@aglyn/plugins-ai 1.0.0-beta.143

package/src/lib/server/ai-admin-org.js

@@ -0,0 +1,381 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { isLiveSubscriptionStatus, ORG_BILLING_DOC_ID, ORG_BILLING_SUBCOLLECTION, orgCogsInputFrom, pluginRequestFromWeb } from "@aglyn/aglyn/server";
+import { emailUnverifiedResponse, firebaseAdmin, isImpersonationSession, readOrgBilling } from "@aglyn/tenant-data-admin";
+import { assistUsageMonth } from "../usage/assist-usage.js";
+import { assistRefusalCounts } from "../usage/assist-refusals.js";
+import { readOrgAiUsageByUser } from "../usage/ai-usage-by-user.js";
+import { recordAdminAudit } from "@aglyn/tenant-data-admin/server/admin-audit";
+import { invalidIdTokenResponse } from "@aglyn/tenant-data-admin/server/id-token-refusal";
+import { addonKindFromPriceId } from "@aglyn/tenant-data-admin/server/billing-addons";
+import { orgMarginRow } from "@aglyn/aglyn/app-utils/margin-utilization";
+import { assistCogsAlertThresholdUsd, assistMarginMultiple } from "@aglyn/aglyn/app-utils/usage-budget";
+import { composeStaffOrgAiAddon, composeStaffOrgAiMargin, composeStaffOrgAiOverage, composeStaffOrgAiPool, composeStaffOrgAiTokens, emptyJobCounts, STAFF_ORG_AI_JOB_STATUSES } from "../usage/staff-org-ai.js";
+/**
+ * THE STAFF AI CARD'S BACKING READ (AGL-2930).
+ *
+ * One request composes everything the card on the staff org page shows: the
+ * add-on and when it was bought, the credit pool and its parts, the month's
+ * overage and the org's own ceilings, the refusal counter, the generation
+ * jobs, the per-user rollup and the margin. Staff-gated exactly as
+ * `/api/admin/org-usage` is, and read-only — every access below is a `get()`.
+ *
+ * ## The reads, stated
+ *
+ * The org document and its billing mirror; this month's `assistUsage`
+ * document; the newest usage rollup (for the contribution margin, the same
+ * read the margin route makes); a bounded page of `aiJobs`; the per-user
+ * rollup for the month; and, when the add-on is on, ONE Stripe subscription
+ * lookup that is cached in-process — see `addonSinceFor`.
+ *
+ * ## The `access` audit row
+ *
+ * Opening the card reads per-user attribution, which is the one thing on it
+ * that is about a person rather than a workspace. So the open is recorded to
+ * `adminAudit` as an ACCESS — `org.ai-viewed`, target the org's assist usage
+ * path — through the same writer that records a staff member opening a
+ * customer's email. No `subjectUid`: the row is about the org, and naming
+ * every uid on the leaderboard would put a row on ten people's pages for one
+ * staff glance at a table.
+ */ /** Generation jobs read per request; the counts are a floor past it. */ const JOBS_SCAN = 200;
+/** How many jobs the card lists. */ const JOBS_RECENT = 10;
+/** How many people the leaderboard names. */ const TOP_USERS = 10;
+/**
+ * How long a Stripe answer to "when was the add-on bought" is kept.
+ *
+ * The date does not move once the item exists, and the card is opened far
+ * more often than an add-on is bought, so the only cost of a stale entry is
+ * a card that says "since —" for up to this long after a purchase. The
+ * alternative — a Stripe round trip on every render — is the thing the brief
+ * forbade.
+ */ const ADDON_SINCE_TTL_MS = 15 * 60 * 1000;
+const addonSinceCache = new Map();
+/** Test seam: drop every cached Stripe answer. */ export function resetAddonSinceCache() {
+    addonSinceCache.clear();
+}
+/**
+ * The instant the add-on's subscription item was created, from Stripe.
+ *
+ * The org document carries the add-on as a quantity (`seatAddons.aiAddon`)
+ * and nothing about WHEN — the webhook mirrors items, not their dates. Stripe
+ * has it as `created` on the subscription item, found by the price id the
+ * add-on sells at (`addonKindFromPriceId`), so a rename or a price change
+ * does not lose it.
+ */ async function addonSinceFor(orgId) {
+    const cached = addonSinceCache.get(orgId);
+    if (cached && Date.now() - cached.at < ADDON_SINCE_TTL_MS) return cached;
+    const answer = await readAddonSince(orgId);
+    addonSinceCache.set(orgId, answer);
+    return answer;
+}
+async function readAddonSince(orgId) {
+    const at = Date.now();
+    const stripeKey = process.env.STRIPE_SECRET_KEY;
+    if (!stripeKey) return {
+        since: null,
+        sinceSource: 'unavailable',
+        at
+    };
+    try {
+        var _ref;
+        const customerId = (await readOrgBilling(orgId)).stripeCustomerId;
+        if (!customerId) return {
+            since: null,
+            sinceSource: 'no-subscription',
+            at
+        };
+        const response = await fetch(`https://api.stripe.com/v1/subscriptions?customer=${encodeURIComponent(String(customerId))}&status=all&limit=10`, {
+            headers: {
+                Authorization: `Bearer ${stripeKey}`
+            }
+        });
+        const payload = await response.json().catch(()=>null);
+        if (!response.ok) {
+            var _ref1;
+            var _payload_error;
+            console.error('[ai/admin/org] Stripe subscription lookup failed', {
+                orgId,
+                status: response.status,
+                detail: (_ref1 = payload == null ? void 0 : (_payload_error = payload.error) == null ? void 0 : _payload_error.message) != null ? _ref1 : null
+            });
+            return {
+                since: null,
+                sinceSource: 'unavailable',
+                at
+            };
+        }
+        const subscriptions = (_ref = payload == null ? void 0 : payload.data) != null ? _ref : [];
+        // The LIVE subscription's item, when one exists: an add-on on a canceled
+        // subscription is not an add-on the org has, and `hasAiAddon` already
+        // says so — the date beside "off" would only confuse.
+        const live = subscriptions.filter((subscription)=>isLiveSubscriptionStatus(subscription.status));
+        for (const subscription of live.length ? live : subscriptions){
+            var _ref2;
+            var _subscription_items;
+            for (const item of (_ref2 = (_subscription_items = subscription.items) == null ? void 0 : _subscription_items.data) != null ? _ref2 : []){
+                var _item_price;
+                if (addonKindFromPriceId((_item_price = item.price) == null ? void 0 : _item_price.id) !== 'aiAddon') continue;
+                const created = Number(item.created);
+                if (Number.isFinite(created) && created > 0) {
+                    return {
+                        since: new Date(created * 1000).toISOString(),
+                        sinceSource: 'stripe',
+                        at
+                    };
+                }
+            }
+        }
+        return {
+            since: null,
+            sinceSource: 'stripe',
+            at
+        };
+    } catch (error) {
+        console.error('[ai/admin/org] Stripe subscription lookup threw', error);
+        return {
+            since: null,
+            sinceSource: 'unavailable',
+            at
+        };
+    }
+}
+const toIso = (value)=>{
+    var _value_toDate;
+    const converted = value == null ? void 0 : (_value_toDate = value.toDate) == null ? void 0 : _value_toDate.call(value);
+    if (converted instanceof Date) return converted.toISOString();
+    if (value instanceof Date) return value.toISOString();
+    return null;
+};
+/**
+ * The month's generation jobs, summarized (AGL-2904's collection).
+ *
+ * Reads `orgs/{orgId}/aiJobs` by `createdAt` from the first instant of the
+ * month, newest first, up to `JOBS_SCAN`. An org with no such collection
+ * answers an empty snapshot, which is the honest "no generation jobs yet";
+ * a read that FAILED answers `null`, which the card renders as a failure
+ * rather than as an idle org. The field names are the ones `AiJob` declares
+ * in `ai-jobs.types.ts`: `kind`, `status`, `creditsReserved`, `creditsSpent`,
+ * `createdAt`, `createdBy`.
+ */ export async function readOrgAiJobsSummary(firestore, orgId, month) {
+    try {
+        const monthStart = new Date(`${month}-01T00:00:00.000Z`);
+        const snapshot = await firestore.collection('orgs').doc(orgId).collection('aiJobs').where('createdAt', '>=', monthStart).orderBy('createdAt', 'desc').limit(JOBS_SCAN + 1).get();
+        const truncated = snapshot.docs.length > JOBS_SCAN;
+        const docs = truncated ? snapshot.docs.slice(0, JOBS_SCAN) : snapshot.docs;
+        const counts = emptyJobCounts();
+        const recent = [];
+        for (const doc of docs){
+            var _doc_get;
+            const status = String((_doc_get = doc.get('status')) != null ? _doc_get : '');
+            if (STAFF_ORG_AI_JOB_STATUSES.includes(status)) {
+                counts[status] += 1;
+            }
+            if (recent.length < JOBS_RECENT) {
+                var _doc_get1, _doc_get2, _doc_get3;
+                recent.push({
+                    id: doc.id,
+                    kind: String((_doc_get1 = doc.get('kind')) != null ? _doc_get1 : ''),
+                    status,
+                    creditsReserved: Number((_doc_get2 = doc.get('creditsReserved')) != null ? _doc_get2 : 0) || 0,
+                    creditsSpent: Number((_doc_get3 = doc.get('creditsSpent')) != null ? _doc_get3 : 0) || 0,
+                    createdAt: toIso(doc.get('createdAt')),
+                    createdBy: typeof doc.get('createdBy') === 'string' ? String(doc.get('createdBy')) : null
+                });
+            }
+        }
+        return {
+            counts,
+            recent,
+            truncated
+        };
+    } catch (error) {
+        console.error('[ai/admin/org] jobs read failed', error);
+        return null;
+    }
+}
+/**
+ * The month's per-user rollup, dearest first (AGL-2928).
+ *
+ * `readOrgAiUsageByUser` is the one reader of
+ * `orgs/{orgId}/aiUsageByUser/{uid}/months/{month}` — the customer's Usage
+ * table reads through it too — joined to the roster for names and carrying
+ * each person's share of the org's measured spend. The card keeps the
+ * dearest `TOP_USERS`.
+ */ async function readOrgAiTopUsers(firestore, orgId, month) {
+    try {
+        const usage = await readOrgAiUsageByUser(firestore, orgId, month);
+        return usage.rows.slice(0, TOP_USERS).map((row)=>({
+                uid: row.uid,
+                name: row.name,
+                credits: row.credits,
+                estCostUsd: row.estCostUsd,
+                share: row.share,
+                requests: row.requests,
+                refusals: row.refusals,
+                byKind: row.byKind,
+                byHost: row.byHost
+            }));
+    } catch (error) {
+        console.error('[ai/admin/org] per-user read failed', error);
+        return [];
+    }
+}
+async function handler(request) {
+    var _headers_authorization, _query_orgId;
+    const { method, query, headers: rawHeaders } = await pluginRequestFromWeb(request);
+    const headers = rawHeaders;
+    if (method !== 'GET') {
+        return Response.json({
+            error: 'Method not allowed'
+        }, {
+            status: 405
+        });
+    }
+    const authorization = (_headers_authorization = headers.authorization) != null ? _headers_authorization : '';
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return Response.json({
+        error: 'Unauthenticated'
+    }, {
+        status: 401
+    });
+    const orgId = String((_query_orgId = query.orgId) != null ? _query_orgId : '');
+    if (!orgId) return Response.json({
+        error: 'Missing orgId'
+    }, {
+        status: 400
+    });
+    try {
+        var _orgSnap_data, _monthSnap_data, _org_name, _rollupDoc_get, _ref, _ref1, _ref2;
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        if (!decoded.email_verified && !isImpersonationSession(decoded)) {
+            return emailUnverifiedResponse();
+        }
+        if (!decoded['staff']) {
+            return Response.json({
+                error: 'Staff only'
+            }, {
+                status: 403
+            });
+        }
+        const now = new Date();
+        const month = assistUsageMonth(now);
+        const db = firebaseAdmin.app().firestore();
+        const orgRef = db.collection('orgs').doc(orgId);
+        const [orgSnap, billingSnap, monthSnap, rollupSnap] = await Promise.all([
+            orgRef.get(),
+            orgRef.collection(ORG_BILLING_SUBCOLLECTION).doc(ORG_BILLING_DOC_ID).get(),
+            orgRef.collection('assistUsage').doc(month).get(),
+            orgRef.collection('usage').orderBy('month', 'desc').limit(1).get()
+        ]);
+        if (!orgSnap.exists) {
+            return Response.json({
+                error: 'No such organization'
+            }, {
+                status: 404
+            });
+        }
+        // Org doc FIRST so a stale inline `subscription` loses to the billing
+        // mirror — the same merge the margin route and the org detail read make.
+        const org = _extends({}, (_orgSnap_data = orgSnap.data()) != null ? _orgSnap_data : {}, billingSnap.exists ? billingSnap.data() : {});
+        const monthDoc = monthSnap.exists ? (_monthSnap_data = monthSnap.data()) != null ? _monthSnap_data : {} : null;
+        /*
+     * The row is written BEFORE the person-shaped read is served, and it is
+     * awaited: a card that rendered the leaderboard and then failed to
+     * record the look would be the access this collection exists to never
+     * lose. A failed write logs and still serves — the card is not a closed
+     * collection the way the delivery log is — but the order is the point.
+     */ try {
+            await recordAdminAudit({
+                actorUid: decoded.uid,
+                action: 'org.ai-viewed',
+                target: `orgs/${orgId}/assistUsage`,
+                note: `AI card opened for ${month}`
+            });
+        } catch (error) {
+            console.error('[ai/admin/org] audit write failed', error);
+        }
+        const [jobs, users, since] = await Promise.all([
+            readOrgAiJobsSummary(db, orgId, month),
+            readOrgAiTopUsers(db, orgId, month),
+            addonSinceFor(orgId)
+        ]);
+        const pool = composeStaffOrgAiPool(org, monthDoc, now);
+        // The overage line is an invoice, so it is priced off what the month
+        // DREW; everything below it is our bill, so it reads what the month
+        // COST (AGL-3015).
+        const overage = composeStaffOrgAiOverage(org, pool.billedUsd);
+        const addon = composeStaffOrgAiAddon(org, {
+            since: since.since,
+            sinceSource: since.sinceSource
+        });
+        const thresholdUsd = assistCogsAlertThresholdUsd(process.env.ASSIST_ORG_MONTHLY_COGS_ALERT_USD);
+        const rollupDoc = rollupSnap.docs[0];
+        // The whole-org contribution margin, on the same row the margin
+        // utilization page builds — with THIS month's live assist spend in
+        // place of the figure frozen onto the rollup, as that route does.
+        const contributionRow = rollupDoc ? orgMarginRow({
+            orgId,
+            name: (_org_name = org['name']) != null ? _org_name : null,
+            org: org,
+            month: String((_rollupDoc_get = rollupDoc.get('month')) != null ? _rollupDoc_get : rollupDoc.id),
+            rollup: _extends({}, orgCogsInputFrom(rollupDoc.data()), {
+                assistCostUsd: pool.providerUsd
+            })
+        }) : null;
+        const margin = composeStaffOrgAiMargin({
+            org: org,
+            pool,
+            overage,
+            addon,
+            thresholdUsd,
+            multiple: assistMarginMultiple(pool.providerUsd, thresholdUsd),
+            contribution: {
+                month: (_ref = contributionRow == null ? void 0 : contributionRow.month) != null ? _ref : null,
+                marginPct: (_ref1 = contributionRow == null ? void 0 : contributionRow.marginPct) != null ? _ref1 : null,
+                rating: (_ref2 = contributionRow == null ? void 0 : contributionRow.rating) != null ? _ref2 : null
+            }
+        });
+        const body = {
+            month,
+            addon,
+            pool,
+            overage,
+            refusals: assistRefusalCounts(monthDoc == null ? void 0 : monthDoc['refusals']),
+            jobs,
+            users,
+            margin,
+            tokens: composeStaffOrgAiTokens(monthDoc)
+        };
+        return Response.json(body, {
+            status: 200
+        });
+    } catch (error) {
+        // An unverifiable credential is a 401, not a fault of ours
+        // (AGL-1993). Null for anything else, so a real failure keeps its 500.
+        const unauthenticated = invalidIdTokenResponse(error);
+        if (unauthenticated) return unauthenticated;
+        console.error('[ai/admin/org]', error);
+        return Response.json({
+            error: 'AI lookup failed'
+        }, {
+            status: 500
+        });
+    }
+}
+export { handler as GET };
+
+//# sourceMappingURL=ai-admin-org.js.map

package/src/lib/server/ai-admin-org.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/ai/src/lib/server/ai-admin-org.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport {\n  isLiveSubscriptionStatus,\n  ORG_BILLING_DOC_ID,\n  ORG_BILLING_SUBCOLLECTION,\n  orgCogsInputFrom,\n  pluginRequestFromWeb,\n} from '@aglyn/aglyn/server'\nimport {\n  emailUnverifiedResponse,\n  firebaseAdmin,\n  isImpersonationSession,\n  readOrgBilling,\n} from '@aglyn/tenant-data-admin'\nimport { assistUsageMonth } from '../usage/assist-usage'\nimport { assistRefusalCounts } from '../usage/assist-refusals'\nimport { readOrgAiUsageByUser } from '../usage/ai-usage-by-user'\nimport { recordAdminAudit } from '@aglyn/tenant-data-admin/server/admin-audit'\nimport { invalidIdTokenResponse } from '@aglyn/tenant-data-admin/server/id-token-refusal'\nimport { addonKindFromPriceId } from '@aglyn/tenant-data-admin/server/billing-addons'\nimport { orgMarginRow } from '@aglyn/aglyn/app-utils/margin-utilization'\nimport {\n  assistCogsAlertThresholdUsd,\n  assistMarginMultiple,\n} from '@aglyn/aglyn/app-utils/usage-budget'\nimport {\n  composeStaffOrgAiAddon,\n  composeStaffOrgAiMargin,\n  composeStaffOrgAiOverage,\n  composeStaffOrgAiPool,\n  composeStaffOrgAiTokens,\n  emptyJobCounts,\n  STAFF_ORG_AI_JOB_STATUSES,\n  type StaffOrgAiAddon,\n  type StaffOrgAiJob,\n  type StaffOrgAiJobs,\n  type StaffOrgAiResponse,\n  type StaffOrgAiUser,\n} from '../usage/staff-org-ai'\n\n/**\n * THE STAFF AI CARD'S BACKING READ (AGL-2930).\n *\n * One request composes everything the card on the staff org page shows: the\n * add-on and when it was bought, the credit pool and its parts, the month's\n * overage and the org's own ceilings, the refusal counter, the generation\n * jobs, the per-user rollup and the margin. Staff-gated exactly as\n * `/api/admin/org-usage` is, and read-only — every access below is a `get()`.\n *\n * ## The reads, stated\n *\n * The org document and its billing mirror; this month's `assistUsage`\n * document; the newest usage rollup (for the contribution margin, the same\n * read the margin route makes); a bounded page of `aiJobs`; the per-user\n * rollup for the month; and, when the add-on is on, ONE Stripe subscription\n * lookup that is cached in-process — see `addonSinceFor`.\n *\n * ## The `access` audit row\n *\n * Opening the card reads per-user attribution, which is the one thing on it\n * that is about a person rather than a workspace. So the open is recorded to\n * `adminAudit` as an ACCESS — `org.ai-viewed`, target the org's assist usage\n * path — through the same writer that records a staff member opening a\n * customer's email. No `subjectUid`: the row is about the org, and naming\n * every uid on the leaderboard would put a row on ten people's pages for one\n * staff glance at a table.\n */\n\n/** Generation jobs read per request; the counts are a floor past it. */\nconst JOBS_SCAN = 200\n\n/** How many jobs the card lists. */\nconst JOBS_RECENT = 10\n\n/** How many people the leaderboard names. */\nconst TOP_USERS = 10\n\n/**\n * How long a Stripe answer to \"when was the add-on bought\" is kept.\n *\n * The date does not move once the item exists, and the card is opened far\n * more often than an add-on is bought, so the only cost of a stale entry is\n * a card that says \"since —\" for up to this long after a purchase. The\n * alternative — a Stripe round trip on every render — is the thing the brief\n * forbade.\n */\nconst ADDON_SINCE_TTL_MS = 15 * 60 * 1000\n\ninterface AddonSince {\n  since: string | null\n  sinceSource: StaffOrgAiAddon['sinceSource']\n  at: number\n}\n\nconst addonSinceCache = new Map<string, AddonSince>()\n\n/** Test seam: drop every cached Stripe answer. */\nexport function resetAddonSinceCache(): void {\n  addonSinceCache.clear()\n}\n\n/**\n * The instant the add-on's subscription item was created, from Stripe.\n *\n * The org document carries the add-on as a quantity (`seatAddons.aiAddon`)\n * and nothing about WHEN — the webhook mirrors items, not their dates. Stripe\n * has it as `created` on the subscription item, found by the price id the\n * add-on sells at (`addonKindFromPriceId`), so a rename or a price change\n * does not lose it.\n */\nasync function addonSinceFor(orgId: string): Promise<AddonSince> {\n  const cached = addonSinceCache.get(orgId)\n  if (cached && Date.now() - cached.at < ADDON_SINCE_TTL_MS) return cached\n  const answer = await readAddonSince(orgId)\n  addonSinceCache.set(orgId, answer)\n  return answer\n}\n\nasync function readAddonSince(orgId: string): Promise<AddonSince> {\n  const at = Date.now()\n  const stripeKey = process.env.STRIPE_SECRET_KEY\n  if (!stripeKey) return { since: null, sinceSource: 'unavailable', at }\n  try {\n    const customerId = (await readOrgBilling(orgId)).stripeCustomerId\n    if (!customerId) return { since: null, sinceSource: 'no-subscription', at }\n    const response = await fetch(\n      `https://api.stripe.com/v1/subscriptions?customer=${encodeURIComponent(\n        String(customerId),\n      )}&status=all&limit=10`,\n      { headers: { Authorization: `Bearer ${stripeKey}` } },\n    )\n    const payload = await response.json().catch(() => null)\n    if (!response.ok) {\n      console.error('[ai/admin/org] Stripe subscription lookup failed', {\n        orgId,\n        status: response.status,\n        detail: payload?.error?.message ?? null,\n      })\n      return { since: null, sinceSource: 'unavailable', at }\n    }\n    const subscriptions = (payload?.data ?? []) as Array<{\n      status?: string\n      items?: { data?: Array<{ created?: number; price?: { id?: string } }> }\n    }>\n    // The LIVE subscription's item, when one exists: an add-on on a canceled\n    // subscription is not an add-on the org has, and `hasAiAddon` already\n    // says so — the date beside \"off\" would only confuse.\n    const live = subscriptions.filter((subscription) =>\n      isLiveSubscriptionStatus(subscription.status),\n    )\n    for (const subscription of live.length ? live : subscriptions) {\n      for (const item of subscription.items?.data ?? []) {\n        if (addonKindFromPriceId(item.price?.id) !== 'aiAddon') continue\n        const created = Number(item.created)\n        if (Number.isFinite(created) && created > 0) {\n          return {\n            since: new Date(created * 1000).toISOString(),\n            sinceSource: 'stripe',\n            at,\n          }\n        }\n      }\n    }\n    return { since: null, sinceSource: 'stripe', at }\n  } catch (error) {\n    console.error('[ai/admin/org] Stripe subscription lookup threw', error)\n    return { since: null, sinceSource: 'unavailable', at }\n  }\n}\n\nconst toIso = (value: unknown): string | null => {\n  const converted = (value as { toDate?: () => Date } | null)?.toDate?.()\n  if (converted instanceof Date) return converted.toISOString()\n  if (value instanceof Date) return value.toISOString()\n  return null\n}\n\n/**\n * The month's generation jobs, summarized (AGL-2904's collection).\n *\n * Reads `orgs/{orgId}/aiJobs` by `createdAt` from the first instant of the\n * month, newest first, up to `JOBS_SCAN`. An org with no such collection\n * answers an empty snapshot, which is the honest \"no generation jobs yet\";\n * a read that FAILED answers `null`, which the card renders as a failure\n * rather than as an idle org. The field names are the ones `AiJob` declares\n * in `ai-jobs.types.ts`: `kind`, `status`, `creditsReserved`, `creditsSpent`,\n * `createdAt`, `createdBy`.\n */\nexport async function readOrgAiJobsSummary(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n  month: string,\n): Promise<StaffOrgAiJobs | null> {\n  try {\n    const monthStart = new Date(`${month}-01T00:00:00.000Z`)\n    const snapshot = await firestore\n      .collection('orgs')\n      .doc(orgId)\n      .collection('aiJobs')\n      .where('createdAt', '>=', monthStart)\n      .orderBy('createdAt', 'desc')\n      .limit(JOBS_SCAN + 1)\n      .get()\n    const truncated = snapshot.docs.length > JOBS_SCAN\n    const docs = truncated ? snapshot.docs.slice(0, JOBS_SCAN) : snapshot.docs\n    const counts = emptyJobCounts()\n    const recent: StaffOrgAiJob[] = []\n    for (const doc of docs) {\n      const status = String(doc.get('status') ?? '')\n      if ((STAFF_ORG_AI_JOB_STATUSES as readonly string[]).includes(status)) {\n        counts[status as keyof typeof counts] += 1\n      }\n      if (recent.length < JOBS_RECENT) {\n        recent.push({\n          id: doc.id,\n          kind: String(doc.get('kind') ?? ''),\n          status,\n          creditsReserved: Number(doc.get('creditsReserved') ?? 0) || 0,\n          creditsSpent: Number(doc.get('creditsSpent') ?? 0) || 0,\n          createdAt: toIso(doc.get('createdAt')),\n          createdBy:\n            typeof doc.get('createdBy') === 'string'\n              ? String(doc.get('createdBy'))\n              : null,\n        })\n      }\n    }\n    return { counts, recent, truncated }\n  } catch (error) {\n    console.error('[ai/admin/org] jobs read failed', error)\n    return null\n  }\n}\n\n/**\n * The month's per-user rollup, dearest first (AGL-2928).\n *\n * `readOrgAiUsageByUser` is the one reader of\n * `orgs/{orgId}/aiUsageByUser/{uid}/months/{month}` — the customer's Usage\n * table reads through it too — joined to the roster for names and carrying\n * each person's share of the org's measured spend. The card keeps the\n * dearest `TOP_USERS`.\n */\nasync function readOrgAiTopUsers(\n  firestore: FirebaseFirestore.Firestore,\n  orgId: string,\n  month: string,\n): Promise<StaffOrgAiUser[]> {\n  try {\n    const usage = await readOrgAiUsageByUser(firestore, orgId, month)\n    return usage.rows.slice(0, TOP_USERS).map((row) => ({\n      uid: row.uid,\n      name: row.name,\n      credits: row.credits,\n      estCostUsd: row.estCostUsd,\n      share: row.share,\n      requests: row.requests,\n      refusals: row.refusals,\n      byKind: row.byKind,\n      byHost: row.byHost,\n    }))\n  } catch (error) {\n    console.error('[ai/admin/org] per-user read failed', error)\n    return []\n  }\n}\n\nasync function handler(request: Request): Promise<Response> {\n  const {\n    method,\n    query,\n    headers: rawHeaders,\n  } = await pluginRequestFromWeb(request)\n  const headers = rawHeaders as Partial<Record<string, string>>\n  if (method !== 'GET') {\n    return Response.json({ error: 'Method not allowed' }, { status: 405 })\n  }\n  const authorization = headers.authorization ?? ''\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken)\n    return Response.json({ error: 'Unauthenticated' }, { status: 401 })\n  const orgId = String(query.orgId ?? '')\n  if (!orgId) return Response.json({ error: 'Missing orgId' }, { status: 400 })\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    if (!decoded.email_verified && !isImpersonationSession(decoded)) {\n      return emailUnverifiedResponse()\n    }\n    if (!decoded['staff']) {\n      return Response.json({ error: 'Staff only' }, { status: 403 })\n    }\n\n    const now = new Date()\n    const month = assistUsageMonth(now)\n    const db = firebaseAdmin.app().firestore()\n    const orgRef = db.collection('orgs').doc(orgId)\n\n    const [orgSnap, billingSnap, monthSnap, rollupSnap] = await Promise.all([\n      orgRef.get(),\n      orgRef.collection(ORG_BILLING_SUBCOLLECTION).doc(ORG_BILLING_DOC_ID).get(),\n      orgRef.collection('assistUsage').doc(month).get(),\n      orgRef.collection('usage').orderBy('month', 'desc').limit(1).get(),\n    ])\n    if (!orgSnap.exists) {\n      return Response.json({ error: 'No such organization' }, { status: 404 })\n    }\n    // Org doc FIRST so a stale inline `subscription` loses to the billing\n    // mirror — the same merge the margin route and the org detail read make.\n    const org = {\n      ...(orgSnap.data() ?? {}),\n      ...(billingSnap.exists ? billingSnap.data() : {}),\n    } as Record<string, unknown>\n    const monthDoc = monthSnap.exists ? (monthSnap.data() ?? {}) : null\n\n    /*\n     * The row is written BEFORE the person-shaped read is served, and it is\n     * awaited: a card that rendered the leaderboard and then failed to\n     * record the look would be the access this collection exists to never\n     * lose. A failed write logs and still serves — the card is not a closed\n     * collection the way the delivery log is — but the order is the point.\n     */\n    try {\n      await recordAdminAudit({\n        actorUid: decoded.uid,\n        action: 'org.ai-viewed',\n        target: `orgs/${orgId}/assistUsage`,\n        note: `AI card opened for ${month}`,\n      })\n    } catch (error) {\n      console.error('[ai/admin/org] audit write failed', error)\n    }\n\n    const [jobs, users, since] = await Promise.all([\n      readOrgAiJobsSummary(db, orgId, month),\n      readOrgAiTopUsers(db, orgId, month),\n      addonSinceFor(orgId),\n    ])\n\n    const pool = composeStaffOrgAiPool(org as never, monthDoc, now)\n    // The overage line is an invoice, so it is priced off what the month\n    // DREW; everything below it is our bill, so it reads what the month\n    // COST (AGL-3015).\n    const overage = composeStaffOrgAiOverage(org as never, pool.billedUsd)\n    const addon = composeStaffOrgAiAddon(org as never, {\n      since: since.since,\n      sinceSource: since.sinceSource,\n    })\n    const thresholdUsd = assistCogsAlertThresholdUsd(\n      process.env.ASSIST_ORG_MONTHLY_COGS_ALERT_USD,\n    )\n    const rollupDoc = rollupSnap.docs[0]\n    // The whole-org contribution margin, on the same row the margin\n    // utilization page builds — with THIS month's live assist spend in\n    // place of the figure frozen onto the rollup, as that route does.\n    const contributionRow = rollupDoc\n      ? orgMarginRow({\n          orgId,\n          name: (org['name'] as string | undefined) ?? null,\n          org: org as never,\n          month: String(rollupDoc.get('month') ?? rollupDoc.id),\n          rollup: {\n            ...orgCogsInputFrom(rollupDoc.data()),\n            assistCostUsd: pool.providerUsd,\n          },\n        })\n      : null\n    const margin = composeStaffOrgAiMargin({\n      org: org as never,\n      pool,\n      overage,\n      addon,\n      thresholdUsd,\n      multiple: assistMarginMultiple(pool.providerUsd, thresholdUsd),\n      contribution: {\n        month: contributionRow?.month ?? null,\n        marginPct: contributionRow?.marginPct ?? null,\n        rating: contributionRow?.rating ?? null,\n      },\n    })\n\n    const body: StaffOrgAiResponse = {\n      month,\n      addon,\n      pool,\n      overage,\n      refusals: assistRefusalCounts(monthDoc?.['refusals']),\n      jobs,\n      users,\n      margin,\n      tokens: composeStaffOrgAiTokens(monthDoc),\n    }\n    return Response.json(body, { status: 200 })\n  } catch (error) {\n    // An unverifiable credential is a 401, not a fault of ours\n    // (AGL-1993). Null for anything else, so a real failure keeps its 500.\n    const unauthenticated = invalidIdTokenResponse(error)\n    if (unauthenticated) return unauthenticated\n    console.error('[ai/admin/org]', error)\n    return Response.json({ error: 'AI lookup failed' }, { status: 500 })\n  }\n}\n\nexport { handler as GET }\n"],"names":["isLiveSubscriptionStatus","ORG_BILLING_DOC_ID","ORG_BILLING_SUBCOLLECTION","orgCogsInputFrom","pluginRequestFromWeb","emailUnverifiedResponse","firebaseAdmin","isImpersonationSession","readOrgBilling","assistUsageMonth","assistRefusalCounts","readOrgAiUsageByUser","recordAdminAudit","invalidIdTokenResponse","addonKindFromPriceId","orgMarginRow","assistCogsAlertThresholdUsd","assistMarginMultiple","composeStaffOrgAiAddon","composeStaffOrgAiMargin","composeStaffOrgAiOverage","composeStaffOrgAiPool","composeStaffOrgAiTokens","emptyJobCounts","STAFF_ORG_AI_JOB_STATUSES","JOBS_SCAN","JOBS_RECENT","TOP_USERS","ADDON_SINCE_TTL_MS","addonSinceCache","Map","resetAddonSinceCache","clear","addonSinceFor","orgId","cached","get","Date","now","at","answer","readAddonSince","set","stripeKey","process","env","STRIPE_SECRET_KEY","since","sinceSource","customerId","stripeCustomerId","response","fetch","encodeURIComponent","String","headers","Authorization","payload","json","catch","ok","console","error","status","detail","message","subscriptions","data","live","filter","subscription","length","item","items","price","id","created","Number","isFinite","toISOString","toIso","value","converted","toDate","readOrgAiJobsSummary","firestore","month","monthStart","snapshot","collection","doc","where","orderBy","limit","truncated","docs","slice","counts","recent","includes","push","kind","creditsReserved","creditsSpent","createdAt","createdBy","readOrgAiTopUsers","usage","rows","map","row","uid","name","credits","estCostUsd","share","requests","refusals","byKind","byHost","handler","request","query","method","rawHeaders","Response","authorization","idToken","startsWith","undefined","orgSnap","monthSnap","org","rollupDoc","decoded","app","auth","verifyIdToken","email_verified","db","orgRef","billingSnap","rollupSnap","Promise","all","exists","monthDoc","actorUid","action","target","note","jobs","users","pool","overage","billedUsd","addon","thresholdUsd","ASSIST_ORG_MONTHLY_COGS_ALERT_USD","contributionRow","rollup","assistCostUsd","providerUsd","margin","multiple","contribution","marginPct","rating","body","tokens","unauthenticated","GET"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,SACEA,wBAAwB,EACxBC,kBAAkB,EAClBC,yBAAyB,EACzBC,gBAAgB,EAChBC,oBAAoB,QACf,sBAAqB;AAC5B,SACEC,uBAAuB,EACvBC,aAAa,EACbC,sBAAsB,EACtBC,cAAc,QACT,2BAA0B;AACjC,SAASC,gBAAgB,QAAQ,2BAAuB;AACxD,SAASC,mBAAmB,QAAQ,8BAA0B;AAC9D,SAASC,oBAAoB,QAAQ,+BAA2B;AAChE,SAASC,gBAAgB,QAAQ,8CAA6C;AAC9E,SAASC,sBAAsB,QAAQ,mDAAkD;AACzF,SAASC,oBAAoB,QAAQ,iDAAgD;AACrF,SAASC,YAAY,QAAQ,4CAA2C;AACxE,SACEC,2BAA2B,EAC3BC,oBAAoB,QACf,sCAAqC;AAC5C,SACEC,sBAAsB,EACtBC,uBAAuB,EACvBC,wBAAwB,EACxBC,qBAAqB,EACrBC,uBAAuB,EACvBC,cAAc,EACdC,yBAAyB,QAMpB,2BAAuB;AAE9B;;;;;;;;;;;;;;;;;;;;;;;;;;CA0BC,GAED,sEAAsE,GACtE,MAAMC,YAAY;AAElB,kCAAkC,GAClC,MAAMC,cAAc;AAEpB,2CAA2C,GAC3C,MAAMC,YAAY;AAElB;;;;;;;;CAQC,GACD,MAAMC,qBAAqB,KAAK,KAAK;AAQrC,MAAMC,kBAAkB,IAAIC;AAE5B,gDAAgD,GAChD,OAAO,SAASC;IACdF,gBAAgBG,KAAK;AACvB;AAEA;;;;;;;;CAQC,GACD,eAAeC,cAAcC,KAAa;IACxC,MAAMC,SAASN,gBAAgBO,GAAG,CAACF;IACnC,IAAIC,UAAUE,KAAKC,GAAG,KAAKH,OAAOI,EAAE,GAAGX,oBAAoB,OAAOO;IAClE,MAAMK,SAAS,MAAMC,eAAeP;IACpCL,gBAAgBa,GAAG,CAACR,OAAOM;IAC3B,OAAOA;AACT;AAEA,eAAeC,eAAeP,KAAa;IACzC,MAAMK,KAAKF,KAAKC,GAAG;IACnB,MAAMK,YAAYC,QAAQC,GAAG,CAACC,iBAAiB;IAC/C,IAAI,CAACH,WAAW,OAAO;QAAEI,OAAO;QAAMC,aAAa;QAAeT;IAAG;IACrE,IAAI;;QACF,MAAMU,aAAa,AAAC,CAAA,MAAMzC,eAAe0B,MAAK,EAAGgB,gBAAgB;QACjE,IAAI,CAACD,YAAY,OAAO;YAAEF,OAAO;YAAMC,aAAa;YAAmBT;QAAG;QAC1E,MAAMY,WAAW,MAAMC,MACrB,CAAC,iDAAiD,EAAEC,mBAClDC,OAAOL,aACP,oBAAoB,CAAC,EACvB;YAAEM,SAAS;gBAAEC,eAAe,CAAC,OAAO,EAAEb,WAAW;YAAC;QAAE;QAEtD,MAAMc,UAAU,MAAMN,SAASO,IAAI,GAAGC,KAAK,CAAC,IAAM;QAClD,IAAI,CAACR,SAASS,EAAE,EAAE;;gBAINH;YAHVI,QAAQC,KAAK,CAAC,oDAAoD;gBAChE5B;gBACA6B,QAAQZ,SAASY,MAAM;gBACvBC,MAAM,WAAEP,4BAAAA,iBAAAA,QAASK,KAAK,qBAAdL,eAAgBQ,OAAO,oBAAI;YACrC;YACA,OAAO;gBAAElB,OAAO;gBAAMC,aAAa;gBAAeT;YAAG;QACvD;QACA,MAAM2B,wBAAiBT,2BAAAA,QAASU,IAAI,mBAAI,EAAE;QAI1C,yEAAyE;QACzE,sEAAsE;QACtE,sDAAsD;QACtD,MAAMC,OAAOF,cAAcG,MAAM,CAAC,CAACC,eACjCtE,yBAAyBsE,aAAaP,MAAM;QAE9C,KAAK,MAAMO,gBAAgBF,KAAKG,MAAM,GAAGH,OAAOF,cAAe;;gBAC1CI;YAAnB,KAAK,MAAME,kBAAQF,sBAAAA,aAAaG,KAAK,qBAAlBH,oBAAoBH,IAAI,oBAAI,EAAE,CAAE;oBACxBK;gBAAzB,IAAI1D,sBAAqB0D,cAAAA,KAAKE,KAAK,qBAAVF,YAAYG,EAAE,MAAM,WAAW;gBACxD,MAAMC,UAAUC,OAAOL,KAAKI,OAAO;gBACnC,IAAIC,OAAOC,QAAQ,CAACF,YAAYA,UAAU,GAAG;oBAC3C,OAAO;wBACL7B,OAAO,IAAIV,KAAKuC,UAAU,MAAMG,WAAW;wBAC3C/B,aAAa;wBACbT;oBACF;gBACF;YACF;QACF;QACA,OAAO;YAAEQ,OAAO;YAAMC,aAAa;YAAUT;QAAG;IAClD,EAAE,OAAOuB,OAAO;QACdD,QAAQC,KAAK,CAAC,mDAAmDA;QACjE,OAAO;YAAEf,OAAO;YAAMC,aAAa;YAAeT;QAAG;IACvD;AACF;AAEA,MAAMyC,QAAQ,CAACC;QACK;IAAlB,MAAMC,YAAaD,0BAAD,gBAAA,AAACA,MAA0CE,MAAM,qBAAjD,mBAACF;IACnB,IAAIC,qBAAqB7C,MAAM,OAAO6C,UAAUH,WAAW;IAC3D,IAAIE,iBAAiB5C,MAAM,OAAO4C,MAAMF,WAAW;IACnD,OAAO;AACT;AAEA;;;;;;;;;;CAUC,GACD,OAAO,eAAeK,qBACpBC,SAAsC,EACtCnD,KAAa,EACboD,KAAa;IAEb,IAAI;QACF,MAAMC,aAAa,IAAIlD,KAAK,GAAGiD,MAAM,iBAAiB,CAAC;QACvD,MAAME,WAAW,MAAMH,UACpBI,UAAU,CAAC,QACXC,GAAG,CAACxD,OACJuD,UAAU,CAAC,UACXE,KAAK,CAAC,aAAa,MAAMJ,YACzBK,OAAO,CAAC,aAAa,QACrBC,KAAK,CAACpE,YAAY,GAClBW,GAAG;QACN,MAAM0D,YAAYN,SAASO,IAAI,CAACxB,MAAM,GAAG9C;QACzC,MAAMsE,OAAOD,YAAYN,SAASO,IAAI,CAACC,KAAK,CAAC,GAAGvE,aAAa+D,SAASO,IAAI;QAC1E,MAAME,SAAS1E;QACf,MAAM2E,SAA0B,EAAE;QAClC,KAAK,MAAMR,OAAOK,KAAM;gBACAL;YAAtB,MAAM3B,SAAST,QAAOoC,WAAAA,IAAItD,GAAG,CAAC,qBAARsD,WAAqB;YAC3C,IAAI,AAAClE,0BAAgD2E,QAAQ,CAACpC,SAAS;gBACrEkC,MAAM,CAAClC,OAA8B,IAAI;YAC3C;YACA,IAAImC,OAAO3B,MAAM,GAAG7C,aAAa;oBAGhBgE,WAEWA,WACHA;gBALvBQ,OAAOE,IAAI,CAAC;oBACVzB,IAAIe,IAAIf,EAAE;oBACV0B,MAAM/C,QAAOoC,YAAAA,IAAItD,GAAG,CAAC,mBAARsD,YAAmB;oBAChC3B;oBACAuC,iBAAiBzB,QAAOa,YAAAA,IAAItD,GAAG,CAAC,8BAARsD,YAA8B,MAAM;oBAC5Da,cAAc1B,QAAOa,YAAAA,IAAItD,GAAG,CAAC,2BAARsD,YAA2B,MAAM;oBACtDc,WAAWxB,MAAMU,IAAItD,GAAG,CAAC;oBACzBqE,WACE,OAAOf,IAAItD,GAAG,CAAC,iBAAiB,WAC5BkB,OAAOoC,IAAItD,GAAG,CAAC,gBACf;gBACR;YACF;QACF;QACA,OAAO;YAAE6D;YAAQC;YAAQJ;QAAU;IACrC,EAAE,OAAOhC,OAAO;QACdD,QAAQC,KAAK,CAAC,mCAAmCA;QACjD,OAAO;IACT;AACF;AAEA;;;;;;;;CAQC,GACD,eAAe4C,kBACbrB,SAAsC,EACtCnD,KAAa,EACboD,KAAa;IAEb,IAAI;QACF,MAAMqB,QAAQ,MAAMhG,qBAAqB0E,WAAWnD,OAAOoD;QAC3D,OAAOqB,MAAMC,IAAI,CAACZ,KAAK,CAAC,GAAGrE,WAAWkF,GAAG,CAAC,CAACC,MAAS,CAAA;gBAClDC,KAAKD,IAAIC,GAAG;gBACZC,MAAMF,IAAIE,IAAI;gBACdC,SAASH,IAAIG,OAAO;gBACpBC,YAAYJ,IAAII,UAAU;gBAC1BC,OAAOL,IAAIK,KAAK;gBAChBC,UAAUN,IAAIM,QAAQ;gBACtBC,UAAUP,IAAIO,QAAQ;gBACtBC,QAAQR,IAAIQ,MAAM;gBAClBC,QAAQT,IAAIS,MAAM;YACpB,CAAA;IACF,EAAE,OAAOzD,OAAO;QACdD,QAAQC,KAAK,CAAC,uCAAuCA;QACrD,OAAO,EAAE;IACX;AACF;AAEA,eAAe0D,QAAQC,OAAgB;QAUflE,wBAMDmE;IAfrB,MAAM,EACJC,MAAM,EACND,KAAK,EACLnE,SAASqE,UAAU,EACpB,GAAG,MAAMxH,qBAAqBqH;IAC/B,MAAMlE,UAAUqE;IAChB,IAAID,WAAW,OAAO;QACpB,OAAOE,SAASnE,IAAI,CAAC;YAAEI,OAAO;QAAqB,GAAG;YAAEC,QAAQ;QAAI;IACtE;IACA,MAAM+D,iBAAgBvE,yBAAAA,QAAQuE,aAAa,YAArBvE,yBAAyB;IAC/C,MAAMwE,UAAUD,cAAcE,UAAU,CAAC,aACrCF,cAAc9B,KAAK,CAAC,UAAUzB,MAAM,IACpC0D;IACJ,IAAI,CAACF,SACH,OAAOF,SAASnE,IAAI,CAAC;QAAEI,OAAO;IAAkB,GAAG;QAAEC,QAAQ;IAAI;IACnE,MAAM7B,QAAQoB,QAAOoE,eAAAA,MAAMxF,KAAK,YAAXwF,eAAe;IACpC,IAAI,CAACxF,OAAO,OAAO2F,SAASnE,IAAI,CAAC;QAAEI,OAAO;IAAgB,GAAG;QAAEC,QAAQ;IAAI;IAE3E,IAAI;YA0BImE,eAG+BC,iBA6CxBC,WAEOC;QA3EpB,MAAMC,UAAU,MAAMhI,cAAciI,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACV;QAC/D,IAAI,CAACO,QAAQI,cAAc,IAAI,CAACnI,uBAAuB+H,UAAU;YAC/D,OAAOjI;QACT;QACA,IAAI,CAACiI,OAAO,CAAC,QAAQ,EAAE;YACrB,OAAOT,SAASnE,IAAI,CAAC;gBAAEI,OAAO;YAAa,GAAG;gBAAEC,QAAQ;YAAI;QAC9D;QAEA,MAAMzB,MAAM,IAAID;QAChB,MAAMiD,QAAQ7E,iBAAiB6B;QAC/B,MAAMqG,KAAKrI,cAAciI,GAAG,GAAGlD,SAAS;QACxC,MAAMuD,SAASD,GAAGlD,UAAU,CAAC,QAAQC,GAAG,CAACxD;QAEzC,MAAM,CAACgG,SAASW,aAAaV,WAAWW,WAAW,GAAG,MAAMC,QAAQC,GAAG,CAAC;YACtEJ,OAAOxG,GAAG;YACVwG,OAAOnD,UAAU,CAACvF,2BAA2BwF,GAAG,CAACzF,oBAAoBmC,GAAG;YACxEwG,OAAOnD,UAAU,CAAC,eAAeC,GAAG,CAACJ,OAAOlD,GAAG;YAC/CwG,OAAOnD,UAAU,CAAC,SAASG,OAAO,CAAC,SAAS,QAAQC,KAAK,CAAC,GAAGzD,GAAG;SACjE;QACD,IAAI,CAAC8F,QAAQe,MAAM,EAAE;YACnB,OAAOpB,SAASnE,IAAI,CAAC;gBAAEI,OAAO;YAAuB,GAAG;gBAAEC,QAAQ;YAAI;QACxE;QACA,sEAAsE;QACtE,yEAAyE;QACzE,MAAMqE,MAAM,cACNF,gBAAAA,QAAQ/D,IAAI,cAAZ+D,gBAAkB,CAAC,GACnBW,YAAYI,MAAM,GAAGJ,YAAY1E,IAAI,KAAK,CAAC;QAEjD,MAAM+E,WAAWf,UAAUc,MAAM,IAAId,kBAAAA,UAAUhE,IAAI,cAAdgE,kBAAoB,CAAC,IAAK;QAE/D;;;;;;KAMC,GACD,IAAI;YACF,MAAMvH,iBAAiB;gBACrBuI,UAAUb,QAAQvB,GAAG;gBACrBqC,QAAQ;gBACRC,QAAQ,CAAC,KAAK,EAAEnH,MAAM,YAAY,CAAC;gBACnCoH,MAAM,CAAC,mBAAmB,EAAEhE,OAAO;YACrC;QACF,EAAE,OAAOxB,OAAO;YACdD,QAAQC,KAAK,CAAC,qCAAqCA;QACrD;QAEA,MAAM,CAACyF,MAAMC,OAAOzG,MAAM,GAAG,MAAMgG,QAAQC,GAAG,CAAC;YAC7C5D,qBAAqBuD,IAAIzG,OAAOoD;YAChCoB,kBAAkBiC,IAAIzG,OAAOoD;YAC7BrD,cAAcC;SACf;QAED,MAAMuH,OAAOpI,sBAAsB+G,KAAcc,UAAU5G;QAC3D,qEAAqE;QACrE,oEAAoE;QACpE,mBAAmB;QACnB,MAAMoH,UAAUtI,yBAAyBgH,KAAcqB,KAAKE,SAAS;QACrE,MAAMC,QAAQ1I,uBAAuBkH,KAAc;YACjDrF,OAAOA,MAAMA,KAAK;YAClBC,aAAaD,MAAMC,WAAW;QAChC;QACA,MAAM6G,eAAe7I,4BACnB4B,QAAQC,GAAG,CAACiH,iCAAiC;QAE/C,MAAMzB,YAAYS,WAAW/C,IAAI,CAAC,EAAE;QACpC,gEAAgE;QAChE,mEAAmE;QACnE,kEAAkE;QAClE,MAAMgE,kBAAkB1B,YACpBtH,aAAa;YACXmB;YACA8E,IAAI,GAAGoB,YAAAA,GAAG,CAAC,OAAO,YAAXA,YAAsC;YAC7CA,KAAKA;YACL9C,OAAOhC,QAAO+E,iBAAAA,UAAUjG,GAAG,CAAC,oBAAdiG,iBAA0BA,UAAU1D,EAAE;YACpDqF,QAAQ,aACH7J,iBAAiBkI,UAAUlE,IAAI;gBAClC8F,eAAeR,KAAKS,WAAW;;QAEnC,KACA;QACJ,MAAMC,SAAShJ,wBAAwB;YACrCiH,KAAKA;YACLqB;YACAC;YACAE;YACAC;YACAO,UAAUnJ,qBAAqBwI,KAAKS,WAAW,EAAEL;YACjDQ,cAAc;gBACZ/E,KAAK,UAAEyE,mCAAAA,gBAAiBzE,KAAK,mBAAI;gBACjCgF,SAAS,WAAEP,mCAAAA,gBAAiBO,SAAS,oBAAI;gBACzCC,MAAM,WAAER,mCAAAA,gBAAiBQ,MAAM,oBAAI;YACrC;QACF;QAEA,MAAMC,OAA2B;YAC/BlF;YACAsE;YACAH;YACAC;YACArC,UAAU3G,oBAAoBwI,4BAAAA,QAAU,CAAC,WAAW;YACpDK;YACAC;YACAW;YACAM,QAAQnJ,wBAAwB4H;QAClC;QACA,OAAOrB,SAASnE,IAAI,CAAC8G,MAAM;YAAEzG,QAAQ;QAAI;IAC3C,EAAE,OAAOD,OAAO;QACd,2DAA2D;QAC3D,uEAAuE;QACvE,MAAM4G,kBAAkB7J,uBAAuBiD;QAC/C,IAAI4G,iBAAiB,OAAOA;QAC5B7G,QAAQC,KAAK,CAAC,kBAAkBA;QAChC,OAAO+D,SAASnE,IAAI,CAAC;YAAEI,OAAO;QAAmB,GAAG;YAAEC,QAAQ;QAAI;IACpE;AACF;AAEA,SAASyD,WAAWmD,GAAG,GAAE"}

package/src/lib/server/ai-admin-orgs-spend.d.ts

@@ -0,0 +1,40 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * THE STAFF ORGANIZATIONS LIST'S AI SPEND (AGL-2984).
+ *
+ * `GET /api/ai/admin/orgs-spend?orgIds=a,b,…` answers this month's provider
+ * spend for each org the list's page shows — the figures its AI spend column
+ * draws and sorts by. Staff-gated exactly as `/api/ai/admin/org` is, and
+ * read-only.
+ *
+ * ## The read
+ *
+ * ONE `getAll` over each named org's usage document for the current UTC
+ * month, the key the usage writer files spend under — a single bounded
+ * round trip for the page, never a read per row, and at most
+ * `STAFF_ORGS_AI_SPEND_MAX_IDS` ids per request.
+ *
+ * An org with no document for the month answers `null`, never `0`, and a
+ * read that FAILS answers `null` for every id: the list renders with the
+ * column blank rather than failing because this read did.
+ *
+ * No `adminAudit` row: the answer is one dollar figure per workspace, with
+ * nothing in it about a person.
+ */
+declare function handler(request: Request): Promise<Response>;
+export { handler as GET };

package/src/lib/server/ai-admin-orgs-spend.js

@@ -0,0 +1,129 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { pluginRequestFromWeb } from "@aglyn/aglyn/server";
+import { emailUnverifiedResponse, firebaseAdmin, isImpersonationSession } from "@aglyn/tenant-data-admin";
+import { invalidIdTokenResponse } from "@aglyn/tenant-data-admin/server/id-token-refusal";
+import { ASSIST_PROVIDER_COST_FIELD, assistProviderCostUsd } from "@aglyn/aglyn/app-utils/assist-credits";
+import { assistUsageMonth } from "../usage/assist-usage.js";
+import { parseStaffOrgIds } from "../usage/staff-orgs-ai-spend.js";
+/**
+ * THE STAFF ORGANIZATIONS LIST'S AI SPEND (AGL-2984).
+ *
+ * `GET /api/ai/admin/orgs-spend?orgIds=a,b,…` answers this month's provider
+ * spend for each org the list's page shows — the figures its AI spend column
+ * draws and sorts by. Staff-gated exactly as `/api/ai/admin/org` is, and
+ * read-only.
+ *
+ * ## The read
+ *
+ * ONE `getAll` over each named org's usage document for the current UTC
+ * month, the key the usage writer files spend under — a single bounded
+ * round trip for the page, never a read per row, and at most
+ * `STAFF_ORGS_AI_SPEND_MAX_IDS` ids per request.
+ *
+ * An org with no document for the month answers `null`, never `0`, and a
+ * read that FAILS answers `null` for every id: the list renders with the
+ * column blank rather than failing because this read did.
+ *
+ * No `adminAudit` row: the answer is one dollar figure per workspace, with
+ * nothing in it about a person.
+ */ async function handler(request) {
+    var _headers_authorization;
+    const { method, query, headers: rawHeaders } = await pluginRequestFromWeb(request);
+    const headers = rawHeaders;
+    if (method !== 'GET') {
+        return Response.json({
+            error: 'Method not allowed'
+        }, {
+            status: 405
+        });
+    }
+    const authorization = (_headers_authorization = headers.authorization) != null ? _headers_authorization : '';
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return Response.json({
+        error: 'Unauthenticated'
+    }, {
+        status: 401
+    });
+    const asked = parseStaffOrgIds(query['orgIds']);
+    if (asked.error) {
+        return Response.json({
+            error: asked.error
+        }, {
+            status: 400
+        });
+    }
+    try {
+        const app = firebaseAdmin.app();
+        const decoded = await app.auth().verifyIdToken(idToken);
+        if (!decoded.email_verified && !isImpersonationSession(decoded)) {
+            return emailUnverifiedResponse();
+        }
+        if (!decoded['staff']) {
+            return Response.json({
+                error: 'Staff only'
+            }, {
+                status: 403
+            });
+        }
+        const month = assistUsageMonth();
+        const db = app.firestore();
+        const orgs = db.collection('orgs');
+        const snapshots = await db.getAll(...asked.orgIds.map((orgId)=>orgs.doc(orgId).collection('assistUsage').doc(month))).catch((error)=>{
+            console.error('[ai/admin/orgs-spend] read failed', error);
+            return null;
+        });
+        const body = {
+            month,
+            // `fromEntries`, so an id is always an own key of the answer.
+            spendUsd: Object.fromEntries(asked.orgIds.map((orgId, index)=>[
+                    orgId,
+                    spendOf(snapshots == null ? void 0 : snapshots[index])
+                ]))
+        };
+        return Response.json(body, {
+            status: 200
+        });
+    } catch (error) {
+        // An unverifiable credential is a 401, not a fault of ours
+        // (AGL-1993). Null for anything else, so a real failure keeps its 500.
+        const unauthenticated = invalidIdTokenResponse(error);
+        if (unauthenticated) return unauthenticated;
+        console.error('[ai/admin/orgs-spend]', error);
+        return Response.json({
+            error: 'AI spend lookup failed'
+        }, {
+            status: 500
+        });
+    }
+}
+/**
+ * A month document's PROVIDER spend, or `null` when there is no document to
+ * read.
+ *
+ * The column this feeds is named for our money and is sorted on to find the
+ * workspace spending it, so it is the provider figure and not what the
+ * workspace drew (AGL-3015). A month closed before the two were split
+ * answers with what it drew, which over-states the bill rather than hiding
+ * it — the direction that still surfaces the workspace worth looking at.
+ */ function spendOf(snapshot) {
+    if (!(snapshot == null ? void 0 : snapshot.exists)) return null;
+    const cost = assistProviderCostUsd(snapshot.get('estCostUsd'), snapshot.get(ASSIST_PROVIDER_COST_FIELD));
+    return Number.isFinite(cost) ? cost : null;
+}
+export { handler as GET };
+
+//# sourceMappingURL=ai-admin-orgs-spend.js.map

package/src/lib/server/ai-admin-orgs-spend.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/ai/src/lib/server/ai-admin-orgs-spend.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { pluginRequestFromWeb } from '@aglyn/aglyn/server'\nimport {\n  emailUnverifiedResponse,\n  firebaseAdmin,\n  isImpersonationSession,\n} from '@aglyn/tenant-data-admin'\nimport { invalidIdTokenResponse } from '@aglyn/tenant-data-admin/server/id-token-refusal'\nimport {\n  ASSIST_PROVIDER_COST_FIELD,\n  assistProviderCostUsd,\n} from '@aglyn/aglyn/app-utils/assist-credits'\nimport { assistUsageMonth } from '../usage/assist-usage'\nimport {\n  parseStaffOrgIds,\n  type StaffOrgsAiSpendWire,\n} from '../usage/staff-orgs-ai-spend'\n\n/**\n * THE STAFF ORGANIZATIONS LIST'S AI SPEND (AGL-2984).\n *\n * `GET /api/ai/admin/orgs-spend?orgIds=a,b,…` answers this month's provider\n * spend for each org the list's page shows — the figures its AI spend column\n * draws and sorts by. Staff-gated exactly as `/api/ai/admin/org` is, and\n * read-only.\n *\n * ## The read\n *\n * ONE `getAll` over each named org's usage document for the current UTC\n * month, the key the usage writer files spend under — a single bounded\n * round trip for the page, never a read per row, and at most\n * `STAFF_ORGS_AI_SPEND_MAX_IDS` ids per request.\n *\n * An org with no document for the month answers `null`, never `0`, and a\n * read that FAILS answers `null` for every id: the list renders with the\n * column blank rather than failing because this read did.\n *\n * No `adminAudit` row: the answer is one dollar figure per workspace, with\n * nothing in it about a person.\n */\nasync function handler(request: Request): Promise<Response> {\n  const {\n    method,\n    query,\n    headers: rawHeaders,\n  } = await pluginRequestFromWeb(request)\n  const headers = rawHeaders as Partial<Record<string, string>>\n  if (method !== 'GET') {\n    return Response.json({ error: 'Method not allowed' }, { status: 405 })\n  }\n  const authorization = headers.authorization ?? ''\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken)\n    return Response.json({ error: 'Unauthenticated' }, { status: 401 })\n  const asked = parseStaffOrgIds(query['orgIds'])\n  if (asked.error) {\n    return Response.json({ error: asked.error }, { status: 400 })\n  }\n\n  try {\n    const app = firebaseAdmin.app()\n    const decoded = await app.auth().verifyIdToken(idToken)\n    if (!decoded.email_verified && !isImpersonationSession(decoded)) {\n      return emailUnverifiedResponse()\n    }\n    if (!decoded['staff']) {\n      return Response.json({ error: 'Staff only' }, { status: 403 })\n    }\n\n    const month = assistUsageMonth()\n    const db = app.firestore()\n    const orgs = db.collection('orgs')\n    const snapshots = await db\n      .getAll(\n        ...asked.orgIds.map((orgId) =>\n          orgs.doc(orgId).collection('assistUsage').doc(month),\n        ),\n      )\n      .catch((error: unknown) => {\n        console.error('[ai/admin/orgs-spend] read failed', error)\n        return null\n      })\n    const body: StaffOrgsAiSpendWire = {\n      month,\n      // `fromEntries`, so an id is always an own key of the answer.\n      spendUsd: Object.fromEntries(\n        asked.orgIds.map((orgId, index) => [\n          orgId,\n          spendOf(snapshots?.[index]),\n        ]),\n      ),\n    }\n    return Response.json(body, { status: 200 })\n  } catch (error) {\n    // An unverifiable credential is a 401, not a fault of ours\n    // (AGL-1993). Null for anything else, so a real failure keeps its 500.\n    const unauthenticated = invalidIdTokenResponse(error)\n    if (unauthenticated) return unauthenticated\n    console.error('[ai/admin/orgs-spend]', error)\n    return Response.json({ error: 'AI spend lookup failed' }, { status: 500 })\n  }\n}\n\n/**\n * A month document's PROVIDER spend, or `null` when there is no document to\n * read.\n *\n * The column this feeds is named for our money and is sorted on to find the\n * workspace spending it, so it is the provider figure and not what the\n * workspace drew (AGL-3015). A month closed before the two were split\n * answers with what it drew, which over-states the bill rather than hiding\n * it — the direction that still surfaces the workspace worth looking at.\n */\nfunction spendOf(\n  snapshot: FirebaseFirestore.DocumentSnapshot | undefined,\n): number | null {\n  if (!snapshot?.exists) return null\n  const cost = assistProviderCostUsd(\n    snapshot.get('estCostUsd'),\n    snapshot.get(ASSIST_PROVIDER_COST_FIELD),\n  )\n  return Number.isFinite(cost) ? cost : null\n}\n\nexport { handler as GET }\n"],"names":["pluginRequestFromWeb","emailUnverifiedResponse","firebaseAdmin","isImpersonationSession","invalidIdTokenResponse","ASSIST_PROVIDER_COST_FIELD","assistProviderCostUsd","assistUsageMonth","parseStaffOrgIds","handler","request","headers","method","query","rawHeaders","Response","json","error","status","authorization","idToken","startsWith","slice","length","undefined","asked","app","decoded","auth","verifyIdToken","email_verified","month","db","firestore","orgs","collection","snapshots","getAll","orgIds","map","orgId","doc","catch","console","body","spendUsd","Object","fromEntries","index","spendOf","unauthenticated","snapshot","exists","cost","get","Number","isFinite","GET"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,oBAAoB,QAAQ,sBAAqB;AAC1D,SACEC,uBAAuB,EACvBC,aAAa,EACbC,sBAAsB,QACjB,2BAA0B;AACjC,SAASC,sBAAsB,QAAQ,mDAAkD;AACzF,SACEC,0BAA0B,EAC1BC,qBAAqB,QAChB,wCAAuC;AAC9C,SAASC,gBAAgB,QAAQ,2BAAuB;AACxD,SACEC,gBAAgB,QAEX,kCAA8B;AAErC;;;;;;;;;;;;;;;;;;;;;CAqBC,GACD,eAAeC,QAAQC,OAAgB;QAUfC;IATtB,MAAM,EACJC,MAAM,EACNC,KAAK,EACLF,SAASG,UAAU,EACpB,GAAG,MAAMd,qBAAqBU;IAC/B,MAAMC,UAAUG;IAChB,IAAIF,WAAW,OAAO;QACpB,OAAOG,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAqB,GAAG;YAAEC,QAAQ;QAAI;IACtE;IACA,MAAMC,iBAAgBR,yBAAAA,QAAQQ,aAAa,YAArBR,yBAAyB;IAC/C,MAAMS,UAAUD,cAAcE,UAAU,CAAC,aACrCF,cAAcG,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SACH,OAAOL,SAASC,IAAI,CAAC;QAAEC,OAAO;IAAkB,GAAG;QAAEC,QAAQ;IAAI;IACnE,MAAMO,QAAQjB,iBAAiBK,KAAK,CAAC,SAAS;IAC9C,IAAIY,MAAMR,KAAK,EAAE;QACf,OAAOF,SAASC,IAAI,CAAC;YAAEC,OAAOQ,MAAMR,KAAK;QAAC,GAAG;YAAEC,QAAQ;QAAI;IAC7D;IAEA,IAAI;QACF,MAAMQ,MAAMxB,cAAcwB,GAAG;QAC7B,MAAMC,UAAU,MAAMD,IAAIE,IAAI,GAAGC,aAAa,CAACT;QAC/C,IAAI,CAACO,QAAQG,cAAc,IAAI,CAAC3B,uBAAuBwB,UAAU;YAC/D,OAAO1B;QACT;QACA,IAAI,CAAC0B,OAAO,CAAC,QAAQ,EAAE;YACrB,OAAOZ,SAASC,IAAI,CAAC;gBAAEC,OAAO;YAAa,GAAG;gBAAEC,QAAQ;YAAI;QAC9D;QAEA,MAAMa,QAAQxB;QACd,MAAMyB,KAAKN,IAAIO,SAAS;QACxB,MAAMC,OAAOF,GAAGG,UAAU,CAAC;QAC3B,MAAMC,YAAY,MAAMJ,GACrBK,MAAM,IACFZ,MAAMa,MAAM,CAACC,GAAG,CAAC,CAACC,QACnBN,KAAKO,GAAG,CAACD,OAAOL,UAAU,CAAC,eAAeM,GAAG,CAACV,SAGjDW,KAAK,CAAC,CAACzB;YACN0B,QAAQ1B,KAAK,CAAC,qCAAqCA;YACnD,OAAO;QACT;QACF,MAAM2B,OAA6B;YACjCb;YACA,8DAA8D;YAC9Dc,UAAUC,OAAOC,WAAW,CAC1BtB,MAAMa,MAAM,CAACC,GAAG,CAAC,CAACC,OAAOQ,QAAU;oBACjCR;oBACAS,QAAQb,6BAAAA,SAAW,CAACY,MAAM;iBAC3B;QAEL;QACA,OAAOjC,SAASC,IAAI,CAAC4B,MAAM;YAAE1B,QAAQ;QAAI;IAC3C,EAAE,OAAOD,OAAO;QACd,2DAA2D;QAC3D,uEAAuE;QACvE,MAAMiC,kBAAkB9C,uBAAuBa;QAC/C,IAAIiC,iBAAiB,OAAOA;QAC5BP,QAAQ1B,KAAK,CAAC,yBAAyBA;QACvC,OAAOF,SAASC,IAAI,CAAC;YAAEC,OAAO;QAAyB,GAAG;YAAEC,QAAQ;QAAI;IAC1E;AACF;AAEA;;;;;;;;;CASC,GACD,SAAS+B,QACPE,QAAwD;IAExD,IAAI,EAACA,4BAAAA,SAAUC,MAAM,GAAE,OAAO;IAC9B,MAAMC,OAAO/C,sBACX6C,SAASG,GAAG,CAAC,eACbH,SAASG,GAAG,CAACjD;IAEf,OAAOkD,OAAOC,QAAQ,CAACH,QAAQA,OAAO;AACxC;AAEA,SAAS5C,WAAWgD,GAAG,GAAE"}

package/src/lib/server/ai-admin-overage.d.ts

@@ -0,0 +1,19 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+declare function handler(request: Request): Promise<Response>;
+export declare const dynamic = "force-dynamic";
+export { handler as POST };