iatoolkit 2.36.2__tar.gz → 2.40.0__tar.gz

{iatoolkit-2.36.2/src/iatoolkit.egg-info → iatoolkit-2.40.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: iatoolkit
-Version: 2.36.2
+Version: 2.40.0
 Summary: IAToolkit
 Author: Fernando Libedinsky
 License-Expression: MIT

{iatoolkit-2.36.2 → iatoolkit-2.40.0}/src/iatoolkit/__init__.py

@@ -3,7 +3,7 @@
 #
 # IAToolkit is open source software.
 
-__version__ = "2.36.2"
+__version__ = "2.40.0"
 
 # Expose main classes and functions at the top level of the package
 

iatoolkit-2.40.0/src/iatoolkit/common/bridge_validation.py

@@ -0,0 +1,39 @@
+# Copyright (c) 2024 Fernando Libedinsky
+# Product: IAToolkit
+#
+# Shared validation for the `bridge_id` that SQL sources and HTTP tools point
+# at. Lives here rather than in either service because both reference the same
+# registry and must reject the same way — a check that drifts between the two
+# is worse than no check, since the GUI would accept in one screen what it
+# refuses in the other.
+
+from iatoolkit.common.exceptions import IAToolkitException
+from iatoolkit.repositories.bridge_repo import BridgeRepo
+from iatoolkit.repositories.models import Company
+
+
+def validate_bridge_is_registered(bridge_repo: BridgeRepo, company: Company, bridge_id: str) -> None:
+    """
+    Rejects a bridge_id with no registered bridge behind it.
+
+    Worth the extra check because the failure it prevents is genuinely
+    confusing: an unregistered bridge_id used to surface only at runtime, as
+    "Bridge '<id>' is not connected" — the exact same message as a bridge that
+    is simply down. Catching it at save time separates "you typed it wrong"
+    from "your agent is offline".
+
+    Skipped entirely for companies that have no bridges registered yet: those
+    still reference bridges by API key name (the pre-registry rule), and
+    refusing to save would break configurations that work today. The check
+    turns itself on once the company is backfilled.
+    """
+    registered = bridge_repo.get_by_company(company)
+    if not registered:
+        return
+
+    if not any(b.bridge_id == bridge_id for b in registered):
+        known = ", ".join(sorted(b.bridge_id for b in registered))
+        raise IAToolkitException(
+            IAToolkitException.ErrorType.INVALID_PARAMETER,
+            f"Unknown bridge_id '{bridge_id}'. Registered bridges for this company: {known}",
+        )

{iatoolkit-2.36.2 → iatoolkit-2.40.0}/src/iatoolkit/locales/en.yaml

@@ -1,4 +1,15 @@
 # Language: English
+emails:
+  google_welcome:
+    subject: "Welcome to IAToolkit"
+    title: "Your IAToolkit account is ready"
+    greeting: "Hello {name},"
+    intro: "We created your account successfully using your Google identity."
+    account: "Sign-in account: {email}"
+    password_note: "You do not need an IAToolkit password. To sign in again, choose Sign up or continue with Google."
+    cta: "Continue to IAToolkit"
+    security_note: "If you did not create this account, contact IAToolkit support."
+
 ui:
   common:
     actions: "Actions"
@@ -318,6 +329,7 @@ ui:
   account:
     title: "My Account"
     back_to_chat: "Back to chat"
+    menu_getting_started: "Getting Started"
     menu_general: "General"
     menu_mcp_tokens: "MCP Tokens"
     general_title: "Personal settings"
@@ -566,6 +578,44 @@ ui:
     last_message_label: "Last message: {value}"
     first_reply_label: "First reply: {value}"
 
+  support:
+    title: "Support"
+    new_case: "Report an issue"
+    my_cases: "Your requests"
+    field_title: "Summary"
+    field_category: "Area"
+    field_impact: "What is happening?"
+    field_description: "What happened"
+    impact_question: "A question, nothing is broken"
+    impact_degraded: "Something fails, we can still work"
+    impact_blocked: "We cannot work"
+    category_general: "General"
+    category_connectivity: "Connectivity"
+    category_onboarding: "Setup"
+    category_billing: "Billing"
+    category_product: "Product"
+    credentials_warning: "Do not paste passwords, API keys or connection strings here."
+    submit: "Send request"
+    sending: "Sending…"
+    sent: "Request sent."
+    required: "Summary and description are required."
+    send_failed: "Could not send the request."
+    load_failed: "Could not load your requests."
+    loading: "Loading…"
+    empty: "You have not opened any requests yet."
+    col_case: "Request"
+    col_status: "Status"
+    col_opened: "Opened"
+    due: "Response by"
+    entitlement_committed_title: "Production Support active"
+    entitlement_committed_text: "Your requests carry a committed response time."
+    entitlement_standard_title: "Standard support"
+    entitlement_standard_text: "We work every request. Production Support adds a committed response time."
+    status_open: "Open"
+    status_in_progress: "In progress"
+    status_waiting_customer: "Waiting for you"
+    status_resolved: "Resolved"
+    status_closed: "Closed"
   admin:
     workspace: "Workspace"
     configuration: "Configuration"
@@ -608,6 +658,7 @@ ui:
     load_configuration_hint: "Applies configuration and refreshes runtime clients"
     load_configuration_short: "Apply"
     select_company: "Select company"
+    documentation: "Documentation"
     goto_chat: "Go to chat"
     logout: "Close session"
     error_loading: "Error loading file content"
@@ -1429,6 +1480,25 @@ ui:
     include_inactive: "Include Inactive"
     new_contract: "New Contract"
     col_cycle: "Cycle"
+    included_amount: "Included"
+    billable_amount: "Billable"
+    plan_title: "Your plan"
+    plan_platform: "Platform"
+    plan_platform_note: "{seats} users included"
+    plan_seats: "Users"
+    plan_seats_note: "{active} active this period · {amount}"
+    seat_alert_over_title: "{active} people are using {contracted} contracted seats"
+    seat_alert_over_text: "Contact us to adjust your plan."
+    seat_alert_near_title: "{remaining} seats left"
+    seat_alert_near_text: "Contact us before your team outgrows the plan."
+    plan_support: "Support"
+    plan_support_standard: "Standard"
+    plan_support_production: "Production support"
+    plan_support_included: "Included in the plan"
+    plan_credits: "Runtime credits this period"
+    plan_credits_remaining: "{amount} of included execution left"
+    plan_credits_exhausted: "Allowance used; further execution is billed"
+    plan_recurring_total: "Monthly recurring"
     col_included: "Included"
     col_grace: "Grace"
     col_markup_pct: "Markup %"
@@ -1472,6 +1542,7 @@ ui:
     sql_sources_form_connection_type: "Connection Type"
     sql_sources_form_connection_env: "Connection String Env"
     sql_sources_form_bridge_id: "Bridge ID"
+    sql_sources_form_bridge_none: "This company has no registered bridges yet. Create them in the Bridges section."
     sql_sources_form_description: "Description"
     sql_sources_form_active: "Active"
     sql_context_scope_title: "SQL Context"
@@ -1856,6 +1927,64 @@ ui:
     save_error: "Error saving API key."
     delete_error: "Error deleting API key."
 
+  bridges:
+    menu_label: "Bridges"
+    title: "Bridges"
+    subtitle: "On-premise agents connecting the company's private databases and APIs."
+    new_btn: "New Bridge"
+    search_placeholder: "Filter bridges..."
+    empty_state: "No bridges registered yet."
+    bridge_id: "Bridge ID"
+    bridge_id_placeholder: "e.g. docker-bridge"
+    bridge_id_required: "Bridge ID is required."
+    bridge_id_help: "Lowercase letters, digits and hyphens (3-64). Cannot be changed later: SQL sources and tools reference it."
+    display_name: "Name"
+    display_name_placeholder: "e.g. Production"
+    description: "Description"
+    api_key: "API Key"
+    api_key_masked: "••••••••••••"
+    api_key_help: "Set this value as IAT_BRIDGE_KEY in the bridge's .env file."
+    copy_tooltip: "Copy API key"
+    copy_success: "API key copied to clipboard."
+    copy_error: "Could not copy the API key."
+    status: "Status"
+    status_connected: "Connected"
+    status_disconnected: "Disconnected"
+    diagnose_action: "Test"
+    diagnose_title: "Connection test"
+    diagnose_intro: "Verify that the Bridge connects, reaches its database and resolves HTTP calls. Each link is reported separately."
+    diagnose_cta: "Test the connection"
+    diagnose_running: "Testing…"
+    diagnose_check_socket: "Bridge connected"
+    diagnose_check_database: "Sample database reachable"
+    diagnose_check_http: "HTTP channel working"
+    diagnose_error: "Could not run the check."
+    status_never_connected: "Never connected"
+    active: "Active"
+    inactive: "Inactive"
+    last_seen_at: "Last seen"
+    origin: "Origin"
+    agent_version: "Version"
+    capabilities: "Capabilities"
+    resources: "Exposed resources"
+    actions: "Actions"
+    create_modal_title: "Create Bridge"
+    edit_modal_title: "Edit Bridge"
+    create_success: "Bridge created. Copy the API key and configure it on the bridge."
+    update_success: "Bridge updated successfully."
+    delete_confirmation: "Delete Bridge?"
+    delete_message: "SQL sources and tools referencing it will stop working. Its API key is deleted too."
+    delete_success: "Bridge deleted successfully."
+    rotate_tooltip: "Rotate API key"
+    rotate_confirmation: "Rotate the API key?"
+    rotate_message: "A new key is issued and the old one is deleted. The bridge stays down until you update IAT_BRIDGE_KEY in its .env."
+    rotate_action: "Rotate key"
+    rotate_success: "API key rotated. Update IAT_BRIDGE_KEY on the bridge."
+    load_error: "Error loading bridges."
+    save_error: "Error saving the bridge."
+    delete_error: "Error deleting the bridge."
+    rotate_error: "Error rotating the API key."
+
   mcp_service_tokens:
     menu_label: "MCP Tokens"
     title: "MCP Tokens"
@@ -1911,7 +2040,6 @@ ui:
     tab_settings: "Settings"
     tab_access: "Access"
     tab_observability: "Observability"
-    tab_usage: "Usage"
     save_success: "MCP configuration saved successfully."
     save_error: "Could not save MCP configuration."
     preview_error: "Could not build the MCP preview."

{iatoolkit-2.36.2 → iatoolkit-2.40.0}/src/iatoolkit/locales/es.yaml

@@ -1,4 +1,15 @@
 # locales/es.yaml
+emails:
+  google_welcome:
+    subject: "Bienvenido a IAToolkit"
+    title: "Tu cuenta IAToolkit está lista"
+    greeting: "Hola {name},"
+    intro: "Creamos tu cuenta correctamente usando tu identidad de Google."
+    account: "Cuenta de acceso: {email}"
+    password_note: "No necesitas una contraseña de IAToolkit. Para volver a entrar, elige Registrarse o continuar con Google."
+    cta: "Continuar en IAToolkit"
+    security_note: "Si no realizaste este registro, contacta al soporte de IAToolkit."
+
 ui:
   common:
     actions: "Acciones"
@@ -269,6 +280,7 @@ ui:
     title: "Iniciar Sesión"
     welcome_message: "Ingresa tus credenciales o registrate para acceder a la plataforma."
     email_placeholder: "Correo electrónico"
+    password_placeholder: "Contraseña"
     login_button: "Acceder"
     google_button: "Continuar con Google"
     continue_with_google_button: "Continuar con Google"
@@ -319,6 +331,7 @@ ui:
   account:
     title: "Mi cuenta"
     back_to_chat: "Volver al chat"
+    menu_getting_started: "Primeros pasos"
     menu_general: "General"
     menu_mcp_tokens: "Tokens MCP"
     general_title: "Configuración personal"
@@ -567,6 +580,44 @@ ui:
     last_message_label: "Último mensaje: {value}"
     first_reply_label: "Primera respuesta: {value}"
 
+  support:
+    title: "Soporte"
+    new_case: "Reportar un problema"
+    my_cases: "Tus solicitudes"
+    field_title: "Resumen"
+    field_category: "Área"
+    field_impact: "¿Qué está pasando?"
+    field_description: "Qué ocurrió"
+    impact_question: "Una consulta, no hay nada roto"
+    impact_degraded: "Algo falla, podemos seguir trabajando"
+    impact_blocked: "No podemos trabajar"
+    category_general: "General"
+    category_connectivity: "Conectividad"
+    category_onboarding: "Puesta en marcha"
+    category_billing: "Facturación"
+    category_product: "Producto"
+    credentials_warning: "No pegues contraseñas, API keys ni cadenas de conexión aquí."
+    submit: "Enviar solicitud"
+    sending: "Enviando…"
+    sent: "Solicitud enviada."
+    required: "El resumen y la descripción son obligatorios."
+    send_failed: "No se pudo enviar la solicitud."
+    load_failed: "No se pudieron cargar tus solicitudes."
+    loading: "Cargando…"
+    empty: "Todavía no abriste ninguna solicitud."
+    col_case: "Solicitud"
+    col_status: "Estado"
+    col_opened: "Abierta"
+    due: "Respuesta antes de"
+    entitlement_committed_title: "Soporte Producción activo"
+    entitlement_committed_text: "Tus solicitudes tienen tiempo de respuesta comprometido."
+    entitlement_standard_title: "Soporte estándar"
+    entitlement_standard_text: "Trabajamos todas las solicitudes. Soporte Producción agrega un tiempo de respuesta comprometido."
+    status_open: "Abierta"
+    status_in_progress: "En curso"
+    status_waiting_customer: "Esperando tu respuesta"
+    status_resolved: "Resuelta"
+    status_closed: "Cerrada"
   admin:
     workspace: "Recursos"
     configuration: "Configuración"
@@ -609,8 +660,10 @@ ui:
     load_configuration_hint: "Aplica configuración y refresca clientes en runtime"
     load_configuration_short: "Aplicar"
     select_company: "Seleccionar empresa"
+    documentation: "Documentación"
     goto_chat: "Ir al chat"
     logout: "Cerrar sesión"
+    error_loading: "Error al cargar el contenido del archivo"
     add: "Agregar"
     create: "Crear"
     delete: "Borrar"
@@ -1430,6 +1483,25 @@ ui:
     include_inactive: "Incluir Inactivos"
     new_contract: "Nuevo Contrato"
     col_cycle: "Ciclo"
+    included_amount: "Incluido"
+    billable_amount: "Facturable"
+    plan_title: "Tu plan"
+    plan_platform: "Plataforma"
+    plan_platform_note: "{seats} usuarios incluidos"
+    plan_seats: "Usuarios"
+    plan_seats_note: "{active} activos en el período · {amount}"
+    seat_alert_over_title: "{active} personas están usando {contracted} asientos contratados"
+    seat_alert_over_text: "Escríbenos para ajustar tu plan."
+    seat_alert_near_title: "Te quedan {remaining} asientos"
+    seat_alert_near_text: "Escríbenos antes de que tu equipo supere el plan."
+    plan_support: "Soporte"
+    plan_support_standard: "Estándar"
+    plan_support_production: "Soporte Producción"
+    plan_support_included: "Incluido en el plan"
+    plan_credits: "Créditos de Runtime del período"
+    plan_credits_remaining: "Quedan {amount} de ejecución incluida"
+    plan_credits_exhausted: "Cupo consumido; la ejecución adicional se factura"
+    plan_recurring_total: "Recurrente mensual"
     col_included: "Incluidos"
     col_grace: "Gracia"
     col_markup_pct: "Recargo %"
@@ -1474,6 +1546,7 @@ ui:
     sql_sources_form_connection_type: "Tipo de conexión"
     sql_sources_form_connection_env: "Variable de entorno de conexión"
     sql_sources_form_bridge_id: "Bridge ID"
+    sql_sources_form_bridge_none: "Esta empresa aún no tiene bridges registrados. Créalos en la sección Bridges."
     sql_sources_form_description: "Descripción"
     sql_sources_form_active: "Activa"
     sql_context_scope_title: "Contexto SQL"
@@ -1860,6 +1933,64 @@ ui:
     save_error: "Error al guardar la API key."
     delete_error: "Error al eliminar la API key."
 
+  bridges:
+    menu_label: "Bridges"
+    title: "Bridges"
+    subtitle: "Agentes on-premise que conectan las bases de datos y APIs privadas de la empresa."
+    new_btn: "Nuevo Bridge"
+    search_placeholder: "Filtrar bridges..."
+    empty_state: "Todavía no hay bridges registrados."
+    bridge_id: "Bridge ID"
+    bridge_id_placeholder: "ej. docker-bridge"
+    bridge_id_required: "El Bridge ID es obligatorio."
+    bridge_id_help: "Minúsculas, dígitos y guiones (3-64). No se puede cambiar después: las fuentes SQL y las tools lo referencian."
+    display_name: "Nombre"
+    display_name_placeholder: "ej. Producción"
+    description: "Descripción"
+    api_key: "API Key"
+    api_key_masked: "••••••••••••"
+    api_key_help: "Configura este valor como IAT_BRIDGE_KEY en el .env del bridge."
+    copy_tooltip: "Copiar API key"
+    copy_success: "API key copiada al portapapeles."
+    copy_error: "No se pudo copiar la API key."
+    status: "Estado"
+    status_connected: "Conectado"
+    status_disconnected: "Desconectado"
+    diagnose_action: "Probar"
+    diagnose_title: "Prueba de conexión"
+    diagnose_intro: "Verifica que el Bridge conecta, alcanza su base y resuelve llamadas HTTP. Cada eslabón se reporta por separado."
+    diagnose_cta: "Probar la conexión"
+    diagnose_running: "Probando…"
+    diagnose_check_socket: "Bridge conectado"
+    diagnose_check_database: "Base de ejemplo alcanzable"
+    diagnose_check_http: "Canal HTTP operativo"
+    diagnose_error: "No se pudo ejecutar la prueba."
+    status_never_connected: "Nunca conectó"
+    active: "Activo"
+    inactive: "Inactivo"
+    last_seen_at: "Último contacto"
+    origin: "Origen"
+    agent_version: "Versión"
+    capabilities: "Capacidades"
+    resources: "Recursos expuestos"
+    actions: "Acciones"
+    create_modal_title: "Crear Bridge"
+    edit_modal_title: "Editar Bridge"
+    create_success: "Bridge creado. Copia la API key y configúrala en el bridge."
+    update_success: "Bridge actualizado correctamente."
+    delete_confirmation: "¿Eliminar Bridge?"
+    delete_message: "Las fuentes SQL y tools que lo referencien dejarán de funcionar. Su API key también se elimina."
+    delete_success: "Bridge eliminado correctamente."
+    rotate_tooltip: "Rotar API key"
+    rotate_confirmation: "¿Rotar la API key?"
+    rotate_message: "Se emite una key nueva y la anterior se elimina. El bridge queda caído hasta que actualices IAT_BRIDGE_KEY en su .env."
+    rotate_action: "Rotar key"
+    rotate_success: "API key rotada. Actualiza IAT_BRIDGE_KEY en el bridge."
+    load_error: "Error al cargar los bridges."
+    save_error: "Error al guardar el bridge."
+    delete_error: "Error al eliminar el bridge."
+    rotate_error: "Error al rotar la API key."
+
   mcp_service_tokens:
     menu_label: "Tokens MCP"
     title: "Tokens MCP"
@@ -1915,7 +2046,6 @@ ui:
     tab_settings: "Configuración"
     tab_access: "Acceso"
     tab_observability: "Observabilidad"
-    tab_usage: "Uso"
     save_success: "Configuración MCP guardada correctamente."
     save_error: "No se pudo guardar la configuración MCP."
     preview_error: "No se pudo generar la vista previa MCP."
@@ -2198,6 +2328,8 @@ ui:
     use_prompt_assistant: "Usar Asistente de Prompts"
     attach_files: "Adjuntar archivos"
     view_attached_files: "Ver archivos adjuntos"
+    send: "Enviar"
+    stop: "Detener"
   modals:
     files_title: "Archivos Cargados"
     feedback_title: "Tu Opinión es Importante"
@@ -2338,6 +2470,7 @@ rag:
 
 flash_messages:
   password_changed_success: "Tu contraseña ha sido restablecida exitosamente. Ahora puedes iniciar sesión."
+  login_required: "Por favor, inicia sesión para continuar."
   signup_success: "Registro exitoso. Por favor, revisa tu correo para verificar tu cuenta."
   signup_success_no_verification: "Registro exitoso."
   user_associated_success: "Usuario existente asociado exitosamente a la nueva empresa."

iatoolkit-2.40.0/src/iatoolkit/repositories/bridge_repo.py

@@ -0,0 +1,77 @@
+# Copyright (c) 2024 Fernando Libedinsky
+# Product: IAToolkit
+#
+# IAToolkit is open source software.
+
+from injector import inject
+
+from iatoolkit.repositories.database_manager import DatabaseManager
+from iatoolkit.repositories.models import Bridge, Company
+
+
+class BridgeRepo:
+    @inject
+    def __init__(self, db_manager: DatabaseManager):
+        self.db_manager = db_manager
+        self.session = db_manager.get_session()
+
+    def create(self, bridge: Bridge) -> Bridge:
+        self.session.add(bridge)
+        self.session.commit()
+        return bridge
+
+    def update(self, bridge: Bridge) -> Bridge:
+        self.session.add(bridge)
+        self.session.commit()
+        return bridge
+
+    def delete(self, bridge: Bridge):
+        self.session.delete(bridge)
+        self.session.commit()
+
+    def get_by_company(self, company: Company) -> list[Bridge]:
+        return (
+            self.session.query(Bridge)
+            .filter(Bridge.company_id == company.id)
+            .order_by(Bridge.bridge_id.asc())
+            .all()
+        )
+
+    def get_by_id(self, company: Company, bridge_pk: int) -> Bridge | None:
+        return (
+            self.session.query(Bridge)
+            .filter(Bridge.company_id == company.id, Bridge.id == bridge_pk)
+            .first()
+        )
+
+    def get_by_bridge_id(self, company: Company, bridge_id: str) -> Bridge | None:
+        return (
+            self.session.query(Bridge)
+            .filter(Bridge.company_id == company.id, Bridge.bridge_id == bridge_id)
+            .first()
+        )
+
+    def get_by_api_key_id(self, api_key_id: int) -> Bridge | None:
+        """
+        Resolves the bridge a connecting agent belongs to from the API key it
+        authenticated with. This is what replaces deriving the bridge identity
+        from the key's name.
+        """
+        return (
+            self.session.query(Bridge)
+            .filter(Bridge.api_key_id == api_key_id)
+            .first()
+        )
+
+    def list_all(self) -> list[tuple[Bridge, Company]]:
+        """
+        Every bridge across every company, joined with its company. Powers the
+        cross-tenant monitoring view in the hosting control center, which is
+        the one place that legitimately looks past a single company.
+        """
+        return (
+            self.session.query(Bridge, Company)
+            .join(Company, Bridge.company_id == Company.id)
+            .order_by(Company.short_name.asc(), Bridge.bridge_id.asc())
+            .all()
+        )

{iatoolkit-2.36.2 → iatoolkit-2.40.0}/src/iatoolkit/repositories/models.py

@@ -174,6 +174,11 @@ class Company(Base):
         back_populates="company",
         cascade="all, delete-orphan",
     )
+    bridges = relationship(
+        "Bridge",
+        back_populates="company",
+        cascade="all, delete-orphan",
+    )
     sql_datasets = relationship(
         "SqlDataset",
         back_populates="company",
@@ -881,6 +886,77 @@ class SqlSource(Base):
         return {column.key: getattr(self, column.key) for column in class_mapper(self.__class__).columns}
 
 
+class Bridge(Base):
+    """
+    An on-premise IAToolkit Bridge agent registered for a company.
+
+    Before this table, `bridge_id` was just the `key_name` of an API key,
+    referenced as free text from SQL sources and HTTP tools with nothing
+    linking the three. That had two costs worth remembering:
+
+      * `key_name` has no uniqueness constraint, so two companies could pick
+        the same bridge name and collide (see BridgeService's Redis key
+        helpers in iatoolkit-enterprise for how that is scoped now).
+      * A typo in a SQL source's `bridge_id` was indistinguishable at runtime
+        from a bridge that was simply down — both surfaced as
+        "Bridge '<id>' is not connected".
+
+    Identity now lives here, and the API key is a satellite pointed at by
+    `api_key_id`. That means the key can be rotated without touching
+    `bridge_id`, and renaming a key no longer breaks routing.
+
+    Columns below the identity block are runtime state, written by the
+    server as bridges connect and report in. They are denormalized here on
+    purpose: live status lives in Redis (cheap, high frequency) and is
+    flushed to this table on transitions and periodically, so that status
+    survives a worker restart and can be queried across companies for the
+    hosting control center.
+    """
+    __tablename__ = "iat_bridges"
+
+    STATUS_CONNECTED = "connected"
+    STATUS_DISCONNECTED = "disconnected"
+    STATUS_NEVER_CONNECTED = "never_connected"
+
+    id = Column(Integer, primary_key=True, autoincrement=True)
+    company_id = Column(Integer, ForeignKey(f"{ORM_SCHEMA}.iat_companies.id", ondelete="CASCADE"), nullable=False)
+
+    # Identity
+    bridge_id = Column(String, nullable=False)
+    display_name = Column(String, nullable=True)
+    description = Column(Text, nullable=True)
+    api_key_id = Column(Integer, ForeignKey(f"{ORM_SCHEMA}.iat_api_keys.id", ondelete="SET NULL"), nullable=True)
+    is_active = Column(Boolean, nullable=False, default=True)
+
+    # Runtime state
+    status = Column(String(32), nullable=False, default=STATUS_NEVER_CONNECTED)
+    last_connected_at = Column(DateTime, nullable=True)
+    last_seen_at = Column(DateTime, nullable=True)
+    last_disconnected_at = Column(DateTime, nullable=True)
+    last_disconnect_reason = Column(String, nullable=True)
+
+    # Telemetry reported by the agent
+    agent_version = Column(String, nullable=True)
+    capabilities = Column(JSON_NATIVE, nullable=False, default=list)
+    exposed_resources = Column(JSON_NATIVE, nullable=False, default=dict)
+    last_remote_addr = Column(String, nullable=True)
+
+    created_at = Column(DateTime, default=datetime.now)
+    updated_at = Column(DateTime, default=datetime.now, onupdate=datetime.now)
+
+    __table_args__ = (
+        # bridge_id is chosen by the customer, so names like "prod" are
+        # expected — unique per company, not globally.
+        UniqueConstraint("company_id", "bridge_id", name="uix_company_bridge_id"),
+    )
+
+    company = relationship("Company", back_populates="bridges")
+    api_key = relationship("ApiKey")
+
+    def to_dict(self):
+        return {column.key: getattr(self, column.key) for column in class_mapper(self.__class__).columns}
+
+
 class SqlDataset(Base):
     """
     Reusable SQL dataset definitions for pipelines and other batch features.

{iatoolkit-2.36.2 → iatoolkit-2.40.0}/src/iatoolkit/services/auth_service.py

@@ -107,6 +107,8 @@ class AuthService:
         state: str,
         nonce: str,
         redirect_uri: str,
+        lang: str | None = None,
+        welcome_url: str | None = None,
     ) -> dict:
         try:
             google_identity = self.google_auth_client.exchange_code_for_identity(
@@ -156,6 +158,8 @@ class AuthService:
         auth_response = self.profile_service.login_with_google(
             company_short_name=company_short_name,
             google_identity=google_identity,
+            lang=lang,
+            welcome_url=welcome_url,
         )
 
         if not auth_response.get('success'):

{iatoolkit-2.36.2 → iatoolkit-2.40.0}/src/iatoolkit/services/llm_client_service.py

@@ -84,6 +84,33 @@ class llmClient:
         return self._telemetry_service
 
 
+    @staticmethod
+    def _assert_runtime_not_suspended(company: Company) -> None:
+        """Refuse execution when a company's runtime spend guard is tripped.
+
+        The flag is written by whoever meters the company's consumption; this
+        layer only honours it, so nothing here knows about plans or invoices. A
+        suspended company keeps full read access — data queries and document
+        retrieval never reach a model and cost nothing — only execution stops.
+
+        This runs on the hot path of every execution, so it reads the company
+        object already in hand and never queries. It also fails open on purpose:
+        a problem reading the flag must never take a customer's operation down.
+        """
+        try:
+            parameters = getattr(company, "parameters", None) or {}
+            guard = parameters.get("runtime_guard") or {}
+            if not guard.get("suspended"):
+                return
+        except Exception:
+            return
+
+        raise IAToolkitException(
+            IAToolkitException.ErrorType.INVALID_STATE,
+            "Runtime execution is paused for this company because the monthly "
+            "spend limit was reached. Data access is unaffected.",
+        )
+
     def invoke(self,
                company: Company,
                user_identifier: str,
@@ -106,6 +133,8 @@ class llmClient:
                response_contract: Optional[Dict[str, Any]] = None
                ) -> dict:
 
+        self._assert_runtime_not_suspended(company)
+
         images = images or []
         attachments = attachments or []
         active_attachments = list(attachments)