@skaile/forge-settings 1.3.3 → 2.0.0

package/src/runtime/editor/index.ts

@@ -4,11 +4,24 @@
  *
  * `@skaile/forge-editor`'s AI routes ask the host's `ModelProvider`
  * (`listModels` / `languageModel`) before their own runtime-config presets.
- * This adapter answers from the host's registry: only `llm` entries on the
- * `openai-completions` surface are offered, because the editor's transport is a
- * chat-completions client (`@ai-sdk/openai-compatible`). A profile's id is the
- * registry selector `<providerId>/<modelId>`, which `languageModel` receives
- * back as `{ preset: id }`.
+ * This adapter answers from the host's registry and is a thin layer over
+ * `@skaile/forge-settings/ai-sdk`: a profile's id is the registry selector
+ * `<providerId>/<modelId>`, which `languageModel` receives back as
+ * `{ preset: id }` and resolves through the same constructor, credential
+ * resolver and policy as every other registry model. Every `llm` entry whose
+ * surface the AI SDK constructor speaks (`openai-completions`,
+ * `openai-responses`, `anthropic-messages`) and that has an endpoint is
+ * offered.
+ *
+ * Listing combines what the registry declares (`model_map` / `capabilities`)
+ * with what an entry's own models list reports, for entries that declare
+ * `discovery` or declare no models at all. Declared models work without a
+ * models list; a declared identity wins over a discovered one.
+ *
+ * The registry is authoritative for the selectors it owns: an empty registry
+ * lists `[]`, and a `<providerId>/…` selector naming a registry entry that is
+ * disabled, refused or unresolvable throws instead of falling through to the
+ * editor's presets. Only a selector the registry does not own answers `null`.
  *
  * The registry and the credential environment are supplied by the host on every
  * call, so provider edits apply without a restart and nothing reads the ambient
@@ -16,104 +29,182 @@
  * them to HTTP in `onFailure`.
  *
  * `@skaile/forge-editor` is an optional peer of this entry only, for its
- * `ModelProvider` contract (types). `@ai-sdk/openai-compatible` builds the model.
+ * `ModelProvider` contract (types).
  */
 
-import { createOpenAICompatible } from "@ai-sdk/openai-compatible";
 import type { ModelProfile, ModelRef } from "@skaile/forge-editor/ai";
 import type { ModelProvider } from "@skaile/forge-editor/server";
-import { ModelResolutionError, assertEntryAllowed } from "../model/errors";
+import { resolveEntryBaseUrl } from "@skaile/provider-registry";
+import { AI_SDK_SURFACES, type LanguageModelObject } from "@skaile/provider-registry/ai-sdk";
+import { resolveRegistryLanguageModel } from "../ai-sdk";
+import { ModelResolutionError } from "../model/errors";
+import { credentialStoreOptions, selectorProviderId } from "../model/selector";
 import { type CredentialPolicy, entryPolicyRefusal } from "../server/credential-policy";
-import { resolveEntryCredential } from "../server/credential-store";
+import { discoverProviderModels } from "../server/provider-discovery";
 import { listAIProviderModels } from "../server/provider-service";
 import {
   type AIProviderLlmEntry,
   type AIProviderRegistryView,
+  asMergedRegistry,
   entriesOfKind,
 } from "../shared/provider-registry";
 
-export { ModelResolutionError } from "../model/errors";
 export type { ModelResolutionCode } from "../model/errors";
+export { ModelResolutionError } from "../model/errors";
 
-/** The editor can only speak chat completions. */
-const EDITOR_SURFACE = "openai-completions";
-
-/** Policy for an editor model call; see `CredentialPolicy`. */
+/** Policy and credential store for an editor model call; see `CredentialPolicy`. */
 export interface EditorModelPolicyOptions {
   /** Which credential references may be resolved; refused entries are not offered. */
   policy?: CredentialPolicy;
+  /** Local encrypted store for `keyring:` references; else `FORGE_CREDENTIAL_STORE` of the env. */
+  path?: string;
+  /** 64-char hex key of the local store; else `FORGE_CREDENTIAL_KEY` of the env. */
+  key?: string;
 }
 
-/** The chat-completions entries (with an endpoint) of `registry`, by id. */
-function editorEntries(registry: AIProviderRegistryView): Map<string, AIProviderLlmEntry> {
+/** The entries the AI SDK constructor can serve (surface and endpoint), by id; policy-refused ones left out. */
+function editorEntries(
+  registry: AIProviderRegistryView,
+  policy: CredentialPolicy | undefined,
+): Map<string, AIProviderLlmEntry> {
   const entries = new Map<string, AIProviderLlmEntry>();
   for (const [id, entry] of entriesOfKind(registry, "llm")) {
-    if (entry.surface === EDITOR_SURFACE && entry.base_url) entries.set(id, entry);
+    const surface = entry.surface ?? "openai-completions";
+    if (!(AI_SDK_SURFACES as readonly string[]).includes(surface)) continue;
+    if (!resolveEntryBaseUrl(entry)) continue;
+    if (entryPolicyRefusal(entry, policy)) continue;
+    entries.set(id, entry);
   }
   return entries;
 }
 
+/** One registry model as an editor profile: its selector `id`, shown as `<providerId> · <name>`. */
+function registryProfile(
+  providerId: string,
+  entry: AIProviderLlmEntry,
+  model: { id: string; name: string; providerModelId: string },
+): ModelProfile {
+  return {
+    id: model.id,
+    label: `${providerId} · ${model.name}`,
+    endpoint: resolveEntryBaseUrl(entry)!,
+    model: model.providerModelId,
+    source: "preset",
+  };
+}
+
+/** The declared models of the served `entries` as profiles, grouped by provider id in registry order. */
+function declaredProfiles(
+  registry: AIProviderRegistryView,
+  entries: Map<string, AIProviderLlmEntry>,
+): Map<string, ModelProfile[]> {
+  const byProvider = new Map<string, ModelProfile[]>();
+  for (const model of listAIProviderModels(registry)) {
+    const entry = entries.get(model.providerId);
+    if (!entry) continue;
+    const profile = registryProfile(model.providerId, entry, {
+      id: model.id,
+      name: model.modelId,
+      providerModelId: model.providerModelId,
+    });
+    const own = byProvider.get(model.providerId);
+    if (own) own.push(profile);
+    else byProvider.set(model.providerId, [profile]);
+  }
+  return byProvider;
+}
+
 /**
- * The registry's chat-completions models as editor model profiles, in registry
- * order. With a policy, entries it refuses are left out.
+ * The models the registry declares (`model_map` / `capabilities`) as editor
+ * model profiles, in registry order — no network. With a policy, entries it
+ * refuses are left out. {@link createEditorModelProvider} lists these plus the
+ * models discovered live.
  */
 export function editorModelProfiles(
   registry: AIProviderRegistryView,
   options: EditorModelPolicyOptions = {},
 ): ModelProfile[] {
-  const entries = editorEntries(registry);
-  const allowed = (providerId: string) => {
-    const entry = entries.get(providerId);
-    return entry !== undefined && !entryPolicyRefusal(entry, options.policy);
-  };
-  return listAIProviderModels(registry)
-    .filter((model) => allowed(model.providerId))
-    .map((model) => ({
-      id: model.id,
-      label: `${model.providerId} · ${model.modelId}`,
-      endpoint: entries.get(model.providerId)!.base_url!,
-      model: model.providerModelId,
-      source: "preset" as const,
-    }));
+  return [...declaredProfiles(registry, editorEntries(registry, options.policy)).values()].flat();
+}
+
+/**
+ * Declared and discovered models as editor profiles, in registry order, one
+ * profile per selector.
+ *
+ * An entry's models list is asked when the entry declares `discovery` (and not
+ * `type: none`) or declares no models; it is asked with the credential the
+ * policy allows, exactly as inference resolves it. A failed or unsupported
+ * list leaves that entry with its declared models. A discovered id that a
+ * declared model already names (as selector or as mapped provider id) is
+ * dropped: the declared identity wins.
+ */
+export async function listEditorModelProfiles(
+  registry: AIProviderRegistryView,
+  env: Record<string, string | undefined>,
+  options: EditorModelPolicyOptions = {},
+): Promise<ModelProfile[]> {
+  const entries = editorEntries(registry, options.policy);
+  const declared = declaredProfiles(registry, entries);
+  const listed = await Promise.all(
+    [...entries].map(async ([providerId, entry]): Promise<ModelProfile[]> => {
+      const own = declared.get(providerId) ?? [];
+      const listable =
+        entry.discovery !== undefined ? entry.discovery.type !== "none" : own.length === 0;
+      if (!listable) return own;
+      const result = await discoverProviderModels(
+        providerId,
+        registry,
+        credentialStoreOptions(env, options),
+      );
+      if (result.status !== "live") return own;
+      const taken = new Set(
+        own.flatMap((profile) => [profile.id, `${providerId}/${profile.model}`]),
+      );
+      const discovered = result.models.flatMap((model) => {
+        const id = `${providerId}/${model.id}`;
+        if (taken.has(id)) return [];
+        taken.add(id);
+        return [
+          registryProfile(providerId, entry, { id, name: model.name, providerModelId: model.id }),
+        ];
+      });
+      return [...own, ...discovered];
+    }),
+  );
+  return listed.flat();
 }
 
 /**
  * The language model of selector `ref.preset`, or `null` when the registry does
- * not serve it (a browser-defined `{ endpoint, model, apiKey }` reference is the
- * editor's own to resolve).
+ * not own it: a browser-defined `{ endpoint, model, apiKey }` reference, or a
+ * preset id whose leading segment names no registry entry, is the editor's own
+ * to resolve.
+ *
+ * Delegates to `resolveRegistryLanguageModel` (`@skaile/forge-settings/ai-sdk`),
+ * so the selector's model id may be declared or discovered: an id the entry's
+ * `model_map` maps is sent as the mapped id, any other is sent verbatim.
  *
- * @throws {ModelResolutionError} `policy_refused` when the policy refuses the
- *   entry (checked before its credential is read); `unresolved` when its
- *   credential reference does not resolve. Neither message carries a secret.
+ * @throws {ModelResolutionError} for an owned selector: `unknown_selector` when
+ *   the entry is disabled or not an `llm` entry, `policy_refused` when the
+ *   policy refuses it (checked before its credential is read), `unresolved`
+ *   when its credential, endpoint or SDK does not resolve. No message carries a
+ *   secret.
  */
-export function editorLanguageModel(
+export async function editorLanguageModel(
   registry: AIProviderRegistryView,
   env: Record<string, string | undefined>,
   ref: ModelRef,
   options: EditorModelPolicyOptions = {},
-) {
+): Promise<LanguageModelObject | null> {
   if (!("preset" in ref)) return null;
-  const model = listAIProviderModels(registry).find((candidate) => candidate.id === ref.preset);
-  const entry = model && editorEntries(registry).get(model.providerId);
-  if (!model || !entry) return null;
-  assertEntryAllowed(entry, model.providerId, options.policy);
-  const credential = resolveEntryCredential(entry, {
-    env,
-    ...(options.policy ? { policy: options.policy } : {}),
+  const merged = asMergedRegistry(registry);
+  const head = selectorProviderId(ref.preset);
+  if (head === undefined || merged.providers[head] === undefined) return null;
+  const resolved = await resolveRegistryLanguageModel(ref.preset, {
+    registry: merged,
+    ...credentialStoreOptions(env, options),
   });
-  if (credential.error && !credential.value) {
-    throw new ModelResolutionError(
-      "unresolved",
-      `provider '${model.providerId}': ${credential.error}`,
-      { providerId: model.providerId },
-    );
-  }
-  return createOpenAICompatible({
-    name: model.providerId,
-    baseURL: entry.base_url!,
-    ...(credential.value ? { apiKey: credential.value } : {}),
-    ...(entry.headers ? { headers: entry.headers } : {}),
-  }).chatModel(model.providerModelId);
+  return resolved.model;
 }
 
 /** Options for {@link createEditorModelProvider}. */
@@ -131,7 +222,12 @@ export function createEditorModelProvider(options: EditorModelProviderOptions):
   return {
     async languageModel(ref) {
       try {
-        return editorLanguageModel(await options.registry(), await options.env(), ref, options);
+        return await editorLanguageModel(
+          await options.registry(),
+          await options.env(),
+          ref,
+          options,
+        );
       } catch (error) {
         if (error instanceof ModelResolutionError && options.onFailure)
           throw options.onFailure(error);
@@ -139,8 +235,7 @@ export function createEditorModelProvider(options: EditorModelProviderOptions):
       }
     },
     async listModels() {
-      const profiles = editorModelProfiles(await options.registry(), options);
-      return profiles.length > 0 ? profiles : null;
+      return listEditorModelProfiles(await options.registry(), await options.env(), options);
     },
   };
 }

package/src/runtime/model/selector.ts

@@ -0,0 +1,31 @@
+/**
+ * Small shared pieces of registry model resolution: the provider a selector
+ * names and the credential-store options a resolution carries.
+ */
+
+import type { CredentialStoreOptions } from "../server/credential-store";
+
+/**
+ * The provider id a `<providerId>/<modelId>` selector names: the segment before
+ * the first `/`. `undefined` for an `@role` selector or a bare model id.
+ */
+export function selectorProviderId(selector: string): string | undefined {
+  const slash = selector.indexOf("/");
+  return !selector.startsWith("@") && slash > 0 ? selector.slice(0, slash) : undefined;
+}
+
+/** The policy and local store a credential resolution uses. */
+export type CredentialAccessOptions = Pick<CredentialStoreOptions, "policy" | "path" | "key">;
+
+/** `env` plus whichever of `policy`, `path` and `key` are set, without `undefined` keys. */
+export function credentialStoreOptions(
+  env: Record<string, string | undefined>,
+  { policy, path, key }: CredentialAccessOptions,
+): CredentialStoreOptions & { env: Record<string, string | undefined> } {
+  return {
+    env,
+    ...(policy ? { policy } : {}),
+    ...(path ? { path } : {}),
+    ...(key ? { key } : {}),
+  };
+}

package/src/runtime/server/credential-store.ts

@@ -24,13 +24,16 @@
  *
  * Blob format: `enc:<base64(iv[16] + tag[16] + ciphertext)>`.
  *
+ * Store path: no implicit home. The caller passes `path` or sets
+ * `FORGE_CREDENTIAL_STORE` in the environment it hands over; see
+ * {@link credentialStorePath}.
+ *
  * Key format: `FORGE_CREDENTIAL_KEY` must be a 64-char hex string (32 bytes).
  */
 
 import { createCipheriv, createDecipheriv, randomBytes } from "node:crypto";
 import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { globalSettingsPath } from "@skaile/workspaces/sdk/core";
+import { dirname } from "node:path";
 import type { AIProviderEntry, AIProviderRegistryView } from "../shared/provider-registry";
 import { isEntryEnabled, parseCredentialRef, registryEntries } from "../shared/provider-registry";
 import {
@@ -41,9 +44,6 @@ import {
 
 export const CREDENTIAL_PREFIX = "enc:" as const;
 
-/** Filename of the local keyring, next to the user's `settings.json`. */
-const STORE_FILENAME = "forge-credentials.json";
-
 const ALGORITHM = "aes-256-gcm" as const;
 const IV_LENGTH = 16; // bytes
 const TAG_LENGTH = 16; // bytes
@@ -162,7 +162,7 @@ export function decryptCredential(ciphertext: string, hexKey: string, ref: strin
 export interface CredentialStoreOptions {
   /** 64-char hex key; defaults to `FORGE_CREDENTIAL_KEY` of the environment. */
   key?: string;
-  /** Store file; defaults to `FORGE_CREDENTIAL_STORE` or `<skaile home>/forge-credentials.json`. */
+  /** Store file; defaults to the environment's `FORGE_CREDENTIAL_STORE`. Required for keyring operations. */
   path?: string;
   /**
    * Environment `env:` references (and the key and store path variables) read
@@ -189,17 +189,27 @@ interface StoreFile {
   credentials: Record<string, string>;
 }
 
+/** What a keyring operation throws when neither a path nor `FORGE_CREDENTIAL_STORE` names the store. */
+export const CREDENTIAL_STORE_PATH_REQUIRED =
+  "FORGE_CREDENTIAL_STORE or credential store path is required" as const;
+
 /**
- * Path of the local keyring file.
+ * Path of the local keyring file: `options.path`, else the selected
+ * environment's `FORGE_CREDENTIAL_STORE`.
+ *
+ * There is no implicit home: the host decides where its secrets live. A
+ * Workspaces host passes `<skaile home>/forge-credentials.json` (see
+ * `@skaile/forge-settings/workspaces`). Only keyring operations ask for the
+ * path, so env-only and keyless providers need none.
  *
- * Lives beside the user's `settings.json` so it follows `$SKAILE_HOME`, and is
- * overridable per app with `FORGE_CREDENTIAL_STORE`.
+ * @throws Error `FORGE_CREDENTIAL_STORE or credential store path is required`
+ *   when neither is given.
  */
 export function credentialStorePath(options: CredentialStoreOptions = {}): string {
   if (options.path) return options.path;
   const fromEnv = envOf(options).FORGE_CREDENTIAL_STORE;
   if (fromEnv) return fromEnv;
-  return join(dirname(globalSettingsPath()), STORE_FILENAME);
+  throw new Error(CREDENTIAL_STORE_PATH_REQUIRED);
 }
 
 function requireKey(options: CredentialStoreOptions): string {

package/src/runtime/server/env-layers.ts

@@ -16,10 +16,7 @@
 
 import { chmodSync, mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
-import { AI_PROVIDER_PRESETS } from "@skaile/workspaces/sdk/bridge";
-import { isPlainObject } from "../shared/guards";
-import type { AIProviderRegistryView } from "../shared/provider-registry";
-import { parseCredentialRef, registryEntries } from "../shared/provider-registry";
+import { AI_PROVIDER_PRESETS } from "@skaile/provider-registry/catalog";
 import {
   ENV_LAYER_ORDER,
   type EnvLayerId,
@@ -29,6 +26,9 @@ import {
   type EnvVarView,
   validateEnvVarName,
 } from "../shared/env-vars";
+import { isPlainObject } from "../shared/guards";
+import type { AIProviderRegistryView } from "../shared/provider-registry";
+import { parseCredentialRef, registryEntries } from "../shared/provider-registry";
 
 export * from "../shared/env-vars";
 

package/src/runtime/server/index.ts

@@ -1,25 +1,26 @@
 /**
- * `@skaile/forge-settings/server` — provider and settings operations for a
- * host server: the registry vocabulary and layer editing, the credential
- * store, env layers, harness settings, model discovery.
+ * `@skaile/forge-settings/server` — provider operations for a host server: the
+ * registry vocabulary and layer editing, the credential store, env layers,
+ * model discovery and voice-entry selection.
  *
- * Imports no Vue, no editor, no AI SDK and no agent session code. Storage,
+ * Imports no Vue, no editor, no AI SDK, no agent session code and no Skaile
+ * Workspaces: the Workspaces settings document, harness settings and project
+ * registry loading live in `@skaile/forge-settings/workspaces`. Storage,
  * authentication and workspace permissions stay with the host.
  */
 
+export * from "../shared/data-zone";
 export * from "../shared/harness-providers";
 export * from "../shared/harnesses";
 export * from "../shared/model-roles";
+export * from "../shared/provider-accounts";
 export * from "../shared/provider-registry";
-export type { DomainConfig, SkaileSettings } from "../shared/settings-types";
 export * from "./credential-policy";
 export * from "./credential-store";
 export * from "./env";
 export * from "./env-layers";
-export * from "./harness-settings";
 export * from "./provider-discovery";
 export * from "./provider-layers";
 export * from "./provider-service";
-export * from "./provider-settings";
 export * from "./provider-write";
-export * from "./settings-defaults";
+export * from "./voice-provider";

package/src/runtime/server/provider-discovery.ts

@@ -5,11 +5,12 @@
  * `model_map`; this module asks the provider's REST API. The two are different
  * facts and the result says which one it is:
  *
- * - `live` — the provider answered; `models` is its list.
- * - `static` — the live request failed or the entry has no key, and `models` is
- *   the offline catalog of its preset. It is a fallback, never a live answer.
- * - `unsupported` — the entry has no catalog preset, so there is nothing to ask;
- *   a host lets the admin type a model id.
+ * - `live` — the provider answered; `models` is its list (possibly empty).
+ * - `static` — the live request failed or the entry speaks no models list, and
+ *   `models` is the offline catalog of the entry's own preset. It is a
+ *   labelled fallback, never a live answer and never an inference destination.
+ * - `unsupported` — the entry speaks no models list and has no catalog; a host
+ *   lets the admin type a model id.
  * - `error` — nothing usable. The message is scrubbed.
  *
  * The error text is built here, never forwarded: a remote response body is
@@ -21,9 +22,15 @@
  * explicit `env` only.
  */
 
-import { resolveEntryBaseUrl } from "@skaile/workspaces/core";
-import { fetchProviderModels, getStaticModels } from "@skaile/workspaces/sdk/bridge";
-import type { AIProviderRegistryView } from "../shared/provider-registry";
+import { resolveEntryBaseUrl } from "@skaile/provider-registry";
+import { entrySurface, getStaticModels } from "@skaile/provider-registry/catalog";
+import {
+  type FetchModelsResult,
+  fetchEntryModels,
+  fetchProviderModels,
+} from "@skaile/provider-registry/discovery";
+import { credentialStoreOptions } from "../model/selector";
+import type { AIProviderLlmEntry, AIProviderRegistryView } from "../shared/provider-registry";
 import { isEntryEnabled, registryEntries } from "../shared/provider-registry";
 import { type CredentialPolicy, entryPolicyRefusal } from "./credential-policy";
 import { resolveEntryCredential } from "./credential-store";
@@ -55,9 +62,12 @@ export interface DiscoverProviderModelsOptions {
   policy?: CredentialPolicy;
   /** Extra strings to remove from error text, besides the secrets this call resolves. */
   redact?: readonly string[];
-  /** Local encrypted store for `keyring:` references. */
-  key?: string;
+  /** Local encrypted store for `keyring:` references; else `FORGE_CREDENTIAL_STORE` of `env`. */
   path?: string;
+  /** 64-char hex key of the local store; else `FORGE_CREDENTIAL_KEY` of `env`. */
+  key?: string;
+  /** Cancels a live request; the result is then an `error` / `static` one. */
+  signal?: AbortSignal;
 }
 
 /** Longest error message returned. */
@@ -83,11 +93,72 @@ export function scrubSecrets(text: string, secrets: readonly (string | undefined
   return out.length > MAX_ERROR_LENGTH ? `${out.slice(0, MAX_ERROR_LENGTH)}…` : out;
 }
 
+/** Whether `fetchEntryModels` speaks a models-list dialect for `entry`, or why not. */
+function entryListing(entry: AIProviderLlmEntry): { ok: true } | { ok: false; reason: string } {
+  const type = entry.discovery?.type;
+  if (type === "none") return { ok: false, reason: "this entry declares no model discovery" };
+  if (type === "openai-models-list" || type === "anthropic-models-list") return { ok: true };
+  if (type !== undefined) return { ok: false, reason: `discovery type '${type}' is not supported` };
+  const surface = entrySurface(entry);
+  if (
+    surface === "openai-completions" ||
+    surface === "openai-responses" ||
+    surface === "anthropic-messages"
+  ) {
+    return { ok: true };
+  }
+  return { ok: false, reason: `surface '${surface ?? "unknown"}' has no models list` };
+}
+
+/** What a cancelled models-list request reports (the wording `fetchEntryModels` uses). */
+const CANCELLED: FetchModelsResult = {
+  ok: false,
+  models: [],
+  error: "models list request was cancelled",
+  source: "api",
+};
+
+/**
+ * Run `start` unless `signal` already aborted, and settle as cancelled the
+ * moment it aborts. `fetchProviderModels` takes no signal: its request then
+ * runs on to its own deadline, but nobody waits for it.
+ */
+function untilAborted(
+  start: () => Promise<FetchModelsResult>,
+  signal: AbortSignal | undefined,
+): Promise<FetchModelsResult> {
+  if (!signal) return start();
+  if (signal.aborted) return Promise.resolve(CANCELLED);
+  return new Promise((resolve, reject) => {
+    const onAbort = () => resolve(CANCELLED);
+    signal.addEventListener("abort", onAbort, { once: true });
+    start()
+      .finally(() => signal.removeEventListener("abort", onAbort))
+      .then(resolve, reject);
+  });
+}
+
 /**
  * Ask one registry entry's provider for its models.
  *
+ * Two ways to ask, both with the credential resolved here under the policy:
+ *
+ * - A catalog-preset entry with a resolved key and no `discovery` block of its
+ *   own uses the preset's list parser (`fetchProviderModels`), which filters
+ *   the vendor's list the way that vendor needs.
+ * - Every other entry — a custom endpoint, a keyless local server, an entry
+ *   that declares `discovery` — asks its own `base_url` with its own headers
+ *   and credential carrier (`fetchEntryModels`), exactly as inference would.
+ *   No preset and no secret are required: `credential.kind: none` queries
+ *   without `Authorization`.
+ *
+ * A successful empty list is `live` and empty. Only a preset entry has a
+ * `static` fallback: its own catalog, labelled as such, never another
+ * provider and never an inference destination.
+ *
  * Never throws for a provider-side failure: that is the `error` / `static`
- * result. A host maps `error` to its own status.
+ * result. A host maps `error` to its own status. A refused or unresolvable
+ * credential sends no request at all.
  */
 export async function discoverProviderModels(
   providerId: string,
@@ -107,50 +178,45 @@ export async function discoverProviderModels(
   const refusal = entryPolicyRefusal(entry, options.policy);
   if (refusal) return { status: "error", providerId, error: refusal };
 
-  const credential = resolveEntryCredential(entry, {
-    env: options.env,
-    ...(options.policy ? { policy: options.policy } : {}),
-    ...(options.key ? { key: options.key } : {}),
-    ...(options.path ? { path: options.path } : {}),
-  });
+  const credential = resolveEntryCredential(entry, credentialStoreOptions(options.env, options));
   const secrets = [credential.value, ...(options.redact ?? [])];
   const scrub = (text: string) => scrubSecrets(text, secrets);
-
-  if (!entry.preset) {
-    return {
-      status: "unsupported",
-      providerId,
-      reason:
-        "this entry names no catalog preset, so its models cannot be listed; enter a model id",
-    };
-  }
   if (credential.error && !credential.value) {
     return { status: "error", providerId, error: scrub(credential.error) };
   }
 
-  const staticList = getStaticModels(entry.preset).map(({ id, name }) => ({ id, name }));
-  if (!credential.value) {
-    // Without a key there is nothing to ask with.
-    return staticList.length > 0
-      ? {
-          status: "static",
-          providerId,
-          models: staticList,
-          reason: "no credential to query the provider with",
-        }
-      : {
-          status: "unsupported",
-          providerId,
-          reason: "no credential, and no offline catalog for this preset",
-        };
-  }
+  const staticList = entry.preset
+    ? getStaticModels(entry.preset).map(({ id, name }) => ({ id, name }))
+    : [];
 
-  const baseUrl = resolveEntryBaseUrl(entry);
-  const live = await fetchProviderModels(entry.preset, credential.value, {
-    ...(baseUrl ? { baseUrl } : {}),
-    env: options.env,
-  });
-  if (live.ok && live.models.length > 0) {
+  let live: FetchModelsResult;
+  if (entry.preset && !entry.discovery && credential.value) {
+    const baseUrl = resolveEntryBaseUrl(entry);
+    const apiKey = credential.value;
+    live = await untilAborted(
+      () =>
+        fetchProviderModels(entry.preset!, apiKey, {
+          ...(baseUrl ? { baseUrl } : {}),
+          env: options.env,
+        }),
+      options.signal,
+    );
+  } else {
+    const listing = entryListing(entry);
+    if (!listing.ok) {
+      return staticList.length > 0
+        ? { status: "static", providerId, models: staticList, reason: listing.reason }
+        : { status: "unsupported", providerId, reason: `${listing.reason}; enter a model id` };
+    }
+    // `env: {}`: the only credential this request may carry is the one resolved
+    // above under the policy, never a second lookup of the entry's reference.
+    live = await fetchEntryModels(entry, {
+      env: {},
+      ...(credential.value !== undefined ? { secret: credential.value } : {}),
+      ...(options.signal ? { signal: options.signal } : {}),
+    });
+  }
+  if (live.ok) {
     return {
       status: "live",
       providerId,