Track private download counts in D1

.github/workflows/agent-updates-tests.yml

@@ -9,6 +9,7 @@ on:
     paths:
       - ".github/workflows/agent-updates-*.yml"
       - "services/agent-updates/**"
+      - "services/download-tracking/**"
       - "scripts/ci/agent-updates.sh"
       - "scripts/ci/test_agent_updates_workflows.py"
       - "scripts/ci/_common.sh"
@@ -20,6 +21,7 @@ on:
     paths:
       - ".github/workflows/agent-updates-*.yml"
       - "services/agent-updates/**"
+      - "services/download-tracking/**"
       - "scripts/ci/agent-updates.sh"
       - "scripts/ci/test_agent_updates_workflows.py"
       - "scripts/ci/_common.sh"

.github/workflows/updates-tests.yml

@@ -10,6 +10,7 @@ on:
       - ".github/workflows/updates-tests.yml"
       - ".github/workflows/updates-publish.yml"
       - "services/updates/**"
+      - "services/download-tracking/**"
       - "scripts/ci/_common.sh"
       - "scripts/ci/updates.sh"
       - "flake.nix"
@@ -20,6 +21,7 @@ on:
       - ".github/workflows/updates-tests.yml"
       - ".github/workflows/updates-publish.yml"
       - "services/updates/**"
+      - "services/download-tracking/**"
       - "scripts/ci/_common.sh"
       - "scripts/ci/updates.sh"
       - "flake.nix"

scripts/ci/agent-updates.sh

@@ -8,6 +8,7 @@ print_source_provenance
 export WRANGLER_SEND_METRICS=false
 cd "${REPO_ROOT}"
 python3 scripts/ci/test_agent_updates_workflows.py
+python3 -I -m unittest discover -s services/download-tracking -p 'test_*.py'
 python3 -I -m unittest discover -s services/agent-updates/publisher -p 'test_*.py'
 cd services/agent-updates
 bun install --frozen-lockfile --ignore-scripts

scripts/ci/change_detection.py

@@ -31,7 +31,7 @@
         "apps/maple-research/zapstore.yaml",
     }
 )
-INERT_PREFIXES = (".agents/", ".githooks/", "docs/", "apps/maple-research/docs/", "apps/maple-research/.githooks/", "services/updates/", "services/opensecret/", "apps/maple-agent/", "apps/maple-auth/")
+INERT_PREFIXES = (".agents/", ".githooks/", "docs/", "apps/maple-research/docs/", "apps/maple-research/.githooks/", "services/updates/", "services/download-tracking/", "services/opensecret/", "apps/maple-agent/", "apps/maple-auth/")
 PURE_FRONTEND_PREFIXES = ("apps/maple-research/frontend/public/", "apps/maple-research/frontend/src/")
 PURE_FRONTEND_FILES = frozenset({"apps/maple-research/frontend/icon.svg", "apps/maple-research/frontend/index.html"})
 RUST_SDK_PREFIX = "sdk/rust/"

scripts/ci/hook_change_detection.py

@@ -165,6 +165,9 @@ def classify_path(path: str) -> frozenset[str]:
             return frozenset()
         return frozenset({"opensecret"})
 
+    if path.startswith("services/download-tracking/"):
+        return frozenset({"updates", "agent_updates"})
+
     if path.startswith(UPDATES_PREFIX + ".githooks/"):
         return frozenset()
     if path.startswith(UPDATES_PREFIX):

scripts/ci/opensecret_change_detection.py

@@ -44,7 +44,7 @@
     ".agents/skills/validate-opensecret/scripts/disposable_db_tests.sh",
 })
 KNOWN_INDEPENDENT_PREFIXES = (
-    "apps/", "proxy/", "services/updates/", ".agents/", ".github/",
+    "apps/", "proxy/", "services/updates/", "services/download-tracking/", ".agents/", ".github/",
     ".githooks/", "docs/", "scripts/",
 )
 KNOWN_INDEPENDENT_FILES = frozenset({

scripts/ci/test_hook_change_detection.py

@@ -102,6 +102,9 @@ def test_proxy_opensecret_and_updates(self) -> None:
         self.assert_selects(["services/opensecret/nix/eif.nix"])
         self.assert_selects(["services/updates/src/index.ts"], "updates")
 
+    def test_download_tracking_selects_both_workers(self) -> None:
+        self.assert_selects(["services/download-tracking/tracking.ts"], "updates", "agent_updates")
+
     def test_agent_updates_component_is_isolated_from_research(self) -> None:
         for path in (
             "services/agent-updates/src/worker.ts",

services/agent-updates/README.md

@@ -8,6 +8,9 @@ See [publisher tooling](publisher/README.md) for exact commands and retry behavi
 The checked-in binding names the owner-provisioned private `maple-agent-updates`
 bucket. This is configuration, not evidence of Worker deployment or activated
 delivery. There is no deploy script or automatic deployment workflow.
+Private download metrics use the shared Queue and D1 ledger described in
+[download tracking](../download-tracking/README.md). The existing Agent Worker
+consumes events from both update Workers; it has no public metrics endpoint.
 `workers_dev` and preview URLs are off; routine configuration must never contain
 `route`, `routes` or a Custom Domain. Local checks use a separate fixture bucket.
 

services/agent-updates/migrations/0001_download_events.sql

@@ -0,0 +1,22 @@
+-- Response starts, not unique users, completed transfers, or installations.
+-- No path, query, IP, raw User-Agent, cookies, or client identifiers are stored.
+CREATE TABLE download_events (
+  event_id TEXT PRIMARY KEY NOT NULL,
+  observed_at TEXT NOT NULL,
+  product TEXT NOT NULL CHECK (product IN ('agent', 'research')),
+  host TEXT NOT NULL CHECK (host IN ('updates.maple.ai', 'updates.trymaple.ai')),
+  version TEXT,
+  platform TEXT NOT NULL CHECK (platform IN ('macos', 'windows', 'linux', 'android', 'all')),
+  artifact TEXT NOT NULL CHECK (artifact IN ('macos-dmg', 'macos-updater', 'windows-installer', 'linux-bundle', 'linux-appimage', 'linux-deb', 'linux-rpm', 'android-apk', 'latest', 'manifest')),
+  kind TEXT NOT NULL CHECK (kind IN ('artifact', 'alias', 'metadata')),
+  method TEXT NOT NULL CHECK (method IN ('GET', 'HEAD')),
+  status INTEGER NOT NULL CHECK (status BETWEEN 200 AND 599),
+  range TEXT NOT NULL CHECK (range IN ('none', 'requested', 'partial', 'unsatisfiable')),
+  result TEXT NOT NULL CHECK (result IN ('success', 'redirect', 'not_modified', 'client_error', 'server_error')),
+  response_length INTEGER CHECK (response_length BETWEEN 0 AND 4294967296),
+  client_kind TEXT NOT NULL CHECK (client_kind IN ('browser', 'maple', 'cli', 'other')),
+  is_probe INTEGER NOT NULL CHECK (is_probe IN (0, 1))
+);
+
+CREATE INDEX download_events_observed_at ON download_events(observed_at);
+CREATE INDEX download_events_trends ON download_events(product, kind, observed_at);

services/agent-updates/package.json

@@ -6,8 +6,8 @@
   "scripts": {
     "check": "bun run format:check && bun run typecheck && bun run test && bun run build:dry-run",
     "build:dry-run": "bun src/dry-run.ts",
-    "format": "prettier --write \"src/**/*.ts\" README.md package.json tsconfig.json wrangler.jsonc",
-    "format:check": "prettier --check \"src/**/*.ts\" README.md package.json tsconfig.json wrangler.jsonc",
+    "format": "prettier --write \"src/**/*.ts\" ../download-tracking/tracking.ts ../download-tracking/README.md README.md package.json tsconfig.json wrangler.jsonc",
+    "format:check": "prettier --check \"src/**/*.ts\" ../download-tracking/tracking.ts ../download-tracking/README.md README.md package.json tsconfig.json wrangler.jsonc",
     "test": "bun --no-env-file test",
     "typecheck": "tsc --noEmit"
   },

services/agent-updates/src/dry-run.ts

@@ -38,6 +38,18 @@ try {
           bucket_name: "agent-updates-local-dry-run",
         },
       ],
+      d1_databases: [
+        {
+          binding: "DOWNLOAD_DB",
+          database_name: "downloads-local-dry-run",
+          database_id: "00000000-0000-4000-8000-000000000001",
+        },
+      ],
+      queues: {
+        producers: [
+          { binding: "DOWNLOAD_EVENTS", queue: "downloads-local-dry-run" },
+        ],
+      },
     }),
   );
   const result = Bun.spawn(