@genesislcap/ai-assistant 15.6.2 → 15.7.0

package/dist/esm/main/main.styles.js

@@ -435,6 +435,7 @@ const baseStyles = css `
   .attachment-chips,
   .agent-picker-panel,
   .session-menu-panel,
+  .blocked-banner,
   chat-suggestions {
     box-sizing: border-box;
     width: 100%;
@@ -458,6 +459,13 @@ const baseStyles = css `
       border-radius: 12px;
     }
 
+    /* The banner joins the same floating-card family, but keeps its own
+       warning-toned border — overriding it with the neutral stroke would erase
+       the one colour signal it carries. Only the radius needs to match. */
+    .blocked-banner.is-visible {
+      border-radius: 12px;
+    }
+
     /* chat-suggestions paints its background on an inner element, so clip it to the
        rounded corners — otherwise that square inner background bleeds past the radius
        and the corners read as square with the border hidden behind them. */
@@ -611,6 +619,45 @@ const baseStyles = css `
     font-size: 0.9em;
   }
 
+  /* Backend-blocked banner (GENC-1464) — sits between the transcript and the
+     disabled composer. Flat and quiet rather than an error toast: the condition
+     is standing, not a momentary failure, so it should read as part of the
+     chrome the user is now working within. */
+
+  /* The container is ALWAYS in the DOM so the live region is registered before the
+     text arrives (see main.template.ts) — so the bare selector carries only layout,
+     and an unblocked banner is an empty, zero-height, invisible box. Everything
+     that would make it visible hangs off .is-visible. */
+  .blocked-banner {
+    display: flex;
+    align-items: center;
+    gap: calc(var(--design-unit) * 2px);
+  }
+
+  .blocked-banner.is-visible {
+    /* Block axis only. The inline-axis margin is owned by the composer width group
+       above (margin-inline: auto), which centres the banner on the same column as
+       the input row — an inline margin here would fight it. */
+    margin-block: calc(var(--design-unit) * 1px);
+    padding: calc(var(--design-unit) * 2px) calc(var(--design-unit) * 3px);
+    border: calc(var(--stroke-width) * 1px) solid var(--warning-color);
+    border-radius: calc(var(--control-corner-radius) * 1px);
+    background: var(--neutral-layer-2);
+    color: var(--neutral-foreground-rest);
+  }
+
+  /* Partial exhaustion: at least one vendor is walled but the composer is still
+     live, so the banner is advice rather than a wall. Softened to match — same
+     layout, same part, lower alarm. */
+  .blocked-banner.is-partial {
+    border-color: var(--neutral-stroke-rest);
+  }
+
+  .blocked-banner-text {
+    font-size: 0.9em;
+    line-height: 1.4;
+  }
+
   .chat-input {
     flex: 1;
     resize: none;

package/dist/esm/main/main.styles.test.js

@@ -0,0 +1,86 @@
+var _a, _b, _c;
+import { assert, createLogicSuite } from '@genesislcap/foundation-testing';
+import { styles } from './main.styles';
+// CSS is not otherwise unit-tested in this package, so this covers the two
+// properties of the BLOCKED BANNER that are cheap to assert from the generated
+// text and that a reviewer had to catch by eye:
+//
+//   1. Design-system tokens are consumed UNFALLBACKED, as every other rule in the
+//      file does. A `var(--token, fallback)` here is dead code at best — both
+//      tokens below ship with defaults — and actively wrong at worst: the blocked
+//      banner's old `var(--neutral-layer-2, transparent)` would, if it ever fired,
+//      have produced a banner with no surface at all.
+//   2. The blocked banner's visual treatment hangs off `.is-visible`, not the bare
+//      class, because the container stays mounted while unblocked so that its
+//      `role="status"` region is registered before the text arrives (see
+//      main.template.ts). Collapsing the empty container would undo that.
+//
+// Scope: the banner's own rules, and nothing else. Both negative assertions were
+// written for one component, but an earlier version grepped the WHOLE stylesheet
+// — quietly turning a banner test into a global style policy nobody agreed to, so
+// any future rule anywhere in an 800-line sheet that legitimately wanted a
+// fallback on either token would have failed a test named after the banner.
+const suite = createLogicSuite('main.styles blocked-banner rules');
+/**
+ * The generated stylesheet text. `css` composes nested `ElementStyles` (this file
+ * builds the sheet from several partials), so flatten recursively rather than
+ * only reading the top level — a shallow read silently returns almost nothing,
+ * which would make every `assert.not.ok` below pass vacuously. The first test
+ * guards exactly that.
+ */
+const flatten = (value) => {
+    if (typeof value === 'string')
+        return value;
+    if (Array.isArray(value))
+        return value.map(flatten).join('\n');
+    const nested = value === null || value === void 0 ? void 0 : value.styles;
+    return nested ? flatten(nested) : '';
+};
+const cssText = flatten(styles);
+/**
+ * Every declaration block whose selector mentions `.blocked-banner`, joined.
+ *
+ * Deliberately crude — one regex over the generated text, no CSS parser — but
+ * enough to keep these assertions about the banner rather than about the whole
+ * sheet, which was the only thing wrong with them. It matches
+ * `<selector> { <declarations> }` for any selector containing `.blocked-banner`,
+ * so it picks up the bare class, the `.is-visible` / `.is-partial` modifiers, the
+ * shared composer-width group and the copy inside the container query alike.
+ */
+const bannerRules = ((_a = cssText.match(/[^{}]*\.blocked-banner[^{}]*\{[^}]*\}/g)) !== null && _a !== void 0 ? _a : []).join('\n');
+/** Declarations of the bare-class rule — the one that applies while empty. */
+const emptyStateRule = (_c = (_b = cssText.match(/[\s{}](\.blocked-banner)\s*\{([^}]*)\}/)) === null || _b === void 0 ? void 0 : _b[2]) !== null && _c !== void 0 ? _c : '';
+suite('the banner rules were extracted as text (guards the assertions below)', () => {
+    assert.ok(cssText.includes('.blocked-banner'), 'the banner rules are in the sheet');
+    assert.ok(bannerRules.includes('.is-visible'), 'the extraction found the modifier rules');
+    assert.ok(emptyStateRule.length > 0, 'and isolated the bare-class rule');
+});
+suite('the banner consumes design-system tokens without dead fallbacks', () => {
+    assert.not.ok(bannerRules.includes('var(--neutral-layer-2,'), '--neutral-layer-2 has a DS default and is used unfallbacked everywhere else here');
+    assert.not.ok(bannerRules.includes('var(--warning-color,'), '--warning-color has a DS default and is used unfallbacked by toast/badge styles');
+});
+suite('the blocked banner keeps its unblocked container visually inert', () => {
+    // `::part(blocked-banner)` matches at all times, so the empty state must set
+    // nothing that reserves space — and must not remove the container from the
+    // accessibility tree, which is where the `role="status"` region is registered.
+    //
+    // Asserted against the bare-class rule's own declarations rather than by
+    // grepping for a `:empty` selector nobody wrote: this catches the mistake as it
+    // would actually be made — a padding or border creeping onto the always-present
+    // container — instead of one specific spelling of it.
+    //
+    // `margin-block` rather than `margin`: the shared composer-width group sets
+    // `margin-inline: auto` on the banner along with the rest of the composer
+    // column, which centres it and reserves nothing.
+    assert.ok(cssText.includes('.blocked-banner.is-visible'), 'visuals hang off is-visible');
+    for (const property of ['display: none', 'padding', 'border', 'background', 'margin-block']) {
+        assert.not.ok(emptyStateRule.includes(property), `the always-present container must not set ${property} — that is .is-visible's job`);
+    }
+});
+suite('partial exhaustion has its own modifier, layered on the visible state', () => {
+    // `.is-visible` carries the layout and surface for BOTH states; `.is-partial`
+    // only softens it. Additive, never a replacement — so host CSS keyed on the
+    // visible state needs to know nothing about partial exhaustion.
+    assert.ok(cssText.includes('.blocked-banner.is-partial'), 'the partial modifier exists');
+});
+suite.run();

package/dist/esm/main/main.template.js

@@ -228,6 +228,109 @@ const restoringTemplate = html `
     <span class="compacting-caption">Restoring…</span>
   </div>
 `;
+/**
+ * Class list for the banner below, joined rather than interpolated so an
+ * inapplicable modifier contributes nothing. Two interpolations directly in the
+ * attribute emitted `class="blocked-banner  "` in the common (unblocked) case —
+ * harmless to the browser, but it shows up in every DOM snapshot and every
+ * innerHTML assertion a host writes against this element.
+ *
+ * The two modifiers name what they actually gate, which is why neither is
+ * `is-blocked`: `is-visible` means the banner has something to say, and that
+ * includes PARTIAL exhaustion — one vendor walled, composer still live, `blocked`
+ * false. `is-partial` then softens the treatment for exactly that case. Naming
+ * the first after `blocked` read as a contradiction beside the second, and made
+ * the styles say `.blocked-banner.is-blocked` to mean "visible".
+ *
+ * Exported for the unit test that pins the attribute; not part of the element
+ * API.
+ *
+ * @internal
+ */
+export const blockedBannerClasses = (x) => [
+    'blocked-banner',
+    x.bannerVisible ? 'is-visible' : '',
+    x.bannerVisible && !x.blocked ? 'is-partial' : '',
+]
+    .filter(Boolean)
+    .join(' ');
+/**
+ * Id of the blocked banner, referenced by the composer controls'
+ * `aria-describedby`. Shadow-DOM-scoped, so a fixed string cannot collide with
+ * the host page — and IDREF resolution is same-root, which is exactly where both
+ * ends of this reference live.
+ *
+ * @internal
+ */
+export const BLOCKED_BANNER_ID = 'blocked-banner';
+/**
+ * `aria-describedby` for the composer's textarea, send button and attach button:
+ * the banner's id whenever the banner has something to say, otherwise `null` (so
+ * the attribute is omitted rather than emitted empty).
+ *
+ * Keyed on `bannerVisible`, NOT on `blocked`, and that is the point. The
+ * PARTIAL state — some vendor walled, composer still live — is the state this
+ * feature exists to create, and it was the one state with no accessible
+ * explanation at all: `aria-disabled` and `aria-label` bind only on `blocked`, and
+ * a live composer keeps the host's own placeholder, so a screen-reader user
+ * arriving at the textarea heard "Type a message" with no hint that the next turn
+ * might be refused. The banner's `role="status"` announces the text when it
+ * CHANGES; this is what makes the same explanation reachable afterwards, on
+ * demand, from the control it is about.
+ *
+ * Applied in the fully blocked state too, where it is additive: the `aria-label`
+ * there states the reason as the control's name, and this restates it as its
+ * description for the send/attach buttons, which carry neither.
+ *
+ * Exported for the unit test that pins it; not part of the element API.
+ *
+ * @internal
+ */
+export const composerDescribedBy = (x) => x.bannerVisible ? BLOCKED_BANNER_ID : null;
+/**
+ * Persistent banner shown above the composer while a backend condition blocks
+ * the assistant — today an exhausted AI budget (GENC-1464).
+ *
+ * Deliberately NOT a transcript replacement like `compactingTemplate` /
+ * `restoringTemplate`: those cover a transient rewrite where the history is
+ * mid-flight and unsafe to show, whereas a block is indefinite. Hiding the
+ * conversation behind it would strand the user's work behind a wall they
+ * cannot clear, so the banner sits alongside a fully readable transcript.
+ *
+ * `role="status"` (not `alert`) — it is a standing condition the user can also
+ * see in the disabled composer, not an interruption.
+ *
+ * **Rendered unconditionally, empty when unblocked.** This is an accessibility
+ * requirement, not a stylistic choice: `role="status"` announces MUTATIONS to a
+ * region the assistive technology was already observing. A region INSERTED into
+ * the DOM already carrying its text is widely missed across NVDA, JAWS and
+ * VoiceOver — and it is the only announcement a screen-reader user gets, since
+ * the textarea simultaneously flips to `disabled`, which drops it out of the tab
+ * order and means the swapped "AI usage limit reached" placeholder is never
+ * voiced (`maybeAutoFocusChatInput` also no-ops against a disabled control). So
+ * the region stays mounted and only its TEXT changes.
+ *
+ * It is deliberately **not** collapsed with `display: none` when unblocked —
+ * that would drop it out of the accessibility tree and make the flip an
+ * insertion again, defeating the point. Instead the visual treatment (padding,
+ * border, background) hangs off the `is-visible` class, so the empty container
+ * occupies no space while remaining a live, registered region.
+ *
+ * It carries {@link BLOCKED_BANNER_ID} so the composer controls can point
+ * `aria-describedby` at it — see {@link composerDescribedBy}.
+ */
+const blockedBannerTemplate = html `
+  <div
+    id="${BLOCKED_BANNER_ID}"
+    class="${blockedBannerClasses}"
+    part="blocked-banner"
+    role="status"
+  >
+    ${when((x) => x.bannerVisible, html `
+        <span class="blocked-banner-text">${(x) => x.effectiveBlockedReason}</span>
+      `)}
+  </div>
+`;
 // ─── Public factory ───────────────────────────────────────────────────────────
 /** @internal */
 export const FoundationAiAssistantTemplate = (designSystemPrefix) => {
@@ -337,13 +440,18 @@ ${(tc) => { var _a; return (((_a = tc.foldPath) === null || _a === void 0 ? void
         `)}
     </${buttonTag}>
   `;
+    // The attach button shares the textarea's disable gate. Attaching a file that
+    // can never be sent is a dead end — and `blocked`, `compacting` and `restoring`
+    // were all missing from it, so files could be attached during a compaction or
+    // against an exhausted budget and then never sent.
     const attachButtonTemplate = html `
     <${buttonTag}
       class="attach-button"
       part="attach-button"
       appearance="stealth"
       title=${(x) => { var _a; return `Attach file (${(_a = x.chatConfig.ui) === null || _a === void 0 ? void 0 : _a.acceptedFiles})`; }}
-      ?disabled=${(x) => x.busy}
+      ?disabled=${(x) => x.busy || x.compacting || x.restoring || x.blocked}
+      aria-describedby=${composerDescribedBy}
       @click=${(x) => x.triggerFileInput()}
     ><${iconTag} name="paperclip"></${iconTag}></${buttonTag}>
   `;
@@ -548,13 +656,18 @@ ${(tc) => { var _a; return (((_a = tc.foldPath) === null || _a === void 0 ? void
               `)}
           </div>
         `)}
-      ${when((x) => { var _a; return ((_a = x.chatConfig.suggestions) === null || _a === void 0 ? void 0 : _a.behavior) !== 'never'; }, html `
+      ${when((x) => { var _a; return ((_a = x.chatConfig.suggestions) === null || _a === void 0 ? void 0 : _a.behavior) !== 'never' && !x.suggestionsBlocked; }, html `
           <chat-suggestions
             :state="${(x) => x.suggestionsState}"
             @suggestion-clicked="${(x, c) => x.handleSuggestionClick(c.event.detail)}"
           ></chat-suggestions>
         `)}
       ${when((x) => x.agentPickerEnabled && x.agentPickerOpen, agentPickerPanelTemplate)}${when((x) => x.sessionMenuOpen && !x.busy, sessionMenuPanelTemplate)}
+      ${
+    /* Rendered above the composer and independently of it — a host that hides the
+       built-in composer (`composerHiddenByConfig`) still needs to be told why its own
+       input is being refused. */ ''}
+      ${blockedBannerTemplate}
       ${when((x) => !x.composerHiddenByConfig &&
         !(x.busy && x.effectiveChatInputDuringExecution === 'hidden'), html `
           ${when((x) => x.isComposerResizable, html `
@@ -579,7 +692,10 @@ ${(tc) => { var _a; return (((_a = tc.foldPath) === null || _a === void 0 ? void
               style=${(x) => x.composerHeightStyle}
               placeholder=${(x) => x.effectivePlaceholder}
               :value=${(x) => x.inputValue}
-              ?disabled=${(x) => x.busy || x.compacting || x.restoring}
+              ?disabled=${(x) => x.busy || x.compacting || x.restoring || x.blocked}
+              aria-disabled=${(x) => (x.blocked ? 'true' : null)}
+              aria-label=${(x) => (x.blocked ? x.effectiveBlockedReason : null)}
+              aria-describedby=${composerDescribedBy}
               @input=${(x, c) => (x.inputValue = c.event.target.value)}
               @keydown=${(x, c) => {
         if (c.event.key === 'Enter' &&
@@ -610,7 +726,8 @@ ${(tc) => { var _a; return (((_a = tc.foldPath) === null || _a === void 0 ? void
               <${buttonTag}
                 class="send-button"
                 part="send-button"
-                ?disabled=${(x) => x.busy || x.compacting || x.restoring || (!x.inputValue.trim() && !x.attachments.length)}
+                ?disabled=${(x) => x.busy || x.compacting || x.restoring || x.blocked || (!x.inputValue.trim() && !x.attachments.length)}
+                aria-describedby=${composerDescribedBy}
                 @click=${(x) => x.handleSendClick()}
               >Send</${buttonTag}>
             </div>

package/dist/esm/state/ai-assistant-slice.js

@@ -29,6 +29,11 @@ export function createDefaultSessionState() {
         sessionMenuOpen: false,
         compacting: false,
         restoring: false,
+        blocked: false,
+        blockedReason: null,
+        blockedVendors: [],
+        sweptVendors: [],
+        blockedVendorReasons: {},
         inputValue: '',
         liveSubAgentTrace: [],
         liveSubAgentName: null,
@@ -106,6 +111,98 @@ export const aiAssistantSlice = createSlice({
         setRestoring(state, action) {
             state.restoring = action.payload;
         },
+        /**
+         * Latch (or release) the backend-blocked state.
+         *
+         * `reason` is only meaningful while blocking, and it distinguishes three
+         * cases rather than two:
+         *
+         * - **omitted** — a re-latch that leaves the existing explanation intact.
+         *   Load-bearing: the block has two writers (the host, and the driver's
+         *   automatic latch), and the driver's write lands AFTER a bus-subscribed
+         *   host has already set its own detailed copy. Treating "no reason" as
+         *   "clear the reason" made that sequence replace the host's figures with
+         *   generic copy every time, deterministically.
+         * - **a string** — replaces the explanation.
+         * - **`null`** — explicitly clears the explanation while staying blocked;
+         *   the banner falls back to the element's default copy.
+         *
+         * Unblocking always clears it, so a stale explanation can never outlive the
+         * condition it described.
+         *
+         * Unblocking **also clears every per-vendor latch**, and that is the single
+         * rule that keeps per-vendor budgets non-breaking. A host asserting "the wall
+         * is gone" (the documented pre-flight, migration-GENC-1464 Option B) must not be
+         * silently overruled by a driver latch it cannot see; without this, the same
+         * `setBlocked(false)` that used to unblock would leave the composer locked.
+         */
+        setBlocked(state, action) {
+            state.blocked = action.payload.blocked;
+            if (!action.payload.blocked) {
+                state.blockedReason = null;
+                state.blockedVendors = [];
+                state.sweptVendors = [];
+                state.blockedVendorReasons = {};
+            }
+            else if (action.payload.reason !== undefined) {
+                state.blockedReason = action.payload.reason;
+            }
+        },
+        /**
+         * Write the banner explanation without touching the flag.
+         *
+         * Separate from {@link setBlocked} rather than expressed as
+         * `setBlocked({ blocked: current, reason })`, because the element's public
+         * `blocked` is now DERIVED: re-latching with the derived value would pass
+         * `false` for a partially-walled session and so clear every per-vendor latch
+         * as a side effect of setting a string.
+         */
+        setBlockedReason(state, action) {
+            state.blockedReason = action.payload;
+        },
+        /**
+         * Wall (or release) a single vendor's budget.
+         *
+         * The `reason` trichotomy mirrors {@link setBlocked}'s exactly, and for the
+         * same reason: the same two-writer race (the driver's latch landing after a
+         * bus-subscribed host has written its own copy) applies per vendor.
+         *
+         * Adding an already-walled vendor is idempotent — the array is a set with an
+         * order, so the vendor keeps the position it was first walled at.
+         */
+        setVendorBlocked(state, action) {
+            const { vendor, blocked, reason, swept } = action.payload;
+            const index = state.blockedVendors.indexOf(vendor);
+            const sweptIndex = state.sweptVendors.indexOf(vendor);
+            if (blocked) {
+                if (index < 0)
+                    state.blockedVendors.push(vendor);
+                if (swept) {
+                    // Provenance is FIRST-writer-wins: marking swept only records a wall
+                    // this call itself created. The sweep site already skips walled
+                    // vendors, so this guard is belt-and-braces against a future caller
+                    // downgrading a refused wall to "just the proxy's word".
+                    if (index < 0 && sweptIndex < 0)
+                        state.sweptVendors.push(vendor);
+                }
+                else if (sweptIndex >= 0) {
+                    state.sweptVendors.splice(sweptIndex, 1);
+                }
+                if (reason === null) {
+                    delete state.blockedVendorReasons[vendor];
+                }
+                else if (reason !== undefined) {
+                    state.blockedVendorReasons[vendor] = reason;
+                }
+            }
+            else {
+                if (index >= 0)
+                    state.blockedVendors.splice(index, 1);
+                if (sweptIndex >= 0)
+                    state.sweptVendors.splice(sweptIndex, 1);
+                delete state.blockedVendorReasons[vendor];
+            }
+        },
         setInputValue(state, action) {
             state.inputValue = action.payload;
         },
@@ -147,21 +244,62 @@ export const aiAssistantSlice = createSlice({
         },
         /**
          * Wipe the session back to a fresh default — the "Clear" / "New chat" action.
-         * The user's **display preferences** (tool-call / thinking / narration / agent-switch
-         * visibility + animations) are deliberately preserved across Clear: they are settings,
-         * not conversation state, and are persisted independently of the snapshot (GENC-1351).
-         * Without this they'd flip to their all-off defaults in the live store on Clear, since
-         * `clearSession` re-applies no baseline and the idempotent setters suppress a re-apply.
+         *
+         * Three categories survive, for three different reasons — keep them distinct:
+         *
+         * 1. The user's **display preferences** (tool-call / thinking / narration /
+         *    agent-switch visibility + animations). They are settings, not
+         *    conversation state, and are persisted independently of the snapshot
+         *    (GENC-1351). Without this they'd flip to their all-off defaults in the
+         *    live store on Clear, since `clearSession` re-applies no baseline and the
+         *    idempotent setters suppress a re-apply.
+         * 2. The **backend block** (`blocked` / `blockedReason`, and the per-vendor
+         *    latches beside them). Not a preference at
+         *    all — a standing backend condition that Clear cannot change. It is here
+         *    because starting a new chat does not refill the AI budget, so clearing
+         *    it would hand the user a working-looking composer that fails on the very
+         *    next send.
+         * 3. The **provider statuses**. They describe the REGISTRY, not the
+         *    conversation — provider registration is static for the store's lifetime
+         *    and this snapshot is refreshed from the registry, never from a turn. They
+         *    are session state only because that is where the element's store lives.
+         *
+         *    Dropping them on Clear is not cosmetic: the element derives `blocked`
+         *    from "every REACHABLE vendor is walled", and an empty reachable set fails
+         *    safe to "blocked". So wiping the statuses while keeping the per-vendor
+         *    latches (category 2) escalated one walled vendor out of two into a fully
+         *    locked composer, and nothing reloads them — `loadProviderStatuses()` runs
+         *    only on connect/session-switch and from the observable-registry
+         *    subscription, so a host with a static registry stayed locked until a
+         *    remount. Preserving is the fix rather than re-loading after reset,
+         *    because the reload is async: it would still flash a fully locked composer
+         *    for a turn of the event loop, and would break a host whose registry is
+         *    immutable (nothing to re-listen to) or whose `listStatuses()` rejects.
+         *
+         * Stated separately so a future contributor deciding what belongs in this
+         * list does not "tidy" the block out on the grounds that it is not a display
+         * preference.
          */
         resetSession(state) {
-            const preservedPrefs = {
+            // `satisfies` gives this literal excess-property checking and per-field type
+            // checking, neither of which `Object.assign` provides — its source parameter
+            // is structurally permissive, so a typo (`blockedResaon`) would compile
+            // clean, silently stop preserving the real key, AND add a junk key to the
+            // draft that then leaks into serialised state.
+            const preservedAcrossReset = {
                 showToolCalls: state.showToolCalls,
                 showThinkingSteps: state.showThinkingSteps,
                 showNarration: state.showNarration,
                 showAgentSwitchIndicator: state.showAgentSwitchIndicator,
                 enabledAnimations: state.enabledAnimations,
+                providerStatuses: state.providerStatuses,
+                blocked: state.blocked,
+                blockedReason: state.blockedReason,
+                blockedVendors: state.blockedVendors,
+                sweptVendors: state.sweptVendors,
+                blockedVendorReasons: state.blockedVendorReasons,
             };
-            Object.assign(state, createDefaultSessionState(), preservedPrefs);
+            Object.assign(state, createDefaultSessionState(), preservedAcrossReset);
         },
     },
     selectors: {},

package/dist/esm/state/ai-assistant-slice.test.js

@@ -1,7 +1,7 @@
 import { assert, createLogicSuite } from '@genesislcap/foundation-testing';
 import { aiAssistantSlice, createDefaultSessionState, } from './ai-assistant-slice';
 // GENC-1351 §5.6 / Phase 1: the new bulk loadSession + resetSession reducers.
-const { loadSession, resetSession, setMessages, setState, setSessionMenuOpen, setShowToolCalls, setShowThinkingSteps, setShowNarration, setShowAgentSwitchIndicator, setEnabledAnimations, } = aiAssistantSlice.actions;
+const { loadSession, resetSession, setBlocked, setBlockedReason, setVendorBlocked, setInputValue, setMessages, setState, setSessionMenuOpen, setShowToolCalls, setShowThinkingSteps, setShowNarration, setShowAgentSwitchIndicator, setEnabledAnimations, } = aiAssistantSlice.actions;
 const reduce = aiAssistantSlice.reducer;
 const Suite = createLogicSuite('ai-assistant-slice-persistence');
 Suite('loadSession hydrates the restorable fields and forces idle', () => {
@@ -89,4 +89,141 @@ Suite('setSessionMenuOpen toggles the lifecycle-menu flag; resetSession clears i
     const cleared = reduce(state, resetSession());
     assert.is(cleared.sessionMenuOpen, false);
 });
+// GENC-1464: the backend-blocked latch (exhausted AI budget).
+Suite('setBlocked latches the flag and its reason', () => {
+    let state = createDefaultSessionState();
+    assert.is(state.blocked, false);
+    assert.is(state.blockedReason, null);
+    state = reduce(state, setBlocked({ blocked: true }));
+    assert.is(state.blocked, true);
+    assert.is(state.blockedReason, null, 'no reason given → null, so the element uses its default');
+    state = reduce(state, setBlocked({ blocked: true, reason: 'Budget exhausted — contact billing' }));
+    assert.is(state.blockedReason, 'Budget exhausted — contact billing');
+});
+Suite('unblocking always clears the reason', () => {
+    // A stale explanation must never outlive the condition it described.
+    let state = reduce(createDefaultSessionState(), setBlocked({ blocked: true, reason: 'gone' }));
+    state = reduce(state, setBlocked({ blocked: false }));
+    assert.is(state.blocked, false);
+    assert.is(state.blockedReason, null);
+});
+Suite('resetSession preserves the block — "New chat" does not refill the budget', () => {
+    // Deliberately unlike sessionMenuOpen/compacting above: this is a backend
+    // condition, not conversation state, so Clear must not hand the user a
+    // working-looking composer that fails on the next send.
+    let state = reduce(createDefaultSessionState(), setBlocked({ blocked: true, reason: 'no funds' }));
+    state = reduce(state, setMessages([{ role: 'user', content: 'x' }]));
+    const cleared = reduce(state, resetSession());
+    assert.is(cleared.messages.length, 0, 'the transcript is still cleared');
+    assert.is(cleared.blocked, true, 'the block survives Clear');
+    assert.is(cleared.blockedReason, 'no funds', 'and so does its reason');
+});
+Suite('re-latching without a reason preserves the host explanation', () => {
+    // The race this fixes is deterministic, not theoretical: `tool-loop-end` is
+    // published from the driver's `finally`, i.e. BEFORE `sendMessage()` resolves.
+    // So a bus-subscribed host (what the migration guide's Option C recommends)
+    // writes its detailed copy first, and the element's own latch — which may have
+    // no figures to offer — lands a moment later. Treating an OMITTED reason as
+    // "clear it" replaced the host's copy with generic copy every single time.
+    let state = reduce(createDefaultSessionState(), setBlocked({ blocked: true, reason: 'contact ops@acme.com' }));
+    state = reduce(state, setBlocked({ blocked: true }));
+    assert.is(state.blocked, true);
+    assert.is(state.blockedReason, 'contact ops@acme.com', 'the host copy survives the re-latch');
+});
+Suite('reason:null clears the explanation while staying blocked', () => {
+    // The explicit escape hatch the omitted case gives up: `null` still clears.
+    let state = reduce(createDefaultSessionState(), setBlocked({ blocked: true, reason: 'stale copy' }));
+    state = reduce(state, setBlocked({ blocked: true, reason: null }));
+    assert.is(state.blocked, true);
+    assert.is(state.blockedReason, null, 'the banner falls back to the default copy');
+});
+Suite('resetSession still resets everything NOT on the preserved list', () => {
+    // Pins the boundary from the other side, so the preserved list cannot quietly
+    // grow: these are conversation/UI state and Clear must wipe them.
+    let state = reduce(createDefaultSessionState(), setBlocked({ blocked: true, reason: 'r' }));
+    state = reduce(state, setSessionMenuOpen(true));
+    state = reduce(state, setInputValue('half-typed message'));
+    const cleared = reduce(state, resetSession());
+    assert.is(cleared.inputValue, '', 'the composer draft is reset');
+    assert.is(cleared.sessionMenuOpen, false, 'the panel flag is reset');
+    assert.is(cleared.blocked, true, '…while the block is still preserved');
+});
+// ── Per-vendor latches (GENC-1464 per-vendor budgets) ──────────────────────────
+Suite('setVendorBlocked walls one vendor and keeps the wall order', () => {
+    let state = reduce(createDefaultSessionState(), setVendorBlocked({ vendor: 'anthropic', blocked: true, reason: 'anthropic copy' }));
+    assert.equal(state.blockedVendors, ['anthropic']);
+    assert.equal(state.blockedVendorReasons, { anthropic: 'anthropic copy' });
+    assert.is(state.blocked, false, 'the vendor-agnostic flag is untouched');
+    state = reduce(state, setVendorBlocked({ vendor: 'gemini', blocked: true }));
+    assert.equal(state.blockedVendors, ['anthropic', 'gemini'], 'order is the order they were walled');
+});
+Suite('walling an already-walled vendor is idempotent', () => {
+    let state = reduce(createDefaultSessionState(), setVendorBlocked({ vendor: 'gemini', blocked: true, reason: 'first' }));
+    state = reduce(state, setVendorBlocked({ vendor: 'gemini', blocked: true, reason: 'second' }));
+    assert.equal(state.blockedVendors, ['gemini'], 'no duplicate entry');
+    assert.is(state.blockedVendorReasons.gemini, 'second');
+});
+Suite('the per-vendor reason honours the same three cases as setBlocked', () => {
+    // The same two-writer race (driver latch landing after a bus-subscribed host)
+    // applies per vendor, so "omitted keeps" has to hold here too.
+    let state = reduce(createDefaultSessionState(), setVendorBlocked({ vendor: 'anthropic', blocked: true, reason: 'host copy' }));
+    state = reduce(state, setVendorBlocked({ vendor: 'anthropic', blocked: true }));
+    assert.is(state.blockedVendorReasons.anthropic, 'host copy', 'omitted keeps');
+    state = reduce(state, setVendorBlocked({ vendor: 'anthropic', blocked: true, reason: null }));
+    assert.is(state.blockedVendorReasons.anthropic, undefined, 'null clears');
+});
+Suite('releasing a vendor drops it and its copy', () => {
+    let state = reduce(createDefaultSessionState(), setVendorBlocked({ vendor: 'anthropic', blocked: true, reason: 'r' }));
+    state = reduce(state, setVendorBlocked({ vendor: 'gemini', blocked: true }));
+    state = reduce(state, setVendorBlocked({ vendor: 'anthropic', blocked: false }));
+    assert.equal(state.blockedVendors, ['gemini']);
+    assert.is(state.blockedVendorReasons.anthropic, undefined);
+});
+Suite('setBlocked(false) also clears every per-vendor latch', () => {
+    // THE back-compat rule. A host asserting "the wall is gone" after its own
+    // pre-flight (migration-GENC-1464 Option B) must not be overruled by a driver
+    // latch it cannot see — without this, per-vendor would silently make the
+    // documented unblock stop working.
+    let state = reduce(createDefaultSessionState(), setVendorBlocked({ vendor: 'anthropic', blocked: true, reason: 'r' }));
+    state = reduce(state, setBlocked({ blocked: true, reason: 'global' }));
+    state = reduce(state, setBlocked({ blocked: false }));
+    assert.is(state.blocked, false);
+    assert.is(state.blockedReason, null);
+    assert.equal(state.blockedVendors, []);
+    assert.equal(state.blockedVendorReasons, {});
+});
+Suite('setBlockedReason writes the copy without disturbing any latch', () => {
+    // It exists precisely so the element's `blockedReason` setter cannot route
+    // through `setBlocked(false, …)` — which would now clear the vendor latches.
+    let state = reduce(createDefaultSessionState(), setVendorBlocked({ vendor: 'gemini', blocked: true }));
+    state = reduce(state, setBlockedReason('host copy'));
+    assert.is(state.blockedReason, 'host copy');
+    assert.is(state.blocked, false, 'the vendor-agnostic flag is untouched');
+    assert.equal(state.blockedVendors, ['gemini'], 'and so are the per-vendor latches');
+});
+Suite('resetSession preserves the per-vendor latches too', () => {
+    let state = reduce(createDefaultSessionState(), setVendorBlocked({ vendor: 'anthropic', blocked: true, reason: 'no funds' }));
+    state = reduce(state, setMessages([{ role: 'user', content: 'hi' }]));
+    const cleared = reduce(state, resetSession());
+    assert.equal(cleared.messages, [], 'the conversation is wiped');
+    assert.equal(cleared.blockedVendors, ['anthropic'], 'Clear does not refill a vendor budget');
+    assert.equal(cleared.blockedVendorReasons, { anthropic: 'no funds' });
+});
+// `resetSession` preserves its keys through `Object.assign`, whose source parameter
+// is structurally permissive: a typo like `blockedResaon` would compile clean,
+// silently stop preserving the real key, AND leak a junk key into serialised state.
+// The reducer therefore annotates its literal `satisfies
+// Partial<AiAssistantSessionState>`, which is a COMPILE-time guarantee — so the
+// durable proof is a type fixture, not a runtime assertion.
+//
+// This mirrors the reducer's clause on the same typo. If `satisfies` ever stopped
+// rejecting excess properties (a TS behaviour change, or someone widening the
+// annotated type), the `@ts-expect-error` below becomes unused and the BUILD fails
+// — which is exactly the signal wanted. The runtime suites above are its
+// behavioural companions: they pin the preserved list from both sides.
+const _typoIsRejectedAtCompileTime = {
+    // @ts-expect-error — an excess/misspelled key must be rejected by `satisfies`
+    blockedResaon: null,
+};
+void _typoIsRejectedAtCompileTime;
 Suite.run();