jishushell 0.4.30 → 0.5.22

package/dist/services/llm-proxy/validate-key.js

@@ -0,0 +1,672 @@
+/**
+ * src/services/llm-proxy/validate-key.ts
+ *
+ * Protocol-aware API key validation. Dispatches different probe strategies
+ * based on the normalized `api` field to correctly validate keys for each
+ * provider family (OpenAI-compat, Anthropic native/gateway, Google, Ollama).
+ *
+ * Returns a structured response so the frontend can distinguish between
+ * "key wrong" (401), "endpoint unsupported" (404), and "network error".
+ *
+ * SECURITY: This module must NEVER log the apiKey parameter in any form.
+ */
+import { LEGACY_PROVIDER_API_ALIASES } from "../../constants.js";
+import { validateUpstreamUrl } from "./ssrf.js";
+import { LOCAL_PROVIDER_IDS } from "./ssrf.js";
+// ── Rate Limiter (10 req/min per IP) ───────────────────────────────────────
+const VALIDATE_RATE_LIMIT_WINDOW_MS = 60_000;
+const VALIDATE_RATE_LIMIT_MAX = 10;
+const MAX_VALIDATE_BUCKETS = 5_000;
+const validateBuckets = new Map();
+export function checkValidateRateLimit(ip) {
+    const now = Date.now();
+    let bucket = validateBuckets.get(ip);
+    if (!bucket || now - bucket.windowStart > VALIDATE_RATE_LIMIT_WINDOW_MS) {
+        if (!validateBuckets.has(ip) && validateBuckets.size >= MAX_VALIDATE_BUCKETS) {
+            let evictKey;
+            for (const [k, v] of validateBuckets) {
+                if (now - v.windowStart > VALIDATE_RATE_LIMIT_WINDOW_MS) {
+                    evictKey = k;
+                    break;
+                }
+            }
+            if (evictKey === undefined)
+                evictKey = validateBuckets.keys().next().value;
+            if (evictKey !== undefined)
+                validateBuckets.delete(evictKey);
+        }
+        bucket = { count: 0, windowStart: now };
+        validateBuckets.set(ip, bucket);
+    }
+    if (bucket.count >= VALIDATE_RATE_LIMIT_MAX)
+        return false;
+    bucket.count++;
+    return true;
+}
+// Periodic cleanup
+setInterval(() => {
+    const now = Date.now();
+    for (const [ip, bucket] of validateBuckets) {
+        if (now - bucket.windowStart > VALIDATE_RATE_LIMIT_WINDOW_MS * 2) {
+            validateBuckets.delete(ip);
+        }
+    }
+}, VALIDATE_RATE_LIMIT_WINDOW_MS * 2).unref();
+// ── Internal helpers ───────────────────────────────────────────────────────
+const FETCH_TIMEOUT_MS = 15_000;
+/** Maximum response body size we'll read (1 MB). Prevents OOM from malicious servers. */
+const MAX_RESPONSE_BYTES = 1_024 * 1_024;
+/**
+ * Read response as JSON with a body size limit to prevent OOM attacks.
+ * Returns null if body exceeds limit, is not JSON, or fails to parse.
+ */
+async function safeReadJson(resp) {
+    const contentLength = resp.headers.get("content-length");
+    if (contentLength && parseInt(contentLength, 10) > MAX_RESPONSE_BYTES) {
+        try {
+            await resp.body?.cancel();
+        }
+        catch { /* ignore */ }
+        return null;
+    }
+    try {
+        const text = await resp.text();
+        if (text.length > MAX_RESPONSE_BYTES)
+            return null;
+        return JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Normalize legacy `api` values to their canonical form.
+ * Also maps bare "openai" to "openai-completions" (Settings dropdown value).
+ */
+function normalizeApi(api) {
+    if (!api)
+        return "openai-completions";
+    const mapped = LEGACY_PROVIDER_API_ALIASES[api];
+    if (mapped)
+        return mapped;
+    if (api === "openai")
+        return "openai-completions";
+    return api;
+}
+/**
+ * Determine provider ID for SSRF validation (same logic as routes/llm.ts).
+ */
+function ssrfProviderId(providerId, api) {
+    if (providerId && LOCAL_PROVIDER_IDS.has(providerId))
+        return providerId;
+    return api === "ollama" ? "ollama" : (providerId || "remote-provider");
+}
+/**
+ * Perform SSRF validation on a URL. Returns true if the URL is safe.
+ * Throws only on hard rejections (private IP, link-local).
+ * Swallows DNS resolution failures (same pattern as probe.ts).
+ */
+async function ssrfCheck(url, providerId) {
+    try {
+        await validateUpstreamUrl(url, providerId);
+    }
+    catch (err) {
+        const msg = String(err?.message || "");
+        // DNS resolution failure is acceptable — the real fetch will fail too
+        if (msg.includes("Cannot resolve provider hostname"))
+            return;
+        throw err;
+    }
+}
+/**
+ * Parse a models response body into a normalized array.
+ */
+function parseModelsResponse(body) {
+    const list = Array.isArray(body?.data) ? body.data
+        : Array.isArray(body?.models) ? body.models
+            : Array.isArray(body) ? body
+                : [];
+    return list.map((m) => ({
+        id: String(m.id || m.model || ""),
+        name: m.name || m.id || undefined,
+    })).filter(m => m.id);
+}
+/**
+ * Map an HTTP status code or error to a ValidateKeyStatus.
+ */
+function statusFromHttpCode(code) {
+    if (code === 401)
+        return "auth_failed";
+    if (code === 403)
+        return "forbidden";
+    if (code === 404)
+        return "unknown_error";
+    return "unknown_error";
+}
+// ── Protocol strategies ────────────────────────────────────────────────────
+/**
+ * OpenAI-compatible: Bearer token + /v1/models with /models fallback.
+ */
+async function validateOpenAI(baseUrl, apiKey, validationId) {
+    const base = baseUrl.replace(/\/+$/, "");
+    const headers = {
+        "Authorization": `Bearer ${apiKey}`,
+    };
+    for (const ep of ["/v1/models", "/models"]) {
+        const url = `${base}${ep}`;
+        try {
+            await ssrfCheck(url, validationId);
+            const resp = await fetch(url, { headers, signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+            if (resp.ok) {
+                const body = await safeReadJson(resp);
+                const models = parseModelsResponse(body);
+                if (models.length === 0) {
+                    return { status: "models_empty", message: "Provider returned empty model list" };
+                }
+                return { status: "ok", models };
+            }
+            // Non-OK: check if auth failure
+            if (resp.status === 401 || resp.status === 403) {
+                try {
+                    await resp.body?.cancel();
+                }
+                catch { /* ignore */ }
+                return { status: statusFromHttpCode(resp.status), message: `HTTP ${resp.status}` };
+            }
+            // Other error (404, 5xx) — try next endpoint
+            try {
+                await resp.body?.cancel();
+            }
+            catch { /* ignore */ }
+        }
+        catch (err) {
+            const msg = String(err?.message || "");
+            if (msg.includes("private") || msg.includes("link-local")) {
+                return { status: "unreachable", message: msg };
+            }
+            if (err.name === "TimeoutError" || msg.includes("timeout")) {
+                return { status: "timeout", message: "Connection timed out" };
+            }
+            // Network error — try next endpoint
+        }
+    }
+    return { status: "unreachable", message: "Cannot reach provider" };
+}
+/**
+ * Anthropic dual-try strategy:
+ * 1. Try Bearer auth + /v1/models (gateways)
+ * 2. If 401/403 → retry with x-api-key (native Anthropic) + anthropic-version header
+ */
+async function validateAnthropic(baseUrl, apiKey, validationId) {
+    const base = baseUrl.replace(/\/+$/, "");
+    const url = `${base}/v1/models`;
+    await ssrfCheck(url, validationId);
+    // Attempt 1: Bearer auth (works for gateways like MiniMax Intl)
+    try {
+        const resp = await fetch(url, {
+            headers: { "Authorization": `Bearer ${apiKey}` },
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (resp.ok) {
+            const body = await safeReadJson(resp);
+            const models = parseModelsResponse(body);
+            if (models.length === 0) {
+                return { status: "models_empty", message: "Provider returned empty model list" };
+            }
+            return { status: "ok", models };
+        }
+        try {
+            await resp.body?.cancel();
+        }
+        catch { /* ignore */ }
+        // If not auth failure, return the error (e.g. 500)
+        if (resp.status !== 401 && resp.status !== 403) {
+            return { status: statusFromHttpCode(resp.status), message: `HTTP ${resp.status}` };
+        }
+    }
+    catch (err) {
+        const msg = String(err?.message || "");
+        if (msg.includes("private") || msg.includes("link-local")) {
+            return { status: "unreachable", message: msg };
+        }
+        if (err.name === "TimeoutError" || msg.includes("timeout")) {
+            return { status: "timeout", message: "Connection timed out" };
+        }
+        // Network error on first try — still attempt native
+    }
+    // Attempt 2: Native Anthropic (x-api-key raw + anthropic-version)
+    try {
+        const resp = await fetch(url, {
+            headers: {
+                "x-api-key": apiKey,
+                "anthropic-version": "2023-06-01",
+            },
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (resp.ok) {
+            const body = await safeReadJson(resp);
+            const models = parseModelsResponse(body);
+            if (models.length === 0) {
+                return { status: "models_empty", message: "Provider returned empty model list" };
+            }
+            return { status: "ok", models };
+        }
+        try {
+            await resp.body?.cancel();
+        }
+        catch { /* ignore */ }
+        return { status: statusFromHttpCode(resp.status), message: `HTTP ${resp.status}` };
+    }
+    catch (err) {
+        const msg = String(err?.message || "");
+        if (err.name === "TimeoutError" || msg.includes("timeout")) {
+            return { status: "timeout", message: "Connection timed out" };
+        }
+        return { status: "unreachable", message: "Cannot reach provider" };
+    }
+}
+/**
+ * Google Generative AI: Bearer token + /v1beta/openai/models.
+ */
+async function validateGoogle(baseUrl, apiKey, validationId) {
+    const base = baseUrl.replace(/\/+$/, "");
+    const url = `${base}/v1beta/openai/models`;
+    try {
+        await ssrfCheck(url, validationId);
+        const resp = await fetch(url, {
+            headers: { "Authorization": `Bearer ${apiKey}` },
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (resp.ok) {
+            const body = await safeReadJson(resp);
+            const models = parseModelsResponse(body);
+            if (models.length === 0) {
+                return { status: "models_empty", message: "Provider returned empty model list" };
+            }
+            return { status: "ok", models };
+        }
+        try {
+            await resp.body?.cancel();
+        }
+        catch { /* ignore */ }
+        if (resp.status === 401 || resp.status === 403) {
+            return { status: statusFromHttpCode(resp.status), message: `HTTP ${resp.status}` };
+        }
+        return { status: "unknown_error", message: `HTTP ${resp.status}` };
+    }
+    catch (err) {
+        const msg = String(err?.message || "");
+        if (msg.includes("private") || msg.includes("link-local")) {
+            return { status: "unreachable", message: msg };
+        }
+        if (err.name === "TimeoutError" || msg.includes("timeout")) {
+            return { status: "timeout", message: "Connection timed out" };
+        }
+        return { status: "unreachable", message: "Cannot reach provider" };
+    }
+}
+/**
+ * Ollama / local providers: No auth + /v1/models with /api/tags fallback.
+ */
+async function validateOllama(baseUrl, validationId) {
+    const base = baseUrl.replace(/\/+$/, "");
+    for (const ep of ["/v1/models", "/api/tags"]) {
+        const url = `${base}${ep}`;
+        try {
+            await ssrfCheck(url, validationId);
+            const resp = await fetch(url, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+            if (resp.ok) {
+                const body = await safeReadJson(resp);
+                const models = parseModelsResponse(body);
+                if (models.length === 0) {
+                    return { status: "models_empty", message: "No models available" };
+                }
+                return { status: "ok", models };
+            }
+            try {
+                await resp.body?.cancel();
+            }
+            catch { /* ignore */ }
+            // 404 on first endpoint → try fallback
+            if (resp.status === 404)
+                continue;
+            return { status: statusFromHttpCode(resp.status), message: `HTTP ${resp.status}` };
+        }
+        catch (err) {
+            const msg = String(err?.message || "");
+            if (msg.includes("private") || msg.includes("link-local")) {
+                return { status: "unreachable", message: msg };
+            }
+            if (err.name === "TimeoutError" || msg.includes("timeout")) {
+                return { status: "timeout", message: "Connection timed out" };
+            }
+            // Network error — try next endpoint
+        }
+    }
+    return { status: "unreachable", message: "Cannot reach provider" };
+}
+// ── Completion validation strategies ───────────────────────────────────────
+const COMPLETION_BODY_BASE = {
+    messages: [{ role: "user", content: "hi" }],
+    max_tokens: 1,
+    stream: false,
+};
+/**
+ * Parse a provider error response to extract meaningful status.
+ * Only reads bounded JSON for classification — never returns content.
+ */
+function classifyCompletionError(status, body) {
+    const code = String(body?.error?.code || body?.error?.type || "");
+    const msg = String(body?.error?.message || body?.message || "");
+    // Quota / billing errors
+    if (status === 402 || code === "insufficient_quota" || code === "billing_hard_limit_reached"
+        || msg.includes("quota") || msg.includes("billing") || msg.includes("credit")
+        || msg.includes("exceeded") || code === "rate_limit_exceeded") {
+        return { status: "quota_exceeded", message: msg || "Quota or credits exhausted" };
+    }
+    // Model not found
+    if (status === 404 || code === "model_not_found" || code === "not_found_error"
+        || msg.includes("does not exist") || msg.includes("not found")) {
+        return { status: "model_not_found", message: msg || "Model not found" };
+    }
+    // Auth failures
+    if (status === 401)
+        return { status: "auth_failed", message: msg || `HTTP ${status}` };
+    if (status === 403)
+        return { status: "forbidden", message: msg || `HTTP ${status}` };
+    // Rate limit from provider (different from our own rate limit).
+    // Distinguish temporary rate limits from persistent quota exhaustion.
+    if (status === 429) {
+        const isQuota = msg.includes("quota") || msg.includes("billing")
+            || msg.includes("credit") || msg.includes("exceeded")
+            || code === "insufficient_quota" || code === "billing_hard_limit_reached";
+        if (isQuota) {
+            return { status: "quota_exceeded", message: msg || "Quota exhausted" };
+        }
+        return { status: "quota_exceeded", message: msg || "Rate limited by provider (retry later)" };
+    }
+    return { status: "unknown_error", message: msg || `HTTP ${status}` };
+}
+/**
+ * OpenAI-compatible completion: POST {base}/chat/completions with path fallback.
+ */
+async function deepValidateOpenAI(baseUrl, apiKey, modelId, validationId) {
+    const base = baseUrl.replace(/\/+$/, "");
+    const headers = {
+        "Authorization": `Bearer ${apiKey}`,
+        "Content-Type": "application/json",
+    };
+    const body = JSON.stringify({ ...COMPLETION_BODY_BASE, model: modelId });
+    // Try /v1/chat/completions then /chat/completions (avoid double /v1)
+    const endpoints = base.endsWith("/v1") || base.includes("/v1/")
+        ? ["/chat/completions"]
+        : ["/v1/chat/completions", "/chat/completions"];
+    for (const ep of endpoints) {
+        const url = `${base}${ep}`;
+        try {
+            await ssrfCheck(url, validationId);
+            const resp = await fetch(url, {
+                method: "POST",
+                headers,
+                body,
+                signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+            });
+            if (resp.ok) {
+                // Discard response content — we only care that it succeeded
+                try {
+                    await resp.body?.cancel();
+                }
+                catch { /* ignore */ }
+                return { status: "ok", message: "Completion request succeeded" };
+            }
+            // Parse bounded error body for classification
+            let errBody;
+            errBody = await safeReadJson(resp) ?? {};
+            // On 404: only fallback to next endpoint if it's a generic "not found"
+            // (endpoint doesn't exist). If the error body indicates model-specific
+            // issues, return immediately.
+            if (resp.status === 404 && endpoints.length > 1) {
+                const code = String(errBody?.error?.code || errBody?.error?.type || "");
+                const msg = String(errBody?.error?.message || "");
+                if (code === "model_not_found" || code === "not_found_error"
+                    || msg.includes("does not exist") || msg.includes("not found")) {
+                    return classifyCompletionError(resp.status, errBody);
+                }
+                continue; // generic 404 — try fallback endpoint
+            }
+            return classifyCompletionError(resp.status, errBody);
+        }
+        catch (err) {
+            const msg = String(err?.message || "");
+            if (msg.includes("private") || msg.includes("link-local")) {
+                return { status: "unreachable", message: msg };
+            }
+            if (err.name === "TimeoutError" || msg.includes("timeout")) {
+                return { status: "timeout", message: "Connection timed out" };
+            }
+        }
+    }
+    return { status: "unreachable", message: "Cannot reach provider" };
+}
+/**
+ * Anthropic completion: POST {base}/v1/messages with dual auth strategy.
+ */
+async function deepValidateAnthropic(baseUrl, apiKey, modelId, validationId) {
+    const base = baseUrl.replace(/\/+$/, "");
+    const endpoint = base.endsWith("/v1") || base.includes("/v1/")
+        ? "/messages"
+        : "/v1/messages";
+    const url = `${base}${endpoint}`;
+    const body = JSON.stringify({
+        model: modelId,
+        messages: [{ role: "user", content: "hi" }],
+        max_tokens: 1,
+    });
+    await ssrfCheck(url, validationId);
+    // Attempt 1: Bearer auth (gateways)
+    try {
+        const resp = await fetch(url, {
+            method: "POST",
+            headers: {
+                "Authorization": `Bearer ${apiKey}`,
+                "Content-Type": "application/json",
+                "anthropic-version": "2023-06-01",
+            },
+            body,
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (resp.ok) {
+            try {
+                await resp.body?.cancel();
+            }
+            catch { /* ignore */ }
+            return { status: "ok", message: "Completion request succeeded" };
+        }
+        let errBody;
+        errBody = await safeReadJson(resp) ?? {};
+        if (resp.status !== 401 && resp.status !== 403) {
+            return classifyCompletionError(resp.status, errBody);
+        }
+    }
+    catch (err) {
+        const msg = String(err?.message || "");
+        if (msg.includes("private") || msg.includes("link-local")) {
+            return { status: "unreachable", message: msg };
+        }
+        if (err.name === "TimeoutError" || msg.includes("timeout")) {
+            return { status: "timeout", message: "Connection timed out" };
+        }
+    }
+    // Attempt 2: Native x-api-key
+    try {
+        const resp = await fetch(url, {
+            method: "POST",
+            headers: {
+                "x-api-key": apiKey,
+                "Content-Type": "application/json",
+                "anthropic-version": "2023-06-01",
+            },
+            body,
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (resp.ok) {
+            try {
+                await resp.body?.cancel();
+            }
+            catch { /* ignore */ }
+            return { status: "ok", message: "Completion request succeeded" };
+        }
+        let errBody;
+        errBody = await safeReadJson(resp) ?? {};
+        return classifyCompletionError(resp.status, errBody);
+    }
+    catch (err) {
+        const msg = String(err?.message || "");
+        if (err.name === "TimeoutError" || msg.includes("timeout")) {
+            return { status: "timeout", message: "Connection timed out" };
+        }
+        return { status: "unreachable", message: "Cannot reach provider" };
+    }
+}
+/**
+ * Google Generative AI completion: POST {base}/v1beta/openai/chat/completions.
+ */
+async function deepValidateGoogle(baseUrl, apiKey, modelId, validationId) {
+    const base = baseUrl.replace(/\/+$/, "");
+    const endpoint = base.includes("/v1beta/openai")
+        ? "/chat/completions"
+        : "/v1beta/openai/chat/completions";
+    const url = `${base}${endpoint}`;
+    try {
+        await ssrfCheck(url, validationId);
+        const resp = await fetch(url, {
+            method: "POST",
+            headers: {
+                "Authorization": `Bearer ${apiKey}`,
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({ ...COMPLETION_BODY_BASE, model: modelId }),
+            signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+        });
+        if (resp.ok) {
+            try {
+                await resp.body?.cancel();
+            }
+            catch { /* ignore */ }
+            return { status: "ok", message: "Completion request succeeded" };
+        }
+        let errBody;
+        errBody = await safeReadJson(resp) ?? {};
+        return classifyCompletionError(resp.status, errBody);
+    }
+    catch (err) {
+        const msg = String(err?.message || "");
+        if (msg.includes("private") || msg.includes("link-local")) {
+            return { status: "unreachable", message: msg };
+        }
+        if (err.name === "TimeoutError" || msg.includes("timeout")) {
+            return { status: "timeout", message: "Connection timed out" };
+        }
+        return { status: "unreachable", message: "Cannot reach provider" };
+    }
+}
+/**
+ * Ollama completion: POST {base}/v1/chat/completions (no auth).
+ */
+async function deepValidateOllama(baseUrl, modelId, validationId) {
+    const base = baseUrl.replace(/\/+$/, "");
+    const endpoints = base.endsWith("/v1") || base.includes("/v1/")
+        ? ["/chat/completions"]
+        : ["/v1/chat/completions", "/api/chat"];
+    for (const ep of endpoints) {
+        const url = `${base}${ep}`;
+        try {
+            await ssrfCheck(url, validationId);
+            const body = ep === "/api/chat"
+                ? JSON.stringify({ model: modelId, messages: [{ role: "user", content: "hi" }], stream: false })
+                : JSON.stringify({ ...COMPLETION_BODY_BASE, model: modelId });
+            const resp = await fetch(url, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body,
+                signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+            });
+            if (resp.ok) {
+                try {
+                    await resp.body?.cancel();
+                }
+                catch { /* ignore */ }
+                return { status: "ok", message: "Completion request succeeded" };
+            }
+            let errBody;
+            errBody = await safeReadJson(resp) ?? {};
+            if (resp.status === 404 && endpoints.length > 1)
+                continue;
+            return classifyCompletionError(resp.status, errBody);
+        }
+        catch (err) {
+            const msg = String(err?.message || "");
+            if (msg.includes("private") || msg.includes("link-local")) {
+                return { status: "unreachable", message: msg };
+            }
+            if (err.name === "TimeoutError" || msg.includes("timeout")) {
+                return { status: "timeout", message: "Connection timed out" };
+            }
+        }
+    }
+    return { status: "unreachable", message: "Cannot reach provider" };
+}
+/**
+ * Validate an API key by probing the provider's models endpoint using the
+ * correct protocol-aware authentication strategy.
+ *
+ * When mode is "completion", sends a 1-token completion request to verify
+ * the key can actually perform inference (catches quota/credit issues).
+ */
+export async function validateApiKey(params) {
+    const { baseUrl, apiKey, providerId, api, authHeader, mode = "models", modelId } = params;
+    if (!baseUrl) {
+        return { status: "unknown_error", message: "baseUrl is required" };
+    }
+    const base = baseUrl.replace(/\/+$/, "");
+    try {
+        const parsed = new URL(base);
+        if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+            return { status: "unknown_error", message: "URL must use http:// or https://" };
+        }
+    }
+    catch {
+        return { status: "unknown_error", message: "Invalid URL" };
+    }
+    const normalizedApi = normalizeApi(api);
+    const validationId = ssrfProviderId(providerId, normalizedApi);
+    // Completion mode: send a 1-token request
+    if (mode === "completion") {
+        if (!modelId) {
+            return { status: "unknown_error", message: "modelId is required for completion validation" };
+        }
+        switch (normalizedApi) {
+            case "anthropic-messages":
+                return deepValidateAnthropic(base, apiKey, modelId, validationId);
+            case "google-generative-ai":
+                return deepValidateGoogle(base, apiKey, modelId, validationId);
+            case "ollama":
+                return deepValidateOllama(base, modelId, validationId);
+            default:
+                return deepValidateOpenAI(base, apiKey, modelId, validationId);
+        }
+    }
+    // Models mode (default): probe /models endpoint
+    switch (normalizedApi) {
+        case "anthropic-messages":
+            return validateAnthropic(base, apiKey, validationId);
+        case "google-generative-ai":
+            return validateGoogle(base, apiKey, validationId);
+        case "ollama":
+            return validateOllama(base, validationId);
+        default:
+            // openai-completions and all unknown protocols → OpenAI-compat strategy
+            return validateOpenAI(base, apiKey, validationId);
+    }
+}
+//# sourceMappingURL=validate-key.js.map