chore: import upstream snapshot with attribution

apps/sim/app/api/providers/base/models/route.ts

@@ -0,0 +1,13 @@
+import { NextResponse } from 'next/server'
+import { providerModelsResponseSchema } from '@/lib/api/contracts/providers'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { getBaseModelProviders } from '@/providers/utils'
+
+export const GET = withRouteHandler(async () => {
+  try {
+    const allModels = Object.keys(getBaseModelProviders())
+    return NextResponse.json(providerModelsResponseSchema.parse({ models: allModels }))
+  } catch (error) {
+    return NextResponse.json({ models: [], error: 'Failed to fetch models' }, { status: 500 })
+  }
+})

apps/sim/app/api/providers/baseten/models/route.test.ts

@@ -0,0 +1,252 @@
+/**
+ * @vitest-environment node
+ */
+import { createMockRequest } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const {
+  mockFilterBlacklistedModels,
+  mockIsProviderBlacklisted,
+  mockGetBYOKKey,
+  mockGetSession,
+  mockGetUserEntityPermissions,
+  mutableEnv,
+} = vi.hoisted(() => ({
+  mockFilterBlacklistedModels: vi.fn(),
+  mockIsProviderBlacklisted: vi.fn(),
+  mockGetBYOKKey: vi.fn(),
+  mockGetSession: vi.fn(),
+  mockGetUserEntityPermissions: vi.fn(),
+  mutableEnv: { BASETEN_API_KEY: undefined as string | undefined },
+}))
+
+vi.mock('@/lib/core/config/env', () => ({ env: mutableEnv }))
+
+vi.mock('@/providers/utils', () => ({
+  filterBlacklistedModels: mockFilterBlacklistedModels,
+  isProviderBlacklisted: mockIsProviderBlacklisted,
+}))
+
+vi.mock('@/lib/api-key/byok', () => ({
+  getBYOKKey: mockGetBYOKKey,
+}))
+
+vi.mock('@/lib/auth', () => ({
+  getSession: mockGetSession,
+}))
+
+vi.mock('@/lib/workspaces/permissions/utils', () => ({
+  getUserEntityPermissions: mockGetUserEntityPermissions,
+}))
+
+import { GET } from '@/app/api/providers/baseten/models/route'
+
+const BASETEN_MODELS_URL = 'https://inference.baseten.co/v1/models'
+
+function jsonResponse(body: unknown, init: { ok?: boolean; status?: number } = {}): Response {
+  const status = init.status ?? 200
+  const ok = init.ok ?? (status >= 200 && status < 300)
+  return {
+    ok,
+    status,
+    statusText: ok ? 'OK' : 'Error',
+    json: vi.fn(async () => body),
+  } as unknown as Response
+}
+
+function setEnvKey(value: string | undefined): void {
+  mutableEnv.BASETEN_API_KEY = value
+}
+
+function authHeaderFromLastFetch(mockFetch: ReturnType<typeof vi.fn>): unknown {
+  const init = mockFetch.mock.calls.at(-1)?.[1] as RequestInit | undefined
+  return (init?.headers as Record<string, string> | undefined)?.Authorization
+}
+
+describe('GET /api/providers/baseten/models', () => {
+  let mockFetch: ReturnType<typeof vi.fn>
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+
+    mockFetch = vi.fn()
+    vi.stubGlobal('fetch', mockFetch)
+
+    mockIsProviderBlacklisted.mockReturnValue(false)
+    mockFilterBlacklistedModels.mockImplementation((models: string[]) => models)
+    mockGetBYOKKey.mockResolvedValue(null)
+    mockGetSession.mockResolvedValue(null)
+    mockGetUserEntityPermissions.mockResolvedValue(null)
+    setEnvKey(undefined)
+  })
+
+  it('returns empty models without fetching when the provider is blacklisted', async () => {
+    mockIsProviderBlacklisted.mockReturnValue(true)
+    setEnvKey('env-key')
+
+    const res = await GET(createMockRequest('GET'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('returns empty models when no workspaceId and no env key are available', async () => {
+    const res = await GET(createMockRequest('GET'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('fetches models with the env key and prefixes each id with baseten/', async () => {
+    setEnvKey('env-key')
+    mockFetch.mockResolvedValueOnce(
+      jsonResponse({
+        data: [{ id: 'openai/gpt-oss-120b' }, { id: 'deepseek-ai/DeepSeek-V3' }],
+      })
+    )
+
+    const res = await GET(createMockRequest('GET'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({
+      models: ['baseten/openai/gpt-oss-120b', 'baseten/deepseek-ai/DeepSeek-V3'],
+    })
+
+    expect(mockFetch).toHaveBeenCalledTimes(1)
+    const [url, init] = mockFetch.mock.calls[0]
+    expect(url).toBe(BASETEN_MODELS_URL)
+    expect((init.headers as Record<string, string>).Authorization).toBe('Bearer env-key')
+  })
+
+  it('uses the BYOK key when workspaceId, session, and permission are present', async () => {
+    setEnvKey('env-key')
+    mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
+    mockGetUserEntityPermissions.mockResolvedValue('admin')
+    mockGetBYOKKey.mockResolvedValue({ apiKey: 'byok-key', isBYOK: true })
+    mockFetch.mockResolvedValueOnce(jsonResponse({ data: [{ id: 'model-a' }] }))
+
+    const res = await GET(
+      createMockRequest('GET', undefined, {}, 'http://localhost:3000/api/test?workspaceId=ws-1')
+    )
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: ['baseten/model-a'] })
+
+    expect(mockGetBYOKKey).toHaveBeenCalledWith('ws-1', 'baseten')
+    expect(authHeaderFromLastFetch(mockFetch)).toBe('Bearer byok-key')
+  })
+
+  it('falls back to the env key when there is a workspaceId but no session', async () => {
+    setEnvKey('env-key')
+    mockGetSession.mockResolvedValue(null)
+    mockFetch.mockResolvedValueOnce(jsonResponse({ data: [{ id: 'model-a' }] }))
+
+    const res = await GET(
+      createMockRequest('GET', undefined, {}, 'http://localhost:3000/api/test?workspaceId=ws-1')
+    )
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: ['baseten/model-a'] })
+    expect(mockGetBYOKKey).not.toHaveBeenCalled()
+    expect(authHeaderFromLastFetch(mockFetch)).toBe('Bearer env-key')
+  })
+
+  it('falls back to the env key when the user lacks workspace permission', async () => {
+    setEnvKey('env-key')
+    mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
+    mockGetUserEntityPermissions.mockResolvedValue(null)
+    mockFetch.mockResolvedValueOnce(jsonResponse({ data: [{ id: 'model-a' }] }))
+
+    const res = await GET(
+      createMockRequest('GET', undefined, {}, 'http://localhost:3000/api/test?workspaceId=ws-1')
+    )
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: ['baseten/model-a'] })
+    expect(mockGetBYOKKey).not.toHaveBeenCalled()
+    expect(authHeaderFromLastFetch(mockFetch)).toBe('Bearer env-key')
+  })
+
+  it('returns empty models when the upstream responds 401', async () => {
+    setEnvKey('env-key')
+    mockFetch.mockResolvedValueOnce(jsonResponse({}, { ok: false, status: 401 }))
+
+    const res = await GET(createMockRequest('GET'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+  })
+
+  it('returns empty models when the upstream responds 500', async () => {
+    setEnvKey('env-key')
+    mockFetch.mockResolvedValueOnce(jsonResponse({}, { ok: false, status: 500 }))
+
+    const res = await GET(createMockRequest('GET'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+  })
+
+  it('returns empty models when fetch throws', async () => {
+    setEnvKey('env-key')
+    mockFetch.mockRejectedValueOnce(new Error('network down'))
+
+    const res = await GET(createMockRequest('GET'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+  })
+
+  it('returns empty models when the upstream data array is empty', async () => {
+    setEnvKey('env-key')
+    mockFetch.mockResolvedValueOnce(jsonResponse({ data: [] }))
+
+    const res = await GET(createMockRequest('GET'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+  })
+
+  it('returns empty models when the upstream omits the data field', async () => {
+    setEnvKey('env-key')
+    mockFetch.mockResolvedValueOnce(jsonResponse({ object: 'list' }))
+
+    const res = await GET(createMockRequest('GET'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+  })
+
+  it('dedupes repeated model ids', async () => {
+    setEnvKey('env-key')
+    mockFetch.mockResolvedValueOnce(
+      jsonResponse({
+        data: [{ id: 'model-a' }, { id: 'model-a' }, { id: 'model-b' }],
+      })
+    )
+
+    const res = await GET(createMockRequest('GET'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: ['baseten/model-a', 'baseten/model-b'] })
+  })
+
+  it('drops models removed by the blacklist filter', async () => {
+    setEnvKey('env-key')
+    mockFilterBlacklistedModels.mockImplementation((models: string[]) =>
+      models.filter((m) => m !== 'baseten/blocked-model')
+    )
+    mockFetch.mockResolvedValueOnce(
+      jsonResponse({
+        data: [{ id: 'allowed-model' }, { id: 'blocked-model' }],
+      })
+    )
+
+    const res = await GET(createMockRequest('GET'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: ['baseten/allowed-model'] })
+  })
+})

apps/sim/app/api/providers/baseten/models/route.ts

@@ -0,0 +1,93 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import {
+  basetenProviderModelsQuerySchema,
+  basetenUpstreamResponseSchema,
+  providerModelsResponseSchema,
+} from '@/lib/api/contracts/providers'
+import { validationErrorResponse } from '@/lib/api/server'
+import { getBYOKKey } from '@/lib/api-key/byok'
+import { getSession } from '@/lib/auth'
+import { env } from '@/lib/core/config/env'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
+import { filterBlacklistedModels, isProviderBlacklisted } from '@/providers/utils'
+
+const logger = createLogger('BasetenModelsAPI')
+
+export const GET = withRouteHandler(async (request: NextRequest) => {
+  if (isProviderBlacklisted('baseten')) {
+    logger.info('Baseten provider is blacklisted, returning empty models')
+    return NextResponse.json({ models: [] })
+  }
+
+  let apiKey: string | undefined
+
+  const queryValidation = basetenProviderModelsQuerySchema.safeParse({
+    workspaceId: request.nextUrl.searchParams.get('workspaceId') ?? undefined,
+  })
+  if (!queryValidation.success) return validationErrorResponse(queryValidation.error)
+  const { workspaceId } = queryValidation.data
+  if (workspaceId) {
+    const session = await getSession()
+    if (session?.user?.id) {
+      const permission = await getUserEntityPermissions(session.user.id, 'workspace', workspaceId)
+      if (permission) {
+        const byokResult = await getBYOKKey(workspaceId, 'baseten')
+        if (byokResult) {
+          apiKey = byokResult.apiKey
+        }
+      }
+    }
+  }
+
+  if (!apiKey) {
+    apiKey = env.BASETEN_API_KEY
+  }
+
+  if (!apiKey) {
+    logger.info('No Baseten API key available, returning empty models')
+    return NextResponse.json({ models: [] })
+  }
+
+  try {
+    const response = await fetch('https://inference.baseten.co/v1/models', {
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        'Content-Type': 'application/json',
+      },
+      cache: 'no-store',
+    })
+
+    if (!response.ok) {
+      logger.warn('Failed to fetch Baseten models', {
+        status: response.status,
+        statusText: response.statusText,
+      })
+      return NextResponse.json({ models: [] })
+    }
+
+    const data = basetenUpstreamResponseSchema.parse(await response.json())
+
+    const allModels: string[] = []
+    for (const model of data.data ?? []) {
+      allModels.push(`baseten/${model.id}`)
+    }
+
+    const uniqueModels = Array.from(new Set(allModels))
+    const models = filterBlacklistedModels(uniqueModels)
+
+    logger.info('Successfully fetched Baseten models', {
+      count: models.length,
+      filtered: uniqueModels.length - models.length,
+    })
+
+    return NextResponse.json(providerModelsResponseSchema.parse({ models }))
+  } catch (error) {
+    logger.error('Error fetching Baseten models', {
+      error: getErrorMessage(error, 'Unknown error'),
+    })
+    return NextResponse.json({ models: [] })
+  }
+})

apps/sim/app/api/providers/fireworks/models/route.ts

@@ -0,0 +1,107 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import {
+  fireworksProviderModelsQuerySchema,
+  fireworksUpstreamResponseSchema,
+  providerModelsResponseSchema,
+} from '@/lib/api/contracts/providers'
+import { validationErrorResponse } from '@/lib/api/server'
+import { getBYOKKey } from '@/lib/api-key/byok'
+import { getSession } from '@/lib/auth'
+import { env } from '@/lib/core/config/env'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
+import { filterBlacklistedModels, isProviderBlacklisted } from '@/providers/utils'
+
+const logger = createLogger('FireworksModelsAPI')
+
+interface FireworksModel {
+  id: string
+  object?: string
+  created?: number
+  owned_by?: string
+}
+
+interface FireworksModelsResponse {
+  data: FireworksModel[]
+  object?: string
+}
+
+export const GET = withRouteHandler(async (request: NextRequest) => {
+  if (isProviderBlacklisted('fireworks')) {
+    logger.info('Fireworks provider is blacklisted, returning empty models')
+    return NextResponse.json({ models: [] })
+  }
+
+  let apiKey: string | undefined
+
+  const queryValidation = fireworksProviderModelsQuerySchema.safeParse({
+    workspaceId: request.nextUrl.searchParams.get('workspaceId') ?? undefined,
+  })
+  if (!queryValidation.success) return validationErrorResponse(queryValidation.error)
+  const { workspaceId } = queryValidation.data
+  if (workspaceId) {
+    const session = await getSession()
+    if (session?.user?.id) {
+      const permission = await getUserEntityPermissions(session.user.id, 'workspace', workspaceId)
+      if (permission) {
+        const byokResult = await getBYOKKey(workspaceId, 'fireworks')
+        if (byokResult) {
+          apiKey = byokResult.apiKey
+        }
+      }
+    }
+  }
+
+  if (!apiKey) {
+    apiKey = env.FIREWORKS_API_KEY
+  }
+
+  if (!apiKey) {
+    logger.info('No Fireworks API key available, returning empty models')
+    return NextResponse.json({ models: [] })
+  }
+
+  try {
+    const response = await fetch('https://api.fireworks.ai/inference/v1/models', {
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        'Content-Type': 'application/json',
+      },
+      cache: 'no-store',
+    })
+
+    if (!response.ok) {
+      logger.warn('Failed to fetch Fireworks models', {
+        status: response.status,
+        statusText: response.statusText,
+      })
+      return NextResponse.json({ models: [] })
+    }
+
+    const data: FireworksModelsResponse = fireworksUpstreamResponseSchema.parse(
+      await response.json()
+    )
+
+    const allModels: string[] = []
+    for (const model of data.data ?? []) {
+      allModels.push(`fireworks/${model.id}`)
+    }
+
+    const uniqueModels = Array.from(new Set(allModels))
+    const models = filterBlacklistedModels(uniqueModels)
+
+    logger.info('Successfully fetched Fireworks models', {
+      count: models.length,
+      filtered: uniqueModels.length - models.length,
+    })
+
+    return NextResponse.json(providerModelsResponseSchema.parse({ models }))
+  } catch (error) {
+    logger.error('Error fetching Fireworks models', {
+      error: getErrorMessage(error, 'Unknown error'),
+    })
+    return NextResponse.json({ models: [] })
+  }
+})

apps/sim/app/api/providers/litellm/models/route.ts

@@ -0,0 +1,70 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import {
+  providerModelsResponseSchema,
+  vllmUpstreamResponseSchema,
+} from '@/lib/api/contracts/providers'
+import { env } from '@/lib/core/config/env'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { filterBlacklistedModels, isProviderBlacklisted } from '@/providers/utils'
+
+const logger = createLogger('LiteLLMModelsAPI')
+
+export const GET = withRouteHandler(async (_request: NextRequest) => {
+  if (isProviderBlacklisted('litellm')) {
+    logger.info('LiteLLM provider is blacklisted, returning empty models')
+    return NextResponse.json({ models: [] })
+  }
+
+  const baseUrl = (env.LITELLM_BASE_URL || '').replace(/\/$/, '')
+
+  if (!baseUrl) {
+    logger.info('LITELLM_BASE_URL not configured')
+    return NextResponse.json({ models: [] })
+  }
+
+  try {
+    logger.info('Fetching LiteLLM models', { baseUrl })
+
+    const headers: Record<string, string> = {
+      'Content-Type': 'application/json',
+    }
+
+    if (env.LITELLM_API_KEY) {
+      headers.Authorization = `Bearer ${env.LITELLM_API_KEY}`
+    }
+
+    const response = await fetch(`${baseUrl}/v1/models`, {
+      headers,
+      next: { revalidate: 60 },
+    })
+
+    if (!response.ok) {
+      logger.warn('LiteLLM service is not available', {
+        status: response.status,
+        statusText: response.statusText,
+      })
+      return NextResponse.json({ models: [] })
+    }
+
+    const data = vllmUpstreamResponseSchema.parse(await response.json())
+    const allModels = data.data.map((model) => `litellm/${model.id}`)
+    const models = filterBlacklistedModels(allModels)
+
+    logger.info('Successfully fetched LiteLLM models', {
+      count: models.length,
+      filtered: allModels.length - models.length,
+      models,
+    })
+
+    return NextResponse.json(providerModelsResponseSchema.parse({ models }))
+  } catch (error) {
+    logger.error('Failed to fetch LiteLLM models', {
+      error: getErrorMessage(error, 'Unknown error'),
+      baseUrl,
+    })
+
+    return NextResponse.json({ models: [] })
+  }
+})

apps/sim/app/api/providers/ollama-cloud/models/route.test.ts

@@ -0,0 +1,238 @@
+/**
+ * @vitest-environment node
+ */
+import { createMockRequest } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const {
+  mockFilterBlacklistedModels,
+  mockIsProviderBlacklisted,
+  mockGetBYOKKey,
+  mockGetSession,
+  mockGetUserEntityPermissions,
+  mockFetch,
+} = vi.hoisted(() => ({
+  mockFilterBlacklistedModels: vi.fn(),
+  mockIsProviderBlacklisted: vi.fn(),
+  mockGetBYOKKey: vi.fn(),
+  mockGetSession: vi.fn(),
+  mockGetUserEntityPermissions: vi.fn(),
+  mockFetch: vi.fn(),
+}))
+
+vi.mock('@/providers/utils', () => ({
+  filterBlacklistedModels: mockFilterBlacklistedModels,
+  isProviderBlacklisted: mockIsProviderBlacklisted,
+}))
+
+vi.mock('@/lib/api-key/byok', () => ({
+  getBYOKKey: mockGetBYOKKey,
+}))
+
+vi.mock('@/lib/auth', () => ({
+  getSession: mockGetSession,
+}))
+
+vi.mock('@/lib/workspaces/permissions/utils', () => ({
+  getUserEntityPermissions: mockGetUserEntityPermissions,
+}))
+
+import { GET } from '@/app/api/providers/ollama-cloud/models/route'
+
+const OLLAMA_CLOUD_TAGS_URL = 'https://ollama.com/api/tags'
+
+const okResponse = (body: unknown) => ({
+  ok: true,
+  status: 200,
+  statusText: 'OK',
+  json: vi.fn().mockResolvedValue(body),
+})
+
+const errorResponse = (status: number, statusText = 'Unauthorized') => ({
+  ok: false,
+  status,
+  statusText,
+  json: vi.fn().mockResolvedValue({}),
+})
+
+/**
+ * Builds a request whose query string carries the given workspaceId. Passing
+ * `undefined` omits the param entirely; passing `''` produces `?workspaceId=`.
+ */
+const requestWithWorkspace = (workspaceId?: string) => {
+  const url = new URL('http://localhost:3000/api/providers/ollama-cloud/models')
+  if (workspaceId !== undefined) {
+    url.searchParams.set('workspaceId', workspaceId)
+  }
+  return createMockRequest('GET', undefined, {}, url.toString())
+}
+
+const fetchAuthHeader = () => {
+  const init = mockFetch.mock.calls[0]?.[1] as RequestInit | undefined
+  const headers = init?.headers as Record<string, string> | undefined
+  return headers?.Authorization
+}
+
+/** Grants a session + workspace permission so the BYOK lookup is reached. */
+const grantWorkspaceAccess = () => {
+  mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
+  mockGetUserEntityPermissions.mockResolvedValue('admin')
+}
+
+describe('GET /api/providers/ollama-cloud/models', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.stubGlobal('fetch', mockFetch)
+
+    mockIsProviderBlacklisted.mockReturnValue(false)
+    mockFilterBlacklistedModels.mockImplementation((models: string[]) => models)
+    mockGetBYOKKey.mockResolvedValue(null)
+    mockGetSession.mockResolvedValue(null)
+    mockGetUserEntityPermissions.mockResolvedValue(null)
+  })
+
+  it('returns empty models without calling fetch when the provider is blacklisted', async () => {
+    mockIsProviderBlacklisted.mockReturnValue(true)
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('returns empty models when there is no workspaceId (BYOK only, no env fallback)', async () => {
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+    expect(mockFetch).not.toHaveBeenCalled()
+    expect(mockGetBYOKKey).not.toHaveBeenCalled()
+  })
+
+  it('returns empty models when the workspace has no stored BYOK key (never falls back to a hosted key)', async () => {
+    grantWorkspaceAccess()
+    mockGetBYOKKey.mockResolvedValue(null)
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+    expect(mockGetBYOKKey).toHaveBeenCalledWith('ws-1', 'ollama-cloud')
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('fetches /api/tags with the BYOK key and prefixes each model name with ollama-cloud/', async () => {
+    grantWorkspaceAccess()
+    mockGetBYOKKey.mockResolvedValue({ apiKey: 'byok-ollama-key' })
+    mockFetch.mockResolvedValue(
+      okResponse({
+        models: [{ name: 'gpt-oss:120b' }, { name: 'deepseek-v3.1:671b' }],
+      })
+    )
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({
+      models: ['ollama-cloud/gpt-oss:120b', 'ollama-cloud/deepseek-v3.1:671b'],
+    })
+
+    expect(mockFetch).toHaveBeenCalledTimes(1)
+    expect(mockFetch.mock.calls[0][0]).toBe(OLLAMA_CLOUD_TAGS_URL)
+    expect(fetchAuthHeader()).toBe('Bearer byok-ollama-key')
+  })
+
+  it('does not call getBYOKKey when there is a workspaceId but no session', async () => {
+    mockGetSession.mockResolvedValue(null)
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+    expect(mockGetBYOKKey).not.toHaveBeenCalled()
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('does not call getBYOKKey when the session user lacks workspace permission', async () => {
+    mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
+    mockGetUserEntityPermissions.mockResolvedValue(null)
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+    expect(mockGetBYOKKey).not.toHaveBeenCalled()
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('returns empty models when the upstream fetch responds non-ok', async () => {
+    grantWorkspaceAccess()
+    mockGetBYOKKey.mockResolvedValue({ apiKey: 'byok-ollama-key' })
+    mockFetch.mockResolvedValue(errorResponse(401, 'Unauthorized'))
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+  })
+
+  it('returns empty models when the upstream fetch throws', async () => {
+    grantWorkspaceAccess()
+    mockGetBYOKKey.mockResolvedValue({ apiKey: 'byok-ollama-key' })
+    mockFetch.mockRejectedValue(new Error('network down'))
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+  })
+
+  it('returns a validation error for an empty workspaceId query param', async () => {
+    const res = await GET(requestWithWorkspace(''))
+
+    expect(res.status).toBe(400)
+    const body = (await res.json()) as { error: string }
+    expect(body.error).toBe('Validation error')
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('dedupes duplicate model names from the upstream response', async () => {
+    grantWorkspaceAccess()
+    mockGetBYOKKey.mockResolvedValue({ apiKey: 'byok-ollama-key' })
+    mockFetch.mockResolvedValue(
+      okResponse({
+        models: [{ name: 'gpt-oss:120b' }, { name: 'gpt-oss:120b' }, { name: 'qwen3-coder:480b' }],
+      })
+    )
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({
+      models: ['ollama-cloud/gpt-oss:120b', 'ollama-cloud/qwen3-coder:480b'],
+    })
+  })
+
+  it('applies the blacklist filter to the deduped model list', async () => {
+    grantWorkspaceAccess()
+    mockGetBYOKKey.mockResolvedValue({ apiKey: 'byok-ollama-key' })
+    mockFilterBlacklistedModels.mockImplementation((models: string[]) =>
+      models.filter((m) => !m.includes('qwen'))
+    )
+    mockFetch.mockResolvedValue(
+      okResponse({
+        models: [{ name: 'gpt-oss:120b' }, { name: 'qwen3-coder:480b' }],
+      })
+    )
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: ['ollama-cloud/gpt-oss:120b'] })
+    expect(mockFilterBlacklistedModels).toHaveBeenCalledWith([
+      'ollama-cloud/gpt-oss:120b',
+      'ollama-cloud/qwen3-coder:480b',
+    ])
+  })
+})

apps/sim/app/api/providers/ollama-cloud/models/route.ts

@@ -0,0 +1,91 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import {
+  ollamaCloudProviderModelsQuerySchema,
+  ollamaUpstreamResponseSchema,
+  providerModelsResponseSchema,
+} from '@/lib/api/contracts/providers'
+import { validationErrorResponse } from '@/lib/api/server'
+import { getBYOKKey } from '@/lib/api-key/byok'
+import { getSession } from '@/lib/auth'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
+import { filterBlacklistedModels, isProviderBlacklisted } from '@/providers/utils'
+
+const logger = createLogger('OllamaCloudModelsAPI')
+
+/**
+ * Get available Ollama Cloud models.
+ *
+ * Ollama Cloud is BYOK-only — Sim never supplies a hosted key and never bills
+ * usage. Models are listed only when the workspace has stored its own Ollama
+ * API key, which is used to authenticate against the cloud `/api/tags` endpoint.
+ */
+export const GET = withRouteHandler(async (request: NextRequest) => {
+  if (isProviderBlacklisted('ollama-cloud')) {
+    logger.info('Ollama Cloud provider is blacklisted, returning empty models')
+    return NextResponse.json({ models: [] })
+  }
+
+  const queryValidation = ollamaCloudProviderModelsQuerySchema.safeParse({
+    workspaceId: request.nextUrl.searchParams.get('workspaceId') ?? undefined,
+  })
+  if (!queryValidation.success) return validationErrorResponse(queryValidation.error)
+  const { workspaceId } = queryValidation.data
+
+  let apiKey: string | undefined
+  if (workspaceId) {
+    const session = await getSession()
+    if (session?.user?.id) {
+      const permission = await getUserEntityPermissions(session.user.id, 'workspace', workspaceId)
+      if (permission) {
+        const byokResult = await getBYOKKey(workspaceId, 'ollama-cloud')
+        if (byokResult) {
+          apiKey = byokResult.apiKey
+        }
+      }
+    }
+  }
+
+  if (!apiKey) {
+    logger.info('No Ollama Cloud API key available, returning empty models')
+    return NextResponse.json({ models: [] })
+  }
+
+  try {
+    const response = await fetch('https://ollama.com/api/tags', {
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        'Content-Type': 'application/json',
+      },
+      cache: 'no-store',
+    })
+
+    if (!response.ok) {
+      logger.warn('Failed to fetch Ollama Cloud models', {
+        status: response.status,
+        statusText: response.statusText,
+      })
+      return NextResponse.json({ models: [] })
+    }
+
+    const data = ollamaUpstreamResponseSchema.parse(await response.json())
+
+    const allModels = data.models.map((model) => `ollama-cloud/${model.name}`)
+    const uniqueModels = Array.from(new Set(allModels))
+    const models = filterBlacklistedModels(uniqueModels)
+
+    logger.info('Successfully fetched Ollama Cloud models', {
+      count: models.length,
+      filtered: uniqueModels.length - models.length,
+    })
+
+    return NextResponse.json(providerModelsResponseSchema.parse({ models }))
+  } catch (error) {
+    logger.error('Error fetching Ollama Cloud models', {
+      error: getErrorMessage(error, 'Unknown error'),
+    })
+    return NextResponse.json({ models: [] })
+  }
+})

apps/sim/app/api/providers/ollama/models/route.ts

@@ -0,0 +1,63 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import {
+  ollamaUpstreamResponseSchema,
+  providerModelsResponseSchema,
+} from '@/lib/api/contracts/providers'
+import { getOllamaUrl } from '@/lib/core/utils/urls'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { filterBlacklistedModels, isProviderBlacklisted } from '@/providers/utils'
+
+const logger = createLogger('OllamaModelsAPI')
+const OLLAMA_HOST = getOllamaUrl()
+
+/**
+ * Get available Ollama models
+ */
+export const GET = withRouteHandler(async (_request: NextRequest) => {
+  if (isProviderBlacklisted('ollama')) {
+    logger.info('Ollama provider is blacklisted, returning empty models')
+    return NextResponse.json({ models: [] })
+  }
+
+  try {
+    logger.info('Fetching Ollama models', {
+      host: OLLAMA_HOST,
+    })
+
+    const response = await fetch(`${OLLAMA_HOST}/api/tags`, {
+      headers: {
+        'Content-Type': 'application/json',
+      },
+      next: { revalidate: 60 },
+    })
+
+    if (!response.ok) {
+      logger.warn('Ollama service is not available', {
+        status: response.status,
+        statusText: response.statusText,
+      })
+      return NextResponse.json({ models: [] })
+    }
+
+    const data = ollamaUpstreamResponseSchema.parse(await response.json())
+    const allModels = data.models.map((model) => model.name)
+    const models = filterBlacklistedModels(allModels)
+
+    logger.info('Successfully fetched Ollama models', {
+      count: models.length,
+      filtered: allModels.length - models.length,
+      models,
+    })
+
+    return NextResponse.json(providerModelsResponseSchema.parse({ models }))
+  } catch (error) {
+    logger.error('Failed to fetch Ollama models', {
+      error: getErrorMessage(error, 'Unknown error'),
+      host: OLLAMA_HOST,
+    })
+
+    return NextResponse.json({ models: [] })
+  }
+})

apps/sim/app/api/providers/openrouter/models/route.ts

@@ -0,0 +1,102 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import {
+  openRouterUpstreamResponseSchema,
+  providerModelsResponseSchema,
+} from '@/lib/api/contracts/providers'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { filterBlacklistedModels, isProviderBlacklisted } from '@/providers/utils'
+
+const logger = createLogger('OpenRouterModelsAPI')
+
+interface OpenRouterModel {
+  id: string
+  context_length?: number
+  supported_parameters?: string[]
+  pricing?: {
+    prompt?: string
+    completion?: string
+  }
+}
+
+interface OpenRouterResponse {
+  data: OpenRouterModel[]
+}
+
+export interface OpenRouterModelInfo {
+  id: string
+  contextLength?: number
+  supportsStructuredOutputs?: boolean
+  supportsTools?: boolean
+  pricing?: {
+    input: number
+    output: number
+  }
+}
+
+export const GET = withRouteHandler(async (_request: NextRequest) => {
+  if (isProviderBlacklisted('openrouter')) {
+    logger.info('OpenRouter provider is blacklisted, returning empty models')
+    return NextResponse.json({ models: [], modelInfo: {} })
+  }
+
+  try {
+    const response = await fetch('https://openrouter.ai/api/v1/models', {
+      headers: { 'Content-Type': 'application/json' },
+      next: { revalidate: 300 },
+    })
+
+    if (!response.ok) {
+      logger.warn('Failed to fetch OpenRouter models', {
+        status: response.status,
+        statusText: response.statusText,
+      })
+      return NextResponse.json({ models: [], modelInfo: {} })
+    }
+
+    const data: OpenRouterResponse = openRouterUpstreamResponseSchema.parse(await response.json())
+
+    const modelInfo: Record<string, OpenRouterModelInfo> = {}
+    const allModels: string[] = []
+
+    for (const model of data.data ?? []) {
+      const modelId = `openrouter/${model.id}`
+      allModels.push(modelId)
+
+      const supportedParams = model.supported_parameters ?? []
+      modelInfo[modelId] = {
+        id: modelId,
+        contextLength: model.context_length,
+        supportsStructuredOutputs: supportedParams.includes('structured_outputs'),
+        supportsTools: supportedParams.includes('tools'),
+        pricing: model.pricing
+          ? {
+              input: Number.parseFloat(model.pricing.prompt ?? '0') * 1000000,
+              output: Number.parseFloat(model.pricing.completion ?? '0') * 1000000,
+            }
+          : undefined,
+      }
+    }
+
+    const uniqueModels = Array.from(new Set(allModels))
+    const models = filterBlacklistedModels(uniqueModels)
+
+    const structuredOutputCount = Object.values(modelInfo).filter(
+      (m) => m.supportsStructuredOutputs
+    ).length
+
+    logger.info('Successfully fetched OpenRouter models', {
+      count: models.length,
+      filtered: uniqueModels.length - models.length,
+      withStructuredOutputs: structuredOutputCount,
+    })
+
+    return NextResponse.json(providerModelsResponseSchema.parse({ models, modelInfo }))
+  } catch (error) {
+    logger.error('Error fetching OpenRouter models', {
+      error: getErrorMessage(error, 'Unknown error'),
+    })
+    return NextResponse.json({ models: [], modelInfo: {} })
+  }
+})

apps/sim/app/api/providers/route.ts

@@ -0,0 +1,450 @@
+import { db } from '@sim/db'
+import { account } from '@sim/db/schema'
+import { createLogger } from '@sim/logger'
+import { getErrorMessage, toError } from '@sim/utils/errors'
+import { eq } from 'drizzle-orm'
+import { type NextRequest, NextResponse } from 'next/server'
+import { executeProviderContract } from '@/lib/api/contracts/providers'
+import { parseRequest } from '@/lib/api/server'
+import { authorizeCredentialUse } from '@/lib/auth/credential-access'
+import { checkInternalAuth } from '@/lib/auth/hybrid'
+import { generateRequestId } from '@/lib/core/utils/request'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { checkWorkspaceAccess } from '@/lib/workspaces/permissions/utils'
+import {
+  getServiceAccountToken,
+  refreshTokenIfNeeded,
+  resolveOAuthAccountId,
+} from '@/app/api/auth/oauth/utils'
+import {
+  assertPermissionsAllowed,
+  IntegrationNotAllowedError,
+  ModelNotAllowedError,
+  ProviderNotAllowedError,
+} from '@/ee/access-control/utils/permission-check'
+import type { StreamingExecution } from '@/executor/types'
+import { executeProviderRequest } from '@/providers'
+
+const logger = createLogger('ProvidersAPI')
+
+export const dynamic = 'force-dynamic'
+
+/**
+ * Server-side proxy for provider requests
+ */
+export const POST = withRouteHandler(async (request: NextRequest) => {
+  const requestId = generateRequestId()
+  const startTime = Date.now()
+
+  try {
+    const auth = await checkInternalAuth(request, { requireWorkflowId: false })
+    if (!auth.success || !auth.userId) {
+      return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+    }
+
+    logger.info(`[${requestId}] Provider API request started`, {
+      timestamp: new Date().toISOString(),
+      userAgent: request.headers.get('User-Agent'),
+      contentType: request.headers.get('Content-Type'),
+    })
+
+    const validation = await parseRequest(
+      executeProviderContract,
+      request,
+      {},
+      {
+        validationErrorResponse: () =>
+          NextResponse.json({ error: 'Invalid request body' }, { status: 400 }),
+        invalidJsonResponse: () =>
+          NextResponse.json({ error: 'Invalid request body' }, { status: 400 }),
+      }
+    )
+    if (!validation.success) return validation.response
+
+    const body = validation.data.body
+    const {
+      provider,
+      model,
+      systemPrompt,
+      context,
+      tools,
+      temperature,
+      maxTokens,
+      apiKey,
+      azureEndpoint,
+      azureApiVersion,
+      vertexProject,
+      vertexLocation,
+      vertexCredential,
+      bedrockAccessKeyId,
+      bedrockSecretKey,
+      bedrockRegion,
+      responseFormat,
+      workflowId,
+      workspaceId,
+      stream,
+      messages,
+      environmentVariables,
+      workflowVariables,
+      blockData,
+      blockNameMapping,
+      reasoningEffort,
+      verbosity,
+    } = body
+
+    logger.info(`[${requestId}] Provider request details`, {
+      provider,
+      model,
+      hasSystemPrompt: !!systemPrompt,
+      hasContext: !!context,
+      hasTools: !!tools?.length,
+      toolCount: tools?.length || 0,
+      hasApiKey: !!apiKey,
+      hasAzureEndpoint: !!azureEndpoint,
+      hasAzureApiVersion: !!azureApiVersion,
+      hasVertexProject: !!vertexProject,
+      hasVertexLocation: !!vertexLocation,
+      hasVertexCredential: !!vertexCredential,
+      hasBedrockAccessKeyId: !!bedrockAccessKeyId,
+      hasBedrockSecretKey: !!bedrockSecretKey,
+      hasBedrockRegion: !!bedrockRegion,
+      hasResponseFormat: !!responseFormat,
+      workflowId,
+      stream: !!stream,
+      hasMessages: !!messages?.length,
+      messageCount: messages?.length || 0,
+      hasEnvironmentVariables:
+        !!environmentVariables && Object.keys(environmentVariables).length > 0,
+      hasWorkflowVariables: !!workflowVariables && Object.keys(workflowVariables).length > 0,
+      reasoningEffort,
+      verbosity,
+    })
+
+    if (workspaceId) {
+      const workspaceAccess = await checkWorkspaceAccess(workspaceId, auth.userId)
+      if (!workspaceAccess.hasAccess) {
+        return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
+      }
+
+      try {
+        await assertPermissionsAllowed({
+          userId: auth.userId,
+          workspaceId,
+          model,
+        })
+      } catch (err) {
+        if (
+          err instanceof ProviderNotAllowedError ||
+          err instanceof ModelNotAllowedError ||
+          err instanceof IntegrationNotAllowedError
+        ) {
+          return NextResponse.json({ error: err.message }, { status: 403 })
+        }
+        throw err
+      }
+    }
+
+    let finalApiKey: string | undefined = apiKey
+    try {
+      if (provider === 'vertex' && vertexCredential) {
+        const vertexCredAccess = await authorizeCredentialUse(request, {
+          credentialId: vertexCredential,
+          workflowId: workflowId || undefined,
+          requireWorkflowIdForInternal: false,
+        })
+        if (!vertexCredAccess.ok) {
+          logger.warn(`[${requestId}] Vertex credential access denied`, {
+            error: vertexCredAccess.error,
+            credentialId: vertexCredential,
+          })
+          return NextResponse.json(
+            { error: vertexCredAccess.error || 'Unauthorized' },
+            { status: 401 }
+          )
+        }
+        finalApiKey = await resolveVertexCredential(requestId, vertexCredential)
+      }
+    } catch (error) {
+      logger.error(`[${requestId}] Failed to resolve Vertex credential:`, {
+        provider,
+        model,
+        error: toError(error).message,
+        hasVertexCredential: !!vertexCredential,
+      })
+      return NextResponse.json(
+        { error: getErrorMessage(error, 'Credential error') },
+        { status: 400 }
+      )
+    }
+
+    logger.info(`[${requestId}] Executing provider request`, {
+      provider,
+      model,
+      workflowId,
+      hasApiKey: !!finalApiKey,
+    })
+
+    const response = await executeProviderRequest(provider, {
+      model,
+      systemPrompt,
+      context,
+      tools,
+      temperature,
+      maxTokens,
+      apiKey: finalApiKey,
+      azureEndpoint,
+      azureApiVersion,
+      vertexProject,
+      vertexLocation,
+      bedrockAccessKeyId,
+      bedrockSecretKey,
+      bedrockRegion,
+      responseFormat,
+      workflowId,
+      workspaceId,
+      userId: auth.userId,
+      stream,
+      messages,
+      environmentVariables,
+      workflowVariables,
+      blockData,
+      blockNameMapping,
+      reasoningEffort,
+      verbosity,
+    })
+
+    const executionTime = Date.now() - startTime
+    logger.info(`[${requestId}] Provider request completed successfully`, {
+      provider,
+      model,
+      workflowId,
+      executionTime,
+      responseType:
+        response instanceof ReadableStream
+          ? 'stream'
+          : response && typeof response === 'object' && 'stream' in response
+            ? 'streaming-execution'
+            : 'json',
+    })
+
+    // Check if the response is a StreamingExecution
+    if (
+      response &&
+      typeof response === 'object' &&
+      'stream' in response &&
+      'execution' in response
+    ) {
+      const streamingExec = response as StreamingExecution
+      logger.info(`[${requestId}] Received StreamingExecution from provider`)
+
+      // Extract the stream and execution data
+      const stream = streamingExec.stream
+      const executionData = streamingExec.execution
+
+      // Attach the execution data as a custom header
+      // We need to safely serialize the execution data to avoid circular references
+      let executionDataHeader
+      try {
+        // Create a safe version of execution data with the most important fields
+        const safeExecutionData = {
+          success: executionData.success,
+          output: {
+            // Sanitize content to remove non-ASCII characters that would cause ByteString errors
+            content: executionData.output?.content
+              ? String(executionData.output.content).replace(/[\u0080-\uFFFF]/g, '')
+              : '',
+            model: executionData.output?.model,
+            tokens: executionData.output?.tokens || {
+              input: 0,
+              output: 0,
+              total: 0,
+            },
+            // Sanitize any potential Unicode characters in tool calls
+            toolCalls: executionData.output?.toolCalls
+              ? sanitizeToolCalls(executionData.output.toolCalls)
+              : undefined,
+            providerTiming: executionData.output?.providerTiming,
+            cost: executionData.output?.cost,
+          },
+          error: executionData.error,
+          logs: [], // Strip logs from header to avoid encoding issues
+          metadata: {
+            startTime: executionData.metadata?.startTime,
+            endTime: executionData.metadata?.endTime,
+            duration: executionData.metadata?.duration,
+          },
+          isStreaming: true, // Always mark streaming execution data as streaming
+          blockId: executionData.logs?.[0]?.blockId,
+          blockName: executionData.logs?.[0]?.blockName,
+          blockType: executionData.logs?.[0]?.blockType,
+        }
+        executionDataHeader = JSON.stringify(safeExecutionData)
+      } catch (error) {
+        logger.error(`[${requestId}] Failed to serialize execution data:`, error)
+        executionDataHeader = JSON.stringify({
+          success: executionData.success,
+          error: 'Failed to serialize full execution data',
+        })
+      }
+
+      // Return the stream with execution data in a header
+      return new Response(stream, {
+        headers: {
+          'Content-Type': 'text/event-stream',
+          'Cache-Control': 'no-cache',
+          Connection: 'keep-alive',
+          'X-Execution-Data': executionDataHeader,
+        },
+      })
+    }
+
+    // Check if the response is a ReadableStream for streaming
+    if (response instanceof ReadableStream) {
+      logger.info(`[${requestId}] Streaming response from provider`)
+      return new Response(response, {
+        headers: {
+          'Content-Type': 'text/event-stream',
+          'Cache-Control': 'no-cache',
+          Connection: 'keep-alive',
+        },
+      })
+    }
+
+    // Return regular JSON response for non-streaming
+    return NextResponse.json(response)
+  } catch (error) {
+    const executionTime = Date.now() - startTime
+    logger.error(`[${requestId}] Provider request failed:`, {
+      error: toError(error).message,
+      errorName: error instanceof Error ? error.name : 'Unknown',
+      errorStack: error instanceof Error ? error.stack : undefined,
+      executionTime,
+      timestamp: new Date().toISOString(),
+    })
+
+    return NextResponse.json({ error: toError(error).message }, { status: 500 })
+  }
+})
+
+/**
+ * Helper function to sanitize tool calls to remove Unicode characters
+ */
+function sanitizeToolCalls(toolCalls: any) {
+  // If it's an object with a list property, sanitize the list
+  if (toolCalls && typeof toolCalls === 'object' && Array.isArray(toolCalls.list)) {
+    return {
+      ...toolCalls,
+      list: toolCalls.list.map(sanitizeToolCall),
+    }
+  }
+
+  // If it's an array, sanitize each item
+  if (Array.isArray(toolCalls)) {
+    return toolCalls.map(sanitizeToolCall)
+  }
+
+  return toolCalls
+}
+
+/**
+ * Sanitize a single tool call to remove Unicode characters
+ */
+function sanitizeToolCall(toolCall: any) {
+  if (!toolCall || typeof toolCall !== 'object') return toolCall
+
+  // Create a sanitized copy
+  const sanitized = { ...toolCall }
+
+  // Sanitize any string fields that might contain Unicode
+  if (typeof sanitized.name === 'string') {
+    sanitized.name = sanitized.name.replace(/[\u0080-\uFFFF]/g, '')
+  }
+
+  // Sanitize input/arguments
+  if (sanitized.input && typeof sanitized.input === 'object') {
+    sanitized.input = sanitizeObject(sanitized.input)
+  }
+
+  if (sanitized.arguments && typeof sanitized.arguments === 'object') {
+    sanitized.arguments = sanitizeObject(sanitized.arguments)
+  }
+
+  // Sanitize output/result
+  if (sanitized.output && typeof sanitized.output === 'object') {
+    sanitized.output = sanitizeObject(sanitized.output)
+  }
+
+  if (sanitized.result && typeof sanitized.result === 'object') {
+    sanitized.result = sanitizeObject(sanitized.result)
+  }
+
+  // Sanitize error message
+  if (typeof sanitized.error === 'string') {
+    sanitized.error = sanitized.error.replace(/[\u0080-\uFFFF]/g, '')
+  }
+
+  return sanitized
+}
+
+/**
+ * Recursively sanitize an object to remove Unicode characters from strings
+ */
+function sanitizeObject(obj: any): any {
+  if (!obj || typeof obj !== 'object') return obj
+
+  // Handle arrays
+  if (Array.isArray(obj)) {
+    return obj.map((item) => sanitizeObject(item))
+  }
+
+  // Handle objects
+  const result: any = {}
+  for (const [key, value] of Object.entries(obj)) {
+    if (typeof value === 'string') {
+      result[key] = value.replace(/[\u0080-\uFFFF]/g, '')
+    } else if (typeof value === 'object' && value !== null) {
+      result[key] = sanitizeObject(value)
+    } else {
+      result[key] = value
+    }
+  }
+
+  return result
+}
+
+/**
+ * Resolves a Vertex AI OAuth credential to an access token
+ */
+async function resolveVertexCredential(requestId: string, credentialId: string): Promise<string> {
+  logger.info(`[${requestId}] Resolving Vertex AI credential: ${credentialId}`)
+
+  const resolved = await resolveOAuthAccountId(credentialId)
+  if (!resolved) {
+    throw new Error(`Vertex AI credential not found: ${credentialId}`)
+  }
+
+  if (resolved.credentialType === 'service_account' && resolved.credentialId) {
+    const accessToken = await getServiceAccountToken(resolved.credentialId, [
+      'https://www.googleapis.com/auth/cloud-platform',
+    ])
+    logger.info(`[${requestId}] Successfully resolved Vertex AI service account credential`)
+    return accessToken
+  }
+
+  const credential = await db.query.account.findFirst({
+    where: eq(account.id, resolved.accountId),
+  })
+
+  if (!credential) {
+    throw new Error(`Vertex AI credential not found: ${credentialId}`)
+  }
+
+  const { accessToken } = await refreshTokenIfNeeded(requestId, credential, resolved.accountId)
+
+  if (!accessToken) {
+    throw new Error('Failed to get Vertex AI access token')
+  }
+
+  logger.info(`[${requestId}] Successfully resolved Vertex AI credential`)
+  return accessToken
+}

apps/sim/app/api/providers/together/models/route.test.ts

@@ -0,0 +1,259 @@
+/**
+ * @vitest-environment node
+ */
+import { createMockRequest } from '@sim/testing'
+import { beforeEach, describe, expect, it, vi } from 'vitest'
+
+const {
+  mockFilterBlacklistedModels,
+  mockIsProviderBlacklisted,
+  mockGetBYOKKey,
+  mockGetSession,
+  mockGetUserEntityPermissions,
+  mockFetch,
+  mutableEnv,
+} = vi.hoisted(() => ({
+  mockFilterBlacklistedModels: vi.fn(),
+  mockIsProviderBlacklisted: vi.fn(),
+  mockGetBYOKKey: vi.fn(),
+  mockGetSession: vi.fn(),
+  mockGetUserEntityPermissions: vi.fn(),
+  mockFetch: vi.fn(),
+  mutableEnv: { TOGETHER_API_KEY: undefined as string | undefined },
+}))
+
+vi.mock('@/providers/utils', () => ({
+  filterBlacklistedModels: mockFilterBlacklistedModels,
+  isProviderBlacklisted: mockIsProviderBlacklisted,
+}))
+
+vi.mock('@/lib/api-key/byok', () => ({
+  getBYOKKey: mockGetBYOKKey,
+}))
+
+vi.mock('@/lib/auth', () => ({
+  getSession: mockGetSession,
+}))
+
+vi.mock('@/lib/workspaces/permissions/utils', () => ({
+  getUserEntityPermissions: mockGetUserEntityPermissions,
+}))
+
+vi.mock('@/lib/core/config/env', () => ({
+  env: mutableEnv,
+}))
+
+import { GET } from '@/app/api/providers/together/models/route'
+
+const TOGETHER_MODELS_URL = 'https://api.together.ai/v1/models'
+
+const okResponse = (body: unknown) => ({
+  ok: true,
+  status: 200,
+  statusText: 'OK',
+  json: vi.fn().mockResolvedValue(body),
+})
+
+const errorResponse = (status: number, statusText = 'Unauthorized') => ({
+  ok: false,
+  status,
+  statusText,
+  json: vi.fn().mockResolvedValue({}),
+})
+
+/**
+ * Builds a request whose query string carries the given workspaceId. Passing
+ * `undefined` omits the param entirely; passing `''` produces `?workspaceId=`.
+ */
+const requestWithWorkspace = (workspaceId?: string) => {
+  const url = new URL('http://localhost:3000/api/providers/together/models')
+  if (workspaceId !== undefined) {
+    url.searchParams.set('workspaceId', workspaceId)
+  }
+  return createMockRequest('GET', undefined, {}, url.toString())
+}
+
+const fetchAuthHeader = () => {
+  const init = mockFetch.mock.calls[0]?.[1] as RequestInit | undefined
+  const headers = init?.headers as Record<string, string> | undefined
+  return headers?.Authorization
+}
+
+describe('GET /api/providers/together/models', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    vi.stubGlobal('fetch', mockFetch)
+
+    mutableEnv.TOGETHER_API_KEY = undefined
+    mockIsProviderBlacklisted.mockReturnValue(false)
+    mockFilterBlacklistedModels.mockImplementation((models: string[]) => models)
+    mockGetBYOKKey.mockResolvedValue(null)
+    mockGetSession.mockResolvedValue(null)
+    mockGetUserEntityPermissions.mockResolvedValue(null)
+  })
+
+  it('returns empty models without calling fetch when the provider is blacklisted', async () => {
+    mockIsProviderBlacklisted.mockReturnValue(true)
+
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('returns empty models when there is no workspaceId and no env key', async () => {
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('fetches with the env key and prefixes each model id with together/', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockFetch.mockResolvedValue(
+      okResponse([{ id: 'moonshotai/Kimi-K2-Instruct' }, { id: 'Qwen/Qwen2.5-72B-Instruct-Turbo' }])
+    )
+
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({
+      models: ['together/moonshotai/Kimi-K2-Instruct', 'together/Qwen/Qwen2.5-72B-Instruct-Turbo'],
+    })
+
+    expect(mockFetch).toHaveBeenCalledTimes(1)
+    expect(mockFetch.mock.calls[0][0]).toBe(TOGETHER_MODELS_URL)
+    expect(fetchAuthHeader()).toBe('Bearer env-together-key')
+  })
+
+  it('uses the BYOK key when a workspace, session, and permission are present', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
+    mockGetUserEntityPermissions.mockResolvedValue('admin')
+    mockGetBYOKKey.mockResolvedValue({ apiKey: 'byok-together-key' })
+    mockFetch.mockResolvedValue(okResponse([{ id: 'moonshotai/Kimi-K2-Instruct' }]))
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: ['together/moonshotai/Kimi-K2-Instruct'] })
+
+    expect(mockGetBYOKKey).toHaveBeenCalledWith('ws-1', 'together')
+    expect(fetchAuthHeader()).toBe('Bearer byok-together-key')
+  })
+
+  it('falls back to the env key when a workspaceId is given but there is no session', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockGetSession.mockResolvedValue(null)
+    mockFetch.mockResolvedValue(okResponse([{ id: 'moonshotai/Kimi-K2-Instruct' }]))
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: ['together/moonshotai/Kimi-K2-Instruct'] })
+    expect(mockGetBYOKKey).not.toHaveBeenCalled()
+    expect(fetchAuthHeader()).toBe('Bearer env-together-key')
+  })
+
+  it('falls back to the env key when the session user lacks workspace permission', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockGetSession.mockResolvedValue({ user: { id: 'user-1' } })
+    mockGetUserEntityPermissions.mockResolvedValue(null)
+    mockFetch.mockResolvedValue(okResponse([{ id: 'moonshotai/Kimi-K2-Instruct' }]))
+
+    const res = await GET(requestWithWorkspace('ws-1'))
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: ['together/moonshotai/Kimi-K2-Instruct'] })
+    expect(mockGetBYOKKey).not.toHaveBeenCalled()
+    expect(fetchAuthHeader()).toBe('Bearer env-together-key')
+  })
+
+  it('returns empty models when the upstream fetch responds non-ok', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockFetch.mockResolvedValue(errorResponse(401, 'Unauthorized'))
+
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+  })
+
+  it('returns empty models when the upstream fetch throws', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockFetch.mockRejectedValue(new Error('network down'))
+
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: [] })
+  })
+
+  it('returns a validation error for an empty workspaceId query param', async () => {
+    const res = await GET(requestWithWorkspace(''))
+
+    expect(res.status).toBe(400)
+    const body = (await res.json()) as { error: string }
+    expect(body.error).toBe('Validation error')
+    expect(mockFetch).not.toHaveBeenCalled()
+  })
+
+  it('dedupes duplicate model ids from the upstream array', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockFetch.mockResolvedValue(
+      okResponse([
+        { id: 'moonshotai/Kimi-K2-Instruct' },
+        { id: 'moonshotai/Kimi-K2-Instruct' },
+        { id: 'Qwen/Qwen2.5-72B-Instruct-Turbo' },
+      ])
+    )
+
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({
+      models: ['together/moonshotai/Kimi-K2-Instruct', 'together/Qwen/Qwen2.5-72B-Instruct-Turbo'],
+    })
+  })
+
+  it('applies the blacklist filter to the deduped model list', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockFilterBlacklistedModels.mockImplementation((models: string[]) =>
+      models.filter((m) => !m.includes('Qwen'))
+    )
+    mockFetch.mockResolvedValue(
+      okResponse([{ id: 'moonshotai/Kimi-K2-Instruct' }, { id: 'Qwen/Qwen2.5-72B-Instruct-Turbo' }])
+    )
+
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({ models: ['together/moonshotai/Kimi-K2-Instruct'] })
+    expect(mockFilterBlacklistedModels).toHaveBeenCalledWith([
+      'together/moonshotai/Kimi-K2-Instruct',
+      'together/Qwen/Qwen2.5-72B-Instruct-Turbo',
+    ])
+  })
+
+  it('filters out non-chat model types (image, embedding, rerank, etc.)', async () => {
+    mutableEnv.TOGETHER_API_KEY = 'env-together-key'
+    mockFetch.mockResolvedValue(
+      okResponse([
+        { id: 'meta-llama/Llama-3.3-70B-Instruct-Turbo', type: 'chat' },
+        { id: 'black-forest-labs/FLUX.1-schnell', type: 'image' },
+        { id: 'BAAI/bge-large-en-v1.5', type: 'embedding' },
+        { id: 'Salesforce/Llama-Rank-V1', type: 'rerank' },
+        { id: 'openai/whisper-large-v3', type: 'transcribe' },
+      ])
+    )
+
+    const res = await GET(requestWithWorkspace())
+
+    expect(res.status).toBe(200)
+    expect(await res.json()).toEqual({
+      models: ['together/meta-llama/Llama-3.3-70B-Instruct-Turbo'],
+    })
+  })
+})

apps/sim/app/api/providers/together/models/route.ts

@@ -0,0 +1,105 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import {
+  providerModelsResponseSchema,
+  togetherProviderModelsQuerySchema,
+  togetherUpstreamResponseSchema,
+} from '@/lib/api/contracts/providers'
+import { validationErrorResponse } from '@/lib/api/server'
+import { getBYOKKey } from '@/lib/api-key/byok'
+import { getSession } from '@/lib/auth'
+import { env } from '@/lib/core/config/env'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { getUserEntityPermissions } from '@/lib/workspaces/permissions/utils'
+import { filterBlacklistedModels, isProviderBlacklisted } from '@/providers/utils'
+
+const logger = createLogger('TogetherModelsAPI')
+
+/** Together's catalog includes non-text models; only chat models work with chat completions. */
+const NON_CHAT_MODEL_TYPES = new Set([
+  'image',
+  'video',
+  'audio',
+  'transcribe',
+  'embedding',
+  'moderation',
+  'rerank',
+])
+
+export const GET = withRouteHandler(async (request: NextRequest) => {
+  if (isProviderBlacklisted('together')) {
+    logger.info('Together provider is blacklisted, returning empty models')
+    return NextResponse.json({ models: [] })
+  }
+
+  let apiKey: string | undefined
+
+  const queryValidation = togetherProviderModelsQuerySchema.safeParse({
+    workspaceId: request.nextUrl.searchParams.get('workspaceId') ?? undefined,
+  })
+  if (!queryValidation.success) return validationErrorResponse(queryValidation.error)
+  const { workspaceId } = queryValidation.data
+  if (workspaceId) {
+    const session = await getSession()
+    if (session?.user?.id) {
+      const permission = await getUserEntityPermissions(session.user.id, 'workspace', workspaceId)
+      if (permission) {
+        const byokResult = await getBYOKKey(workspaceId, 'together')
+        if (byokResult) {
+          apiKey = byokResult.apiKey
+        }
+      }
+    }
+  }
+
+  if (!apiKey) {
+    apiKey = env.TOGETHER_API_KEY
+  }
+
+  if (!apiKey) {
+    logger.info('No Together API key available, returning empty models')
+    return NextResponse.json({ models: [] })
+  }
+
+  try {
+    const response = await fetch('https://api.together.ai/v1/models', {
+      headers: {
+        Authorization: `Bearer ${apiKey}`,
+        'Content-Type': 'application/json',
+      },
+      cache: 'no-store',
+    })
+
+    if (!response.ok) {
+      logger.warn('Failed to fetch Together models', {
+        status: response.status,
+        statusText: response.statusText,
+      })
+      return NextResponse.json({ models: [] })
+    }
+
+    const data = togetherUpstreamResponseSchema.parse(await response.json())
+
+    const allModels: string[] = []
+    for (const model of data) {
+      if (model.type && NON_CHAT_MODEL_TYPES.has(model.type)) continue
+      allModels.push(`together/${model.id}`)
+    }
+
+    const uniqueModels = Array.from(new Set(allModels))
+    const models = filterBlacklistedModels(uniqueModels)
+
+    logger.info('Successfully fetched Together models', {
+      count: models.length,
+      filtered: uniqueModels.length - models.length,
+    })
+
+    return NextResponse.json(providerModelsResponseSchema.parse({ models }))
+  } catch (error) {
+    logger.error('Error fetching Together models', {
+      error: getErrorMessage(error, 'Unknown error'),
+    })
+    return NextResponse.json({ models: [] })
+  }
+})

apps/sim/app/api/providers/vllm/models/route.ts

@@ -0,0 +1,75 @@
+import { createLogger } from '@sim/logger'
+import { getErrorMessage } from '@sim/utils/errors'
+import { type NextRequest, NextResponse } from 'next/server'
+import {
+  providerModelsResponseSchema,
+  vllmUpstreamResponseSchema,
+} from '@/lib/api/contracts/providers'
+import { env } from '@/lib/core/config/env'
+import { withRouteHandler } from '@/lib/core/utils/with-route-handler'
+import { filterBlacklistedModels, isProviderBlacklisted } from '@/providers/utils'
+
+const logger = createLogger('VLLMModelsAPI')
+
+/**
+ * Get available vLLM models
+ */
+export const GET = withRouteHandler(async (_request: NextRequest) => {
+  if (isProviderBlacklisted('vllm')) {
+    logger.info('vLLM provider is blacklisted, returning empty models')
+    return NextResponse.json({ models: [] })
+  }
+
+  const baseUrl = (env.VLLM_BASE_URL || '').replace(/\/$/, '')
+
+  if (!baseUrl) {
+    logger.info('VLLM_BASE_URL not configured')
+    return NextResponse.json({ models: [] })
+  }
+
+  try {
+    logger.info('Fetching vLLM models', {
+      baseUrl,
+    })
+
+    const headers: Record<string, string> = {
+      'Content-Type': 'application/json',
+    }
+
+    if (env.VLLM_API_KEY) {
+      headers.Authorization = `Bearer ${env.VLLM_API_KEY}`
+    }
+
+    const response = await fetch(`${baseUrl}/v1/models`, {
+      headers,
+      next: { revalidate: 60 },
+    })
+
+    if (!response.ok) {
+      logger.warn('vLLM service is not available', {
+        status: response.status,
+        statusText: response.statusText,
+      })
+      return NextResponse.json({ models: [] })
+    }
+
+    const data = vllmUpstreamResponseSchema.parse(await response.json())
+    const allModels = data.data.map((model) => `vllm/${model.id}`)
+    const models = filterBlacklistedModels(allModels)
+
+    logger.info('Successfully fetched vLLM models', {
+      count: models.length,
+      filtered: allModels.length - models.length,
+      models,
+    })
+
+    return NextResponse.json(providerModelsResponseSchema.parse({ models }))
+  } catch (error) {
+    logger.error('Failed to fetch vLLM models', {
+      error: getErrorMessage(error, 'Unknown error'),
+      baseUrl,
+    })
+
+    return NextResponse.json({ models: [] })
+  }
+})