@hasna/uptime 0.1.9 → 0.1.11

package/dist/imports.js

@@ -81,13 +81,74 @@ function isDeniedIpv4(ip) {
 }
 function isDeniedIpv6(ip) {
   const normalized = ip.toLowerCase();
-  return normalized === "::" || normalized === "::1" || normalized.startsWith("fe80:") || normalized.startsWith("fc") || normalized.startsWith("fd") || normalized.startsWith("ff") || normalized.startsWith("::ffff:127.") || normalized.startsWith("::ffff:10.") || normalized.startsWith("::ffff:169.254.") || /^::ffff:172\.(1[6-9]|2\d|3[0-1])\./.test(normalized) || normalized.startsWith("::ffff:192.168.");
+  const mappedIpv4 = ipv4FromMappedIpv6(normalized);
+  if (mappedIpv4)
+    return isDeniedIpv4(mappedIpv4);
+  const words = parseIpv6Words(normalized);
+  return normalized === "::" || normalized === "::1" || words !== null && (words[0] & 65472) === 65152 || normalized.startsWith("fc") || normalized.startsWith("fd") || normalized.startsWith("ff");
+}
+function ipv4FromMappedIpv6(ip) {
+  const words = parseIpv6Words(ip);
+  if (!words)
+    return null;
+  if (words[0] !== 0 || words[1] !== 0 || words[2] !== 0 || words[3] !== 0 || words[4] !== 0 || words[5] !== 65535) {
+    return null;
+  }
+  return [
+    words[6] >> 8,
+    words[6] & 255,
+    words[7] >> 8,
+    words[7] & 255
+  ].join(".");
+}
+function parseIpv6Words(value) {
+  let ip = value.toLowerCase();
+  const zoneIndex = ip.indexOf("%");
+  if (zoneIndex >= 0)
+    ip = ip.slice(0, zoneIndex);
+  if (ip.includes(".")) {
+    const lastColon = ip.lastIndexOf(":");
+    if (lastColon < 0)
+      return null;
+    const ipv4 = parseIpv4Words(ip.slice(lastColon + 1));
+    if (!ipv4)
+      return null;
+    ip = `${ip.slice(0, lastColon)}:${(ipv4[0] << 8 | ipv4[1]).toString(16)}:${(ipv4[2] << 8 | ipv4[3]).toString(16)}`;
+  }
+  const compressed = ip.split("::");
+  if (compressed.length > 2)
+    return null;
+  const left = parseIpv6Side(compressed[0]);
+  const right = compressed.length === 2 ? parseIpv6Side(compressed[1]) : [];
+  if (!left || !right)
+    return null;
+  if (compressed.length === 1)
+    return left.length === 8 ? left : null;
+  const missing = 8 - left.length - right.length;
+  if (missing < 1)
+    return null;
+  return [...left, ...Array(missing).fill(0), ...right];
+}
+function parseIpv6Side(value) {
+  if (!value)
+    return [];
+  const words = value.split(":");
+  if (words.some((word) => !/^[0-9a-f]{1,4}$/.test(word)))
+    return null;
+  return words.map((word) => Number.parseInt(word, 16));
+}
+function parseIpv4Words(value) {
+  const words = value.split(".").map((part) => Number(part));
+  if (words.length !== 4 || words.some((word) => !Number.isInteger(word) || word < 0 || word > 255)) {
+    return null;
+  }
+  return words;
 }
 
 // src/imports.ts
-function previewImport(store, request) {
+function previewImport(store, request, options = {}) {
   const source = normalizeSource(request.source);
-  const items = dedupePreviewItems(request.records.map((record) => previewRecord(store, source, record, request.defaults ?? {})));
+  const items = dedupePreviewItems(request.records.map((record) => previewRecord(store, source, record, request.defaults ?? {}, options)));
   return {
     source,
     generatedAt: new Date().toISOString(),
@@ -161,7 +222,7 @@ function rollbackImport(store, batchId) {
     items
   };
 }
-function previewRecord(store, source, record, defaults) {
+function previewRecord(store, source, record, defaults, options) {
   const warnings = [];
   let candidate;
   try {
@@ -181,13 +242,16 @@ function previewRecord(store, source, record, defaults) {
       reason: error instanceof Error ? error.message : String(error)
     };
   }
-  const provenance = store.getProvenance(candidate.source, candidate.sourceId);
-  const monitor = provenance ? store.getMonitor(provenance.monitorId) : store.getMonitor(candidate.name);
-  if (provenance && !monitor) {
+  const monitorOptions = options.workspaceId ? { workspaceId: options.workspaceId } : undefined;
+  const rawProvenance = store.getProvenance(candidate.source, candidate.sourceId);
+  const provenanceMonitor = rawProvenance ? store.getMonitor(rawProvenance.monitorId, monitorOptions) : null;
+  const provenance = provenanceMonitor ? rawProvenance : null;
+  const monitor = provenanceMonitor ?? store.getMonitor(candidate.name, monitorOptions);
+  if (rawProvenance && !provenanceMonitor && !options.workspaceId) {
     return { candidate, action: "create", monitor: null, provenance, warnings: ["source provenance points to a missing monitor"], reason: null };
   }
   if (provenance && monitor) {
-    const nameOwner = store.getMonitor(candidate.name);
+    const nameOwner = store.getMonitor(candidate.name, monitorOptions);
     if (nameOwner && nameOwner.id !== monitor.id) {
       return {
         candidate,

package/dist/index.js

@@ -276,13 +276,74 @@ function isDeniedIpv4(ip) {
 }
 function isDeniedIpv6(ip) {
   const normalized = ip.toLowerCase();
-  return normalized === "::" || normalized === "::1" || normalized.startsWith("fe80:") || normalized.startsWith("fc") || normalized.startsWith("fd") || normalized.startsWith("ff") || normalized.startsWith("::ffff:127.") || normalized.startsWith("::ffff:10.") || normalized.startsWith("::ffff:169.254.") || /^::ffff:172\.(1[6-9]|2\d|3[0-1])\./.test(normalized) || normalized.startsWith("::ffff:192.168.");
+  const mappedIpv4 = ipv4FromMappedIpv6(normalized);
+  if (mappedIpv4)
+    return isDeniedIpv4(mappedIpv4);
+  const words = parseIpv6Words(normalized);
+  return normalized === "::" || normalized === "::1" || words !== null && (words[0] & 65472) === 65152 || normalized.startsWith("fc") || normalized.startsWith("fd") || normalized.startsWith("ff");
+}
+function ipv4FromMappedIpv6(ip) {
+  const words = parseIpv6Words(ip);
+  if (!words)
+    return null;
+  if (words[0] !== 0 || words[1] !== 0 || words[2] !== 0 || words[3] !== 0 || words[4] !== 0 || words[5] !== 65535) {
+    return null;
+  }
+  return [
+    words[6] >> 8,
+    words[6] & 255,
+    words[7] >> 8,
+    words[7] & 255
+  ].join(".");
+}
+function parseIpv6Words(value) {
+  let ip = value.toLowerCase();
+  const zoneIndex = ip.indexOf("%");
+  if (zoneIndex >= 0)
+    ip = ip.slice(0, zoneIndex);
+  if (ip.includes(".")) {
+    const lastColon = ip.lastIndexOf(":");
+    if (lastColon < 0)
+      return null;
+    const ipv4 = parseIpv4Words(ip.slice(lastColon + 1));
+    if (!ipv4)
+      return null;
+    ip = `${ip.slice(0, lastColon)}:${(ipv4[0] << 8 | ipv4[1]).toString(16)}:${(ipv4[2] << 8 | ipv4[3]).toString(16)}`;
+  }
+  const compressed = ip.split("::");
+  if (compressed.length > 2)
+    return null;
+  const left = parseIpv6Side(compressed[0]);
+  const right = compressed.length === 2 ? parseIpv6Side(compressed[1]) : [];
+  if (!left || !right)
+    return null;
+  if (compressed.length === 1)
+    return left.length === 8 ? left : null;
+  const missing = 8 - left.length - right.length;
+  if (missing < 1)
+    return null;
+  return [...left, ...Array(missing).fill(0), ...right];
+}
+function parseIpv6Side(value) {
+  if (!value)
+    return [];
+  const words = value.split(":");
+  if (words.some((word) => !/^[0-9a-f]{1,4}$/.test(word)))
+    return null;
+  return words.map((word) => Number.parseInt(word, 16));
+}
+function parseIpv4Words(value) {
+  const words = value.split(".").map((part) => Number(part));
+  if (words.length !== 4 || words.some((word) => !Number.isInteger(word) || word < 0 || word > 255)) {
+    return null;
+  }
+  return words;
 }
 
 // src/imports.ts
-function previewImport(store, request) {
+function previewImport(store, request, options = {}) {
   const source = normalizeSource(request.source);
-  const items = dedupePreviewItems(request.records.map((record) => previewRecord(store, source, record, request.defaults ?? {})));
+  const items = dedupePreviewItems(request.records.map((record) => previewRecord(store, source, record, request.defaults ?? {}, options)));
   return {
     source,
     generatedAt: new Date().toISOString(),
@@ -356,7 +417,7 @@ function rollbackImport(store, batchId) {
     items
   };
 }
-function previewRecord(store, source, record, defaults) {
+function previewRecord(store, source, record, defaults, options) {
   const warnings = [];
   let candidate;
   try {
@@ -376,13 +437,16 @@ function previewRecord(store, source, record, defaults) {
       reason: error instanceof Error ? error.message : String(error)
     };
   }
-  const provenance = store.getProvenance(candidate.source, candidate.sourceId);
-  const monitor = provenance ? store.getMonitor(provenance.monitorId) : store.getMonitor(candidate.name);
-  if (provenance && !monitor) {
+  const monitorOptions = options.workspaceId ? { workspaceId: options.workspaceId } : undefined;
+  const rawProvenance = store.getProvenance(candidate.source, candidate.sourceId);
+  const provenanceMonitor = rawProvenance ? store.getMonitor(rawProvenance.monitorId, monitorOptions) : null;
+  const provenance = provenanceMonitor ? rawProvenance : null;
+  const monitor = provenanceMonitor ?? store.getMonitor(candidate.name, monitorOptions);
+  if (rawProvenance && !provenanceMonitor && !options.workspaceId) {
     return { candidate, action: "create", monitor: null, provenance, warnings: ["source provenance points to a missing monitor"], reason: null };
   }
   if (provenance && monitor) {
-    const nameOwner = store.getMonitor(candidate.name);
+    const nameOwner = store.getMonitor(candidate.name, monitorOptions);
     if (nameOwner && nameOwner.id !== monitor.id) {
       return {
         candidate,
@@ -844,7 +908,7 @@ var REQUIRED_TABLES = [
 ];
 var PROBE_TABLES = new Set(["probe_identities", "probe_check_jobs", "probe_submissions"]);
 var REPORT_AUDIT_TABLES = new Set(["report_schedules", "report_runs", "audit_events"]);
-var CURRENT_SCHEMA_VERSION = "3";
+var CURRENT_SCHEMA_VERSION = "4";
 
 class StaleCheckResultError extends Error {
   constructor(message) {
@@ -905,7 +969,8 @@ class UptimeStore {
     this.db.run(`
       CREATE TABLE IF NOT EXISTS monitors (
         id TEXT PRIMARY KEY,
-        name TEXT NOT NULL UNIQUE,
+        workspace_id TEXT NOT NULL DEFAULT 'local',
+        name TEXT NOT NULL,
         kind TEXT NOT NULL CHECK (kind IN ('http', 'tcp', 'browser_page')),
         url TEXT,
         host TEXT,
@@ -920,9 +985,11 @@ class UptimeStore {
         last_checked_at TEXT,
         revision INTEGER NOT NULL DEFAULT 1,
         created_at TEXT NOT NULL,
-        updated_at TEXT NOT NULL
+        updated_at TEXT NOT NULL,
+        UNIQUE (workspace_id, name)
       )
     `);
+    this.ensureColumn("monitors", "workspace_id", "TEXT NOT NULL DEFAULT 'local'");
     this.ensureColumn("monitors", "revision", "INTEGER NOT NULL DEFAULT 1");
     this.ensureMonitorKindAllowsBrowserPage();
     this.db.run(`
@@ -1072,6 +1139,7 @@ class UptimeStore {
     `);
     this.db.query("INSERT OR REPLACE INTO schema_migrations (key, value, updated_at) VALUES ('schema_version', ?, ?)").run(CURRENT_SCHEMA_VERSION, new Date().toISOString());
     this.db.run("CREATE INDEX IF NOT EXISTS idx_results_monitor_time ON check_results(monitor_id, checked_at DESC)");
+    this.db.run("CREATE INDEX IF NOT EXISTS idx_monitors_workspace_enabled_name ON monitors(workspace_id, enabled, name)");
     this.db.run("CREATE INDEX IF NOT EXISTS idx_incidents_monitor_status ON incidents(monitor_id, status)");
     this.db.run("CREATE INDEX IF NOT EXISTS idx_check_leases_until ON check_leases(leased_until)");
     this.db.run("CREATE INDEX IF NOT EXISTS idx_monitor_provenance_monitor ON monitor_provenance(monitor_id)");
@@ -1133,8 +1201,10 @@ class UptimeStore {
     if (this.mode === "hosted")
       assertHostedTargetAllowed(normalized);
     const now = new Date().toISOString();
+    const workspaceId = normalizeWorkspaceId(options.workspaceId ?? input.workspaceId ?? "local");
     const monitor = {
       id: newId("mon"),
+      workspaceId,
       name: normalized.name,
       kind: normalized.kind,
       url: normalized.url ?? null,
@@ -1153,22 +1223,33 @@ class UptimeStore {
       updatedAt: now
     };
     this.db.query(`INSERT INTO monitors (
-          id, name, kind, url, host, port, method, expected_status,
+          id, workspace_id, name, kind, url, host, port, method, expected_status,
           interval_seconds, timeout_ms, retry_count, enabled, status,
           last_checked_at, revision, created_at, updated_at
-        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(monitor.id, monitor.name, monitor.kind, monitor.url, monitor.host, monitor.port, monitor.method, monitor.expectedStatus, monitor.intervalSeconds, monitor.timeoutMs, monitor.retryCount, monitor.enabled ? 1 : 0, monitor.status, monitor.lastCheckedAt, monitor.revision, monitor.createdAt, monitor.updatedAt);
+        ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`).run(monitor.id, monitor.workspaceId, monitor.name, monitor.kind, monitor.url, monitor.host, monitor.port, monitor.method, monitor.expectedStatus, monitor.intervalSeconds, monitor.timeoutMs, monitor.retryCount, monitor.enabled ? 1 : 0, monitor.status, monitor.lastCheckedAt, monitor.revision, monitor.createdAt, monitor.updatedAt);
     return monitor;
   }
   listMonitors(options = {}) {
-    const rows = options.includeDisabled ? this.db.query("SELECT * FROM monitors ORDER BY name ASC").all() : this.db.query("SELECT * FROM monitors WHERE enabled = 1 ORDER BY name ASC").all();
+    const workspaceId = options.workspaceId ? normalizeWorkspaceId(options.workspaceId) : undefined;
+    const clauses = [];
+    const args = [];
+    if (workspaceId) {
+      clauses.push("workspace_id = ?");
+      args.push(workspaceId);
+    }
+    if (!options.includeDisabled)
+      clauses.push("enabled = 1");
+    const where = clauses.length ? `WHERE ${clauses.join(" AND ")}` : "";
+    const rows = this.db.query(`SELECT * FROM monitors ${where} ORDER BY name ASC`).all(...args);
     return rows.map(monitorFromRow);
   }
-  getMonitor(idOrName) {
-    const row = this.db.query("SELECT * FROM monitors WHERE id = ? OR name = ?").get(idOrName, idOrName);
+  getMonitor(idOrName, options = {}) {
+    const workspaceId = options.workspaceId ? normalizeWorkspaceId(options.workspaceId) : undefined;
+    const row = this.db.query(`SELECT * FROM monitors WHERE (id = ? OR name = ?)${workspaceId ? " AND workspace_id = ?" : ""}`).get(...workspaceId ? [idOrName, idOrName, workspaceId] : [idOrName, idOrName]);
     return row ? monitorFromRow(row) : null;
   }
   updateMonitor(idOrName, input, options = {}) {
-    const current = this.getMonitor(idOrName);
+    const current = this.getMonitor(idOrName, { workspaceId: options.workspaceId });
     if (!current)
       throw new Error(`Monitor not found: ${idOrName}`);
     if (this.mode === "hosted") {
@@ -1192,10 +1273,10 @@ class UptimeStore {
     if (definitionChanged(current, next)) {
       this.closeOpenIncident(current.id, updatedAt);
     }
-    return this.getMonitor(current.id);
+    return this.getMonitor(current.id, { workspaceId: options.workspaceId });
   }
-  deleteMonitor(idOrName) {
-    const current = this.getMonitor(idOrName);
+  deleteMonitor(idOrName, options = {}) {
+    const current = this.getMonitor(idOrName, { workspaceId: options.workspaceId });
     if (!current)
       return false;
     this.db.query("DELETE FROM monitors WHERE id = ?").run(current.id);
@@ -1572,7 +1653,20 @@ class UptimeStore {
   }
   listResults(options = {}) {
     const limit = clampLimit(options.limit ?? 50);
-    const rows = options.monitorId ? this.db.query("SELECT * FROM check_results WHERE monitor_id = ? ORDER BY checked_at DESC LIMIT ?").all(options.monitorId, limit) : this.db.query("SELECT * FROM check_results ORDER BY checked_at DESC LIMIT ?").all(limit);
+    const workspaceId = options.workspaceId ? normalizeWorkspaceId(options.workspaceId) : undefined;
+    const clauses = [];
+    const args = [];
+    if (options.monitorId) {
+      clauses.push("check_results.monitor_id = ?");
+      args.push(options.monitorId);
+    }
+    if (workspaceId) {
+      clauses.push("monitors.workspace_id = ?");
+      args.push(workspaceId);
+    }
+    const where = clauses.length ? `WHERE ${clauses.join(" AND ")}` : "";
+    args.push(limit);
+    const rows = this.db.query(`SELECT check_results.* FROM check_results JOIN monitors ON monitors.id = check_results.monitor_id ${where} ORDER BY checked_at DESC LIMIT ?`).all(...args);
     return rows.map(checkResultFromRow);
   }
   getProvenance(source, sourceId) {
@@ -1615,24 +1709,28 @@ class UptimeStore {
     const clauses = [];
     const args = [];
     if (options.status) {
-      clauses.push("status = ?");
+      clauses.push("incidents.status = ?");
       args.push(options.status);
     }
     if (options.monitorId) {
-      clauses.push("monitor_id = ?");
+      clauses.push("incidents.monitor_id = ?");
       args.push(options.monitorId);
     }
+    if (options.workspaceId) {
+      clauses.push("monitors.workspace_id = ?");
+      args.push(normalizeWorkspaceId(options.workspaceId));
+    }
     const where = clauses.length ? `WHERE ${clauses.join(" AND ")}` : "";
     args.push(clampLimit(options.limit ?? 50));
-    const rows = this.db.query(`SELECT * FROM incidents ${where} ORDER BY opened_at DESC LIMIT ?`).all(...args);
+    const rows = this.db.query(`SELECT incidents.* FROM incidents JOIN monitors ON monitors.id = incidents.monitor_id ${where} ORDER BY opened_at DESC LIMIT ?`).all(...args);
     return rows.map(incidentFromRow);
   }
   getOpenIncident(monitorId) {
     const row = this.db.query("SELECT * FROM incidents WHERE monitor_id = ? AND status = 'open' ORDER BY opened_at DESC LIMIT 1").get(monitorId);
     return row ? incidentFromRow(row) : null;
   }
-  summary() {
-    const monitors = this.listMonitors({ includeDisabled: true });
+  summary(options = {}) {
+    const monitors = this.listMonitors({ includeDisabled: true, workspaceId: options.workspaceId });
     const summaries = monitors.map((monitor) => this.monitorSummary(monitor));
     return {
       generatedAt: new Date().toISOString(),
@@ -1644,11 +1742,15 @@ class UptimeStore {
         down: monitors.filter((m) => m.status === "down").length,
         paused: monitors.filter((m) => !m.enabled || m.status === "paused").length,
         unknown: monitors.filter((m) => m.status === "unknown").length,
-        openIncidents: this.countOpenIncidents()
+        openIncidents: this.countOpenIncidents(options.workspaceId)
       }
     };
   }
-  countOpenIncidents() {
+  countOpenIncidents(workspaceId) {
+    if (workspaceId) {
+      const row2 = this.db.query("SELECT COUNT(*) AS count FROM incidents JOIN monitors ON monitors.id = incidents.monitor_id WHERE incidents.status = 'open' AND monitors.workspace_id = ?").get(normalizeWorkspaceId(workspaceId));
+      return Number(row2?.count ?? 0);
+    }
     const row = this.db.query("SELECT COUNT(*) AS count FROM incidents WHERE status = 'open'").get();
     return Number(row?.count ?? 0);
   }
@@ -1712,7 +1814,9 @@ class UptimeStore {
   }
   ensureMonitorKindAllowsBrowserPage() {
     const row = this.db.query("SELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'monitors'").get();
-    if (!row?.sql || row.sql.includes("browser_page"))
+    const needsBrowserPage = !row?.sql?.includes("browser_page");
+    const needsWorkspaceUnique = Boolean(row?.sql?.includes("name TEXT NOT NULL UNIQUE"));
+    if (!row?.sql || !needsBrowserPage && !needsWorkspaceUnique)
       return;
     this.db.run("PRAGMA foreign_keys = OFF");
     this.db.run("PRAGMA legacy_alter_table = ON");
@@ -1722,7 +1826,8 @@ class UptimeStore {
         this.db.run(`
           CREATE TABLE monitors (
             id TEXT PRIMARY KEY,
-            name TEXT NOT NULL UNIQUE,
+            workspace_id TEXT NOT NULL DEFAULT 'local',
+            name TEXT NOT NULL,
             kind TEXT NOT NULL CHECK (kind IN ('http', 'tcp', 'browser_page')),
             url TEXT,
             host TEXT,
@@ -1737,17 +1842,18 @@ class UptimeStore {
             last_checked_at TEXT,
             revision INTEGER NOT NULL DEFAULT 1,
             created_at TEXT NOT NULL,
-            updated_at TEXT NOT NULL
+            updated_at TEXT NOT NULL,
+            UNIQUE (workspace_id, name)
           )
         `);
         this.db.run(`
           INSERT INTO monitors (
-            id, name, kind, url, host, port, method, expected_status,
+            id, workspace_id, name, kind, url, host, port, method, expected_status,
             interval_seconds, timeout_ms, retry_count, enabled, status,
             last_checked_at, revision, created_at, updated_at
           )
           SELECT
-            id, name, kind, url, host, port, method, expected_status,
+            id, workspace_id, name, kind, url, host, port, method, expected_status,
             interval_seconds, timeout_ms, retry_count, enabled, status,
             last_checked_at, revision, created_at, updated_at
           FROM monitors_old_kind
@@ -1947,6 +2053,16 @@ function rejectControlCharacters2(value, label) {
     throw new Error(`${label} must not contain control characters`);
   }
 }
+function normalizeWorkspaceId(value) {
+  const normalized = value.trim();
+  if (!normalized)
+    throw new Error("Workspace id is required");
+  rejectControlCharacters2(normalized, "Workspace id");
+  if (!/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$/.test(normalized)) {
+    throw new Error("Workspace id contains unsupported characters");
+  }
+  return normalized;
+}
 function normalizeScheduleSlot(value) {
   const slot = value.trim();
   if (!slot)
@@ -2133,6 +2249,7 @@ function assertIsoTimestamp(value, label) {
 function monitorFromRow(row) {
   return {
     id: row.id,
+    workspaceId: row.workspace_id ?? "local",
     name: row.name,
     kind: row.kind,
     url: row.url,
@@ -2614,20 +2731,20 @@ class UptimeService {
   close() {
     this.store.close();
   }
-  createMonitor(input) {
-    return this.store.createMonitor(input);
+  createMonitor(input, options = {}) {
+    return this.store.createMonitor(input, options);
   }
-  updateMonitor(idOrName, input) {
-    return this.store.updateMonitor(idOrName, input);
+  updateMonitor(idOrName, input, options = {}) {
+    return this.store.updateMonitor(idOrName, input, options);
   }
-  deleteMonitor(idOrName) {
-    return this.store.deleteMonitor(idOrName);
+  deleteMonitor(idOrName, options = {}) {
+    return this.store.deleteMonitor(idOrName, options);
   }
   listMonitors(options = {}) {
     return this.store.listMonitors(options);
   }
-  getMonitor(idOrName) {
-    return this.store.getMonitor(idOrName);
+  getMonitor(idOrName, options = {}) {
+    return this.store.getMonitor(idOrName, options);
   }
   listResults(options = {}) {
     return this.store.listResults(options);
@@ -2635,8 +2752,8 @@ class UptimeService {
   listIncidents(options = {}) {
     return this.store.listIncidents(options);
   }
-  summary() {
-    return this.store.summary();
+  summary(options = {}) {
+    return this.store.summary(options);
   }
   createProbe(input) {
     const store = this.probeStore();
@@ -2676,8 +2793,8 @@ class UptimeService {
     const execute = () => this.submitProbeResultInTransaction(input);
     return this.store.runInTransaction ? this.store.runInTransaction(execute) : execute();
   }
-  previewImport(request) {
-    return previewImport(this.store, request);
+  previewImport(request, options = {}) {
+    return previewImport(this.store, request, options);
   }
   applyImport(request) {
     return applyImport(this.store, request);
@@ -2692,7 +2809,8 @@ class UptimeService {
     return this.store.verifyBackup(backupPath);
   }
   buildReport(options = {}) {
-    return buildUptimeReport(this.summary(), options);
+    const { workspaceId, ...reportOptions } = options;
+    return buildUptimeReport(this.summary({ workspaceId }), reportOptions);
   }
   async sendReport(options = {}) {
     if (this.store.mode === "hosted" && (options.email || options.sms || options.logs)) {
@@ -3016,6 +3134,7 @@ class UptimeService {
       throw new Error("Probe job fencing token is invalid");
     if (!job.leaseExpiresAt || job.leaseExpiresAt <= new Date().toISOString())
       throw new Error("Probe job lease expired");
+    const evidence = input.evidence ? normalizeBrowserEvidence(monitor.url ?? monitor.host ?? "https://example.invalid", input.evidence) : null;
     const result = this.store.recordCheckResult({
       monitorId: monitor.id,
       checkedAt: input.checkedAt,
@@ -3023,7 +3142,7 @@ class UptimeService {
       latencyMs: input.latencyMs,
       statusCode: input.statusCode ?? null,
       error: input.error ?? null,
-      evidence: input.evidence ?? null,
+      evidence,
       attemptCount: input.attemptCount ?? 1,
       expectedMonitorRevision: input.monitorRevision
     });
@@ -3568,11 +3687,11 @@ async function handleHostedRequest(service, request, url, options) {
   }
   const apiPath = `/api${url.pathname.slice("/api/v1".length)}`;
   const scope = hostedScopeFor(request.method, apiPath);
-  requireHostedActor(request, url, options, scope);
+  const actor = requireHostedActor(request, url, options, scope);
   if (["POST", "PATCH", "DELETE"].includes(request.method)) {
     validateHostedMutationOrigin(request, url, options);
   }
-  return handleApiRoute(service, request, url, apiPath, options, true);
+  return handleApiRoute(service, request, url, apiPath, options, true, actor);
 }
 function validateHostedMutationOrigin(request, url, options) {
   const rawOrigin = request.headers.get("origin");
@@ -3587,12 +3706,12 @@ function validateHostedMutationOrigin(request, url, options) {
     throw new ApiError("cross-origin mutation rejected", 403);
   }
 }
-async function handleApiRoute(service, request, url, apiPath, options, hosted) {
+async function handleApiRoute(service, request, url, apiPath, options, hosted, actor) {
   if (request.method === "GET" && apiPath === "/api/summary") {
-    return json(service.summary());
+    return json(service.summary({ workspaceId: actor?.workspaceId }));
   }
   if (request.method === "GET" && apiPath === "/api/report") {
-    return json(service.buildReport());
+    return json(service.buildReport({ workspaceId: actor?.workspaceId }));
   }
   if (request.method === "POST" && apiPath === "/api/report") {
     if (hosted)
@@ -3649,22 +3768,24 @@ async function handleApiRoute(service, request, url, apiPath, options, hosted) {
     }));
   }
   if (request.method === "GET" && apiPath === "/api/monitors") {
-    return json(service.listMonitors({ includeDisabled: url.searchParams.get("includeDisabled") === "true" }));
+    return json(service.listMonitors({ includeDisabled: url.searchParams.get("includeDisabled") === "true", workspaceId: actor?.workspaceId }));
   }
   if (request.method === "POST" && apiPath === "/api/monitors") {
-    return json(service.createMonitor(await jsonBody(request)), 201);
+    return json(service.createMonitor(await jsonBody(request), { workspaceId: actor?.workspaceId }), 201);
   }
   if (request.method === "GET" && apiPath === "/api/incidents") {
     const status = url.searchParams.get("status");
     return json(service.listIncidents({
       status: status === "open" || status === "closed" ? status : undefined,
       monitorId: url.searchParams.get("monitorId") ?? undefined,
+      workspaceId: actor?.workspaceId,
       limit: numericParam(url, "limit", 50)
     }));
   }
   if (request.method === "GET" && apiPath === "/api/results") {
     return json(service.listResults({
       monitorId: url.searchParams.get("monitorId") ?? undefined,
+      workspaceId: actor?.workspaceId,
       limit: numericParam(url, "limit", 50)
     }));
   }
@@ -3701,7 +3822,7 @@ async function handleApiRoute(service, request, url, apiPath, options, hosted) {
     return json(service.submitProbeResult(await jsonBody(request)), 201);
   }
   if (request.method === "POST" && apiPath === "/api/imports/preview") {
-    return json(service.previewImport(await jsonBody(request)));
+    return json(service.previewImport(await jsonBody(request), { workspaceId: actor?.workspaceId }));
   }
   if (request.method === "POST" && apiPath === "/api/imports/apply") {
     if (hosted)
@@ -3723,14 +3844,14 @@ async function handleApiRoute(service, request, url, apiPath, options, hosted) {
   if (monitorMatch) {
     const id = decodeURIComponent(monitorMatch[1]);
     if (request.method === "GET" && !monitorMatch[2]) {
-      const monitor = service.getMonitor(id);
+      const monitor = service.getMonitor(id, { workspaceId: actor?.workspaceId });
       return monitor ? json(monitor) : json({ error: "not found" }, 404);
     }
     if (request.method === "PATCH" && !monitorMatch[2]) {
-      return json(service.updateMonitor(id, await jsonBody(request)));
+      return json(service.updateMonitor(id, await jsonBody(request), { workspaceId: actor?.workspaceId }));
     }
     if (request.method === "DELETE" && !monitorMatch[2]) {
-      return json({ deleted: service.deleteMonitor(id) });
+      return json({ deleted: service.deleteMonitor(id, { workspaceId: actor?.workspaceId }) });
     }
     if (request.method === "POST" && monitorMatch[2] === "check") {
       if (hosted)
@@ -3881,7 +4002,7 @@ function buildAwsDeploymentPlan(options = {}) {
   const image = clean(options.image, `${imageRepositoryUri}@sha256:<image-digest>`);
   const evidenceBucket = clean(options.evidenceBucket, `hasna-${stage}-${prefix}-evidence`);
   const hostedSqliteDbPath = clean(options.hostedSqliteDbPath, DEFAULT_HOSTED_SQLITE_DB);
-  const runtimePackageVersion = clean(options.runtimePackageVersion, "0.1.9");
+  const runtimePackageVersion = clean(options.runtimePackageVersion, "0.1.11");
   const protectedAccessMode = options.protectedAccessMode ?? DEFAULT_PROTECTED_ACCESS_MODE;
   const protectedAccessUrl = protectedAccessMode === "cloudfront_default_domain" ? "https://<cloudfront-domain>" : `https://${hostname}`;
   const cluster = `${prefix}-${stage}`;