@lobu/gateway 2.8.0

package/dist/auth/agent-metadata-store.js

@@ -0,0 +1,115 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AgentMetadataStore = void 0;
+const core_1 = require("@lobu/core");
+const logger = (0, core_1.createLogger)("agent-metadata-store");
+/**
+ * Store agent metadata in Redis.
+ * Pattern: agent_metadata:{agentId}
+ */
+class AgentMetadataStore extends core_1.BaseRedisStore {
+    constructor(redis) {
+        super({
+            redis,
+            keyPrefix: "agent_metadata",
+            loggerName: "agent-metadata-store",
+        });
+    }
+    /**
+     * Create a new agent with metadata
+     */
+    async createAgent(agentId, name, platform, userId, options) {
+        const metadata = {
+            agentId,
+            name,
+            owner: { platform, userId },
+            isWorkspaceAgent: options === null || options === void 0 ? void 0 : options.isWorkspaceAgent,
+            workspaceId: options === null || options === void 0 ? void 0 : options.workspaceId,
+            parentConnectionId: options === null || options === void 0 ? void 0 : options.parentConnectionId,
+            createdAt: Date.now(),
+        };
+        if (options === null || options === void 0 ? void 0 : options.description) {
+            metadata.description = options.description;
+        }
+        const key = this.buildKey(agentId);
+        await this.set(key, metadata);
+        // Index sandbox under its parent connection
+        if (options === null || options === void 0 ? void 0 : options.parentConnectionId) {
+            await this.redis.sadd(`sandboxes:connection:${options.parentConnectionId}`, agentId);
+        }
+        logger.info(`Created agent metadata for ${agentId}: "${name}"`);
+        return metadata;
+    }
+    /**
+     * Get metadata for an agent
+     */
+    async getMetadata(agentId) {
+        const key = this.buildKey(agentId);
+        return this.get(key);
+    }
+    /**
+     * Update agent metadata (partial update)
+     */
+    async updateMetadata(agentId, updates) {
+        const existing = await this.getMetadata(agentId);
+        if (!existing) {
+            logger.warn(`Cannot update metadata: agent ${agentId} not found`);
+            return;
+        }
+        const updated = Object.assign(Object.assign({}, existing), updates);
+        const key = this.buildKey(agentId);
+        await this.set(key, updated);
+        logger.info(`Updated metadata for agent ${agentId}`);
+    }
+    /**
+     * Delete agent metadata
+     */
+    async deleteAgent(agentId) {
+        // Clean up sandbox index if this agent has a parent connection
+        const metadata = await this.getMetadata(agentId);
+        if (metadata === null || metadata === void 0 ? void 0 : metadata.parentConnectionId) {
+            await this.redis.srem(`sandboxes:connection:${metadata.parentConnectionId}`, agentId);
+        }
+        const key = this.buildKey(agentId);
+        await this.delete(key);
+        logger.info(`Deleted metadata for agent ${agentId}`);
+    }
+    /**
+     * Check if agent exists
+     */
+    async hasAgent(agentId) {
+        const key = this.buildKey(agentId);
+        return this.exists(key);
+    }
+    /**
+     * List sandbox agents belonging to a connection
+     */
+    async listSandboxes(connectionId) {
+        const agentIds = await this.redis.smembers(`sandboxes:connection:${connectionId}`);
+        const sandboxes = [];
+        for (const agentId of agentIds) {
+            const data = await this.getMetadata(agentId);
+            if (data)
+                sandboxes.push(data);
+        }
+        sandboxes.sort((a, b) => { var _a, _b; return ((_a = b.lastUsedAt) !== null && _a !== void 0 ? _a : 0) - ((_b = a.lastUsedAt) !== null && _b !== void 0 ? _b : 0); });
+        return sandboxes;
+    }
+    /**
+     * List all agents in the system, sorted by lastUsedAt descending
+     */
+    async listAllAgents() {
+        const prefix = `${this.keyPrefix}:`;
+        const keys = await this.scanByPrefix(prefix);
+        const agents = [];
+        for (const key of keys) {
+            const data = await this.get(key);
+            if (data)
+                agents.push(data);
+        }
+        agents.sort((a, b) => { var _a, _b; return ((_a = b.lastUsedAt) !== null && _a !== void 0 ? _a : 0) - ((_b = a.lastUsedAt) !== null && _b !== void 0 ? _b : 0); });
+        return agents;
+    }
+}
+exports.AgentMetadataStore = AgentMetadataStore;
+//# sourceMappingURL=agent-metadata-store.js.map

package/dist/auth/agent-metadata-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-metadata-store.js","sourceRoot":"","sources":["../../src/auth/agent-metadata-store.ts"],"names":[],"mappings":";;;AAAA,qCAA0D;AAG1D,MAAM,MAAM,GAAG,IAAA,mBAAY,EAAC,sBAAsB,CAAC,CAAC;AAwBpD;;;GAGG;AACH,MAAa,kBAAmB,SAAQ,qBAA6B;IACnE,YAAY,KAAY;QACtB,KAAK,CAAC;YACJ,KAAK;YACL,SAAS,EAAE,gBAAgB;YAC3B,UAAU,EAAE,sBAAsB;SACnC,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CACf,OAAe,EACf,IAAY,EACZ,QAAgB,EAChB,MAAc,EACd,OAKC;QAED,MAAM,QAAQ,GAAkB;YAC9B,OAAO;YACP,IAAI;YACJ,KAAK,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE;YAC3B,gBAAgB,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,gBAAgB;YAC3C,WAAW,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW;YACjC,kBAAkB,EAAE,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,kBAAkB;YAC/C,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QAEF,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,WAAW,EAAE,CAAC;YACzB,QAAQ,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QAC7C,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAE9B,4CAA4C;QAC5C,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,kBAAkB,EAAE,CAAC;YAChC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CACnB,wBAAwB,OAAO,CAAC,kBAAkB,EAAE,EACpD,OAAO,CACR,CAAC;QACJ,CAAC;QAED,MAAM,CAAC,IAAI,CAAC,8BAA8B,OAAO,MAAM,IAAI,GAAG,CAAC,CAAC;QAChE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAClB,OAAe,EACf,OAA4E;QAE5E,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,CAAC,iCAAiC,OAAO,YAAY,CAAC,CAAC;YAClE,OAAO;QACT,CAAC;QAED,MAAM,OAAO,mCAAuB,QAAQ,GAAK,OAAO,CAAE,CAAC;QAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QAC7B,MAAM,CAAC,IAAI,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,WAAW,CAAC,OAAe;QAC/B,+DAA+D;QAC/D,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,kBAAkB,EAAE,CAAC;YACjC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CACnB,wBAAwB,QAAQ,CAAC,kBAAkB,EAAE,EACrD,OAAO,CACR,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,8BAA8B,OAAO,EAAE,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACnC,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa,CAAC,YAAoB;QACtC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,QAAQ,CACxC,wBAAwB,YAAY,EAAE,CACvC,CAAC;QACF,MAAM,SAAS,GAAoB,EAAE,CAAC;QACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC;YAC7C,IAAI,IAAI;gBAAE,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,eAAC,OAAA,CAAC,MAAA,CAAC,CAAC,UAAU,mCAAI,CAAC,CAAC,GAAG,CAAC,MAAA,CAAC,CAAC,UAAU,mCAAI,CAAC,CAAC,CAAA,EAAA,CAAC,CAAC;QACpE,OAAO,SAAS,CAAC;IACnB,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,aAAa;QACjB,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,CAAC;QACpC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAoB,EAAE,CAAC;QACnC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACjC,IAAI,IAAI;gBAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,eAAC,OAAA,CAAC,MAAA,CAAC,CAAC,UAAU,mCAAI,CAAC,CAAC,GAAG,CAAC,MAAA,CAAC,CAAC,UAAU,mCAAI,CAAC,CAAC,CAAA,EAAA,CAAC,CAAC;QACjE,OAAO,MAAM,CAAC;IAChB,CAAC;CACF;AAxID,gDAwIC"}

package/dist/auth/api-auth-middleware.d.ts

@@ -0,0 +1,19 @@
+import type { Context, Next } from "hono";
+import type { CliTokenService } from "./cli/token-service";
+import type { ExternalAuthClient } from "./external/client";
+export declare const TOKEN_EXPIRATION_MS: number;
+/**
+ * Creates a Hono middleware that enforces the standard auth check:
+ *   1. Settings session cookie  2. CLI JWT  3. External OAuth  4. Admin password  5. Worker token
+ */
+export declare function createApiAuthMiddleware(opts: {
+    adminPassword?: string;
+    cliTokenService?: CliTokenService;
+    externalAuthClient?: ExternalAuthClient;
+    allowWorkerToken?: boolean;
+    allowSettingsSession?: boolean;
+}): (c: Context, next: Next) => Promise<void | (Response & import("hono").TypedResponse<{
+    success: false;
+    error: string;
+}, 401, "json">)>;
+//# sourceMappingURL=api-auth-middleware.d.ts.map

package/dist/auth/api-auth-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-auth-middleware.d.ts","sourceRoot":"","sources":["../../src/auth/api-auth-middleware.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE1C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAE5D,eAAO,MAAM,mBAAmB,QAAsB,CAAC;AAEvD;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE;IAC5C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,IACe,GAAG,OAAO,EAAE,MAAM,IAAI;;;kBAgDrC"}

package/dist/auth/api-auth-middleware.js

@@ -0,0 +1,61 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TOKEN_EXPIRATION_MS = void 0;
+exports.createApiAuthMiddleware = createApiAuthMiddleware;
+const node_crypto_1 = require("node:crypto");
+const core_1 = require("@lobu/core");
+const settings_auth_1 = require("../routes/public/settings-auth");
+exports.TOKEN_EXPIRATION_MS = 24 * 60 * 60 * 1000;
+/**
+ * Creates a Hono middleware that enforces the standard auth check:
+ *   1. Settings session cookie  2. CLI JWT  3. External OAuth  4. Admin password  5. Worker token
+ */
+function createApiAuthMiddleware(opts) {
+    return async (c, next) => {
+        // 1. Try settings session cookie when explicitly allowed.
+        if (opts.allowSettingsSession && (0, settings_auth_1.verifySettingsSession)(c))
+            return next();
+        const authHeader = c.req.header("Authorization");
+        if (!authHeader || !authHeader.startsWith("Bearer ")) {
+            return c.json({ success: false, error: "Unauthorized" }, 401);
+        }
+        const token = authHeader.substring(7);
+        // 2. Try CLI JWT
+        if (opts.cliTokenService) {
+            const identity = await opts.cliTokenService.verifyAccessToken(token);
+            if (identity)
+                return next();
+        }
+        // 3. Try external OAuth token (validated against MEMORY_URL userinfo)
+        if (opts.externalAuthClient) {
+            try {
+                const userInfo = await opts.externalAuthClient.fetchUserInfo(token);
+                if (userInfo === null || userInfo === void 0 ? void 0 : userInfo.sub)
+                    return next();
+            }
+            catch (_a) {
+                // Token not valid for external auth, continue to next method
+            }
+        }
+        // 4. Try admin password
+        if (opts.adminPassword) {
+            const a = Buffer.from(token);
+            const b = Buffer.from(opts.adminPassword);
+            if (a.length === b.length && (0, node_crypto_1.timingSafeEqual)(a, b)) {
+                return next();
+            }
+        }
+        // 5. Try worker token when explicitly allowed for the route
+        if (opts.allowWorkerToken !== false) {
+            const workerData = (0, core_1.verifyWorkerToken)(token);
+            if (workerData) {
+                const tokenAge = Date.now() - workerData.timestamp;
+                if (tokenAge <= exports.TOKEN_EXPIRATION_MS) {
+                    return next();
+                }
+            }
+        }
+        return c.json({ success: false, error: "Unauthorized" }, 401);
+    };
+}
+//# sourceMappingURL=api-auth-middleware.js.map

package/dist/auth/api-auth-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-auth-middleware.js","sourceRoot":"","sources":["../../src/auth/api-auth-middleware.ts"],"names":[],"mappings":";;;AAaA,0DAuDC;AApED,6CAA8C;AAC9C,qCAA+C;AAE/C,kEAAuE;AAI1D,QAAA,mBAAmB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvD;;;GAGG;AACH,SAAgB,uBAAuB,CAAC,IAMvC;IACC,OAAO,KAAK,EAAE,CAAU,EAAE,IAAU,EAAE,EAAE;QACtC,0DAA0D;QAC1D,IAAI,IAAI,CAAC,oBAAoB,IAAI,IAAA,qCAAqB,EAAC,CAAC,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAEzE,MAAM,UAAU,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACrD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAEtC,iBAAiB;QACjB,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,eAAe,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC;YACrE,IAAI,QAAQ;gBAAE,OAAO,IAAI,EAAE,CAAC;QAC9B,CAAC;QAED,sEAAsE;QACtE,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,kBAAkB,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBACpE,IAAI,QAAQ,aAAR,QAAQ,uBAAR,QAAQ,CAAE,GAAG;oBAAE,OAAO,IAAI,EAAE,CAAC;YACnC,CAAC;YAAC,WAAM,CAAC;gBACP,6DAA6D;YAC/D,CAAC;QACH,CAAC;QAED,wBAAwB;QACxB,IAAI,IAAI,CAAC,aAAa,EAAE,CAAC;YACvB,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAC1C,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,IAAA,6BAAe,EAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC;gBACnD,OAAO,IAAI,EAAE,CAAC;YAChB,CAAC;QACH,CAAC;QAED,4DAA4D;QAC5D,IAAI,IAAI,CAAC,gBAAgB,KAAK,KAAK,EAAE,CAAC;YACpC,MAAM,UAAU,GAAG,IAAA,wBAAiB,EAAC,KAAK,CAAC,CAAC;YAC5C,IAAI,UAAU,EAAE,CAAC;gBACf,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC;gBACnD,IAAI,QAAQ,IAAI,2BAAmB,EAAE,CAAC;oBACpC,OAAO,IAAI,EAAE,CAAC;gBAChB,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,GAAG,CAAC,CAAC;IAChE,CAAC,CAAC;AACJ,CAAC"}

package/dist/auth/api-key-provider-module.d.ts

@@ -0,0 +1,60 @@
+import type { ConfigProviderMeta } from "@lobu/core";
+import type { ModelOption } from "../modules/module-system";
+import { BaseProviderModule } from "./base-provider-module";
+import type { AgentSettingsStore } from "./settings/agent-settings-store";
+export interface ApiKeyProviderConfig {
+    providerId: string;
+    providerDisplayName: string;
+    providerIconUrl: string;
+    envVarName: string;
+    apiKeyInstructions: string;
+    apiKeyPlaceholder: string;
+    systemEnvVarName?: string;
+    /** Provider slug for proxy path routing (e.g. "gemini") */
+    slug?: string;
+    /** Upstream base URL for proxy forwarding (e.g. "https://generativelanguage.googleapis.com") */
+    upstreamBaseUrl?: string;
+    /** Explicit base URL env var name (defaults to envVarName with _KEY replaced by _BASE_URL) */
+    baseUrlEnvVarName?: string;
+    /** Relative path to fetch model list (e.g. "/v1/models"). Enables generic model fetching. */
+    modelsEndpoint?: string;
+    /** SDK compatibility — "openai" means OpenAI-compatible format. Also maps OPENAI_BASE_URL in proxy. */
+    sdkCompat?: "openai";
+    /** Default model ID when none is configured */
+    defaultModel?: string;
+    /** Override provider name for model registry lookup */
+    registryAlias?: string;
+    /** Whether to show in "Add Provider" catalog (default: true) */
+    catalogVisible?: boolean;
+    agentSettingsStore: AgentSettingsStore;
+}
+/**
+ * Generic API-key provider module.
+ * Any model provider that only needs a "paste your API key" flow
+ * can be instantiated from this class without writing a full module.
+ *
+ * Config-driven providers (from system-skills.json) set sdkCompat,
+ * defaultModel, and registryAlias to enable dynamic worker model resolution.
+ */
+export declare class ApiKeyProviderModule extends BaseProviderModule {
+    protected readonly apiKeyConfig: ApiKeyProviderConfig;
+    constructor(config: ApiKeyProviderConfig);
+    /**
+     * For openai-compatible providers, also map OPENAI_BASE_URL so the
+     * OpenAI SDK resolves through our proxy.
+     */
+    getProxyBaseUrlMappings(proxyUrl: string, agentId?: string): Record<string, string>;
+    /**
+     * Returns metadata for config-driven providers (sdkCompat, defaultModel, etc.)
+     * so the worker can register them dynamically. Returns null for hardcoded providers.
+     */
+    getProviderMetadata(): ConfigProviderMeta | null;
+    getModelOptions(agentId: string, _userId: string): Promise<ModelOption[]>;
+    /**
+     * Generic model fetcher using Bearer auth. Works with OpenAI-compatible
+     * endpoints ({data:[{id}]}) and Ollama ({models:[{name}]}).
+     */
+    private fetchModelsGeneric;
+    private fetchGeminiModels;
+}
+//# sourceMappingURL=api-key-provider-module.d.ts.map

package/dist/auth/api-key-provider-module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-provider-module.d.ts","sourceRoot":"","sources":["../../src/auth/api-key-provider-module.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iCAAiC,CAAC;AAG1E,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,2DAA2D;IAC3D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,8FAA8F;IAC9F,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,6FAA6F;IAC7F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uGAAuG;IACvG,SAAS,CAAC,EAAE,QAAQ,CAAC;IACrB,+CAA+C;IAC/C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,uDAAuD;IACvD,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gEAAgE;IAChE,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,kBAAkB,EAAE,kBAAkB,CAAC;CACxC;AAED;;;;;;;GAOG;AACH,qBAAa,oBAAqB,SAAQ,kBAAkB;IAC1D,SAAS,CAAC,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;gBAE1C,MAAM,EAAE,oBAAoB;IA4BxC;;;OAGG;IACM,uBAAuB,CAC9B,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAUzB;;;OAGG;IACH,mBAAmB,IAAI,kBAAkB,GAAG,IAAI;IAkB1C,eAAe,CACnB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,WAAW,EAAE,CAAC;IAsBzB;;;OAGG;YACW,kBAAkB;YA8ClB,iBAAiB;CA0BhC"}

package/dist/auth/api-key-provider-module.js

@@ -0,0 +1,148 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApiKeyProviderModule = void 0;
+const base_provider_module_1 = require("./base-provider-module");
+const auth_profiles_manager_1 = require("./settings/auth-profiles-manager");
+/**
+ * Generic API-key provider module.
+ * Any model provider that only needs a "paste your API key" flow
+ * can be instantiated from this class without writing a full module.
+ *
+ * Config-driven providers (from system-skills.json) set sdkCompat,
+ * defaultModel, and registryAlias to enable dynamic worker model resolution.
+ */
+class ApiKeyProviderModule extends base_provider_module_1.BaseProviderModule {
+    constructor(config) {
+        const authProfilesManager = new auth_profiles_manager_1.AuthProfilesManager(config.agentSettingsStore);
+        super({
+            providerId: config.providerId,
+            providerDisplayName: config.providerDisplayName,
+            providerIconUrl: config.providerIconUrl,
+            credentialEnvVarName: config.envVarName,
+            secretEnvVarNames: [config.envVarName],
+            systemEnvVarName: config.systemEnvVarName,
+            slug: config.slug || config.providerId,
+            upstreamBaseUrl: config.upstreamBaseUrl,
+            baseUrlEnvVarName: config.baseUrlEnvVarName ||
+                config.envVarName.replace("_KEY", "_BASE_URL"),
+            authType: "api-key",
+            apiKeyInstructions: config.apiKeyInstructions,
+            apiKeyPlaceholder: config.apiKeyPlaceholder,
+            catalogVisible: config.catalogVisible,
+        }, authProfilesManager);
+        this.apiKeyConfig = config;
+        this.name = `${config.providerId}-api-key`;
+    }
+    /**
+     * For openai-compatible providers, also map OPENAI_BASE_URL so the
+     * OpenAI SDK resolves through our proxy.
+     */
+    getProxyBaseUrlMappings(proxyUrl, agentId) {
+        const mappings = super.getProxyBaseUrlMappings(proxyUrl, agentId);
+        if (this.apiKeyConfig.sdkCompat === "openai") {
+            const slug = this.providerConfig.slug || this.providerId;
+            const base = `${proxyUrl}/${slug}`;
+            mappings.OPENAI_BASE_URL = agentId ? `${base}/a/${agentId}` : base;
+        }
+        return mappings;
+    }
+    /**
+     * Returns metadata for config-driven providers (sdkCompat, defaultModel, etc.)
+     * so the worker can register them dynamically. Returns null for hardcoded providers.
+     */
+    getProviderMetadata() {
+        if (!this.apiKeyConfig.sdkCompat &&
+            !this.apiKeyConfig.defaultModel &&
+            !this.apiKeyConfig.registryAlias) {
+            return null;
+        }
+        return {
+            sdkCompat: this.apiKeyConfig.sdkCompat,
+            defaultModel: this.apiKeyConfig.defaultModel,
+            registryAlias: this.apiKeyConfig.registryAlias,
+            baseUrlEnvVar: this.providerConfig.baseUrlEnvVarName ||
+                this.apiKeyConfig.envVarName.replace("_KEY", "_BASE_URL"),
+        };
+    }
+    async getModelOptions(agentId, _userId) {
+        const key = await this.getCredential(agentId);
+        if (!key)
+            return [];
+        // Gemini uses a non-standard models endpoint with key-in-query auth
+        if (this.providerId === "gemini") {
+            return this.fetchGeminiModels(key);
+        }
+        // Generic modelsEndpoint: supports OpenAI format ({data:[{id}]}) and Ollama format ({models:[{name}]})
+        const modelsEndpoint = this.apiKeyConfig.modelsEndpoint;
+        if (modelsEndpoint && this.apiKeyConfig.upstreamBaseUrl) {
+            return this.fetchModelsGeneric(key, this.apiKeyConfig.upstreamBaseUrl, modelsEndpoint);
+        }
+        return [];
+    }
+    /**
+     * Generic model fetcher using Bearer auth. Works with OpenAI-compatible
+     * endpoints ({data:[{id}]}) and Ollama ({models:[{name}]}).
+     */
+    async fetchModelsGeneric(apiKey, baseUrl, endpoint) {
+        const url = `${baseUrl.replace(/\/$/, "")}${endpoint}`;
+        const response = await fetch(url, {
+            headers: {
+                Accept: "application/json",
+                Authorization: `Bearer ${apiKey}`,
+            },
+        }).catch(() => null);
+        if (!response || !response.ok)
+            return [];
+        const payload = (await response.json().catch(() => ({})));
+        const prefix = this.providerId;
+        // OpenAI format: { data: [{ id: "model-name" }] }
+        if (payload.data && Array.isArray(payload.data)) {
+            return payload.data
+                .map((model) => {
+                var _a;
+                const id = (_a = model.id) === null || _a === void 0 ? void 0 : _a.trim();
+                if (!id)
+                    return null;
+                return { value: `${prefix}/${id}`, label: id };
+            })
+                .filter((item) => Boolean(item));
+        }
+        // Ollama format: { models: [{ name: "model-name", model: "model-name" }] }
+        if (payload.models && Array.isArray(payload.models)) {
+            return payload.models
+                .map((model) => {
+                var _a;
+                const id = (_a = (model.model || model.name)) === null || _a === void 0 ? void 0 : _a.trim();
+                if (!id)
+                    return null;
+                return { value: `${prefix}/${id}`, label: id };
+            })
+                .filter((item) => Boolean(item));
+        }
+        return [];
+    }
+    async fetchGeminiModels(apiKey) {
+        const url = new URL("https://generativelanguage.googleapis.com/v1beta/models");
+        url.searchParams.set("key", apiKey);
+        const response = await fetch(url.toString(), {
+            headers: { Accept: "application/json" },
+        }).catch(() => null);
+        if (!response || !response.ok)
+            return [];
+        const payload = (await response.json().catch(() => ({})));
+        return (payload.models || [])
+            .map((model) => {
+            var _a;
+            const raw = (_a = model.name) === null || _a === void 0 ? void 0 : _a.replace(/^models\//, "").trim();
+            if (!raw)
+                return null;
+            return {
+                value: `gemini/${raw}`,
+                label: model.displayName || raw,
+            };
+        })
+            .filter((item) => Boolean(item));
+    }
+}
+exports.ApiKeyProviderModule = ApiKeyProviderModule;
+//# sourceMappingURL=api-key-provider-module.js.map

package/dist/auth/api-key-provider-module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-key-provider-module.js","sourceRoot":"","sources":["../../src/auth/api-key-provider-module.ts"],"names":[],"mappings":";;;AAEA,iEAA4D;AAE5D,4EAAuE;AA6BvE;;;;;;;GAOG;AACH,MAAa,oBAAqB,SAAQ,yCAAkB;IAG1D,YAAY,MAA4B;QACtC,MAAM,mBAAmB,GAAG,IAAI,2CAAmB,CACjD,MAAM,CAAC,kBAAkB,CAC1B,CAAC;QACF,KAAK,CACH;YACE,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,mBAAmB,EAAE,MAAM,CAAC,mBAAmB;YAC/C,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,oBAAoB,EAAE,MAAM,CAAC,UAAU;YACvC,iBAAiB,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC;YACtC,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,UAAU;YACtC,eAAe,EAAE,MAAM,CAAC,eAAe;YACvC,iBAAiB,EACf,MAAM,CAAC,iBAAiB;gBACxB,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC;YAChD,QAAQ,EAAE,SAAS;YACnB,kBAAkB,EAAE,MAAM,CAAC,kBAAkB;YAC7C,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,EACD,mBAAmB,CACpB,CAAC;QACF,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC;QAC3B,IAAI,CAAC,IAAI,GAAG,GAAG,MAAM,CAAC,UAAU,UAAU,CAAC;IAC7C,CAAC;IAED;;;OAGG;IACM,uBAAuB,CAC9B,QAAgB,EAChB,OAAgB;QAEhB,MAAM,QAAQ,GAAG,KAAK,CAAC,uBAAuB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,YAAY,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC;YACzD,MAAM,IAAI,GAAG,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;YACnC,QAAQ,CAAC,eAAe,GAAG,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QACrE,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;OAGG;IACH,mBAAmB;QACjB,IACE,CAAC,IAAI,CAAC,YAAY,CAAC,SAAS;YAC5B,CAAC,IAAI,CAAC,YAAY,CAAC,YAAY;YAC/B,CAAC,IAAI,CAAC,YAAY,CAAC,aAAa,EAChC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,YAAY,CAAC,SAAS;YACtC,YAAY,EAAE,IAAI,CAAC,YAAY,CAAC,YAAY;YAC5C,aAAa,EAAE,IAAI,CAAC,YAAY,CAAC,aAAa;YAC9C,aAAa,EACX,IAAI,CAAC,cAAc,CAAC,iBAAiB;gBACrC,IAAI,CAAC,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC;SAC5D,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,eAAe,CACnB,OAAe,EACf,OAAe;QAEf,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,CAAC,GAAG;YAAE,OAAO,EAAE,CAAC;QAEpB,oEAAoE;QACpE,IAAI,IAAI,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;YACjC,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACrC,CAAC;QAED,uGAAuG;QACvG,MAAM,cAAc,GAAG,IAAI,CAAC,YAAY,CAAC,cAAc,CAAC;QACxD,IAAI,cAAc,IAAI,IAAI,CAAC,YAAY,CAAC,eAAe,EAAE,CAAC;YACxD,OAAO,IAAI,CAAC,kBAAkB,CAC5B,GAAG,EACH,IAAI,CAAC,YAAY,CAAC,eAAe,EACjC,cAAc,CACf,CAAC;QACJ,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,kBAAkB,CAC9B,MAAc,EACd,OAAe,EACf,QAAgB;QAEhB,MAAM,GAAG,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,OAAO,EAAE;gBACP,MAAM,EAAE,kBAAkB;gBAC1B,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;SACF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QAEzC,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAGvD,CAAC;QAEF,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;QAE/B,kDAAkD;QAClD,IAAI,OAAO,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAChD,OAAO,OAAO,CAAC,IAAI;iBAChB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;;gBACb,MAAM,EAAE,GAAG,MAAA,KAAK,CAAC,EAAE,0CAAE,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC,EAAE;oBAAE,OAAO,IAAI,CAAC;gBACrB,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAwB,CAAC;YACvE,CAAC,CAAC;iBACD,MAAM,CAAC,CAAC,IAAI,EAAuB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,2EAA2E;QAC3E,IAAI,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACpD,OAAO,OAAO,CAAC,MAAM;iBAClB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;;gBACb,MAAM,EAAE,GAAG,MAAA,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,CAAC,0CAAE,IAAI,EAAE,CAAC;gBAC/C,IAAI,CAAC,EAAE;oBAAE,OAAO,IAAI,CAAC;gBACrB,OAAO,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAwB,CAAC;YACvE,CAAC,CAAC;iBACD,MAAM,CAAC,CAAC,IAAI,EAAuB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1D,CAAC;QAED,OAAO,EAAE,CAAC;IACZ,CAAC;IAEO,KAAK,CAAC,iBAAiB,CAAC,MAAc;QAC5C,MAAM,GAAG,GAAG,IAAI,GAAG,CACjB,yDAAyD,CAC1D,CAAC;QACF,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAEpC,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE;YAC3C,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;SACxC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;QACrB,IAAI,CAAC,QAAQ,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,EAAE,CAAC;QAEzC,MAAM,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAEvD,CAAC;QAEF,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;aAC1B,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;;YACb,MAAM,GAAG,GAAG,MAAA,KAAK,CAAC,IAAI,0CAAE,OAAO,CAAC,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACxD,IAAI,CAAC,GAAG;gBAAE,OAAO,IAAI,CAAC;YACtB,OAAO;gBACL,KAAK,EAAE,UAAU,GAAG,EAAE;gBACtB,KAAK,EAAE,KAAK,CAAC,WAAW,IAAI,GAAG;aACV,CAAC;QAC1B,CAAC,CAAC;aACD,MAAM,CAAC,CAAC,IAAI,EAAuB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1D,CAAC;CACF;AA3KD,oDA2KC"}

package/dist/auth/base-provider-module.d.ts

@@ -0,0 +1,70 @@
+import { Hono } from "hono";
+import { BaseModule, type ModelProviderModule, type ProviderUpstreamConfig } from "../modules/module-system";
+import type { AuthProfilesManager } from "./settings/auth-profiles-manager";
+export interface BaseProviderConfig {
+    providerId: string;
+    providerDisplayName: string;
+    providerIconUrl: string;
+    /** Env var name the SDK expects for the API credential (e.g. "ANTHROPIC_API_KEY") */
+    credentialEnvVarName: string;
+    /** All env vars this provider considers secrets */
+    secretEnvVarNames: string[];
+    /** Env var to check for system key (defaults to credentialEnvVarName) */
+    systemEnvVarName?: string;
+    /** Provider slug for proxy path routing (e.g. "anthropic") */
+    slug?: string;
+    /** Upstream base URL for proxy forwarding (e.g. "https://api.anthropic.com") */
+    upstreamBaseUrl?: string;
+    /** Explicit base URL env var name (defaults to slug-derived name) */
+    baseUrlEnvVarName?: string;
+    authType: "oauth" | "device-code" | "api-key";
+    supportedAuthTypes?: ("oauth" | "device-code" | "api-key")[];
+    apiKeyInstructions?: string;
+    apiKeyPlaceholder?: string;
+    catalogDescription?: string;
+    catalogVisible?: boolean;
+}
+/**
+ * Base class for model provider modules.
+ * Implements shared logic: credential lookup, proxy mappings, env var injection,
+ * and Hono app management. Save-key and logout routes are handled by the
+ * parameterized auth router in gateway.ts.
+ *
+ * Subclasses provide a config object and optionally override:
+ * - `setupRoutes(app)` to add provider-specific routes
+ * - `getModelOptions()` for model listing
+ * - `buildEnvVars()` for custom env var injection
+ * - `hasSystemKey()` / `injectSystemKeyFallback()` for multi-env-var logic
+ */
+export declare abstract class BaseProviderModule extends BaseModule implements ModelProviderModule {
+    name: string;
+    providerId: string;
+    providerDisplayName: string;
+    providerIconUrl: string;
+    authType: "oauth" | "device-code" | "api-key";
+    supportedAuthTypes?: ("oauth" | "device-code" | "api-key")[];
+    apiKeyInstructions?: string;
+    apiKeyPlaceholder?: string;
+    catalogDescription?: string;
+    catalogVisible?: boolean;
+    protected readonly providerConfig: BaseProviderConfig;
+    protected readonly authProfilesManager: AuthProfilesManager;
+    protected readonly app: Hono;
+    constructor(config: BaseProviderConfig, authProfilesManager: AuthProfilesManager);
+    isEnabled(): boolean;
+    getSecretEnvVarNames(): string[];
+    getCredentialEnvVarName(): string;
+    getUpstreamConfig(): ProviderUpstreamConfig | null;
+    hasCredentials(agentId: string): Promise<boolean>;
+    hasSystemKey(): boolean;
+    getProxyBaseUrlMappings(proxyUrl: string, agentId?: string): Record<string, string>;
+    injectSystemKeyFallback(envVars: Record<string, string>): Record<string, string>;
+    buildEnvVars(agentId: string, envVars: Record<string, string>): Promise<Record<string, string>>;
+    getApp(): Hono;
+    protected getCredential(agentId: string): Promise<string | null>;
+    /** Build a structured placeholder for proxy mode (default: "lobu-proxy"). */
+    buildCredentialPlaceholder(_agentId: string): Promise<string> | string;
+    /** Override in subclasses to add provider-specific routes. */
+    protected setupRoutes(): void;
+}
+//# sourceMappingURL=base-provider-module.d.ts.map

package/dist/auth/base-provider-module.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-provider-module.d.ts","sourceRoot":"","sources":["../../src/auth/base-provider-module.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,UAAU,EACV,KAAK,mBAAmB,EACxB,KAAK,sBAAsB,EAC5B,MAAM,0BAA0B,CAAC;AAElC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AAI5E,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,qFAAqF;IACrF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mDAAmD;IACnD,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,8DAA8D;IAC9D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,gFAAgF;IAChF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qEAAqE;IACrE,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;IAC9C,kBAAkB,CAAC,EAAE,CAAC,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC,EAAE,CAAC;IAC7D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED;;;;;;;;;;;GAWG;AACH,8BAAsB,kBACpB,SAAQ,UACR,YAAW,mBAAmB;IAE9B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC;IAC9C,kBAAkB,CAAC,EAAE,CAAC,OAAO,GAAG,aAAa,GAAG,SAAS,CAAC,EAAE,CAAC;IAC7D,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,cAAc,CAAC,EAAE,OAAO,CAAC;IAEzB,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,kBAAkB,CAAC;IACtD,SAAS,CAAC,QAAQ,CAAC,mBAAmB,EAAE,mBAAmB,CAAC;IAC5D,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC;gBAG3B,MAAM,EAAE,kBAAkB,EAC1B,mBAAmB,EAAE,mBAAmB;IAqB1C,SAAS,IAAI,OAAO;IAIpB,oBAAoB,IAAI,MAAM,EAAE;IAIhC,uBAAuB,IAAI,MAAM;IAIjC,iBAAiB,IAAI,sBAAsB,GAAG,IAAI;IAU5C,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAOvD,YAAY,IAAI,OAAO;IAOvB,uBAAuB,CACrB,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,MAAM,GACf,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAUzB,uBAAuB,CACrB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;IAYnB,YAAY,CAChB,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC9B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAiBlC,MAAM,IAAI,IAAI;cAIE,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IActE,6EAA6E;IAC7E,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM;IAItE,8DAA8D;IAC9D,SAAS,CAAC,WAAW,IAAI,IAAI;CAG9B"}

package/dist/auth/base-provider-module.js

@@ -0,0 +1,118 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BaseProviderModule = void 0;
+const core_1 = require("@lobu/core");
+const hono_1 = require("hono");
+const module_system_1 = require("../modules/module-system");
+const string_substitution_1 = require("./mcp/string-substitution");
+const logger = (0, core_1.createLogger)("base-provider-module");
+/**
+ * Base class for model provider modules.
+ * Implements shared logic: credential lookup, proxy mappings, env var injection,
+ * and Hono app management. Save-key and logout routes are handled by the
+ * parameterized auth router in gateway.ts.
+ *
+ * Subclasses provide a config object and optionally override:
+ * - `setupRoutes(app)` to add provider-specific routes
+ * - `getModelOptions()` for model listing
+ * - `buildEnvVars()` for custom env var injection
+ * - `hasSystemKey()` / `injectSystemKeyFallback()` for multi-env-var logic
+ */
+class BaseProviderModule extends module_system_1.BaseModule {
+    constructor(config, authProfilesManager) {
+        super();
+        this.providerConfig = config;
+        this.authProfilesManager = authProfilesManager;
+        this.providerId = config.providerId;
+        this.name = `${config.providerId}-provider`;
+        this.providerDisplayName = config.providerDisplayName;
+        this.providerIconUrl = config.providerIconUrl;
+        this.authType = config.authType;
+        this.supportedAuthTypes = config.supportedAuthTypes;
+        this.apiKeyInstructions = config.apiKeyInstructions;
+        this.apiKeyPlaceholder = config.apiKeyPlaceholder;
+        this.catalogDescription = config.catalogDescription;
+        this.catalogVisible = config.catalogVisible;
+        this.app = new hono_1.Hono();
+        this.setupRoutes();
+    }
+    isEnabled() {
+        return true;
+    }
+    getSecretEnvVarNames() {
+        return this.providerConfig.secretEnvVarNames;
+    }
+    getCredentialEnvVarName() {
+        return this.providerConfig.credentialEnvVarName;
+    }
+    getUpstreamConfig() {
+        const { slug, upstreamBaseUrl, baseUrlEnvVarName } = this.providerConfig;
+        if (!slug || !upstreamBaseUrl)
+            return null;
+        // Check env for base URL override (e.g., ANTHROPIC_BASE_URL=https://api.z.ai)
+        const envOverride = baseUrlEnvVarName
+            ? (0, string_substitution_1.resolveEnv)(baseUrlEnvVarName)
+            : undefined;
+        return { slug, upstreamBaseUrl: envOverride || upstreamBaseUrl };
+    }
+    async hasCredentials(agentId) {
+        return this.authProfilesManager.hasProviderProfiles(agentId, this.providerId);
+    }
+    hasSystemKey() {
+        const envVar = this.providerConfig.systemEnvVarName ||
+            this.providerConfig.credentialEnvVarName;
+        return !!(0, string_substitution_1.resolveEnv)(envVar);
+    }
+    getProxyBaseUrlMappings(proxyUrl, agentId) {
+        const { slug, baseUrlEnvVarName, credentialEnvVarName } = this.providerConfig;
+        if (!slug)
+            return {};
+        const envVar = baseUrlEnvVarName || credentialEnvVarName.replace("_KEY", "_BASE_URL");
+        const base = `${proxyUrl}/${slug}`;
+        return { [envVar]: agentId ? `${base}/a/${agentId}` : base };
+    }
+    injectSystemKeyFallback(envVars) {
+        const credVar = this.providerConfig.credentialEnvVarName;
+        if (!envVars[credVar]) {
+            const sysVar = this.providerConfig.systemEnvVarName || credVar;
+            const systemKey = (0, string_substitution_1.resolveEnv)(sysVar);
+            if (systemKey) {
+                envVars[credVar] = systemKey;
+            }
+        }
+        return envVars;
+    }
+    async buildEnvVars(agentId, envVars) {
+        const credVar = this.providerConfig.credentialEnvVarName;
+        if (!envVars[credVar]) {
+            const profile = await this.authProfilesManager.getBestProfile(agentId, this.providerId);
+            if (profile === null || profile === void 0 ? void 0 : profile.credential) {
+                logger.info(`Injecting ${credVar} for agent ${agentId} (${this.providerId})`);
+                envVars[credVar] = profile.credential;
+            }
+        }
+        return envVars;
+    }
+    getApp() {
+        return this.app;
+    }
+    async getCredential(agentId) {
+        const profile = await this.authProfilesManager.getBestProfile(agentId, this.providerId);
+        if (profile === null || profile === void 0 ? void 0 : profile.credential) {
+            return profile.credential;
+        }
+        const sysVar = this.providerConfig.systemEnvVarName ||
+            this.providerConfig.credentialEnvVarName;
+        return process.env[sysVar] || null;
+    }
+    /** Build a structured placeholder for proxy mode (default: "lobu-proxy"). */
+    buildCredentialPlaceholder(_agentId) {
+        return "lobu-proxy";
+    }
+    /** Override in subclasses to add provider-specific routes. */
+    setupRoutes() {
+        // Default: no extra routes
+    }
+}
+exports.BaseProviderModule = BaseProviderModule;
+//# sourceMappingURL=base-provider-module.js.map

package/dist/auth/base-provider-module.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-provider-module.js","sourceRoot":"","sources":["../../src/auth/base-provider-module.ts"],"names":[],"mappings":";;;AAAA,qCAA0C;AAC1C,+BAA4B;AAC5B,4DAIkC;AAClC,mEAAuD;AAGvD,MAAM,MAAM,GAAG,IAAA,mBAAY,EAAC,sBAAsB,CAAC,CAAC;AA0BpD;;;;;;;;;;;GAWG;AACH,MAAsB,kBACpB,SAAQ,0BAAU;IAkBlB,YACE,MAA0B,EAC1B,mBAAwC;QAExC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC;QAC7B,IAAI,CAAC,mBAAmB,GAAG,mBAAmB,CAAC;QAE/C,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,IAAI,GAAG,GAAG,MAAM,CAAC,UAAU,WAAW,CAAC;QAC5C,IAAI,CAAC,mBAAmB,GAAG,MAAM,CAAC,mBAAmB,CAAC;QACtD,IAAI,CAAC,eAAe,GAAG,MAAM,CAAC,eAAe,CAAC;QAC9C,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAChC,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;QACpD,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;QACpD,IAAI,CAAC,iBAAiB,GAAG,MAAM,CAAC,iBAAiB,CAAC;QAClD,IAAI,CAAC,kBAAkB,GAAG,MAAM,CAAC,kBAAkB,CAAC;QACpD,IAAI,CAAC,cAAc,GAAG,MAAM,CAAC,cAAc,CAAC;QAE5C,IAAI,CAAC,GAAG,GAAG,IAAI,WAAI,EAAE,CAAC;QACtB,IAAI,CAAC,WAAW,EAAE,CAAC;IACrB,CAAC;IAED,SAAS;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oBAAoB;QAClB,OAAO,IAAI,CAAC,cAAc,CAAC,iBAAiB,CAAC;IAC/C,CAAC;IAED,uBAAuB;QACrB,OAAO,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC;IAClD,CAAC;IAED,iBAAiB;QACf,MAAM,EAAE,IAAI,EAAE,eAAe,EAAE,iBAAiB,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC;QACzE,IAAI,CAAC,IAAI,IAAI,CAAC,eAAe;YAAE,OAAO,IAAI,CAAC;QAC3C,8EAA8E;QAC9E,MAAM,WAAW,GAAG,iBAAiB;YACnC,CAAC,CAAC,IAAA,gCAAU,EAAC,iBAAiB,CAAC;YAC/B,CAAC,CAAC,SAAS,CAAC;QACd,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,WAAW,IAAI,eAAe,EAAE,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,cAAc,CAAC,OAAe;QAClC,OAAO,IAAI,CAAC,mBAAmB,CAAC,mBAAmB,CACjD,OAAO,EACP,IAAI,CAAC,UAAU,CAChB,CAAC;IACJ,CAAC;IAED,YAAY;QACV,MAAM,MAAM,GACV,IAAI,CAAC,cAAc,CAAC,gBAAgB;YACpC,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC;QAC3C,OAAO,CAAC,CAAC,IAAA,gCAAU,EAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAED,uBAAuB,CACrB,QAAgB,EAChB,OAAgB;QAEhB,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,oBAAoB,EAAE,GACrD,IAAI,CAAC,cAAc,CAAC;QACtB,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,CAAC;QACrB,MAAM,MAAM,GACV,iBAAiB,IAAI,oBAAoB,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC;QACnC,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/D,CAAC;IAED,uBAAuB,CACrB,OAA+B;QAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC;QACzD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtB,MAAM,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,gBAAgB,IAAI,OAAO,CAAC;YAC/D,MAAM,SAAS,GAAG,IAAA,gCAAU,EAAC,MAAM,CAAC,CAAC;YACrC,IAAI,SAAS,EAAE,CAAC;gBACd,OAAO,CAAC,OAAO,CAAC,GAAG,SAAS,CAAC;YAC/B,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,YAAY,CAChB,OAAe,EACf,OAA+B;QAE/B,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC;QACzD,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtB,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC3D,OAAO,EACP,IAAI,CAAC,UAAU,CAChB,CAAC;YACF,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,UAAU,EAAE,CAAC;gBACxB,MAAM,CAAC,IAAI,CACT,aAAa,OAAO,cAAc,OAAO,KAAK,IAAI,CAAC,UAAU,GAAG,CACjE,CAAC;gBACF,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC;YACxC,CAAC;QACH,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM;QACJ,OAAO,IAAI,CAAC,GAAG,CAAC;IAClB,CAAC;IAES,KAAK,CAAC,aAAa,CAAC,OAAe;QAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,mBAAmB,CAAC,cAAc,CAC3D,OAAO,EACP,IAAI,CAAC,UAAU,CAChB,CAAC;QACF,IAAI,OAAO,aAAP,OAAO,uBAAP,OAAO,CAAE,UAAU,EAAE,CAAC;YACxB,OAAO,OAAO,CAAC,UAAU,CAAC;QAC5B,CAAC;QACD,MAAM,MAAM,GACV,IAAI,CAAC,cAAc,CAAC,gBAAgB;YACpC,IAAI,CAAC,cAAc,CAAC,oBAAoB,CAAC;QAC3C,OAAO,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC;IACrC,CAAC;IAED,6EAA6E;IAC7E,0BAA0B,CAAC,QAAgB;QACzC,OAAO,YAAY,CAAC;IACtB,CAAC;IAED,8DAA8D;IACpD,WAAW;QACnB,2BAA2B;IAC7B,CAAC;CACF;AAxJD,gDAwJC"}