@mycadet/assistant 0.12.9 → 0.12.10

package/src/telemetry/telemetry-wire.generated.ts

@@ -1,483 +0,0 @@
-// GENERATED FILE — DO NOT EDIT BY HAND.
-// Source of truth: django/app/assistant/self_hosted_local/serializers.py
-// Regenerate with `make generate-telemetry-wire` (run from `django/`).
-//
-// This file must stay deterministic — never embed timestamps or commit SHAs —
-// so regeneration is diff-stable and CI can enforce freshness.
-
-import { z } from "zod";
-
-export type JsonValue =
-  | string
-  | number
-  | boolean
-  | null
-  | JsonValue[]
-  | { [key: string]: JsonValue };
-export const jsonValueSchema: z.ZodType<JsonValue> = z.lazy(() =>
-  z.union([
-    z.string(),
-    z.number(),
-    z.boolean(),
-    z.null(),
-    z.array(jsonValueSchema),
-    z.record(z.string(), jsonValueSchema),
-  ]),
-);
-
-// Byte length of the JSON serialization as the SERVER measures it: Python
-// `json.dumps(value, separators=(",", ":"))` with the default
-// `ensure_ascii=True`, then UTF-8-encoded. ensure_ascii escapes every code
-// point above 0x7E (including 0x7F DEL) as a 6-byte `\uXXXX` sequence —
-// astral chars become surrogate pairs, i.e. two escapes, 12 bytes — so the
-// escaped JSON is pure ASCII and its byte length equals its character count.
-// JSON.stringify already escapes quotes, backslashes, and ASCII control
-// chars identically to Python, so replacing each remaining UTF-16 code unit
-// above 0x7E with a six-char placeholder reproduces the server's byte count
-// exactly. Counting raw UTF-8 instead would undercount non-ASCII text ~3x
-// and let payloads through that the server silently drops.
-const jsonByteLength = (v: unknown): number =>
-  JSON.stringify(v).replace(/[^\x00-\x7e]/g, "\\uxxxx").length;
-
-// ---- Server-side ingest bounds ----
-// Introspected from the ingest serializer class attributes at
-// generation time, so a server-side bump regenerates automatically.
-// A daemon-sent event violating a bound below is REJECTED by ingest
-// (logged server-side, silently dropped from the daemon's point of
-// view) — except `trace`, see TURN_TRACE_MAX_JSON_BYTES.
-export const TURN_CLIENT_MAX_KEYS = 16;
-export const TURN_CLIENT_MAX_KEY_LEN = 64;
-export const TURN_CLIENT_MAX_VALUE_LEN = 256;
-export const TURN_CLIENT_MAX_JSON_BYTES = 2048;
-// The server does NOT reject a turn event whose `trace` exceeds this
-// bound: it drops (nulls) the trace and keeps the event (see
-// TurnTelemetryEventSerializer.validate_trace). Client-side rejection
-// would therefore be wrong, so there is deliberately no `trace`
-// refinement on the turn schema. The daemon may use this constant to
-// pre-trim a trace it would rather not lose.
-export const TURN_TRACE_MAX_JSON_BYTES = 262144;
-export const WATCHDOG_DETAIL_MAX_JSON_BYTES = 4096;
-export const ONBOARDING_RESEARCH_CLAIMS_MAX_JSON_BYTES = 8192;
-export const ONBOARDING_RESEARCH_SUGGESTIONS_MAX_JSON_BYTES = 8192;
-
-export const llmUsageTelemetryEventSchema = z.object({
-  type: z.literal("llm_usage"),
-  daemon_event_id: z.string().trim().min(1).max(128),
-  recorded_at: z.number().int(),
-  assistant_version: z.string().trim().min(1).max(64).nullable().optional(),
-  provider: z.string().trim().min(1).max(64),
-  model: z.string().trim().min(1).max(128),
-  llm_call_site: z.string().trim().min(1).max(255).nullable().optional(),
-  inference_profile: z.string().trim().min(1).max(255).nullable().optional(),
-  inference_profile_source: z
-    .string()
-    .trim()
-    .min(1)
-    .max(255)
-    .nullable()
-    .optional(),
-  input_tokens: z.number().int().min(0),
-  output_tokens: z.number().int().min(0),
-  cache_creation_input_tokens: z.number().int().min(0).nullable().optional(),
-  raw_usage: jsonValueSchema.nullable().optional(),
-  cache_read_input_tokens: z.number().int().min(0).nullable().optional(),
-  actor: z.string().trim().min(1).max(64),
-  cost: z.number().min(0).nullable().optional(),
-  conversation_id: z.string().trim().min(1).max(64).nullable().optional(),
-  conversation_type: z.string().trim().min(1).max(32).nullable().optional(),
-  turn_index: z.number().int().min(0).nullable().optional(),
-  llm_call_count: z.number().int().min(1).nullable().optional(),
-  parent_conversation_id: z
-    .string()
-    .trim()
-    .min(1)
-    .max(64)
-    .nullable()
-    .optional(),
-  parent_turn_index: z.number().int().min(0).nullable().optional(),
-  subagent_role: z.string().trim().min(1).max(64).nullable().optional(),
-  subagent_spawn_mode: z.string().trim().min(1).max(64).nullable().optional(),
-  cron_run_id: z.string().trim().min(1).max(64).nullable().optional(),
-});
-export type LlmUsageTelemetryEvent = z.infer<
-  typeof llmUsageTelemetryEventSchema
->;
-
-export const turnTelemetryEventSchema = z
-  .object({
-    type: z.literal("turn"),
-    daemon_event_id: z.string().trim().min(1).max(128),
-    recorded_at: z.number().int(),
-    assistant_version: z.string().trim().min(1).max(64).nullable().optional(),
-    conversation_type: z.string().trim().min(1).max(32).nullable().optional(),
-    conversation_id: z.string().trim().min(1).max(64).nullable().optional(),
-    turn_index: z.number().int().min(1).nullable().optional(),
-    interface_id: z.string().trim().min(1).max(64).nullable().optional(),
-    channel_id: z.string().trim().min(1).max(64).nullable().optional(),
-    client: z.record(z.string(), jsonValueSchema).nullable().optional(),
-    outcome: z.string().trim().min(1).max(32).nullable().optional(),
-    batched_into: z.string().trim().min(1).max(64).nullable().optional(),
-    failure_code: z.string().trim().min(1).max(64).nullable().optional(),
-    scripted: z.boolean().nullable().optional(),
-    trace: jsonValueSchema.nullable().optional(),
-  })
-  .superRefine((val, ctx) => {
-    // Mirrors the server's TurnTelemetryEventSerializer.validate_client —
-    // a `client` bag violating these bounds is rejected by ingest (the
-    // event is silently dropped, never the whole batch).
-    if (val.client === null || val.client === undefined) {
-      return;
-    }
-    const entries = Object.entries(val.client);
-    if (entries.length > TURN_CLIENT_MAX_KEYS) {
-      ctx.addIssue({
-        code: "custom",
-        path: ["client"],
-        message: `\`client\` may have at most ${TURN_CLIENT_MAX_KEYS} keys; got ${entries.length}.`,
-      });
-    }
-    for (const [key, value] of entries) {
-      if (key.length > TURN_CLIENT_MAX_KEY_LEN) {
-        ctx.addIssue({
-          code: "custom",
-          path: ["client", key],
-          message: `\`client\` keys must be strings of at most ${TURN_CLIENT_MAX_KEY_LEN} chars.`,
-        });
-      }
-      if (typeof value === "object" && value !== null) {
-        ctx.addIssue({
-          code: "custom",
-          path: ["client", key],
-          message: `\`client\` values must be primitives (string / number / boolean / null), not nested objects or arrays.`,
-        });
-      }
-      if (
-        typeof value === "string" &&
-        value.length > TURN_CLIENT_MAX_VALUE_LEN
-      ) {
-        ctx.addIssue({
-          code: "custom",
-          path: ["client", key],
-          message: `\`client\` string values must be at most ${TURN_CLIENT_MAX_VALUE_LEN} chars.`,
-        });
-      }
-    }
-    if (jsonByteLength(val.client) > TURN_CLIENT_MAX_JSON_BYTES) {
-      ctx.addIssue({
-        code: "custom",
-        path: ["client"],
-        message: `\`client\` JSON exceeds ${TURN_CLIENT_MAX_JSON_BYTES} bytes when serialized.`,
-      });
-    }
-  });
-export type TurnTelemetryEvent = z.infer<typeof turnTelemetryEventSchema>;
-
-export const lifecycleTelemetryEventSchema = z.object({
-  type: z.literal("lifecycle"),
-  daemon_event_id: z.string().trim().min(1).max(128),
-  recorded_at: z.number().int(),
-  assistant_version: z.string().trim().min(1).max(64).nullable().optional(),
-  event_name: z.string().trim().min(1).max(64),
-  tool_name: z.string().trim().min(1).max(255).optional(),
-  risk_level: z.string().trim().min(1).max(32).optional(),
-  risk_threshold: z.string().trim().min(1).max(32).optional(),
-  surface: z.string().trim().min(1).max(64).optional(),
-  conversation_id: z.string().trim().min(1).max(128).optional(),
-});
-export type LifecycleTelemetryEvent = z.infer<
-  typeof lifecycleTelemetryEventSchema
->;
-
-export const onboardingTelemetryEventSchema = z
-  .object({
-    type: z.literal("onboarding"),
-    daemon_event_id: z.string().trim().min(1).max(128),
-    recorded_at: z.number().int(),
-    assistant_version: z.string().trim().min(1).max(64).nullable().optional(),
-    screen: z.string().trim().min(1).max(64).optional(),
-    tools: z.array(z.string().trim().min(1).max(128)).optional(),
-    tasks: z.array(z.string().trim().min(1).max(128)).optional(),
-    tone: z.string().trim().min(1).max(64).optional(),
-    google_connected: z.boolean().optional(),
-    google_scopes: z.array(z.string().trim().min(1).max(256)).optional(),
-    ab_variant: z.string().trim().min(1).max(64).optional(),
-    session_id: z.string().trim().min(1).max(128).optional(),
-    step_name: z.string().trim().min(1).max(128).optional(),
-    step_index: z.number().int().min(0).optional(),
-    completed_at: z.string().trim().min(1).max(64).optional(),
-    funnel_version: z.string().trim().min(1).max(128).optional(),
-    user_id: z.string().trim().min(1).max(64).nullable().optional(),
-    outcome: z.string().trim().min(1).max(32).optional(),
-  })
-  .superRefine((val, ctx) => {
-    // Mirrors the server's OnboardingTelemetryEventSerializer.validate —
-    // an onboarding event needs either a non-empty legacy `screen` or the
-    // COMPLETE pre-chat funnel step field set; anything else is rejected
-    // by ingest (silently dropped).
-    const hasLegacyScreenEvent = Boolean(val.screen);
-    const hasStepEvent = [
-      val.session_id,
-      val.step_name,
-      val.step_index,
-      val.completed_at,
-      val.funnel_version,
-      val.ab_variant,
-    ].every((field) => field !== null && field !== undefined);
-    if (!hasLegacyScreenEvent && !hasStepEvent) {
-      ctx.addIssue({
-        code: "custom",
-        message:
-          "Onboarding telemetry requires either `screen` or the complete pre-chat funnel step fields.",
-      });
-    }
-  });
-export type OnboardingTelemetryEvent = z.infer<
-  typeof onboardingTelemetryEventSchema
->;
-
-export const authFallbackTelemetryEventSchema = z.object({
-  type: z.literal("auth_fallback"),
-  daemon_event_id: z.string().trim().min(1).max(128),
-  recorded_at: z.number().int(),
-  assistant_version: z.string().trim().min(1).max(64).nullable().optional(),
-  guard: z.string().trim().min(1).max(64),
-  failure_kind: z.string().trim().min(1).max(64),
-  path: z.string().trim().min(1).max(2048),
-  count: z.number().int().min(0),
-  window_start: z.number().int().min(0),
-  window_end: z.number().int().min(0),
-});
-export type AuthFallbackTelemetryEvent = z.infer<
-  typeof authFallbackTelemetryEventSchema
->;
-
-export const toolExecutedTelemetryEventSchema = z.object({
-  provider: z.string().trim().min(1).max(64).nullable().optional(),
-  model: z.string().trim().min(1).max(128).nullable().optional(),
-  inference_profile: z.string().trim().min(1).max(255).nullable().optional(),
-  inference_profile_source: z
-    .string()
-    .trim()
-    .min(1)
-    .max(255)
-    .nullable()
-    .optional(),
-  type: z.literal("tool_executed"),
-  daemon_event_id: z.string().trim().min(1).max(128),
-  recorded_at: z.number().int(),
-  assistant_version: z.string().trim().min(1).max(64).nullable().optional(),
-  tool_name: z.string().trim().min(1).max(255),
-  status: z.string().trim().min(1).max(32),
-  duration_ms: z.number().int().min(0).nullable().optional(),
-  arg_bytes: z.number().int().min(0).nullable().optional(),
-  result_bytes: z.number().int().min(0).nullable().optional(),
-  conversation_id: z.string().trim().min(1).max(128).nullable().optional(),
-});
-export type ToolExecutedTelemetryEvent = z.infer<
-  typeof toolExecutedTelemetryEventSchema
->;
-
-export const skillLoadedTelemetryEventSchema = z.object({
-  provider: z.string().trim().min(1).max(64).nullable().optional(),
-  model: z.string().trim().min(1).max(128).nullable().optional(),
-  inference_profile: z.string().trim().min(1).max(255).nullable().optional(),
-  inference_profile_source: z
-    .string()
-    .trim()
-    .min(1)
-    .max(255)
-    .nullable()
-    .optional(),
-  type: z.literal("skill_loaded"),
-  daemon_event_id: z.string().trim().min(1).max(128),
-  recorded_at: z.number().int(),
-  assistant_version: z.string().trim().min(1).max(64).nullable().optional(),
-  skill_name: z.string().trim().min(1).max(255),
-  skill_updated_at: z.string().trim().min(1).max(64).nullable().optional(),
-  conversation_id: z.string().trim().min(1).max(128).nullable().optional(),
-});
-export type SkillLoadedTelemetryEvent = z.infer<
-  typeof skillLoadedTelemetryEventSchema
->;
-
-export const watchdogTelemetryEventSchema = z
-  .object({
-    type: z.literal("watchdog"),
-    daemon_event_id: z.string().trim().min(1).max(128),
-    recorded_at: z.number().int(),
-    assistant_version: z.string().trim().min(1).max(64).nullable().optional(),
-    check_name: z.string().trim().min(1).max(128),
-    value: z.number().nullable().optional(),
-    detail: jsonValueSchema.nullable().optional(),
-  })
-  .superRefine((val, ctx) => {
-    // Mirrors the server's WatchdogTelemetryEventSerializer.validate_detail —
-    // an oversize `detail` bag is rejected by ingest (the event is silently
-    // dropped, never the whole batch).
-    if (val.detail === null || val.detail === undefined) {
-      return;
-    }
-    if (jsonByteLength(val.detail) > WATCHDOG_DETAIL_MAX_JSON_BYTES) {
-      ctx.addIssue({
-        code: "custom",
-        path: ["detail"],
-        message: `\`detail\` JSON exceeds ${WATCHDOG_DETAIL_MAX_JSON_BYTES} bytes when serialized.`,
-      });
-    }
-  });
-export type WatchdogTelemetryEvent = z.infer<
-  typeof watchdogTelemetryEventSchema
->;
-
-export const configSettingTelemetryEventSchema = z.object({
-  type: z.literal("config_setting"),
-  daemon_event_id: z.string().trim().min(1).max(128),
-  recorded_at: z.number().int(),
-  assistant_version: z.string().trim().min(1).max(64).nullable().optional(),
-  config_key: z.string().trim().min(1).max(128),
-  config_value: z.string().trim().min(1).max(256),
-});
-export type ConfigSettingTelemetryEvent = z.infer<
-  typeof configSettingTelemetryEventSchema
->;
-
-export const onboardingResearchTelemetryEventSchema = z
-  .object({
-    type: z.literal("onboarding_research"),
-    daemon_event_id: z.string().trim().min(1).max(128),
-    recorded_at: z.number().int(),
-    assistant_version: z.string().trim().min(1).max(64).nullable().optional(),
-    conversation_id: z.string().trim().min(1).max(64).nullable().optional(),
-    status: z.string().trim().min(1).max(32),
-    self_reported_occupation: z.string().max(256).nullable().optional(),
-    self_reported_hobbies: z
-      .array(z.string().trim().min(1).max(128))
-      .max(32)
-      .optional(),
-    self_reported_timezone: z.string().max(64).nullable().optional(),
-    claims: z.array(jsonValueSchema).max(20),
-    claim_count: z.number().int().min(0),
-    claims_confident: z.number().int().min(0),
-    claims_maybe: z.number().int().min(0),
-    claims_guessing: z.number().int().min(0),
-    suggestions: z.array(jsonValueSchema).max(20),
-    suggestion_count: z.number().int().min(0),
-    plugins: z.array(z.string().trim().min(1).max(128)).max(20),
-    installed_plugins: z.array(z.string().trim().min(1).max(128)).max(20),
-  })
-  .superRefine((val, ctx) => {
-    // Mirrors the server's OnboardingResearchTelemetryEventSerializer
-    // validate_claims / validate_suggestions — an oversize `claims` or
-    // `suggestions` array is rejected by ingest (the event is silently
-    // dropped, never the whole batch).
-    if (
-      jsonByteLength(val.claims) > ONBOARDING_RESEARCH_CLAIMS_MAX_JSON_BYTES
-    ) {
-      ctx.addIssue({
-        code: "custom",
-        path: ["claims"],
-        message: `\`claims\` JSON exceeds ${ONBOARDING_RESEARCH_CLAIMS_MAX_JSON_BYTES} bytes when serialized.`,
-      });
-    }
-    if (
-      jsonByteLength(val.suggestions) >
-      ONBOARDING_RESEARCH_SUGGESTIONS_MAX_JSON_BYTES
-    ) {
-      ctx.addIssue({
-        code: "custom",
-        path: ["suggestions"],
-        message: `\`suggestions\` JSON exceeds ${ONBOARDING_RESEARCH_SUGGESTIONS_MAX_JSON_BYTES} bytes when serialized.`,
-      });
-    }
-  });
-export type OnboardingResearchTelemetryEvent = z.infer<
-  typeof onboardingResearchTelemetryEventSchema
->;
-
-export const avatarChangedTelemetryEventSchema = z.object({
-  type: z.literal("avatar_changed"),
-  daemon_event_id: z.string().trim().min(1).max(128),
-  recorded_at: z.number().int(),
-  assistant_version: z.string().trim().min(1).max(64).nullable().optional(),
-  action: z.string().trim().min(1).max(32),
-  kind: z.string().trim().min(1).max(16),
-  previous_kind: z.string().trim().min(1).max(16),
-  body_shape: z.string().trim().min(1).max(256).optional(),
-  eye_style: z.string().trim().min(1).max(256).optional(),
-  color: z.string().trim().min(1).max(256).optional(),
-  accent_hex: z.string().trim().min(1).max(7).optional(),
-  accent_source: z.string().trim().min(1).max(16).optional(),
-  client_os: z.string().trim().min(1).max(64).optional(),
-});
-export type AvatarChangedTelemetryEvent = z.infer<
-  typeof avatarChangedTelemetryEventSchema
->;
-
-export type WireEventMap = {
-  llm_usage: LlmUsageTelemetryEvent;
-  turn: TurnTelemetryEvent;
-  lifecycle: LifecycleTelemetryEvent;
-  onboarding: OnboardingTelemetryEvent;
-  auth_fallback: AuthFallbackTelemetryEvent;
-  tool_executed: ToolExecutedTelemetryEvent;
-  skill_loaded: SkillLoadedTelemetryEvent;
-  watchdog: WatchdogTelemetryEvent;
-  config_setting: ConfigSettingTelemetryEvent;
-  onboarding_research: OnboardingResearchTelemetryEvent;
-  avatar_changed: AvatarChangedTelemetryEvent;
-};
-
-export const telemetryEventSchema = z.discriminatedUnion("type", [
-  llmUsageTelemetryEventSchema,
-  turnTelemetryEventSchema,
-  lifecycleTelemetryEventSchema,
-  onboardingTelemetryEventSchema,
-  authFallbackTelemetryEventSchema,
-  toolExecutedTelemetryEventSchema,
-  skillLoadedTelemetryEventSchema,
-  watchdogTelemetryEventSchema,
-  configSettingTelemetryEventSchema,
-  onboardingResearchTelemetryEventSchema,
-  avatarChangedTelemetryEventSchema,
-]);
-export type TelemetryEvent = z.infer<typeof telemetryEventSchema>;
-
-// Event types recorded SERVER-SIDE by the cloud. A daemon-sent
-// event of one of these types is rejected (dropped) by ingest.
-export const PLATFORM_MANAGED_EVENT_TYPES = [
-  "credit_balance_depleted",
-  "free_tier_daily_limit_reached",
-  "plugin_installed",
-] as const;
-
-export const MAX_EVENTS_PER_BATCH = 10000;
-
-export const telemetryIngestRequestSchema = z
-  .object({
-    device_id: z.string().trim().min(1).max(255).optional(),
-    installation_id: z.string().trim().min(1).max(255).optional(),
-    assistant_version: z.string().trim().min(1).max(64).nullable().optional(),
-    // The server tolerates unknown event types (it skips them); this
-    // schema describes what a current daemon should construct.
-    events: z.array(telemetryEventSchema).max(MAX_EVENTS_PER_BATCH),
-  })
-  .superRefine((val, ctx) => {
-    if (!val.device_id && !val.installation_id) {
-      ctx.addIssue({
-        code: "custom",
-        message: "Either 'device_id' or 'installation_id' is required.",
-      });
-    }
-  });
-export type TelemetryIngestRequest = z.infer<
-  typeof telemetryIngestRequestSchema
->;
-
-export const telemetryIngestResponseSchema = z.object({
-  accepted: z.number().int(),
-  persisted: z.number().int(),
-  dropped: z.record(z.string(), jsonValueSchema),
-});
-export type TelemetryIngestResponse = z.infer<
-  typeof telemetryIngestResponseSchema
->;

package/src/telemetry/tool-executed-events-store.test.ts

@@ -1,210 +0,0 @@
-import { beforeEach, describe, expect, mock, test } from "bun:test";
-
-// Toggle for the share_analytics opt-out gate the audit listener consults
-// when populating the telemetry columns.
-let shareAnalytics = true;
-
-mock.module("../cloud/consent-cache.js", () => ({
-  getRawShareAnalytics: () => shareAnalytics,
-}));
-
-import {
-  seedToolInvocation,
-  TOOL_INVOCATION_PII_SENTINEL as PII_SENTINEL,
-  type ToolInvocationSeedSpec,
-} from "../__tests__/test-support/tool-invocation-seed.js";
-import { getDb } from "../persistence/db-connection.js";
-import { initializeDb } from "../persistence/db-init.js";
-import { conversations, toolInvocations } from "../persistence/schema/index.js";
-import { recordToolExecuted } from "./tool-audit.js";
-import { queryUnreportedToolExecutedEvents } from "./tool-executed-events-store.js";
-
-await initializeDb();
-
-const CONVERSATION_ID = "conv-tool-executed-store-test";
-
-function insertInvocation(
-  spec: Omit<ToolInvocationSeedSpec, "conversationId">,
-): void {
-  seedToolInvocation(
-    { db: getDb(), conversations, toolInvocations },
-    { ...spec, conversationId: CONVERSATION_ID },
-  );
-}
-
-describe("tool-executed-events-store", () => {
-  beforeEach(() => {
-    shareAnalytics = true;
-    getDb().delete(toolInvocations).run();
-  });
-
-  test("projects telemetry fields in (createdAt, id) order without input/result", () => {
-    insertInvocation({
-      id: "ti-b",
-      createdAt: 2000,
-      toolName: "web_search",
-      decision: "error",
-      durationMs: 7,
-    });
-    insertInvocation({
-      id: "ti-a",
-      createdAt: 1000,
-      argBytes: 42,
-      resultBytes: 9001,
-      provider: "anthropic",
-      model: "model-a",
-      inferenceProfile: "balanced",
-      inferenceProfileSource: "active",
-    });
-
-    const rows = queryUnreportedToolExecutedEvents(0, undefined, 100);
-    expect(rows.map((r) => r.id)).toEqual(["ti-a", "ti-b"]);
-    expect(rows[0]).toEqual({
-      id: "ti-a",
-      toolName: "calendar_list_events",
-      decision: "allow",
-      durationMs: 12,
-      argBytes: 42,
-      resultBytes: 9001,
-      provider: "anthropic",
-      model: "model-a",
-      inferenceProfile: "balanced",
-      inferenceProfileSource: "active",
-      conversationId: CONVERSATION_ID,
-      createdAt: 1000,
-    });
-    expect(rows[1]).toMatchObject({
-      toolName: "web_search",
-      decision: "error",
-      durationMs: 7,
-    });
-    // Raw tool args/outputs are potentially PII — the projection must
-    // never include them.
-    expect(JSON.stringify(rows)).not.toContain(PII_SENTINEL);
-  });
-
-  test("excludes permission-denied rows", () => {
-    insertInvocation({ id: "ti-denied", createdAt: 1000, decision: "denied" });
-    insertInvocation({ id: "ti-allow", createdAt: 2000 });
-    insertInvocation({ id: "ti-error", createdAt: 3000, decision: "error" });
-
-    const rows = queryUnreportedToolExecutedEvents(0, undefined, 100);
-    expect(rows.map((r) => r.id)).toEqual(["ti-allow", "ti-error"]);
-  });
-
-  test("excludes legacy pre-migration rows (null arg_bytes)", () => {
-    // Already shipped under the reverted tool_execution type — never
-    // projected, even from a zero watermark.
-    insertInvocation({
-      id: "ti-legacy",
-      createdAt: 1000,
-      argBytes: null,
-      resultBytes: null,
-    });
-    insertInvocation({ id: "ti-new", createdAt: 2000 });
-
-    const rows = queryUnreportedToolExecutedEvents(0, undefined, 100);
-    expect(rows.map((r) => r.id)).toEqual(["ti-new"]);
-  });
-
-  test("rows recorded while opted out are never projected, even from a zero watermark", () => {
-    // End-to-end through the real audit terminal: the write-time opt-out
-    // gate persists NULL telemetry columns, which the arg_bytes IS NOT NULL
-    // filter excludes permanently — the same mechanism as legacy rows. No
-    // watermark state is involved, so no later opt-in can ship these rows.
-    const recordExecuted = (toolName: string): void =>
-      recordToolExecuted({
-        conversationId: CONVERSATION_ID,
-        toolName,
-        input: { path: "/tmp/a" },
-        resultContent: "ok",
-        resultBytes: 2,
-        decision: "allow",
-        riskLevel: "low",
-        durationMs: 5,
-        attribution: null,
-      });
-
-    recordExecuted("t-opted-in-before");
-
-    shareAnalytics = false;
-    recordExecuted("t-opted-out");
-
-    shareAnalytics = true;
-    recordExecuted("t-opted-in-after");
-
-    // Mid-session opt-out flip: only rows recorded while opted in project.
-    const rows = queryUnreportedToolExecutedEvents(0, undefined, 100);
-    expect(rows.map((r) => r.toolName).sort()).toEqual([
-      "t-opted-in-after",
-      "t-opted-in-before",
-    ]);
-
-    // The audit row itself is still recorded — only its telemetry columns
-    // are NULL.
-    const auditRows = getDb().select().from(toolInvocations).all();
-    expect(auditRows).toHaveLength(3);
-    const optedOut = auditRows.find((r) => r.toolName === "t-opted-out");
-    expect(optedOut).toMatchObject({
-      decision: "allow",
-      argBytes: null,
-      resultBytes: null,
-      provider: null,
-      model: null,
-      inferenceProfile: null,
-      inferenceProfileSource: null,
-    });
-  });
-
-  test("post-migration rows project with null attribution columns", () => {
-    insertInvocation({ id: "ti-no-attr", createdAt: 1000 });
-
-    const rows = queryUnreportedToolExecutedEvents(0, undefined, 100);
-    expect(rows[0]).toMatchObject({
-      argBytes: 2,
-      resultBytes: 9,
-      provider: null,
-      model: null,
-      inferenceProfile: null,
-      inferenceProfileSource: null,
-    });
-  });
-
-  test("query advances past the compound (createdAt, id) cursor", () => {
-    // Two rows in the same millisecond: pagination must use the id
-    // tiebreaker to make forward progress, not loop.
-    insertInvocation({ id: "ti-1", createdAt: 5000 });
-    insertInvocation({ id: "ti-2", createdAt: 5000 });
-    insertInvocation({ id: "ti-3", createdAt: 6000 });
-
-    const first = queryUnreportedToolExecutedEvents(0, undefined, 1);
-    expect(first.map((r) => r.id)).toEqual(["ti-1"]);
-
-    const second = queryUnreportedToolExecutedEvents(
-      first[0]!.createdAt,
-      first[0]!.id,
-      100,
-    );
-    expect(second.map((r) => r.id)).toEqual(["ti-2", "ti-3"]);
-
-    // Without an id cursor the timestamp-only branch is used.
-    expect(
-      queryUnreportedToolExecutedEvents(5000, undefined, 100).map((r) => r.id),
-    ).toEqual(["ti-3"]);
-
-    // Cursor past the last row returns nothing.
-    const last = second[second.length - 1]!;
-    expect(
-      queryUnreportedToolExecutedEvents(last.createdAt, last.id, 100).length,
-    ).toBe(0);
-  });
-
-  test("honors the limit", () => {
-    insertInvocation({ id: "ti-l1", createdAt: 1000 });
-    insertInvocation({ id: "ti-l2", createdAt: 2000 });
-    insertInvocation({ id: "ti-l3", createdAt: 3000 });
-
-    const rows = queryUnreportedToolExecutedEvents(0, undefined, 2);
-    expect(rows.map((r) => r.id)).toEqual(["ti-l1", "ti-l2"]);
-  });
-});