@jeffjassky/telemetry 0.1.0

package/dist/index.cjs

@@ -0,0 +1,2394 @@
+'use strict';
+
+var uuidv7 = require('uuidv7');
+var zod = require('zod');
+var mongoose = require('mongoose');
+var crypto = require('crypto');
+var express2 = require('express');
+var fs = require('fs');
+var path2 = require('path');
+var url = require('url');
+
+var _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var express2__default = /*#__PURE__*/_interopDefault(express2);
+var fs__default = /*#__PURE__*/_interopDefault(fs);
+var path2__default = /*#__PURE__*/_interopDefault(path2);
+
+// src/server/types.ts
+var newId = uuidv7.uuidv7;
+var TelemetryKind = {
+  Event: "event",
+  Error: "error",
+  Span: "span",
+  State: "state",
+  Usage: "usage"
+};
+var TELEMETRY_KINDS = Object.values(TelemetryKind);
+var LogLevel = {
+  Debug: "debug",
+  Info: "info",
+  Warn: "warn",
+  Error: "error",
+  Fatal: "fatal"
+};
+var Env = { Prod: "prod", Staging: "staging", Dev: "dev" };
+var Origin = { Server: "server", Client: "client" };
+var UNKNOWN = "unknown";
+var PLATFORM_SCOPE = "*";
+var isPlatformScope = (tenantId) => tenantId === PLATFORM_SCOPE;
+var RESERVED_TENANT_MESSAGE = `telemetry: tenantId "${PLATFORM_SCOPE}" is reserved for the dashboard's cross-tenant platform scope and may never be written`;
+var RETENTION_DAYS = {
+  // keep-all + 90d is cheap at this scale, and it makes p95-by-route a raw
+  // query instead of a rollup design (schema §2.1)
+  [TelemetryKind.Span]: 90,
+  [TelemetryKind.Error]: 90,
+  [TelemetryKind.Event]: 730,
+  [TelemetryKind.State]: 730,
+  [TelemetryKind.Usage]: null
+  // money is immortal
+};
+var SAMPLE_RATE = {
+  [TelemetryKind.Span]: 1,
+  [TelemetryKind.Event]: 1,
+  [TelemetryKind.Error]: 1,
+  // raw storage burst-capped per fingerprint instead
+  [TelemetryKind.State]: 1,
+  [TelemetryKind.Usage]: 1
+  // NEVER sample. money.
+};
+var REJECT_TTL_DAYS = 30;
+var SCHEMA_VERSION = 2;
+var BODY_MAX_CHARS = 16384;
+var newCounters = () => ({
+  rejected: 0,
+  defaulted: 0,
+  sampled: 0,
+  capped: 0,
+  rollupSkipped: 0,
+  deduped: 0,
+  truncated: 0
+});
+var traceKeep = (traceId, rate) => {
+  if (rate >= 1) return true;
+  if (!traceId) return Math.random() < rate;
+  const tail = parseInt(traceId.slice(-8), 16);
+  if (!Number.isFinite(tail)) {
+    if (process.env.NODE_ENV !== "production") {
+      throw new Error(
+        `telemetry: traceId "${traceId}" has no parseable hex tail \u2014 trace-consistent sampling is impossible and would degrade to per-record. Use UUIDv7 or a 32-hex OTel trace id.`
+      );
+    }
+    return Math.random() < rate;
+  }
+  return tail / 4294967295 < rate;
+};
+var plain = (v) => v instanceof Map ? Object.fromEntries([...v].map(([k, x]) => [k, plain(x)])) : Array.isArray(v) ? v.map(plain) : v instanceof Date ? v : v && typeof v === "object" ? Object.fromEntries(Object.entries(v).map(([k, x]) => [k, plain(x)])) : v;
+var noopLogger = { info() {
+}, warn() {
+}, error() {
+} };
+function defineRegistry(specs) {
+  return specs;
+}
+function boundedMeta() {
+  const scalar = (v) => v === null || typeof v === "boolean" || typeof v === "number" && Number.isFinite(v) || typeof v === "string" && v.length <= 200;
+  const flat = (v) => {
+    if (scalar(v)) return true;
+    if (Array.isArray(v)) return v.length <= 20 && v.every(scalar);
+    if (v && typeof v === "object" && !(v instanceof Date)) {
+      const entries = Object.entries(v);
+      return entries.length <= 12 && entries.every(([, x]) => scalar(x));
+    }
+    return false;
+  };
+  const bounded = (v) => {
+    if (!v || typeof v !== "object" || Array.isArray(v) || v instanceof Date) return false;
+    const entries = Object.entries(v);
+    if (entries.length > 12) return false;
+    if (!entries.every(([, x]) => flat(x))) return false;
+    try {
+      return JSON.stringify(v).length <= 4096;
+    } catch {
+      return false;
+    }
+  };
+  return zod.z.unknown().transform((v) => bounded(v) ? v : void 0);
+}
+var DIM_RE = /^(subject|attr:.+|field:.+)$/;
+function validateRegistry(registry) {
+  const shapes = /* @__PURE__ */ new Map();
+  for (const [name, spec] of Object.entries(registry)) {
+    const fail = (msg) => {
+      throw new Error(`telemetry: registry "${name}": ${msg}`);
+    };
+    if (!TELEMETRY_KINDS.includes(spec.kind)) fail(`unknown kind "${spec.kind}"`);
+    if (!["server", "client", "any"].includes(spec.origin)) fail(`unknown origin "${spec.origin}"`);
+    if (!Array.isArray(spec.subjects)) fail("`subjects` must be an array of subject types");
+    if (spec.sampleRate != null && !(spec.sampleRate > 0 && spec.sampleRate <= 1)) {
+      fail(`sampleRate ${spec.sampleRate} outside (0, 1]`);
+    }
+    if (spec.burst && !(spec.burst.maxPerMinute > 0)) fail("burst.maxPerMinute must be positive");
+    if (spec.burst?.key && !DIM_RE.test(spec.burst.key)) fail(`bad burst key "${spec.burst.key}"`);
+    for (const k of spec.indexedAttrs ?? []) {
+      if (!spec.attrs || !(k in spec.attrs.shape)) fail(`indexedAttrs "${k}" not declared in attrs`);
+    }
+    for (const k of spec.indexedMetrics ?? []) {
+      if (!spec.metrics || !(k in spec.metrics.shape)) fail(`indexedMetrics "${k}" not declared in metrics`);
+    }
+    for (const r of spec.rollups ?? []) {
+      if (!r.by?.length) fail("rollup has empty `by`");
+      for (const d of r.by) if (!DIM_RE.test(d)) fail(`bad dim source "${d}"`);
+      if (r.by.filter((d) => d === "subject").length > 1) {
+        fail("rollup has more than one subject dim");
+      }
+      if (r.by.includes("subject") && !r.subjects?.length) {
+        fail("rollup uses subject without `subjects`");
+      }
+      if (r.actors && !r.actors.length) fail("rollup `actors` must be non-empty when present");
+      if (r.dimDefault !== void 0) {
+        if (typeof r.dimDefault !== "string" || !r.dimDefault) {
+          fail("rollup `dimDefault` must be a non-empty string");
+        }
+        if (/[|=]/.test(r.dimDefault)) fail(`rollup dimDefault "${r.dimDefault}" may not contain "|" or "="`);
+      }
+      const as = r.as ?? name;
+      const shape = r.by.join(",") + "|" + (r.bucket ?? "") + "|" + [...r.subjects ?? []].sort().join(",");
+      const seen = shapes.get(as);
+      if (seen && seen !== shape) {
+        throw new Error(`telemetry: rollup family "${as}" declared with two shapes: ${seen} / ${shape}`);
+      }
+      shapes.set(as, shape);
+    }
+  }
+}
+var safeKey = (k) => k.replace(/\./g, "_");
+var sanitize = (m) => m ? new Map([...m].map(([k, v]) => [safeKey(k), v])) : m;
+var SubjectRefSchema = new mongoose.Schema(
+  {
+    type: { type: String, required: true },
+    // user | org | team | session
+    id: { type: String, required: true },
+    /** disambiguates same-type parties: sender | recipient | impersonated */
+    role: { type: String }
+  },
+  { _id: false }
+);
+var BUILTIN_PLATFORMS = ["web", "electron", "ios", "android", "server", "cli"];
+var buildClientContextSchema = (platforms) => new mongoose.Schema(
+  {
+    platform: { type: String, required: true, enum: platforms },
+    appVersion: { type: String, required: true },
+    userAgent: String,
+    os: String,
+    osVersion: String,
+    browser: String,
+    browserVersion: String,
+    deviceType: String,
+    // desktop | mobile | tablet
+    locale: String,
+    timezone: String,
+    screenW: Number,
+    screenH: Number,
+    viewportW: Number,
+    viewportH: Number,
+    connection: String,
+    // 4g | wifi | slow-2g
+    online: Boolean,
+    /** client clock minus server clock, ms — client timestamps lie */
+    clockSkewMs: Number
+  },
+  { _id: false }
+);
+var StackFrameSchema = new mongoose.Schema(
+  {
+    filename: String,
+    fn: String,
+    lineno: Number,
+    colno: Number,
+    inApp: Boolean,
+    context: [String]
+  },
+  { _id: false }
+);
+var ErrorDetailSchema = new mongoose.Schema(
+  {
+    type: { type: String, required: true },
+    message: { type: String, required: true },
+    handled: { type: Boolean, required: true, default: false },
+    /** grouping key */
+    fingerprint: { type: String, required: true },
+    frames: [StackFrameSchema]
+  },
+  { _id: false }
+);
+var StateDetailSchema = new mongoose.Schema(
+  {
+    key: { type: String, required: true },
+    // 'lifecycle' | 'onboarding_step'
+    from: String,
+    to: { type: String, required: true },
+    /** how long the subject sat in `from` — answers "where do they stall" */
+    previousSinceMs: Number
+  },
+  { _id: false }
+);
+var UsageDetailSchema = new mongoose.Schema(
+  {
+    meter: { type: String, required: true },
+    quantity: { type: Number, required: true },
+    unit: { type: String, required: true },
+    /**
+     * Authoritative money. `metrics.cost_usd` is a BSON double — fine as a
+     * measure, wrong as the thing that becomes an invoice. Money is
+     * authoritative only on kind=usage; the metric is a lossy copy.
+     */
+    amount: mongoose.Schema.Types.Decimal128,
+    currency: String,
+    /** at-least-once dedupe. Deterministic, e.g. `${traceId}:${spanId}` */
+    idempotencyKey: { type: String, required: true },
+    /** who pays — 'org:o_9'. Distinct from subject and from actor. */
+    billedTo: { type: String, required: true },
+    billable: { type: Boolean, required: true, default: true },
+    priceVersion: String,
+    /** corrections are new reversing rows; never UPDATE a billed row */
+    reverses: String
+  },
+  { _id: false }
+);
+function buildBaseSchema(collection, registry, counters, opts) {
+  const schema = new mongoose.Schema(
+    {
+      /** UUIDv7 — sortable, insertion-local, replaces the ObjectId */
+      _id: { type: String, required: true },
+      schemaVersion: { type: Number, required: true },
+      occurredAt: { type: Date, required: true },
+      name: { type: String, required: true },
+      severity: { type: String, required: true, enum: Object.values(LogLevel), default: LogLevel.Info },
+      // ── identity ──
+      /** tenancy root: shard key, access boundary, index prefix. The only promoted id. */
+      tenantId: { type: String, required: true },
+      /** multi-party capable: two users, sender/recipient, admin+impersonated */
+      subjects: { type: [SubjectRefSchema], default: [] },
+      /** derived: ['user:u_1','org:o_9'] */
+      subjectKeys: { type: [String] },
+      /** who caused it */
+      actor: String,
+      /** impersonation / delegation */
+      onBehalfOf: String,
+      /** derived: actor/onBehalfOf NOT already in subjects. Erasure completeness. */
+      otherPrincipals: { type: [String] },
+      // ── origin — required, but filled by the pre-validate hook, NEVER `default:`.
+      // A schema default is applied at construction, before the hook, which would
+      // silently stamp dev traffic as prod and pin counters.defaulted at zero
+      // forever (schema §7 / ops rule 5).
+      service: { type: String, required: true },
+      release: { type: String, required: true },
+      env: { type: String, required: true, enum: Object.values(Env) },
+      origin: { type: String, enum: Object.values(Origin), default: Origin.Server },
+      /** required for client-origin events (enforced by the registry hook, not the schema) */
+      client: buildClientContextSchema(opts.platforms),
+      /**
+       * Caller-supplied idempotency for the four non-usage kinds — a Stripe
+       * webhook redelivery, a nightly lifecycle diff, a bridge that rewinds its
+       * watermark by design. Trusted server callers only; the wire dedupes on
+       * the client `_id` instead.
+       *
+       * Deliberately NOT an `_id` passthrough: `_id` is a UUIDv7 and doubles as
+       * insertion order (§2.6), so letting a caller supply an arbitrary string
+       * would break that invariant for every reader that sorts on it.
+       */
+      dedupeKey: String,
+      // ── correlation ──
+      traceId: String,
+      spanId: String,
+      parentId: String,
+      durationMs: Number,
+      // ── payload — no wildcard index; registry-driven indexes instead (§4.4) ──
+      /** STRING VALUES ONLY — Mongoose casts on assignment. Numbers belong in metrics. */
+      attrs: { type: Map, of: String, default: {} },
+      metrics: { type: Map, of: Number, default: {} },
+      /** only stored when the registry declares a schema for it */
+      data: { type: mongoose.Schema.Types.Mixed },
+      body: String,
+      // ── ops ──
+      /** 1 = kept everything. 0.05 = multiply counts by 20 when aggregating. */
+      sampleRate: { type: Number, default: 1 },
+      /** kept despite sampling (carried money or an error). NOT representative. */
+      forced: { type: Boolean, default: false },
+      expiresAt: Date,
+      /** set by forget() — row survives, identifiers do not */
+      redactedAt: Date
+    },
+    {
+      collection,
+      discriminatorKey: "kind",
+      timestamps: { createdAt: "receivedAt", updatedAt: false },
+      versionKey: false,
+      minimize: false
+    }
+  );
+  schema.index({ tenantId: 1, subjectKeys: 1, occurredAt: -1 });
+  schema.index({ tenantId: 1, kind: 1, name: 1, occurredAt: -1 });
+  schema.index(
+    { traceId: 1, occurredAt: 1 },
+    { partialFilterExpression: { traceId: { $exists: true } } }
+  );
+  schema.index(
+    { tenantId: 1, otherPrincipals: 1 },
+    { partialFilterExpression: { "otherPrincipals.0": { $exists: true } } }
+  );
+  schema.index(
+    { expiresAt: 1 },
+    { expireAfterSeconds: 0, partialFilterExpression: { expiresAt: { $exists: true } } }
+  );
+  schema.index(
+    { tenantId: 1, dedupeKey: 1 },
+    { unique: true, partialFilterExpression: { dedupeKey: { $exists: true } } }
+  );
+  schema.pre("validate", function() {
+    this._id ??= newId();
+    this.schemaVersion ??= SCHEMA_VERSION;
+    this.occurredAt ??= /* @__PURE__ */ new Date();
+    this.attrs = sanitize(this.attrs);
+    this.metrics = sanitize(this.metrics);
+    if (typeof this.body === "string" && this.body.length > opts.bodyMax) {
+      const dropped = this.body.length - opts.bodyMax;
+      this.body = `${this.body.slice(0, opts.bodyMax)}\u2026 [truncated ${dropped} chars]`;
+      counters.truncated++;
+    }
+    const refs = (this.subjects ?? []).map((s) => `${s.type}:${s.id}`);
+    this.subjectKeys = [...new Set(refs)];
+    this.otherPrincipals = [
+      ...new Set(
+        [this.actor, this.onBehalfOf].filter((r) => !!r && !refs.includes(r))
+      )
+    ];
+    for (const f of ["service", "release"]) {
+      if (!this[f]) {
+        this[f] = UNKNOWN;
+        counters.defaulted++;
+      }
+    }
+    if (!this.env) {
+      this.env = process.env.NODE_ENV === "production" ? Env.Prod : Env.Dev;
+    }
+    const spec = registry[this.name];
+    if (!spec) throw new Error(`telemetry: unregistered event "${this.name}"`);
+    if (spec.kind !== this.kind) throw new Error(`telemetry: "${this.name}" is kind=${spec.kind}`);
+    const days = "retentionDays" in spec ? spec.retentionDays : RETENTION_DAYS[this.kind];
+    if (days != null && !this.expiresAt) {
+      this.expiresAt = new Date(this.occurredAt.getTime() + days * 864e5);
+    }
+    const haveTypes = new Set((this.subjects ?? []).map((s) => s.type));
+    for (const t of spec.subjects) {
+      if (!haveTypes.has(t)) throw new Error(`telemetry: "${this.name}" requires subject "${t}"`);
+    }
+    if (spec.origin === Origin.Client && !this.client) {
+      throw new Error(`telemetry: "${this.name}" is client-origin and requires client context`);
+    }
+    if (this.kind === TelemetryKind.Span) {
+      for (const f of ["traceId", "spanId"]) {
+        if (!this[f]) throw new Error(`telemetry: span requires ${f}`);
+      }
+      if (typeof this.durationMs !== "number") throw new Error("telemetry: span requires durationMs");
+    }
+    if (this.kind === TelemetryKind.State && !this.state?.to) {
+      throw new Error("telemetry: state requires state.to");
+    }
+    const check = (label2, m, zschema) => {
+      const obj = Object.fromEntries(m ?? []);
+      if (!zschema) {
+        if (Object.keys(obj).length) throw new Error(`telemetry: "${this.name}" declares no ${label2}`);
+        return;
+      }
+      const s = zschema.strict?.() ?? zschema;
+      const r = s.safeParse(obj);
+      if (!r.success) throw new Error(`telemetry: ${label2} invalid for "${this.name}": ${r.error.message}`);
+    };
+    check("attrs", this.attrs, spec.attrs);
+    check("metrics", this.metrics, spec.metrics);
+    if (this.data != null) {
+      const s = spec.data;
+      if (!s) {
+        this.data = void 0;
+        counters.rejected++;
+      } else {
+        const strict = s.strict?.() ?? s;
+        const r = strict.safeParse(this.data);
+        if (!r.success) throw new Error(`telemetry: data invalid for "${this.name}": ${r.error.message}`);
+        if (r.data === void 0) counters.rejected++;
+        this.data = r.data;
+      }
+    }
+  });
+  return schema;
+}
+function buildTelemetryModels(opts) {
+  const { connection, registry, counters, modelName, collection } = opts;
+  const platforms = [.../* @__PURE__ */ new Set([...BUILTIN_PLATFORMS, ...opts.platforms ?? []])];
+  const bodyMax = opts.bodyMax ?? BODY_MAX_CHARS;
+  const existing = connection.models?.[modelName];
+  if (existing) {
+    return {
+      TelemetryModel: existing,
+      byKind: Object.fromEntries(
+        Object.values(TelemetryKind).map((k) => [k, (existing.discriminators ?? {})[`${modelName}_${k}`] ?? existing])
+      )
+    };
+  }
+  const base = buildBaseSchema(collection, registry, counters, { platforms, bodyMax });
+  const TelemetryModel = connection.model(modelName, base);
+  const disc = (kind, build) => TelemetryModel.discriminator(`${modelName}_${kind}`, build(), kind);
+  const byKind = {
+    [TelemetryKind.Event]: disc(TelemetryKind.Event, () => new mongoose.Schema({})),
+    // envelope suffices
+    [TelemetryKind.Error]: disc(TelemetryKind.Error, () => {
+      const s = new mongoose.Schema({ error: { type: ErrorDetailSchema, required: true } });
+      s.index(
+        { tenantId: 1, "error.fingerprint": 1, occurredAt: -1 },
+        { partialFilterExpression: { kind: TelemetryKind.Error } }
+      );
+      return s;
+    }),
+    [TelemetryKind.Span]: disc(TelemetryKind.Span, () => {
+      const s = new mongoose.Schema({});
+      s.index(
+        { traceId: 1, parentId: 1 },
+        { partialFilterExpression: { kind: TelemetryKind.Span } }
+      );
+      return s;
+    }),
+    [TelemetryKind.State]: disc(TelemetryKind.State, () => {
+      const s = new mongoose.Schema({ state: { type: StateDetailSchema, required: true } });
+      s.index(
+        { tenantId: 1, "state.key": 1, "state.to": 1, occurredAt: -1 },
+        { partialFilterExpression: { kind: TelemetryKind.State } }
+      );
+      return s;
+    }),
+    [TelemetryKind.Usage]: disc(TelemetryKind.Usage, () => {
+      const s = new mongoose.Schema({ usage: { type: UsageDetailSchema, required: true } });
+      s.index(
+        { "usage.idempotencyKey": 1 },
+        { unique: true, partialFilterExpression: { kind: TelemetryKind.Usage } }
+      );
+      s.index(
+        { tenantId: 1, "usage.meter": 1, occurredAt: 1 },
+        { partialFilterExpression: { kind: TelemetryKind.Usage } }
+      );
+      return s;
+    })
+  };
+  return { TelemetryModel, byKind };
+}
+function buildRollupModel(connection, modelName, collection) {
+  const existing = connection.models?.[modelName];
+  if (existing) return existing;
+  const schema = new mongoose.Schema(
+    {
+      /** `${tenantId}|${as}|${dims.join('|')}|${bucketKey}` — deterministic, upsert-safe */
+      _id: { type: String, required: true },
+      tenantId: { type: String, required: true },
+      /** rollup family. Several event names may feed one. */
+      as: { type: String, required: true },
+      /**
+       * Dimension values in spec order. Subject dims keep their native
+       * `type:id` form ('user:u_1') so erasure can match them directly;
+       * everything else is `key=value`. Flattened strings for the same reason
+       * subjectKeys is — never compound-index two fields of one subdoc array.
+       */
+      dims: { type: [String], required: true },
+      /** denormalized prefix of the subject dim, when there is one — §5.4 hazard */
+      subjectType: String,
+      /** UTC-truncated bucket start; absent on lifetime rollups */
+      bucketAt: Date,
+      firstAt: { type: Date, required: true },
+      lastAt: { type: Date, required: true },
+      count: { type: Number, required: true, default: 0 },
+      /** registry `sum` keys accumulated across every contributing record */
+      sums: { type: Map, of: Number, default: {} },
+      /** registry `capture` snapshot at FIRST occurrence — cohort dimensions */
+      firstCapture: { type: Map, of: String, default: {} },
+      firstTraceId: String,
+      expiresAt: Date
+    },
+    { collection, versionKey: false }
+  );
+  schema.index({ tenantId: 1, as: 1, subjectType: 1, firstAt: 1 });
+  schema.index({ tenantId: 1, as: 1, dims: 1, bucketAt: -1 });
+  schema.index({ tenantId: 1, dims: 1 });
+  schema.index(
+    { expiresAt: 1 },
+    { expireAfterSeconds: 0, partialFilterExpression: { expiresAt: { $exists: true } } }
+  );
+  return connection.model(modelName, schema);
+}
+var path = (o, p) => typeof o?.get === "function" ? o.get(p) : p.split(".").reduce((a, k) => a?.[k], o);
+var resolveDim = (src, doc) => src.startsWith("attr:") ? doc.attrs?.get(src.slice(5)) : src.startsWith("field:") ? path(doc, src.slice(6)) : void 0;
+var label = (src) => src.slice(src.indexOf(":") + 1);
+var truncate = (d, b) => {
+  if (!b) return void 0;
+  if (b === "hour") return new Date(Math.floor(d.getTime() / 36e5) * 36e5);
+  const y = d.getUTCFullYear();
+  const m = d.getUTCMonth();
+  if (b === "month") return new Date(Date.UTC(y, m, 1));
+  const day = new Date(Date.UTC(y, m, d.getUTCDate()));
+  if (b === "day") return day;
+  return new Date(day.getTime() - (day.getUTCDay() + 6) % 7 * 864e5);
+};
+async function recordRollup(RollupModel, doc, name, spec, counters) {
+  if (spec.actors && doc.actor) {
+    const actorType = String(doc.actor).split(":")[0];
+    if (!spec.actors.includes(actorType)) return;
+  }
+  const as = spec.as ?? name;
+  const at = doc.occurredAt;
+  const bucketAt = truncate(at, spec.bucket);
+  const bucketKey = bucketAt ? bucketAt.toISOString() : "";
+  const fixed = /* @__PURE__ */ new Map();
+  for (const src of spec.by) {
+    if (src === "subject") continue;
+    let v = resolveDim(src, doc);
+    if (v == null || v === "") {
+      if (spec.dimDefault === void 0) {
+        counters.rollupSkipped++;
+        return;
+      }
+      v = spec.dimDefault;
+    }
+    fixed.set(src, `${label(src)}=${String(v)}`);
+  }
+  const fansOut = spec.by.includes("subject");
+  const refs = fansOut ? (doc.subjectKeys ?? []).filter(
+    (r) => !spec.subjects || spec.subjects.includes(r.split(":")[0])
+  ) : [null];
+  if (!refs.length) return;
+  const firstCapture = Object.fromEntries(
+    (spec.capture ?? []).map((src) => [label(src), resolveDim(src, doc)]).filter(([, v]) => v != null).map(([k, v]) => [k, String(v)])
+  );
+  const expiresAt = spec.retentionDays != null ? new Date(at.getTime() + spec.retentionDays * 864e5) : void 0;
+  await RollupModel.bulkWrite(
+    refs.map((ref) => {
+      const dims = spec.by.map((src) => src === "subject" ? ref : fixed.get(src));
+      const isNewFirst = {
+        $or: [{ $eq: [{ $type: "$firstAt" }, "missing"] }, { $lt: [at, "$firstAt"] }]
+      };
+      const sums = Object.fromEntries(
+        (spec.sum ?? []).map((k) => [k, doc.metrics?.get(k)]).filter(([, v]) => typeof v === "number").map(([k, v]) => [`sums.${k}`, { $add: [{ $ifNull: [`$sums.${k}`, 0] }, v] }])
+      );
+      return {
+        updateOne: {
+          filter: { _id: `${doc.tenantId}|${as}|${dims.join("|")}|${bucketKey}` },
+          update: [
+            {
+              $set: {
+                tenantId: doc.tenantId,
+                as,
+                dims,
+                ...ref ? { subjectType: ref.split(":")[0] } : {},
+                ...bucketAt ? { bucketAt } : {},
+                ...expiresAt ? { expiresAt } : {},
+                // aggregation $min/$max ignore missing, so correct on insert too
+                firstAt: { $min: ["$firstAt", at] },
+                lastAt: { $max: ["$lastAt", at] },
+                count: { $add: [{ $ifNull: ["$count", 0] }, 1] },
+                ...sums,
+                firstTraceId: { $cond: [isNewFirst, doc.traceId ?? null, "$firstTraceId"] },
+                firstCapture: { $cond: [isNewFirst, { $literal: firstCapture }, "$firstCapture"] }
+              }
+            }
+          ],
+          upsert: true
+        }
+      };
+    }),
+    { ordered: false }
+  );
+}
+function buildCheckpointModel(connection, modelName, collection) {
+  const existing = connection.models?.[modelName];
+  if (existing) return existing;
+  const schema = new mongoose.Schema(
+    {
+      /** stable scanner name, e.g. "mailery-bridge" */
+      key: { type: String, required: true, unique: true },
+      /** high-water mark: the scanner has processed everything at/before this */
+      at: { type: Date, required: true }
+    },
+    { collection, timestamps: { createdAt: false, updatedAt: true }, versionKey: false }
+  );
+  return connection.model(modelName, schema);
+}
+function createCheckpointFactory(CheckpointModel, logger) {
+  return function checkpoint(key) {
+    return {
+      async get() {
+        try {
+          const doc = await CheckpointModel.findOne({ key }).lean();
+          return doc?.at ?? null;
+        } catch (err) {
+          logger.error({ err, key }, "[telemetry] checkpoint read failed");
+          return null;
+        }
+      },
+      async advance(at) {
+        try {
+          await CheckpointModel.updateOne({ key }, { $set: { at } }, { upsert: true });
+        } catch (err) {
+          logger.error({ err, key, at }, "[telemetry] checkpoint write failed");
+        }
+      }
+    };
+  };
+}
+
+// src/server/emit.ts
+function createEmitter(ctx) {
+  const { registry, byKind, RollupModel, rejects, counters } = ctx;
+  const burstBuckets = /* @__PURE__ */ new Map();
+  const burstAllow = (key, maxPerMinute) => {
+    const now = Date.now();
+    let b = burstBuckets.get(key);
+    if (!b || now >= b.resetAt) {
+      if (burstBuckets.size > 1e4) burstBuckets.clear();
+      b = { n: 0, resetAt: now + 6e4 };
+      burstBuckets.set(key, b);
+    }
+    return ++b.n <= maxPerMinute;
+  };
+  return async function emit(name, doc) {
+    const id = newId();
+    const reject = (reason) => {
+      counters.rejected++;
+      ctx.track(
+        rejects().insertOne({ at: /* @__PURE__ */ new Date(), name, reason, raw: plain(doc) }).catch(() => {
+        })
+      );
+      return { id, outcome: "rejected" };
+    };
+    if (isPlatformScope(doc.tenantId)) return reject(RESERVED_TENANT_MESSAGE);
+    const spec = registry[name];
+    if (!spec) return reject("unregistered event");
+    const dedupeKey = doc.dedupeKey;
+    if (dedupeKey !== void 0 && (typeof dedupeKey !== "string" || !dedupeKey || dedupeKey.length > 200)) {
+      return reject("dedupeKey must be a non-empty string of at most 200 chars");
+    }
+    const kind = spec.kind;
+    const baseRate = spec.sampleRate ?? SAMPLE_RATE[kind];
+    const forced = !!doc.forceKeep || kind === TelemetryKind.Usage || !!doc.error || dedupeKey != null || doc.metrics?.cost_usd != null;
+    const durable = kind === TelemetryKind.Usage || (doc.durable ?? spec.durable ?? false);
+    const Model = byKind[kind];
+    const { forceKeep: _drop, durable: _durable, ...rest } = doc;
+    const safe = (o) => new Map(Object.entries(o ?? {}).map(([k, v]) => [k.replace(/\./g, "_"), v]));
+    const payload = {
+      ...rest,
+      _id: id,
+      name,
+      sampleRate: forced ? 1 : baseRate,
+      forced,
+      attrs: safe(doc.attrs),
+      metrics: safe(doc.metrics)
+    };
+    const onFail = async (e) => {
+      counters.rejected++;
+      await rejects().insertOne({ at: /* @__PURE__ */ new Date(), name, reason: String(e), raw: plain(doc) }).catch(() => {
+      });
+    };
+    const d = new Model(payload);
+    try {
+      await d.validate();
+    } catch (e) {
+      await onFail(e);
+      if (kind === TelemetryKind.Usage) throw e;
+      return { id, outcome: "rejected" };
+    }
+    const rollup = () => (spec.rollups ?? []).map((r) => {
+      const p = recordRollup(RollupModel, d, name, r, counters).catch(onFail);
+      ctx.track(p);
+      return p;
+    });
+    const saveOpts = {
+      validateBeforeSave: false,
+      ...durable ? { writeConcern: { w: "majority", j: true } } : {}
+    };
+    if (kind === TelemetryKind.Usage || dedupeKey != null) {
+      try {
+        await d.save(saveOpts);
+      } catch (e) {
+        if (isDuplicateKey(e)) {
+          counters.deduped++;
+          return { id, outcome: "deduped" };
+        }
+        await onFail(e);
+        if (durable) throw e;
+        return { id, outcome: "rejected" };
+      }
+      await Promise.all(rollup());
+      return { id, outcome: "written" };
+    }
+    const aggregates = rollup();
+    if (!forced && !traceKeep(doc.traceId, baseRate)) {
+      counters.sampled++;
+      return { id, outcome: "sampled" };
+    }
+    const burst = spec.burst;
+    if (burst && doc.metrics?.cost_usd == null) {
+      const v = burst.key ? resolveDim(burst.key, d) : "";
+      if (!burstAllow(`${doc.tenantId}|${name}|${v ?? ""}`, burst.maxPerMinute)) {
+        counters.capped++;
+        return { id, outcome: "capped" };
+      }
+    }
+    if (durable) {
+      try {
+        await d.save(saveOpts);
+      } catch (e) {
+        await onFail(e);
+        throw e;
+      }
+      await Promise.all(aggregates);
+      return { id, outcome: "written" };
+    }
+    ctx.track(d.save(saveOpts).catch(onFail));
+    return { id, outcome: "queued" };
+  };
+}
+function isDuplicateKey(e) {
+  return e?.code === 11e3 || e?.cause?.code === 11e3;
+}
+function createForget(ctx) {
+  const pseudoId = (ref) => "redacted_" + crypto.createHash("sha256").update(ref + ctx.pepper()).digest("hex").slice(0, 16);
+  return async function forget(tenantId, ref) {
+    const { TelemetryModel, RollupModel } = ctx;
+    if (isPlatformScope(tenantId)) throw new Error(RESERVED_TENANT_MESSAGE);
+    const [type, rawId] = ref.split(":");
+    if (!type || !rawId) throw new Error(`telemetry: forget ref "${ref}" is not "type:id"`);
+    const newId2 = pseudoId(ref);
+    const newRef = `${type}:${newId2}`;
+    const match = { tenantId, $or: [{ subjectKeys: ref }, { otherPrincipals: ref }] };
+    const del = await TelemetryModel.deleteMany({
+      ...match,
+      kind: { $ne: TelemetryKind.Usage },
+      subjectKeys: { $eq: ref, $size: 1 },
+      // ref is the ONLY subject
+      otherPrincipals: { $in: [[], null] }
+    });
+    const red = await TelemetryModel.collection.updateMany(match, [
+      {
+        $set: {
+          subjects: {
+            $map: {
+              input: "$subjects",
+              as: "s",
+              in: {
+                $cond: [
+                  { $eq: [{ $concat: ["$$s.type", ":", "$$s.id"] }, ref] },
+                  { $mergeObjects: ["$$s", { id: newId2 }] },
+                  "$$s"
+                ]
+              }
+            }
+          },
+          subjectKeys: {
+            $map: {
+              input: "$subjectKeys",
+              as: "k",
+              in: { $cond: [{ $eq: ["$$k", ref] }, newRef, "$$k"] }
+            }
+          },
+          otherPrincipals: {
+            $map: {
+              input: { $ifNull: ["$otherPrincipals", []] },
+              as: "k",
+              in: { $cond: [{ $eq: ["$$k", ref] }, newRef, "$$k"] }
+            }
+          },
+          actor: { $cond: [{ $eq: ["$actor", ref] }, newRef, "$actor"] },
+          onBehalfOf: { $cond: [{ $eq: ["$onBehalfOf", ref] }, newRef, "$onBehalfOf"] },
+          client: "$$REMOVE",
+          redactedAt: "$$NOW"
+        }
+      }
+    ]);
+    const rolls = await RollupModel.find({ tenantId, dims: ref }).lean();
+    let rollups = 0;
+    if (rolls.length) {
+      await RollupModel.bulkWrite(
+        rolls.map((r) => {
+          const dims = r.dims.map((d) => d === ref ? newRef : d);
+          const bucketKey = r.bucketAt ? new Date(r.bucketAt).toISOString() : "";
+          return {
+            insertOne: {
+              document: { ...r, _id: `${tenantId}|${r.as}|${dims.join("|")}|${bucketKey}`, dims }
+            }
+          };
+        }),
+        { ordered: false }
+      ).catch((e) => {
+        const errs = e?.writeErrors ?? [];
+        if (e?.code !== 11e3 && !(errs.length && errs.every((w) => w.code === 11e3))) throw e;
+      });
+      rollups = (await RollupModel.deleteMany({ tenantId, dims: ref })).deletedCount;
+    }
+    await ctx.rejects().deleteMany({
+      "raw.tenantId": tenantId,
+      $or: [
+        { "raw.subjects": { $elemMatch: { type, id: rawId } } },
+        { "raw.actor": ref },
+        { "raw.onBehalfOf": ref }
+      ]
+    });
+    const aliases = (await ctx.aliases().deleteMany({ tenantId, $or: [{ anonRef: ref }, { userRef: ref }] })).deletedCount;
+    const viewScope = ctx.globalSubjectRefs() ? { $in: [tenantId, PLATFORM_SCOPE] } : tenantId;
+    const views = (await ctx.views().deleteMany({ tenantId: viewScope, ownerRef: ref, shared: { $ne: true } })).deletedCount + (await ctx.views().updateMany(
+      { tenantId: viewScope, ownerRef: ref, shared: true },
+      { $set: { ownerRef: newRef } }
+    )).modifiedCount;
+    return { deleted: del.deletedCount ?? 0, redacted: red.modifiedCount ?? 0, rollups, aliases, views };
+  };
+}
+
+// src/server/indexes.ts
+var INDEX_BUDGET = 24;
+function createSyncIndexes(ctx) {
+  return async function syncIndexes() {
+    await Promise.all(ctx.models.map((m) => m.init()));
+    const plan = (name, kind, key) => ({
+      name: `${kind}_${name.replace(/\./g, "_")}_${key}`,
+      keys: {
+        tenantId: 1,
+        [`${kind === "attr" ? "attrs" : "metrics"}.${key}`]: 1,
+        occurredAt: -1
+      },
+      partial: { name }
+      // keeps each index to just that event's rows
+    });
+    const planned = Object.entries(ctx.registry).flatMap(([name, spec]) => [
+      ...(spec.indexedAttrs ?? []).map((k) => plan(name, "attr", k)),
+      ...(spec.indexedMetrics ?? []).map((k) => plan(name, "metric", k))
+    ]);
+    const coll = ctx.TelemetryModel.collection;
+    const plannedNames = new Set(planned.map((p) => p.name));
+    for (const ix of await coll.indexes()) {
+      if ((ix.name?.startsWith("attr_") || ix.name?.startsWith("metric_")) && !plannedNames.has(ix.name)) {
+        await coll.dropIndex(ix.name);
+      }
+    }
+    if (planned.length > INDEX_BUDGET) {
+      throw new Error(`telemetry: ${planned.length} payload indexes exceeds budget ${INDEX_BUDGET}`);
+    }
+    for (const p of planned) {
+      await coll.createIndex(p.keys, {
+        name: p.name,
+        partialFilterExpression: p.partial,
+        background: true
+      });
+    }
+    await ctx.rejects().createIndex({ at: 1 }, { expireAfterSeconds: REJECT_TTL_DAYS * 86400 });
+  };
+}
+var KeyKind = { Publishable: "publishable", Secret: "secret" };
+var TenantMode = { Fixed: "fixed", Session: "session", Claimed: "claimed" };
+var KEY_RE = /^(pk|sk)_([a-z0-9]+)_(tk_[a-f0-9]{24})(?:_([a-f0-9]{48}))?$/;
+function parseKeyString(raw) {
+  if (!raw) return null;
+  const m = KEY_RE.exec(raw.trim());
+  if (!m) return null;
+  const [, prefix, label2, id, secret] = m;
+  if (prefix === "sk" && !secret) return null;
+  if (prefix === "pk" && secret) return null;
+  return { kind: prefix === "pk" ? KeyKind.Publishable : KeyKind.Secret, label: label2, id, secret };
+}
+var SCRYPT_VERSION = "scrypt1";
+var SCRYPT = { N: 16384, r: 8, p: 1, keylen: 32 };
+function hashSecret(secret) {
+  const salt = crypto.randomBytes(16).toString("hex");
+  const hash = crypto.scryptSync(secret, salt, SCRYPT.keylen, SCRYPT).toString("hex");
+  return `${SCRYPT_VERSION}$${salt}$${hash}`;
+}
+function verifySecret(secret, stored) {
+  if (!stored) return false;
+  const [version, salt, hex] = stored.split("$");
+  if (version !== SCRYPT_VERSION || !salt || !hex) return false;
+  const expected = Buffer.from(hex, "hex");
+  const actual = crypto.scryptSync(secret, salt, SCRYPT.keylen, SCRYPT);
+  return expected.length === actual.length && crypto.timingSafeEqual(expected, actual);
+}
+function buildKeyModel(connection, modelName, collection) {
+  const existing = connection.models?.[modelName];
+  if (existing) return existing;
+  const schema = new mongoose.Schema(
+    {
+      /** the tk_ id embedded in the key string — lookup is a point read */
+      _id: { type: String, required: true },
+      kind: { type: String, required: true, enum: Object.values(KeyKind) },
+      /** sk_ only — versioned scrypt hash of the secret half */
+      secretHash: String,
+      tenantMode: { type: String, required: true, enum: Object.values(TenantMode) },
+      /** required iff tenantMode = fixed */
+      tenantId: String,
+      /** stamped onto every record — the client cannot lie about where it runs */
+      service: { type: String, required: true },
+      env: { type: String, required: true },
+      /** CORS allowlist. pk_ only; empty = no browser origins accepted. */
+      origins: { type: [String], default: [] },
+      /** pk_ defaults to event/error/span; sk_ to all five */
+      allowedKinds: { type: [String], required: true },
+      /** optional narrowing to a subset of registry names */
+      allowedNames: { type: [String], default: void 0 },
+      /** records/min across the key. Distinct from EventSpec.burst (per-group). */
+      maxPerMinute: { type: Number, required: true, default: 600 },
+      createdAt: { type: Date, required: true },
+      revokedAt: Date,
+      /** touched at most once/min, not per request */
+      lastUsedAt: Date
+    },
+    { collection, versionKey: false }
+  );
+  schema.index({ revokedAt: 1 });
+  return connection.model(modelName, schema);
+}
+async function createKey(KeyModel, input) {
+  const {
+    kind,
+    tenantMode,
+    tenantId,
+    service,
+    env,
+    label: label2 = "live",
+    origins = [],
+    allowedNames,
+    maxPerMinute = 600
+  } = input;
+  if (tenantMode === TenantMode.Claimed && kind !== KeyKind.Secret) {
+    throw new Error('telemetry: tenantMode "claimed" requires a secret key');
+  }
+  if (tenantMode === TenantMode.Fixed && !tenantId) {
+    throw new Error('telemetry: tenantMode "fixed" requires tenantId');
+  }
+  if (isPlatformScope(tenantId)) throw new Error(RESERVED_TENANT_MESSAGE);
+  const allowedKinds = input.allowedKinds ?? (kind === KeyKind.Publishable ? [TelemetryKind.Event, TelemetryKind.Error, TelemetryKind.Span] : Object.values(TelemetryKind));
+  if (kind === KeyKind.Publishable && allowedKinds.includes(TelemetryKind.Usage)) {
+    throw new Error("telemetry: a publishable key may never write usage");
+  }
+  const id = `tk_${crypto.randomBytes(12).toString("hex")}`;
+  const secret = kind === KeyKind.Secret ? crypto.randomBytes(24).toString("hex") : void 0;
+  await KeyModel.create({
+    _id: id,
+    kind,
+    secretHash: secret ? hashSecret(secret) : void 0,
+    tenantMode,
+    tenantId,
+    service,
+    env,
+    origins,
+    allowedKinds,
+    allowedNames,
+    maxPerMinute,
+    createdAt: /* @__PURE__ */ new Date()
+  });
+  const prefix = kind === KeyKind.Publishable ? "pk" : "sk";
+  return { key: secret ? `${prefix}_${label2}_${id}_${secret}` : `${prefix}_${label2}_${id}`, id };
+}
+var BATCH_MAX = 100;
+function createIngest(opts) {
+  const { telemetry: t, contextAdapter, maxRecords = BATCH_MAX, bodyLimit = "512kb", keyCacheMs = 6e4 } = opts;
+  const KeyModel = t.models.keys;
+  const registry = t.registry;
+  const logger = t.logger;
+  const keyCache = /* @__PURE__ */ new Map();
+  const buckets = /* @__PURE__ */ new Map();
+  const takeRecords = (keyId, maxPerMinute, n) => {
+    const now = Date.now();
+    let b = buckets.get(keyId);
+    if (!b || now >= b.resetAt) {
+      b = { n: 0, resetAt: now + 6e4 };
+      buckets.set(keyId, b);
+    }
+    const room = Math.max(0, maxPerMinute - b.n);
+    const taken = Math.min(room, n);
+    b.n += taken;
+    return taken;
+  };
+  const loadKey = async (id) => {
+    const hit = keyCache.get(id);
+    if (hit && Date.now() - hit.at < keyCacheMs) return hit.doc;
+    const doc = await KeyModel.findById(id).lean();
+    keyCache.set(id, { doc: doc ?? null, at: Date.now() });
+    return doc ?? null;
+  };
+  const quarantine = (name, reason, raw) => {
+    t.counters.rejected++;
+    void t.collections.rejects().insertOne({ at: /* @__PURE__ */ new Date(), name, reason, raw: plain(raw) }).catch(() => {
+    });
+  };
+  const router = express2__default.default.Router();
+  router.options("/", (req, res) => {
+    const origin = req.headers.origin;
+    if (origin) {
+      res.setHeader("Access-Control-Allow-Origin", origin);
+      res.setHeader("Vary", "Origin");
+      res.setHeader("Access-Control-Allow-Methods", "POST");
+      res.setHeader("Access-Control-Allow-Headers", "authorization, content-type");
+      res.setHeader("Access-Control-Max-Age", "600");
+    }
+    res.status(204).end();
+  });
+  router.post(
+    "/",
+    async (req, res, next) => {
+      const bearer = /^Bearer\s+(.+)$/i.exec(String(req.headers.authorization ?? ""))?.[1];
+      const fromQuery = typeof req.query.key === "string" ? req.query.key : void 0;
+      const parsed = parseKeyString(bearer) ?? (fromQuery?.startsWith("pk_") ? parseKeyString(fromQuery) : null);
+      const drop = () => res.status(202).json({ accepted: 0, rejected: 0 });
+      if (!parsed) {
+        if (bearer?.startsWith("sk_") || fromQuery?.startsWith("sk_")) {
+          return res.status(401).json({ error: "invalid_key" });
+        }
+        return drop();
+      }
+      const doc = await loadKey(parsed.id);
+      const skFail = (status, error) => res.status(status).json({ error });
+      if (!doc || doc.revokedAt) {
+        return parsed.kind === KeyKind.Secret ? skFail(401, doc ? "revoked_key" : "invalid_key") : drop();
+      }
+      if (doc.kind !== parsed.kind) {
+        return parsed.kind === KeyKind.Secret ? skFail(401, "invalid_key") : drop();
+      }
+      if (parsed.kind === KeyKind.Secret && !verifySecret(parsed.secret, doc.secretHash)) {
+        return skFail(401, "invalid_key");
+      }
+      const origin = req.headers.origin;
+      if (parsed.kind === KeyKind.Publishable && origin) {
+        if (!doc.origins?.includes(origin)) return drop();
+        res.setHeader("Access-Control-Allow-Origin", origin);
+        res.setHeader("Vary", "Origin");
+      }
+      if (!doc.lastUsedAt || Date.now() - new Date(doc.lastUsedAt).getTime() > 6e4) {
+        doc.lastUsedAt = /* @__PURE__ */ new Date();
+        void KeyModel.updateOne({ _id: doc._id }, { $set: { lastUsedAt: doc.lastUsedAt } }).catch(() => {
+        });
+      }
+      req.telemetryKey = doc;
+      next();
+    },
+    express2__default.default.json({ limit: bodyLimit }),
+    async (req, res) => {
+      const key = req.telemetryKey;
+      const pk = key.kind === KeyKind.Publishable;
+      const receivedAt = /* @__PURE__ */ new Date();
+      const body = req.body ?? {};
+      let accepted = 0;
+      let rejected = 0;
+      const respond = () => res.status(202).json({ accepted, rejected });
+      let records = Array.isArray(body.records) ? body.records : [];
+      if (records.length > maxRecords) {
+        if (!pk) return res.status(413).json({ error: "batch_too_large", max: maxRecords });
+        rejected += records.length - maxRecords;
+        records = records.slice(0, maxRecords);
+      }
+      const granted = takeRecords(key._id, key.maxPerMinute, records.length);
+      if (granted < records.length) {
+        if (!pk) return res.status(429).json({ error: "rate_limited" });
+        t.counters.capped += records.length - granted;
+        rejected += records.length - granted;
+        records = records.slice(0, granted);
+      }
+      let ctx = null;
+      if (key.tenantMode === TenantMode.Fixed) {
+        ctx = { tenantId: key.tenantId };
+      } else if (key.tenantMode === TenantMode.Session) {
+        if (!contextAdapter) {
+          logger.warn("[telemetry] session-mode key but no contextAdapter configured");
+          return pk ? respond() : res.status(500).json({ error: "no_context_adapter" });
+        }
+        ctx = await contextAdapter.resolveContext(req);
+        if (!ctx) {
+          rejected += records.length;
+          return pk ? respond() : res.status(401).json({ error: "no_session" });
+        }
+      } else {
+        const claimed = body.context?.tenantId;
+        if (typeof claimed !== "string" || !claimed) {
+          return res.status(400).json({ error: "tenant_required" });
+        }
+        ctx = { tenantId: claimed };
+      }
+      const tenantId = ctx.tenantId;
+      if (isPlatformScope(tenantId)) {
+        logger.warn(`[telemetry] ingest refused a batch: ${RESERVED_TENANT_MESSAGE}`);
+        t.counters.rejected += records.length;
+        rejected += records.length;
+        return pk ? respond() : res.status(400).json({ error: "reserved_tenant" });
+      }
+      const sentAt = body.sentAt ? Date.parse(body.sentAt) : NaN;
+      const clockSkewMs = Number.isFinite(sentAt) ? sentAt - receivedAt.getTime() : 0;
+      const batchClient = {
+        platform: "web",
+        appVersion: String(body.release ?? "unknown"),
+        ...body.client && typeof body.client === "object" ? body.client : {},
+        clockSkewMs
+      };
+      const subjectsOf = (raw) => Array.isArray(raw) ? raw.filter((s) => s && typeof s.type === "string" && typeof s.id === "string").map((s) => ({ type: s.type, id: String(s.id), ...s.role ? { role: String(s.role) } : {} })) : [];
+      const claimSubjects = subjectsOf(body.context?.subjects);
+      const hostSubjects = subjectsOf(ctx.subjects);
+      const mergeSubjects = (recordSubjects) => {
+        const byType = /* @__PURE__ */ new Map();
+        for (const layer of [claimSubjects, subjectsOf(recordSubjects), hostSubjects]) {
+          const grouped = /* @__PURE__ */ new Map();
+          for (const s of layer) {
+            grouped.set(s.type, [...grouped.get(s.type) ?? [], s]);
+          }
+          for (const [type, entries] of grouped) byType.set(type, entries);
+        }
+        return [...byType.values()].flat();
+      };
+      const batchActor = typeof body.context?.actor === "string" ? body.context.actor : void 0;
+      for (const rec of records) {
+        const name = typeof rec?.name === "string" ? rec.name : "";
+        const fail = (reason) => {
+          rejected++;
+          quarantine(name || "(unnamed)", reason, rec);
+        };
+        if (name === "$identify") {
+          const anonRef = String(rec.anonRef ?? "");
+          const userRef = String(rec.userRef ?? "");
+          if (!/^.+:.+$/.test(anonRef) || !/^.+:.+$/.test(userRef)) {
+            fail("malformed $identify");
+            continue;
+          }
+          await t.collections.aliases().updateOne(
+            { _id: `${tenantId}|${anonRef}` },
+            { $set: { tenantId, anonRef, userRef, linkedAt: receivedAt } },
+            { upsert: true }
+          );
+          accepted++;
+          continue;
+        }
+        const spec = registry[name];
+        if (!spec) {
+          fail("unregistered event");
+          continue;
+        }
+        if (!key.allowedKinds.includes(spec.kind)) {
+          fail(`kind ${spec.kind} not allowed for this key`);
+          continue;
+        }
+        if (spec.origin === "server" && pk) {
+          fail("server-origin name over a publishable key");
+          continue;
+        }
+        if (key.allowedNames?.length && !key.allowedNames.includes(name)) {
+          fail("name not allowed for this key");
+          continue;
+        }
+        const id = typeof rec._id === "string" && rec._id.length >= 16 && rec._id.length <= 64 ? rec._id : null;
+        if (!id) {
+          fail("missing client _id");
+          continue;
+        }
+        const occurredRaw = rec.occurredAt ? Date.parse(rec.occurredAt) : NaN;
+        const occurredAt = Number.isFinite(occurredRaw) ? new Date(occurredRaw - clockSkewMs) : receivedAt;
+        const safeMap = (o) => o && typeof o === "object" ? new Map(Object.entries(o).map(([k, v]) => [k.replace(/\./g, "_"), v])) : /* @__PURE__ */ new Map();
+        const Model = t.models.byKind[spec.kind];
+        const d = new Model({
+          // facts the wire may not assert: tenant, service, env, origin, plane
+          // fields (forced/sampleRate stripped by construction — only the
+          // allowlisted fields below ever reach the document)
+          _id: id,
+          name,
+          tenantId,
+          occurredAt,
+          severity: typeof rec.severity === "string" ? rec.severity : void 0,
+          subjects: mergeSubjects(rec.subjects),
+          actor: ctx.actor ?? (typeof rec.actor === "string" ? rec.actor : batchActor),
+          onBehalfOf: typeof rec.onBehalfOf === "string" ? rec.onBehalfOf : void 0,
+          service: key.service,
+          env: key.env,
+          release: typeof body.release === "string" ? body.release : void 0,
+          origin: "client",
+          client: batchClient,
+          traceId: typeof rec.traceId === "string" ? rec.traceId : void 0,
+          spanId: typeof rec.spanId === "string" ? rec.spanId : void 0,
+          parentId: typeof rec.parentId === "string" ? rec.parentId : void 0,
+          durationMs: typeof rec.durationMs === "number" ? rec.durationMs : void 0,
+          attrs: safeMap(rec.attrs),
+          metrics: safeMap(rec.metrics),
+          data: rec.data,
+          body: typeof rec.body === "string" ? rec.body : void 0,
+          error: rec.error,
+          state: rec.state,
+          usage: rec.usage
+        });
+        try {
+          await d.validate();
+        } catch (e) {
+          fail(String(e));
+          continue;
+        }
+        try {
+          await d.save({
+            validateBeforeSave: false,
+            ...spec.kind === TelemetryKind.Usage ? { writeConcern: { w: "majority", j: true } } : {}
+          });
+        } catch (e) {
+          if (e?.code === 11e3 || e?.cause?.code === 11e3) {
+            accepted++;
+            continue;
+          }
+          fail(String(e));
+          continue;
+        }
+        for (const r of spec.rollups ?? []) {
+          await recordRollup(t.models.rollups, d, name, r, t.counters).catch(
+            (e) => quarantine(name, `rollup: ${e}`, rec)
+          );
+        }
+        accepted++;
+      }
+      respond();
+    }
+  );
+  router.use((err, req, res, _next) => {
+    if (req.telemetryKey?.kind === KeyKind.Secret) {
+      const status = err?.type === "entity.too.large" ? 413 : 400;
+      return res.status(status).json({ error: err?.type ?? "bad_request" });
+    }
+    t.counters.rejected++;
+    res.status(202).json({ accepted: 0, rejected: 1 });
+  });
+  return router;
+}
+
+// src/server/funnel.ts
+var DAY_MS = 864e5;
+function median(values) {
+  if (values.length === 0) return null;
+  const s = [...values].sort((a, b) => a - b);
+  const mid = s.length >> 1;
+  return s.length % 2 === 1 ? s[mid] : (s[mid - 1] + s[mid]) / 2;
+}
+function summarizeStages(subjects, stages) {
+  const firstKey = stages[0]?.key;
+  const first = firstKey ? subjects.filter((s) => s.stages[firstKey]).length : 0;
+  return stages.map((st, i) => {
+    const prev = i > 0 ? stages[i - 1] : null;
+    const next = i < stages.length - 1 ? stages[i + 1] : null;
+    const reached = [];
+    const fromAnchor = [];
+    for (const s of subjects) {
+      const at = s.stages[st.key];
+      if (!at) continue;
+      reached.push(s);
+      if (s.anchorAt) fromAnchor.push((at.getTime() - s.anchorAt.getTime()) / DAY_MS);
+    }
+    let prevReached = 0;
+    let notReached = 0;
+    const fromPrevious = [];
+    if (prev) {
+      for (const s of subjects) {
+        const p = s.stages[prev.key];
+        if (!p) continue;
+        prevReached += 1;
+        const cur = s.stages[st.key];
+        if (cur) fromPrevious.push((cur.getTime() - p.getTime()) / DAY_MS);
+        else notReached += 1;
+      }
+    }
+    return {
+      order: st.order,
+      key: st.key,
+      as: st.as,
+      label: st.label,
+      ...st.description ? { description: st.description } : {},
+      subjects: reached.length,
+      pctOfFirst: first > 0 ? reached.length / first * 100 : null,
+      pctOfPrevious: prev ? prevReached > 0 ? reached.length / prevReached * 100 : null : null,
+      medianDaysFromAnchor: median(fromAnchor),
+      medianDaysFromPrevious: prev ? median(fromPrevious) : null,
+      notReached,
+      // the divergence: maxed's `!next` clause makes every subject that reached
+      // the terminal stage "stuck" there. null says "undefined", which is true.
+      stalledAt: next ? subjects.filter((s) => s.stages[st.key] && !s.stages[next.key]).length : null
+    };
+  });
+}
+function findFamily(registry, as) {
+  for (const [name, s] of Object.entries(registry)) {
+    for (const r of s.rollups ?? []) {
+      if ((r.as ?? name) === as) return { name, spec: r };
+    }
+  }
+  return null;
+}
+function requireMilestoneFamily(registry, as, primitive) {
+  const found = findFamily(registry, as);
+  if (!found) {
+    throw new Error(
+      `telemetry: ${primitive} \u2014 no rollup family "${as}" is declared. Add a \`rollups: [{ as: '${as}', by: ['subject'], subjects: [...] }]\` block to the event that marks it.`
+    );
+  }
+  const { name, spec } = found;
+  const shape = `by: [${spec.by.map((d) => `'${d}'`).join(", ")}]${spec.bucket ? `, bucket: '${spec.bucket}'` : ""}`;
+  if (spec.bucket) {
+    throw new Error(
+      `telemetry: ${primitive} \u2014 rollup family "${as}" (declared on "${name}") is BUCKETED (${shape}). A milestone needs a lifetime family so \`firstAt\` is the one moment the subject reached it; a bucketed family has one doc per period and would count the same subject repeatedly.`
+    );
+  }
+  if (spec.by.length !== 1 || spec.by[0] !== "subject") {
+    throw new Error(
+      `telemetry: ${primitive} \u2014 rollup family "${as}" (declared on "${name}") is keyed ${shape}, but a milestone must be keyed by exactly one subject dim (\`by: ['subject']\`). Extra dims split one subject across several docs, which would over-count every stage.`
+    );
+  }
+  return spec;
+}
+function cohortWindow(c) {
+  const endInclusive = c.endInclusive === true;
+  return { from: c.from, to: endInclusive ? new Date(c.to.getTime() + 1) : c.to, endInclusive };
+}
+async function runFunnel(ctx, scope, params) {
+  if (!params.stages?.length) throw new Error("telemetry: funnel() needs at least one stage");
+  const stages = params.stages.map((s, i) => ({
+    order: i + 1,
+    key: s.key ?? s.as,
+    as: s.as,
+    label: s.label ?? s.key ?? s.as,
+    ...s.description ? { description: s.description } : {}
+  }));
+  const exits = (params.exits ?? []).map((s, i) => ({
+    order: i + 1,
+    key: s.key ?? s.as,
+    as: s.as,
+    label: s.label ?? s.key ?? s.as
+  }));
+  const anchor = params.anchor ?? stages[0].as;
+  requireMilestoneFamily(ctx.registry, anchor, "funnel()");
+  for (const s of [...stages, ...exits]) requireMilestoneFamily(ctx.registry, s.as, "funnel()");
+  const { from, to, endInclusive } = cohortWindow(params.cohort);
+  const cap = Math.min(Math.max(1, params.limit ?? ctx.cohortCap), ctx.cohortCap);
+  const cohortMatch = {
+    ...ctx.scopeMatch(scope),
+    as: anchor,
+    // AMBIGUOUS-2 (cohort-math): maxed's cohort read overwrites per row with no
+    // ordering, so its `signupAt` is whichever row Mongo returned last —
+    // nondeterministic. Unreachable here by construction: the rollup's `firstAt`
+    // is a `$min` maintained on write, so the anchor timestamp is the EARLIEST
+    // occurrence, always, matching the tie-break rule maxed uses everywhere else
+    // (R12). We take min(at) and the storage enforces it.
+    firstAt: { $gte: from, $lt: to }
+  };
+  if (params.subjectType) cohortMatch.subjectType = params.subjectType;
+  const cohortRows = await ctx.RollupModel.find(cohortMatch).sort({ firstAt: 1 }).limit(cap + 1).lean();
+  const truncated = cohortRows.length > cap;
+  if (truncated) cohortRows.pop();
+  const keyOf = (r) => `${r.tenantId ?? ""}|${r.dims?.[0]}`;
+  const index = /* @__PURE__ */ new Map();
+  const refs = /* @__PURE__ */ new Set();
+  const tenants = /* @__PURE__ */ new Set();
+  for (const r of cohortRows) {
+    const ref = r.dims?.[0];
+    if (!ref) continue;
+    refs.add(ref);
+    tenants.add(String(r.tenantId ?? ""));
+    index.set(keyOf(r), { ref, anchorAt: r.firstAt, stages: {}, exits: {} });
+  }
+  if (refs.size) {
+    const byAs = /* @__PURE__ */ new Map();
+    for (const s of [...stages, ...exits]) {
+      const list = byAs.get(s.as) ?? [];
+      list.push(s);
+      byAs.set(s.as, list);
+    }
+    const stageRows = await ctx.RollupModel.find({
+      ...ctx.scopeMatch(scope),
+      as: { $in: [...byAs.keys()] },
+      dims: { $in: [...refs] },
+      // AMBIGUOUS-1 (cohort-math): maxed collects stages with `at >= cohortStart`
+      // and no upper bound. We keep the lower bound — reading (a), as-written.
+      // Reasons: (1) it is what maxed does, and an equivalence test against a
+      // table computed under the other reading would prove nothing; (2) over
+      // rollup storage the predicate reads "first reached no earlier than the
+      // cohort opened", which is the only reading under which a cohort's funnel
+      // is a function of its own window — drop the bound and a backfill dated
+      // before the window silently adds stages to a report already published.
+      // No UPPER bound, deliberately: a conversion landing months after the
+      // window still belongs to its cohort (R7).
+      firstAt: { $gte: from }
+    }).limit(refs.size * tenants.size * byAs.size + 1).lean();
+    for (const r of stageRows) {
+      const subject = index.get(keyOf(r));
+      if (!subject) continue;
+      for (const s of byAs.get(r.as) ?? []) {
+        const bag = exits.includes(s) ? subject.exits : subject.stages;
+        const prevAt = bag[s.key];
+        if (!prevAt || r.firstAt < prevAt) bag[s.key] = r.firstAt;
+      }
+    }
+  }
+  const subjects = [...index.values()];
+  const summary = summarizeStages(subjects, stages);
+  let slices = null;
+  if (params.interval) {
+    const groups = /* @__PURE__ */ new Map();
+    for (const s of subjects) {
+      if (!s.anchorAt) continue;
+      const at = truncate(s.anchorAt, params.interval);
+      const k = at.getTime();
+      groups.set(k, [...groups.get(k) ?? [], s]);
+    }
+    slices = [...groups.entries()].sort((a, b) => a[0] - b[0]).map(([k, members]) => ({
+      at: new Date(k),
+      subjects: members.length,
+      stages: summarizeStages(members, stages)
+    }));
+  }
+  return {
+    cohortSubjects: subjects.length,
+    first: stages[0] ? subjects.filter((s) => s.stages[stages[0].key]).length : 0,
+    stages: summary,
+    exits: exits.map((e) => ({
+      key: e.key,
+      as: e.as,
+      label: e.label,
+      subjects: subjects.filter((s) => s.exits[e.key]).length
+    })),
+    slices,
+    truncated,
+    cohort: { from: params.cohort.from, to: params.cohort.to, endInclusive, anchor },
+    dataSource: "rollups"
+  };
+}
+
+// src/server/query.ts
+var DEFAULT_LIMITS = {
+  records: 200,
+  series: 744,
+  // a month of hourly buckets
+  rollups: 500,
+  trace: 500,
+  journey: 500,
+  distribution: 1e5,
+  distinct: 1e5,
+  funnel: 5e3
+};
+var esc = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function buildMatch(scope, range, f) {
+  const match = {
+    // the ONLY place the tenant term is optional. Omitted under '*' — every
+    // other term still applies, and the time range is still mandatory (§18).
+    ...isPlatformScope(scope) ? {} : { tenantId: scope },
+    occurredAt: { $gte: range.from, $lt: range.to }
+  };
+  for (const k of ["kind", "name", "severity", "env", "service", "release", "traceId"]) {
+    if (f[k]) match[k] = f[k];
+  }
+  if (f.subject) match.subjectKeys = f.subject;
+  for (const [k, v] of Object.entries(f.attrs ?? {})) match[`attrs.${k}`] = v;
+  for (const [k, r] of Object.entries(f.metrics ?? {})) {
+    const term = {};
+    if (r.gte != null) term.$gte = r.gte;
+    if (r.lte != null) term.$lte = r.lte;
+    if (Object.keys(term).length) match[`metrics.${k}`] = term;
+  }
+  if (f.excludeActorTypes?.length) {
+    match.$and = [
+      ...match.$and ?? [],
+      {
+        $or: [
+          { actor: { $exists: false } },
+          { actor: { $not: new RegExp(`^(${f.excludeActorTypes.map(esc).join("|")}):`) } }
+        ]
+      }
+    ];
+  }
+  return match;
+}
+var QueryCache = class {
+  constructor(ttlMs, cap) {
+    this.ttlMs = ttlMs;
+    this.cap = cap;
+  }
+  ttlMs;
+  cap;
+  store = /* @__PURE__ */ new Map();
+  get(key, produce) {
+    const hit = this.store.get(key);
+    if (hit && Date.now() - hit.at < this.ttlMs) return hit.value;
+    const value = produce();
+    value.catch(() => this.store.delete(key));
+    if (this.store.size >= this.cap) {
+      const oldest = [...this.store.entries()].sort((a, b) => a[1].at - b[1].at)[0];
+      if (oldest) this.store.delete(oldest[0]);
+    }
+    this.store.set(key, { at: Date.now(), value });
+    return value;
+  }
+};
+function createQueries(ctx) {
+  const limits = { ...DEFAULT_LIMITS, ...ctx.limits };
+  const slowMs = ctx.slowMs ?? 500;
+  const cache = new QueryCache(ctx.cacheTtlMs ?? 10 * 6e4, ctx.cacheSize ?? 60);
+  const timed = async (op, params, run) => {
+    const t0 = Date.now();
+    try {
+      return await run();
+    } finally {
+      const ms = Date.now() - t0;
+      if (ms > slowMs) ctx.onSlowQuery?.({ op, ms, params });
+    }
+  };
+  return {
+    /** cursor-paged raw envelope reads — tables, lists, detail drawers */
+    async records(scope, range, filter = {}, opts = {}) {
+      const limit = Math.min(Math.max(1, opts.limit ?? limits.records), limits.records);
+      const match = buildMatch(scope, range, filter);
+      if (opts.cursor) {
+        const [atIso, id] = JSON.parse(Buffer.from(opts.cursor, "base64url").toString());
+        const at = new Date(atIso);
+        match.$and = [
+          ...match.$and ?? [],
+          { $or: [{ occurredAt: { $lt: at } }, { occurredAt: at, _id: { $lt: id } }] }
+        ];
+      }
+      return timed("records", { scope, filter }, async () => {
+        const items = await ctx.TelemetryModel.find(match).sort({ occurredAt: -1, _id: -1 }).limit(limit + 1).lean();
+        const more = items.length > limit;
+        if (more) items.pop();
+        const last = items[items.length - 1];
+        return {
+          items,
+          nextCursor: more ? Buffer.from(JSON.stringify([new Date(last.occurredAt).toISOString(), last._id])).toString("base64url") : null,
+          dataSource: "raw"
+        };
+      });
+    },
+    /** time-series at query time. count extrapolates by 1/sampleRate (§5.3) —
+     *  exact while rates sit at 1, still honest the day one drops.
+     *
+     *  Under PLATFORM_SCOPE this aggregates ACROSS tenants into one bucket per
+     *  interval. That is the platform-wide chart, not a bug — the sum of every
+     *  tenant is the number a platform operator came for. A per-tenant
+     *  breakdown is a different question; ask it with rollups() or by scoping
+     *  to a tenant. Same for distribution() below. */
+    series(scope, range, filter, opts = {}) {
+      const { measure = "count", interval = "day" } = opts;
+      const key = JSON.stringify(["series", scope, range.from, range.to, filter, measure, interval]);
+      return cache.get(
+        key,
+        () => timed("series", { scope, filter, measure, interval }, async () => {
+          const m = /^(sum|avg):(.+)$/.exec(measure);
+          const value = !m ? { $sum: { $divide: [1, { $ifNull: ["$sampleRate", 1] }] } } : m[1] === "sum" ? { $sum: `$metrics.${m[2]}` } : { $avg: `$metrics.${m[2]}` };
+          const buckets = await ctx.TelemetryModel.aggregate([
+            { $match: buildMatch(scope, range, filter) },
+            {
+              $group: {
+                _id: { $dateTrunc: { date: "$occurredAt", unit: interval, ...interval === "week" ? { startOfWeek: "monday" } : {} } },
+                value
+              }
+            },
+            { $sort: { _id: 1 } },
+            { $limit: limits.series }
+          ]);
+          return { buckets: buckets.map((b) => ({ at: b._id, value: b.value })), dataSource: "raw" };
+        })
+      );
+    },
+    /**
+     * Percentiles + histogram off raw. Keep-all makes the SAMPLE complete —
+     * no sampling stands between the match and the math (§5.3) — but the
+     * computation is not exact and this comment used to claim it was:
+     * `$percentile` runs `method: 'approximate'` (t-digest), and the scan stops
+     * at `limits.distribution`.
+     *
+     * So the ceiling is read as cap+1 and `truncated` reports whether it was
+     * actually reached, the same way rollups/distinctCount/funnel do. A match
+     * wider than the ceiling is an undercount, and an undercount the response
+     * does not mention is the silent cap this package refuses everywhere else.
+     * Mongo 7+.
+     */
+    distribution(scope, range, filter, opts = {}) {
+      const measure = opts.measure ?? "durationMs";
+      const path3 = measure === "durationMs" ? "$durationMs" : `$metrics.${measure.replace(/^metric:/, "")}`;
+      const key = JSON.stringify(["distribution", scope, range.from, range.to, filter, measure]);
+      return cache.get(
+        key,
+        () => timed("distribution", { scope, filter, measure }, async () => {
+          const match = {
+            ...buildMatch(scope, range, filter),
+            [path3.slice(1)]: { $exists: true }
+          };
+          const cap = limits.distribution;
+          const [summary] = await ctx.TelemetryModel.aggregate([
+            { $match: match },
+            { $limit: cap + 1 },
+            {
+              $group: {
+                _id: null,
+                p: { $percentile: { input: path3, p: [0.5, 0.9, 0.95, 0.99], method: "approximate" } },
+                min: { $min: path3 },
+                max: { $max: path3 },
+                avg: { $avg: path3 },
+                n: { $sum: 1 }
+              }
+            }
+          ]);
+          if (!summary) return { n: 0, truncated: false, dataSource: "raw" };
+          const [p50, p90, p95, p99] = summary.p;
+          const histogram = await ctx.TelemetryModel.aggregate([
+            { $match: match },
+            { $limit: cap + 1 },
+            { $bucketAuto: { groupBy: path3, buckets: 20 } }
+          ]);
+          return {
+            p50,
+            p90,
+            p95,
+            p99,
+            min: summary.min,
+            max: summary.max,
+            avg: summary.avg,
+            n: summary.n,
+            histogram: histogram.map((h) => ({ min: h._id.min, max: h._id.max, n: h.count })),
+            truncated: summary.n > cap,
+            dataSource: "raw"
+          };
+        })
+      );
+    },
+    /** rollup family reads — issues, spend, activity, milestones, funnels */
+    rollups(scope, params) {
+      const key = JSON.stringify(["rollups", scope, params]);
+      return cache.get(
+        key,
+        () => timed("rollups", { scope, params }, async () => {
+          let bucketed = false;
+          outer: for (const [name, s] of Object.entries(ctx.registry)) {
+            for (const r of s.rollups ?? []) {
+              if ((r.as ?? name) === params.as) {
+                bucketed = !!r.bucket;
+                break outer;
+              }
+            }
+          }
+          const match = {
+            ...isPlatformScope(scope) ? {} : { tenantId: scope },
+            as: params.as
+          };
+          if (params.dims) {
+            match.dims = Array.isArray(params.dims) ? { $in: params.dims } : params.dims;
+          }
+          if (params.subjectType) match.subjectType = params.subjectType;
+          if (params.range) {
+            const on = params.on ?? (bucketed ? "bucketAt" : "lastAt");
+            match[on] = { $gte: params.range.from, $lt: params.range.to };
+          }
+          const sortKey = params.sort ?? (bucketed ? "bucketAt" : "count");
+          const limit = Math.min(Math.max(1, params.limit ?? limits.rollups), limits.rollups);
+          const rows = await ctx.RollupModel.find(match).sort({ [sortKey]: sortKey === "firstAt" || sortKey === "bucketAt" ? 1 : -1 }).limit(limit + 1).lean();
+          const truncated = rows.length > limit;
+          if (truncated) rows.pop();
+          return { rows, bucketed, truncated, dataSource: "rollups" };
+        })
+      );
+    },
+    /** one trace, every kind, one time axis — the first join view */
+    trace(scope, traceId) {
+      return timed("trace", { scope, traceId }, async () => {
+        const items = await ctx.TelemetryModel.find({
+          ...isPlatformScope(scope) ? {} : { tenantId: scope },
+          traceId
+        }).sort({ occurredAt: 1 }).limit(limits.trace).lean();
+        return { items, dataSource: "raw" };
+      });
+    },
+    /** one subject's whole story — records interleaved, milestones as markers */
+    journey(scope, subjectRef, range, opts = {}) {
+      return timed("journey", { scope, subjectRef }, async () => {
+        const limit = Math.min(Math.max(1, opts.limit ?? limits.journey), limits.journey);
+        const pin = isPlatformScope(scope) ? {} : { tenantId: scope };
+        const [records, milestones] = await Promise.all([
+          ctx.TelemetryModel.find({
+            ...pin,
+            subjectKeys: subjectRef,
+            occurredAt: { $gte: range.from, $lt: range.to }
+          }).sort({ occurredAt: -1 }).limit(limit).lean(),
+          // lifetime families only — bucketed activity rows would drown the markers
+          ctx.RollupModel.find({ ...pin, dims: subjectRef, bucketAt: { $exists: false } }).sort({ firstAt: 1 }).limit(100).lean()
+        ]);
+        return { records, milestones, dataSource: "raw+rollups" };
+      });
+    },
+    /**
+     * Distinct subjects per bucket, and over the whole range — DAU/MAU/WAU,
+     * EXACTLY, with no sketch and no write-path change.
+     *
+     * The trick is that there is no trick. A family declared `by: ['subject']`
+     * with a bucket already writes exactly ONE doc per (subject, bucket), which
+     * is what the deterministic `_id` guarantees. So distinct-subjects-in-bucket
+     * IS the doc count, and distinct-over-a-range is one `$group` on `dims`. An
+     * HLL sketch would buy approximation we do not need and storage we would
+     * have to maintain.
+     *
+     * `interval` may be COARSER than the family's own bucket (daily rows →
+     * monthly MAU) — re-truncating bucket starts cannot split a bucket across
+     * two periods, so the roll-up stays exact. Asking for finer than the family
+     * writes cannot invent detail: it returns the family's own grain.
+     */
+    distinctCount(scope, params) {
+      const spec = requireDistinctFamily(ctx.registry, params.as);
+      const interval = params.interval ?? spec.bucket;
+      const key = JSON.stringify(["distinctCount", scope, params]);
+      return cache.get(
+        key,
+        () => timed("distinctCount", { scope, params }, async () => {
+          const match = {
+            ...isPlatformScope(scope) ? {} : { tenantId: scope },
+            as: params.as,
+            bucketAt: { $gte: params.range.from, $lt: params.range.to }
+          };
+          if (params.subjectType) match.subjectType = params.subjectType;
+          const cap = limits.distinct;
+          const [out] = await ctx.RollupModel.aggregate([
+            { $match: match },
+            // one scan ceiling, shared by both branches — and cap+1 so the
+            // response can SAY it was truncated instead of quietly undercounting
+            { $limit: cap + 1 },
+            {
+              $facet: {
+                buckets: [
+                  {
+                    $group: {
+                      _id: {
+                        at: { $dateTrunc: { date: "$bucketAt", unit: interval, ...interval === "week" ? { startOfWeek: "monday" } : {} } },
+                        dims: "$dims"
+                      }
+                    }
+                  },
+                  { $group: { _id: "$_id.at", value: { $sum: 1 } } },
+                  { $sort: { _id: 1 } },
+                  { $limit: limits.series }
+                ],
+                distinct: [{ $group: { _id: "$dims" } }, { $count: "n" }],
+                scanned: [{ $count: "n" }]
+              }
+            }
+          ]);
+          const scanned = out?.scanned?.[0]?.n ?? 0;
+          return {
+            buckets: (out?.buckets ?? []).map((b) => ({ at: b._id, value: b.value })),
+            /** distinct subjects across the WHOLE range — never the sum of the buckets */
+            distinct: out?.distinct?.[0]?.n ?? 0,
+            interval,
+            truncated: scanned > cap,
+            dataSource: "rollups"
+          };
+        })
+      );
+    },
+    /**
+     * Cohort funnel over lifetime milestone families — stage counts, conversion,
+     * and median time-to-step. See funnel.ts; the math lives there so it can be
+     * unit-pinned without a database.
+     */
+    funnel(scope, params) {
+      return timed(
+        "funnel",
+        { scope, params },
+        () => runFunnel(
+          {
+            RollupModel: ctx.RollupModel,
+            registry: ctx.registry,
+            cohortCap: limits.funnel,
+            scopeMatch: (s) => isPlatformScope(s) ? {} : { tenantId: s }
+          },
+          scope,
+          params
+        )
+      );
+    }
+  };
+}
+function requireDistinctFamily(registry, as) {
+  const found = findFamily(registry, as);
+  if (!found) {
+    throw new Error(
+      `telemetry: distinctCount() \u2014 no rollup family "${as}" is declared. Add \`rollups: [{ as: '${as}', by: ['subject'], subjects: [...], bucket: 'day' }]\` to the events that count as activity.`
+    );
+  }
+  const { name, spec } = found;
+  const by = `by: [${spec.by.map((d) => `'${d}'`).join(", ")}]`;
+  if (!spec.bucket) {
+    throw new Error(
+      `telemetry: distinctCount() \u2014 rollup family "${as}" (declared on "${name}") has no \`bucket\`. Distinct-per-period needs one doc per (subject, period); a lifetime family has one doc per subject forever, so every period would report the same number. Add \`bucket: 'day'\`, or ask this with rollups().`
+    );
+  }
+  if (!spec.by.includes("subject")) {
+    throw new Error(
+      `telemetry: distinctCount() \u2014 rollup family "${as}" (declared on "${name}") is keyed ${by} with no \`subject\` dim, so its docs count OCCURRENCES, not subjects. Add 'subject' to \`by\` (with \`subjects: [...]\`).`
+    );
+  }
+  if (spec.by.length !== 1) {
+    throw new Error(
+      `telemetry: distinctCount() \u2014 rollup family "${as}" (declared on "${name}") is keyed ${by}. Extra dims split one subject across several docs per period, so the count would exceed the true distinct total. Declare a second family with \`by: ['subject']\` for the distinct question.`
+    );
+  }
+  return spec;
+}
+function buildViewModel(connection, modelName, collection) {
+  const existing = connection.models?.[modelName];
+  if (existing) return existing;
+  const schema = new mongoose.Schema(
+    {
+      _id: { type: String, required: true },
+      tenantId: { type: String, required: true },
+      /** a person — forget() deletes private views, redacts this on shared ones */
+      ownerRef: String,
+      shared: { type: Boolean, default: false },
+      spec: { type: mongoose.Schema.Types.Mixed, required: true },
+      createdAt: { type: Date, required: true }
+    },
+    { collection, versionKey: false }
+  );
+  schema.index({ tenantId: 1, shared: 1 });
+  schema.index({ tenantId: 1, ownerRef: 1 });
+  return connection.model(modelName, schema);
+}
+var KIND_PAGE = {
+  error: "errors",
+  span: "traces",
+  event: "events",
+  state: "journeys",
+  usage: "usage"
+};
+function deriveViews(registry) {
+  const views = [];
+  const families = /* @__PURE__ */ new Set();
+  for (const [name, spec] of Object.entries(registry)) {
+    views.push({
+      origin: "derived",
+      name,
+      page: KIND_PAGE[spec.kind] ?? "events",
+      query: { range: "7d", filters: { name }, display: spec.kind === "event" ? "series" : "table" }
+    });
+    for (const r of spec.rollups ?? []) families.add(r.as ?? name);
+  }
+  for (const as of families) {
+    views.push({
+      origin: "derived",
+      name: `rollup: ${as}`,
+      page: "journeys",
+      query: { range: "30d", filters: { rollup: as }, display: "breakdown" }
+    });
+  }
+  return views;
+}
+async function resolveViews(opts) {
+  const byName = /* @__PURE__ */ new Map();
+  for (const v of deriveViews(opts.registry)) byName.set(v.name, v);
+  for (const v of opts.configured) byName.set(v.name, { ...v, origin: "configured" });
+  const saved = await opts.ViewModel.find({
+    tenantId: opts.tenantId,
+    $or: [{ shared: true }, ...opts.viewerRef ? [{ ownerRef: opts.viewerRef }] : []]
+  }).sort({ createdAt: 1 }).limit(200).lean();
+  for (const doc of saved) {
+    byName.set(doc.spec.name, {
+      ...doc.spec,
+      origin: "saved",
+      id: doc._id,
+      ownerRef: doc.ownerRef,
+      shared: doc.shared
+    });
+  }
+  return [...byName.values()];
+}
+async function saveView(opts) {
+  if (!opts.shared && !opts.viewerRef) {
+    throw Object.assign(new Error("private views need a viewer identity"), { status: 400 });
+  }
+  const id = newId();
+  await opts.ViewModel.create({
+    _id: id,
+    tenantId: opts.tenantId,
+    ownerRef: opts.viewerRef,
+    shared: opts.shared,
+    spec: opts.spec,
+    createdAt: /* @__PURE__ */ new Date()
+  });
+  return { id };
+}
+
+// src/server/dashboard.ts
+var here = path2__default.default.dirname(url.fileURLToPath((typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && _documentCurrentScript.tagName.toUpperCase() === 'SCRIPT' && _documentCurrentScript.src || new URL('index.cjs', document.baseURI).href))));
+var SPA_DIR_CANDIDATES = ["./ui", "../../dist/ui"];
+function defaultSpaDir() {
+  for (const candidate of SPA_DIR_CANDIDATES) {
+    const dir = path2__default.default.resolve(here, candidate);
+    if (fs__default.default.existsSync(path2__default.default.join(dir, "index.html"))) return dir;
+  }
+  return path2__default.default.resolve(here, SPA_DIR_CANDIDATES[SPA_DIR_CANDIDATES.length - 1]);
+}
+function escapeJson(value) {
+  return JSON.stringify(value).replace(/</g, "\\u003c");
+}
+var parseRange = (q) => {
+  const to = q.to ? new Date(String(q.to)) : /* @__PURE__ */ new Date();
+  const from = q.from ? new Date(String(q.from)) : new Date(to.getTime() - 7 * 864e5);
+  if (Number.isNaN(from.getTime()) || Number.isNaN(to.getTime()) || from >= to) {
+    throw Object.assign(new Error("invalid time range"), { status: 400 });
+  }
+  return { from, to };
+};
+var parseFilter = (q) => {
+  const f = {};
+  for (const k of ["kind", "name", "severity", "env", "service", "release", "subject", "traceId"]) {
+    if (typeof q[k] === "string" && q[k]) f[k] = q[k];
+  }
+  if (typeof q.attrs === "string" && q.attrs) {
+    f.attrs = Object.fromEntries(
+      String(q.attrs).split(",").map((p) => p.split(":")).filter((p) => p.length >= 2).map(([k, ...v]) => [k, v.join(":")])
+    );
+  }
+  if (typeof q.metrics === "string" && q.metrics) {
+    f.metrics = {};
+    for (const term of String(q.metrics).split(",")) {
+      const m = /^([\w.]+)([<>])(-?[\d.]+)$/.exec(term);
+      if (m) f.metrics[m[1]] = m[2] === ">" ? { gte: Number(m[3]) } : { lte: Number(m[3]) };
+    }
+  }
+  if (typeof q.excludeActors === "string" && q.excludeActors) {
+    f.excludeActorTypes = String(q.excludeActors).split(",").filter(Boolean);
+  }
+  return f;
+};
+var ROLLUP_ON = ["firstAt", "lastAt", "bucketAt"];
+var ROLLUP_SORT = ["count", "lastAt", "firstAt", "bucketAt"];
+var MAX_DIMS = 100;
+var parseDims = (v) => {
+  if (typeof v === "string") return v || void 0;
+  if (!Array.isArray(v)) return void 0;
+  if (v.length > MAX_DIMS) {
+    throw Object.assign(new Error(`at most ${MAX_DIMS} dims values`), { status: 400 });
+  }
+  if (!v.every((d) => typeof d === "string" && d)) {
+    throw Object.assign(new Error("dims must be non-empty strings"), { status: 400 });
+  }
+  return v.length ? v : void 0;
+};
+function registryProjection(t) {
+  return Object.fromEntries(
+    Object.entries(t.registry).map(([name, spec]) => [
+      name,
+      {
+        kind: spec.kind,
+        origin: spec.origin,
+        subjects: spec.subjects,
+        description: spec.description,
+        attrKeys: spec.attrs ? Object.keys(spec.attrs.shape) : [],
+        metricKeys: spec.metrics ? Object.keys(spec.metrics.shape) : [],
+        indexedAttrs: spec.indexedAttrs ?? [],
+        indexedMetrics: spec.indexedMetrics ?? [],
+        rollups: (spec.rollups ?? []).map((r) => ({
+          as: r.as ?? name,
+          by: r.by,
+          bucket: r.bucket ?? null,
+          sum: r.sum ?? [],
+          subjects: r.subjects ?? []
+        }))
+      }
+    ])
+  );
+}
+function createDashboard(opts) {
+  const { telemetry: t, viewerAdapter, subjectAdapter, views: configured = [] } = opts;
+  if (!viewerAdapter?.resolveViewer) {
+    throw new Error(
+      "telemetry: createDashboard requires a viewerAdapter \u2014 an unauthenticated telemetry dashboard is a data leak with charts"
+    );
+  }
+  const mountPath = opts.mountPath ?? "/telemetry";
+  const apiBase = opts.apiBase ?? mountPath;
+  const title = opts.title ?? "Telemetry";
+  const spaDir = opts.spaDir ?? defaultSpaDir();
+  const conn = t.models.telemetry.db;
+  const ViewModel = buildViewModel(
+    conn,
+    `${t.models.telemetry.modelName}View`,
+    `${t.models.telemetry.collection.collectionName}_views`
+  );
+  const q = createQueries({
+    TelemetryModel: t.models.telemetry,
+    RollupModel: t.models.rollups,
+    registry: t.registry,
+    limits: opts.queryLimits,
+    onSlowQuery: opts.onSlowQuery,
+    // forwarded, not re-defaulted — an onSlowQuery pinned at the 500ms default
+    // is a callback the host cannot aim
+    slowMs: opts.slowMs,
+    cacheTtlMs: opts.cacheTtlMs,
+    cacheSize: opts.cacheSize
+  });
+  const api = express2__default.default.Router();
+  api.use(express2__default.default.json({ limit: "64kb" }));
+  api.use(async (req, res, next) => {
+    try {
+      const viewer = await viewerAdapter.resolveViewer(req);
+      if (!viewer?.tenantId) return res.status(401).json({ error: "unauthenticated" });
+      req.viewer = viewer;
+      next();
+    } catch (e) {
+      next(e);
+    }
+  });
+  const h = (fn) => (req, res, next) => {
+    fn(req, res).then((body) => {
+      if (!res.headersSent) res.json(body);
+    }, next);
+  };
+  api.get("/registry", h(async (req) => ({
+    registry: registryProjection(t),
+    kinds: ["event", "error", "span", "state", "usage"],
+    role: req.viewer.role,
+    scope: req.viewer.tenantId,
+    platform: isPlatformScope(req.viewer.tenantId)
+  })));
+  api.get("/records", h(
+    async (req) => q.records(req.viewer.tenantId, parseRange(req.query), parseFilter(req.query), {
+      limit: req.query.limit ? Number(req.query.limit) : void 0,
+      cursor: typeof req.query.cursor === "string" ? req.query.cursor : void 0
+    })
+  ));
+  api.get("/series", h(
+    async (req) => q.series(req.viewer.tenantId, parseRange(req.query), parseFilter(req.query), {
+      measure: typeof req.query.measure === "string" ? req.query.measure : void 0,
+      interval: req.query.interval || void 0
+    })
+  ));
+  api.get("/distribution", h(
+    async (req) => q.distribution(req.viewer.tenantId, parseRange(req.query), parseFilter(req.query), {
+      measure: typeof req.query.measure === "string" ? req.query.measure : void 0
+    })
+  ));
+  api.get("/rollups", h(async (req) => {
+    if (typeof req.query.as !== "string" || !req.query.as) {
+      throw Object.assign(new Error("rollup family required"), { status: 400 });
+    }
+    const on = req.query.on;
+    if (on !== void 0 && !ROLLUP_ON.includes(on)) {
+      throw Object.assign(new Error(`on must be one of ${ROLLUP_ON.join(", ")}`), { status: 400 });
+    }
+    const sort = req.query.sort;
+    if (sort !== void 0 && !ROLLUP_SORT.includes(sort)) {
+      throw Object.assign(new Error(`sort must be one of ${ROLLUP_SORT.join(", ")}`), { status: 400 });
+    }
+    return q.rollups(req.viewer.tenantId, {
+      as: req.query.as,
+      dims: parseDims(req.query.dims),
+      subjectType: typeof req.query.subjectType === "string" ? req.query.subjectType : void 0,
+      // cohort selection wants firstAt; the default is still bucketAt when
+      // bucketed, lastAt otherwise — see query.ts
+      on,
+      range: req.query.from || req.query.to ? parseRange(req.query) : void 0,
+      sort,
+      limit: req.query.limit ? Number(req.query.limit) : void 0
+    });
+  }));
+  api.get("/trace/:traceId", h(async (req) => q.trace(req.viewer.tenantId, String(req.params.traceId))));
+  api.get("/journey/:ref", h(
+    async (req) => q.journey(req.viewer.tenantId, String(req.params.ref), parseRange(req.query), {
+      limit: req.query.limit ? Number(req.query.limit) : void 0
+    })
+  ));
+  const badRequest = async (run) => {
+    try {
+      return await run();
+    } catch (e) {
+      throw Object.assign(e, { status: e?.status ?? 400 });
+    }
+  };
+  api.get("/funnel", h(async (req) => {
+    const parseStages = (v) => String(v ?? "").split(",").map((s) => s.trim()).filter(Boolean).map((as) => ({ as }));
+    const stages = parseStages(req.query.stages);
+    if (!stages.length) {
+      throw Object.assign(new Error("funnel needs `stages` \u2014 a comma-separated list of rollup families"), { status: 400 });
+    }
+    return badRequest(() => q.funnel(req.viewer.tenantId, {
+      stages,
+      exits: parseStages(req.query.exits),
+      anchor: typeof req.query.anchor === "string" ? req.query.anchor : void 0,
+      // the cohort window is the shell's own range, half-open like everything else
+      cohort: { ...parseRange(req.query), endInclusive: req.query.endInclusive === "true" },
+      subjectType: typeof req.query.subjectType === "string" ? req.query.subjectType : void 0,
+      interval: req.query.interval || void 0,
+      limit: req.query.limit ? Number(req.query.limit) : void 0
+    }));
+  }));
+  api.get("/distinct", h(async (req) => {
+    if (typeof req.query.as !== "string" || !req.query.as) {
+      throw Object.assign(new Error("rollup family required"), { status: 400 });
+    }
+    return badRequest(() => q.distinctCount(req.viewer.tenantId, {
+      as: req.query.as,
+      subjectType: typeof req.query.subjectType === "string" ? req.query.subjectType : void 0,
+      range: parseRange(req.query),
+      interval: req.query.interval || void 0
+    }));
+  }));
+  api.get("/subjects/describe", h(async (req) => {
+    const refs = String(req.query.refs ?? "").split(",").filter(Boolean).slice(0, 100);
+    if (!subjectAdapter) return { refs: {} };
+    return { refs: await subjectAdapter.describe(refs) };
+  }));
+  api.get("/views", h(async (req) => ({
+    views: await resolveViews({
+      ViewModel,
+      registry: t.registry,
+      configured,
+      tenantId: req.viewer.tenantId,
+      viewerRef: req.viewer.viewerRef
+    })
+  })));
+  api.post("/views", h(async (req) => {
+    const { spec, shared = false } = req.body ?? {};
+    if (!spec?.name || !spec?.page || typeof spec.query !== "object") {
+      throw Object.assign(new Error("view spec required"), { status: 400 });
+    }
+    return saveView({
+      ViewModel,
+      tenantId: req.viewer.tenantId,
+      viewerRef: req.viewer.viewerRef,
+      spec,
+      shared: !!shared
+    });
+  }));
+  api.delete("/views/:id", h(async (req, res) => {
+    const doc = await ViewModel.findOne({ _id: req.params.id, tenantId: req.viewer.tenantId }).lean();
+    if (!doc) return { removed: 0 };
+    const mine = doc.ownerRef && doc.ownerRef === req.viewer.viewerRef;
+    if (!mine && req.viewer.role !== "admin") {
+      res.status(403).json({ error: "forbidden" });
+      return void 0;
+    }
+    await ViewModel.deleteOne({ _id: doc._id });
+    return { removed: 1 };
+  }));
+  api.get("/system", h(async (req) => {
+    const quarantine = await t.collections.rejects().find(
+      isPlatformScope(req.viewer.tenantId) ? {} : { "raw.tenantId": req.viewer.tenantId },
+      { sort: { at: -1 }, limit: 50 }
+    ).toArray().catch(() => []);
+    const indexes = await t.models.telemetry.collection.indexes().catch(() => []);
+    const keys = req.viewer.role === "admin" ? await t.models.keys.find({}, { secretHash: 0 }).sort({ createdAt: -1 }).limit(100).lean() : [];
+    return {
+      counters: t.counters,
+      quarantine,
+      indexCount: indexes.length,
+      indexBudget: INDEX_BUDGET,
+      keys,
+      role: req.viewer.role
+    };
+  }));
+  api.post("/system/keys/:id/revoke", h(async (req, res) => {
+    if (req.viewer.role !== "admin") {
+      res.status(403).json({ error: "forbidden" });
+      return void 0;
+    }
+    const r = await t.models.keys.updateOne(
+      { _id: req.params.id, revokedAt: null },
+      { $set: { revokedAt: /* @__PURE__ */ new Date() } }
+    );
+    return { revoked: r.modifiedCount ?? 0 };
+  }));
+  api.use((err, _req, res, _next) => {
+    const status = err?.status ?? 500;
+    if (status >= 500) t.logger.error("[telemetry:dashboard]", err);
+    res.status(status).json({ error: status >= 500 ? "internal_error" : String(err?.message ?? "bad_request") });
+  });
+  const router = express2__default.default.Router();
+  router.use("/api", api);
+  router.use("/_assets", express2__default.default.static(path2__default.default.join(spaDir, "_assets"), {
+    maxAge: "1y",
+    immutable: true,
+    index: false
+  }));
+  const base = `${mountPath.replace(/\/$/, "")}/`;
+  router.get(/.*/, (_req, res) => {
+    let html;
+    try {
+      html = fs__default.default.readFileSync(path2__default.default.join(spaDir, "index.html"), "utf8");
+    } catch {
+      return res.status(503).type("text/plain").send(
+        "telemetry: UI bundle not found. Run `npm run build` in the package, or pass an explicit `spaDir`."
+      );
+    }
+    const config = escapeJson({ apiBase: `${apiBase.replace(/\/$/, "")}/api`, mountPath, title });
+    res.setHeader("Cache-Control", "no-store");
+    res.type("html").send(
+      html.replace(
+        "<!--telemetry-config-->",
+        `<base href="${base}" />
+    <script>window.__TELEMETRY__=${config}</script>`
+      )
+    );
+  });
+  return router;
+}
+
+// src/server/index.ts
+function createTelemetry(config) {
+  const {
+    registry,
+    collection = "telemetry",
+    modelName = "Telemetry",
+    logger = noopLogger
+  } = config;
+  validateRegistry(registry);
+  for (const [name, spec] of Object.entries(registry)) {
+    if (!spec.data) continue;
+    if (Object.prototype.hasOwnProperty.call(spec, "retentionDays")) continue;
+    const days = RETENTION_DAYS[spec.kind];
+    if (days == null) continue;
+    logger.warn(
+      `[telemetry] "${name}" declares \`data\` but inherits retentionDays=${days} from kind=${spec.kind} \u2014 its payloads are stamped to expire in ${days} days, and that cannot be undone after the write. Set an explicit retentionDays (null = immortal) to choose, and to silence this.`
+    );
+  }
+  const conn = config.connection.connection ?? config.connection;
+  const counters = newCounters();
+  const { TelemetryModel, byKind } = buildTelemetryModels({
+    connection: conn,
+    registry,
+    counters,
+    modelName,
+    collection,
+    platforms: config.platforms,
+    bodyMax: config.bodyMax
+  });
+  const RollupModel = buildRollupModel(conn, `${modelName}Rollup`, `${collection}_rollups`);
+  const CheckpointModel = buildCheckpointModel(conn, `${modelName}Checkpoint`, `${collection}_checkpoints`);
+  const KeyModel = buildKeyModel(conn, `${modelName}Key`, `${collection}_keys`);
+  const rejects = () => conn.db.collection(`${collection}_rejects`);
+  const aliases = () => conn.db.collection(`${collection}_aliases`);
+  const views = () => conn.db.collection(`${collection}_views`);
+  const inFlight = /* @__PURE__ */ new Set();
+  const track = (p) => {
+    inFlight.add(p);
+    void p.finally(() => inFlight.delete(p));
+  };
+  const emit = createEmitter({ registry, byKind, RollupModel, rejects, counters, logger, track });
+  const forget = createForget({
+    TelemetryModel,
+    RollupModel,
+    rejects,
+    aliases,
+    views,
+    pepper: () => {
+      const p = config.pepper ?? process.env.TELEMETRY_PEPPER;
+      if (!p) {
+        throw new Error(
+          "telemetry: forget() needs a pepper \u2014 pass `pepper` to createTelemetry() or set TELEMETRY_PEPPER"
+        );
+      }
+      return p;
+    },
+    globalSubjectRefs: () => config.globalSubjectRefs === true
+  });
+  const syncIndexes = createSyncIndexes({
+    registry,
+    TelemetryModel,
+    models: [TelemetryModel, ...Object.values(byKind), RollupModel, CheckpointModel, KeyModel],
+    rejects
+  });
+  return {
+    /** write — the only write */
+    emit,
+    /** erasure: delete sole-party rows, redact shared ones, rekey rollups, drop aliases */
+    forget,
+    /**
+     * Tenant scope is not optional — force every read through here. The five
+     * dashboard query primitives (records/series/distribution/rollups/journey)
+     * build on these in the read layer.
+     *
+     * scoped() does NOT know about PLATFORM_SCOPE, and the omission is
+     * deliberate. This is the host-facing isolation primitive, and its
+     * guarantee is worth more unconditional: whatever string goes in, only rows
+     * carrying that string come out. `scoped('*')` therefore scopes to the
+     * literal '*' — and since '*' is reserved on the write side, it matches
+     * nothing. The cross-tenant escape hatch lives one layer up, in the query
+     * primitives behind viewerAdapter, where an authorization decision has
+     * actually been made about who is asking.
+     */
+    scoped(tenantId) {
+      return {
+        find: (q = {}) => TelemetryModel.find({ ...q, tenantId }),
+        aggregate: (stages) => TelemetryModel.aggregate([{ $match: { tenantId } }, ...stages]),
+        rollups: (q = {}) => RollupModel.find({ ...q, tenantId }),
+        rollupAggregate: (stages) => RollupModel.aggregate([{ $match: { tenantId } }, ...stages])
+      };
+    },
+    /** pull-importer watermark — advisory; downstream writers must be idempotent */
+    checkpoint: createCheckpointFactory(CheckpointModel, logger),
+    /** boot: build declared + registry-driven indexes, await before first write */
+    syncIndexes,
+    /** await in-flight fire-and-forget writes (tests, graceful shutdown) */
+    async flush() {
+      while (inFlight.size) await Promise.allSettled([...inFlight]);
+    },
+    /** drop/default/cap counts — surface on /metrics so drops are never silent */
+    counters,
+    /** the registry, exposed for the router factories — hosts should import their own */
+    registry,
+    logger,
+    /** mint an ingest key; the full key string is returned once, never again */
+    createKey: (input) => createKey(KeyModel, input),
+    /** the models, exposed for hosts and the router factories */
+    models: {
+      telemetry: TelemetryModel,
+      byKind,
+      rollups: RollupModel,
+      checkpoints: CheckpointModel,
+      keys: KeyModel
+    },
+    /** side collections (rejects/aliases live outside mongoose models) */
+    collections: { rejects, aliases }
+  };
+}
+
+exports.BODY_MAX_CHARS = BODY_MAX_CHARS;
+exports.DEFAULT_LIMITS = DEFAULT_LIMITS;
+exports.Env = Env;
+exports.INDEX_BUDGET = INDEX_BUDGET;
+exports.KeyKind = KeyKind;
+exports.LogLevel = LogLevel;
+exports.Origin = Origin;
+exports.PLATFORM_SCOPE = PLATFORM_SCOPE;
+exports.RETENTION_DAYS = RETENTION_DAYS;
+exports.SAMPLE_RATE = SAMPLE_RATE;
+exports.SCHEMA_VERSION = SCHEMA_VERSION;
+exports.TelemetryKind = TelemetryKind;
+exports.TenantMode = TenantMode;
+exports.boundedMeta = boundedMeta;
+exports.createDashboard = createDashboard;
+exports.createIngest = createIngest;
+exports.createKey = createKey;
+exports.createQueries = createQueries;
+exports.createTelemetry = createTelemetry;
+exports.defaultSpaDir = defaultSpaDir;
+exports.defineRegistry = defineRegistry;
+exports.deriveViews = deriveViews;
+exports.findFamily = findFamily;
+exports.hashSecret = hashSecret;
+exports.isPlatformScope = isPlatformScope;
+exports.median = median;
+exports.newId = newId;
+exports.parseKeyString = parseKeyString;
+exports.plain = plain;
+exports.requireMilestoneFamily = requireMilestoneFamily;
+exports.resolveDim = resolveDim;
+exports.summarizeStages = summarizeStages;
+exports.traceKeep = traceKeep;
+exports.truncate = truncate;
+exports.validateRegistry = validateRegistry;
+exports.verifySecret = verifySecret;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map