@actuate-media/cms-core 0.42.0 → 0.43.0

package/dist/ai/usage.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage.d.ts","sourceRoot":"","sources":["../../src/ai/usage.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAA;AAgBhD;;;GAGG;AACH,wBAAsB,eAAe,CACnC,EAAE,EAAE,OAAO,EACX,MAAM,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,IAAI,CAAC;IAAC,GAAG,CAAC,EAAE,IAAI,CAAA;CAAE,GACpC,OAAO,CAAC,cAAc,CAAC,CAiDzB"}

package/dist/ai/usage.js

@@ -0,0 +1,70 @@
+/**
+ * AI usage aggregation.
+ *
+ * Until the dedicated per-run metering table lands (Phase 4), usage is derived
+ * from token totals already recorded in `actuate_audit_logs` (`details
+ * .totalTokensUsed` / `details.tokensUsed`). This returns REAL counts — it is 0
+ * when nothing has run, never a fabricated number.
+ */
+import { getAIConfig } from './config-store.js';
+/** First instant of the current calendar month (UTC). */
+function monthStart(now = new Date()) {
+    return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), 1, 0, 0, 0, 0));
+}
+/** First instant of the next calendar month (UTC). */
+function nextMonthStart(now = new Date()) {
+    return new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth() + 1, 1, 0, 0, 0, 0));
+}
+function num(value) {
+    return typeof value === 'number' && Number.isFinite(value) && value > 0 ? value : 0;
+}
+/**
+ * Sum token usage from audit-log entries within the period. Recognizes the
+ * fields current AI handlers write today and is tolerant of missing data.
+ */
+export async function getUsageSummary(db, period) {
+    const start = period?.start ?? monthStart();
+    const end = period?.end ?? nextMonthStart();
+    const config = await getAIConfig(db);
+    const monthlyTokenLimit = config.settings.budget.monthlyTokenLimit;
+    const base = {
+        totalTokens: 0,
+        promptTokens: 0,
+        completionTokens: 0,
+        monthlyTokenLimit,
+        periodStart: start.toISOString(),
+        periodEnd: end.toISOString(),
+        runCount: 0,
+    };
+    const d = db;
+    if (!d?.auditLog?.findMany)
+        return base;
+    let rows = [];
+    try {
+        rows = await d.auditLog.findMany({
+            where: { createdAt: { gte: start, lt: end } },
+            select: { details: true },
+        });
+    }
+    catch {
+        return base;
+    }
+    let totalTokens = 0;
+    let promptTokens = 0;
+    let completionTokens = 0;
+    let runCount = 0;
+    for (const row of rows) {
+        const details = (row?.details ?? {});
+        const total = num(details.totalTokensUsed) + num(details.tokensUsed) + num(details.totalTokens);
+        const prompt = num(details.promptTokens);
+        const completion = num(details.completionTokens);
+        if (total > 0 || prompt > 0 || completion > 0) {
+            runCount += 1;
+            totalTokens += total > 0 ? total : prompt + completion;
+            promptTokens += prompt;
+            completionTokens += completion;
+        }
+    }
+    return { ...base, totalTokens, promptTokens, completionTokens, runCount };
+}
+//# sourceMappingURL=usage.js.map

package/dist/ai/usage.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage.js","sourceRoot":"","sources":["../../src/ai/usage.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAA;AAG/C,yDAAyD;AACzD,SAAS,UAAU,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE;IAClC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AACnF,CAAC;AAED,sDAAsD;AACtD,SAAS,cAAc,CAAC,GAAG,GAAG,IAAI,IAAI,EAAE;IACtC,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,cAAc,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AACvF,CAAC;AAED,SAAS,GAAG,CAAC,KAAc;IACzB,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;AACrF,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAW,EACX,MAAqC;IAErC,MAAM,KAAK,GAAG,MAAM,EAAE,KAAK,IAAI,UAAU,EAAE,CAAA;IAC3C,MAAM,GAAG,GAAG,MAAM,EAAE,GAAG,IAAI,cAAc,EAAE,CAAA;IAE3C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,CAAC,CAAA;IACpC,MAAM,iBAAiB,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAiB,CAAA;IAElE,MAAM,IAAI,GAAmB;QAC3B,WAAW,EAAE,CAAC;QACd,YAAY,EAAE,CAAC;QACf,gBAAgB,EAAE,CAAC;QACnB,iBAAiB;QACjB,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE;QAChC,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,QAAQ,EAAE,CAAC;KACZ,CAAA;IAED,MAAM,CAAC,GAAG,EAAS,CAAA;IACnB,IAAI,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ;QAAE,OAAO,IAAI,CAAA;IAEvC,IAAI,IAAI,GAAgC,EAAE,CAAA;IAC1C,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAC/B,KAAK,EAAE,EAAE,SAAS,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE;YAC7C,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;SAC1B,CAAC,CAAA;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAA;IACb,CAAC;IAED,IAAI,WAAW,GAAG,CAAC,CAAA;IACnB,IAAI,YAAY,GAAG,CAAC,CAAA;IACpB,IAAI,gBAAgB,GAAG,CAAC,CAAA;IACxB,IAAI,QAAQ,GAAG,CAAC,CAAA;IAEhB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,EAAE,CAA4B,CAAA;QAC/D,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;QAC/F,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,YAAY,CAAC,CAAA;QACxC,MAAM,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAA;QAChD,IAAI,KAAK,GAAG,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,UAAU,GAAG,CAAC,EAAE,CAAC;YAC9C,QAAQ,IAAI,CAAC,CAAA;YACb,WAAW,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,UAAU,CAAA;YACtD,YAAY,IAAI,MAAM,CAAA;YACtB,gBAAgB,IAAI,UAAU,CAAA;QAChC,CAAC;IACH,CAAC;IAED,OAAO,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,YAAY,EAAE,gBAAgB,EAAE,QAAQ,EAAE,CAAA;AAC3E,CAAC"}

package/dist/api/handlers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAuhC5C,iFAAiF;AACjF,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AA8JD,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAiVD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAu/WzD"}
+{"version":3,"file":"handlers.d.ts","sourceRoot":"","sources":["../../src/api/handlers.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AAwhC5C,iFAAiF;AACjF,wBAAgB,wBAAwB,IAAI,IAAI,CAE/C;AA8JD,wBAAgB,iBAAiB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAS9E;AAiVD,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAqiYzD"}

package/dist/api/handlers.js

@@ -10073,6 +10073,483 @@ export function registerCMSRoutes(router) {
             return internalError(err, 'ai status');
         }
     });
+    // ---------------------------------------------------------------------------
+    // Settings > AI — provider connections, dynamic model catalog, feature flags.
+    // Backed by the `__ai_config__` config document (see `../ai/config-store.ts`).
+    // ADMIN-gated. Provider API keys are encrypted at rest and NEVER returned.
+    // ---------------------------------------------------------------------------
+    const AI_PROVIDER_KEYS = ['openai', 'anthropic', 'xai', 'custom'];
+    function isAiProviderKey(value) {
+        return typeof value === 'string' && AI_PROVIDER_KEYS.includes(value);
+    }
+    function defaultProviderName(provider) {
+        switch (provider) {
+            case 'openai':
+                return 'OpenAI';
+            case 'anthropic':
+                return 'Anthropic';
+            case 'xai':
+                return 'xAI (Grok)';
+            default:
+                return 'Custom provider';
+        }
+    }
+    router.get('/ai/settings', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const adminErr = requireAdminScope(auth.session);
+            if (adminErr)
+                return adminErr;
+            const { getAIConfig, toPublicConfig, getModels, resolveModelOrUnavailable } = await import('../ai/index.js');
+            const config = await getAIConfig(db());
+            const pub = toPublicConfig(config);
+            const catalog = await getModels(db());
+            const defaultModel = resolveModelOrUnavailable(config.settings.defaultModelId, catalog);
+            return json({
+                data: {
+                    settings: pub.settings,
+                    providers: pub.providers,
+                    defaultModel,
+                    updatedAt: config.updatedAt ?? null,
+                    updatedBy: config.updatedBy ?? null,
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'ai/settings GET');
+        }
+    });
+    router.put('/ai/settings', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const adminErr = requireAdminScope(auth.session);
+            if (adminErr)
+                return adminErr;
+            const body = (await request.json().catch(() => null));
+            if (!body || typeof body !== 'object') {
+                return errorResponse('Request body must be an object', 400);
+            }
+            const { getAIConfig, putAIConfig, getModels } = await import('../ai/index.js');
+            const config = await getAIConfig(db());
+            const catalog = await getModels(db());
+            // Validate the selected default provider exists.
+            if (body.defaultProviderId &&
+                !config.providers.some((p) => p.id === body.defaultProviderId)) {
+                return errorResponse('Selected provider is not connected', 400);
+            }
+            // Validate the selected default model is in the catalog and available.
+            if (body.defaultModelId) {
+                const model = catalog.find((m) => m.id === body.defaultModelId || m.providerModelId === body.defaultModelId);
+                if (!model)
+                    return errorResponse('Selected model is not in the catalog', 400);
+                if (model.status === 'unavailable') {
+                    return errorResponse('Selected model is currently unavailable', 400);
+                }
+            }
+            // Validate budget.
+            let monthlyTokenLimit = config.settings.budget.monthlyTokenLimit;
+            if (body.budget && 'monthlyTokenLimit' in body.budget) {
+                const v = body.budget.monthlyTokenLimit;
+                if (v === null)
+                    monthlyTokenLimit = undefined;
+                else if (typeof v === 'number' && Number.isFinite(v) && v >= 0)
+                    monthlyTokenLimit = v;
+                else
+                    return errorResponse('monthlyTokenLimit must be a non-negative number or null', 400);
+            }
+            // Apply feature toggles by key (ignore unknown keys).
+            const toggles = new Map((body.features ?? []).map((f) => [f.key, Boolean(f.enabled)]));
+            const nextFeatures = config.settings.features.map((f) => toggles.has(f.key) ? { ...f, enabled: toggles.get(f.key) } : f);
+            const changedFeatures = config.settings.features
+                .filter((f) => toggles.has(f.key) && toggles.get(f.key) !== f.enabled)
+                .map((f) => ({ key: f.key, from: f.enabled, to: toggles.get(f.key) }));
+            const nextSettings = {
+                ...config.settings,
+                defaultProviderId: body.defaultProviderId === null
+                    ? undefined
+                    : (body.defaultProviderId ?? config.settings.defaultProviderId),
+                defaultModelId: body.defaultModelId === null
+                    ? undefined
+                    : (body.defaultModelId ?? config.settings.defaultModelId),
+                features: nextFeatures,
+                budget: { ...config.settings.budget, monthlyTokenLimit },
+            };
+            const saved = await putAIConfig(db(), { ...config, settings: nextSettings }, auth.session.userId);
+            try {
+                await logEvent({
+                    event: 'update_ai_settings',
+                    userId: auth.session.userId,
+                    details: {
+                        defaultProviderId: nextSettings.defaultProviderId ?? null,
+                        defaultModelId: nextSettings.defaultModelId ?? null,
+                        monthlyTokenLimit: monthlyTokenLimit ?? null,
+                        changedFeatures,
+                        source: 'settings.ai',
+                    },
+                });
+            }
+            catch {
+                // Audit must never block the write.
+            }
+            const { toPublicConfig } = await import('../ai/index.js');
+            return json({ data: toPublicConfig(saved) });
+        }
+        catch (err) {
+            return internalError(err, 'ai/settings PUT');
+        }
+    });
+    router.post('/ai/providers', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const adminErr = requireAdminScope(auth.session);
+            if (adminErr)
+                return adminErr;
+            const body = (await request.json().catch(() => null));
+            if (!body || !isAiProviderKey(body.provider)) {
+                return errorResponse('A valid `provider` is required', 400);
+            }
+            const provider = body.provider;
+            if (provider === 'custom') {
+                if (!body.baseUrl || typeof body.baseUrl !== 'string') {
+                    return errorResponse('A `baseUrl` is required for a custom provider', 400);
+                }
+                const { validateWebhookUrl } = await import('../security/webhook.js');
+                const check = validateWebhookUrl(body.baseUrl);
+                if (!check.valid)
+                    return errorResponse(`Invalid baseUrl: ${check.error ?? 'unsafe'}`, 400);
+            }
+            const { getAIConfig, putAIConfig, encryptProviderKey, getEnvApiKey, resolveProviderKey, toPublicProvider, } = await import('../ai/index.js');
+            const { testConnection } = await import('../ai/providers/index.js');
+            const config = await getAIConfig(db());
+            const now = new Date().toISOString();
+            const envManaged = Boolean(getEnvApiKey(provider));
+            let apiKeyEncrypted;
+            let apiKeyLast4;
+            if (!envManaged && typeof body.apiKey === 'string' && body.apiKey.trim()) {
+                const enc = await encryptProviderKey(body.apiKey.trim());
+                apiKeyEncrypted = enc.apiKeyEncrypted;
+                apiKeyLast4 = enc.apiKeyLast4;
+            }
+            const connection = {
+                id: crypto.randomUUID(),
+                provider,
+                displayName: (typeof body.displayName === 'string' && body.displayName.trim()) ||
+                    defaultProviderName(provider),
+                enabled: body.enabled !== false,
+                status: 'unknown',
+                apiKeyEncrypted,
+                apiKeyLast4,
+                baseUrl: provider === 'custom' ? body.baseUrl : undefined,
+                organizationId: body.organizationId?.trim() || undefined,
+                projectId: body.projectId?.trim() || undefined,
+                lastTestedAt: undefined,
+                createdAt: now,
+                updatedAt: now,
+                updatedBy: auth.session.userId,
+            };
+            // Optional test-before-save.
+            if (body.test) {
+                const key = await resolveProviderKey(connection);
+                const result = await testConnection(provider, {
+                    apiKey: key ?? '',
+                    baseUrl: connection.baseUrl,
+                    organizationId: connection.organizationId,
+                    projectId: connection.projectId,
+                });
+                connection.status = result.status;
+                connection.lastTestedAt = result.testedAt;
+            }
+            const saved = await putAIConfig(db(), { ...config, providers: [...config.providers, connection] }, auth.session.userId);
+            try {
+                await logEvent({
+                    event: 'create_ai_provider',
+                    userId: auth.session.userId,
+                    details: {
+                        providerId: connection.id,
+                        provider,
+                        envManaged,
+                        tested: Boolean(body.test),
+                        status: connection.status,
+                        source: 'settings.ai',
+                    },
+                });
+            }
+            catch {
+                /* never block on audit */
+            }
+            const created = saved.providers.find((p) => p.id === connection.id);
+            return json({ data: toPublicProvider(created) }, 201);
+        }
+        catch (err) {
+            return internalError(err, 'ai/providers POST');
+        }
+    });
+    router.put('/ai/providers/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const adminErr = requireAdminScope(auth.session);
+            if (adminErr)
+                return adminErr;
+            const body = (await request.json().catch(() => null));
+            if (!body || typeof body !== 'object') {
+                return errorResponse('Request body must be an object', 400);
+            }
+            const { getAIConfig, putAIConfig, encryptProviderKey, getEnvApiKey, toPublicProvider } = await import('../ai/index.js');
+            const config = await getAIConfig(db());
+            const idx = config.providers.findIndex((p) => p.id === params.id);
+            if (idx === -1)
+                return errorResponse('Provider connection not found', 404);
+            const prev = config.providers[idx];
+            if (prev.provider === 'custom' && typeof body.baseUrl === 'string') {
+                const { validateWebhookUrl } = await import('../security/webhook.js');
+                const check = validateWebhookUrl(body.baseUrl);
+                if (!check.valid)
+                    return errorResponse(`Invalid baseUrl: ${check.error ?? 'unsafe'}`, 400);
+            }
+            const envManaged = Boolean(getEnvApiKey(prev.provider));
+            let { apiKeyEncrypted, apiKeyLast4 } = prev;
+            let keyChanged = false;
+            if (!envManaged && body.apiKey !== undefined) {
+                if (body.apiKey === null || body.apiKey === '') {
+                    apiKeyEncrypted = undefined;
+                    apiKeyLast4 = undefined;
+                    keyChanged = true;
+                }
+                else if (typeof body.apiKey === 'string' && body.apiKey.trim()) {
+                    const enc = await encryptProviderKey(body.apiKey.trim());
+                    apiKeyEncrypted = enc.apiKeyEncrypted;
+                    apiKeyLast4 = enc.apiKeyLast4;
+                    keyChanged = true;
+                }
+            }
+            const updated = {
+                ...prev,
+                displayName: typeof body.displayName === 'string' && body.displayName.trim()
+                    ? body.displayName.trim()
+                    : prev.displayName,
+                enabled: typeof body.enabled === 'boolean' ? body.enabled : prev.enabled,
+                baseUrl: prev.provider === 'custom' && typeof body.baseUrl === 'string'
+                    ? body.baseUrl
+                    : prev.baseUrl,
+                organizationId: body.organizationId === null
+                    ? undefined
+                    : (body.organizationId?.trim() ?? prev.organizationId),
+                projectId: body.projectId === null ? undefined : (body.projectId?.trim() ?? prev.projectId),
+                apiKeyEncrypted,
+                apiKeyLast4,
+                // A new key invalidates the previous test result.
+                status: keyChanged ? 'unknown' : prev.status,
+                lastTestedAt: keyChanged ? undefined : prev.lastTestedAt,
+                updatedAt: new Date().toISOString(),
+                updatedBy: auth.session.userId,
+            };
+            const nextProviders = [...config.providers];
+            nextProviders[idx] = updated;
+            const saved = await putAIConfig(db(), { ...config, providers: nextProviders }, auth.session.userId);
+            try {
+                await logEvent({
+                    event: 'update_ai_provider',
+                    userId: auth.session.userId,
+                    details: {
+                        providerId: prev.id,
+                        provider: prev.provider,
+                        keyChanged,
+                        source: 'settings.ai',
+                    },
+                });
+            }
+            catch {
+                /* never block on audit */
+            }
+            const out = saved.providers.find((p) => p.id === prev.id);
+            return json({ data: toPublicProvider(out) });
+        }
+        catch (err) {
+            return internalError(err, 'ai/providers PUT');
+        }
+    });
+    router.delete('/ai/providers/:id', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const adminErr = requireAdminScope(auth.session);
+            if (adminErr)
+                return adminErr;
+            const id = params.id;
+            if (!id)
+                return errorResponse('Provider connection not found', 404);
+            const { getAIConfig, putAIConfig } = await import('../ai/index.js');
+            const config = await getAIConfig(db());
+            const exists = config.providers.some((p) => p.id === id);
+            if (!exists)
+                return errorResponse('Provider connection not found', 404);
+            const nextCatalog = { ...(config.catalog ?? {}) };
+            delete nextCatalog[id];
+            // Clear default selectors that pointed at the removed provider.
+            const clearedProvider = config.settings.defaultProviderId === id;
+            const nextSettings = clearedProvider
+                ? { ...config.settings, defaultProviderId: undefined, defaultModelId: undefined }
+                : config.settings;
+            await putAIConfig(db(), {
+                ...config,
+                providers: config.providers.filter((p) => p.id !== id),
+                catalog: nextCatalog,
+                settings: nextSettings,
+            }, auth.session.userId);
+            try {
+                await logEvent({
+                    event: 'delete_ai_provider',
+                    userId: auth.session.userId,
+                    details: { providerId: id, source: 'settings.ai' },
+                });
+            }
+            catch {
+                /* never block on audit */
+            }
+            return json({ data: { id: params.id, deleted: true } });
+        }
+        catch (err) {
+            return internalError(err, 'ai/providers DELETE');
+        }
+    });
+    router.post('/ai/providers/:id/test', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const adminErr = requireAdminScope(auth.session);
+            if (adminErr)
+                return adminErr;
+            const { getAIConfig, putAIConfig, resolveProviderKey, toPublicProvider } = await import('../ai/index.js');
+            const { testConnection } = await import('../ai/providers/index.js');
+            const config = await getAIConfig(db());
+            const idx = config.providers.findIndex((p) => p.id === params.id);
+            if (idx === -1)
+                return errorResponse('Provider connection not found', 404);
+            const conn = config.providers[idx];
+            const key = await resolveProviderKey(conn);
+            const result = await testConnection(conn.provider, {
+                apiKey: key ?? '',
+                baseUrl: conn.baseUrl,
+                organizationId: conn.organizationId,
+                projectId: conn.projectId,
+            });
+            const updated = { ...conn, status: result.status, lastTestedAt: result.testedAt };
+            const nextProviders = [...config.providers];
+            nextProviders[idx] = updated;
+            const saved = await putAIConfig(db(), { ...config, providers: nextProviders }, auth.session.userId);
+            try {
+                await logEvent({
+                    event: 'test_ai_provider',
+                    userId: auth.session.userId,
+                    details: {
+                        providerId: conn.id,
+                        provider: conn.provider,
+                        status: result.status,
+                        source: 'settings.ai',
+                    },
+                });
+            }
+            catch {
+                /* never block on audit */
+            }
+            const out = saved.providers.find((p) => p.id === conn.id);
+            return json({ data: { provider: toPublicProvider(out), result } });
+        }
+        catch (err) {
+            return internalError(err, 'ai/providers test');
+        }
+    });
+    router.post('/ai/providers/:id/sync-models', async (request, params) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const adminErr = requireAdminScope(auth.session);
+            if (adminErr)
+                return adminErr;
+            const id = params.id;
+            if (!id)
+                return errorResponse('Provider connection not found', 404);
+            const { syncModels } = await import('../ai/index.js');
+            const result = await syncModels(db(), id).catch((err) => {
+                if (err instanceof Error && /not found/i.test(err.message))
+                    return null;
+                throw err;
+            });
+            if (!result)
+                return errorResponse('Provider connection not found', 404);
+            try {
+                await logEvent({
+                    event: 'sync_ai_models',
+                    userId: auth.session.userId,
+                    details: {
+                        providerId: id,
+                        modelCount: result.models.length,
+                        fromFallback: result.fromFallback,
+                        source: 'settings.ai',
+                    },
+                });
+            }
+            catch {
+                /* never block on audit */
+            }
+            return json({
+                data: {
+                    models: result.models,
+                    fromFallback: result.fromFallback,
+                    warning: result.warning ?? null,
+                },
+            });
+        }
+        catch (err) {
+            return internalError(err, 'ai/providers sync-models');
+        }
+    });
+    router.get('/ai/models', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const adminErr = requireAdminScope(auth.session);
+            if (adminErr)
+                return adminErr;
+            const url = new URL(request.url);
+            const connectionId = url.searchParams.get('connectionId') ?? undefined;
+            const provider = url.searchParams.get('provider') ?? undefined;
+            const { getModels } = await import('../ai/index.js');
+            const models = await getModels(db(), { connectionId, provider });
+            return json({ data: { models } });
+        }
+        catch (err) {
+            return internalError(err, 'ai/models GET');
+        }
+    });
+    router.get('/ai/usage/summary', async (request) => {
+        try {
+            const auth = await requireAuth(request);
+            if (auth.error)
+                return auth.error;
+            const adminErr = requireAdminScope(auth.session);
+            if (adminErr)
+                return adminErr;
+            const { getUsageSummary } = await import('../ai/index.js');
+            const summary = await getUsageSummary(db());
+            return json({ data: summary });
+        }
+        catch (err) {
+            return internalError(err, 'ai/usage/summary GET');
+        }
+    });
     router.put('/security', async (request) => {
         try {
             const auth = await requireAuth(request);