Feat/cli autogen

[SteakFisher]

No description provided.

[greptile-apps]

Greptile Summary

This PR adds project-scoped onboarding, authentication, payments, and event querying. The main changes are:

• Master-key onboarding that creates projects, metadata, Dodo webhooks, and dashboard API keys.
• Project-aware API key, tag, expression, webhook, and payment management paths.
• Project and mode scoping for gRPC data queries and event storage/query handlers.
• Output-cache token and debit metrics in AI token usage ingestion and query responses.

Confidence Score: 3/5

This PR needs a database migration and backfill before it is safe to merge.

The main project-scoping paths are consistent, but the schema adds required project_id columns to existing core tables without an upgrade path. Existing deployments can fail during schema application or after deploy until historical rows are assigned to a project.

src/storage/db/postgres/schema.ts

T-Rex Logs

What T-Rex did

• Ran a focused Postgres-compatible schema-upgrade harness to reproduce the missing migration path for required project_id, and observed that the upgrade fails when existing rows have no backfill for the NOT NULL project_id.
• Compared the base and head commits for API config and project routes, noting that the base commit returns 401/404 while the head commit returns 200/201 for project operations and related dashboard-key actions.
• Executed Vitest/Fastify webhook scope tests and captured before/after evidence showing scope enforcement across cross-project, production, and same-project contexts.
• Ran event scope tests and verified that after-change SQL includes a WHERE project_id predicate and additional projections, with data queries returning the expected dashboard-key-only message for non-dashboard keys.
• Ran payment project-scope tests and observed separate Dodo calls per project, project-specific sessions, and a post-webhook project B payment row, with no cross-project session reuse for the same user and mode.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
src/storage/db/postgres/schema.ts	Adds project scoping and non-null foreign keys across core tables; missing migration/backfill makes existing databases unsafe to upgrade.
src/routes/http/api/onboarding.ts	Introduces master-key onboarding that creates projects, metadata, Dodo webhooks, and dashboard keys with rollback handling.
src/routes/http/api/apiKeys.ts	Scopes HTTP API key management by project, reserves dashboard-key creation for master auth, and invalidates revoked keys from cache.
src/routes/gRPC/data/query.ts	Restricts data queries to dashboard keys and adds project/mode filters to scoped metadata tables.
src/routes/gRPC/payment/paymentProvider.ts	Changes Dodo client/config caching to be keyed by project and mode.
src/routes/http/createdCheckout.ts	Routes Dodo webhook verification and payment processing through the project-specific client/session scope.
src/storage/adapter/postgres/handlers/queryEvents.ts	Adds project filters and output-cache metric selection to Postgres event queries.
src/storage/adapter/clickhouse/handlers/queryEvents.ts	Adds project filters and output-cache metric selection to ClickHouse event queries.
src/zod/event.ts	Makes tag/expression pricing resolution project-aware and adds output-cache token pricing inputs.
src/utils/authenticateMasterApiKey.ts	Adds HMAC-based master API key validation for project/onboarding administration endpoints.

Sequence Diagram

%%{init: {'theme': 'neutral'}}%%
sequenceDiagram
participant Dashboard as Dashboard/CLI
participant API as Scrawn HTTP API
participant Auth as Auth helpers
participant DB as Postgres
participant Dodo as Dodo Payments
participant SDK as SDK gRPC client

Dashboard->>API: POST /api/v1/internals/onboarding
API->>Auth: authenticateMasterApiKey()
API->>Dodo: create project webhooks(projectId)
API->>DB: insert project, metadata, dashboard key
API-->>Dashboard: projectId + dashboard apiKey

SDK->>API: gRPC register/stream/query with Bearer key
API->>Auth: authenticate API key
Auth->>DB: load api key + projectId
API->>DB: read/write rows scoped by projectId and mode
API-->>SDK: scoped response

Dodo->>API: "payment webhook?projectId&mode"
API->>DB: load project metadata/session
API->>Dodo: verify signature with project client
API->>DB: update session, user billing, payment event

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
sequenceDiagram
participant Dashboard as Dashboard/CLI
participant API as Scrawn HTTP API
participant Auth as Auth helpers
participant DB as Postgres
participant Dodo as Dodo Payments
participant SDK as SDK gRPC client

Dashboard->>API: POST /api/v1/internals/onboarding
API->>Auth: authenticateMasterApiKey()
API->>Dodo: create project webhooks(projectId)
API->>DB: insert project, metadata, dashboard key
API-->>Dashboard: projectId + dashboard apiKey

SDK->>API: gRPC register/stream/query with Bearer key
API->>Auth: authenticate API key
Auth->>DB: load api key + projectId
API->>DB: read/write rows scoped by projectId and mode
API-->>SDK: scoped response

Dodo->>API: "payment webhook?projectId&mode"
API->>DB: load project metadata/session
API->>Dodo: verify signature with project client
API->>DB: update session, user billing, payment event

Loading

_{Reviews (1): Last reviewed commit: "chore: rename SCRAWN_KEY to MASTER_API_K..." | Re-trigger Greptile}

[greptile-apps]

Missing migration path
This PR adds required project_id foreign keys to existing tables, including users.project_id, without a migration or backfill in the changeset. Existing deployments already have rows in users, api_keys, event tables, and metadata; applying this schema as-is requires a non-null project value for every existing row, so the upgrade can fail until a project row is created and existing data is backfilled.

Artifacts

Repro: schema-upgrade harness that applies required users.project_id to historical rows

• Contains supporting evidence from the run (text/javascript; charset=utf-8).

Repro: equivalent SQL for the historical users row and required project_id addition

• Contains supporting evidence from the run (text/x-sql; charset=utf-8).

Repro: database error output showing NOT NULL project_id upgrade failure

• Keeps the command output available without making the summary code-heavy.

Repro: attempted repository Drizzle push path without available local Postgres

• Keeps the command output available without making the summary code-heavy.

_{Ran code and verified through T-Rex}