@undefineds.co/xpod 0.4.11 → 0.4.13

package/node_modules/@undefineds.co/ai-connections/dist/collection-runtime.d.ts

@@ -0,0 +1,46 @@
+import type { AiConnectionsPodStore, WebExtensionHost } from '@undefineds.co/extension-sdk/web';
+import type { AiConnectionsClient } from '@undefineds.co/ai-connections-core/client';
+import { type CredentialCollection } from './collections';
+/**
+ * The half of the credentials table that needs the collection layer at runtime.
+ *
+ * This module is reached **only** through `collections.credentialCollectionRuntime()`
+ * (a dynamic import): it is the single place in the applet that pulls
+ * `@undefineds.co/pod-collections` - and with it the TanStack DB engine - so the
+ * settings entry and every page that renders the applet without live rows do not
+ * carry that weight (`docs/pod-collections.md` §9-9).
+ *
+ * Everything here is behind an `await`: defining the table (the host may still be
+ * fetching the engine), reading rows and writing rows. The page keeps rendering
+ * the store's own summary until it lands, which is exactly how it behaves when
+ * the host offers no `podCollections` capability at all.
+ */
+/**
+ * The host's live credentials collection, or `undefined` when the host offers no
+ * `podCollections` capability (or cannot lay the table out).
+ *
+ * A missing capability is a degradation, not an error: the page keeps reading
+ * through the store exactly as before. `layout_document_required` cannot happen
+ * for this descriptor (its document is derived from `storage.base`) but is
+ * handled the same way rather than taking the page down with it.
+ *
+ * `load()` is the host accessor that works whether the collection engine is
+ * already in the host or still arriving; `define()` is the eager host's
+ * synchronous path and stays the fallback for a host that does not implement it.
+ */
+export declare function openCredentialCollection(host: WebExtensionHost): Promise<CredentialCollection | undefined>;
+/** Inverse of {@link credentialIdOfRow}: collection key for a credential resource id. */
+export declare function credentialRowKey(id: string): string | undefined;
+/**
+ * The credential mutations of `AiConnectionsClient`, backed by the collection.
+ *
+ * Everything the descriptor declares is written through `insert` / `update` /
+ * `delete`, so it is optimistic, rolls back on rejection and reconciles with the
+ * document instead of being overwritten by the next read. Everything it cannot
+ * express - the secret envelope, `offeringId`, `metadata`, base URLs,
+ * `compatibility` - is written by the store within the same user action; if that
+ * completion fails, the row the collection created is deleted again and a
+ * partially applied update is put back, so a failed write leaves no
+ * half-written credential behind.
+ */
+export declare function collectionCredentialMutations(credentials: CredentialCollection, store: AiConnectionsPodStore): Pick<AiConnectionsClient, 'createApiKeyCredential' | 'createLocalCredential' | 'updateProviderCredential' | 'deleteProviderCredential'>;

package/node_modules/@undefineds.co/ai-connections/dist/collection-runtime.js

@@ -0,0 +1,231 @@
+import { credentialDescriptor, credentialResource } from '@undefineds.co/models';
+import { rowKeyOf } from '@undefineds.co/pod-collections';
+import { credentialProviderRelation, credentialRowKeyFor, customCredentialProviderRelation, } from '@undefineds.co/ai-connections-core/client';
+import { credentialSummaryFromRow } from './collections.js';
+import { normalizeProxyUrl } from '@undefineds.co/ai-connections-core/client';
+import { credentialOfferingMetadata, defaultOfferingFor, offeringBaseUrl, storedOfferingIdFor, } from '@undefineds.co/ai-connections-core/provider-catalog';
+/**
+ * The half of the credentials table that needs the collection layer at runtime.
+ *
+ * This module is reached **only** through `collections.credentialCollectionRuntime()`
+ * (a dynamic import): it is the single place in the applet that pulls
+ * `@undefineds.co/pod-collections` - and with it the TanStack DB engine - so the
+ * settings entry and every page that renders the applet without live rows do not
+ * carry that weight (`docs/pod-collections.md` §9-9).
+ *
+ * Everything here is behind an `await`: defining the table (the host may still be
+ * fetching the engine), reading rows and writing rows. The page keeps rendering
+ * the store's own summary until it lands, which is exactly how it behaves when
+ * the host offers no `podCollections` capability at all.
+ */
+/**
+ * The host's live credentials collection, or `undefined` when the host offers no
+ * `podCollections` capability (or cannot lay the table out).
+ *
+ * A missing capability is a degradation, not an error: the page keeps reading
+ * through the store exactly as before. `layout_document_required` cannot happen
+ * for this descriptor (its document is derived from `storage.base`) but is
+ * handled the same way rather than taking the page down with it.
+ *
+ * `load()` is the host accessor that works whether the collection engine is
+ * already in the host or still arriving; `define()` is the eager host's
+ * synchronous path and stays the fallback for a host that does not implement it.
+ */
+export async function openCredentialCollection(host) {
+    const capability = host.capabilities.podCollections;
+    if (!capability)
+        return undefined;
+    try {
+        if (capability.load) {
+            return { collection: await capability.load(credentialDescriptor, { table: credentialResource }) };
+        }
+        return { collection: capability.define(credentialDescriptor, { table: credentialResource }) };
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Inverse of {@link credentialIdOfRow}: collection key for a credential resource id. */
+export function credentialRowKey(id) {
+    if (!id.includes('#'))
+        return id;
+    return rowKeyOf(credentialDescriptor, { id });
+}
+/** Writes a row the descriptor declares; confirmation is the collection's own protocol. */
+async function insertCredentialRow(collection, row) {
+    await collection.insert(row).isPersisted.promise;
+}
+/** Patches the descriptor-declared fields of one row (label, status, …). */
+async function updateCredentialRow(collection, key, patch) {
+    await collection.update(key, (draft) => {
+        Object.assign(draft, patch);
+    }).isPersisted.promise;
+}
+async function deleteCredentialRow(collection, key) {
+    await collection.delete(key).isPersisted.promise;
+}
+/**
+ * The row a create writes through the collection: exactly the columns the
+ * models descriptor declares.
+ *
+ * The secret envelope is deliberately absent, and not because the confirmation
+ * protocol could not handle it any more (that defect is fixed: a write intent
+ * carrying a `secret: true` field now confirms, §9-7). It is absent because the
+ * store owns it: `encryptedSecret` is built by the store's encryption path.
+ *
+ * `offeringId` / `metadata` / `baseUrl` / `proxyUrl` are a different case: models
+ * 0.2.57 **does** declare them, so a read projects them back and this row has to
+ * carry the same values the store writes or our own echo looks like a change and
+ * replaces the row (see `credentials collection` in
+ * `packages/ai-connections/test/pod-collections.test.tsx`). Their derivation
+ * currently lives in the store adapter, which is why this row still omits them;
+ * reconciling that is the open item, not a decision this comment can settle.
+ */
+function newCredentialRow(key, input) {
+    const { provider } = input;
+    // The offering columns are derived here exactly as the store derives them, so
+    // the row the collection writes is already the row the store will confirm.
+    const offeringId = storedOfferingIdFor(provider, input.offeringId ?? defaultOfferingFor(provider, input.authMode));
+    const baseUrl = input.baseUrl ?? offeringBaseUrl(provider, offeringId);
+    const proxyUrl = normalizeProxyUrl(input.proxyUrl);
+    return {
+        id: key,
+        service: 'ai',
+        // The credential descriptor's provider relation (models 0.2.57 names the
+        // field `provider`; the retired `providerId` still compiles because `RowOf`
+        // carries an index signature, and read back `undefined` at runtime).
+        provider: provider === 'custom'
+            ? customCredentialProviderRelation(key)
+            : credentialProviderRelation(provider),
+        authMode: input.authMode,
+        status: 'active',
+        accountLabel: input.accountLabel,
+        label: input.accountLabel,
+        keyVersion: '1',
+        reauthRequired: false,
+        encryptionAlgorithm: 'PLAINTEXT',
+        offeringId,
+        ...(baseUrl ? { baseUrl } : {}),
+        ...(proxyUrl ? { proxyUrl } : {}),
+        metadata: credentialOfferingMetadata({ offeringId, baseUrl }),
+    };
+}
+/**
+ * The credential mutations of `AiConnectionsClient`, backed by the collection.
+ *
+ * Everything the descriptor declares is written through `insert` / `update` /
+ * `delete`, so it is optimistic, rolls back on rejection and reconciles with the
+ * document instead of being overwritten by the next read. Everything it cannot
+ * express - the secret envelope, `offeringId`, `metadata`, base URLs,
+ * `compatibility` - is written by the store within the same user action; if that
+ * completion fails, the row the collection created is deleted again and a
+ * partially applied update is put back, so a failed write leaves no
+ * half-written credential behind.
+ */
+export function collectionCredentialMutations(credentials, store) {
+    const { collection } = credentials;
+    const discard = async (key) => {
+        await deleteCredentialRow(collection, key).catch(() => undefined);
+    };
+    const summaryOf = (key, provider) => {
+        const row = collection.get(key);
+        return row ? credentialSummaryFromRow(row, provider) : undefined;
+    };
+    const create = async (provider, key, row, complete) => {
+        await insertCredentialRow(collection, row);
+        try {
+            const completed = await complete(credentialResource.buildId({ id: key }));
+            const summary = completed ?? summaryOf(key, provider);
+            if (!summary)
+                throw new Error('credential_create_failed');
+            return summary;
+        }
+        catch (error) {
+            await discard(key);
+            throw error;
+        }
+    };
+    return {
+        async createApiKeyCredential(provider, input) {
+            if (!store.createApiKeyCredential)
+                throw new Error('credential_store_unavailable');
+            const key = credentialRowKeyFor(provider, 'apiKey');
+            const label = input.label ?? provider;
+            return await create(provider, key, newCredentialRow(key, {
+                provider,
+                authMode: 'apiKey',
+                accountLabel: label,
+                offeringId: input.offeringId,
+                baseUrl: input.baseUrl,
+                proxyUrl: input.proxyUrl,
+            }), (id) => store.createApiKeyCredential(provider, { ...input, label, id }));
+        },
+        async createLocalCredential(provider, input) {
+            if (!store.createLocalCredential)
+                throw new Error('credential_store_unavailable');
+            const key = credentialRowKeyFor(provider, 'local');
+            const label = input.label ?? 'Local';
+            return await create(provider, key, newCredentialRow(key, {
+                provider,
+                authMode: 'local',
+                accountLabel: label,
+                offeringId: input.offeringId,
+                baseUrl: input.baseUrl,
+            }), (id) => store.createLocalCredential(provider, { ...input, label, id }));
+        },
+        async updateProviderCredential(provider, credentialId, input) {
+            const key = credentialRowKey(credentialId);
+            if (!key)
+                throw new Error('credential_not_found');
+            // `label` and `enabled` are descriptor fields: they land optimistically
+            // through the collection. Priority and base URLs are not, so they go to
+            // the store within the same call. Built as a literal because models 0.2.59
+            // declares these row fields readonly.
+            const patch = {
+                ...(input.label === undefined ? {} : { label: input.label, accountLabel: input.label }),
+                ...(input.enabled === undefined ? {} : { status: input.enabled ? 'active' : 'disabled' }),
+            };
+            const before = collection.get(key);
+            if (Object.keys(patch).length > 0)
+                await updateCredentialRow(collection, key, patch);
+            const attributes = {
+                ...(input.priority === undefined ? {} : { priority: input.priority }),
+                ...(input.baseUrl === undefined ? {} : { baseUrl: input.baseUrl }),
+                ...(input.proxyUrl === undefined ? {} : { proxyUrl: input.proxyUrl }),
+            };
+            if (Object.keys(attributes).length === 0)
+                return summaryOf(key, provider);
+            if (!store.updateProviderCredential)
+                throw new Error('credential_store_unavailable');
+            try {
+                const completed = await store.updateProviderCredential(provider, credentialId, {
+                    expectedVersion: input.expectedVersion,
+                    ...attributes,
+                });
+                return completed ?? summaryOf(key, provider);
+            }
+            catch (error) {
+                // The optimistic part must not survive a rejected completion: put the
+                // row's own fields back, then report the failure.
+                if (before && Object.keys(patch).length > 0) {
+                    await updateCredentialRow(collection, key, {
+                        ...(patch.label === undefined ? {} : {
+                            label: before.label,
+                            accountLabel: before.accountLabel,
+                        }),
+                        ...(patch.status === undefined ? {} : { status: before.status }),
+                    }).catch(() => undefined);
+                }
+                throw error;
+            }
+        },
+        async deleteProviderCredential(provider, credentialId) {
+            const key = credentialRowKey(credentialId);
+            if (!key)
+                return undefined;
+            const before = summaryOf(key, provider);
+            await deleteCredentialRow(collection, key);
+            return before;
+        },
+    };
+}

package/node_modules/@undefineds.co/ai-connections/dist/collections.d.ts

@@ -0,0 +1,119 @@
+import { credentialDescriptor } from '@undefineds.co/models';
+import type { PodCollection, RowOf } from '@undefineds.co/pod-collections';
+import type { AiConnectionsProvider, AiProviderCredentialSummary, AiProviderSummary } from '@undefineds.co/ai-connections-core/client';
+/**
+ * The credentials table, declared once (`docs/pod-collections.md` §6.4-2).
+ *
+ * This module is the *shape* of the table and everything that can be computed
+ * from a row without the collection layer: the row type, the projection of a row
+ * into the summary the page renders, and the enrichment carriers. Nothing here
+ * imports `@undefineds.co/pod-collections` at runtime - the row type is a type,
+ * and the two things that do need the layer (declaring the table, reading and
+ * writing its rows) live in `./collection-runtime`, which is reached through the
+ * dynamic import below. That is what keeps the engine out of the settings
+ * entry's chunk and out of any page that renders without live rows (§9-9).
+ *
+ * The one read the page does here, `useCredentialRows`, is a `useSyncExternalStore`
+ * subscription to a rows source (the controller's live snapshot of the
+ * collection). It is deliberately not `@tanstack/react-db`'s `useLiveQuery`: the
+ * page needs "all rows of one table, once its first read landed", which the
+ * collection's own change feed answers, and loading a hook lazily would force
+ * the whole panel to remount when the chunk arrived. The design doc names this
+ * exit explicitly (§7.4-4, §8.7-5: engine only, no react hook).
+ *
+ * ## What the collection can carry, and what it cannot (yet)
+ *
+ * Rows are the descriptor's projection: `id`, `service`, `provider`, `label`,
+ * `accountLabel`, `authMode`, `status`, `keyVersion`, `expiresAt`,
+ * `reauthRequired`, … The known schema drift (locked by
+ * `packages/pod-collections/test/guards.test.ts`) means `offeringId`,
+ * `metadata`, `baseUrl` and `proxyUrl` are **not** projectable, and `secret`
+ * fields are not projected however they are written. So
+ *
+ * - reading carries the undeclared attributes over from the store's own summary
+ *   of the same row (`credentialCarriers`), and
+ * - writing hands them to the store (`AiConnectionsPodStore`), which owns those
+ *   columns and the secret envelope.
+ *
+ * Both are migration-window behaviour. models 0.2.57 now declares all four, so
+ * their delete condition is formally met, but they stay until the descriptor
+ * projection work (P4) retires the carrier path as a whole - removing them one
+ * at a time would leave reads and writes disagreeing in between.
+ */
+/** A credentials-table row as the collection projects it. */
+export type CredentialRow = RowOf<typeof credentialDescriptor>;
+/** The collection's `syncState` is the page's availability signal. */
+export interface CredentialCollection {
+    readonly collection: PodCollection<CredentialRow>;
+}
+/**
+ * A live rows source: the controller's snapshot of the credentials collection.
+ *
+ * `credentialRows` is `undefined` until the collection's first read lands - and
+ * stays `undefined` while the collection layer is still loading, when the host
+ * offers no `podCollections` capability, or after a failed first read. The page
+ * keeps its store-backed rendering in every one of those states.
+ */
+export interface CredentialRowsSource {
+    subscribe(listener: () => void): () => void;
+    readonly credentialRows?: readonly CredentialRow[];
+}
+/**
+ * Live rows for the credentials table. Re-renders on sync and on optimistic
+ * writes, because the source is the collection's own change feed.
+ */
+export declare function useCredentialRows(source: CredentialRowsSource): readonly CredentialRow[] | undefined;
+/** The lazy half of this module's subject: everything that needs the engine. */
+export type CredentialCollectionRuntime = typeof import('./collection-runtime');
+/**
+ * The collection layer at the point of use, fetched once.
+ *
+ * This is the applet's only dynamic import of it: the settings entry and the
+ * applet's own chunk contain no part of the engine, and a page that never
+ * reaches the credentials list never fetches it.
+ */
+export declare function credentialCollectionRuntime(): Promise<CredentialCollectionRuntime>;
+/**
+ * The row's resource id in the shape the rest of the applet uses for
+ * credentials: `credentials.ttl#<key>`. The collection's key is only the
+ * `resourceIdPattern` slot (`#{id}` → `openai-<uuid>`), so the document segment
+ * comes from the same models builder the store writes with.
+ */
+export declare function credentialIdOfRow(row: CredentialRow): string;
+/**
+ * Which provider a row belongs to, from the row's own `provider` relation.
+ *
+ * Rows have to be attributable without the store's help: a credential another
+ * device just wrote reaches this page as a live row, before any summary read
+ * has seen it.
+ */
+export declare function providerOfCredentialRow(row: CredentialRow): AiConnectionsProvider | undefined;
+/**
+ * A row as the page's credential summary.
+ *
+ * The row wins for everything the descriptor declares; `carrier` - the store's
+ * summary of the same credential - supplies the attributes the descriptor cannot
+ * project and the secret-derived hint. A row the store has not read yet (an
+ * optimistic insert) falls back to the descriptor's own defaults.
+ */
+export declare function credentialSummaryFromRow(row: CredentialRow, provider: AiConnectionsProvider, carrier?: AiProviderCredentialSummary): AiProviderCredentialSummary;
+/** The provider's credential list, rebuilt from the live rows of one table document. */
+export declare function credentialSummariesForProvider(provider: AiConnectionsProvider, rows: readonly CredentialRow[], carrier?: readonly AiProviderCredentialSummary[]): AiProviderCredentialSummary[];
+/**
+ * The enrichment carrier per provider: the store's own summary of every
+ * credential, plus any credential a mutation of this session added and the store
+ * has not read back yet.
+ *
+ * The store's entries win where both know the same credential - it is the
+ * independent read - and the session's overlay only fills the gap, so a
+ * just-created row keeps its offering and base URL while it is still optimistic.
+ */
+export declare function credentialCarriers(storeProducts: Partial<Record<AiConnectionsProvider, AiProviderSummary>>, overlayProducts: Partial<Record<AiConnectionsProvider, AiProviderSummary>>): Partial<Record<AiConnectionsProvider, readonly AiProviderCredentialSummary[]>>;
+/**
+ * The provider products the page renders, with every credential list rebuilt
+ * from the live rows.
+ *
+ * `carriers` only enriches: which credentials exist, and every field the
+ * descriptor declares, come from the rows.
+ */
+export declare function withLiveCredentials(products: Partial<Record<AiConnectionsProvider, AiProviderSummary>>, carriers: Partial<Record<AiConnectionsProvider, readonly AiProviderCredentialSummary[]>>, rows: readonly CredentialRow[] | undefined): Partial<Record<AiConnectionsProvider, AiProviderSummary>>;

package/node_modules/@undefineds.co/ai-connections/dist/collections.js

@@ -0,0 +1,173 @@
+import { credentialResource } from '@undefineds.co/models';
+import { useSyncExternalStore } from 'react';
+import { AI_CONNECTIONS_PROVIDERS } from '@undefineds.co/ai-connections-core/client';
+import { defaultOfferingFor } from '@undefineds.co/ai-connections-core/provider-catalog';
+import { providerOfCredentialKey, providerResourceKey } from '@undefineds.co/ai-connections-core/client';
+/**
+ * Live rows for the credentials table. Re-renders on sync and on optimistic
+ * writes, because the source is the collection's own change feed.
+ */
+export function useCredentialRows(source) {
+    return useSyncExternalStore(source.subscribe, () => source.credentialRows, () => source.credentialRows);
+}
+let runtime;
+/**
+ * The collection layer at the point of use, fetched once.
+ *
+ * This is the applet's only dynamic import of it: the settings entry and the
+ * applet's own chunk contain no part of the engine, and a page that never
+ * reaches the credentials list never fetches it.
+ */
+export function credentialCollectionRuntime() {
+    runtime ?? (runtime = import('./collection-runtime.js'));
+    return runtime;
+}
+/**
+ * The row's resource id in the shape the rest of the applet uses for
+ * credentials: `credentials.ttl#<key>`. The collection's key is only the
+ * `resourceIdPattern` slot (`#{id}` → `openai-<uuid>`), so the document segment
+ * comes from the same models builder the store writes with.
+ */
+export function credentialIdOfRow(row) {
+    return credentialResource.buildId({ id: String(row.id) });
+}
+/**
+ * Which provider a row belongs to, from the row's own `provider` relation.
+ *
+ * Rows have to be attributable without the store's help: a credential another
+ * device just wrote reaches this page as a live row, before any summary read
+ * has seen it.
+ */
+export function providerOfCredentialRow(row) {
+    // `RowOf` carries an index signature (models types `fields` as
+    // `Record<string, PodModelFieldDescriptor>`), so a stale attribute name
+    // type-checks and reads back `undefined` at runtime instead of failing the
+    // build. `collections.test.ts` pins this read against a row whose id does not
+    // embed its provider, which is the only case the fallback below cannot answer.
+    const relation = typeof row.provider === 'string' ? row.provider : undefined;
+    const key = providerResourceKey(relation);
+    if (key) {
+        if (key.startsWith('custom-instance-'))
+            return 'custom';
+        const declared = AI_CONNECTIONS_PROVIDERS.find((provider) => key === provider || key.startsWith(`${provider}-`));
+        if (declared)
+            return declared;
+    }
+    // A row without a provider relation still declares one in its own key
+    // (`openai-<uuid>`); the store's reader falls back the same way.
+    return providerOfCredentialKey(String(row.id));
+}
+function stringValue(value) {
+    return typeof value === 'string' && value.trim() ? value : undefined;
+}
+function numberValue(value) {
+    if (typeof value === 'number' && Number.isFinite(value))
+        return value;
+    if (typeof value === 'string' && value.trim()) {
+        const parsed = Number(value);
+        return Number.isFinite(parsed) ? parsed : undefined;
+    }
+    return undefined;
+}
+function isoStringValue(value) {
+    if (value instanceof Date)
+        return value.toISOString();
+    return stringValue(value);
+}
+function authModeValue(value) {
+    if (value === 'oauth' || value === 'deviceCode' || value === 'apiKey' || value === 'local') {
+        return value;
+    }
+    if (value === 'deviceCodeOAuth')
+        return 'deviceCode';
+    return undefined;
+}
+/**
+ * A row as the page's credential summary.
+ *
+ * The row wins for everything the descriptor declares; `carrier` - the store's
+ * summary of the same credential - supplies the attributes the descriptor cannot
+ * project and the secret-derived hint. A row the store has not read yet (an
+ * optimistic insert) falls back to the descriptor's own defaults.
+ */
+export function credentialSummaryFromRow(row, provider, carrier) {
+    const authMode = authModeValue(row.authMode) ?? carrier?.authMode ?? 'apiKey';
+    const status = stringValue(row.status);
+    // models 0.2.59 types this column as a boolean; a Pod written by an older
+    // release can still carry the literal as a string, so keep tolerating both.
+    const reauthRequired = row.reauthRequired === true || String(row.reauthRequired) === 'true';
+    return {
+        id: String(row.id),
+        provider,
+        offeringId: carrier?.offeringId ?? defaultOfferingFor(provider, authMode),
+        authMode,
+        label: stringValue(row.accountLabel) ?? stringValue(row.label) ?? carrier?.label,
+        enabled: status === undefined ? carrier?.enabled ?? true : status === 'active',
+        priority: carrier?.priority ?? 100,
+        health: reauthRequired ? 'expired' : carrier?.health ?? 'unknown',
+        maskedHint: carrier?.maskedHint,
+        baseUrl: carrier?.baseUrl,
+        proxyUrl: carrier?.proxyUrl,
+        compatibility: carrier?.compatibility,
+        expiresAt: isoStringValue(row.expiresAt) ?? carrier?.expiresAt,
+        version: numberValue(row.keyVersion) ?? carrier?.version ?? 0,
+    };
+}
+/** The provider's credential list, rebuilt from the live rows of one table document. */
+export function credentialSummariesForProvider(provider, rows, carrier = []) {
+    const byId = new Map(carrier.map((credential) => [credential.id, credential]));
+    const summaries = [];
+    for (const row of rows) {
+        if (providerOfCredentialRow(row) !== provider)
+            continue;
+        summaries.push(credentialSummaryFromRow(row, provider, byId.get(String(row.id))));
+    }
+    return summaries;
+}
+/**
+ * The enrichment carrier per provider: the store's own summary of every
+ * credential, plus any credential a mutation of this session added and the store
+ * has not read back yet.
+ *
+ * The store's entries win where both know the same credential - it is the
+ * independent read - and the session's overlay only fills the gap, so a
+ * just-created row keeps its offering and base URL while it is still optimistic.
+ */
+export function credentialCarriers(storeProducts, overlayProducts) {
+    const carriers = {};
+    for (const provider of AI_CONNECTIONS_PROVIDERS) {
+        const byId = new Map();
+        for (const credential of overlayProducts[provider]?.credentials ?? []) {
+            byId.set(credential.id, credential);
+        }
+        for (const credential of storeProducts[provider]?.credentials ?? []) {
+            byId.set(credential.id, credential);
+        }
+        carriers[provider] = [...byId.values()];
+    }
+    return carriers;
+}
+/**
+ * The provider products the page renders, with every credential list rebuilt
+ * from the live rows.
+ *
+ * `carriers` only enriches: which credentials exist, and every field the
+ * descriptor declares, come from the rows.
+ */
+export function withLiveCredentials(products, carriers, rows) {
+    if (!rows)
+        return products;
+    const live = {};
+    for (const provider of AI_CONNECTIONS_PROVIDERS) {
+        const product = products[provider];
+        if (!product)
+            continue;
+        live[provider] = {
+            ...product,
+            credentials: credentialSummariesForProvider(provider, rows, carriers[provider] ?? []),
+        };
+    }
+    // Providers outside the catalog keep whatever the store reported: the page
+    // never renders them from this table.
+    return { ...products, ...live };
+}