@stacknext/cli 0.0.0-stage → 0.6.0

package/dist/collector/server.js

@@ -0,0 +1,1258 @@
+import { createReadStream } from 'node:fs';
+import { access, readFile, stat } from 'node:fs/promises';
+import { createServer } from 'node:http';
+import path from 'node:path';
+import { randomBytes, createHash, timingSafeEqual } from 'node:crypto';
+import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
+import { DIAGNOSTIC_CATEGORIES, DIAGNOSTIC_RULE_IDS, DIAGNOSTIC_SEVERITIES, DIAGNOSTIC_STATUSES, TelemetryStore, computeCoverage, diagnosticReference, ingestEnvelopeSchema, nextOtelVerboseStatus, } from '@stacknext/core';
+import { diagnosticOverview as buildDiagnosticOverview, generateDiagnosticReport, getDiagnosticDetail, listDiagnosticFindings, } from '@stacknext/diagnostics';
+import { completeRunRequestSchema, createRunRequestSchema, listAllBaselines, listAllComparisons, listAllRuns, loadBaseline, loadComparison, loadRun, RegressionStorageError, submitSampleRequestSchema, } from '@stacknext/regression';
+import { TestRunRegistry } from './test-runs.js';
+import { CLI_VERSION } from '../version.js';
+const VERSION = CLI_VERSION;
+const MAX_BODY_BYTES = 2 * 1024 * 1024;
+const SESSION_COOKIE = 'stacknext_session';
+const SESSION_TTL_MS = 24 * 60 * 60 * 1_000;
+const CONNECTION_STALE_MS = 20_000;
+const CONNECTION_RETENTION_MS = 10 * 60 * 1_000;
+const MAX_SSE_CLIENTS = 50;
+const SSE_HEARTBEAT_MS = 15_000;
+const MAX_SESSIONS = 100;
+function securityHeaders() {
+    return {
+        'x-content-type-options': 'nosniff',
+        'referrer-policy': 'no-referrer',
+        'x-frame-options': 'DENY',
+        'cross-origin-resource-policy': 'same-origin',
+    };
+}
+function dashboardCsp() {
+    return [
+        "default-src 'self'",
+        "script-src 'self'",
+        "style-src 'self' 'unsafe-inline'",
+        "img-src 'self' data:",
+        "font-src 'self'",
+        "connect-src 'self'",
+        "object-src 'none'",
+        "base-uri 'none'",
+        "form-action 'none'",
+        "frame-ancestors 'none'",
+    ].join('; ');
+}
+function sendJson(response, status, payload, extraHeaders = {}) {
+    if (response.headersSent)
+        return;
+    const body = JSON.stringify(payload);
+    response.writeHead(status, {
+        ...securityHeaders(),
+        'content-type': 'application/json; charset=utf-8',
+        'cache-control': 'no-store',
+        'content-length': Buffer.byteLength(body),
+        ...extraHeaders,
+    });
+    response.end(body);
+}
+function sendError(response, status, message, issues) {
+    const payload = issues ? { error: message, issues } : { error: message };
+    sendJson(response, status, payload);
+}
+function parseCookies(header) {
+    if (!header)
+        return {};
+    const cookies = {};
+    for (const part of header.split(';')) {
+        const separator = part.indexOf('=');
+        if (separator < 0)
+            continue;
+        const key = part.slice(0, separator).trim();
+        const value = part.slice(separator + 1).trim();
+        if (key)
+            cookies[key] = decodeURIComponent(value);
+    }
+    return cookies;
+}
+function hashToken(value) {
+    return createHash('sha256').update(value).digest();
+}
+function tokensEqual(candidate, expected) {
+    const left = hashToken(candidate);
+    const right = hashToken(expected);
+    return timingSafeEqual(left, right);
+}
+function hostAllowed(hostHeader) {
+    if (!hostHeader)
+        return false;
+    let hostname;
+    try {
+        hostname = new URL(`http://${hostHeader}`).hostname;
+    }
+    catch {
+        return false;
+    }
+    return (hostname === '127.0.0.1' ||
+        hostname === 'localhost' ||
+        hostname === '[::1]' ||
+        hostname === '::1');
+}
+function originAllowed(origin, port) {
+    try {
+        const url = new URL(origin);
+        return ((url.protocol === 'http:' || url.protocol === 'https:') &&
+            (url.hostname === '127.0.0.1' ||
+                url.hostname === 'localhost' ||
+                url.hostname === '[::1]' ||
+                url.hostname === '::1') &&
+            (url.port === '' || url.port === String(port)));
+    }
+    catch {
+        return false;
+    }
+}
+function queryNumber(value) {
+    if (value === null || value.trim() === '')
+        return undefined;
+    const parsed = Number(value);
+    return Number.isFinite(parsed) ? parsed : undefined;
+}
+function queryBoolean(value) {
+    if (value === null)
+        return undefined;
+    return value === '1' || value === 'true';
+}
+function filtersFromSearch(searchParams) {
+    const sort = searchParams.get('sort');
+    return {
+        ...(queryNumber(searchParams.get('limit')) !== undefined
+            ? { limit: queryNumber(searchParams.get('limit')) }
+            : {}),
+        ...(queryNumber(searchParams.get('offset')) !== undefined
+            ? { offset: queryNumber(searchParams.get('offset')) }
+            : {}),
+        ...(searchParams.get('q') ? { q: searchParams.get('q') ?? undefined } : {}),
+        ...(searchParams.get('method') ? { method: searchParams.get('method') ?? undefined } : {}),
+        ...(searchParams.get('status') ? { status: searchParams.get('status') ?? undefined } : {}),
+        ...(queryBoolean(searchParams.get('slow')) !== undefined
+            ? { slow: queryBoolean(searchParams.get('slow')) }
+            : {}),
+        ...(queryNumber(searchParams.get('minDuration')) !== undefined
+            ? { minDuration: queryNumber(searchParams.get('minDuration')) }
+            : {}),
+        ...(sort === 'recent' || sort === 'oldest' || sort === 'slowest' ? { sort } : {}),
+    };
+}
+function databaseFiltersFromSearch(searchParams) {
+    return {
+        ...(queryNumber(searchParams.get('limit')) !== undefined
+            ? { limit: queryNumber(searchParams.get('limit')) }
+            : {}),
+        ...(queryNumber(searchParams.get('offset')) !== undefined
+            ? { offset: queryNumber(searchParams.get('offset')) }
+            : {}),
+        ...(searchParams.get('q') ? { q: searchParams.get('q') ?? undefined } : {}),
+        ...(queryNumber(searchParams.get('minDuration')) !== undefined
+            ? { minDuration: queryNumber(searchParams.get('minDuration')) }
+            : {}),
+        ...(searchParams.get('traceId') ? { traceId: searchParams.get('traceId') ?? undefined } : {}),
+        ...(searchParams.get('databaseSystem')
+            ? { databaseSystem: searchParams.get('databaseSystem') ?? undefined }
+            : {}),
+    };
+}
+function errorFiltersFromSearch(searchParams) {
+    return {
+        ...(queryNumber(searchParams.get('limit')) !== undefined
+            ? { limit: queryNumber(searchParams.get('limit')) }
+            : {}),
+        ...(queryNumber(searchParams.get('offset')) !== undefined
+            ? { offset: queryNumber(searchParams.get('offset')) }
+            : {}),
+        ...(searchParams.get('q') ? { q: searchParams.get('q') ?? undefined } : {}),
+        ...(searchParams.get('route') ? { route: searchParams.get('route') ?? undefined } : {}),
+        ...(searchParams.get('name') ? { name: searchParams.get('name') ?? undefined } : {}),
+    };
+}
+function oneOf(value, allowed) {
+    if (!value)
+        return undefined;
+    return allowed.includes(value) ? value : undefined;
+}
+function diagnosticFiltersFromSearch(searchParams) {
+    const categoryValue = searchParams.get('category');
+    const severityValue = searchParams.get('severity');
+    const statusValue = searchParams.get('status');
+    const ruleValue = searchParams.get('ruleId');
+    const category = oneOf(categoryValue, DIAGNOSTIC_CATEGORIES);
+    const severity = oneOf(severityValue, DIAGNOSTIC_SEVERITIES);
+    const status = oneOf(statusValue, DIAGNOSTIC_STATUSES);
+    const ruleId = oneOf(ruleValue, DIAGNOSTIC_RULE_IDS);
+    if (categoryValue && !category)
+        return { filters: {}, error: 'Invalid diagnostic category' };
+    if (severityValue && !severity)
+        return { filters: {}, error: 'Invalid diagnostic severity' };
+    if (statusValue && !status)
+        return { filters: {}, error: 'Invalid diagnostic status' };
+    if (ruleValue && !ruleId)
+        return { filters: {}, error: 'Invalid diagnostic rule id' };
+    return {
+        filters: {
+            ...(queryNumber(searchParams.get('limit')) !== undefined
+                ? { limit: queryNumber(searchParams.get('limit')) }
+                : {}),
+            ...(queryNumber(searchParams.get('offset')) !== undefined
+                ? { offset: queryNumber(searchParams.get('offset')) }
+                : {}),
+            ...(category ? { category } : {}),
+            ...(severity ? { severity } : {}),
+            ...(status ? { status } : {}),
+            ...(ruleId ? { ruleId } : {}),
+            ...(searchParams.get('route') ? { route: searchParams.get('route') ?? undefined } : {}),
+            ...(searchParams.get('traceId')
+                ? { traceId: searchParams.get('traceId') ?? undefined }
+                : {}),
+            ...(searchParams.get('q') ? { q: searchParams.get('q') ?? undefined } : {}),
+            ...(queryNumber(searchParams.get('since')) !== undefined
+                ? { since: queryNumber(searchParams.get('since')) }
+                : {}),
+            ...(queryNumber(searchParams.get('until')) !== undefined
+                ? { until: queryNumber(searchParams.get('until')) }
+                : {}),
+        },
+    };
+}
+async function readBody(request, limit) {
+    const contentLength = Number(request.headers['content-length'] ?? '0');
+    if (Number.isFinite(contentLength) && contentLength > limit) {
+        request.resume();
+        return { ok: false, tooLarge: true };
+    }
+    const chunks = [];
+    let total = 0;
+    let tooLarge = false;
+    for await (const chunk of request) {
+        const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
+        total += buffer.length;
+        if (total > limit) {
+            tooLarge = true;
+            continue;
+        }
+        chunks.push(buffer);
+    }
+    if (tooLarge)
+        return { ok: false, tooLarge: true };
+    return { ok: true, body: Buffer.concat(chunks).toString('utf8') };
+}
+function contentTypeFor(file) {
+    switch (path.extname(file).toLowerCase()) {
+        case '.html':
+            return 'text/html; charset=utf-8';
+        case '.js':
+        case '.mjs':
+            return 'text/javascript; charset=utf-8';
+        case '.css':
+            return 'text/css; charset=utf-8';
+        case '.json':
+            return 'application/json; charset=utf-8';
+        case '.svg':
+            return 'image/svg+xml';
+        case '.png':
+            return 'image/png';
+        case '.ico':
+            return 'image/x-icon';
+        case '.webp':
+            return 'image/webp';
+        case '.woff2':
+            return 'font/woff2';
+        case '.txt':
+            return 'text/plain; charset=utf-8';
+        default:
+            return 'application/octet-stream';
+    }
+}
+export async function resolveDashboardDir() {
+    const candidates = [];
+    if (process.env.STACKNEXT_DASHBOARD_DIR) {
+        candidates.push(path.resolve(process.env.STACKNEXT_DASHBOARD_DIR));
+    }
+    try {
+        const require = createRequire(import.meta.url);
+        const packageJsonPath = require.resolve('@stacknext/dashboard/package.json');
+        candidates.push(path.join(path.dirname(packageJsonPath), 'dist'));
+    }
+    catch {
+        // Workspace fallback below.
+    }
+    const moduleDir = path.dirname(fileURLToPath(import.meta.url));
+    candidates.push(path.resolve(moduleDir, '../../../dashboard/dist'));
+    candidates.push(path.resolve(moduleDir, '../../dashboard/dist'));
+    candidates.push(path.resolve(process.cwd(), 'packages/dashboard/dist'));
+    for (const candidate of candidates) {
+        try {
+            await access(path.join(candidate, 'index.html'));
+            return candidate;
+        }
+        catch {
+            // Keep searching.
+        }
+    }
+    throw new Error('Dashboard build not found. Run "pnpm build" (or "pnpm --filter @stacknext/dashboard build") before starting StackNext.');
+}
+function listen(server, port, host) {
+    return new Promise((resolve, reject) => {
+        const onError = (error) => {
+            server.off('listening', onListening);
+            reject(error);
+        };
+        const onListening = () => {
+            server.off('error', onError);
+            const address = server.address();
+            if (typeof address === 'object' && address !== null)
+                resolve(address.port);
+            else
+                reject(new Error('Collector did not bind a TCP port'));
+        };
+        server.once('error', onError);
+        server.once('listening', onListening);
+        server.listen(port, host);
+    });
+}
+export async function startCollector(options) {
+    const host = options.host ?? '127.0.0.1';
+    if (host !== '127.0.0.1' && host !== 'localhost') {
+        throw new Error('StackNext collector may only bind to a loopback address');
+    }
+    if (options.token.length < 16) {
+        throw new Error('Collector token must be at least 16 characters');
+    }
+    const log = options.log ?? (() => undefined);
+    const store = new TelemetryStore({
+        maxSpans: options.config.collector.maxSpans,
+        retentionMs: options.config.collector.retentionMs,
+    });
+    const verboseStatus = options.nextOtelVerbose ??
+        nextOtelVerboseStatus(options.config.instrumentation.verbose, process.env.NEXT_OTEL_VERBOSE);
+    const startedAt = Date.now();
+    const sessions = new Map();
+    const connections = new Map();
+    const sseClients = new Set();
+    const serverStats = {
+        rejectedRequests: 0,
+        droppedPayload: 0,
+        droppedMalformed: 0,
+    };
+    let sequence = 0;
+    let port = options.port;
+    let dashboardUrl = `http://${host}:${port}`;
+    let diagnosticCache = null;
+    const getConnections = (now) => {
+        const output = [];
+        for (const [instanceId, record] of connections) {
+            if (now - record.lastSeen > CONNECTION_RETENTION_MS) {
+                connections.delete(instanceId);
+                continue;
+            }
+            output.push({
+                ...record.info,
+                connected: now - record.lastSeen <= CONNECTION_STALE_MS,
+            });
+        }
+        return output.sort((a, b) => b.lastSeen - a.lastSeen);
+    };
+    const getHealth = () => {
+        const now = Date.now();
+        const summary = store.summary(options.config.slowRequestMs);
+        const storeStats = store.getStats();
+        const connectionList = getConnections(now);
+        const diagnostics = connectionList
+            .map((connection) => connection.diagnostics)
+            .filter((entry) => entry !== undefined);
+        const lastError = diagnostics
+            .map((entry) => entry.lastError)
+            .filter((entry) => Boolean(entry))
+            .sort()
+            .at(-1) ?? null;
+        return {
+            status: 'ok',
+            name: 'stacknext',
+            version: options.version ?? VERSION,
+            projectName: options.projectName,
+            dashboardUrl,
+            startedAt,
+            uptimeMs: now - startedAt,
+            time: now,
+            connected: connectionList.some((connection) => connection.connected),
+            connections: connectionList,
+            instrumentation: {
+                nextOtelVerbose: verboseStatus,
+            },
+            counts: {
+                requests: summary.totalRequests,
+                failedRequests: summary.failedRequests,
+                slowRequests: summary.slowRequests,
+                spans: summary.spanCount,
+                errors: summary.errorCount,
+                databaseQueries: summary.databaseQueryCount,
+            },
+            store: storeStats,
+            server: {
+                ...serverStats,
+                sseClients: sseClients.size,
+            },
+            exporter: {
+                droppedSpans: diagnostics.reduce((sum, entry) => sum + entry.droppedSpans, 0),
+                droppedEvents: diagnostics.reduce((sum, entry) => sum + entry.droppedEvents, 0),
+                lastError,
+            },
+            config: options.config,
+        };
+    };
+    const getCoverage = () => {
+        const now = Date.now();
+        return computeCoverage({
+            projectName: options.projectName,
+            collectorVersion: options.version ?? VERSION,
+            now,
+            config: options.config,
+            connections: getConnections(now),
+            verbose: verboseStatus,
+            evidence: store.getCoverageEvidence(),
+        });
+    };
+    const getDiagnosticState = () => {
+        const now = Date.now();
+        const snapshot = store.getDiagnosticSnapshot(options.config.slowRequestMs);
+        const connectionList = getConnections(now);
+        if (!diagnosticCache || diagnosticCache.revision !== snapshot.revision) {
+            diagnosticCache = {
+                revision: snapshot.revision,
+                report: generateDiagnosticReport(snapshot, {
+                    projectName: options.projectName,
+                    collectorVersion: options.version ?? VERSION,
+                    config: options.config.diagnostics,
+                    generatedAt: now,
+                    connected: connectionList.some((connection) => connection.connected),
+                    connectedInstances: connectionList.filter((connection) => connection.connected).length,
+                }),
+            };
+        }
+        const cached = diagnosticCache.report;
+        return {
+            snapshot,
+            report: {
+                ...cached,
+                generatedAt: now,
+                sample: {
+                    ...cached.sample,
+                    connected: connectionList.some((connection) => connection.connected),
+                    connectedInstances: connectionList.filter((connection) => connection.connected).length,
+                },
+            },
+        };
+    };
+    const getDiagnosticReport = () => getDiagnosticState().report;
+    const testRuns = new TestRunRegistry({
+        slowRequestMs: options.config.slowRequestMs,
+        isConnected: () => getConnections(Date.now()).some((connection) => connection.connected),
+        getDiagnosticReport,
+        lookupTrace: (traceId) => store.getTrace(traceId, options.config.slowRequestMs) ?? null,
+    });
+    const traceWithDiagnostics = (detail) => {
+        const references = listDiagnosticFindings(getDiagnosticReport(), {
+            traceId: detail.traceId,
+            limit: 200,
+        }).items.map(diagnosticReference);
+        return { ...detail, diagnostics: references };
+    };
+    const recordConnection = (instance, diagnostics, now) => {
+        const existing = connections.get(instance.instanceId);
+        connections.set(instance.instanceId, {
+            info: {
+                instanceId: instance.instanceId,
+                serviceName: instance.serviceName,
+                ...(instance.projectName ?? options.projectName
+                    ? { projectName: instance.projectName ?? options.projectName }
+                    : {}),
+                ...(instance.nextVersion ? { nextVersion: instance.nextVersion } : {}),
+                ...(instance.runtimeVersion ? { runtimeVersion: instance.runtimeVersion } : {}),
+                sdkVersion: instance.sdkVersion,
+                lastSeen: now,
+                ...(diagnostics ? { diagnostics } : existing?.info.diagnostics
+                    ? { diagnostics: existing.info.diagnostics }
+                    : {}),
+            },
+            lastSeen: now,
+        });
+        if (connections.size > 20) {
+            const oldest = [...connections.entries()].sort((a, b) => a[1].lastSeen - b[1].lastSeen)[0];
+            if (oldest)
+                connections.delete(oldest[0]);
+        }
+    };
+    const broadcast = (event, payload) => {
+        const message = `event: ${event}\ndata: ${JSON.stringify(payload)}\n\n`;
+        for (const client of sseClients) {
+            try {
+                client.res.write(message);
+            }
+            catch {
+                sseClients.delete(client);
+            }
+        }
+    };
+    const heartbeatInterval = setInterval(() => {
+        for (const client of sseClients) {
+            try {
+                client.res.write(': heartbeat\n\n');
+            }
+            catch {
+                sseClients.delete(client);
+            }
+        }
+    }, options.sseHeartbeatMs ?? SSE_HEARTBEAT_MS);
+    heartbeatInterval.unref();
+    const sessionForRequest = (request, response) => {
+        const cookies = parseCookies(request.headers.cookie);
+        const existing = cookies[SESSION_COOKIE];
+        const now = Date.now();
+        if (existing && sessions.has(existing)) {
+            const createdAt = sessions.get(existing) ?? 0;
+            if (now - createdAt <= SESSION_TTL_MS)
+                return existing;
+            sessions.delete(existing);
+        }
+        const session = randomBytes(32).toString('base64url');
+        sessions.set(session, now);
+        if (sessions.size > MAX_SESSIONS) {
+            const oldest = [...sessions.entries()].sort((a, b) => a[1] - b[1])[0];
+            if (oldest)
+                sessions.delete(oldest[0]);
+        }
+        response.setHeader('set-cookie', `${SESSION_COOKIE}=${session}; Path=/; HttpOnly; SameSite=Strict; Max-Age=86400`);
+        return session;
+    };
+    const hasSession = (request) => {
+        const cookies = parseCookies(request.headers.cookie);
+        const session = cookies[SESSION_COOKIE];
+        if (!session)
+            return false;
+        const createdAt = sessions.get(session);
+        return createdAt !== undefined && Date.now() - createdAt <= SESSION_TTL_MS;
+    };
+    const isReadAuthorized = (request) => {
+        const authorization = request.headers.authorization;
+        if (authorization?.startsWith('Bearer ')) {
+            return tokensEqual(authorization.slice('Bearer '.length), options.token);
+        }
+        return hasSession(request);
+    };
+    const isIngestAuthorized = (request) => {
+        const authorization = request.headers.authorization;
+        if (!authorization?.startsWith('Bearer '))
+            return false;
+        return tokensEqual(authorization.slice('Bearer '.length), options.token);
+    };
+    const serveIndex = async (response, cookies) => {
+        if (!options.dashboardDir) {
+            const html = '<!doctype html><html><head><meta charset="utf-8"><title>StackNext</title></head><body style="font-family:system-ui;background:#0b0d10;color:#e6e8eb;padding:3rem"><h1>Dashboard build not found</h1><p>Run <code>pnpm build</code>, then restart <code>stacknext dev</code>.</p></body></html>';
+            response.writeHead(503, {
+                ...securityHeaders(),
+                'content-type': 'text/html; charset=utf-8',
+                'cache-control': 'no-store',
+                'content-security-policy': dashboardCsp(),
+            });
+            response.end(html);
+            return;
+        }
+        const file = path.join(options.dashboardDir, 'index.html');
+        const html = await readFile(file);
+        if (cookies) {
+            // Set-Cookie is attached by sessionForRequest before this function runs.
+            response.setHeader('set-cookie', response.getHeader('set-cookie') ?? []);
+        }
+        response.writeHead(200, {
+            ...securityHeaders(),
+            'content-type': 'text/html; charset=utf-8',
+            'cache-control': 'no-store',
+            'content-security-policy': dashboardCsp(),
+            'content-length': html.length,
+        });
+        response.end(html);
+    };
+    const serveStatic = async (pathname, request, response, setSession) => {
+        if (!options.dashboardDir)
+            return false;
+        if (pathname === '/' || !path.extname(pathname)) {
+            if (setSession)
+                sessionForRequest(request, response);
+            await serveIndex(response, true);
+            return true;
+        }
+        const decoded = decodeURIComponent(pathname);
+        const relative = decoded.replace(/^\/+/, '');
+        const resolved = path.resolve(options.dashboardDir, relative);
+        const root = path.resolve(options.dashboardDir);
+        if (!resolved.startsWith(`${root}${path.sep}`)) {
+            sendError(response, 403, 'Forbidden');
+            return true;
+        }
+        try {
+            const info = await stat(resolved);
+            if (!info.isFile())
+                return false;
+            const headers = {
+                ...securityHeaders(),
+                'content-type': contentTypeFor(resolved),
+                'content-length': info.size,
+                'cache-control': relative.startsWith('assets/')
+                    ? 'public, max-age=31536000, immutable'
+                    : 'no-store',
+            };
+            response.writeHead(200, headers);
+            if (request.method === 'HEAD') {
+                response.end();
+                return true;
+            }
+            const stream = createReadStream(resolved);
+            stream.on('error', () => {
+                if (!response.headersSent)
+                    sendError(response, 500, 'Could not read asset');
+                else
+                    response.destroy();
+            });
+            stream.pipe(response);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+    const handleIngest = async (request, response) => {
+        if (!isIngestAuthorized(request)) {
+            serverStats.rejectedRequests += 1;
+            sendError(response, 401, 'Unauthorized');
+            return;
+        }
+        const contentType = String(request.headers['content-type'] ?? '');
+        if (!contentType.toLowerCase().includes('application/json')) {
+            serverStats.rejectedRequests += 1;
+            sendError(response, 415, 'Content-Type must be application/json');
+            return;
+        }
+        const body = await readBody(request, MAX_BODY_BYTES);
+        if (!body.ok) {
+            serverStats.rejectedRequests += 1;
+            serverStats.droppedPayload += 1;
+            sendError(response, 413, `Payload exceeds ${MAX_BODY_BYTES} bytes`);
+            return;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(body.body);
+        }
+        catch {
+            serverStats.rejectedRequests += 1;
+            serverStats.droppedMalformed += 1;
+            sendError(response, 400, 'Malformed JSON payload');
+            return;
+        }
+        const result = ingestEnvelopeSchema.safeParse(parsed);
+        if (!result.success) {
+            serverStats.rejectedRequests += 1;
+            serverStats.droppedMalformed += 1;
+            sendError(response, 422, 'Telemetry payload failed validation', result.error.issues.map((issue) => issue.path.join('.') || '(root)'));
+            return;
+        }
+        const envelope = result.data;
+        const now = Date.now();
+        store.ingest(envelope, now);
+        recordConnection(envelope.instance, envelope.diagnostics, now);
+        const accepted = {
+            spans: envelope.spans.length,
+            errors: envelope.errors.length,
+            databaseQueries: envelope.databaseQueries.length,
+        };
+        if (accepted.spans + accepted.errors + accepted.databaseQueries > 0) {
+            sequence += 1;
+            broadcast('telemetry', {
+                type: 'telemetry',
+                sequence,
+                accepted,
+                time: now,
+            });
+        }
+        sendJson(response, 202, { ok: true, accepted, serverTime: now }, { 'x-stacknext-sequence': String(sequence) });
+    };
+    const handleTestRunWrite = async (request, response, url) => {
+        if (!isIngestAuthorized(request)) {
+            serverStats.rejectedRequests += 1;
+            sendError(response, 401, 'Unauthorized');
+            return;
+        }
+        const contentType = String(request.headers['content-type'] ?? '');
+        if (!contentType.toLowerCase().includes('application/json')) {
+            serverStats.rejectedRequests += 1;
+            sendError(response, 415, 'Content-Type must be application/json');
+            return;
+        }
+        const body = await readBody(request, MAX_BODY_BYTES);
+        if (!body.ok) {
+            serverStats.rejectedRequests += 1;
+            serverStats.droppedPayload += 1;
+            sendError(response, 413, `Payload exceeds ${MAX_BODY_BYTES} bytes`);
+            return;
+        }
+        let parsed;
+        try {
+            parsed = JSON.parse(body.body);
+        }
+        catch {
+            serverStats.rejectedRequests += 1;
+            serverStats.droppedMalformed += 1;
+            sendError(response, 400, 'Malformed JSON payload');
+            return;
+        }
+        if (url.pathname === '/api/test-runs') {
+            const result = createRunRequestSchema.safeParse(parsed);
+            if (!result.success) {
+                sendError(response, 422, 'Test run payload failed validation', result.error.issues.map((issue) => issue.path.join('.') || '(root)'));
+                return;
+            }
+            const run = testRuns.create(result.data);
+            sendJson(response, 201, { run });
+            return;
+        }
+        const sampleMatch = /^\/api\/test-runs\/(run-[0-9a-f]{16})\/samples$/.exec(url.pathname);
+        if (sampleMatch?.[1]) {
+            const result = submitSampleRequestSchema.safeParse(parsed);
+            if (!result.success) {
+                sendError(response, 422, 'Captured sample payload failed validation', result.error.issues.map((issue) => issue.path.join('.') || '(root)'));
+                return;
+            }
+            const submitted = testRuns.submit(sampleMatch[1], result.data);
+            if (!submitted.ok) {
+                if (submitted.code === 'not-found') {
+                    sendError(response, 404, 'Test run not found');
+                }
+                else if (submitted.code === 'duplicate-sample') {
+                    sendError(response, 409, 'Sample id already exists for this scenario');
+                }
+                else {
+                    sendError(response, 409, 'Test run is no longer accepting samples');
+                }
+                return;
+            }
+            sendJson(response, 200, {
+                sample: submitted.sample,
+                run: submitted.run,
+            });
+            return;
+        }
+        const completeMatch = /^\/api\/test-runs\/(run-[0-9a-f]{16})\/complete$/.exec(url.pathname);
+        if (completeMatch?.[1]) {
+            const result = completeRunRequestSchema.safeParse(parsed);
+            if (!result.success) {
+                sendError(response, 422, 'Test run completion payload failed validation', result.error.issues.map((issue) => issue.path.join('.') || '(root)'));
+                return;
+            }
+            const run = testRuns.complete(completeMatch[1], result.data);
+            if (!run) {
+                sendError(response, 404, 'Test run not found');
+                return;
+            }
+            sendJson(response, 200, { run });
+            return;
+        }
+        sendError(response, 404, 'Not found');
+    };
+    const handleSse = (request, response) => {
+        if (sseClients.size >= MAX_SSE_CLIENTS) {
+            sendError(response, 429, 'Too many live dashboard connections');
+            return;
+        }
+        response.writeHead(200, {
+            ...securityHeaders(),
+            'content-type': 'text/event-stream; charset=utf-8',
+            'cache-control': 'no-cache, no-transform',
+            connection: 'keep-alive',
+            'x-accel-buffering': 'no',
+        });
+        response.write(`event: ready\ndata: ${JSON.stringify({ type: 'ready', sequence, time: Date.now() })}\n\n`);
+        const client = { res: response };
+        sseClients.add(client);
+        request.on('close', () => {
+            sseClients.delete(client);
+        });
+    };
+    const pageItems = (items, searchParams, invalid = 0) => {
+        const limit = Math.min(Math.max(queryNumber(searchParams.get('limit')) ?? 50, 1), 200);
+        const offset = Math.max(queryNumber(searchParams.get('offset')) ?? 0, 0);
+        return {
+            items: items.slice(offset, offset + limit),
+            total: items.length,
+            limit,
+            offset,
+            invalid,
+        };
+    };
+    const savedRuns = async () => {
+        if (!options.projectDir)
+            return { items: [], invalid: 0 };
+        try {
+            return await listAllRuns(options.projectDir);
+        }
+        catch (error) {
+            log(`could not list saved test runs: ${error instanceof Error ? error.message : String(error)}`);
+            return { items: [], invalid: 0 };
+        }
+    };
+    const savedBaselines = async () => {
+        if (!options.projectDir)
+            return { items: [], invalid: 0 };
+        return listAllBaselines(options.projectDir);
+    };
+    const savedComparisons = async () => {
+        if (!options.projectDir)
+            return { items: [], invalid: 0 };
+        return listAllComparisons(options.projectDir);
+    };
+    const sendStorageError = (response, error, label) => {
+        if (error instanceof RegressionStorageError) {
+            if (error.code === 'not-found') {
+                sendError(response, 404, `${label} not found`);
+                return;
+            }
+            sendError(response, 422, error.message);
+            return;
+        }
+        log(`could not read ${label.toLowerCase()}: ${error instanceof Error ? error.message : String(error)}`);
+        sendError(response, 500, `Could not read ${label.toLowerCase()}`);
+    };
+    const handleApi = async (request, response, url) => {
+        const pathname = url.pathname;
+        if (pathname === '/api/ping') {
+            sendJson(response, 200, {
+                ok: true,
+                name: 'stacknext',
+                version: options.version ?? VERSION,
+            });
+            return;
+        }
+        if (pathname === '/api/stream') {
+            if (!isReadAuthorized(request)) {
+                sendError(response, 401, 'Unauthorized');
+                return;
+            }
+            handleSse(request, response);
+            return;
+        }
+        if (!isReadAuthorized(request)) {
+            serverStats.rejectedRequests += 1;
+            sendError(response, 401, 'Unauthorized');
+            return;
+        }
+        if (pathname === '/api/health') {
+            sendJson(response, 200, getHealth());
+            return;
+        }
+        if (pathname === '/api/summary') {
+            const payload = {
+                health: getHealth(),
+                summary: store.summary(options.config.slowRequestMs),
+                coverage: getCoverage(),
+                diagnosticOverview: buildDiagnosticOverview(getDiagnosticReport()),
+            };
+            sendJson(response, 200, payload);
+            return;
+        }
+        if (pathname === '/api/coverage') {
+            sendJson(response, 200, getCoverage());
+            return;
+        }
+        if (pathname === '/api/test-runs') {
+            try {
+                const live = testRuns.list();
+                const seen = new Set(live.map((run) => run.id));
+                const disk = await savedRuns();
+                const all = [...live, ...disk.items.filter((run) => !seen.has(run.id))].sort((left, right) => right.createdAt - left.createdAt ||
+                    (left.id < right.id ? -1 : left.id > right.id ? 1 : 0));
+                sendJson(response, 200, pageItems(all, url.searchParams, disk.invalid));
+            }
+            catch (error) {
+                sendStorageError(response, error, 'Test runs');
+            }
+            return;
+        }
+        if (pathname.startsWith('/api/test-runs/')) {
+            const id = decodeURIComponent(pathname.slice('/api/test-runs/'.length));
+            if (!/^run-[0-9a-f]{16}$/.test(id)) {
+                sendError(response, 400, 'Invalid test run id');
+                return;
+            }
+            const live = testRuns.get(id);
+            if (live) {
+                sendJson(response, 200, live);
+                return;
+            }
+            if (!options.projectDir) {
+                sendError(response, 404, 'Test run not found');
+                return;
+            }
+            try {
+                sendJson(response, 200, await loadRun(options.projectDir, id));
+            }
+            catch (error) {
+                sendStorageError(response, error, 'Test run');
+            }
+            return;
+        }
+        if (pathname === '/api/baselines') {
+            if (!options.projectDir) {
+                sendJson(response, 200, pageItems([], url.searchParams));
+                return;
+            }
+            try {
+                const records = await savedBaselines();
+                sendJson(response, 200, pageItems(records.items, url.searchParams, records.invalid));
+            }
+            catch (error) {
+                sendStorageError(response, error, 'Baselines');
+            }
+            return;
+        }
+        if (pathname.startsWith('/api/baselines/')) {
+            const id = decodeURIComponent(pathname.slice('/api/baselines/'.length));
+            if (!/^base-[0-9a-f]{16}$/.test(id)) {
+                sendError(response, 400, 'Invalid baseline id');
+                return;
+            }
+            if (!options.projectDir) {
+                sendError(response, 404, 'Baseline not found');
+                return;
+            }
+            try {
+                sendJson(response, 200, await loadBaseline(options.projectDir, id));
+            }
+            catch (error) {
+                sendStorageError(response, error, 'Baseline');
+            }
+            return;
+        }
+        if (pathname === '/api/comparisons') {
+            if (!options.projectDir) {
+                sendJson(response, 200, pageItems([], url.searchParams));
+                return;
+            }
+            try {
+                const records = await savedComparisons();
+                sendJson(response, 200, pageItems(records.items, url.searchParams, records.invalid));
+            }
+            catch (error) {
+                sendStorageError(response, error, 'Comparisons');
+            }
+            return;
+        }
+        if (pathname.startsWith('/api/comparisons/')) {
+            const id = decodeURIComponent(pathname.slice('/api/comparisons/'.length));
+            if (!/^cmp-[0-9a-f]{16}$/.test(id)) {
+                sendError(response, 400, 'Invalid comparison id');
+                return;
+            }
+            if (!options.projectDir) {
+                sendError(response, 404, 'Comparison not found');
+                return;
+            }
+            try {
+                sendJson(response, 200, await loadComparison(options.projectDir, id));
+            }
+            catch (error) {
+                sendStorageError(response, error, 'Comparison');
+            }
+            return;
+        }
+        if (pathname === '/api/diagnostics') {
+            const parsed = diagnosticFiltersFromSearch(url.searchParams);
+            if (parsed.error) {
+                sendError(response, 400, parsed.error);
+                return;
+            }
+            const state = getDiagnosticState();
+            sendJson(response, 200, listDiagnosticFindings(state.report, parsed.filters));
+            return;
+        }
+        if (pathname.startsWith('/api/diagnostics/')) {
+            const id = decodeURIComponent(pathname.slice('/api/diagnostics/'.length));
+            if (!/^diag-[0-9a-f]{8}-[0-9a-f]{8}$/.test(id)) {
+                sendError(response, 400, 'Invalid diagnostic id');
+                return;
+            }
+            const state = getDiagnosticState();
+            const detail = getDiagnosticDetail(state.report, id, state.snapshot);
+            if (!detail) {
+                sendError(response, 404, 'Diagnostic not found');
+                return;
+            }
+            sendJson(response, 200, detail);
+            return;
+        }
+        if (pathname === '/api/config') {
+            sendJson(response, 200, {
+                config: options.config,
+                projectName: options.projectName,
+                version: options.version ?? VERSION,
+                instrumentation: {
+                    nextOtelVerbose: verboseStatus,
+                },
+                limitations: [
+                    'Next.js built-in spans are limited to the operations Next.js exposes through OpenTelemetry.',
+                    'Server Components are not individually traced; route render spans are captured instead.',
+                    'Server Actions are not automatically identified by name. Use withStackNextAction() for successful actions.',
+                    'Drizzle Logger does not expose query duration; durations are null for Drizzle queries.',
+                    'Edge Runtime and production deployments are not supported.',
+                ],
+            });
+            return;
+        }
+        if (pathname === '/api/requests') {
+            sendJson(response, 200, store.listRequests(filtersFromSearch(url.searchParams), options.config.slowRequestMs));
+            return;
+        }
+        if (pathname.startsWith('/api/requests/')) {
+            const traceId = pathname.slice('/api/requests/'.length);
+            if (!/^[0-9a-f]{32}$/i.test(traceId)) {
+                sendError(response, 400, 'Invalid trace id');
+                return;
+            }
+            const detail = store.getRequest(traceId, options.config.slowRequestMs);
+            if (!detail) {
+                sendError(response, 404, 'Request not found');
+                return;
+            }
+            sendJson(response, 200, traceWithDiagnostics(detail));
+            return;
+        }
+        if (pathname === '/api/traces') {
+            const result = store.listTraces(filtersFromSearch(url.searchParams), options.config.slowRequestMs);
+            sendJson(response, 200, result);
+            return;
+        }
+        if (pathname.startsWith('/api/traces/')) {
+            const traceId = pathname.slice('/api/traces/'.length);
+            if (!/^[0-9a-f]{32}$/i.test(traceId)) {
+                sendError(response, 400, 'Invalid trace id');
+                return;
+            }
+            const detail = store.getTrace(traceId, options.config.slowRequestMs);
+            if (!detail) {
+                sendError(response, 404, 'Trace not found');
+                return;
+            }
+            sendJson(response, 200, traceWithDiagnostics(detail));
+            return;
+        }
+        if (pathname === '/api/errors') {
+            const result = store.listErrors(errorFiltersFromSearch(url.searchParams));
+            const payload = {
+                items: result.items,
+                total: result.total,
+                limit: result.limit,
+                offset: result.offset,
+                groups: result.groups,
+            };
+            sendJson(response, 200, payload);
+            return;
+        }
+        if (pathname.startsWith('/api/errors/')) {
+            const id = decodeURIComponent(pathname.slice('/api/errors/'.length));
+            if (!id || id.length > 128) {
+                sendError(response, 400, 'Invalid error id');
+                return;
+            }
+            const detail = store.getError(id, options.config.slowRequestMs);
+            if (!detail) {
+                sendError(response, 404, 'Error not found');
+                return;
+            }
+            const payload = detail;
+            sendJson(response, 200, payload);
+            return;
+        }
+        if (pathname === '/api/database') {
+            const result = store.listDatabaseQueries(databaseFiltersFromSearch(url.searchParams));
+            sendJson(response, 200, result);
+            return;
+        }
+        if (pathname === '/api/export') {
+            const data = store.exportAll();
+            const payload = {
+                format: 'stacknext-export',
+                version: 1,
+                exportedAt: Date.now(),
+                projectName: options.projectName,
+                collectorVersion: options.version ?? VERSION,
+                config: options.config,
+                spans: data.spans,
+                errors: data.errors,
+                databaseQueries: data.databaseQueries,
+                stats: {
+                    requests: store.summary(options.config.slowRequestMs).totalRequests,
+                    errors: data.errors.length,
+                    databaseQueries: data.databaseQueries.length,
+                    spans: data.spans.length,
+                },
+                diagnostics: getDiagnosticReport(),
+                limitations: [
+                    'Bodies, headers, cookies and SQL bind parameters are not stored.',
+                    'Drizzle Logger does not expose query duration.',
+                    'Edge Runtime is not supported.',
+                ],
+            };
+            sendJson(response, 200, payload, {
+                'content-disposition': `attachment; filename="stacknext-${options.projectName.replace(/[^a-z0-9_-]+/gi, '-')}-${Date.now()}.json"`,
+            });
+            return;
+        }
+        sendError(response, 404, 'Not found');
+    };
+    const requestHandler = async (request, response) => {
+        response.setHeader('x-stacknext', options.version ?? VERSION);
+        if (!hostAllowed(request.headers.host)) {
+            serverStats.rejectedRequests += 1;
+            sendError(response, 403, 'Invalid Host header');
+            return;
+        }
+        const origin = request.headers.origin;
+        if (origin && !originAllowed(origin, port)) {
+            serverStats.rejectedRequests += 1;
+            sendError(response, 403, 'Cross-origin requests are not allowed');
+            return;
+        }
+        if (request.headers['sec-fetch-site'] === 'cross-site') {
+            serverStats.rejectedRequests += 1;
+            sendError(response, 403, 'Cross-site requests are not allowed');
+            return;
+        }
+        const url = new URL(request.url ?? '/', `http://${host}:${port}`);
+        try {
+            if (url.pathname === '/__stacknext/v1/ingest') {
+                if (request.method !== 'POST') {
+                    response.setHeader('allow', 'POST');
+                    sendError(response, 405, 'Method not allowed');
+                    return;
+                }
+                await handleIngest(request, response);
+                return;
+            }
+            if (url.pathname.startsWith('/api/')) {
+                const testRunWrite = url.pathname === '/api/test-runs' ||
+                    url.pathname.startsWith('/api/test-runs/');
+                if (request.method === 'POST' && testRunWrite) {
+                    await handleTestRunWrite(request, response, url);
+                    return;
+                }
+                if (request.method !== 'GET' && request.method !== 'HEAD') {
+                    response.setHeader('allow', testRunWrite ? 'GET, HEAD, POST' : 'GET, HEAD');
+                    sendError(response, 405, 'Method not allowed');
+                    return;
+                }
+                await handleApi(request, response, url);
+                if (request.method === 'HEAD')
+                    request.resume();
+                return;
+            }
+            if (request.method !== 'GET' && request.method !== 'HEAD') {
+                response.setHeader('allow', 'GET, HEAD');
+                sendError(response, 405, 'Method not allowed');
+                return;
+            }
+            const served = await serveStatic(url.pathname, request, response, true);
+            if (!served) {
+                if (url.pathname.includes('.')) {
+                    sendError(response, 404, 'Asset not found');
+                }
+                else {
+                    sessionForRequest(request, response);
+                    await serveIndex(response, true);
+                }
+            }
+        }
+        catch (error) {
+            log(`collector request failed: ${error instanceof Error ? error.message : String(error)}`);
+            if (!response.headersSent) {
+                sendError(response, 500, 'Internal collector error');
+            }
+            else {
+                response.destroy();
+            }
+        }
+    };
+    const server = createServer((request, response) => {
+        void requestHandler(request, response);
+    });
+    server.requestTimeout = 15_000;
+    server.headersTimeout = 10_000;
+    server.keepAliveTimeout = 5_000;
+    const maxPortAttempts = options.autoPort === false ? 1 : 25;
+    let lastError = null;
+    let actualPort = null;
+    for (let attempt = 0; attempt < maxPortAttempts; attempt += 1) {
+        try {
+            actualPort = await listen(server, port, host);
+            break;
+        }
+        catch (error) {
+            lastError = error;
+            if (error.code !== 'EADDRINUSE')
+                throw error;
+            if (port === 0)
+                throw error;
+            port += 1;
+        }
+    }
+    if (actualPort === null) {
+        throw new Error(`Could not find an available dashboard port near ${options.port}: ${lastError instanceof Error ? lastError.message : String(lastError)}`);
+    }
+    port = actualPort;
+    dashboardUrl = `http://${host === '127.0.0.1' ? '127.0.0.1' : host}:${port}`;
+    let closing = false;
+    const close = async () => {
+        if (closing)
+            return;
+        closing = true;
+        clearInterval(heartbeatInterval);
+        for (const client of sseClients) {
+            try {
+                client.res.write(`event: shutdown\ndata: ${JSON.stringify({ type: 'shutdown', time: Date.now() })}\n\n`);
+                client.res.end();
+            }
+            catch {
+                // Ignore clients that already disconnected.
+            }
+        }
+        sseClients.clear();
+        await new Promise((resolve) => {
+            const timeout = setTimeout(() => {
+                server.closeAllConnections();
+                resolve();
+            }, 2_000);
+            timeout.unref();
+            server.close(() => {
+                clearTimeout(timeout);
+                resolve();
+            });
+            server.closeIdleConnections();
+        });
+        store.clear();
+        sessions.clear();
+        connections.clear();
+    };
+    return {
+        port,
+        url: dashboardUrl,
+        token: options.token,
+        store,
+        health: getHealth,
+        close,
+    };
+}
+//# sourceMappingURL=server.js.map