nuxt-observe 0.0.2

package/dist/runtime/server/api/observe/auth/logout.post.js

@@ -0,0 +1,6 @@
+import { defineEventHandler } from "h3";
+import { clearUserSession } from "#imports";
+export default defineEventHandler(async (event) => {
+  await clearUserSession(event);
+  return { ok: true };
+});

package/dist/runtime/server/api/observe/auth/me.get.d.ts

@@ -0,0 +1,2 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<import("../../../../shared/auth/types.js").Principal>>;
+export default _default;

package/dist/runtime/server/api/observe/auth/me.get.js

@@ -0,0 +1,3 @@
+import { defineEventHandler } from "h3";
+import { requireObserveSession } from "../../../utils/require-observe-session.js";
+export default defineEventHandler((event) => requireObserveSession(event));

package/dist/runtime/server/api/observe/errors/[fingerprint].get.d.ts

@@ -0,0 +1,3 @@
+import { type ErrorGroupDetailResponse } from '../../../../shared/schema/errors-query.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<ErrorGroupDetailResponse>>;
+export default _default;

package/dist/runtime/server/api/observe/errors/[fingerprint].get.js

@@ -0,0 +1,56 @@
+import { defineEventHandler, getValidatedQuery, getValidatedRouterParams, createError, H3Error } from "h3";
+import { z } from "zod";
+import { useRuntimeConfig } from "#imports";
+import {
+  errorDetailQuerySchema,
+  DEFAULT_REGRESSION_THRESHOLDS
+} from "../../../../shared/schema/errors-query.js";
+import { periodToRange } from "../../../../shared/utils/period.js";
+import { DEFAULT_BUCKET_MS, MAX_BUCKETS } from "../../../utils/stats-query.js";
+import { requireCapability, getAllowedServiceIds } from "../../../utils/authz.js";
+import { resolveEffectiveScope } from "../../../utils/scope.js";
+import { getErrorGroup } from "../../../utils/observe-errors.js";
+const paramsSchema = z.object({ fingerprint: z.string().regex(/^v\d+:[0-9a-f]{16}$/) });
+export default defineEventHandler(async (event) => {
+  const { principal } = await requireCapability(event, "logs.read");
+  const { fingerprint } = await getValidatedRouterParams(event, paramsSchema.parse);
+  const query = await getValidatedQuery(event, errorDetailQuerySchema.parse);
+  const allowed = await getAllowedServiceIds(event, principal);
+  const effective = await resolveEffectiveScope(event, principal, allowed, {
+    service: query.service,
+    group: query.group
+  });
+  const { from, to, label } = periodToRange(query.period);
+  const bucketMs = query.bucketMs ?? DEFAULT_BUCKET_MS[query.period];
+  if ((to - from) / bucketMs > MAX_BUCKETS) {
+    throw createError({ statusCode: 400, statusMessage: "bucketMs too small for window" });
+  }
+  if (effective !== "*" && effective.length === 0) {
+    throw createError({ statusCode: 404, statusMessage: "Not Found", data: { error: "UNKNOWN_ERROR", fingerprint } });
+  }
+  const thresholds = useRuntimeConfig(event).observe.errors ?? DEFAULT_REGRESSION_THRESHOLDS;
+  let detail;
+  try {
+    detail = await getErrorGroup(fingerprint, {
+      from,
+      to,
+      bucketMs,
+      limit: query.limit,
+      offset: query.offset,
+      thresholds,
+      now: Date.now()
+    }, effective);
+  } catch (e) {
+    if (e instanceof H3Error) throw e;
+    throw createError({ statusCode: 500, statusMessage: "Error group query failed" });
+  }
+  if (!detail) {
+    throw createError({ statusCode: 404, statusMessage: "Not Found", data: { error: "UNKNOWN_ERROR", fingerprint } });
+  }
+  return {
+    period: { from, to, label },
+    ...detail,
+    limit: query.limit,
+    offset: query.offset
+  };
+});

package/dist/runtime/server/api/observe/errors/index.get.d.ts

@@ -0,0 +1,3 @@
+import { type ErrorGroupsResponse } from '../../../../shared/schema/errors-query.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<ErrorGroupsResponse>>;
+export default _default;

package/dist/runtime/server/api/observe/errors/index.get.js

@@ -0,0 +1,41 @@
+import { defineEventHandler, getValidatedQuery, createError, H3Error } from "h3";
+import { useRuntimeConfig } from "#imports";
+import {
+  errorsQuerySchema,
+  DEFAULT_REGRESSION_THRESHOLDS
+} from "../../../../shared/schema/errors-query.js";
+import { periodToRange } from "../../../../shared/utils/period.js";
+import { requireCapability, getAllowedServiceIds } from "../../../utils/authz.js";
+import { resolveEffectiveScope } from "../../../utils/scope.js";
+import { listErrorGroups } from "../../../utils/observe-errors.js";
+export default defineEventHandler(async (event) => {
+  const { principal } = await requireCapability(event, "logs.read");
+  const query = await getValidatedQuery(event, errorsQuerySchema.parse);
+  const allowed = await getAllowedServiceIds(event, principal);
+  const effective = await resolveEffectiveScope(event, principal, allowed, {
+    service: query.service,
+    group: query.group
+  });
+  const { from, to, label } = periodToRange(query.period);
+  const period = { from, to, label };
+  if (effective !== "*" && effective.length === 0) {
+    return { period, groups: [], total: 0, limit: query.limit, offset: query.offset };
+  }
+  const thresholds = useRuntimeConfig(event).observe.errors ?? DEFAULT_REGRESSION_THRESHOLDS;
+  try {
+    const { groups, total } = await listErrorGroups({
+      from,
+      to,
+      limit: query.limit,
+      offset: query.offset,
+      sort: query.sort,
+      filters: { app: query.app, version: query.version, env: query.env, level: query.level, q: query.q },
+      thresholds,
+      now: Date.now()
+    }, effective);
+    return { period, groups, total, limit: query.limit, offset: query.offset };
+  } catch (e) {
+    if (e instanceof H3Error) throw e;
+    throw createError({ statusCode: 500, statusMessage: "Errors query failed" });
+  }
+});

package/dist/runtime/server/api/observe/facets.get.d.ts

@@ -0,0 +1,8 @@
+import { type LogsFacetsResponse } from '../../../shared/schema/logs-query.js';
+/**
+ * Distinct versions for the filter bar's version dropdown, scoped to the caller and
+ * narrowed by ?service/?group so it tracks the navbar switcher. Services/groups facets
+ * are deliberately NOT returned - the switcher already owns that surface (Fact 4).
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<LogsFacetsResponse>>;
+export default _default;

package/dist/runtime/server/api/observe/facets.get.js

@@ -0,0 +1,12 @@
+import { defineEventHandler, getValidatedQuery } from "h3";
+import { logsFacetsQuerySchema } from "../../../shared/schema/logs-query.js";
+import { requireCapability, getAllowedServiceIds } from "../../utils/authz.js";
+import { resolveEffectiveScope } from "../../utils/scope.js";
+import { queryDistinctVersions } from "../../utils/logs.js";
+export default defineEventHandler(async (event) => {
+  const { principal } = await requireCapability(event, "logs.read");
+  const { service, group } = await getValidatedQuery(event, logsFacetsQuerySchema.parse);
+  const allowed = await getAllowedServiceIds(event, principal);
+  const effective = await resolveEffectiveScope(event, principal, allowed, { service, group });
+  return { versions: await queryDistinctVersions(effective) };
+});

package/dist/runtime/server/api/observe/groups/[id]/assignments.put.d.ts

@@ -0,0 +1,3 @@
+/** Phase 1: group assignments are config-managed (observe.auth.users). See §11 R1. */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<never>>;
+export default _default;

package/dist/runtime/server/api/observe/groups/[id]/assignments.put.js

@@ -0,0 +1,12 @@
+import { defineEventHandler, getValidatedRouterParams, createError } from "h3";
+import { groupIdParams } from "../../../../../shared/schema/provisioning.js";
+import { requireCapability } from "../../../../utils/authz.js";
+export default defineEventHandler(async (event) => {
+  await requireCapability(event, "users.manage");
+  await getValidatedRouterParams(event, groupIdParams.parse);
+  throw createError({
+    statusCode: 501,
+    statusMessage: "Not Implemented",
+    data: { error: "ASSIGNMENTS_MANAGED_IN_CONFIG", hint: "Edit observe.auth.users; runtime assignment lands in CP16." }
+  });
+});

package/dist/runtime/server/api/observe/groups/[id]/services.put.d.ts

@@ -0,0 +1,5 @@
+/** Reconcile a group's membership to exactly the given service ids (direct group_id FK). */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    ok: true;
+}>>;
+export default _default;

package/dist/runtime/server/api/observe/groups/[id]/services.put.js

@@ -0,0 +1,13 @@
+import { defineEventHandler, getValidatedRouterParams, readValidatedBody, createError } from "h3";
+import { groupIdParams, groupMembershipSchema } from "../../../../../shared/schema/provisioning.js";
+import { requireCapability } from "../../../../utils/authz.js";
+import { getGroupDetail, setGroupMembership } from "../../../../utils/provisioning.js";
+export default defineEventHandler(async (event) => {
+  await requireCapability(event, "groups.manage");
+  const { id } = await getValidatedRouterParams(event, groupIdParams.parse);
+  const existing = await getGroupDetail(id);
+  if (!existing) throw createError({ statusCode: 404, statusMessage: "Group not found" });
+  const { serviceIds } = await readValidatedBody(event, groupMembershipSchema.parse);
+  await setGroupMembership(id, serviceIds);
+  return { ok: true };
+});

package/dist/runtime/server/api/observe/groups/[id].delete.d.ts

@@ -0,0 +1,5 @@
+/** Deletes the group and detaches its member services (group_id = NULL). Admin-only. */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    ok: true;
+}>>;
+export default _default;

package/dist/runtime/server/api/observe/groups/[id].delete.js

@@ -0,0 +1,11 @@
+import { defineEventHandler, getValidatedRouterParams, createError } from "h3";
+import { groupIdParams } from "../../../../shared/schema/provisioning.js";
+import { requireCapability } from "../../../utils/authz.js";
+import { deleteGroupById } from "../../../utils/provisioning.js";
+export default defineEventHandler(async (event) => {
+  await requireCapability(event, "groups.manage");
+  const { id } = await getValidatedRouterParams(event, groupIdParams.parse);
+  const ok = await deleteGroupById(id);
+  if (!ok) throw createError({ statusCode: 404, statusMessage: "Group not found" });
+  return { ok: true };
+});

package/dist/runtime/server/api/observe/groups/[id].get.d.ts

@@ -0,0 +1,6 @@
+import type { GroupListItem, ServiceListItem } from '../../../../shared/schema/provisioning.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    group: GroupListItem;
+    services: ServiceListItem[];
+}>>;
+export default _default;

package/dist/runtime/server/api/observe/groups/[id].get.js

@@ -0,0 +1,14 @@
+import { defineEventHandler, getValidatedRouterParams, createError } from "h3";
+import { groupIdParams } from "../../../../shared/schema/provisioning.js";
+import { requireCapability } from "../../../utils/authz.js";
+import { getGroupDetail } from "../../../utils/provisioning.js";
+export default defineEventHandler(async (event) => {
+  await requireCapability(event, "services.read");
+  const { id } = await getValidatedRouterParams(event, groupIdParams.parse);
+  const detail = await getGroupDetail(id);
+  if (!detail) throw createError({ statusCode: 404, statusMessage: "Group not found" });
+  return {
+    group: { id: detail.group.id, slug: detail.group.slug, name: detail.group.name, serviceCount: detail.services.length },
+    services: detail.services
+  };
+});

package/dist/runtime/server/api/observe/groups/[id].patch.d.ts

@@ -0,0 +1,3 @@
+import type { GroupListItem } from '../../../../shared/schema/provisioning.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<GroupListItem>>;
+export default _default;

package/dist/runtime/server/api/observe/groups/[id].patch.js

@@ -0,0 +1,12 @@
+import { defineEventHandler, getValidatedRouterParams, readValidatedBody, createError } from "h3";
+import { groupIdParams, groupUpdateSchema } from "../../../../shared/schema/provisioning.js";
+import { requireCapability } from "../../../utils/authz.js";
+import { updateGroupById } from "../../../utils/provisioning.js";
+export default defineEventHandler(async (event) => {
+  await requireCapability(event, "groups.manage");
+  const { id } = await getValidatedRouterParams(event, groupIdParams.parse);
+  const { name } = await readValidatedBody(event, groupUpdateSchema.parse);
+  const group = await updateGroupById(id, name);
+  if (!group) throw createError({ statusCode: 404, statusMessage: "Group not found" });
+  return { id: group.id, slug: group.slug, name: group.name, serviceCount: 0 };
+});

package/dist/runtime/server/api/observe/groups/index.get.d.ts

@@ -0,0 +1,3 @@
+import type { GroupListItem } from '../../../../shared/schema/provisioning.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<GroupListItem[]>>;
+export default _default;

package/dist/runtime/server/api/observe/groups/index.get.js

@@ -0,0 +1,7 @@
+import { defineEventHandler } from "h3";
+import { requireCapability } from "../../../utils/authz.js";
+import { listGroupsForPrincipal } from "../../../utils/provisioning.js";
+export default defineEventHandler(async (event) => {
+  const { principal } = await requireCapability(event, "services.read");
+  return await listGroupsForPrincipal(event, principal);
+});

package/dist/runtime/server/api/observe/groups/index.post.d.ts

@@ -0,0 +1,3 @@
+import type { GroupListItem } from '../../../../shared/schema/provisioning.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<GroupListItem>>;
+export default _default;

package/dist/runtime/server/api/observe/groups/index.post.js

@@ -0,0 +1,11 @@
+import { defineEventHandler, readValidatedBody, createError } from "h3";
+import { groupCreateSchema } from "../../../../shared/schema/provisioning.js";
+import { requireCapability } from "../../../utils/authz.js";
+import { createGroupFromInput } from "../../../utils/provisioning.js";
+export default defineEventHandler(async (event) => {
+  await requireCapability(event, "groups.manage");
+  const { name } = await readValidatedBody(event, groupCreateSchema.parse);
+  const result = await createGroupFromInput(name);
+  if (!result.ok) throw createError({ statusCode: 409, statusMessage: "Group slug already exists" });
+  return { id: result.group.id, slug: result.group.slug, name: result.group.name, serviceCount: 0 };
+});

package/dist/runtime/server/api/observe/health.get.d.ts

@@ -0,0 +1,6 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, {
+    ok: true;
+    module: string;
+    version: any;
+}>;
+export default _default;

package/dist/runtime/server/api/observe/health.get.js

@@ -0,0 +1,10 @@
+import { defineEventHandler } from "h3";
+import { useRuntimeConfig } from "#imports";
+export default defineEventHandler((event) => {
+  const { observe } = useRuntimeConfig(event);
+  return {
+    ok: true,
+    module: "nuxt-observe",
+    version: observe.version
+  };
+});

package/dist/runtime/server/api/observe/ingest/frogger.d.ts

@@ -0,0 +1,5 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    ok: true;
+    inserted: number;
+} | undefined>>;
+export default _default;

package/dist/runtime/server/api/observe/ingest/frogger.js

@@ -0,0 +1,42 @@
+import { defineEventHandler, getMethod, getHeader, getQuery, readValidatedBody, createError, setResponseStatus, H3Error } from "h3";
+import { useRuntimeConfig } from "nitropack/runtime";
+import { zFroggerBatch } from "../../../../shared/schema/adapters/frogger.js";
+import { MAX_BATCH_EVENTS } from "../../../../shared/schema/batch.js";
+import { getApiKeyFromEvent, resolveServiceIdByKey } from "../../../utils/api-keys.js";
+import { resolveServiceCorsMeta } from "../../../utils/services.js";
+import { froggerBatchToEvents } from "../../../utils/frogger-adapter.js";
+import { insertEvents } from "../../../utils/logs.js";
+import { handleCorsForIngest } from "../../../utils/ingest-cors.js";
+import { checkIngestRateLimit } from "../../../utils/rate-limit.js";
+import { checkIngestLoop } from "../../../utils/loop-guard.js";
+const DEFAULT_MAX_BYTES = 1048576;
+export default defineEventHandler(async (event) => {
+  const corsMeta = await resolveServiceCorsMeta(getQuery(event).key);
+  if (handleCorsForIngest(event, corsMeta)) return;
+  if (getMethod(event) !== "POST") throw createError({ statusCode: 405, statusMessage: "Method Not Allowed" });
+  const maxBytes = useRuntimeConfig().observe?.ingest?.maxBytes ?? DEFAULT_MAX_BYTES;
+  const len = getHeader(event, "content-length");
+  if (len && Number.parseInt(len) > maxBytes) throw createError({ statusCode: 413, statusMessage: "Request Too Large" });
+  const key = getApiKeyFromEvent(event);
+  if (!key) throw createError({ statusCode: 401, statusMessage: "Missing ingest key" });
+  const serviceId = await resolveServiceIdByKey(key);
+  if (!serviceId) throw createError({ statusCode: 401, statusMessage: "Invalid ingest key" });
+  if (!checkIngestRateLimit(serviceId)) throw createError({ statusCode: 429, statusMessage: "Rate limited" });
+  const batch = await readValidatedBody(event, zFroggerBatch.parse);
+  const loop = checkIngestLoop(event, batch.meta);
+  if (loop.reject) throw createError({ statusCode: 400, statusMessage: loop.reason });
+  const events = froggerBatchToEvents(batch);
+  if (events.length > MAX_BATCH_EVENTS) throw createError({ statusCode: 413, statusMessage: "Batch too large" });
+  if (!events.length) {
+    setResponseStatus(event, 202);
+    return { ok: true, inserted: 0 };
+  }
+  try {
+    const { inserted } = await insertEvents(events, { serviceId });
+    setResponseStatus(event, 202);
+    return { ok: true, inserted };
+  } catch (e) {
+    if (e instanceof H3Error) throw e;
+    throw createError({ statusCode: 500, statusMessage: "Insert failed" });
+  }
+});

package/dist/runtime/server/api/observe/ingest.d.ts

@@ -0,0 +1,5 @@
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<{
+    ok: true;
+    inserted: number;
+} | undefined>>;
+export default _default;

package/dist/runtime/server/api/observe/ingest.js

@@ -0,0 +1,38 @@
+import { defineEventHandler, getMethod, getHeader, getQuery, readValidatedBody, createError, setResponseStatus, H3Error } from "h3";
+import { useRuntimeConfig } from "nitropack/runtime";
+import { zCanonicalBatch } from "../../../shared/schema/batch.js";
+import { getApiKeyFromEvent, resolveServiceIdByKey } from "../../utils/api-keys.js";
+import { resolveServiceCorsMeta } from "../../utils/services.js";
+import { insertEvents } from "../../utils/logs.js";
+import { handleCorsForIngest } from "../../utils/ingest-cors.js";
+import { checkIngestRateLimit } from "../../utils/rate-limit.js";
+import { checkIngestLoop } from "../../utils/loop-guard.js";
+const DEFAULT_MAX_BYTES = 1048576;
+export default defineEventHandler(async (event) => {
+  const corsMeta = await resolveServiceCorsMeta(getQuery(event).key);
+  if (handleCorsForIngest(event, corsMeta)) return;
+  if (getMethod(event) !== "POST") throw createError({ statusCode: 405, statusMessage: "Method Not Allowed" });
+  const maxBytes = useRuntimeConfig().observe?.ingest?.maxBytes ?? DEFAULT_MAX_BYTES;
+  const len = getHeader(event, "content-length");
+  if (len && Number.parseInt(len) > maxBytes) throw createError({ statusCode: 413, statusMessage: "Request Too Large" });
+  const key = getApiKeyFromEvent(event);
+  if (!key) throw createError({ statusCode: 401, statusMessage: "Missing ingest key" });
+  const serviceId = await resolveServiceIdByKey(key);
+  if (!serviceId) throw createError({ statusCode: 401, statusMessage: "Invalid ingest key" });
+  if (!checkIngestRateLimit(serviceId)) throw createError({ statusCode: 429, statusMessage: "Rate limited" });
+  const batch = await readValidatedBody(event, zCanonicalBatch.parse);
+  const loop = checkIngestLoop(event, batch.meta);
+  if (loop.reject) throw createError({ statusCode: 400, statusMessage: loop.reason });
+  if (!batch.events.length) {
+    setResponseStatus(event, 202);
+    return { ok: true, inserted: 0 };
+  }
+  try {
+    const { inserted } = await insertEvents(batch.events, { serviceId });
+    setResponseStatus(event, 202);
+    return { ok: true, inserted };
+  } catch (e) {
+    if (e instanceof H3Error) throw e;
+    throw createError({ statusCode: 500, statusMessage: "Insert failed" });
+  }
+});

package/dist/runtime/server/api/observe/journey.get.d.ts

@@ -0,0 +1,9 @@
+import { type JourneyResponse } from '../../../shared/schema/journey.js';
+/**
+ * GET /api/observe/journey (CP12): a read-only, cross-service correlation timeline
+ * keyed by exactly one of traceId | session | user. Reuses the logs.read capability
+ * and CP6 service scoping. Empty match is a 200 with a partial reason, never a 404 -
+ * 4xx is for malformed input, not empty results.
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<JourneyResponse>>;
+export default _default;

package/dist/runtime/server/api/observe/journey.get.js

@@ -0,0 +1,31 @@
+import { defineEventHandler, getValidatedQuery, createError, H3Error } from "h3";
+import {
+  journeyQuerySchema,
+  journeyMode,
+  detectPartial,
+  computeJourneyStats
+} from "../../../shared/schema/journey.js";
+import { requireCapability, getAllowedServiceIds } from "../../utils/authz.js";
+import { getJourney } from "../../utils/journey.js";
+export default defineEventHandler(async (event) => {
+  const { principal } = await requireCapability(event, "logs.read");
+  const query = await getValidatedQuery(event, journeyQuerySchema.parse);
+  const { mode, key } = journeyMode(query);
+  const allowed = await getAllowedServiceIds(event, principal);
+  if (allowed !== "*" && allowed.length === 0) {
+    return { mode, key, partial: true, reasons: ["empty"], stats: computeJourneyStats([]), events: [] };
+  }
+  try {
+    const events = await getJourney(mode, key, {
+      from: query.from,
+      to: query.to,
+      limit: query.limit,
+      serviceIds: allowed
+    });
+    const { partial, reasons } = detectPartial(events, events.length === query.limit);
+    return { mode, key, partial, reasons, stats: computeJourneyStats(events), events };
+  } catch (e) {
+    if (e instanceof H3Error) throw e;
+    throw createError({ statusCode: 500, statusMessage: "Journey query failed" });
+  }
+});

package/dist/runtime/server/api/observe/logs/[id].get.d.ts

@@ -0,0 +1,3 @@
+import { type LogDetail } from '../../../../shared/schema/logs-query.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<LogDetail>>;
+export default _default;

package/dist/runtime/server/api/observe/logs/[id].get.js

@@ -0,0 +1,19 @@
+import { defineEventHandler, getValidatedRouterParams, createError } from "h3";
+import { z } from "zod";
+import { rowToDetail } from "../../../../shared/schema/logs-query.js";
+import { requireCapability, getAllowedServiceIds } from "../../../utils/authz.js";
+import { getLogById } from "../../../utils/logs.js";
+const paramsSchema = z.object({ id: z.string().min(1).max(64) });
+export default defineEventHandler(async (event) => {
+  const { principal } = await requireCapability(event, "logs.read");
+  const { id } = await getValidatedRouterParams(event, paramsSchema.parse);
+  const row = await getLogById(id);
+  if (!row) {
+    throw createError({ statusCode: 404, statusMessage: "Not Found", data: { error: "UNKNOWN_LOG", id } });
+  }
+  const allowed = await getAllowedServiceIds(event, principal);
+  if (allowed !== "*" && (!row.service_id || !allowed.includes(row.service_id))) {
+    throw createError({ statusCode: 403, statusMessage: "Forbidden", data: { error: "OUT_OF_SCOPE", id } });
+  }
+  return rowToDetail(row);
+});

package/dist/runtime/server/api/observe/logs.get.d.ts

@@ -0,0 +1,3 @@
+import { type LogListResponse } from '../../../shared/schema/logs-query.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<LogListResponse>>;
+export default _default;

package/dist/runtime/server/api/observe/logs.get.js

@@ -0,0 +1,54 @@
+import { defineEventHandler, getValidatedQuery, createError, H3Error } from "h3";
+import { logsQuerySchema } from "../../../shared/schema/logs-query.js";
+import { periodToRange } from "../../../shared/utils/period.js";
+import { requireCapability, getAllowedServiceIds } from "../../utils/authz.js";
+import { resolveEffectiveScope } from "../../utils/scope.js";
+import { queryLogs, countLogs } from "../../utils/logs.js";
+function toListItem(row) {
+  return {
+    id: row.id,
+    time: row.time,
+    level: row.level,
+    message: row.message,
+    app: row.app,
+    version: row.version ?? null,
+    env: row.env ?? null,
+    service_id: row.service_id ?? null,
+    route: row.route ?? null,
+    feature: row.feature ?? null,
+    error_name: row.error_name ?? null,
+    trace_id: row.trace_id ?? null
+  };
+}
+export default defineEventHandler(async (event) => {
+  const { principal } = await requireCapability(event, "logs.read");
+  const query = await getValidatedQuery(event, logsQuerySchema.parse);
+  const allowed = await getAllowedServiceIds(event, principal);
+  const effective = await resolveEffectiveScope(event, principal, allowed, {
+    service: query.service,
+    group: query.group
+  });
+  const { from, to, label } = periodToRange(query.period);
+  const period = { from, to, label };
+  if (effective !== "*" && effective.length === 0) {
+    return { period, rows: [], total: 0, limit: query.limit, offset: query.offset };
+  }
+  const filter = {
+    ...query.traceId ? { traceId: query.traceId } : { from, to },
+    levels: query.levels,
+    versions: query.versions,
+    ...query.route ? { route: query.route } : {},
+    ...query.feature ? { feature: query.feature } : {},
+    q: query.q,
+    serviceIds: effective,
+    limit: query.limit,
+    offset: query.offset
+  };
+  try {
+    const [rows, total] = await Promise.all([queryLogs(filter), countLogs(filter)]);
+    return { period, rows: rows.map(toListItem), total, limit: query.limit, offset: query.offset };
+  } catch (e) {
+    if (e instanceof H3Error) throw e;
+    throw createError({ statusCode: 500, statusMessage: "Logs query failed" });
+  }
+});

package/dist/runtime/server/api/observe/migrations/index.get.d.ts

@@ -0,0 +1,9 @@
+import type { MigrationStatusResponse } from '../../../../shared/schema/migrations.js';
+/**
+ * Migration status for the admin console + the dashboard banner. Admin-only
+ * (migrations.manage). Global action, not service-scoped, so no serviceScopeFilter.
+ * `pendingDestructive` drives the banner; a blocked destructive still needs attention,
+ * so it counts too.
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<MigrationStatusResponse>>;
+export default _default;

package/dist/runtime/server/api/observe/migrations/index.get.js

@@ -0,0 +1,14 @@
+import { defineEventHandler } from "h3";
+import { requireCapability } from "../../../utils/authz.js";
+import { useObserveDb } from "../../../utils/db.js";
+import { getMigrationStatus } from "../../../utils/migration-runner.js";
+export default defineEventHandler(async (event) => {
+  await requireCapability(event, "migrations.manage");
+  const db = useObserveDb();
+  const statuses = await getMigrationStatus(db);
+  const pendingDestructive = statuses.filter(
+    (s) => s.class === "destructive" && s.state !== "applied"
+  ).length;
+  const driftWarnings = statuses.filter((s) => s.driftWarning).map((s) => s.id);
+  return { statuses, pendingDestructive, driftWarnings };
+});

package/dist/runtime/server/api/observe/migrations/run.post.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Runs pending migrations and streams progress as SSE frames. Deliberately POST + an h3
+ * event stream (NOT a GET EventSource): EventSource auto-reconnects, and a reconnect on a
+ * one-shot mutation could re-trigger the run. The client reads `response.body` as a stream
+ * (fetch + TextDecoder), so the wire format is SSE (`data: {json}\n\n`) without EventSource.
+ *
+ * Body: `{ ids?: string[] }` — omit to run all pending, one id for "run next". Frames:
+ *   { type: 'log', line }              per runner output line (start/ok/fail/backup)
+ *   { type: 'complete', applied, failedAt? }   terminal success/summary
+ *   { type: 'error', message }         terminal failure (unexpected throw)
+ */
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<void>>;
+export default _default;

package/dist/runtime/server/api/observe/migrations/run.post.js

@@ -0,0 +1,35 @@
+import { defineEventHandler, readBody, createEventStream } from "h3";
+import { useRuntimeConfig } from "#imports";
+import { requireCapability } from "../../../utils/authz.js";
+import { useObserveDb } from "../../../utils/db.js";
+import { runPendingMigrations } from "../../../utils/migration-runner.js";
+export default defineEventHandler(async (event) => {
+  await requireCapability(event, "migrations.manage");
+  const body = await readBody(event).catch(() => ({}));
+  const ids = Array.isArray(body?.ids) ? body.ids : void 0;
+  const db = useObserveDb();
+  const dbPath = useRuntimeConfig(event).observe.database.path;
+  const stream = createEventStream(event);
+  let chain = Promise.resolve();
+  const send = (payload) => {
+    chain = chain.then(() => stream.push({ data: JSON.stringify(payload) }));
+    return chain;
+  };
+  void (async () => {
+    try {
+      const result = await runPendingMigrations(db, {
+        mode: "admin",
+        ids,
+        dbPath,
+        log: (line) => void send({ type: "log", line })
+      });
+      await send({ type: "complete", applied: result.applied, failedAt: result.failedAt });
+    } catch (e) {
+      const message = e instanceof Error ? e.message : String(e);
+      await send({ type: "error", message });
+    } finally {
+      await stream.close();
+    }
+  })();
+  return stream.send();
+});

package/dist/runtime/server/api/observe/overview.get.d.ts

@@ -0,0 +1,3 @@
+import { type OverviewResponse } from '../../../shared/schema/overview.js';
+declare const _default: import("h3").EventHandler<import("h3").EventHandlerRequest, Promise<OverviewResponse>>;
+export default _default;