@skaile/forge-settings 1.3.2 → 1.4.0

package/dist/runtime/shared/data-zone.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Data zones: where a provider entry processes data, and which entries a
+ * host's data-zone rule ("Where may AI process data?") keeps.
+ *
+ * `@skaile/workspaces` 9.1 owns this (`entryDataZone`,
+ * `entryAllowedByDataZone`, `filterRegistryByDataZone` in
+ * `bridge/src/provider-catalog.ts`, the `data_zone` of each catalog preset).
+ * forge-settings mirrors it here so the settings panel and a host on an older
+ * SDK apply the same rule in the browser and on the server. Semantics match
+ * upstream exactly; {@link PRESET_DATA_ZONES} is a copy of the catalog's
+ * column, and the SDK catalog is its source.
+ *
+ * Browser-safe on purpose — no `node:` imports.
+ */
+import { type AIProviderRegistry, type AIProviderRegistryView, type DataZone, type DataZoneRule, type MergedAIProviderRegistry } from "./provider-registry.js";
+/**
+ * The `data_zone` of each catalog preset, by preset id. Copied from
+ * `@skaile/workspaces/bridge`'s `AI_PROVIDER_PRESETS` (9.1); change it there
+ * first. A preset this table does not name is `transfer`.
+ */
+export declare const PRESET_DATA_ZONES: Readonly<Record<string, DataZone>>;
+/** What a provider row's zone chip says. */
+export declare const DATA_ZONE_LABELS: Readonly<Record<DataZone, string>>;
+/** What a host calls each rule when it names the rule that keeps an entry out. */
+export declare const DATA_ZONE_RULE_LABELS: Readonly<Record<DataZoneRule, string>>;
+/** Whether `value` is one of {@link DATA_ZONES}. */
+export declare function isDataZone(value: unknown): value is DataZone;
+/** Whether `value` is one of {@link DATA_ZONE_RULES}. */
+export declare function isDataZoneRule(value: unknown): value is DataZoneRule;
+/** The zone of catalog preset `presetId`, or `undefined` for an id the catalog does not name. */
+export declare function presetDataZone(presetId: string | undefined): DataZone | undefined;
+/**
+ * Where an entry processes data: its own `data_zone`, else the zone of the
+ * catalog preset it names, else `transfer` (an unknown endpoint is assumed to
+ * leave the EU).
+ */
+export declare function entryDataZone(entry: {
+    data_zone?: DataZone;
+    preset?: string;
+}): DataZone;
+/**
+ * Whether `rule` allows an entry in `zone`: `any` allows all; `eu` allows
+ * `eu` and `local`; `eu_options` additionally allows `eu_option` when
+ * `euProcessing` is `true`.
+ */
+export declare function dataZoneAllows(rule: DataZoneRule, zone: DataZone, euProcessing: boolean | undefined): boolean;
+/** Whether `rule` allows `entry` ({@link dataZoneAllows} over {@link entryDataZone}). */
+export declare function entryAllowedByDataZone(entry: {
+    data_zone?: DataZone;
+    preset?: string;
+    eu_processing?: boolean;
+}, rule: DataZoneRule): boolean;
+/**
+ * Why `rule` keeps an entry in `zone` out, naming the rule, or `undefined`
+ * when the rule allows it. Secret-free, safe to render.
+ */
+export declare function dataZoneRefusal(rule: DataZoneRule, zone: DataZone, euProcessing: boolean | undefined): string | undefined;
+/**
+ * The registry with only the entries `rule` allows, every kind alike
+ * (`llm`, `embed`, `stt`, `tts`). Order is kept; the input is not mutated. A
+ * merged registry comes back merged, its `order`, `origin` and `locked`
+ * narrowed to the kept entries.
+ */
+export declare function filterRegistryByDataZone(registry: AIProviderRegistry, rule: DataZoneRule): AIProviderRegistry;
+export declare function filterRegistryByDataZone(registry: MergedAIProviderRegistry, rule: DataZoneRule): MergedAIProviderRegistry;
+export declare function filterRegistryByDataZone(registry: AIProviderRegistryView, rule: DataZoneRule): AIProviderRegistryView;

package/dist/runtime/shared/data-zone.js

@@ -0,0 +1,79 @@
+import {
+  DATA_ZONE_RULES,
+  DATA_ZONES,
+  isMergedRegistry
+} from "./provider-registry.js";
+export const PRESET_DATA_ZONES = {
+  anthropic: "transfer",
+  openai: "transfer",
+  google: "transfer",
+  groq: "transfer",
+  deepseek: "transfer",
+  openrouter: "transfer",
+  mistral: "eu",
+  xai: "transfer",
+  together: "transfer",
+  fireworks: "transfer",
+  bedrock: "eu_option",
+  vertex: "eu_option",
+  "azure-openai": "eu_option",
+  foundry: "eu_option",
+  ollama: "local",
+  lmstudio: "local",
+  vllm: "local",
+  litellm: "transfer",
+  deepgram: "transfer",
+  elevenlabs: "transfer"
+};
+export const DATA_ZONE_LABELS = {
+  eu: "EU",
+  eu_option: "EU option",
+  transfer: "Transfer",
+  local: "Local"
+};
+export const DATA_ZONE_RULE_LABELS = {
+  any: "Anywhere",
+  eu_options: "EU, or EU option with EU processing on",
+  eu: "EU only"
+};
+export function isDataZone(value) {
+  return typeof value === "string" && DATA_ZONES.includes(value);
+}
+export function isDataZoneRule(value) {
+  return typeof value === "string" && DATA_ZONE_RULES.includes(value);
+}
+export function presetDataZone(presetId) {
+  return presetId !== void 0 && Object.hasOwn(PRESET_DATA_ZONES, presetId) ? PRESET_DATA_ZONES[presetId] : void 0;
+}
+export function entryDataZone(entry) {
+  return entry.data_zone ?? presetDataZone(entry.preset) ?? "transfer";
+}
+export function dataZoneAllows(rule, zone, euProcessing) {
+  if (rule === "any") return true;
+  if (zone === "eu" || zone === "local") return true;
+  return rule === "eu_options" && zone === "eu_option" && euProcessing === true;
+}
+export function entryAllowedByDataZone(entry, rule) {
+  return dataZoneAllows(rule, entryDataZone(entry), entry.eu_processing);
+}
+export function dataZoneRefusal(rule, zone, euProcessing) {
+  if (dataZoneAllows(rule, zone, euProcessing)) return void 0;
+  const why = zone === "eu_option" && rule === "eu_options" ? "EU processing is not on for this account" : `this provider is ${DATA_ZONE_LABELS[zone]}`;
+  return `Blocked by the data-zone rule "${DATA_ZONE_RULE_LABELS[rule]}": ${why}.`;
+}
+export function filterRegistryByDataZone(registry, rule) {
+  const entries = isMergedRegistry(registry) ? registry.providers : registry;
+  const providers = {};
+  for (const [id, entry] of Object.entries(entries)) {
+    if (entryAllowedByDataZone(entry, rule)) providers[id] = entry;
+  }
+  if (!isMergedRegistry(registry)) return providers;
+  const kept = (id) => Object.hasOwn(providers, id);
+  return {
+    ...registry,
+    providers,
+    order: registry.order.filter(kept),
+    origin: Object.fromEntries(Object.entries(registry.origin).filter(([id]) => kept(id))),
+    locked: registry.locked.filter(kept)
+  };
+}

package/dist/runtime/shared/harness-providers.d.ts

@@ -8,9 +8,12 @@
  * Eligibility is by wire surface, never by vendor name: an entry is eligible
  * for a harness when it is an enabled `llm` entry whose `surface` the harness
  * declares. A harness that declares no surfaces accepts every `llm` entry.
+ * A host's data-zone rule then keeps out the entries outside it: such an
+ * entry is reported as `blocked-by-rule`, never eligible and never chosen.
  *
  * Browser-safe on purpose — no `node:` imports.
  */
+import type { DataZone, DataZoneRule } from "./provider-registry.js";
 /** How many registry entries a harness can run at once (`@skaile/workspaces` `HarnessInfo.providerPlurality`). */
 export type HarnessProviderPlurality = "registry" | "credentials-n" | "single";
 /** The slice of a harness the rule reads. `GET /api/agents` rows satisfy it. */
@@ -30,6 +33,32 @@ export interface HarnessProviderCandidate {
     surface?: string;
     /** Absent means enabled. */
     enabled?: boolean;
+    /** Catalog preset; gives the zone when {@link dataZone} is absent. */
+    preset?: string;
+    /** Effective data zone (`GET /api/providers` rows carry it). Absent: the preset's, else `transfer`. */
+    dataZone?: DataZone;
+    /** The account's EU-processing setting is on. */
+    euProcessing?: boolean;
+}
+/** Why an entry on a surface the harness speaks still cannot be used. */
+export type HarnessProviderBlockReason = "blocked-by-rule";
+/** One entry the harness could speak to that the host's rule keeps out. */
+export interface HarnessProviderBlock {
+    id: string;
+    reason: HarnessProviderBlockReason;
+    /** The rule in force. */
+    rule: DataZoneRule;
+    /** The rule's label ("EU only"). */
+    ruleLabel: string;
+    /** The entry's effective zone. */
+    zone: DataZone;
+    /** What a settings table shows on the box it cannot tick. Secret-free. */
+    message: string;
+}
+/** What {@link resolveHarnessProviders} applies beyond the surface rule. */
+export interface HarnessProviderOptions {
+    /** The host's data-zone rule. Absent: `any`. */
+    dataZoneRule?: DataZoneRule;
 }
 /**
  * - `chosen`: the stored pick, narrowed to what is still eligible, is used.
@@ -48,15 +77,25 @@ export interface HarnessProviderResolution<C extends HarnessProviderCandidate =
     state: HarnessProviderState;
     /** The harness can run several providers at once. */
     multiple: boolean;
-    /** Stored pick ids that are no longer eligible, deduplicated, in stored order. */
+    /** Stored pick ids that are no longer eligible (blocked ones included), deduplicated, in stored order. */
     stale: string[];
+    /** Candidates on a surface the harness speaks that the data-zone rule keeps out, in registry order. */
+    blocked: HarnessProviderBlock[];
 }
 /** Whether `candidate` is an enabled `llm` entry on a surface `harness` speaks. */
 export declare function isProviderEligibleForHarness(harness: HarnessProviderInfo, candidate: HarnessProviderCandidate): boolean;
+/**
+ * Why the data-zone rule keeps `candidate` out of `harness`, or `undefined`
+ * when it does not: the candidate must be otherwise eligible
+ * ({@link isProviderEligibleForHarness}) and outside `rule`.
+ */
+export declare function harnessProviderBlock(harness: HarnessProviderInfo, candidate: HarnessProviderCandidate, rule: DataZoneRule | undefined): HarnessProviderBlock | undefined;
 /**
  * Resolve the providers a harness runs against.
  *
  * @param candidates Registry entries in registry order.
  * @param selection The stored per-harness pick (`SkaileSettings.harnessProviders[harness.id]`).
+ * @param options.dataZoneRule The host's data-zone rule: entries outside it are
+ *   `blocked`, never eligible, never auto-chosen; a stored pick of one is `stale`.
  */
-export declare function resolveHarnessProviders<C extends HarnessProviderCandidate>(harness: HarnessProviderInfo, candidates: readonly C[], selection: readonly string[] | undefined): HarnessProviderResolution<C>;
+export declare function resolveHarnessProviders<C extends HarnessProviderCandidate>(harness: HarnessProviderInfo, candidates: readonly C[], selection: readonly string[] | undefined, options?: HarnessProviderOptions): HarnessProviderResolution<C>;

package/dist/runtime/shared/harness-providers.js

@@ -1,14 +1,35 @@
+import { DATA_ZONE_RULE_LABELS, dataZoneRefusal, presetDataZone } from "./data-zone.js";
 export function isProviderEligibleForHarness(harness, candidate) {
   if ((candidate.kind ?? "llm") !== "llm") return false;
   if (candidate.enabled === false) return false;
   if (!harness.surfaces) return true;
   return candidate.surface !== void 0 && harness.surfaces.includes(candidate.surface);
 }
-export function resolveHarnessProviders(harness, candidates, selection) {
+export function harnessProviderBlock(harness, candidate, rule) {
+  if (!rule || rule === "any" || !isProviderEligibleForHarness(harness, candidate)) {
+    return void 0;
+  }
+  const zone = candidate.dataZone ?? presetDataZone(candidate.preset) ?? "transfer";
+  const message = dataZoneRefusal(rule, zone, candidate.euProcessing);
+  if (!message) return void 0;
+  return {
+    id: candidate.id,
+    reason: "blocked-by-rule",
+    rule,
+    ruleLabel: DATA_ZONE_RULE_LABELS[rule],
+    zone,
+    message
+  };
+}
+export function resolveHarnessProviders(harness, candidates, selection, options = {}) {
   const multiple = harness.providerPlurality === "registry" || harness.providerPlurality === "credentials-n";
-  const eligible = candidates.filter(
-    (candidate) => isProviderEligibleForHarness(harness, candidate)
-  );
+  const blocked = [];
+  const eligible = candidates.filter((candidate) => {
+    if (!isProviderEligibleForHarness(harness, candidate)) return false;
+    const block = harnessProviderBlock(harness, candidate, options.dataZoneRule);
+    if (block) blocked.push(block);
+    return !block;
+  });
   const eligibleIds = new Set(eligible.map((candidate) => candidate.id));
   const picked = new Set(selection ?? []);
   const stale = [...picked].filter((id) => !eligibleIds.has(id));
@@ -19,11 +40,12 @@ export function resolveHarnessProviders(harness, candidates, selection) {
       selected: multiple ? usable : usable.slice(0, 1),
       state: "chosen",
       multiple,
-      stale
+      stale,
+      blocked
     };
   }
   if (eligible.length === 0) {
-    return { eligible, selected: [], state: "none-eligible", multiple, stale };
+    return { eligible, selected: [], state: "none-eligible", multiple, stale, blocked };
   }
   if (eligible.length === 1 || multiple) {
     return {
@@ -31,8 +53,9 @@ export function resolveHarnessProviders(harness, candidates, selection) {
       selected: eligible.map((candidate) => candidate.id),
       state: "auto",
       multiple,
-      stale
+      stale,
+      blocked
     };
   }
-  return { eligible, selected: [], state: "needs-choice", multiple, stale };
+  return { eligible, selected: [], state: "needs-choice", multiple, stale, blocked };
 }

package/dist/runtime/shared/harnesses.d.ts

@@ -17,3 +17,10 @@ export declare const HARNESS_LABELS: Record<string, string>;
 export declare const DEFAULT_ENABLED_HARNESSES: readonly ["omp", "claude-sdk", "codex"];
 /** Whether `id` is outside {@link DEFAULT_ENABLED_HARNESSES}, i.e. opt-in only. */
 export declare function isExperimentalHarness(id: string): boolean;
+/**
+ * The model roles ("models per task") each multi-model harness renders, keyed by
+ * harness id. A harness absent here runs one model and takes no roles.
+ */
+export declare const HARNESS_ROLES: Readonly<Record<string, readonly string[]>>;
+/** The role ids `harnessId` supports ({@link HARNESS_ROLES}); empty for a one-model harness. */
+export declare function harnessRoleIds(harnessId: string): string[];

package/dist/runtime/shared/harnesses.js

@@ -13,3 +13,21 @@ export const DEFAULT_ENABLED_HARNESSES = ["omp", "claude-sdk", "codex"];
 export function isExperimentalHarness(id) {
   return !DEFAULT_ENABLED_HARNESSES.includes(id);
 }
+export const HARNESS_ROLES = {
+  omp: [
+    "default",
+    "smol",
+    "slow",
+    "vision",
+    "plan",
+    "designer",
+    "commit",
+    "tiny",
+    "task",
+    "advisor"
+  ],
+  continue: ["chat", "edit", "apply", "autocomplete", "embed", "rerank", "summarize"]
+};
+export function harnessRoleIds(harnessId) {
+  return [...HARNESS_ROLES[harnessId] ?? []];
+}

package/dist/runtime/shared/provider-accounts.d.ts

@@ -0,0 +1,215 @@
+/**
+ * Provider accounts: how one signs in to a catalog preset, what a provider
+ * row says about its account, and the Microsoft Azure account that writes up
+ * to two registry entries (Azure OpenAI and Claude on Foundry) sharing one
+ * resource and one credential.
+ *
+ * Pure and browser-safe: the settings panel and the server's write gate read
+ * the same rules. The facts come from the catalog preset
+ * (`@skaile/workspaces`' `AIProviderPreset`): its `credential.kind`, its
+ * `transport`, its default `params` and its `required_params`. The catalog
+ * names no list of accepted sign-in kinds, so they are derived here from those
+ * facts.
+ */
+import { type AIProviderCredential, type AIProviderCredentialKind, type AIProviderTransport } from "./provider-registry.js";
+/** The preset facts the account helpers read; a catalog preset and its summary both fit. */
+export interface ProviderAccountPreset {
+    id: string;
+    label: string;
+    transport?: AIProviderTransport;
+    credential: {
+        kind: AIProviderCredentialKind;
+        env?: string;
+    };
+    /** Default routing parameters. */
+    params?: Record<string, string>;
+    /** `params` keys the operator must supply. */
+    required_params?: string[];
+}
+/**
+ * The `params` keys a preset requires that `params` leaves empty: the
+ * preset's `required_params` minus the ones its own `params` default.
+ * A value that is not a non-blank string, number or boolean counts as missing.
+ */
+export declare function missingRequiredParams(preset: Pick<ProviderAccountPreset, "required_params" | "params">, params: Record<string, unknown> | undefined): string[];
+/** What the add/edit dialog calls each routing parameter. */
+export declare const PROVIDER_PARAM_LABELS: Record<string, string>;
+/**
+ * Parameters the operator sets only in expert mode: the dialog prefills them
+ * and shows them read-only otherwise.
+ */
+export declare const EXPERT_PARAMS: readonly string[];
+/**
+ * The parameter fields an entry of `preset` needs: its required params the
+ * preset gives no default for, then any further key `current` already holds.
+ */
+export declare function presetParamKeys(preset: Pick<ProviderAccountPreset, "required_params" | "params"> | null | undefined, current?: Record<string, unknown> | undefined): string[];
+/** The value the dialog prefills for parameter `key` of `presetId`, else `""`. */
+export declare function defaultParamValue(presetId: string | undefined, key: string): string;
+/** One way to sign in to a provider, as the add flow's "How do you sign in?" step lists it. */
+export type ProviderSignInId = "api_key" | "entra" | "aws" | "google" | "oauth" | "none" | "reference";
+/** What the sign-in step offers for one {@link ProviderSignInId}. */
+export interface ProviderSignInOption {
+    id: ProviderSignInId;
+    label: string;
+    description: string;
+    /** The `credential.kind` the entry gets. */
+    credentialKind: AIProviderCredentialKind;
+    /**
+     * The fields the next step shows: `key` = environment variable name plus
+     * an optional value for the scope's `.env`; `reference` = a typed
+     * `env:` / `keyring:` / `cmd:` / `platform:` reference; `none` = nothing
+     * (no credential, or the server's ambient cloud chain signs).
+     */
+    fields: "key" | "reference" | "none";
+}
+/** Transports that run on a Microsoft Azure resource. */
+export declare const AZURE_TRANSPORTS: readonly AIProviderTransport[];
+/** Whether a transport runs on a Microsoft Azure resource (and so accepts Entra ID). */
+export declare function isAzureTransport(transport: AIProviderTransport | undefined): boolean;
+/**
+ * The sign-in kinds a preset accepts, in the order the sign-in step lists
+ * them. `null` is a custom entry (no preset).
+ *
+ * - `none` presets (local model servers): No sign-in only.
+ * - `api_key_header` / `bearer` presets: API key; Azure transports
+ *   (`azure-openai`, `foundry`) list Entra ID first, then API key.
+ * - `oauth` / `command` presets: a reference (the token lives behind one).
+ * - `expert`: the raw Reference form is added for every preset that takes a
+ *   credential.
+ */
+export declare function presetSignInOptions(preset: Pick<ProviderAccountPreset, "credential" | "transport"> | null, options?: {
+    expert?: boolean;
+}): ProviderSignInOption[];
+/** What the sign-in fields hold. */
+export interface ProviderSignInInput {
+    /** `key` fields: the environment variable the key lives in. */
+    envName?: string;
+    /** `reference` fields: the typed reference. */
+    ref?: string;
+}
+/** The credential a sign-in choice writes, or why it cannot be written. */
+export type ProviderSignInCredential = {
+    ok: true;
+    credential?: AIProviderCredential;
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * The `credential` of an entry signed in with `option`.
+ *
+ * `key`: `{ kind, ref: "env:<NAME>" }`; a blank name falls back to
+ * `defaultEnv` (the preset's conventional variable) and, without one, writes
+ * no credential so the preset's own applies — unless `requireCredential`.
+ * `reference`: `{ kind, ref }` after the reference check. `none` fields: a
+ * cloud chain writes `{ kind }` without a reference, No sign-in writes
+ * `{ kind: "none" }`.
+ */
+export declare function signInCredential(option: ProviderSignInOption, input: ProviderSignInInput, context?: {
+    defaultEnv?: string;
+    requireCredential?: boolean;
+}): ProviderSignInCredential;
+/** The sign-in option an existing credential corresponds to, among `options`. */
+export declare function signInOptionOf(credential: {
+    kind?: AIProviderCredentialKind;
+    ref?: string;
+} | undefined, options: readonly ProviderSignInOption[]): ProviderSignInOption | undefined;
+/** What a row says for each credential kind. */
+export declare const CREDENTIAL_KIND_LABELS: Record<AIProviderCredentialKind, string>;
+/** The family an Azure-transport entry belongs to. */
+export declare const AZURE_FAMILY_LABEL = "Microsoft Azure";
+/**
+ * The provider family a row belongs to: "Microsoft Azure" for an
+ * Azure transport, else its preset's label, else "Custom".
+ */
+export declare function providerFamilyLabel(entry: {
+    preset?: string;
+    transport?: AIProviderTransport;
+}, presets: readonly Pick<ProviderAccountPreset, "id" | "label" | "transport">[]): string;
+/**
+ * The account line of a provider row: family · sign-in kind · resource, each
+ * part only when known — "Microsoft Azure · Entra ID · contoso-ai".
+ */
+export declare function providerAccountLine(entry: {
+    preset?: string;
+    transport?: AIProviderTransport;
+    credentialKind?: AIProviderCredentialKind;
+    transportParams?: Record<string, string>;
+}, presets: readonly Pick<ProviderAccountPreset, "id" | "label" | "transport" | "credential">[]): string;
+/** A credential's expiry as a row shows it. */
+export interface CredentialExpiry {
+    /** Whole days left, rounded down; `0` = expires within a day, negative = expired. */
+    days: number;
+    expired: boolean;
+    /** "Expires in 12 days" · "Expires in 1 day" · "Expires today" · "Expired". */
+    text: string;
+}
+/** The expiry line for an ISO timestamp, or `null` when there is none or it does not parse. */
+export declare function credentialExpiry(expiresAt: string | null | undefined, now?: number): CredentialExpiry | null;
+/** Catalog preset of the Azure OpenAI entry. */
+export declare const AZURE_OPENAI_PRESET = "azure-openai";
+/** Catalog preset of the Claude on Foundry entry. */
+export declare const FOUNDRY_PRESET = "foundry";
+/**
+ * The `api_version` the Azure account prefills when the preset names none
+ * (the catalog's `azure-openai` preset requires it but has no default).
+ */
+export declare const AZURE_OPENAI_DEFAULT_API_VERSION = "2025-04-01-preview";
+/** One deployment row: the Azure deployment name and the logical model id it serves. */
+export interface ProviderDeploymentRow {
+    deployment: string;
+    /** Logical model id (the `model_map` key). Blank: the deployment name. */
+    model: string;
+}
+/**
+ * `model_map` (logical id → deployment name) from deployment rows. Rows with
+ * both fields blank are skipped; a model without a deployment, or two rows
+ * naming the same logical id, is refused.
+ */
+export declare function deploymentModelMap(rows: readonly ProviderDeploymentRow[]): {
+    ok: true;
+    modelMap: Record<string, string>;
+} | {
+    ok: false;
+    error: string;
+};
+/** What the Microsoft Azure card collects. */
+export interface AzureAccountInput {
+    /** Azure resource name: the `{resource}` of `<resource>.openai.azure.com` / `<resource>.services.ai.azure.com`. */
+    resource: string;
+    /** The one credential both entries get (from {@link signInCredential}). */
+    credential?: AIProviderCredential;
+    /** Set: write an Azure OpenAI entry. At least one deployment. */
+    openai?: {
+        deployments: readonly ProviderDeploymentRow[];
+        apiVersion: string;
+    };
+    /** Set: write a Claude on Foundry entry; deployments are optional. */
+    foundry?: {
+        deployments: readonly ProviderDeploymentRow[];
+    };
+    /** Entry ids the scope already uses; new ids avoid them. */
+    takenIds?: readonly string[];
+}
+/** One entry to `PUT`: its id and body. */
+export interface ProviderEntryDraft {
+    id: string;
+    body: Record<string, unknown>;
+}
+/**
+ * The registry entries one Microsoft Azure account writes: an Azure OpenAI
+ * entry (preset `azure-openai`, `params` `{ resource, deployment, api_version }`
+ * with the first deployment as the routed one, `model_map` from the
+ * deployment rows) and/or a Claude on Foundry entry (preset `foundry`,
+ * `params.resource`, optional `model_map`). Both carry the same resource and
+ * the same credential. Ids are the preset ids, else `<preset>-<resource>`,
+ * else numbered, never one of `takenIds`.
+ */
+export declare function azureAccountEntries(input: AzureAccountInput): {
+    ok: true;
+    entries: ProviderEntryDraft[];
+} | {
+    ok: false;
+    error: string;
+};