@cmmd-center/forge 0.9.15 → 0.9.17

package/dist/bin.cjs

@@ -22345,6 +22345,40 @@ const ServerProviderAuth = require_Schema$1.Struct({
 	accountEmail: require_Schema$1.optional(TrimmedNonEmptyString),
 	provenance: require_Schema$1.optional(ProviderAuthProvenance)
 });
+/**
+* Whether this Environment will let a person select the provider.
+*
+* Published for every provider the build knows about. A provider is never
+* dropped from the list: absence is not a state, and four different reasons
+* once collapsed into one "Coming soon." string because the Shell had to infer
+* meaning from what was missing. See
+* `docs/adr/withheld-providers-carry-their-reason.md`.
+*/
+const ProviderAvailability = require_Schema$1.Literals(["available", "unavailable"]);
+/**
+* Why a Withheld Provider is withheld. The four members are the glossary's,
+* in `CONTEXT.md` section "Provider availability": Unbuilt, Not Offered, Not
+* Usable, Not on this Environment. Only Unbuilt may read "Coming soon."
+*
+* An Environment can only ever report Unbuilt, Not Usable, or Not on this
+* Environment. Not Offered is a CMMD fact about the organization's Provider
+* Offer, which the Shell adds when it joins.
+*/
+const ProviderUnavailableReason = require_Schema$1.Literals([
+	"unbuilt",
+	"not-offered",
+	"not-usable",
+	"not-on-this-environment"
+]);
+/**
+* The Not Usable sub-case. It picks a second line of copy, not a fifth state,
+* which is why it is a separate field rather than three more reasons.
+*/
+const ProviderUnavailableDetail = require_Schema$1.Literals([
+	"no-connection",
+	"delivery-pending",
+	"reconnect-required"
+]);
 const ServerProviderModel = require_Schema$1.Struct({
 	slug: TrimmedNonEmptyString,
 	name: TrimmedNonEmptyString,
@@ -22376,6 +22410,9 @@ const ServerProvider = require_Schema$1.Struct({
 	checkedAt: IsoDateTime,
 	message: require_Schema$1.optional(TrimmedNonEmptyString),
 	models: require_Schema$1.ArraySchema(ServerProviderModel),
+	availability: require_Schema$1.optional(ProviderAvailability),
+	unavailableReason: require_Schema$1.optional(ProviderUnavailableReason),
+	unavailableDetail: require_Schema$1.optional(ProviderUnavailableDetail),
 	slashCommands: require_Schema$1.ArraySchema(ServerProviderSlashCommand).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed([]))),
 	skills: require_Schema$1.ArraySchema(ServerProviderSkill).pipe(require_Schema$1.withDecodingDefault(require_Schema$1.succeed([])))
 });
@@ -65123,7 +65160,7 @@ function normalizeNumberish(value) {
 }
 //#endregion
 //#region package.json
-var version$1 = "0.9.15";
+var version$1 = "0.9.17";
 //#endregion
 //#region src/sentry.ts
 const SERVER_APP_NAME = "forge-server";
@@ -92279,8 +92316,8 @@ const ProjectionThread = require_Schema$1.Struct({
 	createdAt: IsoDateTime,
 	updatedAt: IsoDateTime,
 	archivedAt: require_Schema$1.NullOr(IsoDateTime),
-	settledAt: require_Schema$1.optional(require_Schema$1.NullOr(IsoDateTime)),
-	settledOverride: require_Schema$1.optional(require_Schema$1.NullOr(require_Schema$1.Literals(["settled", "active"]))),
+	settledAt: require_Schema$1.NullOr(IsoDateTime),
+	settledOverride: require_Schema$1.NullOr(require_Schema$1.Literals(["settled", "active"])),
 	latestUserMessageAt: require_Schema$1.NullOr(IsoDateTime),
 	pendingApprovalCount: NonNegativeInt,
 	pendingUserInputCount: NonNegativeInt,
@@ -92466,16 +92503,23 @@ const FORGE_GIT_COMMIT_PATTERN = /^[0-9a-f]{7,40}$/i;
 /**
 * Resolve the commit this forge checkout actually booted from, so the
 * heartbeat can report it and CMMD can tell a stale Sprite from a current
-* one. Sprites clone forge ONLY at bootstrap (see the CMMD-side bootstrap
-* script) and nothing else refreshes them, so this value never changes for
-* the life of the process — resolve it once and cache it.
-*
-* `git rev-parse HEAD` run with the process's own cwd (`apps/server`, a
-* subdirectory of the cloned repo) walks up to find `.git` on its own; no
-* `-C` path is needed. Returns `undefined` (never throws) when there is no
-* git checkout to read — local dev run from a tarball, or any environment
-* this simply does not apply to — so the heartbeat body omits the field
-* exactly like an older Forge build that doesn't know about it yet.
+* one. The commit cannot change for the life of the process, so resolve it
+* once and cache it.
+*
+* This comment used to say Sprites clone forge at bootstrap and read their
+* commit from that checkout. They do not. A cloud runtime installs the
+* published `@cmmd-center/forge` tarball and has no `.git` anywhere near it,
+* which is why its descriptor reported no commit at all until the server
+* started baking one into its bundle. See `../environment/buildIdentity.ts`,
+* which calls this only as its last rung.
+*
+* `git rev-parse HEAD` run with the process's own cwd walks up to find `.git`
+* on its own, so no `-C` path is needed. That also means a cwd inside some
+* unrelated repository answers with that repository's HEAD, which is one more
+* reason this is the last rung rather than the first. Returns `undefined`
+* (never throws) when there is no checkout to read, so the heartbeat body
+* omits the field exactly like an older Forge build that does not know about
+* it yet.
 */
 let cached$1 = null;
 async function resolveForgeGitCommit(execImpl = (command, args) => execFileAsync$6(command, [...args], { timeout: 5e3 })) {
@@ -206610,7 +206654,7 @@ function createDevServerMcpServer(deps, threadId) {
 * per provider — this module only adapts descriptor + result shapes.
 *
 * Without it a Claude agent has no brokered push path at all and falls back to
-* raw `git`, which the runtime deliberately blocks via `GIT_ASKPASS=/bin/false`.
+* raw `git`, which has no authenticated remote credentials in the agent runtime.
 *
 * The catalog is filtered through `applyPluginSkillPermissionsToDynamicTools`,
 * exactly as the Codex surface filters its dynamic tools. `settings` is required
@@ -285036,14 +285080,87 @@ const writeProviderStatusCache = (input) => {
 	})));
 };
 //#endregion
-//#region src/provider/Layers/ProviderRegistry.ts
+//#region ../../packages/shared/src/providerExecution.ts
+/**
+* Canonical provider-readiness gate for starting work.
+*
+* Cloud user VMs can execute through Forge's scoped provider proxy without a
+* provider-local login. In that case the provider reports unauthenticated but
+* its credential provenance is explicitly `proxied`.
+*/
+function isServerProviderExecutable(provider) {
+	const hasExecutionAuthority = provider.auth.status !== "unauthenticated" || provider.auth.provenance?.credentialScope === "proxied";
+	return provider.enabled && provider.installed && provider.status === "ready" && hasExecutionAuthority && provider.models.length > 0;
+}
+//#endregion
+//#region src/provider/providerAvailability.ts
+/**
+* Derive what this Environment knows about a provider's availability.
+*
+* WHY THIS EXISTS
+*
+* Four different states (Unbuilt, Not Offered, Not Usable, Not on this
+* Environment) used to render as one "Coming soon." string, because consumers
+* were handed a filtered list and had to infer meaning from what was missing.
+* Every provider is now published with an explicit availability and, when
+* withheld, its reason. See `docs/adr/withheld-providers-carry-their-reason.md`
+* and the glossary in `CONTEXT.md` section "Provider availability".
+*
+* WHAT AN ENVIRONMENT MAY SAY
+*
+* Three of the four reasons only. Not Offered is a fact about the CMMD
+* organization's Provider Offer, and delivery-pending is a fact about a
+* credential in flight; neither is visible from inside an Environment, so the
+* Shell adds them when it joins. Nothing here may invent them.
+*
+* This reads the snapshot a provider Layer already produced. It runs no probe
+* and changes no probe: `isServerProviderExecutable` stays the single gate on
+* whether a turn can be dispatched, and this restates its answer in the
+* vocabulary a person sees.
+*/
 /**
-* Providers surfaced in the UI but lacking a dedicated detection Layer.
-* Every provider now has a real Layer; this array stays as a (currently
-* empty) hook for any future provider that ships in the UI before its
-* server-side detection lands.
+* Providers Forge ships in the UI but cannot execute, published as Unbuilt.
+*
+* Empty in this build: codex, claudeAgent, ollama, cmmd, apex, cursor and
+* opencode all have a real detection Layer and a registered adapter. The list
+* stays as the one place a provider that ships ahead of its server-side
+* implementation is named, so "Coming soon." is a deliberate entry rather than
+* a fallback something fell into.
 */
-const STUB_PROVIDERS = [];
+const UNBUILT_PROVIDERS = [];
+function deriveProviderAvailability(provider, unbuiltProviders = UNBUILT_PROVIDERS) {
+	if (unbuiltProviders.includes(provider.provider)) return {
+		availability: "unavailable",
+		unavailableReason: "unbuilt"
+	};
+	if (isServerProviderExecutable(provider)) return { availability: "available" };
+	const hasProxiedCredential = provider.auth.provenance?.credentialScope === "proxied";
+	if (provider.installed && provider.auth.status === "unauthenticated" && !hasProxiedCredential) return {
+		availability: "unavailable",
+		unavailableReason: "not-usable",
+		unavailableDetail: "no-connection"
+	};
+	return {
+		availability: "unavailable",
+		unavailableReason: "not-on-this-environment"
+	};
+}
+/**
+* Stamp a snapshot with its derived availability.
+*
+* The previous fields are dropped before the new ones are applied. Merging
+* would leave a provider that just connected reporting `available` while still
+* carrying the reason it was withheld for.
+*/
+function withProviderAvailability(provider, unbuiltProviders = UNBUILT_PROVIDERS) {
+	const { availability: _availability, unavailableReason: _unavailableReason, unavailableDetail: _unavailableDetail, ...rest } = provider;
+	return {
+		...rest,
+		...deriveProviderAvailability(provider, unbuiltProviders)
+	};
+}
+//#endregion
+//#region src/provider/Layers/ProviderRegistry.ts
 const loadProviders = (codexProvider, claudeProvider, ollamaProvider, cmmdProvider, apexProvider, cursorProvider, opencodeProvider) => require_Schema$1.all([
 	codexProvider.getSnapshot,
 	claudeProvider.getSnapshot,
@@ -285080,9 +285197,9 @@ const ProviderRegistryLive = require_Schema$1.effect(ProviderRegistry, require_S
 				cachedProvider,
 				fallbackProvider
 			});
-			return STUB_PROVIDERS.includes(provider) ? fallbackProvider : void 0;
+			return UNBUILT_PROVIDERS.includes(provider) ? fallbackProvider : void 0;
 		}));
-	}, { concurrency: "unbounded" }).pipe(require_Schema$1.map((providers) => orderProviderSnapshots(providers.filter((provider) => provider !== void 0))));
+	}, { concurrency: "unbounded" }).pipe(require_Schema$1.map((providers) => orderProviderSnapshots(providers.filter((provider) => provider !== void 0).map((provider) => withProviderAvailability(provider)))));
 	const providersRef = yield* require_HttpServer.make$3(cachedProviders);
 	const persistProvider = (provider) => writeProviderStatusCache({
 		filePath: cachePathByProvider.get(provider.provider),
@@ -285091,7 +285208,8 @@ const ProviderRegistryLive = require_Schema$1.effect(ProviderRegistry, require_S
 		provider: provider.provider,
 		error
 	})), require_Schema$1.ignore);
-	const upsertProviders = require_Schema$1.fn("upsertProviders")(function* (nextProviders, options) {
+	const upsertProviders = require_Schema$1.fn("upsertProviders")(function* (incomingProviders, options) {
+		const nextProviders = incomingProviders.map((provider) => withProviderAvailability(provider));
 		const [previousProviders, providers] = yield* require_HttpServer.modify(providersRef, (previousProviders) => {
 			const mergedProviders = new Map(previousProviders.map((provider) => [provider.provider, provider]));
 			for (const provider of nextProviders) mergedProviders.set(provider.provider, provider);
@@ -287823,13 +287941,32 @@ const ObservabilityLive = require_Schema$1.unwrap(require_Schema$1.gen(function*
 //#region ../../packages/shared/src/buildCommit.ts
 const COMMIT_SHA_PATTERN$1 = /^[0-9a-f]{40}$/i;
 /**
+* Whether a value is a full commit sha.
+*
+* Exported so each surface can keep its own list of env names while sharing one
+* definition of "valid". Surfaces genuinely differ: Railway injects
+* RAILWAY_GIT_COMMIT_SHA into the cloud shell build, while the desktop release
+* workflows pass VITE_SENTRY_COMMIT_SHA. What must not differ is the check.
+*/
+function isFullCommitSha(value) {
+	const candidate = value?.trim();
+	return candidate !== void 0 && candidate !== "" && COMMIT_SHA_PATTERN$1.test(candidate);
+}
+/**
 * Build identity from the environment.
 *
 * `.dockerignore` excludes `.git`, so `git rev-parse HEAD` cannot resolve inside
 * the Railway container — the surface where "which commit is live?" is asked
 * most. The commit therefore has to arrive as env there, with git left as the
-* fallback for surfaces that genuinely are checkouts (a sprite clones forge at
-* bootstrap; desktop and dev run from a repo).
+* fallback for surfaces that genuinely are checkouts (desktop and dev run from
+* a repo).
+*
+* A cloud runtime is neither: it installs the published `@cmmd-center/forge`
+* tarball, so it has no build variables and no `.git`, and both rungs below
+* return nothing there. That is why the server bakes the commit into its bundle
+* at build time and reads that first — see `apps/server/src/environment/
+* buildIdentity.ts`. This comment previously claimed a sprite clones forge at
+* bootstrap; it does not, and believing it cost a diagnosis.
 *
 * `RAILWAY_GIT_COMMIT_SHA` is injected by the platform, which is what lets this
 * work on the cloud shell with no Dockerfile plumbing. `FORGE_BUILD_COMMIT`
@@ -287847,6 +287984,30 @@ function resolveBuildCommitFromEnv(env) {
 	}
 }
 //#endregion
+//#region src/environment/buildIdentity.ts
+/**
+* Which commit this server was built from.
+*
+* @module
+*/
+/**
+* The commit baked into this bundle, if it is a bundle at all.
+*
+* `typeof` rather than a bare reference: running from source there is no such
+* binding, and a bare reference is a ReferenceError that would take the whole
+* environment descriptor down instead of reporting an honest "unknown".
+*/
+function readBakedBuildCommit() {
+	return "86c71b55bb7a5dfbbad063d6e4c082570759f006";
+}
+async function resolveServerBuildCommit(input) {
+	if (isFullCommitSha(input.baked)) return input.baked;
+	const fromEnv = resolveBuildCommitFromEnv(input.env);
+	if (fromEnv !== void 0) return fromEnv;
+	const fromGit = await input.readGitCommit();
+	return isFullCommitSha(fromGit) ? fromGit : void 0;
+}
+//#endregion
 //#region src/environment/Layers/ServerEnvironmentLabel.ts
 function normalizeLabel(value) {
 	const trimmed = value?.trim();
@@ -287995,7 +288156,11 @@ const makeServerEnvironment = require_Schema$1.fn("makeServerEnvironment")(funct
 	const initialMetadata = yield* readMetadata;
 	const displayNameOverrideRef = yield* require_HttpServer.make$3(normalizeDisplayName(initialMetadata.displayName ?? null));
 	const posthog = yield* PosthogPublicConfig.asEffect();
-	const buildCommit = resolveBuildCommitFromEnv(process.env) ?? (yield* require_Schema$1.promise(() => resolveForgeGitCommit()));
+	const buildCommit = yield* require_Schema$1.promise(() => resolveServerBuildCommit({
+		baked: readBakedBuildCommit(),
+		env: process.env,
+		readGitCommit: resolveForgeGitCommit
+	}));
 	const buildDescriptor = require_Schema$1.gen(function* () {
 		const displayNameOverride = yield* require_HttpServer.get$1(displayNameOverrideRef);
 		const os = platformOs();
@@ -296810,6 +296975,71 @@ function selectProviderUsageEnvironment(rawCatalog, ownerUserId) {
 	};
 }
 //#endregion
+//#region src/command/claudeUsageRefreshFailure.ts
+/**
+* Why a Claude usage refresh failed, in words the Usage page can show.
+*
+* CMMD answers a failed refresh with a machine reason (`runtime_not_active`,
+* `credential_changed`, …). The Shell used to collapse every one of them into
+* "Claude usage refresh is unavailable.", so the card could only say the
+* refresh failed, never what to do about it.
+*
+* The mapping is a closed allowlist in both directions: a reason CMMD may add
+* later falls back to the generic code, and the text a client sees is written
+* here, never forwarded from upstream. That keeps a credential or runtime
+* detail in a CMMD error body from reaching the browser.
+*/
+const FAILURE_TEXT = {
+	CLAUDE_USAGE_ENVIRONMENT_UNAVAILABLE: "Refresh needs your Environment running.",
+	CLAUDE_USAGE_CREDENTIAL_NOT_READY: "The Claude credential is not applied to your Environment yet.",
+	CLAUDE_USAGE_REFRESH_IN_PROGRESS: "A refresh for this account is already running.",
+	CLAUDE_USAGE_PROBE_FAILED: "Your Environment could not read Claude usage.",
+	CLAUDE_USAGE_RECONNECT_REQUIRED: "Reconnect this Claude account to refresh usage.",
+	CLAUDE_USAGE_ACCOUNT_NOT_FOUND: "This Claude account is no longer connected.",
+	CLAUDE_USAGE_REFRESH_UNAVAILABLE: "Claude usage refresh is unavailable."
+};
+/** Verbatim from CMMD `personal-claude-usage.ts` and `provider-usage-service.ts`. */
+const CODE_BY_UPSTREAM_REASON = {
+	runtime_not_active: "CLAUDE_USAGE_ENVIRONMENT_UNAVAILABLE",
+	claude_native_delivery_disabled: "CLAUDE_USAGE_ENVIRONMENT_UNAVAILABLE",
+	runtime_identity_mismatch: "CLAUDE_USAGE_ENVIRONMENT_UNAVAILABLE",
+	credential_generation_not_applied: "CLAUDE_USAGE_CREDENTIAL_NOT_READY",
+	credential_generation_unavailable: "CLAUDE_USAGE_CREDENTIAL_NOT_READY",
+	credential_changed: "CLAUDE_USAGE_CREDENTIAL_NOT_READY",
+	refresh_in_progress: "CLAUDE_USAGE_REFRESH_IN_PROGRESS",
+	usage_probe_failed: "CLAUDE_USAGE_PROBE_FAILED",
+	usage_receipt_invalid: "CLAUDE_USAGE_PROBE_FAILED",
+	usage_output_invalid: "CLAUDE_USAGE_PROBE_FAILED"
+};
+function failure(code, status) {
+	return {
+		status,
+		body: {
+			error: FAILURE_TEXT[code],
+			code
+		}
+	};
+}
+/**
+* CMMD sends the reason as `{ "error": "<reason>" }`. Anything else, including
+* a longer sentence that happens to start with an allowlisted word, is treated
+* as unknown.
+*/
+function readAllowlistedReasonCode(body) {
+	if (body === null || typeof body !== "object") return null;
+	const reason = body.error;
+	if (typeof reason !== "string") return null;
+	return Object.hasOwn(CODE_BY_UPSTREAM_REASON, reason) ? CODE_BY_UPSTREAM_REASON[reason] ?? null : null;
+}
+function describeClaudeUsageRefreshFailure(error) {
+	if (!(error instanceof CmmdProxyRequestError)) return failure("CLAUDE_USAGE_REFRESH_UNAVAILABLE", 502);
+	if (error.status === 409) return failure("CLAUDE_USAGE_RECONNECT_REQUIRED", 409);
+	if (error.status === 404) return failure("CLAUDE_USAGE_ACCOUNT_NOT_FOUND", 404);
+	const reasonCode = readAllowlistedReasonCode(error.body);
+	if (reasonCode !== null) return failure(reasonCode, 503);
+	return failure("CLAUDE_USAGE_REFRESH_UNAVAILABLE", error.status === 503 ? 503 : 502);
+}
+//#endregion
 //#region src/command/wsToken.ts
 /**
 * Build the WS token response given an optional PAT and the configured CMMD
@@ -298549,11 +298779,8 @@ function resolveProviderUsageOwnerUserId(session) {
 	return Number.isSafeInteger(userId) && userId > 0 ? userId : null;
 }
 function buildClaudeUsageRefreshErrorResponse(error) {
-	const status = error instanceof CmmdProxyRequestError && error.status === 503 ? 503 : 502;
-	return require_HttpServer.jsonUnsafe({
-		error: "Claude usage refresh is unavailable.",
-		code: "CLAUDE_USAGE_REFRESH_UNAVAILABLE"
-	}, { status });
+	const failure = describeClaudeUsageRefreshFailure(error);
+	return require_HttpServer.jsonUnsafe(failure.body, { status: failure.status });
 }
 function makeRefreshProviderUsageHandler(dependencies = {}) {
 	return require_Schema$1.gen(function* () {
@@ -300509,21 +300736,24 @@ function processRuntimeReplicationOutboxItem(item, dependencies) {
 //#endregion
 //#region src/runtimeReplication/Services/ActiveHourMeter.ts
 var ActiveHourMeter = class extends require_Schema$1.Service()("forge/runtimeReplication/Services/ActiveHourMeter") {};
-//#endregion
-//#region ../../packages/shared/src/providerExecution.ts
+/** `slug` and `name` are `.min(1).max(512)` on the receiving schema. */
+const FIELD_MAX_LENGTH = 512;
+/** `version` is `.max(128)` on the receiving schema, with no length floor. */
+const VERSION_MAX_LENGTH = 128;
+/** `binaryPath` is `.max(2048)` on the receiving schema, with no length floor. */
+const BINARY_PATH_MAX_LENGTH = 2048;
 /**
-* Canonical provider-readiness gate for starting work.
+* Trim to the receiving schema's maximum, or null.
 *
-* Cloud user VMs can execute through Forge's scoped provider proxy without a
-* provider-local login. In that case the provider reports unauthenticated but
-* its credential provenance is explicitly `proxied`.
+* Neither field has a length floor, so an empty string would be legal — but it
+* is not an answer. A version nobody resolved and a binary nobody found are
+* both null, which is what the control plane stores and what a reader can tell
+* apart from a real value.
 */
-function isServerProviderExecutable(provider) {
-	const hasExecutionAuthority = provider.auth.status !== "unauthenticated" || provider.auth.provenance?.credentialScope === "proxied";
-	return provider.enabled && provider.installed && provider.status === "ready" && hasExecutionAuthority && provider.models.length > 0;
+function cappedText(value, max) {
+	const normalized = value?.trim().slice(0, max);
+	return normalized ? normalized : null;
 }
-/** `slug` and `name` are `.min(1).max(512)` on the receiving schema. */
-const FIELD_MAX_LENGTH = 512;
 function serializeModel(model) {
 	const slug = model.slug.trim().slice(0, FIELD_MAX_LENGTH);
 	const name = model.name.trim().slice(0, FIELD_MAX_LENGTH);
@@ -300537,20 +300767,48 @@ function serializeModel(model) {
 		name
 	};
 }
+/**
+* The availability to publish for one provider.
+*
+* The registry stamps every snapshot before it leaves, so this normally copies.
+* Deriving over a stamped snapshot would lose the one fact only the registry
+* holds — which providers this build cannot run at all — and republish every
+* Unbuilt provider as Not on this Environment. The fallback covers a snapshot
+* that reached the outbox from some other path.
+*
+* Built by spread so a key with no value is ABSENT rather than `undefined`: the
+* receiving object is `.strict()`, `undefined` is not a legal enum member, and
+* the outbox retries the resulting 400 forever.
+*/
+function publishedAvailability(provider) {
+	if (provider.availability === void 0) return deriveProviderAvailability(provider);
+	const reason = provider.unavailableReason;
+	const detail = provider.unavailableDetail;
+	return {
+		availability: provider.availability,
+		...reason === void 0 ? {} : { unavailableReason: reason },
+		...detail === void 0 ? {} : { unavailableDetail: detail }
+	};
+}
+function serializeProvider(provider) {
+	const models = [];
+	for (const model of provider.models) {
+		if (models.length >= 256) break;
+		const serialized = serializeModel(model);
+		if (serialized) models.push(serialized);
+	}
+	return {
+		provider: provider.provider,
+		models,
+		...publishedAvailability(provider),
+		version: cappedText(provider.version, VERSION_MAX_LENGTH),
+		binaryPath: cappedText(provider.auth.provenance?.binaryPath, BINARY_PATH_MAX_LENGTH)
+	};
+}
 function serializeProviderCatalog(providers) {
 	const catalog = [];
 	for (const provider of providers) {
-		if (!isServerProviderExecutable(provider)) continue;
-		const models = [];
-		for (const model of provider.models) {
-			if (models.length >= 256) break;
-			const serialized = serializeModel(model);
-			if (serialized) models.push(serialized);
-		}
-		catalog.push({
-			provider: provider.provider,
-			models
-		});
+		catalog.push(serializeProvider(provider));
 		if (catalog.length >= 16) break;
 	}
 	return catalog;