@aglyn/plugins-ai 1.0.0-beta.228 → 1.0.0-beta.230

package/src/lib/server/ai-jobs-resume.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../../../../../libs/plugins/ai/src/lib/server/ai-jobs-resume.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// lockdown-423: via libs/plugins/ai/src/lib/runtime/ai-gate.ts\n// The POST climbs `aiGateLadder`, whose lockdown rung is the verdict.\n\nimport { randomUUID } from 'crypto'\nimport { aiJobAdmissionRefusal, aiJobSiteRefusal } from '../jobs/ai-job-admission'\nimport {\n  AI_JOB_INLINE_BUDGET_MS,\n  aiJobNextStepMinimumMs,\n  aiJobSummary,\n  getAiJob,\n  resumeAiJob,\n  runAiJobStep,\n  writeAiJobAudit,\n} from '../jobs/ai-jobs'\nimport { aiGateLadder } from '../runtime/ai-gate'\nimport { releaseAssistMessage } from '../usage/assist-usage'\n\n/**\n * Resume a job that stopped for a person (AGL-2935): confirm its plan, or\n * try again the step whose answer broke a building rule on its re-ask.\n *\n * A door that SPENDS — the next step calls the provider — so it climbs the\n * whole ladder the create door climbs: `aiGenerative`,\n * `release_ai_generative`, the `ai-generate` switch, `ai.generate` on the\n * job's site, a per-uid window and a reservation. It then runs the next\n * step inline on that reservation, the way the create door runs the first,\n * and hands the reservation back whenever no step runs here.\n *\n * The body names the org and the job's site. A site that is not the job's\n * is refused, so a collaborator's permission on one site never confirms a\n * job on another. Audited per resume that changed something.\n */\n\nconst AI_JOBS_RESUME_RATE_LIMIT = { key: 'ai-jobs-resume', limit: 10, windowMs: 60_000 }\n\nexport async function POST(\n  request: Request,\n  context: { params: Promise<{ jobId: string }> },\n): Promise<Response> {\n  let payload: Record<string, unknown> | null\n  try {\n    payload = (await request.json()) as Record<string, unknown>\n  } catch {\n    payload = null\n  }\n  const rawHost = payload?.['hostId']\n  const hostId = typeof rawHost === 'string' && rawHost ? rawHost : null\n  const gate = await aiGateLadder(\n    { request, orgId: String(payload?.['orgId'] ?? ''), hostId },\n    {\n      feature: 'aiGenerative',\n      releaseFlag: 'release_ai_generative',\n      lockdownFeature: 'ai-generate',\n      permission: 'ai.generate',\n      rateLimit: AI_JOBS_RESUME_RATE_LIMIT,\n    },\n  )\n  if (gate instanceof Response) return gate\n  // No token is spent until a step runs, so every exit before one hands the\n  // message back.\n  const release = () =>\n    releaseAssistMessage(gate.firestore, gate.orgId, gate.reservation).catch(() => undefined)\n\n  const { jobId } = await context.params\n  const existing = await getAiJob(gate.firestore, gate.orgId, jobId)\n  if (!existing) {\n    await release()\n    return Response.json({ error: 'Unknown job' }, { status: 404 })\n  }\n  if ((existing.hostId ?? null) !== hostId) {\n    await release()\n    return Response.json({ error: 'That job belongs to another site' }, { status: 400 })\n  }\n  // A confirmed plan runs the step that writes, and an allowance free when the\n  // job was created may be used by now (AGL-2909): the kind is asked again\n  // before anything runs, and a refusal leaves the job waiting for review.\n  if (existing.status === 'needs_review') {\n    let refusal: Awaited<ReturnType<typeof aiJobAdmissionRefusal>>\n    try {\n      // A site that switched AI off first (AGL-3028), then the kind's own check.\n      refusal =\n        (await aiJobSiteRefusal({\n          firestore: gate.firestore,\n          org: gate.org,\n          hostId: existing.hostId ?? null,\n        })) ??\n        (await aiJobAdmissionRefusal(existing.kind, {\n          firestore: gate.firestore,\n          orgId: gate.orgId,\n          hostId: existing.hostId ?? null,\n          inputs: existing.inputs ?? {},\n          org: gate.org,\n          // The plan being confirmed, for a kind that builds only some plans.\n          plan: existing.plan ?? null,\n          uid: gate.uid,\n        }))\n    } catch (error) {\n      await release()\n      console.error('ai job admission failed', { orgId: gate.orgId, jobId, error })\n      return Response.json({ error: 'The AI job could not be resumed' }, { status: 500 })\n    }\n    if (refusal) {\n      await release()\n      return Response.json(\n        { error: refusal.error, job: aiJobSummary(existing, new Date()) },\n        { status: refusal.status },\n      )\n    }\n  }\n  const now = new Date()\n  const { job, changed } = await resumeAiJob(\n    gate.firestore,\n    gate.orgId,\n    jobId,\n    { uid: gate.uid },\n    now,\n  )\n  if (!changed) {\n    await release()\n    return Response.json(\n      { error: 'This job is not waiting for review', job: aiJobSummary(job, now) },\n      { status: 409 },\n    )\n  }\n  await writeAiJobAudit(gate.firestore, {\n    action: 'ai.job.resume',\n    actorUid: gate.uid,\n    actorEmail: gate.decoded.email ?? null,\n    orgId: gate.orgId,\n    jobId,\n    after: {\n      status: job.status,\n      reason: existing.review?.reason ?? null,\n      kind: existing.kind,\n    },\n  })\n  if (job.status !== 'queued') {\n    await release()\n    return Response.json({ job: aiJobSummary(job, now) }, { status: 200 })\n  }\n  // A step that needs more time than this request has (AGL-2907) is left\n  // queued for the beat, which starts it with a budget of its own: a provider\n  // call this request's timeout cut off would be billed upstream and metered\n  // nowhere.\n  if (aiJobNextStepMinimumMs(job) > AI_JOB_INLINE_BUDGET_MS) {\n    await release()\n    return Response.json({ job: aiJobSummary(job, now) }, { status: 200 })\n  }\n\n  const run = await runAiJobStep(gate.firestore, gate.orgId, jobId, {\n    owner: `route:${randomUUID()}`,\n    now,\n    reservation: gate.reservation,\n    org: gate.org,\n    signal: AbortSignal.timeout(AI_JOB_INLINE_BUDGET_MS),\n    actor: { uid: gate.uid, email: gate.decoded.email ?? null },\n    // The workspace's AI pause lets staff through, as the ladder above did.\n    staff: gate.staff,\n  })\n  if (run.outcome === 'not-claimable') {\n    // The beat claimed the step between the resume and this run; it runs\n    // there, on a reservation of its own.\n    await release()\n    const latest = await getAiJob(gate.firestore, gate.orgId, jobId)\n    return Response.json({ job: aiJobSummary(latest ?? job, now) }, { status: 200 })\n  }\n  return Response.json({ job: aiJobSummary(run.job) }, { status: 200 })\n}\n\nexport const dynamic = 'force-dynamic'\nexport const maxDuration = 60\n"],"names":["randomUUID","aiJobAdmissionRefusal","aiJobSiteRefusal","AI_JOB_INLINE_BUDGET_MS","aiJobNextStepMinimumMs","aiJobSummary","getAiJob","resumeAiJob","runAiJobStep","writeAiJobAudit","aiGateLadder","releaseAssistMessage","AI_JOBS_RESUME_RATE_LIMIT","key","limit","windowMs","POST","request","context","existing","gate","payload","json","rawHost","hostId","orgId","String","feature","releaseFlag","lockdownFeature","permission","rateLimit","Response","release","firestore","reservation","catch","undefined","jobId","params","error","status","refusal","org","kind","inputs","plan","uid","console","job","Date","now","changed","action","actorUid","actorEmail","decoded","email","after","reason","review","run","owner","signal","AbortSignal","timeout","actor","staff","outcome","latest","dynamic","maxDuration"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,+DAA+D;AAC/D,sEAAsE;AAEtE,SAASA,UAAU,QAAQ,SAAQ;AACnC,SAASC,qBAAqB,EAAEC,gBAAgB,QAAQ,8BAA0B;AAClF,SACEC,uBAAuB,EACvBC,sBAAsB,EACtBC,YAAY,EACZC,QAAQ,EACRC,WAAW,EACXC,YAAY,EACZC,eAAe,QACV,qBAAiB;AACxB,SAASC,YAAY,QAAQ,wBAAoB;AACjD,SAASC,oBAAoB,QAAQ,2BAAuB;AAE5D;;;;;;;;;;;;;;CAcC,GAED,MAAMC,4BAA4B;IAAEC,KAAK;IAAkBC,OAAO;IAAIC,UAAU;AAAO;AAEvF,OAAO,eAAeC,KACpBC,OAAgB,EAChBC,OAA+C;cAgC1CC,kBA0DSC,4BA4BmBA;QAvBrBD;IA7FZ,IAAIE;IACJ,IAAI;QACFA,UAAW,MAAMJ,QAAQK,IAAI;IAC/B,EAAE,eAAM;QACND,UAAU;IACZ;IACA,MAAME,UAAUF,2BAAAA,OAAS,CAAC,SAAS;IACnC,MAAMG,SAAS,OAAOD,YAAY,YAAYA,UAAUA,UAAU;IAClE,MAAMH,OAAO,MAAMV,aACjB;QAAEO;QAASQ,OAAOC,eAAOL,2BAAAA,OAAS,CAAC,QAAQ,mBAAI;QAAKG;IAAO,GAC3D;QACEG,SAAS;QACTC,aAAa;QACbC,iBAAiB;QACjBC,YAAY;QACZC,WAAWnB;IACb;IAEF,IAAIQ,gBAAgBY,UAAU,OAAOZ;IACrC,0EAA0E;IAC1E,gBAAgB;IAChB,MAAMa,UAAU,IACdtB,qBAAqBS,KAAKc,SAAS,EAAEd,KAAKK,KAAK,EAAEL,KAAKe,WAAW,EAAEC,KAAK,CAAC,IAAMC;IAEjF,MAAM,EAAEC,KAAK,EAAE,GAAG,MAAMpB,QAAQqB,MAAM;IACtC,MAAMpB,WAAW,MAAMb,SAASc,KAAKc,SAAS,EAAEd,KAAKK,KAAK,EAAEa;IAC5D,IAAI,CAACnB,UAAU;QACb,MAAMc;QACN,OAAOD,SAASV,IAAI,CAAC;YAAEkB,OAAO;QAAc,GAAG;YAAEC,QAAQ;QAAI;IAC/D;IACA,IAAI,EAACtB,mBAAAA,SAASK,MAAM,YAAfL,mBAAmB,UAAUK,QAAQ;QACxC,MAAMS;QACN,OAAOD,SAASV,IAAI,CAAC;YAAEkB,OAAO;QAAmC,GAAG;YAAEC,QAAQ;QAAI;IACpF;IACA,6EAA6E;IAC7E,yEAAyE;IACzE,yEAAyE;IACzE,IAAItB,SAASsB,MAAM,KAAK,gBAAgB;QACtC,IAAIC;QACJ,IAAI;gBAGC,OAGSvB,mBAKAA,mBACAA,kBAGFA;YAdV,2EAA2E;YAC3EuB,WACG,QAAA,MAAMxC,iBAAiB;gBACtBgC,WAAWd,KAAKc,SAAS;gBACzBS,KAAKvB,KAAKuB,GAAG;gBACbnB,MAAM,GAAEL,oBAAAA,SAASK,MAAM,YAAfL,oBAAmB;YAC7B,cAJC,QAKA,MAAMlB,sBAAsBkB,SAASyB,IAAI,EAAE;gBAC1CV,WAAWd,KAAKc,SAAS;gBACzBT,OAAOL,KAAKK,KAAK;gBACjBD,MAAM,GAAEL,oBAAAA,SAASK,MAAM,YAAfL,oBAAmB;gBAC3B0B,MAAM,GAAE1B,mBAAAA,SAAS0B,MAAM,YAAf1B,mBAAmB,CAAC;gBAC5BwB,KAAKvB,KAAKuB,GAAG;gBACb,oEAAoE;gBACpEG,IAAI,GAAE3B,iBAAAA,SAAS2B,IAAI,YAAb3B,iBAAiB;gBACvB4B,KAAK3B,KAAK2B,GAAG;YACf;QACJ,EAAE,OAAOP,OAAO;YACd,MAAMP;YACNe,QAAQR,KAAK,CAAC,2BAA2B;gBAAEf,OAAOL,KAAKK,KAAK;gBAAEa;gBAAOE;YAAM;YAC3E,OAAOR,SAASV,IAAI,CAAC;gBAAEkB,OAAO;YAAkC,GAAG;gBAAEC,QAAQ;YAAI;QACnF;QACA,IAAIC,SAAS;YACX,MAAMT;YACN,OAAOD,SAASV,IAAI,CAClB;gBAAEkB,OAAOE,QAAQF,KAAK;gBAAES,KAAK5C,aAAac,UAAU,IAAI+B;YAAQ,GAChE;gBAAET,QAAQC,QAAQD,MAAM;YAAC;QAE7B;IACF;IACA,MAAMU,MAAM,IAAID;IAChB,MAAM,EAAED,GAAG,EAAEG,OAAO,EAAE,GAAG,MAAM7C,YAC7Ba,KAAKc,SAAS,EACdd,KAAKK,KAAK,EACVa,OACA;QAAES,KAAK3B,KAAK2B,GAAG;IAAC,GAChBI;IAEF,IAAI,CAACC,SAAS;QACZ,MAAMnB;QACN,OAAOD,SAASV,IAAI,CAClB;YAAEkB,OAAO;YAAsCS,KAAK5C,aAAa4C,KAAKE;QAAK,GAC3E;YAAEV,QAAQ;QAAI;IAElB;IACA,MAAMhC,gBAAgBW,KAAKc,SAAS,EAAE;QACpCmB,QAAQ;QACRC,UAAUlC,KAAK2B,GAAG;QAClBQ,UAAU,GAAEnC,sBAAAA,KAAKoC,OAAO,CAACC,KAAK,YAAlBrC,sBAAsB;QAClCK,OAAOL,KAAKK,KAAK;QACjBa;QACAoB,OAAO;YACLjB,QAAQQ,IAAIR,MAAM;YAClBkB,MAAM,YAAExC,mBAAAA,SAASyC,MAAM,qBAAfzC,iBAAiBwC,MAAM,oBAAI;YACnCf,MAAMzB,SAASyB,IAAI;QACrB;IACF;IACA,IAAIK,IAAIR,MAAM,KAAK,UAAU;QAC3B,MAAMR;QACN,OAAOD,SAASV,IAAI,CAAC;YAAE2B,KAAK5C,aAAa4C,KAAKE;QAAK,GAAG;YAAEV,QAAQ;QAAI;IACtE;IACA,uEAAuE;IACvE,4EAA4E;IAC5E,2EAA2E;IAC3E,WAAW;IACX,IAAIrC,uBAAuB6C,OAAO9C,yBAAyB;QACzD,MAAM8B;QACN,OAAOD,SAASV,IAAI,CAAC;YAAE2B,KAAK5C,aAAa4C,KAAKE;QAAK,GAAG;YAAEV,QAAQ;QAAI;IACtE;IAEA,MAAMoB,MAAM,MAAMrD,aAAaY,KAAKc,SAAS,EAAEd,KAAKK,KAAK,EAAEa,OAAO;QAChEwB,OAAO,CAAC,MAAM,EAAE9D,cAAc;QAC9BmD;QACAhB,aAAaf,KAAKe,WAAW;QAC7BQ,KAAKvB,KAAKuB,GAAG;QACboB,QAAQC,YAAYC,OAAO,CAAC9D;QAC5B+D,OAAO;YAAEnB,KAAK3B,KAAK2B,GAAG;YAAEU,KAAK,GAAErC,uBAAAA,KAAKoC,OAAO,CAACC,KAAK,YAAlBrC,uBAAsB;QAAK;QAC1D,wEAAwE;QACxE+C,OAAO/C,KAAK+C,KAAK;IACnB;IACA,IAAIN,IAAIO,OAAO,KAAK,iBAAiB;QACnC,qEAAqE;QACrE,sCAAsC;QACtC,MAAMnC;QACN,MAAMoC,SAAS,MAAM/D,SAASc,KAAKc,SAAS,EAAEd,KAAKK,KAAK,EAAEa;QAC1D,OAAON,SAASV,IAAI,CAAC;YAAE2B,KAAK5C,aAAagE,iBAAAA,SAAUpB,KAAKE;QAAK,GAAG;YAAEV,QAAQ;QAAI;IAChF;IACA,OAAOT,SAASV,IAAI,CAAC;QAAE2B,KAAK5C,aAAawD,IAAIZ,GAAG;IAAE,GAAG;QAAER,QAAQ;IAAI;AACrE;AAEA,OAAO,MAAM6B,UAAU,gBAAe;AACtC,OAAO,MAAMC,cAAc,GAAE"}
+{"version":3,"sources":["../../../../../../../libs/plugins/ai/src/lib/server/ai-jobs-resume.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n// lockdown-423: via libs/plugins/ai/src/lib/runtime/ai-gate.ts\n// The POST climbs `aiGateLadder`, whose lockdown rung is the verdict.\n\nimport { randomUUID } from 'crypto'\nimport { aiJobAdmissionRefusal, aiJobSiteRefusal } from '../jobs/ai-job-admission'\nimport {\n  AI_JOB_INLINE_BUDGET_MS,\n  aiJobNextStepMinimumMs,\n  aiJobSummary,\n  getAiJob,\n  aiBuildRetryable,\n  resumeAiJob,\n  retryAiBuildJob,\n  runAiJobStep,\n  writeAiJobAudit,\n} from '../jobs/ai-jobs'\nimport type { AiJob } from '../model/ai-jobs.types'\nimport { aiBuildFreeBalanceRefusal, aiBuildFreeTaste } from '../jobs/ai-job-build-step'\nimport { aiBuildCreditEstimate, aiBuildRetryLedger, aiBuildUnits, aiLedgerUnits } from '../model/ai-build-job'\nimport { aiGateLadder } from '../runtime/ai-gate'\nimport { releaseAssistMessage } from '../usage/assist-usage'\n\n/**\n * Resume a job that stopped for a person (AGL-2935): confirm its plan, or\n * try again the step whose answer broke a building rule on its re-ask.\n *\n * A door that SPENDS — the next step calls the provider — so it climbs the\n * whole ladder the create door climbs: `aiGenerative`,\n * `release_ai_generative`, the `ai-generate` switch, `ai.generate` on the\n * job's site, a per-uid window and a reservation. It then runs the next\n * step inline on that reservation, the way the create door runs the first,\n * and hands the reservation back whenever no step runs here.\n *\n * The body names the org and the job's site. A site that is not the job's\n * is refused, so a collaborator's permission on one site never confirms a\n * job on another. Audited per resume that changed something.\n */\n\nconst AI_JOBS_RESUME_RATE_LIMIT = { key: 'ai-jobs-resume', limit: 10, windowMs: 60_000 }\n\nexport async function POST(\n  request: Request,\n  context: { params: Promise<{ jobId: string }> },\n): Promise<Response> {\n  let payload: Record<string, unknown> | null\n  try {\n    payload = (await request.json()) as Record<string, unknown>\n  } catch {\n    payload = null\n  }\n  const rawHost = payload?.['hostId']\n  const hostId = typeof rawHost === 'string' && rawHost ? rawHost : null\n  const gate = await aiGateLadder(\n    { request, orgId: String(payload?.['orgId'] ?? ''), hostId },\n    {\n      feature: 'aiGenerative',\n      releaseFlag: 'release_ai_generative',\n      lockdownFeature: 'ai-generate',\n      permission: 'ai.generate',\n      rateLimit: AI_JOBS_RESUME_RATE_LIMIT,\n    },\n  )\n  if (gate instanceof Response) return gate\n  // No token is spent until a step runs, so every exit before one hands the\n  // message back.\n  const release = () =>\n    releaseAssistMessage(gate.firestore, gate.orgId, gate.reservation).catch(() => undefined)\n\n  const { jobId } = await context.params\n  const existing = await getAiJob(gate.firestore, gate.orgId, jobId)\n  if (!existing) {\n    await release()\n    return Response.json({ error: 'Unknown job' }, { status: 404 })\n  }\n  if ((existing.hostId ?? null) !== hostId) {\n    await release()\n    return Response.json({ error: 'That job belongs to another site' }, { status: 400 })\n  }\n  // Try again on a build (AGL-3616): its failed items and what they left\n  // unbuilt, never what succeeded, and never its plan again.\n  const retryFailedItems = payload?.['retry'] === 'failed-items'\n  if (retryFailedItems) {\n    const refusal = await aiBuildRetryRefusal(gate, existing).catch((error: unknown) => {\n      console.error('ai build retry admission failed', { orgId: gate.orgId, jobId, error })\n      return { status: 500 as const, error: 'The AI job could not be resumed' }\n    })\n    if (refusal) {\n      await release()\n      return Response.json({ error: refusal.error, job: aiJobSummary(existing, new Date()) }, { status: refusal.status })\n    }\n  }\n  // A confirmed plan runs the step that writes, and an allowance free when the\n  // job was created may be used by now (AGL-2909): the kind is asked again\n  // before anything runs, and a refusal leaves the job waiting for review.\n  if (existing.status === 'needs_review') {\n    let refusal: Awaited<ReturnType<typeof aiJobAdmissionRefusal>>\n    try {\n      // A site that switched AI off first (AGL-3028), then the kind's own check.\n      refusal =\n        (await aiJobSiteRefusal({\n          firestore: gate.firestore,\n          org: gate.org,\n          hostId: existing.hostId ?? null,\n        })) ??\n        (await aiJobAdmissionRefusal(existing.kind, {\n          firestore: gate.firestore,\n          orgId: gate.orgId,\n          hostId: existing.hostId ?? null,\n          inputs: existing.inputs ?? {},\n          org: gate.org,\n          // The plan being confirmed, for a kind that builds only some plans.\n          plan: existing.plan ?? null,\n          uid: gate.uid,\n        }))\n    } catch (error) {\n      await release()\n      console.error('ai job admission failed', { orgId: gate.orgId, jobId, error })\n      return Response.json({ error: 'The AI job could not be resumed' }, { status: 500 })\n    }\n    if (refusal) {\n      await release()\n      return Response.json(\n        { error: refusal.error, job: aiJobSummary(existing, new Date()) },\n        { status: refusal.status },\n      )\n    }\n  }\n  const now = new Date()\n  const { job, changed } = retryFailedItems\n    ? await retryAiBuildJob(gate.firestore, gate.orgId, jobId, now)\n    : await resumeAiJob(gate.firestore, gate.orgId, jobId, { uid: gate.uid }, now, {\n        publishConfirmed: payload?.['publish'] === true,\n      })\n  if (!changed) {\n    await release()\n    return Response.json(\n      { error: 'This job is not waiting for review', job: aiJobSummary(job, now) },\n      { status: 409 },\n    )\n  }\n  await writeAiJobAudit(gate.firestore, {\n    action: 'ai.job.resume',\n    actorUid: gate.uid,\n    actorEmail: gate.decoded.email ?? null,\n    orgId: gate.orgId,\n    jobId,\n    after: {\n      status: job.status,\n      reason: retryFailedItems ? 'retry-failed-items' : (existing.review?.reason ?? null),\n      kind: existing.kind,\n    },\n  })\n  if (job.status !== 'queued') {\n    await release()\n    return Response.json({ job: aiJobSummary(job, now) }, { status: 200 })\n  }\n  // A step that needs more time than this request has (AGL-2907) is left\n  // queued for the beat, which starts it with a budget of its own: a provider\n  // call this request's timeout cut off would be billed upstream and metered\n  // nowhere.\n  if (aiJobNextStepMinimumMs(job) > AI_JOB_INLINE_BUDGET_MS) {\n    await release()\n    return Response.json({ job: aiJobSummary(job, now) }, { status: 200 })\n  }\n\n  const run = await runAiJobStep(gate.firestore, gate.orgId, jobId, {\n    owner: `route:${randomUUID()}`,\n    now,\n    reservation: gate.reservation,\n    org: gate.org,\n    signal: AbortSignal.timeout(AI_JOB_INLINE_BUDGET_MS),\n    actor: { uid: gate.uid, email: gate.decoded.email ?? null },\n    // The workspace's AI pause lets staff through, as the ladder above did.\n    staff: gate.staff,\n  })\n  if (run.outcome === 'not-claimable') {\n    // The beat claimed the step between the resume and this run; it runs\n    // there, on a reservation of its own.\n    await release()\n    const latest = await getAiJob(gate.firestore, gate.orgId, jobId)\n    return Response.json({ job: aiJobSummary(latest ?? job, now) }, { status: 200 })\n  }\n  return Response.json({ job: aiJobSummary(run.job) }, { status: 200 })\n}\n\n/**\n * Why a build's Try again cannot run (AGL-3616), or `null`: it is not a\n * finished build, the site switched AI off, or — on the Free taste — the\n * month's Free credits do not cover what the retried items are estimated at.\n */\nasync function aiBuildRetryRefusal(\n  gate: { firestore: FirebaseFirestore.Firestore; org: object | null },\n  job: AiJob,\n): Promise<{ status: 400 | 403 | 404 | 409; error: string } | null> {\n  const plan = job.plan?.status === 'confirmed' ? job.plan : null\n  if (!aiBuildRetryable(job) || !plan || !job.items?.length) {\n    return { status: 409, error: 'Only a finished build can try its failed items again' }\n  }\n  const site = await aiJobSiteRefusal({ firestore: gate.firestore, org: gate.org, hostId: job.hostId ?? null })\n  if (site) return site\n  const { retried } = aiBuildRetryLedger(job.items, job.kind === 'site' ? aiLedgerUnits(job.items) : aiBuildUnits(plan))\n  if (!retried.length) return { status: 409, error: 'Nothing in this build is left to try again' }\n  // A site's retried parts are its own pages and creations, held by the\n  // reservation each pass takes; a build's are estimated against the Free taste.\n  if (job.kind === 'site' || !aiBuildFreeTaste(gate.org)) return null\n  const refusal = await aiBuildFreeBalanceRefusal({\n    firestore: gate.firestore,\n    org: gate.org,\n    estimate: aiBuildCreditEstimate(plan, { slots: new Set(retried) }),\n    now: new Date(),\n  })\n  return refusal ? { status: 403, error: refusal } : null\n}\n\nexport const dynamic = 'force-dynamic'\nexport const maxDuration = 60\n"],"names":["randomUUID","aiJobAdmissionRefusal","aiJobSiteRefusal","AI_JOB_INLINE_BUDGET_MS","aiJobNextStepMinimumMs","aiJobSummary","getAiJob","aiBuildRetryable","resumeAiJob","retryAiBuildJob","runAiJobStep","writeAiJobAudit","aiBuildFreeBalanceRefusal","aiBuildFreeTaste","aiBuildCreditEstimate","aiBuildRetryLedger","aiBuildUnits","aiLedgerUnits","aiGateLadder","releaseAssistMessage","AI_JOBS_RESUME_RATE_LIMIT","key","limit","windowMs","POST","request","context","existing","gate","payload","json","rawHost","hostId","orgId","String","feature","releaseFlag","lockdownFeature","permission","rateLimit","Response","release","firestore","reservation","catch","undefined","jobId","params","error","status","retryFailedItems","refusal","aiBuildRetryRefusal","console","job","Date","org","kind","inputs","plan","uid","now","changed","publishConfirmed","action","actorUid","actorEmail","decoded","email","after","reason","review","run","owner","signal","AbortSignal","timeout","actor","staff","outcome","latest","items","length","site","retried","estimate","slots","Set","dynamic","maxDuration"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED,+DAA+D;AAC/D,sEAAsE;AAEtE,SAASA,UAAU,QAAQ,SAAQ;AACnC,SAASC,qBAAqB,EAAEC,gBAAgB,QAAQ,8BAA0B;AAClF,SACEC,uBAAuB,EACvBC,sBAAsB,EACtBC,YAAY,EACZC,QAAQ,EACRC,gBAAgB,EAChBC,WAAW,EACXC,eAAe,EACfC,YAAY,EACZC,eAAe,QACV,qBAAiB;AAExB,SAASC,yBAAyB,EAAEC,gBAAgB,QAAQ,+BAA2B;AACvF,SAASC,qBAAqB,EAAEC,kBAAkB,EAAEC,YAAY,EAAEC,aAAa,QAAQ,2BAAuB;AAC9G,SAASC,YAAY,QAAQ,wBAAoB;AACjD,SAASC,oBAAoB,QAAQ,2BAAuB;AAE5D;;;;;;;;;;;;;;CAcC,GAED,MAAMC,4BAA4B;IAAEC,KAAK;IAAkBC,OAAO;IAAIC,UAAU;AAAO;AAEvF,OAAO,eAAeC,KACpBC,OAAgB,EAChBC,OAA+C;cAgC1CC,kBAqESC,4BA4BmBA;QAvBsBD;IAxGvD,IAAIE;IACJ,IAAI;QACFA,UAAW,MAAMJ,QAAQK,IAAI;IAC/B,EAAE,eAAM;QACND,UAAU;IACZ;IACA,MAAME,UAAUF,2BAAAA,OAAS,CAAC,SAAS;IACnC,MAAMG,SAAS,OAAOD,YAAY,YAAYA,UAAUA,UAAU;IAClE,MAAMH,OAAO,MAAMV,aACjB;QAAEO;QAASQ,OAAOC,eAAOL,2BAAAA,OAAS,CAAC,QAAQ,mBAAI;QAAKG;IAAO,GAC3D;QACEG,SAAS;QACTC,aAAa;QACbC,iBAAiB;QACjBC,YAAY;QACZC,WAAWnB;IACb;IAEF,IAAIQ,gBAAgBY,UAAU,OAAOZ;IACrC,0EAA0E;IAC1E,gBAAgB;IAChB,MAAMa,UAAU,IACdtB,qBAAqBS,KAAKc,SAAS,EAAEd,KAAKK,KAAK,EAAEL,KAAKe,WAAW,EAAEC,KAAK,CAAC,IAAMC;IAEjF,MAAM,EAAEC,KAAK,EAAE,GAAG,MAAMpB,QAAQqB,MAAM;IACtC,MAAMpB,WAAW,MAAMrB,SAASsB,KAAKc,SAAS,EAAEd,KAAKK,KAAK,EAAEa;IAC5D,IAAI,CAACnB,UAAU;QACb,MAAMc;QACN,OAAOD,SAASV,IAAI,CAAC;YAAEkB,OAAO;QAAc,GAAG;YAAEC,QAAQ;QAAI;IAC/D;IACA,IAAI,EAACtB,mBAAAA,SAASK,MAAM,YAAfL,mBAAmB,UAAUK,QAAQ;QACxC,MAAMS;QACN,OAAOD,SAASV,IAAI,CAAC;YAAEkB,OAAO;QAAmC,GAAG;YAAEC,QAAQ;QAAI;IACpF;IACA,uEAAuE;IACvE,2DAA2D;IAC3D,MAAMC,mBAAmBrB,CAAAA,2BAAAA,OAAS,CAAC,QAAQ,MAAK;IAChD,IAAIqB,kBAAkB;QACpB,MAAMC,UAAU,MAAMC,oBAAoBxB,MAAMD,UAAUiB,KAAK,CAAC,CAACI;YAC/DK,QAAQL,KAAK,CAAC,mCAAmC;gBAAEf,OAAOL,KAAKK,KAAK;gBAAEa;gBAAOE;YAAM;YACnF,OAAO;gBAAEC,QAAQ;gBAAcD,OAAO;YAAkC;QAC1E;QACA,IAAIG,SAAS;YACX,MAAMV;YACN,OAAOD,SAASV,IAAI,CAAC;gBAAEkB,OAAOG,QAAQH,KAAK;gBAAEM,KAAKjD,aAAasB,UAAU,IAAI4B;YAAQ,GAAG;gBAAEN,QAAQE,QAAQF,MAAM;YAAC;QACnH;IACF;IACA,6EAA6E;IAC7E,yEAAyE;IACzE,yEAAyE;IACzE,IAAItB,SAASsB,MAAM,KAAK,gBAAgB;QACtC,IAAIE;QACJ,IAAI;gBAGC,OAGSxB,mBAKAA,mBACAA,kBAGFA;YAdV,2EAA2E;YAC3EwB,WACG,QAAA,MAAMjD,iBAAiB;gBACtBwC,WAAWd,KAAKc,SAAS;gBACzBc,KAAK5B,KAAK4B,GAAG;gBACbxB,MAAM,GAAEL,oBAAAA,SAASK,MAAM,YAAfL,oBAAmB;YAC7B,cAJC,QAKA,MAAM1B,sBAAsB0B,SAAS8B,IAAI,EAAE;gBAC1Cf,WAAWd,KAAKc,SAAS;gBACzBT,OAAOL,KAAKK,KAAK;gBACjBD,MAAM,GAAEL,oBAAAA,SAASK,MAAM,YAAfL,oBAAmB;gBAC3B+B,MAAM,GAAE/B,mBAAAA,SAAS+B,MAAM,YAAf/B,mBAAmB,CAAC;gBAC5B6B,KAAK5B,KAAK4B,GAAG;gBACb,oEAAoE;gBACpEG,IAAI,GAAEhC,iBAAAA,SAASgC,IAAI,YAAbhC,iBAAiB;gBACvBiC,KAAKhC,KAAKgC,GAAG;YACf;QACJ,EAAE,OAAOZ,OAAO;YACd,MAAMP;YACNY,QAAQL,KAAK,CAAC,2BAA2B;gBAAEf,OAAOL,KAAKK,KAAK;gBAAEa;gBAAOE;YAAM;YAC3E,OAAOR,SAASV,IAAI,CAAC;gBAAEkB,OAAO;YAAkC,GAAG;gBAAEC,QAAQ;YAAI;QACnF;QACA,IAAIE,SAAS;YACX,MAAMV;YACN,OAAOD,SAASV,IAAI,CAClB;gBAAEkB,OAAOG,QAAQH,KAAK;gBAAEM,KAAKjD,aAAasB,UAAU,IAAI4B;YAAQ,GAChE;gBAAEN,QAAQE,QAAQF,MAAM;YAAC;QAE7B;IACF;IACA,MAAMY,MAAM,IAAIN;IAChB,MAAM,EAAED,GAAG,EAAEQ,OAAO,EAAE,GAAGZ,mBACrB,MAAMzC,gBAAgBmB,KAAKc,SAAS,EAAEd,KAAKK,KAAK,EAAEa,OAAOe,OACzD,MAAMrD,YAAYoB,KAAKc,SAAS,EAAEd,KAAKK,KAAK,EAAEa,OAAO;QAAEc,KAAKhC,KAAKgC,GAAG;IAAC,GAAGC,KAAK;QAC3EE,kBAAkBlC,CAAAA,2BAAAA,OAAS,CAAC,UAAU,MAAK;IAC7C;IACJ,IAAI,CAACiC,SAAS;QACZ,MAAMrB;QACN,OAAOD,SAASV,IAAI,CAClB;YAAEkB,OAAO;YAAsCM,KAAKjD,aAAaiD,KAAKO;QAAK,GAC3E;YAAEZ,QAAQ;QAAI;IAElB;IACA,MAAMtC,gBAAgBiB,KAAKc,SAAS,EAAE;QACpCsB,QAAQ;QACRC,UAAUrC,KAAKgC,GAAG;QAClBM,UAAU,GAAEtC,sBAAAA,KAAKuC,OAAO,CAACC,KAAK,YAAlBxC,sBAAsB;QAClCK,OAAOL,KAAKK,KAAK;QACjBa;QACAuB,OAAO;YACLpB,QAAQK,IAAIL,MAAM;YAClBqB,QAAQpB,mBAAmB,iCAAwBvB,mBAAAA,SAAS4C,MAAM,qBAAf5C,iBAAiB2C,MAAM,oBAAI;YAC9Eb,MAAM9B,SAAS8B,IAAI;QACrB;IACF;IACA,IAAIH,IAAIL,MAAM,KAAK,UAAU;QAC3B,MAAMR;QACN,OAAOD,SAASV,IAAI,CAAC;YAAEwB,KAAKjD,aAAaiD,KAAKO;QAAK,GAAG;YAAEZ,QAAQ;QAAI;IACtE;IACA,uEAAuE;IACvE,4EAA4E;IAC5E,2EAA2E;IAC3E,WAAW;IACX,IAAI7C,uBAAuBkD,OAAOnD,yBAAyB;QACzD,MAAMsC;QACN,OAAOD,SAASV,IAAI,CAAC;YAAEwB,KAAKjD,aAAaiD,KAAKO;QAAK,GAAG;YAAEZ,QAAQ;QAAI;IACtE;IAEA,MAAMuB,MAAM,MAAM9D,aAAakB,KAAKc,SAAS,EAAEd,KAAKK,KAAK,EAAEa,OAAO;QAChE2B,OAAO,CAAC,MAAM,EAAEzE,cAAc;QAC9B6D;QACAlB,aAAaf,KAAKe,WAAW;QAC7Ba,KAAK5B,KAAK4B,GAAG;QACbkB,QAAQC,YAAYC,OAAO,CAACzE;QAC5B0E,OAAO;YAAEjB,KAAKhC,KAAKgC,GAAG;YAAEQ,KAAK,GAAExC,uBAAAA,KAAKuC,OAAO,CAACC,KAAK,YAAlBxC,uBAAsB;QAAK;QAC1D,wEAAwE;QACxEkD,OAAOlD,KAAKkD,KAAK;IACnB;IACA,IAAIN,IAAIO,OAAO,KAAK,iBAAiB;QACnC,qEAAqE;QACrE,sCAAsC;QACtC,MAAMtC;QACN,MAAMuC,SAAS,MAAM1E,SAASsB,KAAKc,SAAS,EAAEd,KAAKK,KAAK,EAAEa;QAC1D,OAAON,SAASV,IAAI,CAAC;YAAEwB,KAAKjD,aAAa2E,iBAAAA,SAAU1B,KAAKO;QAAK,GAAG;YAAEZ,QAAQ;QAAI;IAChF;IACA,OAAOT,SAASV,IAAI,CAAC;QAAEwB,KAAKjD,aAAamE,IAAIlB,GAAG;IAAE,GAAG;QAAEL,QAAQ;IAAI;AACrE;AAEA;;;;CAIC,GACD,eAAeG,oBACbxB,IAAoE,EACpE0B,GAAU;QAM8EA;QAJ3EA,WAC2BA;IADxC,MAAMK,OAAOL,EAAAA,YAAAA,IAAIK,IAAI,qBAARL,UAAUL,MAAM,MAAK,cAAcK,IAAIK,IAAI,GAAG;IAC3D,IAAI,CAACpD,iBAAiB+C,QAAQ,CAACK,QAAQ,GAACL,aAAAA,IAAI2B,KAAK,qBAAT3B,WAAW4B,MAAM,GAAE;QACzD,OAAO;YAAEjC,QAAQ;YAAKD,OAAO;QAAuD;IACtF;IACA,MAAMmC,OAAO,MAAMjF,iBAAiB;QAAEwC,WAAWd,KAAKc,SAAS;QAAEc,KAAK5B,KAAK4B,GAAG;QAAExB,MAAM,GAAEsB,cAAAA,IAAItB,MAAM,YAAVsB,cAAc;IAAK;IAC3G,IAAI6B,MAAM,OAAOA;IACjB,MAAM,EAAEC,OAAO,EAAE,GAAGrE,mBAAmBuC,IAAI2B,KAAK,EAAE3B,IAAIG,IAAI,KAAK,SAASxC,cAAcqC,IAAI2B,KAAK,IAAIjE,aAAa2C;IAChH,IAAI,CAACyB,QAAQF,MAAM,EAAE,OAAO;QAAEjC,QAAQ;QAAKD,OAAO;IAA6C;IAC/F,sEAAsE;IACtE,+EAA+E;IAC/E,IAAIM,IAAIG,IAAI,KAAK,UAAU,CAAC5C,iBAAiBe,KAAK4B,GAAG,GAAG,OAAO;IAC/D,MAAML,UAAU,MAAMvC,0BAA0B;QAC9C8B,WAAWd,KAAKc,SAAS;QACzBc,KAAK5B,KAAK4B,GAAG;QACb6B,UAAUvE,sBAAsB6C,MAAM;YAAE2B,OAAO,IAAIC,IAAIH;QAAS;QAChEvB,KAAK,IAAIN;IACX;IACA,OAAOJ,UAAU;QAAEF,QAAQ;QAAKD,OAAOG;IAAQ,IAAI;AACrD;AAEA,OAAO,MAAMqC,UAAU,gBAAe;AACtC,OAAO,MAAMC,cAAc,GAAE"}

package/src/lib/server/ai-media-image.d.ts

@@ -0,0 +1,66 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { type AiImageMode, type AiSvgStyle } from '../providers/image-contract';
+/** What a person reads when a picture failed on our side. */
+export declare const AI_MEDIA_OURS_COPY = "This one's on us \u2014 you weren't charged. The picture didn't come out right; try again, or describe it a little differently.";
+/** What the door answers on a deployment that makes no photos. */
+export declare const AI_MEDIA_NO_PHOTOS_COPY = "Photos aren't available here yet. Choose Illustration to draw one instead.";
+/** Every control character as a space, squeezed, trimmed and cut. */
+export declare function cleanAiImagePrompt(value: unknown): string;
+/**
+ * The alt text a picture is stored with: the sentence given, as a sentence,
+ * cut at a word inside the library's alt limit. A person edits it like any
+ * other.
+ */
+export declare function aiImageAltText(text: string): string;
+/** A file name from the description's first words: `ai-a-red-barn-2.png`. */
+export declare function aiImageFileName(prompt: string, index: number, mimeType: string): string;
+/** What the library asked for, read and bounded. */
+export interface AiMediaImageInput {
+    orgId: string;
+    library: 'host' | 'org';
+    /** The site whose library this is, or the site on screen for the org's. */
+    hostId: string | null;
+    folderId: string | null;
+    mode: AiImageMode;
+    prompt: string;
+    aspectRatio: string;
+    count: number;
+    /** An illustration's kind; unread for a photo. */
+    style: string;
+    /** An illustration's colors: the site theme's, or these. */
+    palette: {
+        source: 'theme';
+    } | {
+        source: 'custom';
+        colors: string[];
+    };
+}
+export declare function parseAiMediaImageInput(body: Record<string, unknown> | null): AiMediaImageInput;
+/** The record a generated picture keeps of how it was made. */
+export interface AiMediaProvenance {
+    model: string;
+    prompt: string;
+    mode: AiImageMode;
+    /** An illustration's kind; absent on a photo. */
+    style?: AiSvgStyle;
+    aspectRatio: string;
+    /** The meter's signal id for the request that made it. */
+    signalId: string | null;
+    generatedBy: string;
+}
+export declare function POST(request: Request): Promise<Response>;

package/src/lib/server/ai-media-image.js

@@ -0,0 +1,521 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ // lockdown-423: via libs/plugins/ai/src/lib/runtime/ai-gate.ts
+// The POST climbs `aiGateLadder`, whose lockdown rung is the verdict, and
+// every stored picture also passes the upload route's.
+import { mediaFilterKeys } from "@aglyn/aglyn/app-utils/media-metadata";
+import { MEDIA_ALT_MAX_LENGTH } from "@aglyn/aglyn/app-utils/media-alt";
+import { aiMediaCreditsPerPicture } from "../model/ai-media-credits.js";
+import { aiSvgThemePalette, isAiSvgColor } from "../model/ai-svg.js";
+import { estimateAiBilledUsd } from "../providers/catalog.js";
+import { AI_UPSTREAM_FAILURE_COPY, AiUpstreamError } from "../providers/contract.js";
+import { AI_IMAGE_ASPECT_RATIOS, AI_IMAGE_MAX_COUNT, AI_IMAGE_PROMPT_MAX_CHARS, AI_SVG_MAX_COLORS, AI_SVG_STYLES, AiImageSafetyRefusal, isAiImageAspectRatio } from "../providers/image-contract.js";
+import { vertexImageProvider } from "../providers/vertex-image.js";
+import { aiGateLadder } from "../runtime/ai-gate.js";
+import { aiInventoryTheme } from "../runtime/site-inventory.js";
+import { assistBandRefuses, assistCreditsFromUsd } from "../usage/assist-credits.js";
+import { publicAssistQuota, recordAssistCost, releaseAssistMessage } from "../usage/assist-usage.js";
+import { aiMediaSvgModel, generateAiMediaSvg } from "./ai-media-svg.js";
+/**
+ * "Create with AI" in Media (AGL-3602): pictures from a description, stored
+ * in the library that asked.
+ *
+ * `POST /api/ai/media/images { orgId, library, hostId?, folderId?, mode,
+ * prompt, aspectRatio, count, style?, palette? }` answers
+ * `{ mediaIds, filtered, failed, credits, warning? }`.
+ *
+ * Two modes:
+ *
+ * - `photo` — Google's image models on Vertex AI (`vertex-image.ts`). Off
+ *   unless the deployment configured them; the door answers 404 with a
+ *   sentence the dialog shows.
+ * - `illustration` — an SVG drawn by the text provider every other AI door
+ *   uses (`ai-media-svg.ts`): an illustration, an icon, a tileable pattern or
+ *   a simple logo mark, in the site's theme colors or the person's own. No
+ *   new vendor, so it runs wherever text AI does.
+ *
+ * There is no GET: the button draws from the shell's own gates, and this door
+ * decides when someone asks for a picture.
+ *
+ * ## A request, not a job
+ *
+ * Both modes answer inside the request, the way "Save as a component with
+ * AI" does, and are metered on the same meter every door uses.
+ *
+ * ## The money, in order
+ *
+ * 1. `aiGateLadder` RESERVES before anything is spent: the `aiGenerative`
+ *    entitlement, `release_ai_generative`, the `ai-generate` kill switch,
+ *    `ai.generate` on the site, the per-account and per-address windows, the
+ *    Free taste's own rungs and the band.
+ * 2. A workspace whose band is a wall (Free, or a hard cap) is refused before
+ *    the provider is called when the pictures' estimate is more than it has
+ *    left.
+ * 3. The provider is called. A fault of ours or the provider's hands the
+ *    reservation back and charges nothing. A declined description charges
+ *    only what the decline spent, recorded as a declined request (which a
+ *    Free workspace is never charged for, and which its daily refusal pause
+ *    counts).
+ * 4. Each picture is stored, and only what was stored is SETTLED, at billed
+ *    rates above the provider's: a photo per picture plus its prompt and
+ *    thinking, an illustration as the tokens that drew it. A picture held
+ *    back, one the library refused, and an illustration that failed its
+ *    safety check twice are never charged — that last one is ours.
+ *
+ * ## Stored the way any upload is stored
+ *
+ * Each picture is posted to the console's own `/api/media/upload` with the
+ * caller's credential, so the scope, the uploads lockdown, the structural
+ * inspection, SVG sanitizing, the quarantine list, the storage band, the CDN
+ * variants and the storage counter all apply exactly as they do to a file
+ * the person dropped in. This door writes no media document of its own; it
+ * only adds, to the documents that route made, the alt text and the record
+ * of how the picture was made.
+ */ /** The per-account window: a person makes a few sets a minute, not dozens. */ const RATE_LIMIT = {
+    key: 'ai-media-image',
+    limit: 6,
+    windowMs: 60000
+};
+/** What a person reads when a picture failed on our side. */ export const AI_MEDIA_OURS_COPY = "This one's on us — you weren't charged. The picture didn't come out right; try again, or describe it a little differently.";
+/** What the door answers on a deployment that makes no photos. */ export const AI_MEDIA_NO_PHOTOS_COPY = "Photos aren't available here yet. Choose Illustration to draw one instead.";
+/** The provider photos come from; a spec stands one in through jest. */ function imageProvider() {
+    return vertexImageProvider;
+}
+/** Every control character as a space, squeezed, trimmed and cut. */ export function cleanAiImagePrompt(value) {
+    let out = '';
+    for (const char of String(value != null ? value : '')){
+        const code = char.charCodeAt(0);
+        out += code < 32 || code === 127 || code === 0x2028 || code === 0x2029 ? ' ' : char;
+    }
+    return out.replace(/\s+/g, ' ').trim().slice(0, AI_IMAGE_PROMPT_MAX_CHARS);
+}
+/**
+ * The alt text a picture is stored with: the sentence given, as a sentence,
+ * cut at a word inside the library's alt limit. A person edits it like any
+ * other.
+ */ export function aiImageAltText(text) {
+    const clean = text.replace(/\s+/g, ' ').trim();
+    if (!clean) return '';
+    const sentence = clean.charAt(0).toUpperCase() + clean.slice(1);
+    if (sentence.length <= MEDIA_ALT_MAX_LENGTH) return sentence;
+    const cut = sentence.slice(0, MEDIA_ALT_MAX_LENGTH - 1);
+    const space = cut.lastIndexOf(' ');
+    return `${(space > 40 ? cut.slice(0, space) : cut).trim()}…`;
+}
+const EXTENSIONS = {
+    'image/png': 'png',
+    'image/jpeg': 'jpg',
+    'image/webp': 'webp',
+    'image/svg+xml': 'svg'
+};
+/** A file name from the description's first words: `ai-a-red-barn-2.png`. */ export function aiImageFileName(prompt, index, mimeType) {
+    var _EXTENSIONS_mimeType;
+    const words = prompt.toLowerCase().normalize('NFKD').replace(/[^a-z0-9\s-]/g, ' ').split(/\s+/).filter(Boolean).slice(0, 6).join('-').slice(0, 60).replace(/-+$/, '');
+    return `ai-${words || 'image'}-${index + 1}.${(_EXTENSIONS_mimeType = EXTENSIONS[mimeType]) != null ? _EXTENSIONS_mimeType : 'png'}`;
+}
+export function parseAiMediaImageInput(body) {
+    var _ref;
+    const text = (key, limit = 128)=>{
+        const value = body == null ? void 0 : body[key];
+        return typeof value === 'string' ? value.trim().slice(0, limit) : '';
+    };
+    const count = Math.floor(Number((_ref = body == null ? void 0 : body['count']) != null ? _ref : 1));
+    const palette = body == null ? void 0 : body['palette'];
+    const colors = Array.isArray(palette == null ? void 0 : palette['colors']) ? palette == null ? void 0 : palette['colors'] : [];
+    return {
+        orgId: text('orgId'),
+        library: (body == null ? void 0 : body['library']) === 'org' ? 'org' : 'host',
+        hostId: text('hostId') || null,
+        folderId: text('folderId', 64) || null,
+        mode: (body == null ? void 0 : body['mode']) === 'illustration' ? 'illustration' : 'photo',
+        prompt: cleanAiImagePrompt(body == null ? void 0 : body['prompt']),
+        aspectRatio: text('aspectRatio', 8),
+        count: Number.isFinite(count) ? count : 0,
+        style: text('style', 24) || 'illustration',
+        palette: (palette == null ? void 0 : palette['source']) === 'custom' ? {
+            source: 'custom',
+            colors: colors.map((color)=>String(color != null ? color : '').trim().toLowerCase()).slice(0, AI_SVG_MAX_COLORS + 1)
+        } : {
+            source: 'theme'
+        }
+    };
+}
+/**
+ * Posts one picture to the console's own upload route, as the caller. The
+ * same body the library's Upload button sends, so the route cannot tell the
+ * two apart and applies every check it applies to that one.
+ */ async function storeThroughUploadRoute(request, input, image, fileName) {
+    const scope = input.library === 'org' ? _extends({
+        orgId: input.orgId
+    }, input.hostId ? {
+        forHostId: input.hostId
+    } : {}) : {
+        hostId: input.hostId
+    };
+    let response;
+    try {
+        var _request_headers_get;
+        response = await fetch(new URL('/api/media/upload', request.url), {
+            method: 'POST',
+            headers: {
+                Authorization: (_request_headers_get = request.headers.get('authorization')) != null ? _request_headers_get : '',
+                'Content-Type': 'application/json'
+            },
+            body: JSON.stringify(_extends({}, scope, {
+                fileName,
+                contentType: image.mimeType,
+                folderId: input.folderId,
+                data: image.base64
+            }))
+        });
+    } catch (unused) {
+        return {
+            error: 'The picture could not be saved to the media library.',
+            status: 502
+        };
+    }
+    const payload = await response.json().catch(()=>({}));
+    const mediaId = typeof payload['mediaId'] === 'string' ? payload['mediaId'] : '';
+    if (response.ok && mediaId) return {
+        mediaId
+    };
+    return {
+        error: typeof payload['error'] === 'string' ? payload['error'] : 'The picture could not be saved to the media library.',
+        status: response.ok ? 502 : response.status
+    };
+}
+/**
+ * Adds the alt text and the provenance to a document the upload route made.
+ * An `update`, which cannot mint a document: the route minted it.
+ */ async function annotateStoredImage(gate, input, mediaId, alt, provenance) {
+    var _data;
+    const scopeRef = input.library === 'org' ? gate.firestore.collection('orgs').doc(input.orgId) : gate.firestore.collection('hosts').doc(String(input.hostId));
+    const mediaRef = scopeRef.collection('media').doc(mediaId);
+    const stored = (_data = (await mediaRef.get()).data()) != null ? _data : {};
+    await mediaRef.update(_extends({
+        alt,
+        description: 'Created with AI from a description.',
+        aiGenerated: _extends({}, provenance, {
+            createdAt: new Date()
+        })
+    }, mediaFilterKeys(_extends({}, stored, {
+        alt
+    }))));
+}
+/** The colors an illustration is drawn in. */ async function illustrationPalette(gate, input) {
+    var _snapshot_data;
+    var _aiInventoryTheme;
+    if (input.palette.source === 'custom') return input.palette.colors;
+    if (!input.hostId) return [];
+    const snapshot = await gate.firestore.collection('hosts').doc(input.hostId).get();
+    return aiSvgThemePalette((_aiInventoryTheme = aiInventoryTheme(snapshot.exists ? (_snapshot_data = snapshot.data()) != null ? _snapshot_data : null : null)) == null ? void 0 : _aiInventoryTheme.colors);
+}
+const ZERO_USAGE = {
+    inputTokens: 0,
+    outputTokens: 0,
+    cacheReadTokens: 0,
+    cacheWriteTokens: 0
+};
+const sumUsage = (usages)=>usages.reduce((sum, usage)=>({
+            inputTokens: sum.inputTokens + usage.inputTokens,
+            outputTokens: sum.outputTokens + usage.outputTokens,
+            cacheReadTokens: sum.cacheReadTokens + usage.cacheReadTokens,
+            cacheWriteTokens: sum.cacheWriteTokens + usage.cacheWriteTokens
+        }), ZERO_USAGE);
+export async function POST(request) {
+    var _ref;
+    let body;
+    try {
+        body = await request.json();
+    } catch (unused) {
+        body = null;
+    }
+    const input = parseAiMediaImageInput(body);
+    const provider = imageProvider();
+    const svgModel = input.mode === 'illustration' ? aiMediaSvgModel() : undefined;
+    // A deployment that makes no pictures of this kind has no such door, so
+    // nothing about the caller or the workspace is read first.
+    if (input.mode === 'photo' && !provider.configured()) {
+        return Response.json({
+            error: AI_MEDIA_NO_PHOTOS_COPY,
+            reason: 'unavailable'
+        }, {
+            status: 404
+        });
+    }
+    if (input.mode === 'illustration' && !svgModel) {
+        return Response.json({
+            error: 'Not found'
+        }, {
+            status: 404
+        });
+    }
+    const gate = await aiGateLadder({
+        request,
+        orgId: input.orgId,
+        hostId: input.hostId
+    }, {
+        feature: 'aiGenerative',
+        releaseFlag: 'release_ai_generative',
+        lockdownFeature: 'ai-generate',
+        permission: 'ai.generate',
+        rateLimit: RATE_LIMIT
+    });
+    if (gate instanceof Response) return gate;
+    // Nothing is spent until a provider answers, so every exit before it
+    // hands the reservation back.
+    const release = ()=>releaseAssistMessage(gate.firestore, gate.orgId, gate.reservation).catch(()=>undefined);
+    const refuse = async (error, status, extra = {})=>{
+        await release();
+        return Response.json(_extends({
+            error
+        }, extra), {
+            status
+        });
+    };
+    if (input.library === 'host' && !input.hostId) {
+        return refuse('Open the site whose media library the pictures go in.', 400);
+    }
+    if (!input.prompt) return refuse('Describe the picture you want first.', 400);
+    if (!isAiImageAspectRatio(input.aspectRatio)) {
+        return refuse(`Choose a shape: ${AI_IMAGE_ASPECT_RATIOS.join(', ')}.`, 400);
+    }
+    const aspectRatio = input.aspectRatio;
+    if (input.count < 1 || input.count > AI_IMAGE_MAX_COUNT) {
+        return refuse(`Make between 1 and ${AI_IMAGE_MAX_COUNT} pictures at a time.`, 400);
+    }
+    if (input.mode === 'illustration') {
+        if (!AI_SVG_STYLES.includes(input.style)) {
+            return refuse('Choose an illustration, an icon, a pattern or a logo mark.', 400);
+        }
+        if (input.palette.source === 'custom' && (!input.palette.colors.length || input.palette.colors.length > AI_SVG_MAX_COLORS || !input.palette.colors.every(isAiSvgColor))) {
+            return refuse(`Give between 1 and ${AI_SVG_MAX_COLORS} colors as hex values, such as #1a73e8.`, 400);
+        }
+    }
+    const model = input.mode === 'photo' ? provider.defaultModel() : svgModel;
+    const perPicture = aiMediaCreditsPerPicture(input.mode, model);
+    const estimate = perPicture * input.count;
+    const credits = publicAssistQuota(gate.reservation).credits;
+    if (credits && assistBandRefuses(gate.org) && credits.remaining < estimate) {
+        return refuse(credits.remaining < perPicture ? 'This workspace has used its AI credits for the month.' : `That needs about ${estimate} credits and this workspace has ${credits.remaining} left this month. Make fewer pictures.`, 429, {
+            reason: 'quota',
+            quota: publicAssistQuota(gate.reservation)
+        });
+    }
+    /** Records what a decline spent: a declined request, never a picture. */ const recordDecline = (usage, declinedModel)=>{
+        var _gate_reservation_free;
+        return recordAssistCost(gate.firestore, gate.orgId, {
+            route: '/api/ai/media/images',
+            hostId: input.hostId,
+            model: declinedModel,
+            tier: 'entitled',
+            usage: _extends({}, usage, {
+                images: 0
+            }),
+            docsPaths: [],
+            stopReason: 'refusal',
+            free: (_gate_reservation_free = gate.reservation.free) != null ? _gate_reservation_free : null,
+            uid: gate.uid,
+            kind: 'image'
+        }).catch((meterError)=>console.error('ai media refusal not recorded', {
+                orgId: gate.orgId,
+                meterError
+            }));
+    };
+    let made;
+    /** Pictures asked for and not made: held back, declined or failed on our side. */ let unmade;
+    /** Tokens a photo request spent beside its pictures, charged once any is stored. */ let photoUsage = ZERO_USAGE;
+    let declineReason = null;
+    let style;
+    if (input.mode === 'photo') {
+        try {
+            const result = await provider.generate({
+                model,
+                prompt: input.prompt,
+                aspectRatio,
+                count: input.count
+            });
+            photoUsage = result.usage;
+            unmade = result.filtered;
+            made = result.images.map((image)=>_extends({}, image, {
+                    alt: aiImageAltText(input.prompt),
+                    usage: ZERO_USAGE
+                }));
+        } catch (error) {
+            if (error instanceof AiImageSafetyRefusal) {
+                // Declined, not failed: no picture is charged, and the request is
+                // recorded as a declined one so the Free taste's refusal pause
+                // counts it.
+                await recordDecline(ZERO_USAGE, model);
+                return Response.json({
+                    error: error.message,
+                    reason: 'safety'
+                }, {
+                    status: 422
+                });
+            }
+            await release();
+            console.error('ai photo generation failed', {
+                orgId: gate.orgId,
+                error
+            });
+            const status = error instanceof AiUpstreamError && error.accountProblem ? 503 : 502;
+            return Response.json({
+                error: AI_UPSTREAM_FAILURE_COPY
+            }, {
+                status
+            });
+        }
+    } else {
+        var _ref1;
+        var _declined_;
+        style = input.style;
+        const palette = await illustrationPalette(gate, input);
+        const settled = await Promise.allSettled(Array.from({
+            length: input.count
+        }, (_unused, variant)=>generateAiMediaSvg({
+                model,
+                prompt: input.prompt,
+                style: style,
+                aspectRatio,
+                palette,
+                variant,
+                count: input.count
+            })));
+        const outcomes = settled.flatMap((entry)=>entry.status === 'fulfilled' ? [
+                entry.value
+            ] : []);
+        if (!outcomes.length) {
+            var _settled_;
+            await release();
+            console.error('ai illustration generation failed', {
+                orgId: gate.orgId,
+                error: (_settled_ = settled[0]) == null ? void 0 : _settled_.reason
+            });
+            return Response.json({
+                error: AI_UPSTREAM_FAILURE_COPY
+            }, {
+                status: 502
+            });
+        }
+        const drawn = outcomes.filter((outcome)=>outcome.kind === 'drawn');
+        const declined = outcomes.filter((outcome)=>outcome.kind === 'declined');
+        unmade = input.count - drawn.length;
+        declineReason = (_ref1 = (_declined_ = declined[0]) == null ? void 0 : _declined_.reason) != null ? _ref1 : null;
+        made = drawn.map((outcome)=>({
+                base64: Buffer.from(outcome.svg, 'utf8').toString('base64'),
+                mimeType: 'image/svg+xml',
+                alt: aiImageAltText(outcome.alt || input.prompt),
+                usage: outcome.usage
+            }));
+        if (!made.length) {
+            if (declined.length) {
+                // The model declined: what it spent is a declined request.
+                await recordDecline(sumUsage(declined.map((outcome)=>outcome.usage)), model);
+                return Response.json({
+                    error: declineReason,
+                    reason: 'safety'
+                }, {
+                    status: 422
+                });
+            }
+            // Every picture failed its check twice. Ours, so nothing is charged.
+            await release();
+            return Response.json({
+                error: AI_MEDIA_OURS_COPY,
+                reason: 'ours'
+            }, {
+                status: 502
+            });
+        }
+    }
+    const stored = [];
+    let refusal = null;
+    for (const [index, picture] of made.entries()){
+        const outcome = await storeThroughUploadRoute(request, input, picture, aiImageFileName(input.prompt, index, picture.mimeType));
+        if ('mediaId' in outcome) stored.push({
+            mediaId: outcome.mediaId,
+            picture
+        });
+        else refusal != null ? refusal : refusal = outcome;
+    }
+    if (!stored.length) {
+        var _ref2, _ref3;
+        // Made and not kept: the library refused every picture (its storage
+        // band, a lockdown, a permission), so nothing is charged.
+        await release();
+        return Response.json({
+            error: (_ref2 = refusal == null ? void 0 : refusal.error) != null ? _ref2 : 'The pictures could not be saved.'
+        }, {
+            status: (_ref3 = refusal == null ? void 0 : refusal.status) != null ? _ref3 : 502
+        });
+    }
+    // Only what was stored is settled: a photo's pictures at the per-picture
+    // rate with the request's prompt and thinking, an illustration's tokens.
+    const usage = input.mode === 'photo' ? _extends({}, photoUsage, {
+        images: stored.length
+    }) : sumUsage(stored.map((entry)=>entry.picture.usage));
+    let signalId = null;
+    try {
+        var _gate_reservation_free;
+        signalId = await recordAssistCost(gate.firestore, gate.orgId, {
+            route: '/api/ai/media/images',
+            hostId: input.hostId,
+            model,
+            tier: 'entitled',
+            usage,
+            docsPaths: [],
+            stopReason: 'end_turn',
+            free: (_gate_reservation_free = gate.reservation.free) != null ? _gate_reservation_free : null,
+            uid: gate.uid,
+            kind: 'image'
+        });
+    } catch (error) {
+        // The pictures are in the library and were paid for by us; a meter
+        // that could not be written is not a reason to hide them.
+        console.error('ai media usage not recorded', {
+            orgId: gate.orgId,
+            error
+        });
+    }
+    await Promise.all(stored.map(({ mediaId, picture })=>annotateStoredImage(gate, input, mediaId, picture.alt, _extends({
+            model,
+            prompt: input.prompt,
+            mode: input.mode
+        }, style ? {
+            style
+        } : {}, {
+            aspectRatio,
+            signalId,
+            generatedBy: gate.uid
+        })).catch((error)=>console.error('ai media alt text not written', {
+                mediaId,
+                error
+            }))));
+    const warning = (_ref = refusal == null ? void 0 : refusal.error) != null ? _ref : declineReason && unmade > 0 ? declineReason : unmade > 0 && input.mode === 'illustration' ? AI_MEDIA_OURS_COPY : null;
+    return Response.json(_extends({
+        mediaIds: stored.map((entry)=>entry.mediaId),
+        filtered: unmade,
+        failed: made.length - stored.length,
+        // What was charged, as the meter priced it.
+        credits: assistCreditsFromUsd(estimateAiBilledUsd(usage, model))
+    }, warning ? {
+        warning
+    } : {}));
+}
+
+//# sourceMappingURL=ai-media-image.js.map