@singhak/nodeui-core 0.3.0 → 0.5.0

package/dist/index.mjs

@@ -57,7 +57,10 @@ var BEARER_PATTERN = /\b(Bearer|Basic)\s+[A-Za-z0-9\-._~+/]+=*/gi;
 var JWT_PATTERN = /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]*/g;
 function maskSecretText(text) {
   if (text.length < 6) return text;
-  return text.replace(URL_CREDENTIALS_PATTERN, `$1${SECRET_MASKED}$2`).replace(BEARER_PATTERN, `$1 ${SECRET_MASKED}`).replace(JWT_PATTERN, SECRET_MASKED).replace(TEXT_PAIR_PATTERN, `$1$2${SECRET_MASKED}`);
+  return text.replace(URL_CREDENTIALS_PATTERN, `$1${SECRET_MASKED}$2`).replace(BEARER_PATTERN, `$1 ${SECRET_MASKED}`).replace(JWT_PATTERN, SECRET_MASKED).replace(TEXT_PAIR_PATTERN, (_m, name, sep2, value) => {
+    const quote = value.startsWith('"') || value.startsWith("'") ? value[0] : "";
+    return `${name}${sep2}${quote}${SECRET_MASKED}${quote}`;
+  });
 }
 function resolveActivation(env) {
   if (env.NODEUI_ENABLED === "true") {
@@ -95,21 +98,91 @@ function ipv4ToInt(ip) {
   }
   return out;
 }
+function ipv6ToBigInt(address) {
+  const text = address.split("%")[0] ?? "";
+  if (!text.includes(":")) return null;
+  let head = text;
+  let tailGroups = [];
+  const doubleColon = text.indexOf("::");
+  if (doubleColon !== -1) {
+    if (text.indexOf("::", doubleColon + 1) !== -1) return null;
+    head = text.slice(0, doubleColon);
+    const tail = text.slice(doubleColon + 2);
+    tailGroups = tail === "" ? [] : tail.split(":");
+  }
+  const headGroups = doubleColon !== -1 ? head === "" ? [] : head.split(":") : text.split(":");
+  const groups = doubleColon !== -1 ? [...headGroups, ...tailGroups] : headGroups;
+  const last = groups[groups.length - 1];
+  const v4 = last?.includes(".") ? ipv4ToInt(last) : null;
+  if (last?.includes(".")) {
+    if (v4 === null) return null;
+    groups.splice(
+      groups.length - 1,
+      1,
+      (v4 >>> 16 & 65535).toString(16),
+      (v4 & 65535).toString(16)
+    );
+  }
+  const expected = 8;
+  if (doubleColon === -1 ? groups.length !== expected : groups.length >= expected) return null;
+  const parseGroup = (g) => /^[0-9a-f]{1,4}$/i.test(g) ? BigInt(`0x${g}`) : null;
+  const headLen = doubleColon !== -1 ? headGroups.length : groups.length;
+  const fill = expected - groups.length;
+  const full = [
+    ...groups.slice(0, headLen),
+    ...Array(doubleColon !== -1 ? fill : 0).fill("0"),
+    ...groups.slice(headLen)
+  ];
+  let out = 0n;
+  for (const g of full) {
+    const n = parseGroup(g);
+    if (n === null) return null;
+    out = out << 16n | n;
+  }
+  return out;
+}
+function isValidAddressEntry(entry) {
+  const normalized = normalizeIp(entry);
+  if (!normalized.includes("/"))
+    return ipv4ToInt(normalized) !== null || ipv6ToBigInt(normalized) !== null;
+  const [base = "", bitsRaw = ""] = normalized.split("/");
+  const bits = Number(bitsRaw);
+  if (!/^\d{1,3}$/.test(bitsRaw) || !Number.isInteger(bits)) return false;
+  if (ipv4ToInt(base) !== null) return bits <= 32;
+  return ipv6ToBigInt(base) !== null && bits <= 128;
+}
 function matchesAddress(address, allowed) {
   if (!address) return false;
   const ip = normalizeIp(address);
-  for (const entry of allowed) {
+  const ip4 = ipv4ToInt(ip);
+  const ip6 = ip4 === null ? ipv6ToBigInt(ip) : null;
+  for (const raw of allowed) {
+    const entry = normalizeIp(raw);
     if (!entry.includes("/")) {
-      if (normalizeIp(entry) === ip) return true;
+      if (entry === ip) return true;
+      const e4 = ipv4ToInt(entry);
+      if (ip4 !== null && e4 !== null) {
+        if (ip4 === e4) return true;
+        continue;
+      }
+      const e6 = ipv6ToBigInt(entry);
+      if (ip6 !== null && e6 !== null && ip6 === e6) return true;
       continue;
     }
-    const [base, bitsRaw] = entry.split("/");
+    const [base = "", bitsRaw = ""] = entry.split("/");
+    if (!/^\d{1,3}$/.test(bitsRaw)) continue;
     const bits = Number(bitsRaw);
-    const a = ipv4ToInt(ip);
-    const b = ipv4ToInt(base ?? "");
-    if (a === null || b === null || !Number.isInteger(bits) || bits < 0 || bits > 32) continue;
-    const mask = bits === 0 ? 0 : 4294967295 << 32 - bits >>> 0;
-    if ((a & mask) >>> 0 === (b & mask) >>> 0) return true;
+    const b4 = ipv4ToInt(base);
+    if (b4 !== null) {
+      if (ip4 === null || bits > 32) continue;
+      const mask = bits === 0 ? 0 : 4294967295 << 32 - bits >>> 0;
+      if ((ip4 & mask) >>> 0 === (b4 & mask) >>> 0) return true;
+      continue;
+    }
+    const b6 = ipv6ToBigInt(base);
+    if (b6 === null || ip6 === null || bits > 128) continue;
+    const shift = BigInt(128 - bits);
+    if (ip6 >> shift === b6 >> shift) return true;
   }
   return false;
 }
@@ -340,6 +413,9 @@ var MIME_TYPES = {
   ".woff2": "font/woff2",
   ".webmanifest": "application/manifest+json"
 };
+function uiAssetsDir() {
+  return resolve(__dirname, "..", "static");
+}
 function resolveStaticAsset(rootDir, urlPath) {
   const relative = urlPath === "" ? "index.html" : urlPath.replace(/^\/+/, "");
   const candidate = resolve(rootDir, relative);
@@ -594,12 +670,12 @@ var LAG_DEGRADED_MS = 200;
 var CHECK_TIMEOUT_MS = 3e3;
 var CHECK_CACHE_MS = 5e3;
 function withTimeout(promise, ms) {
-  return new Promise((resolve3, reject) => {
+  return new Promise((resolve2, reject) => {
     const timer = setTimeout(() => reject(new Error(`timed out after ${ms}ms`)), ms);
     promise.then(
       (value) => {
         clearTimeout(timer);
-        resolve3(value);
+        resolve2(value);
       },
       (err) => {
         clearTimeout(timer);
@@ -687,14 +763,355 @@ var HealthProvider = class {
   }
 };
 
+// src/providers/queries.ts
+import { createRequire } from "module";
+import { join as join2 } from "path";
+
+// src/context.ts
+import { AsyncLocalStorage } from "async_hooks";
+var storage = new AsyncLocalStorage();
+var ids = /* @__PURE__ */ new WeakMap();
+var suppression = new AsyncLocalStorage();
+function runSuppressed(fn) {
+  return suppression.run(true, fn);
+}
+function isSuppressed() {
+  return suppression.getStore() === true;
+}
+function currentRequestId() {
+  return storage.getStore()?.requestId;
+}
+function bindRequestId(req, requestId) {
+  ids.set(req, requestId);
+}
+function runWithRequestId(requestId, fn) {
+  return storage.run({ requestId }, fn);
+}
+function runInRequestContext(req, fn) {
+  const requestId = ids.get(req);
+  return requestId === void 0 ? fn() : storage.run({ requestId }, fn);
+}
+function enterRequestContext(req) {
+  const requestId = ids.get(req);
+  if (requestId !== void 0) storage.enterWith({ requestId });
+}
+
+// src/providers/queries.ts
+var RESPONSE_PAGE_SIZE = 100;
+var MAX_SQL_CHARS = 2e3;
+var N_PLUS_ONE_THRESHOLD = 5;
+var defaultLoader = (name) => {
+  try {
+    return createRequire(join2(process.cwd(), "noop.js"))(name);
+  } catch {
+    return null;
+  }
+};
+var recorders = /* @__PURE__ */ new Set();
+var restorers = [];
+function normalizeSql(sql) {
+  return sql.replace(/'(?:[^']|'')*'/g, "?").replace(/\b\d+(?:\.\d+)?\b/g, "?").replace(/\(\s*\?(?:\s*,\s*\?)+\s*\)/g, "(?)").replace(/\s+/g, " ").trim().toLowerCase();
+}
+function emit(entry) {
+  for (const record of recorders) {
+    try {
+      record(entry);
+    } catch {
+    }
+  }
+}
+function sqlOf(arg) {
+  if (typeof arg === "string") return arg;
+  if (arg && typeof arg === "object") {
+    const candidate = arg.text ?? arg.sql;
+    if (typeof candidate === "string") return candidate;
+  }
+  return null;
+}
+function rowCountOf(result) {
+  if (Array.isArray(result)) {
+    const first = result[0];
+    return Array.isArray(first) ? first.length : result.length;
+  }
+  if (result && typeof result === "object") {
+    const r = result;
+    if (typeof r.rowCount === "number") return r.rowCount;
+    if (typeof r.affectedRows === "number") return r.affectedRows;
+  }
+  return void 0;
+}
+function wrapQueryMethod(proto, method, system, rowCount) {
+  const original = proto[method];
+  if (typeof original !== "function") return;
+  const orig = original;
+  const wrapped = function(...args) {
+    if (recorders.size === 0) return orig.apply(this, args);
+    const sql = sqlOf(args[0]);
+    if (sql === null) return orig.apply(this, args);
+    const started = process.hrtime.bigint();
+    const timestampMs = Date.now();
+    const requestId = currentRequestId();
+    let done = false;
+    const finish = (error, result) => {
+      if (done) return;
+      done = true;
+      emit({
+        system,
+        sql: sql.slice(0, MAX_SQL_CHARS),
+        durationMs: Number(process.hrtime.bigint() - started) / 1e6,
+        timestampMs,
+        ...requestId !== void 0 ? { requestId } : {},
+        ...error ? { error: error instanceof Error ? error.message : String(error) } : {},
+        ...!error && rowCount(result) !== void 0 ? { rowCount: rowCount(result) } : {}
+      });
+    };
+    const last = args.length - 1;
+    const hasCallback = typeof args[last] === "function";
+    if (hasCallback) {
+      const callback = args[last];
+      args[last] = function(err, result, ...rest) {
+        finish(err, result);
+        return callback.call(this, err, result, ...rest);
+      };
+    }
+    const ret = orig.apply(this, args);
+    if (!hasCallback && ret && typeof ret.then === "function") {
+      ret.then(
+        (result) => finish(void 0, result),
+        (error) => finish(error ?? new Error("query failed"))
+      );
+    } else if (!hasCallback && ret && typeof ret.once === "function") {
+      const emitter = ret;
+      emitter.once("end", (result) => finish(void 0, result));
+      emitter.once("error", (error) => finish(error ?? new Error("query failed")));
+    }
+    return ret;
+  };
+  proto[method] = wrapped;
+  restorers.push(() => {
+    if (proto[method] === wrapped) proto[method] = original;
+  });
+}
+function instrumentDrivers(load) {
+  const pg = load("pg");
+  if (pg?.Client?.prototype) wrapQueryMethod(pg.Client.prototype, "query", "pg", rowCountOf);
+  const mysql2 = load("mysql2");
+  const proto = mysql2?.Connection?.prototype;
+  if (proto) {
+    wrapQueryMethod(proto, "query", "mysql2", rowCountOf);
+    wrapQueryMethod(proto, "execute", "mysql2", rowCountOf);
+  }
+}
+function interceptQueries(record, load = defaultLoader) {
+  const first = recorders.size === 0;
+  recorders.add(record);
+  if (first) {
+    try {
+      instrumentDrivers(load);
+    } catch {
+    }
+  }
+  return () => {
+    if (!recorders.delete(record) || recorders.size > 0) return;
+    while (restorers.length > 0) restorers.pop()?.();
+  };
+}
+var QueriesProvider = class {
+  constructor(options) {
+    this.options = options;
+    this.buffer = new RingBuffer(options.size);
+  }
+  options;
+  id = "queries";
+  buffer;
+  nextId = 1;
+  release = null;
+  failed = 0;
+  /** Called with every newly recorded entry (persistence hook). */
+  onRecord;
+  start() {
+    if (this.release) return;
+    this.release = interceptQueries((entry) => this.record(entry), this.options.loader);
+  }
+  stop() {
+    this.release?.();
+    this.release = null;
+  }
+  record(entry) {
+    const full = { id: this.nextId, ...entry };
+    this.buffer.push(full);
+    this.nextId += 1;
+    if (entry.error) this.failed += 1;
+    this.onRecord?.(full);
+  }
+  /** Re-inserts journaled entries without re-emitting them. */
+  restore(entries) {
+    for (const entry of entries) {
+      this.buffer.push(entry);
+      this.nextId = Math.max(this.nextId, entry.id + 1);
+      if (entry.error) this.failed += 1;
+    }
+  }
+  get() {
+    const all = this.buffer.toArray();
+    const counts = /* @__PURE__ */ new Map();
+    const keyOf = (e) => e.requestId === void 0 ? null : `${e.requestId}|${normalizeSql(e.sql)}`;
+    for (const e of all) {
+      const key = keyOf(e);
+      if (key) counts.set(key, (counts.get(key) ?? 0) + 1);
+    }
+    const flagged = /* @__PURE__ */ new Set();
+    const entries = all.map((e) => {
+      const key = keyOf(e);
+      const repeats = key ? counts.get(key) ?? 0 : 0;
+      const nPlusOne = repeats >= N_PLUS_ONE_THRESHOLD;
+      if (nPlusOne && key) flagged.add(key);
+      return {
+        ...e,
+        slow: e.durationMs >= this.options.slowQueryMs,
+        ...nPlusOne ? { nPlusOne, repeats } : {}
+      };
+    });
+    return {
+      ok: true,
+      data: {
+        total: this.nextId - 1,
+        failed: this.failed,
+        slow: entries.filter((e) => e.slow).length,
+        nPlusOneGroups: flagged.size,
+        slowQueryMs: this.options.slowQueryMs,
+        entries: entries.slice(Math.max(0, entries.length - RESPONSE_PAGE_SIZE))
+      }
+    };
+  }
+};
+
+// src/providers/errors.ts
+import { createHash as createHash2 } from "crypto";
+var MAX_GROUPS = 100;
+var MAX_STACK_CHARS = 4e3;
+var MAX_MESSAGE_CHARS = 500;
+var FINGERPRINT_FRAMES = 3;
+function toError(value) {
+  if (value instanceof Error) {
+    return { name: value.name, message: value.message, stack: value.stack ?? "" };
+  }
+  let message;
+  try {
+    message = typeof value === "string" ? value : JSON.stringify(value);
+  } catch {
+    message = String(value);
+  }
+  return { name: "NonError", message: message ?? String(value), stack: "" };
+}
+function topFrames(stack) {
+  const frames = [];
+  for (const line of stack.split("\n")) {
+    const match = /^\s*at\s+(?:(.+?)\s+\()?(?:.*[\\/])?([^\\/:()]+?)(?::\d+){0,2}\)?\s*$/.exec(
+      line
+    );
+    if (match) frames.push(`${match[1] ?? ""}@${match[2] ?? ""}`);
+    if (frames.length >= FINGERPRINT_FRAMES) break;
+  }
+  return frames;
+}
+function fingerprintError(name, message, stack) {
+  const shape = message.replace(/\b[0-9a-f]{8}-[0-9a-f-]{27}\b/gi, "#").replace(/\b[0-9a-f]{24}\b/gi, "#").replace(/\d+/g, "#");
+  return createHash2("sha1").update([name, shape, ...topFrames(stack)].join("\n")).digest("hex").slice(0, 12);
+}
+var ErrorsProvider = class {
+  id = "errors";
+  groups = /* @__PURE__ */ new Map();
+  total = 0;
+  listener = null;
+  /** Called with every newly recorded occurrence (persistence hook). */
+  onRecord;
+  /** Starts observing process-level failures. Idempotent. */
+  attach() {
+    if (this.listener) return;
+    this.listener = (err, origin) => this.record(err, origin === "unhandledRejection" ? "rejection" : "uncaught");
+    process.on("uncaughtExceptionMonitor", this.listener);
+  }
+  detach() {
+    if (!this.listener) return;
+    process.removeListener("uncaughtExceptionMonitor", this.listener);
+    this.listener = null;
+  }
+  record(error, source, context = {}) {
+    try {
+      const { name, message, stack } = toError(error);
+      const requestId = context.requestId ?? currentRequestId();
+      const event = {
+        name,
+        message,
+        stack: stack.slice(0, MAX_STACK_CHARS),
+        source,
+        at: Date.now(),
+        ...requestId !== void 0 ? { requestId } : {},
+        ...context.route ? { route: context.route } : {},
+        ...context.status !== void 0 ? { status: context.status } : {}
+      };
+      this.apply(event);
+      this.onRecord?.(event);
+    } catch {
+    }
+  }
+  /** Re-applies journaled occurrences without re-emitting them. */
+  restore(events) {
+    for (const event of events) this.apply(event);
+  }
+  apply(event) {
+    const { name, message, stack, source, at: now, requestId } = event;
+    const context = { route: event.route, status: event.status };
+    const fingerprint = fingerprintError(name, message, stack);
+    const existing = this.groups.get(fingerprint);
+    this.total += 1;
+    if (existing) {
+      existing.count += 1;
+      existing.lastSeenMs = now;
+      existing.message = message.slice(0, MAX_MESSAGE_CHARS);
+      existing.stack = stack.slice(0, MAX_STACK_CHARS);
+      if (requestId !== void 0) existing.lastRequestId = requestId;
+      if (context.route) existing.lastRoute = context.route;
+      if (context.status !== void 0) existing.lastStatus = context.status;
+      return;
+    }
+    if (this.groups.size >= MAX_GROUPS) {
+      let oldest;
+      for (const g of this.groups.values()) {
+        if (!oldest || g.lastSeenMs < oldest.lastSeenMs) oldest = g;
+      }
+      if (oldest) this.groups.delete(oldest.id);
+    }
+    this.groups.set(fingerprint, {
+      id: fingerprint,
+      name,
+      message: message.slice(0, MAX_MESSAGE_CHARS),
+      stack: stack.slice(0, MAX_STACK_CHARS),
+      source,
+      count: 1,
+      firstSeenMs: now,
+      lastSeenMs: now,
+      ...requestId !== void 0 ? { lastRequestId: requestId } : {},
+      ...context.route ? { lastRoute: context.route } : {},
+      ...context.status !== void 0 ? { lastStatus: context.status } : {}
+    });
+  }
+  get() {
+    const groups = [...this.groups.values()].sort((a, b) => b.lastSeenMs - a.lastSeenMs);
+    return { ok: true, data: { total: this.total, groups } };
+  }
+};
+
 // src/providers/outgoing.ts
 import diagnosticsChannel from "diagnostics_channel";
 import http from "http";
 import https from "https";
 import { syncBuiltinESMExports } from "module";
-var RESPONSE_PAGE_SIZE = 100;
-var recorders = /* @__PURE__ */ new Set();
+var RESPONSE_PAGE_SIZE2 = 100;
+var recorders2 = /* @__PURE__ */ new Set();
 var originals = /* @__PURE__ */ new Map();
+var installed = /* @__PURE__ */ new Map();
 var undiciUnsubscribe = null;
 function describeTarget(defaultProtocol, args) {
   try {
@@ -723,8 +1140,8 @@ function describeTarget(defaultProtocol, args) {
     return null;
   }
 }
-function emit(entry) {
-  for (const record of recorders) {
+function emit2(entry) {
+  for (const record of recorders2) {
     try {
       record(entry);
     } catch {
@@ -736,21 +1153,24 @@ function wrapModule(mod, protocol) {
     const key = `${protocol}${name}`;
     const original = mod[name];
     originals.set(key, original);
+    const state = { live: true };
     const wrapped = function(...args) {
       const req = original.apply(this, args);
-      const target = recorders.size > 0 ? describeTarget(protocol, args) : null;
+      const target = state.live && recorders2.size > 0 && !isSuppressed() ? describeTarget(protocol, args) : null;
       if (target && req && typeof req.once === "function") {
         const started = process.hrtime.bigint();
         const timestampMs = Date.now();
+        const requestId = currentRequestId();
         let done = false;
         const finish = (status, error) => {
           if (done) return;
           done = true;
-          emit({
+          emit2({
             ...target,
             status,
             durationMs: Number(process.hrtime.bigint() - started) / 1e6,
             timestampMs,
+            ...requestId !== void 0 ? { requestId } : {},
             ...error ? { error } : {}
           });
         };
@@ -763,15 +1183,21 @@ function wrapModule(mod, protocol) {
       }
       return req;
     };
+    installed.set(key, { fn: wrapped, state });
     mod[name] = wrapped;
   }
   syncBuiltinESMExports();
 }
 function unwrapModule(mod, protocol) {
   for (const name of ["request", "get"]) {
-    const original = originals.get(`${protocol}${name}`);
-    if (original) mod[name] = original;
-    originals.delete(`${protocol}${name}`);
+    const key = `${protocol}${name}`;
+    const original = originals.get(key);
+    const ours = installed.get(key);
+    const target = mod;
+    if (original && ours && target[name] === ours.fn) target[name] = original;
+    if (ours) ours.state.live = false;
+    originals.delete(key);
+    installed.delete(key);
   }
   syncBuiltinESMExports();
 }
@@ -784,7 +1210,13 @@ function subscribeUndici() {
   });
   const onCreate = (message) => {
     const request = message.request;
-    if (request) started.set(request, { at: process.hrtime.bigint(), ts: Date.now() });
+    if (request && !isSuppressed()) {
+      started.set(request, {
+        at: process.hrtime.bigint(),
+        ts: Date.now(),
+        requestId: currentRequestId()
+      });
+    }
   };
   const onHeaders = (message) => {
     const { request, response } = message;
@@ -797,11 +1229,12 @@ function subscribeUndici() {
     const begin = started.get(request);
     if (!begin) return;
     started.delete(request);
-    emit({
+    emit2({
       ...target(request),
       status: statuses.get(request) ?? null,
       durationMs: Number(process.hrtime.bigint() - begin.at) / 1e6,
       timestampMs: begin.ts,
+      ...begin.requestId !== void 0 ? { requestId: begin.requestId } : {},
       ...error ? { error } : {}
     });
   };
@@ -822,8 +1255,8 @@ function subscribeUndici() {
   };
 }
 function interceptOutgoing(record) {
-  const first = recorders.size === 0;
-  recorders.add(record);
+  const first = recorders2.size === 0;
+  recorders2.add(record);
   if (first) {
     wrapModule(http, "http:");
     wrapModule(https, "https:");
@@ -834,7 +1267,7 @@ function interceptOutgoing(record) {
     }
   }
   return () => {
-    if (!recorders.delete(record) || recorders.size > 0) return;
+    if (!recorders2.delete(record) || recorders2.size > 0) return;
     unwrapModule(http, "http:");
     unwrapModule(https, "https:");
     undiciUnsubscribe?.();
@@ -847,6 +1280,8 @@ var OutgoingProvider = class {
   nextId = 1;
   failed = 0;
   release = null;
+  /** Called with every newly recorded entry (persistence hook). */
+  onRecord;
   constructor(size) {
     this.buffer = new RingBuffer(size);
   }
@@ -859,12 +1294,22 @@ var OutgoingProvider = class {
     this.release = null;
   }
   record(entry) {
-    this.buffer.push({ id: this.nextId, ...entry });
+    const full = { id: this.nextId, ...entry };
+    this.buffer.push(full);
     this.nextId += 1;
     if (entry.error || entry.status !== null && entry.status >= 500) this.failed += 1;
+    this.onRecord?.(full);
+  }
+  /** Re-inserts journaled entries without re-emitting them. */
+  restore(entries) {
+    for (const entry of entries) {
+      this.buffer.push(entry);
+      this.nextId = Math.max(this.nextId, entry.id + 1);
+      if (entry.error || entry.status !== null && entry.status >= 500) this.failed += 1;
+    }
   }
   get() {
-    const entries = this.buffer.slice(Math.max(0, this.buffer.length - RESPONSE_PAGE_SIZE));
+    const entries = this.buffer.slice(Math.max(0, this.buffer.length - RESPONSE_PAGE_SIZE2));
     return { ok: true, data: { total: this.nextId - 1, failed: this.failed, entries } };
   }
 };
@@ -872,10 +1317,10 @@ var OutgoingProvider = class {
 // src/providers/heap-snapshot.ts
 import { chmod, mkdir, stat } from "fs/promises";
 import { tmpdir } from "os";
-import { join as join2 } from "path";
+import { join as join3 } from "path";
 import { writeHeapSnapshot } from "v8";
 function defaultSnapshotDir() {
-  return process.env.NODEUI_HEAP_SNAPSHOT_DIR ?? join2(tmpdir(), "nodeui-heap");
+  return process.env.NODEUI_HEAP_SNAPSHOT_DIR ?? join3(tmpdir(), "nodeui-heap");
 }
 var HeapSnapshotProvider = class {
   id = "heap-snapshot";
@@ -887,7 +1332,7 @@ var HeapSnapshotProvider = class {
     const dir = ctx.config.heapSnapshotDir || defaultSnapshotDir();
     const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
     const fileName = `nodeui-heap-${process.pid}-${stamp}.heapsnapshot`;
-    const filePath = join2(dir, fileName);
+    const filePath = join3(dir, fileName);
     try {
       await mkdir(dir, { recursive: true, mode: 448 });
       writeHeapSnapshot(filePath);
@@ -914,24 +1359,89 @@ var HeapSnapshotProvider = class {
 };
 
 // src/providers/requests.ts
-var RESPONSE_PAGE_SIZE2 = 100;
+var RESPONSE_PAGE_SIZE3 = 100;
+var MAX_ROUTE_STATS = 8;
+function percentile(sorted, p) {
+  if (sorted.length === 0) return 0;
+  const index = Math.min(sorted.length - 1, Math.max(0, Math.ceil(p * sorted.length) - 1));
+  return sorted[index] ?? 0;
+}
+function routeKey(path2) {
+  return path2.split("/").map(
+    (seg) => /^\d+$/.test(seg) || /^[0-9a-f]{8}-[0-9a-f-]{27}$/i.test(seg) || /^[0-9a-f]{24}$/i.test(seg) ? ":id" : seg
+  ).join("/");
+}
+function summarizeRequests(entries) {
+  const durations = entries.map((e) => e.durationMs).sort((a, b) => a - b);
+  const byStatus = { "2xx": 0, "3xx": 0, "4xx": 0, "5xx": 0 };
+  const groups = /* @__PURE__ */ new Map();
+  for (const e of entries) {
+    const bucket = `${Math.floor(e.status / 100)}xx`;
+    if (bucket in byStatus) byStatus[bucket] += 1;
+    const path2 = e.route ?? routeKey(e.path);
+    const key = `${e.method} ${path2}`;
+    const group = groups.get(key) ?? { method: e.method, path: path2, ms: [], errors: 0 };
+    group.ms.push(e.durationMs);
+    if (e.status >= 500) group.errors += 1;
+    groups.set(key, group);
+  }
+  const routes = [...groups.values()].map((g) => {
+    const sorted = [...g.ms].sort((a, b) => a - b);
+    return {
+      method: g.method,
+      path: g.path,
+      count: g.ms.length,
+      avgMs: g.ms.reduce((a, b) => a + b, 0) / g.ms.length,
+      p95Ms: percentile(sorted, 0.95),
+      errors: g.errors
+    };
+  }).sort((a, b) => b.p95Ms - a.p95Ms).slice(0, MAX_ROUTE_STATS);
+  return {
+    count: entries.length,
+    errors: byStatus["5xx"],
+    errorRate: entries.length === 0 ? 0 : byStatus["5xx"] / entries.length,
+    avgMs: durations.length === 0 ? 0 : durations.reduce((a, b) => a + b, 0) / durations.length,
+    p50Ms: percentile(durations, 0.5),
+    p95Ms: percentile(durations, 0.95),
+    p99Ms: percentile(durations, 0.99),
+    byStatus,
+    routes
+  };
+}
 var RequestsProvider = class {
   id = "requests";
   buffer;
   nextId = 1;
+  /** Called with every newly recorded entry (persistence hook). */
+  onRecord;
   constructor(size) {
     this.buffer = new RingBuffer(size);
   }
-  record(entry) {
-    this.buffer.push({ id: this.nextId, ...entry });
+  /** Reserves an id up front so in-flight work can be attributed to the request. */
+  reserveId() {
+    const id = this.nextId;
     this.nextId += 1;
+    return id;
+  }
+  record(entry, id = this.reserveId()) {
+    const full = { id, ...entry };
+    this.buffer.push(full);
+    this.onRecord?.(full);
+  }
+  /** Re-inserts journaled entries without re-emitting them. */
+  restore(entries) {
+    for (const entry of entries) {
+      this.buffer.push(entry);
+      this.nextId = Math.max(this.nextId, entry.id + 1);
+    }
   }
   get length() {
     return this.buffer.length;
   }
   get() {
-    const entries = this.buffer.slice(Math.max(0, this.buffer.length - RESPONSE_PAGE_SIZE2));
-    return { ok: true, data: { total: this.buffer.length, entries } };
+    const entries = this.buffer.slice(Math.max(0, this.buffer.length - RESPONSE_PAGE_SIZE3));
+    const summary = summarizeRequests(this.buffer.toArray());
+    return { ok: true, data: { total: this.buffer.length, entries, summary } };
   }
 };
 
@@ -1109,7 +1619,7 @@ function installWrappers() {
     const wrapper = (...args) => {
       for (const push of pushes) {
         try {
-          push({ level, message: args.map(formatArg).join(" ") });
+          push({ level, message: args.map(formatArg).join(" "), requestId: currentRequestId() });
         } catch {
         }
       }
@@ -1153,8 +1663,13 @@ var LogsProvider = class {
   }
   start() {
     if (this.release) return;
-    this.release = interceptConsole(({ level, message }) => {
-      this.buffer.push({ level, message, timestamp: Date.now() });
+    this.release = interceptConsole(({ level, message, requestId }) => {
+      this.buffer.push({
+        level,
+        message,
+        timestamp: Date.now(),
+        ...requestId !== void 0 ? { requestId } : {}
+      });
     });
   }
   stop() {
@@ -1178,6 +1693,160 @@ var LogsProvider = class {
   }
 };
 
+// src/request-detail.ts
+var DEFAULT_REQUEST_DETAIL = {
+  query: true,
+  headers: true,
+  bodies: false,
+  maxBodyBytes: 4096
+};
+function resolveRequestDetail(option, bodiesFromEnv) {
+  if (option === false) {
+    return { query: false, headers: false, bodies: false, maxBodyBytes: 0 };
+  }
+  const given = typeof option === "object" ? option : {};
+  const maxBodyBytes = given.maxBodyBytes ?? DEFAULT_REQUEST_DETAIL.maxBodyBytes;
+  if (!Number.isInteger(maxBodyBytes) || maxBodyBytes <= 0 || maxBodyBytes > 1048576) {
+    throw new Error("captureRequestDetail.maxBodyBytes must be an integer in 1..1048576");
+  }
+  return {
+    query: given.query ?? DEFAULT_REQUEST_DETAIL.query,
+    headers: given.headers ?? DEFAULT_REQUEST_DETAIL.headers,
+    bodies: given.bodies ?? (bodiesFromEnv || DEFAULT_REQUEST_DETAIL.bodies),
+    maxBodyBytes
+  };
+}
+var ALWAYS_REDACT = /^(authorization|proxy-authorization|cookie|set-cookie|x-api-key)$/i;
+var TEXTUAL_TYPE = /json|text|xml|x-www-form-urlencoded|javascript|graphql/i;
+function queryOf(req) {
+  const raw = req.originalUrl ?? req.url ?? "";
+  const index = raw.indexOf("?");
+  if (index === -1) return void 0;
+  const out = {};
+  for (const [key, value] of new URLSearchParams(raw.slice(index + 1))) {
+    out[key] = SECRET_KEY_PATTERN.test(key) ? SECRET_MASKED : value;
+  }
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+function headersOf(req) {
+  const out = {};
+  for (const [name, value] of Object.entries(req.headers)) {
+    if (value === void 0) continue;
+    out[name] = ALWAYS_REDACT.test(name) || SECRET_KEY_PATTERN.test(name) ? SECRET_MASKED : Array.isArray(value) ? value.join(", ") : value;
+  }
+  return out;
+}
+function responseType(res) {
+  const header = res.getHeader("content-type");
+  if (header !== void 0) return String(header);
+  const raw = res._header;
+  const match = typeof raw === "string" ? /^content-type:[ \t]*(.*?)\r?$/im.exec(raw) : null;
+  return match?.[1] ?? "";
+}
+var BodyCollector = class {
+  constructor(max) {
+    this.max = max;
+  }
+  max;
+  chunks = [];
+  size = 0;
+  total = 0;
+  add(chunk, encoding) {
+    let buf;
+    if (Buffer.isBuffer(chunk)) buf = chunk;
+    else if (typeof chunk === "string") {
+      buf = Buffer.from(
+        chunk,
+        typeof encoding === "string" ? encoding : "utf8"
+      );
+    } else if (chunk instanceof Uint8Array) buf = Buffer.from(chunk);
+    else return;
+    this.total += buf.length;
+    if (this.size >= this.max) return;
+    const slice = buf.subarray(0, this.max - this.size);
+    this.chunks.push(slice);
+    this.size += slice.length;
+  }
+  get truncated() {
+    return this.total > this.size;
+  }
+  text() {
+    return Buffer.concat(this.chunks).toString("utf8");
+  }
+};
+function maskBody(text, contentType, mask, truncated) {
+  if (!mask) return text;
+  if (!truncated && /json/i.test(contentType)) {
+    try {
+      return JSON.stringify(maskSecrets(JSON.parse(text)));
+    } catch {
+    }
+  }
+  return maskSecretText(text);
+}
+function captureRequestDetail(req, res, settings, mask) {
+  let reqBody = null;
+  let resBody = null;
+  if (settings.bodies) {
+    const reqType = String(req.headers["content-type"] ?? "");
+    if (TEXTUAL_TYPE.test(reqType)) {
+      const collector2 = new BodyCollector(settings.maxBodyBytes);
+      reqBody = collector2;
+      const emit3 = req.emit.bind(req);
+      req.emit = ((event, ...args) => {
+        if (event === "data") {
+          try {
+            collector2.add(args[0]);
+          } catch {
+          }
+        }
+        return emit3(event, ...args);
+      });
+    }
+    const collector = new BodyCollector(settings.maxBodyBytes);
+    resBody = collector;
+    const write = res.write.bind(res);
+    const end = res.end.bind(res);
+    const textual = () => TEXTUAL_TYPE.test(responseType(res));
+    res.write = ((chunk, ...rest) => {
+      try {
+        if (textual()) collector.add(chunk, rest[0]);
+      } catch {
+      }
+      return write(chunk, ...rest);
+    });
+    res.end = ((chunk, ...rest) => {
+      try {
+        if (chunk && typeof chunk !== "function" && textual()) collector.add(chunk, rest[0]);
+      } catch {
+      }
+      return end(chunk, ...rest);
+    });
+  }
+  return () => {
+    const detail = {};
+    if (settings.query) {
+      const query = queryOf(req);
+      if (query) detail.query = query;
+    }
+    if (settings.headers) detail.headers = headersOf(req);
+    if (reqBody && reqBody.total > 0) {
+      detail.requestBody = maskBody(
+        reqBody.text(),
+        String(req.headers["content-type"] ?? ""),
+        mask,
+        reqBody.truncated
+      );
+      if (reqBody.truncated) detail.requestBodyTruncated = true;
+    }
+    if (resBody && resBody.total > 0) {
+      detail.responseBody = maskBody(resBody.text(), responseType(res), mask, resBody.truncated);
+      if (resBody.truncated) detail.responseBodyTruncated = true;
+    }
+    return detail;
+  };
+}
+
 // src/sse.ts
 function startSse(res, extraHeaders = {}) {
   let closed = false;
@@ -1210,8 +1879,268 @@ function startSse(res, extraHeaders = {}) {
 
 // src/server.ts
 import { tmpdir as tmpdir2 } from "os";
-import { join as join3, resolve as resolve2 } from "path";
-var STATIC_ROOT = resolve2(__dirname, "..", "static");
+import { join as join4 } from "path";
+
+// src/otlp.ts
+import { randomBytes as randomBytes2 } from "crypto";
+var KIND_SERVER = 2;
+var KIND_CLIENT = 3;
+var STATUS_ERROR = 2;
+var MAX_QUEUE = 1e3;
+var MAX_BATCH = 200;
+var MAX_TRACKED_REQUESTS = 1e3;
+var hex = (bytes) => randomBytes2(bytes).toString("hex");
+var nanos = (ms) => (BigInt(Math.round(ms * 1e3)) * 1000n).toString();
+var str = (key, value) => ({ key, value: { stringValue: value } });
+var int = (key, value) => ({
+  key,
+  value: { intValue: String(Math.round(value)) }
+});
+function tracesUrl(endpoint) {
+  const trimmed = endpoint.replace(/\/+$/, "");
+  return trimmed.endsWith("/v1/traces") ? trimmed : `${trimmed}/v1/traces`;
+}
+var OtlpExporter = class {
+  constructor(options, env = process.env) {
+    this.options = options;
+    this.url = tracesUrl(options.endpoint);
+    this.serviceName = options.serviceName ?? env.OTEL_SERVICE_NAME ?? "nodeui-app";
+  }
+  options;
+  url;
+  serviceName;
+  queue = [];
+  timer = null;
+  contexts = /* @__PURE__ */ new Map();
+  warned = false;
+  exported = 0;
+  dropped = 0;
+  /** Stable ids for a request so children recorded earlier link to its span. */
+  contextFor(requestId) {
+    let ctx = this.contexts.get(requestId);
+    if (!ctx) {
+      ctx = { traceId: hex(16), spanId: hex(8) };
+      this.contexts.set(requestId, ctx);
+      if (this.contexts.size > MAX_TRACKED_REQUESTS) {
+        const oldest = this.contexts.keys().next().value;
+        if (oldest !== void 0) this.contexts.delete(oldest);
+      }
+    }
+    return ctx;
+  }
+  request(entry) {
+    const ctx = this.contextFor(entry.id);
+    const attributes = [
+      str("http.request.method", entry.method),
+      str("url.path", maskSecretText(entry.path)),
+      int("http.response.status_code", entry.status),
+      str("client.address", entry.ip)
+    ];
+    if (entry.route) attributes.push(str("http.route", entry.route));
+    this.push({
+      ...ctx,
+      name: `${entry.method} ${entry.route ?? entry.path}`,
+      kind: KIND_SERVER,
+      startTimeUnixNano: nanos(entry.timestampMs),
+      endTimeUnixNano: nanos(entry.timestampMs + entry.durationMs),
+      attributes,
+      ...entry.status >= 500 ? { status: { code: STATUS_ERROR } } : {}
+    });
+  }
+  outgoing(entry) {
+    const attributes = [
+      str("http.request.method", entry.method),
+      str("url.full", maskSecretText(entry.url))
+    ];
+    if (entry.status !== null) attributes.push(int("http.response.status_code", entry.status));
+    const failed = Boolean(entry.error) || entry.status !== null && entry.status >= 500;
+    this.child(entry.requestId, {
+      name: `${entry.method} ${entry.url}`,
+      timestampMs: entry.timestampMs,
+      durationMs: entry.durationMs,
+      attributes,
+      ...failed ? { status: { code: STATUS_ERROR, message: entry.error } } : {}
+    });
+  }
+  query(entry) {
+    const statement = maskSecretText(entry.sql);
+    this.child(entry.requestId, {
+      name: `${statement.split(/\s+/)[0]?.toUpperCase() ?? "QUERY"} ${entry.system}`,
+      timestampMs: entry.timestampMs,
+      durationMs: entry.durationMs,
+      attributes: [str("db.system.name", entry.system), str("db.query.text", statement)],
+      ...entry.error ? { status: { code: STATUS_ERROR, message: entry.error } } : {}
+    });
+  }
+  child(requestId, span) {
+    const parent = requestId === void 0 ? void 0 : this.contextFor(requestId);
+    this.push({
+      traceId: parent?.traceId ?? hex(16),
+      spanId: hex(8),
+      ...parent ? { parentSpanId: parent.spanId } : {},
+      name: span.name,
+      kind: KIND_CLIENT,
+      startTimeUnixNano: nanos(span.timestampMs),
+      endTimeUnixNano: nanos(span.timestampMs + span.durationMs),
+      attributes: span.attributes,
+      ...span.status ? { status: span.status } : {}
+    });
+  }
+  push(span) {
+    if (this.queue.length >= MAX_QUEUE) {
+      this.queue.shift();
+      this.dropped += 1;
+    }
+    this.queue.push(span);
+    if (!this.timer) {
+      this.timer = setTimeout(() => void this.flush(), this.options.intervalMs ?? 2e3);
+      if (typeof this.timer.unref === "function") this.timer.unref();
+    }
+  }
+  body(spans) {
+    return JSON.stringify({
+      resourceSpans: [
+        {
+          resource: { attributes: [str("service.name", this.serviceName)] },
+          scopeSpans: [{ scope: { name: "@singhak/nodeui" }, spans }]
+        }
+      ]
+    });
+  }
+  async flush() {
+    this.timer = null;
+    while (this.queue.length > 0) {
+      const batch = this.queue.splice(0, MAX_BATCH);
+      try {
+        const res = await runSuppressed(
+          () => fetch(this.url, {
+            method: "POST",
+            headers: { "content-type": "application/json", ...this.options.headers },
+            body: this.body(batch),
+            signal: AbortSignal.timeout(5e3)
+          })
+        );
+        if (!res.ok) throw new Error(`collector answered ${res.status}`);
+        this.exported += batch.length;
+      } catch (err) {
+        this.dropped += batch.length;
+        if (!this.warned) {
+          this.warned = true;
+          console.warn(
+            `[nodeui] OTLP export to ${this.url} failed (${err instanceof Error ? err.message : String(err)}); dropping spans.`
+          );
+        }
+        return;
+      }
+    }
+  }
+  /** Cancels the timer and makes a best-effort final export. */
+  close() {
+    if (this.timer) clearTimeout(this.timer);
+    this.timer = null;
+    void this.flush();
+  }
+};
+
+// src/persistence.ts
+import {
+  appendFile,
+  appendFileSync,
+  existsSync as existsSync2,
+  mkdirSync,
+  readFileSync,
+  renameSync,
+  statSync as statSync2
+} from "fs";
+import { dirname } from "path";
+var DEFAULT_PERSIST_MAX_BYTES = 5 * 1024 * 1024;
+var FLUSH_DELAY_MS = 250;
+var Persistence = class {
+  constructor(file, maxBytes = DEFAULT_PERSIST_MAX_BYTES) {
+    this.file = file;
+    this.maxBytes = maxBytes;
+    try {
+      mkdirSync(dirname(file), { recursive: true });
+    } catch {
+    }
+  }
+  file;
+  maxBytes;
+  pending = [];
+  timer = null;
+  writing = false;
+  append(kind, data) {
+    try {
+      this.pending.push(`${JSON.stringify({ kind, data })}
+`);
+    } catch {
+      return;
+    }
+    if (!this.timer) {
+      this.timer = setTimeout(() => this.flush(), FLUSH_DELAY_MS);
+      if (typeof this.timer.unref === "function") this.timer.unref();
+    }
+  }
+  /** Reads the journal (rotated file first) in chronological order. */
+  load() {
+    const out = [];
+    for (const path2 of [`${this.file}.1`, this.file]) {
+      let text;
+      try {
+        text = readFileSync(path2, "utf8");
+      } catch {
+        continue;
+      }
+      for (const line of text.split("\n")) {
+        if (!line) continue;
+        try {
+          const parsed = JSON.parse(line);
+          if (parsed && typeof parsed.kind === "string") out.push(parsed);
+        } catch {
+        }
+      }
+    }
+    return out;
+  }
+  rotateIfNeeded() {
+    try {
+      if (existsSync2(this.file) && statSync2(this.file).size >= this.maxBytes) {
+        renameSync(this.file, `${this.file}.1`);
+      }
+    } catch {
+    }
+  }
+  flush() {
+    this.timer = null;
+    if (this.writing || this.pending.length === 0) {
+      if (this.pending.length > 0) this.timer = setTimeout(() => this.flush(), FLUSH_DELAY_MS);
+      return;
+    }
+    this.rotateIfNeeded();
+    const chunk = this.pending.join("");
+    this.pending = [];
+    this.writing = true;
+    appendFile(this.file, chunk, { mode: 384 }, () => {
+      this.writing = false;
+    });
+  }
+  /** Writes anything still buffered, synchronously (used on shutdown). */
+  close() {
+    if (this.timer) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+    if (this.pending.length === 0) return;
+    try {
+      this.rotateIfNeeded();
+      appendFileSync(this.file, this.pending.join(""), { mode: 384 });
+    } catch {
+    }
+    this.pending = [];
+  }
+};
+
+// src/server.ts
 var SSE_HEARTBEAT_MS = 15e3;
 function serializeEnvelope(envelope, mask = true) {
   return JSON.stringify(mask ? maskSecrets(envelope) : envelope);
@@ -1228,7 +2157,9 @@ var BUILT_IN_PANELS = /* @__PURE__ */ new Set([
   "routes",
   "logs",
   "metrics",
-  "outgoing"
+  "outgoing",
+  "errors",
+  "queries"
 ]);
 var PLUGIN_ID_PATTERN = /^[a-z0-9][a-z0-9-]*$/;
 var RESERVED_API_NAMES = /* @__PURE__ */ new Set(["config", "live", "confirmations"]);
@@ -1243,6 +2174,13 @@ function listFrom(value, raw) {
   if (value) return value;
   return (raw ?? "").split(",").map((v) => v.trim()).filter(Boolean);
 }
+function otlpHostname(endpoint) {
+  try {
+    return new URL(endpoint).hostname.replace(/^\[|\]$/g, "");
+  } catch {
+    throw new Error(`nodeui otlp endpoint "${endpoint}" is not a valid URL`);
+  }
+}
 function pathnameOf(req) {
   const raw = req.originalUrl ?? req.url ?? "/";
   try {
@@ -1256,6 +2194,13 @@ function normalizePath(value) {
   if (!trimmed.startsWith("/")) throw new Error(`NODEUI_PATH must start with "/", got "${value}"`);
   return trimmed.replace(/\/+$/, "") || "/";
 }
+function resolveCapture(option, env) {
+  const value = option ?? env ?? "always";
+  if (value !== "always" && value !== "lazy") {
+    throw new Error(`nodeui capture must be 'always' or 'lazy', got "${String(value)}"`);
+  }
+  return value;
+}
 function positiveInt(value, fallback, name) {
   const n = value === void 0 ? fallback : value;
   if (!Number.isInteger(n) || n <= 0) throw new Error(`${name} must be a positive integer`);
@@ -1291,6 +2236,18 @@ function createNodeUI(options = {}) {
     enabled: activation.active,
     activationReason: activation.reason,
     maskSecrets: options.maskSecrets ?? true,
+    capture: resolveCapture(options.capture, env.NODEUI_CAPTURE),
+    persistFile: (typeof options.persist === "string" ? options.persist : options.persist?.file) ?? env.NODEUI_PERSIST_FILE ?? null,
+    persistMaxBytes: positiveInt(
+      typeof options.persist === "object" ? options.persist.maxBytes : void 0,
+      DEFAULT_PERSIST_MAX_BYTES,
+      "persist.maxBytes"
+    ),
+    otlp: typeof options.otlp === "string" ? { endpoint: options.otlp } : options.otlp ?? (env.NODEUI_OTLP_ENDPOINT ? { endpoint: env.NODEUI_OTLP_ENDPOINT } : null),
+    requestDetail: resolveRequestDetail(
+      options.captureRequestDetail,
+      env.NODEUI_CAPTURE_BODIES === "true"
+    ),
     inactivityTimeoutMs: positiveInt(
       options.inactivityTimeoutMs,
       env.NODEUI_INACTIVITY_TIMEOUT_MS ? Number(env.NODEUI_INACTIVITY_TIMEOUT_MS) : 6e4,
@@ -1301,7 +2258,7 @@ function createNodeUI(options = {}) {
       env.NODEUI_CONFIRM_TTL_MS ? Number(env.NODEUI_CONFIRM_TTL_MS) : 6e4,
       "NODEUI_CONFIRM_TTL_MS"
     ),
-    heapSnapshotDir: options.heapSnapshotDir ?? env.NODEUI_HEAP_SNAPSHOT_DIR ?? join3(tmpdir2(), "nodeui-heap"),
+    heapSnapshotDir: options.heapSnapshotDir ?? env.NODEUI_HEAP_SNAPSHOT_DIR ?? join4(tmpdir2(), "nodeui-heap"),
     allowedHosts: listFrom(options.allowedHosts, env.NODEUI_ALLOWED_HOSTS),
     allowedOrigins: listFrom(options.allowedOrigins, env.NODEUI_ALLOWED_ORIGINS),
     allowedRemoteAddresses: listFrom(options.allowedRemoteAddresses, env.NODEUI_ALLOWED_REMOTE),
@@ -1332,6 +2289,15 @@ function createNodeUI(options = {}) {
       "[nodeui] running with NODE_ENV=production. The console exposes environment, logs and heap data; keep it behind loopback and an auth token."
     );
   }
+  if (config.enabled) {
+    for (const entry of config.allowedRemoteAddresses) {
+      if (!isValidAddressEntry(entry)) {
+        console.warn(
+          `[nodeui] ignoring allowedRemoteAddresses entry "${entry}": expected an IP or a CIDR such as 172.16.0.0/12 or fd00::/8; it will never match.`
+        );
+      }
+    }
+  }
   if (config.enabled && !config.maskSecrets) {
     console.warn("[nodeui] secret masking is disabled; panels may show credentials.");
   }
@@ -1362,9 +2328,59 @@ function createNodeUI(options = {}) {
   registry.register(envProvider);
   const routesProvider = new RoutesProvider();
   registry.register(routesProvider);
-  registry.register(
-    new OutgoingProvider(positiveInt(options.outgoingLogSize, 200, "outgoingLogSize"))
+  const outgoingProvider = new OutgoingProvider(
+    positiveInt(options.outgoingLogSize, 200, "outgoingLogSize")
   );
+  registry.register(outgoingProvider);
+  const queriesProvider = new QueriesProvider({
+    size: positiveInt(options.queryLogSize, 200, "queryLogSize"),
+    slowQueryMs: positiveInt(options.slowQueryMs, 100, "slowQueryMs")
+  });
+  registry.register(queriesProvider);
+  const errorsProvider = new ErrorsProvider();
+  registry.register(errorsProvider);
+  if (config.enabled) errorsProvider.attach();
+  const persistence = config.enabled && config.persistFile ? new Persistence(config.persistFile, config.persistMaxBytes) : null;
+  const exporter = config.enabled && config.otlp ? new OtlpExporter(config.otlp) : null;
+  const pinned = /* @__PURE__ */ new Set();
+  const otlpHost = config.otlp ? otlpHostname(config.otlp.endpoint) : null;
+  if (exporter && config.otlp && !isLoopbackHostname(otlpHost)) {
+    console.warn(
+      `[nodeui] exporting telemetry to non-local OTLP endpoint ${config.otlp.endpoint}; requests, queries and outgoing URLs leave this machine (masked).`
+    );
+  }
+  if (persistence) {
+    const byKind = (kind) => persistence.load().filter((r) => r.kind === kind).map((r) => r.data);
+    requestsProvider.restore(byKind("request"));
+    outgoingProvider.restore(byKind("outgoing"));
+    queriesProvider.restore(byKind("query"));
+    errorsProvider.restore(byKind("error"));
+  }
+  if (persistence || exporter) {
+    const save = (kind, data) => persistence?.append(kind, config.maskSecrets ? maskSecrets(data) : data);
+    requestsProvider.onRecord = (e) => {
+      save("request", e);
+      exporter?.request(e);
+    };
+    outgoingProvider.onRecord = (e) => {
+      save("outgoing", e);
+      exporter?.outgoing(e);
+    };
+    queriesProvider.onRecord = (e) => {
+      save("query", e);
+      exporter?.query(e);
+    };
+    errorsProvider.onRecord = (e) => save("error", e);
+  }
+  const pinnedProviders = [];
+  if (persistence || exporter || config.enabled && config.capture === "always") {
+    pinnedProviders.push(outgoingProvider, queriesProvider);
+  }
+  if (config.enabled && config.capture === "always") pinnedProviders.push(logsProvider);
+  for (const provider of pinnedProviders) {
+    provider.start?.(ctx);
+    pinned.add(provider.id);
+  }
   const pluginMeta = [];
   for (const plugin of options.plugins ?? []) {
     if (!PLUGIN_ID_PATTERN.test(plugin.id) || BUILT_IN_PANELS.has(plugin.id) || RESERVED_API_NAMES.has(plugin.id) || registry.get(plugin.id)) {
@@ -1381,7 +2397,7 @@ function createNodeUI(options = {}) {
   let sseClients = 0;
   function stopAll() {
     for (const id of activeProviders) {
-      registry.get(id)?.stop?.(ctx);
+      if (!pinned.has(id)) registry.get(id)?.stop?.(ctx);
     }
     activeProviders.clear();
     if (inactivityTimer) {
@@ -1453,7 +2469,7 @@ function createNodeUI(options = {}) {
       pollIntervalMs: config.pollIntervalMs,
       panels: registry.ids(),
       masking: { enabled: config.maskSecrets, pattern: SECRET_KEY_PATTERN.source },
-      authRequired: config.authRequired,
+      locked: config.authRequired,
       plugins: pluginMeta
     };
   }
@@ -1553,7 +2569,7 @@ function createNodeUI(options = {}) {
   }
   function serveStatic(req, res, urlPath) {
     const relative = urlPath.slice(path2.length);
-    const asset = resolveStaticAsset(STATIC_ROOT, relative);
+    const asset = resolveStaticAsset(uiAssetsDir(), relative);
     if (!asset) {
       sendJson(res, 404, { ok: false, error: { code: "not-found", message: "Not found" } });
       return;
@@ -1614,21 +2630,37 @@ function createNodeUI(options = {}) {
       ctx.store["express-router"] = router;
     }
   }
+  function routePatternOf(req) {
+    const r = req;
+    if (typeof r.nodeuiRoute === "string") return r.nodeuiRoute;
+    const path3 = r.route?.path;
+    if (typeof path3 !== "string") return void 0;
+    return `${typeof r.baseUrl === "string" ? r.baseUrl : ""}${path3}` || void 0;
+  }
   function recordAppRequest(req, res) {
     const started = process.hrtime.bigint();
     const timestampMs = Date.now();
+    const requestId = requestsProvider.reserveId();
+    bindRequestId(req, requestId);
+    const collectDetail = captureRequestDetail(req, res, config.requestDetail, config.maskSecrets);
     res.on("finish", () => {
       const durationMs = Number(process.hrtime.bigint() - started) / 1e6;
-      requestsProvider.record({
-        method: req.method ?? "?",
-        path: pathnameOf(req),
-        status: res.statusCode,
-        durationMs,
-        timestampMs,
-        ip: req.socket.remoteAddress ?? "unknown"
-      });
+      requestsProvider.record(
+        {
+          method: req.method ?? "?",
+          path: pathnameOf(req),
+          status: res.statusCode,
+          durationMs,
+          timestampMs,
+          ip: req.socket.remoteAddress ?? "unknown",
+          route: routePatternOf(req),
+          ...collectDetail()
+        },
+        requestId
+      );
       metricsProvider.record(res.statusCode);
     });
+    return requestId;
   }
   const server = {
     get config() {
@@ -1652,8 +2684,8 @@ function createNodeUI(options = {}) {
           void handleNodeUIPath(req, res, urlPath);
           return;
         }
-        recordAppRequest(req, res);
-        next();
+        const requestId = recordAppRequest(req, res);
+        runWithRequestId(requestId, next);
       };
     },
     async handle(req, res) {
@@ -1681,7 +2713,35 @@ function createNodeUI(options = {}) {
     addLogSource(entry) {
       logsProvider.addSource(entry);
     },
+    recordQuery(query) {
+      if (!config.enabled) return;
+      queriesProvider.record({
+        ...query,
+        sql: query.sql.slice(0, 2e3),
+        timestampMs: Date.now() - query.durationMs,
+        requestId: currentRequestId()
+      });
+    },
+    trackPrisma(client) {
+      if (!config.enabled) return;
+      client.$on(
+        "query",
+        (e) => server.recordQuery({ system: "prisma", sql: e.query, durationMs: Number(e.duration) })
+      );
+    },
+    recordError(error, context) {
+      if (!config.enabled) return;
+      const e = error;
+      const status = e?.status ?? e?.statusCode;
+      if (typeof status === "number" && status >= 400 && status < 500) return;
+      errorsProvider.record(error, "request", context);
+    },
     shutdown() {
+      errorsProvider.detach();
+      persistence?.close();
+      exporter?.close();
+      for (const id of pinned) registry.get(id)?.stop?.(ctx);
+      pinned.clear();
       stopAll();
     }
   };
@@ -1692,15 +2752,19 @@ export {
   ConfirmationStore,
   CpuProvider,
   DEFAULT_LOG_SIZE,
+  DEFAULT_REQUEST_DETAIL,
   EnvProvider,
+  ErrorsProvider,
   EventLoopLagProvider,
   HealthProvider,
   HeapSnapshotProvider,
   LogsProvider,
   MemoryProvider,
   MetricsProvider,
+  N_PLUS_ONE_THRESHOLD,
   OutgoingProvider,
   ProviderRegistry,
+  QueriesProvider,
   RequestsProvider,
   RingBuffer,
   RoutesProvider,
@@ -1710,18 +2774,27 @@ export {
   StartupTracker,
   createGuard,
   createNodeUI,
+  currentRequestId,
+  enterRequestContext,
   extractRoutes,
+  fingerprintError,
   hostnameFromHostHeader,
   interceptConsole,
   interceptOutgoing,
+  interceptQueries,
   isLoopbackAddress,
   isLoopbackHostname,
+  isValidAddressEntry,
   maskSecretText,
   maskSecrets,
   matchesAddress,
+  normalizeSql,
   resolveActivation,
   resolveStaticAsset,
+  runInRequestContext,
   serializeEnvelope,
-  startSse
+  startSse,
+  summarizeRequests,
+  uiAssetsDir
 };
 //# sourceMappingURL=index.mjs.map