@sixb/core 0.1.11 → 0.1.12

package/src/models/decision/validation.ts

@@ -0,0 +1,335 @@
+import { assertJsonValue, cloneJsonValue } from "../../json"
+import { UnsupportedModelFeatureError } from "../errors"
+import type {
+  ChoiceQuestion,
+  DecisionAnswers,
+  DecisionContent,
+  DecisionModel,
+  DecisionModelDefinition,
+  DecisionQuestion,
+  DecisionQuestions,
+  ScoreQuestion,
+} from "./types"
+
+type DecisionCapabilities = DecisionModelDefinition["capabilities"]
+
+// Allow serialization rounding without normalizing provider answers.
+const DISTRIBUTION_TOLERANCE = 1e-4
+const CHOICE_TOLERANCE = 1e-6
+
+export function assertDecisionContent(
+  value: unknown,
+  path: string
+): asserts value is DecisionContent {
+  assertJsonValue(value, path)
+  if (value === null || (typeof value !== "string" && typeof value !== "object")) {
+    throw new TypeError(`[SixbModels] ${path} must be text, a JSON object or an array.`)
+  }
+}
+
+export function assertDecisionQuestions(value: unknown): asserts value is DecisionQuestions {
+  assertJsonValue(value, "questions")
+  const questions = readRecord(value, "questions")
+  if (!Object.keys(questions).length) {
+    fail("questions must not be empty")
+  }
+
+  for (const [key, question] of Object.entries(questions)) {
+    if (!key.trim()) {
+      fail("question names must not be empty")
+    }
+    assertQuestion(question, `questions.${key}`)
+  }
+}
+
+function assertQuestion(value: unknown, path: string): void {
+  const question = readRecord(value, path)
+  assertDecisionContent(question.instructions, `${path}.instructions`)
+  if (typeof question.instructions === "string" && !question.instructions.trim()) {
+    fail(`${path}.instructions must not be empty`)
+  }
+
+  switch (question.type) {
+    case "choice":
+      assertOnlyKeys(question, ["type", "instructions", "options"], path)
+      assertChoiceOptions(question.options, `${path}.options`)
+      break
+    case "score":
+      assertOnlyKeys(question, ["type", "instructions", "levels"], path)
+      assertScoreLevels(question.levels, `${path}.levels`)
+      break
+    case "probability":
+      assertOnlyKeys(question, ["type", "instructions"], path)
+      break
+    default:
+      fail(`${path}.type is not a supported decision primitive`)
+  }
+}
+
+function assertChoiceOptions(value: unknown, path: string): void {
+  const options = readRecord(value, path)
+  if (!Object.keys(options).length) {
+    fail(`${path} must not be empty`)
+  }
+
+  for (const [option, description] of Object.entries(options)) {
+    if (!option.trim()) {
+      fail(`${path} contains an empty label`)
+    }
+    if (description !== null) {
+      assertDecisionContent(description, `${path}.${option}`)
+    }
+  }
+}
+
+function assertScoreLevels(value: unknown, path: string): void {
+  if (!Array.isArray(value) || value.length < 2) {
+    fail(`${path} needs at least two levels`)
+  }
+
+  for (const level of value) {
+    assertDecisionContent(level, path)
+  }
+}
+
+export function assertDecisionModel(model: DecisionModel): void {
+  const definition = model?.definition
+  if (
+    !model ||
+    typeof model.evaluate !== "function" ||
+    !isValidId(model.providerId) ||
+    !isValidId(model.modelId) ||
+    definition?.kind !== "decision" ||
+    definition.providerId !== model.providerId ||
+    definition.modelId !== model.modelId
+  ) {
+    fail("Expected a DecisionModel with matching provider/model identity")
+  }
+
+  const capabilities = definition.capabilities
+  if (
+    !capabilities ||
+    !Array.isArray(capabilities.questions) ||
+    !capabilities.questions.length ||
+    capabilities.questions.some((kind) => !["choice", "score", "probability"].includes(kind)) ||
+    new Set(capabilities.questions).size !== capabilities.questions.length
+  ) {
+    fail("Decision model capabilities must list distinct supported question types")
+  }
+
+  assertCapabilityLimit(capabilities.maxChoices, "maxChoices", 1)
+  assertCapabilityLimit(capabilities.maxScoreLevels, "maxScoreLevels", 2)
+  const decimals = capabilities.answerDecimalPlaces
+  if (
+    decimals !== undefined &&
+    (!Number.isSafeInteger(decimals) || decimals < 1 || decimals > 15)
+  ) {
+    fail("Invalid decision answerDecimalPlaces (expected 1–15)")
+  }
+}
+
+function assertCapabilityLimit(value: number | undefined, name: string, minimum: number): void {
+  if (value !== undefined && (!Number.isSafeInteger(value) || value < minimum)) {
+    fail(`Invalid decision capability '${name}'`)
+  }
+}
+
+export function assertDecisionSupport(model: DecisionModel, questions: DecisionQuestions): void {
+  for (const [key, question] of Object.entries(questions)) {
+    if (!supportsQuestion(model.definition.capabilities, question)) {
+      throw new UnsupportedModelFeatureError(
+        `[SixbModels] Model '${model.providerId}/${model.modelId}' does not support questions.${key}.`
+      )
+    }
+  }
+}
+
+function supportsQuestion(capabilities: DecisionCapabilities, question: DecisionQuestion): boolean {
+  if (!capabilities.questions.includes(question.type)) return false
+
+  switch (question.type) {
+    case "choice":
+      return Object.keys(question.options).length <= (capabilities.maxChoices ?? Infinity)
+    case "score":
+      return question.levels.length <= (capabilities.maxScoreLevels ?? Infinity)
+    case "probability":
+      return true
+  }
+}
+
+export function validateDecisionAnswers<const Q extends DecisionQuestions>(
+  questions: Q,
+  value: unknown,
+  answerDecimalPlaces?: number
+): DecisionAnswers<Q> {
+  assertJsonValue(value, "decision output")
+  const answers = readRecord(value, "decision output")
+  assertExactKeys(answers, Object.keys(questions), "decision output")
+
+  const roundingError = answerDecimalPlaces === undefined ? 0 : 0.5 * 10 ** -answerDecimalPlaces
+  for (const [key, question] of Object.entries(questions)) {
+    assertAnswer(question, answers[key], `output.${key}`, roundingError)
+  }
+
+  // Validation establishes the mapped type; callers receive an independent JSON snapshot.
+  return cloneJsonValue(value) as DecisionAnswers<Q>
+}
+
+function assertAnswer(
+  question: DecisionQuestion,
+  value: unknown,
+  path: string,
+  roundingError: number
+): void {
+  const answer = readRecord(value, path)
+  if (question.type === "probability") {
+    assertExactKeys(answer, ["probability"], path)
+    readProbability(answer.probability, path)
+    return
+  }
+
+  assertOnlyKeys(answer, [question.type, "probabilities", "confidence"], path)
+  if (answer.confidence !== undefined) {
+    readProbability(answer.confidence, `${path}.confidence`)
+  }
+
+  const distribution =
+    question.type === "choice"
+      ? validateChoiceAnswer(question, answer, path)
+      : validateScoreAnswer(question, answer, path, roundingError)
+
+  const total = distribution.reduce((sum, probability) => sum + probability, 0)
+  const tolerance = Math.max(DISTRIBUTION_TOLERANCE, distribution.length * roundingError)
+  if (Math.abs(total - 1) > tolerance + Number.EPSILON * distribution.length) {
+    fail(`${path}.probabilities must sum to one`)
+  }
+}
+
+function validateChoiceAnswer(
+  question: ChoiceQuestion,
+  answer: Record<string, unknown>,
+  path: string
+): number[] {
+  const probabilities = readRecord(answer.probabilities, `${path}.probabilities`)
+  assertExactKeys(probabilities, Object.keys(question.options), `${path}.probabilities`)
+  const distribution = Object.values(probabilities).map((value) => readProbability(value, path))
+
+  if (typeof answer.choice !== "string" || !Object.hasOwn(question.options, answer.choice)) {
+    fail(`${path}.choice is not a declared option`)
+  }
+
+  const winner = readProbability(probabilities[answer.choice], path)
+  if (winner + CHOICE_TOLERANCE < Math.max(...distribution)) {
+    fail(`${path}.choice is not a highest-probability option`)
+  }
+
+  return distribution
+}
+
+function validateScoreAnswer(
+  question: ScoreQuestion,
+  answer: Record<string, unknown>,
+  path: string,
+  roundingError: number
+): number[] {
+  if (
+    !Array.isArray(answer.probabilities) ||
+    answer.probabilities.length !== question.levels.length
+  ) {
+    fail(`${path}.probabilities must match the score levels`)
+  }
+
+  const distribution = answer.probabilities.map((value) => readProbability(value, path))
+  const expected = distribution.reduce((sum, probability, index) => sum + probability * index, 0)
+  const levels = question.levels.length
+  const [minimum, maximum] = roundingError
+    ? roundedScoreBounds(distribution, roundingError, path)
+    : [expected, expected]
+  const tolerance = roundingError || DISTRIBUTION_TOLERANCE * levels
+  if (
+    typeof answer.score !== "number" ||
+    !Number.isFinite(answer.score) ||
+    answer.score < 0 ||
+    answer.score > question.levels.length - 1 ||
+    answer.score < minimum - tolerance - Number.EPSILON * levels ** 2 ||
+    answer.score > maximum + tolerance + Number.EPSILON * levels ** 2
+  ) {
+    fail(`${path}.score is inconsistent with its distribution`)
+  }
+
+  return distribution
+}
+
+/** Find possible means without changing the returned probabilities. */
+function roundedScoreBounds(
+  distribution: readonly number[],
+  roundingError: number,
+  path: string
+): readonly [number, number] {
+  const lower = distribution.map((value) => Math.max(0, value - roundingError))
+  const upper = distribution.map((value) => Math.min(1, value + roundingError))
+  const remaining = 1 - lower.reduce((sum, value) => sum + value, 0)
+  const epsilon = Number.EPSILON * distribution.length
+  if (remaining < -epsilon || upper.reduce((sum, value) => sum + value, 0) < 1 - epsilon) {
+    fail(`${path}.probabilities must sum to one`)
+  }
+
+  const base = lower.reduce((sum, value, index) => sum + value * index, 0)
+  function extreme(highestFirst: boolean): number {
+    let mass = Math.max(0, remaining)
+    let mean = base
+    // Start at each probability's lower bound, then allocate exactly the remaining mass.
+    // Filling lower levels first minimizes the mean; filling higher levels maximizes it.
+    for (let offset = 0; offset < distribution.length && mass > 0; offset++) {
+      const index = highestFirst ? distribution.length - 1 - offset : offset
+      const added = Math.min(mass, upper[index]! - lower[index]!)
+      mean += added * index
+      mass -= added
+    }
+    return mean
+  }
+  return [extreme(false), extreme(true)]
+}
+
+function readProbability(value: unknown, path: string): number {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || value > 1) {
+    fail(`${path} must contain probabilities between zero and one`)
+  }
+  return value
+}
+
+function readRecord(value: unknown, path: string): Record<string, unknown> {
+  if (value === null || typeof value !== "object" || Array.isArray(value)) {
+    fail(`${path} must be an object`)
+  }
+  return value as Record<string, unknown>
+}
+
+function assertOnlyKeys(
+  value: Record<string, unknown>,
+  keys: readonly string[],
+  path: string
+): void {
+  if (Object.keys(value).some((key) => !keys.includes(key))) {
+    fail(`${path} contains an unknown field`)
+  }
+}
+
+function assertExactKeys(
+  value: Record<string, unknown>,
+  keys: readonly string[],
+  path: string
+): void {
+  assertOnlyKeys(value, keys, path)
+  if (keys.some((key) => !Object.hasOwn(value, key))) {
+    fail(`${path} is missing an expected field`)
+  }
+}
+
+function isValidId(value: unknown): value is string {
+  return typeof value === "string" && !!value.trim() && value.trim() === value
+}
+
+function fail(detail: string): never {
+  throw new TypeError(`[SixbModels] ${detail}.`)
+}

package/src/models/definitions.ts

@@ -5,7 +5,7 @@ import {
   type ModelReasoningCapabilities,
 } from "./language-model"
 
-export type ModelKind = "language" | "image" | "video" | "embedding"
+export type ModelKind = "language" | "image" | "video" | "embedding" | "decision"
 
 /** Common catalog identity shared by every present and future model runtime. */
 export interface ModelDefinition {

package/src/models/embedding-model.ts

@@ -0,0 +1,129 @@
+import type { ModelDefinition } from "./definitions"
+import { ModelProviderError } from "./errors"
+import type { ModelProviderIds, ModelRoute, ModelUsage } from "./events"
+import type { ModelCostEstimator, ModelReportedCost } from "./pricing"
+
+/** The identity includes the configured output dimension, not only the vendor's model id. */
+export interface EmbeddingModelDefinition extends ModelDefinition {
+  readonly kind: "embedding"
+  readonly dimensions: number
+  /** Actual representation behind a routing alias. Omit only when modelId identifies it directly. */
+  readonly representation?: { readonly name: string; readonly version?: string }
+}
+
+export interface EmbeddingModelRequest {
+  readonly texts: readonly string[]
+  /** Providers must honor cancellation and propagate this signal to their transport. */
+  readonly signal?: AbortSignal
+}
+
+/** Provider accounting facts; absent meters or prices remain unknown. */
+export interface EmbeddingModelResponseMetadata {
+  readonly usage?: ModelUsage
+  readonly providerIds?: ModelProviderIds
+  readonly responseModelId?: string
+  readonly reportedCost?: ModelReportedCost
+  readonly route?: ModelRoute
+}
+
+export interface EmbeddingModelResult extends EmbeddingModelResponseMetadata {
+  readonly vectors: readonly (readonly number[])[]
+}
+
+/** Serializable profile reference; executable providers stay on the server. */
+export interface EmbeddingModelRef {
+  readonly providerId: string
+  readonly modelId: string
+  readonly definition: EmbeddingModelDefinition
+}
+
+/** Conservative transport bounds for automatic projection batching, not token estimates. */
+export interface EmbeddingBatchLimits {
+  readonly maxInputs: number
+  readonly maxInputBytes: number
+  readonly maxTotalInputBytes: number
+}
+
+export interface EmbeddingModel extends EmbeddingModelRef {
+  /** Omit when safe multi-input bounds are unknown; automatic indexing then calls one at a time. */
+  readonly batching?: EmbeddingBatchLimits
+  readonly costEstimator?: ModelCostEstimator
+  /** Resolve and pin optional pricing before admission, without an inference call. */
+  resolve?(): Promise<EmbeddingModel>
+  embed(request: EmbeddingModelRequest): Promise<EmbeddingModelResult>
+}
+
+export function assertEmbeddingModel(model: EmbeddingModel): void {
+  if (!model || typeof model !== "object" || typeof model.embed !== "function") {
+    throw new TypeError("[Sixb] Expected an EmbeddingModel with an embed method.")
+  }
+  assertEmbeddingModelRef(model)
+  if (
+    model.batching &&
+    [
+      model.batching.maxInputs,
+      model.batching.maxInputBytes,
+      model.batching.maxTotalInputBytes,
+    ].some((value) => !Number.isSafeInteger(value) || value < 1)
+  ) {
+    throw new TypeError("[Sixb] Embedding batch limits must be positive safe integers.")
+  }
+}
+
+export function assertEmbeddingModelRef(model: EmbeddingModelRef): void {
+  const definition = model?.definition
+  const representation = definition?.representation
+  if (
+    representation !== undefined &&
+    (!representation ||
+      typeof representation !== "object" ||
+      !validIdentityPart(representation.name) ||
+      (representation.version !== undefined && !validIdentityPart(representation.version)))
+  )
+    throw new TypeError("[Sixb] Invalid embedding model representation.")
+  if (
+    !definition ||
+    definition.kind !== "embedding" ||
+    definition.providerId !== model.providerId ||
+    definition.modelId !== model.modelId ||
+    typeof model.providerId !== "string" ||
+    !model.providerId ||
+    model.providerId.trim() !== model.providerId ||
+    typeof model.modelId !== "string" ||
+    !model.modelId ||
+    model.modelId.trim() !== model.modelId ||
+    !Number.isSafeInteger(definition.dimensions) ||
+    definition.dimensions < 1 ||
+    definition.dimensions > 16000
+  ) {
+    throw new TypeError("[Sixb] Invalid embedding model identity or dimensions (expected 1–16000).")
+  }
+}
+
+/** Routing identity, representation and dimensions must agree before any inference. */
+export function sameEmbeddingModel(left: EmbeddingModelRef, right: EmbeddingModelRef): boolean {
+  return (
+    left.providerId === right.providerId &&
+    left.modelId === right.modelId &&
+    left.definition.dimensions === right.definition.dimensions &&
+    (left.definition.representation?.name ?? left.modelId) ===
+      (right.definition.representation?.name ?? right.modelId) &&
+    left.definition.representation?.version === right.definition.representation?.version
+  )
+}
+
+function validIdentityPart(value: unknown): value is string {
+  return typeof value === "string" && value.length > 0 && value.trim() === value
+}
+
+/** A completed provider response whose vectors are unusable, but may still be billable. */
+export class EmbeddingModelResponseError extends ModelProviderError {
+  constructor(
+    message: string,
+    providerId: string,
+    modelId: string,
+    readonly metadata: EmbeddingModelResponseMetadata
+  ) {
+    super(message, providerId, modelId, { code: "invalid_embedding_response", retryable: false })
+  }
+}

package/src/models/execution/README.md

@@ -0,0 +1,63 @@
+# Model execution accounting
+
+Internal execution and accounting shared by language, embedding and decision calls. Application usage is
+documented in [Usage and limits](../../../../../docs/models/usage-and-limits.md).
+
+## Execution boundary
+
+`ModelExecutionSession` binds one execution attempt and cancellation signal. Its lazy recorder
+uses the durable execution's requester-group snapshot, so redelivery cannot change attribution.
+Language execution and the scoped embedding catalog share that recorder and its failure state.
+Object authorization happens before embedding inference; wrapping a catalog does not grant access.
+
+## Embedding flow
+
+```text
+Authorized index / text search
+  → Scoped embedding model
+  → Resolve model and pricing; verify identity and dimensions
+  → Reserve capacity atomically
+  → Call provider once
+  → Record usage, valuation, and reconcile reservation
+  → Check cancellation; return for vector validation and object write
+```
+
+`embedding.ts` snapshots inputs and combines caller, execution, and 30-second cancellation
+signals. Providers must propagate the signal to their transport; cancellation is cooperative.
+Input reservation uses UTF-8 bytes divided by four, rounded up per text. Output allowance and
+actual output tokens are zero. Missing input usage remains unknown.
+
+An optional provider `resolve()` pins pricing before admission. The response can include `usage`,
+`providerIds`, `responseModelId`, `reportedCost`, and `route`. Provider charges take precedence;
+the local estimate is retained separately. `EmbeddingModelResponseError` preserves this evidence
+when a provider rejects an invalid response.
+
+Accounting precedes cancellation propagation, vector validation, and the optimistic object write:
+a rejected result or stale write does not erase a billable call. Ambiguous provider failures retain
+unknown input usage and unresolved capacity. Inference is never retried here.
+
+## Recovery and boundaries
+
+`AiModelCallRecorder` retries the atomic accounting write, then hands persistent failures to
+`queues.agents`. Its failure state prevents further billable calls in the session. Recovery
+replays accounting only, never inference; see the
+[worker recovery contract](../../../../agent-worker/docs/usage-accounting.md).
+
+Direct provider calls bypass this session. Webhook handlers have no bound model execution attempt;
+they must dispatch an action for accounted calls. A process crash before accounting is captured
+can still leave provider billing outside the ledger.
+
+## Decision flow
+
+Decision evaluation in `../decision/runtime.ts` uses the same session and recorder. It snapshots JSON input/questions
+before yielding, resolves only a permitted catalog binding, checks primitive capabilities,
+admits one call, invokes the provider, and records usage before validating or returning answers.
+The original question snapshot defines valid answer keys, labels and score levels.
+
+Input reservation uses serialized UTF-8 bytes divided by four; output reserves the shared
+4,096-token estimate. Neither is a tokenizer or a provider-enforced ceiling. Decision providers
+must preserve their actual output-token meters even when their output price is zero.
+
+`DecisionModelResponseError` carries accounting metadata when protocol translation fails after
+a billable response. Other errors retain unknown usage. Recovery replays accounting, never
+inference. Decision-only projects use the existing recovery worker without an agent sandbox.

package/src/models/execution/binding.ts

@@ -3,6 +3,8 @@ import type { ModelsRuntime } from "../generation-types"
 export interface ModelExecutionAttempt {
   readonly attempt: number
   readonly signal: AbortSignal
+  /** Internal durable fence around admission; it must invoke admit exactly once to proceed. */
+  readonly embeddingAdmission?: (admit: () => Promise<void>) => Promise<void>
 }
 
 const bindings = new WeakMap<ModelsRuntime, (input: ModelExecutionAttempt) => void>()

package/src/models/execution/embedding.ts

@@ -0,0 +1,133 @@
+import { randomUUID } from "node:crypto"
+import type { EmbeddingModelCatalog, EmbeddingModelEntry, ModelRef } from "../catalog"
+import {
+  assertEmbeddingModel,
+  type EmbeddingModel,
+  type EmbeddingModelRequest,
+  EmbeddingModelResponseError,
+  type EmbeddingModelResponseMetadata,
+  type EmbeddingModelResult,
+  sameEmbeddingModel,
+} from "../embedding-model"
+import { estimateModelCall } from "../pricing"
+import type { AiModelCallRecorder } from "./model-call-recorder"
+import type { ModelExecutionSession } from "./session"
+
+/** Scope the configured bindings without changing profile identity or object permissions. */
+export function bindEmbeddingModels(
+  catalog: EmbeddingModelCatalog | undefined,
+  session: ModelExecutionSession
+): EmbeddingModelCatalog | undefined {
+  if (!catalog) return undefined
+  const entries: readonly EmbeddingModelEntry[] = Object.freeze(
+    catalog.list().map((entry) =>
+      Object.freeze({
+        ...entry,
+        model: Object.freeze({
+          providerId: entry.model.providerId,
+          modelId: entry.model.modelId,
+          definition: entry.model.definition,
+          batching: entry.model.batching && Object.freeze({ ...entry.model.batching }),
+          embed: (input: EmbeddingModelRequest) => executeEmbedding(session, entry.model, input),
+        }),
+      })
+    )
+  )
+  const byRef = new Map(
+    entries.map((entry) => [JSON.stringify([entry.provider, entry.modelId]), entry])
+  )
+  return Object.freeze({
+    list: () => entries,
+    getByRef: (ref: ModelRef) => byRef.get(JSON.stringify([ref.provider, ref.modelId])) ?? null,
+  })
+}
+
+async function executeEmbedding(
+  session: ModelExecutionSession,
+  binding: EmbeddingModel,
+  input: EmbeddingModelRequest
+) {
+  if (
+    !Array.isArray(input.texts) ||
+    input.texts.some((text) => typeof text !== "string" || !text.trim())
+  ) {
+    throw new TypeError("[SixbModels] Embedding inputs must be nonempty strings.")
+  }
+  const texts = [...input.texts]
+  const signal = session.signal(input.signal)
+  const requestSignal = AbortSignal.any([signal, AbortSignal.timeout(30_000)])
+  requestSignal.throwIfAborted()
+  if (!texts.length) return { vectors: [] }
+
+  const accounting = await session.accounting()
+  accounting.assertHealthy()
+  const model = (await binding.resolve?.()) ?? binding
+  assertEmbeddingModel(model)
+  if (!sameEmbeddingModel(model, binding)) {
+    throw new TypeError(
+      "[SixbModels] Resolved embedding model identity does not match the selected model."
+    )
+  }
+  requestSignal.throwIfAborted()
+  const callId = `call_${randomUUID()}`
+  const tokens = texts.reduce(
+    (sum, text) => sum + Math.ceil(new TextEncoder().encode(text).byteLength / 4),
+    0
+  )
+  await session.admitEmbeddingCall(() =>
+    accounting.admitCall({
+      callId,
+      providerId: model.providerId,
+      modelId: model.modelId,
+      costEstimator: model.costEstimator,
+      inputTokens: { status: "estimated", tokens, method: "utf8BytesDividedByFour" },
+      outputTokenAllowance: 0,
+      estimatedTotalTokens: tokens,
+    })
+  )
+
+  let result: EmbeddingModelResult
+  try {
+    requestSignal.throwIfAborted()
+    result = await model.embed({ texts, signal: requestSignal })
+  } catch (error) {
+    if (error instanceof EmbeddingModelResponseError) {
+      await recordEmbedding(accounting, model, callId, error.metadata)
+    } else {
+      // The provider may have accepted the request. Never retry inference or release its budget.
+      await recordEmbedding(accounting, model, callId, {})
+    }
+    throw error
+  }
+  // Account before cancellation, vector validation or the materializer's optimistic write.
+  await recordEmbedding(accounting, model, callId, result ?? {})
+  requestSignal.throwIfAborted()
+  return result
+}
+
+async function recordEmbedding(
+  accounting: AiModelCallRecorder,
+  model: EmbeddingModel,
+  callId: string,
+  metadata: EmbeddingModelResponseMetadata
+): Promise<void> {
+  // Embeddings produce no output tokens; missing INPUT usage must remain unknown.
+  const usage = { ...metadata.usage, outputTokens: 0 }
+  const estimate = estimateModelCall(model, {
+    usage,
+    route: metadata.route,
+    responseModelId: metadata.responseModelId,
+  })
+  await accounting.onModelCallEnd({
+    callId,
+    providerId: model.providerId,
+    modelId: model.modelId,
+    responseId: metadata.providerIds?.responseId ?? callId,
+    responseModelId: metadata.responseModelId,
+    providerIds: metadata.providerIds,
+    usage,
+    cost: metadata.reportedCost ? { status: "reported", ...metadata.reportedCost } : estimate,
+    ...(metadata.reportedCost ? { estimate } : {}),
+    route: metadata.route,
+  })
+}