@a-company/sentinel 0.2.0 → 3.6.0

package/dist/{commands-KIMGFR2I.js → commands-E7ACLOE7.js}

@@ -8,7 +8,7 @@ import initSqlJs from "sql.js";
 import { v4 as uuidv4 } from "uuid";
 import * as path from "path";
 import * as fs from "fs";
-var SCHEMA_VERSION = 2;
+var SCHEMA_VERSION = 5;
 var DEFAULT_CONFIDENCE = {
   score: 50,
   timesMatched: 0,
@@ -128,6 +128,72 @@ var SentinelStorage = class {
         notes TEXT
       );
 
+      -- Structured logs table
+      CREATE TABLE IF NOT EXISTS logs (
+        id TEXT PRIMARY KEY,
+        timestamp TEXT NOT NULL,
+        level TEXT NOT NULL CHECK (level IN ('debug','info','warn','error')),
+        symbol TEXT NOT NULL,
+        symbol_type TEXT NOT NULL DEFAULT 'raw',
+        message TEXT NOT NULL,
+        data_json TEXT,
+        service TEXT NOT NULL,
+        session_id TEXT,
+        correlation_id TEXT,
+        duration_ms REAL,
+        environment TEXT
+      );
+
+      -- Service registry
+      CREATE TABLE IF NOT EXISTS services (
+        name TEXT PRIMARY KEY,
+        version TEXT,
+        pid INTEGER,
+        started_at TEXT NOT NULL,
+        last_seen_at TEXT NOT NULL,
+        environment TEXT,
+        metadata_json TEXT
+      );
+
+      -- Live app state snapshots (latest-wins per service+session)
+      CREATE TABLE IF NOT EXISTS app_state (
+        service TEXT NOT NULL,
+        session_id TEXT NOT NULL,
+        timestamp TEXT NOT NULL,
+        state_json TEXT NOT NULL,
+        active_flows_json TEXT,
+        active_gates_json TEXT,
+        PRIMARY KEY (service, session_id)
+      );
+
+      -- Metrics table
+      CREATE TABLE IF NOT EXISTS metrics (
+        id TEXT PRIMARY KEY,
+        timestamp TEXT NOT NULL,
+        name TEXT NOT NULL,
+        type TEXT NOT NULL CHECK (type IN ('counter','gauge','histogram')),
+        value REAL NOT NULL,
+        tags_json TEXT DEFAULT '{}',
+        service TEXT NOT NULL,
+        environment TEXT
+      );
+
+      -- Traces table
+      CREATE TABLE IF NOT EXISTS traces (
+        trace_id TEXT NOT NULL,
+        span_id TEXT PRIMARY KEY,
+        parent_span_id TEXT,
+        service TEXT NOT NULL,
+        symbol TEXT NOT NULL,
+        operation TEXT NOT NULL,
+        start_time TEXT NOT NULL,
+        end_time TEXT,
+        duration_ms REAL,
+        status TEXT NOT NULL DEFAULT 'ok',
+        tags_json TEXT DEFAULT '{}',
+        log_ids_json TEXT DEFAULT '[]'
+      );
+
       -- Indexes
       CREATE INDEX IF NOT EXISTS idx_incidents_timestamp ON incidents(timestamp);
       CREATE INDEX IF NOT EXISTS idx_incidents_status ON incidents(status);
@@ -137,6 +203,18 @@ var SentinelStorage = class {
       CREATE INDEX IF NOT EXISTS idx_practice_events_habit_id ON practice_events(habit_id);
       CREATE INDEX IF NOT EXISTS idx_practice_events_engineer ON practice_events(engineer);
       CREATE INDEX IF NOT EXISTS idx_practice_events_session_id ON practice_events(session_id);
+      CREATE INDEX IF NOT EXISTS idx_logs_timestamp ON logs(timestamp);
+      CREATE INDEX IF NOT EXISTS idx_logs_level ON logs(level);
+      CREATE INDEX IF NOT EXISTS idx_logs_symbol ON logs(symbol);
+      CREATE INDEX IF NOT EXISTS idx_logs_service ON logs(service);
+      CREATE INDEX IF NOT EXISTS idx_logs_session_id ON logs(session_id);
+      CREATE INDEX IF NOT EXISTS idx_logs_correlation_id ON logs(correlation_id);
+      CREATE INDEX IF NOT EXISTS idx_metrics_timestamp ON metrics(timestamp);
+      CREATE INDEX IF NOT EXISTS idx_metrics_name ON metrics(name);
+      CREATE INDEX IF NOT EXISTS idx_metrics_service ON metrics(service);
+      CREATE INDEX IF NOT EXISTS idx_traces_trace_id ON traces(trace_id);
+      CREATE INDEX IF NOT EXISTS idx_traces_service ON traces(service);
+      CREATE INDEX IF NOT EXISTS idx_traces_start_time ON traces(start_time);
     `);
     this.db.run(
       "INSERT OR REPLACE INTO metadata (key, value) VALUES ('schema_version', ?)",
@@ -266,6 +344,149 @@ var SentinelStorage = class {
       this.db.run(
         "INSERT OR REPLACE INTO metadata (key, value) VALUES ('schema_version', '2')"
       );
+      currentVersion = 2;
+    }
+    if (currentVersion < 3) {
+      try {
+        this.db.run(`
+          CREATE TABLE IF NOT EXISTS logs (
+            id TEXT PRIMARY KEY,
+            timestamp TEXT NOT NULL,
+            level TEXT NOT NULL CHECK (level IN ('debug','info','warn','error')),
+            symbol TEXT NOT NULL,
+            symbol_type TEXT NOT NULL DEFAULT 'raw',
+            message TEXT NOT NULL,
+            data_json TEXT,
+            service TEXT NOT NULL,
+            session_id TEXT,
+            correlation_id TEXT,
+            duration_ms REAL,
+            environment TEXT
+          );
+
+          CREATE TABLE IF NOT EXISTS services (
+            name TEXT PRIMARY KEY,
+            version TEXT,
+            pid INTEGER,
+            started_at TEXT NOT NULL,
+            last_seen_at TEXT NOT NULL,
+            environment TEXT,
+            metadata_json TEXT
+          );
+
+          CREATE TABLE IF NOT EXISTS app_state (
+            service TEXT NOT NULL,
+            session_id TEXT NOT NULL,
+            timestamp TEXT NOT NULL,
+            state_json TEXT NOT NULL,
+            active_flows_json TEXT,
+            active_gates_json TEXT,
+            PRIMARY KEY (service, session_id)
+          );
+
+          CREATE INDEX IF NOT EXISTS idx_logs_timestamp ON logs(timestamp);
+          CREATE INDEX IF NOT EXISTS idx_logs_level ON logs(level);
+          CREATE INDEX IF NOT EXISTS idx_logs_symbol ON logs(symbol);
+          CREATE INDEX IF NOT EXISTS idx_logs_service ON logs(service);
+          CREATE INDEX IF NOT EXISTS idx_logs_session_id ON logs(session_id);
+          CREATE INDEX IF NOT EXISTS idx_logs_correlation_id ON logs(correlation_id);
+        `);
+      } catch {
+      }
+      this.db.run(
+        "INSERT OR REPLACE INTO metadata (key, value) VALUES ('schema_version', '3')"
+      );
+      currentVersion = 3;
+    }
+    if (currentVersion < 4) {
+      try {
+        this.db.run(`
+          CREATE TABLE IF NOT EXISTS metrics (
+            id TEXT PRIMARY KEY,
+            timestamp TEXT NOT NULL,
+            name TEXT NOT NULL,
+            type TEXT NOT NULL CHECK (type IN ('counter','gauge','histogram')),
+            value REAL NOT NULL,
+            tags_json TEXT DEFAULT '{}',
+            service TEXT NOT NULL,
+            environment TEXT
+          );
+
+          CREATE TABLE IF NOT EXISTS traces (
+            trace_id TEXT NOT NULL,
+            span_id TEXT PRIMARY KEY,
+            parent_span_id TEXT,
+            service TEXT NOT NULL,
+            symbol TEXT NOT NULL,
+            operation TEXT NOT NULL,
+            start_time TEXT NOT NULL,
+            end_time TEXT,
+            duration_ms REAL,
+            status TEXT NOT NULL DEFAULT 'ok',
+            tags_json TEXT DEFAULT '{}',
+            log_ids_json TEXT DEFAULT '[]'
+          );
+
+          CREATE INDEX IF NOT EXISTS idx_metrics_timestamp ON metrics(timestamp);
+          CREATE INDEX IF NOT EXISTS idx_metrics_name ON metrics(name);
+          CREATE INDEX IF NOT EXISTS idx_metrics_service ON metrics(service);
+          CREATE INDEX IF NOT EXISTS idx_traces_trace_id ON traces(trace_id);
+          CREATE INDEX IF NOT EXISTS idx_traces_service ON traces(service);
+          CREATE INDEX IF NOT EXISTS idx_traces_start_time ON traces(start_time);
+        `);
+      } catch {
+      }
+      this.db.run(
+        "INSERT OR REPLACE INTO metadata (key, value) VALUES ('schema_version', '4')"
+      );
+      currentVersion = 4;
+    }
+    if (currentVersion < 5) {
+      try {
+        this.db.run(`
+          CREATE TABLE IF NOT EXISTS schemas (
+            id TEXT PRIMARY KEY,
+            version TEXT NOT NULL,
+            name TEXT NOT NULL,
+            description TEXT,
+            scope_json TEXT NOT NULL,
+            event_types_json TEXT NOT NULL,
+            causality_json TEXT,
+            visualization_json TEXT,
+            tags_json TEXT DEFAULT '[]',
+            registered_at TEXT NOT NULL,
+            updated_at TEXT NOT NULL
+          );
+
+          CREATE TABLE IF NOT EXISTS events (
+            id TEXT PRIMARY KEY,
+            schema_id TEXT NOT NULL,
+            event_type TEXT NOT NULL,
+            category TEXT NOT NULL,
+            timestamp TEXT NOT NULL,
+            scope_value TEXT,
+            scope_ordinal INTEGER,
+            session_id TEXT,
+            service TEXT NOT NULL,
+            data_json TEXT,
+            severity TEXT DEFAULT 'info',
+            parent_event_id TEXT,
+            depth INTEGER DEFAULT 0
+          );
+
+          CREATE INDEX IF NOT EXISTS idx_events_schema ON events(schema_id);
+          CREATE INDEX IF NOT EXISTS idx_events_type ON events(event_type);
+          CREATE INDEX IF NOT EXISTS idx_events_scope ON events(schema_id, scope_value);
+          CREATE INDEX IF NOT EXISTS idx_events_scope_ord ON events(schema_id, scope_ordinal);
+          CREATE INDEX IF NOT EXISTS idx_events_session ON events(session_id);
+          CREATE INDEX IF NOT EXISTS idx_events_timestamp ON events(timestamp);
+          CREATE INDEX IF NOT EXISTS idx_events_service ON events(service);
+        `);
+      } catch {
+      }
+      this.db.run(
+        "INSERT OR REPLACE INTO metadata (key, value) VALUES ('schema_version', '5')"
+      );
     }
   }
   /**
@@ -1240,165 +1461,1114 @@ var SentinelStorage = class {
       notes: obj.notes || void 0
     };
   }
-  close() {
-    if (this.db) {
-      this.save();
-      this.db.close();
-      this.db = null;
-    }
+  // ─── Structured Logs ─────────────────────────────────────────────
+  inferSymbolType(symbol) {
+    if (symbol.startsWith("#")) return "component";
+    if (symbol.startsWith("^")) return "gate";
+    if (symbol.startsWith("!")) return "signal";
+    if (symbol.startsWith("$")) return "flow";
+    if (symbol.startsWith("~")) return "aspect";
+    return "raw";
   }
-};
-
-// src/matcher.ts
-var DEFAULT_CONFIG = {
-  minScore: 30,
-  maxResults: 5,
-  boostConfidence: true
-};
-var PatternMatcher = class {
-  constructor(storage) {
-    this.storage = storage;
+  insertLog(input) {
+    this.initializeSync();
+    const id = input.id || uuidv4();
+    const timestamp = input.timestamp || (/* @__PURE__ */ new Date()).toISOString();
+    const symbolType = input.symbolType || this.inferSymbolType(input.symbol);
+    this.db.run(
+      `INSERT INTO logs (
+        id, timestamp, level, symbol, symbol_type, message, data_json,
+        service, session_id, correlation_id, duration_ms, environment
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      [
+        id,
+        timestamp,
+        input.level,
+        input.symbol,
+        symbolType,
+        input.message,
+        input.data ? JSON.stringify(input.data) : null,
+        input.service,
+        input.sessionId || null,
+        input.correlationId || null,
+        input.durationMs ?? null,
+        input.environment || null
+      ]
+    );
+    this.save();
+    return id;
   }
-  /**
-   * Match an incident against all patterns and return ranked results
-   */
-  match(incident, config = {}) {
-    const { minScore, maxResults, boostConfidence } = {
-      ...DEFAULT_CONFIG,
-      ...config
-    };
-    const patterns = this.storage.getAllPatterns({ includePrivate: true });
-    const matches = [];
-    for (const pattern of patterns) {
-      if (!this.matchEnvironment(pattern, incident)) {
-        continue;
-      }
-      const { score, matchedCriteria } = this.scoreMatch(pattern, incident);
-      if (score >= minScore) {
-        let confidence = score;
-        if (boostConfidence) {
-          const confidenceFactor = pattern.confidence.score / 100;
-          confidence = score * (0.5 + 0.5 * confidenceFactor);
-        }
-        matches.push({
-          pattern,
-          score,
-          matchedCriteria,
-          confidence: Math.round(confidence)
-        });
-        this.storage.updatePatternConfidence(pattern.id, "matched");
+  insertLogBatch(entries) {
+    this.initializeSync();
+    let accepted = 0;
+    const errors = [];
+    for (const input of entries) {
+      try {
+        const id = input.id || uuidv4();
+        const timestamp = input.timestamp || (/* @__PURE__ */ new Date()).toISOString();
+        const symbolType = input.symbolType || this.inferSymbolType(input.symbol);
+        this.db.run(
+          `INSERT INTO logs (
+            id, timestamp, level, symbol, symbol_type, message, data_json,
+            service, session_id, correlation_id, duration_ms, environment
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+          [
+            id,
+            timestamp,
+            input.level,
+            input.symbol,
+            symbolType,
+            input.message,
+            input.data ? JSON.stringify(input.data) : null,
+            input.service,
+            input.sessionId || null,
+            input.correlationId || null,
+            input.durationMs ?? null,
+            input.environment || null
+          ]
+        );
+        accepted++;
+      } catch (err) {
+        errors.push(err instanceof Error ? err.message : String(err));
       }
     }
-    return matches.sort((a, b) => b.confidence - a.confidence).slice(0, maxResults);
+    this.save();
+    return { accepted, errors };
   }
-  /**
-   * Test a pattern against historical incidents
-   */
-  testPattern(pattern, limit = 100) {
-    const incidents = this.storage.getRecentIncidents({ limit });
-    const wouldMatch = [];
-    let totalScore = 0;
-    for (const incident of incidents) {
-      if (!this.matchEnvironment(pattern, incident)) {
-        continue;
-      }
-      const { score } = this.scoreMatch(pattern, incident);
-      if (score >= 30) {
-        wouldMatch.push(incident);
-        totalScore += score;
-      }
+  queryLogs(options = {}) {
+    this.initializeSync();
+    const { limit = 100, offset = 0 } = options;
+    const conditions = [];
+    const params = [];
+    if (options.level) {
+      conditions.push("level = ?");
+      params.push(options.level);
     }
-    return {
-      wouldMatch,
-      matchCount: wouldMatch.length,
-      avgScore: wouldMatch.length > 0 ? Math.round(totalScore / wouldMatch.length) : 0
-    };
-  }
-  /**
-   * Score how well a pattern matches an incident
-   */
-  scoreMatch(pattern, incident) {
-    let score = 0;
-    const matchedCriteria = {
-      symbols: [],
-      errorKeywords: [],
-      missingSignals: []
-    };
-    const symbolScore = this.matchSymbols(
-      pattern.pattern.symbols,
-      incident.symbols,
-      matchedCriteria.symbols
-    );
-    score += Math.min(symbolScore, 50);
-    const errorScore = this.matchErrorText(
-      pattern,
-      incident,
-      matchedCriteria.errorKeywords
+    if (options.symbol) {
+      conditions.push("symbol LIKE ?");
+      params.push(`%${options.symbol}%`);
+    }
+    if (options.service) {
+      conditions.push("service = ?");
+      params.push(options.service);
+    }
+    if (options.sessionId) {
+      conditions.push("session_id = ?");
+      params.push(options.sessionId);
+    }
+    if (options.correlationId) {
+      conditions.push("correlation_id = ?");
+      params.push(options.correlationId);
+    }
+    if (options.search) {
+      conditions.push("message LIKE ?");
+      params.push(`%${options.search}%`);
+    }
+    if (options.since) {
+      conditions.push("timestamp >= ?");
+      params.push(options.since);
+    }
+    if (options.until) {
+      conditions.push("timestamp <= ?");
+      params.push(options.until);
+    }
+    const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+    const result = this.db.exec(
+      `SELECT * FROM logs ${whereClause} ORDER BY timestamp DESC LIMIT ? OFFSET ?`,
+      [...params, limit, offset]
     );
-    score += Math.min(errorScore, 25);
-    const signalScore = this.matchMissingSignals(
-      pattern,
-      incident,
-      matchedCriteria.missingSignals
+    if (result.length === 0) return [];
+    return result[0].values.map(
+      (row) => this.rowToLogEntry(result[0].columns, row)
     );
-    score += Math.min(signalScore, 25);
-    score = Math.min(score, 100);
-    return { score, matchedCriteria };
   }
-  /**
-   * Match symbols between pattern and incident
-   */
-  matchSymbols(patternSymbols, incidentSymbols, matched) {
-    let score = 0;
-    const symbolTypes = [
-      "feature",
-      "component",
-      "flow",
-      "gate",
-      "signal",
-      "state",
-      "integration"
-    ];
-    for (const type of symbolTypes) {
-      const patternValue = patternSymbols[type];
-      const incidentValue = incidentSymbols[type];
-      if (!patternValue || !incidentValue) {
-        continue;
-      }
-      if (typeof patternValue === "string") {
-        if (this.matchSingleSymbol(patternValue, incidentValue)) {
-          score += patternValue.includes("*") ? 5 : 10;
-          matched.push(type);
-        }
-      } else if (Array.isArray(patternValue)) {
-        for (const pv of patternValue) {
-          if (this.matchSingleSymbol(pv, incidentValue)) {
-            score += 7;
-            matched.push(type);
-            break;
-          }
-        }
-      }
+  getLogCount(options = {}) {
+    this.initializeSync();
+    const conditions = [];
+    const params = [];
+    if (options.level) {
+      conditions.push("level = ?");
+      params.push(options.level);
     }
-    return score;
-  }
-  /**
-   * Match a single symbol value (supports wildcards)
-   */
-  matchSingleSymbol(pattern, value) {
-    if (pattern === "*") {
-      return true;
+    if (options.symbol) {
+      conditions.push("symbol LIKE ?");
+      params.push(`%${options.symbol}%`);
     }
-    if (pattern.endsWith("*")) {
-      const prefix = pattern.slice(0, -1);
-      return value.startsWith(prefix);
+    if (options.service) {
+      conditions.push("service = ?");
+      params.push(options.service);
     }
-    if (pattern.startsWith("*")) {
-      const suffix = pattern.slice(1);
-      return value.endsWith(suffix);
+    if (options.since) {
+      conditions.push("timestamp >= ?");
+      params.push(options.since);
     }
-    if (pattern.includes("*")) {
-      const regex = new RegExp(
+    if (options.until) {
+      conditions.push("timestamp <= ?");
+      params.push(options.until);
+    }
+    const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+    const result = this.db.exec(
+      `SELECT COUNT(*) as count FROM logs ${whereClause}`,
+      params
+    );
+    if (result.length === 0 || result[0].values.length === 0) return 0;
+    return result[0].values[0][0];
+  }
+  pruneLogs(maxCount) {
+    this.initializeSync();
+    if (maxCount <= 0) return 0;
+    const currentCount = this.getLogCount();
+    if (currentCount <= maxCount) return 0;
+    const deleteCount = currentCount - maxCount;
+    this.db.run(
+      `DELETE FROM logs WHERE id IN (
+        SELECT id FROM logs ORDER BY timestamp ASC LIMIT ?
+      )`,
+      [deleteCount]
+    );
+    this.save();
+    return deleteCount;
+  }
+  rowToLogEntry(columns, row) {
+    const obj = {};
+    columns.forEach((col, i) => {
+      obj[col] = row[i];
+    });
+    return {
+      id: obj.id,
+      timestamp: obj.timestamp,
+      level: obj.level,
+      symbol: obj.symbol,
+      symbolType: obj.symbol_type || "raw",
+      message: obj.message,
+      data: obj.data_json ? JSON.parse(obj.data_json) : void 0,
+      service: obj.service,
+      sessionId: obj.session_id || void 0,
+      correlationId: obj.correlation_id || void 0,
+      durationMs: obj.duration_ms || void 0,
+      environment: obj.environment || void 0
+    };
+  }
+  // ─── Service Registry ──────────────────────────────────────────
+  registerService(reg) {
+    this.initializeSync();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    this.db.run(
+      `INSERT INTO services (name, version, pid, started_at, last_seen_at, environment, metadata_json)
+       VALUES (?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT(name) DO UPDATE SET
+         version = excluded.version,
+         pid = excluded.pid,
+         last_seen_at = excluded.last_seen_at,
+         environment = excluded.environment,
+         metadata_json = excluded.metadata_json`,
+      [
+        reg.name,
+        reg.version || null,
+        reg.pid ?? null,
+        now,
+        now,
+        reg.environment || null,
+        reg.metadata ? JSON.stringify(reg.metadata) : null
+      ]
+    );
+    this.save();
+  }
+  updateServiceLastSeen(name) {
+    this.initializeSync();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    this.db.run(
+      "UPDATE services SET last_seen_at = ? WHERE name = ?",
+      [now, name]
+    );
+    this.save();
+  }
+  getServices() {
+    this.initializeSync();
+    const result = this.db.exec(
+      "SELECT * FROM services ORDER BY last_seen_at DESC"
+    );
+    if (result.length === 0) return [];
+    return result[0].values.map((row) => {
+      const obj = {};
+      result[0].columns.forEach((col, i) => {
+        obj[col] = row[i];
+      });
+      return {
+        name: obj.name,
+        version: obj.version || void 0,
+        pid: obj.pid || void 0,
+        startedAt: obj.started_at,
+        lastSeenAt: obj.last_seen_at,
+        environment: obj.environment || void 0,
+        metadata: obj.metadata_json ? JSON.parse(obj.metadata_json) : void 0
+      };
+    });
+  }
+  // ─── App State ──────────────────────────────────────────────────
+  upsertAppState(state) {
+    this.initializeSync();
+    this.db.run(
+      `INSERT INTO app_state (service, session_id, timestamp, state_json, active_flows_json, active_gates_json)
+       VALUES (?, ?, ?, ?, ?, ?)
+       ON CONFLICT(service, session_id) DO UPDATE SET
+         timestamp = excluded.timestamp,
+         state_json = excluded.state_json,
+         active_flows_json = excluded.active_flows_json,
+         active_gates_json = excluded.active_gates_json`,
+      [
+        state.service,
+        state.sessionId,
+        state.timestamp || (/* @__PURE__ */ new Date()).toISOString(),
+        JSON.stringify(state.state),
+        state.activeFlows ? JSON.stringify(state.activeFlows) : null,
+        state.activeGates ? JSON.stringify(state.activeGates) : null
+      ]
+    );
+    this.save();
+  }
+  getAppState(service, sessionId) {
+    this.initializeSync();
+    let query = "SELECT * FROM app_state WHERE service = ?";
+    const params = [service];
+    if (sessionId) {
+      query += " AND session_id = ?";
+      params.push(sessionId);
+    }
+    query += " ORDER BY timestamp DESC";
+    const result = this.db.exec(query, params);
+    if (result.length === 0) return [];
+    return result[0].values.map((row) => this.rowToAppState(result[0].columns, row));
+  }
+  getAllAppStates() {
+    this.initializeSync();
+    const result = this.db.exec(
+      "SELECT * FROM app_state ORDER BY timestamp DESC"
+    );
+    if (result.length === 0) return [];
+    return result[0].values.map((row) => this.rowToAppState(result[0].columns, row));
+  }
+  rowToAppState(columns, row) {
+    const obj = {};
+    columns.forEach((col, i) => {
+      obj[col] = row[i];
+    });
+    return {
+      service: obj.service,
+      sessionId: obj.session_id,
+      timestamp: obj.timestamp,
+      state: JSON.parse(obj.state_json),
+      activeFlows: obj.active_flows_json ? JSON.parse(obj.active_flows_json) : void 0,
+      activeGates: obj.active_gates_json ? JSON.parse(obj.active_gates_json) : void 0
+    };
+  }
+  // ─── Metrics ───────────────────────────────────────────────────
+  insertMetric(input) {
+    this.initializeSync();
+    const id = uuidv4();
+    const timestamp = input.timestamp || (/* @__PURE__ */ new Date()).toISOString();
+    this.db.run(
+      `INSERT INTO metrics (
+        id, timestamp, name, type, value, tags_json, service, environment
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+      [
+        id,
+        timestamp,
+        input.name,
+        input.type,
+        input.value,
+        JSON.stringify(input.tags || {}),
+        input.service,
+        input.environment || null
+      ]
+    );
+    this.save();
+    return id;
+  }
+  insertMetricBatch(entries) {
+    this.initializeSync();
+    let accepted = 0;
+    const errors = [];
+    for (const input of entries) {
+      try {
+        const id = uuidv4();
+        const timestamp = input.timestamp || (/* @__PURE__ */ new Date()).toISOString();
+        this.db.run(
+          `INSERT INTO metrics (
+            id, timestamp, name, type, value, tags_json, service, environment
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
+          [
+            id,
+            timestamp,
+            input.name,
+            input.type,
+            input.value,
+            JSON.stringify(input.tags || {}),
+            input.service,
+            input.environment || null
+          ]
+        );
+        accepted++;
+      } catch (err) {
+        errors.push(err instanceof Error ? err.message : String(err));
+      }
+    }
+    this.save();
+    return { accepted, errors };
+  }
+  queryMetrics(options = {}) {
+    this.initializeSync();
+    const { limit = 100, offset = 0 } = options;
+    const conditions = [];
+    const params = [];
+    if (options.name) {
+      conditions.push("name = ?");
+      params.push(options.name);
+    }
+    if (options.type) {
+      conditions.push("type = ?");
+      params.push(options.type);
+    }
+    if (options.service) {
+      conditions.push("service = ?");
+      params.push(options.service);
+    }
+    if (options.tag) {
+      const eqIdx = options.tag.indexOf("=");
+      if (eqIdx > 0) {
+        const tagKey = options.tag.substring(0, eqIdx);
+        const tagValue = options.tag.substring(eqIdx + 1);
+        conditions.push("tags_json LIKE ?");
+        params.push(`%"${tagKey}":"${tagValue}"%`);
+      }
+    }
+    if (options.since) {
+      conditions.push("timestamp >= ?");
+      params.push(options.since);
+    }
+    if (options.until) {
+      conditions.push("timestamp <= ?");
+      params.push(options.until);
+    }
+    const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+    const result = this.db.exec(
+      `SELECT * FROM metrics ${whereClause} ORDER BY timestamp DESC LIMIT ? OFFSET ?`,
+      [...params, limit, offset]
+    );
+    if (result.length === 0) return [];
+    return result[0].values.map(
+      (row) => this.rowToMetricEntry(result[0].columns, row)
+    );
+  }
+  getMetricCount(options = {}) {
+    this.initializeSync();
+    const conditions = [];
+    const params = [];
+    if (options.name) {
+      conditions.push("name = ?");
+      params.push(options.name);
+    }
+    if (options.type) {
+      conditions.push("type = ?");
+      params.push(options.type);
+    }
+    if (options.service) {
+      conditions.push("service = ?");
+      params.push(options.service);
+    }
+    if (options.tag) {
+      const eqIdx = options.tag.indexOf("=");
+      if (eqIdx > 0) {
+        const tagKey = options.tag.substring(0, eqIdx);
+        const tagValue = options.tag.substring(eqIdx + 1);
+        conditions.push("tags_json LIKE ?");
+        params.push(`%"${tagKey}":"${tagValue}"%`);
+      }
+    }
+    if (options.since) {
+      conditions.push("timestamp >= ?");
+      params.push(options.since);
+    }
+    if (options.until) {
+      conditions.push("timestamp <= ?");
+      params.push(options.until);
+    }
+    const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+    const result = this.db.exec(
+      `SELECT COUNT(*) as count FROM metrics ${whereClause}`,
+      params
+    );
+    if (result.length === 0 || result[0].values.length === 0) return 0;
+    return result[0].values[0][0];
+  }
+  aggregateMetric(name, options) {
+    this.initializeSync();
+    const conditions = ["name = ?"];
+    const params = [name];
+    if (options?.service) {
+      conditions.push("service = ?");
+      params.push(options.service);
+    }
+    if (options?.since) {
+      conditions.push("timestamp >= ?");
+      params.push(options.since);
+    }
+    if (options?.until) {
+      conditions.push("timestamp <= ?");
+      params.push(options.until);
+    }
+    const whereClause = `WHERE ${conditions.join(" AND ")}`;
+    const result = this.db.exec(
+      `SELECT COUNT(*) as count, SUM(value) as sum, MIN(value) as min, MAX(value) as max, AVG(value) as avg
+       FROM metrics ${whereClause}`,
+      params
+    );
+    if (result.length === 0 || result[0].values.length === 0) {
+      return { name, count: 0, sum: 0, min: 0, max: 0, avg: 0 };
+    }
+    const row = result[0].values[0];
+    return {
+      name,
+      count: row[0] || 0,
+      sum: row[1] || 0,
+      min: row[2] || 0,
+      max: row[3] || 0,
+      avg: row[4] || 0
+    };
+  }
+  pruneMetrics(maxCount) {
+    this.initializeSync();
+    if (maxCount <= 0) return 0;
+    const currentCount = this.getMetricCount();
+    if (currentCount <= maxCount) return 0;
+    const deleteCount = currentCount - maxCount;
+    this.db.run(
+      `DELETE FROM metrics WHERE id IN (
+        SELECT id FROM metrics ORDER BY timestamp ASC LIMIT ?
+      )`,
+      [deleteCount]
+    );
+    this.save();
+    return deleteCount;
+  }
+  rowToMetricEntry(columns, row) {
+    const obj = {};
+    columns.forEach((col, i) => {
+      obj[col] = row[i];
+    });
+    return {
+      id: obj.id,
+      timestamp: obj.timestamp,
+      name: obj.name,
+      type: obj.type,
+      value: obj.value,
+      tags: obj.tags_json ? JSON.parse(obj.tags_json) : {},
+      service: obj.service,
+      environment: obj.environment || void 0
+    };
+  }
+  // ─── Traces ───────────────────────────────────────────────────
+  insertSpan(input) {
+    this.initializeSync();
+    const spanId = input.spanId || uuidv4();
+    const startTime = input.startTime || (/* @__PURE__ */ new Date()).toISOString();
+    this.db.run(
+      `INSERT INTO traces (
+        trace_id, span_id, parent_span_id, service, symbol, operation,
+        start_time, end_time, duration_ms, status, tags_json, log_ids_json
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+      [
+        input.traceId,
+        spanId,
+        input.parentSpanId || null,
+        input.service,
+        input.symbol,
+        input.operation,
+        startTime,
+        input.endTime || null,
+        input.durationMs ?? null,
+        input.status || "ok",
+        JSON.stringify(input.tags || {}),
+        JSON.stringify(input.logIds || [])
+      ]
+    );
+    this.save();
+    return spanId;
+  }
+  getTrace(traceId) {
+    this.initializeSync();
+    const result = this.db.exec(
+      "SELECT * FROM traces WHERE trace_id = ? ORDER BY start_time ASC",
+      [traceId]
+    );
+    if (result.length === 0 || result[0].values.length === 0) return null;
+    const spans = result[0].values.map(
+      (row) => this.rowToTraceSpan(result[0].columns, row)
+    );
+    const services = [...new Set(spans.map((s) => s.service))];
+    const startTimes = spans.map((s) => s.startTime);
+    const endTimes = spans.filter((s) => s.endTime).map((s) => s.endTime);
+    const startTime = startTimes.sort()[0];
+    const endTime = endTimes.length > 0 ? endTimes.sort().reverse()[0] : startTime;
+    const startMs = new Date(startTime).getTime();
+    const endMs = new Date(endTime).getTime();
+    const totalDurationMs = endMs - startMs;
+    return {
+      traceId,
+      spans,
+      services,
+      totalDurationMs: totalDurationMs > 0 ? totalDurationMs : 0,
+      startTime,
+      endTime
+    };
+  }
+  queryTraces(options = {}) {
+    this.initializeSync();
+    const conditions = [];
+    const params = [];
+    if (options.service) {
+      conditions.push("service = ?");
+      params.push(options.service);
+    }
+    if (options.symbol) {
+      conditions.push("symbol = ?");
+      params.push(options.symbol);
+    }
+    if (options.since) {
+      conditions.push("start_time >= ?");
+      params.push(options.since);
+    }
+    const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+    const traceLimit = Math.min(options.limit || 20, 20);
+    const result = this.db.exec(
+      `SELECT DISTINCT trace_id FROM traces ${whereClause} ORDER BY start_time DESC LIMIT ?`,
+      [...params, traceLimit]
+    );
+    if (result.length === 0) return [];
+    const traces = [];
+    for (const row of result[0].values) {
+      const traceId = row[0];
+      const trace = this.getTrace(traceId);
+      if (trace) {
+        traces.push(trace);
+      }
+    }
+    return traces;
+  }
+  rowToTraceSpan(columns, row) {
+    const obj = {};
+    columns.forEach((col, i) => {
+      obj[col] = row[i];
+    });
+    return {
+      traceId: obj.trace_id,
+      spanId: obj.span_id,
+      parentSpanId: obj.parent_span_id || void 0,
+      service: obj.service,
+      symbol: obj.symbol,
+      operation: obj.operation,
+      startTime: obj.start_time,
+      endTime: obj.end_time || void 0,
+      durationMs: obj.duration_ms || void 0,
+      status: obj.status || "ok",
+      tags: obj.tags_json ? JSON.parse(obj.tags_json) : {},
+      logs: obj.log_ids_json ? JSON.parse(obj.log_ids_json) : []
+    };
+  }
+  // ─── Schema Registry ─────────────────────────────────────────────
+  registerSchema(schema) {
+    this.initializeSync();
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    this.db.run(
+      `INSERT INTO schemas (
+        id, version, name, description, scope_json, event_types_json,
+        causality_json, visualization_json, tags_json, registered_at, updated_at
+      ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+       ON CONFLICT(id) DO UPDATE SET
+         version = excluded.version,
+         name = excluded.name,
+         description = excluded.description,
+         scope_json = excluded.scope_json,
+         event_types_json = excluded.event_types_json,
+         causality_json = excluded.causality_json,
+         visualization_json = excluded.visualization_json,
+         tags_json = excluded.tags_json,
+         updated_at = excluded.updated_at`,
+      [
+        schema.id,
+        schema.version,
+        schema.name,
+        schema.description || null,
+        JSON.stringify(schema.scope),
+        JSON.stringify(schema.eventTypes),
+        schema.causality ? JSON.stringify(schema.causality) : null,
+        schema.visualization ? JSON.stringify(schema.visualization) : null,
+        JSON.stringify(schema.tags || []),
+        now,
+        now
+      ]
+    );
+    this.save();
+    return {
+      id: schema.id,
+      version: schema.version,
+      name: schema.name,
+      description: schema.description,
+      scope: schema.scope,
+      eventTypes: schema.eventTypes,
+      causality: schema.causality,
+      visualization: schema.visualization,
+      tags: schema.tags || [],
+      registeredAt: now,
+      updatedAt: now
+    };
+  }
+  getSchema(id) {
+    this.initializeSync();
+    const result = this.db.exec("SELECT * FROM schemas WHERE id = ?", [id]);
+    if (result.length === 0 || result[0].values.length === 0) return null;
+    return this.rowToSchema(result[0].columns, result[0].values[0]);
+  }
+  listSchemas() {
+    this.initializeSync();
+    const result = this.db.exec("SELECT * FROM schemas ORDER BY name ASC");
+    if (result.length === 0) return [];
+    return result[0].values.map(
+      (row) => this.rowToSchema(result[0].columns, row)
+    );
+  }
+  rowToSchema(columns, row) {
+    const obj = {};
+    columns.forEach((col, i) => {
+      obj[col] = row[i];
+    });
+    return {
+      id: obj.id,
+      version: obj.version,
+      name: obj.name,
+      description: obj.description || void 0,
+      scope: JSON.parse(obj.scope_json),
+      eventTypes: JSON.parse(obj.event_types_json),
+      causality: obj.causality_json ? JSON.parse(obj.causality_json) : void 0,
+      visualization: obj.visualization_json ? JSON.parse(obj.visualization_json) : void 0,
+      tags: JSON.parse(obj.tags_json || "[]"),
+      registeredAt: obj.registered_at,
+      updatedAt: obj.updated_at
+    };
+  }
+  // ─── Generic Events ────────────────────────────────────────────
+  insertEventBatch(schemaId, service, inputs) {
+    this.initializeSync();
+    const schema = this.getSchema(schemaId);
+    const typeMap = /* @__PURE__ */ new Map();
+    if (schema) {
+      for (const et of schema.eventTypes) {
+        typeMap.set(et.type, {
+          category: et.category,
+          severity: et.severity || "info"
+        });
+      }
+    }
+    let accepted = 0;
+    const errors = [];
+    for (const input of inputs) {
+      try {
+        const id = input.id || uuidv4();
+        const timestamp = input.timestamp || (/* @__PURE__ */ new Date()).toISOString();
+        const resolved = typeMap.get(input.type);
+        const category = resolved?.category || "unknown";
+        const severity = input.severity || resolved?.severity || "info";
+        const scopeValue = input.scopeValue != null ? String(input.scopeValue) : null;
+        const scopeOrdinal = typeof input.scopeValue === "number" ? input.scopeValue : null;
+        this.db.run(
+          `INSERT INTO events (
+            id, schema_id, event_type, category, timestamp, scope_value,
+            scope_ordinal, session_id, service, data_json, severity,
+            parent_event_id, depth
+          ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+          [
+            id,
+            schemaId,
+            input.type,
+            category,
+            timestamp,
+            scopeValue,
+            scopeOrdinal,
+            input.sessionId || null,
+            service,
+            input.data ? JSON.stringify(input.data) : null,
+            severity,
+            input.parentEventId || null,
+            input.depth ?? 0
+          ]
+        );
+        accepted++;
+      } catch (err) {
+        errors.push(err instanceof Error ? err.message : String(err));
+      }
+    }
+    this.save();
+    return { accepted, errors };
+  }
+  queryEvents(options = {}) {
+    this.initializeSync();
+    const { limit = 100, offset = 0 } = options;
+    const conditions = [];
+    const params = [];
+    if (options.schemaId) {
+      conditions.push("schema_id = ?");
+      params.push(options.schemaId);
+    }
+    if (options.eventType) {
+      conditions.push("event_type = ?");
+      params.push(options.eventType);
+    }
+    if (options.category) {
+      conditions.push("category = ?");
+      params.push(options.category);
+    }
+    if (options.service) {
+      conditions.push("service = ?");
+      params.push(options.service);
+    }
+    if (options.sessionId) {
+      conditions.push("session_id = ?");
+      params.push(options.sessionId);
+    }
+    if (options.scopeValue) {
+      conditions.push("scope_value = ?");
+      params.push(options.scopeValue);
+    }
+    if (options.scopeFrom) {
+      conditions.push("scope_value >= ?");
+      params.push(options.scopeFrom);
+    }
+    if (options.scopeTo) {
+      conditions.push("scope_value <= ?");
+      params.push(options.scopeTo);
+    }
+    if (options.severity) {
+      conditions.push("severity = ?");
+      params.push(options.severity);
+    }
+    if (options.since) {
+      conditions.push("timestamp >= ?");
+      params.push(options.since);
+    }
+    if (options.until) {
+      conditions.push("timestamp <= ?");
+      params.push(options.until);
+    }
+    if (options.search) {
+      conditions.push("data_json LIKE ?");
+      params.push(`%${options.search}%`);
+    }
+    const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+    const result = this.db.exec(
+      `SELECT * FROM events ${whereClause} ORDER BY timestamp DESC LIMIT ? OFFSET ?`,
+      [...params, limit, offset]
+    );
+    if (result.length === 0) return [];
+    return result[0].values.map(
+      (row) => this.rowToGenericEvent(result[0].columns, row)
+    );
+  }
+  queryEventsByScope(schemaId, scopeValue) {
+    this.initializeSync();
+    const result = this.db.exec(
+      `SELECT * FROM events
+       WHERE schema_id = ? AND scope_value = ?
+       ORDER BY timestamp ASC`,
+      [schemaId, scopeValue]
+    );
+    if (result.length === 0) return [];
+    return result[0].values.map(
+      (row) => this.rowToGenericEvent(result[0].columns, row)
+    );
+  }
+  getEventScopes(schemaId, options = {}) {
+    this.initializeSync();
+    const { limit = 100, offset = 0 } = options;
+    const conditions = ["schema_id = ?"];
+    const params = [schemaId];
+    if (options.sessionId) {
+      conditions.push("session_id = ?");
+      params.push(options.sessionId);
+    }
+    const whereClause = `WHERE ${conditions.join(" AND ")}`;
+    const result = this.db.exec(
+      `SELECT
+        scope_value,
+        MIN(scope_ordinal) as scope_ordinal,
+        COUNT(*) as event_count,
+        MIN(timestamp) as first_timestamp,
+        MAX(timestamp) as last_timestamp
+       FROM events
+       ${whereClause}
+       AND scope_value IS NOT NULL
+       GROUP BY scope_value
+       ORDER BY MIN(COALESCE(scope_ordinal, 0)) DESC, MIN(timestamp) DESC
+       LIMIT ? OFFSET ?`,
+      [...params, limit, offset]
+    );
+    if (result.length === 0) return [];
+    const scopes = [];
+    for (const row of result[0].values) {
+      const scopeValue = row[0];
+      const scopeOrdinal = row[1] != null ? row[1] : void 0;
+      const eventCount = row[2];
+      const firstTimestamp = row[3];
+      const lastTimestamp = row[4];
+      const catResult = this.db.exec(
+        `SELECT category, COUNT(*) as count FROM events
+         WHERE schema_id = ? AND scope_value = ?
+         GROUP BY category`,
+        [schemaId, scopeValue]
+      );
+      const categories = {};
+      if (catResult.length > 0) {
+        for (const catRow of catResult[0].values) {
+          categories[catRow[0]] = catRow[1];
+        }
+      }
+      scopes.push({
+        scopeValue,
+        scopeOrdinal,
+        eventCount,
+        categories,
+        firstTimestamp,
+        lastTimestamp
+      });
+    }
+    return scopes;
+  }
+  getEventCount(options = {}) {
+    this.initializeSync();
+    const conditions = [];
+    const params = [];
+    if (options.schemaId) {
+      conditions.push("schema_id = ?");
+      params.push(options.schemaId);
+    }
+    if (options.eventType) {
+      conditions.push("event_type = ?");
+      params.push(options.eventType);
+    }
+    if (options.service) {
+      conditions.push("service = ?");
+      params.push(options.service);
+    }
+    if (options.since) {
+      conditions.push("timestamp >= ?");
+      params.push(options.since);
+    }
+    if (options.until) {
+      conditions.push("timestamp <= ?");
+      params.push(options.until);
+    }
+    const whereClause = conditions.length > 0 ? `WHERE ${conditions.join(" AND ")}` : "";
+    const result = this.db.exec(
+      `SELECT COUNT(*) as count FROM events ${whereClause}`,
+      params
+    );
+    if (result.length === 0 || result[0].values.length === 0) return 0;
+    return result[0].values[0][0];
+  }
+  pruneEvents(maxCount) {
+    this.initializeSync();
+    if (maxCount <= 0) return 0;
+    const currentCount = this.getEventCount();
+    if (currentCount <= maxCount) return 0;
+    const deleteCount = currentCount - maxCount;
+    this.db.run(
+      `DELETE FROM events WHERE id IN (
+        SELECT id FROM events ORDER BY timestamp ASC LIMIT ?
+      )`,
+      [deleteCount]
+    );
+    this.save();
+    return deleteCount;
+  }
+  rowToGenericEvent(columns, row) {
+    const obj = {};
+    columns.forEach((col, i) => {
+      obj[col] = row[i];
+    });
+    return {
+      id: obj.id,
+      schemaId: obj.schema_id,
+      eventType: obj.event_type,
+      category: obj.category,
+      timestamp: obj.timestamp,
+      scopeValue: obj.scope_value || void 0,
+      scopeOrdinal: obj.scope_ordinal != null ? obj.scope_ordinal : void 0,
+      sessionId: obj.session_id || void 0,
+      service: obj.service,
+      data: obj.data_json ? JSON.parse(obj.data_json) : void 0,
+      severity: obj.severity || "info",
+      parentEventId: obj.parent_event_id || void 0,
+      depth: obj.depth || 0
+    };
+  }
+  close() {
+    if (this.db) {
+      this.save();
+      this.db.close();
+      this.db = null;
+    }
+  }
+};
+
+// src/matcher.ts
+var DEFAULT_CONFIG = {
+  minScore: 30,
+  maxResults: 5,
+  boostConfidence: true
+};
+var PatternMatcher = class {
+  constructor(storage) {
+    this.storage = storage;
+  }
+  /**
+   * Match an incident against all patterns and return ranked results
+   */
+  match(incident, config = {}) {
+    const { minScore, maxResults, boostConfidence } = {
+      ...DEFAULT_CONFIG,
+      ...config
+    };
+    const patterns = this.storage.getAllPatterns({ includePrivate: true });
+    const matches = [];
+    for (const pattern of patterns) {
+      if (!this.matchEnvironment(pattern, incident)) {
+        continue;
+      }
+      const { score, matchedCriteria } = this.scoreMatch(pattern, incident);
+      if (score >= minScore) {
+        let confidence = score;
+        if (boostConfidence) {
+          const confidenceFactor = pattern.confidence.score / 100;
+          confidence = score * (0.5 + 0.5 * confidenceFactor);
+        }
+        matches.push({
+          pattern,
+          score,
+          matchedCriteria,
+          confidence: Math.round(confidence)
+        });
+        this.storage.updatePatternConfidence(pattern.id, "matched");
+      }
+    }
+    return matches.sort((a, b) => b.confidence - a.confidence).slice(0, maxResults);
+  }
+  /**
+   * Test a pattern against historical incidents
+   */
+  testPattern(pattern, limit = 100) {
+    const incidents = this.storage.getRecentIncidents({ limit });
+    const wouldMatch = [];
+    let totalScore = 0;
+    for (const incident of incidents) {
+      if (!this.matchEnvironment(pattern, incident)) {
+        continue;
+      }
+      const { score } = this.scoreMatch(pattern, incident);
+      if (score >= 30) {
+        wouldMatch.push(incident);
+        totalScore += score;
+      }
+    }
+    return {
+      wouldMatch,
+      matchCount: wouldMatch.length,
+      avgScore: wouldMatch.length > 0 ? Math.round(totalScore / wouldMatch.length) : 0
+    };
+  }
+  /**
+   * Score how well a pattern matches an incident
+   */
+  scoreMatch(pattern, incident) {
+    let score = 0;
+    const matchedCriteria = {
+      symbols: [],
+      errorKeywords: [],
+      missingSignals: []
+    };
+    const symbolScore = this.matchSymbols(
+      pattern.pattern.symbols,
+      incident.symbols,
+      matchedCriteria.symbols
+    );
+    score += Math.min(symbolScore, 50);
+    const errorScore = this.matchErrorText(
+      pattern,
+      incident,
+      matchedCriteria.errorKeywords
+    );
+    score += Math.min(errorScore, 25);
+    const signalScore = this.matchMissingSignals(
+      pattern,
+      incident,
+      matchedCriteria.missingSignals
+    );
+    score += Math.min(signalScore, 25);
+    score = Math.min(score, 100);
+    return { score, matchedCriteria };
+  }
+  /**
+   * Match symbols between pattern and incident
+   */
+  matchSymbols(patternSymbols, incidentSymbols, matched) {
+    let score = 0;
+    const symbolTypes = [
+      "feature",
+      "component",
+      "flow",
+      "gate",
+      "signal",
+      "state",
+      "integration"
+    ];
+    for (const type of symbolTypes) {
+      const patternValue = patternSymbols[type];
+      const incidentValue = incidentSymbols[type];
+      if (!patternValue || !incidentValue) {
+        continue;
+      }
+      if (typeof patternValue === "string") {
+        if (this.matchSingleSymbol(patternValue, incidentValue)) {
+          score += patternValue.includes("*") ? 5 : 10;
+          matched.push(type);
+        }
+      } else if (Array.isArray(patternValue)) {
+        for (const pv of patternValue) {
+          if (this.matchSingleSymbol(pv, incidentValue)) {
+            score += 7;
+            matched.push(type);
+            break;
+          }
+        }
+      }
+    }
+    return score;
+  }
+  /**
+   * Match a single symbol value (supports wildcards)
+   */
+  matchSingleSymbol(pattern, value) {
+    if (pattern === "*") {
+      return true;
+    }
+    if (pattern.endsWith("*")) {
+      const prefix = pattern.slice(0, -1);
+      return value.startsWith(prefix);
+    }
+    if (pattern.startsWith("*")) {
+      const suffix = pattern.slice(1);
+      return value.endsWith(suffix);
+    }
+    if (pattern.includes("*")) {
+      const regex = new RegExp(
         "^" + pattern.replace(/\*/g, ".*") + "$"
       );
       return regex.test(value);
@@ -1902,10 +3072,12 @@ function loadAllSeedPatterns() {
 
 // src/server/index.ts
 import express from "express";
-import * as path5 from "path";
-import * as fs4 from "fs";
+import * as http from "http";
+import * as path6 from "path";
+import * as fs5 from "fs";
 import { fileURLToPath as fileURLToPath2 } from "url";
 import chalk3 from "chalk";
+import { WebSocketServer, WebSocket } from "ws";
 
 // src/server/routes/symbols.ts
 import { Router } from "express";
@@ -2002,7 +3174,7 @@ async function loadParadigmConfig(projectDir) {
 }
 async function loadWithPremiseCore(projectDir) {
   try {
-    const { aggregateFromDirectory } = await import("./dist-BPWLYV4U.js");
+    const { aggregateFromDirectory } = await import("./dist-TYG2XME3.js");
     log.flow("load-symbols").info("Using premise-core aggregator", { path: projectDir });
     const result = await aggregateFromDirectory(projectDir);
     const counts = {};
@@ -2591,66 +3763,916 @@ function createIncidentsRouter(_projectDir) {
       });
       res.json({ success: true });
     } catch (error) {
-      console.error("Failed to resolve incident:", error);
-      res.status(500).json({ error: "Failed to resolve incident" });
+      console.error("Failed to resolve incident:", error);
+      res.status(500).json({ error: "Failed to resolve incident" });
+    }
+  });
+  return router;
+}
+
+// src/server/routes/patterns.ts
+import { Router as Router5 } from "express";
+function createPatternsRouter(_projectDir) {
+  const router = Router5();
+  const storage = new SentinelStorage();
+  router.get("/", async (req, res) => {
+    try {
+      const source = req.query.source;
+      const symbol = req.query.symbol;
+      const minConfidence = parseInt(req.query.minConfidence) || void 0;
+      const options = {};
+      if (source && ["manual", "suggested", "imported", "community"].includes(source)) {
+        options.source = source;
+      }
+      if (symbol) options.symbol = symbol;
+      if (minConfidence) options.minConfidence = minConfidence;
+      const patterns = storage.getAllPatterns(options);
+      const summaries = patterns.map((pattern) => ({
+        id: pattern.id,
+        name: pattern.name,
+        description: pattern.description,
+        confidence: {
+          score: pattern.confidence.score,
+          timesMatched: pattern.confidence.timesMatched,
+          timesResolved: pattern.confidence.timesResolved
+        },
+        tags: pattern.tags
+      }));
+      res.json({ patterns: summaries });
+    } catch (error) {
+      console.error("Failed to load patterns:", error);
+      res.status(500).json({ error: "Failed to load patterns" });
+    }
+  });
+  router.get("/:id", async (req, res) => {
+    try {
+      const pattern = storage.getPattern(req.params.id);
+      if (!pattern) {
+        res.status(404).json({ error: "Pattern not found" });
+        return;
+      }
+      res.json({ pattern });
+    } catch (error) {
+      console.error("Failed to load pattern:", error);
+      res.status(500).json({ error: "Failed to load pattern" });
+    }
+  });
+  return router;
+}
+
+// src/server/routes/logs.ts
+import { Router as Router6 } from "express";
+import { v4 as uuidv42 } from "uuid";
+function inferSymbolType(symbol) {
+  if (symbol.startsWith("#")) return "component";
+  if (symbol.startsWith("^")) return "gate";
+  if (symbol.startsWith("!")) return "signal";
+  if (symbol.startsWith("$")) return "flow";
+  if (symbol.startsWith("~")) return "aspect";
+  return "raw";
+}
+function validateSymbol(symbol, index) {
+  const entry = index.find((e) => e.symbol === symbol);
+  if (entry) return { known: true };
+  const symbolName = symbol.replace(/^[#^!$~]/, "");
+  let bestMatch;
+  let bestScore = 0;
+  for (const e of index) {
+    const eName = e.symbol.replace(/^[#^!$~]/, "");
+    let shared = 0;
+    for (let i = 0; i < Math.min(symbolName.length, eName.length); i++) {
+      if (symbolName[i] === eName[i]) shared++;
+      else break;
+    }
+    const score = shared / Math.max(symbolName.length, eName.length);
+    if (score > bestScore && score > 0.5) {
+      bestScore = score;
+      bestMatch = e.symbol;
+    }
+  }
+  return { known: false, suggestion: bestMatch };
+}
+function autoPromoteToIncident(entry, storage) {
+  try {
+    const symbolType = inferSymbolType(entry.symbol);
+    const symbols = {};
+    if (symbolType === "component") symbols.component = entry.symbol;
+    else if (symbolType === "gate") symbols.gate = entry.symbol;
+    else if (symbolType === "signal") symbols.signal = entry.symbol;
+    else if (symbolType === "flow") symbols.flow = entry.symbol;
+    else symbols.component = entry.symbol;
+    storage.recordIncident({
+      error: {
+        message: entry.message,
+        type: "LogError"
+      },
+      symbols,
+      environment: entry.environment || "unknown",
+      service: entry.service
+    });
+  } catch {
+  }
+}
+var insertsSincePrune = 0;
+function createLogsRouter(options) {
+  const router = Router6();
+  const { storage, serverConfig, onLogReceived, symbolIndex } = options;
+  router.post("/", async (req, res) => {
+    try {
+      const body = req.body;
+      let entries;
+      if (Array.isArray(body.entries)) {
+        entries = body.entries;
+      } else if (body.level && body.symbol && body.message && body.service) {
+        entries = [body];
+      } else {
+        res.status(400).json({ error: "Expected {entries: [...]} or a single log entry with level, symbol, message, service" });
+        return;
+      }
+      if (entries.length > serverConfig.maxBatchSize) {
+        res.status(413).json({
+          error: `Batch too large: ${entries.length} entries, max ${serverConfig.maxBatchSize}`
+        });
+        return;
+      }
+      for (let i = 0; i < entries.length; i++) {
+        const e = entries[i];
+        if (!e.level || !e.symbol || !e.message || !e.service) {
+          res.status(400).json({
+            error: `Entry ${i}: missing required fields (level, symbol, message, service)`
+          });
+          return;
+        }
+        if (!["debug", "info", "warn", "error"].includes(e.level)) {
+          res.status(400).json({
+            error: `Entry ${i}: invalid level "${e.level}", must be debug|info|warn|error`
+          });
+          return;
+        }
+      }
+      const result = storage.insertLogBatch(entries);
+      for (const input of entries) {
+        const entry = {
+          id: input.id || uuidv42(),
+          timestamp: input.timestamp || (/* @__PURE__ */ new Date()).toISOString(),
+          level: input.level,
+          symbol: input.symbol,
+          symbolType: input.symbolType || inferSymbolType(input.symbol),
+          message: input.message,
+          data: input.data,
+          service: input.service,
+          sessionId: input.sessionId,
+          correlationId: input.correlationId,
+          durationMs: input.durationMs,
+          environment: input.environment
+        };
+        let validation;
+        if (symbolIndex) {
+          validation = validateSymbol(entry.symbol, symbolIndex);
+        }
+        if (entry.level === "error") {
+          autoPromoteToIncident(entry, storage);
+        }
+        if (onLogReceived) {
+          onLogReceived(entry, validation);
+        }
+      }
+      insertsSincePrune += result.accepted;
+      if (serverConfig.maxLogs > 0 && insertsSincePrune >= serverConfig.pruneIntervalInserts) {
+        insertsSincePrune = 0;
+        storage.pruneLogs(serverConfig.maxLogs);
+      }
+      res.json({ accepted: result.accepted, errors: result.errors.length > 0 ? result.errors : void 0 });
+    } catch (error) {
+      res.status(500).json({ error: "Failed to insert logs" });
+    }
+  });
+  router.get("/", async (req, res) => {
+    try {
+      const options2 = {
+        level: req.query.level,
+        symbol: req.query.symbol,
+        service: req.query.service,
+        sessionId: req.query.sessionId,
+        correlationId: req.query.correlationId,
+        search: req.query.search,
+        since: req.query.since,
+        until: req.query.until,
+        limit: req.query.limit ? parseInt(req.query.limit) : 100,
+        offset: req.query.offset ? parseInt(req.query.offset) : 0
+      };
+      const logs = storage.queryLogs(options2);
+      const total = storage.getLogCount(options2);
+      res.json({ count: logs.length, total, logs });
+    } catch (error) {
+      res.status(500).json({ error: "Failed to query logs" });
+    }
+  });
+  return router;
+}
+
+// src/server/routes/services.ts
+import { Router as Router7 } from "express";
+function createServicesRouter(options) {
+  const router = Router7();
+  const { storage } = options;
+  router.post("/", async (req, res) => {
+    try {
+      const { name, version, pid, environment, metadata } = req.body;
+      if (!name) {
+        res.status(400).json({ error: "Missing required field: name" });
+        return;
+      }
+      storage.registerService({ name, version, pid, environment, metadata });
+      res.json({ success: true, service: name });
+    } catch (error) {
+      res.status(500).json({ error: "Failed to register service" });
+    }
+  });
+  router.get("/", async (_req, res) => {
+    try {
+      const services = storage.getServices();
+      res.json({ count: services.length, services });
+    } catch (error) {
+      res.status(500).json({ error: "Failed to list services" });
+    }
+  });
+  return router;
+}
+function createStateRouter(options) {
+  const router = Router7();
+  const { storage } = options;
+  router.post("/", async (req, res) => {
+    try {
+      const { service, sessionId, state, activeFlows, activeGates } = req.body;
+      if (!service || !sessionId || !state) {
+        res.status(400).json({ error: "Missing required fields: service, sessionId, state" });
+        return;
+      }
+      storage.upsertAppState({
+        service,
+        sessionId,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        state,
+        activeFlows,
+        activeGates
+      });
+      storage.updateServiceLastSeen(service);
+      res.json({ success: true });
+    } catch (error) {
+      res.status(500).json({ error: "Failed to update state" });
+    }
+  });
+  router.get("/", async (_req, res) => {
+    try {
+      const states = storage.getAllAppStates();
+      res.json({ count: states.length, states });
+    } catch (error) {
+      res.status(500).json({ error: "Failed to get states" });
+    }
+  });
+  router.get("/:service", async (req, res) => {
+    try {
+      const states = storage.getAppState(req.params.service);
+      res.json({ count: states.length, states });
+    } catch (error) {
+      res.status(500).json({ error: "Failed to get service state" });
+    }
+  });
+  return router;
+}
+
+// src/server/routes/metrics.ts
+import { Router as Router8 } from "express";
+var VALID_METRIC_TYPES = ["counter", "gauge", "histogram"];
+function createMetricsRouter(options) {
+  const router = Router8();
+  const { storage, serverConfig } = options;
+  router.post("/", (req, res) => {
+    try {
+      const body = req.body;
+      let entries;
+      if (Array.isArray(body.entries)) {
+        entries = body.entries;
+      } else if (body.name && body.type && body.value !== void 0 && body.service) {
+        entries = [body];
+      } else {
+        res.status(400).json({
+          error: "Expected {entries: [...]} or a single metric with name, type, value, service"
+        });
+        return;
+      }
+      if (entries.length > serverConfig.maxBatchSize) {
+        res.status(413).json({
+          error: `Batch too large: ${entries.length} entries, max ${serverConfig.maxBatchSize}`
+        });
+        return;
+      }
+      for (let i = 0; i < entries.length; i++) {
+        const e = entries[i];
+        if (!e.name || !e.type || e.value === void 0 || !e.service) {
+          res.status(400).json({
+            error: `Entry ${i}: missing required fields (name, type, value, service)`
+          });
+          return;
+        }
+        if (!VALID_METRIC_TYPES.includes(e.type)) {
+          res.status(400).json({
+            error: `Entry ${i}: invalid type "${e.type}", must be counter|gauge|histogram`
+          });
+          return;
+        }
+      }
+      const result = storage.insertMetricBatch(entries);
+      res.json({
+        accepted: result.accepted,
+        errors: result.errors.length > 0 ? result.errors : void 0
+      });
+    } catch {
+      res.status(500).json({ error: "Failed to insert metrics" });
+    }
+  });
+  router.get("/", (req, res) => {
+    try {
+      const options2 = {
+        name: req.query.name,
+        type: req.query.type,
+        service: req.query.service,
+        tag: req.query.tag,
+        since: req.query.since,
+        until: req.query.until,
+        limit: req.query.limit ? parseInt(req.query.limit) : 100,
+        offset: req.query.offset ? parseInt(req.query.offset) : 0
+      };
+      const metrics = storage.queryMetrics(options2);
+      const total = storage.getMetricCount(options2);
+      res.json({ count: metrics.length, total, metrics });
+    } catch {
+      res.status(500).json({ error: "Failed to query metrics" });
+    }
+  });
+  router.get("/aggregate/:name", (req, res) => {
+    try {
+      const aggregation = storage.aggregateMetric(req.params.name, {
+        service: req.query.service,
+        since: req.query.since,
+        until: req.query.until
+      });
+      res.json(aggregation);
+    } catch {
+      res.status(500).json({ error: "Failed to aggregate metric" });
+    }
+  });
+  return router;
+}
+
+// src/server/routes/traces.ts
+import { Router as Router9 } from "express";
+function createTracesRouter(options) {
+  const router = Router9();
+  const { storage } = options;
+  router.post("/", (req, res) => {
+    try {
+      const body = req.body;
+      if (!body.traceId || !body.service || !body.symbol || !body.operation) {
+        res.status(400).json({
+          error: "Missing required fields: traceId, service, symbol, operation"
+        });
+        return;
+      }
+      const spanId = storage.insertSpan(body);
+      res.json({ spanId, traceId: body.traceId });
+    } catch {
+      res.status(500).json({ error: "Failed to insert trace span" });
+    }
+  });
+  router.get("/", (req, res) => {
+    try {
+      const traces = storage.queryTraces({
+        service: req.query.service,
+        symbol: req.query.symbol,
+        since: req.query.since,
+        limit: req.query.limit ? parseInt(req.query.limit) : 20
+      });
+      res.json({ count: traces.length, traces });
+    } catch {
+      res.status(500).json({ error: "Failed to query traces" });
+    }
+  });
+  router.get("/:traceId", (req, res) => {
+    try {
+      const trace = storage.getTrace(req.params.traceId);
+      if (!trace) {
+        res.status(404).json({ error: "Trace not found" });
+        return;
+      }
+      res.json(trace);
+    } catch {
+      res.status(500).json({ error: "Failed to get trace" });
+    }
+  });
+  return router;
+}
+
+// src/server/routes/schemas.ts
+import { Router as Router10 } from "express";
+function createSchemasRouter(options) {
+  const router = Router10();
+  const { storage } = options;
+  router.post("/", (req, res) => {
+    try {
+      const body = req.body;
+      if (!body.id || !body.version || !body.name || !body.scope || !body.eventTypes) {
+        res.status(400).json({
+          error: "Missing required fields: id, version, name, scope, eventTypes"
+        });
+        return;
+      }
+      if (!body.scope.field || !body.scope.type || !body.scope.label || !body.scope.ordering) {
+        res.status(400).json({
+          error: "Invalid scope: requires field, type, label, ordering"
+        });
+        return;
+      }
+      if (!Array.isArray(body.eventTypes) || body.eventTypes.length === 0) {
+        res.status(400).json({
+          error: "eventTypes must be a non-empty array"
+        });
+        return;
+      }
+      for (let i = 0; i < body.eventTypes.length; i++) {
+        const et = body.eventTypes[i];
+        if (!et.type || !et.category) {
+          res.status(400).json({
+            error: `eventTypes[${i}]: missing required fields (type, category)`
+          });
+          return;
+        }
+      }
+      const schema = storage.registerSchema(body);
+      res.status(201).json(schema);
+    } catch (error) {
+      res.status(500).json({ error: "Failed to register schema" });
+    }
+  });
+  router.get("/", (_req, res) => {
+    try {
+      const schemas = storage.listSchemas();
+      res.json({ count: schemas.length, schemas });
+    } catch (error) {
+      res.status(500).json({ error: "Failed to list schemas" });
+    }
+  });
+  router.get("/:id", (req, res) => {
+    try {
+      const schema = storage.getSchema(req.params.id);
+      if (!schema) {
+        res.status(404).json({ error: "Schema not found" });
+        return;
+      }
+      res.json(schema);
+    } catch (error) {
+      res.status(500).json({ error: "Failed to get schema" });
+    }
+  });
+  return router;
+}
+
+// src/server/routes/events.ts
+import { Router as Router11 } from "express";
+function createEventsRouter(options) {
+  const router = Router11();
+  const { storage, serverConfig, onEventReceived } = options;
+  let insertsSincePrune2 = 0;
+  router.post("/", (req, res) => {
+    try {
+      const body = req.body;
+      if (!body.schemaId || !body.service || !Array.isArray(body.events)) {
+        res.status(400).json({
+          error: "Expected { schemaId, service, events: [...] }"
+        });
+        return;
+      }
+      const { schemaId, service, events } = body;
+      const schema = storage.getSchema(schemaId);
+      if (!schema) {
+        res.status(404).json({
+          error: `Schema "${schemaId}" not found. Register it first via POST /api/schemas.`
+        });
+        return;
+      }
+      if (events.length > serverConfig.maxBatchSize) {
+        res.status(413).json({
+          error: `Batch too large: ${events.length} events, max ${serverConfig.maxBatchSize}`
+        });
+        return;
+      }
+      for (let i = 0; i < events.length; i++) {
+        const e = events[i];
+        if (!e.type) {
+          res.status(400).json({
+            error: `events[${i}]: missing required field "type"`
+          });
+          return;
+        }
+      }
+      const result = storage.insertEventBatch(schemaId, service, events);
+      if (onEventReceived) {
+        const typeMap = /* @__PURE__ */ new Map();
+        for (const et of schema.eventTypes) {
+          typeMap.set(et.type, et.category);
+        }
+        for (const input of events) {
+          const evt = {
+            id: input.id || "",
+            schemaId,
+            eventType: input.type,
+            category: typeMap.get(input.type) || "unknown",
+            timestamp: input.timestamp || (/* @__PURE__ */ new Date()).toISOString(),
+            scopeValue: input.scopeValue != null ? String(input.scopeValue) : void 0,
+            sessionId: input.sessionId,
+            service,
+            data: input.data,
+            severity: input.severity || "info",
+            parentEventId: input.parentEventId,
+            depth: input.depth
+          };
+          onEventReceived(evt);
+        }
+      }
+      insertsSincePrune2 += result.accepted;
+      if (serverConfig.maxLogs > 0 && insertsSincePrune2 >= serverConfig.pruneIntervalInserts) {
+        insertsSincePrune2 = 0;
+        storage.pruneEvents(serverConfig.maxLogs);
+      }
+      res.json({
+        accepted: result.accepted,
+        errors: result.errors.length > 0 ? result.errors : void 0
+      });
+    } catch (error) {
+      res.status(500).json({ error: "Failed to ingest events" });
+    }
+  });
+  router.get("/", (req, res) => {
+    try {
+      const query = {
+        schemaId: req.query.schemaId,
+        eventType: req.query.eventType,
+        category: req.query.category,
+        service: req.query.service,
+        sessionId: req.query.sessionId,
+        scopeValue: req.query.scopeValue,
+        scopeFrom: req.query.scopeFrom,
+        scopeTo: req.query.scopeTo,
+        severity: req.query.severity,
+        since: req.query.since,
+        until: req.query.until,
+        search: req.query.search,
+        limit: req.query.limit ? parseInt(req.query.limit) : 100,
+        offset: req.query.offset ? parseInt(req.query.offset) : 0
+      };
+      const events = storage.queryEvents(query);
+      const total = storage.getEventCount(query);
+      res.json({ count: events.length, total, events });
+    } catch (error) {
+      res.status(500).json({ error: "Failed to query events" });
     }
   });
-  return router;
-}
-
-// src/server/routes/patterns.ts
-import { Router as Router5 } from "express";
-function createPatternsRouter(_projectDir) {
-  const router = Router5();
-  const storage = new SentinelStorage();
-  router.get("/", async (req, res) => {
+  router.get("/scopes", (req, res) => {
     try {
-      const source = req.query.source;
-      const symbol = req.query.symbol;
-      const minConfidence = parseInt(req.query.minConfidence) || void 0;
-      const options = {};
-      if (source && ["manual", "suggested", "imported", "community"].includes(source)) {
-        options.source = source;
+      const schemaId = req.query.schemaId;
+      if (!schemaId) {
+        res.status(400).json({ error: "schemaId query parameter is required" });
+        return;
       }
-      if (symbol) options.symbol = symbol;
-      if (minConfidence) options.minConfidence = minConfidence;
-      const patterns = storage.getAllPatterns(options);
-      const summaries = patterns.map((pattern) => ({
-        id: pattern.id,
-        name: pattern.name,
-        description: pattern.description,
-        confidence: {
-          score: pattern.confidence.score,
-          timesMatched: pattern.confidence.timesMatched,
-          timesResolved: pattern.confidence.timesResolved
-        },
-        tags: pattern.tags
-      }));
-      res.json({ patterns: summaries });
+      const scopes = storage.getEventScopes(schemaId, {
+        limit: req.query.limit ? parseInt(req.query.limit) : 100,
+        offset: req.query.offset ? parseInt(req.query.offset) : 0,
+        sessionId: req.query.sessionId
+      });
+      res.json({ count: scopes.length, scopes });
     } catch (error) {
-      console.error("Failed to load patterns:", error);
-      res.status(500).json({ error: "Failed to load patterns" });
+      res.status(500).json({ error: "Failed to query scopes" });
     }
   });
-  router.get("/:id", async (req, res) => {
+  router.get("/scope/:value", (req, res) => {
     try {
-      const pattern = storage.getPattern(req.params.id);
-      if (!pattern) {
-        res.status(404).json({ error: "Pattern not found" });
+      const schemaId = req.query.schemaId;
+      if (!schemaId) {
+        res.status(400).json({ error: "schemaId query parameter is required" });
         return;
       }
-      res.json({ pattern });
+      const events = storage.queryEventsByScope(schemaId, req.params.value);
+      res.json({ count: events.length, events });
     } catch (error) {
-      console.error("Failed to load pattern:", error);
-      res.status(500).json({ error: "Failed to load pattern" });
+      res.status(500).json({ error: "Failed to query scope events" });
     }
   });
   return router;
 }
 
+// src/server/middleware/auth.ts
+function createAuthMiddleware(config) {
+  return function authMiddleware(requiredPermission) {
+    return (req, res, next) => {
+      if (!config.enabled) {
+        next();
+        return;
+      }
+      const authHeader = req.headers.authorization;
+      if (!authHeader) {
+        res.status(401).json({ error: "Authentication required. Provide Authorization: Bearer <token>" });
+        return;
+      }
+      const match = authHeader.match(/^Bearer\s+(.+)$/i);
+      if (!match) {
+        res.status(401).json({ error: "Invalid authorization format. Use: Bearer <token>" });
+        return;
+      }
+      const tokenValue = match[1];
+      const tokenEntry = config.tokens.find((t) => t.token === tokenValue);
+      if (!tokenEntry) {
+        res.status(401).json({ error: "Invalid token" });
+        return;
+      }
+      if (tokenEntry.expiresAt && new Date(tokenEntry.expiresAt) < /* @__PURE__ */ new Date()) {
+        res.status(401).json({ error: "Token expired" });
+        return;
+      }
+      const permissionLevel = { read: 1, write: 2, admin: 3 };
+      const hasPermission = tokenEntry.permissions.some(
+        (p) => permissionLevel[p] >= permissionLevel[requiredPermission]
+      );
+      if (!hasPermission) {
+        res.status(403).json({ error: `Insufficient permissions. Required: ${requiredPermission}` });
+        return;
+      }
+      req.authToken = tokenEntry;
+      next();
+    };
+  };
+}
+
+// src/server/middleware/rate-limit.ts
+var serviceWindows = /* @__PURE__ */ new Map();
+var globalWindow = { count: 0, windowStart: Date.now() };
+var WINDOW_MS = 6e4;
+function getOrResetWindow(entry) {
+  const now = Date.now();
+  if (now - entry.windowStart > WINDOW_MS) {
+    entry.count = 0;
+    entry.windowStart = now;
+  }
+  return entry;
+}
+function createRateLimiter(config) {
+  return (req, res, next) => {
+    if (!config.enabled) {
+      next();
+      return;
+    }
+    const service = req.body?.service || req.body?.entries?.[0]?.service || req.query.service || "_unknown";
+    const rule = config.perService[service] || config.global;
+    if (rule.samplingRate < 1 && Math.random() > rule.samplingRate) {
+      res.status(200).json({ accepted: 0, sampled: true, message: "Request dropped by sampling" });
+      return;
+    }
+    const gw = getOrResetWindow(globalWindow);
+    if (gw.count >= config.global.maxRequestsPerMinute) {
+      res.status(429).json({
+        error: "Global rate limit exceeded",
+        retryAfterMs: WINDOW_MS - (Date.now() - gw.windowStart)
+      });
+      return;
+    }
+    if (!serviceWindows.has(service)) {
+      serviceWindows.set(service, { count: 0, windowStart: Date.now() });
+    }
+    const sw = getOrResetWindow(serviceWindows.get(service));
+    if (sw.count >= rule.maxRequestsPerMinute) {
+      res.status(429).json({
+        error: `Rate limit exceeded for service: ${service}`,
+        retryAfterMs: WINDOW_MS - (Date.now() - sw.windowStart)
+      });
+      return;
+    }
+    const batchSize = req.body?.entries?.length || 1;
+    if (batchSize > rule.maxEntriesPerBatch) {
+      res.status(413).json({
+        error: `Batch too large: ${batchSize} entries, max ${rule.maxEntriesPerBatch} for service ${service}`
+      });
+      return;
+    }
+    gw.count++;
+    sw.count++;
+    next();
+  };
+}
+
+// src/config.ts
+import * as fs4 from "fs";
+import * as path5 from "path";
+
+// src/types.ts
+var DEFAULT_AUTH_CONFIG = {
+  enabled: false,
+  tokens: []
+};
+var DEFAULT_RATE_LIMIT_CONFIG = {
+  enabled: false,
+  global: {
+    maxRequestsPerMinute: 600,
+    maxEntriesPerBatch: 500,
+    samplingRate: 1
+  },
+  perService: {}
+};
+var DEFAULT_SERVER_CONFIG = {
+  port: 3838,
+  maxLogs: 1e4,
+  maxBatchSize: 500,
+  wsMaxSubscribers: 256,
+  pruneIntervalInserts: 100,
+  logRetentionDays: 0,
+  auth: DEFAULT_AUTH_CONFIG,
+  rateLimit: DEFAULT_RATE_LIMIT_CONFIG
+};
+
+// src/config.ts
+var CONFIG_FILES = [".sentinel.yaml", ".sentinel.yml"];
+function loadConfig(projectDir) {
+  for (const filename of CONFIG_FILES) {
+    const filePath = path5.join(projectDir, filename);
+    if (fs4.existsSync(filePath)) {
+      const content = fs4.readFileSync(filePath, "utf-8");
+      return parseSimpleYaml(content);
+    }
+  }
+  return null;
+}
+function writeConfig(projectDir, config) {
+  const filePath = path5.join(projectDir, ".sentinel.yaml");
+  const content = serializeSimpleYaml(config);
+  fs4.writeFileSync(filePath, content, "utf-8");
+}
+function parseSimpleYaml(content) {
+  const config = { version: "1.0", project: "" };
+  const lines = content.split("\n");
+  let currentSection = null;
+  let currentSubSection = null;
+  for (const line of lines) {
+    const trimmed = line.trimEnd();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const topMatch = trimmed.match(/^(\w+):\s*(.+)$/);
+    if (topMatch) {
+      const [, key, value] = topMatch;
+      if (key === "version") config.version = value.replace(/['"]/g, "");
+      else if (key === "project") config.project = value.replace(/['"]/g, "");
+      else if (key === "environment") config.environment = value.replace(/['"]/g, "");
+      currentSection = null;
+      currentSubSection = null;
+      continue;
+    }
+    const sectionMatch = trimmed.match(/^(\w+):$/);
+    if (sectionMatch) {
+      currentSection = sectionMatch[1];
+      currentSubSection = null;
+      if (currentSection === "symbols" && !config.symbols) {
+        config.symbols = {};
+      }
+      if (currentSection === "routes" && !config.routes) {
+        config.routes = {};
+      }
+      if (currentSection === "scrub" && !config.scrub) {
+        config.scrub = {};
+      }
+      if (currentSection === "server" && !config.server) {
+        config.server = {};
+      }
+      continue;
+    }
+    const subMatch = trimmed.match(/^\s{2}(\w+):$/);
+    if (subMatch && currentSection) {
+      currentSubSection = subMatch[1];
+      if (currentSection === "symbols" && config.symbols) {
+        config.symbols[currentSubSection] = [];
+      }
+      if (currentSection === "scrub" && config.scrub) {
+        config.scrub[currentSubSection] = [];
+      }
+      continue;
+    }
+    const listMatch = trimmed.match(/^\s+-\s+(.+)$/);
+    if (listMatch && currentSection && currentSubSection) {
+      const value = listMatch[1].replace(/['"]/g, "");
+      if (currentSection === "symbols" && config.symbols) {
+        const arr = config.symbols[currentSubSection];
+        if (Array.isArray(arr)) arr.push(value);
+      }
+      if (currentSection === "scrub" && config.scrub) {
+        const arr = config.scrub[currentSubSection];
+        if (Array.isArray(arr)) arr.push(value);
+      }
+      continue;
+    }
+    const routeMatch = trimmed.match(/^\s+(['"]?\/[^'"]+['"]?):\s+['"]?([^'"]+)['"]?$/);
+    if (routeMatch && currentSection === "routes" && config.routes) {
+      const route = routeMatch[1].replace(/['"]/g, "");
+      config.routes[route] = routeMatch[2];
+      continue;
+    }
+    const serverKvMatch = trimmed.match(/^\s+(\w+):\s+(\d+)$/);
+    if (serverKvMatch && currentSection === "server" && config.server) {
+      const key = serverKvMatch[1];
+      const value = parseInt(serverKvMatch[2], 10);
+      if (key in { port: 1, maxLogs: 1, maxBatchSize: 1, wsMaxSubscribers: 1, pruneIntervalInserts: 1, logRetentionDays: 1 }) {
+        config.server[key] = value;
+      }
+      continue;
+    }
+  }
+  return config;
+}
+function serializeSimpleYaml(config) {
+  const lines = [];
+  lines.push(`# Sentinel Configuration`);
+  lines.push(`# Auto-generated \u2014 edit freely`);
+  lines.push("");
+  lines.push(`version: "${config.version}"`);
+  lines.push(`project: "${config.project}"`);
+  if (config.environment) {
+    lines.push(`environment: "${config.environment}"`);
+  }
+  if (config.symbols) {
+    lines.push("");
+    lines.push("symbols:");
+    for (const [key, values] of Object.entries(config.symbols)) {
+      if (values && values.length > 0) {
+        lines.push(`  ${key}:`);
+        for (const v of values) {
+          lines.push(`    - ${v}`);
+        }
+      }
+    }
+  }
+  if (config.routes && Object.keys(config.routes).length > 0) {
+    lines.push("");
+    lines.push("routes:");
+    for (const [route, symbol] of Object.entries(config.routes)) {
+      lines.push(`  "${route}": ${symbol}`);
+    }
+  }
+  if (config.scrub) {
+    lines.push("");
+    lines.push("scrub:");
+    if (config.scrub.headers?.length) {
+      lines.push("  headers:");
+      for (const h of config.scrub.headers) {
+        lines.push(`    - ${h}`);
+      }
+    }
+    if (config.scrub.fields?.length) {
+      lines.push("  fields:");
+      for (const f of config.scrub.fields) {
+        lines.push(`    - ${f}`);
+      }
+    }
+  }
+  if (config.server && Object.keys(config.server).length > 0) {
+    lines.push("");
+    lines.push("server:");
+    for (const [key, value] of Object.entries(config.server)) {
+      if (value !== void 0) {
+        lines.push(`  ${key}: ${value}`);
+      }
+    }
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+function loadServerConfig(projectDir) {
+  const config = { ...DEFAULT_SERVER_CONFIG };
+  const yamlConfig = projectDir ? loadConfig(projectDir) : null;
+  const globalDir = path5.join(process.env.HOME || "~", ".paradigm");
+  const globalConfig = loadConfig(globalDir);
+  for (const src of [globalConfig, yamlConfig]) {
+    if (src?.server) {
+      if (src.server.port !== void 0) config.port = src.server.port;
+      if (src.server.maxLogs !== void 0) config.maxLogs = src.server.maxLogs;
+      if (src.server.maxBatchSize !== void 0) config.maxBatchSize = src.server.maxBatchSize;
+      if (src.server.wsMaxSubscribers !== void 0) config.wsMaxSubscribers = src.server.wsMaxSubscribers;
+      if (src.server.pruneIntervalInserts !== void 0) config.pruneIntervalInserts = src.server.pruneIntervalInserts;
+      if (src.server.logRetentionDays !== void 0) config.logRetentionDays = src.server.logRetentionDays;
+    }
+  }
+  if (process.env.SENTINEL_PORT) config.port = parseInt(process.env.SENTINEL_PORT, 10);
+  if (process.env.SENTINEL_MAX_LOGS) config.maxLogs = parseInt(process.env.SENTINEL_MAX_LOGS, 10);
+  return config;
+}
+
 // src/server/index.ts
 var __filename2 = fileURLToPath2(import.meta.url);
-var __dirname2 = path5.dirname(__filename2);
+var __dirname2 = path6.dirname(__filename2);
 var log3 = {
   component(name) {
     const symbol = chalk3.magenta(`#${name}`);
@@ -2676,11 +4698,20 @@ var log3 = {
 };
 function createApp(options) {
   const app = express();
-  app.use(express.json());
+  app.use(express.json({ limit: "5mb" }));
   app.use((_req, res, next) => {
-    res.header("Access-Control-Allow-Origin", "*");
+    const corsOrigin = options.serverConfig?.cors?.origin;
+    const origin = Array.isArray(corsOrigin) ? corsOrigin.join(", ") : corsOrigin ?? "*";
+    res.header("Access-Control-Allow-Origin", origin);
     res.header("Access-Control-Allow-Methods", "GET, POST, PUT, DELETE, OPTIONS");
-    res.header("Access-Control-Allow-Headers", "Content-Type");
+    res.header("Access-Control-Allow-Headers", "Content-Type, Authorization");
+    if (options.serverConfig?.cors?.credentials) {
+      res.header("Access-Control-Allow-Credentials", "true");
+    }
+    if (_req.method === "OPTIONS") {
+      res.sendStatus(204);
+      return;
+    }
     next();
   });
   app.use("/api/symbols", createSymbolsRouter(options.projectDir));
@@ -2688,27 +4719,162 @@ function createApp(options) {
   app.use("/api/commits", createCommitsRouter(options.projectDir));
   app.use("/api/incidents", createIncidentsRouter(options.projectDir));
   app.use("/api/patterns", createPatternsRouter(options.projectDir));
+  if (options.storage && options.serverConfig) {
+    const config = options.serverConfig;
+    const auth = createAuthMiddleware(config.auth);
+    const rateLimiter = createRateLimiter(config.rateLimit);
+    app.use("/api/logs", rateLimiter, auth("write"), createLogsRouter({
+      storage: options.storage,
+      serverConfig: config,
+      onLogReceived: options.onLogReceived,
+      symbolIndex: options.symbolIndex
+    }));
+    app.use("/api/services", rateLimiter, auth("write"), createServicesRouter({ storage: options.storage }));
+    app.use("/api/state", rateLimiter, auth("write"), createStateRouter({ storage: options.storage }));
+    app.use("/api/metrics", rateLimiter, auth("write"), createMetricsRouter({
+      storage: options.storage,
+      serverConfig: config
+    }));
+    app.use("/api/traces", rateLimiter, auth("write"), createTracesRouter({
+      storage: options.storage
+    }));
+    app.use("/api/schemas", rateLimiter, auth("write"), createSchemasRouter({
+      storage: options.storage
+    }));
+    app.use("/api/events", rateLimiter, auth("write"), createEventsRouter({
+      storage: options.storage,
+      serverConfig: config,
+      onEventReceived: options.onEventReceived
+    }));
+  }
   app.get("/api/health", (_req, res) => {
     res.json({ status: "ok", timestamp: (/* @__PURE__ */ new Date()).toISOString() });
   });
-  const uiDistPath = path5.join(__dirname2, "..", "..", "ui", "dist");
-  if (fs4.existsSync(uiDistPath)) {
+  const uiDistPath = path6.join(__dirname2, "..", "..", "ui", "dist");
+  if (fs5.existsSync(uiDistPath)) {
     app.use(express.static(uiDistPath));
     app.get("{*path}", (req, res) => {
       if (!req.path.startsWith("/api")) {
-        res.sendFile(path5.join(uiDistPath, "index.html"));
+        res.sendFile(path6.join(uiDistPath, "index.html"));
       }
     });
   }
   return app;
 }
 async function startServer(options) {
-  const app = createApp(options);
+  const serverConfig = loadServerConfig(options.projectDir);
+  if (options.logPruneLimit !== void 0) {
+    serverConfig.maxLogs = options.logPruneLimit;
+  }
+  const storage = new SentinelStorage(options.dbPath);
+  await storage.ensureReady();
+  let symbolIndex = [];
+  try {
+    symbolIndex = await loadSymbolIndex(options.projectDir);
+  } catch {
+    log3.component("sentinel-server").warn("Could not load symbol index for validation");
+  }
+  const wsClients = /* @__PURE__ */ new Set();
+  function broadcast(message) {
+    const data = JSON.stringify(message);
+    for (const client of wsClients) {
+      if (client.readyState === WebSocket.OPEN) {
+        client.send(data);
+      }
+    }
+  }
+  function onLogReceived(entry, validation) {
+    const message = { type: "log", entry };
+    if (validation && !validation.known) {
+      message.validation = validation;
+    }
+    broadcast(message);
+    if (entry.symbolType === "signal" || entry.symbolType === "gate" || entry.symbolType === "flow") {
+      broadcast({
+        type: "flow_event",
+        flowId: entry.symbolType === "flow" ? entry.symbol : void 0,
+        nodeSymbol: entry.symbol,
+        event: entry.symbolType,
+        timestamp: entry.timestamp,
+        service: entry.service
+      });
+    }
+  }
+  function onEventReceived(event) {
+    broadcast({ type: "event", event });
+  }
+  const app = createApp({
+    ...options,
+    storage,
+    serverConfig,
+    symbolIndex,
+    onLogReceived,
+    onEventReceived
+  });
   log3.component("sentinel-server").info("Starting server", { port: options.port });
   log3.component("sentinel-server").info("Project directory", { path: options.projectDir });
   return new Promise((resolve, reject) => {
-    const server = app.listen(options.port, () => {
+    const httpServer = http.createServer(app);
+    const wss = new WebSocketServer({ server: httpServer });
+    wss.on("connection", (ws) => {
+      if (wsClients.size >= serverConfig.wsMaxSubscribers) {
+        ws.close(1013, "Max subscribers reached");
+        return;
+      }
+      wsClients.add(ws);
+      log3.component("sentinel-ws").info("Client connected", { total: wsClients.size });
+      ws.on("message", (raw) => {
+        try {
+          const msg = JSON.parse(raw.toString());
+          if (msg.method === "ping") {
+            ws.send(JSON.stringify({
+              jsonrpc: "2.0",
+              result: { pong: true, timestamp: (/* @__PURE__ */ new Date()).toISOString() },
+              id: msg.id
+            }));
+          } else if (msg.method === "subscribe") {
+            ws.send(JSON.stringify({
+              jsonrpc: "2.0",
+              result: { subscribed: true },
+              id: msg.id
+            }));
+          } else if (msg.method === "query_logs") {
+            const logs = storage.queryLogs(msg.params || {});
+            ws.send(JSON.stringify({
+              jsonrpc: "2.0",
+              result: { logs },
+              id: msg.id
+            }));
+          } else if (msg.method === "query_events") {
+            const events = storage.queryEvents(msg.params || {});
+            ws.send(JSON.stringify({
+              jsonrpc: "2.0",
+              result: { events },
+              id: msg.id
+            }));
+          } else if (msg.method === "query_scopes") {
+            const { schemaId, ...rest } = msg.params || {};
+            const scopes = schemaId ? storage.getEventScopes(schemaId, rest) : [];
+            ws.send(JSON.stringify({
+              jsonrpc: "2.0",
+              result: { scopes },
+              id: msg.id
+            }));
+          }
+        } catch {
+        }
+      });
+      ws.on("close", () => {
+        wsClients.delete(ws);
+        log3.component("sentinel-ws").info("Client disconnected", { total: wsClients.size });
+      });
+      ws.on("error", () => {
+        wsClients.delete(ws);
+      });
+    });
+    httpServer.listen(options.port, () => {
       log3.component("sentinel-server").success("Server running", { url: `http://localhost:${options.port}` });
+      log3.component("sentinel-ws").success("WebSocket ready", { url: `ws://localhost:${options.port}` });
       if (options.open) {
         import("open").then((openModule) => {
           openModule.default(`http://localhost:${options.port}`);
@@ -2719,7 +4885,7 @@ async function startServer(options) {
       }
       resolve();
     });
-    server.on("error", (err) => {
+    httpServer.on("error", (err) => {
       if (err.code === "EADDRINUSE") {
         log3.component("sentinel-server").error("Port already in use", { port: options.port });
       } else {
@@ -2730,63 +4896,6 @@ async function startServer(options) {
   });
 }
 
-// src/config.ts
-import * as fs5 from "fs";
-import * as path6 from "path";
-function writeConfig(projectDir, config) {
-  const filePath = path6.join(projectDir, ".sentinel.yaml");
-  const content = serializeSimpleYaml(config);
-  fs5.writeFileSync(filePath, content, "utf-8");
-}
-function serializeSimpleYaml(config) {
-  const lines = [];
-  lines.push(`# Sentinel Configuration`);
-  lines.push(`# Auto-generated \u2014 edit freely`);
-  lines.push("");
-  lines.push(`version: "${config.version}"`);
-  lines.push(`project: "${config.project}"`);
-  if (config.environment) {
-    lines.push(`environment: "${config.environment}"`);
-  }
-  if (config.symbols) {
-    lines.push("");
-    lines.push("symbols:");
-    for (const [key, values] of Object.entries(config.symbols)) {
-      if (values && values.length > 0) {
-        lines.push(`  ${key}:`);
-        for (const v of values) {
-          lines.push(`    - ${v}`);
-        }
-      }
-    }
-  }
-  if (config.routes && Object.keys(config.routes).length > 0) {
-    lines.push("");
-    lines.push("routes:");
-    for (const [route, symbol] of Object.entries(config.routes)) {
-      lines.push(`  "${route}": ${symbol}`);
-    }
-  }
-  if (config.scrub) {
-    lines.push("");
-    lines.push("scrub:");
-    if (config.scrub.headers?.length) {
-      lines.push("  headers:");
-      for (const h of config.scrub.headers) {
-        lines.push(`    - ${h}`);
-      }
-    }
-    if (config.scrub.fields?.length) {
-      lines.push("  fields:");
-      for (const f of config.scrub.fields) {
-        lines.push(`    - ${f}`);
-      }
-    }
-  }
-  lines.push("");
-  return lines.join("\n");
-}
-
 // src/detector.ts
 import * as fs6 from "fs";
 import * as path7 from "path";