@schlessera/brain-ui-server 0.18.0 → 0.20.0

package/dist/activity/store.js

@@ -0,0 +1,657 @@
+import { isBillingMode } from "@schlessera/brain-ui-sdk/protocol";
+import { resolveAmbientBillingMode, resolveStandalonePricingConfig, } from "../config/env.js";
+import { createModelPricing } from "../pricing/model-pricing.js";
+export const SPAN_OUTCOMES = [
+    "success",
+    "error",
+    "timeout",
+    "cancelled",
+    "denied",
+    "interrupted",
+];
+/** The one snake→camel mapper for rollup rows — every reader shares it. */
+export function rowToRunRollup(r) {
+    return {
+        runId: r.run_id,
+        origin: r.origin,
+        name: r.name,
+        sessionId: r.session_id,
+        jobName: r.job_name,
+        startedAt: r.started_at,
+        endedAt: r.ended_at,
+        outcome: r.outcome,
+        durationMs: r.duration_ms,
+        spanCount: r.span_count,
+        inputTokens: r.input_tokens,
+        outputTokens: r.output_tokens,
+        cacheReadTokens: r.cache_read_tokens,
+        cacheCreationTokens: r.cache_creation_tokens,
+        costUsd: r.cost_usd,
+        effectiveCostUsd: r.effective_cost_usd ?? null,
+        // Migration 010 CHECKs this column, but a row written around them (older
+        // binary, manual edit) must degrade to unknown, never to a wrong mode.
+        billingMode: isBillingMode(r.billing_mode) ? r.billing_mode : null,
+        pricingEstimate: r.pricing_estimate == null ? null : r.pricing_estimate === 1,
+        failureReason: r.failure_reason,
+        detailPruned: r.detail_pruned === 1,
+    };
+}
+/**
+ * Sum-of-KNOWNS over effective costs: unknown (NULL) rows contribute nothing
+ * to the sum and are counted instead, so no aggregate can pass an unknown off
+ * as $0 (AE3). One definition for every reader that folds rollup rows.
+ */
+export function sumEffectiveCost(rows) {
+    let effectiveCostUsd = 0;
+    let unpricedRuns = 0;
+    for (const row of rows) {
+        if (row.effectiveCostUsd === null)
+            unpricedRuns += 1;
+        else
+            effectiveCostUsd += row.effectiveCostUsd;
+    }
+    return { effectiveCostUsd, unpricedRuns };
+}
+/** A single event payload is capped so no delta can approach the WS frame cap. */
+export const MAX_EVENT_PAYLOAD_BYTES = 16_384;
+export function createActivityStore(db, options = {}) {
+    const writer = options.writer ?? `pid:${process.pid}:${Date.now()}`;
+    // Lazy so a store that never rolls up (span-only paths, most tests)
+    // touches neither the env nor the disk. The env reads live in
+    // config/env.ts — the one chokepoint the env-access gate allows. Every
+    // wrapper whose transaction can reach rollupRunInTx calls this BEFORE
+    // entering `inWrite`, so the SQLite write lock never covers the two
+    // synchronous JSON reads construction costs.
+    let pricing = options.pricing;
+    const getPricing = () => (pricing ??= createModelPricing(resolveStandalonePricingConfig()));
+    // bun:sqlite transactions: `.immediate` takes the write lock up front, so a
+    // concurrent writer waits (busy_timeout) instead of failing mid-upgrade.
+    const inWrite = (fn) => db.transaction(fn).immediate();
+    function nextSeq(runId) {
+        const row = db
+            .query("SELECT COALESCE(MAX(seq), 0) AS hi FROM activity_changes WHERE run_id = ?")
+            .get(runId);
+        return row.hi + 1;
+    }
+    function logChange(runId, seq, spanId, eventIndex) {
+        db.query("INSERT INTO activity_changes (run_id, seq, span_id, event_index) VALUES (?, ?, ?, ?)").run(runId, seq, spanId, eventIndex ?? null);
+    }
+    function rowToSpan(r) {
+        return {
+            spanId: r.span_id,
+            runId: r.run_id,
+            parentSpanId: r.parent_span_id,
+            name: r.name,
+            kind: r.kind,
+            origin: r.origin,
+            sessionId: r.session_id,
+            jobName: r.job_name,
+            attrs: safeParse(r.attrs) ?? {},
+            startedAt: r.started_at,
+            waitUntil: r.wait_until,
+            endedAt: r.ended_at,
+            outcome: r.outcome,
+            outcomeReason: r.outcome_reason,
+            usage: {
+                inputTokens: r.input_tokens ?? undefined,
+                outputTokens: r.output_tokens ?? undefined,
+                cacheReadTokens: r.cache_read_tokens ?? undefined,
+                cacheCreationTokens: r.cache_creation_tokens ?? undefined,
+                costUsd: r.cost_usd ?? undefined,
+                model: r.model ?? undefined,
+            },
+            writer: r.writer,
+            lastHeartbeatAt: r.last_heartbeat_at,
+        };
+    }
+    function rowToEvent(r) {
+        const parsed = safeParse(r.payload);
+        return {
+            spanId: r.span_id,
+            eventIndex: r.event_index,
+            ts: r.ts,
+            eventType: r.event_type,
+            payload: parsed?.v,
+            truncated: parsed?.truncated === true,
+        };
+    }
+    function getSpanRaw(spanId) {
+        const r = db.query("SELECT * FROM activity_spans WHERE span_id = ?").get(spanId);
+        return r ? rowToSpan(r) : null;
+    }
+    function runHighWaterSeqRaw(runId) {
+        const row = db
+            .query("SELECT COALESCE(MAX(seq), 0) AS hi FROM activity_changes WHERE run_id = ?")
+            .get(runId);
+        return row.hi;
+    }
+    function endSpanInTx(spanId, input) {
+        const existing = db
+            .query("SELECT run_id, outcome, attrs FROM activity_spans WHERE span_id = ?")
+            .get(spanId);
+        if (!existing || existing.outcome !== null)
+            return false;
+        const endedAt = input.endedAt ?? Date.now();
+        const attrs = input.attrs
+            ? JSON.stringify({ ...(safeParse(existing.attrs) ?? {}), ...input.attrs })
+            : existing.attrs;
+        const u = input.usage ?? {};
+        db.query(`UPDATE activity_spans SET outcome = ?, outcome_reason = ?, ended_at = ?, attrs = ?,
+         input_tokens = COALESCE(?, input_tokens),
+         output_tokens = COALESCE(?, output_tokens),
+         cache_read_tokens = COALESCE(?, cache_read_tokens),
+         cache_creation_tokens = COALESCE(?, cache_creation_tokens),
+         cost_usd = COALESCE(?, cost_usd),
+         model = COALESCE(?, model)
+       WHERE span_id = ?`).run(input.outcome, input.reason ?? null, endedAt, attrs, u.inputTokens ?? null, u.outputTokens ?? null, u.cacheReadTokens ?? null, u.cacheCreationTokens ?? null, u.costUsd ?? null, u.model ?? null, spanId);
+        logChange(existing.run_id, nextSeq(existing.run_id), spanId);
+        return true;
+    }
+    /** Close every open span of the run (children first) and roll it up. */
+    function closeRunInTx(runId, outcome, reason) {
+        const open = db
+            .query("SELECT span_id FROM activity_spans WHERE run_id = ? AND outcome IS NULL ORDER BY started_at DESC")
+            .all(runId);
+        let closed = 0;
+        for (const { span_id } of open) {
+            if (endSpanInTx(span_id, { outcome, reason }))
+                closed++;
+        }
+        if (closed > 0)
+            rollupRunInTx(runId);
+        return closed;
+    }
+    function rollupRunInTx(runId) {
+        const spans = db
+            .query("SELECT * FROM activity_spans WHERE run_id = ? ORDER BY started_at")
+            .all(runId)
+            .map(rowToSpan);
+        if (spans.length === 0)
+            return;
+        const root = spans.find((s) => s.parentSpanId === null) ?? spans[0];
+        // Aggregation scope: ROOT spans only. Result-level accounting (the
+        // SDK's modelUsage) already includes subagent consumption — summing the
+        // tree would double-count every fan-out. Verified empirically (plan U3
+        // smoke test).
+        const failure = spans.find((s) => (s.outcome === "error" || s.outcome === "timeout") && s.outcomeReason != null)?.outcomeReason ?? (root.outcome === "interrupted" ? "interrupted" : null);
+        // Billing rides the root span when the recorder knew it at run start
+        // (session runs, U3). A root without the attr classifies from THIS
+        // process's env ONLY for non-session origins: for cron rollups the
+        // executing process is the wrapper itself — exactly the credential set
+        // the job's agent authenticated under — so classification and reality
+        // move together. A SESSION root without the attr (a custom backend the
+        // registry could not classify, or a failed profile resolution) stays
+        // unknown instead: this process's ambient credentials say nothing about
+        // whichever backend ran the turn, and a wrong subscription-$0 would
+        // freeze forever where unknown stays honestly unpriced.
+        const attrBilling = root.attrs["brain.billing_mode"];
+        const billingMode = isBillingMode(attrBilling)
+            ? attrBilling
+            : root.origin === "session"
+                ? null
+                : resolveAmbientBillingMode();
+        // List-price math runs regardless of billing mode: it gap-fills a
+        // missing backend cost_usd (pi without snapshots, cron) AND provides the
+        // api-billed effective number. resolve() is synchronous by contract —
+        // nothing here may await inside the write transaction.
+        const usage = usageForPricing(root, spans);
+        const priced = usage.kind === "usage" ? priceUsage(usage.byModel, getPricing()) : null;
+        // Effective-cost semantics (NULL = unknown, 0 = genuinely free):
+        // subscription → 0 regardless of tokens (AE1); api → the priced sum —
+        // 0 when the run verifiably consumed nothing, NULL when usage was never
+        // recorded (denied before inference) or any contributing model/rate is
+        // missing. The estimate flag qualifies the effective number, so it is
+        // NULL exactly when that is, and 0 for a subscription $0 (exact, not
+        // estimated).
+        // An unclassified run (billingMode null — session root without the
+        // attr) prices as unknown: no subscription-zero, no api pricing.
+        const effectiveCostUsd = billingMode === null ? null : billingMode === "subscription" ? 0 : (priced?.costUsd ?? null);
+        const pricingEstimate = billingMode === null
+            ? null
+            : billingMode === "subscription"
+                ? 0
+                : priced
+                    ? (priced.estimate ? 1 : 0)
+                    : null;
+        const costUsd = root.usage.costUsd ?? priced?.costUsd ?? null;
+        db.query(`INSERT INTO activity_run_rollups
+         (run_id, origin, name, session_id, job_name, started_at, ended_at, outcome,
+          duration_ms, span_count, input_tokens, output_tokens, cache_read_tokens,
+          cache_creation_tokens, cost_usd, effective_cost_usd, billing_mode,
+          pricing_estimate, failure_reason, detail_pruned)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0)
+       ON CONFLICT(run_id) DO UPDATE SET
+         ended_at = excluded.ended_at, outcome = excluded.outcome,
+         duration_ms = excluded.duration_ms, span_count = excluded.span_count,
+         input_tokens = excluded.input_tokens, output_tokens = excluded.output_tokens,
+         cache_read_tokens = excluded.cache_read_tokens,
+         cache_creation_tokens = excluded.cache_creation_tokens,
+         cost_usd = COALESCE(activity_run_rollups.cost_usd, excluded.cost_usd),
+         effective_cost_usd = CASE
+           WHEN activity_run_rollups.effective_cost_usd IS NOT NULL
+             THEN activity_run_rollups.effective_cost_usd
+           WHEN activity_run_rollups.billing_mode IS NULL
+             OR activity_run_rollups.billing_mode = excluded.billing_mode
+             THEN excluded.effective_cost_usd
+           ELSE NULL
+         END,
+         billing_mode = COALESCE(activity_run_rollups.billing_mode, excluded.billing_mode),
+         pricing_estimate = CASE
+           WHEN activity_run_rollups.pricing_estimate IS NOT NULL
+             THEN activity_run_rollups.pricing_estimate
+           WHEN activity_run_rollups.billing_mode IS NULL
+             OR activity_run_rollups.billing_mode = excluded.billing_mode
+             THEN excluded.pricing_estimate
+           ELSE NULL
+         END,
+         failure_reason = excluded.failure_reason`
+        // Every cost column is FROZEN at first non-NULL write (AE5): a re-rollup
+        // after a pricing refresh must not silently reprice history — only a
+        // still-NULL slot may be filled by a later computation. cost_usd gets
+        // the plain first-write-wins COALESCE (the terminal endSpan already
+        // merged the backend's authoritative number before the first rollup).
+        // The effective/estimate pair additionally requires the LATER fill to
+        // agree with the frozen classification: billing_mode is first-write-wins,
+        // and a slot left NULL under one classification must never be filled by
+        // a number computed under a different one (a subscription $0 landing on
+        // an api-classified row would fabricate a cross-classified price).
+        ).run(runId, root.origin, root.name, root.sessionId, root.jobName, root.startedAt, root.endedAt, root.outcome, root.endedAt !== null ? root.endedAt - root.startedAt : null, spans.length, root.usage.inputTokens ?? null, root.usage.outputTokens ?? null, root.usage.cacheReadTokens ?? null, root.usage.cacheCreationTokens ?? null, costUsd, effectiveCostUsd, billingMode, pricingEstimate, failure);
+    }
+    return {
+        writer,
+        startSpan(input) {
+            return inWrite(() => {
+                const startedAt = input.startedAt ?? Date.now();
+                db.query(`INSERT INTO activity_spans
+             (span_id, run_id, parent_span_id, name, kind, origin, session_id, job_name,
+              attrs, started_at, writer, last_heartbeat_at)
+           VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(input.spanId, input.runId, input.parentSpanId ?? null, input.name, input.kind, input.origin, input.sessionId ?? null, input.jobName ?? null, input.attrs ? JSON.stringify(input.attrs) : null, startedAt, writer, input.parentSpanId ? null : startedAt);
+                logChange(input.runId, nextSeq(input.runId), input.spanId);
+                return getSpanRaw(input.spanId);
+            });
+        },
+        endSpan(spanId, input) {
+            return inWrite(() => endSpanInTx(spanId, input));
+        },
+        patchSpan(spanId, patch) {
+            return inWrite(() => {
+                const existing = db
+                    .query("SELECT run_id, outcome, attrs FROM activity_spans WHERE span_id = ?")
+                    .get(spanId);
+                if (!existing || existing.outcome !== null)
+                    return false;
+                const attrs = patch.attrs
+                    ? JSON.stringify({ ...(safeParse(existing.attrs) ?? {}), ...patch.attrs })
+                    : existing.attrs;
+                const u = patch.usage ?? {};
+                db.query(`UPDATE activity_spans SET attrs = ?, wait_until = COALESCE(?, wait_until),
+             input_tokens = COALESCE(?, input_tokens),
+             output_tokens = COALESCE(?, output_tokens),
+             cache_read_tokens = COALESCE(?, cache_read_tokens),
+             cache_creation_tokens = COALESCE(?, cache_creation_tokens),
+             cost_usd = COALESCE(?, cost_usd),
+             model = COALESCE(?, model)
+           WHERE span_id = ?`).run(attrs, patch.waitUntil ?? null, u.inputTokens ?? null, u.outputTokens ?? null, u.cacheReadTokens ?? null, u.cacheCreationTokens ?? null, u.costUsd ?? null, u.model ?? null, spanId);
+                logChange(existing.run_id, nextSeq(existing.run_id), spanId);
+                return true;
+            });
+        },
+        appendEvent(spanId, eventType, payload, ts, cap) {
+            return inWrite(() => {
+                const span = db
+                    .query("SELECT run_id FROM activity_spans WHERE span_id = ?")
+                    .get(spanId);
+                if (!span)
+                    return null;
+                const next = db
+                    .query("SELECT COALESCE(MAX(event_index), -1) + 1 AS idx FROM activity_events WHERE span_id = ?")
+                    .get(spanId);
+                const stored = capPayload(payload, cap);
+                const at = ts ?? Date.now();
+                db.query("INSERT INTO activity_events (span_id, event_index, ts, event_type, payload) VALUES (?, ?, ?, ?, ?)").run(spanId, next.idx, at, eventType, JSON.stringify(stored));
+                logChange(span.run_id, nextSeq(span.run_id), spanId, next.idx);
+                // Built from the values just written — no read-back needed.
+                return {
+                    spanId,
+                    eventIndex: next.idx,
+                    ts: at,
+                    eventType,
+                    payload: stored.v,
+                    truncated: stored.truncated === true,
+                };
+            });
+        },
+        heartbeat(spanId, at) {
+            inWrite(() => {
+                // Deliberately NOT change-logged: a heartbeat is liveness metadata,
+                // not activity the client needs a delta for.
+                db.query("UPDATE activity_spans SET last_heartbeat_at = ? WHERE span_id = ? AND outcome IS NULL").run(at ?? Date.now(), spanId);
+            });
+        },
+        cascadeClose(runId, outcome, reason) {
+            getPricing(); // construct outside the write lock; rollup reuses it
+            return inWrite(() => closeRunInTx(runId, outcome, reason));
+        },
+        sweepOwnOrphans() {
+            // "Own" means this PROCESS IDENTITY's rows from a previous life. The
+            // writer stamp includes the start time, so rows written by the
+            // current instance never match a fresh store's sweep... but a boot
+            // sweep runs before any spans are written, so sweeping by pid-prefix
+            // alone would be wrong across pid reuse. Sweep every session-origin
+            // open span instead: only THIS server writes session spans, and at
+            // boot none of ours can legitimately be open.
+            //
+            // Candidates are read OUTSIDE the write transaction — the common case
+            // finds nothing and must not take the exclusive lock for it. The close
+            // loop re-checks open-ness inside the transaction (endSpanInTx is
+            // write-once), so a race just skips.
+            const open = db
+                .query("SELECT DISTINCT run_id FROM activity_spans WHERE outcome IS NULL AND origin = 'session'")
+                .all();
+            if (open.length === 0)
+                return 0;
+            getPricing(); // construct outside the write lock; rollup reuses it
+            return inWrite(() => {
+                let closed = 0;
+                for (const { run_id } of open) {
+                    closed += closeRunInTx(run_id, "interrupted", "server restarted");
+                }
+                return closed;
+            });
+        },
+        sweepStale(staleAfterMs, now) {
+            const cutoff = (now ?? Date.now()) - staleAfterMs;
+            // Staleness is judged on ROOT heartbeat age — never span age — so a
+            // legitimately long, quiet run with a live writer is never killed.
+            // Candidate read outside the write transaction, same as sweepOwnOrphans.
+            const staleRoots = db
+                .query(`SELECT span_id, run_id FROM activity_spans
+           WHERE outcome IS NULL AND parent_span_id IS NULL
+             AND writer != ? AND COALESCE(last_heartbeat_at, started_at) < ?`)
+                .all(writer, cutoff);
+            if (staleRoots.length === 0)
+                return 0;
+            getPricing(); // construct outside the write lock; rollup reuses it
+            return inWrite(() => {
+                let closed = 0;
+                for (const { run_id } of staleRoots) {
+                    closed += closeRunInTx(run_id, "interrupted", "writer went silent");
+                }
+                return closed;
+            });
+        },
+        findStuck(thresholdMs, now) {
+            const cutoff = (now ?? Date.now()) - thresholdMs;
+            return db
+                .query("SELECT * FROM activity_spans WHERE outcome IS NULL AND parent_span_id IS NULL AND started_at < ?")
+                .all(cutoff).map(rowToSpan);
+        },
+        changesSince(changeCursor, limit = 500) {
+            // Set-based: one join per change kind instead of a lookup per row. A
+            // change whose span/event row was pruned drops out via the join, same
+            // as the old per-row miss.
+            const spanRows = db
+                .query(`SELECT c.change_id, c.run_id, c.seq, s.*
+           FROM activity_changes c
+           JOIN activity_spans s ON s.span_id = c.span_id
+           WHERE c.change_id > ? AND c.event_index IS NULL
+           ORDER BY c.change_id LIMIT ?`)
+                .all(changeCursor, limit);
+            const eventRows = db
+                .query(`SELECT c.change_id, c.run_id, c.seq, e.*
+           FROM activity_changes c
+           JOIN activity_events e
+             ON e.span_id = c.span_id AND e.event_index = c.event_index
+           WHERE c.change_id > ? AND c.event_index IS NOT NULL
+           ORDER BY c.change_id LIMIT ?`)
+                .all(changeCursor, limit);
+            const changes = [
+                ...spanRows.map((r) => ({
+                    changeId: r.change_id,
+                    runId: r.run_id,
+                    seq: r.seq,
+                    kind: "span",
+                    span: rowToSpan(r),
+                })),
+                ...eventRows.map((r) => ({
+                    changeId: r.change_id,
+                    runId: r.run_id,
+                    seq: r.seq,
+                    kind: "event",
+                    event: rowToEvent(r),
+                })),
+            ];
+            changes.sort((a, b) => a.changeId - b.changeId);
+            return changes.length > limit ? changes.slice(0, limit) : changes;
+        },
+        terminalRootChangesSince(changeCursor, limit = 500) {
+            const rows = db
+                .query(`SELECT MAX(c.change_id) AS change_id, s.*
+           FROM activity_changes c
+           JOIN activity_spans s ON s.span_id = c.span_id
+           WHERE c.change_id > ? AND c.event_index IS NULL
+             AND s.parent_span_id IS NULL AND s.outcome IS NOT NULL
+           GROUP BY s.span_id
+           ORDER BY change_id LIMIT ?`)
+                .all(changeCursor, limit);
+            return rows.map((r) => ({ changeId: r.change_id, span: rowToSpan(r) }));
+        },
+        latestChangeCursor() {
+            const row = db
+                .query("SELECT COALESCE(MAX(change_id), 0) AS hi FROM activity_changes")
+                .get();
+            return row.hi;
+        },
+        snapshotRun(runId) {
+            // A read transaction so spans, events, high-water seq, and the global
+            // cursor are one consistent picture — the poller baseline is pinned to
+            // exactly this moment (no gap between snapshot and first delta).
+            return db.transaction(() => {
+                const spans = db
+                    .query("SELECT * FROM activity_spans WHERE run_id = ? ORDER BY started_at")
+                    .all(runId).map(rowToSpan);
+                if (spans.length === 0)
+                    return null;
+                const events = db
+                    .query(`SELECT e.* FROM activity_events e
+               JOIN activity_spans s ON s.span_id = e.span_id
+               WHERE s.run_id = ? ORDER BY e.ts, e.event_index`)
+                    .all(runId).map(rowToEvent);
+                const cursor = db
+                    .query("SELECT COALESCE(MAX(change_id), 0) AS hi FROM activity_changes")
+                    .get();
+                return {
+                    runId,
+                    spans,
+                    events,
+                    highWaterSeq: runHighWaterSeqRaw(runId),
+                    changeCursor: cursor.hi,
+                };
+            })();
+        },
+        runHighWaterSeq: runHighWaterSeqRaw,
+        getSpan: getSpanRaw,
+        openRootSpans() {
+            return db
+                .query("SELECT * FROM activity_spans WHERE outcome IS NULL AND parent_span_id IS NULL ORDER BY started_at DESC")
+                .all().map(rowToSpan);
+        },
+        rollupRun(runId) {
+            getPricing(); // construct outside the write lock; rollup reuses it
+            inWrite(() => rollupRunInTx(runId));
+        },
+        prune(options) {
+            const now = options.now ?? Date.now();
+            const batch = options.batch ?? 50;
+            // The digest floor gates pruning, but a dead digest job must not freeze
+            // it forever: the hard ceiling prunes regardless (marking the rollup so
+            // the coverage gap is visible). The floor alone is NOT enough: it meant
+            // "safe to prune once summarized", but drill-in debugging is a second
+            // reader of detail with a different clock — nightly cron runs end
+            // before the morning digest, day sessions after, so floor-only pruning
+            // took cron span trees within the hour while sessions kept theirs (it
+            // looked cron-specific; it was clock skew). The retention cutoff ANDs
+            // with the floor so covered runs still keep detail for a minimum window.
+            const floor = Math.max(options.digestFloorAt, 0);
+            const retentionCutoff = now - options.detailRetentionMs;
+            const ceiling = now - options.hardCeilingMs;
+            return inWrite(() => {
+                // Candidates come from the rollups (they exist for every finished
+                // run — that terminal write is what made the run prunable), guarded
+                // against any run that still has an open span.
+                const candidates = db
+                    .query(`SELECT run_id, ended_at AS ended FROM activity_run_rollups r
+             WHERE detail_pruned = 0 AND ended_at IS NOT NULL
+               AND ((ended_at < ? AND ended_at < ?) OR ended_at < ?)
+               AND NOT EXISTS (
+                 SELECT 1 FROM activity_spans s
+                 WHERE s.run_id = r.run_id AND s.outcome IS NULL
+               )
+             LIMIT ?`)
+                    .all(floor, retentionCutoff, ceiling, batch);
+                let spansDeleted = 0;
+                for (const { run_id, ended } of candidates) {
+                    db.query("UPDATE activity_run_rollups SET detail_pruned = 1 WHERE run_id = ?").run(run_id);
+                    if (ended >= floor) {
+                        // Pruned by the hard ceiling alone — the digest never covered
+                        // this run; make the coverage gap visible on the rollup.
+                        db.query("UPDATE activity_run_rollups SET failure_reason = COALESCE(failure_reason, 'digest coverage gap') WHERE run_id = ?").run(run_id);
+                    }
+                    db.query(`DELETE FROM activity_events WHERE span_id IN
+               (SELECT span_id FROM activity_spans WHERE run_id = ?)`).run(run_id);
+                    const res = db.query("DELETE FROM activity_spans WHERE run_id = ?").run(run_id);
+                    spansDeleted += res.changes;
+                    db.query("DELETE FROM activity_changes WHERE run_id = ?").run(run_id);
+                }
+                // The change log only serves live polling; rows this deep in the past
+                // are unreachable by any live cursor. Keep runs with open spans.
+                db.query(`DELETE FROM activity_changes WHERE change_id < (
+             SELECT COALESCE(MAX(change_id), 0) FROM activity_changes
+           ) - 100000 AND run_id NOT IN (
+             SELECT DISTINCT run_id FROM activity_spans WHERE outcome IS NULL
+           )`).run();
+                return { runsPruned: candidates.length, spansDeleted };
+            });
+        },
+    };
+}
+function tokenCount(value) {
+    return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : undefined;
+}
+/**
+ * The usage a run is priced from. Session runs carry the SDK's per-model
+ * breakdown as a root attr (result-level accounting, subagents included —
+ * the same root-only scope the token rollup uses). Cron runs have no root
+ * aggregate: the wrapper's children carry the usage, summed per model here
+ * — the sanctioned origin-scoped exception to root-only aggregation, safe
+ * because sink children are not double-counted in their root.
+ */
+function usageForPricing(root, spans) {
+    if (root.origin === "cron") {
+        // Null-prototype: model ids are foreign strings — an id like "__proto__"
+        // must be an ordinary key, never a prototype write.
+        const byModel = Object.create(null);
+        let sawUsage = false;
+        for (const span of spans) {
+            if (span.spanId === root.spanId)
+                continue;
+            const u = span.usage;
+            if (u.inputTokens == null &&
+                u.outputTokens == null &&
+                u.cacheReadTokens == null &&
+                u.cacheCreationTokens == null) {
+                continue; // no inference on this span (tool spans etc.) — not "unknown"
+            }
+            sawUsage = true;
+            // Tokens without a model cannot be priced at any rate — guessing one
+            // would silently misprice, so the whole run goes unknown.
+            if (!u.model)
+                return { kind: "unpriceable" };
+            const agg = (byModel[u.model] ??= {});
+            agg.inputTokens = (agg.inputTokens ?? 0) + (u.inputTokens ?? 0);
+            agg.outputTokens = (agg.outputTokens ?? 0) + (u.outputTokens ?? 0);
+            agg.cacheReadTokens = (agg.cacheReadTokens ?? 0) + (u.cacheReadTokens ?? 0);
+            agg.cacheCreationTokens = (agg.cacheCreationTokens ?? 0) + (u.cacheCreationTokens ?? 0);
+        }
+        return sawUsage ? { kind: "usage", byModel } : { kind: "none" };
+    }
+    const perModel = root.attrs["gen_ai.usage.per_model"];
+    if (typeof perModel !== "object" || perModel === null || Array.isArray(perModel)) {
+        return { kind: "none" };
+    }
+    const byModel = Object.create(null);
+    for (const [model, value] of Object.entries(perModel)) {
+        if (typeof value !== "object" || value === null)
+            continue;
+        const v = value;
+        byModel[model] = {
+            inputTokens: tokenCount(v.inputTokens) ?? 0,
+            outputTokens: tokenCount(v.outputTokens) ?? 0,
+            cacheReadTokens: tokenCount(v.cacheReadTokens) ?? 0,
+            cacheCreationTokens: tokenCount(v.cacheCreationTokens) ?? 0,
+        };
+    }
+    return Object.keys(byModel).length > 0 ? { kind: "usage", byModel } : { kind: "none" };
+}
+/**
+ * Price one run's per-model usage at list rates. Null = unknown: an
+ * unresolvable model with consumed tokens, or a consumed token class with no
+ * rate, poisons the WHOLE run — cache reads dominate Claude usage, so
+ * partial pricing would systematically understate (the binding
+ * missing-cache-rate decision). A model with zero consumption contributes
+ * nothing and needs no rate. Variant/snapshot fallbacks are the pricing
+ * service's job (`resolve()`); the store only propagates the estimate flag.
+ */
+function priceUsage(byModel, pricing) {
+    let costUsd = 0;
+    let estimate = false;
+    for (const [model, tokens] of Object.entries(byModel)) {
+        const classes = [
+            [tokens.inputTokens ?? 0, (r) => r.input],
+            [tokens.outputTokens ?? 0, (r) => r.output],
+            [tokens.cacheReadTokens ?? 0, (r) => r.cacheRead],
+            [tokens.cacheCreationTokens ?? 0, (r) => r.cacheWrite],
+        ];
+        if (!classes.some(([count]) => count > 0))
+            continue;
+        const rates = pricing.resolve(model);
+        if (!rates)
+            return null;
+        for (const [count, rateOf] of classes) {
+            if (count <= 0)
+                continue;
+            const perToken = rateOf(rates);
+            if (perToken === null)
+                return null;
+            costUsd += count * perToken;
+        }
+        if (rates.estimate)
+            estimate = true;
+    }
+    // A non-finite sum (overflowed or poisoned rates) must surface as unknown —
+    // once frozen into the rollup it would render as an exact number forever.
+    return Number.isFinite(costUsd) ? { costUsd, estimate } : null;
+}
+function safeParse(text) {
+    if (!text)
+        return undefined;
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return undefined;
+    }
+}
+/** Cap a payload's serialized size; a clipped payload carries the `truncated`
+ *  flag (which rides the wire), so no in-text marker is stored. */
+function capPayload(payload, cap) {
+    const limit = Math.min(cap ?? MAX_EVENT_PAYLOAD_BYTES, MAX_EVENT_PAYLOAD_BYTES);
+    const json = JSON.stringify(payload ?? null);
+    if (json.length <= limit)
+        return { v: payload ?? null };
+    if (typeof payload === "string") {
+        return { v: payload.slice(0, limit), truncated: true };
+    }
+    return { v: json.slice(0, limit), truncated: true };
+}
+//# sourceMappingURL=store.js.map