@autter/otlp-ingester 1.6.1 → 1.7.0

package/README.md

@@ -31,6 +31,16 @@ works with its default exporter settings.
 | --- | --- | --- | --- |
 | `server` (default) | `autter_rt_…` (secret) | all endpoints | 300 req/min |
 | `client` | `autter_rtc_…` (publishable, safe in frontend bundles) | `/v1/browser` only | origin allow-list, 120 req/min |
+| `upload` (1.7.0+) | `autter_rtu_…` (secret, for CI) | `/v1/sourcemaps` and `/v1/sourcemaps/check` only | 300 req/min |
+
+An upload key gets `403 {"error":"upload_key_not_allowed","detail":"autter_rtu_ keys can only upload source maps …"}`
+on every other route, so a CI secret that leaks can upload source maps for
+one repository and nothing else. A static entry without `scope` is an upload
+key when its key starts with `autter_rtu_`, else a server key; an entry (or a
+validator answer) with any other `scope` is ignored rather than treated as a
+server key. Ingesters before 1.7.0 treat every scope but `client` as
+`server`, so a validator must not answer `"scope": "upload"` to them: from
+1.7.0 every validator request carries `x-autter-ingester-version`.
 
 `/v1/browser` answers CORS preflights permissively; real enforcement (key +
 origin allow-list) happens on the POST. Cross-origin browsers send
@@ -41,12 +51,14 @@ route parses as JSON.
 AUTTER_INGEST_KEYS='[
   {"key":"autter_rt_…","orgId":"org1","repositoryId":"repo1"},
   {"key":"autter_rtc_…","orgId":"org1","repositoryId":"repo1",
-   "scope":"client","allowedOrigins":["https://app.example.com"]}
+   "scope":"client","allowedOrigins":["https://app.example.com"]},
+  {"key":"autter_rtu_…","orgId":"org1","repositoryId":"repo1","scope":"upload"}
 ]'
 ```
 
 The validator webhook may return the same extra fields:
-`{ orgId, repositoryId, scope?, allowedOrigins? }`.
+`{ orgId, repositoryId, scope?, allowedOrigins? }`, with `scope` one of
+`server`, `client`, `upload`.
 
 ### Version compatibility
 

package/dist/auth.d.ts

@@ -1,5 +1,5 @@
 import type { Request } from "express";
-import type { IngesterConfig } from "./config.js";
+import { type IngesterConfig } from "./config.js";
 import type { IngestContext } from "./types.js";
 export declare class KeyResolver {
     private readonly config;

package/dist/auth.js

@@ -1,3 +1,6 @@
+import { INGESTER_VERSION_HEADER } from "./compat.js";
+import { defaultScopeFor, isIngestKeyScope } from "./config.js";
+import { ingesterVersion } from "./sdk-versions.js";
 const VALIDATOR_CACHE_TTL_MS = 60_000;
 export class KeyResolver {
     config;
@@ -6,10 +9,13 @@ export class KeyResolver {
     constructor(config) {
         this.config = config;
         for (const entry of config.ingestKeys) {
+            const scope = entry.scope ?? defaultScopeFor(entry.key);
+            if (!isIngestKeyScope(scope))
+                continue;
             this.staticKeys.set(entry.key, {
                 orgId: entry.orgId,
                 repositoryId: entry.repositoryId,
-                scope: entry.scope ?? "server",
+                scope,
                 allowedOrigins: entry.allowedOrigins ?? [],
             });
         }
@@ -44,6 +50,11 @@ export class KeyResolver {
                 method: "POST",
                 headers: {
                     "content-type": "application/json",
+                    // Lets the validator tell which scopes this ingester enforces:
+                    // before 1.7.0 any scope but "client" meant a server key, so an
+                    // upload key must not be answered as "upload" to an ingester
+                    // that doesn't send this header (or sends an older version).
+                    [INGESTER_VERSION_HEADER]: ingesterVersion(),
                     ...(this.config.keyValidatorToken
                         ? { authorization: `Bearer ${this.config.keyValidatorToken}` }
                         : {}),
@@ -53,11 +64,12 @@ export class KeyResolver {
             });
             if (response.ok) {
                 const body = (await response.json());
-                if (body.orgId && body.repositoryId) {
+                const scope = body.scope === undefined || body.scope === null ? defaultScopeFor(key) : body.scope;
+                if (body.orgId && body.repositoryId && isIngestKeyScope(scope)) {
                     ctx = {
                         orgId: body.orgId,
                         repositoryId: body.repositoryId,
-                        scope: body.scope ?? "server",
+                        scope,
                         allowedOrigins: body.allowedOrigins ?? [],
                     };
                 }

package/dist/compat-manifest.json

@@ -118,6 +118,22 @@
             "ingester": "1.6.0",
             "migrations": [],
             "sdks": { "@autter/runtime-browser": "1.6.0", "@autter/runtime-next": "1.6.0", "@autter/runtime-node": "1.6.0" }
+        },
+        {
+            "id": "sourcemap_upload_keys",
+            "title": "Upload-only keys for source maps (autter_rtu_)",
+            "ingester": "1.7.0",
+            "migrations": [],
+            "route": "/v1/sourcemaps",
+            "sdks": {}
+        },
+        {
+            "id": "source_map_verify",
+            "title": "Source map check by debug id (autter-runtime sourcemaps verify)",
+            "ingester": "1.7.0",
+            "migrations": ["0017-source-maps-debug-id"],
+            "route": "/v1/sourcemaps/check",
+            "sdks": {}
         }
     ]
 }

package/dist/config.d.ts

@@ -1,9 +1,26 @@
+import type { IngestKeyScope } from "./types.js";
+export declare const INGEST_KEY_SCOPES: readonly IngestKeyScope[];
+/** Prefix of upload-only keys (`autter_rtu_…`): source map uploads from CI. */
+export declare const UPLOAD_KEY_PREFIX = "autter_rtu_";
+export declare function isIngestKeyScope(value: unknown): value is IngestKeyScope;
+/**
+ * The scope of a key whose static entry or validator answer names none:
+ * "upload" for an `autter_rtu_…` key (its prefix promises no more than
+ * that), else "server" as before 1.7.0.
+ */
+export declare function defaultScopeFor(key: string): IngestKeyScope;
 export interface StaticIngestKey {
     key: string;
     orgId: string;
     repositoryId: string;
-    /** "server" (default) = secret backend key; "client" = publishable browser key. */
-    scope?: "client" | "server";
+    /**
+     * "server" = secret backend key, every route; "client" = publishable
+     * browser key, `/v1/browser` only; "upload" = CI key, `/v1/sourcemaps`
+     * and `/v1/sourcemaps/check` only. Default: "upload" for an
+     * `autter_rtu_…` key, else "server". An entry with any other value is
+     * ignored (never treated as a server key).
+     */
+    scope?: IngestKeyScope;
     /** client keys: exact origins allowed to send (e.g. https://app.example.com). */
     allowedOrigins?: string[];
 }
@@ -61,4 +78,8 @@ export interface IngesterConfig {
      */
     sourceMapCacheMb?: number;
 }
+/** Parse AUTTER_INGEST_KEYS. Entries without a string key, orgId and
+ * repositoryId, or with an unknown scope, are dropped (a typo in `scope`
+ * must not turn a restricted key into a server key). */
+export declare function parseIngestKeys(raw: string | undefined): StaticIngestKey[];
 export declare function loadConfig(): IngesterConfig;

package/dist/config.js

@@ -1,3 +1,17 @@
+export const INGEST_KEY_SCOPES = ["server", "client", "upload"];
+/** Prefix of upload-only keys (`autter_rtu_…`): source map uploads from CI. */
+export const UPLOAD_KEY_PREFIX = "autter_rtu_";
+export function isIngestKeyScope(value) {
+    return typeof value === "string" && INGEST_KEY_SCOPES.includes(value);
+}
+/**
+ * The scope of a key whose static entry or validator answer names none:
+ * "upload" for an `autter_rtu_…` key (its prefix promises no more than
+ * that), else "server" as before 1.7.0.
+ */
+export function defaultScopeFor(key) {
+    return key.startsWith(UPLOAD_KEY_PREFIX) ? "upload" : "server";
+}
 function intEnv(name, fallback) {
     const raw = process.env[name];
     if (!raw)
@@ -19,22 +33,33 @@ function patternListEnv(name) {
         new RegExp(source);
     return parsed;
 }
-function parseIngestKeys(raw) {
+/** Parse AUTTER_INGEST_KEYS. Entries without a string key, orgId and
+ * repositoryId, or with an unknown scope, are dropped (a typo in `scope`
+ * must not turn a restricted key into a server key). */
+export function parseIngestKeys(raw) {
     if (!raw)
         return [];
+    let parsed;
     try {
-        const parsed = JSON.parse(raw);
-        if (!Array.isArray(parsed))
-            return [];
-        return parsed.filter((entry) => entry &&
-            typeof entry.key === "string" &&
-            typeof entry.orgId === "string" &&
-            typeof entry.repositoryId === "string");
+        parsed = JSON.parse(raw);
     }
     catch {
         console.error("AUTTER_INGEST_KEYS is not valid JSON — ignoring");
         return [];
     }
+    if (!Array.isArray(parsed))
+        return [];
+    const keys = [];
+    parsed.forEach((entry, index) => {
+        if (!entry || typeof entry.key !== "string" || typeof entry.orgId !== "string" || typeof entry.repositoryId !== "string")
+            return;
+        if (entry.scope !== undefined && !isIngestKeyScope(entry.scope)) {
+            console.error(`AUTTER_INGEST_KEYS[${index}] has scope ${JSON.stringify(entry.scope)}; expected one of ${INGEST_KEY_SCOPES.join(", ")} — ignoring this key`);
+            return;
+        }
+        keys.push({ ...entry, scope: entry.scope ?? defaultScopeFor(entry.key) });
+    });
+    return keys;
 }
 export function loadConfig() {
     const config = {

package/dist/normalize-browser.d.ts

@@ -52,15 +52,15 @@ export declare const browserPayloadSchema: z.ZodObject<{
          */
         traceId: z.ZodCatch<z.ZodOptional<z.ZodString>>;
     }, "strip", z.ZodTypeAny, {
+        type: "request_failure" | "timing" | "outcome" | "csp_violation" | "message" | "exception" | "unhandled_rejection" | "session_start" | "track_event";
         message: string;
-        type: "message" | "exception" | "request_failure" | "timing" | "outcome" | "csp_violation" | "unhandled_rejection" | "session_start" | "track_event";
         timestamp: string;
+        breadcrumbs?: unknown[] | undefined;
+        route?: string | undefined;
         severity?: "info" | "warning" | "error" | "fatal" | undefined;
         errorType?: string | undefined;
         stack?: string | undefined;
-        route?: string | undefined;
         traceId?: string | undefined;
-        breadcrumbs?: unknown[] | undefined;
         debugIds?: Record<string, unknown> | undefined;
         durationMs?: number | undefined;
         filename?: string | undefined;
@@ -71,15 +71,15 @@ export declare const browserPayloadSchema: z.ZodObject<{
         context?: Record<string, unknown> | undefined;
         fingerprint?: string | string[] | undefined;
     }, {
-        type: "message" | "exception" | "request_failure" | "timing" | "outcome" | "csp_violation" | "unhandled_rejection" | "session_start" | "track_event";
+        type: "request_failure" | "timing" | "outcome" | "csp_violation" | "message" | "exception" | "unhandled_rejection" | "session_start" | "track_event";
         timestamp: string;
+        breadcrumbs?: unknown;
+        route?: string | undefined;
         message?: string | undefined;
         severity?: "info" | "warning" | "error" | "fatal" | undefined;
         errorType?: string | undefined;
         stack?: string | undefined;
-        route?: string | undefined;
         traceId?: unknown;
-        breadcrumbs?: unknown;
         debugIds?: unknown;
         durationMs?: number | undefined;
         filename?: string | undefined;
@@ -91,19 +91,19 @@ export declare const browserPayloadSchema: z.ZodObject<{
         fingerprint?: unknown;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
+    version: 1;
     service: string;
     environment: string;
-    version: 1;
     events: {
+        type: "request_failure" | "timing" | "outcome" | "csp_violation" | "message" | "exception" | "unhandled_rejection" | "session_start" | "track_event";
         message: string;
-        type: "message" | "exception" | "request_failure" | "timing" | "outcome" | "csp_violation" | "unhandled_rejection" | "session_start" | "track_event";
         timestamp: string;
+        breadcrumbs?: unknown[] | undefined;
+        route?: string | undefined;
         severity?: "info" | "warning" | "error" | "fatal" | undefined;
         errorType?: string | undefined;
         stack?: string | undefined;
-        route?: string | undefined;
         traceId?: string | undefined;
-        breadcrumbs?: unknown[] | undefined;
         debugIds?: Record<string, unknown> | undefined;
         durationMs?: number | undefined;
         filename?: string | undefined;
@@ -118,19 +118,19 @@ export declare const browserPayloadSchema: z.ZodObject<{
     sessionId?: string | undefined;
     sdk?: string | undefined;
 }, {
+    version: 1;
     service: string;
     environment: string;
-    version: 1;
     events: {
-        type: "message" | "exception" | "request_failure" | "timing" | "outcome" | "csp_violation" | "unhandled_rejection" | "session_start" | "track_event";
+        type: "request_failure" | "timing" | "outcome" | "csp_violation" | "message" | "exception" | "unhandled_rejection" | "session_start" | "track_event";
         timestamp: string;
+        breadcrumbs?: unknown;
+        route?: string | undefined;
         message?: string | undefined;
         severity?: "info" | "warning" | "error" | "fatal" | undefined;
         errorType?: string | undefined;
         stack?: string | undefined;
-        route?: string | undefined;
         traceId?: unknown;
-        breadcrumbs?: unknown;
         debugIds?: unknown;
         durationMs?: number | undefined;
         filename?: string | undefined;

package/dist/normalize-otlp.d.ts

@@ -78,7 +78,13 @@ export interface OtlpMetricsRequest {
     }>;
 }
 export interface NormalizedTraces {
+    /** One per thrown error: duplicate recordings across a trace's spans are
+     * merged and redundant status-only occurrences dropped (trace-dedupe.ts). */
     occurrences: RuntimeOccurrenceInput[];
+    /** Each occurrence's position among every signal the batch recorded,
+     * before deduplication: the batch index its deterministic id is derived
+     * from, so a merge or a drop never shifts another occurrence's id. */
+    occurrenceBatchIndexes: number[];
     spans: RuntimeSpanRow[];
     metricPoints: RuntimeMetricPoint[];
     llmCalls: RuntimeLlmCall[];

package/dist/normalize-otlp.js

@@ -5,6 +5,7 @@ import { scrubText } from "./redact.js";
 import { normalizeRoute } from "./fingerprint.js";
 import { extractLlmCall } from "./llm.js";
 import { BREADCRUMBS_ATTRIBUTE, breadcrumbsField } from "./breadcrumbs.js";
+import { dedupeTraceSignals, hasAutterKey, hasNextContext } from "./trace-dedupe.js";
 import { asSeverity, } from "./types.js";
 const EMAIL_VALUE_RE = /[A-Z0-9._%+-]{1,64}@[A-Z0-9.-]{1,253}\.[A-Z]{2,63}/gi;
 function attrMap(attributes) {
@@ -100,8 +101,10 @@ function severityOf(eventAttrs, spanAttrs) {
 }
 const MAX_SPANS_PER_REQUEST = 5000;
 export function normalizeTraces(request) {
-    const occurrences = [];
-    const occurrenceSpanIds = [];
+    const signals = [];
+    // Per signal: whether a server span's request rollup already counts it,
+    // and the route its own rollup keys on (before HTTP inheritance).
+    const signalRollups = [];
     const spans = [];
     const llmCalls = [];
     const rollups = new Map();
@@ -143,39 +146,56 @@ export function normalizeTraces(request) {
                     },
                     startedAt,
                 });
-                // Error occurrences: one per exception event; if the span is
+                // Error signals: one per exception event; if the span is
                 // errored without exception events, one from the span status.
-                const occurrencesBefore = occurrences.length;
+                // They become occurrences after the batch-wide dedupe below.
+                const traceId = span.traceId ?? "";
+                const spanId = span.spanId ?? "";
+                const rollup = {
+                    onRequestRollup: kind === "server" && attrs.get("autter.tail_retained") !== "true",
+                    route: route ?? "",
+                };
+                const spanAutter = attrs.has("autter.severity");
                 const exceptionEvents = (span.events ?? []).filter((event) => event.name === "exception");
                 for (const event of exceptionEvents) {
                     const eventAttrs = attrMap(event.attributes);
                     const handled = eventAttrs.get("autter.handled") === "true";
-                    occurrenceSpanIds.push(span.spanId ?? "");
-                    occurrences.push({
-                        source: "server",
-                        severity: severityOf(eventAttrs, attrs),
-                        service: resource.service,
-                        environment: resource.environment,
-                        release: resource.release,
-                        errorType: eventAttrs.get("exception.type") ?? "Error",
-                        message: eventAttrs.get("exception.message") ??
-                            span.status?.message ??
-                            span.name ??
-                            "Unknown error",
-                        stack: eventAttrs.get("exception.stacktrace") ?? null,
-                        route,
-                        method: methodOf(attrs),
-                        statusCode,
-                        traceId: span.traceId ?? null,
-                        sessionId: null,
-                        attributes: sanitizeRuntimeContext({ ...decodeOtlpAttributes(span.attributes), ...decodeOtlpAttributes(event.attributes),
-                            ...(handled ? { "autter.handled": true, "autter.sampled": eventAttrs.get("autter.sampled") === "true" } : {}) }),
-                        occurredAt: nanosToDate(event.timeUnixNano ?? span.startTimeUnixNano),
-                        // Event attributes first: one span can carry several
-                        // exceptions, each with its own code.
-                        ...liftErrorFields(eventAttrs, attrs),
-                        ...breadcrumbsField(eventAttrs.get(BREADCRUMBS_ATTRIBUTE), attrs.get(BREADCRUMBS_ATTRIBUTE)),
-                        ...fingerprintOverrideOf(eventAttrs.get("autter.fingerprint") ?? attrs.get("autter.fingerprint")),
+                    const eventAutter = hasAutterKey(eventAttrs);
+                    signalRollups.push(rollup);
+                    signals.push({
+                        traceId,
+                        spanId,
+                        signal: "exception",
+                        autterCapture: eventAutter || spanAutter,
+                        eventAutter,
+                        nextContext: hasNextContext(eventAttrs, attrs),
+                        handled,
+                        occurrence: {
+                            source: "server",
+                            severity: severityOf(eventAttrs, attrs),
+                            service: resource.service,
+                            environment: resource.environment,
+                            release: resource.release,
+                            errorType: eventAttrs.get("exception.type") ?? "Error",
+                            message: eventAttrs.get("exception.message") ??
+                                span.status?.message ??
+                                span.name ??
+                                "Unknown error",
+                            stack: eventAttrs.get("exception.stacktrace") ?? null,
+                            route,
+                            method: methodOf(attrs),
+                            statusCode,
+                            traceId: span.traceId ?? null,
+                            sessionId: null,
+                            attributes: sanitizeRuntimeContext({ ...decodeOtlpAttributes(span.attributes), ...decodeOtlpAttributes(event.attributes),
+                                ...(handled ? { "autter.handled": true, "autter.sampled": eventAttrs.get("autter.sampled") === "true" } : {}) }),
+                            occurredAt: nanosToDate(event.timeUnixNano ?? span.startTimeUnixNano),
+                            // Event attributes first: one span can carry several
+                            // exceptions, each with its own code.
+                            ...liftErrorFields(eventAttrs, attrs),
+                            ...breadcrumbsField(eventAttrs.get(BREADCRUMBS_ATTRIBUTE), attrs.get(BREADCRUMBS_ATTRIBUTE)),
+                            ...fingerprintOverrideOf(eventAttrs.get("autter.fingerprint") ?? attrs.get("autter.fingerprint")),
+                        },
                     });
                 }
                 const failedOutcomes = (span.events ?? []).filter((event) => {
@@ -186,40 +206,58 @@ export function normalizeTraces(request) {
                 for (const event of failedOutcomes) {
                     const outcome = attrMap(event.attributes);
                     const name = (outcome.get("autter.outcome.name") ?? "operation").replace(EMAIL_VALUE_RE, "[redacted]").slice(0, 200);
-                    occurrenceSpanIds.push(span.spanId ?? "");
-                    occurrences.push({
-                        source: "server", severity: "error", service: resource.service,
-                        environment: resource.environment, release: resource.release,
-                        errorType: "OutcomeFailure",
-                        message: `${name}: ${(outcome.get("autter.outcome.message") ?? "failed").replace(EMAIL_VALUE_RE, "[redacted]").slice(0, 1000)}`,
-                        stack: String(decodeOtlpAttributes(event.attributes)["autter.outcome.stack"] ?? "") || null, route, method: methodOf(attrs), statusCode,
-                        traceId: span.traceId ?? null, sessionId: null,
-                        attributes: sanitizeRuntimeContext({ ...decodeOtlpAttributes(span.attributes), ...decodeOtlpAttributes(event.attributes) }),
-                        occurredAt: nanosToDate(event.timeUnixNano ?? span.startTimeUnixNano),
-                        ...liftErrorFields(outcome, attrs),
+                    signalRollups.push(rollup);
+                    signals.push({
+                        traceId,
+                        spanId,
+                        signal: "outcome",
+                        autterCapture: true,
+                        eventAutter: true,
+                        nextContext: hasNextContext(outcome, attrs),
+                        handled: false,
+                        occurrence: {
+                            source: "server", severity: "error", service: resource.service,
+                            environment: resource.environment, release: resource.release,
+                            errorType: "OutcomeFailure",
+                            message: `${name}: ${(outcome.get("autter.outcome.message") ?? "failed").replace(EMAIL_VALUE_RE, "[redacted]").slice(0, 1000)}`,
+                            stack: String(decodeOtlpAttributes(event.attributes)["autter.outcome.stack"] ?? "") || null, route, method: methodOf(attrs), statusCode,
+                            traceId: span.traceId ?? null, sessionId: null,
+                            attributes: sanitizeRuntimeContext({ ...decodeOtlpAttributes(span.attributes), ...decodeOtlpAttributes(event.attributes) }),
+                            occurredAt: nanosToDate(event.timeUnixNano ?? span.startTimeUnixNano),
+                            ...liftErrorFields(outcome, attrs),
+                        },
                     });
                 }
                 if (exceptionEvents.length === 0 && failedOutcomes.length === 0 && isError) {
-                    occurrenceSpanIds.push(span.spanId ?? "");
-                    occurrences.push({
-                        source: "server",
-                        severity: severityOf(new Map(), attrs),
-                        service: resource.service,
-                        environment: resource.environment,
-                        release: resource.release,
-                        errorType: statusCode !== null && statusCode >= 500 ? "HttpServerError" : "SpanError",
-                        message: span.status?.message || (statusCode !== null && statusCode >= 500
-                            ? `${methodOf(attrs) ?? "HTTP"} ${route ?? span.name ?? "request"} returned ${statusCode}`
-                            : `${span.name ?? "span"} failed`),
-                        stack: null,
-                        route,
-                        method: methodOf(attrs),
-                        statusCode,
-                        traceId: span.traceId ?? null,
-                        sessionId: null,
-                        attributes: decodeOtlpAttributes(span.attributes),
-                        occurredAt: startedAt,
-                        ...liftErrorFields(attrs),
+                    signalRollups.push(rollup);
+                    signals.push({
+                        traceId,
+                        spanId,
+                        signal: "status",
+                        autterCapture: spanAutter,
+                        eventAutter: false,
+                        nextContext: hasNextContext(attrs),
+                        handled: false,
+                        occurrence: {
+                            source: "server",
+                            severity: severityOf(new Map(), attrs),
+                            service: resource.service,
+                            environment: resource.environment,
+                            release: resource.release,
+                            errorType: statusCode !== null && statusCode >= 500 ? "HttpServerError" : "SpanError",
+                            message: span.status?.message || (statusCode !== null && statusCode >= 500
+                                ? `${methodOf(attrs) ?? "HTTP"} ${route ?? span.name ?? "request"} returned ${statusCode}`
+                                : `${span.name ?? "span"} failed`),
+                            stack: null,
+                            route,
+                            method: methodOf(attrs),
+                            statusCode,
+                            traceId: span.traceId ?? null,
+                            sessionId: null,
+                            attributes: decodeOtlpAttributes(span.attributes),
+                            occurredAt: startedAt,
+                            ...liftErrorFields(attrs),
+                        },
                     });
                 }
                 // LLM provider calls (GenAI semconv, Vercel AI SDK telemetry,
@@ -249,7 +287,7 @@ export function normalizeTraces(request) {
                 // ships those at ~100% alongside a metrics pipeline that already
                 // counts every request, so folding them in would double-count
                 // erroring routes.
-                if (kind === "server" && attrs.get("autter.tail_retained") !== "true") {
+                if (rollup.onRequestRollup) {
                     addToRollup(rollups, {
                         service: resource.service,
                         environment: resource.environment,
@@ -262,33 +300,42 @@ export function normalizeTraces(request) {
                         sessionCount: 0,
                     });
                 }
-                else {
-                    // Occurrences on non-server spans (captureException's internal
-                    // error spans, workers, consumers) have no request rollup to
-                    // ride — count each as one event / one error event, or a
-                    // service whose errors arrive outside HTTP handlers groups
-                    // issues while every event counter stays 0. Server spans are
-                    // excluded: their request rollup above already represents them.
-                    for (const occ of occurrences.slice(occurrencesBefore)) {
-                        addToRollup(rollups, {
-                            service: occ.service,
-                            environment: occ.environment,
-                            release: occ.release,
-                            route: occ.route ?? "",
-                            bucketAt: minuteBucket(occ.occurredAt),
-                            requestCount: 1,
-                            errorCount: occ.severity === "fatal" || occ.severity === "error" ? 1 : 0,
-                            durationSumMs: 0,
-                            sessionCount: 0,
-                        });
-                    }
-                }
             }
         }
     }
-    inheritHttpFromParent(occurrences, occurrenceSpanIds, spans);
+    // One occurrence per thrown error: recordings of one error on several
+    // spans of a trace merge, and status-only occurrences an error on their
+    // span chain explains are dropped (trace-dedupe.ts).
+    const deduped = dedupeTraceSignals(signals, spans);
+    const occurrences = deduped.occurrences;
+    // Occurrences on non-server spans (captureException's internal error
+    // spans, workers, consumers) have no request rollup to ride — count each
+    // as one event / one error event, or a service whose errors arrive
+    // outside HTTP handlers groups issues while every event counter stays 0.
+    // Server spans are excluded: their request rollup above already
+    // represents them, and so does it for a merged error any of whose
+    // recordings sits on one. Counted after the dedupe, so each thrown error
+    // is one event; a dropped status-only occurrence is none.
+    deduped.members.forEach((members, i) => {
+        if (members.some((m) => signalRollups[m].onRequestRollup))
+            return;
+        const occ = occurrences[i];
+        addToRollup(rollups, {
+            service: occ.service,
+            environment: occ.environment,
+            release: occ.release,
+            route: signalRollups[deduped.sourceIndexes[i]].route,
+            bucketAt: minuteBucket(occ.occurredAt),
+            requestCount: 1,
+            errorCount: occ.severity === "fatal" || occ.severity === "error" ? 1 : 0,
+            durationSumMs: 0,
+            sessionCount: 0,
+        });
+    });
+    inheritHttpFromParent(occurrences, deduped.sourceIndexes.map((index) => signals[index].spanId), spans);
     return {
         occurrences,
+        occurrenceBatchIndexes: deduped.sourceIndexes,
         spans,
         metricPoints: [...rollups.values()],
         llmCalls,

package/dist/server.d.ts

@@ -11,4 +11,11 @@ export interface IngesterApp {
      * Autter dashboard). Called after the boot schema warm-up; throttled. */
     reportIngesterInfo: () => Promise<void>;
 }
+/** The only routes an upload key (`autter_rtu_…`, scope "upload") may call. */
+export declare const UPLOAD_KEY_ROUTES: readonly ["/v1/sourcemaps", "/v1/sourcemaps/check"];
+/** The 403 an upload key gets on every other authenticated route. */
+export declare const UPLOAD_KEY_NOT_ALLOWED: {
+    readonly error: "upload_key_not_allowed";
+    readonly detail: string;
+};
 export declare function createIngesterApp(config: IngesterConfig): IngesterApp;