@skaile/forge-settings 1.3.2 → 1.4.0

package/dist/runtime/components/ForgeProvidersPanel.vue.d.ts

@@ -1,3 +1,4 @@
+import type { DataZoneRule } from "../shared/provider-registry.js";
 import type { ProvidersPanelClient } from "../vue/providers-client.js";
 import { type ProvidersPanelLayer } from "../vue/useProvidersPanel.js";
 type __VLS_Props = {
@@ -22,12 +23,24 @@ type __VLS_Props = {
     readOnly?: boolean;
     /** The line above the list. Absent: the default text for `layer`; a string replaces it; `false` hides it. */
     note?: string | false;
+    /**
+     * Expert mode: the sign-in step also offers the raw reference form
+     * (`env:` / `keyring:` / `cmd:` / `platform:`), and expert-only
+     * parameters (`api_version`) become editable.
+     */
+    expert?: boolean;
+    /**
+     * The host's data-zone rule: rows outside it show a muted note naming the
+     * rule (`provider-blocked-<id>`). Absent or `any`: none.
+     */
+    dataZoneRule?: DataZoneRule;
 };
 declare const _default: import("vue").DefineComponent<__VLS_Props, {}, {}, {}, {}, import("vue").ComponentOptionsMixin, import("vue").ComponentOptionsMixin, {} & {
     changed: () => any;
 }, string, import("vue").PublicProps, Readonly<__VLS_Props> & Readonly<{
     onChanged?: (() => any) | undefined;
 }>, {
+    expert: boolean;
     environmentEnabled: boolean;
     note: string | false;
 }, {}, {}, {}, string, import("vue").ComponentProvideOptions, false, {}, any>;

package/dist/runtime/server/harness-settings.d.ts

@@ -8,12 +8,13 @@
  * What lives here, so hosts only read and write their own storage:
  *
  * - {@link validateHarnessSettingsPatch} — the rule set for a harness settings
- *   write (`harness`, `harnessModels`, `harnessProviders`, `enabledHarnesses`,
- *   `lock*`), as a pure function over the request body and the stored state.
+ *   write (`harness`, `harnessModels`, `harnessRoles`, `harnessProviders`,
+ *   `enabledHarnesses`, `lock*`), as a pure function over the request body and
+ *   the stored state.
  * - {@link resolveLockFlags} — the admin lock flags in force. Locks are
  *   `settings.json` fields only; there is no environment override.
- * - {@link applyHarnessLayers} — which harness, model and provider pick a
- *   session starts with, given the settings layers the host read.
+ * - {@link applyHarnessLayers} — which harness, model, roles and provider pick
+ *   a session starts with, given the settings layers the host read.
  * - {@link enabledHarnessIds} / {@link buildHarnessRows} — the harness catalog
  *   `GET /api/agents` serves.
  *
@@ -21,9 +22,11 @@
  */
 import type { HarnessDetection } from "@skaile/workspaces/sdk/bridge";
 import type { HarnessInfo } from "@skaile/workspaces/types";
+import { type HarnessProviderBlock, type HarnessProviderCandidate } from "../shared/harness-providers.js";
+import type { DataZoneRule } from "../shared/provider-registry.js";
 import type { SkaileSettings } from "../shared/settings-types.js";
 /** The slice of {@link SkaileSettings} that selects, configures and locks harnesses. */
-export type HarnessSettings = Pick<SkaileSettings, "harness" | "harnessModels" | "harnessProviders" | "enabledHarnesses" | "lockHarness" | "lockProvider" | "lockModel" | "lockAudio">;
+export type HarnessSettings = Pick<SkaileSettings, "harness" | "harnessModels" | "harnessRoles" | "harnessProviders" | "enabledHarnesses" | "lockHarness" | "lockProvider" | "lockModel" | "lockAudio">;
 /** One lock flag and where its value comes from. */
 export type LockFlagStatus = {
     value: boolean;
@@ -59,16 +62,36 @@ export type HarnessRow = HarnessInfo & {
     enabled: boolean;
     /** What `detectHarnesses()` found on this host: installed, version, login. */
     detection: HarnessDetection;
+    /** The role ids the harness takes ({@link harnessRoleIds}); empty for a one-model harness. */
+    roles: string[];
+    /** The role → model selector assignments of `s.harnessRoles` for this harness (pass effective settings). */
+    roleAssignments: Record<string, string>;
+    /**
+     * Registry entries on a surface the harness speaks that the host's
+     * data-zone rule keeps out, by entry id (reason `blocked-by-rule`, with the
+     * message a table shows on the box it cannot tick). Empty without
+     * `providers` or under the rule `any`.
+     */
+    blockedProviders: Record<string, HarnessProviderBlock>;
 };
+/** The registry entries {@link buildHarnessRows} checks against the host's data-zone rule. */
+export interface HarnessRowProviders {
+    /** `GET /api/providers` rows (or any {@link HarnessProviderCandidate}s), in registry order. */
+    candidates: readonly HarnessProviderCandidate[];
+    /** The host's data-zone rule. Absent: `any`. */
+    dataZoneRule?: DataZoneRule;
+}
 /**
  * The rows of `GET /api/agents`: one per harness, in `harnesses` order. Hosts
  * filter to `enabled` unless the request asked for all (`?all=1`).
  * `surfaces` and `providerPlurality` ride along from {@link HarnessInfo} so the
- * Harness tab can offer each harness only the providers it can use.
+ * Harness tab can offer each harness only the providers it can use; `roles`
+ * and `roleAssignments` drive the "Roles" badge and the models-per-task panel.
  * `detections` is the host's `detectHarnesses()` answer; a harness it does not
  * mention (or every harness, when it is omitted) reports `{ status: "unknown" }`.
+ * `providers`, when given, fills each row's `blockedProviders`.
  */
-export declare function buildHarnessRows(harnesses: HarnessInfo[], s: Pick<HarnessSettings, "enabledHarnesses">, detections?: readonly HarnessDetection[]): HarnessRow[];
+export declare function buildHarnessRows(harnesses: HarnessInfo[], s: Pick<HarnessSettings, "enabledHarnesses" | "harnessRoles">, detections?: readonly HarnessDetection[], providers?: HarnessRowProviders): HarnessRow[];
 /** What {@link validateHarnessSettingsPatch} hands back for a valid body. */
 export type HarnessSettingsPatch = {
     /**
@@ -77,9 +100,9 @@ export type HarnessSettingsPatch = {
      */
     patch: Partial<HarnessSettings>;
     /**
-     * Whether the effective `harness`, `harnessModels`, `harnessProviders` or
-     * `enabledHarnesses` changed, i.e. whether running sessions now run on stale
-     * defaults and the host should stop them.
+     * Whether the effective `harness`, `harnessModels`, `harnessRoles`,
+     * `harnessProviders` or `enabledHarnesses` changed, i.e. whether running
+     * sessions now run on stale defaults and the host should stop them.
      */
     sessionAffecting: boolean;
 };
@@ -94,6 +117,11 @@ export type HarnessSettingsPatch = {
  *   keys are present `harness` wins.
  * - `harnessModels`: patched per harness id (catalog ids only); a value is a
  *   `providerId/modelId` selector, an empty string removes that harness's entry.
+ * - `harnessRoles`: patched per harness id, then per role. A harness must be in
+ *   the catalog and take roles ({@link harnessRoleIds}); a role must be one of
+ *   its roles; a value is a `providerId/modelId` selector, and one of
+ *   `ctx.runnableModels` when that list is given. An empty string or `null`
+ *   removes the role; `{}` or `null` for a harness removes all its roles.
  * - `harnessProviders`: the registry entry ids picked per harness id. The modal
  *   sends the whole map, so it replaces the stored one: each value must be an
  *   array of strings (empty strings are dropped, duplicates collapse, order is
@@ -114,6 +142,8 @@ export type HarnessSettingsPatch = {
  * @param ctx.catalog valid harness ids (`listHarnesses().map(d => d.id)`).
  * @param ctx.current the stored settings the patch applies to (the instance file).
  * @param ctx.locks the lock flags in force ({@link resolveLockFlags} of `current`).
+ * @param ctx.runnableModels optional: the selectors a session may run; when
+ * given, a `harnessRoles` value outside it is refused.
  * @returns the patch, or the error message of the first violated rule (a
  * string, mirroring `validateEnvSettingsUpdate`; hosts answer 400 with it).
  */
@@ -121,18 +151,21 @@ export declare function validateHarnessSettingsPatch(body: unknown, ctx: {
     catalog: Iterable<string>;
     current: HarnessSettings;
     locks: LockFlags;
+    runnableModels?: Iterable<string>;
 }): HarnessSettingsPatch | string;
-/** One settings layer's say in which harness, model and provider pick a session gets. */
+/** One settings layer's say in which harness, model, roles and provider pick a session gets. */
 export type HarnessLayer = {
     /** The harness id (the workspaces settings key `harness`). */
     harness?: string;
     /** An explicit model selector; wins over this layer's `harnessModels` entry. */
     model?: string;
     harnessModels?: Record<string, string>;
+    /** Role → model selector per harness id; layered per role. */
+    harnessRoles?: Record<string, Record<string, string>>;
     harnessProviders?: Record<string, string[]>;
 };
 /**
- * Resolve the harness, model and provider pick a session starts with.
+ * Resolve the harness, model, roles and provider pick a session starts with.
  *
  * `layers[0]` is the instance layer; later layers (workspace file, workspace
  * overrides, chat, …) are more specific and override it per field — the last
@@ -146,10 +179,15 @@ export type HarnessLayer = {
  * `layer.harnessProviders[harness]` — both keyed by the *resolved* harness, so
  * a pick stored for another harness never applies.
  *
+ * `roles` is layered per role of the resolved harness: for each role the last
+ * layer with a non-empty selector wins; `locks.model` freezes it to layer 0's
+ * roles, as it freezes `model`. No role set anywhere → `undefined`.
+ *
  * Fields no layer sets come back `undefined`; the host supplies its defaults.
  */
 export declare function applyHarnessLayers(layers: HarnessLayer[], locks: LockFlags): {
     harness: string | undefined;
     model: string | undefined;
+    roles: Record<string, string> | undefined;
     providers: string[] | undefined;
 };

package/dist/runtime/server/harness-settings.js

@@ -1,6 +1,10 @@
+import {
+  harnessProviderBlock
+} from "../shared/harness-providers.js";
 import {
   DEFAULT_ENABLED_HARNESSES,
   HARNESS_LABELS,
+  harnessRoleIds,
   isExperimentalHarness
 } from "../shared/harnesses.js";
 const LOCK_FIELDS = [
@@ -21,15 +25,29 @@ export function resolveLockFlags(stored) {
 export function enabledHarnessIds(s) {
   return s.enabledHarnesses?.length ? s.enabledHarnesses : [...DEFAULT_ENABLED_HARNESSES];
 }
-export function buildHarnessRows(harnesses, s, detections = []) {
+export function buildHarnessRows(harnesses, s, detections = [], providers) {
   const enabled = new Set(enabledHarnessIds(s));
-  return harnesses.map((info) => ({
-    ...info,
-    label: HARNESS_LABELS[info.id] ?? info.name,
-    experimental: isExperimentalHarness(info.id),
-    enabled: enabled.has(info.id),
-    detection: detections.find((d) => d.id === info.id) ?? { id: info.id, status: "unknown" }
-  }));
+  return harnesses.map((info) => {
+    const roles = harnessRoleIds(info.id);
+    const stored = stringEntries(s.harnessRoles?.[info.id]);
+    const roleAssignments = {};
+    for (const role of roles) if (stored[role]) roleAssignments[role] = stored[role];
+    const blockedProviders = {};
+    for (const candidate of providers?.candidates ?? []) {
+      const block = harnessProviderBlock(info, candidate, providers?.dataZoneRule);
+      if (block) blockedProviders[candidate.id] = block;
+    }
+    return {
+      ...info,
+      label: HARNESS_LABELS[info.id] ?? info.name,
+      experimental: isExperimentalHarness(info.id),
+      enabled: enabled.has(info.id),
+      detection: detections.find((d) => d.id === info.id) ?? { id: info.id, status: "unknown" },
+      roles,
+      roleAssignments,
+      blockedProviders
+    };
+  });
 }
 const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
 const nonEmpty = (value) => typeof value === "string" && value ? value : void 0;
@@ -66,6 +84,19 @@ function sameIdLists(a, b) {
     (key) => b[key] !== void 0 && a[key].length === b[key].length && a[key].every((id, i) => id === b[key][i])
   );
 }
+function roleMaps(value) {
+  const maps = {};
+  if (!isObject(value)) return maps;
+  for (const [harnessId, roles] of Object.entries(value)) {
+    const entries = stringEntries(roles);
+    if (Object.keys(entries).length) maps[harnessId] = entries;
+  }
+  return maps;
+}
+function sameRoleMaps(a, b) {
+  const keys = Object.keys(a);
+  return keys.length === Object.keys(b).length && keys.every((key) => b[key] !== void 0 && sameEntries(a[key], b[key]));
+}
 export function validateHarnessSettingsPatch(body, ctx) {
   if (!isObject(body)) return "body must be an object";
   if ("model" in body) return "model is set per harness - use harnessModels";
@@ -120,6 +151,51 @@ export function validateHarnessSettingsPatch(body, ctx) {
       sessionAffecting = true;
     }
   }
+  if ("harnessRoles" in body) {
+    const raw = body.harnessRoles;
+    if (!isObject(raw)) return "harnessRoles must be an object";
+    const runnable = ctx.runnableModels ? new Set(ctx.runnableModels) : void 0;
+    const currentRoles = roleMaps(current.harnessRoles);
+    const nextRoles = {};
+    for (const [id, roles] of Object.entries(currentRoles)) nextRoles[id] = { ...roles };
+    for (const [id, roles] of Object.entries(raw)) {
+      if (!catalog.has(id)) return `harnessRoles: unknown harness "${id}"`;
+      const supported = harnessRoleIds(id);
+      if (!supported.length)
+        return `harnessRoles: harness "${id}" runs one model and takes no roles`;
+      if (roles === null) {
+        delete nextRoles[id];
+        continue;
+      }
+      if (!isObject(roles)) return `harnessRoles.${id} must be an object`;
+      if (!Object.keys(roles).length) {
+        delete nextRoles[id];
+        continue;
+      }
+      const next = { ...nextRoles[id] };
+      for (const [role, entry] of Object.entries(roles)) {
+        if (!supported.includes(role)) return `harnessRoles.${id}: unknown role "${role}"`;
+        if (entry !== null && typeof entry !== "string")
+          return `harnessRoles.${id}.${role} must be a string`;
+        const value = typeof entry === "string" ? entry.trim() : "";
+        if (!value) {
+          delete next[role];
+          continue;
+        }
+        if (!isModelSelector(value))
+          return `harnessRoles.${id}.${role} must be a "providerId/modelId" selector`;
+        if (runnable && !runnable.has(value))
+          return `harnessRoles.${id}.${role}: model "${value}" is not runnable`;
+        next[role] = value;
+      }
+      if (Object.keys(next).length) nextRoles[id] = next;
+      else delete nextRoles[id];
+    }
+    if (!sameRoleMaps(currentRoles, nextRoles)) {
+      patch.harnessRoles = Object.keys(nextRoles).length ? nextRoles : void 0;
+      sessionAffecting = true;
+    }
+  }
   if ("enabledHarnesses" in body) {
     const raw = body.enabledHarnesses;
     if (!Array.isArray(raw) || !raw.every((id) => typeof id === "string")) {
@@ -163,5 +239,13 @@ export function applyHarnessLayers(layers, locks) {
     const ids = harness === void 0 ? void 0 : layer.harnessProviders?.[harness];
     return ids?.length ? ids : void 0;
   });
-  return { harness, model, providers };
+  let roles;
+  if (harness !== void 0) {
+    const merged = {};
+    const roleLayers = locks.model.value ? layers.slice(0, 1) : layers;
+    for (const layer of roleLayers)
+      Object.assign(merged, stringEntries(layer.harnessRoles?.[harness]));
+    if (Object.keys(merged).length) roles = merged;
+  }
+  return { harness, model, roles, providers };
 }

package/dist/runtime/server/index.d.ts

@@ -6,9 +6,11 @@
  * Imports no Vue, no editor, no AI SDK and no agent session code. Storage,
  * authentication and workspace permissions stay with the host.
  */
+export * from "../shared/data-zone.js";
 export * from "../shared/harness-providers.js";
 export * from "../shared/harnesses.js";
 export * from "../shared/model-roles.js";
+export * from "../shared/provider-accounts.js";
 export * from "../shared/provider-registry.js";
 export type { DomainConfig, SkaileSettings } from "../shared/settings-types.js";
 export * from "./credential-policy.js";

package/dist/runtime/server/index.js

@@ -1,6 +1,8 @@
+export * from "../shared/data-zone.js";
 export * from "../shared/harness-providers.js";
 export * from "../shared/harnesses.js";
 export * from "../shared/model-roles.js";
+export * from "../shared/provider-accounts.js";
 export * from "../shared/provider-registry.js";
 export * from "./credential-policy.js";
 export * from "./credential-store.js";

package/dist/runtime/server/provider-service.d.ts

@@ -18,7 +18,7 @@
  *     `model_map`/`capabilities`; harness-backed discovery is
  *     `listModelsForHarness(harnessId, registry)` in the runtime.
  */
-import type { AIProviderCapabilities, AIProviderCredentialKind, AIProviderKind, AIProviderRegistryView, AIProviderSurface, AIProviderVoiceParams } from "../shared/provider-registry.js";
+import type { AIProviderCapabilities, AIProviderCredentialKind, AIProviderKind, AIProviderRegistryView, AIProviderSurface, AIProviderTransport, AIProviderVoiceParams, DataZone } from "../shared/provider-registry.js";
 import { type CredentialSource, type CredentialStoreOptions } from "./credential-store.js";
 /** One registry entry, as a settings UI needs to see it. */
 export interface ProviderInfo {
@@ -52,6 +52,14 @@ export interface ProviderInfo {
     preset?: string;
     /** Wire protocol of an `llm`/`embed` entry (its own or its preset's). */
     surface?: AIProviderSurface;
+    /** How requests of an `llm`/`embed` entry reach its surface, when not `direct`. */
+    transport?: AIProviderTransport;
+    /**
+     * Routing parameters of an `llm`/`embed` entry (`resource`, `deployment`,
+     * `api_version`, `region`, `project`, `location`, …), when it has any.
+     * Voice entries carry theirs in {@link params}.
+     */
+    transportParams?: Record<string, string>;
     /** The entry's `enabled` flag; `false` only in a listing with `includeDisabled`. */
     enabled: boolean;
     /**
@@ -63,6 +71,21 @@ export interface ProviderInfo {
     params?: AIProviderVoiceParams;
     /** Frozen by the control plane: a lower layer cannot change or disable it. */
     locked: boolean;
+    /** Where the entry processes data: its `data_zone`, else its preset's, else `transfer`. */
+    dataZone: DataZone;
+    /** The entry's `eu_processing` switch (an `eu_option` entry counts as EU only with it on). */
+    euProcessing: boolean;
+    /**
+     * The entry's `allowed_models`, when it sets one: the only models it may be
+     * used with (`[]` = none). Absent: every model.
+     */
+    allowedModels?: string[];
+    /**
+     * Logical model ids an `llm`/`embed` entry declares (`model_map` keys, then
+     * ids only `capabilities` names), when it declares any. An entry without
+     * them lists its models through discovery.
+     */
+    modelIds?: string[];
 }
 /** One selectable model of one provider. */
 export interface ModelInfo {
@@ -110,7 +133,8 @@ export declare function listAIProviders(registry: AIProviderRegistryView, option
  *
  * Sourced from each `llm`/`embed` entry's `model_map` (plus any id that only
  * appears in `capabilities`) — the same two tables the runtime's model-reference
- * resolver reads, so a selector built from this list always resolves.
+ * resolver reads, so a selector built from this list always resolves. A model
+ * outside the entry's `allowed_models` is left out, as the runtime refuses it.
  *
  * @param providerId - Restrict to one entry; omit for every enabled entry.
  */

package/dist/runtime/server/provider-service.js

@@ -1,6 +1,8 @@
+import { entryDataZone } from "../shared/data-zone.js";
 import {
   entriesOfKind,
   isEntryEnabled,
+  isModelAllowed,
   isVoiceEntry,
   parseCredentialRef,
   registryEntries
@@ -32,13 +34,25 @@ export function listAIProviders(registry, options = {}) {
       ...entry.base_url ? { baseUrl: entry.base_url } : {},
       ...entry.preset ? { preset: entry.preset } : {},
       ...!isVoiceEntry(entry) && entry.surface ? { surface: entry.surface } : {},
+      ...!isVoiceEntry(entry) && entry.transport && entry.transport !== "direct" ? { transport: entry.transport } : {},
+      ...!isVoiceEntry(entry) && entry.params && Object.keys(entry.params).length > 0 ? { transportParams: { ...entry.params } } : {},
       enabled,
       ...isVoiceEntry(entry) && entry.params ? { params: entry.params } : {},
-      locked: entry.locked === true
+      locked: entry.locked === true,
+      dataZone: entryDataZone(entry),
+      euProcessing: entry.eu_processing === true,
+      ...!isVoiceEntry(entry) && entry.allowed_models ? { allowedModels: [...entry.allowed_models] } : {},
+      ...!isVoiceEntry(entry) ? declaredModelIds(entry) : {}
     });
   }
   return providers;
 }
+function declaredModelIds(entry) {
+  const ids = [
+    .../* @__PURE__ */ new Set([...Object.keys(entry.model_map ?? {}), ...Object.keys(entry.capabilities ?? {})])
+  ];
+  return ids.length > 0 ? { modelIds: ids } : {};
+}
 export function listAIProviderModels(registry, providerId) {
   const models = [];
   for (const kind of ["llm", "embed"]) {
@@ -49,6 +63,7 @@ export function listAIProviderModels(registry, providerId) {
         ...Object.keys(entry.capabilities ?? {})
       ]);
       for (const modelId of logicalIds) {
+        if (!isModelAllowed(entry, modelId)) continue;
         const capabilities = entry.capabilities?.[modelId];
         models.push({
           id: `${id}/${modelId}`,

package/dist/runtime/server/provider-write.d.ts

@@ -74,8 +74,11 @@ export declare function providerScopeWritable(scope: ProviderWriteScope, caller:
  * Upsert entry `id` in the scope's document.
  *
  * - **Own entry** — the body sets the editable fields (`BODY_KEYS`) — one it
- *   omits is removed — and optionally `kind`; fields it does not set (`kind`,
- *   `transport`, `params`, …) keep their written value.
+ *   omits is removed — and optionally `kind`, `params`, `data_zone`,
+ *   `eu_processing` and `allowed_models`; fields it does not set (`kind`,
+ *   `transport`, `params`, `data_zone`, …) keep their written value,
+ *   `params: {}` removes the parameters and `null` removes `data_zone`,
+ *   `eu_processing` or `allowed_models` (`[]` allows no model).
  * - **Patch** — when a lower document defines `id` and the body holds only
  *   {@link PATCH_KEYS}, the body is merged into the scope's stored entry for
  *   `id` (created when absent), leaving every other stored field alone.
@@ -83,11 +86,16 @@ export declare function providerScopeWritable(scope: ProviderWriteScope, caller:
  * The file and its directory are created when absent; other entries are kept
  * as written.
  *
- * 400: invalid id, secret-bearing or malformed body, a body for an inherited
- * entry that is neither a patch nor over an own full entry, or any error
- * diagnostic for the entry (as `data.diagnostics`; nothing is written). 403:
- * the entry is `locked: true` in some document. 409: the document on disk is
- * not a registry.
+ * 400: invalid id, secret-bearing or malformed body (`data_zone` outside
+ * eu | eu_option | transfer | local, a non-boolean `eu_processing`, an
+ * `allowed_models` that is not a list of distinct non-empty ids), a body for
+ * an inherited entry that is neither a patch nor over an own full entry, a
+ * preset's required parameter left out of `params` (named in the message,
+ * `data.missingParams`), or any error diagnostic for the entry (as
+ * `data.diagnostics`; nothing is written — `params` keys a transport does not
+ * accept are refused this way, by the SDK's schema). 403: the entry is
+ * `locked: true` in some document. 409: the document on disk is not a
+ * registry.
  */
 export declare function upsertProviderEntry(scope: ProviderWriteScope, id: string, body: unknown): {
     id: string;
@@ -107,12 +115,18 @@ export interface ProviderPresetSummary {
     label: string;
     kind: AIProviderPreset["kind"];
     surface?: AIProviderPreset["surface"];
+    /** How requests reach the surface; absent = `direct`. Azure transports offer Entra ID sign-in. */
+    transport?: AIProviderPreset["transport"];
     base_url?: string;
     base_url_env?: string;
     credential: {
         kind: AIProviderPreset["credential"]["kind"];
         env?: string;
     };
+    /** Default routing / voice parameters. */
+    params?: Record<string, string>;
+    /** `params` keys an entry naming this preset must supply. */
+    required_params?: string[];
 }
 /** Catalog presets (all of them by default), in catalog order. */
 export declare function providerPresetSummaries(presets?: AIProviderPreset[]): ProviderPresetSummary[];
@@ -129,14 +143,16 @@ export declare function detectedProviderPresets(env: Record<string, string | und
 export type ProviderLayerName = ProviderWriteScope["name"];
 /**
  * The defining document's values for the `PUT`-editable fields a settings UI
- * edit dialog does not show. A `PUT` removes every editable field it omits,
- * so an edit sends these back unchanged instead of dropping them.
+ * edit dialog does not show (or shows only in part, as `params`). A `PUT`
+ * removes every editable field it omits, so an edit sends these back
+ * unchanged instead of dropping them.
  */
 export interface ProviderLayerFields {
     label?: unknown;
     headers?: unknown;
     model_map?: unknown;
     enabled?: unknown;
+    params?: unknown;
 }
 /**
  * Tag each provider view of a scope with every registry document that holds

package/dist/runtime/server/provider-write.js

@@ -10,7 +10,9 @@ import {
   AI_PROVIDER_PRESETS,
   expandPreset
 } from "@skaile/workspaces/sdk/bridge";
+import { isDataZone } from "../shared/data-zone.js";
 import { isPlainObject } from "../shared/guards.js";
+import { missingRequiredParams } from "../shared/provider-accounts.js";
 import { entryPolicyRefusal } from "./credential-policy.js";
 import { catalogPreset, readProviderLayer, writeProviderLayer } from "./provider-layers.js";
 export class ProviderWriteError extends Error {
@@ -41,6 +43,26 @@ const BODY_KEYS = {
   model_map: true,
   enabled: true
 };
+const KEPT_BODY_KEYS = {
+  kind: true,
+  params: true,
+  data_zone: true,
+  eu_processing: true,
+  allowed_models: true
+};
+const NULLABLE_BODY_KEYS = ["data_zone", "eu_processing", "allowed_models"];
+function readAllowedModels(value) {
+  const refusal = "allowed_models must be a list of distinct, non-empty model ids, or null";
+  if (!Array.isArray(value)) return refusal;
+  const ids = [];
+  for (const item of value) {
+    if (typeof item !== "string" || item.trim() === "") return refusal;
+    const id = item.trim();
+    if (ids.includes(id)) return `allowed_models lists '${id}' twice`;
+    ids.push(id);
+  }
+  return ids;
+}
 export const PATCH_KEYS = ["credential", "enabled"];
 const SECRET_KEYS = { apiKey: true, api_key: true, token: true };
 export function providerScopeWritable(scope, caller) {
@@ -74,8 +96,25 @@ function readEntryBody(body) {
   if (Object.keys(body).some((key) => Object.hasOwn(SECRET_KEYS, key)) || credentialKeys.some((key) => key === "value" || Object.hasOwn(SECRET_KEYS, key))) {
     return PROVIDER_SECRET_REFUSAL;
   }
-  const unknown = Object.keys(body).find((key) => !Object.hasOwn(BODY_KEYS, key) && key !== "kind");
+  const unknown = Object.keys(body).find(
+    (key) => !Object.hasOwn(BODY_KEYS, key) && !Object.hasOwn(KEPT_BODY_KEYS, key)
+  );
   if (unknown) return `'${unknown}' is not a provider entry field`;
+  if (body.params !== void 0 && !isPlainObject(body.params)) {
+    return "params must be a map of parameter name to value";
+  }
+  if (body.data_zone !== void 0 && body.data_zone !== null && !isDataZone(body.data_zone)) {
+    return "data_zone must be one of eu, eu_option, transfer, local, or null";
+  }
+  if (body.eu_processing !== void 0 && body.eu_processing !== null && typeof body.eu_processing !== "boolean") {
+    return "eu_processing must be true, false or null";
+  }
+  let allowedModels;
+  if (body.allowed_models !== void 0 && body.allowed_models !== null) {
+    const read = readAllowedModels(body.allowed_models);
+    if (typeof read === "string") return read;
+    allowedModels = read;
+  }
   if (body.preset !== void 0 && !catalogPreset(body.preset)) {
     return `Unknown preset '${String(body.preset)}'`;
   }
@@ -85,7 +124,7 @@ function readEntryBody(body) {
     if (ref !== void 0 && (typeof ref !== "string" || !parseCredentialRef(ref)))
       return CREDENTIAL_REF_REFUSAL;
   }
-  return body;
+  return allowedModels ? { ...body, allowed_models: allowedModels } : body;
 }
 function entryErrors(scope, providers, id) {
   const layer = mergeLayerOf(scope);
@@ -118,6 +157,22 @@ function isPatchOrAbsent(entry) {
   if (entry === void 0) return true;
   return isPlainObject(entry) && Object.keys(entry).every((key) => PATCH_KEYS.includes(key));
 }
+function lowerPreset(lowerEntries) {
+  let preset;
+  for (const entry of lowerEntries)
+    if (isPlainObject(entry) && entry.preset !== void 0) preset = entry.preset;
+  return preset;
+}
+function missingPresetParams(entry, lowerEntries) {
+  const preset = catalogPreset(entry.preset ?? lowerPreset(lowerEntries));
+  if (!preset) return [];
+  const params = {};
+  for (const lower of lowerEntries) {
+    if (isPlainObject(lower) && isPlainObject(lower.params)) Object.assign(params, lower.params);
+  }
+  if (isPlainObject(entry.params)) Object.assign(params, entry.params);
+  return missingRequiredParams(preset, params);
+}
 export function upsertProviderEntry(scope, id, body) {
   if (!isSafeProviderId(id)) {
     throw createError({
@@ -150,6 +205,16 @@ export function upsertProviderEntry(scope, id, body) {
       Object.entries(existing).filter(([key]) => !Object.hasOwn(BODY_KEYS, key))
     ) : {};
     entry = { ...kept, ...fields };
+    if (isPlainObject(entry.params) && Object.keys(entry.params).length === 0) delete entry.params;
+    for (const key of NULLABLE_BODY_KEYS) if (entry[key] === null) delete entry[key];
+    const missing = missingPresetParams(entry, lowerEntries);
+    if (missing.length > 0) {
+      throw createError({
+        statusCode: 400,
+        statusMessage: `Provider '${id}' needs ${missing.map((key) => `params.${key}`).join(", ")} (required by preset '${String(entry.preset ?? lowerPreset(lowerEntries))}')`,
+        data: { missingParams: missing }
+      });
+    }
   }
   const next = { ...providers, [id]: entry };
   const refusal = entryPolicyRefusal(entry, scope.policy);
@@ -183,9 +248,12 @@ export function providerPresetSummaries(presets = Object.values(AI_PROVIDER_PRES
     label: preset.label,
     kind: preset.kind,
     surface: preset.surface,
+    ...preset.transport ? { transport: preset.transport } : {},
     base_url: preset.base_url,
     base_url_env: preset.base_url_env,
-    credential: { kind: preset.credential.kind, env: preset.credential.env }
+    credential: { kind: preset.credential.kind, env: preset.credential.env },
+    ...preset.params ? { params: { ...preset.params } } : {},
+    ...preset.required_params?.length ? { required_params: [...preset.required_params] } : {}
   }));
 }
 export function detectedProviderPresets(env, registry) {
@@ -200,7 +268,7 @@ export function detectedProviderPresets(env, registry) {
     })
   );
 }
-const LAYER_FIELD_KEYS = ["label", "headers", "model_map", "enabled"];
+const LAYER_FIELD_KEYS = ["label", "headers", "model_map", "enabled", "params"];
 export function withProviderLayers(views, scope) {
   const own = readLayerLeniently(scope.file);
   const lower = scope.below.map((file) => readLayerLeniently(file));