fix(providers): route Z.ai through the workspace BYOK resolver too

getApiKeyWithBYOK (the resolver actually used by workspace provider
runs, per providers/index.ts) only rotated server keys for
openai/anthropic/google/mistral, so GLM calls without a user apiKey
failed even with ZAI_API_KEY_1/2/3 configured — getApiKey in
providers/utils.ts had zai wired but that's not the codepath workspace
runs go through. Add zai to the hosted-check condition, and register it
as a BYOKProviderId so a workspace can also bring its own Z.ai key.

Author: waleedlatif1

apps/sim/lib/api-key/byok.ts

@@ -204,13 +204,14 @@ export async function getApiKeyWithBYOK(
   const isClaudeModel = provider === 'anthropic'
   const isGeminiModel = provider === 'google'
   const isMistralModel = provider === 'mistral'
+  const isZaiModel = provider === 'zai'
 
   const byokProviderId = isGeminiModel ? 'google' : (provider as BYOKProviderId)
 
   if (
     isHosted &&
     workspaceId &&
-    (isOpenAIModel || isClaudeModel || isGeminiModel || isMistralModel)
+    (isOpenAIModel || isClaudeModel || isGeminiModel || isMistralModel || isZaiModel)
   ) {
     const hostedModels = getHostedModels()
     const isModelHosted = hostedModels.some((m) => m.toLowerCase() === model.toLowerCase())

apps/sim/lib/api/contracts/byok-keys.ts

@@ -6,6 +6,7 @@ export const byokProviderIdSchema = z.enum([
   'anthropic',
   'google',
   'mistral',
+  'zai',
   'fireworks',
   'together',
   'baseten',

apps/sim/tools/types.ts

@@ -7,6 +7,7 @@ export type BYOKProviderId =
   | 'anthropic'
   | 'google'
   | 'mistral'
+  | 'zai'
   | 'fireworks'
   | 'together'
   | 'baseten'