@openenthrium/oe-runtime-sdk 1.7.5

package/src/routes/threads.js

@@ -0,0 +1,53 @@
+const router = require("express").Router();
+const { authenticate } = require("../middleware/auth");
+const { v4: uuidv4 } = require("uuid");
+
+router.get("/:slug", authenticate, async (req, res) => {
+  const workspace = await req.db.workspace.findUnique({ where: { slug: req.params.slug } });
+  if (!workspace) return res.status(404).json({ error: "Workspace not found" });
+  const threads = await req.db.thread.findMany({
+    where: { workspaceId: workspace.id },
+    orderBy: [{ pinned: "desc" }, { createdAt: "desc" }]
+  });
+  res.json({ threads });
+});
+
+router.post("/:slug", authenticate, async (req, res) => {
+  const { name } = req.body;
+  const workspace = await req.db.workspace.findUnique({ where: { slug: req.params.slug } });
+  if (!workspace) return res.status(404).json({ error: "Workspace not found" });
+  const thread = await req.db.thread.create({
+    data: { uid: uuidv4(), workspaceId: workspace.id, name: name || "New Thread" }
+  });
+  res.json({ thread });
+});
+
+router.put("/:slug/:uid/pin", authenticate, async (req, res) => {
+  const thread = await req.db.thread.findUnique({ where: { uid: req.params.uid } });
+  if (!thread) return res.status(404).json({ error: "Thread not found" });
+  const updated = await req.db.thread.update({
+    where: { uid: req.params.uid },
+    data: { pinned: !thread.pinned }
+  });
+  res.json({ thread: updated });
+});
+
+router.put("/:slug/:uid", authenticate, async (req, res) => {
+  const { name } = req.body;
+  if (!name?.trim()) return res.status(400).json({ error: "Name required" });
+  const thread = await req.db.thread.update({
+    where: { uid: req.params.uid },
+    data: { name: name.trim() }
+  });
+  res.json({ thread });
+});
+
+router.delete("/:slug/:uid", authenticate, async (req, res) => {
+  const thread = await req.db.thread.findUnique({ where: { uid: req.params.uid } });
+  if (!thread) return res.status(404).json({ error: "Thread not found" });
+  await req.db.chat.deleteMany({ where: { threadId: thread.id } });
+  await req.db.thread.delete({ where: { uid: req.params.uid } });
+  res.json({ success: true });
+});
+
+module.exports = router;

package/src/routes/workspaces.js

@@ -0,0 +1,464 @@
+const router = require("express").Router();
+const { authenticate, requireAdmin, requireManagerOrAdmin, requireCommercial } = require("../middleware/auth");
+const { v4: uuidv4 } = require("uuid");
+const fs = require("fs");
+const path = require("path");
+
+// Check workspace membership — admins/managers pass through; regular users must be a member
+async function wsMember(req, slug) {
+  const ws = await req.db.workspace.findUnique({ where: { slug } });
+  if (!ws) return null;
+  if (req.user.role === "admin" || req.user.role === "manager") return ws;
+  const m = await req.db.workspaceUser.findFirst({ where: { userId: req.user.id, workspaceId: ws.id } });
+  return m ? ws : false; // null = not found, false = not a member
+}
+
+// List workspaces for current user
+router.get("/", authenticate, async (req, res) => {
+  const isAdmin = req.user.role === "admin";
+  const include = {
+    _count: { select: { documents: true, chats: true } },
+    createdBy: { select: { id: true, name: true, email: true } },
+  };
+  const workspaces = isAdmin
+    ? await req.db.workspace.findMany({ orderBy: { createdAt: "desc" }, include })
+    : await req.db.workspace.findMany({
+        where: { users: { some: { userId: req.user.id } } },
+        orderBy: { createdAt: "desc" },
+        include,
+      });
+  res.json({ workspaces });
+});
+
+// Agent runs across all workspaces the current user manages
+router.get("/agent-runs", authenticate, requireManagerOrAdmin, async (req, res) => {
+  try {
+    const { period = "all" } = req.query;
+    const days = { "7d": 7, "30d": 30 }[period];
+    const startedAt = days ? { gte: new Date(Date.now() - days * 86400000) } : undefined;
+
+    const isAdmin = req.user.role === "admin";
+    let workspaceFilter = undefined;
+    if (!isAdmin) {
+      const memberships = await req.db.workspaceUser.findMany({ where: { userId: req.user.id }, select: { workspaceId: true } });
+      const workspaceIds = memberships.map(m => m.workspaceId);
+      workspaceFilter = { agent: { workspaceId: { in: workspaceIds } } };
+    }
+
+    const runs = await req.db.agentRun.findMany({
+      where: { ...(startedAt ? { startedAt } : {}), ...workspaceFilter },
+      orderBy: { startedAt: "desc" },
+      take: 200,
+      include: {
+        agent: { select: { id: true, name: true, workspaceId: true, workspace: { select: { id: true, name: true } } } },
+        triggeredBy: { select: { id: true, name: true, email: true } },
+      },
+    });
+    res.json({ runs });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+// ── Member-accessible project routes ─────────────────────────────────────────
+
+// List projects (workspace member or manager/admin)
+router.get("/:slug/projects", authenticate, async (req, res) => {
+  try {
+    const ws = await wsMember(req, req.params.slug);
+    if (ws === null)  return res.status(404).json({ error: "Workspace not found" });
+    if (ws === false) return res.status(403).json({ error: "Access denied" });
+    const projects = await req.db.project.findMany({
+      where:   { workspaceId: ws.id },
+      include: { _count: { select: { agents: true, runs: true } } },
+      orderBy: { createdAt: "desc" },
+    });
+    res.json({ projects });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+// List agents for a project (workspace member or manager/admin)
+router.get("/:slug/projects/:projectId/agents", authenticate, async (req, res) => {
+  try {
+    const ws = await wsMember(req, req.params.slug);
+    if (!ws) return res.status(ws === null ? 404 : 403).json({ error: !ws ? "Access denied" : "Not found" });
+    const agents = await req.db.projectAgent.findMany({
+      where:   { projectId: parseInt(req.params.projectId) },
+      orderBy: { createdAt: "asc" },
+    });
+    res.json({ agents });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+// Run agent — SSE (workspace member or manager/admin)
+router.post("/:slug/projects/:projectId/agents/:agentId/run", authenticate, async (req, res) => {
+  try {
+    const ws = await wsMember(req, req.params.slug);
+    if (!ws) return res.status(403).json({ error: "Access denied" });
+
+    const { input = "" } = req.body;
+    const { getLLMConfig } = require("../providers/llm");
+    const yaml    = require("js-yaml");
+    const engine  = require("../engine");
+
+    const [project, agent] = await Promise.all([
+      req.db.project.findUnique({ where: { id: parseInt(req.params.projectId) } }),
+      req.db.projectAgent.findUnique({ where: { id: parseInt(req.params.agentId) } }),
+    ]);
+    if (!project || !agent) return res.status(404).json({ error: "Not found" });
+
+    const llmConfig  = await getLLMConfig();
+    const oeConfig   = (() => { try { return JSON.parse(project.oeConfig || "{}"); } catch { return {}; } })();
+    // Mirror CLI prepareConnectors: extract creds and wrap in authConfig/config JSON strings
+    // so every adapter can read them via JSON.parse(connector.config / connector.authConfig)
+    const connectors = (oeConfig.connectors || []).map((c, i) => {
+      const { connection_name, connection_type, ...creds } = c;
+      return {
+        id:         i + 1,
+        name:       connection_name,
+        type:       connection_type,
+        status:     "active",
+        authConfig: JSON.stringify(creds),
+        config:     JSON.stringify(creds),
+      };
+    });
+    const doc        = (() => { try { return yaml.load(agent.yamlContent) || {}; } catch { return {}; } })();
+    const agentSpec  = {
+      systemPrompt: doc.instructions || doc.system_prompt || doc.systemPrompt || "",
+      workflow:     (doc.steps || []).map(s => ({ name: s.name || "", content: s.content || "" })),
+      params: [], maxRounds: 25, input,
+    };
+    const refNames      = (doc.connectors || []).map(c => c.connection_name);
+    const filteredConns = refNames.length ? connectors.filter(c => refNames.includes(c.name)) : connectors;
+
+    res.setHeader("Content-Type",  "text/event-stream");
+    res.setHeader("Cache-Control", "no-cache");
+    res.setHeader("Connection",    "keep-alive");
+
+    const run = await req.db.projectRun.create({
+      data: { projectId: project.id, agentId: agent.id, triggeredByUserId: req.user?.id || null, status: "running", input: input || null },
+    });
+
+    const { executeTool } = require("../utils/tools/registry");
+    await engine.run(agentSpec, llmConfig, filteredConns, {
+      toolExecutor: (name, args, conns) => executeTool(name, args, conns, req.db),
+      onToolCall:   (name) => res.write(`data: ${JSON.stringify({ tool_call: name })}\n\n`),
+      checkCancel:  async () => {
+        const [r] = await req.db.$queryRaw`SELECT cancelRequested FROM ProjectRun WHERE id = ${run.id}`;
+        return r?.cancelRequested || false;
+      },
+      onDone: async (output) => {
+        await req.db.projectRun.update({ where: { id: run.id }, data: { status: "success", output, completedAt: new Date() } });
+        res.write(`data: ${JSON.stringify({ done: true, output, runId: run.id })}\n\n`);
+        res.end();
+      },
+      onError: async (err) => {
+        await req.db.projectRun.update({ where: { id: run.id }, data: { status: "error", error: err.message, completedAt: new Date() } }).catch(() => {});
+        res.write(`data: ${JSON.stringify({ error: err.message })}\n\n`);
+        res.end();
+      },
+    });
+  } catch (err) {
+    if (!res.headersSent) return res.status(500).json({ error: err.message });
+    res.write(`data: ${JSON.stringify({ error: err.message })}\n\n`);
+    res.end();
+  }
+});
+
+// Cancel run (workspace member or manager/admin)
+router.post("/:slug/projects/:projectId/runs/:runId/cancel", authenticate, async (req, res) => {
+  try {
+    const ws = await wsMember(req, req.params.slug);
+    if (!ws) return res.status(403).json({ error: "Access denied" });
+    await req.db.$executeRaw`UPDATE ProjectRun SET cancelRequested = 1 WHERE id = ${parseInt(req.params.runId)}`;
+    res.json({ ok: true });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+// List project runs (workspace member or manager/admin)
+router.get("/:slug/project-runs", authenticate, async (req, res) => {
+  try {
+    const ws = await wsMember(req, req.params.slug);
+    if (!ws) return res.status(ws === null ? 404 : 403).json({ error: "Not found" });
+    const { period = "all" } = req.query;
+    const days = { "7d": 7, "30d": 30 }[period];
+    const startFilter = days ? { gte: new Date(Date.now() - days * 86400000) } : undefined;
+    const runs = await req.db.projectRun.findMany({
+      where: {
+        project: { workspaceId: ws.id },
+        ...(startFilter ? { startedAt: startFilter } : {}),
+      },
+      orderBy: { startedAt: "desc" },
+      take: 300,
+      include: {
+        project:     { select: { id: true, name: true } },
+        agent:       { select: { id: true, name: true, fileName: true } },
+        triggeredBy: { select: { id: true, name: true, email: true } },
+      },
+    });
+    res.json({ runs });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+// Clear all project runs (manager/admin only — destructive)
+router.delete("/:slug/project-runs", authenticate, requireManagerOrAdmin, async (req, res) => {
+  try {
+    const workspace = await req.db.workspace.findUnique({ where: { slug: req.params.slug } });
+    if (!workspace) return res.status(404).json({ error: "Workspace not found" });
+    await req.db.projectRun.deleteMany({ where: { project: { workspaceId: workspace.id } } });
+    res.json({ ok: true });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+// Get single workspace
+router.get("/:slug", authenticate, async (req, res) => {
+  const workspace = await req.db.workspace.findUnique({
+    where: { slug: req.params.slug },
+    include: { documents: { orderBy: { createdAt: "desc" } }, _count: { select: { chats: true } } }
+  });
+  if (!workspace) return res.status(404).json({ error: "Workspace not found" });
+  res.json({ workspace });
+});
+
+// Create workspace (manager or admin)
+router.post("/", authenticate, requireManagerOrAdmin, async (req, res) => {
+  const { name, systemPrompt } = req.body;
+  if (!name) return res.status(400).json({ error: "Name required" });
+
+  const slug = name.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/(^-|-$)/g, "") + "-" + uuidv4().slice(0, 6);
+  const workspace = await req.db.workspace.create({
+    data: { name, slug, systemPrompt: systemPrompt || null, createdByUserId: req.user.id || null },
+    include: { createdBy: { select: { id: true, name: true, email: true } } }
+  });
+
+  // Auto-add creator as member (skip superadmin who has no DB row)
+  if (req.user.id !== 0) {
+    await req.db.workspaceUser.create({ data: { userId: req.user.id, workspaceId: workspace.id } });
+  }
+
+  res.json({ workspace });
+});
+
+// Update workspace (manager or admin)
+router.put("/:slug", authenticate, requireManagerOrAdmin, async (req, res) => {
+  const { name, systemPrompt, embedEnabled, temperature, chatHistory, queryRefusalResponse, starterPrompts } = req.body;
+  const workspace = await req.db.workspace.update({
+    where: { slug: req.params.slug },
+    data: {
+      ...(name && { name }),
+      ...(systemPrompt !== undefined && { systemPrompt: systemPrompt || null }),
+      ...(embedEnabled !== undefined && { embedEnabled: Boolean(embedEnabled) }),
+      ...(temperature !== undefined && { temperature: parseFloat(temperature) }),
+      ...(chatHistory !== undefined && { chatHistory: parseInt(chatHistory) }),
+      ...(queryRefusalResponse !== undefined && { queryRefusalResponse: queryRefusalResponse || null }),
+      ...(starterPrompts !== undefined && { starterPrompts: JSON.stringify(starterPrompts) }),
+    }
+  });
+  res.json({ workspace });
+});
+
+// Delete workspace (manager or admin)
+router.delete("/:slug", authenticate, requireManagerOrAdmin, async (req, res) => {
+  await req.db.workspace.delete({ where: { slug: req.params.slug } });
+  res.json({ success: true });
+});
+
+// Add user to workspace (manager or admin)
+router.post("/:slug/users", authenticate, requireManagerOrAdmin, async (req, res) => {
+  const { userId } = req.body;
+  const workspace = await req.db.workspace.findUnique({ where: { slug: req.params.slug } });
+  if (!workspace) return res.status(404).json({ error: "Workspace not found" });
+
+  await req.db.workspaceUser.upsert({
+    where: { userId_workspaceId: { userId: parseInt(userId), workspaceId: workspace.id } },
+    create: { userId: parseInt(userId), workspaceId: workspace.id },
+    update: {}
+  });
+  res.json({ success: true });
+});
+
+// Remove user from workspace (manager or admin)
+router.delete("/:slug/users/:userId", authenticate, requireManagerOrAdmin, async (req, res) => {
+  const workspace = await req.db.workspace.findUnique({ where: { slug: req.params.slug } });
+  if (!workspace) return res.status(404).json({ error: "Workspace not found" });
+
+  await req.db.workspaceUser.deleteMany({
+    where: { userId: parseInt(req.params.userId), workspaceId: workspace.id }
+  });
+  res.json({ success: true });
+});
+
+// ── Manager: all agent runs across managed workspaces ────────────────────────
+router.get("/agent-runs", authenticate, requireManagerOrAdmin, async (req, res) => {
+  try {
+    const { period = "all" } = req.query;
+    const days = { "7d": 7, "30d": 30 }[period];
+    const startedAt = days ? { gte: new Date(Date.now() - days * 86400000) } : undefined;
+
+    const workspaces = await req.db.workspace.findMany({
+      where: req.user.role === "admin" ? undefined : { users: { some: { userId: req.user.id } } },
+      select: { id: true },
+    });
+    const workspaceIds = workspaces.map(w => w.id);
+
+    const agents = await req.db.agent.findMany({
+      where: { workspaceId: { in: workspaceIds } },
+      select: { id: true },
+    });
+    const agentIds = agents.map(a => a.id);
+
+    const runs = await req.db.agentRun.findMany({
+      where: { agentId: { in: agentIds }, ...(startedAt ? { startedAt } : {}) },
+      orderBy: { startedAt: "desc" },
+      take: 200,
+      include: {
+        agent: { select: { id: true, name: true, workspaceId: true, workspace: { select: { id: true, name: true } } } },
+        triggeredBy: { select: { id: true, name: true, email: true } },
+      },
+    });
+    res.json({ runs });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+// ── User-facing agent routes ──────────────────────────────────────────────────
+// Helpers
+function isManagerOrAdmin(user) { return user.role === "admin" || user.role === "manager"; }
+
+async function assertWorkspaceMember(db, user, workspaceId) {
+  if (user.role === "admin") return true;
+  const member = await db.workspaceUser.findFirst({ where: { userId: user.id, workspaceId } });
+  return !!member;
+}
+// ── Knowledge Base Sharing ────────────────────────────────────────────────────
+
+router.get("/:slug/kb-shares", authenticate, requireCommercial, async (req, res) => {
+  try {
+    const workspace = await req.db.workspace.findUnique({ where: { slug: req.params.slug } });
+    if (!workspace) return res.status(404).json({ error: "Not found" });
+    const [outgoing, incoming] = await Promise.all([
+      req.db.workspaceKBShare.findMany({
+        where: { sourceWorkspaceId: workspace.id },
+        include: { targetWorkspace: { select: { id: true, slug: true, name: true } } },
+        orderBy: { createdAt: "asc" },
+      }),
+      req.db.workspaceKBShare.findMany({
+        where: { targetWorkspaceId: workspace.id },
+        include: { sourceWorkspace: { select: { id: true, slug: true, name: true } } },
+        orderBy: { createdAt: "asc" },
+      }),
+    ]);
+    res.json({ outgoing, incoming });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+router.post("/:slug/kb-shares", authenticate, requireCommercial, async (req, res) => {
+  try {
+    const featureSetting = await req.db.setting.findUnique({ where: { key: "feature.kbSharing" } });
+    if (featureSetting?.value !== "true") return res.status(403).json({ error: "Knowledge Base Sharing is disabled on this installation." });
+
+    const workspace = await req.db.workspace.findUnique({ where: { slug: req.params.slug } });
+    if (!workspace) return res.status(404).json({ error: "Not found" });
+    if (!await assertWorkspaceMember(req.db, req.user, workspace.id)) return res.status(403).json({ error: "Access denied" });
+    const target = await req.db.workspace.findUnique({ where: { slug: req.body.targetWorkspaceSlug } });
+    if (!target) return res.status(404).json({ error: "Target workspace not found" });
+    if (target.id === workspace.id) return res.status(400).json({ error: "Cannot share with yourself" });
+    const share = await req.db.workspaceKBShare.create({
+      data: { sourceWorkspaceId: workspace.id, targetWorkspaceId: target.id },
+      include: { targetWorkspace: { select: { id: true, slug: true, name: true } } },
+    });
+    res.json({ share });
+  } catch (err) {
+    if (err.code === "P2002") return res.status(409).json({ error: "Already shared with this workspace" });
+    res.status(500).json({ error: err.message });
+  }
+});
+
+router.delete("/:slug/kb-shares/:id", authenticate, requireCommercial, async (req, res) => {
+  try {
+    const workspace = await req.db.workspace.findUnique({ where: { slug: req.params.slug } });
+    if (!workspace) return res.status(404).json({ error: "Not found" });
+    if (!await assertWorkspaceMember(req.db, req.user, workspace.id)) return res.status(403).json({ error: "Access denied" });
+    await req.db.workspaceKBShare.delete({ where: { id: parseInt(req.params.id), sourceWorkspaceId: workspace.id } });
+    res.json({ ok: true });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+router.get("/:slug/peer-workspaces", authenticate, async (req, res) => {
+  try {
+    const workspace = await req.db.workspace.findUnique({ where: { slug: req.params.slug } });
+    if (!workspace) return res.status(404).json({ error: "Not found" });
+    const workspaces = await req.db.workspace.findMany({
+      where: { id: { not: workspace.id } },
+      select: { id: true, slug: true, name: true },
+      orderBy: { name: "asc" },
+    });
+    res.json({ workspaces });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+// ── Workspace DLP Policies ────────────────────────────────────────────────────
+
+router.get("/:slug/dlp-policies", authenticate, requireManagerOrAdmin, async (req, res) => {
+  try {
+    const workspace = await req.db.workspace.findUnique({ where: { slug: req.params.slug } });
+    if (!workspace) return res.status(404).json({ error: "Workspace not found" });
+    const links = await req.db.workspaceDlpPolicy.findMany({
+      where: { workspaceId: workspace.id },
+      include: { policy: true },
+      orderBy: { createdAt: "asc" },
+    });
+    res.json({ policies: links.map(l => ({ linkId: l.id, ...l.policy })) });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+router.post("/:slug/dlp-policies", authenticate, requireManagerOrAdmin, async (req, res) => {
+  try {
+    const workspace = await req.db.workspace.findUnique({ where: { slug: req.params.slug } });
+    if (!workspace) return res.status(404).json({ error: "Workspace not found" });
+    const policy = await req.db.dlpPolicy.findUnique({ where: { id: parseInt(req.body.policyId) } });
+    if (!policy) return res.status(404).json({ error: "Policy not found" });
+    const link = await req.db.workspaceDlpPolicy.create({
+      data: { workspaceId: workspace.id, policyId: policy.id },
+      include: { policy: true },
+    });
+    res.json({ policy: { linkId: link.id, ...link.policy } });
+  } catch (err) {
+    if (err.code === "P2002") return res.status(409).json({ error: "Policy already assigned to this workspace" });
+    res.status(500).json({ error: err.message });
+  }
+});
+
+router.delete("/:slug/dlp-policies/:linkId", authenticate, requireManagerOrAdmin, async (req, res) => {
+  try {
+    const workspace = await req.db.workspace.findUnique({ where: { slug: req.params.slug } });
+    if (!workspace) return res.status(404).json({ error: "Workspace not found" });
+    await req.db.workspaceDlpPolicy.delete({
+      where: { id: parseInt(req.params.linkId), workspaceId: workspace.id },
+    });
+    res.json({ ok: true });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+// ── Agent config (inline connector credentials) ───────────────────────────────
+
+router.get("/:slug/agent-config", authenticate, requireManagerOrAdmin, async (req, res) => {
+  try {
+    const workspace = await req.db.workspace.findUnique({ where: { slug: req.params.slug } });
+    if (!workspace) return res.status(404).json({ error: "Workspace not found" });
+    const config = (() => { try { return JSON.parse(workspace.agentConfig || "{}"); } catch { return {}; } })();
+    res.json({ config });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+router.put("/:slug/agent-config", authenticate, requireManagerOrAdmin, async (req, res) => {
+  try {
+    const workspace = await req.db.workspace.findUnique({ where: { slug: req.params.slug } });
+    if (!workspace) return res.status(404).json({ error: "Workspace not found" });
+    const { config } = req.body;
+    await req.db.workspace.update({
+      where: { slug: req.params.slug },
+      data:  { agentConfig: JSON.stringify(config) },
+    });
+    res.json({ ok: true });
+  } catch (err) { res.status(500).json({ error: err.message }); }
+});
+
+module.exports = router;

package/src/telemetry/bootstrap.js

@@ -0,0 +1,39 @@
+const fs   = require("fs");
+const path = require("path");
+const { v4: uuidv4 } = require("uuid");
+const { sendRegistration } = require("./registration");
+
+const { version } = JSON.parse(fs.readFileSync(path.resolve(__dirname, "../../../package.json"), "utf8"));
+
+module.exports = async function bootstrap(prisma) {
+  try {
+    if (process.env.LICENSE_TYPE === "enterprise") return;
+
+    const upsert = (key, value) => prisma.setting.upsert({
+      where:  { key },
+      create: { key, value },
+      update: { value },
+    });
+
+    const getSetting = (key) => prisma.setting.findUnique({ where: { key } }).then(r => r?.value ?? null);
+
+    // Generate instance ID once
+    let instanceId = await getSetting("telemetry.instanceId");
+    if (!instanceId) {
+      instanceId = uuidv4();
+      await upsert("telemetry.instanceId", instanceId);
+    }
+
+    const lastVersion = await getSetting("telemetry.lastVersion");
+
+    // Send on first boot or version upgrade
+    if (lastVersion !== version) {
+      const email = process.env.SUPER_ADMIN_EMAIL || "";
+      await sendRegistration({ email, company: "", instanceId, version, event: lastVersion ? "upgrade" : "first_boot" });
+      await upsert("telemetry.lastVersion", version);
+      console.log(`[Telemetry] Registered instance ${instanceId} v${version}`);
+    }
+  } catch (err) {
+    // never crash the server
+  }
+};

package/src/telemetry/registration.js

@@ -0,0 +1,16 @@
+const TELEMETRY_URL   = "https://script.google.com/macros/s/AKfycbxzUHUVoXFQW9Hh2cUMKeIhmNWNLPHU2nSKS_yDO3CLYNpfmvGMuyeH8Y8jypvbdAQ/exec";
+const TELEMETRY_TOKEN = "oe-reg-2026-openenthrium";
+
+async function sendRegistration({ email, company, instanceId, version, event = "first_boot" }) {
+  try {
+    await fetch(TELEMETRY_URL, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ token: TELEMETRY_TOKEN, email, company, instanceId, version, event }),
+    });
+  } catch {
+    // silent fail — never block the user
+  }
+}
+
+module.exports = { sendRegistration };

package/src/utils/activityLog.js

@@ -0,0 +1,16 @@
+async function logActivity(db, user, action, details = {}) {
+  try {
+    await db.activityLog.create({
+      data: {
+        userId:    user?.id    || null,
+        userEmail: user?.email || null,
+        action,
+        details: Object.keys(details).length > 0 ? JSON.stringify(details) : null
+      }
+    });
+  } catch (e) {
+    console.error("Activity log failed:", e.message);
+  }
+}
+
+module.exports = { logActivity };