@k2b/cloud 0.43.0 → 0.44.0

package/src/ai/projects.ts

@@ -12,6 +12,7 @@ import {
 } from "../server/services/access";
 import { stripImageMetadata } from "../services/image-metadata";
 import { toPgUuidArray } from "../services/postgres";
+import { type AiModelRequest, AiModelRequestSchema } from "../shared/ai-models";
 import { AiFileVersionConflict, AiFileWriteError, aiFileContentVersion } from "./file-content-version";
 import { isAiImage } from "./file-media-type";
 import { mountAiProjectFilePath } from "./file-mount";
@@ -42,7 +43,7 @@ export type AiProject = {
   description: string;
   icon: string;
   instructions: string;
-  defaultModelProfileId: string | null;
+  defaultModel: AiModelRequest | null;
   permission: AiProjectPermission;
   revision: number;
   createdAt: string;
@@ -115,7 +116,7 @@ type ProjectRow = {
   description: string;
   icon: string;
   instructions: string;
-  default_model_profile_id: string | null;
+  default_model: AiModelRequest | null;
   revision: number;
   created_at: Date | string;
   updated_at: Date | string;
@@ -213,7 +214,7 @@ const toProject = async (row: ProjectRow, subject: AccessSubject | null, db: SQL
     description: row.description,
     icon: row.icon,
     instructions: row.instructions,
-    defaultModelProfileId: row.default_model_profile_id,
+    defaultModel: row.default_model ? AiModelRequestSchema.parse(row.default_model) : null,
     permission,
     revision: Number(row.revision),
     createdAt: iso(row.created_at),
@@ -417,17 +418,17 @@ export const aiProjects = {
     description?: string;
     icon?: string;
     instructions?: string;
-    defaultModelProfileId?: string | null;
+    defaultModel?: AiModelRequest | null;
   }): Promise<AiProject> {
     return sql.begin(async (tx) => {
       const rows = await withAiShortIdForDb(
         tx,
         "idx_ai_projects_short_id",
         (attempt, shortId) => attempt<ProjectRow[]>`
-        INSERT INTO ai.projects (short_id, name, description, icon, instructions, default_model_profile_id)
+        INSERT INTO ai.projects (short_id, name, description, icon, instructions, default_model)
         VALUES (
           ${shortId}, ${input.name.trim()}, ${input.description?.trim() ?? ""}, ${input.icon?.trim() || "ti ti-folders"},
-          ${input.instructions?.trim() ?? ""}, ${input.defaultModelProfileId?.trim() || null}
+          ${input.instructions?.trim() ?? ""}, ${input.defaultModel ? JSON.stringify(AiModelRequestSchema.parse(input.defaultModel)) : null}::text::jsonb
         )
         RETURNING *
       `,
@@ -488,9 +489,9 @@ export const aiProjects = {
   async update(
     projectId: string,
     subject: AccessSubject | null,
-    input: Partial<Pick<AiProject, "name" | "description" | "icon" | "instructions" | "defaultModelProfileId">>,
+    input: Partial<Pick<AiProject, "name" | "description" | "icon" | "instructions" | "defaultModel">>,
   ): Promise<AiProject | null> {
-    const changesTrustedInstructions = Object.hasOwn(input, "instructions") || Object.hasOwn(input, "defaultModelProfileId");
+    const changesTrustedInstructions = Object.hasOwn(input, "instructions") || Object.hasOwn(input, "defaultModel");
     if (!(await requireProject(projectId, subject, changesTrustedInstructions ? "admin" : "write"))) return null;
     const rows = await sql<ProjectRow[]>`
       UPDATE ai.projects
@@ -498,9 +499,9 @@ export const aiProjects = {
           description = COALESCE(${input.description?.trim() ?? null}, description),
           icon = COALESCE(${input.icon?.trim() ?? null}, icon),
           instructions = COALESCE(${input.instructions?.trim() ?? null}, instructions),
-          default_model_profile_id = CASE
-            WHEN ${Object.hasOwn(input, "defaultModelProfileId")} THEN ${input.defaultModelProfileId?.trim() || null}
-            ELSE default_model_profile_id
+          default_model = CASE
+            WHEN ${Object.hasOwn(input, "defaultModel")} THEN ${input.defaultModel ? JSON.stringify(AiModelRequestSchema.parse(input.defaultModel)) : null}::text::jsonb
+            ELSE default_model
           END,
           revision = revision + 1,
           updated_at = now()
@@ -563,7 +564,7 @@ export const aiProjects = {
         instructions: project.instructions,
         context: lines.join("\n").slice(0, AI_PROJECT_PROMPT_MANIFEST_MAX_CHARS),
         references: references.map((reference) => reference.ref),
-        defaultModelProfileId: project.defaultModelProfileId,
+        defaultModel: project.defaultModel,
       };
     });
   },

package/src/ai/protocol.ts

@@ -90,7 +90,7 @@ export type AiTurnFinishedStatus = "completed" | "failed" | "aborted";
 export type AiWireEvent =
   | (AiWireEventBase & {
       type: "turn_started";
-      modelProfileId: string;
+      modelId: string;
       providerModel: string;
       /** Authoritative ordered baseline for this attempt. Optional for older senders. */
       blocks?: AiTurnBlock[];
@@ -116,7 +116,7 @@ export type AiTurnSnapshot = {
   /** Last wire seq reflected in `blocks` (attempt-scoped). */
   seq: number;
   blocks: AiTurnBlock[];
-  modelProfileId: string | null;
+  modelId: string | null;
   createdAt: string;
   /** Time the turn already waited for answered user actions such as approvals. Absent from older servers. */
   actionWaitMs?: number;

package/src/ai/provider-connections.ts

@@ -0,0 +1,161 @@
+import { sql } from "bun";
+import { z } from "zod";
+import type { AiProvider } from "../shared/ai-models";
+import { getAiCredential } from "./credentials";
+import { getAiRequestHeaders } from "./request-headers";
+
+export type AiProviderTestResult = {
+  status: "ok" | "unreachable" | "key_rejected" | "error";
+  httpStatus?: number;
+  message: string;
+  latencyMs?: number;
+};
+export type AiAvailableProviderModel = { providerModel: string; label?: string; kind?: "chat" | "transcription"; contextWindow?: number };
+type Connection = Pick<AiProvider, "type" | "baseUrl"> & { apiKey?: string; headers?: Record<string, string> };
+const defaults = {
+  openai: "https://api.openai.com/v1",
+  openrouter: "https://openrouter.ai/api/v1",
+  anthropic: "https://api.anthropic.com/v1",
+  mistral: "https://api.mistral.ai/v1",
+  gemini: "https://generativelanguage.googleapis.com/v1beta/openai",
+  ollama: "http://localhost:11434",
+  vllm: "http://localhost:8000/v1",
+  "openai-compatible": "",
+};
+export class AiProviderListError extends Error {
+  constructor(
+    readonly code: "unreachable" | "key_rejected" | "list_failed",
+    message: string,
+    readonly httpStatus?: number,
+  ) {
+    super(message);
+  }
+}
+export const classifyProviderFailure = (error: unknown): AiProviderTestResult => {
+  const details = z
+    .object({ status: z.number().optional(), statusCode: z.number().optional(), code: z.string().optional(), name: z.string().optional() })
+    .passthrough()
+    .safeParse(error);
+  const httpStatus =
+    error instanceof AiProviderListError
+      ? error.httpStatus
+      : details.success
+        ? (details.data.status ?? details.data.statusCode)
+        : undefined;
+  const status =
+    httpStatus === 401 || httpStatus === 403
+      ? "key_rejected"
+      : (error instanceof AiProviderListError && error.code === "unreachable") ||
+          error instanceof TypeError ||
+          (details.success && ["TimeoutError", "AbortError"].includes(details.data.name ?? "")) ||
+          (details.success && ["ECONNREFUSED", "ETIMEDOUT", "ENOTFOUND", "ECONNRESET"].includes(details.data.code ?? ""))
+        ? "unreachable"
+        : "error";
+  return {
+    status,
+    ...(httpStatus ? { httpStatus } : {}),
+    message:
+      status === "key_rejected"
+        ? "The provider rejected the credential."
+        : status === "unreachable"
+          ? "The provider did not respond within 10 seconds or could not be reached."
+          : "The provider request failed.",
+  };
+};
+/** Best-effort persistence never rejects: callers await it inside their provider error boundary. */
+export const recordAiProviderStatus = async (id: string, result: AiProviderTestResult, force = false) => {
+  try {
+    await sql`UPDATE ai.providers SET status=${result.status},status_code=${result.httpStatus?.toString() ?? null},status_message=${result.message},status_checked_at=clock_timestamp() WHERE id=${id} AND (${force} OR status IS DISTINCT FROM ${result.status} OR status_code IS DISTINCT FROM ${result.httpStatus?.toString() ?? null})`;
+  } catch {
+    // A failed database write must not start another write through the persistent logger.
+    console.warn("[ai:providers] Could not persist provider connection status", { providerId: id });
+  }
+};
+const requestModels = async (provider: Connection, signal?: AbortSignal, after?: string) => {
+  const base = (provider.baseUrl ?? defaults[provider.type]).replace(/\/$/, "");
+  if (!base) throw new AiProviderListError("list_failed", "The provider has no base URL.");
+  const headers = new Headers(provider.headers);
+  if (provider.type === "anthropic") {
+    headers.set("anthropic-version", "2023-06-01");
+    if (provider.apiKey) headers.set("x-api-key", provider.apiKey);
+  } else if (provider.apiKey) headers.set("authorization", `Bearer ${provider.apiKey}`);
+  let response: Response;
+  try {
+    response = await fetch(
+      `${base}${provider.type === "ollama" ? "/api/tags" : `/models${after ? `?after_id=${encodeURIComponent(after)}` : ""}`}`,
+      { headers, signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(10_000)]) : AbortSignal.timeout(10_000), redirect: "error" },
+    );
+  } catch {
+    throw new AiProviderListError("unreachable", "The provider could not be reached.");
+  }
+  if (!response.ok) {
+    await response.body?.cancel();
+    throw new AiProviderListError(
+      response.status === 401 || response.status === 403 ? "key_rejected" : "list_failed",
+      "The provider could not list models.",
+      response.status,
+    );
+  }
+  return response;
+};
+/** Cloud's one listing seam; move it to nessi listModels() when that API ships. */
+export const listProviderModels = async (provider: Connection, signal?: AbortSignal): Promise<AiAvailableProviderModel[]> => {
+  const deadline = signal ? AbortSignal.any([signal, AbortSignal.timeout(10_000)]) : AbortSignal.timeout(10_000);
+  const models: AiAvailableProviderModel[] = [];
+  const seen = new Set<string>();
+  let after: string | undefined;
+  do {
+    const response = await requestModels(provider, deadline, after);
+    try {
+      const body: unknown = await response.json();
+      if (provider.type === "ollama")
+        return z
+          .object({ models: z.array(z.object({ name: z.string() })) })
+          .parse(body)
+          .models.map((model) => ({ providerModel: model.name }));
+      const page = z
+        .object({
+          data: z.array(
+            z.object({
+              id: z.string(),
+              name: z.string().optional(),
+              display_name: z.string().optional(),
+              context_length: z.number().int().positive().optional(),
+            }),
+          ),
+          has_more: z.boolean().optional(),
+          last_id: z.string().optional(),
+        })
+        .parse(body);
+      models.push(
+        ...page.data.map((model) => ({
+          providerModel: model.id,
+          ...((model.display_name ?? model.name) ? { label: model.display_name ?? model.name } : {}),
+          ...(model.context_length ? { contextWindow: model.context_length } : {}),
+        })),
+      );
+      if (provider.type !== "anthropic" || !page.has_more) return models;
+      after = page.last_id ?? page.data.at(-1)?.id;
+      if (!after || seen.has(after)) throw new Error("Non-advancing model cursor");
+      seen.add(after);
+    } catch {
+      throw new AiProviderListError("list_failed", "The provider returned an invalid model list.");
+    }
+  } while (!deadline.aborted);
+  throw new AiProviderListError("unreachable", "The provider model list timed out.");
+};
+export const storedProviderConnection = async (provider: AiProvider): Promise<Connection> => ({
+  ...provider,
+  apiKey: (await getAiCredential(provider.id)) ?? undefined,
+  headers: await getAiRequestHeaders(provider.id),
+});
+export const testAiProvider = async (provider: Connection, signal?: AbortSignal): Promise<AiProviderTestResult> => {
+  const start = Date.now();
+  try {
+    const response = await requestModels(provider, signal);
+    await response.body?.cancel();
+    return { status: "ok", httpStatus: response.status, message: "The provider connection works.", latencyMs: Date.now() - start };
+  } catch (error) {
+    return { ...classifyProviderFailure(error), latencyMs: Date.now() - start };
+  }
+};

package/src/ai/provider-errors.ts

@@ -1,4 +1,6 @@
-import type { NessiIssue, Provider } from "@k2b/nessi/ai";
+import type { NessiIssue, Provider, StreamEvent } from "@k2b/nessi/ai";
+import { classifyProviderFailure, recordAiProviderStatus } from "./provider-connections";
+import { type ProviderFetchMarks, runWithProviderFetchMarks } from "./provider-fetch";
 
 /** No provider-owned message, name, stack, cause, or extension fields cross this boundary. */
 export class AiProviderError extends Error {
@@ -63,27 +65,74 @@ const toolStreamReason = (reason: string) => {
 };
 
 /** Apply before accounting, retry, nessi loops, traces, capabilities, and loggers observe an adapter. */
-export const withProviderErrors = (provider: Provider): Provider => ({
+export const withProviderErrors = (provider: Provider, providerId?: string): Provider => ({
   name: provider.name,
   family: provider.family,
   model: provider.model,
   contextWindow: provider.contextWindow,
   capabilities: provider.capabilities,
   complete: async (request) => {
+    const marks: ProviderFetchMarks = {};
     try {
-      return await provider.complete(request);
-    } catch {
+      const result = await runWithProviderFetchMarks(marks, () => provider.complete(request));
+      if (providerId && !request.signal?.aborted)
+        await recordAiProviderStatus(
+          providerId,
+          ["error", "aborted", "interrupted"].includes(result.finishReason ?? "")
+            ? classifyProviderFailure(marks.httpStatus ? { status: marks.httpStatus } : {})
+            : { status: "ok", message: "The provider connection works." },
+        );
+      return result;
+    } catch (error) {
+      if (providerId && !request.signal?.aborted)
+        await recordAiProviderStatus(
+          providerId,
+          classifyProviderFailure(marks.httpStatus ? { status: marks.httpStatus } : marks.networkFailure ? new TypeError() : error),
+        );
       throw new AiProviderError(request.signal?.aborted);
     }
   },
   stream: async function* (request) {
+    const marks: ProviderFetchMarks = {};
+    let iterator: AsyncIterator<StreamEvent> | undefined;
     try {
-      for await (const event of provider.stream(request)) {
+      const activeIterator = provider.stream(request)[Symbol.asyncIterator]();
+      iterator = activeIterator;
+      let failed = false;
+      for (;;) {
+        const next = await runWithProviderFetchMarks(marks, () => activeIterator.next());
+        if (next.done) break;
+        const event = next.value;
+        if (event.type === "issue" && (event.issue.kind === "provider_error" || event.issue.kind === "timeout")) {
+          failed = true;
+          if (providerId)
+            await recordAiProviderStatus(
+              providerId,
+              event.issue.kind === "timeout"
+                ? { status: "unreachable", message: "The provider timed out." }
+                : classifyProviderFailure(
+                    marks.httpStatus ? { status: marks.httpStatus } : marks.networkFailure ? new TypeError() : event.issue,
+                  ),
+            );
+        }
         yield event.type === "issue" ? { type: "issue", issue: providerIssue(event.issue, request.tools) } : event;
       }
-    } catch {
+      if (providerId && !failed && !request.signal?.aborted)
+        await recordAiProviderStatus(providerId, { status: "ok", message: "The provider connection works." });
+    } catch (error) {
+      if (providerId && !request.signal?.aborted)
+        await recordAiProviderStatus(
+          providerId,
+          classifyProviderFailure(marks.httpStatus ? { status: marks.httpStatus } : marks.networkFailure ? new TypeError() : error),
+        );
       // Includes synchronous creation, iteration, and iterator cleanup failures.
       throw new AiProviderError(request.signal?.aborted);
+    } finally {
+      try {
+        await iterator?.return?.();
+      } catch {
+        throw new AiProviderError(request.signal?.aborted);
+      }
     }
   },
 });

package/src/ai/provider-fetch.ts

@@ -13,6 +13,8 @@ import { AsyncLocalStorage } from "node:async_hooks";
  */
 export type ProviderFetchMarks = {
   headersAt?: number;
+  httpStatus?: number;
+  networkFailure?: boolean;
   firstByteAt?: number;
   /** The request never reached the provider, or the provider answered with a status that says it did not process it. */
   refused?: boolean;
@@ -74,6 +76,7 @@ const install = (): void => {
     try {
       response = await realFetch(input, init);
     } catch (error) {
+      for (const store of stores) store.networkFailure = true;
       // A reset, an abort, or a timeout can follow delivery, so only an unsent request counts as refused.
       if (unsent(error))
         for (const store of stores) {
@@ -85,6 +88,7 @@ const install = (): void => {
     const wait = response.ok ? undefined : retryAfterMs(response.headers, headersAt);
     for (const store of stores) {
       store.headersAt = headersAt;
+      store.httpStatus = response.status;
       store.refused = refusedStatus(response.status);
       if (wait !== undefined) store.retryAfterMs = wait;
     }

package/src/ai/provider.ts

@@ -40,7 +40,7 @@ const commonOptions = (profile: AiModelProfile, apiKey?: string) => ({
 
 export const createAiProvider = (profile: AiModelProfile, apiKey?: string, headers?: Record<string, string>): Provider => {
   if (profile.capabilities.includes("transcription")) throw new Error("Transcription profiles cannot be used for chat generation.");
-  return withProviderErrors(completeThroughStream(createAdapter(profile, apiKey, headers)));
+  return withProviderErrors(completeThroughStream(createAdapter(profile, apiKey, headers)), profile.providerId);
 };
 
 const createAdapter = (profile: AiModelProfile, apiKey?: string, headers?: Record<string, string>): Provider => {

package/src/ai/quota-limits.ts

@@ -0,0 +1,36 @@
+import { sql } from "bun";
+import { recursiveGroupIdsSubquery } from "../services/accounts/group-sql";
+import { toPgTextArray } from "../services/postgres";
+import { hasBillableAiPricing } from "../shared/ai-costs";
+import { readAiSettingsState } from "./settings";
+
+/** One row per rule; identities are deduplicated when several model rules apply. */
+export const aiPeopleAtLimit = async (db = sql): Promise<{ scope: string; people: string[] }[]> => {
+  const priced = [
+    ...new Set(
+      (await readAiSettingsState()).profiles.filter((profile) => hasBillableAiPricing(profile.pricing)).map((profile) => profile.modelId),
+    ),
+  ];
+  return db<{ scope: string; people: string[] }[]>`WITH rules AS MATERIALIZED (
+    SELECT r->>'scope' AS scope,r->'grants' AS grants,
+      (r->>'anchor')::timestamptz + floor(extract(epoch FROM (now()-(r->>'anchor')::timestamptz)) / ((r->>'hours')::int*3600)) * ((r->>'hours')::int*interval '1 hour') AS starts
+    FROM ai.cost_config,jsonb_array_elements(rules) r WHERE singleton AND enabled
+      AND (r->>'scope'='*' OR r->>'scope'=ANY(${toPgTextArray(priced)}::text[]))
+  ), people AS MATERIALIZED (
+    SELECT u.id FROM auth.users u WHERE EXISTS(SELECT 1 FROM ai.inference_calls WHERE kind='chat' AND user_id=u.id)
+      OR EXISTS(SELECT 1 FROM ai.conversations c JOIN ai.turns t ON t.conversation_id=c.id
+        WHERE c.created_by_user_id=u.id AND t.run_config->>'assistantChat'='true' AND t.run_config->'mandate' IS NULL)
+  ), allowances AS MATERIALIZED (
+    SELECT u.id,r.scope,r.starts,CASE WHEN bool_or(g->>'limit' IS NULL) FILTER(WHERE g IS NOT NULL) THEN NULL ELSE COALESCE(max((g->>'limit')::float8),0) END AS amount
+    FROM people u CROSS JOIN rules r LEFT JOIN LATERAL (
+      SELECT g FROM jsonb_array_elements(r.grants) g WHERE g->'principal'->>'type'='authenticated'
+        OR g->'principal'->>'userId'=u.id::text OR (g->'principal'->>'groupId')::uuid IN (${recursiveGroupIdsSubquery(sql`u.id`)})
+    ) grants ON true GROUP BY u.id,r.scope,r.starts
+  ), exhausted AS (
+    SELECT a.scope,a.id FROM allowances a LEFT JOIN ai.inference_calls c ON c.user_id=a.id AND c.kind='chat'
+      AND (a.scope='*' OR c.model_id=a.scope) AND c.started_at>=a.starts
+      AND c.started_at>COALESCE((SELECT max(created_at) FROM ai.cost_resets z WHERE z.user_id=a.id AND z.scope=a.scope),'-infinity'::timestamptz)
+    WHERE a.amount IS NOT NULL AND NOT EXISTS(SELECT 1 FROM allowances w WHERE w.id=a.id AND w.scope='*' AND w.amount IS NULL)
+    GROUP BY a.scope,a.id,a.amount HAVING COALESCE(sum(c.cost),0)>=a.amount
+  ) SELECT scope,array_agg(id::text ORDER BY id) AS people FROM exhausted GROUP BY scope`;
+};

package/src/ai/quota-provider.ts

@@ -3,6 +3,7 @@ import { estimateTokens, type Provider } from "@k2b/nessi";
 import { sql } from "bun";
 import type { AccessSubject } from "../server/services/access";
 import { logger } from "../services/logging";
+import type { AiResolvedModelRef } from "../shared/ai-models";
 import { isAssistantChatTurn } from "./assistant-models";
 import { AiBackgroundAdmissionError, type AiCallContext, type AiCallDetails, beginAiCall, finishAiCall } from "./inference-calls";
 import { type ProviderFetchMarks, runWithProviderFetchMarks } from "./provider-fetch";
@@ -230,7 +231,7 @@ export function inferenceProvider(
               firstByteMs: marks.firstByteAt === undefined ? undefined : marks.firstByteAt - requestStartedAt,
               firstBlockMs: marks.firstBlockAt === undefined ? undefined : marks.firstBlockAt - requestStartedAt,
             });
-          } catch (error) {
+          } catch {
             log.warn("Chat usage booking failed", { code: "quota_booking_failed", turnId: context.turnId, callId: id });
           }
         }
@@ -246,8 +247,9 @@ export function assistantQuotaProvider(
   profile: AiModelProfile,
   turnId: string,
   conversationId: string,
+  modelRef: AiResolvedModelRef,
 ) {
-  const common = { subject, turnId, conversationId };
+  const common = { subject, turnId, conversationId, modelRef };
   return inferenceProvider(
     provider,
     profile,

package/src/ai/quota-report.ts

@@ -4,18 +4,21 @@ import { recursiveGroupIdsSubquery } from "../services/accounts/group-sql";
 import { toPgTextArray } from "../services/postgres";
 import { hasBillableAiPricing } from "../shared/ai-costs";
 import { type AiQuotaReport, type AiQuotaReportQuery, AiQuotaReportQuerySchema } from "../shared/ai-quotas";
+import { aiPeopleAtLimit } from "./quota-limits";
 import { aiQuotas } from "./quotas";
 import { readAiSettingsState } from "./settings";
 
 /** Resolve display metadata only for administration, never on the inference path. */
 export async function quotaAdminConfig() {
   const config = await aiQuotas.config();
+  const limits = await aiPeopleAtLimit();
   const grants = await resolveDisplayNames(config.rules.flatMap((rule) => rule.grants));
   let offset = 0;
   return {
     ...config,
     rules: config.rules.map((rule) => ({
       ...rule,
+      peopleAtLimit: limits.find((limit) => limit.scope === rule.scope)?.people.length ?? 0,
       grants: rule.grants.map(() => {
         const grant = grants[offset++]!;
         return {
@@ -50,7 +53,7 @@ export async function quotaReport(input: Partial<AiQuotaReportQuery> = {}, now =
       page: 1,
       perPage: 25,
     };
-  const pricedModels = (await readAiSettingsState()).profiles.filter((p) => hasBillableAiPricing(p.pricing)).map((p) => p.id);
+  const pricedModels = (await readAiSettingsState()).profiles.filter((p) => hasBillableAiPricing(p.pricing)).map((p) => p.modelId);
   const bucket = query.range === "24h" ? "hour" : "day";
   const order = query.sort === "label" ? sql`label` : query.sort === "cost" ? sql`cost` : sql`last_used`;
   const direction = query.direction === "asc" ? sql`ASC` : sql`DESC`;
@@ -80,7 +83,7 @@ export async function quotaReport(input: Partial<AiQuotaReportQuery> = {}, now =
       FROM ai.inference_calls c WHERE c.kind='chat' AND c.started_at<=${now}
     ), periods AS MATERIALIZED (
       SELECT * FROM calls WHERE started_at>=${since} AND started_at<${until}
-        AND (${query.model}='' OR model_profile_id=${query.model})
+        AND (${query.model}='' OR model_id=${query.model})
     ), allowances AS MATERIALIZED (
       SELECT a.id,a.type,r.scope,
         CASE WHEN bool_or((g->>'limit') IS NULL) FILTER(WHERE g IS NOT NULL) THEN NULL ELSE COALESCE(max((g->>'limit')::float8),0) END AS amount,
@@ -95,7 +98,7 @@ export async function quotaReport(input: Partial<AiQuotaReportQuery> = {}, now =
     ), balances AS MATERIALIZED (
       SELECT a.*,COALESCE(sum(c.cost),0)::float8 AS used,count(c.id) FILTER(WHERE c.unknown)::int AS unknown
       FROM allowances a LEFT JOIN calls c ON c.identity_id=a.id AND c.identity_type=a.type
-        AND (a.scope='*' OR c.model_profile_id=a.scope) AND c.started_at>=a.starts
+        AND (a.scope='*' OR c.model_id=a.scope) AND c.started_at>=a.starts
         AND c.started_at>COALESCE((SELECT max(created_at) FROM ai.cost_resets z
           WHERE COALESCE(z.user_id,z.service_account_id)=a.id AND (z.user_id IS NOT NULL)=(a.type='user') AND z.scope=a.scope),'-infinity'::timestamptz)
       GROUP BY a.id,a.type,a.scope,a.amount,a.starts
@@ -111,7 +114,7 @@ export async function quotaReport(input: Partial<AiQuotaReportQuery> = {}, now =
       SELECT a.id,a.type,a.label,
         CASE WHEN NOT COALESCE((SELECT enabled FROM config),false) THEN 'disabled' ELSE COALESCE(s.status,'unlimited') END AS status,
         COALESCE(s.scopes,0) AS scopes,CASE WHEN s.status='unlimited' OR NOT COALESCE((SELECT enabled FROM config),false) THEN 0 ELSE COALESCE(s.exhausted,0) END AS exhausted,
-        (SELECT max(started_at) FROM calls c WHERE c.identity_id=a.id AND c.identity_type=a.type AND (${query.model}='' OR c.model_profile_id=${query.model})) AS last_used,
+        (SELECT max(started_at) FROM calls c WHERE c.identity_id=a.id AND c.identity_type=a.type AND (${query.model}='' OR c.model_id=${query.model})) AS last_used,
         sum(p.cost)::float8 AS cost,COALESCE(sum(p.input),0)::float8 AS input,COALESCE(sum(p.output),0)::float8 AS output,
         count(p.id)::int AS calls,count(p.id) FILTER(WHERE p.input IS NOT NULL AND p.output IS NOT NULL)::int AS measured,count(p.id) FILTER(WHERE p.estimated)::int AS estimated,count(p.id) FILTER(WHERE p.unknown)::int AS unknown
       FROM identities a LEFT JOIN states s ON s.id=a.id AND s.type=a.type

package/src/ai/quotas.ts

@@ -3,6 +3,7 @@ import { type AccessSubject, buildAccessPrincipalCondition } from "../server/ser
 import { hasBillableAiPricing } from "../shared/ai-costs";
 import { type AiQuotaConfig, AiQuotaConfigSchema, type AiQuotaIdentity, type AiQuotaSnapshot } from "../shared/ai-quotas";
 import { readAiSettingsState } from "./settings";
+import type { AiSettingsState } from "./types";
 
 export class AiQuotaError extends Error {
   constructor(
@@ -43,10 +44,18 @@ export const aiQuotas = {
       return { ...config, revision };
     });
   },
-  async snapshot(subject: AccessSubject, model?: string, now = new Date(), db: SQL = sql): Promise<AiQuotaSnapshot> {
-    const config = await aiQuotas.config(db);
+  async snapshot(
+    subject: AccessSubject,
+    model?: string,
+    now = new Date(),
+    db: SQL = sql,
+    context?: { state: AiSettingsState; config: AiQuotaConfig },
+  ): Promise<AiQuotaSnapshot> {
+    const config = context?.config ?? (await aiQuotas.config(db));
     const identity = ids(subject);
-    const pricedModels = new Set((await readAiSettingsState()).profiles.filter((p) => hasBillableAiPricing(p.pricing)).map((p) => p.id));
+    const pricedModels = new Set(
+      (context?.state ?? (await readAiSettingsState())).profiles.filter((p) => hasBillableAiPricing(p.pricing)).map((p) => p.modelId),
+    );
     const matches = buildAccessPrincipalCondition({
       subject,
       columns: {
@@ -76,7 +85,7 @@ export const aiQuotas = {
             (c.finished_at IS NOT NULL OR (c.lease_expires_at <= now() OR (c.turn_id IS NOT NULL AND NOT EXISTS(SELECT 1 FROM ai.turns t WHERE t.id=c.turn_id AND t.attempt=c.turn_attempt AND t.status='running' AND t.lease_expires_at>now())))))::int AS unknown
         FROM ai.inference_calls c
         WHERE c.kind='chat' AND c.user_id IS NOT DISTINCT FROM ${identity.user}::uuid AND c.service_account_id IS NOT DISTINCT FROM ${identity.service}::uuid
-          AND (${rule.scope}='*' OR c.model_profile_id=${rule.scope})
+          AND (${rule.scope}='*' OR c.model_id=${rule.scope})
           AND c.started_at>=${window.from} AND c.started_at<${window.until}
           AND c.started_at>COALESCE((SELECT max(r.created_at) FROM ai.cost_resets r
             WHERE r.user_id IS NOT DISTINCT FROM ${identity.user}::uuid AND r.service_account_id IS NOT DISTINCT FROM ${identity.service}::uuid AND r.scope=${rule.scope}),'-infinity'::timestamptz)`;
@@ -110,13 +119,15 @@ export const aiQuotas = {
       GROUP BY model_profile_id ORDER BY model_profile_id`;
     return { enabled: config.enabled, unit: config.unit ?? "EUR", balances, usage };
   },
-  async assertAllowed(subject: AccessSubject, model: string) {
+  async assertAllowed(subject: AccessSubject, variantId: string, providedState?: AiSettingsState) {
+    const state = providedState ?? (await readAiSettingsState());
+    const profile = state.profiles.find((profile) => profile.id === variantId);
+    if (!profile || !hasBillableAiPricing(profile.pricing)) return false;
+    const model = profile.modelId;
     // Fast default path: no additional identity/usage queries on unrestricted installations.
-    const pricing = (await readAiSettingsState()).profiles.find((profile) => profile.id === model)?.pricing;
-    if (!hasBillableAiPricing(pricing)) return false;
     const config = await aiQuotas.config();
     if (!config.enabled || !config.rules.some((r) => r.scope === "*" || r.scope === model)) return false;
-    const snapshot = await aiQuotas.snapshot(subject, model);
+    const snapshot = await aiQuotas.snapshot(subject, model, undefined, undefined, { state, config });
     for (const b of snapshot.balances) {
       if (b.bypassed || b.limit === null) continue;
       if (b.unknown)

package/src/ai/recent-resources.ts

@@ -26,6 +26,8 @@ import type { AiConversationService, AiRecentResource } from "./types";
 export const AiRecentResourceSchema: z.ZodType<AiRecentResource> = z
   .object({
     ref: CloudResourceRefSchema,
+    context: LinkedCloudResourceReferenceSchema.shape.context,
+    status: LinkedCloudResourceReferenceSchema.shape.status,
     title: LinkedCloudResourceReferenceSchema.shape.title.unwrap(),
     icon: LinkedCloudResourceReferenceSchema.shape.icon,
     href: LinkedCloudResourceReferenceSchema.shape.href,
@@ -183,6 +185,8 @@ export const listAiRecentResources = async (input: {
             ref,
             count,
             title: data.title,
+            context: ownRef?.context,
+            status: ownRef?.status,
             icon: ownRef?.icon ?? data.icon,
             href,
             preview: recentResourcePreview(ownRef?.preview ?? data.description),
@@ -229,6 +233,8 @@ export const listAiRecentResources = async (input: {
           ref,
           count,
           title: ownRef.title,
+          context: ownRef.context,
+          status: ownRef.status,
           icon: (ownRef.icon ?? type.icon ?? app.appIcon)?.slice(0, 120),
           href: ownRef.href,
           kind: type.title.slice(0, 120),