fix(provider): keep Veryfront Cloud credentials internal

cli/commands/eval/command.test.ts

@@ -14,8 +14,10 @@ import {
   runEval,
 } from "veryfront/eval";
 import { createEvalReportExporterRegistry } from "veryfront/extensions/eval";
-import { markCurrentVeryfrontCloudBillingGroupUsed } from "veryfront/provider";
 import type { ModelRuntime } from "veryfront/provider";
+import {
+  markCurrentVeryfrontCloudBillingGroupUsed,
+} from "#veryfront/provider/veryfront-cloud/context.ts";
 import { type Tool, tool } from "veryfront/tool";
 import type { ProjectAgentRuntimeDiscovery } from "../../../src/agent/project/agent-runtime.ts";
 import { getActiveSourceIntegrationPolicy } from "../../../src/integrations/source-policy-context.ts";

cli/commands/eval/command.ts

@@ -35,11 +35,11 @@ import {
 } from "veryfront/extensions/eval";
 import { createLLMProviderRegistry, LLMProviderRegistryName } from "veryfront/extensions/llm";
 import { exportEvalReport, resolveEvalRunProvenance, runEval } from "veryfront/eval";
+import { getVeryfrontCloudBootstrap } from "../../../src/platform/cloud/resolver.ts";
 import {
   getCurrentVeryfrontCloudContext,
-  getVeryfrontCloudBootstrap,
   runWithVeryfrontCloudContextAsync,
-} from "veryfront/provider";
+} from "../../../src/provider/veryfront-cloud/context.ts";
 import { applyRuntimeAuthContext, resolveLinkedProjectSlug } from "#cli/shared/runtime-auth";
 import { brand, dim } from "#cli/ui";
 import { cliLogger, exitProcess, isQuiet, VERSION } from "#cli/utils";

docs/api-reference/veryfront/provider.md

@@ -77,13 +77,10 @@ Clear all registered model providers and reset lazy built-ins (for testing).
 | `ensureModelReady`                             | Eagerly verify that the resolved model's runtime is available.                                  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/model-registry.ts#L433)                |
 | `findVeryfrontCloudModel`                      | Find Veryfront Cloud model.                                                                     | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/veryfront-cloud/model-catalog.ts#L297) |
 | `findVeryfrontCloudModelByModelId`             | Find Veryfront Cloud model by model ID.                                                         | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/veryfront-cloud/model-catalog.ts#L309) |
-| `getCurrentVeryfrontCloudContext`              |                                                                                                 | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/veryfront-cloud/context.ts#L31)        |
 | `getRegisteredModelProviders`                  | Get provider names available in the current scope.                                              | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/model-registry.ts#L421)                |
-| `getVeryfrontCloudBootstrap`                   |                                                                                                 | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/cloud/resolver.ts#L121)                |
 | `getVeryfrontCloudProviderFromModelId`         | Return Veryfront Cloud provider from model ID.                                                  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/veryfront-cloud/model-catalog.ts#L317) |
 | `groupVeryfrontCloudModelsByProvider`          | Group Veryfront Cloud models by provider.                                                       | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/veryfront-cloud/model-catalog.ts#L508) |
 | `hasModelProvider`                             | Check whether a model provider is available in the current scope.                               | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/model-registry.ts#L407)                |
-| `markCurrentVeryfrontCloudBillingGroupUsed`    |                                                                                                 | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/veryfront-cloud/context.ts#L35)        |
 | `normalizeVeryfrontCloudModelId`               | Normalizes Veryfront Cloud model ID.                                                            | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/veryfront-cloud/model-catalog.ts#L302) |
 | `registerModelProvider`                        | Register a custom model provider factory for the active project scope or application bootstrap. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/model-registry.ts#L120)                |
 | `resolveModel`                                 | Resolve a "provider/model" string to a framework-compatible model runtime.                      | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/model-registry.ts#L348)                |
@@ -92,8 +89,6 @@ Clear all registered model providers and reset lazy built-ins (for testing).
 | `resolveVeryfrontCloudModelThinking`           | Resolves Veryfront Cloud model thinking.                                                        | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/veryfront-cloud/model-catalog.ts#L394) |
 | `resolveVeryfrontCloudReasoningOption`         | Resolves provider-neutral runtime reasoning for a Veryfront Cloud model.                        | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/veryfront-cloud/model-catalog.ts#L414) |
 | `resolveVeryfrontCloudThinkingProviderOptions` | Options accepted by resolve Veryfront Cloud thinking provider.                                  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/veryfront-cloud/model-catalog.ts#L448) |
-| `runWithVeryfrontCloudContext`                 | Context for run with Veryfront Cloud.                                                           | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/veryfront-cloud/context.ts#L16)        |
-| `runWithVeryfrontCloudContextAsync`            | Run with Veryfront Cloud context async.                                                         | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/veryfront-cloud/context.ts#L24)        |
 | `tryGetVeryfrontCloudProviderFromModelId`      | Try to get Veryfront Cloud provider from model ID.                                              | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/veryfront-cloud/model-catalog.ts#L331) |
 
 ### Types
@@ -103,9 +98,7 @@ Clear all registered model providers and reset lazy built-ins (for testing).
 | `ModelProviderFactory`              | Public API contract for model provider factory.       | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/model-registry.ts#L34)                |
 | `ModelProviderRegistrationDisposer` |                                                       | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/model-registry.ts#L35)                |
 | `ModelRuntime`                      | Public API contract for model runtime.                | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/types.ts#L221)                        |
-| `VeryfrontCloudBootstrap`           |                                                       | [source](https://github.com/veryfront/veryfront-code/blob/main/src/platform/cloud/resolver.ts#L49)                |
 | `VeryfrontCloudChatModel`           | Public API contract for Veryfront Cloud chat model.   | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/veryfront-cloud/model-catalog.ts#L19) |
-| `VeryfrontCloudContext`             | Context for Veryfront Cloud.                          | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/veryfront-cloud/context.ts#L4)        |
 | `VeryfrontCloudModelThinkingConfig` | Configuration used by Veryfront Cloud model thinking. | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/veryfront-cloud/model-catalog.ts#L12) |
 | `VeryfrontCloudProviderId`          | Public API contract for Veryfront Cloud provider ID.  | [source](https://github.com/veryfront/veryfront-code/blob/main/src/provider/veryfront-cloud/model-catalog.ts#L4)  |
 

scripts/docs/verify-npm-exports.mjs

@@ -69,8 +69,6 @@ const REQUIRED_EXPORTS = {
     "resolveModel",
     "hasModelProvider",
     "getRegisteredModelProviders",
-    "runWithVeryfrontCloudContext",
-    "runWithVeryfrontCloudContextAsync",
   ],
   "./fs": ["readTextFile", "writeTextFile", "join", "resolve", "exists", "mkdir"],
 };

scripts/docs/verify-npm-node.mjs

@@ -184,13 +184,7 @@ try {
   assertType(prov.hasModelProvider, "function", "hasModelProvider is function");
   assertType(prov.getRegisteredModelProviders, "function", "getRegisteredModelProviders is function");
   assertType(prov.clearModelProviders, "function", "clearModelProviders is function");
-  assertType(prov.runWithVeryfrontCloudContext, "function", "runWithVeryfrontCloudContext is function");
-  assertType(
-    prov.runWithVeryfrontCloudContextAsync,
-    "function",
-    "runWithVeryfrontCloudContextAsync is function",
-  );
-  console.log("  OK    provider — 7 checks");
+  console.log("  OK    provider — 5 checks");
 } catch (err) {
   failed++;
   errors.push(`provider: ${err.message}`);

src/agent/factory-call-context.test.ts

@@ -4,7 +4,8 @@ import { FakeTime } from "#std/testing/time";
 import "#veryfront/schemas/_test-setup.ts";
 import { assertEquals, assertStringIncludes } from "#veryfront/testing/assert.ts";
 import { afterEach, describe, it } from "#veryfront/testing/bdd.ts";
-import { registerModelProvider, runWithVeryfrontCloudContextAsync } from "#veryfront/provider";
+import { registerModelProvider } from "#veryfront/provider";
+import { runWithVeryfrontCloudContextAsync } from "#veryfront/provider/veryfront-cloud/context.ts";
 import { deleteEnv, getEnv, setEnv } from "#veryfront/compat/process.ts";
 import { registerSkill } from "#veryfront/skill/registry.ts";
 import { tool } from "#veryfront/tool";

src/agent/hosted/cloud-chat-execution-preparation.ts

@@ -1,7 +1,5 @@
-import {
-  resolveVeryfrontCloudModelThinking,
-  runWithVeryfrontCloudContext,
-} from "#veryfront/provider";
+import { resolveVeryfrontCloudModelThinking } from "#veryfront/provider";
+import { runWithVeryfrontCloudContext } from "#veryfront/provider/veryfront-cloud/context.ts";
 import { resolveRuntimeModel } from "../runtime/model-resolution.ts";
 import type { HostedChatRuntimeCreationResult } from "./chat-runtime-contract.ts";
 import {

src/agent/hosted/context-summary-generator.ts

@@ -3,8 +3,8 @@ import {
   resolveModel,
   resolveVeryfrontCloudGatewayModelId,
   resolveVeryfrontCloudModelId,
-  runWithVeryfrontCloudContextAsync,
 } from "../../provider/index.ts";
+import { runWithVeryfrontCloudContextAsync } from "#veryfront/provider/veryfront-cloud/context.ts";
 import { generateText } from "../../runtime/runtime-bridge.ts";
 import { redactSensitive, sanitizeUrlCredentials } from "#veryfront/utils";
 import type { TextGenerationRuntimeMessage } from "../runtime/text-generation-runtime-message-types.ts";

src/platform/cloud/resolver.test.ts

@@ -7,7 +7,7 @@ import {
   _setRuntimeConfigForTesting,
   createTestConfig,
 } from "#veryfront/config/runtime-config.ts";
-import { runWithVeryfrontCloudContext } from "#veryfront/provider";
+import { runWithVeryfrontCloudContext } from "#veryfront/provider/veryfront-cloud/context.ts";
 import { runWithProjectEnv } from "#veryfront/server/project-env";
 import {
   getDefaultVeryfrontCloudEmbeddingModel,

src/provider/index.test.ts

@@ -0,0 +1,20 @@
+import { assertEquals } from "#veryfront/testing/assert.ts";
+import { describe, it } from "#veryfront/testing/bdd.ts";
+import * as provider from "./index.ts";
+
+describe("provider public API", () => {
+  it("does not expose credential-bearing cloud internals", () => {
+    const internalExports = [
+      "getCurrentVeryfrontCloudContext",
+      "getVeryfrontCloudBootstrap",
+      "markCurrentVeryfrontCloudBillingGroupUsed",
+      "runWithVeryfrontCloudContext",
+      "runWithVeryfrontCloudContextAsync",
+    ];
+
+    assertEquals(
+      Object.keys(provider).filter((name) => internalExports.includes(name)),
+      [],
+    );
+  });
+});

src/provider/index.ts

@@ -21,15 +21,6 @@ export {
 } from "./model-registry.ts";
 export type { ModelProviderFactory, ModelProviderRegistrationDisposer } from "./model-registry.ts";
 export type { ModelRuntime } from "./types.ts";
-export {
-  getCurrentVeryfrontCloudContext,
-  markCurrentVeryfrontCloudBillingGroupUsed,
-  runWithVeryfrontCloudContext,
-  runWithVeryfrontCloudContextAsync,
-} from "./veryfront-cloud/context.ts";
-export type { VeryfrontCloudContext } from "./veryfront-cloud/context.ts";
-export { getVeryfrontCloudBootstrap } from "../platform/cloud/resolver.ts";
-export type { VeryfrontCloudBootstrap } from "../platform/cloud/resolver.ts";
 export type { VeryfrontCloudProviderId } from "./veryfront-cloud/model-catalog.ts";
 export {
   DEFAULT_VERYFRONT_CLOUD_MODEL_ID,

src/provider/veryfront-cloud/shared.test.ts

@@ -2,7 +2,7 @@ import "#veryfront/schemas/_test-setup.ts";
 import { assertEquals, assertRejects, assertThrows } from "#veryfront/testing/assert.ts";
 import { describe, it } from "#veryfront/testing/bdd.ts";
 import { withMockFetch } from "#veryfront/testing/mock-fetch.ts";
-import { runWithVeryfrontCloudContext } from "#veryfront/provider";
+import { runWithVeryfrontCloudContext } from "#veryfront/provider/veryfront-cloud/context.ts";
 import {
   createVeryfrontCloudFetch,
   getVeryfrontCloudGatewayBaseUrl,

src/runs/runs-client.test.ts

@@ -8,7 +8,7 @@ import {
   assertStringIncludes,
 } from "#veryfront/testing/assert";
 import { withEnv } from "#veryfront/testing/deno-compat.ts";
-import { runWithVeryfrontCloudContext } from "#veryfront/provider";
+import { runWithVeryfrontCloudContext } from "#veryfront/provider/veryfront-cloud/context.ts";
 import {
   createRunsClient,
   VeryfrontRunsClient,

src/workflow/blob/veryfront-cloud-storage.test.ts

@@ -3,7 +3,7 @@ import { installMockFetch, restoreMockFetch } from "#veryfront/testing/mock-fetc
 import { assertEquals, assertExists, assertRejects } from "#veryfront/testing/assert.ts";
 import { afterEach, describe, it } from "#veryfront/testing/bdd.ts";
 import { runWithRequestContext } from "#veryfront/platform/adapters/fs/veryfront/multi-project-adapter.ts";
-import { runWithVeryfrontCloudContext } from "#veryfront/provider";
+import { runWithVeryfrontCloudContext } from "#veryfront/provider/veryfront-cloud/context.ts";
 import { VeryfrontCloudBlobStorage } from "./veryfront-cloud-storage.ts";
 
 const FIXED_NOW = new Date("2026-03-08T12:00:00.000Z");