@shipfox/api-agent 2.0.0

package/.turbo/turbo-build.log

@@ -0,0 +1,2 @@
+$ shipfox-swc
+Successfully compiled: 48 files with swc (64.93ms)

package/.turbo/turbo-type$colon$emit.log

@@ -0,0 +1 @@
+$ shipfox-tsc-emit

package/.turbo/turbo-type.log

@@ -0,0 +1 @@
+$ shipfox-tsc-check

package/CHANGELOG.md

@@ -0,0 +1,105 @@
+# @shipfox/api-agent
+
+## 2.0.0
+
+### Minor Changes
+
+- 1b0d344: Publishes the complete API runtime closure with packed-consumer-safe internal imports and records its exact package set in application releases.
+
+### Patch Changes
+
+- Updated dependencies [0cd6dd4]
+- Updated dependencies [1b0d344]
+- Updated dependencies [521e006]
+  - @shipfox/node-module@0.2.0
+  - @shipfox/api-agent-dto@2.0.0
+  - @shipfox/api-auth-context@2.0.0
+  - @shipfox/api-secrets@2.0.0
+  - @shipfox/node-egress-guard@0.1.0
+  - @shipfox/config@1.2.1
+  - @shipfox/node-drizzle@0.2.1
+  - @shipfox/node-fastify@0.2.1
+  - @shipfox/node-opentelemetry@0.5.0
+  - @shipfox/node-postgres@0.4.1
+  - @shipfox/redact@0.2.1
+
+## 0.1.2
+
+### Patch Changes
+
+- @shipfox/api-secrets@0.1.2
+- @shipfox/node-module@0.1.2
+
+## 0.1.1
+
+### Patch Changes
+
+- Updated dependencies [ec75cd5]
+- Updated dependencies [68b8d03]
+- Updated dependencies [6a1fb54]
+  - @shipfox/node-drizzle@0.2.0
+  - @shipfox/redact@0.2.0
+  - @shipfox/node-postgres@0.4.0
+  - @shipfox/api-secrets@0.1.1
+  - @shipfox/node-module@0.1.1
+
+## 0.1.0
+
+### Minor Changes
+
+- 0a6318f: Adds backend model provider storage with workspace defaults and Pi catalog registry validation.
+- 067a260: Adds workspace model provider settings for configuring, testing, defaulting, and deleting provider credentials.
+- 5bcdbf4: Adds harness-native agent tool catalogs with deployment-aware Pi optional tool package config.
+
+### Patch Changes
+
+- 5cdfc69: Adds a reusable custom-model-provider egress guard with instance config for private-network and host-denylist policy.
+- b1f57d1: Moves agent model provider credentials onto the shared secrets store while keeping provider config metadata and runtime resolution behavior intact.
+- 97162dd: Resolves model provider, model, and thinking defaults at workflow run creation using workspace and instance configuration.
+- aca162b: Add workspace model provider management routes: list provider catalog, list workspace provider configs, test-and-save (upsert) a provider configuration, hard-delete a configuration (clearing the workspace default when needed), and set the workspace default provider. Routes carry per-route error translation and never expose stored credentials.
+- 82d22e4: Make the workspace-membership gate stateless. `requireWorkspaceAccess` now lives in `@shipfox/api-auth-context` and authorizes a request purely from the verified session-token claims, replacing the `requireMembership` gate in `@shipfox/api-workspaces` that read the workspace row from the database on every workspace-scoped request. Membership and role already travel in the token, so the check needs no database access.
+
+  This removes the per-request database read and severs the runtime dependency on `@shipfox/api-workspaces` from feature modules that only needed the membership gate (integration providers, secrets, projects, agent, runners). Workspace existence and `active`-status enforcement, which no code path currently exercises, moves off the hot path; enforce it at token issuance when workspace suspension is introduced.
+
+- Updated dependencies [067a260]
+- Updated dependencies [34ba284]
+- Updated dependencies [3b45d86]
+- Updated dependencies [5707d6d]
+- Updated dependencies [b9c3f32]
+- Updated dependencies [a81b68c]
+- Updated dependencies [c0a883c]
+- Updated dependencies [72ce351]
+- Updated dependencies [e47f8da]
+- Updated dependencies [de54da2]
+- Updated dependencies [7b175f5]
+- Updated dependencies [7ca4c65]
+- Updated dependencies [5bcdbf4]
+- Updated dependencies [ae7a63c]
+- Updated dependencies [f92122b]
+- Updated dependencies [360d06d]
+- Updated dependencies [f8f339a]
+- Updated dependencies [857fd73]
+- Updated dependencies [aca162b]
+- Updated dependencies [75520ff]
+- Updated dependencies [f66f606]
+- Updated dependencies [e51d464]
+- Updated dependencies [d6d4862]
+- Updated dependencies [c0a883c]
+- Updated dependencies [6077301]
+- Updated dependencies [3bea87f]
+- Updated dependencies [82d22e4]
+- Updated dependencies [6181819]
+- Updated dependencies [3ddde91]
+- Updated dependencies [282e66a]
+- Updated dependencies [9c149d1]
+  - @shipfox/api-agent-dto@0.1.0
+  - @shipfox/node-fastify@0.2.0
+  - @shipfox/api-secrets@0.1.0
+  - @shipfox/node-drizzle@0.1.0
+  - @shipfox/api-auth-context@0.1.0
+  - @shipfox/node-opentelemetry@0.4.2
+  - @shipfox/node-postgres@0.3.2
+  - @shipfox/node-module@0.1.0
+  - @shipfox/redact@0.1.0
+  - @shipfox/config@1.2.0
+  - @shipfox/node-egress-guard@0.0.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Shipfox
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/config.d.ts

@@ -0,0 +1,13 @@
+export declare const config: Readonly<{
+    AGENT_DEFAULT_PROVIDER: "anthropic" | "ant-ling" | "azure-openai-responses" | "openai" | "deepseek" | "nvidia" | "google" | "mistral" | "groq" | "cerebras" | "cloudflare-ai-gateway" | "cloudflare-workers-ai" | "xai" | "openrouter" | "vercel-ai-gateway" | "zai" | "zai-coding-cn" | "opencode" | "opencode-go" | "huggingface" | "fireworks" | "together" | "kimi-coding" | "minimax" | "minimax-cn" | "moonshotai" | "moonshotai-cn" | "xiaomi" | "xiaomi-token-plan-cn" | "xiaomi-token-plan-ams" | "xiaomi-token-plan-sgp" | undefined;
+    AGENT_DEFAULT_PROVIDER_MODEL: string | undefined;
+    AGENT_DEFAULT_PROVIDER_THINKING: "off" | "minimal" | "low" | "medium" | "high" | "xhigh" | "max" | undefined;
+    AGENT_DEFAULT_PROVIDER_API_KEY: string | undefined;
+    AGENT_PROVIDER_VALIDATION_TIMEOUT_MS: number;
+    AGENT_CUSTOM_PROVIDER_ALLOW_PRIVATE_NETWORKS: boolean;
+    AGENT_CUSTOM_PROVIDER_HOST_DENYLIST: string;
+    AGENT_PI_ENABLED_TOOL_PACKAGES: string;
+    AGENT_PI_WEB_SEARCH_ENABLED: boolean;
+} & import("@shipfox/config").CleanedEnvAccessors>;
+export declare const harnessToolDeploymentConfig: import("@shipfox/api-agent-dto").HarnessToolDeploymentConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAWA,eAAO,MAAM,MAAM;;;;;;;;;;kDAuCjB,CAAC;AAIH,eAAO,MAAM,2BAA2B,8DAGtC,CAAC"}

package/dist/config.js

@@ -0,0 +1,60 @@
+import { agentThinkingSchema, buildHarnessToolDeploymentConfig, getModelProviderEntry, SUPPORTED_MODEL_PROVIDER_IDS } from '@shipfox/api-agent-dto';
+import { bool, createConfig, num, str } from '@shipfox/config';
+const AGENT_THINKING_CHOICES = agentThinkingSchema.options;
+export const config = createConfig({
+    AGENT_DEFAULT_PROVIDER: str({
+        desc: 'Instance-wide default model provider ID used when a workflow and workspace do not choose one. Optional. Use one of the supported model provider IDs from the model provider catalog.',
+        choices: SUPPORTED_MODEL_PROVIDER_IDS,
+        default: undefined
+    }),
+    AGENT_DEFAULT_PROVIDER_MODEL: str({
+        desc: 'Instance-wide default model ID used when the resolved provider matches AGENT_DEFAULT_PROVIDER and no workflow or workspace model is set. Optional. Use a model ID supported by that provider.',
+        default: undefined
+    }),
+    AGENT_DEFAULT_PROVIDER_THINKING: str({
+        desc: 'Instance-wide default thinking effort used when the resolved provider matches AGENT_DEFAULT_PROVIDER and no workflow or workspace thinking effort is set. Optional. Accepted values are off, minimal, low, medium, high, and xhigh.',
+        choices: AGENT_THINKING_CHOICES,
+        default: undefined
+    }),
+    AGENT_DEFAULT_PROVIDER_API_KEY: str({
+        desc: 'API key for the instance default provider. Optional. Must belong to AGENT_DEFAULT_PROVIDER. If you change the default provider, change this key too. Instance defaults support API-key-only providers.',
+        default: undefined
+    }),
+    AGENT_PROVIDER_VALIDATION_TIMEOUT_MS: num({
+        desc: 'Maximum time in milliseconds to wait for the live provider test request when saving credentials.',
+        default: 10000
+    }),
+    AGENT_CUSTOM_PROVIDER_ALLOW_PRIVATE_NETWORKS: bool({
+        desc: 'Allows custom model providers to use private, loopback, link-local, metadata, and .internal network targets. Keep this true for local development and self-hosted private networks. Set it to false on cloud instances.',
+        default: true
+    }),
+    AGENT_CUSTOM_PROVIDER_HOST_DENYLIST: str({
+        desc: 'Comma-separated hosts and IP ranges that custom model providers may not call. Accepts exact hosts, suffix patterns such as .internal.example or *.internal.example, IP literals, and CIDR blocks such as 10.0.0.0/8.',
+        default: ''
+    }),
+    AGENT_PI_ENABLED_TOOL_PACKAGES: str({
+        desc: 'Comma-separated optional Pi tool packages enabled for this deployment. Defaults to pi-web-access so Pi web access is available. Set it to an empty value to enable only Pi built-in tools. Accepted values: pi-web-access.',
+        default: 'pi-web-access'
+    }),
+    AGENT_PI_WEB_SEARCH_ENABLED: bool({
+        desc: 'Enables Pi web search tools when pi-web-access is enabled. Set it to false to disable web_search and get_search_content while keeping fetch_content available.',
+        default: true
+    })
+});
+assertInstanceDefaultModelProviderApiKeyConfig();
+export const harnessToolDeploymentConfig = buildHarnessToolDeploymentConfig({
+    piEnabledToolPackages: config.AGENT_PI_ENABLED_TOOL_PACKAGES,
+    piWebSearchEnabled: config.AGENT_PI_WEB_SEARCH_ENABLED
+});
+function assertInstanceDefaultModelProviderApiKeyConfig() {
+    if (!config.AGENT_DEFAULT_PROVIDER_API_KEY) return;
+    if (!config.AGENT_DEFAULT_PROVIDER) {
+        throw new Error('AGENT_DEFAULT_PROVIDER_API_KEY requires AGENT_DEFAULT_PROVIDER to be set.');
+    }
+    const credentialFields = getModelProviderEntry(config.AGENT_DEFAULT_PROVIDER)?.credential_fields ?? [];
+    const field = credentialFields[0];
+    if (credentialFields.length === 1 && field?.key === 'api_key' && field.secret) return;
+    throw new Error('AGENT_DEFAULT_PROVIDER_API_KEY requires AGENT_DEFAULT_PROVIDER to use exactly one secret api_key credential field.');
+}
+
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config.ts"],"sourcesContent":["import {\n  agentThinkingSchema,\n  buildHarnessToolDeploymentConfig,\n  getModelProviderEntry,\n  SUPPORTED_MODEL_PROVIDER_IDS,\n  type SupportedModelProviderId,\n} from '@shipfox/api-agent-dto';\nimport {bool, createConfig, num, str} from '@shipfox/config';\n\nconst AGENT_THINKING_CHOICES = agentThinkingSchema.options;\n\nexport const config = createConfig({\n  AGENT_DEFAULT_PROVIDER: str({\n    desc: 'Instance-wide default model provider ID used when a workflow and workspace do not choose one. Optional. Use one of the supported model provider IDs from the model provider catalog.',\n    choices: SUPPORTED_MODEL_PROVIDER_IDS,\n    default: undefined,\n  }),\n  AGENT_DEFAULT_PROVIDER_MODEL: str({\n    desc: 'Instance-wide default model ID used when the resolved provider matches AGENT_DEFAULT_PROVIDER and no workflow or workspace model is set. Optional. Use a model ID supported by that provider.',\n    default: undefined,\n  }),\n  AGENT_DEFAULT_PROVIDER_THINKING: str({\n    desc: 'Instance-wide default thinking effort used when the resolved provider matches AGENT_DEFAULT_PROVIDER and no workflow or workspace thinking effort is set. Optional. Accepted values are off, minimal, low, medium, high, and xhigh.',\n    choices: AGENT_THINKING_CHOICES,\n    default: undefined,\n  }),\n  AGENT_DEFAULT_PROVIDER_API_KEY: str({\n    desc: 'API key for the instance default provider. Optional. Must belong to AGENT_DEFAULT_PROVIDER. If you change the default provider, change this key too. Instance defaults support API-key-only providers.',\n    default: undefined,\n  }),\n  AGENT_PROVIDER_VALIDATION_TIMEOUT_MS: num({\n    desc: 'Maximum time in milliseconds to wait for the live provider test request when saving credentials.',\n    default: 10000,\n  }),\n  AGENT_CUSTOM_PROVIDER_ALLOW_PRIVATE_NETWORKS: bool({\n    desc: 'Allows custom model providers to use private, loopback, link-local, metadata, and .internal network targets. Keep this true for local development and self-hosted private networks. Set it to false on cloud instances.',\n    default: true,\n  }),\n  AGENT_CUSTOM_PROVIDER_HOST_DENYLIST: str({\n    desc: 'Comma-separated hosts and IP ranges that custom model providers may not call. Accepts exact hosts, suffix patterns such as .internal.example or *.internal.example, IP literals, and CIDR blocks such as 10.0.0.0/8.',\n    default: '',\n  }),\n  AGENT_PI_ENABLED_TOOL_PACKAGES: str({\n    desc: 'Comma-separated optional Pi tool packages enabled for this deployment. Defaults to pi-web-access so Pi web access is available. Set it to an empty value to enable only Pi built-in tools. Accepted values: pi-web-access.',\n    default: 'pi-web-access',\n  }),\n  AGENT_PI_WEB_SEARCH_ENABLED: bool({\n    desc: 'Enables Pi web search tools when pi-web-access is enabled. Set it to false to disable web_search and get_search_content while keeping fetch_content available.',\n    default: true,\n  }),\n});\n\nassertInstanceDefaultModelProviderApiKeyConfig();\n\nexport const harnessToolDeploymentConfig = buildHarnessToolDeploymentConfig({\n  piEnabledToolPackages: config.AGENT_PI_ENABLED_TOOL_PACKAGES,\n  piWebSearchEnabled: config.AGENT_PI_WEB_SEARCH_ENABLED,\n});\n\nfunction assertInstanceDefaultModelProviderApiKeyConfig(): void {\n  if (!config.AGENT_DEFAULT_PROVIDER_API_KEY) return;\n  if (!config.AGENT_DEFAULT_PROVIDER) {\n    throw new Error('AGENT_DEFAULT_PROVIDER_API_KEY requires AGENT_DEFAULT_PROVIDER to be set.');\n  }\n\n  const credentialFields =\n    getModelProviderEntry(config.AGENT_DEFAULT_PROVIDER as SupportedModelProviderId)\n      ?.credential_fields ?? [];\n  const field = credentialFields[0];\n  if (credentialFields.length === 1 && field?.key === 'api_key' && field.secret) return;\n\n  throw new Error(\n    'AGENT_DEFAULT_PROVIDER_API_KEY requires AGENT_DEFAULT_PROVIDER to use exactly one secret api_key credential field.',\n  );\n}\n"],"names":["agentThinkingSchema","buildHarnessToolDeploymentConfig","getModelProviderEntry","SUPPORTED_MODEL_PROVIDER_IDS","bool","createConfig","num","str","AGENT_THINKING_CHOICES","options","config","AGENT_DEFAULT_PROVIDER","desc","choices","default","undefined","AGENT_DEFAULT_PROVIDER_MODEL","AGENT_DEFAULT_PROVIDER_THINKING","AGENT_DEFAULT_PROVIDER_API_KEY","AGENT_PROVIDER_VALIDATION_TIMEOUT_MS","AGENT_CUSTOM_PROVIDER_ALLOW_PRIVATE_NETWORKS","AGENT_CUSTOM_PROVIDER_HOST_DENYLIST","AGENT_PI_ENABLED_TOOL_PACKAGES","AGENT_PI_WEB_SEARCH_ENABLED","assertInstanceDefaultModelProviderApiKeyConfig","harnessToolDeploymentConfig","piEnabledToolPackages","piWebSearchEnabled","Error","credentialFields","credential_fields","field","length","key","secret"],"mappings":"AAAA,SACEA,mBAAmB,EACnBC,gCAAgC,EAChCC,qBAAqB,EACrBC,4BAA4B,QAEvB,yBAAyB;AAChC,SAAQC,IAAI,EAAEC,YAAY,EAAEC,GAAG,EAAEC,GAAG,QAAO,kBAAkB;AAE7D,MAAMC,yBAAyBR,oBAAoBS,OAAO;AAE1D,OAAO,MAAMC,SAASL,aAAa;IACjCM,wBAAwBJ,IAAI;QAC1BK,MAAM;QACNC,SAASV;QACTW,SAASC;IACX;IACAC,8BAA8BT,IAAI;QAChCK,MAAM;QACNE,SAASC;IACX;IACAE,iCAAiCV,IAAI;QACnCK,MAAM;QACNC,SAASL;QACTM,SAASC;IACX;IACAG,gCAAgCX,IAAI;QAClCK,MAAM;QACNE,SAASC;IACX;IACAI,sCAAsCb,IAAI;QACxCM,MAAM;QACNE,SAAS;IACX;IACAM,8CAA8ChB,KAAK;QACjDQ,MAAM;QACNE,SAAS;IACX;IACAO,qCAAqCd,IAAI;QACvCK,MAAM;QACNE,SAAS;IACX;IACAQ,gCAAgCf,IAAI;QAClCK,MAAM;QACNE,SAAS;IACX;IACAS,6BAA6BnB,KAAK;QAChCQ,MAAM;QACNE,SAAS;IACX;AACF,GAAG;AAEHU;AAEA,OAAO,MAAMC,8BAA8BxB,iCAAiC;IAC1EyB,uBAAuBhB,OAAOY,8BAA8B;IAC5DK,oBAAoBjB,OAAOa,2BAA2B;AACxD,GAAG;AAEH,SAASC;IACP,IAAI,CAACd,OAAOQ,8BAA8B,EAAE;IAC5C,IAAI,CAACR,OAAOC,sBAAsB,EAAE;QAClC,MAAM,IAAIiB,MAAM;IAClB;IAEA,MAAMC,mBACJ3B,sBAAsBQ,OAAOC,sBAAsB,GAC/CmB,qBAAqB,EAAE;IAC7B,MAAMC,QAAQF,gBAAgB,CAAC,EAAE;IACjC,IAAIA,iBAAiBG,MAAM,KAAK,KAAKD,OAAOE,QAAQ,aAAaF,MAAMG,MAAM,EAAE;IAE/E,MAAM,IAAIN,MACR;AAEJ"}

package/dist/core/credential-fingerprints.d.ts

@@ -0,0 +1,10 @@
+import type { SupportedModelProviderId } from '@shipfox/api-agent-dto';
+export declare function agentSystemNamespace(providerId: string): string;
+export declare function toStoreKey(fieldKey: string): string;
+export declare function customCredentialToStoreKey(fieldKey: string): string;
+export declare function customStoreKeyToRuntimeKey(storeKey: string): string;
+export declare function customCredentialsToStoreValues(credentials: Record<string, string>): Record<string, string>;
+export declare function storeValuesToCustomRuntimeCredentials(values: Record<string, string>): Record<string, string>;
+export declare function credentialsToStoreValues(providerId: SupportedModelProviderId, credentials: Record<string, string>): Record<string, string>;
+export declare function storeValuesToRuntimeCredentials(providerId: SupportedModelProviderId, values: Record<string, string>): Record<string, string>;
+//# sourceMappingURL=credential-fingerprints.d.ts.map

package/dist/core/credential-fingerprints.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-fingerprints.d.ts","sourceRoot":"","sources":["../../src/core/credential-fingerprints.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAC,wBAAwB,EAAC,MAAM,wBAAwB,CAAC;AAIrE,wBAAgB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAE/D;AAED,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAEnD;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAKnE;AAED,wBAAgB,0BAA0B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAOnE;AAED,wBAAgB,8BAA8B,CAC5C,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAClC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxB;AAED,wBAAgB,qCAAqC,CACnD,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAIxB;AAED,wBAAgB,wBAAwB,CACtC,UAAU,EAAE,wBAAwB,EACpC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAClC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMxB;AAED,wBAAgB,+BAA+B,CAC7C,UAAU,EAAE,wBAAwB,EACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASxB"}

package/dist/core/credential-fingerprints.js

@@ -0,0 +1,65 @@
+import { getModelProviderEntry } from '@shipfox/api-agent-dto';
+import { UnsupportedModelProviderError } from './errors.js';
+export function agentSystemNamespace(providerId) {
+    return `system/agent/model-provider/${providerId}`;
+}
+export function toStoreKey(fieldKey) {
+    return fieldKey.toUpperCase();
+}
+export function customCredentialToStoreKey(fieldKey) {
+    if (fieldKey === 'api_key') return 'API_KEY';
+    if (fieldKey.startsWith('header:')) return `HEADER_${encodeStoreKey(fieldKey.slice('header:'.length))}`;
+    return `CREDENTIAL_${encodeStoreKey(fieldKey)}`;
+}
+export function customStoreKeyToRuntimeKey(storeKey) {
+    if (storeKey === 'API_KEY') return 'api_key';
+    if (storeKey.startsWith('HEADER_')) return `header:${decodeStoreKey(storeKey.slice('HEADER_'.length))}`;
+    if (storeKey.startsWith('CREDENTIAL_')) return decodeStoreKey(storeKey.slice('CREDENTIAL_'.length));
+    return storeKey.toLowerCase();
+}
+export function customCredentialsToStoreValues(credentials) {
+    return Object.fromEntries(Object.entries(credentials).map(([key, value])=>[
+            customCredentialToStoreKey(key),
+            value
+        ]));
+}
+export function storeValuesToCustomRuntimeCredentials(values) {
+    return Object.fromEntries(Object.entries(values).map(([key, value])=>[
+            customStoreKeyToRuntimeKey(key),
+            value
+        ]));
+}
+export function credentialsToStoreValues(providerId, credentials) {
+    const entry = getSupportedModelProviderEntry(providerId);
+    return Object.fromEntries(entry.credential_fields.map((field)=>[
+            toStoreKey(field.key),
+            credentials[field.key] ?? ''
+        ]));
+}
+export function storeValuesToRuntimeCredentials(providerId, values) {
+    const entry = getSupportedModelProviderEntry(providerId);
+    return Object.fromEntries(entry.credential_fields.flatMap((field)=>{
+        const value = values[toStoreKey(field.key)];
+        return value === undefined ? [] : [
+            [
+                field.key,
+                value
+            ]
+        ];
+    }));
+}
+function getSupportedModelProviderEntry(providerId) {
+    const entry = getModelProviderEntry(providerId);
+    if (entry === undefined || entry.support_status !== 'supported') {
+        throw new UnsupportedModelProviderError(providerId);
+    }
+    return entry;
+}
+function encodeStoreKey(value) {
+    return Buffer.from(value, 'utf8').toString('hex').toUpperCase();
+}
+function decodeStoreKey(value) {
+    return Buffer.from(value, 'hex').toString('utf8');
+}
+
+//# sourceMappingURL=credential-fingerprints.js.map

package/dist/core/credential-fingerprints.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/core/credential-fingerprints.ts"],"sourcesContent":["import type {SupportedModelProviderId} from '@shipfox/api-agent-dto';\nimport {getModelProviderEntry} from '@shipfox/api-agent-dto';\nimport {UnsupportedModelProviderError} from './errors.js';\n\nexport function agentSystemNamespace(providerId: string): string {\n  return `system/agent/model-provider/${providerId}`;\n}\n\nexport function toStoreKey(fieldKey: string): string {\n  return fieldKey.toUpperCase();\n}\n\nexport function customCredentialToStoreKey(fieldKey: string): string {\n  if (fieldKey === 'api_key') return 'API_KEY';\n  if (fieldKey.startsWith('header:'))\n    return `HEADER_${encodeStoreKey(fieldKey.slice('header:'.length))}`;\n  return `CREDENTIAL_${encodeStoreKey(fieldKey)}`;\n}\n\nexport function customStoreKeyToRuntimeKey(storeKey: string): string {\n  if (storeKey === 'API_KEY') return 'api_key';\n  if (storeKey.startsWith('HEADER_'))\n    return `header:${decodeStoreKey(storeKey.slice('HEADER_'.length))}`;\n  if (storeKey.startsWith('CREDENTIAL_'))\n    return decodeStoreKey(storeKey.slice('CREDENTIAL_'.length));\n  return storeKey.toLowerCase();\n}\n\nexport function customCredentialsToStoreValues(\n  credentials: Record<string, string>,\n): Record<string, string> {\n  return Object.fromEntries(\n    Object.entries(credentials).map(([key, value]) => [customCredentialToStoreKey(key), value]),\n  );\n}\n\nexport function storeValuesToCustomRuntimeCredentials(\n  values: Record<string, string>,\n): Record<string, string> {\n  return Object.fromEntries(\n    Object.entries(values).map(([key, value]) => [customStoreKeyToRuntimeKey(key), value]),\n  );\n}\n\nexport function credentialsToStoreValues(\n  providerId: SupportedModelProviderId,\n  credentials: Record<string, string>,\n): Record<string, string> {\n  const entry = getSupportedModelProviderEntry(providerId);\n\n  return Object.fromEntries(\n    entry.credential_fields.map((field) => [toStoreKey(field.key), credentials[field.key] ?? '']),\n  );\n}\n\nexport function storeValuesToRuntimeCredentials(\n  providerId: SupportedModelProviderId,\n  values: Record<string, string>,\n): Record<string, string> {\n  const entry = getSupportedModelProviderEntry(providerId);\n\n  return Object.fromEntries(\n    entry.credential_fields.flatMap((field) => {\n      const value = values[toStoreKey(field.key)];\n      return value === undefined ? [] : [[field.key, value]];\n    }),\n  );\n}\n\nfunction getSupportedModelProviderEntry(providerId: SupportedModelProviderId) {\n  const entry = getModelProviderEntry(providerId);\n  if (entry === undefined || entry.support_status !== 'supported') {\n    throw new UnsupportedModelProviderError(providerId);\n  }\n  return entry;\n}\n\nfunction encodeStoreKey(value: string): string {\n  return Buffer.from(value, 'utf8').toString('hex').toUpperCase();\n}\n\nfunction decodeStoreKey(value: string): string {\n  return Buffer.from(value, 'hex').toString('utf8');\n}\n"],"names":["getModelProviderEntry","UnsupportedModelProviderError","agentSystemNamespace","providerId","toStoreKey","fieldKey","toUpperCase","customCredentialToStoreKey","startsWith","encodeStoreKey","slice","length","customStoreKeyToRuntimeKey","storeKey","decodeStoreKey","toLowerCase","customCredentialsToStoreValues","credentials","Object","fromEntries","entries","map","key","value","storeValuesToCustomRuntimeCredentials","values","credentialsToStoreValues","entry","getSupportedModelProviderEntry","credential_fields","field","storeValuesToRuntimeCredentials","flatMap","undefined","support_status","Buffer","from","toString"],"mappings":"AACA,SAAQA,qBAAqB,QAAO,yBAAyB;AAC7D,SAAQC,6BAA6B,QAAO,cAAc;AAE1D,OAAO,SAASC,qBAAqBC,UAAkB;IACrD,OAAO,CAAC,4BAA4B,EAAEA,YAAY;AACpD;AAEA,OAAO,SAASC,WAAWC,QAAgB;IACzC,OAAOA,SAASC,WAAW;AAC7B;AAEA,OAAO,SAASC,2BAA2BF,QAAgB;IACzD,IAAIA,aAAa,WAAW,OAAO;IACnC,IAAIA,SAASG,UAAU,CAAC,YACtB,OAAO,CAAC,OAAO,EAAEC,eAAeJ,SAASK,KAAK,CAAC,UAAUC,MAAM,IAAI;IACrE,OAAO,CAAC,WAAW,EAAEF,eAAeJ,WAAW;AACjD;AAEA,OAAO,SAASO,2BAA2BC,QAAgB;IACzD,IAAIA,aAAa,WAAW,OAAO;IACnC,IAAIA,SAASL,UAAU,CAAC,YACtB,OAAO,CAAC,OAAO,EAAEM,eAAeD,SAASH,KAAK,CAAC,UAAUC,MAAM,IAAI;IACrE,IAAIE,SAASL,UAAU,CAAC,gBACtB,OAAOM,eAAeD,SAASH,KAAK,CAAC,cAAcC,MAAM;IAC3D,OAAOE,SAASE,WAAW;AAC7B;AAEA,OAAO,SAASC,+BACdC,WAAmC;IAEnC,OAAOC,OAAOC,WAAW,CACvBD,OAAOE,OAAO,CAACH,aAAaI,GAAG,CAAC,CAAC,CAACC,KAAKC,MAAM,GAAK;YAAChB,2BAA2Be;YAAMC;SAAM;AAE9F;AAEA,OAAO,SAASC,sCACdC,MAA8B;IAE9B,OAAOP,OAAOC,WAAW,CACvBD,OAAOE,OAAO,CAACK,QAAQJ,GAAG,CAAC,CAAC,CAACC,KAAKC,MAAM,GAAK;YAACX,2BAA2BU;YAAMC;SAAM;AAEzF;AAEA,OAAO,SAASG,yBACdvB,UAAoC,EACpCc,WAAmC;IAEnC,MAAMU,QAAQC,+BAA+BzB;IAE7C,OAAOe,OAAOC,WAAW,CACvBQ,MAAME,iBAAiB,CAACR,GAAG,CAAC,CAACS,QAAU;YAAC1B,WAAW0B,MAAMR,GAAG;YAAGL,WAAW,CAACa,MAAMR,GAAG,CAAC,IAAI;SAAG;AAEhG;AAEA,OAAO,SAASS,gCACd5B,UAAoC,EACpCsB,MAA8B;IAE9B,MAAME,QAAQC,+BAA+BzB;IAE7C,OAAOe,OAAOC,WAAW,CACvBQ,MAAME,iBAAiB,CAACG,OAAO,CAAC,CAACF;QAC/B,MAAMP,QAAQE,MAAM,CAACrB,WAAW0B,MAAMR,GAAG,EAAE;QAC3C,OAAOC,UAAUU,YAAY,EAAE,GAAG;YAAC;gBAACH,MAAMR,GAAG;gBAAEC;aAAM;SAAC;IACxD;AAEJ;AAEA,SAASK,+BAA+BzB,UAAoC;IAC1E,MAAMwB,QAAQ3B,sBAAsBG;IACpC,IAAIwB,UAAUM,aAAaN,MAAMO,cAAc,KAAK,aAAa;QAC/D,MAAM,IAAIjC,8BAA8BE;IAC1C;IACA,OAAOwB;AACT;AAEA,SAASlB,eAAec,KAAa;IACnC,OAAOY,OAAOC,IAAI,CAACb,OAAO,QAAQc,QAAQ,CAAC,OAAO/B,WAAW;AAC/D;AAEA,SAASQ,eAAeS,KAAa;IACnC,OAAOY,OAAOC,IAAI,CAACb,OAAO,OAAOc,QAAQ,CAAC;AAC5C"}

package/dist/core/custom-model-provider-config-service.d.ts

@@ -0,0 +1,26 @@
+import { type CreateCustomModelProviderBodyDto, type DiscoverCustomModelProviderModelsBodyDto, type DiscoverCustomModelProviderModelsBySlugBodyDto, type ModelProviderRef, type UpdateCustomModelProviderBodyDto } from '@shipfox/api-agent-dto';
+import type { ModelProviderConfig } from './entities/model-provider-config.js';
+import { probeCustomModelProviderCredentials } from './model-provider-validation.js';
+export interface CreateCustomModelProviderConfigParams {
+    workspaceId: string;
+    body: CreateCustomModelProviderBodyDto;
+    setAsDefault?: boolean | undefined;
+    signal?: AbortSignal | undefined;
+}
+export interface UpdateCustomModelProviderConfigParams {
+    workspaceId: string;
+    providerId: ModelProviderRef;
+    body: UpdateCustomModelProviderBodyDto;
+    signal?: AbortSignal | undefined;
+}
+export interface CustomModelProviderConfigServiceOptions {
+    probe?: typeof probeCustomModelProviderCredentials | undefined;
+}
+export declare function createCustomModelProviderConfig(params: CreateCustomModelProviderConfigParams, options?: CustomModelProviderConfigServiceOptions): Promise<ModelProviderConfig>;
+export declare function updateCustomModelProviderConfig(params: UpdateCustomModelProviderConfigParams, options?: CustomModelProviderConfigServiceOptions): Promise<ModelProviderConfig>;
+export declare function resolveCustomModelProviderDiscoveryParams(params: {
+    workspaceId: string;
+    providerId: ModelProviderRef;
+    body: DiscoverCustomModelProviderModelsBySlugBodyDto;
+}): Promise<DiscoverCustomModelProviderModelsBodyDto>;
+//# sourceMappingURL=custom-model-provider-config-service.d.ts.map

package/dist/core/custom-model-provider-config-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-model-provider-config-service.d.ts","sourceRoot":"","sources":["../../src/core/custom-model-provider-config-service.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,gCAAgC,EAKrC,KAAK,wCAAwC,EAC7C,KAAK,8CAA8C,EACnD,KAAK,gBAAgB,EACrB,KAAK,gCAAgC,EAEtC,MAAM,wBAAwB,CAAC;AAgBhC,OAAO,KAAK,EAAC,mBAAmB,EAAC,MAAM,qCAAqC,CAAC;AAQ7E,OAAO,EAEL,mCAAmC,EAEpC,MAAM,gCAAgC,CAAC;AAExC,MAAM,WAAW,qCAAqC;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,gCAAgC,CAAC;IACvC,YAAY,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACnC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,qCAAqC;IACpD,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,gBAAgB,CAAC;IAC7B,IAAI,EAAE,gCAAgC,CAAC;IACvC,MAAM,CAAC,EAAE,WAAW,GAAG,SAAS,CAAC;CAClC;AAED,MAAM,WAAW,uCAAuC;IACtD,KAAK,CAAC,EAAE,OAAO,mCAAmC,GAAG,SAAS,CAAC;CAChE;AASD,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,qCAAqC,EAC7C,OAAO,GAAE,uCAA4C,GACpD,OAAO,CAAC,mBAAmB,CAAC,CAyE9B;AAED,wBAAsB,+BAA+B,CACnD,MAAM,EAAE,qCAAqC,EAC7C,OAAO,GAAE,uCAA4C,GACpD,OAAO,CAAC,mBAAmB,CAAC,CAoG9B;AAED,wBAAsB,yCAAyC,CAAC,MAAM,EAAE;IACtE,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,gBAAgB,CAAC;IAC7B,IAAI,EAAE,8CAA8C,CAAC;CACtD,GAAG,OAAO,CAAC,wCAAwC,CAAC,CA2BpD"}