refactor(providers): one record per provider, one place for the key-and-URL decision (#988)

Every fact about a provider lives in one record in lib/providers.ts (SDK kind,
credential kind, env var prefix, default URL, picker group, four-language
notes, and a short model list for the six providers that cannot list models).
The thirteen tables keyed by provider name are gone. resolveEndpoint decides
whose key a call uses and where it goes; usesServerCredentials reads its
answer instead of mirroring getAIModel's branches; serverCredentialError holds
the server credential check once. The UI, the connection test and the routes
read the record's credential and sdk fields instead of comparing provider
names (44 such checks before, 6 after, in the admin panel's fixed-variable
branches).

Intended behavior changes: providers that can list their models have no
hand-written list; the settings dialog fetches the live list in the background
once credentials are entered for a provider without models and offers it
behind "Browse models". Azure has no placeholder default URL (old entries that
hold it still count as unset); the base URL field of Azure and of the new
"custom" OpenAI-compatible preset (CUSTOM_API_KEY, CUSTOM_BASE_URL) is
labelled required. The connection test answers 400 for an unknown provider
name; prototype names are refused everywhere. Provider lists in error messages
and the admin "add provider" dropdown follow the picker's order.

Also fixed, from before the refactor: the redirect guard drops x-access-code
on cross-origin redirects, and edgeOneEndpoint accepts the Origin header only
when it matches Host or X-Forwarded-Host.

Verification: a behavior snapshot of getAIModel's SDK factory calls and the
quota functions over 25 providers, 22 client override shapes and 9 server
environments (5843 rows), recorded on the old code and unchanged apart from
the intended changes; 752 unit tests, 65 provider e2e tests, tsc, biome,
next build. Reviewed by five models from one brief; their findings and the
resulting fixes are recorded in docs/plans/2026-10-provider-refactor.md.

lib/admin/providers.ts

@@ -1,14 +1,10 @@
 import { z } from "zod"
+import { PROVIDER_NAMES, PROVIDERS, type ProviderName } from "@/lib/providers"
 import {
     ProviderNameSchema,
     type ServerModelsConfig,
     slugify,
 } from "@/lib/server-model-config"
-import {
-    FIXED_CRED_PROVIDERS,
-    PROVIDER_INFO,
-    type ProviderName,
-} from "@/lib/types/model-config"
 import { type MaskedSecret, maskSecret } from "./auth"
 import { loadSettings } from "./settings"
 
@@ -80,20 +76,19 @@ const SECRET_FIELDS = [
     "vertexApiKey",
 ] as const
 
-// ADMIN_-prefixed env var names for instance `index` (0-based) of a provider
-function credEnvNames(
+// ADMIN_-prefixed env var names for instance `index` (0-based) of a
+// provider. None for providers whose credentials live in fixed variables
+// (Bedrock, Vertex AI, Ollama) or that have none (EdgeOne).
+export function credEnvNames(
     provider: ProviderName,
     index: number,
 ): { key?: string; url?: string } {
-    if (FIXED_CRED_PROVIDERS.includes(provider) || provider === "edgeone") {
-        return {}
-    }
-    const prefix =
-        provider === "gateway" ? "AI_GATEWAY" : provider.toUpperCase()
+    const { fixedCredentials, envPrefix } = PROVIDERS[provider]
+    if (fixedCredentials || envPrefix === null) return {}
     const suffix = index === 0 ? "" : `_${index + 1}`
     return {
-        key: `ADMIN_${prefix}_API_KEY${suffix}`,
-        url: `ADMIN_${prefix}_BASE_URL${suffix}`,
+        key: `ADMIN_${envPrefix}_API_KEY${suffix}`,
+        url: `ADMIN_${envPrefix}_BASE_URL${suffix}`,
     }
 }
 
@@ -162,7 +157,7 @@ export function mergeSecrets(
 }
 
 function displayName(p: StoredAdminProvider): string {
-    return p.name?.trim() || PROVIDER_INFO[p.provider].label
+    return p.name?.trim() || PROVIDERS[p.provider].label
 }
 
 export function validateAdminProviders(
@@ -170,9 +165,11 @@ export function validateAdminProviders(
     envConfig: ServerModelsConfig | null = null,
 ): string | null {
     const envProviders = envConfig?.providers ?? []
-    for (const single of FIXED_CRED_PROVIDERS) {
+    // Providers whose credentials live in fixed variables can have one entry
+    const fixed = PROVIDER_NAMES.filter((p) => PROVIDERS[p].fixedCredentials)
+    for (const single of fixed) {
         if (list.filter((p) => p.provider === single).length > 1) {
-            return `Only one ${PROVIDER_INFO[single].label} provider is supported (its credentials use fixed environment variables).`
+            return `Only one ${PROVIDERS[single].label} provider is supported (its credentials use fixed environment variables).`
         }
         // Its credentials are global; a panel instance would silently
         // override the credentials env-configured models rely on
@@ -180,7 +177,7 @@ export function validateAdminProviders(
             list.some((p) => p.provider === single) &&
             envProviders.some((p) => p.provider === single)
         ) {
-            return `${PROVIDER_INFO[single].label} is already configured in AI_MODELS_CONFIG / ai-models.json and shares global credentials. Manage it via the environment configuration instead.`
+            return `${PROVIDERS[single].label} is already configured in AI_MODELS_CONFIG / ai-models.json and shares global credentials. Manage it via the environment configuration instead.`
         }
     }
     // Server model ids are built from the slugified name, so names must

lib/i18n/dictionaries/en.json

@@ -298,9 +298,8 @@
         "mayNotDraw": "models.dev lists no tool call support for this model, so it may not be able to draw.",
         "requestUrl": "Requests go to {url}",
         "baseUrlWithExample": "Base URL (optional, e.g. {example})",
+        "baseUrlRequired": "Base URL (required)",
         "customEndpoint": "Custom endpoint URL",
-        "minimaxBaseUrlHint": "Use /anthropic for Anthropic-compatible API (recommended), or /v1 for OpenAI-compatible API",
-        "mimoBaseUrlHint": "Default works with pay-as-you-go keys (sk-...). Token Plan subscribers (tp-... keys) must set https://token-plan-cn.xiaomimimo.com/v1",
         "models": "Models",
         "customModelId": "Custom model ID...",
         "allAdded": "All added",
@@ -343,12 +342,6 @@
         "groupAggregators": "Aggregators",
         "groupCloud": "Cloud platforms",
         "groupSelfHosted": "Self-hosted",
-        "noteBedrock": "AWS credentials",
-        "noteVertex": "Express mode key",
-        "noteAzure": "Key and resource URL",
-        "noteEdgeone": "No key needed",
-        "noteOllama": "Key optional",
-        "noteSglang": "Your server's URL",
         "added": "Added",
         "awsCredentials": "AWS credentials",
         "bedrockAuthApiKey": "Bedrock API key",
@@ -362,6 +355,7 @@
         "modelFailed": "Failed",
         "modelUntested": "Untested",
         "needKey": "Fill in the API key first.",
+        "needUrl": "Fill in the API key and the base URL first.",
         "needAws": "Fill in the AWS credentials and region first.",
         "needModel": "Add a model first.",
         "stepConnect": "Connection",
@@ -384,7 +378,6 @@
         "deleteProviderOnly": "Delete {name}",
         "addProviderEntry": "Add a provider…",
         "awsKeysRejected": "AWS rejected these access keys. Check that both were copied in full.",
-        "needAzure": "Fill in the API key and your Azure resource's base URL first.",
         "validationFailedCountOne": "{count} model failed the test",
         "validationFailedCountOther": "{count} models failed the test",
         "deleteProviderNamedOne": "Delete {name} and its model",

lib/i18n/dictionaries/ja.json

@@ -253,9 +253,8 @@
         "mayNotDraw": "models.dev によると、このモデルはツール呼び出しに対応していないため、作図できない可能性があります。",
         "requestUrl": "リクエスト先: {url}",
         "baseUrlWithExample": "ベース URL（オプション、例: {example}）",
+        "baseUrlRequired": "ベース URL（必須）",
         "customEndpoint": "カスタムエンドポイント URL",
-        "minimaxBaseUrlHint": "/anthropic で Anthropic 互換 API（推奨）、または /v1 で OpenAI 互換 API を使用",
-        "mimoBaseUrlHint": "デフォルトは従量課金キー（sk-...）用です。Token Plan 加入者（tp-... キー）は https://token-plan-cn.xiaomimimo.com/v1 を設定してください",
         "models": "モデル",
         "customModelId": "カスタムモデル ID...",
         "allAdded": "すべて追加済み",
@@ -298,12 +297,6 @@
         "groupAggregators": "アグリゲーター",
         "groupCloud": "クラウド",
         "groupSelfHosted": "セルフホスト",
-        "noteBedrock": "AWS 認証情報",
-        "noteVertex": "Express モードのキー",
-        "noteAzure": "キーとリソース URL",
-        "noteEdgeone": "キー不要",
-        "noteOllama": "キーは任意",
-        "noteSglang": "サーバーの URL",
         "added": "追加済み",
         "awsCredentials": "AWS 認証情報",
         "bedrockAuthApiKey": "Bedrock API キー",
@@ -317,6 +310,7 @@
         "modelFailed": "エラー",
         "modelUntested": "未テスト",
         "needKey": "先に API キーを入力してください。",
+        "needUrl": "先に API キーとベース URL を入力してください。",
         "needAws": "先に AWS 認証情報とリージョンを入力してください。",
         "needModel": "先にモデルを追加してください。",
         "stepConnect": "接続",
@@ -339,7 +333,6 @@
         "deleteProviderOnly": "{name} を削除",
         "addProviderEntry": "プロバイダーを追加…",
         "awsKeysRejected": "AWS がこのアクセスキーを拒否しました。2 つとも最後までコピーされているか確認してください。",
-        "needAzure": "先に API キーと Azure リソースのベース URL を入力してください。",
         "validationFailedCountOne": "{count} 個のモデルがテストに失敗しました",
         "validationFailedCountOther": "{count} 個のモデルがテストに失敗しました",
         "deleteProviderNamedOne": "{name} とそのモデルを削除",

lib/i18n/dictionaries/zh-Hant.json

@@ -298,9 +298,8 @@
         "mayNotDraw": "models.dev 顯示這個模型不支援工具呼叫，可能無法繪圖。",
         "requestUrl": "請求將傳送至 {url}",
         "baseUrlWithExample": "基礎 URL（可選，例如 {example}）",
+        "baseUrlRequired": "基礎 URL（必填）",
         "customEndpoint": "自訂端點 URL",
-        "minimaxBaseUrlHint": "使用 /anthropic 端點為 Anthropic 相容 API（推薦），或使用 /v1 端點為 OpenAI 相容 API",
-        "mimoBaseUrlHint": "預設地址適用於按量付費金鑰（sk-...）。Token Plan 訂閱用戶（tp-... 金鑰）請設定為 https://token-plan-cn.xiaomimimo.com/v1",
         "models": "模型",
         "customModelId": "自訂模型 ID...",
         "allAdded": "已全部新增",
@@ -343,12 +342,6 @@
         "groupAggregators": "聚合平台",
         "groupCloud": "雲端平台",
         "groupSelfHosted": "自行部署",
-        "noteBedrock": "AWS 憑證",
-        "noteVertex": "Express 模式 Key",
-        "noteAzure": "Key 和資源位址",
-        "noteEdgeone": "不用 Key",
-        "noteOllama": "Key 可不填",
-        "noteSglang": "填服務位址",
         "added": "已新增",
         "awsCredentials": "AWS 憑證",
         "bedrockAuthApiKey": "Bedrock API Key",
@@ -362,6 +355,7 @@
         "modelFailed": "出錯",
         "modelUntested": "未測試",
         "needKey": "先填好 API Key。",
+        "needUrl": "先填好 API Key 和位址。",
         "needAws": "先填好 AWS 憑證和區域。",
         "needModel": "先新增一個模型。",
         "stepConnect": "連線",
@@ -384,7 +378,6 @@
         "deleteProviderOnly": "刪除 {name}",
         "addProviderEntry": "新增服務商…",
         "awsKeysRejected": "AWS 拒絕了這組存取金鑰。檢查兩個金鑰是否都複製完整。",
-        "needAzure": "先填好 API Key 和 Azure 資源的 Base URL。",
         "validationFailedCountOne": "{count} 個模型沒通過測試",
         "validationFailedCountOther": "{count} 個模型沒通過測試",
         "deleteProviderNamedOne": "刪除 {name} 和它的 {count} 個模型",

lib/i18n/dictionaries/zh.json

@@ -298,9 +298,8 @@
         "mayNotDraw": "models.dev 显示这个模型不支持工具调用，可能无法画图。",
         "requestUrl": "请求将发往 {url}",
         "baseUrlWithExample": "基础 URL（可选，例如 {example}）",
+        "baseUrlRequired": "基础 URL（必填）",
         "customEndpoint": "自定义端点 URL",
-        "minimaxBaseUrlHint": "使用 /anthropic 端点为 Anthropic 兼容 API（推荐），或使用 /v1 端点为 OpenAI 兼容 API",
-        "mimoBaseUrlHint": "默认地址适用于按量付费密钥（sk-...）。Token Plan 订阅用户（tp-... 密钥）请设置为 https://token-plan-cn.xiaomimimo.com/v1",
         "models": "模型",
         "customModelId": "自定义模型 ID...",
         "allAdded": "已全部添加",
@@ -343,12 +342,6 @@
         "groupAggregators": "聚合平台",
         "groupCloud": "云平台",
         "groupSelfHosted": "自己部署",
-        "noteBedrock": "AWS 凭证",
-        "noteVertex": "Express 模式 Key",
-        "noteAzure": "Key 和资源地址",
-        "noteEdgeone": "不用 Key",
-        "noteOllama": "Key 可不填",
-        "noteSglang": "填服务地址",
         "added": "已添加",
         "awsCredentials": "AWS 凭证",
         "bedrockAuthApiKey": "Bedrock API Key",
@@ -362,6 +355,7 @@
         "modelFailed": "出错",
         "modelUntested": "未测试",
         "needKey": "先填好 API Key。",
+        "needUrl": "先填好 API Key 和地址。",
         "needAws": "先填好 AWS 凭证和区域。",
         "needModel": "先添加一个模型。",
         "stepConnect": "连接",
@@ -384,7 +378,6 @@
         "deleteProviderOnly": "删除 {name}",
         "addProviderEntry": "添加服务商…",
         "awsKeysRejected": "AWS 拒绝了这组访问密钥。检查两个密钥是否都复制完整。",
-        "needAzure": "先填好 API Key 和 Azure 资源的 Base URL。",
         "validationFailedCountOne": "{count} 个模型没通过测试",
         "validationFailedCountOther": "{count} 个模型没通过测试",
         "deleteProviderNamedOne": "删除 {name} 和它的 {count} 个模型",

lib/provider-models.ts

@@ -1,12 +1,8 @@
 import { createGateway } from "ai"
 import { getModelInfo } from "@/lib/model-catalog"
+import { PROVIDERS, type ProviderName, publicDefaultUrl } from "@/lib/providers"
 import { readLimitedBody } from "@/lib/read-limited-body"
-import {
-    normalizeBaseUrl,
-    ollamaApiUrl,
-    PROVIDER_INFO,
-    type ProviderName,
-} from "@/lib/types/model-config"
+import { normalizeBaseUrl, ollamaApiUrl } from "@/lib/types/model-config"
 
 /** A model a provider offers. tools is false when it cannot call tools. */
 export interface ListedModel {
@@ -17,10 +13,7 @@ export interface ListedModel {
 const AIHUBMIX_MODELS_ENDPOINT = "https://aihubmix.com/api/v1/models"
 
 export function canListModels(provider: ProviderName): boolean {
-    return (
-        Object.hasOwn(PROVIDER_INFO, provider) &&
-        !!PROVIDER_INFO[provider].modelList
-    )
+    return Object.hasOwn(PROVIDERS, provider) && !!PROVIDERS[provider].modelList
 }
 
 // Models in OpenAI-style lists that are not for chat
@@ -131,16 +124,15 @@ async function getJson(
 
 /**
  * Where to list from without the user's base URL: where chat goes then. For
- * Ollama without a key that is the server's Ollama, else the SDK's local
- * default; a local default in PROVIDER_INFO (SGLang's) only fills the
- * settings form.
+ * Ollama (an optional key) without a key that is the server's Ollama, else
+ * the SDK's local default; a local default in the record (SGLang's) only
+ * fills the settings form.
  */
 function listFallbackUrl(provider: ProviderName, apiKey?: string): string {
-    if (provider === "ollama" && !apiKey) {
+    if (PROVIDERS[provider].credential === "optionalKey" && !apiKey) {
         return process.env.OLLAMA_BASE_URL || "http://127.0.0.1:11434/api"
     }
-    const url = PROVIDER_INFO[provider].defaultBaseUrl
-    return url?.startsWith("https://") ? url : ""
+    return publicDefaultUrl(provider) ?? ""
 }
 
 /**
@@ -163,11 +155,11 @@ export async function listProviderModels(
     // AIHubMix has a public list, unless the user points to another
     // endpoint, which is OpenAI-compatible
     const style =
-        provider === "aihubmix" &&
+        PROVIDERS[provider].sdk === "aihubmix" &&
         baseUrl &&
         !/^https:\/\/aihubmix\.com(\/v1)?$/.test(base)
             ? "openai"
-            : PROVIDER_INFO[provider].modelList
+            : PROVIDERS[provider].modelList
 
     switch (style) {
         case "anthropic": {
@@ -242,7 +234,7 @@ export async function listProviderModels(
         default: {
             if (!base) {
                 throw new ModelListError(
-                    `${PROVIDER_INFO[provider].label} needs a base URL to list its models.`,
+                    `${PROVIDERS[provider].label} needs a base URL to list its models.`,
                 )
             }
             const data = await getJson(`${base}/models`, bearer, fetchFn)

lib/provider-setup.ts

@@ -2,49 +2,22 @@
 // picker, and how far a provider's setup has come
 
 import {
-    PROVIDER_INFO,
-    type ProviderConfig,
-    type ProviderName,
-} from "@/lib/types/model-config"
+    PROVIDER_NAMES,
+    PROVIDERS,
+    type ProviderGroup as ProviderGroupId,
+} from "@/lib/providers"
+import type { ProviderConfig, ProviderName } from "@/lib/types/model-config"
 
-export type ProviderGroupId = "vendors" | "aggregators" | "cloud" | "selfHosted"
-
-/** The provider picker's groups, each provider in exactly one */
+/** The provider picker's groups, each provider in exactly one, in record order */
 export const PROVIDER_GROUPS: {
     id: ProviderGroupId
     providers: ProviderName[]
-}[] = [
-    {
-        id: "vendors",
-        providers: [
-            "openai",
-            "anthropic",
-            "google",
-            "deepseek",
-            "qwen",
-            "doubao",
-            "glm",
-            "kimi",
-            "minimax",
-            "mimo",
-        ],
-    },
-    {
-        id: "aggregators",
-        providers: [
-            "openrouter",
-            "aihubmix",
-            "siliconflow",
-            "modelscope",
-            "novita",
-            "atlascloud",
-            "qiniu",
-            "gateway",
-        ],
-    },
-    { id: "cloud", providers: ["bedrock", "vertexai", "azure", "edgeone"] },
-    { id: "selfHosted", providers: ["ollama", "sglang"] },
-]
+}[] = (["vendors", "aggregators", "cloud", "selfHosted"] as const).map(
+    (id) => ({
+        id,
+        providers: PROVIDER_NAMES.filter((p) => PROVIDERS[p].group === id),
+    }),
+)
 
 /** Shown when the user has no provider yet */
 export const POPULAR_PROVIDERS: ProviderName[] = [
@@ -56,29 +29,6 @@ export const POPULAR_PROVIDERS: ProviderName[] = [
     "qwen",
 ]
 
-/** Providers that need something other than a plain API key */
-export const PROVIDER_NOTE_KEYS: Partial<Record<ProviderName, string>> = {
-    bedrock: "noteBedrock",
-    vertexai: "noteVertex",
-    azure: "noteAzure",
-    edgeone: "noteEdgeone",
-    ollama: "noteOllama",
-    sglang: "noteSglang",
-}
-
-/**
- * Providers whose base URL usually needs changing (Azure's default is only
- * an example; Ollama's is its cloud, SGLang's a local server) or comes with
- * a hint (MiniMax, MiMo): their folded options start open
- */
-export const OPTIONS_OPEN: ProviderName[] = [
-    "azure",
-    "ollama",
-    "sglang",
-    "minimax",
-    "mimo",
-]
-
 /** The groups with only the providers whose name matches the search */
 export function filterProviderGroups(query: string) {
     const q = query.trim().toLowerCase()
@@ -87,35 +37,37 @@ export function filterProviderGroups(query: string) {
         ...group,
         providers: group.providers.filter(
             (p) =>
-                PROVIDER_INFO[p].label.toLowerCase().includes(q) ||
-                p.includes(q),
+                PROVIDERS[p].label.toLowerCase().includes(q) || p.includes(q),
         ),
     })).filter((group) => group.providers.length > 0)
 }
 
+const LEGACY_AZURE_PLACEHOLDER = "https://your-resource.openai.azure.com/openai"
+
 /** The credentials a test or a chat request needs are filled in */
 export function hasCredentials(p: ProviderConfig): boolean {
-    switch (p.provider) {
-        case "bedrock":
+    const def = PROVIDERS[p.provider]
+    switch (def.credential) {
+        case "aws":
             return (
                 (!!p.apiKey ||
                     (!!p.awsAccessKeyId && !!p.awsSecretAccessKey)) &&
                 !!p.awsRegion
             )
-        case "vertexai":
+        case "vertexKey":
             return !!p.vertexApiKey
-        // Its default base URL names no real resource
-        case "azure":
-            return (
-                !!p.apiKey &&
-                !!p.baseUrl &&
-                p.baseUrl !== PROVIDER_INFO.azure.defaultBaseUrl
-            )
-        case "edgeone":
-        case "ollama":
+        case "none":
+        case "optionalKey":
             return true
-        default:
-            return !!p.apiKey
+        case "apiKey": {
+            // Without a default URL in the record (Azure, custom) the user's
+            // own is part of the credentials. Entries saved while Azure still
+            // had a placeholder default hold that placeholder; it names no
+            // real resource
+            const baseUrl =
+                p.baseUrl === LEGACY_AZURE_PLACEHOLDER ? "" : p.baseUrl
+            return !!p.apiKey && (!!def.defaultBaseUrl || !!baseUrl)
+        }
     }
 }
 

lib/providers.ts

@@ -0,0 +1,558 @@
+// Every fact about a provider in one record: which AI SDK factory runs it,
+// what it signs in with, its environment variable names, its official URL
+// and what the settings UI shows for it. Pure data with no runtime imports,
+// so client components, the Edge runtime and Node can all read it.
+//
+// Adding an OpenAI-compatible provider means adding one record here, plus
+// its two lines in env.example and a paragraph in docs/*/ai-providers.md.
+
+import type { Locale } from "@/lib/i18n/config"
+
+/** Which AI SDK factory createModel() calls */
+export type Sdk =
+    | "openai" // @ai-sdk/openai: Responses API, Chat Completions behind a configured URL
+    | "openai-compatible" // @ai-sdk/openai-compatible plus <think> tag extraction
+    | "deepseek" // @ai-sdk/deepseek: reasoning_content round trip (deepseek, kimi, mimo)
+    | "doubao" // deepseek for DeepSeek and Kimi model ids, openai-compatible otherwise
+    | "anthropic"
+    | "minimax" // anthropic or openai-compatible, chosen from the URL path
+    | "google"
+    | "vertex"
+    | "azure"
+    | "bedrock"
+    | "openrouter"
+    | "gateway"
+    | "aihubmix" // @aihubmix/ai-sdk-provider on the official URL, openai-compatible elsewhere
+    | "ollama"
+
+/** What the settings form asks for and what a request signs in with */
+export type Credential =
+    | "apiKey" // one key, required with a custom base URL
+    | "optionalKey" // Ollama: the key may be empty
+    | "none" // EdgeOne: the site's own function, cookies authenticate
+    | "aws" // Bedrock: a Bedrock API key, or an access key pair, plus a region
+    | "vertexKey" // Vertex AI Express Mode key
+
+/** How a provider lists its models (see lib/provider-models.ts) */
+export type ModelListStyle =
+    | "openai"
+    | "anthropic"
+    | "google"
+    | "ollama"
+    | "openrouter"
+    | "aihubmix"
+    | "gateway"
+
+export type ProviderGroup = "vendors" | "aggregators" | "cloud" | "selfHosted"
+
+/** One sentence in every UI language */
+export type LocalizedText = Record<Locale, string>
+
+export interface ProviderDef {
+    label: string
+    sdk: Sdk
+    credential: Credential
+    /** The picker's group; the order of the records is the order inside a group */
+    group: ProviderGroup
+    /**
+     * The server reads <PREFIX>_API_KEY and <PREFIX>_BASE_URL. Only the
+     * spelling of the names: whether the key is required (auto-detection,
+     * validation) follows `credential`, and whether the admin panel writes
+     * ADMIN_<PREFIX>_API_KEY[_n] follows `fixedCredentials`.
+     * null: no key variables (Bedrock, EdgeOne)
+     */
+    envPrefix: string | null
+    /** The key variable when it does not follow the prefix (GOOGLE_GENERATIVE_AI_API_KEY) */
+    keyEnv?: string
+    /** A second variable accepted as the server key (ANTHROPIC_AUTH_TOKEN, sent as Bearer) */
+    altKeyEnv?: string
+    /** Azure: the SDK builds the URL from this variable when there is no base URL */
+    resourceNameEnv?: string
+    /**
+     * The official endpoint, also the form's placeholder. A non-https value
+     * (SGLang's 127.0.0.1) only fills the form; the server never falls back
+     * to it. A credential "apiKey" provider without one (Azure, custom)
+     * needs the user's URL
+     */
+    defaultBaseUrl?: string
+    /** The SDK has the official endpoint built in: pass no baseURL unless one is configured */
+    sdkKnowsEndpoint?: true
+    /** Where users create a key */
+    apiKeyUrl?: string
+    /** How to list models; missing when a key alone cannot (Bedrock, Vertex, Azure, EdgeOne, Doubao, MiniMax) */
+    modelList?: ModelListStyle
+    /** The list is public or local: no key needed to list (Ollama, OpenRouter, AIHubMix) */
+    listNeedsNoKey?: true
+    /** A short hand-written list for providers without modelList; the first one is added with the provider */
+    models?: string[]
+    /** The SDK builds the request path itself, so chatRequestUrl shows nothing */
+    ownRequestPath?: true
+    /** Only one system message per request */
+    singleSystem?: true
+    /** Server credentials live in fixed env vars; the admin panel allows one entry */
+    fixedCredentials?: true
+    /** models.dev logo name when it differs from the key */
+    logo?: string
+    /** A Lucide icon shown instead of a models.dev logo */
+    icon?: "cloud" | "server" | "sparkles"
+    /** The note shown under the name in the picker (Bedrock: "AWS credentials") */
+    note?: LocalizedText
+    /** A hint under the base URL field (MiniMax: which path selects which protocol) */
+    baseUrlHint?: LocalizedText
+    /** The folded options start open: the base URL usually needs changing */
+    optionsOpen?: true
+}
+
+// Written in the order the provider picker shows them, group by group
+const defs = {
+    // Model vendors
+    openai: {
+        label: "OpenAI",
+        sdk: "openai",
+        credential: "apiKey",
+        group: "vendors",
+        envPrefix: "OPENAI",
+        defaultBaseUrl: "https://api.openai.com/v1",
+        sdkKnowsEndpoint: true,
+        apiKeyUrl: "https://platform.openai.com/api-keys",
+        modelList: "openai",
+    },
+    anthropic: {
+        label: "Anthropic",
+        sdk: "anthropic",
+        credential: "apiKey",
+        group: "vendors",
+        envPrefix: "ANTHROPIC",
+        altKeyEnv: "ANTHROPIC_AUTH_TOKEN",
+        defaultBaseUrl: "https://api.anthropic.com/v1",
+        apiKeyUrl: "https://platform.claude.com/settings/keys",
+        modelList: "anthropic",
+    },
+    google: {
+        label: "Google",
+        sdk: "google",
+        credential: "apiKey",
+        group: "vendors",
+        envPrefix: "GOOGLE",
+        keyEnv: "GOOGLE_GENERATIVE_AI_API_KEY",
+        defaultBaseUrl: "https://generativelanguage.googleapis.com/v1beta",
+        sdkKnowsEndpoint: true,
+        apiKeyUrl: "https://aistudio.google.com/apikey",
+        modelList: "google",
+        ownRequestPath: true,
+    },
+    deepseek: {
+        label: "DeepSeek",
+        sdk: "deepseek",
+        credential: "apiKey",
+        group: "vendors",
+        envPrefix: "DEEPSEEK",
+        defaultBaseUrl: "https://api.deepseek.com/v1",
+        sdkKnowsEndpoint: true,
+        apiKeyUrl: "https://platform.deepseek.com/api_keys",
+        modelList: "openai",
+    },
+    qwen: {
+        label: "Qwen (Alibaba)",
+        sdk: "openai-compatible",
+        credential: "apiKey",
+        group: "vendors",
+        envPrefix: "QWEN",
+        defaultBaseUrl: "https://dashscope.aliyuncs.com/compatible-mode/v1",
+        apiKeyUrl: "https://bailian.console.aliyun.com/?tab=model#/api-key",
+        modelList: "openai",
+        singleSystem: true,
+    },
+    doubao: {
+        label: "Doubao (ByteDance)",
+        sdk: "doubao",
+        credential: "apiKey",
+        group: "vendors",
+        envPrefix: "DOUBAO",
+        defaultBaseUrl: "https://ark.cn-beijing.volces.com/api/v3",
+        apiKeyUrl:
+            "https://console.volcengine.com/ark/region:ark+cn-beijing/apiKey",
+        icon: "sparkles",
+        // Volcengine Ark ids use the dash form
+        models: [
+            "doubao-seed-2-0-pro-260215",
+            "doubao-seed-2-0-lite-260428",
+            "doubao-seed-2-0-mini-260428",
+            "doubao-seed-1-8-251228",
+            "doubao-seed-1-6-251015",
+            "doubao-seed-1-6-flash-250828",
+            "doubao-seed-1-6-vision-250815",
+            "doubao-1-5-pro-32k-250115",
+            "doubao-1-5-lite-32k-250115",
+        ],
+    },
+    glm: {
+        label: "GLM (Zhipu)",
+        sdk: "openai-compatible",
+        credential: "apiKey",
+        group: "vendors",
+        envPrefix: "GLM",
+        defaultBaseUrl: "https://open.bigmodel.cn/api/paas/v4",
+        apiKeyUrl: "https://open.bigmodel.cn/usercenter/proj-mgmt/apikeys",
+        modelList: "openai",
+        singleSystem: true,
+    },
+    kimi: {
+        label: "Kimi (Moonshot)",
+        sdk: "deepseek",
+        credential: "apiKey",
+        group: "vendors",
+        envPrefix: "KIMI",
+        defaultBaseUrl: "https://api.moonshot.cn/v1",
+        apiKeyUrl: "https://platform.moonshot.cn/console/api-keys",
+        modelList: "openai",
+        singleSystem: true,
+    },
+    minimax: {
+        label: "MiniMax",
+        sdk: "minimax",
+        credential: "apiKey",
+        group: "vendors",
+        envPrefix: "MINIMAX",
+        defaultBaseUrl: "https://api.minimaxi.com/anthropic",
+        apiKeyUrl:
+            "https://platform.minimaxi.com/user-center/basic-information/interface-key",
+        ownRequestPath: true,
+        singleSystem: true,
+        optionsOpen: true,
+        baseUrlHint: {
+            en: "Use /anthropic for Anthropic-compatible API (recommended), or /v1 for OpenAI-compatible API",
+            zh: "使用 /anthropic 端点为 Anthropic 兼容 API（推荐），或使用 /v1 端点为 OpenAI 兼容 API",
+            ja: "/anthropic で Anthropic 互換 API（推奨）、または /v1 で OpenAI 互換 API を使用",
+            "zh-Hant":
+                "使用 /anthropic 端點為 Anthropic 相容 API（推薦），或使用 /v1 端點為 OpenAI 相容 API",
+        },
+        // The Anthropic-compatible API
+        models: [
+            "MiniMax-M3",
+            "MiniMax-M2.7",
+            "MiniMax-M2.7-highspeed",
+            "MiniMax-M2.5",
+        ],
+    },
+    mimo: {
+        label: "MiMo (Xiaomi)",
+        sdk: "deepseek",
+        credential: "apiKey",
+        group: "vendors",
+        envPrefix: "MIMO",
+        defaultBaseUrl: "https://api.xiaomimimo.com/v1",
+        apiKeyUrl: "https://platform.xiaomimimo.com/#/console/api-keys",
+        modelList: "openai",
+        singleSystem: true,
+        logo: "xiaomi",
+        optionsOpen: true,
+        baseUrlHint: {
+            en: "Default works with pay-as-you-go keys (sk-...). Token Plan subscribers (tp-... keys) must set https://token-plan-cn.xiaomimimo.com/v1",
+            zh: "默认地址适用于按量付费密钥（sk-...）。Token Plan 订阅用户（tp-... 密钥）请设置为 https://token-plan-cn.xiaomimimo.com/v1",
+            ja: "デフォルトは従量課金キー（sk-...）用です。Token Plan 加入者（tp-... キー）は https://token-plan-cn.xiaomimimo.com/v1 を設定してください",
+            "zh-Hant":
+                "預設地址適用於按量付費金鑰（sk-...）。Token Plan 訂閱用戶（tp-... 金鑰）請設定為 https://token-plan-cn.xiaomimimo.com/v1",
+        },
+    },
+
+    // Aggregators and gateways
+    openrouter: {
+        label: "OpenRouter",
+        sdk: "openrouter",
+        credential: "apiKey",
+        group: "aggregators",
+        envPrefix: "OPENROUTER",
+        defaultBaseUrl: "https://openrouter.ai/api/v1",
+        sdkKnowsEndpoint: true,
+        apiKeyUrl: "https://openrouter.ai/keys",
+        modelList: "openrouter",
+        listNeedsNoKey: true,
+    },
+    aihubmix: {
+        label: "AIHubMix",
+        sdk: "aihubmix",
+        credential: "apiKey",
+        group: "aggregators",
+        envPrefix: "AIHUBMIX",
+        defaultBaseUrl: "https://aihubmix.com/v1",
+        apiKeyUrl: "https://aihubmix.com/token",
+        modelList: "aihubmix",
+        listNeedsNoKey: true,
+    },
+    siliconflow: {
+        label: "SiliconFlow",
+        sdk: "openai-compatible",
+        credential: "apiKey",
+        group: "aggregators",
+        envPrefix: "SILICONFLOW",
+        defaultBaseUrl: "https://api.siliconflow.cn/v1",
+        apiKeyUrl: "https://cloud.siliconflow.cn/account/ak",
+        modelList: "openai",
+    },
+    modelscope: {
+        label: "ModelScope",
+        sdk: "openai-compatible",
+        credential: "apiKey",
+        group: "aggregators",
+        envPrefix: "MODELSCOPE",
+        defaultBaseUrl: "https://api-inference.modelscope.cn/v1",
+        apiKeyUrl: "https://modelscope.cn/my/myaccesstoken",
+        modelList: "openai",
+    },
+    novita: {
+        label: "Novita AI",
+        sdk: "openai-compatible",
+        credential: "apiKey",
+        group: "aggregators",
+        envPrefix: "NOVITA",
+        defaultBaseUrl: "https://api.novita.ai/openai",
+        apiKeyUrl: "https://novita.ai/dashboard/key",
+        modelList: "openai",
+        singleSystem: true,
+    },
+    atlascloud: {
+        label: "Atlas Cloud",
+        sdk: "openai-compatible",
+        credential: "apiKey",
+        group: "aggregators",
+        envPrefix: "ATLASCLOUD",
+        defaultBaseUrl: "https://api.atlascloud.ai/v1",
+        apiKeyUrl: "https://www.atlascloud.ai/console/api-keys",
+        modelList: "openai",
+        logo: "openai",
+    },
+    qiniu: {
+        label: "Qiniu",
+        sdk: "openai-compatible",
+        credential: "apiKey",
+        group: "aggregators",
+        envPrefix: "QINIU",
+        defaultBaseUrl: "https://api.qnaigc.com/v1",
+        apiKeyUrl: "https://www.qiniu.com/ai/models",
+        modelList: "openai",
+        singleSystem: true,
+    },
+    gateway: {
+        label: "AI Gateway",
+        sdk: "gateway",
+        credential: "apiKey",
+        group: "aggregators",
+        envPrefix: "AI_GATEWAY",
+        defaultBaseUrl: "https://ai-gateway.vercel.sh/v1/ai",
+        sdkKnowsEndpoint: true,
+        apiKeyUrl: "https://vercel.com/ai-gateway",
+        modelList: "gateway",
+        ownRequestPath: true,
+        logo: "vercel",
+    },
+
+    // Cloud platforms
+    bedrock: {
+        label: "Amazon Bedrock",
+        sdk: "bedrock",
+        credential: "aws",
+        group: "cloud",
+        envPrefix: null,
+        fixedCredentials: true,
+        ownRequestPath: true,
+        icon: "cloud",
+        note: {
+            en: "AWS credentials",
+            zh: "AWS 凭证",
+            ja: "AWS 認証情報",
+            "zh-Hant": "AWS 憑證",
+        },
+        // Newer models only answer through an inference profile id (the
+        // region prefix). Each id here was called once on 2026-10-04.
+        models: [
+            // Anthropic Claude ("global." works from any region)
+            "global.anthropic.claude-opus-5-5",
+            "global.anthropic.claude-sonnet-5-5",
+            "global.anthropic.claude-fable-5-1",
+            "global.anthropic.claude-opus-5",
+            "global.anthropic.claude-sonnet-5",
+            "global.anthropic.claude-opus-4-8",
+            "global.anthropic.claude-opus-4-7",
+            "global.anthropic.claude-sonnet-4-6",
+            "global.anthropic.claude-opus-4-6-v1",
+            "global.anthropic.claude-opus-4-5-20251101-v1:0",
+            "global.anthropic.claude-sonnet-4-5-20250929-v1:0",
+            "global.anthropic.claude-haiku-4-5-20251001-v1:0",
+            "global.anthropic.claude-sonnet-4-20250514-v1:0",
+            // Amazon Nova
+            "us.amazon.nova-2-lite-v1:0",
+            "amazon.nova-pro-v1:0",
+            "amazon.nova-lite-v1:0",
+            "amazon.nova-micro-v1:0",
+            // Meta Llama
+            "us.meta.llama4-maverick-17b-instruct-v1:0",
+            "us.meta.llama4-scout-17b-instruct-v1:0",
+            "us.meta.llama3-3-70b-instruct-v1:0",
+            // Mistral
+            "mistral.mistral-large-3-675b-instruct",
+            "us.mistral.pixtral-large-2502-v1:0",
+        ],
+    },
+    vertexai: {
+        label: "Google Vertex AI",
+        sdk: "vertex",
+        credential: "vertexKey",
+        group: "cloud",
+        envPrefix: "GOOGLE_VERTEX",
+        fixedCredentials: true,
+        ownRequestPath: true,
+        logo: "google",
+        note: {
+            en: "Express mode key",
+            zh: "Express 模式 Key",
+            ja: "Express モードのキー",
+            "zh-Hant": "Express 模式 Key",
+        },
+        models: [
+            // Gemini 3 series
+            "gemini-3.1-pro-preview",
+            "gemini-3.5-flash",
+            "gemini-3-flash-preview",
+            "gemini-3.1-flash-lite",
+            // Gemini 2.5 series
+            "gemini-2.5-pro",
+            "gemini-2.5-flash",
+            "gemini-2.5-flash-lite",
+        ],
+    },
+    azure: {
+        label: "Azure OpenAI",
+        sdk: "azure",
+        credential: "apiKey",
+        group: "cloud",
+        envPrefix: "AZURE",
+        resourceNameEnv: "AZURE_RESOURCE_NAME",
+        // No default: the URL names the user's own resource
+        sdkKnowsEndpoint: true,
+        ownRequestPath: true,
+        optionsOpen: true,
+        note: {
+            en: "Key and resource URL",
+            zh: "Key 和资源地址",
+            ja: "キーとリソース URL",
+            "zh-Hant": "Key 和資源位址",
+        },
+        baseUrlHint: {
+            en: "Your Azure OpenAI resource's URL, https://<resource>.openai.azure.com/openai",
+            zh: "Azure OpenAI 资源的地址，形如 https://<资源名>.openai.azure.com/openai",
+            ja: "Azure OpenAI リソースの URL。例: https://<リソース名>.openai.azure.com/openai",
+            "zh-Hant":
+                "Azure OpenAI 資源的位址，形如 https://<資源名稱>.openai.azure.com/openai",
+        },
+        // Deployment names in the user's resource
+        models: [
+            "gpt-5.5",
+            "gpt-5.4",
+            "gpt-5.1",
+            "gpt-5",
+            "gpt-5-mini",
+            "gpt-4.1",
+            "gpt-4o",
+            "gpt-4o-mini",
+            "o3",
+            "o4-mini",
+        ],
+    },
+    edgeone: {
+        label: "EdgeOne Pages",
+        sdk: "openai-compatible",
+        credential: "none",
+        group: "cloud",
+        envPrefix: null,
+        ownRequestPath: true,
+        logo: "tencent-cloud",
+        note: {
+            en: "No key needed",
+            zh: "不用 Key",
+            ja: "キー不要",
+            "zh-Hant": "不用 Key",
+        },
+        models: ["@tx/deepseek-ai/deepseek-v32"],
+    },
+
+    // Self-hosted
+    ollama: {
+        label: "Ollama",
+        sdk: "ollama",
+        credential: "optionalKey",
+        group: "selfHosted",
+        envPrefix: "OLLAMA",
+        fixedCredentials: true,
+        defaultBaseUrl: "https://ollama.com/api",
+        apiKeyUrl: "https://ollama.com/settings/keys",
+        modelList: "ollama",
+        listNeedsNoKey: true,
+        optionsOpen: true,
+        note: {
+            en: "Key optional",
+            zh: "Key 可不填",
+            ja: "キーは任意",
+            "zh-Hant": "Key 可不填",
+        },
+    },
+    sglang: {
+        label: "SGLang",
+        sdk: "openai-compatible",
+        credential: "apiKey",
+        group: "selfHosted",
+        envPrefix: "SGLANG",
+        // A local example that only fills the form; the server never falls
+        // back to it (publicDefaultUrl)
+        defaultBaseUrl: "http://127.0.0.1:8000/v1",
+        modelList: "openai",
+        icon: "server",
+        optionsOpen: true,
+        note: {
+            en: "Your server's URL",
+            zh: "填服务地址",
+            ja: "サーバーの URL",
+            "zh-Hant": "填服務位址",
+        },
+    },
+    // Any OpenAI-compatible API: vLLM, LM Studio, LiteLLM, a gateway. The
+    // user enters the URL; a server that ignores keys takes any non-empty
+    // one (a custom URL always needs a key, see getAIModel's guard)
+    custom: {
+        label: "OpenAI-compatible",
+        sdk: "openai-compatible",
+        credential: "apiKey",
+        group: "selfHosted",
+        envPrefix: "CUSTOM",
+        modelList: "openai",
+        icon: "server",
+        optionsOpen: true,
+        // Open-source chat templates reject several system messages
+        singleSystem: true,
+        note: {
+            en: "Your URL and key",
+            zh: "填地址和 Key",
+            ja: "URL とキー",
+            "zh-Hant": "填位址和 Key",
+        },
+    },
+} satisfies Record<string, ProviderDef>
+
+export type ProviderName = keyof typeof defs
+
+// Widened to ProviderDef so optional fields can be read on any provider:
+// `satisfies` keeps each record's own literal type, on whose union only the
+// fields every record has would exist
+export const PROVIDERS: Record<ProviderName, ProviderDef> = defs
+
+export const PROVIDER_NAMES = Object.keys(PROVIDERS) as ProviderName[]
+
+/**
+ * The https default the server may call on its own. A local default
+ * (SGLang's 127.0.0.1) only fills the settings form: the server must not
+ * call its own machine for it.
+ */
+export function publicDefaultUrl(provider: ProviderName): string | undefined {
+    const url = PROVIDERS[provider].defaultBaseUrl
+    return url?.startsWith("https://") ? url : undefined
+}

lib/server-model-config.ts

@@ -1,12 +1,11 @@
 import fs from "fs/promises"
 import path from "path"
 import { z } from "zod"
-import type { ProviderName } from "@/lib/types/model-config"
-import { PROVIDER_INFO } from "@/lib/types/model-config"
+import { PROVIDERS, type ProviderName } from "@/lib/providers"
 
 export const ProviderNameSchema: z.ZodType<ProviderName> = z
     .string()
-    .refine((val): val is ProviderName => val in PROVIDER_INFO, {
+    .refine((val): val is ProviderName => Object.hasOwn(PROVIDERS, val), {
         message: "Invalid provider name",
     })
 
@@ -81,7 +80,7 @@ function configFromCommaSeparatedAiModel(): ServerModelsConfig | null {
         )
         return null
     }
-    if (!(aiProvider in PROVIDER_INFO)) {
+    if (!Object.hasOwn(PROVIDERS, aiProvider)) {
         console.warn(
             `[server-model-config] AI_PROVIDER="${aiProvider}" is not a known provider; skipping multi-model fallback.`,
         )
@@ -102,7 +101,7 @@ function configFromCommaSeparatedAiModel(): ServerModelsConfig | null {
     return {
         providers: [
             {
-                name: PROVIDER_INFO[providerName]?.label || providerName,
+                name: PROVIDERS[providerName]?.label || providerName,
                 provider: providerName,
                 models,
                 default: true,
@@ -195,7 +194,7 @@ export async function loadFlattenedServerModels(): Promise<
 
     for (const p of cfg.providers) {
         const providerLabel =
-            p.name || PROVIDER_INFO[p.provider]?.label || p.provider
+            p.name || PROVIDERS[p.provider]?.label || p.provider
 
         // Use slugified name for unique ID (supports multiple API keys per provider)
         const nameSlug = slugify(p.name)

lib/ssrf-protection.ts

@@ -126,9 +126,9 @@ export class RedirectRefusedError extends Error {
 
 const MAX_REDIRECTS = 5
 
-// Dropped when a redirect goes to another origin: those fetch drops, and
-// the key headers of providers that do not use Authorization (Anthropic,
-// Google, Azure)
+// Dropped when a redirect goes to another origin: those fetch drops, the
+// key headers of providers that do not use Authorization (Anthropic,
+// Google, Azure) and this site's access code (EdgeOne's function checks it)
 const CREDENTIAL_HEADERS = [
     "authorization",
     "proxy-authorization",
@@ -136,6 +136,7 @@ const CREDENTIAL_HEADERS = [
     "x-api-key",
     "x-goog-api-key",
     "api-key",
+    "x-access-code",
 ]
 
 /**

lib/test-model-connection.ts

@@ -12,8 +12,9 @@ import {
     isQuotaEnabled,
 } from "@/lib/dynamo-quota-manager"
 import { classifyLLMError } from "@/lib/llm-errors"
+import { PROVIDERS, type ProviderName } from "@/lib/providers"
 import { allowPrivateUrls, isPrivateUrl } from "@/lib/ssrf-protection"
-import { normalizeBaseUrl, type ProviderName } from "@/lib/types/model-config"
+import { normalizeBaseUrl } from "@/lib/types/model-config"
 import { getUserIdFromRequest } from "@/lib/user-id"
 
 export interface TestModelRequest {
@@ -74,10 +75,22 @@ export async function testModelConnection(
                 { status: 400 },
             )
         }
-        // EdgeOne is this site's own function, as in the chat; the admin
-        // panel's Test sends no URL, and a relative one cannot be fetched
-        const baseUrl =
-            provider === "edgeone" ? edgeOneEndpoint(req) : body.baseUrl
+        // The body is untrusted: an unknown name has no record to read
+        if (!Object.hasOwn(PROVIDERS, provider)) {
+            return NextResponse.json(
+                {
+                    valid: false,
+                    error: `Invalid provider: ${provider}. Allowed providers: ${Object.keys(PROVIDERS).join(", ")}`,
+                },
+                { status: 400 },
+            )
+        }
+        const { credential } = PROVIDERS[provider]
+        // The site's own function (EdgeOne) is this site's, as in the chat;
+        // the admin panel's Test sends no URL, and a relative one cannot be
+        // fetched
+        const onSiteFunction = credential === "none"
+        const baseUrl = onSiteFunction ? edgeOneEndpoint(req) : body.baseUrl
 
         // SECURITY: Block SSRF attacks via custom baseUrl
         if (
@@ -92,35 +105,44 @@ export async function testModelConnection(
             )
         }
 
-        // Validate credentials based on provider
-        if (provider === "bedrock") {
-            if (
-                !(apiKey || (awsAccessKeyId && awsSecretAccessKey)) ||
-                !awsRegion
-            ) {
-                return NextResponse.json(
-                    {
-                        valid: false,
-                        error: "AWS credentials (a Bedrock API key, or an Access Key ID and Secret Access Key, and a Region) are required",
-                    },
-                    { status: 400 },
-                )
-            }
-        } else if (provider === "vertexai") {
-            if (!vertexApiKey) {
-                return NextResponse.json(
-                    {
-                        valid: false,
-                        error: "Vertex AI API key is required for Express Mode",
-                    },
-                    { status: 400 },
-                )
-            }
-        } else if (provider !== "ollama" && provider !== "edgeone" && !apiKey) {
-            return NextResponse.json(
-                { valid: false, error: "API key is required" },
-                { status: 400 },
-            )
+        // The credentials the provider's kind asks for
+        switch (credential) {
+            case "aws":
+                if (
+                    !(apiKey || (awsAccessKeyId && awsSecretAccessKey)) ||
+                    !awsRegion
+                ) {
+                    return NextResponse.json(
+                        {
+                            valid: false,
+                            error: "AWS credentials (a Bedrock API key, or an Access Key ID and Secret Access Key, and a Region) are required",
+                        },
+                        { status: 400 },
+                    )
+                }
+                break
+            case "vertexKey":
+                if (!vertexApiKey) {
+                    return NextResponse.json(
+                        {
+                            valid: false,
+                            error: "Vertex AI API key is required for Express Mode",
+                        },
+                        { status: 400 },
+                    )
+                }
+                break
+            case "apiKey":
+                if (!apiKey) {
+                    return NextResponse.json(
+                        { valid: false, error: "API key is required" },
+                        { status: 400 },
+                    )
+                }
+                break
+            case "optionalKey":
+            case "none":
+                break
         }
         // The Test button checks the user's own provider. On the server's
         // keys (Ollama Cloud without a key or URL) anyone could run any model.
@@ -180,8 +202,9 @@ export async function testModelConnection(
             // Temporary AWS credentials need it, as in the chat
             awsSessionToken,
             vertexApiKey,
-            // EdgeOne checks the Pages cookies and the access code
-            ...(provider === "edgeone" && {
+            // The site's function (EdgeOne) checks the Pages cookies and
+            // the access code
+            ...(onSiteFunction && {
                 headers: {
                     cookie: req.headers.get("cookie") || "",
                     "x-access-code": req.headers.get("x-access-code") || "",

lib/types/model-config.ts

@@ -1,30 +1,8 @@
 // Types for multi-provider model configuration
 
-export type ProviderName =
-    | "openai"
-    | "anthropic"
-    | "google"
-    | "vertexai"
-    | "azure"
-    | "bedrock"
-    | "ollama"
-    | "openrouter"
-    | "aihubmix"
-    | "deepseek"
-    | "siliconflow"
-    | "sglang"
-    | "gateway"
-    | "edgeone"
-    | "doubao"
-    | "modelscope"
-    | "glm"
-    | "qwen"
-    | "qiniu"
-    | "kimi"
-    | "minimax"
-    | "novita"
-    | "mimo"
-    | "atlascloud"
+import { PROVIDERS, type ProviderName } from "@/lib/providers"
+
+export type { ProviderName } from "@/lib/providers"
 
 // Individual model configuration
 export interface ModelConfig {
@@ -84,449 +62,6 @@ export interface FlattenedModel {
     isDefault?: boolean
 }
 
-// Providers whose server credentials live in fixed env vars
-// (AWS_ACCESS_KEY_ID, GOOGLE_VERTEX_API_KEY, OLLAMA_API_KEY) with no
-// apiKeyEnv redirection support — their credentials are global
-export const FIXED_CRED_PROVIDERS: ProviderName[] = [
-    "bedrock",
-    "vertexai",
-    "ollama",
-]
-
-// Map provider names to models.dev logo names
-export const PROVIDER_LOGO_MAP: Record<string, string> = {
-    openai: "openai",
-    anthropic: "anthropic",
-    google: "google",
-    azure: "azure",
-    bedrock: "amazon-bedrock",
-    openrouter: "openrouter",
-    aihubmix: "aihubmix",
-    deepseek: "deepseek",
-    siliconflow: "siliconflow",
-    sglang: "openai", // SGLang is OpenAI-compatible
-    gateway: "vercel",
-    edgeone: "tencent-cloud",
-    vertexai: "google",
-    doubao: "bytedance",
-    modelscope: "modelscope",
-    minimax: "minimax",
-    novita: "novita",
-    mimo: "xiaomi",
-    atlascloud: "openai",
-}
-
-/** How a provider lists its models (see lib/provider-models.ts) */
-export type ModelListStyle =
-    | "openai"
-    | "anthropic"
-    | "google"
-    | "ollama"
-    | "openrouter"
-    | "aihubmix"
-    | "gateway"
-
-// Provider metadata. apiKeyUrl is the page where users create a key.
-// modelList is missing where a key alone cannot list the models (Bedrock,
-// Vertex, Azure) or the list is not reliable (Doubao, MiniMax).
-export const PROVIDER_INFO: Record<
-    ProviderName,
-    {
-        label: string
-        defaultBaseUrl?: string
-        apiKeyUrl?: string
-        modelList?: ModelListStyle
-    }
-> = {
-    openai: {
-        label: "OpenAI",
-        defaultBaseUrl: "https://api.openai.com/v1",
-        apiKeyUrl: "https://platform.openai.com/api-keys",
-        modelList: "openai",
-    },
-    anthropic: {
-        label: "Anthropic",
-        defaultBaseUrl: "https://api.anthropic.com/v1",
-        apiKeyUrl: "https://platform.claude.com/settings/keys",
-        modelList: "anthropic",
-    },
-    google: {
-        label: "Google",
-        defaultBaseUrl: "https://generativelanguage.googleapis.com/v1beta",
-        apiKeyUrl: "https://aistudio.google.com/apikey",
-        modelList: "google",
-    },
-    vertexai: { label: "Google Vertex AI" },
-    azure: {
-        label: "Azure OpenAI",
-        defaultBaseUrl: "https://your-resource.openai.azure.com/openai",
-    },
-    bedrock: { label: "Amazon Bedrock" },
-    ollama: {
-        label: "Ollama",
-        defaultBaseUrl: "https://ollama.com/api",
-        apiKeyUrl: "https://ollama.com/settings/keys",
-        modelList: "ollama",
-    },
-    openrouter: {
-        label: "OpenRouter",
-        defaultBaseUrl: "https://openrouter.ai/api/v1",
-        apiKeyUrl: "https://openrouter.ai/keys",
-        modelList: "openrouter",
-    },
-    aihubmix: {
-        label: "AIHubMix",
-        defaultBaseUrl: "https://aihubmix.com/v1",
-        apiKeyUrl: "https://aihubmix.com/token",
-        modelList: "aihubmix",
-    },
-    deepseek: {
-        label: "DeepSeek",
-        defaultBaseUrl: "https://api.deepseek.com/v1",
-        apiKeyUrl: "https://platform.deepseek.com/api_keys",
-        modelList: "openai",
-    },
-    siliconflow: {
-        label: "SiliconFlow",
-        defaultBaseUrl: "https://api.siliconflow.cn/v1",
-        apiKeyUrl: "https://cloud.siliconflow.cn/account/ak",
-        modelList: "openai",
-    },
-    sglang: {
-        label: "SGLang",
-        defaultBaseUrl: "http://127.0.0.1:8000/v1",
-        modelList: "openai",
-    },
-    gateway: {
-        label: "AI Gateway",
-        defaultBaseUrl: "https://ai-gateway.vercel.sh/v1/ai",
-        apiKeyUrl: "https://vercel.com/ai-gateway",
-        modelList: "gateway",
-    },
-    edgeone: { label: "EdgeOne Pages" },
-    doubao: {
-        label: "Doubao (ByteDance)",
-        defaultBaseUrl: "https://ark.cn-beijing.volces.com/api/v3",
-        apiKeyUrl:
-            "https://console.volcengine.com/ark/region:ark+cn-beijing/apiKey",
-    },
-    modelscope: {
-        label: "ModelScope",
-        defaultBaseUrl: "https://api-inference.modelscope.cn/v1",
-        apiKeyUrl: "https://modelscope.cn/my/myaccesstoken",
-        modelList: "openai",
-    },
-    glm: {
-        label: "GLM (Zhipu)",
-        defaultBaseUrl: "https://open.bigmodel.cn/api/paas/v4",
-        apiKeyUrl: "https://open.bigmodel.cn/usercenter/proj-mgmt/apikeys",
-        modelList: "openai",
-    },
-    qwen: {
-        label: "Qwen (Alibaba)",
-        defaultBaseUrl: "https://dashscope.aliyuncs.com/compatible-mode/v1",
-        apiKeyUrl: "https://bailian.console.aliyun.com/?tab=model#/api-key",
-        modelList: "openai",
-    },
-    qiniu: {
-        label: "Qiniu",
-        defaultBaseUrl: "https://api.qnaigc.com/v1",
-        apiKeyUrl: "https://www.qiniu.com/ai/models",
-        modelList: "openai",
-    },
-    kimi: {
-        label: "Kimi (Moonshot)",
-        defaultBaseUrl: "https://api.moonshot.cn/v1",
-        apiKeyUrl: "https://platform.moonshot.cn/console/api-keys",
-        modelList: "openai",
-    },
-    minimax: {
-        label: "MiniMax",
-        defaultBaseUrl: "https://api.minimaxi.com/anthropic",
-        apiKeyUrl:
-            "https://platform.minimaxi.com/user-center/basic-information/interface-key",
-    },
-    novita: {
-        label: "Novita AI",
-        defaultBaseUrl: "https://api.novita.ai/openai",
-        apiKeyUrl: "https://novita.ai/dashboard/key",
-        modelList: "openai",
-    },
-    mimo: {
-        label: "MiMo (Xiaomi)",
-        defaultBaseUrl: "https://api.xiaomimimo.com/v1",
-        apiKeyUrl: "https://platform.xiaomimimo.com/#/console/api-keys",
-        modelList: "openai",
-    },
-    atlascloud: {
-        label: "Atlas Cloud",
-        defaultBaseUrl: "https://api.atlascloud.ai/v1",
-        apiKeyUrl: "https://www.atlascloud.ai/console/api-keys",
-        modelList: "openai",
-    },
-}
-
-// Suggested models per provider for quick add
-export const SUGGESTED_MODELS: Partial<Record<ProviderName, string[]>> = {
-    openai: [
-        "gpt-6.1-sol",
-        "gpt-6-sol",
-        "gpt-6-luna",
-        "gpt-6-astra",
-        "gpt-5.5-pro",
-        "gpt-5.5",
-        "gpt-5.4-pro",
-        "gpt-5.4",
-        "gpt-5.4-mini",
-        "gpt-5.4-nano",
-        "gpt-5-codex-mini",
-        "gpt-4.1",
-        "gpt-4.1-mini",
-        "gpt-4o",
-        "gpt-4o-mini",
-    ],
-    anthropic: [
-        // Claude 5 series (latest)
-        "claude-opus-5-5",
-        "claude-sonnet-5-5",
-        "claude-fable-5-1",
-        "claude-opus-5",
-        "claude-sonnet-5",
-        // Claude 4.8 / 4.7 / 4.6 series (dateless pinned IDs)
-        "claude-opus-4-8",
-        "claude-sonnet-4-6",
-        "claude-haiku-4-5",
-        "claude-opus-4-7",
-        "claude-opus-4-6",
-        // Claude 4.5 series
-        "claude-sonnet-4-5-20250929",
-        "claude-opus-4-5-20251101",
-        // Claude 3.7 series
-        "claude-3-7-sonnet-20250219",
-        // Claude 3.5 series
-        "claude-3-5-sonnet-20241022",
-        "claude-3-5-haiku-20241022",
-    ],
-    google: [
-        // Gemini 3 series
-        "gemini-3.1-pro",
-        "gemini-3.5-flash",
-        "gemini-3-flash",
-        "gemini-3.1-flash-lite",
-        // Gemini 2.5 series
-        "gemini-2.5-pro",
-        "gemini-2.5-flash",
-        "gemini-2.5-flash-lite",
-    ],
-    vertexai: [
-        // Gemini 3 series
-        "gemini-3.1-pro-preview",
-        "gemini-3.5-flash",
-        "gemini-3-flash-preview",
-        "gemini-3.1-flash-lite",
-        // Gemini 2.5 series
-        "gemini-2.5-pro",
-        "gemini-2.5-flash",
-        "gemini-2.5-flash-lite",
-    ],
-    azure: [
-        "gpt-5.5",
-        "gpt-5.4",
-        "gpt-5.1",
-        "gpt-5",
-        "gpt-5-mini",
-        "gpt-4.1",
-        "gpt-4o",
-        "gpt-4o-mini",
-        "o3",
-        "o4-mini",
-    ],
-    // Newer models only answer through an inference profile id (the region
-    // prefix). Each id here was called once on 2026-10-04.
-    bedrock: [
-        // Anthropic Claude ("global." works from any region)
-        "global.anthropic.claude-opus-5-5",
-        "global.anthropic.claude-sonnet-5-5",
-        "global.anthropic.claude-fable-5-1",
-        "global.anthropic.claude-opus-5",
-        "global.anthropic.claude-sonnet-5",
-        "global.anthropic.claude-opus-4-8",
-        "global.anthropic.claude-opus-4-7",
-        "global.anthropic.claude-sonnet-4-6",
-        "global.anthropic.claude-opus-4-6-v1",
-        "global.anthropic.claude-opus-4-5-20251101-v1:0",
-        "global.anthropic.claude-sonnet-4-5-20250929-v1:0",
-        "global.anthropic.claude-haiku-4-5-20251001-v1:0",
-        "global.anthropic.claude-sonnet-4-20250514-v1:0",
-        // Amazon Nova
-        "us.amazon.nova-2-lite-v1:0",
-        "amazon.nova-pro-v1:0",
-        "amazon.nova-lite-v1:0",
-        "amazon.nova-micro-v1:0",
-        // Meta Llama
-        "us.meta.llama4-maverick-17b-instruct-v1:0",
-        "us.meta.llama4-scout-17b-instruct-v1:0",
-        "us.meta.llama3-3-70b-instruct-v1:0",
-        // Mistral
-        "mistral.mistral-large-3-675b-instruct",
-        "us.mistral.pixtral-large-2502-v1:0",
-    ],
-    openrouter: [
-        // Anthropic
-        "anthropic/claude-opus-5.5",
-        "anthropic/claude-sonnet-5.5",
-        "anthropic/claude-fable-5.1",
-        "anthropic/claude-opus-4.8",
-        "anthropic/claude-sonnet-4.6",
-        "anthropic/claude-haiku-4.5",
-        // OpenAI
-        "openai/gpt-6.1-sol",
-        "openai/gpt-6-luna",
-        "openai/gpt-5.5",
-        "openai/gpt-5.4",
-        "openai/gpt-5.4-mini",
-        "openai/gpt-4o-mini",
-        // Google
-        "google/gemini-3.1-pro-preview",
-        "google/gemini-3.5-flash",
-        "google/gemini-2.5-flash-lite",
-        // xAI
-        "x-ai/grok-4.3",
-        // Meta Llama
-        "meta-llama/llama-4-maverick",
-        "meta-llama/llama-4-scout",
-        "meta-llama/llama-3.3-70b-instruct",
-        // DeepSeek
-        "deepseek/deepseek-v4-pro",
-        "deepseek/deepseek-v3.2",
-        // Qwen
-        "qwen/qwen3.7-max",
-        "qwen/qwen3-coder",
-        // MiniMax
-        "minimax/minimax-m3",
-    ],
-    aihubmix: [
-        // Fallback list. The settings UI loads the live model list from AIHubMix when available.
-        // Anthropic Claude
-        "claude-fable-5",
-        "claude-opus-4-8",
-        "claude-sonnet-4-6",
-        // OpenAI
-        "gpt-5.5",
-        "gpt-5.5-pro",
-        "gpt-5.4",
-        // Google Gemini
-        "gemini-3.5-flash",
-        "gemini-3.1-pro-preview",
-        "gemini-3-flash-preview",
-        // DeepSeek
-        "deepseek-v4-pro",
-        "deepseek-v4-flash",
-        // Qwen
-        "qwen3.7-max",
-        "qwen3-coder-next",
-        // Z.ai
-        "glm-5.1",
-        // Moonshot AI
-        "kimi-k2.6",
-        // MiniMax
-        "minimax-m3",
-        // xAI
-        "grok-4.3",
-        // Baidu
-        "ernie-5.1",
-        // Mistral
-        "mistral-large-3",
-        // Meta
-        "llama-4-maverick",
-    ],
-    deepseek: [
-        "deepseek-v4-pro",
-        "deepseek-v4-flash",
-        "deepseek-chat",
-        "deepseek-reasoner",
-    ],
-    siliconflow: [
-        // DeepSeek
-        "deepseek-ai/DeepSeek-V4-Pro",
-        "deepseek-ai/DeepSeek-V4-Flash",
-        "deepseek-ai/DeepSeek-V3.2",
-        // MiniMax
-        "MiniMaxAI/MiniMax-M3",
-        // Moonshot
-        "moonshotai/Kimi-K2.6",
-        // Z.ai
-        "zai-org/GLM-5",
-        // Qwen
-        "Qwen/Qwen3.6-35B-A3B",
-        "Qwen/Qwen3-Coder-480B-A35B-Instruct",
-        "Qwen/Qwen3-30B-A3B-Instruct-2507",
-        "Qwen/Qwen3-VL-32B-Instruct",
-        // OpenAI open-weights
-        "openai/gpt-oss-120b",
-    ],
-    sglang: [
-        // SGLang is OpenAI-compatible, models depend on deployment
-        "default",
-    ],
-    gateway: [
-        "anthropic/claude-opus-5.5",
-        "anthropic/claude-sonnet-5.5",
-        "openai/gpt-6.1-sol",
-        "openai/gpt-6-luna",
-        "openai/gpt-5.5",
-        "anthropic/claude-opus-4.7",
-        "google/gemini-3.1-pro-preview",
-        "xai/grok-4.3",
-        "anthropic/claude-sonnet-4.6",
-        "anthropic/claude-haiku-4.5",
-        "openai/gpt-5.4-mini",
-    ],
-    edgeone: ["@tx/deepseek-ai/deepseek-v32"],
-    doubao: [
-        // ByteDance Doubao models (Volcengine Ark IDs use dash form)
-        "doubao-seed-2-0-pro-260215",
-        "doubao-seed-2-0-lite-260428",
-        "doubao-seed-2-0-mini-260428",
-        "doubao-seed-1-8-251228",
-        "doubao-seed-1-6-251015",
-        "doubao-seed-1-6-flash-250828",
-        "doubao-seed-1-6-vision-250815",
-        "doubao-1-5-pro-32k-250115",
-        "doubao-1-5-lite-32k-250115",
-    ],
-    modelscope: [
-        // DeepSeek
-        "deepseek-ai/DeepSeek-V4-Pro",
-        "deepseek-ai/DeepSeek-V3.2",
-        "deepseek-ai/DeepSeek-R1-0528",
-        "deepseek-ai/DeepSeek-R1",
-        // Qwen
-        "Qwen/Qwen3-235B-A22B-Instruct-2507",
-        "Qwen/Qwen3-VL-235B-A22B-Instruct",
-        "Qwen/Qwen3-Coder-30B-A3B-Instruct",
-        "Qwen/Qwen3-32B",
-        "Qwen/Qwen2.5-72B-Instruct",
-    ],
-    minimax: [
-        // MiniMax models (Anthropic-compatible API)
-        "MiniMax-M3",
-        "MiniMax-M2.7",
-        "MiniMax-M2.7-highspeed",
-        "MiniMax-M2.5",
-    ],
-    novita: [
-        // Novita AI models (OpenAI-compatible API)
-        "minimax/minimax-m3",
-        "deepseek/deepseek-v4-pro",
-        "zai-org/glm-5.1",
-        "moonshotai/kimi-k2.6",
-        "deepseek/deepseek-v4-flash",
-    ],
-    mimo: ["mimo-v2.5-pro", "mimo-v2.5"],
-    atlascloud: ["qwen/qwen3.5-flash", "deepseek-ai/deepseek-v4-pro"],
-}
-
 // Helper to generate UUID
 export function generateId(): string {
     return `${Date.now()}-${Math.random().toString(36).slice(2, 9)}`
@@ -547,7 +82,7 @@ export function createProviderConfig(provider: ProviderName): ProviderConfig {
         id: generateId(),
         provider,
         apiKey: "",
-        baseUrl: PROVIDER_INFO[provider].defaultBaseUrl,
+        baseUrl: PROVIDERS[provider].defaultBaseUrl,
         models: [],
     }
 }
@@ -567,7 +102,7 @@ export function flattenModels(config: MultiModelConfig): FlattenedModel[] {
     for (const provider of config.providers) {
         // Use custom name if provided, otherwise use default provider label
         const providerLabel =
-            provider.name || PROVIDER_INFO[provider.provider].label
+            provider.name || PROVIDERS[provider.provider].label
 
         for (const model of provider.models) {
             models.push({
@@ -631,18 +166,10 @@ export function chatRequestUrl(
 ): string | null {
     const url = normalizeBaseUrl(baseUrl)
     if (!url) return null
-    if (provider === "anthropic") return `${url}/messages`
-    if (provider === "ollama") return `${ollamaApiUrl(url)}/chat`
+    const { sdk, ownRequestPath } = PROVIDERS[provider]
+    if (sdk === "anthropic") return `${url}/messages`
+    if (sdk === "ollama") return `${ollamaApiUrl(url)}/chat`
     // These SDKs build their own paths (or, for MiniMax, pick the protocol
     // from the URL)
-    const ownPaths: ProviderName[] = [
-        "google",
-        "vertexai",
-        "azure",
-        "bedrock",
-        "gateway",
-        "minimax",
-        "edgeone",
-    ]
-    return ownPaths.includes(provider) ? null : `${url}/chat/completions`
+    return ownRequestPath ? null : `${url}/chat/completions`
 }