Administrator model catalog

The tenant catalog stores AI providers, models, defaults, model grants, and provider configuration. See administrator authorization before changing it.

Catalog records

The original catalog snapshot contains five providers and 33 models, from base-template/prisma/seeds/llm-providers.ts. It is historical seed data, not evidence of current provider pricing or capabilities. The current seed marker is ecas-2026-10-08-v7. Later catalog upgrades add versioned records. Unknown prices remain null rather than zero.

Tenant transactions and durable seed markers preserve administrator edits and intentional deletions. An unambiguous provider match can retain the existing ID. Adding models does not grant group access. A tenant default is a preference within the user's allowed model grants.

Seed, discovered, and manually configured metadata remain separate. The setup process can seed configured keys through its restricted setup path. Ordinary catalog reads do not expose keys.

Secrets and icons

Provider API keys and organization/project configuration use the admin key referenced by ECAS_ADMIN_ENCRYPTION_KEY_PATH. AES-256-GCM binds ciphertext to tenant and provider. Existing v1 key compatibility remains. Graph certificates do not encrypt these credentials. Key changes require separate permission and audit. Lists expose configuration state, not secret values.

PNG, JPEG, WebP, and simple SVG uploads become metadata-free PNGs no larger than 128×128 pixels. The server rejects active SVG and external resource references. PostgreSQL stores the tenant-owned bytes. This creates no S3 management access.

Model identity and limits

You cannot redirect an existing model UUID to a different provider/model identity. Create another record for that target. Display labels, limits, and prices remain editable. The server also prevents redirection of a referenced provider's protocol and destination.

See model setup and context limits for execution grants and sorter defaults for sorting choices.