@agent-native/core 0.187.0 → 0.187.1-nightly-20260925003003

package/dist/client/observability/OutputPreview.js

@@ -5,6 +5,10 @@ const MAX_ANSWER_LENGTH = 20_000;
 const MAX_COLUMNS = 8;
 const MAX_ROWS = 24;
 const MAX_MARKDOWN_LINES = MAX_ROWS * 2 + 2;
+const DESIGN_HOST_ORIGIN = "https://design.agent-native.com";
+const BETA_DESIGN_HOST_ORIGIN = "https://beta.design.agent-native.com";
+const DESIGN_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9_-]{0,127}$/;
+const DESIGN_URL_PATTERN = /(?:^|[\s([{<"'=])((?:https?:\/\/[^\s<>"'`]+|\/design\/[A-Za-z0-9_-]+(?:[?#][^\s<>"'`]*)?))/gm;
 const REBINDING_DNS_SUFFIXES = [
     "nip.io",
     "sslip.io",
@@ -79,6 +83,40 @@ function safeImageUrl(value) {
     }
     return undefined;
 }
+function safeDesignPreviewUrl(value, baseOrigin) {
+    const candidate = boundedString(value);
+    if (!candidate || candidate.startsWith("//"))
+        return undefined;
+    try {
+        const baseUrl = baseOrigin ? new URL(baseOrigin) : undefined;
+        const url = new URL(candidate, baseUrl);
+        const sameOrigin = baseUrl?.origin === url.origin;
+        if (url.username ||
+            url.password ||
+            (url.origin !== DESIGN_HOST_ORIGIN &&
+                url.origin !== BETA_DESIGN_HOST_ORIGIN &&
+                !sameOrigin)) {
+            return undefined;
+        }
+        const match = url.pathname.match(/^\/design\/([A-Za-z0-9][A-Za-z0-9_-]{0,127})$/);
+        if (!match || !DESIGN_ID_PATTERN.test(match[1]))
+            return undefined;
+        return new URL(`/present/${match[1]}?reviewEmbed=1`, url.origin).toString();
+        // coercion-ok: malformed untrusted design URLs are intentionally rejected.
+    }
+    catch {
+        return undefined;
+    }
+}
+function findDesignPreviewUrl(text, baseOrigin) {
+    for (const match of text.matchAll(DESIGN_URL_PATTERN)) {
+        const candidate = match[1].replace(/[),.;!?]+$/, "");
+        const previewUrl = safeDesignPreviewUrl(candidate, baseOrigin);
+        if (previewUrl)
+            return previewUrl;
+    }
+    return undefined;
+}
 function splitTableRow(line) {
     return line
         .trim()
@@ -115,7 +153,7 @@ function parseMarkdownTable(answer) {
     }
     return undefined;
 }
-function parseStructuredPreview(value) {
+function parseStructuredPreview(value, baseOrigin) {
     if (!isRecord(value))
         return undefined;
     const type = boundedString(value.type)?.toLowerCase();
@@ -204,6 +242,7 @@ function parseStructuredPreview(value) {
     }
     if (type === "design") {
         const imageUrl = safeImageUrl(value.imageUrl ?? value.image);
+        const previewUrl = safeDesignPreviewUrl(value.url ?? value.urlPath ?? value.designUrl, baseOrigin);
         const tokens = Array.isArray(value.tokens)
             ? value.tokens.slice(0, MAX_COLUMNS).flatMap((token) => {
                 if (!isRecord(token))
@@ -215,13 +254,15 @@ function parseStructuredPreview(value) {
             : [];
         const title = boundedString(value.title);
         const summary = boundedString(value.summary);
-        if (imageUrl || tokens.length > 0 || title || summary) {
-            return { kind: "design", title, summary, imageUrl, tokens };
+        if (imageUrl || previewUrl || tokens.length > 0 || title || summary) {
+            return { kind: "design", title, summary, imageUrl, previewUrl, tokens };
         }
     }
     return undefined;
 }
-export function parseOutputPreview(answer) {
+export function parseOutputPreview(answer, baseOrigin = typeof window === "undefined"
+    ? undefined
+    : window.location.origin) {
     const text = answer.trim();
     if (!text)
         return { kind: "text", text: "-" };
@@ -230,7 +271,7 @@ export function parseOutputPreview(answer) {
     }
     const jsonText = text.replace(/^```(?:json)?\s*/i, "").replace(/\s*```$/, "");
     try {
-        const structured = parseStructuredPreview(JSON.parse(jsonText));
+        const structured = parseStructuredPreview(JSON.parse(jsonText), baseOrigin);
         if (structured)
             return structured;
         // coercion-ok: non-JSON answers intentionally use the text fallback.
@@ -238,6 +279,14 @@ export function parseOutputPreview(answer) {
     catch {
         // Plain text and Markdown outputs are expected and remain the fallback.
     }
+    const previewUrl = findDesignPreviewUrl(text, baseOrigin);
+    if (previewUrl) {
+        return {
+            kind: "design",
+            previewUrl,
+            tokens: [],
+        };
+    }
     const imageMatch = text.match(/!\[([^\]]*)\]\((https?:\/\/[^)\s]+)\)/i);
     const imageUrl = imageMatch ? safeImageUrl(imageMatch[2]) : undefined;
     if (imageUrl) {
@@ -251,6 +300,13 @@ export function parseOutputPreview(answer) {
 }
 export function OutputPreview({ answer, previewLabel, inlineApp, inlineAppTitle, compact = false, maxAppHeight, }) {
     const preview = parseOutputPreview(answer);
+    if (preview.kind === "design" && preview.previewUrl) {
+        return (_jsx("div", { "aria-label": preview.title ?? previewLabel, className: compact
+                ? "relative size-full overflow-hidden bg-background"
+                : "relative aspect-[16/10] w-full max-w-full overflow-hidden bg-background", "data-preview-kind": compact ? "design-iframe-thumbnail" : "design-iframe", role: "img", children: _jsx("iframe", { "aria-hidden": "true", className: compact
+                    ? "pointer-events-none absolute left-0 top-0 h-[600%] w-[600%] origin-top-left scale-[0.166667] border-0"
+                    : "absolute inset-0 size-full border-0", loading: "lazy", referrerPolicy: "no-referrer", src: preview.previewUrl, tabIndex: -1, title: preview.title ?? previewLabel }) }));
+    }
     if (inlineApp && !compact) {
         return (_jsxs("div", { className: "min-w-0 space-y-4", children: [answer.trim() && preview.kind === "text" && (_jsx(OutputPreview, { answer: answer, previewLabel: previewLabel })), _jsx(McpAppRenderer, { app: inlineApp, readOnly: true, className: "min-w-0", maxHeight: maxAppHeight })] }));
     }
@@ -292,8 +348,9 @@ export function OutputPreview({ answer, previewLabel, inlineApp, inlineAppTitle,
             return (_jsx("img", { src: preview.imageUrl, alt: preview.title ?? previewLabel, className: "size-full object-cover", "data-preview-kind": "design-thumbnail", loading: "lazy", referrerPolicy: "no-referrer" }));
         }
         if (compact) {
-            return (_jsxs("div", { "aria-label": [preview.title, preview.summary].filter(Boolean).join(": ") ||
-                    previewLabel, className: "size-full overflow-hidden p-2", "data-preview-kind": "design-thumbnail", role: "img", children: [_jsx("span", { className: "block h-1 w-1/3 rounded-full bg-primary/80" }), _jsx("span", { className: "mt-2 block h-2 w-3/4 rounded-full bg-foreground/20" }), _jsx("span", { className: "mt-1.5 block h-1.5 w-1/2 rounded-full bg-muted-foreground/20" }), _jsx("span", { className: "mt-2 flex gap-1", children: preview.tokens.slice(0, 4).map((token) => (_jsx("span", { className: "size-3 rounded-full bg-primary/40" }, `${token.label}-${token.value}`))) })] }));
+            return (_jsx("div", { "aria-label": [preview.title, preview.summary].filter(Boolean).join(": ") ||
+                    previewLabel, className: "size-full overflow-hidden p-2", "data-preview-kind": "design-thumbnail", role: "img", children: _jsx("span", { className: "line-clamp-3 block text-left text-[10px] leading-3 text-muted-foreground", children: [preview.title, preview.summary].filter(Boolean).join(" — ") ||
+                        previewLabel }) }));
         }
         return (_jsxs("div", { className: contentClassName, "data-preview-kind": "design", children: [preview.imageUrl && (_jsx("img", { src: preview.imageUrl, alt: preview.title ?? previewLabel, className: "mb-3 max-h-72 w-full rounded object-cover", loading: "lazy", referrerPolicy: "no-referrer" })), preview.title && _jsx("div", { className: "font-medium", children: preview.title }), preview.summary && (_jsx("p", { className: "mt-1 text-xs text-muted-foreground", children: preview.summary })), preview.tokens.length > 0 && (_jsx("dl", { className: "mt-3 divide-y divide-border/70", children: preview.tokens.map((token) => (_jsxs("div", { className: "flex flex-wrap justify-between gap-x-4 gap-y-1 py-2 first:pt-0", children: [_jsx("dt", { className: "text-xs text-muted-foreground", children: token.label }), _jsx("dd", { className: "text-xs", children: token.value })] }, `${token.label}-${token.value}`))) }))] }));
     }

package/dist/client/observability/useObservability.d.ts

@@ -1,5 +1,5 @@
 import type { AgentMcpAppPayload } from "../../mcp-client/app-result.js";
-import type { InstructionUpdate, OutputReviewListRow } from "../../observability/types.js";
+import type { InstructionUpdate, OutputReviewDetail, OutputReviewListRow } from "../../observability/types.js";
 export interface ObservabilityOverview {
     totalRuns: number;
     totalCostCents: number;
@@ -28,6 +28,7 @@ export interface TraceSummary {
 export declare function useTraces(sinceDays?: number, limit?: number): import("@tanstack/react-query").UseQueryResult<NoInfer<TraceSummary[]>, Error>;
 export declare function useOutputReviews(sinceDays?: number, limit?: number): import("@tanstack/react-query").UseQueryResult<NoInfer<OutputReviewListRow[]>, Error>;
 export declare function useOutputReviewApp(runId: string | null): import("@tanstack/react-query").UseQueryResult<NoInfer<AgentMcpAppPayload | null>, Error>;
+export declare function useOutputReviewDetail(runId: string | null): import("@tanstack/react-query").UseQueryResult<NoInfer<OutputReviewDetail>, Error>;
 export declare function useSaveInstructionUpdate(): import("@tanstack/react-query").UseMutationResult<InstructionUpdate, Error, {
     runId: string;
     threadId?: string | null;

package/dist/client/observability/useObservability.js

@@ -31,11 +31,15 @@ export function useOutputReviews(sinceDays = 7, limit = 100) {
         sinceMs: Date.now() - sinceDays * 86_400_000,
         limit,
     }), [sinceDays, limit]);
-    return useActionQuery("list-observability-reviews", params, { refetchInterval: 30_000 });
+    const query = useActionQuery("list-observability-reviews", params, { refetchInterval: 30_000 });
+    return query;
 }
 export function useOutputReviewApp(runId) {
     return useActionQuery("get-observability-review-app", { runId: runId ?? "" }, { enabled: runId !== null, gcTime: 0 });
 }
+export function useOutputReviewDetail(runId) {
+    return useActionQuery("get-observability-review-detail", { runId: runId ?? "" }, { enabled: runId !== null, gcTime: 0 });
+}
 export function useSaveInstructionUpdate() {
     return useActionMutation("save-observability-instruction-update");
 }

package/dist/client/settings/UsageSection.js

@@ -8,6 +8,7 @@ import { Select, SelectContent, SelectItem, SelectTrigger, SelectValue, } from "
 import { IconArrowUpRight, IconBell, IconChartLine, IconChevronDown, IconLoader2, IconMail, IconPencil, IconPlus, IconRefresh, IconUsers, IconX, } from "@tabler/icons-react";
 import { useState } from "react";
 import { Link } from "react-router";
+import { useT } from "../i18n.js";
 import { useActionMutation, useActionQuery } from "../use-action.js";
 const LOOKBACKS = [
     { value: 7, label: "7d" },
@@ -33,13 +34,53 @@ function compactNumber(value) {
         return `${(value / 1_000).toFixed(1)}K`;
     return Math.round(value).toLocaleString();
 }
-function formatCost(cents, billing) {
-    if (billing.unit === "builder-credits") {
-        const credits = (cents / 100) *
+function usageAmount(cents, billing, builderCredits, estimatedBuilderCredits) {
+    if (billing.unit !== "usd") {
+        if (typeof builderCredits === "number" ||
+            typeof estimatedBuilderCredits === "number") {
+            return (builderCredits ?? 0) + (estimatedBuilderCredits ?? 0);
+        }
+        if (billing.unit === "mixed")
+            return 0;
+        return ((cents / 100) *
             (billing.hardCostMarginMultiplier ?? 1.25) *
-            (billing.creditsPerUsd ?? 20);
-        return `${credits.toLocaleString(undefined, { maximumFractionDigits: 1 })} credits`;
+            (billing.creditsPerUsd ?? 20));
     }
+    return cents;
+}
+function formatCost(t, cents, billing, builderCredits, estimatedBuilderCredits, otherCostCents, includeOtherUsd = true) {
+    if (billing.unit !== "usd") {
+        const parts = [];
+        const actual = builderCredits ?? 0;
+        const estimated = estimatedBuilderCredits ??
+            (typeof builderCredits === "number" || billing.unit === "mixed"
+                ? 0
+                : usageAmount(cents, billing));
+        if (actual > 0) {
+            parts.push(`${actual.toLocaleString(undefined, { maximumFractionDigits: 3 })} ${t("agentChat.usage.builderCredits", { defaultValue: "Builder credits" })}`);
+        }
+        if (estimated > 0) {
+            parts.push(t("agentChat.usage.estimatedBuilderCredits", {
+                defaultValue: "~{{amount}} estimated credits",
+                amount: estimated.toLocaleString(undefined, {
+                    maximumFractionDigits: 3,
+                }),
+            }));
+        }
+        if (includeOtherUsd && otherCostCents && otherCostCents > 0) {
+            parts.push(t("agentChat.usage.otherUsdSpend", {
+                defaultValue: "{{amount}} other USD",
+                amount: formatUsdCost(otherCostCents),
+            }));
+        }
+        return (parts.join(" · ") ||
+            t("agentChat.usage.noBuilderCredits", {
+                defaultValue: "0 Builder credits",
+            }));
+    }
+    return formatUsdCost(cents);
+}
+function formatUsdCost(cents) {
     if (cents < 100)
         return `${cents.toFixed(2)}¢`;
     return `$${(cents / 100).toLocaleString(undefined, {
@@ -69,11 +110,7 @@ function Trend({ daily, billing, }) {
     if (daily.length === 0) {
         return (_jsx("div", { className: "flex h-32 items-center justify-center rounded-lg border border-dashed border-border/70 text-sm text-muted-foreground", children: "No usage recorded in this lookback." }));
     }
-    const values = daily.map((day) => billing.unit === "builder-credits"
-        ? (day.costCents / 100) *
-            (billing.hardCostMarginMultiplier ?? 1.25) *
-            (billing.creditsPerUsd ?? 20)
-        : day.costCents);
+    const values = daily.map((day) => usageAmount(day.costCents, billing, day.builderCredits, day.estimatedBuilderCredits));
     const max = Math.max(...values, 0.01);
     const points = values.map((value, index) => {
         const x = daily.length === 1 ? 50 : (index / (daily.length - 1)) * 100;
@@ -90,17 +127,38 @@ function MetricCard({ label, value, detail, accent = false, }) {
     return (_jsxs("div", { className: "min-w-0 rounded-lg border border-border/70 bg-card px-4 py-4", children: [_jsx("div", { className: "text-xs font-medium text-muted-foreground", children: label }), _jsx("div", { className: `mt-1 truncate text-xl font-semibold tracking-[-0.02em] tabular-nums ${accent ? "text-primary" : "text-foreground"}`, children: value }), _jsx("div", { className: "mt-1 truncate text-xs text-muted-foreground", children: detail })] }));
 }
 function DriverList({ title, rows, billing, }) {
-    const max = Math.max(...rows.map((row) => row.costCents), 1);
-    return (_jsxs("div", { children: [_jsxs("div", { className: "mb-3 flex items-center justify-between gap-3", children: [_jsx("h3", { className: "text-sm font-semibold text-foreground", children: title }), _jsx("span", { className: "text-[11px] uppercase tracking-[0.08em] text-muted-foreground", children: "Spend" })] }), rows.length === 0 ? (_jsx("p", { className: "text-sm text-muted-foreground", children: "No usage recorded yet." })) : (_jsx("div", { className: "space-y-3", children: rows.slice(0, 5).map((row) => (_jsxs("div", { children: [_jsxs("div", { className: "flex items-center justify-between gap-3 text-sm", children: [_jsx("span", { className: "min-w-0 truncate text-foreground", title: row.label, children: row.label }), _jsx("span", { className: "shrink-0 tabular-nums text-muted-foreground", children: formatCost(row.costCents, billing) })] }), _jsx("div", { className: "mt-1.5 h-1 overflow-hidden rounded-full bg-muted", children: _jsx("div", { className: "h-full rounded-full bg-primary/70", style: {
-                                    width: `${Math.max(4, (row.costCents / max) * 100)}%`,
-                                } }) })] }, row.key))) }))] }));
+    const t = useT();
+    const max = Math.max(...rows.map((row) => usageAmount(row.costCents, billing, row.builderCredits, row.estimatedBuilderCredits)), 1);
+    const maxOtherUsd = Math.max(...rows.map((row) => row.otherCostCents ?? 0), 1);
+    return (_jsxs("div", { children: [_jsxs("div", { className: "mb-3 flex items-center justify-between gap-3", children: [_jsx("h3", { className: "text-sm font-semibold text-foreground", children: title }), _jsx("span", { className: "text-[11px] uppercase tracking-[0.08em] text-muted-foreground", children: billing.unit === "mixed"
+                            ? t("agentChat.usage.driverCreditsAndUsd", {
+                                defaultValue: "Builder credits / USD",
+                            })
+                            : billing.unit === "builder-credits"
+                                ? t("agentChat.usage.builderCredits", {
+                                    defaultValue: "Builder credits",
+                                })
+                                : "Spend" })] }), rows.length === 0 ? (_jsx("p", { className: "text-sm text-muted-foreground", children: "No usage recorded yet." })) : (_jsx("div", { className: "space-y-3", children: rows.slice(0, 5).map((row) => {
+                    const builderAmount = usageAmount(row.costCents, billing, row.builderCredits, row.estimatedBuilderCredits);
+                    const otherOnly = billing.unit === "mixed" && builderAmount === 0;
+                    const amount = otherOnly
+                        ? (row.otherCostCents ?? 0)
+                        : builderAmount;
+                    const scale = otherOnly ? maxOtherUsd : max;
+                    return (_jsxs("div", { children: [_jsxs("div", { className: "flex items-center justify-between gap-3 text-sm", children: [_jsx("span", { className: "min-w-0 truncate text-foreground", title: row.label, children: row.label }), _jsx("span", { className: "shrink-0 tabular-nums text-muted-foreground", children: formatCost(t, row.costCents, billing, row.builderCredits, row.estimatedBuilderCredits, row.otherCostCents) })] }), _jsx("div", { className: "mt-1.5 h-1 overflow-hidden rounded-full bg-muted", children: amount > 0 ? (_jsx("div", { className: "h-full rounded-full bg-primary/70", style: {
+                                        width: `${Math.max(4, (amount / scale) * 100)}%`,
+                                    } })) : null })] }, row.key));
+                }) }))] }));
 }
 function UsageLoadingState() {
     return (_jsxs("div", { className: "space-y-5", role: "status", "aria-label": "Loading usage", children: [_jsx("div", { className: "grid gap-3 sm:grid-cols-3", children: ["w-24", "w-16", "w-20"].map((width) => (_jsxs("div", { className: "rounded-lg border border-border/70 p-4", children: [_jsx(Skeleton, { className: `h-3 ${width}` }), _jsx(Skeleton, { className: "mt-3 h-6 w-24" }), _jsx(Skeleton, { className: "mt-2 h-3 w-28" })] }, width))) }), _jsxs("div", { className: "rounded-lg border border-border/70 p-4", children: [_jsx(Skeleton, { className: "h-4 w-32" }), _jsx(Skeleton, { className: "mt-3 h-32 w-full" })] })] }));
 }
 function AlertEditor({ draft, onChange, onSave, onCancel, isPending, }) {
+    const t = useT();
     const channelCount = Number(draft.inApp) + Number(draft.email);
-    return (_jsxs("div", { className: "mt-3 rounded-lg border border-border/70 bg-muted/20 p-3", children: [_jsxs("div", { className: "grid gap-3 sm:grid-cols-[1fr_1fr_1fr]", children: [_jsxs("label", { className: "space-y-1.5 text-xs text-muted-foreground", children: [_jsx("span", { children: "Unit" }), _jsxs(Select, { value: draft.unit, onValueChange: (value) => onChange({ unit: value }), children: [_jsx(SelectTrigger, { className: "h-9 bg-background text-sm", children: _jsx(SelectValue, {}) }), _jsxs(SelectContent, { children: [_jsx(SelectItem, { value: "usd", children: "Dollars" }), _jsx(SelectItem, { value: "builder-credits", children: "Builder credits" }), _jsx(SelectItem, { value: "tokens", children: "Tokens" })] })] })] }), _jsxs("label", { className: "space-y-1.5 text-xs text-muted-foreground", children: [_jsx("span", { children: "Threshold" }), _jsx(Input, { type: "number", min: "0.01", step: draft.unit === "tokens" ? "1" : "0.01", value: draft.limit, onChange: (event) => onChange({ limit: event.target.value }), className: "h-9 bg-background text-sm" })] }), _jsxs("label", { className: "space-y-1.5 text-xs text-muted-foreground", children: [_jsx("span", { children: "Window" }), _jsxs(Select, { value: draft.period, onValueChange: (value) => onChange({ period: value }), children: [_jsx(SelectTrigger, { className: "h-9 bg-background text-sm", children: _jsx(SelectValue, {}) }), _jsxs(SelectContent, { children: [_jsx(SelectItem, { value: "day", children: "Per day" }), _jsx(SelectItem, { value: "month", children: "Per month" })] })] })] })] }), _jsxs("div", { className: "mt-3 flex flex-wrap items-center gap-4 text-xs text-muted-foreground", children: [_jsx("span", { className: "font-medium text-foreground", children: "Deliver via" }), _jsxs("label", { className: "inline-flex items-center gap-2", children: [_jsx(Checkbox, { checked: draft.inApp, onCheckedChange: (checked) => onChange({ inApp: checked === true }) }), _jsx(IconBell, { className: "size-3.5" }), " In app"] }), _jsxs("label", { className: "inline-flex items-center gap-2", children: [_jsx(Checkbox, { checked: draft.email, onCheckedChange: (checked) => onChange({ email: checked === true }) }), _jsx(IconMail, { className: "size-3.5" }), " Email"] }), _jsxs("div", { className: "ms-auto flex items-center gap-2", children: [_jsx(Button, { type: "button", variant: "ghost", size: "sm", onClick: onCancel, children: "Cancel" }), _jsxs(Button, { type: "button", size: "sm", onClick: onSave, disabled: isPending || channelCount === 0, children: [isPending ? _jsx(IconLoader2, { className: "animate-spin" }) : null, "Save alert"] })] })] })] }));
+    return (_jsxs("div", { className: "mt-3 rounded-lg border border-border/70 bg-muted/20 p-3", children: [_jsxs("div", { className: "grid gap-3 sm:grid-cols-[1fr_1fr_1fr]", children: [_jsxs("label", { className: "space-y-1.5 text-xs text-muted-foreground", children: [_jsx("span", { children: "Unit" }), _jsxs(Select, { value: draft.unit, onValueChange: (value) => onChange({ unit: value }), children: [_jsx(SelectTrigger, { className: "h-9 bg-background text-sm", children: _jsx(SelectValue, {}) }), _jsxs(SelectContent, { children: [_jsx(SelectItem, { value: "usd", children: "Dollars" }), _jsx(SelectItem, { value: "builder-credits", children: t("agentChat.usage.builderCredits", {
+                                                    defaultValue: "Builder credits",
+                                                }) }), _jsx(SelectItem, { value: "tokens", children: "Tokens" })] })] })] }), _jsxs("label", { className: "space-y-1.5 text-xs text-muted-foreground", children: [_jsx("span", { children: "Threshold" }), _jsx(Input, { type: "number", min: "0.01", step: draft.unit === "tokens" ? "1" : "0.01", value: draft.limit, onChange: (event) => onChange({ limit: event.target.value }), className: "h-9 bg-background text-sm" })] }), _jsxs("label", { className: "space-y-1.5 text-xs text-muted-foreground", children: [_jsx("span", { children: "Window" }), _jsxs(Select, { value: draft.period, onValueChange: (value) => onChange({ period: value }), children: [_jsx(SelectTrigger, { className: "h-9 bg-background text-sm", children: _jsx(SelectValue, {}) }), _jsxs(SelectContent, { children: [_jsx(SelectItem, { value: "day", children: "Per day" }), _jsx(SelectItem, { value: "month", children: "Per month" })] })] })] })] }), _jsxs("div", { className: "mt-3 flex flex-wrap items-center gap-4 text-xs text-muted-foreground", children: [_jsx("span", { className: "font-medium text-foreground", children: "Deliver via" }), _jsxs("label", { className: "inline-flex items-center gap-2", children: [_jsx(Checkbox, { checked: draft.inApp, onCheckedChange: (checked) => onChange({ inApp: checked === true }) }), _jsx(IconBell, { className: "size-3.5" }), " In app"] }), _jsxs("label", { className: "inline-flex items-center gap-2", children: [_jsx(Checkbox, { checked: draft.email, onCheckedChange: (checked) => onChange({ email: checked === true }) }), _jsx(IconMail, { className: "size-3.5" }), " Email"] }), _jsxs("div", { className: "ms-auto flex items-center gap-2", children: [_jsx(Button, { type: "button", variant: "ghost", size: "sm", onClick: onCancel, children: "Cancel" }), _jsxs(Button, { type: "button", size: "sm", onClick: onSave, disabled: isPending || channelCount === 0, children: [isPending ? _jsx(IconLoader2, { className: "animate-spin" }) : null, "Save alert"] })] })] })] }));
 }
 function UsageAlertsSection({ appId }) {
     const query = useActionQuery("get-usage-alerts", {
@@ -176,6 +234,7 @@ function UsageAlertsSection({ appId }) {
                     }), editing && !editing.ruleId ? (_jsxs("div", { className: "px-4 py-4", children: [_jsx("div", { className: "mb-2 text-xs font-medium text-muted-foreground", children: appLabel(editing.appId) }), _jsx(AlertEditor, { draft: editing, onChange: (patch) => setEditing((current) => current ? { ...current, ...patch } : current), onSave: saveDraft, onCancel: () => setEditing(null), isPending: mutation.isPending })] })) : null] })] }));
 }
 export function UsageSection({ appId = null, viewAllHref, }) {
+    const t = useT();
     const [sinceDays, setSinceDays] = useState(30);
     const [scope, setScope] = useState("me");
     const [selectedUserEmail, setSelectedUserEmail] = useState(null);
@@ -199,8 +258,37 @@ export function UsageSection({ appId = null, viewAllHref, }) {
     return (_jsxs("div", { className: "mx-auto w-full max-w-5xl space-y-6", children: [_jsxs("header", { className: "flex flex-col gap-4 border-b border-border/70 pb-5 lg:flex-row lg:items-end lg:justify-between", children: [_jsxs("div", { children: [_jsxs("div", { className: "flex items-center gap-2 text-xs font-medium uppercase tracking-[0.1em] text-primary", children: [_jsx(IconChartLine, { className: "size-4" }), " Usage"] }), _jsxs("h1", { className: "mt-2 text-xl font-semibold tracking-[-0.02em] text-foreground", children: [appLabel(appId), " usage"] }), _jsx("p", { className: "mt-1 max-w-xl text-sm leading-6 text-muted-foreground", children: "A focused view of spend, capacity, and the prompts driving this app." })] }), _jsxs("div", { className: "flex flex-wrap items-center gap-2", children: [data?.access.canViewWorkspace ? (_jsxs(Select, { value: scope, onValueChange: (value) => {
                                     setScope(value);
                                     setSelectedUserEmail(null);
-                                }, children: [_jsx(SelectTrigger, { className: "h-9 w-32 text-xs", children: _jsx(SelectValue, {}) }), _jsxs(SelectContent, { children: [_jsx(SelectItem, { value: "me", children: "My usage" }), _jsx(SelectItem, { value: "workspace", children: "Workspace" })] })] })) : null, scope === "workspace" && data ? (_jsxs(Select, { value: selectedUserEmail ?? "all", onValueChange: (value) => setSelectedUserEmail(value === "all" ? null : value), children: [_jsx(SelectTrigger, { className: "h-9 w-44 text-xs", children: _jsx(SelectValue, { placeholder: "All users" }) }), _jsxs(SelectContent, { children: [_jsx(SelectItem, { value: "all", children: "All users" }), data.availableUsers.map((user) => (_jsx(SelectItem, { value: user.email, children: user.email }, user.email)))] })] })) : null, _jsx("div", { className: "flex items-center rounded-md border border-border/70 p-0.5", children: LOOKBACKS.map((range) => (_jsx(Button, { type: "button", variant: sinceDays === range.value ? "secondary" : "ghost", size: "sm", className: "h-8 px-2.5 text-xs", onClick: () => setSinceDays(range.value), children: range.label }, range.value))) }), _jsx(Button, { type: "button", variant: "outline", size: "icon", onClick: () => void query.refetch(), disabled: query.isFetching, "aria-label": "Refresh usage", title: "Refresh usage", children: query.isFetching ? (_jsx(IconLoader2, { className: "animate-spin" })) : (_jsx(IconRefresh, {})) })] })] }), query.isError && !data ? (_jsxs("div", { className: "rounded-lg border border-destructive/30 bg-destructive/5 px-4 py-4 text-sm", role: "alert", children: [_jsx("div", { className: "font-medium text-destructive", children: "Usage data couldn\u2019t be loaded." }), _jsx(Button, { type: "button", variant: "link", size: "sm", className: "mt-1 h-auto p-0", onClick: () => void query.refetch(), children: "Try again" })] })) : null, !data && query.isLoading ? _jsx(UsageLoadingState, {}) : null, data ? (_jsxs(_Fragment, { children: [_jsxs("div", { className: "grid gap-3 sm:grid-cols-3", children: [_jsx(MetricCard, { label: billing.label, value: formatCost(data.totals.costCents, billing), detail: `${sinceDays} day lookback`, accent: true }), _jsx(MetricCard, { label: "Calls", value: data.totals.calls.toLocaleString(), detail: `${data.currentDay.calls.toLocaleString()} today` }), _jsx(MetricCard, { label: "Tokens", value: compactNumber(totalTokens), detail: `${compactNumber(data.currentDay.tokens)} today` })] }), _jsxs("section", { className: "rounded-lg border border-border/70 bg-card p-4", children: [_jsxs("div", { className: "flex flex-wrap items-start justify-between gap-3", children: [_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold text-foreground", children: "Daily trend" }), _jsxs("p", { className: "mt-1 text-xs text-muted-foreground", children: [formatCost(data.currentDay.costCents, billing), " used today \u00B7", " ", data.currentDay.calls.toLocaleString(), " calls"] })] }), _jsxs("div", { className: "flex items-center gap-1.5 text-xs text-muted-foreground", children: [scope === "workspace" ? (_jsx(IconUsers, { className: "size-3.5" })) : null, scope === "workspace"
+                                }, children: [_jsx(SelectTrigger, { className: "h-9 w-32 text-xs", children: _jsx(SelectValue, {}) }), _jsxs(SelectContent, { children: [_jsx(SelectItem, { value: "me", children: "My usage" }), _jsx(SelectItem, { value: "workspace", children: "Workspace" })] })] })) : null, scope === "workspace" && data ? (_jsxs(Select, { value: selectedUserEmail ?? "all", onValueChange: (value) => setSelectedUserEmail(value === "all" ? null : value), children: [_jsx(SelectTrigger, { className: "h-9 w-44 text-xs", children: _jsx(SelectValue, { placeholder: "All users" }) }), _jsxs(SelectContent, { children: [_jsx(SelectItem, { value: "all", children: "All users" }), data.availableUsers.map((user) => (_jsx(SelectItem, { value: user.email, children: user.email }, user.email)))] })] })) : null, _jsx("div", { className: "flex items-center rounded-md border border-border/70 p-0.5", children: LOOKBACKS.map((range) => (_jsx(Button, { type: "button", variant: sinceDays === range.value ? "secondary" : "ghost", size: "sm", className: "h-8 px-2.5 text-xs", onClick: () => setSinceDays(range.value), children: range.label }, range.value))) }), _jsx(Button, { type: "button", variant: "outline", size: "icon", onClick: () => void query.refetch(), disabled: query.isFetching, "aria-label": "Refresh usage", title: "Refresh usage", children: query.isFetching ? (_jsx(IconLoader2, { className: "animate-spin" })) : (_jsx(IconRefresh, {})) })] })] }), query.isError && !data ? (_jsxs("div", { className: "rounded-lg border border-destructive/30 bg-destructive/5 px-4 py-4 text-sm", role: "alert", children: [_jsx("div", { className: "font-medium text-destructive", children: "Usage data couldn\u2019t be loaded." }), _jsx(Button, { type: "button", variant: "link", size: "sm", className: "mt-1 h-auto p-0", onClick: () => void query.refetch(), children: "Try again" })] })) : null, !data && query.isLoading ? _jsx(UsageLoadingState, {}) : null, data ? (_jsxs(_Fragment, { children: [_jsxs("div", { className: `grid gap-3 ${billing.unit === "mixed" ? "sm:grid-cols-2 xl:grid-cols-4" : "sm:grid-cols-3"}`, children: [_jsx(MetricCard, { label: billing.unit === "builder-credits"
+                                    ? t("agentChat.usage.builderCredits", {
+                                        defaultValue: "Builder credits",
+                                    })
+                                    : billing.unit === "mixed"
+                                        ? t("agentChat.usage.builderCredits", {
+                                            defaultValue: "Builder credits",
+                                        })
+                                        : billing.label, value: formatCost(t, data.totals.costCents, billing, data.totals.builderCredits, data.totals.estimatedBuilderCredits, data.totals.otherCostCents, false), detail: `${sinceDays} day lookback`, accent: true }), billing.unit === "mixed" ? (_jsx(MetricCard, { label: t("agentChat.usage.otherUnclassifiedSpend", {
+                                    defaultValue: "Other or unclassified USD spend",
+                                }), value: formatUsdCost(data.totals.otherCostCents ?? 0), detail: t("agentChat.usage.providerSpendDetail", {
+                                    defaultValue: "Provider or older calls outside Builder billing",
+                                }) })) : null, _jsx(MetricCard, { label: "Calls", value: data.totals.calls.toLocaleString(), detail: `${data.currentDay.calls.toLocaleString()} today` }), _jsx(MetricCard, { label: "Tokens", value: compactNumber(totalTokens), detail: `${compactNumber(data.currentDay.tokens)} today` })] }), _jsxs("section", { className: "rounded-lg border border-border/70 bg-card p-4", children: [_jsxs("div", { className: "flex flex-wrap items-start justify-between gap-3", children: [_jsxs("div", { children: [_jsx("h2", { className: "text-sm font-semibold text-foreground", children: "Daily trend" }), _jsxs("p", { className: "mt-1 text-xs text-muted-foreground", children: [formatCost(t, data.currentDay.costCents, billing, data.currentDay.credits, data.currentDay.estimatedBuilderCredits, data.currentDay.otherCostCents, false), " ", "used today \u00B7 ", data.currentDay.calls.toLocaleString(), " calls"] }), billing.unit === "mixed" &&
+                                                (data.currentDay.otherCalls ?? 0) > 0 ? (_jsx("p", { className: "mt-1 text-xs text-muted-foreground", children: t("agentChat.usage.providerSpendToday", {
+                                                    defaultValue: "Other or unclassified usage: {{amount}} today",
+                                                    amount: formatUsdCost(data.currentDay.otherCostCents ?? 0),
+                                                }) })) : null] }), _jsxs("div", { className: "flex items-center gap-1.5 text-xs text-muted-foreground", children: [scope === "workspace" ? (_jsx(IconUsers, { className: "size-3.5" })) : null, scope === "workspace"
                                                 ? (selectedUserEmail ?? "All users")
-                                                : "Your usage"] })] }), _jsx("div", { className: "mt-4", children: _jsx(Trend, { daily: data.daily, billing: billing }) })] }), _jsxs("details", { className: "group rounded-lg border border-border/70 bg-card", children: [_jsxs("summary", { className: "flex cursor-pointer list-none items-center justify-between gap-3 px-4 py-4 outline-none transition-colors hover:bg-accent/30 focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-inset [&::-webkit-details-marker]:hidden", children: [_jsxs("span", { children: [_jsx("span", { className: "block text-sm font-semibold text-foreground", children: "Top usage drivers" }), _jsx("span", { className: "mt-1 block text-xs text-muted-foreground", children: "Breakdowns stay collapsed until you need them." })] }), _jsx(IconChevronDown, { className: "size-4 text-muted-foreground transition-transform group-open:rotate-180" })] }), _jsxs("div", { className: "grid gap-6 border-t border-border/70 px-4 py-4 md:grid-cols-2", children: [_jsx(DriverList, { title: "By workflow", rows: data.byLabel, billing: billing }), _jsx(DriverList, { title: "By model", rows: data.byModel, billing: billing })] })] }), _jsxs("details", { className: "group rounded-lg border border-border/70 bg-card", children: [_jsxs("summary", { className: "flex cursor-pointer list-none items-center justify-between gap-3 px-4 py-4 outline-none transition-colors hover:bg-accent/30 focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-inset [&::-webkit-details-marker]:hidden", children: [_jsxs("span", { children: [_jsx("span", { className: "block text-sm font-semibold text-foreground", children: "Recent prompts" }), _jsx("span", { className: "mt-1 block text-xs text-muted-foreground", children: "Latest recorded prompts for the selected app and user scope." })] }), _jsxs("span", { className: "flex items-center gap-2 text-xs text-muted-foreground", children: [data.recent.length, _jsx(IconChevronDown, { className: "size-4 transition-transform group-open:rotate-180" })] })] }), _jsx("div", { className: "border-t border-border/70", children: data.recent.length === 0 ? (_jsx("p", { className: "px-4 py-5 text-sm text-muted-foreground", children: "No recent prompts recorded." })) : (_jsx("div", { className: "divide-y divide-border/60", children: data.recent.map((entry) => (_jsxs("div", { className: "px-4 py-3", children: [_jsxs("div", { className: "flex flex-wrap items-center justify-between gap-2 text-[11px] text-muted-foreground", children: [_jsxs("span", { children: [entry.label, " \u00B7 ", entry.model] }), _jsx("span", { children: entry.ownerEmail })] }), _jsx("p", { className: "mt-1 line-clamp-2 text-sm text-foreground", children: entry.prompt ??
+                                                : "Your usage"] })] }), _jsx("div", { className: "mt-4", children: _jsxs("div", { className: billing.unit === "mixed" &&
+                                        (data.totals.otherCostCents ?? 0) > 0
+                                        ? "grid gap-4 md:grid-cols-2"
+                                        : "", children: [_jsxs("div", { children: [billing.unit === "mixed" ? (_jsx("h3", { className: "mb-2 text-xs font-medium text-muted-foreground", children: t("agentChat.usage.builderCredits", {
+                                                        defaultValue: "Builder credits",
+                                                    }) })) : null, _jsx(Trend, { daily: data.daily, billing: billing })] }), billing.unit === "mixed" &&
+                                            (data.totals.otherCostCents ?? 0) > 0 ? (_jsxs("div", { children: [_jsx("h3", { className: "mb-2 text-xs font-medium text-muted-foreground", children: t("agentChat.usage.otherUnclassifiedSpend", {
+                                                        defaultValue: "Other or unclassified USD spend",
+                                                    }) }), _jsx(Trend, { daily: data.daily.map((day) => ({
+                                                        date: day.date,
+                                                        costCents: day.otherCostCents ?? 0,
+                                                        calls: day.otherCalls ?? 0,
+                                                        tokens: 0,
+                                                    })), billing: { unit: "usd", label: "USD" } })] })) : null] }) })] }), _jsxs("details", { className: "group rounded-lg border border-border/70 bg-card", children: [_jsxs("summary", { className: "flex cursor-pointer list-none items-center justify-between gap-3 px-4 py-4 outline-none transition-colors hover:bg-accent/30 focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-inset [&::-webkit-details-marker]:hidden", children: [_jsxs("span", { children: [_jsx("span", { className: "block text-sm font-semibold text-foreground", children: "Top usage drivers" }), _jsx("span", { className: "mt-1 block text-xs text-muted-foreground", children: "Breakdowns stay collapsed until you need them." })] }), _jsx(IconChevronDown, { className: "size-4 text-muted-foreground transition-transform group-open:rotate-180" })] }), _jsxs("div", { className: "grid gap-6 border-t border-border/70 px-4 py-4 md:grid-cols-2", children: [_jsx(DriverList, { title: "By workflow", rows: data.byLabel, billing: billing }), _jsx(DriverList, { title: "By model", rows: data.byModel, billing: billing })] })] }), _jsxs("details", { className: "group rounded-lg border border-border/70 bg-card", children: [_jsxs("summary", { className: "flex cursor-pointer list-none items-center justify-between gap-3 px-4 py-4 outline-none transition-colors hover:bg-accent/30 focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-inset [&::-webkit-details-marker]:hidden", children: [_jsxs("span", { children: [_jsx("span", { className: "block text-sm font-semibold text-foreground", children: "Recent prompts" }), _jsx("span", { className: "mt-1 block text-xs text-muted-foreground", children: "Latest recorded prompts for the selected app and user scope." })] }), _jsxs("span", { className: "flex items-center gap-2 text-xs text-muted-foreground", children: [data.recent.length, _jsx(IconChevronDown, { className: "size-4 transition-transform group-open:rotate-180" })] })] }), _jsx("div", { className: "border-t border-border/70", children: data.recent.length === 0 ? (_jsx("p", { className: "px-4 py-5 text-sm text-muted-foreground", children: "No recent prompts recorded." })) : (_jsx("div", { className: "divide-y divide-border/60", children: data.recent.map((entry) => (_jsxs("div", { className: "px-4 py-3", children: [_jsxs("div", { className: "flex flex-wrap items-center justify-between gap-2 text-[11px] text-muted-foreground", children: [_jsxs("span", { children: [entry.label, " \u00B7 ", entry.model] }), _jsx("span", { children: entry.ownerEmail })] }), _jsx("p", { className: "mt-1 line-clamp-2 text-sm text-foreground", children: entry.prompt ??
                                                     "Prompt text was not captured for this call." })] }, entry.id))) })) })] }), _jsx(UsageAlertsSection, { appId: appId }), viewAllHref ? (_jsx("div", { className: "flex justify-end", children: _jsx(Button, { asChild: true, variant: "link", size: "sm", className: "gap-1.5", children: _jsxs(Link, { to: viewAllHref, children: ["View all usage", _jsx(IconArrowUpRight, {})] }) }) })) : null] })) : null] }));
 }

package/dist/collab/routes.d.ts

@@ -26,8 +26,8 @@ export declare const getCollabState: import("h3").EventHandlerWithFetch<import("
  * Body: { update: string (base64), requestSource?: string }
  */
 export declare const postCollabUpdate: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/db/client.d.ts

@@ -172,6 +172,16 @@ export declare function isProductionServerlessFunctionRuntime(env?: NodeJS.Proce
  * by the AWS Lambda execution environment itself only once a function actually
  * invokes; `NETLIFY_FUNCTION_NAME` and the Vercel function markers are the
  * same kind of invocation-only signal on their platforms.
+ *
+ * Cloudflare is checked first and outside the `NODE_ENV` gate below:
+ * `hasCloudflareRuntime()` (`__cf_env` / `__env__` on `globalThis`) is only
+ * ever set by the generated Worker `fetch` handler on an actual request (see
+ * `generateCloudflareModuleWorkerEntry()` in deploy/build.ts) — it is never
+ * present in the Node process that runs the build, including the Cloudflare
+ * Pages static-shell prerender, which spawns a plain Node subprocess with no
+ * Workers globals. Unlike Netlify/Lambda/Vercel, Cloudflare's own runtime does
+ * not reliably set `NODE_ENV=production`, so gating it on that check the same
+ * way the other three are would make this branch silently never fire.
  */
 export declare function isHostedFunctionInvocationRuntime(env?: NodeJS.ProcessEnv): boolean;
 /**
@@ -182,6 +192,40 @@ export declare function isHostedFunctionInvocationRuntime(env?: NodeJS.ProcessEn
 export declare class HostedRuntimeLocalDatabaseError extends Error {
     constructor(source: string);
 }
+/**
+ * Shared refusal for every database opener. `getDbExec()` (via `initClient`)
+ * and `createGetDb()`'s Drizzle opener resolve the same runtime URL and must
+ * refuse the same way — a request that reaches Drizzle first used to skip
+ * this check entirely and open PGlite silently.
+ *
+ * `isMigrationAuthorizedRuntime()` is checked first: release scripts and
+ * durable background workers can be a real hosted function invocation (a
+ * Netlify background function still gets `NETLIFY_FUNCTION_NAME`) and are
+ * still allowed to touch PGlite under `withMigrationRuntime()` — that path is
+ * guarded separately by `assertReleaseMigrationTargetsRemoteDatabase()`.
+ *
+ * A real hosted function invocation (`isHostedFunctionInvocationRuntime()`)
+ * always refuses next, before `isEmbeddedRuntimeAuthorized()` is even
+ * consulted: Netlify/Vercel/Lambda/Cloudflare are never a legitimate context
+ * for "this is an intentionally embedded desktop app," regardless of
+ * whether the local database was deliberately configured — an embedded host
+ * that ends up actually running as one of those ephemeral, multi-instance
+ * platforms hits the exact per-instance-PGlite failure the guard exists to
+ * prevent either way. `isEmbeddedRuntimeAuthorized()` only exempts the
+ * bare Node/Docker branch below: `createAgentNativeEmbeddedPlugin()` hosts
+ * (packaged/desktop installs) deliberately pass a `pglite:` `databaseUrl`,
+ * and — unlike the `NODE_ENV=test` integration-suite case
+ * `isServerRuntimeStarted()`'s own gate assumed — a real packaged install
+ * runs with `NODE_ENV=production`, so that gate alone does not exempt it.
+ * `configureAgentNativeEmbeddedEnvironment()` claims this duty whenever the
+ * embedding host supplies an explicit `databaseUrl`.
+ *
+ * `isServerRuntimeStarted()` is additionally gated on `NODE_ENV === "production"`
+ * here, unlike `isHostedFunctionInvocationRuntime()`'s Cloudflare branch:
+ * `getH3App()`'s bootstrap — where the flag is set — also runs for `pnpm dev`
+ * and any `NODE_ENV=test` suite that boots a real H3 app.
+ */
+export declare function assertHostedRuntimeDatabase(): void;
 /** True for statements that change database schema or database privileges. */
 export declare function isSchemaMutationStatement(statement: DbExecStatement): boolean;
 /**

package/dist/db/client.js

@@ -8,8 +8,10 @@ import path from "path";
  */
 import { getAppConfig } from "../app-config/index.js";
 import { getAsyncLocalStorageCtor } from "../shared/optional-node-builtins.js";
+import { isEmbeddedRuntimeAuthorized } from "./embedded-runtime.js";
 import { isMigrationAuthorizedRuntime } from "./migration-runtime.js";
 import { beginDatabaseOperation, recordDatabaseRetry, } from "./request-telemetry.js";
+import { isServerRuntimeStarted } from "./server-runtime.js";
 const recyclingPostgresPools = new WeakSet();
 const loggedNeonPools = new WeakSet();
 const PgliteTransactionStorage = getAsyncLocalStorageCtor();
@@ -906,8 +908,20 @@ export function isProductionServerlessFunctionRuntime(env = process.env) {
  * by the AWS Lambda execution environment itself only once a function actually
  * invokes; `NETLIFY_FUNCTION_NAME` and the Vercel function markers are the
  * same kind of invocation-only signal on their platforms.
+ *
+ * Cloudflare is checked first and outside the `NODE_ENV` gate below:
+ * `hasCloudflareRuntime()` (`__cf_env` / `__env__` on `globalThis`) is only
+ * ever set by the generated Worker `fetch` handler on an actual request (see
+ * `generateCloudflareModuleWorkerEntry()` in deploy/build.ts) — it is never
+ * present in the Node process that runs the build, including the Cloudflare
+ * Pages static-shell prerender, which spawns a plain Node subprocess with no
+ * Workers globals. Unlike Netlify/Lambda/Vercel, Cloudflare's own runtime does
+ * not reliably set `NODE_ENV=production`, so gating it on that check the same
+ * way the other three are would make this branch silently never fire.
  */
 export function isHostedFunctionInvocationRuntime(env = process.env) {
+    if (hasCloudflareRuntime())
+        return true;
     if (env.NODE_ENV !== "production" || env.NETLIFY_LOCAL === "true") {
         return false;
     }
@@ -932,6 +946,53 @@ export class HostedRuntimeLocalDatabaseError extends Error {
         this.name = "HostedRuntimeLocalDatabaseError";
     }
 }
+/**
+ * Shared refusal for every database opener. `getDbExec()` (via `initClient`)
+ * and `createGetDb()`'s Drizzle opener resolve the same runtime URL and must
+ * refuse the same way — a request that reaches Drizzle first used to skip
+ * this check entirely and open PGlite silently.
+ *
+ * `isMigrationAuthorizedRuntime()` is checked first: release scripts and
+ * durable background workers can be a real hosted function invocation (a
+ * Netlify background function still gets `NETLIFY_FUNCTION_NAME`) and are
+ * still allowed to touch PGlite under `withMigrationRuntime()` — that path is
+ * guarded separately by `assertReleaseMigrationTargetsRemoteDatabase()`.
+ *
+ * A real hosted function invocation (`isHostedFunctionInvocationRuntime()`)
+ * always refuses next, before `isEmbeddedRuntimeAuthorized()` is even
+ * consulted: Netlify/Vercel/Lambda/Cloudflare are never a legitimate context
+ * for "this is an intentionally embedded desktop app," regardless of
+ * whether the local database was deliberately configured — an embedded host
+ * that ends up actually running as one of those ephemeral, multi-instance
+ * platforms hits the exact per-instance-PGlite failure the guard exists to
+ * prevent either way. `isEmbeddedRuntimeAuthorized()` only exempts the
+ * bare Node/Docker branch below: `createAgentNativeEmbeddedPlugin()` hosts
+ * (packaged/desktop installs) deliberately pass a `pglite:` `databaseUrl`,
+ * and — unlike the `NODE_ENV=test` integration-suite case
+ * `isServerRuntimeStarted()`'s own gate assumed — a real packaged install
+ * runs with `NODE_ENV=production`, so that gate alone does not exempt it.
+ * `configureAgentNativeEmbeddedEnvironment()` claims this duty whenever the
+ * embedding host supplies an explicit `databaseUrl`.
+ *
+ * `isServerRuntimeStarted()` is additionally gated on `NODE_ENV === "production"`
+ * here, unlike `isHostedFunctionInvocationRuntime()`'s Cloudflare branch:
+ * `getH3App()`'s bootstrap — where the flag is set — also runs for `pnpm dev`
+ * and any `NODE_ENV=test` suite that boots a real H3 app.
+ */
+export function assertHostedRuntimeDatabase() {
+    if (isMigrationAuthorizedRuntime())
+        return;
+    if (!isLocalDatabase())
+        return;
+    if (isHostedFunctionInvocationRuntime()) {
+        throw new HostedRuntimeLocalDatabaseError(getRuntimeDatabaseSource());
+    }
+    if (isEmbeddedRuntimeAuthorized())
+        return;
+    if (process.env.NODE_ENV === "production" && isServerRuntimeStarted()) {
+        throw new HostedRuntimeLocalDatabaseError(getRuntimeDatabaseSource());
+    }
+}
 const SCHEMA_MUTATION_STATEMENT = /^\s*(?:CREATE|ALTER|DROP|TRUNCATE|COMMENT|REINDEX|GRANT|REVOKE)\b/i;
 function rawSql(statement) {
     return typeof statement === "string" ? statement : statement.sql;
@@ -1757,9 +1818,7 @@ function guardSchemaMutations(exec) {
 async function initClient() {
     if (_exec)
         return;
-    if (isHostedFunctionInvocationRuntime() && isLocalDatabase()) {
-        throw new HostedRuntimeLocalDatabaseError(getRuntimeDatabaseSource());
-    }
+    assertHostedRuntimeDatabase();
     const url = getRuntimeDatabaseUrl("pglite:./data/pglite");
     _exec = await createDbExecInternal({ url }, true);
 }

package/dist/db/create-get-db.js

@@ -1,4 +1,4 @@
-import { getActivePgliteTransactionClient, getRuntimeDatabaseUrl, isPgliteUrl, isConnectionError, getPgliteClient, loadPgliteDrizzle, pgliteDrizzleClient, pgPoolOptions, neonPoolOptions, guardNeonPool, withDbTimeout, retryOnConnectionError, dbOpTimeoutMs, sharedDbPool, onSharedDbPoolsClosed, onSharedDbPoolReplaced, } from "./client.js";
+import { getActivePgliteTransactionClient, getRuntimeDatabaseUrl, isPgliteUrl, isConnectionError, getPgliteClient, loadPgliteDrizzle, pgliteDrizzleClient, pgPoolOptions, neonPoolOptions, guardNeonPool, withDbTimeout, retryOnConnectionError, dbOpTimeoutMs, sharedDbPool, onSharedDbPoolsClosed, onSharedDbPoolReplaced, assertHostedRuntimeDatabase, } from "./client.js";
 // Lazy driver loaders — cached promises so dynamic import only runs once.
 let _pgDrizzle;
 function getPgDrizzle() {
@@ -294,6 +294,21 @@ export function createGetDb(schema) {
     function startInit() {
         if (_dbReady)
             return _dbReady;
+        // getDb() below calls this via `void startInit()`, so a throw here must
+        // surface through the rejected `_dbReady` it awaits later, not as a
+        // synchronous exception out of this function.
+        try {
+            assertHostedRuntimeDatabase();
+        }
+        catch (err) {
+            _dbReady = Promise.reject(err);
+            // The real consumer attaches its handler later, through the lazy proxy's
+            // `then` trap, once the caller awaits the query chain — one or more
+            // microtasks from now. Without this, Node flags the promise as an
+            // unhandled rejection in the gap before that happens.
+            _dbReady.catch(() => { });
+            return _dbReady;
+        }
         const url = getRuntimeDatabaseUrl("pglite:./data/pglite");
         if (isPgliteUrl(url)) {
             _dbReady = loadPgliteDrizzle().then(async ({ drizzle }) => {
@@ -356,6 +371,13 @@ export function createGetDb(schema) {
                         }
                         return result;
                     });
+                    // `ready` can already be rejected (e.g. the hosted-runtime database
+                    // guard) when this trap fires, and `[prop].bind(promise)` only
+                    // returns a handler for the *caller* to invoke — it does not attach
+                    // one itself. Without this, `promise` sits rejected and unhandled
+                    // for the gap until the caller actually calls the bound function,
+                    // which is enough for Node to report it as an unhandled rejection.
+                    promise.catch(() => { });
                     return promise[prop].bind(promise);
                 }
                 // drizzle-orm duck-types "is this an SQL entity" by reading these two