@hasna/logs 0.3.26 → 0.3.27

package/dist/index-t3x838zw.js

@@ -0,0 +1,2583 @@
+// @bun
+import {
+  sqlBindings
+} from "./index-b5c72f1p.js";
+
+// src/lib/issues.ts
+import { createHash } from "crypto";
+function computeFingerprint(level, service, message, stackTrace) {
+  const normalized = message.replace(/[0-9a-f]{8,}/gi, "<id>").replace(/\d+/g, "<n>").replace(/https?:\/\/[^\s]+/g, "<url>").trim();
+  const stackFrame = stackTrace ? stackTrace.split(`
+`).slice(0, 3).join("|") : "";
+  const raw = `${level}|${service ?? ""}|${normalized}|${stackFrame}`;
+  return createHash("sha256").update(raw).digest("hex").slice(0, 16);
+}
+function upsertIssue(db, data) {
+  const fingerprint = computeFingerprint(data.level, data.service ?? null, data.message, data.stack_trace);
+  return db.prepare(`
+    INSERT INTO issues (project_id, fingerprint, level, service, message_template)
+    VALUES ($project_id, $fingerprint, $level, $service, $message_template)
+    ON CONFLICT(project_id, fingerprint) DO UPDATE SET
+      count = count + 1,
+      last_seen = strftime('%Y-%m-%dT%H:%M:%fZ','now'),
+      status = CASE WHEN status = 'resolved' THEN 'open' ELSE status END
+    RETURNING *
+  `).get({
+    $project_id: data.project_id ?? null,
+    $fingerprint: fingerprint,
+    $level: data.level,
+    $service: data.service ?? null,
+    $message_template: data.message.slice(0, 500)
+  });
+}
+function listIssues(db, projectId, status, limit = 50) {
+  const conditions = [];
+  const params = { $limit: limit };
+  if (projectId) {
+    conditions.push("project_id = $p");
+    params.$p = projectId;
+  }
+  if (status) {
+    conditions.push("status = $status");
+    params.$status = status;
+  }
+  const where = conditions.length ? `WHERE ${conditions.join(" AND ")}` : "";
+  return db.prepare(`SELECT * FROM issues ${where} ORDER BY last_seen DESC LIMIT $limit`).all(sqlBindings(params));
+}
+function getIssue(db, id) {
+  return db.prepare("SELECT * FROM issues WHERE id = $id").get(sqlBindings({ $id: id }));
+}
+function updateIssueStatus(db, id, status) {
+  return db.prepare("UPDATE issues SET status = $status WHERE id = $id RETURNING *").get(sqlBindings({ $id: id, $status: status }));
+}
+
+// src/lib/event-store.ts
+import { createHash as createHash4 } from "crypto";
+import {
+  closeSync,
+  existsSync,
+  fsyncSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  readdirSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+  writeSync
+} from "fs";
+import { dirname, join, resolve, sep } from "path";
+
+// src/lib/source-map-projections.ts
+import { createHash as createHash2 } from "crypto";
+var MAX_PROJECTED_SOURCE_MAP_SOURCES = 200;
+var MAX_SOURCE_MAP_STRING = 500;
+var MAX_SOURCE_MAP_ERROR = 240;
+var SOURCE_MAP_ROOT_KEYS = [
+  "source_map_id",
+  "source_map_artifact_id",
+  "source_map_path",
+  "javascript_artifact_id",
+  "javascript_path",
+  "linked_by",
+  "file",
+  "sourceRoot",
+  "source_root",
+  "version",
+  "validation_status",
+  "validation_error",
+  "source_count",
+  "section_count",
+  "names_count",
+  "mappings_length",
+  "has_sources_content",
+  "sources",
+  "sections",
+  "sourcesContent",
+  "names",
+  "mappings",
+  "raw_json",
+  "source_storage_policy",
+  "projected_source_limit"
+];
+var SAFE_VALIDATION_ERRORS = new Set([
+  "source map exceeds bounded parser size",
+  "source map could not be read",
+  "source map JSON is invalid",
+  "source map root must be an object",
+  "source map version must be 3",
+  "source map sources must be an array",
+  "source map mappings must be a string"
+]);
+function sanitizeSourceMapTelemetry(value) {
+  const sourceMap = objectRecord(value);
+  if (Object.keys(sourceMap).length === 0)
+    return null;
+  if (!hasSourceMapTelemetrySignal(sourceMap))
+    return null;
+  const sources = sanitizedSources(sourceMap);
+  const rawSources = Array.isArray(sourceMap.sources) ? sourceMap.sources : [];
+  const rawSourcesContent = Array.isArray(sourceMap.sourcesContent) ? sourceMap.sourcesContent : [];
+  const rawNames = Array.isArray(sourceMap.names) ? sourceMap.names : [];
+  const rawMappings = typeof sourceMap.mappings === "string" ? sourceMap.mappings : null;
+  const sourceCount = integerValue(sourceMap.source_count) ?? rawSources.length;
+  const hasSourcesContent = booleanValue(sourceMap.has_sources_content) ?? (rawSourcesContent.some((content) => typeof content === "string") || sources.rows.some((source) => source.has_content));
+  const validation = validationStatus(sourceMap.validation_status) ?? (integerValue(sourceMap.version) === 3 && Array.isArray(sourceMap.sources) && typeof sourceMap.mappings === "string" ? "parsed" : null);
+  const sanitized = compactObject({
+    source_map_id: sanitizeSourceMapIdentifierValue(sourceMap.source_map_id),
+    source_map_artifact_id: sanitizeSourceMapIdentifierValue(sourceMap.source_map_artifact_id),
+    source_map_path: sanitizeSourceMapPathValue(sourceMap.source_map_path),
+    javascript_artifact_id: sanitizeSourceMapIdentifierValue(sourceMap.javascript_artifact_id),
+    javascript_path: sanitizeSourceMapPathValue(sourceMap.javascript_path),
+    linked_by: linkedBy(sourceMap.linked_by),
+    file: sanitizeSourceMapPathValue(sourceMap.file),
+    source_root: sanitizeSourceMapPathValue(sourceMap.source_root ?? sourceMap.sourceRoot),
+    version: integerValue(sourceMap.version),
+    validation_status: validation,
+    validation_error: sanitizeSourceMapValidationError(sourceMap.validation_error),
+    source_count: sourceCount,
+    section_count: Array.isArray(sourceMap.sections) ? sourceMap.sections.length : integerValue(sourceMap.section_count),
+    names_count: integerValue(sourceMap.names_count) ?? rawNames.length,
+    mappings_length: integerValue(sourceMap.mappings_length) ?? rawMappings?.length,
+    has_sources_content: hasSourcesContent,
+    sources: sources.rows,
+    truncated: booleanValue(sourceMap.truncated) ?? sources.truncated ?? rawSources.length > MAX_PROJECTED_SOURCE_MAP_SOURCES,
+    content_hash: sanitizeSourceMapContentHashValue(sourceMap.content_hash),
+    size_bytes: integerValue(sourceMap.size_bytes),
+    source_storage_policy: "paths_and_hashes_only",
+    projected_source_limit: MAX_PROJECTED_SOURCE_MAP_SOURCES
+  });
+  return Object.keys(sanitized).length > 0 ? sanitized : null;
+}
+function sanitizeSourceMapArtifactRecord(value) {
+  const artifact = objectRecord(value);
+  if (Object.keys(artifact).length === 0)
+    return {};
+  const artifactType = stringValue(artifact.artifact_type) ?? stringValue(artifact.type);
+  const path = stringValue(artifact.path);
+  const isSourceMapArtifact = artifactType === "source_map" || artifactType === "source-map" || artifactType === "sourcemap" || Boolean(path?.endsWith(".map")) || hasSourceMapTelemetrySignal(artifact);
+  const nested = sanitizeSourceMapTelemetry(artifact.source_map);
+  const root = isSourceMapArtifact ? sanitizeSourceMapTelemetry(artifact) : null;
+  const sourceMap = nested ?? root;
+  const output = isSourceMapArtifact ? sourceMapArtifactOutput(artifact) : { ...artifact };
+  if (isSourceMapArtifact) {
+    for (const key of SOURCE_MAP_ROOT_KEYS)
+      output[key] = undefined;
+    if ("path" in output)
+      output.path = sanitizeSourceMapPathValue(output.path);
+  }
+  if (sourceMap)
+    output.source_map = sourceMap;
+  else if ("source_map" in output)
+    output.source_map = undefined;
+  return output;
+}
+function sourceMapArtifactOutput(artifact) {
+  const artifactType = sourceMapArtifactKind(artifact.artifact_type) ?? sourceMapArtifactKind(artifact.type) ?? "source_map";
+  return compactObject({
+    category: sanitizeSourceMapScalarValue("category", artifact.category),
+    scanner: sanitizeSourceMapScalarValue("scanner", artifact.scanner),
+    run_type: sanitizeSourceMapScalarValue("run_type", artifact.run_type),
+    tool: sanitizeSourceMapScalarValue("tool", artifact.tool),
+    package_manager: sanitizeSourceMapScalarValue("package_manager", artifact.package_manager),
+    framework: sanitizeSourceMapScalarValue("framework", artifact.framework),
+    script: sanitizeSourceMapScalarValue("script", artifact.script),
+    artifact_id: sanitizeSourceMapIdentifierValue(artifact.artifact_id),
+    artifact_type: artifactType,
+    type: sourceMapArtifactKind(artifact.type) ?? sanitizeSourceMapScalarValue("type", artifact.type),
+    path: sanitizeSourceMapPathValue(artifact.path),
+    content_hash: sanitizeSourceMapContentHashValue(artifact.content_hash),
+    size_bytes: integerValue(artifact.size_bytes),
+    changed: sanitizeSourceMapScalarValue("changed", artifact.changed),
+    mtime_ms: numberValue(artifact.mtime_ms),
+    truncated: booleanValue(artifact.truncated)
+  });
+}
+function sanitizeSourceMapPathValue(value) {
+  if (typeof value !== "string")
+    return null;
+  const normalized = value.split("\\").join("/");
+  if (!normalized || normalized.includes("\x00"))
+    return null;
+  if (normalized.startsWith("[source-map-")) {
+    if (/^\[source-map-(host_path|unsafe_relative|unsafe_marker):[a-f0-9]{16}\]$/.test(normalized))
+      return normalized;
+    return pathHashMarker("unsafe_marker", normalized);
+  }
+  if (isHostPathLike(normalized))
+    return pathHashMarker("host_path", normalized);
+  const parts = [];
+  for (const part of normalized.split("/")) {
+    if (!part || part === ".")
+      continue;
+    if (part === "..")
+      return pathHashMarker("unsafe_relative", normalized);
+    parts.push(part);
+  }
+  if (parts.length === 0)
+    return null;
+  return truncatedString(parts.join("/"), MAX_SOURCE_MAP_STRING);
+}
+function sanitizeSourceMapIdentifierValue(value) {
+  if (typeof value !== "string")
+    return null;
+  const normalized = value.split("\\").join("/");
+  if (!normalized || normalized.includes("\x00"))
+    return null;
+  if (normalized.startsWith("[source-map-")) {
+    if (/^\[source-map-id:[a-f0-9]{16}\]$/.test(normalized))
+      return normalized;
+    return identifierHashMarker(normalized);
+  }
+  if (isHostPathLike(normalized) || normalized.includes("/") || normalized.includes("..") || /\s/.test(normalized))
+    return identifierHashMarker(normalized);
+  return truncatedString(normalized, MAX_SOURCE_MAP_STRING);
+}
+function sourceMapFallbackIdentifier(value) {
+  const text = typeof value === "string" ? value : JSON.stringify(value);
+  return identifierHashMarker(`fallback:${text ?? String(value)}`);
+}
+function sanitizeSourceMapContextRecord(value) {
+  const record = objectRecord(value);
+  const output = { ...record };
+  sanitizeContextId(output, "artifact_id");
+  sanitizeContextId(output, "source_map_id");
+  sanitizeContextId(output, "source_map_artifact_id");
+  sanitizeContextId(output, "javascript_artifact_id");
+  sanitizeContextPath(output, "path");
+  sanitizeContextPath(output, "source_map_path");
+  sanitizeContextPath(output, "javascript_path");
+  sanitizeContextPath(output, "file");
+  sanitizeContextPath(output, "sourceRoot");
+  sanitizeContextPath(output, "source_root");
+  sanitizeContextContentHash(output, "content_hash");
+  sanitizeContextArtifactType(output, "artifact_type");
+  sanitizeContextArtifactType(output, "type");
+  sanitizeContextScalar(output, "category", "category");
+  sanitizeContextScalar(output, "scanner", "scanner");
+  sanitizeContextScalar(output, "run_type", "run_type");
+  sanitizeContextScalar(output, "tool", "tool");
+  sanitizeContextScalar(output, "package_manager", "package_manager");
+  sanitizeContextScalar(output, "framework", "framework");
+  sanitizeContextScalar(output, "script", "script");
+  sanitizeContextScalar(output, "changed", "changed");
+  return output;
+}
+function sourceMapSourceRowId(sourceMapId, ordinal) {
+  return `srcmap_source_${createHash2("md5").update(sourceMapId).update(":").update(String(ordinal)).digest("hex")}`;
+}
+function upsertSourceMapProjection(db, event, index) {
+  const sourceMap = sourceMapObject(event, index);
+  if (!sourceMap)
+    return;
+  const body = objectRecord(event.body);
+  const rootArtifact = sanitizeSourceMapArtifactRecord(body);
+  const artifact = compactObject({
+    ...rootArtifact,
+    ...objectRecord(event.body?.artifact)
+  });
+  const attrs = objectRecord(event.attributes);
+  const metadata = objectRecord(index.metadata);
+  const sourceMapIdCandidate = firstString([sourceMap, artifact, attrs, metadata], ["source_map_id", "source_map_artifact_id", "artifact_id"]) ?? index.artifact_id;
+  const sourceMapId = sanitizeSourceMapIdentifierValue(sourceMapIdCandidate) ?? sourceMapFallbackIdentifier(event.event_id);
+  const sourceMapArtifactId = sanitizeSourceMapIdentifierValue(firstString([sourceMap, artifact, attrs, metadata], ["source_map_artifact_id", "artifact_id"]) ?? sourceMapId) ?? sourceMapId;
+  const sourceMapPath = sanitizeSourceMapPathValue(firstString([sourceMap, artifact, attrs, metadata], ["source_map_path", "path"]));
+  const javascriptArtifactId = sanitizeSourceMapIdentifierValue(sourceMap.javascript_artifact_id);
+  const contentHash = sanitizeSourceMapContentHashValue(sourceMap.content_hash) ?? sanitizeSourceMapContentHashValue(artifact.content_hash) ?? sanitizeSourceMapContentHashValue(attrs.content_hash);
+  const sources = projectedSources(sourceMap);
+  const sourceCount = integerValue(sourceMap.source_count) ?? sources.total_count ?? sources.rows.length;
+  const namesCount = integerValue(sourceMap.names_count);
+  const mappingsLength = integerValue(sourceMap.mappings_length);
+  const hasSourcesContent = booleanValue(sourceMap.has_sources_content) ?? sources.rows.some((source) => source.has_content);
+  const truncated = booleanValue(sourceMap.truncated) ?? sources.truncated ?? sources.rows.length < sourceCount;
+  const projectionMetadata = compactObject({
+    category: "source_map",
+    source_map_artifact_id: sourceMapArtifactId,
+    javascript_artifact_id: javascriptArtifactId,
+    source_map_path: sourceMapPath,
+    javascript_path: stringValue(sourceMap.javascript_path),
+    source_root: stringValue(sourceMap.source_root),
+    file: stringValue(sourceMap.file),
+    version: integerValue(sourceMap.version),
+    validation_status: validationStatus(sourceMap.validation_status),
+    validation_error: sanitizeSourceMapValidationError(sourceMap.validation_error),
+    source_count: sourceCount,
+    names_count: namesCount,
+    mappings_length: mappingsLength,
+    has_sources_content: hasSourcesContent,
+    truncated,
+    content_hash: contentHash,
+    size_bytes: integerValue(sourceMap.size_bytes) ?? integerValue(artifact.size_bytes) ?? integerValue(attrs.size_bytes),
+    source_storage_policy: "paths_and_hashes_only",
+    projected_source_limit: MAX_PROJECTED_SOURCE_MAP_SOURCES
+  });
+  db.prepare(`
+    INSERT INTO source_maps (
+      id, event_id, project_id, machine_id, repo_id, app_id, process_id, run_id,
+      environment, source_map_artifact_id, javascript_artifact_id, source_map_path,
+      javascript_path, source_root, file, version, validation_status, validation_error,
+      source_count, names_count, mappings_length, has_sources_content, truncated,
+      content_hash, size_bytes, metadata
+    )
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(id) DO UPDATE SET
+      event_id = COALESCE(excluded.event_id, source_maps.event_id),
+      project_id = COALESCE(excluded.project_id, source_maps.project_id),
+      machine_id = COALESCE(excluded.machine_id, source_maps.machine_id),
+      repo_id = COALESCE(excluded.repo_id, source_maps.repo_id),
+      app_id = COALESCE(excluded.app_id, source_maps.app_id),
+      process_id = COALESCE(excluded.process_id, source_maps.process_id),
+      run_id = COALESCE(excluded.run_id, source_maps.run_id),
+      environment = COALESCE(excluded.environment, source_maps.environment),
+      source_map_artifact_id = COALESCE(excluded.source_map_artifact_id, source_maps.source_map_artifact_id),
+      javascript_artifact_id = excluded.javascript_artifact_id,
+      source_map_path = COALESCE(excluded.source_map_path, source_maps.source_map_path),
+      javascript_path = excluded.javascript_path,
+      source_root = excluded.source_root,
+      file = excluded.file,
+      version = excluded.version,
+      validation_status = excluded.validation_status,
+      validation_error = excluded.validation_error,
+      source_count = excluded.source_count,
+      names_count = excluded.names_count,
+      mappings_length = excluded.mappings_length,
+      has_sources_content = excluded.has_sources_content,
+      truncated = excluded.truncated,
+      content_hash = COALESCE(excluded.content_hash, source_maps.content_hash),
+      size_bytes = COALESCE(excluded.size_bytes, source_maps.size_bytes),
+      metadata = excluded.metadata
+  `).run(sourceMapId, event.event_id, index.project_id ?? null, index.machine_id ?? event.machine_id ?? null, index.repo_id ?? event.repo_id ?? null, index.app_id ?? event.app_id ?? null, index.process_id ?? event.process_id ?? null, index.run_id ?? event.run_id ?? null, index.environment ?? event.environment ?? null, sourceMapArtifactId, javascriptArtifactId, sourceMapPath, stringValue(sourceMap.javascript_path), stringValue(sourceMap.source_root), stringValue(sourceMap.file), integerValue(sourceMap.version), validationStatus(sourceMap.validation_status), sanitizeSourceMapValidationError(sourceMap.validation_error), sourceCount, namesCount, mappingsLength, hasSourcesContent ? 1 : 0, truncated ? 1 : 0, contentHash, integerValue(sourceMap.size_bytes) ?? integerValue(artifact.size_bytes) ?? integerValue(attrs.size_bytes), JSON.stringify(projectionMetadata));
+  db.prepare("DELETE FROM source_map_sources WHERE source_map_id = ?").run(sourceMapId);
+  const insertSource = db.prepare(`
+    INSERT INTO source_map_sources (
+      id, source_map_id, ordinal, source_path, has_content, content_hash, metadata
+    )
+    VALUES (?, ?, ?, ?, ?, ?, ?)
+  `);
+  for (const source of sources.rows) {
+    insertSource.run(sourceMapSourceRowId(sourceMapId, source.ordinal), sourceMapId, source.ordinal, source.source_path, source.has_content ? 1 : 0, source.content_hash, JSON.stringify({
+      source_storage_policy: "paths_and_hashes_only",
+      truncated: sources.truncated
+    }));
+  }
+}
+function sourceMapObject(event, index) {
+  const body = objectRecord(event.body);
+  const artifact = objectRecord(body.artifact);
+  const attrs = objectRecord(event.attributes);
+  const metadata = objectRecord(index.metadata);
+  const sanitizedRootArtifact = sanitizeSourceMapArtifactRecord(body);
+  const sanitizedArtifact = sanitizeSourceMapArtifactRecord(artifact);
+  const sanitizedAttrs = sanitizeSourceMapArtifactRecord(attrs);
+  const candidates = [
+    objectRecord(artifact.source_map),
+    objectRecord(body.source_map),
+    objectRecord(attrs.source_map),
+    objectRecord(metadata.source_map),
+    objectRecord(sanitizedRootArtifact.source_map),
+    objectRecord(sanitizedArtifact.source_map),
+    objectRecord(sanitizedAttrs.source_map)
+  ];
+  const sourceMap = candidates.find((candidate) => Object.keys(candidate).length > 0) ?? null;
+  return sanitizeSourceMapTelemetry(sourceMap);
+}
+function projectedSources(sourceMap) {
+  const rawSources = Array.isArray(sourceMap.sources) ? sourceMap.sources : [];
+  const rows = [];
+  const usedOrdinals = new Set;
+  let nextOrdinal = 0;
+  for (const [index, raw] of rawSources.entries()) {
+    if (rows.length >= MAX_PROJECTED_SOURCE_MAP_SOURCES)
+      break;
+    const source = objectRecord(raw);
+    if (Object.keys(source).length === 0)
+      continue;
+    let ordinal = integerValue(source.ordinal) ?? index;
+    if (ordinal < 0)
+      ordinal = index;
+    while (usedOrdinals.has(ordinal))
+      ordinal = nextOrdinal++;
+    usedOrdinals.add(ordinal);
+    nextOrdinal = Math.max(nextOrdinal, ordinal + 1);
+    rows.push({
+      ordinal,
+      source_path: sanitizeSourceMapPathValue(source.source_path),
+      has_content: booleanValue(source.has_content) ?? false,
+      content_hash: sanitizeSourceMapContentHashValue(source.content_hash)
+    });
+  }
+  const totalCount = integerValue(sourceMap.source_count);
+  return {
+    rows,
+    total_count: totalCount,
+    truncated: booleanValue(sourceMap.truncated) ?? rawSources.length > MAX_PROJECTED_SOURCE_MAP_SOURCES
+  };
+}
+function sanitizedSources(sourceMap) {
+  const rawSources = Array.isArray(sourceMap.sources) ? sourceMap.sources : [];
+  const rawSourcesContent = Array.isArray(sourceMap.sourcesContent) ? sourceMap.sourcesContent : [];
+  const rows = [];
+  const usedOrdinals = new Set;
+  let nextOrdinal = 0;
+  for (const [index, raw] of rawSources.entries()) {
+    if (rows.length >= MAX_PROJECTED_SOURCE_MAP_SOURCES)
+      break;
+    const source = objectRecord(raw);
+    const content = rawSourcesContent[index] ?? (typeof source.content === "string" ? source.content : undefined);
+    let ordinal = integerValue(source.ordinal) ?? index;
+    if (ordinal < 0)
+      ordinal = index;
+    while (usedOrdinals.has(ordinal))
+      ordinal = nextOrdinal++;
+    usedOrdinals.add(ordinal);
+    nextOrdinal = Math.max(nextOrdinal, ordinal + 1);
+    const computedContentHash = typeof content === "string" ? createHash2("sha256").update(content).digest("hex") : null;
+    rows.push({
+      ordinal,
+      source_path: sanitizeSourceMapPathValue(typeof raw === "string" ? raw : source.source_path ?? source.path ?? source.source),
+      has_content: booleanValue(source.has_content) ?? typeof content === "string",
+      content_hash: computedContentHash ?? sanitizeSourceMapContentHashValue(source.content_hash)
+    });
+  }
+  return {
+    rows,
+    truncated: rawSources.length > MAX_PROJECTED_SOURCE_MAP_SOURCES
+  };
+}
+function validationStatus(value) {
+  const status = stringValue(value);
+  if (status === "parsed" || status === "malformed" || status === "too_large" || status === "unsupported")
+    return status;
+  return null;
+}
+function linkedBy(value) {
+  const linked = stringValue(value);
+  if (linked === "adjacent_path" || linked === "file_field" || linked === "none")
+    return linked;
+  return null;
+}
+function hasSourceMapTelemetrySignal(sourceMap) {
+  const artifactType = stringValue(sourceMap.artifact_type) ?? stringValue(sourceMap.type);
+  const path = stringValue(sourceMap.path);
+  if (artifactType === "source_map" || artifactType === "source-map" || artifactType === "sourcemap" || Boolean(path?.endsWith(".map")))
+    return true;
+  for (const key of SOURCE_MAP_ROOT_KEYS) {
+    if (key === "source_storage_policy" || key === "projected_source_limit")
+      continue;
+    const value = sourceMap[key];
+    if (value === null || value === undefined)
+      continue;
+    if (Array.isArray(value)) {
+      if (value.length > 0)
+        return true;
+      continue;
+    }
+    if (typeof value === "string") {
+      if (value.length > 0)
+        return true;
+      continue;
+    }
+    if (typeof value === "boolean") {
+      if (value)
+        return true;
+      continue;
+    }
+    return true;
+  }
+  return false;
+}
+function sanitizeSourceMapValidationError(value) {
+  if (typeof value !== "string")
+    return null;
+  if (SAFE_VALIDATION_ERRORS.has(value) || /^\[source-map-validation-error:[a-f0-9]{16}\]$/.test(value))
+    return truncatedString(value, MAX_SOURCE_MAP_ERROR);
+  return `[source-map-validation-error:${createHash2("sha256").update(value).digest("hex").slice(0, 16)}]`;
+}
+function firstString(records, keys) {
+  for (const key of keys) {
+    for (const record of records) {
+      const value = stringValue(record[key]);
+      if (value)
+        return value;
+    }
+  }
+  return null;
+}
+function objectRecord(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function stringValue(value) {
+  if (typeof value !== "string")
+    return null;
+  return truncatedString(value, MAX_SOURCE_MAP_STRING);
+}
+function truncatedString(value, maxLength) {
+  if (typeof value !== "string")
+    return null;
+  if (value.length <= maxLength)
+    return value;
+  return `${value.slice(0, maxLength)}... [truncated]`;
+}
+function integerValue(value) {
+  if (typeof value !== "number" || !Number.isFinite(value))
+    return null;
+  return Math.trunc(value);
+}
+function numberValue(value) {
+  return typeof value === "number" && Number.isFinite(value) ? value : null;
+}
+function booleanValue(value) {
+  return typeof value === "boolean" ? value : null;
+}
+function isHostPathLike(value) {
+  return value.startsWith("/") || value.startsWith("~/") || value.startsWith("//") || /^[a-zA-Z]:\//.test(value) || /^[a-zA-Z][a-zA-Z0-9+.-]*:/.test(value);
+}
+function pathHashMarker(kind, value) {
+  return `[source-map-${kind}:${createHash2("sha256").update(value).digest("hex").slice(0, 16)}]`;
+}
+function identifierHashMarker(value) {
+  return `[source-map-id:${createHash2("sha256").update(value).digest("hex").slice(0, 16)}]`;
+}
+function scalarHashMarker(value) {
+  return `[source-map-scalar:${createHash2("sha256").update(value).digest("hex").slice(0, 16)}]`;
+}
+var SOURCE_MAP_SCALAR_ALLOWLISTS = {
+  category: new Set(["build_artifact", "source_map"]),
+  scanner: new Set(["common-output-roots"]),
+  run_type: new Set(["command", "build", "test", "dev-server"]),
+  tool: new Set([
+    "ava",
+    "biome",
+    "build",
+    "eslint",
+    "jest",
+    "mocha",
+    "next",
+    "playwright",
+    "rollup",
+    "svelte-kit",
+    "test",
+    "tsc",
+    "turbo",
+    "vite",
+    "vitest",
+    "webpack"
+  ]),
+  package_manager: new Set(["bun", "npm", "pnpm", "yarn"]),
+  framework: new Set(["astro", "next", "nuxt", "remix", "svelte-kit", "vite"]),
+  script: new Set([
+    "build",
+    "check",
+    "dev",
+    "lint",
+    "serve",
+    "start",
+    "test",
+    "typecheck"
+  ]),
+  type: new Set(["source_map"]),
+  changed: new Set(["created", "modified"])
+};
+function sanitizeSourceMapScalarValue(field, value) {
+  if (typeof value !== "string")
+    return null;
+  const normalized = value.trim().split("\\").join("/");
+  if (!normalized || normalized.includes("\x00"))
+    return null;
+  if (normalized.startsWith("[source-map-")) {
+    if (/^\[source-map-scalar:[a-f0-9]{16}\]$/.test(normalized))
+      return normalized;
+    return scalarHashMarker(normalized);
+  }
+  if (SOURCE_MAP_SCALAR_ALLOWLISTS[field]?.has(normalized))
+    return normalized;
+  if (isHostPathLike(normalized) || normalized.includes("/") || normalized.includes("..") || /\s/.test(normalized) || !/^[a-zA-Z0-9_.-]+$/.test(normalized))
+    return scalarHashMarker(normalized);
+  return scalarHashMarker(normalized);
+}
+function sourceMapArtifactKind(value) {
+  const kind = stringValue(value);
+  if (kind === "source_map" || kind === "source-map" || kind === "sourcemap") {
+    return "source_map";
+  }
+  return null;
+}
+function sanitizeSourceMapContentHashValue(value) {
+  if (typeof value !== "string")
+    return null;
+  const normalized = value.trim();
+  if (!normalized || normalized.includes("\x00"))
+    return null;
+  if (/^\[source-map-content-hash:[a-f0-9]{16}\]$/.test(normalized)) {
+    return normalized;
+  }
+  if (/^[a-f0-9]{64}$/i.test(normalized))
+    return normalized.toLowerCase();
+  if (/^sha256:[a-f0-9]{64}$/i.test(normalized)) {
+    return normalized.toLowerCase();
+  }
+  return `[source-map-content-hash:${createHash2("sha256").update(normalized).digest("hex").slice(0, 16)}]`;
+}
+function sanitizeContextId(record, key) {
+  if (!(key in record))
+    return;
+  const value = sanitizeSourceMapIdentifierValue(record[key]);
+  if (value)
+    record[key] = value;
+  else
+    record[key] = undefined;
+}
+function sanitizeContextPath(record, key) {
+  if (!(key in record))
+    return;
+  const value = sanitizeSourceMapPathValue(record[key]);
+  if (value)
+    record[key] = value;
+  else
+    record[key] = undefined;
+}
+function sanitizeContextContentHash(record, key) {
+  if (!(key in record))
+    return;
+  const value = sanitizeSourceMapContentHashValue(record[key]);
+  if (value)
+    record[key] = value;
+  else
+    record[key] = undefined;
+}
+function sanitizeContextArtifactType(record, key) {
+  if (!(key in record))
+    return;
+  const value = sourceMapArtifactKind(record[key]);
+  if (value)
+    record[key] = value;
+  else
+    record[key] = undefined;
+}
+function sanitizeContextScalar(record, key, field) {
+  if (!(key in record))
+    return;
+  const value = sanitizeSourceMapScalarValue(field, record[key]);
+  if (value)
+    record[key] = value;
+  else
+    record[key] = undefined;
+}
+function compactObject(input) {
+  const output = {};
+  for (const [key, value] of Object.entries(input)) {
+    if (value !== null && value !== undefined)
+      output[key] = value;
+  }
+  return output;
+}
+
+// src/lib/test-report-projections.ts
+import { createHash as createHash3 } from "crypto";
+var MAX_PROJECTED_TEST_REPORT_SUITES = 20;
+var MAX_PROJECTED_TEST_REPORT_CASES = 50;
+var MAX_PROJECTED_PARSE_ERROR_LENGTH = 500;
+var REDACTED_PARSE_ERROR = "[redacted raw test-report parse error]";
+function sanitizedTestReportMetadata(reportInput, metadataInput, attributesInput, extraInput) {
+  const report = objectRecord2(reportInput);
+  const metadata = metadataInput ?? {};
+  const attrs = attributesInput ?? {};
+  const redaction = objectRecord2(metadata.redaction);
+  return compactObject2({
+    category: firstString2(attrs, metadata, "category") ?? "test_report",
+    scanner: firstString2(attrs, metadata, "scanner"),
+    run_type: firstString2(attrs, metadata, "run_type"),
+    tool: firstString2(attrs, metadata, "tool"),
+    package_manager: firstString2(attrs, metadata, "package_manager"),
+    framework: firstString2(attrs, metadata, "framework"),
+    script: firstString2(attrs, metadata, "script"),
+    report_id: stringValue2(report.report_id) ?? firstString2(attrs, metadata, "report_id"),
+    report_format: stringValue2(report.format) ?? firstString2(attrs, metadata, "report_format") ?? firstString2(attrs, metadata, "format"),
+    parser: firstString2(report, attrs, metadata, "parser"),
+    parse_status: firstString2(report, attrs, metadata, "parse_status"),
+    parse_error: sanitizedParseError(firstString2(report, attrs, metadata, "parse_error")),
+    path: firstString2(report, attrs, metadata, "path"),
+    size_bytes: firstNumber(report, attrs, metadata, "size_bytes"),
+    content_hash: firstString2(report, attrs, metadata, "content_hash"),
+    changed: firstString2(report, attrs, metadata, "changed"),
+    mtime_ms: firstNumber(report, attrs, metadata, "mtime_ms"),
+    tests: firstNumber(report, attrs, metadata, "tests"),
+    failures: firstNumber(report, attrs, metadata, "failures"),
+    errors: firstNumber(report, attrs, metadata, "errors"),
+    skipped: firstNumber(report, attrs, metadata, "skipped"),
+    time_seconds: firstNumber(report, attrs, metadata, "time_seconds"),
+    suite_count: firstNumber(report, attrs, metadata, "suite_count"),
+    testcase_count: firstNumber(report, attrs, metadata, "testcase_count"),
+    truncated: firstBoolean(report, attrs, metadata, "truncated") ?? undefined,
+    case_storage_policy: "bounded_raw_cases",
+    ...compactObject2(extraInput ?? {}),
+    redaction: Object.keys(redaction).length > 0 ? redaction : undefined
+  });
+}
+function upsertTestReportProjection(db, envelope, index) {
+  const attrs = objectRecord2(envelope.attributes);
+  const body = objectRecord2(envelope.body);
+  const report = objectRecord2(body.test_report);
+  const metadata = index.metadata ?? {};
+  if (Object.keys(report).length === 0 && !isTestReportCategory(attrs))
+    return;
+  const reportId = stringValue2(report.report_id) ?? stringValue2(attrs.report_id) ?? stringValue2(metadata.report_id) ?? index.event_id ?? envelope.event_id;
+  const suites = reportSuites(report, metadata);
+  const projected = projectedCases(reportId, suites);
+  const cases = projected.cases;
+  const projectionMetadata = sanitizedTestReportMetadata(report, metadata, attrs, {
+    projected_case_count: cases.length,
+    projected_case_limit: MAX_PROJECTED_TEST_REPORT_CASES
+  });
+  db.prepare(`
+    INSERT INTO test_reports (
+      id, event_id, source_event_id, project_id, machine_id, repo_id, app_id,
+      process_id, run_id, environment, source, event_time, path, format, parser,
+      parse_status, parse_error, size_bytes, content_hash, changed, mtime_ms,
+      tests, failures, errors, skipped, time_seconds, suite_count,
+      testcase_count, case_stored_count, truncated, metadata
+    )
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(id) DO UPDATE SET
+      event_id = excluded.event_id,
+      source_event_id = excluded.source_event_id,
+      project_id = COALESCE(excluded.project_id, test_reports.project_id),
+      machine_id = COALESCE(excluded.machine_id, test_reports.machine_id),
+      repo_id = COALESCE(excluded.repo_id, test_reports.repo_id),
+      app_id = COALESCE(excluded.app_id, test_reports.app_id),
+      process_id = COALESCE(excluded.process_id, test_reports.process_id),
+      run_id = COALESCE(excluded.run_id, test_reports.run_id),
+      environment = COALESCE(excluded.environment, test_reports.environment),
+      source = COALESCE(excluded.source, test_reports.source),
+      event_time = COALESCE(excluded.event_time, test_reports.event_time),
+      path = COALESCE(excluded.path, test_reports.path),
+      format = COALESCE(excluded.format, test_reports.format),
+      parser = COALESCE(excluded.parser, test_reports.parser),
+      parse_status = COALESCE(excluded.parse_status, test_reports.parse_status),
+      parse_error = COALESCE(excluded.parse_error, test_reports.parse_error),
+      size_bytes = COALESCE(excluded.size_bytes, test_reports.size_bytes),
+      content_hash = COALESCE(excluded.content_hash, test_reports.content_hash),
+      changed = COALESCE(excluded.changed, test_reports.changed),
+      mtime_ms = COALESCE(excluded.mtime_ms, test_reports.mtime_ms),
+      tests = COALESCE(excluded.tests, test_reports.tests),
+      failures = COALESCE(excluded.failures, test_reports.failures),
+      errors = COALESCE(excluded.errors, test_reports.errors),
+      skipped = COALESCE(excluded.skipped, test_reports.skipped),
+      time_seconds = COALESCE(excluded.time_seconds, test_reports.time_seconds),
+      suite_count = COALESCE(excluded.suite_count, test_reports.suite_count),
+      testcase_count = COALESCE(excluded.testcase_count, test_reports.testcase_count),
+      case_stored_count = excluded.case_stored_count,
+      truncated = excluded.truncated,
+      metadata = excluded.metadata
+  `).run(reportId, envelope.event_id, index.source_event_id ?? envelope.source_event_id ?? null, index.project_id ?? null, index.machine_id ?? null, index.repo_id ?? null, index.app_id ?? null, index.process_id ?? null, index.run_id ?? null, index.environment ?? null, envelope.source, envelope.event_time, stringValue2(report.path) ?? stringValue2(attrs.path) ?? stringValue2(metadata.path), stringValue2(report.format) ?? stringValue2(attrs.report_format) ?? stringValue2(metadata.report_format), stringValue2(report.parser) ?? stringValue2(attrs.parser) ?? stringValue2(metadata.parser), stringValue2(report.parse_status) ?? stringValue2(attrs.parse_status) ?? stringValue2(metadata.parse_status), sanitizedParseError(stringValue2(report.parse_error) ?? stringValue2(attrs.parse_error) ?? stringValue2(metadata.parse_error)), numberValue2(report.size_bytes) ?? numberValue2(attrs.size_bytes) ?? numberValue2(metadata.size_bytes), stringValue2(report.content_hash) ?? stringValue2(attrs.content_hash) ?? stringValue2(metadata.content_hash), stringValue2(report.changed) ?? stringValue2(attrs.changed) ?? stringValue2(metadata.changed), numberValue2(report.mtime_ms) ?? numberValue2(attrs.mtime_ms) ?? numberValue2(metadata.mtime_ms), numberValue2(report.tests) ?? numberValue2(attrs.tests) ?? numberValue2(metadata.tests), numberValue2(report.failures) ?? numberValue2(attrs.failures) ?? numberValue2(metadata.failures), numberValue2(report.errors) ?? numberValue2(attrs.errors) ?? numberValue2(metadata.errors), numberValue2(report.skipped) ?? numberValue2(attrs.skipped) ?? numberValue2(metadata.skipped), numberValue2(report.time_seconds) ?? numberValue2(attrs.time_seconds) ?? numberValue2(metadata.time_seconds), numberValue2(report.suite_count) ?? numberValue2(attrs.suite_count) ?? numberValue2(metadata.suite_count), numberValue2(report.testcase_count) ?? numberValue2(attrs.testcase_count) ?? numberValue2(metadata.testcase_count), cases.length, projected.truncated || boolValue(report.truncated) || boolValue(attrs.truncated) || boolValue(metadata.truncated) ? 1 : 0, JSON.stringify(projectionMetadata));
+  db.prepare("DELETE FROM test_cases WHERE report_id = ?").run(reportId);
+  const insertCase = db.prepare(`
+    INSERT INTO test_cases (
+      id, report_id, event_id, project_id, machine_id, repo_id, app_id,
+      process_id, run_id, environment, suite_name, suite_index, case_index,
+      name, classname, file, status, time_seconds, metadata
+    )
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(id) DO UPDATE SET
+      report_id = excluded.report_id,
+      event_id = excluded.event_id,
+      project_id = COALESCE(excluded.project_id, test_cases.project_id),
+      machine_id = COALESCE(excluded.machine_id, test_cases.machine_id),
+      repo_id = COALESCE(excluded.repo_id, test_cases.repo_id),
+      app_id = COALESCE(excluded.app_id, test_cases.app_id),
+      process_id = COALESCE(excluded.process_id, test_cases.process_id),
+      run_id = COALESCE(excluded.run_id, test_cases.run_id),
+      environment = COALESCE(excluded.environment, test_cases.environment),
+      suite_name = excluded.suite_name,
+      suite_index = excluded.suite_index,
+      case_index = excluded.case_index,
+      name = excluded.name,
+      classname = excluded.classname,
+      file = excluded.file,
+      status = excluded.status,
+      time_seconds = excluded.time_seconds,
+      metadata = excluded.metadata
+  `);
+  for (const testcase of cases) {
+    insertCase.run(testcase.id, testcase.report_id, envelope.event_id, index.project_id ?? null, index.machine_id ?? null, index.repo_id ?? null, index.app_id ?? null, index.process_id ?? null, index.run_id ?? null, index.environment ?? null, testcase.suite_name, testcase.suite_index, testcase.case_index, testcase.name, testcase.classname, testcase.file, testcase.status, testcase.time_seconds, JSON.stringify(testcase.metadata));
+  }
+}
+function projectedCases(reportId, suites) {
+  const cases = [];
+  let truncated = suites.length > MAX_PROJECTED_TEST_REPORT_SUITES;
+  suites.slice(0, MAX_PROJECTED_TEST_REPORT_SUITES).forEach((suite, suiteIndex) => {
+    const suiteName = stringValue2(suite.name);
+    const suiteCases = objectArray(suite.cases);
+    const remaining = MAX_PROJECTED_TEST_REPORT_CASES - cases.length;
+    if (remaining <= 0) {
+      if (suiteCases.length > 0)
+        truncated = true;
+      return;
+    }
+    if (suiteCases.length > remaining)
+      truncated = true;
+    suiteCases.slice(0, remaining).forEach((testcase, caseIndex) => {
+      const name = stringValue2(testcase.name);
+      const classname = stringValue2(testcase.classname);
+      const file = stringValue2(testcase.file);
+      const status = stringValue2(testcase.status);
+      const timeSeconds = numberValue2(testcase.time_seconds);
+      cases.push({
+        id: testcaseProjectionId(reportId, suiteIndex, caseIndex),
+        report_id: reportId,
+        suite_name: suiteName,
+        suite_index: suiteIndex,
+        case_index: caseIndex,
+        name,
+        classname,
+        file,
+        status,
+        time_seconds: timeSeconds,
+        metadata: sanitizedTestCaseMetadata(testcase, suiteName, suiteIndex, caseIndex)
+      });
+    });
+  });
+  return { cases, truncated };
+}
+function sanitizedTestCaseMetadata(testcase, suiteName, suiteIndex, caseIndex) {
+  return compactObject2({
+    suite_name: suiteName,
+    suite_index: suiteIndex,
+    case_index: caseIndex,
+    name: stringValue2(testcase.name),
+    classname: stringValue2(testcase.classname),
+    file: stringValue2(testcase.file),
+    status: stringValue2(testcase.status),
+    time_seconds: numberValue2(testcase.time_seconds),
+    case_storage_policy: "bounded_raw_cases"
+  });
+}
+function reportSuites(report, metadata) {
+  const reportSuites2 = objectArray(report.suites);
+  if (reportSuites2.length > 0)
+    return reportSuites2;
+  return objectArray(metadata.suites);
+}
+function testcaseProjectionId(reportId, suiteIndex, caseIndex) {
+  const digest = createHash3("sha256").update(reportId).update("\x00").update(String(suiteIndex)).update("\x00").update(String(caseIndex)).digest("hex").slice(0, 32);
+  return `testcase_${digest}`;
+}
+function isTestReportCategory(attrs) {
+  return stringValue2(attrs.category) === "test_report";
+}
+function objectRecord2(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function objectArray(value) {
+  if (!Array.isArray(value))
+    return [];
+  return value.flatMap((item) => {
+    const record = objectRecord2(item);
+    return Object.keys(record).length > 0 ? [record] : [];
+  });
+}
+function compactObject2(value) {
+  return Object.fromEntries(Object.entries(value).filter(([, item]) => item !== undefined && item !== null));
+}
+function stringValue2(value) {
+  if (typeof value === "string")
+    return value;
+  if (typeof value === "number" || typeof value === "bigint")
+    return String(value);
+  return null;
+}
+function firstString2(first, second, thirdOrKey, maybeKey) {
+  const records = typeof thirdOrKey === "string" ? [first, second] : [first, second, thirdOrKey];
+  const key = typeof thirdOrKey === "string" ? thirdOrKey : maybeKey;
+  if (!key)
+    return null;
+  for (const record of records) {
+    const value = stringValue2(record[key]);
+    if (value !== null)
+      return value;
+  }
+  return null;
+}
+function sanitizedParseError(value) {
+  if (value === null)
+    return null;
+  const trimmed = value.trim();
+  if (!trimmed)
+    return null;
+  if (containsRawTestReportPayload(trimmed))
+    return REDACTED_PARSE_ERROR;
+  if (trimmed.length <= MAX_PROJECTED_PARSE_ERROR_LENGTH)
+    return trimmed;
+  return `${trimmed.slice(0, MAX_PROJECTED_PARSE_ERROR_LENGTH)}... [truncated]`;
+}
+function containsRawTestReportPayload(value) {
+  return /<\s*(testsuites?|testcase|system-out|system-err|failure|error)\b/i.test(value) || /\b(system-out|system_err|system-err|raw_xml)\b/i.test(value) || /failure body/i.test(value);
+}
+function numberValue2(value) {
+  if (typeof value === "number" && Number.isFinite(value))
+    return value;
+  if (typeof value === "string" && value.trim().length > 0) {
+    const parsed = Number(value);
+    if (Number.isFinite(parsed))
+      return parsed;
+  }
+  return null;
+}
+function firstNumber(first, second, third, key) {
+  return numberValue2(first[key]) ?? numberValue2(second[key]) ?? numberValue2(third[key]);
+}
+function boolValue(value) {
+  if (typeof value === "boolean")
+    return value;
+  if (typeof value === "number")
+    return value !== 0;
+  if (typeof value === "string")
+    return value === "true" || value === "1" || value === "yes";
+  return false;
+}
+function firstBoolean(first, second, third, key) {
+  for (const record of [first, second, third]) {
+    if (record[key] !== undefined && record[key] !== null)
+      return boolValue(record[key]);
+  }
+  return null;
+}
+
+// src/lib/event-store.ts
+var dbDataDirs = new WeakMap;
+var dbLockDepths = new WeakMap;
+function setEventStoreDataDir(db, dataDir) {
+  dbDataDirs.set(db, dataDir);
+}
+function getEventStoreDataDir(db) {
+  const mapped = dbDataDirs.get(db);
+  if (mapped)
+    return mapped;
+  const explicit = process.env.HASNA_LOGS_DATA_DIR ?? process.env.LOGS_DATA_DIR;
+  if (explicit)
+    return explicit;
+  return join(process.env.HOME ?? "~", ".hasna", "logs");
+}
+function appendRawEvent(db, event) {
+  return withEventStoreLock(db, () => {
+    const line = Buffer.from(`${JSON.stringify(event)}
+`, "utf8");
+    const candidate = getActiveSegment(db, event.ingest_time, line.byteLength);
+    const absolutePath = resolveDataPath(db, candidate.relative_path);
+    mkdirSync(dirname(absolutePath), { recursive: true });
+    const byteOffset = existsSync(absolutePath) ? statSync(absolutePath).size : 0;
+    appendAndFlush(absolutePath, line);
+    const byteLength = line.byteLength;
+    const currentSize = byteOffset + byteLength;
+    const recordHash = sha256(line);
+    const segmentHash = shouldHashSegmentOnAppend() ? sha256(readFileSync(absolutePath)) : null;
+    db.prepare(`
+      INSERT INTO event_segments (
+        id, relative_path, manifest_path, byte_length, event_count,
+        first_event_time, last_event_time, segment_hash, updated_at
+      )
+      VALUES (?, ?, ?, ?, 1, ?, ?, ?, strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+      ON CONFLICT(id) DO UPDATE SET
+        byte_length = excluded.byte_length,
+        event_count = event_segments.event_count + 1,
+        first_event_time = COALESCE(event_segments.first_event_time, excluded.first_event_time),
+        last_event_time = excluded.last_event_time,
+        segment_hash = excluded.segment_hash,
+        updated_at = strftime('%Y-%m-%dT%H:%M:%fZ','now')
+    `).run(candidate.id, candidate.relative_path, candidate.manifest_path, currentSize, event.event_time, event.event_time, segmentHash);
+    writeSegmentManifest(db, candidate.id);
+    return {
+      segment_id: candidate.id,
+      segment_path: candidate.relative_path,
+      manifest_path: candidate.manifest_path,
+      byte_offset: byteOffset,
+      byte_length: byteLength,
+      record_hash: recordHash
+    };
+  });
+}
+function indexRawEvent(db, event, write) {
+  const existing = getEventRecord(db, event.event_id);
+  if (existing) {
+    if (matchesRawEventIndex(existing, event, write))
+      return;
+    throw new Error(`Event record already indexed with different raw pointer: ${event.event_id}`);
+  }
+  db.prepare(`
+    INSERT INTO event_records (
+      event_id, schema_version, source_event_id, event_type, event_time, ingest_time,
+      severity, source, project_id, page_id, log_id, trace_id, session_id,
+      machine_id, repo_id, app_id, process_id, run_id, span_id, parent_span_id,
+      release_id, environment, artifact_id, privacy_tier,
+      segment_id, segment_path, byte_offset, byte_length, record_hash,
+      message, metadata
+    )
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+  `).run(event.event_id, event.schema_version ?? 1, event.source_event_id ?? null, event.event_type, event.event_time, event.ingest_time, event.severity ?? null, event.source, event.project_id ?? null, event.page_id ?? null, event.log_id ?? null, event.trace_id ?? null, event.session_id ?? null, event.machine_id ?? null, event.repo_id ?? null, event.app_id ?? null, event.process_id ?? null, event.run_id ?? null, event.span_id ?? null, event.parent_span_id ?? null, event.release_id ?? null, event.environment ?? null, event.artifact_id ?? null, event.privacy_tier ?? null, write.segment_id, write.segment_path, write.byte_offset, write.byte_length, write.record_hash, event.message ?? null, event.metadata ? JSON.stringify(event.metadata) : null);
+}
+function matchesRawEventIndex(existing, event, write) {
+  return existing.schema_version === (event.schema_version ?? 1) && existing.source_event_id === (event.source_event_id ?? null) && existing.event_type === event.event_type && existing.event_time === event.event_time && existing.ingest_time === event.ingest_time && existing.source === event.source && existing.segment_id === write.segment_id && existing.segment_path === write.segment_path && existing.byte_offset === write.byte_offset && existing.byte_length === write.byte_length && existing.record_hash === write.record_hash;
+}
+function getEventRecord(db, eventId) {
+  const row = db.prepare("SELECT * FROM event_records WHERE event_id = ?").get(eventId);
+  return row ?? null;
+}
+function readRawEvent(db, eventOrRecord) {
+  const record = typeof eventOrRecord === "string" ? getEventRecord(db, eventOrRecord) : eventOrRecord;
+  if (!record)
+    return null;
+  const bytes = readFileSync(resolveDataPath(db, record.segment_path));
+  const line = bytes.subarray(record.byte_offset, record.byte_offset + record.byte_length);
+  const actualHash = sha256(line);
+  if (actualHash !== record.record_hash) {
+    throw new Error(`Raw event hash mismatch for ${record.event_id}`);
+  }
+  return JSON.parse(line.toString("utf8"));
+}
+function verifyEventStore(db) {
+  const errors = [];
+  const segments = db.prepare("SELECT * FROM event_segments ORDER BY relative_path").all();
+  const records = db.prepare("SELECT * FROM event_records ORDER BY event_time, event_id").all();
+  const segmentsByPath = new Map(segments.map((segment) => [segment.relative_path, segment]));
+  const recordsByEventId = new Map(records.map((record) => [record.event_id, record]));
+  const paths = [
+    ...new Set([
+      ...segments.map((segment) => segment.relative_path),
+      ...listSegmentFiles(db)
+    ])
+  ].sort();
+  let checkedRawEvents = 0;
+  let unindexedRawEvents = 0;
+  for (const relativePath of paths) {
+    const segment = segmentsByPath.get(relativePath);
+    try {
+      const path = resolveDataPath(db, relativePath);
+      if (!existsSync(path)) {
+        errors.push(`Missing segment file: ${relativePath}`);
+        continue;
+      }
+      const scan = scanSegmentEvents(db, relativePath, { strict: false });
+      checkedRawEvents += scan.events.length;
+      errors.push(...scan.errors);
+      if (!segment) {
+        errors.push(`Segment file is not indexed in SQLite: ${relativePath}`);
+      } else {
+        if (scan.byte_length !== segment.byte_length) {
+          errors.push(`Segment size mismatch for ${relativePath}: sqlite=${segment.byte_length} file=${scan.byte_length}`);
+        }
+        if (segment.segment_hash && scan.segment_hash !== segment.segment_hash) {
+          errors.push(`Segment hash mismatch for ${relativePath}`);
+        }
+        if (segment.manifest_path && !existsSync(resolveDataPath(db, segment.manifest_path))) {
+          errors.push(`Missing segment manifest: ${segment.manifest_path}`);
+        }
+        if (scan.events.length !== segment.event_count) {
+          errors.push(`Segment event count mismatch for ${relativePath}: sqlite=${segment.event_count} file=${scan.events.length}`);
+        }
+      }
+      for (const item of scan.events) {
+        const record = recordsByEventId.get(item.event.event_id);
+        if (!record) {
+          unindexedRawEvents += 1;
+          errors.push(`Raw event is not indexed in SQLite: ${item.event.event_id} at ${relativePath}:${item.write.byte_offset}`);
+          continue;
+        }
+        if (record.segment_path !== item.write.segment_path || record.byte_offset !== item.write.byte_offset || record.byte_length !== item.write.byte_length) {
+          errors.push(`Raw event pointer mismatch for ${item.event.event_id}`);
+        }
+        if (record.record_hash !== item.write.record_hash) {
+          errors.push(`Raw event hash index mismatch for ${item.event.event_id}`);
+        }
+      }
+    } catch (error) {
+      errors.push(errorMessage(error));
+    }
+  }
+  for (const record of records) {
+    try {
+      const raw = readRawEvent(db, record);
+      if (raw?.event_id !== record.event_id) {
+        errors.push(`Raw event id mismatch for ${record.event_id}`);
+      }
+      if (raw?.event_time !== record.event_time) {
+        errors.push(`Raw event time mismatch for ${record.event_id}`);
+      }
+    } catch (error) {
+      errors.push(errorMessage(error));
+    }
+  }
+  return {
+    ok: errors.length === 0,
+    checked_records: records.length,
+    checked_segments: paths.length,
+    checked_raw_events: checkedRawEvents,
+    unindexed_raw_events: unindexedRawEvents,
+    errors
+  };
+}
+function rebuildEventStoreIndex(db) {
+  return withEventStoreLock(db, () => rebuildEventStoreIndexLocked(db));
+}
+function rebuildEventStoreIndexLocked(db) {
+  const segmentPaths = listSegmentFiles(db);
+  let indexedEvents = 0;
+  let skippedEvents = 0;
+  const errors = [];
+  db.transaction(() => {
+    db.run("DELETE FROM event_records");
+    db.run("DELETE FROM event_segments");
+    clearCompatibilityProjections(db);
+    for (const path of segmentPaths) {
+      const scan = scanSegmentEvents(db, path, { strict: false });
+      errors.push(...scan.errors);
+      const candidate = segmentCandidate(path);
+      const first = scan.events[0]?.event.event_time ?? null;
+      const last = scan.events.at(-1)?.event.event_time ?? null;
+      db.prepare(`
+        INSERT INTO event_segments (
+          id, relative_path, manifest_path, byte_length, event_count,
+          first_event_time, last_event_time, segment_hash, updated_at
+        )
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+      `).run(candidate.id, candidate.relative_path, candidate.manifest_path, scan.byte_length, scan.events.length, first, last, scan.segment_hash);
+      for (const item of scan.events) {
+        try {
+          const index = eventIndexFromEnvelope(db, item.event);
+          if (item.event.type === "log")
+            replayLogProjection(db, item.event, index);
+          indexRawEvent(db, index, item.write);
+          applyReplayedCompatibilityProjections(db, item.event, index);
+          indexedEvents += 1;
+        } catch (error) {
+          skippedEvents += 1;
+          errors.push(`Skipped raw event ${item.event.event_id} from ${path}:${item.write.byte_offset}: ${errorMessage(error)}`);
+        }
+      }
+      writeSegmentManifest(db, candidate.id);
+    }
+  })();
+  return {
+    indexed_events: indexedEvents,
+    indexed_segments: segmentPaths.length,
+    skipped_events: skippedEvents,
+    errors
+  };
+}
+function repairEventStoreSegments(db, options = {}) {
+  const apply = options.apply === true;
+  if (apply)
+    return withEventStoreLock(db, () => repairEventStoreSegmentsLocked(db, true));
+  return repairEventStoreSegmentsLocked(db, false);
+}
+function repairEventStoreSegmentsLocked(db, apply) {
+  const segmentPaths = listSegmentFiles(db);
+  const repairs = [];
+  const errors = [];
+  for (const segmentPath of segmentPaths) {
+    try {
+      const plan = planSegmentRepair(db, segmentPath);
+      if (plan.repair.removed_lines.length === 0)
+        continue;
+      if (apply)
+        applySegmentRepair(db, plan);
+      repairs.push({ ...plan.repair, applied: apply });
+    } catch (error) {
+      errors.push(`Failed to repair ${segmentPath}: ${errorMessage(error)}`);
+    }
+  }
+  let rebuild;
+  let verification;
+  if (apply) {
+    rebuild = rebuildEventStoreIndex(db);
+    verification = verifyEventStore(db);
+  }
+  return {
+    applied: apply,
+    scanned_segments: segmentPaths.length,
+    repaired_segments: repairs.length,
+    quarantined_bytes: repairs.reduce((total, repair) => total + repair.removed_bytes, 0),
+    repairs,
+    rebuild,
+    verification,
+    errors
+  };
+}
+function getActiveSegment(db, ingestTime, eventByteLength) {
+  const prefix = segmentPrefix(ingestTime);
+  const maxSegmentBytes = getMaxSegmentBytes();
+  const latest = db.prepare(`
+      SELECT id, relative_path, byte_length, sealed_at
+      FROM event_segments
+      WHERE relative_path LIKE ?
+      ORDER BY relative_path DESC
+      LIMIT 1
+    `).get(`${prefix}/events-%.jsonl`);
+  if (latest && !latest.sealed_at && latest.byte_length + eventByteLength <= maxSegmentBytes) {
+    return segmentCandidate(latest.relative_path);
+  }
+  if (latest && !latest.sealed_at) {
+    sealSegment(db, latest.id);
+  }
+  const lastSequence = latest ? parseSegmentSequence(latest.relative_path) : 0;
+  return segmentCandidate(`${prefix}/events-${String(lastSequence + 1).padStart(6, "0")}.jsonl`);
+}
+function segmentPrefix(isoTime) {
+  const date = new Date(isoTime);
+  const valid = Number.isNaN(date.getTime()) ? new Date : date;
+  const year = valid.getUTCFullYear();
+  const month = String(valid.getUTCMonth() + 1).padStart(2, "0");
+  const day = String(valid.getUTCDate()).padStart(2, "0");
+  return `segments/${year}/${month}/${day}`;
+}
+function segmentCandidate(relativePath) {
+  return {
+    id: sha256(relativePath).slice(0, 24),
+    relative_path: relativePath,
+    manifest_path: relativePath.replace(/\.jsonl$/, ".manifest.json")
+  };
+}
+function parseSegmentSequence(relativePath) {
+  const match = /events-(\d+)\.jsonl$/.exec(relativePath);
+  return match?.[1] ? Number.parseInt(match[1], 10) : 0;
+}
+function writeSegmentManifest(db, segmentId) {
+  const segment = db.prepare("SELECT * FROM event_segments WHERE id = ?").get(segmentId);
+  if (!segment || typeof segment.manifest_path !== "string")
+    return;
+  const manifestPath = resolveDataPath(db, segment.manifest_path);
+  mkdirSync(dirname(manifestPath), { recursive: true });
+  writeFileSync(manifestPath, `${JSON.stringify({ schema_version: 1, segment }, null, 2)}
+`, "utf8");
+}
+function scanSegmentEvents(db, relativePath, options) {
+  const absolutePath = resolveDataPath(db, relativePath);
+  const bytes = readFileSync(absolutePath);
+  const candidate = segmentCandidate(relativePath);
+  const events = [];
+  const errors = [];
+  let offset = 0;
+  while (offset < bytes.byteLength) {
+    const newline = bytes.indexOf(10, offset);
+    if (newline === -1) {
+      const message = `Partial raw event line in ${relativePath} at byte ${offset}`;
+      if (options.strict)
+        throw new Error(message);
+      errors.push(message);
+      break;
+    }
+    const end = newline + 1;
+    const line = bytes.subarray(offset, end);
+    if (line.toString("utf8").trim().length > 0) {
+      try {
+        const event = JSON.parse(line.toString("utf8"));
+        events.push({
+          event,
+          write: {
+            segment_id: candidate.id,
+            segment_path: candidate.relative_path,
+            manifest_path: candidate.manifest_path,
+            byte_offset: offset,
+            byte_length: line.byteLength,
+            record_hash: sha256(line)
+          }
+        });
+      } catch (error) {
+        const message = `Malformed raw event line in ${relativePath} at byte ${offset}: ${errorMessage(error)}`;
+        if (options.strict)
+          throw new Error(message);
+        errors.push(message);
+      }
+    }
+    offset = end;
+  }
+  return {
+    events,
+    errors,
+    byte_length: bytes.byteLength,
+    segment_hash: sha256(bytes)
+  };
+}
+function planSegmentRepair(db, relativePath) {
+  const absolutePath = resolveDataPath(db, relativePath);
+  const bytes = readFileSync(absolutePath);
+  const originalHash = sha256(bytes);
+  const retainedChunks = [];
+  const quarantineChunks = [];
+  const removedLines = [];
+  let retainedEvents = 0;
+  let malformedLines = 0;
+  let partialTruncated = false;
+  let offset = 0;
+  while (offset < bytes.byteLength) {
+    const newline = bytes.indexOf(10, offset);
+    if (newline === -1) {
+      const line2 = bytes.subarray(offset);
+      const message = `Partial raw event line in ${relativePath} at byte ${offset}`;
+      quarantineChunks.push(line2);
+      removedLines.push({
+        byte_offset: offset,
+        byte_length: line2.byteLength,
+        reason: "partial",
+        message
+      });
+      partialTruncated = true;
+      break;
+    }
+    const end = newline + 1;
+    const line = bytes.subarray(offset, end);
+    if (line.toString("utf8").trim().length === 0) {
+      retainedChunks.push(line);
+      offset = end;
+      continue;
+    }
+    try {
+      JSON.parse(line.toString("utf8"));
+      retainedChunks.push(line);
+      retainedEvents += 1;
+    } catch (error) {
+      const message = `Malformed raw event line in ${relativePath} at byte ${offset}: ${errorMessage(error)}`;
+      quarantineChunks.push(line);
+      removedLines.push({
+        byte_offset: offset,
+        byte_length: line.byteLength,
+        reason: "malformed",
+        message
+      });
+      malformedLines += 1;
+    }
+    offset = end;
+  }
+  const repairedBytes = Buffer.concat(retainedChunks);
+  const quarantineBytes = Buffer.concat(quarantineChunks);
+  const repairedHash = sha256(repairedBytes);
+  const quarantinePath = quarantinePathForSegment(relativePath, originalHash);
+  const quarantineManifestPath = quarantinePath.replace(/\.bad$/, ".manifest.json");
+  return {
+    repaired_bytes: repairedBytes,
+    quarantine_bytes: quarantineBytes,
+    repair: {
+      segment_path: relativePath,
+      quarantine_path: quarantinePath,
+      quarantine_manifest_path: quarantineManifestPath,
+      original_byte_length: bytes.byteLength,
+      repaired_byte_length: repairedBytes.byteLength,
+      original_hash: originalHash,
+      repaired_hash: repairedHash,
+      retained_events: retainedEvents,
+      removed_lines: removedLines,
+      removed_bytes: quarantineBytes.byteLength,
+      partial_truncated: partialTruncated,
+      malformed_lines: malformedLines,
+      applied: false
+    }
+  };
+}
+function applySegmentRepair(db, plan) {
+  const repair = plan.repair;
+  const segmentPath = resolveDataPath(db, repair.segment_path);
+  const quarantinePath = resolveDataPath(db, repair.quarantine_path);
+  const quarantineManifestPath = resolveDataPath(db, repair.quarantine_manifest_path);
+  mkdirSync(dirname(quarantinePath), { recursive: true });
+  mkdirSync(dirname(quarantineManifestPath), { recursive: true });
+  writeFileSync(quarantinePath, plan.quarantine_bytes);
+  writeFileSync(quarantineManifestPath, `${JSON.stringify({
+    schema_version: 1,
+    original_segment_path: repair.segment_path,
+    quarantine_path: repair.quarantine_path,
+    original_byte_length: repair.original_byte_length,
+    repaired_byte_length: repair.repaired_byte_length,
+    original_hash: repair.original_hash,
+    repaired_hash: repair.repaired_hash,
+    removed_bytes: repair.removed_bytes,
+    removed_lines: repair.removed_lines,
+    repaired_at: new Date().toISOString()
+  }, null, 2)}
+`, "utf8");
+  const tmpPath = `${segmentPath}.repair-${process.pid}-${Date.now()}.tmp`;
+  writeFileSync(tmpPath, plan.repaired_bytes);
+  renameSync(tmpPath, segmentPath);
+}
+function quarantinePathForSegment(relativePath, originalHash) {
+  return `quarantine/${relativePath.replace(/\.jsonl$/, `.${originalHash.slice(0, 12)}.bad`)}`;
+}
+function listSegmentFiles(db) {
+  const root = resolveDataPath(db, "segments");
+  if (!existsSync(root))
+    return [];
+  const paths = [];
+  walkSegmentDir(root, "segments", paths);
+  return paths.filter((path) => path.endsWith(".jsonl")).sort();
+}
+function walkSegmentDir(absoluteDir, relativeDir, paths) {
+  for (const entry of readdirSync(absoluteDir, { withFileTypes: true })) {
+    const relativePath = `${relativeDir}/${entry.name}`;
+    const absolutePath = join(absoluteDir, entry.name);
+    if (entry.isDirectory()) {
+      walkSegmentDir(absolutePath, relativePath, paths);
+    } else if (entry.isFile()) {
+      paths.push(relativePath);
+    }
+  }
+}
+function hasSourceMapContainer(record) {
+  if (Object.keys(objectRecord3(record.source_map)).length > 0)
+    return true;
+  const artifact = objectRecord3(record.artifact);
+  if (Object.keys(objectRecord3(artifact.source_map)).length > 0)
+    return true;
+  const artifactType = stringAttribute(record, "artifact_type") ?? stringAttribute(record, "type") ?? stringAttribute(artifact, "artifact_type") ?? stringAttribute(artifact, "type");
+  const path = stringAttribute(record, "path") ?? stringAttribute(artifact, "path");
+  return artifactType === "source_map" || artifactType === "source-map" || artifactType === "sourcemap" || Boolean(path?.endsWith(".map"));
+}
+function eventIndexFromEnvelope(db, event) {
+  const rawAttrs = objectRecord3(event.attributes);
+  const rawBody = objectRecord3(event.body);
+  const body = event.type === "artifact" ? sanitizeSourceMapArtifactRecord(rawBody) : rawBody;
+  const artifact = sanitizeSourceMapArtifactRecord(objectRecord3(rawBody.artifact));
+  const attrs = event.type === "artifact" && (hasSourceMapContainer(body) || hasSourceMapContainer(artifact) || hasSourceMapContainer(rawAttrs)) ? sanitizeSourceMapContextRecord(rawAttrs) : rawAttrs;
+  const log = objectRecord3(event.body?.log);
+  const rawProjectId = stringAttribute(attrs, "project_id") ?? stringAttribute(log, "project_id");
+  const rawPageId = stringAttribute(attrs, "page_id") ?? stringAttribute(log, "page_id");
+  return {
+    event_id: event.event_id,
+    schema_version: event.schema_version,
+    source_event_id: event.source_event_id ?? null,
+    event_type: event.type,
+    event_time: event.event_time,
+    ingest_time: event.ingest_time,
+    severity: event.severity ?? null,
+    source: event.source,
+    project_id: rawProjectId && rowExists(db, "projects", rawProjectId) ? rawProjectId : null,
+    page_id: rawPageId && rowExists(db, "pages", rawPageId) ? rawPageId : null,
+    log_id: event.type === "log" ? event.event_id : null,
+    machine_id: event.machine_id ?? stringAttribute(attrs, "machine_id"),
+    repo_id: event.repo_id ?? stringAttribute(attrs, "repo_id"),
+    app_id: event.app_id ?? stringAttribute(attrs, "app_id"),
+    process_id: event.process_id ?? stringAttribute(attrs, "process_id"),
+    run_id: event.run_id ?? stringAttribute(attrs, "run_id"),
+    trace_id: event.trace_id ?? stringAttribute(attrs, "trace_id") ?? stringAttribute(log, "trace_id"),
+    span_id: event.span_id ?? stringAttribute(attrs, "span_id"),
+    parent_span_id: event.parent_span_id ?? stringAttribute(attrs, "parent_span_id"),
+    session_id: event.session_id ?? stringAttribute(attrs, "session_id") ?? stringAttribute(log, "session_id"),
+    release_id: event.release_id ?? stringAttribute(attrs, "release_id"),
+    environment: event.environment ?? stringAttribute(attrs, "environment"),
+    artifact_id: stringAttribute(attrs, "artifact_id") ?? stringAttribute(body, "artifact_id") ?? stringAttribute(artifact, "artifact_id"),
+    privacy_tier: event.privacy ?? stringAttribute(attrs, "privacy_tier"),
+    message: event.message ?? null,
+    metadata: metadataFromEnvelope(event)
+  };
+}
+function clearCompatibilityProjections(db) {
+  db.run("DELETE FROM issues");
+  db.run("DELETE FROM logs");
+  db.run("DELETE FROM spans");
+  db.run("DELETE FROM traces");
+  db.run("DELETE FROM sessions");
+  db.run("DELETE FROM source_map_sources");
+  db.run("DELETE FROM source_maps");
+  db.run("DELETE FROM test_cases");
+  db.run("DELETE FROM test_reports");
+  db.run("DELETE FROM artifacts");
+  db.run("DELETE FROM releases");
+  db.run("DELETE FROM processes");
+  db.run("DELETE FROM runs");
+}
+function applyReplayedCompatibilityProjections(db, event, index) {
+  const attrs = objectRecord3(event.attributes);
+  const category = stringAttribute(attrs, "category");
+  const isCommandRunSummary = event.type === "build" && category === "command_run_summary";
+  const isTestReportEvent = event.type === "build" && category === "test_report";
+  if (index.trace_id)
+    replayTraceProjection(db, event, index);
+  if (event.type === "span")
+    replaySpanProjection(db, event, index);
+  if (index.session_id || event.type === "session")
+    replaySessionProjection(db, event, index);
+  if (index.release_id || event.type === "release")
+    replayReleaseProjection(db, event, index);
+  if (index.artifact_id || event.type === "artifact") {
+    replayArtifactProjection(db, event, index);
+    upsertSourceMapProjection(db, event, index);
+  }
+  if (isTestReportEvent)
+    upsertTestReportProjection(db, event, index);
+  if (isCommandRunSummary) {
+    replayProcessRunProjection(db, event, index, {
+      preserveExistingMetadata: true
+    });
+  } else if (!isTestReportEvent && (index.process_id || index.run_id || event.type === "process" || event.type === "build")) {
+    replayProcessRunProjection(db, event, index);
+  }
+  replayIssueProjection(db, event, index);
+}
+function replayLogProjection(db, event, index) {
+  const log = objectRecord3(event.body?.log);
+  const level = normalizeLogLevel(event.severity ?? stringAttribute(log, "level"));
+  const metadata = objectRecord3(log.metadata);
+  db.prepare(`
+    INSERT INTO logs (id, timestamp, project_id, page_id, level, source, service, message, trace_id, session_id, agent, url, stack_trace, metadata)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(id) DO UPDATE SET
+      timestamp = excluded.timestamp,
+      project_id = excluded.project_id,
+      page_id = excluded.page_id,
+      level = excluded.level,
+      source = excluded.source,
+      service = excluded.service,
+      message = excluded.message,
+      trace_id = excluded.trace_id,
+      session_id = excluded.session_id,
+      agent = excluded.agent,
+      url = excluded.url,
+      stack_trace = excluded.stack_trace,
+      metadata = excluded.metadata
+  `).run(event.event_id, event.event_time, index.project_id ?? null, index.page_id ?? null, level, stringAttribute(log, "source") ?? event.source, stringAttribute(log, "service") ?? stringAttribute(objectRecord3(event.attributes), "service"), stringAttribute(log, "message") ?? event.message ?? "", index.trace_id ?? null, index.session_id ?? null, stringAttribute(log, "agent"), stringAttribute(log, "url"), stringAttribute(log, "stack_trace"), Object.keys(metadata).length > 0 ? JSON.stringify(metadata) : null);
+}
+function replayTraceProjection(db, event, index) {
+  if (!index.trace_id)
+    return;
+  const attrs = objectRecord3(event.attributes);
+  const body = objectRecord3(event.body);
+  db.prepare(`
+    INSERT INTO traces (id, project_id, app_id, root_span_id, started_at, ended_at, status, metadata)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(id) DO UPDATE SET
+      project_id = COALESCE(traces.project_id, excluded.project_id),
+      app_id = COALESCE(traces.app_id, excluded.app_id),
+      root_span_id = COALESCE(traces.root_span_id, excluded.root_span_id),
+      started_at = CASE
+        WHEN excluded.started_at IS NOT NULL
+          AND (traces.started_at IS NULL OR excluded.started_at < traces.started_at)
+        THEN excluded.started_at
+        ELSE traces.started_at
+      END,
+      ended_at = COALESCE(excluded.ended_at, traces.ended_at),
+      status = COALESCE(excluded.status, traces.status),
+      metadata = excluded.metadata
+  `).run(index.trace_id, index.project_id ?? null, index.app_id ?? null, index.span_id ?? null, stringAttribute(attrs, "started_at") ?? event.event_time, stringAttribute(attrs, "ended_at") ?? stringAttribute(body, "ended_at"), stringAttribute(attrs, "status") ?? stringAttribute(body, "status"), JSON.stringify(index.metadata ?? {}));
+}
+function replaySpanProjection(db, event, index) {
+  const attrs = objectRecord3(event.attributes);
+  const body = objectRecord3(event.body);
+  const spanId = index.span_id ?? event.event_id;
+  db.prepare(`
+    INSERT INTO spans (id, trace_id, parent_span_id, app_id, process_id, name, operation, status, started_at, ended_at, duration_ms, metadata)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(id) DO UPDATE SET
+      trace_id = COALESCE(spans.trace_id, excluded.trace_id),
+      parent_span_id = COALESCE(spans.parent_span_id, excluded.parent_span_id),
+      app_id = COALESCE(spans.app_id, excluded.app_id),
+      process_id = COALESCE(spans.process_id, excluded.process_id),
+      name = COALESCE(spans.name, excluded.name),
+      operation = COALESCE(spans.operation, excluded.operation),
+      ended_at = COALESCE(excluded.ended_at, spans.ended_at),
+      duration_ms = COALESCE(excluded.duration_ms, spans.duration_ms),
+      status = COALESCE(excluded.status, spans.status),
+      metadata = excluded.metadata
+  `).run(spanId, index.trace_id ?? null, index.parent_span_id ?? null, index.app_id ?? null, index.process_id ?? null, stringAttribute(attrs, "name") ?? stringAttribute(body, "name") ?? event.message ?? null, stringAttribute(attrs, "operation") ?? stringAttribute(body, "operation"), stringAttribute(attrs, "status") ?? event.severity ?? null, stringAttribute(attrs, "started_at") ?? event.event_time, stringAttribute(attrs, "ended_at"), numberAttribute(attrs, "duration_ms") ?? numberAttribute(body, "duration_ms"), JSON.stringify(index.metadata ?? {}));
+}
+function replaySessionProjection(db, event, index) {
+  const attrs = objectRecord3(event.attributes);
+  const sessionId = index.session_id ?? event.event_id;
+  db.prepare(`
+    INSERT INTO sessions (id, project_id, app_id, user_hash, started_at, ended_at, status, metadata)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(id) DO UPDATE SET
+      project_id = COALESCE(sessions.project_id, excluded.project_id),
+      app_id = COALESCE(sessions.app_id, excluded.app_id),
+      user_hash = COALESCE(sessions.user_hash, excluded.user_hash),
+      started_at = CASE
+        WHEN excluded.started_at IS NOT NULL
+          AND (sessions.started_at IS NULL OR excluded.started_at < sessions.started_at)
+        THEN excluded.started_at
+        ELSE sessions.started_at
+      END,
+      ended_at = COALESCE(excluded.ended_at, sessions.ended_at),
+      status = COALESCE(excluded.status, sessions.status),
+      metadata = excluded.metadata
+  `).run(sessionId, index.project_id ?? null, index.app_id ?? null, stringAttribute(attrs, "user_hash"), stringAttribute(attrs, "started_at") ?? event.event_time, stringAttribute(attrs, "ended_at"), stringAttribute(attrs, "status"), JSON.stringify(index.metadata ?? {}));
+}
+function replayReleaseProjection(db, event, index) {
+  const attrs = objectRecord3(event.attributes);
+  const releaseId = index.release_id ?? event.event_id;
+  db.prepare(`
+    INSERT INTO releases (id, project_id, app_id, version, commit_sha, build_id, deployed_at, metadata)
+    VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(id) DO UPDATE SET
+      project_id = COALESCE(releases.project_id, excluded.project_id),
+      app_id = COALESCE(releases.app_id, excluded.app_id),
+      version = COALESCE(releases.version, excluded.version),
+      commit_sha = COALESCE(releases.commit_sha, excluded.commit_sha),
+      build_id = COALESCE(releases.build_id, excluded.build_id),
+      deployed_at = COALESCE(excluded.deployed_at, releases.deployed_at),
+      metadata = excluded.metadata
+  `).run(releaseId, index.project_id ?? null, index.app_id ?? null, stringAttribute(attrs, "version") ?? event.message ?? null, stringAttribute(attrs, "commit_sha"), stringAttribute(attrs, "build_id"), stringAttribute(attrs, "deployed_at") ?? event.event_time, JSON.stringify(index.metadata ?? {}));
+}
+function replayArtifactProjection(db, event, index) {
+  const sanitizedAttrs = sanitizeSourceMapArtifactRecord(objectRecord3(event.attributes));
+  const rawBody = objectRecord3(event.body);
+  const body = sanitizeSourceMapArtifactRecord(rawBody);
+  const artifact = sanitizeSourceMapArtifactRecord(objectRecord3(rawBody.artifact));
+  const attrs = hasSourceMapContainer(body) || hasSourceMapContainer(artifact) || hasSourceMapContainer(sanitizedAttrs) ? sanitizeSourceMapContextRecord(sanitizedAttrs) : sanitizedAttrs;
+  const isSourceMapArtifact = hasSourceMapContainer(body) || hasSourceMapContainer(artifact) || hasSourceMapContainer(attrs);
+  const artifactIdCandidate = index.artifact_id ?? stringAttribute(attrs, "artifact_id") ?? stringAttribute(body, "artifact_id") ?? stringAttribute(artifact, "artifact_id");
+  const artifactId = isSourceMapArtifact ? sanitizeSourceMapIdentifierValue(artifactIdCandidate) ?? sourceMapFallbackIdentifier(event.event_id) : artifactIdCandidate ?? event.event_id;
+  db.prepare(`
+    INSERT INTO artifacts (id, release_id, artifact_type, path, content_hash, size_bytes, metadata)
+    VALUES (?, ?, ?, ?, ?, ?, ?)
+    ON CONFLICT(id) DO UPDATE SET
+      release_id = COALESCE(artifacts.release_id, excluded.release_id),
+      artifact_type = COALESCE(artifacts.artifact_type, excluded.artifact_type),
+      path = COALESCE(excluded.path, artifacts.path),
+      content_hash = COALESCE(excluded.content_hash, artifacts.content_hash),
+      size_bytes = COALESCE(excluded.size_bytes, artifacts.size_bytes),
+      metadata = excluded.metadata
+  `).run(artifactId, index.release_id ?? null, stringAttribute(attrs, "artifact_type") ?? stringAttribute(attrs, "type") ?? stringAttribute(artifact, "artifact_type") ?? stringAttribute(artifact, "type") ?? event.type, stringAttribute(attrs, "path") ?? stringAttribute(body, "path") ?? stringAttribute(artifact, "path"), stringAttribute(attrs, "content_hash") ?? stringAttribute(body, "content_hash") ?? stringAttribute(artifact, "content_hash"), numberAttribute(attrs, "size_bytes") ?? numberAttribute(body, "size_bytes") ?? numberAttribute(artifact, "size_bytes"), JSON.stringify(index.metadata ?? {}));
+}
+function replayProcessRunProjection(db, event, index, options = {}) {
+  const attrs = objectRecord3(event.attributes);
+  const processBody = objectRecord3(event.body?.process);
+  const lifecycleBody = objectRecord3(event.body?.lifecycle);
+  const body = Object.keys(processBody).length > 0 ? processBody : lifecycleBody;
+  const preserveExistingMetadata = options.preserveExistingMetadata ? 1 : 0;
+  const metadataObject = index.metadata ?? {};
+  const metadata = JSON.stringify(metadataObject);
+  const processMetadata = preserveExistingMetadata && index.process_id ? mergedReplayMetadata(db, "processes", index.process_id, metadataObject) : metadata;
+  const runMetadata = preserveExistingMetadata && index.run_id ? mergedReplayMetadata(db, "runs", index.run_id, metadataObject) : metadata;
+  const exitCode = numberAttribute(attrs, "exit_code") ?? numberAttribute(body, "exit_code");
+  const signal = stringAttribute(attrs, "signal") ?? stringAttribute(body, "signal");
+  const status = stringAttribute(attrs, "status") ?? stringAttribute(body, "status") ?? statusFromExit(exitCode, signal);
+  if (index.process_id) {
+    db.prepare(`
+      INSERT INTO processes (id, machine_id, repo_id, app_id, pid, ppid, command, cwd, started_at, ended_at, exit_code, metadata)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        machine_id = COALESCE(processes.machine_id, excluded.machine_id),
+        repo_id = COALESCE(processes.repo_id, excluded.repo_id),
+        app_id = COALESCE(processes.app_id, excluded.app_id),
+        pid = COALESCE(processes.pid, excluded.pid),
+        ppid = COALESCE(processes.ppid, excluded.ppid),
+        command = COALESCE(processes.command, excluded.command),
+        cwd = COALESCE(processes.cwd, excluded.cwd),
+        ended_at = COALESCE(excluded.ended_at, processes.ended_at),
+        exit_code = COALESCE(excluded.exit_code, processes.exit_code),
+        metadata = excluded.metadata
+    `).run(index.process_id, index.machine_id ?? null, index.repo_id ?? null, index.app_id ?? null, numberAttribute(attrs, "pid") ?? numberAttribute(body, "pid"), numberAttribute(attrs, "ppid") ?? numberAttribute(body, "ppid"), commandString(stringAttribute(attrs, "command") ?? body.command), stringAttribute(attrs, "cwd") ?? stringAttribute(body, "cwd"), stringAttribute(attrs, "started_at") ?? stringAttribute(body, "started_at") ?? event.event_time, stringAttribute(attrs, "ended_at") ?? stringAttribute(body, "ended_at"), exitCode, processMetadata);
+  }
+  if (index.run_id) {
+    db.prepare(`
+      INSERT INTO runs (id, process_id, run_type, name, status, started_at, ended_at, exit_code, metadata)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)
+      ON CONFLICT(id) DO UPDATE SET
+        process_id = COALESCE(runs.process_id, excluded.process_id),
+        run_type = COALESCE(runs.run_type, excluded.run_type),
+        name = COALESCE(runs.name, excluded.name),
+        ended_at = COALESCE(excluded.ended_at, runs.ended_at),
+        exit_code = COALESCE(excluded.exit_code, runs.exit_code),
+        status = COALESCE(excluded.status, runs.status),
+        metadata = excluded.metadata
+    `).run(index.run_id, index.process_id ?? null, stringAttribute(attrs, "run_type") ?? stringAttribute(body, "run_type") ?? stringAttribute(body, "kind") ?? event.type, stringAttribute(attrs, "name") ?? commandString(body.command) ?? event.message ?? null, status, stringAttribute(attrs, "started_at") ?? stringAttribute(body, "started_at") ?? event.event_time, stringAttribute(attrs, "ended_at") ?? stringAttribute(body, "ended_at"), exitCode, runMetadata);
+  }
+}
+function mergedReplayMetadata(db, table, id, incoming) {
+  const row = db.prepare(`SELECT metadata FROM ${table} WHERE id = ?`).get(id);
+  const existing = parseJsonRecord(row?.metadata);
+  return JSON.stringify({ ...incoming, ...existing });
+}
+function statusFromExit(exitCode, signal) {
+  if (signal)
+    return "failed";
+  if (exitCode === null)
+    return null;
+  return exitCode === 0 ? "completed" : "failed";
+}
+function replayIssueProjection(db, event, index) {
+  if (event.type === "exception" && event.message) {
+    upsertIssue(db, {
+      project_id: index.project_id ?? undefined,
+      level: event.severity ?? "error",
+      service: stringAttribute(objectRecord3(event.attributes), "service"),
+      message: event.message,
+      stack_trace: stringAttribute(objectRecord3(event.attributes), "stack_trace") ?? stringAttribute(objectRecord3(event.body), "stack_trace")
+    });
+    return;
+  }
+  if (event.type !== "log" || !index.project_id || !event.message || !index.severity || !["warn", "error", "fatal"].includes(index.severity))
+    return;
+  const log = objectRecord3(event.body?.log);
+  upsertIssue(db, {
+    project_id: index.project_id,
+    level: index.severity,
+    service: stringAttribute(log, "service") ?? stringAttribute(objectRecord3(event.attributes), "service"),
+    message: event.message,
+    stack_trace: stringAttribute(log, "stack_trace")
+  });
+}
+function metadataFromEnvelope(event) {
+  const attrs = objectRecord3(event.attributes);
+  const body = objectRecord3(event.body);
+  const log = objectRecord3(body.log);
+  const logMetadata = objectRecord3(log.metadata);
+  if (event.type === "log")
+    return Object.keys(logMetadata).length > 0 ? logMetadata : null;
+  const processBody = objectRecord3(body.process);
+  if (Object.keys(processBody).length > 0)
+    return { ...attrs, ...processBody };
+  const chunkBody = objectRecord3(body.process_stream_chunk);
+  if (Object.keys(chunkBody).length > 0)
+    return { ...attrs, ...chunkBody };
+  const lifecycleBody = objectRecord3(body.lifecycle);
+  if (Object.keys(lifecycleBody).length > 0)
+    return { ...attrs, ...lifecycleBody };
+  const testReportBody = objectRecord3(body.test_report);
+  if (Object.keys(testReportBody).length > 0)
+    return sanitizedTestReportMetadata(testReportBody, attrs, attrs);
+  const artifactBody = objectRecord3(body.artifact);
+  if (Object.keys(artifactBody).length > 0)
+    return sanitizedArtifactMetadata({ ...artifactBody, ...attrs });
+  if (event.type === "artifact" && Object.keys(body).length > 0)
+    return sanitizedArtifactMetadata({ ...body, ...attrs });
+  if (event.type === "artifact" && Object.keys(attrs).length > 0)
+    return sanitizedArtifactMetadata(attrs);
+  return Object.keys(attrs).length > 0 ? attrs : null;
+}
+function sanitizedArtifactMetadata(metadata) {
+  const output = { ...metadata };
+  if ("source_map" in output) {
+    const sourceMap = sanitizeSourceMapTelemetry(output.source_map);
+    if (sourceMap)
+      output.source_map = sourceMap;
+    else
+      output.source_map = undefined;
+  }
+  return sanitizeSourceMapArtifactRecord(output);
+}
+function objectRecord3(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+function parseJsonRecord(value) {
+  if (!value)
+    return {};
+  try {
+    const parsed = JSON.parse(value);
+    return objectRecord3(parsed);
+  } catch {
+    return {};
+  }
+}
+function stringAttribute(attrs, key) {
+  const value = attrs[key];
+  if (typeof value === "string")
+    return value;
+  if (typeof value === "number" || typeof value === "bigint")
+    return String(value);
+  return null;
+}
+function numberAttribute(attrs, key) {
+  const value = attrs[key];
+  if (typeof value === "number" && Number.isFinite(value))
+    return value;
+  if (typeof value === "string" && value.trim().length > 0) {
+    const parsed = Number(value);
+    if (Number.isFinite(parsed))
+      return parsed;
+  }
+  return null;
+}
+function commandString(value) {
+  if (typeof value === "string")
+    return value;
+  if (Array.isArray(value)) {
+    const parts = value.map((item) => typeof item === "string" || typeof item === "number" || typeof item === "bigint" ? String(item) : null);
+    return parts.every(Boolean) ? parts.join(" ") : null;
+  }
+  return null;
+}
+function normalizeLogLevel(value) {
+  if (value === "debug" || value === "info" || value === "warn" || value === "error" || value === "fatal")
+    return value;
+  return "info";
+}
+function rowExists(db, table, id) {
+  const row = db.prepare(`SELECT 1 AS found FROM ${table} WHERE id = ? LIMIT 1`).get(id);
+  return Boolean(row);
+}
+function sealSegment(db, segmentId) {
+  const segment = db.prepare("SELECT relative_path FROM event_segments WHERE id = ?").get(segmentId);
+  const segmentHash = segment ? sha256(readFileSync(resolveDataPath(db, segment.relative_path))) : null;
+  db.prepare(`
+    UPDATE event_segments
+    SET sealed_at = COALESCE(sealed_at, strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+        segment_hash = COALESCE(?, segment_hash),
+        updated_at = strftime('%Y-%m-%dT%H:%M:%fZ','now')
+    WHERE id = ?
+  `).run(segmentHash, segmentId);
+  writeSegmentManifest(db, segmentId);
+}
+function appendAndFlush(path, bytes) {
+  const fd = openSync(path, "a");
+  try {
+    let written = 0;
+    while (written < bytes.byteLength) {
+      const n = writeSync(fd, bytes, written, bytes.byteLength - written);
+      if (n <= 0)
+        throw new Error(`Failed to append bytes to ${path}`);
+      written += n;
+    }
+    if (shouldFsync()) {
+      fsyncSync(fd);
+    }
+  } finally {
+    closeSync(fd);
+  }
+}
+function withEventStoreLock(db, fn) {
+  const depth = dbLockDepths.get(db) ?? 0;
+  if (depth > 0) {
+    dbLockDepths.set(db, depth + 1);
+    try {
+      return fn();
+    } finally {
+      const nextDepth = (dbLockDepths.get(db) ?? 1) - 1;
+      if (nextDepth > 0)
+        dbLockDepths.set(db, nextDepth);
+      else
+        dbLockDepths.delete(db);
+    }
+  }
+  const lockRoot = resolveDataPath(db, ".locks");
+  const lockDir = resolveDataPath(db, ".locks/segments.lock");
+  mkdirSync(lockRoot, { recursive: true });
+  const timeoutMs = readPositiveIntEnv("HASNA_LOGS_LOCK_TIMEOUT_MS", 1e4);
+  const staleMs = readPositiveIntEnv("HASNA_LOGS_LOCK_STALE_MS", 120000);
+  const start = Date.now();
+  while (true) {
+    try {
+      mkdirSync(lockDir);
+      writeFileSync(join(lockDir, "owner.json"), `${JSON.stringify({ pid: process.pid, created_at: new Date().toISOString() })}
+`, "utf8");
+      break;
+    } catch (error) {
+      if (!isFileExistsError(error))
+        throw error;
+      try {
+        const ageMs = Date.now() - statSync(lockDir).mtimeMs;
+        if (ageMs > staleMs) {
+          rmSync(lockDir, { recursive: true, force: true });
+          continue;
+        }
+      } catch {
+        continue;
+      }
+      if (Date.now() - start > timeoutMs) {
+        throw new Error(`Timed out waiting for event store lock: ${lockDir}`);
+      }
+      sleepSync(20);
+    }
+  }
+  try {
+    dbLockDepths.set(db, 1);
+    return fn();
+  } finally {
+    dbLockDepths.delete(db);
+    rmSync(lockDir, { recursive: true, force: true });
+  }
+}
+function readPositiveIntEnv(name, fallback) {
+  const parsed = Number.parseInt(process.env[name] ?? "", 10);
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+function isFileExistsError(error) {
+  return Boolean(error && typeof error === "object" && "code" in error && error.code === "EEXIST");
+}
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function getMaxSegmentBytes() {
+  const configured = process.env.HASNA_LOGS_SEGMENT_MAX_BYTES ?? process.env.OPEN_LOGS_SEGMENT_MAX_BYTES;
+  const parsed = configured ? Number.parseInt(configured, 10) : 64 * 1024 * 1024;
+  return Number.isFinite(parsed) && parsed > 0 ? parsed : 64 * 1024 * 1024;
+}
+function shouldFsync() {
+  return process.env.HASNA_LOGS_FSYNC !== "0" && process.env.OPEN_LOGS_FSYNC !== "0";
+}
+function shouldHashSegmentOnAppend() {
+  return process.env.HASNA_LOGS_SEGMENT_HASH_ON_APPEND !== "0" && process.env.OPEN_LOGS_SEGMENT_HASH_ON_APPEND !== "0";
+}
+function resolveDataPath(db, relativePath) {
+  const root = resolve(getEventStoreDataDir(db));
+  const fullPath = resolve(root, ...relativePath.split("/"));
+  if (fullPath !== root && !fullPath.startsWith(root + sep)) {
+    throw new Error(`Refusing to access path outside event store: ${relativePath}`);
+  }
+  return fullPath;
+}
+function sha256(input) {
+  return createHash4("sha256").update(input).digest("hex");
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+
+// src/db/index.ts
+import { Database } from "bun:sqlite";
+import { createHash as createHash5 } from "crypto";
+import { cpSync, existsSync as existsSync2, mkdirSync as mkdirSync2, mkdtempSync } from "fs";
+import { join as join2 } from "path";
+
+// src/db/migrations/001_alert_rules.ts
+function migrateAlertRules(db) {
+  db.run(`
+    CREATE TABLE IF NOT EXISTS alert_rules (
+      id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(8)))),
+      project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      name TEXT NOT NULL,
+      service TEXT,
+      level TEXT NOT NULL DEFAULT 'error' CHECK(level IN ('debug','info','warn','error','fatal')),
+      threshold_count INTEGER NOT NULL DEFAULT 10,
+      window_seconds INTEGER NOT NULL DEFAULT 60,
+      action TEXT NOT NULL DEFAULT 'webhook' CHECK(action IN ('webhook','log')),
+      webhook_url TEXT,
+      enabled INTEGER NOT NULL DEFAULT 1,
+      last_fired_at TEXT,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+    )
+  `);
+  db.run("CREATE INDEX IF NOT EXISTS idx_alert_rules_project ON alert_rules(project_id)");
+}
+
+// src/db/migrations/002_issues.ts
+function migrateIssues(db) {
+  db.run(`
+    CREATE TABLE IF NOT EXISTS issues (
+      id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(8)))),
+      project_id TEXT REFERENCES projects(id) ON DELETE CASCADE,
+      fingerprint TEXT NOT NULL,
+      level TEXT NOT NULL,
+      service TEXT,
+      message_template TEXT NOT NULL,
+      first_seen TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+      last_seen TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+      count INTEGER NOT NULL DEFAULT 1,
+      status TEXT NOT NULL DEFAULT 'open' CHECK(status IN ('open','resolved','ignored')),
+      UNIQUE(project_id, fingerprint)
+    )
+  `);
+  db.run("CREATE INDEX IF NOT EXISTS idx_issues_project ON issues(project_id, status)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_issues_fingerprint ON issues(fingerprint)");
+}
+
+// src/db/migrations/003_retention.ts
+var RETENTION_COLUMNS = [
+  "max_rows INTEGER NOT NULL DEFAULT 100000",
+  "debug_ttl_hours INTEGER NOT NULL DEFAULT 24",
+  "info_ttl_hours INTEGER NOT NULL DEFAULT 168",
+  "warn_ttl_hours INTEGER NOT NULL DEFAULT 720",
+  "error_ttl_hours INTEGER NOT NULL DEFAULT 2160"
+];
+function migrateRetention(db) {
+  for (const col of RETENTION_COLUMNS) {
+    try {
+      db.run(`ALTER TABLE projects ADD COLUMN ${col}`);
+    } catch {}
+  }
+}
+
+// src/db/migrations/004_page_auth.ts
+function migratePageAuth(db) {
+  db.run(`
+    CREATE TABLE IF NOT EXISTS page_auth (
+      id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(8)))),
+      page_id TEXT NOT NULL UNIQUE REFERENCES pages(id) ON DELETE CASCADE,
+      type TEXT NOT NULL CHECK(type IN ('cookie','bearer','basic')),
+      credentials TEXT NOT NULL,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+    )
+  `);
+}
+
+// src/db/index.ts
+function resolveDataDir() {
+  const explicit = process.env.HASNA_LOGS_DATA_DIR ?? process.env.LOGS_DATA_DIR;
+  if (explicit)
+    return explicit;
+  const home = process.env.HOME ?? "~";
+  const newDir = join2(home, ".hasna", "logs");
+  const oldDir = join2(home, ".logs");
+  if (!existsSync2(newDir) && existsSync2(oldDir)) {
+    mkdirSync2(join2(home, ".hasna"), { recursive: true });
+    cpSync(oldDir, newDir, { recursive: true });
+  }
+  return newDir;
+}
+var DATA_DIR = resolveDataDir();
+var DB_PATH = process.env.HASNA_LOGS_DB_PATH ?? process.env.LOGS_DB_PATH ?? join2(DATA_DIR, "logs.db");
+var _db = null;
+function getDb() {
+  if (_db)
+    return _db;
+  if (!existsSync2(DATA_DIR))
+    mkdirSync2(DATA_DIR, { recursive: true });
+  _db = new Database(DB_PATH);
+  setEventStoreDataDir(_db, DATA_DIR);
+  configureDb(_db);
+  runWithBusyRetry(_db, `CREATE TABLE IF NOT EXISTS feedback (
+    id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(16)))),
+    message TEXT NOT NULL,
+    email TEXT,
+    category TEXT DEFAULT 'general',
+    version TEXT,
+    machine_id TEXT,
+    created_at TEXT NOT NULL DEFAULT (datetime('now'))
+  )`);
+  return _db;
+}
+function configureDb(db) {
+  db.run("PRAGMA busy_timeout=10000");
+  runWithBusyRetry(db, "PRAGMA journal_mode=WAL");
+  runWithBusyRetry(db, "PRAGMA foreign_keys=ON");
+  migrate(db);
+}
+function migrate(db) {
+  runWithBusyRetry(db, `
+    CREATE TABLE IF NOT EXISTS projects (
+      id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(8)))),
+      name TEXT NOT NULL UNIQUE,
+      github_repo TEXT,
+      base_url TEXT,
+      description TEXT,
+      github_description TEXT,
+      github_branch TEXT,
+      github_sha TEXT,
+      last_synced_at TEXT,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+    )
+  `);
+  runWithBusyRetry(db, `
+    CREATE TABLE IF NOT EXISTS pages (
+      id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(8)))),
+      project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      url TEXT NOT NULL,
+      path TEXT NOT NULL DEFAULT '/',
+      name TEXT,
+      last_scanned_at TEXT,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+      UNIQUE(project_id, url)
+    )
+  `);
+  runWithBusyRetry(db, `
+    CREATE TABLE IF NOT EXISTS browser_ingest_tokens (
+      id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(16)))),
+      project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      token_hash TEXT NOT NULL UNIQUE,
+      token_prefix TEXT NOT NULL,
+      name TEXT,
+      allowed_origins TEXT,
+      enabled INTEGER NOT NULL DEFAULT 1,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+      last_used_at TEXT
+    )
+  `);
+  db.run("CREATE INDEX IF NOT EXISTS idx_browser_ingest_tokens_project ON browser_ingest_tokens(project_id, enabled)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_browser_ingest_tokens_hash ON browser_ingest_tokens(token_hash)");
+  runWithBusyRetry(db, `
+    CREATE TABLE IF NOT EXISTS logs (
+      id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(16)))),
+      timestamp TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+      project_id TEXT REFERENCES projects(id) ON DELETE SET NULL,
+      page_id TEXT REFERENCES pages(id) ON DELETE SET NULL,
+      level TEXT NOT NULL CHECK(level IN ('debug','info','warn','error','fatal')),
+      source TEXT NOT NULL DEFAULT 'sdk',
+      service TEXT,
+      message TEXT NOT NULL,
+      trace_id TEXT,
+      session_id TEXT,
+      agent TEXT,
+      url TEXT,
+      stack_trace TEXT,
+      metadata TEXT
+    )
+  `);
+  db.run("CREATE INDEX IF NOT EXISTS idx_logs_project_level_ts ON logs(project_id, level, timestamp DESC)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_logs_trace ON logs(trace_id)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_logs_service ON logs(service)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_logs_page ON logs(page_id)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_logs_timestamp ON logs(timestamp DESC)");
+  db.run(`
+    CREATE TABLE IF NOT EXISTS machines (
+      id TEXT PRIMARY KEY,
+      hostname TEXT,
+      platform TEXT,
+      arch TEXT,
+      os_release TEXT,
+      metadata TEXT,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+      last_seen_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+    )
+  `);
+  db.run(`
+    CREATE TABLE IF NOT EXISTS repositories (
+      id TEXT PRIMARY KEY,
+      root_path TEXT,
+      remote_url TEXT,
+      branch TEXT,
+      commit_sha TEXT,
+      dirty INTEGER,
+      metadata TEXT,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+      last_seen_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+    )
+  `);
+  db.run(`
+    CREATE TABLE IF NOT EXISTS apps (
+      id TEXT PRIMARY KEY,
+      repo_id TEXT,
+      project_id TEXT REFERENCES projects(id) ON DELETE SET NULL,
+      name TEXT,
+      runtime TEXT,
+      environment TEXT,
+      version TEXT,
+      metadata TEXT,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+      last_seen_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+    )
+  `);
+  db.run(`
+    CREATE TABLE IF NOT EXISTS processes (
+      id TEXT PRIMARY KEY,
+      machine_id TEXT,
+      repo_id TEXT,
+      app_id TEXT,
+      pid INTEGER,
+      ppid INTEGER,
+      command TEXT,
+      cwd TEXT,
+      started_at TEXT,
+      ended_at TEXT,
+      exit_code INTEGER,
+      metadata TEXT,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+    )
+  `);
+  db.run(`
+    CREATE TABLE IF NOT EXISTS runs (
+      id TEXT PRIMARY KEY,
+      process_id TEXT,
+      run_type TEXT,
+      name TEXT,
+      status TEXT,
+      started_at TEXT,
+      ended_at TEXT,
+      exit_code INTEGER,
+      metadata TEXT,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+    )
+  `);
+  db.run(`
+    CREATE TABLE IF NOT EXISTS event_sources (
+      id TEXT PRIMARY KEY,
+      source_type TEXT NOT NULL,
+      name TEXT,
+      version TEXT,
+      config_hash TEXT,
+      metadata TEXT,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+      last_seen_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+    )
+  `);
+  db.run(`
+    CREATE TABLE IF NOT EXISTS traces (
+      id TEXT PRIMARY KEY,
+      project_id TEXT REFERENCES projects(id) ON DELETE SET NULL,
+      app_id TEXT,
+      root_span_id TEXT,
+      started_at TEXT,
+      ended_at TEXT,
+      status TEXT,
+      metadata TEXT,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+    )
+  `);
+  db.run(`
+    CREATE TABLE IF NOT EXISTS spans (
+      id TEXT PRIMARY KEY,
+      trace_id TEXT,
+      parent_span_id TEXT,
+      app_id TEXT,
+      process_id TEXT,
+      name TEXT,
+      operation TEXT,
+      status TEXT,
+      started_at TEXT,
+      ended_at TEXT,
+      duration_ms REAL,
+      metadata TEXT,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+    )
+  `);
+  db.run(`
+    CREATE TABLE IF NOT EXISTS sessions (
+      id TEXT PRIMARY KEY,
+      project_id TEXT REFERENCES projects(id) ON DELETE SET NULL,
+      app_id TEXT,
+      user_hash TEXT,
+      started_at TEXT,
+      ended_at TEXT,
+      status TEXT,
+      metadata TEXT,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+    )
+  `);
+  db.run(`
+    CREATE TABLE IF NOT EXISTS releases (
+      id TEXT PRIMARY KEY,
+      project_id TEXT REFERENCES projects(id) ON DELETE SET NULL,
+      app_id TEXT,
+      version TEXT,
+      commit_sha TEXT,
+      build_id TEXT,
+      deployed_at TEXT,
+      metadata TEXT,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+    )
+  `);
+  db.run(`
+    CREATE TABLE IF NOT EXISTS artifacts (
+      id TEXT PRIMARY KEY,
+      release_id TEXT,
+      artifact_type TEXT,
+      path TEXT,
+      content_hash TEXT,
+      size_bytes INTEGER,
+      metadata TEXT,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+    )
+  `);
+  db.run(`
+    CREATE TABLE IF NOT EXISTS source_maps (
+      id TEXT PRIMARY KEY,
+      event_id TEXT REFERENCES event_records(event_id) ON DELETE CASCADE,
+      project_id TEXT REFERENCES projects(id) ON DELETE SET NULL,
+      machine_id TEXT,
+      repo_id TEXT,
+      app_id TEXT,
+      process_id TEXT,
+      run_id TEXT,
+      environment TEXT,
+      source_map_artifact_id TEXT,
+      javascript_artifact_id TEXT,
+      source_map_path TEXT,
+      javascript_path TEXT,
+      source_root TEXT,
+      file TEXT,
+      version INTEGER,
+      validation_status TEXT,
+      validation_error TEXT,
+      source_count INTEGER,
+      names_count INTEGER,
+      mappings_length INTEGER,
+      has_sources_content INTEGER,
+      truncated INTEGER,
+      content_hash TEXT,
+      size_bytes INTEGER,
+      metadata TEXT,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+    )
+  `);
+  db.run("CREATE INDEX IF NOT EXISTS idx_source_maps_run ON source_maps(run_id, created_at DESC)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_source_maps_js_path ON source_maps(javascript_path)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_source_maps_status ON source_maps(validation_status)");
+  db.run(`
+    CREATE TABLE IF NOT EXISTS source_map_sources (
+      id TEXT PRIMARY KEY,
+      source_map_id TEXT NOT NULL REFERENCES source_maps(id) ON DELETE CASCADE,
+      ordinal INTEGER NOT NULL,
+      source_path TEXT,
+      has_content INTEGER,
+      content_hash TEXT,
+      metadata TEXT,
+      UNIQUE(source_map_id, ordinal)
+    )
+  `);
+  migrateSourceMapSourcesSyncId(db);
+  db.run("CREATE UNIQUE INDEX IF NOT EXISTS idx_source_map_sources_id ON source_map_sources(id)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_source_map_sources_path ON source_map_sources(source_path)");
+  db.run(`
+    CREATE TABLE IF NOT EXISTS test_reports (
+      id TEXT PRIMARY KEY,
+      event_id TEXT REFERENCES event_records(event_id) ON DELETE CASCADE,
+      source_event_id TEXT,
+      project_id TEXT REFERENCES projects(id) ON DELETE SET NULL,
+      machine_id TEXT,
+      repo_id TEXT,
+      app_id TEXT,
+      process_id TEXT,
+      run_id TEXT,
+      environment TEXT,
+      source TEXT,
+      event_time TEXT,
+      path TEXT,
+      format TEXT,
+      parser TEXT,
+      parse_status TEXT,
+      parse_error TEXT,
+      size_bytes INTEGER,
+      content_hash TEXT,
+      changed TEXT,
+      mtime_ms REAL,
+      tests INTEGER,
+      failures INTEGER,
+      errors INTEGER,
+      skipped INTEGER,
+      time_seconds REAL,
+      suite_count INTEGER,
+      testcase_count INTEGER,
+      case_stored_count INTEGER NOT NULL DEFAULT 0,
+      truncated INTEGER NOT NULL DEFAULT 0,
+      metadata TEXT,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+    )
+  `);
+  db.run(`
+    CREATE TABLE IF NOT EXISTS test_cases (
+      id TEXT PRIMARY KEY,
+      report_id TEXT NOT NULL REFERENCES test_reports(id) ON DELETE CASCADE,
+      event_id TEXT REFERENCES event_records(event_id) ON DELETE CASCADE,
+      project_id TEXT REFERENCES projects(id) ON DELETE SET NULL,
+      machine_id TEXT,
+      repo_id TEXT,
+      app_id TEXT,
+      process_id TEXT,
+      run_id TEXT,
+      environment TEXT,
+      suite_name TEXT,
+      suite_index INTEGER,
+      case_index INTEGER,
+      name TEXT,
+      classname TEXT,
+      file TEXT,
+      status TEXT,
+      time_seconds REAL,
+      metadata TEXT,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+    )
+  `);
+  db.run("CREATE INDEX IF NOT EXISTS idx_test_reports_run_time ON test_reports(run_id, event_time DESC)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_test_reports_status_time ON test_reports(parse_status, event_time DESC)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_test_reports_path_hash ON test_reports(path, content_hash)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_test_cases_report_status ON test_cases(report_id, status)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_test_cases_run_status ON test_cases(run_id, status)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_test_cases_name ON test_cases(name, classname)");
+  db.run(`
+    CREATE TABLE IF NOT EXISTS projection_offsets (
+      projection_name TEXT PRIMARY KEY,
+      segment_id TEXT,
+      byte_offset INTEGER NOT NULL DEFAULT 0,
+      event_id TEXT,
+      updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+    )
+  `);
+  db.run(`
+    CREATE TABLE IF NOT EXISTS sync_cursors (
+      target_id TEXT PRIMARY KEY,
+      cursor TEXT,
+      last_event_id TEXT,
+      last_segment_id TEXT,
+      updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+    )
+  `);
+  db.run(`
+    CREATE TABLE IF NOT EXISTS event_segments (
+      id TEXT PRIMARY KEY,
+      relative_path TEXT NOT NULL UNIQUE,
+      manifest_path TEXT,
+      byte_length INTEGER NOT NULL DEFAULT 0,
+      event_count INTEGER NOT NULL DEFAULT 0,
+      first_event_time TEXT,
+      last_event_time TEXT,
+      segment_hash TEXT,
+      sealed_at TEXT,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+      updated_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+    )
+  `);
+  ensureColumn(db, "event_segments", "manifest_path", "TEXT");
+  ensureColumn(db, "event_segments", "segment_hash", "TEXT");
+  db.run(`
+    CREATE TABLE IF NOT EXISTS event_records (
+      event_id TEXT PRIMARY KEY,
+      schema_version INTEGER NOT NULL DEFAULT 1,
+      source_event_id TEXT,
+      event_type TEXT NOT NULL,
+      event_time TEXT NOT NULL,
+      ingest_time TEXT NOT NULL,
+      severity TEXT,
+      source TEXT NOT NULL,
+      project_id TEXT REFERENCES projects(id) ON DELETE SET NULL,
+      page_id TEXT REFERENCES pages(id) ON DELETE SET NULL,
+      log_id TEXT REFERENCES logs(id) ON DELETE SET NULL,
+      machine_id TEXT,
+      repo_id TEXT,
+      app_id TEXT,
+      process_id TEXT,
+      run_id TEXT,
+      trace_id TEXT,
+      span_id TEXT,
+      parent_span_id TEXT,
+      session_id TEXT,
+      release_id TEXT,
+      environment TEXT,
+      artifact_id TEXT,
+      privacy_tier TEXT,
+      segment_id TEXT NOT NULL REFERENCES event_segments(id) ON DELETE CASCADE,
+      segment_path TEXT NOT NULL,
+      byte_offset INTEGER NOT NULL,
+      byte_length INTEGER NOT NULL,
+      record_hash TEXT NOT NULL,
+      message TEXT,
+      metadata TEXT,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+    )
+  `);
+  ensureColumn(db, "event_records", "source_event_id", "TEXT");
+  ensureColumn(db, "event_records", "machine_id", "TEXT");
+  ensureColumn(db, "event_records", "repo_id", "TEXT");
+  ensureColumn(db, "event_records", "app_id", "TEXT");
+  ensureColumn(db, "event_records", "process_id", "TEXT");
+  ensureColumn(db, "event_records", "run_id", "TEXT");
+  ensureColumn(db, "event_records", "span_id", "TEXT");
+  ensureColumn(db, "event_records", "parent_span_id", "TEXT");
+  ensureColumn(db, "event_records", "release_id", "TEXT");
+  ensureColumn(db, "event_records", "environment", "TEXT");
+  ensureColumn(db, "event_records", "artifact_id", "TEXT");
+  ensureColumn(db, "event_records", "privacy_tier", "TEXT");
+  db.run("CREATE INDEX IF NOT EXISTS idx_event_records_time ON event_records(event_time DESC)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_event_records_type_source ON event_records(event_type, source)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_event_records_project_time ON event_records(project_id, event_time DESC)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_event_records_trace ON event_records(trace_id)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_event_records_segment ON event_records(segment_id)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_event_records_machine_time ON event_records(machine_id, event_time DESC)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_event_records_repo_time ON event_records(repo_id, event_time DESC)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_event_records_app_time ON event_records(app_id, event_time DESC)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_event_records_process_time ON event_records(process_id, event_time DESC)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_event_records_run_time ON event_records(run_id, event_time DESC)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_event_records_span ON event_records(span_id)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_event_records_release_time ON event_records(release_id, event_time DESC)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_event_records_source_event ON event_records(source_event_id)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_event_records_environment ON event_records(environment, event_time DESC)");
+  db.run(`
+    CREATE VIRTUAL TABLE IF NOT EXISTS logs_fts USING fts5(
+      message, service, stack_trace,
+      content=logs, content_rowid=rowid
+    )
+  `);
+  db.run(`
+    CREATE TRIGGER IF NOT EXISTS logs_fts_insert AFTER INSERT ON logs BEGIN
+      INSERT INTO logs_fts(rowid, message, service, stack_trace)
+      VALUES (new.rowid, new.message, new.service, new.stack_trace);
+    END
+  `);
+  db.run(`
+    CREATE TRIGGER IF NOT EXISTS logs_fts_delete AFTER DELETE ON logs BEGIN
+      INSERT INTO logs_fts(logs_fts, rowid, message, service, stack_trace)
+      VALUES ('delete', old.rowid, old.message, old.service, old.stack_trace);
+    END
+  `);
+  db.run(`
+    CREATE TABLE IF NOT EXISTS scan_jobs (
+      id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(8)))),
+      project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      page_id TEXT REFERENCES pages(id) ON DELETE SET NULL,
+      schedule TEXT NOT NULL DEFAULT '*/30 * * * *',
+      enabled INTEGER NOT NULL DEFAULT 1,
+      last_run_at TEXT,
+      created_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now'))
+    )
+  `);
+  db.run(`
+    CREATE TABLE IF NOT EXISTS scan_runs (
+      id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(8)))),
+      job_id TEXT NOT NULL REFERENCES scan_jobs(id) ON DELETE CASCADE,
+      page_id TEXT REFERENCES pages(id) ON DELETE SET NULL,
+      started_at TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+      finished_at TEXT,
+      status TEXT NOT NULL DEFAULT 'running' CHECK(status IN ('running','completed','failed')),
+      logs_collected INTEGER NOT NULL DEFAULT 0,
+      errors_found INTEGER NOT NULL DEFAULT 0,
+      perf_score REAL
+    )
+  `);
+  db.run(`
+    CREATE TABLE IF NOT EXISTS performance_snapshots (
+      id TEXT PRIMARY KEY DEFAULT (lower(hex(randomblob(8)))),
+      timestamp TEXT NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ','now')),
+      project_id TEXT NOT NULL REFERENCES projects(id) ON DELETE CASCADE,
+      page_id TEXT REFERENCES pages(id) ON DELETE SET NULL,
+      url TEXT NOT NULL,
+      lcp REAL,
+      fcp REAL,
+      cls REAL,
+      tti REAL,
+      ttfb REAL,
+      score REAL,
+      raw_audit TEXT
+    )
+  `);
+  db.run("CREATE INDEX IF NOT EXISTS idx_perf_project_ts ON performance_snapshots(project_id, timestamp DESC)");
+  db.run("CREATE INDEX IF NOT EXISTS idx_perf_page ON performance_snapshots(page_id)");
+  migrateAlertRules(db);
+  migrateIssues(db);
+  migrateRetention(db);
+  migratePageAuth(db);
+}
+function migrateSourceMapSourcesSyncId(db) {
+  ensureColumn(db, "source_map_sources", "id", "TEXT");
+  const rows = db.prepare(`
+      SELECT source_map_id, ordinal
+      FROM source_map_sources
+      WHERE id IS NULL OR id LIKE 'srcmap_source_legacy_%'
+    `).all();
+  if (rows.length === 0)
+    return;
+  const update = db.prepare(`
+    UPDATE source_map_sources
+    SET id = ?
+    WHERE source_map_id = ? AND ordinal = ?
+  `);
+  db.transaction((items) => {
+    for (const row of items) {
+      update.run(sourceMapSourceRowId2(row.source_map_id, row.ordinal), row.source_map_id, row.ordinal);
+    }
+  })(rows);
+}
+function sourceMapSourceRowId2(sourceMapId, ordinal) {
+  return `srcmap_source_${createHash5("md5").update(sourceMapId).update(":").update(String(ordinal)).digest("hex")}`;
+}
+function ensureColumn(db, table, column, definition) {
+  const existing = db.prepare(`PRAGMA table_info(${table})`).all();
+  if (!existing.some((c) => c.name === column)) {
+    runWithBusyRetry(db, `ALTER TABLE ${table} ADD COLUMN ${column} ${definition}`);
+  }
+}
+function runWithBusyRetry(db, sql) {
+  const started = Date.now();
+  while (true) {
+    try {
+      db.run(sql);
+      return;
+    } catch (error) {
+      if (!isSqliteBusy(error) || Date.now() - started > 1e4)
+        throw error;
+      sleepSync2(25);
+    }
+  }
+}
+function isSqliteBusy(error) {
+  return Boolean(error && typeof error === "object" && "code" in error && error.code === "SQLITE_BUSY");
+}
+function sleepSync2(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+
+export { upsertIssue, listIssues, getIssue, updateIssueStatus, sanitizeSourceMapTelemetry, sanitizeSourceMapArtifactRecord, sanitizeSourceMapPathValue, sanitizeSourceMapIdentifierValue, sourceMapFallbackIdentifier, sanitizeSourceMapContextRecord, upsertSourceMapProjection, sanitizedTestReportMetadata, upsertTestReportProjection, getEventStoreDataDir, appendRawEvent, indexRawEvent, getEventRecord, readRawEvent, verifyEventStore, rebuildEventStoreIndex, repairEventStoreSegments, withEventStoreLock, getDb };