thread_grant_ttl_seconds: nil,

  # The inference credit an account draws its threads against. Signing in is

  # what raises it: a visitor holding only a browser key gets the same figure a

  # single thread used to get, and an account with a user behind it gets $100 to

  # single thread used to get, and an account with a user behind it gets $20 to

  # spend across every thread it opens.

  account_credit_microusd: 100_000_000,

  #

  # This figure is the default a *new* account is created with, not the

  # allowance every account holds. The allowance lives on `users` as

  # `credit_allowance_microusd`, so lowering this number re-prices the next

  # signup rather than every account that already exists — the accounts created

  # while it read $100 still hold $100. `OpenAgents.Inference.Credit` reads the

  # column; only account creation reads this.

  account_credit_microusd: 20_000_000,

  visitor_credit_microusd: 2_000_000,

  inference_input_price_microusd_per_ktoken: 1_250,

  inference_output_price_microusd_per_ktoken: 10_000,

  import Ecto.Query

  alias OpenAgents.Accounts.{OAuthAttempt, TokenVault, User}

  alias OpenAgents.Inference.Credit

  alias OpenAgents.Repo

  @oauth_attempt_retention_seconds 86_400

    %User{}

    |> User.github_changeset(attributes)

    # The credit a new account is granted, written once at creation. The

    # `on_conflict` replacement list below deliberately omits it, so a sign-in

    # by an account that already exists carries its own allowance forward

    # rather than being re-granted the current figure — which is what makes

    # "new accounts get $20" different from "every account now has $20".

    |> Ecto.Changeset.put_change(

      :credit_allowance_microusd,

      Credit.new_account_allowance()

    )

    |> Repo.insert(

      on_conflict:

        {:replace,

    field :public_leaderboard_opted_out, :boolean, default: false

    field :browser_key_hash, :binary

    # The inference money this account holds, in microUSD. It is on the account

    # rather than in config because the two are not the same question: config

    # says what a new account is granted, and this says what this one holds.

    # An account created when the grant was $100 still holds $100 after the

    # grant became $20, and a later top-up is a write here rather than a new

    # subsystem.

    #

    # Only the allowance is here. Spend is still summed from the grants' own

    # `usage` by `OpenAgents.Inference.Credit.spent/1`, so this column can

    # never disagree with a spend counter — there is no spend counter.

    field :credit_allowance_microusd, :integer

    # The notification channel's address, and the proof its owner asked for it.

    # Nothing reads `notification_email` as a recipient on its own:

    # `OpenAgents.Notifications.EmailChannel.verified_address/1` is the one

          github_token_rotated_at: DateTime.t() | nil,

          public_leaderboard_opted_out: boolean(),

          browser_key_hash: binary() | nil,

          credit_allowance_microusd: non_neg_integer(),

          notification_email: String.t() | nil,

          notification_email_verified_at: DateTime.t() | nil,

          notification_email_code_digest: binary() | nil,

    SourceMembership

  }

  alias OpenAgents.Inference.Credit

  alias OpenAgents.Memories.Memory

  alias OpenAgents.Memory.SemanticDerivativeReceipt

  alias OpenAgents.{Accounts, ApiTokens, Conversations, ProfileMemory, Repo}

      {_deleted_memories, nil} =

        Repo.delete_all(from(memory in Memory, where: memory.user_id == ^user_id))

      # The visitor root carries the account's inference grants, and spend is

      # summed from those grants rather than kept in a counter — so deleting it

      # erases the record of what this account spent as well as the data it

      # asked to have removed. The allowance absorbs the difference before the

      # row goes, which leaves the account exactly the credit it had left and

      # keeps the deletion right from doubling as a way to refill it. See

      # `OpenAgents.Inference.Credit.absorb_erased_spend/2`.

      _erased_microusd = Credit.absorb_erased_spend(user_id, visitor_id)

      Repo.delete!(owner)

      {_deleted_receipts, nil} =

          "carries the objective, the terminal report, usage, and the transcript, " <>

          "so the export ledger now reaches what the deletion cascade always did."

    },

    %{

      family: :credit,

      api?: true,

      status: :portable,

      mechanism: "GET /api/v1/credit",

      proof: {:test, "test/openagents_web/controllers/credit_controller_test.exs"},

      issue: nil,

      note:

        "The account's own inference money: what it was granted, what its " <>

          "grants metered, what is left, and how much of that spend carries no " <>

          "price. One read, scoped to the caller, so the account gets the whole " <>

          "record rather than a projection of it. The grants the spend is summed " <>

          "from leave with the threads that hold them."

    },

    %{

      family: :memory,

      api?: true,

  bounded threads.

  So the credit is the account's, and a thread draws against it. Signing in is

  what buys the difference: `account_credit_microusd` for an account with a

  user behind it, `visitor_credit_microusd` for a browser that has not signed

  in. `remaining/1` is the allowance minus everything the account's grants have

  metered, and a thread is minted for exactly that, so one thread may spend the

  whole balance and the next is refused rather than handed a fresh ceiling.

  what buys the difference: an account with a user behind it holds the

  allowance recorded on that user, and a browser that has not signed in holds

  `visitor_credit_microusd`. `remaining/1` is the allowance minus everything

  the account's grants have metered, and a thread is minted for exactly that,

  so one thread may spend the whole balance and the next is refused rather than

  handed a fresh ceiling.

  The account allowance is a column rather than a constant because "what a new

  account is granted" and "what this account holds" are two questions and a

  constant can only answer one. `account_credit_microusd` in config is the

  first — the figure `new_account_allowance/0` returns and account creation

  writes onto the row. `users.credit_allowance_microusd` is the second, and it

  is what `allowance/1` reads. Lowering the config figure re-prices the next

  signup and leaves every existing account holding what it was granted.

  Spend is read from the grants themselves rather than kept in a second

  counter. `OpenAgents.Inference.record_usage/2` is the one writer of

  import Ecto.Query

  alias OpenAgents.Accounts.User

  alias OpenAgents.Conversations

  alias OpenAgents.Conversations.Visitor

  alias OpenAgents.Inference.Grant

  alias OpenAgents.Inference.Pricing

  What this account may spend in total, in microUSD.

  Signing in raises it, which is the whole point: an account with a user behind

  it holds `account_credit_microusd`, and a visitor that has only a browser key

  holds `visitor_credit_microusd`.

  it holds whatever `users.credit_allowance_microusd` records for that account,

  and a visitor that has only a browser key holds `visitor_credit_microusd`.

  The account figure is read from the row rather than from config, so two

  accounts can hold different allowances — which is what "new accounts are

  granted $20 and existing ones keep $100" means. A visitor root whose user row

  has somehow lost its allowance falls back to the visitor figure rather than

  to the new-account grant, because handing an unreadable account the current

  promotional figure is how a grant gets handed out twice.

  """

  @spec allowance(String.t()) :: non_neg_integer()

  def allowance(visitor_id) when is_binary(visitor_id) do

    if signed_in?(visitor_id), do: account_allowance(), else: visitor_allowance()

    case account_allowance(visitor_id) do

      microusd when is_integer(microusd) -> microusd

      nil -> visitor_allowance()

    end

  end

  @doc "What a signed-in account may spend in total, in microUSD."

  @spec account_allowance() :: non_neg_integer()

  def account_allowance, do: setting(:account_credit_microusd, 100_000_000)

  @doc """

  What a new account is granted, in microUSD.

  Read once, at account creation, and written onto the row. It is not what any

  particular account holds: ask `allowance/1` for that.

  """

  @spec new_account_allowance() :: non_neg_integer()

  def new_account_allowance, do: setting(:account_credit_microusd, 20_000_000)

  @doc "What a browser that has not signed in may spend in total, in microUSD."

  @spec visitor_allowance() :: non_neg_integer()

    }

  end

  defp signed_in?(visitor_id) do

    Repo.exists?(from v in Visitor, where: v.id == ^visitor_id and not is_nil(v.user_id))

  @doc """

  What this account has been granted and what it has spent of it, at once.

  One read for a client that renders a balance, and the honest shape of it:

  `remaining_microusd` alone would be a figure a reader could watch not move

  while a coder ran all day on an unpriced lane. `unpriced_calls` and

  `complete?` travel with it so the reader can tell "this account has spent

  $1.60" from "this account has spent at least nothing that anyone priced".

  """

  @spec account_credit(User.t()) :: %{

          allowance_microusd: non_neg_integer(),

          spent_microusd: non_neg_integer(),

          remaining_microusd: non_neg_integer(),

          unpriced_calls: non_neg_integer(),

          complete?: boolean()

        }

  def account_credit(%User{} = user) do

    user

    |> Conversations.ensure_owner_visitor()

    |> Map.fetch!(:id)

    |> balance()

  end

  @doc """

  Take erased spend out of the allowance, so a deletion does not refund it.

  Spend is summed from the account's grants, and those grants hang off the

  visitor root that `OpenAgents.DataRights.delete/3` removes — so the moment an

  account exercises its deletion right, `spent/1` reads zero again. The user row

  survives that deletion by design (DATA-004), which is what stops a second

  signup from being a second $20; nothing stopped the *same* row from being

  handed its whole balance back, once per deletion, for as long as the account

  cared to repeat it.

  The fix keeps the arithmetic rather than adding a counter to it: whatever the

  erased grants had metered is subtracted from the allowance, so

  `allowance - spent` is the same number a moment after the deletion as a

  moment before it. The account loses nothing it had left and recovers nothing

  it had spent.

  """

  @spec absorb_erased_spend(Ecto.UUID.t(), Ecto.UUID.t()) :: non_neg_integer()

  def absorb_erased_spend(user_id, visitor_id)

      when is_binary(user_id) and is_binary(visitor_id) do

    case spent(visitor_id) do

      0 ->

        0

      erased ->

        {1, nil} =

          Repo.update_all(

            from(user in User,

              where: user.id == ^user_id,

              update: [

                set: [

                  credit_allowance_microusd:

                    fragment("GREATEST(? - ?, 0)", user.credit_allowance_microusd, ^erased)

                ]

              ]

            ),

            []

          )

        erased

    end

  end

  defp account_allowance(visitor_id) do

    Repo.one(

      from visitor in Visitor,

        join: user in User,

        on: user.id == visitor.user_id,

        where: visitor.id == ^visitor_id,

        select: user.credit_allowance_microusd

    )

  end

  defp setting(key, default), do: Application.get_env(:openagents, key, default)

      "get /api/v1/chat/events" => {:required_bearer, :chat, :legacy},

      "post /api/v1/chat/turns" => {:required_bearer, :chat, :legacy},

      "get /api/v1/models" => {:required_bearer, :model, :envelope},

      "get /api/v1/credit" => {:required_bearer, :credit, :envelope},

      "post /api/v1/threads" => {:required_bearer, :thread, :envelope},

      "get /api/v1/threads" => {:required_bearer, :thread, :envelope},

      "get /api/v1/threads/:thread_id" => {:required_bearer, :thread, :envelope},

    }

  end

  # The two allowances a caller can be minted against. A thread's

  # `max_cost_microusd` is whichever of these applies minus what the account

  # has already spent, so publishing the allowance describes the balance while

  # publishing a per-thread number would describe nothing.

  # The two figures a caller can be minted against. A thread's

  # `max_cost_microusd` is whichever applies minus what the account has already

  # spent, so publishing them describes the balance while publishing a

  # per-thread number would describe nothing.

  #

  # `account_microusd` is what a *new* account is granted, not what every

  # account holds: the allowance is recorded per account, so one created while

  # the grant was larger still holds the larger figure. A caller that needs its

  # own number reads `GET /api/v1/credit`, which is the only place the account's

  # own allowance, spend, and remainder are stated.

  defp credit_allowances do

    %{

      "account_microusd" => Credit.account_allowance(),

      "account_microusd" => Credit.new_account_allowance(),

      "visitor_microusd" => Credit.visitor_allowance(),

      "description" =>

        "A signed-in account draws against `account_microusd` and an " <>

          "anonymous visitor against `visitor_microusd`, for the life of the " <>

          "account rather than per thread. A thread's grant is minted for the " <>

        "`account_microusd` is the credit a newly created account is granted " <>

          "and `visitor_microusd` is what an anonymous visitor holds, for the " <>

          "life of the account rather than per thread. An account's allowance " <>

          "is recorded on the account, so an older one may hold more than " <>

          "`account_microusd`: read `GET /api/v1/credit` for the caller's own " <>

          "allowance, spend, and remainder. A thread's grant is minted for the " <>

          "remainder, so `grant.max_cost_microusd` in the mint response is " <>

          "what is left rather than a fixed cap.",

      "unpriced_lanes" =>

defmodule OpenAgentsWeb.CreditController do

  @moduledoc """

  `GET /api/v1/credit`: the inference money this account holds and has spent.

  The coder renders a balance from this rather than adding up what it saw,

  because what a turn spent is decided by the server that priced it: a client

  that kept its own total would be reporting one session's tokens as an

  account's spend, and would show the same figure to a second terminal that had

  already spent it.

  Four numbers and a flag, and the flag is the point. `remaining_microusd` is a

  ceiling rather than a balance while any of the account's calls landed on a

  model this deployment declares no rates for: an unpriced call records no

  cost, so it draws nothing down and the remainder does not move. `complete` is

  false exactly then, and `unpriced_calls` says how many calls the figure

  cannot see. A client that renders `remaining_microusd` without reading

  `complete` is a client that will show a full balance beside a session that

  spent all day (METER-001).

  """

  use OpenAgentsWeb, :controller

  alias OpenAgents.Inference.Credit

  def show(conn, _params) do

    credit = Credit.account_credit(conn.assigns.current_user)

    json(conn, %{

      "credit" => %{

        "allowance_microusd" => credit.allowance_microusd,

        "spent_microusd" => credit.spent_microusd,

        "remaining_microusd" => credit.remaining_microusd,

        "unpriced_calls" => credit.unpriced_calls,

        "complete" => credit.complete?

      }

    })

  end

end

    # the thread scope because it names what a thread grant can be minted for.

    get "/models", ModelCatalogController, :index

    # What a thread is minted against. Same scope for the same reason: the

    # caller who can open a thread is the caller who reads what is left to

    # open one with.

    get "/credit", CreditController, :show

    post "/threads", ThreadController, :create

    post "/traces", TraceController, :create

    get "/threads", ThreadController, :index

    20260825220000,

    20260825230000,

    20260826010000,

    20260826103000

    20260826103000,

    20260826145554

  ],

  "required_tables": [

    "users",

defmodule OpenAgents.Repo.Migrations.GrantNewAccountsTwentyDollarsOfCredit do

  use Ecto.Migration

  @moduledoc """

  Move the account inference allowance from a config constant onto the account.

  The allowance used to be `account_credit_microusd`, read per request for

  every signed-in account alike. That constant cannot tell a new account from

  an existing one, so lowering it to $20 would not have granted new users $20 —

  it would have re-priced every account that already held $100, and put any

  account that had already metered more than $20 out of credit in the same

  deploy.

  So the figure moves onto `users`. The config constant stays as the default a

  new row is created with, and this column is the truth for an account that

  exists. Nothing else about the credit changes: spend is still summed from the

  grants' own `usage`, so there is still no second counter to disagree with a

  ledger.

  The backfill is the part worth reading. Every row that exists when this runs

  is by definition an existing account, and the decision is that existing

  accounts keep $100 — so the column is added nullable, every existing row is

  written to 100_000_000 explicitly, and only then does it become `NOT NULL`

  with the new-account default. Adding it with the default in one step would

  have written $20 across every existing account, which is the one outcome this

  change must not produce.

  """

  # $100, the allowance every account held before this migration ran.

  @existing_account_microusd 100_000_000

  # $20, the allowance a row created after this migration is granted. It

  # matches `:account_credit_microusd` in config, which is what

  # `OpenAgents.Inference.Credit.new_account_allowance/0` reads at insert time.

  # This default is the database's backstop for a row inserted by some other

  # path, not a second source of the figure.

  @new_account_microusd 20_000_000

  def up do

    alter table(:users) do

      add :credit_allowance_microusd, :bigint

    end

    execute("""

    UPDATE users

       SET credit_allowance_microusd = #{@existing_account_microusd}

     WHERE credit_allowance_microusd IS NULL

    """)

    alter table(:users) do

      modify :credit_allowance_microusd, :bigint,

        null: false,

        default: @new_account_microusd

    end

    create constraint(:users, :users_credit_allowance_nonnegative,

             check: "credit_allowance_microusd >= 0"

           )

  end

  def down do

    drop constraint(:users, :users_credit_allowance_nonnegative)

    alter table(:users) do

      remove :credit_allowance_microusd

    end

  end

end

  use OpenAgents.DataCase, async: false

  import Ecto.Query

  import OpenAgentsWeb.ConnCase, only: [github_user: 1]

  alias OpenAgents.Accounts.User

  alias OpenAgents.Conversations

  alias OpenAgents.Conversations.Visitor

  alias OpenAgents.DataRights

  alias OpenAgents.Inference

  alias OpenAgents.Inference.Credit

  alias OpenAgents.Repo

  alias OpenAgents.Threads

  defp account(key) do

             Application.fetch_env!(:openagents, :account_credit_microusd)

  end

  # The allowance moved off the config constant and onto the account, so that

  # "a new account is granted $20" could stop meaning "every account is now

  # capped at $20". These three tests are what that distinction rests on.

  describe "the allowance is the account's own" do

    test "a new account is created holding the configured new-account grant" do

      user = github_user("credit-new-account")

      assert user.credit_allowance_microusd == Credit.new_account_allowance()

      assert Credit.allowance(Conversations.ensure_owner_visitor(user).id) ==

               Credit.new_account_allowance()

    end

    test "an account holding more than the current grant keeps it" do

      user = github_user("credit-grandfathered")

      owner = Conversations.ensure_owner_visitor(user)

      # What an account created before the grant was lowered looks like. The

      # migration writes exactly this figure across every row that already

      # existed; here it is set directly so the read is what is under test.

      {1, nil} =

        Repo.update_all(

          from(u in User, where: u.id == ^user.id),

          set: [credit_allowance_microusd: 100_000_000]

        )

      assert Credit.allowance(owner.id) == 100_000_000

      refute Credit.allowance(owner.id) == Credit.new_account_allowance()

      assert Credit.remaining(owner.id) == 100_000_000

    end

    test "signing in again does not re-grant the credit" do

      user = github_user("credit-returning")

      owner = Conversations.ensure_owner_visitor(user)

      {1, nil} =

        Repo.update_all(

          from(u in User, where: u.id == ^user.id),

          set: [credit_allowance_microusd: 3_000_000]

        )

      # `github_user/1` is the upsert the OAuth callback runs, so this is a

      # second sign-in by the same GitHub identity. It must not hand the

      # account the new-account figure again.

      same_user = github_user("credit-returning")

      assert same_user.id == user.id

      assert same_user.credit_allowance_microusd == 3_000_000

      assert Credit.allowance(owner.id) == 3_000_000

    end

  end

  # One GitHub identity holds one credited account: `users.github_id` carries a

  # unique index, so a second signup on the same identity is the same row. The

  # hole that leaves is deletion — `DataRights.delete/3` erases the visitor root

  # the account's grants hang off, and spend is summed from those grants. The

  # user row survives (DATA-004), so the allowance survives with it; without

  # this, everything the account had spent would come back.

  describe "deleting product data does not refund spend" do

    test "the allowance absorbs what the erased grants had metered" do

      user = github_user("credit-deletion")

      owner = Conversations.ensure_owner_visitor(user)

      {:ok, _metered} =

        Inference.record_usage(minted(owner.id), %{

          "output_tokens" => output_tokens_costing(4_000_000)

        })

      granted = Credit.allowance(owner.id)

      assert Credit.spent(owner.id) == 4_000_000

      left = Credit.remaining(owner.id)

      assert left == granted - 4_000_000

      {:ok, conversation} = Conversations.ensure_conversation(user)

      conversation_owner = Conversations.get_conversation_owner!(conversation)

      assert {:ok, :deleted} = DataRights.delete(user, conversation_owner, conversation)

      # A fresh visitor root, so the erased grants are gone and `spent/1` reads

      # zero again. What is left has to be the same number it was.

      next = Conversations.ensure_owner_visitor(Repo.get!(User, user.id))

      refute next.id == conversation_owner.id

      assert Credit.spent(next.id) == 0

      assert Credit.allowance(next.id) == granted - 4_000_000

      assert Credit.remaining(next.id) == left

    end

    test "an account that spent nothing keeps its whole allowance" do

      user = github_user("credit-deletion-unspent")

      granted = Credit.allowance(Conversations.ensure_owner_visitor(user).id)

      {:ok, conversation} = Conversations.ensure_conversation(user)

      conversation_owner = Conversations.get_conversation_owner!(conversation)

      assert {:ok, :deleted} = DataRights.delete(user, conversation_owner, conversation)

      next = Conversations.ensure_owner_visitor(Repo.get!(User, user.id))

      assert Credit.allowance(next.id) == granted

    end

  end

  test "a visitor that has not signed in holds the visitor credit" do

    assert Credit.allowance(visitor("anonymous")) ==

             Application.fetch_env!(:openagents, :visitor_credit_microusd)

defmodule OpenAgents.Repo.CreditAllowanceBackfillTest do

  @moduledoc """

  The migration that moved the account allowance onto `users`, run for real.

  Everything else about this change is safe to get wrong twice. This is not:

  the allowance went from $100 for every account to $20 for a new one, and a

  migration that wrote the new figure across the rows that already existed

  would have silently re-priced every live account and put any that had metered

  more than $20 out of credit in the same deploy.

  So the backfill is not asserted here, it is executed. The migration is rolled

  back so the rows under test are genuinely pre-migration rows — the column does

  not exist while they sit there — and then run forward again. What the test

  reads afterwards is what the migration wrote.

  It runs inside the sandbox transaction the case checks out. PostgreSQL makes

  DDL transactional, so the column disappearing and reappearing is invisible to

  every other connection and is rolled back with the rest of the test.

  """

  use OpenAgents.DataCase, async: false

  alias Ecto.Adapters.SQL

  alias OpenAgents.Repo.Migrations.GrantNewAccountsTwentyDollarsOfCredit, as: Migration

  @version 20_260_826_145_554

  # Migrations are not on the compile path, so the module is loaded from the

  # file the repository will actually run. Found by its version rather than by

  # a hard-coded name, so renaming the file fails this test instead of quietly

  # leaving it testing nothing.

  setup_all do

    [path] = Path.wildcard("priv/repo/migrations/#{@version}_*.exs")

    Code.require_file(path)

    :ok

  end

  # $100. Written out rather than read from the migration, because a test that

  # asks the code under test what the right answer is proves only that it is

  # self-consistent.

  @existing_account_microusd 100_000_000

  # $20, the figure config carries for a new account.

  @new_account_microusd 20_000_000

  defp insert_user(login) do

    id = Ecto.UUID.generate()

    SQL.query!(

      Repo,

      """

      INSERT INTO users

        (id, github_id, github_login, github_avatar_url, status, inserted_at, updated_at)

      VALUES ($1, $2, $3, $4, 'active', NOW(), NOW())

      """,

      [

        Ecto.UUID.dump!(id),

        :erlang.phash2(login, 1_000_000) + 1,

        login,

        "https://avatars.githubusercontent.com/u/1?v=4"

      ]

    )

    id

  end

  defp allowance_of(id) do

    %{rows: [[allowance]]} =

      SQL.query!(

        Repo,

        "SELECT credit_allowance_microusd FROM users WHERE id = $1",

        [Ecto.UUID.dump!(id)]

      )

    allowance

  end

  defp column_exists? do

    %{rows: [[count]]} =

      SQL.query!(

        Repo,

        """

        SELECT COUNT(*) FROM information_schema.columns

         WHERE table_name = 'users' AND column_name = 'credit_allowance_microusd'

        """,

        []

      )

    count == 1

  end

  test "every account that existed before the migration keeps $100" do

    veterans = Enum.map(1..3, &insert_user("veteran-#{&1}"))

    # Down first: the rows above become rows from before this change existed,

    # with no allowance recorded anywhere, which is the only state the backfill

    # is claimed to handle.

    :ok = Ecto.Migrator.down(Repo, @version, Migration, log: false, migration_lock: false)

    refute column_exists?()

    :ok = Ecto.Migrator.up(Repo, @version, Migration, log: false, migration_lock: false)

    assert column_exists?()

    for id <- veterans do

      assert allowance_of(id) == @existing_account_microusd

    end

  end

  test "an account created after the migration is granted $20" do

    :ok = Ecto.Migrator.down(Repo, @version, Migration, log: false, migration_lock: false)

    :ok = Ecto.Migrator.up(Repo, @version, Migration, log: false, migration_lock: false)

    # Inserted through raw SQL, so the figure comes from the column default the

    # migration installed rather than from anything the application chose.

    fresh = insert_user("post-migration")

    assert allowance_of(fresh) == @new_account_microusd

  end

  test "the migration does not lower an account that already holds $100" do

    # The realistic double-run: a deploy that migrates, an account that keeps

    # its grandfathered figure, and a rollback-and-forward afterwards. The

    # second pass must not treat $100 as a value to overwrite — it writes only

    # where nothing is recorded.

    veteran = insert_user("twice-migrated")

    :ok = Ecto.Migrator.down(Repo, @version, Migration, log: false, migration_lock: false)

    :ok = Ecto.Migrator.up(Repo, @version, Migration, log: false, migration_lock: false)

    assert allowance_of(veteran) == @existing_account_microusd

    :ok = Ecto.Migrator.down(Repo, @version, Migration, log: false, migration_lock: false)

    :ok = Ecto.Migrator.up(Repo, @version, Migration, log: false, migration_lock: false)

    assert allowance_of(veteran) == @existing_account_microusd

  end

  test "an allowance cannot be driven below zero" do

    veteran = insert_user("floor")

    assert_raise Postgrex.Error, fn ->

      SQL.query!(

        Repo,

        "UPDATE users SET credit_allowance_microusd = -1 WHERE id = $1",

        [Ecto.UUID.dump!(veteran)]

      )

    end

  end

end

    # The cost figure is the account's credit rather than a per-thread cap, so

    # the document publishes the allowances and the mint reports the remainder.

    refute Map.has_key?(limits["grant"], "max_cost_microusd")

    assert limits["credit"]["account_microusd"] == Credit.account_allowance()

    # The published figure is what a new account is granted. It is no longer

    # what every account holds — the allowance is recorded per account — and

    # the document says so, pointing a caller at `GET /api/v1/credit` for its

    # own.

    assert limits["credit"]["account_microusd"] == Credit.new_account_allowance()

    assert limits["credit"]["description"] =~ "GET /api/v1/credit"

    assert limits["credit"]["visitor_microusd"] == Credit.visitor_allowance()

    created =

defmodule OpenAgentsWeb.CreditControllerTest do

  @moduledoc """

  `GET /api/v1/credit`: what the coder's status bar reads.

  The reason this endpoint exists, rather than a client keeping its own total,

  is that spend is the server's: it prices the call, and a second terminal on

  the same account spends the same money. The reason it carries `complete` is

  METER-001 — an unpriced call records no cost, so the remainder does not move,

  and a client that rendered the remainder alone would show a full balance

  beside a session that had run all day.

  """

  use OpenAgentsWeb.ConnCase, async: false

  import Ecto.Query

  alias OpenAgents.Accounts.User

  alias OpenAgents.Conversations

  alias OpenAgents.Conversations.Visitor

  alias OpenAgents.Inference

  alias OpenAgents.Inference.Credit

  alias OpenAgents.Repo

  alias OpenAgents.Threads

  # `put_chat_api_token/2` mints the token for this account, so naming the key

  # the same way is how a test reaches the user behind the credential it sent.

  defp account(key), do: github_user("api-token-" <> key)

  defp output_tokens_costing(microusd) do

    div(

      microusd * 1_000,

      Application.fetch_env!(:openagents, :inference_output_price_microusd_per_ktoken)

    )

  end

  defp minted(visitor_id) do

    {:ok, thread} = Threads.open(%Visitor{id: visitor_id}, "spend some credit")

    {:ok, _fenced, grant, _token} = Threads.mint_grant(thread)

    grant

  end

  test "a new account reads its whole grant, with nothing unseen", %{conn: conn} do

    body =

      conn

      |> put_chat_api_token("credit-fresh")

      |> get(~p"/api/v1/credit")

      |> json_response(200)

    assert body["credit"]["allowance_microusd"] == Credit.new_account_allowance()

    assert body["credit"]["spent_microusd"] == 0

    assert body["credit"]["remaining_microusd"] == Credit.new_account_allowance()

    assert body["credit"]["unpriced_calls"] == 0

    assert body["credit"]["complete"] == true

  end

  test "priced spend comes off the remainder", %{conn: conn} do

    owner = "credit-spent" |> account() |> Conversations.ensure_owner_visitor()

    {:ok, _metered} =

      Inference.record_usage(minted(owner.id), %{

        "output_tokens" => output_tokens_costing(1_600_000)

      })

    body =

      conn

      |> put_chat_api_token("credit-spent")

      |> get(~p"/api/v1/credit")

      |> json_response(200)

    assert body["credit"]["spent_microusd"] == 1_600_000

    assert body["credit"]["remaining_microusd"] ==

             Credit.new_account_allowance() - 1_600_000

    assert body["credit"]["complete"] == true

  end

  # The path the coder's own lane is on today. The figure does not move, and

  # the response has to say why rather than leave the client to discover it.

  test "an unpriced call leaves the remainder still and says so", %{conn: conn} do

    owner = "credit-unpriced" |> account() |> Conversations.ensure_owner_visitor()

    luna = Application.fetch_env!(:openagents, :openai_model)

    {:ok, thread} = Threads.open(%Visitor{id: owner.id}, "Run the unpriced lane", model: luna)

    {:ok, _fenced, grant, _token} = Threads.mint_grant(thread)

    {:ok, _metered} = Inference.record_usage(grant, %{"output_tokens" => 500_000})

    body =

      conn

      |> put_chat_api_token("credit-unpriced")

      |> get(~p"/api/v1/credit")

      |> json_response(200)

    assert body["credit"]["spent_microusd"] == 0

    assert body["credit"]["remaining_microusd"] == Credit.new_account_allowance()

    assert body["credit"]["unpriced_calls"] == 1

    assert body["credit"]["complete"] == false

  end

  test "an account holding a grandfathered allowance reads its own figure", %{conn: conn} do

    user = account("credit-grandfathered-api")

    {1, nil} =

      Repo.update_all(

        from(u in User, where: u.id == ^user.id),

        set: [credit_allowance_microusd: 100_000_000]

      )

    body =

      conn

      |> put_chat_api_token("credit-grandfathered-api")

      |> get(~p"/api/v1/credit")

      |> json_response(200)

    assert body["credit"]["allowance_microusd"] == 100_000_000

    assert body["credit"]["remaining_microusd"] == 100_000_000

  end

  test "an anonymous caller is refused rather than shown an account", %{conn: conn} do

    assert conn |> get(~p"/api/v1/credit") |> json_response(401)

  end

end

        |> json_response(402)

      assert body["code"] == "credit_exhausted"

      assert body["message"] =~ "$100.00"

      # The account's own allowance, not a deployment-wide figure: it is

      # recorded per account, so the refusal names what this one was granted.

      # Read from the same source the refusal reads, because a hard-coded

      # dollar amount here would go red the next time the grant changes without

      # anything being wrong.

      granted = "$#{:erlang.float_to_binary(allowance / 1_000_000, decimals: 2)}"

      assert body["message"] =~ granted

      assert [message] = body["errors"]["credit"]

      assert message =~ "$100.00"

      assert message =~ granted

    end

    test "the cap counts one account's threads, never another's", %{conn: conn} do

             "the installer still claims it installs oa only"

    end

  end

  # Pull one shell function out of the installer so a test can run the real

  # thing rather than a restatement of it.

  defp extract_function(script, name) do

    script

    |> String.split("\n")

    |> Enum.drop_while(&(!String.starts_with?(&1, "#{name}() {")))

    |> Enum.take_while(&(&1 != "}"))

    |> Kernel.++(["}"])

    |> Enum.join("\n")

  end

  # The ERE the installer greps the shell rc file with.

  defp shadow_pattern(script) do

    [_, pattern] = Regex.run(~r/grep -Eqs '([^']+)'/, script)

    pattern

  end

end