@skaile/forge-settings 1.4.0 → 2.0.1

package/dist/runtime/workspaces/model-endpoint.js

@@ -0,0 +1,54 @@
+import { readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { isPlainObject } from "../shared/guards.js";
+export const WORKSPACE_MODEL_ENDPOINT_URL_ENV = "SKAILE_MODEL_ENDPOINT_URL";
+export const WORKSPACE_MODEL_ENDPOINT_TOKEN_ENV = "SKAILE_MODEL_ENDPOINT_TOKEN";
+const PREFIX = "Skaile model endpoint configuration";
+function isHttpUrl(value) {
+  try {
+    const { protocol } = new URL(value);
+    return protocol === "http:" || protocol === "https:";
+  } catch {
+    return false;
+  }
+}
+export async function readWorkspaceModelEndpoint(options) {
+  const envUrl = options.env[WORKSPACE_MODEL_ENDPOINT_URL_ENV]?.trim() ?? "";
+  const envToken = options.env[WORKSPACE_MODEL_ENDPOINT_TOKEN_ENV]?.trim() ?? "";
+  if (envUrl || envToken) {
+    if (!envUrl || !envToken) {
+      throw new Error(
+        `${PREFIX}: ${WORKSPACE_MODEL_ENDPOINT_URL_ENV} and ${WORKSPACE_MODEL_ENDPOINT_TOKEN_ENV} must be set together`
+      );
+    }
+    if (!isHttpUrl(envUrl)) {
+      throw new Error(`${PREFIX}: ${WORKSPACE_MODEL_ENDPOINT_URL_ENV} is not an http(s) URL`);
+    }
+    return { url: envUrl, token: envToken };
+  }
+  if (options.projectDir === void 0) return null;
+  const file = join(options.projectDir, ".skaile", "model-endpoint.json");
+  let text;
+  try {
+    text = await readFile(file, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw new Error(`${PREFIX}: ${file} could not be read`);
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    throw new Error(`${PREFIX}: ${file} is not valid JSON`);
+  }
+  const record = isPlainObject(parsed) ? parsed : {};
+  const url = typeof record.url === "string" ? record.url.trim() : "";
+  const token = typeof record.token === "string" ? record.token.trim() : "";
+  if (!url || !token) {
+    throw new Error(`${PREFIX}: ${file} needs a non-empty "url" and "token"`);
+  }
+  if (!isHttpUrl(url)) {
+    throw new Error(`${PREFIX}: ${file} "url" is not an http(s) URL`);
+  }
+  return { url, token };
+}

package/dist/runtime/workspaces/provider-settings.d.ts

@@ -0,0 +1,35 @@
+/**
+ * The legacy `settings.json` migration of a Workspaces host.
+ *
+ * A `settings.json` written before the 5.0.0 registry migration holds
+ * `provider` + a free-text `model`, and an `apiKeys` map of secrets. On first
+ * load the pair collapses into one `"<providerId>/<modelId>"` selector, and the
+ * `apiKeys` map is dropped with a warning — a plaintext key is never
+ * auto-written anywhere; the user moves it into `.env`.
+ *
+ * Voice selection over the same settings fields is generic:
+ * `resolveVoiceProvider` in `@skaile/forge-settings/server`.
+ */
+/** What {@link migrateLegacyProviderSettings} did to one settings file. */
+export interface LegacySettingsMigration {
+    /** The file that was inspected. */
+    path: string;
+    /** Whether the file was rewritten. */
+    changed: boolean;
+    /** The selector `provider` + `model` collapsed into, when that happened. */
+    model?: string;
+    /** Everything dropped or left untouched, and why. Secret-free. */
+    warnings: string[];
+}
+/**
+ * Migrate one legacy `settings.json` in place. Idempotent: a file with no
+ * legacy `provider` and no `apiKeys` is left byte-identical.
+ *
+ * An `apiKeys` map is removed from the file and never stored anywhere else:
+ * the registry holds references only, and a plaintext key has no safe
+ * automatic destination. Each non-empty entry is reported through `warnings`
+ * (without the key) so the user can move it into `.env`.
+ *
+ * @param settingsPath - Absolute path to a `settings.json`.
+ */
+export declare function migrateLegacyProviderSettings(settingsPath: string): LegacySettingsMigration;

package/dist/runtime/{server → workspaces}/provider-settings.js

@@ -1,9 +1,4 @@
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
-import {
-  entriesOfKind,
-  selectVoiceEntryId,
-  VOICE_OVERRIDE_PARAM
-} from "../shared/provider-registry.js";
 export function migrateLegacyProviderSettings(settingsPath) {
   const result = {
     path: settingsPath,
@@ -53,29 +48,3 @@ export function migrateLegacyProviderSettings(settingsPath) {
   }
   return result;
 }
-export function resolveVoiceProvider(registry, kind, settings = {}, overrides = {}) {
-  const candidates = entriesOfKind(registry, kind);
-  if (candidates.length === 0) return void 0;
-  const warnings = [];
-  const wanted = (kind === "stt" ? settings.sttProvider : settings.ttsProvider)?.trim();
-  const ids = candidates.map(([id]) => id);
-  const providerId = selectVoiceEntryId(ids, wanted);
-  const entry = candidates[ids.indexOf(providerId)][1];
-  if (wanted && wanted !== providerId) {
-    warnings.push(
-      `settings name '${wanted}' for ${kind}, which is not an enabled ${kind} entry \u2014 using '${providerId}' instead`
-    );
-  }
-  const fallback = wanted !== providerId;
-  const settingsOverride = {};
-  const override = (kind === "stt" ? settings.sttLanguage : settings.ttsVoice)?.trim();
-  if (override) settingsOverride[VOICE_OVERRIDE_PARAM[kind]] = override;
-  return {
-    providerId,
-    entry,
-    ...entry.base_url ? { baseUrl: entry.base_url } : {},
-    params: { ...entry.params, ...settingsOverride, ...overrides },
-    fallback,
-    warnings
-  };
-}

package/dist/runtime/{server → workspaces}/settings-defaults.d.ts

@@ -4,7 +4,7 @@
  * Storage stays with the host: this module reads and writes nothing except the
  * one `settings.json` {@link migrateLegacyHarnessSettings} is pointed at.
  */
-import type { SkaileSettings } from "../shared/settings-types.js";
+import type { SkaileSettings } from "./settings-types.js";
 /**
  * Merged default settings for forge apps.
  *

package/dist/runtime/{shared → workspaces}/settings-types.d.ts

@@ -1,9 +1,9 @@
 /**
- * The settings document type forge apps share.
+ * The settings document type forge apps on Skaile Workspaces share.
  *
- * A leaf module: it imports types only, so the harness and provider settings
- * modules read `SkaileSettings` from here instead of from the broad server
- * entry. Browser-safe.
+ * It extends the Workspaces `settings.json` type, so it lives in the explicit
+ * `@skaile/forge-settings/workspaces` entry: the generic entries never see it.
+ * A leaf module: it imports types only.
  */
 import type { SkaileSettings as CoreSettings } from "@skaile/workspaces/sdk/core";
 /** Skill domain enablement configuration for a forge app installation. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaile/forge-settings",
-  "version": "1.4.0",
+  "version": "2.0.1",
   "description": "Provider and settings operations for Skaile forge apps: provider registry layers, credential store, env layers, model discovery, the providers panel, and editor / AI SDK model adapters.",
   "type": "module",
   "packageManager": "bun@1.3.9",
@@ -26,6 +26,10 @@
     "./editor": {
       "types": "./dist/runtime/editor/index.d.ts",
       "import": "./dist/runtime/editor/index.js"
+    },
+    "./workspaces": {
+      "types": "./dist/runtime/workspaces/index.d.ts",
+      "import": "./dist/runtime/workspaces/index.js"
     }
   },
   "files": [
@@ -55,7 +59,7 @@
   },
   "dependencies": {
     "@nuxt/kit": "^4.0.0",
-    "@skaile/workspaces": "^9.1.0",
+    "@skaile/provider-registry": "^0.1.0",
     "ofetch": "^1.4.0",
     "yaml": "^2.9.0"
   },
@@ -64,7 +68,8 @@
     "@ai-sdk/openai": "^4.0.0",
     "@ai-sdk/openai-compatible": "^3.0.0",
     "@nuxt/ui": "^4.11.1",
-    "@skaile/forge-editor": "^6.0.0",
+    "@skaile/forge-editor": "^6.0.0 || ^7.0.0",
+    "@skaile/workspaces": "^7.8.0 || ^8.0.0 || ^9.0.0 || ^10.0.0",
     "ai": "^7.0.0",
     "nuxt": "^4.0.0",
     "vue": "^3.5.0"
@@ -85,6 +90,9 @@
     "@skaile/forge-editor": {
       "optional": true
     },
+    "@skaile/workspaces": {
+      "optional": true
+    },
     "ai": {
       "optional": true
     },
@@ -101,7 +109,8 @@
     "@nuxt/module-builder": "^1.0.0",
     "@nuxt/schema": "^4.0.0",
     "@nuxt/ui": "^4.11.1",
-    "@skaile/forge-editor": "^6.4.2",
+    "@skaile/forge-editor": "^7.0.0",
+    "@skaile/workspaces": "^10.0.0",
     "@types/bun": "^1.2.0",
     "@types/node": "^22.0.0",
     "ai": "^7.0.155",

package/src/runtime/ai-sdk/index.ts

@@ -1,33 +1,43 @@
 /**
  * `@skaile/forge-settings/ai-sdk` — the AI SDK language model of a registry
- * selector, resolved by `@skaile/workspaces/ai-sdk` and gated by the host's
- * credential policy.
+ * selector, built by `@skaile/provider-registry/ai-sdk` against one registry
+ * snapshot the host passes, with the credential resolved under the host's
+ * policy.
  *
- * Workspaces owns endpoint, header and credential wiring for every surface;
- * this module only decides *whether* an entry may be resolved and against
- * *which* environment. It is not a service locator: the caller passes the
- * selector (role-to-selector mapping belongs to the host's settings document)
- * and the environment explicitly.
+ * The shared constructor owns endpoint, header and SDK wiring for every
+ * surface it supports; this module decides *whether* an entry may be resolved
+ * and supplies its credential — through the same policy-checked resolver model
+ * discovery uses, so a model that lists is a model that calls with the same
+ * key. It is not a service locator: the caller passes the selector
+ * (role-to-selector mapping belongs to the host's settings document), the
+ * registry and the environment explicitly. Nothing is read from disk here;
+ * a Skaile Workspaces host that resolves against a project's registry uses
+ * `resolveWorkspaceLanguageModel` from `@skaile/forge-settings/workspaces`.
  *
  * Provider SDKs (`@ai-sdk/anthropic`, `@ai-sdk/openai`,
- * `@ai-sdk/openai-compatible`) are optional peers of Workspaces: install the
- * one the selected surface needs.
+ * `@ai-sdk/openai-compatible`) are optional peers: install the one the
+ * selected surface needs.
  */
 
-import { type MergedAIProviderRegistry, parseModelRef } from "@skaile/workspaces/core";
-import { type ResolvedLanguageModel, resolveLanguageModel } from "@skaile/workspaces/ai-sdk";
-import { loadMergedProviderRegistry } from "@skaile/workspaces/sdk/bridge";
+import { type MergedAIProviderRegistry, parseModelRef } from "@skaile/provider-registry";
+import {
+  type EntryCredentialResolver,
+  type ResolvedLanguageModel,
+  resolveLanguageModel,
+} from "@skaile/provider-registry/ai-sdk";
+import { assertEntryAllowed, ModelResolutionError } from "../model/errors";
+import { credentialStoreOptions, selectorProviderId } from "../model/selector";
 import type { CredentialPolicy } from "../server/credential-policy";
-import { ModelResolutionError, assertEntryAllowed } from "../model/errors";
+import { resolveEntryCredential } from "../server/credential-store";
 
-export { ModelResolutionError } from "../model/errors";
 export type { ModelResolutionCode } from "../model/errors";
+export { ModelResolutionError } from "../model/errors";
 export type { ResolvedLanguageModel };
 
 /** Options for {@link resolveRegistryLanguageModel}. */
 export interface ResolveRegistryLanguageModelOptions {
-  /** Workspace whose `.skaile/providers.yml` is the workspace layer. */
-  projectDir: string;
+  /** The one merged registry snapshot the selector resolves against. */
+  registry: MergedAIProviderRegistry;
   /**
    * The environment `env:` credential references are read from. Required, so a
    * host never reads the ambient process by accident.
@@ -40,48 +50,91 @@ export interface ResolveRegistryLanguageModelOptions {
    * before anything is read; a refused one is a `policy_refused` failure.
    */
   policy?: CredentialPolicy;
-  /**
-   * An already merged (e.g. transform-proxy-routed) registry. When set,
-   * `projectDir` is not read for providers, the policy check runs on this
-   * registry, and it is handed to Workspaces as the registry to resolve against.
-   */
-  registry?: MergedAIProviderRegistry;
+  /** Local encrypted store for `keyring:` references; else `FORGE_CREDENTIAL_STORE` of `env`. */
+  path?: string;
+  /** 64-char hex key of the local store; else `FORGE_CREDENTIAL_KEY` of `env`. */
+  key?: string;
+}
+
+/**
+ * The credential resolver discovery and invocation share: the policy refuses
+ * an entry before any reference is read, then the reference resolves from
+ * `env` or the local store. Secret-free errors only.
+ */
+function policyCredentialResolver(
+  options: Pick<ResolveRegistryLanguageModelOptions, "env" | "policy" | "path" | "key">,
+): EntryCredentialResolver {
+  return (entry, providerId) => {
+    assertEntryAllowed(entry, providerId, options.policy);
+    const resolved = resolveEntryCredential(entry, credentialStoreOptions(options.env, options));
+    return resolved.error && !resolved.value
+      ? { error: resolved.error }
+      : { ...(resolved.value !== undefined ? { value: resolved.value } : {}) };
+  };
 }
 
 /**
  * The AI SDK model for `selector` (`<providerId>/<modelId>`, a bare model id or
- * `@role`), resolved by Workspaces against the registry on disk, or the given
- * `registry`.
+ * `@role`), resolved against `options.registry` only.
  *
- * @throws {ModelResolutionError} `registry_invalid` (only when read from disk) ·
- *   `unknown_selector` · `policy_refused` · `unresolved` (credential, endpoint or
- *   provider SDK; the message is fixed and never carries Workspaces' text, which
- *   stays on `cause`).
+ * Strict: a selector naming a provider that is missing from the registry's
+ * enabled `llm` entries (and that no entry maps as a model id), disabled, or an
+ * unassigned `@role` fails — nothing is rerouted to another endpoint and
+ * nothing is sent. A bare model id without `/` resolves as the registry orders it.
+ *
+ * @throws {ModelResolutionError} `unknown_selector` (no enabled entry serves the
+ *   selector, or the named entry is disabled / not an `llm` entry) ·
+ *   `policy_refused` · `unresolved` (credential, endpoint or provider SDK; the
+ *   message is fixed, the underlying error stays on `cause`).
  */
 export async function resolveRegistryLanguageModel(
   selector: string,
   options: ResolveRegistryLanguageModelOptions,
 ): Promise<ResolvedLanguageModel> {
-  const merged = options.registry ?? loadRegistry(options.projectDir);
+  const merged = options.registry;
+
+  const head = selectorProviderId(selector);
+  const named = head === undefined ? undefined : merged.providers[head];
+  if (
+    head !== undefined &&
+    named !== undefined &&
+    (named.kind !== "llm" || named.enabled === false)
+  ) {
+    throw new ModelResolutionError(
+      "unknown_selector",
+      `provider '${head}' is ${named.kind !== "llm" ? "not an llm entry" : "disabled"}`,
+      { providerId: head },
+    );
+  }
 
   const ref = parseModelRef(selector, merged, options.roles);
-  if (!ref) {
+  // `<head>/<model>` that no entry is named by or maps: the general resolver would
+  // hand it to the first entry in registry order, i.e. send it (and that entry's
+  // credential) to an endpoint the caller did not name.
+  if (!ref || (head !== undefined && named === undefined && ref.fallback === true)) {
     throw new ModelResolutionError("unknown_selector", `no provider serves '${selector}'`);
   }
+  if (ref.role !== undefined && !options.roles?.[ref.role]) {
+    throw new ModelResolutionError(
+      "unknown_selector",
+      `role '@${ref.role}' is not assigned to a model`,
+    );
+  }
   const entry = merged.providers[ref.providerId];
   if (entry) assertEntryAllowed(entry, ref.providerId, options.policy);
 
   try {
     return await resolveLanguageModel(selector, {
-      projectDir: options.projectDir,
+      registry: merged,
       env: options.env,
       ...(options.roles ? { roles: options.roles } : {}),
-      ...(options.registry ? { registry: options.registry } : {}),
+      resolveCredential: policyCredentialResolver(options),
     });
   } catch (cause) {
-    // Workspaces' message is not ours to vouch for: it can echo a resolved
-    // credential or an endpoint with a key in its query. The message is fixed;
-    // the original error stays on `cause` for a host that logs it server-side.
+    if (cause instanceof ModelResolutionError) throw cause;
+    // The constructor's message is not ours to vouch for: an SDK error can echo
+    // an endpoint with a key in its query. The message is fixed; the original
+    // error stays on `cause` for a host that logs it server-side.
     throw new ModelResolutionError(
       "unresolved",
       `provider '${ref.providerId}': credential, endpoint or provider SDK could not be resolved`,
@@ -89,15 +142,3 @@ export async function resolveRegistryLanguageModel(
     );
   }
 }
-
-/** The merged registry of `projectDir`; `registry_invalid` on any error diagnostic. */
-function loadRegistry(projectDir: string): MergedAIProviderRegistry {
-  const { merged, diagnostics } = loadMergedProviderRegistry({ projectDir });
-  const errors = diagnostics
-    .filter((d) => d.severity === "error")
-    .map((d) => (d.path ? `${d.path}: ${d.message}` : d.message));
-  if (errors.length > 0) {
-    throw new ModelResolutionError("registry_invalid", `providers registry: ${errors.join("; ")}`);
-  }
-  return merged;
-}

package/src/runtime/components/ForgeProvidersPanel.vue

@@ -709,7 +709,7 @@
 
 <script setup lang="ts">
 import { computed } from "vue";
-import type { DataZoneRule } from "../shared/provider-registry";
+import type { AIProviderDataZoneRule } from "../shared/provider-registry";
 import type { ProvidersPanelClient } from "../vue/providers-client";
 import {
   AZURE_ACCOUNT,
@@ -754,7 +754,7 @@ const props = withDefaults(
      * The host's data-zone rule: rows outside it show a muted note naming the
      * rule (`provider-blocked-<id>`). Absent or `any`: none.
      */
-    dataZoneRule?: DataZoneRule;
+    dataZoneRule?: AIProviderDataZoneRule;
   }>(),
   // Without a default Vue casts an absent boolean to `false`; the panel tells absent from `false`.
   { environmentEnabled: undefined, note: undefined, expert: false },