@k2b/cloud 0.42.0 → 0.44.0

package/src/ai/prefs.ts

@@ -1,5 +1,6 @@
 import { sql } from "bun";
 import type { RequestActor } from "../server";
+import { type AiModelRequest, AiModelRequestSchema } from "../shared/ai-models";
 
 /**
  * Learning from private chats applies to everyone who has not chosen.
@@ -12,8 +13,8 @@ export type AiUserPrefs = {
   memoryEnabled: boolean;
   /** Effective setting: the user's explicit choice, otherwise the default. */
   memoryLearningEnabled: boolean;
-  /** Model profile id of the user's most recent chat turn — preselected for new chats. */
-  lastModelId: string;
+  /** Class or explicit variant choice, preselected for new chats. */
+  selection: AiModelRequest | null;
   updatedAt: string;
 };
 
@@ -21,7 +22,7 @@ type PrefsRow = {
   user_id: string;
   memory_enabled: boolean;
   memory_learning_enabled: boolean | null;
-  last_model_id: string | null;
+  model_choice: unknown;
   updated_at: string | Date;
 };
 
@@ -29,7 +30,7 @@ const toPrefs = (row: PrefsRow): AiUserPrefs => ({
   userId: row.user_id,
   memoryEnabled: row.memory_enabled,
   memoryLearningEnabled: row.memory_learning_enabled ?? AI_MEMORY_LEARNING_DEFAULT_ENABLED,
-  lastModelId: row.last_model_id ?? "",
+  selection: row.model_choice ? AiModelRequestSchema.parse(row.model_choice) : null,
   updatedAt: new Date(row.updated_at).toISOString(),
 });
 
@@ -37,7 +38,7 @@ const emptyPrefs = (userId: string): AiUserPrefs => ({
   userId,
   memoryEnabled: true,
   memoryLearningEnabled: AI_MEMORY_LEARNING_DEFAULT_ENABLED,
-  lastModelId: "",
+  selection: null,
   updatedAt: new Date(0).toISOString(),
 });
 
@@ -59,25 +60,26 @@ export const aiUserPrefs = {
 
   async update(
     userId: string,
-    patch: { memoryEnabled?: boolean; memoryLearningEnabled?: boolean; lastModelId?: string },
+    patch: { memoryEnabled?: boolean; memoryLearningEnabled?: boolean; selection?: AiModelRequest | null },
   ): Promise<AiUserPrefs> {
     const memoryEnabled = patch.memoryEnabled ?? null;
     const memoryLearningEnabled = patch.memoryLearningEnabled ?? null;
     // Records when the person last saved the learning switch, so a stored "off"
     // from an earlier release stays distinguishable from a choice made since.
     const learningChosen = memoryLearningEnabled !== null;
-    const lastModelId = patch.lastModelId?.trim().slice(0, 200) ?? null;
+    const choiceChanged = Object.hasOwn(patch, "selection");
+    const modelChoice = patch.selection ? JSON.stringify(AiModelRequestSchema.parse(patch.selection)) : null;
     const rows = (await sql`
-      INSERT INTO ai.user_prefs (user_id, memory_enabled, memory_learning_enabled, memory_learning_chosen_at, last_model_id, updated_at)
+      INSERT INTO ai.user_prefs (user_id, memory_enabled, memory_learning_enabled, memory_learning_chosen_at, model_choice, updated_at)
       VALUES (
         ${userId}, ${memoryEnabled ?? true}, ${memoryLearningEnabled},
-        CASE WHEN ${learningChosen}::boolean THEN now() END, ${lastModelId ?? ""}, now()
+        CASE WHEN ${learningChosen}::boolean THEN now() END, ${modelChoice}::text::jsonb, now()
       )
       ON CONFLICT (user_id) DO UPDATE SET
         memory_enabled = COALESCE(${memoryEnabled}, ai.user_prefs.memory_enabled),
         memory_learning_enabled = COALESCE(${memoryLearningEnabled}, ai.user_prefs.memory_learning_enabled),
         memory_learning_chosen_at = CASE WHEN ${learningChosen}::boolean THEN now() ELSE ai.user_prefs.memory_learning_chosen_at END,
-        last_model_id = COALESCE(${lastModelId}, ai.user_prefs.last_model_id),
+        model_choice = CASE WHEN ${choiceChanged} THEN ${modelChoice}::text::jsonb ELSE ai.user_prefs.model_choice END,
         updated_at = now()
       RETURNING *
     `) as PrefsRow[];

package/src/ai/projects-routes.ts

@@ -6,6 +6,7 @@ import { AuthenticatedPrincipalSchema } from "../contracts/shared";
 import { type AuthContext, auth, err, fail, getLocale, ok, rateLimit, respond, v } from "../server";
 import { noTransform } from "../server/middleware/no-transform";
 import { ImageMetadataError } from "../services/image-metadata";
+import { AiModelRequestSchema } from "../shared/ai-models";
 import { aiChatMessages } from "./chat/messages";
 import { decodeAiFileContent } from "./files-store";
 import {
@@ -27,7 +28,7 @@ const ProjectFieldsSchema = z.object({
   description: z.string().trim().max(AI_PROJECT_DESCRIPTION_MAX_CHARS).default(""),
   icon: z.string().trim().min(1).max(80).default("ti ti-folders"),
   instructions: z.string().trim().max(AI_PROJECT_INSTRUCTIONS_MAX_CHARS).default(""),
-  defaultModelProfileId: z.string().trim().min(1).max(120).nullable().optional(),
+  defaultModel: AiModelRequestSchema.nullable().optional(),
 });
 
 const UpdateProjectSchema = ProjectFieldsSchema.partial().refine((input) => Object.keys(input).length > 0, "No changes supplied.");

package/src/ai/projects.ts

@@ -12,6 +12,7 @@ import {
 } from "../server/services/access";
 import { stripImageMetadata } from "../services/image-metadata";
 import { toPgUuidArray } from "../services/postgres";
+import { type AiModelRequest, AiModelRequestSchema } from "../shared/ai-models";
 import { AiFileVersionConflict, AiFileWriteError, aiFileContentVersion } from "./file-content-version";
 import { isAiImage } from "./file-media-type";
 import { mountAiProjectFilePath } from "./file-mount";
@@ -42,7 +43,7 @@ export type AiProject = {
   description: string;
   icon: string;
   instructions: string;
-  defaultModelProfileId: string | null;
+  defaultModel: AiModelRequest | null;
   permission: AiProjectPermission;
   revision: number;
   createdAt: string;
@@ -115,7 +116,7 @@ type ProjectRow = {
   description: string;
   icon: string;
   instructions: string;
-  default_model_profile_id: string | null;
+  default_model: AiModelRequest | null;
   revision: number;
   created_at: Date | string;
   updated_at: Date | string;
@@ -213,7 +214,7 @@ const toProject = async (row: ProjectRow, subject: AccessSubject | null, db: SQL
     description: row.description,
     icon: row.icon,
     instructions: row.instructions,
-    defaultModelProfileId: row.default_model_profile_id,
+    defaultModel: row.default_model ? AiModelRequestSchema.parse(row.default_model) : null,
     permission,
     revision: Number(row.revision),
     createdAt: iso(row.created_at),
@@ -417,17 +418,17 @@ export const aiProjects = {
     description?: string;
     icon?: string;
     instructions?: string;
-    defaultModelProfileId?: string | null;
+    defaultModel?: AiModelRequest | null;
   }): Promise<AiProject> {
     return sql.begin(async (tx) => {
       const rows = await withAiShortIdForDb(
         tx,
         "idx_ai_projects_short_id",
         (attempt, shortId) => attempt<ProjectRow[]>`
-        INSERT INTO ai.projects (short_id, name, description, icon, instructions, default_model_profile_id)
+        INSERT INTO ai.projects (short_id, name, description, icon, instructions, default_model)
         VALUES (
           ${shortId}, ${input.name.trim()}, ${input.description?.trim() ?? ""}, ${input.icon?.trim() || "ti ti-folders"},
-          ${input.instructions?.trim() ?? ""}, ${input.defaultModelProfileId?.trim() || null}
+          ${input.instructions?.trim() ?? ""}, ${input.defaultModel ? JSON.stringify(AiModelRequestSchema.parse(input.defaultModel)) : null}::text::jsonb
         )
         RETURNING *
       `,
@@ -488,9 +489,9 @@ export const aiProjects = {
   async update(
     projectId: string,
     subject: AccessSubject | null,
-    input: Partial<Pick<AiProject, "name" | "description" | "icon" | "instructions" | "defaultModelProfileId">>,
+    input: Partial<Pick<AiProject, "name" | "description" | "icon" | "instructions" | "defaultModel">>,
   ): Promise<AiProject | null> {
-    const changesTrustedInstructions = Object.hasOwn(input, "instructions") || Object.hasOwn(input, "defaultModelProfileId");
+    const changesTrustedInstructions = Object.hasOwn(input, "instructions") || Object.hasOwn(input, "defaultModel");
     if (!(await requireProject(projectId, subject, changesTrustedInstructions ? "admin" : "write"))) return null;
     const rows = await sql<ProjectRow[]>`
       UPDATE ai.projects
@@ -498,9 +499,9 @@ export const aiProjects = {
           description = COALESCE(${input.description?.trim() ?? null}, description),
           icon = COALESCE(${input.icon?.trim() ?? null}, icon),
           instructions = COALESCE(${input.instructions?.trim() ?? null}, instructions),
-          default_model_profile_id = CASE
-            WHEN ${Object.hasOwn(input, "defaultModelProfileId")} THEN ${input.defaultModelProfileId?.trim() || null}
-            ELSE default_model_profile_id
+          default_model = CASE
+            WHEN ${Object.hasOwn(input, "defaultModel")} THEN ${input.defaultModel ? JSON.stringify(AiModelRequestSchema.parse(input.defaultModel)) : null}::text::jsonb
+            ELSE default_model
           END,
           revision = revision + 1,
           updated_at = now()
@@ -563,7 +564,7 @@ export const aiProjects = {
         instructions: project.instructions,
         context: lines.join("\n").slice(0, AI_PROJECT_PROMPT_MANIFEST_MAX_CHARS),
         references: references.map((reference) => reference.ref),
-        defaultModelProfileId: project.defaultModelProfileId,
+        defaultModel: project.defaultModel,
       };
     });
   },

package/src/ai/protocol.ts

@@ -90,7 +90,7 @@ export type AiTurnFinishedStatus = "completed" | "failed" | "aborted";
 export type AiWireEvent =
   | (AiWireEventBase & {
       type: "turn_started";
-      modelProfileId: string;
+      modelId: string;
       providerModel: string;
       /** Authoritative ordered baseline for this attempt. Optional for older senders. */
       blocks?: AiTurnBlock[];
@@ -116,7 +116,7 @@ export type AiTurnSnapshot = {
   /** Last wire seq reflected in `blocks` (attempt-scoped). */
   seq: number;
   blocks: AiTurnBlock[];
-  modelProfileId: string | null;
+  modelId: string | null;
   createdAt: string;
   /** Time the turn already waited for answered user actions such as approvals. Absent from older servers. */
   actionWaitMs?: number;

package/src/ai/provider-connections.ts

@@ -0,0 +1,161 @@
+import { sql } from "bun";
+import { z } from "zod";
+import type { AiProvider } from "../shared/ai-models";
+import { getAiCredential } from "./credentials";
+import { getAiRequestHeaders } from "./request-headers";
+
+export type AiProviderTestResult = {
+  status: "ok" | "unreachable" | "key_rejected" | "error";
+  httpStatus?: number;
+  message: string;
+  latencyMs?: number;
+};
+export type AiAvailableProviderModel = { providerModel: string; label?: string; kind?: "chat" | "transcription"; contextWindow?: number };
+type Connection = Pick<AiProvider, "type" | "baseUrl"> & { apiKey?: string; headers?: Record<string, string> };
+const defaults = {
+  openai: "https://api.openai.com/v1",
+  openrouter: "https://openrouter.ai/api/v1",
+  anthropic: "https://api.anthropic.com/v1",
+  mistral: "https://api.mistral.ai/v1",
+  gemini: "https://generativelanguage.googleapis.com/v1beta/openai",
+  ollama: "http://localhost:11434",
+  vllm: "http://localhost:8000/v1",
+  "openai-compatible": "",
+};
+export class AiProviderListError extends Error {
+  constructor(
+    readonly code: "unreachable" | "key_rejected" | "list_failed",
+    message: string,
+    readonly httpStatus?: number,
+  ) {
+    super(message);
+  }
+}
+export const classifyProviderFailure = (error: unknown): AiProviderTestResult => {
+  const details = z
+    .object({ status: z.number().optional(), statusCode: z.number().optional(), code: z.string().optional(), name: z.string().optional() })
+    .passthrough()
+    .safeParse(error);
+  const httpStatus =
+    error instanceof AiProviderListError
+      ? error.httpStatus
+      : details.success
+        ? (details.data.status ?? details.data.statusCode)
+        : undefined;
+  const status =
+    httpStatus === 401 || httpStatus === 403
+      ? "key_rejected"
+      : (error instanceof AiProviderListError && error.code === "unreachable") ||
+          error instanceof TypeError ||
+          (details.success && ["TimeoutError", "AbortError"].includes(details.data.name ?? "")) ||
+          (details.success && ["ECONNREFUSED", "ETIMEDOUT", "ENOTFOUND", "ECONNRESET"].includes(details.data.code ?? ""))
+        ? "unreachable"
+        : "error";
+  return {
+    status,
+    ...(httpStatus ? { httpStatus } : {}),
+    message:
+      status === "key_rejected"
+        ? "The provider rejected the credential."
+        : status === "unreachable"
+          ? "The provider did not respond within 10 seconds or could not be reached."
+          : "The provider request failed.",
+  };
+};
+/** Best-effort persistence never rejects: callers await it inside their provider error boundary. */
+export const recordAiProviderStatus = async (id: string, result: AiProviderTestResult, force = false) => {
+  try {
+    await sql`UPDATE ai.providers SET status=${result.status},status_code=${result.httpStatus?.toString() ?? null},status_message=${result.message},status_checked_at=clock_timestamp() WHERE id=${id} AND (${force} OR status IS DISTINCT FROM ${result.status} OR status_code IS DISTINCT FROM ${result.httpStatus?.toString() ?? null})`;
+  } catch {
+    // A failed database write must not start another write through the persistent logger.
+    console.warn("[ai:providers] Could not persist provider connection status", { providerId: id });
+  }
+};
+const requestModels = async (provider: Connection, signal?: AbortSignal, after?: string) => {
+  const base = (provider.baseUrl ?? defaults[provider.type]).replace(/\/$/, "");
+  if (!base) throw new AiProviderListError("list_failed", "The provider has no base URL.");
+  const headers = new Headers(provider.headers);
+  if (provider.type === "anthropic") {
+    headers.set("anthropic-version", "2023-06-01");
+    if (provider.apiKey) headers.set("x-api-key", provider.apiKey);
+  } else if (provider.apiKey) headers.set("authorization", `Bearer ${provider.apiKey}`);
+  let response: Response;
+  try {
+    response = await fetch(
+      `${base}${provider.type === "ollama" ? "/api/tags" : `/models${after ? `?after_id=${encodeURIComponent(after)}` : ""}`}`,
+      { headers, signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(10_000)]) : AbortSignal.timeout(10_000), redirect: "error" },
+    );
+  } catch {
+    throw new AiProviderListError("unreachable", "The provider could not be reached.");
+  }
+  if (!response.ok) {
+    await response.body?.cancel();
+    throw new AiProviderListError(
+      response.status === 401 || response.status === 403 ? "key_rejected" : "list_failed",
+      "The provider could not list models.",
+      response.status,
+    );
+  }
+  return response;
+};
+/** Cloud's one listing seam; move it to nessi listModels() when that API ships. */
+export const listProviderModels = async (provider: Connection, signal?: AbortSignal): Promise<AiAvailableProviderModel[]> => {
+  const deadline = signal ? AbortSignal.any([signal, AbortSignal.timeout(10_000)]) : AbortSignal.timeout(10_000);
+  const models: AiAvailableProviderModel[] = [];
+  const seen = new Set<string>();
+  let after: string | undefined;
+  do {
+    const response = await requestModels(provider, deadline, after);
+    try {
+      const body: unknown = await response.json();
+      if (provider.type === "ollama")
+        return z
+          .object({ models: z.array(z.object({ name: z.string() })) })
+          .parse(body)
+          .models.map((model) => ({ providerModel: model.name }));
+      const page = z
+        .object({
+          data: z.array(
+            z.object({
+              id: z.string(),
+              name: z.string().optional(),
+              display_name: z.string().optional(),
+              context_length: z.number().int().positive().optional(),
+            }),
+          ),
+          has_more: z.boolean().optional(),
+          last_id: z.string().optional(),
+        })
+        .parse(body);
+      models.push(
+        ...page.data.map((model) => ({
+          providerModel: model.id,
+          ...((model.display_name ?? model.name) ? { label: model.display_name ?? model.name } : {}),
+          ...(model.context_length ? { contextWindow: model.context_length } : {}),
+        })),
+      );
+      if (provider.type !== "anthropic" || !page.has_more) return models;
+      after = page.last_id ?? page.data.at(-1)?.id;
+      if (!after || seen.has(after)) throw new Error("Non-advancing model cursor");
+      seen.add(after);
+    } catch {
+      throw new AiProviderListError("list_failed", "The provider returned an invalid model list.");
+    }
+  } while (!deadline.aborted);
+  throw new AiProviderListError("unreachable", "The provider model list timed out.");
+};
+export const storedProviderConnection = async (provider: AiProvider): Promise<Connection> => ({
+  ...provider,
+  apiKey: (await getAiCredential(provider.id)) ?? undefined,
+  headers: await getAiRequestHeaders(provider.id),
+});
+export const testAiProvider = async (provider: Connection, signal?: AbortSignal): Promise<AiProviderTestResult> => {
+  const start = Date.now();
+  try {
+    const response = await requestModels(provider, signal);
+    await response.body?.cancel();
+    return { status: "ok", httpStatus: response.status, message: "The provider connection works.", latencyMs: Date.now() - start };
+  } catch (error) {
+    return { ...classifyProviderFailure(error), latencyMs: Date.now() - start };
+  }
+};

package/src/ai/provider-errors.ts

@@ -0,0 +1,138 @@
+import type { NessiIssue, Provider, StreamEvent } from "@k2b/nessi/ai";
+import { classifyProviderFailure, recordAiProviderStatus } from "./provider-connections";
+import { type ProviderFetchMarks, runWithProviderFetchMarks } from "./provider-fetch";
+
+/** No provider-owned message, name, stack, cause, or extension fields cross this boundary. */
+export class AiProviderError extends Error {
+  readonly code: "provider_error" | "provider_aborted";
+
+  constructor(aborted = false) {
+    super(aborted ? "AI provider request was canceled." : "AI provider request failed.");
+    this.name = aborted ? "AbortError" : "AiProviderError";
+    this.code = aborted ? "provider_aborted" : "provider_error";
+  }
+}
+
+/** Keep only the adapter's typed control signals. Text and diagnostic payloads are untrusted. */
+const providerIssue = (issue: NessiIssue, tools: Parameters<Provider["stream"]>[0]["tools"]): NessiIssue => {
+  switch (issue.kind) {
+    case "provider_error":
+      return {
+        kind: "provider_error",
+        message: "AI provider request failed.",
+        retryable: issue.retryable === true,
+        contextOverflow: issue.contextOverflow === true,
+        overflowRatio:
+          typeof issue.overflowRatio === "number" && Number.isFinite(issue.overflowRatio) && issue.overflowRatio > 0
+            ? issue.overflowRatio
+            : undefined,
+      };
+    case "timeout":
+      return {
+        kind: "timeout",
+        scope: issue.scope === "provider_first_byte" ? "provider_first_byte" : "provider_idle",
+        message: "AI provider request timed out.",
+        retryable: issue.retryable === true,
+      };
+    case "malformed_tool_call":
+    case "cancelled_tool_call":
+      return {
+        kind: issue.kind,
+        reason: toolStreamReason(issue.reason),
+        // Use the application-declared name, never an arbitrary provider diagnostic.
+        name: tools?.find((tool) => tool.name === issue.name)?.name,
+        message: "AI provider returned an incomplete or invalid tool call.",
+      };
+    default:
+      // Tool execution and runtime issues belong to nessi, not a model adapter.
+      return { kind: "provider_error", message: "AI provider request failed.", retryable: false };
+  }
+};
+
+const toolStreamReason = (reason: string) => {
+  switch (reason) {
+    case "text_during_tool_call":
+    case "thinking_during_tool_call":
+    case "tool_delta_without_start":
+    case "missing_tool_name":
+    case "invalid_tool_arguments":
+    case "stream_ended_before_tool_call":
+    case "provider_error_before_tool_call":
+      return reason;
+    default:
+      return "invalid_tool_arguments";
+  }
+};
+
+/** Apply before accounting, retry, nessi loops, traces, capabilities, and loggers observe an adapter. */
+export const withProviderErrors = (provider: Provider, providerId?: string): Provider => ({
+  name: provider.name,
+  family: provider.family,
+  model: provider.model,
+  contextWindow: provider.contextWindow,
+  capabilities: provider.capabilities,
+  complete: async (request) => {
+    const marks: ProviderFetchMarks = {};
+    try {
+      const result = await runWithProviderFetchMarks(marks, () => provider.complete(request));
+      if (providerId && !request.signal?.aborted)
+        await recordAiProviderStatus(
+          providerId,
+          ["error", "aborted", "interrupted"].includes(result.finishReason ?? "")
+            ? classifyProviderFailure(marks.httpStatus ? { status: marks.httpStatus } : {})
+            : { status: "ok", message: "The provider connection works." },
+        );
+      return result;
+    } catch (error) {
+      if (providerId && !request.signal?.aborted)
+        await recordAiProviderStatus(
+          providerId,
+          classifyProviderFailure(marks.httpStatus ? { status: marks.httpStatus } : marks.networkFailure ? new TypeError() : error),
+        );
+      throw new AiProviderError(request.signal?.aborted);
+    }
+  },
+  stream: async function* (request) {
+    const marks: ProviderFetchMarks = {};
+    let iterator: AsyncIterator<StreamEvent> | undefined;
+    try {
+      const activeIterator = provider.stream(request)[Symbol.asyncIterator]();
+      iterator = activeIterator;
+      let failed = false;
+      for (;;) {
+        const next = await runWithProviderFetchMarks(marks, () => activeIterator.next());
+        if (next.done) break;
+        const event = next.value;
+        if (event.type === "issue" && (event.issue.kind === "provider_error" || event.issue.kind === "timeout")) {
+          failed = true;
+          if (providerId)
+            await recordAiProviderStatus(
+              providerId,
+              event.issue.kind === "timeout"
+                ? { status: "unreachable", message: "The provider timed out." }
+                : classifyProviderFailure(
+                    marks.httpStatus ? { status: marks.httpStatus } : marks.networkFailure ? new TypeError() : event.issue,
+                  ),
+            );
+        }
+        yield event.type === "issue" ? { type: "issue", issue: providerIssue(event.issue, request.tools) } : event;
+      }
+      if (providerId && !failed && !request.signal?.aborted)
+        await recordAiProviderStatus(providerId, { status: "ok", message: "The provider connection works." });
+    } catch (error) {
+      if (providerId && !request.signal?.aborted)
+        await recordAiProviderStatus(
+          providerId,
+          classifyProviderFailure(marks.httpStatus ? { status: marks.httpStatus } : marks.networkFailure ? new TypeError() : error),
+        );
+      // Includes synchronous creation, iteration, and iterator cleanup failures.
+      throw new AiProviderError(request.signal?.aborted);
+    } finally {
+      try {
+        await iterator?.return?.();
+      } catch {
+        throw new AiProviderError(request.signal?.aborted);
+      }
+    }
+  },
+});

package/src/ai/provider-fetch.ts

@@ -13,6 +13,8 @@ import { AsyncLocalStorage } from "node:async_hooks";
  */
 export type ProviderFetchMarks = {
   headersAt?: number;
+  httpStatus?: number;
+  networkFailure?: boolean;
   firstByteAt?: number;
   /** The request never reached the provider, or the provider answered with a status that says it did not process it. */
   refused?: boolean;
@@ -74,6 +76,7 @@ const install = (): void => {
     try {
       response = await realFetch(input, init);
     } catch (error) {
+      for (const store of stores) store.networkFailure = true;
       // A reset, an abort, or a timeout can follow delivery, so only an unsent request counts as refused.
       if (unsent(error))
         for (const store of stores) {
@@ -85,6 +88,7 @@ const install = (): void => {
     const wait = response.ok ? undefined : retryAfterMs(response.headers, headersAt);
     for (const store of stores) {
       store.headersAt = headersAt;
+      store.httpStatus = response.status;
       store.refused = refusedStatus(response.status);
       if (wait !== undefined) store.retryAfterMs = wait;
     }

package/src/ai/provider-retry.ts

@@ -8,7 +8,7 @@ export const AI_PROVIDER_RETRY_DELAYS_MS: readonly number[] = [1_000, 4_000];
 /**
  * The longest Retry-After that is honored, the bound the OpenAI and Anthropic
  * SDKs apply. A provider that asks for a longer wait is unavailable for this
- * turn, so the call fails now with the provider's message.
+ * turn, so the call fails now with Cloud's fixed provider error.
  */
 const AI_PROVIDER_MAX_RETRY_AFTER_MS = 60_000;
 

package/src/ai/provider.ts

@@ -1,5 +1,6 @@
 import type { Provider, ReasoningEffort } from "@k2b/nessi/ai";
 import { anthropic, completeFromStream, gemini, mistral, ollama, openAICompatible, openai, openrouter } from "@k2b/nessi/ai";
+import { withProviderErrors } from "./provider-errors";
 import type { AiModelProfile } from "./types";
 
 /** Bound the first response chunk and every gap between chunks to 60s, for chat and complete() calls. */
@@ -39,7 +40,7 @@ const commonOptions = (profile: AiModelProfile, apiKey?: string) => ({
 
 export const createAiProvider = (profile: AiModelProfile, apiKey?: string, headers?: Record<string, string>): Provider => {
   if (profile.capabilities.includes("transcription")) throw new Error("Transcription profiles cannot be used for chat generation.");
-  return completeThroughStream(createAdapter(profile, apiKey, headers));
+  return withProviderErrors(completeThroughStream(createAdapter(profile, apiKey, headers)), profile.providerId);
 };
 
 const createAdapter = (profile: AiModelProfile, apiKey?: string, headers?: Record<string, string>): Provider => {

package/src/ai/quota-limits.ts

@@ -0,0 +1,36 @@
+import { sql } from "bun";
+import { recursiveGroupIdsSubquery } from "../services/accounts/group-sql";
+import { toPgTextArray } from "../services/postgres";
+import { hasBillableAiPricing } from "../shared/ai-costs";
+import { readAiSettingsState } from "./settings";
+
+/** One row per rule; identities are deduplicated when several model rules apply. */
+export const aiPeopleAtLimit = async (db = sql): Promise<{ scope: string; people: string[] }[]> => {
+  const priced = [
+    ...new Set(
+      (await readAiSettingsState()).profiles.filter((profile) => hasBillableAiPricing(profile.pricing)).map((profile) => profile.modelId),
+    ),
+  ];
+  return db<{ scope: string; people: string[] }[]>`WITH rules AS MATERIALIZED (
+    SELECT r->>'scope' AS scope,r->'grants' AS grants,
+      (r->>'anchor')::timestamptz + floor(extract(epoch FROM (now()-(r->>'anchor')::timestamptz)) / ((r->>'hours')::int*3600)) * ((r->>'hours')::int*interval '1 hour') AS starts
+    FROM ai.cost_config,jsonb_array_elements(rules) r WHERE singleton AND enabled
+      AND (r->>'scope'='*' OR r->>'scope'=ANY(${toPgTextArray(priced)}::text[]))
+  ), people AS MATERIALIZED (
+    SELECT u.id FROM auth.users u WHERE EXISTS(SELECT 1 FROM ai.inference_calls WHERE kind='chat' AND user_id=u.id)
+      OR EXISTS(SELECT 1 FROM ai.conversations c JOIN ai.turns t ON t.conversation_id=c.id
+        WHERE c.created_by_user_id=u.id AND t.run_config->>'assistantChat'='true' AND t.run_config->'mandate' IS NULL)
+  ), allowances AS MATERIALIZED (
+    SELECT u.id,r.scope,r.starts,CASE WHEN bool_or(g->>'limit' IS NULL) FILTER(WHERE g IS NOT NULL) THEN NULL ELSE COALESCE(max((g->>'limit')::float8),0) END AS amount
+    FROM people u CROSS JOIN rules r LEFT JOIN LATERAL (
+      SELECT g FROM jsonb_array_elements(r.grants) g WHERE g->'principal'->>'type'='authenticated'
+        OR g->'principal'->>'userId'=u.id::text OR (g->'principal'->>'groupId')::uuid IN (${recursiveGroupIdsSubquery(sql`u.id`)})
+    ) grants ON true GROUP BY u.id,r.scope,r.starts
+  ), exhausted AS (
+    SELECT a.scope,a.id FROM allowances a LEFT JOIN ai.inference_calls c ON c.user_id=a.id AND c.kind='chat'
+      AND (a.scope='*' OR c.model_id=a.scope) AND c.started_at>=a.starts
+      AND c.started_at>COALESCE((SELECT max(created_at) FROM ai.cost_resets z WHERE z.user_id=a.id AND z.scope=a.scope),'-infinity'::timestamptz)
+    WHERE a.amount IS NOT NULL AND NOT EXISTS(SELECT 1 FROM allowances w WHERE w.id=a.id AND w.scope='*' AND w.amount IS NULL)
+    GROUP BY a.scope,a.id,a.amount HAVING COALESCE(sum(c.cost),0)>=a.amount
+  ) SELECT scope,array_agg(id::text ORDER BY id) AS people FROM exhausted GROUP BY scope`;
+};

package/src/ai/quota-provider.ts

@@ -3,11 +3,15 @@ import { estimateTokens, type Provider } from "@k2b/nessi";
 import { sql } from "bun";
 import type { AccessSubject } from "../server/services/access";
 import { logger } from "../services/logging";
+import type { AiResolvedModelRef } from "../shared/ai-models";
 import { isAssistantChatTurn } from "./assistant-models";
 import { AiBackgroundAdmissionError, type AiCallContext, type AiCallDetails, beginAiCall, finishAiCall } from "./inference-calls";
 import { type ProviderFetchMarks, runWithProviderFetchMarks } from "./provider-fetch";
 import type { AiModelProfile } from "./types";
 
+/** A dispatch guard refused the call before any provider request could leave. */
+export class AiProviderAdmissionError extends Error {}
+
 const log = logger("ai:quotas");
 
 /** One wrapper owns call accounting. complete() can have a separate compaction purpose. */
@@ -25,6 +29,8 @@ export function inferenceProvider(
   completeContext = context,
   lifecycle = callLifecycle,
 ): Provider {
+  // createAiProvider normalizes adapter diagnostics before trusted dispatch guards wrap it.
+  // Accounting must preserve those guards' error identity and zero-usage semantics.
   const begin = async (request: Parameters<Provider["complete"]>[0], ctx: AiCallContext) => {
     const messages = request.messages.map((message) =>
       message.role === "user"
@@ -108,6 +114,7 @@ export function inferenceProvider(
         if (status === "failed") error = `The provider finished with ${result.finishReason}.`;
         return result;
       } catch (thrown) {
+        if (thrown instanceof AiProviderAdmissionError) usage = { input: 0, output: 0 };
         error = thrown instanceof Error ? thrown.message : String(thrown);
         throw thrown;
       } finally {
@@ -183,6 +190,7 @@ export function inferenceProvider(
         }
         completed = true;
       } catch (thrown) {
+        if (thrown instanceof AiProviderAdmissionError) usage = { input: 0, output: 0 };
         error ??= thrown instanceof Error ? thrown.message : String(thrown);
         throw thrown;
       } finally {
@@ -223,7 +231,7 @@ export function inferenceProvider(
               firstByteMs: marks.firstByteAt === undefined ? undefined : marks.firstByteAt - requestStartedAt,
               firstBlockMs: marks.firstBlockAt === undefined ? undefined : marks.firstBlockAt - requestStartedAt,
             });
-          } catch (error) {
+          } catch {
             log.warn("Chat usage booking failed", { code: "quota_booking_failed", turnId: context.turnId, callId: id });
           }
         }
@@ -239,8 +247,9 @@ export function assistantQuotaProvider(
   profile: AiModelProfile,
   turnId: string,
   conversationId: string,
+  modelRef: AiResolvedModelRef,
 ) {
-  const common = { subject, turnId, conversationId };
+  const common = { subject, turnId, conversationId, modelRef };
   return inferenceProvider(
     provider,
     profile,