@skaile/forge-settings 1.0.0 → 1.0.1

package/CHANGELOG.md

@@ -1,5 +1,12 @@
 # Changelog
 
+## 1.0.1
+
+- `@skaile/forge-settings/ai-sdk`: an `unresolved` `ModelResolutionError` no longer copies Workspaces' error text into `message` (it could echo a resolved credential or a key in an endpoint query). The message is now fixed (`provider '<id>': credential, endpoint or provider SDK could not be resolved`); the original error stays on `cause`.
+- Refusal wording is one format across adapters: `provider '<id>': <reason>`. `./editor` previously said `AI provider "<id>": <reason>`, for both `policy_refused` and `unresolved`.
+- `entryPolicyRefusal(entry, policy?)` accepts an absent policy (refuses nothing), so call sites no longer branch on it.
+- Internal: one `isPlainObject`, one `assertEntryAllowed`, and the providers panel's types and pure reference helpers moved to `vue/providers-panel-model.ts`. No public export changes.
+
 ## 1.0.0
 
 First release. Extracted from `@skaile/forge-common` (provider/settings half) and skaile-forge's editor model adapter; `@skaile/forge-common` is unchanged and stays installable for consumers that have not migrated.

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@skaile/forge-settings",
   "configKey": "forgeSettings",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/runtime/ai-sdk/index.d.ts

@@ -14,7 +14,7 @@
  * one the selected surface needs.
  */
 import { type ResolvedLanguageModel } from "@skaile/workspaces/ai-sdk";
-import { type CredentialPolicy } from "../server/credential-policy.js";
+import type { CredentialPolicy } from "../server/credential-policy.js";
 export { ModelResolutionError } from "../model/errors.js";
 export type { ModelResolutionCode } from "../model/errors.js";
 export type { ResolvedLanguageModel };
@@ -40,6 +40,7 @@ export interface ResolveRegistryLanguageModelOptions {
  * `@role`), resolved by Workspaces against the registry on disk.
  *
  * @throws {ModelResolutionError} `registry_invalid` · `unknown_selector` ·
- *   `policy_refused` · `unresolved` (credential, endpoint or provider SDK).
+ *   `policy_refused` · `unresolved` (credential, endpoint or provider SDK; the
+ *   message is fixed and never carries Workspaces' text, which stays on `cause`).
  */
 export declare function resolveRegistryLanguageModel(selector: string, options: ResolveRegistryLanguageModelOptions): Promise<ResolvedLanguageModel>;

package/dist/runtime/ai-sdk/index.js

@@ -1,8 +1,7 @@
 import { parseModelRef } from "@skaile/workspaces/core";
 import { resolveLanguageModel } from "@skaile/workspaces/ai-sdk";
 import { loadMergedProviderRegistry } from "@skaile/workspaces/sdk/bridge";
-import { entryPolicyRefusal } from "../server/credential-policy.js";
-import { ModelResolutionError } from "../model/errors.js";
+import { ModelResolutionError, assertEntryAllowed } from "../model/errors.js";
 export { ModelResolutionError } from "../model/errors.js";
 export async function resolveRegistryLanguageModel(selector, options) {
   const { merged, diagnostics } = loadMergedProviderRegistry({ projectDir: options.projectDir });
@@ -15,14 +14,7 @@ export async function resolveRegistryLanguageModel(selector, options) {
     throw new ModelResolutionError("unknown_selector", `no provider serves '${selector}'`);
   }
   const entry = merged.providers[ref.providerId];
-  if (entry && options.policy) {
-    const refusal = entryPolicyRefusal(entry, options.policy);
-    if (refusal) {
-      throw new ModelResolutionError("policy_refused", `provider '${ref.providerId}': ${refusal}`, {
-        providerId: ref.providerId
-      });
-    }
-  }
+  if (entry) assertEntryAllowed(entry, ref.providerId, options.policy);
   try {
     return await resolveLanguageModel(selector, {
       projectDir: options.projectDir,
@@ -32,7 +24,7 @@ export async function resolveRegistryLanguageModel(selector, options) {
   } catch (cause) {
     throw new ModelResolutionError(
       "unresolved",
-      cause instanceof Error ? cause.message : String(cause),
+      `provider '${ref.providerId}': credential, endpoint or provider SDK could not be resolved`,
       { providerId: ref.providerId, cause }
     );
   }

package/dist/runtime/editor/index.js

@@ -1,5 +1,5 @@
 import { createOpenAICompatible } from "@ai-sdk/openai-compatible";
-import { ModelResolutionError } from "../model/errors.js";
+import { ModelResolutionError, assertEntryAllowed } from "../model/errors.js";
 import { entryPolicyRefusal } from "../server/credential-policy.js";
 import { resolveEntryCredential } from "../server/credential-store.js";
 import { listAIProviderModels } from "../server/provider-service.js";
@@ -19,7 +19,7 @@ export function editorModelProfiles(registry, options = {}) {
   const entries = editorEntries(registry);
   const allowed = (providerId) => {
     const entry = entries.get(providerId);
-    return entry !== void 0 && !(options.policy && entryPolicyRefusal(entry, options.policy));
+    return entry !== void 0 && !entryPolicyRefusal(entry, options.policy);
   };
   return listAIProviderModels(registry).filter((model) => allowed(model.providerId)).map((model) => ({
     id: model.id,
@@ -34,18 +34,7 @@ export function editorLanguageModel(registry, env, ref, options = {}) {
   const model = listAIProviderModels(registry).find((candidate) => candidate.id === ref.preset);
   const entry = model && editorEntries(registry).get(model.providerId);
   if (!model || !entry) return null;
-  if (options.policy) {
-    const refusal = entryPolicyRefusal(entry, options.policy);
-    if (refusal) {
-      throw new ModelResolutionError(
-        "policy_refused",
-        `AI provider "${model.providerId}": ${refusal}`,
-        {
-          providerId: model.providerId
-        }
-      );
-    }
-  }
+  assertEntryAllowed(entry, model.providerId, options.policy);
   const credential = resolveEntryCredential(entry, {
     env,
     ...options.policy ? { policy: options.policy } : {}
@@ -53,7 +42,7 @@ export function editorLanguageModel(registry, env, ref, options = {}) {
   if (credential.error && !credential.value) {
     throw new ModelResolutionError(
       "unresolved",
-      `AI provider "${model.providerId}": ${credential.error}`,
+      `provider '${model.providerId}': ${credential.error}`,
       { providerId: model.providerId }
     );
   }

package/dist/runtime/model/errors.d.ts

@@ -1,3 +1,5 @@
+import { type CredentialPolicy } from "../server/credential-policy.js";
+import type { AIProviderEntry } from "../shared/provider-registry.js";
 /**
  * A model could not be resolved. Framework-free: the host decides which HTTP
  * status (or tool error) each `code` becomes.
@@ -22,3 +24,9 @@ export declare class ModelResolutionError extends Error {
         cause?: unknown;
     });
 }
+/**
+ * Throw `policy_refused` when `policy` refuses `entry`; no policy refuses
+ * nothing. The one place a model adapter turns a policy refusal into an error,
+ * so every adapter words it the same way. Nothing is resolved.
+ */
+export declare function assertEntryAllowed(entry: AIProviderEntry, providerId: string, policy?: CredentialPolicy): void;

package/dist/runtime/model/errors.js

@@ -1,3 +1,4 @@
+import { entryPolicyRefusal } from "../server/credential-policy.js";
 export class ModelResolutionError extends Error {
   code;
   providerId;
@@ -8,3 +9,11 @@ export class ModelResolutionError extends Error {
     if (options.providerId !== void 0) this.providerId = options.providerId;
   }
 }
+export function assertEntryAllowed(entry, providerId, policy) {
+  const refusal = entryPolicyRefusal(entry, policy);
+  if (refusal) {
+    throw new ModelResolutionError("policy_refused", `provider '${providerId}': ${refusal}`, {
+      providerId
+    });
+  }
+}

package/dist/runtime/server/credential-policy.d.ts

@@ -48,8 +48,9 @@ export declare function credentialRefRefusal(ref: string, policy: CredentialPoli
 /**
  * The reason an entry is refused, or `undefined`: its credential reference and
  * every environment name it interpolates are checked, nothing is resolved.
+ * Without a policy nothing is refused.
  */
-export declare function entryPolicyRefusal(entry: AIProviderEntry, policy: CredentialPolicy): string | undefined;
+export declare function entryPolicyRefusal(entry: AIProviderEntry, policy?: CredentialPolicy): string | undefined;
 /**
  * The registry without the entries the policy refuses, as a plain entry map in
  * registry order, plus what was refused. Nothing is resolved.

package/dist/runtime/server/credential-policy.js

@@ -30,6 +30,7 @@ function interpolationRefusal(field, value, policy) {
   return void 0;
 }
 export function entryPolicyRefusal(entry, policy) {
+  if (!policy) return void 0;
   const ref = entry.credential?.ref;
   if (ref !== void 0) {
     const refusal = credentialRefRefusal(ref, policy);

package/dist/runtime/server/credential-store.js

@@ -186,7 +186,7 @@ export function resolveCredentialRef(ref, options = {}) {
   }
 }
 export function resolveEntryCredential(entry, options = {}) {
-  const refusal = options.policy ? entryPolicyRefusal(entry, options.policy) : void 0;
+  const refusal = entryPolicyRefusal(entry, options.policy);
   if (refusal) return { source: "none", error: refusal };
   const credential = entry.credential;
   if (!credential || credential.kind === "none") return { source: "none" };

package/dist/runtime/server/env-layers.js

@@ -1,6 +1,7 @@
 import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import { AI_PROVIDER_PRESETS } from "@skaile/workspaces/sdk/bridge";
+import { isPlainObject } from "../shared/guards.js";
 import { parseCredentialRef, registryEntries } from "../shared/provider-registry.js";
 import {
   ENV_LAYER_ORDER,
@@ -153,9 +154,6 @@ export function buildEnvSettingsDocument(input) {
   }
   return { scope: input.scope, editable: input.editable, layer: input.scope, vars, missing };
 }
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 export function validateEnvSettingsUpdate(body) {
   if (!isPlainObject(body)) return "Body must be an object with `set` and/or `unset`";
   const set = {};

package/dist/runtime/server/provider-discovery.js

@@ -27,7 +27,7 @@ export async function discoverProviderModels(providerId, registry, options) {
     return { status: "unsupported", providerId, reason: "only llm entries list models" };
   }
   if (!isEntryEnabled(entry)) return { status: "error", providerId, error: "entry is disabled" };
-  const refusal = options.policy ? entryPolicyRefusal(entry, options.policy) : void 0;
+  const refusal = entryPolicyRefusal(entry, options.policy);
   if (refusal) return { status: "error", providerId, error: refusal };
   const credential = resolveEntryCredential(entry, {
     env: options.env,

package/dist/runtime/server/provider-layers.js

@@ -5,10 +5,8 @@ import {
 } from "@skaile/workspaces/core";
 import { AI_PROVIDER_PRESETS } from "@skaile/workspaces/sdk/bridge";
 import { parse as parseYaml } from "yaml";
+import { isPlainObject } from "../shared/guards.js";
 const PROVIDERS_FILENAME_ALIAS = "providers.yaml";
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 export function providerLayerDocument(path) {
   if (existsSync(path)) return path;
   const alias = `${path.slice(0, -PROVIDERS_FILENAME.length)}${PROVIDERS_FILENAME_ALIAS}`;

package/dist/runtime/server/provider-write.js

@@ -10,6 +10,7 @@ import {
   AI_PROVIDER_PRESETS,
   expandPreset
 } from "@skaile/workspaces/sdk/bridge";
+import { isPlainObject } from "../shared/guards.js";
 import { entryPolicyRefusal } from "./credential-policy.js";
 import { catalogPreset, readProviderLayer, writeProviderLayer } from "./provider-layers.js";
 export class ProviderWriteError extends Error {
@@ -46,9 +47,6 @@ export function providerScopeWritable(scope, caller) {
   if (caller.isAdmin) return true;
   return scope.name !== "instance" && !scope.lock;
 }
-function isPlainObject(value) {
-  return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function mergeLayerOf(scope) {
   return scope.name === "instance" ? "user" : "workspace";
 }
@@ -154,7 +152,7 @@ export function upsertProviderEntry(scope, id, body) {
     entry = { ...kept, ...fields };
   }
   const next = { ...providers, [id]: entry };
-  const refusal = scope.policy ? entryPolicyRefusal(entry, scope.policy) : void 0;
+  const refusal = entryPolicyRefusal(entry, scope.policy);
   if (refusal) throw createError({ statusCode: 400, statusMessage: refusal });
   const diagnostics = entryErrors(scope, next, id);
   if (diagnostics.length > 0) {

package/dist/runtime/shared/guards.d.ts

@@ -0,0 +1,2 @@
+/** A non-null, non-array object. */
+export declare function isPlainObject(value: unknown): value is Record<string, unknown>;

package/dist/runtime/shared/guards.js

@@ -0,0 +1,3 @@
+export function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}

package/dist/runtime/vue/providers-panel-model.d.ts

@@ -0,0 +1,147 @@
+/**
+ * The providers panel's vocabulary: the types the panel and its composable
+ * share, the constants of its form, and the pure reference / error helpers.
+ * No Vue, no requests — testable on their own. The public types and constants
+ * are re-exported by `useProvidersPanel`; the rest is internal to the package.
+ */
+import type { EnvLayerId } from "../shared/env-vars.js";
+import type { AIProviderCredentialKind, AIProviderKind, AIProviderSurface } from "../shared/provider-registry.js";
+/** Registry document a provider entry is defined in. */
+export type ProvidersPanelLayer = "instance" | "workspace";
+/** Props both `ForgeProvidersPanel` variants declare. */
+export interface ProvidersPanelProps {
+    /** `GET` merged view for this scope (`/api/providers` | `/api/workspaces/:id/providers`). */
+    providersUrl: string;
+    /** `PUT|DELETE ${providersWriteUrl}/:id`; `GET ${providersWriteUrl}/detected`. */
+    providersWriteUrl: string;
+    /** Catalog preset summaries. Default `/api/providers/presets`. */
+    presetsUrl?: string;
+    /**
+     * The scope's `.env` route. `GET` on load and after every write; keys typed
+     * into the panel write through it. Omitted, no key can be entered.
+     */
+    environmentUrl?: string;
+    /** The scope's own registry document. */
+    layer: ProvidersPanelLayer;
+    /** Disables every write (non-admin at instance scope; provider lock). */
+    readOnly?: boolean;
+}
+/** Emits both variants declare. */
+export type ProvidersPanelEmit = (event: "changed") => void;
+/** One entry of `GET ${providersUrl}?all=1`. */
+export interface ProvidersPanelEntry {
+    id: string;
+    /** The entry's label, else its id. */
+    name: string;
+    kind: AIProviderKind;
+    /** Whether the credential reference resolved on the server. */
+    configured: boolean;
+    /** Why it did not resolve. Secret-free. */
+    error?: string;
+    credentialRef?: string;
+    credentialKind?: AIProviderCredentialKind;
+    hasEnvKey: boolean;
+    envKeyName?: string;
+    baseUrl?: string;
+    preset?: string;
+    surface?: AIProviderSurface;
+    enabled: boolean;
+    locked: boolean;
+    /** Registry documents holding the id, lowest first: `["instance"]`, `["workspace"]` or both. */
+    layers: ProvidersPanelLayer[];
+    /** The scope's own document's values for the editable fields the dialog does not show. */
+    layerFields?: Record<string, unknown>;
+}
+/** One catalog preset, as `GET /api/providers/presets` and `.../detected` list it. */
+export interface ProvidersPanelPreset {
+    id: string;
+    label: string;
+    kind: AIProviderKind;
+    surface?: AIProviderSurface;
+    base_url?: string;
+    base_url_env?: string;
+    credential: {
+        kind: AIProviderCredentialKind;
+        env?: string;
+    };
+}
+/** Where a row's entry lives relative to the scope's own document. */
+export type ProvidersPanelRowState = "own" | "inherited" | "patched";
+/** One entry of a row's credential select. */
+export interface ProvidersPanelCredentialOption {
+    /** An env var NAME, a literal non-env ref, {@link CREDENTIAL_ENTER_KEY} or {@link CREDENTIAL_OTHER_REF}. */
+    value: string;
+    /** `NAME ••••hint` | `NAME (not set)` | the literal ref | `Enter a key…` | `Other reference…`. */
+    label: string;
+    defined?: boolean;
+    hint?: string;
+    source?: EnvLayerId;
+    action?: "enter-key" | "other-ref";
+}
+/** A table row: the entry plus what the panel derives for it. */
+export interface ProvidersPanelRow extends ProvidersPanelEntry {
+    /** Own entry, an inherited one, or an inherited one this scope patched. */
+    state: ProvidersPanelRowState;
+    /** `instance` | `workspace` | `instance · overridden here`. */
+    badge: string;
+    /** Set on inherited rows. */
+    inheritedNote?: string;
+    /** Edit/Delete offered: the scope's document defines it and the panel is writable. */
+    editable: boolean;
+    /** Reset offered: a patched row of a writable panel. */
+    canReset: boolean;
+    /** The enabled switch is live. */
+    canToggle: boolean;
+    /** The entry takes a credential (its kind is not `none`). */
+    needsCredential: boolean;
+    /** The credential picker is live. */
+    canEditCredential: boolean;
+    /** The select's model: the env var NAME of an `env:` ref, else the literal ref, else `""`. */
+    credentialValue: string;
+    credentialOptions: ProvidersPanelCredentialOption[];
+    /** The preset it inherits, else its surface, else its kind. */
+    origin: string;
+    /** `configured · <source>`, `missing <VAR>`, the resolver's reason, or `No credential needed.`. */
+    status: string;
+    /** Which other layer defines or overrides the credential; see the panel contract. */
+    overrideNotices: string[];
+}
+/** The add/edit dialog's fields. */
+export interface ProvidersPanelForm {
+    /** A preset id, or {@link CUSTOM_PRESET}. */
+    preset: string;
+    id: string;
+    /** Custom entries only. */
+    surface: string;
+    /** Empty: the preset's endpoint. */
+    baseUrl: string;
+    /** Adding only: the `env:` variable the credential references. */
+    envName: string;
+    /** Adding only, "Set value now": written to the scope's `.env`, never to the provider route. */
+    secret: string;
+}
+/** The preset select's value for an entry that names no preset. */
+export declare const CUSTOM_PRESET = "__custom__";
+/** Credential select value: open the inline key editor. */
+export declare const CREDENTIAL_ENTER_KEY = "__enter_key__";
+/** Credential select value: open the inline reference editor. */
+export declare const CREDENTIAL_OTHER_REF = "__other_ref__";
+/** Registry ids the write routes accept (`isSafeProviderId` upstream). */
+export declare const PROVIDER_ID_PATTERN: RegExp;
+export declare const DEFAULT_PRESETS_URL = "/api/providers/presets";
+/** An `env:NAME` credential reference; group 1 is the variable name. */
+export declare const ENV_REF_PATTERN: RegExp;
+/** The credential kind a written reference gets when the row states none. */
+export declare const FALLBACK_CREDENTIAL_KIND: AIProviderCredentialKind;
+export declare const ENV_SOURCE_LABEL: Record<EnvLayerId, string>;
+export declare const OVERRIDES_INSTANCE_NOTICE = "Entering a key here stores it in this workspace's .env and overrides that value for this workspace.";
+/**
+ * The server's refusal for a failed request, else `fallback`. A registry
+ * rejection (`400` with `data.diagnostics`) reads as its diagnostics' messages.
+ */
+export declare function requestErrorMessage(err: unknown, fallback: string): string;
+/** The variable name of an `env:NAME` reference. */
+export declare function envNameOfRef(ref: string | undefined): string | undefined;
+/** `configured · …` for a reference that is not an env var. */
+export declare function nonEnvSourceLabel(ref: string): string | undefined;
+export declare const EMPTY_FORM: Readonly<ProvidersPanelForm>;

package/dist/runtime/vue/providers-panel-model.js

@@ -0,0 +1,37 @@
+export const CUSTOM_PRESET = "__custom__";
+export const CREDENTIAL_ENTER_KEY = "__enter_key__";
+export const CREDENTIAL_OTHER_REF = "__other_ref__";
+export const PROVIDER_ID_PATTERN = /^[a-z0-9][a-z0-9_-]*$/;
+export const DEFAULT_PRESETS_URL = "/api/providers/presets";
+export const ENV_REF_PATTERN = /^env:(.+)$/;
+export const FALLBACK_CREDENTIAL_KIND = "api_key_header";
+export const ENV_SOURCE_LABEL = {
+  instance: "instance .env",
+  workspace: "workspace .env",
+  process: "boot environment"
+};
+export const OVERRIDES_INSTANCE_NOTICE = "Entering a key here stores it in this workspace's .env and overrides that value for this workspace.";
+export function requestErrorMessage(err, fallback) {
+  const e = err;
+  const details = (e?.data?.data?.diagnostics ?? []).map((d) => d.message).filter((m) => typeof m === "string" && m !== "");
+  if (details.length > 0) return details.join("; ");
+  const message = e?.data?.statusMessage ?? e?.statusMessage;
+  return typeof message === "string" && message ? message : fallback;
+}
+export function envNameOfRef(ref) {
+  return ref ? ENV_REF_PATTERN.exec(ref)?.[1] : void 0;
+}
+export function nonEnvSourceLabel(ref) {
+  if (ref.startsWith("keyring:")) return "keyring";
+  if (ref.startsWith("cmd:")) return "runtime-owned (cmd)";
+  if (ref.startsWith("platform:")) return "control-plane-owned (platform)";
+  return void 0;
+}
+export const EMPTY_FORM = {
+  preset: "",
+  id: "",
+  surface: "",
+  baseUrl: "",
+  envName: "",
+  secret: ""
+};

package/dist/runtime/vue/useProvidersPanel.d.ts

@@ -14,128 +14,11 @@
  * value.
  */
 import { type ComputedRef, type Ref, type WritableComputedRef } from "vue";
-import { type EnvLayerId, type EnvSettingsDocument } from "../shared/env-vars.js";
-import { type AIProviderCredentialKind, type AIProviderKind, type AIProviderSurface } from "../shared/provider-registry.js";
-/** Registry document a provider entry is defined in. */
-export type ProvidersPanelLayer = "instance" | "workspace";
-/** Props both `ForgeProvidersPanel` variants declare. */
-export interface ProvidersPanelProps {
-    /** `GET` merged view for this scope (`/api/providers` | `/api/workspaces/:id/providers`). */
-    providersUrl: string;
-    /** `PUT|DELETE ${providersWriteUrl}/:id`; `GET ${providersWriteUrl}/detected`. */
-    providersWriteUrl: string;
-    /** Catalog preset summaries. Default `/api/providers/presets`. */
-    presetsUrl?: string;
-    /**
-     * The scope's `.env` route. `GET` on load and after every write; keys typed
-     * into the panel write through it. Omitted, no key can be entered.
-     */
-    environmentUrl?: string;
-    /** The scope's own registry document. */
-    layer: ProvidersPanelLayer;
-    /** Disables every write (non-admin at instance scope; provider lock). */
-    readOnly?: boolean;
-}
-/** Emits both variants declare. */
-export type ProvidersPanelEmit = (event: "changed") => void;
-/** One entry of `GET ${providersUrl}?all=1`. */
-export interface ProvidersPanelEntry {
-    id: string;
-    /** The entry's label, else its id. */
-    name: string;
-    kind: AIProviderKind;
-    /** Whether the credential reference resolved on the server. */
-    configured: boolean;
-    /** Why it did not resolve. Secret-free. */
-    error?: string;
-    credentialRef?: string;
-    credentialKind?: AIProviderCredentialKind;
-    hasEnvKey: boolean;
-    envKeyName?: string;
-    baseUrl?: string;
-    preset?: string;
-    surface?: AIProviderSurface;
-    enabled: boolean;
-    locked: boolean;
-    /** Registry documents holding the id, lowest first: `["instance"]`, `["workspace"]` or both. */
-    layers: ProvidersPanelLayer[];
-    /** The scope's own document's values for the editable fields the dialog does not show. */
-    layerFields?: Record<string, unknown>;
-}
-/** One catalog preset, as `GET /api/providers/presets` and `.../detected` list it. */
-export interface ProvidersPanelPreset {
-    id: string;
-    label: string;
-    kind: AIProviderKind;
-    surface?: AIProviderSurface;
-    base_url?: string;
-    base_url_env?: string;
-    credential: {
-        kind: AIProviderCredentialKind;
-        env?: string;
-    };
-}
-/** Where a row's entry lives relative to the scope's own document. */
-export type ProvidersPanelRowState = "own" | "inherited" | "patched";
-/** One entry of a row's credential select. */
-export interface ProvidersPanelCredentialOption {
-    /** An env var NAME, a literal non-env ref, {@link CREDENTIAL_ENTER_KEY} or {@link CREDENTIAL_OTHER_REF}. */
-    value: string;
-    /** `NAME ••••hint` | `NAME (not set)` | the literal ref | `Enter a key…` | `Other reference…`. */
-    label: string;
-    defined?: boolean;
-    hint?: string;
-    source?: EnvLayerId;
-    action?: "enter-key" | "other-ref";
-}
-/** A table row: the entry plus what the panel derives for it. */
-export interface ProvidersPanelRow extends ProvidersPanelEntry {
-    /** Own entry, an inherited one, or an inherited one this scope patched. */
-    state: ProvidersPanelRowState;
-    /** `instance` | `workspace` | `instance · overridden here`. */
-    badge: string;
-    /** Set on inherited rows. */
-    inheritedNote?: string;
-    /** Edit/Delete offered: the scope's document defines it and the panel is writable. */
-    editable: boolean;
-    /** Reset offered: a patched row of a writable panel. */
-    canReset: boolean;
-    /** The enabled switch is live. */
-    canToggle: boolean;
-    /** The entry takes a credential (its kind is not `none`). */
-    needsCredential: boolean;
-    /** The credential picker is live. */
-    canEditCredential: boolean;
-    /** The select's model: the env var NAME of an `env:` ref, else the literal ref, else `""`. */
-    credentialValue: string;
-    credentialOptions: ProvidersPanelCredentialOption[];
-    /** The preset it inherits, else its surface, else its kind. */
-    origin: string;
-    /** `configured · <source>`, `missing <VAR>`, the resolver's reason, or `No credential needed.`. */
-    status: string;
-    /** Which other layer defines or overrides the credential; see the panel contract. */
-    overrideNotices: string[];
-}
-/** The add/edit dialog's fields. */
-export interface ProvidersPanelForm {
-    /** A preset id, or {@link CUSTOM_PRESET}. */
-    preset: string;
-    id: string;
-    /** Custom entries only. */
-    surface: string;
-    /** Empty: the preset's endpoint. */
-    baseUrl: string;
-    /** Adding only: the `env:` variable the credential references. */
-    envName: string;
-    /** Adding only, "Set value now": written to the scope's `.env`, never to the provider route. */
-    secret: string;
-}
-/** The preset select's value for an entry that names no preset. */
-export declare const CUSTOM_PRESET = "__custom__";
-/** Credential select value: open the inline key editor. */
-export declare const CREDENTIAL_ENTER_KEY = "__enter_key__";
-/** Credential select value: open the inline reference editor. */
-export declare const CREDENTIAL_OTHER_REF = "__other_ref__";
+import { type EnvSettingsDocument } from "../shared/env-vars.js";
+import { type AIProviderSurface } from "../shared/provider-registry.js";
+import { type ProvidersPanelEntry, type ProvidersPanelEmit, type ProvidersPanelForm, type ProvidersPanelPreset, type ProvidersPanelProps, type ProvidersPanelRow } from "./providers-panel-model.js";
+export { CREDENTIAL_ENTER_KEY, CREDENTIAL_OTHER_REF, CUSTOM_PRESET } from "./providers-panel-model.js";
+export type { ProvidersPanelCredentialOption, ProvidersPanelEmit, ProvidersPanelEntry, ProvidersPanelForm, ProvidersPanelLayer, ProvidersPanelPreset, ProvidersPanelProps, ProvidersPanelRow, ProvidersPanelRowState, } from "./providers-panel-model.js";
 /** What both `ForgeProvidersPanel` variants bind to. */
 export interface ProvidersPanelState {
     /** The scope's entries, disabled ones included, in registry order. */

package/dist/runtime/vue/useProvidersPanel.js

@@ -13,43 +13,21 @@ import {
   AI_PROVIDER_SURFACES,
   validateCredentialRef
 } from "../shared/provider-registry.js";
-export const CUSTOM_PRESET = "__custom__";
-export const CREDENTIAL_ENTER_KEY = "__enter_key__";
-export const CREDENTIAL_OTHER_REF = "__other_ref__";
-const PROVIDER_ID_PATTERN = /^[a-z0-9][a-z0-9_-]*$/;
-const DEFAULT_PRESETS_URL = "/api/providers/presets";
-const ENV_REF_PATTERN = /^env:(.+)$/;
-const FALLBACK_CREDENTIAL_KIND = "api_key_header";
-const ENV_SOURCE_LABEL = {
-  instance: "instance .env",
-  workspace: "workspace .env",
-  process: "boot environment"
-};
-const OVERRIDES_INSTANCE_NOTICE = "Entering a key here stores it in this workspace's .env and overrides that value for this workspace.";
-function requestErrorMessage(err, fallback) {
-  const e = err;
-  const details = (e?.data?.data?.diagnostics ?? []).map((d) => d.message).filter((m) => typeof m === "string" && m !== "");
-  if (details.length > 0) return details.join("; ");
-  const message = e?.data?.statusMessage ?? e?.statusMessage;
-  return typeof message === "string" && message ? message : fallback;
-}
-function envNameOfRef(ref2) {
-  return ref2 ? ENV_REF_PATTERN.exec(ref2)?.[1] : void 0;
-}
-function nonEnvSourceLabel(ref2) {
-  if (ref2.startsWith("keyring:")) return "keyring";
-  if (ref2.startsWith("cmd:")) return "runtime-owned (cmd)";
-  if (ref2.startsWith("platform:")) return "control-plane-owned (platform)";
-  return void 0;
-}
-const EMPTY_FORM = {
-  preset: "",
-  id: "",
-  surface: "",
-  baseUrl: "",
-  envName: "",
-  secret: ""
-};
+import {
+  CREDENTIAL_ENTER_KEY,
+  CREDENTIAL_OTHER_REF,
+  CUSTOM_PRESET,
+  DEFAULT_PRESETS_URL,
+  EMPTY_FORM,
+  ENV_SOURCE_LABEL,
+  envNameOfRef,
+  FALLBACK_CREDENTIAL_KIND,
+  nonEnvSourceLabel,
+  OVERRIDES_INSTANCE_NOTICE,
+  PROVIDER_ID_PATTERN,
+  requestErrorMessage
+} from "./providers-panel-model.js";
+export { CREDENTIAL_ENTER_KEY, CREDENTIAL_OTHER_REF, CUSTOM_PRESET } from "./providers-panel-model.js";
 export function useProvidersPanel(props, emit) {
   const providers = ref([]);
   const presets = ref([]);