@k2b/cloud 0.43.0 → 0.45.0

package/src/ai/provider-connections.ts

@@ -0,0 +1,161 @@
+import { sql } from "bun";
+import { z } from "zod";
+import type { AiProvider } from "../shared/ai-models";
+import { getAiCredential } from "./credentials";
+import { getAiRequestHeaders } from "./request-headers";
+
+export type AiProviderTestResult = {
+  status: "ok" | "unreachable" | "key_rejected" | "error";
+  httpStatus?: number;
+  message: string;
+  latencyMs?: number;
+};
+export type AiAvailableProviderModel = { providerModel: string; label?: string; kind?: "chat" | "transcription"; contextWindow?: number };
+type Connection = Pick<AiProvider, "type" | "baseUrl"> & { apiKey?: string; headers?: Record<string, string> };
+const defaults = {
+  openai: "https://api.openai.com/v1",
+  openrouter: "https://openrouter.ai/api/v1",
+  anthropic: "https://api.anthropic.com/v1",
+  mistral: "https://api.mistral.ai/v1",
+  gemini: "https://generativelanguage.googleapis.com/v1beta/openai",
+  ollama: "http://localhost:11434",
+  vllm: "http://localhost:8000/v1",
+  "openai-compatible": "",
+};
+export class AiProviderListError extends Error {
+  constructor(
+    readonly code: "unreachable" | "key_rejected" | "list_failed",
+    message: string,
+    readonly httpStatus?: number,
+  ) {
+    super(message);
+  }
+}
+export const classifyProviderFailure = (error: unknown): AiProviderTestResult => {
+  const details = z
+    .object({ status: z.number().optional(), statusCode: z.number().optional(), code: z.string().optional(), name: z.string().optional() })
+    .passthrough()
+    .safeParse(error);
+  const httpStatus =
+    error instanceof AiProviderListError
+      ? error.httpStatus
+      : details.success
+        ? (details.data.status ?? details.data.statusCode)
+        : undefined;
+  const status =
+    httpStatus === 401 || httpStatus === 403
+      ? "key_rejected"
+      : (error instanceof AiProviderListError && error.code === "unreachable") ||
+          error instanceof TypeError ||
+          (details.success && ["TimeoutError", "AbortError"].includes(details.data.name ?? "")) ||
+          (details.success && ["ECONNREFUSED", "ETIMEDOUT", "ENOTFOUND", "ECONNRESET"].includes(details.data.code ?? ""))
+        ? "unreachable"
+        : "error";
+  return {
+    status,
+    ...(httpStatus ? { httpStatus } : {}),
+    message:
+      status === "key_rejected"
+        ? "The provider rejected the credential."
+        : status === "unreachable"
+          ? "The provider did not respond within 10 seconds or could not be reached."
+          : "The provider request failed.",
+  };
+};
+/** Best-effort persistence never rejects: callers await it inside their provider error boundary. */
+export const recordAiProviderStatus = async (id: string, result: AiProviderTestResult, force = false) => {
+  try {
+    await sql`UPDATE ai.providers SET status=${result.status},status_code=${result.httpStatus?.toString() ?? null},status_message=${result.message},status_checked_at=clock_timestamp() WHERE id=${id} AND (${force} OR status IS DISTINCT FROM ${result.status} OR status_code IS DISTINCT FROM ${result.httpStatus?.toString() ?? null})`;
+  } catch {
+    // A failed database write must not start another write through the persistent logger.
+    console.warn("[ai:providers] Could not persist provider connection status", { providerId: id });
+  }
+};
+const requestModels = async (provider: Connection, signal?: AbortSignal, after?: string) => {
+  const base = (provider.baseUrl ?? defaults[provider.type]).replace(/\/$/, "");
+  if (!base) throw new AiProviderListError("list_failed", "The provider has no base URL.");
+  const headers = new Headers(provider.headers);
+  if (provider.type === "anthropic") {
+    headers.set("anthropic-version", "2023-06-01");
+    if (provider.apiKey) headers.set("x-api-key", provider.apiKey);
+  } else if (provider.apiKey) headers.set("authorization", `Bearer ${provider.apiKey}`);
+  let response: Response;
+  try {
+    response = await fetch(
+      `${base}${provider.type === "ollama" ? "/api/tags" : `/models${after ? `?after_id=${encodeURIComponent(after)}` : ""}`}`,
+      { headers, signal: signal ? AbortSignal.any([signal, AbortSignal.timeout(10_000)]) : AbortSignal.timeout(10_000), redirect: "error" },
+    );
+  } catch {
+    throw new AiProviderListError("unreachable", "The provider could not be reached.");
+  }
+  if (!response.ok) {
+    await response.body?.cancel();
+    throw new AiProviderListError(
+      response.status === 401 || response.status === 403 ? "key_rejected" : "list_failed",
+      "The provider could not list models.",
+      response.status,
+    );
+  }
+  return response;
+};
+/** Cloud's one listing seam; move it to nessi listModels() when that API ships. */
+export const listProviderModels = async (provider: Connection, signal?: AbortSignal): Promise<AiAvailableProviderModel[]> => {
+  const deadline = signal ? AbortSignal.any([signal, AbortSignal.timeout(10_000)]) : AbortSignal.timeout(10_000);
+  const models: AiAvailableProviderModel[] = [];
+  const seen = new Set<string>();
+  let after: string | undefined;
+  do {
+    const response = await requestModels(provider, deadline, after);
+    try {
+      const body: unknown = await response.json();
+      if (provider.type === "ollama")
+        return z
+          .object({ models: z.array(z.object({ name: z.string() })) })
+          .parse(body)
+          .models.map((model) => ({ providerModel: model.name }));
+      const page = z
+        .object({
+          data: z.array(
+            z.object({
+              id: z.string(),
+              name: z.string().optional(),
+              display_name: z.string().optional(),
+              context_length: z.number().int().positive().optional(),
+            }),
+          ),
+          has_more: z.boolean().optional(),
+          last_id: z.string().optional(),
+        })
+        .parse(body);
+      models.push(
+        ...page.data.map((model) => ({
+          providerModel: model.id,
+          ...((model.display_name ?? model.name) ? { label: model.display_name ?? model.name } : {}),
+          ...(model.context_length ? { contextWindow: model.context_length } : {}),
+        })),
+      );
+      if (provider.type !== "anthropic" || !page.has_more) return models;
+      after = page.last_id ?? page.data.at(-1)?.id;
+      if (!after || seen.has(after)) throw new Error("Non-advancing model cursor");
+      seen.add(after);
+    } catch {
+      throw new AiProviderListError("list_failed", "The provider returned an invalid model list.");
+    }
+  } while (!deadline.aborted);
+  throw new AiProviderListError("unreachable", "The provider model list timed out.");
+};
+export const storedProviderConnection = async (provider: AiProvider): Promise<Connection> => ({
+  ...provider,
+  apiKey: (await getAiCredential(provider.id)) ?? undefined,
+  headers: await getAiRequestHeaders(provider.id),
+});
+export const testAiProvider = async (provider: Connection, signal?: AbortSignal): Promise<AiProviderTestResult> => {
+  const start = Date.now();
+  try {
+    const response = await requestModels(provider, signal);
+    await response.body?.cancel();
+    return { status: "ok", httpStatus: response.status, message: "The provider connection works.", latencyMs: Date.now() - start };
+  } catch (error) {
+    return { ...classifyProviderFailure(error), latencyMs: Date.now() - start };
+  }
+};

package/src/ai/provider-errors.ts

@@ -1,4 +1,6 @@
-import type { NessiIssue, Provider } from "@k2b/nessi/ai";
+import type { NessiIssue, Provider, StreamEvent } from "@k2b/nessi/ai";
+import { classifyProviderFailure, recordAiProviderStatus } from "./provider-connections";
+import { type ProviderFetchMarks, runWithProviderFetchMarks } from "./provider-fetch";
 
 /** No provider-owned message, name, stack, cause, or extension fields cross this boundary. */
 export class AiProviderError extends Error {
@@ -63,27 +65,74 @@ const toolStreamReason = (reason: string) => {
 };
 
 /** Apply before accounting, retry, nessi loops, traces, capabilities, and loggers observe an adapter. */
-export const withProviderErrors = (provider: Provider): Provider => ({
+export const withProviderErrors = (provider: Provider, providerId?: string): Provider => ({
   name: provider.name,
   family: provider.family,
   model: provider.model,
   contextWindow: provider.contextWindow,
   capabilities: provider.capabilities,
   complete: async (request) => {
+    const marks: ProviderFetchMarks = {};
     try {
-      return await provider.complete(request);
-    } catch {
+      const result = await runWithProviderFetchMarks(marks, () => provider.complete(request));
+      if (providerId && !request.signal?.aborted)
+        await recordAiProviderStatus(
+          providerId,
+          ["error", "aborted", "interrupted"].includes(result.finishReason ?? "")
+            ? classifyProviderFailure(marks.httpStatus ? { status: marks.httpStatus } : {})
+            : { status: "ok", message: "The provider connection works." },
+        );
+      return result;
+    } catch (error) {
+      if (providerId && !request.signal?.aborted)
+        await recordAiProviderStatus(
+          providerId,
+          classifyProviderFailure(marks.httpStatus ? { status: marks.httpStatus } : marks.networkFailure ? new TypeError() : error),
+        );
       throw new AiProviderError(request.signal?.aborted);
     }
   },
   stream: async function* (request) {
+    const marks: ProviderFetchMarks = {};
+    let iterator: AsyncIterator<StreamEvent> | undefined;
     try {
-      for await (const event of provider.stream(request)) {
+      const activeIterator = provider.stream(request)[Symbol.asyncIterator]();
+      iterator = activeIterator;
+      let failed = false;
+      for (;;) {
+        const next = await runWithProviderFetchMarks(marks, () => activeIterator.next());
+        if (next.done) break;
+        const event = next.value;
+        if (event.type === "issue" && (event.issue.kind === "provider_error" || event.issue.kind === "timeout")) {
+          failed = true;
+          if (providerId)
+            await recordAiProviderStatus(
+              providerId,
+              event.issue.kind === "timeout"
+                ? { status: "unreachable", message: "The provider timed out." }
+                : classifyProviderFailure(
+                    marks.httpStatus ? { status: marks.httpStatus } : marks.networkFailure ? new TypeError() : event.issue,
+                  ),
+            );
+        }
         yield event.type === "issue" ? { type: "issue", issue: providerIssue(event.issue, request.tools) } : event;
       }
-    } catch {
+      if (providerId && !failed && !request.signal?.aborted)
+        await recordAiProviderStatus(providerId, { status: "ok", message: "The provider connection works." });
+    } catch (error) {
+      if (providerId && !request.signal?.aborted)
+        await recordAiProviderStatus(
+          providerId,
+          classifyProviderFailure(marks.httpStatus ? { status: marks.httpStatus } : marks.networkFailure ? new TypeError() : error),
+        );
       // Includes synchronous creation, iteration, and iterator cleanup failures.
       throw new AiProviderError(request.signal?.aborted);
+    } finally {
+      try {
+        await iterator?.return?.();
+      } catch {
+        throw new AiProviderError(request.signal?.aborted);
+      }
     }
   },
 });

package/src/ai/provider-fetch.ts

@@ -13,6 +13,8 @@ import { AsyncLocalStorage } from "node:async_hooks";
  */
 export type ProviderFetchMarks = {
   headersAt?: number;
+  httpStatus?: number;
+  networkFailure?: boolean;
   firstByteAt?: number;
   /** The request never reached the provider, or the provider answered with a status that says it did not process it. */
   refused?: boolean;
@@ -74,6 +76,7 @@ const install = (): void => {
     try {
       response = await realFetch(input, init);
     } catch (error) {
+      for (const store of stores) store.networkFailure = true;
       // A reset, an abort, or a timeout can follow delivery, so only an unsent request counts as refused.
       if (unsent(error))
         for (const store of stores) {
@@ -85,6 +88,7 @@ const install = (): void => {
     const wait = response.ok ? undefined : retryAfterMs(response.headers, headersAt);
     for (const store of stores) {
       store.headersAt = headersAt;
+      store.httpStatus = response.status;
       store.refused = refusedStatus(response.status);
       if (wait !== undefined) store.retryAfterMs = wait;
     }

package/src/ai/provider.ts

@@ -40,7 +40,7 @@ const commonOptions = (profile: AiModelProfile, apiKey?: string) => ({
 
 export const createAiProvider = (profile: AiModelProfile, apiKey?: string, headers?: Record<string, string>): Provider => {
   if (profile.capabilities.includes("transcription")) throw new Error("Transcription profiles cannot be used for chat generation.");
-  return withProviderErrors(completeThroughStream(createAdapter(profile, apiKey, headers)));
+  return withProviderErrors(completeThroughStream(createAdapter(profile, apiKey, headers)), profile.providerId);
 };
 
 const createAdapter = (profile: AiModelProfile, apiKey?: string, headers?: Record<string, string>): Provider => {

package/src/ai/quota-limits.ts

@@ -0,0 +1,36 @@
+import { sql } from "bun";
+import { recursiveGroupIdsSubquery } from "../services/accounts/group-sql";
+import { toPgTextArray } from "../services/postgres";
+import { hasBillableAiPricing } from "../shared/ai-costs";
+import { readAiSettingsState } from "./settings";
+
+/** One row per rule; identities are deduplicated when several model rules apply. */
+export const aiPeopleAtLimit = async (db = sql): Promise<{ scope: string; people: string[] }[]> => {
+  const priced = [
+    ...new Set(
+      (await readAiSettingsState()).profiles.filter((profile) => hasBillableAiPricing(profile.pricing)).map((profile) => profile.modelId),
+    ),
+  ];
+  return db<{ scope: string; people: string[] }[]>`WITH rules AS MATERIALIZED (
+    SELECT r->>'scope' AS scope,r->'grants' AS grants,
+      (r->>'anchor')::timestamptz + floor(extract(epoch FROM (now()-(r->>'anchor')::timestamptz)) / ((r->>'hours')::int*3600)) * ((r->>'hours')::int*interval '1 hour') AS starts
+    FROM ai.cost_config,jsonb_array_elements(rules) r WHERE singleton AND enabled
+      AND (r->>'scope'='*' OR r->>'scope'=ANY(${toPgTextArray(priced)}::text[]))
+  ), people AS MATERIALIZED (
+    SELECT u.id FROM auth.users u WHERE EXISTS(SELECT 1 FROM ai.inference_calls WHERE kind='chat' AND user_id=u.id)
+      OR EXISTS(SELECT 1 FROM ai.conversations c JOIN ai.turns t ON t.conversation_id=c.id
+        WHERE c.created_by_user_id=u.id AND t.run_config->>'assistantChat'='true' AND t.run_config->'mandate' IS NULL)
+  ), allowances AS MATERIALIZED (
+    SELECT u.id,r.scope,r.starts,CASE WHEN bool_or(g->>'limit' IS NULL) FILTER(WHERE g IS NOT NULL) THEN NULL ELSE COALESCE(max((g->>'limit')::float8),0) END AS amount
+    FROM people u CROSS JOIN rules r LEFT JOIN LATERAL (
+      SELECT g FROM jsonb_array_elements(r.grants) g WHERE g->'principal'->>'type'='authenticated'
+        OR g->'principal'->>'userId'=u.id::text OR (g->'principal'->>'groupId')::uuid IN (${recursiveGroupIdsSubquery(sql`u.id`)})
+    ) grants ON true GROUP BY u.id,r.scope,r.starts
+  ), exhausted AS (
+    SELECT a.scope,a.id FROM allowances a LEFT JOIN ai.inference_calls c ON c.user_id=a.id AND c.kind='chat'
+      AND (a.scope='*' OR c.model_id=a.scope) AND c.started_at>=a.starts
+      AND c.started_at>COALESCE((SELECT max(created_at) FROM ai.cost_resets z WHERE z.user_id=a.id AND z.scope=a.scope),'-infinity'::timestamptz)
+    WHERE a.amount IS NOT NULL AND NOT EXISTS(SELECT 1 FROM allowances w WHERE w.id=a.id AND w.scope='*' AND w.amount IS NULL)
+    GROUP BY a.scope,a.id,a.amount HAVING COALESCE(sum(c.cost),0)>=a.amount
+  ) SELECT scope,array_agg(id::text ORDER BY id) AS people FROM exhausted GROUP BY scope`;
+};

package/src/ai/quota-provider.ts

@@ -3,6 +3,7 @@ import { estimateTokens, type Provider } from "@k2b/nessi";
 import { sql } from "bun";
 import type { AccessSubject } from "../server/services/access";
 import { logger } from "../services/logging";
+import type { AiResolvedModelRef } from "../shared/ai-models";
 import { isAssistantChatTurn } from "./assistant-models";
 import { AiBackgroundAdmissionError, type AiCallContext, type AiCallDetails, beginAiCall, finishAiCall } from "./inference-calls";
 import { type ProviderFetchMarks, runWithProviderFetchMarks } from "./provider-fetch";
@@ -230,7 +231,7 @@ export function inferenceProvider(
               firstByteMs: marks.firstByteAt === undefined ? undefined : marks.firstByteAt - requestStartedAt,
               firstBlockMs: marks.firstBlockAt === undefined ? undefined : marks.firstBlockAt - requestStartedAt,
             });
-          } catch (error) {
+          } catch {
             log.warn("Chat usage booking failed", { code: "quota_booking_failed", turnId: context.turnId, callId: id });
           }
         }
@@ -246,8 +247,9 @@ export function assistantQuotaProvider(
   profile: AiModelProfile,
   turnId: string,
   conversationId: string,
+  modelRef: AiResolvedModelRef,
 ) {
-  const common = { subject, turnId, conversationId };
+  const common = { subject, turnId, conversationId, modelRef };
   return inferenceProvider(
     provider,
     profile,

package/src/ai/quota-report.ts

@@ -4,18 +4,21 @@ import { recursiveGroupIdsSubquery } from "../services/accounts/group-sql";
 import { toPgTextArray } from "../services/postgres";
 import { hasBillableAiPricing } from "../shared/ai-costs";
 import { type AiQuotaReport, type AiQuotaReportQuery, AiQuotaReportQuerySchema } from "../shared/ai-quotas";
+import { aiPeopleAtLimit } from "./quota-limits";
 import { aiQuotas } from "./quotas";
 import { readAiSettingsState } from "./settings";
 
 /** Resolve display metadata only for administration, never on the inference path. */
 export async function quotaAdminConfig() {
   const config = await aiQuotas.config();
+  const limits = await aiPeopleAtLimit();
   const grants = await resolveDisplayNames(config.rules.flatMap((rule) => rule.grants));
   let offset = 0;
   return {
     ...config,
     rules: config.rules.map((rule) => ({
       ...rule,
+      peopleAtLimit: limits.find((limit) => limit.scope === rule.scope)?.people.length ?? 0,
       grants: rule.grants.map(() => {
         const grant = grants[offset++]!;
         return {
@@ -50,7 +53,7 @@ export async function quotaReport(input: Partial<AiQuotaReportQuery> = {}, now =
       page: 1,
       perPage: 25,
     };
-  const pricedModels = (await readAiSettingsState()).profiles.filter((p) => hasBillableAiPricing(p.pricing)).map((p) => p.id);
+  const pricedModels = (await readAiSettingsState()).profiles.filter((p) => hasBillableAiPricing(p.pricing)).map((p) => p.modelId);
   const bucket = query.range === "24h" ? "hour" : "day";
   const order = query.sort === "label" ? sql`label` : query.sort === "cost" ? sql`cost` : sql`last_used`;
   const direction = query.direction === "asc" ? sql`ASC` : sql`DESC`;
@@ -80,7 +83,7 @@ export async function quotaReport(input: Partial<AiQuotaReportQuery> = {}, now =
       FROM ai.inference_calls c WHERE c.kind='chat' AND c.started_at<=${now}
     ), periods AS MATERIALIZED (
       SELECT * FROM calls WHERE started_at>=${since} AND started_at<${until}
-        AND (${query.model}='' OR model_profile_id=${query.model})
+        AND (${query.model}='' OR model_id=${query.model})
     ), allowances AS MATERIALIZED (
       SELECT a.id,a.type,r.scope,
         CASE WHEN bool_or((g->>'limit') IS NULL) FILTER(WHERE g IS NOT NULL) THEN NULL ELSE COALESCE(max((g->>'limit')::float8),0) END AS amount,
@@ -95,7 +98,7 @@ export async function quotaReport(input: Partial<AiQuotaReportQuery> = {}, now =
     ), balances AS MATERIALIZED (
       SELECT a.*,COALESCE(sum(c.cost),0)::float8 AS used,count(c.id) FILTER(WHERE c.unknown)::int AS unknown
       FROM allowances a LEFT JOIN calls c ON c.identity_id=a.id AND c.identity_type=a.type
-        AND (a.scope='*' OR c.model_profile_id=a.scope) AND c.started_at>=a.starts
+        AND (a.scope='*' OR c.model_id=a.scope) AND c.started_at>=a.starts
         AND c.started_at>COALESCE((SELECT max(created_at) FROM ai.cost_resets z
           WHERE COALESCE(z.user_id,z.service_account_id)=a.id AND (z.user_id IS NOT NULL)=(a.type='user') AND z.scope=a.scope),'-infinity'::timestamptz)
       GROUP BY a.id,a.type,a.scope,a.amount,a.starts
@@ -111,7 +114,7 @@ export async function quotaReport(input: Partial<AiQuotaReportQuery> = {}, now =
       SELECT a.id,a.type,a.label,
         CASE WHEN NOT COALESCE((SELECT enabled FROM config),false) THEN 'disabled' ELSE COALESCE(s.status,'unlimited') END AS status,
         COALESCE(s.scopes,0) AS scopes,CASE WHEN s.status='unlimited' OR NOT COALESCE((SELECT enabled FROM config),false) THEN 0 ELSE COALESCE(s.exhausted,0) END AS exhausted,
-        (SELECT max(started_at) FROM calls c WHERE c.identity_id=a.id AND c.identity_type=a.type AND (${query.model}='' OR c.model_profile_id=${query.model})) AS last_used,
+        (SELECT max(started_at) FROM calls c WHERE c.identity_id=a.id AND c.identity_type=a.type AND (${query.model}='' OR c.model_id=${query.model})) AS last_used,
         sum(p.cost)::float8 AS cost,COALESCE(sum(p.input),0)::float8 AS input,COALESCE(sum(p.output),0)::float8 AS output,
         count(p.id)::int AS calls,count(p.id) FILTER(WHERE p.input IS NOT NULL AND p.output IS NOT NULL)::int AS measured,count(p.id) FILTER(WHERE p.estimated)::int AS estimated,count(p.id) FILTER(WHERE p.unknown)::int AS unknown
       FROM identities a LEFT JOIN states s ON s.id=a.id AND s.type=a.type

package/src/ai/quotas.ts

@@ -3,6 +3,7 @@ import { type AccessSubject, buildAccessPrincipalCondition } from "../server/ser
 import { hasBillableAiPricing } from "../shared/ai-costs";
 import { type AiQuotaConfig, AiQuotaConfigSchema, type AiQuotaIdentity, type AiQuotaSnapshot } from "../shared/ai-quotas";
 import { readAiSettingsState } from "./settings";
+import type { AiSettingsState } from "./types";
 
 export class AiQuotaError extends Error {
   constructor(
@@ -43,10 +44,18 @@ export const aiQuotas = {
       return { ...config, revision };
     });
   },
-  async snapshot(subject: AccessSubject, model?: string, now = new Date(), db: SQL = sql): Promise<AiQuotaSnapshot> {
-    const config = await aiQuotas.config(db);
+  async snapshot(
+    subject: AccessSubject,
+    model?: string,
+    now = new Date(),
+    db: SQL = sql,
+    context?: { state: AiSettingsState; config: AiQuotaConfig },
+  ): Promise<AiQuotaSnapshot> {
+    const config = context?.config ?? (await aiQuotas.config(db));
     const identity = ids(subject);
-    const pricedModels = new Set((await readAiSettingsState()).profiles.filter((p) => hasBillableAiPricing(p.pricing)).map((p) => p.id));
+    const pricedModels = new Set(
+      (context?.state ?? (await readAiSettingsState())).profiles.filter((p) => hasBillableAiPricing(p.pricing)).map((p) => p.modelId),
+    );
     const matches = buildAccessPrincipalCondition({
       subject,
       columns: {
@@ -76,7 +85,7 @@ export const aiQuotas = {
             (c.finished_at IS NOT NULL OR (c.lease_expires_at <= now() OR (c.turn_id IS NOT NULL AND NOT EXISTS(SELECT 1 FROM ai.turns t WHERE t.id=c.turn_id AND t.attempt=c.turn_attempt AND t.status='running' AND t.lease_expires_at>now())))))::int AS unknown
         FROM ai.inference_calls c
         WHERE c.kind='chat' AND c.user_id IS NOT DISTINCT FROM ${identity.user}::uuid AND c.service_account_id IS NOT DISTINCT FROM ${identity.service}::uuid
-          AND (${rule.scope}='*' OR c.model_profile_id=${rule.scope})
+          AND (${rule.scope}='*' OR c.model_id=${rule.scope})
           AND c.started_at>=${window.from} AND c.started_at<${window.until}
           AND c.started_at>COALESCE((SELECT max(r.created_at) FROM ai.cost_resets r
             WHERE r.user_id IS NOT DISTINCT FROM ${identity.user}::uuid AND r.service_account_id IS NOT DISTINCT FROM ${identity.service}::uuid AND r.scope=${rule.scope}),'-infinity'::timestamptz)`;
@@ -110,13 +119,15 @@ export const aiQuotas = {
       GROUP BY model_profile_id ORDER BY model_profile_id`;
     return { enabled: config.enabled, unit: config.unit ?? "EUR", balances, usage };
   },
-  async assertAllowed(subject: AccessSubject, model: string) {
+  async assertAllowed(subject: AccessSubject, variantId: string, providedState?: AiSettingsState) {
+    const state = providedState ?? (await readAiSettingsState());
+    const profile = state.profiles.find((profile) => profile.id === variantId);
+    if (!profile || !hasBillableAiPricing(profile.pricing)) return false;
+    const model = profile.modelId;
     // Fast default path: no additional identity/usage queries on unrestricted installations.
-    const pricing = (await readAiSettingsState()).profiles.find((profile) => profile.id === model)?.pricing;
-    if (!hasBillableAiPricing(pricing)) return false;
     const config = await aiQuotas.config();
     if (!config.enabled || !config.rules.some((r) => r.scope === "*" || r.scope === model)) return false;
-    const snapshot = await aiQuotas.snapshot(subject, model);
+    const snapshot = await aiQuotas.snapshot(subject, model, undefined, undefined, { state, config });
     for (const b of snapshot.balances) {
       if (b.bypassed || b.limit === null) continue;
       if (b.unknown)

package/src/ai/recent-resources.ts

@@ -26,6 +26,8 @@ import type { AiConversationService, AiRecentResource } from "./types";
 export const AiRecentResourceSchema: z.ZodType<AiRecentResource> = z
   .object({
     ref: CloudResourceRefSchema,
+    context: LinkedCloudResourceReferenceSchema.shape.context,
+    status: LinkedCloudResourceReferenceSchema.shape.status,
     title: LinkedCloudResourceReferenceSchema.shape.title.unwrap(),
     icon: LinkedCloudResourceReferenceSchema.shape.icon,
     href: LinkedCloudResourceReferenceSchema.shape.href,
@@ -121,9 +123,9 @@ export const listAiRecentResources = async (input: {
   const skillIds = candidates.flatMap(({ ref }) => (ref.type === "core.ai.skill" ? [ref.id] : []));
   // Exactly the sent Skills, so a large Skill catalog never pushes one out; failing, they are left out like a reader.
   const skills = skillIds.length
-    ? withinBudget(signal, () =>
-        (deps.skills ?? aiSkills).list(input.authority.accessSubject, { shortIds: skillIds, authority: input.authority }),
-      ).catch(() => [])
+    ? withinBudget(signal, () => (deps.skills ?? aiSkills).list(input.authority, { shortIds: skillIds, authority: input.authority })).catch(
+        () => [],
+      )
     : Promise.resolve([]);
   const registry = candidates.some(({ ref }) => ref.type !== "core.ai.skill" && ref.type !== "assistant.artifact")
     ? withinBudget(signal, async () =>
@@ -183,6 +185,8 @@ export const listAiRecentResources = async (input: {
             ref,
             count,
             title: data.title,
+            context: ownRef?.context,
+            status: ownRef?.status,
             icon: ownRef?.icon ?? data.icon,
             href,
             preview: recentResourcePreview(ownRef?.preview ?? data.description),
@@ -229,6 +233,8 @@ export const listAiRecentResources = async (input: {
           ref,
           count,
           title: ownRef.title,
+          context: ownRef.context,
+          status: ownRef.status,
           icon: (ownRef.icon ?? type.icon ?? app.appIcon)?.slice(0, 120),
           href: ownRef.href,
           kind: type.title.slice(0, 120),

package/src/ai/request-headers.ts

@@ -1,117 +1,44 @@
 import { sql } from "bun";
-import { toPgTextArray } from "../services/postgres";
 import { decryptValue, encryptValue } from "../services/settings/crypto";
-import {
-  AI_REQUEST_HEADERS_PROVIDER_ERROR,
-  AiRequestHeadersSchema,
-  patchAiRequestHeaders,
-  providerSupportsRequestHeaders,
-} from "../shared/ai-request-options";
-import type { AiModelProfile } from "./types";
+import { AiRequestHeadersSchema, patchAiRequestHeaders } from "../shared/ai-request-options";
 
 type SqlClient = typeof sql;
-export type AiRequestHeaderPatch = { profileId: string; patch: unknown };
 
-const decryptHeaders = async (profileId: string, secret: string): Promise<Record<string, string>> => {
+const decryptHeaders = async (providerId: string, secret: string): Promise<Record<string, string>> => {
   try {
     const parsed = AiRequestHeadersSchema.safeParse(await decryptValue(secret));
     if (parsed.success && Object.values(parsed.data).every((value) => typeof value === "string"))
       return patchAiRequestHeaders({}, parsed.data);
   } catch {}
-  console.warn(`[ai] ignoring unreadable request headers for profile ${JSON.stringify(profileId)}`);
+  console.warn(`[ai] ignoring unreadable request headers for provider ${JSON.stringify(providerId)}`);
   return {};
 };
 
 /** Secrets stay server-side, in a separate encrypted row like provider API keys. */
-export const getAiRequestHeaders = async (profileId: string, db: SqlClient = sql): Promise<Record<string, string>> => {
-  const [row] = await db<{ secret: string }[]>`SELECT secret FROM ai.model_request_headers WHERE profile_id = ${profileId}`;
-  return row ? decryptHeaders(profileId, row.secret) : {};
+export const getAiRequestHeaders = async (providerId: string, db: SqlClient = sql): Promise<Record<string, string>> => {
+  const [row] = await db<{ secret: string }[]>`SELECT secret FROM ai.provider_request_headers WHERE provider_id = ${providerId}`;
+  return row ? decryptHeaders(providerId, row.secret) : {};
 };
 
-export const setAiRequestHeaders = async (profileId: string, headers: Record<string, string>, db: SqlClient = sql): Promise<void> => {
+export const setAiRequestHeaders = async (providerId: string, headers: Record<string, string>, db: SqlClient = sql): Promise<void> => {
   const normalized = patchAiRequestHeaders({}, headers);
   if (!Object.keys(normalized).length) {
-    await db`DELETE FROM ai.model_request_headers WHERE profile_id = ${profileId}`;
+    await db`DELETE FROM ai.provider_request_headers WHERE provider_id = ${providerId}`;
     return;
   }
   const encrypted = await encryptValue(normalized);
-  await db`INSERT INTO ai.model_request_headers (profile_id, secret) VALUES (${profileId}, ${encrypted})
-    ON CONFLICT (profile_id) DO UPDATE SET secret = EXCLUDED.secret, updated_at = now()`;
+  await db`INSERT INTO ai.provider_request_headers (provider_id, secret) VALUES (${providerId}, ${encrypted})
+    ON CONFLICT (provider_id) DO UPDATE SET secret = EXCLUDED.secret, updated_at = now()`;
 };
 
-/** Admin reads contain names only. Never serialize header values into profiles. */
+/** Admin reads contain names only. Never serialize header values into providers. */
 export const listAiRequestHeaderNames = async (db: SqlClient = sql): Promise<Record<string, string[]>> => {
-  const rows = await db<{ profile_id: string; secret: string }[]>`SELECT profile_id, secret FROM ai.model_request_headers`;
+  const rows = await db<{ provider_id: string; secret: string }[]>`SELECT provider_id, secret FROM ai.provider_request_headers`;
   const names: Record<string, string[]> = {};
   for (const row of rows)
-    Object.defineProperty(names, row.profile_id, {
-      value: Object.keys(await decryptHeaders(row.profile_id, row.secret)).sort(),
+    Object.defineProperty(names, row.provider_id, {
+      value: Object.keys(await decryptHeaders(row.provider_id, row.secret)).sort(),
       enumerable: true,
     });
   return names;
 };
-
-export const pruneAiRequestHeaders = async (keepProfileIds: readonly string[], db: SqlClient = sql): Promise<void> => {
-  if (!keepProfileIds.length) await db`DELETE FROM ai.model_request_headers`;
-  else await db`DELETE FROM ai.model_request_headers WHERE profile_id <> ALL(${toPgTextArray([...keepProfileIds])}::text[])`;
-};
-
-/** Follow credentials: changing provider discards stored secrets; omission preserves them on the same provider. */
-export const planAiProfileRequestHeaders = (input: {
-  currentProfiles: readonly AiModelProfile[];
-  nextProfiles: readonly AiModelProfile[];
-  existingNames: Record<string, string[]>;
-  submitted: readonly AiRequestHeaderPatch[];
-}): { keepHeaderProfileIds: string[]; patches: { profileId: string; patch: Record<string, string | null> }[]; error?: string } => {
-  const current = new Map(input.currentProfiles.map((profile) => [profile.id, profile]));
-  const keepHeaderProfileIds = input.nextProfiles
-    .filter(
-      (profile) =>
-        providerSupportsRequestHeaders(profile.provider) &&
-        current.get(profile.id)?.provider === profile.provider &&
-        !profile.capabilities.includes("transcription"),
-    )
-    .map((profile) => profile.id);
-  const patches: { profileId: string; patch: Record<string, string | null> }[] = [];
-  for (const submitted of input.submitted) {
-    const profile = input.nextProfiles.find((profile) => profile.id === submitted.profileId);
-    const parsed = AiRequestHeadersSchema.safeParse(submitted.patch);
-    if (!parsed.success)
-      return { keepHeaderProfileIds: [], patches: [], error: `requestHeaders: ${zodHeaderMessage(parsed.error.issues)}` };
-    if (!profile || !providerSupportsRequestHeaders(profile.provider))
-      return { keepHeaderProfileIds: [], patches: [], error: AI_REQUEST_HEADERS_PROVIDER_ERROR };
-    if (profile.capabilities.includes("transcription"))
-      return {
-        keepHeaderProfileIds: [],
-        patches: [],
-        error: "requestHeaders: Request settings are not supported on transcription profiles.",
-      };
-    const oldNames =
-      keepHeaderProfileIds.includes(profile.id) && Object.hasOwn(input.existingNames, profile.id) ? input.existingNames[profile.id]! : [];
-    try {
-      patchAiRequestHeaders(Object.fromEntries(oldNames.map((name) => [name, ""])), parsed.data);
-    } catch {
-      return {
-        keepHeaderProfileIds: [],
-        patches: [],
-        error: "requestHeaders: At most 32 extra headers are allowed after applying the patch.",
-      };
-    }
-    patches.push({ profileId: profile.id, patch: parsed.data });
-  }
-  return { keepHeaderProfileIds, patches };
-};
-
-const zodHeaderMessage = (issues: readonly { path: readonly PropertyKey[]; message: string }[]) =>
-  issues.map((issue) => `${issue.path.map(String).join(".") || "headers"}: ${issue.message}`).join("; ");
-
-/** Apply after pruning so a provider change cannot inherit old secrets. Call inside the settings transaction. */
-export const storeAiRequestHeaderPlan = async (
-  plan: ReturnType<typeof planAiProfileRequestHeaders>,
-  db: SqlClient = sql,
-): Promise<void> => {
-  if (plan.error) throw new Error(plan.error);
-  await pruneAiRequestHeaders(plan.keepHeaderProfileIds, db);
-  for (const { profileId, patch } of plan.patches)
-    await setAiRequestHeaders(profileId, patchAiRequestHeaders(await getAiRequestHeaders(profileId, db), patch), db);
-};