Files
roshan cc110e2bbf feat(llm): add TypeSafe AI provider setup (#16262)
## Summary

Add TypeSafe AI as a model provider so admins can save System One
credentials before decision-model support lands.

- Add the real TypeSafe AI logo, provider card, and credential form in
Language Models.
- Test credentials through TypeSafe's native System One endpoint and
reuse encrypted provider storage.
- Support creation, editing, and deletion without creating chat models
or setting a chat default.
- Keep TypeSafe out of chat onboarding. Reject tests that send saved
credentials to another provider.
- Keep the setup form focused on credentials. Remove the roadmap and
internal validation paragraph from all nine locales.

This PR covers provider setup only. #16276 moves TypeSafe to the
dedicated Decision Models page and adds discovery and optional
selection. No review or classification workflow ships in this stack.

## Validation

- Previously created and edited the provider in the live admin UI with a
real TypeSafe key. Verified saved credentials against System One.
- Confirmed that the provider stores no chat models, stays out of chat
listings, and can be deleted through the API.
- 232 backend unit tests, 25 PostgreSQL tests, and 12 frontend tests
passed.
- Touched-file hooks passed for typing, lint, formatting, translations,
secrets, and feature-map checks.
- After the copy removal, ten setup and locale tests passed on this PR.
Thirteen passed on the full stack. Typecheck and lint passed.

## Screenshots

Current provider-only setup at `475ae5d`, with the real TypeSafe AI logo
and no implementation-status paragraph. Credentials are empty. This
screenshot is separate from the earlier real-key validation.

![TypeSafe AI System One provider
setup](https://github.com/user-attachments/assets/6142bd45-e75c-4621-b154-b75219085f2e)

## Stack testing (`29eec61fb4`)

Tested the full stack at the top commit on a local dev stack, desktop
and 390×844 mobile. OpenAI decisions and chat used a real key. TypeSafe,
Zoom, OpenRouter, and Vercel AI Gateway used local mock upstreams; Onyx
auth, validation, persistence, encryption, and UI were real.

- Passed: bad credentials show an error; good credentials reach
`/v1/systemone`.
- Passed: create, rename, refresh, model removal, and delete.
- Passed: TypeSafe stores decision models only, never becomes the chat
default, and is absent from the chat picker.
- Passed: both credential-test endpoints reject reuse of saved TypeSafe
credentials against another provider; no request reached the other base.

![TypeSafe desktop and
mobile](https://app.devin.ai/api/presigned_proxy?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjpudWxsLCJidWNrZXRfbmFtZSI6ImRldmluYXR0YWNobWVudHMiLCJidWNrZXRfa2V5IjoiYXR0YWNobWVudHNfcHJpdmF0ZS9vcmdfT2NlNnlnR2RrdGJQekZsaS9jMjZjOGZjNy1jOWI4LTQzYTktYmMxMi04MGNiODQ4YTZiNDYiLCJpYXQiOjE3OTI2MTA4NjQsIm9yZ19pZCI6Im9yZ19PY2U2eWdHZGt0YlB6RmxpIiwiZmlsZW5hbWUiOiJ0eXBlc2FmZS1kZXNrdG9wLW1vYmlsZS5wbmcifQ.r4M2e6HMLKPhrmT4SfbRcrlBWycQgmKQXvIrLmBv6mE)

![TypeSafe
flow](https://app.devin.ai/api/presigned_proxy?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjpudWxsLCJidWNrZXRfbmFtZSI6ImRldmluYXR0YWNobWVudHMiLCJidWNrZXRfa2V5IjoiYXR0YWNobWVudHNfcHJpdmF0ZS9vcmdfT2NlNnlnR2RrdGJQekZsaS8yYzZkM2Q0Yi04ZDcxLTQyMmYtOTYwMi01MTAzNTE4ZWYwZDMiLCJpYXQiOjE3OTI2MTA4NjQsIm9yZ19pZCI6Im9yZ19PY2U2eWdHZGt0YlB6RmxpIiwiZmlsZW5hbWUiOiJ0eXBlc2FmZS1mbG93LndlYnAifQ.N-88hUq9h6n3N_y9OQADTEaXe93FRGOz7EhtVxDY1kI)

![Chat picker excludes
TypeSafe](https://app.devin.ai/api/presigned_proxy?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyX2lkIjpudWxsLCJidWNrZXRfbmFtZSI6ImRldmluYXR0YWNobWVudHMiLCJidWNrZXRfa2V5IjoiYXR0YWNobWVudHNfcHJpdmF0ZS9vcmdfT2NlNnlnR2RrdGJQekZsaS9mZGQwNDE5Yy03YTAwLTQyZmYtYjAwOC03Y2RhMGIxM2U3NGYiLCJpYXQiOjE3OTI2MTA4NjQsIm9yZ19pZCI6Im9yZ19PY2U2eWdHZGt0YlB6RmxpIiwiZmlsZW5hbWUiOiJyZWdyZXNzaW9uLXBpY2tlci1uby10eXBlc2FmZS5wbmcifQ.9-8x1pyxpCssI3uPfpOr0rBGVtbiX1FAOmlfyyqdBdM)

## Stack

PR 1 of 4: **#16262** → #16276 → #16280 → #16284.

Link to Devin session:
https://app.devin.ai/sessions/39d77bde91c34b75922bb05c02b93b90
Open in Devin Desktop:
https://app.devin.ai/desktop/session/39d77bde91c34b75922bb05c02b93b90?variant=devin
Requested by: @rohoswagger
2026-10-21 23:51:26 +00:00
..

Opal

Onyx's TypeScript component library and design system.

Install

bun add @onyx-ai/opal

Peer dependencies (install whichever the lib actually exercises in your usage):

bun add react react-dom next \
  @radix-ui/react-popover \
  @radix-ui/react-slot @radix-ui/react-tooltip \
  @dnd-kit/core @dnd-kit/sortable @dnd-kit/modifiers @dnd-kit/utilities \
  @tanstack/react-table formik \
  react-markdown remark-gfm rehype-sanitize

Setup

1. Import the design tokens once

In your app's root entry (e.g. Next.js app/layout.tsx):

import "@onyx-ai/opal/styles.css";

The CSS file defines the custom properties (--text-01, --background-neutral-00, etc.) that the Tailwind preset references.

2. Wire up the Tailwind preset

In your tailwind.config.js:

module.exports = {
  presets: [require("@onyx-ai/opal/tailwind-preset")],
  content: [
    "./src/**/*.{ts,tsx}",
    "./node_modules/@onyx-ai/opal/dist/**/*.{js,mjs}",
  ],
};

The content glob ensures Tailwind picks up the classes used inside Opal components.

You also need to define the underlying CSS variables (--text-01, etc.) in your own colors.css or import a copy from Onyx. The preset references them but does not define them — they live with the consumer so the consumer controls the palette.

Usage

import { Button, Text } from "@onyx-ai/opal/components";
import { Content } from "@onyx-ai/opal/layouts";
import SvgPlus from "@onyx-ai/opal/icons/plus";

function MyComponent() {
  return (
    <Content
      icon={SvgPlus}
      title="Hello"
      description="World"
      sizePreset="main-ui"
      variant="section"
    />
  );
}

Subpath imports

Subpath Contents
@onyx-ai/opal/components Buttons, Text, Tag, Tooltip, Popover, Table, etc.
@onyx-ai/opal/layouts Content, ContentAction, IllustrationContent, Section
@onyx-ai/opal/core Interactive primitives, Hoverable, Disabled
@onyx-ai/opal/icons SVG icon components
@onyx-ai/opal/illustrations Larger SVG illustrations
@onyx-ai/opal/types Shared types (RichStr, IconProps, etc.)
@onyx-ai/opal/utils cn, markdown helpers
@onyx-ai/opal/styles.css Bundled component CSS
@onyx-ai/opal/tailwind-preset Tailwind preset with tokens

Structure

web/lib/opal/
├── src/
│   ├── core/             # Low-level primitives (Interactive, Hoverable, Disabled)
│   ├── components/       # High-level components (Button, Popover, Tooltip, Table, ...)
│   ├── layouts/          # Layout primitives (Content, ContentAction, Section, ...)
│   ├── icons/            # SVG icon components
│   ├── illustrations/    # Larger SVG illustrations
│   ├── logos/            # Brand / product logos
│   ├── types.ts          # Shared types (RichStr, IconProps, etc.)
│   ├── utils.ts          # cn, markdown helpers
│   ├── shared.ts
│   └── root.css          # Library-owned design tokens
├── scripts/
│   └── bundle-css.mjs    # Concatenates root.css + leaf component CSS into dist/styles.css
├── package.json
├── tsconfig.json         # Source typecheck config
├── tsconfig.build.json   # Used by tsdown to emit dist/
├── tsdown.config.ts
├── tailwind-preset.cjs
└── README.md

Local development (inside the Onyx repo)

Opal reuses /web/node_modules — it does not have its own node_modules. To add a runtime dependency, declare it under peerDependencies in web/lib/opal/package.json AND add the matching version in the root web/package.json dependencies block, then run bun install in /web so Onyx's web app keeps building.

The package is consumed by web/ as a workspace via web/package.json's "@onyx-ai/opal": "./lib/opal". During Onyx development, web/ resolves Opal source through the @opal/* TypeScript path alias (defined in web/tsconfig.json), so changes are picked up live without running bun run build.

To produce the published artifact:

cd web/lib/opal
bun run build       # tsdown -> dist/, then bundle-css.mjs -> dist/styles.css

Releasing to npm

Releases go out through the Release Opal GitHub Actions workflow (.github/workflows/release-opal.yml). It uses npm OIDC Trusted Publishers — no NPM_TOKEN, signed provenance attestation. Pushing a tag is the only thing that triggers a release.

Steps:

  1. Bump version in web/lib/opal/package.json (semver: MAJOR.MINOR.PATCH, prerelease suffix -rc.N allowed).

  2. Open a PR with the version bump and any release-shaped changes. Merge it.

  3. From main, tag and push:

    git switch main && git pull
    git tag opal/v0.1.1
    git push origin opal/v0.1.1
    
  4. The workflow runs automatically on tag push. It builds (tsdown + CSS barrel) and runs bun publish --provenance --access public. Watch the run under the Actions tab; verify the new version on https://www.npmjs.com/package/@onyx-ai/opal.

The tag pattern must match opal/v*.*.* for the workflow to fire.

Conventions

  • Component directories are kebab-case (e.g. select-button/, open-button/, content-action/).
  • Each component dir contains components.tsx, README.md, styles.css (when needed), and a <PascalName>.stories.tsx (when applicable).
  • Imports inside the lib use the @opal/ path alias; never @/.
  • Types/interfaces are declared at the top of components.tsx without export; everything is re-exported from a single export { Foo, type FooProps }; block at the bottom.
  • See web/AGENTS.md for broader frontend standards.

Third-party trademarks

The @onyx-ai/opal/logos subpath ships brand marks of third-party products Onyx integrates with. Marks remain the property of their respective owners; Onyx claims no trademark over them. See NOTICE.md for details.