@obsunified/collector 2.0.1 → 2.1.1

package/dist/auth.d.ts

@@ -1,2 +1,2 @@
 import 'hono';
-export { e as createIngestAuth, r as resetIngestAuthCache } from './ingest-auth-HFVO1zIp.js';
+export { e as createIngestAuth, r as resetIngestAuthCache } from './ingest-auth-C5-8Mly5.js';

package/dist/auth.js

@@ -1,7 +1,7 @@
 import {
   createIngestAuth,
   resetIngestAuthCache
-} from "./chunk-UGWDOGGH.js";
+} from "./chunk-KMEZKGSO.js";
 export {
   createIngestAuth,
   resetIngestAuthCache

package/dist/{chunk-UGWDOGGH.js → chunk-KMEZKGSO.js}

@@ -114,10 +114,11 @@ var ProjectsStore = class {
       warning: "This key will not be shown again. Store it somewhere safe."
     };
   }
-  async revokeKey(keyId) {
+  async revokeKey(keyId, projectId) {
     const result = await this.db.prepare(
-      `UPDATE ingest_keys SET revoked_at = ? WHERE id = ? AND revoked_at IS NULL`
-    ).bind((/* @__PURE__ */ new Date()).toISOString(), keyId).run();
+      `UPDATE ingest_keys SET revoked_at = ?
+				 WHERE id = ? AND project_id = ? AND revoked_at IS NULL`
+    ).bind((/* @__PURE__ */ new Date()).toISOString(), keyId, projectId).run();
     return (result.meta?.changes ?? 0) > 0;
   }
   async findByKeyHash(keyHash) {
@@ -170,18 +171,27 @@ var D1Adapter = class {
   }
 };
 var sqlDbFor = (env) => isSqlDb(env.DB) ? env.DB : new D1Adapter(env.DB);
+var SQLITE_ISO_FORMAT = "%Y-%m-%dT%H:%M:%fZ";
+var sqliteIsoNow = (modifier) => modifier ? `strftime('${SQLITE_ISO_FORMAT}', 'now', ${modifier})` : `strftime('${SQLITE_ISO_FORMAT}', 'now')`;
 var sqliteDialect = {
   name: "sqlite",
-  now: () => "datetime('now')",
-  sinceHours: (param) => `datetime('now', '-' || ${param} || ' hours')`,
-  sinceMinutes: (param) => `datetime('now', '-' || ${param} || ' minutes')`,
+  now: () => sqliteIsoNow(),
+  sinceHours: (param) => sqliteIsoNow(`'-' || ${param} || ' hours'`),
+  sinceMinutes: (param) => sqliteIsoNow(`'-' || ${param} || ' minutes'`),
   jsonText: (expr, path) => `json_extract(${expr}, '${path}')`
 };
+var POSTGRES_ISO_TEXT_FORMAT = `'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"'`;
+var POSTGRES_UTC_NOW = "(CURRENT_TIMESTAMP AT TIME ZONE 'UTC')";
+var postgresIsoText = (expr) => `to_char(${expr}, ${POSTGRES_ISO_TEXT_FORMAT})`;
 var postgresDialect = {
   name: "postgres",
-  now: () => "CURRENT_TIMESTAMP",
-  sinceHours: (param) => `(CURRENT_TIMESTAMP - (${param}::text || ' hours')::interval)`,
-  sinceMinutes: (param) => `(CURRENT_TIMESTAMP - (${param}::text || ' minutes')::interval)`,
+  now: () => postgresIsoText(POSTGRES_UTC_NOW),
+  sinceHours: (param) => postgresIsoText(
+    `${POSTGRES_UTC_NOW} - (${param}::text || ' hours')::interval`
+  ),
+  sinceMinutes: (param) => postgresIsoText(
+    `${POSTGRES_UTC_NOW} - (${param}::text || ' minutes')::interval`
+  ),
   jsonText: (expr, path) => {
     const key = path.replace(/^\$\./, "").replace(/^"|"$/g, "").replace(/\\u002E/g, ".");
     return `(${expr}::jsonb ->> '${key.replace(/'/g, "''")}')`;
@@ -308,6 +318,8 @@ function createIngestAuth(config) {
 export {
   D1Adapter,
   sqlDbFor,
+  SQLITE_ISO_FORMAT,
+  postgresIsoText,
   postgresDialect,
   dialectFor,
   sha256Hex,
@@ -316,4 +328,4 @@ export {
   resetIngestAuthCache,
   createIngestAuth
 };
-//# sourceMappingURL=chunk-UGWDOGGH.js.map
+//# sourceMappingURL=chunk-KMEZKGSO.js.map

package/dist/chunk-KMEZKGSO.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/lib/hash.ts","../src/lib/projects-store.ts","../src/lib/sql-db.ts","../src/auth/ingest-auth.ts"],"sourcesContent":["/**\n * Cross-runtime crypto helpers using Web Crypto API.\n * Works in Cloudflare Workers, Node 20+, Deno, Bun.\n */\n\n/** SHA-256 hash of a string, returned as lowercase hex. */\nexport async function sha256Hex(input: string): Promise<string> {\n\tconst encoder = new TextEncoder();\n\tconst digest = await crypto.subtle.digest(\"SHA-256\", encoder.encode(input));\n\treturn bytesToHex(new Uint8Array(digest));\n}\n\n/** Generate `bytes` cryptographically random bytes and return as lowercase hex. */\nexport function randomHex(bytes: number): string {\n\tconst buf = new Uint8Array(bytes);\n\tcrypto.getRandomValues(buf);\n\treturn bytesToHex(buf);\n}\n\nfunction bytesToHex(bytes: Uint8Array): string {\n\tlet out = \"\";\n\tfor (let i = 0; i < bytes.length; i++) {\n\t\tout += bytes[i].toString(16).padStart(2, \"0\");\n\t}\n\treturn out;\n}\n","import type {\n\tIngestKey,\n\tIngestKeyRow,\n\tIngestKeyWithPlaintext,\n\tProject,\n\tProjectRow,\n} from \"@obsunified/types\";\nimport { randomHex, sha256Hex } from \"./hash\";\nimport type { SqlDb } from \"./sql-db\";\n\nconst rowToProject = (row: ProjectRow): Project => ({\n\tid: row.id,\n\tname: row.name,\n\tslug: row.slug,\n\tcreatedAt: row.created_at,\n\tpayloadCaptureEnabled:\n\t\trow.payload_capture_enabled === true ||\n\t\trow.payload_capture_enabled === 1 ||\n\t\trow.payload_capture_enabled === \"1\" ||\n\t\trow.payload_capture_enabled === \"true\",\n});\n\nconst rowToKey = (row: IngestKeyRow): IngestKey => ({\n\tid: row.id,\n\tprojectId: row.project_id,\n\tname: row.name,\n\tkeyPrefix: row.key_prefix,\n\tcreatedAt: row.created_at,\n\trevokedAt: row.revoked_at,\n});\n\nconst SLUG_PATTERN = /^[a-z0-9]([a-z0-9-]{0,48}[a-z0-9])?$/;\n\nexport class ProjectsStore {\n\tconstructor(private readonly db: SqlDb) {}\n\n\tasync listProjects(): Promise<Project[]> {\n\t\tconst rs = await this.db\n\t\t\t.prepare(`SELECT * FROM projects ORDER BY created_at ASC`)\n\t\t\t.all<ProjectRow>();\n\t\treturn (rs.results ?? []).map(rowToProject);\n\t}\n\n\tasync getProject(id: string): Promise<Project | null> {\n\t\tconst row = await this.db\n\t\t\t.prepare(`SELECT * FROM projects WHERE id = ?`)\n\t\t\t.bind(id)\n\t\t\t.first<ProjectRow>();\n\t\treturn row ? rowToProject(row) : null;\n\t}\n\n\tasync createProject(input: { name: string; slug: string }): Promise<Project> {\n\t\tconst name = input.name.trim();\n\t\tconst slug = input.slug.trim().toLowerCase();\n\t\tif (!name) throw new Error(\"Project name is required\");\n\t\tif (!SLUG_PATTERN.test(slug))\n\t\t\tthrow new Error(\n\t\t\t\t\"Slug must be lowercase letters, digits, and hyphens (max 50 chars)\",\n\t\t\t);\n\n\t\tconst id = randomHex(16);\n\t\tconst createdAt = new Date().toISOString();\n\n\t\tawait this.db\n\t\t\t.prepare(\n\t\t\t\t`INSERT INTO projects (id, name, slug, created_at) VALUES (?, ?, ?, ?)`,\n\t\t\t)\n\t\t\t.bind(id, name, slug, createdAt)\n\t\t\t.run();\n\n\t\treturn { id, name, slug, createdAt, payloadCaptureEnabled: false };\n\t}\n\n\tasync updateProject(\n\t\tid: string,\n\t\tpatch: { name?: string; payloadCaptureEnabled?: boolean },\n\t): Promise<Project | null> {\n\t\tconst existing = await this.getProject(id);\n\t\tif (!existing) return null;\n\n\t\tconst name = patch.name?.trim();\n\t\tlet next = existing;\n\t\tif (name !== undefined && name !== existing.name) {\n\t\t\tawait this.db\n\t\t\t\t.prepare(`UPDATE projects SET name = ? WHERE id = ?`)\n\t\t\t\t.bind(name, id)\n\t\t\t\t.run();\n\t\t\tnext = { ...next, name };\n\t\t}\n\t\tif (\n\t\t\tpatch.payloadCaptureEnabled !== undefined &&\n\t\t\tpatch.payloadCaptureEnabled !== existing.payloadCaptureEnabled\n\t\t) {\n\t\t\tawait this.db\n\t\t\t\t.prepare(`UPDATE projects SET payload_capture_enabled = ? WHERE id = ?`)\n\t\t\t\t.bind(patch.payloadCaptureEnabled ? 1 : 0, id)\n\t\t\t\t.run();\n\t\t\tnext = {\n\t\t\t\t...next,\n\t\t\t\tpayloadCaptureEnabled: patch.payloadCaptureEnabled,\n\t\t\t};\n\t\t}\n\t\treturn next;\n\t}\n\n\tasync ensureDefaultProject(): Promise<void> {\n\t\tawait this.db\n\t\t\t.prepare(\n\t\t\t\t`INSERT OR IGNORE INTO projects (id, name, slug, created_at) VALUES ('default', 'Default', 'default', ?)`,\n\t\t\t)\n\t\t\t.bind(new Date().toISOString())\n\t\t\t.run();\n\t}\n\n\t// ── Ingest keys ──\n\n\tasync listKeys(projectId: string): Promise<IngestKey[]> {\n\t\tconst rs = await this.db\n\t\t\t.prepare(\n\t\t\t\t`SELECT * FROM ingest_keys WHERE project_id = ? ORDER BY created_at DESC`,\n\t\t\t)\n\t\t\t.bind(projectId)\n\t\t\t.all<IngestKeyRow>();\n\t\treturn (rs.results ?? []).map(rowToKey);\n\t}\n\n\tasync createKey(\n\t\tprojectId: string,\n\t\tname: string,\n\t): Promise<IngestKeyWithPlaintext> {\n\t\tconst project = await this.getProject(projectId);\n\t\tif (!project) throw new Error(\"Project not found\");\n\n\t\tconst trimmedName = name.trim() || \"unnamed\";\n\t\tconst id = randomHex(16);\n\t\tconst plaintext = `obs_${project.slug}_${randomHex(24)}`;\n\t\tconst keyHash = await sha256Hex(plaintext);\n\t\t// Prefix: show enough to identify but not recover (first 16 chars).\n\t\tconst keyPrefix = plaintext.slice(0, 16);\n\t\tconst createdAt = new Date().toISOString();\n\n\t\tawait this.db\n\t\t\t.prepare(\n\t\t\t\t`INSERT INTO ingest_keys (id, project_id, key_hash, key_prefix, name, created_at) VALUES (?, ?, ?, ?, ?, ?)`,\n\t\t\t)\n\t\t\t.bind(id, projectId, keyHash, keyPrefix, trimmedName, createdAt)\n\t\t\t.run();\n\n\t\treturn {\n\t\t\tid,\n\t\t\tprojectId,\n\t\t\tname: trimmedName,\n\t\t\tkeyPrefix,\n\t\t\tcreatedAt,\n\t\t\trevokedAt: null,\n\t\t\tkey: plaintext,\n\t\t\twarning: \"This key will not be shown again. Store it somewhere safe.\",\n\t\t};\n\t}\n\n\tasync revokeKey(keyId: string, projectId: string): Promise<boolean> {\n\t\tconst result = await this.db\n\t\t\t.prepare(\n\t\t\t\t`UPDATE ingest_keys SET revoked_at = ?\n\t\t\t\t WHERE id = ? AND project_id = ? AND revoked_at IS NULL`,\n\t\t\t)\n\t\t\t.bind(new Date().toISOString(), keyId, projectId)\n\t\t\t.run();\n\t\treturn (result.meta?.changes ?? 0) > 0;\n\t}\n\n\tasync findByKeyHash(\n\t\tkeyHash: string,\n\t): Promise<{ projectId: string; keyId: string } | null> {\n\t\tconst row = await this.db\n\t\t\t.prepare(\n\t\t\t\t`SELECT id, project_id FROM ingest_keys WHERE key_hash = ? AND revoked_at IS NULL`,\n\t\t\t)\n\t\t\t.bind(keyHash)\n\t\t\t.first<{ id: string; project_id: string }>();\n\t\treturn row ? { projectId: row.project_id, keyId: row.id } : null;\n\t}\n\n\t/**\n\t * Idempotently register the legacy env INGEST_KEY as a bootstrap key on the\n\t * default project, so existing deployments keep working without manual migration.\n\t */\n\tasync bootstrapEnvKey(plaintext: string): Promise<void> {\n\t\tif (!plaintext) return;\n\t\tawait this.ensureDefaultProject();\n\t\tconst keyHash = await sha256Hex(plaintext);\n\t\tconst existing = await this.db\n\t\t\t.prepare(`SELECT id FROM ingest_keys WHERE key_hash = ?`)\n\t\t\t.bind(keyHash)\n\t\t\t.first<{ id: string }>();\n\t\tif (existing) return;\n\n\t\tconst id = randomHex(16);\n\t\tconst keyPrefix = plaintext.slice(0, Math.min(16, plaintext.length));\n\t\tconst createdAt = new Date().toISOString();\n\t\tawait this.db\n\t\t\t.prepare(\n\t\t\t\t`INSERT INTO ingest_keys (id, project_id, key_hash, key_prefix, name, created_at) VALUES (?, 'default', ?, ?, 'bootstrap', ?)`,\n\t\t\t)\n\t\t\t.bind(id, keyHash, keyPrefix, createdAt)\n\t\t\t.run();\n\t}\n}\n","/**\n * Storage seam for the collector — RFC 0008.\n *\n * Stores and plugins target this interface instead of `D1Database` directly,\n * so a future Node / better-sqlite3 / ClickHouse runtime is one new adapter\n * away rather than a fork-and-rewrite. The shape is deliberately D1's\n * existing `prepare → bind → first|all|run` chain so the migration of\n * existing stores is mechanical (search-and-replace the constructor type).\n *\n * Today there is one implementation, `D1Adapter`. A `MemSqlDb` test double\n * lives next door under `test-utils/`; `BetterSqliteAdapter` and\n * `ClickHouseAdapter` are deferred until they have a real runtime to serve.\n */\n\nexport interface SqlDb {\n\treadonly dialect?: SqlDialect;\n\tprepare(sql: string): SqlStatement;\n\t/**\n\t * Run multiple prepared statements as a batch. On D1 this maps to a\n\t * single network round-trip; on a future better-sqlite3 adapter it\n\t * wraps the calls in a transaction. Returns one result per statement\n\t * in input order, mirroring D1's `batch`.\n\t *\n\t * Statements MUST have been produced by this same `SqlDb` instance —\n\t * mixing adapters is an error and runtime behavior is undefined.\n\t */\n\tbatch(\n\t\tstatements: SqlStatement[],\n\t): Promise<Array<{ meta: { changes: number } }>>;\n}\n\nexport type SqlDialectName = \"sqlite\" | \"postgres\";\n\nexport interface SqlDialect {\n\treadonly name: SqlDialectName;\n\tnow(): string;\n\tsinceHours(param: string): string;\n\tsinceMinutes(param: string): string;\n\tjsonText(expr: string, path: string): string;\n}\n\nexport interface SqlStatement {\n\tbind(...args: unknown[]): SqlStatement;\n\tfirst<T = Record<string, unknown>>(): Promise<T | null>;\n\tall<T = Record<string, unknown>>(): Promise<{ results: T[] }>;\n\trun(): Promise<{ meta: { changes: number } }>;\n}\n\n/**\n * D1 already conforms to this shape almost exactly; the adapter normalizes\n * two small differences:\n *  - `all()` on D1 returns `results?: T[]` (optional). We coerce to `[]`.\n *  - `run()`'s `meta.changes` is optional on D1. We coerce to `0`.\n * Both differences are runtime-undetectable for the queries this codebase\n * issues (every successful all() returns results; every run() against an\n * INSERT/UPDATE/DELETE reports changes), but coercing keeps the typed\n * interface honest.\n */\nexport class D1Adapter implements SqlDb {\n\treadonly dialect = sqliteDialect;\n\n\tconstructor(private readonly d1: D1Database) {}\n\n\tprepare(sql: string): SqlStatement {\n\t\treturn new D1StatementAdapter(this.d1.prepare(sql));\n\t}\n\n\tasync batch(\n\t\tstatements: SqlStatement[],\n\t): Promise<Array<{ meta: { changes: number } }>> {\n\t\t// Unwrap each statement back to its D1 form — D1's batch takes\n\t\t// D1PreparedStatement[], not our typed wrapper.\n\t\tconst unwrapped = statements.map((s) => {\n\t\t\tif (!(s instanceof D1StatementAdapter)) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"D1Adapter.batch: statement was not produced by D1Adapter\",\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn s.unwrap();\n\t\t});\n\t\tconst results = await this.d1.batch(unwrapped);\n\t\treturn results.map((r) => ({\n\t\t\tmeta: { changes: r.meta?.changes ?? 0 },\n\t\t}));\n\t}\n}\n\n/**\n * Convenience wrapper for the common case: take a `CollectorEnv`-shaped\n * object and return an `SqlDb`. Most plugins don't have access to the\n * `CollectorRuntime` (they get it at register time, not handler time)\n * so they call this directly. Plugins that *do* hold the runtime should\n * prefer `runtime.getSqlDb(env)` so a host-supplied `sqlDb` factory in\n * `CollectorConfig` takes effect.\n */\nexport const sqlDbFor = (env: { DB: D1Database | SqlDb }): SqlDb =>\n\tisSqlDb(env.DB) ? env.DB : new D1Adapter(env.DB);\n\n/**\n * SQLite `strftime` format that reproduces `Date#toISOString()` output\n * (`YYYY-MM-DDTHH:MM:SS.mmmZ`). Every stored timestamp column holds that\n * shape, so time windows must be rendered the same way: `datetime('now')`\n * yields `YYYY-MM-DD HH:MM:SS` and in a text comparison the space sorts\n * before the `T`, which made \"last 5 minutes\" match the whole current UTC\n * day on D1 and made `expires_at < now` purges run a day late.\n */\nexport const SQLITE_ISO_FORMAT = \"%Y-%m-%dT%H:%M:%fZ\";\n\n/** Render SQLite `now` (optionally shifted by a modifier expression) as ISO text. */\nexport const sqliteIsoNow = (modifier?: string): string =>\n\tmodifier\n\t\t? `strftime('${SQLITE_ISO_FORMAT}', 'now', ${modifier})`\n\t\t: `strftime('${SQLITE_ISO_FORMAT}', 'now')`;\n\nexport const sqliteDialect: SqlDialect = {\n\tname: \"sqlite\",\n\tnow: () => sqliteIsoNow(),\n\tsinceHours: (param) => sqliteIsoNow(`'-' || ${param} || ' hours'`),\n\tsinceMinutes: (param) => sqliteIsoNow(`'-' || ${param} || ' minutes'`),\n\tjsonText: (expr, path) => `json_extract(${expr}, '${path}')`,\n};\n\n/**\n * The collector stores every timestamp column (`received_at`, `expires_at`,\n * `occurred_at`, …) as TEXT holding `Date#toISOString()` output on both\n * D1 and Postgres. Postgres will not compare TEXT against a\n * `timestamptz`, so time-window expressions have to be rendered as ISO\n * text in the same `YYYY-MM-DDTHH:MM:SS.mmmZ` shape the collector writes.\n */\nconst POSTGRES_ISO_TEXT_FORMAT = `'YYYY-MM-DD\"T\"HH24:MI:SS.MS\"Z\"'`;\nconst POSTGRES_UTC_NOW = \"(CURRENT_TIMESTAMP AT TIME ZONE 'UTC')\";\n\n/** Render a Postgres `timestamp` expression as collector-style ISO text. */\nexport const postgresIsoText = (expr: string): string =>\n\t`to_char(${expr}, ${POSTGRES_ISO_TEXT_FORMAT})`;\n\nexport const postgresDialect: SqlDialect = {\n\tname: \"postgres\",\n\tnow: () => postgresIsoText(POSTGRES_UTC_NOW),\n\tsinceHours: (param) =>\n\t\tpostgresIsoText(\n\t\t\t`${POSTGRES_UTC_NOW} - (${param}::text || ' hours')::interval`,\n\t\t),\n\tsinceMinutes: (param) =>\n\t\tpostgresIsoText(\n\t\t\t`${POSTGRES_UTC_NOW} - (${param}::text || ' minutes')::interval`,\n\t\t),\n\tjsonText: (expr, path) => {\n\t\tconst key = path\n\t\t\t.replace(/^\\$\\./, \"\")\n\t\t\t.replace(/^\"|\"$/g, \"\")\n\t\t\t.replace(/\\\\u002E/g, \".\");\n\t\treturn `(${expr}::jsonb ->> '${key.replace(/'/g, \"''\")}')`;\n\t},\n};\n\nexport const dialectFor = (db: SqlDb): SqlDialect =>\n\tdb.dialect ?? sqliteDialect;\n\nconst isSqlDb = (db: unknown): db is SqlDb => {\n\tif (!db || typeof db !== \"object\") return false;\n\tconst candidate = db as {\n\t\tprepare?: unknown;\n\t\tbatch?: unknown;\n\t\texec?: unknown;\n\t};\n\treturn (\n\t\ttypeof candidate.prepare === \"function\" &&\n\t\ttypeof candidate.batch === \"function\" &&\n\t\ttypeof candidate.exec !== \"function\"\n\t);\n};\n\nclass D1StatementAdapter implements SqlStatement {\n\tconstructor(private readonly stmt: D1PreparedStatement) {}\n\n\t/** Internal escape hatch for `D1Adapter.batch` to recover the wrapped\n\t *  D1 statement. Not part of the public `SqlStatement` shape. */\n\tunwrap(): D1PreparedStatement {\n\t\treturn this.stmt;\n\t}\n\n\tbind(...args: unknown[]): SqlStatement {\n\t\treturn new D1StatementAdapter(this.stmt.bind(...args));\n\t}\n\n\tfirst<T = Record<string, unknown>>(): Promise<T | null> {\n\t\treturn this.stmt.first<T>();\n\t}\n\n\tasync all<T = Record<string, unknown>>(): Promise<{ results: T[] }> {\n\t\tconst r = await this.stmt.all<T>();\n\t\treturn { results: r.results ?? [] };\n\t}\n\n\tasync run(): Promise<{ meta: { changes: number } }> {\n\t\tconst r = await this.stmt.run();\n\t\treturn { meta: { changes: r.meta?.changes ?? 0 } };\n\t}\n}\n","import type { MiddlewareHandler } from \"hono\";\nimport type { CollectorEnv } from \"../framework/env\";\nimport { sha256Hex } from \"../lib/hash\";\nimport { ProjectsStore } from \"../lib/projects-store\";\nimport { sqlDbFor } from \"../lib/sql-db\";\n\nconst CACHE_TTL_MS = 60_000; // 60 seconds\nconst CACHE_MAX_ENTRIES = 500;\n\ninterface CacheEntry {\n\tprojectId: string;\n\texpiresAt: number;\n}\n\nlet keyCaches = new WeakMap<object, Map<string, CacheEntry>>();\nlet bootstrapDone = false;\n\nfunction cacheFor(dbKey: object): Map<string, CacheEntry> {\n\tlet cache = keyCaches.get(dbKey);\n\tif (!cache) {\n\t\tcache = new Map();\n\t\tkeyCaches.set(dbKey, cache);\n\t}\n\treturn cache;\n}\n\nfunction getCached(\n\tcache: Map<string, CacheEntry>,\n\thash: string,\n\tnow: number,\n): string | null {\n\tpruneKeyCache(cache, now);\n\tconst entry = cache.get(hash);\n\tif (!entry) return null;\n\tif (entry.expiresAt <= now) {\n\t\tcache.delete(hash);\n\t\treturn null;\n\t}\n\treturn entry.projectId;\n}\n\nfunction setCached(\n\tcache: Map<string, CacheEntry>,\n\thash: string,\n\tprojectId: string,\n\tnow: number,\n): void {\n\tpruneKeyCache(cache, now);\n\twhile (cache.size >= CACHE_MAX_ENTRIES) {\n\t\tconst oldestKey = cache.keys().next().value;\n\t\tif (!oldestKey) break;\n\t\tcache.delete(oldestKey);\n\t}\n\tcache.set(hash, { projectId, expiresAt: now + CACHE_TTL_MS });\n}\n\nfunction pruneKeyCache(cache: Map<string, CacheEntry>, now: number): void {\n\tfor (const [hash, entry] of cache) {\n\t\tif (entry.expiresAt <= now) cache.delete(hash);\n\t}\n}\n\n/** Test helper — clears the in-memory cache and bootstrap flag. */\nexport function resetIngestAuthCache(): void {\n\tkeyCaches = new WeakMap();\n\tbootstrapDone = false;\n}\n\n/**\n * Creates middleware that validates ingest API keys against the ingest_keys table.\n *\n * Accepts the key from either:\n *   - Authorization: Bearer <key>\n *   - X-API-Key: <key>\n *\n * On success, sets `projectId` on the Hono context via `c.set('projectId', ...)`.\n *\n * On the first request per isolate, if `env.INGEST_KEY` is set, the middleware\n * registers it as a `bootstrap` key on the default project — so existing\n * single-tenant deployments continue to work without manual migration.\n */\nexport function createIngestAuth(config?: {\n\tallowUnauthenticated?: boolean;\n}): MiddlewareHandler<{\n\tBindings: CollectorEnv;\n\tVariables: { projectId: string };\n}> {\n\treturn async (c, next) => {\n\t\t// Lazy bootstrap of legacy env key (idempotent).\n\t\tif (!bootstrapDone) {\n\t\t\tconst legacy = c.env.INGEST_KEY || c.env.TELEMETRY_INGEST_TOKEN;\n\t\t\tif (legacy) {\n\t\t\t\tconst store = new ProjectsStore(sqlDbFor(c.env));\n\t\t\t\ttry {\n\t\t\t\t\tawait store.bootstrapEnvKey(legacy);\n\t\t\t\t\t// Latch only after success: a transient DB error on the first\n\t\t\t\t\t// request must not permanently disable legacy-key bootstrap for\n\t\t\t\t\t// the isolate. bootstrapEnvKey is idempotent, so concurrent\n\t\t\t\t\t// first-requests racing here are harmless.\n\t\t\t\t\tbootstrapDone = true;\n\t\t\t\t} catch (err) {\n\t\t\t\t\tconsole.error(\"[ingest-auth] bootstrap failed:\", err);\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Nothing to bootstrap — don't keep re-checking on every request.\n\t\t\t\tbootstrapDone = true;\n\t\t\t}\n\t\t}\n\n\t\tconst bearer = c.req.header(\"Authorization\")?.replace(/^Bearer\\s+/i, \"\");\n\t\tconst apiKey = c.req.header(\"X-API-Key\");\n\t\tconst token = bearer || apiKey;\n\n\t\tif (!token) {\n\t\t\tif (\n\t\t\t\tconfig?.allowUnauthenticated ||\n\t\t\t\tc.env.ALLOW_UNAUTHENTICATED === \"true\"\n\t\t\t) {\n\t\t\t\tc.set(\"projectId\", \"default\");\n\t\t\t\treturn next();\n\t\t\t}\n\t\t\treturn c.json({ error: \"Unauthorized\" }, 401);\n\t\t}\n\n\t\tconst now = Date.now();\n\t\tconst hash = await sha256Hex(token);\n\t\tconst rawDb =\n\t\t\t(c.env.DB as unknown as Record<string, unknown>)?.__unwrapped_db ||\n\t\t\tc.env.DB;\n\t\tconst cache = cacheFor(rawDb);\n\t\tconst cached = getCached(cache, hash, now);\n\t\tif (cached) {\n\t\t\tc.set(\"projectId\", cached);\n\t\t\treturn next();\n\t\t}\n\n\t\tconst store = new ProjectsStore(sqlDbFor(c.env));\n\t\tconst match = await store.findByKeyHash(hash);\n\t\tif (!match) {\n\t\t\treturn c.json({ error: \"Unauthorized\" }, 401);\n\t\t}\n\n\t\tsetCached(cache, hash, match.projectId, now);\n\t\tc.set(\"projectId\", match.projectId);\n\t\treturn next();\n\t};\n}\n"],"mappings":";AAMA,eAAsB,UAAU,OAAgC;AAC/D,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,QAAQ,OAAO,KAAK,CAAC;AAC1E,SAAO,WAAW,IAAI,WAAW,MAAM,CAAC;AACzC;AAGO,SAAS,UAAU,OAAuB;AAChD,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,SAAO,gBAAgB,GAAG;AAC1B,SAAO,WAAW,GAAG;AACtB;AAEA,SAAS,WAAW,OAA2B;AAC9C,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACtC,WAAO,MAAM,CAAC,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAAA,EAC7C;AACA,SAAO;AACR;;;ACfA,IAAM,eAAe,CAAC,SAA8B;AAAA,EACnD,IAAI,IAAI;AAAA,EACR,MAAM,IAAI;AAAA,EACV,MAAM,IAAI;AAAA,EACV,WAAW,IAAI;AAAA,EACf,uBACC,IAAI,4BAA4B,QAChC,IAAI,4BAA4B,KAChC,IAAI,4BAA4B,OAChC,IAAI,4BAA4B;AAClC;AAEA,IAAM,WAAW,CAAC,SAAkC;AAAA,EACnD,IAAI,IAAI;AAAA,EACR,WAAW,IAAI;AAAA,EACf,MAAM,IAAI;AAAA,EACV,WAAW,IAAI;AAAA,EACf,WAAW,IAAI;AAAA,EACf,WAAW,IAAI;AAChB;AAEA,IAAM,eAAe;AAEd,IAAM,gBAAN,MAAoB;AAAA,EAC1B,YAA6B,IAAW;AAAX;AAAA,EAAY;AAAA,EAEzC,MAAM,eAAmC;AACxC,UAAM,KAAK,MAAM,KAAK,GACpB,QAAQ,gDAAgD,EACxD,IAAgB;AAClB,YAAQ,GAAG,WAAW,CAAC,GAAG,IAAI,YAAY;AAAA,EAC3C;AAAA,EAEA,MAAM,WAAW,IAAqC;AACrD,UAAM,MAAM,MAAM,KAAK,GACrB,QAAQ,qCAAqC,EAC7C,KAAK,EAAE,EACP,MAAkB;AACpB,WAAO,MAAM,aAAa,GAAG,IAAI;AAAA,EAClC;AAAA,EAEA,MAAM,cAAc,OAAyD;AAC5E,UAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,UAAM,OAAO,MAAM,KAAK,KAAK,EAAE,YAAY;AAC3C,QAAI,CAAC,KAAM,OAAM,IAAI,MAAM,0BAA0B;AACrD,QAAI,CAAC,aAAa,KAAK,IAAI;AAC1B,YAAM,IAAI;AAAA,QACT;AAAA,MACD;AAED,UAAM,KAAK,UAAU,EAAE;AACvB,UAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AAEzC,UAAM,KAAK,GACT;AAAA,MACA;AAAA,IACD,EACC,KAAK,IAAI,MAAM,MAAM,SAAS,EAC9B,IAAI;AAEN,WAAO,EAAE,IAAI,MAAM,MAAM,WAAW,uBAAuB,MAAM;AAAA,EAClE;AAAA,EAEA,MAAM,cACL,IACA,OAC0B;AAC1B,UAAM,WAAW,MAAM,KAAK,WAAW,EAAE;AACzC,QAAI,CAAC,SAAU,QAAO;AAEtB,UAAM,OAAO,MAAM,MAAM,KAAK;AAC9B,QAAI,OAAO;AACX,QAAI,SAAS,UAAa,SAAS,SAAS,MAAM;AACjD,YAAM,KAAK,GACT,QAAQ,2CAA2C,EACnD,KAAK,MAAM,EAAE,EACb,IAAI;AACN,aAAO,EAAE,GAAG,MAAM,KAAK;AAAA,IACxB;AACA,QACC,MAAM,0BAA0B,UAChC,MAAM,0BAA0B,SAAS,uBACxC;AACD,YAAM,KAAK,GACT,QAAQ,8DAA8D,EACtE,KAAK,MAAM,wBAAwB,IAAI,GAAG,EAAE,EAC5C,IAAI;AACN,aAAO;AAAA,QACN,GAAG;AAAA,QACH,uBAAuB,MAAM;AAAA,MAC9B;AAAA,IACD;AACA,WAAO;AAAA,EACR;AAAA,EAEA,MAAM,uBAAsC;AAC3C,UAAM,KAAK,GACT;AAAA,MACA;AAAA,IACD,EACC,MAAK,oBAAI,KAAK,GAAE,YAAY,CAAC,EAC7B,IAAI;AAAA,EACP;AAAA;AAAA,EAIA,MAAM,SAAS,WAAyC;AACvD,UAAM,KAAK,MAAM,KAAK,GACpB;AAAA,MACA;AAAA,IACD,EACC,KAAK,SAAS,EACd,IAAkB;AACpB,YAAQ,GAAG,WAAW,CAAC,GAAG,IAAI,QAAQ;AAAA,EACvC;AAAA,EAEA,MAAM,UACL,WACA,MACkC;AAClC,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS;AAC/C,QAAI,CAAC,QAAS,OAAM,IAAI,MAAM,mBAAmB;AAEjD,UAAM,cAAc,KAAK,KAAK,KAAK;AACnC,UAAM,KAAK,UAAU,EAAE;AACvB,UAAM,YAAY,OAAO,QAAQ,IAAI,IAAI,UAAU,EAAE,CAAC;AACtD,UAAM,UAAU,MAAM,UAAU,SAAS;AAEzC,UAAM,YAAY,UAAU,MAAM,GAAG,EAAE;AACvC,UAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AAEzC,UAAM,KAAK,GACT;AAAA,MACA;AAAA,IACD,EACC,KAAK,IAAI,WAAW,SAAS,WAAW,aAAa,SAAS,EAC9D,IAAI;AAEN,WAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA,WAAW;AAAA,MACX,KAAK;AAAA,MACL,SAAS;AAAA,IACV;AAAA,EACD;AAAA,EAEA,MAAM,UAAU,OAAe,WAAqC;AACnE,UAAM,SAAS,MAAM,KAAK,GACxB;AAAA,MACA;AAAA;AAAA,IAED,EACC,MAAK,oBAAI,KAAK,GAAE,YAAY,GAAG,OAAO,SAAS,EAC/C,IAAI;AACN,YAAQ,OAAO,MAAM,WAAW,KAAK;AAAA,EACtC;AAAA,EAEA,MAAM,cACL,SACuD;AACvD,UAAM,MAAM,MAAM,KAAK,GACrB;AAAA,MACA;AAAA,IACD,EACC,KAAK,OAAO,EACZ,MAA0C;AAC5C,WAAO,MAAM,EAAE,WAAW,IAAI,YAAY,OAAO,IAAI,GAAG,IAAI;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,gBAAgB,WAAkC;AACvD,QAAI,CAAC,UAAW;AAChB,UAAM,KAAK,qBAAqB;AAChC,UAAM,UAAU,MAAM,UAAU,SAAS;AACzC,UAAM,WAAW,MAAM,KAAK,GAC1B,QAAQ,+CAA+C,EACvD,KAAK,OAAO,EACZ,MAAsB;AACxB,QAAI,SAAU;AAEd,UAAM,KAAK,UAAU,EAAE;AACvB,UAAM,YAAY,UAAU,MAAM,GAAG,KAAK,IAAI,IAAI,UAAU,MAAM,CAAC;AACnE,UAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,UAAM,KAAK,GACT;AAAA,MACA;AAAA,IACD,EACC,KAAK,IAAI,SAAS,WAAW,SAAS,EACtC,IAAI;AAAA,EACP;AACD;;;ACrJO,IAAM,YAAN,MAAiC;AAAA,EAGvC,YAA6B,IAAgB;AAAhB;AAAA,EAAiB;AAAA,EAFrC,UAAU;AAAA,EAInB,QAAQ,KAA2B;AAClC,WAAO,IAAI,mBAAmB,KAAK,GAAG,QAAQ,GAAG,CAAC;AAAA,EACnD;AAAA,EAEA,MAAM,MACL,YACgD;AAGhD,UAAM,YAAY,WAAW,IAAI,CAAC,MAAM;AACvC,UAAI,EAAE,aAAa,qBAAqB;AACvC,cAAM,IAAI;AAAA,UACT;AAAA,QACD;AAAA,MACD;AACA,aAAO,EAAE,OAAO;AAAA,IACjB,CAAC;AACD,UAAM,UAAU,MAAM,KAAK,GAAG,MAAM,SAAS;AAC7C,WAAO,QAAQ,IAAI,CAAC,OAAO;AAAA,MAC1B,MAAM,EAAE,SAAS,EAAE,MAAM,WAAW,EAAE;AAAA,IACvC,EAAE;AAAA,EACH;AACD;AAUO,IAAM,WAAW,CAAC,QACxB,QAAQ,IAAI,EAAE,IAAI,IAAI,KAAK,IAAI,UAAU,IAAI,EAAE;AAUzC,IAAM,oBAAoB;AAG1B,IAAM,eAAe,CAAC,aAC5B,WACG,aAAa,iBAAiB,aAAa,QAAQ,MACnD,aAAa,iBAAiB;AAE3B,IAAM,gBAA4B;AAAA,EACxC,MAAM;AAAA,EACN,KAAK,MAAM,aAAa;AAAA,EACxB,YAAY,CAAC,UAAU,aAAa,UAAU,KAAK,cAAc;AAAA,EACjE,cAAc,CAAC,UAAU,aAAa,UAAU,KAAK,gBAAgB;AAAA,EACrE,UAAU,CAAC,MAAM,SAAS,gBAAgB,IAAI,MAAM,IAAI;AACzD;AASA,IAAM,2BAA2B;AACjC,IAAM,mBAAmB;AAGlB,IAAM,kBAAkB,CAAC,SAC/B,WAAW,IAAI,KAAK,wBAAwB;AAEtC,IAAM,kBAA8B;AAAA,EAC1C,MAAM;AAAA,EACN,KAAK,MAAM,gBAAgB,gBAAgB;AAAA,EAC3C,YAAY,CAAC,UACZ;AAAA,IACC,GAAG,gBAAgB,OAAO,KAAK;AAAA,EAChC;AAAA,EACD,cAAc,CAAC,UACd;AAAA,IACC,GAAG,gBAAgB,OAAO,KAAK;AAAA,EAChC;AAAA,EACD,UAAU,CAAC,MAAM,SAAS;AACzB,UAAM,MAAM,KACV,QAAQ,SAAS,EAAE,EACnB,QAAQ,UAAU,EAAE,EACpB,QAAQ,YAAY,GAAG;AACzB,WAAO,IAAI,IAAI,gBAAgB,IAAI,QAAQ,MAAM,IAAI,CAAC;AAAA,EACvD;AACD;AAEO,IAAM,aAAa,CAAC,OAC1B,GAAG,WAAW;AAEf,IAAM,UAAU,CAAC,OAA6B;AAC7C,MAAI,CAAC,MAAM,OAAO,OAAO,SAAU,QAAO;AAC1C,QAAM,YAAY;AAKlB,SACC,OAAO,UAAU,YAAY,cAC7B,OAAO,UAAU,UAAU,cAC3B,OAAO,UAAU,SAAS;AAE5B;AAEA,IAAM,qBAAN,MAAM,oBAA2C;AAAA,EAChD,YAA6B,MAA2B;AAA3B;AAAA,EAA4B;AAAA;AAAA;AAAA,EAIzD,SAA8B;AAC7B,WAAO,KAAK;AAAA,EACb;AAAA,EAEA,QAAQ,MAA+B;AACtC,WAAO,IAAI,oBAAmB,KAAK,KAAK,KAAK,GAAG,IAAI,CAAC;AAAA,EACtD;AAAA,EAEA,QAAwD;AACvD,WAAO,KAAK,KAAK,MAAS;AAAA,EAC3B;AAAA,EAEA,MAAM,MAA8D;AACnE,UAAM,IAAI,MAAM,KAAK,KAAK,IAAO;AACjC,WAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE;AAAA,EACnC;AAAA,EAEA,MAAM,MAA8C;AACnD,UAAM,IAAI,MAAM,KAAK,KAAK,IAAI;AAC9B,WAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,WAAW,EAAE,EAAE;AAAA,EAClD;AACD;;;ACjMA,IAAM,eAAe;AACrB,IAAM,oBAAoB;AAO1B,IAAI,YAAY,oBAAI,QAAyC;AAC7D,IAAI,gBAAgB;AAEpB,SAAS,SAAS,OAAwC;AACzD,MAAI,QAAQ,UAAU,IAAI,KAAK;AAC/B,MAAI,CAAC,OAAO;AACX,YAAQ,oBAAI,IAAI;AAChB,cAAU,IAAI,OAAO,KAAK;AAAA,EAC3B;AACA,SAAO;AACR;AAEA,SAAS,UACR,OACA,MACA,KACgB;AAChB,gBAAc,OAAO,GAAG;AACxB,QAAM,QAAQ,MAAM,IAAI,IAAI;AAC5B,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,MAAM,aAAa,KAAK;AAC3B,UAAM,OAAO,IAAI;AACjB,WAAO;AAAA,EACR;AACA,SAAO,MAAM;AACd;AAEA,SAAS,UACR,OACA,MACA,WACA,KACO;AACP,gBAAc,OAAO,GAAG;AACxB,SAAO,MAAM,QAAQ,mBAAmB;AACvC,UAAM,YAAY,MAAM,KAAK,EAAE,KAAK,EAAE;AACtC,QAAI,CAAC,UAAW;AAChB,UAAM,OAAO,SAAS;AAAA,EACvB;AACA,QAAM,IAAI,MAAM,EAAE,WAAW,WAAW,MAAM,aAAa,CAAC;AAC7D;AAEA,SAAS,cAAc,OAAgC,KAAmB;AACzE,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO;AAClC,QAAI,MAAM,aAAa,IAAK,OAAM,OAAO,IAAI;AAAA,EAC9C;AACD;AAGO,SAAS,uBAA6B;AAC5C,cAAY,oBAAI,QAAQ;AACxB,kBAAgB;AACjB;AAeO,SAAS,iBAAiB,QAK9B;AACF,SAAO,OAAO,GAAG,SAAS;AAEzB,QAAI,CAAC,eAAe;AACnB,YAAM,SAAS,EAAE,IAAI,cAAc,EAAE,IAAI;AACzC,UAAI,QAAQ;AACX,cAAMA,SAAQ,IAAI,cAAc,SAAS,EAAE,GAAG,CAAC;AAC/C,YAAI;AACH,gBAAMA,OAAM,gBAAgB,MAAM;AAKlC,0BAAgB;AAAA,QACjB,SAAS,KAAK;AACb,kBAAQ,MAAM,mCAAmC,GAAG;AAAA,QACrD;AAAA,MACD,OAAO;AAEN,wBAAgB;AAAA,MACjB;AAAA,IACD;AAEA,UAAM,SAAS,EAAE,IAAI,OAAO,eAAe,GAAG,QAAQ,eAAe,EAAE;AACvE,UAAM,SAAS,EAAE,IAAI,OAAO,WAAW;AACvC,UAAM,QAAQ,UAAU;AAExB,QAAI,CAAC,OAAO;AACX,UACC,QAAQ,wBACR,EAAE,IAAI,0BAA0B,QAC/B;AACD,UAAE,IAAI,aAAa,SAAS;AAC5B,eAAO,KAAK;AAAA,MACb;AACA,aAAO,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;AAAA,IAC7C;AAEA,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,OAAO,MAAM,UAAU,KAAK;AAClC,UAAM,QACJ,EAAE,IAAI,IAA2C,kBAClD,EAAE,IAAI;AACP,UAAM,QAAQ,SAAS,KAAK;AAC5B,UAAM,SAAS,UAAU,OAAO,MAAM,GAAG;AACzC,QAAI,QAAQ;AACX,QAAE,IAAI,aAAa,MAAM;AACzB,aAAO,KAAK;AAAA,IACb;AAEA,UAAM,QAAQ,IAAI,cAAc,SAAS,EAAE,GAAG,CAAC;AAC/C,UAAM,QAAQ,MAAM,MAAM,cAAc,IAAI;AAC5C,QAAI,CAAC,OAAO;AACX,aAAO,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;AAAA,IAC7C;AAEA,cAAU,OAAO,MAAM,MAAM,WAAW,GAAG;AAC3C,MAAE,IAAI,aAAa,MAAM,SAAS;AAClC,WAAO,KAAK;AAAA,EACb;AACD;","names":["store"]}

package/dist/index.d.ts

@@ -1,10 +1,10 @@
 import * as hono from 'hono';
-import { MiddlewareHandler, Hono } from 'hono';
+import { MiddlewareHandler, Hono, Context } from 'hono';
 import * as hono_types from 'hono/types';
 import * as _obsunified_types from '@obsunified/types';
 import { StoredSpan, TelemetryOverviewOptions, TelemetryOverviewResponse, TelemetryTraceDetailResponse, TelemetryInstrumentationGapsResponse, TelemetryIssueOptions, TelemetryIssueOverviewResponse, TelemetryIssueDetailResponse, UsageEventRecord, UsageOverviewOptions, UsageOverviewResponse, UsageSessionDetailResponse, UsageSessionSummary, AlertRuleInput, AlertRule, AlertStateRow, AlertState, AlertEvaluationsListResponse, AlertComparison, JsonValue, EvidenceReference, EvidenceReferenceContract, Project, IngestKey, IngestKeyWithPlaintext } from '@obsunified/types';
-import { b as CollectorEnv, c as CollectorRouteContext, L as Logger, C as ChildSpanRunner } from './ingest-auth-HFVO1zIp.js';
-export { a as CollectorApp, d as consoleLogger, e as createIngestAuth } from './ingest-auth-HFVO1zIp.js';
+import { b as CollectorEnv, L as Logger, C as ChildSpanRunner, c as CollectorRouteContext } from './ingest-auth-C5-8Mly5.js';
+export { a as CollectorApp, d as consoleLogger, e as createIngestAuth } from './ingest-auth-C5-8Mly5.js';
 import { ActionConfidence } from '@obsunified/types/constants';
 import { Pool } from 'pg';
 
@@ -81,6 +81,77 @@ declare class D1Adapter implements SqlDb {
     }>>;
 }
 
+/**
+ * RFC 0002 Stage 1 — runner that executes SQL-only Analyses on the existing
+ * scheduled handler.
+ *
+ * runSqlAnalysis  — execute one definition's `sql` against D1 and shape the
+ *                   row(s) into an AnalysisResult.
+ * runAllDueAnalyses — orchestrator: refresh the in-process registry into
+ *                   analysis_definitions, find which ones are due, run them,
+ *                   persist the results. Per-analysis errors are isolated
+ *                   via Promise.allSettled so one bad SQL doesn't kill the
+ *                   batch.
+ *
+ * Result shape convention: an Analysis SQL is expected to return a single
+ * row with the columns:
+ *
+ *   status         TEXT  | NULL  -- 'ok' | 'warn' | 'critical' | 'unknown'
+ *   primary_value  REAL  | NULL
+ *   baseline_value REAL  | NULL
+ *   payload        TEXT  | NULL  -- JSON-serialized object, optional
+ *
+ * If `status` is NULL we derive it from the magnitude of delta_pct
+ * (>=25% → critical, >=10% → warn, else ok). delta_pct itself is computed
+ * here from primary/baseline so individual SQL queries don't have to.
+ */
+
+/**
+ * Orchestrator. Refreshes the analysis_definitions registry from the
+ * in-process registry (so newly-derived Tier 1 analyses become visible
+ * to the dashboard within one tick), then runs whatever's due.
+ *
+ * Runs once per project in the `projects` table (falling back to the
+ * `default` project when the table is empty or unreadable), so analyses and
+ * the alert rules bound to them refresh for every tenant, not just the
+ * first one.
+ */
+declare function runAllDueAnalyses(ctx: {
+    env: CollectorEnv;
+    retentionHours: number;
+    logger?: Logger;
+    tracer?: ChildSpanRunner;
+}, _runtime?: unknown): Promise<{
+    ran: number;
+    failed: number;
+    refreshed: number;
+    narrated: number;
+    skipped?: number;
+}>;
+
+/**
+ * Retention for the secondary tables the hourly sweep did not cover. Each
+ * rule is tied to an existing contract rather than a new policy:
+ *
+ *  - `alert_evaluations`: `/internal/alerts/evaluations` accepts at most a
+ *    720-hour window, so rows older than that are unreachable through the API.
+ *  - `ask_evidence_events`: feeds `getTopAskedAnalyses`, whose trailing window
+ *    is 7 days; rows older than 30 days cannot influence it.
+ *  - `metric_series`: identity rows whose points have all expired and that
+ *    were created before the retention window. They hold no data; the next
+ *    ingest of that identity recreates the row.
+ *  - `evidence_retrieval_refs`: rows carry their own `expires_at` (copied from
+ *    the signal they reference); expansions follow their ref.
+ */
+
+interface HousekeepingSummary {
+    alert_evaluations: number;
+    ask_evidence_events: number;
+    metric_series: number;
+    evidence_refs: number;
+    evidence_ref_expansions: number;
+}
+
 interface ServiceMapOptions {
     projectId: string;
     hours: number;
@@ -298,6 +369,18 @@ interface CollectorConfig {
      * a tracing layer at the storage seam.
      */
     sqlDb?: SqlDbFactory;
+    /**
+     * Raw request body cap for `/v1/*` and `/internal/*` in bytes. Defaults
+     * to `MAX_BODY_BYTES` from the environment, then 10 MiB. Oversized
+     * requests get a 413 before any handler buffers the body.
+     */
+    maxBodyBytes?: number;
+    /**
+     * Body cap for the unauthenticated `/auth/*` routes (login/check/logout).
+     * Defaults to 16 KiB and is independent of `maxBodyBytes`, so an anonymous
+     * client can never make the host buffer an ingest-sized body.
+     */
+    maxAuthBodyBytes?: number;
 }
 declare class CollectorRuntime implements CollectorPluginContext {
     private readonly spanProcessors;
@@ -327,30 +410,56 @@ declare const createTelemetryCollectorApp: (pluginsOrConfig: CollectorPlugin[] |
     Bindings: CollectorEnv;
 }>;
 /**
- * Scheduled handler that purges expired telemetry and usage rows.
- * Wire into wrangler.toml: `[triggers] crons = ["0 * * * *"]`
- * Source: AgentOwl + DecisionOps
+ * Runtime-neutral entry point for a background maintenance task.
+ *
+ * `run(env)` does the work and needs nothing but a `CollectorEnv`, so any
+ * host (Cloudflare cron, a Node `setInterval`, a Kubernetes CronJob hitting
+ * a one-shot script) can drive it. `scheduled(event, env, ctx)` is the thin
+ * Cloudflare Workers adapter over `run` — the event and context are accepted
+ * for signature compatibility with `ExportedHandler.scheduled` but are never
+ * consulted, so non-Workers hosts should call `run` directly rather than
+ * fabricating placeholder event objects.
  */
+interface ScheduledTaskHandler<TSummary = void> {
+    run(env: CollectorEnv): Promise<TSummary>;
+    scheduled(event: ScheduledEvent, env: CollectorEnv, ctx: ExecutionContext): Promise<void>;
+}
+/** Per-table purge counts reported by the retention cleanup task. */
+interface RetentionCleanupSummary {
+    spans: number;
+    usage: number;
+    logs: number;
+    ai_calls: number;
+    metric_points: number;
+    analysis_results: number;
+    profile_blobs: number;
+    /** RFC 0010 action spine rows removed (trees older than RETENTION_HOURS). */
+    actions: number;
+    /** Leaf rows removed with their actions: agent_runs, tool_calls,
+     *  retrieval_events, eval_results and artifacts. */
+    action_leaves: number;
+    /** Secondary tables (see lib/housekeeping.ts); zeros when that step failed. */
+    housekeeping: HousekeepingSummary;
+}
 declare const createRetentionCleanupHandler: (options?: {
     logger?: Logger;
-}) => {
-    scheduled(_event: ScheduledEvent, env: CollectorEnv, _ctx: ExecutionContext): Promise<void>;
-};
+}) => ScheduledTaskHandler<RetentionCleanupSummary>;
 /**
  * RFC 0002 Stage 1 — run any due Analyses. Cheap to call frequently because
  * `runAllDueAnalyses` filters by `last_run + refreshSeconds < now` before
  * touching D1.
  *
- * Wire to a per-minute trigger in wrangler.toml: `crons = ["* * * * *"]`.
- * Kept distinct from retention so the per-minute tick doesn't sweep every
- * retention table every cycle.
+ * Wire to a per-minute trigger in wrangler.toml: `crons = ["* * * * *"]`,
+ * or call `.run(env)` from a non-Workers host scheduler. Kept distinct from
+ * retention so the per-minute tick doesn't sweep every retention table every
+ * cycle.
  */
 declare const createAnalysesRunHandler: (options?: {
     logger?: Logger;
     tracer?: ChildSpanRunner;
-}) => {
-    scheduled(_event: ScheduledEvent, env: CollectorEnv, _ctx: ExecutionContext): Promise<void>;
-};
+}) => ScheduledTaskHandler<AnalysesRunSummary | undefined>;
+/** Shape returned by `runAllDueAnalyses` and surfaced via the run handler. */
+type AnalysesRunSummary = Awaited<ReturnType<typeof runAllDueAnalyses>>;
 
 declare const actionRoutesPlugin: CollectorPlugin;
 
@@ -371,15 +480,20 @@ declare const aiReceiverPlugin: CollectorPlugin;
 
 declare const aiSpanPayloadsProcessorPlugin: CollectorPlugin;
 
+/** Resolve a hostname to its addresses (e.g. `dns.lookup(host, { all: true })`). */
+type HostLookup = (hostname: string) => Promise<string[]>;
+
 declare function evaluateAllRules(env: CollectorEnv, options?: {
     logger?: Logger;
     tracer?: ChildSpanRunner;
     concurrency?: number;
     ruleTimeoutMs?: number;
+    hostLookup?: HostLookup;
 }): Promise<{
     evaluated: number;
     fired: number;
     resolved: number;
+    redelivered: number;
 }>;
 /**
  * Scheduled handler suitable for wrangler cron triggers. Dispatches on the
@@ -666,18 +780,61 @@ declare const usersQueryRoutesPlugin: CollectorPlugin;
 declare const utmEnrichmentPlugin: CollectorPlugin;
 
 /**
- * Creates auth routes and middleware for dashboard password login.
+ * Fixed-window failure limiter for `POST /auth/login`. Only failed attempts
+ * count; a successful login clears the client's bucket. State is in-memory,
+ * so on Cloudflare Workers it is per isolate and on Node per process — it
+ * slows a single-origin brute force without any shared storage, and it can
+ * never lock an operator out for longer than one window.
+ */
+interface LoginRateLimitOptions {
+    /** Failed attempts allowed per window before 429. Default 10. */
+    maxFailures?: number;
+    /** Window length in milliseconds. Default 15 minutes. */
+    windowMs?: number;
+    /** Upper bound on tracked clients; the oldest bucket is evicted past it. */
+    maxClients?: number;
+    /** Clock override for tests. */
+    now?: () => number;
+}
+
+interface DashboardAuthConfig {
+    password?: string;
+    token?: string;
+    /**
+     * Failed-login limiter for POST /auth/login (see login-rate-limit.ts).
+     * Pass `false` to disable; defaults to 10 failures per 15 minutes.
+     * `clientAddress` lets the host supply the connection's peer address;
+     * `trustProxyHeaders` honours forwarding headers from a trusted proxy.
+     * Without either, Workers use the edge-set client IP and every other
+     * runtime has no trustworthy identity: limiting is then skipped (never a
+     * shared bucket, which would let one client lock everyone out) and a
+     * warning is logged once via `warn` (default `console.warn`).
+     */
+    loginRateLimit?: (LoginRateLimitOptions & {
+        clientAddress?: (c: Context<{
+            Bindings: CollectorEnv;
+        }>) => string | undefined;
+        trustProxyHeaders?: boolean;
+        /** Sink for the one-time "limiter inactive" warning. */
+        warn?: (message: string) => void;
+    }) | false;
+}
+/**
+ * Creates auth routes and middleware for dashboard password login and
+ * programmatic read/admin bearer token authentication.
  *
  * Routes added:
  *   POST /auth/login  — accepts { password }, sets session cookie
- *   GET  /auth/check  — returns { authenticated: true/false }
+ *   GET  /auth/check  — returns { authenticated: true/false } (supports cookie and Bearer token)
  *   POST /auth/logout — clears session cookie
  *
- * The returned middleware validates the session cookie on protected routes.
+ * The returned middleware validates either:
+ *   1. Authorization: Bearer <token> (programmatic read/admin token for MCP/API)
+ *   2. obs_session cookie (human dashboard user session)
+ *
+ * Ingest keys are rejected on dashboard/internal routes — they are write-only.
  */
-declare function createDashboardAuth(config: {
-    password: string;
-}): {
+declare function createDashboardAuth(config?: DashboardAuthConfig): {
     middleware: MiddlewareHandler<{
         Bindings: CollectorEnv;
         Variables: {
@@ -718,6 +875,107 @@ declare class TailHub {
     private broadcast;
 }
 
+/**
+ * Retention for the RFC 0010 action graph (`actions` spine plus the
+ * `agent_runs`, `tool_calls`, `retrieval_events`, `eval_results` and
+ * `artifacts` leaves).
+ *
+ * Unlike the telemetry tables these rows carry no `expires_at`; the sweep
+ * derives expiry from `actions.started_at` and the configured
+ * `RETENTION_HOURS`. The unit of deletion is the causal tree
+ * (`project_id`, `root_action_id`): a tree is selected, rechecked and
+ * removed as a whole inside one `SqlDb.batch` (a D1 batch or a Postgres
+ * transaction), never action by action. A tree is kept whole while any of
+ * its actions:
+ *
+ *   - started inside the retention window,
+ *   - is still in progress (`ended_at IS NULL`),
+ *   - belongs to an `agent_runs` row whose `status` is `running`,
+ *   - is referenced by an `eval_cases` row in the same project via
+ *     `source_action_id`, `source_agent_run_id`, or (through a `tool_calls`
+ *     row) `source_tool_call_id`.
+ *
+ * Work is bounded per invocation: each batch packs whole trees up to
+ * `maxActionsPerBatch` actions and `maxTreesPerBatch` trees, and the sweep
+ * stops after `maxBatches`. A tree with more than `maxActionsPerBatch`
+ * actions can never be deleted atomically within those bounds, so it is
+ * retained intact and reported as `oversized_trees` (and logged by the
+ * handler) instead of being deleted in pieces. Raise `maxActionsPerBatch`
+ * to reclaim such trees.
+ *
+ * Concurrency: every DELETE repeats the eligibility predicate, so a tree
+ * that gained a fresh or unfinished action, a `running` run, or an eval
+ * case between selection and deletion is left alone. On D1 the batch is a
+ * single serialized SQLite transaction, so that recheck is airtight. On
+ * Postgres (READ COMMITTED) each statement sees writes committed before it
+ * started, so a commit landing between the leaf deletes and the final spine
+ * delete of the same tree could leave that tree's spine without its leaves.
+ * That needs an ingest for a tree whose newest action is already older than
+ * the retention window, inside a sub-second window; it is documented rather
+ * than locked against because `SqlDb` has no row-locking primitive.
+ *
+ * Intentionally **not** deleted here:
+ *
+ *   - `artifacts.storage_ref` blobs — only the metadata row goes; the blob
+ *     store is not consulted (the collector never wrote those blobs).
+ *   - `agent_runs` rows whose `id` is not an action in the tree — nothing
+ *     proves when they started.
+ *   - `ai_span_payloads.action_id` and `evidence_retrieval_refs` anchors —
+ *     those tables have their own `expires_at` retention.
+ *   - `eval_cases`, `eval_runs`, `eval_case_results` — curated fixtures,
+ *     never retention-bound.
+ */
+
+interface ActionGraphRetentionOptions {
+    /** Retention window; trees whose newest action is older than this expire. */
+    retentionHours: number;
+    /** Clock override for tests. Defaults to `Date.now`. */
+    now?: () => number;
+    /**
+     * Upper bound on actions deleted per batch/transaction. Also the largest
+     * tree the sweep will delete; bigger trees are retained and reported.
+     * Defaults to 500.
+     */
+    maxActionsPerBatch?: number;
+    /** Upper bound on trees per batch (bounds statements per transaction). Defaults to 25. */
+    maxTreesPerBatch?: number;
+    /** Upper bound on batches per invocation. Defaults to 10. */
+    maxBatches?: number;
+}
+/** Per-table delete counts for one `purgeExpiredActionGraph` call. */
+interface ActionGraphPurgeSummary {
+    actions: number;
+    agent_runs: number;
+    tool_calls: number;
+    retrieval_events: number;
+    eval_results: number;
+    artifacts: number;
+    /** Whole trees deleted. */
+    trees: number;
+    /** Batches (transactions) executed. */
+    batches: number;
+    /** `true` when `maxBatches` was hit while deletable trees remained. */
+    truncated: boolean;
+    /**
+     * Expired, otherwise eligible trees retained because they hold more than
+     * `maxActionsPerBatch` actions. Capped at `OVERSIZED_REPORT_LIMIT`.
+     */
+    oversized_trees: number;
+    /** Identities of the reported oversized trees, for operators. */
+    oversized: Array<{
+        project_id: string;
+        root_action_id: string;
+        actions: number;
+    }>;
+}
+/** Cutoff as the same ISO text shape the collector writes to `started_at`. */
+declare const actionRetentionCutoff: (retentionHours: number, nowMs?: number) => string;
+/**
+ * Purge expired action trees. Safe to call repeatedly: a second call right
+ * after the first finds no deletable trees and changes nothing.
+ */
+declare function purgeExpiredActionGraph(db: SqlDb, options: ActionGraphRetentionOptions): Promise<ActionGraphPurgeSummary>;
+
 type ActionRecord = Omit<ActionRef, "projectId"> & {
     projectId: string;
 };
@@ -756,10 +1014,15 @@ declare class ActionStore {
     listArtifactsByAction(projectId: string, actionId: string, limit?: number): Promise<ArtifactRef[]>;
 }
 
+interface AlertsStoreOptions {
+    /** Permit webhook targets on loopback / private / link-local hosts. */
+    allowPrivateWebhookTargets?: boolean;
+}
 declare function compareValue(value: number, threshold: number, comparison: AlertComparison): boolean;
 declare class AlertsStore {
     private readonly db;
-    constructor(db: SqlDb);
+    private readonly options;
+    constructor(db: SqlDb, options?: AlertsStoreOptions);
     validateInput(input: AlertRuleInput): void;
     listRules(projectId: string): Promise<AlertRule[]>;
     getRule(id: string, projectId: string): Promise<AlertRule | null>;
@@ -767,8 +1030,24 @@ declare class AlertsStore {
     updateRule(id: string, projectId: string, patch: Partial<AlertRuleInput>): Promise<AlertRule | null>;
     deleteRule(id: string, projectId: string): Promise<boolean>;
     listEnabledRules(): Promise<AlertRule[]>;
-    getState(ruleId: string): Promise<AlertStateRow | null>;
+    getState(ruleId: string, projectId: string): Promise<AlertStateRow | null>;
+    /**
+     * Record a state transition with its notification still outstanding
+     * (`notified = 0`); `markNotified` flips it once a channel accepts the
+     * alert. On a database that has not applied migration 049 the column is
+     * missing: the transition is still written (legacy statement) so alerting
+     * keeps working through a rolling deploy, and the evaluator treats a row
+     * without the column as delivered.
+     */
     transitionState(ruleId: string, projectId: string, newState: AlertState, now: string): Promise<void>;
+    /**
+     * Mark the transition `(state, lastStateChange)` as delivered. Scoped to
+     * the exact transition the caller notified for: if the rule changed state
+     * again while the webhook was in flight, the newer transition keeps its
+     * own outstanding flag. Returns false when nothing matched (stale or
+     * already marked). On a pre-049 schema there is nothing to mark.
+     */
+    markNotified(ruleId: string, projectId: string, state: AlertState, lastStateChange: string): Promise<boolean>;
     recordEvaluation(ruleId: string, projectId: string, value: number, state: AlertState, notified: boolean): Promise<void>;
     listEvaluations(params: {
         ruleId: string;
@@ -801,7 +1080,7 @@ declare class AlertsStore {
  *  - `R2BlobStore` — Cloudflare R2 binding (default on Workers).
  *  - `S3BlobStore` (sibling file) — AWS S3 / MinIO / any S3-compatible.
  *
- * Replay chunks live under `replays/<session_id>/<chunk_id>`; pprof
+ * Replay chunks live under `replays/<project_id>/<session_id>/<chunk_id>`; pprof
  * profiles live under `profiles/<service>/<trace_id>/<span_id>`. The
  * adapter never sees these paths — they're constructed by the callers
  * (`replay-receiver`, `profile-routes`).
@@ -1152,7 +1431,7 @@ declare class ProjectsStore {
     ensureDefaultProject(): Promise<void>;
     listKeys(projectId: string): Promise<IngestKey[]>;
     createKey(projectId: string, name: string): Promise<IngestKeyWithPlaintext>;
-    revokeKey(keyId: string): Promise<boolean>;
+    revokeKey(keyId: string, projectId: string): Promise<boolean>;
     findByKeyHash(keyHash: string): Promise<{
         projectId: string;
         keyId: string;
@@ -1184,6 +1463,23 @@ declare class PostgresAdapter implements SqlDb {
         };
     }>>;
 }
+/**
+ * Install `pg` result-type parsers so Postgres rows match the shape D1
+ * returns and the shared stores keep working unchanged:
+ *
+ *  - BOOLEAN  → 0 / 1       (D1 stores flags as INTEGER; stores compare `=== 1`)
+ *  - BIGINT   → number      (`COUNT(*)`, `SUM(bigint)` would otherwise be strings;
+ *                            integral values above MAX_SAFE_INTEGER throw)
+ *  - NUMERIC  → number      (`SUM`, `EXTRACT(EPOCH …)`; same overflow rule)
+ *  - JSON/JSONB → raw text  (stores `JSON.parse` the column themselves)
+ *
+ * Call once per process before issuing queries, e.g.
+ * `configurePostgresTypeParsers(pg.types)` in the Node entrypoint.
+ */
+interface PostgresTypeParserRegistry {
+    setTypeParser(oid: number, parser: (value: string) => unknown): void;
+}
+declare const configurePostgresTypeParsers: (types: PostgresTypeParserRegistry) => void;
 
 /** All built-in plugins in recommended registration order */
 declare const allPlugins: CollectorPlugin[];
@@ -1194,4 +1490,4 @@ declare const _default: hono.Hono<{
     Bindings: CollectorEnv;
 }, hono_types.BlankSchema, "/">;
 
-export { type ActionRecord, ActionStore, type AgentRunRecord, AlertsStore, type ArtifactRecord, type BlobListOptions, type BlobListResult, type BlobObject, type BlobPutOptions, type BlobStore, BlobStoreToR2Adapter, type CollectorAuthConfig, type CollectorConfig, CollectorEnv, type CollectorPlugin, CollectorRouteContext, CollectorRuntime, D1Adapter, type EvalCase, type EvalCaseInput, type EvalCaseListOptions, type EvalCaseSourceLinks, EvalCaseSourceNotFoundError, type EvalCaseSourceType, EvalCasesStore, type EvalResultRecord, type EvalRun, type EvalRunCandidate, type EvalRunInput, type EvalRunSourceCase, type EvalRunStatus, type EvalRunsListOptions, Logger, MetricsStore, PostgresAdapter, type PostgresAdapterOptions, ProjectsStore, R2BlobStore, type RetrievalEventRecord, S3BlobStore, type S3BlobStoreOptions, type SpanProcessorPlugin, type SqlDb, type SqlDbFactory, type SqlStatement, type TailEvent, TailHub, type TailKind, type ToolCallRecord, type UsageEventProcessorPlugin, actionRoutesPlugin, aiReceiverPlugin, aiSpanPayloadsProcessorPlugin, alertsRoutesPlugin, allPlugins, analysesRoutesPlugin, askRoutesPlugin, botFilterPlugin, compareValue, connectedRoutesPlugin, createAlertEvaluatorHandler, createAnalysesRunHandler, createDashboardAuth, createDefaultCollectorApp, createRetentionCleanupHandler, createTelemetryCollectorApp, dashboardRoutesPlugin, _default as default, defaultSpanEnrichmentPlugin, evalCasesRoutesPlugin, evaluateAllRules, evidenceRetrievalRoutesPlugin, genAiNormalizerPlugin, identityReceiverPlugin, isEvalCaseSourceType, isEvalRunStatus, issueEnrichmentPlugin, issueInsightsPlugin, logsReceiverPlugin, metricsReceiverPlugin, onboardingRoutesPlugin, otlpReceiverPlugin, platformRoutesPlugin, profileRoutesPlugin, projectsRoutesPlugin, queryRoutesPlugin, redactionProcessorPlugin, replayQueryRoutesPlugin, replayReceiverPlugin, tailRoutesPlugin, timelineRoutesPlugin, uaEnrichmentPlugin, usageNormalizationPlugin, usagePrivacyPlugin, usageQueryRoutesPlugin, usageReceiverPlugin, usersQueryRoutesPlugin, utmEnrichmentPlugin };
+export { type ActionGraphPurgeSummary, type ActionGraphRetentionOptions, type ActionRecord, ActionStore, type AgentRunRecord, AlertsStore, type AnalysesRunSummary, type ArtifactRecord, type BlobListOptions, type BlobListResult, type BlobObject, type BlobPutOptions, type BlobStore, BlobStoreToR2Adapter, type CollectorAuthConfig, type CollectorConfig, CollectorEnv, type CollectorPlugin, CollectorRouteContext, CollectorRuntime, D1Adapter, type DashboardAuthConfig, type EvalCase, type EvalCaseInput, type EvalCaseListOptions, type EvalCaseSourceLinks, EvalCaseSourceNotFoundError, type EvalCaseSourceType, EvalCasesStore, type EvalResultRecord, type EvalRun, type EvalRunCandidate, type EvalRunInput, type EvalRunSourceCase, type EvalRunStatus, type EvalRunsListOptions, type HostLookup, Logger, MetricsStore, PostgresAdapter, type PostgresAdapterOptions, type PostgresTypeParserRegistry, ProjectsStore, R2BlobStore, type RetentionCleanupSummary, type RetrievalEventRecord, S3BlobStore, type S3BlobStoreOptions, type ScheduledTaskHandler, type SpanProcessorPlugin, type SqlDb, type SqlDbFactory, type SqlStatement, type TailEvent, TailHub, type TailKind, type ToolCallRecord, type UsageEventProcessorPlugin, actionRetentionCutoff, actionRoutesPlugin, aiReceiverPlugin, aiSpanPayloadsProcessorPlugin, alertsRoutesPlugin, allPlugins, analysesRoutesPlugin, askRoutesPlugin, botFilterPlugin, compareValue, configurePostgresTypeParsers, connectedRoutesPlugin, createAlertEvaluatorHandler, createAnalysesRunHandler, createDashboardAuth, createDefaultCollectorApp, createRetentionCleanupHandler, createTelemetryCollectorApp, dashboardRoutesPlugin, _default as default, defaultSpanEnrichmentPlugin, evalCasesRoutesPlugin, evaluateAllRules, evidenceRetrievalRoutesPlugin, genAiNormalizerPlugin, identityReceiverPlugin, isEvalCaseSourceType, isEvalRunStatus, issueEnrichmentPlugin, issueInsightsPlugin, logsReceiverPlugin, metricsReceiverPlugin, onboardingRoutesPlugin, otlpReceiverPlugin, platformRoutesPlugin, profileRoutesPlugin, projectsRoutesPlugin, purgeExpiredActionGraph, queryRoutesPlugin, redactionProcessorPlugin, replayQueryRoutesPlugin, replayReceiverPlugin, tailRoutesPlugin, timelineRoutesPlugin, uaEnrichmentPlugin, usageNormalizationPlugin, usagePrivacyPlugin, usageQueryRoutesPlugin, usageReceiverPlugin, usersQueryRoutesPlugin, utmEnrichmentPlugin };