@skaile/forge-settings 1.3.3 → 2.0.0

package/src/runtime/ai-sdk/index.ts

@@ -1,33 +1,43 @@
 /**
  * `@skaile/forge-settings/ai-sdk` — the AI SDK language model of a registry
- * selector, resolved by `@skaile/workspaces/ai-sdk` and gated by the host's
- * credential policy.
+ * selector, built by `@skaile/provider-registry/ai-sdk` against one registry
+ * snapshot the host passes, with the credential resolved under the host's
+ * policy.
  *
- * Workspaces owns endpoint, header and credential wiring for every surface;
- * this module only decides *whether* an entry may be resolved and against
- * *which* environment. It is not a service locator: the caller passes the
- * selector (role-to-selector mapping belongs to the host's settings document)
- * and the environment explicitly.
+ * The shared constructor owns endpoint, header and SDK wiring for every
+ * surface it supports; this module decides *whether* an entry may be resolved
+ * and supplies its credential — through the same policy-checked resolver model
+ * discovery uses, so a model that lists is a model that calls with the same
+ * key. It is not a service locator: the caller passes the selector
+ * (role-to-selector mapping belongs to the host's settings document), the
+ * registry and the environment explicitly. Nothing is read from disk here;
+ * a Skaile Workspaces host that resolves against a project's registry uses
+ * `resolveWorkspaceLanguageModel` from `@skaile/forge-settings/workspaces`.
  *
  * Provider SDKs (`@ai-sdk/anthropic`, `@ai-sdk/openai`,
- * `@ai-sdk/openai-compatible`) are optional peers of Workspaces: install the
- * one the selected surface needs.
+ * `@ai-sdk/openai-compatible`) are optional peers: install the one the
+ * selected surface needs.
  */
 
-import { type MergedAIProviderRegistry, parseModelRef } from "@skaile/workspaces/core";
-import { type ResolvedLanguageModel, resolveLanguageModel } from "@skaile/workspaces/ai-sdk";
-import { loadMergedProviderRegistry } from "@skaile/workspaces/sdk/bridge";
+import { type MergedAIProviderRegistry, parseModelRef } from "@skaile/provider-registry";
+import {
+  type EntryCredentialResolver,
+  type ResolvedLanguageModel,
+  resolveLanguageModel,
+} from "@skaile/provider-registry/ai-sdk";
+import { assertEntryAllowed, ModelResolutionError } from "../model/errors";
+import { credentialStoreOptions, selectorProviderId } from "../model/selector";
 import type { CredentialPolicy } from "../server/credential-policy";
-import { ModelResolutionError, assertEntryAllowed } from "../model/errors";
+import { resolveEntryCredential } from "../server/credential-store";
 
-export { ModelResolutionError } from "../model/errors";
 export type { ModelResolutionCode } from "../model/errors";
+export { ModelResolutionError } from "../model/errors";
 export type { ResolvedLanguageModel };
 
 /** Options for {@link resolveRegistryLanguageModel}. */
 export interface ResolveRegistryLanguageModelOptions {
-  /** Workspace whose `.skaile/providers.yml` is the workspace layer. */
-  projectDir: string;
+  /** The one merged registry snapshot the selector resolves against. */
+  registry: MergedAIProviderRegistry;
   /**
    * The environment `env:` credential references are read from. Required, so a
    * host never reads the ambient process by accident.
@@ -40,48 +50,91 @@ export interface ResolveRegistryLanguageModelOptions {
    * before anything is read; a refused one is a `policy_refused` failure.
    */
   policy?: CredentialPolicy;
-  /**
-   * An already merged (e.g. transform-proxy-routed) registry. When set,
-   * `projectDir` is not read for providers, the policy check runs on this
-   * registry, and it is handed to Workspaces as the registry to resolve against.
-   */
-  registry?: MergedAIProviderRegistry;
+  /** Local encrypted store for `keyring:` references; else `FORGE_CREDENTIAL_STORE` of `env`. */
+  path?: string;
+  /** 64-char hex key of the local store; else `FORGE_CREDENTIAL_KEY` of `env`. */
+  key?: string;
+}
+
+/**
+ * The credential resolver discovery and invocation share: the policy refuses
+ * an entry before any reference is read, then the reference resolves from
+ * `env` or the local store. Secret-free errors only.
+ */
+function policyCredentialResolver(
+  options: Pick<ResolveRegistryLanguageModelOptions, "env" | "policy" | "path" | "key">,
+): EntryCredentialResolver {
+  return (entry, providerId) => {
+    assertEntryAllowed(entry, providerId, options.policy);
+    const resolved = resolveEntryCredential(entry, credentialStoreOptions(options.env, options));
+    return resolved.error && !resolved.value
+      ? { error: resolved.error }
+      : { ...(resolved.value !== undefined ? { value: resolved.value } : {}) };
+  };
 }
 
 /**
  * The AI SDK model for `selector` (`<providerId>/<modelId>`, a bare model id or
- * `@role`), resolved by Workspaces against the registry on disk, or the given
- * `registry`.
+ * `@role`), resolved against `options.registry` only.
  *
- * @throws {ModelResolutionError} `registry_invalid` (only when read from disk) ·
- *   `unknown_selector` · `policy_refused` · `unresolved` (credential, endpoint or
- *   provider SDK; the message is fixed and never carries Workspaces' text, which
- *   stays on `cause`).
+ * Strict: a selector naming a provider that is missing from the registry's
+ * enabled `llm` entries (and that no entry maps as a model id), disabled, or an
+ * unassigned `@role` fails — nothing is rerouted to another endpoint and
+ * nothing is sent. A bare model id without `/` resolves as the registry orders it.
+ *
+ * @throws {ModelResolutionError} `unknown_selector` (no enabled entry serves the
+ *   selector, or the named entry is disabled / not an `llm` entry) ·
+ *   `policy_refused` · `unresolved` (credential, endpoint or provider SDK; the
+ *   message is fixed, the underlying error stays on `cause`).
  */
 export async function resolveRegistryLanguageModel(
   selector: string,
   options: ResolveRegistryLanguageModelOptions,
 ): Promise<ResolvedLanguageModel> {
-  const merged = options.registry ?? loadRegistry(options.projectDir);
+  const merged = options.registry;
+
+  const head = selectorProviderId(selector);
+  const named = head === undefined ? undefined : merged.providers[head];
+  if (
+    head !== undefined &&
+    named !== undefined &&
+    (named.kind !== "llm" || named.enabled === false)
+  ) {
+    throw new ModelResolutionError(
+      "unknown_selector",
+      `provider '${head}' is ${named.kind !== "llm" ? "not an llm entry" : "disabled"}`,
+      { providerId: head },
+    );
+  }
 
   const ref = parseModelRef(selector, merged, options.roles);
-  if (!ref) {
+  // `<head>/<model>` that no entry is named by or maps: the general resolver would
+  // hand it to the first entry in registry order, i.e. send it (and that entry's
+  // credential) to an endpoint the caller did not name.
+  if (!ref || (head !== undefined && named === undefined && ref.fallback === true)) {
     throw new ModelResolutionError("unknown_selector", `no provider serves '${selector}'`);
   }
+  if (ref.role !== undefined && !options.roles?.[ref.role]) {
+    throw new ModelResolutionError(
+      "unknown_selector",
+      `role '@${ref.role}' is not assigned to a model`,
+    );
+  }
   const entry = merged.providers[ref.providerId];
   if (entry) assertEntryAllowed(entry, ref.providerId, options.policy);
 
   try {
     return await resolveLanguageModel(selector, {
-      projectDir: options.projectDir,
+      registry: merged,
       env: options.env,
       ...(options.roles ? { roles: options.roles } : {}),
-      ...(options.registry ? { registry: options.registry } : {}),
+      resolveCredential: policyCredentialResolver(options),
     });
   } catch (cause) {
-    // Workspaces' message is not ours to vouch for: it can echo a resolved
-    // credential or an endpoint with a key in its query. The message is fixed;
-    // the original error stays on `cause` for a host that logs it server-side.
+    if (cause instanceof ModelResolutionError) throw cause;
+    // The constructor's message is not ours to vouch for: an SDK error can echo
+    // an endpoint with a key in its query. The message is fixed; the original
+    // error stays on `cause` for a host that logs it server-side.
     throw new ModelResolutionError(
       "unresolved",
       `provider '${ref.providerId}': credential, endpoint or provider SDK could not be resolved`,
@@ -89,15 +142,3 @@ export async function resolveRegistryLanguageModel(
     );
   }
 }
-
-/** The merged registry of `projectDir`; `registry_invalid` on any error diagnostic. */
-function loadRegistry(projectDir: string): MergedAIProviderRegistry {
-  const { merged, diagnostics } = loadMergedProviderRegistry({ projectDir });
-  const errors = diagnostics
-    .filter((d) => d.severity === "error")
-    .map((d) => (d.path ? `${d.path}: ${d.message}` : d.message));
-  if (errors.length > 0) {
-    throw new ModelResolutionError("registry_invalid", `providers registry: ${errors.join("; ")}`);
-  }
-  return merged;
-}