@engenty/wizards-runtime 0.0.0-stage → 0.7.5

package/apps/runtime/dist/credits/estimate.js

@@ -0,0 +1,152 @@
+import { isDecidedField, isDecisionStep, } from "@engenty-wizards/shared/definition";
+import { and, desc, eq, inArray, isNull } from "drizzle-orm";
+import { db, schema } from "../db/client.js";
+import { mostAlongOnePath } from "../engine/requirements.js";
+import { classCatalog } from "../models.js";
+import { MICROS_PER_CREDIT } from "./credits.js";
+/**
+ * What a run will cost, in credits, before it starts. A step that has run five times on this
+ * version is estimated from its measurements (median, and the 90th percentile as the amount to
+ * hold); until then a formula per step type and model class stands in.
+ */
+const MIN_SAMPLES = 5;
+const SAMPLE_RUNS = 40;
+/** Tokens a text call of each shape takes, as [input, output]. */
+const TOKENS = {
+    plain: [8_000, 1_500],
+    tools: [60_000, 4_000],
+    browser: [250_000, 8_000],
+    document: [6_000, 8_000],
+    prompt: [2_000, 300],
+    structure: [4_000, 1_000],
+    decision: [1_500, 100],
+};
+function textCredits(price, [input, output]) {
+    if (!price) {
+        return 0;
+    }
+    return ((input / 1e6) * (price.inputCreditsPerMTok ?? 0) +
+        (output / 1e6) * (price.outputCreditsPerMTok ?? 0));
+}
+/** A step's own work, and one decision where `ask` branches or a page's fields are decided. */
+function formula(step, catalog) {
+    const decides = step.next?.some((r) => r.ask) || (step.type === "page" && step.fields.some(isDecidedField));
+    const decision = decides ? textCredits(catalog.classes.classifier, TOKENS.decision) : 0;
+    return decision + stepFormula(step, catalog);
+}
+function stepFormula(step, catalog) {
+    const cls = (c) => catalog.classes[c];
+    if (step.type === "agent") {
+        // A call runs one tool and no model: nothing to pay for.
+        if (step.call) {
+            return 0;
+        }
+        // A decision is one small call to the classifier class.
+        if (isDecisionStep(step)) {
+            return textCredits(cls("classifier"), TOKENS.decision);
+        }
+        const shape = step.tools.includes("browser")
+            ? TOKENS.browser
+            : step.tools.length || step.mcp?.length || step.connections?.length
+                ? TOKENS.tools
+                : TOKENS.plain;
+        // A step with `each` runs once per entry; until it has run, three stand in.
+        let credits = textCredits(cls(step.model ?? "high"), shape) * (step.each ? 3 : 1);
+        if (step.tools.includes("web_search")) {
+            credits += 4 * catalog.webSearchCredits;
+        }
+        if (step.tools.includes("image")) {
+            credits += catalog.classes.image?.creditsPerImage ?? 0;
+        }
+        if (step.output.format === "json") {
+            credits += textCredits(cls("classifier"), TOKENS.structure);
+        }
+        if (step.output.surface === true) {
+            credits += textCredits(cls("standard"), TOKENS.structure);
+        }
+        return credits;
+    }
+    if (step.type === "generate") {
+        if (step.asset === "image") {
+            return ((catalog.classes.image?.creditsPerImage ?? 0) + textCredits(cls("standard"), TOKENS.prompt));
+        }
+        if (step.asset === "video") {
+            const seconds = Math.min(Math.max(Math.round(step.options?.duration ?? 8), 4), 10);
+            return (seconds * (catalog.classes.video?.creditsPerSecond ?? 0) +
+                textCredits(cls("standard"), TOKENS.prompt));
+        }
+        return textCredits(cls(step.model ?? "high"), TOKENS.document);
+    }
+    return 0;
+}
+/**
+ * What a run of a definition costs by the formula alone — before anyone has run it — along its
+ * most expensive way that avoids the steps in `closed`.
+ */
+export function formulaEstimate(definition, catalog, closed) {
+    const credits = mostAlongOnePath(definition, (step) => formula(step, catalog), closed);
+    return { credits: round(credits), high: Math.ceil(credits * 2) };
+}
+function percentile(sorted, p) {
+    return sorted[Math.min(sorted.length - 1, Math.floor(p * sorted.length))];
+}
+/** Credits each step cost in the latest finished runs of this wizard version. */
+async function measurements(wizardId, version) {
+    const runs = await db
+        .select({ id: schema.run.id })
+        .from(schema.run)
+        .where(and(eq(schema.run.wizardId, wizardId), eq(schema.run.status, "done"), version === null ? isNull(schema.run.version) : eq(schema.run.version, version)))
+        .orderBy(desc(schema.run.createdAt))
+        .limit(SAMPLE_RUNS);
+    const out = new Map();
+    if (!runs.length) {
+        return out;
+    }
+    const costs = await db
+        .select()
+        .from(schema.runCost)
+        .where(inArray(schema.runCost.runId, runs.map((r) => r.id)));
+    for (const c of costs) {
+        const list = out.get(c.stepId) ?? [];
+        list.push(c.micros / MICROS_PER_CREDIT);
+        out.set(c.stepId, list);
+    }
+    return out;
+}
+const round = (credits) => Math.round(credits * 10) / 10;
+/**
+ * What a run will cost and how much to hold, along its most expensive way: steps on branches
+ * that exclude each other are not added up. `closed`: steps the run cannot take here.
+ */
+export async function estimateRun(wizardId, version, definition, closed) {
+    const catalog = await classCatalog();
+    if (!catalog) {
+        // A runtime that resolves models itself has no credits to estimate in.
+        return { available: false, credits: 0, reserve: 0, steps: {} };
+    }
+    const measured = await measurements(wizardId, version);
+    const steps = {};
+    for (const step of definition.steps) {
+        const samples = (measured.get(step.id) ?? []).sort((a, b) => a - b);
+        let estimate;
+        if (samples.length >= MIN_SAMPLES) {
+            estimate = {
+                credits: round(percentile(samples, 0.5)),
+                high: round(percentile(samples, 0.9)),
+                measured: true,
+            };
+        }
+        else {
+            const value = formula(step, catalog);
+            if (value <= 0) {
+                continue;
+            }
+            // A formula knows little: hold twice as much as it says.
+            estimate = { credits: round(value), high: round(value * 2), measured: false };
+        }
+        steps[step.id] = estimate;
+    }
+    const credits = mostAlongOnePath(definition, (s) => steps[s.id]?.credits ?? 0, closed);
+    const reserve = mostAlongOnePath(definition, (s) => steps[s.id]?.high ?? 0, closed);
+    return { available: true, credits: round(credits), reserve: Math.ceil(reserve), steps };
+}

package/apps/runtime/dist/db/adopt.js

@@ -0,0 +1,149 @@
+import { existsSync } from "node:fs";
+import { cp } from "node:fs/promises";
+import { join } from "node:path";
+import { createClient } from "@libsql/client";
+import { env } from "../env.js";
+import { readSetting, writeSetting } from "../settings.js";
+import { LOCAL_TENANT } from "../tenants/tenant.js";
+import { control, controlDb, openTenantDb } from "./client.js";
+/**
+ * A data folder from before tenants had their own database holds everything in `wizards.db`,
+ * owned by a user. Its wizards, runs and files become the local tenant's, once. The old file
+ * and folders stay where they are.
+ */
+const TABLES = [
+    "project",
+    "wizard",
+    "wizard_version",
+    "wizard_file",
+    "wizard_message",
+    "run",
+    "run_event",
+    "asset",
+    "project_connector",
+    "store_holder",
+    "store_row",
+    "store_file",
+    "store_secret",
+];
+const CLASS_OF = { fast: "standard", smart: "high" };
+/** Steps named a model speed before they named a model class. */
+function withClasses(json) {
+    if (typeof json !== "string") {
+        return json;
+    }
+    try {
+        const def = JSON.parse(json);
+        for (const step of def.steps ?? []) {
+            if (step.model && CLASS_OF[step.model]) {
+                step.model = CLASS_OF[step.model];
+            }
+        }
+        return JSON.stringify(def);
+    }
+    catch {
+        return json;
+    }
+}
+const personOf = (holder) => typeof holder === "string" && holder.startsWith("u:") ? "u:local" : holder;
+export async function adoptLegacyData() {
+    const legacyFile = join(env.dataDir, "wizards.db");
+    const targetFile = join(env.dataDir, "tenants", `${LOCAL_TENANT}.db`);
+    if (!existsSync(legacyFile) || existsSync(targetFile) || (await readSetting("adopted"))) {
+        return;
+    }
+    const legacy = createClient({ url: `file:${legacyFile}` });
+    const hasOwner = (await legacy.execute("PRAGMA table_info(project)")).rows.some((r) => r.name === "owner_id");
+    if (!hasOwner) {
+        return;
+    }
+    await openTenantDb(LOCAL_TENANT);
+    const target = createClient({ url: `file:${targetFile}` });
+    const statements = [];
+    const links = [];
+    const runs = [];
+    for (const table of TABLES) {
+        const targetColumns = new Set((await target.execute(`PRAGMA table_info(${table})`)).rows.map((r) => String(r.name)));
+        const rows = (await legacy.execute(`SELECT * FROM ${table}`).catch(() => ({ rows: [] }))).rows;
+        for (const row of rows) {
+            const values = {};
+            for (const [column, value] of Object.entries(row)) {
+                const name = column === "owner_id" ? "tenant_id" : column;
+                if (targetColumns.has(name)) {
+                    values[name] = value;
+                }
+            }
+            if ("tenant_id" in values) {
+                values.tenant_id = LOCAL_TENANT;
+            }
+            if ("holder" in values) {
+                values.holder = personOf(values.holder);
+            }
+            if (table === "wizard") {
+                values.draft = withClasses(values.draft);
+                links.push({
+                    token: String(values.share_token),
+                    tenantId: LOCAL_TENANT,
+                    kind: "wizard",
+                    ref: String(values.id),
+                });
+            }
+            if (table === "wizard_version" || table === "run") {
+                values.definition = withClasses(values.definition);
+            }
+            if (table === "run") {
+                values.user_id = values.user_id ? "local" : null;
+                runs.push({
+                    runId: String(values.id),
+                    tenantId: LOCAL_TENANT,
+                    visitorId: values.visitor_id ?? null,
+                    ipHash: values.ip_hash ?? null,
+                    active: values.status === "running",
+                    createdAt: new Date(Number(values.created_at)),
+                });
+                if (values.share_token) {
+                    links.push({
+                        token: String(values.share_token),
+                        tenantId: LOCAL_TENANT,
+                        kind: "result",
+                        ref: String(values.id),
+                    });
+                }
+            }
+            if (table === "asset" && values.kind === "logo") {
+                links.push({
+                    token: String(values.id),
+                    tenantId: LOCAL_TENANT,
+                    kind: "logo",
+                    ref: String(values.id),
+                });
+            }
+            const columns = Object.keys(values);
+            statements.push({
+                sql: `INSERT INTO ${table} (${columns.join(", ")}) VALUES (${columns.map(() => "?").join(", ")})`,
+                args: columns.map((c) => values[c]),
+            });
+        }
+    }
+    await target.batch(statements, "write");
+    for (let i = 0; i < links.length; i += 100) {
+        await controlDb
+            .insert(control.link)
+            .values(links.slice(i, i + 100))
+            .onConflictDoNothing();
+    }
+    for (let i = 0; i < runs.length; i += 100) {
+        await controlDb
+            .insert(control.runIndex)
+            .values(runs.slice(i, i + 100))
+            .onConflictDoNothing();
+    }
+    for (const folder of ["assets", "blobs"]) {
+        const from = join(env.dataDir, folder);
+        if (existsSync(from)) {
+            await cp(from, join(env.dataDir, "objects", "t", LOCAL_TENANT, folder), { recursive: true });
+        }
+    }
+    await writeSetting("adopted", new Date().toISOString());
+    console.log(`Adopted ${statements.length} rows from ${legacyFile} into the local tenant.`);
+}

package/apps/runtime/dist/db/client.js

@@ -0,0 +1,173 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { mkdirSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+import { createClient } from "@libsql/client";
+import { eq } from "drizzle-orm";
+import { drizzle } from "drizzle-orm/libsql";
+import { migrate } from "drizzle-orm/libsql/migrator";
+import { env } from "../env.js";
+import { currentTenant, inTenant } from "../tenants/tenant.js";
+import * as control from "./control-schema.js";
+import * as schema from "./schema.js";
+mkdirSync(join(env.dataDir, "tenants"), { recursive: true });
+const here = dirname(fileURLToPath(import.meta.url));
+/** Migrations are SQL files next to this module; the build copies them next to the built one. */
+function migrationsFolder(name) {
+    return join(here, "migrations", name);
+}
+function open(url, authToken) {
+    return createClient({ url, ...(authToken ? { authToken } : {}) });
+}
+async function prepare(client, url) {
+    if (url.startsWith("file:")) {
+        await client.execute("PRAGMA journal_mode = WAL");
+        await client.execute("PRAGMA busy_timeout = 5000");
+    }
+    await client.execute("PRAGMA foreign_keys = ON");
+}
+// --- control database --------------------------------------------------------
+const controlUrl = env.databaseUrl || `file:${join(env.dataDir, "control.db")}`;
+const controlClient = open(controlUrl, env.databaseAuthToken);
+/** Links, the run index, sessions and settings: what is known before a tenant's database opens. */
+export const controlDb = drizzle(controlClient, { schema: control });
+export { control };
+export async function migrateControlDb() {
+    await prepare(controlClient, controlUrl);
+    await migrate(controlDb, { migrationsFolder: migrationsFolder("control") });
+}
+// --- tenant databases --------------------------------------------------------
+function makeTenantDb(client) {
+    return drizzle(client, { schema });
+}
+const opened = new Map();
+const clients = new Map();
+/** Where a tenant's database lives: the URL the Manage-App handed out, else a file in the data folder. */
+function tenantUrl(id, dbUrl) {
+    if (dbUrl) {
+        return dbUrl;
+    }
+    if (env.tenantDbUrlTemplate) {
+        return env.tenantDbUrlTemplate.replaceAll("{tenant}", id.toLowerCase());
+    }
+    return `file:${join(env.dataDir, "tenants", `${id}.db`)}`;
+}
+async function openTenant(id) {
+    let row = await controlDb.query.tenant.findFirst({ where: eq(control.tenant.id, id) });
+    if (!row) {
+        await controlDb.insert(control.tenant).values({ id }).onConflictDoNothing();
+        row = (await controlDb.query.tenant.findFirst({ where: eq(control.tenant.id, id) }));
+    }
+    const url = tenantUrl(id, row.dbUrl);
+    const client = open(url, url.startsWith("file:") ? "" : env.tenantDbAuthToken);
+    clients.set(id, client);
+    await prepare(client, url);
+    const db = makeTenantDb(client);
+    // Every database is brought to the current schema when it is first opened.
+    await migrate(db, { migrationsFolder: migrationsFolder("tenant") });
+    for (const hook of openHooks) {
+        await hook(id, client);
+    }
+    return db;
+}
+const openHooks = [];
+/** Runs for every tenant database right after it was opened and migrated (plugins' own tables). */
+export function onTenantOpen(hook) {
+    openHooks.push(hook);
+}
+/** The tenant databases this process has open, once each of them finished opening. */
+export async function openTenantClients() {
+    await Promise.allSettled(opened.values());
+    return [...clients.entries()];
+}
+/** The only way to a tenant's tables. Opens the database once per process and migrates it then. */
+export function tenantDb(id) {
+    let db = opened.get(id);
+    if (!db) {
+        db = openTenant(id).catch((err) => {
+            opened.delete(id);
+            throw err;
+        });
+        opened.set(id, db);
+    }
+    return db;
+}
+const ready = new Map();
+/** Closes and forgets an open tenant database (the tenant was deleted or moved). */
+export function closeTenantDb(id) {
+    opened.delete(id);
+    ready.delete(id);
+    clients.get(id)?.close();
+    clients.delete(id);
+}
+/** Opens the current tenant's database; `db` works synchronously afterwards. */
+export async function openTenantDb(id) {
+    if (!ready.has(id)) {
+        ready.set(id, await tenantDb(id));
+    }
+}
+/** Runs `fn` for one tenant: opens its database, then sets the context `db` resolves from. */
+export async function withTenant(id, fn) {
+    await openTenantDb(id);
+    return inTenant(id, fn);
+}
+/** The transaction the current context writes in, while `inTransaction()` runs. */
+const transactions = new AsyncLocalStorage();
+/**
+ * Runs `fn` as one transaction of the current tenant's database: inside it, `db` is the
+ * transaction, so every write of the services called there stands or falls with the others.
+ * Already inside one, `fn` just joins it. Only this database takes part: the object store and
+ * the control database are written as before, so do those first or after.
+ */
+export async function inTransaction(fn) {
+    if (transactions.getStore()) {
+        return fn();
+    }
+    const id = currentTenant();
+    const target = ready.get(id);
+    if (!target) {
+        throw new Error(`Tenant database "${id}" is not open: enter it with withTenant().`);
+    }
+    return target.transaction((tx) => transactions.run(tx, fn));
+}
+/**
+ * The current tenant's database, resolved from the context `inTenant()` set — or the
+ * transaction `inTransaction()` opened there. Code that reads or writes wizards, runs or files
+ * never names a tenant itself.
+ */
+export const db = new Proxy({}, {
+    get(_target, prop) {
+        const id = currentTenant();
+        const target = transactions.getStore() ?? ready.get(id);
+        if (!target) {
+            throw new Error(`Tenant database "${id}" is not open: enter it with withTenant().`);
+        }
+        const value = Reflect.get(target, prop);
+        return typeof value === "function" ? value.bind(target) : value;
+    },
+});
+export { schema };
+/** Brings every known tenant database to the current schema (after a release). */
+export async function migrateAllTenants() {
+    const tenants = await controlDb.select({ id: control.tenant.id }).from(control.tenant);
+    const failed = [];
+    let migrated = 0;
+    const queue = [...tenants];
+    await Promise.all(Array.from({ length: 4 }, async () => {
+        for (let t = queue.shift(); t; t = queue.shift()) {
+            try {
+                await openTenantDb(t.id);
+                migrated++;
+            }
+            catch (err) {
+                console.error(`[migrate ${t.id}]`, err);
+                failed.push(t.id);
+            }
+        }
+    }));
+    return { migrated, failed };
+}
+export async function knownTenants() {
+    const rows = await controlDb.select({ id: control.tenant.id }).from(control.tenant);
+    return rows.map((r) => r.id);
+}

package/apps/runtime/dist/db/control-schema.js

@@ -0,0 +1,133 @@
+import { sql } from "drizzle-orm";
+import { index, integer, primaryKey, sqliteTable, text, uniqueIndex, } from "drizzle-orm/sqlite-core";
+const now = sql `(unixepoch() * 1000)`;
+const createdAt = () => integer("created_at", { mode: "timestamp_ms" }).notNull().default(now);
+// The control database: what the runtime must know before it can open a tenant's database,
+// and what it counts across tenants. No wizard, run content or file lives here.
+/** Every tenant this runtime has opened. `dbUrl` null = a libSQL file in the data folder. */
+export const tenant = sqliteTable("tenant", {
+    id: text("id").primaryKey(),
+    status: text("status", { enum: ["active", "suspended"] })
+        .notNull()
+        .default("active"),
+    dbUrl: text("db_url"),
+    createdAt: createdAt(),
+});
+/** Public tokens that arrive without a session: which tenant, and which row there. */
+export const link = sqliteTable("link", {
+    token: text("token").primaryKey(),
+    tenantId: text("tenant_id").notNull(),
+    /**
+     * `wizard` = a share link `/w/<token>`, `result` = a shared result `/s/<token>`, `logo` = a
+     * brand logo, `code` = a wizard's ID to type in (its `ref` is the wizard's share token).
+     */
+    kind: text("kind", { enum: ["wizard", "result", "logo", "code"] }).notNull(),
+    ref: text("ref").notNull(),
+    createdAt: createdAt(),
+}, (t) => [index("link_tenant").on(t.tenantId), index("link_ref").on(t.kind, t.ref)]);
+/**
+ * One row per run: finds the run's tenant, counts a visitor's runs across all wizards, and
+ * marks the runs that are working (resumed after a restart, counted against the tenant's limit).
+ */
+export const runIndex = sqliteTable("run_index", {
+    runId: text("run_id").primaryKey(),
+    tenantId: text("tenant_id").notNull(),
+    visitorId: text("visitor_id"),
+    ipHash: text("ip_hash"),
+    active: integer("active", { mode: "boolean" }).notNull().default(false),
+    /** The runner working on the run; null while it waits for one. */
+    owner: text("owner"),
+    /** The owner's last heartbeat; one silent for RUNNER_STALE_MS has lost the run. */
+    seen: integer("seen", { mode: "timestamp_ms" }),
+    /**
+     * The mobile app's device for push, set by the app for this run (`POST /api/runs/:id/notify`):
+     * `{ token, platform: "ios" | "android", lang }`. Told through the Manage-App when the run is
+     * done, failed or waits for the person.
+     */
+    push: text("push", { mode: "json" }).$type(),
+    createdAt: createdAt(),
+}, (t) => [
+    index("run_index_visitor").on(t.visitorId, t.createdAt),
+    index("run_index_ip").on(t.ipHash, t.createdAt),
+    index("run_index_active").on(t.active, t.tenantId),
+]);
+/**
+ * The runners that execute runs (RUNTIME_ROLE=runner or all): where the web reaches one for what
+ * only the process holding a run can answer (its browser's screen), and when it last reported.
+ */
+export const runner = sqliteTable("runner", {
+    id: text("id").primaryKey(),
+    url: text("url"),
+    seen: integer("seen", { mode: "timestamp_ms" }).notNull(),
+});
+/** A studio session of someone signed in at the Manage-App. The refresh token is encrypted. */
+export const session = sqliteTable("session", {
+    id: text("id").primaryKey(),
+    userId: text("user_id").notNull(),
+    tenantId: text("tenant_id").notNull(),
+    role: text("role").notNull(),
+    name: text("name").notNull(),
+    email: text("email").notNull(),
+    image: text("image"),
+    refreshToken: text("refresh_token"),
+    /** When the access token's claims (tenant, role) must be renewed. */
+    claimsExpireAt: integer("claims_expire_at", { mode: "timestamp_ms" }).notNull(),
+    expiresAt: integer("expires_at", { mode: "timestamp_ms" }).notNull(),
+    createdAt: createdAt(),
+}, (t) => [index("session_expires").on(t.expiresAt)]);
+/** Settings of a runtime that runs alone: model bindings, the linked account. Never secrets. */
+export const setting = sqliteTable("setting", {
+    key: text("key").primaryKey(),
+    value: text("value", { mode: "json" }).$type().notNull(),
+});
+/**
+ * The runner's own words in a language outside `LANGS`, translated once for the runtime:
+ * `source` is the hash of the English tables they were made from.
+ */
+export const uiTranslation = sqliteTable("ui_translation", {
+    lang: text("lang").primaryKey(),
+    source: text("source").notNull(),
+    texts: text("texts", { mode: "json" }).$type().notNull(),
+    createdAt: createdAt(),
+});
+// --- marketplace -----------------------------------------------------------------
+// The marketplace is an app of its own (docs/marketplace-contract.md). What this runtime keeps
+// of it for offline use: its starters and what people starred, as the marketplace exports them.
+export const marketplaceCache = sqliteTable("marketplace_cache", {
+    id: text("id").primaryKey(),
+    /** The marketplace's hash of the entry: a different one in its list means it changed. */
+    hash: text("hash").notNull(),
+    entry: text("entry", { mode: "json" }).$type().notNull(),
+    fetchedAt: integer("fetched_at", { mode: "timestamp_ms" }).notNull().default(now),
+});
+/** When a plugin's job (`server.every`) last ran for a tenant: the next turn counts from it. */
+export const pluginJob = sqliteTable("plugin_job", {
+    tenantId: text("tenant_id").notNull(),
+    plugin: text("plugin").notNull(),
+    name: text("name").notNull(),
+    lastRunAt: integer("last_run_at", { mode: "timestamp_ms" }).notNull(),
+}, (t) => [primaryKey({ columns: [t.tenantId, t.plugin, t.name] })]);
+/**
+ * The part of a plugin's public address (`server.publicUrl`) that names the tenant, without
+ * giving its id away: `/api/public/plugins/<plugin>/<ref>/…`.
+ */
+export const pluginAddress = sqliteTable("plugin_address", {
+    ref: text("ref").primaryKey(),
+    tenantId: text("tenant_id").notNull(),
+    plugin: text("plugin").notNull(),
+    createdAt: createdAt(),
+}, (t) => [uniqueIndex("plugin_address_tenant").on(t.tenantId, t.plugin)]);
+/**
+ * Keys a plugin holds across tenants (`server.claims`), each for one tenant at a time: a keyword
+ * on a number every tenant shares, who writes to it, a number a tenant connected. What a shared
+ * route asks to find the tenant of a call.
+ */
+export const pluginClaim = sqliteTable("plugin_claim", {
+    plugin: text("plugin").notNull(),
+    key: text("key").notNull(),
+    tenantId: text("tenant_id").notNull(),
+    updatedAt: integer("updated_at", { mode: "timestamp_ms" }).notNull().default(now),
+}, (t) => [
+    primaryKey({ columns: [t.plugin, t.key] }),
+    index("plugin_claim_tenant").on(t.tenantId, t.plugin),
+]);

package/apps/runtime/dist/db/migrations/control/0000_last_absorbing_man.sql

@@ -0,0 +1,47 @@
+CREATE TABLE `link` (
+	`token` text PRIMARY KEY NOT NULL,
+	`tenant_id` text NOT NULL,
+	`kind` text NOT NULL,
+	`ref` text NOT NULL,
+	`created_at` integer DEFAULT (unixepoch() * 1000) NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX `link_tenant` ON `link` (`tenant_id`);--> statement-breakpoint
+CREATE TABLE `run_index` (
+	`run_id` text PRIMARY KEY NOT NULL,
+	`tenant_id` text NOT NULL,
+	`visitor_id` text,
+	`ip_hash` text,
+	`active` integer DEFAULT false NOT NULL,
+	`created_at` integer DEFAULT (unixepoch() * 1000) NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX `run_index_visitor` ON `run_index` (`visitor_id`,`created_at`);--> statement-breakpoint
+CREATE INDEX `run_index_ip` ON `run_index` (`ip_hash`,`created_at`);--> statement-breakpoint
+CREATE INDEX `run_index_active` ON `run_index` (`active`,`tenant_id`);--> statement-breakpoint
+CREATE TABLE `session` (
+	`id` text PRIMARY KEY NOT NULL,
+	`user_id` text NOT NULL,
+	`tenant_id` text NOT NULL,
+	`role` text NOT NULL,
+	`name` text NOT NULL,
+	`email` text NOT NULL,
+	`image` text,
+	`refresh_token` text,
+	`claims_expire_at` integer NOT NULL,
+	`expires_at` integer NOT NULL,
+	`created_at` integer DEFAULT (unixepoch() * 1000) NOT NULL
+);
+--> statement-breakpoint
+CREATE INDEX `session_expires` ON `session` (`expires_at`);--> statement-breakpoint
+CREATE TABLE `setting` (
+	`key` text PRIMARY KEY NOT NULL,
+	`value` text NOT NULL
+);
+--> statement-breakpoint
+CREATE TABLE `tenant` (
+	`id` text PRIMARY KEY NOT NULL,
+	`status` text DEFAULT 'active' NOT NULL,
+	`db_url` text,
+	`created_at` integer DEFAULT (unixepoch() * 1000) NOT NULL
+);