bonecode 1.0.0 → 1.2.0

package/bone/output/session/src/migration_diff.ts

@@ -1,108 +1,108 @@
-// Generated by BoneScript compiler. DO NOT EDIT.
-// Migration diff utility — compares two IR snapshots and produces ALTER statements.
-
-import * as fs from "fs";
-
-interface Field {
-  name: string;
-  type: string;
-  nullable: boolean;
-}
-
-interface Model {
-  name: string;
-  fields: Field[];
-  primary_key: string;
-}
-
-export function diffModels(oldModels: Model[], newModels: Model[]): string[] {
-  const statements: string[] = [];
-  const oldByName = new Map(oldModels.map(m => [m.name, m]));
-  const newByName = new Map(newModels.map(m => [m.name, m]));
-
-  // New tables
-  for (const [name, model] of newByName) {
-    if (!oldByName.has(name)) {
-      const tableName = toSnake(name) + "s";
-      statements.push(`-- New table: ${tableName}`);
-      statements.push(`-- (Generated by previous migration)`);
-    }
-  }
-
-  // Removed tables (warn but don't auto-drop)
-  for (const [name] of oldByName) {
-    if (!newByName.has(name)) {
-      const tableName = toSnake(name) + "s";
-      statements.push(`-- WARNING: Table ${tableName} no longer in schema. Manual DROP required.`);
-    }
-  }
-
-  // Modified tables
-  for (const [name, newModel] of newByName) {
-    const oldModel = oldByName.get(name);
-    if (!oldModel) continue;
-
-    const tableName = toSnake(name) + "s";
-    const oldFields = new Map(oldModel.fields.map(f => [f.name, f]));
-    const newFields = new Map(newModel.fields.map(f => [f.name, f]));
-
-    // New columns (backward-compatible)
-    for (const [fname, field] of newFields) {
-      if (!oldFields.has(fname)) {
-        const sqlType = mapType(field.type);
-        const nullability = field.nullable ? "" : " NOT NULL DEFAULT (CASE WHEN false THEN NULL ELSE NULL END)";
-        statements.push(`ALTER TABLE ${tableName} ADD COLUMN ${fname} ${sqlType}${nullability};`);
-      }
-    }
-
-    // Removed columns (NOT auto-dropped — backward compat)
-    for (const [fname] of oldFields) {
-      if (!newFields.has(fname)) {
-        statements.push(`-- WARNING: Column ${tableName}.${fname} removed from schema. Run manually: ALTER TABLE ${tableName} DROP COLUMN ${fname};`);
-      }
-    }
-
-    // Type changes
-    for (const [fname, newField] of newFields) {
-      const oldField = oldFields.get(fname);
-      if (!oldField) continue;
-      if (oldField.type !== newField.type) {
-        const sqlType = mapType(newField.type);
-        statements.push(`ALTER TABLE ${tableName} ALTER COLUMN ${fname} TYPE ${sqlType};`);
-      }
-    }
-  }
-
-  return statements;
-}
-
-function toSnake(s: string): string {
-  return s.replace(/([a-z])([A-Z])/g, "$1_$2").toLowerCase();
-}
-
-function mapType(t: string): string {
-  const map: Record<string, string> = {
-    string: "VARCHAR", uint: "BIGINT", int: "BIGINT", float: "DOUBLE PRECISION",
-    bool: "BOOLEAN", timestamp: "TIMESTAMPTZ", uuid: "UUID", bytes: "BYTEA", json: "JSONB",
-  };
-  return map[t] || "JSONB";
-}
-
-if (require.main === module) {
-  const oldFile = process.argv[2];
-  const newFile = process.argv[3];
-  if (!oldFile || !newFile) {
-    console.error("Usage: node migration-diff.js <old-ir.json> <new-ir.json>");
-    process.exit(1);
-  }
-  const oldIR = JSON.parse(fs.readFileSync(oldFile, "utf-8"));
-  const newIR = JSON.parse(fs.readFileSync(newFile, "utf-8"));
-
-  const oldModels: Model[] = [];
-  const newModels: Model[] = [];
-  for (const sys of oldIR) for (const mod of sys.modules) for (const m of mod.models) oldModels.push(m);
-  for (const sys of newIR) for (const mod of sys.modules) for (const m of mod.models) newModels.push(m);
-
-  const diff = diffModels(oldModels, newModels);
-  console.log(diff.join("\n"));
-}
+// Generated by BoneScript compiler. DO NOT EDIT.
+// Migration diff utility — compares two IR snapshots and produces ALTER statements.
+
+import * as fs from "fs";
+
+interface Field {
+  name: string;
+  type: string;
+  nullable: boolean;
+}
+
+interface Model {
+  name: string;
+  fields: Field[];
+  primary_key: string;
+}
+
+export function diffModels(oldModels: Model[], newModels: Model[]): string[] {
+  const statements: string[] = [];
+  const oldByName = new Map(oldModels.map(m => [m.name, m]));
+  const newByName = new Map(newModels.map(m => [m.name, m]));
+
+  // New tables
+  for (const [name, model] of newByName) {
+    if (!oldByName.has(name)) {
+      const tableName = toSnake(name) + "s";
+      statements.push(`-- New table: ${tableName}`);
+      statements.push(`-- (Generated by previous migration)`);
+    }
+  }
+
+  // Removed tables (warn but don't auto-drop)
+  for (const [name] of oldByName) {
+    if (!newByName.has(name)) {
+      const tableName = toSnake(name) + "s";
+      statements.push(`-- WARNING: Table ${tableName} no longer in schema. Manual DROP required.`);
+    }
+  }
+
+  // Modified tables
+  for (const [name, newModel] of newByName) {
+    const oldModel = oldByName.get(name);
+    if (!oldModel) continue;
+
+    const tableName = toSnake(name) + "s";
+    const oldFields = new Map(oldModel.fields.map(f => [f.name, f]));
+    const newFields = new Map(newModel.fields.map(f => [f.name, f]));
+
+    // New columns (backward-compatible)
+    for (const [fname, field] of newFields) {
+      if (!oldFields.has(fname)) {
+        const sqlType = mapType(field.type);
+        const nullability = field.nullable ? "" : " NOT NULL DEFAULT (CASE WHEN false THEN NULL ELSE NULL END)";
+        statements.push(`ALTER TABLE ${tableName} ADD COLUMN ${fname} ${sqlType}${nullability};`);
+      }
+    }
+
+    // Removed columns (NOT auto-dropped — backward compat)
+    for (const [fname] of oldFields) {
+      if (!newFields.has(fname)) {
+        statements.push(`-- WARNING: Column ${tableName}.${fname} removed from schema. Run manually: ALTER TABLE ${tableName} DROP COLUMN ${fname};`);
+      }
+    }
+
+    // Type changes
+    for (const [fname, newField] of newFields) {
+      const oldField = oldFields.get(fname);
+      if (!oldField) continue;
+      if (oldField.type !== newField.type) {
+        const sqlType = mapType(newField.type);
+        statements.push(`ALTER TABLE ${tableName} ALTER COLUMN ${fname} TYPE ${sqlType};`);
+      }
+    }
+  }
+
+  return statements;
+}
+
+function toSnake(s: string): string {
+  return s.replace(/([a-z])([A-Z])/g, "$1_$2").toLowerCase();
+}
+
+function mapType(t: string): string {
+  const map: Record<string, string> = {
+    string: "VARCHAR", uint: "BIGINT", int: "BIGINT", float: "DOUBLE PRECISION",
+    bool: "BOOLEAN", timestamp: "TIMESTAMPTZ", uuid: "UUID", bytes: "BYTEA", json: "JSONB",
+  };
+  return map[t] || "JSONB";
+}
+
+if (require.main === module) {
+  const oldFile = process.argv[2];
+  const newFile = process.argv[3];
+  if (!oldFile || !newFile) {
+    console.error("Usage: node migration-diff.js <old-ir.json> <new-ir.json>");
+    process.exit(1);
+  }
+  const oldIR = JSON.parse(fs.readFileSync(oldFile, "utf-8"));
+  const newIR = JSON.parse(fs.readFileSync(newFile, "utf-8"));
+
+  const oldModels: Model[] = [];
+  const newModels: Model[] = [];
+  for (const sys of oldIR) for (const mod of sys.modules) for (const m of mod.models) oldModels.push(m);
+  for (const sys of newIR) for (const mod of sys.modules) for (const m of mod.models) newModels.push(m);
+
+  const diff = diffModels(oldModels, newModels);
+  console.log(diff.join("\n"));
+}

package/bone/output/session/src/notify.ts

@@ -1,112 +1,112 @@
-// Generated by BoneScript compiler.
-// Notification service — fires on event emissions.
-// Configure NOTIFY_PROVIDER=resend|sendgrid|log (default: log)
-// Set NOTIFY_API_KEY and NOTIFY_FROM_EMAIL in .env
-
-import { SystemEvent } from "./events";
-
-export type NotifyProvider = "resend" | "sendgrid" | "log";
-
-const PROVIDER = (process.env.NOTIFY_PROVIDER || "log") as NotifyProvider;
-const API_KEY = process.env.NOTIFY_API_KEY || "";
-const FROM_EMAIL = process.env.NOTIFY_FROM_EMAIL || "noreply@example.com";
-
-export interface NotifyMessage {
-  to: string;
-  subject: string;
-  body: string;
-}
-
-async function sendEmail(msg: NotifyMessage): Promise<void> {
-  if (PROVIDER === "log") {
-    console.log(`[notify] ${msg.subject} → ${msg.to}`);
-    return;
-  }
-  if (PROVIDER === "resend") {
-    const res = await fetch("https://api.resend.com/emails", {
-      method: "POST",
-      headers: { "Authorization": `Bearer ${API_KEY}`, "Content-Type": "application/json" },
-      body: JSON.stringify({ from: FROM_EMAIL, to: msg.to, subject: msg.subject, html: msg.body }),
-    });
-    if (!res.ok) throw new Error(`Resend error: ${res.status}`);
-    return;
-  }
-  if (PROVIDER === "sendgrid") {
-    const res = await fetch("https://api.sendgrid.com/v3/mail/send", {
-      method: "POST",
-      headers: { "Authorization": `Bearer ${API_KEY}`, "Content-Type": "application/json" },
-      body: JSON.stringify({ personalizations: [{ to: [{ email: msg.to }] }], from: { email: FROM_EMAIL }, subject: msg.subject, content: [{ type: "text/html", value: msg.body }] }),
-    });
-    if (!res.ok) throw new Error(`SendGrid error: ${res.status}`);
-    return;
-  }
-}
-
-// Handler for SessionCreated
-export async function notifySessionCreated(event: SystemEvent, recipientEmail: string): Promise<void> {
-  await sendEmail({
-    to: recipientEmail,
-    subject: "SessionCreated notification",
-    body: `<p>Event <strong>SessionCreated</strong> occurred.</p><pre>${JSON.stringify(event.payload, null, 2)}</pre>`,
-  });
-}
-
-// Handler for SessionStateChanged
-export async function notifySessionStateChanged(event: SystemEvent, recipientEmail: string): Promise<void> {
-  await sendEmail({
-    to: recipientEmail,
-    subject: "SessionStateChanged notification",
-    body: `<p>Event <strong>SessionStateChanged</strong> occurred.</p><pre>${JSON.stringify(event.payload, null, 2)}</pre>`,
-  });
-}
-
-// Handler for MessageAdded
-export async function notifyMessageAdded(event: SystemEvent, recipientEmail: string): Promise<void> {
-  await sendEmail({
-    to: recipientEmail,
-    subject: "MessageAdded notification",
-    body: `<p>Event <strong>MessageAdded</strong> occurred.</p><pre>${JSON.stringify(event.payload, null, 2)}</pre>`,
-  });
-}
-
-// Handler for PartUpdated
-export async function notifyPartUpdated(event: SystemEvent, recipientEmail: string): Promise<void> {
-  await sendEmail({
-    to: recipientEmail,
-    subject: "PartUpdated notification",
-    body: `<p>Event <strong>PartUpdated</strong> occurred.</p><pre>${JSON.stringify(event.payload, null, 2)}</pre>`,
-  });
-}
-
-// Handler for SessionCompacted
-export async function notifySessionCompacted(event: SystemEvent, recipientEmail: string): Promise<void> {
-  await sendEmail({
-    to: recipientEmail,
-    subject: "SessionCompacted notification",
-    body: `<p>Event <strong>SessionCompacted</strong> occurred.</p><pre>${JSON.stringify(event.payload, null, 2)}</pre>`,
-  });
-}
-
-export function registerNotificationHandlers(eventBus: any): void {
-  // TODO: implement recipient lookup per event type
-  // eventBus.subscribe("SessionCreated", async (event: SystemEvent) => {
-  //   const recipientEmail = await lookupRecipient(event);
-  //   await notifySessionCreated(event, recipientEmail);
-  // });
-  // eventBus.subscribe("SessionStateChanged", async (event: SystemEvent) => {
-  //   const recipientEmail = await lookupRecipient(event);
-  //   await notifySessionStateChanged(event, recipientEmail);
-  // });
-  // eventBus.subscribe("MessageAdded", async (event: SystemEvent) => {
-  //   const recipientEmail = await lookupRecipient(event);
-  //   await notifyMessageAdded(event, recipientEmail);
-  // });
-  // eventBus.subscribe("PartUpdated", async (event: SystemEvent) => {
-  //   const recipientEmail = await lookupRecipient(event);
-  //   await notifyPartUpdated(event, recipientEmail);
-  // });
-  // eventBus.subscribe("SessionCompacted", async (event: SystemEvent) => {
-  //   const recipientEmail = await lookupRecipient(event);
-  //   await notifySessionCompacted(event, recipientEmail);
-  // });
-}
+// Generated by BoneScript compiler.
+// Notification service — fires on event emissions.
+// Configure NOTIFY_PROVIDER=resend|sendgrid|log (default: log)
+// Set NOTIFY_API_KEY and NOTIFY_FROM_EMAIL in .env
+
+import { SystemEvent } from "./events";
+
+export type NotifyProvider = "resend" | "sendgrid" | "log";
+
+const PROVIDER = (process.env.NOTIFY_PROVIDER || "log") as NotifyProvider;
+const API_KEY = process.env.NOTIFY_API_KEY || "";
+const FROM_EMAIL = process.env.NOTIFY_FROM_EMAIL || "noreply@example.com";
+
+export interface NotifyMessage {
+  to: string;
+  subject: string;
+  body: string;
+}
+
+async function sendEmail(msg: NotifyMessage): Promise<void> {
+  if (PROVIDER === "log") {
+    console.log(`[notify] ${msg.subject} → ${msg.to}`);
+    return;
+  }
+  if (PROVIDER === "resend") {
+    const res = await fetch("https://api.resend.com/emails", {
+      method: "POST",
+      headers: { "Authorization": `Bearer ${API_KEY}`, "Content-Type": "application/json" },
+      body: JSON.stringify({ from: FROM_EMAIL, to: msg.to, subject: msg.subject, html: msg.body }),
+    });
+    if (!res.ok) throw new Error(`Resend error: ${res.status}`);
+    return;
+  }
+  if (PROVIDER === "sendgrid") {
+    const res = await fetch("https://api.sendgrid.com/v3/mail/send", {
+      method: "POST",
+      headers: { "Authorization": `Bearer ${API_KEY}`, "Content-Type": "application/json" },
+      body: JSON.stringify({ personalizations: [{ to: [{ email: msg.to }] }], from: { email: FROM_EMAIL }, subject: msg.subject, content: [{ type: "text/html", value: msg.body }] }),
+    });
+    if (!res.ok) throw new Error(`SendGrid error: ${res.status}`);
+    return;
+  }
+}
+
+// Handler for SessionCreated
+export async function notifySessionCreated(event: SystemEvent, recipientEmail: string): Promise<void> {
+  await sendEmail({
+    to: recipientEmail,
+    subject: "SessionCreated notification",
+    body: `<p>Event <strong>SessionCreated</strong> occurred.</p><pre>${JSON.stringify(event.payload, null, 2)}</pre>`,
+  });
+}
+
+// Handler for SessionStateChanged
+export async function notifySessionStateChanged(event: SystemEvent, recipientEmail: string): Promise<void> {
+  await sendEmail({
+    to: recipientEmail,
+    subject: "SessionStateChanged notification",
+    body: `<p>Event <strong>SessionStateChanged</strong> occurred.</p><pre>${JSON.stringify(event.payload, null, 2)}</pre>`,
+  });
+}
+
+// Handler for MessageAdded
+export async function notifyMessageAdded(event: SystemEvent, recipientEmail: string): Promise<void> {
+  await sendEmail({
+    to: recipientEmail,
+    subject: "MessageAdded notification",
+    body: `<p>Event <strong>MessageAdded</strong> occurred.</p><pre>${JSON.stringify(event.payload, null, 2)}</pre>`,
+  });
+}
+
+// Handler for PartUpdated
+export async function notifyPartUpdated(event: SystemEvent, recipientEmail: string): Promise<void> {
+  await sendEmail({
+    to: recipientEmail,
+    subject: "PartUpdated notification",
+    body: `<p>Event <strong>PartUpdated</strong> occurred.</p><pre>${JSON.stringify(event.payload, null, 2)}</pre>`,
+  });
+}
+
+// Handler for SessionCompacted
+export async function notifySessionCompacted(event: SystemEvent, recipientEmail: string): Promise<void> {
+  await sendEmail({
+    to: recipientEmail,
+    subject: "SessionCompacted notification",
+    body: `<p>Event <strong>SessionCompacted</strong> occurred.</p><pre>${JSON.stringify(event.payload, null, 2)}</pre>`,
+  });
+}
+
+export function registerNotificationHandlers(eventBus: any): void {
+  // TODO: implement recipient lookup per event type
+  // eventBus.subscribe("SessionCreated", async (event: SystemEvent) => {
+  //   const recipientEmail = await lookupRecipient(event);
+  //   await notifySessionCreated(event, recipientEmail);
+  // });
+  // eventBus.subscribe("SessionStateChanged", async (event: SystemEvent) => {
+  //   const recipientEmail = await lookupRecipient(event);
+  //   await notifySessionStateChanged(event, recipientEmail);
+  // });
+  // eventBus.subscribe("MessageAdded", async (event: SystemEvent) => {
+  //   const recipientEmail = await lookupRecipient(event);
+  //   await notifyMessageAdded(event, recipientEmail);
+  // });
+  // eventBus.subscribe("PartUpdated", async (event: SystemEvent) => {
+  //   const recipientEmail = await lookupRecipient(event);
+  //   await notifyPartUpdated(event, recipientEmail);
+  // });
+  // eventBus.subscribe("SessionCompacted", async (event: SystemEvent) => {
+  //   const recipientEmail = await lookupRecipient(event);
+  //   await notifySessionCompacted(event, recipientEmail);
+  // });
+}

package/bone/output/session/src/routes/message.ts

@@ -1,93 +1,93 @@
-// Generated by BoneScript compiler. DO NOT EDIT.
-// Service: MessageService
-import { Router, Request, Response } from "express";
-import { v4 as uuid } from "uuid";
-import { query, queryOne, execute, pool } from "../db";
-import { eventBus } from "../events";
-import { requireAuth, AuthContext } from "../auth";
-import rateLimit from "express-rate-limit";
-import { auditLog } from "../audit";
-import { logger } from "../logger";
-import { counter } from "../metrics";
-import * as __algorithms from "../algorithms";
-const { shortestPath, topologicalSort, binarySearch, bipartiteMatching, roundRobin, weightedAverage, percentile, rankBy, consistentHash } = __algorithms as any;
-
-export const messagesRouter = Router();
-
-// Rate limiter from policy declaration
-const __routeRateLimit = rateLimit({ windowMs: 60000, max: 500, standardHeaders: true, legacyHeaders: false });
-
-// CREATE
-messagesRouter.post("/", __routeRateLimit, requireAuth, async (req: Request, res: Response) => {
-  try {
-    const id = uuid();
-    const { session_id, role, model_id, provider_id, tokens_input, tokens_output, cost_usd, error } = req.body;
-    const sql = `INSERT INTO messages (id, session_id, role, model_id, provider_id, tokens_input, tokens_output, cost_usd, error) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9) RETURNING *`;
-    const rows = await query(sql, [id, session_id, role, model_id, provider_id, tokens_input, tokens_output, cost_usd, error]);
-    counter("entity.created", { entity: "Message" });
-    res.status(201).json(rows[0]);
-  } catch (e: any) {
-    res.status(400).json({ error: { code: "CREATE_FAILED", message: e.message } });
-  }
-});
-
-// READ
-messagesRouter.get("/:id", __routeRateLimit, requireAuth, async (req: Request, res: Response) => {
-  try {
-    const row = await queryOne(`SELECT * FROM messages WHERE id = $1`, [req.params.id]);
-    if (!row) return res.status(404).json({ error: { code: "NOT_FOUND", message: "Not found" } });
-    res.json(row);
-  } catch (e: any) {
-    res.status(500).json({ error: { code: "DB_ERROR", message: e.message } });
-  }
-});
-
-// LIST
-messagesRouter.get("/", __routeRateLimit, requireAuth, async (req: Request, res: Response) => {
-  try {
-    const page = parseInt(req.query.page as string) || 1;
-    const pageSize = Math.min(parseInt(req.query.page_size as string) || 50, 100);
-    const offset = (page - 1) * pageSize;
-    const rows = await query(`SELECT messages.*, row_to_json(session.*) as owner_session FROM messages LEFT JOIN sessions session ON messages.session_id = session.id ORDER BY messages.created_at DESC LIMIT $1 OFFSET $2`, [pageSize, offset]);
-    const [{ count }] = await query(`SELECT COUNT(*) as count FROM messages`);
-    res.json({ items: rows, total: parseInt(count), page, page_size: pageSize });
-  } catch (e: any) {
-    res.status(500).json({ error: { code: "DB_ERROR", message: e.message } });
-  }
-});
-
-// UPDATE
-messagesRouter.put("/:id", __routeRateLimit, requireAuth, async (req: Request, res: Response) => {
-  const fields = { ...req.body };
-  const sets = Object.keys(fields).map((k, i) => `${k} = $${i + 2}`).join(", ");
-  const values = Object.values(fields);
-  const sql = `UPDATE messages SET ${sets}, updated_at = NOW() WHERE id = $1 RETURNING *`;
-  const rows = await query(sql, [req.params.id, ...values]);
-  if (rows.length === 0) return res.status(404).json({ error: { code: "NOT_FOUND", message: "Not found" } });
-  res.json(rows[0]);
-});
-
-// DELETE
-messagesRouter.delete("/:id", __routeRateLimit, requireAuth, async (req: Request, res: Response) => {
-  try {
-    const count = await execute(`DELETE FROM messages WHERE id = $1`, [req.params.id]);
-    if (count === 0) return res.status(404).json({ error: { code: "NOT_FOUND", message: "Not found" } });
-    res.status(204).send();
-  } catch (e: any) {
-    res.status(500).json({ error: { code: "DB_ERROR", message: e.message } });
-  }
-});
-
-// RELATION: parts (has_many Part)
-messagesRouter.get("/:id/parts", requireAuth, async (req: Request, res: Response) => {
-  try {
-    const page = parseInt(req.query.page as string) || 1;
-    const pageSize = Math.min(parseInt(req.query.page_size as string) || 50, 100);
-    const offset = (page - 1) * pageSize;
-    const rows = await query(`SELECT * FROM parts WHERE message_id = $1 ORDER BY created_at DESC LIMIT $2 OFFSET $3`, [req.params.id, pageSize, offset]);
-    const [{ count }] = await query(`SELECT COUNT(*) as count FROM parts WHERE message_id = $1`, [req.params.id]);
-    res.json({ items: rows, total: parseInt(count), page, page_size: pageSize });
-  } catch (e: any) {
-    res.status(500).json({ error: { code: "DB_ERROR", message: e.message } });
-  }
-});
+// Generated by BoneScript compiler. DO NOT EDIT.
+// Service: MessageService
+import { Router, Request, Response } from "express";
+import { v4 as uuid } from "uuid";
+import { query, queryOne, execute, pool } from "../db";
+import { eventBus } from "../events";
+import { requireAuth, AuthContext } from "../auth";
+import rateLimit from "express-rate-limit";
+import { auditLog } from "../audit";
+import { logger } from "../logger";
+import { counter } from "../metrics";
+import * as __algorithms from "../algorithms";
+const { shortestPath, topologicalSort, binarySearch, bipartiteMatching, roundRobin, weightedAverage, percentile, rankBy, consistentHash } = __algorithms as any;
+
+export const messagesRouter = Router();
+
+// Rate limiter from policy declaration
+const __routeRateLimit = rateLimit({ windowMs: 60000, max: 500, standardHeaders: true, legacyHeaders: false });
+
+// CREATE
+messagesRouter.post("/", __routeRateLimit, requireAuth, async (req: Request, res: Response) => {
+  try {
+    const id = uuid();
+    const { session_id, role, model_id, provider_id, tokens_input, tokens_output, cost_usd, error } = req.body;
+    const sql = `INSERT INTO messages (id, session_id, role, model_id, provider_id, tokens_input, tokens_output, cost_usd, error) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9) RETURNING *`;
+    const rows = await query(sql, [id, session_id, role, model_id, provider_id, tokens_input, tokens_output, cost_usd, error]);
+    counter("entity.created", { entity: "Message" });
+    res.status(201).json(rows[0]);
+  } catch (e: any) {
+    res.status(400).json({ error: { code: "CREATE_FAILED", message: e.message } });
+  }
+});
+
+// READ
+messagesRouter.get("/:id", __routeRateLimit, requireAuth, async (req: Request, res: Response) => {
+  try {
+    const row = await queryOne(`SELECT * FROM messages WHERE id = $1`, [req.params.id]);
+    if (!row) return res.status(404).json({ error: { code: "NOT_FOUND", message: "Not found" } });
+    res.json(row);
+  } catch (e: any) {
+    res.status(500).json({ error: { code: "DB_ERROR", message: e.message } });
+  }
+});
+
+// LIST
+messagesRouter.get("/", __routeRateLimit, requireAuth, async (req: Request, res: Response) => {
+  try {
+    const page = parseInt(req.query.page as string) || 1;
+    const pageSize = Math.min(parseInt(req.query.page_size as string) || 50, 100);
+    const offset = (page - 1) * pageSize;
+    const rows = await query(`SELECT messages.*, row_to_json(session.*) as owner_session FROM messages LEFT JOIN sessions session ON messages.session_id = session.id ORDER BY messages.created_at DESC LIMIT $1 OFFSET $2`, [pageSize, offset]);
+    const [{ count }] = await query(`SELECT COUNT(*) as count FROM messages`);
+    res.json({ items: rows, total: parseInt(count), page, page_size: pageSize });
+  } catch (e: any) {
+    res.status(500).json({ error: { code: "DB_ERROR", message: e.message } });
+  }
+});
+
+// UPDATE
+messagesRouter.put("/:id", __routeRateLimit, requireAuth, async (req: Request, res: Response) => {
+  const fields = { ...req.body };
+  const sets = Object.keys(fields).map((k, i) => `${k} = $${i + 2}`).join(", ");
+  const values = Object.values(fields);
+  const sql = `UPDATE messages SET ${sets}, updated_at = NOW() WHERE id = $1 RETURNING *`;
+  const rows = await query(sql, [req.params.id, ...values]);
+  if (rows.length === 0) return res.status(404).json({ error: { code: "NOT_FOUND", message: "Not found" } });
+  res.json(rows[0]);
+});
+
+// DELETE
+messagesRouter.delete("/:id", __routeRateLimit, requireAuth, async (req: Request, res: Response) => {
+  try {
+    const count = await execute(`DELETE FROM messages WHERE id = $1`, [req.params.id]);
+    if (count === 0) return res.status(404).json({ error: { code: "NOT_FOUND", message: "Not found" } });
+    res.status(204).send();
+  } catch (e: any) {
+    res.status(500).json({ error: { code: "DB_ERROR", message: e.message } });
+  }
+});
+
+// RELATION: parts (has_many Part)
+messagesRouter.get("/:id/parts", requireAuth, async (req: Request, res: Response) => {
+  try {
+    const page = parseInt(req.query.page as string) || 1;
+    const pageSize = Math.min(parseInt(req.query.page_size as string) || 50, 100);
+    const offset = (page - 1) * pageSize;
+    const rows = await query(`SELECT * FROM parts WHERE message_id = $1 ORDER BY created_at DESC LIMIT $2 OFFSET $3`, [req.params.id, pageSize, offset]);
+    const [{ count }] = await query(`SELECT COUNT(*) as count FROM parts WHERE message_id = $1`, [req.params.id]);
+    res.json({ items: rows, total: parseInt(count), page, page_size: pageSize });
+  } catch (e: any) {
+    res.status(500).json({ error: { code: "DB_ERROR", message: e.message } });
+  }
+});