feat: add z-ai provider with secure JWT authentication

[kamail12]

What's Added

• New Z-AI provider supporting GLM-4.6, GLM-4.5, GLM-4.5-flash models
• Secure JWT authentication with token generation/validation
• Dynamic model discovery from Z-AI API

[therry47]

@kamail12 maybe add the new model Glm 4.7 and Glm 4.7 flash ?

[Stijnus]

Code review

Found 5 issues that should be addressed before merging:

1. Node.js crypto import incompatible with edge/browser environments

The use of import crypto from 'node:crypto' will fail in Cloudflare Workers and browser contexts. This code is imported in client-side components through the provider registry.

bolt.diy/app/lib/modules/llm/providers/z-ai.ts

Lines 5 to 6 in 25b7ce7

	import { createOpenAI } from '@ai-sdk/openai';
	import crypto from 'node:crypto';

Suggested fix: Use Web Crypto API instead:
```typescript
// Replace crypto import with Web Crypto API
const encoder = new TextEncoder();
const keyData = encoder.encode(secret);
const key = await crypto.subtle.importKey(
'raw',
keyData,
{ name: 'HMAC', hash: 'SHA-256' },
false,
['sign']
);
const signature = await crypto.subtle.sign('HMAC', key, encoder.encode(payload));
const base64Signature = btoa(String.fromCharCode(...new Uint8Array(signature)));
```

2. Missing .env.example configuration

All other providers document their API keys in .env.example. Users won't know what environment variables to configure.

Suggested fix: Add to .env.example:
```env

Z.AI (GLM models)

Get your API key from: https://open.bigmodel.cn/usercenter/apikeys

ZAI_API_KEY=your_zai_api_key_here
ZAI_BASE_URL=https://api.z.ai/api/coding/paas/v4
```

3. Missing CloudProvidersTab UI integration

The provider backend is added but won't appear in the settings UI. TypeScript will error when the provider appears in settings.

bolt.diy/app/lib/modules/llm/providers/z-ai.ts

Lines 8 to 9 in 25b7ce7

	export default class ZaiProvider extends BaseProvider {
	name = 'Z.ai';

Suggested fix: Update app/components/@settings/tabs/providers/cloud/CloudProvidersTab.tsx:
```typescript
type ProviderName = 'Anthropic' | 'OpenAI' | ... | 'Zai';

const PROVIDER_ICONS = {
...
Zai: TbBrain,
};

const PROVIDER_DESCRIPTIONS = {
...
Zai: 'Access GLM-4.6 and other Z.AI models',
};
```

4. Breaking configuration key change

Changed from ZAI_API_BASE_URL to ZAI_BASE_URL without backwards compatibility. Consider keeping the original key name or adding migration logic.

bolt.diy/app/lib/modules/llm/providers/z-ai.ts

Lines 13 to 14 in 25b7ce7

	baseUrlKey: 'ZAI_BASE_URL',
	apiTokenKey: 'ZAI_API_KEY',

5. API endpoint verification needed

Uses /api/coding/paas/v4 endpoint - please verify this is the correct endpoint for general Z.AI usage vs the standard /api/paas/v4 endpoint.

bolt.diy/app/lib/modules/llm/providers/z-ai.ts

Line 15 in 25b7ce7

baseUrl: 'https://api.z.ai/api/coding/paas/v4', //Dedicated endpoint for Coding Plan

---

🤖 Generated with Claude Code

_{- If this code review was useful, please react with 👍. Otherwise, react with 👎.}

[Stijnus]

merged in a new PR and pushed