@skaile/forge-settings 1.3.3 → 2.0.0

package/dist/runtime/shared/provider-registry.d.ts

@@ -1,166 +1,23 @@
 /**
  * The AI provider registry vocabulary, as forge-settings speaks it.
  *
- * `@skaile/workspaces` owns this schema (`core/src/provider-registry.ts`): the
- * validator, the layer merge, the catalog presets and the model-reference
- * resolver live there and are deliberately NOT reimplemented here. What follows
- * is a *structural* mirror of the record so browser bundles do not import the
- * workspaces core. Field names, union members and optionality match the
- * upstream record exactly, so an entry produced by the runtime is assignable to
- * these types and vice versa.
+ * The schema is `@skaile/provider-registry`'s: every record type, the
+ * enumerations and the credential-reference grammar below are re-exported from
+ * there, so an entry this package reads is the same type the runtime resolves
+ * and there is one validator, not a mirror. What this module adds are Forge's
+ * view helpers: reading either registry shape in registry order, filtering by
+ * kind, voice selection and the credential editor's wording.
  *
- * Browser-safe on purpose — no `node:` imports — so the settings modal renders
- * registry entries with the same types the server resolves them with.
+ * Browser-safe on purpose — no `node:` imports, and only the browser-safe root
+ * of `@skaile/provider-registry` — so the settings modal renders registry
+ * entries with the same types the server resolves them with.
  *
  * Vocabulary: these are **AI provider** records. They are unrelated to the
  * platform's connector `ProviderType`/`ProviderLink` (git, SharePoint, Drive).
  */
-/** What an entry produces. `stt`/`tts` use the reduced voice record. */
-export declare const AI_PROVIDER_KINDS: readonly ["llm", "stt", "tts", "embed"];
-/** Union of {@link AI_PROVIDER_KINDS}. */
-export type AIProviderKind = (typeof AI_PROVIDER_KINDS)[number];
-/** Kinds that use the voice subset of the record. */
-export declare const AI_PROVIDER_VOICE_KINDS: readonly ["stt", "tts"];
-/** Union of {@link AI_PROVIDER_VOICE_KINDS}. */
-export type AIProviderVoiceKind = (typeof AI_PROVIDER_VOICE_KINDS)[number];
-/** Wire protocol of an `llm`/`embed` entry — omp's `api` values verbatim. */
-export declare const AI_PROVIDER_SURFACES: readonly ["anthropic-messages", "openai-completions", "openai-responses", "openai-codex-responses", "azure-openai-responses", "bedrock-converse-stream", "google-generative-ai", "google-vertex"];
-/** Union of {@link AI_PROVIDER_SURFACES}. */
-export type AIProviderSurface = (typeof AI_PROVIDER_SURFACES)[number];
-/** How the request reaches the surface — selects the `params` shape. */
-export declare const AI_PROVIDER_TRANSPORTS: readonly ["direct", "bedrock", "vertex", "foundry", "azure-openai"];
-/** Union of {@link AI_PROVIDER_TRANSPORTS}. */
-export type AIProviderTransport = (typeof AI_PROVIDER_TRANSPORTS)[number];
-/** How the credential is presented. */
-export declare const AI_PROVIDER_CREDENTIAL_KINDS: readonly ["api_key_header", "bearer", "sigv4", "google_adc", "azure_entra", "oauth", "command", "none"];
-/** Union of {@link AI_PROVIDER_CREDENTIAL_KINDS}. */
-export type AIProviderCredentialKind = (typeof AI_PROVIDER_CREDENTIAL_KINDS)[number];
-/** `transport: bedrock` routing parameters. */
-export interface AIProviderBedrockParams {
-    /** AWS region, e.g. `us-east-1`. */
-    region: string;
-}
-/** `transport: vertex` routing parameters. */
-export interface AIProviderVertexParams {
-    /** GCP project id. */
-    project: string;
-    /** Vertex location, e.g. `europe-west4`. */
-    location: string;
-    /** Model publisher; defaults to `google`. */
-    publisher?: string;
-}
-/** `transport: foundry` routing parameters. */
-export interface AIProviderFoundryParams {
-    /** Azure AI Foundry resource name. */
-    resource: string;
-}
-/** `transport: azure-openai` routing parameters. */
-export interface AIProviderAzureOpenAIParams {
-    /** Azure OpenAI resource name. */
-    resource: string;
-    /** Deployment the request is routed to. */
-    deployment: string;
-    /** `api-version` query value. */
-    api_version: string;
-}
-/** Voice parameters, typed per preset: Deepgram `{model, language}`, ElevenLabs `{voice_id, output_format}`. */
-export type AIProviderVoiceParams = Record<string, string | number | boolean>;
-/** The `transport` → `params` discriminated union. */
-export type AIProviderTransportSlice = {
-    transport?: "direct";
-    params?: Record<string, never>;
-} | {
-    transport: "bedrock";
-    params: AIProviderBedrockParams;
-} | {
-    transport: "vertex";
-    params: AIProviderVertexParams;
-} | {
-    transport: "foundry";
-    params: AIProviderFoundryParams;
-} | {
-    transport: "azure-openai";
-    params: AIProviderAzureOpenAIParams;
-};
-/** Reference to a secret — never the secret itself. See {@link parseCredentialRef}. */
-export interface AIProviderCredential {
-    kind: AIProviderCredentialKind;
-    /**
-     * `env:NAME` · `cmd:<shell>` · `platform:<configId>` · `keyring:<service>/<account>`.
-     * A literal secret here is a validation error, not a warning.
-     */
-    ref?: string;
-}
-/** Per-model capability facts, keyed by the logical (`model_map`) id. */
-export interface AIProviderCapabilities {
-    context_window?: number;
-    tools?: boolean;
-    images?: boolean;
-    thinking_max?: number;
-}
-/** omp-compatible discovery descriptor. */
-export interface AIProviderDiscovery {
-    type: string;
-    /** Path appended to `base_url` when the surface default does not apply. */
-    path?: string;
-}
-/** Fields every entry carries, whatever its `kind`. */
-export interface AIProviderEntryCommon {
-    /** Display name. Never load-bearing. */
-    label?: string;
-    /** Catalog preset this entry inherits from. */
-    preset?: string;
-    /** Literal endpoint; wins over the preset value and the transport derivation. */
-    base_url?: string;
-    /** Static, non-secret request headers. */
-    headers?: Record<string, string>;
-    credential?: AIProviderCredential;
-    /** Default `true`; read it through {@link isEntryEnabled}. */
-    enabled?: boolean;
-    /** Set by the control plane: lower layers cannot override this entry. */
-    locked?: boolean;
-}
-/** An `llm`/`embed` entry — the full record. */
-export type AIProviderLlmEntry = AIProviderEntryCommon & AIProviderTransportSlice & {
-    kind: "llm" | "embed";
-    /** Required unless a `preset` supplies it. */
-    surface?: AIProviderSurface;
-    /** Azure's `api-version` lives here. */
-    query_params?: Record<string, string>;
-    /** Logical id → provider-side id. */
-    model_map?: Record<string, string>;
-    /** Keyed by the logical id, i.e. the `model_map` key. */
-    capabilities?: Record<string, AIProviderCapabilities>;
-    discovery?: AIProviderDiscovery;
-};
-/**
- * An `stt`/`tts` entry — the reduced record. `surface`, `transport`,
- * `model_map`, `capabilities` and `discovery` are `llm`-only: a TTS voice is
- * not a wire protocol. The voice defaults forge apps used to hardcode at their
- * call sites (Deepgram model/language, ElevenLabs voice id/output format) live
- * in `params`.
- */
-export type AIProviderVoiceEntry = AIProviderEntryCommon & {
-    kind: AIProviderVoiceKind;
-    params?: AIProviderVoiceParams;
-};
-/** One registry entry. */
-export type AIProviderEntry = AIProviderLlmEntry | AIProviderVoiceEntry;
-/** Entry id → entry. Iteration order is registry order. */
-export type AIProviderRegistry = Record<string, AIProviderEntry>;
-/** Configuration layers, lowest precedence first. */
-export type AIProviderLayerId = "catalog" | "user" | "workspace" | "runtime" | "session";
-/** The merged, layered view the runtime hands to a session. */
-export interface MergedAIProviderRegistry {
-    version: 1;
-    providers: AIProviderRegistry;
-    /** Registry order: highest-precedence layer first, document order within a layer. */
-    order: string[];
-    /** Highest-precedence layer that contributed to each entry. */
-    origin: Record<string, AIProviderLayerId>;
-    /** Entries frozen by `locked: true`. */
-    locked: string[];
-}
+import type { AIProviderEntry, AIProviderKind, AIProviderLayerId, AIProviderLlmEntry, AIProviderRegistry, AIProviderVoiceEntry, AIProviderVoiceKind, MergedAIProviderRegistry } from "@skaile/provider-registry";
+export type { AIProviderAzureOpenAIParams, AIProviderBedrockParams, AIProviderCapabilities, AIProviderCredential, AIProviderCredentialKind, AIProviderCredentialRef, AIProviderDataZone, AIProviderDataZoneRule, AIProviderDiscovery, AIProviderEntry, AIProviderEntryCommon, AIProviderFoundryParams, AIProviderKind, AIProviderLayerId, AIProviderLlmEntry, AIProviderModelAllowListFields, AIProviderRegistry, AIProviderSurface, AIProviderTransport, AIProviderTransportSlice, AIProviderVertexParams, AIProviderVoiceEntry, AIProviderVoiceKind, AIProviderVoiceParams, MergedAIProviderRegistry, } from "@skaile/provider-registry";
+export { AI_PROVIDER_CREDENTIAL_KINDS, AI_PROVIDER_DATA_ZONE_RULES, AI_PROVIDER_DATA_ZONES, AI_PROVIDER_KINDS, AI_PROVIDER_SURFACES, AI_PROVIDER_TRANSPORTS, AI_PROVIDER_VOICE_KINDS, allowedModelIds, formatCredentialRef, isEntryEnabled, isModelAllowed, parseCredentialRef, } from "@skaile/provider-registry";
 /** Either shape a consumer may be handed. */
 export type AIProviderRegistryView = AIProviderRegistry | MergedAIProviderRegistry;
 /**
@@ -170,8 +27,13 @@ export type AIProviderRegistryView = AIProviderRegistry | MergedAIProviderRegist
  * reading it) has to put the entries back in the shape it was handed.
  */
 export declare function isMergedRegistry(registry: AIProviderRegistryView): registry is MergedAIProviderRegistry;
-/** `enabled` defaults to `true`. */
-export declare function isEntryEnabled(entry: AIProviderEntry): boolean;
+/**
+ * The layered shape of a view. A merged registry is returned as is; a bare
+ * entry map becomes one layer in its own iteration order, reported as the
+ * `runtime` layer (the host handed it over in memory) with nothing locked.
+ * The model constructor resolves against this shape only.
+ */
+export declare function asMergedRegistry(registry: AIProviderRegistryView, layer?: AIProviderLayerId): MergedAIProviderRegistry;
 /** Entries in registry order, as `[id, entry]` pairs. Both registry shapes accepted. */
 export declare function registryEntries(registry: AIProviderRegistryView): Array<[string, AIProviderEntry]>;
 /**
@@ -211,31 +73,6 @@ export declare const VOICE_OVERRIDE_SETTING: {
  * @returns The chosen id, or `undefined` when no entry of that kind exists.
  */
 export declare function selectVoiceEntryId(ids: readonly string[], wanted?: string): string | undefined;
-/** A parsed `credential.ref`. */
-export type AIProviderCredentialRef = {
-    form: "env";
-    name: string;
-} | {
-    form: "cmd";
-    command: string;
-} | {
-    form: "platform";
-    configId: string;
-} | {
-    form: "keyring";
-    service: string;
-    account: string;
-};
-/**
- * Parse a `credential.ref`.
- *
- * Returns `undefined` for anything that is not one of the four reference forms
- * — which, in a registry entry or a credential editor, means someone typed a
- * literal secret.
- */
-export declare function parseCredentialRef(ref: string): AIProviderCredentialRef | undefined;
-/** Render a parsed reference back to its `<form>:<body>` string. */
-export declare function formatCredentialRef(ref: AIProviderCredentialRef): string;
 /** The reference forms, spelled the way a credential editor offers them. */
 export declare const CREDENTIAL_REF_FORMS: readonly ["env:NAME", "keyring:service/account", "cmd:<shell command>", "platform:<configId>"];
 /** What a credential editor tells a user who typed something that is not a reference. */

package/dist/runtime/shared/provider-registry.js

@@ -1,37 +1,31 @@
-export const AI_PROVIDER_KINDS = ["llm", "stt", "tts", "embed"];
-export const AI_PROVIDER_VOICE_KINDS = ["stt", "tts"];
-export const AI_PROVIDER_SURFACES = [
-  "anthropic-messages",
-  "openai-completions",
-  "openai-responses",
-  "openai-codex-responses",
-  "azure-openai-responses",
-  "bedrock-converse-stream",
-  "google-generative-ai",
-  "google-vertex"
-];
-export const AI_PROVIDER_TRANSPORTS = [
-  "direct",
-  "bedrock",
-  "vertex",
-  "foundry",
-  "azure-openai"
-];
-export const AI_PROVIDER_CREDENTIAL_KINDS = [
-  "api_key_header",
-  "bearer",
-  "sigv4",
-  "google_adc",
-  "azure_entra",
-  "oauth",
-  "command",
-  "none"
-];
+import { isEntryEnabled, parseCredentialRef } from "@skaile/provider-registry";
+export {
+  AI_PROVIDER_CREDENTIAL_KINDS,
+  AI_PROVIDER_DATA_ZONE_RULES,
+  AI_PROVIDER_DATA_ZONES,
+  AI_PROVIDER_KINDS,
+  AI_PROVIDER_SURFACES,
+  AI_PROVIDER_TRANSPORTS,
+  AI_PROVIDER_VOICE_KINDS,
+  allowedModelIds,
+  formatCredentialRef,
+  isEntryEnabled,
+  isModelAllowed,
+  parseCredentialRef
+} from "@skaile/provider-registry";
 export function isMergedRegistry(registry) {
   return Array.isArray(registry.order);
 }
-export function isEntryEnabled(entry) {
-  return entry.enabled !== false;
+export function asMergedRegistry(registry, layer = "runtime") {
+  if (isMergedRegistry(registry)) return registry;
+  const order = Object.keys(registry);
+  return {
+    version: 1,
+    providers: registry,
+    order,
+    origin: Object.fromEntries(order.map((id) => [id, layer])),
+    locked: []
+  };
 }
 export function registryEntries(registry) {
   if (isMergedRegistry(registry)) {
@@ -54,41 +48,7 @@ export function selectVoiceEntryId(ids, wanted) {
   if (trimmed && ids.includes(trimmed)) return trimmed;
   return ids[0];
 }
-const ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
 const CREDENTIAL_REF = /^(env|cmd|platform|keyring):([\s\S]+)$/;
-export function parseCredentialRef(ref) {
-  const match = CREDENTIAL_REF.exec(ref.trim());
-  if (!match) return void 0;
-  const body = match[2].trim();
-  if (body === "") return void 0;
-  switch (match[1]) {
-    case "env":
-      return ENV_NAME.test(body) ? { form: "env", name: body } : void 0;
-    case "cmd":
-      return { form: "cmd", command: body };
-    case "platform":
-      return { form: "platform", configId: body };
-    case "keyring": {
-      const slash = body.indexOf("/");
-      if (slash <= 0 || slash === body.length - 1) return void 0;
-      return { form: "keyring", service: body.slice(0, slash), account: body.slice(slash + 1) };
-    }
-    default:
-      return void 0;
-  }
-}
-export function formatCredentialRef(ref) {
-  switch (ref.form) {
-    case "env":
-      return `env:${ref.name}`;
-    case "cmd":
-      return `cmd:${ref.command}`;
-    case "platform":
-      return `platform:${ref.configId}`;
-    case "keyring":
-      return `keyring:${ref.service}/${ref.account}`;
-  }
-}
 export const CREDENTIAL_REF_FORMS = [
   "env:NAME",
   "keyring:service/account",

package/dist/runtime/vue/index.d.ts

@@ -6,10 +6,12 @@
  * `ForgeProvidersPanel` itself is registered as a component by
  * `@skaile/forge-settings/nuxt`.
  */
+export * from "../shared/data-zone.js";
 export * from "../shared/env-vars.js";
 export * from "../shared/harness-providers.js";
 export * from "../shared/harnesses.js";
 export * from "../shared/model-roles.js";
+export * from "../shared/provider-accounts.js";
 export * from "../shared/provider-registry.js";
 export * from "./model-roles-panel.js";
 export * from "./providers-client.js";

package/dist/runtime/vue/index.js

@@ -1,7 +1,9 @@
+export * from "../shared/data-zone.js";
 export * from "../shared/env-vars.js";
 export * from "../shared/harness-providers.js";
 export * from "../shared/harnesses.js";
 export * from "../shared/model-roles.js";
+export * from "../shared/provider-accounts.js";
 export * from "../shared/provider-registry.js";
 export * from "./model-roles-panel.js";
 export * from "./providers-client.js";

package/dist/runtime/vue/providers-panel-model.d.ts

@@ -5,7 +5,8 @@
  * are re-exported by `useProvidersPanel`; the rest is internal to the package.
  */
 import type { EnvLayerId } from "../shared/env-vars.js";
-import type { AIProviderCredentialKind, AIProviderKind, AIProviderSurface } from "../shared/provider-registry.js";
+import type { CredentialExpiry, ProviderDeploymentRow, ProviderSignInId } from "../shared/provider-accounts.js";
+import type { AIProviderCredentialKind, AIProviderDataZone, AIProviderDataZoneRule, AIProviderKind, AIProviderSurface, AIProviderTransport } from "../shared/provider-registry.js";
 import type { ProvidersPanelClient } from "./providers-client.js";
 /** Registry document a provider entry is defined in. */
 export type ProvidersPanelLayer = "instance" | "workspace";
@@ -43,6 +44,17 @@ export interface ProvidersPanelProps {
      * `layer`; a string replaces it; `false` hides it (Add provider stays).
      */
     note?: string | false;
+    /**
+     * Expert mode: the sign-in step also offers the raw reference form
+     * (`env:` / `keyring:` / `cmd:` / `platform:`) and expert-only parameters
+     * (`api_version`) become editable. Default `false`.
+     */
+    expert?: boolean;
+    /**
+     * The host's data-zone rule ("Where may AI process data?"). Rows outside it
+     * show a muted note naming the rule. Absent or `any`: no row is marked.
+     */
+    dataZoneRule?: AIProviderDataZoneRule;
 }
 /** Emits both variants declare. */
 export type ProvidersPanelEmit = (event: "changed") => void;
@@ -63,12 +75,29 @@ export interface ProvidersPanelEntry {
     baseUrl?: string;
     preset?: string;
     surface?: AIProviderSurface;
+    /** How requests reach the surface, when not `direct`. */
+    transport?: AIProviderTransport;
+    /** Routing parameters (`resource`, `deployment`, `api_version`, …) of an `llm`/`embed` entry. */
+    transportParams?: Record<string, string>;
+    /**
+     * When the credential expires (ISO timestamp), for a credential that
+     * reports one. The row then shows "Expires in N days · Renew".
+     */
+    credentialExpiresAt?: string | null;
     enabled: boolean;
     locked: boolean;
     /** Registry documents holding the id, lowest first: `["instance"]`, `["workspace"]` or both. */
     layers: ProvidersPanelLayer[];
     /** The scope's own document's values for the editable fields the dialog does not show. */
     layerFields?: Record<string, unknown>;
+    /** Where the entry processes data. Absent (an older host): the preset's zone, else `transfer`. */
+    dataZone?: AIProviderDataZone;
+    /** The entry's `eu_processing` switch. */
+    euProcessing?: boolean;
+    /** The entry's `allowed_models`; absent = every model, `[]` = none. */
+    allowedModels?: string[];
+    /** Logical model ids the entry declares (`model_map`); absent: its models come from discovery. */
+    modelIds?: string[];
 }
 /** One catalog preset, as `GET /api/providers/presets` and `.../detected` list it. */
 export interface ProvidersPanelPreset {
@@ -76,12 +105,18 @@ export interface ProvidersPanelPreset {
     label: string;
     kind: AIProviderKind;
     surface?: AIProviderSurface;
+    /** How requests reach the surface; Azure transports offer Entra ID sign-in. */
+    transport?: AIProviderTransport;
     base_url?: string;
     base_url_env?: string;
     credential: {
         kind: AIProviderCredentialKind;
         env?: string;
     };
+    /** Default parameters. */
+    params?: Record<string, string>;
+    /** `params` keys an entry naming this preset must supply. */
+    required_params?: string[];
 }
 /** Where a row's entry lives relative to the scope's own document. */
 export type ProvidersPanelRowState = "own" | "inherited" | "patched";
@@ -121,8 +156,25 @@ export interface ProvidersPanelRow extends ProvidersPanelEntry {
     origin: string;
     /** `configured · <source>`, `missing <VAR>`, the resolver's reason, or `No credential needed.`. */
     status: string;
-    /** Which other layer defines or overrides the credential; see the panel contract. */
     overrideNotices: string[];
+    /** "Microsoft Azure · Entra ID · contoso-ai": family · sign-in kind · resource. */
+    accountLine: string;
+    /** The credential's expiry, when it reports one. */
+    expiry: CredentialExpiry | null;
+    /** "Renew" is offered next to the expiry: the credential can be changed here. */
+    canRenew: boolean;
+    /** The entry's effective data zone. */
+    zone: AIProviderDataZone;
+    /** The zone chip: EU / EU option / Transfer / Local. */
+    zoneLabel: string;
+    /** "EU processing is on for this account" is offered: an `eu_option` entry the panel may write. */
+    canSetEuProcessing: boolean;
+    /** Why the host's data-zone rule keeps the entry out, naming the rule; `null` when it does not. */
+    blockedNote: string | null;
+    /** The model chip: "All models" | "N models". `null` for a voice entry. */
+    modelsChip: string | null;
+    /** "Models allowed here" can be changed: an `llm`/`embed` entry the panel may write. */
+    canFilterModels: boolean;
 }
 /** The add/edit dialog's fields. */
 export interface ProvidersPanelForm {
@@ -133,15 +185,48 @@ export interface ProvidersPanelForm {
     surface: string;
     /** Empty: the preset's endpoint. */
     baseUrl: string;
-    /** Adding only: the `env:` variable the credential references. */
+    /** Key sign-in: the `env:` variable the credential references. */
     envName: string;
-    /** Adding only, "Set value now": written to the scope's `.env`, never to the provider route. */
+    /** Key sign-in, "Set value now": written to the scope's `.env`, never to the provider route. */
     secret: string;
+    /** The chosen "How do you sign in?" option. */
+    signIn: ProviderSignInId | "";
+    /** `reference` sign-in: the typed reference. */
+    credentialRef: string;
+    /** Routing parameters by key (`resource`, `deployment`, `api_version`, …). */
+    params: Record<string, string>;
+}
+/** The Microsoft Azure card's fields. */
+export interface ProvidersPanelAzureForm {
+    /** Azure resource name, shared by both entries. */
+    resource: string;
+    /** Write an Azure OpenAI entry. */
+    useOpenAI: boolean;
+    /** Write a Claude on Foundry entry. */
+    useFoundry: boolean;
+    /** Azure OpenAI deployments: deployment name → logical model id (`model_map`). */
+    deployments: ProviderDeploymentRow[];
+    /** Azure OpenAI `api_version`; prefilled, editable in expert mode. */
+    apiVersion: string;
+}
+/** The add dialog's step: preset library, then the account fields, then the test of what was created. */
+export type ProvidersPanelDialogStep = "library" | "account" | "done";
+/** "Models allowed here": every model, or only the listed ones. */
+export type ProvidersPanelModelsMode = "all" | "only";
+/** The "Models allowed here" editor's fields. */
+export interface ProvidersPanelModelsForm {
+    mode: ProvidersPanelModelsMode;
+    /** The ticked model ids. */
+    selected: string[];
+    /** The checklist's search text. */
+    query: string;
 }
 /** The preset select's value for an entry that names no preset. */
 export declare const CUSTOM_PRESET = "__custom__";
 /** Credential select value: open the inline key editor. */
 export declare const CREDENTIAL_ENTER_KEY = "__enter_key__";
+/** The preset select's value for the Microsoft Azure account (Azure OpenAI and/or Claude on Foundry). */
+export declare const AZURE_ACCOUNT = "__azure__";
 /** Credential select value: open the inline reference editor. */
 export declare const CREDENTIAL_OTHER_REF = "__other_ref__";
 /** Registry ids the write routes accept (`isSafeProviderId` upstream). */
@@ -163,6 +248,14 @@ export declare function providersPanelRowMeta(row: {
 export declare const ENV_REF_PATTERN: RegExp;
 /** The credential kind a written reference gets when the row states none. */
 export declare const FALLBACK_CREDENTIAL_KIND: AIProviderCredentialKind;
+/** A row's model chip: "All models" without an allow-list, else its size. */
+export declare function providerModelsChip(allowedModels: readonly string[] | undefined): string;
+/**
+ * The checklist's ids: the known models (declared or discovered) in their
+ * order, then any allowed id neither lists (so it can still be unticked),
+ * narrowed by a case-insensitive `query`.
+ */
+export declare function providerModelChoices(known: readonly string[], allowed: readonly string[], query?: string): string[];
 export declare const ENV_SOURCE_LABEL: Record<EnvLayerId, string>;
 export declare const OVERRIDES_INSTANCE_NOTICE = "Entering a key here stores it in this workspace's .env and overrides that value for this workspace.";
 /**
@@ -174,4 +267,4 @@ export declare function requestErrorMessage(err: unknown, fallback: string): str
 export declare function envNameOfRef(ref: string | undefined): string | undefined;
 /** `configured · …` for a reference that is not an env var. */
 export declare function nonEnvSourceLabel(ref: string): string | undefined;
-export declare const EMPTY_FORM: Readonly<ProvidersPanelForm>;
+export declare const EMPTY_FORM: Readonly<Omit<ProvidersPanelForm, "params">>;

package/dist/runtime/vue/providers-panel-model.js

@@ -1,5 +1,6 @@
 export const CUSTOM_PRESET = "__custom__";
 export const CREDENTIAL_ENTER_KEY = "__enter_key__";
+export const AZURE_ACCOUNT = "__azure__";
 export const CREDENTIAL_OTHER_REF = "__other_ref__";
 export const PROVIDER_ID_PATTERN = /^[a-z0-9][a-z0-9_-]*$/;
 export const DEFAULT_PRESETS_URL = "/api/providers/presets";
@@ -14,6 +15,15 @@ export function providersPanelRowMeta(row) {
 }
 export const ENV_REF_PATTERN = /^env:(.+)$/;
 export const FALLBACK_CREDENTIAL_KIND = "api_key_header";
+export function providerModelsChip(allowedModels) {
+  if (allowedModels === void 0) return "All models";
+  return allowedModels.length === 1 ? "1 model" : `${allowedModels.length} models`;
+}
+export function providerModelChoices(known, allowed, query = "") {
+  const ids = [.../* @__PURE__ */ new Set([...known, ...allowed])];
+  const needle = query.trim().toLowerCase();
+  return needle ? ids.filter((id) => id.toLowerCase().includes(needle)) : ids;
+}
 export const ENV_SOURCE_LABEL = {
   instance: "instance .env",
   workspace: "workspace .env",
@@ -42,5 +52,7 @@ export const EMPTY_FORM = {
   surface: "",
   baseUrl: "",
   envName: "",
-  secret: ""
+  secret: "",
+  signIn: "",
+  credentialRef: ""
 };