AiSettingsStore.h header

AiSettings ew::app::ai::loadAiSettings(const settings::Settings &settings, const settings::SecretStore &secrets=settings::platformSecretStore())

Loads the user's AiSettings from a Settings store. Reads the endpoint, API key, model, and temperature stored under the "ai/" key prefix; any key that is absent keeps its AiSettings default (so an unconfigured store yields an unconfigured AiSettings). Pure with respect to the store, so it is unit-testable with an in-memory Settings.

The API key is read from the SEALED key first and from the legacy plaintext one only when no sealed value is present, so a store written by an older build still opens. secrets is the seam tests replace; it defaults to the platform's own facility.

void ew::app::ai::saveAiSettings(settings::Settings &settings, const AiSettings &ai, const settings::SecretStore &secrets=settings::platformSecretStore())

Saves ai into settings under the "ai/" key prefix, overwriting any existing values.

The API key is SEALED with secrets and the legacy plaintext key is removed, so saving is also the repair: a store that held a readable key stops holding one the first time it is written. When no secret facility is AVAILABLE the key is written verbatim, as before – losing the user's key would be a worse outcome than storing it the way every previous build did.

A facility that is available and REFUSES is the opposite case and persists nothing: the session keeps the key it already holds, so the cost is re-entering it next launch rather than a readable credential left behind by the very call that was meant to protect it. Distinguishing the two is what settings::SecretStore::isAvailable is for.

bool ew::app::ai::sealStoredApiKey(settings::Settings &settings, const settings::SecretStore &secrets=settings::platformSecretStore())

Seals an API key an older build left in plain text, removing the readable copy. Returns true when it moved one.

Saving repairs the store too, but only for a user who opens the AI settings again – and the whole point is a key that has been sitting readable for months. Called once at startup, this repairs it for everyone. Idempotent: with no plaintext key, or no secret facility, it does nothing and returns false.