@undefineds.co/xpod 0.4.11 → 0.4.12

package/node_modules/@undefineds.co/ai-connections/dist/authorization-methods.d.ts

@@ -1,16 +1,47 @@
 import type { AiConnectAttempt, AiConnectionsMode, AiProviderAuthorizationMethod, AiProviderOffering } from './ai-connections-client';
-import type { AiProviderDefinition } from './controller';
 /**
- * Authorization methods an offering exposes. Offerings that declare them keep
- * that list; the rest derive one method per entry of `authModes`, which is what
- * the shared catalog publishes for most providers.
+ * Authorization methods an offering exposes. An offering that declares them
+ * keeps that list - including an empty one, which is how the server says "this
+ * offering has no connect entry here" instead of publishing an entry that
+ * cannot be used. The rest derive one method per entry of `authModes`, which is
+ * what a payload without the field (a catalog consumer that never asked the
+ * server) falls back to.
+ *
+ * The derivation is therefore a fallback for payloads that carry no
+ * `authorizationMethods` at all, so it must stay a projection of the offering's
+ * own data: no label is invented for a provider, and the wording mirrors the
+ * server's own naming for the same `authModes`.
  */
 export declare function authorizationMethodsForOffering(offering: AiProviderOffering): AiProviderAuthorizationMethod[];
 export declare function connectModeForMethod(method: AiProviderAuthorizationMethod): AiConnectionsMode | undefined;
 export declare function isOAuthMode(mode: AiConnectionsMode | undefined): mode is 'deviceCodeOAuth' | 'authorizationCodeOAuth';
 export declare function isOAuthMethod(method: AiProviderAuthorizationMethod): boolean;
 export declare function isApiKeyMethod(method: AiProviderAuthorizationMethod): boolean;
+/** The catalog id of the entry that collects a key inside Xpod's own form. */
+export declare const API_KEY_METHOD_ID = "api-key";
+/**
+ * The catalog's console entry: it opens the provider's own page so the user
+ * signs in there and mints the key, which then arrives as an `apiKey` credential
+ * - which is why `isApiKeyMethod` covers it too.
+ *
+ * The two apiKey entries are different actions, and the id separates them:
+ * `api-key` is the in-app form, a declaration naming the browser-assisted
+ * connect mode is the console trip. Both are data; nothing here invents one.
+ */
+export declare function isBrowserConnectMethod(method: AiProviderAuthorizationMethod): boolean;
+/**
+ * Where a connect entry belongs in a provider page's toolbar.
+ *
+ * The rank is a property of the method kind and of nothing else - not the
+ * provider, not the offering, not the order an offering happens to declare its
+ * methods in - so every page reads 浏览器登录 → 设备码登录 → 已有登录态 →
+ * 添加 API Key, with 本地服务 wherever a local service stands in for the login
+ * state. That is what keeps the API-key entry last and the browser entry first
+ * even when the browser entry reaches the page from another offering than the
+ * rest of the split (kimi's subscription binding is exactly that case).
+ */
+export declare function connectEntryRank(method: AiProviderAuthorizationMethod): number;
 export declare function isLocalMethod(method: AiProviderAuthorizationMethod): boolean;
 /** Connect mode to fall back to when an offering declares no authorization method. */
-export declare function modeForOffering(offering: AiProviderOffering, definition: AiProviderDefinition): AiConnectionsMode;
+export declare function modeForOffering(offering: AiProviderOffering): AiConnectionsMode;
 export declare function isPendingAttempt(attempt: AiConnectAttempt | undefined): boolean;

package/node_modules/@undefineds.co/ai-connections/dist/authorization-methods.js

@@ -1,10 +1,18 @@
 /**
- * Authorization methods an offering exposes. Offerings that declare them keep
- * that list; the rest derive one method per entry of `authModes`, which is what
- * the shared catalog publishes for most providers.
+ * Authorization methods an offering exposes. An offering that declares them
+ * keeps that list - including an empty one, which is how the server says "this
+ * offering has no connect entry here" instead of publishing an entry that
+ * cannot be used. The rest derive one method per entry of `authModes`, which is
+ * what a payload without the field (a catalog consumer that never asked the
+ * server) falls back to.
+ *
+ * The derivation is therefore a fallback for payloads that carry no
+ * `authorizationMethods` at all, so it must stay a projection of the offering's
+ * own data: no label is invented for a provider, and the wording mirrors the
+ * server's own naming for the same `authModes`.
  */
 export function authorizationMethodsForOffering(offering) {
-    if (offering.authorizationMethods?.length)
+    if (Array.isArray(offering.authorizationMethods))
         return offering.authorizationMethods;
     const lifecycle = offering.lifecycle === 'unavailable' ? 'unavailable' : 'active';
     return [...new Set(offering.authModes ?? [])].map((mode) => {
@@ -30,7 +38,7 @@ export function authorizationMethodsForOffering(offering) {
             id: 'device-code',
             authMode: mode,
             connectMode: 'deviceCodeOAuth',
-            label: '',
+            label: '浏览器登录',
             lifecycle,
         };
     });
@@ -53,17 +61,52 @@ export function isOAuthMethod(method) {
 export function isApiKeyMethod(method) {
     return method.authMode === 'apiKey' || connectModeForMethod(method) === 'browserAssistedApiKey';
 }
+/** The catalog id of the entry that collects a key inside Xpod's own form. */
+export const API_KEY_METHOD_ID = 'api-key';
+/**
+ * The catalog's console entry: it opens the provider's own page so the user
+ * signs in there and mints the key, which then arrives as an `apiKey` credential
+ * - which is why `isApiKeyMethod` covers it too.
+ *
+ * The two apiKey entries are different actions, and the id separates them:
+ * `api-key` is the in-app form, a declaration naming the browser-assisted
+ * connect mode is the console trip. Both are data; nothing here invents one.
+ */
+export function isBrowserConnectMethod(method) {
+    return method.connectMode === 'browserAssistedApiKey' && method.id !== API_KEY_METHOD_ID;
+}
+/**
+ * Where a connect entry belongs in a provider page's toolbar.
+ *
+ * The rank is a property of the method kind and of nothing else - not the
+ * provider, not the offering, not the order an offering happens to declare its
+ * methods in - so every page reads 浏览器登录 → 设备码登录 → 已有登录态 →
+ * 添加 API Key, with 本地服务 wherever a local service stands in for the login
+ * state. That is what keeps the API-key entry last and the browser entry first
+ * even when the browser entry reaches the page from another offering than the
+ * rest of the split (kimi's subscription binding is exactly that case).
+ */
+export function connectEntryRank(method) {
+    const connectMode = connectModeForMethod(method);
+    if (isBrowserConnectMethod(method) || connectMode === 'authorizationCodeOAuth')
+        return 0;
+    if (connectMode === 'deviceCodeOAuth')
+        return 1;
+    if (isLocalMethod(method))
+        return 2;
+    if (isApiKeyMethod(method))
+        return 3;
+    return 4;
+}
 export function isLocalMethod(method) {
     return method.authMode === 'local';
 }
 /** Connect mode to fall back to when an offering declares no authorization method. */
-export function modeForOffering(offering, definition) {
+export function modeForOffering(offering) {
     const modes = offering.authModes ?? [];
     if (modes.some((mode) => mode === 'oauth' || mode === 'deviceCode'))
         return 'deviceCodeOAuth';
-    if (modes.some((mode) => mode === 'apiKey' || mode === 'local'))
-        return 'browserAssistedApiKey';
-    return definition.browserMode === 'connectUnsupported' ? 'browserAssistedApiKey' : definition.browserMode;
+    return 'browserAssistedApiKey';
 }
 export function isPendingAttempt(attempt) {
     return attempt?.status === 'pending' || attempt?.status === 'authorization_pending' || attempt?.status === 'slow_down';

package/node_modules/@undefineds.co/ai-connections/dist/client/normalize.js

@@ -386,10 +386,21 @@ function modelCapabilitiesFromWire(value) {
     const capabilities = [];
     if (value.capabilities.imageInput === true)
         capabilities.push('image');
+    // Only what a model can do for the caller earns a mark. `parallelToolCalls`
+    // refines tool calling and `promptCaching` is a transport optimisation, so
+    // neither becomes a marker of its own.
     if (value.capabilities.toolCalls === true)
         capabilities.push('tool_call');
     if (value.capabilities.reasoningEffort === true)
         capabilities.push('reasoning');
+    // A curated tier marker, not a measurement: the catalog has no latency data,
+    // so a model is only "fast" because the catalog says so.
+    if (value.capabilities.fast === true)
+        capabilities.push('fast');
+    // Catalog-provided embedding models carry the capability as an object flag, the
+    // same way the AI Config embedding assignment reads them.
+    if (value.capabilities.embedding === true)
+        capabilities.push('embedding');
     return capabilities.length > 0 ? capabilities : undefined;
 }
 function isPlatformModelId(modelId) {
@@ -835,12 +846,18 @@ export function parseModelDiscovery(value, expectedProvider) {
         .map((item) => {
         if (!isRecord(item) || typeof item.id !== 'string' || !item.id)
             return undefined;
+        const capabilities = Array.isArray(item.capabilities)
+            ? item.capabilities.filter((cap) => typeof cap === 'string')
+            : undefined;
+        const modelType = discoveredModelType(item.modelType);
         return compactObject({
             id: item.id,
             displayName: stringValue(item.displayName),
-            capabilities: Array.isArray(item.capabilities)
-                ? item.capabilities.filter((cap) => typeof cap === 'string')
-                : undefined,
+            // A provider that declares capabilities sends them; otherwise the type
+            // is the only evidence a row has, and an embedding model without it is
+            // listed as if it were a chat model.
+            capabilities: capabilities ?? (modelType === 'embedding' ? ['embedding'] : undefined),
+            modelType,
         });
     })
         .filter(isDefined);
@@ -855,6 +872,16 @@ export function parseModelDiscovery(value, expectedProvider) {
 export function compactObject(value) {
     return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== undefined));
 }
+/**
+ * Only the two classes the Pod stores survive the wire.
+ *
+ * A server that sends anything else (an older release, a provider's own
+ * vocabulary) leaves the row untyped, which reads as a chat model - never as a
+ * value the AI config write would reject.
+ */
+function discoveredModelType(value) {
+    return value === 'chat' || value === 'embedding' ? value : undefined;
+}
 function stringValue(value) {
     return typeof value === 'string' ? value : undefined;
 }

package/node_modules/@undefineds.co/ai-connections/dist/client/types.d.ts

@@ -85,6 +85,13 @@ export interface CreatedGatewayKey {
 }
 export interface AiGatewayModel extends AiConnectionsModelSelection {
     provider: AiConnectionsProvider;
+    /**
+     * What kind of model this row is, when the Pod or the provider catalog knows.
+     *
+     * Rows read from the Pod carry it as their own column; the settings list shows
+     * it as the same capability mark the Gateway projection uses.
+     */
+    modelType?: DiscoveredProviderModelType;
     /** Owning credential for providers that allow multiple independent custom endpoints. */
     credentialId?: string;
     displayName?: string;
@@ -96,10 +103,21 @@ export interface AiGatewayModel extends AiConnectionsModelSelection {
     outputModalities?: string[];
     capabilities?: string[];
 }
+/**
+ * What the provider's own model list said a model is.
+ *
+ * Two values only, because that is the distinction the product acts on and the
+ * only one the Pod can store: the server infers it
+ * (`ProviderModelType.inferProviderModelType`) and the Pod row keeps it, so an
+ * embedding model stays selectable for embedding instead of being stored as an
+ * ordinary chat model.
+ */
+export type DiscoveredProviderModelType = 'chat' | 'embedding';
 export interface DiscoveredProviderModel {
     id: string;
     displayName?: string;
     capabilities?: string[];
+    modelType?: DiscoveredProviderModelType;
 }
 export interface CustomProviderModel {
     id: string;
@@ -117,7 +135,9 @@ export interface ProviderModelDiscovery {
     observedAt: string;
     source: string;
 }
-export type AiProviderAuthorizationMethodId = 'device-code' | 'local-session-import' | 'api-key' | 'local-service' | string;
+export type AiProviderAuthorizationMethodId = 'device-code' | 'local-session-import' | 'api-key' | 'local-service'
+/** Opens the provider console to sign in and mint the key the entry then stores. */
+ | 'browser-login' | string;
 export interface AiProviderAuthorizationMethod {
     id: AiProviderAuthorizationMethodId;
     authMode: 'oauth' | 'deviceCode' | 'local' | 'apiKey';

package/node_modules/@undefineds.co/ai-connections/dist/client-config/base-adapter.d.ts

@@ -20,8 +20,7 @@ interface OwnershipState {
 export declare function hashWebId(webId: string): string;
 declare function contentHash(value: string): string;
 export declare const contentFingerprint: typeof contentHash;
-export declare function normalizeV1Endpoint(endpoint: string): string;
-export declare function normalizeMessagesEndpoint(endpoint: string): string;
+export { normalizeMessagesEndpoint, normalizeV1Endpoint } from '../endpoint-urls';
 export declare function parseJsonObject(content: string | undefined, label: string): Record<string, unknown>;
 export declare function stringifyJson(value: unknown): string;
 export declare function looksLikePreviousXpodValue(value: unknown): boolean;
@@ -68,4 +67,3 @@ export declare abstract class BaseAiClientConfigAdapter implements AiClientConfi
     private exists;
     private isExecutableOnPath;
 }
-export {};

package/node_modules/@undefineds.co/ai-connections/dist/client-config/base-adapter.js

@@ -17,13 +17,9 @@ function contentHash(value) {
     return crypto.createHash('sha256').update(value, 'utf8').digest('hex');
 }
 export const contentFingerprint = contentHash;
-export function normalizeV1Endpoint(endpoint) {
-    const normalized = endpoint.trim().replace(/\/+$/, '');
-    return normalized.endsWith('/v1') ? normalized : `${normalized}/v1`;
-}
-export function normalizeMessagesEndpoint(endpoint) {
-    return endpoint.trim().replace(/\/+$/, '').replace(/\/v1$/, '');
-}
+// The base-URL rules are shared with the UI (see src/endpoint-urls.ts); they are
+// re-exported here so adapters keep importing them from one place.
+export { normalizeMessagesEndpoint, normalizeV1Endpoint } from '../endpoint-urls.js';
 export function parseJsonObject(content, label) {
     if (!content?.trim())
         return {};

package/node_modules/@undefineds.co/ai-connections/dist/client-config/index.cjs

@@ -269,6 +269,15 @@ class AiClientConfigTransaction {
   }
 }
 
+// src/endpoint-urls.ts
+function normalizeV1Endpoint(endpoint) {
+  const normalized = endpoint.trim().replace(/\/+$/, "");
+  return normalized.endsWith("/v1") ? normalized : `${normalized}/v1`;
+}
+function normalizeMessagesEndpoint(endpoint) {
+  return endpoint.trim().replace(/\/+$/, "").replace(/\/v1$/, "");
+}
+
 // src/client-config/base-adapter.ts
 class AiClientConfigError extends Error {
   code;
@@ -285,13 +294,6 @@ function contentHash(value) {
   return crypto2.createHash("sha256").update(value, "utf8").digest("hex");
 }
 var contentFingerprint = contentHash;
-function normalizeV1Endpoint(endpoint) {
-  const normalized = endpoint.trim().replace(/\/+$/, "");
-  return normalized.endsWith("/v1") ? normalized : `${normalized}/v1`;
-}
-function normalizeMessagesEndpoint(endpoint) {
-  return endpoint.trim().replace(/\/+$/, "").replace(/\/v1$/, "");
-}
 function parseJsonObject(content, label) {
   if (!content?.trim())
     return {};

package/node_modules/@undefineds.co/ai-connections/dist/collection-runtime.d.ts

@@ -0,0 +1,46 @@
+import type { AiConnectionsPodStore, WebExtensionHost } from '@undefineds.co/extension-sdk/web';
+import type { AiConnectionsClient } from './ai-connections-client';
+import { type CredentialCollection } from './collections';
+/**
+ * The half of the credentials table that needs the collection layer at runtime.
+ *
+ * This module is reached **only** through `collections.credentialCollectionRuntime()`
+ * (a dynamic import): it is the single place in the applet that pulls
+ * `@undefineds.co/pod-collections` - and with it the TanStack DB engine - so the
+ * settings entry and every page that renders the applet without live rows do not
+ * carry that weight (`docs/pod-collections.md` §9-9).
+ *
+ * Everything here is behind an `await`: defining the table (the host may still be
+ * fetching the engine), reading rows and writing rows. The page keeps rendering
+ * the store's own summary until it lands, which is exactly how it behaves when
+ * the host offers no `podCollections` capability at all.
+ */
+/**
+ * The host's live credentials collection, or `undefined` when the host offers no
+ * `podCollections` capability (or cannot lay the table out).
+ *
+ * A missing capability is a degradation, not an error: the page keeps reading
+ * through the store exactly as before. `layout_document_required` cannot happen
+ * for this descriptor (its document is derived from `storage.base`) but is
+ * handled the same way rather than taking the page down with it.
+ *
+ * `load()` is the host accessor that works whether the collection engine is
+ * already in the host or still arriving; `define()` is the eager host's
+ * synchronous path and stays the fallback for a host that does not implement it.
+ */
+export declare function openCredentialCollection(host: WebExtensionHost): Promise<CredentialCollection | undefined>;
+/** Inverse of {@link credentialIdOfRow}: collection key for a credential resource id. */
+export declare function credentialRowKey(id: string): string | undefined;
+/**
+ * The credential mutations of `AiConnectionsClient`, backed by the collection.
+ *
+ * Everything the descriptor declares is written through `insert` / `update` /
+ * `delete`, so it is optimistic, rolls back on rejection and reconciles with the
+ * document instead of being overwritten by the next read. Everything it cannot
+ * express - the secret envelope, `offeringId`, `metadata`, base URLs,
+ * `compatibility` - is written by the store within the same user action; if that
+ * completion fails, the row the collection created is deleted again and a
+ * partially applied update is put back, so a failed write leaves no
+ * half-written credential behind.
+ */
+export declare function collectionCredentialMutations(credentials: CredentialCollection, store: AiConnectionsPodStore): Pick<AiConnectionsClient, 'createApiKeyCredential' | 'createLocalCredential' | 'updateProviderCredential' | 'deleteProviderCredential'>;

package/node_modules/@undefineds.co/ai-connections/dist/collection-runtime.js

@@ -0,0 +1,231 @@
+import { credentialDescriptor, credentialResource } from '@undefineds.co/models';
+import { rowKeyOf } from '@undefineds.co/pod-collections';
+import { credentialProviderRelation, credentialRowKeyFor, customCredentialProviderRelation, } from './credential-storage.js';
+import { credentialSummaryFromRow } from './collections.js';
+import { normalizeProxyUrl } from './client/normalize.js';
+import { credentialOfferingMetadata, defaultOfferingFor, offeringBaseUrl, storedOfferingIdFor, } from './provider-catalog.js';
+/**
+ * The half of the credentials table that needs the collection layer at runtime.
+ *
+ * This module is reached **only** through `collections.credentialCollectionRuntime()`
+ * (a dynamic import): it is the single place in the applet that pulls
+ * `@undefineds.co/pod-collections` - and with it the TanStack DB engine - so the
+ * settings entry and every page that renders the applet without live rows do not
+ * carry that weight (`docs/pod-collections.md` §9-9).
+ *
+ * Everything here is behind an `await`: defining the table (the host may still be
+ * fetching the engine), reading rows and writing rows. The page keeps rendering
+ * the store's own summary until it lands, which is exactly how it behaves when
+ * the host offers no `podCollections` capability at all.
+ */
+/**
+ * The host's live credentials collection, or `undefined` when the host offers no
+ * `podCollections` capability (or cannot lay the table out).
+ *
+ * A missing capability is a degradation, not an error: the page keeps reading
+ * through the store exactly as before. `layout_document_required` cannot happen
+ * for this descriptor (its document is derived from `storage.base`) but is
+ * handled the same way rather than taking the page down with it.
+ *
+ * `load()` is the host accessor that works whether the collection engine is
+ * already in the host or still arriving; `define()` is the eager host's
+ * synchronous path and stays the fallback for a host that does not implement it.
+ */
+export async function openCredentialCollection(host) {
+    const capability = host.capabilities.podCollections;
+    if (!capability)
+        return undefined;
+    try {
+        if (capability.load) {
+            return { collection: await capability.load(credentialDescriptor, { table: credentialResource }) };
+        }
+        return { collection: capability.define(credentialDescriptor, { table: credentialResource }) };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Inverse of {@link credentialIdOfRow}: collection key for a credential resource id. */
+export function credentialRowKey(id) {
+    if (!id.includes('#'))
+        return id;
+    return rowKeyOf(credentialDescriptor, { id });
+}
+/** Writes a row the descriptor declares; confirmation is the collection's own protocol. */
+async function insertCredentialRow(collection, row) {
+    await collection.insert(row).isPersisted.promise;
+}
+/** Patches the descriptor-declared fields of one row (label, status, …). */
+async function updateCredentialRow(collection, key, patch) {
+    await collection.update(key, (draft) => {
+        Object.assign(draft, patch);
+    }).isPersisted.promise;
+}
+async function deleteCredentialRow(collection, key) {
+    await collection.delete(key).isPersisted.promise;
+}
+/**
+ * The row a create writes through the collection: exactly the columns the
+ * models descriptor declares.
+ *
+ * The secret envelope is deliberately absent, and not because the confirmation
+ * protocol could not handle it any more (that defect is fixed: a write intent
+ * carrying a `secret: true` field now confirms, §9-7). It is absent because the
+ * store owns it: `encryptedSecret` is built by the store's encryption path.
+ *
+ * `offeringId` / `metadata` / `baseUrl` / `proxyUrl` are a different case: models
+ * 0.2.57 **does** declare them, so a read projects them back and this row has to
+ * carry the same values the store writes or our own echo looks like a change and
+ * replaces the row (see `credentials collection` in
+ * `packages/ai-connections/test/pod-collections.test.tsx`). Their derivation
+ * currently lives in the store adapter, which is why this row still omits them;
+ * reconciling that is the open item, not a decision this comment can settle.
+ */
+function newCredentialRow(key, input) {
+    const { provider } = input;
+    // The offering columns are derived here exactly as the store derives them, so
+    // the row the collection writes is already the row the store will confirm.
+    const offeringId = storedOfferingIdFor(provider, input.offeringId ?? defaultOfferingFor(provider, input.authMode));
+    const baseUrl = input.baseUrl ?? offeringBaseUrl(provider, offeringId);
+    const proxyUrl = normalizeProxyUrl(input.proxyUrl);
+    return {
+        id: key,
+        service: 'ai',
+        // The credential descriptor's provider relation (models 0.2.57 names the
+        // field `provider`; the retired `providerId` still compiles because `RowOf`
+        // carries an index signature, and read back `undefined` at runtime).
+        provider: provider === 'custom'
+            ? customCredentialProviderRelation(key)
+            : credentialProviderRelation(provider),
+        authMode: input.authMode,
+        status: 'active',
+        accountLabel: input.accountLabel,
+        label: input.accountLabel,
+        keyVersion: '1',
+        reauthRequired: false,
+        encryptionAlgorithm: 'PLAINTEXT',
+        offeringId,
+        ...(baseUrl ? { baseUrl } : {}),
+        ...(proxyUrl ? { proxyUrl } : {}),
+        metadata: credentialOfferingMetadata({ offeringId, baseUrl }),
+    };
+}
+/**
+ * The credential mutations of `AiConnectionsClient`, backed by the collection.
+ *
+ * Everything the descriptor declares is written through `insert` / `update` /
+ * `delete`, so it is optimistic, rolls back on rejection and reconciles with the
+ * document instead of being overwritten by the next read. Everything it cannot
+ * express - the secret envelope, `offeringId`, `metadata`, base URLs,
+ * `compatibility` - is written by the store within the same user action; if that
+ * completion fails, the row the collection created is deleted again and a
+ * partially applied update is put back, so a failed write leaves no
+ * half-written credential behind.
+ */
+export function collectionCredentialMutations(credentials, store) {
+    const { collection } = credentials;
+    const discard = async (key) => {
+        await deleteCredentialRow(collection, key).catch(() => undefined);
+    };
+    const summaryOf = (key, provider) => {
+        const row = collection.get(key);
+        return row ? credentialSummaryFromRow(row, provider) : undefined;
+    };
+    const create = async (provider, key, row, complete) => {
+        await insertCredentialRow(collection, row);
+        try {
+            const completed = await complete(credentialResource.buildId({ id: key }));
+            const summary = completed ?? summaryOf(key, provider);
+            if (!summary)
+                throw new Error('credential_create_failed');
+            return summary;
+        }
+        catch (error) {
+            await discard(key);
+            throw error;
+        }
+    };
+    return {
+        async createApiKeyCredential(provider, input) {
+            if (!store.createApiKeyCredential)
+                throw new Error('credential_store_unavailable');
+            const key = credentialRowKeyFor(provider, 'apiKey');
+            const label = input.label ?? provider;
+            return await create(provider, key, newCredentialRow(key, {
+                provider,
+                authMode: 'apiKey',
+                accountLabel: label,
+                offeringId: input.offeringId,
+                baseUrl: input.baseUrl,
+                proxyUrl: input.proxyUrl,
+            }), (id) => store.createApiKeyCredential(provider, { ...input, label, id }));
+        },
+        async createLocalCredential(provider, input) {
+            if (!store.createLocalCredential)
+                throw new Error('credential_store_unavailable');
+            const key = credentialRowKeyFor(provider, 'local');
+            const label = input.label ?? 'Local';
+            return await create(provider, key, newCredentialRow(key, {
+                provider,
+                authMode: 'local',
+                accountLabel: label,
+                offeringId: input.offeringId,
+                baseUrl: input.baseUrl,
+            }), (id) => store.createLocalCredential(provider, { ...input, label, id }));
+        },
+        async updateProviderCredential(provider, credentialId, input) {
+            const key = credentialRowKey(credentialId);
+            if (!key)
+                throw new Error('credential_not_found');
+            // `label` and `enabled` are descriptor fields: they land optimistically
+            // through the collection. Priority and base URLs are not, so they go to
+            // the store within the same call. Built as a literal because models 0.2.59
+            // declares these row fields readonly.
+            const patch = {
+                ...(input.label === undefined ? {} : { label: input.label, accountLabel: input.label }),
+                ...(input.enabled === undefined ? {} : { status: input.enabled ? 'active' : 'disabled' }),
+            };
+            const before = collection.get(key);
+            if (Object.keys(patch).length > 0)
+                await updateCredentialRow(collection, key, patch);
+            const attributes = {
+                ...(input.priority === undefined ? {} : { priority: input.priority }),
+                ...(input.baseUrl === undefined ? {} : { baseUrl: input.baseUrl }),
+                ...(input.proxyUrl === undefined ? {} : { proxyUrl: input.proxyUrl }),
+            };
+            if (Object.keys(attributes).length === 0)
+                return summaryOf(key, provider);
+            if (!store.updateProviderCredential)
+                throw new Error('credential_store_unavailable');
+            try {
+                const completed = await store.updateProviderCredential(provider, credentialId, {
+                    expectedVersion: input.expectedVersion,
+                    ...attributes,
+                });
+                return completed ?? summaryOf(key, provider);
+            }
+            catch (error) {
+                // The optimistic part must not survive a rejected completion: put the
+                // row's own fields back, then report the failure.
+                if (before && Object.keys(patch).length > 0) {
+                    await updateCredentialRow(collection, key, {
+                        ...(patch.label === undefined ? {} : {
+                            label: before.label,
+                            accountLabel: before.accountLabel,
+                        }),
+                        ...(patch.status === undefined ? {} : { status: before.status }),
+                    }).catch(() => undefined);
+                }
+                throw error;
+            }
+        },
+        async deleteProviderCredential(provider, credentialId) {
+            const key = credentialRowKey(credentialId);
+            if (!key)
+                return undefined;
+            const before = summaryOf(key, provider);
+            await deleteCredentialRow(collection, key);
+            return before;
+        },
+    };
+}