feat: support account scoped ai gateway (#7979)

* feat: support account scoped ai gateway

* update dep

* fix lint: remove unnecessary optional chain on accounts

* fix package lock

* update tests

Author: kathmbeck

package-lock.json

@@ -58,7 +58,7 @@
   },
   "dependencies": {
     "@fastify/static": "9.0.0",
-    "@netlify/ai": "0.3.8",
+    "@netlify/ai": "0.4.0",
     "@netlify/api": "14.0.17",
     "@netlify/blobs": "10.7.0",
     "@netlify/build": "35.8.5",

package.json

@@ -15,15 +15,23 @@ export const devExec = async (cmd: string, options: OptionValues, command: BaseC
   const withEnvelopeEnvVars = await getEnvelopeEnv({ api, context: options.context, env: cachedConfig.env, siteInfo })
   const env = await getDotEnvVariables({ devConfig: { ...config.dev }, env: withEnvelopeEnvVars, site })
 
-  const { capabilities, siteUrl } = await getSiteInformation({
+  const { accountId, capabilities, siteUrl } = await getSiteInformation({
     offline: false,
     api,
     site,
     siteInfo,
   })
 
   if (!capabilities.aiGatewayDisabled) {
-    await setupAIGateway({ api, env, siteID: site.id, siteURL: siteUrl })
+    const resolvedAccountId = accountId ?? command.netlify.accounts[0]?.id
+    await setupAIGateway({
+      api,
+      env,
+      siteID: site.id,
+      siteURL: siteUrl,
+      accountID: resolvedAccountId,
+      siteHasDeploy: !!siteInfo.published_deploy,
+    })
 
     const aiGatewayEnv = env.AI_GATEWAY as (typeof env)[string] | undefined
     if (aiGatewayEnv) {

src/commands/dev-exec/dev-exec.ts

@@ -158,7 +158,15 @@ export const dev = async (options: OptionValues, command: BaseCommand) => {
   })
 
   if (!options.offline && !options.offlineEnv && !capabilities.aiGatewayDisabled) {
-    await setupAIGateway({ api, env, siteID: site.id, siteURL: siteUrl })
+    const resolvedAccountId = accountId ?? command.netlify.accounts[0]?.id
+    await setupAIGateway({
+      api,
+      env,
+      siteID: site.id,
+      siteURL: siteUrl,
+      accountID: resolvedAccountId,
+      siteHasDeploy: !!siteInfo.published_deploy,
+    })
 
     const aiGatewayEnv = env.AI_GATEWAY as (typeof env)[string] | undefined
     if (aiGatewayEnv) {

src/commands/dev/dev.ts

@@ -40,7 +40,15 @@ export const functionsServe = async (options: OptionValues, command: BaseCommand
   })
 
   if (!options.offline && !capabilities.aiGatewayDisabled) {
-    await setupAIGateway({ api, env, siteID: site.id, siteURL: siteUrl })
+    const resolvedAccountId = accountId ?? command.netlify.accounts[0]?.id
+    await setupAIGateway({
+      api,
+      env,
+      siteID: site.id,
+      siteURL: siteUrl,
+      accountID: resolvedAccountId,
+      siteHasDeploy: !!siteInfo.published_deploy,
+    })
   } else if (!options.offline && capabilities.aiGatewayDisabled) {
     log(`${NETLIFYDEVLOG} AI Gateway is disabled for this account`)
   }

src/commands/functions/functions-serve.ts

@@ -67,7 +67,15 @@ export const serve = async (options: OptionValues, command: BaseCommand) => {
   })
 
   if (!options.offline && !capabilities.aiGatewayDisabled) {
-    await setupAIGateway({ api, env, siteID: site.id, siteURL: siteUrl })
+    const resolvedAccountId = accountId ?? command.netlify.accounts[0]?.id
+    await setupAIGateway({
+      api,
+      env,
+      siteID: site.id,
+      siteURL: siteUrl,
+      accountID: resolvedAccountId,
+      siteHasDeploy: !!siteInfo.published_deploy,
+    })
 
     const aiGatewayEnv = env.AI_GATEWAY as (typeof env)[string] | undefined
     if (aiGatewayEnv) {

src/commands/serve/serve.ts

@@ -5,6 +5,7 @@ import { withMockApi } from '../../utils/mock-api.js'
 import { withSiteBuilder } from '../../utils/site-builder.js'
 import {
   assertAIGatewayValue,
+  createAccountScopedAIGatewayTestData,
   createAIGatewayCheckFunction,
   createAIGatewayDisabledTestData,
   createAIGatewayTestData,
@@ -263,6 +264,92 @@ describe.concurrent('AI Gateway Integration', () => {
     })
   })
 
+  test('should fall back to account-scoped token when site has no published deploy', async (t) => {
+    await withSiteBuilder(t, async (builder) => {
+      const { siteInfo, accountAIGatewayToken, routes } = createAccountScopedAIGatewayTestData()
+      const checkFunction = createAIGatewayCheckFunction()
+
+      await builder
+        .withContentFile({
+          path: checkFunction.path,
+          content: checkFunction.content,
+        })
+        .build()
+
+      await withMockApi(routes, async ({ apiUrl }) => {
+        await withDevServer(
+          {
+            cwd: builder.directory,
+            offline: false,
+            env: {
+              NETLIFY_API_URL: apiUrl,
+              NETLIFY_SITE_ID: siteInfo.id,
+              NETLIFY_AUTH_TOKEN: 'fake-token',
+            },
+          },
+          async (server) => {
+            const response = await fetch(`${server.url}${checkFunction.urlPath}`)
+            const result = (await response.json()) as { hasAIGateway: boolean; aiGatewayValue: string | null }
+
+            t.expect(response.status).toBe(200)
+            assertAIGatewayValue(t, result, accountAIGatewayToken.token, accountAIGatewayToken.url)
+          },
+        )
+      })
+    })
+  })
+
+  test('should fall back to account-scoped token when site-scoped token fails', async (t) => {
+    await withSiteBuilder(t, async (builder) => {
+      const { siteInfo: baseSiteInfo } = createAIGatewayTestData()
+      const siteInfo = { ...baseSiteInfo }
+      const checkFunction = createAIGatewayCheckFunction()
+
+      const accountAIGatewayToken = {
+        token: 'account-fallback-token-789',
+        url: 'https://ai.netlify.com/.netlify/ai/',
+      }
+
+      const routes = [
+        { path: 'sites/test-site-id', response: siteInfo },
+        { path: 'sites/test-site-id/service-instances', response: [] },
+        { path: 'accounts', response: [{ id: 'account-id-123', slug: siteInfo.account_slug }] },
+        { path: 'accounts/test-account/env', response: [] },
+        { path: 'sites/test-site-id/ai-gateway/token', status: 404, response: { message: 'Not Found' } },
+        { path: 'accounts/account-id-123/ai-gateway/token', response: accountAIGatewayToken },
+        { path: 'ai-gateway/providers', response: { providers: {} } },
+      ]
+
+      await builder
+        .withContentFile({
+          path: checkFunction.path,
+          content: checkFunction.content,
+        })
+        .build()
+
+      await withMockApi(routes, async ({ apiUrl }) => {
+        await withDevServer(
+          {
+            cwd: builder.directory,
+            offline: false,
+            env: {
+              NETLIFY_API_URL: apiUrl,
+              NETLIFY_SITE_ID: siteInfo.id,
+              NETLIFY_AUTH_TOKEN: 'fake-token',
+            },
+          },
+          async (server) => {
+            const response = await fetch(`${server.url}${checkFunction.urlPath}`)
+            const result = (await response.json()) as { hasAIGateway: boolean; aiGatewayValue: string | null }
+
+            t.expect(response.status).toBe(200)
+            assertAIGatewayValue(t, result, accountAIGatewayToken.token, accountAIGatewayToken.url)
+          },
+        )
+      })
+    })
+  })
+
   test('should work with staging environment URLs', async (t) => {
     await withSiteBuilder(t, async (builder) => {
       const { siteInfo: baseSiteInfo, aiGatewayToken: baseToken } = createAIGatewayTestData()

tests/integration/commands/dev/ai-gateway.test.ts

@@ -6,6 +6,7 @@ export const createAIGatewayTestData = () => {
     id: 'test-site-id',
     name: 'site-name',
     ssl_url: 'https://test-site.netlify.app',
+    published_deploy: { id: 'deploy-123' },
   }
 
   const aiGatewayToken = {
@@ -84,6 +85,32 @@ export const createMockApiFailureRoutes = (siteInfo: {
   { path: 'ai-gateway/providers', status: 404, response: { message: 'Not Found' } },
 ]
 
+export const createAccountScopedAIGatewayTestData = () => {
+  const siteInfo = {
+    account_slug: 'test-account',
+    id: 'test-site-id',
+    name: 'site-name',
+    ssl_url: 'https://test-site.netlify.app',
+    // No published_deploy — triggers account-scoped fallback
+  }
+
+  const accountAIGatewayToken = {
+    token: 'account-ai-gateway-token-456',
+    url: 'https://ai.netlify.com/.netlify/ai/',
+  }
+
+  const routes = [
+    { path: 'sites/test-site-id', response: siteInfo },
+    { path: 'sites/test-site-id/service-instances', response: [] },
+    { path: 'accounts', response: [{ id: 'account-id-123', slug: siteInfo.account_slug }] },
+    { path: 'accounts/test-account/env', response: [] },
+    { path: 'accounts/account-id-123/ai-gateway/token', response: accountAIGatewayToken },
+    { path: 'ai-gateway/providers', response: { providers: {} } },
+  ]
+
+  return { siteInfo, accountAIGatewayToken, routes }
+}
+
 export const createAIGatewayDisabledTestData = () => {
   const siteInfo = {
     account_slug: 'test-account',