@k2b/cloud 0.25.0 → 0.26.0

package/src/ai/client/projection.ts

@@ -9,6 +9,14 @@ export type AiActiveTurn = {
   status: "running" | "waiting_for_action";
   blocks: AiTurnBlock[];
   modelProfileId: string | null;
+  /** A model call failed transiently and waits for its retry. Live only: the next turn event or a snapshot ends it. */
+  providerRetry?: boolean;
+  /** Server start of the turn, known from a state snapshot. */
+  createdAt?: string;
+  /** Time already spent waiting for answered user actions, from the last state snapshot. */
+  actionWaitMs?: number;
+  /** Start of the user action the turn waited for at the last state snapshot. */
+  waitingSince?: string | null;
 };
 
 export type AiChatProjection = {
@@ -90,7 +98,7 @@ export const mergeActiveTurn = (previous: AiActiveTurn | null, incoming: AiActiv
   const pendingSteers = previous.blocks.filter((block) => block.kind === "steer_message" && block.status !== "consumed");
   const known = new Set(incoming.blocks.map((block) => block.id));
   const blocks = [...incoming.blocks, ...pendingSteers.filter((block) => !known.has(block.id))];
-  return { ...incoming, blocks, status: deriveStatus(blocks) };
+  return { ...turnTiming(previous), ...incoming, blocks, status: deriveStatus(blocks) };
 };
 
 export const reconcileActiveTurnActions = (
@@ -112,9 +120,22 @@ export const activeTurnFromSnapshot = (snapshot: AiTurnSnapshot | null): AiActiv
     status: snapshot.status === "waiting_for_action" ? "waiting_for_action" : "running",
     blocks: normalizeCustomApprovalBlocks(snapshot.blocks),
     modelProfileId: snapshot.modelProfileId,
+    createdAt: snapshot.createdAt,
+    ...(snapshot.actionWaitMs !== undefined ? { actionWaitMs: snapshot.actionWaitMs } : {}),
+    ...(snapshot.waitingSince !== undefined ? { waitingSince: snapshot.waitingSince } : {}),
   };
 };
 
+/** Snapshot timing survives later attempts of the same turn, which carry no timing of their own. */
+const turnTiming = (turn: AiActiveTurn | null | undefined): Pick<AiActiveTurn, "createdAt" | "actionWaitMs" | "waitingSince"> =>
+  turn
+    ? {
+        ...(turn.createdAt !== undefined ? { createdAt: turn.createdAt } : {}),
+        ...(turn.actionWaitMs !== undefined ? { actionWaitMs: turn.actionWaitMs } : {}),
+        ...(turn.waitingSince !== undefined ? { waitingSince: turn.waitingSince } : {}),
+      }
+    : {};
+
 /**
  * Fold one stream event into the projection. Pure and total: the client and any
  * test converge on the same state for the same ordered event sequence.
@@ -125,6 +146,7 @@ export const activeTurnFromSnapshot = (snapshot: AiTurnSnapshot | null): AiActiv
  *   stale attempts are ignored. Older senders without a baseline reset to only
  *   locally pending steering blocks.
  * - block events apply only when strictly newer than the active turn's cursor.
+ * - `provider_retry` marks the active turn until its next event.
  * - `turn_finished` folds the turn's persisted messages in and clears the active turn.
  */
 export const reduceProjection = (state: AiChatProjection, event: AiStreamEvent): AiChatProjection => {
@@ -146,6 +168,8 @@ export const reduceProjection = (state: AiChatProjection, event: AiStreamEvent):
   return reduceWireEvent(state, event);
 };
 
+const withoutProviderRetry = ({ providerRetry: _, ...turn }: AiActiveTurn): AiActiveTurn => turn;
+
 export const reduceWireEvent = (state: AiChatProjection, event: AiWireEvent): AiChatProjection => {
   const active = state.activeTurn;
 
@@ -163,6 +187,7 @@ export const reduceWireEvent = (state: AiChatProjection, event: AiWireEvent): Ai
         status: deriveStatus(blocks),
         blocks,
         modelProfileId: event.modelProfileId,
+        ...turnTiming(active?.turnId === event.turnId ? active : null),
       },
     };
   }
@@ -172,20 +197,26 @@ export const reduceWireEvent = (state: AiChatProjection, event: AiWireEvent): Ai
     return { ...state, messages: mergeMessages(state.messages, event.messages ?? []), activeTurn: null };
   }
 
+  if (!active || active.turnId !== event.turnId || !isNewerWireEvent(event, active)) return state;
+
+  if (event.type === "provider_retry") {
+    return { ...state, activeTurn: { ...active, seq: event.seq, attempt: event.attempt, providerRetry: true } };
+  }
+
   if (event.type === "message_saved") {
-    if (!active || active.turnId !== event.turnId || !isNewerWireEvent(event, active)) return state;
     return {
       ...state,
       messages: mergeMessages(state.messages, [event.message]),
-      activeTurn: { ...active, seq: event.seq, attempt: event.attempt },
+      activeTurn: { ...withoutProviderRetry(active), seq: event.seq, attempt: event.attempt },
     };
   }
 
   // block_set / block_delta
-  if (!active || active.turnId !== event.turnId) return state;
-  if (!isNewerWireEvent(event, active)) return state;
   const blocks = applyWireEventToBlocks(active.blocks, event);
-  return { ...state, activeTurn: { ...active, attempt: event.attempt, seq: event.seq, blocks, status: deriveStatus(blocks) } };
+  return {
+    ...state,
+    activeTurn: { ...withoutProviderRetry(active), attempt: event.attempt, seq: event.seq, blocks, status: deriveStatus(blocks) },
+  };
 };
 
 /** Assistant/tool messages of the active turn are represented by live blocks; hide them. */

package/src/ai/executor.ts

@@ -40,6 +40,7 @@ import {
   streamBlockId,
   toolBlockId,
 } from "./protocol";
+import { retryTransientProviderErrors } from "./provider-retry";
 import { assistantQuotaProvider, inferenceProvider } from "./quota-provider";
 import { collectConversationResourceObservations } from "./resource-refs";
 import { AiRunTimeout } from "./run-timeout";
@@ -249,6 +250,8 @@ export type ExecutorConfig = {
   validateTurn?: typeof validateAiTurnRequest;
   /** Runs after the durable turn state and final wire event are flushed. */
   onTurnFinalized?: (event: AiTurnFinalizedEvent) => Promise<void>;
+  /** Waits before retrying a transient provider failure without Retry-After; tests shorten them. */
+  providerRetryDelaysMs?: readonly number[];
 };
 
 type ResolvedModel = Awaited<ReturnType<typeof resolveAiModel>>;
@@ -392,6 +395,10 @@ const createEventMapper = (attempt: number, seedBlocks: AiTurnBlock[], allowReme
   const setRejectedCallIds = (items: Set<string>) => {
     rejectedCallIds = items;
   };
+  let approvedCallIds = new Set<string>();
+  const setApprovedCallIds = (items: Set<string>) => {
+    approvedCallIds = items;
+  };
   /** nessi stream block ids (turn-scoped) that belong to tool_call blocks — their deltas are raw args JSON. */
   const toolStreamIds = new Set<string>();
   /** kind per open Cloud stream block id, for delta create-if-missing. */
@@ -414,6 +421,7 @@ const createEventMapper = (attempt: number, seedBlocks: AiTurnBlock[], allowReme
       approval: approval && !allowRememberedApprovals ? { ...approval, allowAlways: false } : approval,
       frontendMode: patch.frontendMode ?? existing?.frontendMode,
       presentation: patch.presentation ?? existing?.presentation ?? presentations.get(rawName) ?? presentations.get(name),
+      ...(approvedCallIds.has(callId) || approvedCallIds.has(displayCallId) || existing?.approved ? { approved: true } : {}),
     };
     toolBlocks.set(callId, block);
     return { type: "block_set", block };
@@ -518,6 +526,7 @@ const createEventMapper = (attempt: number, seedBlocks: AiTurnBlock[], allowReme
     setApprovalPolicies,
     setApprovalReviews,
     setRejectedCallIds,
+    setApprovedCallIds,
   };
 };
 
@@ -829,6 +838,7 @@ export class AiTurnExecutor {
     pipeline.setApprovalPolicies(prepared.approvalPolicies);
     const toolPresentations = new Map<string, AiToolPresentation>();
     const rejectedToolCallIds = new Set<string>();
+    const approvedToolCallIds = new Set<string>();
     pipeline.setPresentations(toolPresentations);
     pipeline.setApprovalReviews(capabilityActionReviews);
     let turnInput = config.input;
@@ -868,17 +878,19 @@ export class AiTurnExecutor {
       turnInput,
       toolPresentations,
       rejectedToolCallIds,
+      approvedToolCallIds,
     });
 
     const { loopMessages, pendingRecords, resolvedRecords, turnSteers } =
       attemptState ?? (await loadChatAttemptState(conversationId, turnId));
     for (const action of resolvedRecords) {
-      if (action.resolvedEvent?.type !== "approval_response" || action.resolvedEvent.approved) continue;
-      rejectedToolCallIds.add(
-        action.kind === "custom_approval" ? (customApprovalParentCallId(action.callId) ?? action.callId) : action.callId,
-      );
+      if (action.resolvedEvent?.type !== "approval_response") continue;
+      // A decision on a custom approval belongs to the call that asked for it.
+      const callId = action.kind === "custom_approval" ? (customApprovalParentCallId(action.callId) ?? action.callId) : action.callId;
+      (action.resolvedEvent.approved ? approvedToolCallIds : rejectedToolCallIds).add(callId);
     }
     pipeline.setRejectedCallIds(rejectedToolCallIds);
+    pipeline.setApprovedCallIds(approvedToolCallIds);
     const assistantMessages = loopMessages.filter((message) => message.message.role !== "user");
     const isFresh = assistantMessages.length === 0 && resolvedRecords.length === 0 && !skipResolvedActions;
 
@@ -1064,8 +1076,19 @@ export class AiTurnExecutor {
     });
     const priorToolRounds = toolRoundState(loopMessages);
     const quotaSubject = accessSubjectForActor(material.actor);
+    const deadline = claim.turn.deadline ? Date.parse(claim.turn.deadline) : null;
     const toolRoundPolicy = applyToolRoundPolicy({
-      provider: assistantQuotaProvider(resolved.provider, config, quotaSubject, resolved.profile, turnId, conversationId),
+      provider: retryTransientProviderErrors(
+        assistantQuotaProvider(resolved.provider, config, quotaSubject, resolved.profile, turnId, conversationId),
+        {
+          deadline,
+          delaysMs: this.config.providerRetryDelaysMs,
+          onRetry: async ({ retry, delayMs, issue }) => {
+            log.warn("AI provider call retried", { conversationId, turnId, retry, delayMs, kind: issue.kind, message: issue.message });
+            await pipeline.emitProviderRetry();
+          },
+        },
+      ),
       tools,
       maxToolRounds: resolved.profile.maxToolRounds,
       issuedToolRounds: priorToolRounds.issued,
@@ -1667,6 +1690,10 @@ class StreamPipeline {
     this.mapper.setRejectedCallIds(callIds);
   }
 
+  setApprovedCallIds(callIds: Set<string>): void {
+    this.mapper.setApprovedCallIds(callIds);
+  }
+
   async emitBaseline(): Promise<void> {
     for (const block of this.blocks) {
       const seq = this.nextSeq();
@@ -1765,6 +1792,12 @@ class StreamPipeline {
     await this.publish(event);
   }
 
+  /** Transient: says a model call is waiting to be retried. Snapshots never carry it. */
+  async emitProviderRetry(): Promise<void> {
+    const seq = this.nextSeq();
+    await this.publish(this.envelope({ type: "provider_retry" as const, seq }));
+  }
+
   async emitTurnFinished(status: "completed" | "failed" | "aborted", error: string | null): Promise<void> {
     const seq = this.nextSeq();
     await this.publish(this.envelope({ type: "turn_finished" as const, seq, status, error }) as AiWireEvent);

package/src/ai/protocol.ts

@@ -39,6 +39,8 @@ export type AiTurnBlock =
       isError?: boolean;
       /** Present while status is awaiting_approval. */
       approval?: { message?: string; review?: CapabilityActionReview; allowAlways: boolean };
+      /** The user approved this call in the chat; the decided approval stays visible as a receipt. */
+      approved?: boolean;
       /** Present for frontend tools. */
       frontendMode?: AiFrontendToolMode;
       /** Saved Cloud-owned display snapshot for capability calls. */
@@ -67,6 +69,8 @@ export type AiWireEvent =
   | (AiWireEventBase & { type: "message_saved"; message: AiStoredMessage })
   | (AiWireEventBase & { type: "block_set"; block: AiTurnBlock })
   | (AiWireEventBase & { type: "block_delta"; blockId: string; blockKind: "text" | "thinking"; delta: string })
+  /** A model call failed transiently and waits for its retry. Transient: the next event of the turn ends it. */
+  | (AiWireEventBase & { type: "provider_retry" })
   | (AiWireEventBase & {
       type: "turn_finished";
       status: AiTurnFinishedStatus;
@@ -85,6 +89,10 @@ export type AiTurnSnapshot = {
   blocks: AiTurnBlock[];
   modelProfileId: string | null;
   createdAt: string;
+  /** Time the turn already waited for answered user actions such as approvals. Absent from older servers. */
+  actionWaitMs?: number;
+  /** Start of the user action the turn waits for now, or null while it works. Absent from older servers. */
+  waitingSince?: string | null;
 };
 
 /** Full projection seed sent as the first SSE event on every (re)connect. */
@@ -151,7 +159,12 @@ export const reconcileResolvedTurnActions = (
     const event = resolvedByCallId.get(block.callId);
     if (!event || event.callId !== block.callId) return block;
     if (block.status === "awaiting_approval" && event.type === "approval_response") {
-      return { ...block, status: event.approved ? "running" : "rejected", approval: undefined };
+      return {
+        ...block,
+        status: event.approved ? "running" : "rejected",
+        approval: undefined,
+        ...(event.approved ? { approved: true } : {}),
+      };
     }
     if (block.status === "awaiting_client" && event.type === "tool_result") {
       return { ...block, status: "completed", result: event.result, isError: false };
@@ -172,7 +185,7 @@ export const buildBlocksFromMessages = (
     meta?: {
       steerId?: string;
       toolPresentations?: Record<string, AiToolPresentation>;
-      toolOutcomes?: Record<string, "rejected">;
+      toolOutcomes?: Record<string, "rejected" | "approved">;
     } | null;
   }[],
 ): AiTurnBlock[] => {
@@ -196,6 +209,8 @@ export const buildBlocksFromMessages = (
             args: block.args,
             status: "running",
             presentation: meta?.toolPresentations?.[block.id],
+            // A turn that ended before an approved call returned records the approval on the call's message.
+            ...(meta?.toolOutcomes?.[block.id] === "approved" ? { approved: true } : {}),
           });
         }
       });
@@ -212,12 +227,13 @@ export const buildBlocksFromMessages = (
       const at = toolIndex.get(message.callId);
       const existing = at !== undefined ? blocks[at] : undefined;
       if (existing?.kind === "tool") {
-        const rejected = meta?.toolOutcomes?.[message.callId] === "rejected";
+        const outcome = meta?.toolOutcomes?.[message.callId];
         blocks[at!] = {
           ...existing,
-          status: rejected ? "rejected" : message.isError ? "failed" : "completed",
+          status: outcome === "rejected" ? "rejected" : message.isError ? "failed" : "completed",
           result: message.result,
           isError: message.isError,
+          ...(outcome === "approved" ? { approved: true } : {}),
         };
       }
     }

package/src/ai/provider-fetch.ts

@@ -1,27 +1,63 @@
 import { AsyncLocalStorage } from "node:async_hooks";
 
 /**
- * Dates the provider response headers and the first body byte of the inference
- * call that is currently streaming, without touching the wire. nessi adapters
- * call the global `fetch`; the wrapper is installed once, on first use, and
- * only observes requests made inside `runWithProviderFetchMarks`.
+ * Observes the provider request of the inference call that is currently
+ * running, without touching the wire: when its headers and first body byte
+ * arrived, whether the provider certainly did not process it, and how long a
+ * rejecting provider asked the caller to wait. nessi adapters call the global
+ * `fetch`; the wrapper is installed once, on first use, and only observes
+ * requests made inside `runWithProviderFetchMarks`. Scopes nest, so an outer
+ * retry policy and the inner per-call accounting each see the same request.
  *
  * Nothing here logs: frames may carry reasoning text and headers carry keys.
  */
-export type ProviderFetchMarks = { headersAt?: number; firstByteAt?: number };
+export type ProviderFetchMarks = {
+  headersAt?: number;
+  firstByteAt?: number;
+  /** The request never reached the provider, or the provider answered with a status that says it did not process it. */
+  refused?: boolean;
+  retryAfterMs?: number;
+};
 
-const marks = new AsyncLocalStorage<ProviderFetchMarks>();
+const scopes = new AsyncLocalStorage<readonly ProviderFetchMarks[]>();
 let installed = false;
 
 export const runWithProviderFetchMarks = <T>(store: ProviderFetchMarks, run: () => Promise<T>): Promise<T> => {
   install();
-  return marks.run(store, run);
+  return scopes.run([...(scopes.getStore() ?? []), store], run);
+};
+
+/** `retry-after-ms` (OpenAI) wins over the standard `retry-after` seconds or HTTP date. */
+export const retryAfterMs = (headers: Headers, now = Date.now()): number | undefined => {
+  const milliseconds = Number(headers.get("retry-after-ms")?.trim() || Number.NaN);
+  if (Number.isFinite(milliseconds) && milliseconds >= 0) return milliseconds;
+  const value = headers.get("retry-after")?.trim();
+  if (!value) return undefined;
+  const seconds = Number(value);
+  if (Number.isFinite(seconds)) return seconds >= 0 ? seconds * 1_000 : undefined;
+  const date = Date.parse(value);
+  return Number.isFinite(date) ? Math.max(0, date - now) : undefined;
 };
 
-const firstByteObserver = (store: ProviderFetchMarks) =>
+/**
+ * A client error, 503, or Anthropic's overloaded 529 says the provider did not
+ * process the request. Other server errors, such as a gateway's 502 or 504, can
+ * follow processing upstream.
+ */
+const refusedStatus = (status: number) => (status >= 400 && status < 500) || status === 503 || status === 529;
+
+/** Bun's codes for a request that never left: no connection, or no address for the host. */
+const unsentCodes = new Set(["ConnectionRefused", "ENOTFOUND"]);
+const unsent = (error: unknown) =>
+  typeof error === "object" && error !== null && "code" in error && typeof error.code === "string" && unsentCodes.has(error.code);
+
+const firstByteObserver = (stores: readonly ProviderFetchMarks[]) =>
   new TransformStream<Uint8Array, Uint8Array>({
     transform(chunk, controller) {
-      if (chunk.byteLength > 0 && store.firstByteAt === undefined) store.firstByteAt = Date.now();
+      if (chunk.byteLength > 0)
+        for (const store of stores) {
+          store.firstByteAt ??= Date.now();
+        }
       controller.enqueue(chunk);
     },
   });
@@ -31,13 +67,29 @@ const install = (): void => {
   installed = true;
   const realFetch = globalThis.fetch;
   const instrumented = async (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
-    const store = marks.getStore();
-    // Only the first request of a call is the provider request; nessi retries create a new call.
-    if (store === undefined || store.headersAt !== undefined) return realFetch(input, init);
-    const response = await realFetch(input, init);
-    store.headersAt = Date.now();
+    // Only the first request of a scope is its provider request; a retry opens a new scope.
+    const stores = (scopes.getStore() ?? []).filter((store) => store.headersAt === undefined);
+    if (stores.length === 0) return realFetch(input, init);
+    let response: Response;
+    try {
+      response = await realFetch(input, init);
+    } catch (error) {
+      // A reset, an abort, or a timeout can follow delivery, so only an unsent request counts as refused.
+      if (unsent(error))
+        for (const store of stores) {
+          store.refused = true;
+        }
+      throw error;
+    }
+    const headersAt = Date.now();
+    const wait = response.ok ? undefined : retryAfterMs(response.headers, headersAt);
+    for (const store of stores) {
+      store.headersAt = headersAt;
+      store.refused = refusedStatus(response.status);
+      if (wait !== undefined) store.retryAfterMs = wait;
+    }
     if (!response.body) return response;
-    return new Response(response.body.pipeThrough(firstByteObserver(store)), {
+    return new Response(response.body.pipeThrough(firstByteObserver(stores)), {
       status: response.status,
       statusText: response.statusText,
       headers: response.headers,

package/src/ai/provider-retry.ts

@@ -0,0 +1,105 @@
+import { setTimeout as delay } from "node:timers/promises";
+import type { NessiIssue, Provider, ProviderIssue, StreamEvent, TimeoutIssue } from "@k2b/nessi/ai";
+import { type ProviderFetchMarks, runWithProviderFetchMarks } from "./provider-fetch";
+
+/** Waits before the first and the second retry when the provider names none. nessi itself never retries. */
+export const AI_PROVIDER_RETRY_DELAYS_MS: readonly number[] = [1_000, 4_000];
+
+/**
+ * The longest Retry-After that is honored, the bound the OpenAI and Anthropic
+ * SDKs apply. A provider that asks for a longer wait is unavailable for this
+ * turn, so the call fails now with the provider's message.
+ */
+const AI_PROVIDER_MAX_RETRY_AFTER_MS = 60_000;
+
+export type AiProviderRetry = {
+  /** 1 for the first retry. */
+  retry: number;
+  delayMs: number;
+  issue: ProviderIssue | TimeoutIssue;
+};
+
+const transientIssue = (issue: NessiIssue): issue is ProviderIssue | TimeoutIssue =>
+  (issue.kind === "provider_error" && issue.retryable && !issue.contextOverflow) ||
+  (issue.kind === "timeout" && issue.retryable && issue.scope !== "tool");
+
+const isBlockEvent = (event: StreamEvent) => event.type === "block_start" || event.type === "block_delta" || event.type === "block_end";
+
+/**
+ * Repeats a model call that failed transiently (429, 5xx, a lost connection, a
+ * provider timeout) before it produced any output. Each attempt passes through
+ * `provider` again, so quota admission and accounting see every request.
+ *
+ * Once a block event was emitted the attempt is final: streamed text cannot be
+ * taken back, so a failure mid-stream still ends the call. Context overflow is
+ * left to compaction. Waits follow the provider's Retry-After, otherwise
+ * `delaysMs`, end before `deadline`, and stop on the request's abort signal.
+ */
+export function retryTransientProviderErrors(
+  provider: Provider,
+  options: {
+    /** Epoch milliseconds by which a wait must end; null when the turn has no run time limit. */
+    deadline: number | null;
+    delaysMs?: readonly number[];
+    /** Announces a wait before it starts. */
+    onRetry?: (retry: AiProviderRetry) => Promise<void>;
+  },
+): Provider {
+  const delays = options.delaysMs ?? AI_PROVIDER_RETRY_DELAYS_MS;
+  const waitFor = (retry: number, marks: ProviderFetchMarks, signal: AbortSignal | undefined): number | null => {
+    if (retry >= delays.length || signal?.aborted) return null;
+    const delayMs = marks.retryAfterMs ?? delays[retry]!;
+    if (delayMs > AI_PROVIDER_MAX_RETRY_AFTER_MS) return null;
+    if (options.deadline !== null && Date.now() + delayMs >= options.deadline) return null;
+    return delayMs;
+  };
+  return {
+    name: provider.name,
+    family: provider.family,
+    model: provider.model,
+    contextWindow: provider.contextWindow,
+    capabilities: provider.capabilities,
+    complete: (request) => provider.complete(request),
+    stream: async function* (request) {
+      for (let retry = 0; ; retry += 1) {
+        const marks: ProviderFetchMarks = {};
+        const events = provider.stream(request)[Symbol.asyncIterator]();
+        const next = () => runWithProviderFetchMarks(marks, () => events.next());
+        // Events before the first block (usage, issues) are held so that a retried attempt leaves no trace.
+        const held: StreamEvent[] = [];
+        let committed = false;
+        let pending: AiProviderRetry | null = null;
+        try {
+          for (let step = await next(); !step.done; step = await next()) {
+            const event = step.value;
+            if (!committed && event.type === "issue" && transientIssue(event.issue)) {
+              const delayMs = waitFor(retry, marks, request.signal);
+              if (delayMs !== null) {
+                pending = { retry: retry + 1, delayMs, issue: event.issue };
+                break;
+              }
+            }
+            if (!committed && !isBlockEvent(event)) {
+              held.push(event);
+              continue;
+            }
+            if (!committed) {
+              committed = true;
+              yield* held.splice(0);
+            }
+            yield event;
+          }
+        } finally {
+          // Settles the failed attempt's accounting before the wait starts.
+          await events.return?.();
+        }
+        if (!pending) {
+          yield* held;
+          return;
+        }
+        await options.onRetry?.(pending);
+        await delay(pending.delayMs, undefined, { signal: request.signal });
+      }
+    },
+  };
+}

package/src/ai/quota-provider.ts

@@ -5,7 +5,7 @@ import type { AccessSubject } from "../server/services/access";
 import { logger } from "../services/logging";
 import { isAssistantChatTurn } from "./assistant-models";
 import { AiBackgroundAdmissionError, type AiCallContext, type AiCallDetails, beginAiCall, finishAiCall } from "./inference-calls";
-import { runWithProviderFetchMarks } from "./provider-fetch";
+import { type ProviderFetchMarks, runWithProviderFetchMarks } from "./provider-fetch";
 import type { AiModelProfile } from "./types";
 
 const log = logger("ai:quotas");
@@ -93,7 +93,7 @@ export function inferenceProvider(
       let status: "ok" | "failed" = "failed";
       let error: string | undefined;
       const requestStartedAt = Date.now();
-      const marks: { headersAt?: number; firstByteAt?: number } = {};
+      const marks: ProviderFetchMarks = {};
       try {
         const result = await runWithProviderFetchMarks(marks, () =>
           provider.complete({ ...request, maxOutputTokens: call.maxOutputTokens }),
@@ -112,7 +112,9 @@ export function inferenceProvider(
         throw thrown;
       } finally {
         call.stop();
-        if (!usage && status === "failed") usage = { input: call.inputTokens, output: 0, estimated: true };
+        // A request the provider refused or never received cost nothing; any other failure may have been processed.
+        if (!usage && status === "failed")
+          usage = marks.refused ? { input: 0, output: 0 } : { input: call.inputTokens, output: 0, estimated: true };
         const cancelled = request.signal?.aborted === true;
         await finish(call.id, usage, cancelled && status === "failed" ? "aborted" : status, {
           error: cancelled ? null : error,
@@ -133,7 +135,7 @@ export function inferenceProvider(
       const outputBlocks = new Map<string, number>();
       let generated = false;
       const requestStartedAt = Date.now();
-      const marks: { headersAt?: number; firstByteAt?: number; firstBlockAt?: number } = {};
+      const marks: ProviderFetchMarks & { firstBlockAt?: number } = {};
       // The wrapped adapter reads lazily, so the request only leaves once the first pull runs inside the marked scope.
       const events = provider.stream({ ...request, maxOutputTokens: call.maxOutputTokens })[Symbol.asyncIterator]();
       const next = () => runWithProviderFetchMarks(marks, () => events.next());
@@ -158,7 +160,14 @@ export function inferenceProvider(
             outputBlocks.set(event.blockId, size);
           }
           if (event.type === "block_start" || event.type === "block_delta" || event.type === "block_end") generated = true;
-          if (event.type === "issue" && event.issue.kind === "provider_error" && event.issue.contextOverflow && !generated && !usage)
+          // A provider that refused the request, or never received it, did not process it.
+          if (
+            event.type === "issue" &&
+            event.issue.kind === "provider_error" &&
+            (event.issue.contextOverflow || marks.refused) &&
+            !generated &&
+            !usage
+          )
             usage = { input: 0, output: 0 };
           if (event.type === "usage") {
             if (event.finishReason === "aborted" || event.finishReason === "interrupted" || event.finishReason === "error") failed = true;