mcpscraper-memory-db 1.0.0

package/dist/db/video-runs.js

@@ -0,0 +1,176 @@
+import { randomBytes } from "node:crypto";
+import { ensureSchema, query } from "./pool";
+import { VIDEO_RUN_TIMEOUT_ERROR } from "../lib/video-reaper";
+function mapRun(r) {
+  return {
+    id: r.id,
+    identity: r.identity,
+    vault: r.vault,
+    sourceUrl: r.source_url,
+    mediaUrl: r.media_url,
+    scraperApiKey: r.scraper_api_key,
+    intervalS: Number(r.interval_s),
+    maxFrames: r.max_frames,
+    detail: r.detail,
+    durationS: r.duration_s == null ? null : Number(r.duration_s),
+    frameCount: r.frame_count,
+    status: r.status,
+    error: r.error,
+    transcript: r.transcript,
+    metrics: r.metrics,
+    lenses: r.lenses,
+    qc: r.qc,
+    reportMd: r.report_md,
+    artifactPath: r.artifact_path,
+    costUsd: Number(r.cost_usd ?? 0),
+    createdAt: new Date(r.created_at),
+    updatedAt: new Date(r.updated_at)
+  };
+}
+const RUN_COLS = `id, identity, vault, source_url, media_url, scraper_api_key, interval_s, max_frames,
+  detail, duration_s, frame_count, status, error, transcript, metrics, lenses, qc, report_md, artifact_path, cost_usd,
+  created_at, updated_at`;
+async function createVideoRun(args) {
+  await ensureSchema();
+  const id = `vid_${randomBytes(8).toString("hex")}`;
+  await query(
+    `INSERT INTO mem_video_runs (id, identity, vault, source_url, interval_s, max_frames, detail, scraper_api_key, status)
+     VALUES ($1,$2,$3,$4,$5,$6,$7,$8,'queued')`,
+    [id, args.identity, args.vault, args.sourceUrl, args.intervalS, args.maxFrames, args.detail, args.scraperApiKey]
+  );
+  return id;
+}
+async function getVideoRun(id, identity) {
+  await ensureSchema();
+  const res = await query(`SELECT ${RUN_COLS} FROM mem_video_runs WHERE id = $1 AND identity = $2 LIMIT 1`, [id, identity]);
+  return res.rows[0] ? mapRun(res.rows[0]) : null;
+}
+const PATCH_COLS = {
+  mediaUrl: "media_url",
+  durationS: "duration_s",
+  frameCount: "frame_count",
+  status: "status",
+  error: "error",
+  transcript: "transcript",
+  metrics: "metrics",
+  lenses: "lenses",
+  qc: "qc",
+  reportMd: "report_md",
+  artifactPath: "artifact_path",
+  costUsd: "cost_usd"
+};
+const JSONB_KEYS = /* @__PURE__ */ new Set(["transcript", "metrics", "lenses", "qc"]);
+async function updateVideoRun(id, patch) {
+  await ensureSchema();
+  const sets = [];
+  const params = [];
+  for (const [k, col] of Object.entries(PATCH_COLS)) {
+    if (k in patch) {
+      const isJson = JSONB_KEYS.has(k);
+      params.push(isJson ? JSON.stringify(patch[k]) : patch[k]);
+      sets.push(`${col} = $${params.length}${isJson ? "::jsonb" : ""}`);
+    }
+  }
+  if (!sets.length) return;
+  params.push(id);
+  await query(`UPDATE mem_video_runs SET ${sets.join(", ")}, updated_at = now() WHERE id = $${params.length}`, params);
+}
+async function insertFrames(runId, frames) {
+  if (!frames.length) return;
+  await ensureSchema();
+  const values = [];
+  const params = [];
+  for (const f of frames) {
+    params.push(runId, f.idx, f.tSec, f.imgB64 ?? null);
+    values.push(`($${params.length - 3}, $${params.length - 2}, $${params.length - 1}, $${params.length})`);
+  }
+  await query(
+    `INSERT INTO mem_video_frames (run_id, idx, t_sec, img_b64) VALUES ${values.join(", ")}
+     ON CONFLICT (run_id, idx) DO UPDATE SET img_b64 = COALESCE(mem_video_frames.img_b64, EXCLUDED.img_b64)`,
+    params
+  );
+}
+async function setFrameObservation(runId, idx, observation, status) {
+  await query(
+    `UPDATE mem_video_frames SET observation = $3::jsonb, status = $4, img_b64 = NULL WHERE run_id = $1 AND idx = $2`,
+    [runId, idx, JSON.stringify(observation), status]
+  );
+}
+async function listPendingImageFrames(runId, limit) {
+  await ensureSchema();
+  const res = await query(
+    `SELECT idx, t_sec, img_b64 FROM mem_video_frames
+     WHERE run_id = $1 AND status = 'pending' AND img_b64 IS NOT NULL
+     ORDER BY idx ASC LIMIT $2`,
+    [runId, limit]
+  );
+  return res.rows.map((r) => ({ idx: r.idx, tSec: Number(r.t_sec), imgB64: r.img_b64 }));
+}
+async function countPendingFrames(runId) {
+  await ensureSchema();
+  const res = await query(
+    `SELECT COUNT(*)::int AS n FROM mem_video_frames WHERE run_id = $1 AND status = 'pending'`,
+    [runId]
+  );
+  return Number(res.rows[0]?.n ?? 0);
+}
+async function setFrameDetail(runId, idx, detail) {
+  await query(
+    `UPDATE mem_video_frames SET detail = $3::jsonb WHERE run_id = $1 AND idx = $2`,
+    [runId, idx, JSON.stringify(detail)]
+  );
+}
+async function listFrames(runId) {
+  await ensureSchema();
+  const res = await query(
+    `SELECT idx, t_sec, observation, detail, status FROM mem_video_frames WHERE run_id = $1 ORDER BY idx ASC`,
+    [runId]
+  );
+  return res.rows.map((r) => ({ idx: r.idx, tSec: Number(r.t_sec), observation: r.observation, detail: r.detail, status: r.status }));
+}
+async function listQueuedVideoRuns(limit) {
+  await ensureSchema();
+  const res = await query(
+    `UPDATE mem_video_runs SET status = 'resolving', updated_at = now()
+     WHERE id IN (SELECT id FROM mem_video_runs WHERE status = 'queued' ORDER BY created_at ASC LIMIT $1)
+     RETURNING id, identity`,
+    [limit]
+  );
+  return res.rows.map((r) => ({ id: r.id, identity: r.identity }));
+}
+async function reapStaleVideoRun(id, reapMinutes) {
+  await ensureSchema();
+  const res = await query(
+    `UPDATE mem_video_runs
+     SET status = 'failed', error = $2, updated_at = now()
+     WHERE id = $1
+       AND status NOT IN ('done', 'failed')
+       AND updated_at < now() - ($3 || ' minutes')::interval
+     RETURNING ${RUN_COLS}`,
+    [id, VIDEO_RUN_TIMEOUT_ERROR, reapMinutes]
+  );
+  return res.rows[0] ? mapRun(res.rows[0]) : null;
+}
+async function runProgress(runId) {
+  await ensureSchema();
+  const res = await query(
+    `SELECT COUNT(*)::int AS total, COUNT(observation)::int AS analyzed FROM mem_video_frames WHERE run_id = $1`,
+    [runId]
+  );
+  return { total: Number(res.rows[0]?.total ?? 0), analyzed: Number(res.rows[0]?.analyzed ?? 0) };
+}
+export {
+  countPendingFrames,
+  createVideoRun,
+  getVideoRun,
+  insertFrames,
+  listFrames,
+  listPendingImageFrames,
+  listQueuedVideoRuns,
+  reapStaleVideoRun,
+  runProgress,
+  setFrameDetail,
+  setFrameObservation,
+  updateVideoRun
+};
+//# sourceMappingURL=video-runs.js.map

package/dist/db/video-runs.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/video-runs.ts"],"sourcesContent":["import { randomBytes } from 'node:crypto'\nimport { ensureSchema, query } from './pool'\nimport { VIDEO_RUN_TIMEOUT_ERROR } from '../lib/video-reaper'\n\nexport type VideoRunStatus =\n  | 'queued' | 'resolving' | 'analyzing' | 'synthesizing' | 'detail' | 'done' | 'failed'\n\nexport interface VideoRunRow {\n  id: string\n  identity: string\n  vault: string\n  sourceUrl: string\n  mediaUrl: string | null\n  scraperApiKey: string | null\n  intervalS: number\n  maxFrames: number\n  detail: string\n  durationS: number | null\n  frameCount: number\n  status: VideoRunStatus\n  error: string | null\n  transcript: unknown\n  metrics: unknown\n  lenses: unknown\n  qc: unknown\n  reportMd: string | null\n  artifactPath: string | null\n  costUsd: number\n  createdAt: Date\n  updatedAt: Date\n}\n\ninterface RawRun {\n  id: string; identity: string; vault: string; source_url: string; media_url: string | null\n  scraper_api_key: string | null; interval_s: number; max_frames: number; detail: string\n  duration_s: number | null; frame_count: number; status: string; error: string | null\n  transcript: unknown; metrics: unknown; lenses: unknown; qc: unknown\n  report_md: string | null; artifact_path: string | null; cost_usd: number\n  created_at: string | Date; updated_at: string | Date\n}\n\nfunction mapRun(r: RawRun): VideoRunRow {\n  return {\n    id: r.id, identity: r.identity, vault: r.vault, sourceUrl: r.source_url, mediaUrl: r.media_url,\n    scraperApiKey: r.scraper_api_key, intervalS: Number(r.interval_s), maxFrames: r.max_frames,\n    detail: r.detail, durationS: r.duration_s == null ? null : Number(r.duration_s), frameCount: r.frame_count,\n    status: r.status as VideoRunStatus, error: r.error,\n    transcript: r.transcript, metrics: r.metrics, lenses: r.lenses, qc: r.qc, reportMd: r.report_md,\n    artifactPath: r.artifact_path, costUsd: Number(r.cost_usd ?? 0),\n    createdAt: new Date(r.created_at), updatedAt: new Date(r.updated_at),\n  }\n}\n\nconst RUN_COLS = `id, identity, vault, source_url, media_url, scraper_api_key, interval_s, max_frames,\n  detail, duration_s, frame_count, status, error, transcript, metrics, lenses, qc, report_md, artifact_path, cost_usd,\n  created_at, updated_at`\n\nexport async function createVideoRun(args: {\n  identity: string; vault: string; sourceUrl: string; intervalS: number; maxFrames: number;\n  detail: string; scraperApiKey: string | null\n}): Promise<string> {\n  await ensureSchema()\n  const id = `vid_${randomBytes(8).toString('hex')}`\n  await query(\n    `INSERT INTO mem_video_runs (id, identity, vault, source_url, interval_s, max_frames, detail, scraper_api_key, status)\n     VALUES ($1,$2,$3,$4,$5,$6,$7,$8,'queued')`,\n    [id, args.identity, args.vault, args.sourceUrl, args.intervalS, args.maxFrames, args.detail, args.scraperApiKey],\n  )\n  return id\n}\n\nexport async function getVideoRun(id: string, identity: string): Promise<VideoRunRow | null> {\n  await ensureSchema()\n  const res = await query<RawRun>(`SELECT ${RUN_COLS} FROM mem_video_runs WHERE id = $1 AND identity = $2 LIMIT 1`, [id, identity])\n  return res.rows[0] ? mapRun(res.rows[0]) : null\n}\n\nconst PATCH_COLS: Record<string, string> = {\n  mediaUrl: 'media_url', durationS: 'duration_s', frameCount: 'frame_count', status: 'status',\n  error: 'error', transcript: 'transcript', metrics: 'metrics', lenses: 'lenses', qc: 'qc',\n  reportMd: 'report_md', artifactPath: 'artifact_path', costUsd: 'cost_usd',\n}\nconst JSONB_KEYS = new Set(['transcript', 'metrics', 'lenses', 'qc'])\n\nexport async function updateVideoRun(id: string, patch: Partial<Record<keyof typeof PATCH_COLS, unknown>>): Promise<void> {\n  await ensureSchema()\n  const sets: string[] = []\n  const params: unknown[] = []\n  for (const [k, col] of Object.entries(PATCH_COLS)) {\n    if (k in patch) {\n      const isJson = JSONB_KEYS.has(k)\n      params.push(isJson ? JSON.stringify((patch as Record<string, unknown>)[k]) : (patch as Record<string, unknown>)[k])\n      sets.push(`${col} = $${params.length}${isJson ? '::jsonb' : ''}`)\n    }\n  }\n  if (!sets.length) return\n  params.push(id)\n  await query(`UPDATE mem_video_runs SET ${sets.join(', ')}, updated_at = now() WHERE id = $${params.length}`, params)\n}\n\nexport async function insertFrames(runId: string, frames: Array<{ idx: number; tSec: number; imgB64?: string }>): Promise<void> {\n  if (!frames.length) return\n  await ensureSchema()\n  const values: string[] = []\n  const params: unknown[] = []\n  for (const f of frames) {\n    params.push(runId, f.idx, f.tSec, f.imgB64 ?? null)\n    values.push(`($${params.length - 3}, $${params.length - 2}, $${params.length - 1}, $${params.length})`)\n  }\n  await query(\n    `INSERT INTO mem_video_frames (run_id, idx, t_sec, img_b64) VALUES ${values.join(', ')}\n     ON CONFLICT (run_id, idx) DO UPDATE SET img_b64 = COALESCE(mem_video_frames.img_b64, EXCLUDED.img_b64)`,\n    params,\n  )\n}\n\nexport async function setFrameObservation(runId: string, idx: number, observation: unknown, status: 'ok' | 'error'): Promise<void> {\n  await query(\n    `UPDATE mem_video_frames SET observation = $3::jsonb, status = $4, img_b64 = NULL WHERE run_id = $1 AND idx = $2`,\n    [runId, idx, JSON.stringify(observation), status],\n  )\n}\n\nexport interface PendingFrame { idx: number; tSec: number; imgB64: string }\n\nexport async function listPendingImageFrames(runId: string, limit: number): Promise<PendingFrame[]> {\n  await ensureSchema()\n  const res = await query<{ idx: number; t_sec: number; img_b64: string }>(\n    `SELECT idx, t_sec, img_b64 FROM mem_video_frames\n     WHERE run_id = $1 AND status = 'pending' AND img_b64 IS NOT NULL\n     ORDER BY idx ASC LIMIT $2`,\n    [runId, limit],\n  )\n  return res.rows.map(r => ({ idx: r.idx, tSec: Number(r.t_sec), imgB64: r.img_b64 }))\n}\n\nexport async function countPendingFrames(runId: string): Promise<number> {\n  await ensureSchema()\n  const res = await query<{ n: string }>(\n    `SELECT COUNT(*)::int AS n FROM mem_video_frames WHERE run_id = $1 AND status = 'pending'`,\n    [runId],\n  )\n  return Number(res.rows[0]?.n ?? 0)\n}\n\nexport async function setFrameDetail(runId: string, idx: number, detail: unknown): Promise<void> {\n  await query(\n    `UPDATE mem_video_frames SET detail = $3::jsonb WHERE run_id = $1 AND idx = $2`,\n    [runId, idx, JSON.stringify(detail)],\n  )\n}\n\nexport interface FrameRow { idx: number; tSec: number; observation: unknown; detail: unknown; status: string }\n\nexport async function listFrames(runId: string): Promise<FrameRow[]> {\n  await ensureSchema()\n  const res = await query<{ idx: number; t_sec: number; observation: unknown; detail: unknown; status: string }>(\n    `SELECT idx, t_sec, observation, detail, status FROM mem_video_frames WHERE run_id = $1 ORDER BY idx ASC`,\n    [runId],\n  )\n  return res.rows.map(r => ({ idx: r.idx, tSec: Number(r.t_sec), observation: r.observation, detail: r.detail, status: r.status }))\n}\n\nexport async function listQueuedVideoRuns(limit: number): Promise<Array<{ id: string; identity: string }>> {\n  await ensureSchema()\n  const res = await query<{ id: string; identity: string }>(\n    `UPDATE mem_video_runs SET status = 'resolving', updated_at = now()\n     WHERE id IN (SELECT id FROM mem_video_runs WHERE status = 'queued' ORDER BY created_at ASC LIMIT $1)\n     RETURNING id, identity`,\n    [limit],\n  )\n  return res.rows.map(r => ({ id: r.id, identity: r.identity }))\n}\n\nexport async function reapStaleVideoRun(id: string, reapMinutes: number): Promise<VideoRunRow | null> {\n  await ensureSchema()\n  const res = await query<RawRun>(\n    `UPDATE mem_video_runs\n     SET status = 'failed', error = $2, updated_at = now()\n     WHERE id = $1\n       AND status NOT IN ('done', 'failed')\n       AND updated_at < now() - ($3 || ' minutes')::interval\n     RETURNING ${RUN_COLS}`,\n    [id, VIDEO_RUN_TIMEOUT_ERROR, reapMinutes],\n  )\n  return res.rows[0] ? mapRun(res.rows[0]) : null\n}\n\nexport async function runProgress(runId: string): Promise<{ total: number; analyzed: number }> {\n  await ensureSchema()\n  const res = await query<{ total: string; analyzed: string }>(\n    `SELECT COUNT(*)::int AS total, COUNT(observation)::int AS analyzed FROM mem_video_frames WHERE run_id = $1`,\n    [runId],\n  )\n  return { total: Number(res.rows[0]?.total ?? 0), analyzed: Number(res.rows[0]?.analyzed ?? 0) }\n}\n"],"mappings":"AAAA,SAAS,mBAAmB;AAC5B,SAAS,cAAc,aAAa;AACpC,SAAS,+BAA+B;AAuCxC,SAAS,OAAO,GAAwB;AACtC,SAAO;AAAA,IACL,IAAI,EAAE;AAAA,IAAI,UAAU,EAAE;AAAA,IAAU,OAAO,EAAE;AAAA,IAAO,WAAW,EAAE;AAAA,IAAY,UAAU,EAAE;AAAA,IACrF,eAAe,EAAE;AAAA,IAAiB,WAAW,OAAO,EAAE,UAAU;AAAA,IAAG,WAAW,EAAE;AAAA,IAChF,QAAQ,EAAE;AAAA,IAAQ,WAAW,EAAE,cAAc,OAAO,OAAO,OAAO,EAAE,UAAU;AAAA,IAAG,YAAY,EAAE;AAAA,IAC/F,QAAQ,EAAE;AAAA,IAA0B,OAAO,EAAE;AAAA,IAC7C,YAAY,EAAE;AAAA,IAAY,SAAS,EAAE;AAAA,IAAS,QAAQ,EAAE;AAAA,IAAQ,IAAI,EAAE;AAAA,IAAI,UAAU,EAAE;AAAA,IACtF,cAAc,EAAE;AAAA,IAAe,SAAS,OAAO,EAAE,YAAY,CAAC;AAAA,IAC9D,WAAW,IAAI,KAAK,EAAE,UAAU;AAAA,IAAG,WAAW,IAAI,KAAK,EAAE,UAAU;AAAA,EACrE;AACF;AAEA,MAAM,WAAW;AAAA;AAAA;AAIjB,eAAsB,eAAe,MAGjB;AAClB,QAAM,aAAa;AACnB,QAAM,KAAK,OAAO,YAAY,CAAC,EAAE,SAAS,KAAK,CAAC;AAChD,QAAM;AAAA,IACJ;AAAA;AAAA,IAEA,CAAC,IAAI,KAAK,UAAU,KAAK,OAAO,KAAK,WAAW,KAAK,WAAW,KAAK,WAAW,KAAK,QAAQ,KAAK,aAAa;AAAA,EACjH;AACA,SAAO;AACT;AAEA,eAAsB,YAAY,IAAY,UAA+C;AAC3F,QAAM,aAAa;AACnB,QAAM,MAAM,MAAM,MAAc,UAAU,QAAQ,gEAAgE,CAAC,IAAI,QAAQ,CAAC;AAChI,SAAO,IAAI,KAAK,CAAC,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,IAAI;AAC7C;AAEA,MAAM,aAAqC;AAAA,EACzC,UAAU;AAAA,EAAa,WAAW;AAAA,EAAc,YAAY;AAAA,EAAe,QAAQ;AAAA,EACnF,OAAO;AAAA,EAAS,YAAY;AAAA,EAAc,SAAS;AAAA,EAAW,QAAQ;AAAA,EAAU,IAAI;AAAA,EACpF,UAAU;AAAA,EAAa,cAAc;AAAA,EAAiB,SAAS;AACjE;AACA,MAAM,aAAa,oBAAI,IAAI,CAAC,cAAc,WAAW,UAAU,IAAI,CAAC;AAEpE,eAAsB,eAAe,IAAY,OAAyE;AACxH,QAAM,aAAa;AACnB,QAAM,OAAiB,CAAC;AACxB,QAAM,SAAoB,CAAC;AAC3B,aAAW,CAAC,GAAG,GAAG,KAAK,OAAO,QAAQ,UAAU,GAAG;AACjD,QAAI,KAAK,OAAO;AACd,YAAM,SAAS,WAAW,IAAI,CAAC;AAC/B,aAAO,KAAK,SAAS,KAAK,UAAW,MAAkC,CAAC,CAAC,IAAK,MAAkC,CAAC,CAAC;AAClH,WAAK,KAAK,GAAG,GAAG,OAAO,OAAO,MAAM,GAAG,SAAS,YAAY,EAAE,EAAE;AAAA,IAClE;AAAA,EACF;AACA,MAAI,CAAC,KAAK,OAAQ;AAClB,SAAO,KAAK,EAAE;AACd,QAAM,MAAM,6BAA6B,KAAK,KAAK,IAAI,CAAC,oCAAoC,OAAO,MAAM,IAAI,MAAM;AACrH;AAEA,eAAsB,aAAa,OAAe,QAA8E;AAC9H,MAAI,CAAC,OAAO,OAAQ;AACpB,QAAM,aAAa;AACnB,QAAM,SAAmB,CAAC;AAC1B,QAAM,SAAoB,CAAC;AAC3B,aAAW,KAAK,QAAQ;AACtB,WAAO,KAAK,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,IAAI;AAClD,WAAO,KAAK,KAAK,OAAO,SAAS,CAAC,MAAM,OAAO,SAAS,CAAC,MAAM,OAAO,SAAS,CAAC,MAAM,OAAO,MAAM,GAAG;AAAA,EACxG;AACA,QAAM;AAAA,IACJ,qEAAqE,OAAO,KAAK,IAAI,CAAC;AAAA;AAAA,IAEtF;AAAA,EACF;AACF;AAEA,eAAsB,oBAAoB,OAAe,KAAa,aAAsB,QAAuC;AACjI,QAAM;AAAA,IACJ;AAAA,IACA,CAAC,OAAO,KAAK,KAAK,UAAU,WAAW,GAAG,MAAM;AAAA,EAClD;AACF;AAIA,eAAsB,uBAAuB,OAAe,OAAwC;AAClG,QAAM,aAAa;AACnB,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA;AAAA;AAAA,IAGA,CAAC,OAAO,KAAK;AAAA,EACf;AACA,SAAO,IAAI,KAAK,IAAI,QAAM,EAAE,KAAK,EAAE,KAAK,MAAM,OAAO,EAAE,KAAK,GAAG,QAAQ,EAAE,QAAQ,EAAE;AACrF;AAEA,eAAsB,mBAAmB,OAAgC;AACvE,QAAM,aAAa;AACnB,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA,CAAC,KAAK;AAAA,EACR;AACA,SAAO,OAAO,IAAI,KAAK,CAAC,GAAG,KAAK,CAAC;AACnC;AAEA,eAAsB,eAAe,OAAe,KAAa,QAAgC;AAC/F,QAAM;AAAA,IACJ;AAAA,IACA,CAAC,OAAO,KAAK,KAAK,UAAU,MAAM,CAAC;AAAA,EACrC;AACF;AAIA,eAAsB,WAAW,OAAoC;AACnE,QAAM,aAAa;AACnB,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA,CAAC,KAAK;AAAA,EACR;AACA,SAAO,IAAI,KAAK,IAAI,QAAM,EAAE,KAAK,EAAE,KAAK,MAAM,OAAO,EAAE,KAAK,GAAG,aAAa,EAAE,aAAa,QAAQ,EAAE,QAAQ,QAAQ,EAAE,OAAO,EAAE;AAClI;AAEA,eAAsB,oBAAoB,OAAiE;AACzG,QAAM,aAAa;AACnB,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA;AAAA;AAAA,IAGA,CAAC,KAAK;AAAA,EACR;AACA,SAAO,IAAI,KAAK,IAAI,QAAM,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,SAAS,EAAE;AAC/D;AAEA,eAAsB,kBAAkB,IAAY,aAAkD;AACpG,QAAM,aAAa;AACnB,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA;AAAA;AAAA;AAAA;AAAA,iBAKa,QAAQ;AAAA,IACrB,CAAC,IAAI,yBAAyB,WAAW;AAAA,EAC3C;AACA,SAAO,IAAI,KAAK,CAAC,IAAI,OAAO,IAAI,KAAK,CAAC,CAAC,IAAI;AAC7C;AAEA,eAAsB,YAAY,OAA6D;AAC7F,QAAM,aAAa;AACnB,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA,CAAC,KAAK;AAAA,EACR;AACA,SAAO,EAAE,OAAO,OAAO,IAAI,KAAK,CAAC,GAAG,SAAS,CAAC,GAAG,UAAU,OAAO,IAAI,KAAK,CAAC,GAAG,YAAY,CAAC,EAAE;AAChG;","names":[]}

package/dist/db/webhooks.d.ts

@@ -0,0 +1,20 @@
+interface WebhookRecord {
+    id: string;
+    identity: string;
+    keyId: string;
+    vault: string;
+    label: string | null;
+    createdAt: string;
+}
+declare function createWebhook(args: {
+    identity: string;
+    vault: string;
+    label?: string;
+}): Promise<{
+    webhook: WebhookRecord;
+    secret: string;
+}>;
+declare function listWebhooksForIdentity(identity: string): Promise<WebhookRecord[]>;
+declare function revokeWebhook(id: string, identity: string): Promise<boolean>;
+
+export { type WebhookRecord, createWebhook, listWebhooksForIdentity, revokeWebhook };

package/dist/db/webhooks.js

@@ -0,0 +1,43 @@
+import { randomUUID } from "node:crypto";
+import { ensureSchema, query } from "./pool";
+import { issueKeyRow, revokeKeyRow } from "./keys";
+function mapRow(r) {
+  return { id: r.id, identity: r.identity, keyId: r.key_id, vault: r.vault, label: r.label, createdAt: r.created_at };
+}
+const COLUMNS = "id, identity, key_id, vault, label, created_at";
+async function createWebhook(args) {
+  await ensureSchema();
+  const issued = await issueKeyRow({
+    identity: args.identity,
+    vaults: [args.vault],
+    scope: { read: false, write: true, export: false, index: false, admin: false, swap: false },
+    plan: "free",
+    expiresAt: null
+  });
+  const id = randomUUID();
+  const res = await query(
+    `INSERT INTO mem_webhooks (id, identity, key_id, vault, label) VALUES ($1, $2, $3, $4, $5) RETURNING ${COLUMNS}`,
+    [id, args.identity, issued.keyId, args.vault, args.label ?? null]
+  );
+  return { webhook: mapRow(res.rows[0]), secret: issued.secret };
+}
+async function listWebhooksForIdentity(identity) {
+  await ensureSchema();
+  const res = await query(`SELECT ${COLUMNS} FROM mem_webhooks WHERE identity = $1 ORDER BY created_at DESC`, [identity]);
+  return res.rows.map(mapRow);
+}
+async function revokeWebhook(id, identity) {
+  await ensureSchema();
+  const res = await query(`SELECT ${COLUMNS} FROM mem_webhooks WHERE id = $1 AND identity = $2`, [id, identity]);
+  const row = res.rows[0];
+  if (!row) return false;
+  await revokeKeyRow(row.key_id);
+  await query(`DELETE FROM mem_webhooks WHERE id = $1`, [id]);
+  return true;
+}
+export {
+  createWebhook,
+  listWebhooksForIdentity,
+  revokeWebhook
+};
+//# sourceMappingURL=webhooks.js.map

package/dist/db/webhooks.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/db/webhooks.ts"],"sourcesContent":["import { randomUUID } from 'node:crypto'\nimport { ensureSchema, query } from './pool'\nimport { issueKeyRow, revokeKeyRow } from './keys'\n\nexport interface WebhookRecord {\n  id: string\n  identity: string\n  keyId: string\n  vault: string\n  label: string | null\n  createdAt: string\n}\n\ninterface RawRow {\n  id: string\n  identity: string\n  key_id: string\n  vault: string\n  label: string | null\n  created_at: string\n}\n\nfunction mapRow(r: RawRow): WebhookRecord {\n  return { id: r.id, identity: r.identity, keyId: r.key_id, vault: r.vault, label: r.label, createdAt: r.created_at }\n}\n\nconst COLUMNS = 'id, identity, key_id, vault, label, created_at'\n\nexport async function createWebhook(args: { identity: string; vault: string; label?: string }): Promise<{ webhook: WebhookRecord; secret: string }> {\n  await ensureSchema()\n  const issued = await issueKeyRow({\n    identity: args.identity,\n    vaults: [args.vault],\n    scope: { read: false, write: true, export: false, index: false, admin: false, swap: false },\n    plan: 'free',\n    expiresAt: null,\n  })\n  const id = randomUUID()\n  const res = await query<RawRow>(\n    `INSERT INTO mem_webhooks (id, identity, key_id, vault, label) VALUES ($1, $2, $3, $4, $5) RETURNING ${COLUMNS}`,\n    [id, args.identity, issued.keyId, args.vault, args.label ?? null],\n  )\n  return { webhook: mapRow(res.rows[0]), secret: issued.secret }\n}\n\nexport async function listWebhooksForIdentity(identity: string): Promise<WebhookRecord[]> {\n  await ensureSchema()\n  const res = await query<RawRow>(`SELECT ${COLUMNS} FROM mem_webhooks WHERE identity = $1 ORDER BY created_at DESC`, [identity])\n  return res.rows.map(mapRow)\n}\n\nexport async function revokeWebhook(id: string, identity: string): Promise<boolean> {\n  await ensureSchema()\n  const res = await query<RawRow>(`SELECT ${COLUMNS} FROM mem_webhooks WHERE id = $1 AND identity = $2`, [id, identity])\n  const row = res.rows[0]\n  if (!row) return false\n  await revokeKeyRow(row.key_id)\n  await query(`DELETE FROM mem_webhooks WHERE id = $1`, [id])\n  return true\n}\n"],"mappings":"AAAA,SAAS,kBAAkB;AAC3B,SAAS,cAAc,aAAa;AACpC,SAAS,aAAa,oBAAoB;AAoB1C,SAAS,OAAO,GAA0B;AACxC,SAAO,EAAE,IAAI,EAAE,IAAI,UAAU,EAAE,UAAU,OAAO,EAAE,QAAQ,OAAO,EAAE,OAAO,OAAO,EAAE,OAAO,WAAW,EAAE,WAAW;AACpH;AAEA,MAAM,UAAU;AAEhB,eAAsB,cAAc,MAAgH;AAClJ,QAAM,aAAa;AACnB,QAAM,SAAS,MAAM,YAAY;AAAA,IAC/B,UAAU,KAAK;AAAA,IACf,QAAQ,CAAC,KAAK,KAAK;AAAA,IACnB,OAAO,EAAE,MAAM,OAAO,OAAO,MAAM,QAAQ,OAAO,OAAO,OAAO,OAAO,OAAO,MAAM,MAAM;AAAA,IAC1F,MAAM;AAAA,IACN,WAAW;AAAA,EACb,CAAC;AACD,QAAM,KAAK,WAAW;AACtB,QAAM,MAAM,MAAM;AAAA,IAChB,uGAAuG,OAAO;AAAA,IAC9G,CAAC,IAAI,KAAK,UAAU,OAAO,OAAO,KAAK,OAAO,KAAK,SAAS,IAAI;AAAA,EAClE;AACA,SAAO,EAAE,SAAS,OAAO,IAAI,KAAK,CAAC,CAAC,GAAG,QAAQ,OAAO,OAAO;AAC/D;AAEA,eAAsB,wBAAwB,UAA4C;AACxF,QAAM,aAAa;AACnB,QAAM,MAAM,MAAM,MAAc,UAAU,OAAO,mEAAmE,CAAC,QAAQ,CAAC;AAC9H,SAAO,IAAI,KAAK,IAAI,MAAM;AAC5B;AAEA,eAAsB,cAAc,IAAY,UAAoC;AAClF,QAAM,aAAa;AACnB,QAAM,MAAM,MAAM,MAAc,UAAU,OAAO,sDAAsD,CAAC,IAAI,QAAQ,CAAC;AACrH,QAAM,MAAM,IAAI,KAAK,CAAC;AACtB,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,aAAa,IAAI,MAAM;AAC7B,QAAM,MAAM,0CAA0C,CAAC,EAAE,CAAC;AAC1D,SAAO;AACT;","names":[]}

package/dist/lib/auth.d.ts

@@ -0,0 +1,75 @@
+declare const SCOPE_KEYS: readonly ["read", "write", "export", "index", "admin", "swap"];
+type ScopeKey = (typeof SCOPE_KEYS)[number];
+type Scope = Record<ScopeKey, boolean>;
+type Plan = 'free' | 'pro' | 'team' | 'enterprise';
+interface AuthUser {
+    keyId: string;
+    identity: string;
+    storageOwner: string;
+    vaults: string[];
+    vaultScopes: Record<string, Scope>;
+    scope: Scope;
+    plan: string;
+    session: string;
+}
+declare class AuthError extends Error {
+    readonly code = "auth_error";
+}
+declare class ScopeError extends Error {
+    readonly code = "scope_error";
+}
+declare function emptyScope(): Scope;
+declare function leastPrivilegeScope(): Scope;
+declare function fullScope(): Scope;
+declare function normalizeScope(input: Partial<Record<string, boolean>> | undefined): Scope;
+declare function generateSecret(): string;
+declare function hashSecret(secret: string): string;
+declare function resolveSecret(secret: string, session: string): Promise<AuthUser>;
+interface ToolAuthInput {
+    apiKey?: string;
+    sessionId?: string;
+}
+interface ToolExecContext {
+    runtimeContext?: {
+        get?: (key: string) => unknown;
+    };
+    requestContext?: {
+        get?: (key: string) => unknown;
+    };
+}
+declare function resolveToolAuth(input: ToolAuthInput, context?: ToolExecContext): Promise<AuthUser>;
+declare function intersectScope(a: Scope, b: Scope): Scope;
+interface VaultContext {
+    storageOwner: string;
+    vaults: string[];
+    vaultScopes: Record<string, Scope>;
+    scope: Scope;
+}
+declare function resolveVaultContext(args: {
+    identity: string;
+    baseScope: Scope;
+    operator: boolean;
+    selfVaults: string[];
+    selfVaultScopes: Record<string, Scope>;
+}): Promise<VaultContext>;
+declare const fga: {
+    assertVaultAccess(user: AuthUser, vault: string, scopeKey: ScopeKey): void;
+    hasVaultAccess(user: AuthUser, vault: string, scopeKey: ScopeKey): boolean;
+};
+declare function oauthIssuer(): string;
+declare function oauthResourceUrl(): string;
+declare function oauthBaseUrl(): string;
+declare function protectedResourceMetadata(): Record<string, unknown>;
+declare function wwwAuthenticateValue(): string;
+declare function isBearerJwt(token: string): boolean;
+declare function verifyOAuthJwt(token: string): Promise<Record<string, unknown>>;
+declare function resolveBearerJwt(token: string, session: string): Promise<AuthUser>;
+declare const mapAuthInfoToUser: (args: {
+    authInfo: unknown;
+    extra: Record<string, unknown>;
+    requestContext?: {
+        set?: (key: string, value: unknown) => void;
+    };
+}) => Promise<AuthUser | undefined>;
+
+export { AuthError, type AuthUser, type Plan, SCOPE_KEYS, type Scope, ScopeError, type ScopeKey, type ToolAuthInput, type VaultContext, emptyScope, fga, fullScope, generateSecret, hashSecret, intersectScope, isBearerJwt, leastPrivilegeScope, mapAuthInfoToUser, normalizeScope, oauthBaseUrl, oauthIssuer, oauthResourceUrl, protectedResourceMetadata, resolveBearerJwt, resolveSecret, resolveToolAuth, resolveVaultContext, verifyOAuthJwt, wwwAuthenticateValue };

package/dist/lib/auth.js

@@ -0,0 +1,248 @@
+import { createHash, randomBytes } from "node:crypto";
+import { createRemoteJWKSet, jwtVerify } from "jose";
+import { ensureSchema, query } from "../db/pool";
+import { isOperatorIdentity, OPERATOR_PLAN } from "./operator";
+import { listVaultsForIdentity, provisionDefaultVaults, getActiveContext, getAccountGrant, ownedVaultNames } from "../db/vaults";
+const SCOPE_KEYS = ["read", "write", "export", "index", "admin", "swap"];
+class AuthError extends Error {
+  code = "auth_error";
+}
+class ScopeError extends Error {
+  code = "scope_error";
+}
+function emptyScope() {
+  return { read: false, write: false, export: false, index: false, admin: false, swap: false };
+}
+function leastPrivilegeScope() {
+  return { ...emptyScope(), read: true };
+}
+function fullScope() {
+  return { read: true, write: true, export: true, index: true, admin: true, swap: true };
+}
+function normalizeScope(input) {
+  const out = emptyScope();
+  if (!input) return out;
+  for (const k of SCOPE_KEYS) {
+    if (input[k] === true) out[k] = true;
+  }
+  return out;
+}
+function generateSecret() {
+  return `mk_${randomBytes(24).toString("base64url")}`;
+}
+function hashSecret(secret) {
+  return createHash("sha256").update(secret).digest("hex");
+}
+function toStringArray(value) {
+  if (Array.isArray(value)) return value.filter((v) => typeof v === "string");
+  return [];
+}
+async function resolveSecret(secret, session) {
+  await ensureSchema();
+  const secretHash = hashSecret(secret);
+  const res = await query(
+    "SELECT key_id, secret_hash, identity, vaults, scope, plan, expires_at, revoked FROM mem_keys WHERE secret_hash = $1 LIMIT 1",
+    [secretHash]
+  );
+  const row = res.rows[0];
+  if (!row) throw new AuthError("Unknown API key.");
+  if (row.revoked) throw new AuthError("API key has been revoked.");
+  if (row.expires_at && new Date(row.expires_at).getTime() < Date.now()) {
+    throw new AuthError("API key has expired.");
+  }
+  await query(
+    "UPDATE mem_keys SET last_used_at = now(), usage_count = usage_count + 1 WHERE key_id = $1",
+    [row.key_id]
+  );
+  const operator = isOperatorIdentity(row.identity);
+  const baseScope = operator ? fullScope() : normalizeScope(row.scope);
+  const live = await listVaultsForIdentity(row.identity);
+  const selfVaults = [.../* @__PURE__ */ new Set([...toStringArray(row.vaults), ...live.map((v) => v.handle)])];
+  const selfVaultScopes = {};
+  for (const v of live) if (v.role === "shared") selfVaultScopes[v.handle] = v.entitlement;
+  const ctx = await resolveVaultContext({
+    identity: row.identity,
+    baseScope,
+    operator,
+    selfVaults,
+    selfVaultScopes
+  });
+  return {
+    keyId: row.key_id,
+    identity: row.identity,
+    storageOwner: ctx.storageOwner,
+    vaults: ctx.vaults,
+    vaultScopes: ctx.vaultScopes,
+    scope: ctx.scope,
+    plan: operator ? OPERATOR_PLAN : row.plan,
+    session
+  };
+}
+async function resolveToolAuth(input, context) {
+  const fromCtx = context?.runtimeContext?.get?.("user") ?? context?.requestContext?.get?.("user");
+  if (fromCtx && typeof fromCtx === "object" && "keyId" in fromCtx) {
+    return fromCtx;
+  }
+  const secret = input.apiKey;
+  if (!secret) throw new AuthError("No API key supplied (set apiKey or authenticate via the MCP transport).");
+  const session = input.sessionId ?? `sess_${hashSecret(secret).slice(0, 12)}`;
+  return resolveSecret(secret, session);
+}
+function intersectScope(a, b) {
+  const out = emptyScope();
+  for (const k of SCOPE_KEYS) out[k] = a[k] === true && b[k] === true;
+  return out;
+}
+async function resolveVaultContext(args) {
+  const ctx = await getActiveContext(args.identity);
+  if (ctx.activeOwner && ctx.activeOwner !== args.identity) {
+    const grant = args.operator ? fullScope() : await getAccountGrant(ctx.activeOwner, args.identity);
+    if (grant) {
+      return {
+        storageOwner: ctx.activeOwner,
+        vaults: await ownedVaultNames(ctx.activeOwner),
+        vaultScopes: {},
+        scope: args.operator ? args.baseScope : intersectScope(args.baseScope, grant)
+      };
+    }
+  }
+  return { storageOwner: args.identity, vaults: args.selfVaults, vaultScopes: args.selfVaultScopes, scope: args.baseScope };
+}
+const fga = {
+  assertVaultAccess(user, vault, scopeKey) {
+    if (!user.vaults.includes(vault)) {
+      throw new ScopeError(`Key ${user.keyId} is not entitled to vault "${vault}".`);
+    }
+    if (!user.scope[scopeKey]) {
+      throw new ScopeError(`Key ${user.keyId} lacks "${scopeKey}" scope.`);
+    }
+    const vs = user.vaultScopes[vault];
+    if (vs && vs[scopeKey] !== true) {
+      throw new ScopeError(`Vault "${vault}" is shared without "${scopeKey}" permission.`);
+    }
+  },
+  hasVaultAccess(user, vault, scopeKey) {
+    if (!user.vaults.includes(vault) || user.scope[scopeKey] !== true) return false;
+    const vs = user.vaultScopes[vault];
+    return !vs || vs[scopeKey] === true;
+  }
+};
+function oauthIssuer() {
+  return (process.env.OAUTH_ISSUER ?? "https://mcpscraper.dev").replace(/\/$/, "");
+}
+function oauthResourceUrl() {
+  return process.env.OAUTH_RESOURCE ?? "https://memory.mcpscraper.dev/mcp";
+}
+function oauthBaseUrl() {
+  return (process.env.OAUTH_RS_BASE_URL ?? "https://memory.mcpscraper.dev").replace(/\/$/, "");
+}
+function protectedResourceMetadata() {
+  return {
+    resource: oauthResourceUrl(),
+    authorization_servers: [oauthIssuer()],
+    scopes_supported: ["memory.read", "memory.write", "memory.admin"],
+    bearer_methods_supported: ["header"]
+  };
+}
+function wwwAuthenticateValue() {
+  return `Bearer resource_metadata="${oauthBaseUrl()}/.well-known/oauth-protected-resource"`;
+}
+function looksLikeJwt(token) {
+  return !token.startsWith("mk_") && token.split(".").length === 3;
+}
+let jwksSingleton = null;
+function getJwks() {
+  if (jwksSingleton) return jwksSingleton;
+  jwksSingleton = createRemoteJWKSet(new URL(`${oauthIssuer()}/.well-known/jwks.json`));
+  return jwksSingleton;
+}
+function scopeFromOAuth(scopeClaim, operator) {
+  if (operator) return fullScope();
+  const scopes = (scopeClaim ?? "").split(/\s+/).map((s) => s.trim()).filter(Boolean);
+  const out = emptyScope();
+  if (scopes.includes("memory.admin")) return fullScope();
+  if (scopes.includes("memory.read")) out.read = true;
+  if (scopes.includes("memory.write")) {
+    out.read = true;
+    out.write = true;
+    out.export = true;
+    out.index = true;
+    out.swap = true;
+  }
+  if (!out.read && !out.write) out.read = true;
+  return out;
+}
+function isBearerJwt(token) {
+  return looksLikeJwt(token);
+}
+async function verifyOAuthJwt(token) {
+  const { payload } = await jwtVerify(token, getJwks(), {
+    issuer: oauthIssuer(),
+    audience: oauthResourceUrl()
+  });
+  return payload;
+}
+async function resolveBearerJwt(token, session) {
+  await ensureSchema();
+  const payload = await verifyOAuthJwt(token);
+  const identity = typeof payload.sub === "string" ? payload.sub : "";
+  if (!identity) throw new AuthError("Bearer token has no subject.");
+  const operator = isOperatorIdentity(identity);
+  const scopeClaim = typeof payload.scope === "string" ? payload.scope : void 0;
+  let self = await listVaultsForIdentity(identity);
+  if (self.length === 0) {
+    await provisionDefaultVaults(identity);
+    self = await listVaultsForIdentity(identity);
+  }
+  const selfVaults = self.map((v) => v.handle);
+  const selfVaultScopes = {};
+  for (const v of self) if (v.role === "shared") selfVaultScopes[v.handle] = v.entitlement;
+  const baseScope = scopeFromOAuth(scopeClaim, operator);
+  const ctx = await resolveVaultContext({ identity, baseScope, operator, selfVaults, selfVaultScopes });
+  const planClaim = typeof payload.plan === "string" ? payload.plan : void 0;
+  return {
+    keyId: `oauth:${identity}`,
+    identity,
+    storageOwner: ctx.storageOwner,
+    vaults: ctx.vaults,
+    vaultScopes: ctx.vaultScopes,
+    scope: ctx.scope,
+    plan: operator ? OPERATOR_PLAN : planClaim ?? "free",
+    session
+  };
+}
+const mapAuthInfoToUser = async (args) => {
+  const info = args.authInfo;
+  const token = info?.token ?? info?.apiKey ?? info?.extra?.apiKey;
+  if (!token) return void 0;
+  const sessionId = typeof args.extra?.sessionId === "string" ? args.extra.sessionId : `sess_${hashSecret(token).slice(0, 12)}`;
+  const user = looksLikeJwt(token) ? await resolveBearerJwt(token, sessionId) : await resolveSecret(token, sessionId);
+  args.requestContext?.set?.("user", user);
+  return user;
+};
+export {
+  AuthError,
+  SCOPE_KEYS,
+  ScopeError,
+  emptyScope,
+  fga,
+  fullScope,
+  generateSecret,
+  hashSecret,
+  intersectScope,
+  isBearerJwt,
+  leastPrivilegeScope,
+  mapAuthInfoToUser,
+  normalizeScope,
+  oauthBaseUrl,
+  oauthIssuer,
+  oauthResourceUrl,
+  protectedResourceMetadata,
+  resolveBearerJwt,
+  resolveSecret,
+  resolveToolAuth,
+  resolveVaultContext,
+  verifyOAuthJwt,
+  wwwAuthenticateValue
+};
+//# sourceMappingURL=auth.js.map

package/dist/lib/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/lib/auth.ts"],"sourcesContent":["import { createHash, randomBytes } from 'node:crypto'\nimport { createRemoteJWKSet, jwtVerify } from 'jose'\nimport { ensureSchema, query } from '../db/pool'\nimport { isOperatorIdentity, OPERATOR_PLAN } from './operator'\nimport { listVaultsForIdentity, provisionDefaultVaults, getActiveContext, getAccountGrant, ownedVaultNames } from '../db/vaults'\n\nexport const SCOPE_KEYS = ['read', 'write', 'export', 'index', 'admin', 'swap'] as const\nexport type ScopeKey = (typeof SCOPE_KEYS)[number]\nexport type Scope = Record<ScopeKey, boolean>\n\nexport type Plan = 'free' | 'pro' | 'team' | 'enterprise'\n\nexport interface AuthUser {\n  keyId: string\n  identity: string\n  storageOwner: string\n  vaults: string[]\n  vaultScopes: Record<string, Scope>\n  scope: Scope\n  plan: string\n  session: string\n}\n\nexport class AuthError extends Error {\n  readonly code = 'auth_error'\n}\nexport class ScopeError extends Error {\n  readonly code = 'scope_error'\n}\n\nexport function emptyScope(): Scope {\n  return { read: false, write: false, export: false, index: false, admin: false, swap: false }\n}\n\nexport function leastPrivilegeScope(): Scope {\n  return { ...emptyScope(), read: true }\n}\n\nexport function fullScope(): Scope {\n  return { read: true, write: true, export: true, index: true, admin: true, swap: true }\n}\n\nexport function normalizeScope(input: Partial<Record<string, boolean>> | undefined): Scope {\n  const out = emptyScope()\n  if (!input) return out\n  for (const k of SCOPE_KEYS) {\n    if (input[k] === true) out[k] = true\n  }\n  return out\n}\n\nexport function generateSecret(): string {\n  return `mk_${randomBytes(24).toString('base64url')}`\n}\n\nexport function hashSecret(secret: string): string {\n  return createHash('sha256').update(secret).digest('hex')\n}\n\ninterface KeyRecord {\n  key_id: string\n  secret_hash: string\n  identity: string\n  vaults: unknown\n  scope: unknown\n  plan: string\n  expires_at: string | null\n  revoked: boolean\n}\n\nfunction toStringArray(value: unknown): string[] {\n  if (Array.isArray(value)) return value.filter((v): v is string => typeof v === 'string')\n  return []\n}\n\nexport async function resolveSecret(secret: string, session: string): Promise<AuthUser> {\n  await ensureSchema()\n  const secretHash = hashSecret(secret)\n  const res = await query<KeyRecord>(\n    'SELECT key_id, secret_hash, identity, vaults, scope, plan, expires_at, revoked FROM mem_keys WHERE secret_hash = $1 LIMIT 1',\n    [secretHash],\n  )\n  const row = res.rows[0]\n  if (!row) throw new AuthError('Unknown API key.')\n  if (row.revoked) throw new AuthError('API key has been revoked.')\n  if (row.expires_at && new Date(row.expires_at).getTime() < Date.now()) {\n    throw new AuthError('API key has expired.')\n  }\n  await query(\n    'UPDATE mem_keys SET last_used_at = now(), usage_count = usage_count + 1 WHERE key_id = $1',\n    [row.key_id],\n  )\n  const operator = isOperatorIdentity(row.identity)\n  const baseScope = operator ? fullScope() : normalizeScope(row.scope as Record<string, boolean>)\n  const live = await listVaultsForIdentity(row.identity)\n  const selfVaults = [...new Set([...toStringArray(row.vaults), ...live.map(v => v.handle)])]\n  const selfVaultScopes: Record<string, Scope> = {}\n  for (const v of live) if (v.role === 'shared') selfVaultScopes[v.handle] = v.entitlement\n  const ctx = await resolveVaultContext({\n    identity: row.identity,\n    baseScope,\n    operator,\n    selfVaults,\n    selfVaultScopes,\n  })\n  return {\n    keyId: row.key_id,\n    identity: row.identity,\n    storageOwner: ctx.storageOwner,\n    vaults: ctx.vaults,\n    vaultScopes: ctx.vaultScopes,\n    scope: ctx.scope,\n    plan: operator ? OPERATOR_PLAN : row.plan,\n    session,\n  }\n}\n\nexport interface ToolAuthInput {\n  apiKey?: string\n  sessionId?: string\n}\n\ninterface ToolExecContext {\n  runtimeContext?: { get?: (key: string) => unknown }\n  requestContext?: { get?: (key: string) => unknown }\n}\n\nexport async function resolveToolAuth(input: ToolAuthInput, context?: ToolExecContext): Promise<AuthUser> {\n  const fromCtx =\n    context?.runtimeContext?.get?.('user') ?? context?.requestContext?.get?.('user')\n  if (fromCtx && typeof fromCtx === 'object' && 'keyId' in (fromCtx as object)) {\n    return fromCtx as AuthUser\n  }\n  const secret = input.apiKey\n  if (!secret) throw new AuthError('No API key supplied (set apiKey or authenticate via the MCP transport).')\n  const session = input.sessionId ?? `sess_${hashSecret(secret).slice(0, 12)}`\n  return resolveSecret(secret, session)\n}\n\nexport function intersectScope(a: Scope, b: Scope): Scope {\n  const out = emptyScope()\n  for (const k of SCOPE_KEYS) out[k] = a[k] === true && b[k] === true\n  return out\n}\n\nexport interface VaultContext {\n  storageOwner: string\n  vaults: string[]\n  vaultScopes: Record<string, Scope>\n  scope: Scope\n}\n\nexport async function resolveVaultContext(args: {\n  identity: string\n  baseScope: Scope\n  operator: boolean\n  selfVaults: string[]\n  selfVaultScopes: Record<string, Scope>\n}): Promise<VaultContext> {\n  const ctx = await getActiveContext(args.identity)\n  if (ctx.activeOwner && ctx.activeOwner !== args.identity) {\n    const grant = args.operator ? fullScope() : await getAccountGrant(ctx.activeOwner, args.identity)\n    if (grant) {\n      return {\n        storageOwner: ctx.activeOwner,\n        vaults: await ownedVaultNames(ctx.activeOwner),\n        vaultScopes: {},\n        scope: args.operator ? args.baseScope : intersectScope(args.baseScope, grant),\n      }\n    }\n  }\n  return { storageOwner: args.identity, vaults: args.selfVaults, vaultScopes: args.selfVaultScopes, scope: args.baseScope }\n}\n\nexport const fga = {\n  assertVaultAccess(user: AuthUser, vault: string, scopeKey: ScopeKey): void {\n    if (!user.vaults.includes(vault)) {\n      throw new ScopeError(`Key ${user.keyId} is not entitled to vault \"${vault}\".`)\n    }\n    if (!user.scope[scopeKey]) {\n      throw new ScopeError(`Key ${user.keyId} lacks \"${scopeKey}\" scope.`)\n    }\n    const vs = user.vaultScopes[vault]\n    if (vs && vs[scopeKey] !== true) {\n      throw new ScopeError(`Vault \"${vault}\" is shared without \"${scopeKey}\" permission.`)\n    }\n  },\n  hasVaultAccess(user: AuthUser, vault: string, scopeKey: ScopeKey): boolean {\n    if (!user.vaults.includes(vault) || user.scope[scopeKey] !== true) return false\n    const vs = user.vaultScopes[vault]\n    return !vs || vs[scopeKey] === true\n  },\n}\n\nexport function oauthIssuer(): string {\n  return (process.env.OAUTH_ISSUER ?? 'https://mcpscraper.dev').replace(/\\/$/, '')\n}\n\nexport function oauthResourceUrl(): string {\n  return (\n    process.env.OAUTH_RESOURCE ??\n    'https://memory.mcpscraper.dev/mcp'\n  )\n}\n\nexport function oauthBaseUrl(): string {\n  return (process.env.OAUTH_RS_BASE_URL ?? 'https://memory.mcpscraper.dev').replace(/\\/$/, '')\n}\n\nexport function protectedResourceMetadata(): Record<string, unknown> {\n  return {\n    resource: oauthResourceUrl(),\n    authorization_servers: [oauthIssuer()],\n    scopes_supported: ['memory.read', 'memory.write', 'memory.admin'],\n    bearer_methods_supported: ['header'],\n  }\n}\n\nexport function wwwAuthenticateValue(): string {\n  return `Bearer resource_metadata=\"${oauthBaseUrl()}/.well-known/oauth-protected-resource\"`\n}\n\nfunction looksLikeJwt(token: string): boolean {\n  return !token.startsWith('mk_') && token.split('.').length === 3\n}\n\nlet jwksSingleton: ReturnType<typeof createRemoteJWKSet> | null = null\n\nfunction getJwks(): ReturnType<typeof createRemoteJWKSet> {\n  if (jwksSingleton) return jwksSingleton\n  jwksSingleton = createRemoteJWKSet(new URL(`${oauthIssuer()}/.well-known/jwks.json`))\n  return jwksSingleton\n}\n\nfunction scopeFromOAuth(scopeClaim: string | undefined, operator: boolean): Scope {\n  if (operator) return fullScope()\n  const scopes = (scopeClaim ?? '').split(/\\s+/).map(s => s.trim()).filter(Boolean)\n  const out = emptyScope()\n  if (scopes.includes('memory.admin')) return fullScope()\n  if (scopes.includes('memory.read')) out.read = true\n  if (scopes.includes('memory.write')) {\n    out.read = true\n    out.write = true\n    out.export = true\n    out.index = true\n    out.swap = true\n  }\n  if (!out.read && !out.write) out.read = true\n  return out\n}\n\nexport function isBearerJwt(token: string): boolean {\n  return looksLikeJwt(token)\n}\n\nexport async function verifyOAuthJwt(token: string): Promise<Record<string, unknown>> {\n  const { payload } = await jwtVerify(token, getJwks(), {\n    issuer: oauthIssuer(),\n    audience: oauthResourceUrl(),\n  })\n  return payload as Record<string, unknown>\n}\n\nexport async function resolveBearerJwt(token: string, session: string): Promise<AuthUser> {\n  await ensureSchema()\n  const payload = await verifyOAuthJwt(token)\n  const identity = typeof payload.sub === 'string' ? payload.sub : ''\n  if (!identity) throw new AuthError('Bearer token has no subject.')\n  const operator = isOperatorIdentity(identity)\n  const scopeClaim = typeof payload.scope === 'string' ? payload.scope : undefined\n  let self = await listVaultsForIdentity(identity)\n  if (self.length === 0) {\n    await provisionDefaultVaults(identity)\n    self = await listVaultsForIdentity(identity)\n  }\n  const selfVaults = self.map(v => v.handle)\n  const selfVaultScopes: Record<string, Scope> = {}\n  for (const v of self) if (v.role === 'shared') selfVaultScopes[v.handle] = v.entitlement\n  const baseScope = scopeFromOAuth(scopeClaim, operator)\n  const ctx = await resolveVaultContext({ identity, baseScope, operator, selfVaults, selfVaultScopes })\n  const planClaim = typeof payload.plan === 'string' ? payload.plan : undefined\n  return {\n    keyId: `oauth:${identity}`,\n    identity,\n    storageOwner: ctx.storageOwner,\n    vaults: ctx.vaults,\n    vaultScopes: ctx.vaultScopes,\n    scope: ctx.scope,\n    plan: operator ? OPERATOR_PLAN : planClaim ?? 'free',\n    session,\n  }\n}\n\nexport const mapAuthInfoToUser = async (args: {\n  authInfo: unknown\n  extra: Record<string, unknown>\n  requestContext?: { set?: (key: string, value: unknown) => void }\n}): Promise<AuthUser | undefined> => {\n  const info = args.authInfo as { token?: string; apiKey?: string; extra?: { apiKey?: string } } | undefined\n  const token = info?.token ?? info?.apiKey ?? info?.extra?.apiKey\n  if (!token) return undefined\n  const sessionId = typeof args.extra?.sessionId === 'string' ? args.extra.sessionId : `sess_${hashSecret(token).slice(0, 12)}`\n  const user = looksLikeJwt(token)\n    ? await resolveBearerJwt(token, sessionId)\n    : await resolveSecret(token, sessionId)\n  args.requestContext?.set?.('user', user)\n  return user\n}\n"],"mappings":"AAAA,SAAS,YAAY,mBAAmB;AACxC,SAAS,oBAAoB,iBAAiB;AAC9C,SAAS,cAAc,aAAa;AACpC,SAAS,oBAAoB,qBAAqB;AAClD,SAAS,uBAAuB,wBAAwB,kBAAkB,iBAAiB,uBAAuB;AAE3G,MAAM,aAAa,CAAC,QAAQ,SAAS,UAAU,SAAS,SAAS,MAAM;AAiBvE,MAAM,kBAAkB,MAAM;AAAA,EAC1B,OAAO;AAClB;AACO,MAAM,mBAAmB,MAAM;AAAA,EAC3B,OAAO;AAClB;AAEO,SAAS,aAAoB;AAClC,SAAO,EAAE,MAAM,OAAO,OAAO,OAAO,QAAQ,OAAO,OAAO,OAAO,OAAO,OAAO,MAAM,MAAM;AAC7F;AAEO,SAAS,sBAA6B;AAC3C,SAAO,EAAE,GAAG,WAAW,GAAG,MAAM,KAAK;AACvC;AAEO,SAAS,YAAmB;AACjC,SAAO,EAAE,MAAM,MAAM,OAAO,MAAM,QAAQ,MAAM,OAAO,MAAM,OAAO,MAAM,MAAM,KAAK;AACvF;AAEO,SAAS,eAAe,OAA4D;AACzF,QAAM,MAAM,WAAW;AACvB,MAAI,CAAC,MAAO,QAAO;AACnB,aAAW,KAAK,YAAY;AAC1B,QAAI,MAAM,CAAC,MAAM,KAAM,KAAI,CAAC,IAAI;AAAA,EAClC;AACA,SAAO;AACT;AAEO,SAAS,iBAAyB;AACvC,SAAO,MAAM,YAAY,EAAE,EAAE,SAAS,WAAW,CAAC;AACpD;AAEO,SAAS,WAAW,QAAwB;AACjD,SAAO,WAAW,QAAQ,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK;AACzD;AAaA,SAAS,cAAc,OAA0B;AAC/C,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,OAAO,CAAC,MAAmB,OAAO,MAAM,QAAQ;AACvF,SAAO,CAAC;AACV;AAEA,eAAsB,cAAc,QAAgB,SAAoC;AACtF,QAAM,aAAa;AACnB,QAAM,aAAa,WAAW,MAAM;AACpC,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA,CAAC,UAAU;AAAA,EACb;AACA,QAAM,MAAM,IAAI,KAAK,CAAC;AACtB,MAAI,CAAC,IAAK,OAAM,IAAI,UAAU,kBAAkB;AAChD,MAAI,IAAI,QAAS,OAAM,IAAI,UAAU,2BAA2B;AAChE,MAAI,IAAI,cAAc,IAAI,KAAK,IAAI,UAAU,EAAE,QAAQ,IAAI,KAAK,IAAI,GAAG;AACrE,UAAM,IAAI,UAAU,sBAAsB;AAAA,EAC5C;AACA,QAAM;AAAA,IACJ;AAAA,IACA,CAAC,IAAI,MAAM;AAAA,EACb;AACA,QAAM,WAAW,mBAAmB,IAAI,QAAQ;AAChD,QAAM,YAAY,WAAW,UAAU,IAAI,eAAe,IAAI,KAAgC;AAC9F,QAAM,OAAO,MAAM,sBAAsB,IAAI,QAAQ;AACrD,QAAM,aAAa,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAG,cAAc,IAAI,MAAM,GAAG,GAAG,KAAK,IAAI,OAAK,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1F,QAAM,kBAAyC,CAAC;AAChD,aAAW,KAAK,KAAM,KAAI,EAAE,SAAS,SAAU,iBAAgB,EAAE,MAAM,IAAI,EAAE;AAC7E,QAAM,MAAM,MAAM,oBAAoB;AAAA,IACpC,UAAU,IAAI;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,SAAO;AAAA,IACL,OAAO,IAAI;AAAA,IACX,UAAU,IAAI;AAAA,IACd,cAAc,IAAI;AAAA,IAClB,QAAQ,IAAI;AAAA,IACZ,aAAa,IAAI;AAAA,IACjB,OAAO,IAAI;AAAA,IACX,MAAM,WAAW,gBAAgB,IAAI;AAAA,IACrC;AAAA,EACF;AACF;AAYA,eAAsB,gBAAgB,OAAsB,SAA8C;AACxG,QAAM,UACJ,SAAS,gBAAgB,MAAM,MAAM,KAAK,SAAS,gBAAgB,MAAM,MAAM;AACjF,MAAI,WAAW,OAAO,YAAY,YAAY,WAAY,SAAoB;AAC5E,WAAO;AAAA,EACT;AACA,QAAM,SAAS,MAAM;AACrB,MAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,yEAAyE;AAC1G,QAAM,UAAU,MAAM,aAAa,QAAQ,WAAW,MAAM,EAAE,MAAM,GAAG,EAAE,CAAC;AAC1E,SAAO,cAAc,QAAQ,OAAO;AACtC;AAEO,SAAS,eAAe,GAAU,GAAiB;AACxD,QAAM,MAAM,WAAW;AACvB,aAAW,KAAK,WAAY,KAAI,CAAC,IAAI,EAAE,CAAC,MAAM,QAAQ,EAAE,CAAC,MAAM;AAC/D,SAAO;AACT;AASA,eAAsB,oBAAoB,MAMhB;AACxB,QAAM,MAAM,MAAM,iBAAiB,KAAK,QAAQ;AAChD,MAAI,IAAI,eAAe,IAAI,gBAAgB,KAAK,UAAU;AACxD,UAAM,QAAQ,KAAK,WAAW,UAAU,IAAI,MAAM,gBAAgB,IAAI,aAAa,KAAK,QAAQ;AAChG,QAAI,OAAO;AACT,aAAO;AAAA,QACL,cAAc,IAAI;AAAA,QAClB,QAAQ,MAAM,gBAAgB,IAAI,WAAW;AAAA,QAC7C,aAAa,CAAC;AAAA,QACd,OAAO,KAAK,WAAW,KAAK,YAAY,eAAe,KAAK,WAAW,KAAK;AAAA,MAC9E;AAAA,IACF;AAAA,EACF;AACA,SAAO,EAAE,cAAc,KAAK,UAAU,QAAQ,KAAK,YAAY,aAAa,KAAK,iBAAiB,OAAO,KAAK,UAAU;AAC1H;AAEO,MAAM,MAAM;AAAA,EACjB,kBAAkB,MAAgB,OAAe,UAA0B;AACzE,QAAI,CAAC,KAAK,OAAO,SAAS,KAAK,GAAG;AAChC,YAAM,IAAI,WAAW,OAAO,KAAK,KAAK,8BAA8B,KAAK,IAAI;AAAA,IAC/E;AACA,QAAI,CAAC,KAAK,MAAM,QAAQ,GAAG;AACzB,YAAM,IAAI,WAAW,OAAO,KAAK,KAAK,WAAW,QAAQ,UAAU;AAAA,IACrE;AACA,UAAM,KAAK,KAAK,YAAY,KAAK;AACjC,QAAI,MAAM,GAAG,QAAQ,MAAM,MAAM;AAC/B,YAAM,IAAI,WAAW,UAAU,KAAK,wBAAwB,QAAQ,eAAe;AAAA,IACrF;AAAA,EACF;AAAA,EACA,eAAe,MAAgB,OAAe,UAA6B;AACzE,QAAI,CAAC,KAAK,OAAO,SAAS,KAAK,KAAK,KAAK,MAAM,QAAQ,MAAM,KAAM,QAAO;AAC1E,UAAM,KAAK,KAAK,YAAY,KAAK;AACjC,WAAO,CAAC,MAAM,GAAG,QAAQ,MAAM;AAAA,EACjC;AACF;AAEO,SAAS,cAAsB;AACpC,UAAQ,QAAQ,IAAI,gBAAgB,0BAA0B,QAAQ,OAAO,EAAE;AACjF;AAEO,SAAS,mBAA2B;AACzC,SACE,QAAQ,IAAI,kBACZ;AAEJ;AAEO,SAAS,eAAuB;AACrC,UAAQ,QAAQ,IAAI,qBAAqB,iCAAiC,QAAQ,OAAO,EAAE;AAC7F;AAEO,SAAS,4BAAqD;AACnE,SAAO;AAAA,IACL,UAAU,iBAAiB;AAAA,IAC3B,uBAAuB,CAAC,YAAY,CAAC;AAAA,IACrC,kBAAkB,CAAC,eAAe,gBAAgB,cAAc;AAAA,IAChE,0BAA0B,CAAC,QAAQ;AAAA,EACrC;AACF;AAEO,SAAS,uBAA+B;AAC7C,SAAO,6BAA6B,aAAa,CAAC;AACpD;AAEA,SAAS,aAAa,OAAwB;AAC5C,SAAO,CAAC,MAAM,WAAW,KAAK,KAAK,MAAM,MAAM,GAAG,EAAE,WAAW;AACjE;AAEA,IAAI,gBAA8D;AAElE,SAAS,UAAiD;AACxD,MAAI,cAAe,QAAO;AAC1B,kBAAgB,mBAAmB,IAAI,IAAI,GAAG,YAAY,CAAC,wBAAwB,CAAC;AACpF,SAAO;AACT;AAEA,SAAS,eAAe,YAAgC,UAA0B;AAChF,MAAI,SAAU,QAAO,UAAU;AAC/B,QAAM,UAAU,cAAc,IAAI,MAAM,KAAK,EAAE,IAAI,OAAK,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AAChF,QAAM,MAAM,WAAW;AACvB,MAAI,OAAO,SAAS,cAAc,EAAG,QAAO,UAAU;AACtD,MAAI,OAAO,SAAS,aAAa,EAAG,KAAI,OAAO;AAC/C,MAAI,OAAO,SAAS,cAAc,GAAG;AACnC,QAAI,OAAO;AACX,QAAI,QAAQ;AACZ,QAAI,SAAS;AACb,QAAI,QAAQ;AACZ,QAAI,OAAO;AAAA,EACb;AACA,MAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,MAAO,KAAI,OAAO;AACxC,SAAO;AACT;AAEO,SAAS,YAAY,OAAwB;AAClD,SAAO,aAAa,KAAK;AAC3B;AAEA,eAAsB,eAAe,OAAiD;AACpF,QAAM,EAAE,QAAQ,IAAI,MAAM,UAAU,OAAO,QAAQ,GAAG;AAAA,IACpD,QAAQ,YAAY;AAAA,IACpB,UAAU,iBAAiB;AAAA,EAC7B,CAAC;AACD,SAAO;AACT;AAEA,eAAsB,iBAAiB,OAAe,SAAoC;AACxF,QAAM,aAAa;AACnB,QAAM,UAAU,MAAM,eAAe,KAAK;AAC1C,QAAM,WAAW,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AACjE,MAAI,CAAC,SAAU,OAAM,IAAI,UAAU,8BAA8B;AACjE,QAAM,WAAW,mBAAmB,QAAQ;AAC5C,QAAM,aAAa,OAAO,QAAQ,UAAU,WAAW,QAAQ,QAAQ;AACvE,MAAI,OAAO,MAAM,sBAAsB,QAAQ;AAC/C,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,uBAAuB,QAAQ;AACrC,WAAO,MAAM,sBAAsB,QAAQ;AAAA,EAC7C;AACA,QAAM,aAAa,KAAK,IAAI,OAAK,EAAE,MAAM;AACzC,QAAM,kBAAyC,CAAC;AAChD,aAAW,KAAK,KAAM,KAAI,EAAE,SAAS,SAAU,iBAAgB,EAAE,MAAM,IAAI,EAAE;AAC7E,QAAM,YAAY,eAAe,YAAY,QAAQ;AACrD,QAAM,MAAM,MAAM,oBAAoB,EAAE,UAAU,WAAW,UAAU,YAAY,gBAAgB,CAAC;AACpG,QAAM,YAAY,OAAO,QAAQ,SAAS,WAAW,QAAQ,OAAO;AACpE,SAAO;AAAA,IACL,OAAO,SAAS,QAAQ;AAAA,IACxB;AAAA,IACA,cAAc,IAAI;AAAA,IAClB,QAAQ,IAAI;AAAA,IACZ,aAAa,IAAI;AAAA,IACjB,OAAO,IAAI;AAAA,IACX,MAAM,WAAW,gBAAgB,aAAa;AAAA,IAC9C;AAAA,EACF;AACF;AAEO,MAAM,oBAAoB,OAAO,SAIH;AACnC,QAAM,OAAO,KAAK;AAClB,QAAM,QAAQ,MAAM,SAAS,MAAM,UAAU,MAAM,OAAO;AAC1D,MAAI,CAAC,MAAO,QAAO;AACnB,QAAM,YAAY,OAAO,KAAK,OAAO,cAAc,WAAW,KAAK,MAAM,YAAY,QAAQ,WAAW,KAAK,EAAE,MAAM,GAAG,EAAE,CAAC;AAC3H,QAAM,OAAO,aAAa,KAAK,IAC3B,MAAM,iBAAiB,OAAO,SAAS,IACvC,MAAM,cAAc,OAAO,SAAS;AACxC,OAAK,gBAAgB,MAAM,QAAQ,IAAI;AACvC,SAAO;AACT;","names":[]}

package/dist/lib/cost-rates.d.ts

@@ -0,0 +1,19 @@
+declare const COST_RATES: {
+    readonly minimax_in_per_tok: number;
+    readonly minimax_out_per_tok: number;
+    readonly jina_per_tok: number;
+    readonly neon_per_gb_month: 0.35;
+    readonly compute_per_run_usd: 0.0005;
+};
+declare const FREE_COST_CAP_USD = 1;
+declare const PRO_COST_BUDGET_USD: number;
+declare const MARGIN_MULTIPLE = 3;
+declare function embedCostUsd(tokens: number): number;
+declare function llmCostUsd(args: {
+    inputTokens?: number;
+    outputTokens?: number;
+}): number;
+declare function storageCostUsdForMonth(bytes: number): number;
+declare function storageCostUsdForDay(bytes: number): number;
+
+export { COST_RATES, FREE_COST_CAP_USD, MARGIN_MULTIPLE, PRO_COST_BUDGET_USD, embedCostUsd, llmCostUsd, storageCostUsdForDay, storageCostUsdForMonth };