@north-light/cli 0.3.554 → 0.3.555

package/dist/core/canvas/export-sqlite.js

@@ -1,3 +1,3 @@
-var V=Object.defineProperty;var l=(i,a)=>V(i,"name",{value:a,configurable:!0});import{DatabaseSync as W}from"node:sqlite";import{existsSync as Y,mkdirSync as P,mkdtempSync as J,renameSync as X,rmSync as k}from"node:fs";import{tmpdir as Q}from"node:os";import{join as A}from"node:path";import j from"pg";import{migrate as z,MIGRATIONS as I}from"./migrations.js";import{canvasDbPath as Z}from"./paths.js";import{canvasSearchPathOptions as ee}from"./schema-version.js";import{EXPORT_MARK_KEY as F,IMPORT_MARK_KEY as te,OBJECT_COLUMNS as ne,pgColumns as re,quote as c,TABLE_ORDER as C}from"./import-sqlite.js";const se=5e3,oe=new Set(["environments","relations","schemas","charges","charge_totals","limits"]),ae={exposures:"node, object, channel",rules:"object, position",edges:"type, src, dst",unresolved_links:"src, name",revision_parents:"child, parent",canvas_meta:"key",runtime_state:"key",message_causes:"message_id",peer_ingested:"key",peer_ingested_destinations:"key",message_sequence:"id",messages:"seq",review_comment_events:"seq",audit_rows:"id",peer_outbox:"id",app_users:"uid"},ie={objects:"id",revisions:"rev_id",watches:"watch_id"},H=new Set(["daemon_owner","schema_version","schema_min_reader","ledger_migrated",te,F]);function ce(i){const a=J(A(Q(),"crtr-export-")),r=process.env.CRTR_HOME;process.env.CRTR_HOME=a,P(A(a,"runtime","nodes"),{recursive:!0});try{const s=new W(i);return s.exec("PRAGMA journal_mode = DELETE;"),s.exec("PRAGMA foreign_keys = ON;"),z(s),s.exec("DELETE FROM canvas_meta; DELETE FROM message_sequence;"),s}finally{r===void 0?delete process.env.CRTR_HOME:process.env.CRTR_HOME=r,k(a,{recursive:!0,force:!0})}}l(ce,"createEmptyDatabase");async function ge(i,a=()=>{}){const r=Z();if(Y(r))throw new Error(`${r} already exists; refusing to overwrite it`);P(A(r,".."),{recursive:!0,mode:448});const s=`${r}.exporting-${process.pid}`,m=Date.now(),t=new j.Client({connectionString:i,application_name:`crtr-export-${process.pid}`,options:ee(),types:{getTypeParser:l(((f,o)=>f===20?d=>Number(d):j.types.getTypeParser(f,o)),"getTypeParser")}});await t.connect();let p;try{if((await t.query("SELECT value FROM canvas_meta WHERE key = 'schema_version'").catch(()=>({rows:[]}))).rows.length===0)throw new Error("the Postgres database has no canvas schema; nothing to export");p=ce(s);const o=p;o.exec("PRAGMA foreign_keys = OFF;");const d=await re(t),L=[...d.keys()].filter(e=>!oe.has(e)&&!C.includes(e));if(L.length>0)throw new Error(`export: Postgres tables with no export rule: ${L.join(", ")}`);await t.query("BEGIN READ ONLY ISOLATION LEVEL REPEATABLE READ");const h={};for(const[e,O]of Object.entries(ie)){const _=new Map;for(const E of(await t.query(`SELECT ${O} AS id, seq FROM ${e}`)).rows)_.set(E.id,Number(E.seq));h[e]=_}const B=h.objects;let M=0;o.exec("BEGIN");for(const e of C){const O=Date.now(),_=new Set(o.prepare(`PRAGMA table_info(${c(e)})`).all().map(n=>n.name)),E=d.get(e);if(E===void 0)throw new Error(`export: Postgres has no table ${e}`);const G=E.some(n=>n.name==="seq"),$=E.filter(n=>_.has(n.name)),K=new Set(ne[e]??[]),R=e==="objects"||e==="revisions"||e==="watches"||e==="watch_subscriptions",v=$.map(n=>n.type==="jsonb"?`${c(n.name)}::text AS ${c(n.name)}`:c(n.name));e==="watches"&&v.push("watch_id AS _watch_id"),R&&v.push("seq AS _seq");const g=$.map(n=>c(n.name)),U=o.prepare(`INSERT INTO ${c(e)} (${R?["rowid",...g]:g}) VALUES (${(R?["?",...g]:g).map(()=>"?").join(", ")})`),q=G?"seq":ae[e],T=`export_${e}`;await t.query(`DECLARE ${T} NO SCROLL CURSOR FOR SELECT ${v.join(", ")} FROM ${c(e)}${e==="canvas_meta"?` WHERE key NOT IN (${[...H].map(n=>`'${n}'`).join(", ")})`:""}${q===void 0?"":` ORDER BY ${q}`}`);let b=0;for(;;){const n=await t.query(`FETCH ${se} FROM ${T}`);if(n.rows.length===0)break;for(const N of n.rows){const D=R?[Number(N._seq)]:[];for(const u of $){let w=N[u.name];e==="revision_parents"&&(u.name==="child"||u.name==="parent")?w=x(h.revisions,"revision",e,u.name,w):e==="watch_subscriptions"&&u.name==="watch"?w=x(h.watches,"watch",e,u.name,w):K.has(u.name)&&(w=x(B,"object",e,u.name,w)),D.push(w??null)}U.run(...D)}b+=n.rows.length}await t.query(`CLOSE ${T}`),M+=b,a(`export ${e}: ${b} rows in ${Date.now()-O} ms`)}o.exec("COMMIT"),await t.query("COMMIT");const y=o.prepare("PRAGMA foreign_key_check").all();if(y.length>0)throw new Error(`export: ${y.length} foreign key violation(s) in the exported canvas.db, first: ${JSON.stringify(y[0])}`);await me(t,o);const S=o.prepare("PRAGMA user_version").get().user_version;if(S!==I.length)throw new Error(`export: exported canvas.db is at user_version ${S}, expected ${I.length}`);return o.close(),p=void 0,await t.query("INSERT INTO canvas_meta (key, value) VALUES ($1, $2) ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value",[F,JSON.stringify({at:new Date().toISOString(),path:r})]),X(s,r),{path:r,rows:M,ms:Date.now()-m,userVersion:S}}catch(f){await t.query("ROLLBACK").catch(()=>{});try{p?.close()}catch{}for(const o of["","-wal","-shm","-journal"])k(`${s}${o}`,{force:!0});throw f}finally{await t.end().catch(()=>{})}}l(ge,"exportPostgresToSqlite");function x(i,a,r,s,m){if(m==null)return null;const t=i.get(m);if(t===void 0)throw new Error(`export: ${r}.${s} references ${a} ${String(m)}, which was not exported (`);return t}l(x,"mapId");async function me(i,a){const r=[];for(const s of C){const m=Number((await i.query(`SELECT count(*) AS n FROM ${c(s)}`)).rows[0].n);let t=Number(a.prepare(`SELECT count(*) AS n FROM ${c(s)}`).get().n),p=m;s==="canvas_meta"&&(p=Number((await i.query("SELECT count(*) AS n FROM canvas_meta WHERE key <> ALL($1)",[[...H]])).rows[0].n),t=Number(a.prepare("SELECT count(*) AS n FROM canvas_meta").get().n)),p!==t&&r.push(`${s}: Postgres ${p} rows, SQLite ${t}`)}if(r.length>0)throw new Error(`Postgres \u2192 SQLite export verification failed:
-  ${r.join(`
-  `)}`)}l(me,"verify");export{ge as exportPostgresToSqlite};
+var V=Object.defineProperty;var w=(i,a)=>V(i,"name",{value:a,configurable:!0});import{DatabaseSync as W}from"node:sqlite";import{existsSync as Y,mkdirSync as D,mkdtempSync as J,renameSync as X,rmSync as P}from"node:fs";import{tmpdir as Q}from"node:os";import{join as A}from"node:path";import j from"pg";import{migrate as z,MIGRATIONS as I}from"./migrations.js";import{canvasDbPath as Z}from"./paths.js";import{canvasSearchPathOptions as ee}from"./schema-version.js";import{EXPORT_MARK_KEY as F,IMPORT_MARK_KEY as te,OBJECT_COLUMNS as ne,pgColumns as se,quote as c,TABLE_ORDER as C}from"./import-sqlite.js";const oe=5e3,re=new Set(["environments","relations","schemas","charges","charge_totals","limits","viewer_attachments","reconciler_leases","environment_repos","conversation_entries","conversation_parts","charge_chunks","profiles","profile_projects","profile_defaults","scope_settings","scope_bookkeeping","scope_marketplaces","scope_plugins","person_settings","model_accounts","model_account_cooldowns","model_api_keys","model_settings","model_sign_in_flows","env_vars"]),ae={exposures:"node, object, channel",rules:"object, position",edges:"type, src, dst",unresolved_links:"src, name",revision_parents:"child, parent",canvas_meta:"key",runtime_state:"key",message_causes:"message_id",peer_ingested:"key",peer_ingested_destinations:"key",message_sequence:"id",messages:"seq",review_comment_events:"seq",audit_rows:"id",peer_outbox:"id",app_users:"uid"},ie={objects:"id",revisions:"rev_id",watches:"watch_id"},H=new Set(["daemon_owner","schema_version","schema_min_reader","ledger_migrated",te,F]);function ce(i){const a=J(A(Q(),"crtr-export-")),s=process.env.CRTR_HOME;process.env.CRTR_HOME=a,D(A(a,"runtime","nodes"),{recursive:!0});try{const o=new W(i);return o.exec("PRAGMA journal_mode = DELETE;"),o.exec("PRAGMA foreign_keys = ON;"),z(o),o.exec("DELETE FROM canvas_meta; DELETE FROM message_sequence;"),o}finally{s===void 0?delete process.env.CRTR_HOME:process.env.CRTR_HOME=s,P(a,{recursive:!0,force:!0})}}w(ce,"createEmptyDatabase");async function Re(i,a=()=>{}){const s=Z();if(Y(s))throw new Error(`${s} already exists; refusing to overwrite it`);D(A(s,".."),{recursive:!0,mode:448});const o=`${s}.exporting-${process.pid}`,p=Date.now(),t=new j.Client({connectionString:i,application_name:`crtr-export-${process.pid}`,options:ee(),types:{getTypeParser:w(((f,r)=>f===20?d=>Number(d):j.types.getTypeParser(f,r)),"getTypeParser")}});await t.connect();let m;try{if((await t.query("SELECT value FROM canvas_meta WHERE key = 'schema_version'").catch(()=>({rows:[]}))).rows.length===0)throw new Error("the Postgres database has no canvas schema; nothing to export");m=ce(o);const r=m;r.exec("PRAGMA foreign_keys = OFF;");const d=await se(t),L=[...d.keys()].filter(e=>!re.has(e)&&!C.includes(e));if(L.length>0)throw new Error(`export: Postgres tables with no export rule: ${L.join(", ")}`);await t.query("BEGIN READ ONLY ISOLATION LEVEL REPEATABLE READ");const E={};for(const[e,S]of Object.entries(ie)){const h=new Map;for(const _ of(await t.query(`SELECT ${S} AS id, seq FROM ${e}`)).rows)h.set(_.id,Number(_.seq));E[e]=h}const B=E.objects;let M=0;r.exec("BEGIN");for(const e of C){const S=Date.now(),h=new Set(r.prepare(`PRAGMA table_info(${c(e)})`).all().map(n=>n.name)),_=d.get(e);if(_===void 0)throw new Error(`export: Postgres has no table ${e}`);const G=_.some(n=>n.name==="seq"),O=_.filter(n=>h.has(n.name)),K=new Set(ne[e]??[]),g=e==="objects"||e==="revisions"||e==="watches"||e==="watch_subscriptions",$=O.map(n=>n.type==="jsonb"?`${c(n.name)}::text AS ${c(n.name)}`:c(n.name));e==="watches"&&$.push("watch_id AS _watch_id"),g&&$.push("seq AS _seq");const R=O.map(n=>c(n.name)),U=r.prepare(`INSERT INTO ${c(e)} (${g?["rowid",...R]:R}) VALUES (${(g?["?",...R]:R).map(()=>"?").join(", ")})`),q=G?"seq":ae[e],b=`export_${e}`;await t.query(`DECLARE ${b} NO SCROLL CURSOR FOR SELECT ${$.join(", ")} FROM ${c(e)}${e==="canvas_meta"?` WHERE key NOT IN (${[...H].map(n=>`'${n}'`).join(", ")})`:""}${q===void 0?"":` ORDER BY ${q}`}`);let T=0;for(;;){const n=await t.query(`FETCH ${oe} FROM ${b}`);if(n.rows.length===0)break;for(const k of n.rows){const N=g?[Number(k._seq)]:[];for(const u of O){let l=k[u.name];e==="revision_parents"&&(u.name==="child"||u.name==="parent")?l=x(E.revisions,"revision",e,u.name,l):e==="watch_subscriptions"&&u.name==="watch"?l=x(E.watches,"watch",e,u.name,l):K.has(u.name)&&(l=x(B,"object",e,u.name,l)),N.push(l??null)}U.run(...N)}T+=n.rows.length}await t.query(`CLOSE ${b}`),M+=T,a(`export ${e}: ${T} rows in ${Date.now()-S} ms`)}r.exec("COMMIT"),await t.query("COMMIT");const y=r.prepare("PRAGMA foreign_key_check").all();if(y.length>0)throw new Error(`export: ${y.length} foreign key violation(s) in the exported canvas.db, first: ${JSON.stringify(y[0])}`);await pe(t,r);const v=r.prepare("PRAGMA user_version").get().user_version;if(v!==I.length)throw new Error(`export: exported canvas.db is at user_version ${v}, expected ${I.length}`);return r.close(),m=void 0,await t.query("INSERT INTO canvas_meta (key, value) VALUES ($1, $2) ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value",[F,JSON.stringify({at:new Date().toISOString(),path:s})]),X(o,s),{path:s,rows:M,ms:Date.now()-p,userVersion:v}}catch(f){await t.query("ROLLBACK").catch(()=>{});try{m?.close()}catch{}for(const r of["","-wal","-shm","-journal"])P(`${o}${r}`,{force:!0});throw f}finally{await t.end().catch(()=>{})}}w(Re,"exportPostgresToSqlite");function x(i,a,s,o,p){if(p==null)return null;const t=i.get(p);if(t===void 0)throw new Error(`export: ${s}.${o} references ${a} ${String(p)}, which was not exported (`);return t}w(x,"mapId");async function pe(i,a){const s=[];for(const o of C){const p=Number((await i.query(`SELECT count(*) AS n FROM ${c(o)}`)).rows[0].n);let t=Number(a.prepare(`SELECT count(*) AS n FROM ${c(o)}`).get().n),m=p;o==="canvas_meta"&&(m=Number((await i.query("SELECT count(*) AS n FROM canvas_meta WHERE key <> ALL($1)",[[...H]])).rows[0].n),t=Number(a.prepare("SELECT count(*) AS n FROM canvas_meta").get().n)),m!==t&&s.push(`${o}: Postgres ${m} rows, SQLite ${t}`)}if(s.length>0)throw new Error(`Postgres \u2192 SQLite export verification failed:
+  ${s.join(`
+  `)}`)}w(pe,"verify");export{Re as exportPostgresToSqlite};

package/dist/core/canvas/schema-chain.d.ts

@@ -29,6 +29,5 @@ export interface SchemaChainOptions {
 /** Bring the connected database to this build's schema. Takes `pg_advisory_lock` for the session and reads the version under
  *  it, so processes opening together queue and a late one applies nothing. Refuses a database whose `schema_min_reader` is above
  *  this build's version; opens one whose `schema_version` is above it when `schema_min_reader` allows. A database with no
- *  `schema_version` gets `schema-pg.sql`, which runs as one multi-statement simple query, one transaction. A database at the
- *  baseline version first runs the file's `-- <name>:begin … -- <name>:end` blocks, in file order, each idempotent (S1 deletes this). */
+ *  `schema_version` gets `schema-pg.sql`, which runs as one multi-statement simple query, one transaction. */
 export declare function ensureSchema(client: pg.Client, options?: SchemaChainOptions): Promise<void>;

package/dist/core/canvas/schema-chain.js

@@ -1 +1 @@
-var _=Object.defineProperty;var u=(a,e)=>_(a,"name",{value:e,configurable:!0});import{createHash as v}from"node:crypto";import{readdirSync as S,readFileSync as E}from"node:fs";import{dirname as T,join as d}from"node:path";import{fileURLToPath as p}from"node:url";import{CANVAS_SCHEMA_VERSION as $,readStoredVersions as f}from"./schema-version.js";const w=T(p(import.meta.url)),g=d(w,"schema-pg.sql"),k=d(w,"schema-pg"),y=7427001,h=1,A=5e3,L=12e4,q="55P03",C=/^(\d{3})-([a-z0-9][a-z0-9-]*)\.sql$/;function M(a=k){const e=[];for(const t of S(a).sort()){if(t===".gitkeep")continue;const o=C.exec(t);if(o===null)throw new Error(`schema delta directory ${a}: ${t} is not named NNN-<name>.sql`);e.push({version:Number(o[1]),name:o[2],file:d(a,t)})}return e.forEach((t,o)=>{if(t.version!==h+1+o)throw new Error(`schema delta directory ${a}: expected delta ${h+1+o} but found ${t.version}-${t.name}.sql; deltas are numbered contiguously from ${h+1}`)}),e}u(M,"listDeltas");async function l(a,e){await a.query("INSERT INTO canvas_meta (key, value) VALUES ($1, $2) ON CONFLICT (key) DO UPDATE SET value = EXCLUDED.value",[e.key,e.hash])}u(l,"recordBlock");const b=u(a=>new Promise(e=>setTimeout(e,a)),"sleep");async function D(a,e,t){const o=E(e.file,"utf8"),c=Date.now();let m=250;for(let r=1;;r++)try{if(await a.query("BEGIN"),await a.query(`SET LOCAL lock_timeout = '${t.lockTimeoutMs}ms'`),await a.query(o),(await a.query("UPDATE canvas_meta SET value = $1 WHERE key = 'schema_version' AND value = $2",[String(e.version),String(e.version-1)])).rowCount!==1)throw new Error(`schema step ${e.version} (${e.name}): schema_version was not ${e.version-1}; another writer changed the schema outside the chain`);await a.query("COMMIT"),t.emit?.("info","schema.step.applied",{version:e.version,name:e.name,ms:Date.now()-c,attempts:r});return}catch(s){if(await a.query("ROLLBACK").catch(()=>{}),s.code!==q)throw s;if(Date.now()+m-c>t.retryBudgetMs)throw new Error(`schema step ${e.version} (${e.name}) could not get its locks within ${t.retryBudgetMs} ms (${r} attempts); a long transaction holds a table it needs`,{cause:s});t.emit?.("warn","schema.step.lock_timeout",{version:e.version,name:e.name,attempt:r,retry_in_ms:m}),await b(m),m=Math.min(m*2,1e4)}}u(D,"applyStep");async function F(a,e={}){const t=e.version??$,o=M(e.deltaDir);if(e.schema!==void 0){const c=`"${e.schema.replace(/"/g,'""')}"`;await a.query(`CREATE SCHEMA IF NOT EXISTS ${c}`),await a.query(`SET search_path TO ${c}`)}await a.query("SELECT pg_advisory_lock($1)",[y]);try{const c=E(g,"utf8"),m=[...c.matchAll(/^-- (\w+):begin\n([\s\S]*?)^-- \1:end$/gm)].map(([,i,n])=>({key:`schema_block.${i}`,sql:n,hash:v("sha256").update(n).digest("hex")}));let r=await f(a);if(r!==void 0&&t<r.minReader)throw new Error(`unsupported canvas schema: this build is at version ${t} but the database requires readers at version ${r.minReader} or above (it is at ${r.version}); this build is older than the database. Select a newer runtime generation.`);let s;if(r===void 0){if(await a.query(c),r=await f(a),r===void 0)throw new Error("schema-pg.sql did not write canvas_meta.schema_version");s=r.version;for(const i of m)await l(a,i)}else if(s=r.version,s===h){const i=new Map((await a.query("SELECT key, value FROM canvas_meta WHERE key LIKE 'schema\\_block.%'")).rows.map(n=>[n.key,n.value]));for(const n of m)i.get(n.key)!==n.hash&&(await a.query(n.sql),await l(a,n))}for(const i of o)i.version<=s||(s=i.version,await D(a,i,{lockTimeoutMs:e.lockTimeoutMs??A,retryBudgetMs:e.retryBudgetMs??L,emit:e.emit}));if(s<t)throw new Error(`canvas schema version ${s} does not match this build's ${t}: no delta reaches it`)}finally{await a.query("SELECT pg_advisory_unlock($1)",[y]).catch(()=>{})}}u(F,"ensureSchema");export{h as BASELINE_VERSION,A as DEFAULT_STEP_LOCK_TIMEOUT_MS,L as DEFAULT_STEP_RETRY_BUDGET_MS,F as ensureSchema,M as listDeltas};
+var w=Object.defineProperty;var i=(r,e)=>w(r,"name",{value:e,configurable:!0});import{readdirSync as _,readFileSync as d}from"node:fs";import{dirname as v,join as m}from"node:path";import{fileURLToPath as y}from"node:url";import{CANVAS_SCHEMA_VERSION as l,readStoredVersions as h}from"./schema-version.js";const E=v(y(import.meta.url)),S=m(E,"schema-pg.sql"),$=m(E,"schema-pg"),f=7427001,u=1,T=5e3,p=12e4,A="55P03",g=/^(\d{3})-([a-z0-9][a-z0-9-]*)\.sql$/;function q(r=$){const e=[];for(const t of _(r).sort()){if(t===".gitkeep")continue;const s=g.exec(t);if(s===null)throw new Error(`schema delta directory ${r}: ${t} is not named NNN-<name>.sql`);e.push({version:Number(s[1]),name:s[2],file:m(r,t)})}return e.forEach((t,s)=>{if(t.version!==u+1+s)throw new Error(`schema delta directory ${r}: expected delta ${u+1+s} but found ${t.version}-${t.name}.sql; deltas are numbered contiguously from ${u+1}`)}),e}i(q,"listDeltas");const L=i(r=>new Promise(e=>setTimeout(e,r)),"sleep");async function M(r,e,t){const s=d(e.file,"utf8"),a=Date.now();let o=250;for(let n=1;;n++)try{if(await r.query("BEGIN"),await r.query(`SET LOCAL lock_timeout = '${t.lockTimeoutMs}ms'`),await r.query(s),(await r.query("UPDATE canvas_meta SET value = $1 WHERE key = 'schema_version' AND value = $2",[String(e.version),String(e.version-1)])).rowCount!==1)throw new Error(`schema step ${e.version} (${e.name}): schema_version was not ${e.version-1}; another writer changed the schema outside the chain`);await r.query("COMMIT"),t.emit?.("info","schema.step.applied",{version:e.version,name:e.name,ms:Date.now()-a,attempts:n});return}catch(c){if(await r.query("ROLLBACK").catch(()=>{}),c.code!==A)throw c;if(Date.now()+o-a>t.retryBudgetMs)throw new Error(`schema step ${e.version} (${e.name}) could not get its locks within ${t.retryBudgetMs} ms (${n} attempts); a long transaction holds a table it needs`,{cause:c});t.emit?.("warn","schema.step.lock_timeout",{version:e.version,name:e.name,attempt:n,retry_in_ms:o}),await L(o),o=Math.min(o*2,1e4)}}i(M,"applyStep");async function O(r,e={}){const t=e.version??l,s=q(e.deltaDir);if(e.schema!==void 0){const a=`"${e.schema.replace(/"/g,'""')}"`;await r.query(`CREATE SCHEMA IF NOT EXISTS ${a}`),await r.query(`SET search_path TO ${a}`)}await r.query("SELECT pg_advisory_lock($1)",[f]);try{let a=await h(r);if(a!==void 0&&t<a.minReader)throw new Error(`unsupported canvas schema: this build is at version ${t} but the database requires readers at version ${a.minReader} or above (it is at ${a.version}); this build is older than the database. Select a newer runtime generation.`);if(a===void 0&&(await r.query(d(S,"utf8")),a=await h(r),a===void 0))throw new Error("schema-pg.sql did not write canvas_meta.schema_version");let o=a.version;for(const n of s)n.version<=o||(o=n.version,await M(r,n,{lockTimeoutMs:e.lockTimeoutMs??T,retryBudgetMs:e.retryBudgetMs??p,emit:e.emit}));if(o<t)throw new Error(`canvas schema version ${o} does not match this build's ${t}: no delta reaches it`)}finally{await r.query("SELECT pg_advisory_unlock($1)",[f]).catch(()=>{})}}i(O,"ensureSchema");export{u as BASELINE_VERSION,T as DEFAULT_STEP_LOCK_TIMEOUT_MS,p as DEFAULT_STEP_RETRY_BUDGET_MS,O as ensureSchema,q as listDeltas};

package/dist/core/canvas/schema-pg/002-fleet.sql

@@ -0,0 +1,600 @@
+-- 002-fleet.sql — cycle 5 additions (design-fleet "Data model"). One transaction, additions only; the removals ship in 003.
+-- Opens with the text of the three blocks that joined version 1 after release (environments, ledger, permissions), verbatim and
+-- idempotent, so a version-1 database with or without them reaches the same schema as a fresh one. A pure function of the baseline.
+CREATE TABLE IF NOT EXISTS environments (
+  object       text PRIMARY KEY REFERENCES objects(id) ON DELETE CASCADE,
+  kind         text NOT NULL CHECK (kind IN ('machine')),
+  machine_id   text NOT NULL UNIQUE,
+  last_seen_at text NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS charges (
+  id         text PRIMARY KEY,
+  request    text,
+  at         text NOT NULL,
+  month      text NOT NULL,
+  kind       text NOT NULL CHECK (kind IN ('model','tool','sandbox','job','storage','take')),
+  what       text NOT NULL,
+  units      jsonb,
+  usd        numeric(14,6),
+  payer      text NOT NULL,
+  funding    text NOT NULL CHECK (funding IN ('bill','subscription','key','endpoint','take','legacy')),
+  sub        text,
+  grantee    text NOT NULL,
+  node       text,
+  run        text,
+  provider   text,
+  caused_by  text,
+  vendor_ref text,
+  refused    jsonb
+);
+CREATE INDEX IF NOT EXISTS charges_month_payer ON charges(month, payer);
+CREATE INDEX IF NOT EXISTS charges_request ON charges(request) WHERE request IS NOT NULL;
+CREATE INDEX IF NOT EXISTS charges_caused_by ON charges(caused_by) WHERE caused_by IS NOT NULL;
+CREATE INDEX IF NOT EXISTS charges_run ON charges(run) WHERE run IS NOT NULL;
+CREATE INDEX IF NOT EXISTS charges_grantee_month ON charges(grantee, month);
+
+CREATE TABLE IF NOT EXISTS charge_totals (
+  month    text NOT NULL,
+  payer    text NOT NULL,
+  funding  text NOT NULL,
+  sub      text NOT NULL DEFAULT '',
+  grantee  text NOT NULL,
+  provider text NOT NULL DEFAULT '',
+  usd      numeric(16,6) NOT NULL DEFAULT 0,
+  PRIMARY KEY (month, payer, funding, sub, grantee, provider)
+);
+
+CREATE TABLE IF NOT EXISTS limits (
+  id            text PRIMARY KEY,
+  payer         text NOT NULL,
+  funding       text,
+  grantee       text,
+  provider      text,
+  sub           text,
+  usd_per_month numeric(14,6) NOT NULL CHECK (usd_per_month >= 0),
+  source        text NOT NULL CHECK (source IN ('grant_sync','person','operator')),
+  updated_at    text NOT NULL
+);
+CREATE INDEX IF NOT EXISTS limits_payer ON limits(payer);
+
+ALTER TABLE nodes ADD COLUMN IF NOT EXISTS caused_by text;
+
+CREATE TABLE IF NOT EXISTS relations (
+  resource_type    text NOT NULL,
+  resource_id      text NOT NULL,
+  relation         text NOT NULL,
+  subject_type     text NOT NULL,
+  subject_id       text NOT NULL,
+  subject_relation text NOT NULL DEFAULT '',
+  written_by       text NOT NULL,
+  created_at       text NOT NULL,
+  PRIMARY KEY (resource_type, resource_id, relation, subject_type, subject_id, subject_relation)
+);
+CREATE INDEX IF NOT EXISTS relations_subject ON relations(subject_type, subject_id, relation);
+CREATE INDEX IF NOT EXISTS relations_resource ON relations(resource_id);
+
+CREATE TABLE IF NOT EXISTS schemas (
+  namespace     text PRIMARY KEY,
+  app           text NOT NULL,
+  version       bigint NOT NULL,
+  source        text NOT NULL,
+  compiled_json text NOT NULL,
+  registered_at text NOT NULL
+);
+
+ALTER TABLE nodes ADD COLUMN IF NOT EXISTS app text;
+ALTER TABLE objects ADD COLUMN IF NOT EXISTS schema_type text;
+ALTER TABLE revisions ADD COLUMN IF NOT EXISTS acting_app text;
+ALTER TABLE revisions ADD COLUMN IF NOT EXISTS acting_for text;
+CREATE INDEX IF NOT EXISTS objects_owner_live ON objects(owner) WHERE deleted_at IS NULL;
+
+UPDATE objects SET privacy = 'private' WHERE privacy = 'friends';
+ALTER TABLE objects DROP CONSTRAINT IF EXISTS objects_privacy_check,
+  ADD CONSTRAINT objects_privacy_check CHECK (privacy IN ('public','private'));
+
+CREATE OR REPLACE VIEW relation_source AS
+SELECT resource_type, resource_id, relation, subject_type, subject_id, subject_relation, written_by FROM relations
+UNION ALL
+SELECT 'crtr/object', id, 'parent', 'crtr/object', owner, '', 'owner' FROM objects
+ WHERE owner IS NOT NULL AND (deleted_at IS NULL OR type = 'node');
+
+DROP VIEW IF EXISTS node_rows;
+CREATE VIEW node_rows AS
+SELECT n.*,
+       o.name,
+       o.kind,
+       oi.external_id AS grantee,
+       CASE WHEN e.state = 'running' THEN e.pid ELSE NULL END AS pi_pid,
+       CASE WHEN e.state = 'running' THEN e.process_identity ELSE NULL END AS pi_pid_identity,
+       e.turn_open_at,
+       e.turn_closed_at,
+       s.session_id AS pi_session_id,
+       s.transcript_path AS pi_session_file,
+       f.fault_id,
+       f.link AS fault_link,
+       f.op AS fault_op,
+       f.kind AS fault_kind,
+       f.message AS fault_message,
+       f.since AS fault_since,
+       f.operation_id AS fault_operation_id,
+       f.anchor_entry_id AS fault_anchor_entry_id,
+       f.retry_disposition AS fault_retry_disposition,
+       f.retry_by AS fault_retry_by,
+       f.retry_attempt AS fault_retry_attempt,
+       f.retry_max AS fault_retry_max,
+       f.retry_next_at AS fault_retry_next_at,
+       f.provider_error_json AS fault_provider_error_json
+  FROM nodes n
+  JOIN objects o ON o.id = n.node_id
+  LEFT JOIN identities oi ON oi.object = COALESCE(n.app, o.owner)
+  LEFT JOIN executions e ON e.node_id = n.node_id AND e.state != 'exited'
+  LEFT JOIN sessions s ON s.node_id = n.node_id AND s.unbound_at IS NULL
+  LEFT JOIN node_faults f ON f.node_id = n.node_id AND f.active = 1;
+
+
+-- ---------------------------------------------------------------- executions: the fleet registry becomes a row
+
+ALTER TABLE executions
+  ADD COLUMN runner text NOT NULL DEFAULT 'process' CHECK (runner IN ('process', 'blaxel')),
+  ADD COLUMN sandbox_name text,
+  ADD COLUMN attempt bigint NOT NULL DEFAULT 1,
+  ADD COLUMN release text,
+  ADD COLUMN heartbeat_at text,
+  ADD COLUMN awake_since text,
+  ADD COLUMN launch_json text,
+  ADD COLUMN stop_requested_at text,
+  ADD COLUMN stop_after_turn bigint NOT NULL DEFAULT 0 CHECK (stop_after_turn IN (0, 1)),
+  ADD COLUMN stop_reason text,
+  ADD COLUMN charged_through text,
+  ADD COLUMN exited_at text,
+  ADD COLUMN idle_at text;
+
+-- ---------------------------------------------------------------- nodes: supervision state, prompts and claims as columns
+
+ALTER TABLE nodes
+  ADD COLUMN initial_prompt text,
+  ADD COLUMN yield_note text,
+  ADD COLUMN situational_card text,
+  ADD COLUMN tool_summaries_json text,
+  ADD COLUMN turn_replies_json text,
+  ADD COLUMN unattended_since text,
+  ADD COLUMN stall_noticed_at text,
+  ADD COLUMN wedge_noticed_at text,
+  ADD COLUMN park_requested_at text,
+  ADD COLUMN park_activity bigint NOT NULL DEFAULT 0 CHECK (park_activity IN (0, 1)),
+  ADD COLUMN idle_release_attempts bigint NOT NULL DEFAULT 0,
+  ADD COLUMN idle_release_last_attempt_at text,
+  ADD COLUMN idle_release_acked_count bigint NOT NULL DEFAULT 0,
+  ADD COLUMN recovery_held_until text,
+  ADD COLUMN recovery_held_by text,
+  ADD COLUMN stream_message_seq bigint,
+  ADD COLUMN stream_block text,
+  ADD COLUMN spend_refusal text;
+
+-- `situational_card` joins the column list so a live broker sees the change.
+DROP TRIGGER IF EXISTS crtr_sig_node_upd ON nodes;
+CREATE TRIGGER crtr_sig_node_upd AFTER UPDATE OF
+    description, title, icon, mode, lifecycle, status, cwd, parent, fork_from, profile_id,
+    review_binding_json, persona_ack_json, intent, situational_card
+  ON nodes FOR EACH ROW EXECUTE FUNCTION crtr_signal_node();
+
+-- `node_rows` is `SELECT n.*`: its columns are fixed when the view is created, so it is created again after the columns above.
+DROP VIEW IF EXISTS node_rows;
+CREATE VIEW node_rows AS
+SELECT n.*,
+       o.name,
+       o.kind,
+       oi.external_id AS grantee,
+       CASE WHEN e.state = 'running' THEN e.pid ELSE NULL END AS pi_pid,
+       CASE WHEN e.state = 'running' THEN e.process_identity ELSE NULL END AS pi_pid_identity,
+       e.turn_open_at,
+       e.turn_closed_at,
+       s.session_id AS pi_session_id,
+       s.transcript_path AS pi_session_file,
+       f.fault_id,
+       f.link AS fault_link,
+       f.op AS fault_op,
+       f.kind AS fault_kind,
+       f.message AS fault_message,
+       f.since AS fault_since,
+       f.operation_id AS fault_operation_id,
+       f.anchor_entry_id AS fault_anchor_entry_id,
+       f.retry_disposition AS fault_retry_disposition,
+       f.retry_by AS fault_retry_by,
+       f.retry_attempt AS fault_retry_attempt,
+       f.retry_max AS fault_retry_max,
+       f.retry_next_at AS fault_retry_next_at,
+       f.provider_error_json AS fault_provider_error_json
+  FROM nodes n
+  JOIN objects o ON o.id = n.node_id
+  LEFT JOIN identities oi ON oi.object = COALESCE(n.app, o.owner)
+  LEFT JOIN executions e ON e.node_id = n.node_id AND e.state != 'exited'
+  LEFT JOIN sessions s ON s.node_id = n.node_id AND s.unbound_at IS NULL
+  LEFT JOIN node_faults f ON f.node_id = n.node_id AND f.active = 1;
+
+-- ---------------------------------------------------------------- viewers
+
+CREATE TABLE viewer_attachments (
+  connection_id  text PRIMARY KEY,
+  node_id        text NOT NULL REFERENCES nodes(node_id) ON DELETE CASCADE,
+  api_process_id text NOT NULL,
+  attends        bigint NOT NULL CHECK (attends IN (0, 1)),
+  presented_at   text,
+  opened_at      text NOT NULL,
+  expires_at     text NOT NULL
+);
+CREATE INDEX idx_viewer_attachments_node ON viewer_attachments(node_id, expires_at);
+
+-- ---------------------------------------------------------------- small row-backed state
+
+ALTER TABLE node_faults ADD COLUMN nudged_at text;
+ALTER TABLE structured_requests
+  ADD COLUMN reprompt_count bigint NOT NULL DEFAULT 0,
+  ADD COLUMN reprompted_at bigint;
+
+CREATE TABLE reconciler_leases (
+  lane       text NOT NULL,
+  key        text NOT NULL,
+  owner      text NOT NULL,
+  expires_at text NOT NULL,
+  cursor     text,
+  PRIMARY KEY (lane, key)
+);
+
+-- Claims of the lanes that have none today (deadline, structured requests, review submit, fault retry, storage due work, bash jobs).
+ALTER TABLE nodes ADD COLUMN claimed_by text, ADD COLUMN lease_expires_at text;
+ALTER TABLE structured_requests ADD COLUMN claimed_by text, ADD COLUMN lease_expires_at text;
+ALTER TABLE human_requests ADD COLUMN claimed_by text, ADD COLUMN lease_expires_at text;
+ALTER TABLE node_faults ADD COLUMN claimed_by text, ADD COLUMN lease_expires_at text;
+ALTER TABLE uploads ADD COLUMN claimed_by text, ADD COLUMN lease_expires_at text;
+ALTER TABLE shares ADD COLUMN claimed_by text, ADD COLUMN lease_expires_at text;
+
+ALTER TABLE jobs
+  ADD COLUMN output_key text,
+  ADD COLUMN deadline_at text,
+  ADD COLUMN claimed_by text,
+  ADD COLUMN lease_expires_at text,
+  ALTER COLUMN job_dir DROP NOT NULL,
+  ALTER COLUMN log_path DROP NOT NULL;
+
+-- ---------------------------------------------------------------- environments (Blaxel sandboxes)
+
+ALTER TABLE environments DROP CONSTRAINT IF EXISTS environments_kind_check;
+-- `machine_id` becomes nullable for a Blaxel environment. "Required for a machine environment" is enforced by the code that writes the row: a new CHECK would narrow an existing table, which an adding delta may not do (003 can add it).
+ALTER TABLE environments ADD CONSTRAINT environments_kind_check CHECK (kind IN ('machine', 'blaxel'));
+ALTER TABLE environments
+  ALTER COLUMN machine_id DROP NOT NULL,
+  ADD COLUMN memory_mb bigint NOT NULL DEFAULT 2048,
+  ADD COLUMN recipe_revision bigint NOT NULL DEFAULT 0,
+  ADD COLUMN setup_script text,
+  ADD COLUMN pi_packages text,
+  ADD COLUMN image_revision bigint,
+  ADD COLUMN image_ref text,
+  ADD COLUMN image_error text,
+  ADD COLUMN image_building_at text;
+
+-- A change of `image_revision` is the wake for nodes waiting on their environment's first image (design: `crtr_signal` kind `environment_image`).
+CREATE FUNCTION crtr_signal_environment_image() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  PERFORM pg_notify('crtr_signal', 'environment_image:' || NEW.object);
+  RETURN NULL;
+END $$;
+CREATE TRIGGER crtr_sig_environment_image AFTER UPDATE OF image_revision ON environments
+  FOR EACH ROW WHEN (OLD.image_revision IS DISTINCT FROM NEW.image_revision) EXECUTE FUNCTION crtr_signal_environment_image();
+
+CREATE TABLE environment_repos (
+  environment       text NOT NULL REFERENCES environments(object) ON DELETE CASCADE,
+  position          bigint NOT NULL,
+  name              text NOT NULL,
+  github_full_name  text NOT NULL,
+  default_branch    text NOT NULL,
+  PRIMARY KEY (environment, position),
+  UNIQUE (environment, name)
+);
+
+-- ---------------------------------------------------------------- conversations
+
+CREATE TABLE conversation_entries (
+  conversation_id text NOT NULL,
+  entry_id        text NOT NULL,
+  seq             bigint GENERATED BY DEFAULT AS IDENTITY UNIQUE,
+  body            text NOT NULL,
+  bytes           bigint NOT NULL,
+  execution_id    text,
+  created         text NOT NULL,
+  PRIMARY KEY (conversation_id, entry_id)
+);
+CREATE INDEX idx_conversation_entries_order ON conversation_entries(conversation_id, seq);
+
+CREATE TABLE conversation_parts (
+  conversation_id text NOT NULL,
+  seq             bigint NOT NULL,
+  blob_key        text NOT NULL,
+  bytes           bigint NOT NULL,
+  entries         bigint NOT NULL,
+  created         text NOT NULL,
+  PRIMARY KEY (conversation_id, seq)
+);
+
+-- ---------------------------------------------------------------- money ledger
+
+ALTER TABLE charges
+  ADD COLUMN account text,
+  ADD COLUMN billed_usd numeric(14,6),
+  ADD COLUMN price_id text,
+  ADD COLUMN priced_at text,
+  ADD COLUMN invoice_id text;
+CREATE INDEX charges_account_invoice ON charges(account, invoice_id, month);
+
+ALTER TABLE charge_totals ADD COLUMN billed_usd numeric(16,6) NOT NULL DEFAULT 0;
+
+-- Keeps `charge_totals.billed_usd`. It leaves `usd` to the application on INSERT (every build up to this one adds it with
+-- `addToTotals`, and a build rolled back to must not count it twice); an UPDATE of a row's amounts or key moves both
+-- amounts, which no earlier build does. Refused rows and `take` rows are never rolled up, as in `rebuildTotals`.
+CREATE FUNCTION charge_totals_rollup() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  IF TG_OP = 'UPDATE' AND OLD.refused IS NULL AND OLD.kind <> 'take' THEN
+    INSERT INTO charge_totals (month, payer, funding, sub, grantee, provider, usd, billed_usd)
+      VALUES (OLD.month, OLD.payer, OLD.funding, COALESCE(OLD.sub, ''), OLD.grantee, COALESCE(OLD.provider, ''),
+              -COALESCE(OLD.usd, 0), -COALESCE(OLD.billed_usd, 0))
+      ON CONFLICT (month, payer, funding, sub, grantee, provider) DO UPDATE
+        SET usd = charge_totals.usd + EXCLUDED.usd, billed_usd = charge_totals.billed_usd + EXCLUDED.billed_usd;
+  END IF;
+  IF NEW.refused IS NULL AND NEW.kind <> 'take' AND (TG_OP = 'UPDATE' OR COALESCE(NEW.billed_usd, 0) <> 0) THEN
+    INSERT INTO charge_totals (month, payer, funding, sub, grantee, provider, usd, billed_usd)
+      VALUES (NEW.month, NEW.payer, NEW.funding, COALESCE(NEW.sub, ''), NEW.grantee, COALESCE(NEW.provider, ''),
+              CASE WHEN TG_OP = 'UPDATE' THEN COALESCE(NEW.usd, 0) ELSE 0 END, COALESCE(NEW.billed_usd, 0))
+      ON CONFLICT (month, payer, funding, sub, grantee, provider) DO UPDATE
+        SET usd = charge_totals.usd + EXCLUDED.usd, billed_usd = charge_totals.billed_usd + EXCLUDED.billed_usd;
+  END IF;
+  RETURN NULL;
+END $$;
+CREATE TRIGGER charges_rollup_insert AFTER INSERT ON charges
+  FOR EACH ROW EXECUTE FUNCTION charge_totals_rollup();
+CREATE TRIGGER charges_rollup_update AFTER UPDATE ON charges
+  FOR EACH ROW WHEN (OLD.usd IS DISTINCT FROM NEW.usd OR OLD.billed_usd IS DISTINCT FROM NEW.billed_usd
+                  OR OLD.month IS DISTINCT FROM NEW.month OR OLD.payer IS DISTINCT FROM NEW.payer
+                  OR OLD.funding IS DISTINCT FROM NEW.funding OR OLD.sub IS DISTINCT FROM NEW.sub
+                  OR OLD.grantee IS DISTINCT FROM NEW.grantee OR OLD.provider IS DISTINCT FROM NEW.provider
+                  OR OLD.refused IS DISTINCT FROM NEW.refused OR OLD.kind IS DISTINCT FROM NEW.kind)
+  EXECUTE FUNCTION charge_totals_rollup();
+
+ALTER TABLE limits ADD COLUMN account text, ALTER COLUMN payer DROP NOT NULL;
+ALTER TABLE limits DROP CONSTRAINT IF EXISTS limits_source_check;
+ALTER TABLE limits ADD CONSTRAINT limits_source_check CHECK (source IN ('grant_sync', 'person', 'operator', 'billing'));
+
+CREATE FUNCTION crtr_signal_limits() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    PERFORM pg_notify('crtr_signal', 'spend_limits:' || OLD.id);
+    RETURN OLD;
+  END IF;
+  PERFORM pg_notify('crtr_signal', 'spend_limits:' || NEW.id);
+  RETURN NEW;
+END $$;
+CREATE TRIGGER crtr_sig_limits AFTER INSERT OR UPDATE OR DELETE ON limits
+  FOR EACH ROW EXECUTE FUNCTION crtr_signal_limits();
+
+CREATE TABLE charge_chunks (
+  month      text NOT NULL,
+  payer      text NOT NULL,
+  blob_key   text NOT NULL,
+  "rows"     bigint NOT NULL,
+  usd        numeric(16,6),
+  billed_usd numeric(16,6),
+  first_at   text NOT NULL,
+  last_at    text NOT NULL,
+  PRIMARY KEY (month, payer)
+);
+
+-- ---------------------------------------------------------------- grants: the one copy, written by the directory too
+
+ALTER TABLE grants
+  ADD COLUMN created_at text,
+  ADD COLUMN computed_rev bigint,
+  ADD COLUMN app_pays_until_vendor bigint NOT NULL DEFAULT 0 CHECK (app_pays_until_vendor IN (0, 1)),
+  ADD COLUMN removal_done_at text,
+  ALTER COLUMN scopes_json DROP NOT NULL,
+  ALTER COLUMN resolved_scopes_json DROP NOT NULL,
+  ALTER COLUMN dependencies_json DROP NOT NULL,
+  ALTER COLUMN synced_at DROP NOT NULL;
+-- The old unique index (grantee, sub) stays until 003 drops it: a removal.
+CREATE UNIQUE INDEX idx_grants_runtime_sub_grantee ON grants(runtime, sub, grantee);
+
+CREATE FUNCTION crtr_signal_grant() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    PERFORM pg_notify('crtr_signal', 'grant:' || OLD.id);
+    RETURN OLD;
+  END IF;
+  PERFORM pg_notify('crtr_signal', 'grant:' || NEW.id);
+  RETURN NEW;
+END $$;
+CREATE TRIGGER crtr_sig_grant_ins_del AFTER INSERT OR DELETE ON grants
+  FOR EACH ROW EXECUTE FUNCTION crtr_signal_grant();
+CREATE TRIGGER crtr_sig_grant_upd AFTER UPDATE OF
+    id, runtime, sub, grantee, rev, scopes_json, resolved_scopes_json, spend_cap, expires_at, status, revoked_at,
+    approved_at, payer, synced_at, dependencies_json, run_notice_url, inference_endpoint_json, created_at,
+    computed_rev, app_pays_until_vendor
+  ON grants FOR EACH ROW EXECUTE FUNCTION crtr_signal_grant();
+
+-- The `grant:<id>` limit row of cycle 4's rule (`grantLimit` in grants/mirror.ts): an active grant with a cap, not paid by the
+-- app, and not `app:terminal`'s, becomes {payer = sub, grantee, any funding, usd_per_month = spend_cap}; any other grant has none.
+-- A negative cap fails the limits CHECK and aborts the grant write, as replaceGrantLimits' RangeError did.
+CREATE FUNCTION crtr_grant_limit() RETURNS trigger LANGUAGE plpgsql AS $$
+BEGIN
+  IF TG_OP = 'DELETE' THEN
+    DELETE FROM limits WHERE source = 'grant_sync' AND id = 'grant:' || OLD.id;
+    RETURN OLD;
+  END IF;
+  IF NEW.status = 'active' AND NEW.spend_cap IS NOT NULL
+     AND NEW.payer IS DISTINCT FROM 'app' AND NEW.grantee <> 'app:terminal' THEN
+    INSERT INTO limits (id, payer, grantee, usd_per_month, source, updated_at)
+      VALUES ('grant:' || NEW.id, NEW.sub, NEW.grantee, NEW.spend_cap::numeric, 'grant_sync',
+              to_char(now() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'))
+      ON CONFLICT (id) DO UPDATE SET payer = EXCLUDED.payer, funding = NULL, grantee = EXCLUDED.grantee, provider = NULL, sub = NULL,
+        account = NULL, usd_per_month = EXCLUDED.usd_per_month, source = 'grant_sync', updated_at = EXCLUDED.updated_at
+        WHERE limits.source = 'grant_sync';
+  ELSE
+    DELETE FROM limits WHERE source = 'grant_sync' AND id = 'grant:' || NEW.id;
+  END IF;
+  RETURN NULL;
+END $$;
+CREATE TRIGGER crtr_grant_limit AFTER INSERT OR UPDATE OR DELETE ON grants
+  FOR EACH ROW EXECUTE FUNCTION crtr_grant_limit();
+
+-- ---------------------------------------------------------------- person stores: profiles, scope settings, model credentials, env vars
+
+CREATE TABLE profiles (
+  id                   text PRIMARY KEY,
+  person               text NOT NULL,
+  name                 text NOT NULL,
+  created_at           text NOT NULL,
+  last_used_at         text,
+  paused_at            text,
+  default_kind         text,
+  grantee              text,
+  metadata_json        text NOT NULL DEFAULT '{}',
+  delivery_limits_json text NOT NULL DEFAULT '{}',
+  environment_id       text,
+  deleting_since       text,
+  UNIQUE (person, name)
+);
+
+CREATE TABLE profile_projects (
+  profile_id text NOT NULL REFERENCES profiles(id) ON DELETE CASCADE,
+  path       text NOT NULL,
+  position   bigint NOT NULL,
+  PRIMARY KEY (profile_id, path),
+  UNIQUE (profile_id, position)
+);
+
+CREATE TABLE profile_defaults (
+  person     text NOT NULL,
+  directory  text NOT NULL,
+  profile_id text NOT NULL REFERENCES profiles(id) ON DELETE CASCADE,
+  PRIMARY KEY (person, directory)
+);
+
+-- `owner_key` is `user` or `profile:<profile id>`, as in the scoped SQLite store; project scopes stay local files.
+CREATE TABLE scope_settings (
+  person    text NOT NULL,
+  owner_key text NOT NULL,
+  raw_json  text NOT NULL,
+  PRIMARY KEY (person, owner_key)
+);
+
+CREATE TABLE scope_bookkeeping (
+  person          text NOT NULL,
+  owner_key       text NOT NULL,
+  last_self_check text,
+  active_canvas   text,
+  PRIMARY KEY (person, owner_key)
+);
+
+CREATE TABLE scope_marketplaces (
+  person       text NOT NULL,
+  owner_key    text NOT NULL,
+  name         text NOT NULL,
+  last_updated text,
+  url          text,
+  ref          text,
+  installed_at text,
+  PRIMARY KEY (person, owner_key, name)
+);
+
+CREATE TABLE scope_plugins (
+  person             text NOT NULL,
+  owner_key          text NOT NULL,
+  name               text NOT NULL,
+  last_updated       text,
+  etag               text,
+  checked_at         text,
+  enabled            bigint NOT NULL DEFAULT 1 CHECK (enabled IN (0, 1)),
+  source_marketplace text,
+  version            text,
+  source_path        text,
+  PRIMARY KEY (person, owner_key, name)
+);
+
+CREATE TABLE person_settings (
+  person           text PRIMARY KEY,
+  plugins_revision bigint NOT NULL DEFAULT 0
+);
+
+CREATE TABLE model_accounts (
+  person              text NOT NULL,
+  provider_id         text NOT NULL,
+  id                  text NOT NULL,
+  label               text NOT NULL,
+  label_key           text NOT NULL,
+  position            bigint NOT NULL,
+  last_attempt_at     bigint NOT NULL DEFAULT 0,
+  last_rate_limited_at bigint NOT NULL DEFAULT 0,
+  rate_limited_until  bigint NOT NULL DEFAULT 0,
+  auth_failure        text CHECK (auth_failure IS NULL OR auth_failure = 'invalid_grant'),
+  refresh_sealed      bytea,
+  access_sealed       bytea,
+  expires             bigint,
+  vendor_account_id   text,
+  client_id           text,
+  key_id              text,
+  PRIMARY KEY (person, provider_id, id),
+  UNIQUE (person, provider_id, label_key)
+);
+CREATE INDEX model_accounts_order ON model_accounts(person, provider_id, position);
+
+CREATE TABLE model_account_cooldowns (
+  person              text NOT NULL,
+  provider_id         text NOT NULL,
+  account_id          text NOT NULL,
+  family              text NOT NULL,
+  rate_limited_until  bigint NOT NULL,
+  last_rate_limited_at bigint NOT NULL,
+  PRIMARY KEY (person, provider_id, account_id, family)
+);
+
+CREATE TABLE model_api_keys (
+  person          text NOT NULL,
+  provider_id     text NOT NULL,
+  credential_sealed bytea NOT NULL,
+  key_id          text NOT NULL,
+  updated_at      text NOT NULL,
+  PRIMARY KEY (person, provider_id)
+);
+
+CREATE TABLE model_settings (
+  person                   text PRIMARY KEY,
+  default_fallback_strength text,
+  revert_when_available    bigint CHECK (revert_when_available IS NULL OR revert_when_available IN (0, 1)),
+  revision                 bigint NOT NULL DEFAULT 0,
+  openai_device_id         text
+);
+
+CREATE TABLE model_sign_in_flows (
+  flow_id         text PRIMARY KEY,
+  provider        text NOT NULL,
+  person          text NOT NULL,
+  verifier_sealed bytea NOT NULL,
+  key_id          text NOT NULL,
+  expires_at      text NOT NULL
+);
+
+CREATE TABLE env_vars (
+  person       text,
+  owner_kind   text NOT NULL CHECK (owner_kind IN ('profile', 'app', 'deployment')),
+  owner_id     text NOT NULL,
+  name         text NOT NULL,
+  value_sealed bytea NOT NULL,
+  key_id       text NOT NULL,
+  updated_at   text NOT NULL,
+  CHECK ((owner_kind = 'deployment') = (person IS NULL))
+);
+-- A deployment row has no person; NULLs are distinct in a plain UNIQUE, so the person is folded into the key.
+CREATE UNIQUE INDEX env_vars_key ON env_vars(COALESCE(person, ''), owner_kind, owner_id, name);
+
+-- ---------------------------------------------------------------- reader floor
+
+-- The previous build must still open this database: every step above only adds (D73).
+INSERT INTO canvas_meta (key, value) VALUES ('schema_min_reader', '1') ON CONFLICT (key) DO NOTHING;

package/dist/core/canvas/schema-pg.sql

@@ -3,8 +3,8 @@
 -- identity columns for insertion order, jsonb where JSON functions run, bytea blobs, PL/pgSQL
 -- triggers, and pg_notify triggers for the broker-signal bus.
 --
--- Applied once, in one transaction, by db.ts when canvas_meta has no `schema_version` row. Every
--- later change is a numbered delta file, never an edit of this file's tables once released.
+-- Frozen: this file is schema version 1. schema-chain.ts applies it once, in one transaction, when canvas_meta has no
+-- `schema_version` row, then each numbered delta in schema-pg/. Every later change is a delta, never an edit of this file.
 -- Types: SQLite INTEGER (64-bit) is bigint everywhere, including 0/1 flags and epoch-ms columns.
 
 -- ---------------------------------------------------------------- objects and their satellites
@@ -73,16 +73,14 @@ CREATE TABLE jobs (
   log_path  text NOT NULL
 );
 
--- The environments an object can run in (design: Environment module). Added after schema version 1 shipped, so
--- `ensureSchema` also runs this block alone against a database that predates it; version 1 stays.
--- environments:begin
+-- The environments an object can run in (design: Environment module). Added after schema version 1 shipped; delta
+-- 002 opens with this block's text so a version-1 database that predates it gains it.
 CREATE TABLE IF NOT EXISTS environments (
   object       text PRIMARY KEY REFERENCES objects(id) ON DELETE CASCADE,
   kind         text NOT NULL CHECK (kind IN ('machine')),
   machine_id   text NOT NULL UNIQUE,
   last_seen_at text NOT NULL
 );
--- environments:end
 
 CREATE TABLE identities (
   object      text PRIMARY KEY REFERENCES objects(id) ON DELETE CASCADE,
@@ -942,11 +940,10 @@ CREATE TABLE peer_ingested_destinations (
 -- ---------------------------------------------------------------- money ledger (cycle 4)
 
 -- One `charges` row per charge, each naming its cause (`caused_by`); one `charge_totals` rollup upserted in the same
--- transaction as each charge; one `limits` row shape. Added after schema version 1 shipped: `ensureSchema` runs this block
--- alone against an older database (idempotent, additive; the version stays 1). It sits BEFORE the permissions block on
+-- transaction as each charge; one `limits` row shape. Added after schema version 1 shipped; delta 002 opens with
+-- this block's text (idempotent, additive). It sits BEFORE the permissions block on
 -- purpose: that block drops and recreates `node_rows` (`SELECT n.*`), which only carries `nodes.caused_by` when the column
 -- exists first. The whole block is one multi-statement query, so it applies entirely or not at all.
--- ledger:begin
 CREATE TABLE IF NOT EXISTS charges (
   id         text PRIMARY KEY,
   request    text,
@@ -998,15 +995,13 @@ CREATE TABLE IF NOT EXISTS limits (
 CREATE INDEX IF NOT EXISTS limits_payer ON limits(payer);
 
 ALTER TABLE nodes ADD COLUMN IF NOT EXISTS caused_by text;
--- ledger:end
 
 -- ---------------------------------------------------------------- permissions (cycle 3)
 
 -- One permission model: relation facts, app schemas, the columns the evaluator and owner tree need, the narrowed privacy
 -- levels, `relation_source` (facts plus each live object's, and each reaped node's, owner presented as its `parent`) and `node_rows` with `grantee` read
--- from `nodes.app`. Added after schema version 1 shipped: `ensureSchema` runs this block alone against an older database
--- (idempotent; the version stays 1). The whole block is one multi-statement query, so it applies entirely or not at all.
--- permissions:begin
+-- from `nodes.app`. Added after schema version 1 shipped; delta 002 opens with this block's text
+-- (idempotent). The whole block is one multi-statement query, so it applies entirely or not at all.
 CREATE TABLE IF NOT EXISTS relations (
   resource_type    text NOT NULL,
   resource_id      text NOT NULL,
@@ -1078,7 +1073,6 @@ SELECT n.*,
   LEFT JOIN executions e ON e.node_id = n.node_id AND e.state != 'exited'
   LEFT JOIN sessions s ON s.node_id = n.node_id AND s.unbound_at IS NULL
   LEFT JOIN node_faults f ON f.node_id = n.node_id AND f.active = 1;
--- permissions:end
 
 -- ---------------------------------------------------------------- triggers
 

package/dist/core/canvas/schema-version.d.ts

@@ -1,7 +1,7 @@
 /** The canvas schema version this build supports: the number of the highest delta in `schema-pg/` (the baseline
  *  `schema-pg.sql` is version 1). `scripts/install-runtime.mjs` reads this module from a candidate generation to refuse
  *  one below the live database's `schema_min_reader`. */
-export declare const CANVAS_SCHEMA_VERSION = 1;
+export declare const CANVAS_SCHEMA_VERSION = 2;
 /** The Postgres schema holding the canvas tables: `CRTR_DATABASE_SCHEMA` (`crtr` in the cloud deploy). Unset or empty
  *  means the role's own search_path (`public` on a Mac and on a VM). A name that is not a plain identifier is an error:
  *  it is put in a `search_path` connection option. */

package/dist/core/canvas/schema-version.js

@@ -1 +1 @@
-var m=Object.defineProperty;var r=(n,e)=>m(n,"name",{value:e,configurable:!0});const A=1;function _(n=process.env){const e=n.CRTR_DATABASE_SCHEMA?.trim();if(e){if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(e))throw new Error(`CRTR_DATABASE_SCHEMA must be a plain identifier (letters, digits, underscore); got ${JSON.stringify(e)}`);return e}}r(_,"canvasDatabaseSchema");function h(n=process.env){return n.CRTR_SCHEMA_DATABASE_URL?.trim()||void 0}r(h,"canvasSchemaDatabaseUrl");function E(n=process.env){const e=_(n);return e===void 0?void 0:`-c search_path=${e}`}r(E,"canvasSearchPathOptions");async function v(n,e){const t=e===void 0?"canvas_meta":`"${e.replace(/"/g,'""')}".canvas_meta`;if((await n.query(`SELECT to_regclass('${t.replace(/'/g,"''")}') IS NOT NULL AS found`)).rows[0].found!==!0)return;const u=(await n.query(`SELECT key, value FROM ${t} WHERE key IN ('schema_version', 'schema_min_reader')`)).rows,o=r(c=>{const i=u.find(f=>f.key===c);if(i===void 0)return;const d=Number(i.value);if(!Number.isSafeInteger(d))throw new Error(`canvas_meta.${c} is not an integer: ${String(i.value)}`);return d},"value"),s=o("schema_version");return s===void 0?void 0:{version:s,minReader:o("schema_min_reader")??s}}r(v,"readStoredVersions");async function l(n,e,t){const a=await v(n,t);if(a!==void 0&&a.minReader>e)throw new Error(`refusing to select runtime with canvas schema ${e}: the live database requires readers at version ${a.minReader} or above (it is at ${a.version}); install a descendant build instead`)}r(l,"assertCandidateMayOpen");export{A as CANVAS_SCHEMA_VERSION,l as assertCandidateMayOpen,_ as canvasDatabaseSchema,h as canvasSchemaDatabaseUrl,E as canvasSearchPathOptions,v as readStoredVersions};
+var m=Object.defineProperty;var r=(n,e)=>m(n,"name",{value:e,configurable:!0});const A=2;function _(n=process.env){const e=n.CRTR_DATABASE_SCHEMA?.trim();if(e){if(!/^[A-Za-z_][A-Za-z0-9_]*$/.test(e))throw new Error(`CRTR_DATABASE_SCHEMA must be a plain identifier (letters, digits, underscore); got ${JSON.stringify(e)}`);return e}}r(_,"canvasDatabaseSchema");function h(n=process.env){return n.CRTR_SCHEMA_DATABASE_URL?.trim()||void 0}r(h,"canvasSchemaDatabaseUrl");function E(n=process.env){const e=_(n);return e===void 0?void 0:`-c search_path=${e}`}r(E,"canvasSearchPathOptions");async function v(n,e){const t=e===void 0?"canvas_meta":`"${e.replace(/"/g,'""')}".canvas_meta`;if((await n.query(`SELECT to_regclass('${t.replace(/'/g,"''")}') IS NOT NULL AS found`)).rows[0].found!==!0)return;const u=(await n.query(`SELECT key, value FROM ${t} WHERE key IN ('schema_version', 'schema_min_reader')`)).rows,o=r(c=>{const i=u.find(f=>f.key===c);if(i===void 0)return;const d=Number(i.value);if(!Number.isSafeInteger(d))throw new Error(`canvas_meta.${c} is not an integer: ${String(i.value)}`);return d},"value"),s=o("schema_version");return s===void 0?void 0:{version:s,minReader:o("schema_min_reader")??s}}r(v,"readStoredVersions");async function l(n,e,t){const a=await v(n,t);if(a!==void 0&&a.minReader>e)throw new Error(`refusing to select runtime with canvas schema ${e}: the live database requires readers at version ${a.minReader} or above (it is at ${a.version}); install a descendant build instead`)}r(l,"assertCandidateMayOpen");export{A as CANVAS_SCHEMA_VERSION,l as assertCandidateMayOpen,_ as canvasDatabaseSchema,h as canvasSchemaDatabaseUrl,E as canvasSearchPathOptions,v as readStoredVersions};

package/dist/core/grants/mirror.d.ts

@@ -108,8 +108,8 @@ export interface TeamRecord {
 }
 /** The `teams` a grant sync answer carried; absent (an unjoined install, an older directory) reads as none. */
 export declare function teamsOf(value: unknown): TeamRecord[];
-/** Replace the mirror with `grants`, the ledger's `grant:<id>` limit rows from their caps, and the `written_by = 'directory'` team
- *  `member` facts with `teams`, in one transaction. */
+/** Replace the mirror with `grants` and the `written_by = 'directory'` team `member` facts with `teams`, in one transaction. The
+ *  ledger's `grant:<id>` limit rows follow from the `grants` trigger `crtr_grant_limit` (schema delta 002). */
 export declare function replaceGrants(grants: readonly GrantRecord[], syncedAt: string, source: string, teams?: readonly TeamRecord[]): Promise<void>;
 /** Bumped by every `replaceGrants`. A launch compiled against one generation
  *  and started under another may hold mounts the new mirror no longer grants. */

package/dist/core/grants/mirror.js

@@ -1,4 +1,4 @@
-var m=Object.defineProperty;var t=(e,r)=>m(e,"name",{value:r,configurable:!0});import{createHash as S}from"node:crypto";import{parseScope as T}from"@north-light/identity";import{openDb as p,withCanvasWrite as w}from"../canvas/db.js";import{isUnsandboxedMachine as O}from"../runtime/unsandboxed.js";import{replaceWrittenBy as v,userSubject as R}from"../permissions/facts.js";import{GROUP_TYPE as x}from"../permissions/builtin.js";import{replaceGrantLimits as A}from"../ledger/index.js";const N=["not_started","pending","ready","failed","unavailable"],h=["ultra","strong","medium","light"];function u(e){if(!Array.isArray(e))throw new TypeError("grant scopes must be a list");return e.map(r=>{if(!r||typeof r!="object"||typeof r.scope!="string"||!["always","ask"].includes(r.mode))throw new TypeError("invalid grant scope entry");return{scope:r.scope,mode:r.mode}})}t(u,"entries");function L(e){if(!e||typeof e!="object"||Array.isArray(e))return null;const{state:r,message:n,next:i,step:o}=e;return typeof r!="string"||!N.includes(r)||n!==void 0&&typeof n!="string"||o!==void 0&&typeof o!="string"||typeof i!="string"||!i?null:{state:r,...n===void 0?{}:{message:n},next:i,...o===void 0?{}:{step:o}}}t(L,"dependencyOf");function E(e){if(!e||typeof e!="object"||Array.isArray(e))return{};const r={};for(const[n,i]of Object.entries(e)){const o=L(i);o&&(r[n]=o)}return r}t(E,"dependenciesOf");function b(e){if(!e||typeof e!="object"||Array.isArray(e))return null;const{base_url:r,rungs:n}=e;if(typeof r!="string"||!r||!n||typeof n!="object"||Array.isArray(n))return null;const i={};for(const o of h){const s=n[o];typeof s=="string"&&s&&(i[o]=s)}return Object.keys(i).length?{base_url:r.replace(/\/+$/,""),rungs:i}:null}t(b,"inferenceEndpointOf");function l(e){return{id:e.id,runtime:e.runtime,sub:e.sub,grantee:e.grantee,rev:e.rev,scopes:u(JSON.parse(e.scopes_json)),resolved_scopes:u(JSON.parse(e.resolved_scopes_json)),spend_cap:e.spend_cap,expires_at:e.expires_at,status:e.status,revoked_at:e.revoked_at,approved_at:e.approved_at,payer:e.payer,dependencies:E(JSON.parse(e.dependencies_json)),run_notice_url:e.run_notice_url??null,inference_endpoint:e.inference_endpoint_json?b(JSON.parse(e.inference_endpoint_json)):null,synced_at:e.synced_at}}t(l,"record");function f(e){if(!e||e.status!=="active")return null;try{return j(l(e))}catch(r){if(r instanceof TypeError||r instanceof SyntaxError)return null;throw r}}t(f,"active");function d(e){return e.grantee!=="app:terminal"&&O()}t(d,"mirrorOnly");async function P(){return(await F()).filter(e=>!d(e))}t(P,"localGrants");async function F(){return(await(await p()).prepare("SELECT * FROM grants").all()).flatMap(e=>{try{return[l(e)]}catch(r){if(r instanceof TypeError||r instanceof SyntaxError)return[];throw r}})}t(F,"allGrants");function M(e){return e.expires_at!==null&&!(Date.parse(e.expires_at)>Date.now())}t(M,"grantExpired");function j(e){if(e.status!=="active"||M(e))return null;try{const r=e.resolved_scopes.map(({scope:n})=>T(n));return{...e,resolved:e.resolved_scopes.flatMap(({mode:n},i)=>n==="always"?[r[i]]:[])}}catch(r){if(r instanceof TypeError||r instanceof SyntaxError)return null;throw r}}t(j,"activeRecord");function y(e){return Array.isArray(e)?`[${e.map(y).join(",")}]`:e&&typeof e=="object"?`{${Object.keys(e).sort().filter(r=>e[r]!==void 0).map(r=>`${JSON.stringify(r)}:${y(e[r])}`).join(",")}}`:JSON.stringify(e)??"null"}t(y,"canonicalJson");function V(e){const r={rev:e.rev,resolved_scopes:e.resolved_scopes,spend_cap:e.spend_cap,payer:e.payer,dependencies:e.dependencies??{},...e.inference_endpoint?{inference_endpoint:e.inference_endpoint}:{}};return S("sha256").update(y(r)).digest("base64url").slice(0,22)}t(V,"grantVersion");async function B(e){return!!await(await p()).prepare("SELECT 1 FROM grants WHERE id = ?").get(e)}t(B,"hasGrant");async function X(e){return await(await p()).prepare("SELECT rev, status FROM grants WHERE id = ?").get(e)??null}t(X,"grantSyncState");async function Y(e,r){return await(await p()).prepare("SELECT rev, status FROM grants WHERE grantee = ? AND sub = ?").get(e,r)??null}t(Y,"grantSyncStateFor");async function C(e){const r=await(await p()).prepare("SELECT * FROM grants WHERE id = ?").get(e);if(!r)return null;try{return l(r)}catch(n){if(n instanceof TypeError||n instanceof SyntaxError)return null;throw n}}t(C,"grantRecord");async function q(e){return(e?(await C(e))?.payer:null)??"user"}t(q,"payerOfGrant");async function z(e){return f(await(await p()).prepare("SELECT * FROM grants WHERE id = ?").get(e))}t(z,"activeGrant");async function K(e,r){return f(await(await p()).prepare("SELECT * FROM grants WHERE grantee = ? AND sub = ?").get(e,r))}t(K,"grantFor");async function Q(e){if(d({grantee:e}))return null;const r=await(await p()).prepare("SELECT * FROM grants WHERE grantee = ? AND status = 'active'").all(e);if(r.length>1)throw new Error(`multiple active grants for ${e}`);return f(r[0])}t(Q,"activeGrantForApp");async function Z(e){const r=await(await p()).prepare("SELECT run_notice_url AS url, sub, grantee FROM grants WHERE id = ? AND status = 'active'").get(e);return r&&r.url&&!d(r)?{url:r.url,sub:r.sub,grantee:r.grantee}:null}t(Z,"runNoticeTarget");async function ee(){const e=await(await p()).prepare("SELECT * FROM grants WHERE grantee = 'app:terminal' AND status = 'active'").all();if(e.length>1)throw new Error("multiple active terminal grants");return f(e[0])}t(ee,"terminalGrant");async function re(){return(await(await p()).prepare("SELECT value FROM runtime_state WHERE key = 'grants_source'").get())?.value??null}t(re,"grantsSource");async function te(e){return(await(await p()).prepare("SELECT value FROM runtime_state WHERE key = 'grants_source'").get())?.value===e}t(te,"hasSyncedGrants");async function ne(e){return(await e.prepare("SELECT value FROM runtime_state WHERE key = 'grants_source'").get())?.value!=="local"?0:(await e.prepare("DELETE FROM runtime_state WHERE key = 'grants_source'").run(),Number((await e.prepare("DELETE FROM grants").run()).changes))}t(ne,"dropLocalGrantMirror");function ae(e){if(e===void 0)return[];if(!Array.isArray(e))throw new TypeError("invalid grant sync response");return e.map(r=>{const{team:n,members:i}=r??{};if(typeof n!="string"||!/^team:\S+$/.test(n)||!Array.isArray(i)||i.some(o=>typeof o!="string"||!/^user:[^\s*]+$/.test(o)))throw new TypeError("invalid grant sync response");return{team:n,members:i}})}t(ae,"teamsOf");function k(e){return e.status!=="active"||e.spend_cap===null||e.payer==="app"||e.grantee==="app:terminal"?null:{payer:e.sub,grantee:e.grantee,usd_per_month:e.spend_cap}}t(k,"grantLimit");async function se(e,r,n,i=[]){const o=new Set;for(const s of e){if(o.has(s.id)||!s.id||!s.runtime||!s.sub||!s.grantee||!Number.isInteger(s.rev)||!["active","revoked","removed"].includes(s.status))throw new TypeError("invalid grant sync response");o.add(s.id),u(s.scopes),u(s.resolved_scopes)}await w(async s=>{await s.exec("DELETE FROM grants");const _=s.prepare(`INSERT INTO grants
+var m=Object.defineProperty;var t=(e,r)=>m(e,"name",{value:r,configurable:!0});import{createHash as S}from"node:crypto";import{parseScope as T}from"@north-light/identity";import{openDb as c,withCanvasWrite as O}from"../canvas/db.js";import{isUnsandboxedMachine as v}from"../runtime/unsandboxed.js";import{replaceWrittenBy as w,userSubject as x}from"../permissions/facts.js";import{GROUP_TYPE as R}from"../permissions/builtin.js";const A=["not_started","pending","ready","failed","unavailable"],N=["ultra","strong","medium","light"];function p(e){if(!Array.isArray(e))throw new TypeError("grant scopes must be a list");return e.map(r=>{if(!r||typeof r!="object"||typeof r.scope!="string"||!["always","ask"].includes(r.mode))throw new TypeError("invalid grant scope entry");return{scope:r.scope,mode:r.mode}})}t(p,"entries");function h(e){if(!e||typeof e!="object"||Array.isArray(e))return null;const{state:r,message:n,next:i,step:o}=e;return typeof r!="string"||!A.includes(r)||n!==void 0&&typeof n!="string"||o!==void 0&&typeof o!="string"||typeof i!="string"||!i?null:{state:r,...n===void 0?{}:{message:n},next:i,...o===void 0?{}:{step:o}}}t(h,"dependencyOf");function y(e){if(!e||typeof e!="object"||Array.isArray(e))return{};const r={};for(const[n,i]of Object.entries(e)){const o=h(i);o&&(r[n]=o)}return r}t(y,"dependenciesOf");function b(e){if(!e||typeof e!="object"||Array.isArray(e))return null;const{base_url:r,rungs:n}=e;if(typeof r!="string"||!r||!n||typeof n!="object"||Array.isArray(n))return null;const i={};for(const o of N){const a=n[o];typeof a=="string"&&a&&(i[o]=a)}return Object.keys(i).length?{base_url:r.replace(/\/+$/,""),rungs:i}:null}t(b,"inferenceEndpointOf");function f(e){return{id:e.id,runtime:e.runtime,sub:e.sub,grantee:e.grantee,rev:e.rev,scopes:p(JSON.parse(e.scopes_json)),resolved_scopes:p(JSON.parse(e.resolved_scopes_json)),spend_cap:e.spend_cap,expires_at:e.expires_at,status:e.status,revoked_at:e.revoked_at,approved_at:e.approved_at,payer:e.payer,dependencies:y(JSON.parse(e.dependencies_json)),run_notice_url:e.run_notice_url??null,inference_endpoint:e.inference_endpoint_json?b(JSON.parse(e.inference_endpoint_json)):null,synced_at:e.synced_at}}t(f,"record");function u(e){if(!e||e.status!=="active")return null;try{return F(f(e))}catch(r){if(r instanceof TypeError||r instanceof SyntaxError)return null;throw r}}t(u,"active");function l(e){return e.grantee!=="app:terminal"&&v()}t(l,"mirrorOnly");async function I(){return(await L()).filter(e=>!l(e))}t(I,"localGrants");async function L(){return(await(await c()).prepare("SELECT * FROM grants").all()).flatMap(e=>{try{return[f(e)]}catch(r){if(r instanceof TypeError||r instanceof SyntaxError)return[];throw r}})}t(L,"allGrants");function j(e){return e.expires_at!==null&&!(Date.parse(e.expires_at)>Date.now())}t(j,"grantExpired");function F(e){if(e.status!=="active"||j(e))return null;try{const r=e.resolved_scopes.map(({scope:n})=>T(n));return{...e,resolved:e.resolved_scopes.flatMap(({mode:n},i)=>n==="always"?[r[i]]:[])}}catch(r){if(r instanceof TypeError||r instanceof SyntaxError)return null;throw r}}t(F,"activeRecord");function d(e){return Array.isArray(e)?`[${e.map(d).join(",")}]`:e&&typeof e=="object"?`{${Object.keys(e).sort().filter(r=>e[r]!==void 0).map(r=>`${JSON.stringify(r)}:${d(e[r])}`).join(",")}}`:JSON.stringify(e)??"null"}t(d,"canonicalJson");function U(e){const r={rev:e.rev,resolved_scopes:e.resolved_scopes,spend_cap:e.spend_cap,payer:e.payer,dependencies:e.dependencies??{},...e.inference_endpoint?{inference_endpoint:e.inference_endpoint}:{}};return S("sha256").update(d(r)).digest("base64url").slice(0,22)}t(U,"grantVersion");async function $(e){return!!await(await c()).prepare("SELECT 1 FROM grants WHERE id = ?").get(e)}t($,"hasGrant");async function P(e){return await(await c()).prepare("SELECT rev, status FROM grants WHERE id = ?").get(e)??null}t(P,"grantSyncState");async function V(e,r){return await(await c()).prepare("SELECT rev, status FROM grants WHERE grantee = ? AND sub = ?").get(e,r)??null}t(V,"grantSyncStateFor");async function M(e){const r=await(await c()).prepare("SELECT * FROM grants WHERE id = ?").get(e);if(!r)return null;try{return f(r)}catch(n){if(n instanceof TypeError||n instanceof SyntaxError)return null;throw n}}t(M,"grantRecord");async function B(e){return(e?(await M(e))?.payer:null)??"user"}t(B,"payerOfGrant");async function X(e){return u(await(await c()).prepare("SELECT * FROM grants WHERE id = ?").get(e))}t(X,"activeGrant");async function Y(e,r){return u(await(await c()).prepare("SELECT * FROM grants WHERE grantee = ? AND sub = ?").get(e,r))}t(Y,"grantFor");async function q(e){if(l({grantee:e}))return null;const r=await(await c()).prepare("SELECT * FROM grants WHERE grantee = ? AND status = 'active'").all(e);if(r.length>1)throw new Error(`multiple active grants for ${e}`);return u(r[0])}t(q,"activeGrantForApp");async function z(e){const r=await(await c()).prepare("SELECT run_notice_url AS url, sub, grantee FROM grants WHERE id = ? AND status = 'active'").get(e);return r&&r.url&&!l(r)?{url:r.url,sub:r.sub,grantee:r.grantee}:null}t(z,"runNoticeTarget");async function K(){const e=await(await c()).prepare("SELECT * FROM grants WHERE grantee = 'app:terminal' AND status = 'active'").all();if(e.length>1)throw new Error("multiple active terminal grants");return u(e[0])}t(K,"terminalGrant");async function Q(){return(await(await c()).prepare("SELECT value FROM runtime_state WHERE key = 'grants_source'").get())?.value??null}t(Q,"grantsSource");async function Z(e){return(await(await c()).prepare("SELECT value FROM runtime_state WHERE key = 'grants_source'").get())?.value===e}t(Z,"hasSyncedGrants");async function ee(e){return(await e.prepare("SELECT value FROM runtime_state WHERE key = 'grants_source'").get())?.value!=="local"?0:(await e.prepare("DELETE FROM runtime_state WHERE key = 'grants_source'").run(),Number((await e.prepare("DELETE FROM grants").run()).changes))}t(ee,"dropLocalGrantMirror");function re(e){if(e===void 0)return[];if(!Array.isArray(e))throw new TypeError("invalid grant sync response");return e.map(r=>{const{team:n,members:i}=r??{};if(typeof n!="string"||!/^team:\S+$/.test(n)||!Array.isArray(i)||i.some(o=>typeof o!="string"||!/^user:[^\s*]+$/.test(o)))throw new TypeError("invalid grant sync response");return{team:n,members:i}})}t(re,"teamsOf");async function te(e,r,n,i=[]){const o=new Set;for(const a of e){if(o.has(a.id)||!a.id||!a.runtime||!a.sub||!a.grantee||!Number.isInteger(a.rev)||!["active","revoked","removed"].includes(a.status))throw new TypeError("invalid grant sync response");o.add(a.id),p(a.scopes),p(a.resolved_scopes)}await O(async a=>{await a.exec("DELETE FROM grants");const E=a.prepare(`INSERT INTO grants
       (id, runtime, sub, grantee, rev, scopes_json, resolved_scopes_json, spend_cap, expires_at,
        status, revoked_at, approved_at, payer, dependencies_json, run_notice_url, inference_endpoint_json, synced_at)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`);for(const a of e)await _.run(a.id,a.runtime,a.sub,a.grantee,a.rev,JSON.stringify(a.scopes),JSON.stringify(a.resolved_scopes),a.spend_cap,a.expires_at,a.status,a.revoked_at,a.approved_at,a.payer,JSON.stringify(E(a.dependencies)),a.run_notice_url??null,a.inference_endpoint?JSON.stringify(a.inference_endpoint):null,a.synced_at);await s.prepare("DELETE FROM limits WHERE source = 'grant_sync'").run();for(const a of e){const c=k(a);c&&await A(a.id,[c],s)}await v(s,"directory",x,"member",i.flatMap(({team:a,members:c})=>c.map(g=>({resourceId:a,subject:R(g)})))),await s.prepare("INSERT INTO runtime_state (key, value) VALUES ('grants_source', ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(n),await s.prepare("INSERT INTO runtime_state (key, value) VALUES ('grants_generation', '1') ON CONFLICT(key) DO UPDATE SET value = CAST(CAST(runtime_state.value AS INTEGER) + 1 AS TEXT)").run()})}t(se,"replaceGrants");async function ie(){const e=await(await p()).prepare("SELECT value FROM runtime_state WHERE key = 'grants_generation'").get();return e?Number(e.value):0}t(ie,"grantsGeneration");export{z as activeGrant,Q as activeGrantForApp,j as activeRecord,F as allGrants,E as dependenciesOf,ne as dropLocalGrantMirror,M as grantExpired,K as grantFor,C as grantRecord,X as grantSyncState,Y as grantSyncStateFor,V as grantVersion,ie as grantsGeneration,re as grantsSource,B as hasGrant,te as hasSyncedGrants,b as inferenceEndpointOf,P as localGrants,d as mirrorOnly,q as payerOfGrant,se as replaceGrants,Z as runNoticeTarget,ae as teamsOf,ee as terminalGrant};
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`);for(const s of e)await E.run(s.id,s.runtime,s.sub,s.grantee,s.rev,JSON.stringify(s.scopes),JSON.stringify(s.resolved_scopes),s.spend_cap,s.expires_at,s.status,s.revoked_at,s.approved_at,s.payer,JSON.stringify(y(s.dependencies)),s.run_notice_url??null,s.inference_endpoint?JSON.stringify(s.inference_endpoint):null,s.synced_at);await w(a,"directory",R,"member",i.flatMap(({team:s,members:_})=>_.map(g=>({resourceId:s,subject:x(g)})))),await a.prepare("INSERT INTO runtime_state (key, value) VALUES ('grants_source', ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value").run(n),await a.prepare("INSERT INTO runtime_state (key, value) VALUES ('grants_generation', '1') ON CONFLICT(key) DO UPDATE SET value = CAST(CAST(runtime_state.value AS INTEGER) + 1 AS TEXT)").run()})}t(te,"replaceGrants");async function ne(){const e=await(await c()).prepare("SELECT value FROM runtime_state WHERE key = 'grants_generation'").get();return e?Number(e.value):0}t(ne,"grantsGeneration");export{X as activeGrant,q as activeGrantForApp,F as activeRecord,L as allGrants,y as dependenciesOf,ee as dropLocalGrantMirror,j as grantExpired,Y as grantFor,M as grantRecord,P as grantSyncState,V as grantSyncStateFor,U as grantVersion,ne as grantsGeneration,Q as grantsSource,$ as hasGrant,Z as hasSyncedGrants,b as inferenceEndpointOf,I as localGrants,l as mirrorOnly,B as payerOfGrant,te as replaceGrants,z as runNoticeTarget,re as teamsOf,K as terminalGrant};

package/dist/core/ledger/backfill.d.ts

@@ -4,9 +4,8 @@ export declare const LEGACY_ID_SQL = "'legacy:' || u.grantee || ':' || u.month |
 export interface BackfillResult {
     migrated: boolean;
     charges: number;
-    limits: number;
 }
-/** Copy `usage` into `charges` as legacy rows, rebuild `charge_totals` from them and fill `limits` from the grant mirror, then
+/** Copy `usage` into `charges` as legacy rows and rebuild `charge_totals` from them, then
  *  verify per `(grantee, month, payer, source, served_model)` that usd and token sums equal the `usage` row's, null kept. A
  *  second call sees the marker and does nothing. A failed verification rolls the whole thing back and throws. */
 export declare function backfillLedger(person: string): Promise<BackfillResult>;

package/dist/core/ledger/backfill.js

@@ -1,5 +1,5 @@
-var s=Object.defineProperty;var u=(t,e)=>s(t,"name",{value:e,configurable:!0});import{withCanvasWrite as E}from"../canvas/db.js";import{rebuildTotals as o}from"./totals.js";const a="ledger_migrated",r="'legacy:' || u.grantee || ':' || u.month || ':' || u.payer || ':' || u.source || ':' || u.served_model";async function L(t){return await E(async e=>{if(await e.prepare("SELECT value FROM canvas_meta WHERE key = ?").get(a)!==void 0)return{migrated:!1,charges:0,limits:0};const n=await e.prepare(`INSERT INTO charges (id, request, at, month, kind, what, units, usd, payer, funding, sub, grantee, provider)
-      SELECT ${r},
+var E=Object.defineProperty;var t=(u,e)=>E(u,"name",{value:e,configurable:!0});import{withCanvasWrite as i}from"../canvas/db.js";import{rebuildTotals as o}from"./totals.js";const r="ledger_migrated",a="'legacy:' || u.grantee || ':' || u.month || ':' || u.payer || ':' || u.source || ':' || u.served_model";async function p(u){return await i(async e=>{if(await e.prepare("SELECT value FROM canvas_meta WHERE key = ?").get(r)!==void 0)return{migrated:!1,charges:0};const n=await e.prepare(`INSERT INTO charges (id, request, at, month, kind, what, units, usd, payer, funding, sub, grantee, provider)
+      SELECT ${a},
              NULL, u.month || '-01T00:00:00.000Z', u.month,
              CASE WHEN u.source = 'model' THEN 'model' ELSE 'tool' END,
              CASE WHEN u.source = 'model' THEN u.served_model ELSE substr(u.source, 10) END,
@@ -9,14 +9,11 @@ var s=Object.defineProperty;var u=(t,e)=>s(t,"name",{value:e,configurable:!0});i
              CASE WHEN u.payer = 'app' THEN 'endpoint' WHEN u.source = 'model' THEN 'legacy' ELSE 'bill' END,
              ?::text, u.grantee,
              CASE WHEN u.source = 'model' THEN NULL ELSE 'app:' || substr(u.source, 10) END
-        FROM usage u ON CONFLICT (id) DO NOTHING`).run(t,t);await o(e);const i=await c(e);return await d(e),await e.prepare("INSERT INTO canvas_meta (key, value) VALUES (?, ?) ON CONFLICT (key) DO UPDATE SET value = excluded.value").run(a,new Date().toISOString()),{migrated:!0,charges:n.changes,limits:i}})}u(L,"backfillLedger");async function c(t){return(await t.prepare(`INSERT INTO limits (id, payer, funding, grantee, provider, sub, usd_per_month, source, updated_at)
-    SELECT 'grant:' || id, sub, NULL, grantee, NULL, NULL, spend_cap, 'grant_sync', ?
-      FROM grants WHERE status = 'active' AND spend_cap IS NOT NULL AND COALESCE(payer, 'user') <> 'app' AND grantee <> 'app:terminal'
-    ON CONFLICT (id) DO NOTHING`).run(new Date().toISOString())).changes}u(c,"backfillLimits");async function d(t){const e=await t.prepare(`SELECT u.grantee, u.month, u.payer, u.source, u.served_model FROM usage u
-    LEFT JOIN charges c ON c.id = ${r}
+        FROM usage u ON CONFLICT (id) DO NOTHING`).run(u,u);return await o(e),await s(e),await e.prepare("INSERT INTO canvas_meta (key, value) VALUES (?, ?) ON CONFLICT (key) DO UPDATE SET value = excluded.value").run(r,new Date().toISOString()),{migrated:!0,charges:n.changes}})}t(p,"backfillLedger");async function s(u){const e=await u.prepare(`SELECT u.grantee, u.month, u.payer, u.source, u.served_model FROM usage u
+    LEFT JOIN charges c ON c.id = ${a}
     WHERE c.id IS NULL
        OR c.usd IS DISTINCT FROM u.usd_equivalent::numeric(14,6)
        OR (u.source = 'model' AND (COALESCE((c.units ->> 'input')::bigint, -1) <> u.input_tokens
             OR COALESCE((c.units ->> 'output')::bigint, -1) <> u.output_tokens
             OR COALESCE((c.units ->> 'cache_read')::bigint, -1) <> u.cached_tokens))
-    LIMIT 5`).all();if(e.length>0)throw new Error(`ledger backfill verification failed; first differing usage rows: ${JSON.stringify(e)}`)}u(d,"verify");export{a as LEDGER_MIGRATED_KEY,r as LEGACY_ID_SQL,L as backfillLedger};
+    LIMIT 5`).all();if(e.length>0)throw new Error(`ledger backfill verification failed; first differing usage rows: ${JSON.stringify(e)}`)}t(s,"verify");export{r as LEDGER_MIGRATED_KEY,a as LEGACY_ID_SQL,p as backfillLedger};

package/dist/core/ledger/index.d.ts

@@ -3,7 +3,7 @@ export * from './months.js';
 export { payerOf, type Payer, type PayerCall } from './payer.js';
 export { writeCharge, receiptChargeId, takePct, chargeOf, type WriteResult } from './charges.js';
 export { check, findRefusal, refusalError, refusedMark, userActionOf, type Candidate, type CallCandidate, type StartCandidate, type Refusal } from './check.js';
-export { upsertLimit, deleteLimit, replaceGrantLimits, listLimits, grantLimitId } from './limits.js';
+export { upsertLimit, deleteLimit, listLimits } from './limits.js';
 export { usageFor, listCharges, monthTotals, assertReference, type ChargePage, type ListFilter, type MonthTotals } from './read.js';
 export { backfillLedger, LEDGER_MIGRATED_KEY, type BackfillResult } from './backfill.js';
 export { rebuildTotals, rebuildTotalsFor } from './totals.js';

package/dist/core/ledger/index.js

@@ -1 +1 @@
-export*from"./types.js";export*from"./months.js";import{payerOf as i}from"./payer.js";import{writeCharge as f,receiptChargeId as s,takePct as m,chargeOf as l}from"./charges.js";import{check as c,findRefusal as x,refusalError as d,refusedMark as u,userActionOf as g}from"./check.js";import{upsertLimit as h,deleteLimit as n,replaceGrantLimits as E,listLimits as k,grantLimitId as R}from"./limits.js";import{usageFor as b,listCharges as C,monthTotals as G,assertReference as I}from"./read.js";import{backfillLedger as A,LEDGER_MIGRATED_KEY as D}from"./backfill.js";import{rebuildTotals as M,rebuildTotalsFor as _}from"./totals.js";export{D as LEDGER_MIGRATED_KEY,I as assertReference,A as backfillLedger,l as chargeOf,c as check,n as deleteLimit,x as findRefusal,R as grantLimitId,C as listCharges,k as listLimits,G as monthTotals,i as payerOf,M as rebuildTotals,_ as rebuildTotalsFor,s as receiptChargeId,d as refusalError,u as refusedMark,E as replaceGrantLimits,m as takePct,h as upsertLimit,b as usageFor,g as userActionOf,f as writeCharge};
+export*from"./types.js";export*from"./months.js";import{payerOf as f}from"./payer.js";import{writeCharge as i,receiptChargeId as s,takePct as m,chargeOf as l}from"./charges.js";import{check as x,findRefusal as c,refusalError as u,refusedMark as d,userActionOf as g}from"./check.js";import{upsertLimit as E,deleteLimit as L,listLimits as k}from"./limits.js";import{usageFor as R,listCharges as T,monthTotals as b,assertReference as C}from"./read.js";import{backfillLedger as A,LEDGER_MIGRATED_KEY as D}from"./backfill.js";import{rebuildTotals as G,rebuildTotalsFor as I}from"./totals.js";export{D as LEDGER_MIGRATED_KEY,C as assertReference,A as backfillLedger,l as chargeOf,x as check,L as deleteLimit,c as findRefusal,T as listCharges,k as listLimits,b as monthTotals,f as payerOf,G as rebuildTotals,I as rebuildTotalsFor,s as receiptChargeId,u as refusalError,d as refusedMark,m as takePct,E as upsertLimit,R as usageFor,g as userActionOf,i as writeCharge};

package/dist/core/ledger/limits.d.ts

@@ -1,13 +1,8 @@
-import { type CanvasDb } from '../canvas/db.js';
 import type { Limit, LimitInput, LimitSource } from './types.js';
-export declare const grantLimitId: (grantId: string) => string;
 /** Insert or replace one limit row by id. */
 export declare function upsertLimit(input: LimitInput): Promise<Limit>;
 /** Delete one limit row; true when it existed. */
 export declare function deleteLimit(id: string): Promise<boolean>;
-/** A grant's limit rows in one transaction: delete every `grant_sync` row of this grant, then write `rows`. The first row's id
- *  is `grant:<grant id>`, later ones `grant:<grant id>#<n>`. Only `grant_sync` rows are touched. */
-export declare function replaceGrantLimits(grantId: string, rows: ReadonlyArray<Omit<LimitInput, 'id' | 'source'>>, db?: CanvasDb): Promise<void>;
 /** Limit rows, optionally of one source or one payer, in id order. */
 export declare function listLimits(filter?: {
     source?: LimitSource;

package/dist/core/ledger/limits.js

@@ -1,3 +1,3 @@
-var l=Object.defineProperty;var a=(n,e)=>l(n,"name",{value:e,configurable:!0});import{openDb as m,withCanvasWrite as i}from"../canvas/db.js";const u=a(n=>`grant:${n}`,"grantLimitId"),s="id, payer, funding, grantee, provider, sub, usd_per_month, source, updated_at";async function E(n){if(!Number.isFinite(n.usd_per_month)||n.usd_per_month<0)throw new RangeError("usd_per_month must be a number of at least 0");const e={funding:null,grantee:null,provider:null,sub:null,...n,updated_at:new Date().toISOString()};return await i(async r=>{await r.prepare(`INSERT INTO limits (${s}) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+var d=Object.defineProperty;var t=(r,e)=>d(r,"name",{value:e,configurable:!0});import{openDb as i,withCanvasWrite as u}from"../canvas/db.js";const a="id, payer, funding, grantee, provider, sub, usd_per_month, source, updated_at";async function o(r){if(!Number.isFinite(r.usd_per_month)||r.usd_per_month<0)throw new RangeError("usd_per_month must be a number of at least 0");const e={funding:null,grantee:null,provider:null,sub:null,...r,updated_at:new Date().toISOString()};return await u(async n=>{await n.prepare(`INSERT INTO limits (${a}) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
       ON CONFLICT (id) DO UPDATE SET payer = excluded.payer, funding = excluded.funding, grantee = excluded.grantee,
-        provider = excluded.provider, sub = excluded.sub, usd_per_month = excluded.usd_per_month, source = excluded.source, updated_at = excluded.updated_at`).run(e.id,e.payer,e.funding,e.grantee,e.provider,e.sub,e.usd_per_month,e.source,e.updated_at)}),e}a(E,"upsertLimit");async function w(n){return await i(async e=>(await e.prepare("DELETE FROM limits WHERE id = ?").run(n)).changes>0)}a(w,"deleteLimit");async function f(n,e,r){const d=a(async o=>{await o.prepare("DELETE FROM limits WHERE source = 'grant_sync' AND (id = ? OR starts_with(id, ?))").run(u(n),`${u(n)}#`);const c=new Date().toISOString();for(const[p,t]of e.entries()){if(!Number.isFinite(t.usd_per_month)||t.usd_per_month<0)throw new RangeError("usd_per_month must be a number of at least 0");await o.prepare(`INSERT INTO limits (${s}) VALUES (?, ?, ?, ?, ?, ?, ?, 'grant_sync', ?)`).run(p===0?u(n):`${u(n)}#${p}`,t.payer,t.funding??null,t.grantee??null,t.provider??null,t.sub??null,t.usd_per_month,c)}},"body");r!==void 0&&r.inTransaction?await d(r):await i(d)}a(f,"replaceGrantLimits");async function g(n={}){const e=[],r=[];return n.source!==void 0&&(e.push("source = ?"),r.push(n.source)),n.payer!==void 0&&(e.push("payer = ?"),r.push(n.payer)),await(await m()).prepareUncached(`SELECT ${s} FROM limits${e.length?` WHERE ${e.join(" AND ")}`:""} ORDER BY id`).all(...r)}a(g,"listLimits");export{w as deleteLimit,u as grantLimitId,g as listLimits,f as replaceGrantLimits,E as upsertLimit};
+        provider = excluded.provider, sub = excluded.sub, usd_per_month = excluded.usd_per_month, source = excluded.source, updated_at = excluded.updated_at`).run(e.id,e.payer,e.funding,e.grantee,e.provider,e.sub,e.usd_per_month,e.source,e.updated_at)}),e}t(o,"upsertLimit");async function c(r){return await u(async e=>(await e.prepare("DELETE FROM limits WHERE id = ?").run(r)).changes>0)}t(c,"deleteLimit");async function l(r={}){const e=[],n=[];return r.source!==void 0&&(e.push("source = ?"),n.push(r.source)),r.payer!==void 0&&(e.push("payer = ?"),n.push(r.payer)),await(await i()).prepareUncached(`SELECT ${a} FROM limits${e.length?` WHERE ${e.join(" AND ")}`:""} ORDER BY id`).all(...n)}t(l,"listLimits");export{c as deleteLimit,l as listLimits,o as upsertLimit};

package/dist/core/ledger/totals.d.ts

@@ -12,7 +12,8 @@ export declare function addToTotals(db: CanvasDb, charge: {
     provider: string | null;
     usd: number | null;
 }): Promise<void>;
-/** Rebuild the whole rollup from `charges`. */
+/** Rebuild the whole rollup from `charges`, `billed_usd` with `usd`: a rebuild that dropped it would zero the billed totals
+ *  002's trigger keeps, and an older build that may still open the database must not do that either. */
 export declare function rebuildTotals(db: CanvasDb): Promise<void>;
 /** Delete the rollup rows that name `a` or `b` as payer, sub or grantee and rebuild them from `charges`, so two rows that
  *  now share a key are summed once. For person substitution, in the same transaction as the rename. */

package/dist/core/ledger/totals.js

@@ -1,4 +1,4 @@
-var s=Object.defineProperty;var t=(r,e)=>s(r,"name",{value:e,configurable:!0});const a=t(r=>r??"","absent");async function p(r,e){await r.prepare(`INSERT INTO charge_totals (month, payer, funding, sub, grantee, provider, usd) VALUES (?, ?, ?, ?, ?, ?, ?)
-    ON CONFLICT (month, payer, funding, sub, grantee, provider) DO UPDATE SET usd = charge_totals.usd + excluded.usd`).run(e.month,e.payer,e.funding,a(e.sub),e.grantee,a(e.provider),e.usd??0)}t(p,"addToTotals");const u=`SELECT month, payer, funding, COALESCE(sub, ''), grantee, COALESCE(provider, ''), COALESCE(SUM(usd), 0)
-  FROM charges WHERE refused IS NULL AND kind <> 'take'`,o="GROUP BY month, payer, funding, COALESCE(sub, ''), grantee, COALESCE(provider, '')";async function d(r){await r.prepare("DELETE FROM charge_totals").run(),await r.prepare(`INSERT INTO charge_totals (month, payer, funding, sub, grantee, provider, usd) ${u} ${o}`).run()}t(d,"rebuildTotals");async function i(r,e,n){await r.prepare("DELETE FROM charge_totals WHERE payer IN (?, ?) OR sub IN (?, ?) OR grantee IN (?, ?)").run(e,n,e,n,e,n),await r.prepare(`INSERT INTO charge_totals (month, payer, funding, sub, grantee, provider, usd) ${u}
-    AND (payer IN (?, ?) OR sub IN (?, ?) OR grantee IN (?, ?)) ${o}`).run(e,n,e,n,e,n)}t(i,"rebuildTotalsFor");export{a as absent,p as addToTotals,d as rebuildTotals,i as rebuildTotalsFor};
+var o=Object.defineProperty;var t=(r,e)=>o(r,"name",{value:e,configurable:!0});const a=t(r=>r??"","absent");async function E(r,e){await r.prepare(`INSERT INTO charge_totals (month, payer, funding, sub, grantee, provider, usd) VALUES (?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT (month, payer, funding, sub, grantee, provider) DO UPDATE SET usd = charge_totals.usd + excluded.usd`).run(e.month,e.payer,e.funding,a(e.sub),e.grantee,a(e.provider),e.usd??0)}t(E,"addToTotals");const u=`SELECT month, payer, funding, COALESCE(sub, ''), grantee, COALESCE(provider, ''), COALESCE(SUM(usd), 0), COALESCE(SUM(billed_usd), 0)
+  FROM charges WHERE refused IS NULL AND kind <> 'take'`,s="GROUP BY month, payer, funding, COALESCE(sub, ''), grantee, COALESCE(provider, '')";async function p(r){await r.prepare("DELETE FROM charge_totals").run(),await r.prepare(`INSERT INTO charge_totals (month, payer, funding, sub, grantee, provider, usd, billed_usd) ${u} ${s}`).run()}t(p,"rebuildTotals");async function i(r,e,n){await r.prepare("DELETE FROM charge_totals WHERE payer IN (?, ?) OR sub IN (?, ?) OR grantee IN (?, ?)").run(e,n,e,n,e,n),await r.prepare(`INSERT INTO charge_totals (month, payer, funding, sub, grantee, provider, usd, billed_usd) ${u}
+    AND (payer IN (?, ?) OR sub IN (?, ?) OR grantee IN (?, ?)) ${s}`).run(e,n,e,n,e,n)}t(i,"rebuildTotalsFor");export{a as absent,E as addToTotals,p as rebuildTotals,i as rebuildTotalsFor};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.554",
+  "version": "0.3.555",
   "description": "crtr — agent runtime with memory, plugins, and marketplaces",
   "type": "module",
   "main": "dist/index.js",
@@ -141,7 +141,7 @@
   },
   "license": "UNLICENSED",
   "dependencies": {
-    "@north-light/identity": "0.3.554",
+    "@north-light/identity": "0.3.555",
     "@earendil-works/pi-agent-core": "1.1.0",
     "@earendil-works/pi-ai": "1.1.0",
     "@earendil-works/pi-coding-agent": "1.1.0",

package/packages/crouter-identity/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@north-light/identity",
-  "version": "0.3.554",
+  "version": "0.3.555",
   "description": "Northlight access-token verification and scope rules",
   "type": "module",
   "main": "./dist/index.js",

package/runtime.lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@north-light/cli",
-  "version": "0.3.554",
+  "version": "0.3.555",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@north-light/cli",
-      "version": "0.3.554",
+      "version": "0.3.555",
       "hasInstallScript": true,
       "license": "UNLICENSED",
       "workspaces": [
@@ -24,7 +24,7 @@
         "@milkdown/preset-gfm": "^7.22.3",
         "@milkdown/prose": "^7.22.3",
         "@milkdown/utils": "^7.22.3",
-        "@north-light/identity": "0.3.554",
+        "@north-light/identity": "0.3.555",
         "cron-parser": "^5.6.0",
         "esbuild": "^0.27.7",
         "jose": "^6.2.12",
@@ -12455,17 +12455,17 @@
     },
     "packages/crouter-api": {
       "name": "@north-light/api",
-      "version": "0.3.554",
+      "version": "0.3.555",
       "license": "UNLICENSED"
     },
     "packages/crouter-env-docker": {
       "name": "@north-light/env-docker",
-      "version": "0.3.554",
+      "version": "0.3.555",
       "license": "UNLICENSED"
     },
     "packages/crouter-identity": {
       "name": "@north-light/identity",
-      "version": "0.3.554",
+      "version": "0.3.555",
       "license": "UNLICENSED",
       "dependencies": {
         "jose": "^6.2.1"
@@ -12473,21 +12473,21 @@
     },
     "packages/crouter-plugin": {
       "name": "@north-light/plugin",
-      "version": "0.3.554",
+      "version": "0.3.555",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.554",
-        "@north-light/identity": "0.3.554"
+        "@north-light/api": "0.3.555",
+        "@north-light/identity": "0.3.555"
       }
     },
     "packages/crouter-sdk": {
       "name": "@north-light/sdk",
-      "version": "0.3.554",
+      "version": "0.3.555",
       "license": "UNLICENSED",
       "dependencies": {
-        "@north-light/api": "0.3.554",
-        "@north-light/identity": "0.3.554",
-        "@north-light/plugin": "0.3.554",
+        "@north-light/api": "0.3.555",
+        "@north-light/identity": "0.3.555",
+        "@north-light/plugin": "0.3.555",
         "jose": "^6.2.1"
       },
       "bin": {