@marinoscar/platform-api 0.1.0-next.3 → 0.1.0-next.4

package/dist/ai/config/ai-provider-test.service.js

@@ -0,0 +1,281 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var AiProviderTestService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AiProviderTestService = exports.AI_SMOKE_MAX_OUTPUT_TOKENS = exports.AI_TEST_CALL_TIMEOUT_MS = void 0;
+exports.withTimeout = withTimeout;
+const node_crypto_1 = require("node:crypto");
+const common_1 = require("@nestjs/common");
+const index_1 = require("../../credentials/index");
+const index_2 = require("../../core/index");
+const ai_error_1 = require("../core/ai-error");
+const capabilities_1 = require("../core/capabilities");
+const provider_adapter_interface_1 = require("../core/provider-adapter.interface");
+const ai_config_admin_service_1 = require("./ai-config-admin.service");
+const ai_config_service_1 = require("./ai-config.service");
+const ai_credential_constants_1 = require("./ai-credential.constants");
+// =============================================================================
+// AiProviderTestService — "does this key work?" (issue #428, epic #419)
+// =============================================================================
+//
+// Three checks, each reported separately, mirroring `StorageConnectionTestService`:
+//
+//   credentials      adapter.verifyKey
+//   list_models      adapter.listModels — how many models the key can see
+//   responses_smoke  one tiny responses call, ONLY when an admin-enabled,
+//                    non-deprecated text model exists (otherwise skipped:
+//                    testing a model nobody enabled proves nothing an admin
+//                    asked about, and costs money on their account)
+//
+// NEVER THROWS for a key or connectivity problem — every such outcome is a
+// check with `status: 'failed'`, and the route answers 200. It can still
+// reject for a genuine fault (the database being down while auditing), which
+// is a 500 and correctly so. An unknown provider is a 404, not a diagnosis.
+//
+// ⚠ THE KEY. A submitted key is used for this call only and never stored; a
+// stored key is decrypted at the moment of use and never returned. Every
+// `error` string is passed through `redact` before it leaves this file, and the
+// audit row carries codes only.
+// =============================================================================
+/** Upper bound on any one provider call made by the probe. */
+exports.AI_TEST_CALL_TIMEOUT_MS = 15_000;
+/**
+ * Output-token budget for the smoke call. Not 1: OpenAI's Responses API rejects
+ * `max_output_tokens` below 16, and a probe that fails on its own parameters
+ * would report a working key as broken.
+ */
+exports.AI_SMOKE_MAX_OUTPUT_TOKENS = 16;
+const LABELS = {
+    credentials: 'API key accepted',
+    list_models: 'Models visible to this key',
+    responses_smoke: 'Test response',
+};
+let AiProviderTestService = AiProviderTestService_1 = class AiProviderTestService {
+    prisma;
+    credentials;
+    aiConfig;
+    admin;
+    logger = new common_1.Logger(AiProviderTestService_1.name);
+    constructor(prisma, credentials, aiConfig, admin) {
+        this.prisma = prisma;
+        this.credentials = credentials;
+        this.aiConfig = aiConfig;
+        this.admin = admin;
+    }
+    async test(provider, input, actorUserId) {
+        const adapter = this.admin.requireRegistered(provider);
+        const attemptedAt = new Date();
+        const policy = await this.aiConfig.resolve({ fresh: true });
+        const slot = (0, ai_config_service_1.providerPolicy)(policy, provider);
+        const submittedKey = input.apiKey ?? '';
+        const storedKey = submittedKey.length === 0
+            ? await this.credentials.getSecret(ai_credential_constants_1.AI_CREDENTIAL_PURPOSE, (0, ai_credential_constants_1.aiCredentialName)(provider))
+            : null;
+        const usedStoredKey = submittedKey.length === 0 && storedKey !== null;
+        // A keyless provider (#448: `requiresKey: false`) is tested with no key at
+        // all when none is submitted or stored — exactly how it will be called.
+        const apiKey = submittedKey.length > 0 ? submittedKey : (storedKey ?? ((0, ai_config_service_1.providerRequiresKey)(slot, provider) ? null : provider_adapter_interface_1.AI_KEYLESS_API_KEY));
+        // The slot's own settings, with a submitted endpoint taking the stored one's place.
+        const call = (0, ai_config_service_1.providerCallSettings)(slot);
+        const baseUrl = input.baseUrl || call.baseUrl || undefined;
+        if (!apiKey) {
+            const detail = 'Nothing was attempted: no key was submitted and no admin key is stored.';
+            return this.assemble(provider, usedStoredKey, attemptedAt, actorUserId, {
+                checks: AI_TEST_CHECK_ORDER.map((id) => check(id, 'skipped', 'not_configured', detail)),
+            });
+        }
+        const redact = (text) => text.split(apiKey).join('[redacted]');
+        const ctx = (signal) => ({
+            apiKey,
+            ...(baseUrl ? { baseUrl } : {}),
+            ...(call.providerSettings ? { providerSettings: call.providerSettings } : {}),
+            signal,
+            requestId: (0, node_crypto_1.randomUUID)(),
+        });
+        // 1. credentials
+        let credentialsCheck;
+        try {
+            const verification = await withTimeout((signal) => adapter.verifyKey(ctx(signal)));
+            credentialsCheck = verification.ok
+                ? check('credentials', 'passed', 'ok', `${adapter.displayName} accepted the key.`)
+                : check('credentials', 'failed', verification.code ?? 'AI_KEY_INVALID', `${adapter.displayName} rejected the key. Check it was copied in full and has not been revoked.`, verification.detail ? redact(verification.detail) : null);
+        }
+        catch (error) {
+            credentialsCheck = failure('credentials', error, redact);
+        }
+        if (credentialsCheck.status !== 'passed') {
+            return this.assemble(provider, usedStoredKey, attemptedAt, actorUserId, {
+                checks: [credentialsCheck, notAttempted('list_models'), notAttempted('responses_smoke')],
+            });
+        }
+        // 2. list_models
+        let listCheck;
+        let visibleIds = null;
+        try {
+            const models = await withTimeout((signal) => adapter.listModels(ctx(signal)));
+            visibleIds = new Set(models.map((model) => model.id));
+            listCheck = check('list_models', 'passed', 'ok', `${models.length} model(s) are visible to this key.`);
+        }
+        catch (error) {
+            listCheck = failure('list_models', error, redact);
+        }
+        if (listCheck.status !== 'passed') {
+            return this.assemble(provider, usedStoredKey, attemptedAt, actorUserId, {
+                checks: [credentialsCheck, listCheck, notAttempted('responses_smoke')],
+            });
+        }
+        // 3. responses_smoke
+        const smoke = await this.smoke(adapter, visibleIds, ctx, redact);
+        return this.assemble(provider, usedStoredKey, attemptedAt, actorUserId, {
+            checks: [credentialsCheck, listCheck, smoke.check],
+            modelCount: visibleIds?.size ?? null,
+            smokeModelId: smoke.modelId,
+        });
+    }
+    async smoke(adapter, visibleIds, ctx, redact) {
+        if (!adapter.responses) {
+            return {
+                check: check('responses_smoke', 'skipped', 'not_supported', `${adapter.displayName} does not generate text responses in this deployment.`),
+                modelId: null,
+            };
+        }
+        const modelId = await this.pickSmokeModel(adapter.id, visibleIds);
+        if (!modelId) {
+            return {
+                check: check('responses_smoke', 'skipped', 'no_eligible_model', 'Skipped: no enabled text model is visible to this key yet. Enable one in the model ' +
+                    'catalog to include a test response.'),
+                modelId: null,
+            };
+        }
+        const responses = adapter.responses;
+        try {
+            await withTimeout((signal) => responses.create({ model: modelId, input: 'Reply with the single word: ok', maxOutputTokens: exports.AI_SMOKE_MAX_OUTPUT_TOKENS }, ctx(signal)));
+            return {
+                check: check('responses_smoke', 'passed', 'ok', `"${modelId}" answered a test request.`),
+                modelId,
+            };
+        }
+        catch (error) {
+            return { check: failure('responses_smoke', error, redact), modelId };
+        }
+    }
+    /**
+     * The cheapest-looking enabled, non-deprecated text model this key can see,
+     * or null. "Cheapest-looking" is a naming heuristic (`nano`, then `mini`,
+     * then anything else) — the catalog carries no prices — and the tie-break is the
+     * id, so the choice is stable between runs.
+     */
+    async pickSmokeModel(provider, visibleIds) {
+        const rows = await this.prisma.aiModel.findMany({
+            where: { provider, enabled: true, deprecatedAt: null },
+            select: { modelId: true, capabilities: true },
+        });
+        const candidates = rows
+            .filter((row) => {
+            const parsed = capabilities_1.aiModelCapabilitiesSchema.safeParse(row.capabilities);
+            return parsed.success && parsed.data.capabilities.includes('responses');
+        })
+            .map((row) => row.modelId)
+            .filter((id) => !visibleIds || visibleIds.has(id));
+        const rank = (id) => (/nano/i.test(id) ? 0 : /mini/i.test(id) ? 1 : 2);
+        candidates.sort((a, b) => rank(a) - rank(b) || a.localeCompare(b));
+        return candidates[0] ?? null;
+    }
+    /** Build the result and audit the attempt (every attempt, successful or not). */
+    async assemble(provider, usedStoredKey, attemptedAt, actorUserId, parts) {
+        const { checks } = parts;
+        const success = checks[0]?.status === 'passed' && checks.every((entry) => entry.status !== 'failed');
+        const result = {
+            success,
+            provider,
+            usedStoredKey,
+            modelCount: parts.modelCount ?? null,
+            smokeModelId: parts.smokeModelId ?? null,
+            checks,
+            attemptedAt: attemptedAt.toISOString(),
+        };
+        await this.prisma.auditEvent.create({
+            data: {
+                actorUserId,
+                action: 'ai_config:test',
+                targetType: 'ai_config',
+                targetId: provider,
+                meta: {
+                    provider,
+                    success,
+                    usedStoredKey,
+                    // Codes only — `error` strings are the provider's words and belong in
+                    // the response an admin is reading, not in a table that outlives it.
+                    checks: checks.map((entry) => ({ id: entry.id, status: entry.status, code: entry.code })),
+                },
+            },
+        });
+        if (!success) {
+            this.logger.warn(`AI provider test failed for "${provider}" (user ${actorUserId}): ` +
+                checks
+                    .filter((entry) => entry.status !== 'passed')
+                    .map((entry) => `${entry.id}=${entry.code}`)
+                    .join(' '));
+        }
+        return result;
+    }
+};
+exports.AiProviderTestService = AiProviderTestService;
+exports.AiProviderTestService = AiProviderTestService = AiProviderTestService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(0, (0, common_1.Inject)(index_2.PLATFORM_PRISMA)),
+    __metadata("design:paramtypes", [Object, index_1.CredentialsService,
+        ai_config_service_1.AiConfigService,
+        ai_config_admin_service_1.AiConfigAdminService])
+], AiProviderTestService);
+const AI_TEST_CHECK_ORDER = ['credentials', 'list_models', 'responses_smoke'];
+function check(id, status, code, detail, error = null) {
+    return { id, label: LABELS[id], status, code, detail, error };
+}
+function notAttempted(id) {
+    return check(id, 'skipped', 'not_attempted', 'Not attempted: an earlier check failed, so this one would say nothing useful.');
+}
+/** A failed check from whatever the adapter threw — always as an `AiError`. */
+function failure(id, error, redact) {
+    const aiError = ai_error_1.AiError.wrap(error);
+    return check(id, 'failed', aiError.code, FAILURE_DETAIL[aiError.code] ?? GENERIC_FAILURE, redact(aiError.message));
+}
+const GENERIC_FAILURE = 'The provider refused the request. See the error for its reason.';
+const FAILURE_DETAIL = {
+    AI_KEY_INVALID: 'The provider rejected the key. Check it was copied in full and has not been revoked.',
+    AI_RATE_LIMITED: 'The provider rate-limited this key. Wait a moment and test again.',
+    AI_PROVIDER_UNAVAILABLE: 'The provider could not be reached. Check the base URL, and that this server can make outbound HTTPS requests.',
+};
+/**
+ * Run `fn` with an abort signal that fires after AI_TEST_CALL_TIMEOUT_MS, and
+ * reject with `AI_PROVIDER_UNAVAILABLE` at that point even if the adapter
+ * ignores the signal.
+ */
+async function withTimeout(fn) {
+    const controller = new AbortController();
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => {
+            controller.abort();
+            reject(new ai_error_1.AiError('AI_PROVIDER_UNAVAILABLE', 'The provider did not answer in time.'));
+        }, exports.AI_TEST_CALL_TIMEOUT_MS);
+    });
+    try {
+        return await Promise.race([fn(controller.signal), timeout]);
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+//# sourceMappingURL=ai-provider-test.service.js.map

package/dist/ai/config/ai-provider-test.service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-provider-test.service.js","sourceRoot":"","sources":["../../../src/ai/config/ai-provider-test.service.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AA+VA,kCAgBC;AA/WD,6CAAyC;AAEzC,2CAA4D;AAG5D,mDAA6D;AAE7D,4CAAmD;AACnD,+CAA2C;AAC3C,uDAAiE;AACjE,mFAAoH;AACpH,uEAAiE;AACjE,2DAAiH;AACjH,uEAAoF;AAUpF,gFAAgF;AAChF,wEAAwE;AACxE,gFAAgF;AAChF,EAAE;AACF,oFAAoF;AACpF,EAAE;AACF,uCAAuC;AACvC,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,4EAA4E;AAC5E,oEAAoE;AACpE,EAAE;AACF,2EAA2E;AAC3E,yEAAyE;AACzE,6EAA6E;AAC7E,4EAA4E;AAC5E,EAAE;AACF,4EAA4E;AAC5E,yEAAyE;AACzE,gFAAgF;AAChF,gCAAgC;AAChC,gFAAgF;AAEhF,8DAA8D;AACjD,QAAA,uBAAuB,GAAG,MAAM,CAAC;AAE9C;;;;GAIG;AACU,QAAA,0BAA0B,GAAG,EAAE,CAAC;AAE7C,MAAM,MAAM,GAAkC;IAC5C,WAAW,EAAE,kBAAkB;IAC/B,WAAW,EAAE,4BAA4B;IACzC,eAAe,EAAE,eAAe;CACjC,CAAC;AAGK,IAAM,qBAAqB,6BAA3B,MAAM,qBAAqB;IAIY;IACzB;IACA;IACA;IANF,MAAM,GAAG,IAAI,eAAM,CAAC,uBAAqB,CAAC,IAAI,CAAC,CAAC;IAEjE,YAC4C,MAAgB,EACzC,WAA+B,EAC/B,QAAyB,EACzB,KAA2B;QAHF,WAAM,GAAN,MAAM,CAAU;QACzC,gBAAW,GAAX,WAAW,CAAoB;QAC/B,aAAQ,GAAR,QAAQ,CAAiB;QACzB,UAAK,GAAL,KAAK,CAAsB;IAC3C,CAAC;IAEJ,KAAK,CAAC,IAAI,CACR,QAAgB,EAChB,KAA0B,EAC1B,WAAmB;QAEnB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5D,MAAM,IAAI,GAAG,IAAA,kCAAc,EAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9C,MAAM,YAAY,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;QACxC,MAAM,SAAS,GACb,YAAY,CAAC,MAAM,KAAK,CAAC;YACvB,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,+CAAqB,EAAE,IAAA,0CAAgB,EAAC,QAAQ,CAAC,CAAC;YACrF,CAAC,CAAC,IAAI,CAAC;QACX,MAAM,aAAa,GAAG,YAAY,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,KAAK,IAAI,CAAC;QACtE,2EAA2E;QAC3E,wEAAwE;QACxE,MAAM,MAAM,GACV,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,IAAA,uCAAmB,EAAC,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,+CAAkB,CAAC,CAAC,CAAC;QAC5H,oFAAoF;QACpF,MAAM,IAAI,GAAG,IAAA,wCAAoB,EAAC,IAAI,CAAC,CAAC;QACxC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,IAAI,SAAS,CAAC;QAE3D,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,MAAM,GAAG,yEAAyE,CAAC;YAEzF,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE;gBACtE,MAAM,EAAE,mBAAmB,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,CAAC,CAAC;aACxF,CAAC,CAAC;QACL,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,CAAC,MAAmB,EAAiB,EAAE,CAAC,CAAC;YACnD,MAAM;YACN,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7E,MAAM;YACN,SAAS,EAAE,IAAA,wBAAU,GAAE;SACxB,CAAC,CAAC;QAEH,iBAAiB;QACjB,IAAI,gBAAqC,CAAC;QAE1C,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,MAAM,WAAW,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAEnF,gBAAgB,GAAG,YAAY,CAAC,EAAE;gBAChC,CAAC,CAAC,KAAK,CAAC,aAAa,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,WAAW,oBAAoB,CAAC;gBAClF,CAAC,CAAC,KAAK,CACH,aAAa,EACb,QAAQ,EACR,YAAY,CAAC,IAAI,IAAI,gBAAgB,EACrC,GAAG,OAAO,CAAC,WAAW,0EAA0E,EAChG,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CACzD,CAAC;QACR,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,gBAAgB,GAAG,OAAO,CAAC,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAC3D,CAAC;QAED,IAAI,gBAAgB,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE;gBACtE,MAAM,EAAE,CAAC,gBAAgB,EAAE,YAAY,CAAC,aAAa,CAAC,EAAE,YAAY,CAAC,iBAAiB,CAAC,CAAC;aACzF,CAAC,CAAC;QACL,CAAC;QAED,iBAAiB;QACjB,IAAI,SAA8B,CAAC;QACnC,IAAI,UAAU,GAAuB,IAAI,CAAC;QAE1C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC9E,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;YACtD,SAAS,GAAG,KAAK,CACf,aAAa,EACb,QAAQ,EACR,IAAI,EACJ,GAAG,MAAM,CAAC,MAAM,oCAAoC,CACrD,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,SAAS,GAAG,OAAO,CAAC,aAAa,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,SAAS,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE;gBACtE,MAAM,EAAE,CAAC,gBAAgB,EAAE,SAAS,EAAE,YAAY,CAAC,iBAAiB,CAAC,CAAC;aACvE,CAAC,CAAC;QACL,CAAC;QAED,qBAAqB;QACrB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAEjE,OAAO,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE;YACtE,MAAM,EAAE,CAAC,gBAAgB,EAAE,SAAS,EAAE,KAAK,CAAC,KAAK,CAAC;YAClD,UAAU,EAAE,UAAU,EAAE,IAAI,IAAI,IAAI;YACpC,YAAY,EAAE,KAAK,CAAC,OAAO;SAC5B,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,KAAK,CACjB,OAA0B,EAC1B,UAA8B,EAC9B,GAA2C,EAC3C,MAAgC;QAEhC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;YACvB,OAAO;gBACL,KAAK,EAAE,KAAK,CACV,iBAAiB,EACjB,SAAS,EACT,eAAe,EACf,GAAG,OAAO,CAAC,WAAW,uDAAuD,CAC9E;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,OAAO,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;QAElE,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,OAAO;gBACL,KAAK,EAAE,KAAK,CACV,iBAAiB,EACjB,SAAS,EACT,mBAAmB,EACnB,qFAAqF;oBACnF,qCAAqC,CACxC;gBACD,OAAO,EAAE,IAAI;aACd,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC;QAEpC,IAAI,CAAC;YACH,MAAM,WAAW,CAAC,CAAC,MAAM,EAAE,EAAE,CAC3B,SAAS,CAAC,MAAM,CACd,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,gCAAgC,EAAE,eAAe,EAAE,kCAA0B,EAAE,EACxG,GAAG,CAAC,MAAM,CAAC,CACZ,CACF,CAAC;YAEF,OAAO;gBACL,KAAK,EAAE,KAAK,CAAC,iBAAiB,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,OAAO,4BAA4B,CAAC;gBACxF,OAAO;aACR,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,EAAE,KAAK,EAAE,OAAO,CAAC,iBAAiB,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC;QACvE,CAAC;IACH,CAAC;IAED;;;;;OAKG;IACK,KAAK,CAAC,cAAc,CAAC,QAAgB,EAAE,UAA8B;QAC3E,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC;YAC9C,KAAK,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;YACtD,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE;SAC9C,CAAC,CAAC;QAEH,MAAM,UAAU,GAAG,IAAI;aACpB,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;YACd,MAAM,MAAM,GAAG,wCAAyB,CAAC,SAAS,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;YACrE,OAAO,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QAC1E,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC;aACzB,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,IAAI,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAErD,MAAM,IAAI,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAE/E,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnE,OAAO,UAAU,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC/B,CAAC;IAED,iFAAiF;IACzE,KAAK,CAAC,QAAQ,CACpB,QAAgB,EAChB,aAAsB,EACtB,WAAiB,EACjB,WAAmB,EACnB,KAAkG;QAElG,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;QACzB,MAAM,OAAO,GACX,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;QAEvF,MAAM,MAAM,GAAyB;YACnC,OAAO;YACP,QAAQ;YACR,aAAa;YACb,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;YACpC,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,IAAI;YACxC,MAAM;YACN,WAAW,EAAE,WAAW,CAAC,WAAW,EAAE;SACvC,CAAC;QAEF,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC;YAClC,IAAI,EAAE;gBACJ,WAAW;gBACX,MAAM,EAAE,gBAAgB;gBACxB,UAAU,EAAE,WAAW;gBACvB,QAAQ,EAAE,QAAQ;gBAClB,IAAI,EAAE;oBACJ,QAAQ;oBACR,OAAO;oBACP,aAAa;oBACb,sEAAsE;oBACtE,qEAAqE;oBACrE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;iBACjE;aAC3B;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,IAAI,CAAC,MAAM,CAAC,IAAI,CACd,gCAAgC,QAAQ,WAAW,WAAW,KAAK;gBACjE,MAAM;qBACH,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC;qBAC5C,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC;qBAC3C,IAAI,CAAC,GAAG,CAAC,CACf,CAAC;QACJ,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;CACF,CAAA;AA/OY,sDAAqB;gCAArB,qBAAqB;IADjC,IAAA,mBAAU,GAAE;IAKR,WAAA,IAAA,eAAM,EAAC,uBAAe,CAAC,CAAA;6CACM,0BAAkB;QACrB,mCAAe;QAClB,8CAAoB;GAPnC,qBAAqB,CA+OjC;AAED,MAAM,mBAAmB,GAAoB,CAAC,aAAa,EAAE,aAAa,EAAE,iBAAiB,CAAC,CAAC;AAE/F,SAAS,KAAK,CACZ,EAAiB,EACjB,MAAyB,EACzB,IAAqB,EACrB,MAAc,EACd,QAAuB,IAAI;IAE3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,YAAY,CAAC,EAAiB;IACrC,OAAO,KAAK,CACV,EAAE,EACF,SAAS,EACT,eAAe,EACf,+EAA+E,CAChF,CAAC;AACJ,CAAC;AAED,+EAA+E;AAC/E,SAAS,OAAO,CACd,EAAiB,EACjB,KAAc,EACd,MAAgC;IAEhC,MAAM,OAAO,GAAG,kBAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAEpC,OAAO,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,EAAE,cAAc,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;AACrH,CAAC;AAED,MAAM,eAAe,GAAG,iEAAiE,CAAC;AAE1F,MAAM,cAAc,GAA6C;IAC/D,cAAc,EAAE,sFAAsF;IACtG,eAAe,EAAE,mEAAmE;IACpF,uBAAuB,EACrB,+GAA+G;CAClH,CAAC;AAEF;;;;GAIG;AACI,KAAK,UAAU,WAAW,CAAI,EAAuC;IAC1E,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,IAAI,KAAiC,CAAC;IAEtC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAC/C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YACtB,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,MAAM,CAAC,IAAI,kBAAO,CAAC,yBAAyB,EAAE,sCAAsC,CAAC,CAAC,CAAC;QACzF,CAAC,EAAE,+BAAuB,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IAC9D,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC"}

package/dist/ai/config/ai-public.controller.d.ts

@@ -0,0 +1,29 @@
+import { type RequestWithPrincipal } from '../../identity/index';
+import { AiConfigService } from './ai-config.service';
+export declare class AiPublicController {
+    private readonly aiConfig;
+    constructor(aiConfig: AiConfigService);
+    getConfig(request: RequestWithPrincipal): Promise<{
+        enabled: boolean;
+        keyPolicy: "byok" | "byok_with_org_fallback";
+        allowBackgroundRuns: boolean;
+        allowRealtime: boolean;
+        perUserDefaultModel: boolean;
+        hostedTools: {
+            web_search: boolean;
+            file_search: boolean;
+            code_interpreter: boolean;
+            image_generation: boolean;
+            mcp: boolean;
+        };
+        providers: {
+            id: string;
+            displayName: string;
+            enabled: boolean;
+            hasOrgKey: boolean;
+            supportsPreviousResponseId: boolean;
+            requiresKey: boolean;
+        }[];
+    }>;
+}
+//# sourceMappingURL=ai-public.controller.d.ts.map

package/dist/ai/config/ai-public.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-public.controller.d.ts","sourceRoot":"","sources":["../../../src/ai/config/ai-public.controller.ts"],"names":[],"mappings":"AAGA,OAAO,EAAuB,KAAK,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AACtF,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAiBtD,qBAEa,kBAAkB;IACjB,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBAAR,QAAQ,EAAE,eAAe;IAiBhD,SAAS,CAAQ,OAAO,EAAE,oBAAoB;;;;;;;;;;;;;;;;;;;;;;CAGrD"}

package/dist/ai/config/ai-public.controller.js

@@ -0,0 +1,69 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AiPublicController = void 0;
+const common_1 = require("@nestjs/common");
+const swagger_1 = require("@nestjs/swagger");
+const index_1 = require("../../identity/index");
+const ai_config_service_1 = require("./ai-config.service");
+const ai_public_config_dto_1 = require("./dto/ai-public-config.dto");
+// =============================================================================
+// AiPublicController — GET /api/ai/config (issue #428, epic #419)
+// =============================================================================
+//
+// `@Auth()` with NO permission, exactly like `GET /api/notifications/config`:
+// every signed-in user renders (or hides) AI surfaces against this answer, and
+// the users it matters to are precisely the ones who cannot read
+// `system_settings`.
+//
+// ⚠ DELIBERATELY NOT BEHIND `AiEnabledGuard` — it is how a browser learns that
+// AI is OFF, so it must answer while AI is off (docs/specs/ai-platform.md §2.19).
+// Every other route under `/api/ai/*` carries that guard.
+// =============================================================================
+let AiPublicController = class AiPublicController {
+    aiConfig;
+    constructor(aiConfig) {
+        this.aiConfig = aiConfig;
+    }
+    async getConfig(request) {
+        return this.aiConfig.describePublic((0, index_1.activeOrgIdOf)(request));
+    }
+};
+exports.AiPublicController = AiPublicController;
+__decorate([
+    (0, common_1.Get)('config'),
+    (0, index_1.Auth)(),
+    (0, swagger_1.ApiOperation)({
+        summary: 'Get the AI capabilities of this deployment',
+        description: 'Whether AI is enabled, which key policy applies, and — while enabled — each registered ' +
+            'provider with whether it is enabled and whether an admin (org) key is stored for it. ' +
+            'Readable by any signed-in user, and reachable while AI is disabled: this is how a ' +
+            'client learns to hide its AI surfaces. Carries no key, key hint or configuration ' +
+            'detail. An admin key serves a user only under `byok_with_org_fallback`. Answers may ' +
+            'lag an administrator’s change by up to five seconds. The answer is your active ' +
+            'organization’s EFFECTIVE policy (#739): an organization that switched AI or a provider ' +
+            'off, or narrowed the key policy, reads that way here.',
+    }),
+    (0, swagger_1.ApiResponse)({ status: 200, description: 'The AI capabilities', type: ai_public_config_dto_1.AiPublicConfigDto }),
+    __param(0, (0, common_1.Req)()),
+    __metadata("design:type", Function),
+    __metadata("design:paramtypes", [Object]),
+    __metadata("design:returntype", Promise)
+], AiPublicController.prototype, "getConfig", null);
+exports.AiPublicController = AiPublicController = __decorate([
+    (0, swagger_1.ApiTags)('AI'),
+    (0, common_1.Controller)('ai'),
+    __metadata("design:paramtypes", [ai_config_service_1.AiConfigService])
+], AiPublicController);
+//# sourceMappingURL=ai-public.controller.js.map

package/dist/ai/config/ai-public.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-public.controller.js","sourceRoot":"","sources":["../../../src/ai/config/ai-public.controller.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;AAAA,2CAAsD;AACtD,6CAAqE;AAErE,gDAAsF;AACtF,2DAAsD;AACtD,qEAA+D;AAE/D,gFAAgF;AAChF,kEAAkE;AAClE,gFAAgF;AAChF,EAAE;AACF,8EAA8E;AAC9E,+EAA+E;AAC/E,iEAAiE;AACjE,qBAAqB;AACrB,EAAE;AACF,+EAA+E;AAC/E,kFAAkF;AAClF,0DAA0D;AAC1D,gFAAgF;AAIzE,IAAM,kBAAkB,GAAxB,MAAM,kBAAkB;IACA;IAA7B,YAA6B,QAAyB;QAAzB,aAAQ,GAAR,QAAQ,CAAiB;IAAG,CAAC;IAiBpD,AAAN,KAAK,CAAC,SAAS,CAAQ,OAA6B;QAClD,OAAO,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAA,qBAAa,EAAC,OAAO,CAAC,CAAC,CAAC;IAC9D,CAAC;CACF,CAAA;AArBY,gDAAkB;AAkBvB;IAfL,IAAA,YAAG,EAAC,QAAQ,CAAC;IACb,IAAA,YAAI,GAAE;IACN,IAAA,sBAAY,EAAC;QACZ,OAAO,EAAE,4CAA4C;QACrD,WAAW,EACT,yFAAyF;YACzF,uFAAuF;YACvF,oFAAoF;YACpF,mFAAmF;YACnF,sFAAsF;YACtF,iFAAiF;YACjF,yFAAyF;YACzF,uDAAuD;KAC1D,CAAC;IACD,IAAA,qBAAW,EAAC,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,qBAAqB,EAAE,IAAI,EAAE,wCAAiB,EAAE,CAAC;IACzE,WAAA,IAAA,YAAG,GAAE,CAAA;;;;mDAErB;6BApBU,kBAAkB;IAF9B,IAAA,iBAAO,EAAC,IAAI,CAAC;IACb,IAAA,mBAAU,EAAC,IAAI,CAAC;qCAEwB,mCAAe;GAD3C,kBAAkB,CAqB9B"}

package/dist/ai/config/doctor/ai-enabled.doctor-check.d.ts

@@ -0,0 +1,25 @@
+import { OnModuleInit } from '@nestjs/common';
+import { DoctorCheck, DoctorCheckOutcome } from '../../../doctor/index';
+import { DoctorCheckRegistry } from '../../../doctor/index';
+import { AiConfigService } from '../ai-config.service';
+export declare const AI_SETTINGS_PATH = "/admin/settings/ai";
+/**
+ * `ai` / `ai.enabled` — is the AI platform switched on?
+ *
+ * OFF IS `skip`, NOT `warn` AND NOT `pass`: turning AI off is an operator's
+ * decision (see `doctor-check.interface.ts`, rule 5), so there is nothing to
+ * fix — but nothing was verified either. The provider check depends on this
+ * one and is skipped with it.
+ */
+export declare class AiEnabledDoctorCheck implements DoctorCheck, OnModuleInit {
+    private readonly registry;
+    private readonly aiConfig;
+    readonly id = "ai.enabled";
+    readonly category = "ai";
+    readonly label = "AI platform";
+    readonly settingsPath = "/admin/settings/ai";
+    constructor(registry: DoctorCheckRegistry, aiConfig: AiConfigService);
+    onModuleInit(): void;
+    run(): Promise<DoctorCheckOutcome>;
+}
+//# sourceMappingURL=ai-enabled.doctor-check.d.ts.map

package/dist/ai/config/doctor/ai-enabled.doctor-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-enabled.doctor-check.d.ts","sourceRoot":"","sources":["../../../../src/ai/config/doctor/ai-enabled.doctor-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,eAAO,MAAM,gBAAgB,uBAAuB,CAAC;AAErD;;;;;;;GAOG;AACH,qBACa,oBAAqB,YAAW,WAAW,EAAE,YAAY;IAOlE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ;IAP3B,QAAQ,CAAC,EAAE,gBAAgB;IAC3B,QAAQ,CAAC,QAAQ,QAAQ;IACzB,QAAQ,CAAC,KAAK,iBAAiB;IAC/B,QAAQ,CAAC,YAAY,wBAAoB;gBAGtB,QAAQ,EAAE,mBAAmB,EAC7B,QAAQ,EAAE,eAAe;IAG5C,YAAY,IAAI,IAAI;IAId,GAAG,IAAI,OAAO,CAAC,kBAAkB,CAAC;CASzC"}

package/dist/ai/config/doctor/ai-enabled.doctor-check.js

@@ -0,0 +1,53 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AiEnabledDoctorCheck = exports.AI_SETTINGS_PATH = void 0;
+const common_1 = require("@nestjs/common");
+const index_1 = require("../../../doctor/index");
+const ai_config_service_1 = require("../ai-config.service");
+exports.AI_SETTINGS_PATH = '/admin/settings/ai';
+/**
+ * `ai` / `ai.enabled` — is the AI platform switched on?
+ *
+ * OFF IS `skip`, NOT `warn` AND NOT `pass`: turning AI off is an operator's
+ * decision (see `doctor-check.interface.ts`, rule 5), so there is nothing to
+ * fix — but nothing was verified either. The provider check depends on this
+ * one and is skipped with it.
+ */
+let AiEnabledDoctorCheck = class AiEnabledDoctorCheck {
+    registry;
+    aiConfig;
+    id = 'ai.enabled';
+    category = 'ai';
+    label = 'AI platform';
+    settingsPath = exports.AI_SETTINGS_PATH;
+    constructor(registry, aiConfig) {
+        this.registry = registry;
+        this.aiConfig = aiConfig;
+    }
+    onModuleInit() {
+        this.registry.register(this);
+    }
+    async run() {
+        const policy = await this.aiConfig.resolve({ fresh: true });
+        if (!policy.enabled) {
+            return { status: 'skip', detail: 'AI is switched off', data: { enabled: false } };
+        }
+        return { status: 'pass', detail: 'AI is switched on', data: { enabled: true, keyPolicy: policy.keyPolicy } };
+    }
+};
+exports.AiEnabledDoctorCheck = AiEnabledDoctorCheck;
+exports.AiEnabledDoctorCheck = AiEnabledDoctorCheck = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [index_1.DoctorCheckRegistry,
+        ai_config_service_1.AiConfigService])
+], AiEnabledDoctorCheck);
+//# sourceMappingURL=ai-enabled.doctor-check.js.map

package/dist/ai/config/doctor/ai-enabled.doctor-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-enabled.doctor-check.js","sourceRoot":"","sources":["../../../../src/ai/config/doctor/ai-enabled.doctor-check.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,2CAA0D;AAG1D,iDAA4D;AAC5D,4DAAuD;AAE1C,QAAA,gBAAgB,GAAG,oBAAoB,CAAC;AAErD;;;;;;;GAOG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAoB;IAOZ;IACA;IAPV,EAAE,GAAG,YAAY,CAAC;IAClB,QAAQ,GAAG,IAAI,CAAC;IAChB,KAAK,GAAG,aAAa,CAAC;IACtB,YAAY,GAAG,wBAAgB,CAAC;IAEzC,YACmB,QAA6B,EAC7B,QAAyB;QADzB,aAAQ,GAAR,QAAQ,CAAqB;QAC7B,aAAQ,GAAR,QAAQ,CAAiB;IACzC,CAAC;IAEJ,YAAY;QACV,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,GAAG;QACP,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAE5D,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;YACpB,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC;QACpF,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC;IAC/G,CAAC;CACF,CAAA;AAxBY,oDAAoB;+BAApB,oBAAoB;IADhC,IAAA,mBAAU,GAAE;qCAQkB,2BAAmB;QACnB,mCAAe;GARjC,oBAAoB,CAwBhC"}

package/dist/ai/config/doctor/ai-providers.doctor-check.d.ts

@@ -0,0 +1,31 @@
+import { OnModuleInit } from '@nestjs/common';
+import { DoctorCheck, DoctorCheckOutcome } from '../../../doctor/index';
+import { DoctorCheckRegistry } from '../../../doctor/index';
+import { AiConfigAdminService } from '../ai-config-admin.service';
+import { AiConfigResponse } from '../dto/ai-config-response.dto';
+/**
+ * Pure: can every ENABLED provider actually serve a call?
+ *
+ *   - enabled but no adapter registered → it can never serve one;
+ *   - enabled, needs a key, no org key, and the policy promises an org-key
+ *     fallback (`byok_with_org_fallback`) → users without their own key fail;
+ *   - under plain `byok` a missing org key is expected — users bring keys.
+ *
+ * Reads key STATUS only (`keyStatus.configured`), never a hint or material,
+ * and calls no model: the "Test" button at /admin/settings/ai does that.
+ */
+export declare function decideAiProviders(view: Pick<AiConfigResponse, 'keyPolicy' | 'providers'>): DoctorCheckOutcome;
+/** `ai` / `ai.providers` — every enabled provider has what it needs to serve a call. */
+export declare class AiProvidersDoctorCheck implements DoctorCheck, OnModuleInit {
+    private readonly registry;
+    private readonly aiAdmin;
+    readonly id = "ai.providers";
+    readonly category = "ai";
+    readonly label = "AI providers and keys";
+    readonly settingsPath = "/admin/settings/ai";
+    readonly dependsOn: string[];
+    constructor(registry: DoctorCheckRegistry, aiAdmin: AiConfigAdminService);
+    onModuleInit(): void;
+    run(): Promise<DoctorCheckOutcome>;
+}
+//# sourceMappingURL=ai-providers.doctor-check.d.ts.map

package/dist/ai/config/doctor/ai-providers.doctor-check.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-providers.doctor-check.d.ts","sourceRoot":"","sources":["../../../../src/ai/config/doctor/ai-providers.doctor-check.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE1D,OAAO,EAAE,WAAW,EAAE,kBAAkB,EAAE,MAAM,uBAAuB,CAAC;AACxE,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAGjE;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,gBAAgB,EAAE,WAAW,GAAG,WAAW,CAAC,GAAG,kBAAkB,CA8C7G;AAED,wFAAwF;AACxF,qBACa,sBAAuB,YAAW,WAAW,EAAE,YAAY;IAQpE,OAAO,CAAC,QAAQ,CAAC,QAAQ;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAR1B,QAAQ,CAAC,EAAE,kBAAkB;IAC7B,QAAQ,CAAC,QAAQ,QAAQ;IACzB,QAAQ,CAAC,KAAK,2BAA2B;IACzC,QAAQ,CAAC,YAAY,wBAAoB;IACzC,QAAQ,CAAC,SAAS,WAAkB;gBAGjB,QAAQ,EAAE,mBAAmB,EAC7B,OAAO,EAAE,oBAAoB;IAGhD,YAAY,IAAI,IAAI;IAId,GAAG,IAAI,OAAO,CAAC,kBAAkB,CAAC;CAGzC"}

package/dist/ai/config/doctor/ai-providers.doctor-check.js

@@ -0,0 +1,92 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AiProvidersDoctorCheck = void 0;
+exports.decideAiProviders = decideAiProviders;
+const common_1 = require("@nestjs/common");
+const index_1 = require("../../../doctor/index");
+const ai_config_admin_service_1 = require("../ai-config-admin.service");
+const ai_enabled_doctor_check_1 = require("./ai-enabled.doctor-check");
+/**
+ * Pure: can every ENABLED provider actually serve a call?
+ *
+ *   - enabled but no adapter registered → it can never serve one;
+ *   - enabled, needs a key, no org key, and the policy promises an org-key
+ *     fallback (`byok_with_org_fallback`) → users without their own key fail;
+ *   - under plain `byok` a missing org key is expected — users bring keys.
+ *
+ * Reads key STATUS only (`keyStatus.configured`), never a hint or material,
+ * and calls no model: the "Test" button at /admin/settings/ai does that.
+ */
+function decideAiProviders(view) {
+    const enabled = view.providers.filter((p) => p.enabled);
+    const data = { enabledProviders: enabled.length, keyPolicy: view.keyPolicy };
+    if (enabled.length === 0) {
+        return {
+            status: 'fail',
+            detail: 'AI is on, but no provider is enabled; every AI call will fail',
+            remedy: `Enable a provider and save its key at ${ai_enabled_doctor_check_1.AI_SETTINGS_PATH}, or switch AI off there.`,
+            data,
+        };
+    }
+    const problems = [];
+    for (const provider of enabled) {
+        if (!provider.registered) {
+            problems.push(`${provider.displayName}: no adapter is available in this build`);
+            continue;
+        }
+        const needsKey = provider.requiresKey !== false;
+        if (needsKey && !provider.keyStatus.configured && view.keyPolicy === 'byok_with_org_fallback') {
+            problems.push(`${provider.displayName}: no organization key, but the key policy promises a fallback`);
+        }
+    }
+    if (problems.length > 0) {
+        return {
+            status: 'fail',
+            detail: problems.join('; '),
+            remedy: `Save an organization key for each enabled provider at ${ai_enabled_doctor_check_1.AI_SETTINGS_PATH}, or disable the provider there.`,
+            data,
+        };
+    }
+    const names = enabled.map((p) => p.requiresKey === false
+        ? `${p.displayName} (no key needed)`
+        : p.keyStatus.configured
+            ? `${p.displayName} (org key)`
+            : `${p.displayName} (users' own keys)`);
+    return { status: 'pass', detail: `Enabled: ${names.join(', ')}`, data };
+}
+/** `ai` / `ai.providers` — every enabled provider has what it needs to serve a call. */
+let AiProvidersDoctorCheck = class AiProvidersDoctorCheck {
+    registry;
+    aiAdmin;
+    id = 'ai.providers';
+    category = 'ai';
+    label = 'AI providers and keys';
+    settingsPath = ai_enabled_doctor_check_1.AI_SETTINGS_PATH;
+    dependsOn = ['ai.enabled'];
+    constructor(registry, aiAdmin) {
+        this.registry = registry;
+        this.aiAdmin = aiAdmin;
+    }
+    onModuleInit() {
+        this.registry.register(this);
+    }
+    async run() {
+        return decideAiProviders(await this.aiAdmin.describeForAdmin());
+    }
+};
+exports.AiProvidersDoctorCheck = AiProvidersDoctorCheck;
+exports.AiProvidersDoctorCheck = AiProvidersDoctorCheck = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [index_1.DoctorCheckRegistry,
+        ai_config_admin_service_1.AiConfigAdminService])
+], AiProvidersDoctorCheck);
+//# sourceMappingURL=ai-providers.doctor-check.js.map

package/dist/ai/config/doctor/ai-providers.doctor-check.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ai-providers.doctor-check.js","sourceRoot":"","sources":["../../../../src/ai/config/doctor/ai-providers.doctor-check.ts"],"names":[],"mappings":";;;;;;;;;;;;AAmBA,8CA8CC;AAjED,2CAA0D;AAG1D,iDAA4D;AAC5D,wEAAkE;AAElE,uEAA6D;AAE7D;;;;;;;;;;GAUG;AACH,SAAgB,iBAAiB,CAAC,IAAuD;IACvF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IACxD,MAAM,IAAI,GAAG,EAAE,gBAAgB,EAAE,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;IAE7E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,+DAA+D;YACvE,MAAM,EAAE,yCAAyC,0CAAgB,2BAA2B;YAC5F,IAAI;SACL,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,QAAQ,IAAI,OAAO,EAAE,CAAC;QAC/B,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE,CAAC;YACzB,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,WAAW,yCAAyC,CAAC,CAAC;YAChF,SAAS;QACX,CAAC;QAED,MAAM,QAAQ,GAAG,QAAQ,CAAC,WAAW,KAAK,KAAK,CAAC;QAEhD,IAAI,QAAQ,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,UAAU,IAAI,IAAI,CAAC,SAAS,KAAK,wBAAwB,EAAE,CAAC;YAC9F,QAAQ,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,WAAW,+DAA+D,CAAC,CAAC;QACxG,CAAC;IACH,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,OAAO;YACL,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAC3B,MAAM,EAAE,yDAAyD,0CAAgB,kCAAkC;YACnH,IAAI;SACL,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9B,CAAC,CAAC,WAAW,KAAK,KAAK;QACrB,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,kBAAkB;QACpC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU;YACtB,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,YAAY;YAC9B,CAAC,CAAC,GAAG,CAAC,CAAC,WAAW,oBAAoB,CAC3C,CAAC;IAEF,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC;AAC1E,CAAC;AAED,wFAAwF;AAEjF,IAAM,sBAAsB,GAA5B,MAAM,sBAAsB;IAQd;IACA;IARV,EAAE,GAAG,cAAc,CAAC;IACpB,QAAQ,GAAG,IAAI,CAAC;IAChB,KAAK,GAAG,uBAAuB,CAAC;IAChC,YAAY,GAAG,0CAAgB,CAAC;IAChC,SAAS,GAAG,CAAC,YAAY,CAAC,CAAC;IAEpC,YACmB,QAA6B,EAC7B,OAA6B;QAD7B,aAAQ,GAAR,QAAQ,CAAqB;QAC7B,YAAO,GAAP,OAAO,CAAsB;IAC7C,CAAC;IAEJ,YAAY;QACV,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,KAAK,CAAC,GAAG;QACP,OAAO,iBAAiB,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAAC;IAClE,CAAC;CACF,CAAA;AAnBY,wDAAsB;iCAAtB,sBAAsB;IADlC,IAAA,mBAAU,GAAE;qCASkB,2BAAmB;QACpB,8CAAoB;GATrC,sBAAsB,CAmBlC"}