@dashadmin/dash-admin 1.3.70 → 1.3.72

package/dist/components/tenant/SettingsSections.js

@@ -0,0 +1,77 @@
+import { Fragment, jsx, jsxs } from "react/jsx-runtime";
+import { DashAutoFormTabs } from "dash-auto-admin";
+import { useState } from "react";
+import { useTranslate } from "react-admin";
+import {
+  Box,
+  Card,
+  CardActionArea,
+  CardContent,
+  Divider,
+  Drawer,
+  IconButton,
+  Typography
+} from "@mui/material";
+import CloseIcon from "@mui/icons-material/Close";
+const FormTabsRenderer = ({ schema, method, label }) => /* @__PURE__ */ jsx(Fragment, { children: DashAutoFormTabs({ schema, resourceConfig: null, options: { mode: method, label } }) });
+const toSettingsSections = (schema) => {
+  const order = [];
+  const byGroup = {};
+  schema.forEach((entry) => {
+    const key = entry.group || entry.tab || "general";
+    if (!byGroup[key]) {
+      byGroup[key] = [];
+      order.push(key);
+    }
+    byGroup[key].push(entry);
+  });
+  return order.map((key) => ({ key, entries: byGroup[key] }));
+};
+const prettifyGroup = (key) => key.replace(/[_-]+/g, " ").replace(/^./, (c) => c.toUpperCase());
+const SettingsSections = ({ schema, method, translationNamespace = "tenant.settings" }) => {
+  const translate = useTranslate();
+  const [openSection, setOpenSection] = useState(null);
+  const sections = toSettingsSections(schema);
+  const labelFor = (key) => translate(`${translationNamespace}.groups.${key}`, { _: prettifyGroup(key) });
+  return /* @__PURE__ */ jsxs("section", { children: [
+    /* @__PURE__ */ jsx(
+      Box,
+      {
+        sx: {
+          display: "grid",
+          gap: 2,
+          gridTemplateColumns: { xs: "1fr", sm: "repeat(2, 1fr)", md: "repeat(3, 1fr)" }
+        },
+        children: sections.map((section) => /* @__PURE__ */ jsx(Card, { variant: "outlined", children: /* @__PURE__ */ jsx(CardActionArea, { onClick: () => setOpenSection(section.key), children: /* @__PURE__ */ jsxs(CardContent, { children: [
+          /* @__PURE__ */ jsx(Typography, { variant: "subtitle1", sx: { fontWeight: 600 }, children: labelFor(section.key) }),
+          /* @__PURE__ */ jsx(Typography, { variant: "caption", color: "text.secondary", children: translate(`${translationNamespace}.option_count`, {
+            smart_count: section.entries.length,
+            _: `${section.entries.length}`
+          }) })
+        ] }) }) }, section.key))
+      }
+    ),
+    sections.map((section) => /* @__PURE__ */ jsx(
+      Drawer,
+      {
+        anchor: "right",
+        open: openSection === section.key,
+        onClose: () => setOpenSection(null),
+        ModalProps: { keepMounted: true },
+        children: /* @__PURE__ */ jsxs(Box, { sx: { width: { xs: "100vw", sm: 560 }, p: 2 }, children: [
+          /* @__PURE__ */ jsxs(Box, { sx: { display: "flex", alignItems: "center", justifyContent: "space-between", mb: 1 }, children: [
+            /* @__PURE__ */ jsx(Typography, { variant: "h6", children: labelFor(section.key) }),
+            /* @__PURE__ */ jsx(IconButton, { onClick: () => setOpenSection(null), size: "small", "aria-label": "Close", children: /* @__PURE__ */ jsx(CloseIcon, {}) })
+          ] }),
+          /* @__PURE__ */ jsx(Divider, { sx: { mb: 2 } }),
+          /* @__PURE__ */ jsx(FormTabsRenderer, { schema: section.entries, method, label: labelFor(section.key) })
+        ] })
+      },
+      section.key
+    ))
+  ] });
+};
+export {
+  FormTabsRenderer,
+  SettingsSections
+};

package/dist/components/tenant/TenancySettings.js

@@ -0,0 +1,98 @@
+var __defProp = Object.defineProperty;
+var __defProps = Object.defineProperties;
+var __getOwnPropDescs = Object.getOwnPropertyDescriptors;
+var __getOwnPropSymbols = Object.getOwnPropertySymbols;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __propIsEnum = Object.prototype.propertyIsEnumerable;
+var __defNormalProp = (obj, key, value) => key in obj ? __defProp(obj, key, { enumerable: true, configurable: true, writable: true, value }) : obj[key] = value;
+var __spreadValues = (a, b) => {
+  for (var prop in b || (b = {}))
+    if (__hasOwnProp.call(b, prop))
+      __defNormalProp(a, prop, b[prop]);
+  if (__getOwnPropSymbols)
+    for (var prop of __getOwnPropSymbols(b)) {
+      if (__propIsEnum.call(b, prop))
+        __defNormalProp(a, prop, b[prop]);
+    }
+  return a;
+};
+var __spreadProps = (a, b) => __defProps(a, __getOwnPropDescs(b));
+import { Fragment, jsx } from "react/jsx-runtime";
+import { useEffect, useState } from "react";
+import { Loading, useRecordContext } from "react-admin";
+import { useSystemRequestsCache } from "../../contexts/SystemRequestsCache";
+import { FormTabsRenderer, SettingsSections } from "./SettingsSections";
+const AI_PROVIDERS_TAB = "ai";
+const TenancySettingsEdit = ({ method, tenancy }) => {
+  const [settingFormatsSchema, setSettingFormatsSchema] = useState(null);
+  const { formats: formatsData } = useSystemRequestsCache();
+  useEffect(() => {
+    var _a;
+    if ((_a = formatsData == null ? void 0 : formatsData.data) == null ? void 0 : _a.setting_formats) {
+      const parsedSchema = formatsData.data.setting_formats.filter((entry) => entry.tab === AI_PROVIDERS_TAB && entry.visible !== false).map((entry) => {
+        var _a2, _b;
+        const settingName = entry.attribute ? entry.attribute.replace("settings.", "") : entry.id;
+        const defaultValue = (_b = (_a2 = tenancy == null ? void 0 : tenancy.settings) == null ? void 0 : _a2[settingName]) != null ? _b : entry == null ? void 0 : entry.default_value;
+        return __spreadValues(__spreadValues({}, entry), defaultValue !== null && defaultValue !== void 0 && {
+          fieldOptions: { defaultValue, fullWidth: true }
+        });
+      });
+      setSettingFormatsSchema(parsedSchema);
+    }
+  }, [formatsData, tenancy]);
+  if (!settingFormatsSchema) {
+    return /* @__PURE__ */ jsx(Loading, {});
+  }
+  return /* @__PURE__ */ jsx(SettingsSections, { schema: settingFormatsSchema, method, translationNamespace: "tenancy.settings" });
+};
+const TenancySettingsView = ({ method, tenancy }) => {
+  const [settingFormatsSchema, setSettingFormatsSchema] = useState(null);
+  const { formats: formatsData } = useSystemRequestsCache();
+  useEffect(() => {
+    var _a;
+    if ((_a = formatsData == null ? void 0 : formatsData.data) == null ? void 0 : _a.setting_formats) {
+      const parsedSchema = formatsData.data.setting_formats.filter((entry) => entry.tab === AI_PROVIDERS_TAB && entry.visible !== false).map((entry) => __spreadProps(__spreadValues({}, entry), { readOnly: true }));
+      setSettingFormatsSchema(parsedSchema);
+    }
+  }, [formatsData]);
+  if (!settingFormatsSchema) {
+    return /* @__PURE__ */ jsx(Loading, {});
+  }
+  return /* @__PURE__ */ jsx(SettingsSections, { schema: settingFormatsSchema, method, translationNamespace: "tenancy.settings" });
+};
+const TenancySettingsCreate = ({ method }) => {
+  const [settingFormatsSchema, setSettingFormatsSchema] = useState(null);
+  const { formats: formatsData, loading } = useSystemRequestsCache();
+  useEffect(() => {
+    var _a;
+    if (!loading && ((_a = formatsData == null ? void 0 : formatsData.data) == null ? void 0 : _a.setting_formats)) {
+      setSettingFormatsSchema(
+        formatsData.data.setting_formats.filter(
+          (entry) => entry.tab === AI_PROVIDERS_TAB && entry.visible !== false
+        )
+      );
+    }
+  }, [formatsData, loading]);
+  if (!settingFormatsSchema) {
+    return /* @__PURE__ */ jsx(Loading, {});
+  }
+  return /* @__PURE__ */ jsx(FormTabsRenderer, { schema: settingFormatsSchema, method, label: "AI Providers" });
+};
+const TenancySettings = ({ method, attribute, resourceConfig }) => {
+  const tenancy = useRecordContext();
+  switch (method) {
+    case "edit":
+      return /* @__PURE__ */ jsx(TenancySettingsEdit, { attribute, method, tenancy, resourceConfig });
+    case "view":
+      return /* @__PURE__ */ jsx(TenancySettingsView, { attribute, method, tenancy, resourceConfig });
+    case "create":
+      return /* @__PURE__ */ jsx(TenancySettingsCreate, { attribute, method, resourceConfig });
+    case "list":
+    default:
+      return /* @__PURE__ */ jsx(Fragment, {});
+  }
+};
+var TenancySettings_default = TenancySettings;
+export {
+  TenancySettings_default as default
+};

package/dist/components/tenant/TenantSettings.js

@@ -14,82 +14,13 @@ var __spreadValues = (a, b) => {
     }
   return a;
 };
-import { Fragment, jsx, jsxs } from "react/jsx-runtime";
-import { DashAutoFormTabs } from "dash-auto-admin";
+import { Fragment, jsx } from "react/jsx-runtime";
 import { useState, useEffect } from "react";
-import { Loading, useRecordContext, useTranslate } from "react-admin";
-import {
-  Box,
-  Card,
-  CardActionArea,
-  CardContent,
-  Divider,
-  Drawer,
-  IconButton,
-  Typography
-} from "@mui/material";
-import CloseIcon from "@mui/icons-material/Close";
+import { Loading, useRecordContext } from "react-admin";
 import MUISimpleJsonTable from "../misc/MuiSimpleJsonTable";
 import { useTenantSettingsFormats } from "./TenantSettingsContext";
 import { useSystemRequestsCache } from "../../contexts/SystemRequestsCache";
-const FormTabsRenderer = ({ schema, method, label }) => /* @__PURE__ */ jsx(Fragment, { children: DashAutoFormTabs({ schema, resourceConfig: null, options: { mode: method, label } }) });
-const toSettingsSections = (schema) => {
-  const order = [];
-  const byGroup = {};
-  schema.forEach((entry) => {
-    const key = entry.group || entry.tab || "general";
-    if (!byGroup[key]) {
-      byGroup[key] = [];
-      order.push(key);
-    }
-    byGroup[key].push(entry);
-  });
-  return order.map((key) => ({ key, entries: byGroup[key] }));
-};
-const prettifyGroup = (key) => key.replace(/[_-]+/g, " ").replace(/^./, (c) => c.toUpperCase());
-const SettingsSections = ({ schema, method }) => {
-  const translate = useTranslate();
-  const [openSection, setOpenSection] = useState(null);
-  const sections = toSettingsSections(schema);
-  const labelFor = (key) => translate(`tenant.settings.groups.${key}`, { _: prettifyGroup(key) });
-  return /* @__PURE__ */ jsxs("section", { children: [
-    /* @__PURE__ */ jsx(
-      Box,
-      {
-        sx: {
-          display: "grid",
-          gap: 2,
-          gridTemplateColumns: { xs: "1fr", sm: "repeat(2, 1fr)", md: "repeat(3, 1fr)" }
-        },
-        children: sections.map((section) => /* @__PURE__ */ jsx(Card, { variant: "outlined", children: /* @__PURE__ */ jsx(CardActionArea, { onClick: () => setOpenSection(section.key), children: /* @__PURE__ */ jsxs(CardContent, { children: [
-          /* @__PURE__ */ jsx(Typography, { variant: "subtitle1", sx: { fontWeight: 600 }, children: labelFor(section.key) }),
-          /* @__PURE__ */ jsx(Typography, { variant: "caption", color: "text.secondary", children: translate("tenant.settings.option_count", {
-            smart_count: section.entries.length,
-            _: `${section.entries.length}`
-          }) })
-        ] }) }) }, section.key))
-      }
-    ),
-    sections.map((section) => /* @__PURE__ */ jsx(
-      Drawer,
-      {
-        anchor: "right",
-        open: openSection === section.key,
-        onClose: () => setOpenSection(null),
-        ModalProps: { keepMounted: true },
-        children: /* @__PURE__ */ jsxs(Box, { sx: { width: { xs: "100vw", sm: 560 }, p: 2 }, children: [
-          /* @__PURE__ */ jsxs(Box, { sx: { display: "flex", alignItems: "center", justifyContent: "space-between", mb: 1 }, children: [
-            /* @__PURE__ */ jsx(Typography, { variant: "h6", children: labelFor(section.key) }),
-            /* @__PURE__ */ jsx(IconButton, { onClick: () => setOpenSection(null), size: "small", "aria-label": "Close", children: /* @__PURE__ */ jsx(CloseIcon, {}) })
-          ] }),
-          /* @__PURE__ */ jsx(Divider, { sx: { mb: 2 } }),
-          /* @__PURE__ */ jsx(FormTabsRenderer, { schema: section.entries, method, label: labelFor(section.key) })
-        ] })
-      },
-      section.key
-    ))
-  ] });
-};
+import { FormTabsRenderer, SettingsSections } from "./SettingsSections";
 const TenantSettingsEdit = ({ method, attribute, tenant }) => {
   const [settingFormatsSchema, setSettingFormatsSchema] = useState(null);
   const { formats: formatsData, loading } = useSystemRequestsCache();

package/dist/systemResources.js

@@ -22,6 +22,7 @@ import { SelectInput, FunctionField } from "react-admin";
 import ResourceTemplate from "./templates/ResourceTemplate";
 import { TenantImpersonateResource } from "./resources/Tenant/ImpersonateTenantResource";
 import tenantSystemAdminSchema from "./schemas/tenant_superadmin";
+import TenancySettings from "./components/tenant/TenancySettings";
 import subscriptionPlanSchema from "./schemas/subscriptionPlan";
 import { RutValidator } from "./utils/validators";
 import { DASHAppConstants } from "dash-constants";
@@ -55,6 +56,21 @@ const systemResources = [
     roles: [DASHAppConstants.system.SYSTEM_ROLE],
     trash: true,
     component: ResourceTemplate,
+    // Same F21 dynamic-tab pattern the sibling system/tenant resource
+    // already uses below — fetches config('tenancies.setting_formats')
+    // (core + whatever domain merges onto it, e.g. the AI Providers
+    // governance tab) once per edit/view, cached client-side.
+    contextComponent: ({ resourceConfig, mode, children }) => {
+      return mode === "list" ? children : /* @__PURE__ */ jsx(
+        SystemRequestsCache,
+        {
+          cacheKey: "tenancy_formats_cache",
+          apiUrl: "system/tenancy/systemSettingFormats",
+          cacheSeconds: 300,
+          children
+        }
+      );
+    },
     model: "system/tenancy",
     //group: "resource.groups.system_resources",
     group: "Accounts",
@@ -332,6 +348,18 @@ const systemResources = [
         inEdit: false,
         inShow: true,
         inCreate: false
+      },
+      {
+        tab: "AI Providers",
+        label: "AI Providers",
+        attribute: "settings",
+        // custom component owns rendering; 'attribute' is required by the interface, not used directly
+        type: Object,
+        custom: true,
+        inList: false,
+        component: TenancySettings,
+        inCreate: false,
+        inShow: false
       }
     ],
     label: "Accounts",
@@ -372,7 +400,27 @@ const systemResources = [
       }
     ],
     mutationMode: "pessimistic",
-    redirectAfterUpdate: false
+    redirectAfterUpdate: false,
+    // Defensive normalization, same pattern already proven in
+    // kt-ecommerce's tenant/tenant resource's own postFormatter: if
+    // 'settings' ever ends up as a JS Array (react-hook-form keeps it
+    // array-shaped once seeded that way, even after nested dot-path
+    // fields like 'settings.bionic_mode' are set on it), JSON.stringify
+    // silently drops the non-index keys on submit — the AI Providers tab
+    // then looks saved in the UI but nothing persists. The backend now
+    // always seeds 'settings' as an object on load (SystemTenancyResource
+    // + TenancyController::_postGetOne), which should prevent this at
+    // the source, but this stays as a second line of defense — cheap,
+    // and it's exactly what already shipped for the sibling resource.
+    postFormatter: (params) => {
+      if (Array.isArray(params.settings)) {
+        params.settings = Object.fromEntries(Object.entries(params.settings));
+      }
+      if (Array.isArray(params.metadata)) {
+        params.metadata = Object.fromEntries(Object.entries(params.metadata));
+      }
+      return params;
+    }
   }, drawerSettings),
   __spreadProps(__spreadValues({
     roles: [DASHAppConstants.system.SYSTEM_ROLE],
@@ -437,6 +485,12 @@ const systemResources = [
     search: false,
     exporter: false,
     postFormatter: (params) => {
+      if (Array.isArray(params.settings)) {
+        params.settings = Object.fromEntries(Object.entries(params.settings));
+      }
+      if (Array.isArray(params.attributes)) {
+        params.attributes = Object.fromEntries(Object.entries(params.attributes));
+      }
       if (params.systemMarketplaces) {
         params.system_marketplace_ids = params.systemMarketplaces.map((item) => item.id);
       }
@@ -456,6 +510,167 @@ const systemResources = [
     //toolbarCreateButton: { enabled: true },
     //listEditButton: { enabled: true, component: QuickEditButton, props: { icon: <Bolt />, label: "", resource: "tenant/inline", navigation:"virtualhash", navigate: (id) => id, size: "small", color: "secondary" }},
   }),
+  {
+    // Platform-wide AI provider credentials (bionic/ollama/deepinfra/
+    // aws_bedrock) — see backend App\AiAgentCore\Models\SystemAiProviderKey.
+    // The 4 rows are seeded by migration and never created/deleted here;
+    // an admin only ever edits an existing row's credentials/flags.
+    // Credential VALUES are never returned by the API once saved
+    // (SystemAiProviderKeyResource only exposes has_api_key/
+    // has_access_key_id/has_secret_access_key) — the fields below are
+    // write-only by design, same convention as any masked secret field.
+    roles: [DASHAppConstants.system.SYSTEM_ROLE],
+    component: ResourceTemplate,
+    model: "system/system_ai_provider_key",
+    group: "Accounts",
+    label: "AI Providers",
+    icon: /* @__PURE__ */ jsx(SystemUpdateAlt, {}),
+    create: false,
+    schema: [
+      {
+        tab: "General",
+        label: "Provider",
+        attribute: "provider",
+        type: String,
+        inList: true,
+        inEdit: false,
+        inShow: true,
+        inCreate: false
+      },
+      {
+        tab: "General",
+        label: "Active",
+        attribute: "is_active",
+        type: Boolean,
+        inList: true,
+        inEdit: true,
+        inShow: true,
+        inCreate: false
+      },
+      {
+        tab: "General",
+        label: "Platform Default Provider",
+        attribute: "is_default",
+        type: Boolean,
+        inList: true,
+        inEdit: true,
+        inShow: true,
+        inCreate: false,
+        fieldProps: {
+          helperText: "The fallback provider used platform-wide, and for any Tenancy that disables a provider without setting its own default."
+        }
+      },
+      {
+        tab: "General",
+        label: "API Key",
+        attribute: "credentials.api_key",
+        type: String,
+        inList: false,
+        inEdit: true,
+        inShow: false,
+        inCreate: false,
+        fieldProps: {
+          helperText: "Bionic / Ollama / DeepInfra only. Write-only \u2014 leave blank to keep the current value."
+        }
+      },
+      {
+        tab: "General",
+        label: "AWS Access Key ID",
+        attribute: "credentials.access_key_id",
+        type: String,
+        inList: false,
+        inEdit: true,
+        inShow: false,
+        inCreate: false,
+        fieldProps: {
+          helperText: "AWS Bedrock only. Write-only \u2014 leave blank to keep the current value."
+        }
+      },
+      {
+        tab: "General",
+        label: "AWS Secret Access Key",
+        attribute: "credentials.secret_access_key",
+        type: String,
+        inList: false,
+        inEdit: true,
+        inShow: false,
+        inCreate: false,
+        fieldProps: {
+          helperText: "AWS Bedrock only. Write-only \u2014 leave blank to keep the current value."
+        }
+      },
+      {
+        // The platform-wide floor of SystemAiProviderKey::resolveServiceTier()'s
+        // 3-level cascade (System -> Tenancy -> Lab) — see
+        // vanexa-backend-domain/docs/CASCADING_AI_SETTINGS_KEY_PERMISSIONS.md.
+        // Reaches for the SAME static-choices 'select'/'multiselect' types the
+        // Tenancy-level "AI Providers" tab already uses (dash-auto-admin's
+        // AttributeToInput/AttributeToField) — a hand-written schema like this
+        // one is a normal consumer of those types too, not just the dynamic
+        // setting_formats pipeline.
+        tab: "General",
+        label: "DeepInfra Service Tier (Platform Default)",
+        attribute: "settings.service_tier",
+        type: "select",
+        inList: false,
+        inEdit: true,
+        inShow: true,
+        inCreate: false,
+        options: [
+          { id: "flex", name: "Flex (0.8x \u2014 best-effort, may wait or be rejected)" },
+          { id: "standard", name: "Standard (1.0x)" },
+          { id: "priority", name: "Priority (1.5x \u2014 skips queues)" }
+        ],
+        fieldProps: {
+          helperText: "DeepInfra only. Used whenever a Tenancy has not set its own default.",
+          // Matches resolveServiceTier()'s OWN eventual fallback
+          // (SystemAiProviderKey::SERVICE_TIER_DEFAULT) — a fresh
+          // row with no settings yet shows what would actually be
+          // used, not a misleadingly blank field.
+          defaultValue: "standard"
+        }
+      },
+      {
+        tab: "General",
+        label: "DeepInfra Tiers Any Tenancy May Ever Use",
+        attribute: "settings.service_tier_allowed",
+        type: "multiselect",
+        inList: false,
+        inEdit: true,
+        inShow: true,
+        inCreate: false,
+        options: [
+          { id: "flex", name: "Flex (0.8x \u2014 best-effort, may wait or be rejected)" },
+          { id: "standard", name: "Standard (1.0x)" },
+          { id: "priority", name: "Priority (1.5x \u2014 skips queues)" }
+        ],
+        fieldProps: {
+          helperText: "DeepInfra only. The HARD CEILING \u2014 a Tenancy's own allow-list can only narrow this, never exceed it. Leave all three selected unless a tier should be forbidden platform-wide.",
+          // Matches resolveServiceTier()'s own default when this
+          // key has never been saved (SystemAiProviderKey::
+          // providerSetting()'s $default param, called with
+          // SERVICE_TIERS) — an unrestricted ceiling, shown as such
+          // rather than as an empty, seemingly-forbid-everything list.
+          defaultValue: ["flex", "standard", "priority"]
+        }
+      }
+    ],
+    menu: [
+      {
+        title: "AI Providers",
+        redirect: "/system/system_ai_provider_key"
+      }
+    ],
+    mutationMode: "pessimistic",
+    redirectAfterUpdate: false,
+    drawer: true,
+    drawerOptions: {
+      view: false,
+      edit: true,
+      create: false
+    },
+    listEditButton: { props: { buttonProps: { variant: "text", size: "small" }, label: "" } }
+  },
   __spreadValues({
     roles: [DASHAppConstants.system.SYSTEM_ROLE],
     component: ResourceTemplate,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@dashadmin/dash-admin",
-	"version": "1.3.70",
+	"version": "1.3.72",
 	"main": "dist/index.js",
 	"type": "module",
 	"scripts": {
@@ -38,11 +38,11 @@
 		"@rollup/plugin-node-resolve": "latest",
 		"@rollup/plugin-replace": "latest",
 		"@rollup/plugin-typescript": "latest",
-		"@dashadmin/dash-admin-state": "1.3.70",
-		"@dashadmin/dash-auto-admin": "1.3.70",
-		"@dashadmin/dash-constants": "1.3.70",
-		"@dashadmin/dash-dialog": "1.3.70",
-		"@dashadmin/dash-styles": "1.3.70",
+		"@dashadmin/dash-admin-state": "1.3.72",
+		"@dashadmin/dash-auto-admin": "1.3.72",
+		"@dashadmin/dash-constants": "1.3.72",
+		"@dashadmin/dash-dialog": "1.3.72",
+		"@dashadmin/dash-styles": "1.3.72",
 		"framer-motion": "latest",
 		"prop-types": "latest",
 		"query-string": "latest",
@@ -61,11 +61,11 @@
 		"rollup-plugin-dts": "latest",
 		"rollup-plugin-peer-deps-external": "latest",
 		"rollup-plugin-svg": "latest",
-		"@dashadmin/dash-modal": "1.3.70",
-		"@dashadmin/dash-components": "1.3.70",
-		"@dashadmin/dash-axios-hook": "1.3.70",
-		"@dashadmin/dash-utils": "1.3.70",
-		"@dashadmin/dash-auth": "1.3.70"
+		"@dashadmin/dash-modal": "1.3.72",
+		"@dashadmin/dash-components": "1.3.72",
+		"@dashadmin/dash-axios-hook": "1.3.72",
+		"@dashadmin/dash-utils": "1.3.72",
+		"@dashadmin/dash-auth": "1.3.72"
 	},
 	"devDependencies": {
 		"@babel/core": "latest",
@@ -78,8 +78,8 @@
 		"@types/react-dom": "latest",
 		"@zerollup/ts-transform-paths": "latest",
 		"babel-loader": "latest",
-		"@dashadmin/dash-eslint": "1.3.70",
-		"@dashadmin/dash-tsconfig": "1.3.70",
+		"@dashadmin/dash-eslint": "1.3.72",
+		"@dashadmin/dash-tsconfig": "1.3.72",
 		"eslint": "latest",
 		"eslint-config-airbnb": "latest",
 		"eslint-config-airbnb-typescript": "latest",
@@ -93,7 +93,7 @@
 		"eslint-plugin-prettier": "latest",
 		"eslint-plugin-react": "latest",
 		"eslint-plugin-react-hooks": "latest",
-		"@dashadmin/dash-prettier": "1.3.70",
+		"@dashadmin/dash-prettier": "1.3.72",
 		"query-string": "latest",
 		"react-dom": "19.2.8",
 		"rollup": "latest",

package/src/components/tenant/SettingsSections.tsx

@@ -0,0 +1,151 @@
+import { DashAutoFormTabs } from "dash-auto-admin";
+import React, { useState } from "react";
+import { useTranslate } from "react-admin";
+import {
+    Box,
+    Card,
+    CardActionArea,
+    CardContent,
+    Divider,
+    Drawer,
+    IconButton,
+    Typography,
+} from "@mui/material";
+import CloseIcon from "@mui/icons-material/Close";
+
+/**
+ * Shared by TenantSettings.tsx and TenancySettings.tsx — both render the
+ * same "one card per settings group, each opening a drawer" layout over a
+ * backend-declared setting_formats schema, the only difference being which
+ * record (Tenant vs Tenancy) supplies the current values. Extracted here
+ * rather than duplicated a second time WITHIN this package (unlike
+ * kt-ecommerce's own TenantSettings.tsx twin, which stays separate on
+ * purpose — see that file's docblock — because pulling a cross-PACKAGE
+ * shared export would break the *-system apps until dash-admin is
+ * republished; that constraint doesn't apply to two components already in
+ * the same package).
+ */
+
+/** Wrapper creating a React component boundary so DashAutoFormTabs hooks don't violate Rules of Hooks */
+export const FormTabsRenderer: React.FC<{ schema: any; method: "list" | "create" | "edit" | "view"; label: string }> = ({ schema, method, label }) => (
+    <>{DashAutoFormTabs({ schema, resourceConfig: null, options: { mode: method, label } })}</>
+);
+
+/**
+ * Split the settings schema into the cards shown on the configuration tab.
+ *
+ * Grouped by the `group` each setting format already declares — data-driven, so
+ * this is agnostic to which product is running: a domain that ships different
+ * groups gets different cards with no change here, and one that ships none at
+ * all still gets a single card rather than an error.
+ *
+ * `group` rather than `tab`: tab is the coarser of the two, and a domain that
+ * puts everything on one tab (the common case) would get no split at all.
+ */
+const toSettingsSections = (schema: any[]) => {
+    const order: string[] = [];
+    const byGroup: Record<string, any[]> = {};
+
+    schema.forEach((entry) => {
+        const key = entry.group || entry.tab || 'general';
+
+        if (!byGroup[key]) {
+            byGroup[key] = [];
+            order.push(key);
+        }
+
+        byGroup[key].push(entry);
+    });
+
+    return order.map((key) => ({ key, entries: byGroup[key] }));
+};
+
+const prettifyGroup = (key: string) =>
+    key.replace(/[_-]+/g, ' ').replace(/^./, (c) => c.toUpperCase());
+
+/**
+ * The configuration panel: one card per settings group, each opening a drawer.
+ *
+ * Replaces a single flat list that grew to whatever the backend declared —
+ * unreadable once a product ships more than a handful of settings.
+ *
+ * ── Two things this has to get right ─────────────────────────────────────────
+ *
+ * keepMounted: the fields belong to the surrounding react-hook-form. Unmounting
+ * a closed drawer unregisters them and drops edits made in a section the user
+ * closed before saving. Context reaches through the portal, so the form itself
+ * is fine — it is only unmount that loses data.
+ *
+ * z-index: this panel is often rendered INSIDE a Drawer already (the tenancy/
+ * tenant resource opens records in one). Two Drawers both sit at
+ * theme.zIndex.modal, where stacking falls to DOM order; raising this one
+ * makes it deliberate.
+ *
+ * Labels resolve through the translator, so a domain can name its own groups.
+ * A missing key falls back to the prettified group key rather than rendering a
+ * raw translation string.
+ */
+export const SettingsSections: React.FC<{
+    schema: any[];
+    method: "list" | "create" | "edit" | "view";
+    /** Translation namespace prefix — 'tenant.settings' or 'tenancy.settings'. */
+    translationNamespace?: string;
+}> = ({ schema, method, translationNamespace = 'tenant.settings' }) => {
+    const translate = useTranslate();
+    const [openSection, setOpenSection] = useState<string | null>(null);
+    const sections = toSettingsSections(schema);
+
+    const labelFor = (key: string) =>
+        translate(`${translationNamespace}.groups.${key}`, { _: prettifyGroup(key) });
+
+    return (
+        <section>
+            <Box
+                sx={{
+                    display: 'grid',
+                    gap: 2,
+                    gridTemplateColumns: { xs: '1fr', sm: 'repeat(2, 1fr)', md: 'repeat(3, 1fr)' },
+                }}
+            >
+                {sections.map((section) => (
+                    <Card key={section.key} variant="outlined">
+                        <CardActionArea onClick={() => setOpenSection(section.key)}>
+                            <CardContent>
+                                <Typography variant="subtitle1" sx={{ fontWeight: 600 }}>
+                                    {labelFor(section.key)}
+                                </Typography>
+                                <Typography variant="caption" color="text.secondary">
+                                    {translate(`${translationNamespace}.option_count`, {
+                                        smart_count: section.entries.length,
+                                        _: `${section.entries.length}`,
+                                    })}
+                                </Typography>
+                            </CardContent>
+                        </CardActionArea>
+                    </Card>
+                ))}
+            </Box>
+
+            {sections.map((section) => (
+                <Drawer
+                    key={section.key}
+                    anchor="right"
+                    open={openSection === section.key}
+                    onClose={() => setOpenSection(null)}
+                    ModalProps={{ keepMounted: true }}
+                >
+                    <Box sx={{ width: { xs: '100vw', sm: 560 }, p: 2 }}>
+                        <Box sx={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', mb: 1 }}>
+                            <Typography variant="h6">{labelFor(section.key)}</Typography>
+                            <IconButton onClick={() => setOpenSection(null)} size="small" aria-label="Close">
+                                <CloseIcon />
+                            </IconButton>
+                        </Box>
+                        <Divider sx={{ mb: 2 }} />
+                        <FormTabsRenderer schema={section.entries} method={method} label={labelFor(section.key)} />
+                    </Box>
+                </Drawer>
+            ))}
+        </section>
+    );
+};

package/src/components/tenant/TenancySettings.tsx

@@ -0,0 +1,122 @@
+import { IDashAutoAdminCustomFieldComponent } from "dash-auto-admin";
+import React, { useEffect, useState } from "react";
+import { Loading, useRecordContext } from "react-admin";
+
+import { useSystemRequestsCache } from "../../contexts/SystemRequestsCache";
+import { FormTabsRenderer, SettingsSections } from "./SettingsSections";
+
+/**
+ * The Tenancy-level twin of TenantSettings.tsx — same backend-driven
+ * card+drawer settings layout (shared via ./SettingsSections.tsx), reading
+ * a Tenancy record's `settings` JSON column instead of a Tenant's. Feeds
+ * the system app's Tenancy edit screen "AI Providers" tab (per-provider
+ * system_key/tenant_key/disabled mode + the tenancy's own default-provider
+ * fallback — see the backend's config/ai_tenancy_settings.php) with no
+ * further frontend change if a domain adds more tenancy-level settings
+ * later, the same guarantee TenantSettings.tsx already makes for Tenant.
+ *
+ * Requires the resource's contextComponent to wrap edit/view in
+ * <SystemRequestsCache apiUrl="system/tenancy/systemSettingFormats" ...>
+ * — see systemResources.tsx's `system/tenancy` resource.
+ *
+ * FILTERED TO tab === 'ai' — `system/tenancy/systemSettingFormats` returns
+ * EVERY tenancy setting_formats entry, including core's pre-existing
+ * billing-tab fields (billing_email/tax_id_type/auto_pay_enabled,
+ * config/tenancies.php) that have never had a dedicated UI before this
+ * component's own contextComponent wiring was added. Mirrors
+ * TenantTheme.tsx's own `.filter((entry) => entry.tab === 'colors')` — this
+ * component owns exactly ONE tab, not "everything the endpoint returns".
+ */
+const AI_PROVIDERS_TAB = 'ai';
+
+const TenancySettingsEdit: React.FC<IDashAutoAdminCustomFieldComponent & { tenancy: any }> = ({ method, tenancy }) => {
+    const [settingFormatsSchema, setSettingFormatsSchema] = useState<any>(null);
+    const { formats: formatsData } = useSystemRequestsCache();
+
+    useEffect(() => {
+        if (formatsData?.data?.setting_formats) {
+            const parsedSchema = formatsData.data.setting_formats
+                .filter((entry: any) => entry.tab === AI_PROVIDERS_TAB && entry.visible !== false)
+                .map((entry: any) => {
+                    // 'settings.foo' -> 'foo', the actual key on the record.
+                    const settingName = entry.attribute ? entry.attribute.replace('settings.', '') : entry.id;
+                    const defaultValue = tenancy?.settings?.[settingName] ?? entry?.default_value;
+
+                    return {
+                        ...entry,
+                        ...(defaultValue !== null && defaultValue !== undefined && {
+                            fieldOptions: { defaultValue, fullWidth: true },
+                        }),
+                    };
+                });
+
+            setSettingFormatsSchema(parsedSchema);
+        }
+    }, [formatsData, tenancy]);
+
+    if (!settingFormatsSchema) {
+        return <Loading />;
+    }
+
+    return <SettingsSections schema={settingFormatsSchema} method={method} translationNamespace="tenancy.settings" />;
+};
+
+const TenancySettingsView: React.FC<IDashAutoAdminCustomFieldComponent & { tenancy: any }> = ({ method, tenancy }) => {
+    const [settingFormatsSchema, setSettingFormatsSchema] = useState<any>(null);
+    const { formats: formatsData } = useSystemRequestsCache();
+
+    useEffect(() => {
+        if (formatsData?.data?.setting_formats) {
+            const parsedSchema = formatsData.data.setting_formats
+                .filter((entry: any) => entry.tab === AI_PROVIDERS_TAB && entry.visible !== false)
+                .map((entry: any) => ({ ...entry, readOnly: true }));
+
+            setSettingFormatsSchema(parsedSchema);
+        }
+    }, [formatsData]);
+
+    if (!settingFormatsSchema) {
+        return <Loading />;
+    }
+
+    return <SettingsSections schema={settingFormatsSchema} method={method} translationNamespace="tenancy.settings" />;
+};
+
+const TenancySettingsCreate: React.FC<IDashAutoAdminCustomFieldComponent> = ({ method }) => {
+    const [settingFormatsSchema, setSettingFormatsSchema] = useState<any>(null);
+    const { formats: formatsData, loading } = useSystemRequestsCache();
+
+    useEffect(() => {
+        if (!loading && formatsData?.data?.setting_formats) {
+            setSettingFormatsSchema(
+                formatsData.data.setting_formats.filter(
+                    (entry: any) => entry.tab === AI_PROVIDERS_TAB && entry.visible !== false,
+                ),
+            );
+        }
+    }, [formatsData, loading]);
+
+    if (!settingFormatsSchema) {
+        return <Loading />;
+    }
+
+    return <FormTabsRenderer schema={settingFormatsSchema} method={method} label="AI Providers" />;
+};
+
+const TenancySettings = ({ method, attribute, resourceConfig }: IDashAutoAdminCustomFieldComponent) => {
+    const tenancy = useRecordContext();
+
+    switch (method) {
+        case "edit":
+            return <TenancySettingsEdit attribute={attribute} method={method} tenancy={tenancy} resourceConfig={resourceConfig} />;
+        case "view":
+            return <TenancySettingsView attribute={attribute} method={method} tenancy={tenancy} resourceConfig={resourceConfig} />;
+        case "create":
+            return <TenancySettingsCreate attribute={attribute} method={method} resourceConfig={resourceConfig} />;
+        case "list":
+        default:
+            return <></>;
+    }
+};
+
+export default TenancySettings;

package/src/components/tenant/TenantSettings.tsx

@@ -1,32 +1,12 @@
-import { DashAutoFormGroups, DashAutoFormTabs, IDashAutoAdminCustomFieldComponent } from "dash-auto-admin";
-import React, { useState, useEffect, useContext, createContext, useRef } from "react";
-import { useGetList, Loading, useRecordContext, useTranslate } from "react-admin";
-import {
-    Box,
-    Card,
-    CardActionArea,
-    CardContent,
-    Divider,
-    Drawer,
-    IconButton,
-    Typography,
-} from "@mui/material";
-import CloseIcon from "@mui/icons-material/Close";
-
-
-
-import { useAxios } from 'dash-axios-hook';
-import { useFormContext, useWatch } from "react-hook-form";
+import { IDashAutoAdminCustomFieldComponent } from "dash-auto-admin";
+import React, { useState, useEffect } from "react";
+import { Loading, useRecordContext } from "react-admin";
+
 import { Tenant } from "../../interfaces/Tenant";
 import MUISimpleJsonTable from "../misc/MuiSimpleJsonTable";
 import { useTenantSettingsFormats } from "./TenantSettingsContext";
 import { useSystemRequestsCache } from "../../contexts/SystemRequestsCache";
-
-/** Wrapper creating a React component boundary so DashAutoFormTabs hooks don't violate Rules of Hooks */
-const FormTabsRenderer: React.FC<{schema: any; method: "list" | "create" | "edit" | "view"; label: string}> = ({schema, method, label}) => (
-    <>{DashAutoFormTabs({schema, resourceConfig: null, options: {mode: method, label}})}</>
-);
-
+import { FormTabsRenderer, SettingsSections } from "./SettingsSections";
 
 /**
  * NOTE — there is a second, behaviourally identical implementation of this
@@ -39,122 +19,11 @@ const FormTabsRenderer: React.FC<{schema: any; method: "list" | "create" | "edit
  * anyone without LINK_DASH_CORE=true — so it would break the *-system apps
  * until dash-admin is republished. Merge them in the same change that ships a
  * new dash-admin version, not before.
- */
-/**
- * Split the settings schema into the cards shown on the configuration tab.
- *
- * Grouped by the `group` each setting format already declares — data-driven, so
- * this is agnostic to which product is running: a domain that ships different
- * groups gets different cards with no change here, and one that ships none at
- * all still gets a single card rather than an error.
- *
- * `group` rather than `tab`: tab is the coarser of the two, and a domain that
- * puts everything on one tab (the common case) would get no split at all.
- */
-const toSettingsSections = (schema: any[]) => {
-    const order: string[] = [];
-    const byGroup: Record<string, any[]> = {};
-
-    schema.forEach((entry) => {
-        const key = entry.group || entry.tab || 'general';
-
-        if (!byGroup[key]) {
-            byGroup[key] = [];
-            order.push(key);
-        }
-
-        byGroup[key].push(entry);
-    });
-
-    return order.map((key) => ({ key, entries: byGroup[key] }));
-};
-
-const prettifyGroup = (key: string) =>
-    key.replace(/[_-]+/g, ' ').replace(/^./, (c) => c.toUpperCase());
-
-/**
- * The configuration panel: one card per settings group, each opening a drawer.
- *
- * Replaces a single flat list that grew to whatever the backend declared —
- * unreadable once a product ships more than a handful of settings.
- *
- * ── Two things this has to get right ─────────────────────────────────────────
- *
- * keepMounted: the fields belong to the surrounding react-hook-form. Unmounting
- * a closed drawer unregisters them and drops edits made in a section the user
- * closed before saving. Context reaches through the portal, so the form itself
- * is fine — it is only unmount that loses data.
- *
- * z-index: this panel is often rendered INSIDE a Drawer already (the tenancy
- * resource opens records in one). Two Drawers both sit at theme.zIndex.modal,
- * where stacking falls to DOM order; raising this one makes it deliberate.
  *
- * Labels resolve through the translator, so a domain can name its own groups.
- * A missing key falls back to the prettified group key rather than rendering a
- * raw translation string.
+ * The card+drawer layout itself lives in ./SettingsSections.tsx, shared with
+ * TenancySettings.tsx — that extraction is safe because both are already in
+ * THIS package, unlike the kt-ecommerce case above.
  */
-const SettingsSections: React.FC<{
-    schema: any[];
-    method: "list" | "create" | "edit" | "view";
-}> = ({ schema, method }) => {
-    const translate = useTranslate();
-    const [openSection, setOpenSection] = useState<string | null>(null);
-    const sections = toSettingsSections(schema);
-
-    const labelFor = (key: string) =>
-        translate(`tenant.settings.groups.${key}`, { _: prettifyGroup(key) });
-
-    return (
-        <section>
-            <Box
-                sx={{
-                    display: 'grid',
-                    gap: 2,
-                    gridTemplateColumns: { xs: '1fr', sm: 'repeat(2, 1fr)', md: 'repeat(3, 1fr)' },
-                }}
-            >
-                {sections.map((section) => (
-                    <Card key={section.key} variant="outlined">
-                        <CardActionArea onClick={() => setOpenSection(section.key)}>
-                            <CardContent>
-                                <Typography variant="subtitle1" sx={{ fontWeight: 600 }}>
-                                    {labelFor(section.key)}
-                                </Typography>
-                                <Typography variant="caption" color="text.secondary">
-                                    {translate('tenant.settings.option_count', {
-                                        smart_count: section.entries.length,
-                                        _: `${section.entries.length}`,
-                                    })}
-                                </Typography>
-                            </CardContent>
-                        </CardActionArea>
-                    </Card>
-                ))}
-            </Box>
-
-            {sections.map((section) => (
-                <Drawer
-                    key={section.key}
-                    anchor="right"
-                    open={openSection === section.key}
-                    onClose={() => setOpenSection(null)}
-                    ModalProps={{ keepMounted: true }}
-                >
-                    <Box sx={{ width: { xs: '100vw', sm: 560 }, p: 2 }}>
-                        <Box sx={{ display: 'flex', alignItems: 'center', justifyContent: 'space-between', mb: 1 }}>
-                            <Typography variant="h6">{labelFor(section.key)}</Typography>
-                            <IconButton onClick={() => setOpenSection(null)} size="small" aria-label="Close">
-                                <CloseIcon />
-                            </IconButton>
-                        </Box>
-                        <Divider sx={{ mb: 2 }} />
-                        <FormTabsRenderer schema={section.entries} method={method} label={labelFor(section.key)} />
-                    </Box>
-                </Drawer>
-            ))}
-        </section>
-    );
-};
 
 const TenantSettingsEdit: React.FC<IDashAutoAdminCustomFieldComponent> = ({ method, attribute, tenant }) => {
     const [settingFormatsSchema, setSettingFormatsSchema] = useState<any>(null);

package/src/systemResources.tsx

@@ -4,6 +4,7 @@ import ResourceTemplate from './templates/ResourceTemplate';
 import IAppResourceConfig from './interfaces/IAppResourceConfig';
 import { TenantImpersonateResource } from './resources/Tenant/ImpersonateTenantResource';
 import tenantSystemAdminSchema from './schemas/tenant_superadmin';
+import TenancySettings from './components/tenant/TenancySettings';
 import subscriptionPlanSchema from './schemas/subscriptionPlan';
 import { RutValidator } from './utils/validators';
 import { DASHAppConstants } from 'dash-constants';
@@ -43,6 +44,21 @@ const systemResources: IAppResourceConfig[] = [
         roles: [DASHAppConstants.system.SYSTEM_ROLE],
         trash: true,
         component: ResourceTemplate,
+        // Same F21 dynamic-tab pattern the sibling system/tenant resource
+        // already uses below — fetches config('tenancies.setting_formats')
+        // (core + whatever domain merges onto it, e.g. the AI Providers
+        // governance tab) once per edit/view, cached client-side.
+        contextComponent: ({ resourceConfig, mode, children }) => {
+            return mode === "list" ? children : (
+                <SystemRequestsCache
+                    cacheKey="tenancy_formats_cache"
+                    apiUrl="system/tenancy/systemSettingFormats"
+                    cacheSeconds={300}
+                >
+                    {children}
+                </SystemRequestsCache>
+            )
+        },
         model: "system/tenancy",
         //group: "resource.groups.system_resources",
         group: "Accounts",
@@ -319,6 +335,17 @@ const systemResources: IAppResourceConfig[] = [
                 inShow: true,
                 inCreate: false,
             },
+            {
+                tab: 'AI Providers',
+                label: 'AI Providers',
+                attribute: 'settings', // custom component owns rendering; 'attribute' is required by the interface, not used directly
+                type: Object,
+                custom: true,
+                inList: false,
+                component: TenancySettings,
+                inCreate: false,
+                inShow: false,
+            },
         ],
         label: "Accounts",
         icon: <BusinessIcon />,
@@ -364,6 +391,27 @@ const systemResources: IAppResourceConfig[] = [
         mutationMode: "pessimistic",
         redirectAfterUpdate: false,
 
+        // Defensive normalization, same pattern already proven in
+        // kt-ecommerce's tenant/tenant resource's own postFormatter: if
+        // 'settings' ever ends up as a JS Array (react-hook-form keeps it
+        // array-shaped once seeded that way, even after nested dot-path
+        // fields like 'settings.bionic_mode' are set on it), JSON.stringify
+        // silently drops the non-index keys on submit — the AI Providers tab
+        // then looks saved in the UI but nothing persists. The backend now
+        // always seeds 'settings' as an object on load (SystemTenancyResource
+        // + TenancyController::_postGetOne), which should prevent this at
+        // the source, but this stays as a second line of defense — cheap,
+        // and it's exactly what already shipped for the sibling resource.
+        postFormatter: (params) => {
+            if (Array.isArray(params.settings)) {
+                params.settings = Object.fromEntries(Object.entries(params.settings));
+            }
+            if (Array.isArray(params.metadata)) {
+                params.metadata = Object.fromEntries(Object.entries(params.metadata));
+            }
+            return params;
+        },
+
         ...drawerSettings,
     },
 
@@ -434,6 +482,14 @@ const systemResources: IAppResourceConfig[] = [
         exporter: false,
         postFormatter: (params) => {
 
+            // Same array-vs-object defense as system/tenancy's own
+            // postFormatter above — see that one's comment for why.
+            if (Array.isArray(params.settings)) {
+                params.settings = Object.fromEntries(Object.entries(params.settings));
+            }
+            if (Array.isArray(params.attributes)) {
+                params.attributes = Object.fromEntries(Object.entries(params.attributes));
+            }
 
             if (params.systemMarketplaces) {
                 params.system_marketplace_ids = params.systemMarketplaces.map((item) => item.id);
@@ -463,6 +519,173 @@ const systemResources: IAppResourceConfig[] = [
     },
 
 
+    {
+        // Platform-wide AI provider credentials (bionic/ollama/deepinfra/
+        // aws_bedrock) — see backend App\AiAgentCore\Models\SystemAiProviderKey.
+        // The 4 rows are seeded by migration and never created/deleted here;
+        // an admin only ever edits an existing row's credentials/flags.
+        // Credential VALUES are never returned by the API once saved
+        // (SystemAiProviderKeyResource only exposes has_api_key/
+        // has_access_key_id/has_secret_access_key) — the fields below are
+        // write-only by design, same convention as any masked secret field.
+        roles: [DASHAppConstants.system.SYSTEM_ROLE],
+        component: ResourceTemplate,
+        model: "system/system_ai_provider_key",
+        group: "Accounts",
+        label: "AI Providers",
+        icon: <SystemUpdateAlt />,
+        create: false,
+
+        schema: [
+            {
+                tab: 'General',
+                label: 'Provider',
+                attribute: 'provider',
+                type: String,
+                inList: true,
+                inEdit: false,
+                inShow: true,
+                inCreate: false,
+            },
+            {
+                tab: 'General',
+                label: 'Active',
+                attribute: 'is_active',
+                type: Boolean,
+                inList: true,
+                inEdit: true,
+                inShow: true,
+                inCreate: false,
+            },
+            {
+                tab: 'General',
+                label: 'Platform Default Provider',
+                attribute: 'is_default',
+                type: Boolean,
+                inList: true,
+                inEdit: true,
+                inShow: true,
+                inCreate: false,
+                fieldProps: {
+                    helperText: 'The fallback provider used platform-wide, and for any Tenancy that disables a provider without setting its own default.',
+                },
+            },
+            {
+                tab: 'General',
+                label: 'API Key',
+                attribute: 'credentials.api_key',
+                type: String,
+                inList: false,
+                inEdit: true,
+                inShow: false,
+                inCreate: false,
+                fieldProps: {
+                    helperText: 'Bionic / Ollama / DeepInfra only. Write-only — leave blank to keep the current value.',
+                },
+            },
+            {
+                tab: 'General',
+                label: 'AWS Access Key ID',
+                attribute: 'credentials.access_key_id',
+                type: String,
+                inList: false,
+                inEdit: true,
+                inShow: false,
+                inCreate: false,
+                fieldProps: {
+                    helperText: 'AWS Bedrock only. Write-only — leave blank to keep the current value.',
+                },
+            },
+            {
+                tab: 'General',
+                label: 'AWS Secret Access Key',
+                attribute: 'credentials.secret_access_key',
+                type: String,
+                inList: false,
+                inEdit: true,
+                inShow: false,
+                inCreate: false,
+                fieldProps: {
+                    helperText: 'AWS Bedrock only. Write-only — leave blank to keep the current value.',
+                },
+            },
+            {
+                // The platform-wide floor of SystemAiProviderKey::resolveServiceTier()'s
+                // 3-level cascade (System -> Tenancy -> Lab) — see
+                // vanexa-backend-domain/docs/CASCADING_AI_SETTINGS_KEY_PERMISSIONS.md.
+                // Reaches for the SAME static-choices 'select'/'multiselect' types the
+                // Tenancy-level "AI Providers" tab already uses (dash-auto-admin's
+                // AttributeToInput/AttributeToField) — a hand-written schema like this
+                // one is a normal consumer of those types too, not just the dynamic
+                // setting_formats pipeline.
+                tab: 'General',
+                label: 'DeepInfra Service Tier (Platform Default)',
+                attribute: 'settings.service_tier',
+                type: 'select',
+                inList: false,
+                inEdit: true,
+                inShow: true,
+                inCreate: false,
+                options: [
+                    { id: 'flex', name: 'Flex (0.8x — best-effort, may wait or be rejected)' },
+                    { id: 'standard', name: 'Standard (1.0x)' },
+                    { id: 'priority', name: 'Priority (1.5x — skips queues)' },
+                ],
+                fieldProps: {
+                    helperText: 'DeepInfra only. Used whenever a Tenancy has not set its own default.',
+                    // Matches resolveServiceTier()'s OWN eventual fallback
+                    // (SystemAiProviderKey::SERVICE_TIER_DEFAULT) — a fresh
+                    // row with no settings yet shows what would actually be
+                    // used, not a misleadingly blank field.
+                    defaultValue: 'standard',
+                },
+            },
+            {
+                tab: 'General',
+                label: 'DeepInfra Tiers Any Tenancy May Ever Use',
+                attribute: 'settings.service_tier_allowed',
+                type: 'multiselect',
+                inList: false,
+                inEdit: true,
+                inShow: true,
+                inCreate: false,
+                options: [
+                    { id: 'flex', name: 'Flex (0.8x — best-effort, may wait or be rejected)' },
+                    { id: 'standard', name: 'Standard (1.0x)' },
+                    { id: 'priority', name: 'Priority (1.5x — skips queues)' },
+                ],
+                fieldProps: {
+                    helperText: 'DeepInfra only. The HARD CEILING — a Tenancy\'s own allow-list can only narrow this, never exceed it. Leave all three selected unless a tier should be forbidden platform-wide.',
+                    // Matches resolveServiceTier()'s own default when this
+                    // key has never been saved (SystemAiProviderKey::
+                    // providerSetting()'s $default param, called with
+                    // SERVICE_TIERS) — an unrestricted ceiling, shown as such
+                    // rather than as an empty, seemingly-forbid-everything list.
+                    defaultValue: ['flex', 'standard', 'priority'],
+                },
+            },
+        ],
+
+        menu: [
+            {
+                title: 'AI Providers',
+                redirect: '/system/system_ai_provider_key',
+            },
+        ],
+
+        mutationMode: "pessimistic",
+        redirectAfterUpdate: false,
+
+        drawer: true,
+        drawerOptions: {
+            view: false,
+            edit: true,
+            create: false,
+        },
+        listEditButton: { props: { buttonProps: { variant: 'text', size: 'small' }, label: '' } },
+    },
+
+