@skaile/forge-settings 1.3.3 → 2.0.0

package/dist/runtime/server/provider-layers.d.ts

@@ -7,7 +7,7 @@
  * therefore read the raw `providers` map and write it back unchanged apart
  * from the entry being edited.
  */
-import { type AIProviderPreset } from "@skaile/workspaces/sdk/bridge";
+import { type AIProviderPreset } from "@skaile/provider-registry/catalog";
 /**
  * The file a write to the layer at `path` goes to: the `.yaml` spelling when
  * only that one exists, so an edit never shadows a hand-written document.

package/dist/runtime/server/provider-layers.js

@@ -1,11 +1,9 @@
 import { existsSync, readFileSync } from "node:fs";
-import {
-  PROVIDERS_FILENAME,
-  saveProviderRegistryFile
-} from "@skaile/workspaces/core";
-import { AI_PROVIDER_PRESETS } from "@skaile/workspaces/sdk/bridge";
+import { AI_PROVIDER_PRESETS } from "@skaile/provider-registry/catalog";
+import { saveProviderRegistryFile } from "@skaile/provider-registry/files";
 import { parse as parseYaml } from "yaml";
 import { isPlainObject } from "../shared/guards.js";
+const PROVIDERS_FILENAME = "providers.yml";
 const PROVIDERS_FILENAME_ALIAS = "providers.yaml";
 export function providerLayerDocument(path) {
   if (existsSync(path)) return path;

package/dist/runtime/server/provider-service.d.ts

@@ -18,7 +18,7 @@
  *     `model_map`/`capabilities`; harness-backed discovery is
  *     `listModelsForHarness(harnessId, registry)` in the runtime.
  */
-import type { AIProviderCapabilities, AIProviderCredentialKind, AIProviderKind, AIProviderRegistryView, AIProviderSurface, AIProviderVoiceParams } from "../shared/provider-registry.js";
+import type { AIProviderCapabilities, AIProviderCredentialKind, AIProviderDataZone, AIProviderKind, AIProviderRegistryView, AIProviderSurface, AIProviderTransport, AIProviderVoiceParams } from "../shared/provider-registry.js";
 import { type CredentialSource, type CredentialStoreOptions } from "./credential-store.js";
 /** One registry entry, as a settings UI needs to see it. */
 export interface ProviderInfo {
@@ -52,6 +52,14 @@ export interface ProviderInfo {
     preset?: string;
     /** Wire protocol of an `llm`/`embed` entry (its own or its preset's). */
     surface?: AIProviderSurface;
+    /** How requests of an `llm`/`embed` entry reach its surface, when not `direct`. */
+    transport?: AIProviderTransport;
+    /**
+     * Routing parameters of an `llm`/`embed` entry (`resource`, `deployment`,
+     * `api_version`, `region`, `project`, `location`, …), when it has any.
+     * Voice entries carry theirs in {@link params}.
+     */
+    transportParams?: Record<string, string>;
     /** The entry's `enabled` flag; `false` only in a listing with `includeDisabled`. */
     enabled: boolean;
     /**
@@ -63,6 +71,21 @@ export interface ProviderInfo {
     params?: AIProviderVoiceParams;
     /** Frozen by the control plane: a lower layer cannot change or disable it. */
     locked: boolean;
+    /** Where the entry processes data: its `data_zone`, else its preset's, else `transfer`. */
+    dataZone: AIProviderDataZone;
+    /** The entry's `eu_processing` switch (an `eu_option` entry counts as EU only with it on). */
+    euProcessing: boolean;
+    /**
+     * The entry's `allowed_models`, when it sets one: the only models it may be
+     * used with (`[]` = none). Absent: every model.
+     */
+    allowedModels?: string[];
+    /**
+     * Logical model ids an `llm`/`embed` entry declares (`model_map` keys, then
+     * ids only `capabilities` names), when it declares any. An entry without
+     * them lists its models through discovery.
+     */
+    modelIds?: string[];
 }
 /** One selectable model of one provider. */
 export interface ModelInfo {
@@ -110,7 +133,8 @@ export declare function listAIProviders(registry: AIProviderRegistryView, option
  *
  * Sourced from each `llm`/`embed` entry's `model_map` (plus any id that only
  * appears in `capabilities`) — the same two tables the runtime's model-reference
- * resolver reads, so a selector built from this list always resolves.
+ * resolver reads, so a selector built from this list always resolves. A model
+ * outside the entry's `allowed_models` is left out, as the runtime refuses it.
  *
  * @param providerId - Restrict to one entry; omit for every enabled entry.
  */

package/dist/runtime/server/provider-service.js

@@ -1,6 +1,8 @@
+import { entryDataZone } from "../shared/data-zone.js";
 import {
   entriesOfKind,
   isEntryEnabled,
+  isModelAllowed,
   isVoiceEntry,
   parseCredentialRef,
   registryEntries
@@ -32,13 +34,25 @@ export function listAIProviders(registry, options = {}) {
       ...entry.base_url ? { baseUrl: entry.base_url } : {},
       ...entry.preset ? { preset: entry.preset } : {},
       ...!isVoiceEntry(entry) && entry.surface ? { surface: entry.surface } : {},
+      ...!isVoiceEntry(entry) && entry.transport && entry.transport !== "direct" ? { transport: entry.transport } : {},
+      ...!isVoiceEntry(entry) && entry.params && Object.keys(entry.params).length > 0 ? { transportParams: { ...entry.params } } : {},
       enabled,
       ...isVoiceEntry(entry) && entry.params ? { params: entry.params } : {},
-      locked: entry.locked === true
+      locked: entry.locked === true,
+      dataZone: entryDataZone(entry),
+      euProcessing: entry.eu_processing === true,
+      ...!isVoiceEntry(entry) && entry.allowed_models ? { allowedModels: [...entry.allowed_models] } : {},
+      ...!isVoiceEntry(entry) ? declaredModelIds(entry) : {}
     });
   }
   return providers;
 }
+function declaredModelIds(entry) {
+  const ids = [
+    .../* @__PURE__ */ new Set([...Object.keys(entry.model_map ?? {}), ...Object.keys(entry.capabilities ?? {})])
+  ];
+  return ids.length > 0 ? { modelIds: ids } : {};
+}
 export function listAIProviderModels(registry, providerId) {
   const models = [];
   for (const kind of ["llm", "embed"]) {
@@ -49,6 +63,7 @@ export function listAIProviderModels(registry, providerId) {
         ...Object.keys(entry.capabilities ?? {})
       ]);
       for (const modelId of logicalIds) {
+        if (!isModelAllowed(entry, modelId)) continue;
         const capabilities = entry.capabilities?.[modelId];
         models.push({
           id: `${id}/${modelId}`,

package/dist/runtime/server/provider-write.d.ts

@@ -22,7 +22,7 @@
  * Auth stays in the app: it builds the {@link ProviderWriteScope} (paths, env,
  * lock state), asks {@link providerScopeWritable}, and answers 403 itself.
  */
-import { type AIProviderPreset } from "@skaile/workspaces/sdk/bridge";
+import { type AIProviderPreset } from "@skaile/provider-registry/catalog";
 import type { AIProviderRegistry } from "../shared/provider-registry.js";
 import { type CredentialPolicy } from "./credential-policy.js";
 /**
@@ -74,8 +74,11 @@ export declare function providerScopeWritable(scope: ProviderWriteScope, caller:
  * Upsert entry `id` in the scope's document.
  *
  * - **Own entry** — the body sets the editable fields (`BODY_KEYS`) — one it
- *   omits is removed — and optionally `kind`; fields it does not set (`kind`,
- *   `transport`, `params`, …) keep their written value.
+ *   omits is removed — and optionally `kind`, `params`, `data_zone`,
+ *   `eu_processing` and `allowed_models`; fields it does not set (`kind`,
+ *   `transport`, `params`, `data_zone`, …) keep their written value,
+ *   `params: {}` removes the parameters and `null` removes `data_zone`,
+ *   `eu_processing` or `allowed_models` (`[]` allows no model).
  * - **Patch** — when a lower document defines `id` and the body holds only
  *   {@link PATCH_KEYS}, the body is merged into the scope's stored entry for
  *   `id` (created when absent), leaving every other stored field alone.
@@ -83,11 +86,16 @@ export declare function providerScopeWritable(scope: ProviderWriteScope, caller:
  * The file and its directory are created when absent; other entries are kept
  * as written.
  *
- * 400: invalid id, secret-bearing or malformed body, a body for an inherited
- * entry that is neither a patch nor over an own full entry, or any error
- * diagnostic for the entry (as `data.diagnostics`; nothing is written). 403:
- * the entry is `locked: true` in some document. 409: the document on disk is
- * not a registry.
+ * 400: invalid id, secret-bearing or malformed body (`data_zone` outside
+ * eu | eu_option | transfer | local, a non-boolean `eu_processing`, an
+ * `allowed_models` that is not a list of distinct non-empty ids), a body for
+ * an inherited entry that is neither a patch nor over an own full entry, a
+ * preset's required parameter left out of `params` (named in the message,
+ * `data.missingParams`), or any error diagnostic for the entry (as
+ * `data.diagnostics`; nothing is written — `params` keys a transport does not
+ * accept are refused this way, by the SDK's schema). 403: the entry is
+ * `locked: true` in some document. 409: the document on disk is not a
+ * registry.
  */
 export declare function upsertProviderEntry(scope: ProviderWriteScope, id: string, body: unknown): {
     id: string;
@@ -107,12 +115,18 @@ export interface ProviderPresetSummary {
     label: string;
     kind: AIProviderPreset["kind"];
     surface?: AIProviderPreset["surface"];
+    /** How requests reach the surface; absent = `direct`. Azure transports offer Entra ID sign-in. */
+    transport?: AIProviderPreset["transport"];
     base_url?: string;
     base_url_env?: string;
     credential: {
         kind: AIProviderPreset["credential"]["kind"];
         env?: string;
     };
+    /** Default routing / voice parameters. */
+    params?: Record<string, string>;
+    /** `params` keys an entry naming this preset must supply. */
+    required_params?: string[];
 }
 /** Catalog presets (all of them by default), in catalog order. */
 export declare function providerPresetSummaries(presets?: AIProviderPreset[]): ProviderPresetSummary[];
@@ -129,14 +143,16 @@ export declare function detectedProviderPresets(env: Record<string, string | und
 export type ProviderLayerName = ProviderWriteScope["name"];
 /**
  * The defining document's values for the `PUT`-editable fields a settings UI
- * edit dialog does not show. A `PUT` removes every editable field it omits,
- * so an edit sends these back unchanged instead of dropping them.
+ * edit dialog does not show (or shows only in part, as `params`). A `PUT`
+ * removes every editable field it omits, so an edit sends these back
+ * unchanged instead of dropping them.
  */
 export interface ProviderLayerFields {
     label?: unknown;
     headers?: unknown;
     model_map?: unknown;
     enabled?: unknown;
+    params?: unknown;
 }
 /**
  * Tag each provider view of a scope with every registry document that holds

package/dist/runtime/server/provider-write.js

@@ -1,16 +1,18 @@
 import {
   isSafeProviderId,
-  loadProviderRegistryFile,
   mergeRegistries,
   parseCredentialRef,
   validateMergedRegistry,
   validateRegistry
-} from "@skaile/workspaces/core";
+} from "@skaile/provider-registry";
 import {
   AI_PROVIDER_PRESETS,
   expandPreset
-} from "@skaile/workspaces/sdk/bridge";
+} from "@skaile/provider-registry/catalog";
+import { loadProviderRegistryFile } from "@skaile/provider-registry/files";
+import { isDataZone } from "../shared/data-zone.js";
 import { isPlainObject } from "../shared/guards.js";
+import { missingRequiredParams } from "../shared/provider-accounts.js";
 import { entryPolicyRefusal } from "./credential-policy.js";
 import { catalogPreset, readProviderLayer, writeProviderLayer } from "./provider-layers.js";
 export class ProviderWriteError extends Error {
@@ -41,6 +43,26 @@ const BODY_KEYS = {
   model_map: true,
   enabled: true
 };
+const KEPT_BODY_KEYS = {
+  kind: true,
+  params: true,
+  data_zone: true,
+  eu_processing: true,
+  allowed_models: true
+};
+const NULLABLE_BODY_KEYS = ["data_zone", "eu_processing", "allowed_models"];
+function readAllowedModels(value) {
+  const refusal = "allowed_models must be a list of distinct, non-empty model ids, or null";
+  if (!Array.isArray(value)) return refusal;
+  const ids = [];
+  for (const item of value) {
+    if (typeof item !== "string" || item.trim() === "") return refusal;
+    const id = item.trim();
+    if (ids.includes(id)) return `allowed_models lists '${id}' twice`;
+    ids.push(id);
+  }
+  return ids;
+}
 export const PATCH_KEYS = ["credential", "enabled"];
 const SECRET_KEYS = { apiKey: true, api_key: true, token: true };
 export function providerScopeWritable(scope, caller) {
@@ -74,8 +96,25 @@ function readEntryBody(body) {
   if (Object.keys(body).some((key) => Object.hasOwn(SECRET_KEYS, key)) || credentialKeys.some((key) => key === "value" || Object.hasOwn(SECRET_KEYS, key))) {
     return PROVIDER_SECRET_REFUSAL;
   }
-  const unknown = Object.keys(body).find((key) => !Object.hasOwn(BODY_KEYS, key) && key !== "kind");
+  const unknown = Object.keys(body).find(
+    (key) => !Object.hasOwn(BODY_KEYS, key) && !Object.hasOwn(KEPT_BODY_KEYS, key)
+  );
   if (unknown) return `'${unknown}' is not a provider entry field`;
+  if (body.params !== void 0 && !isPlainObject(body.params)) {
+    return "params must be a map of parameter name to value";
+  }
+  if (body.data_zone !== void 0 && body.data_zone !== null && !isDataZone(body.data_zone)) {
+    return "data_zone must be one of eu, eu_option, transfer, local, or null";
+  }
+  if (body.eu_processing !== void 0 && body.eu_processing !== null && typeof body.eu_processing !== "boolean") {
+    return "eu_processing must be true, false or null";
+  }
+  let allowedModels;
+  if (body.allowed_models !== void 0 && body.allowed_models !== null) {
+    const read = readAllowedModels(body.allowed_models);
+    if (typeof read === "string") return read;
+    allowedModels = read;
+  }
   if (body.preset !== void 0 && !catalogPreset(body.preset)) {
     return `Unknown preset '${String(body.preset)}'`;
   }
@@ -85,7 +124,7 @@ function readEntryBody(body) {
     if (ref !== void 0 && (typeof ref !== "string" || !parseCredentialRef(ref)))
       return CREDENTIAL_REF_REFUSAL;
   }
-  return body;
+  return allowedModels ? { ...body, allowed_models: allowedModels } : body;
 }
 function entryErrors(scope, providers, id) {
   const layer = mergeLayerOf(scope);
@@ -118,6 +157,22 @@ function isPatchOrAbsent(entry) {
   if (entry === void 0) return true;
   return isPlainObject(entry) && Object.keys(entry).every((key) => PATCH_KEYS.includes(key));
 }
+function lowerPreset(lowerEntries) {
+  let preset;
+  for (const entry of lowerEntries)
+    if (isPlainObject(entry) && entry.preset !== void 0) preset = entry.preset;
+  return preset;
+}
+function missingPresetParams(entry, lowerEntries) {
+  const preset = catalogPreset(entry.preset ?? lowerPreset(lowerEntries));
+  if (!preset) return [];
+  const params = {};
+  for (const lower of lowerEntries) {
+    if (isPlainObject(lower) && isPlainObject(lower.params)) Object.assign(params, lower.params);
+  }
+  if (isPlainObject(entry.params)) Object.assign(params, entry.params);
+  return missingRequiredParams(preset, params);
+}
 export function upsertProviderEntry(scope, id, body) {
   if (!isSafeProviderId(id)) {
     throw createError({
@@ -150,6 +205,16 @@ export function upsertProviderEntry(scope, id, body) {
       Object.entries(existing).filter(([key]) => !Object.hasOwn(BODY_KEYS, key))
     ) : {};
     entry = { ...kept, ...fields };
+    if (isPlainObject(entry.params) && Object.keys(entry.params).length === 0) delete entry.params;
+    for (const key of NULLABLE_BODY_KEYS) if (entry[key] === null) delete entry[key];
+    const missing = missingPresetParams(entry, lowerEntries);
+    if (missing.length > 0) {
+      throw createError({
+        statusCode: 400,
+        statusMessage: `Provider '${id}' needs ${missing.map((key) => `params.${key}`).join(", ")} (required by preset '${String(entry.preset ?? lowerPreset(lowerEntries))}')`,
+        data: { missingParams: missing }
+      });
+    }
   }
   const next = { ...providers, [id]: entry };
   const refusal = entryPolicyRefusal(entry, scope.policy);
@@ -183,9 +248,12 @@ export function providerPresetSummaries(presets = Object.values(AI_PROVIDER_PRES
     label: preset.label,
     kind: preset.kind,
     surface: preset.surface,
+    ...preset.transport ? { transport: preset.transport } : {},
     base_url: preset.base_url,
     base_url_env: preset.base_url_env,
-    credential: { kind: preset.credential.kind, env: preset.credential.env }
+    credential: { kind: preset.credential.kind, env: preset.credential.env },
+    ...preset.params ? { params: { ...preset.params } } : {},
+    ...preset.required_params?.length ? { required_params: [...preset.required_params] } : {}
   }));
 }
 export function detectedProviderPresets(env, registry) {
@@ -200,7 +268,7 @@ export function detectedProviderPresets(env, registry) {
     })
   );
 }
-const LAYER_FIELD_KEYS = ["label", "headers", "model_map", "enabled"];
+const LAYER_FIELD_KEYS = ["label", "headers", "model_map", "enabled", "params"];
 export function withProviderLayers(views, scope) {
   const own = readLayerLeniently(scope.file);
   const lower = scope.below.map((file) => readLayerLeniently(file));

package/dist/runtime/server/voice-provider.d.ts

@@ -0,0 +1,61 @@
+/**
+ * Voice selection: which `kind: stt|tts` registry entry serves a request and
+ * with which parameters.
+ *
+ * `sttProvider`/`ttsProvider` are registry ids of `kind: stt|tts` entries; the
+ * endpoint and the voice parameters live on the entry, and
+ * `sttLanguage`/`ttsVoice` are per-request overrides of two of those
+ * parameters. Resolving all of that used to be three apps' worth of hardcoded
+ * endpoints and voice ids.
+ */
+import type { AIProviderRegistryView, AIProviderVoiceEntry, AIProviderVoiceKind, AIProviderVoiceParams } from "../shared/provider-registry.js";
+/**
+ * Settings fields that name a voice entry and override its parameters — the
+ * same field names as the Workspaces `settings.json` document, so a
+ * `SkaileSettings` (`@skaile/forge-settings/workspaces`) can be passed as is.
+ */
+export interface VoiceSettings {
+    /** Registry id of the `kind: stt` entry. */
+    sttProvider?: string;
+    /** Registry id of the `kind: tts` entry. */
+    ttsProvider?: string;
+    /** Overrides the stt entry's `language` parameter. */
+    sttLanguage?: string;
+    /** Overrides the tts entry's `voice_id` parameter. */
+    ttsVoice?: string;
+}
+/** The `kind: stt|tts` entry a request runs against, with its parameters resolved. */
+export interface VoiceProviderSelection {
+    /** Registry id of the entry. */
+    providerId: string;
+    entry: AIProviderVoiceEntry;
+    /** Endpoint from the entry; absent when the entry inherits its preset's default. */
+    baseUrl?: string;
+    /**
+     * The entry's `params` with overrides applied — Deepgram `{model, language}`,
+     * ElevenLabs `{voice_id, output_format}`. This is the only place a forge app
+     * should read voice defaults from.
+     */
+    params: AIProviderVoiceParams;
+    /** True when settings named no usable entry and registry order decided. */
+    fallback: boolean;
+    /** Non-fatal notes, e.g. settings naming an entry the registry does not have. */
+    warnings: string[];
+}
+/**
+ * Resolve which registry entry serves speech-to-text or text-to-speech.
+ *
+ * Selection is `settings.sttProvider`/`settings.ttsProvider`, falling back to
+ * the first enabled entry of that kind in registry order when the setting is
+ * absent or names an entry that is gone — a missing setting must not silence an
+ * app that has a perfectly good entry configured.
+ *
+ * Parameter precedence, lowest first: the entry's `params`, then the settings
+ * overrides (`sttLanguage` → `language`, `ttsVoice` → `voice_id`), then
+ * `overrides` from the request. The per-request override is the contract
+ * forge-concept already honoured and the other apps silently dropped.
+ *
+ * @returns The selection, or `undefined` when the registry has no enabled entry
+ *          of that kind.
+ */
+export declare function resolveVoiceProvider(registry: AIProviderRegistryView, kind: AIProviderVoiceKind, settings?: VoiceSettings, overrides?: AIProviderVoiceParams): VoiceProviderSelection | undefined;

package/dist/runtime/server/voice-provider.js

@@ -0,0 +1,31 @@
+import {
+  entriesOfKind,
+  selectVoiceEntryId,
+  VOICE_OVERRIDE_PARAM
+} from "../shared/provider-registry.js";
+export function resolveVoiceProvider(registry, kind, settings = {}, overrides = {}) {
+  const candidates = entriesOfKind(registry, kind);
+  if (candidates.length === 0) return void 0;
+  const warnings = [];
+  const wanted = (kind === "stt" ? settings.sttProvider : settings.ttsProvider)?.trim();
+  const ids = candidates.map(([id]) => id);
+  const providerId = selectVoiceEntryId(ids, wanted);
+  const entry = candidates[ids.indexOf(providerId)][1];
+  if (wanted && wanted !== providerId) {
+    warnings.push(
+      `settings name '${wanted}' for ${kind}, which is not an enabled ${kind} entry \u2014 using '${providerId}' instead`
+    );
+  }
+  const fallback = wanted !== providerId;
+  const settingsOverride = {};
+  const override = (kind === "stt" ? settings.sttLanguage : settings.ttsVoice)?.trim();
+  if (override) settingsOverride[VOICE_OVERRIDE_PARAM[kind]] = override;
+  return {
+    providerId,
+    entry,
+    ...entry.base_url ? { baseUrl: entry.base_url } : {},
+    params: { ...entry.params, ...settingsOverride, ...overrides },
+    fallback,
+    warnings
+  };
+}

package/dist/runtime/shared/data-zone.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Data zones: where a provider entry processes data, and which entries a
+ * host's data-zone rule ("Where may AI process data?") keeps.
+ *
+ * `@skaile/provider-registry` owns the vocabulary (`AI_PROVIDER_DATA_ZONES`,
+ * `AI_PROVIDER_DATA_ZONE_RULES`, re-exported by `./provider-registry`) and the
+ * catalog's `data_zone` column with `entryDataZone`, `entryAllowedByDataZone`
+ * and `filterRegistryByDataZone` in its `/catalog` entry. forge-settings keeps
+ * the browser-side view here so the settings panel does not ship the catalog
+ * (and its generated model table) to the browser: the same semantics, plus
+ * labels, refusal wording and a filter that keeps a merged registry merged.
+ * {@link PRESET_DATA_ZONES} is a copy of the catalog's column; a test holds it
+ * equal to `@skaile/provider-registry/catalog`.
+ *
+ * Browser-safe on purpose — no `node:` imports.
+ */
+import { type AIProviderDataZone, type AIProviderDataZoneRule, type AIProviderRegistry, type AIProviderRegistryView, type MergedAIProviderRegistry } from "./provider-registry.js";
+/**
+ * The `data_zone` of each catalog preset, by preset id. Copied from
+ * `@skaile/provider-registry/catalog`'s `AI_PROVIDER_PRESETS`; change it there
+ * first. A preset this table does not name is `transfer`.
+ */
+export declare const PRESET_DATA_ZONES: Readonly<Record<string, AIProviderDataZone>>;
+/** What a provider row's zone chip says. */
+export declare const DATA_ZONE_LABELS: Readonly<Record<AIProviderDataZone, string>>;
+/** What a host calls each rule when it names the rule that keeps an entry out. */
+export declare const DATA_ZONE_RULE_LABELS: Readonly<Record<AIProviderDataZoneRule, string>>;
+/** Whether `value` is one of `AI_PROVIDER_DATA_ZONES`. */
+export declare function isDataZone(value: unknown): value is AIProviderDataZone;
+/** Whether `value` is one of `AI_PROVIDER_DATA_ZONE_RULES`. */
+export declare function isDataZoneRule(value: unknown): value is AIProviderDataZoneRule;
+/** The zone of catalog preset `presetId`, or `undefined` for an id the catalog does not name. */
+export declare function presetDataZone(presetId: string | undefined): AIProviderDataZone | undefined;
+/**
+ * Where an entry processes data: its own `data_zone`, else the zone of the
+ * catalog preset it names, else `transfer` (an unknown endpoint is assumed to
+ * leave the EU).
+ */
+export declare function entryDataZone(entry: {
+    data_zone?: AIProviderDataZone;
+    preset?: string;
+}): AIProviderDataZone;
+/**
+ * Whether `rule` allows an entry in `zone`: `any` allows all; `eu` allows
+ * `eu` and `local`; `eu_options` additionally allows `eu_option` when
+ * `euProcessing` is `true`.
+ */
+export declare function dataZoneAllows(rule: AIProviderDataZoneRule, zone: AIProviderDataZone, euProcessing: boolean | undefined): boolean;
+/** Whether `rule` allows `entry` ({@link dataZoneAllows} over {@link entryDataZone}). */
+export declare function entryAllowedByDataZone(entry: {
+    data_zone?: AIProviderDataZone;
+    preset?: string;
+    eu_processing?: boolean;
+}, rule: AIProviderDataZoneRule): boolean;
+/**
+ * Why `rule` keeps an entry in `zone` out, naming the rule, or `undefined`
+ * when the rule allows it. Secret-free, safe to render.
+ */
+export declare function dataZoneRefusal(rule: AIProviderDataZoneRule, zone: AIProviderDataZone, euProcessing: boolean | undefined): string | undefined;
+/**
+ * The registry with only the entries `rule` allows, every kind alike
+ * (`llm`, `embed`, `stt`, `tts`). Order is kept; the input is not mutated. A
+ * merged registry comes back merged, its `order`, `origin` and `locked`
+ * narrowed to the kept entries.
+ */
+export declare function filterRegistryByDataZone(registry: AIProviderRegistry, rule: AIProviderDataZoneRule): AIProviderRegistry;
+export declare function filterRegistryByDataZone(registry: MergedAIProviderRegistry, rule: AIProviderDataZoneRule): MergedAIProviderRegistry;
+export declare function filterRegistryByDataZone(registry: AIProviderRegistryView, rule: AIProviderDataZoneRule): AIProviderRegistryView;

package/dist/runtime/shared/data-zone.js

@@ -0,0 +1,79 @@
+import {
+  AI_PROVIDER_DATA_ZONE_RULES,
+  AI_PROVIDER_DATA_ZONES,
+  isMergedRegistry
+} from "./provider-registry.js";
+export const PRESET_DATA_ZONES = {
+  anthropic: "transfer",
+  openai: "transfer",
+  google: "transfer",
+  groq: "transfer",
+  deepseek: "transfer",
+  openrouter: "transfer",
+  mistral: "eu",
+  xai: "transfer",
+  together: "transfer",
+  fireworks: "transfer",
+  bedrock: "eu_option",
+  vertex: "eu_option",
+  "azure-openai": "eu_option",
+  foundry: "eu_option",
+  ollama: "local",
+  lmstudio: "local",
+  vllm: "local",
+  litellm: "transfer",
+  deepgram: "transfer",
+  elevenlabs: "transfer"
+};
+export const DATA_ZONE_LABELS = {
+  eu: "EU",
+  eu_option: "EU option",
+  transfer: "Transfer",
+  local: "Local"
+};
+export const DATA_ZONE_RULE_LABELS = {
+  any: "Anywhere",
+  eu_options: "EU, or EU option with EU processing on",
+  eu: "EU only"
+};
+export function isDataZone(value) {
+  return typeof value === "string" && AI_PROVIDER_DATA_ZONES.includes(value);
+}
+export function isDataZoneRule(value) {
+  return typeof value === "string" && AI_PROVIDER_DATA_ZONE_RULES.includes(value);
+}
+export function presetDataZone(presetId) {
+  return presetId !== void 0 && Object.hasOwn(PRESET_DATA_ZONES, presetId) ? PRESET_DATA_ZONES[presetId] : void 0;
+}
+export function entryDataZone(entry) {
+  return entry.data_zone ?? presetDataZone(entry.preset) ?? "transfer";
+}
+export function dataZoneAllows(rule, zone, euProcessing) {
+  if (rule === "any") return true;
+  if (zone === "eu" || zone === "local") return true;
+  return rule === "eu_options" && zone === "eu_option" && euProcessing === true;
+}
+export function entryAllowedByDataZone(entry, rule) {
+  return dataZoneAllows(rule, entryDataZone(entry), entry.eu_processing);
+}
+export function dataZoneRefusal(rule, zone, euProcessing) {
+  if (dataZoneAllows(rule, zone, euProcessing)) return void 0;
+  const why = zone === "eu_option" && rule === "eu_options" ? "EU processing is not on for this account" : `this provider is ${DATA_ZONE_LABELS[zone]}`;
+  return `Blocked by the data-zone rule "${DATA_ZONE_RULE_LABELS[rule]}": ${why}.`;
+}
+export function filterRegistryByDataZone(registry, rule) {
+  const entries = isMergedRegistry(registry) ? registry.providers : registry;
+  const providers = {};
+  for (const [id, entry] of Object.entries(entries)) {
+    if (entryAllowedByDataZone(entry, rule)) providers[id] = entry;
+  }
+  if (!isMergedRegistry(registry)) return providers;
+  const kept = (id) => Object.hasOwn(providers, id);
+  return {
+    ...registry,
+    providers,
+    order: registry.order.filter(kept),
+    origin: Object.fromEntries(Object.entries(registry.origin).filter(([id]) => kept(id))),
+    locked: registry.locked.filter(kept)
+  };
+}