@engenty/wizards-runtime 0.0.0-stage → 0.7.6

package/apps/runtime/dist/connectors/mail.js

@@ -0,0 +1,72 @@
+import { z } from "zod";
+/**
+ * Mail as wizards use it: read-only, and the same three actions whichever provider the person
+ * connected. Every mail connector is an engenty `ConnectorDefinition` whose actions are these.
+ */
+export const mailSearchInput = z.object({
+    terms: z
+        .array(z.string().min(1))
+        .max(12)
+        .optional()
+        .describe("Words to look for in subject and body; a mail matches when ANY of them occurs."),
+    from: z.string().optional().describe("Sender address or domain, e.g. billing@notion.so"),
+    since: z.string().optional().describe("First day, YYYY-MM-DD (inclusive)."),
+    until: z.string().optional().describe("Last day, YYYY-MM-DD (inclusive)."),
+    has_attachment: z.boolean().optional(),
+    limit: z.number().int().min(1).max(100).optional().describe("Newest first; default 40."),
+});
+export const mailReadInput = z.object({ id: z.string() });
+export const mailAttachmentInput = z.object({ id: z.string(), attachment_id: z.string() });
+export function mailActions(backend, providerScopes) {
+    return [
+        {
+            id: "search",
+            group: "read",
+            summary: "Search the mailbox",
+            description: "Search the mailbox, newest first. Returns id, date, sender, subject, a snippet and the attachments of each mail.",
+            inputSchema: mailSearchInput,
+            providerScopes,
+            handler: async (input, ctx) => ({
+                mails: await backend.search(mailSearchInput.parse(input), ctx),
+            }),
+        },
+        {
+            id: "read",
+            group: "read",
+            summary: "Read one mail",
+            description: "Read one mail in full: sender, recipients, text and attachments.",
+            inputSchema: mailReadInput,
+            providerScopes,
+            handler: (input, ctx) => backend.read(mailReadInput.parse(input).id, ctx),
+        },
+        {
+            id: "get_attachment",
+            group: "read",
+            summary: "Fetch an attachment",
+            description: "Fetch one attachment's bytes (base64).",
+            inputSchema: mailAttachmentInput,
+            providerScopes,
+            handler: (input, ctx) => {
+                const { id, attachment_id } = mailAttachmentInput.parse(input);
+                return backend.attachment(id, attachment_id, ctx);
+            },
+        },
+    ];
+}
+/** Calls one of a mail connector's actions. */
+export async function mailAction(connector, actionId, input, ctx) {
+    const action = connector.actions.find((a) => a.id === actionId);
+    if (!action) {
+        throw new Error(`${connector.name} has no action "${actionId}".`);
+    }
+    return (await action.handler(input, ctx));
+}
+export function snippetOf(text, length = 240) {
+    return text.replace(/\s+/g, " ").trim().slice(0, length);
+}
+/** The day after a YYYY-MM-DD date — for providers whose "before" is exclusive. */
+export function dayAfter(day) {
+    const d = new Date(`${day}T00:00:00Z`);
+    d.setUTCDate(d.getUTCDate() + 1);
+    return d.toISOString().slice(0, 10);
+}

package/apps/runtime/dist/connectors/outlook.js

@@ -0,0 +1,90 @@
+import { bodyToText, graphJson, MICROSOFT_OAUTH2 } from "../engenty/connections-microsoft/graph.js";
+import { mailActions, snippetOf, } from "./mail.js";
+const SCOPE_READ = "Mail.Read";
+const address = (a) => {
+    const e = a?.emailAddress;
+    return e?.address ? (e.name ? `${e.name} <${e.address}>` : e.address) : null;
+};
+/** KQL, the language of Graph's `$search` on messages. */
+function kql(input) {
+    const quote = (t) => `"${t.replace(/["\\]/g, "")}"`;
+    const parts = [
+        input.terms?.length ? `(${input.terms.map(quote).join(" OR ")})` : "",
+        input.from ? `from:${quote(input.from)}` : "",
+        input.since || input.until
+            ? `received:${input.since ?? "1990-01-01"}..${input.until ?? "2999-12-31"}`
+            : "",
+        input.has_attachment ? "hasAttachments:true" : "",
+    ].filter(Boolean);
+    return parts.join(" AND ");
+}
+async function attachmentsOf(ctx, id) {
+    const data = await graphJson(ctx, `/me/messages/${encodeURIComponent(id)}/attachments?$select=id,name,contentType,size,isInline`);
+    return (data.value ?? [])
+        .filter((a) => !a.isInline)
+        .map((a) => ({
+        id: a.id,
+        name: a.name ?? "attachment",
+        mime: a.contentType ?? "application/octet-stream",
+        size: a.size ?? null,
+    }));
+}
+const SELECT = "id,subject,bodyPreview,receivedDateTime,hasAttachments,from";
+const backend = {
+    async search(input, ctx) {
+        const params = new URLSearchParams({ $select: SELECT, $top: String(input.limit ?? 40) });
+        const search = kql(input);
+        if (search) {
+            params.set("$search", `"${search.replace(/"/g, '\\"')}"`);
+        }
+        else {
+            params.set("$orderby", "receivedDateTime desc");
+        }
+        const data = await graphJson(ctx, `/me/messages?${params}`);
+        const messages = data.value ?? [];
+        return Promise.all(messages.map(async (m) => ({
+            id: m.id,
+            date: m.receivedDateTime ?? null,
+            from: address(m.from),
+            subject: m.subject ?? null,
+            snippet: snippetOf(m.bodyPreview ?? ""),
+            attachments: m.hasAttachments ? await attachmentsOf(ctx, m.id) : [],
+        })));
+    },
+    async read(id, ctx) {
+        const m = await graphJson(ctx, `/me/messages/${encodeURIComponent(id)}?$select=${SELECT},toRecipients,body`);
+        const text = bodyToText(m.body);
+        return {
+            id: m.id,
+            date: m.receivedDateTime ?? null,
+            from: address(m.from),
+            to: (m.toRecipients ?? []).map(address).filter((a) => Boolean(a)),
+            subject: m.subject ?? null,
+            snippet: snippetOf(m.bodyPreview ?? text),
+            attachments: m.hasAttachments ? await attachmentsOf(ctx, m.id) : [],
+            text,
+            html: m.body?.contentType?.toLowerCase() === "html" ? (m.body.content ?? null) : null,
+        };
+    },
+    async attachment(id, attachmentId, ctx) {
+        const a = await graphJson(ctx, `/me/messages/${encodeURIComponent(id)}/attachments/${encodeURIComponent(attachmentId)}`);
+        if (!a.contentBytes) {
+            throw new Error("This attachment is not a file.");
+        }
+        return {
+            name: a.name ?? "attachment",
+            mime: a.contentType ?? "application/octet-stream",
+            data_base64: a.contentBytes,
+        };
+    },
+};
+export const outlookConnector = {
+    id: "mail-outlook",
+    moduleId: "wizards-mail",
+    name: "Outlook",
+    description: "Read mail in an Outlook or Microsoft 365 account.",
+    icon: "logo:outlook",
+    toolPrefix: "mail",
+    auth: { kind: "oauth2", oauth2: MICROSOFT_OAUTH2 },
+    actions: mailActions(backend, [SCOPE_READ]),
+};

package/apps/runtime/dist/connectors/plugin-connections.js

@@ -0,0 +1,343 @@
+import { and, desc, eq } from "drizzle-orm";
+import { nanoid } from "nanoid";
+import { db, schema } from "../db/client.js";
+import { buildAuthorizationUrl, createOAuth2Pkce, exchangeAuthorizationCode, refreshAccessToken, } from "../engenty/connections-sdk/oauth2.js";
+import { seal, unseal } from "../secrets/crypto.js";
+import { currentTenant } from "../tenants/tenant.js";
+import { builtinConnector, connectorFetch, resolveEnv, usable, viaAccount } from "./builtin.js";
+import { connectRedirectUri as redirectUri } from "./index.js";
+import { AccountConnectError, redeemTicket, refreshThroughAccount, startThroughAccount, } from "./via-account.js";
+function oauthConnector(id) {
+    const connector = builtinConnector(id);
+    if (connector?.auth.kind !== "oauth2") {
+        throw new Error(`"${id}" is not a built-in connector that signs in.`);
+    }
+    return connector;
+}
+/** A built-in connector a plugin may connect: signed in, or with keys. */
+function connectorOf(id) {
+    const connector = builtinConnector(id);
+    if (!connector || connector.auth.kind === "browser") {
+        throw new Error(`"${id}" is not a built-in connector a plugin can connect.`);
+    }
+    return connector;
+}
+/** The actions a connection is made for exist on the connector. */
+function knownActions(connector, actions) {
+    for (const id of actions) {
+        if (!connector.actions.some((a) => a.id === id)) {
+            throw new Error(`${connector.name} has no action "${id}".`);
+        }
+    }
+    return [...new Set(actions)];
+}
+async function spaceExists(space) {
+    const project = await db.query.project.findFirst({
+        where: eq(schema.project.id, space),
+        columns: { id: true },
+    });
+    if (!project) {
+        throw new Error(`There’s no space “${space}”.`);
+    }
+}
+/** Keeps a connection: the same account for the same space again replaces the first one. */
+async function keep(input) {
+    const same = await db.query.pluginConnection.findFirst({
+        where: and(eq(schema.pluginConnection.plugin, input.plugin), eq(schema.pluginConnection.projectId, input.projectId), eq(schema.pluginConnection.connector, input.connector), eq(schema.pluginConnection.label, input.label)),
+    });
+    if (same) {
+        const [row] = await db
+            .update(schema.pluginConnection)
+            .set({ actions: input.actions, data: seal(input.stored), updatedAt: new Date() })
+            .where(eq(schema.pluginConnection.id, same.id))
+            .returning();
+        return row;
+    }
+    const [row] = await db
+        .insert(schema.pluginConnection)
+        .values({
+        id: nanoid(14),
+        plugin: input.plugin,
+        projectId: input.projectId,
+        connector: input.connector,
+        label: input.label,
+        actions: input.actions,
+        data: seal(input.stored),
+    })
+        .returning();
+    return row;
+}
+/** The provider rights the named actions need, and the connector's own base rights. */
+function scopesOf(connector, actions) {
+    const scopes = new Set(connector.auth.kind === "oauth2" ? connector.auth.oauth2.baseScopes : []);
+    for (const id of actions) {
+        const action = connector.actions.find((a) => a.id === id);
+        if (!action) {
+            throw new Error(`${connector.name} has no action "${id}".`);
+        }
+        for (const scope of action.providerScopes ?? []) {
+            scopes.add(scope);
+        }
+    }
+    return [...scopes];
+}
+const view = (row) => ({
+    id: row.id,
+    space: row.projectId,
+    connector: row.connector,
+    label: row.label,
+    actions: row.actions,
+    createdAt: row.createdAt.toISOString(),
+});
+/** A state the callback can tell is a plugin's: the tenant to finish it in, or null. */
+export function pluginStateTenant(rawState) {
+    const state = unseal(rawState);
+    return state && typeof state.plugin === "string" ? state.tenantId : null;
+}
+/**
+ * The provider came back for a plugin's sign-in: keeps the account. A second sign-in to the
+ * same account for the same space replaces the first one's tokens.
+ */
+export async function finishPluginOAuth(answer, rawState) {
+    const state = unseal(rawState);
+    if (!state?.plugin || state.exp < Date.now()) {
+        throw new Error("The sign-in has expired. Connect again.");
+    }
+    const connector = oauthConnector(state.connectorId);
+    if (connector.auth.kind !== "oauth2") {
+        throw new Error("not an oauth connector");
+    }
+    const tokens = "ticket" in answer
+        ? await redeemTicket(answer.ticket)
+        : await exchangeAuthorizationCode({
+            code: answer.code,
+            codeVerifier: state.verifier,
+            config: connector.auth.oauth2,
+            redirectUri: redirectUri(),
+            resolveEnv,
+        });
+    const account = (await connector.auth.oauth2
+        .resolveAccount?.(tokens.accessToken, fetch)
+        .catch(() => null)) ?? { label: connector.name };
+    const stored = {
+        accessToken: tokens.accessToken,
+        refreshToken: tokens.refreshToken,
+        expiresAt: tokens.expiresAt?.toISOString() ?? null,
+        scopes: tokens.grantedScopes,
+        ...("ticket" in answer ? { via: "account" } : {}),
+    };
+    await keep({
+        plugin: state.plugin,
+        projectId: state.projectId,
+        connector: connector.id,
+        label: account.label,
+        actions: state.actions,
+        stored,
+    });
+    return { plugin: state.plugin, projectId: state.projectId };
+}
+/** The tokens of a connection, refreshed when they run out within five minutes. */
+async function freshTokens(row, connector) {
+    let data = unseal(row.data);
+    if (!data) {
+        throw new Error("The connection's keys cannot be read here. Connect the account again.");
+    }
+    const expires = data.expiresAt ? Date.parse(data.expiresAt) : null;
+    if (connector.auth.kind === "oauth2" &&
+        data.refreshToken &&
+        expires !== null &&
+        expires - Date.now() < 5 * 60_000) {
+        const tokens = data.via === "account"
+            ? await refreshThroughAccount(data.refreshToken)
+            : await refreshAccessToken({
+                config: connector.auth.oauth2,
+                refreshToken: data.refreshToken,
+                resolveEnv,
+            });
+        data = {
+            ...(data.via ? { via: data.via } : {}),
+            accessToken: tokens.accessToken,
+            refreshToken: tokens.refreshToken ?? data.refreshToken,
+            expiresAt: tokens.expiresAt?.toISOString() ?? null,
+            scopes: tokens.grantedScopes.length ? tokens.grantedScopes : data.scopes,
+        };
+        await db
+            .update(schema.pluginConnection)
+            .set({ data: seal(data), updatedAt: new Date() })
+            .where(eq(schema.pluginConnection.id, row.id));
+    }
+    return data;
+}
+function contextOf(row, connector, data) {
+    const ctx = {
+        accessToken: data.accessToken,
+        fetchImpl: connectorFetch,
+        log: () => undefined,
+        connection: {
+            id: row.id,
+            connector_id: connector.id,
+            auth_kind: connector.auth.kind,
+            autonomous_mode: "read_only",
+            connected_by: row.createdBy,
+            created_at: row.createdAt.toISOString(),
+            display_name: row.label,
+            error_message: null,
+            external_account: row.label,
+            granted_scopes: data.scopes,
+            owner_user_id: null,
+            space_id: row.projectId,
+            status: "active",
+            tenant_id: currentTenant(),
+        },
+    };
+    return ctx;
+}
+/** `server.connections` of one plugin; every call runs inside the current tenant. */
+export function pluginConnections(plugin) {
+    const own = (id) => db.query.pluginConnection.findFirst({
+        where: and(eq(schema.pluginConnection.id, id), eq(schema.pluginConnection.plugin, plugin)),
+    });
+    return {
+        async available(ids) {
+            const out = [];
+            for (const id of ids) {
+                const connector = builtinConnector(id);
+                if (!connector || connector.auth.kind === "browser" || !(await usable(connector))) {
+                    continue;
+                }
+                out.push(connector.auth.kind === "api_key"
+                    ? {
+                        id,
+                        name: connector.name,
+                        auth: "api_key",
+                        fields: connector.auth.apiKey.fields.map((f) => ({
+                            key: f.key,
+                            label: f.label,
+                            ...(f.placeholder ? { placeholder: f.placeholder } : {}),
+                            ...(f.required === false ? { required: false } : {}),
+                            ...(f.secret ? { secret: true } : {}),
+                        })),
+                    }
+                    : { id, name: connector.name, auth: "oauth2" });
+            }
+            return out;
+        },
+        async start({ space, connector: connectorId, actions, lang }) {
+            const connector = oauthConnector(connectorId);
+            if (connector.auth.kind !== "oauth2") {
+                throw new Error("not an oauth connector");
+            }
+            await spaceExists(space);
+            const scopes = scopesOf(connector, actions);
+            const base = {
+                plugin,
+                tenantId: currentTenant(),
+                projectId: space,
+                connectorId,
+                actions: [...new Set(actions)],
+                exp: Date.now() + 15 * 60_000,
+                lang,
+            };
+            if (await viaAccount(connector)) {
+                // The Manage-App keeps the PKCE verifier; ours stays empty.
+                try {
+                    const url = await startThroughAccount(scopes, seal({ ...base, verifier: "" }), redirectUri());
+                    return { url };
+                }
+                catch (err) {
+                    throw err instanceof AccountConnectError
+                        ? Object.assign(new Error(err.message), { status: 409, code: "account" })
+                        : err;
+                }
+            }
+            await connector.auth.oauth2.registerClient?.();
+            const pkce = createOAuth2Pkce();
+            const url = await buildAuthorizationUrl({
+                connector,
+                pkce,
+                redirectUri: redirectUri(),
+                scopes,
+                state: seal({ ...base, verifier: pkce.codeVerifier }),
+                resolveEnv,
+            });
+            return { url };
+        },
+        async connect({ space, connector: connectorId, actions, credentials }) {
+            const connector = connectorOf(connectorId);
+            if (connector.auth.kind !== "api_key") {
+                throw new Error(`${connector.name} is connected by signing in: use start.`);
+            }
+            await spaceExists(space);
+            const wanted = knownActions(connector, actions);
+            const keys = {};
+            for (const field of connector.auth.apiKey.fields) {
+                const value = String(credentials[field.key] ?? "").trim();
+                if (!value && field.required !== false) {
+                    throw Object.assign(new Error(`"${field.label}" is missing.`), {
+                        status: 400,
+                        code: "credentials",
+                    });
+                }
+                if (value) {
+                    keys[field.key] = value.slice(0, 500);
+                }
+            }
+            let account;
+            try {
+                account = await connector.auth.apiKey.verify(keys, connectorFetch);
+            }
+            catch (err) {
+                throw Object.assign(new Error(String(err?.message ?? err).slice(0, 300)), {
+                    status: 400,
+                    code: "credentials",
+                });
+            }
+            const row = await keep({
+                plugin,
+                projectId: space,
+                connector: connector.id,
+                label: account.label,
+                actions: wanted,
+                stored: {
+                    accessToken: JSON.stringify(keys),
+                    refreshToken: null,
+                    expiresAt: null,
+                    scopes: [],
+                },
+            });
+            return view(row);
+        },
+        async list(space) {
+            const rows = await db.query.pluginConnection.findMany({
+                where: and(eq(schema.pluginConnection.plugin, plugin), eq(schema.pluginConnection.projectId, space)),
+                orderBy: [desc(schema.pluginConnection.createdAt)],
+            });
+            return rows.map(view);
+        },
+        async get(id) {
+            const row = await own(id);
+            return row ? view(row) : null;
+        },
+        async call(id, actionId, input) {
+            const row = await own(id);
+            if (!row) {
+                throw new Error(`There is no connection "${id}".`);
+            }
+            if (!row.actions.includes(actionId)) {
+                throw new Error(`The connection was not made for "${actionId}". Connect it again.`);
+            }
+            const connector = connectorOf(row.connector);
+            const action = connector.actions.find((a) => a.id === actionId);
+            if (!action) {
+                throw new Error(`${connector.name} has no action "${actionId}".`);
+            }
+            const data = await freshTokens(row, connector);
+            return (await action.handler(action.inputSchema.parse(input), contextOf(row, connector, data)));
+        },
+        async remove(id) {
+            await db
+                .delete(schema.pluginConnection)
+                .where(and(eq(schema.pluginConnection.id, id), eq(schema.pluginConnection.plugin, plugin)));
+        },
+    };
+}

package/apps/runtime/dist/connectors/via-account.js

@@ -0,0 +1,65 @@
+import { note } from "@engenty-wizards/shared/run";
+import { accountToken } from "../auth/account.js";
+import { env } from "../env.js";
+import { NotedError } from "../model-errors.js";
+/*
+ * Google accounts on a local install without an OAuth client of its own: the Manage-App of the
+ * linked account runs the consent at Google with its client and hands the tokens over, and
+ * refreshes them later (docs/manage-contract.md, "Google accounts through the Manage-App").
+ */
+const base = () => `${env.local.accountUrl}/v1/connect`;
+/** Something the person can mend or retry; the message is for them. */
+export class AccountConnectError extends NotedError {
+}
+let offered = null;
+/** Whether the Manage-App connects Google accounts; asked at most every ten minutes. */
+export async function googleThroughAccount() {
+    if (offered && Date.now() - offered.at < (offered.google ? 600_000 : 60_000)) {
+        return offered.google;
+    }
+    const google = await fetch(base(), { signal: AbortSignal.timeout(5000) })
+        .then(async (res) => res.ok ? (await res.json()).google === true : false)
+        .catch(() => false);
+    offered = { at: Date.now(), google };
+    return google;
+}
+async function call(path, body) {
+    const token = await accountToken();
+    if (!token) {
+        throw new AccountConnectError(note("connectEngentyAccountFirst"));
+    }
+    const res = await fetch(`${base()}${path}`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${token}`, "content-type": "application/json" },
+        body: JSON.stringify(body),
+        signal: AbortSignal.timeout(20_000),
+    }).catch(() => null);
+    if (!res) {
+        throw new AccountConnectError(note("engentyAccountNotReached"));
+    }
+    const data = (await res.json().catch(() => ({})));
+    if (!res.ok) {
+        throw new AccountConnectError(data.code === "invalid_grant"
+            ? note("googleNoLongerAccepts")
+            : data.code === "not_configured"
+                ? note("googleNotConnectedThrough")
+                : note("viaAccountFailed", { code: data.code ?? res.status }));
+    }
+    return data;
+}
+const tokensOf = (t) => ({
+    accessToken: t.access_token,
+    refreshToken: t.refresh_token ?? null,
+    expiresAt: t.expires_in ? new Date(Date.now() + t.expires_in * 1000) : null,
+    grantedScopes: (t.scope ?? "").split(/\s+/).filter(Boolean),
+});
+/** Google's consent page for these scopes; Google comes back to `returnUrl` with a ticket. */
+export async function startThroughAccount(scopes, state, returnUrl) {
+    return (await call("/google/start", { scopes, state, returnUrl })).url;
+}
+export async function redeemTicket(ticket) {
+    return tokensOf(await call("/google/redeem", { ticket }));
+}
+export async function refreshThroughAccount(refreshToken) {
+    return tokensOf(await call("/google/refresh", { refreshToken }));
+}

package/apps/runtime/dist/credits/credits.js

@@ -0,0 +1,100 @@
+import { sql } from "drizzle-orm";
+import { db, schema } from "../db/client.js";
+import { ManageError, managed, release, reserve, runUsage, tenantInfo } from "../manage.js";
+import { currentTenant } from "../tenants/tenant.js";
+/**
+ * Credits live in the Manage-App: its gateway books every model call. The runtime only asks
+ * whether a tenant may start, reserves before a run and reads what a run cost. A runtime that
+ * runs alone has no credits; it keeps the provider cost of a run for display (1 credit = 1 cent).
+ */
+export const MICROS_PER_CREDIT = 1_000_000;
+export function usdToMicros(usd) {
+    return Math.ceil(usd * 100 * MICROS_PER_CREDIT);
+}
+/** At least one credit left — enough to start something. */
+export async function canSpend() {
+    if (!managed) {
+        return true;
+    }
+    try {
+        const t = await tenantInfo(currentTenant());
+        return t.status === "active" && t.balanceCredits >= 1;
+    }
+    catch (err) {
+        console.error("[credits]", err);
+        return false;
+    }
+}
+export async function balanceCredits() {
+    if (!managed) {
+        return null;
+    }
+    return (await tenantInfo(currentTenant(), true).catch(() => null))?.balanceCredits ?? null;
+}
+/** Holds credits for a run before it starts. False = the free balance does not cover it. */
+export async function reserveForRun(runId, credits) {
+    if (!managed || credits <= 0) {
+        return true;
+    }
+    try {
+        await reserve(currentTenant(), runId, Math.ceil(credits));
+        return true;
+    }
+    catch (err) {
+        if (err instanceof ManageError && err.status === 402) {
+            return false;
+        }
+        throw err;
+    }
+}
+export async function releaseRun(runId) {
+    if (managed) {
+        await release(runId).catch((err) => console.error("[credits] release", err));
+    }
+}
+async function setStepCost(runId, stepId, micros) {
+    await db
+        .insert(schema.runCost)
+        .values({ runId, stepId, micros })
+        .onConflictDoUpdate({
+        target: [schema.runCost.runId, schema.runCost.stepId],
+        set: { micros },
+    });
+}
+/** What the ledger booked for the run so far, written to the run and its steps. */
+export async function syncRunCost(runId) {
+    if (!managed) {
+        return;
+    }
+    try {
+        const usage = await runUsage(currentTenant(), runId);
+        await db
+            .update(schema.run)
+            .set({ costMicros: Math.round(usage.credits * MICROS_PER_CREDIT) })
+            .where(sql `${schema.run.id} = ${runId}`);
+        for (const [stepId, credits] of Object.entries(usage.steps)) {
+            await setStepCost(runId, stepId, Math.round(credits * MICROS_PER_CREDIT));
+        }
+    }
+    catch (err) {
+        console.error("[credits] usage", err);
+    }
+}
+/** A runtime that runs alone adds up the provider cost itself. */
+export async function addLocalCost(runId, stepId, usd) {
+    const micros = usdToMicros(usd);
+    if (managed || micros <= 0) {
+        return;
+    }
+    await db
+        .update(schema.run)
+        .set({ costMicros: sql `${schema.run.costMicros} + ${micros}` })
+        .where(sql `${schema.run.id} = ${runId}`);
+    await db
+        .insert(schema.runCost)
+        .values({ runId, stepId, micros })
+        .onConflictDoUpdate({
+        target: [schema.runCost.runId, schema.runCost.stepId],
+        set: { micros: sql `${schema.runCost.micros} + ${micros}` },
+    });
+}