@skaile/forge-settings 1.4.0 → 2.0.0

package/src/runtime/shared/provider-registry.ts

@@ -1,242 +1,74 @@
 /**
  * The AI provider registry vocabulary, as forge-settings speaks it.
  *
- * `@skaile/workspaces` owns this schema (`core/src/provider-registry.ts`): the
- * validator, the layer merge, the catalog presets and the model-reference
- * resolver live there and are deliberately NOT reimplemented here. What follows
- * is a *structural* mirror of the record so browser bundles do not import the
- * workspaces core. Field names, union members and optionality match the
- * upstream record exactly, so an entry produced by the runtime is assignable to
- * these types and vice versa.
+ * The schema is `@skaile/provider-registry`'s: every record type, the
+ * enumerations and the credential-reference grammar below are re-exported from
+ * there, so an entry this package reads is the same type the runtime resolves
+ * and there is one validator, not a mirror. What this module adds are Forge's
+ * view helpers: reading either registry shape in registry order, filtering by
+ * kind, voice selection and the credential editor's wording.
  *
- * Browser-safe on purpose — no `node:` imports — so the settings modal renders
- * registry entries with the same types the server resolves them with.
+ * Browser-safe on purpose — no `node:` imports, and only the browser-safe root
+ * of `@skaile/provider-registry` — so the settings modal renders registry
+ * entries with the same types the server resolves them with.
  *
  * Vocabulary: these are **AI provider** records. They are unrelated to the
  * platform's connector `ProviderType`/`ProviderLink` (git, SharePoint, Drive).
  */
 
-// ── Enums ──────────────────────────────────────────────────────────────────
-
-/** What an entry produces. `stt`/`tts` use the reduced voice record. */
-export const AI_PROVIDER_KINDS = ["llm", "stt", "tts", "embed"] as const;
-
-/** Union of {@link AI_PROVIDER_KINDS}. */
-export type AIProviderKind = (typeof AI_PROVIDER_KINDS)[number];
-
-/** Kinds that use the voice subset of the record. */
-export const AI_PROVIDER_VOICE_KINDS = ["stt", "tts"] as const;
-
-/** Union of {@link AI_PROVIDER_VOICE_KINDS}. */
-export type AIProviderVoiceKind = (typeof AI_PROVIDER_VOICE_KINDS)[number];
-
-/** Wire protocol of an `llm`/`embed` entry — omp's `api` values verbatim. */
-export const AI_PROVIDER_SURFACES = [
-  "anthropic-messages",
-  "openai-completions",
-  "openai-responses",
-  "openai-codex-responses",
-  "azure-openai-responses",
-  "bedrock-converse-stream",
-  "google-generative-ai",
-  "google-vertex",
-] as const;
-
-/** Union of {@link AI_PROVIDER_SURFACES}. */
-export type AIProviderSurface = (typeof AI_PROVIDER_SURFACES)[number];
-
-/** How the request reaches the surface — selects the `params` shape. */
-export const AI_PROVIDER_TRANSPORTS = [
-  "direct",
-  "bedrock",
-  "vertex",
-  "foundry",
-  "azure-openai",
-] as const;
-
-/** Union of {@link AI_PROVIDER_TRANSPORTS}. */
-export type AIProviderTransport = (typeof AI_PROVIDER_TRANSPORTS)[number];
-
-/** How the credential is presented. */
-export const AI_PROVIDER_CREDENTIAL_KINDS = [
-  "api_key_header",
-  "bearer",
-  "sigv4",
-  "google_adc",
-  "azure_entra",
-  "oauth",
-  "command",
-  "none",
-] as const;
-
-/** Union of {@link AI_PROVIDER_CREDENTIAL_KINDS}. */
-export type AIProviderCredentialKind = (typeof AI_PROVIDER_CREDENTIAL_KINDS)[number];
-
-/**
- * Where an endpoint processes data: `eu` inside the EU, `eu_option` only once
- * the account's EU-processing setting is on, `transfer` outside the EU,
- * `local` on the operator's own machine or network. Upstream
- * `AI_PROVIDER_DATA_ZONES` (`@skaile/workspaces` 9.1).
- */
-export const DATA_ZONES = ["eu", "eu_option", "transfer", "local"] as const;
-
-/** Union of {@link DATA_ZONES}. */
-export type DataZone = (typeof DATA_ZONES)[number];
-
-/**
- * Which data zones a host allows: `any` all, `eu_options` EU, local and
- * `eu_option` entries with `eu_processing: true`, `eu` only EU and local.
- * Upstream `AI_PROVIDER_DATA_ZONE_RULES` (`@skaile/workspaces` 9.1).
- */
-export const DATA_ZONE_RULES = ["any", "eu_options", "eu"] as const;
-
-/** Union of {@link DATA_ZONE_RULES}. */
-export type DataZoneRule = (typeof DATA_ZONE_RULES)[number];
-
-// ── Record ─────────────────────────────────────────────────────────────────
-
-/** `transport: bedrock` routing parameters. */
-export interface AIProviderBedrockParams {
-  /** AWS region, e.g. `us-east-1`. */
-  region: string;
-}
-
-/** `transport: vertex` routing parameters. */
-export interface AIProviderVertexParams {
-  /** GCP project id. */
-  project: string;
-  /** Vertex location, e.g. `europe-west4`. */
-  location: string;
-  /** Model publisher; defaults to `google`. */
-  publisher?: string;
-}
-
-/** `transport: foundry` routing parameters. */
-export interface AIProviderFoundryParams {
-  /** Azure AI Foundry resource name. */
-  resource: string;
-}
-
-/** `transport: azure-openai` routing parameters. */
-export interface AIProviderAzureOpenAIParams {
-  /** Azure OpenAI resource name. */
-  resource: string;
-  /** Deployment the request is routed to. */
-  deployment: string;
-  /** `api-version` query value. */
-  api_version: string;
-}
-
-/** Voice parameters, typed per preset: Deepgram `{model, language}`, ElevenLabs `{voice_id, output_format}`. */
-export type AIProviderVoiceParams = Record<string, string | number | boolean>;
-
-/** The `transport` → `params` discriminated union. */
-export type AIProviderTransportSlice =
-  | { transport?: "direct"; params?: Record<string, never> }
-  | { transport: "bedrock"; params: AIProviderBedrockParams }
-  | { transport: "vertex"; params: AIProviderVertexParams }
-  | { transport: "foundry"; params: AIProviderFoundryParams }
-  | { transport: "azure-openai"; params: AIProviderAzureOpenAIParams };
-
-/** Reference to a secret — never the secret itself. See {@link parseCredentialRef}. */
-export interface AIProviderCredential {
-  kind: AIProviderCredentialKind;
-  /**
-   * `env:NAME` · `cmd:<shell>` · `platform:<configId>` · `keyring:<service>/<account>`.
-   * A literal secret here is a validation error, not a warning.
-   */
-  ref?: string;
-}
-
-/** Per-model capability facts, keyed by the logical (`model_map`) id. */
-export interface AIProviderCapabilities {
-  context_window?: number;
-  tools?: boolean;
-  images?: boolean;
-  thinking_max?: number;
-}
-
-/** omp-compatible discovery descriptor. */
-export interface AIProviderDiscovery {
-  type: string;
-  /** Path appended to `base_url` when the surface default does not apply. */
-  path?: string;
-}
-
-/** Fields every entry carries, whatever its `kind`. */
-export interface AIProviderEntryCommon {
-  /** Display name. Never load-bearing. */
-  label?: string;
-  /** Catalog preset this entry inherits from. */
-  preset?: string;
-  /** Literal endpoint; wins over the preset value and the transport derivation. */
-  base_url?: string;
-  /** Static, non-secret request headers. */
-  headers?: Record<string, string>;
-  credential?: AIProviderCredential;
-  /** Default `true`; read it through {@link isEntryEnabled}. */
-  enabled?: boolean;
-  /** Set by the control plane: lower layers cannot override this entry. */
-  locked?: boolean;
-  /** Where the endpoint processes data; overrides the preset's zone. Read it through `entryDataZone`. */
-  data_zone?: DataZone;
-  /** The account's EU-processing setting is on; only an `eu_option` entry reads it. */
-  eu_processing?: boolean;
-}
-
-/** An `llm`/`embed` entry — the full record. */
-export type AIProviderLlmEntry = AIProviderEntryCommon &
-  AIProviderTransportSlice & {
-    kind: "llm" | "embed";
-    /** Required unless a `preset` supplies it. */
-    surface?: AIProviderSurface;
-    /** Azure's `api-version` lives here. */
-    query_params?: Record<string, string>;
-    /** Logical id → provider-side id. */
-    model_map?: Record<string, string>;
-    /** Keyed by the logical id, i.e. the `model_map` key. */
-    capabilities?: Record<string, AIProviderCapabilities>;
-    discovery?: AIProviderDiscovery;
-    /**
-     * The models this entry may be used with; absent = every model, `[]` =
-     * none. Logical ids of `model_map`, or provider-side ids (what a
-     * `discovery` entry lists). Read it through {@link isModelAllowed}.
-     */
-    allowed_models?: string[];
-  };
-
-/**
- * An `stt`/`tts` entry — the reduced record. `surface`, `transport`,
- * `model_map`, `capabilities` and `discovery` are `llm`-only: a TTS voice is
- * not a wire protocol. The voice defaults forge apps used to hardcode at their
- * call sites (Deepgram model/language, ElevenLabs voice id/output format) live
- * in `params`.
- */
-export type AIProviderVoiceEntry = AIProviderEntryCommon & {
-  kind: AIProviderVoiceKind;
-  params?: AIProviderVoiceParams;
-};
-
-/** One registry entry. */
-export type AIProviderEntry = AIProviderLlmEntry | AIProviderVoiceEntry;
-
-/** Entry id → entry. Iteration order is registry order. */
-export type AIProviderRegistry = Record<string, AIProviderEntry>;
-
-/** Configuration layers, lowest precedence first. */
-export type AIProviderLayerId = "catalog" | "user" | "workspace" | "runtime" | "session";
-
-/** The merged, layered view the runtime hands to a session. */
-export interface MergedAIProviderRegistry {
-  version: 1;
-  providers: AIProviderRegistry;
-  /** Registry order: highest-precedence layer first, document order within a layer. */
-  order: string[];
-  /** Highest-precedence layer that contributed to each entry. */
-  origin: Record<string, AIProviderLayerId>;
-  /** Entries frozen by `locked: true`. */
-  locked: string[];
-}
+import type {
+  AIProviderEntry,
+  AIProviderKind,
+  AIProviderLayerId,
+  AIProviderLlmEntry,
+  AIProviderRegistry,
+  AIProviderVoiceEntry,
+  AIProviderVoiceKind,
+  MergedAIProviderRegistry,
+} from "@skaile/provider-registry";
+import { isEntryEnabled, parseCredentialRef } from "@skaile/provider-registry";
+
+export type {
+  AIProviderAzureOpenAIParams,
+  AIProviderBedrockParams,
+  AIProviderCapabilities,
+  AIProviderCredential,
+  AIProviderCredentialKind,
+  AIProviderCredentialRef,
+  AIProviderDataZone,
+  AIProviderDataZoneRule,
+  AIProviderDiscovery,
+  AIProviderEntry,
+  AIProviderEntryCommon,
+  AIProviderFoundryParams,
+  AIProviderKind,
+  AIProviderLayerId,
+  AIProviderLlmEntry,
+  AIProviderModelAllowListFields,
+  AIProviderRegistry,
+  AIProviderSurface,
+  AIProviderTransport,
+  AIProviderTransportSlice,
+  AIProviderVertexParams,
+  AIProviderVoiceEntry,
+  AIProviderVoiceKind,
+  AIProviderVoiceParams,
+  MergedAIProviderRegistry,
+} from "@skaile/provider-registry";
+export {
+  AI_PROVIDER_CREDENTIAL_KINDS,
+  AI_PROVIDER_DATA_ZONE_RULES,
+  AI_PROVIDER_DATA_ZONES,
+  AI_PROVIDER_KINDS,
+  AI_PROVIDER_SURFACES,
+  AI_PROVIDER_TRANSPORTS,
+  AI_PROVIDER_VOICE_KINDS,
+  allowedModelIds,
+  formatCredentialRef,
+  isEntryEnabled,
+  isModelAllowed,
+  parseCredentialRef,
+} from "@skaile/provider-registry";
 
 /** Either shape a consumer may be handed. */
 export type AIProviderRegistryView = AIProviderRegistry | MergedAIProviderRegistry;
@@ -255,9 +87,25 @@ export function isMergedRegistry(
   return Array.isArray((registry as MergedAIProviderRegistry).order);
 }
 
-/** `enabled` defaults to `true`. */
-export function isEntryEnabled(entry: AIProviderEntry): boolean {
-  return entry.enabled !== false;
+/**
+ * The layered shape of a view. A merged registry is returned as is; a bare
+ * entry map becomes one layer in its own iteration order, reported as the
+ * `runtime` layer (the host handed it over in memory) with nothing locked.
+ * The model constructor resolves against this shape only.
+ */
+export function asMergedRegistry(
+  registry: AIProviderRegistryView,
+  layer: AIProviderLayerId = "runtime",
+): MergedAIProviderRegistry {
+  if (isMergedRegistry(registry)) return registry;
+  const order = Object.keys(registry);
+  return {
+    version: 1,
+    providers: registry,
+    order,
+    origin: Object.fromEntries(order.map((id) => [id, layer])),
+    locked: [],
+  };
 }
 
 /** Entries in registry order, as `[id, entry]` pairs. Both registry shapes accepted. */
@@ -293,33 +141,6 @@ export function isVoiceEntry(entry: AIProviderEntry): entry is AIProviderVoiceEn
   return entry.kind === "stt" || entry.kind === "tts";
 }
 
-/** A thinking-level suffix omp takes on a selector (`sonnet:high`); not part of the model id. */
-const THINKING_SUFFIX = /:(off|minimal|low|medium|high|xhigh)$/i;
-
-/**
- * Whether an entry's `allowed_models` lets it be used with `modelId`. Absent
- * allows every model, `[]` none. `modelId` and the list may each hold the
- * logical id (a `model_map` key) or the provider-side id; a trailing
- * thinking-level suffix (`:high`) is ignored. Mirrors `isModelAllowed` of
- * `@skaile/workspaces/core` 9.1, which enforces it at model resolution.
- */
-export function isModelAllowed(
-  entry: { allowed_models?: readonly string[]; model_map?: Record<string, string> },
-  modelId: string,
-): boolean {
-  const list = entry.allowed_models;
-  if (list === undefined) return true;
-  const matches = (id: string): boolean => {
-    if (list.includes(id)) return true;
-    const mapped = entry.model_map?.[id];
-    if (mapped !== undefined && list.includes(mapped)) return true;
-    return list.some((allowed) => entry.model_map?.[allowed] === id);
-  };
-  if (matches(modelId)) return true;
-  const base = modelId.replace(THINKING_SUFFIX, "");
-  return base !== modelId && matches(base);
-}
-
 // ── Voice selection ────────────────────────────────────────────────────────
 
 /**
@@ -352,62 +173,9 @@ export function selectVoiceEntryId(ids: readonly string[], wanted?: string): str
 
 // ── Credential references ──────────────────────────────────────────────────
 
-/** POSIX environment variable name. */
-const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-
-/** The four reference forms. */
+/** The four reference forms, as a credential editor's refusal distinguishes them. */
 const CREDENTIAL_REF = /^(env|cmd|platform|keyring):([\s\S]+)$/;
 
-/** A parsed `credential.ref`. */
-export type AIProviderCredentialRef =
-  | { form: "env"; name: string }
-  | { form: "cmd"; command: string }
-  | { form: "platform"; configId: string }
-  | { form: "keyring"; service: string; account: string };
-
-/**
- * Parse a `credential.ref`.
- *
- * Returns `undefined` for anything that is not one of the four reference forms
- * — which, in a registry entry or a credential editor, means someone typed a
- * literal secret.
- */
-export function parseCredentialRef(ref: string): AIProviderCredentialRef | undefined {
-  const match = CREDENTIAL_REF.exec(ref.trim());
-  if (!match) return undefined;
-  const body = match[2].trim();
-  if (body === "") return undefined;
-  switch (match[1]) {
-    case "env":
-      return ENV_NAME.test(body) ? { form: "env", name: body } : undefined;
-    case "cmd":
-      return { form: "cmd", command: body };
-    case "platform":
-      return { form: "platform", configId: body };
-    case "keyring": {
-      const slash = body.indexOf("/");
-      if (slash <= 0 || slash === body.length - 1) return undefined;
-      return { form: "keyring", service: body.slice(0, slash), account: body.slice(slash + 1) };
-    }
-    default:
-      return undefined;
-  }
-}
-
-/** Render a parsed reference back to its `<form>:<body>` string. */
-export function formatCredentialRef(ref: AIProviderCredentialRef): string {
-  switch (ref.form) {
-    case "env":
-      return `env:${ref.name}`;
-    case "cmd":
-      return `cmd:${ref.command}`;
-    case "platform":
-      return `platform:${ref.configId}`;
-    case "keyring":
-      return `keyring:${ref.service}/${ref.account}`;
-  }
-}
-
 /** The reference forms, spelled the way a credential editor offers them. */
 export const CREDENTIAL_REF_FORMS = [
   "env:NAME",

package/src/runtime/vue/providers-panel-model.ts

@@ -13,11 +13,11 @@ import type {
 } from "../shared/provider-accounts";
 import type {
   AIProviderCredentialKind,
+  AIProviderDataZone,
+  AIProviderDataZoneRule,
   AIProviderKind,
   AIProviderSurface,
   AIProviderTransport,
-  DataZone,
-  DataZoneRule,
 } from "../shared/provider-registry";
 import type { ProvidersPanelClient } from "./providers-client";
 
@@ -68,7 +68,7 @@ export interface ProvidersPanelProps {
    * The host's data-zone rule ("Where may AI process data?"). Rows outside it
    * show a muted note naming the rule. Absent or `any`: no row is marked.
    */
-  dataZoneRule?: DataZoneRule;
+  dataZoneRule?: AIProviderDataZoneRule;
 }
 
 /** Emits both variants declare. */
@@ -107,7 +107,7 @@ export interface ProvidersPanelEntry {
   /** The scope's own document's values for the editable fields the dialog does not show. */
   layerFields?: Record<string, unknown>;
   /** Where the entry processes data. Absent (an older host): the preset's zone, else `transfer`. */
-  dataZone?: DataZone;
+  dataZone?: AIProviderDataZone;
   /** The entry's `eu_processing` switch. */
   euProcessing?: boolean;
   /** The entry's `allowed_models`; absent = every model, `[]` = none. */
@@ -181,7 +181,7 @@ export interface ProvidersPanelRow extends ProvidersPanelEntry {
   /** "Renew" is offered next to the expiry: the credential can be changed here. */
   canRenew: boolean;
   /** The entry's effective data zone. */
-  zone: DataZone;
+  zone: AIProviderDataZone;
   /** The zone chip: EU / EU option / Transfer / Local. */
   zoneLabel: string;
   /** "EU processing is on for this account" is offered: an `eu_option` entry the panel may write. */

package/src/runtime/vue/useProvidersPanel.ts

@@ -55,9 +55,9 @@ import {
 import {
   AI_PROVIDER_SURFACES,
   type AIProviderCredentialKind,
+  type AIProviderDataZone,
   type AIProviderKind,
   type AIProviderSurface,
-  type DataZone,
   validateCredentialRef,
 } from "../shared/provider-registry";
 import {
@@ -466,7 +466,10 @@ export function useProvidersPanel(
   }
 
   /** The muted note of a row the host's data-zone rule keeps out; `null` when it does not. */
-  function blockedNoteOf(zone: DataZone, euProcessing: boolean | undefined): string | null {
+  function blockedNoteOf(
+    zone: AIProviderDataZone,
+    euProcessing: boolean | undefined,
+  ): string | null {
     const rule = props.dataZoneRule;
     if (!rule || rule === "any") return null;
     return dataZoneRefusal(rule, zone, euProcessing) ?? null;

package/src/runtime/{server → workspaces}/harness-settings.ts

@@ -34,8 +34,8 @@ import {
   harnessRoleIds,
   isExperimentalHarness,
 } from "../shared/harnesses";
-import type { DataZoneRule } from "../shared/provider-registry";
-import type { SkaileSettings } from "../shared/settings-types";
+import type { AIProviderDataZoneRule } from "../shared/provider-registry";
+import type { SkaileSettings } from "./settings-types";
 
 /** The slice of {@link SkaileSettings} that selects, configures and locks harnesses. */
 export type HarnessSettings = Pick<
@@ -126,7 +126,7 @@ export interface HarnessRowProviders {
   /** `GET /api/providers` rows (or any {@link HarnessProviderCandidate}s), in registry order. */
   candidates: readonly HarnessProviderCandidate[];
   /** The host's data-zone rule. Absent: `any`. */
-  dataZoneRule?: DataZoneRule;
+  dataZoneRule?: AIProviderDataZoneRule;
 }
 
 /**

package/src/runtime/workspaces/index.ts

@@ -0,0 +1,17 @@
+/**
+ * `@skaile/forge-settings/workspaces` — the Skaile Workspaces integration:
+ * the Workspaces `settings.json` document (`SkaileSettings`, defaults, legacy
+ * migrations), harness settings, project-registry model resolution with the
+ * Workspaces keyring location, and the address of a running Workspaces model
+ * endpoint.
+ *
+ * The only entry that needs the optional peer `@skaile/workspaces`; the generic
+ * entries (`/server`, `/vue`, `/nuxt`, `/ai-sdk`, `/editor`) never import it.
+ */
+
+export * from "./harness-settings";
+export * from "./language-model";
+export * from "./model-endpoint";
+export * from "./provider-settings";
+export * from "./settings-defaults";
+export type { DomainConfig, SkaileSettings } from "./settings-types";

package/src/runtime/workspaces/language-model.ts

@@ -0,0 +1,82 @@
+/**
+ * Project-oriented model resolution for a Skaile Workspaces host: load the
+ * project's merged provider registry once (user + workspace layers + catalog),
+ * keep the forge keyring where Workspaces hosts always kept it, and delegate to
+ * the generic `resolveRegistryLanguageModel` (`@skaile/forge-settings/ai-sdk`).
+ */
+
+import { join } from "node:path";
+import type { MergedAIProviderRegistry } from "@skaile/provider-registry";
+import { loadMergedProviderRegistry } from "@skaile/workspaces/sdk/bridge";
+import { globalSkaileDir } from "@skaile/workspaces/sdk/core";
+import {
+  type ResolvedLanguageModel,
+  type ResolveRegistryLanguageModelOptions,
+  resolveRegistryLanguageModel,
+} from "../ai-sdk";
+import { ModelResolutionError } from "../model/errors";
+
+/**
+ * The forge keyring of a Workspaces host: `FORGE_CREDENTIAL_STORE` of `env`
+ * when set, else `<skaile home>/forge-credentials.json`, beside the user's
+ * `settings.json` (follows `$SKAILE_HOME`). Generic entries never assume this
+ * home; a Workspaces host passes it as the store `path` (or pins it into
+ * `FORGE_CREDENTIAL_STORE`).
+ */
+export function workspaceCredentialStorePath(
+  env?: Readonly<Record<string, string | undefined>>,
+): string {
+  return env?.FORGE_CREDENTIAL_STORE || join(globalSkaileDir(), "forge-credentials.json");
+}
+
+/**
+ * The merged provider registry of `projectDir` — the user layer, the
+ * project's `.skaile/providers.yml` and the catalog presets they name.
+ *
+ * @throws {ModelResolutionError} `registry_invalid` on any error diagnostic.
+ */
+export function loadWorkspaceProviderRegistry(projectDir: string): MergedAIProviderRegistry {
+  const { merged, diagnostics } = loadMergedProviderRegistry({ projectDir });
+  const errors = diagnostics
+    .filter((d) => d.severity === "error")
+    .map((d) => (d.path ? `${d.path}: ${d.message}` : d.message));
+  if (errors.length > 0) {
+    throw new ModelResolutionError("registry_invalid", `providers registry: ${errors.join("; ")}`);
+  }
+  return merged;
+}
+
+/** Options for {@link resolveWorkspaceLanguageModel}. */
+export interface ResolveWorkspaceLanguageModelOptions
+  extends Omit<ResolveRegistryLanguageModelOptions, "registry"> {
+  /** Workspace whose `.skaile/providers.yml` is the workspace layer. */
+  projectDir: string;
+  /**
+   * An already merged (e.g. transform-proxy-routed) registry. When set,
+   * `projectDir` is not read for providers; the selector, the policy check
+   * and the model all resolve against this registry.
+   */
+  registry?: MergedAIProviderRegistry;
+}
+
+/**
+ * The AI SDK model for `selector`, resolved against the registry of
+ * `projectDir` (read once) or the given `registry`.
+ *
+ * `keyring:` references read the store at `path`, else the environment's
+ * `FORGE_CREDENTIAL_STORE`, else {@link workspaceCredentialStorePath}.
+ *
+ * @throws {ModelResolutionError} `registry_invalid` (only when read from disk),
+ *   plus every failure of `resolveRegistryLanguageModel`.
+ */
+export async function resolveWorkspaceLanguageModel(
+  selector: string,
+  options: ResolveWorkspaceLanguageModelOptions,
+): Promise<ResolvedLanguageModel> {
+  const { projectDir, registry, ...rest } = options;
+  return resolveRegistryLanguageModel(selector, {
+    ...rest,
+    registry: registry ?? loadWorkspaceProviderRegistry(projectDir),
+    path: options.path ?? workspaceCredentialStorePath(options.env),
+  });
+}