@agent-native/core 0.71.0 → 0.72.0

package/dist/server/security-headers.d.ts

@@ -19,11 +19,14 @@
  *   - `Referrer-Policy: strict-origin-when-cross-origin` — strips path/query
  *     from outbound Referer headers when the request crosses origin, so a
  *     public-share viewer's outbound link clicks never leak the share token.
- *   - `Permissions-Policy: camera=(), microphone=(self), geolocation=(),
- *     screen-wake-lock=()` — allows the app shell to request microphone access
- *     for composer dictation while keeping camera/location/wake-lock blocked
- *     by default. Templates that need broader media capture for recording UI
- *     override this on their own routes.
+ *   - `Permissions-Policy: camera=*, microphone=(self), geolocation=(),
+ *     screen-wake-lock=()` — allows microphone access for composer dictation
+ *     and camera access for media-capture UI (the Clips recorder, and the
+ *     Clips browser extension's camera bubble, which is injected as a
+ *     cross-origin iframe and is therefore blocked outright by `camera=()`).
+ *     Location and wake-lock stay disabled. The browser still gates actual
+ *     camera/mic use behind a per-origin permission prompt, so `camera=*` only
+ *     removes the policy-level block, not the user consent.
  *   - `Cross-Origin-Opener-Policy: same-origin` — isolates window.opener so
  *     a popup-window opener reference can't read or modify our document.
  *   - `Cross-Origin-Embedder-Policy: require-corp` — emitted only for

package/dist/server/security-headers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security-headers.d.ts","sourceRoot":"","sources":["../../src/server/security-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAUH;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAGrE;AAwCD;;;;;GAKG;AACH,wBAAgB,+BAA+B,8EA6C9C"}
+{"version":3,"file":"security-headers.d.ts","sourceRoot":"","sources":["../../src/server/security-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAUH;;;;GAIG;AACH,wBAAgB,uBAAuB,CAAC,aAAa,EAAE,MAAM,GAAG,MAAM,CAGrE;AAwCD;;;;;GAKG;AACH,wBAAgB,+BAA+B,8EA6C9C"}

package/dist/server/security-headers.js

@@ -19,11 +19,14 @@
  *   - `Referrer-Policy: strict-origin-when-cross-origin` — strips path/query
  *     from outbound Referer headers when the request crosses origin, so a
  *     public-share viewer's outbound link clicks never leak the share token.
- *   - `Permissions-Policy: camera=(), microphone=(self), geolocation=(),
- *     screen-wake-lock=()` — allows the app shell to request microphone access
- *     for composer dictation while keeping camera/location/wake-lock blocked
- *     by default. Templates that need broader media capture for recording UI
- *     override this on their own routes.
+ *   - `Permissions-Policy: camera=*, microphone=(self), geolocation=(),
+ *     screen-wake-lock=()` — allows microphone access for composer dictation
+ *     and camera access for media-capture UI (the Clips recorder, and the
+ *     Clips browser extension's camera bubble, which is injected as a
+ *     cross-origin iframe and is therefore blocked outright by `camera=()`).
+ *     Location and wake-lock stay disabled. The browser still gates actual
+ *     camera/mic use behind a per-origin permission prompt, so `camera=*` only
+ *     removes the policy-level block, not the user consent.
  *   - `Cross-Origin-Opener-Policy: same-origin` — isolates window.opener so
  *     a popup-window opener reference can't read or modify our document.
  *   - `Cross-Origin-Embedder-Policy: require-corp` — emitted only for
@@ -62,7 +65,7 @@ export function computeInlineScriptHash(scriptContent) {
     return `'sha256-${hash}'`;
 }
 const HSTS = "max-age=31536000; includeSubDomains; preload";
-const PERMISSIONS_POLICY = "camera=(), microphone=(self), geolocation=(), screen-wake-lock=()";
+const PERMISSIONS_POLICY = "camera=*, microphone=(self), geolocation=(), screen-wake-lock=()";
 /**
  * Returns true when the request was received over HTTPS. We trust both the
  * underlying connection (when the server is terminating TLS itself) and the

package/dist/server/security-headers.js.map

@@ -1 +1 @@
-{"version":3,"file":"security-headers.js","sourceRoot":"","sources":["../../src/server/security-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiDG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EACL,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,aAAqB;IAC3D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzE,OAAO,WAAW,IAAI,GAAG,CAAC;AAC5B,CAAC;AAED,MAAM,IAAI,GAAG,8CAA8C,CAAC;AAC5D,MAAM,kBAAkB,GACtB,mEAAmE,CAAC;AAEtE;;;;;GAKG;AACH,SAAS,cAAc,CAAC,KAAU;IAChC,MAAM,GAAG,GACP,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC;QAChD,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,OAAO;QACjE,OAAO,IAAI,CAAC;IACd,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1D,uDAAuD;IACvD,MAAM,KAAK,GAAG,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC;IACnC,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,2DAA2D;IAC3D,IAAI,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAU;IACtC,MAAM,QAAQ,GACZ,KAAK,EAAE,GAAG,EAAE,QAAQ;QACpB,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,KAAK,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,CACL,QAAQ,KAAK,oBAAoB,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAU;IAC3C,OAAO,SAAS,CAAC,KAAK,EAAE,gBAAgB,CAAC,KAAK,QAAQ,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B;IAC7C,OAAO,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;QAClC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;QAC3D,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,uBAAuB,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACjD,iBAAiB,CAAC,KAAK,EAAE,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC9D,iBAAiB,CACf,KAAK,EACL,iBAAiB,EACjB,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,iCAAiC,CACtE,CAAC;QACF,iBAAiB,CAAC,KAAK,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;QACnE,iBAAiB,CAAC,KAAK,EAAE,4BAA4B,EAAE,aAAa,CAAC,CAAC;QACtE,IAAI,iBAAiB,IAAI,uBAAuB,EAAE,CAAC;YACjD,iBAAiB,CAAC,KAAK,EAAE,8BAA8B,EAAE,cAAc,CAAC,CAAC;QAC3E,CAAC;QACD,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,iBAAiB,IAAI,kBAAkB,IAAI,uBAAuB;YAChE,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,WAAW,CAChB,CAAC;QACF,IAAI,iBAAiB,IAAI,oBAAoB,CAAC,aAAa,CAAC,EAAE,CAAC;YAC7D,uFAAuF;YACvF,iBAAiB,CAAC,KAAK,EAAE,6BAA6B,EAAE,aAAc,CAAC,CAAC;YACxE,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC3C,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,wCAAwC,CACzC,CAAC;YACF,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,4BAA4B,CAC7B,CAAC;QACJ,CAAC;QACD,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,iBAAiB,CAAC,KAAK,EAAE,2BAA2B,EAAE,IAAI,CAAC,CAAC;QAC9D,CAAC;QACD,2EAA2E;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Security response headers middleware.\n *\n * Sets a baseline set of \"no-brainer\" security headers on every framework HTTP\n * response. These headers are layered defenses: each one mitigates a specific\n * class of attack, and together they harden the surface against MIME-sniffing,\n * referrer leakage, mixed-content downgrades, and cross-origin window/embed\n * access.\n *\n * The headers we emit:\n *\n *   - `Strict-Transport-Security` — forces HTTPS for the browser's lifetime\n *     of the cached value, preventing SSL-strip MITM. Only emitted when the\n *     request scheme is `https` (we don't want to break local-dev HTTP, and\n *     emitting HSTS over HTTP is a no-op per the spec but causes confusion).\n *   - `X-Content-Type-Options: nosniff` — disables browser MIME sniffing so\n *     a tool /render route serving user-authored HTML can't be misinterpreted\n *     as some other content type by a clever Accept header.\n *   - `Referrer-Policy: strict-origin-when-cross-origin` — strips path/query\n *     from outbound Referer headers when the request crosses origin, so a\n *     public-share viewer's outbound link clicks never leak the share token.\n *   - `Permissions-Policy: camera=(), microphone=(self), geolocation=(),\n *     screen-wake-lock=()` — allows the app shell to request microphone access\n *     for composer dictation while keeping camera/location/wake-lock blocked\n *     by default. Templates that need broader media capture for recording UI\n *     override this on their own routes.\n *   - `Cross-Origin-Opener-Policy: same-origin` — isolates window.opener so\n *     a popup-window opener reference can't read or modify our document.\n *   - `Cross-Origin-Embedder-Policy: require-corp` — emitted only for\n *     validated MCP embed-session page loads and browser iframe navigations.\n *     COEP hosts such as Claude's MCP Apps proxy require framed cross-origin\n *     documents to opt in explicitly.\n *   - `Cross-Origin-Resource-Policy: same-site` — prevents other origins from\n *     embedding our endpoints as `<img>` / `<script>` / `<audio>`, blocking\n *     the simplest data-leak chain when combined with auth cookies. Validated\n *     MCP embed-session page loads and browser iframe navigations use\n *     `cross-origin` so COEP hosts can frame app documents.\n *\n * NOTE: `Cross-Origin-Embedder-Policy` is NOT set by default because it\n * requires every embedded subresource to opt in via CORP/CORS, which would\n * break Builder's iframe editor and template embed use cases. COOP + CORP\n * without COEP gives us most of the protection on normal responses; COEP is\n * only added for validated MCP embed-session page loads and browser iframe\n * navigations (see above).\n *\n * NOTE: `X-Frame-Options` is intentionally not set globally. Agent-native apps\n * are expected to run inside iframe hosts such as Builder, Design, and MCP app\n * shells. Routes that render especially sensitive iframe-only documents should\n * set their own route-specific CSP / frame policy.\n */\n\nimport { createHash } from \"node:crypto\";\nimport { defineEventHandler, getHeader, setResponseHeader } from \"h3\";\nimport { requestHasEmbedAuthMarker } from \"./embed-session.js\";\nimport {\n  isMcpEmbedCorsOrigin,\n  MCP_EMBED_CORS_ALLOW_HEADERS,\n} from \"../shared/mcp-embed-headers.js\";\n\n/**\n * Compute the sha256-<base64> hash token for an inline script's text content.\n * Pass the raw script body (no surrounding <script> tags). The resulting token\n * can be listed directly in a `script-src` CSP directive.\n */\nexport function computeInlineScriptHash(scriptContent: string): string {\n  const hash = createHash(\"sha256\").update(scriptContent).digest(\"base64\");\n  return `'sha256-${hash}'`;\n}\n\nconst HSTS = \"max-age=31536000; includeSubDomains; preload\";\nconst PERMISSIONS_POLICY =\n  \"camera=(), microphone=(self), geolocation=(), screen-wake-lock=()\";\n\n/**\n * Returns true when the request was received over HTTPS. We trust both the\n * underlying connection (when the server is terminating TLS itself) and the\n * `x-forwarded-proto` header (set by Netlify, Vercel, Cloudflare, and any\n * other reverse proxy that fronts the framework).\n */\nfunction isHttpsRequest(event: any): boolean {\n  const xfp =\n    event?.node?.req?.headers?.[\"x-forwarded-proto\"] ??\n    event?.headers?.get?.(\"x-forwarded-proto\");\n  if (typeof xfp === \"string\" && xfp.split(\",\")[0].trim() === \"https\")\n    return true;\n  if (Array.isArray(xfp) && xfp[0] === \"https\") return true;\n  // h3 sets `event.url.protocol` to \"http:\" or \"https:\".\n  const proto = event?.url?.protocol;\n  if (proto === \"https:\") return true;\n  // Direct Node `req.connection.encrypted` (older runtimes).\n  if (event?.node?.req?.connection?.encrypted) return true;\n  return false;\n}\n\nfunction isMcpEndpointRequest(event: any): boolean {\n  const pathname =\n    event?.url?.pathname ??\n    String(event?.node?.req?.url ?? event?.path ?? \"/\").split(\"?\")[0];\n  return (\n    pathname === \"/_agent-native/mcp\" || pathname.endsWith(\"/_agent-native/mcp\")\n  );\n}\n\nfunction isIframeNavigationRequest(event: any): boolean {\n  return getHeader(event, \"sec-fetch-dest\") === \"iframe\";\n}\n\n/**\n * Create the security-headers h3 middleware. Mount this BEFORE other route\n * handlers so the headers are present on every response (including 4xx/5xx\n * error pages). Route handlers that need to tighten a specific header can call\n * `setResponseHeader` after this runs — the latest write wins.\n */\nexport function createSecurityHeadersMiddleware() {\n  return defineEventHandler((event) => {\n    const embedFrameRequest = requestHasEmbedAuthMarker(event);\n    const mcpEndpointRequest = isMcpEndpointRequest(event);\n    const iframeNavigationRequest = isIframeNavigationRequest(event);\n    const requestOrigin = getHeader(event, \"origin\");\n    setResponseHeader(event, \"X-Content-Type-Options\", \"nosniff\");\n    setResponseHeader(\n      event,\n      \"Referrer-Policy\",\n      embedFrameRequest ? \"no-referrer\" : \"strict-origin-when-cross-origin\",\n    );\n    setResponseHeader(event, \"Permissions-Policy\", PERMISSIONS_POLICY);\n    setResponseHeader(event, \"Cross-Origin-Opener-Policy\", \"same-origin\");\n    if (embedFrameRequest || iframeNavigationRequest) {\n      setResponseHeader(event, \"Cross-Origin-Embedder-Policy\", \"require-corp\");\n    }\n    setResponseHeader(\n      event,\n      \"Cross-Origin-Resource-Policy\",\n      embedFrameRequest || mcpEndpointRequest || iframeNavigationRequest\n        ? \"cross-origin\"\n        : \"same-site\",\n    );\n    if (embedFrameRequest && isMcpEmbedCorsOrigin(requestOrigin)) {\n      // requestOrigin is non-null: isMcpEmbedCorsOrigin returns true only for truthy origins\n      setResponseHeader(event, \"Access-Control-Allow-Origin\", requestOrigin!);\n      setResponseHeader(event, \"Vary\", \"Origin\");\n      setResponseHeader(\n        event,\n        \"Access-Control-Allow-Methods\",\n        \"GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS\",\n      );\n      setResponseHeader(\n        event,\n        \"Access-Control-Allow-Headers\",\n        MCP_EMBED_CORS_ALLOW_HEADERS,\n      );\n    }\n    if (isHttpsRequest(event)) {\n      setResponseHeader(event, \"Strict-Transport-Security\", HSTS);\n    }\n    // Continue to the next handler — we only set headers, don't return a body.\n    return undefined;\n  });\n}\n"]}
+{"version":3,"file":"security-headers.js","sourceRoot":"","sources":["../../src/server/security-headers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,iBAAiB,EAAE,MAAM,IAAI,CAAC;AACtE,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EACL,oBAAoB,EACpB,4BAA4B,GAC7B,MAAM,gCAAgC,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,aAAqB;IAC3D,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACzE,OAAO,WAAW,IAAI,GAAG,CAAC;AAC5B,CAAC;AAED,MAAM,IAAI,GAAG,8CAA8C,CAAC;AAC5D,MAAM,kBAAkB,GACtB,kEAAkE,CAAC;AAErE;;;;;GAKG;AACH,SAAS,cAAc,CAAC,KAAU;IAChC,MAAM,GAAG,GACP,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,mBAAmB,CAAC;QAChD,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,mBAAmB,CAAC,CAAC;IAC7C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,OAAO;QACjE,OAAO,IAAI,CAAC;IACd,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1D,uDAAuD;IACvD,MAAM,KAAK,GAAG,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC;IACnC,IAAI,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACpC,2DAA2D;IAC3D,IAAI,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,SAAS;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAU;IACtC,MAAM,QAAQ,GACZ,KAAK,EAAE,GAAG,EAAE,QAAQ;QACpB,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,IAAI,KAAK,EAAE,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,OAAO,CACL,QAAQ,KAAK,oBAAoB,IAAI,QAAQ,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAC7E,CAAC;AACJ,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAU;IAC3C,OAAO,SAAS,CAAC,KAAK,EAAE,gBAAgB,CAAC,KAAK,QAAQ,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,+BAA+B;IAC7C,OAAO,kBAAkB,CAAC,CAAC,KAAK,EAAE,EAAE;QAClC,MAAM,iBAAiB,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;QAC3D,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,KAAK,CAAC,CAAC;QACvD,MAAM,uBAAuB,GAAG,yBAAyB,CAAC,KAAK,CAAC,CAAC;QACjE,MAAM,aAAa,GAAG,SAAS,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QACjD,iBAAiB,CAAC,KAAK,EAAE,wBAAwB,EAAE,SAAS,CAAC,CAAC;QAC9D,iBAAiB,CACf,KAAK,EACL,iBAAiB,EACjB,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,iCAAiC,CACtE,CAAC;QACF,iBAAiB,CAAC,KAAK,EAAE,oBAAoB,EAAE,kBAAkB,CAAC,CAAC;QACnE,iBAAiB,CAAC,KAAK,EAAE,4BAA4B,EAAE,aAAa,CAAC,CAAC;QACtE,IAAI,iBAAiB,IAAI,uBAAuB,EAAE,CAAC;YACjD,iBAAiB,CAAC,KAAK,EAAE,8BAA8B,EAAE,cAAc,CAAC,CAAC;QAC3E,CAAC;QACD,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,iBAAiB,IAAI,kBAAkB,IAAI,uBAAuB;YAChE,CAAC,CAAC,cAAc;YAChB,CAAC,CAAC,WAAW,CAChB,CAAC;QACF,IAAI,iBAAiB,IAAI,oBAAoB,CAAC,aAAa,CAAC,EAAE,CAAC;YAC7D,uFAAuF;YACvF,iBAAiB,CAAC,KAAK,EAAE,6BAA6B,EAAE,aAAc,CAAC,CAAC;YACxE,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;YAC3C,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,wCAAwC,CACzC,CAAC;YACF,iBAAiB,CACf,KAAK,EACL,8BAA8B,EAC9B,4BAA4B,CAC7B,CAAC;QACJ,CAAC;QACD,IAAI,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,iBAAiB,CAAC,KAAK,EAAE,2BAA2B,EAAE,IAAI,CAAC,CAAC;QAC9D,CAAC;QACD,2EAA2E;QAC3E,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["/**\n * Security response headers middleware.\n *\n * Sets a baseline set of \"no-brainer\" security headers on every framework HTTP\n * response. These headers are layered defenses: each one mitigates a specific\n * class of attack, and together they harden the surface against MIME-sniffing,\n * referrer leakage, mixed-content downgrades, and cross-origin window/embed\n * access.\n *\n * The headers we emit:\n *\n *   - `Strict-Transport-Security` — forces HTTPS for the browser's lifetime\n *     of the cached value, preventing SSL-strip MITM. Only emitted when the\n *     request scheme is `https` (we don't want to break local-dev HTTP, and\n *     emitting HSTS over HTTP is a no-op per the spec but causes confusion).\n *   - `X-Content-Type-Options: nosniff` — disables browser MIME sniffing so\n *     a tool /render route serving user-authored HTML can't be misinterpreted\n *     as some other content type by a clever Accept header.\n *   - `Referrer-Policy: strict-origin-when-cross-origin` — strips path/query\n *     from outbound Referer headers when the request crosses origin, so a\n *     public-share viewer's outbound link clicks never leak the share token.\n *   - `Permissions-Policy: camera=*, microphone=(self), geolocation=(),\n *     screen-wake-lock=()` — allows microphone access for composer dictation\n *     and camera access for media-capture UI (the Clips recorder, and the\n *     Clips browser extension's camera bubble, which is injected as a\n *     cross-origin iframe and is therefore blocked outright by `camera=()`).\n *     Location and wake-lock stay disabled. The browser still gates actual\n *     camera/mic use behind a per-origin permission prompt, so `camera=*` only\n *     removes the policy-level block, not the user consent.\n *   - `Cross-Origin-Opener-Policy: same-origin` — isolates window.opener so\n *     a popup-window opener reference can't read or modify our document.\n *   - `Cross-Origin-Embedder-Policy: require-corp` — emitted only for\n *     validated MCP embed-session page loads and browser iframe navigations.\n *     COEP hosts such as Claude's MCP Apps proxy require framed cross-origin\n *     documents to opt in explicitly.\n *   - `Cross-Origin-Resource-Policy: same-site` — prevents other origins from\n *     embedding our endpoints as `<img>` / `<script>` / `<audio>`, blocking\n *     the simplest data-leak chain when combined with auth cookies. Validated\n *     MCP embed-session page loads and browser iframe navigations use\n *     `cross-origin` so COEP hosts can frame app documents.\n *\n * NOTE: `Cross-Origin-Embedder-Policy` is NOT set by default because it\n * requires every embedded subresource to opt in via CORP/CORS, which would\n * break Builder's iframe editor and template embed use cases. COOP + CORP\n * without COEP gives us most of the protection on normal responses; COEP is\n * only added for validated MCP embed-session page loads and browser iframe\n * navigations (see above).\n *\n * NOTE: `X-Frame-Options` is intentionally not set globally. Agent-native apps\n * are expected to run inside iframe hosts such as Builder, Design, and MCP app\n * shells. Routes that render especially sensitive iframe-only documents should\n * set their own route-specific CSP / frame policy.\n */\n\nimport { createHash } from \"node:crypto\";\nimport { defineEventHandler, getHeader, setResponseHeader } from \"h3\";\nimport { requestHasEmbedAuthMarker } from \"./embed-session.js\";\nimport {\n  isMcpEmbedCorsOrigin,\n  MCP_EMBED_CORS_ALLOW_HEADERS,\n} from \"../shared/mcp-embed-headers.js\";\n\n/**\n * Compute the sha256-<base64> hash token for an inline script's text content.\n * Pass the raw script body (no surrounding <script> tags). The resulting token\n * can be listed directly in a `script-src` CSP directive.\n */\nexport function computeInlineScriptHash(scriptContent: string): string {\n  const hash = createHash(\"sha256\").update(scriptContent).digest(\"base64\");\n  return `'sha256-${hash}'`;\n}\n\nconst HSTS = \"max-age=31536000; includeSubDomains; preload\";\nconst PERMISSIONS_POLICY =\n  \"camera=*, microphone=(self), geolocation=(), screen-wake-lock=()\";\n\n/**\n * Returns true when the request was received over HTTPS. We trust both the\n * underlying connection (when the server is terminating TLS itself) and the\n * `x-forwarded-proto` header (set by Netlify, Vercel, Cloudflare, and any\n * other reverse proxy that fronts the framework).\n */\nfunction isHttpsRequest(event: any): boolean {\n  const xfp =\n    event?.node?.req?.headers?.[\"x-forwarded-proto\"] ??\n    event?.headers?.get?.(\"x-forwarded-proto\");\n  if (typeof xfp === \"string\" && xfp.split(\",\")[0].trim() === \"https\")\n    return true;\n  if (Array.isArray(xfp) && xfp[0] === \"https\") return true;\n  // h3 sets `event.url.protocol` to \"http:\" or \"https:\".\n  const proto = event?.url?.protocol;\n  if (proto === \"https:\") return true;\n  // Direct Node `req.connection.encrypted` (older runtimes).\n  if (event?.node?.req?.connection?.encrypted) return true;\n  return false;\n}\n\nfunction isMcpEndpointRequest(event: any): boolean {\n  const pathname =\n    event?.url?.pathname ??\n    String(event?.node?.req?.url ?? event?.path ?? \"/\").split(\"?\")[0];\n  return (\n    pathname === \"/_agent-native/mcp\" || pathname.endsWith(\"/_agent-native/mcp\")\n  );\n}\n\nfunction isIframeNavigationRequest(event: any): boolean {\n  return getHeader(event, \"sec-fetch-dest\") === \"iframe\";\n}\n\n/**\n * Create the security-headers h3 middleware. Mount this BEFORE other route\n * handlers so the headers are present on every response (including 4xx/5xx\n * error pages). Route handlers that need to tighten a specific header can call\n * `setResponseHeader` after this runs — the latest write wins.\n */\nexport function createSecurityHeadersMiddleware() {\n  return defineEventHandler((event) => {\n    const embedFrameRequest = requestHasEmbedAuthMarker(event);\n    const mcpEndpointRequest = isMcpEndpointRequest(event);\n    const iframeNavigationRequest = isIframeNavigationRequest(event);\n    const requestOrigin = getHeader(event, \"origin\");\n    setResponseHeader(event, \"X-Content-Type-Options\", \"nosniff\");\n    setResponseHeader(\n      event,\n      \"Referrer-Policy\",\n      embedFrameRequest ? \"no-referrer\" : \"strict-origin-when-cross-origin\",\n    );\n    setResponseHeader(event, \"Permissions-Policy\", PERMISSIONS_POLICY);\n    setResponseHeader(event, \"Cross-Origin-Opener-Policy\", \"same-origin\");\n    if (embedFrameRequest || iframeNavigationRequest) {\n      setResponseHeader(event, \"Cross-Origin-Embedder-Policy\", \"require-corp\");\n    }\n    setResponseHeader(\n      event,\n      \"Cross-Origin-Resource-Policy\",\n      embedFrameRequest || mcpEndpointRequest || iframeNavigationRequest\n        ? \"cross-origin\"\n        : \"same-site\",\n    );\n    if (embedFrameRequest && isMcpEmbedCorsOrigin(requestOrigin)) {\n      // requestOrigin is non-null: isMcpEmbedCorsOrigin returns true only for truthy origins\n      setResponseHeader(event, \"Access-Control-Allow-Origin\", requestOrigin!);\n      setResponseHeader(event, \"Vary\", \"Origin\");\n      setResponseHeader(\n        event,\n        \"Access-Control-Allow-Methods\",\n        \"GET,HEAD,POST,PUT,PATCH,DELETE,OPTIONS\",\n      );\n      setResponseHeader(\n        event,\n        \"Access-Control-Allow-Headers\",\n        MCP_EMBED_CORS_ALLOW_HEADERS,\n      );\n    }\n    if (isHttpsRequest(event)) {\n      setResponseHeader(event, \"Strict-Transport-Security\", HSTS);\n    }\n    // Continue to the next handler — we only set headers, don't return a body.\n    return undefined;\n  });\n}\n"]}

package/dist/settings/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/settings/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAOtC,wBAAgB,kBAAkB,IAAI,YAAY,CAEjD;AAqCD,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAUzC;AAED,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED,wBAAsB,cAAc,IAAI,OAAO,CAC7C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CACxC,CAUA"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/settings/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAQtC,wBAAgB,kBAAkB,IAAI,YAAY,CAEjD;AA0CD,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,CAUzC;AAED,MAAM,WAAW,iBAAiB;IAChC,gEAAgE;IAChE,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,wBAAsB,aAAa,CACjC,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,iBAAiB,GAC1B,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED,wBAAsB,cAAc,IAAI,OAAO,CAC7C,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CACxC,CAUA"}

package/dist/settings/store.js

@@ -1,5 +1,6 @@
 import { EventEmitter } from "events";
 import { getDbExec, isPostgres, intType } from "../db/client.js";
+import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
 let _initPromise;
 const _emitter = new EventEmitter();
 export function getSettingsEmitter() {
@@ -20,6 +21,11 @@ async function ensureTable() {
           updated_at ${intType()} NOT NULL
         )
       `);
+            // Older deployments (pre BIGINT-compat) have a 32-bit `updated_at`; on
+            // Postgres the `Date.now()` written on every setSetting overflows int4.
+            // Widen in place (no-op once done / on fresh DBs). Pass the unqualified
+            // name — the helper scopes to the `public` schema.
+            await widenIntColumnsToBigInt("settings", ["updated_at"]);
             // Index for the poll watermark query: `SELECT MAX(updated_at) FROM settings`.
             // MAX on an indexed column avoids a full-table scan on every poll cycle.
             // IF NOT EXISTS makes it idempotent on existing databases.

package/dist/settings/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/settings/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAEjE,IAAI,YAAuC,CAAC;AAE5C,MAAM,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;AAEpC,MAAM,UAAU,kBAAkB;IAChC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;YAC9B,MAAM,MAAM,CAAC,OAAO,CAAC;qCACU,KAAK;;;uBAGnB,OAAO,EAAE;;OAEzB,CAAC,CAAC;YACH,8EAA8E;YAC9E,yEAAyE;YACzE,2DAA2D;YAC3D,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,yDAAyD,KAAK,eAAe,CAC9E,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;YAC9D,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,sDAAsD;YACtD,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAW;IAEX,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,qBAAqB,KAAK,gBAAgB;QAC/C,IAAI,EAAE,CAAC,GAAG,CAAC;KACZ,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC,CAAC;AAC7C,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAW,EACX,KAA8B,EAC9B,OAA2B;IAE3B,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,UAAU,EAAE;YACf,CAAC,CAAC,eAAe,KAAK,iIAAiI;YACvJ,CAAC,CAAC,0BAA0B,KAAK,4CAA4C;QAC/E,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;KAC/C,CAAC,CAAC;IACH,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE;QACxB,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,QAAQ;QACd,GAAG;QACH,GAAG,CAAC,OAAO,EAAE,aAAa,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;KACxE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,OAA2B;IAE3B,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,eAAe,KAAK,gBAAgB;QACzC,IAAI,EAAE,CAAC,GAAG,CAAC;KACZ,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE;YACxB,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,QAAQ;YACd,GAAG;YACH,GAAG,CAAC,OAAO,EAAE,aAAa,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;SACxE,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAGlC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,0BAA0B,KAAK,EAAE,CAAC,CAAC;IACzE,MAAM,MAAM,GAA4C,EAAE,CAAC;IAC3D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,GAAa,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAe,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import { EventEmitter } from \"events\";\nimport { getDbExec, isPostgres, intType } from \"../db/client.js\";\n\nlet _initPromise: Promise<void> | undefined;\n\nconst _emitter = new EventEmitter();\n\nexport function getSettingsEmitter(): EventEmitter {\n  return _emitter;\n}\n\nfunction settingsTable(): string {\n  return isPostgres() ? \"public.settings\" : \"settings\";\n}\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      const table = settingsTable();\n      await client.execute(`\n        CREATE TABLE IF NOT EXISTS ${table} (\n          key TEXT PRIMARY KEY,\n          value TEXT NOT NULL,\n          updated_at ${intType()} NOT NULL\n        )\n      `);\n      // Index for the poll watermark query: `SELECT MAX(updated_at) FROM settings`.\n      // MAX on an indexed column avoids a full-table scan on every poll cycle.\n      // IF NOT EXISTS makes it idempotent on existing databases.\n      try {\n        await client.execute(\n          `CREATE INDEX IF NOT EXISTS settings_updated_at_idx ON ${table} (updated_at)`,\n        );\n      } catch {\n        // Index already exists or the dialect rejected a duplicate.\n      }\n    })().catch((err) => {\n      // Retry init on the next call after a failed startup.\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\nexport async function getSetting(\n  key: string,\n): Promise<Record<string, unknown> | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const table = settingsTable();\n  const { rows } = await client.execute({\n    sql: `SELECT value FROM ${table} WHERE key = ?`,\n    args: [key],\n  });\n  if (rows.length === 0) return null;\n  return JSON.parse(rows[0].value as string);\n}\n\nexport interface StoreWriteOptions {\n  /** Tag identifying who initiated this write (e.g. a tab ID). */\n  requestSource?: string;\n}\n\nexport async function putSetting(\n  key: string,\n  value: Record<string, unknown>,\n  options?: StoreWriteOptions,\n): Promise<void> {\n  await ensureTable();\n  const client = getDbExec();\n  const table = settingsTable();\n  await client.execute({\n    sql: isPostgres()\n      ? `INSERT INTO ${table} (key, value, updated_at) VALUES (?, ?, ?) ON CONFLICT (key) DO UPDATE SET value=EXCLUDED.value, updated_at=EXCLUDED.updated_at`\n      : `INSERT OR REPLACE INTO ${table} (key, value, updated_at) VALUES (?, ?, ?)`,\n    args: [key, JSON.stringify(value), Date.now()],\n  });\n  _emitter.emit(\"settings\", {\n    source: \"settings\",\n    type: \"change\",\n    key,\n    ...(options?.requestSource && { requestSource: options.requestSource }),\n  });\n}\n\nexport async function deleteSetting(\n  key: string,\n  options?: StoreWriteOptions,\n): Promise<boolean> {\n  await ensureTable();\n  const client = getDbExec();\n  const table = settingsTable();\n  const result = await client.execute({\n    sql: `DELETE FROM ${table} WHERE key = ?`,\n    args: [key],\n  });\n  if (result.rowsAffected > 0) {\n    _emitter.emit(\"settings\", {\n      source: \"settings\",\n      type: \"delete\",\n      key,\n      ...(options?.requestSource && { requestSource: options.requestSource }),\n    });\n    return true;\n  }\n  return false;\n}\n\nexport async function getAllSettings(): Promise<\n  Record<string, Record<string, unknown>>\n> {\n  await ensureTable();\n  const client = getDbExec();\n  const table = settingsTable();\n  const { rows } = await client.execute(`SELECT key, value FROM ${table}`);\n  const result: Record<string, Record<string, unknown>> = {};\n  for (const row of rows) {\n    result[row.key as string] = JSON.parse(row.value as string);\n  }\n  return result;\n}\n"]}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/settings/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AACtC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAEjE,IAAI,YAAuC,CAAC;AAE5C,MAAM,QAAQ,GAAG,IAAI,YAAY,EAAE,CAAC;AAEpC,MAAM,UAAU,kBAAkB;IAChC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,UAAU,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,UAAU,CAAC;AACvD,CAAC;AAED,KAAK,UAAU,WAAW;IACxB,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;YAC9B,MAAM,MAAM,CAAC,OAAO,CAAC;qCACU,KAAK;;;uBAGnB,OAAO,EAAE;;OAEzB,CAAC,CAAC;YACH,uEAAuE;YACvE,wEAAwE;YACxE,wEAAwE;YACxE,mDAAmD;YACnD,MAAM,uBAAuB,CAAC,UAAU,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;YAC1D,8EAA8E;YAC9E,yEAAyE;YACzE,2DAA2D;YAC3D,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,yDAAyD,KAAK,eAAe,CAC9E,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,4DAA4D;YAC9D,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,sDAAsD;YACtD,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAW;IAEX,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,qBAAqB,KAAK,gBAAgB;QAC/C,IAAI,EAAE,CAAC,GAAG,CAAC;KACZ,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC,CAAC;AAC7C,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAW,EACX,KAA8B,EAC9B,OAA2B;IAE3B,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE,UAAU,EAAE;YACf,CAAC,CAAC,eAAe,KAAK,iIAAiI;YACvJ,CAAC,CAAC,0BAA0B,KAAK,4CAA4C;QAC/E,IAAI,EAAE,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC;KAC/C,CAAC,CAAC;IACH,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE;QACxB,MAAM,EAAE,UAAU;QAClB,IAAI,EAAE,QAAQ;QACd,GAAG;QACH,GAAG,CAAC,OAAO,EAAE,aAAa,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;KACxE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,GAAW,EACX,OAA2B;IAE3B,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QAClC,GAAG,EAAE,eAAe,KAAK,gBAAgB;QACzC,IAAI,EAAE,CAAC,GAAG,CAAC;KACZ,CAAC,CAAC;IACH,IAAI,MAAM,CAAC,YAAY,GAAG,CAAC,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,UAAU,EAAE;YACxB,MAAM,EAAE,UAAU;YAClB,IAAI,EAAE,QAAQ;YACd,GAAG;YACH,GAAG,CAAC,OAAO,EAAE,aAAa,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,aAAa,EAAE,CAAC;SACxE,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc;IAGlC,MAAM,WAAW,EAAE,CAAC;IACpB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAG,aAAa,EAAE,CAAC;IAC9B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,0BAA0B,KAAK,EAAE,CAAC,CAAC;IACzE,MAAM,MAAM,GAA4C,EAAE,CAAC;IAC3D,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,CAAC,GAAG,CAAC,GAAa,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAe,CAAC,CAAC;IAC9D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC","sourcesContent":["import { EventEmitter } from \"events\";\nimport { getDbExec, isPostgres, intType } from \"../db/client.js\";\nimport { widenIntColumnsToBigInt } from \"../db/widen-columns.js\";\n\nlet _initPromise: Promise<void> | undefined;\n\nconst _emitter = new EventEmitter();\n\nexport function getSettingsEmitter(): EventEmitter {\n  return _emitter;\n}\n\nfunction settingsTable(): string {\n  return isPostgres() ? \"public.settings\" : \"settings\";\n}\n\nasync function ensureTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      const table = settingsTable();\n      await client.execute(`\n        CREATE TABLE IF NOT EXISTS ${table} (\n          key TEXT PRIMARY KEY,\n          value TEXT NOT NULL,\n          updated_at ${intType()} NOT NULL\n        )\n      `);\n      // Older deployments (pre BIGINT-compat) have a 32-bit `updated_at`; on\n      // Postgres the `Date.now()` written on every setSetting overflows int4.\n      // Widen in place (no-op once done / on fresh DBs). Pass the unqualified\n      // name — the helper scopes to the `public` schema.\n      await widenIntColumnsToBigInt(\"settings\", [\"updated_at\"]);\n      // Index for the poll watermark query: `SELECT MAX(updated_at) FROM settings`.\n      // MAX on an indexed column avoids a full-table scan on every poll cycle.\n      // IF NOT EXISTS makes it idempotent on existing databases.\n      try {\n        await client.execute(\n          `CREATE INDEX IF NOT EXISTS settings_updated_at_idx ON ${table} (updated_at)`,\n        );\n      } catch {\n        // Index already exists or the dialect rejected a duplicate.\n      }\n    })().catch((err) => {\n      // Retry init on the next call after a failed startup.\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\nexport async function getSetting(\n  key: string,\n): Promise<Record<string, unknown> | null> {\n  await ensureTable();\n  const client = getDbExec();\n  const table = settingsTable();\n  const { rows } = await client.execute({\n    sql: `SELECT value FROM ${table} WHERE key = ?`,\n    args: [key],\n  });\n  if (rows.length === 0) return null;\n  return JSON.parse(rows[0].value as string);\n}\n\nexport interface StoreWriteOptions {\n  /** Tag identifying who initiated this write (e.g. a tab ID). */\n  requestSource?: string;\n}\n\nexport async function putSetting(\n  key: string,\n  value: Record<string, unknown>,\n  options?: StoreWriteOptions,\n): Promise<void> {\n  await ensureTable();\n  const client = getDbExec();\n  const table = settingsTable();\n  await client.execute({\n    sql: isPostgres()\n      ? `INSERT INTO ${table} (key, value, updated_at) VALUES (?, ?, ?) ON CONFLICT (key) DO UPDATE SET value=EXCLUDED.value, updated_at=EXCLUDED.updated_at`\n      : `INSERT OR REPLACE INTO ${table} (key, value, updated_at) VALUES (?, ?, ?)`,\n    args: [key, JSON.stringify(value), Date.now()],\n  });\n  _emitter.emit(\"settings\", {\n    source: \"settings\",\n    type: \"change\",\n    key,\n    ...(options?.requestSource && { requestSource: options.requestSource }),\n  });\n}\n\nexport async function deleteSetting(\n  key: string,\n  options?: StoreWriteOptions,\n): Promise<boolean> {\n  await ensureTable();\n  const client = getDbExec();\n  const table = settingsTable();\n  const result = await client.execute({\n    sql: `DELETE FROM ${table} WHERE key = ?`,\n    args: [key],\n  });\n  if (result.rowsAffected > 0) {\n    _emitter.emit(\"settings\", {\n      source: \"settings\",\n      type: \"delete\",\n      key,\n      ...(options?.requestSource && { requestSource: options.requestSource }),\n    });\n    return true;\n  }\n  return false;\n}\n\nexport async function getAllSettings(): Promise<\n  Record<string, Record<string, unknown>>\n> {\n  await ensureTable();\n  const client = getDbExec();\n  const table = settingsTable();\n  const { rows } = await client.execute(`SELECT key, value FROM ${table}`);\n  const result: Record<string, Record<string, unknown>> = {};\n  for (const row of rows) {\n    result[row.key as string] = JSON.parse(row.value as string);\n  }\n  return result;\n}\n"]}

package/dist/templates/workspace-core/.agents/skills/audit-log/SKILL.md

@@ -0,0 +1,93 @@
+---
+name: audit-log
+description: >-
+  Durable, access-scoped, append-only record of who changed what app data,
+  when, and whether it was the agent or a human. Use when adding an activity
+  feed or change history, declaring what a mutating action targets, auditing
+  sensitive reads, or answering "what did the agent change / who edited this".
+scope: dev
+metadata:
+  internal: true
+---
+
+# Audit Log
+
+## Rule
+
+Every mutating action automatically records an audit event — **no wiring
+needed**. The framework captures who/what/when/from-where at the `defineAction`
+seam, redacts credentials, and attributes the change to a human or the agent
+(with the agent thread/turn that caused it). You only touch `audit` config to
+make events *more useful* (declare the target) or to opt a read in / a noisy
+write out.
+
+This is distinct from:
+
+- **observability** — sampled agent-run telemetry (traces, evals), developer-facing.
+- **tracking** — fire-and-forget product analytics to external SaaS.
+
+Audit is complete, durable, locally queryable, and scoped to the data it
+describes.
+
+## Declare the target so it lands in the owner's trail
+
+By default an event is scoped to the **actor** (you see your own changes and the
+agent's changes on your behalf). To make a change to a *shared* resource show up
+in the **owner's** audit trail, declare the target:
+
+```ts
+defineAction({
+  description: "Delete a recording",
+  schema: z.object({ id: z.string() }),
+  audit: {
+    // type + id label the event; ownerEmail/orgId/visibility scope who can read it.
+    target: (args, result, meta) => ({
+      type: "recording",
+      id: args.id,
+      // Optional — defaults to the actor. Set when editing someone else's resource.
+      ownerEmail: result?.ownerEmail,
+      visibility: "org",
+    }),
+    summary: (args) => `Deleted recording ${args.id}`,
+  },
+  run: async (args, ctx) => { /* ... */ },
+});
+```
+
+`target`, `ownerEmail`, `visibility`, and `summary` are all optional. The
+minimum useful addition is `target: () => ({ type, id })`.
+
+## Defaults and how to override them
+
+- **Mutations** (anything not GET / `readOnly`) are audited automatically.
+- **Read-only** actions are skipped. Audit a sensitive read (secret access, bulk
+  export) with `audit: { onRead: true }`.
+- **High-frequency framework actions** (app-state sync, context-xray, navigate,
+  appearance) are skipped by default. Force one on with `audit: { enabled: true }`.
+- **Opt a noisy write out** with `audit: { enabled: false }`.
+- **Skip capturing arguments** (large/sensitive payloads) with
+  `audit: { recordInputs: false }`. Inputs are credential-redacted regardless.
+
+## Reading the log
+
+Two actions are available to the agent and the frontend in every app, scoped in
+SQL to the caller — they never leak another tenant's rows:
+
+- `list-audit-events` — filter by `targetType`/`targetId`, `actorKind`
+  (`agent` | `human` | `system`), `status`, `threadId`/`turnId`, `action`,
+  `sinceMs`, `limit`.
+- `get-audit-event` — one event by id, with its redacted input payload.
+
+Call them from the UI with `useActionQuery` to build an activity feed or a
+"who changed this" line — never hand-write a fetch to the audit table.
+
+## Never
+
+- Don't write a parallel "history" table for a resource — declare an `audit.target`
+  and read it back instead.
+- Don't put secrets in `summary` or rely on inputs being safe — redaction covers
+  credential-shaped values, but keep summaries free of sensitive data.
+- Don't expose an update/delete path for audit rows. The log is append-only; the
+  only deletion is the retention purge (`AGENT_NATIVE_AUDIT_RETENTION_DAYS`,
+  default 365 days; `0` = keep forever). Global kill switch:
+  `AGENT_NATIVE_AUDIT_ENABLED=false`.

package/dist/usage/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/usage/store.ts"],"names":[],"mappings":"AAuBA,eAAO,MAAM,sCAAsC,OAAO,CAAC;AAC3D,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,iBAAiB,CAAC;AAEzD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,gBAAgB,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,yBAAyB,GAAG,uBAAuB,CAAC;IAC5D,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,iBAAiB,EAAE,gBAK/B,CAAC;AAEF,eAAO,MAAM,4BAA4B,EAAE,gBAO1C,CAAC;AAEF,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACpC,gBAAgB,CAIlB;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQjE;AA4FD,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAiED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,eAAe,SAAI,EACnB,gBAAgB,SAAI,GACnB,MAAM,CAQR;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AACtE,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAAC;AA6EjB,qEAAqE;AACrE,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS3E;AAID,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,MAAM,EAAE,gBAAgB,EAAE,CAAC;CAC5B;AAID;;;GAGG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,YAAY,CAAC,CAqHvB"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/usage/store.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,sCAAsC,OAAO,CAAC;AAC3D,eAAO,MAAM,6BAA6B,KAAK,CAAC;AAEhD,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,iBAAiB,CAAC;AAEzD,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,gBAAgB,CAAC;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,yBAAyB,GAAG,uBAAuB,CAAC;IAC5D,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,iBAAiB,EAAE,gBAK/B,CAAC;AAEF,eAAO,MAAM,4BAA4B,EAAE,gBAO1C,CAAC;AAEF,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GACpC,gBAAgB,CAIlB;AAED,wBAAgB,2BAA2B,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQjE;AA4FD,MAAM,WAAW,WAAW;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,iFAAiF;IACjF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wFAAwF;IACxF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAsED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,EACb,eAAe,SAAI,EACnB,gBAAgB,SAAI,GACnB,MAAM,CAQR;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;AACtE,wBAAsB,WAAW,CAC/B,UAAU,EAAE,MAAM,EAClB,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAAC;AA6EjB,qEAAqE;AACrE,wBAAsB,iBAAiB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS3E;AAID,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,CAAC;IACnB,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,uBAAuB;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,gBAAgB;IAC/B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,OAAO,CAAC,EAAE,gBAAgB,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,oBAAoB,EAAE,MAAM,CAAC;IAC7B,qBAAqB,EAAE,MAAM,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,OAAO,EAAE,WAAW,EAAE,CAAC;IACvB,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,KAAK,EAAE,WAAW,EAAE,CAAC;IACrB,MAAM,EAAE,gBAAgB,EAAE,CAAC;CAC5B;AAID;;;GAGG;AACH,wBAAsB,eAAe,CACnC,OAAO,EAAE,mBAAmB,GAC3B,OAAO,CAAC,YAAY,CAAC,CAqHvB"}

package/dist/usage/store.js

@@ -8,6 +8,7 @@
  * Cost is stored as "centicents" (1/100th of a cent) for integer precision.
  */
 import { getDbExec, intType, isPostgres } from "../db/client.js";
+import { widenIntColumnsToBigInt } from "../db/widen-columns.js";
 export const BUILDER_AGENT_CREDIT_MARGIN_MULTIPLIER = 1.25;
 export const BUILDER_AGENT_CREDITS_PER_USD = 20;
 export const USD_USAGE_BILLING = {
@@ -171,6 +172,10 @@ async function ensureUsageTable() {
                     // Column already exists — ignore
                 }
             }
+            // Older deployments created `created_at` as 32-bit `INTEGER`; on Postgres
+            // the `Date.now()` written per run by recordUsage() overflows int4. Widen
+            // it in place (no-op once done / on fresh BIGINT databases).
+            await widenIntColumnsToBigInt("token_usage", ["created_at"]);
             try {
                 await client.execute(`CREATE INDEX IF NOT EXISTS idx_token_usage_owner_created ON token_usage (owner_email, created_at)`);
             }

package/dist/usage/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/usage/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAcjE,MAAM,CAAC,MAAM,sCAAsC,GAAG,IAAI,CAAC;AAC3D,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAahD,MAAM,CAAC,MAAM,iBAAiB,GAAqB;IACjD,IAAI,EAAE,KAAK;IACX,KAAK,EAAE,iBAAiB;IACxB,UAAU,EAAE,MAAM;IAClB,MAAM,EAAE,yBAAyB;CAClC,CAAC;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAAqB;IAC5D,IAAI,EAAE,iBAAiB;IACvB,KAAK,EAAE,yBAAyB;IAChC,UAAU,EAAE,SAAS;IACrB,MAAM,EAAE,uBAAuB;IAC/B,wBAAwB,EAAE,sCAAsC;IAChE,aAAa,EAAE,6BAA6B;CAC7C,CAAC;AAEF,MAAM,UAAU,qBAAqB,CACnC,UAAqC;IAErC,OAAO,UAAU,KAAK,SAAS;QAC7B,CAAC,CAAC,4BAA4B;QAC9B,CAAC,CAAC,iBAAiB,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACvD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,KAAK,GAAG,GAAG,CAAC;IAC5B,MAAM,OAAO,GACX,OAAO;QACP,sCAAsC;QACtC,6BAA6B,CAAC;IAChC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;AAC1C,CAAC;AAED,MAAM,OAAO,GAAoD;IAC/D,8EAA8E;IAC9E,uEAAuE;IACvE;QACE,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE;KACzE;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E;QACE,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE;KACtE;IACD,oDAAoD;IACpD;QACE,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE;KACzE;IACD;QACE,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE;KACrE;IACD,+EAA+E;IAC/E,yEAAyE;IACzE,oEAAoE;IACpE,2EAA2E;IAC3E;QACE,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;KACpE;IACD;QACE,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE;KACtE;IACD,+EAA+E;IAC/E,+EAA+E;IAC/E;QACE,KAAK,EAAE,sBAAsB;QAC7B,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;KACpE;IACD,oDAAoD;IACpD;QACE,KAAK,EAAE,6BAA6B;QACpC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;KAChE;IACD,iDAAiD;IACjD;QACE,KAAK,EAAE,kBAAkB;QACzB,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;KACpE;IACD;QACE,KAAK,EAAE,oBAAoB;QAC3B,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;KAChE;IACD,+EAA+E;IAC/E,2CAA2C;IAC3C;QACE,KAAK,EAAE,iBAAiB;QACxB,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;KAChE;IACD,kDAAkD;IAClD;QACE,KAAK,EAAE,0BAA0B;QACjC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;KAC9D;IACD,+EAA+E;IAC/E,iCAAiC;IACjC;QACE,KAAK,EAAE,gBAAgB;QACvB,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;KAClE;IACD,4CAA4C;IAC5C;QACE,KAAK,EAAE,+BAA+B;QACtC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;KAChE;IACD,6CAA6C;IAC7C;QACE,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE;KACtE;CACF,CAAC;AAEF,SAAS,UAAU,CAAC,KAAa;IAC/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACpD,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,OAAO,CAAC;AAC9C,CAAC;AA2BD,IAAI,YAAuC,CAAC;AAE5C,KAAK,UAAU,gBAAgB;IAC7B,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAAC;;eAEZ,OAAO,EAAE;;yBAEC,OAAO,EAAE;0BACR,OAAO,EAAE;8BACL,OAAO,EAAE;+BACR,OAAO,EAAE;4BACZ,OAAO,EAAE;;;;;uBAKd,OAAO,EAAE;;OAEzB,CAAC,CAAC;YAEH,iEAAiE;YACjE,mEAAmE;YACnE,kEAAkE;YAClE,MAAM,SAAS,GAA4B;gBACzC,CAAC,mBAAmB,EAAE,GAAG,OAAO,EAAE,qBAAqB,CAAC;gBACxD,CAAC,oBAAoB,EAAE,GAAG,OAAO,EAAE,qBAAqB,CAAC;gBACzD,CAAC,OAAO,EAAE,8BAA8B,CAAC;gBACzC,CAAC,KAAK,EAAE,0BAA0B,CAAC;gBACnC,CAAC,QAAQ,EAAE,0BAA0B,CAAC;aACvC,CAAC;YACF,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,IAAI,UAAU,EAAE,EAAE,CAAC;wBACjB,MAAM,MAAM,CAAC,OAAO,CAClB,oDAAoD,GAAG,IAAI,GAAG,EAAE,CACjE,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,MAAM,MAAM,CAAC,OAAO,CAClB,sCAAsC,GAAG,IAAI,GAAG,EAAE,CACnD,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,iCAAiC;gBACnC,CAAC;YACH,CAAC;YAED,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,mGAAmG,CACpG,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,sDAAsD;YACtD,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,WAAmB,EACnB,YAAoB,EACpB,KAAa,EACb,eAAe,GAAG,CAAC,EACnB,gBAAgB,GAAG,CAAC;IAEpB,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,aAAa,GACjB,CAAC,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,GAAG;QACzC,CAAC,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,GAAG;QAC3C,CAAC,eAAe,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,SAAS,GAAG,GAAG;QACjD,CAAC,gBAAgB,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,GAAG,CAAC;IACtD,OAAO,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,aAAmC,EACnC,WAAoB,EACpB,YAAqB,EACrB,KAAc;IAEd,MAAM,MAAM,GACV,OAAO,aAAa,KAAK,QAAQ;QAC/B,CAAC,CAAC;YACE,UAAU,EAAE,aAAa;YACzB,WAAW,EAAE,WAAW,IAAI,CAAC;YAC7B,YAAY,EAAE,YAAY,IAAI,CAAC;YAC/B,KAAK,EAAE,KAAK,IAAI,EAAE;SACnB;QACH,CAAC,CAAC,aAAa,CAAC;IAEpB,MAAM,EACJ,UAAU,EACV,WAAW,EAAE,KAAK,EAClB,YAAY,EAAE,MAAM,EACpB,eAAe,GAAG,CAAC,EACnB,gBAAgB,GAAG,CAAC,EACpB,KAAK,EAAE,SAAS,EAChB,KAAK,EACL,GAAG,EACH,KAAK,EACL,aAAa,GACd,GAAG,MAAM,CAAC;IAEX,qEAAqE;IACrE,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,IAAI,CAAC,gBAAgB;QAAE,OAAO;IAEvE,MAAM,gBAAgB,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,WAAW,GACf,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC7D,MAAM,aAAa,GAAG,KAAK,IAAI,MAAM,CAAC;IACtC,MAAM,WAAW,GAAG,KAAK,IAAI,EAAE,CAAC;IAEhC,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE,wDAAwD;YAC7D,IAAI,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,yDAAyD;IACzD,MAAM,QAAQ,GACZ,aAAa;QACb,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC;IAC7E,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IAChE,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE;;kDAEyC;QAC9C,IAAI,EAAE;YACJ,EAAE;YACF,UAAU;YACV,KAAK;YACL,MAAM;YACN,eAAe;YACf,gBAAgB;YAChB,QAAQ;YACR,SAAS;YACT,aAAa;YACb,WAAW;YACX,WAAW;YACX,IAAI,CAAC,GAAG,EAAE;SACX;KACF,CAAC,CAAC;AACL,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACxD,MAAM,gBAAgB,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,0FAA0F;QAC/F,IAAI,EAAE,CAAC,UAAU,CAAC;KACnB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAwB,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;IAClE,OAAO,KAAK,GAAG,GAAG,CAAC;AACrB,CAAC;AAwDD,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA4B;IAE5B,MAAM,gBAAgB,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAE5D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE;;;;;;;iEAOwD;QAC7D,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC;KACpC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAkC,CAAC;IAEpE,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC;QAClC,GAAG,EAAE,UAAU,GAAG;;;;;;;;;iBASL,GAAG;0BACM;QACtB,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC;KACpC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,CAAC,IAAe,EAAiB,EAAE,CACpD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACb,MAAM,GAAG,GAAG,CAA2C,CAAC;QACxD,OAAO;YACL,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACxB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG;YACnC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;YAC7B,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;YACpC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YACtC,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;YACxC,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;SAC1C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACrD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;KACjC,CAAC,CAAC;IAEH,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACnC,GAAG,EAAE;gDACuC;QAC5C,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC;KACpC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4C,CAAC;IACnE,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAqC,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAChB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,KAAK,GAAkB,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SAC/C,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnB,IAAI;QACJ,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACtC,GAAG,EAAE;;;;;;eAMM;QACX,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;KAC3B,CAAC,CAAC;IACH,MAAM,MAAM,GACV,UAAU,CAAC,IACZ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACd,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QACjC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC;QAClC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;QAC1B,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC;QAC1C,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,CAAC;QAC5C,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,CAAC;QACnD,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,CAAC;QACrD,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,GAAG;KAC9C,CAAC,CAAC,CAAC;IAEJ,OAAO;QACL,OAAO,EAAE,iBAAiB;QAC1B,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG;QACtC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAChC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACvC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;QACzC,oBAAoB,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QAC3C,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QAC5C,OAAO;QACP,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAClC,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAClC,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;QAC9B,KAAK;QACL,MAAM;KACP,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Token usage tracking and cost monitoring.\n *\n * Every LLM call made by the framework records a row here so users can\n * see where their spend is going — chat vs automations vs background jobs\n * vs whatever else a template labels its prompts as.\n *\n * Cost is stored as \"centicents\" (1/100th of a cent) for integer precision.\n */\nimport { getDbExec, intType, isPostgres } from \"../db/client.js\";\n\n/**\n * Per-million-token pricing in cents. Cache read is typically ~10% of\n * input; cache write (5m TTL) is ~125%. Pricing is best-effort — keep\n * this table in sync with Anthropic's published prices.\n */\ninterface ModelPricing {\n  input: number;\n  output: number;\n  cacheRead: number;\n  cacheWrite: number;\n}\n\nexport const BUILDER_AGENT_CREDIT_MARGIN_MULTIPLIER = 1.25;\nexport const BUILDER_AGENT_CREDITS_PER_USD = 20;\n\nexport type UsageBillingUnit = \"usd\" | \"builder-credits\";\n\nexport interface UsageBillingMode {\n  unit: UsageBillingUnit;\n  label: string;\n  shortLabel: string;\n  source: \"estimated-provider-cost\" | \"builder-agent-credits\";\n  hardCostMarginMultiplier?: number;\n  creditsPerUsd?: number;\n}\n\nexport const USD_USAGE_BILLING: UsageBillingMode = {\n  unit: \"usd\",\n  label: \"Estimated spend\",\n  shortLabel: \"Cost\",\n  source: \"estimated-provider-cost\",\n};\n\nexport const BUILDER_CREDIT_USAGE_BILLING: UsageBillingMode = {\n  unit: \"builder-credits\",\n  label: \"Builder.io credit spend\",\n  shortLabel: \"Credits\",\n  source: \"builder-agent-credits\",\n  hardCostMarginMultiplier: BUILDER_AGENT_CREDIT_MARGIN_MULTIPLIER,\n  creditsPerUsd: BUILDER_AGENT_CREDITS_PER_USD,\n};\n\nexport function usageBillingForEngine(\n  engineName: string | null | undefined,\n): UsageBillingMode {\n  return engineName === \"builder\"\n    ? BUILDER_CREDIT_USAGE_BILLING\n    : USD_USAGE_BILLING;\n}\n\nexport function builderCreditsFromCostCents(cents: number): number {\n  if (!Number.isFinite(cents) || cents <= 0) return 0;\n  const dollars = cents / 100;\n  const credits =\n    dollars *\n    BUILDER_AGENT_CREDIT_MARGIN_MULTIPLIER *\n    BUILDER_AGENT_CREDITS_PER_USD;\n  return Math.ceil(credits * 1000) / 1000;\n}\n\nconst PRICING: Array<{ match: RegExp; pricing: ModelPricing }> = [\n  // ── Anthropic ──────────────────────────────────────────────────────────────\n  // claude-fable-5: $10/$50 per MTok (Mythos-class, launched 2026-06-09)\n  {\n    match: /fable-5/i,\n    pricing: { input: 1000, output: 5000, cacheRead: 100, cacheWrite: 1250 },\n  },\n  // claude-opus-4-8: $5/$25 standard mode (fast mode same as fable-5 $10/$50)\n  // Use standard-mode pricing as default; fast-mode is a separate model id.\n  {\n    match: /opus-4-8/i,\n    pricing: { input: 500, output: 2500, cacheRead: 50, cacheWrite: 625 },\n  },\n  // claude-opus-4-7 and older opus: ~$15/$75 per MTok\n  {\n    match: /opus/i,\n    pricing: { input: 1500, output: 7500, cacheRead: 150, cacheWrite: 1875 },\n  },\n  {\n    match: /haiku/i,\n    pricing: { input: 100, output: 500, cacheRead: 10, cacheWrite: 125 },\n  },\n  // ── OpenAI / Codex ──────────────────────────────────────────────────────────\n  // Published rates as of 2026-06; OpenAI bills cached input at a discount\n  // and has no separate cache-write token charge, so cacheWrite is 0.\n  // /gpt-5\\.5/ must precede /gpt-5/ since the latter also matches \"gpt-5.5\".\n  {\n    match: /gpt-5\\.5/i,\n    pricing: { input: 500, output: 3000, cacheRead: 50, cacheWrite: 0 },\n  },\n  {\n    match: /gpt-5/i,\n    pricing: { input: 125, output: 1000, cacheRead: 12.5, cacheWrite: 0 },\n  },\n  // ── Google Gemini ───────────────────────────────────────────────────────────\n  // Gemini 3 Pro / 3.1 Pro: ~$1.25/$10 per MTok (approximate; verify on billing)\n  {\n    match: /gemini-3[\\.\\-]1-pro/i,\n    pricing: { input: 125, output: 1000, cacheRead: 31, cacheWrite: 0 },\n  },\n  // Gemini 3.5 Flash / 3 Flash: ~$0.15/$0.60 per MTok\n  {\n    match: /gemini-3[\\.\\-][0-9]+-flash/i,\n    pricing: { input: 15, output: 60, cacheRead: 4, cacheWrite: 0 },\n  },\n  // Gemini 2.5 Pro/Flash (catch-all for older 2.5)\n  {\n    match: /gemini-2\\.5-pro/i,\n    pricing: { input: 125, output: 1000, cacheRead: 31, cacheWrite: 0 },\n  },\n  {\n    match: /gemini-2\\.5-flash/i,\n    pricing: { input: 15, output: 60, cacheRead: 4, cacheWrite: 0 },\n  },\n  // ── Groq ────────────────────────────────────────────────────────────────────\n  // Groq Llama 3.3 70B: $0.59/$0.79 per MTok\n  {\n    match: /llama-3\\.3-70b/i,\n    pricing: { input: 59, output: 79, cacheRead: 0, cacheWrite: 0 },\n  },\n  // Groq Llama 3.1 8B instant: $0.05/$0.08 per MTok\n  {\n    match: /llama-3\\.1-8b|llama3-8b/i,\n    pricing: { input: 5, output: 8, cacheRead: 0, cacheWrite: 0 },\n  },\n  // ── Mistral ─────────────────────────────────────────────────────────────────\n  // Mistral Large: ~$2/$6 per MTok\n  {\n    match: /mistral-large/i,\n    pricing: { input: 200, output: 600, cacheRead: 0, cacheWrite: 0 },\n  },\n  // Mistral Small/Medium: ~$0.2/$0.6 per MTok\n  {\n    match: /mistral-small|mistral-medium/i,\n    pricing: { input: 20, output: 60, cacheRead: 0, cacheWrite: 0 },\n  },\n  // default → sonnet pricing ($3/$15 per MTok)\n  {\n    match: /.*/,\n    pricing: { input: 300, output: 1500, cacheRead: 30, cacheWrite: 375 },\n  },\n];\n\nfunction pricingFor(model: string): ModelPricing {\n  for (const entry of PRICING) {\n    if (entry.match.test(model)) return entry.pricing;\n  }\n  return PRICING[PRICING.length - 1]!.pricing;\n}\n\nexport interface UsageRecord {\n  ownerEmail: string;\n  inputTokens: number;\n  outputTokens: number;\n  cacheReadTokens?: number;\n  cacheWriteTokens?: number;\n  model: string;\n  /** Category for this call — e.g. \"chat\", \"automation\", \"job\", \"custom-agent\". */\n  label?: string;\n  /** Optional template/app name (e.g. \"mail\"). Falls back to AGENT_APP / APP_NAME env. */\n  app?: string;\n  /**\n   * Stable id of the thing this usage belongs to (e.g. a recap plan id). When\n   * set, any prior row(s) with the same (label, refId) are deleted before\n   * insert, so re-recording the same run overwrites instead of double-counting.\n   */\n  refId?: string;\n  /**\n   * Precomputed cost in centicents (1/100¢). When provided, it is stored\n   * verbatim instead of being derived from tokens — e.g. to mirror a\n   * provider-reported dollar cost so two surfaces agree exactly.\n   */\n  costCentsX100?: number;\n}\n\nlet _initPromise: Promise<void> | undefined;\n\nasync function ensureUsageTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      await client.execute(`\n        CREATE TABLE IF NOT EXISTS token_usage (\n          id ${intType()} PRIMARY KEY,\n          owner_email TEXT NOT NULL,\n          input_tokens ${intType()} NOT NULL DEFAULT 0,\n          output_tokens ${intType()} NOT NULL DEFAULT 0,\n          cache_read_tokens ${intType()} NOT NULL DEFAULT 0,\n          cache_write_tokens ${intType()} NOT NULL DEFAULT 0,\n          cost_cents_x100 ${intType()} NOT NULL DEFAULT 0,\n          model TEXT NOT NULL DEFAULT '',\n          label TEXT NOT NULL DEFAULT 'chat',\n          app TEXT NOT NULL DEFAULT '',\n          ref_id TEXT NOT NULL DEFAULT '',\n          created_at ${intType()} NOT NULL\n        )\n      `);\n\n      // Add columns on older deployments that pre-date the label/cache\n      // fields. Each ALTER is wrapped so a dialect without IF NOT EXISTS\n      // (SQLite) still makes progress if only some columns are missing.\n      const additions: Array<[string, string]> = [\n        [\"cache_read_tokens\", `${intType()} NOT NULL DEFAULT 0`],\n        [\"cache_write_tokens\", `${intType()} NOT NULL DEFAULT 0`],\n        [\"label\", `TEXT NOT NULL DEFAULT 'chat'`],\n        [\"app\", `TEXT NOT NULL DEFAULT ''`],\n        [\"ref_id\", `TEXT NOT NULL DEFAULT ''`],\n      ];\n      for (const [col, def] of additions) {\n        try {\n          if (isPostgres()) {\n            await client.execute(\n              `ALTER TABLE token_usage ADD COLUMN IF NOT EXISTS ${col} ${def}`,\n            );\n          } else {\n            await client.execute(\n              `ALTER TABLE token_usage ADD COLUMN ${col} ${def}`,\n            );\n          }\n        } catch {\n          // Column already exists — ignore\n        }\n      }\n\n      try {\n        await client.execute(\n          `CREATE INDEX IF NOT EXISTS idx_token_usage_owner_created ON token_usage (owner_email, created_at)`,\n        );\n      } catch {}\n    })().catch((err) => {\n      // Retry init on the next call after a failed startup.\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\n/**\n * Calculate cost in centicents (1/100th of a cent).\n * Accepts cache tokens so callers that use prompt caching are priced\n * correctly. Non-cache-aware callers can pass 0 for the cache fields.\n */\nexport function calculateCost(\n  inputTokens: number,\n  outputTokens: number,\n  model: string,\n  cacheReadTokens = 0,\n  cacheWriteTokens = 0,\n): number {\n  const p = pricingFor(model);\n  const rawCenticents =\n    (inputTokens / 1_000_000) * p.input * 100 +\n    (outputTokens / 1_000_000) * p.output * 100 +\n    (cacheReadTokens / 1_000_000) * p.cacheRead * 100 +\n    (cacheWriteTokens / 1_000_000) * p.cacheWrite * 100;\n  return rawCenticents > 0 ? Math.max(1, Math.round(rawCenticents)) : 0;\n}\n\n/**\n * Record token usage from an LLM call.\n *\n * Accepts an object with the full set of fields. A positional overload\n * remains for backward compatibility with the older 4-arg signature.\n */\nexport async function recordUsage(record: UsageRecord): Promise<void>;\nexport async function recordUsage(\n  ownerEmail: string,\n  inputTokens: number,\n  outputTokens: number,\n  model: string,\n): Promise<void>;\nexport async function recordUsage(\n  recordOrOwner: UsageRecord | string,\n  inputTokens?: number,\n  outputTokens?: number,\n  model?: string,\n): Promise<void> {\n  const record: UsageRecord =\n    typeof recordOrOwner === \"string\"\n      ? {\n          ownerEmail: recordOrOwner,\n          inputTokens: inputTokens ?? 0,\n          outputTokens: outputTokens ?? 0,\n          model: model ?? \"\",\n        }\n      : recordOrOwner;\n\n  const {\n    ownerEmail,\n    inputTokens: inTok,\n    outputTokens: outTok,\n    cacheReadTokens = 0,\n    cacheWriteTokens = 0,\n    model: modelName,\n    label,\n    app,\n    refId,\n    costCentsX100,\n  } = record;\n\n  // Skip no-op writes (e.g. a stream aborted before any tokens flowed)\n  if (!inTok && !outTok && !cacheReadTokens && !cacheWriteTokens) return;\n\n  await ensureUsageTable();\n  const client = getDbExec();\n  const resolvedApp =\n    app ?? process.env.AGENT_APP ?? process.env.APP_NAME ?? \"\";\n  const resolvedLabel = label ?? \"chat\";\n  const resolvedRef = refId ?? \"\";\n\n  // Replace any prior usage for this (label, refId) so re-recording the same\n  // run — e.g. a recap regenerated on a PR re-push — overwrites instead of\n  // double-counting. No-op when refId is unset (the common per-call path).\n  if (resolvedRef) {\n    await client.execute({\n      sql: `DELETE FROM token_usage WHERE label = ? AND ref_id = ?`,\n      args: [resolvedLabel, resolvedRef],\n    });\n  }\n\n  // Prefer an explicit precomputed cost (e.g. a provider-reported dollar cost);\n  // otherwise derive it from tokens via the pricing table.\n  const costX100 =\n    costCentsX100 ??\n    calculateCost(inTok, outTok, modelName, cacheReadTokens, cacheWriteTokens);\n  const id = Date.now() * 1000 + Math.floor(Math.random() * 1000);\n  await client.execute({\n    sql: `INSERT INTO token_usage\n      (id, owner_email, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, cost_cents_x100, model, label, app, ref_id, created_at)\n      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      id,\n      ownerEmail,\n      inTok,\n      outTok,\n      cacheReadTokens,\n      cacheWriteTokens,\n      costX100,\n      modelName,\n      resolvedLabel,\n      resolvedApp,\n      resolvedRef,\n      Date.now(),\n    ],\n  });\n}\n\n/** Total cost (in cents) charged against a user, across all time. */\nexport async function getUserUsageCents(ownerEmail: string): Promise<number> {\n  await ensureUsageTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT COALESCE(SUM(cost_cents_x100), 0) as total FROM token_usage WHERE owner_email = ?`,\n    args: [ownerEmail],\n  });\n  const total = Number((rows[0] as { total?: number })?.total ?? 0);\n  return total / 100;\n}\n\n// ─── Admin / UI queries ─────────────────────────────────────────────────\n\nexport interface UsageSummaryOptions {\n  ownerEmail: string;\n  /** Inclusive lower bound (ms since epoch). Defaults to 30 days ago. */\n  sinceMs?: number;\n}\n\nexport interface UsageBucket {\n  key: string;\n  inputTokens: number;\n  outputTokens: number;\n  cacheReadTokens: number;\n  cacheWriteTokens: number;\n  cents: number;\n  calls: number;\n}\n\nexport interface DailyBucket {\n  /** YYYY-MM-DD (UTC) */\n  date: string;\n  cents: number;\n  calls: number;\n}\n\nexport interface UsageRecentEntry {\n  id: number;\n  createdAt: number;\n  label: string;\n  app: string;\n  model: string;\n  inputTokens: number;\n  outputTokens: number;\n  cacheReadTokens: number;\n  cacheWriteTokens: number;\n  cents: number;\n}\n\nexport interface UsageSummary {\n  billing?: UsageBillingMode;\n  totalCents: number;\n  totalCalls: number;\n  totalInputTokens: number;\n  totalOutputTokens: number;\n  totalCacheReadTokens: number;\n  totalCacheWriteTokens: number;\n  sinceMs: number;\n  byLabel: UsageBucket[];\n  byModel: UsageBucket[];\n  byApp: UsageBucket[];\n  byDay: DailyBucket[];\n  recent: UsageRecentEntry[];\n}\n\nconst DAY_MS = 86_400_000;\n\n/**\n * Produce an aggregated spend view for the Usage admin panel.\n * Scoped to the passed owner email; the UI always passes the session user.\n */\nexport async function getUsageSummary(\n  options: UsageSummaryOptions,\n): Promise<UsageSummary> {\n  await ensureUsageTable();\n  const client = getDbExec();\n  const sinceMs = options.sinceMs ?? Date.now() - 30 * DAY_MS;\n\n  const totalRow = await client.execute({\n    sql: `SELECT\n      COALESCE(SUM(cost_cents_x100), 0) AS cents,\n      COUNT(*) AS calls,\n      COALESCE(SUM(input_tokens), 0) AS in_tok,\n      COALESCE(SUM(output_tokens), 0) AS out_tok,\n      COALESCE(SUM(cache_read_tokens), 0) AS cr_tok,\n      COALESCE(SUM(cache_write_tokens), 0) AS cw_tok\n      FROM token_usage WHERE owner_email = ? AND created_at >= ?`,\n    args: [options.ownerEmail, sinceMs],\n  });\n  const t = (totalRow.rows[0] ?? {}) as Record<string, number | null>;\n\n  const bucketSql = (col: string) => ({\n    sql: `SELECT ${col} AS k,\n        COALESCE(SUM(cost_cents_x100), 0) AS cents,\n        COUNT(*) AS calls,\n        COALESCE(SUM(input_tokens), 0) AS in_tok,\n        COALESCE(SUM(output_tokens), 0) AS out_tok,\n        COALESCE(SUM(cache_read_tokens), 0) AS cr_tok,\n        COALESCE(SUM(cache_write_tokens), 0) AS cw_tok\n      FROM token_usage\n      WHERE owner_email = ? AND created_at >= ?\n      GROUP BY ${col}\n      ORDER BY cents DESC`,\n    args: [options.ownerEmail, sinceMs],\n  });\n\n  const mapBuckets = (rows: unknown[]): UsageBucket[] =>\n    rows.map((r) => {\n      const row = r as Record<string, number | string | null>;\n      return {\n        key: String(row.k ?? \"\"),\n        cents: Number(row.cents ?? 0) / 100,\n        calls: Number(row.calls ?? 0),\n        inputTokens: Number(row.in_tok ?? 0),\n        outputTokens: Number(row.out_tok ?? 0),\n        cacheReadTokens: Number(row.cr_tok ?? 0),\n        cacheWriteTokens: Number(row.cw_tok ?? 0),\n      };\n    });\n\n  const [byLabelR, byModelR, byAppR] = await Promise.all([\n    client.execute(bucketSql(\"label\")),\n    client.execute(bucketSql(\"model\")),\n    client.execute(bucketSql(\"app\")),\n  ]);\n\n  // By-day aggregation — done in JS so we don't depend on dialect-specific\n  // date functions (SQLite `strftime`, Postgres `to_char`). Cheap enough\n  // for a 30-day window; if this grows, swap for a dialect-aware query.\n  const dayRows = await client.execute({\n    sql: `SELECT created_at, cost_cents_x100 FROM token_usage\n      WHERE owner_email = ? AND created_at >= ?`,\n    args: [options.ownerEmail, sinceMs],\n  });\n  const dayMap = new Map<string, { cents: number; calls: number }>();\n  for (const row of dayRows.rows as Array<Record<string, number>>) {\n    const date = new Date(Number(row.created_at)).toISOString().slice(0, 10);\n    const prev = dayMap.get(date) ?? { cents: 0, calls: 0 };\n    prev.cents += Number(row.cost_cents_x100 ?? 0);\n    prev.calls += 1;\n    dayMap.set(date, prev);\n  }\n  const byDay: DailyBucket[] = [...dayMap.entries()]\n    .map(([date, v]) => ({\n      date,\n      cents: v.cents / 100,\n      calls: v.calls,\n    }))\n    .sort((a, b) => a.date.localeCompare(b.date));\n\n  const recentRows = await client.execute({\n    sql: `SELECT id, created_at, label, app, model,\n        input_tokens, output_tokens, cache_read_tokens, cache_write_tokens,\n        cost_cents_x100\n      FROM token_usage\n      WHERE owner_email = ?\n      ORDER BY created_at DESC\n      LIMIT 50`,\n    args: [options.ownerEmail],\n  });\n  const recent: UsageRecentEntry[] = (\n    recentRows.rows as Array<Record<string, number | string | null>>\n  ).map((row) => ({\n    id: Number(row.id),\n    createdAt: Number(row.created_at),\n    label: String(row.label ?? \"chat\"),\n    app: String(row.app ?? \"\"),\n    model: String(row.model ?? \"\"),\n    inputTokens: Number(row.input_tokens ?? 0),\n    outputTokens: Number(row.output_tokens ?? 0),\n    cacheReadTokens: Number(row.cache_read_tokens ?? 0),\n    cacheWriteTokens: Number(row.cache_write_tokens ?? 0),\n    cents: Number(row.cost_cents_x100 ?? 0) / 100,\n  }));\n\n  return {\n    billing: USD_USAGE_BILLING,\n    totalCents: Number(t.cents ?? 0) / 100,\n    totalCalls: Number(t.calls ?? 0),\n    totalInputTokens: Number(t.in_tok ?? 0),\n    totalOutputTokens: Number(t.out_tok ?? 0),\n    totalCacheReadTokens: Number(t.cr_tok ?? 0),\n    totalCacheWriteTokens: Number(t.cw_tok ?? 0),\n    sinceMs,\n    byLabel: mapBuckets(byLabelR.rows),\n    byModel: mapBuckets(byModelR.rows),\n    byApp: mapBuckets(byAppR.rows),\n    byDay,\n    recent,\n  };\n}\n"]}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../src/usage/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AACjE,OAAO,EAAE,uBAAuB,EAAE,MAAM,wBAAwB,CAAC;AAcjE,MAAM,CAAC,MAAM,sCAAsC,GAAG,IAAI,CAAC;AAC3D,MAAM,CAAC,MAAM,6BAA6B,GAAG,EAAE,CAAC;AAahD,MAAM,CAAC,MAAM,iBAAiB,GAAqB;IACjD,IAAI,EAAE,KAAK;IACX,KAAK,EAAE,iBAAiB;IACxB,UAAU,EAAE,MAAM;IAClB,MAAM,EAAE,yBAAyB;CAClC,CAAC;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAAqB;IAC5D,IAAI,EAAE,iBAAiB;IACvB,KAAK,EAAE,yBAAyB;IAChC,UAAU,EAAE,SAAS;IACrB,MAAM,EAAE,uBAAuB;IAC/B,wBAAwB,EAAE,sCAAsC;IAChE,aAAa,EAAE,6BAA6B;CAC7C,CAAC;AAEF,MAAM,UAAU,qBAAqB,CACnC,UAAqC;IAErC,OAAO,UAAU,KAAK,SAAS;QAC7B,CAAC,CAAC,4BAA4B;QAC9B,CAAC,CAAC,iBAAiB,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,2BAA2B,CAAC,KAAa;IACvD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;QAAE,OAAO,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,KAAK,GAAG,GAAG,CAAC;IAC5B,MAAM,OAAO,GACX,OAAO;QACP,sCAAsC;QACtC,6BAA6B,CAAC;IAChC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;AAC1C,CAAC;AAED,MAAM,OAAO,GAAoD;IAC/D,8EAA8E;IAC9E,uEAAuE;IACvE;QACE,KAAK,EAAE,UAAU;QACjB,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE;KACzE;IACD,4EAA4E;IAC5E,0EAA0E;IAC1E;QACE,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE;KACtE;IACD,oDAAoD;IACpD;QACE,KAAK,EAAE,OAAO;QACd,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE;KACzE;IACD;QACE,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE;KACrE;IACD,+EAA+E;IAC/E,yEAAyE;IACzE,oEAAoE;IACpE,2EAA2E;IAC3E;QACE,KAAK,EAAE,WAAW;QAClB,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;KACpE;IACD;QACE,KAAK,EAAE,QAAQ;QACf,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE;KACtE;IACD,+EAA+E;IAC/E,+EAA+E;IAC/E;QACE,KAAK,EAAE,sBAAsB;QAC7B,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;KACpE;IACD,oDAAoD;IACpD;QACE,KAAK,EAAE,6BAA6B;QACpC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;KAChE;IACD,iDAAiD;IACjD;QACE,KAAK,EAAE,kBAAkB;QACzB,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE;KACpE;IACD;QACE,KAAK,EAAE,oBAAoB;QAC3B,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;KAChE;IACD,+EAA+E;IAC/E,2CAA2C;IAC3C;QACE,KAAK,EAAE,iBAAiB;QACxB,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;KAChE;IACD,kDAAkD;IAClD;QACE,KAAK,EAAE,0BAA0B;QACjC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;KAC9D;IACD,+EAA+E;IAC/E,iCAAiC;IACjC;QACE,KAAK,EAAE,gBAAgB;QACvB,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;KAClE;IACD,4CAA4C;IAC5C;QACE,KAAK,EAAE,+BAA+B;QACtC,OAAO,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE;KAChE;IACD,6CAA6C;IAC7C;QACE,KAAK,EAAE,IAAI;QACX,OAAO,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE;KACtE;CACF,CAAC;AAEF,SAAS,UAAU,CAAC,KAAa;IAC/B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACpD,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAE,CAAC,OAAO,CAAC;AAC9C,CAAC;AA2BD,IAAI,YAAuC,CAAC;AAE5C,KAAK,UAAU,gBAAgB;IAC7B,IAAI,CAAC,YAAY,EAAE,CAAC;QAClB,YAAY,GAAG,CAAC,KAAK,IAAI,EAAE;YACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;YAC3B,MAAM,MAAM,CAAC,OAAO,CAAC;;eAEZ,OAAO,EAAE;;yBAEC,OAAO,EAAE;0BACR,OAAO,EAAE;8BACL,OAAO,EAAE;+BACR,OAAO,EAAE;4BACZ,OAAO,EAAE;;;;;uBAKd,OAAO,EAAE;;OAEzB,CAAC,CAAC;YAEH,iEAAiE;YACjE,mEAAmE;YACnE,kEAAkE;YAClE,MAAM,SAAS,GAA4B;gBACzC,CAAC,mBAAmB,EAAE,GAAG,OAAO,EAAE,qBAAqB,CAAC;gBACxD,CAAC,oBAAoB,EAAE,GAAG,OAAO,EAAE,qBAAqB,CAAC;gBACzD,CAAC,OAAO,EAAE,8BAA8B,CAAC;gBACzC,CAAC,KAAK,EAAE,0BAA0B,CAAC;gBACnC,CAAC,QAAQ,EAAE,0BAA0B,CAAC;aACvC,CAAC;YACF,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,SAAS,EAAE,CAAC;gBACnC,IAAI,CAAC;oBACH,IAAI,UAAU,EAAE,EAAE,CAAC;wBACjB,MAAM,MAAM,CAAC,OAAO,CAClB,oDAAoD,GAAG,IAAI,GAAG,EAAE,CACjE,CAAC;oBACJ,CAAC;yBAAM,CAAC;wBACN,MAAM,MAAM,CAAC,OAAO,CAClB,sCAAsC,GAAG,IAAI,GAAG,EAAE,CACnD,CAAC;oBACJ,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,iCAAiC;gBACnC,CAAC;YACH,CAAC;YAED,0EAA0E;YAC1E,0EAA0E;YAC1E,6DAA6D;YAC7D,MAAM,uBAAuB,CAAC,aAAa,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC;YAE7D,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,OAAO,CAClB,mGAAmG,CACpG,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC,CAAA,CAAC;QACZ,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACjB,sDAAsD;YACtD,YAAY,GAAG,SAAS,CAAC;YACzB,MAAM,GAAG,CAAC;QACZ,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAC3B,WAAmB,EACnB,YAAoB,EACpB,KAAa,EACb,eAAe,GAAG,CAAC,EACnB,gBAAgB,GAAG,CAAC;IAEpB,MAAM,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IAC5B,MAAM,aAAa,GACjB,CAAC,WAAW,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG,GAAG;QACzC,CAAC,YAAY,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,GAAG;QAC3C,CAAC,eAAe,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,SAAS,GAAG,GAAG;QACjD,CAAC,gBAAgB,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,GAAG,CAAC;IACtD,OAAO,aAAa,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxE,CAAC;AAeD,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,aAAmC,EACnC,WAAoB,EACpB,YAAqB,EACrB,KAAc;IAEd,MAAM,MAAM,GACV,OAAO,aAAa,KAAK,QAAQ;QAC/B,CAAC,CAAC;YACE,UAAU,EAAE,aAAa;YACzB,WAAW,EAAE,WAAW,IAAI,CAAC;YAC7B,YAAY,EAAE,YAAY,IAAI,CAAC;YAC/B,KAAK,EAAE,KAAK,IAAI,EAAE;SACnB;QACH,CAAC,CAAC,aAAa,CAAC;IAEpB,MAAM,EACJ,UAAU,EACV,WAAW,EAAE,KAAK,EAClB,YAAY,EAAE,MAAM,EACpB,eAAe,GAAG,CAAC,EACnB,gBAAgB,GAAG,CAAC,EACpB,KAAK,EAAE,SAAS,EAChB,KAAK,EACL,GAAG,EACH,KAAK,EACL,aAAa,GACd,GAAG,MAAM,CAAC;IAEX,qEAAqE;IACrE,IAAI,CAAC,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,eAAe,IAAI,CAAC,gBAAgB;QAAE,OAAO;IAEvE,MAAM,gBAAgB,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,WAAW,GACf,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC7D,MAAM,aAAa,GAAG,KAAK,IAAI,MAAM,CAAC;IACtC,MAAM,WAAW,GAAG,KAAK,IAAI,EAAE,CAAC;IAEhC,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,MAAM,CAAC,OAAO,CAAC;YACnB,GAAG,EAAE,wDAAwD;YAC7D,IAAI,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IAED,8EAA8E;IAC9E,yDAAyD;IACzD,MAAM,QAAQ,GACZ,aAAa;QACb,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,eAAe,EAAE,gBAAgB,CAAC,CAAC;IAC7E,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC;IAChE,MAAM,MAAM,CAAC,OAAO,CAAC;QACnB,GAAG,EAAE;;kDAEyC;QAC9C,IAAI,EAAE;YACJ,EAAE;YACF,UAAU;YACV,KAAK;YACL,MAAM;YACN,eAAe;YACf,gBAAgB;YAChB,QAAQ;YACR,SAAS;YACT,aAAa;YACb,WAAW;YACX,WAAW;YACX,IAAI,CAAC,GAAG,EAAE;SACX;KACF,CAAC,CAAC;AACL,CAAC;AAED,qEAAqE;AACrE,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAkB;IACxD,MAAM,gBAAgB,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE,0FAA0F;QAC/F,IAAI,EAAE,CAAC,UAAU,CAAC;KACnB,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,CAAE,IAAI,CAAC,CAAC,CAAwB,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;IAClE,OAAO,KAAK,GAAG,GAAG,CAAC;AACrB,CAAC;AAwDD,MAAM,MAAM,GAAG,UAAU,CAAC;AAE1B;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,OAA4B;IAE5B,MAAM,gBAAgB,EAAE,CAAC;IACzB,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;IAE5D,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACpC,GAAG,EAAE;;;;;;;iEAOwD;QAC7D,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC;KACpC,CAAC,CAAC;IACH,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAkC,CAAC;IAEpE,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,CAAC;QAClC,GAAG,EAAE,UAAU,GAAG;;;;;;;;;iBASL,GAAG;0BACM;QACtB,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC;KACpC,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,CAAC,IAAe,EAAiB,EAAE,CACpD,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACb,MAAM,GAAG,GAAG,CAA2C,CAAC;QACxD,OAAO;YACL,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;YACxB,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG;YACnC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;YAC7B,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;YACpC,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;YACtC,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;YACxC,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC;SAC1C,CAAC;IACJ,CAAC,CAAC,CAAC;IAEL,MAAM,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACrD,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;KACjC,CAAC,CAAC;IAEH,yEAAyE;IACzE,uEAAuE;IACvE,sEAAsE;IACtE,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACnC,GAAG,EAAE;gDACuC;QAC5C,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC;KACpC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4C,CAAC;IACnE,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,IAAqC,EAAE,CAAC;QAChE,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACzE,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;QACxD,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAChB,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,MAAM,KAAK,GAAkB,CAAC,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;SAC/C,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACnB,IAAI;QACJ,KAAK,EAAE,CAAC,CAAC,KAAK,GAAG,GAAG;QACpB,KAAK,EAAE,CAAC,CAAC,KAAK;KACf,CAAC,CAAC;SACF,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAEhD,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC;QACtC,GAAG,EAAE;;;;;;eAMM;QACX,IAAI,EAAE,CAAC,OAAO,CAAC,UAAU,CAAC;KAC3B,CAAC,CAAC;IACH,MAAM,MAAM,GACV,UAAU,CAAC,IACZ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACd,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QACjC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC;QAClC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC;QAC1B,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;QAC9B,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,CAAC;QAC1C,YAAY,EAAE,MAAM,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,CAAC;QAC5C,eAAe,EAAE,MAAM,CAAC,GAAG,CAAC,iBAAiB,IAAI,CAAC,CAAC;QACnD,gBAAgB,EAAE,MAAM,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,CAAC;QACrD,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,CAAC,GAAG,GAAG;KAC9C,CAAC,CAAC,CAAC;IAEJ,OAAO;QACL,OAAO,EAAE,iBAAiB;QAC1B,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG;QACtC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QAChC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QACvC,iBAAiB,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC;QACzC,oBAAoB,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QAC3C,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;QAC5C,OAAO;QACP,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAClC,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC;QAClC,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;QAC9B,KAAK;QACL,MAAM;KACP,CAAC;AACJ,CAAC","sourcesContent":["/**\n * Token usage tracking and cost monitoring.\n *\n * Every LLM call made by the framework records a row here so users can\n * see where their spend is going — chat vs automations vs background jobs\n * vs whatever else a template labels its prompts as.\n *\n * Cost is stored as \"centicents\" (1/100th of a cent) for integer precision.\n */\nimport { getDbExec, intType, isPostgres } from \"../db/client.js\";\nimport { widenIntColumnsToBigInt } from \"../db/widen-columns.js\";\n\n/**\n * Per-million-token pricing in cents. Cache read is typically ~10% of\n * input; cache write (5m TTL) is ~125%. Pricing is best-effort — keep\n * this table in sync with Anthropic's published prices.\n */\ninterface ModelPricing {\n  input: number;\n  output: number;\n  cacheRead: number;\n  cacheWrite: number;\n}\n\nexport const BUILDER_AGENT_CREDIT_MARGIN_MULTIPLIER = 1.25;\nexport const BUILDER_AGENT_CREDITS_PER_USD = 20;\n\nexport type UsageBillingUnit = \"usd\" | \"builder-credits\";\n\nexport interface UsageBillingMode {\n  unit: UsageBillingUnit;\n  label: string;\n  shortLabel: string;\n  source: \"estimated-provider-cost\" | \"builder-agent-credits\";\n  hardCostMarginMultiplier?: number;\n  creditsPerUsd?: number;\n}\n\nexport const USD_USAGE_BILLING: UsageBillingMode = {\n  unit: \"usd\",\n  label: \"Estimated spend\",\n  shortLabel: \"Cost\",\n  source: \"estimated-provider-cost\",\n};\n\nexport const BUILDER_CREDIT_USAGE_BILLING: UsageBillingMode = {\n  unit: \"builder-credits\",\n  label: \"Builder.io credit spend\",\n  shortLabel: \"Credits\",\n  source: \"builder-agent-credits\",\n  hardCostMarginMultiplier: BUILDER_AGENT_CREDIT_MARGIN_MULTIPLIER,\n  creditsPerUsd: BUILDER_AGENT_CREDITS_PER_USD,\n};\n\nexport function usageBillingForEngine(\n  engineName: string | null | undefined,\n): UsageBillingMode {\n  return engineName === \"builder\"\n    ? BUILDER_CREDIT_USAGE_BILLING\n    : USD_USAGE_BILLING;\n}\n\nexport function builderCreditsFromCostCents(cents: number): number {\n  if (!Number.isFinite(cents) || cents <= 0) return 0;\n  const dollars = cents / 100;\n  const credits =\n    dollars *\n    BUILDER_AGENT_CREDIT_MARGIN_MULTIPLIER *\n    BUILDER_AGENT_CREDITS_PER_USD;\n  return Math.ceil(credits * 1000) / 1000;\n}\n\nconst PRICING: Array<{ match: RegExp; pricing: ModelPricing }> = [\n  // ── Anthropic ──────────────────────────────────────────────────────────────\n  // claude-fable-5: $10/$50 per MTok (Mythos-class, launched 2026-06-09)\n  {\n    match: /fable-5/i,\n    pricing: { input: 1000, output: 5000, cacheRead: 100, cacheWrite: 1250 },\n  },\n  // claude-opus-4-8: $5/$25 standard mode (fast mode same as fable-5 $10/$50)\n  // Use standard-mode pricing as default; fast-mode is a separate model id.\n  {\n    match: /opus-4-8/i,\n    pricing: { input: 500, output: 2500, cacheRead: 50, cacheWrite: 625 },\n  },\n  // claude-opus-4-7 and older opus: ~$15/$75 per MTok\n  {\n    match: /opus/i,\n    pricing: { input: 1500, output: 7500, cacheRead: 150, cacheWrite: 1875 },\n  },\n  {\n    match: /haiku/i,\n    pricing: { input: 100, output: 500, cacheRead: 10, cacheWrite: 125 },\n  },\n  // ── OpenAI / Codex ──────────────────────────────────────────────────────────\n  // Published rates as of 2026-06; OpenAI bills cached input at a discount\n  // and has no separate cache-write token charge, so cacheWrite is 0.\n  // /gpt-5\\.5/ must precede /gpt-5/ since the latter also matches \"gpt-5.5\".\n  {\n    match: /gpt-5\\.5/i,\n    pricing: { input: 500, output: 3000, cacheRead: 50, cacheWrite: 0 },\n  },\n  {\n    match: /gpt-5/i,\n    pricing: { input: 125, output: 1000, cacheRead: 12.5, cacheWrite: 0 },\n  },\n  // ── Google Gemini ───────────────────────────────────────────────────────────\n  // Gemini 3 Pro / 3.1 Pro: ~$1.25/$10 per MTok (approximate; verify on billing)\n  {\n    match: /gemini-3[\\.\\-]1-pro/i,\n    pricing: { input: 125, output: 1000, cacheRead: 31, cacheWrite: 0 },\n  },\n  // Gemini 3.5 Flash / 3 Flash: ~$0.15/$0.60 per MTok\n  {\n    match: /gemini-3[\\.\\-][0-9]+-flash/i,\n    pricing: { input: 15, output: 60, cacheRead: 4, cacheWrite: 0 },\n  },\n  // Gemini 2.5 Pro/Flash (catch-all for older 2.5)\n  {\n    match: /gemini-2\\.5-pro/i,\n    pricing: { input: 125, output: 1000, cacheRead: 31, cacheWrite: 0 },\n  },\n  {\n    match: /gemini-2\\.5-flash/i,\n    pricing: { input: 15, output: 60, cacheRead: 4, cacheWrite: 0 },\n  },\n  // ── Groq ────────────────────────────────────────────────────────────────────\n  // Groq Llama 3.3 70B: $0.59/$0.79 per MTok\n  {\n    match: /llama-3\\.3-70b/i,\n    pricing: { input: 59, output: 79, cacheRead: 0, cacheWrite: 0 },\n  },\n  // Groq Llama 3.1 8B instant: $0.05/$0.08 per MTok\n  {\n    match: /llama-3\\.1-8b|llama3-8b/i,\n    pricing: { input: 5, output: 8, cacheRead: 0, cacheWrite: 0 },\n  },\n  // ── Mistral ─────────────────────────────────────────────────────────────────\n  // Mistral Large: ~$2/$6 per MTok\n  {\n    match: /mistral-large/i,\n    pricing: { input: 200, output: 600, cacheRead: 0, cacheWrite: 0 },\n  },\n  // Mistral Small/Medium: ~$0.2/$0.6 per MTok\n  {\n    match: /mistral-small|mistral-medium/i,\n    pricing: { input: 20, output: 60, cacheRead: 0, cacheWrite: 0 },\n  },\n  // default → sonnet pricing ($3/$15 per MTok)\n  {\n    match: /.*/,\n    pricing: { input: 300, output: 1500, cacheRead: 30, cacheWrite: 375 },\n  },\n];\n\nfunction pricingFor(model: string): ModelPricing {\n  for (const entry of PRICING) {\n    if (entry.match.test(model)) return entry.pricing;\n  }\n  return PRICING[PRICING.length - 1]!.pricing;\n}\n\nexport interface UsageRecord {\n  ownerEmail: string;\n  inputTokens: number;\n  outputTokens: number;\n  cacheReadTokens?: number;\n  cacheWriteTokens?: number;\n  model: string;\n  /** Category for this call — e.g. \"chat\", \"automation\", \"job\", \"custom-agent\". */\n  label?: string;\n  /** Optional template/app name (e.g. \"mail\"). Falls back to AGENT_APP / APP_NAME env. */\n  app?: string;\n  /**\n   * Stable id of the thing this usage belongs to (e.g. a recap plan id). When\n   * set, any prior row(s) with the same (label, refId) are deleted before\n   * insert, so re-recording the same run overwrites instead of double-counting.\n   */\n  refId?: string;\n  /**\n   * Precomputed cost in centicents (1/100¢). When provided, it is stored\n   * verbatim instead of being derived from tokens — e.g. to mirror a\n   * provider-reported dollar cost so two surfaces agree exactly.\n   */\n  costCentsX100?: number;\n}\n\nlet _initPromise: Promise<void> | undefined;\n\nasync function ensureUsageTable(): Promise<void> {\n  if (!_initPromise) {\n    _initPromise = (async () => {\n      const client = getDbExec();\n      await client.execute(`\n        CREATE TABLE IF NOT EXISTS token_usage (\n          id ${intType()} PRIMARY KEY,\n          owner_email TEXT NOT NULL,\n          input_tokens ${intType()} NOT NULL DEFAULT 0,\n          output_tokens ${intType()} NOT NULL DEFAULT 0,\n          cache_read_tokens ${intType()} NOT NULL DEFAULT 0,\n          cache_write_tokens ${intType()} NOT NULL DEFAULT 0,\n          cost_cents_x100 ${intType()} NOT NULL DEFAULT 0,\n          model TEXT NOT NULL DEFAULT '',\n          label TEXT NOT NULL DEFAULT 'chat',\n          app TEXT NOT NULL DEFAULT '',\n          ref_id TEXT NOT NULL DEFAULT '',\n          created_at ${intType()} NOT NULL\n        )\n      `);\n\n      // Add columns on older deployments that pre-date the label/cache\n      // fields. Each ALTER is wrapped so a dialect without IF NOT EXISTS\n      // (SQLite) still makes progress if only some columns are missing.\n      const additions: Array<[string, string]> = [\n        [\"cache_read_tokens\", `${intType()} NOT NULL DEFAULT 0`],\n        [\"cache_write_tokens\", `${intType()} NOT NULL DEFAULT 0`],\n        [\"label\", `TEXT NOT NULL DEFAULT 'chat'`],\n        [\"app\", `TEXT NOT NULL DEFAULT ''`],\n        [\"ref_id\", `TEXT NOT NULL DEFAULT ''`],\n      ];\n      for (const [col, def] of additions) {\n        try {\n          if (isPostgres()) {\n            await client.execute(\n              `ALTER TABLE token_usage ADD COLUMN IF NOT EXISTS ${col} ${def}`,\n            );\n          } else {\n            await client.execute(\n              `ALTER TABLE token_usage ADD COLUMN ${col} ${def}`,\n            );\n          }\n        } catch {\n          // Column already exists — ignore\n        }\n      }\n\n      // Older deployments created `created_at` as 32-bit `INTEGER`; on Postgres\n      // the `Date.now()` written per run by recordUsage() overflows int4. Widen\n      // it in place (no-op once done / on fresh BIGINT databases).\n      await widenIntColumnsToBigInt(\"token_usage\", [\"created_at\"]);\n\n      try {\n        await client.execute(\n          `CREATE INDEX IF NOT EXISTS idx_token_usage_owner_created ON token_usage (owner_email, created_at)`,\n        );\n      } catch {}\n    })().catch((err) => {\n      // Retry init on the next call after a failed startup.\n      _initPromise = undefined;\n      throw err;\n    });\n  }\n  return _initPromise;\n}\n\n/**\n * Calculate cost in centicents (1/100th of a cent).\n * Accepts cache tokens so callers that use prompt caching are priced\n * correctly. Non-cache-aware callers can pass 0 for the cache fields.\n */\nexport function calculateCost(\n  inputTokens: number,\n  outputTokens: number,\n  model: string,\n  cacheReadTokens = 0,\n  cacheWriteTokens = 0,\n): number {\n  const p = pricingFor(model);\n  const rawCenticents =\n    (inputTokens / 1_000_000) * p.input * 100 +\n    (outputTokens / 1_000_000) * p.output * 100 +\n    (cacheReadTokens / 1_000_000) * p.cacheRead * 100 +\n    (cacheWriteTokens / 1_000_000) * p.cacheWrite * 100;\n  return rawCenticents > 0 ? Math.max(1, Math.round(rawCenticents)) : 0;\n}\n\n/**\n * Record token usage from an LLM call.\n *\n * Accepts an object with the full set of fields. A positional overload\n * remains for backward compatibility with the older 4-arg signature.\n */\nexport async function recordUsage(record: UsageRecord): Promise<void>;\nexport async function recordUsage(\n  ownerEmail: string,\n  inputTokens: number,\n  outputTokens: number,\n  model: string,\n): Promise<void>;\nexport async function recordUsage(\n  recordOrOwner: UsageRecord | string,\n  inputTokens?: number,\n  outputTokens?: number,\n  model?: string,\n): Promise<void> {\n  const record: UsageRecord =\n    typeof recordOrOwner === \"string\"\n      ? {\n          ownerEmail: recordOrOwner,\n          inputTokens: inputTokens ?? 0,\n          outputTokens: outputTokens ?? 0,\n          model: model ?? \"\",\n        }\n      : recordOrOwner;\n\n  const {\n    ownerEmail,\n    inputTokens: inTok,\n    outputTokens: outTok,\n    cacheReadTokens = 0,\n    cacheWriteTokens = 0,\n    model: modelName,\n    label,\n    app,\n    refId,\n    costCentsX100,\n  } = record;\n\n  // Skip no-op writes (e.g. a stream aborted before any tokens flowed)\n  if (!inTok && !outTok && !cacheReadTokens && !cacheWriteTokens) return;\n\n  await ensureUsageTable();\n  const client = getDbExec();\n  const resolvedApp =\n    app ?? process.env.AGENT_APP ?? process.env.APP_NAME ?? \"\";\n  const resolvedLabel = label ?? \"chat\";\n  const resolvedRef = refId ?? \"\";\n\n  // Replace any prior usage for this (label, refId) so re-recording the same\n  // run — e.g. a recap regenerated on a PR re-push — overwrites instead of\n  // double-counting. No-op when refId is unset (the common per-call path).\n  if (resolvedRef) {\n    await client.execute({\n      sql: `DELETE FROM token_usage WHERE label = ? AND ref_id = ?`,\n      args: [resolvedLabel, resolvedRef],\n    });\n  }\n\n  // Prefer an explicit precomputed cost (e.g. a provider-reported dollar cost);\n  // otherwise derive it from tokens via the pricing table.\n  const costX100 =\n    costCentsX100 ??\n    calculateCost(inTok, outTok, modelName, cacheReadTokens, cacheWriteTokens);\n  const id = Date.now() * 1000 + Math.floor(Math.random() * 1000);\n  await client.execute({\n    sql: `INSERT INTO token_usage\n      (id, owner_email, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, cost_cents_x100, model, label, app, ref_id, created_at)\n      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,\n    args: [\n      id,\n      ownerEmail,\n      inTok,\n      outTok,\n      cacheReadTokens,\n      cacheWriteTokens,\n      costX100,\n      modelName,\n      resolvedLabel,\n      resolvedApp,\n      resolvedRef,\n      Date.now(),\n    ],\n  });\n}\n\n/** Total cost (in cents) charged against a user, across all time. */\nexport async function getUserUsageCents(ownerEmail: string): Promise<number> {\n  await ensureUsageTable();\n  const client = getDbExec();\n  const { rows } = await client.execute({\n    sql: `SELECT COALESCE(SUM(cost_cents_x100), 0) as total FROM token_usage WHERE owner_email = ?`,\n    args: [ownerEmail],\n  });\n  const total = Number((rows[0] as { total?: number })?.total ?? 0);\n  return total / 100;\n}\n\n// ─── Admin / UI queries ─────────────────────────────────────────────────\n\nexport interface UsageSummaryOptions {\n  ownerEmail: string;\n  /** Inclusive lower bound (ms since epoch). Defaults to 30 days ago. */\n  sinceMs?: number;\n}\n\nexport interface UsageBucket {\n  key: string;\n  inputTokens: number;\n  outputTokens: number;\n  cacheReadTokens: number;\n  cacheWriteTokens: number;\n  cents: number;\n  calls: number;\n}\n\nexport interface DailyBucket {\n  /** YYYY-MM-DD (UTC) */\n  date: string;\n  cents: number;\n  calls: number;\n}\n\nexport interface UsageRecentEntry {\n  id: number;\n  createdAt: number;\n  label: string;\n  app: string;\n  model: string;\n  inputTokens: number;\n  outputTokens: number;\n  cacheReadTokens: number;\n  cacheWriteTokens: number;\n  cents: number;\n}\n\nexport interface UsageSummary {\n  billing?: UsageBillingMode;\n  totalCents: number;\n  totalCalls: number;\n  totalInputTokens: number;\n  totalOutputTokens: number;\n  totalCacheReadTokens: number;\n  totalCacheWriteTokens: number;\n  sinceMs: number;\n  byLabel: UsageBucket[];\n  byModel: UsageBucket[];\n  byApp: UsageBucket[];\n  byDay: DailyBucket[];\n  recent: UsageRecentEntry[];\n}\n\nconst DAY_MS = 86_400_000;\n\n/**\n * Produce an aggregated spend view for the Usage admin panel.\n * Scoped to the passed owner email; the UI always passes the session user.\n */\nexport async function getUsageSummary(\n  options: UsageSummaryOptions,\n): Promise<UsageSummary> {\n  await ensureUsageTable();\n  const client = getDbExec();\n  const sinceMs = options.sinceMs ?? Date.now() - 30 * DAY_MS;\n\n  const totalRow = await client.execute({\n    sql: `SELECT\n      COALESCE(SUM(cost_cents_x100), 0) AS cents,\n      COUNT(*) AS calls,\n      COALESCE(SUM(input_tokens), 0) AS in_tok,\n      COALESCE(SUM(output_tokens), 0) AS out_tok,\n      COALESCE(SUM(cache_read_tokens), 0) AS cr_tok,\n      COALESCE(SUM(cache_write_tokens), 0) AS cw_tok\n      FROM token_usage WHERE owner_email = ? AND created_at >= ?`,\n    args: [options.ownerEmail, sinceMs],\n  });\n  const t = (totalRow.rows[0] ?? {}) as Record<string, number | null>;\n\n  const bucketSql = (col: string) => ({\n    sql: `SELECT ${col} AS k,\n        COALESCE(SUM(cost_cents_x100), 0) AS cents,\n        COUNT(*) AS calls,\n        COALESCE(SUM(input_tokens), 0) AS in_tok,\n        COALESCE(SUM(output_tokens), 0) AS out_tok,\n        COALESCE(SUM(cache_read_tokens), 0) AS cr_tok,\n        COALESCE(SUM(cache_write_tokens), 0) AS cw_tok\n      FROM token_usage\n      WHERE owner_email = ? AND created_at >= ?\n      GROUP BY ${col}\n      ORDER BY cents DESC`,\n    args: [options.ownerEmail, sinceMs],\n  });\n\n  const mapBuckets = (rows: unknown[]): UsageBucket[] =>\n    rows.map((r) => {\n      const row = r as Record<string, number | string | null>;\n      return {\n        key: String(row.k ?? \"\"),\n        cents: Number(row.cents ?? 0) / 100,\n        calls: Number(row.calls ?? 0),\n        inputTokens: Number(row.in_tok ?? 0),\n        outputTokens: Number(row.out_tok ?? 0),\n        cacheReadTokens: Number(row.cr_tok ?? 0),\n        cacheWriteTokens: Number(row.cw_tok ?? 0),\n      };\n    });\n\n  const [byLabelR, byModelR, byAppR] = await Promise.all([\n    client.execute(bucketSql(\"label\")),\n    client.execute(bucketSql(\"model\")),\n    client.execute(bucketSql(\"app\")),\n  ]);\n\n  // By-day aggregation — done in JS so we don't depend on dialect-specific\n  // date functions (SQLite `strftime`, Postgres `to_char`). Cheap enough\n  // for a 30-day window; if this grows, swap for a dialect-aware query.\n  const dayRows = await client.execute({\n    sql: `SELECT created_at, cost_cents_x100 FROM token_usage\n      WHERE owner_email = ? AND created_at >= ?`,\n    args: [options.ownerEmail, sinceMs],\n  });\n  const dayMap = new Map<string, { cents: number; calls: number }>();\n  for (const row of dayRows.rows as Array<Record<string, number>>) {\n    const date = new Date(Number(row.created_at)).toISOString().slice(0, 10);\n    const prev = dayMap.get(date) ?? { cents: 0, calls: 0 };\n    prev.cents += Number(row.cost_cents_x100 ?? 0);\n    prev.calls += 1;\n    dayMap.set(date, prev);\n  }\n  const byDay: DailyBucket[] = [...dayMap.entries()]\n    .map(([date, v]) => ({\n      date,\n      cents: v.cents / 100,\n      calls: v.calls,\n    }))\n    .sort((a, b) => a.date.localeCompare(b.date));\n\n  const recentRows = await client.execute({\n    sql: `SELECT id, created_at, label, app, model,\n        input_tokens, output_tokens, cache_read_tokens, cache_write_tokens,\n        cost_cents_x100\n      FROM token_usage\n      WHERE owner_email = ?\n      ORDER BY created_at DESC\n      LIMIT 50`,\n    args: [options.ownerEmail],\n  });\n  const recent: UsageRecentEntry[] = (\n    recentRows.rows as Array<Record<string, number | string | null>>\n  ).map((row) => ({\n    id: Number(row.id),\n    createdAt: Number(row.created_at),\n    label: String(row.label ?? \"chat\"),\n    app: String(row.app ?? \"\"),\n    model: String(row.model ?? \"\"),\n    inputTokens: Number(row.input_tokens ?? 0),\n    outputTokens: Number(row.output_tokens ?? 0),\n    cacheReadTokens: Number(row.cache_read_tokens ?? 0),\n    cacheWriteTokens: Number(row.cache_write_tokens ?? 0),\n    cents: Number(row.cost_cents_x100 ?? 0) / 100,\n  }));\n\n  return {\n    billing: USD_USAGE_BILLING,\n    totalCents: Number(t.cents ?? 0) / 100,\n    totalCalls: Number(t.calls ?? 0),\n    totalInputTokens: Number(t.in_tok ?? 0),\n    totalOutputTokens: Number(t.out_tok ?? 0),\n    totalCacheReadTokens: Number(t.cr_tok ?? 0),\n    totalCacheWriteTokens: Number(t.cw_tok ?? 0),\n    sinceMs,\n    byLabel: mapBuckets(byLabelR.rows),\n    byModel: mapBuckets(byModelR.rows),\n    byApp: mapBuckets(byAppR.rows),\n    byDay,\n    recent,\n  };\n}\n"]}

package/docs/content/actions.md

@@ -329,6 +329,28 @@ export default defineAction({
 > [!WARNING]
 > Keep approvals rare. Each gated action is a hard stop in the agent loop. The default is **off**, and almost every action should leave it off. See [Human-in-the-Loop Approvals](/docs/human-approval) for the predicate API, the `approval_required` event, and the full flow.
 
+### Audit logging {#audit}
+
+Every mutating action is **audited automatically** — the framework records who ran it, when, from which surface, and (when it was the agent) which thread/turn, with credential-redacted inputs. Read-only (`GET`) actions are skipped. You don't write any code for this; it happens at the `defineAction` seam.
+
+Add an `audit` block only to _tune_ capture — most usefully to declare the resource the action changed so the change shows up in that resource's owner's trail:
+
+```ts
+export default defineAction({
+  description: "Delete a recording.",
+  schema: z.object({ id: z.string() }),
+  audit: {
+    target: (args, result) => ({ type: "recording", id: args.id }),
+    summary: (args) => `Deleted recording ${args.id}`,
+  },
+  run: async (args, ctx) => {
+    /* ...delete... */
+  },
+});
+```
+
+Other knobs: `audit: { onRead: true }` audits a sensitive read (secret access, bulk export); `audit: { enabled: false }` opts a noisy write out; `audit: { recordInputs: false }` skips capturing arguments. Read the trail back with the built-in `list-audit-events` / `get-audit-event` actions. Full details in [Audit Log](/docs/audit-log).
+
 ## Calling it from the UI {#ui}
 
 Two hooks, both in `@agent-native/core/client`. Types are inferred from your `defineAction` schemas — no manual type declarations.
@@ -553,6 +575,7 @@ const args = parseArgs(["--name", "Steve", "--verbose", "--count=3"]);
 
 ## What's next
 
+- [**Audit Log**](/docs/audit-log) — the automatic who-changed-what trail around every action
 - [**Human-in-the-Loop Approvals**](/docs/human-approval) — the `needsApproval` gate in depth
 - [**Drop-in Agent**](/docs/drop-in-agent) — `useActionMutation` / `useActionQuery` in React
 - [**Context Awareness**](/docs/context-awareness) — the `view-screen` + `navigate` pattern in depth

package/docs/content/audit-log.md

@@ -0,0 +1,111 @@
+---
+title: "Audit Log"
+description: "A durable, append-only record of who changed what app data, when, and whether it was you or the agent — captured automatically at the action seam."
+---
+
+# Audit Log
+
+Every agent-native app gets an audit log out of the box: a durable, complete, access-scoped, append-only record of **who mutated what app data, when, from where, and — when it was the agent — in which run.** Capture is automatic at the action seam; you write no code for it.
+
+Because the agent can change data on your behalf, the headline question an audit log answers here isn't just "who edited this record" — it's **"was that me or the agent, and which turn caused it?"** No other system in the framework can answer that.
+
+## Audit vs. observability vs. tracking {#which}
+
+Three systems record "what happened," for three different reasons. Pick by the question you're asking:
+
+| System                                   | The question it answers                                | Fidelity                         | Audience                      |
+| ---------------------------------------- | ------------------------------------------------------ | -------------------------------- | ----------------------------- |
+| **Audit Log** (this page)                | "Who changed this record, when, and was it the agent?" | **Complete, durable, scoped**    | User, admin, the agent itself |
+| **[Observability](/docs/observability)** | "Why did the agent do that, and what did it cost?"     | Sampled span telemetry           | Developer                     |
+| **[Tracking](/docs/tracking)**           | "How are people using the product?"                    | Fire-and-forget to external SaaS | PM / growth                   |
+
+An audit log that's sampled or shipped off to an analytics provider is useless — the whole point is that it's complete, local, and queryable. So it's its own subsystem, not a mode of the other two.
+
+## What's captured automatically {#captured}
+
+When any **mutating** action runs (anything that isn't a read-only `GET`), the framework appends one row to `agent_audit_log` with:
+
+- **Action** — the action name (e.g. `delete-recording`).
+- **Actor** — `agent`, `human`, or `system`, plus the actor's email — populated **even for agent calls**, so you get "the agent, acting for alice@, …".
+- **Run linkage** — the agent `threadId` / `turnId` that triggered the call (a tool call), so a mutation traces back to the exact agent turn.
+- **Surface** — `tool` (agent), `frontend`, `http`, `cli`, `mcp`, or `a2a`.
+- **Outcome** — `success`, `error` (with an error code), or `denied` (blocked by a human-approval gate).
+- **Inputs** — the call arguments, with credential-shaped values [redacted](#privacy).
+- **Target & owner** — the resource the action changed, used to [scope reads](#reading).
+
+No wiring needed — the capture hooks into `defineAction` transparently. Read-only actions are skipped, and a few high-frequency framework actions (app-state sync, context-xray, navigation) are skipped by default to avoid flooding the log.
+
+## Declare what an action changed {#target}
+
+By default an event is scoped to the **actor** — you see your own changes and the agent's changes on your behalf. To make a change to a _shared_ resource also appear in the **owner's** trail, and to label events by resource, declare a `target`:
+
+```ts
+export default defineAction({
+  description: "Delete a recording.",
+  schema: z.object({ id: z.string() }),
+  audit: {
+    target: (args, result) => ({
+      type: "recording",
+      id: args.id,
+      // Optional — defaults to the actor. Set when editing someone else's resource.
+      ownerEmail: result?.ownerEmail,
+      visibility: "org",
+    }),
+    summary: (args) => `Deleted recording ${args.id}`,
+  },
+  run: async (args, ctx) => {
+    /* ...delete... */
+  },
+});
+```
+
+Everything in `audit` is optional. The minimum useful addition is `target: () => ({ type, id })`.
+
+### Tuning capture {#tuning}
+
+| Option               | Effect                                                          |
+| -------------------- | --------------------------------------------------------------- |
+| `audit.target`       | Label the event with the resource and scope reads to its owner. |
+| `audit.summary`      | A short human-readable line for the event.                      |
+| `audit.onRead`       | Audit a sensitive **read** (secret access, bulk export).        |
+| `audit.enabled`      | `true` forces capture on; `false` opts a noisy mutation out.    |
+| `audit.recordInputs` | `false` skips capturing the (already redacted) arguments.       |
+
+## Reading the trail {#reading}
+
+Two read actions are available to the agent **and** the frontend in every app, scoped in SQL to the caller — they never return another tenant's rows:
+
+- **`list-audit-events`** — filter by `targetType` / `targetId`, `actorKind` (`agent` | `human` | `system`), `status`, `threadId` / `turnId`, `action`, `sinceMs`, and `limit`.
+- **`get-audit-event`** — one event by id, including its redacted input payload.
+
+Build an activity feed or a "who changed this" line by calling `list-audit-events` from the UI with `useActionQuery` — never hand-write a fetch to the audit table:
+
+```tsx
+import { useActionQuery } from "@agent-native/core/client";
+
+const { data } = useActionQuery("list-audit-events", {
+  targetType: "recording",
+  targetId: recordingId,
+});
+// data.events → [{ action, actorKind, actorEmail, turnId, status, summary, createdAt }, …]
+```
+
+The agent can call the same action — ask it "what did you change on this recording?" and it answers from the trail.
+
+## Privacy & retention {#privacy}
+
+- **Redaction** — before any inputs are stored, credential-shaped keys and values (tokens, secrets, passwords, bearer strings) are stripped and oversized payloads truncated. The audit log never becomes a secondary store of secrets. Keep `summary` text free of sensitive data too.
+- **Append-only** — there is no update or delete action for audit rows. The only deletion is the retention purge, which makes the log trustworthy as an audit trail.
+- **Tenant isolation** — reads are scoped to the caller's identity and org; with no identity, nothing matches.
+
+Configure via environment:
+
+- `AGENT_NATIVE_AUDIT_RETENTION_DAYS` — how long rows are kept (default `365`; `0` = keep forever).
+- `AGENT_NATIVE_AUDIT_ENABLED=false` — global kill switch.
+
+## What's next
+
+- [**Actions**](/docs/actions) — the `defineAction` seam where capture happens
+- [**Human-in-the-Loop Approvals**](/docs/human-approval) — gated actions, recorded as `denied`
+- [**Security & Data Scoping**](/docs/security) — the ownership model audit reads reuse
+- [**Observability**](/docs/observability) — agent-run telemetry (the other "what happened")