blackriver-gateway 3.8.46

package/src/lib/providers/validation/openaiFormat.ts

@@ -0,0 +1,500 @@
+// OpenAI/Gemini-format + Bedrock provider key validators (bedrock, openai-like, command-code, gemini-like, openai-compatible).
+// Extracted from validation.ts (god-file decomposition) — top-level functions; behavior is
+// byte-identical to the original inline defs.
+import { randomUUID } from "node:crypto";
+import { getRegistryEntry } from "@omniroute/open-sse/config/providerRegistry.ts";
+import {
+  discoverBedrockNativeModels,
+  isBedrockNativeApiError,
+  isBedrockNativeAuthError,
+} from "@omniroute/open-sse/services/bedrock.ts";
+import { addModelsSuffix, normalizeBaseUrl, resolveChatUrl } from "./urlHelpers";
+import { applyCustomUserAgent, buildBearerHeaders } from "./headers";
+import { toValidationErrorResult, validationRead, validationWrite } from "./transport";
+import { validateDirectChatProvider } from "./directChatProbe";
+import { extractCozeValidationError } from "./cozeError";
+
+export async function validateBedrockProvider({ apiKey, providerSpecificData = {} }: any) {
+  if (!apiKey) {
+    return { valid: false, error: "Provider and API key required" };
+  }
+
+  try {
+    const discovery = await discoverBedrockNativeModels({
+      apiKey,
+      providerSpecificData,
+      fetcher: (url, init) => validationRead(url, init),
+    });
+    return {
+      valid: true,
+      error: null,
+      method: "bedrock_native_models",
+      warning: discovery.warnings[0] || null,
+    };
+  } catch (error: any) {
+    if (isBedrockNativeAuthError(error)) {
+      return { valid: false, error: "Invalid API key" };
+    }
+    if (isBedrockNativeApiError(error)) {
+      if (error.status === 429) {
+        return {
+          valid: true,
+          error: null,
+          warning: "Bedrock accepted the key but model discovery is rate limited",
+          method: "bedrock_native_models",
+        };
+      }
+      if (typeof error.status === "number" && error.status >= 500) {
+        return { valid: false, error: `Provider unavailable (${error.status})` };
+      }
+      if (typeof error.status === "number") {
+        return { valid: false, error: `Bedrock validation failed: ${error.status}` };
+      }
+    }
+    return toValidationErrorResult(error);
+  }
+}
+
+export async function validateOpenAILikeProvider({
+  provider = "openai",
+  apiKey,
+  baseUrl,
+  headers = {},
+  modelId = "gpt-3.5-turbo",
+  providerSpecificData,
+  modelsUrl = "",
+  isLocal = false,
+}: any) {
+  try {
+    // Guard against a non-string modelsUrl reaching .trim()/.startsWith() — a malformed
+    // providerSpecificData / registry value would otherwise throw a TypeError mid-validation
+    // ("trim is not a function" / "startsWith is not a function"). See #2463 class.
+    const customModelsUrl = (typeof modelsUrl === "string" ? modelsUrl.trim() : "") || "";
+    const endpointUrl = customModelsUrl
+      ? customModelsUrl.startsWith("http")
+        ? customModelsUrl
+        : `${baseUrl.replace(/\/+$/, "")}/${customModelsUrl.replace(/^\/+/, "")}`
+      : // addModelsSuffix strips a trailing /chat/completions before appending /models,
+        // so an OpenAI-style baseUrl validates against /v1/models, not /v1/chat/completions/models.
+        addModelsSuffix(baseUrl);
+
+    const requestUrl =
+      typeof providerSpecificData?.modelsUrl === "string" &&
+      providerSpecificData.modelsUrl.trim() !== ""
+        ? providerSpecificData.modelsUrl.trim()
+        : endpointUrl;
+
+    const response = await validationRead(
+      requestUrl,
+      {
+        headers: {
+          ...headers,
+          ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
+        },
+      },
+      isLocal
+    );
+
+    if (response.ok) {
+      return { valid: true, error: null };
+    }
+
+    if (response.status === 401) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    // #2929: A 403 on the models endpoint is not always a bad key. Some providers
+    // (e.g. Fireworks Fire Pass `fpk_*` keys) return "...not authorized for this
+    // route." on /models while still serving chat. Fall through to the chat probe
+    // for such route-restriction 403s instead of declaring the key invalid.
+    if (response.status === 403) {
+      const forbiddenBody = await response.text().catch(() => "");
+      if (!/not authorized for this route/i.test(forbiddenBody)) {
+        return { valid: false, error: "Invalid API key" };
+      }
+    }
+
+    const chatUrl = resolveChatUrl(provider, baseUrl, providerSpecificData);
+    if (!chatUrl) {
+      return { valid: false, error: `Validation failed: ${response.status}` };
+    }
+
+    const testModelId = (providerSpecificData as any)?.validationModelId || modelId;
+
+    const testBody = {
+      model: testModelId,
+      messages: [{ role: "user", content: "test" }],
+      max_tokens: 1,
+    };
+
+    const chatRes = await validationWrite(
+      chatUrl,
+      {
+        method: "POST",
+        headers: {
+          ...headers,
+          ...(apiKey ? { Authorization: `Bearer ${apiKey}` } : {}),
+        },
+        body: JSON.stringify(testBody),
+      },
+      isLocal
+    );
+
+    if (chatRes.ok) {
+      return { valid: true, error: null };
+    }
+
+    // #5426: Coze answers the chat probe with a JSON envelope ({ code, msg,
+    // logId, from }) on a bad key. Translate it into a friendly message so the
+    // raw envelope (logId included) never leaks into the connection UI. Scoped
+    // to provider === "coze" so a non-Coze error body that happens to carry a
+    // `msg` field is never mislabeled, and other providers' response bodies are
+    // never consumed here — they fall through to the canned handling below.
+    if (provider === "coze") {
+      const chatErrorBody = await chatRes.text().catch(() => "");
+      const cozeError = extractCozeValidationError(chatErrorBody);
+      if (cozeError) {
+        return { valid: false, error: cozeError };
+      }
+    }
+
+    if (chatRes.status === 401 || chatRes.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (chatRes.status === 404 || chatRes.status === 405) {
+      return { valid: false, error: "Provider validation endpoint not supported" };
+    }
+
+    if (chatRes.status >= 500) {
+      return { valid: false, error: `Provider unavailable (${chatRes.status})` };
+    }
+
+    return { valid: true, error: null };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+export async function validateCommandCodeProvider({ apiKey, providerSpecificData = {} }: any) {
+  const entry = getRegistryEntry("command-code");
+  const baseUrl = normalizeBaseUrl(entry?.baseUrl || "https://api.commandcode.ai");
+  const chatPath = entry?.chatPath || "/alpha/generate";
+  const url = `${baseUrl}${chatPath.startsWith("/") ? chatPath : `/${chatPath}`}`;
+  const validationModelId =
+    providerSpecificData?.validationModelId ||
+    entry?.models?.find((model) => model.id === "deepseek/deepseek-v4-flash")?.id ||
+    "deepseek/deepseek-v4-flash";
+  const { COMMAND_CODE_VERSION } = await import("@omniroute/open-sse/executors/commandCode.ts");
+
+  return validateDirectChatProvider({
+    url,
+    providerSpecificData,
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${apiKey}`,
+      "x-command-code-version": COMMAND_CODE_VERSION,
+      "x-cli-environment": "external",
+      "x-project-slug": "pi-cc",
+      "x-taste-learning": "false",
+      "x-co-flag": "false",
+      "x-session-id": randomUUID(),
+    },
+    body: {
+      config: {
+        workingDir: "/workspace",
+        date: new Date().toISOString().slice(0, 10),
+        environment: "external",
+        structure: [],
+        isGitRepo: false,
+        currentBranch: "",
+        mainBranch: "",
+        gitStatus: "",
+        recentCommits: [],
+      },
+      memory: "",
+      taste: "",
+      skills: "",
+      permissionMode: "standard",
+      params: {
+        model: validationModelId,
+        messages: [{ role: "user", content: "test" }],
+        tools: [],
+        system: "",
+        max_tokens: 1,
+        stream: true,
+      },
+    },
+  });
+}
+
+// HuggingFace fine-grained Inference-Provider tokens are valid even when
+// model/task endpoints reject them, so the generic OpenAI-like probe against
+// router.huggingface.co/v1/models falsely marks them invalid. Validate the
+// token strictly as an auth check via the whoami-v2 endpoint instead: only
+// 401/403 means the token is invalid; any other non-OK status is a transient
+// upstream failure, NOT an invalid key.
+export async function validateHuggingFaceProvider({ apiKey }: any) {
+  try {
+    const response = await validationRead("https://huggingface.co/api/whoami-v2", {
+      method: "GET",
+      headers: { Authorization: `Bearer ${apiKey}` },
+    });
+
+    if (response.ok) {
+      return { valid: true, error: null, method: "huggingface_whoami" };
+    }
+
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    // Non-auth, non-OK status — surface as a transient upstream failure rather
+    // than declaring the (potentially valid) fine-grained token invalid.
+    return { valid: false, error: `HuggingFace token check returned ${response.status}` };
+  } catch (error: unknown) {
+    return toValidationErrorResult(error);
+  }
+}
+
+export async function validateGeminiLikeProvider({
+  apiKey,
+  baseUrl,
+  providerSpecificData = {},
+  authType = "query",
+  isLocal = false,
+}: any) {
+  try {
+    if (!baseUrl) {
+      return { valid: false, error: "Missing base URL" };
+    }
+
+    const normalizedAuthType = String(authType || "query").toLowerCase();
+    // Strip a trailing /models before appending — the default Gemini registry baseUrl is
+    // `.../v1beta/models` (for the chat urlBuilder), so naively appending /models produced
+    // `.../v1beta/models/models` → upstream 404 on connection validation (#2545).
+    const baseForModels = String(baseUrl)
+      .replace(/\/models\/?$/, "")
+      .replace(/\/$/, "");
+    const requestUrl =
+      typeof providerSpecificData?.modelsUrl === "string" &&
+      providerSpecificData.modelsUrl.trim() !== ""
+        ? providerSpecificData.modelsUrl.trim()
+        : `${baseForModels}/models`;
+
+    // Use the correct auth header based on provider config:
+    // - gemini (API key): x-goog-api-key
+    // - Google OAuth access tokens (ya29.*): Bearer token
+    const headers: Record<string, string> = {};
+    let urlWithKey = requestUrl;
+
+    if (typeof apiKey === "string" && apiKey.startsWith("ya29.")) {
+      // A Google OAuth access token (ya29.*) must use Bearer auth even when the
+      // connection is configured as an API-key provider. Checked first so authType
+      // "apikey"/"header" doesn't shadow it with x-goog-api-key.
+      headers["Authorization"] = `Bearer ${apiKey}`;
+    } else if (normalizedAuthType === "header" || normalizedAuthType === "apikey") {
+      headers["x-goog-api-key"] = apiKey;
+    } else if (normalizedAuthType === "oauth" || normalizedAuthType === "bearer") {
+      headers["Authorization"] = `Bearer ${apiKey}`;
+    } else if (normalizedAuthType === "query") {
+      urlWithKey = `${requestUrl}?key=${encodeURIComponent(apiKey)}`;
+    }
+
+    applyCustomUserAgent(headers, providerSpecificData);
+
+    const response = await validationRead(
+      urlWithKey,
+      {
+        headers,
+      },
+      isLocal
+    );
+
+    if (response.ok) {
+      return { valid: true, error: null };
+    }
+
+    if (response.status === 429) {
+      return { valid: true, error: null };
+    }
+
+    if (response.status === 400 || response.status === 401 || response.status === 403) {
+      const isAuthError = (body: any) => {
+        const message = (body?.error?.message || "").toLowerCase();
+        const reason = body?.error?.details?.[0]?.reason || "";
+        const status = body?.error?.status || "";
+        const authPatterns = [
+          "api key not valid",
+          "api key expired",
+          "api key invalid",
+          "API_KEY_INVALID",
+          "API_KEY_EXPIRED",
+          "PERMISSION_DENIED",
+          "UNAUTHENTICATED",
+        ];
+        return authPatterns.some(
+          (p) => message.includes(p.toLowerCase()) || reason === p || status === p
+        );
+      };
+
+      try {
+        const body = await response.json();
+        if (isAuthError(body)) {
+          return { valid: false, error: "Invalid API key" };
+        }
+        if (response.status === 401 || response.status === 403) {
+          return { valid: false, error: "Invalid API key" };
+        }
+      } catch {
+        if (response.status === 401 || response.status === 403) {
+          return { valid: false, error: "Invalid API key" };
+        }
+        return { valid: false, error: "Invalid API key" };
+      }
+    }
+
+    return { valid: false, error: `Validation failed: ${response.status}` };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+// ── Specialty providers (non-standard APIs) ──
+
+export async function validateOpenAICompatibleProvider({ apiKey, providerSpecificData = {} }: any) {
+  const baseUrl = normalizeBaseUrl(providerSpecificData.baseUrl);
+  if (!baseUrl) {
+    return { valid: false, error: "No base URL configured for OpenAI compatible provider" };
+  }
+
+  const validationModelId =
+    typeof providerSpecificData?.validationModelId === "string"
+      ? providerSpecificData.validationModelId.trim()
+      : "";
+
+  // Step 1: Try GET /models
+  let modelsReachable = false;
+  try {
+    const modelsRes = await validationRead(`${baseUrl}/models`, {
+      method: "GET",
+      headers: buildBearerHeaders(apiKey, providerSpecificData),
+    });
+
+    modelsReachable = true;
+
+    if (modelsRes.ok) {
+      return { valid: true, error: null, method: "models_endpoint" };
+    }
+
+    if (modelsRes.status === 401 || modelsRes.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    // Endpoint responded and auth seems valid, but quota is exhausted/rate-limited.
+    if (modelsRes.status === 429) {
+      return {
+        valid: true,
+        error: null,
+        method: "models_endpoint",
+        warning: "Rate limited, but credentials are valid",
+      };
+    }
+  } catch {
+    // /models fetch failed (network error, etc.) — fall through to chat test
+  }
+
+  // T25: if /models cannot be used and no custom model was provided, return a
+  // clear actionable message instead of a generic connection error.
+  if (!validationModelId) {
+    return {
+      valid: false,
+      error: "Endpoint /models unavailable. Provide a Model ID to validate via /chat/completions.",
+    };
+  }
+
+  // Step 2: Fallback — try a minimal chat completion request
+  // Many providers don't expose /models but accept chat completions fine
+  const apiType = providerSpecificData.apiType || "chat";
+  const chatSuffix = apiType === "responses" ? "/responses" : "/chat/completions";
+  const chatUrl = `${baseUrl}${chatSuffix}`;
+  const testModelId = validationModelId;
+
+  try {
+    const chatRes = await validationWrite(chatUrl, {
+      method: "POST",
+      headers: buildBearerHeaders(apiKey, providerSpecificData),
+      body: JSON.stringify({
+        model: testModelId,
+        messages: [{ role: "user", content: "test" }],
+        max_tokens: 1,
+      }),
+    });
+
+    if (chatRes.ok) {
+      return { valid: true, error: null, method: "chat_completions" };
+    }
+
+    if (chatRes.status === 401 || chatRes.status === 403) {
+      return { valid: false, error: "Invalid API key" };
+    }
+
+    if (chatRes.status === 429) {
+      return {
+        valid: true,
+        error: null,
+        method: "chat_completions",
+        warning: "Rate limited, but credentials are valid",
+      };
+    }
+
+    // If /models was reachable but returned non-auth error, and chat succeeds
+    // auth-wise, this still confirms credentials are valid.
+    if (chatRes.status === 400) {
+      return {
+        valid: true,
+        error: null,
+        method: "inference_available",
+        warning: "Model ID may be invalid, but credentials are valid",
+      };
+    }
+
+    // 4xx other than auth (e.g. 400 bad model, 422) usually means auth passed
+    if (chatRes.status >= 400 && chatRes.status < 500) {
+      return {
+        valid: true,
+        error: null,
+        method: "inference_available",
+      };
+    }
+
+    if (chatRes.status >= 500) {
+      return { valid: false, error: `Provider unavailable (${chatRes.status})` };
+    }
+  } catch {
+    // Chat test also failed — fall through to simple connectivity check
+  }
+
+  // Step 3: Final fallback — simple connectivity check
+  // For local providers (Ollama, LM Studio, etc.) that may not respond to
+  // standard OpenAI endpoints but are still reachable
+  if (!modelsReachable) {
+    return { valid: false, error: "Connection failed while testing /chat/completions" };
+  }
+
+  try {
+    const pingRes = await validationRead(baseUrl, {
+      method: "GET",
+      headers: buildBearerHeaders(apiKey, providerSpecificData),
+    });
+
+    // If the server responds at all (even with an error page), it's reachable
+    if (pingRes.status < 500) {
+      return { valid: true, error: null };
+    }
+
+    return { valid: false, error: `Provider unavailable (${pingRes.status})` };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}

package/src/lib/providers/validation/searchProviders.ts

@@ -0,0 +1,199 @@
+// Web-search provider key validators + their per-provider request configs (serper, tavily, jina-reader,
+// …). Extracted from validation.ts (god-file decomposition) — top-level functions/data with no
+// dispatcher-state captures; behavior is byte-identical to the original inline defs.
+import { SAFE_OUTBOUND_FETCH_PRESETS, safeOutboundFetch } from "@/shared/network/safeOutboundFetch";
+import { getProviderOutboundGuard } from "@/shared/network/outboundUrlGuard";
+import { withCustomUserAgent } from "./headers";
+import { toValidationErrorResult, validationWrite } from "./transport";
+
+export async function validateSearchProvider(
+  url: string,
+  init: RequestInit,
+  providerSpecificData: any = {},
+  isLocal: boolean = false
+): Promise<{ valid: boolean; error: string | null; unsupported: false }> {
+  try {
+    const response = await safeOutboundFetch(url, {
+      ...SAFE_OUTBOUND_FETCH_PRESETS.validationWrite,
+      guard: isLocal ? "none" : getProviderOutboundGuard(),
+      ...withCustomUserAgent(init, providerSpecificData),
+    });
+    if (response.ok) return { valid: true, error: null, unsupported: false };
+    if (response.status === 401 || response.status === 403) {
+      return { valid: false, error: "Invalid API key", unsupported: false };
+    }
+    // For provider setup we only need to confirm authentication passed.
+    // Search providers may return non-auth statuses for exhausted credits,
+    // rate limiting, or request-shape quirks while still accepting the key.
+    if (response.status < 500) {
+      return { valid: true, error: null, unsupported: false };
+    }
+    return { valid: false, error: `Validation failed: ${response.status}`, unsupported: false };
+  } catch (error: any) {
+    return toValidationErrorResult(error);
+  }
+}
+
+export const SEARCH_VALIDATOR_CONFIGS: Record<
+  string,
+  (apiKey: string, providerSpecificData?: any) => { url: string; init: RequestInit }
+> = {
+  "serper-search": (apiKey) => ({
+    url: "https://google.serper.dev/search",
+    init: {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-API-Key": apiKey },
+      body: JSON.stringify({ q: "test", num: 1 }),
+    },
+  }),
+  "brave-search": (apiKey) => ({
+    url: "https://api.search.brave.com/res/v1/web/search?q=test&count=1",
+    init: {
+      method: "GET",
+      headers: { Accept: "application/json", "X-Subscription-Token": apiKey },
+    },
+  }),
+  "perplexity-search": (apiKey) => ({
+    url: "https://api.perplexity.ai/search",
+    init: {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+      body: JSON.stringify({ query: "test", max_results: 1 }),
+    },
+  }),
+  "exa-search": (apiKey) => ({
+    url: "https://api.exa.ai/search",
+    init: {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "x-api-key": apiKey },
+      body: JSON.stringify({ query: "test", numResults: 1 }),
+    },
+  }),
+  "tavily-search": (apiKey) => ({
+    url: "https://api.tavily.com/search",
+    init: {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+      body: JSON.stringify({ query: "test", max_results: 1 }),
+    },
+  }),
+  "google-pse-search": (apiKey, providerSpecificData = {}) => {
+    const cx = providerSpecificData?.cx;
+    if (!cx || typeof cx !== "string") {
+      throw new Error("Programmable Search Engine ID (cx) is required");
+    }
+    return {
+      url: `https://www.googleapis.com/customsearch/v1?key=${encodeURIComponent(apiKey)}&cx=${encodeURIComponent(
+        cx
+      )}&q=test&num=1`,
+      init: {
+        method: "GET",
+        headers: { Accept: "application/json" },
+      },
+    };
+  },
+  "linkup-search": (apiKey) => ({
+    url: "https://api.linkup.so/v1/search",
+    init: {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+      body: JSON.stringify({
+        q: "test",
+        depth: "standard",
+        outputType: "searchResults",
+        maxResults: 1,
+      }),
+    },
+  }),
+  "searchapi-search": (apiKey) => ({
+    url: `https://www.searchapi.io/api/v1/search?engine=google&q=test&api_key=${encodeURIComponent(
+      apiKey
+    )}`,
+    init: {
+      method: "GET",
+      headers: { Accept: "application/json" },
+    },
+  }),
+  "youcom-search": (apiKey) => ({
+    url: "https://ydc-index.io/v1/search?query=test&count=1",
+    init: {
+      method: "GET",
+      headers: { Accept: "application/json", "X-API-Key": apiKey },
+    },
+  }),
+  "searxng-search": (apiKey, providerSpecificData = {}) => {
+    const baseUrl =
+      typeof providerSpecificData?.baseUrl === "string" && providerSpecificData.baseUrl.trim()
+        ? providerSpecificData.baseUrl.trim().replace(/\/+$/, "")
+        : "http://localhost:8888/search";
+    const searchUrl = baseUrl.endsWith("/search") ? baseUrl : `${baseUrl}/search`;
+    const headers: Record<string, string> = { Accept: "application/json" };
+    if (apiKey) {
+      headers["Authorization"] = `Bearer ${apiKey}`;
+    }
+    return {
+      url: `${searchUrl}?q=test&format=json`,
+      init: {
+        method: "GET",
+        headers,
+      },
+    };
+  },
+  "ollama-search": (apiKey) => ({
+    url: "https://ollama.com/api/web_search",
+    init: {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+      body: JSON.stringify({ query: "test", max_results: 1 }),
+    },
+  }),
+  "zai-search": (apiKey, providerSpecificData = {}) => {
+    const baseUrl =
+      typeof providerSpecificData?.baseUrl === "string" && providerSpecificData.baseUrl.trim()
+        ? providerSpecificData.baseUrl.trim().replace(/\/+$/, "")
+        : "https://api.z.ai/api/mcp/web_search_prime/mcp";
+    return {
+      url: baseUrl,
+      init: {
+        method: "POST",
+        headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+        body: JSON.stringify({
+          jsonrpc: "2.0",
+          method: "tools/call",
+          params: { name: "web_search_prime", arguments: { search_query: "test" } },
+          id: 1,
+        }),
+      },
+    };
+  },
+  // ── Web-fetch providers (#4401) ──
+  // firecrawl / jina-reader were added as webFetch-kind providers in #2645 with their
+  // own executors but no validator, so the dashboard "Validate" step returned
+  // "Provider validation not supported" and accounts could not be added through the UI.
+  // Probe each provider's real fetch endpoint with the same Bearer auth the executor
+  // uses; validateSearchProvider maps 200/<500 → valid, 401/403 → invalid key,
+  // >=500 → failure (a credit-exhausted / rate-limited key still validates).
+  firecrawl: (apiKey) => ({
+    url: "https://api.firecrawl.dev/v1/scrape",
+    init: {
+      method: "POST",
+      headers: { "Content-Type": "application/json", Authorization: `Bearer ${apiKey}` },
+      body: JSON.stringify({ url: "https://example.com", formats: ["markdown"] }),
+    },
+  }),
+  "jina-reader": (apiKey) => ({
+    url: "https://r.jina.ai/https://example.com",
+    init: {
+      method: "GET",
+      headers: { Authorization: `Bearer ${apiKey}` },
+    },
+  }),
+  tinyfish: (apiKey) => ({
+    url: "https://api.fetch.tinyfish.ai",
+    init: {
+      method: "POST",
+      headers: { "Content-Type": "application/json", "X-API-Key": apiKey },
+      body: JSON.stringify({ urls: ["https://example.com"], format: "markdown" }),
+    },
+  }),
+};