@k2b/cloud 0.42.0 → 0.44.0

package/src/ai/maintenance.ts

@@ -145,7 +145,7 @@ const createSchedule = async (config: {
       resourceKind: config.resourceKind,
       resourceId: config.resourceId,
       resourceLabel: config.label,
-      detailHref: "/admin/settings?tab=ai",
+      detailHref: "/admin/ai?sec=general",
     },
     process: async (context) => {
       await config.submit(`slot:${context.slot.getTime()}`);

package/src/ai/memory-learning-runs.ts

@@ -21,7 +21,7 @@ export type AiMemoryLearningRun = {
   conversationTitle: string;
   kind: AiMemoryLearningRunKind;
   status: AiMemoryLearningRunStatus;
-  modelProfileId: string | null;
+  modelId: string | null;
   durationMs: number | null;
   addedCount: number;
   updatedCount: number;
@@ -79,7 +79,7 @@ const toRun = (row: RunRow): AiMemoryLearningRun => ({
   conversationTitle: row.conversation_title,
   kind: row.run_kind,
   status: row.status,
-  modelProfileId: row.model_profile_id,
+  modelId: row.model_profile_id,
   durationMs: row.duration_ms,
   addedCount: row.added_count,
   updatedCount: row.updated_count,
@@ -107,7 +107,7 @@ export const aiMemoryLearningRuns = {
     turnId: string;
     runKind: AiMemoryLearningRunKind;
     evidenceKey?: string;
-    modelProfileId: string;
+    modelId: string;
     accountedTokens: number;
   }): Promise<string | null> {
     if ((input.runKind === "workflow") !== Boolean(input.evidenceKey)) {
@@ -119,7 +119,7 @@ export const aiMemoryLearningRuns = {
         INSERT INTO ai.memory_learning_runs (
           short_id, user_id, conversation_id, turn_id, conversation_title, run_kind, model_profile_id, accounted_tokens
         )
-        SELECT ${shortId}, ${input.userId}::uuid, c.id, turn.id, c.title, ${input.runKind}, ${input.modelProfileId}, ${input.accountedTokens}
+        SELECT ${shortId}, ${input.userId}::uuid, c.id, turn.id, c.title, ${input.runKind}, ${input.modelId}, ${input.accountedTokens}
         FROM ai.conversations c
         JOIN ai.turns turn ON turn.conversation_id = c.id AND turn.id = ${input.turnId}::uuid
         WHERE c.id = ${input.conversationId}::uuid AND c.created_by_user_id = ${input.userId}::uuid
@@ -136,7 +136,7 @@ export const aiMemoryLearningRuns = {
           short_id, user_id, conversation_id, turn_id, conversation_title, run_kind, evidence_key, model_profile_id, accounted_tokens
         )
         SELECT ${shortId}, ${input.userId}::uuid, c.id, turn.id, c.title, 'workflow', ${input.evidenceKey!},
-               ${input.modelProfileId}, ${input.accountedTokens}
+               ${input.modelId}, ${input.accountedTokens}
         FROM ai.conversations c
         JOIN ai.turns turn ON turn.conversation_id = c.id AND turn.id = ${input.turnId}::uuid
         WHERE c.id = ${input.conversationId}::uuid AND c.created_by_user_id = ${input.userId}::uuid

package/src/ai/memory-learning.ts

@@ -432,7 +432,7 @@ export const learnAiMemoriesFromPrivateChats = async (
   const summary: AiMemoryLearningRunSummary = { scanned: 0, learned: 0, updated: 0, retired: 0, skipped: 0, failed: 0 };
   let resolved: AiResolvedModel;
   try {
-    resolved = await (input.deps?.resolveModel ?? resolveAiBackgroundModel)();
+    resolved = await (input.deps?.resolveModel ?? resolveAiBackgroundModel)({ class: "fast" });
   } catch (error) {
     log.info("Memory learning skipped: no background model available", {
       error: error instanceof Error ? error.message : String(error),
@@ -500,7 +500,7 @@ export const learnAiMemoriesFromPrivateChats = async (
         conversationId: candidate.conversationId,
         turnId: candidate.turnId,
         runKind: "turn",
-        modelProfileId: resolved.profile.id,
+        modelId: resolved.profile.id,
         accountedTokens: reservedTokens,
       });
       // Claiming the run also awaits the database: recheck immediately before inference.
@@ -617,7 +617,7 @@ export const learnAiMemoriesFromPrivateChats = async (
         turnId: context.source.candidate.turnId,
         runKind: "workflow",
         evidenceKey: workflowEvidenceKey(pattern),
-        modelProfileId: resolved.profile.id,
+        modelId: resolved.profile.id,
         accountedTokens: reservedTokens,
       });
       if (!(await isAiWorkflowPatternEligible(pattern))) {

package/src/ai/message-queue.ts

@@ -153,8 +153,7 @@ export const drainQueuedMessages = async (
   for (const row of rows) {
     try {
       const quotaSubject = aiChatAccessSubject(row.submission.runConfig.actor);
-      if (isAssistantChatTurn(row.submission.runConfig) && quotaSubject)
-        await aiQuotas.assertAllowed(quotaSubject, row.submission.modelProfileId);
+      if (isAssistantChatTurn(row.submission.runConfig) && quotaSubject) await aiQuotas.assertAllowed(quotaSubject, row.submission.modelId);
       await sql`UPDATE ai.queued_messages SET status='pending', error=NULL WHERE id=${row.id}::uuid AND status='failed' AND error IN ('quota_exhausted','quota_usage_unknown')`;
       const result = await aiConversations.submitChatTurn({ ...row.submission, queuedMessageId: row.id });
       await enqueue({ conversationId: row.conversation_id, turnId: result.turn.id });

package/src/ai/migrate.ts

@@ -560,6 +560,8 @@ export const migrateCloudAi = async (): Promise<void> => {
     )
   `.simple();
   await sql`ALTER TABLE ai.conversation_resource_refs DROP COLUMN IF EXISTS occurrences`.simple();
+  await sql`ALTER TABLE ai.conversation_resource_refs ADD COLUMN IF NOT EXISTS context VARCHAR(200)`.simple();
+  await sql`ALTER TABLE ai.conversation_resource_refs ADD COLUMN IF NOT EXISTS status VARCHAR(60)`.simple();
 
   await sql`
     CREATE INDEX IF NOT EXISTS idx_ai_conversation_resource_refs_recent
@@ -1100,7 +1102,7 @@ export const migrateCloudAi = async (): Promise<void> => {
   `.simple();
 
   // Last model the user actually ran a turn with — preselected for new chats.
-  await sql`ALTER TABLE ai.user_prefs ADD COLUMN IF NOT EXISTS last_model_id TEXT NOT NULL DEFAULT ''`.simple();
+  await sql`ALTER TABLE ai.user_prefs ADD COLUMN IF NOT EXISTS model_choice JSONB`.simple();
 
   await sql`
     CREATE TABLE IF NOT EXISTS ai.memories (
@@ -1880,7 +1882,7 @@ export const migrateCloudAi = async (): Promise<void> => {
       description TEXT NOT NULL DEFAULT '',
       icon TEXT NOT NULL DEFAULT 'ti ti-folders',
       instructions TEXT NOT NULL DEFAULT '',
-      default_model_profile_id TEXT,
+      default_model JSONB,
       revision INTEGER NOT NULL DEFAULT 1,
       created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
       updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
@@ -2497,46 +2499,6 @@ export const migrateCloudAi = async (): Promise<void> => {
     FOR EACH ROW EXECUTE FUNCTION ai.live_project_group_membership_changed()
   `.simple();
 
-  // Provider API keys used to live inside the ai.model_profiles_json setting.
-  // A JSON setting is delivered to the admin UI in full, so every key rode
-  // along in the page payload; a per-profile row keeps them server-side and
-  // lets a deployment hold as many as it has profiles.
-  await sql`
-    CREATE TABLE IF NOT EXISTS ai.model_credentials (
-      profile_id TEXT PRIMARY KEY,
-      secret TEXT NOT NULL,
-      created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
-      updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
-    )
-  `.simple();
-
-  await sql`
-    CREATE TABLE IF NOT EXISTS ai.model_request_headers (
-      profile_id TEXT PRIMARY KEY,
-      secret TEXT NOT NULL,
-      created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
-      updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
-    )
-  `.simple();
-
-  // One-time move of keys that were stored inside the profiles setting. Once
-  // the blob holds no apiKey the split yields nothing and this is a no-op, so
-  // it is safe to re-run. Dynamic imports keep the module free of store deps.
-  {
-    const { coreSettings } = await import("../services");
-    const { setAiCredential, splitAiProfileCredentials } = await import("./credentials");
-    const profiles = await coreSettings.read<string>("ai.model_profiles_json");
-    if (profiles.stored === "unreadable") {
-      console.warn('[ai] cannot read setting "ai.model_profiles_json"; skipping credential split');
-    }
-    const split = profiles.stored === "unreadable" ? null : splitAiProfileCredentials(profiles.value ?? "[]");
-    if (split && split.credentials.length > 0) {
-      for (const { profileId, secret } of split.credentials) await setAiCredential(profileId, secret);
-      await coreSettings.set("ai.model_profiles_json", split.profilesJson);
-      console.log(`  ✓ moved ${split.credentials.length} AI provider key(s) out of ai.model_profiles_json`);
-    }
-  }
-
   await sql`ALTER TABLE ai.structured_runs
     ADD COLUMN IF NOT EXISTS user_id UUID REFERENCES auth.users(id) ON DELETE SET NULL,
     ADD COLUMN IF NOT EXISTS conversation_id UUID REFERENCES ai.conversations(id) ON DELETE SET NULL,
@@ -2609,6 +2571,7 @@ export const migrateCloudAi = async (): Promise<void> => {
 
   await migrateAiModelAccess();
   await migrateAiQuotas();
+  await migrateAiModelClasses();
 
   await sql`CREATE OR REPLACE FUNCTION ai.sidebar_tool_label(blocks jsonb) RETURNS jsonb AS $$
     SELECT jsonb_build_object('label', left(COALESCE(block->'presentation'->>'title', block->>'name'),200), 'status', block->>'status')
@@ -2733,3 +2696,73 @@ const backfillApprovalRequests = async (): Promise<void> => {
     if (!count) return;
   }
 };
+
+/** Breaking cut: configuration is deliberately discarded once; history stays intact. */
+export const migrateAiModelClasses = async (): Promise<void> => {
+  await sql.begin(migrateAiModelClassesInTransaction);
+};
+
+export const migrateAiModelClassesInTransaction = async (db: typeof sql): Promise<void> => {
+  await db`SELECT pg_advisory_xact_lock(hashtext('ai.model-classes-v9'))`;
+  const [state] = await db<{ exists: boolean }[]>`SELECT to_regclass('ai.providers') IS NOT NULL AS exists`;
+  if (!state?.exists) {
+    await db`DELETE FROM auth.access WHERE id IN (SELECT access_id FROM ai.model_access)`;
+    await db`DELETE FROM ai.model_access_resources`;
+    await db`DO $$ BEGIN
+        IF EXISTS (SELECT 1 FROM information_schema.columns WHERE table_schema='ai' AND table_name='model_access_resources' AND column_name='profile_id') THEN
+          ALTER TABLE ai.model_access_resources RENAME COLUMN profile_id TO model_id;
+          ALTER TABLE ai.model_access RENAME COLUMN profile_id TO model_id;
+        END IF;
+      END $$`;
+    await db`UPDATE ai.cost_config SET rules = COALESCE((SELECT jsonb_agg(rule) FROM jsonb_array_elements(rules) rule WHERE rule->>'scope' = '*'), '[]'::jsonb), revision = revision + 1`;
+    await db`DELETE FROM settings.entries WHERE key IN ('ai.model_profiles_json','ai.model_profiles','ai.default_model_id','ai.background_model_id','ai.workflow_model_id','ai.vision_model_id','ai.audio_model_id')`;
+    await db`DROP TABLE IF EXISTS ai.model_credentials`;
+    await db`DROP TABLE IF EXISTS ai.model_request_headers`;
+    await db`ALTER TABLE ai.projects DROP COLUMN IF EXISTS default_model_profile_id`;
+    await db`ALTER TABLE ai.user_prefs DROP COLUMN IF EXISTS last_model_id`;
+  }
+  await db`ALTER TABLE ai.projects ADD COLUMN IF NOT EXISTS default_model JSONB`;
+  await db`ALTER TABLE ai.user_prefs ADD COLUMN IF NOT EXISTS model_choice JSONB`;
+  await db`ALTER TABLE settings.entries ADD COLUMN IF NOT EXISTS updated_by UUID REFERENCES auth.users(id) ON DELETE SET NULL`;
+  await db`CREATE TABLE IF NOT EXISTS ai.model_change_notices (
+      id UUID PRIMARY KEY DEFAULT gen_random_uuid(),user_id UUID NOT NULL REFERENCES auth.users(id) ON DELETE CASCADE,
+      name TEXT NOT NULL,retargeted BOOLEAN NOT NULL,created_at TIMESTAMPTZ NOT NULL DEFAULT now()
+    )`;
+  await db`CREATE TABLE IF NOT EXISTS ai.providers (
+      id TEXT PRIMARY KEY, type TEXT NOT NULL, label TEXT NOT NULL, base_url TEXT, data_boundary TEXT NOT NULL CHECK(data_boundary IN ('hosted','private')),
+      enabled BOOLEAN NOT NULL DEFAULT true, logo TEXT, status TEXT NOT NULL DEFAULT 'unknown' CHECK(status IN ('unknown','ok','unreachable','key_rejected','error')),
+      status_code TEXT, status_message TEXT, status_checked_at TIMESTAMPTZ,
+      revision INTEGER NOT NULL DEFAULT 1, created_at TIMESTAMPTZ NOT NULL DEFAULT now(), updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      updated_by UUID REFERENCES auth.users(id) ON DELETE SET NULL
+    )`;
+  await db`CREATE TABLE IF NOT EXISTS ai.provider_credentials (
+      provider_id TEXT PRIMARY KEY REFERENCES ai.providers(id) ON DELETE CASCADE, secret TEXT NOT NULL, updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+    )`;
+  await db`CREATE TABLE IF NOT EXISTS ai.provider_request_headers (
+      provider_id TEXT PRIMARY KEY REFERENCES ai.providers(id) ON DELETE CASCADE, secret TEXT NOT NULL, updated_at TIMESTAMPTZ NOT NULL DEFAULT now()
+    )`;
+  await db`CREATE TABLE IF NOT EXISTS ai.models (
+      id TEXT PRIMARY KEY, provider_id TEXT NOT NULL REFERENCES ai.providers(id) ON DELETE CASCADE, provider_model TEXT NOT NULL,
+      label TEXT NOT NULL, description TEXT NOT NULL DEFAULT '', kind TEXT NOT NULL CHECK(kind IN ('chat','transcription')),
+      capabilities JSONB NOT NULL DEFAULT '[]', context_window INTEGER, max_output_tokens INTEGER, temperature DOUBLE PRECISION, extra_body JSONB,
+      max_loaded_tools INTEGER, max_tool_rounds INTEGER, pricing JSONB, icon JSONB NOT NULL DEFAULT '{"kind":"provider"}', enabled BOOLEAN NOT NULL DEFAULT true,
+      revision INTEGER NOT NULL DEFAULT 1, created_at TIMESTAMPTZ NOT NULL DEFAULT now(), updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      updated_by UUID REFERENCES auth.users(id) ON DELETE SET NULL
+    )`;
+  await db`CREATE TABLE IF NOT EXISTS ai.model_variants (
+      id TEXT PRIMARY KEY, model_id TEXT NOT NULL REFERENCES ai.models(id) ON DELETE CASCADE, slug TEXT NOT NULL, label TEXT NOT NULL,
+      hint TEXT NOT NULL DEFAULT '', reasoning_effort TEXT, max_output_tokens INTEGER, pricing JSONB, extra_body JSONB,
+      show_in_picker BOOLEAN NOT NULL DEFAULT true, position INTEGER NOT NULL DEFAULT 0,
+      revision INTEGER NOT NULL DEFAULT 1, created_at TIMESTAMPTZ NOT NULL DEFAULT now(), updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+      updated_by UUID REFERENCES auth.users(id) ON DELETE SET NULL, UNIQUE(model_id,slug),
+      CHECK(id = CASE WHEN slug = 'standard' THEN model_id ELSE model_id || ':' || slug END)
+    )`;
+  await db`CREATE TABLE IF NOT EXISTS ai.model_assignments (
+      slot TEXT PRIMARY KEY CHECK(slot IN ('fast','balanced','thorough','maximum','vision','audio')),
+      variant_id TEXT REFERENCES ai.model_variants(id), revision INTEGER NOT NULL DEFAULT 1,
+      updated_at TIMESTAMPTZ NOT NULL DEFAULT now(), updated_by UUID REFERENCES auth.users(id) ON DELETE SET NULL
+    )`;
+  for (const slot of ["fast", "balanced", "thorough", "maximum", "vision", "audio"])
+    await db`INSERT INTO ai.model_assignments(slot) VALUES(${slot}) ON CONFLICT DO NOTHING`;
+  await db`ALTER TABLE ai.inference_calls ADD COLUMN IF NOT EXISTS requested_class TEXT, ADD COLUMN IF NOT EXISTS resolved_class TEXT, ADD COLUMN IF NOT EXISTS model_id TEXT`;
+};

package/src/ai/model-access-migrate.ts

@@ -1,30 +1,16 @@
 import { sql } from "bun";
-import { decryptValue } from "../services/settings/crypto";
-import { aiModelAccess } from "./model-access";
-import { parseAiModelProfiles } from "./settings";
 
 export const migrateAiModelAccess = async (): Promise<void> => {
   await sql.begin(async (tx) => {
     await tx`CREATE SEQUENCE IF NOT EXISTS ai.model_access_revision`;
     await tx`CREATE TABLE IF NOT EXISTS ai.model_access_resources (
-      profile_id TEXT PRIMARY KEY,
+      model_id TEXT PRIMARY KEY,
       revision BIGINT NOT NULL DEFAULT nextval('ai.model_access_revision')
     )`;
     await tx`CREATE TABLE IF NOT EXISTS ai.model_access (
-      profile_id TEXT NOT NULL REFERENCES ai.model_access_resources(profile_id) ON DELETE CASCADE,
+      model_id TEXT NOT NULL REFERENCES ai.model_access_resources(model_id) ON DELETE CASCADE,
       access_id UUID NOT NULL REFERENCES auth.access(id) ON DELETE CASCADE,
-      PRIMARY KEY (profile_id, access_id), UNIQUE (access_id)
+      PRIMARY KEY (model_id, access_id), UNIQUE (access_id)
     )`;
-    // Read authoritative configuration, not a possibly stale Redis settings snapshot.
-    const [setting] = await tx<{ value: string }[]>`SELECT value FROM settings.entries WHERE key = 'ai.model_profiles_json' FOR UPDATE`;
-    const raw = setting ? await decryptValue(setting.value) : "[]";
-    if (typeof raw !== "string") throw new Error("Model profiles must be a JSON array string.");
-    const parsed = parseAiModelProfiles(raw);
-    if (parsed.error) throw new Error(parsed.error.message);
-    await aiModelAccess.syncProfiles(
-      parsed.profiles.map((profile) => profile.id),
-      [],
-      tx,
-    );
   });
 };

package/src/ai/model-access.ts

@@ -1,50 +1,15 @@
 import { sql } from "bun";
-import { z } from "zod";
-import { type AccessEntry, type Principal, PrincipalSchema, type ServiceAccountKind } from "../contracts/shared";
+import type { AccessEntry, Principal, ServiceAccountKind } from "../contracts/shared";
 import { type AccessSubject, buildAccessPrincipalCondition, createAccess } from "../server/services/access";
 import { toPgTextArray } from "../services/postgres";
+import type { AiModelAccessDraft } from "../shared/ai-models";
 import type { AiSettingsError } from "./types";
 
 export type AiModelAccessState = { entries: AccessEntry[]; revision: number };
 export type AiModelAccessMap = Record<string, AiModelAccessState>;
 
-const GrantSchema = z
-  .object({
-    principal: PrincipalSchema.refine((principal) => principal.type !== "public", "Assistant models cannot be public."),
-    permission: z.literal("read"),
-  })
-  .strict();
-export const AiModelAccessDraftSchema = z
-  .object({
-    expectedRevision: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).nullable(),
-    sourceProfileId: z
-      .string()
-      .trim()
-      .regex(/^[a-z0-9][a-z0-9._-]*$/)
-      .optional(),
-    entries: z.array(GrantSchema),
-  })
-  .strict();
-export type AiModelAccessDraft = z.infer<typeof AiModelAccessDraftSchema>;
-export type AiModelAccessChange = AiModelAccessDraft & { profileId: string };
-
-/** Transport-only draft fields never enter the provider setting. */
-export const splitAiModelAccess = (profilesJson: string): { profilesJson: string; changes: AiModelAccessChange[] } => {
-  const profiles = z.array(z.record(z.string(), z.unknown())).parse(JSON.parse(profilesJson));
-  const changes: AiModelAccessChange[] = [];
-  const stored = profiles.map(({ assistantAccess, ...profile }) => {
-    if (assistantAccess !== undefined) {
-      const profileId = z
-        .string()
-        .trim()
-        .regex(/^[a-z0-9][a-z0-9._-]*$/)
-        .parse(profile.id);
-      changes.push({ profileId, ...AiModelAccessDraftSchema.parse(assistantAccess) });
-    }
-    return profile;
-  });
-  return { profilesJson: JSON.stringify(stored), changes };
-};
+export { type AiModelAccessDraft, AiModelAccessDraftSchema } from "../shared/ai-models";
+export type AiModelAccessChange = AiModelAccessDraft & { modelId: string };
 
 export class AiModelAccessConflict extends Error {
   constructor() {
@@ -61,14 +26,14 @@ const principalKey = (principal: Principal): string => {
   return principal.type;
 };
 
-const grant = async (profileId: string, principal: Principal, db: typeof sql): Promise<void> => {
+const grant = async (modelId: string, principal: Principal, db: typeof sql): Promise<void> => {
   const result = await createAccess({ principal, permission: "read" }, db);
   if (!result.ok) throw new AiModelAccessInvalid(result.error.message);
-  await db`INSERT INTO ai.model_access (profile_id, access_id) VALUES (${profileId}, ${result.data.id}::uuid)`;
+  await db`INSERT INTO ai.model_access (model_id, access_id) VALUES (${modelId}, ${result.data.id}::uuid)`;
 };
 
-const allowedProfileIds = async (profileIds: string[], subject: AccessSubject | null): Promise<Set<string>> => {
-  if (!subject || profileIds.length === 0) return new Set();
+const allowedModelIds = async (modelIds: string[], subject: AccessSubject | null): Promise<Set<string>> => {
+  if (!subject || modelIds.length === 0) return new Set();
   const match = buildAccessPrincipalCondition({
     subject,
     columns: {
@@ -78,34 +43,34 @@ const allowedProfileIds = async (profileIds: string[], subject: AccessSubject |
       authenticatedOnly: sql`access.authenticated_only`,
     },
   });
-  const rows = await sql<{ profile_id: string }[]>`
-    SELECT DISTINCT model.profile_id FROM ai.model_access model JOIN auth.access access ON access.id = model.access_id
-    WHERE model.profile_id = ANY(${toPgTextArray(profileIds)}::text[])
+  const rows = await sql<{ model_id: string }[]>`
+    SELECT DISTINCT model.model_id FROM ai.model_access model JOIN auth.access access ON access.id = model.access_id
+    WHERE model.model_id = ANY(${toPgTextArray(modelIds)}::text[])
       AND access.permission IN ('read', 'write', 'admin') AND ${match}
   `;
-  return new Set(rows.map((row) => row.profile_id));
+  return new Set(rows.map((row) => row.model_id));
 };
 
 /** Assistant chat authorization only. Global/background model resolution does not call this service. */
 export const aiModelAccess = {
-  filterModels: async <T extends { id: string }>(models: T[], subject: AccessSubject | null): Promise<T[]> => {
-    const allowed = await allowedProfileIds(
-      models.map((model) => model.id),
+  filterModels: async <T extends { id: string; modelId: string }>(models: T[], subject: AccessSubject | null): Promise<T[]> => {
+    const allowed = await allowedModelIds(
+      models.map((model) => model.modelId),
       subject,
     );
-    return models.filter((model) => allowed.has(model.id));
+    return models.filter((model) => allowed.has(model.modelId));
   },
-  assertAllowed: async (profileId: string, subject: AccessSubject | null): Promise<void> => {
-    if ((await allowedProfileIds([profileId], subject)).has(profileId)) return;
+  assertAllowed: async (modelId: string, subject: AccessSubject | null): Promise<void> => {
+    if ((await allowedModelIds([modelId], subject)).has(modelId)) return;
     const message = "You do not have permission to use this model in Assistant. Choose another model.";
     throw Object.assign(new Error(message), {
-      aiError: { code: "model_access_denied", message, fields: { modelProfileId: message } } satisfies AiSettingsError,
+      aiError: { code: "model_policy_mismatch", message, fields: { model: message } } satisfies AiSettingsError,
     });
   },
-  listForAdmin: async (): Promise<AiModelAccessMap> => {
-    const rows = await sql<
+  listForAdmin: async (db = sql): Promise<AiModelAccessMap> => {
+    const rows = await db<
       {
-        profile_id: string;
+        model_id: string;
         revision: number | string;
         id: string | null;
         created_at: Date | null;
@@ -118,21 +83,21 @@ export const aiModelAccess = {
         service_account_kind: ServiceAccountKind | null;
       }[]
     >`
-      SELECT resource.profile_id, resource.revision, access.id, access.created_at,
+      SELECT resource.model_id, resource.revision, access.id, access.created_at,
         access.user_id, access.group_id, access.service_account_id, access.authenticated_only,
         COALESCE(NULLIF(users.display_name, ''), users.uid, groups.name, service_accounts.name) AS display_name,
         users.avatar_hash, service_accounts.kind AS service_account_kind
-      FROM ai.model_access_resources resource LEFT JOIN ai.model_access model ON model.profile_id = resource.profile_id
+      FROM ai.model_access_resources resource LEFT JOIN ai.model_access model ON model.model_id = resource.model_id
       LEFT JOIN auth.access access ON access.id = model.access_id
       LEFT JOIN auth.users users ON users.id = access.user_id
       LEFT JOIN auth.groups groups ON groups.id = access.group_id
       LEFT JOIN auth.service_accounts service_accounts ON service_accounts.id = access.service_account_id
-      ORDER BY resource.profile_id, access.created_at, access.id
+      ORDER BY resource.model_id, access.created_at, access.id
     `;
     const result = new Map<string, AiModelAccessState>();
     for (const row of rows) {
-      const state = result.get(row.profile_id) ?? { entries: [], revision: Number(row.revision) };
-      result.set(row.profile_id, state);
+      const state = result.get(row.model_id) ?? { entries: [], revision: Number(row.revision) };
+      result.set(row.model_id, state);
       if (!row.id || !row.created_at) continue;
       const principal: Principal = row.user_id
         ? { type: "user", userId: row.user_id }
@@ -156,41 +121,35 @@ export const aiModelAccess = {
     return Object.fromEntries(result);
   },
 
-  /** Called in the settings transaction. Existing grants survive edits that omit the ACL draft. */
-  syncProfiles: async (profileIds: readonly string[], changes: readonly AiModelAccessChange[], db: typeof sql): Promise<void> => {
-    // Serialize lifecycle changes (including a previously absent profile) with saves and migration seeding.
+  /** Called in the catalog transaction. Existing grants survive edits that omit the ACL draft. */
+  syncModels: async (modelIds: readonly string[], changes: readonly AiModelAccessChange[], db: typeof sql): Promise<void> => {
+    // Serialize lifecycle changes (including a previously absent model) with catalog saves.
     await db`LOCK TABLE ai.model_access_resources IN SHARE ROW EXCLUSIVE MODE`;
-    const current = await db<
-      { profile_id: string; revision: number | string }[]
-    >`SELECT profile_id, revision FROM ai.model_access_resources`;
-    const revisions = new Map(current.map((row) => [row.profile_id, Number(row.revision)]));
-    const keep = new Set(profileIds);
+    const current = await db<{ model_id: string; revision: number | string }[]>`SELECT model_id, revision FROM ai.model_access_resources`;
+    const revisions = new Map(current.map((row) => [row.model_id, Number(row.revision)]));
+    const keep = new Set(modelIds);
     for (const change of changes) {
-      if (!keep.has(change.profileId)) throw new Error("Permissions reference an unknown model profile.");
-      const sourceId = change.sourceProfileId ?? change.profileId;
-      if ((revisions.get(sourceId) ?? null) !== change.expectedRevision) throw new AiModelAccessConflict();
-      if (change.sourceProfileId && change.sourceProfileId !== change.profileId && revisions.has(change.profileId)) {
-        throw new AiModelAccessConflict();
-      }
+      if (!keep.has(change.modelId)) throw new Error("Permissions reference an unknown model.");
+      if ((revisions.get(change.modelId) ?? null) !== change.expectedRevision) throw new AiModelAccessConflict();
     }
-    for (const profileId of keep) {
-      if (revisions.has(profileId)) continue;
-      await db`INSERT INTO ai.model_access_resources (profile_id) VALUES (${profileId})`;
-      await grant(profileId, { type: "authenticated" }, db);
+    for (const modelId of keep) {
+      if (revisions.has(modelId)) continue;
+      await db`INSERT INTO ai.model_access_resources (model_id) VALUES (${modelId})`;
+      await grant(modelId, { type: "authenticated" }, db);
     }
     for (const change of changes) {
-      await db`DELETE FROM auth.access WHERE id IN (SELECT access_id FROM ai.model_access WHERE profile_id = ${change.profileId})`;
+      await db`DELETE FROM auth.access WHERE id IN (SELECT access_id FROM ai.model_access WHERE model_id = ${change.modelId})`;
       const seen = new Set<string>();
       for (const entry of change.entries) {
         const key = principalKey(entry.principal);
         if (seen.has(key)) continue;
         seen.add(key);
-        await grant(change.profileId, entry.principal, db);
+        await grant(change.modelId, entry.principal, db);
       }
-      await db`UPDATE ai.model_access_resources SET revision = nextval('ai.model_access_revision') WHERE profile_id = ${change.profileId}`;
+      await db`UPDATE ai.model_access_resources SET revision = nextval('ai.model_access_revision') WHERE model_id = ${change.modelId}`;
     }
     const ids = toPgTextArray([...keep]);
-    await db`DELETE FROM auth.access WHERE id IN (SELECT access_id FROM ai.model_access WHERE profile_id <> ALL(${ids}::text[]))`;
-    await db`DELETE FROM ai.model_access_resources WHERE profile_id <> ALL(${ids}::text[])`;
+    await db`DELETE FROM auth.access WHERE id IN (SELECT access_id FROM ai.model_access WHERE model_id <> ALL(${ids}::text[]))`;
+    await db`DELETE FROM ai.model_access_resources WHERE model_id <> ALL(${ids}::text[])`;
   },
 };

package/src/ai/model-card.tsx

@@ -0,0 +1,134 @@
+import { ChoiceSlider, IconButton, useLocale } from "@k2b/ui";
+import { createSignal, type JSX, Show } from "solid-js";
+import { AI_MODEL_CLASSES, type AiModelClass, type AiPeopleModelIcon } from "../shared/ai-models";
+import { aiModelChooserMessages } from "./model-chooser-messages";
+import { AiModelIcon } from "./model-icon";
+
+export type AiModelCardStop = {
+  class: AiModelClass;
+  /** The model behind the class, as people see it: short name and icon. */
+  name: string;
+  icon: AiPeopleModelIcon;
+  /** Why the class cannot be chosen now; replaces the subtitle in the line. */
+  unavailable?: string;
+};
+
+const asClass = (value: string | null): AiModelClass | null => AI_MODEL_CLASSES.find((modelClass) => modelClass === value) ?? null;
+
+export const aiModelClassLabel = (locale: string, modelClass: AiModelClass): string =>
+  aiModelChooserMessages.resolve([locale]).t[`class_${modelClass}`];
+export const aiModelClassSubtitle = (locale: string, modelClass: AiModelClass): string =>
+  aiModelChooserMessages.resolve([locale]).t[`classSub_${modelClass}`];
+
+/**
+ * The model card: the class in accent colour, the model behind it, one fixed line that always says what the class
+ * is for, and the slider over the assigned classes. Off the classes it shows "Own choice" with the model's name.
+ * The preview in the AI area renders the same card without interaction.
+ */
+export function AiModelCard(props: {
+  stops: readonly AiModelCardStop[];
+  /** The chosen class, or `null` for a model outside the classes. */
+  value: AiModelClass | null;
+  /** The model shown off the classes: "Name · Variant", its icon and its subtitle. */
+  own?: { name: string; icon: AiPeopleModelIcon; description: string };
+  /** A problem with the current model, such as a used-up budget; shown in warning colour. */
+  issue?: string;
+  /** Replaces the subtitle when the chosen class is empty and another one answers. */
+  note?: string;
+  onChoose?: (modelClass: AiModelClass) => void;
+  onOpenList?: () => void;
+  disabled?: boolean;
+  /** A static preview: same layout, no controls. */
+  preview?: boolean;
+  size?: "md" | "lg";
+  /** The slider's id, so the opener can move focus to it. */
+  sliderId?: string;
+}): JSX.Element {
+  const locale = useLocale();
+  const t = () => aiModelChooserMessages.resolve([locale()]).t;
+  const [active, setActive] = createSignal<AiModelClass | null>(null);
+  const shownClass = () => active() ?? props.value;
+  const stop = () => props.stops.find((entry) => entry.class === shownClass());
+  const level = () => (shownClass() ? aiModelClassLabel(locale(), shownClass()!) : t().ownChoice);
+  const name = () => stop()?.name ?? props.own?.name ?? "";
+  const icon = () => stop()?.icon ?? props.own?.icon;
+  const warn = () => Boolean(props.issue) && active() === null;
+  const options = () =>
+    props.stops.map((entry) => ({
+      value: entry.class,
+      label: aiModelClassLabel(locale(), entry.class),
+      description:
+        entry.class === props.value && props.note && active() === null ? props.note : aiModelClassSubtitle(locale(), entry.class),
+      disabledReason: entry.unavailable,
+      valueText: [
+        aiModelClassLabel(locale(), entry.class),
+        entry.name,
+        entry.unavailable ?? aiModelClassSubtitle(locale(), entry.class),
+      ].join(", "),
+    }));
+  const atDefault = () => props.value === "balanced" || !props.stops.some((entry) => entry.class === "balanced");
+  return (
+    <div class="grid gap-0.5" data-ai-model-card={props.preview ? "preview" : ""} aria-hidden={props.preview ? "true" : undefined}>
+      <div class="grid grid-cols-[2rem_minmax(0,1fr)_2rem] items-center">
+        <i class="ti ti-gauge grid place-items-center text-(--k2b-text-muted)" aria-hidden="true" />
+        <span
+          class="truncate text-center text-[1.0625rem] leading-snug font-semibold tracking-tight"
+          classList={{ "text-(--k2b-action)": !warn(), "text-(--k2b-warning-text)": warn() }}
+        >
+          {level()}
+        </span>
+        <span class="grid place-items-center" classList={{ invisible: atDefault() || props.preview || props.disabled }}>
+          <IconButton
+            type="button"
+            variant="ghost"
+            size="sm"
+            label={t().resetTo}
+            tabIndex={atDefault() || props.preview ? -1 : undefined}
+            onClick={() => props.onChoose?.("balanced")}
+          >
+            <i class="ti ti-arrow-back-up" aria-hidden="true" />
+          </IconButton>
+        </span>
+      </div>
+      <div class="flex justify-center">
+        <Show
+          when={props.onOpenList && !props.preview}
+          fallback={
+            <span class="inline-flex max-w-full items-center gap-1.5 px-1.5 py-0.5 text-sm text-(--k2b-text-secondary)">
+              <Show when={icon()}>{(current) => <AiModelIcon icon={current()} size="xs" />}</Show>
+              <span class="truncate">{name()}</span>
+            </span>
+          }
+        >
+          <button
+            type="button"
+            class="inline-flex max-w-full items-center gap-1.5 rounded-md px-1.5 py-0.5 text-sm text-(--k2b-text-secondary) hover:bg-(--k2b-surface-muted) hover:text-(--k2b-text) focus-visible:outline-2 focus-visible:outline-(--k2b-focus-ring)"
+            aria-label={`${t().allModels}: ${name()}`}
+            disabled={props.disabled}
+            onClick={() => props.onOpenList?.()}
+          >
+            <Show when={icon()}>{(current) => <AiModelIcon icon={current()} size="xs" />}</Show>
+            <span class="truncate">{name()}</span>
+            <i class="ti ti-chevron-right text-xs" aria-hidden="true" />
+          </button>
+        </Show>
+      </div>
+      <div>
+        <ChoiceSlider
+          id={props.sliderId}
+          aria-label={t().sliderAria}
+          options={options()}
+          value={() => props.value}
+          description={props.issue ?? props.own?.description}
+          disabled={props.disabled || props.preview}
+          size={props.size}
+          onActiveChange={(value) => setActive(asClass(value))}
+          onValueChange={(value) => {
+            const modelClass = asClass(value);
+            if (modelClass) props.onChoose?.(modelClass);
+          }}
+        />
+      </div>
+    </div>
+  );
+}