@srouterhq/server 0.0.0-stage → 0.9.0

package/dist/scripts/test-all-models.js

@@ -0,0 +1,56 @@
+/**
+ * Probe every enabled model with a minimal request to find broken model IDs.
+ * Usage: npx tsx src/scripts/test-all-models.ts
+ */
+import { initDb, getDb } from '../db/index.js';
+import { decrypt } from '../lib/crypto.js';
+import { getProvider } from '../providers/index.js';
+initDb();
+const db = getDb();
+const models = db.prepare(`
+  SELECT m.id, m.platform, m.model_id, m.display_name
+    FROM models m
+   WHERE m.enabled = 1
+     AND EXISTS (SELECT 1 FROM api_keys k WHERE k.platform = m.platform AND k.enabled = 1)
+   ORDER BY m.intelligence_rank, m.platform
+`).all();
+const keyStmt = db.prepare(`
+  SELECT encrypted_key, iv, auth_tag FROM api_keys
+   WHERE platform = ? AND enabled = 1 ORDER BY id LIMIT 1
+`);
+const results = [];
+for (const row of models) {
+    const keyRow = keyStmt.get(row.platform);
+    if (!keyRow) {
+        results.push({ row, ok: false, ms: 0, error: 'no key' });
+        continue;
+    }
+    const apiKey = decrypt(keyRow.encrypted_key, keyRow.iv, keyRow.auth_tag);
+    const provider = getProvider(row.platform);
+    if (!provider) {
+        results.push({ row, ok: false, ms: 0, error: 'no provider' });
+        continue;
+    }
+    const start = Date.now();
+    try {
+        // 120s: NVIDIA NIM cold starts regularly take 15-60s and frontier reasoning
+        // models longer — at the default 15s they false-flag as broken (V23 audit).
+        const res = await provider.chatCompletion(apiKey, [{ role: 'user', content: 'hi' }], row.model_id, { max_tokens: 5, timeoutMs: 120000 });
+        const raw = res.choices?.[0]?.message?.content;
+        const reply = typeof raw === 'string' ? raw.slice(0, 40) : '';
+        results.push({ row, ok: true, ms: Date.now() - start, reply });
+    }
+    catch (err) {
+        results.push({ row, ok: false, ms: Date.now() - start, error: String(err?.message ?? err).slice(0, 200) });
+    }
+}
+console.log('\n=== Results ===\n');
+const pad = (s, n) => s.length > n ? s.slice(0, n - 1) + '…' : s.padEnd(n);
+for (const r of results) {
+    const status = r.ok ? '✓' : '✗';
+    console.log(`${status} ${pad(r.row.platform, 12)} ${pad(r.row.model_id, 52)} ${String(r.ms).padStart(5)}ms  ${r.ok ? `"${r.reply}"` : r.error}`);
+}
+const okCount = results.filter(r => r.ok).length;
+console.log(`\n${okCount}/${results.length} models working\n`);
+process.exit(0);
+//# sourceMappingURL=test-all-models.js.map

package/dist/scripts/test-all-models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"test-all-models.js","sourceRoot":"","sources":["../../src/scripts/test-all-models.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AAEpD,MAAM,EAAE,CAAC;AACT,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;AAcnB,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC;;;;;;CAMzB,CAAC,CAAC,GAAG,EAAW,CAAC;AAElB,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC;;;CAG1B,CAAC,CAAC;AAEH,MAAM,OAAO,GAA4E,EAAE,CAAC;AAE5F,KAAK,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAoB,CAAC;IAC5D,IAAI,CAAC,MAAM,EAAE,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAAC,SAAS;IAAC,CAAC;IACpF,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzE,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,QAAe,CAAC,CAAC;IAClD,IAAI,CAAC,QAAQ,EAAE,CAAC;QAAC,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC;QAAC,SAAS;IAAC,CAAC;IAE3F,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IACzB,IAAI,CAAC;QACH,4EAA4E;QAC5E,4EAA4E;QAC5E,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,CAAC,CAAC;QACzI,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC;QAC/C,MAAM,KAAK,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC7G,CAAC;AACH,CAAC;AAED,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;AACnC,MAAM,GAAG,GAAG,CAAC,CAAS,EAAE,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AAC3F,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;AACnJ,CAAC;AACD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;AACjD,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,IAAI,OAAO,CAAC,MAAM,mBAAmB,CAAC,CAAC;AAE/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC"}

package/dist/services/anthropic-map.d.ts

@@ -0,0 +1,39 @@
+import { z } from 'zod';
+export declare const CLAUDE_FAMILIES: readonly ["default", "opus", "sonnet", "haiku"];
+export type ClaudeFamily = (typeof CLAUDE_FAMILIES)[number];
+export type AnthropicModelMap = Record<ClaudeFamily, string>;
+export declare const anthropicModelMapSchema: z.ZodObject<{
+    default: z.ZodOptional<z.ZodString>;
+    opus: z.ZodOptional<z.ZodString>;
+    sonnet: z.ZodOptional<z.ZodString>;
+    haiku: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    haiku?: string | undefined;
+    default?: string | undefined;
+    opus?: string | undefined;
+    sonnet?: string | undefined;
+}, {
+    haiku?: string | undefined;
+    default?: string | undefined;
+    opus?: string | undefined;
+    sonnet?: string | undefined;
+}>;
+export declare function getClaudeModelMap(): AnthropicModelMap;
+export declare function setClaudeModelMap(input: unknown): AnthropicModelMap;
+export declare function classifyClaudeFamily(model?: string): ClaudeFamily | null;
+export interface ResolvedAnthropicModel {
+    preferredModelDbId?: number;
+    modelId?: string;
+    pinned: boolean;
+}
+export declare function resolveAnthropicModel(model?: string): ResolvedAnthropicModel;
+export declare const CLAUDE_FAMILY_ALIASES: {
+    id: string;
+    family: ClaudeFamily;
+    label: string;
+}[];
+export declare function claudeFamilyDiscoveryEntries(): {
+    id: string;
+    displayName: string;
+}[];
+//# sourceMappingURL=anthropic-map.d.ts.map

package/dist/services/anthropic-map.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic-map.d.ts","sourceRoot":"","sources":["../../src/services/anthropic-map.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAgBxB,eAAO,MAAM,eAAe,iDAAkD,CAAC;AAC/E,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC;AAE5D,MAAM,MAAM,iBAAiB,GAAG,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;AAI7D,eAAO,MAAM,uBAAuB;;;;;;;;;;;;;;;EAKzB,CAAC;AAEZ,wBAAgB,iBAAiB,IAAI,iBAAiB,CAcrD;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,GAAG,iBAAiB,CAWnE;AAID,wBAAgB,oBAAoB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI,CAYxE;AAED,MAAM,WAAW,sBAAsB;IAErC,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAK5B,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,MAAM,EAAE,OAAO,CAAC;CACjB;AAKD,wBAAgB,qBAAqB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,sBAAsB,CA8B5E;AAiBD,eAAO,MAAM,qBAAqB,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,EAItF,CAAC;AAIF,wBAAgB,4BAA4B,IAAI;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,EAAE,CAWpF"}

package/dist/services/anthropic-map.js

@@ -0,0 +1,138 @@
+import { z } from 'zod';
+import { getDb, getSetting, setSetting } from '../db/index.js';
+// Claude Code model mapping. Claude Code keeps its built-in model names
+// (e.g. `claude-sonnet-4-5` as the main model, `claude-3-5-haiku` as the
+// small/fast background model) and sends them verbatim to `/v1/messages`.
+// Since this proxy serves a free model pool (not the real Claude cloud
+// models), we map each Claude family to either "auto" (let the router pick —
+// the default and the common case) or a specific catalog model the operator
+// pins. A concrete catalog model id sent directly (e.g. the user set
+// ANTHROPIC_MODEL to one of our models) bypasses the map and pins as-is.
+//
+// Stored as a JSON blob in the `settings` table — no migration needed.
+const SETTING_KEY = 'anthropic_model_map';
+export const CLAUDE_FAMILIES = ['default', 'opus', 'sonnet', 'haiku'];
+const DEFAULT_MAP = { default: 'auto', opus: 'auto', sonnet: 'auto', haiku: 'auto' };
+export const anthropicModelMapSchema = z.object({
+    default: z.string().min(1).optional(),
+    opus: z.string().min(1).optional(),
+    sonnet: z.string().min(1).optional(),
+    haiku: z.string().min(1).optional(),
+}).strict();
+export function getClaudeModelMap() {
+    const raw = getSetting(SETTING_KEY);
+    if (!raw)
+        return { ...DEFAULT_MAP };
+    try {
+        const p = JSON.parse(raw);
+        return {
+            default: typeof p.default === 'string' && p.default ? p.default : 'auto',
+            opus: typeof p.opus === 'string' && p.opus ? p.opus : 'auto',
+            sonnet: typeof p.sonnet === 'string' && p.sonnet ? p.sonnet : 'auto',
+            haiku: typeof p.haiku === 'string' && p.haiku ? p.haiku : 'auto',
+        };
+    }
+    catch {
+        return { ...DEFAULT_MAP };
+    }
+}
+export function setClaudeModelMap(input) {
+    const patch = anthropicModelMapSchema.parse(input);
+    const current = getClaudeModelMap();
+    const next = {
+        default: patch.default ?? current.default,
+        opus: patch.opus ?? current.opus,
+        sonnet: patch.sonnet ?? current.sonnet,
+        haiku: patch.haiku ?? current.haiku,
+    };
+    setSetting(SETTING_KEY, JSON.stringify(next));
+    return next;
+}
+// Classify a requested model into a Claude family, or null when it's not a
+// Claude alias at all (a concrete catalog id meant to pin directly).
+export function classifyClaudeFamily(model) {
+    const m = (model ?? '').trim().toLowerCase();
+    if (!m || m === 'auto' || m === 'default' || m === 'srouter-auto')
+        return 'default';
+    // Claude Code's planning alias is opus-ish by name but must hit the catch-all,
+    // so match it before the substring family checks below.
+    if (m === 'opusplan' || m === 'opusplan-4')
+        return 'default';
+    if (m.includes('opus'))
+        return 'opus';
+    if (m.includes('sonnet'))
+        return 'sonnet';
+    if (m.includes('haiku'))
+        return 'haiku';
+    // Any other claude-ish alias → the catch-all.
+    if (m.startsWith('claude'))
+        return 'default';
+    return null;
+}
+// Resolve the model a `/v1/messages` request should route to, honoring the
+// operator's family map. Returns undefined preferredModelDbId to mean
+// "auto-route" (the default for every family unless the operator pinned one).
+export function resolveAnthropicModel(model) {
+    const db = getDb();
+    // A model_id can exist on several platforms at once (the same open-weights
+    // model relayed by two providers). The row we pin is only the head hint —
+    // the caller routes over the whole group — but an arbitrary SQLite row order
+    // made the head flap between providers run to run, so pick deterministically:
+    // chain priority first (ascending, as everywhere else), then insertion order.
+    const lookupEnabled = (modelId) => db.prepare(`
+      SELECT m.id as id, m.model_id as model_id
+      FROM models m
+      LEFT JOIN fallback_config fc ON fc.model_db_id = m.id
+      WHERE m.model_id = ? AND m.enabled = 1
+      ORDER BY COALESCE(fc.priority, 0) ASC, m.id ASC
+      LIMIT 1
+    `).get(modelId);
+    const family = classifyClaudeFamily(model);
+    if (family) {
+        const target = getClaudeModelMap()[family];
+        if (!target || target === 'auto')
+            return { pinned: false };
+        const row = lookupEnabled(target);
+        // A pinned-but-now-disabled/removed target degrades gracefully to auto.
+        return row ? { preferredModelDbId: row.id, modelId: row.model_id, pinned: true } : { pinned: false };
+    }
+    // Not a Claude alias: treat as a concrete catalog model id and pin it if it
+    // exists and is enabled; otherwise auto-route (lenient, like the OpenAI route).
+    const row = lookupEnabled((model ?? '').trim());
+    return row ? { preferredModelDbId: row.id, modelId: row.model_id, pinned: true } : { pinned: false };
+}
+// The canonical Claude id this gateway answers to for each family, and the
+// label discovery shows for it.
+//
+// These are NOT real Claude cloud models and are not presented as such: every
+// one of them is already accepted by `/v1/messages`, where classifyClaudeFamily
+// maps it onto the free pool through the operator's family map. They are listed
+// in `GET /v1/models` because some Anthropic clients only accept ids that look
+// like Claude models and reject a catalog of free-model ids outright. Claude
+// Desktop's third-party gateway picker is the reported case (#880): it fetched
+// the full catalog over HTTP 200 and still reported "found 0 models", because
+// nothing in it belonged to a Claude family.
+//
+// Listing them is honest in the sense that matters for discovery: these are ids
+// the gateway really will serve. The display name says where the request
+// actually goes so nobody reads the entry as hosted Claude.
+export const CLAUDE_FAMILY_ALIASES = [
+    { id: 'claude-opus-4-5', family: 'opus', label: 'Opus' },
+    { id: 'claude-sonnet-4-5', family: 'sonnet', label: 'Sonnet' },
+    { id: 'claude-haiku-4-5', family: 'haiku', label: 'Haiku' },
+];
+// Discovery entries for the family aliases, named after where each one routes:
+// the pinned catalog model when the operator pinned one, otherwise the router.
+export function claudeFamilyDiscoveryEntries() {
+    const map = getClaudeModelMap();
+    return CLAUDE_FAMILY_ALIASES.map(({ id, family, label }) => {
+        const target = map[family];
+        return {
+            id,
+            displayName: !target || target === 'auto'
+                ? `${label} slot (auto-routed to a free model)`
+                : `${label} slot (routed to ${target})`,
+        };
+    });
+}
+//# sourceMappingURL=anthropic-map.js.map

package/dist/services/anthropic-map.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic-map.js","sourceRoot":"","sources":["../../src/services/anthropic-map.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AAE/D,wEAAwE;AACxE,yEAAyE;AACzE,0EAA0E;AAC1E,uEAAuE;AACvE,6EAA6E;AAC7E,4EAA4E;AAC5E,qEAAqE;AACrE,yEAAyE;AACzE,EAAE;AACF,uEAAuE;AAEvE,MAAM,WAAW,GAAG,qBAAqB,CAAC;AAE1C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,CAAU,CAAC;AAK/E,MAAM,WAAW,GAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AAExG,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,CAAC,MAAM,CAAC;IAC9C,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACrC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpC,CAAC,CAAC,MAAM,EAAE,CAAC;AAEZ,MAAM,UAAU,iBAAiB;IAC/B,MAAM,GAAG,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,GAAG,WAAW,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA+B,CAAC;QACxD,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;YACxE,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM;YAC5D,MAAM,EAAE,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;YACpE,KAAK,EAAE,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM;SACjE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,GAAG,WAAW,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,MAAM,KAAK,GAAG,uBAAuB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACnD,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAsB;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO;QACzC,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI;QAChC,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM;QACtC,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,OAAO,CAAC,KAAK;KACpC,CAAC;IACF,UAAU,CAAC,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,qEAAqE;AACrE,MAAM,UAAU,oBAAoB,CAAC,KAAc;IACjD,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7C,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,cAAc;QAAE,OAAO,SAAS,CAAC;IACpF,+EAA+E;IAC/E,wDAAwD;IACxD,IAAI,CAAC,KAAK,UAAU,IAAI,CAAC,KAAK,YAAY;QAAE,OAAO,SAAS,CAAC;IAC7D,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACtC,IAAI,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACxC,8CAA8C;IAC9C,IAAI,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,OAAO,IAAI,CAAC;AACd,CAAC;AAcD,2EAA2E;AAC3E,sEAAsE;AACtE,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CAAC,KAAc;IAClD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,2EAA2E;IAC3E,0EAA0E;IAC1E,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E,MAAM,aAAa,GAAG,CAAC,OAAe,EAAgD,EAAE,CACtF,EAAE,CAAC,OAAO,CAAC;;;;;;;KAOV,CAAC,CAAC,GAAG,CAAC,OAAO,CAAiD,CAAC;IAElE,MAAM,MAAM,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM;YAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QAC3D,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QAClC,wEAAwE;QACxE,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACvG,CAAC;IAED,4EAA4E;IAC5E,gFAAgF;IAChF,MAAM,GAAG,GAAG,aAAa,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IAChD,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,GAAG,CAAC,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AACvG,CAAC;AAED,2EAA2E;AAC3E,gCAAgC;AAChC,EAAE;AACF,8EAA8E;AAC9E,gFAAgF;AAChF,gFAAgF;AAChF,+EAA+E;AAC/E,6EAA6E;AAC7E,+EAA+E;AAC/E,8EAA8E;AAC9E,6CAA6C;AAC7C,EAAE;AACF,gFAAgF;AAChF,yEAAyE;AACzE,4DAA4D;AAC5D,MAAM,CAAC,MAAM,qBAAqB,GAA0D;IAC1F,EAAE,EAAE,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE;IACxD,EAAE,EAAE,EAAE,mBAAmB,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,QAAQ,EAAE;IAC9D,EAAE,EAAE,EAAE,kBAAkB,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE;CAC5D,CAAC;AAEF,+EAA+E;AAC/E,+EAA+E;AAC/E,MAAM,UAAU,4BAA4B;IAC1C,MAAM,GAAG,GAAG,iBAAiB,EAAE,CAAC;IAChC,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE;QACzD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,OAAO;YACL,EAAE;YACF,WAAW,EAAE,CAAC,MAAM,IAAI,MAAM,KAAK,MAAM;gBACvC,CAAC,CAAC,GAAG,KAAK,qCAAqC;gBAC/C,CAAC,CAAC,GAAG,KAAK,oBAAoB,MAAM,GAAG;SAC1C,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/services/auth.d.ts

@@ -0,0 +1,30 @@
+export interface SessionUser {
+    userId: number;
+    email: string;
+}
+/** The one spelling of an address the DB is keyed on. Exported so callers that
+ *  bucket by email (the login throttle in routes/auth.ts) key on exactly what
+ *  verifyCredentials will look up — keying on anything else lets a padded
+ *  address authenticate against the real row while landing in its own bucket. */
+export declare function normalizeEmail(email: string): string;
+export declare function userCount(): number;
+/** Create a user. Throws { code: 'email_taken' } if the email already exists. */
+export declare function createUser(email: string, password: string): SessionUser;
+/** Verify credentials. Returns the user on success, null on failure. */
+export declare function verifyCredentials(email: string, password: string): SessionUser | null;
+/** Mint a session and return the raw token (only the hash is persisted). */
+export declare function createSession(userId: number): string;
+/** Resolve a session token to its user, or null if missing/expired. */
+export declare function validateSession(token: string | undefined | null): SessionUser | null;
+export declare function deleteSession(token: string | undefined | null): void;
+/** Update the email of the authenticated user after verifying the current password. Throws { code: 'email_taken' } on conflict. */
+export declare function updateEmail(userId: number, currentPassword: string, newEmail: string): boolean;
+/** Update the password of the authenticated user after verifying the current one. Invalidates all sessions on success. */
+export declare function updatePassword(userId: number, currentPassword: string, newPassword: string): boolean;
+/**
+ * Reset the password for the single existing user and invalidate all
+ * sessions.
+ * Returns false if no user exists.
+ */
+export declare function resetUserPassword(newPassword: string): boolean;
+//# sourceMappingURL=auth.d.ts.map

package/dist/services/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/services/auth.ts"],"names":[],"mappings":"AAUA,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;CACf;AAMD;;;iFAGiF;AACjF,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,wBAAgB,SAAS,IAAI,MAAM,CAGlC;AAED,iFAAiF;AACjF,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW,CAYvE;AAED,wEAAwE;AACxE,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW,GAAG,IAAI,CAOrF;AAED,4EAA4E;AAC5E,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAKpD;AAED,uEAAuE;AACvE,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,WAAW,GAAG,IAAI,CAcpF;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,IAAI,CAGpE;AAED,mIAAmI;AACnI,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAiB9F;AAED,0HAA0H;AAC1H,wBAAgB,cAAc,CAAC,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,OAAO,CASpG;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAO9D"}

package/dist/services/auth.js

@@ -0,0 +1,124 @@
+import crypto from 'crypto';
+import { getDb } from '../db/index.js';
+import { hashPassword, verifyPassword } from '../lib/password.js';
+// Dashboard authentication: email + password accounts with opaque session
+// tokens. Distinct from the unified API key, which authenticates the /v1 proxy
+// for apps — this gates the /api/* admin surface for the human operator (#35).
+const SESSION_TTL_MS = 30 * 24 * 60 * 60 * 1000; // 30 days
+function sha256(s) {
+    return crypto.createHash('sha256').update(s).digest('hex');
+}
+/** The one spelling of an address the DB is keyed on. Exported so callers that
+ *  bucket by email (the login throttle in routes/auth.ts) key on exactly what
+ *  verifyCredentials will look up — keying on anything else lets a padded
+ *  address authenticate against the real row while landing in its own bucket. */
+export function normalizeEmail(email) {
+    return email.trim().toLowerCase();
+}
+export function userCount() {
+    const row = getDb().prepare('SELECT COUNT(*) AS c FROM users').get();
+    return row.c;
+}
+/** Create a user. Throws { code: 'email_taken' } if the email already exists. */
+export function createUser(email, password) {
+    const db = getDb();
+    const normalized = normalizeEmail(email);
+    const existing = db.prepare('SELECT id FROM users WHERE email = ?').get(normalized);
+    if (existing) {
+        const err = new Error('An account with that email already exists');
+        err.code = 'email_taken';
+        throw err;
+    }
+    const result = db.prepare('INSERT INTO users (email, password_hash) VALUES (?, ?)')
+        .run(normalized, hashPassword(password));
+    return { userId: Number(result.lastInsertRowid), email: normalized };
+}
+/** Verify credentials. Returns the user on success, null on failure. */
+export function verifyCredentials(email, password) {
+    const db = getDb();
+    const row = db.prepare('SELECT id, email, password_hash FROM users WHERE email = ?')
+        .get(normalizeEmail(email));
+    if (!row)
+        return null;
+    if (!verifyPassword(password, row.password_hash))
+        return null;
+    return { userId: row.id, email: row.email };
+}
+/** Mint a session and return the raw token (only the hash is persisted). */
+export function createSession(userId) {
+    const token = crypto.randomBytes(32).toString('hex');
+    getDb().prepare('INSERT INTO sessions (token_hash, user_id, expires_at_ms) VALUES (?, ?, ?)')
+        .run(sha256(token), userId, Date.now() + SESSION_TTL_MS);
+    return token;
+}
+/** Resolve a session token to its user, or null if missing/expired. */
+export function validateSession(token) {
+    if (!token)
+        return null;
+    const db = getDb();
+    const row = db.prepare(`
+    SELECT s.user_id, s.expires_at_ms, u.email
+    FROM sessions s JOIN users u ON u.id = s.user_id
+    WHERE s.token_hash = ?
+  `).get(sha256(token));
+    if (!row)
+        return null;
+    if (row.expires_at_ms < Date.now()) {
+        db.prepare('DELETE FROM sessions WHERE token_hash = ?').run(sha256(token));
+        return null;
+    }
+    return { userId: row.user_id, email: row.email };
+}
+export function deleteSession(token) {
+    if (!token)
+        return;
+    getDb().prepare('DELETE FROM sessions WHERE token_hash = ?').run(sha256(token));
+}
+/** Update the email of the authenticated user after verifying the current password. Throws { code: 'email_taken' } on conflict. */
+export function updateEmail(userId, currentPassword, newEmail) {
+    const db = getDb();
+    const row = db.prepare('SELECT password_hash FROM users WHERE id = ?')
+        .get(userId);
+    if (!row)
+        return false;
+    if (!verifyPassword(currentPassword, row.password_hash))
+        return false;
+    const normalized = normalizeEmail(newEmail);
+    const existing = db.prepare('SELECT id FROM users WHERE email = ? AND id != ?').get(normalized, userId);
+    if (existing) {
+        const err = new Error('An account with that email already exists');
+        err.code = 'email_taken';
+        throw err;
+    }
+    db.prepare('UPDATE users SET email = ? WHERE id = ?').run(normalized, userId);
+    // Keep sessions alive; the new email will be reflected on the next validateSession call.
+    return true;
+}
+/** Update the password of the authenticated user after verifying the current one. Invalidates all sessions on success. */
+export function updatePassword(userId, currentPassword, newPassword) {
+    const db = getDb();
+    const row = db.prepare('SELECT password_hash FROM users WHERE id = ?')
+        .get(userId);
+    if (!row)
+        return false;
+    if (!verifyPassword(currentPassword, row.password_hash))
+        return false;
+    db.prepare('UPDATE users SET password_hash = ? WHERE id = ?').run(hashPassword(newPassword), userId);
+    db.prepare('DELETE FROM sessions WHERE user_id = ?').run(userId);
+    return true;
+}
+/**
+ * Reset the password for the single existing user and invalidate all
+ * sessions.
+ * Returns false if no user exists.
+ */
+export function resetUserPassword(newPassword) {
+    const db = getDb();
+    const row = db.prepare('SELECT id FROM users LIMIT 1').get();
+    if (!row)
+        return false;
+    db.prepare('UPDATE users SET password_hash = ? WHERE id = ?').run(hashPassword(newPassword), row.id);
+    db.prepare('DELETE FROM sessions WHERE user_id = ?').run(row.id);
+    return true;
+}
+//# sourceMappingURL=auth.js.map

package/dist/services/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/services/auth.ts"],"names":[],"mappings":"AAAA,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,KAAK,EAAE,MAAM,gBAAgB,CAAC;AACvC,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AAElE,0EAA0E;AAC1E,+EAA+E;AAC/E,+EAA+E;AAE/E,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,UAAU;AAO3D,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED;;;iFAGiF;AACjF,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,MAAM,GAAG,GAAG,KAAK,EAAE,CAAC,OAAO,CAAC,iCAAiC,CAAC,CAAC,GAAG,EAAmB,CAAC;IACtF,OAAO,GAAG,CAAC,CAAC,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,UAAU,CAAC,KAAa,EAAE,QAAgB;IACxD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,UAAU,GAAG,cAAc,CAAC,KAAK,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,sCAAsC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IACpF,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,2CAA2C,CAAQ,CAAC;QAC1E,GAAG,CAAC,IAAI,GAAG,aAAa,CAAC;QACzB,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAG,EAAE,CAAC,OAAO,CAAC,wDAAwD,CAAC;SAChF,GAAG,CAAC,UAAU,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;AACvE,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,iBAAiB,CAAC,KAAa,EAAE,QAAgB;IAC/D,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,4DAA4D,CAAC;SACjF,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,CAAqE,CAAC;IAClG,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9D,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;AAC9C,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,MAAc;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,KAAK,EAAE,CAAC,OAAO,CAAC,4EAA4E,CAAC;SAC1F,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC;IAC3D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,eAAe,CAAC,KAAgC;IAC9D,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC;;;;GAItB,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAA0E,CAAC;IAC/F,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,GAAG,CAAC,aAAa,GAAG,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QACnC,EAAE,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAgC;IAC5D,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,KAAK,EAAE,CAAC,OAAO,CAAC,2CAA2C,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,mIAAmI;AACnI,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,eAAuB,EAAE,QAAgB;IACnF,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC;SACnE,GAAG,CAAC,MAAM,CAA0C,CAAC;IACxD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IAEtE,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,QAAQ,GAAG,EAAE,CAAC,OAAO,CAAC,kDAAkD,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IACxG,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,2CAA2C,CAAQ,CAAC;QAC1E,GAAG,CAAC,IAAI,GAAG,aAAa,CAAC;QACzB,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,EAAE,CAAC,OAAO,CAAC,yCAAyC,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC9E,yFAAyF;IACzF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,0HAA0H;AAC1H,MAAM,UAAU,cAAc,CAAC,MAAc,EAAE,eAAuB,EAAE,WAAmB;IACzF,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,8CAA8C,CAAC;SACnE,GAAG,CAAC,MAAM,CAA0C,CAAC;IACxD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,CAAC,cAAc,CAAC,eAAe,EAAE,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC;IACrG,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB;IACnD,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC,GAAG,EAAgC,CAAC;IAC3F,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,EAAE,CAAC,OAAO,CAAC,iDAAiD,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACrG,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/services/auto-discover.d.ts

@@ -0,0 +1,77 @@
+/**
+ * auto-discover — Automatically discover and register ALL model types
+ * (chat, embeddings, media) when a provider key is added but the catalog
+ * hasn't shipped models for it yet.
+ *
+ * This bypasses the catalog gate: instead of telling users to "add as custom
+ * endpoint", we query the provider's own /v1/models endpoint with the user's
+ * key and register discovered models directly.
+ *
+ * All modalities are discovered:
+ *   - Chat models → models table
+ *   - Embedding models → embedding_models table (dimensions auto-guessed)
+ *   - Image/audio/video/transcription → media_models table
+ *   - Provider quirks auto-assigned from known patterns
+ *
+ * Models are inserted with source='user' so catalog syncs never delete them.
+ */
+import type { Scheduler } from '../lib/scheduler.js';
+/**
+ * Count enabled models for a platform across all model tables.
+ */
+export declare function enabledModelCountForPlatform(platform: string): number;
+/** Detailed result returned by autoDiscoverModels. */
+export interface DiscoverResult {
+    registered: number;
+    refreshed: number;
+    retired: number;
+    /** Embedding models discovered */
+    embeddingsRegistered: number;
+    embeddingsRefreshed: number;
+    /** Media models discovered (image/audio/video/transcription) */
+    mediaRegistered: number;
+    mediaRefreshed: number;
+    /** Provider quirks auto-assigned */
+    quirksAssigned: number;
+    newModels: string[];
+    updatedModels: string[];
+    retiredModels: string[];
+}
+/**
+ * Discover and register models for a platform that has API keys but zero
+ * models. Uses the provider's /v1/models endpoint with the user's own key.
+ *
+ * Returns a DiscoverResult with counts and model-name lists, or an empty
+ * result if nothing was needed or discoverable.
+ */
+export declare function autoDiscoverModels(platform: string, opts?: {
+    refresh?: boolean;
+}): Promise<DiscoverResult>;
+/**
+ * Discover models for ALL configured providers that have keys.
+ * Called on startup — handles initial registration for platforms with zero
+ * models, and also discovers embeddings/media for platforms that only have chat.
+ */
+export declare function autoDiscoverAll(): Promise<void>;
+/**
+ * Re-verify every configured platform's roster against its live upstream.
+ *
+ * A discovery run is a snapshot, and upstream rosters move: models are added,
+ * dropped, or flip behind a paid gate without any catalog noticing. This
+ * function sweeps ALL model types (chat, embeddings, media) for discovery-owned
+ * platforms.
+ */
+export declare function refreshDiscoveredModels(): Promise<void>;
+/** First pass after boot: long enough for the DB and catalog sync to settle,
+ *  short enough that a stale roster discovered before restart self-heals in
+ *  minutes rather than at the next tick. */
+export declare const MODEL_REFRESH_BOOT_DELAY_MS: number;
+/**
+ * Schedule the recurring roster re-verification.
+ * Uses the same configurable interval as catalog sync (sync_interval_hours).
+ * When sync schedule is 'off', auto-discover also stops recurring (manual only).
+ */
+export declare function startModelRefresh(scheduler: Scheduler): void;
+/** Restart the recurring auto-discover timer (call when sync schedule changes). */
+export declare function restartRefreshInterval(): void;
+//# sourceMappingURL=auto-discover.d.ts.map

package/dist/services/auto-discover.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auto-discover.d.ts","sourceRoot":"","sources":["../../src/services/auto-discover.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAsbrD;;GAEG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAQrE;AAED,sDAAsD;AACtD,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,kCAAkC;IAClC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gEAAgE;IAChE,eAAe,EAAE,MAAM,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,oCAAoC;IACpC,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,cAAc,CAAC,CA6cpH;AAED;;;;GAIG;AACH,wBAAsB,eAAe,IAAI,OAAO,CAAC,IAAI,CAAC,CAuBrD;AAED;;;;;;;GAOG;AACH,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,IAAI,CAAC,CAsF7D;AAOD;;4CAE4C;AAC5C,eAAO,MAAM,2BAA2B,QAAgB,CAAC;AAMzD;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,SAAS,GAAG,IAAI,CAS5D;AAWD,mFAAmF;AACnF,wBAAgB,sBAAsB,IAAI,IAAI,CAU7C"}