@k2b/cloud 0.42.0 → 0.44.0

package/src/services/app-events.ts

@@ -0,0 +1,92 @@
+import type { TopicDeadLetter, TopicInventoryEntry } from "@k2b/sync";
+import { type SQL, sql } from "bun";
+import { lazySync } from "../_internal/process-sync";
+import { getCapability, listCapabilities } from "../_internal/registry";
+import type { AppEventEnvelope } from "../contracts/app-events";
+import type { CapabilityRegistryEntry } from "../contracts/registry";
+import { appEventTopic } from "../events/app-event-delivery";
+import { createEventAcceptance } from "./app-events/accept";
+import { createEventAdministration } from "./app-events/admin";
+import { createDeclarationSync } from "./app-events/declarations";
+import { createEventDelivery } from "./app-events/deliver";
+import type { signAppEventInvocation } from "./identity/invocation-token";
+import { logger } from "./logging";
+
+export { APP_EVENT_DELIVERY_ATTEMPTS, APP_EVENT_DELIVERY_BACKOFF_MS } from "./app-events/deliver";
+
+const log = logger("app-events:broker");
+const topicInventory = lazySync((sync) => () => sync.listTopics({ idPrefix: "cloud:app-events" }));
+type BrokerDependencies = {
+  db?: SQL;
+  registry?: () => Promise<CapabilityRegistryEntry[]>;
+  getApp?: typeof getCapability;
+  fetch?: typeof fetch;
+  sign?: typeof signAppEventInvocation;
+  deadLetters?: (after?: string) => Promise<TopicDeadLetter<AppEventEnvelope>[]>;
+  streams?: () => AsyncIterable<Pick<TopicInventoryEntry, "id" | "firstSequence">>;
+};
+const message = (error: unknown): string => (error instanceof Error ? error.message : String(error)).slice(0, 1000);
+
+export const createAppEventBroker = (dependencies: BrokerDependencies = {}) => {
+  const db = dependencies.db ?? sql;
+  const registry = dependencies.registry ?? listCapabilities;
+  const declarations = createDeclarationSync(db, registry);
+  const admin = createEventAdministration(db, {
+    registry,
+    deadLetters: dependencies.deadLetters ?? ((after) => appEventTopic().deadLetters.list({ limit: 100, after })),
+    streams: dependencies.streams ?? (() => topicInventory()()),
+  });
+  const acceptance = createEventAcceptance(db, declarations.reconcileSubscriptions);
+  const delivery = createEventDelivery(db, dependencies.getApp ?? getCapability, declarations.reconcileSubscriptions, dependencies);
+  return { ...declarations, ...acceptance, ...delivery, ...admin };
+};
+
+export const appEventBroker = createAppEventBroker();
+export const startAppEventBroker = async (): Promise<() => Promise<void>> => {
+  const worker = await appEventTopic().process(
+    {
+      consumer: "core-app-events-v1",
+      start: "earliest",
+      concurrency: 1,
+      recoverDeadLetters: true,
+      delivery: { maxAttempts: 8, backoffMs: [1000, 5000, 30000, 120000, 600000, 1800000, 3600000], maxInFlight: 1 },
+    },
+    async (event) => {
+      try {
+        await appEventBroker.accept(event.data, event.sequence, event.attempt);
+      } catch (error) {
+        if (event.attempt >= 8) {
+          await appEventBroker.markSeen(event.sequence);
+        }
+        throw error;
+      }
+    },
+  );
+  let stopping = false;
+  let active: Promise<void> | null = null;
+  let tickCount = 0;
+  const run = () => {
+    if (stopping || active) return;
+    active = (async () => {
+      await appEventBroker.work();
+      if (++tickCount % 60 === 0) {
+        await appEventBroker.checkGap();
+        await appEventBroker.retain();
+      }
+    })()
+      .catch((error) => log.error("App event broker pass failed", { error: message(error) }))
+      .finally(() => {
+        active = null;
+      });
+  };
+  const timer = setInterval(run, 1000);
+  timer.unref();
+  run();
+  return async () => {
+    stopping = true;
+    clearInterval(timer);
+    worker.stop();
+    await worker.drain();
+    await active;
+  };
+};

package/src/services/config-conflict.ts

@@ -0,0 +1,11 @@
+export class ConfigConflict extends Error {
+  readonly code = "conflict";
+  constructor(
+    readonly current: unknown,
+    readonly changedBy: { id: string; name: string } | null,
+    readonly changedAt: string,
+    readonly key?: string,
+  ) {
+    super("This configuration changed. Read the current version before saving.");
+  }
+}

package/src/services/core-user-events.ts

@@ -0,0 +1 @@
+export { coreUserEvents, coreUserEventTypes } from "../events/core-user-created";

package/src/services/freeipa-config.ts

@@ -1,6 +1,8 @@
 import { X509Certificate } from "node:crypto";
+import type { SQL } from "bun";
 import { setFreeIpaTlsResolver } from "../server/services/freeipa/tls";
 import { coreSettings } from "./settings/api";
+import { readKeyState, SettingUnreadableError } from "./settings/store";
 
 const MAX_CA_CERT_BYTES = 256 * 1024;
 const PEM_CERTIFICATE_PATTERN = /-----BEGIN CERTIFICATE-----[\s\S]*?-----END CERTIFICATE-----/g;
@@ -82,6 +84,13 @@ const normalizeStringList = (value: unknown, fallback: string[] = []): string[]
   return normalized.length > 0 ? normalized : fallback;
 };
 
+/** Read the role mapping on the caller's connection during authorization. */
+export const getFreeIpaAdminGroups = async (db: SQL): Promise<string[]> => {
+  const state = await readKeyState("freeipa.groups.admin", db);
+  if (state.stored === "unreadable") throw new SettingUnreadableError("freeipa.groups.admin");
+  return normalizeStringList(state.value, ["admins"]);
+};
+
 /**
  * Read the full FreeIPA config snapshot from settings (Redis cache-aside +
  * Postgres fallback). Always returns within Redis-TTL fresh data — no hidden

package/src/services/geo/admin.ts

@@ -146,7 +146,7 @@ export const createGeoAdmin = (options: { db?: SQL; verify?: Verify; now?: () =>
     const config = await readGeoConfig();
     const periods = geoPeriods(now(), config.timezone);
     const plan = config.plan === "custom" ? { dailyCredits: config.customDailyCredits } : GEO_PLANS[config.plan];
-    const [[month], [today], shares] = await Promise.all([
+    const [[month], [today], shares, [overruns]] = await Promise.all([
       db<
         { used: number }[]
       >`SELECT used::float8 AS used FROM geo.usage WHERE scope = 'cloud' AND subject = '*' AND period = ${periods.cloud.period}`,
@@ -155,6 +155,8 @@ export const createGeoAdmin = (options: { db?: SQL; verify?: Verify; now?: () =>
         FROM geo.usage WHERE scope = 'person' AND period = ${periods.person.period}`,
       db<{ function_group: string; used: number }[]>`
         SELECT function_group, used::float8 AS used FROM geo.shares WHERE scope = 'cloud' AND subject = '*' AND period = ${periods.cloud.period}`,
+      db<{ count: number }[]>`SELECT count(*)::int AS count FROM audit.events
+        WHERE action = 'core.geo.route_cost_overrun' AND metadata->>'period' = ${periods.cloud.period}`,
     ]);
     return {
       month: {
@@ -174,6 +176,7 @@ export const createGeoAdmin = (options: { db?: SQL; verify?: Verify; now?: () =>
         credits: (shares.find((row) => row.function_group === group)?.used ?? 0) / 1000,
       })),
       peopleAtLimit: today?.at_limit ?? 0,
+      routeCostOverruns: overruns?.count ?? 0,
       timezone: config.timezone,
     };
   };

package/src/services/geo/ledger.ts

@@ -1,4 +1,5 @@
 import { type SQL, sql } from "bun";
+import type { AppPwaActor } from "../../app-pwa/contracts";
 import type { AccessSubject, CapabilityExecutionContext } from "../../contracts";
 import { audit } from "../audit";
 import { GeoError } from "./errors";
@@ -52,9 +53,21 @@ export const createGeoLedger = (db: SQL = sql) => ({
       for (const row of rows)
         await tx`INSERT INTO geo.usage(scope,subject,period) VALUES(${row.scope},${row.subject},${row.period}) ON CONFLICT DO NOTHING`;
       for (const row of rows) {
+        // Keep the refusal's available/shortfall numbers in the same row-lock snapshot as admission.
+        const [balance] = await tx<{ used: number }[]>`SELECT used::float8 AS used FROM geo.usage
+          WHERE scope=${row.scope} AND subject=${row.subject} AND period=${row.period} FOR UPDATE`;
         const changed = await tx`UPDATE geo.usage SET used=used+${cost} WHERE scope=${row.scope} AND subject=${row.subject}
           AND period=${row.period} AND used+${cost}<=${row.limit} RETURNING used`;
-        if (!changed.length) throw new GeoError("GEO_BUDGET_EXHAUSTED", { scope: row.scope, resetsAt: row.resetsAt });
+        if (!changed.length) {
+          const available = row.limit - (balance?.used ?? 0);
+          throw new GeoError("GEO_BUDGET_EXHAUSTED", {
+            scope: row.scope,
+            resetsAt: row.resetsAt,
+            requiredCredits: cost / 1000,
+            availableCredits: available / 1000,
+            shortfallCredits: (cost - available) / 1000,
+          });
+        }
       }
       for (const row of rows)
         await tx`INSERT INTO geo.shares(scope,subject,period,function_group,used)
@@ -88,32 +101,52 @@ export const createGeoLedger = (db: SQL = sql) => ({
     return { cloud: balances[0]!, person: balances[1]! };
   },
   async recordTransition(
-    event: "provider_key_rejected" | "monthly_budget_exhausted",
+    event: "provider_key_rejected" | "monthly_budget_exhausted" | "route_cost_overrun",
     timezone: string,
-    context: Pick<CapabilityExecutionContext, "actor"> & Partial<Pick<CapabilityExecutionContext, "requestId">>,
+    context: { actor: CapabilityExecutionContext["actor"] | AppPwaActor; requestId?: string },
     now: Date,
+    metadata: Record<string, number> = {},
   ) {
     const period = geoPeriods(now, timezone).cloud.period;
     await db.begin(async (tx) => {
       const inserted =
-        await tx`INSERT INTO geo.audit_transitions(event,period) VALUES(${event},${period}) ON CONFLICT DO NOTHING RETURNING event`;
+        event === "route_cost_overrun"
+          ? [true]
+          : await tx`INSERT INTO geo.audit_transitions(event,period) VALUES(${event},${period}) ON CONFLICT DO NOTHING RETURNING event`;
       if (!inserted.length) return;
       const actor =
-        context.actor.kind === "user"
-          ? {
-              userId: context.actor.user.id,
-              uid: context.actor.user.uid,
-              provider: context.actor.user.provider,
-              roles: context.actor.user.roles,
-            }
-          : { uid: `service-account:${context.actor.serviceAccount.id}`, provider: "service_account", roles: context.actor.scopes };
+        context.actor.kind === "device" || context.actor.kind === "visit"
+          ? null
+          : context.actor.kind === "user"
+            ? {
+                userId: context.actor.user.id,
+                uid: context.actor.user.uid,
+                provider: context.actor.user.provider,
+                roles: context.actor.user.roles,
+              }
+            : { uid: `service-account:${context.actor.serviceAccount.id}`, provider: "service_account", roles: context.actor.scopes };
       await audit.record(
         {
           action: `core.geo.${event}`,
-          outcome: event === "provider_key_rejected" ? "failed" : "denied",
+          outcome: event === "monthly_budget_exhausted" ? "denied" : "failed",
           actor,
           requestId: context.requestId,
-          metadata: { period },
+          metadata: {
+            period,
+            ...metadata,
+            ...(context.actor.kind === "device" || context.actor.kind === "visit"
+              ? {
+                  appId: context.actor.appId,
+                  subject: { type: "user", userId: context.actor.ownerUserId },
+                  via: {
+                    kind: context.actor.kind,
+                    appId: context.actor.appId,
+                    deviceId: context.actor.deviceId,
+                    ...(context.actor.kind === "visit" ? { visitId: context.actor.visitId } : {}),
+                  },
+                }
+              : {}),
+          },
         },
         tx,
       );

package/src/services/geo/route-chain.ts

@@ -16,11 +16,16 @@ export type GeoRouteChainDependencies = {
   bucket: ReturnType<typeof createGeoBucket>;
   ledger: ReturnType<typeof createGeoLedger>;
   now: () => Date;
-  recordTransition: (event: "monthly_budget_exhausted" | "provider_key_rejected", timezone: string, context: GeoContext) => Promise<void>;
+  recordTransition: (
+    event: "monthly_budget_exhausted" | "provider_key_rejected" | "route_cost_overrun",
+    timezone: string,
+    context: GeoContext,
+    metadata?: Record<string, number>,
+  ) => Promise<boolean | void>;
 };
-export type GeoRouteCallPricing = { pairs: number; avoids: number; optimize: boolean; distanceAllowanceMeters: number };
+export type GeoRouteCallPricing = { pairs: number; avoids: number; optimize: boolean; estimatedDistanceMeters: number };
 export const reserveRouteCall = (pricing: GeoRouteCallPricing) =>
-  geoRouteReferenceCost({ ...pricing, distanceMeters: pricing.pairs * pricing.distanceAllowanceMeters });
+  geoRouteReferenceCost({ ...pricing, distanceMeters: pricing.estimatedDistanceMeters });
 export type GeoRouteChainCall = <V>(
   fn: GeoFunction,
   input: unknown,
@@ -53,26 +58,28 @@ export const runGeoRouteChain = async <T>(
   let known = 0,
     unknown = 0;
   let result: T | undefined, failure: unknown;
+  let overrun:
+    | { estimatedDistanceMeters: number; actualDistanceMeters: number; reservedCredits: number; actualCredits: number }
+    | undefined;
   try {
     result = await work(async (fn, input, schema, request, pricing, distance) => {
       context.signal?.throwIfAborted();
       const key = geoCacheKey(fn, input, context.locale ?? "en");
       const hit = await cache.get(key, schema);
-      if (hit !== null) {
-        // A cached response still must respect this call's reference allowance.
-        if (pricing && distance && distance(hit) > pricing.pairs * pricing.distanceAllowanceMeters)
-          throw new GeoError("GEO_COST_OVERRUN", {
-            distanceAllowanceMeters: pricing.distanceAllowanceMeters,
-            actualDistanceMeters: distance(hit),
-          });
-        return hit;
-      }
+      if (hit !== null) return hit; // Cached provider results incur no new cost.
       const allocated = pricing ? reserveRouteCall(pricing) : geoReferenceCost({ fn });
       const debitKnown = (meters: number) => {
         try {
           const cost = pricing ? geoRouteReferenceCost({ ...pricing, distanceMeters: meters }) : allocated;
           if (!Number.isSafeInteger(known + unknown + cost)) throw new Error("Unrepresentable reference cost");
           known += cost;
+          if (pricing && cost > allocated)
+            overrun = {
+              estimatedDistanceMeters: pricing.estimatedDistanceMeters,
+              actualDistanceMeters: meters,
+              reservedCredits: allocated / 1000,
+              actualCredits: cost / 1000,
+            };
         } catch {
           // A sent request never becomes free because the provider's distance cannot be priced safely.
           unknown += allocated;
@@ -106,13 +113,9 @@ export const runGeoRouteChain = async <T>(
         const actualDistance = pricing && distance ? distance(parsed.data) : 0;
         debitKnown(actualDistance);
         if (signal.aborted) throw new GeoError("GEO_PROVIDER_FAILED");
-        // Retain valid paid results even on overrun, so an explicitly larger allowance can reuse them.
+        // Retain paid results even on overrun so an explicit retry can reuse them without paying again.
         await cache.put(key, fn, parsed.data, false);
-        if (pricing && actualDistance > pricing.pairs * pricing.distanceAllowanceMeters)
-          throw new GeoError("GEO_COST_OVERRUN", {
-            distanceAllowanceMeters: pricing.distanceAllowanceMeters,
-            actualDistanceMeters: actualDistance,
-          });
+        if (overrun) throw new GeoError("GEO_COST_OVERRUN", overrun);
         return parsed.data;
       } finally {
         await release();
@@ -121,9 +124,13 @@ export const runGeoRouteChain = async <T>(
   } catch (error) {
     failure = error;
   }
+  if (overrun) failure = new GeoError("GEO_COST_OVERRUN", overrun);
+  const knownReferenceCredits = known / 1000;
+  let settlementConfirmed = true;
   try {
     await ledger.settle(reservation, known + unknown);
   } catch {
+    settlementConfirmed = false;
     // Keep the original admission debit, and make failed reconciliation visible without retaining a provider cause.
     failure = new GeoError("GEO_PROVIDER_FAILED", {
       adminHint:
@@ -139,6 +146,21 @@ export const runGeoRouteChain = async <T>(
   }
   if (failure) {
     const error = failure instanceof GeoError ? failure : new GeoError("GEO_PROVIDER_FAILED");
+    if (overrun) {
+      const recorded = await dependencies.recordTransition("route_cost_overrun", config.timezone, context, {
+        reservedCredits: reservation.cost / 1000,
+        settledCredits: known / 1000,
+        unknownCredits: unknown / 1000,
+        knownReferenceCredits,
+        settlementConfirmed: settlementConfirmed ? 1 : 0,
+        estimatedCallCredits: overrun.reservedCredits,
+        actualCallCredits: overrun.actualCredits,
+      });
+      if (recorded === false)
+        error.details.adminHint =
+          "The routing cost overrun could not be recorded in the audit log. Reconcile the reported costs before retrying. " +
+          (typeof error.details.adminHint === "string" ? error.details.adminHint : "");
+    }
     throw new GeoError(error.code, { ...error.details, costs: { settledCredits: known / 1000, unknownCredits: unknown / 1000 } });
   }
   return result!;

package/src/services/geo/route-estimate.ts

@@ -0,0 +1,19 @@
+import type { GeoRouteResolvedStop } from "../../contracts/geo-route";
+import { geoDistance } from "./polyline";
+
+// Cloud technical budget policy, 2026-10-22: straight-line distance × 2.0.
+// Source: places-and-maps.md#reserve-estimated-routing-costs (coordinator decision).
+// This is an admission estimate, not a Geoapify guarantee or a measured detour bound.
+// All checked routing fixtures are synthetic; no measured fixture supersedes this policy.
+export const GEO_ROUTE_DETOUR_FACTOR = 2.0;
+// Maximum great-circle distance on the same sphere used by geoDistance. Unknown addresses
+// must not become zero-distance legs before geocoding; known coordinates avoid this reserve.
+const MAX_STRAIGHT_LINE_METERS = geoDistance({ lat: 0, lon: 0 }, { lat: 0, lon: 180 });
+type Stop = GeoRouteResolvedStop | undefined;
+export const estimateRouteDistance = (stops: readonly Stop[], reorder = false) => {
+  const distance = (a: Stop, b: Stop) => (a && b ? geoDistance(a.point, b.point) : MAX_STRAIGHT_LINE_METERS);
+  const diameter = reorder ? Math.max(0, ...stops.flatMap((a, i) => stops.slice(i + 1).map((b) => distance(a, b)))) : 0;
+  return Math.ceil(
+    stops.slice(1).reduce((sum, stop, i) => sum + (reorder ? diameter : distance(stops[i], stop)), 0) * GEO_ROUTE_DETOUR_FACTOR,
+  );
+};

package/src/services/geo/route-plan.ts

@@ -84,14 +84,12 @@ export const assembleRoute = (
   defaults: GeoRouteOptions,
   originalLegs: GeoRouteLeg[],
   now: Date,
-  distanceAllowanceMeters: number,
 ): GeoRoute => {
   let legs = originalLegs;
   const build = (): GeoRoute => ({
     stops,
     options: defaults,
     legs,
-    distanceAllowanceMeters,
     distanceMeters: legs.reduce((sum, leg) => sum + leg.distanceMeters, 0),
     durationSeconds: legs.reduce((sum, leg) => sum + leg.durationSeconds, 0),
     polyline6: joinRouteLines(legs.map((leg) => leg.polyline6)),

package/src/services/geo/route-service.ts

@@ -16,7 +16,7 @@ import {
   GeoRouteUpdateInputSchema,
 } from "../../contracts/geo-route";
 import { geoCacheKey, normalizeGeoInput } from "./cache";
-import { GeoError, limitExceeded } from "./errors";
+import { GeoError, GeoProviderError, limitExceeded } from "./errors";
 import type { GeoapifyAdapter } from "./geoapify";
 import { geoDistance } from "./polyline";
 import {
@@ -26,6 +26,7 @@ import {
   reserveRouteCall,
   runGeoRouteChain,
 } from "./route-chain";
+import { estimateRouteDistance } from "./route-estimate";
 import {
   assembleRoute,
   insertionGaps,
@@ -120,18 +121,18 @@ export const createGeoRouteService = (
       },
     };
   };
-  const pricing = (step: PlannedCall, allowance: number): GeoRouteCallPricing => ({
+  const pricing = (step: PlannedCall, stops: readonly (GeoRouteResolvedStop | undefined)[], reorder = false): GeoRouteCallPricing => ({
     pairs: step.ids.length - 1,
     avoids: step.options.avoid?.length ?? 0,
     optimize: step.optimize,
-    distanceAllowanceMeters: allowance,
+    estimatedDistanceMeters: reorder
+      ? (estimateRouteDistance(stops, true) / (stops.length - 1)) * (step.ids.length - 1)
+      : estimateRouteDistance(
+          step.ids.map((id) => stops.find((stop) => stop?.id === id)),
+          step.optimize,
+        ),
   });
-  const preflight = (
-    stops: readonly (GeoRouteResolvedStop | undefined)[],
-    options: GeoRouteOptions,
-    allowance: number,
-    optimize = false,
-  ) => {
+  const preflight = (stops: readonly (GeoRouteResolvedStop | undefined)[], options: GeoRouteOptions, optimize = false) => {
     if (optimize) {
       // Every route connects all known stops. Their minimum spanning tree is an order-independent lower bound.
       const known = stops.filter((stop): stop is GeoRouteResolvedStop => !!stop);
@@ -153,7 +154,6 @@ export const createGeoRouteService = (
         lowerBound += shortest;
       }
       const pairs = stops.length - 1;
-      if (lowerBound > pairs * allowance) limitExceeded("distanceAllowanceMeters", pairs * allowance, lowerBound);
       if (options.mode === "walk" && lowerBound > pairs * 100_000) limitExceeded("walk.legMeters", pairs * 100_000, lowerBound);
       return;
     }
@@ -161,27 +161,41 @@ export const createGeoRouteService = (
       const a = stops[i - 1],
         b = stops[i];
       if (!a || !b) continue;
-      const distance = geoDistance(a.point, b.point);
-      if (distance > allowance) limitExceeded("distanceAllowanceMeters", allowance, distance);
       walkDistance([a, b], options);
     }
   };
   const execute = async (
     step: PlannedCall,
     stops: readonly GeoRouteResolvedStop[],
-    allowance: number,
     call: RouteCall,
     config: GeoConfig,
     context: GeoContext,
   ) => {
     const selected = step.ids.map((id) => stops.find((stop) => stop.id === id)!);
-    preflight(selected, step.options, allowance, step.optimize);
+    preflight(selected, step.options, step.optimize);
     return call(
       "route",
       { stops: selected, options: step.options, optimize: step.optimize },
       providerData,
-      (signal) => dependencies.adapter.route(selected, step.options, step.optimize, config.apiKey, context.locale ?? "en", signal),
-      pricing(step, allowance),
+      async (signal) => {
+        const result = await dependencies.adapter.route(
+          selected,
+          step.options,
+          step.optimize,
+          config.apiKey,
+          context.locale ?? "en",
+          signal,
+        );
+        try {
+          // Intermediate paid responses (including overruns) must fit the same cache bound
+          // as final routes. Keep distance totals exact while compacting only geometry.
+          const compact = assembleRoute(result.stops, step.options, result.legs, dependencies.now());
+          return { stops: compact.stops, legs: compact.legs, distanceMeters: result.distanceMeters };
+        } catch {
+          throw new GeoProviderError("GEO_PROVIDER_FAILED", "known", false, result.distanceMeters);
+        }
+      },
+      pricing(step, stops),
       (data) => data.distanceMeters,
     );
   };
@@ -189,14 +203,12 @@ export const createGeoRouteService = (
     const config = await dependencies.configured(context);
     const { plan } = parse(GeoRouteCalculateInputSchema, input);
     const { defaults, byDeparture } = validateRoutePlan(plan);
-    const allowance = plan.distanceAllowanceMeters ?? 500_000;
     const key = geoCacheKey(
       "route",
       {
         calculate: {
           stops: plan.stops.map((stop) => (stop.address ? { ...stop, address: normalizeGeoInput(stop.address, "geocode") } : stop)),
           options: defaults,
-          distanceAllowanceMeters: allowance,
           optimize: plan.optimize ?? false,
           legOptions: plan.stops.flatMap((stop) => {
             const options = byDeparture.get(stop.id);
@@ -229,27 +241,26 @@ export const createGeoRouteService = (
       preflight(
         step.ids.map((id) => prepared.known[plan.stops.findIndex((stop) => stop.id === id)]),
         step.options,
-        allowance,
         step.optimize,
       );
     const result = await runGeoRouteChain(
       dependencies,
       context,
       config,
-      prepared.cost + steps.reduce((sum, step) => sum + reserveRouteCall(pricing(step, allowance)), 0),
+      prepared.cost + steps.reduce((sum, step) => sum + reserveRouteCall(pricing(step, prepared.known, plan.optimize)), 0),
       async (call) => {
         let stops = await prepared.resolve(call, config);
         let legs: GeoRouteLeg[] = [];
         const first = steps[0]!;
         if (plan.optimize) {
-          const optimized = await execute(first, stops, allowance, call, config, context);
+          const optimized = await execute(first, stops, call, config, context);
           stops = optimized.stops;
           legs = optimized.legs;
           for (let i = 0; i < legs.length; i++) {
             const options = byDeparture.get(stops[i]!.id);
             if (options && !sameRouteOptions(options, defaults)) {
               const step = { ids: [stops[i]!.id, stops[i + 1]!.id], options, optimize: false };
-              legs[i] = (await execute(step, stops, allowance, call, config, context)).legs[0]!;
+              legs[i] = (await execute(step, stops, call, config, context)).legs[0]!;
             }
           }
         } else {
@@ -258,11 +269,10 @@ export const createGeoRouteService = (
             preflight(
               step.ids.map((id) => stops.find((stop) => stop.id === id)!),
               step.options,
-              allowance,
             );
-          for (const step of steps) legs.push(...(await execute(step, stops, allowance, call, config, context)).legs);
+          for (const step of steps) legs.push(...(await execute(step, stops, call, config, context)).legs);
         }
-        return { route: assembleRoute(stops, defaults, legs, dependencies.now(), allowance) };
+        return { route: assembleRoute(stops, defaults, legs, dependencies.now()) };
       },
     );
     await dependencies.cache.put(key, "route", result, false);
@@ -270,9 +280,8 @@ export const createGeoRouteService = (
   };
   const update = async (input: GeoRouteUpdateInput, context: GeoContext): Promise<GeoRouteUpdateData> => {
     const config = await dependencies.configured(context);
-    const { route, changes, distanceAllowanceMeters } = parse(GeoRouteUpdateInputSchema, input);
+    const { route, changes } = parse(GeoRouteUpdateInputSchema, input);
     validateSavedRoute(route);
-    const allowance = distanceAllowanceMeters ?? route.distanceAllowanceMeters;
     const key = geoCacheKey("route", { update: input }, context.locale ?? "en");
     const cached = await dependencies.cache.get(key, GeoRouteUpdateDataSchema);
     if (cached) return cached;
@@ -298,12 +307,15 @@ export const createGeoRouteService = (
           options: route.legs[index]!.options,
           optimize: false,
         });
-      steps.sort((a, b) => reserveRouteCall(pricing(b, allowance)) - reserveRouteCall(pricing(a, allowance)));
+      steps.sort(
+        (a, b) =>
+          reserveRouteCall(pricing(b, [...stops, inserted!.known[0]])) - reserveRouteCall(pricing(a, [...stops, inserted!.known[0]])),
+      );
       steps.splice(3);
       const point = inserted.known[0];
       if (point)
         for (const index of fixedGap !== undefined ? [fixedGap] : insertionGaps(route, point.point))
-          preflight([stops[index], point, stops[index + 1]], route.legs[index]!.options, allowance);
+          preflight([stops[index], point, stops[index + 1]], route.legs[index]!.options);
     } else if (changes.type === "move") {
       const index = stops.findIndex((stop) => stop.id === changes.stopId);
       if (index < 0 || changes.toIndex >= stops.length) throw new GeoError("GEO_UNSUPPORTED_OPTION");
@@ -344,7 +356,6 @@ export const createGeoRouteService = (
         preflight(
           step.ids.map((id) => stops.find((stop) => stop.id === id)!),
           step.options,
-          allowance,
           step.optimize,
         );
     const work = async (call: RouteCall) => {
@@ -353,7 +364,7 @@ export const createGeoRouteService = (
         const [point] = await inserted!.resolve(call, config);
         const gaps = fixedGap !== undefined ? [fixedGap] : insertionGaps(route, point!.point);
         // Resolve and validate every candidate before the first paid route request.
-        for (const index of gaps) preflight([stops[index], point, stops[index + 1]], route.legs[index]!.options, allowance);
+        for (const index of gaps) preflight([stops[index], point, stops[index + 1]], route.legs[index]!.options);
         let winner: { index: number; legs: GeoRouteLeg[]; detour: number; meters: number } | undefined;
         for (const index of gaps) {
           let result: z.infer<typeof providerData>;
@@ -361,7 +372,6 @@ export const createGeoRouteService = (
             result = await execute(
               { ids: [stops[index]!.id, point!.id, stops[index + 1]!.id], options: route.legs[index]!.options, optimize: false },
               [...stops, point!],
-              allowance,
               call,
               config,
               context,
@@ -385,20 +395,19 @@ export const createGeoRouteService = (
         };
         stops.splice(winner!.index + 1, 0, point!);
       } else if (changes.type === "optimize") {
-        const result = await execute(steps[0]!, stops, allowance, call, config, context);
+        const result = await execute(steps[0]!, stops, call, config, context);
         stops = result.stops;
         legs = result.legs;
         for (let i = 0; i < legs.length; i++) {
           const options = byDeparture.get(stops[i]!.id) ?? defaults;
           if (!sameRouteOptions(options, defaults))
-            legs[i] = (
-              await execute({ ids: [stops[i]!.id, stops[i + 1]!.id], options, optimize: false }, stops, allowance, call, config, context)
-            ).legs[0]!;
+            legs[i] = (await execute({ ids: [stops[i]!.id, stops[i + 1]!.id], options, optimize: false }, stops, call, config, context))
+              .legs[0]!;
         }
       } else {
         const replacements = new Map<string, GeoRouteLeg>();
         for (const step of steps)
-          for (const leg of (await execute(step, stops, allowance, call, config, context)).legs) replacements.set(leg.fromStopId, leg);
+          for (const leg of (await execute(step, stops, call, config, context)).legs) replacements.set(leg.fromStopId, leg);
         legs = stops
           .slice(0, -1)
           .map(
@@ -406,7 +415,11 @@ export const createGeoRouteService = (
               replacements.get(stop.id) ?? route.legs.find((leg) => leg.fromStopId === stop.id && leg.toStopId === stops[i + 1]!.id)!,
           );
       }
-      const next = assembleRoute(stops, defaults, legs, dependencies.now(), allowance);
+      const unchanged =
+        sameRouteOptions(defaults, route.options) &&
+        stops.every((stop, i) => stop === route.stops[i]) &&
+        legs.every((leg, i) => leg === route.legs[i]);
+      const next = unchanged ? route : assembleRoute(stops, defaults, legs, dependencies.now());
       const before = routeSummary(route),
         after = routeSummary(next);
       return GeoRouteUpdateDataSchema.parse({
@@ -420,7 +433,12 @@ export const createGeoRouteService = (
         ...(insertion ? { insertion } : {}),
       });
     };
-    const cost = (inserted?.cost ?? 0) + steps.reduce((sum, step) => sum + reserveRouteCall(pricing(step, allowance)), 0);
+    const cost =
+      (inserted?.cost ?? 0) +
+      steps.reduce(
+        (sum, step) => sum + reserveRouteCall(pricing(step, inserted ? [...stops, inserted.known[0]] : stops, changes.type === "optimize")),
+        0,
+      );
     const result = cost
       ? await runGeoRouteChain(dependencies, context, config, cost, work)
       : await work(async () => {