@dudousxd/nestjs-agent-store-drizzle 0.36.2 → 0.37.0

package/dist/index.cjs

@@ -282,7 +282,9 @@ var agentTokenUsage = (0, import_sqlite_core.sqliteTable)("agent_token_usage", {
   (0, import_sqlite_core.index)("agent_token_usage_actor_created_idx").on(table.actorRef, table.createdAt),
   (0, import_sqlite_core.index)("agent_token_usage_created_idx").on(table.createdAt),
   (0, import_sqlite_core.index)("agent_token_usage_thread_idx").on(table.threadId),
-  (0, import_sqlite_core.index)("agent_token_usage_feature_created_idx").on(table.feature, table.createdAt)
+  (0, import_sqlite_core.index)("agent_token_usage_feature_created_idx").on(table.feature, table.createdAt),
+  // `quota.per: 'tenant' | 'actor-in-tenant'` sums a tenant's window.
+  (0, import_sqlite_core.index)("agent_token_usage_tenant_created_idx").on(table.tenantRef, table.createdAt)
 ]);
 var agentGenuiCall = (0, import_sqlite_core.sqliteTable)("agent_genui_call", {
   id: (0, import_sqlite_core.text)("id").primaryKey(),
@@ -755,7 +757,9 @@ var agentTokenUsage2 = (0, import_mysql_core.mysqlTable)("agent_token_usage", {
   (0, import_mysql_core.index)("agent_token_usage_actor_created_idx").on(table.actorRef, table.createdAt),
   (0, import_mysql_core.index)("agent_token_usage_created_idx").on(table.createdAt),
   (0, import_mysql_core.index)("agent_token_usage_thread_idx").on(table.threadId),
-  (0, import_mysql_core.index)("agent_token_usage_feature_created_idx").on(table.feature, table.createdAt)
+  (0, import_mysql_core.index)("agent_token_usage_feature_created_idx").on(table.feature, table.createdAt),
+  // `quota.per: 'tenant' | 'actor-in-tenant'` sums a tenant's window.
+  (0, import_mysql_core.index)("agent_token_usage_tenant_created_idx").on(table.tenantRef, table.createdAt)
 ]);
 var agentGenuiCall2 = (0, import_mysql_core.mysqlTable)("agent_genui_call", {
   id: key("id").primaryKey(),
@@ -1242,7 +1246,9 @@ var agentTokenUsage3 = (0, import_pg_core.pgTable)("agent_token_usage", {
   (0, import_pg_core.index)("agent_token_usage_actor_created_idx").on(table.actorRef, table.createdAt),
   (0, import_pg_core.index)("agent_token_usage_created_idx").on(table.createdAt),
   (0, import_pg_core.index)("agent_token_usage_thread_idx").on(table.threadId),
-  (0, import_pg_core.index)("agent_token_usage_feature_created_idx").on(table.feature, table.createdAt)
+  (0, import_pg_core.index)("agent_token_usage_feature_created_idx").on(table.feature, table.createdAt),
+  // `quota.per: 'tenant' | 'actor-in-tenant'` sums a tenant's window.
+  (0, import_pg_core.index)("agent_token_usage_tenant_created_idx").on(table.tenantRef, table.createdAt)
 ]);
 var agentGenuiCall3 = (0, import_pg_core.pgTable)("agent_genui_call", {
   id: (0, import_pg_core.text)("id").primaryKey(),
@@ -2586,7 +2592,15 @@ var DrizzleAgentStore = class {
     return rows.reverse().map((row) => this.toStoredMessage(row));
   }
   async listThreads(actorRef, limit = 50) {
-    const threads = await this.db.select().from(this.t.agentThread).where((0, import_drizzle_orm4.and)((0, import_drizzle_orm4.eq)(this.t.agentThread.actorRef, actorRef), (0, import_drizzle_orm4.eq)(this.t.agentThread.transient, false), (0, import_drizzle_orm4.isNull)(this.t.agentThread.deletedAt))).orderBy((0, import_drizzle_orm4.desc)(this.t.agentThread.updatedAt)).limit(limit);
+    return this.listThreadsWhere(actorRef, void 0, limit);
+  }
+  async listThreadsForTenant(actorRef, filter, limit = 50) {
+    const column = this.t.agentThread.tenantRef;
+    const visible = filter.tenant === void 0 ? (0, import_drizzle_orm4.isNull)(column) : filter.nulls ? (0, import_drizzle_orm4.or)((0, import_drizzle_orm4.eq)(column, filter.tenant), (0, import_drizzle_orm4.isNull)(column)) : (0, import_drizzle_orm4.eq)(column, filter.tenant);
+    return this.listThreadsWhere(actorRef, visible, limit);
+  }
+  async listThreadsWhere(actorRef, tenant, limit) {
+    const threads = await this.db.select().from(this.t.agentThread).where((0, import_drizzle_orm4.and)((0, import_drizzle_orm4.eq)(this.t.agentThread.actorRef, actorRef), (0, import_drizzle_orm4.eq)(this.t.agentThread.transient, false), (0, import_drizzle_orm4.isNull)(this.t.agentThread.deletedAt), tenant)).orderBy((0, import_drizzle_orm4.desc)(this.t.agentThread.updatedAt)).limit(limit);
     const previews = await this.lastMessageContents(threads.map((thread) => thread.id));
     return threads.map((thread) => this.toSummary(thread, previews.get(thread.id)));
   }
@@ -2780,6 +2794,23 @@ var DrizzleAgentStore = class {
       expiresAt: row.expiresAt?.toISOString() ?? null
     };
   }
+  async tenantOf(target) {
+    const thread = this.t.agentThread;
+    if ("toolCallId" in target) {
+      const [row2] = await this.db.select({
+        tenantRef: thread.tenantRef
+      }).from(this.t.agentToolCall).innerJoin(this.t.agentMessage, (0, import_drizzle_orm4.eq)(this.t.agentToolCall.messageId, this.t.agentMessage.id)).innerJoin(thread, (0, import_drizzle_orm4.eq)(this.t.agentMessage.threadId, thread.id)).where((0, import_drizzle_orm4.eq)(this.t.agentToolCall.id, target.toolCallId));
+      return row2 === void 0 ? null : {
+        tenantRef: row2.tenantRef ?? null
+      };
+    }
+    const [row] = await this.db.select({
+      tenantRef: thread.tenantRef
+    }).from(thread).where((0, import_drizzle_orm4.and)("threadId" in target ? (0, import_drizzle_orm4.eq)(thread.id, target.threadId) : (0, import_drizzle_orm4.eq)(thread.activeStreamId, target.runId), (0, import_drizzle_orm4.isNull)(thread.deletedAt)));
+    return row === void 0 ? null : {
+      tenantRef: row.tenantRef ?? null
+    };
+  }
   async ownerOfActiveStream(runId) {
     const [thread] = await this.db.select({
       actorRef: this.t.agentThread.actorRef
@@ -3375,6 +3406,17 @@ var DrizzleAgentStore = class {
   * it, and no usage row crosses the wire.
   */
   async usageWindows(actorRef, ranges) {
+    return this.sumUsageWindows((0, import_drizzle_orm4.eq)(this.t.agentTokenUsage.actorRef, actorRef), ranges);
+  }
+  /**
+  * {@link usageWindows} over the tenant's rows (every actor's, or `actorRef`'s only), served by the
+  * `(tenant_ref, created_at)` index.
+  */
+  async usageWindowsForTenant(tenantRef, ranges, actorRef) {
+    const usage = this.t.agentTokenUsage;
+    return this.sumUsageWindows((0, import_drizzle_orm4.and)((0, import_drizzle_orm4.eq)(usage.tenantRef, tenantRef), actorRef !== void 0 ? (0, import_drizzle_orm4.eq)(usage.actorRef, actorRef) : void 0), ranges);
+  }
+  async sumUsageWindows(owner, ranges) {
     if (ranges.length === 0) {
       return [];
     }
@@ -3392,7 +3434,7 @@ var DrizzleAgentStore = class {
     });
     const from = new Date(Math.min(...bounds.map(({ start }) => start.getTime())));
     const to = new Date(Math.max(...bounds.map(({ end }) => end.getTime())));
-    const [row] = await this.db.select(columns).from(usage).where((0, import_drizzle_orm4.and)((0, import_drizzle_orm4.eq)(usage.actorRef, actorRef), within(from, to), (0, import_drizzle_orm4.eq)(usage.countsTowardsQuota, true)));
+    const [row] = await this.db.select(columns).from(usage).where((0, import_drizzle_orm4.and)(owner, within(from, to), (0, import_drizzle_orm4.eq)(usage.countsTowardsQuota, true)));
     return bounds.map((_, index4) => ({
       usedTokens: Number(row?.[`tokens${index4}`] ?? 0),
       costUsd: Number(row?.[`cost${index4}`] ?? 0),
@@ -3686,19 +3728,55 @@ function percentileMs(sortedDurationsMs, p) {
   return sortedDurationsMs[offset] ?? null;
 }
 __name(percentileMs, "percentileMs");
-var DrizzleGovernanceQueries = class {
+var DrizzleGovernanceQueries = class _DrizzleGovernanceQueries {
   static {
     __name(this, "DrizzleGovernanceQueries");
   }
+  source;
   pricingStore;
+  tenant;
   db;
   dialect;
   t;
-  constructor(db, pricingStore) {
+  /**
+  * `tenant`: the rows these queries may see (see {@link forTenant}); absent → every row. Threads by
+  * their `tenant_ref`; runs, messages, tool calls and generative-UI calls by their thread's; usage
+  * by its own `tenant_ref`.
+  */
+  constructor(source, pricingStore, tenant) {
+    this.source = source;
     this.pricingStore = pricingStore;
-    this.dialect = agentDialectOf(db);
+    this.tenant = tenant;
+    this.dialect = agentDialectOf(source);
     this.t = agentTablesFor(this.dialect);
-    this.db = asBuilder(db);
+    this.db = asBuilder(source);
+  }
+  /** These queries narrowed to the rows `filter` may see — the console's tenant scope. */
+  forTenant(filter) {
+    return new _DrizzleGovernanceQueries(this.source, this.pricingStore, filter);
+  }
+  /** The matching rule on a `tenant_ref` column; `undefined` (no condition) without a scope. */
+  tenantOn(column) {
+    const filter = this.tenant;
+    if (filter === void 0) return void 0;
+    if (filter.tenant === void 0) return (0, import_drizzle_orm5.isNull)(column);
+    return filter.nulls ? (0, import_drizzle_orm5.or)((0, import_drizzle_orm5.eq)(column, filter.tenant), (0, import_drizzle_orm5.isNull)(column)) : (0, import_drizzle_orm5.eq)(column, filter.tenant);
+  }
+  /** Rows keyed by a thread id whose thread the scope may see; `undefined` without a scope. */
+  threadIn(threadId) {
+    const visible = this.tenantOn(this.t.agentThread.tenantRef);
+    if (visible === void 0) return void 0;
+    return (0, import_drizzle_orm5.inArray)(threadId, this.db.select({
+      id: this.t.agentThread.id
+    }).from(this.t.agentThread).where(visible));
+  }
+  /** Tool calls (by `message_id`) on a thread the scope may see; `undefined` without a scope. */
+  toolCallIn(messageId) {
+    const visible = this.threadIn(this.t.agentMessage.threadId);
+    if (visible === void 0) return void 0;
+    return (0, import_drizzle_orm5.inArray)(messageId, this.db.select({
+      id: this.t.agentMessage.id
+    }).from(this.t.agentMessage).where(visible));
   }
   async loadPricing() {
     const prices = await this.pricingStore.listCurrentPrices();
@@ -3739,7 +3817,7 @@ var DrizzleGovernanceQueries = class {
         audioSeconds: usage.audioSeconds,
         characters: usage.characters
       } : {}
-    }).from(usage).where((0, import_drizzle_orm5.and)((0, import_drizzle_orm5.gte)(this.t.agentTokenUsage.createdAt, start), (0, import_drizzle_orm5.lt)(this.t.agentTokenUsage.createdAt, end)));
+    }).from(usage).where((0, import_drizzle_orm5.and)((0, import_drizzle_orm5.gte)(this.t.agentTokenUsage.createdAt, start), (0, import_drizzle_orm5.lt)(this.t.agentTokenUsage.createdAt, end), this.tenantOn(usage.tenantRef)));
     return rows.map(toUsageInput);
   }
   async spendByModel(range) {
@@ -3804,7 +3882,7 @@ var DrizzleGovernanceQueries = class {
       threadId: this.t.agentMessage.threadId,
       createdAt: this.t.agentToolCall.createdAt,
       runId: this.t.agentToolCall.runId
-    }).from(this.t.agentToolCall).innerJoin(this.t.agentMessage, (0, import_drizzle_orm5.eq)(this.t.agentToolCall.messageId, this.t.agentMessage.id)).orderBy((0, import_drizzle_orm5.desc)(this.t.agentToolCall.createdAt), (0, import_drizzle_orm5.desc)(this.t.agentToolCall.id)).limit(limit);
+    }).from(this.t.agentToolCall).innerJoin(this.t.agentMessage, (0, import_drizzle_orm5.eq)(this.t.agentToolCall.messageId, this.t.agentMessage.id)).where(this.threadIn(this.t.agentMessage.threadId)).orderBy((0, import_drizzle_orm5.desc)(this.t.agentToolCall.createdAt), (0, import_drizzle_orm5.desc)(this.t.agentToolCall.id)).limit(limit);
     return rows.map((row) => ({
       toolCallId: row.toolCallId,
       toolName: row.toolName,
@@ -3871,7 +3949,7 @@ var DrizzleGovernanceQueries = class {
     });
   }
   async recentThreads(limit) {
-    const threads = await this.db.select().from(this.t.agentThread).where((0, import_drizzle_orm5.isNull)(this.t.agentThread.deletedAt)).orderBy((0, import_drizzle_orm5.desc)(this.t.agentThread.updatedAt), (0, import_drizzle_orm5.desc)(this.t.agentThread.id)).limit(limit);
+    const threads = await this.db.select().from(this.t.agentThread).where((0, import_drizzle_orm5.and)((0, import_drizzle_orm5.isNull)(this.t.agentThread.deletedAt), this.tenantOn(this.t.agentThread.tenantRef))).orderBy((0, import_drizzle_orm5.desc)(this.t.agentThread.updatedAt), (0, import_drizzle_orm5.desc)(this.t.agentThread.id)).limit(limit);
     return this.toThreadActivityRows(threads);
   }
   /** The range's runs, with only the columns the rollups read. */
@@ -3886,7 +3964,7 @@ var DrizzleGovernanceQueries = class {
       ttftMs: run.ttftMs,
       parentRunId: run.parentRunId,
       startedAt: run.startedAt
-    }).from(run).where((0, import_drizzle_orm5.and)((0, import_drizzle_orm5.gte)(run.startedAt, start), (0, import_drizzle_orm5.lte)(run.startedAt, end)));
+    }).from(run).where((0, import_drizzle_orm5.and)((0, import_drizzle_orm5.gte)(run.startedAt, start), (0, import_drizzle_orm5.lte)(run.startedAt, end), this.threadIn(run.threadId)));
   }
   async runMetrics(range) {
     const runs = await this.runsInRange(range);
@@ -3952,7 +4030,7 @@ var DrizzleGovernanceQueries = class {
     const { start, end } = (0, import_nestjs_agent_core5.dayBoundsUtc)(range);
     const runs = await this.db.select({
       errorCode: this.t.agentRun.errorCode
-    }).from(this.t.agentRun).where((0, import_drizzle_orm5.and)((0, import_drizzle_orm5.gte)(this.t.agentRun.startedAt, start), (0, import_drizzle_orm5.lte)(this.t.agentRun.startedAt, end), (0, import_drizzle_orm5.eq)(this.t.agentRun.status, "failed")));
+    }).from(this.t.agentRun).where((0, import_drizzle_orm5.and)((0, import_drizzle_orm5.gte)(this.t.agentRun.startedAt, start), (0, import_drizzle_orm5.lte)(this.t.agentRun.startedAt, end), (0, import_drizzle_orm5.eq)(this.t.agentRun.status, "failed"), this.threadIn(this.t.agentRun.threadId)));
     const byError = /* @__PURE__ */ new Map();
     for (const run of runs) {
       const errorCode = run.errorCode ?? UNCLASSIFIED_ERROR_CODE;
@@ -3992,7 +4070,7 @@ var DrizzleGovernanceQueries = class {
     return result;
   }
   async recentRuns(limit) {
-    const runs = await this.db.select().from(this.t.agentRun).orderBy((0, import_drizzle_orm5.desc)(this.t.agentRun.startedAt), (0, import_drizzle_orm5.desc)(this.t.agentRun.id)).limit(limit);
+    const runs = await this.db.select().from(this.t.agentRun).where(this.threadIn(this.t.agentRun.threadId)).orderBy((0, import_drizzle_orm5.desc)(this.t.agentRun.startedAt), (0, import_drizzle_orm5.desc)(this.t.agentRun.id)).limit(limit);
     return runs.map(toRecentRunRow);
   }
   /**
@@ -4011,7 +4089,7 @@ var DrizzleGovernanceQueries = class {
       agentName: this.t.agentMessage.agentName,
       requestedAt: this.t.agentToolCall.createdAt,
       runId: this.t.agentToolCall.runId
-    }).from(this.t.agentToolCall).innerJoin(this.t.agentMessage, (0, import_drizzle_orm5.eq)(this.t.agentToolCall.messageId, this.t.agentMessage.id)).innerJoin(this.t.agentThread, (0, import_drizzle_orm5.eq)(this.t.agentMessage.threadId, this.t.agentThread.id)).where((0, import_drizzle_orm5.eq)(this.t.agentToolCall.status, "pending_approval")).orderBy(this.t.agentToolCall.createdAt, this.t.agentToolCall.id).limit(limit);
+    }).from(this.t.agentToolCall).innerJoin(this.t.agentMessage, (0, import_drizzle_orm5.eq)(this.t.agentToolCall.messageId, this.t.agentMessage.id)).innerJoin(this.t.agentThread, (0, import_drizzle_orm5.eq)(this.t.agentMessage.threadId, this.t.agentThread.id)).where((0, import_drizzle_orm5.and)((0, import_drizzle_orm5.eq)(this.t.agentToolCall.status, "pending_approval"), this.tenantOn(this.t.agentThread.tenantRef))).orderBy(this.t.agentToolCall.createdAt, this.t.agentToolCall.id).limit(limit);
     return rows.map((row) => ({
       toolCallId: row.toolCallId,
       toolName: row.toolName,
@@ -4038,7 +4116,7 @@ var DrizzleGovernanceQueries = class {
       toolType: this.t.agentToolCall.toolType,
       status: this.t.agentToolCall.status,
       executionMs: this.t.agentToolCall.executionMs
-    }).from(this.t.agentToolCall).where((0, import_drizzle_orm5.and)((0, import_drizzle_orm5.gte)(this.t.agentToolCall.createdAt, start), (0, import_drizzle_orm5.lte)(this.t.agentToolCall.createdAt, end)));
+    }).from(this.t.agentToolCall).where((0, import_drizzle_orm5.and)((0, import_drizzle_orm5.gte)(this.t.agentToolCall.createdAt, start), (0, import_drizzle_orm5.lte)(this.t.agentToolCall.createdAt, end), this.toolCallIn(this.t.agentToolCall.messageId)));
     const byTool = /* @__PURE__ */ new Map();
     for (const call of calls) {
       const key2 = `${call.toolName} ${call.toolType}`;
@@ -4088,7 +4166,7 @@ var DrizzleGovernanceQueries = class {
     if (filters?.toolType !== void 0 && !isToolKind(filters.toolType)) {
       return emptyPage(query);
     }
-    const whereClause = (0, import_drizzle_orm5.and)(filters?.toolName !== void 0 ? (0, import_drizzle_orm5.eq)(this.t.agentToolCall.toolName, filters.toolName) : void 0, filters?.toolType !== void 0 && isToolKind(filters.toolType) ? (0, import_drizzle_orm5.eq)(this.t.agentToolCall.toolType, filters.toolType) : void 0, filters?.status !== void 0 && isToolCallStatus(filters.status) ? (0, import_drizzle_orm5.eq)(this.t.agentToolCall.status, filters.status) : void 0, filters?.threadId !== void 0 ? (0, import_drizzle_orm5.eq)(this.t.agentMessage.threadId, filters.threadId) : void 0, filters?.fromDay !== void 0 ? (0, import_drizzle_orm5.gte)(this.t.agentToolCall.createdAt, dayStartUtc(filters.fromDay)) : void 0, filters?.toDay !== void 0 ? (0, import_drizzle_orm5.lte)(this.t.agentToolCall.createdAt, dayEndUtc(filters.toDay)) : void 0);
+    const whereClause = (0, import_drizzle_orm5.and)(filters?.toolName !== void 0 ? (0, import_drizzle_orm5.eq)(this.t.agentToolCall.toolName, filters.toolName) : void 0, filters?.toolType !== void 0 && isToolKind(filters.toolType) ? (0, import_drizzle_orm5.eq)(this.t.agentToolCall.toolType, filters.toolType) : void 0, filters?.status !== void 0 && isToolCallStatus(filters.status) ? (0, import_drizzle_orm5.eq)(this.t.agentToolCall.status, filters.status) : void 0, filters?.threadId !== void 0 ? (0, import_drizzle_orm5.eq)(this.t.agentMessage.threadId, filters.threadId) : void 0, filters?.fromDay !== void 0 ? (0, import_drizzle_orm5.gte)(this.t.agentToolCall.createdAt, dayStartUtc(filters.fromDay)) : void 0, filters?.toDay !== void 0 ? (0, import_drizzle_orm5.lte)(this.t.agentToolCall.createdAt, dayEndUtc(filters.toDay)) : void 0, this.threadIn(this.t.agentMessage.threadId));
     const [totalRow] = await this.db.select({
       value: (0, import_drizzle_orm5.count)()
     }).from(this.t.agentToolCall).innerJoin(this.t.agentMessage, (0, import_drizzle_orm5.eq)(this.t.agentToolCall.messageId, this.t.agentMessage.id)).where(whereClause);
@@ -4124,7 +4202,7 @@ var DrizzleGovernanceQueries = class {
   */
   async threadsPage(query) {
     const filters = query.where;
-    const whereClause = (0, import_drizzle_orm5.and)((0, import_drizzle_orm5.isNull)(this.t.agentThread.deletedAt), filters?.actorRef !== void 0 ? (0, import_drizzle_orm5.eq)(this.t.agentThread.actorRef, filters.actorRef) : void 0, filters?.title !== void 0 ? (0, import_drizzle_orm5.like)(import_drizzle_orm5.sql`lower(${this.t.agentThread.title})`, `%${filters.title.toLowerCase()}%`) : void 0, filters?.fromDay !== void 0 ? (0, import_drizzle_orm5.gte)(this.t.agentThread.updatedAt, dayStartUtc(filters.fromDay)) : void 0, filters?.toDay !== void 0 ? (0, import_drizzle_orm5.lte)(this.t.agentThread.updatedAt, dayEndUtc(filters.toDay)) : void 0);
+    const whereClause = (0, import_drizzle_orm5.and)((0, import_drizzle_orm5.isNull)(this.t.agentThread.deletedAt), filters?.actorRef !== void 0 ? (0, import_drizzle_orm5.eq)(this.t.agentThread.actorRef, filters.actorRef) : void 0, filters?.title !== void 0 ? (0, import_drizzle_orm5.like)(import_drizzle_orm5.sql`lower(${this.t.agentThread.title})`, `%${filters.title.toLowerCase()}%`) : void 0, filters?.fromDay !== void 0 ? (0, import_drizzle_orm5.gte)(this.t.agentThread.updatedAt, dayStartUtc(filters.fromDay)) : void 0, filters?.toDay !== void 0 ? (0, import_drizzle_orm5.lte)(this.t.agentThread.updatedAt, dayEndUtc(filters.toDay)) : void 0, this.tenantOn(this.t.agentThread.tenantRef));
     const [totalRow] = await this.db.select({
       value: (0, import_drizzle_orm5.count)()
     }).from(this.t.agentThread).where(whereClause);
@@ -4146,7 +4224,7 @@ var DrizzleGovernanceQueries = class {
     if (filters?.status !== void 0 && !isRunStatus(filters.status)) {
       return emptyPage(query);
     }
-    const whereClause = (0, import_drizzle_orm5.and)(filters?.agentName !== void 0 ? (0, import_drizzle_orm5.eq)(this.t.agentRun.agentName, filters.agentName) : void 0, filters?.status !== void 0 && isRunStatus(filters.status) ? (0, import_drizzle_orm5.eq)(this.t.agentRun.status, filters.status) : void 0, filters?.errorCode !== void 0 ? (0, import_drizzle_orm5.eq)(this.t.agentRun.errorCode, filters.errorCode) : void 0, filters?.threadId !== void 0 ? (0, import_drizzle_orm5.eq)(this.t.agentRun.threadId, filters.threadId) : void 0, filters?.fromDay !== void 0 ? (0, import_drizzle_orm5.gte)(this.t.agentRun.startedAt, dayStartUtc(filters.fromDay)) : void 0, filters?.toDay !== void 0 ? (0, import_drizzle_orm5.lte)(this.t.agentRun.startedAt, dayEndUtc(filters.toDay)) : void 0);
+    const whereClause = (0, import_drizzle_orm5.and)(filters?.agentName !== void 0 ? (0, import_drizzle_orm5.eq)(this.t.agentRun.agentName, filters.agentName) : void 0, filters?.status !== void 0 && isRunStatus(filters.status) ? (0, import_drizzle_orm5.eq)(this.t.agentRun.status, filters.status) : void 0, filters?.errorCode !== void 0 ? (0, import_drizzle_orm5.eq)(this.t.agentRun.errorCode, filters.errorCode) : void 0, filters?.threadId !== void 0 ? (0, import_drizzle_orm5.eq)(this.t.agentRun.threadId, filters.threadId) : void 0, filters?.fromDay !== void 0 ? (0, import_drizzle_orm5.gte)(this.t.agentRun.startedAt, dayStartUtc(filters.fromDay)) : void 0, filters?.toDay !== void 0 ? (0, import_drizzle_orm5.lte)(this.t.agentRun.startedAt, dayEndUtc(filters.toDay)) : void 0, this.threadIn(this.t.agentRun.threadId));
     const [totalRow] = await this.db.select({
       value: (0, import_drizzle_orm5.count)()
     }).from(this.t.agentRun).where(whereClause);
@@ -4170,7 +4248,7 @@ var DrizzleGovernanceQueries = class {
   */
   async approvalsPage(query) {
     const filters = query.where;
-    const whereClause = (0, import_drizzle_orm5.and)((0, import_drizzle_orm5.eq)(this.t.agentToolCall.status, "pending_approval"), filters?.toolName !== void 0 ? (0, import_drizzle_orm5.eq)(this.t.agentToolCall.toolName, filters.toolName) : void 0, filters?.threadId !== void 0 ? (0, import_drizzle_orm5.eq)(this.t.agentThread.id, filters.threadId) : void 0, filters?.actorRef !== void 0 ? (0, import_drizzle_orm5.eq)(this.t.agentThread.actorRef, filters.actorRef) : void 0, filters?.agentName !== void 0 ? (0, import_drizzle_orm5.eq)(this.t.agentMessage.agentName, filters.agentName) : void 0, filters?.fromDay !== void 0 ? (0, import_drizzle_orm5.gte)(this.t.agentToolCall.createdAt, dayStartUtc(filters.fromDay)) : void 0, filters?.toDay !== void 0 ? (0, import_drizzle_orm5.lte)(this.t.agentToolCall.createdAt, dayEndUtc(filters.toDay)) : void 0);
+    const whereClause = (0, import_drizzle_orm5.and)((0, import_drizzle_orm5.eq)(this.t.agentToolCall.status, "pending_approval"), filters?.toolName !== void 0 ? (0, import_drizzle_orm5.eq)(this.t.agentToolCall.toolName, filters.toolName) : void 0, filters?.threadId !== void 0 ? (0, import_drizzle_orm5.eq)(this.t.agentThread.id, filters.threadId) : void 0, filters?.actorRef !== void 0 ? (0, import_drizzle_orm5.eq)(this.t.agentThread.actorRef, filters.actorRef) : void 0, filters?.agentName !== void 0 ? (0, import_drizzle_orm5.eq)(this.t.agentMessage.agentName, filters.agentName) : void 0, filters?.fromDay !== void 0 ? (0, import_drizzle_orm5.gte)(this.t.agentToolCall.createdAt, dayStartUtc(filters.fromDay)) : void 0, filters?.toDay !== void 0 ? (0, import_drizzle_orm5.lte)(this.t.agentToolCall.createdAt, dayEndUtc(filters.toDay)) : void 0, this.tenantOn(this.t.agentThread.tenantRef));
     const [totalRow] = await this.db.select({
       value: (0, import_drizzle_orm5.count)()
     }).from(this.t.agentToolCall).innerJoin(this.t.agentMessage, (0, import_drizzle_orm5.eq)(this.t.agentToolCall.messageId, this.t.agentMessage.id)).innerJoin(this.t.agentThread, (0, import_drizzle_orm5.eq)(this.t.agentMessage.threadId, this.t.agentThread.id)).where(whereClause);
@@ -4211,7 +4289,7 @@ var DrizzleGovernanceQueries = class {
     const [row] = await this.db.select({
       run: this.t.agentRun,
       thread: this.t.agentThread
-    }).from(this.t.agentRun).innerJoin(this.t.agentThread, (0, import_drizzle_orm5.eq)(this.t.agentRun.threadId, this.t.agentThread.id)).where((0, import_drizzle_orm5.eq)(this.t.agentRun.id, runId)).limit(1);
+    }).from(this.t.agentRun).innerJoin(this.t.agentThread, (0, import_drizzle_orm5.eq)(this.t.agentRun.threadId, this.t.agentThread.id)).where((0, import_drizzle_orm5.and)((0, import_drizzle_orm5.eq)(this.t.agentRun.id, runId), this.tenantOn(this.t.agentThread.tenantRef))).limit(1);
     if (row === void 0) {
       return null;
     }
@@ -4235,7 +4313,7 @@ var DrizzleGovernanceQueries = class {
   * message. Soft-deleted threads are returned with `deleted: true`; an audit still needs them.
   */
   async threadDetail(query) {
-    const [thread] = await this.db.select().from(this.t.agentThread).where((0, import_drizzle_orm5.eq)(this.t.agentThread.id, query.threadId)).limit(1);
+    const [thread] = await this.db.select().from(this.t.agentThread).where((0, import_drizzle_orm5.and)((0, import_drizzle_orm5.eq)(this.t.agentThread.id, query.threadId), this.tenantOn(this.t.agentThread.tenantRef))).limit(1);
     if (thread === void 0) {
       return null;
     }
@@ -4287,7 +4365,7 @@ var DrizzleGovernanceQueries = class {
   async genuiStats(range) {
     const { start, end } = (0, import_nestjs_agent_core5.dayBoundsUtc)(range);
     const table = this.t.agentGenuiCall;
-    const rows = await this.db.select().from(table).where((0, import_drizzle_orm5.and)((0, import_drizzle_orm5.gte)(table.createdAt, start.getTime()), (0, import_drizzle_orm5.lte)(table.createdAt, end.getTime())));
+    const rows = await this.db.select().from(table).where((0, import_drizzle_orm5.and)((0, import_drizzle_orm5.gte)(table.createdAt, start.getTime()), (0, import_drizzle_orm5.lte)(table.createdAt, end.getTime()), this.threadIn(table.threadId)));
     return (0, import_nestjs_agent_core5.summarizeGenuiCalls)(rows.map(toGenuiCallRow));
   }
   /** Tool-call counts for a set of messages in ONE grouped query — the detail view's no-N+1 guarantee. */