@k2b/cloud 0.43.0 → 0.44.0

package/src/browser/cloud-id.ts

@@ -0,0 +1,86 @@
+import { i18n } from "@k2b/stdlib";
+import { type DropdownItem, toast, useLocale } from "@k2b/ui";
+import { createMemo, onMount } from "solid-js";
+import type { CloudResourceRef } from "../contracts/capabilities";
+import { cloudResourceHref } from "../contracts/resource-href";
+import { cloudOrigin } from "./resource-links";
+
+export const cloudIdMessages = i18n.define({
+  baseLocale: "en",
+  messages: {
+    en: {
+      copy: "Copy Cloud ID",
+      copied: "Cloud ID copied",
+      copyFailed: "Could not copy the Cloud ID",
+    },
+    de: {
+      copy: "Cloud-ID kopieren",
+      copied: "Cloud-ID kopiert",
+      copyFailed: "Cloud-ID konnte nicht kopiert werden",
+    },
+  },
+});
+
+type ClipboardModule = typeof import("./resource-clipboard");
+// The clipboard contract validates with Zod, which stays out of an island's first load. It loads once the page is
+// idle, so a copy usually writes the structured reference inside the click that asked for it.
+let clipboardModule: ClipboardModule | undefined;
+const loadClipboard = () => import("./resource-clipboard").then((module) => (clipboardModule = module));
+
+/** One entry of the menu; `label` names the resource when a menu offers several, such as a message and its conversation. */
+export type CloudIdTarget = { ref: CloudResourceRef; label?: string };
+
+/**
+ * "Copy Cloud ID" for the "…" menu of a resource. It copies the structured reference and its `/open` permalink as
+ * text: Cloud paste surfaces recognize the resource, and anywhere else the text opens it after sign-in. Without a
+ * configured Cloud URL the menu shows nothing.
+ */
+export const useCloudIdCopy = () => {
+  const locale = useLocale();
+  const t = createMemo(() => cloudIdMessages.resolve([locale()]).t);
+  onMount(() => {
+    if (clipboardModule || !cloudOrigin()) return;
+    const warm = () => void loadClipboard().catch(() => undefined);
+    if (typeof requestIdleCallback === "function") requestIdleCallback(warm, { timeout: 2000 });
+    else setTimeout(warm, 0);
+  });
+
+  const copy = (ref: CloudResourceRef) => {
+    const cloudUrl = cloudOrigin();
+    if (!cloudUrl) return;
+    const failed = () => void toast.error(t().copyFailed);
+    const write = (module: ClipboardModule) => {
+      try {
+        const { cloudResourceClipboard } = module;
+        return cloudResourceClipboard
+          .write({ cloudUrl, ref, fallbackText: cloudResourceClipboard.url(ref, cloudUrl) })
+          .then(() => void toast.success(t().copied), failed);
+      } catch {
+        failed();
+      }
+    };
+    if (clipboardModule) return void write(clipboardModule);
+    // Before the clipboard code loads, copy the permalink alone: WebKit allows a write only while the click is handled.
+    try {
+      void navigator.clipboard.writeText(new URL(cloudResourceHref(ref), cloudUrl).href).then(() => void toast.success(t().copied), failed);
+    } catch {
+      failed();
+    }
+    void loadClipboard().catch(() => undefined);
+  };
+
+  return {
+    available: () => Boolean(cloudOrigin()),
+    copy,
+    /** The last section of a resource's "…" menu; empty without a resource or a configured Cloud URL. */
+    section: (...targets: readonly (CloudResourceRef | CloudIdTarget | null | undefined | false)[]): DropdownItem[] => {
+      if (!cloudOrigin()) return [];
+      const items = targets.flatMap((target) => {
+        if (!target) return [];
+        const { ref, label } = "ref" in target ? target : { ref: target, label: undefined };
+        return [{ label: label ?? t().copy, icon: "ti ti-id", immediate: true, action: () => copy(ref) }];
+      });
+      return items.length > 0 ? [{ items }] : [];
+    },
+  };
+};

package/src/browser/resource-clipboard.ts

@@ -3,7 +3,9 @@ import {
   CLOUD_RESOURCE_CLIPBOARD_MAX_BYTES,
   CLOUD_RESOURCE_CLIPBOARD_MIME_TYPE,
   CLOUD_RESOURCE_CLIPBOARD_WEB_FORMAT,
+  formatCloudResourceUrl,
   parseCloudResourceClipboard,
+  parseCloudResourceUrl,
   serializeCloudResourceClipboard,
 } from "../contracts/resource-clipboard";
 
@@ -65,6 +67,8 @@ export const cloudResourceClipboard = {
   webFormat: CLOUD_RESOURCE_CLIPBOARD_WEB_FORMAT,
   parse: parseCloudResourceClipboard,
   serialize: serializeCloudResourceClipboard,
+  url: formatCloudResourceUrl,
+  parseUrl: parseCloudResourceUrl,
   write: writeCloudResourceClipboard,
   read: readCloudResourceClipboard,
 } as const;

package/src/browser/resource-links.ts

@@ -0,0 +1,52 @@
+import type { CoreApiType } from "../api";
+import { localCloudResourceUrl } from "../contracts/resource-pages";
+import type { ResolvedCloudResourceUrl } from "../contracts/resource-resolution";
+import { createApiClient } from "../server/api-client";
+import { readShellData } from "../ssr/shell-data";
+
+export type { ResolvedCloudResourceUrl } from "../contracts/resource-resolution";
+
+/** Available on Layout and AdminLayout pages; MinimalLayout does not install shell data. */
+export const cloudOrigin = (): string | null => readShellData()?.cloudOrigin ?? null;
+
+/** Recognize one pasted Cloud link. Unsupported, unreadable, and unavailable links all return null. */
+export const resolveCloudUrl = async (text: string, options: { signal?: AbortSignal } = {}): Promise<ResolvedCloudResourceUrl | null> => {
+  const url = text.trim();
+  if (!localCloudResourceUrl(url, cloudOrigin())) return null;
+  try {
+    const response = await createApiClient<CoreApiType>().resources.resolve.$post({ json: { url } }, { init: { signal: options.signal } });
+    if (!response.ok) return null;
+    // Validate only after a successful response; Zod stays out of the initial browser graph.
+    const { ResolvedCloudResourceUrlSchema } = await import("../contracts/resource-resolution");
+    const result = ResolvedCloudResourceUrlSchema.safeParse(await response.json());
+    return result.success ? result.data : null;
+  } catch {
+    return null;
+  }
+};
+
+// Ctrl+Shift+V (Cmd+Shift+V, also with Option, which changes the key's character) asks for plain text; that paste
+// keeps the link as it is.
+let plainPasteAt = -Infinity;
+if (typeof window !== "undefined")
+  window.addEventListener(
+    "keydown",
+    (event) => {
+      if (event.shiftKey && (event.ctrlKey || event.metaKey) && (event.code === "KeyV" || event.key.toLowerCase() === "v"))
+        plainPasteAt = event.timeStamp;
+    },
+    true,
+  );
+
+/**
+ * The Cloud link a paste carries: one absolute URL on this Cloud, as copied from the address bar or "Copy Cloud ID",
+ * and nothing else. Returns null for other text, other origins, and a paste as plain text. Recognize the link with
+ * `resolveCloudUrl()`.
+ */
+export const pastedCloudLink = (event: ClipboardEvent): string | null => {
+  const plain = event.timeStamp - plainPasteAt < 1_000;
+  plainPasteAt = -Infinity;
+  const text = (event.clipboardData?.getData("text/plain") ?? "").trim();
+  if (plain || text.startsWith("/")) return null;
+  return localCloudResourceUrl(text, cloudOrigin()) ? text : null;
+};

package/src/capabilities/server-invoke.ts

@@ -1,6 +1,5 @@
 import { z } from "zod";
 import { dispatchCapability, loadCapabilityCatalogPage } from "../api/capabilities";
-import { env } from "../config/env";
 import {
   CAPABILITY_FRAMEWORK_ERROR_CODES,
   CAPABILITY_MAX_CATALOG_BYTES,
@@ -9,8 +8,7 @@ import {
   capabilityResultSchema,
 } from "../contracts/capabilities";
 import type { RequestAuthority } from "../server";
-import { get } from "../services/settings";
-import { publicCloudOrigin } from "../shared/app-url";
+import { coreOrigin } from "../services/identity/core-origin";
 import { capabilityMessages } from "../shared/capability-messages";
 import { LOCALE_HEADER } from "../shared/locale";
 import { readCapabilityResponse } from "./response";
@@ -41,14 +39,7 @@ export type CapabilityCaller = {
   mandate?: { id: string; revision: number; callingAppId: string };
 };
 
-export const coreOrigin = async (internal = false): Promise<string> => {
-  const configured = env.CLOUD_CORE_INTERNAL_ORIGIN;
-  if (internal && !configured) throw new Error("CLOUD_CORE_INTERNAL_ORIGIN is required for mandate-backed invocation");
-  const origin = configured || publicCloudOrigin(await get<string>("app.url"));
-  const url = new URL(origin);
-  if (url.protocol !== "http:" && url.protocol !== "https:") throw new Error("CLOUD_CORE_INTERNAL_ORIGIN must use http or https");
-  return url.origin;
-};
+export { coreOrigin } from "../services/identity/core-origin";
 
 export const callerRequest = async (
   caller: CapabilityCaller,

package/src/capabilities/testing.ts

@@ -17,8 +17,11 @@ import {
 } from "../contracts/capabilities";
 
 /** Compile and validate the public manifest an app would register at startup. */
-export const compileCapabilityManifest = (appId: string, definitions: CapabilityDefinitions): CapabilityManifest =>
-  compileCapabilities(appId, definitions).manifest;
+export const compileCapabilityManifest = (
+  appId: string,
+  definitions: CapabilityDefinitions,
+  routes?: readonly string[],
+): CapabilityManifest => compileCapabilities(appId, definitions, routes).manifest;
 
 /** Fail a provider compatibility test when a published local id changed incompatibly. */
 export const assertCapabilityManifestEvolution = (previous: CapabilityManifest, next: CapabilityManifest): void => {

package/src/cli/access.ts

@@ -49,6 +49,7 @@ export type AccessCommandAdapter<TResource extends AccessResource> = {
   scopes?: readonly [string, ...string[]];
   allowPublic?: boolean;
   allowAuthenticated?: boolean;
+  /** Defaults to true; false preserves an explicitly restricted resource contract. */
   allowServiceAccounts?: boolean;
   examples?: {
     list?: readonly string[];
@@ -217,7 +218,7 @@ export const resolveAccessPrincipal = async (
       "--group",
       ...(options.allowAuthenticated === false ? [] : ["--authenticated"]),
       ...(options.allowPublic === true ? ["--public"] : []),
-      ...(options.allowServiceAccounts === true ? ["--service-account"] : []),
+      ...(options.allowServiceAccounts !== false ? ["--service-account"] : []),
     ];
     throw new Error(`Pass exactly one principal flag: ${allowedFlags.join(", ")}.`);
   }
@@ -225,8 +226,8 @@ export const resolveAccessPrincipal = async (
   if (flags.authenticated && options.allowAuthenticated === false) {
     throw new Error("This resource does not allow authenticated-audience grants.");
   }
-  if (flags.serviceAccount && options.allowServiceAccounts !== true) {
-    throw new Error("Service-account grants are hidden by default. Enable allowServiceAccounts for this access command.");
+  if (flags.serviceAccount && options.allowServiceAccounts === false) {
+    throw new Error("This resource does not allow service-account access grants.");
   }
   if (flags.authenticated) return { type: "authenticated" };
   if (flags.public) return { type: "public" };
@@ -348,11 +349,11 @@ const accessIdFlag = {
 
 export const createAccessCommands = <TResource extends AccessResource>(adapter: AccessCommandAdapter<TResource>) => {
   const allowed = normalizeAllowedPermissions(adapter.allowedPermissions);
-  const searchableKinds = adapter.allowServiceAccounts ? PRINCIPAL_KINDS : (["user", "group"] as const);
+  const searchableKinds = adapter.allowServiceAccounts !== false ? PRINCIPAL_KINDS : (["user", "group"] as const);
   const principalFlagOptions = {
     includePublicFlag: adapter.allowPublic === true,
     includeAuthenticatedFlag: adapter.allowAuthenticated !== false,
-    includeServiceAccountFlag: adapter.allowServiceAccounts === true,
+    includeServiceAccountFlag: adapter.allowServiceAccounts !== false,
   };
   const resolve = (ctx: CloudCliContext, args: string[]) => adapter.resolveResource(ctx, args);
   const scopeFlag: { scope?: ReturnType<typeof flag.string> } = adapter.scopes

package/src/cli/admin/ai-models.ts

@@ -0,0 +1,199 @@
+import { z } from "zod";
+import {
+  AI_MODEL_SLOTS,
+  AiDeleteModelSchema,
+  AiModelAccessDraftSchema,
+  AiModelInputSchema,
+  AiModelPatchSchema,
+  AiProviderInputSchema,
+  AiProviderPatchSchema,
+  AiVariantInputSchema,
+  AiVariantPatchSchema,
+} from "../../shared/ai-models";
+import { arg, type CloudCliContext, command, confirmFlag, flag, printStructured, readCliInput } from "../index";
+import { apiGet, apiJson, readJsonInput } from "./shared";
+
+const base = "/api/admin/core/ai";
+const print = (ctx: CloudCliContext, result: unknown) => {
+  if (!printStructured(ctx, result)) ctx.print(JSON.stringify(result, null, 2));
+};
+const confirm = (yes: boolean) => {
+  if (!yes) throw new Error("AI configuration changes require --yes.");
+};
+const id = { id: arg.required({ valueLabel: "id" }) };
+const input = flag.input({ required: true, description: "JSON input: --input, --input-file or --stdin" });
+const yes = confirmFlag("Confirm AI configuration change");
+const endpoint = (area: string, id: string) => `${base}/${area}/${encodeURIComponent(id)}`;
+export const aiModelCommands = [
+  command("ai providers list", {
+    summary: "List provider connections and their status",
+    async run({ ctx }) {
+      print(ctx, await apiGet(ctx, `${base}/providers`));
+    },
+  }),
+  command("ai providers show", {
+    summary: "Show a provider; credential and header values stay private",
+    args: id,
+    async run({ ctx, args }) {
+      print(ctx, await apiGet(ctx, endpoint("providers", args.id)));
+    },
+  }),
+  command("ai providers add", {
+    summary: "Create a provider connection",
+    flags: { input, yes },
+    async run({ ctx, flags }) {
+      confirm(flags.yes);
+      print(
+        ctx,
+        await apiJson(ctx, "POST", `${base}/providers`, AiProviderInputSchema.parse(await readJsonInput<unknown>(flags.input, "provider"))),
+      );
+    },
+  }),
+  command("ai providers update", {
+    summary: "Update a provider with optimistic concurrency",
+    args: id,
+    flags: { input, yes },
+    async run({ ctx, args, flags }) {
+      confirm(flags.yes);
+      const patch = AiProviderPatchSchema.parse(await readJsonInput<unknown>(flags.input, "provider patch"));
+      const current = await apiGet<{ revision: number }>(ctx, endpoint("providers", args.id));
+      print(ctx, await apiJson(ctx, "PATCH", endpoint("providers", args.id), { ...patch, revision: current.revision }));
+    },
+  }),
+  command("ai providers test", {
+    summary: "Test a saved provider connection (10 second timeout)",
+    args: id,
+    async run({ ctx, args }) {
+      print(ctx, await apiJson(ctx, "POST", `${endpoint("providers", args.id)}/test`, {}));
+    },
+  }),
+  command("ai providers key", {
+    summary: "Replace a provider key from protected input",
+    args: id,
+    flags: { key: flag.input({ required: true, description: "API key: use --key-file or --stdin" }), yes },
+    async run({ ctx, args, flags }) {
+      confirm(flags.yes);
+      const apiKey = await readCliInput(flags.key, { required: true, label: "API key" });
+      const current = await apiGet<{ revision: number }>(ctx, endpoint("providers", args.id));
+      print(
+        ctx,
+        await apiJson(ctx, "PUT", `${endpoint("providers", args.id)}/credential`, {
+          apiKey: apiKey?.trim() ?? "",
+          revision: current.revision,
+        }),
+      );
+    },
+  }),
+  command("ai providers models", {
+    summary: "List the models advertised by a provider",
+    args: id,
+    async run({ ctx, args }) {
+      print(ctx, await apiGet(ctx, `${endpoint("providers", args.id)}/available-models`));
+    },
+  }),
+  command("ai models list", {
+    summary: "List configured models",
+    async run({ ctx }) {
+      print(ctx, await apiGet(ctx, `${base}/models`));
+    },
+  }),
+  command("ai models show", {
+    summary: "Show a model, variants and access",
+    args: id,
+    async run({ ctx, args }) {
+      print(ctx, await apiGet(ctx, endpoint("models", args.id)));
+    },
+  }),
+  command("ai models add", {
+    summary: "Add a model to a provider",
+    args: { provider: arg.required() },
+    flags: { input, yes },
+    async run({ ctx, args, flags }) {
+      confirm(flags.yes);
+      const data = z
+        .union([AiModelInputSchema, z.array(AiModelInputSchema).min(1)])
+        .parse(await readJsonInput<unknown>(flags.input, "models"));
+      print(ctx, await apiJson(ctx, "POST", `${endpoint("providers", args.provider)}/models`, data));
+    },
+  }),
+  command("ai models update", {
+    summary: "Update one model and its shared prices",
+    args: id,
+    flags: { input, yes },
+    async run({ ctx, args, flags }) {
+      confirm(flags.yes);
+      const data = AiModelPatchSchema.extend({ access: AiModelAccessDraftSchema.optional() }).parse(
+        await readJsonInput<unknown>(flags.input, "model patch"),
+      );
+      const current = await apiGet<{ revision: number }>(ctx, endpoint("models", args.id));
+      print(ctx, await apiJson(ctx, "PATCH", endpoint("models", args.id), { ...data, revision: current.revision }));
+    },
+  }),
+  command("ai variants add", {
+    summary: "Create a named model variant",
+    args: { model: arg.required() },
+    flags: { input, yes },
+    async run({ ctx, args, flags }) {
+      confirm(flags.yes);
+      print(
+        ctx,
+        await apiJson(
+          ctx,
+          "POST",
+          `${endpoint("models", args.model)}/variants`,
+          AiVariantInputSchema.parse(await readJsonInput<unknown>(flags.input, "variant")),
+        ),
+      );
+    },
+  }),
+  command("ai variants update", {
+    summary: "Update a variant's overrides",
+    args: id,
+    flags: { input, yes },
+    async run({ ctx, args, flags }) {
+      confirm(flags.yes);
+      const data = AiVariantPatchSchema.parse(await readJsonInput<unknown>(flags.input, "variant patch"));
+      const current = await apiGet<{ variants: { id: string; revision: number }[] }>(ctx, endpoint("models", args.id.split(":")[0]!));
+      const variant = current.variants.find((v) => v.id === args.id);
+      if (!variant) throw new Error("Variant not found.");
+      print(ctx, await apiJson(ctx, "PATCH", endpoint("variants", args.id), { ...data, revision: variant.revision }));
+    },
+  }),
+  ...(["providers", "models", "variants"] as const).map((area) =>
+    command(`ai ${area} delete`, {
+      summary: "Delete with explicit assignment replacements and retargeting choice",
+      args: id,
+      flags: { input, yes },
+      async run({ ctx, args, flags }) {
+        confirm(flags.yes);
+        const data = AiDeleteModelSchema.parse(await readJsonInput<unknown>(flags.input, "delete consequences"));
+        print(ctx, await apiJson(ctx, "DELETE", endpoint(area, args.id), data));
+      },
+    }),
+  ),
+  command("ai classes show", {
+    summary: "Show class and tool assignments, fallback chains and recent callers",
+    async run({ ctx }) {
+      print(ctx, await apiGet(ctx, `${base}/assignments`));
+    },
+  }),
+  command("ai classes set", {
+    summary: "Assign a class or tool slot to a variant or none",
+    args: { slot: arg.required(), variant: arg.required() },
+    flags: { yes },
+    async run({ ctx, args, flags }) {
+      confirm(flags.yes);
+      const slot = z.enum(AI_MODEL_SLOTS).parse(args.slot);
+      const current = await apiGet<{ assignments: { slot: string; revision: number }[] }>(ctx, `${base}/assignments`);
+      const assignment = current.assignments.find((a) => a.slot === slot);
+      if (!assignment) throw new Error("Assignment missing.");
+      print(
+        ctx,
+        await apiJson(ctx, "PUT", `${base}/assignments/${slot}`, {
+          variantId: args.variant === "none" ? null : args.variant,
+          revision: assignment.revision,
+        }),
+      );
+    },
+  }),
+];

package/src/cli/admin/ai-quotas.ts

@@ -1,9 +1,5 @@
-import { type AiModelPricing, AiModelPricingSchema } from "../../shared/ai-costs";
-import {
-  type AiModelRequestSettings,
-  AiModelRequestSettingsSchema,
-  AiModelRequestSettingsUpdateSchema,
-} from "../../shared/ai-model-request-settings";
+import type { AiModelPricing } from "../../shared/ai-costs";
+
 import {
   type AiQuotaConfig,
   AiQuotaConfigSchema,
@@ -12,7 +8,7 @@ import {
   AiQuotaReportQuerySchema,
   AiQuotaResetSchema,
 } from "../../shared/ai-quotas";
-import { type CloudCliContext, cliText, command, confirmFlag, flag, printRows, printStructured, readCliInput } from "../index";
+import { type CloudCliContext, cliText, command, confirmFlag, flag, printRows, printStructured } from "../index";
 import { apiGet, apiJson, queryString, readJsonInput } from "./shared";
 
 const path = "/api/admin/core/ai-quotas";
@@ -28,98 +24,6 @@ const confirm = (ctx: CloudCliContext, yes: boolean) => {
 };
 
 export const aiQuotaCommands = [
-  command("ai models settings get", {
-    summary: "Read model thinking level, extra parameters and configured header names",
-    flags: { id: flag.string({ required: true, description: "Model profile ID" }) },
-    async run({ ctx, flags }) {
-      print(ctx, AiModelRequestSettingsSchema.parse(await apiGet(ctx, `${path}/models/${encodeURIComponent(flags.id!)}/settings`)));
-    },
-  }),
-  command("ai models settings set", {
-    summary: "Patch one model's request settings; header values are write-only",
-    flags: {
-      id: flag.string({ required: true, description: "Model profile ID" }),
-      thinkingLevel: flag.string({ name: "thinking-level", description: "Provider-specific thinking level" }),
-      clearThinkingLevel: flag.boolean({ name: "clear-thinking-level", description: "Use the model's default thinking level" }),
-      extraBody: flag.input({ name: "extra-body", description: "Extra parameters JSON: --extra-body, --extra-body-file or --stdin" }),
-      clearExtraBody: flag.boolean({ name: "clear-extra-body", description: "Remove extra parameters" }),
-      headers: flag.input({
-        stdinName: "headers-stdin",
-        description: "Header patch JSON; use --headers-file or --headers-stdin for secrets",
-      }),
-      clearHeaders: flag.boolean({ name: "clear-headers", description: "Remove all configured extra headers before applying the patch" }),
-      yes: confirmFlag("Confirm model request settings change"),
-    },
-    async run({ ctx, flags }) {
-      if (!flags.yes) throw new Error("Model request settings changes require --yes.");
-      if (flags.thinkingLevel !== undefined && flags.clearThinkingLevel)
-        throw new Error("Choose --thinking-level or --clear-thinking-level.");
-      if (flags.extraBody.provided && flags.clearExtraBody) throw new Error("Choose --extra-body or --clear-extra-body.");
-      if (
-        !flags.extraBody.provided &&
-        !flags.headers.provided &&
-        flags.thinkingLevel === undefined &&
-        !flags.clearThinkingLevel &&
-        !flags.clearExtraBody &&
-        !flags.clearHeaders
-      )
-        throw new Error("Select at least one model request setting to change.");
-      if (flags.extraBody.source === "stdin" && flags.headers.source === "stdin")
-        throw new Error("Read one JSON input from stdin and supply the other from a file.");
-      const parseInput = async (input: typeof flags.headers, label: string): Promise<unknown> => {
-        const raw = await readCliInput(input, { required: true, label });
-        try {
-          return JSON.parse(raw!);
-        } catch {
-          throw new Error(`Invalid ${label} JSON.`);
-        }
-      };
-      const patch: Record<string, unknown> = {};
-      if (flags.thinkingLevel !== undefined || flags.clearThinkingLevel)
-        patch.reasoningEffort = flags.clearThinkingLevel ? null : flags.thinkingLevel;
-      if (flags.extraBody.provided || flags.clearExtraBody)
-        patch.extraBody = flags.clearExtraBody ? null : await parseInput(flags.extraBody, "extra parameters");
-      if (flags.headers.provided) patch.requestHeaders = await parseInput(flags.headers, "extra headers");
-      if (flags.clearHeaders) patch.clearRequestHeaders = true;
-      // Validate locally before reading the current revision or sending secrets.
-      const valid = AiModelRequestSettingsUpdateSchema.parse({ ...patch, expected: "pending" });
-      const current = await apiGet<AiModelRequestSettings>(ctx, `${path}/models/${encodeURIComponent(flags.id!)}/settings`);
-      print(
-        ctx,
-        AiModelRequestSettingsSchema.parse(
-          await apiJson(ctx, "PUT", `${path}/models/${encodeURIComponent(flags.id!)}/settings`, { ...valid, expected: current.revision }),
-        ),
-      );
-    },
-  }),
-  command("ai models pricing get", {
-    summary: "List configured model input/output reference prices per million tokens",
-    async run({ ctx }) {
-      print(ctx, await apiGet(ctx, `${path}/models`));
-    },
-  }),
-  command("ai models pricing set", {
-    summary: "Set one model's reference prices; JSON null removes prices and makes it unlimited",
-    flags: {
-      id: flag.string({ required: true, description: "Model profile ID" }),
-      pricing: flag.input({
-        required: true,
-        description: "{inputPerMillion,outputPerMillion} or null: --pricing, --pricing-file or --stdin",
-      }),
-      yes: confirmFlag("Confirm model price change"),
-    },
-    async run({ ctx, flags }) {
-      confirm(ctx, flags.yes);
-      const pricing = AiModelPricingSchema.nullable().parse(await readJsonInput<unknown>(flags.pricing, "model pricing"));
-      const current = await apiGet<{ models: { id: string; pricing?: AiModelPricing }[] }>(ctx, `${path}/models`);
-      const model = current.models.find((model) => model.id === flags.id);
-      if (!model) throw new Error("Model not found.");
-      print(
-        ctx,
-        await apiJson(ctx, "PUT", `${path}/models/${encodeURIComponent(flags.id!)}/pricing`, { pricing, expected: model.pricing ?? null }),
-      );
-    },
-  }),
   command("ai quotas background status", {
     summary: "Show rolling 24-hour background costs and emergency-stop state",
     async run({ ctx }) {
@@ -153,7 +57,7 @@ export const aiQuotaCommands = [
     },
   }),
   command("ai quotas models", {
-    summary: "List configured model profiles; only priced chat models support cost rules",
+    summary: "List configured models; only priced chat models support cost rules",
     async run({ ctx }) {
       const result = await apiGet<{ models: { id: string; label: string; pricing?: AiModelPricing }[] }>(ctx, `${path}/models`);
       printRows(
@@ -170,7 +74,7 @@ export const aiQuotaCommands = [
       range: flag.enum(["24h", "7d", "30d", "90d"] as const, { default: "30d" }),
       until: flag.string({ description: "ISO period end; reuse query.until for consistent pagination" }),
       search: flag.string({ description: "Search identity labels" }),
-      model: flag.string({ description: "Model profile ID" }),
+      model: flag.string({ description: "Model ID" }),
       status: flag.enum(["all", "available", "exhausted", "unknown", "unlimited", "disabled"] as const, { default: "all" }),
       sort: flag.enum(["label", "cost", "lastUsed"] as const, { default: "lastUsed" }),
       direction: flag.enum(["asc", "desc"] as const, { default: "desc" }),
@@ -216,7 +120,7 @@ export const aiQuotaCommands = [
     summary: "Reset one identity and quota scope; reuse request ID when retrying",
     flags: {
       ...identity,
-      scope: flag.string({ required: true, description: "Model profile ID or * (quote the wildcard)" }),
+      scope: flag.string({ required: true, description: "Model ID or * (quote the wildcard)" }),
       requestId: flag.string({ required: true, description: "UUID for this reset; reuse for retries, use a new UUID for a new reset" }),
       yes: confirmFlag("Confirm reset of this identity and quota scope"),
     },

package/src/cli/admin/ai-usage.ts

@@ -7,7 +7,7 @@ const filters = {
   range: flag.enum(AI_USAGE_RANGES, { default: "30d", description: "Response/run period" }),
   until: flag.string({ description: "Fixed ISO end time; reuse report.query.until across pages" }),
   userId: flag.string({ name: "user", description: "User UUID or unassigned" }),
-  modelProfileId: flag.string({ name: "model", description: "Model profile ID" }),
+  modelId: flag.string({ name: "model", description: "Model profile ID" }),
   providerModel: flag.string({ name: "provider-model", description: "Actual provider model" }),
   workflowId: flag.string({ name: "workflow", description: "Workflow definition UUID" }),
   workflowRunId: flag.string({ name: "workflow-run", description: "Workflow run UUID" }),
@@ -75,7 +75,7 @@ export const aiUsageCommands = [
               { key: "task" },
               { key: "status" },
               { key: "userLabel" },
-              { key: "modelProfileId" },
+              { key: "modelId" },
               { key: "cost" },
               { key: "unit" },
               { key: "error" },
@@ -85,7 +85,7 @@ export const aiUsageCommands = [
           ctx.table(report.feedback.items, [
             { key: "id" },
             { key: "userLabel" },
-            { key: "modelProfileId" },
+            { key: "modelId" },
             { key: "rating" },
             { key: "comment" },
           ]);
@@ -125,7 +125,7 @@ export const aiUsageCommands = [
   command("ai usage facets", {
     summary: "Find user IDs, model profiles, provider models, apps or tasks for filtering",
     flags: {
-      field: flag.enum(["userId", "modelProfileId", "providerModel", "appId", "task"] as const, { required: true }),
+      field: flag.enum(["userId", "modelId", "providerModel", "appId", "task"] as const, { required: true }),
       search: flag.string(),
       range: filters.range,
     },

package/src/cli/admin/app-credentials.ts

@@ -51,7 +51,7 @@ export const appCredentialCommands = [
     },
     async run({ ctx, args, flags }) {
       if (!flags.yes)
-        throw new Error(cliText(ctx, { en: "Creating an app credential requires --yes.", de: "App-Zugang erstellen erfordert --yes." }));
+        throw new Error(cliText(ctx, { en: "Creating an app credential requires --yes.", de: "App-Schlüssel erstellen erfordert --yes." }));
       const result = z.object({ credential: metadata, token: z.string() }).parse(
         await apiJson(ctx, "POST", path(args.app), {
           name: flags.name,
@@ -68,10 +68,12 @@ export const appCredentialCommands = [
     flags: { yes: confirmFlag("Revoke this app credential") },
     async run({ ctx, args, flags }) {
       if (!flags.yes)
-        throw new Error(cliText(ctx, { en: "Revoking an app credential requires --yes.", de: "App-Zugang widerrufen erfordert --yes." }));
+        throw new Error(
+          cliText(ctx, { en: "Revoking an app credential requires --yes.", de: "App-Schlüssel widerrufen erfordert --yes." }),
+        );
       const credentialId = z.uuid().parse(args.credential);
       const result = await apiJson(ctx, "DELETE", `${path(args.app)}/${credentialId}`);
-      if (!printStructured(ctx, result)) ctx.print(cliText(ctx, { en: "Credential revoked.", de: "Zugang widerrufen." }));
+      if (!printStructured(ctx, result)) ctx.print(cliText(ctx, { en: "Credential revoked.", de: "Schlüssel widerrufen." }));
     },
   }),
 ];