@k2b/cloud 0.43.0 → 0.45.0

package/src/ai/transcription.ts

@@ -1,14 +1,13 @@
 import { openAICompatibleTranscription, type TranscriptionProvider } from "@k2b/nessi/ai";
-import { coreSettings } from "../services";
 import { logger, type TraceContext, trace } from "../services/logging";
 import { AI_AUDIO_MAX_BYTES, inspectAiAudio } from "./audio-format";
 import { getAiCredential } from "./credentials";
 import { beginAiCall, finishAiCall } from "./inference-calls";
-import { readAiSettingsState, selectAiModelProfile } from "./settings";
+import { classifyProviderFailure, recordAiProviderStatus } from "./provider-connections";
+import { readAiSettingsState, resolveAiModelRef, selectAiModelProfile } from "./settings";
 import { type AiUsageAttribution, safelyRecordStructuredRun } from "./structured-runs";
 import type { AiDataBoundary, AiModelProfile } from "./types";
 
-export const AI_AUDIO_MODEL_SETTING_KEY = "ai.audio_model_id";
 /** Matches the existing chat turn execution budget; callers may cancel sooner. */
 export const AI_TRANSCRIPTION_TIMEOUT_MS = 10 * 60_000;
 
@@ -37,36 +36,42 @@ export const createAiTranscriptionProvider = (profile: AiModelProfile, apiKey?:
     model: provider.model,
     transcribe: async (request) => {
       try {
-        return await provider.transcribe(request);
+        const result = await provider.transcribe(request);
+        await recordAiProviderStatus(profile.providerId, { status: "ok", message: "The provider connection works." });
+        return result;
       } catch (error) {
-        throw describeTranscriptionFailure(error, "provider", request.signal?.aborted);
+        const failure = describeTranscriptionFailure(error, "provider", request.signal?.aborted);
+        if (!request.signal?.aborted)
+          await recordAiProviderStatus(
+            profile.providerId,
+            failure.httpStatus
+              ? classifyProviderFailure({ status: failure.httpStatus })
+              : failure.code === "transcription_connection_failed"
+                ? classifyProviderFailure(new TypeError())
+                : classifyProviderFailure(error),
+          );
+        throw failure;
       }
     },
   };
 };
 
 export const resolveAiAudioModel = async (
-  input: { requestedModelId?: string; allowedDataBoundaries?: AiDataBoundary[] } = {},
+  input: { model?: import("../shared/ai-models").AiModelRequest; allowedDataBoundaries?: AiDataBoundary[] } = {},
 ): Promise<AiResolvedAudioModel> => {
   const state = await readAiSettingsState();
-  if (!state.ok)
-    throw Object.assign(
-      new AiTranscriptionError(
-        "transcription_configuration_failed",
-        `Audio transcription is not available: ${state.error.message} An administrator can fix this in the AI settings.`,
-      ),
-      { aiError: state.error },
-    );
   if (!state.enabled)
     throw new AiTranscriptionError(
       "transcription_configuration_failed",
       "Audio transcription is not available: AI is disabled. An administrator can enable AI in the AI settings.",
     );
-  const modelId = input.requestedModelId ?? String((await coreSettings.get<string>(AI_AUDIO_MODEL_SETTING_KEY)) ?? "").trim();
+  const modelId = input.model
+    ? resolveAiModelRef(state, input.model).id
+    : state.assignments.find((assignment) => assignment.slot === "audio")?.variantId;
   if (!modelId)
     throw new AiTranscriptionError(
       "transcription_configuration_failed",
-      "Audio transcription is not set up: no audio model is configured. An administrator can configure an audio model in the AI settings.",
+      "Audio transcription is not set up: no audio model is assigned. An administrator can configure an audio model in the AI settings.",
     );
   let profile: AiModelProfile;
   try {
@@ -93,7 +98,7 @@ export const resolveAiAudioModel = async (
       error instanceof Error && "aiError" in error ? { aiError: error.aiError } : {},
     );
   }
-  const credential = await getAiCredential(profile.id);
+  const credential = await getAiCredential(profile.providerId);
   if (profile.provider === "openai" && !credential?.trim())
     throw new AiTranscriptionError(
       "transcription_configuration_failed",
@@ -108,7 +113,7 @@ export type RunAiTranscriptionInput = {
   filename: string;
   language?: string;
   prompt?: string;
-  requestedModelId?: string;
+  model?: import("../shared/ai-models").AiModelRequest;
   allowedDataBoundaries?: AiDataBoundary[];
   signal?: AbortSignal;
   appId?: string;
@@ -119,7 +124,7 @@ export type RunAiTranscriptionInput = {
 };
 
 /** One provider call. Durable execution and input authorization belong to the caller. */
-export const runAiTranscription = async (input: RunAiTranscriptionInput): Promise<{ text: string; modelProfileId: string }> => {
+export const runAiTranscription = async (input: RunAiTranscriptionInput): Promise<{ text: string; modelId: string }> => {
   return trace.withSpan(
     {
       name: `ai.transcription.${input.task}`,
@@ -165,13 +170,13 @@ export const runAiTranscription = async (input: RunAiTranscriptionInput): Promis
         });
         signal.throwIfAborted();
         succeeded = true;
-        return { text: result.text, modelProfileId: resolved.profile.id };
+        return { text: result.text, modelId: resolved.profile.id };
       } catch (error) {
         failure = describeTranscriptionFailure(error, stage, signal.aborted);
         logger("ai:transcription")[input.signal?.aborted ? "info" : "error"](failure.message, {
           traceId: span.traceId,
           task: input.task,
-          modelProfileId: resolved?.profile.id ?? input.requestedModelId,
+          modelId: resolved?.profile.id ?? input.model,
           providerModel: resolved?.profile.model,
           stage,
           errorCode: failure.code,
@@ -191,7 +196,7 @@ export const runAiTranscription = async (input: RunAiTranscriptionInput): Promis
           task: input.task,
           appId: input.appId,
           attribution: input.attribution,
-          modelProfileId: resolved?.profile.id,
+          modelId: resolved?.profile.id,
           providerModel: resolved?.profile.model,
           mode: "transcription",
           attempts: resolved ? 1 : 0,

package/src/ai/types.ts

@@ -20,6 +20,7 @@ import type {
   CloudResourceRef,
 } from "../contracts/capabilities";
 import type { RequestActor } from "../server";
+import type { AiModelRequest, AiResolvedModelRef } from "../shared/ai-models";
 import type { AiActionCheck, AiStoredActionReview } from "./action-review";
 import type { AiLocalClient, AiLocalContext, AiLocalToolName } from "./local-tool-contracts";
 import type { AiTurnBlock } from "./protocol";
@@ -27,6 +28,8 @@ import type { AiTurnBlock } from "./protocol";
 /** Current reader-confirmed metadata for a recently sent resource. */
 export type AiRecentResource = {
   ref: CloudResourceRef;
+  context?: string;
+  status?: string;
   title: string;
   icon?: string;
   href?: string;
@@ -44,7 +47,7 @@ export type AiRecentSentResourceRef = {
   conversationId: string;
 };
 
-export const AI_MODEL_CAPABILITIES = ["streaming", "tools", "vision", "transcription"] as const;
+export const AI_MODEL_CAPABILITIES = ["tools", "vision", "transcription"] as const;
 export type AiModelCapability = (typeof AI_MODEL_CAPABILITIES)[number];
 
 export const AI_IMAGE_MEDIA_TYPES = ["image/png", "image/jpeg", "image/jpg", "image/webp", "image/gif"] as const;
@@ -62,11 +65,15 @@ export type AiDataPolicy = AiDataBoundary;
 export type AiModelProfile = {
   id: string;
   label: string;
+  modelId: string;
+  providerId: string;
+  variantLabel: string;
+  description: string;
+  icon: import("../shared/ai-models").AiModelIcon;
+  showInPicker: boolean;
   provider: AiProviderId;
   model: string;
   enabled: boolean;
-  /** Small logo (data URL, hard-compressed) shown in the admin card and the composer model picker. */
-  image?: string;
   capabilities: AiModelCapability[];
   dataBoundary: AiDataBoundary;
   baseURL?: string;
@@ -82,67 +89,34 @@ export type AiModelProfile = {
   pricing?: import("../shared/ai-costs").AiModelPricing;
 };
 
-export type AiPublicModelProfile = Pick<
-  AiModelProfile,
-  "id" | "label" | "provider" | "model" | "image" | "capabilities" | "dataBoundary" | "contextWindow"
->;
-
 export type AiUserContentPart = ContentPart;
 
-export type AiSettingsErrorCode =
-  | "ai_disabled"
-  | "invalid_model_profiles"
-  | "missing_default_model"
-  | "default_model_disabled"
-  | "missing_provider_credential"
-  | "model_policy_mismatch"
-  | "model_access_denied";
-
-export type AiSettingsError = {
-  code: AiSettingsErrorCode;
-  message: string;
-  fields?: Record<string, string>;
+export type AiSettingsErrorCode = "ai_disabled" | "ai_no_model" | "model_policy_mismatch";
+export type AiSettingsError = { code: AiSettingsErrorCode; message: string; fields?: Record<string, string> };
+export type AiSettingsState = {
+  ok: true;
+  enabled: boolean;
+  assignments: import("../shared/ai-models").AiModelAssignment[];
+  globalInstructions: string;
+  localClientInstructions: string;
+  compactionInstructions: string;
+  maxToolResultChars: number;
+  firecrawlConfigured: boolean;
+  profiles: AiModelProfile[];
 };
 
-export type AiSettingsState =
-  | {
-      ok: true;
-      enabled: boolean;
-      defaultModelId: string;
-      visionModelId?: string;
-      globalInstructions: string;
-      localClientInstructions: string;
-      compactionInstructions: string;
-      maxToolResultChars: number;
-      firecrawlConfigured: boolean;
-      profiles: AiModelProfile[];
-    }
-  | {
-      ok: false;
-      enabled: boolean;
-      defaultModelId: string;
-      visionModelId?: string;
-      globalInstructions: string;
-      localClientInstructions: string;
-      compactionInstructions: string;
-      maxToolResultChars: number;
-      firecrawlConfigured: boolean;
-      profiles: AiModelProfile[];
-      error: AiSettingsError;
-    };
-
 export type AiModelPolicy =
   | { kind: "platform-default"; allowedDataBoundaries?: AiDataBoundary[]; requiredCapabilities?: AiModelCapability[] }
   | { kind: "locked"; modelId: string; allowedDataBoundaries?: AiDataBoundary[]; requiredCapabilities?: AiModelCapability[] }
   | {
       kind: "selectable";
-      defaultModelId?: string;
       allowedModelIds?: string[];
       allowedDataBoundaries?: AiDataBoundary[];
       requiredCapabilities?: AiModelCapability[];
     };
 
 export type AiResolvedModel = {
+  model: import("../shared/ai-models").AiResolvedModelRef;
   profile: AiModelProfile;
   provider: Provider;
 };
@@ -230,7 +204,7 @@ export type AiEnrichmentRun = {
   conversationId: string;
   status: AiEnrichmentRunStatus;
   trigger: AiEnrichmentTrigger;
-  modelProfileId: string | null;
+  modelId: string | null;
   /** nessi structured mode of the successful call: native | fallback | repair. */
   mode: string | null;
   durationMs: number | null;
@@ -298,7 +272,7 @@ export type AiStoredMessage = {
   kind: "message" | "summary";
   message: Message;
   loopId: string | null;
-  modelProfileId: string | null;
+  modelId: string | null;
   providerModel: string | null;
   usage: Usage | null;
   stopReason: string | null;
@@ -313,6 +287,9 @@ export type AiStoredMessage = {
   meta: {
     /** The atomically consumed composer revision, used to confirm a local send. */
     submittedDraftRevision?: number;
+    modelRequest?: AiModelRequest;
+    modelResolved?: AiResolvedModelRef;
+    modelReplacement?: { kind: "model_replaced"; previousLabel: string; nextLabel: string };
     compactedCount?: number;
     todoPlan?: import("./todo-contracts").AiTodoPlan;
     steerId?: string;
@@ -353,6 +330,7 @@ export type AiConversationTimelineEntry = {
   id: string;
   seq: number;
   loopId: string | null;
+  modelReplacement?: { kind: "model_replaced"; previousLabel: string; nextLabel: string };
   userPreview: string;
   assistantPreview: string;
   isSteer: boolean;
@@ -418,7 +396,7 @@ export type AiTurn = {
   conversationId: string;
   status: AiTurnStatus;
   attempt: number;
-  modelProfileId: string | null;
+  modelId: string | null;
   createdAt: string;
   completedAt: string | null;
   error: string | null;
@@ -534,7 +512,7 @@ export type AiProjectPromptSnapshot = {
   instructions: string;
   context: string;
   references: CloudResourceRef[];
-  defaultModelProfileId: string | null;
+  defaultModel: import("../shared/ai-models").AiModelRequest | null;
 };
 
 export type AiProjectFileToolStat = {
@@ -569,6 +547,8 @@ export type AiSkillFileToolSource = {
 
 export type AiConversationResourceRef = {
   ref: CloudResourceRef;
+  context?: string | null;
+  status?: string | null;
   title: string | null;
   preview: string | null;
   icon: string | null;
@@ -581,6 +561,8 @@ export type AiConversationResourceRef = {
 
 export type AiConversationResourceObservation = {
   ref: CloudResourceRef;
+  context?: string;
+  status?: string;
   title?: string;
   preview?: string;
   icon?: string;
@@ -601,6 +583,8 @@ export type AiConversationResourceOccurrence = AiConversationResourceRef & {
 export type AiConversationSourceKind = "result" | "web" | "file" | "resource" | "activity";
 
 export type AiConversationSource = {
+  context?: string | null;
+  status?: string | null;
   kind: AiConversationSourceKind;
   key: string;
   title: string;
@@ -683,7 +667,10 @@ export type AiChatTurnRunConfig = {
   /** Request locale persisted with the turn so async execution keeps the caller preference. */
   locale?: string;
   modelPolicy?: AiModelPolicy;
-  requestedModelId?: string;
+  model?: AiModelRequest;
+  modelResolved?: AiResolvedModelRef;
+  modelLabel?: string;
+  modelReplacement?: { kind: "model_replaced"; previousLabel: string; nextLabel: string };
   /** Optional instructions that apply only to this turn. */
   systemPrompt?: string;
   project?: AiProjectPromptSnapshot;
@@ -708,7 +695,8 @@ export type AiCompactionTurnRunConfig = {
   kind: "compact";
   actor?: RequestActor;
   modelPolicy?: AiModelPolicy;
-  requestedModelId?: string;
+  model?: AiModelRequest;
+  modelResolved?: AiResolvedModelRef;
 };
 
 export type AiTurnRunConfig = AiChatTurnRunConfig | AiCompactionTurnRunConfig;
@@ -851,7 +839,7 @@ export type AiConversationService = {
   failInterChatMessage(input: { messageId: string; error: string }): Promise<boolean>;
   deliverInterChatMessage(input: {
     messageId: string;
-    modelProfileId: string;
+    modelId: string;
     runConfig: AiChatTurnRunConfig;
     userMessage: Message;
     sourceHref?: string;
@@ -909,7 +897,7 @@ export type AiConversationService = {
     conversationId: string;
     status: AiEnrichmentRunStatus;
     trigger: AiEnrichmentTrigger;
-    modelProfileId?: string;
+    modelId?: string;
     mode?: string;
     durationMs?: number;
     titleUpdated?: boolean;
@@ -954,7 +942,7 @@ export type AiConversationService = {
     turnId?: string;
     checkpointSeq: number;
     summary: Message;
-    modelProfileId?: string | null;
+    modelId?: string | null;
   }): Promise<void>;
   listTurnMessages(input: { conversationId: string; loopId: string; includeCompacted?: boolean }): Promise<AiStoredMessage[]>;
   setMessageFeedback(input: {
@@ -964,12 +952,12 @@ export type AiConversationService = {
   }): Promise<AiMessageFeedback | null>;
   clearMessageFeedback(input: { conversationId: string; messageShortId: string }): Promise<boolean>;
   /** Create a queued compaction turn. Chat turns must use submitChatTurn. */
-  createCompactionTurn(input: { conversationId: string; modelProfileId: string; runConfig: AiCompactionTurnRunConfig }): Promise<AiTurn>;
+  createCompactionTurn(input: { conversationId: string; modelId: string; runConfig: AiCompactionTurnRunConfig }): Promise<AiTurn>;
   /** Persist the user message and create its turn in one transaction. */
   submitChatTurn(input: {
     queuedMessageId?: string;
     conversationId: string;
-    modelProfileId: string;
+    modelId: string;
     runConfig: AiChatTurnRunConfig;
     userMessage: Message;
     /** Atomically consume this saved draft revision when present. */
@@ -984,7 +972,7 @@ export type AiConversationService = {
     retrySourceTurnId?: string;
   }): Promise<{ turn: AiTurn; message: AiStoredMessage }>;
   getTurnRunConfig(input: { conversationId: string; turnId: string }): Promise<AiTurnRunConfig | null>;
-  getLatestTurn(input: { conversationId: string }): Promise<AiTurn | null>;
+  getLatestTurn(input: { conversationId: string; kind?: AiTurnRunConfig["kind"] }): Promise<AiTurn | null>;
   getTurn(input: { conversationId: string; turnId: string }): Promise<AiTurn | null>;
   getTurnByShortId(input: { conversationId: string; shortId: string }): Promise<AiTurn | null>;
   getActiveTurn(input: { conversationId: string }): Promise<{
@@ -1076,7 +1064,7 @@ export type AiConversationService = {
     /** Called after a durable append, for incremental usage/history projection. */
     onMessage?: (message: AiStoredMessage) => Promise<void>;
     conversationId: string;
-    modelProfileId?: string | null;
+    modelId?: string | null;
     turnId?: string | null;
     leaseOwner?: string | null;
     /** Ephemeral provider input for this turn; user-message persistence remains reference-only. */

package/src/ai/ui.tsx

@@ -1,4 +1,17 @@
 export { AiTurnBlockView } from "./chat/blocks";
+export { AiModelCard, type AiModelCardStop, aiModelClassLabel, aiModelClassSubtitle } from "./model-card";
+export {
+  AiModelChooser,
+  type AiModelChooserState,
+  AiModelField,
+  AiModelNote,
+  aiModelBlocksSending,
+  aiModelRequestFor,
+  aiModelUnavailableText,
+  resolveAiModelChoice,
+} from "./model-chooser";
+export { aiModelChooserMessages } from "./model-chooser-messages";
+export { AiModelIcon, aiModelDisplayIcon } from "./model-icon";
 
 import { latestLoopUsage, latestUsage, latestUsageSnapshot, textFromMessage } from "./chat/message-utils";
 

package/src/ai/usage.ts

@@ -12,7 +12,7 @@ export type AiUsageRun = {
   createdAt: string;
   userId: string | null;
   userLabel: string | null;
-  modelProfileId: string | null;
+  modelId: string | null;
   providerModel: string | null;
   appId: string | null;
   conversationId: string | null;
@@ -42,7 +42,7 @@ export type AiUsageFeedback = {
   conversationTitle: string;
   userId: string | null;
   userLabel: string | null;
-  modelProfileId: string | null;
+  modelId: string | null;
   providerModel: string | null;
   rating: "up" | "down";
   reasons: string[];
@@ -137,7 +137,7 @@ const events = (since: Date, until: Date) => sql`
 `;
 const globalFilter = (q: AiUsageQuery) => sql`
   (${q.userId ?? null}::text IS NULL OR (${q.userId === "unassigned"} AND e.user_id IS NULL) OR e.user_id::text=${q.userId ?? null})
-  AND (${q.modelProfileId ?? null}::text IS NULL OR e.model_profile_id=${q.modelProfileId ?? null})
+  AND (${q.modelId ?? null}::text IS NULL OR e.model_profile_id=${q.modelId ?? null})
   AND (${q.providerModel ?? null}::text IS NULL OR e.provider_model=${q.providerModel ?? null})
   AND (${q.workflowId ?? null}::uuid IS NULL OR e.workflow_id=${q.workflowId ?? null}::uuid)
   AND (${q.workflowRunId ?? null}::uuid IS NULL OR e.workflow_run_id=${q.workflowRunId ?? null}::uuid)
@@ -187,7 +187,7 @@ const pageOf = async <T>(projection: ReturnType<typeof events>, q: AiUsageQuery)
   return { items, total, page, perPage: q.perPage };
 };
 const runColumns = () => sql`e.id, e.kind, e.task, e.status, e.created_at::text AS "createdAt", e.user_id::text AS "userId",
-  COALESCE(NULLIF(u.display_name,''),u.uid,sa.name) AS "userLabel",e.model_profile_id AS "modelProfileId",e.provider_model AS "providerModel",
+  COALESCE(NULLIF(u.display_name,''),u.uid,sa.name) AS "userLabel",e.model_profile_id AS "modelId",e.provider_model AS "providerModel",
   e.app_id AS "appId",e.conversation_id::text AS "conversationId",e.turn_id::text AS "turnId",e.workflow_run_id::text AS "workflowRunId",
   e.workflow_id::text AS "workflowId",e.workflow_name AS "workflowName",e.estimated,e.trace_id AS "traceId",e.tokens,e.cost::float8 AS cost,e.duration_ms AS "durationMs",e.error_code AS "errorCode",e.error,e.attempts,
   e.request_started_at::text AS "requestStartedAt",e.generation_ms AS "generationMs",e.headers_ms AS "headersMs",e.first_byte_ms AS "firstByteMs",
@@ -235,7 +235,7 @@ export const aiUsage = {
     // The response period is authoritative for both summary and feedback. Editing a rating never moves its response into a different period.
     const feedbackRows = sql`SELECT m.id::text AS id,c.id::text AS "conversationId",c.title AS "conversationTitle",
       e.user_id::text AS "userId",COALESCE(NULLIF(u.display_name,''),u.uid,sa.name) AS "userLabel",
-      e.model_profile_id AS "modelProfileId",e.provider_model AS "providerModel",
+      e.model_profile_id AS "modelId",e.provider_model AS "providerModel",
       CASE WHEN m.feedback_rating=1 THEN 'up' ELSE 'down' END AS rating,
       m.feedback_reasons AS reasons,m.feedback_comment AS comment,m.created_at::text AS "createdAt",m.feedback_updated_at::text AS "updatedAt"
       FROM (${filtered}) e JOIN ai.messages m ON m.loop_id=e.turn_id::text AND m.conversation_id=e.conversation_id
@@ -266,7 +266,7 @@ export const aiUsage = {
         FROM ai.conversations c WHERE c.created_at >= ${since} AND c.created_at <= ${until} AND c.launched_by_app_id IS NOT NULL
         AND (${q.userId ?? null}::text IS NULL OR (${q.userId === "unassigned"} AND c.created_by_user_id IS NULL) OR c.created_by_user_id::text=${q.userId ?? null})
         AND (${q.appId ?? null}::text IS NULL OR c.launched_by_app_id=${q.appId ?? null})
-        AND ((${q.modelProfileId ?? null}::text IS NULL AND ${q.providerModel ?? null}::text IS NULL) OR EXISTS (
+        AND ((${q.modelId ?? null}::text IS NULL AND ${q.providerModel ?? null}::text IS NULL) OR EXISTS (
           SELECT 1 FROM (${filtered}) e WHERE e.kind='chat' AND e.conversation_id=c.id
         )) GROUP BY c.launched_by_app_id ORDER BY chats DESC,c.launched_by_app_id`,
         q,
@@ -305,12 +305,12 @@ export const aiUsage = {
       LEFT JOIN auth.users u ON u.id=e.user_id LEFT JOIN auth.service_accounts sa ON sa.id=e.user_id WHERE e.kind=${kind} AND e.id=${id}`;
     return row ?? null;
   },
-  facets: async (field: "userId" | "modelProfileId" | "providerModel" | "appId" | "task", search: string, input: Partial<AiUsageQuery>) => {
+  facets: async (field: "userId" | "modelId" | "providerModel" | "appId" | "task", search: string, input: Partial<AiUsageQuery>) => {
     const { query, since, until } = period(input);
     const key =
       field === "userId"
         ? sql`e.user_id::text`
-        : field === "modelProfileId"
+        : field === "modelId"
           ? sql`e.model_profile_id`
           : field === "providerModel"
             ? sql`e.provider_model`

package/src/ai/validate.ts

@@ -1,9 +1,10 @@
 import type { Input } from "@k2b/nessi";
+import type { AiModelRequest } from "../shared/ai-models";
 import { readAiSettingsState, resolveAiModelFromState } from "./settings";
 import type { AiModelPolicy, AiSettingsError, AiSettingsState } from "./types";
 
 export const isAiSettingsError = (error: unknown): error is Error & { aiError: AiSettingsError } =>
-  error instanceof Error && typeof (error as Error & { aiError?: unknown }).aiError === "object";
+  error instanceof Error && "aiError" in error && typeof error.aiError === "object";
 
 const inputIncludesFiles = (input: Input): boolean =>
   Array.isArray(input) && input.some((part) => typeof part === "object" && part.type === "file");
@@ -13,27 +14,27 @@ export type ValidateAiTurnInput = {
   hasImageAttachments?: boolean;
   canInspectAttachedImages?: boolean;
   modelPolicy?: AiModelPolicy;
-  requestedModelId?: string;
+  model?: AiModelRequest;
 };
 
 export const validateAiTurnRequest = async (
   input: ValidateAiTurnInput,
+  providedState?: AiSettingsState,
 ): Promise<{ settings: Extract<AiSettingsState, { ok: true }>; resolved: Awaited<ReturnType<typeof resolveAiModelFromState>> }> => {
-  const settings = await readAiSettingsState();
-  if (!settings.ok) throw Object.assign(new Error(settings.error.message), { aiError: settings.error });
+  const settings = providedState ?? (await readAiSettingsState());
   if (!settings.enabled) {
     throw Object.assign(new Error("AI is disabled."), {
       aiError: { code: "ai_disabled", message: "AI is disabled." } satisfies AiSettingsError,
     });
   }
 
-  const resolved = await resolveAiModelFromState(settings, input.modelPolicy ?? { kind: "platform-default" }, input.requestedModelId);
+  const resolved = await resolveAiModelFromState(settings, input.modelPolicy ?? { kind: "platform-default" }, input.model);
   if (inputIncludesFiles(input.input) && !resolved.profile.capabilities.includes("vision")) {
     throw Object.assign(new Error(`AI model "${resolved.profile.id}" does not support image input.`), {
       aiError: {
         code: "model_policy_mismatch",
         message: `AI model "${resolved.profile.label}" does not support image input.`,
-        fields: { modelProfileId: "Choose a model with vision support." },
+        fields: { modelId: "Choose a model with vision support." },
       } satisfies AiSettingsError,
     });
   }
@@ -44,7 +45,7 @@ export const validateAiTurnRequest = async (
         aiError: {
           code: "model_policy_mismatch",
           message: `AI model "${resolved.profile.label}" needs Vision support or Tools with a configured Vision tool model.`,
-          fields: { modelProfileId: "Choose a Vision model, or configure the view_image fallback." },
+          fields: { modelId: "Choose a Vision model, or configure the view_image fallback." },
         } satisfies AiSettingsError,
       });
     }

package/src/ai/view-block.ts

@@ -41,7 +41,7 @@ export const CLOUD_AI_DETAILS_VIEWPORT_ITEMS = 12;
 // the viewport at any width and its length counts no further.
 export const CLOUD_AI_DETAILS_MAX_CHARS = 4096;
 
-const referenceSchema = () => CloudResourceReferenceSchema.pick({ type: true, id: true, title: true });
+const referenceSchema = () => CloudResourceReferenceSchema.pick({ type: true, id: true, title: true, context: true, status: true });
 const ReferenceSchema = /* @__PURE__ */ referenceSchema();
 export type CloudAiViewReference = z.output<typeof ReferenceSchema>;
 const cellTypeSchema = () => z.enum(["text", "number", "date", "datetime", "ref"]);
@@ -371,7 +371,7 @@ const ExplorerViewSchema = ExplorerDataSchema.superRefine((value, ctx) => {
       };
     }
     const domains = [
-      ...("xAxis" in input && input.xAxis?.domain ? [input.xAxis.domain] : []),
+      ...("xAxis" in input && input.kind !== "bar" && input.xAxis?.domain ? [input.xAxis.domain] : []),
       ...("yAxis" in input && input.yAxis?.domain ? [input.yAxis.domain] : []),
     ];
     const stepping = domains.some(

package/src/api/accounts-entities.ts

@@ -10,6 +10,8 @@ import {
   PaginationQuerySchema,
   PaginationResponseSchema,
   parsePagination,
+  ServiceAccountKindSchema,
+  ServiceAccountStatusSchema,
   UserProfileSchema,
   UserProviderSchema,
 } from "../contracts";
@@ -34,6 +36,9 @@ const QuerySchema = z
     profile: UserProfileSchema.optional(),
     user_ids: z.string().optional(),
     group_ids: z.string().optional(),
+    service_account_ids: z.string().optional(),
+    service_account_kinds: z.string().optional(),
+    service_account_status: ServiceAccountStatusSchema.optional(),
     exclude_user_ids: z.string().optional(),
     exclude_group_ids: z.string().optional(),
     exclude_service_account_ids: z.string().optional(),
@@ -43,7 +48,6 @@ const QuerySchema = z
     parent_group_id: z.uuid().optional(),
     managed_by_user_id: z.uuid().optional(),
     recursive: z.enum(["true", "false"]).optional(),
-    include_personal: z.enum(["true", "false"]).optional(),
   })
   .refine(
     (value) => {
@@ -73,6 +77,14 @@ const parseKinds = (value?: string) => {
   return { ok: false as const, message: "Invalid kinds query parameter." };
 };
 
+const parseServiceAccountKinds = (value?: string) => {
+  const kinds = parseCsv(value);
+  if (kinds.length === 0) return { ok: true as const, value: undefined };
+  const parsed = z.array(ServiceAccountKindSchema).safeParse([...new Set(kinds)]);
+  if (parsed.success) return { ok: true as const, value: parsed.data };
+  return { ok: false as const, message: "Invalid service_account_kinds query parameter." };
+};
+
 const parseUuidList = (value: string | undefined, label: string) => {
   const ids = parseCsv(value);
   if (ids.length === 0) return { ok: true as const, value: undefined };
@@ -100,7 +112,7 @@ export const createAccountsEntitiesRoutes = (dependencies: AccountsEntitiesRoute
       tags: ["Accounts"],
       summary: "List visible directory entries",
       description:
-        "List visible users and groups with SQL-backed filtering and pagination. Guest accounts see only themselves and their effective groups; relation filters require a full user account. Standalone and agent accounts with read scope see only explicitly shared directory entries and cannot query relationships. Personal Linux groups (a user's private primary group, flagged with `personalOwner`) are left out unless `include_personal=true`; exact `group_ids` lookups and relation filters always return them.",
+        "List visible users and groups with SQL-backed filtering and pagination. Guest accounts see only themselves and their effective groups; relation filters require a full user account. Standalone and agent accounts with read scope see only explicitly shared directory entries and cannot query relationships. Personal Linux groups are excluded, including exact group IDs and relation filters. Inspect the owning user's Linux identity for diagnostic attributes.",
       ...requiresAuth,
       responses: {
         200: jsonResponse(EntitiesListResponseSchema, "Paginated mixed entity list"),
@@ -126,6 +138,8 @@ export const createAccountsEntitiesRoutes = (dependencies: AccountsEntitiesRoute
       const params = parsePagination(query);
       const kinds = parseKinds(query.kinds);
       if (!kinds.ok) return respond(c, fail(err.badInput(kinds.message)));
+      const serviceAccountKinds = parseServiceAccountKinds(query.service_account_kinds);
+      if (!serviceAccountKinds.ok) return respond(c, fail(err.badInput(serviceAccountKinds.message)));
       const excludeUserIds = parseUuidList(query.exclude_user_ids, "exclude_user_ids");
       if (!excludeUserIds.ok) return respond(c, fail(err.badInput(excludeUserIds.message)));
       const excludeGroupIds = parseUuidList(query.exclude_group_ids, "exclude_group_ids");
@@ -139,6 +153,9 @@ export const createAccountsEntitiesRoutes = (dependencies: AccountsEntitiesRoute
       const groupIds = parseUuidList(query.group_ids, "group_ids");
       if (!groupIds.ok) return respond(c, fail(err.badInput(groupIds.message)));
 
+      const serviceAccountIds = parseUuidList(query.service_account_ids, "service_account_ids");
+      if (!serviceAccountIds.ok) return respond(c, fail(err.badInput(serviceAccountIds.message)));
+
       const filters = {
         search: query.search,
         kinds: kinds.value,
@@ -146,6 +163,9 @@ export const createAccountsEntitiesRoutes = (dependencies: AccountsEntitiesRoute
         profile: query.profile,
         userIds: userIds.value,
         groupIds: groupIds.value,
+        serviceAccountIds: serviceAccountIds.value,
+        serviceAccountKinds: serviceAccountKinds.value,
+        serviceAccountStatus: query.service_account_status,
         excludeUserIds: excludeUserIds.value,
         excludeGroupIds: excludeGroupIds.value,
         excludeServiceAccountIds: excludeServiceAccountIds.value,
@@ -155,7 +175,6 @@ export const createAccountsEntitiesRoutes = (dependencies: AccountsEntitiesRoute
         parentGroupId: query.parent_group_id,
         managedByUserId: query.managed_by_user_id,
         recursive: query.recursive === "true",
-        includePersonal: query.include_personal === "true",
       };
       if (!user) {
         const result = await (dependencies.searchShares ?? directoryShares.search)({