apilive 1.1.0

package/src/env.js

@@ -0,0 +1,134 @@
+// Finds API keys in .env files, the process environment, or pasted text.
+
+import fs from "node:fs";
+import path from "node:path";
+import { detectProvider, providerForEnvName, providers } from "./providers.js";
+import { cleanKey } from "./check.js";
+
+export const DEFAULT_ENV_FILES = [
+  ".env",
+  ".env.local",
+  ".env.development",
+  ".env.development.local",
+  ".env.test",
+  ".env.test.local",
+  ".env.production",
+  ".env.production.local",
+];
+
+const PLACEHOLDER = /^(|x+|\.\.\.|changeme|change_me|todo|null|undefined|none|your[-_ ].*|<.*>|\$\{.*\}|sk-\.\.\.|sk-x+|.*\*{3,}.*)$/i;
+
+// Minimal dotenv parser: KEY=VALUE, `export KEY=VALUE`, quotes, inline comments.
+export function parseDotenv(text) {
+  const out = [];
+  const lines = String(text).replace(/\r\n?/g, "\n").split("\n");
+  for (const line of lines) {
+    const m = line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_.-]*)\s*[=:]\s*(.*)?$/);
+    if (!m) continue;
+    let value = (m[2] ?? "").trim();
+    const q = value[0];
+    if ((q === '"' || q === "'" || q === "`") && value.indexOf(q, 1) > 0) {
+      value = value.slice(1, value.indexOf(q, 1));
+    } else {
+      value = value.replace(/\s+#.*$/, "").trim();
+    }
+    out.push({ name: m[1], value });
+  }
+  return out;
+}
+
+function looksLikeKey(value) {
+  return value.length >= 16 && !PLACEHOLDER.test(value) && !/\s/.test(value);
+}
+
+// Turn arbitrary pasted text (one key, many keys, or a whole .env) into
+// candidate entries. `forced` pins every bare key to one provider.
+export function extractKeys(text, { forced = null } = {}) {
+  const found = [];
+  const lines = String(text).replace(/\r\n?/g, "\n").split("\n").map((l) => l.trim()).filter(Boolean);
+
+  for (const line of lines) {
+    if (line.startsWith("#")) continue;
+    const [pair] = parseDotenv(line);
+    // A base64-ish key ending in "=" parses as a pair too, so only treat the
+    // line as NAME=VALUE when the value itself looks like a key.
+    if (pair && looksLikeKey(cleanKey(pair.value))) {
+      const key = cleanKey(pair.value);
+      const byName = providerForEnvName(pair.name);
+      if (byName || forced) {
+        found.push({ key, name: pair.name, provider: forced || byName, confident: true, candidates: [] });
+        continue;
+      }
+      const d = detectProvider(key);
+      if (d.provider) found.push({ key, name: pair.name, ...d });
+      continue;
+    }
+    // NAME=placeholder / NAME= lines are config, not a bare key.
+    if (pair && /^[A-Z][A-Z0-9]*_[A-Z0-9_]*$/.test(pair.name)) continue;
+    const key = cleanKey(line);
+    if (!key || /\s/.test(key)) continue;
+    if (forced) {
+      found.push({ key, name: null, provider: forced, confident: true, candidates: [] });
+    } else {
+      found.push({ key, name: null, ...detectProvider(key) });
+    }
+  }
+  return dedupe(found);
+}
+
+function dedupe(entries) {
+  const map = new Map();
+  for (const e of entries) {
+    const id = `${e.provider}\u0000${e.key}`;
+    const prev = map.get(id);
+    if (prev) {
+      for (const s of e.sources || []) if (!prev.sources?.includes(s)) prev.sources = [...(prev.sources || []), s];
+    } else {
+      map.set(id, { ...e });
+    }
+  }
+  return [...map.values()];
+}
+
+// Scan .env files in `cwd` (or explicit `files`) plus the process environment.
+export function scanEnvironment({ cwd = process.cwd(), files = null, env = process.env, includeEnv = true } = {}) {
+  const found = [];
+  const targets = files ?? DEFAULT_ENV_FILES.map((f) => path.join(cwd, f));
+  const scanned = [];
+
+  for (const file of targets) {
+    let text;
+    try {
+      text = fs.readFileSync(file, "utf8");
+    } catch (e) {
+      if (files) scanned.push({ file, error: e.code === "ENOENT" ? "not found" : e.message });
+      continue;
+    }
+    scanned.push({ file });
+    const label = path.relative(cwd, file) || file;
+    for (const { name, value } of parseDotenv(text)) {
+      const entry = fromVar(name, value);
+      if (entry) found.push({ ...entry, sources: [`${name} · ${label}`] });
+    }
+  }
+
+  if (includeEnv) {
+    for (const [name, value] of Object.entries(env)) {
+      const entry = fromVar(name, value ?? "");
+      if (entry) found.push({ ...entry, sources: [`${name} · env`] });
+    }
+  }
+
+  return { keys: dedupe(found), scanned };
+}
+
+function fromVar(name, value) {
+  const key = cleanKey(value);
+  if (!looksLikeKey(key)) return null;
+  const byName = providerForEnvName(name);
+  if (byName) return { key, name, provider: byName, confident: true, candidates: [] };
+  // Unknown variable name: only accept keys whose format is unambiguous.
+  const d = detectProvider(key);
+  if (d.confident && providers[d.provider]) return { key, name, ...d };
+  return null;
+}

package/src/markdown.js

@@ -0,0 +1,133 @@
+// Minimal Markdown → HTML for the bundled docs (README-style subset).
+// All text is HTML-escaped first; only a fixed set of tags is ever emitted.
+
+const esc = (s) => s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+
+export const slugify = (s) =>
+  s.toLowerCase().replace(/<[^>]+>/g, "").replace(/&[a-z]+;/g, "").replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+
+// Map links between bundled docs onto in-app routes.
+const DOC_ROUTES = {
+  "PRIVACY.md": "#/docs/privacy",
+  "TERMS.md": "#/docs/terms",
+  "SECURITY.md": "#/docs/security",
+  "SUPPORT.md": "#/docs/support",
+  "CHANGELOG.md": "#/docs/changelog",
+  "LICENSE": "#/docs/license",
+  "docs/GUIDE.md": "#/docs/guide",
+  "GUIDE.md": "#/docs/guide",
+};
+
+function href(url) {
+  const [base, hash] = url.split("#");
+  const clean = base.replace(/^\.\.?\//, "");
+  if (DOC_ROUTES[clean]) return { url: DOC_ROUTES[clean] + (hash ? `#${hash}` : ""), external: false };
+  if (/^https?:\/\//i.test(url) || /^mailto:/i.test(url)) return { url, external: true };
+  if (url.startsWith("#")) return { url, external: false };
+  return null; // unknown relative link — render as text
+}
+
+function inline(text) {
+  const codes = [];
+  let s = text.replace(/`([^`]+)`/g, (_, c) => {
+    codes.push(`<code>${esc(c)}</code>`);
+    return `\u0000${codes.length - 1}\u0000`;
+  });
+  s = esc(s);
+  s = s.replace(/\[([^\]]+)\]\(([^)\s]+)\)/g, (_, label, url) => {
+    const target = href(url.replace(/&amp;/g, "&"));
+    if (!target) return label;
+    const ext = target.external ? ' target="_blank" rel="noopener noreferrer"' : "";
+    return `<a href="${esc(target.url)}"${ext}>${label}</a>`;
+  });
+  s = s.replace(/(^|[\s(])(https?:\/\/[^\s<)]+)/g, (_, pre, url) => `${pre}<a href="${url}" target="_blank" rel="noopener noreferrer">${url}</a>`);
+  s = s.replace(/\*\*([^*]+)\*\*/g, "<strong>$1</strong>");
+  s = s.replace(/(^|[\s(])_([^_]+)_(?=[\s).,;:]|$)/g, "$1<em>$2</em>");
+  s = s.replace(/(^|[\s(])\*([^*]+)\*(?=[\s).,;:]|$)/g, "$1<em>$2</em>");
+  return s.replace(/\u0000(\d+)\u0000/g, (_, i) => codes[i]);
+}
+
+export function renderMarkdown(src) {
+  const lines = String(src).replace(/\r\n?/g, "\n").split("\n");
+  const out = [];
+  const toc = [];
+  let i = 0;
+
+  const isBlockStart = (l) => /^(#{1,6}\s|```|>|\s*[-*]\s|\s*\d+\.\s|\|)/.test(l) || /^-{3,}\s*$/.test(l);
+
+  while (i < lines.length) {
+    const line = lines[i];
+
+    if (!line.trim()) {
+      i++;
+      continue;
+    }
+    if (line.startsWith("```")) {
+      const lang = line.slice(3).trim();
+      const buf = [];
+      i++;
+      while (i < lines.length && !lines[i].startsWith("```")) buf.push(lines[i++]);
+      i++;
+      out.push(`<pre><code${lang ? ` data-lang="${esc(lang)}"` : ""}>${esc(buf.join("\n"))}</code></pre>`);
+      continue;
+    }
+    const h = line.match(/^(#{1,6})\s+(.*)$/);
+    if (h) {
+      const level = h[1].length;
+      const html = inline(h[2].trim());
+      const id = slugify(html);
+      if (level === 2 || level === 3) toc.push({ level, id, text: html.replace(/<[^>]+>/g, "") });
+      out.push(`<h${level} id="${id}">${html}</h${level}>`);
+      i++;
+      continue;
+    }
+    if (/^-{3,}\s*$/.test(line)) {
+      out.push("<hr>");
+      i++;
+      continue;
+    }
+    if (line.startsWith(">")) {
+      const buf = [];
+      while (i < lines.length && lines[i].startsWith(">")) buf.push(lines[i++].replace(/^>\s?/, ""));
+      out.push(`<blockquote>${renderMarkdown(buf.join("\n")).html}</blockquote>`);
+      continue;
+    }
+    if (line.startsWith("|")) {
+      const rows = [];
+      while (i < lines.length && lines[i].startsWith("|")) rows.push(lines[i++]);
+      const cells = (r) => r.replace(/^\||\|\s*$/g, "").split("|").map((c) => c.trim());
+      const [head, sep, ...body] = rows;
+      if (sep && /^[\s|:-]+$/.test(sep)) {
+        out.push(
+          `<div class="table-wrap"><table><thead><tr>${cells(head).map((c) => `<th>${inline(c)}</th>`).join("")}</tr></thead>` +
+            `<tbody>${body.map((r) => `<tr>${cells(r).map((c) => `<td>${inline(c)}</td>`).join("")}</tr>`).join("")}</tbody></table></div>`,
+        );
+      } else {
+        out.push(`<p>${rows.map((r) => inline(r)).join("<br>")}</p>`);
+      }
+      continue;
+    }
+    const list = line.match(/^\s*([-*]|\d+\.)\s+/);
+    if (list) {
+      const ordered = /\d/.test(list[1]);
+      const items = [];
+      while (i < lines.length) {
+        const m = lines[i].match(/^\s*([-*]|\d+\.)\s+(.*)$/);
+        if (m) {
+          items.push(m[2]);
+          i++;
+        } else if (lines[i].trim() && /^\s{2,}/.test(lines[i]) && items.length) {
+          items[items.length - 1] += " " + lines[i++].trim();
+        } else break;
+      }
+      const tag = ordered ? "ol" : "ul";
+      out.push(`<${tag}>${items.map((t) => `<li>${inline(t)}</li>`).join("")}</${tag}>`);
+      continue;
+    }
+    const buf = [];
+    while (i < lines.length && lines[i].trim() && !isBlockStart(lines[i])) buf.push(lines[i++].trim());
+    if (!buf.length) buf.push(lines[i++].trim());
+    out.push(`<p>${inline(buf.join(" "))}</p>`);
+  }
+  return { html: out.join("\n"), toc };
+}

package/src/providers.js

@@ -0,0 +1,400 @@
+// Provider registry.
+//
+// Every provider is validated against a FREE endpoint — model listing,
+// account or balance. These authenticate the key and return metadata without
+// running inference, so a check never spends tokens or credits.
+//
+// Each endpoint here has been confirmed to REJECT a fake key (see
+// `npm run verify`). An endpoint that answers 200 without auth would report
+// every key as live, so public listing endpoints are never used.
+//
+// Provider shape:
+//   id, name, mark             display (plain monogram, never a logo)
+//   keyUrl                     where users create / manage keys
+//   env                        env var names that hold this provider's key
+//   pattern                    regex that uniquely identifies the key format
+//   loose                      regex that *might* be this provider (ambiguous)
+//   regions                    base URLs tried in order until one accepts the key
+//   request(key, base)         -> { url, method?, headers, body? }
+//   parse(body, headers)       -> { models?, balance?, account?, rateLimit? }
+//   acceptStatus               extra HTTP statuses that prove the key authenticated
+//   extra(key, ctx)            optional follow-up lookup (e.g. balance); failures ignored
+
+const bearer = (key) => ({ Authorization: `Bearer ${key}` });
+
+export function modelIds(list) {
+  if (!Array.isArray(list)) return [];
+  const ids = list
+    .map((m) => (typeof m === "string" ? m : m?.id ?? m?.name))
+    .filter((x) => typeof x === "string" && x)
+    .map((x) => x.replace(/^models\//, ""));
+  return [...new Set(ids)].sort((a, b) => a.localeCompare(b));
+}
+
+function rateLimit(headers) {
+  const req = headers?.get?.("x-ratelimit-remaining-requests");
+  const tok = headers?.get?.("x-ratelimit-remaining-tokens");
+  const parts = [];
+  if (req != null) parts.push(`${req} req`);
+  if (tok != null) parts.push(`${tok} tokens`);
+  return parts.length ? `${parts.join(" · ")} remaining` : null;
+}
+
+const money = (n, currency = "USD") => {
+  const v = Number(n);
+  if (!Number.isFinite(v)) return null;
+  const sym = { USD: "$", CNY: "¥", RMB: "¥" }[String(currency).toUpperCase()];
+  return sym ? `${sym}${v.toFixed(2)}` : `${v.toFixed(2)} ${currency}`;
+};
+
+// OpenAI-compatible `GET {base}/models`.
+function openAICompatible(path = "/models") {
+  return {
+    request: (key, base) => ({ url: base + path, headers: bearer(key) }),
+    parse: (body, headers) => ({
+      models: modelIds(Array.isArray(body) ? body : body?.data),
+      rateLimit: rateLimit(headers),
+    }),
+  };
+}
+
+const list = [
+  {
+    id: "openai",
+    name: "OpenAI",
+    mark: "OA",
+    keyUrl: "https://platform.openai.com/api-keys",
+    env: ["OPENAI_API_KEY", "OPENAI_KEY"],
+    pattern: /^sk-(proj|svcacct|admin)-[\w-]{20,}$/,
+    loose: /^sk-[A-Za-z0-9]{48}$/,
+    regions: ["https://api.openai.com/v1"],
+    ...openAICompatible(),
+  },
+  {
+    id: "anthropic",
+    name: "Anthropic",
+    mark: "An",
+    keyUrl: "https://console.anthropic.com/settings/keys",
+    env: ["ANTHROPIC_API_KEY", "CLAUDE_API_KEY"],
+    pattern: /^sk-ant-[\w-]{20,}$/,
+    regions: ["https://api.anthropic.com/v1"],
+    request: (key, base) => ({
+      url: `${base}/models?limit=1000`,
+      headers: { "x-api-key": key, "anthropic-version": "2023-06-01" },
+    }),
+    parse: (body) => ({ models: modelIds(body?.data) }),
+  },
+  {
+    id: "gemini",
+    name: "Google Gemini",
+    mark: "Ge",
+    keyUrl: "https://aistudio.google.com/app/apikey",
+    env: ["GEMINI_API_KEY", "GOOGLE_API_KEY", "GOOGLE_GENERATIVE_AI_API_KEY"],
+    pattern: /^AIza[\w-]{35}$/,
+    regions: ["https://generativelanguage.googleapis.com/v1beta"],
+    // Header auth keeps the key out of URLs (and any proxy logs).
+    request: (key, base) => ({
+      url: `${base}/models?pageSize=1000`,
+      headers: { "x-goog-api-key": key },
+    }),
+    parse: (body) => ({ models: modelIds(body?.models) }),
+  },
+  {
+    id: "groq",
+    name: "Groq",
+    mark: "Gq",
+    keyUrl: "https://console.groq.com/keys",
+    env: ["GROQ_API_KEY"],
+    pattern: /^gsk_\w{20,}$/,
+    regions: ["https://api.groq.com/openai/v1"],
+    ...openAICompatible(),
+  },
+  {
+    id: "mistral",
+    name: "Mistral",
+    mark: "Mi",
+    keyUrl: "https://console.mistral.ai/api-keys",
+    env: ["MISTRAL_API_KEY"],
+    regions: ["https://api.mistral.ai/v1"],
+    ...openAICompatible(),
+  },
+  {
+    id: "openrouter",
+    name: "OpenRouter",
+    mark: "OR",
+    keyUrl: "https://openrouter.ai/keys",
+    env: ["OPENROUTER_API_KEY"],
+    pattern: /^sk-or-[\w-]{20,}$/,
+    regions: ["https://openrouter.ai/api/v1"],
+    // /key reports usage + credit limit; /models is public so it can't validate.
+    request: (key, base) => ({ url: `${base}/key`, headers: bearer(key) }),
+    parse: (body) => {
+      const d = body?.data || {};
+      let balance = null;
+      if (d.limit_remaining != null) balance = `${money(d.limit_remaining)} / ${money(d.limit)}`;
+      else if (d.usage != null) balance = `${money(d.usage)} used · no limit`;
+      if (balance && d.is_free_tier) balance += " · free tier";
+      return { balance, account: d.label || null };
+    },
+  },
+  {
+    id: "deepseek",
+    name: "DeepSeek",
+    mark: "DS",
+    keyUrl: "https://platform.deepseek.com/api_keys",
+    env: ["DEEPSEEK_API_KEY"],
+    loose: /^sk-[a-f0-9]{32}$/,
+    regions: ["https://api.deepseek.com"],
+    request: (key, base) => ({ url: `${base}/user/balance`, headers: bearer(key) }),
+    parse: (body) => {
+      const info = (body?.balance_infos || [])[0];
+      if (info) return { balance: money(info.total_balance, info.currency) };
+      if (body?.is_available != null) return { balance: body.is_available ? "Balance available" : "No balance" };
+      return {};
+    },
+  },
+  {
+    id: "xai",
+    name: "xAI Grok",
+    mark: "xA",
+    keyUrl: "https://console.x.ai",
+    env: ["XAI_API_KEY", "GROK_API_KEY"],
+    pattern: /^xai-\w{20,}$/,
+    regions: ["https://api.x.ai/v1"],
+    ...openAICompatible(),
+  },
+  {
+    id: "together",
+    name: "Together AI",
+    mark: "To",
+    keyUrl: "https://api.together.ai/settings/api-keys",
+    env: ["TOGETHER_API_KEY", "TOGETHERAI_API_KEY"],
+    pattern: /^tgp_v1_[\w-]{20,}$/,
+    regions: ["https://api.together.xyz/v1"],
+    ...openAICompatible(),
+  },
+  {
+    id: "cohere",
+    name: "Cohere",
+    mark: "Co",
+    keyUrl: "https://dashboard.cohere.com/api-keys",
+    env: ["COHERE_API_KEY", "CO_API_KEY"],
+    regions: ["https://api.cohere.com/v1"],
+    request: (key, base) => ({ url: `${base}/models?page_size=1000`, headers: bearer(key) }),
+    parse: (body) => ({ models: modelIds(body?.models) }),
+  },
+  {
+    id: "kimi",
+    name: "Kimi (Moonshot)",
+    mark: "Ki",
+    keyUrl: "https://platform.moonshot.ai/console/api-keys",
+    env: ["MOONSHOT_API_KEY", "KIMI_API_KEY"],
+    loose: /^sk-\w{40,}$/,
+    regions: ["https://api.moonshot.ai/v1", "https://api.moonshot.cn/v1"],
+    ...openAICompatible(),
+    async extra(key, { base, get }) {
+      const res = await get(`${base}/users/me/balance`, bearer(key));
+      const d = res.body?.data;
+      if (d?.available_balance == null) return {};
+      const cur = base.includes(".cn") ? "CNY" : "USD";
+      return { balance: money(d.available_balance, cur) };
+    },
+  },
+  {
+    id: "qwen",
+    name: "Qwen (DashScope)",
+    mark: "Qw",
+    keyUrl: "https://bailian.console.alibabacloud.com/?apiKey=1",
+    env: ["DASHSCOPE_API_KEY", "QWEN_API_KEY"],
+    loose: /^sk-[a-f0-9]{32}$/,
+    regions: [
+      "https://dashscope-intl.aliyuncs.com/compatible-mode/v1",
+      "https://dashscope.aliyuncs.com/compatible-mode/v1",
+    ],
+    ...openAICompatible(),
+  },
+  {
+    id: "glm",
+    name: "GLM (Zhipu / Z.ai)",
+    mark: "GL",
+    keyUrl: "https://z.ai/manage-apikey/apikey-list",
+    env: ["ZHIPUAI_API_KEY", "ZAI_API_KEY", "GLM_API_KEY"],
+    pattern: /^[a-f0-9]{32}\.[A-Za-z0-9]{16}$/,
+    regions: ["https://api.z.ai/api/paas/v4", "https://open.bigmodel.cn/api/paas/v4"],
+    ...openAICompatible(),
+  },
+  {
+    id: "siliconflow",
+    name: "SiliconFlow",
+    mark: "SF",
+    keyUrl: "https://cloud.siliconflow.com/account/ak",
+    env: ["SILICONFLOW_API_KEY", "SILICON_FLOW_API_KEY"],
+    loose: /^sk-[a-z]{40,}$/,
+    regions: ["https://api.siliconflow.com/v1", "https://api.siliconflow.cn/v1"],
+    ...openAICompatible(),
+    async extra(key, { base, get }) {
+      const res = await get(`${base}/user/info`, bearer(key));
+      const d = res.body?.data;
+      if (d?.totalBalance == null) return {};
+      const cur = base.includes(".cn") ? "CNY" : "USD";
+      return { balance: money(d.totalBalance, cur), account: d.name || d.email || null };
+    },
+  },
+  {
+    id: "perplexity",
+    name: "Perplexity",
+    mark: "Px",
+    keyUrl: "https://www.perplexity.ai/settings/api",
+    env: ["PERPLEXITY_API_KEY", "PPLX_API_KEY"],
+    pattern: /^pplx-\w{20,}$/,
+    regions: ["https://api.perplexity.ai/v1"],
+    ...openAICompatible(),
+  },
+  {
+    id: "cerebras",
+    name: "Cerebras",
+    mark: "Ce",
+    keyUrl: "https://cloud.cerebras.ai",
+    env: ["CEREBRAS_API_KEY"],
+    pattern: /^csk-\w{20,}$/,
+    regions: ["https://api.cerebras.ai/v1"],
+    ...openAICompatible(),
+  },
+  {
+    id: "fireworks",
+    name: "Fireworks AI",
+    mark: "Fw",
+    keyUrl: "https://fireworks.ai/account/api-keys",
+    env: ["FIREWORKS_API_KEY"],
+    pattern: /^fw_\w{20,}$/,
+    regions: ["https://api.fireworks.ai/inference/v1"],
+    ...openAICompatible(),
+  },
+  {
+    id: "sambanova",
+    name: "SambaNova",
+    mark: "Sa",
+    keyUrl: "https://cloud.sambanova.ai/apis",
+    env: ["SAMBANOVA_API_KEY"],
+    regions: ["https://api.sambanova.ai/v1"],
+    // SambaNova's /models is public, so it can't prove anything. Instead we
+    // send an embeddings request with no input: a bad key gets 401, a good key
+    // gets a validation error. Nothing is ever computed or billed.
+    request: (key, base) => ({
+      url: `${base}/embeddings`,
+      method: "POST",
+      headers: { ...bearer(key), "Content-Type": "application/json" },
+      body: JSON.stringify({ model: "E5-Mistral-7B-Instruct" }),
+    }),
+    acceptStatus: [400, 422],
+    parse: () => ({}),
+  },
+  {
+    id: "huggingface",
+    name: "Hugging Face",
+    mark: "HF",
+    keyUrl: "https://huggingface.co/settings/tokens",
+    env: ["HF_TOKEN", "HUGGINGFACE_API_KEY", "HUGGING_FACE_HUB_TOKEN", "HUGGINGFACEHUB_API_TOKEN"],
+    pattern: /^hf_\w{20,}$/,
+    regions: ["https://huggingface.co/api"],
+    request: (key, base) => ({ url: `${base}/whoami-v2`, headers: bearer(key) }),
+    parse: (body) => {
+      const role = body?.auth?.accessToken?.role;
+      return { account: [body?.name, role && `${role} token`].filter(Boolean).join(" · ") || null };
+    },
+  },
+  {
+    id: "replicate",
+    name: "Replicate",
+    mark: "Re",
+    keyUrl: "https://replicate.com/account/api-tokens",
+    env: ["REPLICATE_API_TOKEN", "REPLICATE_API_KEY"],
+    pattern: /^r8_\w{20,}$/,
+    regions: ["https://api.replicate.com/v1"],
+    request: (key, base) => ({ url: `${base}/account`, headers: bearer(key) }),
+    parse: (body) => ({
+      account: [body?.username, body?.type].filter(Boolean).join(" · ") || null,
+    }),
+  },
+  {
+    id: "novita",
+    name: "Novita AI",
+    mark: "No",
+    keyUrl: "https://novita.ai/settings/key-management",
+    env: ["NOVITA_API_KEY"],
+    regions: ["https://api.novita.ai"],
+    // Novita's /models is public. The billing endpoint requires auth and is
+    // free. Amounts are in 1/10000 USD.
+    request: (key, base) => ({
+      url: `${base}/openapi/v1/billing/balance/detail`,
+      headers: bearer(key),
+    }),
+    parse: (body) =>
+      body?.availableBalance != null
+        ? { balance: money(Number(body.availableBalance) / 10000) }
+        : {},
+  },
+  {
+    id: "deepinfra",
+    name: "DeepInfra",
+    mark: "DI",
+    keyUrl: "https://deepinfra.com/dash/api_keys",
+    env: ["DEEPINFRA_API_KEY", "DEEPINFRA_TOKEN"],
+    regions: ["https://api.deepinfra.com/v1/openai"],
+    ...openAICompatible(),
+  },
+  {
+    id: "hyperbolic",
+    name: "Hyperbolic",
+    mark: "Hy",
+    keyUrl: "https://app.hyperbolic.xyz/settings",
+    env: ["HYPERBOLIC_API_KEY"],
+    regions: ["https://api.hyperbolic.xyz/v1"],
+    ...openAICompatible(),
+  },
+  {
+    id: "nebius",
+    name: "Nebius AI Studio",
+    mark: "Nb",
+    keyUrl: "https://studio.nebius.com/settings/api-keys",
+    env: ["NEBIUS_API_KEY"],
+    regions: ["https://api.studio.nebius.com/v1"],
+    ...openAICompatible(),
+  },
+];
+
+export const providers = Object.fromEntries(list.map((p) => [p.id, p]));
+export const providerList = list;
+
+// Public, serialisable view for the UI / `apilive providers`.
+export function describeProviders() {
+  return list.map((p) => ({
+    id: p.id,
+    name: p.name,
+    mark: p.mark,
+    keyUrl: p.keyUrl,
+    env: p.env,
+    pattern: p.pattern?.source ?? null,
+    loose: p.loose?.source ?? null,
+    balance: Boolean(p.extra) || ["openrouter", "deepseek", "novita"].includes(p.id),
+  }));
+}
+
+const envIndex = new Map(list.flatMap((p) => p.env.map((name) => [name, p.id])));
+
+// Work out which provider a key belongs to.
+// Returns { provider: id|null, confident: boolean, candidates: id[] }.
+export function detectProvider(key, envName) {
+  if (envName && envIndex.has(envName)) {
+    return { provider: envIndex.get(envName), confident: true, candidates: [] };
+  }
+  const exact = list.find((p) => p.pattern?.test(key));
+  if (exact) return { provider: exact.id, confident: true, candidates: [] };
+
+  const candidates = list.filter((p) => p.loose?.test(key)).map((p) => p.id);
+  return { provider: candidates[0] ?? null, confident: false, candidates };
+}
+
+export function providerForEnvName(name) {
+  return envIndex.get(name) ?? null;
+}