@oomol-lab/open-connector 1.8.0 → 1.9.0

package/src/providers/keyzy/actions.js

@@ -0,0 +1,102 @@
+import { jsonSchema as s } from "../../core/json-schema.js";
+import { defineProviderAction } from "../../core/provider-definition.js";
+export const keyzyActions = [
+    defineProviderAction("keyzy", {
+        name: "register_license",
+        description: "Register a customer to a license. SKU settings control whether KEYZY emails the license.",
+        operationType: "write",
+        requiredScopes: [],
+        inputSchema: {
+            ...s.object("License operation input.", {
+                sku_number: s.nonEmptyString("The SKU number to register."),
+                name: s.nonEmptyString("The licensee name."),
+                email: s.string("The licensee email address.", { format: "email" }),
+                type: s.stringEnum("The license type; omit on registration to inherit the SKU type.", [
+                    "perpetual",
+                    "subscription",
+                    "trial",
+                ]),
+                start_at: s.integer("The license start time as a Unix timestamp."),
+                end_at: s.integer("The license end time as a Unix timestamp."),
+            }, { optional: ["type", "start_at", "end_at"] }),
+            allOf: [
+                {
+                    if: { properties: { type: { enum: ["subscription", "trial"] } }, required: ["type"] },
+                    then: { required: ["start_at", "end_at"] },
+                },
+            ],
+        },
+        outputSchema: s.looseObject("Registration response.", {
+            message: s.looseObject("Registration result.", {
+                serial: s.string("The registered license serial number."),
+            }),
+        }),
+    }),
+    defineProviderAction("keyzy", {
+        name: "get_license",
+        description: "Get license details by serial number.",
+        operationType: "read",
+        requiredScopes: [],
+        inputSchema: s.requiredObject("License operation input.", {
+            serial: s.nonEmptyString("The license serial number."),
+        }),
+        outputSchema: s.looseObject("License details response.", {
+            data: s.object("License details returned by KEYZY.", {
+                serial: s.string("The license serial number."),
+                name: s.string("The licensee name."),
+                email: s.string("The licensee email address."),
+                type: s.string("The license type."),
+                sku_number: s.string("The associated SKU number."),
+                sku_name: s.string("The associated SKU name."),
+                start_at: s.nullable(s.integer("The license start time as a Unix timestamp.")),
+                end_at: s.nullable(s.integer("The license end time as a Unix timestamp.")),
+                registered: s.boolean("Whether the license has been registered."),
+            }, { required: [], additionalProperties: true }),
+        }),
+    }),
+    defineProviderAction("keyzy", {
+        name: "update_license_sku",
+        description: "Change the SKU associated with a license.",
+        operationType: "write",
+        requiredScopes: [],
+        inputSchema: s.requiredObject("License operation input.", {
+            serial: s.nonEmptyString("The license serial number."),
+            current_sku_number: s.nonEmptyString("The current SKU number."),
+            new_sku_number: s.nonEmptyString("The new SKU number. Its type replaces the license type; trial or subscription may also need update_license_time."),
+        }),
+        outputSchema: s.looseObject("License operation response.", {
+            message: s.string("The operation result message."),
+        }),
+    }),
+    defineProviderAction("keyzy", {
+        name: "update_license_time",
+        description: "Update the end time and optional start time of a subscription or trial license.",
+        operationType: "write",
+        requiredScopes: [],
+        inputSchema: s.object("License operation input.", {
+            serial: s.nonEmptyString("The license serial number."),
+            start_at: s.integer("The license start time as a Unix timestamp."),
+            end_at: s.integer("The license end time as a Unix timestamp."),
+        }, { optional: ["start_at"] }),
+        outputSchema: s.looseObject("License operation response.", {
+            message: s.string("The operation result message."),
+        }),
+    }),
+    defineProviderAction("keyzy", {
+        name: "delete_license",
+        description: "Delete a license and all its activations. The supplied type must match the license type.",
+        operationType: "destructive",
+        requiredScopes: [],
+        inputSchema: s.requiredObject("License operation input.", {
+            serial: s.nonEmptyString("The license serial number."),
+            type: s.stringEnum("The actual license type, required to confirm deletion.", [
+                "perpetual",
+                "subscription",
+                "trial",
+            ]),
+        }),
+        outputSchema: s.looseObject("License operation response.", {
+            message: s.string("The operation result message."),
+        }),
+    }),
+];

package/src/providers/keyzy/executors.d.ts

@@ -0,0 +1,4 @@
+import type { CredentialValidators, ProviderExecutors, ProviderProxyExecutor } from "../../core/types.ts";
+export declare const credentialValidators: CredentialValidators;
+export declare const executors: ProviderExecutors;
+export declare const proxy: ProviderProxyExecutor;

package/src/providers/keyzy/executors.js

@@ -0,0 +1,114 @@
+import { optionalRecord, optionalRawString } from "../../core/cast.js";
+import { providerInputError, defineProviderExecutors, requireApiKeyCredential, defineProviderProxy, mapProviderActionHandlers, requiredInputString, requiredResponseRecord, providerUserAgent, runProviderRequest, ProviderRequestError, readProviderProxyErrorMessage, withRetryAfterSeconds, } from "../provider-runtime.js";
+import { keyzyActions } from "./actions.js";
+const baseUrl = "https://api.keyzy.io/v2";
+const endpoints = {
+    register_license: { method: "POST", path: "/licenses/register" },
+    get_license: { method: "GET", path: "/licenses/show-license" },
+    update_license_sku: { method: "POST", path: "/licenses/update-sku" },
+    update_license_time: { method: "POST", path: "/licenses/update-time" },
+    delete_license: { method: "DELETE", path: "/licenses/destroy-serial" },
+};
+const defaultHeaders = {
+    accept: "application/json",
+    "content-type": "application/json",
+    "user-agent": providerUserAgent,
+};
+const handlers = mapProviderActionHandlers("keyzy", keyzyActions, (action) => async (values, context) => {
+    const { apiKey, appId } = context;
+    const endpoint = endpoints[action.name];
+    const url = new URL(`${baseUrl}${endpoint.path}`);
+    let body = undefined;
+    if (action.name === "get_license") {
+        const serial = requiredInputString(values.serial, "serial");
+        if (serial === "." || serial === "..") {
+            throw providerInputError("serial must not be a dot path segment");
+        }
+        url.pathname += `/${encodeURIComponent(serial)}`;
+        url.searchParams.set("app_id", appId);
+        url.searchParams.set("api_key", apiKey);
+    }
+    else {
+        body = JSON.stringify({ ...values, app_id: appId, api_key: apiKey });
+    }
+    return runProviderRequest({ label: "KEYZY", signal: context.signal }, async (signal) => {
+        const response = await context.fetcher(url, {
+            method: endpoint.method,
+            headers: defaultHeaders,
+            body,
+            signal,
+        });
+        const text = await response.text();
+        let payload = undefined;
+        try {
+            payload = JSON.parse(text);
+        }
+        catch {
+            throw new ProviderRequestError(response.ok ? 502 : response.status, "KEYZY returned a non-JSON response", undefined, "provider_error");
+        }
+        const record = requiredResponseRecord(payload, "KEYZY response");
+        const error = optionalRecord(record.error);
+        if (!response.ok || error) {
+            const message = optionalRawString(error?.message) ??
+                (optionalRecord(error?.message) ? JSON.stringify(error?.message) : undefined) ??
+                optionalRawString(record.message) ??
+                "KEYZY request failed";
+            throw new ProviderRequestError(response.ok ? 502 : response.status, message, undefined, "provider_error");
+        }
+        return record;
+    });
+});
+export const credentialValidators = {
+    async apiKey(input) {
+        requiredInputString(input.apiKey, "apiKey");
+        requiredInputString(input.values.appId, "appId");
+        return {
+            profile: { displayName: "KEYZY API Key" },
+            grantedScopes: [],
+            metadata: {
+                apiBaseUrl: baseUrl,
+                validationMode: "local_non_empty_fields",
+                validationReason: "No documented non-resource authentication endpoint",
+            },
+        };
+    },
+};
+export const executors = defineProviderExecutors({
+    service: "keyzy",
+    handlers,
+    skipDnsValidation: true,
+    async createContext(context, fetcher) {
+        const credential = await requireApiKeyCredential(context, "keyzy");
+        return {
+            apiKey: requiredInputString(credential.apiKey, "apiKey"),
+            appId: requiredInputString(credential.values.appId, "appId"),
+            fetcher,
+            signal: context.signal,
+        };
+    },
+});
+export const proxy = defineProviderProxy({
+    service: "keyzy",
+    baseUrl,
+    auth: { type: "api_key_query_or_json_body", name: "api_key", bodyMethods: ["POST", "PUT", "PATCH", "DELETE"] },
+    skipDnsValidation: true,
+    async readError(response) {
+        return new ProviderRequestError(response.status, await readProviderProxyErrorMessage(response, `Provider request failed with HTTP ${response.status}`), withRetryAfterSeconds(response), response.status === 429 ? "rate_limited" : "provider_error");
+    },
+    customizeRequest({ headers, credential, method, url, body, setBody }) {
+        for (const [name, value] of Object.entries(defaultHeaders))
+            if (!headers.has(name))
+                headers.set(name, value);
+        const appId = requiredInputString(credential && "values" in credential ? credential.values.appId : undefined, "appId");
+        if (method === "GET" || method === "HEAD")
+            url.searchParams.set("app_id", appId);
+        else {
+            const record = optionalRecord(body);
+            if (body != null && !record)
+                throw providerInputError("KEYZY proxy requires a JSON object body");
+            url.searchParams.delete("app_id");
+            url.searchParams.delete("api_key");
+            setBody({ ...record, app_id: appId });
+        }
+    },
+});

package/src/providers/kickofflabs/actions.d.ts

@@ -0,0 +1,2 @@
+import type { ActionDefinition } from "../../core/types.ts";
+export declare const kickofflabsActions: ActionDefinition[];

package/src/providers/kickofflabs/actions.js

@@ -0,0 +1,48 @@
+import { s } from "../../core/json-schema.js";
+import { defineProviderAction } from "../../core/provider-definition.js";
+const campaignInput = s.requiredObject("The campaign to query.", {
+    campaignId: s.integer("The KickoffLabs campaign ID returned by list_campaigns.", { minimum: 1 }),
+});
+export const kickofflabsActions = [
+    defineProviderAction("kickofflabs", {
+        name: "list_campaigns",
+        description: "List the KickoffLabs campaigns available to the connected API key.",
+        operationType: "read",
+        requiredScopes: [],
+        inputSchema: s.requiredObject("The campaign listing parameters.", {}),
+        outputSchema: s.requiredObject("The campaigns available to the API key.", {
+            campaigns: s.array("The available campaigns.", s.looseObject("A KickoffLabs campaign.", {
+                id: s.integer("The campaign ID."),
+                name: s.string("The campaign name."),
+                lead_count: s.integer("The lead count including jump-start settings."),
+            })),
+        }),
+    }),
+    defineProviderAction("kickofflabs", {
+        name: "get_campaign_stats",
+        description: "Get overview lead statistics for a KickoffLabs campaign.",
+        operationType: "read",
+        requiredScopes: [],
+        inputSchema: campaignInput,
+        outputSchema: s.looseObject("The campaign overview statistics.", {
+            leads: s.looseObject("The campaign lead counts.", {
+                total: s.integer("The total number of leads."),
+                total_with_jumpstart: s.integer("The total number of leads including jump-start settings."),
+                removed_from_waitlist: s.integer("The number of leads removed from the waitlist."),
+            }),
+        }),
+    }),
+    defineProviderAction("kickofflabs", {
+        name: "list_campaign_actions",
+        description: "List the scoring action definitions configured for a KickoffLabs campaign.",
+        operationType: "read",
+        requiredScopes: [],
+        inputSchema: campaignInput,
+        outputSchema: s.requiredObject("The campaign scoring action definitions.", {
+            actions: s.array("The configured scoring actions.", s.looseObject("A campaign scoring action.", {
+                id: s.integer("The campaign action ID, used as laid when marking a lead action complete."),
+                text: s.string("The action label."),
+            })),
+        }),
+    }),
+];

package/src/providers/kickofflabs/executors.d.ts

@@ -0,0 +1,4 @@
+import type { CredentialValidators, ProviderExecutors, ProviderProxyExecutor } from "../../core/types.ts";
+export declare const executors: ProviderExecutors;
+export declare const credentialValidators: CredentialValidators;
+export declare const proxy: ProviderProxyExecutor;

package/src/providers/kickofflabs/executors.js

@@ -0,0 +1,71 @@
+import { optionalRecord, optionalRawString } from "../../core/cast.js";
+import { defineApiKeyProviderExecutors, defineProviderProxy, mapProviderActionHandlers, ProviderRequestError, providerResponseError, requiredInputString, requiredResponseRecord, runProviderRequest, providerUserAgent, readProviderTextBody, } from "../provider-runtime.js";
+import { kickofflabsActions } from "./actions.js";
+const baseUrl = "https://api.kickofflabs.com/v2";
+async function request(route, apiKey, fetcher, parentSignal) {
+    return runProviderRequest({ signal: parentSignal, label: "kickofflabs" }, async (signal) => {
+        const url = new URL(`${baseUrl}${route}`);
+        url.searchParams.set("api_key", apiKey);
+        const response = await fetcher(url, {
+            method: "GET",
+            headers: { accept: "application/json", "user-agent": providerUserAgent },
+            signal,
+        });
+        const text = await readProviderTextBody(response, "kickofflabs response", undefined, signal);
+        let payload;
+        try {
+            payload = JSON.parse(text);
+        }
+        catch {
+            if (response.ok)
+                throw new ProviderRequestError(502, "kickofflabs returned invalid JSON", undefined, "provider_error");
+        }
+        if (!response.ok) {
+            const object = optionalRecord(payload);
+            const message = optionalRawString(object?.message) ??
+                optionalRawString(object?.error) ??
+                `kickofflabs request failed (HTTP ${response.status})`;
+            throw new ProviderRequestError(response.status, message.replaceAll(apiKey, "[REDACTED]"), undefined, response.status === 429 ? "rate_limited" : "provider_error");
+        }
+        return payload;
+    });
+}
+const handlers = mapProviderActionHandlers("kickofflabs", kickofflabsActions, (action) => async (values, context) => {
+    const route = action.name === "list_campaigns"
+        ? "/campaigns"
+        : `/${values.campaignId}/${action.name === "get_campaign_stats" ? "stats" : "actions"}`;
+    const payload = await request(route, context.apiKey, context.fetcher, context.signal);
+    if (action.name !== "get_campaign_stats") {
+        if (!Array.isArray(payload))
+            throw providerResponseError("KickoffLabs list must be an array");
+        return action.name === "list_campaigns" ? { campaigns: payload } : { actions: payload };
+    }
+    return requiredResponseRecord(payload, "kickofflabs campaign stats");
+});
+export const executors = defineApiKeyProviderExecutors("kickofflabs", handlers, {
+    skipDnsValidation: true,
+});
+export const credentialValidators = {
+    async apiKey(input, { fetcher }) {
+        const campaigns = await request("/campaigns", requiredInputString(input.apiKey, "API Key"), fetcher);
+        if (!Array.isArray(campaigns))
+            throw providerResponseError("KickoffLabs campaigns must be an array");
+        return {
+            profile: { displayName: "KickoffLabs API Key" },
+            grantedScopes: [],
+            metadata: { apiBaseUrl: baseUrl, validationEndpoint: "/campaigns" },
+        };
+    },
+};
+export const proxy = defineProviderProxy({
+    service: "kickofflabs",
+    baseUrl,
+    auth: { type: "api_key_query", name: "api_key" },
+    skipDnsValidation: true,
+    customizeRequest({ headers }) {
+        if (!headers.has("accept"))
+            headers.set("accept", "application/json");
+        if (!headers.has("user-agent"))
+            headers.set("user-agent", providerUserAgent);
+    },
+});

package/src/providers/klangio/runtime.js

@@ -1,5 +1,5 @@
 import { optionalRecord, optionalString } from "../../core/cast.js";
-import { assertPublicHttpUrl, readBoundedResponseBytes } from "../../core/request.js";
+import { assertPublicHttpUrl, readBoundedResponseBytes, storeResponseInTransit } from "../../core/request.js";
 import { providerFetch, providerUserAgent, ProviderRequestError } from "../provider-runtime.js";
 export const klangioApiBaseUrl = "https://api.klang.io";
 const klangioValidationJobId = "00000000-0000-0000-0000-000000000000";
@@ -170,17 +170,19 @@ async function downloadKlangioFile(input) {
         const payload = await readKlangioPayload(response);
         throw createKlangioError(response, payload);
     }
-    const bytes = await readBoundedResponseBytes(response, {
-        maxBytes: input.context.transitFiles.maxBytes,
+    const contentType = normalizeMimeType(response.headers.get("content-type")) ?? input.fallbackMimeType;
+    const name = appendExtensionIfMissing(input.fileName, extensionForMimeType(contentType));
+    const upload = await storeResponseInTransit(response, input.context.transitFiles, {
+        name,
+        mimeType: contentType,
         fieldName: `Klangio ${input.actionName} file`,
         createError: (message) => new ProviderRequestError(413, message),
+        signal: input.context.signal,
     });
-    if (bytes.byteLength === 0) {
+    if (upload.sizeBytes === 0) {
+        await input.context.transitFiles.delete(upload.fileId).catch(() => undefined);
         throw new ProviderRequestError(502, `Klangio ${input.actionName} response did not include file bytes`);
     }
-    const contentType = normalizeMimeType(response.headers.get("content-type")) ?? input.fallbackMimeType;
-    const name = appendExtensionIfMissing(input.fileName, extensionForMimeType(contentType));
-    const upload = await input.context.transitFiles.create(new File([Uint8Array.from(bytes)], name, { type: contentType }));
     return {
         file: {
             name,
@@ -191,7 +193,7 @@ async function downloadKlangioFile(input) {
             mimeType: contentType,
         },
         contentType,
-        contentLength: bytes.byteLength,
+        contentLength: upload.sizeBytes,
     };
 }
 async function createFileFormData(value, context) {

package/src/providers/latchshot/executors.js

@@ -1,5 +1,5 @@
 import { compactObject, optionalBoolean, optionalInteger, optionalRawString, optionalRecord, optionalString, requiredString, } from "../../core/cast.js";
-import { readBoundedResponseBytes } from "../../core/request.js";
+import { storeResponseInTransit } from "../../core/request.js";
 import { createProviderFetch, defineApiKeyProviderExecutors, defineProviderProxy, providerInputError, providerResponseError, providerUserAgent, ProviderRequestError, readProviderTextBody, } from "../provider-runtime.js";
 const service = "latchshot";
 const latchshotApiBaseUrl = "https://latchshot.fly.dev";
@@ -76,16 +76,18 @@ async function captureLatchshotPage(input, context) {
     if (!response.ok) {
         throw await createLatchshotError(response, "execute");
     }
-    const bytes = await readBoundedResponseBytes(response, {
-        maxBytes: context.transitFiles.maxBytes,
+    const artifact = resolveArtifact(response.headers.get("content-type"), format);
+    const stored = await storeResponseInTransit(response, context.transitFiles, {
+        name: `latchshot-capture.${artifact.extension}`,
+        mimeType: artifact.mimeType,
         fieldName: "Latchshot artifact",
         createError: (message) => new ProviderRequestError(413, message),
+        signal: context.signal,
     });
-    if (bytes.byteLength === 0) {
+    if (stored.sizeBytes === 0) {
+        await context.transitFiles.delete(stored.fileId).catch(() => undefined);
         throw new ProviderRequestError(502, "Latchshot returned an empty artifact.");
     }
-    const artifact = resolveArtifact(response.headers.get("content-type"), format);
-    const stored = await context.transitFiles.create(new File([Uint8Array.from(bytes)], `latchshot-capture.${artifact.extension}`, { type: artifact.mimeType }));
     const file = {
         fileId: stored.fileId,
         downloadUrl: stored.downloadUrl,

package/src/providers/lingxing_mcp/runtime.js

@@ -2,7 +2,7 @@ import { UnauthorizedError } from "@modelcontextprotocol/client";
 import { SdkHttpError } from "@modelcontextprotocol/client";
 import { ProtocolError, SdkError, SdkErrorCode } from "@modelcontextprotocol/client";
 import { createHash } from "node:crypto";
-import { optionalRecord, requiredString } from "../../core/cast.js";
+import { optionalNumber, optionalRecord, optionalString, requiredString } from "../../core/cast.js";
 import { assertPublicHttpUrl } from "../../core/request.js";
 import { withMcpClient } from "../mcp-client.js";
 import { providerUserAgent, ProviderRequestError, toProviderExecutionError } from "../provider-runtime.js";
@@ -107,7 +107,7 @@ export function normalizeLingxingMcpEndpoint(value) {
 }
 export async function validateLingxingCredential(values, fetcher, signal) {
     const context = createLingxingContext(values, fetcher, signal);
-    const tools = await runLingxingMcp("validate", () => discoverLingxingTools(context));
+    const tools = await discoverLingxingTools(context);
     if (tools.length === 0) {
         throw new ProviderRequestError(502, "Lingxing MCP did not expose any tools for this account");
     }
@@ -126,13 +126,13 @@ export async function validateLingxingCredential(values, fetcher, signal) {
 }
 export async function listLingxingTools(context) {
     return {
-        tools: await runLingxingMcp("execute", () => discoverLingxingTools(context)),
+        tools: await discoverLingxingTools(context),
     };
 }
 export async function callLingxingTool(context, input) {
     const toolName = requiredString(input.toolName, "toolName", (message) => new ProviderRequestError(400, message));
     const argumentsValue = readToolArguments(input.arguments);
-    const result = await runLingxingMcp("execute", () => withLingxingMcpClient(context, async (client) => {
+    const result = await withLingxingMcpClient(context, async (client) => {
         const toolResult = await client.callTool({
             name: toolName,
             arguments: argumentsValue,
@@ -141,7 +141,7 @@ export async function callLingxingTool(context, input) {
             signal: context.signal,
         });
         return normalizeLingxingMcpToolResult(toolName, toolResult);
-    }));
+    });
     return { result };
 }
 async function discoverLingxingTools(context) {
@@ -200,6 +200,38 @@ function readToolArguments(value) {
     return argumentsValue;
 }
 function normalizeLingxingMcpToolResult(toolName, result) {
+    if ("content" in result) {
+        const candidates = [result.structuredContent];
+        for (const content of result.content) {
+            if (content.type !== "text")
+                continue;
+            const prefix = "call failed, status: 429, response: ";
+            const text = result.isError && content.text.startsWith(prefix) ? content.text.slice(prefix.length) : content.text;
+            try {
+                candidates.push(JSON.parse(text));
+            }
+            catch {
+                /* Unstructured tool content is passed through. */
+            }
+        }
+        for (const candidate of candidates) {
+            const envelope = optionalRecord(candidate);
+            if (envelope?.success !== false)
+                continue;
+            const code = optionalNumber(envelope.code);
+            const message = optionalString(envelope.msg)?.trim();
+            if (code === undefined || !message)
+                continue;
+            // Code 102 also reports changed tool parameters; only the verified key signal permits recovery.
+            if (code === 102 && message.startsWith("MCP Key无效或已失效，请检查x-mcp-key配置")) {
+                throw new ProviderRequestError(401, message, undefined, "authorization_failed");
+            }
+            if (code === 429 && message === "认证请求过于频繁，请稍后重试") {
+                throw new ProviderRequestError(429, message, undefined, "rate_limited");
+            }
+            throw new ProviderRequestError(502, `Lingxing MCP tool failed (${code}): ${message}`);
+        }
+    }
     if ("content" in result && result.isError) {
         throw new ProviderRequestError(502, `Lingxing MCP tool ${toolName} returned an error: ${formatLingxingMcpToolContent(result)}`, result);
     }
@@ -232,17 +264,11 @@ function mapLingxingMcpError(error) {
         return error;
     }
     if (error instanceof UnauthorizedError) {
-        return new ProviderRequestError(401, "Lingxing MCP token is invalid or expired", error);
+        return new ProviderRequestError(401, "Lingxing MCP authentication request failed", error, "provider_error");
     }
     if (error instanceof SdkHttpError) {
         const status = error.status;
-        return new ProviderRequestError(status === 401 || status === 403
-            ? 401
-            : status === 429
-                ? 429
-                : status && status >= 400 && status < 500
-                    ? 400
-                    : 502, `Lingxing MCP request failed: ${error.message}`, error);
+        return new ProviderRequestError(status && status >= 400 ? status : 502, `Lingxing MCP request failed: ${error.message}`, error, status === 429 ? "rate_limited" : "provider_error");
     }
     if (error instanceof SdkError && error.code === SdkErrorCode.RequestTimeout) {
         return new ProviderRequestError(504, "Lingxing MCP request timed out", error);
@@ -255,17 +281,6 @@ function mapLingxingMcpError(error) {
     }
     return new ProviderRequestError(502, error instanceof Error ? `Lingxing MCP request failed: ${error.message}` : "Lingxing MCP request failed", error);
 }
-async function runLingxingMcp(phase, run) {
-    try {
-        return await run();
-    }
-    catch (error) {
-        if (error instanceof ProviderRequestError && error.status === 401) {
-            throw new ProviderRequestError(phase === "validate" ? 400 : 401, "Lingxing MCP Server URL or X-Mcp-Key is invalid", error);
-        }
-        throw error;
-    }
-}
 function hashLingxingCredential(credential) {
     return createHash("sha256").update(credential.endpoint.toString()).digest("hex").slice(0, 16);
 }

package/src/providers/litellm/executors.d.ts

@@ -0,0 +1,4 @@
+import type { CredentialValidators, ProviderExecutors, ProviderProxyExecutor } from "../../core/types.ts";
+export declare const executors: ProviderExecutors;
+export declare const proxy: ProviderProxyExecutor;
+export declare const credentialValidators: CredentialValidators;

package/src/providers/litellm/executors.js

@@ -0,0 +1,34 @@
+import { optionalString } from "../../core/cast.js";
+import { isPrivateNetworkAccessAllowed } from "../../core/request.js";
+import { createProviderFetch, defineProviderExecutors, defineProviderProxy, ProviderRequestError, requireApiKeyCredential, } from "../provider-runtime.js";
+import { createLitellmContext, litellmActionHandlers, normalizeLitellmBaseUrl, validateLitellmCredential, } from "./runtime.js";
+const service = "litellm";
+export const executors = defineProviderExecutors({
+    service,
+    handlers: litellmActionHandlers,
+    async createContext(context, fetcher) {
+        const credential = await requireApiKeyCredential(context, service);
+        return createLitellmContext(credential.values, credential.apiKey, fetcher, context.signal);
+    },
+    allowPrivateNetwork: isPrivateNetworkAccessAllowed,
+});
+export const proxy = defineProviderProxy({
+    service,
+    baseUrl: async (context) => {
+        const credential = await requireApiKeyCredential(context, service);
+        const value = optionalString(credential.metadata.apiBaseUrl) ?? optionalString(credential.values.baseUrl);
+        if (!value)
+            throw new ProviderRequestError(500, "litellm connection is missing baseUrl metadata");
+        return normalizeLitellmBaseUrl(value);
+    },
+    auth: { type: "api_key_authorization", prefix: "Bearer " },
+    allowPrivateNetwork: isPrivateNetworkAccessAllowed,
+});
+export const credentialValidators = {
+    apiKey(input, { fetcher, signal }) {
+        // Re-guard the shared validator fetcher with the private-network opt-in so
+        // validating a proxy on a private network works when the deployment allows it.
+        const guardedFetcher = createProviderFetch({ fetch: fetcher, allowPrivateNetwork: isPrivateNetworkAccessAllowed });
+        return validateLitellmCredential(input.values, input.apiKey, guardedFetcher, signal);
+    },
+};

package/src/providers/litellm/runtime.d.ts

@@ -0,0 +1,29 @@
+import type { CredentialValidationResult } from "../../core/types.ts";
+import type { ProviderActionHandlers } from "../provider-runtime.ts";
+export interface LitellmContext {
+    apiKey: string;
+    /** Proxy root URL, without a trailing `/v1`. */
+    baseUrl: string;
+    fetcher: typeof fetch;
+    signal?: AbortSignal;
+}
+type LitellmActionHandler = (input: Record<string, unknown>, context: LitellmContext) => Promise<unknown>;
+export declare const litellmActionHandlers: ProviderActionHandlers<"litellm", LitellmActionHandler>;
+/**
+ * Build the per-request LiteLLM context from the stored connection fields.
+ */
+export declare function createLitellmContext(values: Record<string, string>, apiKey: string, fetcher: typeof fetch, signal?: AbortSignal): LitellmContext;
+/**
+ * Verify a LiteLLM key against the proxy and record the models it can call.
+ * `/v1/models` accepts both virtual keys and the master key, unlike `/key/info`.
+ */
+export declare function validateLitellmCredential(values: Record<string, string>, apiKey: string, fetcher: typeof fetch, signal?: AbortSignal): Promise<CredentialValidationResult>;
+/**
+ * Validates a LiteLLM proxy URL, rejects embedded credentials and unsafe
+ * targets, removes query/hash components, and reduces it to the proxy root.
+ * LiteLLM serves its OpenAI routes under both `/` and `/v1`, so a pasted
+ * `https://host/v1` and `https://host` resolve to the same connection, while a
+ * path prefix such as `https://host/litellm` (SERVER_ROOT_PATH) is kept.
+ */
+export declare function normalizeLitellmBaseUrl(value: unknown, allowPrivateNetwork?: boolean): string;
+export {};