@obsunified/collector 2.0.1 → 2.2.0

package/src/plugins/eval-cases-routes.ts

@@ -19,6 +19,7 @@ import { sourceLinkEvidenceReferences } from "../lib/evidence-references";
 import { randomHex } from "../lib/hash";
 import { sqlDbFor } from "../lib/sql-db";
 import { getProjectId } from "./_context";
+import { readJsonObject } from "./_json";
 
 interface EvalCaseRequestBody {
 	sourceEntityType?: unknown;
@@ -49,6 +50,8 @@ interface EvalCaseResultResponse {
 	passed: boolean;
 	score: number | null;
 	actualOutcome: string | null;
+	inputPayloadHash: string | null;
+	failureFingerprint: string | null;
 	details: unknown;
 	createdAt: string;
 	evidenceReferences?: EvidenceReference[];
@@ -61,6 +64,12 @@ interface EvalRunRequestBody {
 	evalCaseId?: unknown;
 	status?: unknown;
 	candidate?: unknown;
+	environment?: unknown;
+	serviceVersion?: unknown;
+	commitSha?: unknown;
+	configDigest?: unknown;
+	inputPayloadHash?: unknown;
+	failureFingerprint?: unknown;
 	startedAt?: unknown;
 	endedAt?: unknown;
 	totalCount?: unknown;
@@ -123,12 +132,8 @@ export const evalCasesRoutesPlugin: CollectorPlugin = {
 	name: "eval-cases-routes",
 	register(app) {
 		app.post("/internal/eval-cases", async (c) => {
-			let body: EvalCaseRequestBody;
-			try {
-				body = (await c.req.json()) as EvalCaseRequestBody;
-			} catch {
-				return c.json(badRequest("body must be JSON"), 400);
-			}
+			const body = await readJsonObject<EvalCaseRequestBody>(c);
+			if (!body) return c.json(badRequest("body must be a JSON object"), 400);
 
 			const sourceType = body.sourceEntityType ?? body.source?.type;
 			if (!isEvalCaseSourceType(sourceType)) {
@@ -236,12 +241,8 @@ export const evalCasesRoutesPlugin: CollectorPlugin = {
 		});
 
 		app.post("/internal/eval-runs", async (c) => {
-			let body: EvalRunRequestBody;
-			try {
-				body = (await c.req.json()) as EvalRunRequestBody;
-			} catch {
-				return c.json(badRequest("body must be JSON"), 400);
-			}
+			const body = await readJsonObject<EvalRunRequestBody>(c);
+			if (!body) return c.json(badRequest("body must be a JSON object"), 400);
 
 			const id = asOptionalString(body.id ?? body.runId)?.trim();
 			if ((body.id ?? body.runId) !== undefined && !id) {
@@ -301,6 +302,20 @@ export const evalCasesRoutesPlugin: CollectorPlugin = {
 				id: id ?? undefined,
 				evalCaseId,
 				status,
+				environment:
+					asOptionalString(body.environment) ??
+					asOptionalString(candidate.environment),
+				serviceVersion:
+					asOptionalString(body.serviceVersion) ??
+					asOptionalString(candidate.serviceVersion),
+				commitSha:
+					asOptionalString(body.commitSha) ??
+					asOptionalString(candidate.commitSha),
+				configDigest:
+					asOptionalString(body.configDigest) ??
+					asOptionalString(candidate.configDigest),
+				inputPayloadHash: asOptionalString(body.inputPayloadHash),
+				failureFingerprint: asOptionalString(body.failureFingerprint),
 				candidate: {
 					agentId: asOptionalString(candidate.agentId),
 					agentVersion: asOptionalString(candidate.agentVersion),
@@ -309,6 +324,18 @@ export const evalCasesRoutesPlugin: CollectorPlugin = {
 					modelProvider: asOptionalString(candidate.modelProvider),
 					model: asOptionalString(candidate.model),
 					modelVersion: asOptionalString(candidate.modelVersion),
+					environment:
+						asOptionalString(candidate.environment) ??
+						asOptionalString(body.environment),
+					serviceVersion:
+						asOptionalString(candidate.serviceVersion) ??
+						asOptionalString(body.serviceVersion),
+					commitSha:
+						asOptionalString(candidate.commitSha) ??
+						asOptionalString(body.commitSha),
+					configDigest:
+						asOptionalString(candidate.configDigest) ??
+						asOptionalString(body.configDigest),
 				},
 				startedAt: asOptionalString(body.startedAt),
 				endedAt: asOptionalString(body.endedAt),
@@ -376,13 +403,13 @@ export const evalCasesRoutesPlugin: CollectorPlugin = {
 				passed?: unknown;
 				score?: unknown;
 				actualOutcome?: unknown;
+				inputPayloadHash?: unknown;
+				failureFingerprint?: unknown;
 				details?: unknown;
 			};
-			try {
-				body = (await c.req.json()) as typeof body;
-			} catch {
-				return c.json(badRequest("body must be JSON"), 400);
-			}
+			const parsed = await readJsonObject<typeof body>(c);
+			if (!parsed) return c.json(badRequest("body must be a JSON object"), 400);
+			body = parsed;
 
 			if (body.passed === undefined || typeof body.passed !== "boolean") {
 				return c.json(badRequest("passed must be a boolean"), 400);
@@ -420,6 +447,16 @@ export const evalCasesRoutesPlugin: CollectorPlugin = {
 					: null;
 			const actualOutcome =
 				typeof body.actualOutcome === "string" ? body.actualOutcome : null;
+			const inputPayloadHash =
+				typeof body.inputPayloadHash === "string" &&
+				body.inputPayloadHash.trim()
+					? body.inputPayloadHash.trim()
+					: null;
+			const failureFingerprint =
+				typeof body.failureFingerprint === "string" &&
+				body.failureFingerprint.trim()
+					? body.failureFingerprint.trim()
+					: null;
 			const details_json =
 				body.details === undefined ? null : JSON.stringify(body.details);
 			const now = new Date().toISOString();
@@ -427,8 +464,9 @@ export const evalCasesRoutesPlugin: CollectorPlugin = {
 			await db
 				.prepare(
 					`INSERT INTO eval_case_results (
-					id, project_id, eval_case_id, run_id, passed, score, actual_outcome, details_json, created_at
-				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?)`,
+					id, project_id, eval_case_id, run_id, passed, score, actual_outcome,
+					input_payload_hash, failure_fingerprint, details_json, created_at
+				) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`,
 				)
 				.bind(
 					id,
@@ -438,6 +476,8 @@ export const evalCasesRoutesPlugin: CollectorPlugin = {
 					passed,
 					score,
 					actualOutcome,
+					inputPayloadHash,
+					failureFingerprint,
 					details_json,
 					now,
 				)
@@ -455,6 +495,8 @@ export const evalCasesRoutesPlugin: CollectorPlugin = {
 				passed: body.passed,
 				score,
 				actualOutcome,
+				inputPayloadHash,
+				failureFingerprint,
 				details: body.details ?? null,
 				createdAt: now,
 				evidenceReferences: evalCaseResultEvidenceReferences(evalCase, id),
@@ -491,6 +533,8 @@ export const evalCasesRoutesPlugin: CollectorPlugin = {
 					passed: number;
 					score: number | null;
 					actual_outcome: string | null;
+					input_payload_hash?: string | null;
+					failure_fingerprint?: string | null;
 					details_json: string | null;
 					created_at: string;
 				}>();
@@ -513,6 +557,8 @@ export const evalCasesRoutesPlugin: CollectorPlugin = {
 					passed: row.passed === 1,
 					score: row.score,
 					actualOutcome: row.actual_outcome,
+					inputPayloadHash: row.input_payload_hash ?? null,
+					failureFingerprint: row.failure_fingerprint ?? null,
 					details: parseJsonMaybe(row.details_json),
 					createdAt: row.created_at,
 					evidenceReferences: evalCaseResultEvidenceReferences(

package/src/plugins/evidence-retrieval-routes.ts

@@ -12,6 +12,13 @@ import type {
 	TelemetryTraceDetailResponse,
 } from "@obsunified/types";
 import type { CollectorPlugin } from "../framework/collector";
+import {
+	computeChangeBlastRadius,
+	listChangeEvents,
+} from "../lib/autosre-change-correlation";
+import { searchInvestigationFindings } from "../lib/autosre-findings";
+import { loadTraceFaultLocusFromDb } from "../lib/autosre-ontology";
+import { getIncidentInvestigation } from "../lib/autosre-remediation-gate";
 import type {
 	ActionRef,
 	EntityManifestExtended,
@@ -75,7 +82,7 @@ interface ReplayEvidenceRow {
 
 interface AICallEvidenceRow {
 	call_id: string;
-	trace_id: string | null;
+	trace_id: string;
 	span_id?: string | null;
 	service_name?: string | null;
 	model_name: string;
@@ -105,6 +112,7 @@ const DEFAULT_PROFILE_FRAME_LIMIT = 50;
 const MAX_PROFILE_FRAME_LIMIT = 200;
 const EVIDENCE_INTENTS = new Set<EvidenceBundleIntent>([
 	"debug_failure",
+	"triage_incident",
 	"explain_latency",
 	"explain_cost",
 	"inspect_agent_run",
@@ -1460,6 +1468,187 @@ const buildActionGraphBundle = (
 	return bundle;
 };
 
+const attachAutoSreTriageContext = async (
+	db: SqlDb,
+	projectId: string,
+	traceId: string | null,
+	bundle: EvidenceBundle,
+): Promise<EvidenceBundle> => {
+	try {
+		const faultLocus = traceId
+			? await loadTraceFaultLocusFromDb(db, projectId, traceId)
+			: null;
+		const environment = (
+			faultLocus?.faultLocusSpan?.environment ??
+			bundle.environment ??
+			"default"
+		).toLowerCase();
+		const recentChanges = await listChangeEvents(db, {
+			projectId,
+			environment,
+			limit: 5,
+		});
+		const blastRadii = (
+			await Promise.all(
+				recentChanges
+					.slice(0, 3)
+					.map((ch) =>
+						computeChangeBlastRadius(db, projectId, ch.id, { environment }),
+					),
+			)
+		).filter((br): br is NonNullable<typeof br> => Boolean(br));
+
+		const candidateChanges = blastRadii.map((br) => ({
+			changeId: br.change.id,
+			kind: br.change.kind,
+			version: br.change.version,
+			previousVersion: br.change.previousVersion,
+			occurredAt: br.change.occurredAt,
+			cohortVerdict: br.cohortVerdict,
+			causalProofTier: br.causalProofTier,
+			rateNew: br.newCohort.errorRate,
+			rateOld: br.oldCohort.errorRate,
+			sampleNew: br.newCohort.requestCount,
+			sampleOld: br.oldCohort.requestCount,
+			overlappingCodePaths: br.overlappingCodePaths,
+		}));
+		const contentionCandidates = blastRadii
+			.flatMap((br) => br.sharedResourceAggressors)
+			.map((ag) => ({
+				aggressorTraceId: ag.aggressorTraceId,
+				aggressorSpanId: ag.aggressorSpanId,
+				aggressorServiceName: ag.aggressorServiceName,
+				sharedTargetNodeId: ag.sharedTargetNodeId,
+				relationshipCertainty: ag.relationshipCertainty,
+				totalResourceTimeMs: ag.totalResourceTimeMs,
+			}));
+		let priorFindingsList = await searchInvestigationFindings(db, {
+			projectId,
+			environment,
+			rootCauseEntityId:
+				faultLocus?.faultLocusNodeId ??
+				faultLocus?.faultLocusSpan?.span_id ??
+				undefined,
+			limit: 5,
+		});
+		if (priorFindingsList.length === 0 && faultLocus?.faultLocusSpan?.span_id) {
+			priorFindingsList = await searchInvestigationFindings(db, {
+				projectId,
+				environment,
+				rootCauseEntityId: faultLocus.faultLocusSpan.span_id,
+				limit: 5,
+			});
+		}
+		if (priorFindingsList.length === 0) {
+			priorFindingsList = await searchInvestigationFindings(db, {
+				projectId,
+				environment,
+				limit: 5,
+			});
+		}
+		const priorFindings = priorFindingsList.map((f) => ({
+			findingId: f.id,
+			title: f.title,
+			causalProofTier: f.causalProofTier,
+			causalVerificationStatus: f.causalVerificationStatus,
+			recoveryStatus: f.recoveryStatus,
+			contributingChangeId: f.contributingChangeId,
+			occurredAt: f.createdAt,
+		}));
+
+		for (const br of blastRadii) {
+			const changeId = br.change.id;
+			const changeRoute = `#/changes/${encodeURIComponent(changeId)}`;
+			bundle.evidenceReferences.push({
+				evidenceId: `change:${changeId}`,
+				entityKind: "change",
+				entityId: changeId,
+				route: changeRoute,
+				source: br.overlappingCodePaths.length
+					? "stack_frame_overlap"
+					: "cohort_comparison",
+				confidence:
+					br.cohortVerdict === "isolated_to_new_version" ? 0.9 : 0.65,
+				relationshipCertainty: br.relationshipCertainty,
+				causalProofTier: br.causalProofTier,
+				reason: br.summary,
+				citations: [
+					{
+						label: `change ${changeId} (${br.change.version ?? br.change.kind})`,
+						entityKind: "change",
+						entityId: changeId,
+						route: changeRoute,
+					},
+				],
+				suggestedNextPivots: [
+					{
+						label: "Inspect change blast radius",
+						entityKind: "change",
+						entityId: changeId,
+						route: changeRoute,
+						reason: "Inspect traffic-normalized cohort lift and contention.",
+					},
+				],
+			});
+		}
+
+		for (const finding of priorFindingsList) {
+			const findingRoute = `#/findings/${encodeURIComponent(finding.id)}`;
+			bundle.evidenceReferences.push({
+				evidenceId: `finding:${finding.id}`,
+				entityKind: "finding",
+				entityId: finding.id,
+				route: findingRoute,
+				source: "incident_memory_fingerprint",
+				confidence: finding.confidence,
+				relationshipCertainty: "exact",
+				causalProofTier: finding.causalProofTier,
+				reason: `Prior finding (${finding.causalProofTier}): ${finding.title}`,
+				citations: [
+					{
+						label: finding.title,
+						entityKind: "finding",
+						entityId: finding.id,
+						route: findingRoute,
+					},
+				],
+				suggestedNextPivots: [
+					{
+						label: "Open prior finding",
+						entityKind: "finding",
+						entityId: finding.id,
+						route: findingRoute,
+						reason: "Search incident memory for similar recurring findings.",
+					},
+				],
+			});
+		}
+
+		bundle.autosre = {
+			faultLocus: faultLocus?.faultLocusNodeId
+				? {
+						nodeId: faultLocus.faultLocusNodeId,
+						spanId: faultLocus.faultLocusSpan?.span_id,
+						relationshipCertainty: faultLocus.relationshipCertainty,
+						isBlackoutSuspected: false,
+					}
+				: undefined,
+			candidateChanges,
+			contentionCandidates,
+			priorFindings,
+		};
+		if (bundle.budget) {
+			bundle.budget = {
+				...bundle.budget,
+				estimatedTokens: estimateTokens(bundle),
+			};
+		}
+	} catch {
+		// Gracefully degrade if AutoSRE tables are absent in minimal test setups
+	}
+	return bundle;
+};
+
 const parseBundleRequest = async (request: Request) => {
 	try {
 		const body = await request.json();
@@ -1550,7 +1739,7 @@ export const evidenceRetrievalRoutesPlugin: CollectorPlugin = {
 							all.findIndex((candidate) => candidate.id === profile.id) ===
 							index,
 					);
-				const bundle = buildActionGraphBundle(
+				let bundle = buildActionGraphBundle(
 					projectId,
 					anchor.entityKind,
 					anchor.entityId,
@@ -1560,15 +1749,114 @@ export const evidenceRetrievalRoutesPlugin: CollectorPlugin = {
 					targetTokens,
 					detailLevel,
 				);
+				if (intent === "triage_incident") {
+					bundle = await attachAutoSreTriageContext(
+						db,
+						projectId,
+						traceIds[0] ?? null,
+						bundle,
+					);
+				}
 				return c.json(await materializeBundle(db, projectId, bundle));
 			}
 
+			if (anchor.entityKind === "incident") {
+				const incident = await getIncidentInvestigation(
+					db,
+					projectId,
+					anchor.entityId,
+				);
+				if (!incident) {
+					return c.json(
+						{ error: "Not Found", message: "Incident not found" },
+						404,
+					);
+				}
+				const recentErrSpan = await db
+					.prepare(
+						`SELECT trace_id FROM telemetry_spans
+						 WHERE project_id = ? AND environment = ? AND status_code = 2
+						 ORDER BY start_time DESC LIMIT 1`,
+					)
+					.bind(projectId, incident.environment)
+					.first<{ trace_id: string }>();
+
+				const incRoute = `#/incidents/${encodeURIComponent(incident.id)}`;
+				const baseBundle: EvidenceBundle = {
+					schemaVersion: BUNDLE_SCHEMA_VERSION,
+					intent,
+					environment: incident.environment,
+					incidentId: incident.id,
+					symptomFingerprint: incident.symptomFingerprint ?? undefined,
+					anchor: { entityKind: "incident", entityId: incident.id },
+					budget: { targetTokens, detailLevel },
+					summary: `Incident ${incident.id} (${incident.status}) on ${incident.targetNodeId} in environment ${incident.environment}.`,
+					derivedSummaries: [
+						{
+							title: `Incident ${incident.id}`,
+							reason: `Trigger ${incident.symptomAnchorKind}:${incident.symptomAnchorId} on ${incident.targetNodeId} (status=${incident.status}).`,
+							confidence: 1.0,
+							evidenceIds: [`incident:${incident.id}`],
+							retrievalRefIds: [],
+						},
+					],
+					findings: [],
+					compactions: [],
+					evidenceReferences: [
+						{
+							evidenceId: `incident:${incident.id}`,
+							entityKind: "incident",
+							entityId: incident.id,
+							route: incRoute,
+							source: "incident_investigations",
+							confidence: 1.0,
+							relationshipCertainty: "exact",
+							reason: `Incident triggered by ${incident.symptomAnchorKind}:${incident.symptomAnchorId}.`,
+							citations: [
+								{
+									label: incident.targetNodeId,
+									entityKind: "incident",
+									entityId: incident.id,
+									route: incRoute,
+								},
+							],
+							suggestedNextPivots: [
+								{
+									label: "Open incident",
+									entityKind: "incident",
+									entityId: incident.id,
+									route: incRoute,
+									reason: "Inspect incident investigation and candidate changes.",
+								},
+							],
+						},
+					],
+					retrievalRefs: [],
+					suggestedNextPivots: [
+						{
+							label: "Open incident",
+							entityKind: "incident",
+							entityId: incident.id,
+							route: incRoute,
+							reason: "Inspect incident investigation and candidate changes.",
+						},
+					],
+				};
+				const enriched = await attachAutoSreTriageContext(
+					db,
+					projectId,
+					recentErrSpan?.trace_id ?? null,
+					baseBundle,
+				);
+				return c.json(await materializeBundle(db, projectId, enriched));
+			}
+
 			if (anchor.entityKind !== "trace") {
 				return c.json(
 					{
 						error: "Bad Request",
 						message:
-							"Supported evidence bundle anchors are trace, action, agent_run, and tool_call.",
+							"Supported evidence bundle anchors are trace, action, agent_run, tool_call, and incident.",
 					},
 					400,
 				);
@@ -1588,7 +1876,7 @@ export const evidenceRetrievalRoutesPlugin: CollectorPlugin = {
 				limit: MAX_LOGS_FOR_BUNDLE,
 			});
 			const profiles = await profilesForTrace(db, projectId, traceId);
-			const bundle = await buildTraceBundle(
+			let bundle = await buildTraceBundle(
 				projectId,
 				detail,
 				logs.logs,
@@ -1598,6 +1886,14 @@ export const evidenceRetrievalRoutesPlugin: CollectorPlugin = {
 				detailLevel,
 				hours,
 			);
+			if (intent === "triage_incident" || intent === "debug_failure") {
+				bundle = await attachAutoSreTriageContext(
+					db,
+					projectId,
+					traceId,
+					bundle,
+				);
+			}
 			return c.json(await materializeBundle(db, projectId, bundle));
 		});
 

package/src/plugins/identity-receiver.ts

@@ -2,18 +2,15 @@ import type { IdentifyInput } from "@obsunified/types";
 import type { CollectorPlugin } from "../framework/collector";
 import { dialectFor, sqlDbFor } from "../lib/sql-db";
 import { getProjectId } from "./_context";
+import { readJsonObject } from "./_json";
 
 export const identityReceiverPlugin: CollectorPlugin = {
 	name: "identity-receiver",
 	register(app) {
 		app.post("/v1/identify", async (c) => {
 			const projectId = getProjectId(c);
-			let payload: IdentifyInput;
-			try {
-				payload = await c.req.json<IdentifyInput>();
-			} catch {
-				return c.json({ error: "Invalid JSON body" }, 400);
-			}
+			const payload = await readJsonObject<IdentifyInput>(c);
+			if (!payload) return c.json({ error: "Invalid JSON body" }, 400);
 			if (!payload.userId || typeof payload.userId !== "string") {
 				return c.json({ error: "userId is required" }, 400);
 			}
@@ -51,10 +48,11 @@ export const identityReceiverPlugin: CollectorPlugin = {
 				? JSON.stringify(payload.properties)
 				: null;
 
-			// user_id is the PK today (single-tenant legacy). For MVP, we keep
-			// that contract — user_id is treated as globally unique and the
-			// first project to identify them "owns" the profile. project_id on
-			// the row reflects where the user was first seen.
+			// Profiles are keyed by (project_id, user_id) — migration 045.
+			// user_id values are caller-chosen (often an email), so two
+			// projects identifying the same id must get two independent rows;
+			// an ingest key for one project can never read or rewrite another
+			// project's profile through this endpoint.
 			//
 			// On conflict we keep the EARLIEST first_seen_at via MIN() — once
 			// observed, a user's first-seen is monotonic; an identify() call
@@ -69,7 +67,7 @@ export const identityReceiverPlugin: CollectorPlugin = {
 				.prepare(
 					`INSERT INTO user_profiles (project_id, user_id, visitor_id, email, name, properties_json, first_seen_at, last_seen_at)
          VALUES (?, ?, ?, ?, ?, ?, ?, ?)
-         ON CONFLICT(user_id) DO UPDATE SET
+         ON CONFLICT(project_id, user_id) DO UPDATE SET
            visitor_id = excluded.visitor_id,
            email = COALESCE(excluded.email, user_profiles.email),
            name = COALESCE(excluded.name, user_profiles.name),

package/src/plugins/json-body.test.ts

@@ -0,0 +1,91 @@
+/**
+ * `c.req.json()` resolves `null`, arrays and primitives for bodies such as
+ * `null` or `"x"`. Every JSON ingest and admin route used to dereference the
+ * result straight away and answer 500. They must all answer 400 now, and the
+ * replay receiver must reject a chunk before writing it to blob storage.
+ */
+
+import type { MiddlewareHandler } from "hono";
+import { describe, expect, it } from "vitest";
+import { createTelemetryCollectorApp } from "../framework/collector";
+import type { CollectorEnv } from "../framework/env";
+import { MemSqlDb } from "../lib/test-utils/mem-sql-db";
+import { aiReceiverPlugin } from "./ai-receiver";
+import { askRoutesPlugin } from "./ask-routes";
+import { evalCasesRoutesPlugin } from "./eval-cases-routes";
+import { identityReceiverPlugin } from "./identity-receiver";
+import { replayReceiverPlugin } from "./replay-receiver";
+import { usageReceiverPlugin } from "./usage-receiver";
+
+const passthrough: MiddlewareHandler<{
+	Bindings: CollectorEnv;
+	Variables: { projectId: string };
+}> = async (c, next) => {
+	c.set("projectId", "default");
+	await next();
+};
+
+const app = createTelemetryCollectorApp({
+	plugins: [
+		aiReceiverPlugin,
+		usageReceiverPlugin,
+		replayReceiverPlugin,
+		identityReceiverPlugin,
+		askRoutesPlugin,
+		evalCasesRoutesPlugin,
+	],
+	auth: { middleware: passthrough },
+	dashboardAuth: { middleware: passthrough, registerRoutes: () => {} },
+});
+
+const ROUTES = [
+	"/v1/ai",
+	"/v1/ai/evaluations",
+	"/v1/usage",
+	"/v1/replays",
+	"/v1/identify",
+	"/internal/ask",
+	"/internal/eval-cases",
+	"/internal/eval-runs",
+	"/internal/eval-cases/case-1/results",
+];
+
+const NON_OBJECT_BODIES = ["null", "[]", '"text"', "42", "true"];
+
+const post = (path: string, body: string, env: Partial<CollectorEnv> = {}) =>
+	app.request(
+		path,
+		{ method: "POST", headers: { "content-type": "application/json" }, body },
+		{ DB: new MemSqlDb() as unknown as D1Database, ...env } as CollectorEnv,
+	);
+
+describe("JSON body validation", () => {
+	for (const path of ROUTES) {
+		it(`${path} answers 400 for non-object JSON bodies`, async () => {
+			for (const body of NON_OBJECT_BODIES) {
+				const res = await post(path, body);
+				expect(res.status, `${path} <- ${body}`).toBe(400);
+				const json = (await res.json()) as { error?: string };
+				expect(typeof json.error, `${path} <- ${body}`).toBe("string");
+			}
+			const malformed = await post(path, "{not json");
+			expect(malformed.status, `${path} <- malformed`).toBe(400);
+		});
+	}
+
+	it("/v1/replays rejects a chunk without visitorId before touching blob storage", async () => {
+		const puts: string[] = [];
+		const bucket = {
+			put: async (key: string) => {
+				puts.push(key);
+			},
+		};
+		const res = await post(
+			"/v1/replays",
+			JSON.stringify({ sessionId: "sess-1", sequenceNumber: 0, events: [] }),
+			{ REPLAYS_BUCKET: bucket as unknown as R2Bucket },
+		);
+		expect(res.status).toBe(400);
+		expect(puts).toEqual([]);
+	});
+});