@wtfalch/reporting 0.5.0 → 0.7.0

package/README.md

@@ -3,9 +3,12 @@
 The estate's operational event log and the housekeeping tick behind it: a
 writer that never fails a request, a claim protocol that needs no scheduler,
 and the readers an operator opens. Per-app Postgres, a host-supplied logger,
-a framework-neutral core and a Next entry. The design and its decisions are
-`docs/plans/reporting.md` and `docs/plans/reporting/core.md` in
-`wtfalch/app-template`.
+a framework-neutral core and a Next entry. The design and its decisions were
+originally `docs/plans/reporting.md` and `docs/plans/reporting/core.md` in
+`wtfalch/app-template`, which was archived 2026-09-24 and replaced by
+`foundry`; those docs are a historical record only. The design history for
+everything past 0.2.0 lives in this repo's own `docs/plans/errors.md` and
+`CHANGELOG.md`.
 
 Three records make up reporting on the estate. This package holds the
 **events** (what the system did: jobs, drains, alerts, an integration saying
@@ -15,27 +18,104 @@ row is transactional and its actor is unforgeable; an event row is best
 effort. The two share column names so a reader can walk between them, and
 nothing else.
 
+## Status
+
+Published: yes, v0.5.1, 2026-09-28
+
 ## Install
 
 ```sh
-pnpm add @wtfalch/reporting
-pnpm exec reporting-migrations   # copies migrations/*.sql into drizzle/ as the next numbers
+pnpm add @wtfalch/reporting @wtfalch/db
+```
+
+The package ships SQL and never connects or migrates. The host installs
+`@wtfalch/db`, applies the SQL with the owner credential into a schema of
+its own, then makes the runtime role. The runtime `searchPath` and
+`ensureRuntimeRole({ schemas })` must both cover that schema. The SQL names
+no schema and no role: its `SECURITY DEFINER` functions use `set search_path
+from current`, so they find their tables in whatever schema the host
+migrated into. Migrate with `@wtfalch/db` 0.5.2 or later: 0.5.0 and 0.5.1
+let a temp table shadow a table inside a `SECURITY DEFINER` function, and
+0.5.2 puts `pg_temp` last on the runner's `search_path`.
+
+```ts
+import { migrationsDir as reportingMigrations } from '@wtfalch/reporting/migrations-dir';
+import { runMigrationSources } from '@wtfalch/db/migrate';
+import { ensureRuntimeRole } from '@wtfalch/db/runtime-role';
+
+await runMigrationSources({
+  url: ownerUrl,
+  schema: 'myservice', // created if missing; the tables land here, never in public
+  sources: [
+    { name: 'reporting', dir: reportingMigrations }, // before the host's own
+    { name: 'app', dir: 'drizzle' },
+  ],
+});
+
+await ensureRuntimeRole({
+  ownerUrl,
+  runtimeUrl,
+  schemas: ['myservice'],
+  appendOnly: ['reporting_events', 'reporting_analytics'], // insert and read only
+  readOnly: ['reporting_analytics_daily', 'reporting_analytics_weekly'], // the rollups: written only by the functions
+  noDelete: [ // insert and update, never delete (needs @wtfalch/db 0.5.2 or later)
+    'reporting_tasks',
+    'reporting_settings',
+    'reporting_errors',
+    'reporting_tenant_settings',
+    'reporting_error_tenants',
+  ],
+  grants: [ // the seven security definer functions, schema-qualified
+    'myservice.reporting_prune_events(interval, integer)',
+    'myservice.reporting_rollup_day(date)',
+    'myservice.reporting_rollup_week(date)',
+    'myservice.reporting_prune_analytics(interval, integer, date)',
+    'myservice.reporting_erase_person(text)',
+    'myservice.reporting_prune_errors(interval, integer)',
+    'myservice.reporting_prune_open_errors(integer, integer)',
+  ],
+});
 ```
 
-The copied migration creates `reporting_events`, `reporting_tasks` and
-`reporting_settings`, a `SECURITY DEFINER` prune function, and, when a role
-named `<database>_rt` exists, revokes UPDATE, DELETE and TRUNCATE on events
-from it. That is the estate's runtime-role convention; a host without the
-role gets the tables and the function and no revokes take effect. Your
-migrate script applies the file; this package never connects to apply
-anything.
+Run `ensureRuntimeRole` after every migration run: the lists apply to the
+tables that exist at that moment. `grants` entries are spliced into SQL, so
+they are trusted text. Without `noDelete` the role can delete from those five
+tables. These are the privileges the
+package's own tests check, on a real Postgres, in a named schema.
+
+At boot, check the role over the runtime connection, whose `searchPath`
+includes the schema:
+
+```ts
+import { assertRuntimeRole } from '@wtfalch/db/runtime-role';
+
+await assertRuntimeRole(connection.database, {
+  appendOnly: ['myservice.reporting_events', 'myservice.reporting_analytics'],
+  readOnly: ['myservice.reporting_analytics_daily', 'myservice.reporting_analytics_weekly'],
+  noDelete: [
+    'myservice.reporting_tasks',
+    'myservice.reporting_settings',
+    'myservice.reporting_errors',
+    'myservice.reporting_tenant_settings',
+    'myservice.reporting_error_tenants',
+  ],
+});
+```
+
+The runtime handle is the native Drizzle one: pass `withDrizzle(runtime, {
+schema: tables }).orm` (or `tx.orm`) from `@wtfalch/db/drizzle`.
+
+Without `@wtfalch/db`, `reporting-migrations` still copies
+`migrations/*.sql` into `drizzle/` as the next numbers and the host applies
+them itself. Prefer `runMigrationSources`: the copy path has no schema and no
+runtime-role step, so the host must grant and revoke by hand.
 
 ## Bind it once
 
 ```ts
 // src/lib/reporting/core.ts, the one file that imports your raw handle
 import { createReporting } from '@wtfalch/reporting';
-import { createHousekeeping, pruneEvents, retentionLag } from '@wtfalch/reporting/housekeeping';
+import { createHousekeeping, pruneErrors, pruneEvents, retentionLag } from '@wtfalch/reporting/housekeeping';
 import { deferWithAfter } from '@wtfalch/reporting/next';
 
 export const reporting = createReporting({
@@ -48,6 +128,7 @@ export const reporting = createReporting({
 
 export const housekeeping = createHousekeeping({ reporting });
 housekeeping.register(pruneEvents);
+housekeeping.register(pruneErrors);
 housekeeping.register(retentionLag);
 ```
 
@@ -136,6 +217,24 @@ every row regardless.
 
 ## Analytics (0.2.0)
 
+**Topology, today:** this package is a library, not a host. `createReporting({
+db, ... })` binds to whichever Postgres the calling app already has, and
+every table below lives in that one app's own database. `tenantId` scopes a
+read to one organisation *within* that single app's database — it does not
+let a console outside that app read anything. There is no cross-app or
+cross-company read: one company's own Boule sees only the rows its own
+process wrote.
+
+**Topology, target (settled 2026-09-28, planned after launch):** one shared
+reporting collector, org-scoped like `@wtfalch/files` and `@wtfalch/ai` —
+every app's `reporting` calls point at that one shared store instead of a
+database of its own, row-level scoping keeps one company's rows out of
+another's reads, Archon reads totals across every company, and each
+company's own Boule reads only its own organisation's slice. Not built yet:
+today's shape is the per-app library described above, and the shared-host
+change (or a lighter "point every app's `reporting` at one app's database"
+approach) is an open architecture question for whoever picks it up next.
+
 Three tables and two writers. `reporting_analytics` holds raw rows for a
 window (`analytics.retention_days`, default 90); `reporting_analytics_daily`
 and `reporting_analytics_weekly` hold counts with no identifier in any column

package/dist/errors/capture.js

@@ -1,9 +1,9 @@
 import { eq, sql } from 'drizzle-orm';
 import { ERROR_RUNTIMES, KIND_PATTERN, LIMITS } from '../schema.js';
-import { reportingErrors } from '../tables.js';
+import { reportingErrorTenants, reportingErrors } from '../tables.js';
 import { describe } from '../writer.js';
 import { errorKind, fingerprint } from './fingerprint.js';
-import { heldSecrets, redactText } from './redact.js';
+import { heldSecrets, redactPii, redactText } from './redact.js';
 const CAMEL_BOUNDARY = /([a-z0-9])([A-Z])/g;
 const INVALID_KIND_CHARS = /[^a-z0-9_]+/g;
 /** camelCase/PascalCase/anything, folded down to what `KIND_PATTERN` allows. */
@@ -51,6 +51,8 @@ function messageOf(error, kind) {
 function stackOf(error) {
     return error instanceof Error && typeof error.stack === 'string' ? error.stack : null;
 }
+/** Extra characters kept before redaction so a secret at the size limit is seen whole. */
+const SLACK = 1024;
 /** Keeps the top of the text — the start, where the throw site and its callers are — and drops the rest. */
 function truncateEnd(text, max) {
     return text.length > max ? text.slice(0, max) : text;
@@ -101,7 +103,7 @@ function normaliseRuntime(runtime) {
  * share one transaction so the lock from the first is still held for the
  * second.
  */
-async function upsertGroup(db, site, s) {
+async function upsertGroup(db, site, s, log) {
     return db.transaction(async (tx) => {
         const prior = await tx
             .select({ state: reportingErrors.state })
@@ -131,7 +133,7 @@ async function upsertGroup(db, site, s) {
             target: reportingErrors.fingerprint,
             set: {
                 occurrences: sql `${reportingErrors.occurrences} + 1`,
-                lastSeenAt: s.at,
+                lastSeenAt: sql `greatest(${reportingErrors.lastSeenAt}, ${s.at.toISOString()}::timestamptz)`,
                 message: s.message,
                 stack: s.stack,
                 tenantId: s.tenantId,
@@ -147,6 +149,33 @@ async function upsertGroup(db, site, s) {
             // false when it took the on-conflict-update path -- the standard,
             // race-free way to tell the two apart from an upsert's own result.
             .returning({ created: sql `(xmax = 0)` });
+        if (s.tenantId) {
+            // In a savepoint and fail-soft: a host that has not applied 0008 yet
+            // must still get the group row. The tenant row is the lesser loss.
+            try {
+                await tx.transaction(async (sp) => {
+                    await sp
+                        .insert(reportingErrorTenants)
+                        .values({
+                        fingerprint: s.fingerprint,
+                        tenantId: s.tenantId,
+                        occurrences: 1,
+                        firstSeenAt: s.at,
+                        lastSeenAt: s.at,
+                    })
+                        .onConflictDoUpdate({
+                        target: [reportingErrorTenants.fingerprint, reportingErrorTenants.tenantId],
+                        set: {
+                            occurrences: sql `${reportingErrorTenants.occurrences} + 1`,
+                            lastSeenAt: sql `greatest(${reportingErrorTenants.lastSeenAt}, ${s.at.toISOString()}::timestamptz)`,
+                        },
+                    });
+                });
+            }
+            catch (err) {
+                log.warn({ err: describe(err), fingerprint: s.fingerprint }, 'reporting: tenant row not written; is migration 0008 applied?');
+            }
+        }
         if (written[0]?.created)
             return 'created';
         return priorState === 'resolved' || priorState === 'ignored' ? 'reopened' : 'unchanged';
@@ -171,9 +200,15 @@ export function createCapture(o) {
         try {
             const kind = resolveKind(error, context.kind);
             const secrets = heldSecrets(process.env, o.redactEnvVars);
-            const message = truncateEnd(redactText(messageOf(error, kind), secrets), LIMITS.message);
+            // Bound the text before redacting it: the patterns must never see an
+            // uncapped, attacker-sized string. The cut keeps slack past the limit so
+            // a secret straddling the limit is redacted whole, then the final cut
+            // applies the real limit.
+            const message = truncateEnd(redactPii(redactText(truncateEnd(messageOf(error, kind), LIMITS.message + SLACK), secrets)), LIMITS.message);
             const rawStack = stackOf(error);
-            const stack = rawStack === null ? null : truncateEnd(redactText(rawStack, secrets), LIMITS.stack);
+            const stack = rawStack === null
+                ? null
+                : truncateEnd(redactPii(redactText(truncateEnd(rawStack, LIMITS.stack + SLACK), secrets)), LIMITS.stack);
             const fp = fingerprint({ kind, message, stack });
             const runtime = normaliseRuntime(context.runtime);
             // A tenant id that is not a uuid would be refused by the event row's
@@ -208,7 +243,7 @@ export function createCapture(o) {
                 at,
             };
             try {
-                o.defer(() => upsertGroup(o.db, o.site, sample)
+                o.defer(() => upsertGroup(o.db, o.site, sample, o.log)
                     .then((outcome) => {
                     if (outcome === 'unchanged' || !o.alert)
                         return;

package/dist/errors/reader.d.ts

@@ -1,5 +1,5 @@
 import type { ErrorState } from '../schema.js';
-import type { ReportingErrorRow } from '../tables.js';
+import type { ReportingErrorRow, TenantErrorRow } from '../tables.js';
 import type { Actor, Db, ErrorsPage, ErrorsPageOptions } from '../types.js';
 /**
  * Newest first, keyset-paged on `(last_seen_at, fingerprint)`, the table's
@@ -11,9 +11,28 @@ import type { Actor, Db, ErrorsPage, ErrorsPageOptions } from '../types.js';
  * for its scale. No permission is applied here: the host gates, and this
  * returns rows as stored.
  */
+export declare function errorsPage(db: Db, opts?: ErrorsPageOptions & {
+    readonly tenantId?: undefined;
+}): Promise<ErrorsPage<ReportingErrorRow>>;
+export declare function errorsPage(db: Db, opts: ErrorsPageOptions & {
+    readonly tenantId: string;
+}): Promise<ErrorsPage<TenantErrorRow>>;
 export declare function errorsPage(db: Db, opts?: ErrorsPageOptions): Promise<ErrorsPage>;
-/** One row by fingerprint, or null when it is unknown. */
-export declare function errorDetail(db: Db, fingerprint: string): Promise<ReportingErrorRow | null>;
+/**
+ * One row by fingerprint, or null when it is unknown. With `tenantId`, null
+ * too when that tenant never hit it, and the row is a `TenantErrorRow`: the
+ * counts and times are the tenant's own and the shared text and triage state
+ * are null, as in `errorsPage`. A present `tenantId` that is not a uuid throws.
+ */
+export declare function errorDetail(db: Db, fingerprint: string, opts?: {
+    readonly tenantId?: undefined;
+}): Promise<ReportingErrorRow | null>;
+export declare function errorDetail(db: Db, fingerprint: string, opts: {
+    readonly tenantId: string;
+}): Promise<TenantErrorRow | null>;
+export declare function errorDetail(db: Db, fingerprint: string, opts?: {
+    readonly tenantId?: string;
+}): Promise<ReportingErrorRow | TenantErrorRow | null>;
 /**
  * Moves an error's state. 'resolved' and 'ignored' stamp `resolved_at` and
  * `resolved_by` with this instant and who did it; moving back to 'open'

package/dist/errors/reader.js

@@ -1,32 +1,75 @@
 import { and, desc, eq, ilike, lt, or, sql } from 'drizzle-orm';
-import { reportingErrors } from '../tables.js';
+import { reportingErrorTenants, reportingErrors } from '../tables.js';
 /** Postgres's default LIKE/ILIKE escape is backslash; escaping the pattern's own three special characters is what makes a search term match itself literally rather than as a wildcard pattern. */
 function likePattern(term) {
     return `%${term.replace(/[\\%_]/g, (c) => `\\${c}`)}%`;
 }
+const UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 /**
- * Newest first, keyset-paged on `(last_seen_at, fingerprint)`, the table's
- * index. Every filter is an equality on an indexed column, except `search`:
- * a case-insensitive substring match on `message` or `stack`, for triaging
- * an incident by grepping the group list rather than raw rows by hand (gap
- * issue #8). Unindexed by design -- a trigram index would need the
- * pg_trgm extension, an operational cost this triage tool does not carry
- * for its scale. No permission is applied here: the host gates, and this
- * returns rows as stored.
+ * Scope is decided by whether the key is present, not by truthiness: an empty
+ * string or an explicit `undefined` from a host bug must not fall through to
+ * the unscoped read of every tenant's data, so a present key that is not a
+ * uuid throws. An absent key is unscoped.
  */
+function tenantScope(opts) {
+    if (!('tenantId' in opts))
+        return undefined;
+    const { tenantId } = opts;
+    if (typeof tenantId !== 'string' || !UUID.test(tenantId)) {
+        throw new Error('tenantId must be a uuid when given; refusing to fall back to an unscoped read');
+    }
+    return tenantId;
+}
+/**
+ * The columns a tenant may see of a shared group. The text and request facts
+ * of the group belong to whichever tenant hit it last, and its triage state is
+ * one operator's call for every tenant, so those are null.
+ */
+function tenantColumns() {
+    return {
+        fingerprint: reportingErrors.fingerprint,
+        site: reportingErrors.site,
+        environment: reportingErrors.environment,
+        kind: reportingErrors.kind,
+        message: sql `null`.as('message'),
+        stack: sql `null`.as('stack'),
+        runtime: sql `null`.as('runtime'),
+        release: sql `null`.as('release'),
+        requestId: sql `null`.as('request_id'),
+        resolvedBy: sql `null`.as('resolved_by'),
+        state: sql `null`.as('state'),
+        resolvedAt: sql `null`.as('resolved_at'),
+        tenantId: reportingErrorTenants.tenantId,
+        occurrences: reportingErrorTenants.occurrences,
+        firstSeenAt: reportingErrorTenants.firstSeenAt,
+        lastSeenAt: reportingErrorTenants.lastSeenAt,
+    };
+}
 export async function errorsPage(db, opts = {}) {
+    const tenantId = tenantScope(opts);
     const limit = Math.max(1, Math.min(opts.limit ?? 50, 200));
+    // With a tenant, the page is that tenant's own view: its rows join the
+    // group and supply the counts and times, so ordering and paging follow the
+    // tenant's last occurrence, not anyone else's.
+    const seen = tenantId !== undefined ? reportingErrorTenants.lastSeenAt : reportingErrors.lastSeenAt;
     const conditions = [];
     if (opts.site)
         conditions.push(eq(reportingErrors.site, opts.site));
-    if (opts.state)
+    // `state` is shared operator triage, so in tenant scope it is ignored: a
+    // filter on it would show one tenant whether another reopened the group.
+    if (opts.state && tenantId === undefined)
         conditions.push(eq(reportingErrors.state, opts.state));
-    if (opts.runtime)
+    // `runtime` and the text are the latest sample from any tenant, so a tenant
+    // scope neither filters on the first nor searches the rest: either would be
+    // an oracle on another tenant's data. Search matches `kind` there.
+    if (opts.runtime && tenantId === undefined)
         conditions.push(eq(reportingErrors.runtime, opts.runtime));
     const search = opts.search?.trim().slice(0, 200);
     if (search) {
         const pattern = likePattern(search);
-        const clause = or(ilike(reportingErrors.message, pattern), ilike(reportingErrors.stack, pattern));
+        const clause = tenantId !== undefined
+            ? ilike(reportingErrors.kind, pattern)
+            : or(ilike(reportingErrors.message, pattern), ilike(reportingErrors.stack, pattern));
         if (clause)
             conditions.push(clause);
     }
@@ -34,16 +77,26 @@ export async function errorsPage(db, opts = {}) {
         conditions.push(eq(reportingErrors.environment, opts.environment));
     if (opts.after) {
         const { lastSeenAt, fingerprint } = opts.after;
-        const keyset = or(lt(reportingErrors.lastSeenAt, lastSeenAt), and(eq(reportingErrors.lastSeenAt, lastSeenAt), lt(reportingErrors.fingerprint, fingerprint)));
+        const keyset = or(lt(seen, lastSeenAt), and(eq(seen, lastSeenAt), lt(reportingErrors.fingerprint, fingerprint)));
         if (keyset)
             conditions.push(keyset);
     }
-    const rows = await db
-        .select()
-        .from(reportingErrors)
-        .where(conditions.length > 0 ? and(...conditions) : undefined)
-        .orderBy(desc(reportingErrors.lastSeenAt), desc(reportingErrors.fingerprint))
-        .limit(limit + 1);
+    const where = conditions.length > 0 ? and(...conditions) : undefined;
+    const order = [desc(seen), desc(reportingErrors.fingerprint)];
+    const rows = tenantId !== undefined
+        ? await db
+            .select(tenantColumns())
+            .from(reportingErrors)
+            .innerJoin(reportingErrorTenants, and(eq(reportingErrorTenants.fingerprint, reportingErrors.fingerprint), eq(reportingErrorTenants.tenantId, tenantId)))
+            .where(where)
+            .orderBy(...order)
+            .limit(limit + 1)
+        : await db
+            .select()
+            .from(reportingErrors)
+            .where(where)
+            .orderBy(...order)
+            .limit(limit + 1);
     const items = rows.slice(0, limit);
     const last = items.at(-1);
     return {
@@ -53,8 +106,17 @@ export async function errorsPage(db, opts = {}) {
             : null,
     };
 }
-/** One row by fingerprint, or null when it is unknown. */
-export async function errorDetail(db, fingerprint) {
+export async function errorDetail(db, fingerprint, opts = {}) {
+    const tenantId = tenantScope(opts);
+    if (tenantId !== undefined) {
+        const scoped = await db
+            .select(tenantColumns())
+            .from(reportingErrors)
+            .innerJoin(reportingErrorTenants, and(eq(reportingErrorTenants.fingerprint, reportingErrors.fingerprint), eq(reportingErrorTenants.tenantId, tenantId)))
+            .where(eq(reportingErrors.fingerprint, fingerprint))
+            .limit(1);
+        return scoped[0] ?? null;
+    }
     const rows = await db
         .select()
         .from(reportingErrors)

package/dist/errors/redact.d.ts

@@ -42,6 +42,7 @@ export declare function heldSecrets(env: Readonly<Record<string, string | undefi
  * than wrapping each in an object just to hand it to `scrub`.
  */
 export declare function redactText(text: string, secrets: readonly string[]): string;
+export declare function redactPii(text: string): string;
 /**
  * The same structure with every held secret replaced.
  *

package/dist/errors/redact.js

@@ -68,6 +68,69 @@ export function redactText(text, secrets) {
     }
     return out;
 }
+/**
+ * Pattern-based PII redaction for a captured `message` or `stack`.
+ *
+ * `redactText` only knows the exact strings the host holds. A user's email
+ * address or a bearer token inside an error message is not one of them, yet
+ * it would be stored verbatim, kept until pruned and readable by anyone who
+ * can open the errors page. This covers the common shapes by pattern: cheap,
+ * and with false negatives (a bare opaque token with no label is not caught).
+ * A string that only looks like a secret and is not one, such as a version
+ * like `lodash@4.17.20`, is left alone.
+ */
+const PII_PATTERNS = [
+    // URL userinfo: `scheme://user:pass@host` keeps scheme and user, drops the
+    // password (also `scheme://:pass@host`). Before the email rule, which would
+    // otherwise take `pass@host` and leave the user behind a wrong label.
+    [/\b([a-z][a-z0-9+.-]{0,30}:\/\/[^\s:@/]{0,64}:)[^\s@/]{1,256}@/gi, '$1[redacted: password]@'],
+    // Every quantifier is bounded (RFC 5321 limits: 64-char local part, 63-char
+    // labels), so a long run of `a.a.a.` with no `@` costs a fixed amount per
+    // start position rather than a rescan of the rest of the string.
+    [
+        /\b[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9-]{1,63}(?:\.[A-Za-z0-9-]{1,63}){0,8}\.[A-Za-z]{2,24}\b/g,
+        '[redacted: email]',
+    ],
+    // A PEM private key block; an unterminated one (a truncated stack) runs to the end.
+    [
+        /-----BEGIN [A-Z ]{0,30}PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]{0,30}PRIVATE KEY-----|$)/g,
+        '[redacted: private key]',
+    ],
+    // The JSON form of an Authorization header, whatever the value's length.
+    [/("authorization"\s*:\s*)"(?:[^"\\]|\\.)*"/gi, '$1"[redacted: token]"'],
+    // A Cookie or Set-Cookie header's value, to the end of the line.
+    [/\b((?:set-)?cookie\s*:\s*)[^\r\n]+/gi, '$1[redacted: cookie]'],
+    // A JSON "cookie" / "set-cookie" value.
+    [/("(?:set-)?cookie"\s*:\s*)"(?:[^"\\]|\\.){0,2048}"/gi, '$1"[redacted: cookie]"'],
+    // A labelled secret in `=`, `:`, JSON (`"password":"x"`) or `%3D` form,
+    // including `x-api-key:` headers. A quoted value is taken whole.
+    [
+        /((?:password|passwd|token|secret|api[_-]?key|apikey|client_secret|access_token|refresh_token)["']?\s*(?::|=|%3D)\s*)(?:"(?:[^"\\]|\\.){0,512}"|'[^']{0,512}'|[^\s&;,'"}]+)/gi,
+        '$1[redacted: secret]',
+    ],
+    // JWT: three base64url segments, the first two starting with an encoded `{"`.
+    // Linear: a start cannot sit inside a base64url run (the lookbehind), and
+    // each segment is capped, so a hostile `-eyJ-eyJ...` costs a fixed amount.
+    [
+        /(?<![A-Za-z0-9_-])eyJ[A-Za-z0-9_-]{5,2048}\.eyJ[A-Za-z0-9_-]{5,2048}\.[A-Za-z0-9_-]{0,2048}/g,
+        '[redacted: token]',
+    ],
+    // An Authorization header's value, including its scheme.
+    [/\b(authorization\s*[:=]\s*)(?:(?:bearer|basic|token)\s+)?[^\s,;'"]+/gi, '$1[redacted: token]'],
+    // A scheme followed by a credential, anywhere.
+    [/\b(bearer|basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi, '$1 [redacted: token]'],
+    // Well-known prefixed token formats.
+    [
+        /\b(?:gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|xox[abprs]-[A-Za-z0-9-]{10,}|(?:AKIA|ASIA)[0-9A-Z]{16}|(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{10,}|AIza[0-9A-Za-z_-]{30,})\b/g,
+        '[redacted: token]',
+    ],
+];
+export function redactPii(text) {
+    let out = text;
+    for (const [pattern, replacement] of PII_PATTERNS)
+        out = out.replace(pattern, replacement);
+    return out;
+}
 /**
  * The same structure with every held secret replaced.
  *

package/dist/errors/tasks.d.ts

@@ -14,3 +14,18 @@ import type { Db } from '../types.js';
  */
 export declare const pruneErrors: Task;
 export declare function pruneErrorsBatch(db: Db, days: number, batch: number): Promise<number>;
+/**
+ * The most open groups one site keeps. `pruneErrors` never deletes an open
+ * group, and the public ingest route lets anyone create one per distinct
+ * message, so without this ceiling `reporting_errors` grows without bound.
+ * Generous for a real app (a few thousand distinct live bugs is already an
+ * incident), tight enough that a flood cannot fill the disk.
+ */
+export declare const MAX_OPEN_ERRORS_PER_SITE = 5000;
+/**
+ * Evicts the least recently seen open groups beyond `MAX_OPEN_ERRORS_PER_SITE`
+ * per site (0007_errors_open_cap.sql). Needs that migration; a host that has
+ * not applied it sees this one task fail and `pruneErrors` unaffected.
+ */
+export declare const pruneOpenErrors: Task;
+export declare function pruneOpenErrorsBatch(db: Db, cap: number, batch: number): Promise<number>;

package/dist/errors/tasks.js

@@ -48,3 +48,50 @@ export async function pruneErrorsBatch(db, days, batch) {
         return Number(row?.n ?? 0);
     });
 }
+/**
+ * The most open groups one site keeps. `pruneErrors` never deletes an open
+ * group, and the public ingest route lets anyone create one per distinct
+ * message, so without this ceiling `reporting_errors` grows without bound.
+ * Generous for a real app (a few thousand distinct live bugs is already an
+ * incident), tight enough that a flood cannot fill the disk.
+ */
+export const MAX_OPEN_ERRORS_PER_SITE = 5000;
+/**
+ * Evicts the least recently seen open groups beyond `MAX_OPEN_ERRORS_PER_SITE`
+ * per site (0007_errors_open_cap.sql). Needs that migration; a host that has
+ * not applied it sees this one task fail and `pruneErrors` unaffected.
+ */
+export const pruneOpenErrors = {
+    name: 'reporting.prune_open_errors',
+    every: HOUR,
+    lease: 10 * 60 * 1000,
+    retry: 15 * 60 * 1000,
+    async run(ctx) {
+        let total = 0;
+        for (let i = 0; i < 20; i += 1) {
+            if (ctx.now().getTime() > ctx.deadline.getTime() - 30_000)
+                break;
+            const n = await pruneOpenErrorsBatch(ctx.db, MAX_OPEN_ERRORS_PER_SITE, 5000);
+            total += n;
+            if (n < 5000)
+                break;
+            if (!(await ctx.renew()))
+                break;
+        }
+        if (total > 0) {
+            ctx.reporting.event({
+                kind: 'reporting.pruned_open_errors',
+                message: `evicted ${total} open error group(s) beyond the per-site cap`,
+                data: { rows: total, cap: MAX_OPEN_ERRORS_PER_SITE },
+            });
+        }
+    },
+};
+export async function pruneOpenErrorsBatch(db, cap, batch) {
+    return db.transaction(async (tx) => {
+        await tx.execute(sql `set local statement_timeout = '30s'`);
+        const result = await tx.execute(sql `select reporting_prune_open_errors(${cap}::int, ${batch}::int) as n`);
+        const [row] = rowsOf(result);
+        return Number(row?.n ?? 0);
+    });
+}

package/dist/housekeeping/index.d.ts

@@ -64,3 +64,5 @@ export interface Housekeeping {
 export declare function createHousekeeping(options: HousekeepingOptions): Housekeeping;
 export { pruneEvents, retentionLag } from './tasks.js';
 export { pruneAnalytics, rollupAnalytics, rollupAnalyticsWeekly } from '../analytics/tasks.js';
+export { pruneOpenErrors } from '../errors/tasks.js';
+export { pruneErrors } from '../errors/tasks.js';

package/dist/housekeeping/index.js

@@ -209,3 +209,5 @@ export function createHousekeeping(options) {
 }
 export { pruneEvents, retentionLag } from './tasks.js';
 export { pruneAnalytics, rollupAnalytics, rollupAnalyticsWeekly } from '../analytics/tasks.js';
+export { pruneOpenErrors } from '../errors/tasks.js';
+export { pruneErrors } from '../errors/tasks.js';

package/dist/migrations/0001_reporting.sql

@@ -5,10 +5,9 @@
 -- after the host copies this file into its drizzle/ directory as the next
 -- number (reporting-migrations); never edited there.
 --
--- Estate-shaped: the DO block at the end assumes the runtime-role convention
--- (a role named <database>_rt that owns nothing and serves the app). A host
--- without that role gets the tables and the function and no revokes take
--- effect, which the package README says plainly.
+-- The SQL names no role and no schema. The host applies it into its own
+-- schema and makes the runtime role itself; the package README lists the
+-- privileges to pass to ensureRuntimeRole.
 
 create table if not exists reporting_events (
   id              bigint generated always as identity primary key,
@@ -114,7 +113,7 @@ create or replace function reporting_prune_events(retention interval, batch inte
 returns integer
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 declare
   w interval := greatest(interval '7 days', least(coalesce(retention, interval '30 days'), interval '400 days'));
@@ -136,18 +135,5 @@ revoke all on function reporting_prune_events(interval, integer) from public;
 
 -- The runtime role keeps SELECT and INSERT on all three tables, UPDATE on
 -- tasks and settings because the claim protocol and the settings page write
--- them, and nothing that deletes. The host's default privileges granted the
--- rest at create time; the revokes here win because they run later in the
--- same file.
-do $$
-declare
-  rt text := current_database() || '_rt';
-begin
-  if exists (select 1 from pg_roles where rolname = rt) then
-    execute format('revoke update, delete, truncate on reporting_events from %I', rt);
-    execute format('revoke delete, truncate on reporting_tasks from %I', rt);
-    execute format('revoke delete, truncate on reporting_settings from %I', rt);
-    execute format('grant execute on function reporting_prune_events(interval, integer) to %I', rt);
-  end if;
-end
-$$;
+-- them, and nothing that deletes. The host's ensureRuntimeRole call sets
+-- that; see the README.

package/dist/migrations/0002_analytics.sql

@@ -135,7 +135,7 @@ create or replace function reporting_rollup_day(d date)
 returns integer
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 declare
   n integer;
@@ -231,7 +231,7 @@ create or replace function reporting_rollup_week(w date)
 returns integer
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 declare
   n integer;
@@ -282,7 +282,7 @@ create or replace function reporting_prune_analytics(retention interval, batch i
 returns integer
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 declare
   w interval := greatest(interval '7 days', least(coalesce(retention, interval '90 days'), interval '400 days'));
@@ -316,7 +316,7 @@ create or replace function reporting_erase_person(subject text)
 returns integer
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 declare
   n integer;
@@ -332,19 +332,5 @@ $$;
 revoke all on function reporting_erase_person(text) from public;
 
 -- The runtime role inserts and reads raw rows, reads the rollups, and
--- changes either only through the functions above.
-do $$
-declare
-  rt text := current_database() || '_rt';
-begin
-  if exists (select 1 from pg_roles where rolname = rt) then
-    execute format('revoke update, delete, truncate on reporting_analytics from %I', rt);
-    execute format('revoke insert, update, delete, truncate on reporting_analytics_daily from %I', rt);
-    execute format('revoke insert, update, delete, truncate on reporting_analytics_weekly from %I', rt);
-    execute format('grant execute on function reporting_rollup_day(date) to %I', rt);
-    execute format('grant execute on function reporting_rollup_week(date) to %I', rt);
-    execute format('grant execute on function reporting_prune_analytics(interval, integer, date) to %I', rt);
-    execute format('grant execute on function reporting_erase_person(text) to %I', rt);
-  end if;
-end
-$$;
+-- changes either only through the functions above (the host's
+-- ensureRuntimeRole call; see the README).

package/dist/migrations/0003_errors.sql

@@ -7,10 +7,8 @@
 -- copies this file into its drizzle/ directory as the next number
 -- (reporting-migrations); never edited there.
 --
--- Estate-shaped: the DO block at the end assumes the runtime-role convention
--- (a role named <database>_rt that owns nothing and serves the app). A host
--- without that role gets the table and no revokes take effect, which the
--- package README says plainly.
+-- The SQL names no role and no schema; the host's ensureRuntimeRole call
+-- sets the runtime role's privileges (see the README).
 
 create table if not exists reporting_errors (
   fingerprint     text primary key,
@@ -77,7 +75,7 @@ create or replace function reporting_prune_errors(retention interval, batch inte
 returns integer
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 declare
   w interval := greatest(interval '7 days', least(coalesce(retention, interval '30 days'), interval '400 days'));
@@ -105,14 +103,4 @@ comment on function reporting_prune_errors(interval, integer) is
 -- on repeat occurrences and an operator moves state through this table.
 -- Nothing that deletes, the same as reporting_tasks and reporting_settings;
 -- reporting_prune_errors runs as the function owner, not the runtime role,
--- so the grant below is execute only, same shape as reporting_prune_events.
-do $$
-declare
-  rt text := current_database() || '_rt';
-begin
-  if exists (select 1 from pg_roles where rolname = rt) then
-    execute format('revoke delete, truncate on reporting_errors from %I', rt);
-    execute format('grant execute on function reporting_prune_errors(interval, integer) to %I', rt);
-  end if;
-end
-$$;
+-- so the runtime role needs execute only, same shape as reporting_prune_events.

package/dist/migrations/0006_tenant_settings.sql

@@ -45,7 +45,7 @@ create or replace function reporting_prune_events(retention interval, batch inte
 returns integer
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 declare
   w interval := greatest(interval '7 days', least(coalesce(retention, interval '30 days'), interval '400 days'));
@@ -82,7 +82,7 @@ create or replace function reporting_prune_analytics(retention interval, batch i
 returns integer
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 declare
   w interval := greatest(interval '7 days', least(coalesce(retention, interval '90 days'), interval '400 days'));
@@ -121,22 +121,4 @@ revoke all on function reporting_prune_analytics(interval, integer, date) from p
 -- The runtime role reads and edits overrides (an operator's settings page),
 -- same shape as reporting_settings: select, insert, update, nothing that
 -- deletes -- clearing an override is a value update, not a row removal.
---
--- CREATE OR REPLACE FUNCTION keeps the two prune functions' existing grants
--- (their signatures are unchanged from 0001/0002); the two re-grants below
--- are a no-op on a host that already has them and a safety net on one
--- whose grants somehow drifted, cheap either way.
-do $$
-declare
-  rt text := current_database() || '_rt';
-begin
-  if exists (select 1 from pg_roles where rolname = rt) then
-    execute format('revoke delete, truncate on reporting_tenant_settings from %I', rt);
-    execute format('grant execute on function reporting_prune_events(interval, integer) to %I', rt);
-    execute format(
-      'grant execute on function reporting_prune_analytics(interval, integer, date) to %I',
-      rt
-    );
-  end if;
-end
-$$;
+-- The host's ensureRuntimeRole call sets that; see the README.

package/dist/migrations/0007_errors_open_cap.sql

@@ -0,0 +1,42 @@
+-- @wtfalch/reporting 0.6.0: a ceiling on open error groups per site.
+--
+-- reporting_prune_errors (0003) never deletes an 'open' row, on purpose. But
+-- the public ingest route lets an unauthenticated caller create a new group
+-- per distinct message, so "never" also means "without bound". This function
+-- is the bound: when a site holds more than `cap` open groups, the ones seen
+-- least recently leave first. An incident that is still firing keeps its
+-- group, because every occurrence moves last_seen_at forward; a flood of
+-- one-off messages pushes out only other one-off messages. Idempotent.
+--
+-- `cap` is clamped to at least 100 so a bad argument cannot empty the table;
+-- `batch` to between 1 and 5,000, same as reporting_prune_errors.
+create or replace function reporting_prune_open_errors(cap integer, batch integer)
+returns integer
+language plpgsql
+security definer
+set search_path from current
+as $$
+declare
+  c integer := greatest(100, coalesce(cap, 5000));
+  b integer := greatest(1, least(coalesce(batch, 5000), 5000));
+  n integer;
+begin
+  with ranked as (
+    select fingerprint,
+           row_number() over (partition by site order by last_seen_at desc, fingerprint) as rn
+      from reporting_errors
+     where state = 'open'
+  ),
+  victims as (
+    select fingerprint from ranked where rn > c order by rn desc limit b
+  )
+  delete from reporting_errors e using victims v where e.fingerprint = v.fingerprint;
+  get diagnostics n = row_count;
+  return n;
+end
+$$;
+revoke all on function reporting_prune_open_errors(integer, integer) from public;
+
+comment on function reporting_prune_open_errors(integer, integer) is
+  'Deletes the least recently seen open groups beyond `cap` per site. The only way an open row leaves on a timer: a bound on unauthenticated ingest, not an age limit.';
+

package/dist/migrations/0008_error_tenants.sql

@@ -0,0 +1,35 @@
+-- @wtfalch/reporting 0.6.0: per-tenant occurrence tracking for error groups.
+-- Mirrors src/tables.ts.
+--
+-- reporting_errors keeps one row per fingerprint, so two tenants that hit the
+-- same bug share a row whose tenant_id is whichever occurrence came last.
+-- That silently moves the group between tenants and gives a tenant-scoped
+-- reader nothing to filter on. This table records, per fingerprint and
+-- tenant, that the tenant saw the error, how often and when. Readers filter
+-- and count from here when given a tenantId; the shared row is unchanged.
+--
+-- The foreign key cascades, so a pruned group takes its tenant rows with it
+-- (the prune functions run as the table owner; the runtime role never
+-- deletes). Every statement is idempotent.
+
+create table if not exists reporting_error_tenants (
+  fingerprint     text not null references reporting_errors (fingerprint) on delete cascade,
+  tenant_id       uuid not null,
+  occurrences     bigint not null default 1,
+  first_seen_at   timestamptz not null,
+  last_seen_at    timestamptz not null,
+  constraint reporting_error_tenants_pkey primary key (fingerprint, tenant_id),
+  constraint reporting_error_tenants_fingerprint_check check (fingerprint ~ '^[0-9a-f]{32}$'),
+  constraint reporting_error_tenants_occurrences_check check (occurrences > 0),
+  constraint reporting_error_tenants_seen_check check (last_seen_at >= first_seen_at)
+);
+
+create index if not exists reporting_error_tenants_tenant_idx
+  on reporting_error_tenants (tenant_id, last_seen_at desc);
+
+-- No backfill. reporting_errors holds only the latest tenant per group, so
+-- copying its occurrences to that tenant would credit it with every other
+-- tenant's history. Counts per tenant start at the deploy of 0.6.0.
+
+-- Select, insert and update for the runtime role; nothing that deletes (the
+-- host's ensureRuntimeRole call sets that; see the README).

package/dist/migrations-dir.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Absolute path of the directory holding this package's numbered `.sql`
+ * migrations. The host passes it to `runMigrationSources` as
+ * `{ name: 'reporting', dir: migrationsDir }`.
+ *
+ * Its own subpath (`@wtfalch/reporting/migrations-dir`) and no other
+ * imports: a migration image imports this without the Drizzle, React and
+ * Next the main entry pulls in, and a bundler never meets this file's
+ * `import.meta.url` through the main entry.
+ */
+export declare const migrationsDir: string;

package/dist/migrations-dir.js

@@ -0,0 +1,12 @@
+import { fileURLToPath } from 'node:url';
+/**
+ * Absolute path of the directory holding this package's numbered `.sql`
+ * migrations. The host passes it to `runMigrationSources` as
+ * `{ name: 'reporting', dir: migrationsDir }`.
+ *
+ * Its own subpath (`@wtfalch/reporting/migrations-dir`) and no other
+ * imports: a migration image imports this without the Drizzle, React and
+ * Next the main entry pulls in, and a bundler never meets this file's
+ * `import.meta.url` through the main entry.
+ */
+export const migrationsDir = fileURLToPath(new URL('./migrations/', import.meta.url));

package/dist/react/errors.d.ts

@@ -1,4 +1,4 @@
-import type { ReportingErrorRow } from '../tables.js';
+import type { ReportingErrorRow, TenantErrorRow } from '../tables.js';
 /**
  * The operator's error list: a plain table over the rows `errorsPage()`
  * already returned, newest last-seen first — the same props-in split as
@@ -7,6 +7,6 @@ import type { ReportingErrorRow } from '../tables.js';
  * renders the group's summary columns.
  */
 export declare function ErrorsTable(props: {
-    readonly rows: readonly ReportingErrorRow[];
+    readonly rows: readonly (ReportingErrorRow | TenantErrorRow)[];
     readonly label?: string;
 }): import("react").JSX.Element;

package/dist/react/errors.js

@@ -10,7 +10,7 @@ export function ErrorsTable(props) {
     if (props.rows.length === 0) {
         return _jsx("p", { "data-reporting-errors-empty": "", children: "No errors captured. All clear." });
     }
-    return (_jsxs("table", { "data-reporting-errors": "", "aria-label": props.label ?? 'Errors, newest last seen first', children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { scope: "col", children: "Kind" }), _jsx("th", { scope: "col", children: "Message" }), _jsx("th", { scope: "col", children: "Occurrences" }), _jsx("th", { scope: "col", children: "First seen" }), _jsx("th", { scope: "col", children: "Last seen" }), _jsx("th", { scope: "col", children: "Runtime" }), _jsx("th", { scope: "col", children: "Release" }), _jsx("th", { scope: "col", children: "State" })] }) }), _jsx("tbody", { children: props.rows.map((row) => (_jsxs("tr", { children: [_jsx("td", { children: row.kind }), _jsx("td", { style: { maxWidth: '32rem', overflowWrap: 'anywhere', wordBreak: 'break-word' }, title: row.message, children: row.message }), _jsx("td", { style: { fontVariantNumeric: 'tabular-nums' }, children: String(row.occurrences) }), _jsx("td", { children: formatTimestamp(row.firstSeenAt) }), _jsx("td", { children: formatTimestamp(row.lastSeenAt) }), _jsx("td", { children: row.runtime }), _jsx("td", { children: row.release ?? '—' }), _jsx("td", { children: row.state })] }, row.fingerprint))) })] }));
+    return (_jsxs("table", { "data-reporting-errors": "", "aria-label": props.label ?? 'Errors, newest last seen first', children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { scope: "col", children: "Kind" }), _jsx("th", { scope: "col", children: "Message" }), _jsx("th", { scope: "col", children: "Occurrences" }), _jsx("th", { scope: "col", children: "First seen" }), _jsx("th", { scope: "col", children: "Last seen" }), _jsx("th", { scope: "col", children: "Runtime" }), _jsx("th", { scope: "col", children: "Release" }), _jsx("th", { scope: "col", children: "State" })] }) }), _jsx("tbody", { children: props.rows.map((row) => (_jsxs("tr", { children: [_jsx("td", { children: row.kind }), _jsx("td", { style: { maxWidth: '32rem', overflowWrap: 'anywhere', wordBreak: 'break-word' }, title: row.message ?? undefined, children: row.message ?? '—' }), _jsx("td", { style: { fontVariantNumeric: 'tabular-nums' }, children: String(row.occurrences) }), _jsx("td", { children: formatTimestamp(row.firstSeenAt) }), _jsx("td", { children: formatTimestamp(row.lastSeenAt) }), _jsx("td", { children: row.runtime ?? '—' }), _jsx("td", { children: row.release ?? '—' }), _jsx("td", { children: row.state })] }, row.fingerprint))) })] }));
 }
 function formatTimestamp(value) {
     return `${value.toISOString().slice(0, 19).replace('T', ' ')} UTC`;

package/dist/tables.d.ts

@@ -1633,6 +1633,99 @@ export declare const reportingErrors: import("drizzle-orm/pg-core").PgTableWithC
     };
     dialect: "pg";
 }>;
+/** One row per (fingerprint, tenant): that tenant's own occurrences of a shared error group; mirrored from migrations/0008_error_tenants.sql. */
+export declare const reportingErrorTenants: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "reporting_error_tenants";
+    schema: undefined;
+    columns: {
+        fingerprint: import("drizzle-orm/pg-core").PgColumn<{
+            name: "fingerprint";
+            tableName: "reporting_error_tenants";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        tenantId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "tenant_id";
+            tableName: "reporting_error_tenants";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        occurrences: import("drizzle-orm/pg-core").PgColumn<{
+            name: "occurrences";
+            tableName: "reporting_error_tenants";
+            dataType: "number";
+            columnType: "PgBigInt53";
+            data: number;
+            driverParam: string | number;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        firstSeenAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "first_seen_at";
+            tableName: "reporting_error_tenants";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        lastSeenAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "last_seen_at";
+            tableName: "reporting_error_tenants";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
 export type ReportingEventRow = typeof reportingEvents.$inferSelect;
 export type ReportingAnalyticsRow = typeof reportingAnalytics.$inferSelect;
 export type ReportingAnalyticsDailyRow = typeof reportingAnalyticsDaily.$inferSelect;
@@ -1641,6 +1734,24 @@ export type ReportingTaskRow = typeof reportingTasks.$inferSelect;
 export type ReportingSettingRow = typeof reportingSettings.$inferSelect;
 export type ReportingTenantSettingRow = typeof reportingTenantSettings.$inferSelect;
 export type ReportingErrorRow = typeof reportingErrors.$inferSelect;
+/**
+ * A group as a tenant sees it: the shared group's text and request facts come
+ * from whichever tenant hit it last, and its triage state (`state`,
+ * `resolvedAt`) is one operator's call for all tenants, so they are null here.
+ * Counts, times and
+ * `tenantId` are the tenant's own (reporting_error_tenants).
+ */
+export type TenantErrorRow = Omit<ReportingErrorRow, 'message' | 'stack' | 'runtime' | 'release' | 'requestId' | 'resolvedBy' | 'state' | 'resolvedAt'> & {
+    readonly message: null;
+    readonly stack: null;
+    readonly runtime: null;
+    readonly release: null;
+    readonly requestId: null;
+    readonly resolvedBy: null;
+    /** Triage state is shared across tenants, so a tenant cannot see it. */
+    readonly state: null;
+    readonly resolvedAt: null;
+};
 export declare const tables: {
     events: import("drizzle-orm/pg-core").PgTableWithColumns<{
         name: "reporting_events";
@@ -3265,4 +3376,96 @@ export declare const tables: {
         };
         dialect: "pg";
     }>;
+    errorTenants: import("drizzle-orm/pg-core").PgTableWithColumns<{
+        name: "reporting_error_tenants";
+        schema: undefined;
+        columns: {
+            fingerprint: import("drizzle-orm/pg-core").PgColumn<{
+                name: "fingerprint";
+                tableName: "reporting_error_tenants";
+                dataType: "string";
+                columnType: "PgText";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: [string, ...string[]];
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            tenantId: import("drizzle-orm/pg-core").PgColumn<{
+                name: "tenant_id";
+                tableName: "reporting_error_tenants";
+                dataType: "string";
+                columnType: "PgUUID";
+                data: string;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            occurrences: import("drizzle-orm/pg-core").PgColumn<{
+                name: "occurrences";
+                tableName: "reporting_error_tenants";
+                dataType: "number";
+                columnType: "PgBigInt53";
+                data: number;
+                driverParam: string | number;
+                notNull: true;
+                hasDefault: true;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            firstSeenAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "first_seen_at";
+                tableName: "reporting_error_tenants";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+            lastSeenAt: import("drizzle-orm/pg-core").PgColumn<{
+                name: "last_seen_at";
+                tableName: "reporting_error_tenants";
+                dataType: "date";
+                columnType: "PgTimestamp";
+                data: Date;
+                driverParam: string;
+                notNull: true;
+                hasDefault: false;
+                isPrimaryKey: false;
+                isAutoincrement: false;
+                hasRuntimeDefault: false;
+                enumValues: undefined;
+                baseColumn: never;
+                identity: undefined;
+                generated: undefined;
+            }, {}, {}>;
+        };
+        dialect: "pg";
+    }>;
 };

package/dist/tables.js

@@ -176,6 +176,17 @@ export const reportingErrors = pgTable('reporting_errors', {
         .where(sql `${t.state} = 'open'`),
     index('reporting_errors_state_idx').on(t.state, t.lastSeenAt.desc()),
 ]);
+/** One row per (fingerprint, tenant): that tenant's own occurrences of a shared error group; mirrored from migrations/0008_error_tenants.sql. */
+export const reportingErrorTenants = pgTable('reporting_error_tenants', {
+    fingerprint: text('fingerprint').notNull(),
+    tenantId: uuid('tenant_id').notNull(),
+    occurrences: bigint('occurrences', { mode: 'number' }).notNull().default(1),
+    firstSeenAt: timestamp('first_seen_at', { withTimezone: true }).notNull(),
+    lastSeenAt: timestamp('last_seen_at', { withTimezone: true }).notNull(),
+}, (t) => [
+    primaryKey({ name: 'reporting_error_tenants_pkey', columns: [t.fingerprint, t.tenantId] }),
+    index('reporting_error_tenants_tenant_idx').on(t.tenantId, t.lastSeenAt.desc()),
+]);
 export const tables = {
     events: reportingEvents,
     tasks: reportingTasks,
@@ -185,4 +196,5 @@ export const tables = {
     analyticsDaily: reportingAnalyticsDaily,
     analyticsWeekly: reportingAnalyticsWeekly,
     errors: reportingErrors,
+    errorTenants: reportingErrorTenants,
 };

package/dist/types.d.ts

@@ -3,7 +3,7 @@ import type { RecentEvent, RecentOptions, SeriesOptions, SeriesPoint, WeeklyPoin
 import type { Device } from './analytics/schema.js';
 import type { Actor, ErrorRuntime, ErrorState, EventInput, FlatData, Level } from './schema.js';
 import type { TenantRetentionKey } from './settings.js';
-import type { ReportingErrorRow, ReportingEventRow, tables } from './tables.js';
+import type { ReportingErrorRow, ReportingEventRow, TenantErrorRow, tables } from './tables.js';
 /**
  * The host's drizzle handle, whatever driver it runs on. postgres-js in the
  * apps, PGlite in this package's own tests; the queries here use nothing
@@ -111,12 +111,14 @@ export interface ErrorsPageOptions {
     readonly site?: string;
     readonly state?: ErrorState;
     readonly runtime?: ErrorRuntime;
-    /** A case-insensitive substring match against `message` or `stack`, for triaging an incident by grepping the group list. Capped at 200 characters. */
+    /** A case-insensitive substring match against `message` or `stack`, for triaging an incident by grepping the group list. Capped at 200 characters. With `tenantId`, it matches `kind` only: the shared message and stack are not the tenant's to search. */
     readonly search?: string;
     readonly environment?: string;
+    /** Only groups this tenant hit, as `TenantErrorRow`s: `occurrences`, `firstSeenAt`, `lastSeenAt` and `tenantId` come from the tenant's own record (migration 0008), and `message`, `stack`, `runtime`, `release`, `requestId`, `resolvedBy`, `state` and `resolvedAt` are null, because the shared group holds them from whichever tenant hit it last. `state` is ignored as a filter in tenant scope. Scope is decided by presence: an absent key is unscoped, any present value, `undefined` included, must be a uuid or the call throws. */
+    readonly tenantId?: string;
 }
-export interface ErrorsPage {
-    readonly items: readonly ReportingErrorRow[];
+export interface ErrorsPage<Row = ReportingErrorRow | TenantErrorRow> {
+    readonly items: readonly Row[];
     readonly next: {
         readonly lastSeenAt: Date;
         readonly fingerprint: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wtfalch/reporting",
-  "version": "0.5.0",
+  "version": "0.7.0",
   "description": "The estate's operational event log and housekeeping tick: a writer that never fails a request, a claim protocol that needs no scheduler, and the readers an operator opens. Per-app Postgres, host-supplied logger, framework-neutral core with a Next entry.",
   "repository": {
     "type": "git",
@@ -46,6 +46,10 @@
       "types": "./dist/react/errors.d.ts",
       "default": "./dist/react/errors.js"
     },
+    "./migrations-dir": {
+      "types": "./dist/migrations-dir.d.ts",
+      "default": "./dist/migrations-dir.js"
+    },
     "./migrations/*.sql": "./dist/migrations/*.sql",
     "./package.json": "./package.json"
   },
@@ -63,7 +67,7 @@
     "test": "vitest run"
   },
   "peerDependencies": {
-    "drizzle-orm": ">=0.39.0",
+    "drizzle-orm": ">=0.39.3 <1.0.0",
     "next": ">=16.0.0",
     "react": ">=19.0.0",
     "zod": "^4.0.0"
@@ -77,9 +81,9 @@
     "@electric-sql/pglite": "^0.5.8",
     "@types/node": "^22",
     "@types/react": "^19",
-    "drizzle-orm": "^0.39.3",
+    "@wtfalch/db": "0.5.2",
+    "drizzle-orm": "0.39.3",
     "next": "^16.2.4",
-    "postgres": "^3.4.5",
     "react": "^19",
     "react-dom": "^19",
     "typescript": "^5.9.0",