stack-auth · N2D4 · Apr 15, 2026 · Mar 10, 2026 · Mar 10, 2026 · Mar 10, 2026
diff --git a/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts b/apps/backend/src/app/api/latest/ai/query/[mode]/route.ts
@@ -5,6 +5,7 @@ import { getTools, validateToolNames } from "@/lib/ai/tools";
 import { listManagedProjectIds } from "@/lib/projects";
 import { SmartResponse } from "@/route-handlers/smart-response";
 import { createSmartRouteHandler } from "@/route-handlers/smart-route-handler";
+import { validateImageAttachments } from "@stackframe/stack-shared/dist/ai/image-limits";
 import { yupMixed, yupObject, yupString } from "@stackframe/stack-shared/dist/schema-fields";
 import { StatusError } from "@stackframe/stack-shared/dist/utils/errors";
 import { Json } from "@stackframe/stack-shared/dist/utils/json";
@@ -31,7 +32,6 @@ export const POST = createSmartRouteHandler({
     const isAuthenticated = fullReq.auth != null;
     const { quality, speed, systemPrompt: systemPromptId, tools: toolNames, messages, projectId } = body;
 
-    // Verify user has access to the target project
     if (projectId != null) {
       if (fullReq.auth?.project.id !== "internal") {
         throw new StatusError(StatusError.Forbidden, "You do not have access to this project");
@@ -46,12 +46,31 @@ export const POST = createSmartRouteHandler({
       }
     }
 
+    const imageValidationResult = validateImageAttachments(messages);
+    if (!imageValidationResult.ok) {
+      throw new StatusError(StatusError.BadRequest, imageValidationResult.reason);
+    }
+
     const model = selectModel(quality, speed, isAuthenticated);
     const systemPrompt = getFullSystemPrompt(systemPromptId);
     const tools = await getTools(toolNames, { auth: fullReq.auth, targetProjectId: projectId });
     const toolsArg = Object.keys(tools).length > 0 ? tools : undefined;
     const isDocsOrSearch = systemPromptId === "docs-ask-ai" || systemPromptId === "command-center-ask-ai";
-    const stepLimit = toolsArg == null ? 1 : isDocsOrSearch ? 50 : 5;
+    // create-dashboard now does an inspection loop (queryAnalytics) before calling updateDashboard,
+    // so it needs room for ~3 exploratory queries + the final tool call + some retry slack.
+    const isCreateDashboard = systemPromptId === "create-dashboard";
+    // build-analytics-query aims for one-shot queries with complete schema
+    // knowledge, but needs a few steps for retries on errors or follow-ups.
+    const isBuildAnalyticsQuery = systemPromptId === "build-analytics-query";
+    const stepLimit = toolsArg == null
+      ? 1
+      : isDocsOrSearch
+        ? 50
+        : isCreateDashboard
+          ? 12
+          : isBuildAnalyticsQuery
+            ? 5
+            : 5;
 
     if (mode === "stream") {
       const result = streamText({

diff --git a/apps/backend/src/app/api/latest/internal/metrics/route.test.ts b/apps/backend/src/app/api/latest/internal/metrics/route.test.ts
@@ -0,0 +1,20 @@
+import { describe, expect, it } from "vitest";
+import { getMetricsWindowBounds, isMetricsRevenueInvoiceStatus } from "./route";
+
+describe("internal metrics helpers", () => {
+  it("only counts paid and succeeded invoices as revenue", () => {
+    expect(isMetricsRevenueInvoiceStatus("paid")).toBe(true);
+    expect(isMetricsRevenueInvoiceStatus("succeeded")).toBe(true);
+    expect(isMetricsRevenueInvoiceStatus("failed")).toBe(false);
+    expect(isMetricsRevenueInvoiceStatus("uncollectible")).toBe(false);
+    expect(isMetricsRevenueInvoiceStatus(null)).toBe(false);
+  });
+
+  it("derives a single UTC-aligned rolling window from one clock", () => {
+    const { todayUtc, since, untilExclusive } = getMetricsWindowBounds(new Date("2026-04-13T23:59:59.999Z"));
+
+    expect(todayUtc.toISOString()).toBe("2026-04-13T00:00:00.000Z");
+    expect(since.toISOString()).toBe("2026-03-14T00:00:00.000Z");
+    expect(untilExclusive.toISOString()).toBe("2026-04-14T00:00:00.000Z");
+  });
+});