@k2b/cloud 0.42.0 → 0.44.0

package/src/ai/credentials.ts

@@ -1,138 +1,37 @@
 import { sql } from "bun";
-import { toPgTextArray } from "../services/postgres";
 import { decryptValue, encryptValue } from "../services/settings/crypto";
-import type { AiRequestHeaderPatch } from "./request-headers";
 
 type SqlClient = typeof sql;
 
-/**
- * Provider API keys, one per model profile.
- *
- * They used to live on the profile inside the `ai.model_profiles_json` setting.
- * Settings are encrypted at rest but a `text` setting is handed to the admin UI
- * in full, so every key travelled to the browser in the page payload — and the
- * form had to send them back to avoid dropping them while editing a label.
- * Only `kind: "secret"` settings are redacted, and the registry is static, so
- * one setting per profile was never an option.
- *
- * These rows are the answer: encrypted with the same `APP_SECRET` helper the
- * settings store uses, addressed by profile id, and never serialised into
- * anything the client receives.
- */
-
-/** The key for a profile, or null when none is stored. */
-export const getAiCredential = async (profileId: string, db: SqlClient = sql): Promise<string | null> => {
+/** Provider keys are encrypted at rest and never returned by an API. */
+export const getAiCredential = async (providerId: string, db: SqlClient = sql): Promise<string | null> => {
   const [row] = await db<{ secret: string }[]>`
-    SELECT secret FROM ai.model_credentials WHERE profile_id = ${profileId}
+    SELECT secret FROM ai.provider_credentials WHERE provider_id = ${providerId}
   `;
   if (!row) return null;
   try {
     const value = await decryptValue(row.secret);
     return typeof value === "string" && value.trim() ? value : null;
   } catch {
-    console.warn(`[ai] ignoring unreadable provider credential for profile ${JSON.stringify(profileId)}`);
+    console.warn(`[ai] ignoring unreadable provider credential for provider ${JSON.stringify(providerId)}`);
     return null;
   }
 };
 
-/** Store or replace a profile's key. */
-export const setAiCredential = async (profileId: string, secret: string, db: SqlClient = sql): Promise<void> => {
+/** Store or replace a provider's key. */
+export const setAiCredential = async (providerId: string, secret: string, db: SqlClient = sql): Promise<void> => {
   const encrypted = await encryptValue(secret);
   await db`
-    INSERT INTO ai.model_credentials (profile_id, secret)
-    VALUES (${profileId}, ${encrypted})
-    ON CONFLICT (profile_id) DO UPDATE
+    INSERT INTO ai.provider_credentials (provider_id, secret)
+    VALUES (${providerId}, ${encrypted})
+    ON CONFLICT (provider_id) DO UPDATE
       SET secret = EXCLUDED.secret,
           updated_at = now()
   `;
 };
 
-/** Profile ids whose stored key can currently be decrypted and used. */
-export const listAiCredentialProfileIds = async (db: SqlClient = sql): Promise<string[]> => {
-  const rows = await db<{ profile_id: string; secret: string }[]>`SELECT profile_id, secret FROM ai.model_credentials`;
-  const usable: string[] = [];
-  for (const row of rows) {
-    try {
-      const value = await decryptValue(row.secret);
-      if (typeof value === "string" && value.trim()) usable.push(row.profile_id);
-    } catch {
-      console.warn(`[ai] ignoring unreadable provider credential for profile ${JSON.stringify(row.profile_id)}`);
-    }
-  }
-  return usable;
-};
-
-/**
- * Drop keys for profiles that no longer exist.
- *
- * Profiles live in a JSON setting rather than a table, so there is no foreign
- * key to cascade from. Pruning on save keeps a deleted profile from leaving its
- * key behind, and makes recreating an id a clean slate rather than a silent
- * inheritance.
- */
-export const pruneAiCredentials = async (keepProfileIds: readonly string[], db: SqlClient = sql): Promise<void> => {
-  if (keepProfileIds.length === 0) {
-    await db`DELETE FROM ai.model_credentials`;
-    return;
-  }
-  await db`DELETE FROM ai.model_credentials WHERE profile_id <> ALL(${toPgTextArray([...keepProfileIds])}::text[])`;
-};
-
-/**
- * Separate provider keys from the profiles blob.
- *
- * Pure on purpose: the admin route and the one-time migration both need the
- * exact same split, and getting it wrong either leaks a key into a setting or
- * drops one on save. `profilesJson` is what may be stored; `credentials` is
- * what must go into the table; `profileIds` is what survives pruning.
- *
- * Unparseable input is handed back untouched — the settings validator owns that
- * error, and rewriting it here would replace the admin's parse message.
- */
-export const splitAiProfileCredentials = (
-  rawValue: unknown,
-): {
-  profilesJson: string;
-  credentials: Array<{ profileId: string; secret: string }>;
-  profileIds: string[];
-  requestHeaders: AiRequestHeaderPatch[];
-} | null => {
-  if (typeof rawValue !== "string") return null;
-  const text = rawValue;
-  let parsed: unknown;
-  try {
-    parsed = JSON.parse(text || "[]");
-  } catch {
-    return null;
-  }
-  if (!Array.isArray(parsed)) return null;
-
-  const profiles: unknown[] = [];
-  const credentials: Array<{ profileId: string; secret: string }> = [];
-  const profileIds: string[] = [];
-  const requestHeaders: AiRequestHeaderPatch[] = [];
-
-  for (const entry of parsed) {
-    if (!entry || typeof entry !== "object") {
-      profiles.push(entry);
-      continue;
-    }
-    const {
-      apiKey,
-      requestHeaders: headerPatch,
-      requestHeaderNames: _headerNames,
-      credentialSetting: _legacy,
-      ...profile
-    } = entry as Record<string, unknown>;
-    const profileId = typeof profile.id === "string" ? profile.id.trim() : "";
-    if (profileId) {
-      profile.id = profileId;
-      profileIds.push(profileId);
-      if (headerPatch !== undefined) requestHeaders.push({ profileId, patch: headerPatch });
-      if (typeof apiKey === "string" && apiKey.trim()) credentials.push({ profileId, secret: apiKey.trim() });
-    }
-    profiles.push(profile);
-  }
-
-  return { profilesJson: JSON.stringify(profiles), credentials, profileIds, requestHeaders };
+/** Provider IDs with a stored key; decrypt only the selected provider at execution. */
+export const listAiCredentialProviderIds = async (db: SqlClient = sql): Promise<string[]> => {
+  const rows = await db<{ provider_id: string }[]>`SELECT provider_id FROM ai.provider_credentials`;
+  return rows.map((row) => row.provider_id);
 };

package/src/ai/default-tool-contracts.ts

@@ -171,6 +171,7 @@ const chartKinds = (limits = true) => {
       kind: z.literal("bar"),
       ...ChartKindCommon,
       data: list(ChartCategory, 1, CLOUD_AI_CHART_MAX_VALUES),
+      xAxis: ChartAxis.pick({ label: true }).strict().optional(),
       yAxis: ChartAxis.optional(),
       colorByBar: z.boolean().optional(),
       showValues: z.boolean().optional(),
@@ -387,14 +388,14 @@ const flatChartSchema = () => {
       .max(CLOUD_AI_CHART_MAX_SERIES)
       .optional()
       .describe("line, scatter: label/data, optional reference role; line: style. Line needs 2 points per series."),
-    xAxis: ChartAxis.optional().describe("line, scatter: x axis."),
-    yAxis: ChartAxis.optional().describe("bar, line, scatter, boxplot: y axis."),
+    xAxis: ChartAxis.optional().describe("line, scatter: x axis. bar: only label, the category axis title."),
+    yAxis: ChartAxis.optional().describe("bar, line, scatter, boxplot: y axis; label names the value, format sets units."),
     legend: z
       .boolean()
       .optional()
       .describe("bar (colorByBar), line, scatter, pie, donut: legend; defaults to several series or unlabeled slices."),
     colorByBar: z.boolean().optional().describe("bar: one palette color per bar."),
-    showValues: z.boolean().optional().describe("bar, heatmap: print values."),
+    showValues: z.boolean().optional().describe("bar: print values, by default when they stay readable. heatmap: print values."),
     area: z.boolean().optional().describe("line, sparkline: fill under the line."),
     smooth: z.boolean().optional().describe("line: smooth curves."),
     showLabels: z.boolean().optional().describe("pie, donut: name slices next to them."),

package/src/ai/dictation-runtime.ts

@@ -43,7 +43,7 @@ export const isRetryableDictationError = (error: unknown): boolean => {
 export const processAiDictation = async (
   id: string,
   signal: AbortSignal,
-  run: (input: RunAiTranscriptionInput) => Promise<{ text: string; modelProfileId: string }> = runAiTranscription,
+  run: (input: RunAiTranscriptionInput) => Promise<{ text: string; modelId: string }> = runAiTranscription,
 ): Promise<void> => {
   const token = crypto.randomUUID();
   const [task] = await sql<ClaimedDictation[]>`
@@ -57,7 +57,7 @@ export const processAiDictation = async (
     name: "ai.dictation",
     source: "ai:dictations",
     category: "ai",
-    attributes: { dictationId: id, conversationId: task.conversation_id, modelProfileId: task.model_profile_id, attempt: task.attempts },
+    attributes: { dictationId: id, conversationId: task.conversation_id, modelId: task.model_profile_id, attempt: task.attempts },
   });
   let failure: AiTranscriptionError | undefined;
   const canceled = new AbortController();
@@ -92,7 +92,7 @@ export const processAiDictation = async (
       traceParent: span,
       file: new Blob([new Uint8Array(task.source_bytes)]),
       filename: task.source_path,
-      requestedModelId: task.model_profile_id,
+      model: { id: task.model_profile_id },
       language: task.language ?? undefined,
       signal: combined,
       attribution: { userId: task.user_id, conversationId: task.conversation_id },
@@ -109,7 +109,7 @@ export const processAiDictation = async (
     log[combined.aborted ? "info" : retry ? "warn" : "error"](failure.message, {
       dictationId: id,
       traceId: span.traceId,
-      modelProfileId: task.model_profile_id,
+      modelId: task.model_profile_id,
       attempt: task.attempts,
       retry,
       errorCode: failure.code,

package/src/ai/enrich.ts

@@ -151,7 +151,7 @@ export const enrichDirtyAiConversations = async (input: {
   // Resolve the background model once per run; AI disabled / no model = quiet no-op.
   let resolved: AiResolvedModel;
   try {
-    resolved = await (input.deps?.resolveModel ?? resolveAiBackgroundModel)();
+    resolved = await (input.deps?.resolveModel ?? resolveAiBackgroundModel)({ class: "fast" });
   } catch (error) {
     log.info("Enrichment skipped: no background model available", {
       error: error instanceof Error ? error.message : String(error),
@@ -224,7 +224,7 @@ export const enrichDirtyAiConversations = async (input: {
       conversationId: conversation.id,
       status: "ok",
       trigger,
-      modelProfileId: result.modelProfileId,
+      modelId: result.model.id,
       mode: result.structuredMeta.mode,
       durationMs: Date.now() - startedAt,
       titleUpdated: applyTitle,

package/src/ai/executor.ts

@@ -7,10 +7,11 @@ import { CapabilityActionReviewDataSchema, capabilityActionPolicy } from "../con
 import type { AccessSubject, RequestActor } from "../server";
 import { approvalAssurance, approvalScopeFromToolName, approvals } from "../services/approvals";
 import { createHelpReader } from "../services/help";
-import { logger } from "../services/logging";
+import { logger, trace } from "../services/logging";
 import { getMandate } from "../services/mandates";
 import type { MandatePolicyV1 } from "../services/mandates/policy";
 import { coreSettings } from "../services/settings/api";
+import type { AiModelRequest } from "../shared/ai-models";
 import { normalizeLocale } from "../shared/locale";
 import { type AiActionCheck, type AiStoredActionReview, storedActionReview } from "./action-review";
 import {
@@ -99,6 +100,7 @@ import {
   AiTurnFailure,
   type AiTurnFailureInfo,
   type AiTurnFailureReason,
+  aiIssueDiagnostic,
   aiTurnFailureFromThrown,
   aiTurnReasonFromThrown,
   rememberProviderErrors,
@@ -702,7 +704,7 @@ type MaterializedChatConfig = {
   tools: AiRuntimeTool[];
   toolApprovalContext?: AiToolApprovalContext;
   modelPolicy: AiChatTurnRunConfig["modelPolicy"];
-  requestedModelId?: string;
+  model?: AiModelRequest;
 };
 
 const materializeChatConfig = async (config: AiChatTurnRunConfig, signal: AbortSignal, turnId: string): Promise<MaterializedChatConfig> => {
@@ -722,7 +724,7 @@ const materializeChatConfig = async (config: AiChatTurnRunConfig, signal: AbortS
         : [],
     toolApprovalContext: config.toolApprovalContext,
     modelPolicy: config.modelPolicy,
-    requestedModelId: config.requestedModelId,
+    model: config.model,
   };
 };
 
@@ -752,7 +754,7 @@ export class AiTurnExecutor {
     const runConfig = claim.runConfig;
     if (!runConfig) {
       pipeline.seedBaseline(claim.liveBlocks ?? []);
-      await pipeline.emitTurnStarted(claim.turn.modelProfileId ?? "");
+      await pipeline.emitTurnStarted(claim.turn.modelId ?? "");
       await pipeline.emitBaseline();
       await this.finalize(
         conversationId,
@@ -767,7 +769,7 @@ export class AiTurnExecutor {
 
     if (runConfig.kind === "compact") {
       pipeline.seedBaseline(claim.liveBlocks ?? []);
-      await pipeline.emitTurnStarted(claim.turn.modelProfileId ?? "");
+      await pipeline.emitTurnStarted(claim.turn.modelId ?? "");
       await pipeline.emitBaseline();
       await this.runCompaction(conversationId, turnId, pipeline, runConfig, signal);
       return;
@@ -778,7 +780,7 @@ export class AiTurnExecutor {
       attemptState = await loadChatAttemptState(conversationId, turnId);
     } catch (error) {
       pipeline.seedBaseline(claim.liveBlocks ?? []);
-      await pipeline.emitTurnStarted(claim.turn.modelProfileId ?? "");
+      await pipeline.emitTurnStarted(claim.turn.modelId ?? "");
       await pipeline.emitBaseline();
       await this.finalize(
         conversationId,
@@ -792,15 +794,15 @@ export class AiTurnExecutor {
       return;
     }
     pipeline.seedBaseline(rebuildAttemptBaseline(attemptState));
-    await pipeline.emitTurnStarted(claim.turn.modelProfileId ?? "");
+    await pipeline.emitTurnStarted(claim.turn.modelId ?? "");
     await pipeline.emitBaseline();
     await this.runChat(conversationId, turnId, claim, runConfig, pipeline, signal, false, attemptState);
   }
 
   /**
    * Ends the turn. A failure stores its reason twice: as a code on the turn's last message, which the chat words in
-   * the reader's language, and as text in the turn's language for readers without the chat view. The raw cause, such
-   * as a provider's own message, goes only to the log. A failed compaction left the chat as it was, so its text names
+   * the reader's language, and as text in the turn's language for readers without the chat view. The diagnostic cause,
+   * with provider and loop issues reduced to fixed text, goes only to the log. A failed compaction left the chat as it was, so its text names
    * only the reason.
    */
   private async finalize(
@@ -888,9 +890,6 @@ export class AiTurnExecutor {
         }
         resolvedProjectId = project.id;
       }
-      if (isAssistantChatTurn(config) && claim.turn.modelProfileId) {
-        await aiModelAccess.assertAllowed(claim.turn.modelProfileId, accessSubjectForActor(material.actor));
-      }
       validated = await (this.config.validateTurn ?? validateAiTurnRequest)({
         input: config.input,
         hasImageAttachments: config.files?.attached.some((file) => isAiImageMediaType(file.mediaType)),
@@ -898,12 +897,10 @@ export class AiTurnExecutor {
           material.tools.some((tool) => tool.def.name === "view_image") &&
           (await isAiVisionModelConfigured(material.modelPolicy?.allowedDataBoundaries)),
         modelPolicy: material.modelPolicy,
-        requestedModelId: isAssistantChatTurn(config)
-          ? (claim.turn.modelProfileId ?? material.requestedModelId)
-          : material.requestedModelId,
+        model: claim.turn.modelId ? { id: claim.turn.modelId } : material.model,
       });
       if (isAssistantChatTurn(config)) {
-        await aiModelAccess.assertAllowed(validated.resolved.profile.id, accessSubjectForActor(material.actor));
+        await aiModelAccess.assertAllowed(validated.resolved.profile.modelId, accessSubjectForActor(material.actor));
       }
     } catch (error) {
       signal.removeEventListener("abort", onSignal);
@@ -919,6 +916,11 @@ export class AiTurnExecutor {
       return;
     }
     const { settings, resolved } = validated;
+    if (config.modelResolved?.id === resolved.profile.id) resolved.model = config.modelResolved;
+    await trace.record({
+      event: "model.resolved",
+      attributes: { ...resolved.model, resolvedClass: resolved.model.class, turnId, conversationId },
+    });
 
     const defaultToolSource = config.toolSource?.kind === "default" ? config.toolSource : null;
     const toolActor =
@@ -1186,7 +1188,7 @@ export class AiTurnExecutor {
         await pipeline.emitMessage(message);
       },
       conversationId,
-      modelProfileId: resolved.profile.id,
+      modelId: resolved.profile.id,
       turnId,
       leaseOwner: this.config.leaseOwner,
       turnInput,
@@ -1590,7 +1592,9 @@ export class AiTurnExecutor {
       provider: acceptCanonicalToolNames(
         retryTransientProviderErrors(
           rememberProviderErrors(
-            answerOpenToolCalls(assistantQuotaProvider(resolved.provider, config, quotaSubject, resolved.profile, turnId, conversationId)),
+            answerOpenToolCalls(
+              assistantQuotaProvider(resolved.provider, config, quotaSubject, resolved.profile, turnId, conversationId, resolved.model),
+            ),
             remember,
           ),
           {
@@ -1658,7 +1662,7 @@ export class AiTurnExecutor {
         : createCloudCompactFn({
             conversationId,
             turnId,
-            modelProfileId: resolved.profile.id,
+            modelId: resolved.profile.id,
             additionalInstructions: settings.compactionInstructions,
             maxOutputTokens: resolved.profile.maxOutputTokens,
             signal: abortController.signal,
@@ -1885,8 +1889,9 @@ export class AiTurnExecutor {
           if (!abortController.signal.aborted && isToolRound(event.message)) noteToolRound();
         } else if (event.type === "issue") {
           if (event.issue.kind === "malformed_tool_call" && event.issue.callId) malformedCallIds.add(event.issue.callId);
-          lastIssueMessage = event.issue.message;
-          log.warn("AI turn issue", { conversationId, turnId, kind: event.issue.kind, message: event.issue.message });
+          const diagnostic = aiIssueDiagnostic(event.issue);
+          lastIssueMessage = diagnostic.message;
+          log.warn("AI turn issue", { conversationId, turnId, ...diagnostic });
         } else if (event.type === "loop_end") {
           const stoppedAfterFailure =
             event.reason === "stop" &&
@@ -2218,7 +2223,7 @@ export class AiTurnExecutor {
       validated = await (this.config.validateTurn ?? validateAiTurnRequest)({
         input: "",
         modelPolicy: config.modelPolicy,
-        requestedModelId: config.requestedModelId,
+        model: config.model,
       });
     } catch (error) {
       signal.removeEventListener("abort", onSignal);
@@ -2226,10 +2231,15 @@ export class AiTurnExecutor {
       return;
     }
     const { settings, resolved } = validated;
+    if (config.modelResolved?.id === resolved.profile.id) resolved.model = config.modelResolved;
+    await trace.record({
+      event: "model.resolved",
+      attributes: { ...resolved.model, resolvedClass: resolved.model.class, turnId, conversationId },
+    });
 
     const store = aiConversations.createSessionStore({
       conversationId,
-      modelProfileId: resolved.profile.id,
+      modelId: resolved.profile.id,
       turnId,
       leaseOwner: this.config.leaseOwner,
     });
@@ -2242,6 +2252,7 @@ export class AiTurnExecutor {
         inferenceProvider(resolved.provider, resolved.profile, {
           kind: "background",
           task: "chat-compaction",
+          modelRef: resolved.model,
           conversationId,
           turnId,
           appId: "core",
@@ -2255,7 +2266,7 @@ export class AiTurnExecutor {
       compact: createCloudCompactFn({
         conversationId,
         turnId,
-        modelProfileId: resolved.profile.id,
+        modelId: resolved.profile.id,
         additionalInstructions: settings.compactionInstructions,
         maxOutputTokens: resolved.profile.maxOutputTokens,
         signal: abortController.signal,
@@ -2274,7 +2285,7 @@ export class AiTurnExecutor {
       for await (const event of loop as AsyncIterable<CompactEvent>) {
         if (event.type === "compaction_start") await pipeline.applyCompaction("running");
         else if (event.type === "compaction_end") await pipeline.applyCompaction("completed");
-        else if (event.type === "issue") issueMessage = event.issue.message;
+        else if (event.type === "issue") issueMessage = aiIssueDiagnostic(event.issue).message;
         else if (event.type === "loop_end") {
           status = event.reason === "stop" ? "completed" : event.reason === "aborted" ? "aborted" : "failed";
           await pipeline.applyCompaction(status === "failed" ? "failed" : "completed", event.result);
@@ -2428,10 +2439,10 @@ class StreamPipeline {
     await this.maybeSnapshot();
   }
 
-  async emitTurnStarted(modelProfileId: string): Promise<void> {
+  async emitTurnStarted(modelId: string): Promise<void> {
     const seq = this.nextSeq();
     await this.publish(
-      this.envelope({ type: "turn_started" as const, seq, modelProfileId, providerModel: "", blocks: this.blocks }) as AiWireEvent,
+      this.envelope({ type: "turn_started" as const, seq, modelId, providerModel: "", blocks: this.blocks }) as AiWireEvent,
     );
   }
 

package/src/ai/http.ts

@@ -3,6 +3,7 @@ import type { Context } from "hono";
 import { z } from "zod";
 import { CapabilityAppIdSchema } from "../contracts/capabilities";
 import { type AuthContext, err, fail, respond } from "../server";
+import { AiModelRequestSchema } from "../shared/ai-models";
 import { aiAttachmentMarker } from "./attachments";
 import { CODE_RUNTIME_TOOL_NAMES } from "./browser-code-contracts";
 import { AI_TURN_ATTACHMENT_MAX_ITEMS } from "./limits";
@@ -11,13 +12,7 @@ import { AiQuotaError } from "./quotas";
 import { AiResourceMarkerSchema } from "./resource-markers";
 import { AI_SHORT_ID_PATTERN } from "./short-id";
 import { AI_SKILL_NAME_MAX_CHARS, AI_SKILL_NAME_PATTERN } from "./skill-format";
-import {
-  AI_MESSAGE_FEEDBACK_REASONS,
-  type AiClientToolId,
-  type AiDraftContentPart,
-  type AiSettingsError,
-  type AiUserContentPart,
-} from "./types";
+import { AI_MESSAGE_FEEDBACK_REASONS, type AiClientToolId, type AiDraftContentPart, type AiUserContentPart } from "./types";
 import { isAiSettingsError } from "./validate";
 
 export const AiDraftContentPartSchema = z.discriminatedUnion("type", [
@@ -144,9 +139,10 @@ export const AiTurnInputSchema = z
       .min(1)
       .max(AI_TURN_ATTACHMENT_MAX_ITEMS * 2 + 1)
       .optional(),
-    modelProfileId: z.string().trim().min(1).optional(),
+    model: AiModelRequestSchema.optional(),
     clientToolIds: AiClientToolIdsSchema.optional(),
   })
+  .strict()
   .refine((input) => Boolean(input.message?.trim() || input.content?.length), {
     message: "Message or content is required.",
     path: ["message"],
@@ -166,13 +162,14 @@ export const AiSubmitConversationDraftInputSchema = z
   .object({
     queueId: z.uuid().optional(),
     draftRevision: z.number().int().min(1),
-    modelProfileId: z.string().trim().min(1).optional(),
+    model: AiModelRequestSchema.optional(),
     clientToolIds: AiClientToolIdsSchema.optional(),
     /** Set by a local client such as cld; the web never sends it. */
     client: AiLocalClientSchema.optional(),
     /** AGENTS.md files and local Skills a local client found; only valid together with client. */
     localContext: AiLocalContextSchema.optional(),
   })
+  .strict()
   .refine((input) => !input.localContext || Boolean(input.client), {
     message: "Local context requires a local client.",
     path: ["localContext"],
@@ -183,9 +180,11 @@ export const AiSteerInputSchema = z.object({
   clientRequestId: z.string().trim().min(1).max(120),
 });
 
-export const AiCompactionInputSchema = z.object({
-  modelProfileId: z.string().trim().min(1).optional(),
-});
+export const AiCompactionInputSchema = z
+  .object({
+    model: AiModelRequestSchema.optional(),
+  })
+  .strict();
 
 export type AiCompactionInput = z.infer<typeof AiCompactionInputSchema>;
 
@@ -200,11 +199,12 @@ export const AiMessageRetryInputSchema = z
       .min(1)
       .max(AI_TURN_ATTACHMENT_MAX_ITEMS * 2 + 1)
       .optional(),
-    modelProfileId: z.string().trim().min(1).optional(),
+    model: AiModelRequestSchema.optional(),
     clientToolIds: AiClientToolIdsSchema.optional(),
     client: AiLocalClientSchema.optional(),
     localContext: AiLocalContextSchema.omit({ selectedSkills: true }).optional(),
   })
+  .strict()
   .refine((input) => !input.localContext || Boolean(input.client), {
     message: "Local context requires a local client.",
     path: ["localContext"],
@@ -268,25 +268,13 @@ export const AiApiErrorSchema = z.object({
 
 const conflict = (message: string) => ({ code: "CONFLICT" as const, message, status: 409 as const });
 
-const aiSettingsServiceError = (error: AiSettingsError) => {
-  switch (error.code) {
-    case "model_access_denied":
-      return err.forbidden(error.message);
-    case "invalid_model_profiles":
-    case "model_policy_mismatch":
-      return err.badInput(error.message);
-    case "ai_disabled":
-    case "missing_default_model":
-    case "default_model_disabled":
-    case "missing_provider_credential":
-      return conflict(error.message);
-  }
-};
-
 export const toAiErrorResponse = (c: Context<AuthContext>, error: unknown) => {
   if (error instanceof AiQuotaError) return c.json({ ok: false, error: error.message, message: error.message, code: error.code }, 429);
   if (isAiSettingsError(error)) {
-    return respond(c, fail(aiSettingsServiceError(error.aiError)));
+    return c.json(
+      { ok: false, code: error.aiError.code, message: error.aiError.message, error: error.aiError.message },
+      error.aiError.code === "model_policy_mismatch" ? 400 : 409,
+    );
   }
   const message = error instanceof Error ? error.message : "AI request failed";
   if (message.includes("idx_ai_turns_one_active")) return respond(c, fail(err.conflict("Running turn")));

package/src/ai/index.ts

@@ -1,4 +1,13 @@
+export * from "../shared/ai-models";
 export { type AiAppSkillIssue, aiAppSkills, appSkillsRegistryState, reconcileAppSkills } from "./app-skill-store";
+export {
+  type ApplicationAiTaskInput,
+  type ApplicationAiTaskKey,
+  deleteApplicationAiTasks,
+  listUnreleasedApplicationAiTaskSources,
+  releaseApplicationAiTask,
+  runApplicationAiTask,
+} from "./application-tasks";
 export { type AiApprovalPreferenceRoutes, type AiApprovalPreferenceView, createAiApprovalPreferenceRoutes } from "./approval-routes";
 export {
   AI_WEBSITE_APPROVAL_TOOL,
@@ -19,7 +28,7 @@ export {
   rememberAiToolApproval,
   revokeAiToolApprovalPreference,
 } from "./approvals";
-export { assistantAiSettingsState, listAssistantAiModels, selectAssistantAiModelId } from "./assistant-models";
+export { assistantAiSettingsState, listAssistantAiModels, peopleAiModels, selectAssistantAiModel } from "./assistant-models";
 export { type AiAttachmentRef, aiAttachmentMarker, formatAiFileSize, parseAiAttachmentMarkers } from "./attachments";
 export { CloudAiTranscribeAudioInputSchema, CloudAiTranscribeAudioOutputSchema, createCloudAiTranscribeAudioTool } from "./audio-tool";
 export { AiBackgroundApprovalRequiredError, authorizeBackgroundAction } from "./background-review";
@@ -65,7 +74,7 @@ export { parseAiSse } from "./client/transport";
 export { CODE_CAPABILITY_TOKEN_HEADER, createCodeCapabilityTransport } from "./code-capability-transport";
 export { authorizeCodeExecution } from "./code-execution";
 export { CODE_SOURCE_TOOLS, type CodeSourceToolName } from "./code-source-contracts";
-export { listAiCredentialProfileIds } from "./credentials";
+export { listAiCredentialProviderIds } from "./credentials";
 export {
   CLOUD_AI_CHART_MAX_SERIES,
   CLOUD_AI_CHART_MAX_VALUES,
@@ -306,7 +315,6 @@ export {
   listAiModels,
   readAiSettingsState,
   resolveAiModel,
-  resolveAiSettingsStateFromRaw,
   resolveAiVisionModel,
   selectAiModelProfile,
   toPublicAiSettingsState,
@@ -365,7 +373,6 @@ export {
   streamAiConversationEvents,
 } from "./stream";
 export {
-  AI_BACKGROUND_MODEL_SETTING_KEY,
   type RunAiStructuredInput,
   type RunAiStructuredResult,
   resolveAiBackgroundModel,
@@ -420,7 +427,6 @@ export type {
   AiPendingTurnAction,
   AiProjectPromptSnapshot,
   AiProviderId,
-  AiPublicModelProfile,
   AiRecentResource,
   AiResolvedModel,
   AiRuntimeTool,

package/src/ai/inference-calls.ts

@@ -27,8 +27,10 @@ export class AiBackgroundAdmissionError extends Error {
 export type AiCallContext = {
   kind: "chat" | "background";
   task: string;
+  modelRef?: import("../shared/ai-models").AiResolvedModelRef;
   subject?: AccessSubject | null;
   userId?: string;
+  credentialId?: string;
   conversationId?: string;
   turnId?: string;
   workflowRunId?: string;
@@ -91,7 +93,7 @@ export async function beginAiCall(
     }
     if (hasBillableAiPricing(profile.pricing) && context.kind === "chat" && context.subject && config.enabled) {
       const now = new Date();
-      const snapshot = await aiQuotas.snapshot(context.subject, profile.id, now, db);
+      const snapshot = await aiQuotas.snapshot(context.subject, profile.modelId, now, db);
       for (const balance of snapshot.balances) {
         if (balance.bypassed || balance.limit === null) continue;
         if (balance.unknown)
@@ -109,7 +111,7 @@ export async function beginAiCall(
           SELECT (COALESCE(sum(cost),0)+COALESCE(sum(reserved) FILTER(WHERE finished_at IS NULL AND lease_expires_at>now()),0))::text AS committed FROM ai.inference_calls c
           WHERE kind='chat'
             AND user_id IS NOT DISTINCT FROM ${user}::uuid AND service_account_id IS NOT DISTINCT FROM ${service}::uuid
-            AND (${balance.scope}='*' OR model_profile_id=${balance.scope}) AND started_at>=${window.from} AND started_at<${window.until}
+            AND (${balance.scope}='*' OR model_id=${balance.scope}) AND started_at>=${window.from} AND started_at<${window.until}
             AND started_at>COALESCE((SELECT max(created_at) FROM ai.cost_resets r
               WHERE r.user_id IS NOT DISTINCT FROM ${user}::uuid AND r.service_account_id IS NOT DISTINCT FROM ${service}::uuid AND r.scope=${balance.scope}),'-infinity'::timestamptz)`;
         const available = aiBudgetUnits(balance.limit) - aiDecimalUnits(pending?.committed ?? "0");
@@ -145,10 +147,10 @@ export async function beginAiCall(
     const id = crypto.randomUUID();
     const userId = context.subject?.type === "user" ? context.subject.userId : context.userId;
     const serviceId = context.subject?.type === "service_account" ? context.subject.serviceAccountId : null;
-    await db`INSERT INTO ai.inference_calls(id,user_id,service_account_id,model_profile_id,provider_model,kind,task,
+    await db`INSERT INTO ai.inference_calls(id,user_id,service_account_id,credential_id,model_profile_id,model_id,requested_class,resolved_class,provider_model,kind,task,
       turn_id,turn_attempt,conversation_id,workflow_run_id,step_key,trace_id,app_id,workflow_id,workflow_name,workflow_version,pricing,reserved,lease_expires_at)
       VALUES(${id}::uuid,CASE WHEN ${serviceId}::uuid IS NULL THEN COALESCE(${userId ?? null}::uuid,(SELECT created_by_user_id FROM ai.conversations WHERE id=${context.conversationId ?? null}::uuid)) ELSE NULL END,
-        ${serviceId}::uuid,${profile.id},${profile.model},${context.kind},${context.task},${context.turnId ?? null}::uuid,
+        ${serviceId}::uuid,${context.credentialId ?? null}::uuid,${profile.id},${profile.modelId},${context.modelRef?.requestedClass ?? null},${context.modelRef?.class ?? null},${profile.model},${context.kind},${context.task},${context.turnId ?? null}::uuid,
         (SELECT attempt FROM ai.turns WHERE id=${context.turnId ?? null}::uuid),${context.conversationId ?? null}::uuid,
         ${context.workflowRunId ?? null}::uuid,${context.stepKey ?? null},${context.traceId ?? null},COALESCE(${workflow?.app ?? context.appId ?? null},(SELECT launched_by_app_id FROM ai.conversations WHERE id=${context.conversationId ?? null}::uuid),'core'),${workflow?.id ?? null}::uuid,${workflow?.name ?? null},${workflow?.revision ?? null},
         (${profile.pricing ? JSON.stringify(profile.pricing) : null}::text)::jsonb,${reserved}::numeric,now()+interval '2 minutes')`;