@shipfox/api-agent 13.1.0 → 14.0.0

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
 $ shipfox-swc
-Successfully compiled: 53 files with swc (443.5ms)
+Successfully compiled: 53 files with swc (442.43ms)

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # @shipfox/api-agent
 
+## 14.0.0
+
+### Minor Changes
+
+- 09924ca: Adds optional model metadata (`context_window`, `max_output_tokens`, `reasoning`, `input_image`) to managed model entries and passes it through to the pi `custom_provider` contract so managed steps carry the same model descriptor as custom providers.
+
+### Patch Changes
+
+- Updated dependencies [09924ca]
+  - @shipfox/api-agent-dto@14.0.0
+
 ## 13.1.0
 
 ### Minor Changes

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,oBAAoB,EAIzB,KAAK,wBAAwB,EAC9B,MAAM,wBAAwB,CAAC;AAQhC,eAAO,MAAM,MAAM;;;;;;;;;;;kDA2CjB,CAAC;AAEH,eAAO,MAAM,wBAAwB,EACC,wBAAwB,CAAC;AAE/D,eAAO,MAAM,2BAA2B,8DAGtC,CAAC;AAEH,wBAAgB,iBAAiB,CAAC,eAAe,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAuC9E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAIL,KAAK,oBAAoB,EAKzB,KAAK,wBAAwB,EAC9B,MAAM,wBAAwB,CAAC;AAQhC,eAAO,MAAM,MAAM;;;;;;;;;;;kDA2CjB,CAAC;AAEH,eAAO,MAAM,wBAAwB,EACC,wBAAwB,CAAC;AAE/D,eAAO,MAAM,2BAA2B,8DAGtC,CAAC;AAEH,wBAAgB,iBAAiB,CAAC,eAAe,CAAC,EAAE,oBAAoB,GAAG,IAAI,CAuC9E"}

package/dist/config.js

@@ -1,4 +1,4 @@
-import { agentThinkingSchema, buildHarnessToolDeploymentConfig, isReservedModelProviderId, managedModelApiSchema, modelProviderRefSchema, SUPPORTED_MODEL_PROVIDER_IDS } from '@shipfox/api-agent-dto';
+import { agentThinkingSchema, buildHarnessToolDeploymentConfig, isReservedModelProviderId, managedModelApiSchema, managedModelMetadataSchema, modelProviderRefSchema, SUPPORTED_MODEL_PROVIDER_IDS } from '@shipfox/api-agent-dto';
 import { bool, createConfig, num, str } from '@shipfox/config';
 import { WorkspaceProvidersDisabledError } from '#core/errors.js';
 import { getModelProviderEntry } from '#core/model-provider-policy.js';
@@ -111,6 +111,9 @@ function assertManagedProvider(provider) {
         if (!managedModelApiSchema.safeParse(model.api).success) {
             throw new Error(`Managed model provider model API is invalid: ${provider.id}/${model.id}.`);
         }
+        if (!managedModelMetadataSchema.safeParse(model).success) {
+            throw new Error(`Managed model provider model metadata is invalid: ${provider.id}/${model.id}.`);
+        }
     }
     if (!modelIds.has(provider.defaultModel)) {
         throw new Error(`Managed model provider default model is not registered: ${provider.id}.`);

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/config.ts"],"sourcesContent":["import {\n  agentThinkingSchema,\n  buildHarnessToolDeploymentConfig,\n  isReservedModelProviderId,\n  type ManagedModelProvider,\n  managedModelApiSchema,\n  modelProviderRefSchema,\n  SUPPORTED_MODEL_PROVIDER_IDS,\n  type WorkspaceProvidersPolicy,\n} from '@shipfox/api-agent-dto';\nimport {bool, createConfig, num, str} from '@shipfox/config';\nimport {WorkspaceProvidersDisabledError} from '#core/errors.js';\nimport {getModelProviderEntry} from '#core/model-provider-policy.js';\n\nconst AGENT_THINKING_CHOICES = agentThinkingSchema.options;\nconst SUPPORTED_PROVIDER_IDS_DESCRIPTION = SUPPORTED_MODEL_PROVIDER_IDS.join(', ');\n\nexport const config = createConfig({\n  AGENT_WORKSPACE_PROVIDERS: str({\n    desc: 'Controls whether workspaces can configure model providers. Use enabled to preserve the default workspace provider behavior, or disabled when the injected managed provider is the only provider for this instance.',\n    choices: ['enabled', 'disabled'],\n    default: 'enabled',\n  }),\n  AGENT_DEFAULT_PROVIDER: str({\n    desc: `Instance-wide default model provider ID used when a workflow and workspace do not choose one. Optional. Use one of the supported model catalog IDs (${SUPPORTED_PROVIDER_IDS_DESCRIPTION}) or the injected managed provider.`,\n    default: undefined,\n  }),\n  AGENT_DEFAULT_PROVIDER_MODEL: str({\n    desc: 'Instance-wide default model ID used when the resolved provider matches AGENT_DEFAULT_PROVIDER and no workflow or workspace model is set. Optional. Use a model ID supported by that provider.',\n    default: undefined,\n  }),\n  AGENT_DEFAULT_PROVIDER_THINKING: str({\n    desc: 'Instance-wide default thinking effort used when the resolved provider matches AGENT_DEFAULT_PROVIDER and no workflow or workspace thinking effort is set. Optional. Accepted values are off, minimal, low, medium, high, and xhigh.',\n    choices: AGENT_THINKING_CHOICES,\n    default: undefined,\n  }),\n  AGENT_DEFAULT_PROVIDER_API_KEY: str({\n    desc: 'API key for the instance default provider. Optional. Must belong to AGENT_DEFAULT_PROVIDER. If you change the default provider, change this key too. Instance defaults support API-key-only providers.',\n    default: undefined,\n  }),\n  AGENT_PROVIDER_VALIDATION_TIMEOUT_MS: num({\n    desc: 'Maximum time in milliseconds to wait for the live provider test request when saving credentials.',\n    default: 10000,\n  }),\n  AGENT_CUSTOM_PROVIDER_ALLOW_PRIVATE_NETWORKS: bool({\n    desc: 'Allows custom model providers to use private, loopback, link-local, metadata, and .internal network targets. Keep this true for local development and self-hosted private networks. Set it to false on cloud instances.',\n    default: true,\n  }),\n  AGENT_CUSTOM_PROVIDER_HOST_DENYLIST: str({\n    desc: 'Comma-separated hosts and IP ranges that custom model providers may not call. Accepts exact hosts, suffix patterns such as .internal.example or *.internal.example, IP literals, and CIDR blocks such as 10.0.0.0/8.',\n    default: '',\n  }),\n  AGENT_PI_ENABLED_TOOL_PACKAGES: str({\n    desc: 'Comma-separated optional Pi tool packages enabled for this deployment. Defaults to pi-web-access so Pi web access is available. Set it to an empty value to enable only Pi built-in tools. Accepted values: pi-web-access.',\n    default: 'pi-web-access',\n  }),\n  AGENT_PI_WEB_SEARCH_ENABLED: bool({\n    desc: 'Enables Pi web search tools when pi-web-access is enabled. Set it to false to disable web_search and get_search_content while keeping fetch_content available.',\n    default: true,\n  }),\n});\n\nexport const workspaceProvidersPolicy =\n  config.AGENT_WORKSPACE_PROVIDERS as WorkspaceProvidersPolicy;\n\nexport const harnessToolDeploymentConfig = buildHarnessToolDeploymentConfig({\n  piEnabledToolPackages: config.AGENT_PI_ENABLED_TOOL_PACKAGES,\n  piWebSearchEnabled: config.AGENT_PI_WEB_SEARCH_ENABLED,\n});\n\nexport function assertAgentConfig(managedProvider?: ManagedModelProvider): void {\n  if (managedProvider !== undefined) assertManagedProvider(managedProvider);\n\n  if (workspaceProvidersPolicy === 'disabled') {\n    if (managedProvider === undefined) {\n      throw new Error(\n        'AGENT_WORKSPACE_PROVIDERS=disabled requires an injected managed model provider.',\n      );\n    }\n    if (\n      config.AGENT_DEFAULT_PROVIDER !== undefined &&\n      config.AGENT_DEFAULT_PROVIDER !== managedProvider.id\n    ) {\n      throw new WorkspaceProvidersDisabledError(managedProvider.id);\n    }\n  }\n\n  const defaultProvider = config.AGENT_DEFAULT_PROVIDER;\n  if (defaultProvider !== undefined && !isRegisteredProvider(defaultProvider, managedProvider)) {\n    throw new Error(\n      `AGENT_DEFAULT_PROVIDER must name a supported registered provider: ${defaultProvider}.`,\n    );\n  }\n\n  if (!config.AGENT_DEFAULT_PROVIDER_API_KEY) return;\n  if (!defaultProvider) {\n    throw new Error('AGENT_DEFAULT_PROVIDER_API_KEY requires AGENT_DEFAULT_PROVIDER to be set.');\n  }\n  if (managedProvider?.id === defaultProvider) {\n    throw new Error('AGENT_DEFAULT_PROVIDER_API_KEY cannot be used with a managed model provider.');\n  }\n\n  const credentialFields = getModelProviderEntry(defaultProvider)?.credential_fields ?? [];\n  const field = credentialFields[0];\n  if (credentialFields.length === 1 && field?.key === 'api_key' && field.secret) return;\n\n  throw new Error(\n    'AGENT_DEFAULT_PROVIDER_API_KEY requires AGENT_DEFAULT_PROVIDER to use exactly one secret api_key credential field.',\n  );\n}\n\nfunction isRegisteredProvider(\n  providerId: string,\n  managedProvider: ManagedModelProvider | undefined,\n): boolean {\n  if (managedProvider?.id === providerId) return true;\n  return getModelProviderEntry(providerId)?.support_status === 'supported';\n}\n\nfunction assertManagedProvider(provider: ManagedModelProvider): void {\n  if (!modelProviderRefSchema.safeParse(provider.id).success) {\n    throw new Error(`Managed model provider ID must be a valid provider slug: ${provider.id}.`);\n  }\n  if (isReservedModelProviderId(provider.id)) {\n    throw new Error(`Managed model provider ID is reserved: ${provider.id}.`);\n  }\n  if (provider.label.length === 0) {\n    throw new Error(`Managed model provider label must not be empty: ${provider.id}.`);\n  }\n  if (provider.models.length === 0) {\n    throw new Error(`Managed model provider must define at least one model: ${provider.id}.`);\n  }\n\n  const modelIds = new Set<string>();\n  for (const model of provider.models) {\n    if (model.id.length === 0 || model.label.length === 0) {\n      throw new Error(`Managed model provider models must have IDs and labels: ${provider.id}.`);\n    }\n    if (modelIds.has(model.id)) {\n      throw new Error(`Managed model provider models must have unique IDs: ${provider.id}.`);\n    }\n    modelIds.add(model.id);\n    if (!managedModelApiSchema.safeParse(model.api).success) {\n      throw new Error(`Managed model provider model API is invalid: ${provider.id}/${model.id}.`);\n    }\n  }\n\n  if (!modelIds.has(provider.defaultModel)) {\n    throw new Error(`Managed model provider default model is not registered: ${provider.id}.`);\n  }\n  if (\n    provider.defaultThinking !== undefined &&\n    !agentThinkingSchema.safeParse(provider.defaultThinking).success\n  ) {\n    throw new Error(`Managed model provider default thinking is invalid: ${provider.id}.`);\n  }\n  if (typeof provider.resolveCredentials !== 'function') {\n    throw new Error(`Managed model provider must resolve credentials: ${provider.id}.`);\n  }\n}\n"],"names":["agentThinkingSchema","buildHarnessToolDeploymentConfig","isReservedModelProviderId","managedModelApiSchema","modelProviderRefSchema","SUPPORTED_MODEL_PROVIDER_IDS","bool","createConfig","num","str","WorkspaceProvidersDisabledError","getModelProviderEntry","AGENT_THINKING_CHOICES","options","SUPPORTED_PROVIDER_IDS_DESCRIPTION","join","config","AGENT_WORKSPACE_PROVIDERS","desc","choices","default","AGENT_DEFAULT_PROVIDER","undefined","AGENT_DEFAULT_PROVIDER_MODEL","AGENT_DEFAULT_PROVIDER_THINKING","AGENT_DEFAULT_PROVIDER_API_KEY","AGENT_PROVIDER_VALIDATION_TIMEOUT_MS","AGENT_CUSTOM_PROVIDER_ALLOW_PRIVATE_NETWORKS","AGENT_CUSTOM_PROVIDER_HOST_DENYLIST","AGENT_PI_ENABLED_TOOL_PACKAGES","AGENT_PI_WEB_SEARCH_ENABLED","workspaceProvidersPolicy","harnessToolDeploymentConfig","piEnabledToolPackages","piWebSearchEnabled","assertAgentConfig","managedProvider","assertManagedProvider","Error","id","defaultProvider","isRegisteredProvider","credentialFields","credential_fields","field","length","key","secret","providerId","support_status","provider","safeParse","success","label","models","modelIds","Set","model","has","add","api","defaultModel","defaultThinking","resolveCredentials"],"mappings":"AAAA,SACEA,mBAAmB,EACnBC,gCAAgC,EAChCC,yBAAyB,EAEzBC,qBAAqB,EACrBC,sBAAsB,EACtBC,4BAA4B,QAEvB,yBAAyB;AAChC,SAAQC,IAAI,EAAEC,YAAY,EAAEC,GAAG,EAAEC,GAAG,QAAO,kBAAkB;AAC7D,SAAQC,+BAA+B,QAAO,kBAAkB;AAChE,SAAQC,qBAAqB,QAAO,iCAAiC;AAErE,MAAMC,yBAAyBZ,oBAAoBa,OAAO;AAC1D,MAAMC,qCAAqCT,6BAA6BU,IAAI,CAAC;AAE7E,OAAO,MAAMC,SAAST,aAAa;IACjCU,2BAA2BR,IAAI;QAC7BS,MAAM;QACNC,SAAS;YAAC;YAAW;SAAW;QAChCC,SAAS;IACX;IACAC,wBAAwBZ,IAAI;QAC1BS,MAAM,CAAC,oJAAoJ,EAAEJ,mCAAmC,mCAAmC,CAAC;QACpOM,SAASE;IACX;IACAC,8BAA8Bd,IAAI;QAChCS,MAAM;QACNE,SAASE;IACX;IACAE,iCAAiCf,IAAI;QACnCS,MAAM;QACNC,SAASP;QACTQ,SAASE;IACX;IACAG,gCAAgChB,IAAI;QAClCS,MAAM;QACNE,SAASE;IACX;IACAI,sCAAsClB,IAAI;QACxCU,MAAM;QACNE,SAAS;IACX;IACAO,8CAA8CrB,KAAK;QACjDY,MAAM;QACNE,SAAS;IACX;IACAQ,qCAAqCnB,IAAI;QACvCS,MAAM;QACNE,SAAS;IACX;IACAS,gCAAgCpB,IAAI;QAClCS,MAAM;QACNE,SAAS;IACX;IACAU,6BAA6BxB,KAAK;QAChCY,MAAM;QACNE,SAAS;IACX;AACF,GAAG;AAEH,OAAO,MAAMW,2BACXf,OAAOC,yBAAyB,CAA6B;AAE/D,OAAO,MAAMe,8BAA8B/B,iCAAiC;IAC1EgC,uBAAuBjB,OAAOa,8BAA8B;IAC5DK,oBAAoBlB,OAAOc,2BAA2B;AACxD,GAAG;AAEH,OAAO,SAASK,kBAAkBC,eAAsC;IACtE,IAAIA,oBAAoBd,WAAWe,sBAAsBD;IAEzD,IAAIL,6BAA6B,YAAY;QAC3C,IAAIK,oBAAoBd,WAAW;YACjC,MAAM,IAAIgB,MACR;QAEJ;QACA,IACEtB,OAAOK,sBAAsB,KAAKC,aAClCN,OAAOK,sBAAsB,KAAKe,gBAAgBG,EAAE,EACpD;YACA,MAAM,IAAI7B,gCAAgC0B,gBAAgBG,EAAE;QAC9D;IACF;IAEA,MAAMC,kBAAkBxB,OAAOK,sBAAsB;IACrD,IAAImB,oBAAoBlB,aAAa,CAACmB,qBAAqBD,iBAAiBJ,kBAAkB;QAC5F,MAAM,IAAIE,MACR,CAAC,kEAAkE,EAAEE,gBAAgB,CAAC,CAAC;IAE3F;IAEA,IAAI,CAACxB,OAAOS,8BAA8B,EAAE;IAC5C,IAAI,CAACe,iBAAiB;QACpB,MAAM,IAAIF,MAAM;IAClB;IACA,IAAIF,iBAAiBG,OAAOC,iBAAiB;QAC3C,MAAM,IAAIF,MAAM;IAClB;IAEA,MAAMI,mBAAmB/B,sBAAsB6B,kBAAkBG,qBAAqB,EAAE;IACxF,MAAMC,QAAQF,gBAAgB,CAAC,EAAE;IACjC,IAAIA,iBAAiBG,MAAM,KAAK,KAAKD,OAAOE,QAAQ,aAAaF,MAAMG,MAAM,EAAE;IAE/E,MAAM,IAAIT,MACR;AAEJ;AAEA,SAASG,qBACPO,UAAkB,EAClBZ,eAAiD;IAEjD,IAAIA,iBAAiBG,OAAOS,YAAY,OAAO;IAC/C,OAAOrC,sBAAsBqC,aAAaC,mBAAmB;AAC/D;AAEA,SAASZ,sBAAsBa,QAA8B;IAC3D,IAAI,CAAC9C,uBAAuB+C,SAAS,CAACD,SAASX,EAAE,EAAEa,OAAO,EAAE;QAC1D,MAAM,IAAId,MAAM,CAAC,yDAAyD,EAAEY,SAASX,EAAE,CAAC,CAAC,CAAC;IAC5F;IACA,IAAIrC,0BAA0BgD,SAASX,EAAE,GAAG;QAC1C,MAAM,IAAID,MAAM,CAAC,uCAAuC,EAAEY,SAASX,EAAE,CAAC,CAAC,CAAC;IAC1E;IACA,IAAIW,SAASG,KAAK,CAACR,MAAM,KAAK,GAAG;QAC/B,MAAM,IAAIP,MAAM,CAAC,gDAAgD,EAAEY,SAASX,EAAE,CAAC,CAAC,CAAC;IACnF;IACA,IAAIW,SAASI,MAAM,CAACT,MAAM,KAAK,GAAG;QAChC,MAAM,IAAIP,MAAM,CAAC,uDAAuD,EAAEY,SAASX,EAAE,CAAC,CAAC,CAAC;IAC1F;IAEA,MAAMgB,WAAW,IAAIC;IACrB,KAAK,MAAMC,SAASP,SAASI,MAAM,CAAE;QACnC,IAAIG,MAAMlB,EAAE,CAACM,MAAM,KAAK,KAAKY,MAAMJ,KAAK,CAACR,MAAM,KAAK,GAAG;YACrD,MAAM,IAAIP,MAAM,CAAC,wDAAwD,EAAEY,SAASX,EAAE,CAAC,CAAC,CAAC;QAC3F;QACA,IAAIgB,SAASG,GAAG,CAACD,MAAMlB,EAAE,GAAG;YAC1B,MAAM,IAAID,MAAM,CAAC,oDAAoD,EAAEY,SAASX,EAAE,CAAC,CAAC,CAAC;QACvF;QACAgB,SAASI,GAAG,CAACF,MAAMlB,EAAE;QACrB,IAAI,CAACpC,sBAAsBgD,SAAS,CAACM,MAAMG,GAAG,EAAER,OAAO,EAAE;YACvD,MAAM,IAAId,MAAM,CAAC,6CAA6C,EAAEY,SAASX,EAAE,CAAC,CAAC,EAAEkB,MAAMlB,EAAE,CAAC,CAAC,CAAC;QAC5F;IACF;IAEA,IAAI,CAACgB,SAASG,GAAG,CAACR,SAASW,YAAY,GAAG;QACxC,MAAM,IAAIvB,MAAM,CAAC,wDAAwD,EAAEY,SAASX,EAAE,CAAC,CAAC,CAAC;IAC3F;IACA,IACEW,SAASY,eAAe,KAAKxC,aAC7B,CAACtB,oBAAoBmD,SAAS,CAACD,SAASY,eAAe,EAAEV,OAAO,EAChE;QACA,MAAM,IAAId,MAAM,CAAC,oDAAoD,EAAEY,SAASX,EAAE,CAAC,CAAC,CAAC;IACvF;IACA,IAAI,OAAOW,SAASa,kBAAkB,KAAK,YAAY;QACrD,MAAM,IAAIzB,MAAM,CAAC,iDAAiD,EAAEY,SAASX,EAAE,CAAC,CAAC,CAAC;IACpF;AACF"}
+{"version":3,"sources":["../src/config.ts"],"sourcesContent":["import {\n  agentThinkingSchema,\n  buildHarnessToolDeploymentConfig,\n  isReservedModelProviderId,\n  type ManagedModelProvider,\n  managedModelApiSchema,\n  managedModelMetadataSchema,\n  modelProviderRefSchema,\n  SUPPORTED_MODEL_PROVIDER_IDS,\n  type WorkspaceProvidersPolicy,\n} from '@shipfox/api-agent-dto';\nimport {bool, createConfig, num, str} from '@shipfox/config';\nimport {WorkspaceProvidersDisabledError} from '#core/errors.js';\nimport {getModelProviderEntry} from '#core/model-provider-policy.js';\n\nconst AGENT_THINKING_CHOICES = agentThinkingSchema.options;\nconst SUPPORTED_PROVIDER_IDS_DESCRIPTION = SUPPORTED_MODEL_PROVIDER_IDS.join(', ');\n\nexport const config = createConfig({\n  AGENT_WORKSPACE_PROVIDERS: str({\n    desc: 'Controls whether workspaces can configure model providers. Use enabled to preserve the default workspace provider behavior, or disabled when the injected managed provider is the only provider for this instance.',\n    choices: ['enabled', 'disabled'],\n    default: 'enabled',\n  }),\n  AGENT_DEFAULT_PROVIDER: str({\n    desc: `Instance-wide default model provider ID used when a workflow and workspace do not choose one. Optional. Use one of the supported model catalog IDs (${SUPPORTED_PROVIDER_IDS_DESCRIPTION}) or the injected managed provider.`,\n    default: undefined,\n  }),\n  AGENT_DEFAULT_PROVIDER_MODEL: str({\n    desc: 'Instance-wide default model ID used when the resolved provider matches AGENT_DEFAULT_PROVIDER and no workflow or workspace model is set. Optional. Use a model ID supported by that provider.',\n    default: undefined,\n  }),\n  AGENT_DEFAULT_PROVIDER_THINKING: str({\n    desc: 'Instance-wide default thinking effort used when the resolved provider matches AGENT_DEFAULT_PROVIDER and no workflow or workspace thinking effort is set. Optional. Accepted values are off, minimal, low, medium, high, and xhigh.',\n    choices: AGENT_THINKING_CHOICES,\n    default: undefined,\n  }),\n  AGENT_DEFAULT_PROVIDER_API_KEY: str({\n    desc: 'API key for the instance default provider. Optional. Must belong to AGENT_DEFAULT_PROVIDER. If you change the default provider, change this key too. Instance defaults support API-key-only providers.',\n    default: undefined,\n  }),\n  AGENT_PROVIDER_VALIDATION_TIMEOUT_MS: num({\n    desc: 'Maximum time in milliseconds to wait for the live provider test request when saving credentials.',\n    default: 10000,\n  }),\n  AGENT_CUSTOM_PROVIDER_ALLOW_PRIVATE_NETWORKS: bool({\n    desc: 'Allows custom model providers to use private, loopback, link-local, metadata, and .internal network targets. Keep this true for local development and self-hosted private networks. Set it to false on cloud instances.',\n    default: true,\n  }),\n  AGENT_CUSTOM_PROVIDER_HOST_DENYLIST: str({\n    desc: 'Comma-separated hosts and IP ranges that custom model providers may not call. Accepts exact hosts, suffix patterns such as .internal.example or *.internal.example, IP literals, and CIDR blocks such as 10.0.0.0/8.',\n    default: '',\n  }),\n  AGENT_PI_ENABLED_TOOL_PACKAGES: str({\n    desc: 'Comma-separated optional Pi tool packages enabled for this deployment. Defaults to pi-web-access so Pi web access is available. Set it to an empty value to enable only Pi built-in tools. Accepted values: pi-web-access.',\n    default: 'pi-web-access',\n  }),\n  AGENT_PI_WEB_SEARCH_ENABLED: bool({\n    desc: 'Enables Pi web search tools when pi-web-access is enabled. Set it to false to disable web_search and get_search_content while keeping fetch_content available.',\n    default: true,\n  }),\n});\n\nexport const workspaceProvidersPolicy =\n  config.AGENT_WORKSPACE_PROVIDERS as WorkspaceProvidersPolicy;\n\nexport const harnessToolDeploymentConfig = buildHarnessToolDeploymentConfig({\n  piEnabledToolPackages: config.AGENT_PI_ENABLED_TOOL_PACKAGES,\n  piWebSearchEnabled: config.AGENT_PI_WEB_SEARCH_ENABLED,\n});\n\nexport function assertAgentConfig(managedProvider?: ManagedModelProvider): void {\n  if (managedProvider !== undefined) assertManagedProvider(managedProvider);\n\n  if (workspaceProvidersPolicy === 'disabled') {\n    if (managedProvider === undefined) {\n      throw new Error(\n        'AGENT_WORKSPACE_PROVIDERS=disabled requires an injected managed model provider.',\n      );\n    }\n    if (\n      config.AGENT_DEFAULT_PROVIDER !== undefined &&\n      config.AGENT_DEFAULT_PROVIDER !== managedProvider.id\n    ) {\n      throw new WorkspaceProvidersDisabledError(managedProvider.id);\n    }\n  }\n\n  const defaultProvider = config.AGENT_DEFAULT_PROVIDER;\n  if (defaultProvider !== undefined && !isRegisteredProvider(defaultProvider, managedProvider)) {\n    throw new Error(\n      `AGENT_DEFAULT_PROVIDER must name a supported registered provider: ${defaultProvider}.`,\n    );\n  }\n\n  if (!config.AGENT_DEFAULT_PROVIDER_API_KEY) return;\n  if (!defaultProvider) {\n    throw new Error('AGENT_DEFAULT_PROVIDER_API_KEY requires AGENT_DEFAULT_PROVIDER to be set.');\n  }\n  if (managedProvider?.id === defaultProvider) {\n    throw new Error('AGENT_DEFAULT_PROVIDER_API_KEY cannot be used with a managed model provider.');\n  }\n\n  const credentialFields = getModelProviderEntry(defaultProvider)?.credential_fields ?? [];\n  const field = credentialFields[0];\n  if (credentialFields.length === 1 && field?.key === 'api_key' && field.secret) return;\n\n  throw new Error(\n    'AGENT_DEFAULT_PROVIDER_API_KEY requires AGENT_DEFAULT_PROVIDER to use exactly one secret api_key credential field.',\n  );\n}\n\nfunction isRegisteredProvider(\n  providerId: string,\n  managedProvider: ManagedModelProvider | undefined,\n): boolean {\n  if (managedProvider?.id === providerId) return true;\n  return getModelProviderEntry(providerId)?.support_status === 'supported';\n}\n\nfunction assertManagedProvider(provider: ManagedModelProvider): void {\n  if (!modelProviderRefSchema.safeParse(provider.id).success) {\n    throw new Error(`Managed model provider ID must be a valid provider slug: ${provider.id}.`);\n  }\n  if (isReservedModelProviderId(provider.id)) {\n    throw new Error(`Managed model provider ID is reserved: ${provider.id}.`);\n  }\n  if (provider.label.length === 0) {\n    throw new Error(`Managed model provider label must not be empty: ${provider.id}.`);\n  }\n  if (provider.models.length === 0) {\n    throw new Error(`Managed model provider must define at least one model: ${provider.id}.`);\n  }\n\n  const modelIds = new Set<string>();\n  for (const model of provider.models) {\n    if (model.id.length === 0 || model.label.length === 0) {\n      throw new Error(`Managed model provider models must have IDs and labels: ${provider.id}.`);\n    }\n    if (modelIds.has(model.id)) {\n      throw new Error(`Managed model provider models must have unique IDs: ${provider.id}.`);\n    }\n    modelIds.add(model.id);\n    if (!managedModelApiSchema.safeParse(model.api).success) {\n      throw new Error(`Managed model provider model API is invalid: ${provider.id}/${model.id}.`);\n    }\n    if (!managedModelMetadataSchema.safeParse(model).success) {\n      throw new Error(\n        `Managed model provider model metadata is invalid: ${provider.id}/${model.id}.`,\n      );\n    }\n  }\n\n  if (!modelIds.has(provider.defaultModel)) {\n    throw new Error(`Managed model provider default model is not registered: ${provider.id}.`);\n  }\n  if (\n    provider.defaultThinking !== undefined &&\n    !agentThinkingSchema.safeParse(provider.defaultThinking).success\n  ) {\n    throw new Error(`Managed model provider default thinking is invalid: ${provider.id}.`);\n  }\n  if (typeof provider.resolveCredentials !== 'function') {\n    throw new Error(`Managed model provider must resolve credentials: ${provider.id}.`);\n  }\n}\n"],"names":["agentThinkingSchema","buildHarnessToolDeploymentConfig","isReservedModelProviderId","managedModelApiSchema","managedModelMetadataSchema","modelProviderRefSchema","SUPPORTED_MODEL_PROVIDER_IDS","bool","createConfig","num","str","WorkspaceProvidersDisabledError","getModelProviderEntry","AGENT_THINKING_CHOICES","options","SUPPORTED_PROVIDER_IDS_DESCRIPTION","join","config","AGENT_WORKSPACE_PROVIDERS","desc","choices","default","AGENT_DEFAULT_PROVIDER","undefined","AGENT_DEFAULT_PROVIDER_MODEL","AGENT_DEFAULT_PROVIDER_THINKING","AGENT_DEFAULT_PROVIDER_API_KEY","AGENT_PROVIDER_VALIDATION_TIMEOUT_MS","AGENT_CUSTOM_PROVIDER_ALLOW_PRIVATE_NETWORKS","AGENT_CUSTOM_PROVIDER_HOST_DENYLIST","AGENT_PI_ENABLED_TOOL_PACKAGES","AGENT_PI_WEB_SEARCH_ENABLED","workspaceProvidersPolicy","harnessToolDeploymentConfig","piEnabledToolPackages","piWebSearchEnabled","assertAgentConfig","managedProvider","assertManagedProvider","Error","id","defaultProvider","isRegisteredProvider","credentialFields","credential_fields","field","length","key","secret","providerId","support_status","provider","safeParse","success","label","models","modelIds","Set","model","has","add","api","defaultModel","defaultThinking","resolveCredentials"],"mappings":"AAAA,SACEA,mBAAmB,EACnBC,gCAAgC,EAChCC,yBAAyB,EAEzBC,qBAAqB,EACrBC,0BAA0B,EAC1BC,sBAAsB,EACtBC,4BAA4B,QAEvB,yBAAyB;AAChC,SAAQC,IAAI,EAAEC,YAAY,EAAEC,GAAG,EAAEC,GAAG,QAAO,kBAAkB;AAC7D,SAAQC,+BAA+B,QAAO,kBAAkB;AAChE,SAAQC,qBAAqB,QAAO,iCAAiC;AAErE,MAAMC,yBAAyBb,oBAAoBc,OAAO;AAC1D,MAAMC,qCAAqCT,6BAA6BU,IAAI,CAAC;AAE7E,OAAO,MAAMC,SAAST,aAAa;IACjCU,2BAA2BR,IAAI;QAC7BS,MAAM;QACNC,SAAS;YAAC;YAAW;SAAW;QAChCC,SAAS;IACX;IACAC,wBAAwBZ,IAAI;QAC1BS,MAAM,CAAC,oJAAoJ,EAAEJ,mCAAmC,mCAAmC,CAAC;QACpOM,SAASE;IACX;IACAC,8BAA8Bd,IAAI;QAChCS,MAAM;QACNE,SAASE;IACX;IACAE,iCAAiCf,IAAI;QACnCS,MAAM;QACNC,SAASP;QACTQ,SAASE;IACX;IACAG,gCAAgChB,IAAI;QAClCS,MAAM;QACNE,SAASE;IACX;IACAI,sCAAsClB,IAAI;QACxCU,MAAM;QACNE,SAAS;IACX;IACAO,8CAA8CrB,KAAK;QACjDY,MAAM;QACNE,SAAS;IACX;IACAQ,qCAAqCnB,IAAI;QACvCS,MAAM;QACNE,SAAS;IACX;IACAS,gCAAgCpB,IAAI;QAClCS,MAAM;QACNE,SAAS;IACX;IACAU,6BAA6BxB,KAAK;QAChCY,MAAM;QACNE,SAAS;IACX;AACF,GAAG;AAEH,OAAO,MAAMW,2BACXf,OAAOC,yBAAyB,CAA6B;AAE/D,OAAO,MAAMe,8BAA8BhC,iCAAiC;IAC1EiC,uBAAuBjB,OAAOa,8BAA8B;IAC5DK,oBAAoBlB,OAAOc,2BAA2B;AACxD,GAAG;AAEH,OAAO,SAASK,kBAAkBC,eAAsC;IACtE,IAAIA,oBAAoBd,WAAWe,sBAAsBD;IAEzD,IAAIL,6BAA6B,YAAY;QAC3C,IAAIK,oBAAoBd,WAAW;YACjC,MAAM,IAAIgB,MACR;QAEJ;QACA,IACEtB,OAAOK,sBAAsB,KAAKC,aAClCN,OAAOK,sBAAsB,KAAKe,gBAAgBG,EAAE,EACpD;YACA,MAAM,IAAI7B,gCAAgC0B,gBAAgBG,EAAE;QAC9D;IACF;IAEA,MAAMC,kBAAkBxB,OAAOK,sBAAsB;IACrD,IAAImB,oBAAoBlB,aAAa,CAACmB,qBAAqBD,iBAAiBJ,kBAAkB;QAC5F,MAAM,IAAIE,MACR,CAAC,kEAAkE,EAAEE,gBAAgB,CAAC,CAAC;IAE3F;IAEA,IAAI,CAACxB,OAAOS,8BAA8B,EAAE;IAC5C,IAAI,CAACe,iBAAiB;QACpB,MAAM,IAAIF,MAAM;IAClB;IACA,IAAIF,iBAAiBG,OAAOC,iBAAiB;QAC3C,MAAM,IAAIF,MAAM;IAClB;IAEA,MAAMI,mBAAmB/B,sBAAsB6B,kBAAkBG,qBAAqB,EAAE;IACxF,MAAMC,QAAQF,gBAAgB,CAAC,EAAE;IACjC,IAAIA,iBAAiBG,MAAM,KAAK,KAAKD,OAAOE,QAAQ,aAAaF,MAAMG,MAAM,EAAE;IAE/E,MAAM,IAAIT,MACR;AAEJ;AAEA,SAASG,qBACPO,UAAkB,EAClBZ,eAAiD;IAEjD,IAAIA,iBAAiBG,OAAOS,YAAY,OAAO;IAC/C,OAAOrC,sBAAsBqC,aAAaC,mBAAmB;AAC/D;AAEA,SAASZ,sBAAsBa,QAA8B;IAC3D,IAAI,CAAC9C,uBAAuB+C,SAAS,CAACD,SAASX,EAAE,EAAEa,OAAO,EAAE;QAC1D,MAAM,IAAId,MAAM,CAAC,yDAAyD,EAAEY,SAASX,EAAE,CAAC,CAAC,CAAC;IAC5F;IACA,IAAItC,0BAA0BiD,SAASX,EAAE,GAAG;QAC1C,MAAM,IAAID,MAAM,CAAC,uCAAuC,EAAEY,SAASX,EAAE,CAAC,CAAC,CAAC;IAC1E;IACA,IAAIW,SAASG,KAAK,CAACR,MAAM,KAAK,GAAG;QAC/B,MAAM,IAAIP,MAAM,CAAC,gDAAgD,EAAEY,SAASX,EAAE,CAAC,CAAC,CAAC;IACnF;IACA,IAAIW,SAASI,MAAM,CAACT,MAAM,KAAK,GAAG;QAChC,MAAM,IAAIP,MAAM,CAAC,uDAAuD,EAAEY,SAASX,EAAE,CAAC,CAAC,CAAC;IAC1F;IAEA,MAAMgB,WAAW,IAAIC;IACrB,KAAK,MAAMC,SAASP,SAASI,MAAM,CAAE;QACnC,IAAIG,MAAMlB,EAAE,CAACM,MAAM,KAAK,KAAKY,MAAMJ,KAAK,CAACR,MAAM,KAAK,GAAG;YACrD,MAAM,IAAIP,MAAM,CAAC,wDAAwD,EAAEY,SAASX,EAAE,CAAC,CAAC,CAAC;QAC3F;QACA,IAAIgB,SAASG,GAAG,CAACD,MAAMlB,EAAE,GAAG;YAC1B,MAAM,IAAID,MAAM,CAAC,oDAAoD,EAAEY,SAASX,EAAE,CAAC,CAAC,CAAC;QACvF;QACAgB,SAASI,GAAG,CAACF,MAAMlB,EAAE;QACrB,IAAI,CAACrC,sBAAsBiD,SAAS,CAACM,MAAMG,GAAG,EAAER,OAAO,EAAE;YACvD,MAAM,IAAId,MAAM,CAAC,6CAA6C,EAAEY,SAASX,EAAE,CAAC,CAAC,EAAEkB,MAAMlB,EAAE,CAAC,CAAC,CAAC;QAC5F;QACA,IAAI,CAACpC,2BAA2BgD,SAAS,CAACM,OAAOL,OAAO,EAAE;YACxD,MAAM,IAAId,MACR,CAAC,kDAAkD,EAAEY,SAASX,EAAE,CAAC,CAAC,EAAEkB,MAAMlB,EAAE,CAAC,CAAC,CAAC;QAEnF;IACF;IAEA,IAAI,CAACgB,SAASG,GAAG,CAACR,SAASW,YAAY,GAAG;QACxC,MAAM,IAAIvB,MAAM,CAAC,wDAAwD,EAAEY,SAASX,EAAE,CAAC,CAAC,CAAC;IAC3F;IACA,IACEW,SAASY,eAAe,KAAKxC,aAC7B,CAACvB,oBAAoBoD,SAAS,CAACD,SAASY,eAAe,EAAEV,OAAO,EAChE;QACA,MAAM,IAAId,MAAM,CAAC,oDAAoD,EAAEY,SAASX,EAAE,CAAC,CAAC,CAAC;IACvF;IACA,IAAI,OAAOW,SAASa,kBAAkB,KAAK,YAAY;QACrD,MAAM,IAAIzB,MAAM,CAAC,iDAAiD,EAAEY,SAASX,EAAE,CAAC,CAAC,CAAC;IACpF;AACF"}

package/dist/core/resolve-runtime-credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-runtime-credentials.d.ts","sourceRoot":"","sources":["../../src/core/resolve-runtime-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kCAAkC,EAClC,aAAa,EACb,OAAO,EACP,oBAAoB,EAEpB,gBAAgB,EAEhB,wBAAwB,EACzB,MAAM,wBAAwB,CAAC;AAchC,OAAO,EAAC,KAAK,kBAAkB,EAA4B,MAAM,qBAAqB,CAAC;AAEvF,MAAM,WAAW,+BAA+B;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,aAAa,CAAC;CACzB;AAED,UAAU,wBAAwB;IAChC,sBAAsB,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACtD,8BAA8B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrD;AAED,UAAU,gCAAgC;IACxC,aAAa,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACrD,kBAAkB,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAC1D,OAAO,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACzC,eAAe,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACnD,gBAAgB,CAAC,EACb,CAAC,CAAC,MAAM,EAAE;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GACvF,SAAS,CAAC;CACf;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,+BAA+B,EACvC,OAAO,CAAC,EAAE,gCAAgC,GACzC,OAAO,CAAC,kCAAkC,CAAC,CAqF7C;AAED,wBAAgB,0CAA0C,CACxD,UAAU,EAAE,gBAAgB,GAC3B,SAAS,GAAG,SAAS,CAQvB"}
+{"version":3,"file":"resolve-runtime-credentials.d.ts","sourceRoot":"","sources":["../../src/core/resolve-runtime-credentials.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,kCAAkC,EAClC,aAAa,EACb,OAAO,EACP,oBAAoB,EAEpB,gBAAgB,EAEhB,wBAAwB,EACzB,MAAM,wBAAwB,CAAC;AAehC,OAAO,EAAC,KAAK,kBAAkB,EAA4B,MAAM,qBAAqB,CAAC;AAEvF,MAAM,WAAW,+BAA+B;IAC9C,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,aAAa,EAAE,MAAM,CAAC;IACtB,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,gBAAgB,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,aAAa,CAAC;CACzB;AAED,UAAU,wBAAwB;IAChC,sBAAsB,CAAC,EAAE,gBAAgB,GAAG,SAAS,CAAC;IACtD,8BAA8B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACrD;AAED,UAAU,gCAAgC;IACxC,aAAa,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IACrD,kBAAkB,CAAC,EAAE,wBAAwB,GAAG,SAAS,CAAC;IAC1D,OAAO,CAAC,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACzC,eAAe,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACnD,gBAAgB,CAAC,EACb,CAAC,CAAC,MAAM,EAAE;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAC,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,GACvF,SAAS,CAAC;CACf;AAED,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,+BAA+B,EACvC,OAAO,CAAC,EAAE,gCAAgC,GACzC,OAAO,CAAC,kCAAkC,CAAC,CAqF7C;AAED,wBAAgB,0CAA0C,CACxD,UAAU,EAAE,gBAAgB,GAC3B,SAAS,GAAG,SAAS,CAQvB"}

package/dist/core/resolve-runtime-credentials.js

@@ -1,3 +1,4 @@
+import { toCustomAgentModelDto } from '@shipfox/api-agent-dto';
 import { secretsInterModuleContract } from '@shipfox/api-secrets-dto/inter-module';
 import { isInterModuleKnownError } from '@shipfox/inter-module';
 import { config, workspaceProvidersPolicy } from '#config.js';
@@ -130,10 +131,10 @@ function toResponse(params, credentials, providerConfig, managed) {
     }
     if (managed !== undefined) {
         const model = managed.provider.models.find((candidate)=>candidate.id === params.model);
-        const modelDescriptor = {
+        const modelDescriptor = toCustomAgentModelDto(model ?? {
             id: params.model,
-            label: model?.label ?? params.model
-        };
+            label: params.model
+        });
         if (params.harness === 'pi') {
             response.custom_provider = {
                 api: managed.runtimeConfig.api,

package/dist/core/resolve-runtime-credentials.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/core/resolve-runtime-credentials.ts"],"sourcesContent":["import type {\n  AgentRuntimeCredentialsResponseDto,\n  AgentThinking,\n  Harness,\n  ManagedModelProvider,\n  ManagedProviderRuntimeConfig,\n  ModelProviderRef,\n  SupportedModelProviderId,\n  WorkspaceProvidersPolicy,\n} from '@shipfox/api-agent-dto';\nimport {secretsInterModuleContract} from '@shipfox/api-secrets-dto/inter-module';\nimport {isInterModuleKnownError} from '@shipfox/inter-module';\nimport {config, workspaceProvidersPolicy} from '#config.js';\nimport {getModelProviderConfig} from '#db/index.js';\nimport {agentRuntimeConfigResolvedCount} from '#metrics/index.js';\nimport {\n  agentSystemNamespace,\n  storeValuesToCustomRuntimeCredentials,\n  storeValuesToRuntimeCredentials,\n} from './credential-fingerprints.js';\nimport type {ModelProviderConfig} from './entities/model-provider-config.js';\nimport {ModelProviderConfigNotFoundError, WorkspaceProvidersDisabledError} from './errors.js';\nimport {getModelProviderEntry, modelProviderCredentialKeysMatch} from './model-provider-policy.js';\nimport {type AgentSecretsClient, requireAgentSecretsClient} from './secrets-client.js';\n\nexport interface ResolveRuntimeCredentialsParams {\n  workspaceId: string;\n  runId: string;\n  stepAttemptId: string;\n  harness: Harness;\n  provider: ModelProviderRef;\n  model: string;\n  thinking: AgentThinking;\n}\n\ninterface RuntimeCredentialsConfig {\n  AGENT_DEFAULT_PROVIDER?: ModelProviderRef | undefined;\n  AGENT_DEFAULT_PROVIDER_API_KEY?: string | undefined;\n}\n\ninterface ResolveRuntimeCredentialsOptions {\n  runtimeConfig?: RuntimeCredentialsConfig | undefined;\n  workspaceProviders?: WorkspaceProvidersPolicy | undefined;\n  secrets?: AgentSecretsClient | undefined;\n  managedProvider?: ManagedModelProvider | undefined;\n  getCredentialBag?:\n    | ((params: {workspaceId: string; namespace: string}) => Promise<Record<string, string>>)\n    | undefined;\n}\n\nexport async function resolveRuntimeCredentials(\n  params: ResolveRuntimeCredentialsParams,\n  options?: ResolveRuntimeCredentialsOptions,\n): Promise<AgentRuntimeCredentialsResponseDto> {\n  const runtimeConfig = options?.runtimeConfig ?? config;\n  const configuredWorkspaceProviders = options?.workspaceProviders ?? workspaceProvidersPolicy;\n  const secrets = options?.secrets;\n  const managedProvider = options?.managedProvider;\n  if (managedProvider?.id === params.provider) {\n    const managedRuntimeConfig = await managedProvider.resolveCredentials({\n      workspaceId: params.workspaceId,\n      runId: params.runId,\n      stepAttemptId: params.stepAttemptId,\n      model: params.model,\n    });\n    agentRuntimeConfigResolvedCount.add(1, {source: 'instance', outcome: 'resolved'});\n    return toResponse(params, managedRuntimeConfig.credentials, undefined, {\n      provider: managedProvider,\n      runtimeConfig: managedRuntimeConfig,\n    });\n  }\n\n  if (configuredWorkspaceProviders === 'disabled') {\n    agentRuntimeConfigResolvedCount.add(1, {\n      source: params.provider === runtimeConfig.AGENT_DEFAULT_PROVIDER ? 'instance' : 'workspace',\n      outcome: 'unavailable',\n    });\n    if (managedProvider !== undefined) {\n      throw new WorkspaceProvidersDisabledError(managedProvider.id);\n    }\n    throw new ModelProviderConfigNotFoundError(params.workspaceId, params.provider);\n  }\n\n  const providerConfig = await getModelProviderConfig({\n    workspaceId: params.workspaceId,\n    providerId: params.provider,\n  });\n\n  if (providerConfig) {\n    try {\n      const values = options?.getCredentialBag\n        ? await options.getCredentialBag({\n            workspaceId: params.workspaceId,\n            namespace: agentSystemNamespace(params.provider),\n          })\n        : (\n            await requireAgentSecretsClient(secrets).getSecretsByNamespace({\n              workspaceId: params.workspaceId,\n              namespace: agentSystemNamespace(params.provider),\n            })\n          ).values;\n      if (providerConfig.kind === 'custom') {\n        const credentials = storeValuesToCustomRuntimeCredentials(values);\n        agentRuntimeConfigResolvedCount.add(1, {source: 'workspace', outcome: 'resolved'});\n        return toResponse(params, credentials, providerConfig);\n      }\n\n      const providerId = params.provider as SupportedModelProviderId;\n      const credentials = storeValuesToRuntimeCredentials(providerId, values);\n      if (!modelProviderCredentialKeysMatch(providerId, credentials)) {\n        throw new ModelProviderConfigNotFoundError(params.workspaceId, params.provider);\n      }\n      agentRuntimeConfigResolvedCount.add(1, {source: 'workspace', outcome: 'resolved'});\n      return toResponse(params, credentials, providerConfig);\n    } catch (error) {\n      if (\n        isInterModuleKnownError(secretsInterModuleContract.methods.getSecretsByNamespace, error)\n      ) {\n        agentRuntimeConfigResolvedCount.add(1, {\n          source: 'workspace',\n          outcome: 'decryption_failed',\n        });\n      }\n      throw error;\n    }\n  }\n\n  const instanceCredentials = instanceFallbackCredentials(params.provider, runtimeConfig);\n  if (instanceCredentials) {\n    agentRuntimeConfigResolvedCount.add(1, {source: 'instance', outcome: 'resolved'});\n    return toResponse(params, instanceCredentials);\n  }\n\n  agentRuntimeConfigResolvedCount.add(1, {\n    source: params.provider === runtimeConfig.AGENT_DEFAULT_PROVIDER ? 'instance' : 'workspace',\n    outcome: 'unavailable',\n  });\n  throw new ModelProviderConfigNotFoundError(params.workspaceId, params.provider);\n}\n\nexport function getInstanceDefaultModelProviderApiKeyField(\n  providerId: ModelProviderRef,\n): 'api_key' | undefined {\n  const credentialFields =\n    getModelProviderEntry(providerId as SupportedModelProviderId)?.credential_fields ?? [];\n  const field = credentialFields[0];\n  if (credentialFields.length !== 1 || field?.key !== 'api_key' || !field.secret) {\n    return undefined;\n  }\n  return 'api_key';\n}\n\nfunction instanceFallbackCredentials(\n  providerId: ModelProviderRef,\n  runtimeConfig: RuntimeCredentialsConfig,\n): Record<string, string> | undefined {\n  const instanceApiKey = runtimeConfig.AGENT_DEFAULT_PROVIDER_API_KEY;\n  if (providerId !== runtimeConfig.AGENT_DEFAULT_PROVIDER || !instanceApiKey) return undefined;\n\n  const fieldKey = getInstanceDefaultModelProviderApiKeyField(providerId);\n  if (!fieldKey) return undefined;\n\n  return {[fieldKey]: instanceApiKey};\n}\n\nfunction toResponse(\n  params: ResolveRuntimeCredentialsParams,\n  credentials: Record<string, string>,\n  providerConfig?: ModelProviderConfig | undefined,\n  managed?:\n    | {\n        provider: ManagedModelProvider;\n        runtimeConfig: ManagedProviderRuntimeConfig;\n      }\n    | undefined,\n): AgentRuntimeCredentialsResponseDto {\n  const response: AgentRuntimeCredentialsResponseDto = {\n    harness: params.harness,\n    provider_id: params.provider,\n    model: params.model,\n    thinking: params.thinking,\n    credentials,\n  };\n\n  if (providerConfig?.kind === 'custom') {\n    response.custom_provider = {\n      api: providerConfig.api ?? 'openai-responses',\n      base_url: providerConfig.baseUrl ?? '',\n      headers: providerConfig.headers ?? [],\n      secret_header_names: Object.keys(credentials)\n        .filter((key) => key.startsWith('header:'))\n        .map((key) => key.slice('header:'.length))\n        .sort(),\n      models: providerConfig.models ?? [],\n      requires_api_key: providerConfig.requiresApiKey,\n    };\n  }\n\n  if (managed !== undefined) {\n    const model = managed.provider.models.find((candidate) => candidate.id === params.model);\n    const modelDescriptor = {id: params.model, label: model?.label ?? params.model};\n\n    if (params.harness === 'pi') {\n      response.custom_provider = {\n        api: managed.runtimeConfig.api,\n        base_url: managed.runtimeConfig.baseUrl,\n        headers: [],\n        secret_header_names: [],\n        models: [modelDescriptor],\n        requires_api_key: true,\n      };\n    } else {\n      const authToken = managed.runtimeConfig.credentials.api_key;\n      if (authToken === undefined) {\n        throw new ModelProviderConfigNotFoundError(params.workspaceId, params.provider);\n      }\n      response.claude = {\n        base_url: managed.runtimeConfig.baseUrl,\n        auth_token: authToken,\n      };\n    }\n  }\n\n  return response;\n}\n"],"names":["secretsInterModuleContract","isInterModuleKnownError","config","workspaceProvidersPolicy","getModelProviderConfig","agentRuntimeConfigResolvedCount","agentSystemNamespace","storeValuesToCustomRuntimeCredentials","storeValuesToRuntimeCredentials","ModelProviderConfigNotFoundError","WorkspaceProvidersDisabledError","getModelProviderEntry","modelProviderCredentialKeysMatch","requireAgentSecretsClient","resolveRuntimeCredentials","params","options","runtimeConfig","configuredWorkspaceProviders","workspaceProviders","secrets","managedProvider","id","provider","managedRuntimeConfig","resolveCredentials","workspaceId","runId","stepAttemptId","model","add","source","outcome","toResponse","credentials","undefined","AGENT_DEFAULT_PROVIDER","providerConfig","providerId","values","getCredentialBag","namespace","getSecretsByNamespace","kind","error","methods","instanceCredentials","instanceFallbackCredentials","getInstanceDefaultModelProviderApiKeyField","credentialFields","credential_fields","field","length","key","secret","instanceApiKey","AGENT_DEFAULT_PROVIDER_API_KEY","fieldKey","managed","response","harness","provider_id","thinking","custom_provider","api","base_url","baseUrl","headers","secret_header_names","Object","keys","filter","startsWith","map","slice","sort","models","requires_api_key","requiresApiKey","find","candidate","modelDescriptor","label","authToken","api_key","claude","auth_token"],"mappings":"AAUA,SAAQA,0BAA0B,QAAO,wCAAwC;AACjF,SAAQC,uBAAuB,QAAO,wBAAwB;AAC9D,SAAQC,MAAM,EAAEC,wBAAwB,QAAO,aAAa;AAC5D,SAAQC,sBAAsB,QAAO,eAAe;AACpD,SAAQC,+BAA+B,QAAO,oBAAoB;AAClE,SACEC,oBAAoB,EACpBC,qCAAqC,EACrCC,+BAA+B,QAC1B,+BAA+B;AAEtC,SAAQC,gCAAgC,EAAEC,+BAA+B,QAAO,cAAc;AAC9F,SAAQC,qBAAqB,EAAEC,gCAAgC,QAAO,6BAA6B;AACnG,SAAiCC,yBAAyB,QAAO,sBAAsB;AA2BvF,OAAO,eAAeC,0BACpBC,MAAuC,EACvCC,OAA0C;IAE1C,MAAMC,gBAAgBD,SAASC,iBAAiBf;IAChD,MAAMgB,+BAA+BF,SAASG,sBAAsBhB;IACpE,MAAMiB,UAAUJ,SAASI;IACzB,MAAMC,kBAAkBL,SAASK;IACjC,IAAIA,iBAAiBC,OAAOP,OAAOQ,QAAQ,EAAE;QAC3C,MAAMC,uBAAuB,MAAMH,gBAAgBI,kBAAkB,CAAC;YACpEC,aAAaX,OAAOW,WAAW;YAC/BC,OAAOZ,OAAOY,KAAK;YACnBC,eAAeb,OAAOa,aAAa;YACnCC,OAAOd,OAAOc,KAAK;QACrB;QACAxB,gCAAgCyB,GAAG,CAAC,GAAG;YAACC,QAAQ;YAAYC,SAAS;QAAU;QAC/E,OAAOC,WAAWlB,QAAQS,qBAAqBU,WAAW,EAAEC,WAAW;YACrEZ,UAAUF;YACVJ,eAAeO;QACjB;IACF;IAEA,IAAIN,iCAAiC,YAAY;QAC/Cb,gCAAgCyB,GAAG,CAAC,GAAG;YACrCC,QAAQhB,OAAOQ,QAAQ,KAAKN,cAAcmB,sBAAsB,GAAG,aAAa;YAChFJ,SAAS;QACX;QACA,IAAIX,oBAAoBc,WAAW;YACjC,MAAM,IAAIzB,gCAAgCW,gBAAgBC,EAAE;QAC9D;QACA,MAAM,IAAIb,iCAAiCM,OAAOW,WAAW,EAAEX,OAAOQ,QAAQ;IAChF;IAEA,MAAMc,iBAAiB,MAAMjC,uBAAuB;QAClDsB,aAAaX,OAAOW,WAAW;QAC/BY,YAAYvB,OAAOQ,QAAQ;IAC7B;IAEA,IAAIc,gBAAgB;QAClB,IAAI;YACF,MAAME,SAASvB,SAASwB,mBACpB,MAAMxB,QAAQwB,gBAAgB,CAAC;gBAC7Bd,aAAaX,OAAOW,WAAW;gBAC/Be,WAAWnC,qBAAqBS,OAAOQ,QAAQ;YACjD,KACA,AACE,CAAA,MAAMV,0BAA0BO,SAASsB,qBAAqB,CAAC;gBAC7DhB,aAAaX,OAAOW,WAAW;gBAC/Be,WAAWnC,qBAAqBS,OAAOQ,QAAQ;YACjD,EAAC,EACDgB,MAAM;YACZ,IAAIF,eAAeM,IAAI,KAAK,UAAU;gBACpC,MAAMT,cAAc3B,sCAAsCgC;gBAC1DlC,gCAAgCyB,GAAG,CAAC,GAAG;oBAACC,QAAQ;oBAAaC,SAAS;gBAAU;gBAChF,OAAOC,WAAWlB,QAAQmB,aAAaG;YACzC;YAEA,MAAMC,aAAavB,OAAOQ,QAAQ;YAClC,MAAMW,cAAc1B,gCAAgC8B,YAAYC;YAChE,IAAI,CAAC3B,iCAAiC0B,YAAYJ,cAAc;gBAC9D,MAAM,IAAIzB,iCAAiCM,OAAOW,WAAW,EAAEX,OAAOQ,QAAQ;YAChF;YACAlB,gCAAgCyB,GAAG,CAAC,GAAG;gBAACC,QAAQ;gBAAaC,SAAS;YAAU;YAChF,OAAOC,WAAWlB,QAAQmB,aAAaG;QACzC,EAAE,OAAOO,OAAO;YACd,IACE3C,wBAAwBD,2BAA2B6C,OAAO,CAACH,qBAAqB,EAAEE,QAClF;gBACAvC,gCAAgCyB,GAAG,CAAC,GAAG;oBACrCC,QAAQ;oBACRC,SAAS;gBACX;YACF;YACA,MAAMY;QACR;IACF;IAEA,MAAME,sBAAsBC,4BAA4BhC,OAAOQ,QAAQ,EAAEN;IACzE,IAAI6B,qBAAqB;QACvBzC,gCAAgCyB,GAAG,CAAC,GAAG;YAACC,QAAQ;YAAYC,SAAS;QAAU;QAC/E,OAAOC,WAAWlB,QAAQ+B;IAC5B;IAEAzC,gCAAgCyB,GAAG,CAAC,GAAG;QACrCC,QAAQhB,OAAOQ,QAAQ,KAAKN,cAAcmB,sBAAsB,GAAG,aAAa;QAChFJ,SAAS;IACX;IACA,MAAM,IAAIvB,iCAAiCM,OAAOW,WAAW,EAAEX,OAAOQ,QAAQ;AAChF;AAEA,OAAO,SAASyB,2CACdV,UAA4B;IAE5B,MAAMW,mBACJtC,sBAAsB2B,aAAyCY,qBAAqB,EAAE;IACxF,MAAMC,QAAQF,gBAAgB,CAAC,EAAE;IACjC,IAAIA,iBAAiBG,MAAM,KAAK,KAAKD,OAAOE,QAAQ,aAAa,CAACF,MAAMG,MAAM,EAAE;QAC9E,OAAOnB;IACT;IACA,OAAO;AACT;AAEA,SAASY,4BACPT,UAA4B,EAC5BrB,aAAuC;IAEvC,MAAMsC,iBAAiBtC,cAAcuC,8BAA8B;IACnE,IAAIlB,eAAerB,cAAcmB,sBAAsB,IAAI,CAACmB,gBAAgB,OAAOpB;IAEnF,MAAMsB,WAAWT,2CAA2CV;IAC5D,IAAI,CAACmB,UAAU,OAAOtB;IAEtB,OAAO;QAAC,CAACsB,SAAS,EAAEF;IAAc;AACpC;AAEA,SAAStB,WACPlB,MAAuC,EACvCmB,WAAmC,EACnCG,cAAgD,EAChDqB,OAKa;IAEb,MAAMC,WAA+C;QACnDC,SAAS7C,OAAO6C,OAAO;QACvBC,aAAa9C,OAAOQ,QAAQ;QAC5BM,OAAOd,OAAOc,KAAK;QACnBiC,UAAU/C,OAAO+C,QAAQ;QACzB5B;IACF;IAEA,IAAIG,gBAAgBM,SAAS,UAAU;QACrCgB,SAASI,eAAe,GAAG;YACzBC,KAAK3B,eAAe2B,GAAG,IAAI;YAC3BC,UAAU5B,eAAe6B,OAAO,IAAI;YACpCC,SAAS9B,eAAe8B,OAAO,IAAI,EAAE;YACrCC,qBAAqBC,OAAOC,IAAI,CAACpC,aAC9BqC,MAAM,CAAC,CAAClB,MAAQA,IAAImB,UAAU,CAAC,YAC/BC,GAAG,CAAC,CAACpB,MAAQA,IAAIqB,KAAK,CAAC,UAAUtB,MAAM,GACvCuB,IAAI;YACPC,QAAQvC,eAAeuC,MAAM,IAAI,EAAE;YACnCC,kBAAkBxC,eAAeyC,cAAc;QACjD;IACF;IAEA,IAAIpB,YAAYvB,WAAW;QACzB,MAAMN,QAAQ6B,QAAQnC,QAAQ,CAACqD,MAAM,CAACG,IAAI,CAAC,CAACC,YAAcA,UAAU1D,EAAE,KAAKP,OAAOc,KAAK;QACvF,MAAMoD,kBAAkB;YAAC3D,IAAIP,OAAOc,KAAK;YAAEqD,OAAOrD,OAAOqD,SAASnE,OAAOc,KAAK;QAAA;QAE9E,IAAId,OAAO6C,OAAO,KAAK,MAAM;YAC3BD,SAASI,eAAe,GAAG;gBACzBC,KAAKN,QAAQzC,aAAa,CAAC+C,GAAG;gBAC9BC,UAAUP,QAAQzC,aAAa,CAACiD,OAAO;gBACvCC,SAAS,EAAE;gBACXC,qBAAqB,EAAE;gBACvBQ,QAAQ;oBAACK;iBAAgB;gBACzBJ,kBAAkB;YACpB;QACF,OAAO;YACL,MAAMM,YAAYzB,QAAQzC,aAAa,CAACiB,WAAW,CAACkD,OAAO;YAC3D,IAAID,cAAchD,WAAW;gBAC3B,MAAM,IAAI1B,iCAAiCM,OAAOW,WAAW,EAAEX,OAAOQ,QAAQ;YAChF;YACAoC,SAAS0B,MAAM,GAAG;gBAChBpB,UAAUP,QAAQzC,aAAa,CAACiD,OAAO;gBACvCoB,YAAYH;YACd;QACF;IACF;IAEA,OAAOxB;AACT"}
+{"version":3,"sources":["../../src/core/resolve-runtime-credentials.ts"],"sourcesContent":["import type {\n  AgentRuntimeCredentialsResponseDto,\n  AgentThinking,\n  Harness,\n  ManagedModelProvider,\n  ManagedProviderRuntimeConfig,\n  ModelProviderRef,\n  SupportedModelProviderId,\n  WorkspaceProvidersPolicy,\n} from '@shipfox/api-agent-dto';\nimport {toCustomAgentModelDto} from '@shipfox/api-agent-dto';\nimport {secretsInterModuleContract} from '@shipfox/api-secrets-dto/inter-module';\nimport {isInterModuleKnownError} from '@shipfox/inter-module';\nimport {config, workspaceProvidersPolicy} from '#config.js';\nimport {getModelProviderConfig} from '#db/index.js';\nimport {agentRuntimeConfigResolvedCount} from '#metrics/index.js';\nimport {\n  agentSystemNamespace,\n  storeValuesToCustomRuntimeCredentials,\n  storeValuesToRuntimeCredentials,\n} from './credential-fingerprints.js';\nimport type {ModelProviderConfig} from './entities/model-provider-config.js';\nimport {ModelProviderConfigNotFoundError, WorkspaceProvidersDisabledError} from './errors.js';\nimport {getModelProviderEntry, modelProviderCredentialKeysMatch} from './model-provider-policy.js';\nimport {type AgentSecretsClient, requireAgentSecretsClient} from './secrets-client.js';\n\nexport interface ResolveRuntimeCredentialsParams {\n  workspaceId: string;\n  runId: string;\n  stepAttemptId: string;\n  harness: Harness;\n  provider: ModelProviderRef;\n  model: string;\n  thinking: AgentThinking;\n}\n\ninterface RuntimeCredentialsConfig {\n  AGENT_DEFAULT_PROVIDER?: ModelProviderRef | undefined;\n  AGENT_DEFAULT_PROVIDER_API_KEY?: string | undefined;\n}\n\ninterface ResolveRuntimeCredentialsOptions {\n  runtimeConfig?: RuntimeCredentialsConfig | undefined;\n  workspaceProviders?: WorkspaceProvidersPolicy | undefined;\n  secrets?: AgentSecretsClient | undefined;\n  managedProvider?: ManagedModelProvider | undefined;\n  getCredentialBag?:\n    | ((params: {workspaceId: string; namespace: string}) => Promise<Record<string, string>>)\n    | undefined;\n}\n\nexport async function resolveRuntimeCredentials(\n  params: ResolveRuntimeCredentialsParams,\n  options?: ResolveRuntimeCredentialsOptions,\n): Promise<AgentRuntimeCredentialsResponseDto> {\n  const runtimeConfig = options?.runtimeConfig ?? config;\n  const configuredWorkspaceProviders = options?.workspaceProviders ?? workspaceProvidersPolicy;\n  const secrets = options?.secrets;\n  const managedProvider = options?.managedProvider;\n  if (managedProvider?.id === params.provider) {\n    const managedRuntimeConfig = await managedProvider.resolveCredentials({\n      workspaceId: params.workspaceId,\n      runId: params.runId,\n      stepAttemptId: params.stepAttemptId,\n      model: params.model,\n    });\n    agentRuntimeConfigResolvedCount.add(1, {source: 'instance', outcome: 'resolved'});\n    return toResponse(params, managedRuntimeConfig.credentials, undefined, {\n      provider: managedProvider,\n      runtimeConfig: managedRuntimeConfig,\n    });\n  }\n\n  if (configuredWorkspaceProviders === 'disabled') {\n    agentRuntimeConfigResolvedCount.add(1, {\n      source: params.provider === runtimeConfig.AGENT_DEFAULT_PROVIDER ? 'instance' : 'workspace',\n      outcome: 'unavailable',\n    });\n    if (managedProvider !== undefined) {\n      throw new WorkspaceProvidersDisabledError(managedProvider.id);\n    }\n    throw new ModelProviderConfigNotFoundError(params.workspaceId, params.provider);\n  }\n\n  const providerConfig = await getModelProviderConfig({\n    workspaceId: params.workspaceId,\n    providerId: params.provider,\n  });\n\n  if (providerConfig) {\n    try {\n      const values = options?.getCredentialBag\n        ? await options.getCredentialBag({\n            workspaceId: params.workspaceId,\n            namespace: agentSystemNamespace(params.provider),\n          })\n        : (\n            await requireAgentSecretsClient(secrets).getSecretsByNamespace({\n              workspaceId: params.workspaceId,\n              namespace: agentSystemNamespace(params.provider),\n            })\n          ).values;\n      if (providerConfig.kind === 'custom') {\n        const credentials = storeValuesToCustomRuntimeCredentials(values);\n        agentRuntimeConfigResolvedCount.add(1, {source: 'workspace', outcome: 'resolved'});\n        return toResponse(params, credentials, providerConfig);\n      }\n\n      const providerId = params.provider as SupportedModelProviderId;\n      const credentials = storeValuesToRuntimeCredentials(providerId, values);\n      if (!modelProviderCredentialKeysMatch(providerId, credentials)) {\n        throw new ModelProviderConfigNotFoundError(params.workspaceId, params.provider);\n      }\n      agentRuntimeConfigResolvedCount.add(1, {source: 'workspace', outcome: 'resolved'});\n      return toResponse(params, credentials, providerConfig);\n    } catch (error) {\n      if (\n        isInterModuleKnownError(secretsInterModuleContract.methods.getSecretsByNamespace, error)\n      ) {\n        agentRuntimeConfigResolvedCount.add(1, {\n          source: 'workspace',\n          outcome: 'decryption_failed',\n        });\n      }\n      throw error;\n    }\n  }\n\n  const instanceCredentials = instanceFallbackCredentials(params.provider, runtimeConfig);\n  if (instanceCredentials) {\n    agentRuntimeConfigResolvedCount.add(1, {source: 'instance', outcome: 'resolved'});\n    return toResponse(params, instanceCredentials);\n  }\n\n  agentRuntimeConfigResolvedCount.add(1, {\n    source: params.provider === runtimeConfig.AGENT_DEFAULT_PROVIDER ? 'instance' : 'workspace',\n    outcome: 'unavailable',\n  });\n  throw new ModelProviderConfigNotFoundError(params.workspaceId, params.provider);\n}\n\nexport function getInstanceDefaultModelProviderApiKeyField(\n  providerId: ModelProviderRef,\n): 'api_key' | undefined {\n  const credentialFields =\n    getModelProviderEntry(providerId as SupportedModelProviderId)?.credential_fields ?? [];\n  const field = credentialFields[0];\n  if (credentialFields.length !== 1 || field?.key !== 'api_key' || !field.secret) {\n    return undefined;\n  }\n  return 'api_key';\n}\n\nfunction instanceFallbackCredentials(\n  providerId: ModelProviderRef,\n  runtimeConfig: RuntimeCredentialsConfig,\n): Record<string, string> | undefined {\n  const instanceApiKey = runtimeConfig.AGENT_DEFAULT_PROVIDER_API_KEY;\n  if (providerId !== runtimeConfig.AGENT_DEFAULT_PROVIDER || !instanceApiKey) return undefined;\n\n  const fieldKey = getInstanceDefaultModelProviderApiKeyField(providerId);\n  if (!fieldKey) return undefined;\n\n  return {[fieldKey]: instanceApiKey};\n}\n\nfunction toResponse(\n  params: ResolveRuntimeCredentialsParams,\n  credentials: Record<string, string>,\n  providerConfig?: ModelProviderConfig | undefined,\n  managed?:\n    | {\n        provider: ManagedModelProvider;\n        runtimeConfig: ManagedProviderRuntimeConfig;\n      }\n    | undefined,\n): AgentRuntimeCredentialsResponseDto {\n  const response: AgentRuntimeCredentialsResponseDto = {\n    harness: params.harness,\n    provider_id: params.provider,\n    model: params.model,\n    thinking: params.thinking,\n    credentials,\n  };\n\n  if (providerConfig?.kind === 'custom') {\n    response.custom_provider = {\n      api: providerConfig.api ?? 'openai-responses',\n      base_url: providerConfig.baseUrl ?? '',\n      headers: providerConfig.headers ?? [],\n      secret_header_names: Object.keys(credentials)\n        .filter((key) => key.startsWith('header:'))\n        .map((key) => key.slice('header:'.length))\n        .sort(),\n      models: providerConfig.models ?? [],\n      requires_api_key: providerConfig.requiresApiKey,\n    };\n  }\n\n  if (managed !== undefined) {\n    const model = managed.provider.models.find((candidate) => candidate.id === params.model);\n    const modelDescriptor = toCustomAgentModelDto(model ?? {id: params.model, label: params.model});\n\n    if (params.harness === 'pi') {\n      response.custom_provider = {\n        api: managed.runtimeConfig.api,\n        base_url: managed.runtimeConfig.baseUrl,\n        headers: [],\n        secret_header_names: [],\n        models: [modelDescriptor],\n        requires_api_key: true,\n      };\n    } else {\n      const authToken = managed.runtimeConfig.credentials.api_key;\n      if (authToken === undefined) {\n        throw new ModelProviderConfigNotFoundError(params.workspaceId, params.provider);\n      }\n      response.claude = {\n        base_url: managed.runtimeConfig.baseUrl,\n        auth_token: authToken,\n      };\n    }\n  }\n\n  return response;\n}\n"],"names":["toCustomAgentModelDto","secretsInterModuleContract","isInterModuleKnownError","config","workspaceProvidersPolicy","getModelProviderConfig","agentRuntimeConfigResolvedCount","agentSystemNamespace","storeValuesToCustomRuntimeCredentials","storeValuesToRuntimeCredentials","ModelProviderConfigNotFoundError","WorkspaceProvidersDisabledError","getModelProviderEntry","modelProviderCredentialKeysMatch","requireAgentSecretsClient","resolveRuntimeCredentials","params","options","runtimeConfig","configuredWorkspaceProviders","workspaceProviders","secrets","managedProvider","id","provider","managedRuntimeConfig","resolveCredentials","workspaceId","runId","stepAttemptId","model","add","source","outcome","toResponse","credentials","undefined","AGENT_DEFAULT_PROVIDER","providerConfig","providerId","values","getCredentialBag","namespace","getSecretsByNamespace","kind","error","methods","instanceCredentials","instanceFallbackCredentials","getInstanceDefaultModelProviderApiKeyField","credentialFields","credential_fields","field","length","key","secret","instanceApiKey","AGENT_DEFAULT_PROVIDER_API_KEY","fieldKey","managed","response","harness","provider_id","thinking","custom_provider","api","base_url","baseUrl","headers","secret_header_names","Object","keys","filter","startsWith","map","slice","sort","models","requires_api_key","requiresApiKey","find","candidate","modelDescriptor","label","authToken","api_key","claude","auth_token"],"mappings":"AAUA,SAAQA,qBAAqB,QAAO,yBAAyB;AAC7D,SAAQC,0BAA0B,QAAO,wCAAwC;AACjF,SAAQC,uBAAuB,QAAO,wBAAwB;AAC9D,SAAQC,MAAM,EAAEC,wBAAwB,QAAO,aAAa;AAC5D,SAAQC,sBAAsB,QAAO,eAAe;AACpD,SAAQC,+BAA+B,QAAO,oBAAoB;AAClE,SACEC,oBAAoB,EACpBC,qCAAqC,EACrCC,+BAA+B,QAC1B,+BAA+B;AAEtC,SAAQC,gCAAgC,EAAEC,+BAA+B,QAAO,cAAc;AAC9F,SAAQC,qBAAqB,EAAEC,gCAAgC,QAAO,6BAA6B;AACnG,SAAiCC,yBAAyB,QAAO,sBAAsB;AA2BvF,OAAO,eAAeC,0BACpBC,MAAuC,EACvCC,OAA0C;IAE1C,MAAMC,gBAAgBD,SAASC,iBAAiBf;IAChD,MAAMgB,+BAA+BF,SAASG,sBAAsBhB;IACpE,MAAMiB,UAAUJ,SAASI;IACzB,MAAMC,kBAAkBL,SAASK;IACjC,IAAIA,iBAAiBC,OAAOP,OAAOQ,QAAQ,EAAE;QAC3C,MAAMC,uBAAuB,MAAMH,gBAAgBI,kBAAkB,CAAC;YACpEC,aAAaX,OAAOW,WAAW;YAC/BC,OAAOZ,OAAOY,KAAK;YACnBC,eAAeb,OAAOa,aAAa;YACnCC,OAAOd,OAAOc,KAAK;QACrB;QACAxB,gCAAgCyB,GAAG,CAAC,GAAG;YAACC,QAAQ;YAAYC,SAAS;QAAU;QAC/E,OAAOC,WAAWlB,QAAQS,qBAAqBU,WAAW,EAAEC,WAAW;YACrEZ,UAAUF;YACVJ,eAAeO;QACjB;IACF;IAEA,IAAIN,iCAAiC,YAAY;QAC/Cb,gCAAgCyB,GAAG,CAAC,GAAG;YACrCC,QAAQhB,OAAOQ,QAAQ,KAAKN,cAAcmB,sBAAsB,GAAG,aAAa;YAChFJ,SAAS;QACX;QACA,IAAIX,oBAAoBc,WAAW;YACjC,MAAM,IAAIzB,gCAAgCW,gBAAgBC,EAAE;QAC9D;QACA,MAAM,IAAIb,iCAAiCM,OAAOW,WAAW,EAAEX,OAAOQ,QAAQ;IAChF;IAEA,MAAMc,iBAAiB,MAAMjC,uBAAuB;QAClDsB,aAAaX,OAAOW,WAAW;QAC/BY,YAAYvB,OAAOQ,QAAQ;IAC7B;IAEA,IAAIc,gBAAgB;QAClB,IAAI;YACF,MAAME,SAASvB,SAASwB,mBACpB,MAAMxB,QAAQwB,gBAAgB,CAAC;gBAC7Bd,aAAaX,OAAOW,WAAW;gBAC/Be,WAAWnC,qBAAqBS,OAAOQ,QAAQ;YACjD,KACA,AACE,CAAA,MAAMV,0BAA0BO,SAASsB,qBAAqB,CAAC;gBAC7DhB,aAAaX,OAAOW,WAAW;gBAC/Be,WAAWnC,qBAAqBS,OAAOQ,QAAQ;YACjD,EAAC,EACDgB,MAAM;YACZ,IAAIF,eAAeM,IAAI,KAAK,UAAU;gBACpC,MAAMT,cAAc3B,sCAAsCgC;gBAC1DlC,gCAAgCyB,GAAG,CAAC,GAAG;oBAACC,QAAQ;oBAAaC,SAAS;gBAAU;gBAChF,OAAOC,WAAWlB,QAAQmB,aAAaG;YACzC;YAEA,MAAMC,aAAavB,OAAOQ,QAAQ;YAClC,MAAMW,cAAc1B,gCAAgC8B,YAAYC;YAChE,IAAI,CAAC3B,iCAAiC0B,YAAYJ,cAAc;gBAC9D,MAAM,IAAIzB,iCAAiCM,OAAOW,WAAW,EAAEX,OAAOQ,QAAQ;YAChF;YACAlB,gCAAgCyB,GAAG,CAAC,GAAG;gBAACC,QAAQ;gBAAaC,SAAS;YAAU;YAChF,OAAOC,WAAWlB,QAAQmB,aAAaG;QACzC,EAAE,OAAOO,OAAO;YACd,IACE3C,wBAAwBD,2BAA2B6C,OAAO,CAACH,qBAAqB,EAAEE,QAClF;gBACAvC,gCAAgCyB,GAAG,CAAC,GAAG;oBACrCC,QAAQ;oBACRC,SAAS;gBACX;YACF;YACA,MAAMY;QACR;IACF;IAEA,MAAME,sBAAsBC,4BAA4BhC,OAAOQ,QAAQ,EAAEN;IACzE,IAAI6B,qBAAqB;QACvBzC,gCAAgCyB,GAAG,CAAC,GAAG;YAACC,QAAQ;YAAYC,SAAS;QAAU;QAC/E,OAAOC,WAAWlB,QAAQ+B;IAC5B;IAEAzC,gCAAgCyB,GAAG,CAAC,GAAG;QACrCC,QAAQhB,OAAOQ,QAAQ,KAAKN,cAAcmB,sBAAsB,GAAG,aAAa;QAChFJ,SAAS;IACX;IACA,MAAM,IAAIvB,iCAAiCM,OAAOW,WAAW,EAAEX,OAAOQ,QAAQ;AAChF;AAEA,OAAO,SAASyB,2CACdV,UAA4B;IAE5B,MAAMW,mBACJtC,sBAAsB2B,aAAyCY,qBAAqB,EAAE;IACxF,MAAMC,QAAQF,gBAAgB,CAAC,EAAE;IACjC,IAAIA,iBAAiBG,MAAM,KAAK,KAAKD,OAAOE,QAAQ,aAAa,CAACF,MAAMG,MAAM,EAAE;QAC9E,OAAOnB;IACT;IACA,OAAO;AACT;AAEA,SAASY,4BACPT,UAA4B,EAC5BrB,aAAuC;IAEvC,MAAMsC,iBAAiBtC,cAAcuC,8BAA8B;IACnE,IAAIlB,eAAerB,cAAcmB,sBAAsB,IAAI,CAACmB,gBAAgB,OAAOpB;IAEnF,MAAMsB,WAAWT,2CAA2CV;IAC5D,IAAI,CAACmB,UAAU,OAAOtB;IAEtB,OAAO;QAAC,CAACsB,SAAS,EAAEF;IAAc;AACpC;AAEA,SAAStB,WACPlB,MAAuC,EACvCmB,WAAmC,EACnCG,cAAgD,EAChDqB,OAKa;IAEb,MAAMC,WAA+C;QACnDC,SAAS7C,OAAO6C,OAAO;QACvBC,aAAa9C,OAAOQ,QAAQ;QAC5BM,OAAOd,OAAOc,KAAK;QACnBiC,UAAU/C,OAAO+C,QAAQ;QACzB5B;IACF;IAEA,IAAIG,gBAAgBM,SAAS,UAAU;QACrCgB,SAASI,eAAe,GAAG;YACzBC,KAAK3B,eAAe2B,GAAG,IAAI;YAC3BC,UAAU5B,eAAe6B,OAAO,IAAI;YACpCC,SAAS9B,eAAe8B,OAAO,IAAI,EAAE;YACrCC,qBAAqBC,OAAOC,IAAI,CAACpC,aAC9BqC,MAAM,CAAC,CAAClB,MAAQA,IAAImB,UAAU,CAAC,YAC/BC,GAAG,CAAC,CAACpB,MAAQA,IAAIqB,KAAK,CAAC,UAAUtB,MAAM,GACvCuB,IAAI;YACPC,QAAQvC,eAAeuC,MAAM,IAAI,EAAE;YACnCC,kBAAkBxC,eAAeyC,cAAc;QACjD;IACF;IAEA,IAAIpB,YAAYvB,WAAW;QACzB,MAAMN,QAAQ6B,QAAQnC,QAAQ,CAACqD,MAAM,CAACG,IAAI,CAAC,CAACC,YAAcA,UAAU1D,EAAE,KAAKP,OAAOc,KAAK;QACvF,MAAMoD,kBAAkBlF,sBAAsB8B,SAAS;YAACP,IAAIP,OAAOc,KAAK;YAAEqD,OAAOnE,OAAOc,KAAK;QAAA;QAE7F,IAAId,OAAO6C,OAAO,KAAK,MAAM;YAC3BD,SAASI,eAAe,GAAG;gBACzBC,KAAKN,QAAQzC,aAAa,CAAC+C,GAAG;gBAC9BC,UAAUP,QAAQzC,aAAa,CAACiD,OAAO;gBACvCC,SAAS,EAAE;gBACXC,qBAAqB,EAAE;gBACvBQ,QAAQ;oBAACK;iBAAgB;gBACzBJ,kBAAkB;YACpB;QACF,OAAO;YACL,MAAMM,YAAYzB,QAAQzC,aAAa,CAACiB,WAAW,CAACkD,OAAO;YAC3D,IAAID,cAAchD,WAAW;gBAC3B,MAAM,IAAI1B,iCAAiCM,OAAOW,WAAW,EAAEX,OAAOQ,QAAQ;YAChF;YACAoC,SAAS0B,MAAM,GAAG;gBAChBpB,UAAUP,QAAQzC,aAAa,CAACiD,OAAO;gBACvCoB,YAAYH;YACd;QACF;IACF;IAEA,OAAOxB;AACT"}