AI Suite, Pixels & Cloud
Five AI providers reached without a single API key on a customer machine, usage metered in a two-bucket wallet the server owns, and an R2-backed cloud tier that turns a Revit model into a QR code you can scan into AR.
Security
AI proxy — zero client-side secrets
Every third-party AI request — fal.ai, Tripo3D, Hi3D, OpenRouter, Google Generative Language, World Labs — is tunnelled from the add-in to POST /api/plugin/proxy, which injects the real provider secret server-side. No provider API key ever exists on a customer machine.
The proxy enforces a host allowlist plus a per-host method-and-path allowlist. Critically, it walks redirects manually — maximum five hops — re-checking every hop and re-deriving credentials per destination host.
The credential-leak class this closed
The default fetch redirect behaviour will carry a header like x-goog-api-key straight to a redirected host. That is a real leak of a live provider secret to whatever the redirect points at. The manual walker re-derives credentials per destination instead: non-allowlisted asset CDNs are followed GET-only with no credentials, and body-bearing methods are never replayed.
The whole redirect walker is covered by behavioural tests, including one against real TLS.
Metering
The pixel economy
AI usage is metered in “pixels”, a two-bucket wallet in an ai_entitlements table: a renewing monthly allowance (pixels_per_period, rolled lazily on read — no cron job) and non-expiring one-time top-ups (pixels_topup), each floored independently so a lapsed subscription keeps its top-ups.
Every engine operation is priced server-side. spendPixels debits top-ups first, then the monthly bucket, writing an auditable pixel_ledger row; refunds are negative rows. A one-time free 70-pixel grant (ensureFreeTrialPixels, idempotent per email) lets any paying customer try the AI Suite.
The server is authoritative
The client’s cost estimates exist only to inform the user before they commit. Nothing the add-in believes about a balance can spend a pixel — which is also why the AI ribbon gate can safely fail open (see Stage 2).
Storage tier
PixyCloud
File storage for AR models and 360 panoramas lives in a Cloudflare Worker backed by R2 at files.pixyplugin.store. The server mints itself short-lived (600-second) publish-scope RS256 tokens per email, which the Worker verifies offline against the public key — so the storage tier never needs to call back into the licence server to authorise a write.
Cloud sign-in supports silent device activation (reusing the existing tool seat via the shared fingerprint), emailed OTP, and email plus password (scrypt-hashed), with scoped tokens for set-password, cloud and publish, plus a GDPR data-export endpoint. The public-facing 360 viewer and drive are a static web app gated behind this sign-in.