nuxt-observe 0.0.2

package/dist/runtime/server/utils/api-keys.d.ts

@@ -0,0 +1,48 @@
+import { type H3Event } from 'h3';
+import { type Database } from './db.js';
+interface DbOpts {
+    db?: Database;
+}
+export declare function hashApiKey(raw: string): string;
+/**
+ * Mint a new ingest key for a service. The raw key is returned exactly ONCE;
+ * only its sha256 hash + a short prefix (for UI identification) are persisted.
+ */
+export declare function mintApiKey(serviceId: string, label?: string, opts?: DbOpts): Promise<{
+    id: string;
+    raw: string;
+    prefix: string;
+}>;
+/**
+ * Frogger's client transport sends no auth header by default (bare $fetch), so
+ * the `?key=` query path is mandatory; `x-api-key` is the alternative for BYO sources.
+ */
+export declare function getApiKeyFromEvent(event: H3Event): string | null;
+/**
+ * Resolve a raw key to its service id. Single indexed key_hash lookup with a
+ * revoked filter; preimage resistance replaces a constant-time compare. Bumps
+ * last_used_at best-effort. Returns null for an unknown or revoked key.
+ */
+export declare function resolveServiceIdByKey(raw: string, opts?: DbOpts): Promise<string | null>;
+export declare function revokeApiKey(id: string, opts?: DbOpts): Promise<void>;
+/**
+ * Atomic key rotation: revoke `oldKeyId` and mint a fresh key for the same service
+ * in one transaction, so a client is never left with two live keys or none. The new
+ * raw key is returned exactly ONCE (same contract as mintApiKey). The mint SQL is
+ * inlined rather than calling mintApiKey so it shares the single BEGIN.
+ */
+export declare function rotateApiKey(oldKeyId: string, serviceId: string, label?: string, opts?: DbOpts): Promise<{
+    id: string;
+    raw: string;
+    prefix: string;
+}>;
+/** Lists a service's keys WITHOUT ever exposing key_hash or the raw key. */
+export declare function listApiKeys(serviceId: string, opts?: DbOpts): Promise<Array<{
+    id: string;
+    key_prefix: string;
+    label: string | null;
+    created_at: number;
+    revoked_at: number | null;
+    last_used_at: number | null;
+}>>;
+export {};

package/dist/runtime/server/utils/api-keys.js

@@ -0,0 +1,67 @@
+import { createHash, randomBytes } from "node:crypto";
+import { getQuery, getHeader } from "h3";
+import { uuidv7 } from "../../shared/utils/uuid.js";
+import { useObserveDb } from "./db.js";
+const KEY_PREFIX = "obsk_";
+export function hashApiKey(raw) {
+  return createHash("sha256").update(raw).digest("hex");
+}
+export async function mintApiKey(serviceId, label, opts = {}) {
+  const db = opts.db ?? useObserveDb();
+  const raw = KEY_PREFIX + randomBytes(32).toString("base64url");
+  const prefix = raw.slice(0, KEY_PREFIX.length + 6);
+  const id = uuidv7();
+  await db.sql`
+    INSERT INTO api_keys (id, service_id, key_hash, key_prefix, label, created_at)
+    VALUES (${id}, ${serviceId}, ${hashApiKey(raw)}, ${prefix}, ${label ?? null}, ${Date.now()})
+  `;
+  return { id, raw, prefix };
+}
+export function getApiKeyFromEvent(event) {
+  const fromQuery = getQuery(event).key;
+  if (typeof fromQuery === "string" && fromQuery.length > 0) return fromQuery;
+  const fromHeader = getHeader(event, "x-api-key");
+  return fromHeader && fromHeader.length > 0 ? fromHeader : null;
+}
+export async function resolveServiceIdByKey(raw, opts = {}) {
+  const db = opts.db ?? useObserveDb();
+  const row = await db.prepare(
+    "SELECT id, service_id FROM api_keys WHERE key_hash = ? AND revoked_at IS NULL"
+  ).get(hashApiKey(raw));
+  if (!row) return null;
+  try {
+    await db.sql`UPDATE api_keys SET last_used_at = ${Date.now()} WHERE id = ${row.id}`;
+  } catch {
+  }
+  return row.service_id;
+}
+export async function revokeApiKey(id, opts = {}) {
+  const db = opts.db ?? useObserveDb();
+  await db.sql`UPDATE api_keys SET revoked_at = ${Date.now()} WHERE id = ${id}`;
+}
+export async function rotateApiKey(oldKeyId, serviceId, label, opts = {}) {
+  const db = opts.db ?? useObserveDb();
+  const raw = KEY_PREFIX + randomBytes(32).toString("base64url");
+  const prefix = raw.slice(0, KEY_PREFIX.length + 6);
+  const id = uuidv7();
+  const now = Date.now();
+  await db.sql`BEGIN`;
+  try {
+    await db.sql`UPDATE api_keys SET revoked_at = ${now} WHERE id = ${oldKeyId} AND service_id = ${serviceId}`;
+    await db.sql`
+      INSERT INTO api_keys (id, service_id, key_hash, key_prefix, label, created_at)
+      VALUES (${id}, ${serviceId}, ${hashApiKey(raw)}, ${prefix}, ${label ?? null}, ${now})
+    `;
+    await db.sql`COMMIT`;
+  } catch (e) {
+    await db.sql`ROLLBACK`;
+    throw e;
+  }
+  return { id, raw, prefix };
+}
+export async function listApiKeys(serviceId, opts = {}) {
+  const db = opts.db ?? useObserveDb();
+  return await db.prepare(
+    "SELECT id, key_prefix, label, created_at, revoked_at, last_used_at FROM api_keys WHERE service_id = ? ORDER BY created_at"
+  ).all(serviceId);
+}

package/dist/runtime/server/utils/authz.d.ts

@@ -0,0 +1,50 @@
+import type { H3Event } from 'h3';
+import type { Principal } from '../../shared/auth/types.js';
+import type { Capability, Scope } from '../../shared/rbac/capabilities.js';
+import { type Database } from './db.js';
+interface DbOpts {
+    db?: Database;
+}
+/**
+ * The single server-side authorization choke point every gated /api/observe/* route
+ * composes. Resolves the session first (requireObserveSession throws 401 when absent),
+ * then the (role, capability) scope. A capability the role holds at no scope is the ONLY
+ * 403 CP6 mints; the 401 is never hand-rolled. Returns the resolved scope so the caller
+ * decides whether it must additionally scope rows (serviceScopeFilter) or a named
+ * resource (assertServiceInScope). No DB access happens here, so nothing is caught.
+ */
+export declare function requireCapability(event: H3Event, capability: Capability): Promise<{
+    principal: Principal;
+    scope: Exclude<Scope, 'none'>;
+}>;
+/**
+ * Expand a principal's slug-level Assignment into the concrete service ids it may act on,
+ * memoized on event.context.observe for the request so the group->service expansion query
+ * runs at most once even when a route calls both serviceScopeFilter and assertServiceInScope.
+ * Returns '*' for an admin (any '*' in services/groups => no restriction) or a possibly-empty
+ * id list. IDs are TEXT (uuidv7), hence string[] — not number[].
+ */
+export declare function getAllowedServiceIds(event: H3Event, principal: Principal, opts?: DbOpts): Promise<string[] | '*'>;
+/**
+ * A bare boolean SQL fragment (NO `WHERE` keyword) callers AND into any query to scope it
+ * by service. Three shapes: '' = no restriction (admin); '1=0' = matches nothing (empty
+ * assignment — a 200-with-zero-rows, never an error); `service_id IN (?,?)` otherwise.
+ * Splice `params` in positional order. `opts.column` retargets the id column for
+ * services/api-keys queries; `opts.db` injects a connection for unit tests. See
+ * CP6-HANDOFF §4.6 for the two composition patterns (LogFilter.serviceIds vs. this fragment).
+ */
+export declare function serviceScopeFilter(event: H3Event, principal: Principal, opts?: {
+    column?: string;
+    db?: Database;
+}): Promise<{
+    clause: string;
+    params: string[];
+}>;
+/**
+ * 403 when a principal names a service id outside its scope. For write/detail routes that
+ * take a validated :id (validate with getValidatedRouterParams -> 400 BEFORE this call).
+ * Admin ('*') and in-scope ids pass silently. 403 (not 404) is intentional: in a
+ * self-hosted single-tenant dashboard, existence is not sensitive (CP6-HANDOFF §9.7).
+ */
+export declare function assertServiceInScope(event: H3Event, principal: Principal, serviceId: string, opts?: DbOpts): Promise<void>;
+export {};

package/dist/runtime/server/utils/authz.js

@@ -0,0 +1,60 @@
+import { createError } from "h3";
+import { roleCan } from "../../shared/rbac/capabilities.js";
+import { requireObserveSession } from "./require-observe-session.js";
+import { useObserveDb } from "./db.js";
+export async function requireCapability(event, capability) {
+  const principal = await requireObserveSession(event);
+  const scope = roleCan(principal.role, capability);
+  if (!scope || scope === "none") {
+    throw createError({
+      statusCode: 403,
+      statusMessage: "Forbidden",
+      data: { error: "FORBIDDEN", capability }
+    });
+  }
+  return { principal, scope };
+}
+export async function getAllowedServiceIds(event, principal, opts = {}) {
+  const ctx = event.context.observe ??= {};
+  if (ctx.allowedServiceIds !== void 0) return ctx.allowedServiceIds;
+  const { services, groups } = principal.assignment;
+  if (services.includes("*") || groups.includes("*")) {
+    return ctx.allowedServiceIds = "*";
+  }
+  if (services.length === 0 && groups.length === 0) {
+    return ctx.allowedServiceIds = [];
+  }
+  const db = opts.db ?? useObserveDb();
+  const wheres = [];
+  const params = [];
+  if (services.length) {
+    wheres.push(`slug IN (${services.map(() => "?").join(",")})`);
+    params.push(...services);
+  }
+  if (groups.length) {
+    wheres.push(`group_id IN (SELECT id FROM groups WHERE slug IN (${groups.map(() => "?").join(",")}))`);
+    params.push(...groups);
+  }
+  const rows = await db.prepare(
+    `SELECT id FROM services WHERE ${wheres.join(" OR ")}`
+  ).all(...params);
+  return ctx.allowedServiceIds = rows.map((r) => r.id);
+}
+export async function serviceScopeFilter(event, principal, opts = {}) {
+  const column = opts.column ?? "service_id";
+  const ids = await getAllowedServiceIds(event, principal, opts);
+  if (ids === "*") return { clause: "", params: [] };
+  if (ids.length === 0) return { clause: "1=0", params: [] };
+  return { clause: `${column} IN (${ids.map(() => "?").join(",")})`, params: ids };
+}
+export async function assertServiceInScope(event, principal, serviceId, opts = {}) {
+  const ids = await getAllowedServiceIds(event, principal, opts);
+  if (ids === "*") return;
+  if (!ids.includes(serviceId)) {
+    throw createError({
+      statusCode: 403,
+      statusMessage: "Forbidden",
+      data: { error: "OUT_OF_SCOPE", serviceId }
+    });
+  }
+}

package/dist/runtime/server/utils/db/users.d.ts

@@ -0,0 +1,91 @@
+import type { Role, Assignment, Principal } from '../../../shared/auth/types.js';
+import { type Database } from '../db.js';
+/**
+ * All SQL for DB-backed dashboard users (CP16). Parameterised via db.prepare / db.sql,
+ * connection injected `opts.db ?? useObserveDb()` (repo convention). Ids are TEXT uuidv7.
+ *
+ * The `users` table stores service/group assignments as ids (user_service_roles.service_id,
+ * user_group_roles.group_id) but a Principal.assignment carries SLUGS (getAllowedServiceIds
+ * expands slugs, not ids). getUserAssignments is the single place that join happens: it
+ * returns slugs, never ids. Do not leak raw ids into a Principal, or scoping breaks silently.
+ */
+export interface UserRow {
+    id: string;
+    username: string;
+    display_name: string | null;
+    role: Role;
+    password_hash: string | null;
+    disabled: number;
+    source: string;
+    created_by: string | null;
+    created_at: number;
+    updated_at: number | null;
+}
+interface DbOpts {
+    db?: Database;
+}
+export interface AssignmentInput {
+    services: Array<{
+        serviceId: string;
+        role: Role;
+    }>;
+    groups: Array<{
+        groupId: string;
+        role: Role;
+    }>;
+}
+export declare function listUsers(opts?: DbOpts): Promise<UserRow[]>;
+export declare function getUserById(id: string, opts?: DbOpts): Promise<UserRow | null>;
+export declare function getUserByUsername(username: string, opts?: DbOpts): Promise<UserRow | null>;
+export declare function createUser(input: {
+    username: string;
+    displayName?: string | null;
+    role: Role;
+    passwordHash?: string | null;
+    createdBy?: string | null;
+}, opts?: DbOpts): Promise<UserRow>;
+export declare function updateUser(id: string, patch: Partial<{
+    displayName: string | null;
+    role: Role;
+    disabled: boolean;
+    passwordHash: string | null;
+}>, opts?: DbOpts): Promise<UserRow | null>;
+/**
+ * Delete a user and every dependent row (service/group role assignments + identities)
+ * in one transaction. FK CASCADE is not enabled on this connection (no per-connection
+ * PRAGMA foreign_keys = ON), so dependents are removed explicitly.
+ */
+export declare function deleteUser(id: string, opts?: DbOpts): Promise<void>;
+/** Enabled admins only: the bootstrap-fallback gate and the last-admin guard. */
+export declare function countAdmins(opts?: DbOpts): Promise<number>;
+/**
+ * Assignment as SLUGS (not ids): joins user_service_roles.service_id -> services.slug and
+ * user_group_roles.group_id -> groups.slug. This is what a Principal.assignment must carry.
+ */
+export declare function getUserAssignments(userId: string, opts?: DbOpts): Promise<Assignment>;
+/**
+ * Raw assignment rows (ids + per-scope role) for the management UI, which edits by id and
+ * pairs each with a role. Distinct from getUserAssignments, which returns SLUGS for a Principal.
+ */
+export declare function getUserAssignmentRows(userId: string, opts?: DbOpts): Promise<{
+    services: Array<{
+        serviceId: string;
+        role: Role;
+    }>;
+    groups: Array<{
+        groupId: string;
+        role: Role;
+    }>;
+}>;
+/** Replace a user's full assignment set (service + group roles) in one transaction. */
+export declare function setUserAssignments(userId: string, input: AssignmentInput, opts?: DbOpts): Promise<void>;
+export declare function findUserByIdentity(provider: string, subject: string, opts?: DbOpts): Promise<UserRow | null>;
+/** Link an external identity to a user, idempotent on (provider, subject). */
+export declare function upsertIdentity(userId: string, provider: string, subject: string, opts?: DbOpts): Promise<void>;
+/**
+ * Assemble a session-shaped Principal from a row + its (slug) assignment. Admins carry the
+ * wildcard assignment so getAllowedServiceIds short-circuits; everyone else carries the
+ * looked-up slugs. `provider` tags who minted it ('db' by default, 'jwt' for a token identity).
+ */
+export declare function principalFromUser(row: UserRow, assignment: Assignment, provider?: 'db' | 'jwt'): Principal;
+export {};

package/dist/runtime/server/utils/db/users.js

@@ -0,0 +1,128 @@
+import { uuidv7 } from "../../../shared/utils/uuid.js";
+import { ALL } from "../../../shared/auth/roles.js";
+import { useObserveDb } from "../db.js";
+export async function listUsers(opts = {}) {
+  const db = opts.db ?? useObserveDb();
+  return await db.prepare("SELECT * FROM users ORDER BY username").all();
+}
+export async function getUserById(id, opts = {}) {
+  const db = opts.db ?? useObserveDb();
+  const row = await db.prepare("SELECT * FROM users WHERE id = ?").get(id);
+  return row ?? null;
+}
+export async function getUserByUsername(username, opts = {}) {
+  const db = opts.db ?? useObserveDb();
+  const row = await db.prepare("SELECT * FROM users WHERE username = ?").get(username);
+  return row ?? null;
+}
+export async function createUser(input, opts = {}) {
+  const db = opts.db ?? useObserveDb();
+  const id = uuidv7();
+  const now = Date.now();
+  await db.sql`
+    INSERT INTO users (id, username, display_name, password_hash, role, disabled, source, created_by, created_at, updated_at)
+    VALUES (
+      ${id}, ${input.username}, ${input.displayName ?? null}, ${input.passwordHash ?? null},
+      ${input.role}, 0, 'db', ${input.createdBy ?? null}, ${now}, ${now}
+    )
+  `;
+  return await getUserById(id, { db });
+}
+export async function updateUser(id, patch, opts = {}) {
+  const db = opts.db ?? useObserveDb();
+  const existing = await getUserById(id, { db });
+  if (!existing) return null;
+  const displayName = "displayName" in patch ? patch.displayName ?? null : existing.display_name;
+  const role = patch.role ?? existing.role;
+  const disabled = patch.disabled === void 0 ? existing.disabled : patch.disabled ? 1 : 0;
+  const passwordHash = "passwordHash" in patch ? patch.passwordHash ?? null : existing.password_hash;
+  await db.sql`
+    UPDATE users
+    SET display_name = ${displayName}, role = ${role}, disabled = ${disabled},
+        password_hash = ${passwordHash}, updated_at = ${Date.now()}
+    WHERE id = ${id}
+  `;
+  return await getUserById(id, { db });
+}
+export async function deleteUser(id, opts = {}) {
+  const db = opts.db ?? useObserveDb();
+  await db.sql`BEGIN`;
+  try {
+    await db.sql`DELETE FROM user_service_roles WHERE user_id = ${id}`;
+    await db.sql`DELETE FROM user_group_roles WHERE user_id = ${id}`;
+    await db.sql`DELETE FROM user_identities WHERE user_id = ${id}`;
+    await db.sql`DELETE FROM users WHERE id = ${id}`;
+    await db.sql`COMMIT`;
+  } catch (e) {
+    await db.sql`ROLLBACK`;
+    throw e;
+  }
+}
+export async function countAdmins(opts = {}) {
+  const db = opts.db ?? useObserveDb();
+  const row = await db.prepare(`SELECT COUNT(*) AS c FROM users WHERE role = 'admin' AND disabled = 0`).get();
+  return row.c;
+}
+export async function getUserAssignments(userId, opts = {}) {
+  const db = opts.db ?? useObserveDb();
+  const services = await db.prepare(
+    `SELECT s.slug AS slug FROM user_service_roles r JOIN services s ON s.id = r.service_id WHERE r.user_id = ? ORDER BY s.slug`
+  ).all(userId);
+  const groups = await db.prepare(
+    `SELECT g.slug AS slug FROM user_group_roles r JOIN groups g ON g.id = r.group_id WHERE r.user_id = ? ORDER BY g.slug`
+  ).all(userId);
+  return { services: services.map((r) => r.slug), groups: groups.map((r) => r.slug) };
+}
+export async function getUserAssignmentRows(userId, opts = {}) {
+  const db = opts.db ?? useObserveDb();
+  const services = await db.prepare(
+    "SELECT service_id AS serviceId, role FROM user_service_roles WHERE user_id = ?"
+  ).all(userId);
+  const groups = await db.prepare(
+    "SELECT group_id AS groupId, role FROM user_group_roles WHERE user_id = ?"
+  ).all(userId);
+  return { services, groups };
+}
+export async function setUserAssignments(userId, input, opts = {}) {
+  const db = opts.db ?? useObserveDb();
+  await db.sql`BEGIN`;
+  try {
+    await db.sql`DELETE FROM user_service_roles WHERE user_id = ${userId}`;
+    await db.sql`DELETE FROM user_group_roles WHERE user_id = ${userId}`;
+    for (const s of input.services) {
+      await db.sql`INSERT INTO user_service_roles (user_id, service_id, role) VALUES (${userId}, ${s.serviceId}, ${s.role})`;
+    }
+    for (const g of input.groups) {
+      await db.sql`INSERT INTO user_group_roles (user_id, group_id, role) VALUES (${userId}, ${g.groupId}, ${g.role})`;
+    }
+    await db.sql`COMMIT`;
+  } catch (e) {
+    await db.sql`ROLLBACK`;
+    throw e;
+  }
+}
+export async function findUserByIdentity(provider, subject, opts = {}) {
+  const db = opts.db ?? useObserveDb();
+  const row = await db.prepare(
+    `SELECT u.* FROM users u JOIN user_identities i ON i.user_id = u.id WHERE i.provider = ? AND i.subject = ?`
+  ).get(provider, subject);
+  return row ?? null;
+}
+export async function upsertIdentity(userId, provider, subject, opts = {}) {
+  const db = opts.db ?? useObserveDb();
+  const id = uuidv7();
+  await db.sql`
+    INSERT INTO user_identities (id, user_id, provider, subject, created_at)
+    VALUES (${id}, ${userId}, ${provider}, ${subject}, ${Date.now()})
+    ON CONFLICT (provider, subject) DO UPDATE SET user_id = ${userId}
+  `;
+}
+export function principalFromUser(row, assignment, provider = "db") {
+  return {
+    sub: row.id,
+    name: row.display_name ?? row.username,
+    role: row.role,
+    assignment: row.role === "admin" ? { services: [ALL], groups: [ALL] } : assignment,
+    provider
+  };
+}

package/dist/runtime/server/utils/db.d.ts

@@ -0,0 +1,10 @@
+import type { Database } from 'db0';
+export declare const OBSERVE_DB = "observe";
+/**
+ * The one place the module touches Nitro's database layer. A future swap to a
+ * direct better-sqlite3 driver changes only this file. Importing `useDatabase`
+ * from 'nitropack/runtime' (not '#imports') keeps this file loadable from
+ * node-env unit tests, which resolve real package exports but not unimport aliases.
+ */
+export declare function useObserveDb(): Database;
+export type { Database };

package/dist/runtime/server/utils/db.js

@@ -0,0 +1,5 @@
+import { useDatabase } from "nitropack/runtime";
+export const OBSERVE_DB = "observe";
+export function useObserveDb() {
+  return useDatabase(OBSERVE_DB);
+}

package/dist/runtime/server/utils/frogger-adapter.d.ts

@@ -0,0 +1,40 @@
+import type { CanonicalEvent } from '../../shared/schema/event.js';
+/**
+ * Minimal frogger wire shapes (subset of frogger's LoggerObject/LoggerObjectBatch).
+ * Only the fields this adapter reads are typed; the rest ride through `ctx`.
+ */
+export interface FroggerLog {
+    time: number;
+    lvl: number;
+    type?: string;
+    msg: string;
+    ctx?: Record<string, unknown>;
+    tags?: string[];
+    env?: string;
+    source?: {
+        name?: string;
+        version?: string;
+    };
+    trace?: {
+        traceId?: string;
+        spanId?: string;
+        parentId?: string;
+    };
+}
+export interface FroggerBatch {
+    logs: FroggerLog[];
+    app?: {
+        name?: string;
+        version?: string;
+    };
+    meta?: Record<string, unknown>;
+}
+/**
+ * Map a frogger log to a CanonicalEvent. Returns null when the level normalises
+ * to a drop (e.g. frogger `silent`). Derives the first-class error/session/user/
+ * route/feature fields out of ctx per the frozen frogger-map contract, strips the
+ * consumed keys from a shallow ctx copy (the caller's object is never mutated),
+ * and demotes a non-W3C trace into ctx._trace rather than emitting an invalid one.
+ */
+export declare function froggerLogToEvent(log: FroggerLog, batch: FroggerBatch): CanonicalEvent | null;
+export declare function froggerBatchToEvents(batch: FroggerBatch): CanonicalEvent[];

package/dist/runtime/server/utils/frogger-adapter.js

@@ -0,0 +1,97 @@
+import { parseLevel } from "../../shared/schema/levels.js";
+const TRACE_ID_RE = /^[0-9a-f]{32}$/;
+const SPAN_ID_RE = /^[0-9a-f]{16}$/;
+const asString = (v) => typeof v === "string" ? v : void 0;
+const asCode = (v) => typeof v === "string" || typeof v === "number" ? v : void 0;
+function deriveError(ctx) {
+  const consumed = /* @__PURE__ */ new Set();
+  const eo = ctx.error && typeof ctx.error === "object" && !Array.isArray(ctx.error) ? ctx.error : void 0;
+  let name = asString(eo?.name);
+  if (name === void 0 && asString(ctx.name) !== void 0) {
+    name = asString(ctx.name);
+    consumed.add("name");
+  }
+  let message = asString(eo?.message);
+  if (message === void 0 && asString(ctx.message) !== void 0) {
+    message = asString(ctx.message);
+    consumed.add("message");
+  }
+  let stack = asString(eo?.stack);
+  if (stack === void 0 && asString(ctx.stack) !== void 0) {
+    stack = asString(ctx.stack);
+    consumed.add("stack");
+  }
+  let code = asCode(eo?.code);
+  if (code === void 0 && asCode(ctx.code) !== void 0) {
+    code = asCode(ctx.code);
+    consumed.add("code");
+  } else if (code === void 0 && asCode(ctx.statusCode) !== void 0) {
+    code = asCode(ctx.statusCode);
+    consumed.add("statusCode");
+  }
+  if (name === void 0 || message === void 0) return { consumed: /* @__PURE__ */ new Set() };
+  if (eo) consumed.add("error");
+  const error = { name, message };
+  if (stack !== void 0) error.stack = stack;
+  if (code !== void 0) error.code = code;
+  return { error, consumed };
+}
+export function froggerLogToEvent(log, batch) {
+  const level = parseLevel(log.lvl);
+  if (level === null) return null;
+  const app = log.source?.name ?? batch.app?.name;
+  const version = log.source?.version ?? batch.app?.version;
+  const event = {
+    time: log.time,
+    level,
+    message: log.msg
+  };
+  if (app) {
+    event.source = { app, ...version ? { version } : {}, ...log.env ? { env: log.env } : {} };
+  }
+  const srcCtx = log.ctx ?? {};
+  const { error, consumed } = deriveError(srcCtx);
+  if (error) event.error = error;
+  const omit = new Set(consumed);
+  if (asString(srcCtx.session) !== void 0) {
+    event.session = asString(srcCtx.session);
+    omit.add("session");
+  }
+  if (asString(srcCtx.user) !== void 0) {
+    event.user = asString(srcCtx.user);
+    omit.add("user");
+  }
+  if (asString(srcCtx.route) !== void 0) {
+    event.route = asString(srcCtx.route);
+    omit.add("route");
+  }
+  if (asString(srcCtx.feature) !== void 0) {
+    event.feature = asString(srcCtx.feature);
+    omit.add("feature");
+  }
+  const ctx = {};
+  for (const [k, v] of Object.entries(srcCtx)) {
+    if (!omit.has(k)) ctx[k] = v;
+  }
+  const t = log.trace;
+  if (t?.traceId && t?.spanId && TRACE_ID_RE.test(t.traceId) && SPAN_ID_RE.test(t.spanId)) {
+    event.trace = {
+      traceId: t.traceId,
+      spanId: t.spanId,
+      ...t.parentId ? { parentId: t.parentId } : {}
+    };
+  } else if (t && (t.traceId || t.spanId)) {
+    ctx._trace = { ...t };
+  }
+  if (log.tags && log.tags.length) event.tags = log.tags;
+  if (Object.keys(ctx).length) event.ctx = ctx;
+  return event;
+}
+export function froggerBatchToEvents(batch) {
+  const out = [];
+  for (const log of batch.logs ?? []) {
+    const event = froggerLogToEvent(log, batch);
+    if (event) out.push(event);
+  }
+  return out;
+}

package/dist/runtime/server/utils/groups.d.ts

@@ -0,0 +1,35 @@
+import { type Database } from './db.js';
+import type { ServiceRow } from './services.js';
+export interface GroupRow {
+    id: string;
+    slug: string;
+    name: string;
+    created_at: number;
+    updated_at: number;
+}
+interface DbOpts {
+    db?: Database;
+}
+export declare function createGroup(input: {
+    slug: string;
+    name: string;
+}, opts?: DbOpts): Promise<GroupRow>;
+export declare function getGroupById(id: string, opts?: DbOpts): Promise<GroupRow | null>;
+export declare function getGroupBySlug(slug: string, opts?: DbOpts): Promise<GroupRow | null>;
+export declare function listGroups(opts?: DbOpts): Promise<GroupRow[]>;
+export declare function updateGroup(id: string, patch: {
+    name: string;
+}, opts?: DbOpts): Promise<GroupRow | null>;
+/**
+ * Delete a group after detaching its member services (services.group_id = NULL),
+ * in one transaction. Services are never deleted with their group; they become
+ * ungrouped. Returns false when the group does not exist.
+ */
+export declare function deleteGroup(id: string, opts?: DbOpts): Promise<boolean>;
+export declare function assignServiceToGroup(serviceId: string, groupId: string | null, opts?: DbOpts): Promise<void>;
+export declare function listServicesInGroup(groupId: string, opts?: DbOpts): Promise<ServiceRow[]>;
+export declare function getGroupWithServices(groupId: string, opts?: DbOpts): Promise<{
+    group: GroupRow;
+    services: ServiceRow[];
+} | null>;
+export {};