@skaile/workspaces 3.27.1 → 4.0.0

package/dist/chunk-ILG4BXYE.js

@@ -0,0 +1,936 @@
+// core/src/provider-registry.ts
+var AI_PROVIDER_KINDS = ["llm", "stt", "tts", "embed"];
+var AI_PROVIDER_VOICE_KINDS = ["stt", "tts"];
+var AI_PROVIDER_SURFACES = [
+  "anthropic-messages",
+  "openai-completions",
+  "openai-responses",
+  "openai-codex-responses",
+  "azure-openai-responses",
+  "bedrock-converse-stream",
+  "google-generative-ai",
+  "google-vertex"
+];
+var AI_PROVIDER_TRANSPORTS = [
+  "direct",
+  "bedrock",
+  "vertex",
+  "foundry",
+  "azure-openai"
+];
+var AI_PROVIDER_CREDENTIAL_KINDS = [
+  "api_key_header",
+  "bearer",
+  "sigv4",
+  "google_adc",
+  "azure_entra",
+  "oauth",
+  "none",
+  "command"
+];
+var CREDENTIAL_REF_REQUIRED = {
+  api_key_header: true,
+  bearer: true,
+  oauth: true,
+  command: true
+};
+var AI_PROVIDER_DISCOVERY_TYPES = [
+  "openai-models-list",
+  "anthropic-models-list",
+  "google-models-list",
+  "none"
+];
+var AI_PROVIDER_LAYERS = ["catalog", "user", "workspace", "runtime", "session"];
+var SAFE_ID = /^[a-z0-9][a-z0-9_-]*$/;
+var ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+var CREDENTIAL_REF = /^(env|cmd|platform|keyring):([\s\S]+)$/;
+var SECRET_KEY = /(^|[-_])(api[-_]?key|apikey|authorization|auth|token|secret|password|passwd|credential|credentials|cookie)([-_]|$)|^key$/i;
+var SECRET_VALUE_PATTERNS = [
+  /^sk-/i,
+  /^xai-/i,
+  /^gsk_/,
+  /^(ghp|gho|ghu|ghs)_/,
+  /^github_pat_/,
+  /^xox[baprs]-/,
+  /^AIza[0-9A-Za-z_-]{10,}/,
+  /^(Bearer|Token|Basic)\s+\S{8,}$/i,
+  // Long opaque blob: no spaces, no dots, no scheme punctuation.
+  /^[A-Za-z0-9+/_-]{40,}={0,2}$/
+];
+var INTERPOLATION = /\$\{[^}]+\}/;
+var LLM_KEYS = {
+  kind: true,
+  label: true,
+  preset: true,
+  surface: true,
+  transport: true,
+  base_url: true,
+  params: true,
+  headers: true,
+  query_params: true,
+  credential: true,
+  model_map: true,
+  capabilities: true,
+  discovery: true,
+  enabled: true,
+  locked: true
+};
+var VOICE_KEYS = {
+  kind: true,
+  label: true,
+  preset: true,
+  base_url: true,
+  params: true,
+  headers: true,
+  credential: true,
+  enabled: true,
+  locked: true
+};
+var ENTRY_KEYS = { ...LLM_KEYS, ...VOICE_KEYS };
+var LLM_ONLY_KEYS = ["surface", "transport", "model_map", "capabilities", "discovery"];
+var CAPABILITY_KEYS = {
+  context_window: true,
+  tools: true,
+  images: true,
+  thinking_max: true
+};
+var TRANSPORT_PARAMS = {
+  bedrock: { required: ["region"], optional: [] },
+  vertex: { required: ["project", "location"], optional: ["publisher"] },
+  foundry: { required: ["resource"], optional: [] },
+  "azure-openai": { required: ["resource", "deployment", "api_version"], optional: [] }
+};
+var AI_PROVIDER_BASE_URL_TEMPLATES = {
+  bedrock: "https://bedrock-runtime.{region}.amazonaws.com",
+  vertex: "https://{location}-aiplatform.googleapis.com/v1/projects/{project}/locations/{location}/publishers/{publisher}",
+  foundry: "https://{resource}.services.ai.azure.com/anthropic",
+  "azure-openai": "https://{resource}.openai.azure.com/openai"
+};
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isSafeProviderId(id) {
+  return SAFE_ID.test(id);
+}
+function looksLikeLiteralSecret(key, value) {
+  const trimmed = value.trim();
+  if (trimmed === "") return false;
+  if (INTERPOLATION.test(trimmed)) return false;
+  if (CREDENTIAL_REF.test(trimmed)) return false;
+  if (SECRET_KEY.test(key)) return true;
+  return SECRET_VALUE_PATTERNS.some((re) => re.test(trimmed));
+}
+function err(ctx, code, path, message) {
+  ctx.diagnostics.push({ code, severity: "error", message, path });
+}
+function warn(ctx, code, path, message) {
+  ctx.diagnostics.push({ code, severity: "warning", message, path });
+}
+function readStringMap(ctx, raw, path, opts) {
+  if (!isPlainObject(raw)) {
+    err(ctx, "invalid_type", path, `${path} must be a map of string values`);
+    return void 0;
+  }
+  const out = {};
+  let ok = true;
+  for (const [key, value] of Object.entries(raw)) {
+    const keyPath = `${path}.${key}`;
+    if (typeof value !== "string") {
+      err(ctx, "invalid_type", keyPath, `${keyPath} must be a string`);
+      ok = false;
+      continue;
+    }
+    if (opts.secretScan && looksLikeLiteralSecret(key, value)) {
+      err(
+        ctx,
+        "literal_secret",
+        keyPath,
+        `${keyPath} holds a literal secret \u2014 use a reference instead (env:NAME, cmd:<shell>, platform:<configId>, keyring:<service>/<account>) or a \${...} interpolation`
+      );
+      ok = false;
+      continue;
+    }
+    out[key] = value;
+  }
+  return ok ? out : void 0;
+}
+function readCredential(ctx, raw, path) {
+  if (!isPlainObject(raw)) {
+    err(ctx, "invalid_type", path, `${path} must be a map with a 'kind'`);
+    return { ok: false };
+  }
+  let ok = true;
+  for (const key of Object.keys(raw)) {
+    if (key !== "kind" && key !== "ref") {
+      err(ctx, "unknown_key", `${path}.${key}`, `${path}.${key} is not a credential key`);
+      ok = false;
+    }
+  }
+  const kind = raw.kind;
+  if (typeof kind !== "string" || !AI_PROVIDER_CREDENTIAL_KINDS.includes(kind)) {
+    err(
+      ctx,
+      "unknown_credential_kind",
+      `${path}.kind`,
+      `${path}.kind must be one of ${AI_PROVIDER_CREDENTIAL_KINDS.join(", ")}`
+    );
+    return { ok: false };
+  }
+  const credentialKind = kind;
+  const rawRef = raw.ref;
+  let ref;
+  if (rawRef !== void 0) {
+    if (typeof rawRef !== "string") {
+      err(ctx, "invalid_type", `${path}.ref`, `${path}.ref must be a string`);
+      ok = false;
+    } else if (!parseCredentialRef(rawRef)) {
+      err(
+        ctx,
+        "literal_secret",
+        `${path}.ref`,
+        `${path}.ref must be a reference, not a literal secret \u2014 use env:NAME, cmd:<shell>, platform:<configId> or keyring:<service>/<account>`
+      );
+      ok = false;
+    } else {
+      ref = rawRef;
+    }
+  } else if (CREDENTIAL_REF_REQUIRED[credentialKind]) {
+    err(
+      ctx,
+      "missing_credential_ref",
+      `${path}.ref`,
+      `${path}.ref is required for credential kind '${credentialKind}'`
+    );
+    ok = false;
+  }
+  if (!ok) return { ok: false };
+  return {
+    ok: true,
+    value: ref === void 0 ? { kind: credentialKind } : { kind: credentialKind, ref }
+  };
+}
+function readTransportSlice(ctx, transport, params, path, present) {
+  if (transport === void 0 && present.has("transport")) return { slice: {}, ok: false };
+  const explicit = transport !== void 0;
+  const effective = transport ?? "direct";
+  const rejectedParams = params === void 0 && present.has("params");
+  if (effective === "direct") {
+    let ok2 = true;
+    for (const key of Object.keys(params ?? {})) {
+      err(
+        ctx,
+        "unknown_param",
+        `${path}.params.${key}`,
+        `${path}.params.${key} is not valid for transport 'direct' \u2014 it takes no parameters`
+      );
+      ok2 = false;
+    }
+    return { slice: explicit ? { transport: "direct" } : {}, ok: ok2 };
+  }
+  const spec = TRANSPORT_PARAMS[effective];
+  if (params === void 0) {
+    if (!rejectedParams) {
+      err(
+        ctx,
+        "missing_params",
+        `${path}.params`,
+        `${path}.params is required for transport '${effective}' (${spec.required.join(", ")})`
+      );
+    }
+    return { slice: {}, ok: false };
+  }
+  let ok = true;
+  const values = {};
+  for (const [key, value] of Object.entries(params)) {
+    if (!spec.required.includes(key) && !spec.optional.includes(key)) {
+      err(
+        ctx,
+        "unknown_param",
+        `${path}.params.${key}`,
+        `${path}.params.${key} is not valid for transport '${effective}' (accepted: ${[...spec.required, ...spec.optional].join(", ")})`
+      );
+      ok = false;
+      continue;
+    }
+    if (typeof value !== "string") {
+      err(ctx, "invalid_type", `${path}.params.${key}`, `${path}.params.${key} must be a string`);
+      ok = false;
+      continue;
+    }
+    values[key] = value;
+  }
+  for (const key of spec.required) {
+    if (values[key] === void 0) {
+      err(
+        ctx,
+        "missing_param",
+        `${path}.params.${key}`,
+        `${path}.params.${key} is required for transport '${effective}'`
+      );
+      ok = false;
+    }
+  }
+  if (!ok) return { slice: {}, ok: false };
+  switch (effective) {
+    case "bedrock":
+      return { slice: { transport: effective, params: { region: values.region } }, ok: true };
+    case "vertex":
+      return {
+        slice: {
+          transport: effective,
+          params: {
+            project: values.project,
+            location: values.location,
+            ...values.publisher === void 0 ? {} : { publisher: values.publisher }
+          }
+        },
+        ok: true
+      };
+    case "foundry":
+      return { slice: { transport: effective, params: { resource: values.resource } }, ok: true };
+    case "azure-openai":
+      return {
+        slice: {
+          transport: effective,
+          params: {
+            resource: values.resource,
+            deployment: values.deployment,
+            api_version: values.api_version
+          }
+        },
+        ok: true
+      };
+  }
+}
+function readParams(ctx, raw, path) {
+  if (!isPlainObject(raw)) {
+    err(ctx, "invalid_type", path, `${path} must be a map`);
+    return { ok: false };
+  }
+  const out = {};
+  let ok = true;
+  for (const [key, value] of Object.entries(raw)) {
+    if (typeof value !== "string" && typeof value !== "number" && typeof value !== "boolean") {
+      err(
+        ctx,
+        "invalid_type",
+        `${path}.${key}`,
+        `${path}.${key} must be a string, number or boolean`
+      );
+      ok = false;
+      continue;
+    }
+    if (typeof value === "string" && looksLikeLiteralSecret(key, value)) {
+      err(
+        ctx,
+        "literal_secret",
+        `${path}.${key}`,
+        `${path}.${key} holds a literal secret \u2014 put it in credential.ref as a reference`
+      );
+      ok = false;
+      continue;
+    }
+    out[key] = value;
+  }
+  return ok ? { ok: true, value: out } : { ok: false };
+}
+function readBaseUrl(ctx, raw, path) {
+  if (typeof raw !== "string") {
+    err(ctx, "invalid_type", path, `${path} must be a string`);
+    return { ok: false };
+  }
+  let parsed;
+  try {
+    parsed = new URL(raw);
+  } catch {
+    err(ctx, "invalid_base_url", path, `${path} is not a valid URL: ${raw}`);
+    return { ok: false };
+  }
+  if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+    err(
+      ctx,
+      "invalid_base_url",
+      path,
+      `${path} must use http:// or https:// (got ${parsed.protocol}//)`
+    );
+    return { ok: false };
+  }
+  if (parsed.username || parsed.password) {
+    err(
+      ctx,
+      "literal_secret",
+      path,
+      `${path} embeds credentials in the URL \u2014 move them to credential.ref as a reference`
+    );
+    return { ok: false };
+  }
+  return { ok: true, value: raw };
+}
+function readBoolean(ctx, raw, path) {
+  if (typeof raw !== "boolean") {
+    err(ctx, "invalid_type", path, `${path} must be true or false`);
+    return { ok: false };
+  }
+  return { ok: true, value: raw };
+}
+function readEntry(ctx, raw, path) {
+  if (!isPlainObject(raw)) {
+    err(ctx, "invalid_type", path, `${path} must be a map`);
+    return void 0;
+  }
+  const present = new Set(Object.keys(raw));
+  const entry = {};
+  let ok = true;
+  if (raw.kind !== void 0) {
+    if (typeof raw.kind !== "string" || !AI_PROVIDER_KINDS.includes(raw.kind)) {
+      err(
+        ctx,
+        "unknown_kind",
+        `${path}.kind`,
+        `${path}.kind must be one of ${AI_PROVIDER_KINDS.join(", ")}`
+      );
+      ok = false;
+    } else {
+      entry.kind = raw.kind;
+    }
+  }
+  for (const key of present) {
+    if (!ENTRY_KEYS[key]) {
+      err(ctx, "unknown_key", `${path}.${key}`, `${path}.${key} is not a registry key`);
+      ok = false;
+    }
+  }
+  if (raw.label !== void 0) {
+    if (typeof raw.label !== "string") {
+      err(ctx, "invalid_type", `${path}.label`, `${path}.label must be a string`);
+      ok = false;
+    } else {
+      entry.label = raw.label;
+    }
+  }
+  if (raw.preset !== void 0) {
+    if (typeof raw.preset !== "string" || !isSafeProviderId(raw.preset)) {
+      err(
+        ctx,
+        "invalid_preset",
+        `${path}.preset`,
+        `${path}.preset must be a catalog preset id matching [a-z0-9][a-z0-9_-]*`
+      );
+      ok = false;
+    } else {
+      entry.preset = raw.preset;
+    }
+  }
+  if (raw.base_url !== void 0) {
+    const res = readBaseUrl(ctx, raw.base_url, `${path}.base_url`);
+    if (!res.ok) ok = false;
+    else entry.base_url = res.value;
+  }
+  if (raw.headers !== void 0) {
+    const headers = readStringMap(ctx, raw.headers, `${path}.headers`, { secretScan: true });
+    if (!headers) ok = false;
+    else entry.headers = headers;
+  }
+  if (raw.credential !== void 0) {
+    const res = readCredential(ctx, raw.credential, `${path}.credential`);
+    if (!res.ok) ok = false;
+    else entry.credential = res.value;
+  }
+  if (raw.enabled !== void 0) {
+    const res = readBoolean(ctx, raw.enabled, `${path}.enabled`);
+    if (!res.ok) ok = false;
+    else entry.enabled = res.value;
+  }
+  if (raw.locked !== void 0) {
+    const res = readBoolean(ctx, raw.locked, `${path}.locked`);
+    if (!res.ok) ok = false;
+    else entry.locked = res.value;
+  }
+  if (raw.surface !== void 0) {
+    if (typeof raw.surface !== "string" || !AI_PROVIDER_SURFACES.includes(raw.surface)) {
+      err(
+        ctx,
+        "unknown_surface",
+        `${path}.surface`,
+        `${path}.surface must be one of ${AI_PROVIDER_SURFACES.join(", ")}`
+      );
+      ok = false;
+    } else {
+      entry.surface = raw.surface;
+    }
+  }
+  if (raw.transport !== void 0) {
+    if (typeof raw.transport !== "string" || !AI_PROVIDER_TRANSPORTS.includes(raw.transport)) {
+      err(
+        ctx,
+        "unknown_transport",
+        `${path}.transport`,
+        `${path}.transport must be one of ${AI_PROVIDER_TRANSPORTS.join(", ")}`
+      );
+      ok = false;
+    } else {
+      entry.transport = raw.transport;
+    }
+  }
+  if (raw.params !== void 0) {
+    const res = readParams(ctx, raw.params, `${path}.params`);
+    if (!res.ok) ok = false;
+    else entry.params = res.value;
+  }
+  if (raw.query_params !== void 0) {
+    const qp = readStringMap(ctx, raw.query_params, `${path}.query_params`, { secretScan: true });
+    if (!qp) ok = false;
+    else entry.query_params = qp;
+  }
+  if (raw.model_map !== void 0) {
+    const map = readStringMap(ctx, raw.model_map, `${path}.model_map`, { secretScan: false });
+    if (!map) ok = false;
+    else entry.model_map = map;
+  }
+  if (raw.capabilities !== void 0) {
+    if (!isPlainObject(raw.capabilities)) {
+      err(ctx, "invalid_type", `${path}.capabilities`, `${path}.capabilities must be a map`);
+      ok = false;
+    } else {
+      const caps = {};
+      for (const [modelId, value] of Object.entries(raw.capabilities)) {
+        const capPath = `${path}.capabilities.${modelId}`;
+        if (!isPlainObject(value)) {
+          err(ctx, "invalid_type", capPath, `${capPath} must be a map`);
+          ok = false;
+          continue;
+        }
+        const cap = {};
+        for (const [capKey, capValue] of Object.entries(value)) {
+          if (!CAPABILITY_KEYS[capKey]) {
+            err(
+              ctx,
+              "unknown_key",
+              `${capPath}.${capKey}`,
+              `${capPath}.${capKey} is not a capability (${Object.keys(CAPABILITY_KEYS).join(", ")})`
+            );
+            ok = false;
+            continue;
+          }
+          const expected = capKey === "tools" || capKey === "images" ? "boolean" : "number";
+          if (typeof capValue !== expected) {
+            err(
+              ctx,
+              "invalid_type",
+              `${capPath}.${capKey}`,
+              `${capPath}.${capKey} must be a ${expected}`
+            );
+            ok = false;
+            continue;
+          }
+          cap[capKey] = capValue;
+        }
+        caps[modelId] = cap;
+      }
+      entry.capabilities = caps;
+    }
+  }
+  if (raw.discovery !== void 0) {
+    if (!isPlainObject(raw.discovery)) {
+      err(ctx, "invalid_type", `${path}.discovery`, `${path}.discovery must be a map`);
+      ok = false;
+    } else {
+      const type = raw.discovery.type;
+      if (typeof type !== "string") {
+        err(
+          ctx,
+          "invalid_type",
+          `${path}.discovery.type`,
+          `${path}.discovery.type must be a string`
+        );
+        ok = false;
+      } else {
+        if (!AI_PROVIDER_DISCOVERY_TYPES.includes(type)) {
+          warn(
+            ctx,
+            "unknown_discovery_type",
+            `${path}.discovery.type`,
+            `${path}.discovery.type '${type}' is not a known probe (${AI_PROVIDER_DISCOVERY_TYPES.join(", ")}) \u2014 it is kept verbatim`
+          );
+        }
+        const discovery = { type };
+        const discPath = raw.discovery.path;
+        if (discPath !== void 0) {
+          if (typeof discPath !== "string") {
+            err(
+              ctx,
+              "invalid_type",
+              `${path}.discovery.path`,
+              `${path}.discovery.path must be a string`
+            );
+            ok = false;
+          } else {
+            discovery.path = discPath;
+          }
+        }
+        for (const key of Object.keys(raw.discovery)) {
+          if (key !== "type" && key !== "path") {
+            err(
+              ctx,
+              "unknown_key",
+              `${path}.discovery.${key}`,
+              `${path}.discovery.${key} is not a discovery key`
+            );
+            ok = false;
+          }
+        }
+        entry.discovery = discovery;
+      }
+    }
+  }
+  return ok ? { entry, present } : void 0;
+}
+function entryCommon(patch) {
+  const common = {};
+  if (patch.label !== void 0) common.label = patch.label;
+  if (patch.preset !== void 0) common.preset = patch.preset;
+  if (patch.base_url !== void 0) common.base_url = patch.base_url;
+  if (patch.headers !== void 0) common.headers = patch.headers;
+  if (patch.credential !== void 0) common.credential = patch.credential;
+  if (patch.enabled !== void 0) common.enabled = patch.enabled;
+  if (patch.locked !== void 0) common.locked = patch.locked;
+  return common;
+}
+function checkEntry(ctx, patch, path, present) {
+  const kind = patch.kind;
+  if (kind === void 0) {
+    if (!present.has("kind")) {
+      err(
+        ctx,
+        "missing_kind",
+        `${path}.kind`,
+        `${path}.kind is required and no layer supplies it \u2014 an entry needs one of ${AI_PROVIDER_KINDS.join(", ")}`
+      );
+    }
+    return void 0;
+  }
+  let ok = true;
+  const common = entryCommon(patch);
+  if (patch.base_url !== void 0 && !readBaseUrl(ctx, patch.base_url, `${path}.base_url`).ok) {
+    ok = false;
+  }
+  if (patch.headers !== void 0 && readStringMap(ctx, patch.headers, `${path}.headers`, { secretScan: true }) === void 0) {
+    ok = false;
+  }
+  if (patch.query_params !== void 0 && readStringMap(ctx, patch.query_params, `${path}.query_params`, { secretScan: true }) === void 0) {
+    ok = false;
+  }
+  if (patch.credential !== void 0 && !readCredential(ctx, patch.credential, `${path}.credential`).ok) {
+    ok = false;
+  }
+  let params;
+  if (patch.params !== void 0) {
+    const res = readParams(ctx, patch.params, `${path}.params`);
+    if (!res.ok) ok = false;
+    else params = res.value;
+  }
+  if (kind === "stt" || kind === "tts") {
+    for (const key of LLM_ONLY_KEYS) {
+      if (!present.has(key)) continue;
+      err(
+        ctx,
+        "llm_only_key",
+        `${path}.${key}`,
+        `${path}.${key} is llm-only and not accepted on kind '${kind}' (voice entries take kind, label, preset, base_url, headers, credential, params, enabled)`
+      );
+      ok = false;
+    }
+    for (const key of present) {
+      if (VOICE_KEYS[key] || LLM_ONLY_KEYS.includes(key)) continue;
+      err(ctx, "unknown_key", `${path}.${key}`, `${path}.${key} is not a registry key`);
+      ok = false;
+    }
+    const voice = { kind, ...common };
+    if (params !== void 0) voice.params = params;
+    return ok ? voice : void 0;
+  }
+  const llm = { kind, ...common };
+  if (patch.surface !== void 0) {
+    llm.surface = patch.surface;
+  } else if (!present.has("surface") && patch.preset === void 0) {
+    err(
+      ctx,
+      "missing_surface",
+      `${path}.surface`,
+      `${path}.surface is required unless the entry inherits one from a preset`
+    );
+    ok = false;
+  }
+  const transportResult = readTransportSlice(ctx, patch.transport, params, path, present);
+  if (!transportResult.ok) ok = false;
+  else Object.assign(llm, transportResult.slice);
+  if (patch.query_params !== void 0) llm.query_params = patch.query_params;
+  if (patch.model_map !== void 0) llm.model_map = patch.model_map;
+  if (patch.capabilities !== void 0) llm.capabilities = patch.capabilities;
+  if (patch.discovery !== void 0) llm.discovery = patch.discovery;
+  return ok ? llm : void 0;
+}
+function validateRegistry(raw, options = {}) {
+  const ctx = { diagnostics: [] };
+  const document = { version: 1, providers: {} };
+  const prefix = options.source ? `${options.source}: ` : "";
+  const partial = options.layer !== void 0 && options.layer !== "catalog";
+  if (raw === void 0 || raw === null) return { document, diagnostics: ctx.diagnostics };
+  if (!isPlainObject(raw)) {
+    err(ctx, "invalid_type", "", `${prefix}registry document must be a map`);
+    return { document, diagnostics: ctx.diagnostics };
+  }
+  if (raw.version !== void 0 && raw.version !== 1) {
+    err(ctx, "unsupported_version", "version", `version must be 1 (got ${String(raw.version)})`);
+    return { document, diagnostics: ctx.diagnostics };
+  }
+  for (const key of Object.keys(raw)) {
+    if (key === "version" || key === "providers") continue;
+    if (key === "roles") {
+      warn(
+        ctx,
+        "roles_not_here",
+        "roles",
+        "roles are read from skaile.yaml, not from providers.yml \u2014 this block is ignored"
+      );
+      continue;
+    }
+    warn(ctx, "unknown_key", key, `${key} is not a registry document key \u2014 ignored`);
+  }
+  if (raw.providers === void 0) return { document, diagnostics: ctx.diagnostics };
+  if (!isPlainObject(raw.providers)) {
+    err(ctx, "invalid_type", "providers", "providers must be a map of entry id \u2192 entry");
+    return { document, diagnostics: ctx.diagnostics };
+  }
+  for (const [id, rawEntry] of Object.entries(raw.providers)) {
+    const path = `providers.${id}`;
+    if (!isSafeProviderId(id)) {
+      err(
+        ctx,
+        "invalid_id",
+        path,
+        `'${id}' is not a valid entry id \u2014 use lowercase letters, digits, '-' and '_' starting with a letter or digit`
+      );
+      continue;
+    }
+    const read = readEntry(ctx, rawEntry, path);
+    if (!read) continue;
+    if (partial) {
+      document.providers[id] = read.entry;
+      continue;
+    }
+    const entry = checkEntry(ctx, read.entry, path, read.present);
+    if (entry) document.providers[id] = entry;
+  }
+  if (options.source) {
+    for (const diagnostic of ctx.diagnostics) {
+      diagnostic.message = `${prefix}${diagnostic.message}`;
+    }
+  }
+  return { document, diagnostics: ctx.diagnostics };
+}
+function isEntryEnabled(entry) {
+  return entry.enabled !== false;
+}
+function entryTransport(entry) {
+  if (entry.kind !== "llm" && entry.kind !== "embed") return void 0;
+  return entry.transport ?? "direct";
+}
+function resolveEntryBaseUrl(entry) {
+  if (entry.base_url) return entry.base_url;
+  const transport = entryTransport(entry);
+  if (!transport || transport === "direct") return void 0;
+  const template = AI_PROVIDER_BASE_URL_TEMPLATES[transport];
+  const params = entry.params;
+  if (!params) return void 0;
+  const filled = { ...params };
+  if (transport === "vertex") filled.publisher ??= "google";
+  let out = template;
+  for (const [key, value] of Object.entries(filled)) {
+    out = out.replaceAll(`{${key}}`, value);
+  }
+  return /\{[a-z_]+\}/.test(out) ? void 0 : out;
+}
+var LAYER_RANK = {
+  catalog: 0,
+  user: 1,
+  workspace: 2,
+  runtime: 3,
+  session: 4
+};
+function deepMerge(high, low) {
+  if (high === void 0) return low;
+  if (low === void 0) return high;
+  if (!isPlainObject(high) || !isPlainObject(low)) return high;
+  const out = { ...low };
+  for (const [key, value] of Object.entries(high)) {
+    out[key] = deepMerge(value, low[key]);
+  }
+  return out;
+}
+function mergeRegistries(layers) {
+  const ordered = layers.map((layer, index) => ({ layer, index })).sort((a, b) => {
+    const rank = LAYER_RANK[b.layer.layer] - LAYER_RANK[a.layer.layer];
+    return rank !== 0 ? rank : a.index - b.index;
+  }).map((x) => x.layer);
+  const providers = {};
+  const origin = {};
+  const order = [];
+  const frozen = /* @__PURE__ */ new Set();
+  for (const { layer, providers: entries } of ordered) {
+    for (const [id, entry] of Object.entries(entries)) {
+      if (frozen.has(id)) continue;
+      if (providers[id] === void 0) {
+        providers[id] = { ...entry };
+        origin[id] = layer;
+        order.push(id);
+      } else {
+        providers[id] = deepMerge(providers[id], entry);
+      }
+      if (entry.locked) frozen.add(id);
+    }
+  }
+  return {
+    version: 1,
+    // The fold cannot narrow a patch into an entry; `validateMergedRegistry`
+    // is what turns this view into one every consumer can read as complete.
+    providers,
+    order,
+    origin,
+    locked: [...frozen]
+  };
+}
+function validateMergedRegistry(merged, options = {}) {
+  const ctx = { diagnostics: [] };
+  const providers = {};
+  const origin = {};
+  const order = [];
+  for (const id of merged.order) {
+    const patch = merged.providers[id];
+    if (patch === void 0) continue;
+    const present = new Set(
+      Object.entries(patch).filter(([, value]) => value !== void 0).map(([key]) => key)
+    );
+    const from = ctx.diagnostics.length;
+    const entry = checkEntry(ctx, patch, `providers.${id}`, present);
+    const contributors = (options.sources ?? []).filter((source) => source.providers[id] !== void 0).map((source) => source.label);
+    if (contributors.length > 0) {
+      const where = ` (contributed by ${contributors.join(", ")})`;
+      for (const diagnostic of ctx.diagnostics.slice(from)) diagnostic.message += where;
+    }
+    if (entry === void 0) continue;
+    providers[id] = entry;
+    origin[id] = merged.origin[id];
+    order.push(id);
+  }
+  return {
+    registry: {
+      version: 1,
+      providers,
+      order,
+      origin,
+      locked: merged.locked.filter((id) => providers[id] !== void 0)
+    },
+    diagnostics: ctx.diagnostics
+  };
+}
+function registryEntries(registry) {
+  if (isMergedRegistry(registry)) {
+    return registry.order.map((id) => [id, registry.providers[id]]);
+  }
+  return Object.entries(registry);
+}
+function isMergedRegistry(registry) {
+  return Array.isArray(registry.order);
+}
+function parseCredentialRef(ref) {
+  const match = CREDENTIAL_REF.exec(ref.trim());
+  if (!match) return void 0;
+  const [, form, rest] = match;
+  const body = rest.trim();
+  if (body === "") return void 0;
+  switch (form) {
+    case "env":
+      return ENV_NAME.test(body) ? { form: "env", name: body } : void 0;
+    case "cmd":
+      return { form: "cmd", command: body };
+    case "platform":
+      return { form: "platform", configId: body };
+    case "keyring": {
+      const slash = body.indexOf("/");
+      if (slash <= 0 || slash === body.length - 1) return void 0;
+      return { form: "keyring", service: body.slice(0, slash), account: body.slice(slash + 1) };
+    }
+    default:
+      return void 0;
+  }
+}
+function formatCredentialRef(ref) {
+  switch (ref.form) {
+    case "env":
+      return `env:${ref.name}`;
+    case "cmd":
+      return `cmd:${ref.command}`;
+    case "platform":
+      return `platform:${ref.configId}`;
+    case "keyring":
+      return `keyring:${ref.service}/${ref.account}`;
+  }
+}
+function selectableEntries(registry) {
+  return registryEntries(registry).filter(
+    (pair) => (pair[1].kind === "llm" || pair[1].kind === "embed") && isEntryEnabled(pair[1])
+  );
+}
+function resolveAgainstEntry(providerId, entry, modelId, extra) {
+  return {
+    providerId,
+    modelId,
+    providerModelId: modelId === void 0 ? void 0 : entry.model_map?.[modelId] ?? modelId,
+    role: extra.role,
+    warnings: extra.warnings
+  };
+}
+function parseModelRef(ref, registry, roles) {
+  const entries = selectableEntries(registry);
+  if (entries.length === 0) return void 0;
+  const warnings = [];
+  let selector = ref.trim();
+  let role;
+  if (selector.startsWith("@")) {
+    role = selector.slice(1);
+    const target = roles?.[role];
+    if (!target) {
+      warnings.push(`role '@${role}' is not defined in roles \u2014 falling back to registry order`);
+      const [providerId2, entry2] = entries[0];
+      return resolveAgainstEntry(providerId2, entry2, void 0, { role, warnings });
+    }
+    selector = target.trim();
+    if (selector.startsWith("@")) {
+      warnings.push(`role '@${role}' points at another role ('${selector}') \u2014 roles do not chain`);
+      const [providerId2, entry2] = entries[0];
+      return resolveAgainstEntry(providerId2, entry2, void 0, { role, warnings });
+    }
+  }
+  const slash = selector.indexOf("/");
+  if (slash > 0) {
+    const head = selector.slice(0, slash);
+    const tail = selector.slice(slash + 1);
+    const match = entries.find(([id]) => id === head);
+    if (match && tail !== "") {
+      return resolveAgainstEntry(match[0], match[1], tail, { role, warnings });
+    }
+    if (!match && registryEntries(registry).some(([id]) => id === head)) {
+      warnings.push(`provider '${head}' is disabled or not an llm entry \u2014 falling back`);
+    }
+  }
+  const mapped = entries.find(
+    ([, entry2]) => entry2.model_map?.[selector] !== void 0 || entry2.capabilities?.[selector]
+  );
+  const [providerId, entry] = mapped ?? entries[0];
+  return resolveAgainstEntry(providerId, entry, selector, { role, warnings });
+}
+
+export { AI_PROVIDER_BASE_URL_TEMPLATES, AI_PROVIDER_CREDENTIAL_KINDS, AI_PROVIDER_DISCOVERY_TYPES, AI_PROVIDER_KINDS, AI_PROVIDER_LAYERS, AI_PROVIDER_SURFACES, AI_PROVIDER_TRANSPORTS, AI_PROVIDER_VOICE_KINDS, entryTransport, formatCredentialRef, isEntryEnabled, isSafeProviderId, looksLikeLiteralSecret, mergeRegistries, parseCredentialRef, parseModelRef, registryEntries, resolveEntryBaseUrl, validateMergedRegistry, validateRegistry };
+//# sourceMappingURL=chunk-ILG4BXYE.js.map
+//# sourceMappingURL=chunk-ILG4BXYE.js.map