@lobehub/lobehub 2.0.0-next.220 → 2.0.0-next.222

package/packages/memory-user-memory/src/extractors/identity.test.ts

@@ -40,14 +40,31 @@ describe('IdentityExtractor', () => {
 
   it('uses structuredCall to invoke the runtime and parse structured results', async () => {
     const extractor = new IdentityExtractor(extractorConfig);
+    // Mock data matching IdentityActionsSchema structure
     const structuredResult = {
-      withIdentities: {
-        actions: {
-          add: [{ description: 'New identity', extractedLabels: ['tag'], type: 'personal' }],
-          remove: null,
-          update: null,
+      add: [
+        {
+          details: null,
+          memoryCategory: 'personal',
+          memoryLayer: 'identity',
+          memoryType: 'fact',
+          summary: 'New identity summary',
+          tags: ['tag'],
+          title: 'New identity',
+          withIdentity: {
+            description: 'New identity description',
+            episodicDate: null,
+            extractedLabels: ['tag'],
+            relationship: 'self',
+            role: 'developer',
+            scoreConfidence: 0.8,
+            sourceEvidence: null,
+            type: 'personal',
+          },
         },
-      },
+      ],
+      remove: null,
+      update: null,
     };
     (runtimeMock.generateObject as any) = vi.fn().mockResolvedValue(structuredResult);
 

package/packages/memory-user-memory/src/extractors/preference.test.ts

@@ -3,7 +3,7 @@ import type { ModelRuntime } from '@lobechat/model-runtime';
 import { readFile } from 'node:fs/promises';
 import { beforeEach, describe, expect, it, vi } from 'vitest';
 
-import { MEMORY_CATEGORIES, memoryTypeValues } from '../schemas';
+import { memoryTypeValues } from '../schemas';
 import type { ExtractorTemplateProps } from '../types';
 import { PreferenceExtractor } from './preference';
 
@@ -40,7 +40,8 @@ describe('PreferenceExtractor', () => {
 
     expect(memories.type).toBe('array');
     expect(memoryItem.properties.memoryLayer.const).toBe('preference');
-    expect(memoryItem.properties.memoryCategory.enum).toEqual(MEMORY_CATEGORIES);
+    // memoryCategory is a plain string in schema, not an enum
+    expect(memoryItem.properties.memoryCategory.type).toBe('string');
     expect(memoryItem.properties.memoryType.enum).toEqual(memoryTypeValues);
     expect((schema?.schema as any).additionalProperties).toBe(false);
   });

package/packages/memory-user-memory/vitest.config.ts

@@ -1,7 +1,11 @@
+import { resolve } from 'node:path';
 import { defineConfig } from 'vitest/config';
 
 export default defineConfig({
   test: {
+    alias: {
+      '@': resolve(__dirname, '../../src'),
+    },
     coverage: {
       reporter: ['text', 'json', 'lcov', 'text-summary'],
     },

package/packages/model-runtime/src/providers/replicate/index.ts

@@ -160,7 +160,7 @@ export class LobeReplicateAI implements LobeRuntimeAI {
             '[Replicate createImage] Local URL detected, will fetch and upload as data',
           );
           try {
-            const { ssrfSafeFetch } = await import('ssrf-safe-fetch');
+            const { ssrfSafeFetch } = await import('@lobechat/ssrf-safe-fetch');
             const imageResponse = await ssrfSafeFetch(imageUrl);
             if (!imageResponse.ok) {
               throw new Error(

package/packages/ssrf-safe-fetch/index.test.ts

@@ -117,7 +117,7 @@ describe('ssrfSafeFetch', () => {
     });
 
     it('should allow private IPs when SSRF_ALLOW_PRIVATE_IP_ADDRESS is true', async () => {
-      process.env.SSRF_ALLOW_PRIVATE_IP_ADDRESS = 'true';
+      process.env.SSRF_ALLOW_PRIVATE_IP_ADDRESS = '1';
 
       const mockResponse = createMockResponse();
       mockFetch.mockResolvedValue(mockResponse);
@@ -277,7 +277,7 @@ describe('ssrfSafeFetch', () => {
   describe('integration scenarios', () => {
     it('should work with complex request configurations', async () => {
       process.env.SSRF_ALLOW_IP_ADDRESS_LIST = '127.0.0.1';
-      process.env.SSRF_ALLOW_PRIVATE_IP_ADDRESS = 'true';
+      process.env.SSRF_ALLOW_PRIVATE_IP_ADDRESS = '1';
 
       const mockResponse = createMockResponse({
         // @ts-ignore

package/packages/ssrf-safe-fetch/package.json

@@ -1,5 +1,5 @@
 {
-  "name": "ssrf-safe-fetch",
+  "name": "@lobechat/ssrf-safe-fetch",
   "version": "1.0.0",
   "private": true,
   "description": "SSRF-safe fetch implementation with browser/node conditional exports",
@@ -12,7 +12,8 @@
   },
   "main": "index.ts",
   "scripts": {
-    "test": "vitest run"
+    "test": "vitest run",
+    "test:coverage": "vitest --coverage --silent='passed-only'"
   },
   "dependencies": {
     "node-fetch": "^3.3.2",

package/packages/types/src/serverConfig.ts

@@ -49,7 +49,9 @@ export type ServerLanguageModel = Partial<Record<GlobalLLMProviderKey, ServerMod
 export interface GlobalServerConfig {
   aiProvider: ServerLanguageModel;
   defaultAgent?: PartialDeep<UserDefaultAgent>;
+  enableEmailVerification?: boolean;
   enableKlavis?: boolean;
+  enableMagicLink?: boolean;
   enableMarketTrustedClient?: boolean;
   enableUploadFileToServer?: boolean;
   enabledAccessCode?: boolean;

package/packages/utils/package.json

@@ -34,7 +34,7 @@
     "remark": "^15.0.1",
     "remark-gfm": "^4.0.1",
     "remark-html": "^16.0.1",
-    "ssrf-safe-fetch": "workspace:*",
+    "@lobechat/ssrf-safe-fetch": "workspace:*",
     "tokenx": "^1.2.1",
     "ua-parser-js": "^1.0.41",
     "uuid": "^11.1.0",

package/packages/utils/src/client/xor-obfuscation.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from 'vitest';
 
-import { SECRET_XOR_KEY } from '@/const/auth';
+import { SECRET_XOR_KEY } from '@/envs/auth';
 
 import { obfuscatePayloadWithXOR } from './xor-obfuscation';
 
@@ -8,7 +8,7 @@ describe('xor-obfuscation', () => {
   describe('obfuscatePayloadWithXOR', () => {
     it('应该对简单字符串进行混淆并返回Base64字符串', () => {
       const payload = 'hello world';
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -22,7 +22,7 @@ describe('xor-obfuscation', () => {
 
     it('应该对JSON对象进行混淆', () => {
       const payload = { name: 'test', value: 123, active: true };
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -33,7 +33,7 @@ describe('xor-obfuscation', () => {
 
     it('应该对数组进行混淆', () => {
       const payload = [1, 2, 3, 'test', { nested: true }];
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -58,7 +58,7 @@ describe('xor-obfuscation', () => {
         tokens: ['abc123', 'def456'],
         metadata: null,
       };
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -69,8 +69,8 @@ describe('xor-obfuscation', () => {
 
     it('相同的输入应该产生相同的输出', () => {
       const payload = { test: 'consistent' };
-      const result1 = obfuscatePayloadWithXOR(payload);
-      const result2 = obfuscatePayloadWithXOR(payload);
+      const result1 = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
+      const result2 = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       expect(result1).toBe(result2);
     });
@@ -79,15 +79,15 @@ describe('xor-obfuscation', () => {
       const payload1 = { test: 'value1' };
       const payload2 = { test: 'value2' };
 
-      const result1 = obfuscatePayloadWithXOR(payload1);
-      const result2 = obfuscatePayloadWithXOR(payload2);
+      const result1 = obfuscatePayloadWithXOR(payload1, SECRET_XOR_KEY);
+      const result2 = obfuscatePayloadWithXOR(payload2, SECRET_XOR_KEY);
 
       expect(result1).not.toBe(result2);
     });
 
     it('应该处理包含特殊字符的字符串', () => {
       const payload = 'Hello! @#$%^&*()_+-=[]{}|;:,.<>?/~`"\'\\';
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -98,7 +98,7 @@ describe('xor-obfuscation', () => {
 
     it('应该处理包含Unicode字符的字符串', () => {
       const payload = '你好世界 🌍 émojis 日本語 한국어';
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -109,7 +109,7 @@ describe('xor-obfuscation', () => {
 
     it('应该处理空字符串', () => {
       const payload = '';
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -120,7 +120,7 @@ describe('xor-obfuscation', () => {
 
     it('应该处理空对象', () => {
       const payload = {};
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -130,7 +130,7 @@ describe('xor-obfuscation', () => {
     });
 
     it('应该处理空数组', () => {
-      const result = obfuscatePayloadWithXOR([]);
+      const result = obfuscatePayloadWithXOR([], SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -141,7 +141,7 @@ describe('xor-obfuscation', () => {
 
     it('应该处理null值', () => {
       const payload = null;
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -152,7 +152,7 @@ describe('xor-obfuscation', () => {
 
     it('应该处理数字', () => {
       const payload = 42;
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -165,8 +165,8 @@ describe('xor-obfuscation', () => {
       const payloadTrue = true;
       const payloadFalse = false;
 
-      const resultTrue = obfuscatePayloadWithXOR(payloadTrue);
-      const resultFalse = obfuscatePayloadWithXOR(payloadFalse);
+      const resultTrue = obfuscatePayloadWithXOR(payloadTrue, SECRET_XOR_KEY);
+      const resultFalse = obfuscatePayloadWithXOR(payloadFalse, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof resultTrue).toBe('string');
@@ -189,7 +189,7 @@ describe('xor-obfuscation', () => {
         tab: 'col1\tcol2',
         unicode: '\u0041\u0042\u0043',
       };
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -200,7 +200,7 @@ describe('xor-obfuscation', () => {
 
     it('应该处理很长的字符串', () => {
       const payload = 'a'.repeat(10000);
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -216,8 +216,8 @@ describe('xor-obfuscation', () => {
       const shortPayload = 'short';
       const longPayload = 'this is a much longer string that should produce different output';
 
-      const shortResult = obfuscatePayloadWithXOR(shortPayload);
-      const longResult = obfuscatePayloadWithXOR(longPayload);
+      const shortResult = obfuscatePayloadWithXOR(shortPayload, SECRET_XOR_KEY);
+      const longResult = obfuscatePayloadWithXOR(longPayload, SECRET_XOR_KEY);
 
       // 较长的输入应该产生较长的输出
       expect(longResult.length).toBeGreaterThan(shortResult.length);
@@ -225,7 +225,7 @@ describe('xor-obfuscation', () => {
 
     it('应该验证输出是有效的Base64格式', () => {
       const payload = { test: 'base64 validation' };
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证Base64格式的正则表达式
       const base64Regex = /^[A-Za-z0-9+/]*={0,2}$/;
@@ -242,14 +242,14 @@ describe('xor-obfuscation', () => {
         },
       };
 
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
       expect(typeof result).toBe('string');
       expect(() => atob(result)).not.toThrow();
     });
 
     it('应该对undefined值进行处理', () => {
       const payload = undefined;
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
 
       // 验证返回值是字符串
       expect(typeof result).toBe('string');
@@ -268,7 +268,7 @@ describe('xor-obfuscation', () => {
         value: 123,
       };
 
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
       expect(typeof result).toBe('string');
       expect(() => atob(result)).not.toThrow();
     });
@@ -279,7 +279,7 @@ describe('xor-obfuscation', () => {
 
       // 多次运行相同输入
       for (let i = 0; i < 10; i++) {
-        results.push(obfuscatePayloadWithXOR(payload));
+        results.push(obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY));
       }
 
       // 所有结果应该相同
@@ -293,7 +293,7 @@ describe('xor-obfuscation', () => {
         name: 'date test',
       };
 
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
       expect(typeof result).toBe('string');
       expect(() => atob(result)).not.toThrow();
     });
@@ -306,7 +306,7 @@ describe('xor-obfuscation', () => {
         normalKey: 'normal value',
       };
 
-      const result = obfuscatePayloadWithXOR(payload);
+      const result = obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY);
       expect(typeof result).toBe('string');
       expect(() => atob(result)).not.toThrow();
     });
@@ -314,7 +314,7 @@ describe('xor-obfuscation', () => {
     it('应该验证混淆后的数据长度合理性', () => {
       const originalPayload = { test: 'length check' };
       const originalJSON = JSON.stringify(originalPayload);
-      const result = obfuscatePayloadWithXOR(originalPayload);
+      const result = obfuscatePayloadWithXOR(originalPayload, SECRET_XOR_KEY);
 
       // Base64 编码后的长度通常是原始长度的 4/3 倍（向上取整到4的倍数）
       const expectedMinLength = Math.ceil((originalJSON.length * 4) / 3 / 4) * 4;
@@ -323,7 +323,7 @@ describe('xor-obfuscation', () => {
 
     it('应该验证XOR操作的正确性（通过逆向操作）', () => {
       const originalPayload = { message: 'XOR test', value: 42 };
-      const obfuscatedResult = obfuscatePayloadWithXOR(originalPayload);
+      const obfuscatedResult = obfuscatePayloadWithXOR(originalPayload, SECRET_XOR_KEY);
 
       // 手动实现逆向操作来验证 XOR 操作的正确性
       const base64Decoded = atob(obfuscatedResult);
@@ -357,7 +357,7 @@ describe('xor-obfuscation', () => {
         [4, 5, 6],
       ];
 
-      const results = payloads.map((payload) => obfuscatePayloadWithXOR(payload));
+      const results = payloads.map((payload) => obfuscatePayloadWithXOR(payload, SECRET_XOR_KEY));
 
       // 验证所有结果都不相同
       for (let i = 0; i < results.length; i++) {

package/packages/utils/src/client/xor-obfuscation.ts

@@ -1,5 +1,3 @@
-import { SECRET_XOR_KEY } from '@/const/auth';
-
 /**
  * Convert string to Uint8Array (UTF-8 encoding)
  */
@@ -24,12 +22,13 @@ const xorProcess = (data: Uint8Array, key: Uint8Array): Uint8Array => {
 /**
  * Obfuscate payload with XOR and encode to Base64
  * @param payload The JSON object to obfuscate
+ * @param secretKey The key used for XOR obfuscation
  * @returns The obfuscated string encoded in Base64
  */
-export const obfuscatePayloadWithXOR = <T>(payload: T): string => {
+export const obfuscatePayloadWithXOR = <T>(payload: T, secretKey: string): string => {
   const jsonString = JSON.stringify(payload);
   const dataBytes = stringToUint8Array(jsonString);
-  const keyBytes = stringToUint8Array(SECRET_XOR_KEY);
+  const keyBytes = stringToUint8Array(secretKey);
 
   const xoredBytes = xorProcess(dataBytes, keyBytes);
 

package/packages/utils/src/imageToBase64.ts

@@ -48,7 +48,7 @@ export const imageUrlToBase64 = async (
 
     // Use SSRF-safe fetch on server-side to prevent SSRF attacks
     const res = isServer
-      ? await import('ssrf-safe-fetch').then((m) => m.ssrfSafeFetch(imageUrl))
+      ? await import('@lobechat/ssrf-safe-fetch').then((m) => m.ssrfSafeFetch(imageUrl))
       : await fetch(imageUrl);
 
     const blob = await res.blob();

package/packages/utils/src/server/__tests__/auth.test.ts

@@ -7,7 +7,7 @@ let mockEnableBetterAuth = false;
 let mockEnableClerk = false;
 let mockEnableNextAuth = false;
 
-vi.mock('@/const/auth', () => ({
+vi.mock('@/envs/auth', () => ({
   get enableBetterAuth() {
     return mockEnableBetterAuth;
   },

package/packages/utils/src/server/auth.ts

@@ -1,6 +1,6 @@
 import { headers } from 'next/headers';
 
-import { enableBetterAuth, enableClerk, enableNextAuth } from '@/const/auth';
+import { enableBetterAuth, enableClerk, enableNextAuth } from '@/envs/auth';
 
 export const getUserAuth = async () => {
   if (enableClerk) {

package/packages/utils/src/server/xor.test.ts

@@ -1,5 +1,7 @@
 import { describe, expect, it } from 'vitest';
 
+import { SECRET_XOR_KEY } from '@/envs/auth';
+
 import { obfuscatePayloadWithXOR } from '../client/xor-obfuscation';
 import { getXorPayload } from './xor';
 
@@ -12,7 +14,7 @@ describe('getXorPayload', () => {
     };
 
     // 使用客户端的混淆函数生成token
-    const obfuscatedToken = obfuscatePayloadWithXOR(originalPayload);
+    const obfuscatedToken = obfuscatePayloadWithXOR(originalPayload, SECRET_XOR_KEY);
 
     // 使用服务端的解码函数解码
     const decodedPayload = getXorPayload(obfuscatedToken);
@@ -25,7 +27,7 @@ describe('getXorPayload', () => {
       userId: '12345',
     };
 
-    const obfuscatedToken = obfuscatePayloadWithXOR(originalPayload);
+    const obfuscatedToken = obfuscatePayloadWithXOR(originalPayload, SECRET_XOR_KEY);
     const decodedPayload = getXorPayload(obfuscatedToken);
 
     expect(decodedPayload).toEqual(originalPayload);
@@ -40,7 +42,7 @@ describe('getXorPayload', () => {
       awsSessionToken: 'session-token-example',
     };
 
-    const obfuscatedToken = obfuscatePayloadWithXOR(originalPayload);
+    const obfuscatedToken = obfuscatePayloadWithXOR(originalPayload, SECRET_XOR_KEY);
     const decodedPayload = getXorPayload(obfuscatedToken);
 
     expect(decodedPayload).toEqual(originalPayload);
@@ -54,7 +56,7 @@ describe('getXorPayload', () => {
       azureApiVersion: '2024-02-15-preview',
     };
 
-    const obfuscatedToken = obfuscatePayloadWithXOR(originalPayload);
+    const obfuscatedToken = obfuscatePayloadWithXOR(originalPayload, SECRET_XOR_KEY);
     const decodedPayload = getXorPayload(obfuscatedToken);
 
     expect(decodedPayload).toEqual(originalPayload);
@@ -67,7 +69,7 @@ describe('getXorPayload', () => {
       cloudflareBaseURLOrAccountID: 'account-id-example',
     };
 
-    const obfuscatedToken = obfuscatePayloadWithXOR(originalPayload);
+    const obfuscatedToken = obfuscatePayloadWithXOR(originalPayload, SECRET_XOR_KEY);
     const decodedPayload = getXorPayload(obfuscatedToken);
 
     expect(decodedPayload).toEqual(originalPayload);
@@ -76,7 +78,7 @@ describe('getXorPayload', () => {
   it('should handle empty payload correctly', () => {
     const originalPayload = {};
 
-    const obfuscatedToken = obfuscatePayloadWithXOR(originalPayload);
+    const obfuscatedToken = obfuscatePayloadWithXOR(originalPayload, SECRET_XOR_KEY);
     const decodedPayload = getXorPayload(obfuscatedToken);
 
     expect(decodedPayload).toEqual(originalPayload);
@@ -89,7 +91,7 @@ describe('getXorPayload', () => {
       apiKey: 'test-key',
     };
 
-    const obfuscatedToken = obfuscatePayloadWithXOR(originalPayload);
+    const obfuscatedToken = obfuscatePayloadWithXOR(originalPayload, SECRET_XOR_KEY);
     const decodedPayload = getXorPayload(obfuscatedToken);
 
     expect(decodedPayload).toEqual(originalPayload);

package/packages/utils/src/server/xor.ts

@@ -1,6 +1,6 @@
 import { ClientSecretPayload } from '@lobechat/types';
 
-import { SECRET_XOR_KEY } from '@/const/auth';
+import { SECRET_XOR_KEY } from '@/envs/auth';
 
 /**
  * Convert Base64 string to Uint8Array

package/packages/web-crawler/package.json

@@ -13,7 +13,7 @@
     "happy-dom": "^20.0.11",
     "node-html-markdown": "^1.3.0",
     "query-string": "^9.3.1",
-    "ssrf-safe-fetch": "workspace:*",
+    "@lobechat/ssrf-safe-fetch": "workspace:*",
     "url-join": "^5"
   }
 }

package/packages/web-crawler/src/crawImpl/__tests__/naive.test.ts

@@ -13,7 +13,7 @@ vi.mock('../../utils/withTimeout', () => ({
   withTimeout: vi.fn(),
 }));
 
-vi.mock('ssrf-safe-fetch', () => ({
+vi.mock('@lobechat/ssrf-safe-fetch', () => ({
   ssrfSafeFetch: vi.fn(),
 }));
 

package/packages/web-crawler/src/crawImpl/naive.ts

@@ -1,4 +1,4 @@
-import { ssrfSafeFetch } from 'ssrf-safe-fetch';
+import { ssrfSafeFetch } from '@lobechat/ssrf-safe-fetch';
 
 import { CrawlImpl, CrawlSuccessResult } from '../type';
 import { NetworkConnectionError, PageNotFoundError, TimeoutError } from '../utils/errorType';

package/scripts/prebuild.mts

@@ -1,3 +1,4 @@
+import { execSync } from 'node:child_process';
 import * as dotenv from 'dotenv';
 import dotenvExpand from 'dotenv-expand';
 import { existsSync } from 'node:fs';
@@ -14,6 +15,61 @@ if (isDesktop) {
 } else {
   dotenvExpand.expand(dotenv.config());
 }
+
+// Auth flags - use process.env directly for build-time dead code elimination
+const enableClerk =
+  process.env.NEXT_PUBLIC_ENABLE_CLERK_AUTH === '1'
+    ? true
+    : !!process.env.NEXT_PUBLIC_CLERK_PUBLISHABLE_KEY;
+const enableBetterAuth = process.env.NEXT_PUBLIC_ENABLE_BETTER_AUTH === '1';
+const enableNextAuth = process.env.NEXT_PUBLIC_ENABLE_NEXT_AUTH === '1';
+const enableAuth = enableClerk || enableBetterAuth || enableNextAuth || false;
+
+const getCommandVersion = (command: string): string | null => {
+  try {
+    return execSync(`${command} --version`, { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] })
+      .trim()
+      .split('\n')[0];
+  } catch {
+    return null;
+  }
+};
+
+const printEnvInfo = () => {
+  console.log('\n📋 Build Environment Info:');
+  console.log('─'.repeat(50));
+
+  // Runtime versions
+  console.log(`  Node.js: ${process.version}`);
+  console.log(`  npm: ${getCommandVersion('npm') ?? 'not installed'}`);
+
+  const bunVersion = getCommandVersion('bun');
+  if (bunVersion) console.log(`  bun: ${bunVersion}`);
+
+  const pnpmVersion = getCommandVersion('pnpm');
+  if (pnpmVersion) console.log(`  pnpm: ${pnpmVersion}`);
+
+  // Auth-related env vars
+  console.log('\n  Auth Environment Variables:');
+  console.log(`    NEXT_PUBLIC_AUTH_URL: ${process.env.NEXT_PUBLIC_AUTH_URL ?? '(not set)'}`);
+  console.log(`    NEXTAUTH_URL: ${process.env.NEXTAUTH_URL ?? '(not set)'}`);
+  console.log(`    APP_URL: ${process.env.APP_URL ?? '(not set)'}`);
+  console.log(`    VERCEL_URL: ${process.env.VERCEL_URL ?? '(not set)'}`);
+  console.log(`    AUTH_EMAIL_VERIFICATION: ${process.env.AUTH_EMAIL_VERIFICATION ?? '(not set)'}`);
+  console.log(`    ENABLE_MAGIC_LINK: ${process.env.ENABLE_MAGIC_LINK ?? '(not set)'}`);
+  console.log(`    AUTH_SECRET: ${process.env.AUTH_SECRET ? '✓ set' : '✗ not set'}`);
+  console.log(`    KEY_VAULTS_SECRET: ${process.env.KEY_VAULTS_SECRET ? '✓ set' : '✗ not set'}`);
+
+  // Auth flags
+  console.log('\n  Auth Flags:');
+  console.log(`    enableClerk: ${enableClerk}`);
+  console.log(`    enableBetterAuth: ${enableBetterAuth}`);
+  console.log(`    enableNextAuth: ${enableNextAuth}`);
+  console.log(`    enableAuth: ${enableAuth}`);
+
+  console.log('─'.repeat(50));
+};
+
 // 创建需要排除的特性映射
 /* eslint-disable sort-keys-fix/sort-keys-fix */
 const partialBuildPages = [
@@ -105,8 +161,9 @@ export const runPrebuild = async (targetDir: string = 'src') => {
 const isMainModule = process.argv[1] === fileURLToPath(import.meta.url);
 
 if (isMainModule) {
+  printEnvInfo();
   // 执行删除操作
-  console.log('Starting prebuild cleanup...');
+  console.log('\nStarting prebuild cleanup...');
   await runPrebuild();
   console.log('Prebuild cleanup completed.');
 }

package/src/app/(backend)/api/auth/[...all]/route.ts

@@ -1,6 +1,7 @@
-import { enableBetterAuth, enableNextAuth } from '@lobechat/const';
 import type { NextRequest } from 'next/server';
 
+import { enableBetterAuth, enableNextAuth } from '@/envs/auth';
+
 const createHandler = async () => {
   if (enableBetterAuth) {
     const [{ toNextJsHandler }, { auth }] = await Promise.all([

package/src/app/(backend)/middleware/auth/index.ts

@@ -8,15 +8,15 @@ import { ChatErrorType, type ClientSecretPayload } from '@lobechat/types';
 import { getXorPayload } from '@lobechat/utils/server';
 import { type NextRequest } from 'next/server';
 
+import { getServerDB } from '@/database/core/db-adaptor';
+import { type LobeChatDatabase } from '@/database/type';
 import {
   LOBE_CHAT_AUTH_HEADER,
   LOBE_CHAT_OIDC_AUTH_HEADER,
   OAUTH_AUTHORIZED,
   enableBetterAuth,
   enableClerk,
-} from '@/const/auth';
-import { getServerDB } from '@/database/core/db-adaptor';
-import { type LobeChatDatabase } from '@/database/type';
+} from '@/envs/auth';
 import { ClerkAuth } from '@/libs/clerk-auth';
 import { validateOIDCJWT } from '@/libs/oidc-provider/jwt';
 import { createErrorResponse } from '@/utils/errorResponse';

package/src/app/(backend)/middleware/auth/utils.test.ts

@@ -7,7 +7,7 @@ let enableClerkMock = false;
 let enableNextAuthMock = false;
 let enableBetterAuthMock = false;
 
-vi.mock('@/const/auth', async (importOriginal) => {
+vi.mock('@/envs/auth', async (importOriginal) => {
   const data = await importOriginal();
 
   return {