@maxceem/agw 0.12.1 → 0.13.0

package/dist/agw.mjs

@@ -6,7 +6,7 @@ var __export = (target, all) => {
 };
 
 // <define:__AGW_MANIFEST__>
-var define_AGW_MANIFEST_default = { version: "0.12.1", wrangler: "4.96.0", upgradeFrom: ["0.12.1", "0.12.0", "0.11.2", "0.11.1", "0.11.0", "0.10.11", "0.10.10", "0.10.9", "0.10.8", "0.10.7", "0.10.6", "0.10.5", "0.10.4", "0.10.3", "0.10.2", "0.10.1", "0.10.0", "0.9.3", "0.9.2", "0.9.1", "0.9.0", "0.8.3", "0.8.2", "0.8.1", "0.8.0", "0.7.2", "0.7.1", "0.7.0", "0.6.4", "0.6.3", "0.6.2", "0.6.1", "0.6.0", "0.5.2", "0.5.1", "0.5.0", "0.4.0"], release: { url: "https://github.com/maxceem/app-ai-gateway/releases/download/v0.12.1/gateway-0.12.1.tar.gz", sha256: "c234a2d2f97d69a37e9ca2c6ac435e7d6718cceece957852719403dc1a4f421d", manifest: "1ae57d80d3c5f319c89b1fb34f365d59966311f897afd84227c48ded4707c791" } };
+var define_AGW_MANIFEST_default = { version: "0.13.0", wrangler: "4.96.0", upgradeFrom: ["0.13.0", "0.12.1", "0.12.0", "0.11.2", "0.11.1", "0.11.0", "0.10.11", "0.10.10", "0.10.9", "0.10.8", "0.10.7", "0.10.6", "0.10.5", "0.10.4", "0.10.3", "0.10.2", "0.10.1", "0.10.0", "0.9.3", "0.9.2", "0.9.1", "0.9.0", "0.8.3", "0.8.2", "0.8.1", "0.8.0", "0.7.2", "0.7.1", "0.7.0", "0.6.4", "0.6.3", "0.6.2", "0.6.1", "0.6.0", "0.5.2", "0.5.1", "0.5.0", "0.4.0"], release: { url: "https://github.com/maxceem/app-ai-gateway/releases/download/v0.13.0/gateway-0.13.0.tar.gz", sha256: "02babcd3375a7412195b94c12ae93d4df10e4373ec29b15a496b900647abeb83", manifest: "f652db00f7a44d87c26779ce20a938a7cdefc98fdc8f5f52f2186f995d65a226" } };
 
 // src/main.ts
 import { Writable as Writable2 } from "node:stream";
@@ -15334,6 +15334,7 @@ var APP_ATTEST_VERIFY_ON = ["every_request", "token_exchange"];
 var ENDPOINT_SLUG = /^[a-z0-9-]{1,64}$/;
 var PROVIDER_SLUG_PATTERN = /^[a-z0-9][a-z0-9-]{0,62}$/;
 var HTTP_FIELD_NAME = /^[A-Za-z0-9!#$%&'*+.^_`|~-]+$/;
+var CLIENT_TRACE_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
 var MONTH_PATTERN = /^\d{4}-(?:0[1-9]|1[0-2])$/;
 var MONTH_FORMAT_MESSAGE = "month must use YYYY-MM format";
 var MonthSchema = external_exports.string().regex(MONTH_PATTERN, { error: MONTH_FORMAT_MESSAGE });
@@ -15426,6 +15427,8 @@ var RESERVED_APP_HEADERS = /* @__PURE__ */ new Set([
   "x-appattest-proof",
   ...PROVIDER_CREDENTIAL_HEADERS,
   "x-app-version",
+  "x-client-trace-id",
+  "x-conversation-storage",
   "content-type",
   "content-length",
   "host"
@@ -15577,6 +15580,22 @@ function identifiesEndUsers(authentication) {
   return authentication.end_user.source !== "none";
 }
 var scopeHasLimits = (scope) => scope.requests.per_minute !== null || scope.requests.per_day !== null || scope.spending.monthly_usd !== null;
+var CONVERSATION_RETENTION_DAYS = { default: 180, min: 1, max: 400 };
+var keptMedia = (field, what) => external_exports.boolean({ error: `conversations.keep.${field} must be true or false` }).default(true).meta({
+  description: `Keep ${what} beside the conversation. Off, each is recorded by its type and size alone.`
+});
+var ConversationKeepSchema = external_exports.object({
+  images: keptMedia("images", "images"),
+  audio: keptMedia("audio", "audio: recordings sent for transcription, audio in a request, spoken replies"),
+  files: keptMedia("files", "every other attached file, such as a PDF or a text document")
+}).strict();
+var ConversationsSchema = external_exports.object({
+  store: external_exports.boolean({ error: "conversations.store must be true or false" }).default(false).meta({
+    description: "Keep a copy of every request and response this app sends through the gateway, with the media `keep` allows."
+  }),
+  keep: ConversationKeepSchema.prefault({}),
+  retention_days: external_exports.number({ error: "conversations.retention_days must be a whole number of days" }).int({ error: "conversations.retention_days must be a whole number of days" }).min(CONVERSATION_RETENTION_DAYS.min, { error: `conversations.retention_days must be at least ${CONVERSATION_RETENTION_DAYS.min}` }).max(CONVERSATION_RETENTION_DAYS.max, { error: `conversations.retention_days must be at most ${CONVERSATION_RETENTION_DAYS.max}` }).default(CONVERSATION_RETENTION_DAYS.default).meta({ description: "Days a stored conversation is kept before nightly maintenance deletes it." })
+}).strict();
 var AppConfigSchema = external_exports.object({
   authentication: external_exports.discriminatedUnion("type", [
     AppleAppAttestAuthenticationSchema,
@@ -15614,7 +15633,8 @@ var AppConfigSchema = external_exports.object({
     safeKey(external_exports.string().regex(ENDPOINT_SLUG)),
     EndpointSchema,
     { error: "is not a valid slug; use 1-64 characters from a-z, 0-9, and -" }
-  ).prefault({})
+  ).prefault({}),
+  conversations: ConversationsSchema.prefault({})
 }).strict().superRefine((config2, context) => {
   const authentication = config2.authentication;
   const perUser = config2.limits?.per_user;
@@ -16007,7 +16027,7 @@ async function prompt(label, flags, { hidden = false, defaultValue } = {}) {
   const wasRaw = stdin.isRaw;
   stdin.setRawMode(true);
   stdin.resume();
-  return new Promise((resolve3, reject2) => {
+  return new Promise((resolve4, reject2) => {
     let value = "";
     let shown = 0;
     function mask() {
@@ -16021,7 +16041,7 @@ async function prompt(label, flags, { hidden = false, defaultValue } = {}) {
       stdin.pause();
       stderr.write("\n");
       if (error51) reject2(error51);
-      else resolve3(value);
+      else resolve4(value);
     }
     function onData(chunk) {
       for (const char of chunk.toString()) {
@@ -16137,6 +16157,7 @@ var commands = {
   "app validate": { args: 0, flags: "file" },
   "app check": { args: 1, flags: "" },
   "app snippet": { args: 1, flags: "language provider endpoint output" },
+  "app conversations": { args: 1, flags: "from to output media!" },
   "app remove": { args: 1, flags: "yes!" },
   "app key list": { args: 1, flags: "" },
   "app key add": { args: 1, flags: "name key-output" },
@@ -17396,9 +17417,138 @@ function snippetRemedy(code, appId, language) {
   }
 }
 
+// src/conversations.ts
+import { mkdir as mkdir2, readFile as readFile3, stat, writeFile } from "node:fs/promises";
+import { dirname, join as join2, resolve as resolve2 } from "node:path";
+import { gunzipSync } from "node:zlib";
+
+// src/usage.ts
+var CLI_BREAKDOWNS = ["provider", "model", "status"];
+function month(value) {
+  if (!MONTH_PATTERN.test(value))
+    fail(
+      "invalid_input",
+      "Month must use YYYY-MM with a valid calendar month."
+    );
+  return value;
+}
+function date5(value) {
+  if (!/^\d{4}-\d{2}-\d{2}$/.test(value) || !Number.isFinite(Date.parse(value)) || new Date(value).toISOString().slice(0, 10) !== value)
+    fail(
+      "invalid_input",
+      "Dates must be real UTC calendar dates in YYYY-MM-DD format."
+    );
+  return value;
+}
+function positive(value, max = 3600) {
+  if (!/^\d+$/.test(String(value)) || Number(value) < 1 || Number(value) > max)
+    fail("invalid_input", `Supply an integer between 1 and ${max}.`);
+  return Number(value);
+}
+async function usageCommand(ctx, command, flags) {
+  if (command === "usage show") {
+    const m = month(flags.month ?? (/* @__PURE__ */ new Date()).toISOString().slice(0, 7));
+    return flags.app ? (await ctx.call("getAppUsage", { params: { app: flags.app }, query: { month: m } })).data : (await ctx.call("getCliUsage", { query: { month: m } })).data;
+  }
+  const app2 = await required2(flags, "app");
+  const by = CLI_BREAKDOWNS.find((dimension) => dimension === (flags.by ?? "model"));
+  if (by === void 0)
+    fail("invalid_input", "--by must be provider, model or status.");
+  if (Boolean(flags.from) !== Boolean(flags.to))
+    fail("invalid_input", "Supply both --from and --to or neither.");
+  const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+  const from = date5(flags.from ?? today.slice(0, 7) + "-01");
+  const to = date5(flags.to ?? today);
+  if (from > to) fail("invalid_input", "--from must not be later than --to.");
+  const limit = positive(flags.limit ?? 50, 200);
+  return {
+    ...(await ctx.call("getAppUsageBreakdown", {
+      params: { app: app2 },
+      query: { from, to, by, limit }
+    })).data,
+    coverage: {
+      from,
+      to,
+      source: "Raw events and retained daily aggregates; dimensions provider, model and status survive raw event retention."
+    }
+  };
+}
+
+// src/conversations.ts
+var MEDIA_REFERENCE = /agw-media:(\d{4}-\d{2}-\d{2}\/media\/[0-9a-f]{64}\.[a-z0-9]{1,5})/g;
+async function sizeOf(path) {
+  try {
+    return (await stat(path)).size;
+  } catch {
+    return null;
+  }
+}
+async function save(path, bytes) {
+  await mkdir2(dirname(path), { recursive: true });
+  await writeFile(path, bytes);
+}
+async function conversationsCommand(ctx, appId, flags) {
+  const from = flags.from === void 0 ? null : date5(flags.from);
+  const to = date5(flags.to ?? (/* @__PURE__ */ new Date()).toISOString().slice(0, 10));
+  if (from !== null && from > to) fail("invalid_input", "--from must not be later than --to.");
+  const output = resolve2(flags.output ?? `conversations-${appId}`);
+  await mkdir2(output, { recursive: true });
+  const result = {
+    app_id: appId,
+    output,
+    from,
+    to,
+    files: 0,
+    downloaded: 0,
+    media: 0,
+    bytes: 0
+  };
+  const batches = [];
+  let cursor;
+  do {
+    const page2 = (await ctx.call("listAppConversations", {
+      params: { app: appId },
+      query: { ...from ? { from } : {}, to, ...cursor ? { cursor } : {} }
+    })).data;
+    for (const file2 of page2.files) {
+      result.files += 1;
+      const path = join2(output, file2.name);
+      batches.push(path);
+      if (await sizeOf(path) === file2.size) continue;
+      const bytes = await ctx.client.download("getAppConversationFile", {
+        params: { app: appId },
+        query: { name: file2.name }
+      });
+      await save(path, bytes);
+      result.downloaded += 1;
+      result.bytes += bytes.byteLength;
+    }
+    cursor = page2.next_cursor ?? void 0;
+  } while (cursor !== void 0);
+  if (flags.media) {
+    const names = /* @__PURE__ */ new Set();
+    for (const path of batches) {
+      const text2 = gunzipSync(await readFile3(path)).toString("utf8");
+      for (const match of text2.matchAll(MEDIA_REFERENCE)) names.add(match[1]);
+    }
+    for (const name of names) {
+      const path = join2(output, name);
+      if (await sizeOf(path) !== null) continue;
+      const bytes = await ctx.client.download("getAppConversationFile", {
+        params: { app: appId },
+        query: { name }
+      });
+      await save(path, bytes);
+      result.media += 1;
+      result.bytes += bytes.byteLength;
+    }
+  }
+  return result;
+}
+
 // src/context.ts
 import { createHash as createHash2 } from "node:crypto";
-import { resolve as resolve2 } from "node:path";
+import { resolve as resolve3 } from "node:path";
 import { spawn } from "node:child_process";
 import { setTimeout as delay2 } from "node:timers/promises";
 
@@ -17608,7 +17758,9 @@ var ConsoleCapabilitiesResponseSchema = external_exports.object({
    * has billing and can send email. The console still offers the menu only to
    * an organization on a paid plan, and the gateway refuses anyone else.
    */
-  supportEmail: external_exports.email().optional()
+  supportEmail: external_exports.email().optional(),
+  /** Whether this deployment can store conversations: an R2 bucket is bound for it. */
+  conversationStorage: external_exports.boolean()
 });
 var GoogleSignInResponseSchema = external_exports.object({
   url: external_exports.url().meta({ description: "Provider authorization URL for the browser to navigate to." }),
@@ -17696,8 +17848,26 @@ var UsageEventSchema = external_exports.object({
     description: "1 when the client disconnected before the upstream finished streaming, which cancelled the provider call; null otherwise. Not a failure \u2014 the request was served as far as the caller wanted it \u2014 but an aborted stream often takes the provider's end-of-response usage with it, which is why such an event may carry cost_source unresolved."
   }),
   latency_ms: external_exports.number().int().nullable(),
+  client_trace_id: external_exports.string().nullable().meta({
+    description: "The client's X-Client-Trace-Id for this request, or null where it sent none."
+  }),
   created_at: external_exports.string()
 }).meta({ id: "UsageEvent" });
+var ConversationFileSchema = external_exports.object({
+  name: external_exports.string().meta({
+    description: "The file's name within the app, `YYYY-MM-DD/HHMMSS-<batch>.jsonl.gz`; pass it to the download operation."
+  }),
+  size: external_exports.number().int().meta({ description: "Bytes, gzipped." }),
+  records: external_exports.number().int().nullable().meta({ description: "Records in the file, where it says." }),
+  uploaded_at: external_exports.string()
+}).meta({ id: "ConversationFile" });
+var ConversationFileListSchema = external_exports.object({
+  app_id: external_exports.string(),
+  files: external_exports.array(ConversationFileSchema),
+  next_cursor: external_exports.string().nullable().meta({
+    description: "Pass as cursor to continue the listing; null when it is complete."
+  })
+}).meta({ id: "ConversationFileList" });
 var UsageEventListSchema = external_exports.object({
   app_id: external_exports.string(),
   limit: external_exports.number().int(),
@@ -18705,6 +18875,12 @@ var GatewayClientHeadersSchema = external_exports.object({
   }),
   "x-end-user-id": external_exports.string().optional().meta({
     description: "Optional configured end-user identity for issuer-less API-key applications."
+  }),
+  "x-client-trace-id": external_exports.string().regex(CLIENT_TRACE_ID_PATTERN).optional().meta({
+    description: "Optional identifier of the client's own unit of work, such as one chat message that takes several requests. Recorded on the usage event and on the stored conversation, so both can be grouped and joined with the app's own data. 1-128 characters from A-Z, a-z, 0-9, `.`, `_`, `:` and `-`; anything else answers 400 invalid_request. Never forwarded to the provider."
+  }),
+  "x-conversation-storage": external_exports.enum(["off"]).optional().meta({
+    description: "`off` keeps this request out of conversation storage even where the app stores conversations, for a user who has opted out. Any other value answers 400 invalid_request. Never forwarded to the provider."
   })
 });
 var MonthQuerySchema = external_exports.object({
@@ -19351,11 +19527,50 @@ var CATALOG = {
       user: external_exports.string().optional(),
       install: external_exports.string().optional().meta({ description: "Only events of this install: an App Attest key id." }),
       model: external_exports.string().optional(),
+      trace: external_exports.string().regex(CLIENT_TRACE_ID_PATTERN).optional().meta({
+        description: "Only the requests the client sent with this X-Client-Trace-Id."
+      }),
       before_id: BeforeIdSchema
     }),
     response: UsageEventListSchema,
     responseDescription: "Paginated application usage events."
   },
+  listAppConversations: {
+    method: "GET",
+    path: "/v1/admin/apps/{app}/conversations",
+    tags: ["Admin operations"],
+    summary: "List stored conversation files",
+    description: "The batches of stored conversations for an app with conversations.store on, oldest first, by the UTC day of their earliest record. Each file is gzipped JSON lines, one request and its response per line. Media the app keeps (conversations.keep) is stored beside them as `<YYYY-MM-DD>/media/<sha256>.<ext>` and named in the records as `agw-media:<name>`.",
+    security: "management",
+    params: APP_PARAM,
+    policy: { role: "admin", access: "read", grant: "read" },
+    query: external_exports.object({
+      from: DaySchema("from").optional().meta({
+        description: "First UTC day, YYYY-MM-DD; defaults to the oldest stored."
+      }),
+      to: DaySchema("to").optional().meta({
+        description: "Last UTC day, YYYY-MM-DD, inclusive; defaults to today."
+      }),
+      cursor: external_exports.string().max(1024).optional()
+    }),
+    response: ConversationFileListSchema,
+    responseDescription: "One page of stored conversation files."
+  },
+  getAppConversationFile: {
+    method: "GET",
+    path: "/v1/admin/apps/{app}/conversations/file",
+    tags: ["Admin operations"],
+    summary: "Download a stored conversation file",
+    description: "One file named by the listing, or an image a record names: a batch answers as application/gzip, an image as its own type.",
+    security: "management",
+    params: APP_PARAM,
+    policy: { role: "admin", access: "read", grant: "read" },
+    query: external_exports.object({
+      name: external_exports.string().meta({ description: "A file name from the listing, or a media name a record gives, `<YYYY-MM-DD>/media/<sha256>.<ext>`." })
+    }),
+    response: external_exports.unknown(),
+    responseDescription: "The file's bytes."
+  },
   getAppAuthEventSummary: {
     method: "GET",
     path: "/v1/admin/apps/{app}/auth-events/summary",
@@ -19950,6 +20165,20 @@ var GatewayClient = class {
       throw error51;
     }
   }
+  /**
+   * One operation whose success is a file rather than JSON, with the
+   * connection's management credential: its bytes, as the deployment sent them.
+   */
+  async download(name, { params, query } = {}) {
+    const wire = await this.transport.request(
+      this.source.url(),
+      pathFor(name, params, query),
+      { method: CATALOG[name].method, key: this.credential(name), binary: true }
+    );
+    if (!(wire.data instanceof Uint8Array))
+      fail("invalid_response", `The deployment answered ${String(name)} with an unusable body.`, void 0, 3);
+    return wire.data;
+  }
   /**
    * The current management credential, or the refusal that names the way back.
    * An admin operation is also reachable from a plain deployment connection,
@@ -20003,8 +20232,8 @@ var FAILED_PAGE = page(
 );
 async function listenLoopback() {
   let deliver;
-  const code = new Promise((resolve3) => {
-    deliver = resolve3;
+  const code = new Promise((resolve4) => {
+    deliver = resolve4;
   });
   let waiting = null;
   let delivered = false;
@@ -20023,11 +20252,11 @@ async function listenLoopback() {
     waiting = response;
     deliver(value);
   });
-  await new Promise((resolve3, reject2) => {
+  await new Promise((resolve4, reject2) => {
     server.once("error", reject2);
     server.listen(0, "127.0.0.1", () => {
       server.off("error", reject2);
-      resolve3();
+      resolve4();
     });
   });
   const { port } = server.address();
@@ -20039,21 +20268,21 @@ async function listenLoopback() {
       const response = waiting;
       if (!response) return;
       waiting = null;
-      answered = new Promise((resolve3) => {
-        response.once("finish", resolve3);
-        response.once("close", resolve3);
+      answered = new Promise((resolve4) => {
+        response.once("finish", resolve4);
+        response.once("close", resolve4);
       });
       response.writeHead(200, PAGE_HEADERS).end(connected ? CONNECTED_PAGE : FAILED_PAGE);
     },
     async close() {
       loopback.answer(false);
       await answered;
-      await new Promise((resolve3) => {
+      await new Promise((resolve4) => {
         const force = setTimeout(() => server.closeAllConnections(), 1e3);
         force.unref();
         server.close(() => {
           clearTimeout(force);
-          resolve3();
+          resolve4();
         });
         server.closeIdleConnections();
       });
@@ -20360,7 +20589,7 @@ Operation: ${data.id}
       );
     const target = origin(this.url);
     const [id, record2] = await this.reserveOperation(kind, payload, target);
-    const chosen = requestedPath ? resolve2(requestedPath) : record2.output?.path;
+    const chosen = requestedPath ? resolve3(requestedPath) : record2.output?.path;
     if (record2.completedAt && chosen !== record2.output?.path)
       fail(
         "output_changed",
@@ -20861,29 +21090,29 @@ function assertTrustedApprovalUrl(url2, capabilities, target) {
 async function openBrowser(url2) {
   const command = process.platform === "darwin" ? "open" : process.platform === "win32" ? "rundll32" : "xdg-open";
   const args = process.platform === "win32" ? ["url.dll,FileProtocolHandler", url2] : [url2];
-  return new Promise((resolve3) => {
+  return new Promise((resolve4) => {
     const child = spawn(command, args, { stdio: "ignore", detached: true });
-    child.once("error", () => resolve3(false));
+    child.once("error", () => resolve4(false));
     child.once("spawn", () => {
       child.unref();
-      resolve3(true);
+      resolve4(true);
     });
   });
 }
 
 // src/deployment.ts
 import { createHash as createHash4, randomUUID } from "node:crypto";
-import { writeFile as writeFile3, unlink as unlink2 } from "node:fs/promises";
-import { join as join4 } from "node:path";
+import { writeFile as writeFile4, unlink as unlink2 } from "node:fs/promises";
+import { join as join5 } from "node:path";
 
 // src/release.ts
-import { readFile as readFile3, lstat as lstat2, mkdir as mkdir2, rename as rename2, rm, writeFile } from "node:fs/promises";
-import { join as join2, dirname } from "node:path";
+import { readFile as readFile4, lstat as lstat2, mkdir as mkdir3, rename as rename2, rm, writeFile as writeFile2 } from "node:fs/promises";
+import { join as join3, dirname as dirname2 } from "node:path";
 import { fileURLToPath } from "node:url";
 import { createHash as createHash3, randomBytes as randomBytes3 } from "node:crypto";
 
 // src/archive.ts
-import { gunzipSync } from "node:zlib";
+import { gunzipSync as gunzipSync2 } from "node:zlib";
 var BLOCK = 512;
 var ARCHIVE_LIMIT = 64 * 1024 * 1024;
 function text(header, start, length) {
@@ -20920,7 +21149,7 @@ function safePath(raw, directory) {
 function readArchive(gzipped, limit = ARCHIVE_LIMIT) {
   let tar;
   try {
-    tar = gunzipSync(gzipped, { maxOutputLength: limit });
+    tar = gunzipSync2(gzipped, { maxOutputLength: limit });
   } catch {
     fail("release_archive", "Release archive is not readable gzip within the size limit.");
   }
@@ -21001,26 +21230,26 @@ async function fetchArchive(url2) {
   return body;
 }
 async function extract(archive, directory) {
-  await mkdir2(directory, { recursive: true, mode: 448 });
+  await mkdir3(directory, { recursive: true, mode: 448 });
   for (const entry of readArchive(archive)) {
-    const path = join2(directory, entry.path);
+    const path = join3(directory, entry.path);
     if (entry.directory) {
-      await mkdir2(path, { recursive: true, mode: 448 });
+      await mkdir3(path, { recursive: true, mode: 448 });
       continue;
     }
-    await mkdir2(dirname(path), { recursive: true, mode: 448 });
-    await writeFile(path, entry.data, { mode: 384, flag: "wx" });
+    await mkdir3(dirname2(path), { recursive: true, mode: 448 });
+    await writeFile2(path, entry.data, { mode: 384, flag: "wx" });
   }
 }
 async function cachedRelease(version2, integrity, source) {
-  const root = source.cache ?? join2(cacheDirectory(), "releases");
-  const directory = join2(root, version2);
-  const cached2 = await readFile3(join2(directory, "manifest.json")).catch(() => null);
+  const root = source.cache ?? join3(cacheDirectory(), "releases");
+  const directory = join3(root, version2);
+  const cached2 = await readFile4(join3(directory, "manifest.json")).catch(() => null);
   if (cached2 && digest(cached2) === integrity.manifest) return directory;
   const supplied = source.archive ?? process.env["AGW_RELEASE_ARCHIVE"] ?? void 0;
   let archive;
   if (supplied) {
-    archive = await readFile3(supplied).catch(
+    archive = await readFile4(supplied).catch(
       () => fail(
         "release_unavailable",
         `Cannot read the gateway release archive at ${supplied}.`,
@@ -21039,10 +21268,10 @@ async function cachedRelease(version2, integrity, source) {
       4
     );
   await protectedDirectory(root);
-  const staging = join2(root, `.${version2}-${randomBytes3(8).toString("hex")}`);
+  const staging = join3(root, `.${version2}-${randomBytes3(8).toString("hex")}`);
   try {
     await extract(archive, staging);
-    const manifest2 = await readFile3(join2(staging, "manifest.json")).catch(() => null);
+    const manifest2 = await readFile4(join3(staging, "manifest.json")).catch(() => null);
     if (!manifest2 || digest(manifest2) !== integrity.manifest)
       fail(
         "release_integrity",
@@ -21057,7 +21286,7 @@ async function cachedRelease(version2, integrity, source) {
   }
   return directory;
 }
-async function release2(requested = VERSION, base = dirname(fileURLToPath(import.meta.url)), source = {}) {
+async function release2(requested = VERSION, base = dirname2(fileURLToPath(import.meta.url)), source = {}) {
   if (requested !== VERSION)
     fail(
       "unsupported_release",
@@ -21068,7 +21297,7 @@ async function release2(requested = VERSION, base = dirname(fileURLToPath(import
   if (major === void 0 || minor === void 0 || major < 22 || major === 22 && minor < 19)
     fail("unsupported_runtime", "Node.js 22.19.0 or newer is required.");
   const integrity = source.integrity === void 0 ? RELEASE : source.integrity;
-  const packaged = join2(base, "release", requested);
+  const packaged = join3(base, "release", requested);
   const local = await lstat2(packaged).catch(() => null);
   let directory;
   if (local?.isDirectory()) directory = packaged;
@@ -21082,7 +21311,7 @@ async function release2(requested = VERSION, base = dirname(fileURLToPath(import
     );
   let serialized;
   try {
-    serialized = await readFile3(join2(directory, "manifest.json"), "utf8");
+    serialized = await readFile4(join3(directory, "manifest.json"), "utf8");
   } catch {
     fail(
       "release_missing",
@@ -21102,16 +21331,16 @@ async function release2(requested = VERSION, base = dirname(fileURLToPath(import
   for (const [path, hash2] of Object.entries(manifest2.files)) {
     if (path.startsWith("/") || path.split(/[\\/]/).some((p) => p === ".." || p === ""))
       fail("release_integrity", "Release includes an unsafe path.");
-    const file2 = join2(directory, path);
+    const file2 = join3(directory, path);
     const info = await lstat2(file2);
-    if (!info.isFile() || info.isSymbolicLink() || digest(await readFile3(file2)) !== hash2)
+    if (!info.isFile() || info.isSymbolicLink() || digest(await readFile4(file2)) !== hash2)
       fail("release_integrity", "Release asset integrity check failed.");
   }
   return {
     directory,
     manifest: manifest2,
     config: JSON.parse(
-      await readFile3(join2(directory, "wrangler.json"), "utf8")
+      await readFile4(join3(directory, "wrangler.json"), "utf8")
     )
   };
 }
@@ -21147,7 +21376,7 @@ function wranglerEnvironment({
   };
 }
 async function runWrangler(args, { cwd, input, interactive = false, redact } = {}) {
-  return new Promise((resolve3, reject2) => {
+  return new Promise((resolve4, reject2) => {
     const child = spawn2(process.execPath, [require2.resolve("wrangler/bin/wrangler.js"), ...args], {
       ...cwd === void 0 ? {} : { cwd },
       env: wranglerEnvironment({ interactive }),
@@ -21177,7 +21406,7 @@ async function runWrangler(args, { cwd, input, interactive = false, redact } = {
     );
     child.once("close", (code) => {
       if (code !== 0) reject2(wranglerFailure(args, code, errors || output, redact));
-      else resolve3(output);
+      else resolve4(output);
     });
   });
 }
@@ -21367,8 +21596,8 @@ async function whileWarming(run, sleep = delay3, report = (line) => process.stde
 }
 
 // src/installation.ts
-import { cp, writeFile as writeFile2 } from "node:fs/promises";
-import { join as join3 } from "node:path";
+import { cp, writeFile as writeFile3 } from "node:fs/promises";
+import { join as join4 } from "node:path";
 import { setTimeout as delay4 } from "node:timers/promises";
 async function advance(ctx, journal, phase, patch = {}) {
   const fields = journal;
@@ -21395,9 +21624,9 @@ function selectedInstallation(ctx) {
   };
 }
 async function configFile(ctx, journal, artifact) {
-  const directory = join3(ctx.store.directory, "deployments", journal.id);
+  const directory = join4(ctx.store.directory, "deployments", journal.id);
   await protectedDirectory(directory);
-  await cp(artifact.directory, join3(directory, "release"), { recursive: true });
+  await cp(artifact.directory, join4(directory, "release"), { recursive: true });
   const config2 = {
     ...artifact.config,
     name: journal.name,
@@ -21425,8 +21654,8 @@ async function configFile(ctx, journal, artifact) {
       }))
     } : {}
   };
-  const path = join3(directory, "wrangler.json");
-  await writeFile2(path, JSON.stringify(config2, null, 2), { mode: 384 });
+  const path = join4(directory, "wrangler.json");
+  await writeFile3(path, JSON.stringify(config2, null, 2), { mode: 384 });
   return { path, directory, config: config2 };
 }
 async function verifyDeployment(ctx, url2, id) {
@@ -21533,7 +21762,8 @@ async function currentInventory(cf, accountId, name, settings, expectedDatabaseI
     DB: "d1",
     USER_LIMITER: "durable_object_namespace",
     ORG_QUOTA: "durable_object_namespace",
-    ENDPOINT_RATE_LIMITER: "durable_object_namespace"
+    ENDPOINT_RATE_LIMITER: "durable_object_namespace",
+    CONVERSATION_LOG: "durable_object_namespace"
   };
   if (bindings.some(
     (b) => !["plain_text", "secret_text"].includes(b.type) && resourceTypes[b.name] !== b.type
@@ -21546,7 +21776,8 @@ async function currentInventory(cf, accountId, name, settings, expectedDatabaseI
   const localClasses = {
     USER_LIMITER: "UserLimiter",
     ORG_QUOTA: "OrgQuota",
-    ENDPOINT_RATE_LIMITER: "EndpointRateLimiter"
+    ENDPOINT_RATE_LIMITER: "EndpointRateLimiter",
+    CONVERSATION_LOG: "ConversationLog"
   };
   if (bindings.some(
     (binding) => binding.type === "durable_object_namespace" && (binding.class_name !== localClasses[binding.name] || binding.script_name && binding.script_name !== name || binding.environment && binding.environment !== "production")
@@ -21770,8 +22001,8 @@ async function install(ctx, cf, journal, artifact, url2, domain2) {
     // the account is this CLI's however soon anyone else finds the address.
     CLI_BOOTSTRAP_TOKEN_DIGEST: createHash4("sha256").update(journal.bootstrap.token).digest("hex")
   };
-  const secretPath = join4(file2.directory, "secrets.json");
-  await writeFile3(secretPath, JSON.stringify(secrets), {
+  const secretPath = join5(file2.directory, "secrets.json");
+  await writeFile4(secretPath, JSON.stringify(secrets), {
     mode: 384
   });
   try {
@@ -22012,8 +22243,23 @@ function render(command, result, context, style2) {
       return deployment(result, style2);
     case "support send":
       return support(result, style2);
+    case "app conversations":
+      return conversations(result, style2);
   }
 }
+function conversations(result, style2) {
+  if (!("downloaded" in result)) return [];
+  return [
+    style2.headline(
+      result.files === 0 ? `No stored conversations for ${result.app_id} in that range.` : `Exported ${result.files} conversation files for ${result.app_id}.`
+    ),
+    ...kv([
+      ["Folder", result.output],
+      ["Downloaded", `${result.downloaded} files${result.media ? `, ${result.media} media` : ""}`],
+      ["Range", `${result.from ?? "oldest"} to ${result.to}`]
+    ], style2)
+  ];
+}
 function support(result, style2) {
   if (!("reference" in result)) return [];
   return [
@@ -22560,7 +22806,7 @@ var Transport = class {
   constructor(fetchImpl = fetch) {
     this.fetch = fetchImpl;
   }
-  async request(url2, path, { key, method = "GET", body, headers = {} } = {}) {
+  async request(url2, path, { key, method = "GET", body, headers = {}, binary } = {}) {
     const base = origin(url2);
     if (!path.startsWith("/") || path.startsWith("//"))
       fail("invalid_request", "Invalid API path.");
@@ -22571,7 +22817,7 @@ var Transport = class {
         redirect: "manual",
         signal: AbortSignal.timeout(3e4),
         headers: {
-          accept: "application/json",
+          accept: binary ? "*/*" : "application/json",
           "user-agent": `agw/${VERSION}`,
           ...body ? { "content-type": "application/json" } : {},
           ...key ? { authorization: `Bearer ${key}` } : {},
@@ -22594,6 +22840,7 @@ var Transport = class {
         "Connect explicitly to the intended deployment.",
         3
       );
+    if (binary && response.ok) return { data: new Uint8Array(await response.arrayBuffer()) };
     let data;
     try {
       data = await response.json();
@@ -22637,63 +22884,12 @@ var Transport = class {
   }
 };
 
-// src/usage.ts
-var CLI_BREAKDOWNS = ["provider", "model", "status"];
-function month(value) {
-  if (!MONTH_PATTERN.test(value))
-    fail(
-      "invalid_input",
-      "Month must use YYYY-MM with a valid calendar month."
-    );
-  return value;
-}
-function date5(value) {
-  if (!/^\d{4}-\d{2}-\d{2}$/.test(value) || !Number.isFinite(Date.parse(value)) || new Date(value).toISOString().slice(0, 10) !== value)
-    fail(
-      "invalid_input",
-      "Dates must be real UTC calendar dates in YYYY-MM-DD format."
-    );
-  return value;
-}
-function positive(value, max = 3600) {
-  if (!/^\d+$/.test(String(value)) || Number(value) < 1 || Number(value) > max)
-    fail("invalid_input", `Supply an integer between 1 and ${max}.`);
-  return Number(value);
-}
-async function usageCommand(ctx, command, flags) {
-  if (command === "usage show") {
-    const m = month(flags.month ?? (/* @__PURE__ */ new Date()).toISOString().slice(0, 7));
-    return flags.app ? (await ctx.call("getAppUsage", { params: { app: flags.app }, query: { month: m } })).data : (await ctx.call("getCliUsage", { query: { month: m } })).data;
-  }
-  const app2 = await required2(flags, "app");
-  const by = CLI_BREAKDOWNS.find((dimension) => dimension === (flags.by ?? "model"));
-  if (by === void 0)
-    fail("invalid_input", "--by must be provider, model or status.");
-  if (Boolean(flags.from) !== Boolean(flags.to))
-    fail("invalid_input", "Supply both --from and --to or neither.");
-  const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
-  const from = date5(flags.from ?? today.slice(0, 7) + "-01");
-  const to = date5(flags.to ?? today);
-  if (from > to) fail("invalid_input", "--from must not be later than --to.");
-  const limit = positive(flags.limit ?? 50, 200);
-  return {
-    ...(await ctx.call("getAppUsageBreakdown", {
-      params: { app: app2 },
-      query: { from, to, by, limit }
-    })).data,
-    coverage: {
-      from,
-      to,
-      source: "Raw events and retained daily aggregates; dimensions provider, model and status survive raw event retention."
-    }
-  };
-}
-
 // src/main.ts
 async function execute(parsed, ctx) {
   const { command, flags, args } = parsed;
   if (command.startsWith("provider"))
     return resourceCommand(ctx, command, args, flags);
+  if (command === "app conversations") return conversationsCommand(ctx, args[0] ?? "", flags);
   if (command.startsWith("app ")) return appCommand(ctx, command, args, flags);
   if (command.startsWith("usage ")) return usageCommand(ctx, command, flags);
   if (command === "support send") return supportCommand(ctx, flags);
@@ -22755,9 +22951,9 @@ async function main(argv = process.argv.slice(2), {
       const text2 = json2 ? JSON.stringify(output) + "\n" : humanResult(parsed.command, rendered, context, styleFor(stdout));
       if (stdout instanceof Writable2) {
         await new Promise(
-          (resolve3, reject2) => stdout.write(
+          (resolve4, reject2) => stdout.write(
             text2,
-            (error51) => error51 ? reject2(error51) : resolve3()
+            (error51) => error51 ? reject2(error51) : resolve4()
           )
         );
       } else {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@maxceem/agw",
-  "version": "0.12.1",
+  "version": "0.13.0",
   "type": "module",
   "description": "Manage App AI Gateway from a terminal or coding agent: providers, iOS and server apps, usage, and self-hosted deployment on Cloudflare",
   "keywords": [
@@ -26,6 +26,7 @@
   },
   "bugs": "https://github.com/maxceem/app-ai-gateway/issues",
   "upgradeFrom": [
+    "0.12.1",
     "0.12.0",
     "0.11.2",
     "0.11.1",