@obsunified/collector 2.2.1 → 2.3.0

package/src/lib/eval-cases-store.test.ts

@@ -91,7 +91,7 @@ describe("EvalCasesStore", () => {
 				expect.objectContaining({
 					entityKind: "span",
 					entityId: "trace-1:span-1",
-					route: "#/traces/trace-1#span=span-1",
+					route: "#/traces?trace=trace-1&span=span-1",
 				}),
 			]),
 		);

package/src/lib/eval-cases-store.ts

@@ -3,7 +3,10 @@ import type {
 	EvidenceReferenceContract as EvidenceReferenceContractType,
 	JsonValue,
 } from "@obsunified/types";
-import { EVIDENCE_REFERENCE_CONTRACT } from "@obsunified/types";
+import {
+	dashboardRouteToHref,
+	EVIDENCE_REFERENCE_CONTRACT,
+} from "@obsunified/types";
 import { sourceLinkEvidenceReferences } from "./evidence-references";
 import { randomHex } from "./hash";
 import { parseJsonArray, parseJsonValue } from "./json";
@@ -345,7 +348,10 @@ const evalCaseEvidenceReferences = (evalCase: EvalCase): EvidenceReference[] =>
 			sourceLabel: `Eval case "${evalCase.name}"`,
 			sourceId: evalCase.id,
 			sourceKind: "eval_case",
-			sourceRoute: `#/evaluations?case=${encodeURIComponent(evalCase.id)}`,
+			sourceRoute: dashboardRouteToHref({
+				tab: "evaluations",
+				evaluationId: evalCase.id,
+			}),
 			sourceName: evalCase.name,
 		},
 		evalCase,
@@ -384,7 +390,10 @@ const evalRunEvidenceReferences = (run: EvalRun): EvidenceReference[] => {
 			sourceLabel: `Eval run "${run.id}"`,
 			sourceId: run.id,
 			sourceKind: "eval_run",
-			sourceRoute: `#/evaluations?run=${encodeURIComponent(run.id)}`,
+			sourceRoute: dashboardRouteToHref({
+				tab: "evaluations",
+				evaluationId: run.evalCaseId ?? run.id,
+			}),
 			sourceName: run.sourceEvalCase.name,
 		},
 		run.sourceEvalCase,
@@ -413,7 +422,10 @@ const rowToEvalRun = (row: EvalRunRow): EvalRun => {
 				sourceLabel: `Eval case "${sourceEvalCase.name}"`,
 				sourceId: sourceEvalCase.id,
 				sourceKind: "eval_case",
-				sourceRoute: `#/evaluations?case=${encodeURIComponent(sourceEvalCase.id)}`,
+				sourceRoute: dashboardRouteToHref({
+					tab: "evaluations",
+					evaluationId: sourceEvalCase.id,
+				}),
 				sourceName: sourceEvalCase.name,
 			},
 			sourceEvalCase,

package/src/lib/evidence-references.ts

@@ -10,9 +10,10 @@ import type {
 	EvidenceReference,
 	JsonValue,
 } from "@obsunified/types";
+import { dashboardRouteToHref, hrefForEntity } from "@obsunified/types";
 
 const analysisRoute = (analysisId: string) =>
-	`#/investigate/${encodeURIComponent(analysisId)}`;
+	dashboardRouteToHref({ tab: "investigate", investigationId: analysisId });
 
 export const analysisEvidenceReference = (
 	evidence: AskEvidence,
@@ -103,10 +104,10 @@ const valueFor = (
 };
 
 const traceRoute = (traceId: string) =>
-	`#/traces/${encodeURIComponent(traceId)}`;
+	dashboardRouteToHref({ tab: "traces", traceId });
 
 const spanRoute = (traceId: string, spanId: string) =>
-	`${traceRoute(traceId)}#span=${encodeURIComponent(spanId)}`;
+	dashboardRouteToHref({ tab: "traces", traceId, spanId });
 
 export const evidenceRouteFor = (
 	entityKind: EvidenceEntityKind,
@@ -117,41 +118,48 @@ export const evidenceRouteFor = (
 		case "analysis":
 			return analysisRoute(entityId);
 		case "action":
-			return `#/actions/${encodeURIComponent(entityId)}`;
+			return dashboardRouteToHref({ tab: "actions", actionId: entityId });
 		case "alert":
-			return `#/alerts?alert=${encodeURIComponent(entityId)}`;
+			return dashboardRouteToHref({ tab: "alerts", alertId: entityId });
 		case "agent_run":
-			return `#/agent-runs/${encodeURIComponent(entityId)}`;
+			return dashboardRouteToHref({ tab: "agent-runs", agentRunId: entityId });
 		case "ai_call":
-			return `#/ai/calls/${encodeURIComponent(entityId)}`;
+			return dashboardRouteToHref({ tab: "ai", aiCallId: entityId });
 		case "eval":
-			return `#/evals/${encodeURIComponent(entityId)}`;
+			return dashboardRouteToHref({
+				tab: "evaluations",
+				evaluationId: entityId,
+			});
 		case "log":
-			return `#/logs?id=${encodeURIComponent(entityId)}`;
+			return dashboardRouteToHref({ tab: "logs", logId: entityId });
 		case "profile":
-			return traceId
-				? `#/profiles/${encodeURIComponent(entityId)}?trace_id=${encodeURIComponent(traceId)}`
-				: `#/profiles/${encodeURIComponent(entityId)}`;
+			return dashboardRouteToHref({
+				tab: "profiles",
+				profileId: entityId,
+				...(traceId ? { traceId } : {}),
+			});
 		case "replay":
-			return `#/replay?session=${encodeURIComponent(entityId)}`;
+			return dashboardRouteToHref({ tab: "replay", sessionId: entityId });
 		case "service":
-			return `#/traces?service=${encodeURIComponent(entityId)}`;
+			return dashboardRouteToHref({ tab: "service-map", service: entityId });
 		case "span": {
 			const [tracePart, spanPart] = entityId.split(":");
-			return spanPart ? spanRoute(tracePart, spanPart) : `#/spans/${entityId}`;
+			return spanPart
+				? spanRoute(tracePart, spanPart)
+				: hrefForEntity("span", entityId, traceId ? { traceId } : undefined);
 		}
 		case "tool_call":
-			return `#/tool-calls/${encodeURIComponent(entityId)}`;
+			return dashboardRouteToHref({ tab: "tool-calls", toolCallId: entityId });
 		case "trace":
 			return traceRoute(entityId);
 		case "docs":
-			return entityId.startsWith("#/") ? entityId : `#/docs/${entityId}`;
+			return hrefForEntity("docs", entityId);
 		case "change":
-			return `#/changes/${encodeURIComponent(entityId)}`;
+			return dashboardRouteToHref({ tab: "changes", changeId: entityId });
 		case "finding":
-			return `#/findings/${encodeURIComponent(entityId)}`;
+			return dashboardRouteToHref({ tab: "findings", findingId: entityId });
 		case "incident":
-			return `#/incidents/${encodeURIComponent(entityId)}`;
+			return dashboardRouteToHref({ tab: "incidents", incidentId: entityId });
 	}
 	const exhaustive: never = entityKind;
 	return exhaustive;
@@ -232,7 +240,7 @@ const instrumentationGapEvidenceReferences = (
 			const thresholdText = thresholdVersion
 				? ` Thresholds: ${thresholdVersion}.`
 				: "";
-			const docsRoute = "#/docs/howto/ebpf";
+			const docsRoute = hrefForEntity("docs", "howto/ebpf");
 			return {
 				evidenceId: `analysis:${result.analysisId}:instrumentation-gap:${index}:span:${entityId}`,
 				entityKind: "span",
@@ -262,7 +270,7 @@ const instrumentationGapEvidenceReferences = (
 						label: "Open trace gap data",
 						entityKind: "trace",
 						entityId: traceId,
-						route: `${traceRoute(traceId)}/gaps`,
+						route: traceRoute(traceId),
 						reason:
 							"Review all structured instrumentation blindspots for this trace.",
 					},

package/src/lib/projects-store.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it } from "vitest";
 import { sha256Hex } from "./hash";
-import { ProjectsStore } from "./projects-store";
+import { displayPrefix, ProjectsStore } from "./projects-store";
 import { createMigratedSqliteDb } from "./test-utils/node-sqlite-db";
 
 describe("ProjectsStore.revokeKey", () => {
@@ -23,3 +23,40 @@ describe("ProjectsStore.revokeKey", () => {
 		db.close();
 	});
 });
+
+describe("bootstrap key display prefix", () => {
+	it("never exposes a short bootstrap key in full", async () => {
+		const db = createMigratedSqliteDb();
+		const store = new ProjectsStore(db);
+		await store.bootstrapEnvKey("short-key-12345"); // 15 chars
+		const [key] = (await store.listKeys("default")).filter(
+			(k) => k.name === "bootstrap",
+		);
+		expect(key?.keyPrefix).toBe("short");
+		expect("short-key-12345".startsWith(key?.keyPrefix ?? "")).toBe(true);
+		expect(key?.keyPrefix.length).toBeLessThan("short-key-12345".length);
+		db.close();
+	});
+
+	it("keeps 16 chars for long keys, matching minted keys", () => {
+		expect(displayPrefix("a".repeat(64))).toHaveLength(16);
+		expect(displayPrefix("abc")).toBe("a");
+		expect(displayPrefix("")).toBe("");
+	});
+
+	it("shrinks a legacy full-length prefix on the next bootstrap", async () => {
+		const db = createMigratedSqliteDb();
+		const store = new ProjectsStore(db);
+		await store.bootstrapEnvKey("legacy-key-1234");
+		await db
+			.prepare(`UPDATE ingest_keys SET key_prefix = ? WHERE name = 'bootstrap'`)
+			.bind("legacy-key-1234")
+			.run();
+		await store.bootstrapEnvKey("legacy-key-1234");
+		const [key] = (await store.listKeys("default")).filter(
+			(k) => k.name === "bootstrap",
+		);
+		expect(key?.keyPrefix).toBe("legac");
+		db.close();
+	});
+});

package/src/lib/projects-store.ts

@@ -31,6 +31,15 @@ const rowToKey = (row: IngestKeyRow): IngestKey => ({
 
 const SLUG_PATTERN = /^[a-z0-9]([a-z0-9-]{0,48}[a-z0-9])?$/;
 
+/**
+ * Display identifier for a secret: at most 16 chars (what minted keys show),
+ * but never more than a third of the secret, so a short operator-chosen
+ * INGEST_KEY can never be returned in full by `keys list`.
+ */
+export function displayPrefix(plaintext: string): string {
+	return plaintext.slice(0, Math.min(16, Math.floor(plaintext.length / 3)));
+}
+
 export class ProjectsStore {
 	constructor(private readonly db: SqlDb) {}
 
@@ -189,14 +198,24 @@ export class ProjectsStore {
 		if (!plaintext) return;
 		await this.ensureDefaultProject();
 		const keyHash = await sha256Hex(plaintext);
+		const keyPrefix = displayPrefix(plaintext);
 		const existing = await this.db
-			.prepare(`SELECT id FROM ingest_keys WHERE key_hash = ?`)
+			.prepare(`SELECT id, key_prefix FROM ingest_keys WHERE key_hash = ?`)
 			.bind(keyHash)
-			.first<{ id: string }>();
-		if (existing) return;
+			.first<{ id: string; key_prefix: string }>();
+		if (existing) {
+			// Rows written before the prefix was length-capped may hold a short
+			// bootstrap key in full; shrink them to the safe display prefix.
+			if (existing.key_prefix.length > keyPrefix.length) {
+				await this.db
+					.prepare(`UPDATE ingest_keys SET key_prefix = ? WHERE id = ?`)
+					.bind(keyPrefix, existing.id)
+					.run();
+			}
+			return;
+		}
 
 		const id = randomHex(16);
-		const keyPrefix = plaintext.slice(0, Math.min(16, plaintext.length));
 		const createdAt = new Date().toISOString();
 		await this.db
 			.prepare(

package/src/lib/sql-db-postgres.integration.test.ts

@@ -28,20 +28,22 @@ import type {
 	StoredSpan,
 	UsageEventRecord,
 } from "@obsunified/types";
-import type { MiddlewareHandler } from "hono";
+import { Hono, type MiddlewareHandler } from "hono";
 import { afterAll, beforeAll, describe, expect, it } from "vitest";
 import { deriveAnalysesForProject } from "../analyses/derive";
 import { INVESTIGATION_ANALYSES } from "../analyses/investigations";
 import { TIER0_ANALYSES } from "../analyses/tier0";
 import {
-	type CollectorRuntime,
+	CollectorRuntime,
 	createTelemetryCollectorApp,
 	type SpanProcessorPlugin,
 } from "../framework/collector";
 import type { CollectorEnv, CollectorRouteContext } from "../framework/env";
 import type { DecodedMetricPoint } from "../otlp/decode";
 import { aiSpanPayloadsProcessorPlugin } from "../plugins/ai-span-payloads-processor";
+import { connectedRoutesPlugin } from "../plugins/connected-routes";
 import { identityReceiverPlugin } from "../plugins/identity-receiver";
+import { usageQueryRoutesPlugin } from "../plugins/usage-query-routes";
 import { purgeExpiredActionGraph } from "./action-retention";
 import { ActionStore } from "./actions-store";
 import { getAICallsOverview, ingestAICallBatch } from "./ai-store/calls";
@@ -1222,4 +1224,75 @@ describe.skipIf(!databaseUrl)("PostgresAdapter against a live Postgres", () => {
 		expect(errorRate.primaryValue).toBe(0.5);
 		expect(Array.isArray(errorRate.payload.sparkline)).toBe(true);
 	});
+
+	it("serves the change connected-rail and usage sessions routes without Postgres query errors", async () => {
+		const now = isoNow();
+		const later = isoIn(60 * 60 * 1000);
+		const insertSpan = (spanId: string, startTime: string) =>
+			db
+				.prepare(
+					`INSERT INTO telemetry_spans (
+						project_id, environment, trace_id, span_id, service_name, service_version,
+						span_name, status_code, start_time, end_time, duration_ms, received_at, expires_at
+					) VALUES ('default', 'default', 'trace-pg-1', ?, 'checkout', 'v9.9.9', 'POST /pay', 2, ?, ?, 5, ?, ?)`,
+				)
+				.bind(spanId, startTime, startTime, now, later)
+				.run();
+		await insertSpan("span-pg-a", "2026-01-01T00:00:00.000Z");
+		await insertSpan("span-pg-b", "2026-01-01T00:00:01.000Z");
+		await db
+			.prepare(
+				`INSERT INTO change_events (
+					project_id, environment, id, target_node_id, kind, source, summary,
+					service_name, version, occurred_at, received_at
+				) VALUES ('default', 'default', 'chg-pg-1', 'service:checkout', 'deploy', 'explicit', 'deploy v9.9.9', 'checkout', 'v9.9.9', ?, ?)`,
+			)
+			.bind(now, now)
+			.run();
+		await new UsageStore(db).ingest([
+			usageEvent({
+				eventId: "pg-s1-a",
+				sessionId: "pg-sess-1",
+				pagePath: "/a",
+			}),
+			usageEvent({
+				eventId: "pg-s1-b",
+				sessionId: "pg-sess-1",
+				pagePath: "/b",
+				eventType: "interaction",
+			}),
+		]);
+
+		const app = new Hono<{ Bindings: CollectorEnv }>();
+		const runtime = new CollectorRuntime();
+		connectedRoutesPlugin.register(app, runtime);
+		usageQueryRoutesPlugin.register(app, runtime);
+		const env = { DB: db as unknown as D1Database } as CollectorEnv;
+
+		const change = await app.request(
+			"/internal/connected/change/chg-pg-1",
+			{},
+			env,
+		);
+		expect(change.status).toBe(200);
+		const manifest = (await change.json()) as {
+			across: Array<{ links: Array<{ entityId: string }> }>;
+		};
+		const spanIds = manifest.across.flatMap((s) =>
+			s.links.map((l) => l.entityId),
+		);
+		// Most recent first, one link per span.
+		expect(spanIds).toEqual(["trace-pg-1:span-pg-b", "trace-pg-1:span-pg-a"]);
+
+		const sessions = await app.request(
+			"/internal/usage/sessions?hours=24",
+			{},
+			env,
+		);
+		expect(sessions.status).toBe(200);
+		const body = (await sessions.json()) as {
+			sessions: Array<{ sessionId: string; lastPath: string | null }>;
+		};
+		expect(body.sessions.map((r) => r.sessionId)).toContain("pg-sess-1");
+	});
 });

package/src/lib/stage6.test.ts

@@ -201,7 +201,7 @@ describe("AlertsStore.listEvaluations evidence references", () => {
 				evidenceId: "alert:rule-1:rule",
 				entityKind: "alert",
 				entityId: "rule-1",
-				route: "#/alerts?alert=rule-1",
+				route: "#/alerts?id=rule-1",
 				source: "alerts.rule_evaluation_preview",
 			}),
 			expect.objectContaining({

package/src/lib/usage-store.ts

@@ -503,15 +503,21 @@ export class UsageStore {
 					SUM(CASE WHEN event_type = 'interaction' THEN 1 ELSE 0 END) AS interaction_count,
 					SUM(CASE WHEN event_type = 'frontend_error' OR severity = 'error' THEN 1 ELSE 0 END) AS error_count,
 					MAX(CASE WHEN event_type = 'page_view' THEN CAST(COALESCE(${loadMsExpr}, ${loadTimeMsExpr}, ${durationMsExpr}) AS REAL) ELSE NULL END) AS max_load_ms,
-					(SELECT referrer FROM usage_events ref WHERE ref.project_id = ue.project_id AND ref.session_id = ue.session_id ORDER BY occurred_at ASC LIMIT 1) AS referrer,
-					(SELECT page_path FROM usage_events lp WHERE lp.project_id = ue.project_id AND lp.session_id = ue.session_id ORDER BY occurred_at DESC LIMIT 1) AS last_path
+					(SELECT referrer FROM usage_events ref WHERE ref.project_id = ? AND ref.session_id = ue.session_id ORDER BY occurred_at ASC LIMIT 1) AS referrer,
+					(SELECT page_path FROM usage_events lp WHERE lp.project_id = ? AND lp.session_id = ue.session_id ORDER BY occurred_at DESC LIMIT 1) AS last_path
 				FROM usage_events ue
 				WHERE project_id = ? AND received_at >= ?
 				GROUP BY session_id
 				ORDER BY last_seen DESC
 				LIMIT ?`,
 			)
-			.bind(options.projectId, cutoff, limit * 3)
+			.bind(
+				options.projectId,
+				options.projectId,
+				options.projectId,
+				cutoff,
+				limit * 3,
+			)
 			.all<{
 				session_id: string;
 				visitor_id: string;

package/src/migrations/052_remediation_callback.sql

@@ -0,0 +1,10 @@
+-- Persisted grant-handoff callback (RFC 0013 § 6.B, journey review J17).
+--
+-- A proposal parked for human approval may carry a webhook that receives the
+-- one-time grant token when the approval happens later. `callback_url` is the
+-- target (SSRF-guarded again at delivery time); `callback_secret` is the HMAC
+-- signing secret, stored as supplied (the collector has no at-rest encryption
+-- helper) and never returned by any GET. Both are cleared once the grant is
+-- delivered, rejected or expired.
+ALTER TABLE remediation_proposals ADD COLUMN callback_url TEXT;
+ALTER TABLE remediation_proposals ADD COLUMN callback_secret TEXT;

package/src/migrations/053_remediation_callback_delivery.sql

@@ -0,0 +1,7 @@
+-- Last grant-handoff webhook delivery outcome (RFC 0013 § 6.B).
+--
+-- JSON `{status: 'delivered'|'failed', attempts, lastError, at}` recorded after
+-- the grant webhook is attempted (up to 3 attempts). It never contains the
+-- callback URL or secret, so unlike callback_url it is kept after approval so
+-- the dashboard can flag a failed handoff.
+ALTER TABLE remediation_proposals ADD COLUMN callback_delivery TEXT;

package/src/migrations/parity.test.ts

@@ -8,6 +8,7 @@
 
 import { readdirSync, readFileSync } from "node:fs";
 import path from "node:path";
+import { DatabaseSync } from "node:sqlite";
 import { fileURLToPath } from "node:url";
 import { describe, expect, it } from "vitest";
 
@@ -34,13 +35,74 @@ const RETENTION_TABLES = [
 	"remediation_proposals",
 ];
 
+export function checkMigrationFilePairings(
+	sqliteFiles: readonly string[],
+	postgresFiles: readonly string[],
+): string[] {
+	const errors: string[] = [];
+	const sqliteSet = new Set(sqliteFiles);
+	const pgSet = new Set(postgresFiles);
+	for (const f of sqliteFiles) {
+		if (!pgSet.has(f)) {
+			errors.push(`Missing Postgres migration counterpart for ${f}`);
+		}
+	}
+	for (const f of postgresFiles) {
+		if (!sqliteSet.has(f)) {
+			errors.push(`Missing SQLite migration counterpart for ${f}`);
+		}
+	}
+	const seenPrefixes = new Set<string>();
+	for (const f of sqliteFiles) {
+		const prefix = f.slice(0, 3);
+		if (seenPrefixes.has(prefix)) {
+			errors.push(`Duplicate migration prefix ${prefix} in ${f}`);
+		}
+		seenPrefixes.add(prefix);
+	}
+	return errors;
+}
+
+const extractCreatedTables = (sql: string): string[] => {
+	const names: string[] = [];
+	for (const m of sql.matchAll(
+		/CREATE\s+TABLE(?:\s+IF\s+NOT\s+EXISTS)?\s+([a-zA-Z0-9_]+)/gi,
+	)) {
+		const table = m[1].toLowerCase();
+		if (!table.endsWith("_new")) {
+			names.push(table);
+		}
+	}
+	return [...new Set(names)].sort();
+};
+
+const extractAddedColumns = (sql: string): string[] => {
+	const cols: string[] = [];
+	for (const m of sql.matchAll(
+		/ALTER\s+TABLE\s+([a-zA-Z0-9_]+)\s+ADD\s+COLUMN(?:\s+IF\s+NOT\s+EXISTS)?\s+([a-zA-Z0-9_]+)/gi,
+	)) {
+		cols.push(`${m[1].toLowerCase()}.${m[2].toLowerCase()}`);
+	}
+	return [...new Set(cols)].sort();
+};
+
 describe("migration parity", () => {
-	it("has the same numbered files on SQLite/D1 and Postgres", () => {
+	it("has the same numbered files on SQLite/D1 and Postgres and catches missing pairs", () => {
 		const sqlite = sqlFiles(sqliteDir);
 		const postgres = sqlFiles(postgresDir);
 		expect(postgres).toEqual(sqlite);
-		const prefixes = sqlite.map((f) => f.slice(0, 3));
-		expect(new Set(prefixes).size).toBe(prefixes.length);
+		expect(sqlite.length).toBeGreaterThanOrEqual(53);
+		expect(checkMigrationFilePairings(sqlite, postgres)).toEqual([]);
+
+		// Regression check: missing or duplicate migration files must be flagged.
+		expect(
+			checkMigrationFilePairings([...sqlite, "099_new_feature.sql"], postgres),
+		).toEqual([
+			"Missing Postgres migration counterpart for 099_new_feature.sql",
+		]);
+		expect(
+			checkMigrationFilePairings(sqlite, [...postgres, "099_pg_only.sql"]),
+		).toEqual(["Missing SQLite migration counterpart for 099_pg_only.sql"]);
 	});
 
 	it("declares retention timestamps as TEXT in every Postgres CREATE TABLE", () => {
@@ -65,4 +127,44 @@ describe("migration parity", () => {
 		}
 		expect(offenders).toEqual([]);
 	});
+
+	it("creates and alters the same tables and columns per migration file", () => {
+		const mismatches: string[] = [];
+		for (const file of sqlFiles(sqliteDir)) {
+			const sqliteSql = readFileSync(path.join(sqliteDir, file), "utf8");
+			const pgSql = readFileSync(path.join(postgresDir, file), "utf8");
+			const sTables = extractCreatedTables(sqliteSql);
+			const pTables = extractCreatedTables(pgSql);
+			if (JSON.stringify(sTables) !== JSON.stringify(pTables)) {
+				mismatches.push(
+					`${file} CREATE TABLE mismatch: sqlite=${JSON.stringify(sTables)} pg=${JSON.stringify(pTables)}`,
+				);
+			}
+			const sCols = extractAddedColumns(sqliteSql);
+			const pCols = extractAddedColumns(pgSql);
+			if (JSON.stringify(sCols) !== JSON.stringify(pCols)) {
+				mismatches.push(
+					`${file} ALTER TABLE ADD COLUMN mismatch: sqlite=${JSON.stringify(sCols)} pg=${JSON.stringify(pCols)}`,
+				);
+			}
+		}
+		expect(mismatches).toEqual([]);
+	});
+
+	it("applies all SQLite migrations cleanly in-memory without leftover staging tables", () => {
+		const db = new DatabaseSync(":memory:");
+		try {
+			for (const file of sqlFiles(sqliteDir)) {
+				db.exec(readFileSync(path.join(sqliteDir, file), "utf8"));
+			}
+			const leftover = db
+				.prepare(
+					"SELECT name FROM sqlite_master WHERE type = 'table' AND name LIKE '%_new'",
+				)
+				.all();
+			expect(leftover).toEqual([]);
+		} finally {
+			db.close();
+		}
+	});
 });

package/src/migrations-postgres/052_remediation_callback.sql

@@ -0,0 +1,10 @@
+-- (PostgreSQL mirror) Persisted grant-handoff callback (RFC 0013 § 6.B, journey review J17).
+--
+-- A proposal parked for human approval may carry a webhook that receives the
+-- one-time grant token when the approval happens later. `callback_url` is the
+-- target (SSRF-guarded again at delivery time); `callback_secret` is the HMAC
+-- signing secret, stored as supplied (the collector has no at-rest encryption
+-- helper) and never returned by any GET. Both are cleared once the grant is
+-- delivered, rejected or expired.
+ALTER TABLE remediation_proposals ADD COLUMN IF NOT EXISTS callback_url TEXT;
+ALTER TABLE remediation_proposals ADD COLUMN IF NOT EXISTS callback_secret TEXT;

package/src/migrations-postgres/053_remediation_callback_delivery.sql

@@ -0,0 +1,7 @@
+-- (PostgreSQL mirror) Last grant-handoff webhook delivery outcome (RFC 0013 § 6.B).
+--
+-- JSON `{status: 'delivered'|'failed', attempts, lastError, at}` recorded after
+-- the grant webhook is attempted (up to 3 attempts). It never contains the
+-- callback URL or secret, so unlike callback_url it is kept after approval so
+-- the dashboard can flag a failed handoff.
+ALTER TABLE remediation_proposals ADD COLUMN IF NOT EXISTS callback_delivery TEXT;

package/src/plugins/ai-call-by-id.test.ts

@@ -0,0 +1,73 @@
+import type { MiddlewareHandler } from "hono";
+import { describe, expect, it } from "vitest";
+import { createTelemetryCollectorApp } from "../framework/collector";
+import type { CollectorEnv } from "../framework/env";
+import { MemSqlDb } from "../lib/test-utils/mem-sql-db";
+import { aiReceiverPlugin } from "./ai-receiver";
+
+const passthrough: MiddlewareHandler<{
+	Bindings: CollectorEnv;
+	Variables: { projectId: string };
+}> = async (c, next) => {
+	c.set("projectId", "default");
+	await next();
+};
+
+const app = createTelemetryCollectorApp({
+	plugins: [aiReceiverPlugin],
+	auth: { middleware: passthrough },
+	dashboardAuth: { middleware: passthrough, registerRoutes: () => {} },
+});
+
+const row = {
+	project_id: "default",
+	call_id: "call-1",
+	trace_id: "trace-1",
+	span_id: "span-1",
+	service_name: "svc",
+	model_name: "gpt-4.1",
+	provider: "openai",
+	call_type: "chat",
+	request_json: null,
+	response_json: null,
+	prompt_tokens: 10,
+	completion_tokens: 5,
+	total_cost_usd: 0.01,
+	latency_ms: 120,
+	is_error: 0,
+	error_message: null,
+	occurred_at: "2026-05-01T00:00:00.000Z",
+	received_at: "2026-05-01T00:00:01.000Z",
+	expires_at: "2026-05-02T00:00:00.000Z",
+};
+
+describe("GET /internal/ai/calls/:callId", () => {
+	it("returns the call with its trace and span ids", async () => {
+		const db = new MemSqlDb({
+			first: (sql, binds) =>
+				sql.includes("FROM ai_calls") && binds[1] === "call-1" ? row : null,
+		});
+		const res = await app.request("/internal/ai/calls/call-1", {}, {
+			DB: db,
+		} as unknown as CollectorEnv);
+		expect(res.status).toBe(200);
+		const body = (await res.json()) as {
+			call: { callId: string; modelName: string };
+			traceId: string;
+			spanId: string;
+		};
+		expect(body.call.callId).toBe("call-1");
+		expect(body.call.modelName).toBe("gpt-4.1");
+		expect(body.traceId).toBe("trace-1");
+		expect(body.spanId).toBe("span-1");
+		expect(db.calls[0].binds).toEqual(["default", "call-1"]);
+	});
+
+	it("answers 404 for an unknown call id", async () => {
+		const db = new MemSqlDb({ first: () => null });
+		const res = await app.request("/internal/ai/calls/nope", {}, {
+			DB: db,
+		} as unknown as CollectorEnv);
+		expect(res.status).toBe(404);
+	});
+});

package/src/plugins/ai-receiver.ts

@@ -16,6 +16,7 @@ import { AIStore, type IngestEvaluation } from "../lib/ai-store";
 import { sqlDbFor } from "../lib/sql-db";
 import { getProjectId } from "./_context";
 import { readJsonObject } from "./_json";
+import { respondWithContract } from "./autosre-routes";
 
 export const aiReceiverPlugin: CollectorPlugin = {
 	name: "ai-receiver",
@@ -97,6 +98,20 @@ export const aiReceiverPlugin: CollectorPlugin = {
 			return c.json(response);
 		});
 
+		// One AI call by its call id, with the trace/span it belongs to. Backs
+		// the `#/ai/calls/<id>` deep link when the call is outside the loaded list.
+		app.get("/internal/ai/calls/:callId", async (c) => {
+			const projectId = getProjectId(c);
+			const store = new AIStore(sqlDbFor(c.env));
+			const call = await store.getAICall(projectId, c.req.param("callId"));
+			if (!call) return c.json({ error: "AI call not found" }, 404);
+			return respondWithContract(c, "GET /internal/ai/calls/:callId", {
+				call,
+				traceId: call.traceId,
+				spanId: call.spanId,
+			});
+		});
+
 		// OpenInference-kind spans (LLM/TOOL/RETRIEVER/CHAIN/AGENT/...) joined
 		// with their payload side-table. This is the replacement for the flat
 		// ai_calls endpoint — it returns typed spans that live inside the