@runtimescope/collector 0.9.2 → 0.10.0

package/dist/{chunk-GENCCHYK.js → chunk-WWFIEANS.js}

@@ -50,6 +50,12 @@ var RingBuffer = class {
 };
 
 // src/store.ts
+function matchesSessionFilter(eventSessionId, filterSessionId) {
+  if (filterSessionId.includes(",")) {
+    return filterSessionId.split(",").includes(eventSessionId);
+  }
+  return eventSessionId === filterSessionId;
+}
 var EventStore = class {
   buffer;
   sessions = /* @__PURE__ */ new Map();
@@ -110,7 +116,7 @@ var EventStore = class {
     const since = filter.sinceSeconds ? Date.now() - filter.sinceSeconds * 1e3 : 0;
     return this.buffer.query((e) => {
       if (e.eventType !== "network") return false;
-      if (filter.sessionId && e.sessionId !== filter.sessionId) return false;
+      if (filter.sessionId && !matchesSessionFilter(e.sessionId, filter.sessionId)) return false;
       if (filter.projectId && !this.matchesProjectId(e.sessionId, filter.projectId)) return false;
       const ne = e;
       if (ne.timestamp < since) return false;
@@ -125,7 +131,7 @@ var EventStore = class {
     const since = filter.sinceSeconds ? Date.now() - filter.sinceSeconds * 1e3 : 0;
     return this.buffer.query((e) => {
       if (e.eventType !== "console") return false;
-      if (filter.sessionId && e.sessionId !== filter.sessionId) return false;
+      if (filter.sessionId && !matchesSessionFilter(e.sessionId, filter.sessionId)) return false;
       if (filter.projectId && !this.matchesProjectId(e.sessionId, filter.projectId)) return false;
       const ce = e;
       if (ce.timestamp < since) return false;
@@ -147,7 +153,7 @@ var EventStore = class {
     const typeSet = filter.eventTypes ? new Set(filter.eventTypes) : null;
     return this.buffer.toArray().filter((e) => {
       if (e.timestamp < since) return false;
-      if (filter.sessionId && e.sessionId !== filter.sessionId) return false;
+      if (filter.sessionId && !matchesSessionFilter(e.sessionId, filter.sessionId)) return false;
       if (filter.projectId && !this.matchesProjectId(e.sessionId, filter.projectId)) return false;
       if (typeSet && !typeSet.has(e.eventType)) return false;
       return true;
@@ -168,16 +174,28 @@ var EventStore = class {
   getSessionIdsForProjectId(projectId) {
     return Array.from(this.sessions.values()).filter((s) => s.projectId === projectId).map((s) => s.sessionId);
   }
+  /** Re-tag all sessions with oldProjectId to use newProjectId. */
+  retagSessions(oldProjectId, newProjectId) {
+    for (const [, session] of this.sessions) {
+      if (session.projectId === oldProjectId) {
+        session.projectId = newProjectId;
+      }
+    }
+  }
   /** Check if an event belongs to the given projectId (via its session). */
   matchesProjectId(sessionId, projectId) {
     const session = this.sessions.get(sessionId);
-    return session?.projectId === projectId;
+    if (!session?.projectId) return false;
+    if (projectId.includes(",")) {
+      return projectId.split(",").includes(session.projectId);
+    }
+    return session.projectId === projectId;
   }
   getStateEvents(filter = {}) {
     const since = filter.sinceSeconds ? Date.now() - filter.sinceSeconds * 1e3 : 0;
     return this.buffer.query((e) => {
       if (e.eventType !== "state") return false;
-      if (filter.sessionId && e.sessionId !== filter.sessionId) return false;
+      if (filter.sessionId && !matchesSessionFilter(e.sessionId, filter.sessionId)) return false;
       if (filter.projectId && !this.matchesProjectId(e.sessionId, filter.projectId)) return false;
       const se = e;
       if (se.timestamp < since) return false;
@@ -189,7 +207,7 @@ var EventStore = class {
     const since = filter.sinceSeconds ? Date.now() - filter.sinceSeconds * 1e3 : 0;
     return this.buffer.query((e) => {
       if (e.eventType !== "render") return false;
-      if (filter.sessionId && e.sessionId !== filter.sessionId) return false;
+      if (filter.sessionId && !matchesSessionFilter(e.sessionId, filter.sessionId)) return false;
       if (filter.projectId && !this.matchesProjectId(e.sessionId, filter.projectId)) return false;
       const re = e;
       if (re.timestamp < since) return false;
@@ -206,7 +224,7 @@ var EventStore = class {
     const since = filter.sinceSeconds ? Date.now() - filter.sinceSeconds * 1e3 : 0;
     return this.buffer.query((e) => {
       if (e.eventType !== "performance") return false;
-      if (filter.sessionId && e.sessionId !== filter.sessionId) return false;
+      if (filter.sessionId && !matchesSessionFilter(e.sessionId, filter.sessionId)) return false;
       if (filter.projectId && !this.matchesProjectId(e.sessionId, filter.projectId)) return false;
       const pe = e;
       if (pe.timestamp < since) return false;
@@ -218,7 +236,7 @@ var EventStore = class {
     const since = filter.sinceSeconds ? Date.now() - filter.sinceSeconds * 1e3 : 0;
     return this.buffer.query((e) => {
       if (e.eventType !== "database") return false;
-      if (filter.sessionId && e.sessionId !== filter.sessionId) return false;
+      if (filter.sessionId && !matchesSessionFilter(e.sessionId, filter.sessionId)) return false;
       if (filter.projectId && !this.matchesProjectId(e.sessionId, filter.projectId)) return false;
       const de = e;
       if (de.timestamp < since) return false;
@@ -240,7 +258,7 @@ var EventStore = class {
     const since = filter.sinceSeconds ? Date.now() - filter.sinceSeconds * 1e3 : 0;
     return this.buffer.query((e) => {
       if (e.eventType !== "custom") return false;
-      if (filter.sessionId && e.sessionId !== filter.sessionId) return false;
+      if (filter.sessionId && !matchesSessionFilter(e.sessionId, filter.sessionId)) return false;
       if (filter.projectId && !this.matchesProjectId(e.sessionId, filter.projectId)) return false;
       const ce = e;
       if (ce.timestamp < since) return false;
@@ -252,7 +270,7 @@ var EventStore = class {
     const since = filter.sinceSeconds ? Date.now() - filter.sinceSeconds * 1e3 : 0;
     return this.buffer.query((e) => {
       if (e.eventType !== "ui") return false;
-      if (filter.sessionId && e.sessionId !== filter.sessionId) return false;
+      if (filter.sessionId && !matchesSessionFilter(e.sessionId, filter.sessionId)) return false;
       if (filter.projectId && !this.matchesProjectId(e.sessionId, filter.projectId)) return false;
       const ue = e;
       if (ue.timestamp < since) return false;
@@ -267,7 +285,7 @@ var EventStore = class {
     const since = filter.sinceSeconds ? Date.now() - filter.sinceSeconds * 1e3 : 0;
     const results = this.buffer.query((e) => {
       if (e.eventType !== eventType) return false;
-      if (filter.sessionId && e.sessionId !== filter.sessionId) return false;
+      if (filter.sessionId && !matchesSessionFilter(e.sessionId, filter.sessionId)) return false;
       if (filter.projectId && !this.matchesProjectId(e.sessionId, filter.projectId)) return false;
       if (e.timestamp < since) return false;
       if (filter.url) {
@@ -282,7 +300,7 @@ var EventStore = class {
     const since = filter.sinceSeconds ? Date.now() - filter.sinceSeconds * 1e3 : 0;
     return this.buffer.query((e) => {
       if (e.eventType !== eventType) return false;
-      if (filter.sessionId && e.sessionId !== filter.sessionId) return false;
+      if (filter.sessionId && !matchesSessionFilter(e.sessionId, filter.sessionId)) return false;
       if (filter.projectId && !this.matchesProjectId(e.sessionId, filter.projectId)) return false;
       if (e.timestamp < since) return false;
       if (filter.url) {
@@ -349,6 +367,18 @@ function getOrCreateProjectId(projectManager, appName) {
   projectManager.setProjectIdForApp(appName, projectId);
   return projectId;
 }
+function resolveProjectId(projectManager, appName, pmStore) {
+  const fromIndex = projectManager.resolveAppProjectId(appName);
+  if (fromIndex) return fromIndex;
+  if (pmStore) {
+    const fromPm = pmStore.findProjectIdByApp(appName);
+    if (fromPm) {
+      projectManager.setProjectIdForApp(appName, fromPm);
+      return fromPm;
+    }
+  }
+  return getOrCreateProjectId(projectManager, appName);
+}
 
 // src/sqlite-store.ts
 import { renameSync, existsSync } from "fs";
@@ -852,6 +882,7 @@ var CollectorServer = class {
   pruneTimer = null;
   heartbeatTimer = null;
   tlsConfig = null;
+  pmStore = null;
   constructor(options = {}) {
     this.store = new EventStore(options.bufferSize ?? 1e4);
     this.projectManager = options.projectManager ?? null;
@@ -887,6 +918,10 @@ var CollectorServer = class {
   getRateLimiter() {
     return this.rateLimiter;
   }
+  /** Set the PmStore for project ID resolution (called after construction when PmStore is available). */
+  setPmStore(pmStore) {
+    this.pmStore = pmStore;
+  }
   onConnect(cb) {
     this.connectCallbacks.push(cb);
   }
@@ -894,7 +929,7 @@ var CollectorServer = class {
     this.disconnectCallbacks.push(cb);
   }
   start(options = {}) {
-    const port = options.port ?? 9090;
+    const port = options.port ?? 6767;
     const host = options.host ?? "127.0.0.1";
     const maxRetries = options.maxRetries ?? 5;
     const retryDelayMs = options.retryDelayMs ?? 1e3;
@@ -1055,7 +1090,15 @@ var CollectorServer = class {
     switch (msg.type) {
       case "handshake": {
         const payload = msg.payload;
-        if (this.authManager?.isEnabled()) {
+        let workspaceFromKey = null;
+        if (payload.authToken && this.pmStore?.getWorkspaceByApiKey) {
+          try {
+            const ws2 = this.pmStore.getWorkspaceByApiKey(payload.authToken);
+            if (ws2) workspaceFromKey = { id: ws2.id, slug: ws2.slug };
+          } catch {
+          }
+        }
+        if (this.authManager?.isEnabled() && !workspaceFromKey) {
           if (!this.authManager.isAuthorized(payload.authToken)) {
             try {
               ws.send(JSON.stringify({
@@ -1068,15 +1111,27 @@ var CollectorServer = class {
             ws.close(4001, "Authentication failed");
             return;
           }
-          this.pendingHandshakes.delete(ws);
         }
+        this.pendingHandshakes.delete(ws);
         const projectName = payload.appName;
-        const projectId = payload.projectId ?? (this.projectManager ? getOrCreateProjectId(this.projectManager, projectName) : void 0);
+        const projectId = payload.projectId ?? (this.projectManager ? resolveProjectId(this.projectManager, projectName, this.pmStore) : void 0);
         this.clients.set(ws, {
           sessionId: payload.sessionId,
           projectName,
-          projectId
+          projectId,
+          workspaceId: workspaceFromKey?.id
         });
+        if (workspaceFromKey && projectId && this.pmStore?.listProjects && this.pmStore.setProjectWorkspace) {
+          try {
+            const existing = this.pmStore.listProjects().find(
+              (p) => p.runtimeProjectId === projectId
+            );
+            if (existing && !existing.workspaceId) {
+              this.pmStore.setProjectWorkspace(existing.id, workspaceFromKey.id);
+            }
+          } catch {
+          }
+        }
         const sqliteStore = this.ensureSqliteStore(projectName);
         if (sqliteStore) {
           const sessionInfo = {
@@ -1238,12 +1293,13 @@ import { mkdirSync, readFileSync as readFileSync2, writeFileSync, existsSync as
 import { join } from "path";
 import { homedir } from "os";
 var DEFAULT_GLOBAL_CONFIG = {
-  defaultPort: 9090,
+  defaultPort: 6767,
   bufferSize: 1e4,
-  httpPort: 9091
+  httpPort: 6768
 };
 var ProjectManager = class {
   baseDir;
+  appProjectIndex = /* @__PURE__ */ new Map();
   constructor(baseDir) {
     this.baseDir = baseDir ?? join(homedir(), ".runtimescope");
   }
@@ -1356,6 +1412,60 @@ var ProjectManager = class {
     }
     return null;
   }
+  // --- Reverse index: appName → projectId ---
+  /**
+   * Build reverse index: appName -> projectId.
+   * Scans all project configs, PM projects with runtimeApps + runtimeProjectId,
+   * and project-level .runtimescope/config.json files from PM project paths.
+   */
+  rebuildAppIndex(pmStore) {
+    this.appProjectIndex.clear();
+    for (const name of this.listProjects()) {
+      const config = this.getProjectConfig(name);
+      if (config?.projectId) {
+        this.appProjectIndex.set(name.toLowerCase(), config.projectId);
+      }
+    }
+    if (pmStore) {
+      for (const p of pmStore.listProjects()) {
+        if (p.runtimeProjectId && p.runtimeApps) {
+          for (const app of p.runtimeApps) {
+            this.appProjectIndex.set(app.toLowerCase(), p.runtimeProjectId);
+          }
+        }
+      }
+    }
+    if (pmStore) {
+      for (const p of pmStore.listProjects()) {
+        if (p.path) {
+          try {
+            const configPath = join(p.path, ".runtimescope", "config.json");
+            if (existsSync2(configPath)) {
+              const content = readFileSync2(configPath, "utf-8");
+              const config = JSON.parse(content);
+              if (config.projectId) {
+                if (config.appName) {
+                  this.appProjectIndex.set(config.appName.toLowerCase(), config.projectId);
+                }
+                if (Array.isArray(config.sdks)) {
+                  for (const sdk of config.sdks) {
+                    if (sdk.appName) {
+                      this.appProjectIndex.set(sdk.appName.toLowerCase(), config.projectId);
+                    }
+                  }
+                }
+              }
+            }
+          } catch {
+          }
+        }
+      }
+    }
+  }
+  /** O(1) lookup from the cached index. */
+  resolveAppProjectId(appName) {
+    return this.appProjectIndex.get(appName.toLowerCase()) ?? null;
+  }
   // --- Environment variable resolution ---
   resolveEnvVars(value) {
     return value.replace(/\$\{([^}]+)\}/g, (_match, varName) => {
@@ -1409,6 +1519,129 @@ var ProjectManager = class {
   }
 };
 
+// src/project-config.ts
+import { readFileSync as readFileSync3, existsSync as existsSync3, writeFileSync as writeFileSync2, mkdirSync as mkdirSync2 } from "fs";
+import { join as join2 } from "path";
+var DEFAULT_CAPTURE = {
+  network: true,
+  console: true,
+  xhr: true,
+  body: false,
+  performance: true,
+  renders: true,
+  navigation: true,
+  clicks: false,
+  http: false,
+  errors: true,
+  stackTraces: false
+};
+function readProjectConfig(projectDir) {
+  const configPath = join2(projectDir, ".runtimescope", "config.json");
+  if (!existsSync3(configPath)) return null;
+  try {
+    const content = readFileSync3(configPath, "utf-8");
+    return JSON.parse(content);
+  } catch {
+    return null;
+  }
+}
+function writeProjectConfig(projectDir, config) {
+  const dir = join2(projectDir, ".runtimescope");
+  if (!existsSync3(dir)) mkdirSync2(dir, { recursive: true });
+  writeFileSync2(join2(dir, "config.json"), JSON.stringify(config, null, 2) + "\n", "utf-8");
+}
+function scaffoldProjectConfig(projectDir, opts) {
+  const existing = readProjectConfig(projectDir);
+  if (existing) {
+    if (opts.sdkType) {
+      const alreadyHas = existing.sdks.some((s) => s.type === opts.sdkType);
+      if (!alreadyHas) {
+        existing.sdks.push({
+          type: opts.sdkType,
+          framework: opts.framework,
+          appName: opts.appName !== existing.appName ? opts.appName : void 0
+        });
+        writeProjectConfig(projectDir, existing);
+      }
+    }
+    return existing;
+  }
+  const projectId = generateProjectId();
+  const httpPort = process.env.RUNTIMESCOPE_HTTP_PORT ?? "6768";
+  const dsn = `runtimescope://${projectId}@localhost:${httpPort}/${opts.appName}`;
+  const config = {
+    projectId,
+    dsn,
+    appName: opts.appName,
+    description: opts.description,
+    sdks: opts.sdkType ? [{ type: opts.sdkType, framework: opts.framework }] : [],
+    capture: { ...DEFAULT_CAPTURE },
+    category: opts.category
+  };
+  writeProjectConfig(projectDir, config);
+  const gitignorePath = join2(projectDir, ".runtimescope", ".gitignore");
+  if (!existsSync3(gitignorePath)) {
+    writeFileSync2(gitignorePath, "# Keep config.json committed, ignore local state\n*.log\n*.db\n.env\n", "utf-8");
+  }
+  return config;
+}
+function resolveProjectAppNames(config) {
+  const names = /* @__PURE__ */ new Set([config.appName]);
+  for (const sdk of config.sdks) {
+    if (sdk.appName) names.add(sdk.appName);
+  }
+  return Array.from(names);
+}
+function migrateProjectIds(projectManager, pmStore) {
+  const result = { unified: 0, skipped: 0, details: [] };
+  if (!pmStore) return result;
+  for (const project of pmStore.listProjects()) {
+    if (!project.runtimeApps || project.runtimeApps.length < 2) continue;
+    if (!project.path) {
+      result.skipped++;
+      continue;
+    }
+    let canonicalId = null;
+    try {
+      const configPath = join2(project.path, ".runtimescope", "config.json");
+      if (existsSync3(configPath)) {
+        const config = JSON.parse(readFileSync3(configPath, "utf-8"));
+        if (config.projectId) canonicalId = config.projectId;
+      }
+    } catch {
+    }
+    if (!canonicalId && project.runtimeProjectId) {
+      canonicalId = project.runtimeProjectId;
+    }
+    if (!canonicalId) {
+      for (const appName of project.runtimeApps) {
+        const existing = projectManager.getProjectIdForApp(appName);
+        if (existing) {
+          canonicalId = existing;
+          break;
+        }
+      }
+    }
+    if (!canonicalId) {
+      result.skipped++;
+      continue;
+    }
+    for (const appName of project.runtimeApps) {
+      const current = projectManager.getProjectIdForApp(appName);
+      if (current !== canonicalId) {
+        projectManager.setProjectIdForApp(appName, canonicalId);
+        result.details.push(`Unified ${appName}: ${current ?? "none"} \u2192 ${canonicalId}`);
+        result.unified++;
+      }
+    }
+    if (project.runtimeProjectId !== canonicalId) {
+      pmStore.updateProject(project.id, { runtimeProjectId: canonicalId });
+      result.details.push(`PM project ${project.name}: runtimeProjectId \u2192 ${canonicalId}`);
+    }
+  }
+  return result;
+}
+
 // src/auth.ts
 import { randomBytes as randomBytes2, timingSafeEqual } from "crypto";
 var AuthManager = class {
@@ -1573,7 +1806,7 @@ var Redactor = class {
 // src/platform.ts
 import { execFileSync, execSync } from "child_process";
 import { readlinkSync, readdirSync as readdirSync2 } from "fs";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 var IS_WIN = process.platform === "win32";
 var IS_LINUX = process.platform === "linux";
 function runFile(cmd, args, timeoutMs = 5e3) {
@@ -1692,7 +1925,7 @@ function findPidsInDir_linux(dir) {
       const pid = parseInt(entry, 10);
       if (isNaN(pid) || pid <= 1) continue;
       try {
-        const cwd = readlinkSync(join2("/proc", entry, "cwd"));
+        const cwd = readlinkSync(join3("/proc", entry, "cwd"));
         if (cwd.startsWith(dir)) pids.push(pid);
       } catch {
       }
@@ -1896,15 +2129,15 @@ var SessionManager = class {
 // src/http-server.ts
 import { createServer } from "http";
 import { createServer as createHttpsServer2 } from "https";
-import { readFileSync as readFileSync3, existsSync as existsSync4 } from "fs";
+import { readFileSync as readFileSync4, existsSync as existsSync5 } from "fs";
 import { resolve, dirname } from "path";
 import { fileURLToPath } from "url";
 import { WebSocketServer as WebSocketServer2 } from "ws";
 
 // src/pm/pm-routes.ts
 import { readdir, readFile, writeFile, unlink, mkdir } from "fs/promises";
-import { existsSync as existsSync3 } from "fs";
-import { join as join3 } from "path";
+import { existsSync as existsSync4 } from "fs";
+import { join as join4 } from "path";
 import { homedir as homedir2 } from "os";
 import { spawn, execFileSync as execFileSync2 } from "child_process";
 var LOG_RING_SIZE = 500;
@@ -1943,7 +2176,11 @@ function createPmRouter(pmStore, discovery, helpers, broadcastDevServer) {
       helpers.json(res, { ...project, stats });
       return;
     }
-    const projects = pmStore.listProjects();
+    let projects = pmStore.listProjects();
+    const workspaceId = params.get("workspace_id");
+    if (workspaceId) {
+      projects = projects.filter((p) => p.workspaceId === workspaceId);
+    }
     helpers.json(res, { data: projects, count: projects.length });
   });
   route("GET", "/api/pm/projects/export-csv", (_req, res, params) => {
@@ -2041,6 +2278,152 @@ function createPmRouter(pmStore, discovery, helpers, broadcastDevServer) {
       helpers.json(res, { error: err.message }, 400);
     }
   });
+  route("DELETE", "/api/pm/projects/:id", (_req, res, params) => {
+    const id = params.get("id");
+    const project = pmStore.getProject(id);
+    if (!project) {
+      helpers.json(res, { error: "Project not found" }, 404);
+      return;
+    }
+    pmStore.deleteProject(id);
+    helpers.json(res, { ok: true, deleted: project.name });
+  });
+  route("PUT", "/api/pm/projects/:id/workspace", async (req, res, params) => {
+    const id = params.get("id");
+    const body = await helpers.readBody(req, 4096);
+    if (!body) {
+      helpers.json(res, { error: "Missing body" }, 400);
+      return;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(body);
+    } catch {
+      helpers.json(res, { error: "Invalid JSON" }, 400);
+      return;
+    }
+    if (!parsed.workspace_id) {
+      helpers.json(res, { error: "Missing workspace_id" }, 400);
+      return;
+    }
+    try {
+      pmStore.setProjectWorkspace(id, parsed.workspace_id);
+      helpers.json(res, { ok: true });
+    } catch (err) {
+      helpers.json(res, { error: err.message }, 400);
+    }
+  });
+  route("GET", "/api/pm/workspaces", (_req, res) => {
+    helpers.json(res, { data: pmStore.listWorkspaces() });
+  });
+  route("POST", "/api/pm/workspaces", async (req, res) => {
+    const body = await helpers.readBody(req, 4096);
+    if (!body) {
+      helpers.json(res, { error: "Missing body" }, 400);
+      return;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(body);
+    } catch {
+      helpers.json(res, { error: "Invalid JSON" }, 400);
+      return;
+    }
+    if (!parsed.name || typeof parsed.name !== "string") {
+      helpers.json(res, { error: "Missing name" }, 400);
+      return;
+    }
+    try {
+      const ws = pmStore.createWorkspace({ name: parsed.name, slug: parsed.slug, description: parsed.description });
+      helpers.json(res, ws, 201);
+    } catch (err) {
+      helpers.json(res, { error: err.message }, 400);
+    }
+  });
+  route("GET", "/api/pm/workspaces/:id", (_req, res, params) => {
+    const id = params.get("id");
+    const ws = pmStore.getWorkspace(id);
+    if (!ws) {
+      helpers.json(res, { error: "Workspace not found" }, 404);
+      return;
+    }
+    helpers.json(res, ws);
+  });
+  route("PUT", "/api/pm/workspaces/:id", async (req, res, params) => {
+    const id = params.get("id");
+    if (!pmStore.getWorkspace(id)) {
+      helpers.json(res, { error: "Workspace not found" }, 404);
+      return;
+    }
+    const body = await helpers.readBody(req, 4096);
+    if (!body) {
+      helpers.json(res, { error: "Missing body" }, 400);
+      return;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(body);
+    } catch {
+      helpers.json(res, { error: "Invalid JSON" }, 400);
+      return;
+    }
+    try {
+      pmStore.updateWorkspace(id, parsed);
+      helpers.json(res, pmStore.getWorkspace(id));
+    } catch (err) {
+      helpers.json(res, { error: err.message }, 400);
+    }
+  });
+  route("DELETE", "/api/pm/workspaces/:id", (_req, res, params) => {
+    const id = params.get("id");
+    try {
+      pmStore.deleteWorkspace(id);
+      helpers.json(res, { ok: true });
+    } catch (err) {
+      helpers.json(res, { error: err.message }, 400);
+    }
+  });
+  route("GET", "/api/pm/workspaces/:id/api-keys", (_req, res, params) => {
+    const id = params.get("id");
+    if (!pmStore.getWorkspace(id)) {
+      helpers.json(res, { error: "Workspace not found" }, 404);
+      return;
+    }
+    helpers.json(res, { data: pmStore.listApiKeys(id) });
+  });
+  route("POST", "/api/pm/workspaces/:id/api-keys", async (req, res, params) => {
+    const id = params.get("id");
+    if (!pmStore.getWorkspace(id)) {
+      helpers.json(res, { error: "Workspace not found" }, 404);
+      return;
+    }
+    const body = await helpers.readBody(req, 4096);
+    if (!body) {
+      helpers.json(res, { error: "Missing body" }, 400);
+      return;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(body);
+    } catch {
+      helpers.json(res, { error: "Invalid JSON" }, 400);
+      return;
+    }
+    if (!parsed.label) {
+      helpers.json(res, { error: "Missing label" }, 400);
+      return;
+    }
+    try {
+      const key = pmStore.createApiKey(id, parsed.label, parsed.expires_at);
+      helpers.json(res, key, 201);
+    } catch (err) {
+      helpers.json(res, { error: err.message }, 400);
+    }
+  });
+  route("DELETE", "/api/pm/api-keys/:key", (_req, res, params) => {
+    pmStore.revokeApiKey(params.get("key"));
+    helpers.json(res, { ok: true });
+  });
   route("GET", "/api/pm/tasks", (_req, res, params) => {
     const projectId = params.get("project_id") ?? void 0;
     const status = params.get("status") ?? void 0;
@@ -2216,13 +2599,13 @@ function createPmRouter(pmStore, discovery, helpers, broadcastDevServer) {
       helpers.json(res, { data: [], count: 0 });
       return;
     }
-    const memoryDir = join3(homedir2(), ".claude", "projects", project.claudeProjectKey, "memory");
+    const memoryDir = join4(homedir2(), ".claude", "projects", project.claudeProjectKey, "memory");
     try {
       const files = await readdir(memoryDir);
       const mdFiles = files.filter((f) => f.endsWith(".md"));
       const result = await Promise.all(
         mdFiles.map(async (filename) => {
-          const content = await readFile(join3(memoryDir, filename), "utf-8");
+          const content = await readFile(join4(memoryDir, filename), "utf-8");
           return { filename, content, sizeBytes: Buffer.byteLength(content) };
         })
       );
@@ -2239,7 +2622,7 @@ function createPmRouter(pmStore, discovery, helpers, broadcastDevServer) {
       helpers.json(res, { error: "Project not found" }, 404);
       return;
     }
-    const filePath = join3(homedir2(), ".claude", "projects", project.claudeProjectKey, "memory", filename);
+    const filePath = join4(homedir2(), ".claude", "projects", project.claudeProjectKey, "memory", filename);
     try {
       const content = await readFile(filePath, "utf-8");
       helpers.json(res, { filename, content, sizeBytes: Buffer.byteLength(content) });
@@ -2262,9 +2645,9 @@ function createPmRouter(pmStore, discovery, helpers, broadcastDevServer) {
     }
     try {
       const { content } = JSON.parse(body);
-      const memoryDir = join3(homedir2(), ".claude", "projects", project.claudeProjectKey, "memory");
+      const memoryDir = join4(homedir2(), ".claude", "projects", project.claudeProjectKey, "memory");
       await mkdir(memoryDir, { recursive: true });
-      await writeFile(join3(memoryDir, filename), content, "utf-8");
+      await writeFile(join4(memoryDir, filename), content, "utf-8");
       helpers.json(res, { ok: true });
     } catch (err) {
       helpers.json(res, { error: err.message }, 500);
@@ -2278,7 +2661,7 @@ function createPmRouter(pmStore, discovery, helpers, broadcastDevServer) {
       helpers.json(res, { error: "Project not found" }, 404);
       return;
     }
-    const filePath = join3(homedir2(), ".claude", "projects", project.claudeProjectKey, "memory", filename);
+    const filePath = join4(homedir2(), ".claude", "projects", project.claudeProjectKey, "memory", filename);
     try {
       await unlink(filePath);
       helpers.json(res, { ok: true });
@@ -2338,7 +2721,7 @@ function createPmRouter(pmStore, discovery, helpers, broadcastDevServer) {
       const { content } = JSON.parse(body);
       const paths = getRulesPaths(project.claudeProjectKey, project.path);
       const filePath = paths[scope];
-      const dir = join3(filePath, "..");
+      const dir = join4(filePath, "..");
       await mkdir(dir, { recursive: true });
       await writeFile(filePath, content, "utf-8");
       helpers.json(res, { ok: true });
@@ -2358,7 +2741,7 @@ function createPmRouter(pmStore, discovery, helpers, broadcastDevServer) {
       return;
     }
     try {
-      const pkgPath = join3(project.path, "package.json");
+      const pkgPath = join4(project.path, "package.json");
       const pkg = JSON.parse(await readFile(pkgPath, "utf-8"));
       const scripts = pkg.scripts ?? {};
       const recommended = ["dev", "start", "serve"].find((s) => s in scripts) ?? null;
@@ -2774,6 +3157,71 @@ function createPmRouter(pmStore, discovery, helpers, broadcastDevServer) {
       res.end(csv);
     }
   });
+  route("GET", "/api/pm/capex-all", (_req, res, params) => {
+    const category = params.get("category") ?? void 0;
+    const projects = pmStore.listProjects();
+    const filteredProjects = category ? projects.filter((p) => p.category === category) : projects;
+    const allEntries = [];
+    let totalCost = 0;
+    let totalCapitalizable = 0;
+    let totalExpensed = 0;
+    let totalMinutes = 0;
+    let totalConfirmed = 0;
+    let totalUnconfirmed = 0;
+    const byProject = [];
+    for (const project of filteredProjects) {
+      const entries = pmStore.listCapexEntries(project.id);
+      let projCost = 0;
+      let projCap = 0;
+      let projExp = 0;
+      let projMins = 0;
+      let projConfirmed = 0;
+      for (const e of entries) {
+        allEntries.push({ ...e, projectName: project.name });
+        projCost += e.adjustedCostMicrodollars;
+        projMins += e.activeMinutes;
+        if (e.classification === "capitalizable") projCap += e.adjustedCostMicrodollars;
+        else projExp += e.adjustedCostMicrodollars;
+        if (e.confirmed) projConfirmed++;
+      }
+      if (entries.length > 0) {
+        byProject.push({
+          projectId: project.id,
+          projectName: project.name,
+          category: project.category,
+          totalCost: projCost,
+          capitalizable: projCap,
+          expensed: projExp,
+          activeMinutes: projMins,
+          activeHours: +(projMins / 60).toFixed(2),
+          confirmed: projConfirmed,
+          total: entries.length
+        });
+      }
+      totalCost += projCost;
+      totalCapitalizable += projCap;
+      totalExpensed += projExp;
+      totalMinutes += projMins;
+      totalConfirmed += projConfirmed;
+      totalUnconfirmed += entries.length - projConfirmed;
+    }
+    helpers.json(res, {
+      data: {
+        summary: {
+          totalCost,
+          capitalizable: totalCapitalizable,
+          expensed: totalExpensed,
+          activeMinutes: totalMinutes,
+          activeHours: +(totalMinutes / 60).toFixed(2),
+          confirmed: totalConfirmed,
+          unconfirmed: totalUnconfirmed,
+          projectCount: byProject.length
+        },
+        byProject,
+        entries: allEntries.sort((a, b) => b.createdAt - a.createdAt)
+      }
+    });
+  });
   route("GET", "/api/pm/capex-report-all", async (_req, res, params) => {
     const startDate = params.get("start_date") ?? void 0;
     const endDate = params.get("end_date") ?? void 0;
@@ -2819,9 +3267,9 @@ function sanitizeFilename(name) {
 function getRulesPaths(claudeProjectKey, projectPath) {
   const home = homedir2();
   return {
-    global: join3(home, ".claude", "CLAUDE.md"),
-    project: claudeProjectKey ? join3(home, ".claude", "projects", claudeProjectKey, "CLAUDE.md") : join3(projectPath ?? "", ".claude", "CLAUDE.md"),
-    local: projectPath ? join3(projectPath, "CLAUDE.md") : join3(home, "CLAUDE.md")
+    global: join4(home, ".claude", "CLAUDE.md"),
+    project: claudeProjectKey ? join4(home, ".claude", "projects", claudeProjectKey, "CLAUDE.md") : join4(projectPath ?? "", ".claude", "CLAUDE.md"),
+    local: projectPath ? join4(projectPath, "CLAUDE.md") : join4(home, "CLAUDE.md")
   };
 }
 function execGit(args, cwd) {
@@ -2866,7 +3314,7 @@ function parseGitStatus(porcelain) {
 }
 async function readRuleFile(filePath) {
   try {
-    if (existsSync3(filePath)) {
+    if (existsSync4(filePath)) {
       const content = await readFile(filePath, "utf-8");
       return { path: filePath, content, exists: true };
     }
@@ -2876,6 +3324,16 @@ async function readRuleFile(filePath) {
 }
 
 // src/http-server.ts
+var COLLECTOR_VERSION = (() => {
+  try {
+    const here = dirname(fileURLToPath(import.meta.url));
+    const pkgJson = readFileSync4(resolve(here, "..", "package.json"), "utf-8");
+    const pkg = JSON.parse(pkgJson);
+    return pkg.version ?? "unknown";
+  } catch {
+    return "unknown";
+  }
+})();
 var HttpServer = class {
   server = null;
   wss = null;
@@ -2889,7 +3347,7 @@ var HttpServer = class {
   routes = /* @__PURE__ */ new Map();
   pmRouter = null;
   sdkBundlePath = null;
-  activePort = 9091;
+  activePort = 6768;
   startedAt = Date.now();
   connectedSessionsGetter = null;
   pmStore = null;
@@ -2915,6 +3373,7 @@ var HttpServer = class {
     this.routes.set("GET /api/health", (_req, res) => {
       this.json(res, {
         status: "ok",
+        version: COLLECTOR_VERSION,
         timestamp: Date.now(),
         uptime: Math.floor((Date.now() - this.startedAt) / 1e3),
         sessions: this.store.getSessionInfo().filter((s) => s.isConnected).length,
@@ -3111,7 +3570,7 @@ var HttpServer = class {
         return;
       }
       const payload = parsed;
-      const projectId = typeof payload.projectId === "string" ? payload.projectId : payload.appName && this.projectManager ? getOrCreateProjectId(this.projectManager, payload.appName) : void 0;
+      const projectId = typeof payload.projectId === "string" ? payload.projectId : payload.appName && this.projectManager ? resolveProjectId(this.projectManager, payload.appName, this.pmStore) : void 0;
       if (!payload.sessionId || !Array.isArray(payload.events) || payload.events.length === 0) {
         this.json(res, {
           error: "Required: sessionId (string), events (non-empty array)",
@@ -3138,6 +3597,21 @@ var HttpServer = class {
           } catch {
           }
         }
+        if (this.pmStore) {
+          try {
+            const token = AuthManager.extractBearer(req.headers.authorization);
+            if (token) {
+              const ws = this.pmStore.getWorkspaceByApiKey(token);
+              if (ws && projectId) {
+                const existing = this.pmStore.listProjects().find((p) => p.runtimeProjectId === projectId);
+                if (existing && !existing.workspaceId) {
+                  this.pmStore.setProjectWorkspace(existing.id, ws.id);
+                }
+              }
+            }
+          } catch {
+          }
+        }
       }
       const VALID_EVENT_TYPES = /* @__PURE__ */ new Set([
         "network",
@@ -3196,7 +3670,7 @@ var HttpServer = class {
       // npm installed
     ];
     for (const p of candidates) {
-      if (existsSync4(p)) {
+      if (existsSync5(p)) {
         this.sdkBundlePath = p;
         return p;
       }
@@ -3204,7 +3678,7 @@ var HttpServer = class {
     return null;
   }
   async start(options = {}) {
-    const basePort = options.port ?? parseInt(process.env.RUNTIMESCOPE_HTTP_PORT ?? "9091", 10);
+    const basePort = options.port ?? parseInt(process.env.RUNTIMESCOPE_HTTP_PORT ?? "6768", 10);
     const host = options.host ?? "127.0.0.1";
     const tls = options.tls;
     const maxRetries = 5;
@@ -3336,7 +3810,9 @@ var HttpServer = class {
     const isPublic = url.pathname === "/api/health" || url.pathname === "/runtimescope.js" || url.pathname === "/snippet";
     if (!isPublic && this.authManager?.isEnabled()) {
       const token = AuthManager.extractBearer(req.headers.authorization);
-      if (!this.authManager.isAuthorized(token)) {
+      const isGlobal = this.authManager.isAuthorized(token);
+      const isWorkspaceToken = !!(token && this.pmStore?.getWorkspaceByApiKey(token));
+      if (!isGlobal && !isWorkspaceToken) {
         this.json(res, { error: "Unauthorized", code: "AUTH_FAILED" }, 401);
         return;
       }
@@ -3344,7 +3820,7 @@ var HttpServer = class {
     if (req.method === "GET" && url.pathname === "/runtimescope.js") {
       const sdkPath = this.resolveSdkPath();
       if (sdkPath) {
-        const bundle = readFileSync3(sdkPath, "utf-8");
+        const bundle = readFileSync4(sdkPath, "utf-8");
         res.writeHead(200, {
           "Content-Type": "application/javascript",
           "Cache-Control": "no-cache"
@@ -3358,14 +3834,12 @@ var HttpServer = class {
     }
     if (req.method === "GET" && url.pathname === "/snippet") {
       const appName = (url.searchParams.get("app") || "my-app").replace(/[^a-zA-Z0-9_-]/g, "");
-      const wsPort = process.env.RUNTIMESCOPE_PORT ?? "9090";
+      const projectId = url.searchParams.get("project_id") || "proj_xxx";
+      const dsn = `runtimescope://${projectId}@localhost:${this.activePort}/${appName}`;
       const snippet = `<!-- RuntimeScope SDK \u2014 paste before </body> -->
 <script src="http://localhost:${this.activePort}/runtimescope.js"></script>
 <script>
-  RuntimeScope.init({
-    appName: '${appName}',
-    endpoint: 'ws://localhost:${wsPort}',
-  });
+  RuntimeScope.init({ dsn: '${dsn}' });
 </script>`;
       res.writeHead(200, {
         "Content-Type": "text/plain"
@@ -3470,6 +3944,7 @@ function numParam(params, key) {
 
 // src/pm/pm-store.ts
 import Database from "better-sqlite3";
+import { randomBytes as randomBytes3 } from "crypto";
 var PmStore = class {
   db;
   constructor(options) {
@@ -3595,6 +4070,37 @@ var PmStore = class {
       CREATE INDEX IF NOT EXISTS idx_pm_capex_project ON pm_capex_entries(project_id);
       CREATE INDEX IF NOT EXISTS idx_pm_capex_period ON pm_capex_entries(period);
       CREATE INDEX IF NOT EXISTS idx_pm_capex_confirmed ON pm_capex_entries(confirmed);
+
+      CREATE TABLE IF NOT EXISTS pm_deleted_projects (
+        path TEXT PRIMARY KEY,
+        name TEXT,
+        deleted_at INTEGER NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_deleted_path ON pm_deleted_projects(path);
+
+      -- Multi-tenant workspaces (Phase 1) --
+      CREATE TABLE IF NOT EXISTS pm_workspaces (
+        id TEXT PRIMARY KEY,
+        name TEXT NOT NULL,
+        slug TEXT UNIQUE NOT NULL,
+        description TEXT,
+        is_default INTEGER NOT NULL DEFAULT 0,
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL
+      );
+      CREATE INDEX IF NOT EXISTS idx_workspaces_slug ON pm_workspaces(slug);
+
+      CREATE TABLE IF NOT EXISTS pm_api_keys (
+        key TEXT PRIMARY KEY,
+        workspace_id TEXT NOT NULL,
+        label TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        last_used_at INTEGER,
+        expires_at INTEGER,
+        revoked_at INTEGER,
+        FOREIGN KEY (workspace_id) REFERENCES pm_workspaces(id) ON DELETE CASCADE
+      );
+      CREATE INDEX IF NOT EXISTS idx_api_keys_workspace ON pm_api_keys(workspace_id);
     `);
   }
   runMigrations() {
@@ -3614,18 +4120,45 @@ var PmStore = class {
       this.db.exec("ALTER TABLE pm_projects ADD COLUMN runtime_project_id TEXT DEFAULT NULL");
     } catch {
     }
+    try {
+      this.db.exec("ALTER TABLE pm_projects ADD COLUMN workspace_id TEXT DEFAULT NULL");
+    } catch {
+    }
+    this.ensureDefaultWorkspace();
+  }
+  /**
+   * Ensure a default "personal" workspace exists and every project has a
+   * workspace_id. Runs on every startup — idempotent.
+   */
+  ensureDefaultWorkspace() {
+    const existing = this.db.prepare("SELECT id FROM pm_workspaces WHERE is_default = 1").get();
+    let defaultId;
+    if (existing) {
+      defaultId = existing.id;
+    } else {
+      defaultId = generateWorkspaceId();
+      const now = Date.now();
+      this.db.prepare(
+        `INSERT INTO pm_workspaces (id, name, slug, description, is_default, created_at, updated_at)
+           VALUES (?, ?, ?, ?, 1, ?, ?)`
+      ).run(defaultId, "Personal", "personal", "Your personal workspace", now, now);
+    }
+    this.db.prepare("UPDATE pm_projects SET workspace_id = ? WHERE workspace_id IS NULL").run(defaultId);
   }
   // ============================================================
   // Projects
   // ============================================================
   upsertProject(project) {
+    const workspaceId = project.workspaceId ?? this.db.prepare("SELECT id FROM pm_workspaces WHERE is_default = 1 LIMIT 1").get();
+    const resolvedWorkspaceId = typeof workspaceId === "string" ? workspaceId : workspaceId?.id ?? null;
     this.db.prepare(`
-      INSERT INTO pm_projects (id, name, path, claude_project_key, runtimescope_project,
+      INSERT INTO pm_projects (id, workspace_id, name, path, claude_project_key, runtimescope_project,
         phase, management_authorized, probable_to_complete, project_status,
         category, sdk_installed, runtime_apps,
         created_at, updated_at, metadata)
-      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+      VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
       ON CONFLICT(id) DO UPDATE SET
+        workspace_id = COALESCE(pm_projects.workspace_id, excluded.workspace_id),
         name = excluded.name,
         path = COALESCE(excluded.path, pm_projects.path),
         claude_project_key = COALESCE(excluded.claude_project_key, pm_projects.claude_project_key),
@@ -3636,6 +4169,7 @@ var PmStore = class {
         metadata = COALESCE(excluded.metadata, pm_projects.metadata)
     `).run(
       project.id,
+      resolvedWorkspaceId,
       project.name,
       project.path ?? null,
       project.claudeProjectKey ?? null,
@@ -3762,13 +4296,132 @@ var PmStore = class {
     this.updateProject(match.id, updates);
     return match.id;
   }
+  /** Find a project's runtimeProjectId by checking if appName appears in any project's runtimeApps. */
+  findProjectIdByApp(appName) {
+    const row = this.db.prepare(`SELECT runtime_project_id FROM pm_projects WHERE runtime_apps LIKE ? AND runtime_project_id IS NOT NULL LIMIT 1`).get(`%"${appName}"%`);
+    return row?.runtime_project_id ?? null;
+  }
   listCategories() {
     const rows = this.db.prepare("SELECT DISTINCT category FROM pm_projects WHERE category IS NOT NULL ORDER BY category ASC").all();
     return rows.map((r) => r.category);
   }
+  // ============================================================
+  // Workspaces (multi-tenant)
+  // ============================================================
+  listWorkspaces() {
+    const rows = this.db.prepare("SELECT * FROM pm_workspaces ORDER BY is_default DESC, name ASC").all();
+    return rows.map(mapWorkspaceRow);
+  }
+  getWorkspace(id) {
+    const row = this.db.prepare("SELECT * FROM pm_workspaces WHERE id = ?").get(id);
+    return row ? mapWorkspaceRow(row) : null;
+  }
+  getWorkspaceBySlug(slug) {
+    const row = this.db.prepare("SELECT * FROM pm_workspaces WHERE slug = ?").get(slug);
+    return row ? mapWorkspaceRow(row) : null;
+  }
+  getDefaultWorkspace() {
+    const row = this.db.prepare("SELECT * FROM pm_workspaces WHERE is_default = 1 LIMIT 1").get();
+    if (!row) {
+      throw new Error("Default workspace missing \u2014 ensureDefaultWorkspace() must run first");
+    }
+    return mapWorkspaceRow(row);
+  }
+  createWorkspace(input) {
+    const id = generateWorkspaceId();
+    const slug = (input.slug ?? input.name).toLowerCase().replace(/[^a-z0-9-]+/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+    if (!slug) {
+      throw new Error("Workspace slug cannot be empty");
+    }
+    if (this.getWorkspaceBySlug(slug)) {
+      throw new Error(`Workspace with slug "${slug}" already exists`);
+    }
+    const now = Date.now();
+    this.db.prepare(
+      `INSERT INTO pm_workspaces (id, name, slug, description, is_default, created_at, updated_at)
+         VALUES (?, ?, ?, ?, 0, ?, ?)`
+    ).run(id, input.name, slug, input.description ?? null, now, now);
+    return { id, name: input.name, slug, description: input.description, createdAt: now, updatedAt: now, isDefault: false };
+  }
+  updateWorkspace(id, updates) {
+    const sets = [];
+    const params = [];
+    if (updates.name !== void 0) {
+      sets.push("name = ?");
+      params.push(updates.name);
+    }
+    if (updates.slug !== void 0) {
+      sets.push("slug = ?");
+      params.push(updates.slug);
+    }
+    if (updates.description !== void 0) {
+      sets.push("description = ?");
+      params.push(updates.description);
+    }
+    if (!sets.length) return;
+    sets.push("updated_at = ?");
+    params.push(Date.now());
+    params.push(id);
+    this.db.prepare(`UPDATE pm_workspaces SET ${sets.join(", ")} WHERE id = ?`).run(...params);
+  }
+  deleteWorkspace(id) {
+    const ws = this.getWorkspace(id);
+    if (!ws) return;
+    if (ws.isDefault) {
+      throw new Error("Cannot delete the default workspace");
+    }
+    const def = this.getDefaultWorkspace();
+    this.db.prepare("UPDATE pm_projects SET workspace_id = ? WHERE workspace_id = ?").run(def.id, id);
+    this.db.prepare("DELETE FROM pm_api_keys WHERE workspace_id = ?").run(id);
+    this.db.prepare("DELETE FROM pm_workspaces WHERE id = ?").run(id);
+  }
+  /** Move a project between workspaces. */
+  setProjectWorkspace(projectId, workspaceId) {
+    const ws = this.getWorkspace(workspaceId);
+    if (!ws) throw new Error(`Workspace ${workspaceId} does not exist`);
+    this.db.prepare("UPDATE pm_projects SET workspace_id = ?, updated_at = ? WHERE id = ?").run(workspaceId, Date.now(), projectId);
+  }
+  // ============================================================
+  // API Keys (workspace-scoped)
+  // ============================================================
+  createApiKey(workspaceId, label, expiresAt) {
+    const ws = this.getWorkspace(workspaceId);
+    if (!ws) throw new Error(`Workspace ${workspaceId} does not exist`);
+    const key = `tk_${randomBytes3(24).toString("hex")}`;
+    const now = Date.now();
+    this.db.prepare(
+      `INSERT INTO pm_api_keys (key, workspace_id, label, created_at, expires_at)
+         VALUES (?, ?, ?, ?, ?)`
+    ).run(key, workspaceId, label, now, expiresAt ?? null);
+    return { key, workspaceId, label, createdAt: now, expiresAt };
+  }
+  listApiKeys(workspaceId) {
+    const rows = this.db.prepare(
+      `SELECT * FROM pm_api_keys WHERE workspace_id = ? AND revoked_at IS NULL ORDER BY created_at DESC`
+    ).all(workspaceId);
+    return rows.map(mapApiKeyRow);
+  }
+  revokeApiKey(key) {
+    this.db.prepare("UPDATE pm_api_keys SET revoked_at = ? WHERE key = ?").run(Date.now(), key);
+  }
+  getWorkspaceByApiKey(key) {
+    const row = this.db.prepare(
+      `SELECT w.* FROM pm_api_keys k
+         JOIN pm_workspaces w ON w.id = k.workspace_id
+         WHERE k.key = ? AND k.revoked_at IS NULL
+         AND (k.expires_at IS NULL OR k.expires_at > ?)`
+    ).get(key, Date.now());
+    if (!row) return null;
+    try {
+      this.db.prepare("UPDATE pm_api_keys SET last_used_at = ? WHERE key = ?").run(Date.now(), key);
+    } catch {
+    }
+    return mapWorkspaceRow(row);
+  }
   mapProjectRow(row) {
     return {
       id: row.id,
+      workspaceId: row.workspace_id ?? void 0,
       name: row.name,
       path: row.path ?? void 0,
       claudeProjectKey: row.claude_project_key ?? void 0,
@@ -4521,12 +5174,69 @@ var PmStore = class {
     };
   }
   // ============================================================
+  // Deleted Projects Blocklist
+  // ============================================================
+  deleteProject(id) {
+    const project = this.getProject(id);
+    if (!project) return;
+    if (project.path) {
+      this.db.prepare(
+        "INSERT OR REPLACE INTO pm_deleted_projects (path, name, deleted_at) VALUES (?, ?, ?)"
+      ).run(project.path, project.name, Date.now());
+    }
+    if (project.claudeProjectKey) {
+      this.db.prepare(
+        "INSERT OR REPLACE INTO pm_deleted_projects (path, name, deleted_at) VALUES (?, ?, ?)"
+      ).run(project.claudeProjectKey, project.name, Date.now());
+    }
+    this.db.prepare("DELETE FROM pm_capex_entries WHERE project_id = ?").run(id);
+    this.db.prepare("DELETE FROM pm_notes WHERE project_id = ?").run(id);
+    this.db.prepare("DELETE FROM pm_tasks WHERE project_id = ?").run(id);
+    this.db.prepare("DELETE FROM pm_sessions WHERE project_id = ?").run(id);
+    this.db.prepare("DELETE FROM pm_projects WHERE id = ?").run(id);
+  }
+  isDeletedPath(path) {
+    const row = this.db.prepare("SELECT 1 FROM pm_deleted_projects WHERE path = ?").get(path);
+    return !!row;
+  }
+  recoverProject(path) {
+    this.db.prepare("DELETE FROM pm_deleted_projects WHERE path = ?").run(path);
+  }
+  listDeletedProjects() {
+    return this.db.prepare("SELECT path, name, deleted_at as deletedAt FROM pm_deleted_projects ORDER BY deleted_at DESC").all();
+  }
+  // ============================================================
   // Cleanup
   // ============================================================
   close() {
     this.db.close();
   }
 };
+function generateWorkspaceId() {
+  return `ws_${randomBytes3(8).toString("hex")}`;
+}
+function mapWorkspaceRow(row) {
+  return {
+    id: row.id,
+    name: row.name,
+    slug: row.slug,
+    description: row.description ?? void 0,
+    isDefault: row.is_default === 1,
+    createdAt: row.created_at,
+    updatedAt: row.updated_at
+  };
+}
+function mapApiKeyRow(row) {
+  return {
+    key: row.key,
+    workspaceId: row.workspace_id,
+    label: row.label,
+    createdAt: row.created_at,
+    lastUsedAt: row.last_used_at ?? void 0,
+    expiresAt: row.expires_at ?? void 0,
+    revokedAt: row.revoked_at ?? void 0
+  };
+}
 
 // src/pm/session-parser.ts
 import { createReadStream } from "fs";
@@ -4733,13 +5443,13 @@ async function parseSessionJsonl(jsonlPath, sessionId, projectId) {
 
 // src/pm/project-discovery.ts
 import { readdir as readdir2, readFile as readFile2, stat as stat2 } from "fs/promises";
-import { join as join4, basename as basename2 } from "path";
-import { existsSync as existsSync5 } from "fs";
+import { join as join5, basename as basename2 } from "path";
+import { existsSync as existsSync6 } from "fs";
 import { homedir as homedir3 } from "os";
 var LOG_PREFIX = "[RuntimeScope PM]";
 async function detectSdkInstalled(projectPath) {
   try {
-    const pkgPath = join4(projectPath, "package.json");
+    const pkgPath = join5(projectPath, "package.json");
     const pkg = JSON.parse(await readFile2(pkgPath, "utf-8"));
     const allDeps = { ...pkg.dependencies, ...pkg.devDependencies };
     if ("@runtimescope/sdk" in allDeps || "@runtimescope/server-sdk" in allDeps) {
@@ -4749,13 +5459,13 @@ async function detectSdkInstalled(projectPath) {
       const workspaces = Array.isArray(pkg.workspaces) ? pkg.workspaces : pkg.workspaces.packages ?? [];
       for (const ws of workspaces) {
         const wsBase = ws.replace(/\/?\*$/, "");
-        const wsDir = join4(projectPath, wsBase);
+        const wsDir = join5(projectPath, wsBase);
         try {
           const entries = await readdir2(wsDir, { withFileTypes: true });
           for (const entry of entries) {
             if (!entry.isDirectory()) continue;
             try {
-              const wsPkg = JSON.parse(await readFile2(join4(wsDir, entry.name, "package.json"), "utf-8"));
+              const wsPkg = JSON.parse(await readFile2(join5(wsDir, entry.name, "package.json"), "utf-8"));
               const wsDeps = { ...wsPkg.dependencies, ...wsPkg.devDependencies };
               if ("@runtimescope/sdk" in wsDeps || "@runtimescope/server-sdk" in wsDeps) {
                 return true;
@@ -4770,7 +5480,7 @@ async function detectSdkInstalled(projectPath) {
   } catch {
   }
   try {
-    await stat2(join4(projectPath, "node_modules", "@runtimescope"));
+    await stat2(join5(projectPath, "node_modules", "@runtimescope"));
     return true;
   } catch {
     return false;
@@ -4801,7 +5511,7 @@ function slugifyPath(fsPath) {
 }
 function decodeClaudeKey(key) {
   const naive = "/" + key.slice(1).replace(/-/g, "/");
-  if (existsSync5(naive)) return naive;
+  if (existsSync6(naive)) return naive;
   const parts = key.slice(1).split("-");
   return resolvePathSegments(parts);
 }
@@ -4809,16 +5519,16 @@ function resolvePathSegments(parts) {
   if (parts.length === 0) return null;
   function tryResolve(prefix, remaining) {
     if (remaining.length === 0) {
-      return existsSync5(prefix) ? prefix : null;
+      return existsSync6(prefix) ? prefix : null;
     }
     for (let count = remaining.length; count >= 1; count--) {
       const segment = remaining.slice(0, count).join("-");
-      const candidate = join4(prefix, segment);
+      const candidate = join5(prefix, segment);
       if (count === remaining.length) {
-        if (existsSync5(candidate)) return candidate;
+        if (existsSync6(candidate)) return candidate;
       } else {
         try {
-          if (existsSync5(candidate)) {
+          if (existsSync6(candidate)) {
             const result = tryResolve(candidate, remaining.slice(count));
             if (result) return result;
           }
@@ -4834,13 +5544,14 @@ function toPeriod(timestampMs) {
   const d = new Date(timestampMs);
   const year = d.getFullYear();
   const month = String(d.getMonth() + 1).padStart(2, "0");
-  return `${year}-${month}`;
+  const day = String(d.getDate()).padStart(2, "0");
+  return `${year}-${month}-${day}`;
 }
 var ProjectDiscovery = class {
   constructor(pmStore, projectManager, claudeBaseDir) {
     this.pmStore = pmStore;
     this.projectManager = projectManager;
-    this.claudeBaseDir = claudeBaseDir ?? join4(homedir3(), ".claude");
+    this.claudeBaseDir = claudeBaseDir ?? join5(homedir3(), ".claude");
   }
   claudeBaseDir;
   /**
@@ -4873,7 +5584,7 @@ var ProjectDiscovery = class {
       sessionsUpdated: 0,
       errors: []
     };
-    const projectsDir = join4(this.claudeBaseDir, "projects");
+    const projectsDir = join5(this.claudeBaseDir, "projects");
     try {
       await stat2(projectsDir);
     } catch {
@@ -4940,6 +5651,7 @@ var ProjectDiscovery = class {
             await this.pmStore.upsertProject(updated);
             result.projectsUpdated = (result.projectsUpdated ?? 0) + 1;
           } else {
+            if (this.pmStore.isDeletedPath(sourcePath)) continue;
             const fsPath = projectDir;
             const project = {
               id,
@@ -4985,10 +5697,10 @@ var ProjectDiscovery = class {
     if (!project.claudeProjectKey) {
       return 0;
     }
-    const projectDir = join4(this.claudeBaseDir, "projects", project.claudeProjectKey);
+    const projectDir = join5(this.claudeBaseDir, "projects", project.claudeProjectKey);
     let sessionsIndexed = 0;
     try {
-      const indexPath = join4(projectDir, "sessions-index.json");
+      const indexPath = join5(projectDir, "sessions-index.json");
       let indexEntries = null;
       try {
         const indexContent = await readFile2(indexPath, "utf-8");
@@ -5001,7 +5713,7 @@ var ProjectDiscovery = class {
       for (const jsonlFile of jsonlFiles) {
         try {
           const sessionId = jsonlFile.replace(".jsonl", "");
-          const jsonlPath = join4(projectDir, jsonlFile);
+          const jsonlPath = join5(projectDir, jsonlFile);
           const fileStat = await stat2(jsonlPath);
           const fileSize = fileStat.size;
           const existingSession = await this.pmStore.getSession(sessionId);
@@ -5036,7 +5748,7 @@ var ProjectDiscovery = class {
    * Process a single Claude project directory key.
    */
   async processClaudeProject(key, result) {
-    const projectDir = join4(this.claudeBaseDir, "projects", key);
+    const projectDir = join5(this.claudeBaseDir, "projects", key);
     let fsPath = decodeClaudeKey(key);
     if (!fsPath) {
       fsPath = await this.resolvePathFromIndex(projectDir);
@@ -5062,6 +5774,8 @@ var ProjectDiscovery = class {
       await this.pmStore.upsertProject(updated);
       result.projectsUpdated = (result.projectsUpdated ?? 0) + 1;
     } else {
+      if (fsPath && this.pmStore.isDeletedPath(fsPath)) return;
+      if (this.pmStore.isDeletedPath(key)) return;
       const project = {
         id,
         name,
@@ -5088,7 +5802,7 @@ var ProjectDiscovery = class {
    */
   async resolvePathFromIndex(projectDir) {
     try {
-      const indexPath = join4(projectDir, "sessions-index.json");
+      const indexPath = join5(projectDir, "sessions-index.json");
       const content = await readFile2(indexPath, "utf-8");
       const index = JSON.parse(content);
       const entry = index.entries?.find((e) => e.projectPath);
@@ -5103,11 +5817,11 @@ var ProjectDiscovery = class {
    */
   async indexSessionsForClaudeProject(projectId, claudeKey) {
     const counts = { discovered: 0, updated: 0 };
-    const projectDir = join4(this.claudeBaseDir, "projects", claudeKey);
+    const projectDir = join5(this.claudeBaseDir, "projects", claudeKey);
     try {
       let indexEntries = null;
       try {
-        const indexPath = join4(projectDir, "sessions-index.json");
+        const indexPath = join5(projectDir, "sessions-index.json");
         const indexContent = await readFile2(indexPath, "utf-8");
         const index = JSON.parse(indexContent);
         indexEntries = index.entries ?? [];
@@ -5118,7 +5832,7 @@ var ProjectDiscovery = class {
       for (const jsonlFile of jsonlFiles) {
         try {
           const sessionId = jsonlFile.replace(".jsonl", "");
-          const jsonlPath = join4(projectDir, jsonlFile);
+          const jsonlPath = join5(projectDir, jsonlFile);
           const fileStat = await stat2(jsonlPath);
           const fileSize = fileStat.size;
           const existingSession = await this.pmStore.getSession(sessionId);
@@ -5308,6 +6022,11 @@ export {
   resolveTlsConfig,
   CollectorServer,
   ProjectManager,
+  readProjectConfig,
+  writeProjectConfig,
+  scaffoldProjectConfig,
+  resolveProjectAppNames,
+  migrateProjectIds,
   AuthManager,
   generateApiKey,
   BUILT_IN_RULES,
@@ -5326,4 +6045,4 @@ export {
   parseSessionJsonl,
   ProjectDiscovery
 };
-//# sourceMappingURL=chunk-GENCCHYK.js.map
+//# sourceMappingURL=chunk-WWFIEANS.js.map