@plumix/core 0.3.0 → 0.5.0

package/dist/auth/authenticator.d.ts

@@ -1,4 +1,4 @@
-import type { Db } from "../context/app.js";
+import type { AppContext, Db } from "../context/app.js";
 import type { User } from "../db/schema/users.js";
 /**
  * Resolved auth on a request — the user plus any guard-specific
@@ -87,6 +87,13 @@ export interface RequestAuthenticator {
  * caps. PAT-style scoping doesn't apply here.
  */
 export declare function sessionAuthenticator(): RequestAuthenticator;
+/**
+ * Run an authenticator inside an `auth` telemetry span, so session/token
+ * resolution shows up in the request's span tree with its outcome. The
+ * single traced entry point for every auth choke point — public render,
+ * admin shell, RPC middleware, and the bearer surfaces (MCP, REST).
+ */
+export declare function authenticateTraced(ctx: AppContext, authenticator: RequestAuthenticator): Promise<AuthResult | null>;
 /**
  * Whether a request carries a session this authenticator would resolve on a
  * public render. Defaults to "the standard `plumix_session` cookie is present"

package/dist/auth/authenticator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"authenticator.d.ts","sourceRoot":"","sources":["../../src/auth/authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAKlD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;CACjD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,oBAAoB;IACnC,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnE;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;IACvC;;;;;;;;;;;;;;;;;OAiBG;IACH,UAAU,CAAC,IAAI,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,IAAI,oBAAoB,CAa3D;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,oBAAoB,EACnC,OAAO,EAAE,OAAO,GACf,OAAO,CAIT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,IAAI,oBAAoB,CAuB5D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,cAAc,EAAE,SAAS,oBAAoB,EAAE,GACjD,oBAAoB,CAoBtB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,oBAAoB,CAE3D"}
+{"version":3,"file":"authenticator.d.ts","sourceRoot":"","sources":["../../src/auth/authenticator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,uBAAuB,CAAC;AAKlD;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;CACjD;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,WAAW,oBAAoB;IACnC,YAAY,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,GAAG,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAC;IACnE;;;;;;;;;;;OAWG;IACH,UAAU,CAAC,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC;IACvC;;;;;;;;;;;;;;;;;OAiBG;IACH,UAAU,CAAC,IAAI,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,IAAI,oBAAoB,CAa3D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAChC,GAAG,EAAE,UAAU,EACf,aAAa,EAAE,oBAAoB,GAClC,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAO5B;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE,oBAAoB,EACnC,OAAO,EAAE,OAAO,GACf,OAAO,CAIT;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,qBAAqB,IAAI,oBAAoB,CAuB5D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,cAAc,EAAE,SAAS,oBAAoB,EAAE,GACjD,oBAAoB,CAoBtB;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,oBAAoB,CAE3D"}

package/dist/auth/authenticator.js

@@ -25,6 +25,21 @@ export function sessionAuthenticator() {
         },
     };
 }
+/**
+ * Run an authenticator inside an `auth` telemetry span, so session/token
+ * resolution shows up in the request's span tree with its outcome. The
+ * single traced entry point for every auth choke point — public render,
+ * admin shell, RPC middleware, and the bearer surfaces (MCP, REST).
+ */
+export function authenticateTraced(ctx, authenticator) {
+    return ctx.telemetry.span("auth", async (s) => {
+        const result = await authenticator.authenticate(ctx.request, ctx.db);
+        s.set("auth.authenticated", result !== null);
+        if (result)
+            s.set("auth.user.id", result.user.id);
+        return result;
+    });
+}
 /**
  * Whether a request carries a session this authenticator would resolve on a
  * public render. Defaults to "the standard `plumix_session` cookie is present"

package/dist/auth/authenticator.js.map

@@ -1 +1 @@
-{"version":3,"file":"authenticator.js","sourceRoot":"","sources":["../../src/auth/authenticator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAkFhD;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE;YAC5B,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACnD,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC5B,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;QAClC,CAAC;QACD,UAAU,CAAC,OAAO;YAChB,OAAO,iBAAiB,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;QAC7C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,aAAmC,EACnC,OAAgB;IAEhB,OAAO,CACL,aAAa,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,KAAK,IAAI,CAC3E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7B,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACvD,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC5B,OAAO;gBACL,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,0DAA0D;gBAC1D,sDAAsD;gBACtD,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI;aAC5C,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,0EAA0E;QAC1E,2EAA2E;QAC3E,UAAU;YACR,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAG,cAA+C;IAElD,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE;YAC5B,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;gBAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBACpD,IAAI,MAAM;oBAAE,OAAO,MAAM,CAAC;YAC5B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,UAAU,CAAC,OAAO;YAChB,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,UAAU;YACR,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,IAAI,CAAC;gBACxC,IAAI,GAAG;oBAAE,OAAO,GAAG,CAAC;YACtB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,mBAAmB,CAAC,oBAAoB,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"authenticator.js","sourceRoot":"","sources":["../../src/auth/authenticator.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,eAAe,CAAC;AAkFhD;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE;YAC5B,MAAM,KAAK,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxB,MAAM,SAAS,GAAG,MAAM,eAAe,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACnD,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC5B,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,CAAC;QAClC,CAAC;QACD,UAAU,CAAC,OAAO;YAChB,OAAO,iBAAiB,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;QAC7C,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAChC,GAAe,EACf,aAAmC;IAEnC,OAAO,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC5C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC,CAAC,GAAG,CAAC,oBAAoB,EAAE,MAAM,KAAK,IAAI,CAAC,CAAC;QAC7C,IAAI,MAAM;YAAE,CAAC,CAAC,GAAG,CAAC,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,aAAmC,EACnC,OAAgB;IAEhB,OAAO,CACL,aAAa,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,iBAAiB,CAAC,OAAO,CAAC,KAAK,IAAI,CAC3E,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,qBAAqB;IACnC,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE;YAC5B,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YACpD,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,MAAM,KAAK,GAAG,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC/C,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7B,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YACvD,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC5B,OAAO;gBACL,IAAI,EAAE,SAAS,CAAC,IAAI;gBACpB,0DAA0D;gBAC1D,sDAAsD;gBACtD,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,MAAM,IAAI,IAAI;aAC5C,CAAC;QACJ,CAAC;QACD,qEAAqE;QACrE,0EAA0E;QAC1E,2EAA2E;QAC3E,UAAU;YACR,OAAO,KAAK,CAAC;QACf,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAG,cAA+C;IAElD,OAAO;QACL,KAAK,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE;YAC5B,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;gBAClC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBACpD,IAAI,MAAM;oBAAE,OAAO,MAAM,CAAC;YAC5B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,UAAU,CAAC,OAAO;YAChB,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,iBAAiB,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACzE,CAAC;QACD,UAAU;YACR,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;gBAClC,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,EAAE,IAAI,IAAI,CAAC;gBACxC,IAAI,GAAG;oBAAE,OAAO,GAAG,CAAC;YACtB,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB;IAClC,OAAO,mBAAmB,CAAC,oBAAoB,EAAE,EAAE,qBAAqB,EAAE,CAAC,CAAC;AAC9E,CAAC"}

package/dist/auth/bearer.js

@@ -1,5 +1,5 @@
 import { withUser } from "../context/app.js";
-import { apiTokenAuthenticator } from "./authenticator.js";
+import { apiTokenAuthenticator, authenticateTraced } from "./authenticator.js";
 // Bearer PAT only — shared by the CSRF-exempt external surfaces (MCP, REST).
 // Deliberately NOT the request's configured authenticator (cookie/custom
 // guard): cookie auth must never resolve on an endpoint mounted ahead of the
@@ -19,7 +19,7 @@ export function hasBearerToken(request) {
  * disabled. Callers decide whether a null means 401 or anonymous access.
  */
 export async function authenticateBearer(ctx) {
-    const result = await bearerAuthenticator.authenticate(ctx.request, ctx.db);
+    const result = await authenticateTraced(ctx, bearerAuthenticator);
     if (!result)
         return null;
     const { id, email, role, meta } = result.user;

package/dist/auth/bearer.js.map

@@ -1 +1 @@
-{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAE3D,6EAA6E;AAC7E,yEAAyE;AACzE,6EAA6E;AAC7E,+DAA+D;AAC/D,MAAM,mBAAmB,GAAG,qBAAqB,EAAE,CAAC;AAEpD,+EAA+E;AAC/E,6EAA6E;AAC7E,gFAAgF;AAChF,8BAA8B;AAC9B,MAAM,MAAM,GAAG,eAAe,CAAC;AAE/B,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAe;IAEf,MAAM,MAAM,GAAG,MAAM,mBAAmB,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IAC9C,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;AAC9E,CAAC"}
+{"version":3,"file":"bearer.js","sourceRoot":"","sources":["../../src/auth/bearer.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAE/E,6EAA6E;AAC7E,yEAAyE;AACzE,6EAA6E;AAC7E,+DAA+D;AAC/D,MAAM,mBAAmB,GAAG,qBAAqB,EAAE,CAAC;AAEpD,+EAA+E;AAC/E,6EAA6E;AAC7E,gFAAgF;AAChF,8BAA8B;AAC9B,MAAM,MAAM,GAAG,eAAe,CAAC;AAE/B,MAAM,UAAU,cAAc,CAAC,OAAgB;IAC7C,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,CAAC;AACjE,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,GAAe;IAEf,MAAM,MAAM,GAAG,MAAM,kBAAkB,CAAC,GAAG,EAAE,mBAAmB,CAAC,CAAC;IAClE,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IAC9C,OAAO,QAAQ,CAAC,GAAG,EAAE,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC;AAC9E,CAAC"}

package/dist/auth/bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../src/auth/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAI5D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,wBAAsB,aAAa,CACjC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE;IACL,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC,GACA,OAAO,CAAC,gBAAgB,CAAC,CAwB3B"}
+{"version":3,"file":"bootstrap.d.ts","sourceRoot":"","sources":["../../src/auth/bootstrap.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,EAAE,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAK5D,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;CAChC;AAED,wBAAsB,aAAa,CACjC,EAAE,EAAE,EAAE,EACN,KAAK,EAAE;IACL,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC,GACA,OAAO,CAAC,gBAAgB,CAAC,CA0C3B"}

package/dist/auth/bootstrap.js

@@ -1,27 +1,44 @@
-import { sql } from "../db/index.js";
+import { isUniqueConstraintErrorOn, sql } from "../db/index.js";
 import { users } from "../db/schema/users.js";
+import { deriveUserSlug, MAX_SLUG_ATTEMPTS } from "../users/slug.js";
 export async function provisionUser(db, input) {
     const defaultRole = input.defaultRole ?? "subscriber";
-    // Role is decided inside the INSERT so concurrent first-user provisioning
-    // can't elect two admins: SQLite serializes writers, and the subquery
-    // observes previously-inserted rows. Only the statement that runs when
-    // the table is empty gets `admin`.
-    const [user] = await db
-        .insert(users)
-        .values({
-        email: input.email,
-        name: input.name ?? null,
-        avatarUrl: input.avatarUrl ?? null,
-        role: sql `CASE WHEN (SELECT COUNT(*) FROM ${users}) = 0 THEN 'admin' ELSE ${defaultRole} END`,
-        emailVerifiedAt: input.emailVerified ? new Date() : null,
-    })
-        .returning();
-    // eslint-disable-next-line no-restricted-syntax -- defensive driver-regression guard; migrate alongside auth errors in PR 2 (#234)
-    if (!user)
-        throw new Error("provisionUser: insert returned no row");
-    return {
-        user,
-        bootstrapped: user.role === "admin" && defaultRole !== "admin",
-    };
+    for (let attempt = 1;; attempt++) {
+        const slug = await deriveUserSlug(db, input.name);
+        // Role is decided inside the INSERT so concurrent first-user provisioning
+        // can't elect two admins: SQLite serializes writers, and the subquery
+        // observes previously-inserted rows. Only the statement that runs when
+        // the table is empty gets `admin`.
+        let user;
+        try {
+            [user] = await db
+                .insert(users)
+                .values({
+                email: input.email,
+                slug,
+                name: input.name ?? null,
+                avatarUrl: input.avatarUrl ?? null,
+                role: sql `CASE WHEN (SELECT COUNT(*) FROM ${users}) = 0 THEN 'admin' ELSE ${defaultRole} END`,
+                emailVerifiedAt: input.emailVerified ? new Date() : null,
+            })
+                .returning();
+        }
+        catch (error) {
+            // Only a slug race is retryable; an email collision is a real conflict
+            // the caller must see, so re-throw it (and any other error) as-is.
+            if (attempt < MAX_SLUG_ATTEMPTS &&
+                isUniqueConstraintErrorOn(error, "users.slug")) {
+                continue;
+            }
+            throw error;
+        }
+        // eslint-disable-next-line no-restricted-syntax -- defensive driver-regression guard; migrate alongside auth errors in PR 2 (#234)
+        if (!user)
+            throw new Error("provisionUser: insert returned no row");
+        return {
+            user,
+            bootstrapped: user.role === "admin" && defaultRole !== "admin",
+        };
+    }
 }
 //# sourceMappingURL=bootstrap.js.map

package/dist/auth/bootstrap.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/auth/bootstrap.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAO9C,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAM,EACN,KAMC;IAED,MAAM,WAAW,GAAa,KAAK,CAAC,WAAW,IAAI,YAAY,CAAC;IAEhE,0EAA0E;IAC1E,sEAAsE;IACtE,uEAAuE;IACvE,mCAAmC;IACnC,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;SACpB,MAAM,CAAC,KAAK,CAAC;SACb,MAAM,CAAC;QACN,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;QACxB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;QAClC,IAAI,EAAE,GAAG,CAAU,mCAAmC,KAAK,2BAA2B,WAAW,MAAM;QACvG,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;KACzD,CAAC;SACD,SAAS,EAAE,CAAC;IAEf,mIAAmI;IACnI,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;IACpE,OAAO;QACL,IAAI;QACJ,YAAY,EAAE,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,WAAW,KAAK,OAAO;KAC/D,CAAC;AACJ,CAAC"}
+{"version":3,"file":"bootstrap.js","sourceRoot":"","sources":["../../src/auth/bootstrap.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,yBAAyB,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AAOrE,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,EAAM,EACN,KAMC;IAED,MAAM,WAAW,GAAa,KAAK,CAAC,WAAW,IAAI,YAAY,CAAC;IAEhE,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,EAAE,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAElD,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,mCAAmC;QACnC,IAAI,IAAsB,CAAC;QAC3B,IAAI,CAAC;YACH,CAAC,IAAI,CAAC,GAAG,MAAM,EAAE;iBACd,MAAM,CAAC,KAAK,CAAC;iBACb,MAAM,CAAC;gBACN,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,IAAI;gBACJ,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI;gBACxB,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;gBAClC,IAAI,EAAE,GAAG,CAAU,mCAAmC,KAAK,2BAA2B,WAAW,MAAM;gBACvG,eAAe,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI;aACzD,CAAC;iBACD,SAAS,EAAE,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,uEAAuE;YACvE,mEAAmE;YACnE,IACE,OAAO,GAAG,iBAAiB;gBAC3B,yBAAyB,CAAC,KAAK,EAAE,YAAY,CAAC,EAC9C,CAAC;gBACD,SAAS;YACX,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;QAED,mIAAmI;QACnI,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QACpE,OAAO;YACL,IAAI;YACJ,YAAY,EAAE,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,WAAW,KAAK,OAAO;SAC/D,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/cache/decision.d.ts

@@ -18,11 +18,15 @@ interface CacheableRequest {
  * would outlive the token's authorization window in the edge cache.
  */
 export declare function requestIsPrivileged(request: Request): boolean;
+/** Why the edge cache refused to participate in a request. */
+export type CacheBypassReason = "method" | "privileged" | "intent";
 /**
- * Whether the edge cache may participate in this request at all — the gate for
- * both reading a stored response and storing a fresh one.
+ * The gate for whether the edge cache may participate in this request at all —
+ * both reading a stored response and storing a fresh one. Returns `null` when
+ * the request is cacheable, otherwise the first failing check — the reason the
+ * telemetry `cache` record carries.
  */
-export declare function requestIsCacheable(req: CacheableRequest): boolean;
+export declare function cacheBypassReason(req: CacheableRequest): CacheBypassReason | null;
 /**
  * Whether a rendered response may be written to the edge cache. Only a `200`
  * is a complete public document worth storing; redirects and errors are never

package/dist/cache/decision.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"decision.d.ts","sourceRoot":"","sources":["../../src/cache/decision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAatD,UAAU,gBAAgB;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC1C;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAI7D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAIjE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAE1E"}
+{"version":3,"file":"decision.d.ts","sourceRoot":"","sources":["../../src/cache/decision.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAatD,UAAU,gBAAgB;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;CAC1C;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAI7D;AAED,8DAA8D;AAC9D,MAAM,MAAM,iBAAiB,GAAG,QAAQ,GAAG,YAAY,GAAG,QAAQ,CAAC;AAEnE;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAC/B,GAAG,EAAE,gBAAgB,GACpB,iBAAiB,GAAG,IAAI,CAI1B;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAE1E"}

package/dist/cache/decision.js

@@ -25,15 +25,17 @@ export function requestIsPrivileged(request) {
     return new URL(request.url).searchParams.has("preview");
 }
 /**
- * Whether the edge cache may participate in this request at all — the gate for
- * both reading a stored response and storing a fresh one.
+ * The gate for whether the edge cache may participate in this request at all —
+ * both reading a stored response and storing a fresh one. Returns `null` when
+ * the request is cacheable, otherwise the first failing check — the reason the
+ * telemetry `cache` record carries.
  */
-export function requestIsCacheable(req) {
+export function cacheBypassReason(req) {
     if (req.method !== "GET" && req.method !== "HEAD")
-        return false;
+        return "method";
     if (req.isPrivileged)
-        return false;
-    return CACHEABLE_INTENTS.has(req.intentKind);
+        return "privileged";
+    return CACHEABLE_INTENTS.has(req.intentKind) ? null : "intent";
 }
 /**
  * Whether a rendered response may be written to the edge cache. Only a `200`

package/dist/cache/decision.js.map

@@ -1 +1 @@
-{"version":3,"file":"decision.js","sourceRoot":"","sources":["../../src/cache/decision.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,+EAA+E;AAC/E,8EAA8E;AAC9E,sDAAsD;AACtD,MAAM,iBAAiB,GAAqC,IAAI,GAAG,CAAC;IAClE,QAAQ;IACR,SAAS;IACT,UAAU;IACV,YAAY;CACb,CAAC,CAAC;AAYH;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,IAAI,iBAAiB,CAAC,OAAO,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC1D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAqB;IACtD,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAChE,IAAI,GAAG,CAAC,YAAY;QAAE,OAAO,KAAK,CAAC;IACnC,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,MAAc;IAC/D,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5C,CAAC"}
+{"version":3,"file":"decision.js","sourceRoot":"","sources":["../../src/cache/decision.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,+EAA+E;AAC/E,8EAA8E;AAC9E,sDAAsD;AACtD,MAAM,iBAAiB,GAAqC,IAAI,GAAG,CAAC;IAClE,QAAQ;IACR,SAAS;IACT,UAAU;IACV,YAAY;CACb,CAAC,CAAC;AAYH;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAgB;IAClD,IAAI,iBAAiB,CAAC,OAAO,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QAAE,OAAO,IAAI,CAAC;IACtD,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;AAC1D,CAAC;AAKD;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAC/B,GAAqB;IAErB,IAAI,GAAG,CAAC,MAAM,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,QAAQ,CAAC;IACnE,IAAI,GAAG,CAAC,YAAY;QAAE,OAAO,YAAY,CAAC;IAC1C,OAAO,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAc,EAAE,MAAc;IAC/D,OAAO,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,GAAG,CAAC;AAC5C,CAAC"}

package/dist/cache/read-through.d.ts

@@ -1,4 +1,5 @@
 import type { DeferFn } from "../context/app.js";
+import type { TelemetryCollector } from "../context/telemetry.js";
 import type { RouteIntent } from "../route/intent.js";
 import type { ConnectedCache } from "../runtime/slots.js";
 interface ReadThroughArgs {
@@ -10,6 +11,8 @@ interface ReadThroughArgs {
     readonly intentKind: RouteIntent["kind"] | null;
     readonly cache: ConnectedCache;
     readonly defer: DeferFn;
+    /** Records the cache decision + reason as a durationless `cache` fact. */
+    readonly telemetry: TelemetryCollector;
     /** Renders the page live. Called once on a miss, never on a hit. */
     readonly render: () => Promise<Response>;
     /**

package/dist/cache/read-through.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"read-through.d.ts","sourceRoot":"","sources":["../../src/cache/read-through.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAO1D,UAAU,eAAe;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;CACxC;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsB1E"}
+{"version":3,"file":"read-through.d.ts","sourceRoot":"","sources":["../../src/cache/read-through.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AACjD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAO1D,UAAU,eAAe;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,UAAU,EAAE,WAAW,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,0EAA0E;IAC1E,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,oEAAoE;IACpE,QAAQ,CAAC,MAAM,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzC;;;OAGG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;CACxC;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CA6B1E"}

package/dist/cache/read-through.js

@@ -1,4 +1,4 @@
-import { requestIsCacheable, requestIsPrivileged, responseIsStorable, } from "./decision.js";
+import { cacheBypassReason, requestIsPrivileged, responseIsStorable, } from "./decision.js";
 /**
  * Serve a public page through the edge cache: return a stored response on a
  * hit, otherwise render live and store the result when it's cacheable. The
@@ -7,20 +7,27 @@ import { requestIsCacheable, requestIsPrivileged, responseIsStorable, } from "./
  * and touch the cache not at all.
  */
 export async function readThrough(args) {
-    const { request, intentKind, cache, defer, render, tags } = args;
-    if (intentKind === null ||
-        !requestIsCacheable({
+    const { request, intentKind, cache, defer, telemetry, render, tags } = args;
+    const reason = intentKind === null
+        ? "no-route"
+        : cacheBypassReason({
             method: request.method,
             isPrivileged: requestIsPrivileged(request),
             intentKind,
-        })) {
+        });
+    if (reason !== null) {
+        telemetry.record("cache", { decision: "bypass", reason });
         return render();
     }
     const hit = await cache.match(request);
-    if (hit)
+    if (hit) {
+        telemetry.record("cache", { decision: "hit" });
         return hit;
+    }
     const fresh = await render();
-    if (responseIsStorable(request.method, fresh.status)) {
+    const stored = responseIsStorable(request.method, fresh.status);
+    telemetry.record("cache", { decision: "miss", stored });
+    if (stored) {
         defer(cache.put(request, fresh.clone(), tags()));
     }
     return fresh;

package/dist/cache/read-through.js.map

@@ -1 +1 @@
-{"version":3,"file":"read-through.js","sourceRoot":"","sources":["../../src/cache/read-through.ts"],"names":[],"mappings":"AAGA,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAoBvB;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAqB;IACrD,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IAEjE,IACE,UAAU,KAAK,IAAI;QACnB,CAAC,kBAAkB,CAAC;YAClB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,YAAY,EAAE,mBAAmB,CAAC,OAAO,CAAC;YAC1C,UAAU;SACX,CAAC,EACF,CAAC;QACD,OAAO,MAAM,EAAE,CAAC;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IAEpB,MAAM,KAAK,GAAG,MAAM,MAAM,EAAE,CAAC;IAC7B,IAAI,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACrD,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"read-through.js","sourceRoot":"","sources":["../../src/cache/read-through.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,iBAAiB,EACjB,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,eAAe,CAAC;AAsBvB;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAqB;IACrD,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC;IAE5E,MAAM,MAAM,GACV,UAAU,KAAK,IAAI;QACjB,CAAC,CAAC,UAAU;QACZ,CAAC,CAAC,iBAAiB,CAAC;YAChB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,YAAY,EAAE,mBAAmB,CAAC,OAAO,CAAC;YAC1C,UAAU;SACX,CAAC,CAAC;IACT,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAC1D,OAAO,MAAM,EAAE,CAAC;IAClB,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvC,IAAI,GAAG,EAAE,CAAC;QACR,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC;QAC/C,OAAO,GAAG,CAAC;IACb,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,MAAM,EAAE,CAAC;IAC7B,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IAChE,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IACxD,IAAI,MAAM,EAAE,CAAC;QACX,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/cache/tags.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tags.d.ts","sourceRoot":"","sources":["../../src/cache/tags.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAKtD,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,UAAU,cAAc;IACtB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/C,mEAAmE;IACnE,QAAQ,CAAC,mBAAmB,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IACtD,kDAAkD;IAClD,QAAQ,CAAC,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAC;CACtE;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,EAAE,CAgB1D;AAED,yEAAyE;AACzE,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAE3E;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAE7E"}
+{"version":3,"file":"tags.d.ts","sourceRoot":"","sources":["../../src/cache/tags.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAKtD,wBAAgB,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAEjD;AAED,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED,UAAU,cAAc;IACtB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IAC/C,mEAAmE;IACnE,QAAQ,CAAC,mBAAmB,EAAE,MAAM,SAAS,MAAM,EAAE,CAAC;IACtD,kDAAkD;IAClD,QAAQ,CAAC,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,SAAS,MAAM,EAAE,CAAC;CACtE;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,cAAc,GAAG,MAAM,EAAE,CAyB1D;AAED,yEAAyE;AACzE,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAE3E;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,kBAAkB,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,EAAE,CAE7E"}

package/dist/cache/tags.js

@@ -27,7 +27,16 @@ export function pageTags(sources) {
             return sources.frontPageEntryTypes().map(typeTag);
         case "taxonomy":
             return sources.taxonomyEntryTypes(intent.taxonomy).map(typeTag);
+        case "author":
+        case "date":
+            // Author and date archives list the same public, non-hierarchical type
+            // set as the front page, so any publish of those types can change them.
+            return sources.frontPageEntryTypes().map(typeTag);
+        case "custom":
         case "search":
+            // A plugin archive's content dependencies are unknown to core (as search
+            // results are), so it carries no coarse type tags — the plugin manages
+            // its own invalidation if it edge-caches.
             return [];
     }
 }

package/dist/cache/tags.js.map

@@ -1 +1 @@
-{"version":3,"file":"tags.js","sourceRoot":"","sources":["../../src/cache/tags.ts"],"names":[],"mappings":"AAGA,8EAA8E;AAC9E,+EAA+E;AAC/E,2EAA2E;AAC3E,MAAM,UAAU,OAAO,CAAC,SAAiB;IACvC,OAAO,KAAK,SAAS,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AAChC,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAuB;IAC9C,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAC3C,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,QAAQ;YACX,OAAO,cAAc,EAAE,IAAI,KAAK,OAAO;gBACrC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;gBAC1D,CAAC,CAAC,EAAE,CAAC;QACT,KAAK,SAAS;YACZ,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACrC,KAAK,YAAY;YACf,OAAO,OAAO,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpD,KAAK,UAAU;YACb,OAAO,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClE,KAAK,QAAQ;YACX,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,OAAe;IAC/D,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,kBAAqC;IACjE,OAAO,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC"}
+{"version":3,"file":"tags.js","sourceRoot":"","sources":["../../src/cache/tags.ts"],"names":[],"mappings":"AAGA,8EAA8E;AAC9E,+EAA+E;AAC/E,2EAA2E;AAC3E,MAAM,UAAU,OAAO,CAAC,SAAiB;IACvC,OAAO,KAAK,SAAS,EAAE,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,QAAQ,CAAC,OAAe;IACtC,OAAO,KAAK,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;AAChC,CAAC;AAWD;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,OAAuB;IAC9C,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC;IAC3C,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,KAAK,QAAQ;YACX,OAAO,cAAc,EAAE,IAAI,KAAK,OAAO;gBACrC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;gBAC1D,CAAC,CAAC,EAAE,CAAC;QACT,KAAK,SAAS;YACZ,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC;QACrC,KAAK,YAAY;YACf,OAAO,OAAO,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpD,KAAK,UAAU;YACb,OAAO,OAAO,CAAC,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAClE,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM;YACT,uEAAuE;YACvE,wEAAwE;YACxE,OAAO,OAAO,CAAC,mBAAmB,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACpD,KAAK,QAAQ,CAAC;QACd,KAAK,QAAQ;YACX,yEAAyE;YACzE,uEAAuE;YACvE,0CAA0C;YAC1C,OAAO,EAAE,CAAC;IACd,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,OAAe;IAC/D,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;AACjD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,kBAAqC;IACjE,OAAO,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACzC,CAAC"}

package/dist/config.d.ts

@@ -2,6 +2,7 @@ import type { HtmlAllowlistOverride } from "@plumix/blocks";
 import type { RemotePattern } from "@plumix/blocks/renderer";
 import type { PlumixAuthConfig } from "./auth/config.js";
 import type { MailerInput } from "./auth/mailer/resolve.js";
+import type { TelemetryConfig } from "./context/telemetry.js";
 import type { DebugBarInput } from "./debug-bar/config.js";
 import type { I18nInput, ResolvedI18n } from "./i18n/locale-registry.js";
 import type { PluginDescriptor } from "./plugin/define.js";
@@ -98,6 +99,13 @@ export interface PlumixConfigInput {
      * to suppress it or `{ disable: [...] }` to silence individual panels.
      */
     readonly debugBar?: DebugBarInput;
+    /**
+     * Telemetry consumers, registered once here. Each consumer head-samples
+     * per request and receives a serializable snapshot post-response; with no
+     * consumers the collector stays a no-op and production pays nothing. The
+     * dev debug bar registers itself as the first consumer automatically.
+     */
+    readonly telemetry?: TelemetryConfig;
     /**
      * Block-system configuration. Today only exposes the operator-
      * configurable `core/html` allowlist override; future block-level
@@ -137,6 +145,7 @@ export interface PlumixConfig {
     readonly mcp?: InterfaceToggle;
     readonly api?: ApiConfig;
     readonly debugBar?: DebugBarInput;
+    readonly telemetry?: TelemetryConfig;
     readonly blocks?: {
         readonly htmlAllowlist?: HtmlAllowlistOverride;
     };

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EACV,aAAa,EACb,eAAe,EACf,aAAa,EACb,EAAE,EACF,aAAa,EACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAMlD;;;;GAIG;AACH,MAAM,MAAM,KAAK,GAAG,eAAe,CAAC;AAKpC,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;AACxD,MAAM,MAAM,kBAAkB,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;AAGtD;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,GAAG,OAAO,CAE7E;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,GAAG,CAAC;CAC5C;AAED,MAAM,WAAW,SAAU,SAAQ,eAAe;IAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;IACjB;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;KAChD,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;KACpD,CAAC;IACF;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;IACjB,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACjD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;KAChD,CAAC;IACF,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;KACpD,CAAC;IACF,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnD;AAED,wBAAgB,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,YAAY,CA6B9D;AAED,OAAO,EAAE,MAAM,IAAI,YAAY,EAAE,CAAC"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAE7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,KAAK,EAAE,SAAS,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EACV,aAAa,EACb,eAAe,EACf,aAAa,EACb,EAAE,EACF,aAAa,EACd,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAMlD;;;;GAIG;AACH,MAAM,MAAM,KAAK,GAAG,eAAe,CAAC;AAKpC,MAAM,MAAM,mBAAmB,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;AACxD,MAAM,MAAM,kBAAkB,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;AAGtD;;;;;GAKG;AACH,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,GAAG,OAAO,CAE7E;AAED;;;;;;GAMG;AACH,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,GAAG,CAAC;CAC5C;AAED,MAAM,WAAW,SAAU,SAAQ,eAAe;IAChD,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;IACjB;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B;;;;;;;;OAQG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC;IACjC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,mBAAmB,EAAE,CAAC;IAClD,QAAQ,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAC1B;;;;;;;OAOG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC;IAC/B;;;OAGG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC;IACzB;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;KAChD,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;KACpD,CAAC;IACF;;;OAGG;IACH,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC;IACtC,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;IACjB,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACjD,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,mEAAmE;IACnE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC;IAC/B,QAAQ,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,aAAa,CAAC,EAAE,qBAAqB,CAAC;KAChD,CAAC;IACF,QAAQ,CAAC,MAAM,CAAC,EAAE;QAChB,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;KACpD,CAAC;IACF,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC;CACnD;AAED,wBAAgB,MAAM,CAAC,MAAM,EAAE,iBAAiB,GAAG,YAAY,CA8B9D;AAED,OAAO,EAAE,MAAM,IAAI,YAAY,EAAE,CAAC"}

package/dist/config.js

@@ -28,6 +28,7 @@ export function plumix(config) {
         mcp: config.mcp,
         api: config.api,
         debugBar: config.debugBar,
+        telemetry: config.telemetry,
         blocks: config.blocks,
         images: config.images,
         vite: config.vite,

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AA0BlD,MAAM,UAAU,gBAAgB,CAAC,MAAmC;IAClE,OAAO,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;AAClC,CAAC;AA6HD,MAAM,UAAU,MAAM,CAAC,MAAyB;IAC9C,iEAAiE;IACjE,oEAAoE;IACpE,oEAAoE;IACpE,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,WAAW,CAAC,uBAAuB,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,YAAY;QACnC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;QAC7B,IAAI,EAAE,cAAc,CAClB,MAAM,CAAC,IAAI,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CACxD;QACD,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5C,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,MAAM,IAAI,YAAY,EAAE,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAkBA,OAAO,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AA0BlD,MAAM,UAAU,gBAAgB,CAAC,MAAmC;IAClE,OAAO,MAAM,EAAE,OAAO,KAAK,IAAI,CAAC;AAClC,CAAC;AAqID,MAAM,UAAU,MAAM,CAAC,MAAyB;IAC9C,iEAAiE;IACjE,oEAAoE;IACpE,oEAAoE;IACpE,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAC5C,MAAM,WAAW,CAAC,uBAAuB,EAAE,CAAC;IAC9C,CAAC;IACD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,aAAa,EAAE,MAAM,CAAC,aAAa;QACnC,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,YAAY;QACnC,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;QAC7B,IAAI,EAAE,cAAc,CAClB,MAAM,CAAC,IAAI,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,IAAI,CAAC,EAAE,CACxD;QACD,QAAQ,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC5C,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,MAAM,IAAI,YAAY,EAAE,CAAC"}

package/dist/context/app.d.ts

@@ -15,7 +15,7 @@ import type { ResolvedEntity } from "../route/current.js";
 import type { OAuthProviderSummary } from "../runtime/app.js";
 import type { PlumixEnv } from "../runtime/bindings.js";
 import type { AssetsBinding, ConnectedCache, ConnectedObjectStorage, ImageDelivery } from "../runtime/slots.js";
-import type { DebugCollector } from "./debug.js";
+import type { TelemetryCollector, TelemetryConfig, TelemetryConsumer } from "./telemetry.js";
 export type CoreSchema = typeof coreSchema;
 export type Db<TSchema extends Record<string, unknown> = CoreSchema> = BaseSQLiteDatabase<"async" | "sync", unknown, TSchema>;
 export interface AuthenticatedUser {
@@ -98,12 +98,28 @@ export interface AppContextBase<TSchema extends Record<string, unknown> = CoreSc
     readonly shortcodes: ShortcodeRegistry;
     readonly logger: Logger;
     /**
-     * Request-scoped debug collector. Core and plugins record per-request data
-     * for the dev debug bar via `ctx.debug.record`/`span`. Always present: the
-     * real collector in dev, {@link NOOP_DEBUG} in prod (so call sites are safe
-     * and the debug-bar module tree-shakes out of prod builds).
+     * Request-scoped telemetry collector — spans + records for what happened
+     * during this request. Core and plugins record via `ctx.telemetry.record`/
+     * `span`. Always present: the real collector when at least one registered
+     * consumer voted to sample this request, {@link NOOP_TELEMETRY} otherwise
+     * (so call sites are safe and a site with no consumers pays nothing).
      */
-    readonly debug: DebugCollector;
+    readonly telemetry: TelemetryCollector;
+    /**
+     * Traced outbound HTTP — same signature as global `fetch`, one telemetry
+     * span per call with method, URL, and response status. Core and plugins
+     * make external calls through this so a slow third-party API shows up in
+     * the request waterfall. Bare global `fetch` is an untraced platform
+     * boundary (the same line drawn for DB connections not obtained from
+     * `ctx.db`) — nothing is patched globally.
+     */
+    readonly fetch: typeof globalThis.fetch;
+    /**
+     * Consumers whose head-sampling vote said yes for this request — the
+     * targets of post-response snapshot delivery. Absent when nothing sampled
+     * (and `telemetry` is the no-op). Internal to the dispatcher.
+     */
+    readonly telemetryConsumers?: readonly TelemetryConsumer[];
     readonly auth: AuthNamespace;
     /**
      * Resolved request authenticator — same instance the dispatcher
@@ -211,6 +227,13 @@ export interface AppContextBase<TSchema extends Record<string, unknown> = CoreSc
      * / custom headers here; the dispatcher folds them into the Response.
      */
     readonly resHeaders?: Headers;
+    /**
+     * Unique id for this execution (request or cron run), minted at context
+     * creation so mid-request consumers — logs, error hooks, the debug bar —
+     * and the post-response telemetry snapshot all correlate on one value.
+     * The snapshot envelope's `requestId` is this id.
+     */
+    readonly requestId: string;
     /**
      * Set by the public-route resolver after URL → entity matching;
      * `null` for non-public routes (admin, RPC, etc.) and on cold-start.
@@ -220,6 +243,13 @@ export interface AppContextBase<TSchema extends Record<string, unknown> = CoreSc
      * and response rendering, and read paths see the populated value.
      */
     resolvedEntity: ResolvedEntity | null;
+    /**
+     * The template rule that won resolution (its `ruleLabel`), written by the
+     * theme renderer once a rule matches; `null` before render and on paths
+     * that never render a template. Same write-once-mutable design as
+     * `resolvedEntity` — the resolve phase span reads it back post-render.
+     */
+    resolvedTemplate: string | null;
 }
 export type AppContext<TSchema extends Record<string, unknown> = CoreSchema> = AppContextBase<TSchema> & AppContextExtensions;
 export type AuthenticatedAppContext<TSchema extends Record<string, unknown> = CoreSchema> = Omit<AppContext<TSchema>, "user"> & {
@@ -245,6 +275,8 @@ export interface CreateAppContextArgs<TSchema extends Record<string, unknown>> {
     readonly origin?: string;
     readonly basePath?: string;
     readonly debugBar?: DebugBarInput;
+    /** App-config telemetry slot — registered consumers vote per request. */
+    readonly telemetry?: TelemetryConfig;
     readonly siteName?: string;
     readonly logger?: Logger;
     readonly defer?: DeferFn;

package/dist/context/app.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/context/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,KAAK,EACV,aAAa,EACb,QAAQ,EACR,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAG7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,KAAK,UAAU,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EACd,sBAAsB,EACtB,aAAa,EACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAkBjD,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC;AAE3C,MAAM,MAAM,EAAE,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,IACjE,kBAAkB,CAAC,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAEzD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC9D;AAED,MAAM,WAAW,aAAa;IAI5B,GAAG,CAAC,UAAU,EAAE,eAAe,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC;CAC3D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AAE1D;;;;;;;;GAQG;AAEH,MAAM,WAAW,oBAAoB;CAAG;AAExC,MAAM,WAAW,cAAc,CAC7B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU;IAEpD,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACzD;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IAC1C;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,8FAA8F;IAC9F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACxD;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;;;OAOG;IACH,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;CACvC;AAED,MAAM,MAAM,UAAU,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,IACzE,cAAc,CAAC,OAAO,CAAC,GAAG,oBAAoB,CAAC;AAEjD,MAAM,MAAM,uBAAuB,CACjC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,IAClD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG;IACtC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;CAClC,CAAC;AAEF,MAAM,WAAW,oBAAoB,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC3E,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACxD;6EACyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC1D,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,WAAW,CACzC,MAAM,EACN;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAC5B,CAAC;CACH;AA4DD,wBAAgB,gBAAgB,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtE,IAAI,EAAE,oBAAoB,CAAC,OAAO,CAAC,GAClC,UAAU,CAAC,OAAO,CAAC,CAmErB;AAED,wBAAgB,QAAQ,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9D,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,EACxB,IAAI,EAAE,iBAAiB,EACvB,WAAW,GAAE,SAAS,MAAM,EAAE,GAAG,IAAW,GAC3C,uBAAuB,CAAC,OAAO,CAAC,CAYlC;AAED,eAAO,MAAM,aAAa,EAAE,MAK3B,CAAC"}
+{"version":3,"file":"app.d.ts","sourceRoot":"","sources":["../../src/context/app.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,yBAAyB,CAAC;AAElE,OAAO,KAAK,EACV,aAAa,EACb,QAAQ,EACR,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAG7D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AACrE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAC;AAC7D,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,KAAK,KAAK,UAAU,MAAM,uBAAuB,CAAC;AACzD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC/E,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAC;AAC9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,KAAK,EACV,aAAa,EACb,cAAc,EACd,sBAAsB,EACtB,aAAa,EACd,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EACV,kBAAkB,EAClB,eAAe,EACf,iBAAiB,EAClB,MAAM,gBAAgB,CAAC;AAoBxB,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC;AAE3C,MAAM,MAAM,EAAE,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,IACjE,kBAAkB,CAAC,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;AAEzD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wEAAwE;IACxE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACxC;AAED,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC7D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5D,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC5D,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC9D;AAED,MAAM,WAAW,aAAa;IAI5B,GAAG,CAAC,UAAU,EAAE,eAAe,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,GAAG,OAAO,CAAC;CAC3D;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AAE1D;;;;;;;;GAQG;AAEH,MAAM,WAAW,oBAAoB;CAAG;AAExC,MAAM,WAAW,cAAc,CAC7B,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU;IAEpD,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACxC;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC/C,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;IAC/B,QAAQ,CAAC,KAAK,EAAE,SAAS,QAAQ,EAAE,CAAC;IACpC;;;;OAIG;IACH,QAAQ,CAAC,UAAU,EAAE,iBAAiB,CAAC;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC;;;;;;;OAOG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;IACxC;;;;OAIG;IACH,QAAQ,CAAC,kBAAkB,CAAC,EAAE,SAAS,iBAAiB,EAAE,CAAC;IAC3D,QAAQ,CAAC,IAAI,EAAE,aAAa,CAAC;IAC7B;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,oBAAoB,CAAC;IAC7C;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,cAAc,EAAE,SAAS,oBAAoB,EAAE,CAAC;IACzD;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IAC1C;;;;;OAKG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;IAChC;;;;;;OAMG;IACH,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,8FAA8F;IAC9F,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACxD;;;;;;;OAOG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;OAMG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,YAAY,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B;;;;;;;OAOG;IACH,cAAc,EAAE,cAAc,GAAG,IAAI,CAAC;IACtC;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;CACjC;AAED,MAAM,MAAM,UAAU,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,IACzE,cAAc,CAAC,OAAO,CAAC,GAAG,oBAAoB,CAAC;AAEjD,MAAM,MAAM,uBAAuB,CACjC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,IAClD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,GAAG;IACtC,QAAQ,CAAC,IAAI,EAAE,iBAAiB,CAAC;CAClC,CAAC;AAEF,MAAM,WAAW,oBAAoB,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;IAC3E,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC;IACzB,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,cAAc,CAAC;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,KAAK,CAAC,EAAE,SAAS,QAAQ,EAAE,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,IAAI,CAAC,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAChD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC;IAClC,yEAAyE;IACzE,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,sBAAsB,CAAC;IAC1C,QAAQ,CAAC,KAAK,CAAC,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;IACvC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,SAAS,aAAa,EAAE,CAAC;IACxD;6EACyE;IACzE,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,IAAI,CAAC,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,SAAS,oBAAoB,EAAE,CAAC;IAC1D,QAAQ,CAAC,aAAa,CAAC,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IACpC;;;;;OAKG;IACH,QAAQ,CAAC,oBAAoB,CAAC,EAAE,WAAW,CACzC,MAAM,EACN;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAA;KAAE,CAC5B,CAAC;CACH;AA4DD,wBAAgB,gBAAgB,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACtE,IAAI,EAAE,oBAAoB,CAAC,OAAO,CAAC,GAClC,UAAU,CAAC,OAAO,CAAC,CAyFrB;AAsBD,wBAAgB,QAAQ,CAAC,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9D,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,EACxB,IAAI,EAAE,iBAAiB,EACvB,WAAW,GAAE,SAAS,MAAM,EAAE,GAAG,IAAW,GAC3C,uBAAuB,CAAC,OAAO,CAAC,CAYlC;AAED,eAAO,MAAM,aAAa,EAAE,MAK3B,CAAC"}

package/dist/context/app.js

@@ -2,11 +2,13 @@ import { createBlockRegistry } from "@plumix/blocks";
 import { defaultAuthenticator } from "../auth/authenticator.js";
 import { resolveMailer } from "../auth/mailer/resolve.js";
 import { createCapabilityResolver } from "../auth/rbac.js";
-import { createDebugCollector } from "../debug-bar/collector.js";
+import { debugBarTelemetryConsumer } from "../debug-bar/consumer.js";
 import { resolveLocales } from "../i18n/locale-registry.js";
 import { resolveLocale } from "../i18n/resolve-locale.js";
-import { NOOP_DEBUG } from "./debug.js";
+import { createTelemetryCollector } from "./collector.js";
 import { ContextError } from "./errors.js";
+import { NOOP_TELEMETRY } from "./telemetry.js";
+import { createTracedFetch } from "./traced-fetch.js";
 const EMPTY_BLOCK_REGISTRY = createBlockRegistry([]);
 const EMPTY_MARK_LIST = Object.freeze([]);
 const EMPTY_SHORTCODE_REGISTRY = new Map();
@@ -100,7 +102,9 @@ export function createAppContext(args) {
         oauthProviders: args.oauthProviders ?? [],
         authenticator: args.authenticator ?? defaultAuthenticator(),
         bootstrapAllowed: args.bootstrapAllowed ?? false,
+        requestId: crypto.randomUUID(),
         resolvedEntity: null,
+        resolvedTemplate: null,
         // Best-effort fallback for tests / runtimes that don't pass an
         // explicit origin: derive from the inbound request URL. Production
         // always passes the canonical operator-set origin so URLs in
@@ -108,11 +112,13 @@ export function createAppContext(args) {
         origin: args.origin ?? new URL(args.request.url).origin,
         basePath: args.basePath ?? "",
         debugBar: args.debugBar,
-        // Real collector only in dev; `process.env.PLUMIX_DEV` is Vite-empty in a
-        // build, so the prod branch keeps NOOP_DEBUG and tree-shakes the rest.
-        debug: process.env.PLUMIX_DEV
-            ? createDebugCollector(args.debugBar)
-            : NOOP_DEBUG,
+        // Provisional no-op — swapped for the real collector below iff a consumer
+        // votes to sample this request. Consumers see the assembled context when
+        // voting, so `telemetry` must exist (inactive) before the vote runs.
+        telemetry: NOOP_TELEMETRY,
+        // Reads `base.telemetry` per call, so the post-vote collector swap below
+        // is observed without rebinding.
+        fetch: createTracedFetch(() => base.telemetry),
         siteName: args.siteName,
     };
     // Spread plugin-contributed entries onto the base. The cast is the
@@ -133,7 +139,34 @@ export function createAppContext(args) {
             target[key] = entry.value;
         }
     }
-    return base;
+    const ctx = base;
+    // Consumers are declared against the core schema; a custom-schema context
+    // is structurally the same at the seam, so the double cast is safe.
+    const sampled = sampleTelemetryConsumers(ctx, args.debugBar, args.telemetry);
+    if (sampled.length > 0) {
+        // The context is frozen-by-type, not by object — createAppContext owns
+        // construction, so activating the collector post-vote is a private step.
+        const mutable = base;
+        mutable.telemetry = createTelemetryCollector();
+        mutable.telemetryConsumers = sampled;
+    }
+    return ctx;
+}
+/**
+ * The gate: which registered consumers want this request collected. In dev
+ * the debug bar registers first (the `PLUMIX_DEV` branch is Vite-empty in a
+ * build, so the bar and its config never reach production bundles); config
+ * consumers follow. A consumer without `sample` always votes yes.
+ */
+function sampleTelemetryConsumers(ctx, debugBar, config) {
+    const consumers = [];
+    if (process.env.PLUMIX_DEV) {
+        const bar = debugBarTelemetryConsumer(debugBar);
+        if (bar)
+            consumers.push(bar);
+    }
+    consumers.push(...(config?.consumers ?? []));
+    return consumers.filter((c) => c.sample?.(ctx) ?? true);
 }
 export function withUser(ctx, user, tokenScopes = null) {
     const resolver = createCapabilityResolver(ctx.plugins);