@wtfalch/reporting 0.2.1 → 0.3.0

package/dist/errors/fingerprint.js

@@ -0,0 +1,211 @@
+import { createHash } from 'node:crypto';
+/**
+ * Turning an exception into a group, without a database and without a
+ * database of known errors: `sha256(kind + top five normalised frames)`,
+ * truncated to 32 hex characters (docs/plans/errors.md, "Fingerprint").
+ *
+ * The whole design is one constraint: the same bug, thrown a thousand
+ * times across deploys, must fingerprint the same every time, and a
+ * different bug must not collide with it. That is why every normalisation
+ * below throws away information that varies for reasons unrelated to which
+ * bug this is — a line number, a package's patch version, a machine's
+ * absolute filesystem path — while keeping what actually names the bug: the
+ * error's class, the call chain's function names, and which files they are
+ * in relative to the project.
+ */
+/** node_modules/<pkg>, node_modules/@scope/pkg — a scoped package's name is two segments. */
+const SCOPED_PACKAGE = /^(@[^/]+\/[^/]+)/;
+const PLAIN_PACKAGE = /^([^/]+)/;
+/** webpack, webpack-internal and turbopack all prefix a location with a scheme and a fake "host". */
+const BUNDLER_SCHEME_PREFIX = /^[a-zA-Z][\w+.-]*:\/\/[^/]*\//;
+/** Trailing `:<line>:<column>` or, more rarely, just `:<line>`. */
+const TRAILING_LINE_COL = /:\d+:\d+$/;
+const TRAILING_LINE = /:\d+$/;
+/** `at fn (location)` — the parenthesised form. Function-only frames have no match. */
+const FRAME_WITH_FUNCTION = /^(.*)\s\((.+)\)$/;
+/**
+ * One V8 stack frame to its stable identity: the function name (if any) and
+ * the location, with everything that drifts for reasons unrelated to the
+ * bug removed.
+ *
+ * Handles both formats Node/V8 produce:
+ *   at functionName (/path/to/file.ts:10:5)
+ *   at /path/to/file.ts:10:5
+ */
+export function normaliseFrame(frame) {
+    let s = frame.trim();
+    if (s.startsWith('at '))
+        s = s.slice(3).trim();
+    const withFunction = s.match(FRAME_WITH_FUNCTION);
+    const functionName = withFunction ? withFunction[1]?.trim() : undefined;
+    const location = withFunction ? (withFunction[2]?.trim() ?? '') : s;
+    const normalisedLocation = normaliseLocation(location);
+    return functionName ? `${functionName} (${normalisedLocation})` : normalisedLocation;
+}
+function normaliseLocation(rawLocation) {
+    // Next.js emits webpack-internal:///, webpack://_N_E/ and turbopack://[project]/
+    // ahead of the real path; a bundled build and a plain `node file.js` run of
+    // the same source must fingerprint the same, so the scheme goes first.
+    let location = rawLocation.replace(BUNDLER_SCHEME_PREFIX, '');
+    location = location.replace(/^file:\/\//, '');
+    // A dependency's own file layout is not this app's bug: two patch releases
+    // of the same package rename nothing an app author can act on, and pnpm's
+    // content-addressed store puts the version number in the path itself
+    // (node_modules/.pnpm/lodash@4.17.20/node_modules/lodash/index.js). Taking
+    // the LAST node_modules/ segment lands on the package's own copy of
+    // itself, past any version-numbered store directory, so both versions
+    // collapse to the same "node_modules/lodash".
+    const nodeModulesIndex = location.lastIndexOf('node_modules/');
+    if (nodeModulesIndex !== -1) {
+        const afterNodeModules = location.slice(nodeModulesIndex + 'node_modules/'.length);
+        const scoped = afterNodeModules.match(SCOPED_PACKAGE);
+        const plain = afterNodeModules.match(PLAIN_PACKAGE);
+        const pkg = scoped?.[1] ?? plain?.[1];
+        return pkg ? `node_modules/${pkg}` : 'node_modules';
+    }
+    // Line and column drift on every edit to the file, even ones nowhere near
+    // the throw (a comment added above it shifts every line below). Keeping
+    // them would turn one bug into a new group on every deploy, which is the
+    // exact failure mode a grouped error list exists to avoid.
+    location = location.replace(TRAILING_LINE_COL, '').replace(TRAILING_LINE, '');
+    // A bundler names its output after a build-varying token — a chunk id
+    // (8471.js) or a content hash appended for cache-busting (main-abc123.js).
+    // Neither identifies the bug; both identify the build, so a browser or
+    // Next.js chunk stack would otherwise open a brand new group on every
+    // deploy — the exact failure line numbers were already excluded to avoid.
+    location = maskBasenameHash(location);
+    return stripAbsolutePrefix(location);
+}
+/** A run of 6+ hex characters straight after the last `-` or `.` in a name. */
+const HASH_SUFFIX = /[-.][0-9a-fA-F]{6,}$/;
+/**
+ * Masks a build-varying token in the FILENAME only — never a directory name
+ * — so `chunks/8471.js` and `chunks/main-abc123.js` both collapse to a form
+ * that survives a rebuild, while `dashboard/page.js` is untouched because
+ * there is nothing in it to mask.
+ */
+function maskBasenameHash(path) {
+    const lastSlash = path.lastIndexOf('/');
+    const dir = lastSlash === -1 ? '' : path.slice(0, lastSlash + 1);
+    const basename = lastSlash === -1 ? path : path.slice(lastSlash + 1);
+    return `${dir}${maskBuildHash(basename)}`;
+}
+function maskBuildHash(basename) {
+    const lastDot = basename.lastIndexOf('.');
+    // No extension, or a dotfile (".env"): nothing to anchor an extension on,
+    // so there is no safe way to tell a hash from the rest of the name.
+    if (lastDot <= 0)
+        return basename;
+    const ext = basename.slice(lastDot);
+    const stem = basename.slice(0, lastDot);
+    // A chunk named after nothing but its id: "8471.js", "9032.js". The whole
+    // stem changes on every build even though it is the same chunk.
+    if (/^\d+$/.test(stem))
+        return `#${ext}`;
+    // A real name with a hash tacked on for cache-busting: "main-abc123.js",
+    // "page.4f2a91b.js". Anchored on the LAST separator so it only ever
+    // consumes a trailing suffix, and constrained to hex characters so an
+    // ordinary multi-word filename is never mistaken for one — "component" in
+    // "my-component.tsx" contains 'o', 'p', 'n', 't', none of them hex digits,
+    // so it does not match and the name survives untouched.
+    const masked = stem.replace(HASH_SUFFIX, (match) => `${match[0]}#`);
+    return `${masked}${ext}`;
+}
+/**
+ * The same file has a different absolute path in every environment it
+ * runs in — a developer's home directory, the CI runner's workspace, the
+ * container's /app — so keeping it would fragment one bug into one group
+ * per place it was seen. `src/` is the one directory name this monorepo's
+ * own code always sits under, so anything from there on is kept in full.
+ * Failing that (a frame with no recognisable project root, e.g. a bare
+ * dependency-free script), the last two path segments are kept: enough to
+ * tell apart two files that happen to share a name, without the
+ * environment-specific parent directories.
+ */
+function stripAbsolutePrefix(path) {
+    const marker = '/src/';
+    const markerIndex = path.indexOf(marker);
+    if (markerIndex !== -1)
+        return path.slice(markerIndex + 1);
+    if (path.startsWith('src/'))
+        return path;
+    const segments = path.split('/').filter((segment) => segment.length > 0);
+    return segments.slice(-2).join('/');
+}
+const FRAME_LINE = /^at /;
+function parseFrames(stack) {
+    if (!stack)
+        return [];
+    return stack
+        .split('\n')
+        .map((line) => line.trim())
+        .filter((line) => FRAME_LINE.test(line));
+}
+/**
+ * A message differs by the one thing that made this particular occurrence
+ * unique — a user id, a filename, a value that failed validation — so a
+ * fallback that used the raw message would give one group per occurrence,
+ * which is exactly the firehose grouping exists to prevent. Digits and
+ * quoted substrings are the two shapes that carry that kind of unique data
+ * in practice, so both are masked before hashing: "user 4821 not found" and
+ * "user 9913 not found" become the same "user # not found".
+ */
+function maskMessage(message) {
+    return message
+        .replace(/"[^"]*"/g, '"…"')
+        .replace(/'[^']*'/g, "'…'")
+        .replace(/`[^`]*`/g, '`…`')
+        .replace(/\d+/g, '#');
+}
+/**
+ * The group an error belongs to: sha256 over the kind and the top five
+ * normalised frames, truncated to 32 lower-case hex characters. Five frames
+ * because the throw site and its immediate callers are what identifies a
+ * bug; frames further up are shared by every request and add nothing but
+ * noise a coincidental match in them could exploit.
+ *
+ * Falls back to `kind + masked message` when there is no stack at all, or
+ * the stack has no line this package recognises as a frame (a non-V8
+ * runtime, or a stack someone already stripped).
+ */
+export function fingerprint(input) {
+    const frames = parseFrames(input.stack).slice(0, 5).map(normaliseFrame);
+    const basis = frames.length > 0
+        ? `${input.kind}\n${frames.join('\n')}`
+        : `${input.kind}\n${maskMessage(input.message)}`;
+    return createHash('sha256').update(basis).digest('hex').slice(0, 32);
+}
+/**
+ * The class name a `kind` column and a fingerprint are built from —
+ * `TypeError`, `ZodError` — bounded so a pathological name cannot blow out
+ * the 512-character message column it eventually contributes to, and safe
+ * for the throws JavaScript actually allows: a string, `null`, an object
+ * with no prototype at all. None of those may throw out of this function;
+ * an error reporter that itself throws while reporting an error is the one
+ * failure mode worse than not reporting it.
+ */
+export function errorKind(error) {
+    if (error instanceof Error) {
+        return bound(error.constructor?.name || error.name || 'Error');
+    }
+    if (error === null)
+        return 'null';
+    if (error === undefined)
+        return 'undefined';
+    if (Array.isArray(error))
+        return 'array';
+    if (typeof error === 'object') {
+        // Object.create(null) has no `.constructor` at all; a plain `{}` has one
+        // whose name is the unhelpful "Object". Either way there is no class
+        // name worth keeping, so it is grouped as a plain object rather than
+        // risking a crash reading a property that may not exist.
+        const ctorName = error.constructor?.name;
+        return bound(ctorName && ctorName !== 'Object' ? ctorName : 'object');
+    }
+    // string, number, boolean, symbol, bigint, function.
+    return bound(typeof error);
+}
+function bound(name) {
+    const trimmed = name.trim();
+    return trimmed.length > 0 ? trimmed.slice(0, 100) : 'Error';
+}

package/dist/errors/reader.d.ts

@@ -0,0 +1,19 @@
+import type { ErrorState } from '../schema.js';
+import type { ReportingErrorRow } from '../tables.js';
+import type { Actor, Db, ErrorsPage, ErrorsPageOptions } from '../types.js';
+/**
+ * Newest first, keyset-paged on `(last_seen_at, fingerprint)`, the table's
+ * index. Every filter is an equality on an indexed column. No permission is
+ * applied here: the host gates, and this returns rows as stored.
+ */
+export declare function errorsPage(db: Db, opts?: ErrorsPageOptions): Promise<ErrorsPage>;
+/** One row by fingerprint, or null when it is unknown. */
+export declare function errorDetail(db: Db, fingerprint: string): Promise<ReportingErrorRow | null>;
+/**
+ * Moves an error's state. 'resolved' and 'ignored' stamp `resolved_at` and
+ * `resolved_by` with this instant and who did it; moving back to 'open'
+ * clears both, never one alone — `reporting_errors_resolved_pair_check`
+ * (0003_errors.sql) refuses a row with only one of the pair set. Returns the
+ * updated row, or null when the fingerprint is unknown.
+ */
+export declare function setErrorState(db: Db, fingerprint: string, state: ErrorState, by: Actor): Promise<ReportingErrorRow | null>;

package/dist/errors/reader.js

@@ -0,0 +1,66 @@
+import { and, desc, eq, lt, or, sql } from 'drizzle-orm';
+import { reportingErrors } from '../tables.js';
+/**
+ * Newest first, keyset-paged on `(last_seen_at, fingerprint)`, the table's
+ * index. Every filter is an equality on an indexed column. No permission is
+ * applied here: the host gates, and this returns rows as stored.
+ */
+export async function errorsPage(db, opts = {}) {
+    const limit = Math.max(1, Math.min(opts.limit ?? 50, 200));
+    const conditions = [];
+    if (opts.site)
+        conditions.push(eq(reportingErrors.site, opts.site));
+    if (opts.state)
+        conditions.push(eq(reportingErrors.state, opts.state));
+    if (opts.runtime)
+        conditions.push(eq(reportingErrors.runtime, opts.runtime));
+    if (opts.after) {
+        const { lastSeenAt, fingerprint } = opts.after;
+        const keyset = or(lt(reportingErrors.lastSeenAt, lastSeenAt), and(eq(reportingErrors.lastSeenAt, lastSeenAt), lt(reportingErrors.fingerprint, fingerprint)));
+        if (keyset)
+            conditions.push(keyset);
+    }
+    const rows = await db
+        .select()
+        .from(reportingErrors)
+        .where(conditions.length > 0 ? and(...conditions) : undefined)
+        .orderBy(desc(reportingErrors.lastSeenAt), desc(reportingErrors.fingerprint))
+        .limit(limit + 1);
+    const items = rows.slice(0, limit);
+    const last = items.at(-1);
+    return {
+        items,
+        next: rows.length > limit && last
+            ? { lastSeenAt: last.lastSeenAt, fingerprint: last.fingerprint }
+            : null,
+    };
+}
+/** One row by fingerprint, or null when it is unknown. */
+export async function errorDetail(db, fingerprint) {
+    const rows = await db
+        .select()
+        .from(reportingErrors)
+        .where(eq(reportingErrors.fingerprint, fingerprint))
+        .limit(1);
+    return rows[0] ?? null;
+}
+/**
+ * Moves an error's state. 'resolved' and 'ignored' stamp `resolved_at` and
+ * `resolved_by` with this instant and who did it; moving back to 'open'
+ * clears both, never one alone — `reporting_errors_resolved_pair_check`
+ * (0003_errors.sql) refuses a row with only one of the pair set. Returns the
+ * updated row, or null when the fingerprint is unknown.
+ */
+export async function setErrorState(db, fingerprint, state, by) {
+    const closing = state === 'resolved' || state === 'ignored';
+    const rows = await db
+        .update(reportingErrors)
+        .set({
+        state,
+        resolvedAt: closing ? sql `now()` : null,
+        resolvedBy: closing ? `${by.class}:${by.id}` : null,
+    })
+        .where(eq(reportingErrors.fingerprint, fingerprint))
+        .returning();
+    return rows[0] ?? null;
+}

package/dist/errors/redact.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Keeping the wrapping keys out of anything this package captures.
+ *
+ * **Why this is worth a file.** The store's whole promise is that a database
+ * dump is ciphertext, and that promise has exactly one premise: the wrapping
+ * key is not where the ciphertext is. An error report is the most likely way
+ * for it to end up somewhere else — a crash during boot with the environment
+ * attached, a configuration error whose message quotes the value it could not
+ * parse, a breadcrumb from a library that logs what it was given. None of
+ * those is a bug in this module; all of them would hand the key to whoever
+ * can read the error.
+ *
+ * So the rule is stated once, here, and applied on the capture path rather
+ * than trusted to every path in. `scrub` walks a structure and replaces any
+ * exact occurrence of a held key with a marker; `redactText` does the same
+ * for the plain-string case — a captured `message` or `stack` — without
+ * walking a structure that does not exist yet.
+ *
+ * **It cannot cover stored values**, and does not pretend to: those are not in
+ * the environment, so there is nothing to enumerate. What protects them is
+ * that no code path writes one anywhere but the response that asked for it.
+ *
+ * No `server-only`: the edge runtime captures errors too, and this reaches
+ * nothing but its arguments and `process.env`.
+ */
+export declare const REDACTED = "[redacted: wrapping key]";
+/**
+ * The exact strings that must never appear in anything sent anywhere: both
+ * environment variables in full, and each key's base64 half on its own, since
+ * a parser that split on the colon would report only that part.
+ */
+export declare function heldSecrets(env: Readonly<Record<string, string | undefined>>): string[];
+/**
+ * The string case alone: a captured `message` and `stack` are strings before
+ * they are anything else, so the capture path scrubs them directly rather
+ * than wrapping each in an object just to hand it to `scrub`.
+ */
+export declare function redactText(text: string, secrets: readonly string[]): string;
+/**
+ * The same structure with every held secret replaced.
+ *
+ * Walks rather than serialising and string-replacing, so the shape a caller
+ * expects survives. Cycles are tracked because an error object graph has them
+ * and a scrubber that hangs is worse than one that missed something.
+ */
+export declare function scrub<T>(value: T, secrets: readonly string[]): T;

package/dist/errors/redact.js

@@ -0,0 +1,93 @@
+/**
+ * Keeping the wrapping keys out of anything this package captures.
+ *
+ * **Why this is worth a file.** The store's whole promise is that a database
+ * dump is ciphertext, and that promise has exactly one premise: the wrapping
+ * key is not where the ciphertext is. An error report is the most likely way
+ * for it to end up somewhere else — a crash during boot with the environment
+ * attached, a configuration error whose message quotes the value it could not
+ * parse, a breadcrumb from a library that logs what it was given. None of
+ * those is a bug in this module; all of them would hand the key to whoever
+ * can read the error.
+ *
+ * So the rule is stated once, here, and applied on the capture path rather
+ * than trusted to every path in. `scrub` walks a structure and replaces any
+ * exact occurrence of a held key with a marker; `redactText` does the same
+ * for the plain-string case — a captured `message` or `stack` — without
+ * walking a structure that does not exist yet.
+ *
+ * **It cannot cover stored values**, and does not pretend to: those are not in
+ * the environment, so there is nothing to enumerate. What protects them is
+ * that no code path writes one anywhere but the response that asked for it.
+ *
+ * No `server-only`: the edge runtime captures errors too, and this reaches
+ * nothing but its arguments and `process.env`.
+ */
+export const REDACTED = '[redacted: wrapping key]';
+/**
+ * The exact strings that must never appear in anything sent anywhere: both
+ * environment variables in full, and each key's base64 half on its own, since
+ * a parser that split on the colon would report only that part.
+ */
+export function heldSecrets(env) {
+    const specs = [env.KEYSTORE_KEK ?? '', ...(env.KEYSTORE_KEK_PREVIOUS ?? '').split(',')]
+        .map((spec) => spec.trim())
+        .filter((spec) => spec.length > 0);
+    const secrets = new Set();
+    for (const spec of specs) {
+        secrets.add(spec);
+        const separator = spec.indexOf(':');
+        // A short tail is not worth replacing: it would be a common substring
+        // rather than a secret, and a scrubber that rewrites ordinary text is one
+        // somebody turns off.
+        if (separator > 0 && spec.length - separator > 16)
+            secrets.add(spec.slice(separator + 1));
+    }
+    return [...secrets];
+}
+/**
+ * The string case alone: a captured `message` and `stack` are strings before
+ * they are anything else, so the capture path scrubs them directly rather
+ * than wrapping each in an object just to hand it to `scrub`.
+ */
+export function redactText(text, secrets) {
+    let out = text;
+    for (const secret of secrets) {
+        if (out.includes(secret))
+            out = out.split(secret).join(REDACTED);
+    }
+    return out;
+}
+/**
+ * The same structure with every held secret replaced.
+ *
+ * Walks rather than serialising and string-replacing, so the shape a caller
+ * expects survives. Cycles are tracked because an error object graph has them
+ * and a scrubber that hangs is worse than one that missed something.
+ */
+export function scrub(value, secrets) {
+    if (secrets.length === 0)
+        return value;
+    return walk(value, secrets, new WeakMap());
+}
+function walk(value, secrets, seen) {
+    if (typeof value === 'string')
+        return redactText(value, secrets);
+    if (value === null || typeof value !== 'object')
+        return value;
+    const existing = seen.get(value);
+    if (existing !== undefined)
+        return existing;
+    if (Array.isArray(value)) {
+        const copy = [];
+        seen.set(value, copy);
+        for (const item of value)
+            copy.push(walk(item, secrets, seen));
+        return copy;
+    }
+    const copy = {};
+    seen.set(value, copy);
+    for (const [key, item] of Object.entries(value))
+        copy[key] = walk(item, secrets, seen);
+    return copy;
+}

package/dist/errors/tasks.d.ts

@@ -0,0 +1,16 @@
+import type { Task } from '../housekeeping/index.js';
+import type { Db } from '../types.js';
+/**
+ * Deletes resolved/ignored error rows past the operator's window, up to
+ * twenty batches of 5,000 per run, each in its own statement with a bounded
+ * timeout, renewing the lease between batches. `reporting_prune_errors`
+ * (0003_errors.sql) does the clamping and, critically, never touches a row
+ * still in state 'open' regardless of age.
+ *
+ * Reuses `events.retention_days` rather than adding an `errors.*` setting: a
+ * new setting means a migration to reporting_settings and an operator
+ * control nobody asked for. One retention window for the whole operational
+ * log (events and the errors grouped from them) is the simpler default.
+ */
+export declare const pruneErrors: Task;
+export declare function pruneErrorsBatch(db: Db, days: number, batch: number): Promise<number>;

package/dist/errors/tasks.js

@@ -0,0 +1,50 @@
+import { sql } from 'drizzle-orm';
+import { rowsOf } from '../housekeeping/tasks.js';
+const HOUR = 60 * 60 * 1000;
+/**
+ * Deletes resolved/ignored error rows past the operator's window, up to
+ * twenty batches of 5,000 per run, each in its own statement with a bounded
+ * timeout, renewing the lease between batches. `reporting_prune_errors`
+ * (0003_errors.sql) does the clamping and, critically, never touches a row
+ * still in state 'open' regardless of age.
+ *
+ * Reuses `events.retention_days` rather than adding an `errors.*` setting: a
+ * new setting means a migration to reporting_settings and an operator
+ * control nobody asked for. One retention window for the whole operational
+ * log (events and the errors grouped from them) is the simpler default.
+ */
+export const pruneErrors = {
+    name: 'reporting.prune_errors',
+    every: HOUR,
+    lease: 10 * 60 * 1000,
+    retry: 15 * 60 * 1000,
+    async run(ctx) {
+        const days = ctx.settings['events.retention_days'];
+        let total = 0;
+        for (let i = 0; i < 20; i += 1) {
+            if (ctx.now().getTime() > ctx.deadline.getTime() - 30_000)
+                break;
+            const n = await pruneErrorsBatch(ctx.db, days, 5000);
+            total += n;
+            if (n < 5000)
+                break;
+            if (!(await ctx.renew()))
+                break;
+        }
+        if (total > 0) {
+            ctx.reporting.event({
+                kind: 'reporting.pruned_errors',
+                message: `pruned ${total} error(s) older than ${days} days`,
+                data: { rows: total, days },
+            });
+        }
+    },
+};
+export async function pruneErrorsBatch(db, days, batch) {
+    return db.transaction(async (tx) => {
+        await tx.execute(sql `set local statement_timeout = '30s'`);
+        const result = await tx.execute(sql `select reporting_prune_errors(make_interval(days => ${days}::int), ${batch}::int) as n`);
+        const [row] = rowsOf(result);
+        return Number(row?.n ?? 0);
+    });
+}

package/dist/fake/index.js

@@ -1,4 +1,5 @@
 import { alertRow } from '../alerts.js';
+import { createCapture } from '../errors/capture.js';
 import { eventInputSchema } from '../schema.js';
 import { DEFAULT_SETTINGS, RETENTION_BOUNDS } from '../settings.js';
 import { tables } from '../tables.js';
@@ -11,6 +12,16 @@ export function createFakeReporting(opts = {}) {
     const tracked = [];
     let settings = { ...DEFAULT_SETTINGS };
     let id = 0;
+    // No group table to fake, so the upsert never runs (`defer` is a no-op);
+    // the timeline row through `fake.event` is what a host's test asserts on.
+    const capture = createCapture({
+        db: undefined,
+        log,
+        site,
+        now: () => new Date(),
+        defer: () => { },
+        event: (input) => fake.event(input),
+    });
     const fake = {
         site,
         log,
@@ -43,6 +54,7 @@ export function createFakeReporting(opts = {}) {
             fake.event(alertRow(finding));
             alerts.push(finding);
         },
+        captureError: (error, context) => capture(error, context),
         async flush() { },
         events: {
             async page(o = {}) {

package/dist/index.js

@@ -2,6 +2,7 @@ import { alertRow } from './alerts.js';
 import { analyticsRecent, analyticsSeries, analyticsWeekly } from './analytics/reader.js';
 import { ANALYTICS_NAME_PATTERN, normalisePath, propsSchema } from './analytics/schema.js';
 import { insertAnalytics } from './analytics/write.js';
+import { createCapture } from './errors/capture.js';
 import { eventsPage } from './reader.js';
 import { siteSchema } from './schema.js';
 import { getSettings, setSettings } from './settings.js';
@@ -29,25 +30,38 @@ export function createReporting(options) {
     const site = siteSchema.parse(options.site);
     const now = options.now ?? (() => new Date());
     const mode = options.mode ?? modeFromEnv();
+    const defer = options.defer ??
+        ((fn) => {
+            setTimeout(() => void fn(), 0);
+        });
     const writer = new Writer({
         db: options.db,
         log: options.log,
         site,
         mode,
         now,
-        defer: options.defer ??
-            ((fn) => {
-                setTimeout(() => void fn(), 0);
-            }),
+        defer,
         queueLimit: options.queueLimit ?? 1000,
         batchSize: options.batchSize ?? 500,
         flushEveryMs: options.flushEveryMs ?? 1000,
     });
+    // Same db, log, defer, now and site as the writer: one instance, one
+    // upsert path, no second connection or timer to keep in sync.
+    const capture = createCapture({
+        db: options.db,
+        log: options.log,
+        site,
+        now,
+        defer,
+        event: (input) => writer.event(input),
+        release: process.env.REPORTING_RELEASE ?? null,
+    });
     const reporting = {
         site,
         log: options.log,
         tables,
         event: (input) => writer.event(input),
+        captureError: (error, context) => capture(error, context),
         alert(finding) {
             writer.event(alertRow(finding));
             if (!options.onAlert)

package/dist/ingest-limit.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The token bucket both public ingest routes share.
+ *
+ * `./next`'s analytics collector and its client-error collector are the only
+ * two routes in this package a host mounts unauthenticated, and both write to
+ * the database on a stranger's say-so. They had one limiter between them: the
+ * analytics one. The error route went without until it was noticed that
+ * `reporting_errors` never prunes an open row (migrations/0003_errors.sql),
+ * so an unbounded public write lands in a table nothing ages out — the two
+ * decisions are safe apart and not together.
+ *
+ * Per process, not per deploy: several containers each keep their own, so the
+ * real ceiling is this times the container count. Enough to bound abuse,
+ * never to meter.
+ */
+export declare class Buckets {
+    private readonly perMinute;
+    private readonly now;
+    private readonly buckets;
+    constructor(perMinute: number, now: () => Date);
+    take(key: string, n: number): boolean;
+}

package/dist/ingest-limit.js

@@ -0,0 +1,39 @@
+/**
+ * The token bucket both public ingest routes share.
+ *
+ * `./next`'s analytics collector and its client-error collector are the only
+ * two routes in this package a host mounts unauthenticated, and both write to
+ * the database on a stranger's say-so. They had one limiter between them: the
+ * analytics one. The error route went without until it was noticed that
+ * `reporting_errors` never prunes an open row (migrations/0003_errors.sql),
+ * so an unbounded public write lands in a table nothing ages out — the two
+ * decisions are safe apart and not together.
+ *
+ * Per process, not per deploy: several containers each keep their own, so the
+ * real ceiling is this times the container count. Enough to bound abuse,
+ * never to meter.
+ */
+export class Buckets {
+    perMinute;
+    now;
+    buckets = new Map();
+    constructor(perMinute, now) {
+        this.perMinute = perMinute;
+        this.now = now;
+    }
+    take(key, n) {
+        const t = this.now().getTime();
+        const b = this.buckets.get(key) ?? { tokens: this.perMinute, at: t };
+        b.tokens = Math.min(this.perMinute, b.tokens + ((t - b.at) / 60_000) * this.perMinute);
+        b.at = t;
+        if (b.tokens < n) {
+            this.buckets.set(key, b);
+            return false;
+        }
+        b.tokens -= n;
+        this.buckets.set(key, b);
+        if (this.buckets.size > 10_000)
+            this.buckets.clear();
+        return true;
+    }
+}