@skaile/forge-settings 1.4.0 → 2.0.0

package/CHANGELOG.md

@@ -1,5 +1,30 @@
 # Changelog
 
+## 2.0.0
+
+### Breaking
+
+- `@skaile/workspaces` dependency → optional peer, needed only by the new `@skaile/forge-settings/workspaces` entry. `/server`, `/vue`, `/nuxt`, `/ai-sdk` and `/editor` no longer import it at runtime or in their declarations; the registry schema, catalog, discovery and model constructor come from the new dependency `@skaile/provider-registry`.
+- `SkaileSettings`, `DomainConfig`, `SETTINGS_DEFAULTS`, `migrateLegacyHarnessSettings`, `migrateLegacyProviderSettings`, `LegacySettingsMigration` and the harness settings rules (`HarnessSettings`, `LockFlags`, `LockFlagStatus`, `resolveLockFlags`, `enabledHarnessIds`, `HarnessRow`, `buildHarnessRows`, `HarnessSettingsPatch`, `validateHarnessSettingsPatch`, `HarnessLayer`, `applyHarnessLayers`) from `@skaile/forge-settings/server` → `@skaile/forge-settings/workspaces`. Voice selection (`resolveVoiceProvider`, `VoiceSettings`, `VoiceProviderSelection`) stays in `/server`; `VoiceSettings` is now its own interface with the same four fields instead of `Pick<SkaileSettings, …>`, so a `SkaileSettings` still passes.
+- `resolveRegistryLanguageModel(selector, { projectDir, registry?, env, roles?, policy? })` → `resolveRegistryLanguageModel(selector, { registry, env, roles?, policy?, path?, key? })`: `registry` is required and nothing is read from disk. Project-oriented callers → `resolveWorkspaceLanguageModel(selector, { projectDir, registry?, env, roles?, policy?, path?, key? })` from `/workspaces`, which loads the project's registry once and keeps the keyring at `<skaile home>/forge-credentials.json`.
+- Credential store: implicit `<skaile home>/forge-credentials.json` → explicit `options.path`, else `FORGE_CREDENTIAL_STORE` of the environment; with neither, a keyring operation throws `FORGE_CREDENTIAL_STORE or credential store path is required` (resolution reports it as the credential error). Workspaces hosts pass `workspaceCredentialStorePath(env)` (or pin it into `FORGE_CREDENTIAL_STORE`) to keep their file. Env-only and keyless providers need no store.
+- `editorLanguageModel(registry, env, ref, options)` synchronous `LanguageModel | null` → `Promise<LanguageModel | null>`, built by the shared `@skaile/provider-registry/ai-sdk` constructor (adds `openai-responses` and `anthropic-messages` entries; the `<providerId>/<modelId>` profile selector is unchanged). A `<providerId>/…` selector whose provider is a registry entry now throws when disabled or refused instead of answering `null`.
+- `createEditorModelProvider(…).listModels()` returns `[]` for a registry with no servable models (was `null`, which fell through to the editor's presets) and lists discovered models next to the declared ones.
+- `shared/provider-registry` mirror types → re-exports of the canonical `@skaile/provider-registry` types (same names); `parseCredentialRef`, `formatCredentialRef` and `isEntryEnabled` are the canonical functions.
+- 1.4.0 harness additions move with the harness rules to `/workspaces`: `HarnessRowProviders`, `buildHarnessRows(harnesses, settings, detections?, { candidates, dataZoneRule }?)` with `HarnessRow.roles` / `roleAssignments` / `blockedProviders`, `validateHarnessSettingsPatch`'s `harnessRoles` (and `ctx.runnableModels`), `applyHarnessLayers`' `roles`, and the `SkaileSettings.harnessRoles` field: `import { buildHarnessRows, type HarnessRowProviders, type SkaileSettings } from '@skaile/forge-settings/server'` → `… from '@skaile/forge-settings/workspaces'`. `HARNESS_ROLES`, `harnessRoleIds` and the browser-safe harness-provider rule (`resolveHarnessProviders`, `harnessProviderBlock`, `HarnessProviderBlock`, `HarnessProviderCandidate`, `HarnessProviderOptions`) stay in `/server` and `/vue`.
+- 1.4.0 data-zone vocabulary mirror → the registry's own names, re-exported by `/server` and `/vue` from `@skaile/provider-registry` (values unchanged): `DATA_ZONES` → `AI_PROVIDER_DATA_ZONES`, `DATA_ZONE_RULES` → `AI_PROVIDER_DATA_ZONE_RULES`, type `DataZone` → `AIProviderDataZone`, type `DataZoneRule` → `AIProviderDataZoneRule`. Every signature that took or returned them (`entryDataZone`, `entryAllowedByDataZone`, `dataZoneAllows`, `dataZoneRefusal`, `filterRegistryByDataZone`, `presetDataZone`, `ProviderInfo.dataZone`, `HarnessProviderBlock.rule` / `.zone`, the `dataZoneRule` panel prop) now names the canonical types. The browser-safe helpers `PRESET_DATA_ZONES`, `DATA_ZONE_LABELS`, `DATA_ZONE_RULE_LABELS`, `isDataZone`, `isDataZoneRule`, `presetDataZone`, `entryDataZone`, `entryAllowedByDataZone`, `dataZoneAllows`, `dataZoneRefusal` and `filterRegistryByDataZone` (which keeps a merged registry merged) stay in `/server` and `/vue`; `PRESET_DATA_ZONES` is tested equal to `@skaile/provider-registry/catalog`.
+- 1.4.0 `isModelAllowed` mirror → the canonical `isModelAllowed` of `@skaile/provider-registry`, still re-exported by `/server` and `/vue` under the same name and with the same rules; its entry parameter is `AIProviderModelAllowListFields` (`allowed_models?: string[]`), so pass a mutable array instead of a `readonly string[]`. New re-exports next to it: `allowedModelIds`, `AIProviderModelAllowListFields`.
+- 1.4.0 entry fields `data_zone`, `eu_processing` and `allowed_models` are validated by `@skaile/provider-registry` (was: the `@skaile/workspaces` 9.1 schema), so `upsertProviderEntry` and the generic entries accept them with any peer or none. `/workspaces`' `loadWorkspaceProviderRegistry` / `resolveWorkspaceLanguageModel` load the project registry through the installed `@skaile/workspaces`, whose schema before 9.1 refuses those keys: a registry that uses them needs the peer at 9.1 or later.
+
+### Added
+
+- `discoverProviderModels` asks any entry that speaks a models list (`discovery: { type: 'openai-models-list' | 'anthropic-models-list' }` or an OpenAI/Anthropic surface) at its own `base_url`, through `fetchEntryModels`: no catalog preset needed, `credential.kind: 'none'` queries without `Authorization`, static headers and the credential carrier match inference. Options `path`, `key`, `signal` (`signal` also settles a catalog-preset listing as cancelled).
+- `CREDENTIAL_STORE_PATH_REQUIRED` (`/server`): the message a keyring operation without a store path throws.
+- `createEditorModelProvider` / `editorLanguageModel` options `path` and `key` (local store); `listEditorModelProfiles(registry, env, options)`.
+- `asMergedRegistry(view)` (browser-safe).
+- `/workspaces`: `resolveWorkspaceLanguageModel`, `loadWorkspaceProviderRegistry(projectDir)`, `workspaceCredentialStorePath(env?)` (`FORGE_CREDENTIAL_STORE` of `env`, else `<skaile home>/forge-credentials.json`), `readWorkspaceModelEndpoint({ env, projectDir? })` (`SKAILE_MODEL_ENDPOINT_URL` + `SKAILE_MODEL_ENDPOINT_TOKEN`, else `<projectDir>/.skaile/model-endpoint.json`; `null` when absent, token-free configuration errors) and the env names `WORKSPACE_MODEL_ENDPOINT_URL_ENV` / `WORKSPACE_MODEL_ENDPOINT_TOKEN_ENV`.
+- Accepts `@skaile/workspaces` ^7.8.0 through ^10.0.0 as the optional `/workspaces` peer (`^7.8.0 || ^8.0.0 || ^9.0.0 || ^10.0.0`; 1.4.0 required `^9.1.0` as a dependency). The `/workspaces` entry imports no 9.1 symbol: its imports (`loadMergedProviderRegistry`, `globalSkaileDir`, `SETTINGS_DEFAULTS`, `SkaileSettings`, the `HarnessInfo` / `HarnessDetection` types) exist in 7.8.0 through 10.0.0, and the entry typechecks against each of 7.8.0, 8.0.0, 9.0.0 and 10.0.0. 1.4.0's `^9.1.0` was for the registry schema of `data_zone` / `eu_processing` / `allowed_models`, which the generic entries now take from `@skaile/provider-registry`; only a project registry that uses those keys needs the peer at 9.1 or later (see Breaking). 10.0.0 moved the registry primitives to `@skaile/provider-registry`, which this package now takes from there.
+
 ## 1.4.0
 
 - `<ForgeProvidersPanel>` adds a provider as a flow: a library of the catalog presets (plus Custom), then *How do you sign in?* listing only the kinds the preset accepts, the fields of that kind and the preset's routing parameters, then a done step that tests every created entry when a `client` is passed. New boolean prop `expert` (default `false`): adds the raw Reference form (`env:` / `keyring:` / `cmd:` / `platform:`) to the sign-in step and makes `api_version` editable. Detected-preset Add and Edit keep working; Edit skips the library.

package/README.md

@@ -4,13 +4,14 @@ Provider and settings operations for Skaile forge apps, without the app's databa
 
 | Entry | Contents | Peers it needs |
 |---|---|---|
-| `/server` | registry layers and writes, credential store, `.env` layers, provider inventory and discovery, harness settings rules, credential policy | none |
+| `/server` | registry layers and writes, credential store, `.env` layers, provider inventory and discovery, credential policy, model roles, voice selection (`resolveVoiceProvider`) | none |
 | `/vue` | `useProvidersPanel`, `urlProvidersClient`, `SettingsModalScope`, model-role helpers, browser-safe registry/env/harness vocabulary | `vue` |
 | `/nuxt` | Nuxt module registering `<ForgeProvidersPanel>` and `<ForgeModelRolesPanel>` | `nuxt`, `@nuxt/ui` |
 | `/ai-sdk` | AI SDK `LanguageModel` of a registry selector | `ai` + the `@ai-sdk/*` provider the surface needs |
-| `/editor` | the editor's `ModelProvider` over a registry | `@skaile/forge-editor`, `@ai-sdk/openai-compatible` |
+| `/editor` | the editor's `ModelProvider` over a registry | `@skaile/forge-editor`, `ai`, the `@ai-sdk/*` provider the surface needs |
+| `/workspaces` | Skaile Workspaces integration: `SkaileSettings`, `SETTINGS_DEFAULTS`, legacy settings migrations, harness settings rules, `workspaceCredentialStorePath`, `resolveWorkspaceLanguageModel`, `readWorkspaceModelEndpoint` | `@skaile/workspaces` |
 
-Importing `/server` loads no Vue, editor, AI SDK or agent session code. Every peer is optional and used by one entry only.
+The registry schema, catalog, discovery and model constructor come from `@skaile/provider-registry` (a dependency). Importing `/server` loads no Vue, editor, AI SDK, agent session code or Skaile Workspaces. Every peer is optional and used by one entry only: `/server`, `/vue`, `/nuxt`, `/ai-sdk` and `/editor` install, load and typecheck without `@skaile/workspaces`; only `/workspaces` needs it.
 
 ## What stays with the host
 
@@ -34,16 +35,20 @@ The policy is checked against `credential.ref` and every `${NAME}` token in `bas
 ```ts
 const scope: ProviderWriteScope = { name: 'instance', file, below: [], env, lock, policy } // refuses writes naming a refused ref
 discoverProviderModels('main', registry, { env, policy })
-resolveRegistryLanguageModel('main/gpt-x', { projectDir, env, policy })
+resolveRegistryLanguageModel('main/gpt-x', { registry, env, policy })
 ```
 
 ## Credential store
 
 `keyring:<service>/<account>` references are stored AES-256-GCM encrypted in a JSON file; the reference is the additional authenticated data, so a blob cannot be replayed under another reference. The key is `FORGE_CREDENTIAL_KEY` (64 hex characters) or `options.key`. Without it only operations that need the store fail, with `CredentialKeyError` (`statusCode: 503`); `env:` references keep working. A blob that does not authenticate raises `CredentialDecryptError`.
 
+There is no implicit store location. The file is `options.path`, else `FORGE_CREDENTIAL_STORE` of the environment the call is handed; with neither, a keyring operation throws `FORGE_CREDENTIAL_STORE or credential store path is required` (resolution reports it as the credential's error and sends nothing). Env-only and keyless providers need no store. A Skaile Workspaces host keeps its existing file by passing `workspaceCredentialStorePath()` from `/workspaces` (`<skaile home>/forge-credentials.json`) as `path`, or pinning it into `FORGE_CREDENTIAL_STORE`.
+
 ## Model discovery
 
-`discoverProviderModels(id, registry, { env, policy?, redact? })` returns `live`, `static` (the offline catalog, with the scrubbed reason the live request failed), `unsupported` (no catalog preset: let the admin type a model id) or `error`. Error text never contains a remote response body, and every secret the call resolved (plus `redact`) is removed from it, also in URL-encoded and base64 form.
+`discoverProviderModels(id, registry, { env, policy?, redact?, path?, key?, signal? })` returns `live` (possibly empty), `static` (the entry's own preset catalog, with the scrubbed reason the live request failed — a labelled fallback, never an inference destination), `unsupported` (the entry speaks no models list and has no catalog: let the admin type a model id) or `error`. Error text never contains a remote response body, and every secret the call resolved (plus `redact`) is removed from it, also in URL-encoded and base64 form.
+
+Any entry with `discovery: { type: 'openai-models-list' }` (or an OpenAI/Anthropic surface) is asked at its own `base_url`, with its static `headers` and its credential exactly as inference sends them — no catalog preset needed. `credential.kind: 'none'` queries without `Authorization`, so a local model server works keyless. The credential is resolved under the policy first: a refused or unresolvable reference sends no request.
 
 ## Models for the editor and the AI SDK
 
@@ -55,18 +60,36 @@ export const models = createEditorModelProvider({
   registry: () => getProviderRegistry(home()),
   env: () => effectiveEnv(),
   policy,                                            // refused entries are neither listed nor resolved
+  path: credentialStoreFile,                         // keyring: references; else FORGE_CREDENTIAL_STORE of env()
   onFailure: (e) => createError({ statusCode: e.code === 'policy_refused' ? 403 : 400, statusMessage: e.message }),
 })
 ```
 
+`listModels` answers the declared models (`model_map` / `capabilities`) plus the models each entry's models list reports, one profile per selector (a declared identity wins over a discovered duplicate). Declared models work without a models list. The registry is authoritative: an empty one lists `[]`, and a selector whose provider id is a registry entry either resolves or throws (disabled, refused, unresolvable) — only a selector the registry does not own (or a browser `{ endpoint, model, apiKey }` reference) answers `null` and falls through to the editor's presets. `editorModelProfiles(registry, { policy? })` is the declared-only, network-free list; `await editorLanguageModel(registry, env, ref, options)` is the adapter's model lookup.
+
 ```ts
 import { resolveRegistryLanguageModel } from '@skaile/forge-settings/ai-sdk'
-const { model } = await resolveRegistryLanguageModel('assistant-default/some-model', { projectDir, env, policy })
+const { model } = await resolveRegistryLanguageModel('assistant-default/some-model', { registry, env, policy, path })
 ```
 
-Role-to-selector mapping belongs to the host's settings document; there is no global model locator. Failures are `ModelResolutionError` with a `code`; messages never carry a secret.
+Resolves against the one `registry` snapshot passed (no disk read), with the same policy-checked credential resolver discovery uses, through `@skaile/provider-registry/ai-sdk` (`openai-completions`, `openai-responses`, `anthropic-messages`). A disabled or missing named provider and an unassigned `@role` fail; nothing is rerouted. Role-to-selector mapping belongs to the host's settings document; there is no global model locator. Failures are `ModelResolutionError` with a `code`; messages never carry a secret.
+
+## Skaile Workspaces
+
+```ts
+import { readWorkspaceModelEndpoint, resolveWorkspaceLanguageModel } from '@skaile/forge-settings/workspaces'
+
+// The project's merged registry (user + .skaile/providers.yml + catalog), read once;
+// keyring: references read <skaile home>/forge-credentials.json unless path / FORGE_CREDENTIAL_STORE say otherwise.
+const { model } = await resolveWorkspaceLanguageModel('@assistant', { projectDir, env, roles, policy })
+// Or an already merged (e.g. transform-proxy-routed) registry: { projectDir, registry, env }.
+
+// A running `skaile serve --model-endpoint`: SKAILE_MODEL_ENDPOINT_URL + _TOKEN from env (both, http(s)),
+// else <projectDir>/.skaile/model-endpoint.json when projectDir is given; null when neither exists.
+const endpoint = await readWorkspaceModelEndpoint({ env, projectDir }) // { url, token } | null
+```
 
-Pass `registry` (an already merged registry, e.g. one routed through the Workspaces transform proxy) to resolve against it instead of the providers on disk; the policy check runs on it and Workspaces receives it unchanged.
+`readWorkspaceModelEndpoint` never climbs directories or reads the working directory, and its configuration errors (half an env pair, malformed or incomplete file) never contain the token. `workspaceCredentialStorePath(env?)` is the Workspaces keyring: `FORGE_CREDENTIAL_STORE` of `env`, else `<skaile home>/forge-credentials.json`. The settings document (`SkaileSettings`, `SETTINGS_DEFAULTS`, `migrateLegacyHarnessSettings`, `migrateLegacyProviderSettings`) and harness rules (`buildHarnessRows`, `validateHarnessSettingsPatch`, `applyHarnessLayers`, …) live here too; voice selection (`resolveVoiceProvider`) is generic and lives in `/server` — a `SkaileSettings` passes as its `VoiceSettings`.
 
 ## Providers panel
 
@@ -94,7 +117,7 @@ Without URLs, pass `:client` (a `ProvidersPanelClient`: `list`, `detected`, `pre
 
 ### Data zones and model filters
 
-Three entry fields (`@skaile/workspaces` 9.1; 9.0's schema refuses them) are writable through `upsertProviderEntry`. A body that omits one keeps the stored value, and `null` removes it:
+Three entry fields of the `@skaile/provider-registry` schema are writable through `upsertProviderEntry` (a Workspaces runtime reading the same file needs `@skaile/workspaces` 9.1 or later; 9.0's schema refuses them). A body that omits one keeps the stored value, and `null` removes it:
 
 |Field|Accepts|Removed by `null` means|
 |---|---|---|
@@ -104,7 +127,7 @@ Three entry fields (`@skaile/workspaces` 9.1; 9.0's schema refuses them) are wri
 
 Any other value is a 400 naming the field. Provider views carry `dataZone` (effective), `euProcessing`, `allowedModels` and `modelIds`.
 
-The zone rule is the host's: `filterRegistryByDataZone(registry, rule)` keeps what `rule` allows (`any` all; `eu_options` EU, local, and EU option with `eu_processing: true`; `eu` EU and local). `entryDataZone`, `entryAllowedByDataZone` and `dataZoneRefusal` answer per entry; `PRESET_DATA_ZONES` copies the SDK catalog's zone per preset. Pass the rule to `resolveHarnessProviders(..., { dataZoneRule })` and `buildHarnessRows(..., { candidates, dataZoneRule })`: an entry the rule keeps out is reported as `blocked-by-rule` (`blocked`, `HarnessRow.blockedProviders`) with a message naming the rule, and is never eligible or chosen.
+The zone rule is the host's: `filterRegistryByDataZone(registry, rule)` keeps what `rule` allows (`any` all; `eu_options` EU, local, and EU option with `eu_processing: true`; `eu` EU and local), and keeps a merged registry merged. `entryDataZone`, `entryAllowedByDataZone` and `dataZoneRefusal` answer per entry; `PRESET_DATA_ZONES` copies the `@skaile/provider-registry/catalog` zone per preset, so the panel needs no catalog in the browser. The vocabulary is the registry's: `AI_PROVIDER_DATA_ZONES`, `AI_PROVIDER_DATA_ZONE_RULES`, `AIProviderDataZone`, `AIProviderDataZoneRule`, and `isModelAllowed` / `allowedModelIds` for `allowed_models`, re-exported by `/server` and `/vue`. Pass the rule to `resolveHarnessProviders(..., { dataZoneRule })` and to `/workspaces`' `buildHarnessRows(..., { candidates, dataZoneRule })`: an entry the rule keeps out is reported as `blocked-by-rule` (`blocked`, `HarnessRow.blockedProviders`) with a message naming the rule, and is never eligible or chosen.
 
 In the panel every row shows its zone chip (`provider-zone-<id>`) and, for `llm` / `embed` entries, a model chip (`provider-models-chip-<id>`: "All models" / "N models"). An own `eu_option` row offers "EU processing is on for this account" (`provider-eu-processing-<id>`). `:data-zone-rule="rule"` marks rows outside the rule with a muted note (`provider-blocked-<id>`). "Models allowed here" (`provider-models-<id>`) switches All models / Only these (`provider-models-mode-<id>`); Only these is a searchable checklist (`provider-models-search-<id>`, `provider-model-<id>-<modelId>`) of the entry's declared models or, for a discovery entry, of `client.models(id)`, and Save (`provider-models-save-<id>`) writes `allowed_models`.
 
@@ -128,7 +151,7 @@ const roles = [
 ]
 validateModelRoleAssignments(roles, assignments, registry) // [{ role, code, message }]: one issue per role id, host turns them into 400s
 resolveModelRole('assistant', { roles, assignments, registry }) // { kind: 'model', selector, entryId } | { kind: 'voice', entryId } | { kind: 'unassigned' }
-resolveRegistryLanguageModel('@assistant', { roles: modelRoleAliases(roles, assignments) })
+resolveRegistryLanguageModel('@assistant', { registry, env, roles: modelRoleAliases(roles, assignments) })
 ```
 
 A dangling assignment throws `ModelResolutionError` (`unknown_selector`). `<ForgeModelRolesPanel :roles :assignments :client :read-only @update:assignments>` renders one row per enabled role (provider select, model select from `client.models`, free text when the provider cannot list models, Clear, a `status` slot per row). It never writes; the host saves the emitted assignments.

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@skaile/forge-settings",
   "configKey": "forgeSettings",
-  "version": "1.4.0",
+  "version": "2.0.0",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/runtime/ai-sdk/index.d.ts

@@ -1,28 +1,33 @@
 /**
  * `@skaile/forge-settings/ai-sdk` — the AI SDK language model of a registry
- * selector, resolved by `@skaile/workspaces/ai-sdk` and gated by the host's
- * credential policy.
+ * selector, built by `@skaile/provider-registry/ai-sdk` against one registry
+ * snapshot the host passes, with the credential resolved under the host's
+ * policy.
  *
- * Workspaces owns endpoint, header and credential wiring for every surface;
- * this module only decides *whether* an entry may be resolved and against
- * *which* environment. It is not a service locator: the caller passes the
- * selector (role-to-selector mapping belongs to the host's settings document)
- * and the environment explicitly.
+ * The shared constructor owns endpoint, header and SDK wiring for every
+ * surface it supports; this module decides *whether* an entry may be resolved
+ * and supplies its credential — through the same policy-checked resolver model
+ * discovery uses, so a model that lists is a model that calls with the same
+ * key. It is not a service locator: the caller passes the selector
+ * (role-to-selector mapping belongs to the host's settings document), the
+ * registry and the environment explicitly. Nothing is read from disk here;
+ * a Skaile Workspaces host that resolves against a project's registry uses
+ * `resolveWorkspaceLanguageModel` from `@skaile/forge-settings/workspaces`.
  *
  * Provider SDKs (`@ai-sdk/anthropic`, `@ai-sdk/openai`,
- * `@ai-sdk/openai-compatible`) are optional peers of Workspaces: install the
- * one the selected surface needs.
+ * `@ai-sdk/openai-compatible`) are optional peers: install the one the
+ * selected surface needs.
  */
-import { type MergedAIProviderRegistry } from "@skaile/workspaces/core";
-import { type ResolvedLanguageModel } from "@skaile/workspaces/ai-sdk";
+import { type MergedAIProviderRegistry } from "@skaile/provider-registry";
+import { type ResolvedLanguageModel } from "@skaile/provider-registry/ai-sdk";
 import type { CredentialPolicy } from "../server/credential-policy.js";
-export { ModelResolutionError } from "../model/errors.js";
 export type { ModelResolutionCode } from "../model/errors.js";
+export { ModelResolutionError } from "../model/errors.js";
 export type { ResolvedLanguageModel };
 /** Options for {@link resolveRegistryLanguageModel}. */
 export interface ResolveRegistryLanguageModelOptions {
-    /** Workspace whose `.skaile/providers.yml` is the workspace layer. */
-    projectDir: string;
+    /** The one merged registry snapshot the selector resolves against. */
+    registry: MergedAIProviderRegistry;
     /**
      * The environment `env:` credential references are read from. Required, so a
      * host never reads the ambient process by accident.
@@ -35,21 +40,23 @@ export interface ResolveRegistryLanguageModelOptions {
      * before anything is read; a refused one is a `policy_refused` failure.
      */
     policy?: CredentialPolicy;
-    /**
-     * An already merged (e.g. transform-proxy-routed) registry. When set,
-     * `projectDir` is not read for providers, the policy check runs on this
-     * registry, and it is handed to Workspaces as the registry to resolve against.
-     */
-    registry?: MergedAIProviderRegistry;
+    /** Local encrypted store for `keyring:` references; else `FORGE_CREDENTIAL_STORE` of `env`. */
+    path?: string;
+    /** 64-char hex key of the local store; else `FORGE_CREDENTIAL_KEY` of `env`. */
+    key?: string;
 }
 /**
  * The AI SDK model for `selector` (`<providerId>/<modelId>`, a bare model id or
- * `@role`), resolved by Workspaces against the registry on disk, or the given
- * `registry`.
+ * `@role`), resolved against `options.registry` only.
+ *
+ * Strict: a selector naming a provider that is missing from the registry's
+ * enabled `llm` entries (and that no entry maps as a model id), disabled, or an
+ * unassigned `@role` fails — nothing is rerouted to another endpoint and
+ * nothing is sent. A bare model id without `/` resolves as the registry orders it.
  *
- * @throws {ModelResolutionError} `registry_invalid` (only when read from disk) ·
- *   `unknown_selector` · `policy_refused` · `unresolved` (credential, endpoint or
- *   provider SDK; the message is fixed and never carries Workspaces' text, which
- *   stays on `cause`).
+ * @throws {ModelResolutionError} `unknown_selector` (no enabled entry serves the
+ *   selector, or the named entry is disabled / not an `llm` entry) ·
+ *   `policy_refused` · `unresolved` (credential, endpoint or provider SDK; the
+ *   message is fixed, the underlying error stays on `cause`).
  */
 export declare function resolveRegistryLanguageModel(selector: string, options: ResolveRegistryLanguageModelOptions): Promise<ResolvedLanguageModel>;

package/dist/runtime/ai-sdk/index.js

@@ -1,24 +1,50 @@
-import { parseModelRef } from "@skaile/workspaces/core";
-import { resolveLanguageModel } from "@skaile/workspaces/ai-sdk";
-import { loadMergedProviderRegistry } from "@skaile/workspaces/sdk/bridge";
-import { ModelResolutionError, assertEntryAllowed } from "../model/errors.js";
+import { parseModelRef } from "@skaile/provider-registry";
+import {
+  resolveLanguageModel
+} from "@skaile/provider-registry/ai-sdk";
+import { assertEntryAllowed, ModelResolutionError } from "../model/errors.js";
+import { credentialStoreOptions, selectorProviderId } from "../model/selector.js";
+import { resolveEntryCredential } from "../server/credential-store.js";
 export { ModelResolutionError } from "../model/errors.js";
+function policyCredentialResolver(options) {
+  return (entry, providerId) => {
+    assertEntryAllowed(entry, providerId, options.policy);
+    const resolved = resolveEntryCredential(entry, credentialStoreOptions(options.env, options));
+    return resolved.error && !resolved.value ? { error: resolved.error } : { ...resolved.value !== void 0 ? { value: resolved.value } : {} };
+  };
+}
 export async function resolveRegistryLanguageModel(selector, options) {
-  const merged = options.registry ?? loadRegistry(options.projectDir);
+  const merged = options.registry;
+  const head = selectorProviderId(selector);
+  const named = head === void 0 ? void 0 : merged.providers[head];
+  if (head !== void 0 && named !== void 0 && (named.kind !== "llm" || named.enabled === false)) {
+    throw new ModelResolutionError(
+      "unknown_selector",
+      `provider '${head}' is ${named.kind !== "llm" ? "not an llm entry" : "disabled"}`,
+      { providerId: head }
+    );
+  }
   const ref = parseModelRef(selector, merged, options.roles);
-  if (!ref) {
+  if (!ref || head !== void 0 && named === void 0 && ref.fallback === true) {
     throw new ModelResolutionError("unknown_selector", `no provider serves '${selector}'`);
   }
+  if (ref.role !== void 0 && !options.roles?.[ref.role]) {
+    throw new ModelResolutionError(
+      "unknown_selector",
+      `role '@${ref.role}' is not assigned to a model`
+    );
+  }
   const entry = merged.providers[ref.providerId];
   if (entry) assertEntryAllowed(entry, ref.providerId, options.policy);
   try {
     return await resolveLanguageModel(selector, {
-      projectDir: options.projectDir,
+      registry: merged,
       env: options.env,
       ...options.roles ? { roles: options.roles } : {},
-      ...options.registry ? { registry: options.registry } : {}
+      resolveCredential: policyCredentialResolver(options)
     });
   } catch (cause) {
+    if (cause instanceof ModelResolutionError) throw cause;
     throw new ModelResolutionError(
       "unresolved",
       `provider '${ref.providerId}': credential, endpoint or provider SDK could not be resolved`,
@@ -26,11 +52,3 @@ export async function resolveRegistryLanguageModel(selector, options) {
     );
   }
 }
-function loadRegistry(projectDir) {
-  const { merged, diagnostics } = loadMergedProviderRegistry({ projectDir });
-  const errors = diagnostics.filter((d) => d.severity === "error").map((d) => d.path ? `${d.path}: ${d.message}` : d.message);
-  if (errors.length > 0) {
-    throw new ModelResolutionError("registry_invalid", `providers registry: ${errors.join("; ")}`);
-  }
-  return merged;
-}

package/dist/runtime/components/ForgeProvidersPanel.d.vue.ts

@@ -1,4 +1,4 @@
-import type { DataZoneRule } from "../shared/provider-registry.js";
+import type { AIProviderDataZoneRule } from "../shared/provider-registry.js";
 import type { ProvidersPanelClient } from "../vue/providers-client.js";
 import { type ProvidersPanelLayer } from "../vue/useProvidersPanel.js";
 type __VLS_Props = {
@@ -33,7 +33,7 @@ type __VLS_Props = {
      * The host's data-zone rule: rows outside it show a muted note naming the
      * rule (`provider-blocked-<id>`). Absent or `any`: none.
      */
-    dataZoneRule?: DataZoneRule;
+    dataZoneRule?: AIProviderDataZoneRule;
 };
 declare const _default: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {} & {
     changed: () => any;

package/dist/runtime/components/ForgeProvidersPanel.vue.d.ts

@@ -1,4 +1,4 @@
-import type { DataZoneRule } from "../shared/provider-registry.js";
+import type { AIProviderDataZoneRule } from "../shared/provider-registry.js";
 import type { ProvidersPanelClient } from "../vue/providers-client.js";
 import { type ProvidersPanelLayer } from "../vue/useProvidersPanel.js";
 type __VLS_Props = {
@@ -33,7 +33,7 @@ type __VLS_Props = {
      * The host's data-zone rule: rows outside it show a muted note naming the
      * rule (`provider-blocked-<id>`). Absent or `any`: none.
      */
-    dataZoneRule?: DataZoneRule;
+    dataZoneRule?: AIProviderDataZoneRule;
 };
 declare const _default: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {} & {
     changed: () => any;

package/dist/runtime/editor/index.d.ts

@@ -4,11 +4,24 @@
  *
  * `@skaile/forge-editor`'s AI routes ask the host's `ModelProvider`
  * (`listModels` / `languageModel`) before their own runtime-config presets.
- * This adapter answers from the host's registry: only `llm` entries on the
- * `openai-completions` surface are offered, because the editor's transport is a
- * chat-completions client (`@ai-sdk/openai-compatible`). A profile's id is the
- * registry selector `<providerId>/<modelId>`, which `languageModel` receives
- * back as `{ preset: id }`.
+ * This adapter answers from the host's registry and is a thin layer over
+ * `@skaile/forge-settings/ai-sdk`: a profile's id is the registry selector
+ * `<providerId>/<modelId>`, which `languageModel` receives back as
+ * `{ preset: id }` and resolves through the same constructor, credential
+ * resolver and policy as every other registry model. Every `llm` entry whose
+ * surface the AI SDK constructor speaks (`openai-completions`,
+ * `openai-responses`, `anthropic-messages`) and that has an endpoint is
+ * offered.
+ *
+ * Listing combines what the registry declares (`model_map` / `capabilities`)
+ * with what an entry's own models list reports, for entries that declare
+ * `discovery` or declare no models at all. Declared models work without a
+ * models list; a declared identity wins over a discovered one.
+ *
+ * The registry is authoritative for the selectors it owns: an empty registry
+ * lists `[]`, and a `<providerId>/…` selector naming a registry entry that is
+ * disabled, refused or unresolvable throws instead of falling through to the
+ * editor's presets. Only a selector the registry does not own answers `null`.
  *
  * The registry and the credential environment are supplied by the host on every
  * call, so provider edits apply without a restart and nothing reads the ambient
@@ -16,35 +29,61 @@
  * them to HTTP in `onFailure`.
  *
  * `@skaile/forge-editor` is an optional peer of this entry only, for its
- * `ModelProvider` contract (types). `@ai-sdk/openai-compatible` builds the model.
+ * `ModelProvider` contract (types).
  */
 import type { ModelProfile, ModelRef } from "@skaile/forge-editor/ai";
 import type { ModelProvider } from "@skaile/forge-editor/server";
+import { type LanguageModelObject } from "@skaile/provider-registry/ai-sdk";
 import { ModelResolutionError } from "../model/errors.js";
 import { type CredentialPolicy } from "../server/credential-policy.js";
 import { type AIProviderRegistryView } from "../shared/provider-registry.js";
-export { ModelResolutionError } from "../model/errors.js";
 export type { ModelResolutionCode } from "../model/errors.js";
-/** Policy for an editor model call; see `CredentialPolicy`. */
+export { ModelResolutionError } from "../model/errors.js";
+/** Policy and credential store for an editor model call; see `CredentialPolicy`. */
 export interface EditorModelPolicyOptions {
     /** Which credential references may be resolved; refused entries are not offered. */
     policy?: CredentialPolicy;
+    /** Local encrypted store for `keyring:` references; else `FORGE_CREDENTIAL_STORE` of the env. */
+    path?: string;
+    /** 64-char hex key of the local store; else `FORGE_CREDENTIAL_KEY` of the env. */
+    key?: string;
 }
 /**
- * The registry's chat-completions models as editor model profiles, in registry
- * order. With a policy, entries it refuses are left out.
+ * The models the registry declares (`model_map` / `capabilities`) as editor
+ * model profiles, in registry order — no network. With a policy, entries it
+ * refuses are left out. {@link createEditorModelProvider} lists these plus the
+ * models discovered live.
  */
 export declare function editorModelProfiles(registry: AIProviderRegistryView, options?: EditorModelPolicyOptions): ModelProfile[];
+/**
+ * Declared and discovered models as editor profiles, in registry order, one
+ * profile per selector.
+ *
+ * An entry's models list is asked when the entry declares `discovery` (and not
+ * `type: none`) or declares no models; it is asked with the credential the
+ * policy allows, exactly as inference resolves it. A failed or unsupported
+ * list leaves that entry with its declared models. A discovered id that a
+ * declared model already names (as selector or as mapped provider id) is
+ * dropped: the declared identity wins.
+ */
+export declare function listEditorModelProfiles(registry: AIProviderRegistryView, env: Record<string, string | undefined>, options?: EditorModelPolicyOptions): Promise<ModelProfile[]>;
 /**
  * The language model of selector `ref.preset`, or `null` when the registry does
- * not serve it (a browser-defined `{ endpoint, model, apiKey }` reference is the
- * editor's own to resolve).
+ * not own it: a browser-defined `{ endpoint, model, apiKey }` reference, or a
+ * preset id whose leading segment names no registry entry, is the editor's own
+ * to resolve.
+ *
+ * Delegates to `resolveRegistryLanguageModel` (`@skaile/forge-settings/ai-sdk`),
+ * so the selector's model id may be declared or discovered: an id the entry's
+ * `model_map` maps is sent as the mapped id, any other is sent verbatim.
  *
- * @throws {ModelResolutionError} `policy_refused` when the policy refuses the
- *   entry (checked before its credential is read); `unresolved` when its
- *   credential reference does not resolve. Neither message carries a secret.
+ * @throws {ModelResolutionError} for an owned selector: `unknown_selector` when
+ *   the entry is disabled or not an `llm` entry, `policy_refused` when the
+ *   policy refuses it (checked before its credential is read), `unresolved`
+ *   when its credential, endpoint or SDK does not resolve. No message carries a
+ *   secret.
  */
-export declare function editorLanguageModel(registry: AIProviderRegistryView, env: Record<string, string | undefined>, ref: ModelRef, options?: EditorModelPolicyOptions): import("@ai-sdk/provider").LanguageModelV4 | null;
+export declare function editorLanguageModel(registry: AIProviderRegistryView, env: Record<string, string | undefined>, ref: ModelRef, options?: EditorModelPolicyOptions): Promise<LanguageModelObject | null>;
 /** Options for {@link createEditorModelProvider}. */
 export interface EditorModelProviderOptions extends EditorModelPolicyOptions {
     /** The registry to serve, read on every call. */

package/dist/runtime/editor/index.js

@@ -1,63 +1,106 @@
-import { createOpenAICompatible } from "@ai-sdk/openai-compatible";
-import { ModelResolutionError, assertEntryAllowed } from "../model/errors.js";
+import { resolveEntryBaseUrl } from "@skaile/provider-registry";
+import { AI_SDK_SURFACES } from "@skaile/provider-registry/ai-sdk";
+import { resolveRegistryLanguageModel } from "../ai-sdk/index.js";
+import { ModelResolutionError } from "../model/errors.js";
+import { credentialStoreOptions, selectorProviderId } from "../model/selector.js";
 import { entryPolicyRefusal } from "../server/credential-policy.js";
-import { resolveEntryCredential } from "../server/credential-store.js";
+import { discoverProviderModels } from "../server/provider-discovery.js";
 import { listAIProviderModels } from "../server/provider-service.js";
 import {
+  asMergedRegistry,
   entriesOfKind
 } from "../shared/provider-registry.js";
 export { ModelResolutionError } from "../model/errors.js";
-const EDITOR_SURFACE = "openai-completions";
-function editorEntries(registry) {
+function editorEntries(registry, policy) {
   const entries = /* @__PURE__ */ new Map();
   for (const [id, entry] of entriesOfKind(registry, "llm")) {
-    if (entry.surface === EDITOR_SURFACE && entry.base_url) entries.set(id, entry);
+    const surface = entry.surface ?? "openai-completions";
+    if (!AI_SDK_SURFACES.includes(surface)) continue;
+    if (!resolveEntryBaseUrl(entry)) continue;
+    if (entryPolicyRefusal(entry, policy)) continue;
+    entries.set(id, entry);
   }
   return entries;
 }
-export function editorModelProfiles(registry, options = {}) {
-  const entries = editorEntries(registry);
-  const allowed = (providerId) => {
-    const entry = entries.get(providerId);
-    return entry !== void 0 && !entryPolicyRefusal(entry, options.policy);
-  };
-  return listAIProviderModels(registry).filter((model) => allowed(model.providerId)).map((model) => ({
+function registryProfile(providerId, entry, model) {
+  return {
     id: model.id,
-    label: `${model.providerId} \xB7 ${model.modelId}`,
-    endpoint: entries.get(model.providerId).base_url,
+    label: `${providerId} \xB7 ${model.name}`,
+    endpoint: resolveEntryBaseUrl(entry),
     model: model.providerModelId,
     source: "preset"
-  }));
+  };
+}
+function declaredProfiles(registry, entries) {
+  const byProvider = /* @__PURE__ */ new Map();
+  for (const model of listAIProviderModels(registry)) {
+    const entry = entries.get(model.providerId);
+    if (!entry) continue;
+    const profile = registryProfile(model.providerId, entry, {
+      id: model.id,
+      name: model.modelId,
+      providerModelId: model.providerModelId
+    });
+    const own = byProvider.get(model.providerId);
+    if (own) own.push(profile);
+    else byProvider.set(model.providerId, [profile]);
+  }
+  return byProvider;
+}
+export function editorModelProfiles(registry, options = {}) {
+  return [...declaredProfiles(registry, editorEntries(registry, options.policy)).values()].flat();
 }
-export function editorLanguageModel(registry, env, ref, options = {}) {
+export async function listEditorModelProfiles(registry, env, options = {}) {
+  const entries = editorEntries(registry, options.policy);
+  const declared = declaredProfiles(registry, entries);
+  const listed = await Promise.all(
+    [...entries].map(async ([providerId, entry]) => {
+      const own = declared.get(providerId) ?? [];
+      const listable = entry.discovery !== void 0 ? entry.discovery.type !== "none" : own.length === 0;
+      if (!listable) return own;
+      const result = await discoverProviderModels(
+        providerId,
+        registry,
+        credentialStoreOptions(env, options)
+      );
+      if (result.status !== "live") return own;
+      const taken = new Set(
+        own.flatMap((profile) => [profile.id, `${providerId}/${profile.model}`])
+      );
+      const discovered = result.models.flatMap((model) => {
+        const id = `${providerId}/${model.id}`;
+        if (taken.has(id)) return [];
+        taken.add(id);
+        return [
+          registryProfile(providerId, entry, { id, name: model.name, providerModelId: model.id })
+        ];
+      });
+      return [...own, ...discovered];
+    })
+  );
+  return listed.flat();
+}
+export async function editorLanguageModel(registry, env, ref, options = {}) {
   if (!("preset" in ref)) return null;
-  const model = listAIProviderModels(registry).find((candidate) => candidate.id === ref.preset);
-  const entry = model && editorEntries(registry).get(model.providerId);
-  if (!model || !entry) return null;
-  assertEntryAllowed(entry, model.providerId, options.policy);
-  const credential = resolveEntryCredential(entry, {
-    env,
-    ...options.policy ? { policy: options.policy } : {}
+  const merged = asMergedRegistry(registry);
+  const head = selectorProviderId(ref.preset);
+  if (head === void 0 || merged.providers[head] === void 0) return null;
+  const resolved = await resolveRegistryLanguageModel(ref.preset, {
+    registry: merged,
+    ...credentialStoreOptions(env, options)
   });
-  if (credential.error && !credential.value) {
-    throw new ModelResolutionError(
-      "unresolved",
-      `provider '${model.providerId}': ${credential.error}`,
-      { providerId: model.providerId }
-    );
-  }
-  return createOpenAICompatible({
-    name: model.providerId,
-    baseURL: entry.base_url,
-    ...credential.value ? { apiKey: credential.value } : {},
-    ...entry.headers ? { headers: entry.headers } : {}
-  }).chatModel(model.providerModelId);
+  return resolved.model;
 }
 export function createEditorModelProvider(options) {
   return {
     async languageModel(ref) {
       try {
-        return editorLanguageModel(await options.registry(), await options.env(), ref, options);
+        return await editorLanguageModel(
+          await options.registry(),
+          await options.env(),
+          ref,
+          options
+        );
       } catch (error) {
         if (error instanceof ModelResolutionError && options.onFailure)
           throw options.onFailure(error);
@@ -65,8 +108,7 @@ export function createEditorModelProvider(options) {
       }
     },
     async listModels() {
-      const profiles = editorModelProfiles(await options.registry(), options);
-      return profiles.length > 0 ? profiles : null;
+      return listEditorModelProfiles(await options.registry(), await options.env(), options);
     }
   };
 }