@lensmcp/core 1.18.4 → 1.18.7

package/index.js

@@ -1,11 +1 @@
-export * from './lib/common.js';
-export * from './lib/ulid.js';
-export * from './lib/event-bus.js';
-export * from './lib/resource-store.js';
-export * from './lib/graph-store.js';
-export * from './lib/fingerprint.js';
-export * from './lib/reducer-registry.js';
-export * from './lib/story.js';
-export * from './lib/patterns.js';
-export * from './lib/thresholds.js';
-export * from './lib/graph-from-events.js';
+"use strict";export*from"./lib/common.js";export*from"./lib/ulid.js";export*from"./lib/event-bus.js";export*from"./lib/resource-store.js";export*from"./lib/graph-store.js";export*from"./lib/fingerprint.js";export*from"./lib/reducer-registry.js";export*from"./lib/story.js";export*from"./lib/patterns.js";export*from"./lib/thresholds.js";export*from"./lib/graph-from-events.js";

package/lib/common.js

@@ -1 +1 @@
-export {};
+"use strict";export{};

package/lib/event-bus.js

@@ -1,65 +1 @@
-/**
- * In-process, single-threaded, bounded event bus. Subscribers are notified
- * synchronously (errors from one handler do not stop others). Backpressure
- * is enforced by a fixed ring buffer of buffered events used only when
- * deferred delivery is configured — by default we deliver immediately.
- *
- * The bus is intentionally tiny. Reducers run on top of it.
- */
-export class EventBus {
-    constructor(opts = {}) {
-        this.subs = new Set();
-        this.dropped = 0;
-        this.capacity = opts.capacity ?? 10_000;
-        this.onDrop = opts.onDrop;
-        this.transform = opts.transform;
-    }
-    publish(event) {
-        if (this.subs.size > this.capacity) {
-            this.dropped++;
-            this.onDrop?.(1);
-            return;
-        }
-        let delivered = event;
-        if (this.transform) {
-            try {
-                delivered = this.transform(event) ?? event;
-            }
-            catch {
-                // A misbehaving transform must never swallow an event: fall back to
-                // the original rather than dropping observability on the floor.
-                delivered = event;
-            }
-        }
-        for (const sub of this.subs) {
-            if (sub.filter && !sub.filter(delivered))
-                continue;
-            try {
-                const ret = sub.handler(delivered);
-                if (ret && typeof ret.then === 'function') {
-                    ret.catch(() => {
-                        /* swallow async handler errors; reducers must not affect bus */
-                    });
-                }
-            }
-            catch {
-                /* swallow sync handler errors */
-            }
-        }
-    }
-    subscribe(handler, filter) {
-        const sub = { handler, filter };
-        this.subs.add(sub);
-        return () => {
-            this.subs.delete(sub);
-        };
-    }
-    /** Number of dropped events since construction. */
-    droppedCount() {
-        return this.dropped;
-    }
-    /** Number of currently registered subscribers. */
-    subscriberCount() {
-        return this.subs.size;
-    }
-}
+"use strict";var o=Object.defineProperty;var n=(e,t)=>o(e,"name",{value:t,configurable:!0});var c=Object.defineProperty,h=n((e,t)=>c(e,"name",{value:t,configurable:!0}),"e");export class EventBus{static{n(this,"EventBus")}static{h(this,"EventBus")}constructor(t={}){this.subs=new Set,this.dropped=0,this.capacity=t.capacity??1e4,this.onDrop=t.onDrop,this.transform=t.transform}publish(t){if(this.subs.size>this.capacity){this.dropped++,this.onDrop?.(1);return}let s=t;if(this.transform)try{s=this.transform(t)??t}catch{s=t}for(const r of this.subs)if(!(r.filter&&!r.filter(s)))try{const i=r.handler(s);i&&typeof i.then=="function"&&i.catch(()=>{})}catch{}}subscribe(t,s){const r={handler:t,filter:s};return this.subs.add(r),()=>{this.subs.delete(r)}}droppedCount(){return this.dropped}subscriberCount(){return this.subs.size}}

package/lib/fingerprint.js

@@ -1,24 +1 @@
-/**
- * Stable, deterministic fingerprints for events. Same root cause →
- * same fingerprint, even if line numbers or stack traces drift between
- * runs. See `02-data-model.md#fingerprinting`.
- *
- * We deliberately do not use a strong hash — fingerprints are routing
- * keys, not security tokens. A lightweight FNV-1a 32-bit hash is enough
- * to dedupe noisy event streams.
- */
-const FNV_OFFSET_BASIS = 0x811c9dc5;
-const FNV_PRIME = 0x01000193;
-function fnv1a32(input) {
-    let h = FNV_OFFSET_BASIS;
-    for (let i = 0; i < input.length; i++) {
-        h ^= input.charCodeAt(i);
-        h = Math.imul(h, FNV_PRIME);
-    }
-    // Force to unsigned 32-bit and emit zero-padded hex.
-    return (h >>> 0).toString(16).padStart(8, '0');
-}
-export function fingerprint(input) {
-    const parts = [input.kind, input.identity, input.file ?? '', input.detail ?? ''];
-    return `${input.kind}:${fnv1a32(parts.join('|'))}`;
-}
+"use strict";var a=Object.defineProperty;var r=(n,e)=>a(n,"name",{value:e,configurable:!0});var f=Object.defineProperty,i=r((n,e)=>f(n,"name",{value:e,configurable:!0}),"e");const l=2166136261,u=16777619;function o(n){let e=2166136261;for(let t=0;t<n.length;t++)e^=n.charCodeAt(t),e=Math.imul(e,16777619);return(e>>>0).toString(16).padStart(8,"0")}r(o,"i"),i(o,"fnv1a32");export function fingerprint(n){const e=[n.kind,n.identity,n.file??"",n.detail??""];return`${n.kind}:${o(e.join("|"))}`}r(fingerprint,"fingerprint"),i(fingerprint,"fingerprint");

package/lib/graph-from-events.js

@@ -1,141 +1 @@
-/**
- * Convert one event into a graph node, or return undefined if the event
- * doesn't promote to a node.
- */
-function eventToNode(event) {
-    const raw = (event.raw ?? null);
-    const kind = raw?.kind;
-    const baseContext = event.context;
-    const common = {
-        id: event.id,
-        parentTraceNodeId: baseContext.causedByNodeId ?? baseContext.originNodeId,
-        lifecycle: 'completed',
-        context: baseContext,
-        startTime: event.timestamp,
-        attributes: { ...(raw ?? {}) },
-    };
-    if (event.source === 'react' && kind === 'render') {
-        const r = raw;
-        return {
-            parentAxis: 'render',
-            node: {
-                ...common,
-                type: 'render',
-                logicalId: r.render?.componentLogicalId,
-                instanceId: r.render?.componentInstanceId,
-                name: `render ${r.render?.componentName ?? '?'}`,
-                durationMs: r.render?.actualDurationMs,
-            },
-        };
-    }
-    if (event.source === 'valtio' && kind === 'state-update') {
-        const r = raw;
-        return {
-            parentAxis: 'state',
-            node: {
-                ...common,
-                type: 'state-update',
-                logicalId: r.update?.storeId,
-                name: `${r.update?.storeId ?? '?'}.${r.update?.path ?? '?'}`,
-            },
-        };
-    }
-    if (event.source === 'nestjs' && kind === 'server-request') {
-        const r = raw;
-        return {
-            parentAxis: 'backend',
-            node: {
-                ...common,
-                type: 'server-request',
-                name: `${r.request?.method ?? '?'} ${r.request?.route ?? '?'}`,
-                durationMs: r.request?.durationMs,
-            },
-        };
-    }
-    if (kind === 'loop') {
-        const r = raw;
-        return {
-            parentAxis: 'performance',
-            node: {
-                ...common,
-                type: 'loop',
-                name: 'loop',
-                durationMs: r.loop?.durationMs,
-            },
-        };
-    }
-    if (event.source === 'client-runtime' && kind === 'user-action') {
-        const r = raw;
-        return {
-            parentAxis: 'caused',
-            node: {
-                ...common,
-                type: 'ui-event',
-                logicalId: r.origin?.nodeId,
-                name: r.origin?.label ?? event.title,
-            },
-        };
-    }
-    return undefined;
-}
-/**
- * Populate `store` from `events`. Edges are created two ways:
- *   1. explicit `causedByNodeId` → an edge on the node's natural axis.
- *   2. same-flow chronological chaining on the 'caused' axis so a flow's
- *      nodes form a walkable spine even when explicit causality is absent.
- */
-export function buildGraphFromEvents(store, events) {
-    const sorted = [...events].sort((a, b) => a.timestamp - b.timestamp);
-    const mapped = [];
-    for (const e of sorted) {
-        const m = eventToNode(e);
-        if (!m)
-            continue;
-        store.addNode(m.node);
-        mapped.push(m);
-    }
-    let edgeCount = 0;
-    const addEdge = (from, to, axis, type) => {
-        const edge = {
-            id: `${axis}:${from}->${to}`,
-            from,
-            to,
-            axis,
-            type,
-            timestamp: store.getNode(to)?.startTime ?? 0,
-        };
-        store.addEdge(edge);
-        edgeCount++;
-    };
-    // Explicit causedBy edges.
-    for (const m of mapped) {
-        const caused = m.node.context.causedByNodeId;
-        if (caused && store.getNode(caused)) {
-            addEdge(caused, m.node.id, m.parentAxis ?? 'caused', 'caused-by');
-        }
-    }
-    // Same-flow chronological spine on the caused axis.
-    const byFlow = new Map();
-    for (const m of mapped) {
-        const flowId = m.node.context.flowId;
-        if (!flowId)
-            continue;
-        let arr = byFlow.get(flowId);
-        if (!arr) {
-            arr = [];
-            byFlow.set(flowId, arr);
-        }
-        arr.push(m);
-    }
-    for (const chain of byFlow.values()) {
-        for (let i = 1; i < chain.length; i++) {
-            const prev = chain[i - 1].node;
-            const cur = chain[i].node;
-            // Skip if an explicit edge already connects them.
-            if (cur.context.causedByNodeId === prev.id)
-                continue;
-            addEdge(prev.id, cur.id, 'caused', 'flow-sequence');
-        }
-    }
-    return { nodeCount: mapped.length, edgeCount };
-}
+"use strict";var g=Object.defineProperty;var u=(t,r)=>g(t,"name",{value:r,configurable:!0});var I=Object.defineProperty,l=u((t,r)=>I(t,"name",{value:r,configurable:!0}),"u");function m(t){const r=t.raw??null,c=r?.kind,s=t.context,a={id:t.id,parentTraceNodeId:s.causedByNodeId??s.originNodeId,lifecycle:"completed",context:s,startTime:t.timestamp,attributes:{...r??{}}};if(t.source==="react"&&c==="render"){const n=r;return{parentAxis:"render",node:{...a,type:"render",logicalId:n.render?.componentLogicalId,instanceId:n.render?.componentInstanceId,name:`render ${n.render?.componentName??"?"}`,durationMs:n.render?.actualDurationMs}}}if(t.source==="valtio"&&c==="state-update"){const n=r;return{parentAxis:"state",node:{...a,type:"state-update",logicalId:n.update?.storeId,name:`${n.update?.storeId??"?"}.${n.update?.path??"?"}`}}}if(t.source==="nestjs"&&c==="server-request"){const n=r;return{parentAxis:"backend",node:{...a,type:"server-request",name:`${n.request?.method??"?"} ${n.request?.route??"?"}`,durationMs:n.request?.durationMs}}}if(c==="loop")return{parentAxis:"performance",node:{...a,type:"loop",name:"loop",durationMs:r.loop?.durationMs}};if(t.source==="client-runtime"&&c==="user-action"){const n=r;return{parentAxis:"caused",node:{...a,type:"ui-event",logicalId:n.origin?.nodeId,name:n.origin?.label??t.title}}}}u(m,"f"),l(m,"eventToNode");export function buildGraphFromEvents(t,r){const c=[...r].sort((o,e)=>o.timestamp-e.timestamp),s=[];for(const o of c){const e=m(o);e&&(t.addNode(e.node),s.push(e))}let a=0;const n=l((o,e,d,i)=>{const f={id:`${d}:${o}->${e}`,from:o,to:e,axis:d,type:i,timestamp:t.getNode(e)?.startTime??0};t.addEdge(f),a++},"addEdge");for(const o of s){const e=o.node.context.causedByNodeId;e&&t.getNode(e)&&n(e,o.node.id,o.parentAxis??"caused","caused-by")}const p=new Map;for(const o of s){const e=o.node.context.flowId;if(!e)continue;let d=p.get(e);d||(d=[],p.set(e,d)),d.push(o)}for(const o of p.values())for(let e=1;e<o.length;e++){const d=o[e-1].node,i=o[e].node;i.context.causedByNodeId!==d.id&&n(d.id,i.id,"caused","flow-sequence")}return{nodeCount:s.length,edgeCount:a}}u(buildGraphFromEvents,"buildGraphFromEvents"),l(buildGraphFromEvents,"buildGraphFromEvents");

package/lib/graph-store.js

@@ -1,171 +1 @@
-const DEFAULT_DEPTH = 4;
-const DEFAULT_MAX_NODES = 1000;
-/**
- * Typed multi-axis trace graph. Hot-tier only (in-memory). Nodes and
- * edges are indexed for cheap per-axis traversal.
- */
-export class GraphStore {
-    constructor() {
-        this.nodes = new Map();
-        this.edges = new Map();
-        // Indices
-        this.byParent = new Map();
-        this.byFlow = new Map();
-        this.byLogical = new Map();
-        this.byInstance = new Map();
-        this.byRequest = new Map();
-        /** axis → { from-nodeId → Set<edgeId> } */
-        this.outByAxis = new Map();
-        /** axis → { to-nodeId → Set<edgeId> } */
-        this.inByAxis = new Map();
-    }
-    addNode(node) {
-        this.nodes.set(node.id, node);
-        if (node.parentTraceNodeId) {
-            this.addToIndex(this.byParent, node.parentTraceNodeId, node.id);
-        }
-        if (node.context.flowId) {
-            this.addToIndex(this.byFlow, node.context.flowId, node.id);
-        }
-        if (node.logicalId) {
-            this.addToIndex(this.byLogical, node.logicalId, node.id);
-        }
-        if (node.instanceId) {
-            this.addToIndex(this.byInstance, node.instanceId, node.id);
-        }
-        if (node.context.requestId) {
-            this.addToIndex(this.byRequest, node.context.requestId, node.id);
-        }
-    }
-    updateNode(id, patch) {
-        const existing = this.nodes.get(id);
-        if (!existing)
-            throw new Error(`Unknown node: ${id}`);
-        const next = { ...existing, ...patch, id: existing.id };
-        this.nodes.set(id, next);
-        return next;
-    }
-    getNode(id) {
-        return this.nodes.get(id);
-    }
-    addEdge(edge) {
-        this.edges.set(edge.id, edge);
-        let outMap = this.outByAxis.get(edge.axis);
-        if (!outMap) {
-            outMap = new Map();
-            this.outByAxis.set(edge.axis, outMap);
-        }
-        this.addToIndex(outMap, edge.from, edge.id);
-        let inMap = this.inByAxis.get(edge.axis);
-        if (!inMap) {
-            inMap = new Map();
-            this.inByAxis.set(edge.axis, inMap);
-        }
-        this.addToIndex(inMap, edge.to, edge.id);
-    }
-    getEdge(id) {
-        return this.edges.get(id);
-    }
-    // ---------- Indexed lookups ----------
-    childrenOf(parentId) {
-        return this.materialiseNodes(this.byParent.get(parentId));
-    }
-    nodesInFlow(flowId) {
-        return this.materialiseNodes(this.byFlow.get(flowId));
-    }
-    nodesByLogical(logicalId) {
-        return this.materialiseNodes(this.byLogical.get(logicalId));
-    }
-    nodesByInstance(instanceId) {
-        return this.materialiseNodes(this.byInstance.get(instanceId));
-    }
-    nodesByRequest(requestId) {
-        return this.materialiseNodes(this.byRequest.get(requestId));
-    }
-    // ---------- Lens traversal ----------
-    traverse(opts) {
-        const start = this.nodes.get(opts.from);
-        if (!start)
-            return { nodes: [], edges: [] };
-        const axes = Array.isArray(opts.lens)
-            ? opts.lens
-            : [opts.lens];
-        const direction = opts.direction ?? 'both';
-        const depth = opts.depth ?? DEFAULT_DEPTH;
-        const maxNodes = opts.maxNodes ?? DEFAULT_MAX_NODES;
-        const visitedNodes = new Set();
-        const visitedEdges = new Set();
-        const queue = [{ id: start.id, d: 0 }];
-        while (queue.length) {
-            if (visitedNodes.size >= maxNodes)
-                break;
-            const { id, d } = queue.shift();
-            if (visitedNodes.has(id))
-                continue;
-            visitedNodes.add(id);
-            if (d >= depth)
-                continue;
-            for (const axis of axes) {
-                if (direction === 'out' || direction === 'both') {
-                    const outMap = this.outByAxis.get(axis);
-                    const edgeIds = outMap?.get(id);
-                    if (edgeIds) {
-                        for (const eid of edgeIds) {
-                            visitedEdges.add(eid);
-                            const edge = this.edges.get(eid);
-                            if (!visitedNodes.has(edge.to)) {
-                                queue.push({ id: edge.to, d: d + 1 });
-                            }
-                        }
-                    }
-                }
-                if (direction === 'in' || direction === 'both') {
-                    const inMap = this.inByAxis.get(axis);
-                    const edgeIds = inMap?.get(id);
-                    if (edgeIds) {
-                        for (const eid of edgeIds) {
-                            visitedEdges.add(eid);
-                            const edge = this.edges.get(eid);
-                            if (!visitedNodes.has(edge.from)) {
-                                queue.push({ id: edge.from, d: d + 1 });
-                            }
-                        }
-                    }
-                }
-            }
-        }
-        return {
-            nodes: this.materialiseNodes(visitedNodes),
-            edges: [...visitedEdges]
-                .map((eid) => this.edges.get(eid))
-                .filter((e) => Boolean(e)),
-        };
-    }
-    // ---------- Stats ----------
-    nodeCount() {
-        return this.nodes.size;
-    }
-    edgeCount() {
-        return this.edges.size;
-    }
-    // ---------- internals ----------
-    addToIndex(index, key, value) {
-        let set = index.get(key);
-        if (!set) {
-            set = new Set();
-            index.set(key, set);
-        }
-        set.add(value);
-    }
-    materialiseNodes(ids) {
-        if (!ids)
-            return [];
-        const out = [];
-        for (const id of ids) {
-            const n = this.nodes.get(id);
-            if (n)
-                out.push(n);
-        }
-        return out;
-    }
-}
+"use strict";var w=Object.defineProperty;var l=(h,e)=>w(h,"name",{value:e,configurable:!0});var p=Object.defineProperty,I=l((h,e)=>p(h,"name",{value:e,configurable:!0}),"l");const m=4,N=1e3;export class GraphStore{static{l(this,"GraphStore")}static{I(this,"GraphStore")}constructor(){this.nodes=new Map,this.edges=new Map,this.byParent=new Map,this.byFlow=new Map,this.byLogical=new Map,this.byInstance=new Map,this.byRequest=new Map,this.outByAxis=new Map,this.inByAxis=new Map}addNode(e){this.nodes.set(e.id,e),e.parentTraceNodeId&&this.addToIndex(this.byParent,e.parentTraceNodeId,e.id),e.context.flowId&&this.addToIndex(this.byFlow,e.context.flowId,e.id),e.logicalId&&this.addToIndex(this.byLogical,e.logicalId,e.id),e.instanceId&&this.addToIndex(this.byInstance,e.instanceId,e.id),e.context.requestId&&this.addToIndex(this.byRequest,e.context.requestId,e.id)}updateNode(e,s){const i=this.nodes.get(e);if(!i)throw new Error(`Unknown node: ${e}`);const t={...i,...s,id:i.id};return this.nodes.set(e,t),t}getNode(e){return this.nodes.get(e)}addEdge(e){this.edges.set(e.id,e);let s=this.outByAxis.get(e.axis);s||(s=new Map,this.outByAxis.set(e.axis,s)),this.addToIndex(s,e.from,e.id);let i=this.inByAxis.get(e.axis);i||(i=new Map,this.inByAxis.set(e.axis,i)),this.addToIndex(i,e.to,e.id)}getEdge(e){return this.edges.get(e)}childrenOf(e){return this.materialiseNodes(this.byParent.get(e))}nodesInFlow(e){return this.materialiseNodes(this.byFlow.get(e))}nodesByLogical(e){return this.materialiseNodes(this.byLogical.get(e))}nodesByInstance(e){return this.materialiseNodes(this.byInstance.get(e))}nodesByRequest(e){return this.materialiseNodes(this.byRequest.get(e))}traverse(e){const s=this.nodes.get(e.from);if(!s)return{nodes:[],edges:[]};const i=Array.isArray(e.lens)?e.lens:[e.lens],t=e.direction??"both",f=e.depth??4,x=e.maxNodes??1e3,n=new Set,g=new Set,c=[{id:s.id,d:0}];for(;c.length&&!(n.size>=x);){const{id:d,d:u}=c.shift();if(!n.has(d)&&(n.add(d),!(u>=f)))for(const y of i){if(t==="out"||t==="both"){const o=this.outByAxis.get(y)?.get(d);if(o)for(const a of o){g.add(a);const r=this.edges.get(a);n.has(r.to)||c.push({id:r.to,d:u+1})}}if(t==="in"||t==="both"){const o=this.inByAxis.get(y)?.get(d);if(o)for(const a of o){g.add(a);const r=this.edges.get(a);n.has(r.from)||c.push({id:r.from,d:u+1})}}}}return{nodes:this.materialiseNodes(n),edges:[...g].map(d=>this.edges.get(d)).filter(d=>!!d)}}nodeCount(){return this.nodes.size}edgeCount(){return this.edges.size}addToIndex(e,s,i){let t=e.get(s);t||(t=new Set,e.set(s,t)),t.add(i)}materialiseNodes(e){if(!e)return[];const s=[];for(const i of e){const t=this.nodes.get(i);t&&s.push(t)}return s}}

package/lib/patterns.js

@@ -1,163 +1 @@
-/**
- * Flag `loop` events whose `dbCallsInsideLoop` exceeds the threshold.
- * Events are expected to carry `raw.kind === 'loop'` with a `loop`
- * attribute matching `LoopAttrs`.
- */
-export function detectDbInLoop(events, options = {}) {
-    const threshold = options.threshold ?? 5;
-    const out = [];
-    for (const e of events) {
-        const raw = (e.raw ?? null);
-        if (raw?.kind !== 'loop' || !raw.loop)
-            continue;
-        const dbCalls = raw.loop.dbCallsInsideLoop ?? 0;
-        if (dbCalls > threshold) {
-            out.push({
-                kind: 'db-in-loop',
-                severity: 'warning',
-                title: `${dbCalls} DB calls inside a loop (${raw.loop.iterations ?? '?'} iterations)`,
-                evidence: [e.id],
-                details: {
-                    dbCallsInsideLoop: dbCalls,
-                    iterations: raw.loop.iterations,
-                    durationMs: raw.loop.durationMs,
-                    threshold,
-                },
-                detectedAt: e.timestamp,
-            });
-        }
-    }
-    return out;
-}
-/**
- * Flag repeated identical DB query signatures. Events are expected to
- * carry `raw.kind === 'db-query'` with `raw.query.signature`.
- */
-export function detectNPlusOne(events, options = {}) {
-    const threshold = options.threshold ?? 3;
-    const groups = new Map();
-    for (const e of events) {
-        const raw = (e.raw ?? null);
-        if (raw?.kind !== 'db-query' || !raw.query?.signature)
-            continue;
-        const sig = raw.query.signature;
-        let arr = groups.get(sig);
-        if (!arr) {
-            arr = [];
-            groups.set(sig, arr);
-        }
-        arr.push(e);
-    }
-    const out = [];
-    for (const [signature, group] of groups) {
-        if (group.length >= threshold) {
-            out.push({
-                kind: 'n+1-query',
-                severity: 'warning',
-                title: `Query repeated ${group.length}× — likely N+1`,
-                evidence: group.map((e) => e.id),
-                details: { signature, count: group.length, threshold },
-                detectedAt: group[group.length - 1].timestamp,
-            });
-        }
-    }
-    return out;
-}
-/**
- * Flag a component instance that rendered more than `threshold` times
- * inside any `windowMs` window. Events are `source:'react'`,
- * `raw.kind === 'render'`, `raw.render.componentInstanceId`.
- */
-export function detectRenderStorm(events, options = {}) {
-    const threshold = options.threshold ?? 5;
-    const windowMs = options.windowMs ?? 250;
-    const byInstance = new Map();
-    for (const e of events) {
-        if (e.source !== 'react')
-            continue;
-        const raw = (e.raw ?? null);
-        if (raw?.kind !== 'render' || !raw.render?.componentInstanceId)
-            continue;
-        const id = raw.render.componentInstanceId;
-        let arr = byInstance.get(id);
-        if (!arr) {
-            arr = [];
-            byInstance.set(id, arr);
-        }
-        arr.push(e);
-    }
-    const out = [];
-    for (const [instanceId, group] of byInstance) {
-        group.sort((a, b) => a.timestamp - b.timestamp);
-        // Sliding window: find the densest run.
-        let start = 0;
-        for (let end = 0; end < group.length; end++) {
-            while (group[end].timestamp - group[start].timestamp > windowMs) {
-                start++;
-            }
-            const count = end - start + 1;
-            if (count > threshold) {
-                const window = group.slice(start, end + 1);
-                const name = window[0].raw.render
-                    ?.componentName ?? instanceId;
-                out.push({
-                    kind: 'render-storm',
-                    severity: 'warning',
-                    title: `${name} rendered ${count}× in ${windowMs}ms`,
-                    evidence: window.map((e) => e.id),
-                    details: {
-                        componentInstanceId: instanceId,
-                        count,
-                        windowMs,
-                        threshold,
-                    },
-                    detectedAt: window[window.length - 1].timestamp,
-                });
-                break; // one match per instance is enough
-            }
-        }
-    }
-    return out;
-}
-/**
- * Find the single slowest cumulative chain on the caused/async axis,
- * given a precomputed adjacency (nodeId → outgoing nodeIds) and a
- * per-node duration map. Pure + bounded (visits each node once via
- * memoised DFS).
- */
-export function findSlowPath(roots, adjacency, durationOf) {
-    const memo = new Map();
-    const inProgress = new Set();
-    function best(nodeId) {
-        const cached = memo.get(nodeId);
-        if (cached)
-            return cached;
-        if (inProgress.has(nodeId)) {
-            // cycle guard
-            return { path: [nodeId], totalDurationMs: durationOf(nodeId) };
-        }
-        inProgress.add(nodeId);
-        const selfMs = durationOf(nodeId);
-        const children = adjacency.get(nodeId) ?? [];
-        let bestChild;
-        for (const child of children) {
-            const r = best(child);
-            if (!bestChild || r.totalDurationMs > bestChild.totalDurationMs) {
-                bestChild = r;
-            }
-        }
-        inProgress.delete(nodeId);
-        const result = bestChild
-            ? { path: [nodeId, ...bestChild.path], totalDurationMs: selfMs + bestChild.totalDurationMs }
-            : { path: [nodeId], totalDurationMs: selfMs };
-        memo.set(nodeId, result);
-        return result;
-    }
-    let overall = { path: [], totalDurationMs: 0 };
-    for (const root of roots) {
-        const r = best(root);
-        if (r.totalDurationMs > overall.totalDurationMs)
-            overall = r;
-    }
-    return overall;
-}
+"use strict";var g=Object.defineProperty;var p=(c,a)=>g(c,"name",{value:a,configurable:!0});var M=Object.defineProperty,f=p((c,a)=>M(c,"name",{value:a,configurable:!0}),"p");export function detectDbInLoop(c,a={}){const d=a.threshold??5,i=[];for(const s of c){const n=s.raw??null;if(n?.kind!=="loop"||!n.loop)continue;const e=n.loop.dbCallsInsideLoop??0;e>d&&i.push({kind:"db-in-loop",severity:"warning",title:`${e} DB calls inside a loop (${n.loop.iterations??"?"} iterations)`,evidence:[s.id],details:{dbCallsInsideLoop:e,iterations:n.loop.iterations,durationMs:n.loop.durationMs,threshold:d},detectedAt:s.timestamp})}return i}p(detectDbInLoop,"detectDbInLoop"),f(detectDbInLoop,"detectDbInLoop");export function detectNPlusOne(c,a={}){const d=a.threshold??3,i=new Map;for(const n of c){const e=n.raw??null;if(e?.kind!=="db-query"||!e.query?.signature)continue;const t=e.query.signature;let o=i.get(t);o||(o=[],i.set(t,o)),o.push(n)}const s=[];for(const[n,e]of i)e.length>=d&&s.push({kind:"n+1-query",severity:"warning",title:`Query repeated ${e.length}\xD7 \u2014 likely N+1`,evidence:e.map(t=>t.id),details:{signature:n,count:e.length,threshold:d},detectedAt:e[e.length-1].timestamp});return s}p(detectNPlusOne,"detectNPlusOne"),f(detectNPlusOne,"detectNPlusOne");export function detectRenderStorm(c,a={}){const d=a.threshold??5,i=a.windowMs??250,s=new Map;for(const e of c){if(e.source!=="react")continue;const t=e.raw??null;if(t?.kind!=="render"||!t.render?.componentInstanceId)continue;const o=t.render.componentInstanceId;let r=s.get(o);r||(r=[],s.set(o,r)),r.push(e)}const n=[];for(const[e,t]of s){t.sort((r,u)=>r.timestamp-u.timestamp);let o=0;for(let r=0;r<t.length;r++){for(;t[r].timestamp-t[o].timestamp>i;)o++;const u=r-o+1;if(u>d){const l=t.slice(o,r+1),h=l[0].raw.render?.componentName??e;n.push({kind:"render-storm",severity:"warning",title:`${h} rendered ${u}\xD7 in ${i}ms`,evidence:l.map(m=>m.id),details:{componentInstanceId:e,count:u,windowMs:i,threshold:d},detectedAt:l[l.length-1].timestamp});break}}}return n}p(detectRenderStorm,"detectRenderStorm"),f(detectRenderStorm,"detectRenderStorm");export function findSlowPath(c,a,d){const i=new Map,s=new Set;function n(t){const o=i.get(t);if(o)return o;if(s.has(t))return{path:[t],totalDurationMs:d(t)};s.add(t);const r=d(t),u=a.get(t)??[];let l;for(const m of u){const w=n(m);(!l||w.totalDurationMs>l.totalDurationMs)&&(l=w)}s.delete(t);const h=l?{path:[t,...l.path],totalDurationMs:r+l.totalDurationMs}:{path:[t],totalDurationMs:r};return i.set(t,h),h}p(n,"o"),f(n,"best");let e={path:[],totalDurationMs:0};for(const t of c){const o=n(t);o.totalDurationMs>e.totalDurationMs&&(e=o)}return e}p(findSlowPath,"findSlowPath"),f(findSlowPath,"findSlowPath");

package/lib/redact.d.ts

@@ -0,0 +1,127 @@
+/**
+ * Redaction + bounding for anything LensMCP writes to the event bus.
+ *
+ * ── Why this exists ─────────────────────────────────────────────────────────
+ * Until the browser taps were enriched they recorded almost nothing about an
+ * error, so there was nothing to leak. Enriching them (message, stack,
+ * method/URL/status) changed that: a request URL routinely carries a
+ * credential in its query string (`?access_token=…`, `?code=` on an OAuth
+ * callback, `?key=` on a Google API), and an error message can quote a JWT or
+ * an `Authorization` header. Those values then land in `runtime://browser/*`,
+ * which an agent reads and may quote into a transcript.
+ *
+ * ── Why it lives in `core` and not in the bridge ────────────────────────────
+ * It shipped inside `@lensmcp/bridge`, applied in `envelopeToEvent` — the ONE
+ * function every BROWSER envelope crosses. That covered the browser and only
+ * the browser. The GATEWAY publishes its own events straight onto the same bus
+ * without ever crossing that function, so it stayed unredacted — and the
+ * gateway sees every request from every app in the workspace, which makes it
+ * the higher-volume path by a wide margin. Observed on a real machine
+ * (foodguard, 1.18.4): a single request wrote
+ * `?access_token=sk_live_…` verbatim into `title`, `raw.url` AND
+ * `raw.steps[].url` of `.lensmcp/events.jsonl`.
+ *
+ * So the module moved DOWN to `layer:core`, where both the browser bridge
+ * (`layer:host`) and the cluster gateway (`layer:install`) can reach it. There
+ * is exactly one implementation; a second one would diverge and one of the two
+ * would be the one that misses. `@lensmcp/bridge` re-exports every symbol, so
+ * its public API is unchanged.
+ *
+ * It is imported through the dependency-free `@lensmcp/core/redact` subpath
+ * rather than the package root, so the prod gateway pulls in this one file and
+ * not the whole core graph (event bus, graph store, zod).
+ *
+ * `nx.json` has carried a `redaction: { headers, paths }` block since the init
+ * generator was written, with no reader anywhere in the repo. This is the
+ * first code to honour that intent; the lists below are a superset of it.
+ *
+ * ── Deliberately NOT done here ──────────────────────────────────────────────
+ * • Request/response HEADERS are never captured in the first place (the
+ *   browser taps read none, and the gateway trace records none), which is the
+ *   strongest possible defence — nothing to redact. Keep it that way; do not
+ *   add header capture without extending this module.
+ * • Request/response BODIES are likewise never captured.
+ */
+/** Replacement for a redacted value. Short, obvious, greppable. */
+export declare const REDACTED = "REDACTED";
+/**
+ * Bounds. `raw` is structurally clamped to 32KiB by the bus transform
+ * (`createEventClamp`, wired in `@lensmcp/session`), but `title`/`message` are
+ * NOT — they are plain strings on `BaseEvent` and reach every reader
+ * unclamped. A stack from a deep React tree is routinely tens of KB, so these
+ * are the bounds that actually keep an event small.
+ */
+export declare const MAX_TITLE_CHARS = 300;
+export declare const MAX_MESSAGE_CHARS = 4096;
+export declare const MAX_URL_CHARS = 1024;
+/** Is this query-parameter name carrying a credential? */
+export declare function isSecretParam(name: string): boolean;
+/**
+ * Strip credentials from a URL — userinfo, then any query OR fragment
+ * parameter whose NAME looks like a credential — preserving every other byte
+ * and applying no length bound.
+ *
+ * Split out of {@link redactUrl} because the same pass has to run over strings
+ * that are not *only* a URL: a gateway event's title is
+ * `gateway GET host/path?a=1&token=… → 401 (3ms)`, and bounding that at
+ * `MAX_URL_CHARS` would be the wrong limit. `PARAM_RE` is not anchored, so it
+ * finds the pairs wherever they sit in the surrounding prose, and
+ * {@link isSecretParam} keeps `?limit=1` and `→ 401 (3ms)` untouched.
+ *
+ * Implemented as a regex rewrite rather than `new URL(...)` on purpose:
+ * `URL` re-encodes as it round-trips (`+` vs `%20`, dropped default ports,
+ * sorted-looking output), which would mean the URL an agent reads is not the
+ * URL the app requested. It also throws on relative inputs, which is most of
+ * what a SPA fetches. This keeps the string byte-identical apart from the
+ * redacted values, and never throws.
+ *
+ * The fragment matters — an OAuth implicit-flow callback puts the access token
+ * there (`#access_token=…`).
+ */
+export declare function redactUrlParams(value: string): string;
+/** {@link redactUrlParams}, bounded — the standard treatment for a captured URL. */
+export declare function redactUrl(url: string): string;
+/**
+ * Scrub credentials out of free text (an event title, an error message, a
+ * stack, a console line). Cheap, linear, and tuned for precision over recall —
+ * a false positive destroys the diagnostic value this whole change is adding.
+ *
+ * Runs {@link redactUrlParams} FIRST, so a URL embedded in prose is cleaned
+ * wherever it appears. The bridge originally left free text alone on the
+ * grounds that "widening that means running the URL redactor over every
+ * message, which is a cost/false-positive trade not worth making blind" — the
+ * gateway leak above made it no longer blind. A gateway event's title IS a URL
+ * in prose, and it was the field that leaked. The trade is cheap on both
+ * counts: one extra linear pass, and the false-positive surface is
+ * {@link isSecretParam}, the exact predicate {@link redactUrl} already trusts
+ * (`?author=`/`?keywords=` survive, and a string with no `?name=value` pair
+ * comes back byte-identical).
+ */
+export declare function redactText(text: string): string;
+/**
+ * Bound a string, marking what was removed. Marker text matches
+ * `@lensmcp/storage`'s `clampEventRaw` so the two truncations read the same in
+ * a transcript.
+ */
+export declare function clip(value: string, max: number): string;
+/** Redact then bound — the standard treatment for any captured free text. */
+export declare function safeText(value: string | undefined, max?: number): string | undefined;
+/** Redact then bound — the standard treatment for a captured title. */
+export declare function safeTitle(value: string): string;
+/**
+ * Scrub credentials out of every string leaf of an arbitrary value.
+ *
+ * Needed for `console` arguments, which are the one captured payload that is
+ * genuinely unstructured — `console.log('auth', { token })` is ordinary
+ * debugging code, and the whole point of that change is that those payloads
+ * now reach a transcript. It is also what covers a structured `raw`: the
+ * gateway's request event carries the URL at `raw.url` AND again at
+ * `raw.steps[].url`, and walking every string leaf catches BOTH plus whatever
+ * URL-bearing field a future event type adds — which naming the fields
+ * one-by-one would not. Bounded on depth and array length so a pathological
+ * object cannot make redaction the slow part of a page's logging.
+ *
+ * Values are returned by reference when nothing changed, so the common case
+ * (no credential anywhere) allocates nothing.
+ */
+export declare function redactDeep(value: unknown, depth?: number): unknown;

package/lib/redact.js

@@ -0,0 +1 @@
+"use strict";var f=Object.defineProperty;var o=(e,r)=>f(e,"name",{value:r,configurable:!0});var l=Object.defineProperty,a=o((e,r)=>l(e,"name",{value:r,configurable:!0}),"o");export const REDACTED="REDACTED",MAX_TITLE_CHARS=300,MAX_MESSAGE_CHARS=4096,MAX_URL_CHARS=1024;const d=["token","secret","password","passwd","apikey","credential","assertion","signature"],x=new Set(["key","auth","authorization","jwt","code","sig","pwd","pass","session","sid","bearer","otp","cookie","set-cookie"]);export function isSecretParam(e){const r=e.toLowerCase();if(d.some(t=>r.includes(t)))return!0;for(const t of r.split(/[-_.]+/))if(t&&x.has(t))return!0;return!1}o(isSecretParam,"isSecretParam"),a(isSecretParam,"isSecretParam");const A=/^([a-z][a-z0-9+.-]*:\/\/)[^/?#@\s]*@/i,$=/([?&#])([^=&#\s]+)=([^&#\s]*)/g;export function redactUrlParams(e){return e&&e.replace(A,`$1${REDACTED}@`).replace($,(r,t,s)=>isSecretParam(s)?`${t}${s}=${REDACTED}`:r)}o(redactUrlParams,"redactUrlParams"),a(redactUrlParams,"redactUrlParams");export function redactUrl(e){return e&&clip(redactUrlParams(e),1024)}o(redactUrl,"redactUrl"),a(redactUrl,"redactUrl");const _=/\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{4,}\.[A-Za-z0-9_-]*/g,b=/\b(bearer|basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi,y=/\b(authorization|x-api-key|api-key|cookie|set-cookie|proxy-authorization)\b(\s*[:=]\s*)(["']?)([^\s"',;]{4,})\3/gi;export function redactText(e){return redactUrlParams(e).replace(y,(r,t,s,n)=>`${t}${s}${n}${REDACTED}${n}`).replace(_,REDACTED).replace(b,(r,t)=>`${t} ${REDACTED}`)}o(redactText,"redactText"),a(redactText,"redactText");export function clip(e,r){return e.length<=r?e:`${e.slice(0,r)}\u2026[lensmcp truncated: ${e.length-r} more chars]`}o(clip,"clip"),a(clip,"clip");export function safeText(e,r=4096){if(e!==void 0)return clip(redactText(e),r)}o(safeText,"safeText"),a(safeText,"safeText");export function safeTitle(e){return clip(redactText(e),300)}o(safeTitle,"safeTitle"),a(safeTitle,"safeTitle");const T=6,g=64;export function redactDeep(e,r=0){if(typeof e=="string")return redactText(e);if(e===null||typeof e!="object"||r>=T)return e;if(Array.isArray(e)){let n=!1;const i=e.map((c,p)=>{if(p>=g)return c;const u=redactDeep(c,r+1);return u!==c&&(n=!0),u});return n?i:e}let t=!1;const s={};for(const[n,i]of Object.entries(e)){const c=isSecretParam(n)&&i!==void 0&&i!==null?REDACTED:redactDeep(i,r+1);c!==i&&(t=!0),s[n]=c}return t?s:e}o(redactDeep,"redactDeep"),a(redactDeep,"redactDeep");

package/lib/reducer-registry.js

@@ -1,28 +1 @@
-export class ReducerRegistry {
-    constructor() {
-        this.reducers = [];
-    }
-    register(name, reducer) {
-        if (this.reducers.some((r) => r.name === name)) {
-            throw new Error(`Reducer already registered: ${name}`);
-        }
-        this.reducers.push({ name, reducer });
-    }
-    list() {
-        return this.reducers;
-    }
-    /** Run every registered reducer against one event. */
-    async dispatch(event) {
-        for (const { reducer } of this.reducers) {
-            try {
-                const r = reducer(event);
-                if (r && typeof r.then === 'function') {
-                    await r;
-                }
-            }
-            catch {
-                /* swallow reducer errors */
-            }
-        }
-    }
-}
+"use strict";var i=Object.defineProperty;var c=(t,e)=>i(t,"name",{value:e,configurable:!0});var u=Object.defineProperty,a=c((t,e)=>u(t,"name",{value:e,configurable:!0}),"c");export class ReducerRegistry{static{c(this,"ReducerRegistry")}static{a(this,"ReducerRegistry")}constructor(){this.reducers=[]}register(e,s){if(this.reducers.some(r=>r.name===e))throw new Error(`Reducer already registered: ${e}`);this.reducers.push({name:e,reducer:s})}list(){return this.reducers}async dispatch(e){for(const{reducer:s}of this.reducers)try{const r=s(e);r&&typeof r.then=="function"&&await r}catch{}}}

package/lib/resource-store.js

@@ -1,71 +1 @@
-/**
- * The resource store. URIs are registered once; reading is cheap; the
- * `markDirty` call bumps the revision counter and notifies subscribers
- * only when the produced JSON actually changes (diff-aware).
- */
-export class ResourceStore {
-    constructor() {
-        this.entries = new Map();
-        this.subs = new Map();
-    }
-    register(uri, produce) {
-        if (this.entries.has(uri)) {
-            throw new Error(`Resource already registered: ${uri}`);
-        }
-        this.entries.set(uri, { uri, produce, revision: 0 });
-        return () => {
-            this.entries.delete(uri);
-            this.subs.delete(uri);
-        };
-    }
-    async read(uri) {
-        const entry = this.entries.get(uri);
-        if (!entry)
-            throw new Error(`Unknown resource: ${uri}`);
-        return entry.produce();
-    }
-    list() {
-        return [...this.entries.keys()];
-    }
-    /**
-     * Recompute the JSON, bump the revision counter if it differs, and
-     * notify subscribers. No-op if the URI is unknown or the JSON didn't
-     * change.
-     */
-    async markDirty(uri) {
-        const entry = this.entries.get(uri);
-        if (!entry)
-            return;
-        const next = await entry.produce();
-        const serialised = JSON.stringify(next);
-        if (serialised === entry.lastJson)
-            return;
-        entry.lastJson = serialised;
-        entry.revision += 1;
-        const handlers = this.subs.get(uri);
-        if (handlers) {
-            for (const h of handlers) {
-                try {
-                    h(uri, entry.revision);
-                }
-                catch {
-                    /* swallow handler errors */
-                }
-            }
-        }
-    }
-    revision(uri) {
-        return this.entries.get(uri)?.revision;
-    }
-    subscribe(uri, handler) {
-        let set = this.subs.get(uri);
-        if (!set) {
-            set = new Set();
-            this.subs.set(uri, set);
-        }
-        set.add(handler);
-        return () => {
-            set?.delete(handler);
-        };
-    }
-}
+"use strict";var u=Object.defineProperty;var i=(r,e)=>u(r,"name",{value:e,configurable:!0});var a=Object.defineProperty,h=i((r,e)=>a(r,"name",{value:e,configurable:!0}),"o");export class ResourceStore{static{i(this,"ResourceStore")}static{h(this,"ResourceStore")}constructor(){this.entries=new Map,this.subs=new Map}register(e,t){if(this.entries.has(e))throw new Error(`Resource already registered: ${e}`);return this.entries.set(e,{uri:e,produce:t,revision:0}),()=>{this.entries.delete(e),this.subs.delete(e)}}async read(e){const t=this.entries.get(e);if(!t)throw new Error(`Unknown resource: ${e}`);return t.produce()}list(){return[...this.entries.keys()]}async markDirty(e){const t=this.entries.get(e);if(!t)return;const s=await t.produce(),n=JSON.stringify(s);if(n===t.lastJson)return;t.lastJson=n,t.revision+=1;const o=this.subs.get(e);if(o)for(const c of o)try{c(e,t.revision)}catch{}}revision(e){return this.entries.get(e)?.revision}subscribe(e,t){let s=this.subs.get(e);return s||(s=new Set,this.subs.set(e,s)),s.add(t),()=>{s?.delete(t)}}}

package/lib/story.js

@@ -1,199 +1 @@
-/** Group events by `context.flowId`. Events without a flowId are dropped. */
-export function groupByFlow(events) {
-    const out = new Map();
-    for (const e of events) {
-        const flowId = e.context.flowId;
-        if (!flowId)
-            continue;
-        let arr = out.get(flowId);
-        if (!arr) {
-            arr = [];
-            out.set(flowId, arr);
-        }
-        arr.push(e);
-    }
-    return out;
-}
-/**
- * Compile a single flow's events into a `FlowStory`. The caller can
- * either pre-filter events (preferred) or pass everything and supply
- * `options.flowId`.
- */
-export function compileStory(events, options = {}) {
-    let pool;
-    let flowId;
-    if (options.flowId) {
-        flowId = options.flowId;
-        pool = events.filter((e) => e.context.flowId === flowId);
-    }
-    else {
-        const first = events.find((e) => e.context.flowId);
-        if (!first)
-            return undefined;
-        flowId = first.context.flowId;
-        pool = events.filter((e) => e.context.flowId === flowId);
-    }
-    if (pool.length === 0)
-        return undefined;
-    pool.sort((a, b) => a.timestamp - b.timestamp);
-    // Bound the compiled narrative: a story is a READABLE mechanism trace, and stories are pinned
-    // (50 of them) in a long-lived registry — an unbounded flow (event flood, long-lived flowId)
-    // must not compile into hundreds of thousands of phases each holding refs into event.raw.
-    // Keep the origin plus the most RECENT window (the resolution is what the reader needs).
-    const MAX_STORY_EVENTS = 1000;
-    if (pool.length > MAX_STORY_EVENTS) {
-        pool = [pool[0], ...pool.slice(pool.length - (MAX_STORY_EVENTS - 1))];
-    }
-    const origin = pool[0];
-    const phases = [];
-    let finalRender;
-    let finalVisualFrame;
-    for (const event of pool) {
-        const phase = classifyEvent(event);
-        if (!phase)
-            continue;
-        phases.push(phase);
-        if (phase.kind === 'render' || phase.kind === 'final-render') {
-            const raw = event.raw;
-            if (raw?.render) {
-                finalRender = {
-                    id: raw.render.id,
-                    page: raw.render.page,
-                    route: raw.render.route,
-                    componentName: raw.render.componentName,
-                };
-            }
-        }
-        else if (event.source === 'visual' && phase.kind === 'visual-violation') {
-            const raw = event.raw;
-            if (raw?.frame)
-                finalVisualFrame = raw.frame.id;
-        }
-    }
-    // Promote the final `render` phase (if any) to `final-render`.
-    for (let i = phases.length - 1; i >= 0; i--) {
-        if (phases[i].kind === 'render') {
-            phases[i] = { ...phases[i], kind: 'final-render' };
-            break;
-        }
-    }
-    const startedAt = pool[0].timestamp;
-    const endedAt = pool[pool.length - 1].timestamp;
-    return {
-        flowId,
-        origin: {
-            type: origin.context.originType,
-            nodeId: origin.context.originNodeId,
-            at: origin.timestamp,
-        },
-        phases,
-        finalState: finalRender
-            ? {
-                page: finalRender.page,
-                route: finalRender.route,
-                componentName: finalRender.componentName,
-                renderId: finalRender.id,
-                visualFrameId: finalVisualFrame,
-            }
-            : undefined,
-        startedAt,
-        endedAt,
-        eventCount: pool.length,
-    };
-}
-/**
- * Classify a single event into a story phase. Returns undefined for
- * events that don't carry phase semantics (we still keep them under
- * `flow://flow/{flowId}.events` but don't surface them in the story).
- */
-function classifyEvent(event) {
-    const raw = (event.raw ?? null);
-    const kind = raw?.kind;
-    // Flow origin events (synthetic user-action emitter)
-    if (kind === 'flow-origin' || (event.source === 'client-runtime' && kind === 'user-action')) {
-        const r = event.raw;
-        return {
-            kind: 'user-action',
-            at: event.timestamp,
-            label: r?.origin?.label ?? event.title,
-            eventIds: [event.id],
-        };
-    }
-    // React renders
-    if (event.source === 'react' && kind === 'render') {
-        const r = event.raw;
-        return {
-            kind: 'render',
-            at: event.timestamp,
-            label: `render ${r?.render?.componentName ?? '?'}`,
-            eventIds: [event.id],
-            details: r?.render
-                ? { componentName: r.render.componentName, durationMs: r.render.actualDurationMs }
-                : undefined,
-        };
-    }
-    // Slot transitions (loading / idle UI)
-    if (event.source === 'react' && kind === 'slot-content-changed') {
-        const r = event.raw;
-        const to = r?.slot?.toComponent ?? '?';
-        const isLoading = /spinner|loader|loading/i.test(to);
-        return {
-            kind: isLoading ? 'loading-ui' : 'idle-ui',
-            at: event.timestamp,
-            label: `slot ${r?.slot?.slotLogicalId ?? ''} → ${to}`,
-            eventIds: [event.id],
-        };
-    }
-    // Route transitions (client-runtime emits)
-    if (event.source === 'client-runtime' && kind === 'route') {
-        const r = event.raw;
-        return {
-            kind: 'route-transition',
-            at: event.timestamp,
-            label: `route ${r?.from ?? ''} → ${r?.url ?? ''}`,
-            eventIds: [event.id],
-        };
-    }
-    // Valtio state-update
-    if (event.source === 'valtio' && kind === 'state-update') {
-        const r = event.raw;
-        return {
-            kind: 'state-update',
-            at: event.timestamp,
-            label: `${r?.update?.storeId ?? '?'}.${r?.update?.path ?? '?'}`,
-            eventIds: [event.id],
-            details: r?.update,
-        };
-    }
-    // Backend (NestJS) server-request
-    if (event.source === 'nestjs' && kind === 'server-request') {
-        const r = event.raw;
-        return {
-            kind: 'backend-request',
-            at: event.timestamp,
-            label: `${r?.request?.method ?? '?'} ${r?.request?.route ?? '?'} → ${r?.request?.status ?? '?'}`,
-            eventIds: [event.id],
-            details: r?.request,
-        };
-    }
-    // Chrome fetch (browser side) — synthesised by client-runtime.
-    if (event.source === 'chrome' && event.category === 'network') {
-        return {
-            kind: 'backend-request',
-            at: event.timestamp,
-            label: event.title,
-            eventIds: [event.id],
-        };
-    }
-    // Visual violations
-    if (event.source === 'visual' && kind === 'visual-violation') {
-        const r = event.raw;
-        return {
-            kind: 'visual-violation',
-            at: event.timestamp,
-            label: `${r?.violation?.ruleType ?? 'rule'} ${r?.violation?.ruleId ?? ''}`,
-            eventIds: [event.id],
-        };
-    }
-    return undefined;
-}
+"use strict";var w=Object.defineProperty;var u=(e,n)=>w(e,"name",{value:n,configurable:!0});var I=Object.defineProperty,m=u((e,n)=>I(e,"name",{value:n,configurable:!0}),"c");export function groupByFlow(e){const n=new Map;for(const t of e){const o=t.context.flowId;if(!o)continue;let s=n.get(o);s||(s=[],n.set(o,s)),s.push(t)}return n}u(groupByFlow,"groupByFlow"),m(groupByFlow,"groupByFlow");export function compileStory(e,n={}){let t,o;if(n.flowId)o=n.flowId,t=e.filter(r=>r.context.flowId===o);else{const r=e.find(i=>i.context.flowId);if(!r)return;o=r.context.flowId,t=e.filter(i=>i.context.flowId===o)}if(t.length===0)return;t.sort((r,i)=>r.timestamp-i.timestamp);const s=1e3;t.length>s&&(t=[t[0],...t.slice(t.length-(s-1))]);const c=t[0],d=[];let l,p;for(const r of t){const i=f(r);if(i){if(d.push(i),i.kind==="render"||i.kind==="final-render"){const a=r.raw;a?.render&&(l={id:a.render.id,page:a.render.page,route:a.render.route,componentName:a.render.componentName})}else if(r.source==="visual"&&i.kind==="visual-violation"){const a=r.raw;a?.frame&&(p=a.frame.id)}}}for(let r=d.length-1;r>=0;r--)if(d[r].kind==="render"){d[r]={...d[r],kind:"final-render"};break}const v=t[0].timestamp,g=t[t.length-1].timestamp;return{flowId:o,origin:{type:c.context.originType,nodeId:c.context.originNodeId,at:c.timestamp},phases:d,finalState:l?{page:l.page,route:l.route,componentName:l.componentName,renderId:l.id,visualFrameId:p}:void 0,startedAt:v,endedAt:g,eventCount:t.length}}u(compileStory,"compileStory"),m(compileStory,"compileStory");function f(e){const n=(e.raw??null)?.kind;if(n==="flow-origin"||e.source==="client-runtime"&&n==="user-action"){const t=e.raw;return{kind:"user-action",at:e.timestamp,label:t?.origin?.label??e.title,eventIds:[e.id]}}if(e.source==="react"&&n==="render"){const t=e.raw;return{kind:"render",at:e.timestamp,label:`render ${t?.render?.componentName??"?"}`,eventIds:[e.id],details:t?.render?{componentName:t.render.componentName,durationMs:t.render.actualDurationMs}:void 0}}if(e.source==="react"&&n==="slot-content-changed"){const t=e.raw,o=t?.slot?.toComponent??"?";return{kind:/spinner|loader|loading/i.test(o)?"loading-ui":"idle-ui",at:e.timestamp,label:`slot ${t?.slot?.slotLogicalId??""} \u2192 ${o}`,eventIds:[e.id]}}if(e.source==="client-runtime"&&n==="route"){const t=e.raw;return{kind:"route-transition",at:e.timestamp,label:`route ${t?.from??""} \u2192 ${t?.url??""}`,eventIds:[e.id]}}if(e.source==="valtio"&&n==="state-update"){const t=e.raw;return{kind:"state-update",at:e.timestamp,label:`${t?.update?.storeId??"?"}.${t?.update?.path??"?"}`,eventIds:[e.id],details:t?.update}}if(e.source==="nestjs"&&n==="server-request"){const t=e.raw;return{kind:"backend-request",at:e.timestamp,label:`${t?.request?.method??"?"} ${t?.request?.route??"?"} \u2192 ${t?.request?.status??"?"}`,eventIds:[e.id],details:t?.request}}if(e.source==="chrome"&&e.category==="network")return{kind:"backend-request",at:e.timestamp,label:e.title,eventIds:[e.id]};if(e.source==="visual"&&n==="visual-violation"){const t=e.raw;return{kind:"visual-violation",at:e.timestamp,label:`${t?.violation?.ruleType??"rule"} ${t?.violation?.ruleId??""}`,eventIds:[e.id]}}}u(f,"g"),m(f,"classifyEvent");

package/lib/thresholds.js

@@ -1,23 +1 @@
-export const DEFAULT_THRESHOLDS = {
-    dbInLoop: 5,
-    nPlusOne: 3,
-    renderStorm: 5,
-    slowRouteMs: 500,
-    slowRenderMs: 16,
-};
-/**
- * Merge partial overrides over the defaults, ignoring any non-finite /
- * non-numeric values (so a malformed config can't disable detection).
- */
-export function resolveThresholds(overrides) {
-    const out = { ...DEFAULT_THRESHOLDS };
-    if (overrides) {
-        for (const key of Object.keys(DEFAULT_THRESHOLDS)) {
-            const v = overrides[key];
-            if (typeof v === 'number' && Number.isFinite(v) && v >= 0) {
-                out[key] = v;
-            }
-        }
-    }
-    return out;
-}
+"use strict";var t=Object.defineProperty;var s=(e,r)=>t(e,"name",{value:r,configurable:!0});var c=Object.defineProperty,l=s((e,r)=>c(e,"name",{value:r,configurable:!0}),"s");export const DEFAULT_THRESHOLDS={dbInLoop:5,nPlusOne:3,renderStorm:5,slowRouteMs:500,slowRenderMs:16};export function resolveThresholds(e){const r={...DEFAULT_THRESHOLDS};if(e)for(const n of Object.keys(DEFAULT_THRESHOLDS)){const o=e[n];typeof o=="number"&&Number.isFinite(o)&&o>=0&&(r[n]=o)}return r}s(resolveThresholds,"resolveThresholds"),l(resolveThresholds,"resolveThresholds");

package/lib/ulid.js

@@ -1,32 +1 @@
-/**
- * Tiny dependency-free ULID-like ID generator.
- *
- * Real ULIDs are 26 chars Crockford-Base32. Ours are 26 chars of the same
- * alphabet for compatibility, with the 48-bit timestamp prefix and 80
- * bits of `crypto.getRandomValues` randomness. Sortable by creation time.
- */
-const ALPHABET = '0123456789ABCDEFGHJKMNPQRSTVWXYZ';
-const RANDOM_LEN = 16;
-function encodeTime(now, len) {
-    let out = '';
-    let n = now;
-    for (let i = len - 1; i >= 0; i--) {
-        const mod = n % 32;
-        out = ALPHABET[mod] + out;
-        n = (n - mod) / 32;
-    }
-    return out;
-}
-function encodeRandom(len) {
-    const bytes = new Uint8Array(len);
-    // Node 24 has global crypto; this is also fine in modern browsers.
-    globalThis.crypto.getRandomValues(bytes);
-    let out = '';
-    for (let i = 0; i < len; i++) {
-        out += ALPHABET[(bytes[i] ?? 0) & 31];
-    }
-    return out;
-}
-export function ulid(now = Date.now()) {
-    return encodeTime(now, 10) + encodeRandom(RANDOM_LEN);
-}
+"use strict";var d=Object.defineProperty;var r=(e,n)=>d(e,"name",{value:n,configurable:!0});var f=Object.defineProperty,c=r((e,n)=>f(e,"name",{value:n,configurable:!0}),"r");const i="0123456789ABCDEFGHJKMNPQRSTVWXYZ",b=16;function l(e,n){let o="",t=e;for(let u=n-1;u>=0;u--){const a=t%32;o=i[a]+o,t=(t-a)/32}return o}r(l,"s"),c(l,"encodeTime");function s(e){const n=new Uint8Array(e);globalThis.crypto.getRandomValues(n);let o="";for(let t=0;t<e;t++)o+=i[(n[t]??0)&31];return o}r(s,"a"),c(s,"encodeRandom");export function ulid(e=Date.now()){return l(e,10)+s(16)}r(ulid,"ulid"),c(ulid,"ulid");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lensmcp/core",
-  "version": "1.18.4",
+  "version": "1.18.7",
   "type": "module",
   "main": "./index.js",
   "module": "./index.js",
@@ -11,10 +11,15 @@
       "types": "./index.d.ts",
       "import": "./index.js",
       "default": "./index.js"
+    },
+    "./redact": {
+      "types": "./lib/redact.d.ts",
+      "import": "./lib/redact.js",
+      "default": "./lib/redact.js"
     }
   },
   "dependencies": {
-    "@lensmcp/protocol-types": "1.18.4",
+    "@lensmcp/protocol-types": "1.18.7",
     "tslib": "^2.3.0"
   },
   "license": "Apache-2.0",