@skaile/workspaces 3.27.0 → 4.0.0

package/dist/bridge/src/provider-materialize/continue-config-yaml.d.ts

@@ -0,0 +1,117 @@
+/**
+ * Continue's `config.yaml` adapter — the file half of the Continue row (§2.3).
+ *
+ * `cn` has no model flag. Its assistant is a document, and the document binds
+ * models to **roles** (`chat`, `edit`, `apply`, `autocomplete`, `embed`,
+ * `rerank`, `summarize`); a headless `cn -p` turn runs as `chat`. So unlike
+ * OpenCode and Goose, Continue needs a file for *every* endpoint, stock or
+ * custom — it has no built-in provider table keyed by vendor names to fall
+ * back on:
+ *
+ * ```yaml
+ * name: Skaile session
+ * version: 0.0.1
+ * schema: v1
+ * models:
+ *   - name: corp-gateway/corp-fast-1
+ *     provider: openai
+ *     model: corp-fast-1
+ *     apiBase: https://llm.corp.example/v1
+ *     apiKey: ${{ secrets.SKAILE_AIP_CORP_GATEWAY_KEY }}
+ *     roles:
+ *       - chat
+ * ```
+ *
+ * `provider` is Continue's *adapter class*, not an endpoint name — the
+ * endpoint is `apiBase`. The row's `name` carries the identity instead, and it
+ * is `backendProviderName`/`backendModelSelector` verbatim, so a model reads
+ * the same here as in every other adapter.
+ *
+ * **Credentials never enter the file.** `apiKey` holds Continue's own
+ * `${{ secrets.NAME }}` indirection; the CLI resolves a secret from the
+ * process environment before it asks Continue Hub, so `SKAILE_AIP_<ID>_KEY`
+ * in the child env is what authenticates the request.
+ *
+ * **Roles.** The session's `roles` table is the source: every entry whose key
+ * is one of Continue's roles becomes that role's binding (`default` is read as
+ * `chat`, matching how the rest of the programme spells the fallback), and the
+ * session's own model selection wins `chat` when it named one.
+ *
+ * @see https://docs.continue.dev/reference
+ * @docLink packages/bridge/drivers#one-shot-cli-drivers-gemini-qwen-opencode-goose-continue
+ */
+import { type AIProviderLlmEntry } from "@skaile/workspaces/core/provider-registry";
+import { type EnvDriverSession } from "./env-drivers.js";
+/** Filename Continue reads its local assistant from, under the global dir. */
+export declare const CONTINUE_CONFIG_FILENAME = "config.yaml";
+/** One `models[]` row. */
+export interface ContinueModelRow {
+    /** `<backendProviderName>/<providerModelId>` — the programme-wide model id. */
+    name: string;
+    /** Continue adapter class: `openai`, `anthropic`, `gemini`. */
+    provider: string;
+    /** Provider-side model id. */
+    model: string;
+    apiBase?: string;
+    /** Continue's `${{ secrets.NAME }}` indirection — never a secret. */
+    apiKey?: string;
+    roles: string[];
+    requestOptions?: {
+        headers: Record<string, string>;
+    };
+}
+/** The `config.yaml` document this adapter owns. */
+export interface ContinueConfigDocument {
+    name: string;
+    version: string;
+    schema: string;
+    models: ContinueModelRow[];
+}
+/** Result of {@link buildContinueConfigDocument}. */
+export interface ContinueConfigBuild {
+    document: ContinueConfigDocument;
+    /** Role bindings that resolved to nothing Continue can run. */
+    warnings: string[];
+}
+/**
+ * Render one entry + model as a `models[]` row, or explain why Continue cannot
+ * run it.
+ */
+export declare function renderContinueModel(providerId: string, entry: AIProviderLlmEntry, model: string, roles: string[]): {
+    row: ContinueModelRow;
+} | {
+    skipped: string;
+};
+/**
+ * Build the document for a session: one `models[]` row per distinct endpoint +
+ * model a role binds, with every role that binds it.
+ *
+ * Only bound models are rendered. Continue defaults an omitted `roles` to
+ * `[chat, edit, apply, summarize]`, so listing the registry's other models
+ * would silently make each of them a chat candidate — the document says
+ * exactly what the session decided and nothing else.
+ *
+ * An empty registry renders nothing — `cn` then runs on whatever its own
+ * `config.yaml` or Hub login provides.
+ */
+export declare function buildContinueConfigDocument(session: EnvDriverSession): ContinueConfigBuild;
+/** What {@link materializeContinueConfig} handed the driver. */
+export interface ContinueMaterialization extends ContinueConfigBuild {
+    /** Child env fragment: `CONTINUE_GLOBAL_DIR`, or empty when nothing was written. */
+    env: Record<string, string>;
+    /** Absolute path of the rendered file, when one was written. */
+    path?: string;
+}
+/**
+ * Render the session's role bindings and point the child at them.
+ *
+ * A session that bound no model writes nothing and leaves
+ * `CONTINUE_GLOBAL_DIR` alone, so `cn` keeps resolving its Hub assistant (or
+ * the developer's own `~/.continue/config.yaml`) exactly as before. A file
+ * left by an earlier render of the same session is removed in that case.
+ */
+export declare function materializeContinueConfig(session: EnvDriverSession, config: {
+    cwd: string;
+    sessionId?: string;
+}): ContinueMaterialization;
+//# sourceMappingURL=continue-config-yaml.d.ts.map

package/dist/bridge/src/provider-materialize/continue-config-yaml.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"continue-config-yaml.d.ts","sourceRoot":"","sources":["../../../../bridge/src/provider-materialize/continue-config-yaml.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,OAAO,EACL,KAAK,kBAAkB,EAGxB,MAAM,2CAA2C,CAAC;AAGnD,OAAO,EAKL,KAAK,gBAAgB,EAEtB,MAAM,kBAAkB,CAAC;AAqC1B,8EAA8E;AAC9E,eAAO,MAAM,wBAAwB,gBAAgB,CAAC;AAEtD,0BAA0B;AAC1B,MAAM,WAAW,gBAAgB;IAC/B,+EAA+E;IAC/E,IAAI,EAAE,MAAM,CAAC;IACb,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,CAAC;IACjB,8BAA8B;IAC9B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,cAAc,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,CAAC;CACtD;AAED,oDAAoD;AACpD,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,gBAAgB,EAAE,CAAC;CAC5B;AAED,qDAAqD;AACrD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,sBAAsB,CAAC;IACjC,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AASD;;;GAGG;AACH,wBAAgB,mBAAmB,CACjC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,kBAAkB,EACzB,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,EAAE,GACd;IAAE,GAAG,EAAE,gBAAgB,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CAwBjD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,gBAAgB,GAAG,mBAAmB,CA+D1F;AAED,gEAAgE;AAChE,MAAM,WAAW,uBAAwB,SAAQ,mBAAmB;IAClE,oFAAoF;IACpF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1C,uBAAuB,CAazB"}

package/dist/bridge/src/provider-materialize/credential-env.d.ts

@@ -0,0 +1,103 @@
+/**
+ * Credential delivery for driver adapters — the one naming rule (§2.3).
+ *
+ * Every adapter that hands a registry entry's secret to a child process, and
+ * every renderer that has to *name* that secret in a config file it writes
+ * (omp's `models.yml` `apiKey:`, Codex's `env_key`, OpenCode's `{env:…}`),
+ * agrees on one env-var name per entry: `SKAILE_AIP_<UPPER_ID>_KEY`. The name
+ * goes in the file, the value goes in the child environment — a rendered
+ * config never contains a secret.
+ *
+ * The platform's secret-env allowlist is a prefix rule on exactly that name,
+ * and forge-common delivers the same names when it spawns `skaile serve`, so
+ * the transform below is a cross-repo contract: uppercase, every character
+ * outside `[A-Za-z0-9]` mapped to `_` (registry ids are `[a-z0-9][a-z0-9_-]*`,
+ * so in practice only `-`).
+ *
+ * Alongside the canonical name, {@link registryCredentialEnv} also sets the
+ * *conventional* carrier a CLI already reads (`ANTHROPIC_API_KEY`,
+ * `GEMINI_API_KEY`, `GROQ_API_KEY`, …) so a catalog-preset entry works in a
+ * backend that has no per-endpoint config file yet.
+ *
+ * @see PROVIDER-CONFIG-PLAN.md §1.4, §2.3
+ */
+import { type AIProviderEntry, type AIProviderRegistry, type MergedAIProviderRegistry } from "@skaile/workspaces/core/provider-registry";
+/** Options shared by every registry-shaped credential resolution. */
+export interface RegistryCredentialOptions {
+    /** Restrict resolution to one entry — the provider half of a `modelRef`. */
+    providerId?: string;
+    /** Environment `env:` refs resolve against. Defaults to `process.env`. */
+    env?: Record<string, string | undefined>;
+    /** Control-plane secrets keyed by config id, for `platform:` refs. */
+    secrets?: Record<string, string>;
+    /** Run `cmd:` references. Default `true`. */
+    allowCommand?: boolean;
+}
+/** Prefix of the canonical per-entry credential variable. */
+export declare const PROVIDER_CREDENTIAL_ENV_PREFIX = "SKAILE_AIP_";
+/** Suffix of the canonical per-entry credential variable. */
+export declare const PROVIDER_CREDENTIAL_ENV_SUFFIX = "_KEY";
+/**
+ * The env-var name that carries a registry entry's credential:
+ * `anthropic` → `SKAILE_AIP_ANTHROPIC_KEY`, `my-gw.eu` → `SKAILE_AIP_MY_GW_EU_KEY`.
+ *
+ * Pure: no environment, no registry, no I/O. Renderers call it per entry while
+ * emitting a config file, adapters call it while assembling a child env, and
+ * the platform allowlist matches the prefix.
+ */
+export declare function providerCredentialEnvName(providerId: string): string;
+/**
+ * The env var a backend already looks for on its own, when the entry names one.
+ *
+ * The catalog preset's conventional carrier wins (`GEMINI_API_KEY` for
+ * `google`), because that is the name the vendor's own CLI reads; otherwise an
+ * `env:NAME` credential reference is taken at face value — the operator named
+ * that variable, so the child gets it under the same name. `cmd:`, `platform:`
+ * and `keyring:` refs have no conventional carrier and return `undefined`.
+ */
+export declare function conventionalCredentialEnvName(entry: AIProviderEntry): string | undefined;
+/**
+ * Resolve one entry's credential to its value, or `undefined` when there is
+ * none to hand over (`kind: none`, an ambient `sigv4`/`google_adc` chain, an
+ * unset variable, a reserved `keyring:` ref).
+ */
+export declare function resolveEntryCredential(entry: AIProviderEntry, options?: RegistryCredentialOptions): string | undefined;
+/**
+ * One entry's credential value, including the one the session boundary
+ * already resolved for it.
+ *
+ * A `platform:<configId>` reference is resolved by the runner — it holds the
+ * `session_init` secrets map, the driver does not — and materialized into the
+ * child environment under {@link providerCredentialEnvName}. So when the
+ * reference itself yields nothing, that carrier is consulted: it is the same
+ * secret, delivered one step earlier.
+ */
+export declare function entryCredentialValue(providerId: string, entry: AIProviderEntry, options?: RegistryCredentialOptions): string | undefined;
+/** Options for {@link entryCredentialEnv} / {@link registryCredentialEnv}. */
+export interface RegistryCredentialEnvOptions extends RegistryCredentialOptions {
+    /**
+     * Also set the backend-conventional carrier
+     * ({@link conventionalCredentialEnvName}). Default `true`. Set `false` for a
+     * backend that reads every endpoint out of a rendered config file and must
+     * not inherit a vendor default from a neighbouring entry.
+     */
+    aliases?: boolean;
+}
+/**
+ * The credential variables one entry contributes: always
+ * `SKAILE_AIP_<ID>_KEY`, plus the conventional carrier unless `aliases` is
+ * `false`. Empty when the entry has no resolvable secret.
+ */
+export declare function entryCredentialEnv(providerId: string, entry: AIProviderEntry, options?: RegistryCredentialEnvOptions): Record<string, string>;
+/**
+ * Every enabled entry's credential, as a child-process environment fragment.
+ *
+ * One canonical `SKAILE_AIP_<ID>_KEY` per entry whose credential resolves; the
+ * conventional carriers are added underneath, first entry in registry order
+ * winning a collision (registry order is highest-precedence layer first, so
+ * the alias follows the same precedence the selector does). Entries whose
+ * credential cannot be resolved contribute nothing — exactly what the flat
+ * `apiKeys` cascade produced for them.
+ */
+export declare function registryCredentialEnv(registry: AIProviderRegistry | MergedAIProviderRegistry, options?: RegistryCredentialEnvOptions): Record<string, string>;
+//# sourceMappingURL=credential-env.d.ts.map

package/dist/bridge/src/provider-materialize/credential-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-env.d.ts","sourceRoot":"","sources":["../../../../bridge/src/provider-materialize/credential-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,OAAO,EACL,KAAK,eAAe,EACpB,KAAK,kBAAkB,EAEvB,KAAK,wBAAwB,EAG9B,MAAM,2CAA2C,CAAC;AAInD,qEAAqE;AACrE,MAAM,WAAW,yBAAyB;IACxC,4EAA4E;IAC5E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0EAA0E;IAC1E,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,sEAAsE;IACtE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,6CAA6C;IAC7C,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,6DAA6D;AAC7D,eAAO,MAAM,8BAA8B,gBAAgB,CAAC;AAE5D,6DAA6D;AAC7D,eAAO,MAAM,8BAA8B,SAAS,CAAC;AAErD;;;;;;;GAOG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAGpE;AAED;;;;;;;;GAQG;AACH,wBAAgB,6BAA6B,CAAC,KAAK,EAAE,eAAe,GAAG,MAAM,GAAG,SAAS,CAKxF;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,eAAe,EACtB,OAAO,GAAE,yBAA8B,GACtC,MAAM,GAAG,SAAS,CAMpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,eAAe,EACtB,OAAO,GAAE,yBAA8B,GACtC,MAAM,GAAG,SAAS,CAIpB;AAED,8EAA8E;AAC9E,MAAM,WAAW,4BAA6B,SAAQ,yBAAyB;IAC7E;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,eAAe,EACtB,OAAO,GAAE,4BAAiC,GACzC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASxB;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,kBAAkB,GAAG,wBAAwB,EACvD,OAAO,GAAE,4BAAiC,GACzC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAcxB"}

package/dist/bridge/src/provider-materialize/env-drivers.d.ts

@@ -0,0 +1,209 @@
+/**
+ * Registry adapter for the **env-shaped CLI drivers** — Gemini, Qwen, OpenCode,
+ * Goose and Continue (§2.3).
+ *
+ * These backends take their endpoint from the environment rather than from a
+ * config file, so the adapter's job is three things: resolve which registry
+ * entry the session's model selector names, refuse at start when that entry
+ * speaks a wire surface the backend cannot, and hand the driver the
+ * provider-side model id it must put on the command line.
+ *
+ * Two pluralities meet here (`BUILTIN_DRIVER_CATALOG.providerPlurality`):
+ *
+ * - `single` — Gemini and Qwen address exactly one endpoint. The bound entry
+ *   supplies the credential *and* the base URL, and a surface mismatch is
+ *   fatal: a Gemini CLI pointed at an `openai-completions` endpoint cannot
+ *   work, and failing at start names the surface instead of leaving the user
+ *   with an opaque error mid-turn.
+ * - `credentials-n` — OpenCode, Goose and Continue accept every enabled
+ *   entry's credential at once and select one active model. The credential
+ *   fan-out is `registryCredentialEnv`; the active model is this module's
+ *   `<provider>/<model>` binding.
+ *
+ * Writing the per-endpoint config files those three need for *custom*
+ * endpoints (`opencode.json`, Goose `custom_providers/*.json`, Continue
+ * `config.yaml`) is the file half, and is deliberately not here.
+ *
+ * @see PROVIDER-CONFIG-PLAN.md §2.3
+ */
+import { type AIProviderLlmEntry, type AIProviderSurface, type MergedAIProviderRegistry } from "@skaile/workspaces/core/provider-registry";
+import type { ModelEntry } from "../models.js";
+import type { AgentConfig } from "../types.js";
+/**
+ * Everything a CLI driver needs to know about this session's AI providers,
+ * resolved once from its {@link AgentConfig}.
+ */
+export interface EnvDriverSession {
+    /** The merged registry this session may address. Empty when none was configured. */
+    registry: MergedAIProviderRegistry;
+    /**
+     * Environment `credential.ref` lookups resolve against — the process
+     * environment widened with `config.env`, which is where the session
+     * boundary delivered every resolved `SKAILE_AIP_<ID>_KEY`.
+     */
+    lookupEnv: Record<string, string | undefined>;
+    /** Model selector: `<providerId>/<modelId>`, a bare id, or `@role`. */
+    modelRef?: string;
+    /** Roles table an `@role` selector resolves through. */
+    roles?: Record<string, string>;
+}
+/**
+ * Resolve the session's providers once, from its {@link AgentConfig}.
+ *
+ * `config.env` is folded into `lookupEnv` rather than kept apart: it is part
+ * of the session's environment, not an extra, and a credential or
+ * `*_BASE_URL` delivered there must be visible exactly as the child will see
+ * it.
+ */
+export declare function resolveEnvDriverSession(config: AgentConfig, processEnv?: Record<string, string | undefined>): EnvDriverSession;
+/** One resolved endpoint + model — everything a driver needs to spawn. */
+export interface RegistryModelBinding {
+    /** Registry id of the selected entry. */
+    providerId: string;
+    /** The selected entry itself. */
+    entry: AIProviderLlmEntry;
+    /** Logical model id, after `@role` expansion and before `model_map`. */
+    modelId?: string;
+    /** Provider-side model id — what goes on the wire / command line. */
+    providerModelId?: string;
+    /** Wire protocol, from the entry or its preset. */
+    surface?: AIProviderSurface;
+    /** Resolved endpoint, from the entry, its transport params, or its preset. */
+    baseUrl?: string;
+    /**
+     * The provider name the *backend* knows this endpoint by — a catalog preset
+     * id for a stock endpoint, the registry id for anything custom. See
+     * {@link backendProviderName}.
+     */
+    backendProviderId: string;
+    /** Non-fatal notes from `parseModelRef` (dangling role, disabled provider). */
+    warnings: string[];
+}
+/** The entry's wire surface: its own, else its preset's. */
+export declare function entrySurface(entry: AIProviderLlmEntry): AIProviderSurface | undefined;
+/**
+ * The entry's endpoint: its literal or transport-derived URL, else its
+ * preset's literal. Transport templates that still carry `{param}`
+ * placeholders never come back — `resolveEntryBaseUrl` withholds those, and a
+ * preset's template is not a URL.
+ */
+export declare function entryBaseUrl(entry: AIProviderLlmEntry): string | undefined;
+/**
+ * True when a `credentials-n` backend already knows this endpoint under its
+ * own catalog name — the entry names a preset and did not move it somewhere
+ * else.
+ *
+ * The one rule both halves of §2.3 read: it decides the name the env half
+ * puts on the command line ({@link backendProviderName}) *and* whether the
+ * file half has to describe the endpoint at all. Reading it twice is what
+ * keeps `-m <name>/<model>` and the generated provider file talking about the
+ * same thing.
+ */
+export declare function isStockCatalogEndpoint(entry: AIProviderLlmEntry): boolean;
+/**
+ * The provider name to give a `credentials-n` backend (`-m <name>/<model>`,
+ * `GOOSE_PROVIDER`).
+ *
+ * A stock catalog endpoint is named by its preset, because that is the name
+ * OpenCode's models.dev list and Goose's built-in provider table already use —
+ * `prod-claude: {preset: anthropic}` is still Anthropic to them. An entry with
+ * an endpoint of its own is named by its registry id: no built-in table knows
+ * it, so the id is what its generated provider file is keyed by (the file half
+ * of §2.3).
+ */
+export declare function backendProviderName(providerId: string, entry: AIProviderLlmEntry): string;
+/**
+ * Enabled `llm`/`embed` entries, in registry order. Also the set the file
+ * adapters render (`opencode-config.ts`, `goose-custom-providers.ts`,
+ * `continue-config-yaml.ts`): the env half and the file half must agree on
+ * which entries exist before they can agree on what to call them.
+ */
+export declare function selectableEntries(registry: MergedAIProviderRegistry): Array<[string, AIProviderLlmEntry]>;
+/**
+ * The provider-side model ids an entry declares, as `[logicalId, providerId]`
+ * pairs in declaration order: every `model_map` entry, plus every
+ * `capabilities` key the map does not rename.
+ */
+export declare function entryModelIds(entry: AIProviderLlmEntry): Array<[string, string]>;
+/**
+ * Resolve the session's endpoint + model.
+ *
+ * With no selector the first entry in registry order wins and the backend
+ * keeps its own default model — exactly what an absent `model` meant before
+ * the registry existed. Returns `undefined` when no entry can serve a model
+ * (an empty, fully-disabled or voice-only registry).
+ */
+export declare function resolveRegistryBinding(session: EnvDriverSession): RegistryModelBinding | undefined;
+/**
+ * Every credential a `credentials-n` backend may use: one variable per
+ * enabled registry entry. OpenCode, Goose and Continue have always received
+ * *all* of them, not just the selected endpoint's, because they route across
+ * providers inside a single session.
+ */
+export declare function credentialsForEveryProvider(session: EnvDriverSession): Record<string, string>;
+/**
+ * Throw when the bound entry speaks a wire surface this driver cannot.
+ *
+ * The message names the offending surface and lists the ones the backend does
+ * speak (`BUILTIN_DRIVER_CATALOG[driverId].surfaces`). An entry that declares
+ * no surface and names no preset is not judged — there is nothing to compare.
+ */
+export declare function assertDriverSpeaksSurface(driverId: string, productName: string, binding: RegistryModelBinding): void;
+/**
+ * The models a `credentials-n` backend can be pointed at, straight from the
+ * registry: every enabled entry's mapped ids, namespaced the way the backend
+ * takes them (`-m <provider>/<model>`).
+ *
+ * These backends have no model-list endpoint of their own — OpenCode reads
+ * models.dev, Goose and Continue read their config — so the registry is the
+ * only list that describes *this* session's reachable models, and it needs no
+ * network call to produce.
+ */
+export declare function registryModelEntries(session: EnvDriverSession): ModelEntry[];
+/**
+ * Resolve the binding and enforce the surface — what a `single`-plurality
+ * driver does at start.
+ *
+ * The registry is authoritative: pointing the driver at an entry it cannot
+ * speak throws rather than silently running somewhere else. `undefined` when
+ * the session configured no endpoint at all, which leaves the driver on its
+ * own native auth.
+ */
+export declare function bindSingleProviderEntry(driverId: string, productName: string, session: EnvDriverSession): RegistryModelBinding | undefined;
+/**
+ * The `<provider>/<model>` selector a `credentials-n` backend takes on its
+ * command line (`opencode -m`). `undefined` when no model was selected — the
+ * backend then uses its own default rather than being handed a bare provider.
+ */
+export declare function backendModelSelector(binding: RegistryModelBinding): string | undefined;
+/**
+ * Continue's model selection is a **role binding**, not a flag: `cn` has no
+ * `--model` option (only `--config <slug>`), and its `config.yaml` binds each
+ * model to roles (`chat`, `edit`, `apply`, …). This is the binding for the
+ * role a headless `cn -p` turn runs as, and the shape its generated
+ * `config.yaml` is rendered from.
+ *
+ * `apiKeyEnv` is a variable *name*: the secret travels in the child
+ * environment, never in a rendered config.
+ */
+export interface ContinueRoleBinding {
+    /** Continue role this model serves. A headless prompt is a `chat` turn. */
+    role: "chat";
+    /** Registry id of the entry. */
+    providerId: string;
+    /** Provider name Continue knows the endpoint by. */
+    provider: string;
+    /** Provider-side model id. */
+    model?: string;
+    /** Endpoint, when the entry states one. */
+    apiBase?: string;
+    /** Env var holding the credential — the name, never the value. */
+    apiKeyEnv: string;
+}
+/**
+ * Map the session's chosen endpoint onto the Continue role a headless turn
+ * runs as. `undefined` when the session configured no endpoint — `cn` then
+ * runs against whatever its own `config.yaml` / Hub login provides.
+ */
+export declare function continueRoleBinding(session: EnvDriverSession): ContinueRoleBinding | undefined;
+//# sourceMappingURL=env-drivers.d.ts.map

package/dist/bridge/src/provider-materialize/env-drivers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"env-drivers.d.ts","sourceRoot":"","sources":["../../../../bridge/src/provider-materialize/env-drivers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EACL,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EAEtB,KAAK,wBAAwB,EAK9B,MAAM,2CAA2C,CAAC;AACnD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAG/C;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,oFAAoF;IACpF,QAAQ,EAAE,wBAAwB,CAAC;IACnC;;;;OAIG;IACH,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IAC9C,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,wDAAwD;IACxD,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;;;;;;GAOG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,WAAW,EACnB,UAAU,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAC3D,gBAAgB,CAOlB;AAED,0EAA0E;AAC1E,MAAM,WAAW,oBAAoB;IACnC,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAC;IACnB,iCAAiC;IACjC,KAAK,EAAE,kBAAkB,CAAC;IAC1B,wEAAwE;IACxE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,mDAAmD;IACnD,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;OAIG;IACH,iBAAiB,EAAE,MAAM,CAAC;IAC1B,+EAA+E;IAC/E,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,4DAA4D;AAC5D,wBAAgB,YAAY,CAAC,KAAK,EAAE,kBAAkB,GAAG,iBAAiB,GAAG,SAAS,CAGrF;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,kBAAkB,GAAG,MAAM,GAAG,SAAS,CAI1E;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAGzE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,kBAAkB,GAAG,MAAM,CAIzF;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,QAAQ,EAAE,wBAAwB,GACjC,KAAK,CAAC,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAKrC;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,kBAAkB,GAAG,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAMhF;AAuBD;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,CACpC,OAAO,EAAE,gBAAgB,GACxB,oBAAoB,GAAG,SAAS,CA2BlC;AAED;;;;;GAKG;AACH,wBAAgB,2BAA2B,CAAC,OAAO,EAAE,gBAAgB,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAE7F;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CACvC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,oBAAoB,GAC5B,IAAI,CAWN;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,gBAAgB,GAAG,UAAU,EAAE,CAc5E;AAED;;;;;;;;GAQG;AACH,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,MAAM,EAChB,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,gBAAgB,GACxB,oBAAoB,GAAG,SAAS,CAKlC;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,oBAAoB,GAAG,MAAM,GAAG,SAAS,CAGtF;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,gCAAgC;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,oDAAoD;IACpD,QAAQ,EAAE,MAAM,CAAC;IACjB,8BAA8B;IAC9B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,2CAA2C;IAC3C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,kEAAkE;IAClE,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,gBAAgB,GAAG,mBAAmB,GAAG,SAAS,CAW9F"}

package/dist/bridge/src/provider-materialize/goose-custom-providers.d.ts

@@ -0,0 +1,127 @@
+/**
+ * Goose's `custom_providers/*.json` adapter — the file half of the Goose row
+ * (§2.3).
+ *
+ * `GOOSE_PROVIDER` can only name a provider Goose already has: one of its
+ * built-in Rust providers, or one of the JSON *declarative* providers it loads
+ * from `<config dir>/custom_providers/`. An endpoint of the session's own is
+ * therefore a file — one per entry, named after the entry, in Goose's own
+ * vocabulary:
+ *
+ * ```json
+ * {
+ *   "name": "corp-gateway",
+ *   "engine": "openai",
+ *   "display_name": "Corp Gateway",
+ *   "api_key_env": "SKAILE_AIP_CORP_GATEWAY_KEY",
+ *   "base_url": "https://llm.corp.example/v1",
+ *   "models": [{ "name": "corp-fast-1" }],
+ *   "requires_auth": true
+ * }
+ * ```
+ *
+ * `name` is {@link backendProviderName}, so the id in the file is the one the
+ * env half already puts in `GOOSE_PROVIDER`. `api_key_env` is a variable
+ * *name*: Goose resolves it from the child environment (its config layer reads
+ * the process environment first), so no secret is ever written.
+ *
+ * **Engines.** A declarative provider is one of three engines — `openai`,
+ * `anthropic`, `ollama` — each a request shape, not a vendor. Only the two
+ * surfaces that map onto one are rendered; `google-generative-ai` and
+ * `bedrock-converse-stream` are built-in Goose providers with no declarative
+ * spelling, so an entry on those surfaces is reported instead of guessed at.
+ *
+ * **Config home.** Goose resolves its config, data and state directories from
+ * one variable, `GOOSE_PATH_ROOT`, so a session that renders anything moves
+ * the whole tree and never touches the developer's own — neither reading it
+ * nor writing to it.
+ *
+ * @see https://block.github.io/goose/docs/guides/custom-providers
+ * @docLink packages/bridge/drivers#one-shot-cli-drivers-gemini-qwen-opencode-goose-continue
+ */
+import type { AIProviderLlmEntry } from "@skaile/workspaces/core/provider-registry";
+import { type EnvDriverSession } from "./env-drivers.js";
+/** Directory, relative to `GOOSE_PATH_ROOT`, Goose reads its config from. */
+export declare const GOOSE_CONFIG_DIRNAME = "config";
+/** Directory, relative to the config dir, declarative providers are loaded from. */
+export declare const GOOSE_CUSTOM_PROVIDERS_DIRNAME = "custom_providers";
+/** One entry of a declarative provider's `models[]`. */
+export interface GooseModelEntry {
+    name: string;
+    context_limit?: number;
+}
+/** One `custom_providers/<id>.json` document. */
+export interface GooseCustomProvider {
+    /** Provider id — what `GOOSE_PROVIDER` names. Must equal the file stem. */
+    name: string;
+    engine: string;
+    display_name: string;
+    /** Name of the variable carrying the credential — never the credential. */
+    api_key_env?: string;
+    base_url: string;
+    models: GooseModelEntry[];
+    headers?: Record<string, string>;
+    supports_streaming?: boolean;
+    requires_auth: boolean;
+    /**
+     * `false` keeps Goose on the static `models[]` instead of probing
+     * `<base>/v1/models`; only meaningful with a non-empty list.
+     */
+    dynamic_models?: boolean;
+}
+/** An entry Goose cannot be taught, and why. */
+export interface GooseSkippedEntry {
+    id: string;
+    reason: string;
+}
+/** Result of {@link buildGooseCustomProviders}. */
+export interface GooseCustomProvidersBuild {
+    /** Provider id → its document, in registry order. */
+    providers: Record<string, GooseCustomProvider>;
+    skipped: GooseSkippedEntry[];
+}
+/**
+ * Render one entry as a declarative provider, or explain why Goose cannot load
+ * it.
+ */
+export declare function renderGooseCustomProvider(providerId: string, entry: AIProviderLlmEntry): {
+    provider: GooseCustomProvider;
+} | {
+    skipped: string;
+};
+/**
+ * Build one declarative provider per entry Goose cannot name on its own.
+ *
+ * The selected model is appended to its provider's `models[]` when the
+ * registry did not enumerate it, so `GOOSE_MODEL` always names something the
+ * file declares. A provider with a static list gets `dynamic_models: false` —
+ * without it Goose probes `<base>/v1/models` on every run, which a gateway
+ * that serves only completions answers with an error.
+ *
+ * An empty registry renders nothing — Goose's built-in provider table
+ * already covers every stock catalog endpoint.
+ */
+export declare function buildGooseCustomProviders(session: EnvDriverSession): GooseCustomProvidersBuild;
+/** What {@link materializeGooseCustomProviders} handed the driver. */
+export interface GooseMaterialization extends GooseCustomProvidersBuild {
+    /** Child env fragment: `GOOSE_PATH_ROOT`, or empty when nothing was written. */
+    env: Record<string, string>;
+    /** Absolute paths of the rendered provider files. */
+    paths: string[];
+}
+/**
+ * Render the session's custom endpoints and point the child at them.
+ *
+ * A session whose every endpoint is a Goose built-in writes nothing and
+ * leaves `GOOSE_PATH_ROOT` unset, so the developer's own Goose tree keeps
+ * working exactly as before. Once anything *is* rendered the whole tree moves
+ * — config, data and state together, because Goose derives all three from
+ * that one variable — and the session stops inheriting the developer's Goose
+ * settings along with their config directory. That is the price of never
+ * reading or writing it.
+ */
+export declare function materializeGooseCustomProviders(session: EnvDriverSession, config: {
+    cwd: string;
+    sessionId?: string;
+}): GooseMaterialization;
+//# sourceMappingURL=goose-custom-providers.d.ts.map

package/dist/bridge/src/provider-materialize/goose-custom-providers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"goose-custom-providers.d.ts","sourceRoot":"","sources":["../../../../bridge/src/provider-materialize/goose-custom-providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AAGH,OAAO,KAAK,EACV,kBAAkB,EAEnB,MAAM,2CAA2C,CAAC;AAEnD,OAAO,EAIL,KAAK,gBAAgB,EAItB,MAAM,kBAAkB,CAAC;AAwB1B,6EAA6E;AAC7E,eAAO,MAAM,oBAAoB,WAAW,CAAC;AAE7C,oFAAoF;AACpF,eAAO,MAAM,8BAA8B,qBAAqB,CAAC;AAEjE,wDAAwD;AACxD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,iDAAiD;AACjD,MAAM,WAAW,mBAAmB;IAClC,2EAA2E;IAC3E,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,aAAa,EAAE,OAAO,CAAC;IACvB;;;OAGG;IACH,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,gDAAgD;AAChD,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,mDAAmD;AACnD,MAAM,WAAW,yBAAyB;IACxC,qDAAqD;IACrD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAC/C,OAAO,EAAE,iBAAiB,EAAE,CAAC;CAC9B;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,CACvC,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE,kBAAkB,GACxB;IAAE,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,CA2CzD;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,gBAAgB,GAAG,yBAAyB,CA6B9F;AAED,sEAAsE;AACtE,MAAM,WAAW,oBAAqB,SAAQ,yBAAyB;IACrE,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,qDAAqD;IACrD,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,+BAA+B,CAC7C,OAAO,EAAE,gBAAgB,EACzB,MAAM,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1C,oBAAoB,CAmBtB"}