@north-light/cli 0.3.551 → 0.3.553

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.551",
+  "version": "0.3.553",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/cli",
-      "version": "0.3.551",
+      "version": "0.3.553",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "workspaces": [
@@ -24,7 +24,7 @@
         "@milkdown/preset-gfm": "^7.22.3",
         "@milkdown/prose": "^7.22.3",
         "@milkdown/utils": "^7.22.3",
-        "@north-light/identity": "0.3.551",
+        "@north-light/identity": "0.3.553",
         "cron-parser": "^5.6.0",
         "esbuild": "^0.27.7",
         "jose": "^6.2.12",
@@ -12455,17 +12455,17 @@
     },
     "packages/crouter-api": {
       "name": "@north-light/api",
-      "version": "0.3.551",
+      "version": "0.3.553",
       "license": "UNLICENSED"
     },
     "packages/crouter-env-docker": {
       "name": "@north-light/env-docker",
-      "version": "0.3.551",
+      "version": "0.3.553",
       "license": "UNLICENSED"
     },
     "packages/crouter-identity": {
       "name": "@north-light/identity",
-      "version": "0.3.551",
+      "version": "0.3.553",
       "license": "UNLICENSED",
       "dependencies": {
         "jose": "^6.2.1"
@@ -12473,21 +12473,21 @@
     },
     "packages/crouter-plugin": {
       "name": "@north-light/plugin",
-      "version": "0.3.551",
+      "version": "0.3.553",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.551",
-        "@north-light/identity": "0.3.551"
+        "@north-light/api": "0.3.553",
+        "@north-light/identity": "0.3.553"
       }
     },
     "packages/crouter-sdk": {
       "name": "@north-light/sdk",
-      "version": "0.3.551",
+      "version": "0.3.553",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.551",
-        "@north-light/identity": "0.3.551",
-        "@north-light/plugin": "0.3.551",
+        "@north-light/api": "0.3.553",
+        "@north-light/identity": "0.3.553",
+        "@north-light/plugin": "0.3.553",
         "jose": "^6.2.1"
       },
       "bin": {

package/scripts/install-runtime.mjs

@@ -13,6 +13,7 @@ import { smokeValidate } from './runtime-smoke.mjs';
 import { scrubInheritedBrokerEnv, unsafeIsolationReason } from './lib/isolation-env.mjs';
 import { packArgs } from './lib/pack-args.mjs';
 import { runtimeDepsKeyFromFiles } from './lib/runtime-deps-key.mjs';
+import { assertCandidateMayOpenLiveDatabase, candidateSchemaVersion } from './lib/canvas-schema-gate.mjs';
 
 scrubInheritedBrokerEnv();
 // CI has no account store to protect, and its checkout sits inside the runner's
@@ -198,18 +199,11 @@ async function assertCanvasSchemaCompatible(stage) {
   }
 }
 
-/** The candidate's Postgres canvas schema version, read from its own `schema-version.js`. */
-async function candidatePostgresSchemaVersion(stage) {
-  const { CANVAS_SCHEMA_VERSION: version } = await import(pathToFileURL(join(stage, 'dist', 'core', 'canvas', 'schema-version.js')).href);
-  if (!Number.isSafeInteger(version) || version < 1) throw new Error('candidate runtime does not expose a valid canvas schema version');
-  return version;
-}
-
-/** Read `canvas_meta.schema_version` from the live Postgres cluster and refuse a candidate older than it. A cluster that
- *  is not running cannot be read, so the candidate is refused until the cluster is started. */
+/** Refuse a candidate whose version is below `canvas_meta.schema_min_reader` (absent: `schema_version`) in the live Postgres
+ *  cluster, read from `CRTR_DATABASE_SCHEMA` as the daemon reads it (`scripts/lib/canvas-schema-gate.mjs`). A cluster that is
+ *  not running cannot be read, so the candidate is refused until the cluster is started. */
 async function assertPostgresSchemaCompatible(stage, runtime) {
   const { default: pg } = await import('pg');
-  const supported = await candidatePostgresSchemaVersion(stage);
   let socketDir = join(runtime, 'pg');
   try { socketDir = (await readFile(join(runtime, 'pg', 'socket-dir'), 'utf8')).trim(); } catch (error) { if (error?.code !== 'ENOENT') throw error; }
   const connectionString = process.env.CRTR_DATABASE_URL
@@ -220,22 +214,14 @@ async function assertPostgresSchemaCompatible(stage, runtime) {
   } catch (error) {
     if (!process.env.CRTR_DATABASE_URL && (error?.code === 'ENOENT' || error?.code === 'ECONNREFUSED')) {
       throw new Error(
-        `refusing to select runtime: the Postgres cluster at ${socketDir} is not running, so its canvas schema version cannot be checked against this build (${supported}). ` +
+        `refusing to select runtime: the Postgres cluster at ${socketDir} is not running, so its canvas schema version cannot be checked against this build (${await candidateSchemaVersion(stage)}). ` +
         'Start it with the currently selected generation (`crtr sys daemon start`) and install again.',
       );
     }
     throw error;
   }
   try {
-    const exists = await client.query(`SELECT to_regclass('canvas_meta') AS t`);
-    const row = exists.rows[0].t === null ? { rows: [] } : await client.query(`SELECT value FROM canvas_meta WHERE key = 'schema_version'`);
-    const current = row.rows[0] === undefined ? undefined : Number(row.rows[0].value);
-    if (current !== undefined && current > supported) {
-      throw new Error(
-        `refusing to select runtime with canvas schema ${supported}: ` +
-        `the live database is already at version ${current}; install a descendant build instead`,
-      );
-    }
+    await assertCandidateMayOpenLiveDatabase(stage, client);
   } finally {
     await client.end();
   }

package/scripts/lib/canvas-schema-gate.mjs

@@ -0,0 +1,20 @@
+// The installer's rollback gate on the live Postgres canvas: loads the candidate generation's own schema module (its
+// supported version, which Postgres schema holds the canvas — `CRTR_DATABASE_SCHEMA`, read by the same resolver the daemon
+// uses — and the check itself) and refuses a candidate below the database's `schema_min_reader`. Takes a connected client so
+// a test can drive it without the installer's side effects.
+import { join } from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+/** `client` is a connected `pg` client for the live database; `env` is the installer's environment. */
+export async function assertCandidateMayOpenLiveDatabase(stage, client, env = process.env) {
+  const candidate = await import(pathToFileURL(join(stage, 'dist', 'core', 'canvas', 'schema-version.js')).href);
+  const supported = candidate.CANVAS_SCHEMA_VERSION;
+  if (!Number.isSafeInteger(supported) || supported < 1) throw new Error('candidate runtime does not expose a valid canvas schema version');
+  await candidate.assertCandidateMayOpen(client, supported, candidate.canvasDatabaseSchema(env));
+}
+
+/** The candidate's supported canvas schema version, for messages. */
+export async function candidateSchemaVersion(stage) {
+  const candidate = await import(pathToFileURL(join(stage, 'dist', 'core', 'canvas', 'schema-version.js')).href);
+  return candidate.CANVAS_SCHEMA_VERSION;
+}

package/dist/core/usage/ledger.d.ts

@@ -1,49 +0,0 @@
-import { type CanvasDb } from '../canvas/db.js';
-import type { SpendUsageDTO } from '../../api/dto/usage.js';
-/** The person's own agent. Its grant carries the directory's default cap, but the
- *  cap bounds what an app spends of the person's subscription, never the person's
- *  own work, so `app:terminal` is never stopped. */
-export declare const UNCAPPED_GRANTEE = "app:terminal";
-export type Payer = 'user' | 'app';
-/** The UTC calendar month `YYYY-MM` of `at`. */
-export declare function usageMonth(at?: Date): string;
-/** 00:00Z on the first day of the UTC month after `month`. */
-export declare function resetAt(month: string): string;
-export interface UsageRecord {
-    grantee: string;
-    payer: Payer;
-    /** `model` for a completion, `provider:<id>` for a provider receipt. */
-    source: string;
-    /** The model that answered; `''` for a provider receipt. */
-    served_model: string;
-    input_tokens: number;
-    output_tokens: number;
-    cached_tokens: number;
-    /** List-price cost; null when the served model has no list price (it adds nothing to the total). */
-    usd_equivalent: number | null;
-}
-/** Add one completion's or receipt's usage to its grantee's month, inside the caller's write. */
-export declare function addUsage(db: CanvasDb, record: UsageRecord, at?: Date): Promise<void>;
-/** Record one model completion for `grantee`. */
-export declare function recordModelUsage(grantee: string, payer: Payer, servedModel: string, usage: {
-    input: number;
-    output: number;
-    cacheRead: number;
-}, usdEquivalent: number | null): Promise<void>;
-/** The grantee's user-paid month-to-date model spend; provider receipts are not in it. */
-export declare function monthSpend(grantee: string, month?: string): Promise<number>;
-/** Who a user-paid call bills, and the cap that bounds it (`null` = uncapped). */
-export interface SpendTarget {
-    grantee: string;
-    spend_cap: number | null;
-}
-/** The cap that applies to `target`: none for the person's own agent or a grant with no cap. */
-export declare function effectiveCap(target: SpendTarget): number | null;
-/** Refuse a user-paid call once the grantee's month spend reached its cap (SPD-2).
- *  The check runs before the call; one response may overshoot the cap (no
- *  reserve-then-settle), and the next call is refused. */
-export declare function assertUnderCap(target: SpendTarget | undefined, at?: Date): Promise<void>;
-/** `usage.get` for one grantee and month. */
-export declare function usageFor(grantee: string, spendCap: number | null, month?: string): Promise<SpendUsageDTO>;
-/** A `month` query value: `YYYY-MM` with a real month, years 1000-9999; absent means the current month. */
-export declare function parseUsageMonth(value: string | null): string;

package/dist/core/usage/ledger.js

@@ -1,10 +0,0 @@
-var f=Object.defineProperty;var a=(e,t)=>f(e,"name",{value:t,configurable:!0});import{withCanvasWrite as h,openDb as d}from"../canvas/db.js";import{RunError as _}from"../runs/operations.js";const q="app:terminal";function r(e=new Date){return e.toISOString().slice(0,7)}a(r,"usageMonth");function l(e){const[t,n]=e.split("-").map(Number);return new Date(Date.UTC(t,n,1)).toISOString()}a(l,"resetAt");async function w(e,t,n=new Date){const u=r(n);await e.prepare(`INSERT INTO usage (grantee, month, payer, source, served_model, input_tokens, output_tokens, cached_tokens, usd_equivalent)
-    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
-    ON CONFLICT(grantee, month, payer, source, served_model) DO UPDATE SET
-      input_tokens = usage.input_tokens + excluded.input_tokens,
-      output_tokens = usage.output_tokens + excluded.output_tokens,
-      cached_tokens = usage.cached_tokens + excluded.cached_tokens,
-      usd_equivalent = CASE WHEN usage.usd_equivalent IS NULL AND excluded.usd_equivalent IS NULL THEN NULL
-        ELSE COALESCE(usage.usd_equivalent, 0) + COALESCE(excluded.usd_equivalent, 0) END`).run(t.grantee,u,t.payer,t.source,t.served_model,t.input_tokens,t.output_tokens,t.cached_tokens,t.usd_equivalent),t.payer==="user"&&t.source==="model"&&t.usd_equivalent!==null&&t.usd_equivalent>0&&await e.prepare(`INSERT INTO grantee_usage (grantee, month, usd_equivalent) VALUES (?, ?, ?)
-      ON CONFLICT(grantee, month) DO UPDATE SET usd_equivalent = grantee_usage.usd_equivalent + excluded.usd_equivalent`).run(t.grantee,u,t.usd_equivalent)}a(w,"addUsage");async function y(e,t,n,u,s){await h(async p=>await w(p,{grantee:e,payer:t,source:"model",served_model:n,input_tokens:u.input,output_tokens:u.output,cached_tokens:u.cacheRead,usd_equivalent:s}))}a(y,"recordModelUsage");async function c(e,t=r()){return(await(await d()).prepare("SELECT usd_equivalent FROM grantee_usage WHERE grantee = ? AND month = ?").get(e,t))?.usd_equivalent??0}a(c,"monthSpend");function m(e){return e.grantee===q?null:e.spend_cap}a(m,"effectiveCap");async function x(e,t=new Date){if(!e)return;const n=m(e);if(n===null)return;const u=r(t),s=await c(e.grantee,u);if(!(s<n))throw new _(402,"cap_exhausted",`${e.grantee} reached its monthly usage limit`,void 0,{spend_cap:n,usd_equivalent:s,reset_at:l(u)})}a(x,"assertUnderCap");async function C(e,t,n=r()){const u=await(await d()).prepare(`SELECT payer, source, served_model, input_tokens, output_tokens, usd_equivalent
-    FROM usage WHERE grantee = ? AND month = ? ORDER BY served_model`).all(e,n),s=a(i=>u.filter(o=>o.payer===i&&o.source==="model").map(({served_model:o,input_tokens:E,output_tokens:v,usd_equivalent:g})=>({served_model:o,input_tokens:E,output_tokens:v,usd_equivalent:g})),"byModel"),p=u.filter(i=>i.payer==="app").reduce((i,o)=>i+(o.usd_equivalent??0),0);return{grantee:e,month:n,usd_equivalent:await c(e,n),by_model:s("user"),app_paid:{usd_equivalent:p,by_model:s("app")},spend_cap:m({grantee:e,spend_cap:t}),reset_at:l(n)}}a(C,"usageFor");function D(e){if(e===null)return r();if(!/^[1-9]\d{3}-(0[1-9]|1[0-2])$/.test(e))throw new _(400,"invalid_request","month must be YYYY-MM","month");return e}a(D,"parseUsageMonth");export{q as UNCAPPED_GRANTEE,w as addUsage,x as assertUnderCap,m as effectiveCap,c as monthSpend,D as parseUsageMonth,y as recordModelUsage,l as resetAt,C as usageFor,r as usageMonth};