@obsunified/collector 2.2.1 → 2.2.3

package/src/plugins/connected-routes/manifest.test.ts

@@ -0,0 +1,142 @@
+import { describe, expect, it } from "vitest";
+import {
+	hrefForEntity,
+	linksFromArtifacts,
+	linksFromEvalResults,
+	linksFromRetrievalEvents,
+	linksFromToolCalls,
+	MAX_LINKS_INLINE,
+	resolveFaultLocusTarget,
+} from "./manifest";
+
+// Tabs served by apps/web/src/app/router.ts (KNOWN_TABS). Generated hrefs
+// must start with one of these or the app falls back to Health.
+const ROUTER_TABS = new Set([
+	"health",
+	"investigate",
+	"traces",
+	"service-map",
+	"issues",
+	"logs",
+	"ai",
+	"evidence",
+	"usage",
+	"replay",
+	"alerts",
+	"users",
+	"agent-runs",
+	"actions",
+	"tool-calls",
+	"profiles",
+	"tool-reliability",
+	"evaluations",
+	"changes",
+	"findings",
+	"incidents",
+	"remediations",
+]);
+const tabOf = (href: string) =>
+	href.replace(/^#\//, "").split(/[/?#]/)[0] ?? "";
+
+describe("connected manifest hrefs target real router tabs", () => {
+	it("tool call overflow, retrievals, evals and artifacts avoid unknown tabs", () => {
+		const many = Array.from({ length: MAX_LINKS_INLINE + 1 }, (_, i) => ({
+			id: `t${i}`,
+			actionId: "a1",
+			toolName: "search",
+		}));
+		const hrefs = [
+			linksFromToolCalls(many as never, "Tools").links[0]?.href,
+			linksFromRetrievalEvents(
+				[
+					{
+						id: "r1",
+						actionId: "a1",
+						retrieverName: "kb",
+						totalResults: 3,
+					},
+				] as never,
+				"R",
+			).links[0]?.href,
+			linksFromEvalResults(
+				[{ id: "e1", actionId: "a1", evaluatorName: "g", passed: 1 }] as never,
+				"E",
+			).links[0]?.href,
+			linksFromArtifacts(
+				[
+					{
+						id: "x1",
+						actionId: "a1",
+						artifactName: "plan",
+						artifactType: "json",
+					},
+				] as never,
+				"A",
+			).links[0]?.href,
+		];
+		expect(hrefs).toEqual([
+			"#/tool-calls",
+			"#/actions/a1",
+			"#/evaluations/e1",
+			"#/actions/a1",
+		]);
+		for (const href of hrefs)
+			expect(ROUTER_TABS.has(tabOf(href ?? ""))).toBe(true);
+	});
+
+	it("hrefForEntity only emits router tabs for every evidence kind", () => {
+		for (const kind of [
+			"trace",
+			"span",
+			"alert",
+			"analysis",
+			"service",
+			"agent_run",
+			"action",
+			"tool_call",
+			"ai_call",
+			"profile",
+			"change",
+			"finding",
+			"incident",
+			"eval",
+			"log",
+			"replay",
+			"docs",
+		]) {
+			expect(ROUTER_TABS.has(tabOf(hrefForEntity(kind, "id-1"))), kind).toBe(
+				true,
+			);
+		}
+		expect(hrefForEntity("trace", "abc")).toBe("#/traces?trace=abc");
+		expect(hrefForEntity("alert", "al 1")).toBe("#/alerts?id=al%201");
+		expect(hrefForEntity("ai_call", "c1")).toBe("#/ai/calls/c1");
+	});
+});
+
+describe("resolveFaultLocusTarget", () => {
+	const trace = "a".repeat(32);
+	const span = "b".repeat(16);
+	it("classifies service nodes, bare services and spans", () => {
+		expect(
+			resolveFaultLocusTarget("service:prod:default:checkout-api"),
+		).toEqual({
+			entityKind: "service",
+			entityId: "service:prod:default:checkout-api",
+			href: "#/service-map?service=checkout-api",
+		});
+		expect(resolveFaultLocusTarget("checkout-api")).toMatchObject({
+			entityKind: "service",
+			href: "#/service-map?service=checkout-api",
+		});
+		expect(resolveFaultLocusTarget(`${trace}:${span}`)).toEqual({
+			entityKind: "span",
+			entityId: `${trace}:${span}`,
+			href: `#/traces?trace=${trace}&span=${span}`,
+		});
+		expect(resolveFaultLocusTarget(span)).toMatchObject({
+			entityKind: "span",
+			href: `#/evidence?kind=span&id=${span}`,
+		});
+	});
+});

package/src/plugins/connected-routes/manifest.ts

@@ -1,4 +1,8 @@
-import type { CausalProofTier, RelationshipCertainty } from "@obsunified/types";
+import type {
+	CausalProofTier,
+	EvidenceEntityKind,
+	RelationshipCertainty,
+} from "@obsunified/types";
 import type {
 	ActionRef,
 	AICallRef,
@@ -55,7 +59,7 @@ export interface ConnectedLink {
 	href: string;
 	count?: number;
 	sample?: string;
-	entityKind?: ConnectedEntityKind | "trace" | "eval";
+	entityKind?: ConnectedEntityKind | EvidenceEntityKind;
 	entityId?: string;
 	source?: string;
 	confidence?: number;
@@ -344,7 +348,9 @@ export const linksFromAi = (
 		label: prefix,
 		links: calls.map((c) => ({
 			label: `${c.provider} · ${c.modelName}`,
-			href: `#/ai?id=${c.callId}`,
+			href: `#/ai/calls/${encodeURIComponent(c.callId)}`,
+			entityKind: "ai_call",
+			entityId: c.callId,
 		})),
 	};
 };
@@ -451,7 +457,7 @@ export const linksFromToolCalls = (
 			links: [
 				{
 					label: `${calls.length} tool calls`,
-					href: `#/tools`,
+					href: `#/tool-calls`,
 					count: calls.length,
 					sample: truncate(calls[0].toolName),
 					entityKind: "tool_call",
@@ -488,7 +494,8 @@ export const linksFromRetrievalEvents = (
 		label: prefix,
 		links: events.map((r) => ({
 			label: `retrieve: ${r.retrieverName} (${r.totalResults} docs)`,
-			href: `#/retrieval-events/${r.id}`,
+			// No dedicated retrieval tab: the owning action's detail page lists it.
+			href: `#/actions/${encodeURIComponent(r.actionId)}`,
 		})),
 	};
 };
@@ -511,7 +518,9 @@ export const linksFromEvalResults = (
 		label: prefix,
 		links: results.map((e) => ({
 			label: `eval: ${e.evaluatorName} (${e.passed ? "passed" : "failed"})`,
-			href: `#/evals/${e.id}`,
+			// The Evaluations tab resolves this id to an eval case, falling back
+			// to the case saved from the same action.
+			href: `#/evaluations/${encodeURIComponent(e.id)}`,
 			entityKind: "eval",
 			entityId: e.id,
 			...metadataForAction?.(e.actionId),
@@ -534,7 +543,118 @@ export const linksFromArtifacts = (
 		label: prefix,
 		links: arts.map((a) => ({
 			label: `artifact: ${a.artifactName} (${a.artifactType})`,
-			href: `#/artifacts/${a.id}`,
+			// No dedicated artifact tab: the owning action's detail page lists it.
+			href: `#/actions/${encodeURIComponent(a.actionId)}`,
 		})),
 	};
 };
+
+/**
+ * Dashboard destination for an evidence entity, using only routes the web
+ * router (`apps/web/src/app/router.ts`) actually serves. Unknown kinds fall
+ * back to the evidence explorer so a link never lands on the Health tab.
+ */
+export const hrefForEntity = (kind: string, id: string): string => {
+	const enc = encodeURIComponent;
+	switch (kind) {
+		case "trace":
+			return `#/traces?trace=${enc(id)}`;
+		case "span": {
+			const [traceId, spanId] = id.split(":");
+			return spanId && traceId
+				? `#/traces?trace=${enc(traceId)}&span=${enc(spanId)}`
+				: `#/evidence?kind=span&id=${enc(id)}`;
+		}
+		case "alert":
+			return `#/alerts?id=${enc(id)}`;
+		case "analysis":
+			return "#/health";
+		case "service":
+			return `#/service-map?service=${enc(id)}`;
+		case "agent_run":
+			return `#/agent-runs/${enc(id)}`;
+		case "action":
+			return `#/actions/${enc(id)}`;
+		case "tool_call":
+			return `#/tool-calls/${enc(id)}`;
+		case "ai_call":
+			return `#/ai/calls/${enc(id)}`;
+		case "profile":
+			return `#/profiles/${enc(id)}`;
+		case "change":
+			return `#/changes/${enc(id)}`;
+		case "finding":
+			return `#/findings/${enc(id)}`;
+		case "incident":
+			return `#/incidents/${enc(id)}`;
+		case "eval":
+			return `#/evaluations/${enc(id)}`;
+		case "log":
+			return `#/logs?id=${enc(id)}`;
+		case "replay":
+			return `#/replay?session=${enc(id)}`;
+		default:
+			return `#/evidence?kind=${enc(kind)}&id=${enc(id)}`;
+	}
+};
+
+export interface FaultLocusTarget {
+	entityKind: "service" | "span";
+	entityId: string;
+	href: string;
+}
+
+const HEX_SPAN_PAIR = /^[0-9a-f]{32}:[0-9a-f]{16}$/i;
+const HEX_SPAN_ID = /^[0-9a-f]{16}$/i;
+const NODE_KINDS = new Set([
+	"service",
+	"endpoint",
+	"database",
+	"queue",
+	"messaging_topic",
+	"topic",
+	"cache",
+	"external",
+]);
+
+/**
+ * A finding's `faultLocusEntityId` is a canonical ontology node id
+ * (`service:<env>:<ns>:<name>`, `endpoint:<env>:<ns>:<svc>:...`), a
+ * `traceId:spanId` pair, a bare span id, or a bare service name. Resolve it to
+ * the entity kind it really is and the surface that shows that kind.
+ */
+export const resolveFaultLocusTarget = (
+	faultLocusEntityId: string,
+): FaultLocusTarget => {
+	const id = faultLocusEntityId;
+	if (HEX_SPAN_PAIR.test(id)) {
+		return {
+			entityKind: "span",
+			entityId: id,
+			href: hrefForEntity("span", id),
+		};
+	}
+	if (HEX_SPAN_ID.test(id)) {
+		return {
+			entityKind: "span",
+			entityId: id,
+			href: hrefForEntity("span", id),
+		};
+	}
+	const segments = id.split(":");
+	if (segments.length > 1 && NODE_KINDS.has(segments[0] ?? "")) {
+		// service:<env>:<ns>:<name> and endpoint:<env>:<ns>:<svc>:... both carry
+		// the owning service name at index 3.
+		const name = segments[3] || segments[segments.length - 1] || id;
+		return {
+			entityKind: "service",
+			entityId: id,
+			href: hrefForEntity("service", name),
+		};
+	}
+	return {
+		entityKind: "service",
+		entityId: id,
+		href: hrefForEntity("service", id),
+	};
+};

package/src/plugins/connected-routes-links.test.ts

@@ -0,0 +1,96 @@
+import { Hono } from "hono";
+import { describe, expect, it } from "vitest";
+import { CollectorRuntime } from "../framework/collector";
+import type { CollectorEnv } from "../framework/env";
+import { recordInvestigationFinding } from "../lib/autosre-findings";
+import { openOrDeduplicateIncident } from "../lib/autosre-remediation-gate";
+import { createMigratedSqliteDb } from "../lib/test-utils/node-sqlite-db";
+import { connectedRoutesPlugin } from "./connected-routes";
+
+type Link = { href: string; entityKind?: string; entityId?: string };
+type Manifest = { up: { links: Link[] }[]; across: { links: Link[] }[] };
+
+const SERVICE_NODE = "service:prod:default:checkout-api";
+
+const setup = () => {
+	const db = createMigratedSqliteDb();
+	const app = new Hono<{ Bindings: CollectorEnv }>();
+	connectedRoutesPlugin.register(app, new CollectorRuntime());
+	const env = { DB: db as unknown as D1Database } as CollectorEnv;
+	const get = async (path: string) =>
+		(await (await app.request(path, {}, env)).json()) as Manifest;
+	return { db, get };
+};
+
+const openIncident = async (
+	db: ReturnType<typeof setup>["db"],
+	kind: "trace" | "alert",
+	anchorId: string,
+) =>
+	(
+		await openOrDeduplicateIncident(db, "default", {
+			environment: "prod",
+			targetNodeId: SERVICE_NODE,
+			symptomAnchorKind: kind,
+			symptomAnchorId: anchorId,
+			symptomFingerprint: `fp_${kind}`,
+			symptomCategory: `fp_${kind}`,
+		})
+	).incident;
+
+describe("connected links carry the real entity kind and a matching href", () => {
+	it("incident trigger signal for a trace anchor is a trace link", async () => {
+		const { db, get } = setup();
+		const incident = await openIncident(db, "trace", "trace-123");
+		const m = await get(
+			`/internal/connected/incident/${incident.id}?environment=prod`,
+		);
+		expect(m.up[0]?.links[0]).toMatchObject({
+			entityKind: "trace",
+			entityId: "trace-123",
+			href: "#/traces?trace=trace-123",
+		});
+		db.close();
+	});
+
+	it("incident trigger signal for an alert anchor stays an alert link", async () => {
+		const { db, get } = setup();
+		const incident = await openIncident(db, "alert", "rule-9");
+		const m = await get(
+			`/internal/connected/incident/${incident.id}?environment=prod`,
+		);
+		expect(m.up[0]?.links[0]).toMatchObject({
+			entityKind: "alert",
+			entityId: "rule-9",
+			href: "#/alerts?id=rule-9",
+		});
+		db.close();
+	});
+
+	it.each([
+		[SERVICE_NODE, "service", "#/service-map?service=checkout-api"],
+		["checkout-api", "service", "#/service-map?service=checkout-api"],
+	])("finding fault locus %s links as %s", async (locus, kind, href) => {
+		const { db, get } = setup();
+		const incident = await openIncident(db, "trace", "t1");
+		const finding = await recordInvestigationFinding(db, "default", {
+			environment: "prod",
+			incidentId: incident.id,
+			title: "Regression",
+			summary: "Errors after deploy",
+			causalProofTier: "corroborated_candidate",
+			symptomEntityKind: "trace",
+			symptomEntityId: "t1",
+			faultLocusEntityKind: "service",
+			faultLocusEntityId: locus,
+			causalChain: [],
+			citedEvidenceIds: [],
+		});
+		const m = await get(
+			`/internal/connected/finding/${finding.id}?environment=prod`,
+		);
+		const link = m.across[0]?.links[0];
+		expect(link).toMatchObject({ entityKind: kind, entityId: locus, href });
+		db.close();
+	});
+});

package/src/plugins/connected-routes.test.ts

@@ -470,7 +470,7 @@ describe("ConnectedRail manifest — raw signal action back-links", () => {
 			m.down.find((s) => s.label === "Evaluations for this span")?.links[0],
 		).toMatchObject({
 			label: "eval: groundedness (passed)",
-			href: "#/evals/eval-explicit",
+			href: "#/evaluations/eval-explicit",
 		});
 		expect(
 			m.related.find((s) => s.label === "Agent runs for this span")?.links[0],
@@ -749,7 +749,7 @@ describe("ConnectedRail manifest — raw signal action back-links", () => {
 		).toMatchObject({ href: "#/tool-calls/tool-explicit" });
 		expect(
 			m.down.find((s) => s.label === "Evaluations for this AI call")?.links[0],
-		).toMatchObject({ href: "#/evals/eval-explicit" });
+		).toMatchObject({ href: "#/evaluations/eval-explicit" });
 		expect(
 			m.related.find((s) => s.label === "Agent runs for this AI call")
 				?.links[0],
@@ -1280,7 +1280,7 @@ describe("ConnectedRail scenario acceptance contracts", () => {
 		const aiSection = userManifest.across.find((s) =>
 			s.label.toLowerCase().includes("ai call"),
 		);
-		expect(aiSection?.links[0].href).toBe("#/ai?id=ai-heavy-1");
+		expect(aiSection?.links[0].href).toBe("#/ai/calls/ai-heavy-1");
 
 		const sessionManifest = await fetch(
 			"/internal/connected/usage/sess-heavy?session_id=sess-heavy",

package/src/plugins/connected-routes.ts

@@ -42,6 +42,7 @@ import {
 	type ActionContextLinkMetadata,
 	type ConnectedEntityKind,
 	type ConnectedManifest,
+	hrefForEntity,
 	KNOWN_KINDS,
 	linksFromActions,
 	linksFromAi,
@@ -59,6 +60,7 @@ import {
 	linkToTrace,
 	MAX_LINKS_INLINE,
 	profileLinksForTrace,
+	resolveFaultLocusTarget,
 } from "./connected-routes/manifest";
 
 export type {
@@ -1115,10 +1117,11 @@ export const connectedRoutesPlugin: CollectorPlugin = {
 					const spans = changeRow.version
 						? await db
 								.prepare(
-									`SELECT DISTINCT trace_id, span_id, service_name, span_name
+									`SELECT trace_id, span_id, service_name, span_name
 									 FROM telemetry_spans
 									 WHERE project_id = ? AND environment = ? AND service_version = ? AND status_code = 2
-									 ORDER BY start_time DESC LIMIT 5`,
+									 GROUP BY trace_id, span_id, service_name, span_name
+									 ORDER BY MAX(start_time) DESC LIMIT 5`,
 								)
 								.bind(projectId, changeRow.environment, changeRow.version)
 								.all<{
@@ -1195,7 +1198,7 @@ export const connectedRoutesPlugin: CollectorPlugin = {
 							links: [
 								{
 									label: `fault locus: ${findingRow.faultLocusEntityId}`,
-									href: `#/traces?q=${encodeURIComponent(findingRow.faultLocusEntityId)}`,
+									...resolveFaultLocusTarget(findingRow.faultLocusEntityId),
 									relationshipCertainty: "exact",
 									causalProofTier: proofTier,
 								},
@@ -1249,11 +1252,11 @@ export const connectedRoutesPlugin: CollectorPlugin = {
 							links: [
 								{
 									label: `${incRow.symptomAnchorKind}: ${incRow.symptomAnchorId}`,
-									href: `#/alerts?id=${encodeURIComponent(incRow.symptomAnchorId)}`,
-									entityKind:
-										incRow.symptomAnchorKind === "analysis"
-											? "analysis"
-											: "alert",
+									href: hrefForEntity(
+										incRow.symptomAnchorKind,
+										incRow.symptomAnchorId,
+									),
+									entityKind: incRow.symptomAnchorKind,
 									entityId: incRow.symptomAnchorId,
 									relationshipCertainty: "exact",
 								},

package/src/plugins/evidence-retrieval-routes.ts

@@ -11,6 +11,7 @@ import type {
 	TelemetrySpanDetail,
 	TelemetryTraceDetailResponse,
 } from "@obsunified/types";
+import { buildFindingFingerprint } from "@obsunified/types";
 import type { CollectorPlugin } from "../framework/collector";
 import {
 	computeChangeBlastRadius,
@@ -18,6 +19,7 @@ import {
 	listChangeEvents,
 } from "../lib/autosre-change-correlation";
 import {
+	fingerprintInputFromSpan,
 	getInvestigationFinding,
 	searchInvestigationFindings,
 } from "../lib/autosre-findings";
@@ -1607,6 +1609,34 @@ const attachAutoSreTriageContext = async (
 				limit: 5,
 			});
 		}
+		// Secondary match: the same recurrence fingerprint (service + route +
+		// error signature) in this project, so a failure that recurs on a
+		// different span id still surfaces the findings and fixes recorded
+		// before. Entity-id matches stay first.
+		if (faultLocus?.faultLocusSpan) {
+			const spanFp = fingerprintInputFromSpan(
+				faultLocus.faultLocusSpan,
+				environment,
+			);
+			const fingerprint = buildFindingFingerprint({
+				...spanFp,
+				normalizedOperation: spanFp.normalizedOperation ?? "",
+				errorSignature: spanFp.errorSignature ?? "",
+			}).fingerprint;
+			const byFingerprint = await searchInvestigationFindings(db, {
+				projectId,
+				environment,
+				fingerprint,
+				limit: 5,
+			});
+			const seen = new Set(priorFindingsList.map((f) => f.id));
+			for (const f of byFingerprint) {
+				if (!seen.has(f.id) && priorFindingsList.length < 5) {
+					priorFindingsList.push(f);
+					seen.add(f.id);
+				}
+			}
+		}
 		// No unfiltered fallback: unrelated findings would read as relevant
 		// prior art. An empty list is the honest answer.
 		const priorFindings = priorFindingsList.map((f) => ({

package/dist/chunk-KMEZKGSO.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/lib/hash.ts","../src/lib/projects-store.ts","../src/lib/sql-db.ts","../src/auth/ingest-auth.ts"],"sourcesContent":["/**\n * Cross-runtime crypto helpers using Web Crypto API.\n * Works in Cloudflare Workers, Node 20+, Deno, Bun.\n */\n\n/** SHA-256 hash of a string, returned as lowercase hex. */\nexport async function sha256Hex(input: string): Promise<string> {\n\tconst encoder = new TextEncoder();\n\tconst digest = await crypto.subtle.digest(\"SHA-256\", encoder.encode(input));\n\treturn bytesToHex(new Uint8Array(digest));\n}\n\n/** Generate `bytes` cryptographically random bytes and return as lowercase hex. */\nexport function randomHex(bytes: number): string {\n\tconst buf = new Uint8Array(bytes);\n\tcrypto.getRandomValues(buf);\n\treturn bytesToHex(buf);\n}\n\nfunction bytesToHex(bytes: Uint8Array): string {\n\tlet out = \"\";\n\tfor (let i = 0; i < bytes.length; i++) {\n\t\tout += bytes[i].toString(16).padStart(2, \"0\");\n\t}\n\treturn out;\n}\n","import type {\n\tIngestKey,\n\tIngestKeyRow,\n\tIngestKeyWithPlaintext,\n\tProject,\n\tProjectRow,\n} from \"@obsunified/types\";\nimport { randomHex, sha256Hex } from \"./hash\";\nimport type { SqlDb } from \"./sql-db\";\n\nconst rowToProject = (row: ProjectRow): Project => ({\n\tid: row.id,\n\tname: row.name,\n\tslug: row.slug,\n\tcreatedAt: row.created_at,\n\tpayloadCaptureEnabled:\n\t\trow.payload_capture_enabled === true ||\n\t\trow.payload_capture_enabled === 1 ||\n\t\trow.payload_capture_enabled === \"1\" ||\n\t\trow.payload_capture_enabled === \"true\",\n});\n\nconst rowToKey = (row: IngestKeyRow): IngestKey => ({\n\tid: row.id,\n\tprojectId: row.project_id,\n\tname: row.name,\n\tkeyPrefix: row.key_prefix,\n\tcreatedAt: row.created_at,\n\trevokedAt: row.revoked_at,\n});\n\nconst SLUG_PATTERN = /^[a-z0-9]([a-z0-9-]{0,48}[a-z0-9])?$/;\n\nexport class ProjectsStore {\n\tconstructor(private readonly db: SqlDb) {}\n\n\tasync listProjects(): Promise<Project[]> {\n\t\tconst rs = await this.db\n\t\t\t.prepare(`SELECT * FROM projects ORDER BY created_at ASC`)\n\t\t\t.all<ProjectRow>();\n\t\treturn (rs.results ?? []).map(rowToProject);\n\t}\n\n\tasync getProject(id: string): Promise<Project | null> {\n\t\tconst row = await this.db\n\t\t\t.prepare(`SELECT * FROM projects WHERE id = ?`)\n\t\t\t.bind(id)\n\t\t\t.first<ProjectRow>();\n\t\treturn row ? rowToProject(row) : null;\n\t}\n\n\tasync createProject(input: { name: string; slug: string }): Promise<Project> {\n\t\tconst name = input.name.trim();\n\t\tconst slug = input.slug.trim().toLowerCase();\n\t\tif (!name) throw new Error(\"Project name is required\");\n\t\tif (!SLUG_PATTERN.test(slug))\n\t\t\tthrow new Error(\n\t\t\t\t\"Slug must be lowercase letters, digits, and hyphens (max 50 chars)\",\n\t\t\t);\n\n\t\tconst id = randomHex(16);\n\t\tconst createdAt = new Date().toISOString();\n\n\t\tawait this.db\n\t\t\t.prepare(\n\t\t\t\t`INSERT INTO projects (id, name, slug, created_at) VALUES (?, ?, ?, ?)`,\n\t\t\t)\n\t\t\t.bind(id, name, slug, createdAt)\n\t\t\t.run();\n\n\t\treturn { id, name, slug, createdAt, payloadCaptureEnabled: false };\n\t}\n\n\tasync updateProject(\n\t\tid: string,\n\t\tpatch: { name?: string; payloadCaptureEnabled?: boolean },\n\t): Promise<Project | null> {\n\t\tconst existing = await this.getProject(id);\n\t\tif (!existing) return null;\n\n\t\tconst name = patch.name?.trim();\n\t\tlet next = existing;\n\t\tif (name !== undefined && name !== existing.name) {\n\t\t\tawait this.db\n\t\t\t\t.prepare(`UPDATE projects SET name = ? WHERE id = ?`)\n\t\t\t\t.bind(name, id)\n\t\t\t\t.run();\n\t\t\tnext = { ...next, name };\n\t\t}\n\t\tif (\n\t\t\tpatch.payloadCaptureEnabled !== undefined &&\n\t\t\tpatch.payloadCaptureEnabled !== existing.payloadCaptureEnabled\n\t\t) {\n\t\t\tawait this.db\n\t\t\t\t.prepare(`UPDATE projects SET payload_capture_enabled = ? WHERE id = ?`)\n\t\t\t\t.bind(patch.payloadCaptureEnabled ? 1 : 0, id)\n\t\t\t\t.run();\n\t\t\tnext = {\n\t\t\t\t...next,\n\t\t\t\tpayloadCaptureEnabled: patch.payloadCaptureEnabled,\n\t\t\t};\n\t\t}\n\t\treturn next;\n\t}\n\n\tasync ensureDefaultProject(): Promise<void> {\n\t\tawait this.db\n\t\t\t.prepare(\n\t\t\t\t`INSERT OR IGNORE INTO projects (id, name, slug, created_at) VALUES ('default', 'Default', 'default', ?)`,\n\t\t\t)\n\t\t\t.bind(new Date().toISOString())\n\t\t\t.run();\n\t}\n\n\t// ── Ingest keys ──\n\n\tasync listKeys(projectId: string): Promise<IngestKey[]> {\n\t\tconst rs = await this.db\n\t\t\t.prepare(\n\t\t\t\t`SELECT * FROM ingest_keys WHERE project_id = ? ORDER BY created_at DESC`,\n\t\t\t)\n\t\t\t.bind(projectId)\n\t\t\t.all<IngestKeyRow>();\n\t\treturn (rs.results ?? []).map(rowToKey);\n\t}\n\n\tasync createKey(\n\t\tprojectId: string,\n\t\tname: string,\n\t): Promise<IngestKeyWithPlaintext> {\n\t\tconst project = await this.getProject(projectId);\n\t\tif (!project) throw new Error(\"Project not found\");\n\n\t\tconst trimmedName = name.trim() || \"unnamed\";\n\t\tconst id = randomHex(16);\n\t\tconst plaintext = `obs_${project.slug}_${randomHex(24)}`;\n\t\tconst keyHash = await sha256Hex(plaintext);\n\t\t// Prefix: show enough to identify but not recover (first 16 chars).\n\t\tconst keyPrefix = plaintext.slice(0, 16);\n\t\tconst createdAt = new Date().toISOString();\n\n\t\tawait this.db\n\t\t\t.prepare(\n\t\t\t\t`INSERT INTO ingest_keys (id, project_id, key_hash, key_prefix, name, created_at) VALUES (?, ?, ?, ?, ?, ?)`,\n\t\t\t)\n\t\t\t.bind(id, projectId, keyHash, keyPrefix, trimmedName, createdAt)\n\t\t\t.run();\n\n\t\treturn {\n\t\t\tid,\n\t\t\tprojectId,\n\t\t\tname: trimmedName,\n\t\t\tkeyPrefix,\n\t\t\tcreatedAt,\n\t\t\trevokedAt: null,\n\t\t\tkey: plaintext,\n\t\t\twarning: \"This key will not be shown again. Store it somewhere safe.\",\n\t\t};\n\t}\n\n\tasync revokeKey(keyId: string, projectId: string): Promise<boolean> {\n\t\tconst result = await this.db\n\t\t\t.prepare(\n\t\t\t\t`UPDATE ingest_keys SET revoked_at = ?\n\t\t\t\t WHERE id = ? AND project_id = ? AND revoked_at IS NULL`,\n\t\t\t)\n\t\t\t.bind(new Date().toISOString(), keyId, projectId)\n\t\t\t.run();\n\t\treturn (result.meta?.changes ?? 0) > 0;\n\t}\n\n\tasync findByKeyHash(\n\t\tkeyHash: string,\n\t): Promise<{ projectId: string; keyId: string } | null> {\n\t\tconst row = await this.db\n\t\t\t.prepare(\n\t\t\t\t`SELECT id, project_id FROM ingest_keys WHERE key_hash = ? AND revoked_at IS NULL`,\n\t\t\t)\n\t\t\t.bind(keyHash)\n\t\t\t.first<{ id: string; project_id: string }>();\n\t\treturn row ? { projectId: row.project_id, keyId: row.id } : null;\n\t}\n\n\t/**\n\t * Idempotently register the legacy env INGEST_KEY as a bootstrap key on the\n\t * default project, so existing deployments keep working without manual migration.\n\t */\n\tasync bootstrapEnvKey(plaintext: string): Promise<void> {\n\t\tif (!plaintext) return;\n\t\tawait this.ensureDefaultProject();\n\t\tconst keyHash = await sha256Hex(plaintext);\n\t\tconst existing = await this.db\n\t\t\t.prepare(`SELECT id FROM ingest_keys WHERE key_hash = ?`)\n\t\t\t.bind(keyHash)\n\t\t\t.first<{ id: string }>();\n\t\tif (existing) return;\n\n\t\tconst id = randomHex(16);\n\t\tconst keyPrefix = plaintext.slice(0, Math.min(16, plaintext.length));\n\t\tconst createdAt = new Date().toISOString();\n\t\tawait this.db\n\t\t\t.prepare(\n\t\t\t\t`INSERT INTO ingest_keys (id, project_id, key_hash, key_prefix, name, created_at) VALUES (?, 'default', ?, ?, 'bootstrap', ?)`,\n\t\t\t)\n\t\t\t.bind(id, keyHash, keyPrefix, createdAt)\n\t\t\t.run();\n\t}\n}\n","/**\n * Storage seam for the collector — RFC 0008.\n *\n * Stores and plugins target this interface instead of `D1Database` directly,\n * so a future Node / better-sqlite3 / ClickHouse runtime is one new adapter\n * away rather than a fork-and-rewrite. The shape is deliberately D1's\n * existing `prepare → bind → first|all|run` chain so the migration of\n * existing stores is mechanical (search-and-replace the constructor type).\n *\n * Today there is one implementation, `D1Adapter`. A `MemSqlDb` test double\n * lives next door under `test-utils/`; `BetterSqliteAdapter` and\n * `ClickHouseAdapter` are deferred until they have a real runtime to serve.\n */\n\nexport interface SqlDb {\n\treadonly dialect?: SqlDialect;\n\tprepare(sql: string): SqlStatement;\n\t/**\n\t * Run multiple prepared statements as a batch. On D1 this maps to a\n\t * single network round-trip; on a future better-sqlite3 adapter it\n\t * wraps the calls in a transaction. Returns one result per statement\n\t * in input order, mirroring D1's `batch`.\n\t *\n\t * Statements MUST have been produced by this same `SqlDb` instance —\n\t * mixing adapters is an error and runtime behavior is undefined.\n\t */\n\tbatch(\n\t\tstatements: SqlStatement[],\n\t): Promise<Array<{ meta: { changes: number } }>>;\n}\n\nexport type SqlDialectName = \"sqlite\" | \"postgres\";\n\nexport interface SqlDialect {\n\treadonly name: SqlDialectName;\n\tnow(): string;\n\tsinceHours(param: string): string;\n\tsinceMinutes(param: string): string;\n\tjsonText(expr: string, path: string): string;\n}\n\nexport interface SqlStatement {\n\tbind(...args: unknown[]): SqlStatement;\n\tfirst<T = Record<string, unknown>>(): Promise<T | null>;\n\tall<T = Record<string, unknown>>(): Promise<{ results: T[] }>;\n\trun(): Promise<{ meta: { changes: number } }>;\n}\n\n/**\n * D1 already conforms to this shape almost exactly; the adapter normalizes\n * two small differences:\n *  - `all()` on D1 returns `results?: T[]` (optional). We coerce to `[]`.\n *  - `run()`'s `meta.changes` is optional on D1. We coerce to `0`.\n * Both differences are runtime-undetectable for the queries this codebase\n * issues (every successful all() returns results; every run() against an\n * INSERT/UPDATE/DELETE reports changes), but coercing keeps the typed\n * interface honest.\n */\nexport class D1Adapter implements SqlDb {\n\treadonly dialect = sqliteDialect;\n\n\tconstructor(private readonly d1: D1Database) {}\n\n\tprepare(sql: string): SqlStatement {\n\t\treturn new D1StatementAdapter(this.d1.prepare(sql));\n\t}\n\n\tasync batch(\n\t\tstatements: SqlStatement[],\n\t): Promise<Array<{ meta: { changes: number } }>> {\n\t\t// Unwrap each statement back to its D1 form — D1's batch takes\n\t\t// D1PreparedStatement[], not our typed wrapper.\n\t\tconst unwrapped = statements.map((s) => {\n\t\t\tif (!(s instanceof D1StatementAdapter)) {\n\t\t\t\tthrow new Error(\n\t\t\t\t\t\"D1Adapter.batch: statement was not produced by D1Adapter\",\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn s.unwrap();\n\t\t});\n\t\tconst results = await this.d1.batch(unwrapped);\n\t\treturn results.map((r) => ({\n\t\t\tmeta: { changes: r.meta?.changes ?? 0 },\n\t\t}));\n\t}\n}\n\n/**\n * Convenience wrapper for the common case: take a `CollectorEnv`-shaped\n * object and return an `SqlDb`. Most plugins don't have access to the\n * `CollectorRuntime` (they get it at register time, not handler time)\n * so they call this directly. Plugins that *do* hold the runtime should\n * prefer `runtime.getSqlDb(env)` so a host-supplied `sqlDb` factory in\n * `CollectorConfig` takes effect.\n */\nexport const sqlDbFor = (env: { DB: D1Database | SqlDb }): SqlDb =>\n\tisSqlDb(env.DB) ? env.DB : new D1Adapter(env.DB);\n\n/**\n * SQLite `strftime` format that reproduces `Date#toISOString()` output\n * (`YYYY-MM-DDTHH:MM:SS.mmmZ`). Every stored timestamp column holds that\n * shape, so time windows must be rendered the same way: `datetime('now')`\n * yields `YYYY-MM-DD HH:MM:SS` and in a text comparison the space sorts\n * before the `T`, which made \"last 5 minutes\" match the whole current UTC\n * day on D1 and made `expires_at < now` purges run a day late.\n */\nexport const SQLITE_ISO_FORMAT = \"%Y-%m-%dT%H:%M:%fZ\";\n\n/** Render SQLite `now` (optionally shifted by a modifier expression) as ISO text. */\nexport const sqliteIsoNow = (modifier?: string): string =>\n\tmodifier\n\t\t? `strftime('${SQLITE_ISO_FORMAT}', 'now', ${modifier})`\n\t\t: `strftime('${SQLITE_ISO_FORMAT}', 'now')`;\n\nexport const sqliteDialect: SqlDialect = {\n\tname: \"sqlite\",\n\tnow: () => sqliteIsoNow(),\n\tsinceHours: (param) => sqliteIsoNow(`'-' || ${param} || ' hours'`),\n\tsinceMinutes: (param) => sqliteIsoNow(`'-' || ${param} || ' minutes'`),\n\tjsonText: (expr, path) => `json_extract(${expr}, '${path}')`,\n};\n\n/**\n * The collector stores every timestamp column (`received_at`, `expires_at`,\n * `occurred_at`, …) as TEXT holding `Date#toISOString()` output on both\n * D1 and Postgres. Postgres will not compare TEXT against a\n * `timestamptz`, so time-window expressions have to be rendered as ISO\n * text in the same `YYYY-MM-DDTHH:MM:SS.mmmZ` shape the collector writes.\n */\nconst POSTGRES_ISO_TEXT_FORMAT = `'YYYY-MM-DD\"T\"HH24:MI:SS.MS\"Z\"'`;\nconst POSTGRES_UTC_NOW = \"(CURRENT_TIMESTAMP AT TIME ZONE 'UTC')\";\n\n/** Render a Postgres `timestamp` expression as collector-style ISO text. */\nexport const postgresIsoText = (expr: string): string =>\n\t`to_char(${expr}, ${POSTGRES_ISO_TEXT_FORMAT})`;\n\nexport const postgresDialect: SqlDialect = {\n\tname: \"postgres\",\n\tnow: () => postgresIsoText(POSTGRES_UTC_NOW),\n\tsinceHours: (param) =>\n\t\tpostgresIsoText(\n\t\t\t`${POSTGRES_UTC_NOW} - (${param}::text || ' hours')::interval`,\n\t\t),\n\tsinceMinutes: (param) =>\n\t\tpostgresIsoText(\n\t\t\t`${POSTGRES_UTC_NOW} - (${param}::text || ' minutes')::interval`,\n\t\t),\n\tjsonText: (expr, path) => {\n\t\tconst key = path\n\t\t\t.replace(/^\\$\\./, \"\")\n\t\t\t.replace(/^\"|\"$/g, \"\")\n\t\t\t.replace(/\\\\u002E/g, \".\");\n\t\treturn `(${expr}::jsonb ->> '${key.replace(/'/g, \"''\")}')`;\n\t},\n};\n\nexport const dialectFor = (db: SqlDb): SqlDialect =>\n\tdb.dialect ?? sqliteDialect;\n\nconst isSqlDb = (db: unknown): db is SqlDb => {\n\tif (!db || typeof db !== \"object\") return false;\n\tconst candidate = db as {\n\t\tprepare?: unknown;\n\t\tbatch?: unknown;\n\t\texec?: unknown;\n\t};\n\treturn (\n\t\ttypeof candidate.prepare === \"function\" &&\n\t\ttypeof candidate.batch === \"function\" &&\n\t\ttypeof candidate.exec !== \"function\"\n\t);\n};\n\nclass D1StatementAdapter implements SqlStatement {\n\tconstructor(private readonly stmt: D1PreparedStatement) {}\n\n\t/** Internal escape hatch for `D1Adapter.batch` to recover the wrapped\n\t *  D1 statement. Not part of the public `SqlStatement` shape. */\n\tunwrap(): D1PreparedStatement {\n\t\treturn this.stmt;\n\t}\n\n\tbind(...args: unknown[]): SqlStatement {\n\t\treturn new D1StatementAdapter(this.stmt.bind(...args));\n\t}\n\n\tfirst<T = Record<string, unknown>>(): Promise<T | null> {\n\t\treturn this.stmt.first<T>();\n\t}\n\n\tasync all<T = Record<string, unknown>>(): Promise<{ results: T[] }> {\n\t\tconst r = await this.stmt.all<T>();\n\t\treturn { results: r.results ?? [] };\n\t}\n\n\tasync run(): Promise<{ meta: { changes: number } }> {\n\t\tconst r = await this.stmt.run();\n\t\treturn { meta: { changes: r.meta?.changes ?? 0 } };\n\t}\n}\n","import type { MiddlewareHandler } from \"hono\";\nimport type { CollectorEnv } from \"../framework/env\";\nimport { sha256Hex } from \"../lib/hash\";\nimport { ProjectsStore } from \"../lib/projects-store\";\nimport { sqlDbFor } from \"../lib/sql-db\";\n\nconst CACHE_TTL_MS = 60_000; // 60 seconds\nconst CACHE_MAX_ENTRIES = 500;\n\ninterface CacheEntry {\n\tprojectId: string;\n\texpiresAt: number;\n}\n\nlet keyCaches = new WeakMap<object, Map<string, CacheEntry>>();\nlet bootstrapDone = false;\n\nfunction cacheFor(dbKey: object): Map<string, CacheEntry> {\n\tlet cache = keyCaches.get(dbKey);\n\tif (!cache) {\n\t\tcache = new Map();\n\t\tkeyCaches.set(dbKey, cache);\n\t}\n\treturn cache;\n}\n\nfunction getCached(\n\tcache: Map<string, CacheEntry>,\n\thash: string,\n\tnow: number,\n): string | null {\n\tpruneKeyCache(cache, now);\n\tconst entry = cache.get(hash);\n\tif (!entry) return null;\n\tif (entry.expiresAt <= now) {\n\t\tcache.delete(hash);\n\t\treturn null;\n\t}\n\treturn entry.projectId;\n}\n\nfunction setCached(\n\tcache: Map<string, CacheEntry>,\n\thash: string,\n\tprojectId: string,\n\tnow: number,\n): void {\n\tpruneKeyCache(cache, now);\n\twhile (cache.size >= CACHE_MAX_ENTRIES) {\n\t\tconst oldestKey = cache.keys().next().value;\n\t\tif (!oldestKey) break;\n\t\tcache.delete(oldestKey);\n\t}\n\tcache.set(hash, { projectId, expiresAt: now + CACHE_TTL_MS });\n}\n\nfunction pruneKeyCache(cache: Map<string, CacheEntry>, now: number): void {\n\tfor (const [hash, entry] of cache) {\n\t\tif (entry.expiresAt <= now) cache.delete(hash);\n\t}\n}\n\n/** Test helper — clears the in-memory cache and bootstrap flag. */\nexport function resetIngestAuthCache(): void {\n\tkeyCaches = new WeakMap();\n\tbootstrapDone = false;\n}\n\n/**\n * Creates middleware that validates ingest API keys against the ingest_keys table.\n *\n * Accepts the key from either:\n *   - Authorization: Bearer <key>\n *   - X-API-Key: <key>\n *\n * On success, sets `projectId` on the Hono context via `c.set('projectId', ...)`.\n *\n * On the first request per isolate, if `env.INGEST_KEY` is set, the middleware\n * registers it as a `bootstrap` key on the default project — so existing\n * single-tenant deployments continue to work without manual migration.\n */\nexport function createIngestAuth(config?: {\n\tallowUnauthenticated?: boolean;\n}): MiddlewareHandler<{\n\tBindings: CollectorEnv;\n\tVariables: { projectId: string };\n}> {\n\treturn async (c, next) => {\n\t\t// Lazy bootstrap of legacy env key (idempotent).\n\t\tif (!bootstrapDone) {\n\t\t\tconst legacy = c.env.INGEST_KEY || c.env.TELEMETRY_INGEST_TOKEN;\n\t\t\tif (legacy) {\n\t\t\t\tconst store = new ProjectsStore(sqlDbFor(c.env));\n\t\t\t\ttry {\n\t\t\t\t\tawait store.bootstrapEnvKey(legacy);\n\t\t\t\t\t// Latch only after success: a transient DB error on the first\n\t\t\t\t\t// request must not permanently disable legacy-key bootstrap for\n\t\t\t\t\t// the isolate. bootstrapEnvKey is idempotent, so concurrent\n\t\t\t\t\t// first-requests racing here are harmless.\n\t\t\t\t\tbootstrapDone = true;\n\t\t\t\t} catch (err) {\n\t\t\t\t\tconsole.error(\"[ingest-auth] bootstrap failed:\", err);\n\t\t\t\t}\n\t\t\t} else {\n\t\t\t\t// Nothing to bootstrap — don't keep re-checking on every request.\n\t\t\t\tbootstrapDone = true;\n\t\t\t}\n\t\t}\n\n\t\tconst bearer = c.req.header(\"Authorization\")?.replace(/^Bearer\\s+/i, \"\");\n\t\tconst apiKey = c.req.header(\"X-API-Key\");\n\t\tconst token = bearer || apiKey;\n\n\t\tif (!token) {\n\t\t\tif (\n\t\t\t\tconfig?.allowUnauthenticated ||\n\t\t\t\tc.env.ALLOW_UNAUTHENTICATED === \"true\"\n\t\t\t) {\n\t\t\t\tc.set(\"projectId\", \"default\");\n\t\t\t\treturn next();\n\t\t\t}\n\t\t\treturn c.json({ error: \"Unauthorized\" }, 401);\n\t\t}\n\n\t\tconst now = Date.now();\n\t\tconst hash = await sha256Hex(token);\n\t\tconst rawDb =\n\t\t\t(c.env.DB as unknown as Record<string, unknown>)?.__unwrapped_db ||\n\t\t\tc.env.DB;\n\t\tconst cache = cacheFor(rawDb);\n\t\tconst cached = getCached(cache, hash, now);\n\t\tif (cached) {\n\t\t\tc.set(\"projectId\", cached);\n\t\t\treturn next();\n\t\t}\n\n\t\tconst store = new ProjectsStore(sqlDbFor(c.env));\n\t\tconst match = await store.findByKeyHash(hash);\n\t\tif (!match) {\n\t\t\treturn c.json({ error: \"Unauthorized\" }, 401);\n\t\t}\n\n\t\tsetCached(cache, hash, match.projectId, now);\n\t\tc.set(\"projectId\", match.projectId);\n\t\treturn next();\n\t};\n}\n"],"mappings":";AAMA,eAAsB,UAAU,OAAgC;AAC/D,QAAM,UAAU,IAAI,YAAY;AAChC,QAAM,SAAS,MAAM,OAAO,OAAO,OAAO,WAAW,QAAQ,OAAO,KAAK,CAAC;AAC1E,SAAO,WAAW,IAAI,WAAW,MAAM,CAAC;AACzC;AAGO,SAAS,UAAU,OAAuB;AAChD,QAAM,MAAM,IAAI,WAAW,KAAK;AAChC,SAAO,gBAAgB,GAAG;AAC1B,SAAO,WAAW,GAAG;AACtB;AAEA,SAAS,WAAW,OAA2B;AAC9C,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACtC,WAAO,MAAM,CAAC,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG;AAAA,EAC7C;AACA,SAAO;AACR;;;ACfA,IAAM,eAAe,CAAC,SAA8B;AAAA,EACnD,IAAI,IAAI;AAAA,EACR,MAAM,IAAI;AAAA,EACV,MAAM,IAAI;AAAA,EACV,WAAW,IAAI;AAAA,EACf,uBACC,IAAI,4BAA4B,QAChC,IAAI,4BAA4B,KAChC,IAAI,4BAA4B,OAChC,IAAI,4BAA4B;AAClC;AAEA,IAAM,WAAW,CAAC,SAAkC;AAAA,EACnD,IAAI,IAAI;AAAA,EACR,WAAW,IAAI;AAAA,EACf,MAAM,IAAI;AAAA,EACV,WAAW,IAAI;AAAA,EACf,WAAW,IAAI;AAAA,EACf,WAAW,IAAI;AAChB;AAEA,IAAM,eAAe;AAEd,IAAM,gBAAN,MAAoB;AAAA,EAC1B,YAA6B,IAAW;AAAX;AAAA,EAAY;AAAA,EAEzC,MAAM,eAAmC;AACxC,UAAM,KAAK,MAAM,KAAK,GACpB,QAAQ,gDAAgD,EACxD,IAAgB;AAClB,YAAQ,GAAG,WAAW,CAAC,GAAG,IAAI,YAAY;AAAA,EAC3C;AAAA,EAEA,MAAM,WAAW,IAAqC;AACrD,UAAM,MAAM,MAAM,KAAK,GACrB,QAAQ,qCAAqC,EAC7C,KAAK,EAAE,EACP,MAAkB;AACpB,WAAO,MAAM,aAAa,GAAG,IAAI;AAAA,EAClC;AAAA,EAEA,MAAM,cAAc,OAAyD;AAC5E,UAAM,OAAO,MAAM,KAAK,KAAK;AAC7B,UAAM,OAAO,MAAM,KAAK,KAAK,EAAE,YAAY;AAC3C,QAAI,CAAC,KAAM,OAAM,IAAI,MAAM,0BAA0B;AACrD,QAAI,CAAC,aAAa,KAAK,IAAI;AAC1B,YAAM,IAAI;AAAA,QACT;AAAA,MACD;AAED,UAAM,KAAK,UAAU,EAAE;AACvB,UAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AAEzC,UAAM,KAAK,GACT;AAAA,MACA;AAAA,IACD,EACC,KAAK,IAAI,MAAM,MAAM,SAAS,EAC9B,IAAI;AAEN,WAAO,EAAE,IAAI,MAAM,MAAM,WAAW,uBAAuB,MAAM;AAAA,EAClE;AAAA,EAEA,MAAM,cACL,IACA,OAC0B;AAC1B,UAAM,WAAW,MAAM,KAAK,WAAW,EAAE;AACzC,QAAI,CAAC,SAAU,QAAO;AAEtB,UAAM,OAAO,MAAM,MAAM,KAAK;AAC9B,QAAI,OAAO;AACX,QAAI,SAAS,UAAa,SAAS,SAAS,MAAM;AACjD,YAAM,KAAK,GACT,QAAQ,2CAA2C,EACnD,KAAK,MAAM,EAAE,EACb,IAAI;AACN,aAAO,EAAE,GAAG,MAAM,KAAK;AAAA,IACxB;AACA,QACC,MAAM,0BAA0B,UAChC,MAAM,0BAA0B,SAAS,uBACxC;AACD,YAAM,KAAK,GACT,QAAQ,8DAA8D,EACtE,KAAK,MAAM,wBAAwB,IAAI,GAAG,EAAE,EAC5C,IAAI;AACN,aAAO;AAAA,QACN,GAAG;AAAA,QACH,uBAAuB,MAAM;AAAA,MAC9B;AAAA,IACD;AACA,WAAO;AAAA,EACR;AAAA,EAEA,MAAM,uBAAsC;AAC3C,UAAM,KAAK,GACT;AAAA,MACA;AAAA,IACD,EACC,MAAK,oBAAI,KAAK,GAAE,YAAY,CAAC,EAC7B,IAAI;AAAA,EACP;AAAA;AAAA,EAIA,MAAM,SAAS,WAAyC;AACvD,UAAM,KAAK,MAAM,KAAK,GACpB;AAAA,MACA;AAAA,IACD,EACC,KAAK,SAAS,EACd,IAAkB;AACpB,YAAQ,GAAG,WAAW,CAAC,GAAG,IAAI,QAAQ;AAAA,EACvC;AAAA,EAEA,MAAM,UACL,WACA,MACkC;AAClC,UAAM,UAAU,MAAM,KAAK,WAAW,SAAS;AAC/C,QAAI,CAAC,QAAS,OAAM,IAAI,MAAM,mBAAmB;AAEjD,UAAM,cAAc,KAAK,KAAK,KAAK;AACnC,UAAM,KAAK,UAAU,EAAE;AACvB,UAAM,YAAY,OAAO,QAAQ,IAAI,IAAI,UAAU,EAAE,CAAC;AACtD,UAAM,UAAU,MAAM,UAAU,SAAS;AAEzC,UAAM,YAAY,UAAU,MAAM,GAAG,EAAE;AACvC,UAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AAEzC,UAAM,KAAK,GACT;AAAA,MACA;AAAA,IACD,EACC,KAAK,IAAI,WAAW,SAAS,WAAW,aAAa,SAAS,EAC9D,IAAI;AAEN,WAAO;AAAA,MACN;AAAA,MACA;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA,WAAW;AAAA,MACX,KAAK;AAAA,MACL,SAAS;AAAA,IACV;AAAA,EACD;AAAA,EAEA,MAAM,UAAU,OAAe,WAAqC;AACnE,UAAM,SAAS,MAAM,KAAK,GACxB;AAAA,MACA;AAAA;AAAA,IAED,EACC,MAAK,oBAAI,KAAK,GAAE,YAAY,GAAG,OAAO,SAAS,EAC/C,IAAI;AACN,YAAQ,OAAO,MAAM,WAAW,KAAK;AAAA,EACtC;AAAA,EAEA,MAAM,cACL,SACuD;AACvD,UAAM,MAAM,MAAM,KAAK,GACrB;AAAA,MACA;AAAA,IACD,EACC,KAAK,OAAO,EACZ,MAA0C;AAC5C,WAAO,MAAM,EAAE,WAAW,IAAI,YAAY,OAAO,IAAI,GAAG,IAAI;AAAA,EAC7D;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,gBAAgB,WAAkC;AACvD,QAAI,CAAC,UAAW;AAChB,UAAM,KAAK,qBAAqB;AAChC,UAAM,UAAU,MAAM,UAAU,SAAS;AACzC,UAAM,WAAW,MAAM,KAAK,GAC1B,QAAQ,+CAA+C,EACvD,KAAK,OAAO,EACZ,MAAsB;AACxB,QAAI,SAAU;AAEd,UAAM,KAAK,UAAU,EAAE;AACvB,UAAM,YAAY,UAAU,MAAM,GAAG,KAAK,IAAI,IAAI,UAAU,MAAM,CAAC;AACnE,UAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,UAAM,KAAK,GACT;AAAA,MACA;AAAA,IACD,EACC,KAAK,IAAI,SAAS,WAAW,SAAS,EACtC,IAAI;AAAA,EACP;AACD;;;ACrJO,IAAM,YAAN,MAAiC;AAAA,EAGvC,YAA6B,IAAgB;AAAhB;AAAA,EAAiB;AAAA,EAFrC,UAAU;AAAA,EAInB,QAAQ,KAA2B;AAClC,WAAO,IAAI,mBAAmB,KAAK,GAAG,QAAQ,GAAG,CAAC;AAAA,EACnD;AAAA,EAEA,MAAM,MACL,YACgD;AAGhD,UAAM,YAAY,WAAW,IAAI,CAAC,MAAM;AACvC,UAAI,EAAE,aAAa,qBAAqB;AACvC,cAAM,IAAI;AAAA,UACT;AAAA,QACD;AAAA,MACD;AACA,aAAO,EAAE,OAAO;AAAA,IACjB,CAAC;AACD,UAAM,UAAU,MAAM,KAAK,GAAG,MAAM,SAAS;AAC7C,WAAO,QAAQ,IAAI,CAAC,OAAO;AAAA,MAC1B,MAAM,EAAE,SAAS,EAAE,MAAM,WAAW,EAAE;AAAA,IACvC,EAAE;AAAA,EACH;AACD;AAUO,IAAM,WAAW,CAAC,QACxB,QAAQ,IAAI,EAAE,IAAI,IAAI,KAAK,IAAI,UAAU,IAAI,EAAE;AAUzC,IAAM,oBAAoB;AAG1B,IAAM,eAAe,CAAC,aAC5B,WACG,aAAa,iBAAiB,aAAa,QAAQ,MACnD,aAAa,iBAAiB;AAE3B,IAAM,gBAA4B;AAAA,EACxC,MAAM;AAAA,EACN,KAAK,MAAM,aAAa;AAAA,EACxB,YAAY,CAAC,UAAU,aAAa,UAAU,KAAK,cAAc;AAAA,EACjE,cAAc,CAAC,UAAU,aAAa,UAAU,KAAK,gBAAgB;AAAA,EACrE,UAAU,CAAC,MAAM,SAAS,gBAAgB,IAAI,MAAM,IAAI;AACzD;AASA,IAAM,2BAA2B;AACjC,IAAM,mBAAmB;AAGlB,IAAM,kBAAkB,CAAC,SAC/B,WAAW,IAAI,KAAK,wBAAwB;AAEtC,IAAM,kBAA8B;AAAA,EAC1C,MAAM;AAAA,EACN,KAAK,MAAM,gBAAgB,gBAAgB;AAAA,EAC3C,YAAY,CAAC,UACZ;AAAA,IACC,GAAG,gBAAgB,OAAO,KAAK;AAAA,EAChC;AAAA,EACD,cAAc,CAAC,UACd;AAAA,IACC,GAAG,gBAAgB,OAAO,KAAK;AAAA,EAChC;AAAA,EACD,UAAU,CAAC,MAAM,SAAS;AACzB,UAAM,MAAM,KACV,QAAQ,SAAS,EAAE,EACnB,QAAQ,UAAU,EAAE,EACpB,QAAQ,YAAY,GAAG;AACzB,WAAO,IAAI,IAAI,gBAAgB,IAAI,QAAQ,MAAM,IAAI,CAAC;AAAA,EACvD;AACD;AAEO,IAAM,aAAa,CAAC,OAC1B,GAAG,WAAW;AAEf,IAAM,UAAU,CAAC,OAA6B;AAC7C,MAAI,CAAC,MAAM,OAAO,OAAO,SAAU,QAAO;AAC1C,QAAM,YAAY;AAKlB,SACC,OAAO,UAAU,YAAY,cAC7B,OAAO,UAAU,UAAU,cAC3B,OAAO,UAAU,SAAS;AAE5B;AAEA,IAAM,qBAAN,MAAM,oBAA2C;AAAA,EAChD,YAA6B,MAA2B;AAA3B;AAAA,EAA4B;AAAA;AAAA;AAAA,EAIzD,SAA8B;AAC7B,WAAO,KAAK;AAAA,EACb;AAAA,EAEA,QAAQ,MAA+B;AACtC,WAAO,IAAI,oBAAmB,KAAK,KAAK,KAAK,GAAG,IAAI,CAAC;AAAA,EACtD;AAAA,EAEA,QAAwD;AACvD,WAAO,KAAK,KAAK,MAAS;AAAA,EAC3B;AAAA,EAEA,MAAM,MAA8D;AACnE,UAAM,IAAI,MAAM,KAAK,KAAK,IAAO;AACjC,WAAO,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE;AAAA,EACnC;AAAA,EAEA,MAAM,MAA8C;AACnD,UAAM,IAAI,MAAM,KAAK,KAAK,IAAI;AAC9B,WAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,WAAW,EAAE,EAAE;AAAA,EAClD;AACD;;;ACjMA,IAAM,eAAe;AACrB,IAAM,oBAAoB;AAO1B,IAAI,YAAY,oBAAI,QAAyC;AAC7D,IAAI,gBAAgB;AAEpB,SAAS,SAAS,OAAwC;AACzD,MAAI,QAAQ,UAAU,IAAI,KAAK;AAC/B,MAAI,CAAC,OAAO;AACX,YAAQ,oBAAI,IAAI;AAChB,cAAU,IAAI,OAAO,KAAK;AAAA,EAC3B;AACA,SAAO;AACR;AAEA,SAAS,UACR,OACA,MACA,KACgB;AAChB,gBAAc,OAAO,GAAG;AACxB,QAAM,QAAQ,MAAM,IAAI,IAAI;AAC5B,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,MAAM,aAAa,KAAK;AAC3B,UAAM,OAAO,IAAI;AACjB,WAAO;AAAA,EACR;AACA,SAAO,MAAM;AACd;AAEA,SAAS,UACR,OACA,MACA,WACA,KACO;AACP,gBAAc,OAAO,GAAG;AACxB,SAAO,MAAM,QAAQ,mBAAmB;AACvC,UAAM,YAAY,MAAM,KAAK,EAAE,KAAK,EAAE;AACtC,QAAI,CAAC,UAAW;AAChB,UAAM,OAAO,SAAS;AAAA,EACvB;AACA,QAAM,IAAI,MAAM,EAAE,WAAW,WAAW,MAAM,aAAa,CAAC;AAC7D;AAEA,SAAS,cAAc,OAAgC,KAAmB;AACzE,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO;AAClC,QAAI,MAAM,aAAa,IAAK,OAAM,OAAO,IAAI;AAAA,EAC9C;AACD;AAGO,SAAS,uBAA6B;AAC5C,cAAY,oBAAI,QAAQ;AACxB,kBAAgB;AACjB;AAeO,SAAS,iBAAiB,QAK9B;AACF,SAAO,OAAO,GAAG,SAAS;AAEzB,QAAI,CAAC,eAAe;AACnB,YAAM,SAAS,EAAE,IAAI,cAAc,EAAE,IAAI;AACzC,UAAI,QAAQ;AACX,cAAMA,SAAQ,IAAI,cAAc,SAAS,EAAE,GAAG,CAAC;AAC/C,YAAI;AACH,gBAAMA,OAAM,gBAAgB,MAAM;AAKlC,0BAAgB;AAAA,QACjB,SAAS,KAAK;AACb,kBAAQ,MAAM,mCAAmC,GAAG;AAAA,QACrD;AAAA,MACD,OAAO;AAEN,wBAAgB;AAAA,MACjB;AAAA,IACD;AAEA,UAAM,SAAS,EAAE,IAAI,OAAO,eAAe,GAAG,QAAQ,eAAe,EAAE;AACvE,UAAM,SAAS,EAAE,IAAI,OAAO,WAAW;AACvC,UAAM,QAAQ,UAAU;AAExB,QAAI,CAAC,OAAO;AACX,UACC,QAAQ,wBACR,EAAE,IAAI,0BAA0B,QAC/B;AACD,UAAE,IAAI,aAAa,SAAS;AAC5B,eAAO,KAAK;AAAA,MACb;AACA,aAAO,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;AAAA,IAC7C;AAEA,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,OAAO,MAAM,UAAU,KAAK;AAClC,UAAM,QACJ,EAAE,IAAI,IAA2C,kBAClD,EAAE,IAAI;AACP,UAAM,QAAQ,SAAS,KAAK;AAC5B,UAAM,SAAS,UAAU,OAAO,MAAM,GAAG;AACzC,QAAI,QAAQ;AACX,QAAE,IAAI,aAAa,MAAM;AACzB,aAAO,KAAK;AAAA,IACb;AAEA,UAAM,QAAQ,IAAI,cAAc,SAAS,EAAE,GAAG,CAAC;AAC/C,UAAM,QAAQ,MAAM,MAAM,cAAc,IAAI;AAC5C,QAAI,CAAC,OAAO;AACX,aAAO,EAAE,KAAK,EAAE,OAAO,eAAe,GAAG,GAAG;AAAA,IAC7C;AAEA,cAAU,OAAO,MAAM,MAAM,WAAW,GAAG;AAC3C,MAAE,IAAI,aAAa,MAAM,SAAS;AAClC,WAAO,KAAK;AAAA,EACb;AACD;","names":["store"]}