@relaycast/engine 10.6.5 → 11.1.0

package/dist/lib/serverTelemetry.js

@@ -1,7 +1,4 @@
-import { TELEMETRY_CLOUD_ID_MAX_LENGTH, } from "@relaycast/types";
-import { eq } from "drizzle-orm";
-import { workspaces } from "../db/schema.js";
-import { extractActorIdentity, extractAgentRelayDistinctId, extractOriginActor, requiredOriginInfo, UNKNOWN_ORIGIN_ACTOR, } from "./origin.js";
+import { extractOriginActor, requiredOriginInfo, UNKNOWN_ORIGIN_ACTOR, } from "./origin.js";
 export function normalizeRoutePathForTelemetry(value) {
     const withoutQuery = value.split(/[?#]/)[0] ?? value;
     const compact = withoutQuery.replace(/\/+/g, "/").trim();
@@ -20,48 +17,6 @@ export function normalizeRoutePathForTelemetry(value) {
     });
     return `/${segments.join("/")}`;
 }
-/**
- * Load the workspace fields that carry its PostHog groups, for emitters that
- * run without an authenticated workspace in context (external webhooks, node
- * sockets). Groups are optional, so a failed lookup yields none rather than
- * dropping the event.
- */
-export async function loadTelemetryWorkspace(db, workspaceId) {
-    try {
-        const [workspace] = await db
-            .select({ id: workspaces.id, metadata: workspaces.metadata })
-            .from(workspaces)
-            .where(eq(workspaces.id, workspaceId));
-        return workspace;
-    }
-    catch (error) {
-        console.warn('[telemetry] workspace lookup failed; event sent without groups', {
-            workspace_id: workspaceId,
-            error: error instanceof Error ? error.message : String(error),
-        });
-        return undefined;
-    }
-}
-/** Sends whose first occurrence is stamped on the person via `$set_once`. */
-const SEND_EVENTS = new Set([
-    "relaycast_server_message_created",
-    "relaycast_server_thread_reply_created",
-    "relaycast_server_dm_sent",
-    "relaycast_server_group_dm_message_sent",
-]);
-/** Distinct id for events with no person; a workspace is never a person. */
-export function workspaceTelemetryDistinctId(workspaceId) {
-    return `relaycast-ws:${workspaceId}`;
-}
-function cloudId(metadata, key) {
-    const value = metadata?.[key];
-    if (typeof value !== "string")
-        return undefined;
-    const trimmed = value.trim();
-    if (!trimmed || trimmed.length > TELEMETRY_CLOUD_ID_MAX_LENGTH)
-        return undefined;
-    return trimmed;
-}
 function senderType(type) {
     if (type === "human")
         return "human";
@@ -69,45 +24,6 @@ function senderType(type) {
         return "system";
     return "agent";
 }
-function senderProperties(actor, cloudUserId) {
-    const type = senderType(actor.type);
-    return {
-        sender_type: type,
-        agent_id: actor.id,
-        agent_name: actor.name,
-        ...(type !== "human" && cloudUserId ? { agent_owner_user_id: cloudUserId } : {}),
-    };
-}
-function workspaceGroups(workspace) {
-    const organization = cloudId(workspace?.metadata, "cloud_org_id");
-    const cloudWorkspace = cloudId(workspace?.metadata, "cloud_workspace_id");
-    if (!organization && !cloudWorkspace)
-        return undefined;
-    return {
-        ...(organization ? { organization } : {}),
-        ...(cloudWorkspace ? { workspace: cloudWorkspace } : {}),
-    };
-}
-function firstSendSetOnce(sender) {
-    const now = new Date().toISOString();
-    if (sender.sender_type === "human")
-        return { first_human_message_at: now };
-    // An agent send counts toward a person only when an owner is known; system
-    // actors are not the person's agents.
-    return sender.sender_type === "agent" && sender.agent_owner_user_id
-        ? { first_agent_message_at: now }
-        : {};
-}
-/**
- * Emit a server-side product-telemetry event through the injected
- * {@link TelemetrySink}. Self-host's default sink is a no-op; cloud injects
- * PostHog. The sink owns batching/background-flush, so this returns immediately.
- *
- * The person is the acting agent's `metadata.cloud_user_id` (a human, or the
- * owner of an agent), else the caller-declared user/client id, else the
- * workspace with person processing off. The workspace's cloud org and
- * workspace ids become PostHog groups.
- */
 export function emitServerEvent(c, workspaceId, event, properties, attribution = {}) {
     const normalizedProperties = { ...properties };
     // The `workspaceId` argument is authoritative; a caller value must not
@@ -120,50 +36,36 @@ export function emitServerEvent(c, workspaceId, event, properties, attribution =
     // header directly so emitters that bypass middleware still get a sane value.
     const originActor = c.get("originActor") ?? extractOriginActor(c.req.raw) ?? UNKNOWN_ORIGIN_ACTOR;
     const origin = requiredOriginInfo(c.req.raw);
-    const clientDistinctId = extractAgentRelayDistinctId(c.req.raw);
-    // Caller-declared user/org. Analytics dimensions only — never authorization.
-    const actor = extractActorIdentity(c.req.raw);
     // Context rows belong to the authenticated token; an event about another
     // workspace (e.g. one just created) must not inherit them.
     const contextAgent = c.get("agent");
-    const contextWorkspace = c.get("workspace");
     const actingAgent = attribution.actor ??
         (contextAgent?.workspaceId === workspaceId ? contextAgent : undefined);
-    const workspace = attribution.workspace ??
-        (contextWorkspace?.id === workspaceId ? contextWorkspace : undefined);
-    const cloudUserId = actingAgent
-        ? cloudId(actingAgent.metadata, "cloud_user_id")
-        : undefined;
-    const sender = actingAgent
-        ? senderProperties(actingAgent, cloudUserId)
-        : undefined;
-    // `client_distinct_id` is already the user id when the CLI is signed in; the
-    // explicit user header covers callers that send only one of the two.
-    const personId = cloudUserId ?? actor.actor_user_id ?? clientDistinctId;
-    const groups = workspaceGroups(workspace);
-    const setOnce = personId && sender && SEND_EVENTS.has(event)
-        ? firstSendSetOnce(sender)
-        : {};
-    c.get("engine").telemetry.capture({
-        name: event,
-        distinctId: personId ?? workspaceTelemetryDistinctId(workspaceId),
-        ...(personId ? {} : { processPersonProfile: false }),
-        ...(groups ? { groups } : {}),
-        ...(Object.keys(setOnce).length > 0 ? { setOnce } : {}),
-        properties: {
-            app: "relaycast-server",
-            surface: "cloud",
-            // Early, so the sink's 64-property cap can never truncate it away.
-            workspace_id: workspaceId,
-            ...(clientDistinctId ? { client_distinct_id: clientDistinctId } : {}),
-            is_authenticated: Boolean(actor.actor_user_id),
-            ...actor,
-            ...sender,
-            origin_actor: originActor,
-            origin_client: origin.origin_client,
-            origin_version: origin.origin_version,
-            ...normalizedProperties,
-        },
-    });
+    const sender = actingAgent ? { id: actingAgent.id, name: actingAgent.name, type: senderType(actingAgent.type) } : undefined;
+    // Only the credential-authenticated agent can establish ownership. A node
+    // may name any workspace agent as `from`; loading that sender's row proves
+    // neither possession of its token nor any external ownership.
+    const scopedActor = contextAgent?.workspaceId === workspaceId ? contextAgent : undefined;
+    // Neither synchronous throws nor asynchronous rejections may change a domain outcome.
+    try {
+        const pending = c.get("engine").telemetry.capture({
+            kind: event,
+            occurredAt: new Date().toISOString(),
+            workspaceId,
+            ...(scopedActor ? { authenticatedActor: {
+                    agentId: scopedActor.id,
+                    credentialHash: c.get('agentCredentialHash'),
+                    type: senderType(scopedActor.type),
+                } } : {}),
+            ...(sender ? { sender } : {}),
+            origin: { actor: originActor, client: origin.origin_client, version: origin.origin_version },
+            facts: normalizedProperties,
+        });
+        if (pending)
+            void Promise.resolve(pending).catch(() => { });
+    }
+    catch {
+        // Host observation is best effort.
+    }
 }
 //# sourceMappingURL=serverTelemetry.js.map

package/dist/lib/serverTelemetry.js.map

@@ -1 +1 @@
-{"version":3,"file":"serverTelemetry.js","sourceRoot":"","sources":["../../src/lib/serverTelemetry.ts"],"names":[],"mappings":"AACA,OAAO,EACL,6BAA6B,GAO9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,UAAU,EAAe,MAAM,iBAAiB,CAAC;AAG1D,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAqBrB,MAAM,UAAU,8BAA8B,CAAC,KAAa;IAC1D,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IACrD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,MAAM,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAG,gBAAgB;SAC9B,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACf,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,IACE,4EAA4E,CAAC,IAAI,CAC/E,OAAO,CACR;YAED,OAAO,KAAK,CAAC;QACf,IAAI,0CAA0C,CAAC,IAAI,CAAC,OAAO,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IACL,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAClC,CAAC;AAwBD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,EAAY,EACZ,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,CAAC,SAAS,CAAC,GAAG,MAAM,EAAE;aACzB,MAAM,CAAC,EAAE,EAAE,EAAE,UAAU,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,QAAQ,EAAE,CAAC;aAC5D,IAAI,CAAC,UAAU,CAAC;aAChB,KAAK,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;QACzC,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,gEAAgE,EAAE;YAC7E,YAAY,EAAE,WAAW;YACzB,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;SAC9D,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,WAAW,GAA0C,IAAI,GAAG,CAAC;IACjE,kCAAkC;IAClC,uCAAuC;IACvC,0BAA0B;IAC1B,wCAAwC;CACzC,CAAC,CAAC;AAEH,4EAA4E;AAC5E,MAAM,UAAU,4BAA4B,CAAC,WAAmB;IAC9D,OAAO,gBAAgB,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,SAAS,OAAO,CACd,QAAoD,EACpD,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,GAAG,6BAA6B;QAAE,OAAO,SAAS,CAAC;IACjF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACrC,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACvC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAqB,EACrB,WAA+B;IAE/B,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpC,OAAO;QACL,WAAW,EAAE,IAAI;QACjB,QAAQ,EAAE,KAAK,CAAC,EAAE;QAClB,UAAU,EAAE,KAAK,CAAC,IAAI;QACtB,GAAG,CAAC,IAAI,KAAK,OAAO,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CACtB,SAAyC;IAEzC,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,oBAAoB,CAAC,CAAC;IAC1E,IAAI,CAAC,YAAY,IAAI,CAAC,cAAc;QAAE,OAAO,SAAS,CAAC;IACvD,OAAO;QACL,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,MAAiC;IAEjC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,IAAI,MAAM,CAAC,WAAW,KAAK,OAAO;QAAE,OAAO,EAAE,sBAAsB,EAAE,GAAG,EAAE,CAAC;IAC3E,2EAA2E;IAC3E,sCAAsC;IACtC,OAAO,MAAM,CAAC,WAAW,KAAK,OAAO,IAAI,MAAM,CAAC,mBAAmB;QACjE,CAAC,CAAC,EAAE,sBAAsB,EAAE,GAAG,EAAE;QACjC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,CAAkB,EAClB,WAAmB,EACnB,KAAQ,EACR,UAAoC,EACpC,cAAsC,EAAE;IAExC,MAAM,oBAAoB,GAA4B,EAAE,GAAG,UAAU,EAAE,CAAC;IACxE,uEAAuE;IACvE,cAAc;IACd,OAAO,oBAAoB,CAAC,YAAY,CAAC;IACzC,IAAI,OAAO,oBAAoB,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACxD,oBAAoB,CAAC,UAAU,GAAG,8BAA8B,CAC9D,oBAAoB,CAAC,UAAU,CAChC,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAM,WAAW,GACf,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,oBAAoB,CAAC;IAEhF,MAAM,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7C,MAAM,gBAAgB,GAAG,2BAA2B,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAChE,6EAA6E;IAC7E,MAAM,KAAK,GAAG,oBAAoB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAE9C,yEAAyE;IACzE,2DAA2D;IAC3D,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,gBAAgB,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAC5C,MAAM,WAAW,GACf,WAAW,CAAC,KAAK;QACjB,CAAC,YAAY,EAAE,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACzE,MAAM,SAAS,GACb,WAAW,CAAC,SAAS;QACrB,CAAC,gBAAgB,EAAE,EAAE,KAAK,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAExE,MAAM,WAAW,GAAG,WAAW;QAC7B,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,EAAE,eAAe,CAAC;QAChD,CAAC,CAAC,SAAS,CAAC;IACd,MAAM,MAAM,GAAG,WAAW;QACxB,CAAC,CAAC,gBAAgB,CAAC,WAAW,EAAE,WAAW,CAAC;QAC5C,CAAC,CAAC,SAAS,CAAC;IACd,6EAA6E;IAC7E,qEAAqE;IACrE,MAAM,QAAQ,GAAG,WAAW,IAAI,KAAK,CAAC,aAAa,IAAI,gBAAgB,CAAC;IACxE,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,OAAO,GACX,QAAQ,IAAI,MAAM,IAAI,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC;QAC1C,CAAC,CAAC,gBAAgB,CAAC,MAAM,CAAC;QAC1B,CAAC,CAAC,EAAE,CAAC;IAET,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC;QAChC,IAAI,EAAE,KAAK;QACX,UAAU,EAAE,QAAQ,IAAI,4BAA4B,CAAC,WAAW,CAAC;QACjE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,KAAK,EAAE,CAAC;QACpD,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,UAAU,EAAE;YACV,GAAG,EAAE,kBAAkB;YACvB,OAAO,EAAE,OAAO;YAChB,mEAAmE;YACnE,YAAY,EAAE,WAAW;YACzB,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,gBAAgB,EAAE,OAAO,CAAC,KAAK,CAAC,aAAa,CAAC;YAC9C,GAAG,KAAK;YACR,GAAG,MAAM;YACT,YAAY,EAAE,WAAW;YACzB,aAAa,EAAE,MAAM,CAAC,aAAa;YACnC,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,GAAG,oBAAoB;SACxB;KACF,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"serverTelemetry.js","sourceRoot":"","sources":["../../src/lib/serverTelemetry.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,oBAAoB,GACrB,MAAM,aAAa,CAAC;AAErB,MAAM,UAAU,8BAA8B,CAAC,KAAa;IAC1D,MAAM,YAAY,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IACrD,MAAM,OAAO,GAAG,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACzD,MAAM,gBAAgB,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;IAC3E,MAAM,QAAQ,GAAG,gBAAgB;SAC9B,KAAK,CAAC,GAAG,CAAC;SACV,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QACf,IAAI,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3C,IACE,4EAA4E,CAAC,IAAI,CAC/E,OAAO,CACR;YAED,OAAO,KAAK,CAAC;QACf,IAAI,0CAA0C,CAAC,IAAI,CAAC,OAAO,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,OAAO,OAAO,CAAC;IACjB,CAAC,CAAC,CAAC;IACL,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;AAClC,CAAC;AAaD,SAAS,UAAU,CAAC,IAAY;IAC9B,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACrC,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACvC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,eAAe,CAC7B,CAAkB,EAClB,WAAmB,EACnB,KAAQ,EACR,UAAqC,EACrC,cAAsC,EAAE;IAExC,MAAM,oBAAoB,GAA4B,EAAE,GAAG,UAAU,EAAE,CAAC;IACxE,uEAAuE;IACvE,cAAc;IACd,OAAO,oBAAoB,CAAC,YAAY,CAAC;IACzC,IAAI,OAAO,oBAAoB,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QACxD,oBAAoB,CAAC,UAAU,GAAG,8BAA8B,CAC9D,oBAAoB,CAAC,UAAU,CAChC,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,6EAA6E;IAC7E,MAAM,WAAW,GACf,CAAC,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,oBAAoB,CAAC;IAEhF,MAAM,MAAM,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAE7C,yEAAyE;IACzE,2DAA2D;IAC3D,MAAM,YAAY,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACpC,MAAM,WAAW,GACf,WAAW,CAAC,KAAK;QACjB,CAAC,YAAY,EAAE,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAGzE,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,WAAW,CAAC,EAAE,EAAE,IAAI,EAAE,WAAW,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5H,0EAA0E;IAC1E,2EAA2E;IAC3E,8DAA8D;IAC9D,MAAM,WAAW,GAAG,YAAY,EAAE,WAAW,KAAK,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IAEzF,sFAAsF;IACtF,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC;YAChD,IAAI,EAAE,KAAK;YACX,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACpC,WAAW;YACX,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE;oBACtC,OAAO,EAAE,WAAW,CAAC,EAAE;oBACvB,cAAc,EAAE,CAAC,CAAC,GAAG,CAAC,qBAAqB,CAAC;oBAC5C,IAAI,EAAE,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC;iBACnC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACT,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,MAAM,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,CAAC,aAAa,EAAE,OAAO,EAAE,MAAM,CAAC,cAAc,EAAE;YAE5F,KAAK,EAAE,oBAAiD;SACpC,CAAC,CAAC;QACxB,IAAI,OAAO;YAAE,KAAK,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,mCAAmC;IACrC,CAAC;AACH,CAAC"}

package/dist/middleware/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAKxC,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAyC7C,UAAU,oBAAoB;IAC5B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAMD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,aAAa,GAAG,aAAa,EAAE,EACvC,OAAO,GAAE,oBAAyB,kEAuDnC;AAED,gDAAgD;AAChD,eAAO,MAAM,mBAAmB,gEAAkC,CAAC;AAEnE,wDAAwD;AACxD,eAAO,MAAM,WAAW,gEAA4B,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,aAAa,gEAA+B,CAAC;AAE1D,+CAA+C;AAC/C,eAAO,MAAM,iBAAiB,gEAA8B,CAAC;AAE7D,6CAA6C;AAC7C,eAAO,MAAM,gBAAgB,gEAA6B,CAAC"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAMxC,OAAO,EAEL,KAAK,aAAa,EACnB,MAAM,4BAA4B,CAAC;AAIpC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAgD7C,UAAU,oBAAoB;IAC5B,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAMD,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,aAAa,GAAG,aAAa,EAAE,EACvC,OAAO,GAAE,oBAAyB,kEAyDnC;AAED,gDAAgD;AAChD,eAAO,MAAM,mBAAmB,gEAAkC,CAAC;AAEnE,wDAAwD;AACxD,eAAO,MAAM,WAAW,gEAA4B,CAAC;AAErD;;;;GAIG;AACH,eAAO,MAAM,aAAa,gEAA+B,CAAC;AAE1D,+CAA+C;AAC/C,eAAO,MAAM,iBAAiB,gEAA8B,CAAC;AAE7D,6CAA6C;AAC7C,eAAO,MAAM,gBAAgB,gEAA6B,CAAC"}

package/dist/middleware/auth.js

@@ -3,6 +3,7 @@ import { touchLastSeen } from '../engine/agent.js';
 import { getAuthTokenKind } from '../auth/tokenKind.js';
 import { authenticateUnexpired } from '../auth/workspaceExpiry.js';
 import { jsonError } from '../lib/httpResponse.js';
+import { sha256Hex } from '../lib/crypto.js';
 import { hasAnyObserverScope, } from '../engine/observerToken.js';
 // Re-exported for the WS upgrade, which looks tokens up
 // directly. The active provider's `hashToken` is preferred at those call sites.
@@ -13,6 +14,16 @@ function extractToken(authHeader) {
         return null;
     return authHeader.slice(7);
 }
+async function presentedCredentialHash(token) {
+    // AuthProvider.hashToken describes storage, and may return a raw token.
+    // Telemetry provenance always uses its own irreversible SHA-256 digest.
+    try {
+        return await sha256Hex(token);
+    }
+    catch {
+        return undefined;
+    }
+}
 function makeAuthMiddleware(require) {
     return createMiddleware(async (c, next) => {
         const token = extractToken(c.req.header('Authorization'));
@@ -25,6 +36,7 @@ function makeAuthMiddleware(require) {
             return jsonError(c, result.code, result.message, result.status);
         }
         c.set('workspace', result.workspace);
+        c.set('agentCredentialHash', result.agent ? await presentedCredentialHash(token) : undefined);
         if (result.agent) {
             c.set('agent', result.agent);
             // Touch lastSeen (debounced, fire-and-forget)
@@ -69,6 +81,7 @@ export function requireWorkspaceRead(scopes, options = {}) {
             }
             c.set('workspace', result.workspace);
             c.set('agent', undefined);
+            c.set('agentCredentialHash', undefined);
             c.set('node', undefined);
             c.set('observerToken', result.observerToken);
             await next();
@@ -81,6 +94,7 @@ export function requireWorkspaceRead(scopes, options = {}) {
             return jsonError(c, 'forbidden', 'Node token cannot access this resource', 403);
         }
         c.set('workspace', result.workspace);
+        c.set('agentCredentialHash', result.agent ? await presentedCredentialHash(token) : undefined);
         if (result.agent) {
             c.set('agent', result.agent);
             if (Date.now() - result.agent.lastSeen.getTime() > LAST_SEEN_DEBOUNCE_MS) {

package/dist/middleware/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EACL,mBAAmB,GAEpB,MAAM,4BAA4B,CAAC;AAEpC,wDAAwD;AACxD,gFAAgF;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,MAAM,qBAAqB,GAAG,MAAM,CAAC,CAAC,aAAa;AAEnD,SAAS,YAAY,CAAC,UAA8B;IAClD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAoB;IAC9C,OAAO,gBAAgB,CAAS,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAChD,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,CAAC,EAAE,cAAc,EAAE,yCAAyC,EAAE,GAAG,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAA8B,CAAC,CAAC;QAC1F,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7B,8CAA8C;YAC9C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,qBAAqB,EAAE,CAAC;gBACzE,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzB,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,SAAS,WAAW,CAAC,MAAuC;IAC1D,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAuC,EACvC,UAAgC,EAAE;IAElC,MAAM,cAAc,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;IAE5C,OAAO,gBAAgB,CAAS,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAChD,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,CAAC,EAAE,cAAc,EAAE,yCAAyC,EAAE,GAAG,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,OAAO,GAAgB,gBAAgB,CAAC,KAAK,CAAC,KAAK,UAAU;YACjE,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,UAAU,IAAI,SAAS;gBACvB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,WAAW,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAA8B,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzB,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC;gBAC/D,OAAO,SAAS,CAAC,CAAC,EAAE,oBAAoB,EAAE,yCAAyC,EAAE,GAAG,CAAC,CAAC;YAC5F,CAAC;YACD,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACrC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC1B,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACzB,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;YAC7C,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YAChC,OAAO,SAAS,CAAC,CAAC,EAAE,WAAW,EAAE,yCAAyC,EAAE,GAAG,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC,CAAC,EAAE,WAAW,EAAE,wCAAwC,EAAE,GAAG,CAAC,CAAC;QAClF,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACrC,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,qBAAqB,EAAE,CAAC;gBACzE,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;AAEnE,wDAAwD;AACxD,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;AAE1D,+CAA+C;AAC/C,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAE7D,6CAA6C;AAC7C,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/middleware/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAEhD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAGnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AACnE,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EACL,mBAAmB,GAEpB,MAAM,4BAA4B,CAAC;AAEpC,wDAAwD;AACxD,gFAAgF;AAChF,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAE7C,MAAM,qBAAqB,GAAG,MAAM,CAAC,CAAC,aAAa;AAEnD,SAAS,YAAY,CAAC,UAA8B;IAClD,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,IAAI,CAAC;IACpD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,KAAa;IAClD,wEAAwE;IACxE,wEAAwE;IACxE,IAAI,CAAC;QAAC,OAAO,MAAM,SAAS,CAAC,KAAK,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,SAAS,CAAC;IAAC,CAAC;AACpE,CAAC;AAED,SAAS,kBAAkB,CAAC,OAAoB;IAC9C,OAAO,gBAAgB,CAAS,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAChD,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,CAAC,EAAE,cAAc,EAAE,yCAAyC,EAAE,GAAG,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAA8B,CAAC,CAAC;QAC1F,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9F,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7B,8CAA8C;YAC9C,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,qBAAqB,EAAE,CAAC;gBACzE,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzB,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;QAC/C,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAOD,SAAS,WAAW,CAAC,MAAuC;IAC1D,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,oBAAoB,CAClC,MAAuC,EACvC,UAAgC,EAAE;IAElC,MAAM,cAAc,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3C,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,IAAI,CAAC;IAC9C,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC;IAE5C,OAAO,gBAAgB,CAAS,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAChD,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QAC1D,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,SAAS,CAAC,CAAC,EAAE,cAAc,EAAE,yCAAyC,EAAE,GAAG,CAAC,CAAC;QACtF,CAAC;QAED,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,OAAO,GAAgB,gBAAgB,CAAC,KAAK,CAAC,KAAK,UAAU;YACjE,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,UAAU,IAAI,SAAS;gBACvB,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,WAAW,CAAC;QAClB,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,MAA8B,CAAC,CAAC;QAC1F,CAAC;QAED,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACzB,IAAI,CAAC,mBAAmB,CAAC,MAAM,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,CAAC;gBAC/D,OAAO,SAAS,CAAC,CAAC,EAAE,oBAAoB,EAAE,yCAAyC,EAAE,GAAG,CAAC,CAAC;YAC5F,CAAC;YACD,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACrC,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAC1B,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,SAAS,CAAC,CAAC;YACxC,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YACzB,CAAC,CAAC,GAAG,CAAC,eAAe,EAAE,MAAM,CAAC,aAAa,CAAC,CAAC;YAC7C,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QAED,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,CAAC;YAChC,OAAO,SAAS,CAAC,CAAC,EAAE,WAAW,EAAE,yCAAyC,EAAE,GAAG,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YAC9B,OAAO,SAAS,CAAC,CAAC,EAAE,WAAW,EAAE,wCAAwC,EAAE,GAAG,CAAC,CAAC;QAClF,CAAC;QAED,CAAC,CAAC,GAAG,CAAC,WAAW,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;QACrC,CAAC,CAAC,GAAG,CAAC,qBAAqB,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QAC9F,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,CAAC,CAAC,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;YAC7B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,EAAE,GAAG,qBAAqB,EAAE,CAAC;gBACzE,aAAa,CAAC,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YAChB,CAAC,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,MAAM,mBAAmB,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;AAEnE,wDAAwD;AACxD,MAAM,CAAC,MAAM,WAAW,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC;AAErD;;;;GAIG;AACH,MAAM,CAAC,MAAM,aAAa,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;AAE1D,+CAA+C;AAC/C,MAAM,CAAC,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;AAE7D,6CAA6C;AAC7C,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC"}

package/dist/middleware/planLimits.d.ts

@@ -1,5 +1,36 @@
+import type { Context } from 'hono';
 import type { AppEnv } from '../env.js';
 import type { UsageMetric } from '../ports/entitlements.js';
 export { PLAN_LIMITS } from '../providers/static-entitlements.js';
 export declare function checkPlanLimit(metric: UsageMetric): import("hono").MiddlewareHandler<AppEnv, string, {}, Response>;
+/**
+ * Enforce a plan's one-time `lifetime_messages` allowance on message sends.
+ *
+ * Mounted after `rateLimit` on the routes that create a message (channel post,
+ * DM, group DM, thread reply). Plans without a finite allowance — every tier
+ * except a hosted anonymous trial, and always `selfhost` — skip it without
+ * touching the counter. The allowance never resets, so the 429 carries no
+ * `Retry-After`: retrying cannot clear it; signing in or upgrading does.
+ *
+ * Idempotency is preserved. Only a fresh send that succeeds (2xx without
+ * `Idempotency-Replayed`) is counted, so retries never spend the allowance.
+ * Once the allowance is spent, a request without an `Idempotency-Key` is
+ * refused here; a keyed request reaches the route so a replay of an earlier
+ * successful send still returns its stored receipt, and the route refuses only
+ * a fresh send ({@link assertMessageAllowance}, called inside the idempotent
+ * operation).
+ *
+ * The count is kept alive past the response with `runInBackground`
+ * (`waitUntil` on Workers). Check-then-count is not atomic: concurrent sends at
+ * the boundary can overshoot by the number in flight, which a soft trial
+ * allowance tolerates. Fails open on entitlement or counter errors, matching
+ * `checkPlanLimit`.
+ */
+export declare const checkMessageAllowance: import("hono").MiddlewareHandler<AppEnv, string, {}, Response>;
+/**
+ * Refuse a fresh send when `checkMessageAllowance` found the allowance spent.
+ * Call it first inside a message route's idempotent `operation`, which runs
+ * only for a new send — never for a replay of a stored receipt.
+ */
+export declare function assertMessageAllowance(c: Context<AppEnv>): void;
 //# sourceMappingURL=planLimits.d.ts.map

package/dist/middleware/planLimits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"planLimits.d.ts","sourceRoot":"","sources":["../../src/middleware/planLimits.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,KAAK,EAAwB,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAMlF,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAmBlE,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,kEA+BjD"}
+{"version":3,"file":"planLimits.d.ts","sourceRoot":"","sources":["../../src/middleware/planLimits.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAEpC,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACxC,OAAO,KAAK,EAAyC,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAQnG,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAwElE,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,kEAuCjD;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,eAAO,MAAM,qBAAqB,gEA0ChC,CAAC;AAEH;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,GAAG,IAAI,CAG/D"}

package/dist/middleware/planLimits.js

@@ -1,7 +1,8 @@
 import { createMiddleware } from 'hono/factory';
-import { usagePeriodResetAt } from '../engine/usage.js';
-import { jsonError } from '../lib/httpResponse.js';
+import { getLifetimeUsageMetric, incrementLifetimeUsage, usagePeriodResetAt } from '../engine/usage.js';
 import { setRetryContract } from '../lib/throttle.js';
+import { PlanLimitExceededError } from '../lib/planLimitError.js';
+import { runInBackground } from '../routes/background.js';
 // Re-exported for back-compat with callers/tests that imported the table here.
 export { PLAN_LIMITS } from '../providers/static-entitlements.js';
 /**
@@ -18,6 +19,49 @@ async function resolveUsageResetAt(entitlements, workspaceId, metric) {
     catch { /* fall through to the engine period */ }
     return usagePeriodResetAt();
 }
+/**
+ * Where the caller can lift the limit. Advisory only: an absent or failing hook,
+ * or a non-absolute URL, omits the guidance and never changes the decision.
+ */
+async function resolveUpgradeGuidance(entitlements, workspace, metric) {
+    try {
+        const guidance = await entitlements.getUpgradeGuidance?.(workspace, metric);
+        if (!guidance || typeof guidance.url !== 'string')
+            return null;
+        const url = new URL(guidance.url);
+        if (url.protocol !== 'https:' && url.protocol !== 'http:')
+            return null;
+        return guidance;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * The `plan_limit_exceeded` body. The envelope stays `{ ok, error: { code,
+ * message } }`; `metric`, `limit`, `usage`, `plan` and — when the host knows
+ * one — `upgrade_url` / `upgrade_action` are additive fields on `error` so a
+ * client can render "sign in" or "upgrade" without parsing the message.
+ */
+function planLimitExceededBody(input) {
+    const { guidance } = input;
+    const nextStep = guidance
+        ? `${guidance.hint ?? (guidance.action === 'sign_in' ? 'Sign in to keep going:' : 'Upgrade your plan to increase limits:')} ${guidance.url}`
+        : 'Upgrade your plan to increase limits.';
+    return {
+        ok: false,
+        error: {
+            code: 'plan_limit_exceeded',
+            message: `${input.message} ${nextStep}`,
+            metric: input.metric,
+            plan: input.plan,
+            limit: input.limit,
+            usage: input.usage,
+            upgrade_url: guidance?.url ?? null,
+            upgrade_action: guidance?.action ?? null,
+        },
+    };
+}
 export function checkPlanLimit(metric) {
     return createMiddleware(async (c, next) => {
         const workspace = c.get('workspace');
@@ -42,17 +86,105 @@ export function checkPlanLimit(metric) {
         try {
             const current = await entitlements.getUsage(workspace.id, metric);
             if (current >= limit) {
-                const plan = workspace.plan || 'free';
+                const guidance = await resolveUpgradeGuidance(entitlements, workspace, metric);
+                const plan = guidance?.plan ?? (workspace.plan || 'free');
                 // Quota clears on the billing period, not on a backoff. Advertising the
                 // real reset lets a caller with a bounded retry budget fail fast instead
                 // of spending it on a condition retrying cannot fix.
                 const resetAt = await resolveUsageResetAt(entitlements, workspace.id, metric);
                 setRetryContract(c, resetAt);
-                return jsonError(c, 'plan_limit_exceeded', `Plan limit exceeded for ${metric}. Current plan: ${plan}. Limit: ${limit} per usage period. Current usage: ${current}. Quota resets at ${new Date(resetAt).toISOString()}. Upgrade your plan to increase limits.`, 429);
+                return c.json(planLimitExceededBody({
+                    metric,
+                    plan,
+                    limit,
+                    usage: current,
+                    message: `Plan limit exceeded for ${metric}. Current plan: ${plan}. Limit: ${limit} per usage period. Current usage: ${current}. Quota resets at ${new Date(resetAt).toISOString()}.`,
+                    guidance,
+                }), 429);
             }
         }
         catch { /* fail open */ }
         await next();
     });
 }
+/**
+ * Enforce a plan's one-time `lifetime_messages` allowance on message sends.
+ *
+ * Mounted after `rateLimit` on the routes that create a message (channel post,
+ * DM, group DM, thread reply). Plans without a finite allowance — every tier
+ * except a hosted anonymous trial, and always `selfhost` — skip it without
+ * touching the counter. The allowance never resets, so the 429 carries no
+ * `Retry-After`: retrying cannot clear it; signing in or upgrading does.
+ *
+ * Idempotency is preserved. Only a fresh send that succeeds (2xx without
+ * `Idempotency-Replayed`) is counted, so retries never spend the allowance.
+ * Once the allowance is spent, a request without an `Idempotency-Key` is
+ * refused here; a keyed request reaches the route so a replay of an earlier
+ * successful send still returns its stored receipt, and the route refuses only
+ * a fresh send ({@link assertMessageAllowance}, called inside the idempotent
+ * operation).
+ *
+ * The count is kept alive past the response with `runInBackground`
+ * (`waitUntil` on Workers). Check-then-count is not atomic: concurrent sends at
+ * the boundary can overshoot by the number in flight, which a soft trial
+ * allowance tolerates. Fails open on entitlement or counter errors, matching
+ * `checkPlanLimit`.
+ */
+export const checkMessageAllowance = createMiddleware(async (c, next) => {
+    const workspace = c.get('workspace');
+    if (!workspace) {
+        await next();
+        return;
+    }
+    const { entitlements, kv } = c.get('engine');
+    let allowance;
+    try {
+        allowance = (await entitlements.getLimits(workspace)).lifetime_messages;
+    }
+    catch {
+        await next();
+        return;
+    }
+    if (typeof allowance !== 'number' || !Number.isFinite(allowance)) {
+        await next();
+        return;
+    }
+    let used;
+    try {
+        used = await getLifetimeUsageMetric(kv, workspace.id, 'messages');
+    }
+    catch {
+        await next();
+        return;
+    }
+    if (used >= allowance) {
+        const guidance = await resolveUpgradeGuidance(entitlements, workspace, 'messages');
+        const plan = guidance?.plan ?? (workspace.plan || 'free');
+        const body = planLimitExceededBody({
+            metric: 'messages',
+            plan,
+            limit: allowance,
+            usage: used,
+            message: `Message allowance used up: this workspace has sent ${used} of its ${allowance} messages (current plan: ${plan}). The allowance does not reset.`,
+            guidance,
+        });
+        if (!c.req.header('Idempotency-Key'))
+            return c.json(body, 429);
+        c.set('messageAllowanceDenial', body);
+    }
+    await next();
+    if (c.res.status >= 200 && c.res.status < 300 && c.res.headers.get('Idempotency-Replayed') !== 'true') {
+        runInBackground(c, incrementLifetimeUsage(kv, workspace.id, 'messages'), 'lifetime message usage increment');
+    }
+});
+/**
+ * Refuse a fresh send when `checkMessageAllowance` found the allowance spent.
+ * Call it first inside a message route's idempotent `operation`, which runs
+ * only for a new send — never for a replay of a stored receipt.
+ */
+export function assertMessageAllowance(c) {
+    const denial = c.get('messageAllowanceDenial');
+    if (denial)
+        throw new PlanLimitExceededError(denial);
+}
 //# sourceMappingURL=planLimits.js.map

package/dist/middleware/planLimits.js.map

@@ -1 +1 @@
-{"version":3,"file":"planLimits.js","sourceRoot":"","sources":["../../src/middleware/planLimits.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAGhD,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAEtD,+EAA+E;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAElE;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAChC,YAAkC,EAClC,WAAmB,EACnB,MAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC,CAAC,uCAAuC,CAAC,CAAC;IACnD,OAAO,kBAAkB,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAmB;IAChD,OAAO,gBAAgB,CAAS,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAChD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS,EAAE,CAAC;YAAC,MAAM,IAAI,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAEzC,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YAAC,MAAM,IAAI,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAE9E,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAClE,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;gBACrB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,IAAI,MAAM,CAAC;gBACtC,wEAAwE;gBACxE,yEAAyE;gBACzE,qDAAqD;gBACrD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBAC9E,gBAAgB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBAC7B,OAAO,SAAS,CAAC,CAAC,EAAE,qBAAqB,EAAE,2BAA2B,MAAM,mBAAmB,IAAI,YAAY,KAAK,qCAAqC,OAAO,qBAAqB,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,yCAAyC,EAAE,GAAG,CAAC,CAAC;YACtQ,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;QAE3B,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"planLimits.js","sourceRoot":"","sources":["../../src/middleware/planLimits.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAIhD,OAAO,EAAE,sBAAsB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxG,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,sBAAsB,EAA8B,MAAM,0BAA0B,CAAC;AAC9F,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1D,+EAA+E;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,qCAAqC,CAAC;AAElE;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAChC,YAAkC,EAClC,WAAmB,EACnB,MAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,eAAe,EAAE,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAC3E,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC;YAAE,OAAO,QAAQ,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC,CAAC,uCAAuC,CAAC,CAAC;IACnD,OAAO,kBAAkB,EAAE,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,sBAAsB,CACnC,YAAkC,EAClC,SAAoB,EACpB,MAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,kBAAkB,EAAE,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QAC5E,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC/D,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClC,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,IAAI,CAAC;QACvE,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,KAO9B;IACC,MAAM,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;IAC3B,MAAM,QAAQ,GAAG,QAAQ;QACvB,CAAC,CAAC,GAAG,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,uCAAuC,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE;QAC5I,CAAC,CAAC,uCAAuC,CAAC;IAC5C,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE;YACL,IAAI,EAAE,qBAAqB;YAC3B,OAAO,EAAE,GAAG,KAAK,CAAC,OAAO,IAAI,QAAQ,EAAE;YACvC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,KAAK,EAAE,KAAK,CAAC,KAAK;YAClB,WAAW,EAAE,QAAQ,EAAE,GAAG,IAAI,IAAI;YAClC,cAAc,EAAE,QAAQ,EAAE,MAAM,IAAI,IAAI;SACzC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,MAAmB;IAChD,OAAO,gBAAgB,CAAS,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QAChD,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,SAAS,EAAE,CAAC;YAAC,MAAM,IAAI,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAEzC,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACzC,IAAI,MAAM,CAAC;QACX,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACT,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YAAC,MAAM,IAAI,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAE9E,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;YAClE,IAAI,OAAO,IAAI,KAAK,EAAE,CAAC;gBACrB,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,YAAY,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;gBAC/E,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC;gBAC1D,wEAAwE;gBACxE,yEAAyE;gBACzE,qDAAqD;gBACrD,MAAM,OAAO,GAAG,MAAM,mBAAmB,CAAC,YAAY,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC;gBAC9E,gBAAgB,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;gBAC7B,OAAO,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC;oBAClC,MAAM;oBACN,IAAI;oBACJ,KAAK;oBACL,KAAK,EAAE,OAAO;oBACd,OAAO,EAAE,2BAA2B,MAAM,mBAAmB,IAAI,YAAY,KAAK,qCAAqC,OAAO,qBAAqB,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,GAAG;oBACrL,QAAQ;iBACT,CAAC,EAAE,GAAG,CAAC,CAAC;YACX,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,eAAe,CAAC,CAAC;QAE3B,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,gBAAgB,CAAS,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;IAC9E,MAAM,SAAS,GAAG,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,IAAI,CAAC,SAAS,EAAE,CAAC;QAAC,MAAM,IAAI,EAAE,CAAC;QAAC,OAAO;IAAC,CAAC;IAEzC,MAAM,EAAE,YAAY,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7C,IAAI,SAA6B,CAAC;IAClC,IAAI,CAAC;QACH,SAAS,GAAG,CAAC,MAAM,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,iBAAiB,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IACD,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAAC,MAAM,IAAI,EAAE,CAAC;QAAC,OAAO;IAAC,CAAC;IAE3F,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,sBAAsB,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,EAAE,CAAC;QACb,OAAO;IACT,CAAC;IAED,IAAI,IAAI,IAAI,SAAS,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,YAAY,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QACnF,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,IAAI,MAAM,CAAC,CAAC;QAC1D,MAAM,IAAI,GAAG,qBAAqB,CAAC;YACjC,MAAM,EAAE,UAAU;YAClB,IAAI;YACJ,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,sDAAsD,IAAI,WAAW,SAAS,4BAA4B,IAAI,kCAAkC;YACzJ,QAAQ;SACT,CAAC,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,iBAAiB,CAAC;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,IAAI,EAAE,CAAC;IAEb,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,KAAK,MAAM,EAAE,CAAC;QACtG,eAAe,CAAC,CAAC,EAAE,sBAAsB,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,UAAU,CAAC,EAAE,kCAAkC,CAAC,CAAC;IAC/G,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,CAAkB;IACvD,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;IAC/C,IAAI,MAAM;QAAE,MAAM,IAAI,sBAAsB,CAAC,MAAM,CAAC,CAAC;AACvD,CAAC"}

package/dist/ports/entitlements.d.ts

@@ -8,6 +8,29 @@ export interface PlanLimits {
     api_calls: number;
     /** Global requests-per-minute ceiling, fed into the rate limiter. */
     rate_per_min: number;
+    /**
+     * One-time message allowance that never resets. When set to a finite number,
+     * message sends (channel posts, DMs, group DMs, thread replies) are refused
+     * with `plan_limit_exceeded` once the workspace has sent this many messages
+     * over its whole lifetime. Unset (or `Infinity`) means no lifetime cap — the
+     * case for every tier except a hosted anonymous trial.
+     */
+    lifetime_messages?: number;
+}
+/**
+ * Where a workspace that hit a limit should go next. Returned by
+ * {@link EntitlementsProvider.getUpgradeGuidance} and surfaced on the
+ * `plan_limit_exceeded` error body as `upgrade_url` / `upgrade_action`.
+ */
+export interface UpgradeGuidance {
+    /** An absolute URL the caller can open to lift the limit. */
+    url: string;
+    /** `sign_in` when signing in (free) lifts the limit, `upgrade` when a paid plan does. */
+    action: 'sign_in' | 'upgrade';
+    /** Effective plan name to report, when it differs from the stored `workspace.plan`. */
+    plan?: string;
+    /** One sentence appended to the error message, e.g. how to sign in. */
+    hint?: string;
 }
 /**
  * Pluggable plan limits / usage — the billing seam.
@@ -31,5 +54,12 @@ export interface EntitlementsProvider {
      * UTC-month period.
      */
     getUsageResetAt?(workspaceId: string, metric: UsageMetric): Promise<number>;
+    /**
+     * Where a workspace that hit `metric`'s limit can lift it (sign in, upgrade).
+     * Optional: self-host deployments have no upgrade path, and an absent or
+     * failing hook only omits `upgrade_url` from the error — it never changes
+     * the limit decision.
+     */
+    getUpgradeGuidance?(workspace: Workspace, metric: UsageMetric): Promise<UpgradeGuidance | null>;
 }
 //# sourceMappingURL=entitlements.d.ts.map

package/dist/ports/entitlements.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"entitlements.d.ts","sourceRoot":"","sources":["../../src/ports/entitlements.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,QAAQ,GAAG,YAAY,GAAG,WAAW,CAAC;AAE7E,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,YAAY,EAAE,MAAM,CAAC;CACtB;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,sDAAsD;IACtD,SAAS,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAErD,wFAAwF;IACxF,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEpE;;;;;;OAMG;IACH,eAAe,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC7E"}
+{"version":3,"file":"entitlements.d.ts","sourceRoot":"","sources":["../../src/ports/entitlements.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,QAAQ,GAAG,YAAY,GAAG,WAAW,CAAC;AAE7E,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,YAAY,EAAE,MAAM,CAAC;IACrB;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;;;GAIG;AACH,MAAM,WAAW,eAAe;IAC9B,6DAA6D;IAC7D,GAAG,EAAE,MAAM,CAAC;IACZ,yFAAyF;IACzF,MAAM,EAAE,SAAS,GAAG,SAAS,CAAC;IAC9B,uFAAuF;IACvF,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uEAAuE;IACvE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,sDAAsD;IACtD,SAAS,CAAC,SAAS,EAAE,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IAErD,wFAAwF;IACxF,QAAQ,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAEpE;;;;;;OAMG;IACH,eAAe,CAAC,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAE5E;;;;;OAKG;IACH,kBAAkB,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAAC;CACjG"}

package/dist/ports/index.d.ts

@@ -21,8 +21,10 @@ export type { FileStorage } from './files.js';
 export type { KeyValueStore } from './kv.js';
 export type { EventQueue, QueuedEvent } from './event-queue.js';
 export type { AuthProvider, AuthResult, AuthRequire, Workspace, Agent, } from './auth.js';
-export type { EntitlementsProvider, PlanLimits, UsageMetric, } from './entitlements.js';
-export type { TelemetrySink, TelemetryEvent } from './telemetry.js';
+export type { EntitlementsProvider, PlanLimits, UpgradeGuidance, UsageMetric, } from './entitlements.js';
+export { ENGINE_OBSERVATION_FACTS } from './telemetry.js';
+export type { TelemetrySink, TelemetryEvent, EngineObservation, EngineObservationKind, EngineObservationFacts } from './telemetry.js';
+export type { EngineLogRecord, EngineLogExport } from './logging.js';
 import type { EngineDb } from './database.js';
 import type { RealtimeBus, ConnectionRegistry, NodeConnectionRegistry } from './realtime.js';
 import type { PresenceTracker } from './presence.js';
@@ -33,6 +35,7 @@ import type { EventQueue } from './event-queue.js';
 import type { AuthProvider } from './auth.js';
 import type { EntitlementsProvider } from './entitlements.js';
 import type { TelemetrySink } from './telemetry.js';
+import type { EngineLogExport } from './logging.js';
 /** Infrastructure ports the engine reads off the request context. */
 export interface EnginePorts {
     db: EngineDb;
@@ -49,7 +52,7 @@ export interface EnginePorts {
 export interface EngineProviders {
     auth: AuthProvider;
     entitlements: EntitlementsProvider;
-    telemetry: TelemetrySink;
+    telemetry?: TelemetrySink;
 }
 /** Everything `createEngine` needs. */
 export interface EngineDeps extends EnginePorts, EngineProviders {
@@ -124,15 +127,8 @@ export interface EngineConfig {
         url?: string;
         secret?: string;
     };
-    /**
-     * When set, the structured logger exports prod logs to a PostHog OTLP endpoint
-     * via plain fetch (no posthog-node dependency). Self-host leaves this unset and
-     * logs to the console only; cloud wires it from its secrets.
-     */
-    logExport?: {
-        posthogApiKey?: string;
-        posthogHost?: string;
-    };
+    /** Optional host-owned log transport. Console output remains enabled. */
+    logExport?: EngineLogExport;
     /**
      * Bounded durable mailbox tuning. Hosted adapters may provide workspace
      * overrides; self-host defaults to one hour TTL and 1000 in-flight deliveries

package/dist/ports/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ports/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,YAAY,EACV,QAAQ,EACR,qBAAqB,EACrB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC3D,YAAY,EACV,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,sBAAsB,EACtB,WAAW,EACX,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAC7D,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACpE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7C,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAChE,YAAY,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,SAAS,EACT,KAAK,GACN,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,oBAAoB,EACpB,UAAU,EACV,WAAW,GACZ,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AAEpE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAC7F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAEpD,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,QAAQ,CAAC;IACb,QAAQ,EAAE,WAAW,CAAC;IACtB,WAAW,EAAE,kBAAkB,CAAC;IAChC,eAAe,EAAE,sBAAsB,CAAC;IACxC,QAAQ,EAAE,eAAe,CAAC;IAC1B,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,EAAE,WAAW,CAAC;IACnB,EAAE,EAAE,aAAa,CAAC;IAClB,YAAY,EAAE,UAAU,CAAC;CAC1B;AAED,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,YAAY,CAAC;IACnB,YAAY,EAAE,oBAAoB,CAAC;IACnC,SAAS,EAAE,aAAa,CAAC;CAC1B;AAED,uCAAuC;AACvC,MAAM,WAAW,UAAW,SAAQ,WAAW,EAAE,eAAe;IAC9D;;;;OAIG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAC/C;;;;;OAKG;IACH,SAAS,CAAC,EAAE;QACV,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAChC,CAAC;IACF;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;OAKG;IACH,+BAA+B,CAAC,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;OAUG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE;QACd,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF;;;;OAIG;IACH,SAAS,CAAC,EAAE;QACV,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,CAAC;IACF;;;;OAIG;IACH,OAAO,CAAC,EAAE;QACR,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB;;;;WAIG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;SAC3B,CAAC,CAAC;KACJ,CAAC;IACF;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,OAAO,wBAAwB,EAAE,6BAA6B,CAAC;CACpF;AAED,YAAY,EAAE,uBAAuB,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ports/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,YAAY,EACV,QAAQ,EACR,qBAAqB,EACrB,eAAe,EACf,WAAW,EACX,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAC3D,YAAY,EACV,WAAW,EACX,WAAW,EACX,kBAAkB,EAClB,sBAAsB,EACtB,WAAW,EACX,eAAe,GAChB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,4BAA4B,EAAE,MAAM,eAAe,CAAC;AAC7D,YAAY,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACpE,YAAY,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7C,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAChE,YAAY,EACV,YAAY,EACZ,UAAU,EACV,WAAW,EACX,SAAS,EACT,KAAK,GACN,MAAM,WAAW,CAAC;AACnB,YAAY,EACV,oBAAoB,EACpB,UAAU,EACV,eAAe,EACf,WAAW,GACZ,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,wBAAwB,EAAE,MAAM,gBAAgB,CAAC;AAC1D,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACtI,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAErE,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AAC9C,OAAO,KAAK,EAAE,WAAW,EAAE,kBAAkB,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AAC7F,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AACrD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7C,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAEpD,qEAAqE;AACrE,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,QAAQ,CAAC;IACb,QAAQ,EAAE,WAAW,CAAC;IACtB,WAAW,EAAE,kBAAkB,CAAC;IAChC,eAAe,EAAE,sBAAsB,CAAC;IACxC,QAAQ,EAAE,eAAe,CAAC;IAC1B,WAAW,EAAE,WAAW,CAAC;IACzB,KAAK,EAAE,WAAW,CAAC;IACnB,EAAE,EAAE,aAAa,CAAC;IAClB,YAAY,EAAE,UAAU,CAAC;CAC1B;AAED,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,YAAY,CAAC;IACnB,YAAY,EAAE,oBAAoB,CAAC;IACnC,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,uCAAuC;AACvC,MAAM,WAAW,UAAW,SAAQ,WAAW,EAAE,eAAe;IAC9D;;;;OAIG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;CACvB;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,oBAAoB,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IAC/C;;;;;OAKG;IACH,SAAS,CAAC,EAAE;QACV,cAAc,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAChC,CAAC;IACF;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,MAAM,CAAC;IAClC;;;;;OAKG;IACH,+BAA+B,CAAC,EAAE,OAAO,CAAC;IAC1C;;;;;;;;;;OAUG;IACH,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;;;;;OAQG;IACH,aAAa,CAAC,EAAE;QACd,GAAG,CAAC,EAAE,MAAM,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,yEAAyE;IACzE,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B;;;;OAIG;IACH,OAAO,CAAC,EAAE;QACR,aAAa,CAAC,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB;;;;WAIG;QACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAC1B,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;YAC1B,aAAa,CAAC,EAAE,MAAM,CAAC;YACvB,QAAQ,CAAC,EAAE,MAAM,CAAC;YAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;SAC3B,CAAC,CAAC;KACJ,CAAC;IACF;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,OAAO,wBAAwB,EAAE,6BAA6B,CAAC;CACpF;AAED,YAAY,EAAE,uBAAuB,EAAE,6BAA6B,EAAE,MAAM,wBAAwB,CAAC"}