@skaile/forge-settings 1.3.2 → 1.4.0

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 1.4.0
+
+- `<ForgeProvidersPanel>` adds a provider as a flow: a library of the catalog presets (plus Custom), then *How do you sign in?* listing only the kinds the preset accepts, the fields of that kind and the preset's routing parameters, then a done step that tests every created entry when a `client` is passed. New boolean prop `expert` (default `false`): adds the raw Reference form (`env:` / `keyring:` / `cmd:` / `platform:`) to the sign-in step and makes `api_version` editable. Detected-preset Add and Edit keep working; Edit skips the library.
+- **Microsoft Azure** library card: resource name, one sign-in (Entra ID or API key), then Azure OpenAI (deployment rows → `model_map`, `api_version` prefilled `2025-04-01-preview`) and/or Claude on Foundry. Writes up to two entries (presets `azure-openai`, `foundry`) sharing `params.resource` and the credential; a refusal after the first write names the entries already created.
+- Provider rows show an account line ("Microsoft Azure · Entra ID · contoso-ai": family · sign-in kind · resource) and, when the entry view carries `credentialExpiresAt`, "Expires in N days · Renew" (Renew re-opens the sign-in). No registry API reports an expiry yet, so the line appears only for hosts that set the field.
+- New test ids: `provider-library`, `provider-library-<presetId>`, `provider-library-azure`, `provider-library-custom`, `provider-back`, `provider-signin`, `provider-signin-<optionId>`, `provider-param-<key>`, `provider-azure-resource`, `provider-azure-openai`, `provider-azure-foundry`, `provider-azure-deployments`, `provider-azure-deployment-<i>`, `provider-azure-model-<i>`, `provider-azure-deployment-remove-<i>`, `provider-azure-deployment-add`, `provider-azure-api-version`, `provider-done`, `provider-created-<id>`, `provider-created-result-<id>`, `provider-created-test-<id>`, `provider-done-close`, `provider-account-<id>`, `provider-expiry-<id>`, `provider-renew-<id>`. Existing ids are unchanged.
+- `/server` and `/vue` export the browser-safe account helpers: `presetSignInOptions`, `signInCredential`, `signInOptionOf`, `missingRequiredParams`, `presetParamKeys`, `defaultParamValue`, `isAzureTransport`, `providerAccountLine`, `providerFamilyLabel`, `credentialExpiry`, `deploymentModelMap`, `azureAccountEntries`, `CREDENTIAL_KIND_LABELS`, `PROVIDER_PARAM_LABELS`, `EXPERT_PARAMS`, `AZURE_TRANSPORTS`, `AZURE_FAMILY_LABEL`, `AZURE_OPENAI_PRESET`, `FOUNDRY_PRESET`, `AZURE_OPENAI_DEFAULT_API_VERSION`, and their types.
+- `upsertProviderEntry` accepts `params` (an omitting body keeps them, `params: {}` removes them). A catalog preset's required parameter that neither the entry nor a lower document's entry supplies is refused with 400 naming it (`data.missingParams`); keys the transport does not accept are refused by the SDK schema as before (`data.diagnostics`). `withProviderLayers` carries `params` in `layerFields`.
+- `providerPresetSummaries()` adds each preset's `transport`, `params` and `required_params`; `listAIProviders` views add `transport` and `transportParams` for `llm` / `embed` entries.
+- Harness roles ("models per task"): new setting `harnessRoles` (harness id → role → `providerId/modelId`), exported `HARNESS_ROLES` (omp: default, smol, slow, vision, plan, designer, commit, tiny, task, advisor; continue: chat, edit, apply, autocomplete, embed, rerank, summarize) and `harnessRoleIds(harnessId)`. `validateHarnessSettingsPatch` validates and patches it per role (optional `ctx.runnableModels` refuses selectors that cannot run; empty/`null` removes a role, `{}`/`null` a harness's roles); `applyHarnessLayers` returns `roles`, layered per role and frozen by `lockModel`; `HarnessRow` carries `roles` and `roleAssignments`.
+- Data zones (mirror of `@skaile/workspaces` 9.1, browser-safe, exported from `/server` and `/vue`): `DATA_ZONES` (`eu`, `eu_option`, `transfer`, `local`), `DATA_ZONE_RULES` (`any`, `eu_options`, `eu`), types `DataZone` / `DataZoneRule`, `PRESET_DATA_ZONES` (each catalog preset's zone, copied from the SDK catalog), `DATA_ZONE_LABELS` (EU / EU option / Transfer / Local), `DATA_ZONE_RULE_LABELS`, `isDataZone`, `isDataZoneRule`, `presetDataZone`, `entryDataZone` (the entry's `data_zone`, else the preset's, else `transfer`), `dataZoneAllows`, `entryAllowedByDataZone`, `dataZoneRefusal` and `filterRegistryByDataZone` (`any` keeps all; `eu_options` keeps `eu`, `local` and `eu_option` with `eu_processing: true`; `eu` keeps `eu` and `local`; a merged registry keeps its shape). The registry mirror gains `data_zone`, `eu_processing` and `allowed_models`, plus `isModelAllowed(entry, modelId)`.
+- `resolveHarnessProviders(harness, candidates, selection, { dataZoneRule })`: an otherwise-eligible entry outside the rule is listed in `blocked` (reason `blocked-by-rule`, the rule, its label, the entry's zone and a message naming the rule). It is never eligible, never auto-chosen and never counted towards `needs-choice`; a stored pick of it is reported in `stale`. `HarnessProviderCandidate` reads `preset`, `dataZone` and `euProcessing`; `harnessProviderBlock(harness, candidate, rule)` answers for one entry. `buildHarnessRows(harnesses, settings, detections?, { candidates, dataZoneRule }?)` fills `HarnessRow.blockedProviders` (entry id → block), so a host table can say why a box cannot be ticked.
+- `upsertProviderEntry` accepts `data_zone` (one of the four zones), `eu_processing` (boolean) and `allowed_models` (a list of distinct, non-empty model ids, trimmed; `[]` allows none); any other value is a 400 naming the field. Like `params`, a body that omits them keeps the stored value; `null` removes it (`allowed_models: null` = every model). `listAIProviders` views carry `dataZone` (effective), `euProcessing`, `allowedModels` (when set) and `modelIds` (the declared `model_map` / `capabilities` ids); `listAIProviderModels` leaves out models outside `allowed_models`. Writing these fields needs `@skaile/workspaces` 9.1 at runtime: 9.0's registry schema refuses them as unknown keys.
+- `<ForgeProvidersPanel>`: each row shows its zone chip and, for `llm` / `embed` entries, its model chip ("All models" / "N models"). An own `eu_option` row has the switch "EU processing is on for this account" (writes `eu_processing`). New optional prop `dataZoneRule`: rows outside it show a muted note naming the rule. A writable own `llm` / `embed` row has a "Models allowed here" section: All models | Only these, the latter a searchable checklist of the entry's declared models or, when it declares none, of `client.models(id)` (the existing listing; when that fails or lists nothing, the reason is shown); Save writes `allowed_models`. New exports `providerModelsChip`, `providerModelChoices`, types `ProvidersPanelModelsMode`, `ProvidersPanelModelsForm`. New test ids: `provider-zone-<id>`, `provider-eu-processing-<id>`, `provider-blocked-<id>`, `provider-models-chip-<id>`, `provider-models-<id>`, `provider-models-mode-<id>`, `provider-models-search-<id>`, `provider-model-<id>-<modelId>`, `provider-models-message-<id>`, `provider-models-error-<id>`, `provider-models-cancel-<id>`, `provider-models-save-<id>`.
+
+## 1.3.3
+
+- Accepts `@skaile/workspaces` ^9.0.0. The only 9.0.0 break is the new `skaile replica` command, which this package does not use; the provider registry, catalog and model-discovery APIs it uses are unchanged.
+
 ## 1.3.2
 
 - `<ForgeProvidersPanel>` lists providers as stacked rows instead of a six-column table: name and badge, then one muted line with id, preset and base URL, the credential picker below, and Test / Edit / Delete / Enabled on the right. It fits a settings column without clipping the actions or wrapping the base URL per character. Test ids are unchanged.

package/README.md

@@ -88,6 +88,26 @@ Without URLs, pass `:client` (a `ProvidersPanelClient`: `list`, `detected`, `pre
 
 `note` sets the line above the list: absent keeps the panel's text for `layer`, a string replaces it, `false` hides it (the Add provider button stays, right-aligned).
 
+**Adding a provider** is a flow: a library of the catalog presets, then *How do you sign in?* with only the kinds the preset accepts (`presetSignInOptions` in `/server` and `/vue`: API key; Entra ID first for the Azure transports; AWS / Google credentials for Bedrock / Vertex; No sign-in for local servers), then the fields of that kind and the preset's routing parameters (`params`: `resource`, `deployment`, `api_version`, …), then the entry is written and, with a client, tested on a done step. `:expert="true"` adds the raw *Reference* form (`env:` / `keyring:` / `cmd:` / `platform:`) to every sign-in step and makes expert-only parameters (`api_version`) editable; the host owns the switch. The **Microsoft Azure** card takes a resource name, one sign-in, and Azure OpenAI (deployment rows → `model_map`) and/or Claude on Foundry; it writes up to two entries (`azure-openai`, `foundry` presets, `azureAccountEntries`) sharing `params.resource` and the credential. Each row shows its account line (`providerAccountLine`: "Microsoft Azure · Entra ID · contoso-ai") and, when the entry view carries `credentialExpiresAt`, "Expires in N days · Renew".
+
+`upsertProviderEntry` accepts `params` (kept when a body omits it, removed by `params: {}`). A catalog preset's `required_params` missing from the entry and from every lower document's entry of the same id is refused with 400, the message naming `params.<key>` and `data.missingParams` listing them; keys a transport does not accept are refused by the SDK schema (`data.diagnostics`). `providerPresetSummaries()` carries each preset's `transport`, `params` and `required_params`; provider views carry an `llm`/`embed` entry's `transport` and `transportParams`.
+
+### Data zones and model filters
+
+Three entry fields (`@skaile/workspaces` 9.1; 9.0's schema refuses them) are writable through `upsertProviderEntry`. A body that omits one keeps the stored value, and `null` removes it:
+
+|Field|Accepts|Removed by `null` means|
+|---|---|---|
+|`data_zone`|`eu`, `eu_option`, `transfer`, `local` (overrides the preset's zone)|the preset's zone, else `transfer`|
+|`eu_processing`|boolean: the account's EU-processing setting is on (only an `eu_option` entry reads it)|off|
+|`allowed_models`|distinct, non-empty model ids (`model_map` keys, or provider ids for a discovery entry); `[]` allows none|every model|
+
+Any other value is a 400 naming the field. Provider views carry `dataZone` (effective), `euProcessing`, `allowedModels` and `modelIds`.
+
+The zone rule is the host's: `filterRegistryByDataZone(registry, rule)` keeps what `rule` allows (`any` all; `eu_options` EU, local, and EU option with `eu_processing: true`; `eu` EU and local). `entryDataZone`, `entryAllowedByDataZone` and `dataZoneRefusal` answer per entry; `PRESET_DATA_ZONES` copies the SDK catalog's zone per preset. Pass the rule to `resolveHarnessProviders(..., { dataZoneRule })` and `buildHarnessRows(..., { candidates, dataZoneRule })`: an entry the rule keeps out is reported as `blocked-by-rule` (`blocked`, `HarnessRow.blockedProviders`) with a message naming the rule, and is never eligible or chosen.
+
+In the panel every row shows its zone chip (`provider-zone-<id>`) and, for `llm` / `embed` entries, a model chip (`provider-models-chip-<id>`: "All models" / "N models"). An own `eu_option` row offers "EU processing is on for this account" (`provider-eu-processing-<id>`). `:data-zone-rule="rule"` marks rows outside the rule with a muted note (`provider-blocked-<id>`). "Models allowed here" (`provider-models-<id>`) switches All models / Only these (`provider-models-mode-<id>`); Only these is a searchable checklist (`provider-models-search-<id>`, `provider-model-<id>-<modelId>`) of the entry's declared models or, for a discovery entry, of `client.models(id)`, and Save (`provider-models-save-<id>`) writes `allowed_models`.
+
 ## Model roles
 
 A *model role* is a named purpose a host picks a model for. The host declares roles and stores the assignments (role id to selector); this package supplies the vocabulary, validation, resolution and a picker.

package/dist/module.json

@@ -1,7 +1,7 @@
 {
   "name": "@skaile/forge-settings",
   "configKey": "forgeSettings",
-  "version": "1.3.2",
+  "version": "1.4.0",
   "builder": {
     "@nuxt/module-builder": "1.0.3",
     "unbuild": "3.6.1"

package/dist/runtime/components/ForgeProvidersPanel.d.vue.ts

@@ -1,3 +1,4 @@
+import type { DataZoneRule } from "../shared/provider-registry.js";
 import type { ProvidersPanelClient } from "../vue/providers-client.js";
 import { type ProvidersPanelLayer } from "../vue/useProvidersPanel.js";
 type __VLS_Props = {
@@ -22,12 +23,24 @@ type __VLS_Props = {
     readOnly?: boolean;
     /** The line above the list. Absent: the default text for `layer`; a string replaces it; `false` hides it. */
     note?: string | false;
+    /**
+     * Expert mode: the sign-in step also offers the raw reference form
+     * (`env:` / `keyring:` / `cmd:` / `platform:`), and expert-only
+     * parameters (`api_version`) become editable.
+     */
+    expert?: boolean;
+    /**
+     * The host's data-zone rule: rows outside it show a muted note naming the
+     * rule (`provider-blocked-<id>`). Absent or `any`: none.
+     */
+    dataZoneRule?: DataZoneRule;
 };
 declare const _default: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {} & {
     changed: () => any;
 }, string, import("vue").PublicProps, Readonly<__VLS_Props> & Readonly<{
     onChanged?: (() => any) | undefined;
 }>, {
+    expert: boolean;
     environmentEnabled: boolean;
     note: string | false;
 }, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;