@bongos/core 1.23.22 → 1.24.1

package/tests/ai_studio_keys.mjs

@@ -0,0 +1,159 @@
+// tests/ai_studio_keys.mjs — a builder's own AI provider keys (task 1004919,
+// goal 1000136, ADR 0392): saved only through the Settings route, stored
+// encrypted, and NEVER sent back to the browser or written to a log.
+//
+// Drives the real router over a stubbed db and a stand-in secret box, so it
+// needs no Postgres and no master key.
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+import fs from 'node:fs';
+
+const require = createRequire(import.meta.url);
+const K = require('../modules/ai-studio/keys.js');
+const db = require('../modules/ai-studio/db.js');
+const api = require('../src/module-api.js');
+
+const SECRET = 'sk-or-v1-THIS-IS-A-TEST-KEY-abcdef0123456789WXYZ';
+
+// ---- pure ------------------------------------------------------------------
+
+test('cleanKey trims, refuses blanks, spaces and silly lengths, and never echoes the key', () => {
+  assert.deepEqual(K.cleanKey(`  ${SECRET}\n`), { key: SECRET });
+  assert.equal(K.cleanKey('').error, 'key_required');
+  assert.equal(K.cleanKey(undefined).error, 'key_required');
+  assert.equal(K.cleanKey('short').error, 'key_wrong_length');
+  assert.equal(K.cleanKey('abcdefgh ijklmnopqrstu').error, 'key_has_spaces');
+  for (const bad of ['short', 'abcdefgh ijklmnopqrstu']) assert.ok(!JSON.stringify(K.cleanKey(bad)).includes(bad));
+});
+
+test('publicKey carries no field that could hold the key or its ciphertext', () => {
+  const row = { provider: 'openrouter', key_enc: 'v1.iv.tag.CIPHERTEXT', last4: 'WXYZ', set_at: '2026-10-28T00:00:00Z', plaintext: SECRET };
+  const out = K.publicKey('openrouter', row);
+  assert.deepEqual(Object.keys(out).sort(), ['label', 'last4', 'learn_more_url', 'provider', 'set', 'set_at']);
+  assert.equal(out.set, true);
+  assert.equal(out.last4, 'WXYZ');
+  assert.ok(!JSON.stringify(out).includes('CIPHERTEXT'));
+  assert.ok(!JSON.stringify(out).includes(SECRET));
+  assert.deepEqual(K.listPublic([]).map((k) => [k.provider, k.set]), [['openrouter', false], ['gemini', false]]);
+});
+
+test('the migration stores only ciphertext and the last four, for known providers', () => {
+  const sql = fs.readFileSync(new URL('../modules/ai-studio/migrations/ai_studio_001_keys.sql', import.meta.url), 'utf8');
+  assert.match(sql, /key_enc\s+TEXT\s+NOT NULL/);
+  assert.match(sql, /CHECK \(key_enc LIKE 'v1\.%'\)/);
+  assert.match(sql, /CHECK \(provider IN \('openrouter', 'gemini'\)\)/);
+  assert.match(sql, /INSERT INTO schema_migrations \(version\) VALUES \('ai_studio_001_keys'\)/);
+  assert.deepEqual(Object.keys(K.PROVIDERS).sort(), ['gemini', 'openrouter'], 'the CHECK and PROVIDERS must name the same providers');
+});
+
+// ---- the routes ------------------------------------------------------------
+
+const store = new Map();
+db.listKeyMeta = async (builderId) => [...store.values()].filter((r) => r.builder_id === builderId).map((r) => ({ provider: r.provider, last4: r.last4, set_at: r.set_at, key_enc: true }));
+db.setKey = async (builderId, provider, keyEnc, last4) => {
+  const row = { builder_id: builderId, provider, key_enc: keyEnc, last4, set_at: '2026-10-28T00:00:00Z' };
+  store.set(`${builderId}/${provider}`, row);
+  return { provider, last4, set_at: row.set_at, key_enc: true };
+};
+db.clearKey = async (builderId, provider) => store.delete(`${builderId}/${provider}`);
+
+let configured = true;
+const box = { isConfigured: () => configured, encrypt: (p) => `v1.iv.tag.${Buffer.from(p).toString('base64url')}`, decrypt: () => { throw new Error('a route must never decrypt'); } };
+const logged = [];
+const capture = (...args) => logged.push(JSON.stringify(args));
+const fakeLog = { info: capture, warn: capture, error: capture, debug: capture, child: () => fakeLog };
+let viewer = { id: 7, rank: 'xenos' };
+for (const [name, value] of Object.entries({
+  secretBox: box,
+  logger: () => fakeLog,
+  requireBuilder: (req, res, next) => { if (!viewer) return res.status(401).json({ error: { code: 'unauthenticated' } }); req.builder = viewer; next(); },
+  requireRank: () => (req, res, next) => next(),
+})) Object.defineProperty(api, name, { value, configurable: true, writable: true });
+
+const express = require('express');
+const app = express();
+app.use((req, res, next) => {
+  res.fail = (code, opts) => res.status(typeof opts === 'number' ? opts : (opts && opts.status) || 400).json({ error: { code, message: opts && opts.message } });
+  next();
+});
+app.use(express.json({ limit: '64kb' }));
+app.use('/api/bongos', require('../modules/ai-studio/routes/ai-studio.js')());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+test.after(() => server.close());
+
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const data = body === undefined ? null : JSON.stringify(body);
+    const req = http.request(`${base}${path}`, { method, headers: data ? { 'content-type': 'application/json', 'content-length': Buffer.byteLength(data) } : {} }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => { const raw = Buffer.concat(chunks).toString(); resolve({ status: res.statusCode, raw, body: JSON.parse(raw) }); });
+    });
+    req.on('error', reject);
+    if (data) req.write(data);
+    req.end();
+  });
+}
+
+test('THE WHOLE PATH: save a key, list it, replace it, remove it, and the key never comes back', async () => {
+  const saved = await call('PUT', '/ai-studio/keys/openrouter', { key: SECRET });
+  assert.equal(saved.status, 200);
+  assert.equal(saved.body.key.set, true);
+  assert.equal(saved.body.key.last4, 'WXYZ');
+
+  // It is stored encrypted, never as the plaintext.
+  const row = store.get('7/openrouter');
+  assert.ok(row.key_enc.startsWith('v1.'));
+  assert.notEqual(row.key_enc, SECRET);
+
+  const listed = await call('GET', '/ai-studio/keys');
+  assert.equal(listed.status, 200);
+  assert.equal(listed.body.storage_configured, true);
+  assert.deepEqual(listed.body.keys.map((k) => [k.provider, k.set, k.last4]), [['openrouter', true, 'WXYZ'], ['gemini', false, null]]);
+
+  const removed = await call('DELETE', '/ai-studio/keys/openrouter');
+  assert.equal(removed.body.removed, true);
+  assert.equal(removed.body.key.set, false);
+
+  // Nothing any route answered, and nothing logged, holds the key or its ciphertext.
+  for (const r of [saved, listed, removed]) {
+    assert.ok(!r.raw.includes(SECRET), 'a response carried the key');
+    assert.ok(!r.raw.includes(row.key_enc), 'a response carried the ciphertext');
+  }
+  assert.ok(logged.length > 0, 'the routes do log, so the next check is not vacuous');
+  for (const line of logged) {
+    assert.ok(!line.includes(SECRET), 'a log line carried the key');
+    assert.ok(!line.includes('WXYZ') || !line.includes(SECRET.slice(0, 12)), 'a log line carried part of the key');
+  }
+});
+
+test('a builder only ever sees their own keys', async () => {
+  viewer = { id: 7, rank: 'xenos' };
+  await call('PUT', '/ai-studio/keys/gemini', { key: SECRET });
+  viewer = { id: 8, rank: 'xenos' };
+  const other = await call('GET', '/ai-studio/keys');
+  assert.deepEqual(other.body.keys.map((k) => k.set), [false, false]);
+  viewer = { id: 7, rank: 'xenos' };
+  await call('DELETE', '/ai-studio/keys/gemini');
+});
+
+test('refusals: unknown provider, bad key, no storage, signed out', async () => {
+  assert.equal((await call('PUT', '/ai-studio/keys/acme', { key: SECRET })).status, 404);
+  const bad = await call('PUT', '/ai-studio/keys/openrouter', { key: 'nope' });
+  assert.equal(bad.status, 400);
+  assert.ok(!bad.raw.includes('nope'));
+  configured = false;
+  const off = await call('PUT', '/ai-studio/keys/openrouter', { key: SECRET });
+  assert.equal(off.status, 409);
+  assert.equal(off.body.error.code, 'storage_not_configured');
+  assert.equal(store.size, 0, 'nothing is stored when storage is not set up');
+  configured = true;
+  viewer = null;
+  assert.equal((await call('GET', '/ai-studio/keys')).status, 401);
+  viewer = { id: 7, rank: 'xenos' };
+});

package/tests/ai_studio_requests.mjs

@@ -0,0 +1,319 @@
+// tests/ai_studio_requests.mjs — THE WHOLE PATH of an AI studio request through
+// the real router (task 1004917, goal 1000136, ADR 0392): upload a sketch, send
+// a request naming it, wait for it to finish, read the reply, the image and the
+// exact price, and fetch the image back. Also: a builder can only send and see
+// their own files, and our key appears in no response.
+//
+// Drives the real router over an in-memory db, the fake payments backend and a
+// stubbed fetch standing in for OpenRouter, so it needs no Postgres and no network.
+
+import { test } from 'node:test';
+import { strict as assert } from 'node:assert';
+import { createRequire } from 'node:module';
+import http from 'node:http';
+
+const require = createRequire(import.meta.url);
+const db = require('../modules/ai-studio/db.js');
+const payments = require('../modules/ai-studio/payments.js');
+const P = require('../modules/ai-studio/pricing.js');
+const api = require('../src/module-api.js');
+
+const OUR_KEY = 'sk-or-v1-OUR-SERVER-KEY-0123456789abcdef';
+const PNG = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 0, 0, 0, 13]);
+const OUT_PNG = Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a, 1, 2, 3, 4]);
+
+// ---- an in-memory db with the same ownership rules as the SQL ---------------
+
+const files = new Map();
+const requests = new Map();
+let seq = 100;
+const meta = (f) => ({ id: f.id, request_id: f.request_id, role: f.role, name: f.name, content_type: f.content_type, size_bytes: f.bytes.length, created_at: f.created_at });
+Object.assign(db, {
+  appendLedger: async () => ({}),
+  addUpload: async (builderId, f) => {
+    const row = { id: String(++seq), builder_id: builderId, request_id: null, role: 'upload', name: f.name, content_type: f.content_type, bytes: f.bytes, created_at: 'now' };
+    files.set(row.id, row);
+    return meta(row);
+  },
+  createRequest: async (builderId, prompt, ids) => {
+    const own = ids.map((id) => files.get(id)).filter((f) => f && f.builder_id === builderId && f.role === 'upload' && !f.request_id);
+    if (own.length !== ids.length) return null;
+    const r = { id: String(++seq), builder_id: builderId, prompt, status: 'queued', key_source: null, created_at: 'now' };
+    requests.set(r.id, r);
+    own.forEach((f) => { f.request_id = r.id; });
+    return { ...r, attached: own.length };
+  },
+  markRunning: async (id, src) => Object.assign(requests.get(String(id)), { status: 'running', key_source: src }),
+  finishRequest: async (id, f) => Object.assign(requests.get(String(id)), f, { finished_at: 'now' }),
+  addOutput: async (requestId, builderId, img) => {
+    const row = { id: String(++seq), builder_id: builderId, request_id: String(requestId), role: 'output', name: 'generated.png', content_type: img.content_type, bytes: Buffer.from(img.base64, 'base64'), created_at: 'now' };
+    files.set(row.id, row);
+    return meta(row);
+  },
+  getRequest: async (builderId, id) => {
+    const r = requests.get(String(id));
+    if (!r || r.builder_id !== builderId) return null;
+    return { ...r, files: [...files.values()].filter((f) => f.request_id === r.id).map(meta) };
+  },
+  listRequests: async (builderId) => [...requests.values()].filter((r) => r.builder_id === builderId),
+  getFile: async (builderId, id) => { const f = files.get(String(id)); return f && f.builder_id === builderId ? f : null; },
+  requestUploads: async (id) => [...files.values()].filter((f) => f.request_id === String(id) && f.role === 'upload'),
+  countActiveRequests: async (builderId) => [...requests.values()].filter((r) => r.builder_id === builderId && ['queued', 'running'].includes(r.status)).length,
+  listKeyMeta: async (builderId) => [...ownKeys.entries()].filter(([k]) => k.startsWith(`${builderId}/`)).map(([k]) => ({ provider: k.split('/')[1], key_enc: true })),
+  getKeyEnc: async (builderId, provider) => ownKeys.get(`${builderId}/${provider}`) || null,
+});
+
+// A builder's own saved keys, as the secret box would store them.
+const ownKeys = new Map();
+const box = { isConfigured: () => true, encrypt: (p) => `v1.${Buffer.from(p).toString('base64url')}`, decrypt: (b) => Buffer.from(String(b).slice(3), 'base64url').toString() };
+Object.defineProperty(api, 'secretBox', { value: box, configurable: true, writable: true });
+
+// ---- OpenRouter stand-in: a reply, then an image, each with its cost --------
+
+const providerCalls = [];
+globalThis.fetch = async (url, init) => {
+  const body = JSON.parse(init.body);
+  providerCalls.push({ url, auth: init.headers.authorization, googKey: init.headers['x-goog-api-key'], body });
+  if (url.includes('generativelanguage.googleapis.com')) {
+    const part = body.generationConfig
+      ? { inlineData: { mimeType: 'image/png', data: OUT_PNG.toString('base64') } }
+      : { text: 'From Gemini direct: lovely.' };
+    return { ok: true, status: 200, json: async () => ({ candidates: [{ content: { parts: [part] } }] }) };
+  }
+  const json = body.modalities
+    ? { choices: [{ message: { images: [{ image_url: { url: `data:image/png;base64,${OUT_PNG.toString('base64')}` } }] } }], usage: { cost: 0.039 } }
+    : { choices: [{ message: { content: 'The tower reads well; push the dusk light.' } }], usage: { cost: 0.0114 } };
+  return { ok: true, status: 200, json: async () => json };
+};
+process.env.OPENROUTER_API_KEY = OUR_KEY;
+const pay = payments.createFakeBackend();
+payments._setBackend(pay);
+await pay.topUp(7, { chargeMicro: 10 * P.MICRO_PER_USD + 1, creditedMicro: 10 * P.MICRO_PER_USD });
+
+// ---- the app -----------------------------------------------------------------
+
+const logged = [];
+const capture = (...args) => logged.push(JSON.stringify(args));
+const fakeLog = { info: capture, warn: capture, error: capture, debug: capture, child: () => fakeLog };
+let viewer = { id: 7, rank: 'xenos' };
+for (const [name, value] of Object.entries({
+  logger: () => fakeLog,
+  requireBuilder: (req, res, next) => { req.builder = viewer; next(); },
+})) Object.defineProperty(api, name, { value, configurable: true, writable: true });
+
+const express = require('express');
+const app = express();
+app.use((req, res, next) => {
+  res.fail = (code, opts) => res.status(typeof opts === 'number' ? opts : (opts && opts.status) || 400).json({ error: { code, message: opts && opts.message } });
+  next();
+});
+// Like src/bongos/routes.js: the tight global parser skips the upload path.
+const small = express.json({ limit: '64kb' });
+app.use((req, res, next) => (req.path === '/api/bongos/ai-studio/uploads' ? next() : small(req, res, next)));
+app.use('/api/bongos', require('../modules/ai-studio/routes/ai-studio.js')());
+const server = app.listen(0);
+await new Promise((r) => server.once('listening', r));
+const base = `http://127.0.0.1:${server.address().port}/api/bongos`;
+test.after(() => server.close());
+
+function call(method, path, body) {
+  return new Promise((resolve, reject) => {
+    const data = body === undefined ? null : JSON.stringify(body);
+    const req = http.request(`${base}${path}`, { method, headers: data ? { 'content-type': 'application/json', 'content-length': Buffer.byteLength(data) } : {} }, (res) => {
+      const chunks = [];
+      res.on('data', (c) => chunks.push(c));
+      res.on('end', () => {
+        const buf = Buffer.concat(chunks);
+        const raw = buf.toString('latin1');
+        let json = null;
+        try { json = JSON.parse(buf.toString()); } catch (_) { /* a file */ }
+        resolve({ status: res.statusCode, headers: res.headers, raw, buf, body: json });
+      });
+    });
+    req.on('error', reject);
+    if (data) req.write(data);
+    req.end();
+  });
+}
+
+async function waitDone(id) {
+  for (let i = 0; i < 100; i++) {
+    const r = await call('GET', `/ai-studio/requests/${id}`);
+    if (!['queued', 'running'].includes(r.body.request.status)) return r;
+    await new Promise((res) => setTimeout(res, 10));
+  }
+  throw new Error('the request never finished');
+}
+
+test('THE WHOLE PATH: upload a sketch, send it, get a reply, an image and the exact price', async () => {
+  // A sketch bigger than the 64 KB global cap still goes up.
+  const sketch = Buffer.concat([PNG, Buffer.alloc(200 * 1024)]);
+  const up = await call('POST', '/ai-studio/uploads', { name: 'tower.png', content_type: 'image/png', data: sketch.toString('base64') });
+  assert.equal(up.status, 201, up.raw);
+  assert.equal(up.body.file.size_bytes, sketch.length);
+
+  const sent = await call('POST', '/ai-studio/requests', { prompt: 'Finish this tower at dusk', file_ids: [up.body.file.id] });
+  assert.equal(sent.status, 202, sent.raw);
+
+  const done = await waitDone(sent.body.request.id);
+  const r = done.body.request;
+  assert.equal(r.status, 'done', r.error);
+  assert.equal(r.key_source, 'ours');
+  assert.equal(r.reply_md, 'The tower reads well; push the dusk light.');
+  // 0.0114 + 0.039 = $0.0504 cost; x 1.08 = $0.054432.
+  assert.deepEqual([r.provider_cost_micro, r.markup_micro, r.price_micro], [50400, 4032, 54432]);
+  assert.deepEqual((await pay.balance(7)).available_micro, 10 * P.MICRO_PER_USD - 54432);
+
+  const out = r.files.find((f) => f.role === 'output');
+  assert.ok(out, 'the generated image is on the request');
+  const img = await call('GET', out.url.replace('/api/bongos', ''));
+  assert.equal(img.status, 200);
+  assert.equal(img.headers['content-type'], 'image/png');
+  assert.equal(img.headers['x-content-type-options'], 'nosniff');
+  assert.ok(img.buf.equals(OUT_PNG));
+
+  // The provider got our key as a header, the sketch, and the server-built context.
+  assert.equal(providerCalls.length, 2);
+  assert.ok(providerCalls.every((c) => c.auth === `Bearer ${OUR_KEY}`));
+  assert.match(providerCalls[0].body.messages[0].content, /art director's assistant/);
+  assert.equal(providerCalls[0].body.messages[1].content[1].type, 'image_url');
+
+  // Our key is in nothing a builder can see, and in no log line.
+  for (const res of [up, sent, done]) assert.ok(!res.raw.includes(OUR_KEY));
+  assert.ok(logged.length > 0);
+  assert.ok(logged.every((l) => !l.includes(OUR_KEY)));
+});
+
+test('a builder can neither send nor read another builder\'s files or requests', async () => {
+  const up = await call('POST', '/ai-studio/uploads', { name: 'mine.png', content_type: 'image/png', data: PNG.toString('base64') });
+  const sent = await call('POST', '/ai-studio/requests', { prompt: 'my own request', file_ids: [up.body.file.id] });
+  await waitDone(sent.body.request.id);
+
+  viewer = { id: 8, rank: 'xenos' };
+  try {
+    const up2 = await call('POST', '/ai-studio/uploads', { name: 'other.png', content_type: 'image/png', data: PNG.toString('base64') });
+    const borrow = await call('POST', '/ai-studio/requests', { prompt: 'borrow it', file_ids: [up.body.file.id, up2.body.file.id] });
+    assert.equal(borrow.status, 404);
+    assert.equal((await call('GET', `/ai-studio/requests/${sent.body.request.id}`)).status, 404);
+    assert.equal((await call('GET', `/ai-studio/files/${up.body.file.id}`)).status, 404);
+  } finally {
+    viewer = { id: 7, rank: 'xenos' };
+  }
+  // A file already sent cannot be sent again.
+  const again = await call('POST', '/ai-studio/requests', { prompt: 'again please', file_ids: [up.body.file.id] });
+  assert.equal(again.status, 404);
+});
+
+test('refusals: a disguised file, a missing prompt, too many files', async () => {
+  const fake = await call('POST', '/ai-studio/uploads', { name: 'x.jpg', content_type: 'image/jpeg', data: PNG.toString('base64') });
+  assert.equal(fake.status, 400);
+  assert.equal(fake.body.error.code, 'type_mismatch');
+  const svg = await call('POST', '/ai-studio/uploads', { name: 'x.svg', content_type: 'image/svg+xml', data: Buffer.from('<svg/>').toString('base64') });
+  assert.equal(svg.body.error.code, 'unsupported_type');
+  assert.equal((await call('POST', '/ai-studio/requests', { prompt: '', file_ids: ['1'] })).body.error.code, 'prompt_required');
+  assert.equal((await call('POST', '/ai-studio/requests', { prompt: 'seven', file_ids: ['1', '2', '3', '4', '5', '6', '7'] })).status, 400);
+});
+
+// ---- the builder's own key (task 1004918) ------------------------------------
+
+const BUILDER_OR_KEY = 'sk-or-v1-BUILDER-OWN-KEY-fedcba9876543210';
+const BUILDER_GOOGLE_KEY = 'test-builder-google-key-0123456789abcdef';
+
+async function sendSketch(body = {}) {
+  const up = await call('POST', '/ai-studio/uploads', { name: 'own.png', content_type: 'image/png', data: PNG.toString('base64') });
+  return call('POST', '/ai-studio/requests', { prompt: 'Finish on my key', file_ids: [up.body.file.id], ...body });
+}
+
+test('OWN KEY: with an OpenRouter key saved, it runs on that key and charges nothing', async () => {
+  ownKeys.set('9/openrouter', box.encrypt(BUILDER_OR_KEY));
+  viewer = { id: 9, rank: 'xenos' };
+  const balanceBefore = await pay.balance(9);
+  const callsBefore = providerCalls.length;
+  try {
+    const sent = await sendSketch();
+    assert.equal(sent.status, 202, sent.raw);
+    const r = (await waitDone(sent.body.request.id)).body.request;
+    assert.equal(r.status, 'done', r.error);
+    assert.equal(r.key_source, 'own');
+    assert.equal(r.price_micro, 0, 'we charge nothing on their key');
+    assert.equal(r.markup_micro, 0);
+    assert.equal(r.provider_cost_micro, 50400, 'what it cost them is still shown');
+    assert.deepEqual(await pay.balance(9), balanceBefore, 'no money moved');
+    const used = providerCalls.slice(callsBefore);
+    assert.equal(used.length, 2);
+    assert.ok(used.every((c) => c.auth === `Bearer ${BUILDER_OR_KEY}`), 'their key, not ours');
+    // Their key appears in no response and no log line.
+    assert.ok(!sent.raw.includes(BUILDER_OR_KEY));
+    assert.ok(logged.every((l) => !l.includes(BUILDER_OR_KEY)));
+  } finally {
+    viewer = { id: 7, rank: 'xenos' };
+  }
+});
+
+test('OWN KEY: a Google key goes to Gemini directly, as a header, and its unknown cost is shown as unknown', async () => {
+  ownKeys.set('10/gemini', box.encrypt(BUILDER_GOOGLE_KEY));
+  viewer = { id: 10, rank: 'xenos' };
+  const callsBefore = providerCalls.length;
+  try {
+    const sent = await sendSketch();
+    const r = (await waitDone(sent.body.request.id)).body.request;
+    assert.equal(r.status, 'done', r.error);
+    assert.equal(r.reply_md, 'From Gemini direct: lovely.');
+    assert.equal(r.provider_cost_micro, null);
+    assert.equal(r.price_micro, 0);
+    assert.ok(r.files.some((f) => f.role === 'output'));
+    const used = providerCalls.slice(callsBefore);
+    assert.equal(used.length, 2);
+    assert.ok(used.every((c) => c.url.startsWith('https://generativelanguage.googleapis.com/') && c.googKey === BUILDER_GOOGLE_KEY));
+    assert.ok(used.every((c) => !c.url.includes(BUILDER_GOOGLE_KEY)), 'the key is never in the URL');
+  } finally {
+    viewer = { id: 7, rank: 'xenos' };
+  }
+});
+
+test('OWN KEY: pay_with ours uses the balance even with a key saved; own with none saved is refused', async () => {
+  viewer = { id: 9, rank: 'xenos' };
+  await pay.topUp(9, { chargeMicro: 5 * P.MICRO_PER_USD + 1, creditedMicro: 5 * P.MICRO_PER_USD });
+  try {
+    const sent = await sendSketch({ pay_with: 'ours' });
+    const r = (await waitDone(sent.body.request.id)).body.request;
+    assert.equal(r.key_source, 'ours');
+    assert.equal(r.price_micro, 54432);
+  } finally {
+    viewer = { id: 7, rank: 'xenos' };
+  }
+  const none = await sendSketch({ pay_with: 'own' });
+  assert.equal(none.status, 409);
+  assert.equal(none.body.error.code, 'no_own_key');
+});
+
+test('a builder may have only two requests running at once', async () => {
+  viewer = { id: 11, rank: 'xenos' };
+  const realFetch = globalThis.fetch;
+  let release;
+  const gate = new Promise((r) => { release = r; });
+  globalThis.fetch = async (...a) => { await gate; return realFetch(...a); };
+  try {
+    ownKeys.set('11/openrouter', box.encrypt(BUILDER_OR_KEY));
+    const a = await sendSketch();
+    const b = await sendSketch();
+    const c = await sendSketch();
+    assert.deepEqual([a.status, b.status, c.status], [202, 202, 429]);
+    assert.equal(c.body.error.code, 'too_many_running');
+    release();
+    await waitDone(a.body.request.id);
+    await waitDone(b.body.request.id);
+  } finally {
+    globalThis.fetch = realFetch;
+    viewer = { id: 7, rank: 'xenos' };
+  }
+});
+
+test('an uploaded PDF downloads rather than opening in the page', async () => {
+  const pdf = Buffer.from('%PDF-1.7\n%test\n');
+  const up = await call('POST', '/ai-studio/uploads', { name: 'brief.pdf', content_type: 'application/pdf', data: pdf.toString('base64') });
+  const got = await call('GET', `/ai-studio/files/${up.body.file.id}`);
+  assert.match(got.headers['content-disposition'], /^attachment;/);
+  const img = await call('POST', '/ai-studio/uploads', { name: 'i.png', content_type: 'image/png', data: PNG.toString('base64') });
+  assert.match((await call('GET', `/ai-studio/files/${img.body.file.id}`)).headers['content-disposition'], /^inline;/);
+});