create-ailk 0.2.0 → 0.4.0

package/templates/apps/api/src/services/usage-metering.ts

@@ -1,699 +0,0 @@
-/**
- * @file usage-metering.ts
- * @description Usage-metering write path — cost → markup → write (ADR 0009
- * D3 service-layer assembler; spec docs/specs/3705-s1-usage-metering-service-spec.md).
- *
- * The AILK analog of working-theory's `UsageTracker.logEvent`: given a
- * completed AI call's token breakdown + model, compute the provider cost
- * (token counts × pricing, with an optional 2x extended-context surcharge),
- * apply a hierarchical markup (model → provider → org → 20% system default),
- * write the `UsageEvent` (the three attribution portions initialized to 0 —
- * populated later by the credit waterfall, P3/P4), then upsert the
- * `UsagePeriod` tier aggregate. Mirrors `lead-routing.ts`'s shape:
- * discriminated `{ ok } | { ok: false, error }` result, no throw on the
- * expected paths.
- *
- * This is a MONEY-WRITING path. Four invariants hold it (security review of
- * PR #3727 — findings H3/H4/H5, M1–M5):
- *
- *   1. ATOMIC (H3). The `UsageEvent` insert and the `UsagePeriod` upsert run
- *      in ONE `$transaction`. Either both land or neither does — so a failed
- *      upsert (incl. the Prisma `upsert` P2002 race on a new period) can never
- *      strand a persisted event that the caller's retry would then double-bill.
- *      Every `ok: false` therefore carries `persisted: false`: nothing was
- *      written, a retry is always safe.
- *   2. VALIDATED AT THE BOUNDARY (H4/M1). Every caller-supplied number is
- *      parsed by `recordUsageEventSchema` before it reaches the cost math or
- *      the DB — a negative count (which would DECREMENT the org's metered
- *      spend), a `NaN` (which Postgres `double precision` accepts, permanently
- *      poisoning the aggregate), a non-integer, or an absurd magnitude is
- *      rejected as `invalid_input`. `totalTokens` is DERIVED server-side from
- *      the buckets, never trusted from the caller (M1 — it alone drives the
- *      quota columns).
- *   3. TYPED TENANT GRAIN (H5). The input carries a `TenantContext` whose ids
- *      are the branded `Id<>` types, so the type system forces callers through
- *      `resolveActiveTenant` (which proves session ↔ workspace ↔ org ↔
- *      Membership). `organizationId` keys BOTH the markup lookup AND the spend
- *      increment, so a caller-supplied string here bills the wrong tenant. The
- *      zod schema re-checks the id grammar at runtime, so a cast that smuggles
- *      a workspace id into the organization slot is rejected too.
- *   4. DB-SOURCED NUMBERS ARE RANGE-CHECKED (M2/M3). Pricing rates, markup
- *      percents, and the model tier come from operator-editable rows; each is
- *      validated (finite, non-negative, in range / in the tier union) before it
- *      can reach the money math. A null markup column (`Number(null) === 0`)
- *      no longer silently zeroes revenue.
- *
- * PII boundary: only ids (organizationId/workspaceId/userId), provider/model
- * names, and computed costs ever appear in logs or in a returned error. Never
- * token content. Raw DB error text is logged server-side and NEVER returned —
- * Prisma validation errors embed the full `data` argument (M5).
- *
- * Schema note: `UsageEvent`/`UsagePeriod` (database/content, #3709) and
- * `LlmModel`/`LlmModelPricing`/`AiMarkupConfig` (database/config, #3710) are
- * the FEAT-047 P1 models this P2.S1 service is written against — they are not
- * yet in the generated Prisma client this package compiles against (P1 has
- * not merged). `db` below is `prisma` structurally cast to the delegate shape
- * this file needs; once P1 merges and the client regenerates, the real
- * client's delegates satisfy this shape for free — no code change required.
- * Field/constraint names (esp. the `UsagePeriod` compound-unique key) are the
- * spec's best-effort assumption and should be reconciled against P1 as merged
- * (spec §5.3).
- */
-
-import { zOrganizationId, zUserId, zWorkspaceId } from "@working-theory/ids";
-import { z } from "zod";
-
-import { prisma } from "../lib/prisma.js";
-
-// ─── Types ────────────────────────────────────────────────────────────────────
-
-export type ModelTier = "BASE" | "PREMIUM" | "FRONTIER";
-
-/**
- * The tenant grain this service bills against (#5182).
- *
- * Previously `import type { TenantContext } from "./tenant-context.js"` — a
- * multi-tenant SLICE file the OSS strip removes, which makes a type-only import
- * of it a TS2307 on the public tree exactly as a value import would be (spec
- * D1). There is no non-slice home for that type: `packages/observability`'s
- * same-named interface is a telemetry attribute bag, not the branded auth
- * grain, and reusing it would be a false friend.
- *
- * So the type is derived from this file's OWN runtime contract instead, which
- * is strictly more accurate than the import was. `zTenantContext` below already
- * re-validates exactly these three branded ids; the slice type's fourth member
- * (`role`) was never read here and was never re-checked at runtime, so the
- * declared input type and the validator now agree rather than diverge.
- */
-type BillableTenant = z.infer<typeof zTenantContext>;
-
-export interface RecordUsageEventInput {
-  /**
-   * The resolved tenant grain (H5) — produced by `resolveActiveTenant`, never
-   * assembled from request-supplied strings. `organizationId` keys the markup
-   * lookup AND the spend increment, so this is the tenant that gets billed.
-   */
-  tenant: BillableTenant;
-  provider: string;
-  model: string;
-  inputTokensCacheWrite?: number;
-  inputTokensNoCacheWrite: number;
-  cacheReadTokens?: number;
-  outputTokens: number;
-  thinkingTokens?: number;
-  /** Actual conversation context size; omitted → 0 → extended pricing skipped ("don't guess"). */
-  contextWindowSize?: number;
-  /** Drives downstream aggregation filtering (P2.S2); the write itself never branches on it. */
-  completionStatus?: string;
-}
-
-export type RecordUsageErrorKind = "invalid_input" | "write_failed";
-
-export type RecordUsageResult =
-  | { ok: true; eventId: string; billedCostUsd: number }
-  | {
-      ok: false;
-      error: {
-        kind: RecordUsageErrorKind;
-        message: string;
-        /**
-         * ALWAYS `false` (H3). The event + aggregate writes are one
-         * transaction, so a failure leaves NOTHING persisted — a caller may
-         * always retry without risking a double-bill. If this path ever gains
-         * a non-atomic branch, this field becomes a union and callers must
-         * branch on it.
-         */
-        persisted: false;
-      };
-    };
-
-/** The pure cost-math input — provider pricing for one (provider, model) pair. */
-export interface ModelPricing {
-  inputPricePerMillion: number;
-  outputPricePerMillion: number;
-  cachedInputPricePerMillion?: number | null;
-}
-
-// ─── Boundary validation (H4/M1) ──────────────────────────────────────────────
-
-/**
- * Sane magnitude ceilings. These are ABSURDITY guards, not business limits —
- * they exist so a corrupt/hostile caller cannot drive the cost math to
- * `Infinity` (which Postgres `double precision` accepts, poisoning the
- * aggregate). The largest real context window today is ~10M tokens.
- */
-const MAX_TOKENS_PER_EVENT = 100_000_000;
-const MAX_CONTEXT_WINDOW = 100_000_000;
-
-/**
- * A token bucket: finite, integral, non-negative, bounded. `z.number().int()`
- * rejects `NaN` and `±Infinity` (neither is an integer) — the H4 poison path.
- */
-const zTokenCount = z
-  .number()
-  .int("token counts must be integers")
-  .min(0, "token counts cannot be negative")
-  .max(MAX_TOKENS_PER_EVENT, "token count exceeds the per-event maximum");
-
-/** The branded tenant grain (H5) — re-checked at runtime, not merely typed. */
-const zTenantContext = z.object({
-  userId: zUserId,
-  organizationId: zOrganizationId,
-  workspaceId: zWorkspaceId,
-});
-
-const recordUsageEventSchema = z.object({
-  tenant: zTenantContext,
-  provider: z.string().min(1).max(128),
-  model: z.string().min(1).max(128),
-  inputTokensCacheWrite: zTokenCount.optional(),
-  inputTokensNoCacheWrite: zTokenCount,
-  cacheReadTokens: zTokenCount.optional(),
-  outputTokens: zTokenCount,
-  thinkingTokens: zTokenCount.optional(),
-  contextWindowSize: z
-    .number()
-    .int("contextWindowSize must be an integer")
-    .min(0, "contextWindowSize cannot be negative")
-    .max(MAX_CONTEXT_WINDOW)
-    .optional(),
-  completionStatus: z.string().min(1).max(64).optional(),
-});
-
-// ─── Structural delegate shape for the not-yet-generated FEAT-047 models ───────
-// (See the schema note above — reconcile against P1/P1.S2 as merged.)
-
-interface UsageEventCreateData {
-  organizationId: string;
-  workspaceId: string;
-  userId: string;
-  provider: string;
-  model: string;
-  inputTokensCacheWrite: number;
-  inputTokensNoCacheWrite: number;
-  cacheReadTokens: number;
-  outputTokens: number;
-  thinkingTokens: number;
-  totalTokens: number;
-  providerCostUsd: number;
-  markupPercent: number;
-  billedCostUsd: number;
-  modelTier: ModelTier;
-  wasAutoModel: boolean;
-  includedPortionCents: number;
-  creditBalancePortionCents: number;
-  onDemandPortionCents: number;
-  completionStatus: string;
-}
-
-interface UsagePeriodUpsertData {
-  organizationId: string;
-  periodStart: Date;
-  periodEnd: Date;
-  tokensConsumed: number;
-  usageSpendCents: number;
-  baseTokensConsumed?: number;
-  premiumTokensConsumed?: number;
-  frontierTokensConsumed?: number;
-}
-
-interface LlmModelRow {
-  tier: ModelTier;
-  isAutoModel: boolean;
-  chargeExtendedContextAt2x: boolean;
-  consumptionMultiplier: number | string;
-}
-
-interface LlmModelPricingRow {
-  inputPricePerMillion: number | string;
-  outputPricePerMillion: number | string;
-  cachedInputPricePerMillion: number | string | null;
-}
-
-interface AiMarkupConfigRow {
-  markupPercent: number | string;
-}
-
-/**
- * The two write delegates, as seen INSIDE the transaction (H3). `recordUsageEvent`
- * reaches the `UsageEvent` / `UsagePeriod` writers ONLY through the `$transaction`
- * callback, never off the base client — which is what makes the pair atomic.
- */
-export interface UsageWriteClient {
-  usageEvent: {
-    create(args: {
-      data: UsageEventCreateData;
-      select: { id: true };
-    }): Promise<{ id: string }>;
-  };
-  usagePeriod: {
-    upsert(args: {
-      where: {
-        organizationId_periodStart: { organizationId: string; periodStart: Date };
-      };
-      create: UsagePeriodUpsertData;
-      update: Record<string, unknown>;
-    }): Promise<unknown>;
-  };
-}
-
-export interface UsageMeteringPrismaDelegates extends UsageWriteClient {
-  llmModel: {
-    findFirst(args: {
-      where: { provider: string; model: string };
-    }): Promise<LlmModelRow | null>;
-  };
-  llmModelPricing: {
-    findFirst(args: unknown): Promise<LlmModelPricingRow | null>;
-  };
-  aiMarkupConfig: {
-    findFirst(args: unknown): Promise<AiMarkupConfigRow | null>;
-  };
-  $transaction<T>(fn: (tx: UsageWriteClient) => Promise<T>): Promise<T>;
-}
-
-const db = prisma as unknown as UsageMeteringPrismaDelegates;
-
-// ─── Constants ──────────────────────────────────────────────────────────────
-
-const STANDARD_CONTEXT_WINDOW = 200_000;
-const EXTENDED_CONTEXT_MULTIPLIER = 2;
-const SYSTEM_DEFAULT_MARKUP_PERCENT = 20;
-
-/**
- * Absurdity ceilings for the two operator-editable money inputs (M2). A rate or
- * markup beyond these is a mis-seeded row, not a pricing decision — treated as
- * absent rather than allowed to reach the cost math (where a `1e308` markup
- * would produce an `Infinity` bill).
- */
-const MAX_PRICE_PER_MILLION = 1_000_000;
-const MAX_MARKUP_PERCENT = 100_000;
-
-/**
- * Marks an event metered with NO pricing row (M4). Prefix-encoded onto the
- * existing `completionStatus` column (no schema change — #3709 owns the
- * schema), so the event is (a) distinguishable from a genuine $0 call and
- * therefore re-priceable, and (b) still carries the caller's original status.
- * A dedicated column is the right long-term home — see the PR follow-up.
- */
-const PRICING_MISSING_PREFIX = "pricing_missing:";
-
-const TIER_COLUMN: Record<
-  ModelTier,
-  "baseTokensConsumed" | "premiumTokensConsumed" | "frontierTokensConsumed"
-> = {
-  BASE: "baseTokensConsumed",
-  PREMIUM: "premiumTokensConsumed",
-  FRONTIER: "frontierTokensConsumed",
-};
-
-/**
- * Guard for every DB-sourced money number (M2) — finite, non-negative, sane.
- *
- * The nullish/empty check is LOAD-BEARING and must come first: `Number(null)`
- * and `Number("")` are both `0`, so a coercion-only guard would wave a NULL
- * markup column through as a legitimate 0% — the silent revenue loss M2
- * reports. A genuine numeric `0` still passes (a real 0% markup is valid).
- */
-function money(value: unknown, max: number): number | null {
-  if (value === null || value === undefined || value === "") {
-    return null;
-  }
-  const n = Number(value);
-  return Number.isFinite(n) && n >= 0 && n <= max ? n : null;
-}
-
-// ─── Pure cost math ───────────────────────────────────────────────────────────
-
-/**
- * Computes the raw provider cost for one AI call. Standard path: tokens/1e6 ×
- * rate per bucket (cached input defaults to half the input rate when the
- * model has no explicit cached rate). Extended-context path — ONLY when
- * `chargeExtendedAt2x && contextWindowSize > 200_000` — splits each token
- * bucket by the ratio of the 200K standard window to the actual context,
- * charging the extended portion at 2x. `contextWindowSize` omitted/0 skips
- * extended pricing ("don't guess").
- */
-export function calculateProviderCost(
-  inputTokensNoCacheWrite: number,
-  cacheReadTokens: number,
-  outputTokens: number,
-  pricing: ModelPricing,
-  contextWindowSize = 0,
-  chargeExtendedAt2x = false,
-): number {
-  const inputRate = pricing.inputPricePerMillion;
-  const cachedInputRate =
-    pricing.cachedInputPricePerMillion ?? pricing.inputPricePerMillion * 0.5;
-  const outputRate = pricing.outputPricePerMillion;
-
-  if (!chargeExtendedAt2x || contextWindowSize <= STANDARD_CONTEXT_WINDOW) {
-    return (
-      (inputTokensNoCacheWrite / 1_000_000) * inputRate +
-      (cacheReadTokens / 1_000_000) * cachedInputRate +
-      (outputTokens / 1_000_000) * outputRate
-    );
-  }
-
-  const standardRatio = Math.min(1, STANDARD_CONTEXT_WINDOW / contextWindowSize);
-  const extendedRatio = 1 - standardRatio;
-
-  const splitCost = (tokens: number, rate: number): number =>
-    ((tokens * standardRatio) / 1_000_000) * rate +
-    ((tokens * extendedRatio) / 1_000_000) * rate * EXTENDED_CONTEXT_MULTIPLIER;
-
-  return (
-    splitCost(inputTokensNoCacheWrite, inputRate) +
-    splitCost(cacheReadTokens, cachedInputRate) +
-    splitCost(outputTokens, outputRate)
-  );
-}
-
-// ─── Resolution helpers ───────────────────────────────────────────────────────
-
-/**
- * Most-recent active pricing row for (provider, model). Missing OR unusable
- * (a non-finite / negative / absurd rate — M2) → null, which the caller meters
- * at $0 and marks `pricing_missing` (M4). Never throws.
- */
-async function resolvePricing(
-  provider: string,
-  model: string,
-): Promise<ModelPricing | null> {
-  const now = new Date();
-  const row = await db.llmModelPricing.findFirst({
-    where: {
-      provider,
-      model,
-      effectiveFrom: { lte: now },
-      OR: [{ effectiveTo: null }, { effectiveTo: { gte: now } }],
-    },
-    orderBy: { effectiveFrom: "desc" },
-    select: {
-      inputPricePerMillion: true,
-      outputPricePerMillion: true,
-      cachedInputPricePerMillion: true,
-    },
-  });
-  if (!row) {
-    return null;
-  }
-
-  const inputPricePerMillion = money(row.inputPricePerMillion, MAX_PRICE_PER_MILLION);
-  const outputPricePerMillion = money(row.outputPricePerMillion, MAX_PRICE_PER_MILLION);
-  if (inputPricePerMillion === null || outputPricePerMillion === null) {
-    // A corrupt rate must never reach the cost math (it would write NaN/Infinity
-    // into the org's aggregate — unrecoverable). Treat as "no pricing".
-    console.warn("usage-metering: unusable pricing row", { provider, model });
-    return null;
-  }
-
-  return {
-    inputPricePerMillion,
-    outputPricePerMillion,
-    cachedInputPricePerMillion:
-      row.cachedInputPricePerMillion != null
-        ? money(row.cachedInputPricePerMillion, MAX_PRICE_PER_MILLION)
-        : null,
-  };
-}
-
-interface ResolvedModelMeta {
-  tier: ModelTier;
-  wasAutoModel: boolean;
-  chargeExtendedContextAt2x: boolean;
-}
-
-/**
- * Model catalog lookup. Unknown model → safe defaults (BASE, not auto, no
- * extended surcharge). An out-of-union `tier` on the row (the column is
- * operator-editable; the TS type is an assumption, not a guarantee) normalizes
- * to BASE rather than producing an `undefined` tier column key (M3).
- */
-async function resolveModelMetadata(
-  provider: string,
-  model: string,
-): Promise<ResolvedModelMeta> {
-  const row = await db.llmModel.findFirst({ where: { provider, model } });
-  if (!row) {
-    return { tier: "BASE", wasAutoModel: false, chargeExtendedContextAt2x: false };
-  }
-  const tier: ModelTier = row.tier in TIER_COLUMN ? row.tier : "BASE";
-  if (tier !== row.tier) {
-    console.warn("usage-metering: unknown model tier, defaulting to BASE", {
-      provider,
-      model,
-    });
-  }
-  return {
-    tier,
-    wasAutoModel: row.isAutoModel,
-    chargeExtendedContextAt2x: row.chargeExtendedContextAt2x,
-  };
-}
-
-/**
- * Hierarchical markup resolution: model-specific → provider-wide →
- * organization default → 20% system default (first VALID match wins).
- *
- * A row whose `markupPercent` is unusable — null (`Number(null) === 0`, a
- * silent 0% = lost revenue), negative (billing BELOW provider cost), NaN, or
- * absurd — is skipped, not obeyed (M2). The chain continues, terminating at
- * the 20% system default.
- */
-async function resolveMarkup(
-  organizationId: string,
-  provider: string,
-  model: string,
-): Promise<number> {
-  const candidates = [
-    { organizationId, provider, model },
-    { organizationId, provider, model: null },
-    { organizationId, provider: null, model: null },
-  ];
-
-  for (const where of candidates) {
-    const row = await db.aiMarkupConfig.findFirst({ where });
-    if (!row) {
-      continue;
-    }
-    const markupPercent = money(row.markupPercent, MAX_MARKUP_PERCENT);
-    if (markupPercent !== null) {
-      return markupPercent;
-    }
-    console.warn("usage-metering: unusable markup row, falling through", {
-      organizationId,
-      provider: where.provider,
-      model: where.model,
-    });
-  }
-
-  return SYSTEM_DEFAULT_MARKUP_PERCENT;
-}
-
-function startOfMonthUtc(date: Date): Date {
-  return new Date(Date.UTC(date.getUTCFullYear(), date.getUTCMonth(), 1));
-}
-
-function startOfNextMonthUtc(periodStart: Date): Date {
-  return new Date(
-    Date.UTC(periodStart.getUTCFullYear(), periodStart.getUTCMonth() + 1, 1),
-  );
-}
-
-/**
- * Upserts the month's tier aggregate — INSIDE the caller's transaction (H3), so
- * a failure here rolls the `UsageEvent` back with it.
- *
- * NOTE (H1/H2, deliberately unchanged): `Math.ceil(billedCostUsd * 100)` both
- * inherits IEEE-754 error (0.07 * 100 → 7.000000000000001 → 8¢) and rounds every
- * sub-cent call UP to a whole cent, which compounds into systematic overbilling.
- * The fix is a spec-level billing-fairness decision (accumulate sub-cent
- * precision, round once at invoice time) that would subsume the float fix —
- * escalated to Sam, deliberately NOT patched here (PR #3727).
- */
-async function upsertUsagePeriod(
-  tx: UsageWriteClient,
-  params: {
-    organizationId: string;
-    tier: ModelTier;
-    totalTokens: number;
-    billedCostUsd: number;
-  },
-): Promise<void> {
-  const { organizationId, tier, totalTokens, billedCostUsd } = params;
-  const periodStart = startOfMonthUtc(new Date());
-  const periodEnd = startOfNextMonthUtc(periodStart);
-  const usageSpendCents = Math.ceil(billedCostUsd * 100);
-  const tierColumn = TIER_COLUMN[tier] ?? TIER_COLUMN.BASE;
-
-  await tx.usagePeriod.upsert({
-    where: { organizationId_periodStart: { organizationId, periodStart } },
-    create: {
-      organizationId,
-      periodStart,
-      periodEnd,
-      tokensConsumed: totalTokens,
-      usageSpendCents,
-      [tierColumn]: totalTokens,
-    },
-    update: {
-      tokensConsumed: { increment: totalTokens },
-      usageSpendCents: { increment: usageSpendCents },
-      [tierColumn]: { increment: totalTokens },
-    },
-  });
-}
-
-// ─── Main export ──────────────────────────────────────────────────────────────
-
-/**
- * Records one billable AI call: validates the input, resolves model metadata +
- * pricing, computes the provider cost (incl. the extended-context surcharge),
- * resolves the hierarchical markup, then writes the `UsageEvent` (attribution
- * portions = 0 — populated later by the credit waterfall) and upserts the
- * `UsagePeriod` tier aggregate ATOMICALLY.
- *
- * Never throws. Invalid caller input → `invalid_input`; a DB failure →
- * `write_failed`. Both carry `persisted: false` — the transaction guarantees
- * nothing landed, so the caller may always retry (H3). Missing pricing does not
- * fail the call: metering never blocks on a missing rate; the event is metered
- * at $0 and marked `pricing_missing` so it can be re-priced (M4).
- */
-export async function recordUsageEvent(
-  input: RecordUsageEventInput,
-): Promise<RecordUsageResult> {
-  const parsed = recordUsageEventSchema.safeParse(input);
-  if (!parsed.success) {
-    const issue = parsed.error.issues[0];
-    const field = issue?.path.join(".") ?? "input";
-    return {
-      ok: false,
-      error: {
-        kind: "invalid_input",
-        message: `${field}: ${issue?.message ?? "invalid input"}`,
-        persisted: false,
-      },
-    };
-  }
-
-  const {
-    tenant,
-    provider,
-    model,
-    inputTokensCacheWrite = 0,
-    inputTokensNoCacheWrite,
-    cacheReadTokens = 0,
-    outputTokens,
-    thinkingTokens = 0,
-    contextWindowSize = 0,
-    completionStatus = "success",
-  } = parsed.data;
-
-  // Branded by `zTenantContext` (H5) — an `Id<"organization">`, not a bare string.
-  const organizationId = tenant.organizationId;
-
-  // Derived server-side, never caller-supplied (M1): totalTokens alone drives
-  // `tokensConsumed` + the tier column — i.e. the QUOTA surface. A caller
-  // passing `totalTokens: 0` alongside real buckets would otherwise be billed
-  // for the call while burning no quota.
-  const totalTokens =
-    inputTokensCacheWrite +
-    inputTokensNoCacheWrite +
-    cacheReadTokens +
-    outputTokens +
-    thinkingTokens;
-
-  const modelMeta = await resolveModelMetadata(provider, model);
-
-  const pricing = await resolvePricing(provider, model);
-  let providerCostUsd = 0;
-  if (pricing) {
-    providerCostUsd = calculateProviderCost(
-      inputTokensNoCacheWrite,
-      cacheReadTokens,
-      outputTokens,
-      pricing,
-      contextWindowSize,
-      modelMeta.chargeExtendedContextAt2x,
-    );
-  } else {
-    // Missing pricing never blocks metering — but it is NOT silent (M4): the
-    // event is marked so it is distinguishable from a real $0 call and can be
-    // re-priced once the pricing row is seeded. (ids/model only — no token content.)
-    console.warn("usage-metering: no active pricing found", {
-      organizationId,
-      provider,
-      model,
-    });
-  }
-
-  const markupPercent = await resolveMarkup(organizationId, provider, model);
-  const billedCostUsd = providerCostUsd * (1 + markupPercent / 100);
-
-  try {
-    // ATOMIC (H3): the event insert and the aggregate upsert are ONE unit. A
-    // failed upsert (incl. the P2002 upsert race on a fresh period) rolls the
-    // event back, so `ok: false` always means "nothing persisted" and a retry
-    // can never double-bill.
-    const eventId = await db.$transaction(async (tx) => {
-      const event = await tx.usageEvent.create({
-        data: {
-          organizationId,
-          workspaceId: tenant.workspaceId,
-          userId: tenant.userId,
-          provider,
-          model,
-          inputTokensCacheWrite,
-          inputTokensNoCacheWrite,
-          cacheReadTokens,
-          outputTokens,
-          thinkingTokens,
-          totalTokens,
-          providerCostUsd,
-          markupPercent,
-          billedCostUsd,
-          modelTier: modelMeta.tier,
-          wasAutoModel: modelMeta.wasAutoModel,
-          includedPortionCents: 0,
-          creditBalancePortionCents: 0,
-          onDemandPortionCents: 0,
-          completionStatus: pricing
-            ? completionStatus
-            : `${PRICING_MISSING_PREFIX}${completionStatus}`,
-        },
-        select: { id: true },
-      });
-
-      await upsertUsagePeriod(tx, {
-        organizationId,
-        tier: modelMeta.tier,
-        totalTokens,
-        billedCostUsd,
-      });
-
-      return event.id;
-    });
-
-    return { ok: true, eventId, billedCostUsd };
-  } catch (error) {
-    // Log the detail server-side; NEVER return it (M5). Prisma validation
-    // errors embed the full `data` argument — org/workspace/user ids and token
-    // counts — which a route could forward to an untrusted caller.
-    const detail = error instanceof Error ? error.message : String(error);
-    console.error("usage-metering: write failed", {
-      organizationId,
-      provider,
-      model,
-      detail,
-    });
-    return {
-      ok: false,
-      error: {
-        kind: "write_failed",
-        message: "usage event write failed",
-        persisted: false,
-      },
-    };
-  }
-}