@secondlayer/shared 7.11.1 → 8.0.0

package/dist/src/crypto/secrets.js

@@ -15,14 +15,33 @@ var __export = (target, all) => {
 };
 
 // src/mode.ts
-var VALID_MODES = ["oss", "platform"];
-function getInstanceMode() {
+var VALID_MODES = [
+  "oss",
+  "platform",
+  "archive"
+];
+function declaredMode() {
   const raw = process.env.INSTANCE_MODE?.trim().toLowerCase();
   if (raw && VALID_MODES.includes(raw)) {
     return raw;
   }
   return "oss";
 }
+function getInstanceMode() {
+  const declared = declaredMode();
+  return declared === "archive" ? "platform" : declared;
+}
+function getDeclaredInstanceMode() {
+  return declaredMode();
+}
+function isMeteredReads() {
+  const override = process.env.METERED_READS?.trim().toLowerCase();
+  if (override === "true")
+    return true;
+  if (override === "false")
+    return false;
+  return getInstanceMode() === "platform";
+}
 function isPlatformMode() {
   return getInstanceMode() === "platform";
 }
@@ -160,5 +179,5 @@ export {
   decryptSecret
 };
 
-//# debugId=D05BC92983E1614B64756E2164756E21
+//# debugId=8E49B42A8C43DF1864756E2164756E21
 //# sourceMappingURL=secrets.js.map

package/dist/src/crypto/secrets.js.map

@@ -2,10 +2,10 @@
   "version": 3,
   "sources": ["../src/mode.ts", "../src/crypto/secrets.ts"],
   "sourcesContent": [
-    "/**\n * Instance modes for the Secondlayer platform.\n *\n * - `oss`: self-hosted, single-tenant. No auth middleware, no platform routes\n *   (projects, admin). Everything runs against a single `DATABASE_URL`.\n *   Intended for `docker compose up`.\n *\n * - `platform`: control-plane mode. Magic-link auth, API keys, projects,\n *   admin. Serves the dashboard + CLI against a single shared DB. Post\n *   2026-05-14 shared-rip this also serves subgraphs + subscriptions.\n */\n\nexport type InstanceMode = \"oss\" | \"platform\";\n\nconst VALID_MODES: readonly InstanceMode[] = [\"oss\", \"platform\"];\n\n/**\n * Resolve the active instance mode from `process.env.INSTANCE_MODE`.\n * Defaults to `\"oss\"` — the safest default for self-hosters who deploy\n * without setting the variable.\n */\nexport function getInstanceMode(): InstanceMode {\n\tconst raw = process.env.INSTANCE_MODE?.trim().toLowerCase();\n\tif (raw && (VALID_MODES as readonly string[]).includes(raw)) {\n\t\treturn raw as InstanceMode;\n\t}\n\treturn \"oss\";\n}\n\n/** True when the active mode is `\"platform\"` (shared multi-tenant). */\nexport function isPlatformMode(): boolean {\n\treturn getInstanceMode() === \"platform\";\n}\n\n/** True when the active mode is `\"oss\"` (self-hosted). */\nexport function isOssMode(): boolean {\n\treturn getInstanceMode() === \"oss\";\n}\n",
+    "/**\n * Instance modes for the Secondlayer platform.\n *\n * - `oss`: self-hosted, single-tenant. No auth middleware, no platform routes\n *   (projects, admin). Everything runs against a single `DATABASE_URL`.\n *   Intended for `docker compose up`.\n *\n * - `platform`: control-plane mode. Magic-link auth, API keys, projects,\n *   admin. Serves the dashboard + CLI against a single shared DB. Post\n *   2026-05-14 shared-rip this also serves subgraphs + subscriptions.\n */\n\nexport type InstanceMode = \"oss\" | \"platform\";\n\n/** What the operator wrote in the env — `archive` is the honest name for the\n *  metered public-archive deployment and aliases `platform` behaviorally. */\nexport type DeclaredInstanceMode = InstanceMode | \"archive\";\n\nconst VALID_MODES: readonly DeclaredInstanceMode[] = [\n\t\"oss\",\n\t\"platform\",\n\t\"archive\",\n];\n\nfunction declaredMode(): DeclaredInstanceMode {\n\tconst raw = process.env.INSTANCE_MODE?.trim().toLowerCase();\n\tif (raw && (VALID_MODES as readonly string[]).includes(raw)) {\n\t\treturn raw as DeclaredInstanceMode;\n\t}\n\treturn \"oss\";\n}\n\n/**\n * Resolve the active instance mode from `process.env.INSTANCE_MODE`.\n * Defaults to `\"oss\"` — the safest default for self-hosters who deploy\n * without setting the variable. `archive` normalizes to `platform` here so\n * every behavioral branch stays a two-way choice; use\n * `getDeclaredInstanceMode()` for display surfaces.\n */\nexport function getInstanceMode(): InstanceMode {\n\tconst declared = declaredMode();\n\treturn declared === \"archive\" ? \"platform\" : declared;\n}\n\n/** The mode as declared in the env, for status/identity surfaces. */\nexport function getDeclaredInstanceMode(): DeclaredInstanceMode {\n\treturn declaredMode();\n}\n\n/**\n * True when public reads are credit-metered (the free window, retention, and\n * credits gates arm). Platform/archive deployments meter by default;\n * self-host never does unless the operator explicitly sets\n * `METERED_READS=true`. `METERED_READS=false` disarms a metered deployment.\n */\nexport function isMeteredReads(): boolean {\n\tconst override = process.env.METERED_READS?.trim().toLowerCase();\n\tif (override === \"true\") return true;\n\tif (override === \"false\") return false;\n\treturn getInstanceMode() === \"platform\";\n}\n\n/** True when the active mode is `\"platform\"` (shared multi-tenant). */\nexport function isPlatformMode(): boolean {\n\treturn getInstanceMode() === \"platform\";\n}\n\n/** True when the active mode is `\"oss\"` (self-hosted). */\nexport function isOssMode(): boolean {\n\treturn getInstanceMode() === \"oss\";\n}\n",
     "import { createCipheriv, createDecipheriv, randomBytes } from \"node:crypto\";\nimport {\n\tappendFileSync,\n\tcloseSync,\n\texistsSync,\n\topenSync,\n\treadFileSync,\n\tunlinkSync,\n} from \"node:fs\";\nimport { resolve } from \"node:path\";\nimport { getInstanceMode } from \"../mode.ts\";\n\n/**\n * AES-256-GCM symmetric envelope for encrypted secrets at rest (tenant keys,\n * subscription signing secrets, etc.).\n *\n * Ciphertext layout: `iv (12 bytes) || authTag (16 bytes) || ciphertext`\n *\n * The key comes from `SECONDLAYER_SECRETS_KEY` — 32 bytes hex. In OSS mode,\n * if the env var is unset on first use we autogenerate a key and persist it\n * to `.env.local` in the current working directory so subsequent restarts\n * pick it up without user intervention. Dedicated/platform modes throw —\n * those runtimes must provision the key explicitly.\n *\n * Rotation strategy: re-encrypt all rows with the new key and swap the env\n * var. Not zero-downtime, but acceptable at v2 scale. For real KMS (AWS\n * KMS, Vault, GCP KMS), wrap the same byte layout behind an\n * `EncryptSecret`/`DecryptSecret` interface and swap at startup.\n */\n\nconst KEY_ENV = \"SECONDLAYER_SECRETS_KEY\";\nconst IV_LEN = 12;\nconst TAG_LEN = 16;\n\nfunction readExistingKey(envPath: string): string | null {\n\tif (!existsSync(envPath)) return null;\n\tconst contents = readFileSync(envPath, \"utf8\");\n\tconst match = contents.match(/^SECONDLAYER_SECRETS_KEY=([a-fA-F0-9]{64})/m);\n\t// biome-ignore lint/style/noNonNullAssertion: value is non-null after preceding check or by construction; TS narrowing limitation\n\treturn match ? match[1]! : null;\n}\n\n/**\n * Atomic file lock via `openSync(..., \"wx\")` — O_CREAT | O_EXCL. If two\n * processes race on cold-compose start, exactly one creates the lock\n * file; the loser polls until the winner finishes writing `.env.local`,\n * then reads the winner's key. Stale locks (process crashed mid-write)\n * are cleaned after `STALE_LOCK_MS`.\n */\nconst STALE_LOCK_MS = 10_000;\nconst POLL_MS = 25;\n\nfunction bootstrapOssKey(): string {\n\tconst envPath = resolve(process.cwd(), \".env.local\");\n\n\t// Fast path — key already on disk from a prior run.\n\tconst existing = readExistingKey(envPath);\n\tif (existing) {\n\t\tprocess.env[KEY_ENV] = existing;\n\t\treturn existing;\n\t}\n\n\tconst lockPath = `${envPath}.secret-bootstrap.lock`;\n\tlet lockFd: number | null = null;\n\ttry {\n\t\tlockFd = openSync(lockPath, \"wx\", 0o600);\n\t} catch (err) {\n\t\tconst e = err as NodeJS.ErrnoException;\n\t\tif (e.code !== \"EEXIST\") throw err;\n\t}\n\n\tif (lockFd === null) {\n\t\t// Another process is bootstrapping. Poll for its result.\n\t\tconst deadline = Date.now() + STALE_LOCK_MS;\n\t\twhile (Date.now() < deadline) {\n\t\t\tconst key = readExistingKey(envPath);\n\t\t\tif (key) {\n\t\t\t\tprocess.env[KEY_ENV] = key;\n\t\t\t\treturn key;\n\t\t\t}\n\t\t\tBun.sleepSync(POLL_MS);\n\t\t}\n\t\t// Lock holder died mid-write — force-clean and retry once.\n\t\ttry {\n\t\t\tunlinkSync(lockPath);\n\t\t} catch {}\n\t\treturn bootstrapOssKey();\n\t}\n\n\ttry {\n\t\tconst hex = randomBytes(32).toString(\"hex\");\n\t\tconst line = `${existsSync(envPath) ? \"\\n\" : \"\"}${KEY_ENV}=${hex}\\n`;\n\t\tappendFileSync(envPath, line, { mode: 0o600 });\n\t\tprocess.env[KEY_ENV] = hex;\n\t\tconsole.log(\n\t\t\t`[secondlayer] generated ${KEY_ENV}; saved to ${envPath} (mode 0600)`,\n\t\t);\n\t\treturn hex;\n\t} finally {\n\t\tcloseSync(lockFd);\n\t\ttry {\n\t\t\tunlinkSync(lockPath);\n\t\t} catch {}\n\t}\n}\n\nfunction loadKey(): Buffer {\n\tlet hex = process.env[KEY_ENV];\n\tif (!hex) {\n\t\tif (getInstanceMode() === \"oss\") {\n\t\t\thex = bootstrapOssKey();\n\t\t} else {\n\t\t\tthrow new Error(\n\t\t\t\t`${KEY_ENV} not set. Generate one with: openssl rand -hex 32`,\n\t\t\t);\n\t\t}\n\t}\n\tconst key = Buffer.from(hex, \"hex\");\n\tif (key.length !== 32) {\n\t\tthrow new Error(`${KEY_ENV} must be 32 bytes hex (got ${key.length})`);\n\t}\n\treturn key;\n}\n\nlet _cachedKey: Buffer | null = null;\nfunction getKey(): Buffer {\n\tif (!_cachedKey) _cachedKey = loadKey();\n\treturn _cachedKey;\n}\n\n/**\n * Non-throwing check for whether a secrets key is currently resolvable —\n * same resolution order as {@link loadKey} (env var, then the OSS\n * `.env.local` fallback), but never bootstraps a new key (that would\n * generate+persist a key as a side effect of a mere existence check), never\n * throws, and never returns or logs the key itself. Used by callers that\n * need to fail loud on a missing key BEFORE attempting a decrypt (f072).\n */\nexport function secretsKeyAvailable(): boolean {\n\tif (process.env[KEY_ENV]) return true;\n\tif (getInstanceMode() === \"oss\") {\n\t\tconst envPath = resolve(process.cwd(), \".env.local\");\n\t\treturn readExistingKey(envPath) !== null;\n\t}\n\treturn false;\n}\n\nexport function encryptSecret(plaintext: string): Buffer {\n\tconst key = getKey();\n\tconst iv = randomBytes(IV_LEN);\n\tconst cipher = createCipheriv(\"aes-256-gcm\", key, iv);\n\tconst ciphertext = Buffer.concat([\n\t\tcipher.update(plaintext, \"utf8\"),\n\t\tcipher.final(),\n\t]);\n\tconst tag = cipher.getAuthTag();\n\treturn Buffer.concat([iv, tag, ciphertext]);\n}\n\nexport function decryptSecret(envelope: Buffer): string {\n\tconst key = getKey();\n\tconst iv = envelope.subarray(0, IV_LEN);\n\tconst tag = envelope.subarray(IV_LEN, IV_LEN + TAG_LEN);\n\tconst ciphertext = envelope.subarray(IV_LEN + TAG_LEN);\n\tconst decipher = createDecipheriv(\"aes-256-gcm\", key, iv);\n\tdecipher.setAuthTag(tag);\n\treturn decipher.update(ciphertext).toString(\"utf8\") + decipher.final(\"utf8\");\n}\n\n/** Generate a fresh 32-byte hex key suitable for `SECONDLAYER_SECRETS_KEY`. */\nexport function generateSecretsKey(): string {\n\treturn randomBytes(32).toString(\"hex\");\n}\n"
   ],
-  "mappings": ";;;;;;;;;;;;;;;;;AAcA,IAAM,cAAuC,CAAC,OAAO,UAAU;AAOxD,SAAS,eAAe,GAAiB;AAAA,EAC/C,MAAM,MAAM,QAAQ,IAAI,eAAe,KAAK,EAAE,YAAY;AAAA,EAC1D,IAAI,OAAQ,YAAkC,SAAS,GAAG,GAAG;AAAA,IAC5D,OAAO;AAAA,EACR;AAAA,EACA,OAAO;AAAA;AAID,SAAS,cAAc,GAAY;AAAA,EACzC,OAAO,gBAAgB,MAAM;AAAA;AAIvB,SAAS,SAAS,GAAY;AAAA,EACpC,OAAO,gBAAgB,MAAM;AAAA;;;ACpC9B;AACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA;AAqBA,IAAM,UAAU;AAChB,IAAM,SAAS;AACf,IAAM,UAAU;AAEhB,SAAS,eAAe,CAAC,SAAgC;AAAA,EACxD,IAAI,CAAC,WAAW,OAAO;AAAA,IAAG,OAAO;AAAA,EACjC,MAAM,WAAW,aAAa,SAAS,MAAM;AAAA,EAC7C,MAAM,QAAQ,SAAS,MAAM,6CAA6C;AAAA,EAE1E,OAAO,QAAQ,MAAM,KAAM;AAAA;AAU5B,IAAM,gBAAgB;AACtB,IAAM,UAAU;AAEhB,SAAS,eAAe,GAAW;AAAA,EAClC,MAAM,UAAU,QAAQ,QAAQ,IAAI,GAAG,YAAY;AAAA,EAGnD,MAAM,WAAW,gBAAgB,OAAO;AAAA,EACxC,IAAI,UAAU;AAAA,IACb,QAAQ,IAAI,WAAW;AAAA,IACvB,OAAO;AAAA,EACR;AAAA,EAEA,MAAM,WAAW,GAAG;AAAA,EACpB,IAAI,SAAwB;AAAA,EAC5B,IAAI;AAAA,IACH,SAAS,SAAS,UAAU,MAAM,GAAK;AAAA,IACtC,OAAO,KAAK;AAAA,IACb,MAAM,IAAI;AAAA,IACV,IAAI,EAAE,SAAS;AAAA,MAAU,MAAM;AAAA;AAAA,EAGhC,IAAI,WAAW,MAAM;AAAA,IAEpB,MAAM,WAAW,KAAK,IAAI,IAAI;AAAA,IAC9B,OAAO,KAAK,IAAI,IAAI,UAAU;AAAA,MAC7B,MAAM,MAAM,gBAAgB,OAAO;AAAA,MACnC,IAAI,KAAK;AAAA,QACR,QAAQ,IAAI,WAAW;AAAA,QACvB,OAAO;AAAA,MACR;AAAA,MACA,IAAI,UAAU,OAAO;AAAA,IACtB;AAAA,IAEA,IAAI;AAAA,MACH,WAAW,QAAQ;AAAA,MAClB,MAAM;AAAA,IACR,OAAO,gBAAgB;AAAA,EACxB;AAAA,EAEA,IAAI;AAAA,IACH,MAAM,MAAM,YAAY,EAAE,EAAE,SAAS,KAAK;AAAA,IAC1C,MAAM,OAAO,GAAG,WAAW,OAAO,IAAI;AAAA,IAAO,KAAK,WAAW;AAAA;AAAA,IAC7D,eAAe,SAAS,MAAM,EAAE,MAAM,IAAM,CAAC;AAAA,IAC7C,QAAQ,IAAI,WAAW;AAAA,IACvB,QAAQ,IACP,2BAA2B,qBAAqB,qBACjD;AAAA,IACA,OAAO;AAAA,YACN;AAAA,IACD,UAAU,MAAM;AAAA,IAChB,IAAI;AAAA,MACH,WAAW,QAAQ;AAAA,MAClB,MAAM;AAAA;AAAA;AAIV,SAAS,OAAO,GAAW;AAAA,EAC1B,IAAI,MAAM,QAAQ,IAAI;AAAA,EACtB,IAAI,CAAC,KAAK;AAAA,IACT,IAAI,gBAAgB,MAAM,OAAO;AAAA,MAChC,MAAM,gBAAgB;AAAA,IACvB,EAAO;AAAA,MACN,MAAM,IAAI,MACT,GAAG,0DACJ;AAAA;AAAA,EAEF;AAAA,EACA,MAAM,MAAM,OAAO,KAAK,KAAK,KAAK;AAAA,EAClC,IAAI,IAAI,WAAW,IAAI;AAAA,IACtB,MAAM,IAAI,MAAM,GAAG,qCAAqC,IAAI,SAAS;AAAA,EACtE;AAAA,EACA,OAAO;AAAA;AAGR,IAAI,aAA4B;AAChC,SAAS,MAAM,GAAW;AAAA,EACzB,IAAI,CAAC;AAAA,IAAY,aAAa,QAAQ;AAAA,EACtC,OAAO;AAAA;AAWD,SAAS,mBAAmB,GAAY;AAAA,EAC9C,IAAI,QAAQ,IAAI;AAAA,IAAU,OAAO;AAAA,EACjC,IAAI,gBAAgB,MAAM,OAAO;AAAA,IAChC,MAAM,UAAU,QAAQ,QAAQ,IAAI,GAAG,YAAY;AAAA,IACnD,OAAO,gBAAgB,OAAO,MAAM;AAAA,EACrC;AAAA,EACA,OAAO;AAAA;AAGD,SAAS,aAAa,CAAC,WAA2B;AAAA,EACxD,MAAM,MAAM,OAAO;AAAA,EACnB,MAAM,KAAK,YAAY,MAAM;AAAA,EAC7B,MAAM,SAAS,eAAe,eAAe,KAAK,EAAE;AAAA,EACpD,MAAM,aAAa,OAAO,OAAO;AAAA,IAChC,OAAO,OAAO,WAAW,MAAM;AAAA,IAC/B,OAAO,MAAM;AAAA,EACd,CAAC;AAAA,EACD,MAAM,MAAM,OAAO,WAAW;AAAA,EAC9B,OAAO,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC;AAAA;AAGpC,SAAS,aAAa,CAAC,UAA0B;AAAA,EACvD,MAAM,MAAM,OAAO;AAAA,EACnB,MAAM,KAAK,SAAS,SAAS,GAAG,MAAM;AAAA,EACtC,MAAM,MAAM,SAAS,SAAS,QAAQ,SAAS,OAAO;AAAA,EACtD,MAAM,aAAa,SAAS,SAAS,SAAS,OAAO;AAAA,EACrD,MAAM,WAAW,iBAAiB,eAAe,KAAK,EAAE;AAAA,EACxD,SAAS,WAAW,GAAG;AAAA,EACvB,OAAO,SAAS,OAAO,UAAU,EAAE,SAAS,MAAM,IAAI,SAAS,MAAM,MAAM;AAAA;AAIrE,SAAS,kBAAkB,GAAW;AAAA,EAC5C,OAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAAA;",
-  "debugId": "D05BC92983E1614B64756E2164756E21",
+  "mappings": ";;;;;;;;;;;;;;;;;AAkBA,IAAM,cAA+C;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AACD;AAEA,SAAS,YAAY,GAAyB;AAAA,EAC7C,MAAM,MAAM,QAAQ,IAAI,eAAe,KAAK,EAAE,YAAY;AAAA,EAC1D,IAAI,OAAQ,YAAkC,SAAS,GAAG,GAAG;AAAA,IAC5D,OAAO;AAAA,EACR;AAAA,EACA,OAAO;AAAA;AAUD,SAAS,eAAe,GAAiB;AAAA,EAC/C,MAAM,WAAW,aAAa;AAAA,EAC9B,OAAO,aAAa,YAAY,aAAa;AAAA;AAIvC,SAAS,uBAAuB,GAAyB;AAAA,EAC/D,OAAO,aAAa;AAAA;AASd,SAAS,cAAc,GAAY;AAAA,EACzC,MAAM,WAAW,QAAQ,IAAI,eAAe,KAAK,EAAE,YAAY;AAAA,EAC/D,IAAI,aAAa;AAAA,IAAQ,OAAO;AAAA,EAChC,IAAI,aAAa;AAAA,IAAS,OAAO;AAAA,EACjC,OAAO,gBAAgB,MAAM;AAAA;AAIvB,SAAS,cAAc,GAAY;AAAA,EACzC,OAAO,gBAAgB,MAAM;AAAA;AAIvB,SAAS,SAAS,GAAY;AAAA,EACpC,OAAO,gBAAgB,MAAM;AAAA;;;ACrE9B;AACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQA;AAqBA,IAAM,UAAU;AAChB,IAAM,SAAS;AACf,IAAM,UAAU;AAEhB,SAAS,eAAe,CAAC,SAAgC;AAAA,EACxD,IAAI,CAAC,WAAW,OAAO;AAAA,IAAG,OAAO;AAAA,EACjC,MAAM,WAAW,aAAa,SAAS,MAAM;AAAA,EAC7C,MAAM,QAAQ,SAAS,MAAM,6CAA6C;AAAA,EAE1E,OAAO,QAAQ,MAAM,KAAM;AAAA;AAU5B,IAAM,gBAAgB;AACtB,IAAM,UAAU;AAEhB,SAAS,eAAe,GAAW;AAAA,EAClC,MAAM,UAAU,QAAQ,QAAQ,IAAI,GAAG,YAAY;AAAA,EAGnD,MAAM,WAAW,gBAAgB,OAAO;AAAA,EACxC,IAAI,UAAU;AAAA,IACb,QAAQ,IAAI,WAAW;AAAA,IACvB,OAAO;AAAA,EACR;AAAA,EAEA,MAAM,WAAW,GAAG;AAAA,EACpB,IAAI,SAAwB;AAAA,EAC5B,IAAI;AAAA,IACH,SAAS,SAAS,UAAU,MAAM,GAAK;AAAA,IACtC,OAAO,KAAK;AAAA,IACb,MAAM,IAAI;AAAA,IACV,IAAI,EAAE,SAAS;AAAA,MAAU,MAAM;AAAA;AAAA,EAGhC,IAAI,WAAW,MAAM;AAAA,IAEpB,MAAM,WAAW,KAAK,IAAI,IAAI;AAAA,IAC9B,OAAO,KAAK,IAAI,IAAI,UAAU;AAAA,MAC7B,MAAM,MAAM,gBAAgB,OAAO;AAAA,MACnC,IAAI,KAAK;AAAA,QACR,QAAQ,IAAI,WAAW;AAAA,QACvB,OAAO;AAAA,MACR;AAAA,MACA,IAAI,UAAU,OAAO;AAAA,IACtB;AAAA,IAEA,IAAI;AAAA,MACH,WAAW,QAAQ;AAAA,MAClB,MAAM;AAAA,IACR,OAAO,gBAAgB;AAAA,EACxB;AAAA,EAEA,IAAI;AAAA,IACH,MAAM,MAAM,YAAY,EAAE,EAAE,SAAS,KAAK;AAAA,IAC1C,MAAM,OAAO,GAAG,WAAW,OAAO,IAAI;AAAA,IAAO,KAAK,WAAW;AAAA;AAAA,IAC7D,eAAe,SAAS,MAAM,EAAE,MAAM,IAAM,CAAC;AAAA,IAC7C,QAAQ,IAAI,WAAW;AAAA,IACvB,QAAQ,IACP,2BAA2B,qBAAqB,qBACjD;AAAA,IACA,OAAO;AAAA,YACN;AAAA,IACD,UAAU,MAAM;AAAA,IAChB,IAAI;AAAA,MACH,WAAW,QAAQ;AAAA,MAClB,MAAM;AAAA;AAAA;AAIV,SAAS,OAAO,GAAW;AAAA,EAC1B,IAAI,MAAM,QAAQ,IAAI;AAAA,EACtB,IAAI,CAAC,KAAK;AAAA,IACT,IAAI,gBAAgB,MAAM,OAAO;AAAA,MAChC,MAAM,gBAAgB;AAAA,IACvB,EAAO;AAAA,MACN,MAAM,IAAI,MACT,GAAG,0DACJ;AAAA;AAAA,EAEF;AAAA,EACA,MAAM,MAAM,OAAO,KAAK,KAAK,KAAK;AAAA,EAClC,IAAI,IAAI,WAAW,IAAI;AAAA,IACtB,MAAM,IAAI,MAAM,GAAG,qCAAqC,IAAI,SAAS;AAAA,EACtE;AAAA,EACA,OAAO;AAAA;AAGR,IAAI,aAA4B;AAChC,SAAS,MAAM,GAAW;AAAA,EACzB,IAAI,CAAC;AAAA,IAAY,aAAa,QAAQ;AAAA,EACtC,OAAO;AAAA;AAWD,SAAS,mBAAmB,GAAY;AAAA,EAC9C,IAAI,QAAQ,IAAI;AAAA,IAAU,OAAO;AAAA,EACjC,IAAI,gBAAgB,MAAM,OAAO;AAAA,IAChC,MAAM,UAAU,QAAQ,QAAQ,IAAI,GAAG,YAAY;AAAA,IACnD,OAAO,gBAAgB,OAAO,MAAM;AAAA,EACrC;AAAA,EACA,OAAO;AAAA;AAGD,SAAS,aAAa,CAAC,WAA2B;AAAA,EACxD,MAAM,MAAM,OAAO;AAAA,EACnB,MAAM,KAAK,YAAY,MAAM;AAAA,EAC7B,MAAM,SAAS,eAAe,eAAe,KAAK,EAAE;AAAA,EACpD,MAAM,aAAa,OAAO,OAAO;AAAA,IAChC,OAAO,OAAO,WAAW,MAAM;AAAA,IAC/B,OAAO,MAAM;AAAA,EACd,CAAC;AAAA,EACD,MAAM,MAAM,OAAO,WAAW;AAAA,EAC9B,OAAO,OAAO,OAAO,CAAC,IAAI,KAAK,UAAU,CAAC;AAAA;AAGpC,SAAS,aAAa,CAAC,UAA0B;AAAA,EACvD,MAAM,MAAM,OAAO;AAAA,EACnB,MAAM,KAAK,SAAS,SAAS,GAAG,MAAM;AAAA,EACtC,MAAM,MAAM,SAAS,SAAS,QAAQ,SAAS,OAAO;AAAA,EACtD,MAAM,aAAa,SAAS,SAAS,SAAS,OAAO;AAAA,EACrD,MAAM,WAAW,iBAAiB,eAAe,KAAK,EAAE;AAAA,EACxD,SAAS,WAAW,GAAG;AAAA,EACvB,OAAO,SAAS,OAAO,UAAU,EAAE,SAAS,MAAM,IAAI,SAAS,MAAM,MAAM;AAAA;AAIrE,SAAS,kBAAkB,GAAW;AAAA,EAC5C,OAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAAA;",
+  "debugId": "8E49B42A8C43DF1864756E2164756E21",
   "names": []
 }

package/dist/src/db/index.d.ts

@@ -241,11 +241,9 @@ interface AccountsTable {
 	ghost: Generated<boolean>;
 	/** Stacks principal owning a wallet-ghost account (x402-paid deploys). */
 	wallet_principal: string | null;
-	plan: Generated<string>;
 	display_name: string | null;
 	bio: string | null;
 	avatar_url: string | null;
-	slug: string | null;
 	stripe_customer_id: string | null;
 	/** Opt-out toggle for the subgraph reindex-completion email. Defaults true. */
 	notify_reindex_complete: Generated<boolean>;
@@ -262,19 +260,6 @@ interface SessionsTable {
 	last_used_at: Date | null;
 	created_at: Generated<Date>;
 }
-/**
-* One-time claim tokens for ghost accounts. The raw token only ever appears in
-* the claim URL returned at mint time; we store its sha256. A used token marks
-* the account as claimed (or merged into an existing account).
-*/
-interface ClaimTokensTable {
-	id: Generated<string>;
-	account_id: string;
-	token_hash: string;
-	created_at: Generated<Date>;
-	expires_at: Date;
-	used_at: Date | null;
-}
 interface MagicLinksTable {
 	id: Generated<string>;
 	email: string;
@@ -285,47 +270,6 @@ interface MagicLinksTable {
 	failed_attempts: Generated<number>;
 	created_at: Generated<Date>;
 }
-interface UsageDailyTable {
-	account_id: string;
-	tenant_id: string | null;
-	date: string;
-	api_requests: Generated<number>;
-	deliveries: Generated<number>;
-	streams_events_returned: Generated<number>;
-	index_decoded_events_returned: Generated<number>;
-}
-interface UsageSnapshotsTable {
-	id: Generated<string>;
-	account_id: string;
-	measured_at: Generated<Date>;
-	storage_bytes: Generated<number>;
-}
-interface AccountInsightsTable {
-	id: Generated<string>;
-	account_id: string;
-	category: string;
-	insight_type: string;
-	resource_id: string | null;
-	severity: string;
-	title: string;
-	body: string;
-	data: unknown;
-	dismissed_at: Date | null;
-	expires_at: Date | null;
-	created_at: Generated<Date>;
-}
-interface AccountAgentRunsTable {
-	id: Generated<string>;
-	account_id: string;
-	started_at: Generated<Date>;
-	completed_at: Date | null;
-	status: Generated<string>;
-	input_tokens: Generated<number>;
-	output_tokens: Generated<number>;
-	cost_usd: Generated<number>;
-	insights_created: Generated<number>;
-	error: string | null;
-}
 interface SubgraphProcessingStatsTable {
 	id: Generated<string>;
 	subgraph_name: string;
@@ -358,41 +302,6 @@ interface SubgraphHealthSnapshotsTable {
 	last_processed_block: number | null;
 	captured_at: Generated<Date>;
 }
-interface SubgraphUsageDailyTable {
-	subgraph_id: string;
-	date: string;
-	query_count: Generated<number>;
-}
-interface ProjectsTable {
-	id: Generated<string>;
-	name: string;
-	slug: string;
-	account_id: string;
-	settings: Generated<Record<string, unknown>>;
-	network: Generated<string>;
-	node_rpc: string | null;
-	created_at: Generated<Date>;
-	updated_at: Generated<Date>;
-}
-interface TeamMembersTable {
-	id: Generated<string>;
-	project_id: string;
-	account_id: string;
-	role: Generated<string>;
-	invited_by: string | null;
-	created_at: Generated<Date>;
-}
-interface TeamInvitationsTable {
-	id: Generated<string>;
-	project_id: string;
-	email: string;
-	role: Generated<string>;
-	token: string;
-	invited_by: string | null;
-	expires_at: Date;
-	accepted_at: Date | null;
-	created_at: Generated<Date>;
-}
 interface ProcessedStripeEventsTable {
 	event_id: string;
 	event_type: string;
@@ -845,27 +754,14 @@ interface Database {
 	accounts: AccountsTable;
 	sessions: SessionsTable;
 	magic_links: MagicLinksTable;
-	claim_tokens: ClaimTokensTable;
-	usage_daily: UsageDailyTable;
-	usage_snapshots: UsageSnapshotsTable;
-	account_insights: AccountInsightsTable;
-	account_agent_runs: AccountAgentRunsTable;
 	subgraph_health_snapshots: SubgraphHealthSnapshotsTable;
 	subgraph_processing_stats: SubgraphProcessingStatsTable;
 	subgraph_table_snapshots: SubgraphTableSnapshotsTable;
 	subgraph_gaps: SubgraphGapsTable;
 	subgraph_operations: SubgraphOperationsTable;
-	subgraph_usage_daily: SubgraphUsageDailyTable;
-	projects: ProjectsTable;
-	team_members: TeamMembersTable;
-	team_invitations: TeamInvitationsTable;
 	processed_stripe_events: ProcessedStripeEventsTable;
-	tenants: TenantsTable;
-	tenant_usage_monthly: TenantUsageMonthlyTable;
-	tenant_compute_addons: TenantComputeAddonsTable;
 	account_spend_caps: AccountSpendCapsTable;
 	account_credits: AccountCreditsTable;
-	provisioning_audit_log: ProvisioningAuditLogTable;
 	subscriptions: SubscriptionsTable;
 	subscription_outbox: SubscriptionOutboxTable;
 	subscription_deliveries: SubscriptionDeliveriesTable;
@@ -940,66 +836,6 @@ interface X402PaymentsTable {
 	*  reconciler's heal path can never double-credit them. */
 	credited_at: Generated<Date> | null;
 }
-type TenantStatus = "provisioning" | "active" | "limit_warning" | "paused_limit" | "suspended" | "error" | "deleted";
-interface TenantsTable {
-	id: Generated<string>;
-	account_id: string;
-	slug: string;
-	status: ColumnType<TenantStatus, TenantStatus | undefined, TenantStatus>;
-	plan: string;
-	cpus: ColumnType<number, number | string, number | string>;
-	memory_mb: number;
-	storage_limit_mb: number;
-	storage_used_mb: number | null;
-	pg_container_id: string | null;
-	api_container_id: string | null;
-	processor_container_id: string | null;
-	target_database_url_enc: Buffer;
-	tenant_jwt_secret_enc: Buffer;
-	anon_key_enc: Buffer;
-	service_key_enc: Buffer;
-	api_url_internal: string;
-	api_url_public: string;
-	suspended_at: Date | null;
-	last_health_check_at: Date | null;
-	last_active_at: Generated<Date>;
-	service_gen: Generated<number>;
-	anon_gen: Generated<number>;
-	project_id: string | null;
-	created_at: Generated<Date>;
-	updated_at: Generated<Date>;
-}
-type Tenant = Selectable<TenantsTable>;
-type InsertTenant = Insertable<TenantsTable>;
-type UpdateTenant = Updateable<TenantsTable>;
-interface TenantUsageMonthlyTable {
-	id: Generated<string>;
-	tenant_id: string;
-	period_month: Date;
-	storage_peak_mb: Generated<number>;
-	storage_avg_mb: Generated<number>;
-	storage_last_mb: Generated<number>;
-	measurements: Generated<number>;
-	first_at: Generated<Date>;
-	last_at: Generated<Date>;
-}
-type TenantUsageMonthly = Selectable<TenantUsageMonthlyTable>;
-type InsertTenantUsageMonthly = Insertable<TenantUsageMonthlyTable>;
-type UpdateTenantUsageMonthly = Updateable<TenantUsageMonthlyTable>;
-interface TenantComputeAddonsTable {
-	id: Generated<string>;
-	tenant_id: string;
-	memory_mb_delta: Generated<number>;
-	cpu_delta: Generated<number | string>;
-	storage_mb_delta: Generated<number>;
-	effective_from: Generated<Date>;
-	effective_until: Date | null;
-	stripe_subscription_item_id: string | null;
-	created_at: Generated<Date>;
-}
-type TenantComputeAddon = Selectable<TenantComputeAddonsTable>;
-type InsertTenantComputeAddon = Insertable<TenantComputeAddonsTable>;
-type UpdateTenantComputeAddon = Updateable<TenantComputeAddonsTable>;
 interface AccountSpendCapsTable {
 	account_id: string;
 	monthly_cap_cents: number | null;
@@ -1029,22 +865,6 @@ interface AccountCreditsTable {
 type AccountCredits = Selectable<AccountCreditsTable>;
 type InsertAccountCredits = Insertable<AccountCreditsTable>;
 type UpdateAccountCredits = Updateable<AccountCreditsTable>;
-type ProvisioningAuditEvent = "provision.start" | "provision.success" | "provision.failure" | "suspend" | "resume" | "resize" | "keys.rotate" | "bastion.key.upload" | "bastion.key.revoke" | "teardown";
-type ProvisioningAuditStatus = "ok" | "error";
-interface ProvisioningAuditLogTable {
-	id: Generated<string>;
-	tenant_id: string | null;
-	tenant_slug: string | null;
-	account_id: string | null;
-	actor: string;
-	event: ProvisioningAuditEvent;
-	status: ProvisioningAuditStatus;
-	detail: unknown | null;
-	error: string | null;
-	created_at: Generated<Date>;
-}
-type ProvisioningAuditLog = Selectable<ProvisioningAuditLogTable>;
-type InsertProvisioningAuditLog = Insertable<ProvisioningAuditLogTable>;
 type Block = Selectable<BlocksTable>;
 type InsertBlock = Insertable<BlocksTable>;
 type UpdateBlock = Updateable<BlocksTable>;
@@ -1075,29 +895,12 @@ type Account = Selectable<AccountsTable>;
 type InsertAccount = Insertable<AccountsTable>;
 type MagicLink = Selectable<MagicLinksTable>;
 type InsertMagicLink = Insertable<MagicLinksTable>;
-type ClaimToken = Selectable<ClaimTokensTable>;
-type InsertClaimToken = Insertable<ClaimTokensTable>;
 type Session = Selectable<SessionsTable>;
 type InsertSession = Insertable<SessionsTable>;
-type UsageDaily = Selectable<UsageDailyTable>;
-type UsageSnapshot = Selectable<UsageSnapshotsTable>;
-type AccountInsight = Selectable<AccountInsightsTable>;
-type InsertAccountInsight = Insertable<AccountInsightsTable>;
-type AccountAgentRun = Selectable<AccountAgentRunsTable>;
-type InsertAccountAgentRun = Insertable<AccountAgentRunsTable>;
 type SubgraphHealthSnapshot = Selectable<SubgraphHealthSnapshotsTable>;
 type InsertSubgraphHealthSnapshot = Insertable<SubgraphHealthSnapshotsTable>;
 type SubgraphGap = Selectable<SubgraphGapsTable>;
 type InsertSubgraphGap = Insertable<SubgraphGapsTable>;
-type SubgraphUsageDaily = Selectable<SubgraphUsageDailyTable>;
-type InsertSubgraphUsageDaily = Insertable<SubgraphUsageDailyTable>;
-type Project = Selectable<ProjectsTable>;
-type InsertProject = Insertable<ProjectsTable>;
-type UpdateProject = Updateable<ProjectsTable>;
-type TeamMember = Selectable<TeamMembersTable>;
-type InsertTeamMember = Insertable<TeamMembersTable>;
-type TeamInvitation = Selectable<TeamInvitationsTable>;
-type InsertTeamInvitation = Insertable<TeamInvitationsTable>;
 type SubscriptionStatus = "active" | "paused" | "error";
 /** Polymorphic subscription mode: `subgraph` reacts to processed table rows;
 *  `chain` reacts to raw chain events matched directly off the Index/Streams
@@ -2118,20 +1921,8 @@ declare const TABLE_TO_DB: {
 	api_keys: string
 	sessions: string
 	magic_links: string
-	claim_tokens: string
-	usage_daily: string
-	usage_snapshots: string
-	account_insights: string
-	account_agent_runs: string
 	account_spend_caps: string
 	processed_stripe_events: string
-	tenants: string
-	tenant_usage_monthly: string
-	tenant_compute_addons: string
-	provisioning_audit_log: string
-	projects: string
-	team_members: string
-	team_invitations: string
 	subscriptions: string
 	subscription_outbox: string
 	subscription_deliveries: string
@@ -2140,7 +1931,6 @@ declare const TABLE_TO_DB: {
 	subgraph_operations: string
 	subgraph_health_snapshots: string
 	subgraph_gaps: string
-	subgraph_usage_daily: string
 	subgraph_processing_stats: string
 	subgraph_table_snapshots: string
 	x402_payments: string
@@ -2217,4 +2007,4 @@ declare function getRawClient(role?: "source" | "target"): ReturnType<typeof pos
 declare function getRawClientFor(url: string): ReturnType<typeof postgres>;
 /** Close all DB connection pools. Call in CLI commands to allow process exit. */
 declare function closeDb(): Promise<void>;
-export { sql, setMigrationRole, parseJsonb, onControlPlane, onChainPlane, jsonb, getTargetDb, getSourceDb, getRawClientFor, getRawClient, getMigrationRole, getDbSplitStatus, getDb, closeDb, assertDbSplit, applicationDatabaseUrl, X402PaymentsTable, X402BalancesTable, UsageSnapshotsTable, UsageSnapshot, UsageDailyTable, UsageDaily, UpdateTransaction, UpdateTenantUsageMonthly, UpdateTenantComputeAddon, UpdateTenant, UpdateSubscriptionOutbox, UpdateSubscription, UpdateSubgraphOperation, UpdateSubgraph, UpdateProject, UpdateIndexProgress, UpdateEvent, UpdateContract, UpdateBlock, UpdateApiKey, UpdateAccountSpendCap, UpdateAccountCredits, TriggerEvaluatorStateTable, TriggerEvaluatorState, TransactionsTable, TransactionsArchiveTable, Transaction, TenantsTable, TenantUsageMonthlyTable, TenantUsageMonthly, TenantStatus, TenantComputeAddonsTable, TenantComputeAddon, Tenant, TeamMembersTable, TeamMember, TeamInvitationsTable, TeamInvitation, TABLE_TO_DB, SubscriptionsTable, SubscriptionStatus, SubscriptionRuntime, SubscriptionOutboxTable, SubscriptionOutbox, SubscriptionKind, SubscriptionFormat, SubscriptionDelivery, SubscriptionDeliveriesTable, Subscription, SubgraphsTable, SubgraphUsageDailyTable, SubgraphUsageDaily, SubgraphTableSnapshotsTable, SubgraphProcessingStatsTable, SubgraphOperationsTable, SubgraphOperationStatus, SubgraphOperationKind, SubgraphOperation, SubgraphHealthSnapshotsTable, SubgraphHealthSnapshot, SubgraphGapsTable, SubgraphGap, Subgraph, StageRunsTable, StageRegistryTable, StageKind, StageFailuresTable, StageBlockReceiptsTable, SessionsTable, Session, ServiceHeartbeatsTable, SbtcTokenEventsTable, SbtcTokenEventType, SbtcSupplySnapshotsTable, SbtcSettlementsTable, SbtcEventsTable, SbtcEventTopic, SOURCE_READ_TYPES, SOURCE_READ_PKS, SOURCE_READ_COLUMNS, RunStatus, RetryState, RepairMode, ProvisioningAuditStatus, ProvisioningAuditLogTable, ProvisioningAuditLog, ProvisioningAuditEvent, ProjectsTable, Project, ProcessedStripeEventsTable, Pox5EventsTable, Pox5EventTopic, Pox4SignersDailyTable, Pox4FunctionName, Pox4CyclesDailyTable, Pox4CallsTable, PendingForkBlocksTable, OutboxStatus, ObserverJournalTable, ObserverJournalStatus, NumericAsText, NativeClock, MigrationRole, MempoolTransactionsTable, MempoolTransaction, MagicLinksTable, MagicLink, InstancesTable, InsertTransaction, InsertTenantUsageMonthly, InsertTenantComputeAddon, InsertTenant, InsertTeamMember, InsertTeamInvitation, InsertSubscriptionOutbox, InsertSubscriptionDelivery, InsertSubscription, InsertSubgraphUsageDaily, InsertSubgraphOperation, InsertSubgraphHealthSnapshot, InsertSubgraphGap, InsertSubgraph, InsertSession, InsertProvisioningAuditLog, InsertProject, InsertMempoolTransaction, InsertMagicLink, InsertIndexProgress, InsertEvent, InsertContract, InsertClaimToken, InsertBlock, InsertApiKey, InsertAccountSpendCap, InsertAccountInsight, InsertAccountCredits, InsertAccountAgentRun, InsertAccount, IndexProgressTable, IndexProgress, IndexPrimaryKey, IndexColumnType, IndexColumn, FailureUnit, FailureClass, EventsTable, EventsArchiveTable, Event, DecoderCheckpointsTable, DecodedEventsTable, DeadLetterEventsTable, DbSplitStatus, DbReadRow, DbPlane, Database, CoverageSegmentsTable, ContractsTable, Contract, ClaimTokensTable, ClaimToken, ChainReorgsTable, ChainReadCacheTable, BurnBlockRewardsTable, BurnBlockRewardSlotsTable, BnsNamespacesTable, BnsNamespaceEventsTable, BnsNamespaceEventStatus, BnsNamesTable, BnsNameEventsTable, BnsNameEventTopic, BnsMarketplaceEventsTable, BnsMarketplaceAction, BlocksTable, Block, ApiKeysTable, ApiKey, AccountsTable, AccountSpendCapsTable, AccountSpendCap, AccountInsightsTable, AccountInsight, AccountCreditsTable, AccountCredits, AccountAgentRunsTable, AccountAgentRun, Account };
+export { sql, setMigrationRole, parseJsonb, onControlPlane, onChainPlane, jsonb, getTargetDb, getSourceDb, getRawClientFor, getRawClient, getMigrationRole, getDbSplitStatus, getDb, closeDb, assertDbSplit, applicationDatabaseUrl, X402PaymentsTable, X402BalancesTable, UpdateTransaction, UpdateSubscriptionOutbox, UpdateSubscription, UpdateSubgraphOperation, UpdateSubgraph, UpdateIndexProgress, UpdateEvent, UpdateContract, UpdateBlock, UpdateApiKey, UpdateAccountSpendCap, UpdateAccountCredits, TriggerEvaluatorStateTable, TriggerEvaluatorState, TransactionsTable, TransactionsArchiveTable, Transaction, TABLE_TO_DB, SubscriptionsTable, SubscriptionStatus, SubscriptionRuntime, SubscriptionOutboxTable, SubscriptionOutbox, SubscriptionKind, SubscriptionFormat, SubscriptionDelivery, SubscriptionDeliveriesTable, Subscription, SubgraphsTable, SubgraphTableSnapshotsTable, SubgraphProcessingStatsTable, SubgraphOperationsTable, SubgraphOperationStatus, SubgraphOperationKind, SubgraphOperation, SubgraphHealthSnapshotsTable, SubgraphHealthSnapshot, SubgraphGapsTable, SubgraphGap, Subgraph, StageRunsTable, StageRegistryTable, StageKind, StageFailuresTable, StageBlockReceiptsTable, SessionsTable, Session, ServiceHeartbeatsTable, SbtcTokenEventsTable, SbtcTokenEventType, SbtcSupplySnapshotsTable, SbtcSettlementsTable, SbtcEventsTable, SbtcEventTopic, SOURCE_READ_TYPES, SOURCE_READ_PKS, SOURCE_READ_COLUMNS, RunStatus, RetryState, RepairMode, ProcessedStripeEventsTable, Pox5EventsTable, Pox5EventTopic, Pox4SignersDailyTable, Pox4FunctionName, Pox4CyclesDailyTable, Pox4CallsTable, PendingForkBlocksTable, OutboxStatus, ObserverJournalTable, ObserverJournalStatus, NumericAsText, NativeClock, MigrationRole, MempoolTransactionsTable, MempoolTransaction, MagicLinksTable, MagicLink, InstancesTable, InsertTransaction, InsertSubscriptionOutbox, InsertSubscriptionDelivery, InsertSubscription, InsertSubgraphOperation, InsertSubgraphHealthSnapshot, InsertSubgraphGap, InsertSubgraph, InsertSession, InsertMempoolTransaction, InsertMagicLink, InsertIndexProgress, InsertEvent, InsertContract, InsertBlock, InsertApiKey, InsertAccountSpendCap, InsertAccountCredits, InsertAccount, IndexProgressTable, IndexProgress, IndexPrimaryKey, IndexColumnType, IndexColumn, FailureUnit, FailureClass, EventsTable, EventsArchiveTable, Event, DecoderCheckpointsTable, DecodedEventsTable, DeadLetterEventsTable, DbSplitStatus, DbReadRow, DbPlane, Database, CoverageSegmentsTable, ContractsTable, Contract, ChainReorgsTable, ChainReadCacheTable, BurnBlockRewardsTable, BurnBlockRewardSlotsTable, BnsNamespacesTable, BnsNamespaceEventsTable, BnsNamespaceEventStatus, BnsNamesTable, BnsNameEventsTable, BnsNameEventTopic, BnsMarketplaceEventsTable, BnsMarketplaceAction, BlocksTable, Block, ApiKeysTable, ApiKey, AccountsTable, AccountSpendCapsTable, AccountSpendCap, AccountCreditsTable, AccountCredits, Account };

package/dist/src/db/index.js

@@ -139,14 +139,33 @@ class Logger {
 var logger = new Logger;
 
 // src/mode.ts
-var VALID_MODES = ["oss", "platform"];
-function getInstanceMode() {
+var VALID_MODES = [
+  "oss",
+  "platform",
+  "archive"
+];
+function declaredMode() {
   const raw = process.env.INSTANCE_MODE?.trim().toLowerCase();
   if (raw && VALID_MODES.includes(raw)) {
     return raw;
   }
   return "oss";
 }
+function getInstanceMode() {
+  const declared = declaredMode();
+  return declared === "archive" ? "platform" : declared;
+}
+function getDeclaredInstanceMode() {
+  return declaredMode();
+}
+function isMeteredReads() {
+  const override = process.env.METERED_READS?.trim().toLowerCase();
+  if (override === "true")
+    return true;
+  if (override === "false")
+    return false;
+  return getInstanceMode() === "platform";
+}
 function isPlatformMode() {
   return getInstanceMode() === "platform";
 }
@@ -749,20 +768,8 @@ var TABLE_TO_DB = {
   api_keys: "target",
   sessions: "target",
   magic_links: "target",
-  claim_tokens: "target",
-  usage_daily: "target",
-  usage_snapshots: "target",
-  account_insights: "target",
-  account_agent_runs: "target",
   account_spend_caps: "target",
   processed_stripe_events: "target",
-  tenants: "target",
-  tenant_usage_monthly: "target",
-  tenant_compute_addons: "target",
-  provisioning_audit_log: "target",
-  projects: "target",
-  team_members: "target",
-  team_invitations: "target",
   subscriptions: "target",
   subscription_outbox: "target",
   subscription_deliveries: "target",
@@ -771,7 +778,6 @@ var TABLE_TO_DB = {
   subgraph_operations: "target",
   subgraph_health_snapshots: "target",
   subgraph_gaps: "target",
-  subgraph_usage_daily: "target",
   subgraph_processing_stats: "target",
   subgraph_table_snapshots: "target",
   x402_payments: "target",
@@ -979,5 +985,5 @@ export {
   SOURCE_READ_COLUMNS
 };
 
-//# debugId=12924C1A09E0071964756E2164756E21
+//# debugId=DD3D0E63F39C5F9D64756E2164756E21
 //# sourceMappingURL=index.js.map