@genesislcap/ai-assistant 15.23.3 → 15.24.0

package/dist/esm/main/budget-controller.js

@@ -0,0 +1,745 @@
+import { __decorate } from "tslib";
+import { BUDGETED_VENDORS, DEFAULT_BUDGET_EXHAUSTED_MESSAGE, VENDOR_LABELS, vendorTypeOfLabel, } from '@genesislcap/foundation-ai';
+import { observable, volatile } from '@genesislcap/web-core';
+import { formatUsd } from '../utils/format-usd';
+import { logger } from '../utils/logger';
+/**
+ * Closing sentence for a wall the user cannot route around. Singular/plural
+ * variants because the banner names one vendor or several.
+ */
+const RAISE_LIMIT_ACTION = 'Contact your administrator to raise it.';
+const RAISE_LIMITS_ACTION = 'Contact your administrator to raise them.';
+/**
+ * Banner copy built from the figures a 402 actually reported, or `undefined`
+ * when the proxy sent none.
+ *
+ * `undefined` is the meaningful return, not a fallback: paired with the
+ * slice's "a re-latch without a reason keeps the existing explanation" rule, it
+ * makes a figureless driver latch leave a host-supplied reason intact rather
+ * than blanking it back to the default at the exact moment the wall is hit.
+ *
+ * Exported for the unit test that pins the formatting; not part of the element
+ * API.
+ *
+ * @internal
+ */
+export function formatBlockedReason(
+// `Partial`, so the store's `VendorBudgetFigures` satisfies it as well as a live
+// 402's payload: the banner composes from stored figures and the latch from the
+// fresh ones, and both carry the same dollars. One formatter for both means a
+// remembered wall and a just-hit one cannot word themselves differently.
+budget, vendor) {
+    if (!budget || (budget.budgetUsd == null && budget.spentUsd == null))
+        return undefined;
+    const money = (v) => (v == null ? 'an unknown amount' : formatUsd(v));
+    const figures = `(${money(budget.spentUsd)} of ${money(budget.budgetUsd)})`;
+    // No "you have $0.00 left" clause here, deliberately: "limit is reached" already
+    // says the allowance is gone, and a remainder clamped at zero CONTRADICTS the
+    // figures beside it — spend overshoots the cap on the last allowed call, so the
+    // words would read "$0.00 left" next to numbers showing $12.34 past it.
+    // A per-vendor statement carries NO action clause, because the right action is
+    // not knowable at latch time: whether "switch vendor" or "contact your
+    // administrator" is the honest advice depends on whether any OTHER vendor still
+    // has headroom, which only the composing getter can see. The vendor-agnostic
+    // form keeps its historical trailing sentence — nothing composes onto it.
+    if (!vendor)
+        return `AI usage limit reached ${figures}. Contact your administrator to raise it.`;
+    return `${vendorDisplayName(vendor)}'s AI usage limit is reached ${figures}.`;
+}
+/**
+ * Human-readable name for a vendor, falling back to its raw type.
+ *
+ * `'none'` needs no special case: it is the "no provider configured" sentinel,
+ * it is filtered out of {@link BudgetController.reachableVendors}, the latch
+ * refuses to attribute a wall to it, and {@link BudgetController.setVendorBlocked}
+ * rejects it at the boundary — so nothing can put it in front of this function.
+ * The `?? vendor` fallback is for a vendor type added to `AIProviderType` without
+ * a label, which would print the type rather than nothing.
+ */
+function vendorDisplayName(vendor) {
+    var _a;
+    return (_a = VENDOR_LABELS[vendor]) !== null && _a !== void 0 ? _a : vendor;
+}
+/**
+ * `a`, `a and b`, `a, b and c`.
+ *
+ * The general joiner is kept rather than hardcoded to a pair because the list
+ * is `BUDGETED_VENDORS`-shaped, and that list is a cross-repo contract owned by
+ * the proxy (today `anthropic` and `gemini`; `openai` is refused up front with
+ * 400 UNSUPPORTED_PROVIDER and can never be walled) — a vendor added there must
+ * not require an edit here. Its upper bound is not an assertion in a comment — it is
+ * the key count of `VENDOR_LABELS`, since every element of every list passed here
+ * comes from `blockedVendors` or `reachableVendors`, both of which hold
+ * `AIProviderType` values, and the type has five members of which `'none'` is
+ * excluded from both.
+ */
+function formatVendorList(vendors) {
+    return joinList(vendors.map(vendorDisplayName));
+}
+/**
+ * `"A"`, `"A and B"`, `"A, B and C"` — over already-rendered labels, so a caller
+ * can annotate each name (the multi-vendor banner appends each vendor's figures)
+ * without duplicating the joining rules.
+ */
+function joinList(names) {
+    var _a;
+    if (names.length <= 1)
+        return (_a = names[0]) !== null && _a !== void 0 ? _a : '';
+    return `${names.slice(0, -1).join(', ')} and ${names[names.length - 1]}`;
+}
+/**
+ * Whole-number percentage of a budget consumed, for the meter (GENC-1464).
+ *
+ * Deliberately unclamped — spend can genuinely overshoot the cap (the last
+ * allowed call may cross it), and the meter's TEXT shows the truth; only the
+ * bar clamps, at the render site. The one special case is a `$0` cap, which the
+ * platform treats as "no spend allowed" (not "unlimited"): it has no headroom
+ * by definition, so the meter reads full rather than dividing by zero.
+ *
+ * Exported for the unit test that pins the arithmetic; not element API.
+ *
+ * @internal
+ */
+export function budgetPercentOf(figures) {
+    if (figures.budgetUsd <= 0)
+        return 100;
+    return Math.round((figures.spentUsd / figures.budgetUsd) * 100);
+}
+/**
+ * The AI-spend budget: which vendors are walled, whether that locks the composer,
+ * the banner copy that explains it, and the settings-modal meter (GENC-1464).
+ *
+ * Two invariants run through the whole file:
+ *
+ * - **Walls latch; locking derives.** A wall is one-way per vendor and nothing in
+ *   here clears it, because nothing the user can do refills a budget. But
+ *   {@link BudgetController.blocked} is *derived* from "is every reachable vendor
+ *   walled", so a host swapping its registry to a vendor with headroom recovers
+ *   the composer without un-latching anything.
+ * - **The banner may only name vendors the user could actually be routed to.**
+ *   Hence {@link BudgetController.relevantBlockedVendors}, and hence the
+ *   provenance mark the sweep writes.
+ *
+ * @internal
+ */
+export class BudgetController {
+    constructor(deps) {
+        this.deps = deps;
+        /**
+         * When budget figures last arrived — from the host's
+         * {@link BudgetController.setVendorBudget} or the wall latch's own feed — as
+         * epoch ms; `null` until the first feed.
+         *
+         * ELEMENT state, not slice state, on purpose: the reducer is idempotent by
+         * value (an unchanged re-feed must not re-render the meter rows), but "when
+         * was this fetched" must move on every feed, changed figures or not — a
+         * refresh that confirms the same dollars is still a refresh. Only the
+         * toolbar label observes this, so a stamp re-renders one span, not the rows.
+         */
+        this.meterLastFedAt = null;
+        /**
+         * One warning per element for garbage fed to
+         * {@link BudgetController.setVendorBudget}. Once, not per call, because the
+         * documented feed re-runs after every turn — a host bug would otherwise repeat
+         * the same warning on every send for the life of the page.
+         *
+         * Not observable: nothing renders it.
+         */
+        this.warningIssued = false;
+    }
+    get slice() {
+        var _a;
+        return (_a = this.deps.sessionRef()) === null || _a === void 0 ? void 0 : _a.store.aiAssistant;
+    }
+    /**
+     * Whether the assistant is blocked by a backend condition and cannot send.
+     *
+     * Derived, not stored — see the class note. Unknown reachability (statuses not
+     * loaded yet, or providers that report no status) fails SAFE: any wall blocks
+     * everything, and that needs no clause of its own, because `every` on the empty
+     * set is vacuously true.
+     */
+    get blocked() {
+        const session = this.slice;
+        if (!session)
+            return false;
+        if (session.blocked)
+            return true;
+        // Byte-identical to the old stored read for every host that never adopts the
+        // per-vendor API — which is what makes this derivation non-breaking.
+        if (session.blockedVendors.length === 0)
+            return false;
+        return this.reachableVendors.every((v) => session.blockedVendors.includes(v));
+    }
+    set blocked(value) {
+        var _a;
+        (_a = this.deps.sessionRef()) === null || _a === void 0 ? void 0 : _a.actions.aiAssistant.setBlocked({ blocked: value });
+    }
+    /**
+     * The distinct vendors the registry can currently reach, from the provider
+     * statuses the element loads on connect and refreshes on every
+     * observable-registry change.
+     *
+     * This is the answer to "which vendor would the next turn use" — a question
+     * that has **no** correct answer and deliberately gets no API. The provider is
+     * resolved per turn AND per agent: `activeProviderInput` may be an async
+     * function of the turn's context, an orchestrated turn picks its agent with an
+     * LLM `classify()` call, and sub-agents resolve their own providers. Any
+     * pre-turn "peek" would therefore be a guess that is wrong precisely on the
+     * multi-agent hosts per-vendor budgets exist for.
+     *
+     * Asking instead which vendors are REACHABLE is answerable, synchronous, and
+     * free — and it is enough: the composer must stay live while any reachable
+     * vendor has headroom, and must lock when none does. It also makes
+     * vendor-switch recovery a derivation rather than a mutation.
+     */
+    get reachableVendors() {
+        var _a;
+        const seen = new Set();
+        const registry = this.deps.providerRegistry();
+        for (const entry of this.deps.providerStatuses()) {
+            const provider = (_a = entry.status) === null || _a === void 0 ? void 0 : _a.provider;
+            if (!provider || provider === 'none')
+                continue;
+            // Reachable means "can serve the next turn", and `chat()` is OPTIONAL on
+            // `AIProvider` — the shipped `ChromeProvider` and `OpenAIProvider`
+            // implement `getStatus()` only. Counting a chat-less provider here made
+            // every consumer wrong at once: it was headroom for the `blocked`
+            // derivation (so `otherVendorAvailable: false` failed to lock the
+            // composer and each send burned another doomed 402), and it was a switch
+            // target for the banner ("Switch to Chrome to keep going" toward a
+            // provider that cannot chat).
+            //
+            // The gate is CAPABILITY, not vendor identity, so a host's custom
+            // chat-capable OpenAI provider still counts — the same distinction
+            // `validate-providers.ts` already enforces by throwing. And it drops a
+            // vendor only on positive evidence: statuses normally come from
+            // `providerRegistry.listStatuses()`, whose `name` always resolves, but a
+            // host (or test) that assigns `providerStatuses` directly may have no
+            // matching registry entry, and an unresolvable name must not silently
+            // erase a vendor the status layer vouched for.
+            const registered = registry === null || registry === void 0 ? void 0 : registry.get(entry.name);
+            if (registered && typeof registered.chat !== 'function')
+                continue;
+            seen.add(provider);
+        }
+        return [...seen];
+    }
+    /** Vendors currently walled, in the order they were walled. */
+    get blockedVendors() {
+        var _a, _b;
+        return (_b = (_a = this.slice) === null || _a === void 0 ? void 0 : _a.blockedVendors) !== null && _b !== void 0 ? _b : [];
+    }
+    /** Whether this specific vendor's budget is walled, regardless of the others. */
+    isVendorBlocked(vendor) {
+        return this.blockedVendors.includes(vendor);
+    }
+    /** Whether this vendor's wall came from the sweep alone — see the slice's `sweptVendors`. */
+    isVendorSwept(vendor) {
+        var _a, _b;
+        return ((_b = (_a = this.slice) === null || _a === void 0 ? void 0 : _a.sweptVendors) !== null && _b !== void 0 ? _b : []).includes(vendor);
+    }
+    /**
+     * Wall (or release) one vendor's budget, optionally with banner copy for it.
+     *
+     * `'none'` is rejected with a warning rather than accepted: it is the "no
+     * provider configured" sentinel, not a vendor. Latching it would put the raw
+     * sentinel in the banner ("none's AI usage limit is reached") and could never be
+     * undone by derivation, because `'none'` never appears in
+     * {@link BudgetController.reachableVendors} — so `blocked` could never become
+     * derivable from it either.
+     */
+    setVendorBlocked(vendor, blocked, reason) {
+        var _a;
+        if (vendor === 'none') {
+            logger.warn("FoundationAiAssistant.setVendorBlocked: 'none' is the no-provider sentinel, not a vendor — " +
+                'ignoring. Use setBlocked() for a vendor-agnostic block.');
+            return;
+        }
+        (_a = this.deps.sessionRef()) === null || _a === void 0 ? void 0 : _a.actions.aiAssistant.setVendorBlocked({ vendor, blocked, reason });
+    }
+    warnOnce(message) {
+        if (this.warningIssued)
+            return;
+        this.warningIssued = true;
+        logger.warn(`FoundationAiAssistant.setVendorBudget: ${message}`);
+    }
+    /**
+     * Feed (or clear) one vendor's AI-spend figures for the meter. Returns `false`
+     * — warning once, not per call — for a non-budgeted vendor or a figure that is
+     * not a finite number `>= 0`, and also for "no store yet", which is a lifecycle
+     * window rather than bad input and so is deliberately not warned about.
+     *
+     * The full host-facing contract, including the intended `GET /api/budget` feed,
+     * is on the element's `setVendorBudget`.
+     */
+    setVendorBudget(vendor, figures) {
+        if (!BUDGETED_VENDORS.includes(vendor)) {
+            this.warnOnce(`'${vendor}' is not a budgeted vendor — ignoring. Only the proxy-metered vendors ` +
+                `(${BUDGETED_VENDORS.join(', ')}) can carry budget figures.`);
+            return false;
+        }
+        // Nullish, not `!== null`: an untyped host's missing lookup arrives as
+        // `undefined`, and dereferencing it here would throw at a boundary whose
+        // whole contract is to return false instead. `undefined` clears, like null.
+        if (figures != null) {
+            const validUsd = (v) => typeof v === 'number' && Number.isFinite(v) && v >= 0;
+            if (!validUsd(figures.budgetUsd) || !validUsd(figures.spentUsd)) {
+                this.warnOnce(`invalid figures for '${vendor}' — ignoring. budgetUsd and spentUsd must both be ` +
+                    `finite numbers >= 0 (got budgetUsd: ${figures.budgetUsd}, spentUsd: ${figures.spentUsd}).`);
+                return false;
+            }
+        }
+        const session = this.deps.sessionRef();
+        // No store yet (fed before the first append, or mid pop-out remount): there
+        // is nowhere to write, so say so rather than returning an accepted the
+        // caller would never retry. Not warned — this is a lifecycle window, not
+        // bad input, and the documented per-turn re-feed lands the figures as soon
+        // as the store exists.
+        if (!session)
+            return false;
+        session.actions.aiAssistant.setVendorBudget({
+            vendor: vendor,
+            // A fresh literal, never the caller's object — see the reducer, which
+            // must not adopt (and potentially freeze) state the host still owns.
+            figures: figures == null ? null : { budgetUsd: figures.budgetUsd, spentUsd: figures.spentUsd },
+        });
+        if (figures != null)
+            this.meterLastFedAt = Date.now();
+        return true;
+    }
+    /** "Updated HH:MM:SS" for the meter toolbar, or `undefined` before any feed. */
+    get updatedLabel() {
+        if (this.meterLastFedAt == null)
+            return undefined;
+        return `Updated ${new Date(this.meterLastFedAt).toLocaleTimeString()}`;
+    }
+    /**
+     * The walled vendors the user can still be routed to — i.e.
+     * {@link BudgetController.blockedVendors} narrowed to the reachable set, which
+     * is the only set the banner may name.
+     *
+     * A wall the registry can no longer reach is not news: it cannot be hit, and
+     * naming it puts a vendor in front of the user that is not theirs. The concrete
+     * failure this exists to stop: a host ships Anthropic-only, Anthropic walls, the
+     * host swaps its registry to Gemini, Gemini walls — and the banner reads "AI
+     * usage limits are reached for Anthropic and Gemini" to a user who has never
+     * had an Anthropic key. The spurious second name also flips the copy onto the
+     * plural branch, so even the closing sentence is wrong.
+     *
+     * When nothing is reachable YET (the statuses are still loading — the exact
+     * window the pre-flight and the cross-tab bus latch into), the fallback keeps
+     * every wall for LOCKING (`blocked` still derives true) but names only the
+     * vendors walled by a REFUSAL, dropping the ones the `otherVendorAvailable`
+     * sweep added. A refusal is a fact about a vendor this user just used; a sweep
+     * entry is the proxy's headroom verdict about a vendor the host may not even
+     * ship — naming it here reproduced the exact failure above from the other
+     * direction ("Gemini's AI usage limit is reached" to an Anthropic-only user),
+     * and flipped the copy onto the plural branch with it. Self-corrects when the
+     * statuses land: from then on reachability, not provenance, decides.
+     */
+    get relevantBlockedVendors() {
+        var _a, _b;
+        const walled = this.blockedVendors;
+        const reachable = this.reachableVendors;
+        if (reachable.length === 0) {
+            const swept = (_b = (_a = this.slice) === null || _a === void 0 ? void 0 : _a.sweptVendors) !== null && _b !== void 0 ? _b : [];
+            return walled.filter((v) => !swept.includes(v));
+        }
+        return walled.filter((v) => reachable.includes(v));
+    }
+    /**
+     * Whether the blocked banner has anything to say — a vendor-agnostic block, or
+     * a partial wall that the NEXT send would actually hit.
+     *
+     * Partial exhaustion is announced only while the ACTIVE vendor (the registry
+     * default the next send resolves to) is among the walled ones. A user who has
+     * switched to a vendor with headroom has already acted on the advice —
+     * keeping the banner up past that point nagged about a vendor they just left
+     * (GENC-1464 tester feedback), while switching BACK to the walled vendor
+     * brings the banner straight back. Two conservative fallbacks keep it
+     * fail-informative: while the statuses are still loading the active vendor is
+     * unknowable, so any reachable-and-walled vendor still announces; and a
+     * vendor-agnostic block announces always, exactly as before.
+     */
+    get bannerVisible() {
+        if (this.blocked)
+            return true;
+        const walled = this.relevantBlockedVendors;
+        if (walled.length === 0)
+            return false;
+        const active = this.activeVendor;
+        if (!active)
+            return true;
+        return walled.includes(active);
+    }
+    /**
+     * Whether a suggestions fetch would hit a wall.
+     *
+     * Unlike a chat turn, this one CAN be resolved exactly: both suggestion paths
+     * go to the registry **default** and never to a per-agent override
+     * (`ChatDriver.getSuggestions` calls `providerRegistry.default()`, and
+     * `OrchestratingDriver.getSuggestions` just delegates to it). So the vendor a
+     * suggestions call would use is knowable, and this is the one place in the
+     * feature where that is true.
+     */
+    get suggestionsBlocked() {
+        if (this.blocked)
+            return true;
+        const active = this.activeVendor;
+        return !!active && this.isVendorBlocked(active);
+    }
+    /**
+     * The vendor the NEXT send resolves to — the registry default's provider, as
+     * reported through `providerStatuses`. `undefined` while the statuses are
+     * still loading (or when the default reports the `'none'` sentinel), which
+     * every consumer treats conservatively.
+     */
+    get activeVendor() {
+        var _a, _b;
+        const vendor = (_b = (_a = this.deps.providerStatuses().find((e) => e.isDefault)) === null || _a === void 0 ? void 0 : _a.status) === null || _b === void 0 ? void 0 : _b.provider;
+        return vendor && vendor !== 'none' ? vendor : undefined;
+    }
+    /** Host override for the banner copy, or `null` for the element's default. */
+    get blockedReason() {
+        var _a, _b;
+        return (_b = (_a = this.slice) === null || _a === void 0 ? void 0 : _a.blockedReason) !== null && _b !== void 0 ? _b : null;
+    }
+    set blockedReason(value) {
+        var _a;
+        // Deliberately NOT `setBlocked({ blocked: this.blocked, reason })`: `blocked`
+        // is derived now, so re-latching with it would pass `false` for a partially
+        // walled session and clear every per-vendor latch as a side effect of setting
+        // a string.
+        (_a = this.deps.sessionRef()) === null || _a === void 0 ? void 0 : _a.actions.aiAssistant.setBlockedReason(value);
+    }
+    /**
+     * Block or unblock the assistant, optionally with custom banner copy.
+     *
+     * Blocking writes the **vendor-agnostic** block — what a host with one budget
+     * pot means — and does not populate {@link BudgetController.blockedVendors}.
+     * Unblocking clears the per-vendor walls as well, so a host asserting "the wall
+     * is gone" after its own pre-flight cannot be silently overruled by a driver
+     * latch it never saw.
+     */
+    setBlocked(blocked, reason) {
+        var _a;
+        (_a = this.deps.sessionRef()) === null || _a === void 0 ? void 0 : _a.actions.aiAssistant.setBlocked({ blocked, reason });
+    }
+    /**
+     * Latch the backend block off a turn outcome. The single decision point for
+     * both latch sites (the `tool-loop-end` bus subscription and `send()`'s
+     * return-value check), so the rule cannot diverge between them.
+     *
+     * Idempotent and one-way **per vendor**: it never unblocks, and it never
+     * re-writes an existing wall. That guard is load-bearing, not just an
+     * optimisation — the bus fires from the driver's `finally`, i.e. BEFORE
+     * `sendMessage()` resolves, so a host subscribed to `tool-loop-end` (what the
+     * migration guide's Option C recommends) sets its own detailed reason and the
+     * return-value latch would otherwise land a moment later and blank it.
+     *
+     * The guard being per-vendor rather than global is the whole difference. A
+     * single global "already blocked, do nothing" would swallow a second vendor's
+     * wall entirely.
+     *
+     * **Vendor attribution, in precedence order:**
+     *
+     * 1. `budget.vendorLabel` — stamped by the transport that was actually refused,
+     *    so it is the only source that cannot be a guess. A label the element does
+     *    not recognise leaves it unclaimed by any vendor.
+     * 2. `budget.vendor` — which the driver resolved from the label where it could,
+     *    and otherwise from the proxy's own `vendor` field on the 402. It is
+     *    therefore NOT simply `vendorLabel` normalised, and the two can disagree.
+     * 3. `vendorHint` — the bus detail's top-level vendor, i.e. the driver's
+     *    best guess at the turn's vendor, which may be the previous turn's vendor
+     *    or nothing at all.
+     *
+     * A wall that names no recognised vendor falls back to the vendor-agnostic
+     * block — fail-safe, and identical to the pre-per-vendor behaviour.
+     *
+     * **`otherVendorAvailable: false` is server-known truth and outranks every
+     * local guess.** Only the proxy knows whether anything else has headroom; this
+     * element can only observe which vendors the registry can reach. So when the
+     * proxy says no, every other *budgeted* vendor is walled in the same pass. That
+     * is what makes `blocked` derive true — locking the composer on the first wall
+     * rather than leaving it live against a vendor set the banner would otherwise
+     * have advised switching to.
+     *
+     * The sweep runs over `BUDGETED_VENDORS`, NOT
+     * {@link BudgetController.reachableVendors}: reachability is loaded
+     * asynchronously, so a reachability-scoped sweep dropped the verdict entirely
+     * when the wall beat the statuses home — making it effectively un-latch, since
+     * the single wall derived `blocked` only while nothing was reachable, and the
+     * composer came back to life against a budget the proxy had already said was
+     * gone. Sweeping the metered list instead makes the verdict independent of load
+     * order. Walling a vendor the registry cannot reach costs nothing: `blocked`
+     * only asks whether every REACHABLE vendor is walled, and the banner reads
+     * {@link BudgetController.relevantBlockedVendors}.
+     *
+     * One boundary remains on the sweep: it walls only vendors the proxy meters,
+     * because a vendor it does not meter has no budget there to exhaust, so "no
+     * other vendor has budget" is not a statement about it.
+     *
+     * The sweep runs last but sits OUTSIDE the per-vendor idempotence guard, and
+     * both halves of that matter. Last, so the vendor that actually refused this
+     * turn heads the wall order the multi-vendor banner reads. Outside the guard,
+     * because the verdict can arrive on a LATER 402 for a vendor that is already
+     * walled.
+     *
+     * @param reason - the turn's failure reason; anything but `'budget-exhausted'` is ignored.
+     * @param ref - the session store to write through, captured by the caller so a
+     *   teardown race cannot land the wall in a new session's store.
+     * @param budget - what the 402 reported: figures when the proxy sent any, the
+     *   refusing vendor, and its `otherVendorAvailable` verdict.
+     * @param vendorHint - the `tool-loop-end` detail's top-level vendor, used only
+     *   when the budget payload names none.
+     */
+    latchFrom(reason, ref = this.deps.sessionRef(), budget, vendorHint) {
+        var _a, _b;
+        if (reason !== 'budget-exhausted')
+            return;
+        const vendor = (_b = (_a = vendorTypeOfLabel(budget === null || budget === void 0 ? void 0 : budget.vendorLabel)) !== null && _a !== void 0 ? _a : budget === null || budget === void 0 ? void 0 : budget.vendor) !== null && _b !== void 0 ? _b : vendorHint;
+        // Meter feed (GENC-1464): snap this vendor's meter to the figures the 402
+        // itself reported, the moment the wall lands. Hosts refresh the meter on
+        // `tool-loop-end`, and a walled turn may never reach one — the user then
+        // stares at the pre-turn figures next to a banner saying the budget is gone
+        // until something else ends a loop (observed live: the meter only caught up
+        // when the user cancelled the stuck interaction). Deliberately NOT under the
+        // per-vendor idempotence guard below, for the same reason as the sweep: a
+        // later 402 for an already-walled vendor carries fresher spend. Both figures
+        // are required (`VendorBudgetFigures` is total, and half a meter is a lie),
+        // and the write goes through the captured `ref` like every other write here,
+        // so a teardown race cannot land it in a new session's store.
+        let metered = false;
+        if (vendor && vendor !== 'none' && (budget === null || budget === void 0 ? void 0 : budget.budgetUsd) != null && (budget === null || budget === void 0 ? void 0 : budget.spentUsd) != null) {
+            ref === null || ref === void 0 ? void 0 : ref.actions.aiAssistant.setVendorBudget({
+                vendor,
+                figures: { budgetUsd: budget.budgetUsd, spentUsd: budget.spentUsd },
+            });
+            this.meterLastFedAt = Date.now();
+            metered = true;
+        }
+        if (!vendor || vendor === 'none') {
+            if (!this.blocked) {
+                ref === null || ref === void 0 ? void 0 : ref.actions.aiAssistant.setBlocked({ blocked: true, reason: formatBlockedReason(budget) });
+            }
+        }
+        else if (!this.isVendorBlocked(vendor) || this.isVendorSwept(vendor)) {
+            // The idempotence guard protects a host-supplied reason from being
+            // overwritten by this latch's boilerplate — but a SWEPT wall cannot carry
+            // one (the sweep writes no reason, and any host call clears the swept
+            // mark), so upgrading it on a first-hand refusal clobbers nothing and
+            // gains the vendor its own figures plus a place in the early-window
+            // banner (see `relevantBlockedVendors`).
+            if (this.reachableVendors.length === 0) {
+                // Not fatal — `blocked` still derives to true, so the UI is correct — but
+                // the host gets no per-vendor benefit and would otherwise have no signal.
+                logger.warn(`FoundationAiAssistant: ${vendor} hit its AI budget, but no registered provider counts ` +
+                    'as reachable, so per-vendor blocking degrades to blocking everything. Two causes: no ' +
+                    'provider reports a status (implement AIProvider.getStatus()), or every provider that ' +
+                    'does is chat-less and so cannot serve a turn (implement chat() on at least one).');
+            }
+            ref === null || ref === void 0 ? void 0 : ref.actions.aiAssistant.setVendorBlocked({
+                vendor,
+                blocked: true,
+                // No reason when the meter snap above already stored these figures: the
+                // banner composes the same sentence from them, so carrying a copy here
+                // would duplicate the dollars in two places that can drift apart. It would
+                // also make this latch INDISTINGUISHABLE from host copy, which the banner
+                // must preserve verbatim — and preserving boilerplate is what forced it to
+                // repeat a sentence per walled vendor instead of folding them into one.
+                // The partial-figures case still needs copy carried here: it has no meter
+                // entry to compose from, and "an unknown amount of $50.00" is worth saying.
+                reason: metered ? undefined : formatBlockedReason(budget, vendor),
+            });
+        }
+        // Last, so the vendor that actually refused this turn heads the wall order the
+        // multi-vendor banner reads — and unconditionally, NOT under the per-vendor
+        // idempotence guard above, because the verdict can arrive on a later 402 for a
+        // vendor that is already walled.
+        if ((budget === null || budget === void 0 ? void 0 : budget.otherVendorAvailable) !== false)
+            return;
+        for (const other of BUDGETED_VENDORS) {
+            if (other === vendor || this.isVendorBlocked(other))
+                continue;
+            // No reason: the slice's "an omitted reason keeps the existing explanation"
+            // rule applies, and there are no figures for this vendor — only the proxy's
+            // word that it has nothing left. `swept: true` records exactly that
+            // provenance, so the unknown-reachability banner can decline to name it.
+            ref === null || ref === void 0 ? void 0 : ref.actions.aiAssistant.setVendorBlocked({ vendor: other, blocked: true, swept: true });
+        }
+    }
+    /**
+     * Copy shown in the blocked banner, in ascending specificity:
+     *
+     * 1. the host's `blockedReason` — a whole-banner override, unchanged;
+     * 2. copy composed from the walled vendors (their per-vendor reasons when set,
+     *    else their figures);
+     * 3. the default budget-exhaustion message.
+     *
+     * The action clause is composed HERE, not stored at latch time, because whether
+     * "switch vendor" or "contact your administrator" is honest depends on whether
+     * another reachable vendor still has headroom — which changes when the registry
+     * changes, long after the wall was latched. Telling a user to switch to a vendor
+     * that is also exhausted is worse than saying nothing.
+     *
+     * **Per-vendor copy is composed however many vendors are walled**, which is what
+     * `setVendorBlocked`'s `reason` parameter promises. It used to be honoured only
+     * on the single-vendor branch, so a host that had carefully set copy for each of
+     * its vendors watched all of it vanish the moment a second one walled.
+     */
+    get effectiveBlockedReason() {
+        var _a, _b;
+        if (this.blockedReason)
+            return this.blockedReason;
+        const walled = this.relevantBlockedVendors;
+        if (walled.length === 0)
+            return DEFAULT_BUDGET_EXHAUSTED_MESSAGE;
+        const free = this.reachableVendors.filter((v) => !walled.includes(v));
+        const action = free.length
+            ? `Switch to ${formatVendorList(free)} to keep going.`
+            : walled.length > 1
+                ? RAISE_LIMITS_ACTION
+                : RAISE_LIMIT_ACTION;
+        const reasons = (_a = this.slice) === null || _a === void 0 ? void 0 : _a.blockedVendorReasons;
+        const budgets = (_b = this.slice) === null || _b === void 0 ? void 0 : _b.vendorBudgets;
+        // The wall's own figures, read from the entry the METER renders, so the two
+        // cannot state different dollars for the same vendor. A vendor with no entry
+        // (a swept wall — the proxy's word, no figures of its own) contributes a bare
+        // name rather than a gap where numbers should be.
+        const statementFor = (v) => {
+            var _a, _b;
+            return (_b = (_a = reasons === null || reasons === void 0 ? void 0 : reasons[v]) !== null && _a !== void 0 ? _a : formatBlockedReason(budgets === null || budgets === void 0 ? void 0 : budgets[v], v)) !== null && _b !== void 0 ? _b : `${vendorDisplayName(v)}'s AI usage limit is reached.`;
+        };
+        const nameWithFigures = (v) => {
+            const figures = budgets === null || budgets === void 0 ? void 0 : budgets[v];
+            return figures
+                ? `${vendorDisplayName(v)} (${formatUsd(figures.spentUsd)} of ${formatUsd(figures.budgetUsd)})`
+                : vendorDisplayName(v);
+        };
+        if (walled.length === 1)
+            return `${statementFor(walled[0])} ${action}`;
+        // Several walled vendors: fold them into ONE sentence carrying each vendor's
+        // figures, rather than repeating "X's AI usage limit is reached (…)." per
+        // vendor — the same clause twice reads like a stutter, and the second copy of
+        // the boilerplate adds nothing the first did not already say.
+        //
+        // Host copy is not foldable: `setVendorBlocked` promises it survives verbatim,
+        // and it cannot be rewritten into a list item. So the moment any walled vendor
+        // carries some, the branch below lists one statement per vendor instead —
+        // falling back to composed copy for the ones that have none, so the sentence
+        // set stays complete rather than silently naming a subset.
+        if (!walled.some((v) => reasons === null || reasons === void 0 ? void 0 : reasons[v])) {
+            return `AI usage limits are reached for ${joinList(walled.map(nameWithFigures))}. ${action}`;
+        }
+        return `${walled.map(statementFor).join(' ')} ${action}`;
+    }
+    /**
+     * Copy the driver writes into the TRANSCRIPT when a turn hits the budget wall,
+     * or `undefined` to let the driver compose it per wall.
+     *
+     * A set `blockedReason` still wins — a white-labelled host must not read its own
+     * explanation in the banner and shipped copy directly below it.
+     *
+     * `undefined` (the usual case) is NOT the old `DEFAULT_BUDGET_EXHAUSTED_MESSAGE`
+     * fallback: it hands composition to the driver, which builds the bubble from
+     * EACH wall's own 402 — naming the exhausted vendor and advising a switch only
+     * when that refusal's `otherVendorAvailable` positively vouched for headroom
+     * elsewhere. That is immune to the staleness this getter used to guard against
+     * by freezing the copy: construction-time advice could outlive its truth
+     * (`getOrCreateDriver` re-runs on an agents swap and would have baked the
+     * sentence into every later bubble), but per-wall advice is derived from the
+     * refusal it annotates and dies with the turn. Forcing the default here was also
+     * what made the driver's composed bubble unreachable in every real mount — the
+     * banner advised switching while the bubble under it never did (the GENC-1464
+     * tester finding, root cause).
+     */
+    get transcriptMessage() {
+        var _a;
+        return (_a = this.blockedReason) !== null && _a !== void 0 ? _a : undefined;
+    }
+    /**
+     * Built-in per-vendor budget meter (GENC-1464) — the money sibling of the
+     * settings modal's context-usage gate, with the same shape: not configured off,
+     * and there is data to show. "Data" here is "at least one vendor has figures",
+     * so a host that feeds nothing (or only unlimited vendors) gets no meter and no
+     * empty container.
+     *
+     * Answered from the RAW slice state rather than from
+     * {@link BudgetController.settingsRows}, whose `.length` would format every row
+     * (a `formatUsd` pair and a `budgetPercentOf` each) only to ask whether any
+     * exist. This is read several times per render pass — the getter, the section
+     * gate, the template's `when` — so it stays as cheap as the context sibling's
+     * `!= null`.
+     */
+    get settingsUsageVisible() {
+        var _a, _b;
+        const budgets = (_a = this.slice) === null || _a === void 0 ? void 0 : _a.vendorBudgets;
+        return (((_b = this.deps.chatConfig().ui) === null || _b === void 0 ? void 0 : _b.showBudgetUsage) !== false &&
+            budgets != null &&
+            // Keyed off BUDGETED_VENDORS, exactly as the rows are, so a key outside
+            // that list could never surface a meter with no row to show.
+            BUDGETED_VENDORS.some((vendor) => budgets[vendor] != null));
+    }
+    /**
+     * The meter's rows — one per vendor that currently has figures, in
+     * `BUDGETED_VENDORS` order (the proxy's own metered list) so the rendering is
+     * stable however the host ordered its feed calls. Pre-formatted; see
+     * {@link SettingsBudgetRow} for why the text is unclamped while the bar is.
+     */
+    get settingsRows() {
+        var _a;
+        const budgets = (_a = this.slice) === null || _a === void 0 ? void 0 : _a.vendorBudgets;
+        if (!budgets)
+            return [];
+        const rows = [];
+        for (const vendor of BUDGETED_VENDORS) {
+            const figures = budgets[vendor];
+            if (!figures)
+                continue;
+            const percent = budgetPercentOf(figures);
+            rows.push({
+                vendor,
+                label: vendorDisplayName(vendor),
+                figures: `${formatUsd(figures.spentUsd)} / ${formatUsd(figures.budgetUsd)} (${percent}%)`,
+                // The same clamp the context indicator applies to its bar. No lower
+                // clamp needed: the boundary refuses negative figures.
+                barValue: Math.min(100, percent),
+            });
+        }
+        return rows;
+    }
+}
+__decorate([
+    observable
+], BudgetController.prototype, "meterLastFedAt", void 0);
+__decorate([
+    volatile
+], BudgetController.prototype, "blocked", null);
+__decorate([
+    volatile
+], BudgetController.prototype, "reachableVendors", null);
+__decorate([
+    volatile
+], BudgetController.prototype, "updatedLabel", null);
+__decorate([
+    volatile
+], BudgetController.prototype, "relevantBlockedVendors", null);
+__decorate([
+    volatile
+], BudgetController.prototype, "bannerVisible", null);
+__decorate([
+    volatile
+], BudgetController.prototype, "suggestionsBlocked", null);
+__decorate([
+    volatile
+], BudgetController.prototype, "activeVendor", null);
+__decorate([
+    volatile
+], BudgetController.prototype, "effectiveBlockedReason", null);
+__decorate([
+    volatile
+], BudgetController.prototype, "settingsUsageVisible", null);
+__decorate([
+    volatile
+], BudgetController.prototype, "settingsRows", null);