fix(knowledge): classify rejected BYOK embedding keys

[waleedlatif1]

Summary

• preserve customer-managed credential ownership on embedding provider errors
• record rejected BYOK keys as actionable document failures without futile automatic retries
• keep platform-owned credential failures on the existing hard-failure path

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation
• Other

Testing

• bunx vitest run background/knowledge-processing.test.ts lib/embeddings/client.test.ts lib/knowledge/documents/document-processing-source.test.ts
• bun run type-check --filter=@sim/app
• bun run lint
• bun run apps/sim/scripts/check-block-registry.ts origin/staging
• bun run check:audits

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

Screenshots/Videos

Not applicable; this change has no UI surface.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 28, 2026 8:22pm

[cubic-dev-ai]

No issues found across 7 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

_{Re-trigger cubic}

[greptile-apps]

Greptile Summary

This PR preserves embedding credential ownership on provider errors and gives rejected customer-managed keys a terminal, actionable document-processing outcome while retaining the existing hard-failure behavior for platform credentials.

• Propagates BYOK ownership through embedding API errors and quota wrappers.
• Distinguishes non-quota BYOK 401/403 responses from platform credential and quota failures.
• Persists an actionable document error and suppresses futile background retries.
• Adds coverage for ownership classification, worker outcomes, quota exclusions, and persisted failure state.

Confidence Score: 5/5

The PR appears safe to merge; the changed ownership classification and terminal retry behavior are consistent across embedding, persistence, and worker paths.

Customer-managed 401/403 failures propagate as the original typed error into actionable document handling, while platform-owned and quota failures remain on their distinct existing paths; no actionable defect remains.

Important Files Changed

Filename	Overview
apps/sim/lib/embeddings/client.ts	Propagates credential ownership into embedding errors and introduces a guarded classifier for non-quota BYOK 401/403 responses.
apps/sim/background/knowledge-processing.ts	Converts rejected customer-managed credentials into an actionable terminal worker outcome while continuing to throw platform credential failures.
apps/sim/lib/knowledge/documents/service.ts	Persists the actionable rejection message, marks the failed document terminal for automatic processing, and keeps manual retry available.
apps/sim/lib/embeddings/index.ts	Exposes the new rejection classifier and customer-facing message through the embeddings barrel.
apps/sim/background/knowledge-processing.test.ts	Covers distinct worker behavior for customer-managed and platform-owned rejected credentials.
apps/sim/lib/embeddings/client.test.ts	Covers ownership propagation and ensures quota-related BYOK responses are not treated as credential rejection.
apps/sim/lib/knowledge/documents/document-processing-source.test.ts	Verifies rejected BYOK credentials persist an actionable terminal document failure.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[Embedding request] --> B{Provider response}
    B -->|Success| C[Persist embeddings]
    B -->|Quota exhausted| D[Existing quota handling]
    B -->|401 or 403| E{Customer-managed credential?}
    E -->|Yes| F[Persist actionable document failure]
    F --> G[Stop automatic retries]
    E -->|No| H[Preserve hard-failure path]

Loading

_{Reviews (1): Last reviewed commit: "fix(knowledge): classify rejected BYOK e..." | Re-trigger Greptile}