@xopcai/xopc 0.0.162 → 0.0.164

package/dist/src/config/schema.d.ts

@@ -934,6 +934,11 @@ export declare const GatewayConfigSchema: z.ZodDefault<z.ZodObject<{
 export declare const ModelsDevConfigSchema: z.ZodDefault<z.ZodObject<{
     enabled: z.ZodDefault<z.ZodBoolean>;
 }, z.core.$strip>>;
+export declare const ModelCatalogConfigSchema: z.ZodDefault<z.ZodObject<{
+    enabled: z.ZodDefault<z.ZodBoolean>;
+    refreshOnStartup: z.ZodDefault<z.ZodBoolean>;
+    intervalHours: z.ZodDefault<z.ZodNumber>;
+}, z.core.$strict>>;
 export declare const STTProviderConfigSchema: z.ZodObject<{
     apiKey: z.ZodOptional<z.ZodString>;
     model: z.ZodOptional<z.ZodString>;
@@ -1247,15 +1252,14 @@ export declare const ProviderRequestOverridesSchema: z.ZodObject<{
 }, z.core.$strict>;
 /**
  * Generic per-vendor provider config — used by image / audio / video
- * capability providers via `cfg.providers.<id>`. Kept loose (`.strict()` but
- * everything optional) so adding a new vendor never requires a config
- * migration.
+ * capability providers via `cfg.providers.<id>`.
  */
 export declare const ProviderAuthConfigSchema: z.ZodObject<{
-    apiKey: z.ZodOptional<z.ZodString>;
     baseUrl: z.ZodOptional<z.ZodString>;
-    region: z.ZodOptional<z.ZodString>;
-    imageBaseUrl: z.ZodOptional<z.ZodString>;
+    region: z.ZodOptional<z.ZodEnum<{
+        cn: "cn";
+        intl: "intl";
+    }>>;
     request: z.ZodOptional<z.ZodObject<{
         timeoutMs: z.ZodOptional<z.ZodNumber>;
         headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -1268,15 +1272,16 @@ export declare const ProviderAuthConfigSchema: z.ZodObject<{
 }, z.core.$strict>;
 export type ProviderAuthConfig = z.infer<typeof ProviderAuthConfigSchema>;
 /**
- * `cfg.providers.<id>` is keyed by provider id (`openai`, `dashscope`,
- * `minimax`, `google`, `fal`, …). Every entry is optional and validated by
+ * `cfg.providers.<id>` stores non-secret connection settings. Credentials
+ * live in the credential store or environment. Every entry is validated by
  * {@link ProviderAuthConfigSchema}.
  */
 export declare const ProvidersConfigSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
-    apiKey: z.ZodOptional<z.ZodString>;
     baseUrl: z.ZodOptional<z.ZodString>;
-    region: z.ZodOptional<z.ZodString>;
-    imageBaseUrl: z.ZodOptional<z.ZodString>;
+    region: z.ZodOptional<z.ZodEnum<{
+        cn: "cn";
+        intl: "intl";
+    }>>;
     request: z.ZodOptional<z.ZodObject<{
         timeoutMs: z.ZodOptional<z.ZodNumber>;
         headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -2330,10 +2335,11 @@ export declare const ConfigSchema: z.ZodDefault<z.ZodObject<{
     }, z.core.$strict>>;
     extensions: z.ZodDefault<z.ZodType<Record<string, unknown>, unknown, z.core.$ZodTypeInternals<Record<string, unknown>, unknown>>>;
     providers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
-        apiKey: z.ZodOptional<z.ZodString>;
         baseUrl: z.ZodOptional<z.ZodString>;
-        region: z.ZodOptional<z.ZodString>;
-        imageBaseUrl: z.ZodOptional<z.ZodString>;
+        region: z.ZodOptional<z.ZodEnum<{
+            cn: "cn";
+            intl: "intl";
+        }>>;
         request: z.ZodOptional<z.ZodObject<{
             timeoutMs: z.ZodOptional<z.ZodNumber>;
             headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
@@ -2347,6 +2353,11 @@ export declare const ConfigSchema: z.ZodDefault<z.ZodObject<{
     modelsDev: z.ZodDefault<z.ZodObject<{
         enabled: z.ZodDefault<z.ZodBoolean>;
     }, z.core.$strip>>;
+    modelCatalog: z.ZodDefault<z.ZodObject<{
+        enabled: z.ZodDefault<z.ZodBoolean>;
+        refreshOnStartup: z.ZodDefault<z.ZodBoolean>;
+        intervalHours: z.ZodDefault<z.ZodNumber>;
+    }, z.core.$strict>>;
     messages: z.ZodOptional<z.ZodObject<{
         tts: z.ZodOptional<z.ZodObject<{
             enabled: z.ZodDefault<z.ZodBoolean>;
@@ -2446,6 +2457,6 @@ export interface ParsedModelRef {
 }
 export declare function getAgentDefaultModelRef(config: Config): string | undefined;
 export declare function getAgentDefaultImageModelConfig(config: Config): AgentModelConfig | undefined;
-export declare function getAgentDefaultImageGenerationModelConfig(config: Config): AgentImageGenerationModelConfig | undefined;
+export declare function getAgentDefaultImageGenerationModelConfig(config: Config, agentId: string): AgentImageGenerationModelConfig | undefined;
 /** `provider/model` or null when invalid. */
 export declare function parseModelRef(ref: string): ParsedModelRef | null;

package/dist/src/config/schema.js

@@ -26,9 +26,9 @@ function getAgentDefaultModelRef(config) {
 	applyModels(agent.models);
 	return modelRef;
 }
-function getAgentDefaultModelsConfig(config) {
+function getAgentDefaultModelsConfig(config, requestedAgentId) {
 	const list = Array.isArray(config.agents?.list) ? config.agents.list : [];
-	const defaultId = config.agents?.default?.trim() || list.find((entry) => entry.default === true)?.id?.trim() || list[0]?.id;
+	const defaultId = requestedAgentId?.trim() || config.agents?.default?.trim() || list.find((entry) => entry.default === true)?.id?.trim() || list[0]?.id;
 	const agent = list.find((entry) => entry.enabled !== false && entry.id === defaultId) ?? list[0];
 	if (!agent) return void 0;
 	let modelConfig;
@@ -51,8 +51,8 @@ function getAgentDefaultModelsConfig(config) {
 function getAgentDefaultImageModelConfig(config) {
 	return getAgentDefaultModelsConfig(config)?.imageModel;
 }
-function getAgentDefaultImageGenerationModelConfig(config) {
-	return getAgentDefaultModelsConfig(config)?.imageGenerationModel;
+function getAgentDefaultImageGenerationModelConfig(config, agentId) {
+	return getAgentDefaultModelsConfig(config, agentId)?.imageGenerationModel;
 }
 /** `provider/model` or null when invalid. */
 function parseModelRef(ref) {
@@ -64,7 +64,7 @@ function parseModelRef(ref) {
 		model: trimmed.slice(idx + 1).trim()
 	};
 }
-var AgentModelRefSchema, AgentImageGenerationModelSchema, AgentTypedModelRoleSchema, AgentTypedModelRolesSchema, AgentModelsSchema, AgentsConfigSchema, BrowserCloudConfigSchema, BrowserExtensionConfigSchema, BrowserCloakConfigSchema, BrowserConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, SessionDmScopeSchema, SessionStorageConfigSchema, SessionResetModeSchema, SessionResetConfigSchema, SessionResetByTypeSchema, SessionScopeSchema, SessionConfigSchema, ChannelsConfigSchema, SearchProviderEntrySchema, WebSearchConfigSchema, WebsiteBlocklistSchema, WebToolsConfigSchema, ToolsConfigSchema, GatewayAuthRateLimitSchema, GatewaySecuritySchema, GatewayTrustedProxySchema, GatewayAuthSchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayRemoteSchema, GatewayTlsSchema, GatewayModeSchema, HeartbeatConfigSchema, GatewayChannelConnectDeferModeSchema, TunnelConsentSchema, TunnelConfigSchema, WorkspaceImportConfigSchema, WorkspaceConfigSchema, GatewayBindModeSchema, GatewayConfigSchema, ModelsDevConfigSchema, SttProviderConfigCatchallSchema, STTProviderConfigSchema, STTFallbackConfigSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, STTConfigSchema, TtsProviderConfigCatchallSchema, TTSProviderConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSEdgeConfigSchema, TTSSummarizationConfigSchema, TTSConfigSchema, VoiceRefinementConfigSchema, VoiceConfigSchema, MessagesConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProviderAuthConfigSchema, ProvidersConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, UpdateAutoConfigSchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, UpdateConfigSchema, CommandsConfigSchema, TuiConfigSchema, McpHttpUrlSchema, ConnectorSecretReferenceSchema, McpConfigScalarSchema, McpServerSchema, McpConfigSchema, CodeIntelligenceConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ConfigSchema;
+var AgentModelRefSchema, AgentImageGenerationModelSchema, AgentTypedModelRoleSchema, AgentTypedModelRolesSchema, AgentModelsSchema, AgentsConfigSchema, BrowserCloudConfigSchema, BrowserExtensionConfigSchema, BrowserCloakConfigSchema, BrowserConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, SessionDmScopeSchema, SessionStorageConfigSchema, SessionResetModeSchema, SessionResetConfigSchema, SessionResetByTypeSchema, SessionScopeSchema, SessionConfigSchema, ChannelsConfigSchema, SearchProviderEntrySchema, WebSearchConfigSchema, WebsiteBlocklistSchema, WebToolsConfigSchema, ToolsConfigSchema, GatewayAuthRateLimitSchema, GatewaySecuritySchema, GatewayTrustedProxySchema, GatewayAuthSchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayRemoteSchema, GatewayTlsSchema, GatewayModeSchema, HeartbeatConfigSchema, GatewayChannelConnectDeferModeSchema, TunnelConsentSchema, TunnelConfigSchema, WorkspaceImportConfigSchema, WorkspaceConfigSchema, GatewayBindModeSchema, GatewayConfigSchema, ModelsDevConfigSchema, ModelCatalogConfigSchema, SttProviderConfigCatchallSchema, STTProviderConfigSchema, STTFallbackConfigSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, STTConfigSchema, TtsProviderConfigCatchallSchema, TTSProviderConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSEdgeConfigSchema, TTSSummarizationConfigSchema, TTSConfigSchema, VoiceRefinementConfigSchema, VoiceConfigSchema, MessagesConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProviderAuthConfigSchema, ProvidersConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, UpdateAutoConfigSchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, UpdateConfigSchema, CommandsConfigSchema, TuiConfigSchema, McpHttpUrlSchema, ConnectorSecretReferenceSchema, McpConfigScalarSchema, McpServerSchema, McpConfigSchema, CodeIntelligenceConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ConfigSchema;
 var init_schema = __esmMin((() => {
 	init_schema$1();
 	init_preset_chain();
@@ -645,6 +645,15 @@ strict: z.boolean().optional() }).optional();
 		skillsStoreBaseUrl: "https://store.xopc.ai"
 	});
 	ModelsDevConfigSchema = z.object({ enabled: z.boolean().default(true) }).default({ enabled: true });
+	ModelCatalogConfigSchema = z.object({
+		enabled: z.boolean().default(true),
+		refreshOnStartup: z.boolean().default(true),
+		intervalHours: z.number().min(.25).default(6)
+	}).strict().default({
+		enabled: true,
+		refreshOnStartup: true,
+		intervalHours: 6
+	});
 	SttProviderConfigCatchallSchema = z.union([
 		z.string(),
 		z.number(),
@@ -804,14 +813,10 @@ tts: TTSConfigSchema.optional() }).optional();
 		headers: z.record(z.string(), z.string()).optional()
 	}).strict();
 	ProviderAuthConfigSchema = z.object({
-		/** Static API key (api-key / azure-key modes). */
-		apiKey: z.string().optional(),
 		/** Override the default REST base URL. */
 		baseUrl: z.string().url().optional(),
-		/** Vendor region (DashScope: `beijing` / `singapore`; AWS: region id). */
-		region: z.string().optional(),
-		/** Image-only base URL override (DashScope splits image vs LLM). */
-		imageBaseUrl: z.string().url().optional(),
+		/** Provider deployment region. */
+		region: z.enum(["cn", "intl"]).optional(),
 		/** Per-vendor request overrides. */
 		request: ProviderRequestOverridesSchema.optional(),
 		/** Azure OpenAI deployment overrides; only consumed by OpenAI image provider. */
@@ -1015,6 +1020,7 @@ workDiscoveryOnboarding: z.boolean().default(true) }).strict().default({ workDis
 		/** Per-vendor capability provider config (image / audio / video). */
 		providers: ProvidersConfigSchema.optional(),
 		modelsDev: ModelsDevConfigSchema,
+		modelCatalog: ModelCatalogConfigSchema,
 		/** Delivery / presentation concerns (currently `tts`). */
 		messages: MessagesConfigSchema,
 		/** User-facing voice input behavior beyond provider selection. */
@@ -1168,9 +1174,14 @@ workDiscoveryOnboarding: z.boolean().default(true) }).strict().default({ workDis
 			slots: {}
 		},
 		modelsDev: { enabled: true },
+		modelCatalog: {
+			enabled: true,
+			refreshOnStartup: true,
+			intervalHours: 6
+		},
 		tui: {}
 	});
 }));
 //#endregion
 init_schema();
-export { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CodeIntelligenceConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WeixinAccountConfigSchema, WeixinConfigSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef };
+export { AgentImageGenerationModelSchema, AgentModelRefSchema, AgentModelsSchema, AgentTypedModelRoleSchema, AgentsConfigSchema, BindingMatchSchema, BindingRuleSchema, BindingsConfigSchema, BrowserConfigSchema, ChannelsConfigSchema, CodeIntelligenceConfigSchema, CommandsConfigSchema, ConfigSchema, ConnectorsConfigSchema, ExperimentalConfigSchema, ExtensionSecurityConfigSchema, ExtensionSlotsConfigSchema, ExtensionsConfigSchema, GatewayAuthRateLimitSchema, GatewayAuthSchema, GatewayBindModeSchema, GatewayChannelConnectDeferModeSchema, GatewayConfigSchema, GatewayModeSchema, GatewayRemoteSchema, GatewaySecuritySchema, GatewayTailscaleConsentSchema, GatewayTailscaleSchema, GatewayTlsSchema, GatewayTrustedProxySchema, GoalNotificationEventSchema, GoalNotificationTargetSchema, GoalNotificationsConfigSchema, GoalsConfigSchema, HeartbeatConfigSchema, McpConfigSchema, McpServerSchema, MediaUnderstandingCapabilitiesSchema, MediaUnderstandingModelSchema, MessagesConfigSchema, ModelCatalogConfigSchema, ModelsDevConfigSchema, ProviderAuthConfigSchema, ProviderAzureConfigSchema, ProviderRequestOverridesSchema, ProvidersConfigSchema, STTConfigSchema, STTFallbackConfigSchema, STTProviderConfigSchema, SearchProviderEntrySchema, SessionConfigSchema, SessionDmScopeSchema, SessionResetByTypeSchema, SessionResetConfigSchema, SessionResetModeSchema, SessionScopeSchema, SessionStorageConfigSchema, TTSConfigSchema, TTSEdgeConfigSchema, TTSFallbackConfigSchema, TTSModelOverridesConfigSchema, TTSProviderConfigSchema, TTSSummarizationConfigSchema, TelegramAccountConfigSchema, TelegramConfigSchema, TelegramGroupConfigSchema, TelegramTopicConfigSchema, ToolsConfigSchema, ToolsMediaAudioConfigSchema, ToolsMediaConfigSchema, TuiConfigSchema, TunnelConfigSchema, TunnelConsentSchema, UpdateAutoConfigSchema, UpdateConfigSchema, VoiceConfigSchema, VoiceRefinementConfigSchema, WebSearchConfigSchema, WebToolsConfigSchema, WebsiteBlocklistSchema, WeixinAccountConfigSchema, WeixinConfigSchema, WorkspaceConfigSchema, WorkspaceImportConfigSchema, getAgentDefaultImageGenerationModelConfig, getAgentDefaultImageModelConfig, getAgentDefaultModelRef, init_schema, parseModelRef };

package/dist/src/gateway/heartbeat/service.js

@@ -1,9 +1,9 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
 import { shouldSilence, stripHeartbeatToken } from "../../heartbeat/tokens.js";
-import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { isWithinActiveHours } from "../../heartbeat/active-hours.js";
 import { isHeartbeatContentEmpty } from "../../heartbeat/content-check.js";
+import { appendCronEventLines } from "../../heartbeat/event-prompt.js";
 import { createHeartbeatWake } from "../../heartbeat/wake.js";
 import { resolveHeartbeatMdPath } from "../workspace-heartbeat-path.js";
 import { readFile } from "fs/promises";

package/dist/src/gateway/hono/app.js

@@ -12,7 +12,7 @@ import { buildGatewayConsoleCspHeader } from "../security/csp.js";
 import { checkBrowserOrigin } from "../security/origin-check.js";
 import { auth } from "./middleware/auth.js";
 import { operatorScopes } from "./middleware/scopes.js";
-import { createChannelRateLimitMiddleware, createStrictRateLimitMiddleware } from "./middleware/strict-rate-limit.js";
+import { createChannelRateLimitMiddleware, createStrictRateLimitMiddleware, createXopcCloudPollRateLimitMiddleware } from "./middleware/strict-rate-limit.js";
 import { logContextMiddleware } from "./middleware/log-context.js";
 import { logger } from "./middleware/logger.js";
 import { routeErrorMiddleware } from "./middleware/route-errors.js";
@@ -204,16 +204,22 @@ function createHonoApp(config) {
 		})
 	}));
 	authenticated.use(operatorScopes());
+	const strictRateLimitMiddleware = createStrictRateLimitMiddleware({ getTrustedProxyContext: () => ({
+		trustedProxies: service.currentConfig.gateway?.trustedProxies,
+		allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
+	}) });
+	const channelRateLimitMiddleware = createChannelRateLimitMiddleware({ getTrustedProxyContext: () => ({
+		trustedProxies: service.currentConfig.gateway?.trustedProxies,
+		allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
+	}) });
 	registerAuthenticatedRoutes(app, authenticated, {
 		service,
-		strictRateLimitMiddleware: createStrictRateLimitMiddleware({ getTrustedProxyContext: () => ({
-			trustedProxies: service.currentConfig.gateway?.trustedProxies,
-			allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
-		}) }),
-		channelRateLimitMiddleware: createChannelRateLimitMiddleware({ getTrustedProxyContext: () => ({
+		strictRateLimitMiddleware,
+		xopcCloudPollRateLimitMiddleware: createXopcCloudPollRateLimitMiddleware({ getTrustedProxyContext: () => ({
 			trustedProxies: service.currentConfig.gateway?.trustedProxies,
 			allowRealIpFallback: service.currentConfig.gateway?.allowRealIpFallback === true
 		}) }),
+		channelRateLimitMiddleware,
 		sseConfig: {
 			service,
 			maxSseConnections: service.currentConfig.gateway.maxSseConnections

package/dist/src/gateway/hono/lib/safe-providers-config.d.ts

@@ -1,13 +1,10 @@
 import type { Config } from '../../../config/schema.js';
 /**
  * Per-vendor slice of {@link Config.providers} safe for GET `/api/config`.
- * Secrets are never sent verbatim; `apiKey` is length-preserving bullets when set, else empty.
  */
 export type SafeProviderAuthEntry = {
-    apiKey: string;
     region?: string;
     baseUrl?: string;
-    imageBaseUrl?: string;
 };
 /**
  * Build a redacted `providersConfig` map for the gateway console (image / audio / video keys).

package/dist/src/gateway/hono/lib/safe-providers-config.js

@@ -1,4 +1,3 @@
-import { maskSecretLength } from "./mask-secret-length.js";
 //#region src/gateway/hono/lib/safe-providers-config.ts
 /**
 * Build a redacted `providersConfig` map for the gateway console (image / audio / video keys).
@@ -10,10 +9,9 @@ function buildSafeProvidersConfigForWeb(providers) {
 		if (!id) continue;
 		if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
 		const o = raw;
-		const entry = { apiKey: typeof o.apiKey === "string" && o.apiKey.trim() ? maskSecretLength(o.apiKey) : "" };
+		const entry = {};
 		if (typeof o.region === "string" && o.region.trim()) entry.region = o.region.trim();
 		if (typeof o.baseUrl === "string" && o.baseUrl.trim()) entry.baseUrl = o.baseUrl.trim();
-		if (typeof o.imageBaseUrl === "string" && o.imageBaseUrl.trim()) entry.imageBaseUrl = o.imageBaseUrl.trim();
 		out[id] = entry;
 	}
 	return out;

package/dist/src/gateway/hono/middleware/strict-rate-limit.d.ts

@@ -12,6 +12,10 @@ export declare function createStrictRateLimitMiddleware(deps: StrictRateLimitDep
     error: string;
     code: string;
 }, 429, "json">>;
+export declare function createXopcCloudPollRateLimitMiddleware(deps: StrictRateLimitDeps): import("hono").MiddlewareHandler<any, string, {}, Response & import("hono").TypedResponse<{
+    error: string;
+    code: string;
+}, 429, "json">>;
 export declare function createChannelRateLimitMiddleware(deps: StrictRateLimitDeps): import("hono").MiddlewareHandler<any, string, {}, Response & import("hono").TypedResponse<{
     error: string;
     code: string;

package/dist/src/gateway/hono/middleware/strict-rate-limit.js

@@ -63,6 +63,13 @@ function createStrictRateLimitMiddleware(deps) {
 		reason: "strict_rate_limit_exceeded"
 	});
 }
+function createXopcCloudPollRateLimitMiddleware(deps) {
+	return createClientRateLimitMiddleware(deps, {
+		limiter: () => buckets.xopcCloudPoll(),
+		exceededMessage: "XOPC Cloud polling rate limit exceeded",
+		reason: "xopc_cloud_poll_rate_limit_exceeded"
+	});
+}
 function createChannelRateLimitMiddleware(deps) {
 	return createClientRateLimitMiddleware(deps, {
 		limiter: () => buckets.channelApi(),
@@ -71,4 +78,4 @@ function createChannelRateLimitMiddleware(deps) {
 	});
 }
 //#endregion
-export { createChannelRateLimitMiddleware, createStrictRateLimitMiddleware };
+export { createChannelRateLimitMiddleware, createStrictRateLimitMiddleware, createXopcCloudPollRateLimitMiddleware };

package/dist/src/gateway/hono/oauth-async.js

@@ -1,17 +1,9 @@
 import { createLogger } from "../../utils/logger/index.js";
 import { init_logger } from "../../utils/logger.js";
+import { getOAuthProviderInterfaces, init_registry } from "../../auth/oauth/registry.js";
 import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
 import { isLoopbackHost } from "../host.js";
 import { resolveReverseProxyPublicUrl } from "../public-url.js";
-import { anthropicOAuthProvider } from "../../auth/oauth/anthropic.js";
-import { minimaxOAuthProvider } from "../../auth/oauth/minimax.js";
-import { minimaxCnOAuthProvider } from "../../auth/oauth/minimax-cn.js";
-import { kimiCodingOAuthProvider } from "../../auth/oauth/kimi-coding.js";
-import { githubCopilotOAuthProvider } from "../../auth/oauth/github-copilot.js";
-import { geminiCliOAuthProvider } from "../../auth/oauth/google-oauth/google-gemini-cli.js";
-import { antigravityOAuthProvider } from "../../auth/oauth/google-oauth/google-antigravity.js";
-import { openaiCodexOAuthProvider } from "../../auth/oauth/openai-codex.js";
-import "../../auth/oauth/index.js";
 import { Hono } from "hono";
 //#region src/gateway/hono/oauth-async.ts
 /**
@@ -21,6 +13,7 @@ import { Hono } from "hono";
 * This allows OAuth flows that require user interaction (browser login) 
 * without blocking the HTTP request.
 */
+init_registry();
 init_credentials();
 init_logger();
 const log = createLogger("OAuthAsync");
@@ -32,16 +25,7 @@ function formatOAuthAsyncError(err) {
 	if (/^fetch failed$/i.test(base) || base.includes("fetch failed")) return `Network request failed${detail}. If the browser opened on another device, the redirect goes to that device's localhost — copy the full URL from the browser address bar after sign-in (starts with http://127.0.0.1 or http://localhost) and paste it below. Otherwise check VPN/proxy/DNS/firewall access to Google OAuth.`;
 	return base;
 }
-const OAUTH_PROVIDERS = {
-	"kimi-coding": kimiCodingOAuthProvider,
-	"minimax": minimaxOAuthProvider,
-	"minimax-cn": minimaxCnOAuthProvider,
-	"anthropic": anthropicOAuthProvider,
-	"github-copilot": githubCopilotOAuthProvider,
-	"google-gemini-cli": geminiCliOAuthProvider,
-	"google-antigravity": antigravityOAuthProvider,
-	"openai-codex": openaiCodexOAuthProvider
-};
+const OAUTH_PROVIDERS = getOAuthProviderInterfaces();
 const oauthSessions = /* @__PURE__ */ new Map();
 const SESSION_TTL_MS = 600 * 1e3;
 setInterval(() => {

package/dist/src/gateway/hono/oauth.js

@@ -1,14 +1,6 @@
+import { getOAuthProviderInterfaces, init_registry } from "../../auth/oauth/registry.js";
 import { CredentialResolver, init_credentials } from "../../auth/credentials.js";
 import { getProviderAuthState, init_providers, isProviderConfigured } from "../../providers/index.js";
-import { anthropicOAuthProvider } from "../../auth/oauth/anthropic.js";
-import { minimaxOAuthProvider } from "../../auth/oauth/minimax.js";
-import { minimaxCnOAuthProvider } from "../../auth/oauth/minimax-cn.js";
-import { kimiCodingOAuthProvider } from "../../auth/oauth/kimi-coding.js";
-import { githubCopilotOAuthProvider } from "../../auth/oauth/github-copilot.js";
-import { geminiCliOAuthProvider } from "../../auth/oauth/google-oauth/google-gemini-cli.js";
-import { antigravityOAuthProvider } from "../../auth/oauth/google-oauth/google-antigravity.js";
-import { openaiCodexOAuthProvider } from "../../auth/oauth/openai-codex.js";
-import "../../auth/oauth/index.js";
 import { Hono } from "hono";
 //#region src/gateway/hono/oauth.ts
 /**
@@ -16,18 +8,10 @@ import { Hono } from "hono";
 * 
 * Provides HTTP endpoints for OAuth login flow.
 */
+init_registry();
 init_credentials();
 init_providers();
-const OAUTH_PROVIDERS = {
-	"kimi-coding": kimiCodingOAuthProvider,
-	"minimax": minimaxOAuthProvider,
-	"minimax-cn": minimaxCnOAuthProvider,
-	"anthropic": anthropicOAuthProvider,
-	"github-copilot": githubCopilotOAuthProvider,
-	"google-gemini-cli": geminiCliOAuthProvider,
-	"google-antigravity": antigravityOAuthProvider,
-	"openai-codex": openaiCodexOAuthProvider
-};
+const OAUTH_PROVIDERS = getOAuthProviderInterfaces();
 const oauthCredentialsCache = /* @__PURE__ */ new Map();
 function getOAuthCredentialsFromCache(provider) {
 	return oauthCredentialsCache.get(provider);

package/dist/src/gateway/hono/routes/config-patch/misc.js

@@ -72,17 +72,8 @@ async function applyMiscPatch(config, body) {
 			if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
 			const next = cfgProviders[vendorId] ?? {};
 			const patch = raw;
-			for (const field of [
-				"apiKey",
-				"baseUrl",
-				"region",
-				"imageBaseUrl"
-			]) if (patch[field] === null || patch[field] === "") delete next[field];
-			else if (typeof patch[field] === "string") {
-				const trimmed = patch[field].trim();
-				if (field === "apiKey" && isMaskedSecretPatchValue(trimmed)) continue;
-				next[field] = trimmed;
-			}
+			for (const field of ["baseUrl", "region"]) if (patch[field] === null || patch[field] === "") delete next[field];
+			else if (typeof patch[field] === "string") next[field] = patch[field].trim();
 			if (patch.azure === null) delete next.azure;
 			else if (patch.azure && typeof patch.azure === "object" && !Array.isArray(patch.azure)) next.azure = {
 				...next.azure ?? {},

package/dist/src/gateway/hono/routes/deps.d.ts

@@ -4,6 +4,7 @@ import type { SSEHandlerConfig } from '../sse.js';
 export interface AuthenticatedRouteDeps {
     service: GatewayService;
     strictRateLimitMiddleware: MiddlewareHandler;
+    xopcCloudPollRateLimitMiddleware: MiddlewareHandler;
     channelRateLimitMiddleware?: MiddlewareHandler;
     sseConfig: SSEHandlerConfig;
 }

package/dist/src/gateway/hono/routes/lazy-bundles.js

@@ -92,6 +92,14 @@ const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
 			return { register: registerDreamingRoutes };
 		}
 	},
+	{
+		id: "image-generation",
+		match: (path) => startsWithAny(path, ["/api/image-generation"]) || /^\/api\/agents\/[^/]+\/image-generation(?:\/setup)?$/.test(path),
+		load: async () => {
+			const { registerModelsRoutes } = await import("./models.js");
+			return { register: registerModelsRoutes };
+		}
+	},
 	{
 		id: "agents",
 		match: (path) => startsWithAny(path, [
@@ -135,8 +143,7 @@ const AUTHENTICATED_LAZY_ROUTE_BUNDLES = [
 		match: (path) => startsWithAny(path, [
 			"/api/models",
 			"/api/models-json",
-			"/api/providers",
-			"/api/image"
+			"/api/providers"
 		]),
 		load: async () => {
 			const { registerModelsRoutes } = await import("./models.js");