@cat-factory/node-server 0.87.10 → 0.89.0

package/dist/repositories/drizzle.js

@@ -2,7 +2,7 @@ import { LLM_WARNING_FINISH_REASONS } from '@cat-factory/kernel';
 import { agentRunKindSchema, decodeInitiativeRow, isWebSearchProvider, } from '@cat-factory/contracts';
 import { decodeEnum, tryDecodeRows, blockInsertValues, blockPatchToColumns, parseIssueIntakeColumn, serializeIssueIntakeColumn, rowToBlock, rowToExecution, executionToDetail, rowToPipeline, rowToSandboxExperiment, rowToSandboxFixture, rowToSandboxGrade, rowToSandboxPromptVersion, rowToSandboxRun, rowToWorkspace, } from '@cat-factory/server';
 import { and, asc, count, desc, eq, gte, inArray, isNull, lt, ne, notInArray, or, sql, } from 'drizzle-orm';
-import { accountInvitations, passwordResetTokens, accountSettings, localSettings, accounts, agentContextSnapshots, agentSearchQueries, agentRuns, blocks, consensusSessions, incidentEnrichmentConnections, observabilityConnections, packageRegistryConnections, emailConnections, llmCallMetrics, provisioningLog, sharedStacks, memberships, mergeThresholdPresets, releaseHealthConfigs, pipelineScheduleRuns, pipelineSchedules, pipelines, requirementReviews, docInterviewSessions, kaizenGradings, kaizenVerifiedCombos, clarityReviews, binaryArtifacts, brainstormSessions, initiatives, sandboxPromptVersions, sandboxFixtures, sandboxExperiments, sandboxRuns, sandboxGrades, services, tokenUsage, trackerSettings, modelPresets, userIdentities, users, userSettings, workspaceFragmentDefaults, workspaceServices, workspaceSettings, workspaces, } from '../db/schema.js';
+import { accountInvitations, passwordResetTokens, accountSettings, localSettings, accounts, agentContextSnapshots, agentSearchQueries, agentRuns, blocks, consensusSessions, incidentEnrichmentConnections, observabilityConnections, packageRegistryConnections, emailConnections, llmCallMetrics, provisioningLog, sharedStacks, memberships, riskPolicies, releaseHealthConfigs, testSecrets, pipelineScheduleRuns, pipelineSchedules, pipelines, requirementReviews, docInterviewSessions, kaizenGradings, kaizenVerifiedCombos, clarityReviews, binaryArtifacts, brainstormSessions, initiatives, sandboxPromptVersions, sandboxFixtures, sandboxExperiments, sandboxRuns, sandboxGrades, services, tokenUsage, trackerSettings, modelPresets, userIdentities, users, userSettings, workspaceFragmentDefaults, workspaceServices, workspaceSettings, workspaces, } from '../db/schema.js';
 // Drizzle/Postgres implementations of the core kernel repository ports. The
 // row<->domain mapping is the SAME shared mapping the Cloudflare D1 repos use
 // (@cat-factory/server), so behaviour matches across stores; this layer only owns
@@ -222,6 +222,7 @@ class DrizzlePipelineRepository {
             gating: pipeline.gating ? JSON.stringify(pipeline.gating) : null,
             follow_ups: pipeline.followUps ? JSON.stringify(pipeline.followUps) : null,
             tester_quality: pipeline.testerQuality ? JSON.stringify(pipeline.testerQuality) : null,
+            step_options: pipeline.stepOptions ? JSON.stringify(pipeline.stepOptions) : null,
             labels: pipeline.labels ? JSON.stringify(pipeline.labels) : null,
             archived: pipeline.archived ? 1 : null,
             builtin: pipeline.builtin ? 1 : null,
@@ -246,6 +247,7 @@ class DrizzlePipelineRepository {
             gating: pipeline.gating ? JSON.stringify(pipeline.gating) : null,
             follow_ups: pipeline.followUps ? JSON.stringify(pipeline.followUps) : null,
             tester_quality: pipeline.testerQuality ? JSON.stringify(pipeline.testerQuality) : null,
+            step_options: pipeline.stepOptions ? JSON.stringify(pipeline.stepOptions) : null,
             labels: pipeline.labels ? JSON.stringify(pipeline.labels) : null,
             archived: pipeline.archived ? 1 : null,
             version: pipeline.version ?? null,
@@ -969,9 +971,41 @@ class DrizzleTokenUsageRepository {
             input_tokens: usage.inputTokens,
             output_tokens: usage.outputTokens,
             cost_estimate: usage.costEstimate,
+            billing: usage.billing,
+            vendor: usage.vendor,
             created_at: usage.createdAt,
         });
     }
+    async usageBreakdownForWorkspace(workspaceId, epochMs) {
+        // One GROUP BY over the workspace's current period — both billing kinds (the report
+        // shows total usage). Never a per-model loop. sum() of int columns is bigint; cast +
+        // coerce like the totals rollups. Ordered heaviest-first in SQL, mirroring the D1 repo.
+        const rows = await this.db
+            .select({
+            billing: tokenUsage.billing,
+            vendor: tokenUsage.vendor,
+            provider: tokenUsage.provider,
+            model: tokenUsage.model,
+            input: sql `coalesce(sum(${tokenUsage.input_tokens}), 0)::bigint`,
+            output: sql `coalesce(sum(${tokenUsage.output_tokens}), 0)::bigint`,
+            cost: sql `coalesce(sum(${tokenUsage.cost_estimate}), 0)::float8`,
+            calls: sql `count(*)::bigint`,
+        })
+            .from(tokenUsage)
+            .where(and(eq(tokenUsage.workspace_id, workspaceId), gte(tokenUsage.created_at, epochMs)))
+            .groupBy(tokenUsage.billing, tokenUsage.vendor, tokenUsage.provider, tokenUsage.model)
+            .orderBy(sql `(coalesce(sum(${tokenUsage.input_tokens}), 0) + coalesce(sum(${tokenUsage.output_tokens}), 0)) desc`);
+        return rows.map((r) => ({
+            billing: (r.billing === 'subscription' ? 'subscription' : 'metered'),
+            vendor: r.vendor,
+            provider: r.provider,
+            model: r.model,
+            inputTokens: Number(r.input ?? 0),
+            outputTokens: Number(r.output ?? 0),
+            costEstimate: r.cost ?? 0,
+            calls: Number(r.calls ?? 0),
+        }));
+    }
     async totalsSince(epochMs) {
         // sum() of int columns is bigint in Postgres — cast to bigint (NOT int4, which
         // overflows past ~2.1B tokens) and coerce: node-postgres returns bigint as a
@@ -984,7 +1018,7 @@ class DrizzleTokenUsageRepository {
             cost: sql `coalesce(sum(${tokenUsage.cost_estimate}), 0)::float8`,
         })
             .from(tokenUsage)
-            .where(gte(tokenUsage.created_at, epochMs));
+            .where(and(gte(tokenUsage.created_at, epochMs), eq(tokenUsage.billing, 'metered')));
         return {
             inputTokens: Number(row?.input ?? 0),
             outputTokens: Number(row?.output ?? 0),
@@ -999,7 +1033,7 @@ class DrizzleTokenUsageRepository {
             cost: sql `coalesce(sum(${tokenUsage.cost_estimate}), 0)::float8`,
         })
             .from(tokenUsage)
-            .where(and(eq(tokenUsage.workspace_id, workspaceId), gte(tokenUsage.created_at, epochMs)));
+            .where(and(eq(tokenUsage.workspace_id, workspaceId), gte(tokenUsage.created_at, epochMs), eq(tokenUsage.billing, 'metered')));
         return {
             inputTokens: Number(row?.input ?? 0),
             outputTokens: Number(row?.output ?? 0),
@@ -1014,7 +1048,7 @@ class DrizzleTokenUsageRepository {
             cost: sql `coalesce(sum(${tokenUsage.cost_estimate}), 0)::float8`,
         })
             .from(tokenUsage)
-            .where(and(eq(tokenUsage.account_id, accountId), gte(tokenUsage.created_at, epochMs)));
+            .where(and(eq(tokenUsage.account_id, accountId), gte(tokenUsage.created_at, epochMs), eq(tokenUsage.billing, 'metered')));
         return {
             inputTokens: Number(row?.input ?? 0),
             outputTokens: Number(row?.output ?? 0),
@@ -1029,7 +1063,7 @@ class DrizzleTokenUsageRepository {
             cost: sql `coalesce(sum(${tokenUsage.cost_estimate}), 0)::float8`,
         })
             .from(tokenUsage)
-            .where(and(eq(tokenUsage.user_id, userId), gte(tokenUsage.created_at, epochMs)));
+            .where(and(eq(tokenUsage.user_id, userId), gte(tokenUsage.created_at, epochMs), eq(tokenUsage.billing, 'metered')));
         return {
             inputTokens: Number(row?.input ?? 0),
             outputTokens: Number(row?.output ?? 0),
@@ -2801,7 +2835,7 @@ class DrizzleInitiativeRepository {
             .where(and(eq(initiatives.workspace_id, workspaceId), eq(initiatives.id, id)));
     }
 }
-function rowToMergePreset(row) {
+function rowToRiskPolicy(row) {
     return {
         id: row.id,
         name: row.name,
@@ -2823,13 +2857,13 @@ function rowToMergePreset(row) {
 }
 /**
  * Per-workspace merge threshold presets over Postgres (the Drizzle mirror of the
- * Worker's `D1MergePresetRepository`, migration 0024). Enforces the single-default
+ * Worker's `D1RiskPolicyRepository`, migration 0024). Enforces the single-default
  * invariant: promoting a preset to default demotes every other in the workspace
  * before the upsert. The default preset cannot be removed (the service keeps that
  * rule too; the DELETE also guards `is_default = 0`). Behaviourally identical to the
  * D1 repo so the cross-runtime conformance suite asserts the same preset resolution.
  */
-class DrizzleMergePresetRepository {
+class DrizzleRiskPolicyRepository {
     db;
     constructor(db) {
         this.db = db;
@@ -2837,27 +2871,27 @@ class DrizzleMergePresetRepository {
     async get(workspaceId, id) {
         const rows = await this.db
             .select()
-            .from(mergeThresholdPresets)
-            .where(and(eq(mergeThresholdPresets.workspace_id, workspaceId), eq(mergeThresholdPresets.id, id)))
+            .from(riskPolicies)
+            .where(and(eq(riskPolicies.workspace_id, workspaceId), eq(riskPolicies.id, id)))
             .limit(1);
-        return rows[0] ? rowToMergePreset(rows[0]) : null;
+        return rows[0] ? rowToRiskPolicy(rows[0]) : null;
     }
     async list(workspaceId) {
         const rows = await this.db
             .select()
-            .from(mergeThresholdPresets)
-            .where(eq(mergeThresholdPresets.workspace_id, workspaceId))
-            .orderBy(mergeThresholdPresets.created_at);
-        return rows.map(rowToMergePreset);
+            .from(riskPolicies)
+            .where(eq(riskPolicies.workspace_id, workspaceId))
+            .orderBy(riskPolicies.created_at);
+        return rows.map(rowToRiskPolicy);
     }
     async getDefault(workspaceId) {
         const rows = await this.db
             .select()
-            .from(mergeThresholdPresets)
-            .where(and(eq(mergeThresholdPresets.workspace_id, workspaceId), eq(mergeThresholdPresets.is_default, 1)))
-            .orderBy(mergeThresholdPresets.created_at)
+            .from(riskPolicies)
+            .where(and(eq(riskPolicies.workspace_id, workspaceId), eq(riskPolicies.is_default, 1)))
+            .orderBy(riskPolicies.created_at)
             .limit(1);
-        return rows[0] ? rowToMergePreset(rows[0]) : null;
+        return rows[0] ? rowToRiskPolicy(rows[0]) : null;
     }
     async upsert(workspaceId, preset) {
         const values = {
@@ -2885,15 +2919,15 @@ class DrizzleMergePresetRepository {
             // Promoting this preset to default demotes any other default first.
             if (preset.isDefault) {
                 await tx
-                    .update(mergeThresholdPresets)
+                    .update(riskPolicies)
                     .set({ is_default: 0 })
-                    .where(and(eq(mergeThresholdPresets.workspace_id, workspaceId), sql `${mergeThresholdPresets.id} <> ${preset.id}`));
+                    .where(and(eq(riskPolicies.workspace_id, workspaceId), sql `${riskPolicies.id} <> ${preset.id}`));
             }
             await tx
-                .insert(mergeThresholdPresets)
+                .insert(riskPolicies)
                 .values(values)
                 .onConflictDoUpdate({
-                target: [mergeThresholdPresets.workspace_id, mergeThresholdPresets.id],
+                target: [riskPolicies.workspace_id, riskPolicies.id],
                 set: {
                     name: values.name,
                     max_complexity: values.max_complexity,
@@ -2915,8 +2949,8 @@ class DrizzleMergePresetRepository {
     }
     async remove(workspaceId, id) {
         await this.db
-            .delete(mergeThresholdPresets)
-            .where(and(eq(mergeThresholdPresets.workspace_id, workspaceId), eq(mergeThresholdPresets.id, id), eq(mergeThresholdPresets.is_default, 0)));
+            .delete(riskPolicies)
+            .where(and(eq(riskPolicies.workspace_id, workspaceId), eq(riskPolicies.id, id), eq(riskPolicies.is_default, 0)));
     }
 }
 // Shape-guarded parsers matching the D1 mirror (`D1SharedStackRepository`) EXACTLY, so a
@@ -3825,6 +3859,77 @@ class DrizzleReleaseHealthConfigRepository {
             .where(and(eq(releaseHealthConfigs.workspace_id, workspaceId), eq(releaseHealthConfigs.block_id, blockId)));
     }
 }
+/**
+ * A service frame's sensitive test credentials over Postgres (the Drizzle mirror of the
+ * Worker's `D1TestSecretsRepository`, migration 0044). At most one row per (workspace, block);
+ * `credentials` is a sealed envelope of the `TestSecretEntry[]` JSON, `summary` a non-secret
+ * `TestSecretRef[]` display blob.
+ */
+export class DrizzleTestSecretsRepository {
+    db;
+    constructor(db) {
+        this.db = db;
+    }
+    async getByBlock(workspaceId, blockId) {
+        const rows = await this.db
+            .select()
+            .from(testSecrets)
+            .where(and(eq(testSecrets.workspace_id, workspaceId), eq(testSecrets.block_id, blockId)))
+            .limit(1);
+        const row = rows[0];
+        if (!row)
+            return null;
+        return {
+            workspaceId: row.workspace_id,
+            blockId: row.block_id,
+            credentials: row.credentials,
+            summary: row.summary,
+            createdAt: row.created_at,
+            updatedAt: row.updated_at,
+        };
+    }
+    async listByWorkspace(workspaceId) {
+        const rows = await this.db
+            .select()
+            .from(testSecrets)
+            .where(eq(testSecrets.workspace_id, workspaceId))
+            .orderBy(testSecrets.block_id);
+        return rows.map((row) => ({
+            workspaceId: row.workspace_id,
+            blockId: row.block_id,
+            credentials: row.credentials,
+            summary: row.summary,
+            createdAt: row.created_at,
+            updatedAt: row.updated_at,
+        }));
+    }
+    async upsert(record) {
+        const values = {
+            workspace_id: record.workspaceId,
+            block_id: record.blockId,
+            credentials: record.credentials,
+            summary: record.summary,
+            created_at: record.createdAt,
+            updated_at: record.updatedAt,
+        };
+        await this.db
+            .insert(testSecrets)
+            .values(values)
+            .onConflictDoUpdate({
+            target: [testSecrets.workspace_id, testSecrets.block_id],
+            set: {
+                credentials: values.credentials,
+                summary: values.summary,
+                updated_at: values.updated_at,
+            },
+        });
+    }
+    async deleteByBlock(workspaceId, blockId) {
+        await this.db
+            .delete(testSecrets)
+            .where(and(eq(testSecrets.workspace_id, workspaceId), eq(testSecrets.block_id, blockId)));
+    }
+}
 /** Build the Drizzle/Postgres-backed core repositories. */
 export function createDrizzleRepositories(db, clock) {
     return {
@@ -3858,7 +3963,7 @@ export function createDrizzleRepositories(db, clock) {
         clarityReviewRepository: new DrizzleClarityReviewRepository(db),
         brainstormSessionRepository: new DrizzleBrainstormSessionRepository(db),
         initiativeRepository: new DrizzleInitiativeRepository(db),
-        mergePresetRepository: new DrizzleMergePresetRepository(db),
+        riskPolicyRepository: new DrizzleRiskPolicyRepository(db),
         sharedStackRepository: new DrizzleSharedStackRepository(db),
         workspaceSettingsRepository: new DrizzleWorkspaceSettingsRepository(db),
         userSettingsRepository: new DrizzleUserSettingsRepository(db),
@@ -3867,6 +3972,7 @@ export function createDrizzleRepositories(db, clock) {
         incidentEnrichmentConnectionRepository: new DrizzleIncidentEnrichmentConnectionRepository(db),
         accountSettingsRepository: new DrizzleAccountSettingsRepository(db),
         releaseHealthConfigRepository: new DrizzleReleaseHealthConfigRepository(db),
+        testSecretsRepository: new DrizzleTestSecretsRepository(db),
         provisioningLogRepository: new DrizzleProvisioningLogRepository(db),
     };
 }