cursedbelt 0.0.0 → 2.3.0

package/dist/server/runtime/localHost.js

@@ -0,0 +1,372 @@
+/**
+ * The LOCAL profile's host plumbing (02 §1) — everything `bootEngineApp`
+ * deliberately does not construct.
+ *
+ * The recipe refuses to invent paths, keys or a telemetry database, and that
+ * refusal is a law (handle injection, 01 §1.1.3): a library that opens its own
+ * files puts the storage layout back inside the library, where a generated app
+ * can never change it. But the work still has to happen somewhere, and "somewhere"
+ * must not be N copies of the same twenty lines pasted into N generated
+ * `server.ts` files — that is precisely the divergence the recipe exists to end.
+ *
+ * So this is the local host, once, as a tested unit. It owns four things a
+ * machine-level host owns and a library must not:
+ *
+ *   1. **Where the app's data lives** — `<app-data-home>/instances/<appId>`, where
+ *      the home is CONFIGURATION ({@link resolveAppDataHome}): an explicit
+ *      argument, else `$APP_DATA_HOME`, else the OS convention. Never a bespoke
+ *      `~/.<app>` directory, and never a folder named after one machine's owner.
+ *   2. **Key custody.** The object-store URL signing key and the telemetry row
+ *      integrity key are minted once, persisted `0600`, and read back **as bytes**
+ *      — never as a string (V6 `key-material-as-string`; a hex string of a key
+ *      lands in GC-managed RAM with no way to zeroize it).
+ *   3. **The telemetry tier**, opened and migrated, with the row signer
+ *      `meter_events.row_signature` is NOT NULL for.
+ *   4. **The GuardEngine's identity tier** ({@link createLocalGuardServices}) —
+ *      the app's own registry file, the argon2id binding, and the
+ *      manager/secrets/identity trio `bootEngineApp({ guardDeps })` needs. Split
+ *      out rather than folded in, so an app with no guard engine opens no
+ *      registry file and loads no native KDF.
+ *   5. **The DevStudio's registry handle** ({@link createLocalDevServices}) —
+ *      same split, same reason.
+ *
+ * A SaaS host wires its own equivalents (pooled Postgres, S3, a shared telemetry
+ * database); nothing here is reachable from that path.
+ */
+import { Database } from 'bun:sqlite';
+import { generateKeyPairSync } from 'node:crypto';
+import { chmodSync, existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { assertArgon2idReady, CC_SALT_BYTES, createRowSigner, createSecretEnvelopeManager, SecureKey, } from 'cwip/guard';
+import { CC_REGISTRY_MIGRATIONS, CC_REGISTRY_NAMESPACE, createRegistryIdentityStore, createRegistrySecretsStore, } from 'cwip/cc-registry';
+import { assertCcPragmas, getTxnLifetimeGuard, runNamespacedMigrations } from 'cwip/sqlite';
+import { createSqliteExecutor } from 'cwip/storage';
+import { registerNodeRsArgon2id } from '../guard/argon2Binding';
+import { createSessionSigner } from '../guard/sessionSigner';
+import { createTelemetryWriter, openTelemetryDatabase, } from 'cwip/telemetry';
+import { resolveAppDataHome } from '../paths/appDataHome';
+/** Bytes in a minted key file. Matches cwip's `CC_KEY_BYTES`. */
+export const HOST_KEY_BYTES = 32;
+/**
+ * `<app-data-home>/instances/<appId>` — the app's data root.
+ *
+ * A HOST function, not a library one: `openDomainHandles` still refuses to derive
+ * a path, and this is the thing that hands it one. The home underneath it is
+ * {@link resolveAppDataHome} — configuration, then the OS convention, and nothing
+ * else. A published package may not go looking for a directory it invented in
+ * somebody's home.
+ */
+export function resolveAppDataRoot(options) {
+    const override = options.override?.trim();
+    if (override)
+        return path.resolve(override);
+    return path.join(resolveAppDataHome({ env: options.env }), 'instances', options.appId);
+}
+/**
+ * Read a persisted key file, minting it on first boot. Bytes in, bytes out —
+ * the material is never rendered as a string, and the file is `0600` from the
+ * moment it exists (written to a temp name and chmod'd before the rename would be
+ * stricter still; `writeFileSync` with `mode` is applied at create time, which
+ * closes the window for a file this process creates).
+ */
+export function loadOrMintKeyFile(file, byteLength = HOST_KEY_BYTES) {
+    if (existsSync(file)) {
+        const bytes = new Uint8Array(readFileSync(file));
+        if (bytes.byteLength === byteLength)
+            return bytes;
+        throw new Error(`Key file ${file} holds ${bytes.byteLength} bytes, expected ${byteLength}. Refusing to sign with a truncated key — move the file aside to mint a fresh one (this invalidates URLs signed with the old key).`);
+    }
+    mkdirSync(path.dirname(file), { recursive: true });
+    const key = SecureKey.random(byteLength, path.basename(file));
+    const material = key.use((bytes) => new Uint8Array(bytes));
+    writeFileSync(file, material, { mode: 0o600 });
+    chmodSync(file, 0o600); // umask cannot loosen an explicit chmod
+    key.destroy();
+    return material;
+}
+/**
+ * The app's session-signing key, minted once and persisted `0600` as a PKCS8 PEM.
+ *
+ * `createSessionSigner()` with no key generates an EPHEMERAL Ed25519 pair, which
+ * is correct only for a single-process dev server: every restart invalidates
+ * every live session (a deploy silently logs every user out) and a second
+ * process — the saas worker, a companion — cannot verify a token the server
+ * minted. Persisting the key is what makes both work, so the local host does it
+ * rather than leaving each generated app to rediscover the problem.
+ */
+export function loadOrMintSessionKey(file) {
+    if (existsSync(file))
+        return readFileSync(file, 'utf8');
+    const { privateKey } = generateKeyPairSync('ed25519');
+    const pem = privateKey.export({ type: 'pkcs8', format: 'pem' });
+    mkdirSync(path.dirname(file), { recursive: true });
+    writeFileSync(file, pem, { mode: 0o600 });
+    chmodSync(file, 0o600);
+    return pem;
+}
+/**
+ * Build the local host's services. Idempotent across boots: the keys persist, so
+ * a signed media URL minted before a restart still verifies after it (regenerating
+ * the signing key per boot silently 404s every `<img>` on the page after a deploy).
+ */
+export function createLocalHostServices(options) {
+    const root = path.resolve(options.root);
+    mkdirSync(root, { recursive: true });
+    const objectStoreRoot = path.join(root, 'objects');
+    mkdirSync(objectStoreRoot, { recursive: true });
+    const objectStoreSigningKey = loadOrMintKeyFile(path.join(root, 'object-signing.key'));
+    let telemetryDb = null;
+    telemetryDb = openTelemetryDatabase({
+        open: (file) => new Database(file, { create: true }),
+        ...(options.appManagedHome === undefined ? {} : { appManagedHome: options.appManagedHome }),
+    });
+    const integrityKey = SecureKey.adopt(loadOrMintKeyFile(path.join(root, 'row-integrity.key')), 'machine-integrity');
+    const telemetry = createTelemetryWriter({
+        db: telemetryDb.db,
+        spillPath: telemetryDb.paths.spillPath,
+        signer: createRowSigner({ integrityKey }),
+    });
+    const jobsDb = new Database(path.join(root, 'jobs.db'), { create: true });
+    const governanceDb = new Database(path.join(root, 'governance.db'), { create: true });
+    const governanceExecutor = createSqliteExecutor(governanceDb);
+    const signer = createSessionSigner({
+        privateKey: loadOrMintSessionKey(path.join(root, 'session.key')),
+        ttlSeconds: options.sessionTtlSeconds ?? 3600,
+    });
+    return {
+        root,
+        telemetry,
+        telemetryDb,
+        objectStoreRoot,
+        objectStoreSigningKey,
+        jobsDb,
+        governanceDb,
+        governanceExecutor,
+        signer,
+        async close() {
+            // Flush BEFORE closing the handle: queued meter events are billing rows,
+            // and dropping them on shutdown is the one loss this tier may never take.
+            await telemetry.flush?.();
+            await telemetry.close?.();
+            integrityKey.destroy();
+            jobsDb.close();
+            governanceDb.close();
+            telemetryDb?.close();
+        },
+    };
+}
+/**
+ * The GuardEngine half of the local host (02 §2-tail) — the seam that makes a
+ * generated app genuinely loginable.
+ *
+ * `AccountService`, the auth routes and the wired limiter all landed in 02 §1/§2,
+ * but no SHIPPING host ever constructed `guardDeps`, so a real generated app
+ * still answered 404 on `/api/guard/login`: the whole tier was reachable only
+ * from `recipe.spec.ts`. This function is what a `server.ts` calls, and it owns
+ * the four things a library must not decide:
+ *
+ *   1. **Which file the identity lives in.** `<root>/registry.db` — the app's
+ *      OWN registry, never the machine-wide `cc-registry.db`. The station is the
+ *      sole DDL owner of that shared file (V6 `client-ddl-on-shared-db`), and
+ *      two generated apps sharing one account table is a tenancy decision no
+ *      generator gets to make silently. Same schema, same station-authored
+ *      migration chain, per-app file.
+ *   2. **Row integrity.** The identity and secrets tables are HMAC-signed with
+ *      the SAME persisted machine key the telemetry tier signs with — one key
+ *      file per data root, minted `0600` on first boot.
+ *   3. **The envelope salt**, persisted beside the registry. Minting it per boot
+ *      would change every new envelope's `kdf` block and orphan yesterday's
+ *      secrets behind a reseal.
+ *   4. **The KDF.** cwip ships no argon2id; the binding is registered here, once,
+ *      and `assertArgon2idReady()` proves it took before a single route mounts.
+ *
+ * Async solely because the argon2id binding is an optional native module loaded
+ * with a dynamic `import()` — the generated `server.ts` is already a top-level
+ * `await` module.
+ */
+export async function createLocalGuardServices(options) {
+    const root = path.resolve(options.root);
+    mkdirSync(root, { recursive: true });
+    // FIRST, before a handle is opened: a missing binding must fail the boot, not
+    // leave a half-built tier behind on the way out.
+    await (options.registerKdf ?? registerNodeRsArgon2id)();
+    assertArgon2idReady();
+    const registryFile = path.join(root, 'registry.db');
+    const registryDb = (options.openDatabase ?? ((file) => new Database(file, { create: true })))(registryFile);
+    assertCcPragmas(registryDb);
+    runNamespacedMigrations(registryDb, CC_REGISTRY_MIGRATIONS, { namespace: CC_REGISTRY_NAMESPACE });
+    // A SECOND SecureKey over the same key file the telemetry writer signs with —
+    // deliberately not a shared instance: each owner zeroizes its own copy on
+    // close, and sharing one would make either close() a use-after-destroy for the
+    // other.
+    const integrityKey = SecureKey.adopt(loadOrMintKeyFile(path.join(root, 'row-integrity.key')), 'machine-integrity');
+    const signer = createRowSigner({ integrityKey });
+    // The KDF salt is NOT secret (envelopes carry it in the clear), but it must be
+    // STABLE — `loadOrMintKeyFile` is the persistence path already proven `0600`.
+    const manager = createSecretEnvelopeManager({
+        salt: loadOrMintKeyFile(path.join(root, 'envelope.salt'), CC_SALT_BYTES),
+    });
+    return {
+        registryFile,
+        registryDb,
+        deps: {
+            manager,
+            secrets: createRegistrySecretsStore(registryDb, { manager, signer }),
+            identity: createRegistryIdentityStore(registryDb, { signer }),
+        },
+        close() {
+            manager.lock();
+            getTxnLifetimeGuard(registryDb)?.dispose();
+            registryDb.close();
+            integrityKey.destroy();
+        },
+    };
+}
+/** Extensions the screenshot source publishes, and the type each is served as. */
+const SCREENSHOT_TYPES = Object.freeze({
+    '.png': 'image/png',
+    '.jpg': 'image/jpeg',
+    '.jpeg': 'image/jpeg',
+    '.webp': 'image/webp',
+    '.avif': 'image/avif',
+    '.gif': 'image/gif',
+});
+/**
+ * The local `ScreenshotSource` — a flat directory of captures.
+ *
+ * Three properties make it safe to hand a URL segment to, and all three come
+ * from the same decision: the LISTING is the authority, not the caller's string.
+ *
+ *   * Only files whose extension is in {@link SCREENSHOT_TYPES} are published,
+ *     so the source can never serve an `.env` that happens to be in the folder.
+ *   * The list is FLAT — sub-directories are not descended and a name containing
+ *     a separator is never produced, so no listed name can traverse.
+ *   * `read` re-checks the name against the same rules before it opens anything;
+ *     `DevService.readScreenshot` also matches the name against the live listing
+ *     first. Two independent checks, because this is the one dev route that
+ *     turns a caller-supplied segment into a file handle.
+ *
+ * A missing directory is an EMPTY listing, not a boot failure: an operator who
+ * turned the feature on before their first capture should see "no screenshots
+ * yet", and the directory appears the moment something writes one.
+ */
+export function createLocalScreenshotSource(root) {
+    const resolvedRoot = path.resolve(root);
+    const publishable = (name) => {
+        if (name !== path.basename(name))
+            return null; // never a path, only a name
+        if (name.startsWith('.'))
+            return null;
+        return SCREENSHOT_TYPES[path.extname(name).toLowerCase()] ?? null;
+    };
+    return {
+        list() {
+            let names;
+            try {
+                names = readdirSync(resolvedRoot);
+            }
+            catch {
+                return [];
+            }
+            const entries = [];
+            for (const name of names) {
+                const contentType = publishable(name);
+                if (!contentType)
+                    continue;
+                let stats;
+                try {
+                    stats = statSync(path.join(resolvedRoot, name));
+                }
+                catch {
+                    continue; // vanished between readdir and stat
+                }
+                if (!stats.isFile())
+                    continue;
+                entries.push({ name, bytes: stats.size, capturedAt: stats.mtime.toISOString(), contentType });
+            }
+            // Newest first — a capture gallery is read from the most recent shot.
+            return entries.sort((a, b) => b.capturedAt.localeCompare(a.capturedAt));
+        },
+        read(name) {
+            const contentType = publishable(name);
+            if (!contentType)
+                return null;
+            try {
+                return { bytes: new Uint8Array(readFileSync(path.join(resolvedRoot, name))), contentType };
+            }
+            catch {
+                return null;
+            }
+        },
+    };
+}
+/**
+ * The DevStudio half of the local host (03 §2c) — the seam whose absence made
+ * the `dev` engine **unbootable in a generated app**.
+ *
+ * `DevService`, `dev.mixin.ts` and the five DevStudio views all landed arcs ago,
+ * and `buildEngineServices` has always thrown `DEV_DEPS_MISSING` when the engine
+ * is active with no `devDeps` — but no shipping host ever constructed them, and
+ * the generated `server.ts` emitted nothing for dev. Every app whose config
+ * activated the engine died at boot with a 500 before serving a byte. The
+ * migrator found it on the first real app, because `plugin-app-info` maps to
+ * `dev.appRegistry` and the then-live local-gallery app mounted it.
+ *
+ * What it decides — the two things a library must not:
+ *
+ *   1. **Which registry the app board reads.** `<root>/registry.db`, the app's
+ *      OWN file, for exactly the reason the guard tier uses it: the station is
+ *      the sole DDL owner of the machine-wide `cc-registry.db` (V6
+ *      `client-ddl-on-shared-db`), and a generated app silently attaching to the
+ *      machine fleet database is a decision no generator gets to make. A host
+ *      that genuinely wants the machine board passes that handle in.
+ *   2. **That it is ONE handle.** With the guard engine active the caller passes
+ *      `guard.registryDb` and this opens nothing — same file, same chain, one
+ *      lock.
+ *
+ * `snapshotRoot`/`snapshot` are deliberately NOT set here: the recipe defaults
+ * them from the domain handles it opens, which is the only place those handles
+ * exist (see {@link DevServiceDeps.snapshot}).
+ */
+export function createLocalDevServices(options) {
+    const root = path.resolve(options.root);
+    mkdirSync(root, { recursive: true });
+    const registryFile = path.join(root, 'registry.db');
+    const shared = options.registryDb !== undefined;
+    const registryDb = options.registryDb ?? (options.openDatabase ?? ((file) => new Database(file, { create: true })))(registryFile);
+    if (!shared) {
+        assertCcPragmas(registryDb);
+        runNamespacedMigrations(registryDb, CC_REGISTRY_MIGRATIONS, { namespace: CC_REGISTRY_NAMESPACE });
+    }
+    const screenshotRoot = path.resolve(options.screenshotRoot ?? path.join(root, 'screenshots'));
+    // The `ports` row signer (05 §A5). A THIRD SecureKey over the same persisted
+    // machine key file the guard tier and the telemetry writer sign with — one key
+    // per data root, and deliberately not a shared instance, because each owner
+    // zeroizes its own copy on `close()` and sharing one would make either close a
+    // use-after-destroy for the other.
+    //
+    // Not optional and not defaulted-to-nothing: `DevService` reads `ports` (a
+    // signed table) to render the fleet board, and a read that skips
+    // `assertVerified` serves a row edited outside the app as though the registry
+    // had said it — the exact thing `SECURITY_INTEGRITY_VIOLATION` exists to catch.
+    const integrityKey = SecureKey.adopt(loadOrMintKeyFile(path.join(root, 'row-integrity.key')), 'machine-integrity');
+    const portSigner = createRowSigner({ integrityKey });
+    return {
+        registryFile,
+        registryDb,
+        screenshotRoot,
+        deps: { registry: registryDb, portSigner, screenshots: createLocalScreenshotSource(screenshotRoot) },
+        close() {
+            // The key is ours either way — a shared HANDLE is the guard tier's, but
+            // this SecureKey is a copy this function adopted.
+            integrityKey.destroy();
+            // A SHARED handle belongs to whoever opened it — closing it here would
+            // pull the registry out from under the guard tier mid-request.
+            if (shared)
+                return;
+            getTxnLifetimeGuard(registryDb)?.dispose();
+            registryDb.close();
+        },
+    };
+}
+//# sourceMappingURL=localHost.js.map

package/dist/server/runtime/localHost.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localHost.js","sourceRoot":"","sources":["../../../src/server/runtime/localHost.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,QAAQ,EAAc,aAAa,EAAE,MAAM,SAAS,CAAC;AAC3H,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EACL,mBAAmB,EACnB,aAAa,EACb,eAAe,EACf,2BAA2B,EAC3B,SAAS,GACV,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,2BAA2B,EAC3B,0BAA0B,GAC3B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,oBAAoB,EAA0B,MAAM,cAAc,CAAC;AAC5E,OAAO,EAAE,sBAAsB,EAAE,MAAM,wBAAwB,CAAC;AAChE,OAAO,EAAE,mBAAmB,EAAsB,MAAM,wBAAwB,CAAC;AAIjF,OAAO,EACL,qBAAqB,EACrB,qBAAqB,GAGtB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D,iEAAiE;AACjE,MAAM,CAAC,MAAM,cAAc,GAAG,EAAE,CAAC;AAUjC;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAkC;IACnE,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IAC1C,IAAI,QAAQ;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC5C,OAAO,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,aAAqB,cAAc;IACjF,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QACjD,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU;YAAE,OAAO,KAAK,CAAC;QAClD,MAAM,IAAI,KAAK,CACb,YAAY,IAAI,UAAU,KAAK,CAAC,UAAU,oBAAoB,UAAU,oIAAoI,CAC7M,CAAC;IACJ,CAAC;IACD,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IAC3D,aAAa,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/C,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,wCAAwC;IAChE,GAAG,CAAC,OAAO,EAAE,CAAC;IACd,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,IAAI,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxD,MAAM,EAAE,UAAU,EAAE,GAAG,mBAAmB,CAAC,SAAS,CAAC,CAAC;IACtD,MAAM,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAW,CAAC;IAC1E,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1C,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACvB,OAAO,GAAG,CAAC;AACb,CAAC;AAoDD;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAuC;IAC7E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAErC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACnD,SAAS,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,qBAAqB,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAAC;IAEvF,IAAI,WAAW,GAA6B,IAAI,CAAC;IACjD,WAAW,GAAG,qBAAqB,CAAC;QAClC,IAAI,EAAE,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAU;QACrE,GAAG,CAAC,OAAO,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,cAAc,EAAE,CAAC;KAC5F,CAAC,CAAC;IACH,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACnH,MAAM,SAAS,GAAG,qBAAqB,CAAC;QACtC,EAAE,EAAE,WAAW,CAAC,EAAE;QAClB,SAAS,EAAE,WAAW,CAAC,KAAK,CAAC,SAAS;QACtC,MAAM,EAAE,eAAe,CAAC,EAAE,YAAY,EAAE,CAAC;KAC1C,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1E,MAAM,YAAY,GAAG,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IACtF,MAAM,kBAAkB,GAAG,oBAAoB,CAAC,YAAY,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,mBAAmB,CAAC;QACjC,UAAU,EAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QAChE,UAAU,EAAE,OAAO,CAAC,iBAAiB,IAAI,IAAI;KAC9C,CAAC,CAAC;IAEH,OAAO;QACL,IAAI;QACJ,SAAS;QACT,WAAW;QACX,eAAe;QACf,qBAAqB;QACrB,MAAM;QACN,YAAY;QACZ,kBAAkB;QAClB,MAAM;QACN,KAAK,CAAC,KAAK;YACT,yEAAyE;YACzE,0EAA0E;YAC1E,MAAM,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;YAC1B,MAAM,SAAS,CAAC,KAAK,EAAE,EAAE,CAAC;YAC1B,YAAY,CAAC,OAAO,EAAE,CAAC;YACvB,MAAM,CAAC,KAAK,EAAE,CAAC;YACf,YAAY,CAAC,KAAK,EAAE,CAAC;YACrB,WAAW,EAAE,KAAK,EAAE,CAAC;QACvB,CAAC;KACF,CAAC;AACJ,CAAC;AAmCD;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,OAAwC;IACrF,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAErC,8EAA8E;IAC9E,iDAAiD;IACjD,MAAM,CAAC,OAAO,CAAC,WAAW,IAAI,sBAAsB,CAAC,EAAE,CAAC;IACxD,mBAAmB,EAAE,CAAC;IAEtB,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACpD,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACpH,eAAe,CAAC,UAAU,CAAC,CAAC;IAC5B,uBAAuB,CAAC,UAAU,EAAE,sBAAsB,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC,CAAC;IAElG,8EAA8E;IAC9E,0EAA0E;IAC1E,+EAA+E;IAC/E,SAAS;IACT,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACnH,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;IAEjD,+EAA+E;IAC/E,8EAA8E;IAC9E,MAAM,OAAO,GAAG,2BAA2B,CAAC;QAC1C,IAAI,EAAE,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,aAAa,CAAC;KACzE,CAAC,CAAC;IAEH,OAAO;QACL,YAAY;QACZ,UAAU;QACV,IAAI,EAAE;YACJ,OAAO;YACP,OAAO,EAAE,0BAA0B,CAAC,UAAU,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;YACpE,QAAQ,EAAE,2BAA2B,CAAC,UAAU,EAAE,EAAE,MAAM,EAAE,CAAC;SAC9D;QACD,KAAK;YACH,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,mBAAmB,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;YAC3C,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,YAAY,CAAC,OAAO,EAAE,CAAC;QACzB,CAAC;KACF,CAAC;AACJ,CAAC;AAmCD,kFAAkF;AAClF,MAAM,gBAAgB,GAAqC,MAAM,CAAC,MAAM,CAAC;IACvE,MAAM,EAAE,WAAW;IACnB,MAAM,EAAE,YAAY;IACpB,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,YAAY;IACrB,OAAO,EAAE,YAAY;IACrB,MAAM,EAAE,WAAW;CACpB,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAExC,MAAM,WAAW,GAAG,CAAC,IAAY,EAAiB,EAAE;QAClD,IAAI,IAAI,KAAK,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,CAAC,4BAA4B;QAC3E,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACtC,OAAO,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,IAAI,CAAC;IACpE,CAAC,CAAC;IAEF,OAAO;QACL,IAAI;YACF,IAAI,KAAe,CAAC;YACpB,IAAI,CAAC;gBACH,KAAK,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;YACpC,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,CAAC;YACZ,CAAC;YACD,MAAM,OAAO,GAAqB,EAAE,CAAC;YACrC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;gBACtC,IAAI,CAAC,WAAW;oBAAE,SAAS;gBAC3B,IAAI,KAAY,CAAC;gBACjB,IAAI,CAAC;oBACH,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC;gBAClD,CAAC;gBAAC,MAAM,CAAC;oBACP,SAAS,CAAC,oCAAoC;gBAChD,CAAC;gBACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;oBAAE,SAAS;gBAC9B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,sEAAsE;YACtE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAC1E,CAAC;QAED,IAAI,CAAC,IAAY;YACf,MAAM,WAAW,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,WAAW;gBAAE,OAAO,IAAI,CAAC;YAC9B,IAAI,CAAC;gBACH,OAAO,EAAE,KAAK,EAAE,IAAI,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;YAC7F,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAsC;IAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACxC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAErC,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,OAAO,CAAC,UAAU,KAAK,SAAS,CAAC;IAChD,MAAM,UAAU,GACd,OAAO,CAAC,UAAU,IAAI,CAAC,OAAO,CAAC,YAAY,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC;IACzH,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,eAAe,CAAC,UAAU,CAAC,CAAC;QAC5B,uBAAuB,CAAC,UAAU,EAAE,sBAAsB,EAAE,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC,CAAC;IACpG,CAAC;IAED,MAAM,cAAc,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IAE9F,6EAA6E;IAC7E,+EAA+E;IAC/E,4EAA4E;IAC5E,+EAA+E;IAC/E,mCAAmC;IACnC,EAAE;IACF,2EAA2E;IAC3E,iEAAiE;IACjE,8EAA8E;IAC9E,gFAAgF;IAChF,MAAM,YAAY,GAAG,SAAS,CAAC,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;IACnH,MAAM,UAAU,GAAG,eAAe,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC;IAErD,OAAO;QACL,YAAY;QACZ,UAAU;QACV,cAAc;QACd,IAAI,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW,EAAE,2BAA2B,CAAC,cAAc,CAAC,EAAE;QACpG,KAAK;YACH,wEAAwE;YACxE,kDAAkD;YAClD,YAAY,CAAC,OAAO,EAAE,CAAC;YACvB,uEAAuE;YACvE,+DAA+D;YAC/D,IAAI,MAAM;gBAAE,OAAO;YACnB,mBAAmB,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;YAC3C,UAAU,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/server/runtime/meterRollup.pg.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=meterRollup.pg.test.d.ts.map

package/dist/server/runtime/meterRollup.pg.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"meterRollup.pg.test.d.ts","sourceRoot":"","sources":["../../../src/server/runtime/meterRollup.pg.test.ts"],"names":[],"mappings":""}

package/dist/server/runtime/meterRollup.pg.test.js

@@ -0,0 +1,197 @@
+/**
+ * The SHARED meter against a REAL Postgres (04 item 4e, owner decision D26).
+ *
+ * `meterSharing.spec.ts` proves the BEHAVIOR — two booted nodes, real uploads,
+ * a plan ceiling that flips on the rollup — over a SQLite control plane, which
+ * is fast and runs on every gate. What it cannot prove is the SQL, and the SQL
+ * is where this tier's real risk lives:
+ *
+ *   * `ON CONFLICT (event_uuid) DO NOTHING` on a multi-row `VALUES` insert —
+ *     the whole idempotency story, and the clause differs in shape between the
+ *     dialects (the statement carries an explicit `pg` form).
+ *   * `SUM(qty)` over a `bigint` column, which Postgres returns as a STRING.
+ *     `Number(row.used)` is correct and `row.used` alone would silently
+ *     concatenate — a bug that produces a plausible-looking bill.
+ *   * `MAX(local_id)` as the resume cursor, likewise a `bigint`. A cursor read
+ *     as a string compares lexicographically: `"9" > "10"`, so a node past its
+ *     tenth event would stop shipping and nobody would see an error.
+ *   * The compiled DDL — a `CREATE TABLE` that SQLite accepts and Postgres does
+ *     not is a boot failure a fake pool cannot find.
+ *
+ * A fake that answered any of those would be answering with our own assumptions.
+ *
+ *   bun run test:pg          (starts a disposable container, runs, tears down)
+ *   CC_PG_URL=postgres://…   (or point it at any throwaway database)
+ *
+ * SKIPPED, loudly, when `CC_PG_URL` is absent — a skip is a missing proof, never
+ * a passing one. It runs nightly.
+ */
+import { SQL } from 'bun';
+import { Database } from 'bun:sqlite';
+import { afterAll, beforeAll, beforeEach, describe, expect, it } from 'bun:test';
+import { createRowSigner, SecureKey } from 'cwip/guard';
+import { createMemorySyncFileSystem, createMeterRollup, createStatementMeterUsageReader, createTelemetryWriter, ensureSharedMeterSchema, initTelemetryDatabase, SHARED_METER_TABLE, } from 'cwip/telemetry';
+import { createPooledControlExecutor } from '../drivers/pooledControlStores';
+import { createBillingService } from '../services/billingService';
+const URL_ = process.env.CC_PG_URL;
+const TENANT = 't_pg_meter';
+const EPOCH = '1970-01-01T00:00:00.000Z';
+let sql;
+let pool;
+const openNode = (nodeId) => {
+    const errors = [];
+    const db = new Database(':memory:');
+    initTelemetryDatabase(db);
+    const writer = createTelemetryWriter({
+        db: db,
+        signer: createRowSigner({ integrityKey: SecureKey.adopt(new Uint8Array(32).fill(9), 'pg-meter-integrity') }),
+        spillPath: `/${nodeId}-spill.jsonl`,
+        spillFs: createMemorySyncFileSystem(),
+        bindProcessExit: false,
+    });
+    return {
+        db,
+        writer,
+        errors,
+        rollup: createMeterRollup({
+            source: db,
+            target: createPooledControlExecutor(pool),
+            nodeId,
+            autoStart: false,
+            // A pass that throws is SWALLOWED by design (the cursor did not advance,
+            // so the next tick retries). That is right in production and wrong in a
+            // test: the first version of this file read a failed pass as "no rows"
+            // and reported an empty total instead of the Postgres error underneath
+            // it. Collected here and asserted empty, so a failure is a failure.
+            onError: (error) => errors.push(error),
+        }),
+    };
+};
+/** Ship one page and refuse to continue quietly if the pass failed. */
+const shipAll = async (...list) => {
+    for (const node of list) {
+        await node.rollup.drain();
+        expect(node.errors).toEqual([]);
+    }
+};
+// SKIPPED unless CC_PG_URL names a throwaway Postgres — this suite's subject IS the engine. `bun run test:pg` supplies one.
+describe.skipIf(!URL_)('the shared meter against a real Postgres (04 item 4e)', () => {
+    // 120s rather than Bun's 5s, for the reason `pooledControlStores.pg.test.ts`
+    // records: this hook issues real DDL against a real engine, and on a shared CI
+    // runner a timeout here surfaces as a misleading mid-migration connection
+    // close rather than as "the hook was slow".
+    beforeAll(async () => {
+        sql = new SQL(URL_);
+        const connection = {
+            async query(text, params = []) {
+                return (await sql.unsafe(text, [...params]));
+            },
+            async execute(text, params = []) {
+                const result = await sql.unsafe(text, [...params]);
+                return { rowCount: result.count ?? 0 };
+            },
+        };
+        pool = {
+            async withConnection(fn) {
+                return await fn(connection);
+            },
+        };
+        await sql.unsafe(`DROP TABLE IF EXISTS ${SHARED_METER_TABLE}`);
+        await ensureSharedMeterSchema(createPooledControlExecutor(pool));
+    }, 120_000);
+    afterAll(async () => {
+        await sql?.close();
+    });
+    beforeEach(async () => {
+        await sql.unsafe(`DELETE FROM ${SHARED_METER_TABLE}`);
+    });
+    it('sums a tenant’s usage across nodes, with bigint totals read as NUMBERS', async () => {
+        const a = openNode('pg-node-a');
+        const b = openNode('pg-node-b');
+        // Deliberately larger than 2^31 in total: a `bigint` sum returned as a
+        // string and concatenated instead of added is the failure this size makes
+        // visible, and it is exactly the shape that would ship a wrong invoice.
+        a.writer.recordMeterEvent({ tenantId: TENANT, metric: 'storage.bytes', qty: 3_000_000_000 });
+        b.writer.recordMeterEvent({ tenantId: TENANT, metric: 'storage.bytes', qty: 4_000_000_000 });
+        b.writer.recordMeterEvent({ tenantId: TENANT, metric: 'ai.tokens', qty: 12 });
+        await shipAll(a, b);
+        const reader = createStatementMeterUsageReader(createPooledControlExecutor(pool));
+        const totals = await reader.totals({ tenantId: TENANT, since: EPOCH });
+        expect(totals).toEqual([
+            { metric: 'ai.tokens', qty: 12 },
+            { metric: 'storage.bytes', qty: 7_000_000_000 },
+        ]);
+        for (const total of totals)
+            expect(typeof total.qty).toBe('number');
+        // And through the real service, which is what a route answers with.
+        const billing = createBillingService({
+            usage: reader,
+            resolvePlan: () => ({ id: 'pg', title: 'PG', limits: { 'storage.bytes': 10_000_000_000 } }),
+            windowStart: () => EPOCH,
+        });
+        expect(await billing.usage(TENANT)).toEqual([
+            { metric: 'ai.tokens', used: 12, limit: Number.POSITIVE_INFINITY },
+            { metric: 'storage.bytes', used: 7_000_000_000, limit: 10_000_000_000 },
+        ]);
+        a.writer.close();
+        b.writer.close();
+    });
+    it('is idempotent on event_uuid — a re-offered page cannot double-bill', async () => {
+        const node = openNode('pg-node-a');
+        node.writer.recordMeterEvent({ tenantId: TENANT, metric: 'storage.bytes', qty: 500 });
+        node.writer.recordMeterEvent({ tenantId: TENANT, metric: 'storage.bytes', qty: 500 });
+        expect(await node.rollup.tick()).toMatchObject({ shipped: 2, duplicates: 0 });
+        // A second node id over the same source re-offers every row — a restored
+        // backup, or a re-scan after a local reset. `ON CONFLICT DO NOTHING` is the
+        // only thing between that and a doubled invoice, and it is a Postgres
+        // behavior, not a TypeScript one.
+        const clone = createMeterRollup({
+            source: node.db,
+            target: createPooledControlExecutor(pool),
+            nodeId: 'pg-node-a-clone',
+            autoStart: false,
+        });
+        expect(await clone.tick()).toMatchObject({ shipped: 2, duplicates: 2 });
+        const rows = (await sql.unsafe(`SELECT COUNT(*)::int AS n, SUM(qty)::bigint AS total FROM ${SHARED_METER_TABLE} WHERE tenant_id = $1`, [TENANT]));
+        expect(rows[0]?.n).toBe(2);
+        expect(Number(rows[0]?.total)).toBe(1_000);
+        node.writer.close();
+    });
+    it('resumes past 9 — the bigint cursor is compared as a number, not a string', async () => {
+        const node = openNode('pg-node-a');
+        // Twelve events, shipped in pages of five. If `MAX(local_id)` came back as
+        // the string "10", `"9" > "10"` lexicographically and the resume point would
+        // go BACKWARDS — a re-scan every pass, forever, silently.
+        for (let i = 0; i < 12; i += 1)
+            node.writer.recordMeterEvent({ tenantId: TENANT, metric: 'storage.bytes', qty: 1 });
+        const paged = createMeterRollup({
+            source: node.db,
+            target: createPooledControlExecutor(pool),
+            nodeId: 'pg-node-a',
+            limit: 5,
+            autoStart: false,
+        });
+        expect(await paged.drain()).toMatchObject({ shipped: 12, duplicates: 0 });
+        // The restart is where a string cursor actually bites: a fresh object reads
+        // `MAX(local_id)` from Postgres rather than holding it in memory.
+        const restarted = createMeterRollup({
+            source: node.db,
+            target: createPooledControlExecutor(pool),
+            nodeId: 'pg-node-a',
+            autoStart: false,
+        });
+        expect(await restarted.tick()).toMatchObject({ shipped: 0, duplicates: 0, cursor: 12 });
+        node.writer.close();
+    });
+    it('scopes every read to one tenant', async () => {
+        const node = openNode('pg-node-a');
+        node.writer.recordMeterEvent({ tenantId: TENANT, metric: 'storage.bytes', qty: 10 });
+        node.writer.recordMeterEvent({ tenantId: 'someone-else', metric: 'storage.bytes', qty: 9_999 });
+        await node.rollup.tick();
+        const reader = createStatementMeterUsageReader(createPooledControlExecutor(pool));
+        expect(await reader.totals({ tenantId: TENANT, since: EPOCH })).toEqual([{ metric: 'storage.bytes', qty: 10 }]);
+        await expect(reader.totals({ tenantId: '', since: EPOCH })).rejects.toThrow(/scoped/);
+        node.writer.close();
+    });
+});
+//# sourceMappingURL=meterRollup.pg.test.js.map

package/dist/server/runtime/meterRollup.pg.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"meterRollup.pg.test.js","sourceRoot":"","sources":["../../../src/server/runtime/meterRollup.pg.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,GAAG,EAAE,MAAM,KAAK,CAAC;AAC1B,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,UAAU,CAAC;AACjF,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAExD,OAAO,EACL,0BAA0B,EAC1B,iBAAiB,EACjB,+BAA+B,EAC/B,qBAAqB,EACrB,uBAAuB,EACvB,qBAAqB,EACrB,kBAAkB,GAGnB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAElE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC;AACnC,MAAM,MAAM,GAAG,YAAY,CAAC;AAC5B,MAAM,KAAK,GAAG,0BAA0B,CAAC;AAEzC,IAAI,GAAQ,CAAC;AACb,IAAI,IAAc,CAAC;AAUnB,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAQ,EAAE;IACxC,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,UAAU,CAAC,CAAC;IACpC,qBAAqB,CAAC,EAAW,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,qBAAqB,CAAC;QACnC,EAAE,EAAE,EAAW;QACf,MAAM,EAAE,eAAe,CAAC,EAAE,YAAY,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,UAAU,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,oBAAoB,CAAC,EAAE,CAAC;QAC5G,SAAS,EAAE,IAAI,MAAM,cAAc;QACnC,OAAO,EAAE,0BAA0B,EAAE;QACrC,eAAe,EAAE,KAAK;KACvB,CAAC,CAAC;IACH,OAAO;QACL,EAAE;QACF,MAAM;QACN,MAAM;QACN,MAAM,EAAE,iBAAiB,CAAC;YACxB,MAAM,EAAE,EAAW;YACnB,MAAM,EAAE,2BAA2B,CAAC,IAAI,CAAC;YACzC,MAAM;YACN,SAAS,EAAE,KAAK;YAChB,yEAAyE;YACzE,wEAAwE;YACxE,uEAAuE;YACvE,uEAAuE;YACvE,oEAAoE;YACpE,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACvC,CAAC;KACH,CAAC;AACJ,CAAC,CAAC;AAEF,uEAAuE;AACvE,MAAM,OAAO,GAAG,KAAK,EAAE,GAAG,IAAqB,EAAiB,EAAE;IAChE,KAAK,MAAM,IAAI,IAAI,IAAI,EAAE,CAAC;QACxB,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAClC,CAAC;AACH,CAAC,CAAC;AAEF,4HAA4H;AAC5H,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,uDAAuD,EAAE,GAAG,EAAE;IACnF,6EAA6E;IAC7E,+EAA+E;IAC/E,0EAA0E;IAC1E,4CAA4C;IAC5C,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,GAAG,GAAG,IAAI,GAAG,CAAC,IAAc,CAAC,CAAC;QAC9B,MAAM,UAAU,GAAmB;YACjC,KAAK,CAAC,KAAK,CAAI,IAAY,EAAE,SAA6B,EAAE;gBAC1D,OAAO,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAQ,CAAC;YACtD,CAAC;YACD,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,SAA6B,EAAE;gBACzD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC;gBACnD,OAAO,EAAE,QAAQ,EAAG,MAA6B,CAAC,KAAK,IAAI,CAAC,EAAE,CAAC;YACjE,CAAC;SACF,CAAC;QACF,IAAI,GAAG;YACL,KAAK,CAAC,cAAc,CAAC,EAAE;gBACrB,OAAO,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC;YAC9B,CAAC;SACF,CAAC;QACF,MAAM,GAAG,CAAC,MAAM,CAAC,wBAAwB,kBAAkB,EAAE,CAAC,CAAC;QAC/D,MAAM,uBAAuB,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC,EAAE,OAAO,CAAC,CAAC;IAEZ,QAAQ,CAAC,KAAK,IAAI,EAAE;QAClB,MAAM,GAAG,EAAE,KAAK,EAAE,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,MAAM,GAAG,CAAC,MAAM,CAAC,eAAe,kBAAkB,EAAE,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;QAChC,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;QAC7F,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC,CAAC;QAC7F,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAE9E,MAAM,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAEpB,MAAM,MAAM,GAAG,+BAA+B,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC;YACrB,EAAE,MAAM,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,EAAE;YAChC,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,aAAa,EAAE;SAChD,CAAC,CAAC;QACH,KAAK,MAAM,KAAK,IAAI,MAAM;YAAE,MAAM,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAEpE,oEAAoE;QACpE,MAAM,OAAO,GAAG,oBAAoB,CAAC;YACnC,KAAK,EAAE,MAAM;YACb,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,cAAc,EAAE,EAAE,CAAC;YAC3F,WAAW,EAAE,GAAG,EAAE,CAAC,KAAK;SACzB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;YAC1C,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,iBAAiB,EAAE;YAClE,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,cAAc,EAAE;SACxE,CAAC,CAAC;QAEH,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QACtF,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC;QACtF,MAAM,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QAE9E,yEAAyE;QACzE,4EAA4E;QAC5E,sEAAsE;QACtE,kCAAkC;QAClC,MAAM,KAAK,GAAG,iBAAiB,CAAC;YAC9B,MAAM,EAAE,IAAI,CAAC,EAAW;YACxB,MAAM,EAAE,2BAA2B,CAAC,IAAI,CAAC;YACzC,MAAM,EAAE,iBAAiB;YACzB,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QAExE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,MAAM,CAC5B,6DAA6D,kBAAkB,uBAAuB,EACtG,CAAC,MAAM,CAAC,CACT,CAAwC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAE3C,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;QACnC,2EAA2E;QAC3E,6EAA6E;QAC7E,0DAA0D;QAC1D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAEtF,MAAM,KAAK,GAAG,iBAAiB,CAAC;YAC9B,MAAM,EAAE,IAAI,CAAC,EAAW;YACxB,MAAM,EAAE,2BAA2B,CAAC,IAAI,CAAC;YACzC,MAAM,EAAE,WAAW;YACnB,KAAK,EAAE,CAAC;YACR,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC,CAAC;QAE1E,4EAA4E;QAC5E,kEAAkE;QAClE,MAAM,SAAS,GAAG,iBAAiB,CAAC;YAClC,MAAM,EAAE,IAAI,CAAC,EAAW;YACxB,MAAM,EAAE,2BAA2B,CAAC,IAAI,CAAC;YACzC,MAAM,EAAE,WAAW;YACnB,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC;QACH,MAAM,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAExF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iCAAiC,EAAE,KAAK,IAAI,EAAE;QAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACrF,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC;QAChG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAEzB,MAAM,MAAM,GAAG,+BAA+B,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC;QAClF,MAAM,CAAC,MAAM,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QAChH,MAAM,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAEtF,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}