@skaile/forge-settings 1.3.2 → 1.4.0

package/dist/runtime/shared/provider-accounts.js

@@ -0,0 +1,255 @@
+import {
+  validateCredentialRef
+} from "./provider-registry.js";
+export function missingRequiredParams(preset, params) {
+  return (preset.required_params ?? []).filter((key) => {
+    if (preset.params?.[key] !== void 0) return false;
+    const value = params?.[key];
+    if (typeof value === "number" || typeof value === "boolean") return false;
+    return typeof value !== "string" || value.trim() === "";
+  });
+}
+export const PROVIDER_PARAM_LABELS = {
+  resource: "Resource",
+  deployment: "Deployment",
+  api_version: "API version",
+  region: "Region",
+  project: "Project",
+  location: "Location",
+  publisher: "Publisher"
+};
+export const EXPERT_PARAMS = ["api_version"];
+export function presetParamKeys(preset, current = void 0) {
+  const keys = (preset?.required_params ?? []).filter((key) => preset?.params?.[key] === void 0);
+  for (const key of Object.keys(current ?? {})) if (!keys.includes(key)) keys.push(key);
+  return keys;
+}
+export function defaultParamValue(presetId, key) {
+  return presetId === AZURE_OPENAI_PRESET && key === "api_version" ? AZURE_OPENAI_DEFAULT_API_VERSION : "";
+}
+export const AZURE_TRANSPORTS = ["azure-openai", "foundry"];
+export function isAzureTransport(transport) {
+  return transport !== void 0 && AZURE_TRANSPORTS.includes(transport);
+}
+function apiKeyOption(kind) {
+  return {
+    id: "api_key",
+    label: "API key",
+    description: "A key from the provider. It is stored in this scope's environment; the entry only names the variable.",
+    credentialKind: kind,
+    fields: "key"
+  };
+}
+const ENTRA_OPTION = {
+  id: "entra",
+  label: "Entra ID",
+  description: "Microsoft Entra ID: the server's Azure identity signs the requests (managed identity, az login or AZURE_CLIENT_ID / AZURE_CLIENT_SECRET / AZURE_TENANT_ID). No key is stored.",
+  credentialKind: "azure_entra",
+  fields: "none"
+};
+const AWS_OPTION = {
+  id: "aws",
+  label: "AWS credentials",
+  description: "The server's AWS default credential chain signs the requests. No key is stored.",
+  credentialKind: "sigv4",
+  fields: "none"
+};
+const GOOGLE_OPTION = {
+  id: "google",
+  label: "Google credentials",
+  description: "Google application default credentials on the server sign the requests. No key is stored.",
+  credentialKind: "google_adc",
+  fields: "none"
+};
+const OAUTH_OPTION = {
+  id: "oauth",
+  label: "OAuth",
+  description: "An OAuth token held behind a reference (keyring, command or control plane).",
+  credentialKind: "oauth",
+  fields: "reference"
+};
+const NONE_OPTION = {
+  id: "none",
+  label: "No sign-in",
+  description: "The endpoint takes no credential, such as a model server on this machine.",
+  credentialKind: "none",
+  fields: "none"
+};
+function referenceOption(kind) {
+  return {
+    id: "reference",
+    label: "Reference",
+    description: "Type the credential reference yourself: env:NAME, keyring:service/account, cmd:\u2026 or platform:\u2026.",
+    credentialKind: kind,
+    fields: "reference"
+  };
+}
+export function presetSignInOptions(preset, options = {}) {
+  const out = [];
+  const kind = preset?.credential.kind;
+  if (!preset) {
+    out.push(apiKeyOption("bearer"), NONE_OPTION);
+  } else if (kind === "none") {
+    out.push(NONE_OPTION);
+  } else if (kind === "sigv4") {
+    out.push(AWS_OPTION);
+  } else if (kind === "google_adc") {
+    out.push(GOOGLE_OPTION);
+  } else if (kind === "azure_entra") {
+    out.push(ENTRA_OPTION);
+  } else if (kind === "oauth") {
+    out.push(OAUTH_OPTION);
+  } else if (kind === "command") {
+    out.push(referenceOption("command"));
+  } else if (kind === "api_key_header" || kind === "bearer") {
+    if (isAzureTransport(preset.transport)) out.push(ENTRA_OPTION);
+    out.push(apiKeyOption(kind));
+  }
+  const referenceKind = kind ?? "bearer";
+  if (options.expert && referenceKind !== "none" && !out.some((o) => o.fields === "reference")) {
+    out.push(referenceOption(referenceKind));
+  }
+  return out;
+}
+const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+export function signInCredential(option, input, context = {}) {
+  if (option.fields === "none") return { ok: true, credential: { kind: option.credentialKind } };
+  if (option.fields === "reference") {
+    const ref = input.ref?.trim() ?? "";
+    if (!ref) return { ok: false, error: "Enter a credential reference." };
+    const refusal = validateCredentialRef(ref);
+    if (refusal) return { ok: false, error: refusal };
+    return { ok: true, credential: { kind: option.credentialKind, ref } };
+  }
+  const name = input.envName?.trim() || context.defaultEnv || "";
+  if (!name) {
+    return context.requireCredential ? { ok: false, error: "Name the environment variable the key is stored in." } : { ok: true };
+  }
+  if (!ENV_NAME.test(name)) {
+    return { ok: false, error: `'${name}' is not a valid environment variable name.` };
+  }
+  return { ok: true, credential: { kind: option.credentialKind, ref: `env:${name}` } };
+}
+export function signInOptionOf(credential, options) {
+  if (!credential?.kind) return options[0];
+  const sameKind = options.filter((o) => o.credentialKind === credential.kind);
+  const ref = credential.ref;
+  const wanted = !ref ? sameKind.some((o) => o.fields === "none") ? "none" : "key" : ref.startsWith("env:") ? "key" : "reference";
+  return sameKind.find((o) => o.fields === wanted) ?? sameKind[0];
+}
+export const CREDENTIAL_KIND_LABELS = {
+  api_key_header: "API key",
+  bearer: "API key",
+  azure_entra: "Entra ID",
+  sigv4: "AWS credentials",
+  google_adc: "Google credentials",
+  oauth: "OAuth",
+  command: "Command",
+  none: "No sign-in"
+};
+export const AZURE_FAMILY_LABEL = "Microsoft Azure";
+export function providerFamilyLabel(entry, presets) {
+  const preset = entry.preset ? presets.find((p) => p.id === entry.preset) : void 0;
+  if (isAzureTransport(entry.transport ?? preset?.transport)) return AZURE_FAMILY_LABEL;
+  return preset?.label ?? (entry.preset ? entry.preset : "Custom");
+}
+export function providerAccountLine(entry, presets) {
+  const preset = entry.preset ? presets.find((p) => p.id === entry.preset) : void 0;
+  const kind = entry.credentialKind ?? preset?.credential.kind;
+  const resource = entry.transportParams?.resource?.trim();
+  return [
+    providerFamilyLabel(entry, presets),
+    kind ? CREDENTIAL_KIND_LABELS[kind] : null,
+    resource || null
+  ].filter((part) => !!part).join(" \xB7 ");
+}
+const DAY_MS = 24 * 60 * 60 * 1e3;
+export function credentialExpiry(expiresAt, now = Date.now()) {
+  if (!expiresAt) return null;
+  const at = Date.parse(expiresAt);
+  if (!Number.isFinite(at)) return null;
+  if (at <= now) return { days: Math.floor((at - now) / DAY_MS), expired: true, text: "Expired" };
+  const days = Math.floor((at - now) / DAY_MS);
+  const text = days === 0 ? "Expires today" : `Expires in ${days} day${days === 1 ? "" : "s"}`;
+  return { days, expired: false, text };
+}
+export const AZURE_OPENAI_PRESET = "azure-openai";
+export const FOUNDRY_PRESET = "foundry";
+export const AZURE_OPENAI_DEFAULT_API_VERSION = "2025-04-01-preview";
+export function deploymentModelMap(rows) {
+  const modelMap = {};
+  for (const row of rows) {
+    const deployment = row.deployment.trim();
+    const model = row.model.trim();
+    if (!deployment && !model) continue;
+    if (!deployment) return { ok: false, error: `Name the deployment that serves '${model}'.` };
+    const id = model || deployment;
+    if (Object.hasOwn(modelMap, id)) return { ok: false, error: `Model '${id}' is listed twice.` };
+    modelMap[id] = deployment;
+  }
+  return { ok: true, modelMap };
+}
+const AZURE_RESOURCE = /^[A-Za-z0-9](?:[A-Za-z0-9-]*[A-Za-z0-9])?$/;
+function freeId(base, resource, taken) {
+  if (!taken.has(base)) return base;
+  const slug = resource.toLowerCase().replace(/[^a-z0-9_-]+/g, "-").replace(/^-+|-+$/g, "");
+  const withResource = slug ? `${base}-${slug}` : base;
+  if (!taken.has(withResource)) return withResource;
+  for (let n = 2; ; n++) {
+    const candidate = `${withResource}-${n}`;
+    if (!taken.has(candidate)) return candidate;
+  }
+}
+export function azureAccountEntries(input) {
+  const resource = input.resource.trim();
+  if (!resource) return { ok: false, error: "Enter the Azure resource name." };
+  if (!AZURE_RESOURCE.test(resource)) {
+    return {
+      ok: false,
+      error: "An Azure resource name has letters, digits and hyphens, and starts and ends with a letter or digit."
+    };
+  }
+  if (!input.openai && !input.foundry) {
+    return { ok: false, error: "Choose Azure OpenAI, Claude on Foundry or both." };
+  }
+  const taken = new Set(input.takenIds ?? []);
+  const entries = [];
+  const credential = input.credential ? { credential: { ...input.credential } } : {};
+  if (input.openai) {
+    const map = deploymentModelMap(input.openai.deployments);
+    if (!map.ok) return map;
+    const first = Object.values(map.modelMap)[0];
+    if (!first) return { ok: false, error: "Add at least one Azure OpenAI deployment." };
+    const apiVersion = input.openai.apiVersion.trim();
+    if (!apiVersion) return { ok: false, error: "Enter the Azure OpenAI api_version." };
+    const id = freeId(AZURE_OPENAI_PRESET, resource, taken);
+    taken.add(id);
+    entries.push({
+      id,
+      body: {
+        preset: AZURE_OPENAI_PRESET,
+        label: "Azure OpenAI",
+        params: { resource, deployment: first, api_version: apiVersion },
+        model_map: map.modelMap,
+        ...credential
+      }
+    });
+  }
+  if (input.foundry) {
+    const map = deploymentModelMap(input.foundry.deployments);
+    if (!map.ok) return map;
+    const id = freeId(FOUNDRY_PRESET, resource, taken);
+    taken.add(id);
+    entries.push({
+      id,
+      body: {
+        preset: FOUNDRY_PRESET,
+        label: "Claude on Foundry",
+        params: { resource },
+        ...Object.keys(map.modelMap).length > 0 ? { model_map: map.modelMap } : {},
+        ...credential
+      }
+    });
+  }
+  return { ok: true, entries };
+}

package/dist/runtime/shared/provider-registry.d.ts

@@ -35,6 +35,23 @@ export type AIProviderTransport = (typeof AI_PROVIDER_TRANSPORTS)[number];
 export declare const AI_PROVIDER_CREDENTIAL_KINDS: readonly ["api_key_header", "bearer", "sigv4", "google_adc", "azure_entra", "oauth", "command", "none"];
 /** Union of {@link AI_PROVIDER_CREDENTIAL_KINDS}. */
 export type AIProviderCredentialKind = (typeof AI_PROVIDER_CREDENTIAL_KINDS)[number];
+/**
+ * Where an endpoint processes data: `eu` inside the EU, `eu_option` only once
+ * the account's EU-processing setting is on, `transfer` outside the EU,
+ * `local` on the operator's own machine or network. Upstream
+ * `AI_PROVIDER_DATA_ZONES` (`@skaile/workspaces` 9.1).
+ */
+export declare const DATA_ZONES: readonly ["eu", "eu_option", "transfer", "local"];
+/** Union of {@link DATA_ZONES}. */
+export type DataZone = (typeof DATA_ZONES)[number];
+/**
+ * Which data zones a host allows: `any` all, `eu_options` EU, local and
+ * `eu_option` entries with `eu_processing: true`, `eu` only EU and local.
+ * Upstream `AI_PROVIDER_DATA_ZONE_RULES` (`@skaile/workspaces` 9.1).
+ */
+export declare const DATA_ZONE_RULES: readonly ["any", "eu_options", "eu"];
+/** Union of {@link DATA_ZONE_RULES}. */
+export type DataZoneRule = (typeof DATA_ZONE_RULES)[number];
 /** `transport: bedrock` routing parameters. */
 export interface AIProviderBedrockParams {
     /** AWS region, e.g. `us-east-1`. */
@@ -119,6 +136,10 @@ export interface AIProviderEntryCommon {
     enabled?: boolean;
     /** Set by the control plane: lower layers cannot override this entry. */
     locked?: boolean;
+    /** Where the endpoint processes data; overrides the preset's zone. Read it through `entryDataZone`. */
+    data_zone?: DataZone;
+    /** The account's EU-processing setting is on; only an `eu_option` entry reads it. */
+    eu_processing?: boolean;
 }
 /** An `llm`/`embed` entry — the full record. */
 export type AIProviderLlmEntry = AIProviderEntryCommon & AIProviderTransportSlice & {
@@ -132,6 +153,12 @@ export type AIProviderLlmEntry = AIProviderEntryCommon & AIProviderTransportSlic
     /** Keyed by the logical id, i.e. the `model_map` key. */
     capabilities?: Record<string, AIProviderCapabilities>;
     discovery?: AIProviderDiscovery;
+    /**
+     * The models this entry may be used with; absent = every model, `[]` =
+     * none. Logical ids of `model_map`, or provider-side ids (what a
+     * `discovery` entry lists). Read it through {@link isModelAllowed}.
+     */
+    allowed_models?: string[];
 };
 /**
  * An `stt`/`tts` entry — the reduced record. `surface`, `transport`,
@@ -184,6 +211,17 @@ export declare function registryEntries(registry: AIProviderRegistryView): Array
 export declare function entriesOfKind<K extends AIProviderKind>(registry: AIProviderRegistryView, kind: K): Array<[string, K extends AIProviderVoiceKind ? AIProviderVoiceEntry : AIProviderLlmEntry]>;
 /** Whether an entry uses the reduced voice record. Narrows `params` into view. */
 export declare function isVoiceEntry(entry: AIProviderEntry): entry is AIProviderVoiceEntry;
+/**
+ * Whether an entry's `allowed_models` lets it be used with `modelId`. Absent
+ * allows every model, `[]` none. `modelId` and the list may each hold the
+ * logical id (a `model_map` key) or the provider-side id; a trailing
+ * thinking-level suffix (`:high`) is ignored. Mirrors `isModelAllowed` of
+ * `@skaile/workspaces/core` 9.1, which enforces it at model resolution.
+ */
+export declare function isModelAllowed(entry: {
+    allowed_models?: readonly string[];
+    model_map?: Record<string, string>;
+}, modelId: string): boolean;
 /**
  * The one `params` key a settings override replaces, per voice kind.
  *

package/dist/runtime/shared/provider-registry.js

@@ -27,6 +27,8 @@ export const AI_PROVIDER_CREDENTIAL_KINDS = [
   "command",
   "none"
 ];
+export const DATA_ZONES = ["eu", "eu_option", "transfer", "local"];
+export const DATA_ZONE_RULES = ["any", "eu_options", "eu"];
 export function isMergedRegistry(registry) {
   return Array.isArray(registry.order);
 }
@@ -47,6 +49,20 @@ export function entriesOfKind(registry, kind) {
 export function isVoiceEntry(entry) {
   return entry.kind === "stt" || entry.kind === "tts";
 }
+const THINKING_SUFFIX = /:(off|minimal|low|medium|high|xhigh)$/i;
+export function isModelAllowed(entry, modelId) {
+  const list = entry.allowed_models;
+  if (list === void 0) return true;
+  const matches = (id) => {
+    if (list.includes(id)) return true;
+    const mapped = entry.model_map?.[id];
+    if (mapped !== void 0 && list.includes(mapped)) return true;
+    return list.some((allowed) => entry.model_map?.[allowed] === id);
+  };
+  if (matches(modelId)) return true;
+  const base = modelId.replace(THINKING_SUFFIX, "");
+  return base !== modelId && matches(base);
+}
 export const VOICE_OVERRIDE_PARAM = { stt: "language", tts: "voice_id" };
 export const VOICE_OVERRIDE_SETTING = { stt: "sttLanguage", tts: "ttsVoice" };
 export function selectVoiceEntryId(ids, wanted) {

package/dist/runtime/shared/settings-types.d.ts

@@ -55,6 +55,13 @@ export interface SkaileSettings extends Omit<CoreSettings, "apiKeys"> {
      * harness, all of them) is used automatically.
      */
     harnessProviders?: Record<string, string[]>;
+    /**
+     * Per-harness model per task ("roles"): role id → model selector
+     * (`"<providerId>/<modelId>"`), keyed by harness id. Only harnesses with
+     * `HARNESS_ROLES` take roles (omp, Continue); hosts pass the session
+     * harness's map to `skaile serve --roles`. Frozen by `lockModel`.
+     */
+    harnessRoles?: Record<string, Record<string, string>>;
     /**
      * Instance allow-list of harness ids the harness picker offers. Absent means
      * `DEFAULT_ENABLED_HARNESSES`.

package/dist/runtime/vue/index.d.ts

@@ -6,10 +6,12 @@
  * `ForgeProvidersPanel` itself is registered as a component by
  * `@skaile/forge-settings/nuxt`.
  */
+export * from "../shared/data-zone.js";
 export * from "../shared/env-vars.js";
 export * from "../shared/harness-providers.js";
 export * from "../shared/harnesses.js";
 export * from "../shared/model-roles.js";
+export * from "../shared/provider-accounts.js";
 export * from "../shared/provider-registry.js";
 export * from "./model-roles-panel.js";
 export * from "./providers-client.js";

package/dist/runtime/vue/index.js

@@ -1,7 +1,9 @@
+export * from "../shared/data-zone.js";
 export * from "../shared/env-vars.js";
 export * from "../shared/harness-providers.js";
 export * from "../shared/harnesses.js";
 export * from "../shared/model-roles.js";
+export * from "../shared/provider-accounts.js";
 export * from "../shared/provider-registry.js";
 export * from "./model-roles-panel.js";
 export * from "./providers-client.js";

package/dist/runtime/vue/providers-panel-model.d.ts

@@ -5,7 +5,8 @@
  * are re-exported by `useProvidersPanel`; the rest is internal to the package.
  */
 import type { EnvLayerId } from "../shared/env-vars.js";
-import type { AIProviderCredentialKind, AIProviderKind, AIProviderSurface } from "../shared/provider-registry.js";
+import type { CredentialExpiry, ProviderDeploymentRow, ProviderSignInId } from "../shared/provider-accounts.js";
+import type { AIProviderCredentialKind, AIProviderKind, AIProviderSurface, AIProviderTransport, DataZone, DataZoneRule } from "../shared/provider-registry.js";
 import type { ProvidersPanelClient } from "./providers-client.js";
 /** Registry document a provider entry is defined in. */
 export type ProvidersPanelLayer = "instance" | "workspace";
@@ -43,6 +44,17 @@ export interface ProvidersPanelProps {
      * `layer`; a string replaces it; `false` hides it (Add provider stays).
      */
     note?: string | false;
+    /**
+     * Expert mode: the sign-in step also offers the raw reference form
+     * (`env:` / `keyring:` / `cmd:` / `platform:`) and expert-only parameters
+     * (`api_version`) become editable. Default `false`.
+     */
+    expert?: boolean;
+    /**
+     * The host's data-zone rule ("Where may AI process data?"). Rows outside it
+     * show a muted note naming the rule. Absent or `any`: no row is marked.
+     */
+    dataZoneRule?: DataZoneRule;
 }
 /** Emits both variants declare. */
 export type ProvidersPanelEmit = (event: "changed") => void;
@@ -63,12 +75,29 @@ export interface ProvidersPanelEntry {
     baseUrl?: string;
     preset?: string;
     surface?: AIProviderSurface;
+    /** How requests reach the surface, when not `direct`. */
+    transport?: AIProviderTransport;
+    /** Routing parameters (`resource`, `deployment`, `api_version`, …) of an `llm`/`embed` entry. */
+    transportParams?: Record<string, string>;
+    /**
+     * When the credential expires (ISO timestamp), for a credential that
+     * reports one. The row then shows "Expires in N days · Renew".
+     */
+    credentialExpiresAt?: string | null;
     enabled: boolean;
     locked: boolean;
     /** Registry documents holding the id, lowest first: `["instance"]`, `["workspace"]` or both. */
     layers: ProvidersPanelLayer[];
     /** The scope's own document's values for the editable fields the dialog does not show. */
     layerFields?: Record<string, unknown>;
+    /** Where the entry processes data. Absent (an older host): the preset's zone, else `transfer`. */
+    dataZone?: DataZone;
+    /** The entry's `eu_processing` switch. */
+    euProcessing?: boolean;
+    /** The entry's `allowed_models`; absent = every model, `[]` = none. */
+    allowedModels?: string[];
+    /** Logical model ids the entry declares (`model_map`); absent: its models come from discovery. */
+    modelIds?: string[];
 }
 /** One catalog preset, as `GET /api/providers/presets` and `.../detected` list it. */
 export interface ProvidersPanelPreset {
@@ -76,12 +105,18 @@ export interface ProvidersPanelPreset {
     label: string;
     kind: AIProviderKind;
     surface?: AIProviderSurface;
+    /** How requests reach the surface; Azure transports offer Entra ID sign-in. */
+    transport?: AIProviderTransport;
     base_url?: string;
     base_url_env?: string;
     credential: {
         kind: AIProviderCredentialKind;
         env?: string;
     };
+    /** Default parameters. */
+    params?: Record<string, string>;
+    /** `params` keys an entry naming this preset must supply. */
+    required_params?: string[];
 }
 /** Where a row's entry lives relative to the scope's own document. */
 export type ProvidersPanelRowState = "own" | "inherited" | "patched";
@@ -121,8 +156,25 @@ export interface ProvidersPanelRow extends ProvidersPanelEntry {
     origin: string;
     /** `configured · <source>`, `missing <VAR>`, the resolver's reason, or `No credential needed.`. */
     status: string;
-    /** Which other layer defines or overrides the credential; see the panel contract. */
     overrideNotices: string[];
+    /** "Microsoft Azure · Entra ID · contoso-ai": family · sign-in kind · resource. */
+    accountLine: string;
+    /** The credential's expiry, when it reports one. */
+    expiry: CredentialExpiry | null;
+    /** "Renew" is offered next to the expiry: the credential can be changed here. */
+    canRenew: boolean;
+    /** The entry's effective data zone. */
+    zone: DataZone;
+    /** The zone chip: EU / EU option / Transfer / Local. */
+    zoneLabel: string;
+    /** "EU processing is on for this account" is offered: an `eu_option` entry the panel may write. */
+    canSetEuProcessing: boolean;
+    /** Why the host's data-zone rule keeps the entry out, naming the rule; `null` when it does not. */
+    blockedNote: string | null;
+    /** The model chip: "All models" | "N models". `null` for a voice entry. */
+    modelsChip: string | null;
+    /** "Models allowed here" can be changed: an `llm`/`embed` entry the panel may write. */
+    canFilterModels: boolean;
 }
 /** The add/edit dialog's fields. */
 export interface ProvidersPanelForm {
@@ -133,15 +185,48 @@ export interface ProvidersPanelForm {
     surface: string;
     /** Empty: the preset's endpoint. */
     baseUrl: string;
-    /** Adding only: the `env:` variable the credential references. */
+    /** Key sign-in: the `env:` variable the credential references. */
     envName: string;
-    /** Adding only, "Set value now": written to the scope's `.env`, never to the provider route. */
+    /** Key sign-in, "Set value now": written to the scope's `.env`, never to the provider route. */
     secret: string;
+    /** The chosen "How do you sign in?" option. */
+    signIn: ProviderSignInId | "";
+    /** `reference` sign-in: the typed reference. */
+    credentialRef: string;
+    /** Routing parameters by key (`resource`, `deployment`, `api_version`, …). */
+    params: Record<string, string>;
+}
+/** The Microsoft Azure card's fields. */
+export interface ProvidersPanelAzureForm {
+    /** Azure resource name, shared by both entries. */
+    resource: string;
+    /** Write an Azure OpenAI entry. */
+    useOpenAI: boolean;
+    /** Write a Claude on Foundry entry. */
+    useFoundry: boolean;
+    /** Azure OpenAI deployments: deployment name → logical model id (`model_map`). */
+    deployments: ProviderDeploymentRow[];
+    /** Azure OpenAI `api_version`; prefilled, editable in expert mode. */
+    apiVersion: string;
+}
+/** The add dialog's step: preset library, then the account fields, then the test of what was created. */
+export type ProvidersPanelDialogStep = "library" | "account" | "done";
+/** "Models allowed here": every model, or only the listed ones. */
+export type ProvidersPanelModelsMode = "all" | "only";
+/** The "Models allowed here" editor's fields. */
+export interface ProvidersPanelModelsForm {
+    mode: ProvidersPanelModelsMode;
+    /** The ticked model ids. */
+    selected: string[];
+    /** The checklist's search text. */
+    query: string;
 }
 /** The preset select's value for an entry that names no preset. */
 export declare const CUSTOM_PRESET = "__custom__";
 /** Credential select value: open the inline key editor. */
 export declare const CREDENTIAL_ENTER_KEY = "__enter_key__";
+/** The preset select's value for the Microsoft Azure account (Azure OpenAI and/or Claude on Foundry). */
+export declare const AZURE_ACCOUNT = "__azure__";
 /** Credential select value: open the inline reference editor. */
 export declare const CREDENTIAL_OTHER_REF = "__other_ref__";
 /** Registry ids the write routes accept (`isSafeProviderId` upstream). */
@@ -163,6 +248,14 @@ export declare function providersPanelRowMeta(row: {
 export declare const ENV_REF_PATTERN: RegExp;
 /** The credential kind a written reference gets when the row states none. */
 export declare const FALLBACK_CREDENTIAL_KIND: AIProviderCredentialKind;
+/** A row's model chip: "All models" without an allow-list, else its size. */
+export declare function providerModelsChip(allowedModels: readonly string[] | undefined): string;
+/**
+ * The checklist's ids: the known models (declared or discovered) in their
+ * order, then any allowed id neither lists (so it can still be unticked),
+ * narrowed by a case-insensitive `query`.
+ */
+export declare function providerModelChoices(known: readonly string[], allowed: readonly string[], query?: string): string[];
 export declare const ENV_SOURCE_LABEL: Record<EnvLayerId, string>;
 export declare const OVERRIDES_INSTANCE_NOTICE = "Entering a key here stores it in this workspace's .env and overrides that value for this workspace.";
 /**
@@ -174,4 +267,4 @@ export declare function requestErrorMessage(err: unknown, fallback: string): str
 export declare function envNameOfRef(ref: string | undefined): string | undefined;
 /** `configured · …` for a reference that is not an env var. */
 export declare function nonEnvSourceLabel(ref: string): string | undefined;
-export declare const EMPTY_FORM: Readonly<ProvidersPanelForm>;
+export declare const EMPTY_FORM: Readonly<Omit<ProvidersPanelForm, "params">>;

package/dist/runtime/vue/providers-panel-model.js

@@ -1,5 +1,6 @@
 export const CUSTOM_PRESET = "__custom__";
 export const CREDENTIAL_ENTER_KEY = "__enter_key__";
+export const AZURE_ACCOUNT = "__azure__";
 export const CREDENTIAL_OTHER_REF = "__other_ref__";
 export const PROVIDER_ID_PATTERN = /^[a-z0-9][a-z0-9_-]*$/;
 export const DEFAULT_PRESETS_URL = "/api/providers/presets";
@@ -14,6 +15,15 @@ export function providersPanelRowMeta(row) {
 }
 export const ENV_REF_PATTERN = /^env:(.+)$/;
 export const FALLBACK_CREDENTIAL_KIND = "api_key_header";
+export function providerModelsChip(allowedModels) {
+  if (allowedModels === void 0) return "All models";
+  return allowedModels.length === 1 ? "1 model" : `${allowedModels.length} models`;
+}
+export function providerModelChoices(known, allowed, query = "") {
+  const ids = [.../* @__PURE__ */ new Set([...known, ...allowed])];
+  const needle = query.trim().toLowerCase();
+  return needle ? ids.filter((id) => id.toLowerCase().includes(needle)) : ids;
+}
 export const ENV_SOURCE_LABEL = {
   instance: "instance .env",
   workspace: "workspace .env",
@@ -42,5 +52,7 @@ export const EMPTY_FORM = {
   surface: "",
   baseUrl: "",
   envName: "",
-  secret: ""
+  secret: "",
+  signIn: "",
+  credentialRef: ""
 };