ldrouter 1.5.1

package/dist/server/routes/admin/combos.js

@@ -0,0 +1,198 @@
+// Admin API: combos CRUD + member management.
+import { z } from 'zod';
+import { eq, sql } from 'drizzle-orm';
+import { getDb, schema } from '../../db/index.js';
+import { requireAdminAuth } from '../../auth/middleware.js';
+import { recordAudit } from '../../db/repositories/audit.js';
+import { uuid } from '../../auth/ids.js';
+import { GatewayError } from '../../errors.js';
+const MemberSpec = z.object({ modelId: z.string(), position: z.number().int().min(0), weight: z.number().int().min(1).default(1), enabled: z.boolean().default(true) });
+const ComboCreate = z.object({
+    name: z.string().min(1).max(128),
+    slug: z.string().min(1).max(64).optional(),
+    mode: z.enum(['fallback', 'weighted_round_robin']),
+    maxTotalAttempts: z.number().int().min(1).max(8).optional(),
+    enabled: z.boolean().optional(),
+    fallbackOnConnection: z.boolean().optional(),
+    fallbackOnConnectTimeout: z.boolean().optional(),
+    fallbackOnFirstTokenTimeout: z.boolean().optional(),
+    fallbackOn408: z.boolean().optional(),
+    fallbackOn429: z.boolean().optional(),
+    fallbackOn5xx: z.boolean().optional(),
+    members: z.array(MemberSpec).min(1).max(16),
+});
+const ComboUpdate = ComboCreate.partial().extend({ id: z.string() });
+// Combo public IDs default to the (normalized) name WITHOUT a prefix — e.g.
+// name "gpt-5.5" becomes model id "gpt-5.5". Only when the client explicitly
+// supplies a slug does the id get the "combo/" prefix ("combo/<slug>").
+// Unlike slugify(), dots are preserved: they are legal in model IDs
+// (e.g. "gpt-5.6-sol").
+function comboSlug(input) {
+    return (input
+        .trim()
+        .toLowerCase()
+        .replace(/[\s/]+/g, '-')
+        .replace(/[^a-z0-9._-]+/g, '')
+        .slice(0, 64) || 'item');
+}
+export async function registerComboRoutes(app) {
+    app.addHook('preHandler', requireAdminAuth);
+    app.get('/api/admin/combos', async () => {
+        const db = getDb();
+        const combos = db.select().from(schema.combos).all();
+        const allMembers = db.select().from(schema.comboMembers).all();
+        const models = db.select().from(schema.models).all();
+        const modelMap = new Map(models.map((m) => [m.id, m]));
+        return {
+            combos: combos.map((c) => {
+                const members = allMembers.filter((m) => m.comboId === c.id);
+                const healthy = members.filter((m) => {
+                    const model = modelMap.get(m.modelId);
+                    return model && model.enabled && model.upstreamAvailable;
+                });
+                return {
+                    id: c.id,
+                    name: c.name,
+                    slug: c.slug,
+                    publicModelId: c.publicModelId,
+                    mode: c.mode,
+                    enabled: c.enabled,
+                    memberCount: members.length,
+                    healthyMemberCount: healthy.length,
+                };
+            }),
+        };
+    });
+    app.get('/api/admin/combos/:id', async (req) => {
+        const { id } = req.params;
+        const db = getDb();
+        const c = db.select().from(schema.combos).where(eq(schema.combos.id, id)).get();
+        if (!c)
+            throw new GatewayError('invalid_request_error', 'Combo not found', { status: 404 });
+        const members = db.select().from(schema.comboMembers).where(eq(schema.comboMembers.comboId, id)).all();
+        const models = db.select().from(schema.models).all();
+        const modelMap = new Map(models.map((m) => [m.id, m]));
+        return {
+            combo: {
+                ...c,
+                members: members.map((m) => ({
+                    id: m.id,
+                    modelId: m.modelId,
+                    publicModelId: modelMap.get(m.modelId)?.publicModelId ?? '',
+                    displayName: modelMap.get(m.modelId)?.displayName ?? '',
+                    providerSlug: '',
+                    position: m.position,
+                    weight: m.weight,
+                    enabled: m.enabled,
+                })),
+            },
+        };
+    });
+    app.post('/api/admin/combos', async (req) => {
+        const body = ComboCreate.parse(req.body);
+        const db = getDb();
+        // No slug given → the public id IS the normalized name (no "combo/" prefix).
+        const slug = comboSlug(body.slug ?? body.name);
+        const publicModelId = body.slug ? `combo/${slug}` : slug;
+        // The id must be globally unique across combos AND physical models — the
+        // resolver treats every name as one routing surface.
+        if (db.select().from(schema.combos).where(eq(schema.combos.publicModelId, publicModelId)).get()) {
+            throw new GatewayError('invalid_request_error', 'Combo ID already in use', { status: 400 });
+        }
+        if (db.select().from(schema.models).where(eq(schema.models.publicModelId, publicModelId)).get()) {
+            throw new GatewayError('invalid_request_error', `A model with ID "${publicModelId}" already exists`, { status: 400 });
+        }
+        // Verify all referenced models exist and are physical
+        const modelIds = body.members.map((m) => m.modelId);
+        const models = db.select().from(schema.models).where(sql `id IN (${sql.join(modelIds.map((id) => sql `${id}`), sql `, `)})`).all();
+        if (models.length !== new Set(modelIds).size)
+            throw new GatewayError('invalid_request_error', 'One or more members are not valid physical models', { status: 400 });
+        const id = uuid();
+        db.insert(schema.combos).values({
+            id,
+            name: body.name,
+            slug,
+            publicModelId,
+            mode: body.mode,
+            enabled: body.enabled ?? true,
+            maxTotalAttempts: body.maxTotalAttempts ?? 3,
+            fallbackOnConnection: body.fallbackOnConnection ?? true,
+            fallbackOnConnectTimeout: body.fallbackOnConnectTimeout ?? true,
+            fallbackOnFirstTokenTimeout: body.fallbackOnFirstTokenTimeout ?? true,
+            fallbackOn408: body.fallbackOn408 ?? true,
+            fallbackOn429: body.fallbackOn429 ?? true,
+            fallbackOn5xx: body.fallbackOn5xx ?? true,
+            configVersion: 1,
+        }).run();
+        for (const m of body.members) {
+            db.insert(schema.comboMembers).values({ id: uuid(), comboId: id, modelId: m.modelId, position: m.position, weight: m.weight ?? 1, enabled: m.enabled ?? true }).run();
+        }
+        recordAudit({ action: 'combo.create', success: true, targetType: 'combo', targetId: id, targetName: body.name, ip: req.ip, metadata: { members: body.members.length, mode: body.mode } });
+        return { id, slug, publicModelId };
+    });
+    app.patch('/api/admin/combos', async (req) => {
+        const body = ComboUpdate.parse(req.body);
+        const db = getDb();
+        const c = db.select().from(schema.combos).where(eq(schema.combos.id, body.id)).get();
+        if (!c)
+            throw new GatewayError('invalid_request_error', 'Combo not found', { status: 404 });
+        const update = { updatedAt: new Date().toISOString(), configVersion: c.configVersion + 1 };
+        if (body.name)
+            update.name = body.name;
+        if (body.slug !== undefined) {
+            // Same rule as creation: empty slug → plain id, provided slug → combo/<slug>.
+            const slug = comboSlug(body.slug || body.name || c.name);
+            const publicModelId = body.slug ? `combo/${slug}` : slug;
+            const clashCombo = db.select().from(schema.combos).where(eq(schema.combos.publicModelId, publicModelId)).get();
+            if (clashCombo && clashCombo.id !== body.id)
+                throw new GatewayError('invalid_request_error', 'Combo ID already in use', { status: 400 });
+            if (db.select().from(schema.models).where(eq(schema.models.publicModelId, publicModelId)).get()) {
+                throw new GatewayError('invalid_request_error', `A model with ID "${publicModelId}" already exists`, { status: 400 });
+            }
+            update.slug = slug;
+            update.publicModelId = publicModelId;
+        }
+        if (body.mode)
+            update.mode = body.mode;
+        if (body.enabled !== undefined)
+            update.enabled = body.enabled;
+        if (body.maxTotalAttempts !== undefined)
+            update.maxTotalAttempts = body.maxTotalAttempts;
+        if (body.fallbackOnConnection !== undefined)
+            update.fallbackOnConnection = body.fallbackOnConnection;
+        if (body.fallbackOnConnectTimeout !== undefined)
+            update.fallbackOnConnectTimeout = body.fallbackOnConnectTimeout;
+        if (body.fallbackOnFirstTokenTimeout !== undefined)
+            update.fallbackOnFirstTokenTimeout = body.fallbackOnFirstTokenTimeout;
+        if (body.fallbackOn408 !== undefined)
+            update.fallbackOn408 = body.fallbackOn408;
+        if (body.fallbackOn429 !== undefined)
+            update.fallbackOn429 = body.fallbackOn429;
+        if (body.fallbackOn5xx !== undefined)
+            update.fallbackOn5xx = body.fallbackOn5xx;
+        db.update(schema.combos).set(update).where(eq(schema.combos.id, body.id)).run();
+        if (body.members) {
+            db.delete(schema.comboMembers).where(eq(schema.comboMembers.comboId, body.id)).run();
+            for (const m of body.members) {
+                db.insert(schema.comboMembers).values({ id: uuid(), comboId: body.id, modelId: m.modelId, position: m.position, weight: m.weight ?? 1, enabled: m.enabled ?? true }).run();
+            }
+        }
+        // Invalidate cache for this combo
+        const { invalidateCacheFor } = await import('../../caching/store.js');
+        invalidateCacheFor('combo', body.id);
+        recordAudit({ action: 'combo.update', success: true, targetType: 'combo', targetId: body.id, targetName: c.name, ip: req.ip });
+        return { ok: true };
+    });
+    app.delete('/api/admin/combos/:id', async (req) => {
+        const { id } = req.params;
+        const db = getDb();
+        const c = db.select().from(schema.combos).where(eq(schema.combos.id, id)).get();
+        if (!c)
+            throw new GatewayError('invalid_request_error', 'Combo not found', { status: 404 });
+        db.delete(schema.combos).where(eq(schema.combos.id, id)).run();
+        const { invalidateCacheFor } = await import('../../caching/store.js');
+        invalidateCacheFor('combo', id);
+        recordAudit({ action: 'combo.delete', success: true, targetType: 'combo', targetId: id, targetName: c.name, ip: req.ip });
+        return { ok: true };
+    });
+}

package/dist/server/routes/admin/dashboard.js

@@ -0,0 +1,55 @@
+// Admin API: dashboard summary.
+import { and, desc, gte, sql } from 'drizzle-orm';
+import { getDb, schema } from '../../db/index.js';
+import { requireAdminAuth } from '../../auth/middleware.js';
+export async function registerDashboardRoutes(app) {
+    app.addHook('preHandler', requireAdminAuth);
+    app.get('/api/admin/dashboard', async () => {
+        const db = getDb();
+        const startOfDay = new Date();
+        startOfDay.setUTCHours(0, 0, 0, 0);
+        const startIso = startOfDay.toISOString();
+        const today = db
+            .select({
+            total: sql `COUNT(*)`,
+            success: sql `SUM(CASE WHEN success=1 THEN 1 ELSE 0 END)`,
+            failed: sql `SUM(CASE WHEN success=0 THEN 1 ELSE 0 END)`,
+            totalTokens: sql `COALESCE(SUM(total_tokens),0)`,
+        })
+            .from(schema.requests)
+            .where(gte(schema.requests.createdAt, startIso))
+            .get();
+        const providerHealth = db.select().from(schema.providers).all();
+        const recentFailures = db
+            .select()
+            .from(schema.requests)
+            .where(and(sql `success = 0`, gte(schema.requests.createdAt, startIso)))
+            .orderBy(desc(schema.requests.createdAt))
+            .limit(5)
+            .all();
+        return {
+            today: {
+                total: Number(today?.total ?? 0),
+                success: Number(today?.success ?? 0),
+                failed: Number(today?.failed ?? 0),
+                totalTokens: Number(today?.totalTokens ?? 0),
+            },
+            providers: providerHealth.map((p) => ({
+                id: p.id,
+                name: p.name,
+                slug: p.slug,
+                type: p.type,
+                health: p.healthState,
+                enabled: p.enabled,
+            })),
+            recentFailures: recentFailures.map((r) => ({
+                id: r.id,
+                createdAt: r.createdAt,
+                requestedModel: r.requestedModel,
+                errorType: r.errorType,
+                errorMessage: r.errorMessage,
+                httpStatus: r.httpStatus,
+            })),
+        };
+    });
+}

package/dist/server/routes/admin/models.js

@@ -0,0 +1,178 @@
+import { z } from 'zod';
+import { eq, sql } from 'drizzle-orm';
+import { getDb, schema } from '../../db/index.js';
+import { requireAdminAuth } from '../../auth/middleware.js';
+import { recordAudit } from '../../db/repositories/audit.js';
+import { uuid } from '../../auth/ids.js';
+import { GatewayError } from '../../errors.js';
+const ImportModelsBody = z.object({
+    providerId: z.string(),
+    modelIds: z.array(z.string().min(1)).min(1),
+});
+const ModelUpdate = z.object({
+    id: z.string(),
+    displayName: z.string().min(1).max(128).optional(),
+    enabled: z.boolean().optional(),
+    upstreamAvailable: z.boolean().optional(),
+    capabilities: z.record(z.any()).optional(),
+    cacheOverrideEnabled: z.boolean().nullable().optional(),
+    maxContextTokens: z.number().int().min(1).nullable().optional(),
+    maxOutputTokens: z.number().int().min(1).nullable().optional(),
+});
+export async function registerModelRoutes(app) {
+    app.addHook('preHandler', requireAdminAuth);
+    app.get('/api/admin/models', async (req) => {
+        const q = req.query;
+        const db = getDb();
+        let rows = db.select().from(schema.models).all();
+        const providers = db.select().from(schema.providers).all();
+        const providerMap = new Map(providers.map((p) => [p.id, p]));
+        if (q.providerId)
+            rows = rows.filter((r) => r.providerId === q.providerId);
+        if (q.enabled !== undefined)
+            rows = rows.filter((r) => r.enabled === (q.enabled === 'true'));
+        if (q.upstreamAvailable !== undefined)
+            rows = rows.filter((r) => r.upstreamAvailable === (q.upstreamAvailable === 'true'));
+        if (q.capability)
+            rows = rows.filter((r) => {
+                try {
+                    const caps = JSON.parse(r.capabilitiesJson);
+                    return caps[q.capability] === true;
+                }
+                catch {
+                    return false;
+                }
+            });
+        const models = rows.map((m) => ({
+            id: m.id,
+            providerId: m.providerId,
+            providerSlug: providerMap.get(m.providerId)?.slug ?? '',
+            providerType: providerMap.get(m.providerId)?.type ?? 'openai',
+            publicModelId: m.publicModelId,
+            upstreamModelId: m.upstreamModelId,
+            displayName: m.displayName,
+            enabled: m.enabled,
+            upstreamAvailable: m.upstreamAvailable,
+            capabilities: safeJson(m.capabilitiesJson),
+            maxContextTokens: m.maxContextTokens,
+            maxOutputTokens: m.maxOutputTokens,
+            lastSeenUpstreamAt: m.lastSeenUpstreamAt,
+            createdAt: m.createdAt,
+        }));
+        return { models };
+    });
+    app.post('/api/admin/models/import', async (req) => {
+        const body = ImportModelsBody.parse(req.body);
+        const db = getDb();
+        const provider = db.select().from(schema.providers).where(eq(schema.providers.id, body.providerId)).get();
+        if (!provider)
+            throw new GatewayError('invalid_request_error', 'Provider not found', { status: 404 });
+        // Fetch discovered model metadata fresh (so import uses current discovery data)
+        // For simplicity: re-discover and match by upstream id.
+        const { discoverProviderModels } = await import('../../providers/index.js');
+        const { decryptSecret, decryptCustomHeaders } = await import('../../auth/crypto.js');
+        const apiKey = decryptSecret({ ciphertext: provider.encryptedApiKey, nonce: provider.apiKeyNonce, version: provider.apiKeyVersion });
+        const headers = decryptCustomHeaders(provider.customHeadersEncrypted && provider.customHeadersNonce ? { ciphertext: provider.customHeadersEncrypted, nonce: provider.customHeadersNonce, version: 1 } : null);
+        let discovered;
+        try {
+            discovered = await discoverProviderModels({ type: provider.type, baseUrl: provider.baseUrl, apiKey, customHeaders: headers, connectTimeoutMs: 5000, totalTimeoutMs: 30000 });
+        }
+        catch {
+            discovered = [];
+        }
+        const discMap = new Map(discovered.map((d) => [d.upstreamId, d]));
+        const now = new Date().toISOString();
+        let imported = 0;
+        for (const upstreamId of body.modelIds) {
+            const existing = db.select().from(schema.models).where(sql `provider_id = ${provider.id} AND upstream_model_id = ${upstreamId}`).get();
+            const disc = discMap.get(upstreamId);
+            const caps = disc?.capabilities ?? { chat: true, streaming: true, tools: true };
+            if (existing) {
+                db.update(schema.models).set({ upstreamAvailable: true, lastSeenUpstreamAt: now, updatedAt: now }).where(eq(schema.models.id, existing.id)).run();
+                continue;
+            }
+            const publicModelId = `${provider.slug}/${upstreamId}`;
+            db.insert(schema.models).values({
+                id: uuid(),
+                providerId: provider.id,
+                upstreamModelId: upstreamId,
+                publicModelId,
+                displayName: disc?.displayName ?? upstreamId,
+                enabled: true,
+                upstreamAvailable: true,
+                capabilitiesJson: JSON.stringify(caps),
+                maxContextTokens: typeof caps.max_context_tokens === 'number' ? caps.max_context_tokens : null,
+                maxOutputTokens: typeof caps.max_output_tokens === 'number' ? caps.max_output_tokens : null,
+                lastSeenUpstreamAt: now,
+            }).run();
+            imported++;
+        }
+        recordAudit({ action: 'model.import', success: true, targetType: 'provider', targetId: provider.id, targetName: provider.name, ip: req.ip, metadata: { count: body.modelIds.length, imported } });
+        return { ok: true, imported, requested: body.modelIds.length };
+    });
+    app.patch('/api/admin/models', async (req) => {
+        const body = ModelUpdate.parse(req.body);
+        const db = getDb();
+        const m = db.select().from(schema.models).where(eq(schema.models.id, body.id)).get();
+        if (!m)
+            throw new GatewayError('invalid_request_error', 'Model not found', { status: 404 });
+        const update = { updatedAt: new Date().toISOString() };
+        if (body.displayName)
+            update.displayName = body.displayName;
+        if (body.enabled !== undefined)
+            update.enabled = body.enabled;
+        if (body.upstreamAvailable !== undefined)
+            update.upstreamAvailable = body.upstreamAvailable;
+        if (body.capabilities) {
+            const merged = { ...safeJson(m.capabilitiesJson), ...body.capabilities };
+            update.capabilitiesJson = JSON.stringify(merged);
+            if (typeof merged.max_context_tokens === 'number')
+                update.maxContextTokens = merged.max_context_tokens;
+            if (typeof merged.max_output_tokens === 'number')
+                update.maxOutputTokens = merged.max_output_tokens;
+        }
+        if (body.cacheOverrideEnabled !== undefined)
+            update.cacheOverrideEnabled = body.cacheOverrideEnabled ?? null;
+        if (body.maxContextTokens !== undefined)
+            update.maxContextTokens = body.maxContextTokens;
+        if (body.maxOutputTokens !== undefined)
+            update.maxOutputTokens = body.maxOutputTokens;
+        db.update(schema.models).set(update).where(eq(schema.models.id, body.id)).run();
+        recordAudit({ action: 'model.update', success: true, targetType: 'model', targetId: m.id, targetName: m.publicModelId, ip: req.ip });
+        return { ok: true };
+    });
+    app.post('/api/admin/models/:id/toggle', async (req) => {
+        const { id } = req.params;
+        const db = getDb();
+        const m = db.select().from(schema.models).where(eq(schema.models.id, id)).get();
+        if (!m)
+            throw new GatewayError('invalid_request_error', 'Model not found', { status: 404 });
+        db.update(schema.models).set({ enabled: !m.enabled, updatedAt: new Date().toISOString() }).where(eq(schema.models.id, id)).run();
+        recordAudit({ action: m.enabled ? 'model.disable' : 'model.enable', success: true, targetType: 'model', targetId: id, targetName: m.publicModelId, ip: req.ip });
+        return { ok: true, enabled: !m.enabled };
+    });
+    app.delete('/api/admin/models/:id', async (req) => {
+        const { id } = req.params;
+        const db = getDb();
+        const m = db.select().from(schema.models).where(eq(schema.models.id, id)).get();
+        if (!m)
+            throw new GatewayError('invalid_request_error', 'Model not found', { status: 404 });
+        const inCombo = db.select().from(schema.comboMembers).where(eq(schema.comboMembers.modelId, id)).all();
+        if (inCombo.length > 0) {
+            db.update(schema.models).set({ enabled: false, upstreamAvailable: false, updatedAt: new Date().toISOString() }).where(eq(schema.models.id, id)).run();
+            recordAudit({ action: 'model.soft_disable', success: true, targetType: 'model', targetId: id, targetName: m.publicModelId, ip: req.ip, metadata: { reason: 'in_combo' } });
+            return { ok: true, softDisabled: true };
+        }
+        db.delete(schema.models).where(eq(schema.models.id, id)).run();
+        recordAudit({ action: 'model.delete', success: true, targetType: 'model', targetId: id, targetName: m.publicModelId, ip: req.ip });
+        return { ok: true };
+    });
+}
+function safeJson(s) {
+    try {
+        return JSON.parse(s);
+    }
+    catch {
+        return {};
+    }
+}

package/dist/server/routes/admin/providers.js

@@ -0,0 +1,212 @@
+import { z } from 'zod';
+import { sql, eq } from 'drizzle-orm';
+import { getDb, schema } from '../../db/index.js';
+import { requireAdminAuth } from '../../auth/middleware.js';
+import { recordAudit } from '../../db/repositories/audit.js';
+import { encryptSecret, decryptSecret, encryptCustomHeaders, decryptCustomHeaders, isMasterKeyConfigured } from '../../auth/crypto.js';
+import { uuid, slugify } from '../../auth/ids.js';
+import { GatewayError } from '../../errors.js';
+import { probeProvider, discoverProviderModels } from '../../providers/index.js';
+const ProviderCreate = z.object({
+    name: z.string().min(1).max(128),
+    slug: z.string().min(1).max(64).optional(),
+    type: z.enum(['openai', 'anthropic']),
+    baseUrl: z.string().url().max(512),
+    apiKey: z.string().min(1).max(512),
+    customHeaders: z.record(z.string(), z.string()).optional(),
+    enabled: z.boolean().optional(),
+    connectTimeoutMs: z.number().int().min(100).max(60000).optional(),
+    firstTokenTimeoutMs: z.number().int().min(100).max(300000).optional(),
+    streamIdleTimeoutMs: z.number().int().min(100).max(600000).optional(),
+    totalTimeoutMs: z.number().int().min(1000).max(600000).optional(),
+    maxRetries: z.number().int().min(0).max(8).optional(),
+    cbFailureThreshold: z.number().int().min(1).max(50).optional(),
+    cbCooldownSeconds: z.number().int().min(1).max(3600).optional(),
+});
+const ProviderUpdate = ProviderCreate.partial().extend({ id: z.string() });
+function requireMasterKey() {
+    if (!isMasterKeyConfigured()) {
+        throw new GatewayError('gateway_error', 'Master key not configured — set LATEDEV_MASTER_KEY', { status: 503 });
+    }
+}
+function providerToSummary(p, modelCount, recentErrorRate, recentAvgLatencyMs) {
+    return {
+        id: p.id,
+        name: p.name,
+        slug: p.slug,
+        type: p.type,
+        baseUrl: p.baseUrl,
+        enabled: p.enabled,
+        health: p.healthState,
+        modelCount,
+        recentErrorRate,
+        recentAvgLatencyMs,
+    };
+}
+export async function registerProviderRoutes(app) {
+    app.addHook('preHandler', requireAdminAuth);
+    app.get('/api/admin/providers', async () => {
+        const db = getDb();
+        const providers = db.select().from(schema.providers).all();
+        const modelCounts = db
+            .select({ providerId: schema.models.providerId, c: sql `COUNT(*)` })
+            .from(schema.models)
+            .groupBy(schema.models.providerId)
+            .all();
+        const counts = new Map(modelCounts.map((r) => [r.providerId, Number(r.c)]));
+        return {
+            providers: providers.map((p) => providerToSummary(p, counts.get(p.id) ?? 0, null, null)),
+        };
+    });
+    app.post('/api/admin/providers', async (req) => {
+        const body = ProviderCreate.parse(req.body);
+        requireMasterKey(); // Need master key to encrypt new credentials
+        const db = getDb();
+        const slug = body.slug ? slugify(body.slug) : slugify(body.name);
+        const dup = db.select().from(schema.providers).where(eq(schema.providers.slug, slug)).get();
+        if (dup)
+            throw new GatewayError('invalid_request_error', `Provider slug '${slug}' is already in use`, { status: 400 });
+        const enc = encryptSecret(body.apiKey);
+        const headersEnc = body.customHeaders ? encryptCustomHeaders(body.customHeaders) : null;
+        const id = uuid();
+        db.insert(schema.providers).values({
+            id,
+            name: body.name,
+            slug,
+            type: body.type,
+            baseUrl: body.baseUrl,
+            encryptedApiKey: enc.ciphertext,
+            apiKeyNonce: enc.nonce,
+            apiKeyVersion: enc.version,
+            customHeadersEncrypted: headersEnc?.ciphertext ?? null,
+            customHeadersNonce: headersEnc?.nonce ?? null,
+            enabled: body.enabled ?? true,
+            connectTimeoutMs: body.connectTimeoutMs ?? 10000,
+            firstTokenTimeoutMs: body.firstTokenTimeoutMs ?? 30000,
+            streamIdleTimeoutMs: body.streamIdleTimeoutMs ?? 60000,
+            totalTimeoutMs: body.totalTimeoutMs ?? 180000,
+            maxRetries: body.maxRetries ?? 2,
+            cbFailureThreshold: body.cbFailureThreshold ?? 5,
+            cbCooldownSeconds: body.cbCooldownSeconds ?? 60,
+        }).run();
+        recordAudit({ action: 'provider.create', success: true, targetType: 'provider', targetId: id, targetName: body.name, ip: req.ip });
+        return { id, slug };
+    });
+    app.patch('/api/admin/providers', async (req) => {
+        const body = ProviderUpdate.parse(req.body);
+        requireMasterKey(); // Need master key to encrypt/decrypt credentials
+        const db = getDb();
+        const p = db.select().from(schema.providers).where(eq(schema.providers.id, body.id)).get();
+        if (!p)
+            throw new GatewayError('invalid_request_error', 'Provider not found', { status: 404 });
+        const update = { updatedAt: new Date().toISOString() };
+        if (body.name)
+            update.name = body.name;
+        if (body.slug)
+            update.slug = slugify(body.slug);
+        if (body.baseUrl)
+            update.baseUrl = body.baseUrl;
+        if (body.enabled !== undefined)
+            update.enabled = body.enabled;
+        if (body.connectTimeoutMs !== undefined)
+            update.connectTimeoutMs = body.connectTimeoutMs;
+        if (body.firstTokenTimeoutMs !== undefined)
+            update.firstTokenTimeoutMs = body.firstTokenTimeoutMs;
+        if (body.streamIdleTimeoutMs !== undefined)
+            update.streamIdleTimeoutMs = body.streamIdleTimeoutMs;
+        if (body.totalTimeoutMs !== undefined)
+            update.totalTimeoutMs = body.totalTimeoutMs;
+        if (body.maxRetries !== undefined)
+            update.maxRetries = body.maxRetries;
+        if (body.cbFailureThreshold !== undefined)
+            update.cbFailureThreshold = body.cbFailureThreshold;
+        if (body.cbCooldownSeconds !== undefined)
+            update.cbCooldownSeconds = body.cbCooldownSeconds;
+        if (body.apiKey) {
+            const enc = encryptSecret(body.apiKey);
+            update.encryptedApiKey = enc.ciphertext;
+            update.apiKeyNonce = enc.nonce;
+            update.apiKeyVersion = enc.version;
+        }
+        if (body.customHeaders) {
+            const enc = encryptCustomHeaders(body.customHeaders);
+            update.customHeadersEncrypted = enc?.ciphertext ?? null;
+            update.customHeadersNonce = enc?.nonce ?? null;
+        }
+        db.update(schema.providers).set(update).where(eq(schema.providers.id, body.id)).run();
+        recordAudit({ action: 'provider.update', success: true, targetType: 'provider', targetId: p.id, targetName: body.name ?? p.name, ip: req.ip });
+        return { ok: true };
+    });
+    app.delete('/api/admin/providers/:id', async (req) => {
+        const { id } = req.params;
+        const db = getDb();
+        const p = db.select().from(schema.providers).where(eq(schema.providers.id, id)).get();
+        if (!p)
+            throw new GatewayError('invalid_request_error', 'Provider not found', { status: 404 });
+        const used = db.select().from(schema.models).where(eq(schema.models.providerId, id)).all();
+        if (used.length > 0) {
+            // Soft-disable if there are dependent models
+            db.update(schema.providers).set({ enabled: false, updatedAt: new Date().toISOString() }).where(eq(schema.providers.id, id)).run();
+            recordAudit({ action: 'provider.soft_disable', success: true, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip });
+            return { ok: true, softDisabled: true };
+        }
+        db.delete(schema.providers).where(eq(schema.providers.id, id)).run();
+        recordAudit({ action: 'provider.delete', success: true, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip });
+        return { ok: true };
+    });
+    app.post('/api/admin/providers/:id/test', async (req) => {
+        const { id } = req.params;
+        const db = getDb();
+        const p = db.select().from(schema.providers).where(eq(schema.providers.id, id)).get();
+        if (!p)
+            throw new GatewayError('invalid_request_error', 'Provider not found', { status: 404 });
+        const apiKey = decryptSecret({ ciphertext: p.encryptedApiKey, nonce: p.apiKeyNonce, version: p.apiKeyVersion });
+        const headers = decryptCustomHeaders(p.customHeadersEncrypted && p.customHeadersNonce ? { ciphertext: p.customHeadersEncrypted, nonce: p.customHeadersNonce, version: 1 } : null);
+        const result = await probeProvider({
+            type: p.type,
+            baseUrl: p.baseUrl,
+            apiKey,
+            customHeaders: headers,
+            connectTimeoutMs: p.connectTimeoutMs,
+            totalTimeoutMs: Math.min(p.totalTimeoutMs, 20000),
+        });
+        if (result.ok) {
+            db.update(schema.providers).set({ healthState: 'healthy', updatedAt: new Date().toISOString() }).where(eq(schema.providers.id, id)).run();
+        }
+        else {
+            db.update(schema.providers).set({ healthState: 'down', updatedAt: new Date().toISOString() }).where(eq(schema.providers.id, id)).run();
+        }
+        recordAudit({ action: 'provider.test', success: result.ok, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip, metadata: { detail: result.detail } });
+        return result;
+    });
+    app.post('/api/admin/providers/:id/discover', async (req) => {
+        const { id } = req.params;
+        const db = getDb();
+        const p = db.select().from(schema.providers).where(eq(schema.providers.id, id)).get();
+        if (!p)
+            throw new GatewayError('invalid_request_error', 'Provider not found', { status: 404 });
+        const apiKey = decryptSecret({ ciphertext: p.encryptedApiKey, nonce: p.apiKeyNonce, version: p.apiKeyVersion });
+        const headers = decryptCustomHeaders(p.customHeadersEncrypted && p.customHeadersNonce ? { ciphertext: p.customHeadersEncrypted, nonce: p.customHeadersNonce, version: 1 } : null);
+        const discovered = await discoverProviderModels({
+            type: p.type,
+            baseUrl: p.baseUrl,
+            apiKey,
+            customHeaders: headers,
+            connectTimeoutMs: 5000,
+            totalTimeoutMs: 30000,
+        });
+        const existing = db
+            .select()
+            .from(schema.models)
+            .where(eq(schema.models.providerId, p.id))
+            .all();
+        const existingMap = new Map(existing.map((m) => [m.upstreamModelId, m]));
+        const enriched = discovered.map((d) => ({
+            ...d,
+            alreadyImported: existingMap.has(d.upstreamId),
+            existingModelId: existingMap.get(d.upstreamId)?.id ?? null,
+        }));
+        recordAudit({ action: 'provider.discover', success: true, targetType: 'provider', targetId: id, targetName: p.name, ip: req.ip, metadata: { count: discovered.length } });
+        return { models: enriched };
+    });
+}