@aglyn/plugins-ai 1.0.0-beta.143

package/src/lib/server/ai-jobs-route.js

@@ -0,0 +1,307 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ // lockdown-423: via libs/plugins/ai/src/lib/runtime/ai-gate.ts
+// The POST climbs `aiGateLadder`, whose lockdown rung is the verdict; the
+// GET climbs `ai-jobs-gate.ts`, which carries the same rung.
+import { randomUUID } from "crypto";
+import { AI_JOB_KINDS } from "../model/ai-jobs.types.js";
+// By their own entry points rather than the barrel (AGL-2903): the specs
+// stub the barrel closed-world, and the ladder, the machine and the runtime
+// are the things under test here, not things to be stubbed away.
+import { aiGateLadder } from "../runtime/ai-gate.js";
+import { aiJobAdmissionRefusal, aiJobSiteRefusal } from "../jobs/ai-job-admission.js";
+import { AI_JOB_BRIEF_MAX_CHARS } from "../jobs/ai-job-text-step.js";
+import { AI_JOB_INLINE_BUDGET_MS, aiJobNextStepMinimumMs, aiJobSummary, createAiJob, listAiJobs, runAiJobStep } from "../jobs/ai-jobs.js";
+import { releaseAssistMessage } from "../usage/assist-usage.js";
+import { aiUsageMeter } from "../usage/ai-usage-meter.js";
+import { aiJobsGate } from "./ai-jobs-gate.js";
+/**
+ * AI generation jobs: create and list (AGL-2904).
+ *
+ * `POST` is a door that spends, so it climbs the whole ladder (AGL-2903) —
+ * `aiGenerative`, `release_ai_generative`, the `ai-generate` switch, a
+ * per-uid window, and a reservation — and then creates the job and runs
+ * its first step INLINE under `AI_JOB_INLINE_BUDGET_MS`. A step that
+ * finishes in time answers with the job `done` (or `queued` behind its
+ * next step); one that does not is aborted, its reservation handed back,
+ * and the job answers `queued` for the beat to resume. Either way the
+ * caller gets the job document, and the events route is how it watches
+ * from there.
+ *
+ * `GET` lists the org's jobs, newest first, through the read gate: the
+ * same rungs up to the lockdown verdict, no reservation.
+ *
+ * The request must NAME the org it is metered against (AGL-1934). There
+ * is no fallback to "the caller's first org".
+ */ const AI_JOBS_RATE_LIMIT = {
+    key: 'ai-jobs',
+    limit: 10,
+    windowMs: 60000
+};
+/** Kind-specific inputs, bounded: a runner reads scalars, not a document. */ const MAX_INPUTS_JSON_CHARS = 8000;
+/** The admitted statuses for the list filter, as the union spells them. */ const AI_JOB_STATUSES = [
+    'queued',
+    'running',
+    'needs_input',
+    'needs_review',
+    'done',
+    'failed',
+    'canceled'
+];
+const ID_CHARS = /^[A-Za-z0-9_-]{1,100}$/;
+/** The longest model id a body may carry; the catalog's ids are far shorter. */ const MAX_MODEL_CHARS = 100;
+/** Validate + clamp the request body; a string names what is wrong. */ export function parseCreateAiJobBody(payload) {
+    var _body_orgId, _body_kind, _body_brief;
+    const body = payload != null ? payload : {};
+    const orgId = String((_body_orgId = body.orgId) != null ? _body_orgId : '').trim();
+    if (!orgId) return 'Open a workspace before using this feature';
+    const kind = String((_body_kind = body.kind) != null ? _body_kind : '');
+    if (!AI_JOB_KINDS.includes(kind)) {
+        return `kind must be one of ${AI_JOB_KINDS.join(', ')}`;
+    }
+    const brief = String((_body_brief = body.brief) != null ? _body_brief : '').trim();
+    if (!brief) return 'Write a brief for the job';
+    if (brief.length > AI_JOB_BRIEF_MAX_CHARS) {
+        return `Keep the brief under ${AI_JOB_BRIEF_MAX_CHARS.toLocaleString('en-US')} characters`;
+    }
+    const rawHost = body.hostId;
+    const hostId = rawHost === undefined || rawHost === null || rawHost === '' ? null : typeof rawHost === 'string' && ID_CHARS.test(rawHost) ? rawHost : undefined;
+    if (hostId === undefined) return 'hostId is not a site id';
+    // A theme is fields on one site's document, so a theme job that names no
+    // site has nothing to propose a change to (AGL-2938).
+    if (kind === 'theme' && !hostId) return 'Open a site before changing its theme';
+    const rawInputs = body.inputs;
+    const inputs = {};
+    if (rawInputs !== undefined && rawInputs !== null) {
+        if (typeof rawInputs !== 'object' || Array.isArray(rawInputs)) {
+            return 'inputs must be an object';
+        }
+        for (const [key, value] of Object.entries(rawInputs)){
+            if (typeof value !== 'string' && typeof value !== 'number' && typeof value !== 'boolean') {
+                return `inputs.${key} must be a string, number or boolean`;
+            }
+            inputs[key] = value;
+        }
+        if (JSON.stringify(inputs).length > MAX_INPUTS_JSON_CHARS) {
+            return 'inputs are too large';
+        }
+    }
+    const rawModel = typeof body.model === 'string' ? body.model.trim() : '';
+    if (rawModel.length > MAX_MODEL_CHARS) return 'model is not a model id';
+    // Validated against the plan and the allotment allowlists when each step
+    // runs, not here: the allowlists are read inside the step's reservation.
+    const model = rawModel && rawModel !== 'auto' ? rawModel : null;
+    return {
+        orgId,
+        hostId,
+        kind: kind,
+        brief,
+        inputs,
+        model
+    };
+}
+export async function POST(request) {
+    var _ref, _gate_decoded_email;
+    let payload;
+    try {
+        payload = await request.json();
+    } catch (unused) {
+        payload = null;
+    }
+    const parsed = parseCreateAiJobBody(payload);
+    // The org is parsed BEFORE the ladder so a request that named none is
+    // refused with the ladder's 400 rather than a shape error; every other
+    // shape fault waits until the caller has proven who they are.
+    const orgId = typeof parsed === 'string' ? String((_ref = payload == null ? void 0 : payload.orgId) != null ? _ref : '') : parsed.orgId;
+    // The site rides along for the same reason: a collaborator's `ai.generate`
+    // is decided per site (AGL-2927), so the ladder needs it before it can say
+    // whether this member may generate here at all.
+    const hostId = typeof parsed === 'string' ? null : parsed.hostId;
+    const gate = await aiGateLadder({
+        request,
+        orgId,
+        hostId
+    }, {
+        feature: 'aiGenerative',
+        releaseFlag: 'release_ai_generative',
+        lockdownFeature: 'ai-generate',
+        permission: 'ai.generate',
+        rateLimit: AI_JOBS_RATE_LIMIT
+    });
+    if (gate instanceof Response) return gate;
+    if (typeof parsed === 'string') {
+        // Admitted, reserved, and then found to have sent nothing runnable: the
+        // reservation goes back, because no token was spent.
+        await releaseAssistMessage(gate.firestore, gate.orgId, gate.reservation).catch(()=>undefined);
+        return Response.json({
+            error: parsed
+        }, {
+            status: 400
+        });
+    }
+    // What only this kind can say about the request (AGL-2909): a site it
+    // needs, inputs it reads, an allowance its draft counts against. Asked
+    // before the job exists, so a refusal spends nothing.
+    let refusal;
+    try {
+        var _ref1;
+        // A site that switched AI off first (AGL-3028), then the kind's own check.
+        refusal = (_ref1 = await aiJobSiteRefusal({
+            firestore: gate.firestore,
+            org: gate.org,
+            hostId: parsed.hostId
+        })) != null ? _ref1 : await aiJobAdmissionRefusal(parsed.kind, {
+            firestore: gate.firestore,
+            orgId: gate.orgId,
+            hostId: parsed.hostId,
+            inputs: parsed.inputs,
+            org: gate.org,
+            uid: gate.uid
+        });
+    } catch (error) {
+        await releaseAssistMessage(gate.firestore, gate.orgId, gate.reservation).catch(()=>undefined);
+        console.error('ai job admission failed', {
+            orgId: gate.orgId,
+            kind: parsed.kind,
+            error
+        });
+        return Response.json({
+            error: 'The AI job could not be created'
+        }, {
+            status: 500
+        });
+    }
+    if (refusal) {
+        await releaseAssistMessage(gate.firestore, gate.orgId, gate.reservation).catch(()=>undefined);
+        return Response.json({
+            error: refusal.error
+        }, {
+            status: refusal.status
+        });
+    }
+    const now = new Date();
+    let created;
+    try {
+        var _gate_decoded_email1;
+        created = await createAiJob(gate.firestore, {
+            orgId: gate.orgId,
+            hostId: parsed.hostId,
+            kind: parsed.kind,
+            brief: parsed.brief,
+            inputs: parsed.inputs,
+            model: parsed.model,
+            createdBy: gate.uid,
+            createdByEmail: (_gate_decoded_email1 = gate.decoded.email) != null ? _gate_decoded_email1 : null
+        }, now);
+    } catch (error) {
+        await releaseAssistMessage(gate.firestore, gate.orgId, gate.reservation).catch(()=>undefined);
+        console.error('ai job create failed', {
+            orgId: gate.orgId,
+            error
+        });
+        return Response.json({
+            error: 'The AI job could not be created'
+        }, {
+            status: 500
+        });
+    }
+    const jobId = created.$id;
+    // A first step that needs more time than this request has (AGL-2907) is left
+    // queued for the beat, which starts it with a budget of its own: a provider
+    // call this request's timeout cut off would be billed upstream and metered
+    // nowhere. Nothing ran, so the reservation goes back.
+    if (aiJobNextStepMinimumMs(created) > AI_JOB_INLINE_BUDGET_MS) {
+        await releaseAssistMessage(gate.firestore, gate.orgId, gate.reservation).catch(()=>undefined);
+        return Response.json({
+            job: aiJobSummary(created, now),
+            meter: aiUsageMeter(gate.reservation, {
+                lastCredits: null
+            })
+        }, {
+            status: 200
+        });
+    }
+    // The first step, inline, on the reservation the ladder already holds.
+    // The runner hands that reservation back itself if the provider is never
+    // reached, and re-queues the step when the budget ends first.
+    const run = await runAiJobStep(gate.firestore, gate.orgId, jobId, {
+        owner: `route:${randomUUID()}`,
+        now,
+        reservation: gate.reservation,
+        org: gate.org,
+        signal: AbortSignal.timeout(AI_JOB_INLINE_BUDGET_MS),
+        // The caller is on the request, so what the inline step produces is
+        // attributed with their address; the beat's steps carry the uid alone.
+        actor: {
+            uid: gate.uid,
+            email: (_gate_decoded_email = gate.decoded.email) != null ? _gate_decoded_email : null
+        },
+        // The workspace's AI pause lets staff through, as the ladder above did.
+        staff: gate.staff
+    });
+    if (run.outcome === 'not-claimable') {
+        // A job created a moment ago has a claimable first step; anything else
+        // is a fault in the machine, and the reservation must not be stranded.
+        await releaseAssistMessage(gate.firestore, gate.orgId, gate.reservation).catch(()=>undefined);
+        console.error('ai job first step not claimable', {
+            orgId: gate.orgId,
+            jobId
+        });
+        return Response.json({
+            error: 'The AI job could not be started'
+        }, {
+            status: 500
+        });
+    }
+    return Response.json({
+        job: aiJobSummary(run.job),
+        // The usage strip's envelope (AGL-2942): the reservation the ladder
+        // took, with what the inline step spent.
+        meter: aiUsageMeter(gate.reservation, {
+            lastCredits: run.job.creditsSpent > 0 ? run.job.creditsSpent : null
+        })
+    }, {
+        status: 200
+    });
+}
+export async function GET(request) {
+    var _url_searchParams_get, _url_searchParams_get1, _url_searchParams_get2;
+    const url = new URL(request.url);
+    const gate = await aiJobsGate(request, (_url_searchParams_get = url.searchParams.get('orgId')) != null ? _url_searchParams_get : '');
+    if (gate instanceof Response) return gate;
+    const rawStatus = (_url_searchParams_get1 = url.searchParams.get('status')) != null ? _url_searchParams_get1 : '';
+    const status = AI_JOB_STATUSES.includes(rawStatus) ? rawStatus : undefined;
+    const limit = Number((_url_searchParams_get2 = url.searchParams.get('limit')) != null ? _url_searchParams_get2 : '');
+    const now = new Date();
+    const jobs = await listAiJobs(gate.firestore, gate.orgId, _extends({}, status ? {
+        status
+    } : {}, Number.isFinite(limit) && limit > 0 ? {
+        limit
+    } : {}));
+    return Response.json({
+        jobs: jobs.map((job)=>aiJobSummary(job, now))
+    }, {
+        status: 200,
+        headers: {
+            'Cache-Control': 'no-store'
+        }
+    });
+}
+export const dynamic = 'force-dynamic';
+export const maxDuration = 60;
+
+//# sourceMappingURL=ai-jobs-route.js.map

package/src/lib/server/ai-jobs-route.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/ai/src/lib/server/ai-jobs-route.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// lockdown-423: via libs/plugins/ai/src/lib/runtime/ai-gate.ts\n// The POST climbs `aiGateLadder`, whose lockdown rung is the verdict; the\n// GET climbs `ai-jobs-gate.ts`, which carries the same rung.\n\nimport { randomUUID } from 'crypto'\nimport {\n  AI_JOB_KINDS,\n  type AiJobKind,\n  type AiJobStatus,\n} from '../model/ai-jobs.types'\n// By their own entry points rather than the barrel (AGL-2903): the specs\n// stub the barrel closed-world, and the ladder, the machine and the runtime\n// are the things under test here, not things to be stubbed away.\nimport { aiGateLadder } from '../runtime/ai-gate'\nimport { aiJobAdmissionRefusal, aiJobSiteRefusal } from '../jobs/ai-job-admission'\nimport { AI_JOB_BRIEF_MAX_CHARS } from '../jobs/ai-job-text-step'\nimport {\n  AI_JOB_INLINE_BUDGET_MS,\n  aiJobNextStepMinimumMs,\n  aiJobSummary,\n  createAiJob,\n  listAiJobs,\n  runAiJobStep,\n} from '../jobs/ai-jobs'\nimport { releaseAssistMessage } from '../usage/assist-usage'\nimport { aiUsageMeter } from '../usage/ai-usage-meter'\nimport { aiJobsGate } from './ai-jobs-gate'\n\n/**\n * AI generation jobs: create and list (AGL-2904).\n *\n * `POST` is a door that spends, so it climbs the whole ladder (AGL-2903) —\n * `aiGenerative`, `release_ai_generative`, the `ai-generate` switch, a\n * per-uid window, and a reservation — and then creates the job and runs\n * its first step INLINE under `AI_JOB_INLINE_BUDGET_MS`. A step that\n * finishes in time answers with the job `done` (or `queued` behind its\n * next step); one that does not is aborted, its reservation handed back,\n * and the job answers `queued` for the beat to resume. Either way the\n * caller gets the job document, and the events route is how it watches\n * from there.\n *\n * `GET` lists the org's jobs, newest first, through the read gate: the\n * same rungs up to the lockdown verdict, no reservation.\n *\n * The request must NAME the org it is metered against (AGL-1934). There\n * is no fallback to \"the caller's first org\".\n */\n\nconst AI_JOBS_RATE_LIMIT = { key: 'ai-jobs', limit: 10, windowMs: 60_000 }\n\n/** Kind-specific inputs, bounded: a runner reads scalars, not a document. */\nconst MAX_INPUTS_JSON_CHARS = 8_000\n\n/** The admitted statuses for the list filter, as the union spells them. */\nconst AI_JOB_STATUSES: readonly AiJobStatus[] = [\n  'queued',\n  'running',\n  'needs_input',\n  'needs_review',\n  'done',\n  'failed',\n  'canceled',\n]\n\nexport interface CreateAiJobBody {\n  orgId: string\n  hostId: string | null\n  kind: AiJobKind\n  brief: string\n  inputs: Record<string, string | number | boolean>\n  /** A catalog model the creator picked (AGL-2942), or `null` for Auto. */\n  model: string | null\n}\n\nconst ID_CHARS = /^[A-Za-z0-9_-]{1,100}$/\n\n/** The longest model id a body may carry; the catalog's ids are far shorter. */\nconst MAX_MODEL_CHARS = 100\n\n/** Validate + clamp the request body; a string names what is wrong. */\nexport function parseCreateAiJobBody(payload: unknown): CreateAiJobBody | string {\n  const body = (payload ?? {}) as Record<string, unknown>\n  const orgId = String(body.orgId ?? '').trim()\n  if (!orgId) return 'Open a workspace before using this feature'\n  const kind = String(body.kind ?? '')\n  if (!(AI_JOB_KINDS as readonly string[]).includes(kind)) {\n    return `kind must be one of ${AI_JOB_KINDS.join(', ')}`\n  }\n  const brief = String(body.brief ?? '').trim()\n  if (!brief) return 'Write a brief for the job'\n  if (brief.length > AI_JOB_BRIEF_MAX_CHARS) {\n    return `Keep the brief under ${AI_JOB_BRIEF_MAX_CHARS.toLocaleString('en-US')} characters`\n  }\n  const rawHost = body.hostId\n  const hostId =\n    rawHost === undefined || rawHost === null || rawHost === ''\n      ? null\n      : typeof rawHost === 'string' && ID_CHARS.test(rawHost)\n        ? rawHost\n        : undefined\n  if (hostId === undefined) return 'hostId is not a site id'\n  // A theme is fields on one site's document, so a theme job that names no\n  // site has nothing to propose a change to (AGL-2938).\n  if (kind === 'theme' && !hostId) return 'Open a site before changing its theme'\n  const rawInputs = body.inputs\n  const inputs: Record<string, string | number | boolean> = {}\n  if (rawInputs !== undefined && rawInputs !== null) {\n    if (typeof rawInputs !== 'object' || Array.isArray(rawInputs)) {\n      return 'inputs must be an object'\n    }\n    for (const [key, value] of Object.entries(rawInputs as Record<string, unknown>)) {\n      if (\n        typeof value !== 'string' &&\n        typeof value !== 'number' &&\n        typeof value !== 'boolean'\n      ) {\n        return `inputs.${key} must be a string, number or boolean`\n      }\n      inputs[key] = value\n    }\n    if (JSON.stringify(inputs).length > MAX_INPUTS_JSON_CHARS) {\n      return 'inputs are too large'\n    }\n  }\n  const rawModel = typeof body.model === 'string' ? body.model.trim() : ''\n  if (rawModel.length > MAX_MODEL_CHARS) return 'model is not a model id'\n  // Validated against the plan and the allotment allowlists when each step\n  // runs, not here: the allowlists are read inside the step's reservation.\n  const model = rawModel && rawModel !== 'auto' ? rawModel : null\n  return { orgId, hostId, kind: kind as AiJobKind, brief, inputs, model }\n}\n\nexport async function POST(request: Request): Promise<Response> {\n  let payload: unknown\n  try {\n    payload = await request.json()\n  } catch {\n    payload = null\n  }\n  const parsed = parseCreateAiJobBody(payload)\n  // The org is parsed BEFORE the ladder so a request that named none is\n  // refused with the ladder's 400 rather than a shape error; every other\n  // shape fault waits until the caller has proven who they are.\n  const orgId = typeof parsed === 'string' ? String((payload as Record<string, unknown> | null)?.orgId ?? '') : parsed.orgId\n  // The site rides along for the same reason: a collaborator's `ai.generate`\n  // is decided per site (AGL-2927), so the ladder needs it before it can say\n  // whether this member may generate here at all.\n  const hostId = typeof parsed === 'string' ? null : parsed.hostId\n  const gate = await aiGateLadder(\n    { request, orgId, hostId },\n    {\n      feature: 'aiGenerative',\n      releaseFlag: 'release_ai_generative',\n      lockdownFeature: 'ai-generate',\n      permission: 'ai.generate',\n      rateLimit: AI_JOBS_RATE_LIMIT,\n    },\n  )\n  if (gate instanceof Response) return gate\n  if (typeof parsed === 'string') {\n    // Admitted, reserved, and then found to have sent nothing runnable: the\n    // reservation goes back, because no token was spent.\n    await releaseAssistMessage(gate.firestore, gate.orgId, gate.reservation).catch(\n      () => undefined,\n    )\n    return Response.json({ error: parsed }, { status: 400 })\n  }\n  // What only this kind can say about the request (AGL-2909): a site it\n  // needs, inputs it reads, an allowance its draft counts against. Asked\n  // before the job exists, so a refusal spends nothing.\n  let refusal: Awaited<ReturnType<typeof aiJobAdmissionRefusal>>\n  try {\n    // A site that switched AI off first (AGL-3028), then the kind's own check.\n    refusal =\n      (await aiJobSiteRefusal({\n        firestore: gate.firestore,\n        org: gate.org,\n        hostId: parsed.hostId,\n      })) ??\n      (await aiJobAdmissionRefusal(parsed.kind, {\n        firestore: gate.firestore,\n        orgId: gate.orgId,\n        hostId: parsed.hostId,\n        inputs: parsed.inputs,\n        org: gate.org,\n        uid: gate.uid,\n      }))\n  } catch (error) {\n    await releaseAssistMessage(gate.firestore, gate.orgId, gate.reservation).catch(\n      () => undefined,\n    )\n    console.error('ai job admission failed', { orgId: gate.orgId, kind: parsed.kind, error })\n    return Response.json({ error: 'The AI job could not be created' }, { status: 500 })\n  }\n  if (refusal) {\n    await releaseAssistMessage(gate.firestore, gate.orgId, gate.reservation).catch(\n      () => undefined,\n    )\n    return Response.json({ error: refusal.error }, { status: refusal.status })\n  }\n\n  const now = new Date()\n  let created: Awaited<ReturnType<typeof createAiJob>>\n  try {\n    created = await createAiJob(\n      gate.firestore,\n      {\n        orgId: gate.orgId,\n        hostId: parsed.hostId,\n        kind: parsed.kind,\n        brief: parsed.brief,\n        inputs: parsed.inputs,\n        model: parsed.model,\n        createdBy: gate.uid,\n        createdByEmail: gate.decoded.email ?? null,\n      },\n      now,\n    )\n  } catch (error) {\n    await releaseAssistMessage(gate.firestore, gate.orgId, gate.reservation).catch(\n      () => undefined,\n    )\n    console.error('ai job create failed', { orgId: gate.orgId, error })\n    return Response.json({ error: 'The AI job could not be created' }, { status: 500 })\n  }\n  const jobId = created.$id\n\n  // A first step that needs more time than this request has (AGL-2907) is left\n  // queued for the beat, which starts it with a budget of its own: a provider\n  // call this request's timeout cut off would be billed upstream and metered\n  // nowhere. Nothing ran, so the reservation goes back.\n  if (aiJobNextStepMinimumMs(created) > AI_JOB_INLINE_BUDGET_MS) {\n    await releaseAssistMessage(gate.firestore, gate.orgId, gate.reservation).catch(\n      () => undefined,\n    )\n    return Response.json(\n      {\n        job: aiJobSummary(created, now),\n        meter: aiUsageMeter(gate.reservation, { lastCredits: null }),\n      },\n      { status: 200 },\n    )\n  }\n\n  // The first step, inline, on the reservation the ladder already holds.\n  // The runner hands that reservation back itself if the provider is never\n  // reached, and re-queues the step when the budget ends first.\n  const run = await runAiJobStep(gate.firestore, gate.orgId, jobId, {\n    owner: `route:${randomUUID()}`,\n    now,\n    reservation: gate.reservation,\n    org: gate.org,\n    signal: AbortSignal.timeout(AI_JOB_INLINE_BUDGET_MS),\n    // The caller is on the request, so what the inline step produces is\n    // attributed with their address; the beat's steps carry the uid alone.\n    actor: { uid: gate.uid, email: gate.decoded.email ?? null },\n    // The workspace's AI pause lets staff through, as the ladder above did.\n    staff: gate.staff,\n  })\n  if (run.outcome === 'not-claimable') {\n    // A job created a moment ago has a claimable first step; anything else\n    // is a fault in the machine, and the reservation must not be stranded.\n    await releaseAssistMessage(gate.firestore, gate.orgId, gate.reservation).catch(\n      () => undefined,\n    )\n    console.error('ai job first step not claimable', { orgId: gate.orgId, jobId })\n    return Response.json({ error: 'The AI job could not be started' }, { status: 500 })\n  }\n  return Response.json(\n    {\n      job: aiJobSummary(run.job),\n      // The usage strip's envelope (AGL-2942): the reservation the ladder\n      // took, with what the inline step spent.\n      meter: aiUsageMeter(gate.reservation, {\n        lastCredits: run.job.creditsSpent > 0 ? run.job.creditsSpent : null,\n      }),\n    },\n    { status: 200 },\n  )\n}\n\nexport async function GET(request: Request): Promise<Response> {\n  const url = new URL(request.url)\n  const gate = await aiJobsGate(request, url.searchParams.get('orgId') ?? '')\n  if (gate instanceof Response) return gate\n  const rawStatus = url.searchParams.get('status') ?? ''\n  const status = (AI_JOB_STATUSES as readonly string[]).includes(rawStatus)\n    ? (rawStatus as AiJobStatus)\n    : undefined\n  const limit = Number(url.searchParams.get('limit') ?? '')\n  const now = new Date()\n  const jobs = await listAiJobs(gate.firestore, gate.orgId, {\n    ...(status ? { status } : {}),\n    ...(Number.isFinite(limit) && limit > 0 ? { limit } : {}),\n  })\n  return Response.json(\n    { jobs: jobs.map((job) => aiJobSummary(job, now)) },\n    { status: 200, headers: { 'Cache-Control': 'no-store' } },\n  )\n}\n\nexport const dynamic = 'force-dynamic'\nexport const maxDuration = 60\n"],"names":["randomUUID","AI_JOB_KINDS","aiGateLadder","aiJobAdmissionRefusal","aiJobSiteRefusal","AI_JOB_BRIEF_MAX_CHARS","AI_JOB_INLINE_BUDGET_MS","aiJobNextStepMinimumMs","aiJobSummary","createAiJob","listAiJobs","runAiJobStep","releaseAssistMessage","aiUsageMeter","aiJobsGate","AI_JOBS_RATE_LIMIT","key","limit","windowMs","MAX_INPUTS_JSON_CHARS","AI_JOB_STATUSES","ID_CHARS","MAX_MODEL_CHARS","parseCreateAiJobBody","payload","body","orgId","String","trim","kind","includes","join","brief","length","toLocaleString","rawHost","hostId","undefined","test","rawInputs","inputs","Array","isArray","value","Object","entries","JSON","stringify","rawModel","model","POST","request","gate","json","parsed","feature","releaseFlag","lockdownFeature","permission","rateLimit","Response","firestore","reservation","catch","error","status","refusal","org","uid","console","now","Date","created","createdBy","createdByEmail","decoded","email","jobId","$id","job","meter","lastCredits","run","owner","signal","AbortSignal","timeout","actor","staff","outcome","creditsSpent","GET","url","URL","searchParams","get","rawStatus","Number","jobs","isFinite","map","headers","dynamic","maxDuration"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED,+DAA+D;AAC/D,0EAA0E;AAC1E,6DAA6D;AAE7D,SAASA,UAAU,QAAQ,SAAQ;AACnC,SACEC,YAAY,QAGP,4BAAwB;AAC/B,yEAAyE;AACzE,4EAA4E;AAC5E,iEAAiE;AACjE,SAASC,YAAY,QAAQ,wBAAoB;AACjD,SAASC,qBAAqB,EAAEC,gBAAgB,QAAQ,8BAA0B;AAClF,SAASC,sBAAsB,QAAQ,8BAA0B;AACjE,SACEC,uBAAuB,EACvBC,sBAAsB,EACtBC,YAAY,EACZC,WAAW,EACXC,UAAU,EACVC,YAAY,QACP,qBAAiB;AACxB,SAASC,oBAAoB,QAAQ,2BAAuB;AAC5D,SAASC,YAAY,QAAQ,6BAAyB;AACtD,SAASC,UAAU,QAAQ,oBAAgB;AAE3C;;;;;;;;;;;;;;;;;;CAkBC,GAED,MAAMC,qBAAqB;IAAEC,KAAK;IAAWC,OAAO;IAAIC,UAAU;AAAO;AAEzE,2EAA2E,GAC3E,MAAMC,wBAAwB;AAE9B,yEAAyE,GACzE,MAAMC,kBAA0C;IAC9C;IACA;IACA;IACA;IACA;IACA;IACA;CACD;AAYD,MAAMC,WAAW;AAEjB,8EAA8E,GAC9E,MAAMC,kBAAkB;AAExB,qEAAqE,GACrE,OAAO,SAASC,qBAAqBC,OAAgB;QAE9BC,aAEDA,YAICA;IAPrB,MAAMA,OAAQD,kBAAAA,UAAW,CAAC;IAC1B,MAAME,QAAQC,QAAOF,cAAAA,KAAKC,KAAK,YAAVD,cAAc,IAAIG,IAAI;IAC3C,IAAI,CAACF,OAAO,OAAO;IACnB,MAAMG,OAAOF,QAAOF,aAAAA,KAAKI,IAAI,YAATJ,aAAa;IACjC,IAAI,CAAC,AAACxB,aAAmC6B,QAAQ,CAACD,OAAO;QACvD,OAAO,CAAC,oBAAoB,EAAE5B,aAAa8B,IAAI,CAAC,OAAO;IACzD;IACA,MAAMC,QAAQL,QAAOF,cAAAA,KAAKO,KAAK,YAAVP,cAAc,IAAIG,IAAI;IAC3C,IAAI,CAACI,OAAO,OAAO;IACnB,IAAIA,MAAMC,MAAM,GAAG5B,wBAAwB;QACzC,OAAO,CAAC,qBAAqB,EAAEA,uBAAuB6B,cAAc,CAAC,SAAS,WAAW,CAAC;IAC5F;IACA,MAAMC,UAAUV,KAAKW,MAAM;IAC3B,MAAMA,SACJD,YAAYE,aAAaF,YAAY,QAAQA,YAAY,KACrD,OACA,OAAOA,YAAY,YAAYd,SAASiB,IAAI,CAACH,WAC3CA,UACAE;IACR,IAAID,WAAWC,WAAW,OAAO;IACjC,yEAAyE;IACzE,sDAAsD;IACtD,IAAIR,SAAS,WAAW,CAACO,QAAQ,OAAO;IACxC,MAAMG,YAAYd,KAAKe,MAAM;IAC7B,MAAMA,SAAoD,CAAC;IAC3D,IAAID,cAAcF,aAAaE,cAAc,MAAM;QACjD,IAAI,OAAOA,cAAc,YAAYE,MAAMC,OAAO,CAACH,YAAY;YAC7D,OAAO;QACT;QACA,KAAK,MAAM,CAACvB,KAAK2B,MAAM,IAAIC,OAAOC,OAAO,CAACN,WAAuC;YAC/E,IACE,OAAOI,UAAU,YACjB,OAAOA,UAAU,YACjB,OAAOA,UAAU,WACjB;gBACA,OAAO,CAAC,OAAO,EAAE3B,IAAI,oCAAoC,CAAC;YAC5D;YACAwB,MAAM,CAACxB,IAAI,GAAG2B;QAChB;QACA,IAAIG,KAAKC,SAAS,CAACP,QAAQP,MAAM,GAAGd,uBAAuB;YACzD,OAAO;QACT;IACF;IACA,MAAM6B,WAAW,OAAOvB,KAAKwB,KAAK,KAAK,WAAWxB,KAAKwB,KAAK,CAACrB,IAAI,KAAK;IACtE,IAAIoB,SAASf,MAAM,GAAGX,iBAAiB,OAAO;IAC9C,yEAAyE;IACzE,yEAAyE;IACzE,MAAM2B,QAAQD,YAAYA,aAAa,SAASA,WAAW;IAC3D,OAAO;QAAEtB;QAAOU;QAAQP,MAAMA;QAAmBG;QAAOQ;QAAQS;IAAM;AACxE;AAEA,OAAO,eAAeC,KAAKC,OAAgB;cA2HRC;IA1HjC,IAAI5B;IACJ,IAAI;QACFA,UAAU,MAAM2B,QAAQE,IAAI;IAC9B,EAAE,eAAM;QACN7B,UAAU;IACZ;IACA,MAAM8B,SAAS/B,qBAAqBC;IACpC,sEAAsE;IACtE,uEAAuE;IACvE,8DAA8D;IAC9D,MAAME,QAAQ,OAAO4B,WAAW,WAAW3B,eAAQH,2BAAD,AAACA,QAA4CE,KAAK,mBAAI,MAAM4B,OAAO5B,KAAK;IAC1H,2EAA2E;IAC3E,2EAA2E;IAC3E,gDAAgD;IAChD,MAAMU,SAAS,OAAOkB,WAAW,WAAW,OAAOA,OAAOlB,MAAM;IAChE,MAAMgB,OAAO,MAAMlD,aACjB;QAAEiD;QAASzB;QAAOU;IAAO,GACzB;QACEmB,SAAS;QACTC,aAAa;QACbC,iBAAiB;QACjBC,YAAY;QACZC,WAAW5C;IACb;IAEF,IAAIqC,gBAAgBQ,UAAU,OAAOR;IACrC,IAAI,OAAOE,WAAW,UAAU;QAC9B,wEAAwE;QACxE,qDAAqD;QACrD,MAAM1C,qBAAqBwC,KAAKS,SAAS,EAAET,KAAK1B,KAAK,EAAE0B,KAAKU,WAAW,EAAEC,KAAK,CAC5E,IAAM1B;QAER,OAAOuB,SAASP,IAAI,CAAC;YAAEW,OAAOV;QAAO,GAAG;YAAEW,QAAQ;QAAI;IACxD;IACA,sEAAsE;IACtE,uEAAuE;IACvE,sDAAsD;IACtD,IAAIC;IACJ,IAAI;YAGC;QAFH,2EAA2E;QAC3EA,WACG,QAAA,MAAM9D,iBAAiB;YACtByD,WAAWT,KAAKS,SAAS;YACzBM,KAAKf,KAAKe,GAAG;YACb/B,QAAQkB,OAAOlB,MAAM;QACvB,cAJC,QAKA,MAAMjC,sBAAsBmD,OAAOzB,IAAI,EAAE;YACxCgC,WAAWT,KAAKS,SAAS;YACzBnC,OAAO0B,KAAK1B,KAAK;YACjBU,QAAQkB,OAAOlB,MAAM;YACrBI,QAAQc,OAAOd,MAAM;YACrB2B,KAAKf,KAAKe,GAAG;YACbC,KAAKhB,KAAKgB,GAAG;QACf;IACJ,EAAE,OAAOJ,OAAO;QACd,MAAMpD,qBAAqBwC,KAAKS,SAAS,EAAET,KAAK1B,KAAK,EAAE0B,KAAKU,WAAW,EAAEC,KAAK,CAC5E,IAAM1B;QAERgC,QAAQL,KAAK,CAAC,2BAA2B;YAAEtC,OAAO0B,KAAK1B,KAAK;YAAEG,MAAMyB,OAAOzB,IAAI;YAAEmC;QAAM;QACvF,OAAOJ,SAASP,IAAI,CAAC;YAAEW,OAAO;QAAkC,GAAG;YAAEC,QAAQ;QAAI;IACnF;IACA,IAAIC,SAAS;QACX,MAAMtD,qBAAqBwC,KAAKS,SAAS,EAAET,KAAK1B,KAAK,EAAE0B,KAAKU,WAAW,EAAEC,KAAK,CAC5E,IAAM1B;QAER,OAAOuB,SAASP,IAAI,CAAC;YAAEW,OAAOE,QAAQF,KAAK;QAAC,GAAG;YAAEC,QAAQC,QAAQD,MAAM;QAAC;IAC1E;IAEA,MAAMK,MAAM,IAAIC;IAChB,IAAIC;IACJ,IAAI;YAWkBpB;QAVpBoB,UAAU,MAAM/D,YACd2C,KAAKS,SAAS,EACd;YACEnC,OAAO0B,KAAK1B,KAAK;YACjBU,QAAQkB,OAAOlB,MAAM;YACrBP,MAAMyB,OAAOzB,IAAI;YACjBG,OAAOsB,OAAOtB,KAAK;YACnBQ,QAAQc,OAAOd,MAAM;YACrBS,OAAOK,OAAOL,KAAK;YACnBwB,WAAWrB,KAAKgB,GAAG;YACnBM,cAAc,GAAEtB,uBAAAA,KAAKuB,OAAO,CAACC,KAAK,YAAlBxB,uBAAsB;QACxC,GACAkB;IAEJ,EAAE,OAAON,OAAO;QACd,MAAMpD,qBAAqBwC,KAAKS,SAAS,EAAET,KAAK1B,KAAK,EAAE0B,KAAKU,WAAW,EAAEC,KAAK,CAC5E,IAAM1B;QAERgC,QAAQL,KAAK,CAAC,wBAAwB;YAAEtC,OAAO0B,KAAK1B,KAAK;YAAEsC;QAAM;QACjE,OAAOJ,SAASP,IAAI,CAAC;YAAEW,OAAO;QAAkC,GAAG;YAAEC,QAAQ;QAAI;IACnF;IACA,MAAMY,QAAQL,QAAQM,GAAG;IAEzB,6EAA6E;IAC7E,4EAA4E;IAC5E,2EAA2E;IAC3E,sDAAsD;IACtD,IAAIvE,uBAAuBiE,WAAWlE,yBAAyB;QAC7D,MAAMM,qBAAqBwC,KAAKS,SAAS,EAAET,KAAK1B,KAAK,EAAE0B,KAAKU,WAAW,EAAEC,KAAK,CAC5E,IAAM1B;QAER,OAAOuB,SAASP,IAAI,CAClB;YACE0B,KAAKvE,aAAagE,SAASF;YAC3BU,OAAOnE,aAAauC,KAAKU,WAAW,EAAE;gBAAEmB,aAAa;YAAK;QAC5D,GACA;YAAEhB,QAAQ;QAAI;IAElB;IAEA,uEAAuE;IACvE,yEAAyE;IACzE,8DAA8D;IAC9D,MAAMiB,MAAM,MAAMvE,aAAayC,KAAKS,SAAS,EAAET,KAAK1B,KAAK,EAAEmD,OAAO;QAChEM,OAAO,CAAC,MAAM,EAAEnF,cAAc;QAC9BsE;QACAR,aAAaV,KAAKU,WAAW;QAC7BK,KAAKf,KAAKe,GAAG;QACbiB,QAAQC,YAAYC,OAAO,CAAChF;QAC5B,oEAAoE;QACpE,uEAAuE;QACvEiF,OAAO;YAAEnB,KAAKhB,KAAKgB,GAAG;YAAEQ,KAAK,GAAExB,sBAAAA,KAAKuB,OAAO,CAACC,KAAK,YAAlBxB,sBAAsB;QAAK;QAC1D,wEAAwE;QACxEoC,OAAOpC,KAAKoC,KAAK;IACnB;IACA,IAAIN,IAAIO,OAAO,KAAK,iBAAiB;QACnC,uEAAuE;QACvE,uEAAuE;QACvE,MAAM7E,qBAAqBwC,KAAKS,SAAS,EAAET,KAAK1B,KAAK,EAAE0B,KAAKU,WAAW,EAAEC,KAAK,CAC5E,IAAM1B;QAERgC,QAAQL,KAAK,CAAC,mCAAmC;YAAEtC,OAAO0B,KAAK1B,KAAK;YAAEmD;QAAM;QAC5E,OAAOjB,SAASP,IAAI,CAAC;YAAEW,OAAO;QAAkC,GAAG;YAAEC,QAAQ;QAAI;IACnF;IACA,OAAOL,SAASP,IAAI,CAClB;QACE0B,KAAKvE,aAAa0E,IAAIH,GAAG;QACzB,oEAAoE;QACpE,yCAAyC;QACzCC,OAAOnE,aAAauC,KAAKU,WAAW,EAAE;YACpCmB,aAAaC,IAAIH,GAAG,CAACW,YAAY,GAAG,IAAIR,IAAIH,GAAG,CAACW,YAAY,GAAG;QACjE;IACF,GACA;QAAEzB,QAAQ;IAAI;AAElB;AAEA,OAAO,eAAe0B,IAAIxC,OAAgB;QAEDyC,uBAErBA,wBAIGA;IAPrB,MAAMA,MAAM,IAAIC,IAAI1C,QAAQyC,GAAG;IAC/B,MAAMxC,OAAO,MAAMtC,WAAWqC,UAASyC,wBAAAA,IAAIE,YAAY,CAACC,GAAG,CAAC,oBAArBH,wBAAiC;IACxE,IAAIxC,gBAAgBQ,UAAU,OAAOR;IACrC,MAAM4C,aAAYJ,yBAAAA,IAAIE,YAAY,CAACC,GAAG,CAAC,qBAArBH,yBAAkC;IACpD,MAAM3B,SAAS,AAAC7C,gBAAsCU,QAAQ,CAACkE,aAC1DA,YACD3D;IACJ,MAAMpB,QAAQgF,QAAOL,yBAAAA,IAAIE,YAAY,CAACC,GAAG,CAAC,oBAArBH,yBAAiC;IACtD,MAAMtB,MAAM,IAAIC;IAChB,MAAM2B,OAAO,MAAMxF,WAAW0C,KAAKS,SAAS,EAAET,KAAK1B,KAAK,EAAE,aACpDuC,SAAS;QAAEA;IAAO,IAAI,CAAC,GACvBgC,OAAOE,QAAQ,CAAClF,UAAUA,QAAQ,IAAI;QAAEA;IAAM,IAAI,CAAC;IAEzD,OAAO2C,SAASP,IAAI,CAClB;QAAE6C,MAAMA,KAAKE,GAAG,CAAC,CAACrB,MAAQvE,aAAauE,KAAKT;IAAM,GAClD;QAAEL,QAAQ;QAAKoC,SAAS;YAAE,iBAAiB;QAAW;IAAE;AAE5D;AAEA,OAAO,MAAMC,UAAU,gBAAe;AACtC,OAAO,MAAMC,cAAc,GAAE"}

package/src/lib/server/ai-models.d.ts

@@ -0,0 +1,18 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+declare function handler(request: Request): Promise<Response>;
+export { handler as GET };

package/src/lib/server/ai-models.js

@@ -0,0 +1,134 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ import { pluginRequestFromWeb } from "@aglyn/aglyn/server";
+import { resolveEffectivePlan } from "@aglyn/aglyn/app-utils/plan-entitlements";
+import { permissionRefusal, emailUnverifiedResponse, firebaseAdmin, isImpersonationSession, memberHasPermissionOnHost, resolveOrgMembership } from "@aglyn/tenant-data-admin";
+import { invalidIdTokenResponse } from "@aglyn/tenant-data-admin/server/id-token-refusal";
+import { aiUsageMonthKeys } from "../model/ai-usage-by-user.js";
+import { AI_STEP_TIERS } from "../providers/catalog.js";
+import { aiModelOptions } from "../providers/model-choice.js";
+import { aiProviderReady } from "../runtime/ai-runtime.js";
+import { readAiAllotmentGate } from "../usage/ai-allotments.js";
+import { readMeasuredStepUsage } from "../usage/ai-model-sample.js";
+// lockdown-423: exempt — a READ-ONLY listing of what the model switch
+// offers; it spends nothing and writes nothing, and every door the pick is
+// then sent to carries its own lockdown rung.
+/**
+ * THE MODEL SWITCH'S OPTIONS (AGL-2942): `GET ?orgId=&hostId=&kind=`.
+ *
+ * What the selector in the panel and the generation dialogs lists for one
+ * step kind: Auto — labeled with the model the routing table sends that kind
+ * to under the caller's bounds — and the models a manual pick may name, each
+ * with its credits per typical request and its multiple of Auto.
+ *
+ * Read when the switch is OPENED, never on a panel's mount, and bounded to
+ * the reads the answer needs: the org's plan (the membership read already
+ * returns the org), the allotment allowlists that apply to the caller on the
+ * site, and a bounded page of the workspace's own signals for the measured
+ * median. The door the pick is sent to decides again, inside its own
+ * reservation, so this list is a courtesy the server does not trust.
+ *
+ * Gated on `ai.use` on the caller's axis — the switch is part of using AI.
+ */ const json = (body, status)=>Response.json(body, {
+        status
+    });
+const STEP_KINDS = Object.keys(AI_STEP_TIERS);
+async function handler(request) {
+    var _headers_authorization, _params_orgId, _params_hostId, _params_kind;
+    const { method, query, headers: rawHeaders } = await pluginRequestFromWeb(request);
+    const headers = rawHeaders;
+    if (method !== 'GET') return json({
+        error: 'Method not allowed'
+    }, 405);
+    const authorization = (_headers_authorization = headers.authorization) != null ? _headers_authorization : '';
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return json({
+        error: 'Unauthenticated'
+    }, 401);
+    const params = query != null ? query : {};
+    const orgId = String((_params_orgId = params['orgId']) != null ? _params_orgId : '').trim();
+    const hostId = String((_params_hostId = params['hostId']) != null ? _params_hostId : '').trim();
+    const kind = String((_params_kind = params['kind']) != null ? _params_kind : '');
+    if (!orgId) return json({
+        error: 'Missing orgId'
+    }, 400);
+    if (!STEP_KINDS.includes(kind)) {
+        return json({
+            error: `kind must be one of ${STEP_KINDS.join(', ')}`
+        }, 400);
+    }
+    try {
+        var _orgSnapshot_data, _ref, _ref1, _ref2, _ref3, _ref4;
+        const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+        if (!decoded.email_verified && !isImpersonationSession(decoded)) {
+            return emailUnverifiedResponse();
+        }
+        const staff = decoded['staff'] === true;
+        const membership = await resolveOrgMembership(decoded.uid, orgId);
+        if (!membership && !staff) return json({
+            error: 'Not found'
+        }, 404);
+        if (!staff && !await memberHasPermissionOnHost(orgId, hostId, membership == null ? void 0 : membership.member, 'ai.use')) {
+            return permissionRefusal('ai.use');
+        }
+        if (!aiProviderReady()) {
+            return json({
+                kind,
+                auto: null,
+                options: [],
+                measured: false
+            }, 200);
+        }
+        const firestore = firebaseAdmin.app().firestore();
+        const orgRef = firestore.collection('orgs').doc(orgId);
+        const month = aiUsageMonthKeys()[0];
+        const [orgSnapshot, gate, measured] = await Promise.all([
+            orgRef.get(),
+            readAiAllotmentGate((ref)=>ref.get(), orgRef, {
+                uid: decoded.uid,
+                hostId
+            }, month),
+            readMeasuredStepUsage(firestore, orgId, kind).catch(()=>null)
+        ]);
+        const org = (_orgSnapshot_data = orgSnapshot.data()) != null ? _orgSnapshot_data : {};
+        const listed = aiModelOptions(kind, {
+            plan: resolveEffectivePlan(org),
+            allotmentModels: (_ref = gate == null ? void 0 : gate.models) != null ? _ref : null,
+            orgModels: (_ref1 = gate == null ? void 0 : gate.orgModels) != null ? _ref1 : null
+        }, measured);
+        return Response.json({
+            kind,
+            auto: (_ref2 = listed == null ? void 0 : listed.auto) != null ? _ref2 : null,
+            options: (_ref3 = listed == null ? void 0 : listed.options) != null ? _ref3 : [],
+            measured: (_ref4 = listed == null ? void 0 : listed.measured) != null ? _ref4 : false
+        }, {
+            status: 200,
+            headers: {
+                'Cache-Control': 'no-store, private'
+            }
+        });
+    } catch (error) {
+        const unauthenticated = invalidIdTokenResponse(error);
+        if (unauthenticated) return unauthenticated;
+        console.error('[ai/models] failed', orgId, error);
+        return json({
+            error: 'AI models unavailable'
+        }, 500);
+    }
+}
+export { handler as GET };
+
+//# sourceMappingURL=ai-models.js.map

package/src/lib/server/ai-models.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/ai/src/lib/server/ai-models.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\nimport { pluginRequestFromWeb } from '@aglyn/aglyn/server'\nimport { resolveEffectivePlan } from '@aglyn/aglyn/app-utils/plan-entitlements'\nimport {\n  permissionRefusal,\n  emailUnverifiedResponse,\n  firebaseAdmin,\n  isImpersonationSession,\n  memberHasPermissionOnHost,\n  resolveOrgMembership,\n} from '@aglyn/tenant-data-admin'\nimport { invalidIdTokenResponse } from '@aglyn/tenant-data-admin/server/id-token-refusal'\nimport { aiUsageMonthKeys } from '../model/ai-usage-by-user'\nimport { AI_STEP_TIERS, type AiStepKind } from '../providers/catalog'\nimport { aiModelOptions } from '../providers/model-choice'\nimport { aiProviderReady } from '../runtime/ai-runtime'\nimport { readAiAllotmentGate } from '../usage/ai-allotments'\nimport { readMeasuredStepUsage } from '../usage/ai-model-sample'\n\n// lockdown-423: exempt — a READ-ONLY listing of what the model switch\n// offers; it spends nothing and writes nothing, and every door the pick is\n// then sent to carries its own lockdown rung.\n\n/**\n * THE MODEL SWITCH'S OPTIONS (AGL-2942): `GET ?orgId=&hostId=&kind=`.\n *\n * What the selector in the panel and the generation dialogs lists for one\n * step kind: Auto — labeled with the model the routing table sends that kind\n * to under the caller's bounds — and the models a manual pick may name, each\n * with its credits per typical request and its multiple of Auto.\n *\n * Read when the switch is OPENED, never on a panel's mount, and bounded to\n * the reads the answer needs: the org's plan (the membership read already\n * returns the org), the allotment allowlists that apply to the caller on the\n * site, and a bounded page of the workspace's own signals for the measured\n * median. The door the pick is sent to decides again, inside its own\n * reservation, so this list is a courtesy the server does not trust.\n *\n * Gated on `ai.use` on the caller's axis — the switch is part of using AI.\n */\n\nconst json = (body: unknown, status: number) => Response.json(body, { status })\n\nconst STEP_KINDS = Object.keys(AI_STEP_TIERS) as AiStepKind[]\n\nasync function handler(request: Request): Promise<Response> {\n  const { method, query, headers: rawHeaders } = await pluginRequestFromWeb(request)\n  const headers = rawHeaders as Partial<Record<string, string>>\n  if (method !== 'GET') return json({ error: 'Method not allowed' }, 405)\n  const authorization = headers.authorization ?? ''\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return json({ error: 'Unauthenticated' }, 401)\n  const params = (query ?? {}) as Record<string, unknown>\n  const orgId = String(params['orgId'] ?? '').trim()\n  const hostId = String(params['hostId'] ?? '').trim()\n  const kind = String(params['kind'] ?? '') as AiStepKind\n  if (!orgId) return json({ error: 'Missing orgId' }, 400)\n  if (!STEP_KINDS.includes(kind)) {\n    return json({ error: `kind must be one of ${STEP_KINDS.join(', ')}` }, 400)\n  }\n\n  try {\n    const decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n    if (!decoded.email_verified && !isImpersonationSession(decoded)) {\n      return emailUnverifiedResponse()\n    }\n    const staff = decoded['staff'] === true\n    const membership = await resolveOrgMembership(decoded.uid, orgId)\n    if (!membership && !staff) return json({ error: 'Not found' }, 404)\n    if (\n      !staff &&\n      !(await memberHasPermissionOnHost(orgId, hostId, membership?.member, 'ai.use'))\n    ) {\n      return permissionRefusal('ai.use')\n    }\n    if (!aiProviderReady()) {\n      return json({ kind, auto: null, options: [], measured: false }, 200)\n    }\n\n    const firestore = firebaseAdmin.app().firestore()\n    const orgRef = firestore.collection('orgs').doc(orgId)\n    const month = aiUsageMonthKeys()[0]\n    const [orgSnapshot, gate, measured] = await Promise.all([\n      orgRef.get(),\n      readAiAllotmentGate((ref) => ref.get(), orgRef, { uid: decoded.uid, hostId }, month),\n      readMeasuredStepUsage(firestore, orgId, kind).catch(() => null),\n    ])\n    const org = (orgSnapshot.data() ?? {}) as Record<string, unknown>\n    const listed = aiModelOptions(\n      kind,\n      {\n        plan: resolveEffectivePlan(org as never),\n        allotmentModels: gate?.models ?? null,\n        orgModels: gate?.orgModels ?? null,\n      },\n      measured,\n    )\n    return Response.json(\n      {\n        kind,\n        auto: listed?.auto ?? null,\n        options: listed?.options ?? [],\n        measured: listed?.measured ?? false,\n      },\n      { status: 200, headers: { 'Cache-Control': 'no-store, private' } },\n    )\n  } catch (error) {\n    const unauthenticated = invalidIdTokenResponse(error)\n    if (unauthenticated) return unauthenticated\n    console.error('[ai/models] failed', orgId, error)\n    return json({ error: 'AI models unavailable' }, 500)\n  }\n}\n\nexport { handler as GET }\n"],"names":["pluginRequestFromWeb","resolveEffectivePlan","permissionRefusal","emailUnverifiedResponse","firebaseAdmin","isImpersonationSession","memberHasPermissionOnHost","resolveOrgMembership","invalidIdTokenResponse","aiUsageMonthKeys","AI_STEP_TIERS","aiModelOptions","aiProviderReady","readAiAllotmentGate","readMeasuredStepUsage","json","body","status","Response","STEP_KINDS","Object","keys","handler","request","headers","params","method","query","rawHeaders","error","authorization","idToken","startsWith","slice","length","undefined","orgId","String","trim","hostId","kind","includes","join","orgSnapshot","decoded","app","auth","verifyIdToken","email_verified","staff","membership","uid","member","auto","options","measured","firestore","orgRef","collection","doc","month","gate","Promise","all","get","ref","catch","org","data","listed","plan","allotmentModels","models","orgModels","unauthenticated","console","GET"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,SAASA,oBAAoB,QAAQ,sBAAqB;AAC1D,SAASC,oBAAoB,QAAQ,2CAA0C;AAC/E,SACEC,iBAAiB,EACjBC,uBAAuB,EACvBC,aAAa,EACbC,sBAAsB,EACtBC,yBAAyB,EACzBC,oBAAoB,QACf,2BAA0B;AACjC,SAASC,sBAAsB,QAAQ,mDAAkD;AACzF,SAASC,gBAAgB,QAAQ,+BAA2B;AAC5D,SAASC,aAAa,QAAyB,0BAAsB;AACrE,SAASC,cAAc,QAAQ,+BAA2B;AAC1D,SAASC,eAAe,QAAQ,2BAAuB;AACvD,SAASC,mBAAmB,QAAQ,4BAAwB;AAC5D,SAASC,qBAAqB,QAAQ,8BAA0B;AAEhE,sEAAsE;AACtE,2EAA2E;AAC3E,8CAA8C;AAE9C;;;;;;;;;;;;;;;;CAgBC,GAED,MAAMC,OAAO,CAACC,MAAeC,SAAmBC,SAASH,IAAI,CAACC,MAAM;QAAEC;IAAO;AAE7E,MAAME,aAAaC,OAAOC,IAAI,CAACX;AAE/B,eAAeY,QAAQC,OAAgB;QAIfC,wBAMDC,eACCA,gBACFA;IAXpB,MAAM,EAAEC,MAAM,EAAEC,KAAK,EAAEH,SAASI,UAAU,EAAE,GAAG,MAAM5B,qBAAqBuB;IAC1E,MAAMC,UAAUI;IAChB,IAAIF,WAAW,OAAO,OAAOX,KAAK;QAAEc,OAAO;IAAqB,GAAG;IACnE,MAAMC,iBAAgBN,yBAAAA,QAAQM,aAAa,YAArBN,yBAAyB;IAC/C,MAAMO,UAAUD,cAAcE,UAAU,CAAC,aACrCF,cAAcG,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAOhB,KAAK;QAAEc,OAAO;IAAkB,GAAG;IACxD,MAAMJ,SAAUE,gBAAAA,QAAS,CAAC;IAC1B,MAAMS,QAAQC,QAAOZ,gBAAAA,MAAM,CAAC,QAAQ,YAAfA,gBAAmB,IAAIa,IAAI;IAChD,MAAMC,SAASF,QAAOZ,iBAAAA,MAAM,CAAC,SAAS,YAAhBA,iBAAoB,IAAIa,IAAI;IAClD,MAAME,OAAOH,QAAOZ,eAAAA,MAAM,CAAC,OAAO,YAAdA,eAAkB;IACtC,IAAI,CAACW,OAAO,OAAOrB,KAAK;QAAEc,OAAO;IAAgB,GAAG;IACpD,IAAI,CAACV,WAAWsB,QAAQ,CAACD,OAAO;QAC9B,OAAOzB,KAAK;YAAEc,OAAO,CAAC,oBAAoB,EAAEV,WAAWuB,IAAI,CAAC,OAAO;QAAC,GAAG;IACzE;IAEA,IAAI;YA0BWC;QAzBb,MAAMC,UAAU,MAAMxC,cAAcyC,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAAChB;QAC/D,IAAI,CAACa,QAAQI,cAAc,IAAI,CAAC3C,uBAAuBuC,UAAU;YAC/D,OAAOzC;QACT;QACA,MAAM8C,QAAQL,OAAO,CAAC,QAAQ,KAAK;QACnC,MAAMM,aAAa,MAAM3C,qBAAqBqC,QAAQO,GAAG,EAAEf;QAC3D,IAAI,CAACc,cAAc,CAACD,OAAO,OAAOlC,KAAK;YAAEc,OAAO;QAAY,GAAG;QAC/D,IACE,CAACoB,SACD,CAAE,MAAM3C,0BAA0B8B,OAAOG,QAAQW,8BAAAA,WAAYE,MAAM,EAAE,WACrE;YACA,OAAOlD,kBAAkB;QAC3B;QACA,IAAI,CAACU,mBAAmB;YACtB,OAAOG,KAAK;gBAAEyB;gBAAMa,MAAM;gBAAMC,SAAS,EAAE;gBAAEC,UAAU;YAAM,GAAG;QAClE;QAEA,MAAMC,YAAYpD,cAAcyC,GAAG,GAAGW,SAAS;QAC/C,MAAMC,SAASD,UAAUE,UAAU,CAAC,QAAQC,GAAG,CAACvB;QAChD,MAAMwB,QAAQnD,kBAAkB,CAAC,EAAE;QACnC,MAAM,CAACkC,aAAakB,MAAMN,SAAS,GAAG,MAAMO,QAAQC,GAAG,CAAC;YACtDN,OAAOO,GAAG;YACVnD,oBAAoB,CAACoD,MAAQA,IAAID,GAAG,IAAIP,QAAQ;gBAAEN,KAAKP,QAAQO,GAAG;gBAAEZ;YAAO,GAAGqB;YAC9E9C,sBAAsB0C,WAAWpB,OAAOI,MAAM0B,KAAK,CAAC,IAAM;SAC3D;QACD,MAAMC,OAAOxB,oBAAAA,YAAYyB,IAAI,cAAhBzB,oBAAsB,CAAC;QACpC,MAAM0B,SAAS1D,eACb6B,MACA;YACE8B,MAAMrE,qBAAqBkE;YAC3BI,eAAe,UAAEV,wBAAAA,KAAMW,MAAM,mBAAI;YACjCC,SAAS,WAAEZ,wBAAAA,KAAMY,SAAS,oBAAI;QAChC,GACAlB;QAEF,OAAOrC,SAASH,IAAI,CAClB;YACEyB;YACAa,IAAI,WAAEgB,0BAAAA,OAAQhB,IAAI,oBAAI;YACtBC,OAAO,WAAEe,0BAAAA,OAAQf,OAAO,oBAAI,EAAE;YAC9BC,QAAQ,WAAEc,0BAAAA,OAAQd,QAAQ,oBAAI;QAChC,GACA;YAAEtC,QAAQ;YAAKO,SAAS;gBAAE,iBAAiB;YAAoB;QAAE;IAErE,EAAE,OAAOK,OAAO;QACd,MAAM6C,kBAAkBlE,uBAAuBqB;QAC/C,IAAI6C,iBAAiB,OAAOA;QAC5BC,QAAQ9C,KAAK,CAAC,sBAAsBO,OAAOP;QAC3C,OAAOd,KAAK;YAAEc,OAAO;QAAwB,GAAG;IAClD;AACF;AAEA,SAASP,WAAWsD,GAAG,GAAE"}

package/src/lib/server/ai-seo-apply.d.ts

@@ -0,0 +1,53 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import type { AiJob } from '../model/ai-jobs.types';
+import { type AiSeoAuditView } from '../model/ai-seo';
+/** The version history sentence the versions route gives, for a plan without it. */
+export declare const AI_SEO_APPLY_VERSIONING_COPY = "Version history requires a Pro plan \u2014 see Billing to upgrade";
+export interface AiSeoApplyInput {
+    orgId: string;
+    hostId: string;
+    job: AiJob;
+    view: AiSeoAuditView;
+    uid: string;
+    /** Whether the org's plan keeps more than one version of a page. */
+    versioning: boolean;
+    now?: Date;
+}
+export interface AiSeoApplyResult {
+    job: AiJob;
+    /** The version each page's content fixes went into; `fixes` is 0 for one opened by an earlier apply. */
+    versions: Array<{
+        screenId: string;
+        versionId: string;
+        name: string;
+        fixes: number;
+    }>;
+    /** Pages whose listing values wait in their SEO card. */
+    staged: string[];
+    skipped: Array<{
+        screenId: string;
+        reason: string;
+    }>;
+}
+/**
+ * Open the versions and record the apply. Exported for the spec, which drives
+ * it against a Firestore double and proves what it leaves alone.
+ */
+export declare function applyAiSeoAudit(firestore: FirebaseFirestore.Firestore, input: AiSeoApplyInput): Promise<AiSeoApplyResult>;
+export declare function POST(request: Request): Promise<Response>;
+export declare const dynamic = "force-dynamic";