@k2b/cloud 0.6.0-rc.0 → 0.7.0

package/src/ai/provider.ts

@@ -10,12 +10,11 @@ const commonOptions = (profile: AiModelProfile, apiKey?: string) => ({
   baseURL: profile.baseURL,
   contextWindow: profile.contextWindow,
   temperature: profile.temperature,
-  creditsPerInputToken: profile.creditsPerInputToken,
-  creditsPerOutputToken: profile.creditsPerOutputToken,
   timeouts: PROVIDER_TIMEOUTS,
 });
 
 export const createAiProvider = (profile: AiModelProfile, apiKey?: string): Provider => {
+  if (profile.capabilities.includes("transcription")) throw new Error("Transcription profiles cannot be used for chat generation.");
   switch (profile.provider) {
     case "openai":
       return openai(profile.model, commonOptions(profile, apiKey));
@@ -32,8 +31,6 @@ export const createAiProvider = (profile: AiModelProfile, apiKey?: string): Prov
         baseURL: profile.baseURL,
         contextWindow: profile.contextWindow,
         temperature: profile.temperature,
-        creditsPerInputToken: profile.creditsPerInputToken,
-        creditsPerOutputToken: profile.creditsPerOutputToken,
         timeouts: PROVIDER_TIMEOUTS,
       });
     case "vllm":
@@ -44,8 +41,6 @@ export const createAiProvider = (profile: AiModelProfile, apiKey?: string): Prov
         apiKey,
         contextWindow: profile.contextWindow,
         temperature: profile.temperature,
-        creditsPerInputToken: profile.creditsPerInputToken,
-        creditsPerOutputToken: profile.creditsPerOutputToken,
         timeouts: PROVIDER_TIMEOUTS,
         compat: {
           toolCallIdPolicy: "passthrough",
@@ -65,8 +60,6 @@ export const createAiProvider = (profile: AiModelProfile, apiKey?: string): Prov
         apiKey,
         contextWindow: profile.contextWindow,
         temperature: profile.temperature,
-        creditsPerInputToken: profile.creditsPerInputToken,
-        creditsPerOutputToken: profile.creditsPerOutputToken,
         timeouts: PROVIDER_TIMEOUTS,
       });
   }

package/src/ai/quota-provider.ts

@@ -0,0 +1,191 @@
+import { isAssistantChatTurn } from "./assistant-models";
+import { estimateTokens, type Provider } from "@k2b/nessi";
+import type { AccessSubject } from "../server/services/access";
+import { sql } from "bun";
+import { setTimeout as delay } from "node:timers/promises";
+import { AiBackgroundAdmissionError, beginAiCall, finishAiCall, type AiCallContext } from "./inference-calls";
+import type { AiModelProfile } from "./types";
+import { logger } from "../services/logging";
+const log = logger("ai:quotas");
+
+/** One wrapper owns call accounting. complete() can have a separate compaction purpose. */
+const callLifecycle = {
+  begin: beginAiCall,
+  finish: finishAiCall,
+  heartbeat: async (id: string) => {
+    await sql`UPDATE ai.inference_calls SET lease_expires_at=now()+interval '2 minutes' WHERE id=${id}::uuid AND finished_at IS NULL`;
+  },
+};
+export function inferenceProvider(
+  provider: Provider,
+  profile: AiModelProfile,
+  context: AiCallContext,
+  completeContext = context,
+  lifecycle = callLifecycle,
+): Provider {
+  const begin = async (request: Parameters<Provider["complete"]>[0], ctx: AiCallContext) => {
+    const messages = request.messages.map((message) =>
+      message.role === "user"
+        ? {
+            ...message,
+            content: message.content.filter((part) => typeof part === "string" || part.type !== "file"),
+          }
+        : message,
+    );
+    const inputTokens =
+      estimateTokens(messages) +
+      Math.ceil(
+        ((request.systemPrompt?.length ?? 0) +
+          JSON.stringify(request.tools ?? []).length +
+          JSON.stringify(request.responseFormat ?? {}).length) /
+          4,
+      );
+    // Wait up to one reservation lease before delegating to the caller's retry policy.
+    // No provider request or new reservation exists while waiting; cancellation stays active.
+    const deadline = Date.now() + 120_000;
+    const admit = async () => {
+      for (;;) {
+        request.signal?.throwIfAborted();
+        try {
+          return await lifecycle.begin(
+            profile,
+            ctx,
+            inputTokens,
+            request.maxOutputTokens ?? profile.maxOutputTokens,
+            // Nessi's Anthropic adapter defaults to 1024; other adapters use the model default.
+            provider.family === "anthropic" ? 1024 : provider.contextWindow,
+          );
+        } catch (error) {
+          if (!(error instanceof AiBackgroundAdmissionError) || !error.retryable || Date.now() >= deadline) throw error;
+          await delay(1_000, undefined, { signal: request.signal });
+        }
+      }
+    };
+    const call = await admit();
+    const heartbeat = setInterval(() => {
+      void lifecycle.heartbeat(call.id).catch(() => log.warn("AI accounting heartbeat failed", { callId: call.id }));
+    }, 30_000);
+    return { ...call, inputTokens, stop: () => clearInterval(heartbeat) };
+  };
+  const finish = async (id: string, usage: Parameters<typeof finishAiCall>[1], status: "ok" | "failed") => {
+    try {
+      await lifecycle.finish(id, usage, status);
+    } catch {
+      log.error("AI cost booking failed", { callId: id, code: "ai_cost_booking_failed" });
+    }
+  };
+  return {
+    name: provider.name,
+    family: provider.family,
+    model: provider.model,
+    contextWindow: provider.contextWindow,
+    capabilities: provider.capabilities,
+    complete: async (request) => {
+      const call = await begin(request, completeContext);
+      let usage: Parameters<typeof finishAiCall>[1];
+      let status: "ok" | "failed" = "failed";
+      try {
+        const result = await provider.complete({ ...request, maxOutputTokens: call.maxOutputTokens });
+        if (
+          result.usage &&
+          [result.usage.input, result.usage.output].every((n) => Number.isSafeInteger(n) && n >= 0) &&
+          result.usage.input + result.usage.output > 0
+        )
+          usage = { input: result.usage.input, output: result.usage.output };
+        status = ["error", "aborted", "interrupted"].includes(result.finishReason) ? "failed" : "ok";
+        return result;
+      } finally {
+        call.stop();
+        if (!usage && status === "failed") usage = { input: call.inputTokens, output: 0, estimated: true };
+        await finish(call.id, usage, status);
+      }
+    },
+    stream: async function* (request) {
+      const call = await begin(request, context);
+      const id = call.id;
+      let usage: { input: number; output: number; estimated?: boolean } | undefined;
+      let completed = false;
+      let failed = false;
+      const outputBlocks = new Map<string, number>();
+      let generated = false;
+      try {
+        for await (const event of provider.stream({ ...request, maxOutputTokens: call.maxOutputTokens })) {
+          if (event.type === "issue" && event.issue.kind === "provider_error") failed = true;
+          if (event.type === "block_delta") outputBlocks.set(event.blockId, (outputBlocks.get(event.blockId) ?? 0) + event.delta.length);
+          if (event.type === "block_end") {
+            const block = event.block;
+            const size =
+              block.type === "text"
+                ? block.text.length
+                : block.type === "thinking"
+                  ? block.thinking.length
+                  : block.name.length + JSON.stringify(block.args).length;
+            outputBlocks.set(event.blockId, size);
+          }
+          if (event.type === "block_start" || event.type === "block_delta" || event.type === "block_end") generated = true;
+          if (event.type === "issue" && event.issue.kind === "provider_error" && event.issue.contextOverflow && !generated && !usage)
+            usage = { input: 0, output: 0 };
+          if (event.type === "usage") {
+            if (event.finishReason === "aborted" || event.finishReason === "interrupted" || event.finishReason === "error") failed = true;
+            const { input, output } = event.usage;
+            // Some adapters synthesize all-zero usage when the endpoint reports none.
+            if (Number.isSafeInteger(input) && Number.isSafeInteger(output) && input >= 0 && output >= 0 && input + output > 0)
+              usage = { input, output };
+          }
+          yield event;
+        }
+        completed = true;
+      } finally {
+        call.stop();
+        if (id) {
+          try {
+            // Interrupted adapters commonly omit their final usage event. Charge an
+            // explicitly labelled estimate, never invent a measured zero.
+            const interrupted = !completed || failed || request.signal?.aborted;
+            if (!usage && interrupted) {
+              // Encoded files are not text tokens. Their provider-specific costs
+              // cannot be reconstructed after interruption.
+              const messages = request.messages.map((message) =>
+                message.role === "user"
+                  ? {
+                      ...message,
+                      content: message.content.filter((part) => typeof part === "string" || part.type !== "file"),
+                    }
+                  : message,
+              );
+              const instructionSize =
+                (request.systemPrompt?.length ?? 0) +
+                JSON.stringify(request.tools ?? []).length +
+                JSON.stringify(request.responseFormat ?? {}).length;
+              usage = {
+                input: estimateTokens(messages) + Math.ceil(instructionSize / 4),
+                output: Math.ceil(Array.from(outputBlocks.values()).reduce((sum, size) => sum + size, 0) / 4),
+                estimated: true,
+              };
+            }
+            await finish(id, usage, completed && !failed && !request.signal?.aborted ? "ok" : "failed");
+          } catch (error) {
+            log.warn("Chat usage booking failed", { code: "quota_booking_failed", turnId: context.turnId, callId: id });
+          }
+        }
+      }
+    },
+  };
+}
+
+export function assistantQuotaProvider(
+  provider: Provider,
+  config: Parameters<typeof isAssistantChatTurn>[0],
+  subject: AccessSubject | null,
+  profile: AiModelProfile,
+  turnId: string,
+  conversationId: string,
+) {
+  const common = { subject, turnId, conversationId };
+  return inferenceProvider(
+    provider,
+    profile,
+    { ...common, kind: isAssistantChatTurn(config) ? "chat" : "background", task: isAssistantChatTurn(config) ? "chat" : "agent-turn" },
+    { ...common, kind: "background", task: "chat-compaction" },
+  );
+}

package/src/ai/quota-report.ts

@@ -0,0 +1,152 @@
+import { hasBillableAiPricing } from "../shared/ai-costs";
+import { readAiSettingsState } from "./settings";
+import { toPgTextArray } from "../services/postgres";
+import { sql } from "bun";
+import { recursiveGroupIdsSubquery } from "../services/accounts/group-sql";
+import { AiQuotaReportQuerySchema, type AiQuotaReport, type AiQuotaReportQuery } from "../shared/ai-quotas";
+import { resolveDisplayNames } from "../server/services/access";
+import { aiQuotas } from "./quotas";
+
+/** Resolve display metadata only for administration, never on the inference path. */
+export async function quotaAdminConfig() {
+  const config = await aiQuotas.config();
+  const grants = await resolveDisplayNames(config.rules.flatMap((rule) => rule.grants));
+  let offset = 0;
+  return {
+    ...config,
+    rules: config.rules.map((rule) => ({
+      ...rule,
+      grants: rule.grants.map(() => {
+        const grant = grants[offset++]!;
+        return { principal: grant.principal, limit: grant.limit, displayName: grant.displayName };
+      }),
+    })),
+  };
+}
+
+/** One database snapshot: aggregate and filter the cohort before paginating identities. */
+export async function quotaReport(input: Partial<AiQuotaReportQuery> = {}, now = new Date()): Promise<AiQuotaReport> {
+  const query = AiQuotaReportQuerySchema.parse(input);
+  const until = new Date(Math.min(Date.parse(query.until ?? now.toISOString()), now.getTime()));
+  const days = { "24h": 1, "7d": 7, "30d": 30, "90d": 90 }[query.range];
+  const since = new Date(until.getTime() - days * 86400000);
+  if (query.view === "rules")
+    return {
+      query,
+      since: since.toISOString(),
+      until: until.toISOString(),
+      asOf: now.toISOString(),
+      overview: { cost: null, accounts: 0, input: 0, output: 0, calls: 0, measured: 0, estimated: 0, unknown: 0 },
+      timeline: [],
+      models: [],
+      items: [],
+      selected: null,
+      total: 0,
+      page: 1,
+      perPage: 25,
+    };
+  const pricedModels = (await readAiSettingsState()).profiles.filter((p) => hasBillableAiPricing(p.pricing)).map((p) => p.id);
+  const bucket = query.range === "24h" ? "hour" : "day";
+  const order = query.sort === "label" ? sql`label` : query.sort === "cost" ? sql`cost` : sql`last_used`;
+  const direction = query.direction === "asc" ? sql`ASC` : sql`DESC`;
+  // JSON grant cardinality is unknown to the planner; JIT compilation otherwise
+  // dominates small admin reports. Scope this setting to this read transaction.
+  const [data] = await sql.begin(async (db) => {
+    await db`SET LOCAL jit = off`;
+    return db<Omit<AiQuotaReport, "query" | "since" | "until" | "asOf">[]>`
+    WITH config AS MATERIALIZED (SELECT enabled,rules FROM ai.cost_config WHERE singleton),
+    rules AS MATERIALIZED (
+      SELECT r->>'scope' AS scope,r->'grants' AS grants,
+        (r->>'anchor')::timestamptz + floor(extract(epoch FROM (${now}::timestamptz-(r->>'anchor')::timestamptz)) / ((r->>'hours')::int*3600)) * ((r->>'hours')::int*interval '1 hour') AS starts
+      FROM config,jsonb_array_elements(rules) r WHERE (${query.model}='' OR (r->>'scope' IN ('*',${query.model}) AND ${query.model}=ANY(${toPgTextArray(pricedModels)}::text[]))) AND (r->>'scope'='*' OR r->>'scope'=ANY(${toPgTextArray(pricedModels)}::text[]))
+    ), accounts AS (
+      SELECT 'user'::text AS type,u.id,COALESCE(NULLIF(u.display_name,''),u.uid) AS label,u.id AS user_id,NULL::uuid AS service_id
+      FROM auth.users u WHERE ${query.search}<>'' OR EXISTS(SELECT 1 FROM ai.inference_calls WHERE kind='chat' AND user_id=u.id)
+        OR EXISTS(SELECT 1 FROM ai.conversations c JOIN ai.turns t ON t.conversation_id=c.id WHERE c.created_by_user_id=u.id AND t.run_config->>'assistantChat'='true' AND t.run_config->'mandate' IS NULL)
+      UNION ALL SELECT 'service_account',id,name,NULL::uuid,id FROM auth.service_accounts s
+      WHERE ${query.search}<>'' OR EXISTS(SELECT 1 FROM ai.inference_calls WHERE kind='chat' AND service_account_id=s.id)
+    ), identities AS MATERIALIZED (
+      SELECT a.*,ARRAY(SELECT group_id FROM (${recursiveGroupIdsSubquery(sql`a.user_id`)}) groups) AS groups
+      FROM accounts a WHERE position(lower(${query.search}) in lower(label))>0 OR id::text=${query.search}
+    ), calls AS MATERIALIZED (
+      SELECT c.*,COALESCE(c.user_id,c.service_account_id) AS identity_id,
+        CASE WHEN c.user_id IS NOT NULL THEN 'user' ELSE 'service_account' END AS identity_type,
+        (COALESCE((c.pricing->>'inputPerMillion')::numeric,0)>0 OR COALESCE((c.pricing->>'outputPerMillion')::numeric,0)>0) AND c.cost IS NULL AND (c.finished_at IS NOT NULL OR (c.lease_expires_at<=${now} OR (c.turn_id IS NOT NULL AND NOT EXISTS(SELECT 1 FROM ai.turns t WHERE t.id=c.turn_id AND t.attempt=c.turn_attempt AND t.status='running' AND t.lease_expires_at>${now})))) AS unknown
+      FROM ai.inference_calls c WHERE c.kind='chat' AND c.started_at<=${now}
+    ), periods AS MATERIALIZED (
+      SELECT * FROM calls WHERE started_at>=${since} AND started_at<${until}
+        AND (${query.model}='' OR model_profile_id=${query.model})
+    ), allowances AS MATERIALIZED (
+      SELECT a.id,a.type,r.scope,
+        CASE WHEN bool_or((g->>'limit') IS NULL) FILTER(WHERE g IS NOT NULL) THEN NULL ELSE COALESCE(max((g->>'limit')::float8),0) END AS amount,
+        r.starts
+      FROM identities a CROSS JOIN rules r
+      LEFT JOIN LATERAL (SELECT g FROM jsonb_array_elements(r.grants) g WHERE
+        g->'principal'->>'type'='authenticated'
+        OR (g->'principal'->>'userId')::uuid=a.user_id
+        OR (g->'principal'->>'serviceAccountId')::uuid=a.service_id
+        OR (g->'principal'->>'groupId')::uuid=ANY(a.groups)) grant_match ON true
+      GROUP BY a.id,a.type,r.scope,r.starts
+    ), balances AS MATERIALIZED (
+      SELECT a.*,COALESCE(sum(c.cost),0)::float8 AS used,count(c.id) FILTER(WHERE c.unknown)::int AS unknown
+      FROM allowances a LEFT JOIN calls c ON c.identity_id=a.id AND c.identity_type=a.type
+        AND (a.scope='*' OR c.model_profile_id=a.scope) AND c.started_at>=a.starts
+        AND c.started_at>COALESCE((SELECT max(created_at) FROM ai.cost_resets z
+          WHERE COALESCE(z.user_id,z.service_account_id)=a.id AND (z.user_id IS NOT NULL)=(a.type='user') AND z.scope=a.scope),'-infinity'::timestamptz)
+      GROUP BY a.id,a.type,a.scope,a.amount,a.starts
+    ), states AS MATERIALIZED (
+      SELECT id,type,count(*)::int AS scopes,
+        count(*) FILTER(WHERE amount IS NOT NULL AND used>=amount)::int AS exhausted,
+        CASE WHEN bool_or(scope='*' AND amount IS NULL) THEN 'unlimited'
+          WHEN bool_or(amount IS NOT NULL AND unknown>0) THEN 'unknown'
+          WHEN bool_or(amount IS NOT NULL AND used>=amount) THEN 'exhausted'
+          WHEN bool_or(amount IS NOT NULL) THEN 'available' ELSE 'unlimited' END AS status
+      FROM balances GROUP BY id,type
+    ), summary AS MATERIALIZED (
+      SELECT a.id,a.type,a.label,
+        CASE WHEN NOT COALESCE((SELECT enabled FROM config),false) THEN 'disabled' ELSE COALESCE(s.status,'unlimited') END AS status,
+        COALESCE(s.scopes,0) AS scopes,CASE WHEN s.status='unlimited' OR NOT COALESCE((SELECT enabled FROM config),false) THEN 0 ELSE COALESCE(s.exhausted,0) END AS exhausted,
+        (SELECT max(started_at) FROM calls c WHERE c.identity_id=a.id AND c.identity_type=a.type AND (${query.model}='' OR c.model_profile_id=${query.model})) AS last_used,
+        sum(p.cost)::float8 AS cost,COALESCE(sum(p.input),0)::float8 AS input,COALESCE(sum(p.output),0)::float8 AS output,
+        count(p.id)::int AS calls,count(p.id) FILTER(WHERE p.input IS NOT NULL AND p.output IS NOT NULL)::int AS measured,count(p.id) FILTER(WHERE p.estimated)::int AS estimated,count(p.id) FILTER(WHERE p.unknown)::int AS unknown
+      FROM identities a LEFT JOIN states s ON s.id=a.id AND s.type=a.type
+      LEFT JOIN periods p ON p.identity_id=a.id AND p.identity_type=a.type
+      GROUP BY a.id,a.type,a.label,s.status,s.scopes,s.exhausted
+    ), cohort AS MATERIALIZED (
+      SELECT * FROM summary WHERE ${query.status}='all' OR status=${query.status}
+    ), selected_calls AS (
+      SELECT p.* FROM periods p JOIN cohort a ON a.id=p.identity_id AND a.type=p.identity_type
+    ), pagination AS (
+      SELECT count(*)::int AS total,least(${query.page},greatest(1,ceil(count(*)/25.0)))::int AS page,25 AS "perPage" FROM cohort
+    ), page_rows AS (
+      SELECT id,type,label,cost,input,output,calls,measured,estimated,unknown,status,scopes,exhausted,
+        COALESCE((SELECT jsonb_agg(jsonb_build_object('scope',b.scope,'limit',b.amount,'used',b.used,'unknown',b.unknown,
+          'bypassed', NOT COALESCE((SELECT enabled FROM config),false) OR (b.scope<>'*' AND EXISTS(SELECT 1 FROM balances w WHERE w.id=b.id AND w.type=b.type AND w.scope='*' AND w.amount IS NULL))) ORDER BY b.scope)
+          FROM balances b WHERE b.id=cohort.id AND b.type=cohort.type),'[]') AS balances,
+        to_char(last_used AT TIME ZONE 'UTC','YYYY-MM-DD"T"HH24:MI:SS.MS"Z"') AS "lastUsed"
+      FROM cohort ORDER BY ${order} ${direction} NULLS LAST,id,type LIMIT 25 OFFSET ((SELECT page FROM pagination)-1)*25
+    ), timeline AS (
+      SELECT date_trunc(${bucket},started_at AT TIME ZONE 'UTC') AS bucket,
+        sum(cost)::float8 AS cost,COALESCE(sum(input),0)::float8 AS input,COALESCE(sum(output),0)::float8 AS output,count(*)::int AS calls,count(*) FILTER(WHERE input IS NOT NULL AND output IS NOT NULL)::int AS measured,count(*) FILTER(WHERE unknown)::int AS unknown
+      FROM selected_calls GROUP BY 1 ORDER BY 1
+    ), models AS (
+      SELECT model_profile_id AS model,sum(cost)::float8 AS cost,COALESCE(sum(input),0)::float8 AS input,COALESCE(sum(output),0)::float8 AS output,
+        count(*)::int AS calls,count(*) FILTER(WHERE input IS NOT NULL AND output IS NOT NULL)::int AS measured,count(*) FILTER(WHERE unknown)::int AS unknown
+      FROM selected_calls GROUP BY 1 ORDER BY sum(cost) DESC NULLS LAST,model_profile_id LIMIT 20
+    ) SELECT pagination.*,
+      (SELECT jsonb_build_object('cost',sum(cost),'accounts',count(*) FILTER(WHERE calls>0),'input',COALESCE(sum(input),0),'output',COALESCE(sum(output),0),
+        'calls',COALESCE(sum(calls),0),'measured',COALESCE(sum(measured),0),'estimated',COALESCE(sum(estimated),0),'unknown',COALESCE(sum(unknown),0)) FROM cohort) AS overview,
+      (SELECT jsonb_build_object('id',id,'type',type,'label',label,'lastUsed',NULL) FROM accounts WHERE id=${query.identity ?? null}::uuid AND type=${query.identityType}) AS selected,
+      COALESCE((SELECT jsonb_agg(page_rows) FROM page_rows),'[]') AS items,
+      COALESCE((SELECT jsonb_agg(jsonb_build_object('cost',cost,'at',to_char(bucket,'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'),'input',input,'output',output,'calls',calls,'measured',measured,'unknown',unknown)) FROM timeline),'[]') AS timeline,
+      COALESCE((SELECT jsonb_agg(models) FROM models),'[]') AS models FROM pagination`;
+  });
+  if (!data) throw new Error("Quota report returned no snapshot");
+  return {
+    ...data,
+    query: { ...query, until: until.toISOString(), page: data.page },
+    since: since.toISOString(),
+    until: until.toISOString(),
+    asOf: now.toISOString(),
+  };
+}

package/src/ai/quotas-migrate.ts

@@ -0,0 +1,45 @@
+import { sql } from "bun";
+export async function migrateAiQuotas() {
+  await sql.begin(async (db) => {
+    await db`CREATE TABLE IF NOT EXISTS ai.cost_config (
+      singleton BOOLEAN PRIMARY KEY DEFAULT true CHECK(singleton), enabled BOOLEAN NOT NULL DEFAULT false,
+      revision INTEGER NOT NULL DEFAULT 0, rules JSONB NOT NULL DEFAULT '[]',
+      unit TEXT NOT NULL DEFAULT 'EUR', background JSONB, background_stopped_at TIMESTAMPTZ, background_warned BOOLEAN NOT NULL DEFAULT false
+    )`;
+    await db`CREATE TABLE IF NOT EXISTS ai.cost_alerts (
+      id UUID PRIMARY KEY, kind TEXT NOT NULL CHECK(kind IN ('warning','stop')), cost NUMERIC(30,12) NOT NULL,
+      unit TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp()
+    )`;
+    await db`INSERT INTO ai.cost_config(singleton) VALUES(true) ON CONFLICT DO NOTHING`;
+    await db`CREATE TABLE IF NOT EXISTS ai.inference_calls (
+      id UUID PRIMARY KEY, user_id UUID REFERENCES auth.users(id) ON DELETE SET NULL,
+      service_account_id UUID REFERENCES auth.service_accounts(id) ON DELETE SET NULL,
+      model_profile_id TEXT NOT NULL, turn_id UUID, turn_attempt INTEGER, started_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+      finished_at TIMESTAMPTZ, input BIGINT, output BIGINT,
+      kind TEXT NOT NULL CHECK(kind IN ('chat','background')), task TEXT NOT NULL,
+      provider_model TEXT NOT NULL, app_id TEXT, conversation_id UUID, workflow_run_id UUID,
+      step_key TEXT, trace_id TEXT, workflow_id UUID, workflow_name TEXT, workflow_version INTEGER, pricing JSONB, cost NUMERIC(30,12), reserved NUMERIC(30,12) NOT NULL DEFAULT 0,
+      lease_expires_at TIMESTAMPTZ NOT NULL, status TEXT NOT NULL DEFAULT 'running', error_code TEXT,
+      CHECK(cost IS NULL OR cost>=0), CHECK(reserved>=0),
+      CHECK(input IS NULL OR input>=0), CHECK(output IS NULL OR output>=0)
+    )`;
+    await db`ALTER TABLE ai.inference_calls ADD COLUMN IF NOT EXISTS estimated BOOLEAN NOT NULL DEFAULT false`;
+    await db`CREATE INDEX IF NOT EXISTS inference_calls_workflow ON ai.inference_calls(workflow_run_id,started_at)`;
+    await db`CREATE INDEX IF NOT EXISTS inference_calls_started ON ai.inference_calls(started_at)`;
+    await db`CREATE INDEX IF NOT EXISTS inference_calls_turn ON ai.inference_calls(turn_id,started_at,id) WHERE kind='chat'`;
+    await db`CREATE INDEX IF NOT EXISTS inference_calls_user ON ai.inference_calls(user_id,started_at)`;
+    await db`CREATE INDEX IF NOT EXISTS inference_calls_service ON ai.inference_calls(service_account_id,started_at)`;
+    await db`CREATE TABLE IF NOT EXISTS ai.cost_resets (
+      request_id UUID PRIMARY KEY, user_id UUID REFERENCES auth.users(id) ON DELETE CASCADE,
+      service_account_id UUID REFERENCES auth.service_accounts(id) ON DELETE CASCADE,
+      scope TEXT NOT NULL, created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(),
+      actor_id UUID REFERENCES auth.users(id) ON DELETE SET NULL,
+      CHECK(num_nonnulls(user_id,service_account_id)=1)
+    )`;
+    await db`CREATE INDEX IF NOT EXISTS cost_resets_user ON ai.cost_resets(user_id,service_account_id,scope,created_at)`;
+    await db`CREATE TABLE IF NOT EXISTS ai.cost_changes (
+      revision INTEGER PRIMARY KEY, actor_id UUID REFERENCES auth.users(id) ON DELETE SET NULL,
+      created_at TIMESTAMPTZ NOT NULL DEFAULT clock_timestamp(), config JSONB NOT NULL
+    )`;
+  });
+}

package/src/ai/quotas.ts

@@ -0,0 +1,168 @@
+import { hasBillableAiPricing } from "../shared/ai-costs";
+import { readAiSettingsState } from "./settings";
+import { sql, type SQL } from "bun";
+import { buildAccessPrincipalCondition, type AccessSubject } from "../server/services/access";
+import { AiQuotaConfigSchema, type AiQuotaConfig, type AiQuotaSnapshot, type AiQuotaIdentity } from "../shared/ai-quotas";
+
+export class AiQuotaError extends Error {
+  constructor(
+    public code: "quota_exhausted" | "quota_usage_unknown" | "quota_conflict",
+    message: string,
+  ) {
+    super(message);
+  }
+}
+const ids = (s: AccessSubject) => ({
+  user: s.type === "user" ? s.userId : null,
+  service: s.type === "service_account" ? s.serviceAccountId : null,
+});
+export const quotaWindow = (anchor: string, hours: number, now: Date) => {
+  const width = hours * 3_600_000,
+    start = Date.parse(anchor);
+  const from = start + Math.floor((now.getTime() - start) / width) * width;
+  return { from: new Date(from), until: new Date(from + width) };
+};
+export const aiQuotas = {
+  async config(db: SQL = sql): Promise<AiQuotaConfig> {
+    const [row] = await db<AiQuotaConfig[]>`SELECT enabled,revision,rules,unit,background FROM ai.cost_config WHERE singleton`;
+    return row ? { ...row, background: row.background ?? undefined } : { enabled: false, revision: 0, rules: [], unit: "EUR" };
+  },
+  async save(input: AiQuotaConfig, actorId: string) {
+    const config = AiQuotaConfigSchema.parse(input);
+    return sql.begin(async (db) => {
+      const [old] = await db<{ revision: number; unit: string }[]>`SELECT revision,unit FROM ai.cost_config WHERE singleton FOR UPDATE`;
+      if (!old || old.revision !== config.revision)
+        throw new AiQuotaError("quota_conflict", "Quota settings changed. Reload before saving.");
+      if ((config.unit ?? "EUR") !== old.unit) {
+        const [used] = await db`SELECT 1 FROM ai.inference_calls WHERE pricing IS NOT NULL LIMIT 1`;
+        if (used) throw new AiQuotaError("quota_conflict", "The accounting unit cannot change after priced usage has been recorded.");
+      }
+      const revision = config.revision + 1;
+      await db`UPDATE ai.cost_config SET enabled=${config.enabled},revision=${revision},rules=(${JSON.stringify(config.rules)}::text)::jsonb,unit=${config.unit ?? "EUR"},background=(${config.background ? JSON.stringify(config.background) : null}::text)::jsonb WHERE singleton`;
+      await db`INSERT INTO ai.cost_changes(revision,actor_id,config) VALUES(${revision},${actorId}::uuid,(${JSON.stringify(config)}::text)::jsonb)`;
+      return { ...config, revision };
+    });
+  },
+  async snapshot(subject: AccessSubject, model?: string, now = new Date(), db: SQL = sql): Promise<AiQuotaSnapshot> {
+    const config = await aiQuotas.config(db);
+    const identity = ids(subject);
+    const pricedModels = new Set((await readAiSettingsState()).profiles.filter((p) => hasBillableAiPricing(p.pricing)).map((p) => p.id));
+    const matches = buildAccessPrincipalCondition({
+      subject,
+      columns: {
+        userId: sql`NULLIF(g->'principal'->>'userId','')::uuid`,
+        groupId: sql`NULLIF(g->'principal'->>'groupId','')::uuid`,
+        serviceAccountId: sql`NULLIF(g->'principal'->>'serviceAccountId','')::uuid`,
+        authenticatedOnly: sql`(g->'principal'->>'type'='authenticated')`,
+      },
+    });
+    const balances: AiQuotaSnapshot["balances"] = [];
+    for (const rule of config.rules.filter((r) => !model || r.scope === "*" || r.scope === model)) {
+      const grants = await db<
+        { limit: number | null; principal: AiQuotaConfig["rules"][number]["grants"][number]["principal"]; label: string }[]
+      >`
+        SELECT (g->>'limit')::float8 AS limit, g->'principal' AS principal,
+          COALESCE(u.display_name,u.uid,gr.name,sa.name,'Authenticated users') AS label
+        FROM jsonb_array_elements((${JSON.stringify(rule.grants)}::text)::jsonb) g
+        LEFT JOIN auth.users u ON u.id=NULLIF(g->'principal'->>'userId','')::uuid
+        LEFT JOIN auth.groups gr ON gr.id=NULLIF(g->'principal'->>'groupId','')::uuid
+        LEFT JOIN auth.service_accounts sa ON sa.id=NULLIF(g->'principal'->>'serviceAccountId','')::uuid
+        WHERE ${matches}`;
+      const limit = grants.some((g) => g.limit === null) ? null : Math.max(0, ...grants.map((g) => g.limit ?? 0));
+      const window = quotaWindow(rule.anchor, rule.hours, now);
+      const [counts] = await db<{ input: number; output: number; used: number; unknown: number; estimated: number }[]>`
+        SELECT COALESCE(sum(c.cost),0)::float8 AS used, COALESCE(sum(c.input),0)::float8 AS input, COALESCE(sum(c.output),0)::float8 AS output, count(*) FILTER(WHERE c.estimated)::int AS estimated,
+          count(*) FILTER(WHERE (COALESCE((c.pricing->>'inputPerMillion')::numeric,0)>0 OR COALESCE((c.pricing->>'outputPerMillion')::numeric,0)>0) AND c.cost IS NULL AND
+            (c.finished_at IS NOT NULL OR (c.lease_expires_at <= now() OR (c.turn_id IS NOT NULL AND NOT EXISTS(SELECT 1 FROM ai.turns t WHERE t.id=c.turn_id AND t.attempt=c.turn_attempt AND t.status='running' AND t.lease_expires_at>now())))))::int AS unknown
+        FROM ai.inference_calls c
+        WHERE c.kind='chat' AND c.user_id IS NOT DISTINCT FROM ${identity.user}::uuid AND c.service_account_id IS NOT DISTINCT FROM ${identity.service}::uuid
+          AND (${rule.scope}='*' OR c.model_profile_id=${rule.scope})
+          AND c.started_at>=${window.from} AND c.started_at<${window.until}
+          AND c.started_at>COALESCE((SELECT max(r.created_at) FROM ai.cost_resets r
+            WHERE r.user_id IS NOT DISTINCT FROM ${identity.user}::uuid AND r.service_account_id IS NOT DISTINCT FROM ${identity.service}::uuid AND r.scope=${rule.scope}),'-infinity'::timestamptz)`;
+      balances.push({
+        scope: rule.scope,
+        limit,
+        input: counts?.input ?? 0,
+        output: counts?.output ?? 0,
+        used: counts?.used ?? 0,
+        unknown: counts?.unknown ?? 0,
+        estimated: counts?.estimated ?? 0,
+        resetsAt: window.until.toISOString(),
+        sources: grants.filter((g) => g.limit === limit).map((g) => g.label),
+        sourceDetails: grants.filter((g) => g.limit === limit).map((g) => ({ principal: g.principal, displayName: g.label })),
+        bypassed: false,
+      });
+    }
+    const unlimited = balances.some((b) => b.scope === "*" && b.limit === null);
+    for (const b of balances)
+      b.bypassed =
+        !config.enabled ||
+        (model !== undefined && !pricedModels.has(model)) ||
+        (b.scope !== "*" && !pricedModels.has(b.scope)) ||
+        (unlimited && b.scope !== "*");
+    const usage = model
+      ? []
+      : await db<
+          { model: string; input: number; output: number; unknown: number }[]
+        >`SELECT model_profile_id AS model,COALESCE(sum(input),0)::float8 AS input,COALESCE(sum(output),0)::float8 AS output,count(*) FILTER(WHERE finished_at IS NOT NULL AND input IS NULL)::int AS unknown FROM ai.inference_calls
+      WHERE kind='chat' AND user_id IS NOT DISTINCT FROM ${identity.user}::uuid AND service_account_id IS NOT DISTINCT FROM ${identity.service}::uuid
+      GROUP BY model_profile_id ORDER BY model_profile_id`;
+    return { enabled: config.enabled, unit: config.unit ?? "EUR", balances, usage };
+  },
+  async assertAllowed(subject: AccessSubject, model: string) {
+    // Fast default path: no additional identity/usage queries on unrestricted installations.
+    const pricing = (await readAiSettingsState()).profiles.find((profile) => profile.id === model)?.pricing;
+    if (!hasBillableAiPricing(pricing)) return false;
+    const config = await aiQuotas.config();
+    if (!config.enabled || !config.rules.some((r) => r.scope === "*" || r.scope === model)) return false;
+    const snapshot = await aiQuotas.snapshot(subject, model);
+    for (const b of snapshot.balances) {
+      if (b.bypassed || b.limit === null) continue;
+      if (b.unknown)
+        throw new AiQuotaError(
+          "quota_usage_unknown",
+          "Chat usage could not be measured. Contact an administrator or wait for the quota reset.",
+        );
+      if (b.used >= b.limit) throw new AiQuotaError("quota_exhausted", `Chat cost limit reached. Resets at ${b.resetsAt}.`);
+    }
+    return snapshot.balances.some((b) => !b.bypassed && b.limit !== null);
+  },
+  async prune() {
+    // Preserve every supported quota window, including rules added while limits were off.
+    // One bounded batch per runtime sweep avoids long deletes on busy installations.
+    await sql`DELETE FROM ai.inference_calls WHERE id IN (
+      SELECT c.id FROM ai.inference_calls c WHERE c.started_at < now() - interval '8760 hours'
+      AND (c.turn_id IS NOT NULL OR c.finished_at IS NOT NULL OR c.lease_expires_at<=now())
+      AND NOT EXISTS(SELECT 1 FROM ai.turns t WHERE t.id=c.turn_id AND t.attempt=c.turn_attempt
+        AND t.status='running' AND t.lease_expires_at>now())
+      ORDER BY c.started_at LIMIT 1000 FOR UPDATE SKIP LOCKED)`;
+  },
+  async reset(subject: AccessSubject, scope: string, requestId: string, actorId: string) {
+    const identity = ids(subject);
+    await sql.begin(async (db) => {
+      // The unique key makes transport retries safe; do not accept reuse for another target.
+      await db`INSERT INTO ai.cost_resets(request_id,user_id,service_account_id,scope,actor_id)
+        VALUES(${requestId}::uuid,${identity.user}::uuid,${identity.service}::uuid,${scope},${actorId}::uuid) ON CONFLICT DO NOTHING`;
+      const [row] = await db`SELECT 1 FROM ai.cost_resets WHERE request_id=${requestId}::uuid AND scope=${scope}
+        AND user_id IS NOT DISTINCT FROM ${identity.user}::uuid AND service_account_id IS NOT DISTINCT FROM ${identity.service}::uuid AND actor_id=${actorId}::uuid`;
+      if (!row) throw new AiQuotaError("quota_conflict", "Reset request was already used for another target.");
+    });
+  },
+  async users(search: string, page: number): Promise<{ items: AiQuotaIdentity[]; total: number; page: number; perPage: number }> {
+    const source = sql`SELECT 'user'::text AS type,u.id,COALESCE(NULLIF(u.display_name,''),u.uid) AS label,
+        (SELECT max(started_at) FROM ai.inference_calls WHERE kind='chat' AND user_id=u.id) AS last_used
+      FROM auth.users u WHERE (${search}<>'' OR EXISTS(SELECT 1 FROM ai.inference_calls WHERE kind='chat' AND user_id=u.id) OR EXISTS(SELECT 1 FROM ai.conversations c JOIN ai.turns t ON t.conversation_id=c.id WHERE c.created_by_user_id=u.id AND t.run_config->>'assistantChat'='true' AND t.run_config->'mandate' IS NULL))
+      UNION ALL SELECT 'service_account',s.id,s.name,(SELECT max(started_at) FROM ai.inference_calls WHERE kind='chat' AND service_account_id=s.id)
+      FROM auth.service_accounts s WHERE (${search}<>'' OR EXISTS(SELECT 1 FROM ai.inference_calls WHERE kind='chat' AND service_account_id=s.id))`;
+    const filtered = sql`SELECT * FROM (${source}) users WHERE position(lower(${search}) in lower(label))>0 OR id::text=${search}`;
+    const [count] = await sql<{ total: number }[]>`SELECT count(*)::int AS total FROM (${filtered}) q`;
+    const total = count?.total ?? 0,
+      perPage = 25,
+      current = Math.min(page, Math.max(1, Math.ceil(total / perPage)));
+    const items = await sql<
+      AiQuotaIdentity[]
+    >`SELECT type,id,label,to_char(last_used AT TIME ZONE 'UTC','YYYY-MM-DD"T"HH24:MI:SS.MS"Z"') AS "lastUsed" FROM (${filtered}) q ORDER BY last_used DESC NULLS LAST,label,id LIMIT ${perPage} OFFSET ${(current - 1) * perPage}`;
+    return { items, total, page: current, perPage };
+  },
+};