@littlebearapps/platform-admin-sdk 2.1.0 → 2.3.0

package/templates/full/scripts/ops/audit-cost-anomaly.ts

@@ -0,0 +1,430 @@
+#!/usr/bin/env npx tsx
+/**
+ * Audit Cost Anomaly Script
+ *
+ * Forensic analysis of cost anomalies in daily_usage_rollups.
+ * Identifies days with unexpectedly high costs and breaks down by component.
+ *
+ * Usage:
+ *   npx tsx scripts/ops/audit-cost-anomaly.ts                    # High-cost days
+ *   npx tsx scripts/ops/audit-cost-anomaly.ts --threshold 50     # Custom threshold ($50)
+ *   npx tsx scripts/ops/audit-cost-anomaly.ts --detailed         # Include hourly breakdown
+ *   npx tsx scripts/ops/audit-cost-anomaly.ts --date 2026-01-23  # Specific date deep dive
+ *
+ * Environment Variables:
+ *   CLOUDFLARE_ACCOUNT_ID - Cloudflare account ID (optional, uses default)
+ *   CLOUDFLARE_API_TOKEN  - API token with D1:Read (required)
+ *   D1_DATABASE_ID        - Platform D1 database ID (optional, uses default)
+ */
+
+import { request } from 'undici';
+
+// =============================================================================
+// CONFIGURATION
+// =============================================================================
+
+const REST_API_BASE = 'https://api.cloudflare.com/client/v4';
+const DEFAULT_ACCOUNT_ID = '55a0bf6d1396d90cbf9dcbf30fceeb14';
+const DEFAULT_D1_DATABASE_ID = '076b2cd5-054e-4c8c-aa42-86cedc84a4ec';
+
+// =============================================================================
+// TYPES
+// =============================================================================
+
+interface D1QueryResponse {
+  success: boolean;
+  errors?: Array<{ message: string }>;
+  result: Array<{
+    results: Record<string, unknown>[];
+    success: boolean;
+  }>;
+}
+
+interface HighCostDay {
+  project: string;
+  snapshot_date: string;
+  d1_writes: number;
+  d1_reads: number;
+  kv_writes: number;
+  kv_reads: number;
+  workers_requests: number;
+  total_cost: number;
+  d1_cost: number;
+  kv_cost: number;
+  workers_cost: number;
+}
+
+interface HourlySample {
+  snapshot_hour: string;
+  project: string;
+  d1_rows_written: number;
+  d1_rows_read: number;
+  kv_writes: number;
+  total_cost_usd: number;
+}
+
+// =============================================================================
+// D1 QUERY FUNCTIONS
+// =============================================================================
+
+async function queryD1(
+  sql: string,
+  accountId: string,
+  apiToken: string,
+  databaseId: string
+): Promise<Record<string, unknown>[]> {
+  const url = `${REST_API_BASE}/accounts/${accountId}/d1/database/${databaseId}/query`;
+
+  const response = await request(url, {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${apiToken}`,
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify({ sql }),
+  });
+
+  const body = (await response.body.json()) as D1QueryResponse;
+
+  if (!body.success) {
+    const errorMsg = body.errors?.map((e) => e.message).join(', ') ?? 'Unknown error';
+    throw new Error(`D1 query failed: ${errorMsg}`);
+  }
+
+  return body.result[0]?.results ?? [];
+}
+
+// =============================================================================
+// ANALYSIS QUERIES
+// =============================================================================
+
+/**
+ * Find days with costs exceeding threshold, broken down by resource type.
+ */
+async function findHighCostDays(
+  threshold: number,
+  accountId: string,
+  apiToken: string,
+  databaseId: string
+): Promise<HighCostDay[]> {
+  const sql = `
+    SELECT
+      project,
+      snapshot_date,
+      SUM(d1_rows_written) as d1_writes,
+      SUM(d1_rows_read) as d1_reads,
+      SUM(kv_writes) as kv_writes,
+      SUM(kv_reads) as kv_reads,
+      SUM(workers_requests) as workers_requests,
+      SUM(total_cost_usd) as total_cost,
+      SUM(d1_cost_usd) as d1_cost,
+      SUM(kv_cost_usd) as kv_cost,
+      SUM(workers_cost_usd) as workers_cost
+    FROM daily_usage_rollups
+    WHERE total_cost_usd > ${threshold}
+    GROUP BY project, snapshot_date
+    ORDER BY total_cost DESC
+    LIMIT 50;
+  `;
+
+  const results = await queryD1(sql, accountId, apiToken, databaseId);
+  return results as unknown as HighCostDay[];
+}
+
+/**
+ * Get hourly breakdown for a specific date.
+ */
+async function getHourlyBreakdown(
+  date: string,
+  accountId: string,
+  apiToken: string,
+  databaseId: string
+): Promise<HourlySample[]> {
+  const sql = `
+    SELECT
+      snapshot_hour,
+      project,
+      d1_rows_written,
+      d1_rows_read,
+      kv_writes,
+      total_cost_usd
+    FROM hourly_usage_snapshots
+    WHERE snapshot_hour LIKE '${date}%'
+    ORDER BY snapshot_hour, project;
+  `;
+
+  const results = await queryD1(sql, accountId, apiToken, databaseId);
+  return results as unknown as HourlySample[];
+}
+
+/**
+ * Get billing period summary.
+ */
+async function getBillingPeriodSummary(
+  accountId: string,
+  apiToken: string,
+  databaseId: string
+): Promise<Record<string, unknown>[]> {
+  // First get the billing cycle day
+  const settingsSql = `
+    SELECT billing_cycle_day
+    FROM billing_settings
+    LIMIT 1;
+  `;
+  const settings = await queryD1(settingsSql, accountId, apiToken, databaseId);
+
+  // Calculate billing window dates
+  const now = new Date();
+  let billingCycleDay = 17; // Default
+  if (settings.length > 0 && settings[0].billing_cycle_day) {
+    billingCycleDay = settings[0].billing_cycle_day as number;
+  }
+
+  // Calculate start date of current billing period
+  let startDate: Date;
+  if (now.getUTCDate() >= billingCycleDay) {
+    startDate = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), billingCycleDay));
+  } else {
+    startDate = new Date(Date.UTC(now.getUTCFullYear(), now.getUTCMonth() - 1, billingCycleDay));
+  }
+
+  const startDateStr = startDate.toISOString().split('T')[0];
+
+  const sql = `
+    SELECT
+      project,
+      SUM(total_cost_usd) as period_cost,
+      SUM(d1_rows_written) as total_d1_writes,
+      SUM(d1_cost_usd) as total_d1_cost,
+      SUM(kv_writes) as total_kv_writes,
+      SUM(kv_cost_usd) as total_kv_cost,
+      COUNT(DISTINCT snapshot_date) as days_in_period
+    FROM daily_usage_rollups
+    WHERE snapshot_date >= '${startDateStr}'
+    GROUP BY project
+    ORDER BY period_cost DESC;
+  `;
+
+  const results = await queryD1(sql, accountId, apiToken, databaseId);
+  return results.map((r) => ({ ...r, billing_start: startDateStr }));
+}
+
+/**
+ * Verify cost calculation logic by checking raw metrics vs computed cost.
+ */
+async function verifyCostCalculation(
+  date: string,
+  accountId: string,
+  apiToken: string,
+  databaseId: string
+): Promise<Record<string, unknown>[]> {
+  const sql = `
+    SELECT
+      project,
+      snapshot_date,
+      d1_rows_written,
+      d1_rows_read,
+      d1_cost_usd,
+      kv_writes,
+      kv_reads,
+      kv_cost_usd,
+      workers_requests,
+      workers_cost_usd,
+      total_cost_usd,
+      -- Expected D1 cost: $1/million writes + $0.001/million reads (first 25B free)
+      ROUND(d1_rows_written / 1000000.0, 4) as expected_d1_write_cost,
+      -- Expected KV cost: $1/million writes, $0.50/million reads (first 10M free)
+      ROUND(kv_writes / 1000000.0, 4) as expected_kv_write_cost
+    FROM daily_usage_rollups
+    WHERE snapshot_date = '${date}'
+    ORDER BY total_cost_usd DESC;
+  `;
+
+  return await queryD1(sql, accountId, apiToken, databaseId);
+}
+
+// =============================================================================
+// FORMATTING
+// =============================================================================
+
+function formatNumber(n: number): string {
+  if (n >= 1_000_000_000) return `${(n / 1_000_000_000).toFixed(2)}B`;
+  if (n >= 1_000_000) return `${(n / 1_000_000).toFixed(2)}M`;
+  if (n >= 1_000) return `${(n / 1_000).toFixed(1)}K`;
+  return n.toFixed(0);
+}
+
+function formatCost(n: number): string {
+  return `$${n.toFixed(2)}`;
+}
+
+// =============================================================================
+// CLI
+// =============================================================================
+
+async function main(): Promise<void> {
+  const args = process.argv.slice(2);
+
+  // Parse arguments
+  const thresholdIdx = args.indexOf('--threshold');
+  const threshold = thresholdIdx >= 0 ? parseFloat(args[thresholdIdx + 1]) : 100;
+
+  const dateIdx = args.indexOf('--date');
+  const specificDate = dateIdx >= 0 ? args[dateIdx + 1] : null;
+
+  const detailed = args.includes('--detailed');
+
+  // Environment variables
+  const accountId = process.env.CLOUDFLARE_ACCOUNT_ID ?? DEFAULT_ACCOUNT_ID;
+  const apiToken = process.env.CLOUDFLARE_API_TOKEN;
+  const databaseId = process.env.D1_DATABASE_ID ?? DEFAULT_D1_DATABASE_ID;
+
+  if (!apiToken) {
+    console.error('Error: CLOUDFLARE_API_TOKEN environment variable is required');
+    process.exit(1);
+  }
+
+  console.log('='.repeat(80));
+  console.log('COST ANOMALY FORENSIC AUDIT');
+  console.log('='.repeat(80));
+  console.log(`Threshold: ${formatCost(threshold)}`);
+  console.log(`Database: ${databaseId}`);
+  console.log('');
+
+  // Section 1: Billing Period Summary
+  console.log('─'.repeat(80));
+  console.log('SECTION 1: CURRENT BILLING PERIOD SUMMARY');
+  console.log('─'.repeat(80));
+
+  const billingSummary = await getBillingPeriodSummary(accountId, apiToken, databaseId);
+  if (billingSummary.length > 0) {
+    console.log(`Billing period start: ${billingSummary[0].billing_start}`);
+    console.log('');
+    console.log(
+      'Project            | Period Cost | D1 Writes     | D1 Cost   | KV Writes   | KV Cost'
+    );
+    console.log(
+      '-------------------|-------------|---------------|-----------|-------------|--------'
+    );
+    for (const row of billingSummary) {
+      console.log(
+        `${String(row.project).padEnd(18)} | ` +
+          `${formatCost(row.period_cost as number).padStart(11)} | ` +
+          `${formatNumber(row.total_d1_writes as number).padStart(13)} | ` +
+          `${formatCost(row.total_d1_cost as number).padStart(9)} | ` +
+          `${formatNumber(row.total_kv_writes as number).padStart(11)} | ` +
+          `${formatCost(row.total_kv_cost as number).padStart(6)}`
+      );
+    }
+  } else {
+    console.log('No data found for current billing period.');
+  }
+  console.log('');
+
+  // Section 2: High-Cost Days
+  console.log('─'.repeat(80));
+  console.log(`SECTION 2: HIGH-COST DAYS (>${formatCost(threshold)})`);
+  console.log('─'.repeat(80));
+
+  const highCostDays = await findHighCostDays(threshold, accountId, apiToken, databaseId);
+  if (highCostDays.length === 0) {
+    console.log(`No days found with cost > ${formatCost(threshold)}`);
+  } else {
+    console.log(
+      'Date       | Project     | Total Cost | D1 Writes     | D1 Cost   | KV Writes   | KV Cost'
+    );
+    console.log(
+      '-----------|-------------|------------|---------------|-----------|-------------|--------'
+    );
+    for (const row of highCostDays) {
+      console.log(
+        `${row.snapshot_date} | ` +
+          `${String(row.project).padEnd(11)} | ` +
+          `${formatCost(row.total_cost).padStart(10)} | ` +
+          `${formatNumber(row.d1_writes).padStart(13)} | ` +
+          `${formatCost(row.d1_cost).padStart(9)} | ` +
+          `${formatNumber(row.kv_writes).padStart(11)} | ` +
+          `${formatCost(row.kv_cost).padStart(6)}`
+      );
+    }
+  }
+  console.log('');
+
+  // Section 3: Cost Calculation Verification (if specific date or highest cost date)
+  const auditDate =
+    specificDate ?? (highCostDays.length > 0 ? highCostDays[0].snapshot_date : null);
+  if (auditDate) {
+    console.log('─'.repeat(80));
+    console.log(`SECTION 3: COST CALCULATION VERIFICATION FOR ${auditDate}`);
+    console.log('─'.repeat(80));
+
+    const verification = await verifyCostCalculation(auditDate, accountId, apiToken, databaseId);
+    console.log('');
+    console.log('Checking if recorded costs match expected costs based on Cloudflare pricing...');
+    console.log('D1 pricing: $1.00/million writes, $0.001/million reads (25B free)');
+    console.log('KV pricing: $1.00/million writes, $0.50/million reads (10M free)');
+    console.log('');
+
+    for (const row of verification) {
+      console.log(`Project: ${row.project}`);
+      console.log(`  D1 Writes:           ${formatNumber(row.d1_rows_written as number)}`);
+      console.log(`  D1 Recorded Cost:    ${formatCost(row.d1_cost_usd as number)}`);
+      console.log(
+        `  D1 Expected Cost:    ${formatCost(row.expected_d1_write_cost as number)} (writes only)`
+      );
+
+      const d1Diff = Math.abs((row.d1_cost_usd as number) - (row.expected_d1_write_cost as number));
+      if (d1Diff > 1) {
+        console.log(`  ⚠️  D1 COST DISCREPANCY: ${formatCost(d1Diff)}`);
+      }
+
+      console.log(`  KV Writes:           ${formatNumber(row.kv_writes as number)}`);
+      console.log(`  KV Recorded Cost:    ${formatCost(row.kv_cost_usd as number)}`);
+      console.log(
+        `  KV Expected Cost:    ${formatCost(row.expected_kv_write_cost as number)} (writes only)`
+      );
+
+      const kvDiff = Math.abs((row.kv_cost_usd as number) - (row.expected_kv_write_cost as number));
+      if (kvDiff > 1) {
+        console.log(`  ⚠️  KV COST DISCREPANCY: ${formatCost(kvDiff)}`);
+      }
+
+      console.log(`  Total Recorded Cost: ${formatCost(row.total_cost_usd as number)}`);
+      console.log('');
+    }
+  }
+
+  // Section 4: Hourly breakdown (if requested)
+  if (detailed && auditDate) {
+    console.log('─'.repeat(80));
+    console.log(`SECTION 4: HOURLY BREAKDOWN FOR ${auditDate}`);
+    console.log('─'.repeat(80));
+
+    const hourly = await getHourlyBreakdown(auditDate, accountId, apiToken, databaseId);
+    if (hourly.length === 0) {
+      console.log('No hourly data found (may have been rolled up and deleted).');
+    } else {
+      console.log('Hour                 | Project     | D1 Writes     | KV Writes   | Cost');
+      console.log('---------------------|-------------|---------------|-------------|--------');
+      for (const row of hourly) {
+        console.log(
+          `${row.snapshot_hour} | ` +
+            `${String(row.project).padEnd(11)} | ` +
+            `${formatNumber(row.d1_rows_written).padStart(13)} | ` +
+            `${formatNumber(row.kv_writes).padStart(11)} | ` +
+            `${formatCost(row.total_cost_usd).padStart(6)}`
+        );
+      }
+    }
+    console.log('');
+  }
+
+  console.log('='.repeat(80));
+  console.log('AUDIT COMPLETE');
+  console.log('='.repeat(80));
+}
+
+main().catch((error) => {
+  console.error('Fatal error:', error);
+  process.exit(1);
+});

package/templates/full/scripts/ops/verify-account-total.ts

@@ -0,0 +1,256 @@
+#!/usr/bin/env npx tsx
+/**
+ * verify-account-total.ts
+ *
+ * Queries Cloudflare GraphQL for account-wide usage totals (not filtered by script).
+ * This provides the "ground truth" for what the account actually used, regardless
+ * of whether individual workers were deleted.
+ *
+ * Purpose: Determine if the ~$2,600 australian-history-mcp cost was REAL or PHANTOM
+ * by comparing account-level metrics to our D1 records.
+ *
+ * Usage:
+ *   npx tsx scripts/ops/verify-account-total.ts
+ */
+
+const GRAPHQL_ENDPOINT = 'https://api.cloudflare.com/client/v4/graphql';
+const ACCOUNT_ID = '55a0bf6d1396d90cbf9dcbf30fceeb14';
+
+// Pricing constants (Workers Paid Plan)
+const WORKERS_INCLUDED_REQUESTS = 10_000_000; // 10M included
+const WORKERS_REQUEST_COST_PER_MILLION = 0.3; // $0.30 per million after included
+const WORKERS_CPU_COST_PER_MILLION_MS = 0.02; // $0.02 per million CPU ms (approx)
+
+interface GraphQLResponse {
+  data?: {
+    viewer?: {
+      accounts?: Array<{
+        workersInvocationsAdaptive?: Array<{
+          sum: {
+            requests: number;
+            errors: number;
+            subrequests: number;
+          };
+          quantiles: {
+            cpuTimeP50: number;
+            cpuTimeP99: number;
+          };
+          dimensions: {
+            date: string;
+          };
+        }>;
+      }>;
+    };
+  };
+  errors?: Array<{ message: string }>;
+}
+
+async function queryAccountTotal(
+  apiToken: string,
+  startDate: string,
+  endDate: string
+): Promise<{
+  totalRequests: number;
+  totalErrors: number;
+  totalSubrequests: number;
+  avgCpuTimeP50: number;
+  avgCpuTimeP99: number;
+  dailyBreakdown: Array<{ date: string; requests: number }>;
+}> {
+  const query = `
+    query AccountUsage($accountTag: String!, $startDate: Time!, $endDate: Time!) {
+      viewer {
+        accounts(filter: { accountTag: $accountTag }) {
+          workersInvocationsAdaptive(
+            filter: {
+              datetime_geq: $startDate
+              datetime_lt: $endDate
+            }
+            limit: 1000
+          ) {
+            sum {
+              requests
+              errors
+              subrequests
+            }
+            quantiles {
+              cpuTimeP50
+              cpuTimeP99
+            }
+            dimensions {
+              date
+            }
+          }
+        }
+      }
+    }
+  `;
+
+  const response = await fetch(GRAPHQL_ENDPOINT, {
+    method: 'POST',
+    headers: {
+      Authorization: `Bearer ${apiToken}`,
+      'Content-Type': 'application/json',
+    },
+    body: JSON.stringify({
+      query,
+      variables: {
+        accountTag: ACCOUNT_ID,
+        startDate: `${startDate}T00:00:00Z`,
+        endDate: `${endDate}T00:00:00Z`,
+      },
+    }),
+  });
+
+  const result = (await response.json()) as GraphQLResponse;
+
+  if (result.errors?.length) {
+    throw new Error(`GraphQL errors: ${result.errors.map((e) => e.message).join(', ')}`);
+  }
+
+  const data = result.data?.viewer?.accounts?.[0]?.workersInvocationsAdaptive ?? [];
+
+  let totalRequests = 0;
+  let totalErrors = 0;
+  let totalSubrequests = 0;
+  let cpuTimeP50Sum = 0;
+  let cpuTimeP99Sum = 0;
+  const dailyBreakdown: Array<{ date: string; requests: number }> = [];
+
+  for (const row of data) {
+    totalRequests += row.sum.requests;
+    totalErrors += row.sum.errors;
+    totalSubrequests += row.sum.subrequests;
+    cpuTimeP50Sum += row.quantiles.cpuTimeP50 * row.sum.requests;
+    cpuTimeP99Sum += row.quantiles.cpuTimeP99 * row.sum.requests;
+    dailyBreakdown.push({
+      date: row.dimensions.date,
+      requests: row.sum.requests,
+    });
+  }
+
+  return {
+    totalRequests,
+    totalErrors,
+    totalSubrequests,
+    avgCpuTimeP50: totalRequests > 0 ? cpuTimeP50Sum / totalRequests : 0,
+    avgCpuTimeP99: totalRequests > 0 ? cpuTimeP99Sum / totalRequests : 0,
+    dailyBreakdown: dailyBreakdown.sort((a, b) => a.date.localeCompare(b.date)),
+  };
+}
+
+function calculateWorkersCost(requests: number, avgCpuTimeMs: number): number {
+  // Billable requests (after 10M included)
+  const billableRequests = Math.max(0, requests - WORKERS_INCLUDED_REQUESTS);
+  const requestCost = (billableRequests / 1_000_000) * WORKERS_REQUEST_COST_PER_MILLION;
+
+  // CPU time cost (rough estimate based on total CPU ms)
+  // This is approximate - actual billing is more complex
+  const totalCpuMs = requests * avgCpuTimeMs;
+  const cpuCost = (totalCpuMs / 1_000_000) * WORKERS_CPU_COST_PER_MILLION_MS;
+
+  return requestCost + cpuCost;
+}
+
+async function main(): Promise<void> {
+  const apiToken = process.env.CLOUDFLARE_API_TOKEN;
+
+  if (!apiToken) {
+    console.error('Error: CLOUDFLARE_API_TOKEN environment variable is required');
+    process.exit(1);
+  }
+
+  console.log('='.repeat(70));
+  console.log('ACCOUNT-WIDE USAGE VERIFICATION');
+  console.log('='.repeat(70));
+  console.log('Purpose: Determine if the ~$2,600 was REAL or PHANTOM');
+  console.log('Method: Query account-level metrics (not filtered by script name)');
+  console.log('');
+
+  // Query January 2026
+  const startDate = '2026-01-01';
+  const endDate = '2026-02-01';
+
+  console.log(`Period: ${startDate} to ${endDate}`);
+  console.log('');
+  console.log('-'.repeat(70));
+  console.log('QUERYING CLOUDFLARE GRAPHQL...');
+  console.log('-'.repeat(70));
+
+  const metrics = await queryAccountTotal(apiToken, startDate, endDate);
+
+  console.log('');
+  console.log('ACCOUNT-WIDE TOTALS (January 2026):');
+  console.log('-'.repeat(70));
+  console.log(`  Total Requests:     ${metrics.totalRequests.toLocaleString()}`);
+  console.log(`  Total Errors:       ${metrics.totalErrors.toLocaleString()}`);
+  console.log(`  Total Subrequests:  ${metrics.totalSubrequests.toLocaleString()}`);
+  console.log(`  Avg CPU Time (P50): ${metrics.avgCpuTimeP50.toFixed(2)} ms`);
+  console.log(`  Avg CPU Time (P99): ${metrics.avgCpuTimeP99.toFixed(2)} ms`);
+  console.log('');
+
+  // Calculate estimated cost
+  const estimatedCost = calculateWorkersCost(metrics.totalRequests, metrics.avgCpuTimeP50);
+
+  console.log('ESTIMATED WORKERS COST:');
+  console.log('-'.repeat(70));
+  console.log(`  Included requests:  10,000,000`);
+  console.log(
+    `  Billable requests:  ${Math.max(0, metrics.totalRequests - WORKERS_INCLUDED_REQUESTS).toLocaleString()}`
+  );
+  console.log(`  Estimated cost:     $${estimatedCost.toFixed(2)}`);
+  console.log('');
+
+  // Daily breakdown (top 10 days)
+  console.log('TOP 10 DAYS BY REQUESTS:');
+  console.log('-'.repeat(70));
+  const topDays = [...metrics.dailyBreakdown].sort((a, b) => b.requests - a.requests).slice(0, 10);
+  for (const day of topDays) {
+    console.log(`  ${day.date}: ${day.requests.toLocaleString()} requests`);
+  }
+  console.log('');
+
+  // The Verdict
+  console.log('='.repeat(70));
+  console.log('THE VERDICT');
+  console.log('='.repeat(70));
+
+  if (metrics.totalRequests > 500_000) {
+    console.log('');
+    console.log('⚠️  VERDICT: POTENTIALLY REAL');
+    console.log('');
+    console.log('The account had significant traffic. However, this could be from:');
+    console.log('  1. Known workers (scout, brand-copilot, platform-*)');
+    console.log('  2. The deleted semantic-librarian worker');
+    console.log('');
+    console.log('Next step: Compare against D1 totals to find the gap.');
+  } else if (estimatedCost > 2000) {
+    console.log('');
+    console.log('🔴 VERDICT: REAL');
+    console.log('');
+    console.log('Account-level costs exceed $2,000.');
+    console.log('The deleted worker likely had real usage.');
+    console.log('Recommendation: Create placeholder record for billing reconciliation.');
+  } else if (estimatedCost < 500) {
+    console.log('');
+    console.log('✅ VERDICT: PHANTOM');
+    console.log('');
+    console.log('Account-level costs are under $500.');
+    console.log('The $2,600 was likely a data artifact from triple-counting.');
+    console.log('Current D1 totals (~$416) are correct.');
+  } else {
+    console.log('');
+    console.log('⚠️  VERDICT: INCONCLUSIVE');
+    console.log('');
+    console.log('Account costs are in the middle range ($500-$2000).');
+    console.log('Manual investigation recommended.');
+  }
+
+  console.log('');
+  console.log('='.repeat(70));
+}
+
+main().catch((error) => {
+  console.error('Fatal error:', error);
+  process.exit(1);
+});