@skaile/forge-settings 1.3.3 → 2.0.0

package/src/runtime/shared/provider-registry.ts

@@ -1,211 +1,74 @@
 /**
  * The AI provider registry vocabulary, as forge-settings speaks it.
  *
- * `@skaile/workspaces` owns this schema (`core/src/provider-registry.ts`): the
- * validator, the layer merge, the catalog presets and the model-reference
- * resolver live there and are deliberately NOT reimplemented here. What follows
- * is a *structural* mirror of the record so browser bundles do not import the
- * workspaces core. Field names, union members and optionality match the
- * upstream record exactly, so an entry produced by the runtime is assignable to
- * these types and vice versa.
+ * The schema is `@skaile/provider-registry`'s: every record type, the
+ * enumerations and the credential-reference grammar below are re-exported from
+ * there, so an entry this package reads is the same type the runtime resolves
+ * and there is one validator, not a mirror. What this module adds are Forge's
+ * view helpers: reading either registry shape in registry order, filtering by
+ * kind, voice selection and the credential editor's wording.
  *
- * Browser-safe on purpose — no `node:` imports — so the settings modal renders
- * registry entries with the same types the server resolves them with.
+ * Browser-safe on purpose — no `node:` imports, and only the browser-safe root
+ * of `@skaile/provider-registry` — so the settings modal renders registry
+ * entries with the same types the server resolves them with.
  *
  * Vocabulary: these are **AI provider** records. They are unrelated to the
  * platform's connector `ProviderType`/`ProviderLink` (git, SharePoint, Drive).
  */
 
-// ── Enums ──────────────────────────────────────────────────────────────────
-
-/** What an entry produces. `stt`/`tts` use the reduced voice record. */
-export const AI_PROVIDER_KINDS = ["llm", "stt", "tts", "embed"] as const;
-
-/** Union of {@link AI_PROVIDER_KINDS}. */
-export type AIProviderKind = (typeof AI_PROVIDER_KINDS)[number];
-
-/** Kinds that use the voice subset of the record. */
-export const AI_PROVIDER_VOICE_KINDS = ["stt", "tts"] as const;
-
-/** Union of {@link AI_PROVIDER_VOICE_KINDS}. */
-export type AIProviderVoiceKind = (typeof AI_PROVIDER_VOICE_KINDS)[number];
-
-/** Wire protocol of an `llm`/`embed` entry — omp's `api` values verbatim. */
-export const AI_PROVIDER_SURFACES = [
-  "anthropic-messages",
-  "openai-completions",
-  "openai-responses",
-  "openai-codex-responses",
-  "azure-openai-responses",
-  "bedrock-converse-stream",
-  "google-generative-ai",
-  "google-vertex",
-] as const;
-
-/** Union of {@link AI_PROVIDER_SURFACES}. */
-export type AIProviderSurface = (typeof AI_PROVIDER_SURFACES)[number];
-
-/** How the request reaches the surface — selects the `params` shape. */
-export const AI_PROVIDER_TRANSPORTS = [
-  "direct",
-  "bedrock",
-  "vertex",
-  "foundry",
-  "azure-openai",
-] as const;
-
-/** Union of {@link AI_PROVIDER_TRANSPORTS}. */
-export type AIProviderTransport = (typeof AI_PROVIDER_TRANSPORTS)[number];
-
-/** How the credential is presented. */
-export const AI_PROVIDER_CREDENTIAL_KINDS = [
-  "api_key_header",
-  "bearer",
-  "sigv4",
-  "google_adc",
-  "azure_entra",
-  "oauth",
-  "command",
-  "none",
-] as const;
-
-/** Union of {@link AI_PROVIDER_CREDENTIAL_KINDS}. */
-export type AIProviderCredentialKind = (typeof AI_PROVIDER_CREDENTIAL_KINDS)[number];
-
-// ── Record ─────────────────────────────────────────────────────────────────
-
-/** `transport: bedrock` routing parameters. */
-export interface AIProviderBedrockParams {
-  /** AWS region, e.g. `us-east-1`. */
-  region: string;
-}
-
-/** `transport: vertex` routing parameters. */
-export interface AIProviderVertexParams {
-  /** GCP project id. */
-  project: string;
-  /** Vertex location, e.g. `europe-west4`. */
-  location: string;
-  /** Model publisher; defaults to `google`. */
-  publisher?: string;
-}
-
-/** `transport: foundry` routing parameters. */
-export interface AIProviderFoundryParams {
-  /** Azure AI Foundry resource name. */
-  resource: string;
-}
-
-/** `transport: azure-openai` routing parameters. */
-export interface AIProviderAzureOpenAIParams {
-  /** Azure OpenAI resource name. */
-  resource: string;
-  /** Deployment the request is routed to. */
-  deployment: string;
-  /** `api-version` query value. */
-  api_version: string;
-}
-
-/** Voice parameters, typed per preset: Deepgram `{model, language}`, ElevenLabs `{voice_id, output_format}`. */
-export type AIProviderVoiceParams = Record<string, string | number | boolean>;
-
-/** The `transport` → `params` discriminated union. */
-export type AIProviderTransportSlice =
-  | { transport?: "direct"; params?: Record<string, never> }
-  | { transport: "bedrock"; params: AIProviderBedrockParams }
-  | { transport: "vertex"; params: AIProviderVertexParams }
-  | { transport: "foundry"; params: AIProviderFoundryParams }
-  | { transport: "azure-openai"; params: AIProviderAzureOpenAIParams };
-
-/** Reference to a secret — never the secret itself. See {@link parseCredentialRef}. */
-export interface AIProviderCredential {
-  kind: AIProviderCredentialKind;
-  /**
-   * `env:NAME` · `cmd:<shell>` · `platform:<configId>` · `keyring:<service>/<account>`.
-   * A literal secret here is a validation error, not a warning.
-   */
-  ref?: string;
-}
-
-/** Per-model capability facts, keyed by the logical (`model_map`) id. */
-export interface AIProviderCapabilities {
-  context_window?: number;
-  tools?: boolean;
-  images?: boolean;
-  thinking_max?: number;
-}
-
-/** omp-compatible discovery descriptor. */
-export interface AIProviderDiscovery {
-  type: string;
-  /** Path appended to `base_url` when the surface default does not apply. */
-  path?: string;
-}
-
-/** Fields every entry carries, whatever its `kind`. */
-export interface AIProviderEntryCommon {
-  /** Display name. Never load-bearing. */
-  label?: string;
-  /** Catalog preset this entry inherits from. */
-  preset?: string;
-  /** Literal endpoint; wins over the preset value and the transport derivation. */
-  base_url?: string;
-  /** Static, non-secret request headers. */
-  headers?: Record<string, string>;
-  credential?: AIProviderCredential;
-  /** Default `true`; read it through {@link isEntryEnabled}. */
-  enabled?: boolean;
-  /** Set by the control plane: lower layers cannot override this entry. */
-  locked?: boolean;
-}
-
-/** An `llm`/`embed` entry — the full record. */
-export type AIProviderLlmEntry = AIProviderEntryCommon &
-  AIProviderTransportSlice & {
-    kind: "llm" | "embed";
-    /** Required unless a `preset` supplies it. */
-    surface?: AIProviderSurface;
-    /** Azure's `api-version` lives here. */
-    query_params?: Record<string, string>;
-    /** Logical id → provider-side id. */
-    model_map?: Record<string, string>;
-    /** Keyed by the logical id, i.e. the `model_map` key. */
-    capabilities?: Record<string, AIProviderCapabilities>;
-    discovery?: AIProviderDiscovery;
-  };
-
-/**
- * An `stt`/`tts` entry — the reduced record. `surface`, `transport`,
- * `model_map`, `capabilities` and `discovery` are `llm`-only: a TTS voice is
- * not a wire protocol. The voice defaults forge apps used to hardcode at their
- * call sites (Deepgram model/language, ElevenLabs voice id/output format) live
- * in `params`.
- */
-export type AIProviderVoiceEntry = AIProviderEntryCommon & {
-  kind: AIProviderVoiceKind;
-  params?: AIProviderVoiceParams;
-};
-
-/** One registry entry. */
-export type AIProviderEntry = AIProviderLlmEntry | AIProviderVoiceEntry;
-
-/** Entry id → entry. Iteration order is registry order. */
-export type AIProviderRegistry = Record<string, AIProviderEntry>;
-
-/** Configuration layers, lowest precedence first. */
-export type AIProviderLayerId = "catalog" | "user" | "workspace" | "runtime" | "session";
-
-/** The merged, layered view the runtime hands to a session. */
-export interface MergedAIProviderRegistry {
-  version: 1;
-  providers: AIProviderRegistry;
-  /** Registry order: highest-precedence layer first, document order within a layer. */
-  order: string[];
-  /** Highest-precedence layer that contributed to each entry. */
-  origin: Record<string, AIProviderLayerId>;
-  /** Entries frozen by `locked: true`. */
-  locked: string[];
-}
+import type {
+  AIProviderEntry,
+  AIProviderKind,
+  AIProviderLayerId,
+  AIProviderLlmEntry,
+  AIProviderRegistry,
+  AIProviderVoiceEntry,
+  AIProviderVoiceKind,
+  MergedAIProviderRegistry,
+} from "@skaile/provider-registry";
+import { isEntryEnabled, parseCredentialRef } from "@skaile/provider-registry";
+
+export type {
+  AIProviderAzureOpenAIParams,
+  AIProviderBedrockParams,
+  AIProviderCapabilities,
+  AIProviderCredential,
+  AIProviderCredentialKind,
+  AIProviderCredentialRef,
+  AIProviderDataZone,
+  AIProviderDataZoneRule,
+  AIProviderDiscovery,
+  AIProviderEntry,
+  AIProviderEntryCommon,
+  AIProviderFoundryParams,
+  AIProviderKind,
+  AIProviderLayerId,
+  AIProviderLlmEntry,
+  AIProviderModelAllowListFields,
+  AIProviderRegistry,
+  AIProviderSurface,
+  AIProviderTransport,
+  AIProviderTransportSlice,
+  AIProviderVertexParams,
+  AIProviderVoiceEntry,
+  AIProviderVoiceKind,
+  AIProviderVoiceParams,
+  MergedAIProviderRegistry,
+} from "@skaile/provider-registry";
+export {
+  AI_PROVIDER_CREDENTIAL_KINDS,
+  AI_PROVIDER_DATA_ZONE_RULES,
+  AI_PROVIDER_DATA_ZONES,
+  AI_PROVIDER_KINDS,
+  AI_PROVIDER_SURFACES,
+  AI_PROVIDER_TRANSPORTS,
+  AI_PROVIDER_VOICE_KINDS,
+  allowedModelIds,
+  formatCredentialRef,
+  isEntryEnabled,
+  isModelAllowed,
+  parseCredentialRef,
+} from "@skaile/provider-registry";
 
 /** Either shape a consumer may be handed. */
 export type AIProviderRegistryView = AIProviderRegistry | MergedAIProviderRegistry;
@@ -224,9 +87,25 @@ export function isMergedRegistry(
   return Array.isArray((registry as MergedAIProviderRegistry).order);
 }
 
-/** `enabled` defaults to `true`. */
-export function isEntryEnabled(entry: AIProviderEntry): boolean {
-  return entry.enabled !== false;
+/**
+ * The layered shape of a view. A merged registry is returned as is; a bare
+ * entry map becomes one layer in its own iteration order, reported as the
+ * `runtime` layer (the host handed it over in memory) with nothing locked.
+ * The model constructor resolves against this shape only.
+ */
+export function asMergedRegistry(
+  registry: AIProviderRegistryView,
+  layer: AIProviderLayerId = "runtime",
+): MergedAIProviderRegistry {
+  if (isMergedRegistry(registry)) return registry;
+  const order = Object.keys(registry);
+  return {
+    version: 1,
+    providers: registry,
+    order,
+    origin: Object.fromEntries(order.map((id) => [id, layer])),
+    locked: [],
+  };
 }
 
 /** Entries in registry order, as `[id, entry]` pairs. Both registry shapes accepted. */
@@ -294,62 +173,9 @@ export function selectVoiceEntryId(ids: readonly string[], wanted?: string): str
 
 // ── Credential references ──────────────────────────────────────────────────
 
-/** POSIX environment variable name. */
-const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
-
-/** The four reference forms. */
+/** The four reference forms, as a credential editor's refusal distinguishes them. */
 const CREDENTIAL_REF = /^(env|cmd|platform|keyring):([\s\S]+)$/;
 
-/** A parsed `credential.ref`. */
-export type AIProviderCredentialRef =
-  | { form: "env"; name: string }
-  | { form: "cmd"; command: string }
-  | { form: "platform"; configId: string }
-  | { form: "keyring"; service: string; account: string };
-
-/**
- * Parse a `credential.ref`.
- *
- * Returns `undefined` for anything that is not one of the four reference forms
- * — which, in a registry entry or a credential editor, means someone typed a
- * literal secret.
- */
-export function parseCredentialRef(ref: string): AIProviderCredentialRef | undefined {
-  const match = CREDENTIAL_REF.exec(ref.trim());
-  if (!match) return undefined;
-  const body = match[2].trim();
-  if (body === "") return undefined;
-  switch (match[1]) {
-    case "env":
-      return ENV_NAME.test(body) ? { form: "env", name: body } : undefined;
-    case "cmd":
-      return { form: "cmd", command: body };
-    case "platform":
-      return { form: "platform", configId: body };
-    case "keyring": {
-      const slash = body.indexOf("/");
-      if (slash <= 0 || slash === body.length - 1) return undefined;
-      return { form: "keyring", service: body.slice(0, slash), account: body.slice(slash + 1) };
-    }
-    default:
-      return undefined;
-  }
-}
-
-/** Render a parsed reference back to its `<form>:<body>` string. */
-export function formatCredentialRef(ref: AIProviderCredentialRef): string {
-  switch (ref.form) {
-    case "env":
-      return `env:${ref.name}`;
-    case "cmd":
-      return `cmd:${ref.command}`;
-    case "platform":
-      return `platform:${ref.configId}`;
-    case "keyring":
-      return `keyring:${ref.service}/${ref.account}`;
-  }
-}
-
 /** The reference forms, spelled the way a credential editor offers them. */
 export const CREDENTIAL_REF_FORMS = [
   "env:NAME",

package/src/runtime/vue/index.ts

@@ -7,10 +7,12 @@
  * `@skaile/forge-settings/nuxt`.
  */
 
+export * from "../shared/data-zone";
 export * from "../shared/env-vars";
 export * from "../shared/harness-providers";
 export * from "../shared/harnesses";
 export * from "../shared/model-roles";
+export * from "../shared/provider-accounts";
 export * from "../shared/provider-registry";
 export * from "./model-roles-panel";
 export * from "./providers-client";

package/src/runtime/vue/providers-panel-model.ts

@@ -6,10 +6,18 @@
  */
 
 import type { EnvLayerId } from "../shared/env-vars";
+import type {
+  CredentialExpiry,
+  ProviderDeploymentRow,
+  ProviderSignInId,
+} from "../shared/provider-accounts";
 import type {
   AIProviderCredentialKind,
+  AIProviderDataZone,
+  AIProviderDataZoneRule,
   AIProviderKind,
   AIProviderSurface,
+  AIProviderTransport,
 } from "../shared/provider-registry";
 import type { ProvidersPanelClient } from "./providers-client";
 
@@ -50,6 +58,17 @@ export interface ProvidersPanelProps {
    * `layer`; a string replaces it; `false` hides it (Add provider stays).
    */
   note?: string | false;
+  /**
+   * Expert mode: the sign-in step also offers the raw reference form
+   * (`env:` / `keyring:` / `cmd:` / `platform:`) and expert-only parameters
+   * (`api_version`) become editable. Default `false`.
+   */
+  expert?: boolean;
+  /**
+   * The host's data-zone rule ("Where may AI process data?"). Rows outside it
+   * show a muted note naming the rule. Absent or `any`: no row is marked.
+   */
+  dataZoneRule?: AIProviderDataZoneRule;
 }
 
 /** Emits both variants declare. */
@@ -72,12 +91,29 @@ export interface ProvidersPanelEntry {
   baseUrl?: string;
   preset?: string;
   surface?: AIProviderSurface;
+  /** How requests reach the surface, when not `direct`. */
+  transport?: AIProviderTransport;
+  /** Routing parameters (`resource`, `deployment`, `api_version`, …) of an `llm`/`embed` entry. */
+  transportParams?: Record<string, string>;
+  /**
+   * When the credential expires (ISO timestamp), for a credential that
+   * reports one. The row then shows "Expires in N days · Renew".
+   */
+  credentialExpiresAt?: string | null;
   enabled: boolean;
   locked: boolean;
   /** Registry documents holding the id, lowest first: `["instance"]`, `["workspace"]` or both. */
   layers: ProvidersPanelLayer[];
   /** The scope's own document's values for the editable fields the dialog does not show. */
   layerFields?: Record<string, unknown>;
+  /** Where the entry processes data. Absent (an older host): the preset's zone, else `transfer`. */
+  dataZone?: AIProviderDataZone;
+  /** The entry's `eu_processing` switch. */
+  euProcessing?: boolean;
+  /** The entry's `allowed_models`; absent = every model, `[]` = none. */
+  allowedModels?: string[];
+  /** Logical model ids the entry declares (`model_map`); absent: its models come from discovery. */
+  modelIds?: string[];
 }
 
 /** One catalog preset, as `GET /api/providers/presets` and `.../detected` list it. */
@@ -86,9 +122,15 @@ export interface ProvidersPanelPreset {
   label: string;
   kind: AIProviderKind;
   surface?: AIProviderSurface;
+  /** How requests reach the surface; Azure transports offer Entra ID sign-in. */
+  transport?: AIProviderTransport;
   base_url?: string;
   base_url_env?: string;
   credential: { kind: AIProviderCredentialKind; env?: string };
+  /** Default parameters. */
+  params?: Record<string, string>;
+  /** `params` keys an entry naming this preset must supply. */
+  required_params?: string[];
 }
 
 /** Where a row's entry lives relative to the scope's own document. */
@@ -131,8 +173,25 @@ export interface ProvidersPanelRow extends ProvidersPanelEntry {
   origin: string;
   /** `configured · <source>`, `missing <VAR>`, the resolver's reason, or `No credential needed.`. */
   status: string;
-  /** Which other layer defines or overrides the credential; see the panel contract. */
   overrideNotices: string[];
+  /** "Microsoft Azure · Entra ID · contoso-ai": family · sign-in kind · resource. */
+  accountLine: string;
+  /** The credential's expiry, when it reports one. */
+  expiry: CredentialExpiry | null;
+  /** "Renew" is offered next to the expiry: the credential can be changed here. */
+  canRenew: boolean;
+  /** The entry's effective data zone. */
+  zone: AIProviderDataZone;
+  /** The zone chip: EU / EU option / Transfer / Local. */
+  zoneLabel: string;
+  /** "EU processing is on for this account" is offered: an `eu_option` entry the panel may write. */
+  canSetEuProcessing: boolean;
+  /** Why the host's data-zone rule keeps the entry out, naming the rule; `null` when it does not. */
+  blockedNote: string | null;
+  /** The model chip: "All models" | "N models". `null` for a voice entry. */
+  modelsChip: string | null;
+  /** "Models allowed here" can be changed: an `llm`/`embed` entry the panel may write. */
+  canFilterModels: boolean;
 }
 
 /** The add/edit dialog's fields. */
@@ -144,13 +203,46 @@ export interface ProvidersPanelForm {
   surface: string;
   /** Empty: the preset's endpoint. */
   baseUrl: string;
-  /** Adding only: the `env:` variable the credential references. */
+  /** Key sign-in: the `env:` variable the credential references. */
   envName: string;
-  /** Adding only, "Set value now": written to the scope's `.env`, never to the provider route. */
+  /** Key sign-in, "Set value now": written to the scope's `.env`, never to the provider route. */
   secret: string;
+  /** The chosen "How do you sign in?" option. */
+  signIn: ProviderSignInId | "";
+  /** `reference` sign-in: the typed reference. */
+  credentialRef: string;
+  /** Routing parameters by key (`resource`, `deployment`, `api_version`, …). */
+  params: Record<string, string>;
 }
 
-// ── Constants ─────────────────────────────────────────────────────────────────
+/** The Microsoft Azure card's fields. */
+export interface ProvidersPanelAzureForm {
+  /** Azure resource name, shared by both entries. */
+  resource: string;
+  /** Write an Azure OpenAI entry. */
+  useOpenAI: boolean;
+  /** Write a Claude on Foundry entry. */
+  useFoundry: boolean;
+  /** Azure OpenAI deployments: deployment name → logical model id (`model_map`). */
+  deployments: ProviderDeploymentRow[];
+  /** Azure OpenAI `api_version`; prefilled, editable in expert mode. */
+  apiVersion: string;
+}
+
+/** The add dialog's step: preset library, then the account fields, then the test of what was created. */
+export type ProvidersPanelDialogStep = "library" | "account" | "done";
+
+/** "Models allowed here": every model, or only the listed ones. */
+export type ProvidersPanelModelsMode = "all" | "only";
+
+/** The "Models allowed here" editor's fields. */
+export interface ProvidersPanelModelsForm {
+  mode: ProvidersPanelModelsMode;
+  /** The ticked model ids. */
+  selected: string[];
+  /** The checklist's search text. */
+  query: string;
+}
 
 /** The preset select's value for an entry that names no preset. */
 export const CUSTOM_PRESET = "__custom__";
@@ -158,6 +250,9 @@ export const CUSTOM_PRESET = "__custom__";
 /** Credential select value: open the inline key editor. */
 export const CREDENTIAL_ENTER_KEY = "__enter_key__";
 
+/** The preset select's value for the Microsoft Azure account (Azure OpenAI and/or Claude on Foundry). */
+export const AZURE_ACCOUNT = "__azure__";
+
 /** Credential select value: open the inline reference editor. */
 export const CREDENTIAL_OTHER_REF = "__other_ref__";
 
@@ -198,6 +293,27 @@ export const ENV_REF_PATTERN = /^env:(.+)$/;
 /** The credential kind a written reference gets when the row states none. */
 export const FALLBACK_CREDENTIAL_KIND: AIProviderCredentialKind = "api_key_header";
 
+/** A row's model chip: "All models" without an allow-list, else its size. */
+export function providerModelsChip(allowedModels: readonly string[] | undefined): string {
+  if (allowedModels === undefined) return "All models";
+  return allowedModels.length === 1 ? "1 model" : `${allowedModels.length} models`;
+}
+
+/**
+ * The checklist's ids: the known models (declared or discovered) in their
+ * order, then any allowed id neither lists (so it can still be unticked),
+ * narrowed by a case-insensitive `query`.
+ */
+export function providerModelChoices(
+  known: readonly string[],
+  allowed: readonly string[],
+  query = "",
+): string[] {
+  const ids = [...new Set([...known, ...allowed])];
+  const needle = query.trim().toLowerCase();
+  return needle ? ids.filter((id) => id.toLowerCase().includes(needle)) : ids;
+}
+
 export const ENV_SOURCE_LABEL: Record<EnvLayerId, string> = {
   instance: "instance .env",
   workspace: "workspace .env",
@@ -237,11 +353,13 @@ export function nonEnvSourceLabel(ref: string): string | undefined {
   return undefined;
 }
 
-export const EMPTY_FORM: Readonly<ProvidersPanelForm> = {
+export const EMPTY_FORM: Readonly<Omit<ProvidersPanelForm, "params">> = {
   preset: "",
   id: "",
   surface: "",
   baseUrl: "",
   envName: "",
   secret: "",
+  signIn: "",
+  credentialRef: "",
 };