@celestea/studio 2.7.1

package/dist/store/prompts.js

@@ -0,0 +1,273 @@
+/**
+ * Prompt registry store — global `prompts.json` + per-workspace
+ * `<CELESTEA_HOME>/workspaces/<ws>/prompts.json` (W880; legacy
+ * `<ws>/.celestea-prompts.json` stays readable) (`contracts/data-files/prompts.schema.json`,
+ * `src/prompts.rs:560-880`).
+ *
+ * Tolerated-on-read, strict-on-write: a missing OR malformed registry file
+ * degrades to an empty one (the registry must never break compose or the UI),
+ * while every write validates the id and every override template before the
+ * file is touched. There are four registry levels — builtin → global →
+ * workspace → the bound prompt's `section_overrides` — and writing is
+ * `persist -> hot apply -> roll the file back when the apply fails`.
+ */
+import { readFileSync, rmSync } from "node:fs";
+import { existsSync } from "node:fs";
+import { readJsonIfExists, writeJsonAtomic } from "./fs-json.js";
+import { badRequest, errText, fail, notFound, ok } from "./result.js";
+import { validatePromptId } from "./validate.js";
+import { ORDER_FALLBACK, validateTemplate } from "./prompts-template.js";
+import { builtinRowsFor } from "./builtin-sections.js";
+import { DEFAULT_SESSION_MODE } from "./mode.js";
+import { promptsFileCandidates } from "./session-id.js";
+const EMPTY = { sections: [], prompts: [], default_prompt: null };
+function parseSections(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const row of raw) {
+        if (typeof row !== "object" || row === null)
+            continue;
+        const rec = row;
+        const id = rec["id"];
+        const template = rec["template"];
+        if (typeof id !== "string" || id === "" || typeof template !== "string")
+            continue;
+        out.push({
+            id,
+            name: typeof rec["name"] === "string" ? rec["name"] : id,
+            template,
+            order: typeof rec["order"] === "number" ? Math.trunc(rec["order"]) : ORDER_FALLBACK,
+        });
+    }
+    return out;
+}
+function parsePrompts(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const row of raw) {
+        if (typeof row !== "object" || row === null)
+            continue;
+        const rec = row;
+        const id = rec["id"];
+        if (typeof id !== "string" || validatePromptId(id) !== null)
+            continue;
+        const overrides = {};
+        const rawOverrides = rec["section_overrides"];
+        if (typeof rawOverrides === "object" && rawOverrides !== null) {
+            for (const [k, v] of Object.entries(rawOverrides)) {
+                if (typeof v === "string")
+                    overrides[k] = v;
+            }
+        }
+        out.push({ id, name: typeof rec["name"] === "string" ? rec["name"] : id, section_overrides: overrides, is_default: rec["is_default"] === true });
+    }
+    return out;
+}
+export class PromptsStore {
+    globalFile;
+    constructor(globalFile) {
+        this.globalFile = globalFile;
+    }
+    scopeGlobal() {
+        return { kind: "global", workspace: null, file: this.globalFile, files: [this.globalFile] };
+    }
+    scopeWorkspace(name, wsPath) {
+        const files = promptsFileCandidates(wsPath);
+        return { kind: "workspace", workspace: name, file: files[0], files };
+    }
+    /**
+     * Tolerant read: missing OR malformed both degrade to an empty registry. The
+     * first EXISTING candidate wins (canonical, then the legacy locations).
+     */
+    read(scope) {
+        const file = scope.files.find((candidate) => existsSync(candidate));
+        if (file === undefined)
+            return { ...EMPTY, sections: [], prompts: [] };
+        const out = readJsonIfExists(file);
+        if (!out.exists || out.error !== undefined)
+            return { ...EMPTY, sections: [], prompts: [] };
+        const rec = (typeof out.value === "object" && out.value !== null ? out.value : {});
+        const def = rec["default_prompt"];
+        return {
+            sections: parseSections(rec["sections"]),
+            prompts: parsePrompts(rec["prompts"]),
+            default_prompt: typeof def === "string" && def !== "" ? def : null,
+        };
+    }
+    /** Raw file text (the rollback snapshot for a failed hot apply). */
+    snapshot(scope) {
+        return existsSync(scope.file) ? readFileSync(scope.file, "utf8") : null;
+    }
+    /**
+     * Roll a failed hot apply back to its snapshot.
+     *
+     * W815-1: a null snapshot means the scope file did NOT exist before the
+     * mutate, so "back to the snapshot" is "remove the file" — returning early
+     * left the fresh content on disk while the engine had rejected it (registry
+     * ahead of the engine). A present snapshot is restored verbatim.
+     */
+    restore(scope, text) {
+        if (text === null) {
+            rmSync(scope.file, { force: true });
+            return;
+        }
+        writeJsonAtomic(scope.file, JSON.parse(text));
+    }
+    persist(scope, data) {
+        try {
+            writeJsonAtomic(scope.file, data);
+            return ok(undefined);
+        }
+        catch (e) {
+            return fail(500, errText(e));
+        }
+    }
+    find(scope, id) {
+        return this.read(scope).prompts.find((p) => p.id === id);
+    }
+    /** `default_prompt` of this scope, falling back to the global one. */
+    defaultFor(scope) {
+        const own = this.read(scope);
+        if (scope.kind === "workspace" && own.default_prompt !== null)
+            return { id: own.default_prompt, scope: "workspace" };
+        if (scope.kind === "workspace") {
+            const global = this.read(this.scopeGlobal());
+            return global.default_prompt === null ? null : { id: global.default_prompt, scope: "global" };
+        }
+        return own.default_prompt === null ? null : { id: own.default_prompt, scope: "global" };
+    }
+    promptList(scope) {
+        const ws = scope.kind === "workspace" ? this.read(scope) : { ...EMPTY, prompts: [] };
+        const global = this.read(this.scopeGlobal());
+        const wsIds = new Set(ws.prompts.map((p) => p.id));
+        const rows = global.prompts.map((p) => ({ ...p, scope: "global", shadowed: scope.kind === "workspace" && wsIds.has(p.id) }));
+        if (scope.kind === "workspace")
+            rows.push(...ws.prompts.map((p) => ({ ...p, scope: "workspace", shadowed: false })));
+        return rows;
+    }
+    /** GET /api/prompts body (handler fills `active_prompt`). */
+    list(scope, activePrompt) {
+        return {
+            ok: true,
+            scope: scope.kind,
+            workspace: scope.workspace,
+            global_file: this.globalFile,
+            // The listing has no mode of its own: it shows the `standard` variant
+            // (the UI mode selector is P1, and every P0 session defaults to standard).
+            sections: this.effective(scope, null, DEFAULT_SESSION_MODE).rows,
+            prompts: this.promptList(scope),
+            default_prompt: this.defaultFor(scope),
+            active_prompt: activePrompt,
+        };
+    }
+    effective(scope, boundId, mode) {
+        return composeSections({
+            global: scope.kind === "workspace" ? this.read(this.scopeGlobal()) : this.read(scope),
+            workspace: scope.kind === "workspace" ? this.read(scope) : null,
+            bound: boundId === null ? null : (this.find(scope, boundId) ?? null),
+            mode,
+        });
+    }
+    /**
+     * The registry-resolved sections (used by the sections listing and by
+     * `build_gen`). `mode` swaps the `tool_access` builtin VARIANT (W729/K6); it
+     * never adds or removes a row.
+     */
+    sections(scope, boundId = null, mode = DEFAULT_SESSION_MODE) {
+        return this.effective(scope, boundId, mode).rows;
+    }
+    upsert(scope, req) {
+        const idError = validatePromptId(req.id);
+        if (idError !== null)
+            return badRequest(idError);
+        const overrides = req.section_overrides ?? {};
+        for (const [sectionId, template] of Object.entries(overrides)) {
+            const bad = validateTemplate(template);
+            if (bad !== null)
+                return badRequest(`section '${sectionId}': ${bad.error}`);
+        }
+        const data = this.read(scope);
+        const idx = data.prompts.findIndex((p) => p.id === req.id);
+        const previous = idx >= 0 ? data.prompts[idx] : undefined;
+        const isDefault = req.is_default ?? previous?.is_default ?? false;
+        const entry = { id: req.id, name: req.name, section_overrides: overrides, is_default: isDefault };
+        if (idx >= 0)
+            data.prompts[idx] = entry;
+        else
+            data.prompts.push(entry);
+        if (isDefault) {
+            for (const p of data.prompts)
+                if (p.id !== req.id)
+                    p.is_default = false;
+        }
+        const saved = this.persist(scope, data);
+        if (!saved.ok)
+            return saved;
+        return ok({ id: req.id, scope: scope.kind, hot_applied: true });
+    }
+    remove(scope, rawId) {
+        const data = this.read(scope);
+        const idx = data.prompts.findIndex((p) => p.id === rawId);
+        if (idx < 0)
+            return notFound(`unknown prompt '${rawId}'`);
+        data.prompts.splice(idx, 1);
+        if (data.default_prompt === rawId)
+            data.default_prompt = null;
+        const saved = this.persist(scope, data);
+        if (!saved.ok)
+            return saved;
+        return ok({ scope: scope.kind, hot_applied: true });
+    }
+    setDefault(scope, rawId) {
+        const data = this.read(scope);
+        const idx = data.prompts.findIndex((p) => p.id === rawId);
+        if (idx < 0)
+            return notFound(`unknown prompt '${rawId}'`);
+        data.default_prompt = rawId;
+        for (const p of data.prompts)
+            p.is_default = p.id === rawId;
+        const saved = this.persist(scope, data);
+        if (!saved.ok)
+            return saved;
+        return ok({ default_prompt: rawId, scope: scope.kind, hot_applied: true });
+    }
+}
+/**
+ * Four-level overlay: builtin -> global -> workspace -> bound overrides.
+ * A known id keeps its ORIGINAL order and only swaps its template; an unknown
+ * id is appended with ORDER_FALLBACK and sorted by `(order, id)`.
+ */
+export function composeSections(input) {
+    const rows = [];
+    const seen = new Map();
+    const push = (id, name, template, order, source) => {
+        const at = seen.get(id);
+        if (at === undefined) {
+            seen.set(id, rows.length);
+            rows.push({ id, name, template, order, source });
+        }
+        else {
+            const row = rows[at];
+            row.template = template;
+            if (source !== "builtin")
+                row.source = source;
+        }
+    };
+    for (const s of builtinRowsFor(input.mode ?? DEFAULT_SESSION_MODE))
+        push(s.id, s.name, s.template, s.order, "builtin");
+    for (const s of input.global.sections)
+        push(s.id, s.name, s.template, s.order, "global");
+    if (input.workspace !== null)
+        for (const s of input.workspace.sections)
+            push(s.id, s.name, s.template, s.order, "workspace");
+    if (input.bound !== null) {
+        for (const [id, template] of Object.entries(input.bound.section_overrides)) {
+            push(id, id, template, ORDER_FALLBACK, input.global.sections.some((s) => s.id === id) ? "global" : "builtin");
+        }
+    }
+    rows.sort((a, b) => (a.order === b.order ? (a.id < b.id ? -1 : 1) : a.order - b.order));
+    const templates = new Map(rows.map((r) => [r.id, r.template]));
+    return { rows, templates };
+}

package/dist/store/provider-probe.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Provider model probe — `/api/providers/test` and
+ * `/api/providers/{id}/models/fetch` (`src/providers.rs:523-553,725-776`).
+ *
+ * Two rules carry the security weight:
+ *   1. **keyless same-origin borrow** — a provider with NO key whose
+ *      normalized `base_url` equals the CURRENT generation's `base_url` may
+ *      borrow the engine's own key for that one request. The borrowed key is
+ *      never persisted, never echoed and never logged;
+ *   2. a keyless NON-same-origin provider reports `该提供商未配置 api_key`
+ *      WITHOUT issuing a request at all (no key ever leaves the process for a
+ *      provider that never had one).
+ *
+ * The HTTP client is injected so the contract is testable without network.
+ */
+import { HttpTargetPolicy } from "@celestea/tools";
+import type { RequestFormat } from "./providers.js";
+export declare const UNSUPPORTED_FORMAT = "\u8BE5\u8BF7\u6C42\u683C\u5F0F\u6682\u4E0D\u652F\u6301\u81EA\u52A8\u6D4B\u8BD5";
+export declare const NO_API_KEY = "\u8BE5\u63D0\u4F9B\u5546\u672A\u914D\u7F6E api_key";
+/**
+ * W815-13 (= W819-6): the target was refused by the deployment SSRF policy.
+ * Deliberately generic - the resolver reason names the resolved IP, and that
+ * internal address must not travel back to the caller.
+ */
+export declare const TARGET_FORBIDDEN = "\u8BE5\u63D0\u4F9B\u5546\u5730\u5740\u88AB\u7AD9\u70B9\u7684 SSRF \u7B56\u7565\u62D2\u7EDD\uFF08CELESTEA_HTTP_ALLOW / CELESTEA_HTTP_DENY\uFF09";
+export interface ProbeResponse {
+    status: number;
+    text(): Promise<string>;
+}
+export interface ProbeInit {
+    method: string;
+    headers: Record<string, string>;
+    signal?: AbortSignal;
+}
+export type ProbeFetch = (url: string, init: ProbeInit) => Promise<ProbeResponse>;
+export interface ProbeCandidate {
+    id: string;
+    base_url: string;
+    request_format: RequestFormat;
+    api_key: string | null;
+}
+export interface ProbeOptions {
+    /** Defaults to the global fetch; tests inject a recorder. */
+    fetch?: ProbeFetch;
+    /** The CURRENT generation's base_url + key (borrow source). */
+    engineBaseUrl: string;
+    engineKey: string | null;
+    timeoutMs?: number;
+    /**
+     * W815-13: the deployment SSRF target policy. Default:
+     * HttpTargetPolicy.fromEnv(env ?? process.env) - exactly the policy
+     * http_request mounts, so a denied target is never dialed.
+     */
+    policy?: HttpTargetPolicy;
+    /** Env for the default policy (tests / injected deployments). */
+    env?: NodeJS.ProcessEnv;
+}
+export interface ProbeOutcome {
+    ok: boolean;
+    models?: Array<{
+        id: string;
+    }>;
+    error?: string;
+}
+/** Probe bodies are model lists; 1 MiB is far beyond any real answer. */
+export declare const PROBE_MAX_BODY_BYTES: number;
+/** Which key a probe would use, and whether it was borrowed. NEVER logged. */
+export declare function resolveProbeKey(candidate: ProbeCandidate, opts: ProbeOptions): {
+    key: string | null;
+    borrowed: boolean;
+};
+/** GET `<base_url>/models`; every failure is a 200 body with `ok:false`. */
+export declare function probeModels(candidate: ProbeCandidate, opts: ProbeOptions): Promise<ProbeOutcome>;
+export interface TestOutcome {
+    ok: boolean;
+    latency_ms?: number;
+    model_count?: number;
+    error?: string;
+}
+/** POST /api/providers/test — same probe, plus latency and model count. */
+export declare function testProvider(candidate: ProbeCandidate, opts: ProbeOptions, now?: () => number): Promise<TestOutcome>;

package/dist/store/provider-probe.js

@@ -0,0 +1,154 @@
+/**
+ * Provider model probe — `/api/providers/test` and
+ * `/api/providers/{id}/models/fetch` (`src/providers.rs:523-553,725-776`).
+ *
+ * Two rules carry the security weight:
+ *   1. **keyless same-origin borrow** — a provider with NO key whose
+ *      normalized `base_url` equals the CURRENT generation's `base_url` may
+ *      borrow the engine's own key for that one request. The borrowed key is
+ *      never persisted, never echoed and never logged;
+ *   2. a keyless NON-same-origin provider reports `该提供商未配置 api_key`
+ *      WITHOUT issuing a request at all (no key ever leaves the process for a
+ *      provider that never had one).
+ *
+ * The HTTP client is injected so the contract is testable without network.
+ */
+import { HttpTargetPolicy, requestOnce } from "@celestea/tools";
+import { normalizeBaseUrl } from "./providers.js";
+import { errText } from "./result.js";
+export const UNSUPPORTED_FORMAT = "该请求格式暂不支持自动测试";
+export const NO_API_KEY = "该提供商未配置 api_key";
+/**
+ * W815-13 (= W819-6): the target was refused by the deployment SSRF policy.
+ * Deliberately generic - the resolver reason names the resolved IP, and that
+ * internal address must not travel back to the caller.
+ */
+export const TARGET_FORBIDDEN = "该提供商地址被站点的 SSRF 策略拒绝（CELESTEA_HTTP_ALLOW / CELESTEA_HTTP_DENY）";
+const DEFAULT_TIMEOUT_MS = 15_000;
+/** Probe bodies are model lists; 1 MiB is far beyond any real answer. */
+export const PROBE_MAX_BODY_BYTES = 1024 * 1024;
+/**
+ * The production transport of a probe: one policy-approved, PINNED hop over
+ * the same requestOnce http_request uses. pinnedIps makes the socket connect
+ * to the exact address resolveChecked authorized, so a DNS rebind between
+ * check and connect cannot carry the borrowed key to an internal address
+ * (W738 check-then-use).
+ */
+function pinnedProbeFetch(pinnedIps, timeoutMs) {
+    return async (url, init) => {
+        const result = await requestOnce({
+            url: new URL(url),
+            method: init.method,
+            headers: Object.entries(init.headers),
+            body: null,
+            timeoutMs,
+            maxBodyBytes: PROBE_MAX_BODY_BYTES,
+            pinnedIps,
+        });
+        return { status: result.status, text: () => Promise.resolve(result.body) };
+    };
+}
+function head(text, n) {
+    return text.length <= n ? text : text.slice(0, n);
+}
+/** Which key a probe would use, and whether it was borrowed. NEVER logged. */
+export function resolveProbeKey(candidate, opts) {
+    const own = candidate.api_key;
+    if (typeof own === "string" && own !== "")
+        return { key: own, borrowed: false };
+    const sameOrigin = normalizeBaseUrl(candidate.base_url) === normalizeBaseUrl(opts.engineBaseUrl);
+    if (sameOrigin && opts.engineKey !== null && opts.engineKey !== "")
+        return { key: opts.engineKey, borrowed: true };
+    return { key: null, borrowed: false };
+}
+function parseModels(text) {
+    let body;
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        return null;
+    }
+    const rows = Array.isArray(body) ? body : body.data;
+    if (!Array.isArray(rows))
+        return null;
+    const out = [];
+    for (const row of rows) {
+        const id = typeof row === "object" && row !== null ? row["id"] : undefined;
+        if (typeof id === "string" && id !== "")
+            out.push({ id });
+    }
+    return out;
+}
+/** GET `<base_url>/models`; every failure is a 200 body with `ok:false`. */
+export async function probeModels(candidate, opts) {
+    if (candidate.request_format !== "chat_completions")
+        return { ok: false, error: UNSUPPORTED_FORMAT };
+    if ((candidate.base_url ?? "").trim() === "")
+        return { ok: false, error: "base_url is required" };
+    const { key } = resolveProbeKey(candidate, opts);
+    if (key === null)
+        return { ok: false, error: NO_API_KEY };
+    const url = `${candidate.base_url.replace(/\/+$/, "")}/models`;
+    // W815-13: authorize the target with the SAME policy http_request uses
+    // before a single byte leaves the process. An inactive policy (both env vars
+    // unset) allows everything, so it neither resolves nor pins and the historical
+    // host-fetch path is unchanged.
+    const policy = opts.policy ?? HttpTargetPolicy.fromEnv(opts.env ?? process.env);
+    let pinned = null;
+    try {
+        if (policy.active) {
+            const checked = await policy.resolveChecked(url);
+            if (checked.reason !== null)
+                return { ok: false, error: TARGET_FORBIDDEN };
+            pinned = checked.ips;
+        }
+    }
+    catch (e) {
+        return { ok: false, error: errText(e) };
+    }
+    const doFetch = opts.fetch ??
+        (pinned === null
+            ? globalThis.fetch
+            : pinnedProbeFetch(pinned, opts.timeoutMs ?? DEFAULT_TIMEOUT_MS));
+    // The pinned transport owns its own deadline; only the injected / host-fetch
+    // paths keep the AbortSignal timeout (no dangling timer on the pinned path).
+    const signal = opts.fetch === undefined && pinned !== null
+        ? undefined
+        : AbortSignal.timeout(opts.timeoutMs ?? DEFAULT_TIMEOUT_MS);
+    let res;
+    try {
+        res = await doFetch(url, {
+            method: "GET",
+            headers: { authorization: `Bearer ${key}`, accept: "application/json" },
+            ...(signal === undefined ? {} : { signal }),
+        });
+    }
+    catch (e) {
+        return { ok: false, error: errText(e) };
+    }
+    let text;
+    try {
+        text = await res.text();
+    }
+    catch (e) {
+        return { ok: false, error: `summary response read failed: ${errText(e)}` };
+    }
+    if (res.status < 200 || res.status >= 300) {
+        return { ok: false, error: `HTTP ${res.status}: ${head(text, 300)}` };
+    }
+    const models = parseModels(text);
+    if (models === null) {
+        return { ok: false, error: `response is not JSON (invalid body); body head: ${head(text, 200)}` };
+    }
+    return { ok: true, models };
+}
+/** POST /api/providers/test — same probe, plus latency and model count. */
+export async function testProvider(candidate, opts, now = Date.now) {
+    const start = now();
+    const outcome = await probeModels(candidate, opts);
+    if (!outcome.ok)
+        return { ok: false, error: outcome.error };
+    const latency_ms = Math.max(0, Math.round(now() - start));
+    return { ok: true, latency_ms, model_count: outcome.models?.length ?? 0 };
+}

package/dist/store/providers.d.ts

@@ -0,0 +1,97 @@
+/**
+ * `providers.json` store — `contracts/data-files/providers.schema.json`,
+ * `src/providers.rs:52-86,219-241,673-797`.
+ *
+ * Security rules enforced here, not by convention:
+ *   - the file holds PLAINTEXT keys and is written through
+ *     `OpenOptions::mode(0600)` + fsync + rename, i.e. EVERY save re-asserts
+ *     0600 (see `save()`);
+ *   - `public_view` has NO `api_key` key at all (not null, not empty) — the
+ *     type returned by every read path simply has no such field, so a handler
+ *     cannot leak it by accident;
+ *   - update semantics: `api_key` absent/null/blank KEEPS the stored key (the
+ *     only keep-on-default field), while `models` absent CLEARS the list,
+ *     `note` absent clears to "", `request_format` absent silently resets to
+ *     chat_completions and `name` absent falls back to `id`.
+ */
+import { type StoreResult } from "./result.js";
+export declare const REQUEST_FORMATS: readonly ["chat_completions", "responses", "anthropic_messages"];
+export type RequestFormat = (typeof REQUEST_FORMATS)[number];
+export declare const PROVIDERS_MODE = 384;
+export interface ProviderModel {
+    id: string;
+    name: string;
+    reasoning_efforts: string[];
+    context_window: number | null;
+    max_output_tokens: number | null;
+    /**
+     * W804: per-model capability bits. ABSENT = the optimistic default
+     * (input ["text","image"], output ["text"]); configuring input ["text"] is the
+     * only way to disable the image entry points. Kept optional so re-writing an
+     * existing providers.json stays byte-identical until an operator sets them.
+     */
+    input_modalities?: string[];
+    output_modalities?: string[];
+}
+/** Internal row: the ONLY place an api_key may live. */
+export interface ProviderRow {
+    id: string;
+    name: string;
+    note: string;
+    base_url: string;
+    request_format: RequestFormat;
+    api_key: string | null;
+    models: ProviderModel[];
+}
+/** Wire shape: structurally identical to `ProviderRow` MINUS `api_key`. */
+export interface ProviderPublicView {
+    id: string;
+    name: string;
+    note: string;
+    base_url: string;
+    request_format: RequestFormat;
+    models: ProviderModel[];
+    is_default: boolean;
+    has_key: boolean;
+}
+export interface ProvidersView {
+    providers: ProviderPublicView[];
+    default_model: string | null;
+}
+export interface ProviderUpsertRequest {
+    id?: string;
+    name?: string;
+    note?: string;
+    base_url?: string;
+    request_format?: string;
+    api_key?: string | null;
+    models?: Array<Partial<ProviderModel> & {
+        id?: string;
+    }>;
+}
+/** Normalize a base_url for the keyless-borrow comparison (trim + no trailing '/'). */
+export declare function normalizeBaseUrl(url: string): string;
+export declare class ProvidersStore {
+    private readonly file;
+    private data;
+    constructor(file: string);
+    /** Internal rows — used by the probe and by `/api/config` model listing. */
+    rows(): readonly ProviderRow[];
+    find(id: string): ProviderRow | undefined;
+    defaultModel(): string | null;
+    /** Every id listed by any provider (used to validate `default_model`). */
+    modelIds(): string[];
+    private view;
+    viewOf(p: ProviderRow): ProviderPublicView;
+    list(): ProviderPublicView[];
+    /** GET /api/providers body (no `ok`, never a key). */
+    response(): ProvidersView;
+    private save;
+    private validate;
+    /** POST /api/providers — upsert by id; returns the public view. */
+    upsert(req: ProviderUpsertRequest): StoreResult<ProviderPublicView>;
+    /** POST /api/providers/{id}/delete — UNTRIMMED raw path value. */
+    remove(rawId: string): StoreResult<void>;
+    /** POST /api/providers/default — persist the default model id. */
+    setDefaultModel(model: string): StoreResult<void>;
+}