nuxt-observe 0.0.2

package/dist/runtime/server/utils/migration-runner.js

@@ -0,0 +1,129 @@
+import { createHash } from "node:crypto";
+import { copyFileSync } from "node:fs";
+import { MIGRATIONS } from "../migrations/index.js";
+export function computeChecksum(m) {
+  return createHash("sha1").update(m.up.toString()).digest("hex");
+}
+function sortById(migrations) {
+  return [...migrations].sort((a, b) => a.id < b.id ? -1 : a.id > b.id ? 1 : 0);
+}
+async function readLedger(db) {
+  const rows = await db.prepare(
+    "SELECT id, class, checksum, applied_at, duration_ms FROM schema_migrations"
+  ).all();
+  return new Map(rows.map((r) => [r.id, r]));
+}
+export async function getMigrationStatus(db, migrations = MIGRATIONS) {
+  const ledger = await readLedger(db);
+  const sorted = sortById(migrations);
+  const out = [];
+  let sawPendingDestructive = false;
+  for (const m of sorted) {
+    const row = ledger.get(m.id);
+    if (row) {
+      out.push({
+        id: m.id,
+        class: m.class,
+        description: m.description,
+        state: "applied",
+        applied_at: row.applied_at,
+        driftWarning: row.checksum !== computeChecksum(m)
+      });
+      continue;
+    }
+    if (sawPendingDestructive) {
+      out.push({ id: m.id, class: m.class, description: m.description, state: "blocked" });
+      continue;
+    }
+    out.push({ id: m.id, class: m.class, description: m.description, state: "pending" });
+    if (m.class === "destructive") sawPendingDestructive = true;
+  }
+  return out;
+}
+let _adminRunLock = false;
+async function recordLedger(db, m, appliedAt, durationMs) {
+  await db.sql`
+    INSERT INTO schema_migrations (id, class, checksum, applied_at, duration_ms)
+    VALUES (${m.id}, ${m.class}, ${computeChecksum(m)}, ${appliedAt}, ${durationMs})
+  `;
+}
+function backupDatabase(dbPath, firstDestructiveId, log) {
+  if (!dbPath || dbPath === ":memory:") {
+    log(`[backup] skipped (no on-disk database path)`);
+    return;
+  }
+  const dest = `${dbPath}.bak-${firstDestructiveId}-${Date.now()}`;
+  copyFileSync(dbPath, dest);
+  log(`[backup] ${dest}`);
+}
+export async function runPendingMigrations(db, opts) {
+  const log = opts.log ?? ((line) => console.log("[observe:migrate]", line));
+  const registry = opts.migrations ?? MIGRATIONS;
+  if (opts.mode === "admin") {
+    if (_adminRunLock) {
+      log("[fail] another migration run is already in progress");
+      return { applied: [], skipped: [], failedAt: "__locked__" };
+    }
+    _adminRunLock = true;
+  }
+  try {
+    const sorted = sortById(registry);
+    const ledger = await readLedger(db);
+    const pendingOrdered = sorted.filter((m) => !ledger.has(m.id));
+    let targets;
+    if (opts.mode === "boot") {
+      targets = [];
+      for (const m of pendingOrdered) {
+        if (m.class === "destructive") break;
+        targets.push(m);
+      }
+    } else {
+      if (opts.ids && opts.ids.length) {
+        const known = new Set(sorted.map((m) => m.id));
+        const unknown = opts.ids.find((id) => !known.has(id));
+        if (unknown) {
+          log(`[fail] unknown migration id: ${unknown}`);
+          return { applied: [], skipped: [], failedAt: unknown };
+        }
+        const requested = new Set(opts.ids);
+        targets = pendingOrdered.filter((m) => requested.has(m.id));
+        const expected = pendingOrdered.slice(0, targets.length);
+        const outOfOrder = targets.find((m, i) => expected[i]?.id !== m.id);
+        if (outOfOrder) {
+          log(`[fail] cannot run ${outOfOrder.id} out of order; an earlier pending migration must run first`);
+          return { applied: [], skipped: [], failedAt: outOfOrder.id };
+        }
+      } else {
+        targets = pendingOrdered;
+      }
+    }
+    const applied = [];
+    const skipped = sorted.filter((m) => !targets.includes(m) && !ledger.has(m.id)).map((m) => m.id);
+    let backedUp = false;
+    for (const m of targets) {
+      if (m.class === "destructive" && !backedUp) {
+        backupDatabase(opts.dbPath, m.id, log);
+        backedUp = true;
+      }
+      const start = Date.now();
+      log(`[run] ${m.id}  ${m.description}`);
+      try {
+        await db.sql`BEGIN`;
+        await m.up(db, log);
+        await recordLedger(db, m, Date.now(), Date.now() - start);
+        await db.sql`COMMIT`;
+        applied.push(m.id);
+        log(`[ok] ${m.id}  (${Date.now() - start}ms)`);
+      } catch (e) {
+        await db.sql`ROLLBACK`.catch(() => {
+        });
+        const message = e instanceof Error ? e.message : String(e);
+        log(`[fail] ${m.id}: ${message}`);
+        return { applied, skipped, failedAt: m.id };
+      }
+    }
+    return { applied, skipped };
+  } finally {
+    if (opts.mode === "admin") _adminRunLock = false;
+  }
+}

package/dist/runtime/server/utils/observe-errors.d.ts

@@ -0,0 +1,58 @@
+import type { LogListItem } from '../../shared/schema/logs-query.js';
+import type { StatsBucket } from '../../shared/schema/stats.js';
+import { type ErrorGroup, type ErrorGroupHeader, type ErrorVersionBreakdown, type ErrorServiceBreakdown, type ErrorSort, type RegressionThresholds } from '../../shared/schema/errors-query.js';
+import { type Database } from './db.js';
+/**
+ * CP14 error-grouping aggregates behind GET /api/observe/errors + /errors/:fingerprint.
+ * Same contract as getStats / getVersionSummary: both builders take a RESOLVED scope
+ * (string[] | '*'), not an event - the handler runs requireCapability /
+ * getAllowedServiceIds / resolveEffectiveScope first - so these stay pure and
+ * node-testable via `opts.db`. Scope is applied as `service_id IN (...)`: '*' = no
+ * restriction; an empty list short-circuits before touching the db. worst_level is
+ * MIN(level) because 0 = error is the MOST severe (CP14 §1.1). The regression flag is
+ * computed in JS from conditional aggregates, never stored (CP14 §6).
+ */
+interface DbOpts {
+    db?: Database;
+}
+export interface ErrorFilters {
+    app?: string;
+    version?: string;
+    env?: string;
+    level?: number;
+    q?: string;
+}
+export interface ListErrorGroupsParams {
+    from: number;
+    to: number;
+    limit: number;
+    offset: number;
+    sort: ErrorSort;
+    filters?: ErrorFilters;
+    thresholds: RegressionThresholds;
+    now: number;
+}
+export interface GetErrorGroupParams {
+    from: number;
+    to: number;
+    bucketMs: number;
+    limit: number;
+    offset: number;
+    thresholds: RegressionThresholds;
+    now: number;
+}
+export interface ErrorGroupDetail {
+    header: ErrorGroupHeader;
+    bucketMs: number;
+    series: StatsBucket[];
+    versions: ErrorVersionBreakdown[];
+    services: ErrorServiceBreakdown[];
+    occurrences: LogListItem[];
+    occurrencesTotal: number;
+}
+export declare function listErrorGroups(params: ListErrorGroupsParams, scope: string[] | '*', opts?: DbOpts): Promise<{
+    groups: ErrorGroup[];
+    total: number;
+}>;
+export declare function getErrorGroup(fingerprint: string, params: GetErrorGroupParams, scope: string[] | '*', opts?: DbOpts): Promise<ErrorGroupDetail | null>;
+export {};

package/dist/runtime/server/utils/observe-errors.js

@@ -0,0 +1,206 @@
+import {
+  isRegressed,
+  splitConcat,
+  NULL_VERSION
+} from "../../shared/schema/errors-query.js";
+import { zeroFilledBuckets } from "./stats-query.js";
+import { queryLogs, countLogs, escapeLike } from "./logs.js";
+import { useObserveDb } from "./db.js";
+const ORDER_BY = {
+  recent: "last_seen DESC",
+  count: "count DESC, last_seen DESC",
+  first: "first_seen DESC"
+};
+function scopeClause(scope, column = "service_id") {
+  return scope === "*" ? { clause: "", params: [] } : { clause: `AND ${column} IN (${scope.map(() => "?").join(",")})`, params: [...scope] };
+}
+function filterClause(filters) {
+  if (!filters) return { clause: "", params: [] };
+  const conds = [];
+  const params = [];
+  const eq = (col, val) => {
+    if (val !== void 0 && val !== null) {
+      conds.push(`AND ${col} = ?`);
+      params.push(val);
+    }
+  };
+  eq("app", filters.app);
+  eq("version", filters.version);
+  eq("env", filters.env);
+  eq("level", filters.level);
+  if (filters.q) {
+    conds.push(`AND error_message LIKE ? ESCAPE '\\'`);
+    params.push(`%${escapeLike(filters.q)}%`);
+  }
+  return { clause: conds.join(" "), params };
+}
+function toListItem(row) {
+  return {
+    id: row.id,
+    time: row.time,
+    level: row.level,
+    message: row.message,
+    app: row.app,
+    version: row.version ?? null,
+    env: row.env ?? null,
+    service_id: row.service_id ?? null,
+    route: row.route ?? null,
+    feature: row.feature ?? null,
+    error_name: row.error_name ?? null,
+    trace_id: row.trace_id ?? null
+  };
+}
+export async function listErrorGroups(params, scope, opts = {}) {
+  if (scope !== "*" && scope.length === 0) return { groups: [], total: 0 };
+  const db = opts.db ?? useObserveDb();
+  const { from, to, limit, offset, sort, filters, thresholds, now } = params;
+  const activeStart = now - thresholds.activeWindowMs;
+  const scoped = scopeClause(scope);
+  const filt = filterClause(filters);
+  const where = `WHERE error_fingerprint IS NOT NULL AND time >= ? AND time <= ? ${scoped.clause} ${filt.clause}`;
+  const whereParams = [from, to, ...scoped.params, ...filt.params];
+  const rows = await db.prepare(
+    `SELECT error_fingerprint,
+            COUNT(*)                       AS count,
+            MIN(time)                      AS first_seen,
+            MAX(time)                      AS last_seen,
+            MIN(level)                     AS worst_level,
+            COUNT(DISTINCT app)            AS service_count,
+            GROUP_CONCAT(DISTINCT app)     AS apps,
+            GROUP_CONCAT(DISTINCT version) AS versions,
+            MIN(CASE WHEN time >= ? THEN time END) AS first_in_active,
+            MAX(CASE WHEN time <  ? THEN time END) AS prev_before_active
+     FROM logs ${where}
+     GROUP BY error_fingerprint
+     ORDER BY ${ORDER_BY[sort]}
+     LIMIT ? OFFSET ?`
+  ).all(activeStart, activeStart, ...whereParams, limit, offset);
+  const totalRow = await db.prepare(
+    `SELECT COUNT(*) AS n FROM (SELECT 1 FROM logs ${where} GROUP BY error_fingerprint)`
+  ).get(...whereParams);
+  const fps = rows.map((r) => r.error_fingerprint);
+  const repr = /* @__PURE__ */ new Map();
+  if (fps.length) {
+    const reprRows = await db.prepare(
+      `SELECT error_fingerprint, error_name, error_message, error_code
+       FROM logs
+       WHERE id IN (
+         SELECT MAX(id) FROM logs
+         WHERE error_fingerprint IN (${fps.map(() => "?").join(",")}) AND time >= ? AND time <= ? ${scoped.clause} ${filt.clause}
+         GROUP BY error_fingerprint
+       )`
+    ).all(...fps, from, to, ...scoped.params, ...filt.params);
+    for (const r of reprRows) repr.set(r.error_fingerprint, r);
+  }
+  const groups = rows.map((r) => {
+    const rep = repr.get(r.error_fingerprint);
+    return {
+      fingerprint: r.error_fingerprint,
+      count: r.count,
+      firstSeen: r.first_seen,
+      lastSeen: r.last_seen,
+      worstLevel: r.worst_level,
+      serviceCount: r.service_count,
+      apps: splitConcat(r.apps),
+      versions: splitConcat(r.versions),
+      name: rep?.error_name ?? null,
+      message: rep?.error_message ?? null,
+      regressed: isRegressed(
+        { lastSeen: r.last_seen, firstInActive: r.first_in_active, prevBeforeActive: r.prev_before_active },
+        thresholds,
+        now
+      )
+    };
+  });
+  return { groups, total: totalRow.n };
+}
+export async function getErrorGroup(fingerprint, params, scope, opts = {}) {
+  if (scope !== "*" && scope.length === 0) return null;
+  const db = opts.db ?? useObserveDb();
+  const { from, to, bucketMs, limit, offset, thresholds, now } = params;
+  const activeStart = now - thresholds.activeWindowMs;
+  const scoped = scopeClause(scope);
+  const base = `WHERE error_fingerprint = ? AND time >= ? AND time <= ? ${scoped.clause}`;
+  const baseParams = [fingerprint, from, to, ...scoped.params];
+  const agg = await db.prepare(
+    `SELECT COUNT(*)                       AS count,
+            MIN(time)                      AS first_seen,
+            MAX(time)                      AS last_seen,
+            MIN(level)                     AS worst_level,
+            COUNT(DISTINCT app)            AS service_count,
+            GROUP_CONCAT(DISTINCT app)     AS apps,
+            GROUP_CONCAT(DISTINCT version) AS versions,
+            MIN(CASE WHEN time >= ? THEN time END) AS first_in_active,
+            MAX(CASE WHEN time <  ? THEN time END) AS prev_before_active
+     FROM logs ${base}`
+  ).get(activeStart, activeStart, ...baseParams);
+  if (!agg || agg.count === 0) return null;
+  const rep = await db.prepare(
+    `SELECT error_name, error_message, error_code FROM logs
+     WHERE id = (SELECT MAX(id) FROM logs ${base})`
+  ).get(...baseParams);
+  const header = {
+    fingerprint,
+    count: agg.count,
+    firstSeen: agg.first_seen,
+    lastSeen: agg.last_seen,
+    worstLevel: agg.worst_level,
+    serviceCount: agg.service_count,
+    apps: splitConcat(agg.apps),
+    versions: splitConcat(agg.versions),
+    name: rep?.error_name ?? null,
+    message: rep?.error_message ?? null,
+    code: rep?.error_code ?? null,
+    regressed: isRegressed(
+      { lastSeen: agg.last_seen, firstInActive: agg.first_in_active, prevBeforeActive: agg.prev_before_active },
+      thresholds,
+      now
+    )
+  };
+  const seriesRows = await db.prepare(
+    `SELECT CAST(time / ? AS INTEGER) AS b, COUNT(*) AS count, SUM(level = 0) AS errorCount
+     FROM logs ${base}
+     GROUP BY b ORDER BY b`
+  ).all(bucketMs, ...baseParams);
+  const series = zeroFilledBuckets(from, to, bucketMs);
+  const bFrom = Math.floor(from / bucketMs);
+  for (const row of seriesRows) {
+    const bucket = series[row.b - bFrom];
+    if (!bucket) continue;
+    bucket.count += row.count;
+    bucket.errorCount += row.errorCount ?? 0;
+  }
+  const versionRows = await db.prepare(
+    `SELECT COALESCE(version, '${NULL_VERSION}') AS version, COUNT(*) AS count
+     FROM logs ${base}
+     GROUP BY COALESCE(version, '${NULL_VERSION}') ORDER BY count DESC`
+  ).all(...baseParams);
+  const versions = versionRows.map((r) => ({ version: r.version, count: r.count }));
+  const svcScoped = scopeClause(scope, "l.service_id");
+  const serviceRows = await db.prepare(
+    `SELECT l.service_id AS serviceId, s.slug AS slug, s.name AS name, COUNT(*) AS count
+     FROM logs l LEFT JOIN services s ON s.id = l.service_id
+     WHERE l.error_fingerprint = ? AND l.time >= ? AND l.time <= ? ${svcScoped.clause}
+     GROUP BY l.service_id ORDER BY count DESC`
+  ).all(fingerprint, from, to, ...svcScoped.params);
+  const services = serviceRows.map((r) => ({
+    serviceId: r.serviceId,
+    slug: r.slug,
+    name: r.name,
+    count: r.count
+  }));
+  const occFilter = { errorFingerprint: fingerprint, from, to, serviceIds: scope, order: "desc", limit, offset };
+  const [occRows, occurrencesTotal] = await Promise.all([
+    queryLogs(occFilter, { db }),
+    countLogs(occFilter, { db })
+  ]);
+  return {
+    header,
+    bucketMs,
+    series,
+    versions,
+    services,
+    occurrences: occRows.map(toListItem),
+    occurrencesTotal
+  };
+}

package/dist/runtime/server/utils/overview.d.ts

@@ -0,0 +1,20 @@
+import type { OverviewData } from '../../shared/schema/overview.js';
+import { type Database } from './db.js';
+/**
+ * CP7 overview aggregates. Owns its SQL outright (no CP5 query layer exists — see
+ * docs/internals/roadmap.md: analytical helpers live with the dashboard checkpoints
+ * whose UI drives their shape). Takes a RESOLVED scope (string[] | '*'), not an event:
+ * the handler runs requireCapability/getAllowedServiceIds first, so this stays pure
+ * and node-testable via `opts.db` like the CP2/CP3 helpers.
+ *
+ * Every query rides idx_logs_service_time when scoped (idx_logs_time/level_time for
+ * admin) and parameterises every value — the scope IN (...) placeholder count always
+ * equals the id count.
+ */
+interface DbOpts {
+    db?: Database;
+}
+/** Zeroed response slice for an empty scope; never touches the db. */
+export declare function emptyOverview(): OverviewData;
+export declare function getOverview(scope: string[] | '*', from: number, to: number, opts?: DbOpts): Promise<OverviewData>;
+export {};

package/dist/runtime/server/utils/overview.js

@@ -0,0 +1,119 @@
+import { useObserveDb } from "./db.js";
+export function emptyOverview() {
+  return {
+    stats: {
+      totalEvents: 0,
+      errorCount: 0,
+      errorRate: 0,
+      warnCount: 0,
+      activeServices: 0,
+      activeVersions: 0
+    },
+    services: [],
+    activity: []
+  };
+}
+export async function getOverview(scope, from, to, opts = {}) {
+  if (scope !== "*" && scope.length === 0) return emptyOverview();
+  const db = opts.db ?? useObserveDb();
+  const scoped = scope === "*" ? { clause: "", params: [] } : { clause: `AND service_id IN (${scope.map(() => "?").join(",")})`, params: [...scope] };
+  const timeAndScope = `WHERE time >= ? AND time <= ? ${scoped.clause}`;
+  const base = [from, to, ...scoped.params];
+  const scalars = await db.prepare(
+    `SELECT COUNT(*) AS total,
+            SUM(level = 0) AS errorCount,
+            SUM(level = 1) AS warnCount,
+            COUNT(DISTINCT service_id) AS activeServices,
+            COUNT(DISTINCT version) AS activeVersions
+     FROM logs ${timeAndScope}`
+  ).get(...base);
+  const latestError = await db.prepare(
+    `SELECT time, message, error_name AS name, service_id, app, route, trace_id AS traceId
+     FROM logs ${timeAndScope} AND level = 0
+     ORDER BY time DESC LIMIT 1`
+  ).get(...base);
+  const rollups = await db.prepare(
+    `SELECT service_id, MAX(app) AS app, COUNT(*) AS total,
+            SUM(level = 0) AS errorCount, SUM(level = 1) AS warnCount, MAX(time) AS lastSeen
+     FROM logs ${timeAndScope}
+     GROUP BY service_id`
+  ).all(...base);
+  const versionRows = await db.prepare(
+    `SELECT service_id, version FROM logs ${timeAndScope} AND version IS NOT NULL
+     GROUP BY service_id, version`
+  ).all(...base);
+  const activityRows = await db.prepare(
+    `SELECT time, level, message, service_id, app, route, session,
+            user_id AS user, trace_id AS traceId, error_name AS errorName
+     FROM logs ${timeAndScope}
+     ORDER BY time DESC LIMIT 50`
+  ).all(...base);
+  const idSet = /* @__PURE__ */ new Set();
+  for (const r of [...rollups, ...activityRows]) {
+    if (r.service_id) idSet.add(r.service_id);
+  }
+  if (latestError?.service_id) idSet.add(latestError.service_id);
+  const ids = [...idSet];
+  const displayRows = ids.length ? await db.prepare(
+    `SELECT id, slug, name, env FROM services WHERE id IN (${ids.map(() => "?").join(",")})`
+  ).all(...ids) : [];
+  const display = new Map(displayRows.map((r) => [r.id, r]));
+  const serviceLabel = (serviceId, app) => (serviceId ? display.get(serviceId)?.slug : void 0) ?? app ?? "unknown";
+  const versionsByService = /* @__PURE__ */ new Map();
+  for (const v of versionRows) {
+    if (!v.service_id) continue;
+    const list = versionsByService.get(v.service_id) ?? [];
+    list.push(v.version);
+    versionsByService.set(v.service_id, list);
+  }
+  const services = rollups.filter((r) => r.service_id !== null).map((r) => {
+    const d = display.get(r.service_id);
+    const errorCount2 = r.errorCount ?? 0;
+    return {
+      id: r.service_id,
+      slug: d?.slug ?? r.app ?? r.service_id,
+      name: d?.name ?? r.app ?? r.service_id,
+      ...d?.env ? { env: d.env } : {},
+      totalEvents: r.total,
+      errorCount: errorCount2,
+      errorRate: r.total ? errorCount2 / r.total : 0,
+      warnCount: r.warnCount ?? 0,
+      lastSeen: r.lastSeen,
+      versions: versionsByService.get(r.service_id) ?? []
+    };
+  });
+  const activity = activityRows.map((r) => ({
+    time: r.time,
+    level: r.level,
+    message: r.message ?? "",
+    service: serviceLabel(r.service_id, r.app),
+    ...r.route ? { route: r.route } : {},
+    ...r.session ? { session: r.session } : {},
+    ...r.user ? { user: r.user } : {},
+    ...r.traceId ? { traceId: r.traceId } : {},
+    ...r.errorName ? { errorName: r.errorName } : {}
+  }));
+  const errorCount = scalars.errorCount ?? 0;
+  return {
+    stats: {
+      totalEvents: scalars.total,
+      errorCount,
+      errorRate: scalars.total ? errorCount / scalars.total : 0,
+      warnCount: scalars.warnCount ?? 0,
+      activeServices: scalars.activeServices,
+      activeVersions: scalars.activeVersions,
+      ...latestError ? {
+        latestError: {
+          time: latestError.time,
+          message: latestError.message ?? "",
+          ...latestError.name ? { name: latestError.name } : {},
+          service: serviceLabel(latestError.service_id, latestError.app),
+          ...latestError.route ? { route: latestError.route } : {},
+          ...latestError.traceId ? { traceId: latestError.traceId } : {}
+        }
+      } : {}
+    },
+    services,
+    activity
+  };
+}

package/dist/runtime/server/utils/provisioning.d.ts

@@ -0,0 +1,62 @@
+import { type H3Event } from 'h3';
+import type { Principal } from '../../shared/auth/types.js';
+import type { ServiceCreate, ServiceUpdate, ServiceListItem, ServiceDetail, KeyMeta, MintedKey, GroupListItem, UserPick, UserDetail } from '../../shared/schema/provisioning.js';
+import { SERVICE_DELETE_RETENTION_MS } from './services.js';
+import { type GroupRow } from './groups.js';
+import { type Database } from './db.js';
+/**
+ * Thin orchestration layer over the CP2/CP6/CP10.5 helpers (services/groups/api-keys/authz).
+ * It maps DB rows to the framework-free wire shapes in shared/schema/provisioning.ts and
+ * never re-implements the underlying SQL. All DB access stays in server/utils/* so the
+ * experimental sqlite layer can be swapped later.
+ */
+export { SERVICE_DELETE_RETENTION_MS };
+interface Ctx {
+    db?: Database;
+}
+/**
+ * Scoped service list for the provisioning table. Soft-deleted services are INCLUDED
+ * (so the UI can render a countdown + restore) but sorted to the bottom. keyCount is an
+ * active-key count via a correlated subquery, avoiding an N+1 over api_keys.
+ */
+export declare function listServicesForPrincipal(event: H3Event, principal: Principal, ctx?: Ctx): Promise<ServiceListItem[]>;
+export declare function getServiceDetail(id: string, ctx?: Ctx): Promise<ServiceDetail | null>;
+export declare function createServiceFromInput(input: ServiceCreate, principal: Principal, ctx?: Ctx): Promise<ServiceDetail>;
+export declare function updateServiceFromInput(id: string, patch: ServiceUpdate, ctx?: Ctx): Promise<ServiceDetail | null>;
+export declare function softDeleteServiceById(id: string, ctx?: Ctx): Promise<{
+    deletedAt: number;
+    purgeAt: number;
+} | null>;
+export declare function restoreServiceById(id: string, ctx?: Ctx): Promise<ServiceDetail | null>;
+export declare function listKeyMeta(serviceId: string, ctx?: Ctx): Promise<KeyMeta[]>;
+export declare function mintKey(event: H3Event, serviceId: string, label: string, ctx?: Ctx): Promise<MintedKey>;
+export declare function rotateKey(event: H3Event, serviceId: string, oldKeyId: string, label: string, ctx?: Ctx): Promise<MintedKey>;
+export declare function revokeKey(keyId: string, ctx?: Ctx): Promise<void>;
+/** Guard: does this key belong to this service? (routes assert scope on the service, then this on the key). */
+export declare function keyBelongsToService(keyId: string, serviceId: string, ctx?: Ctx): Promise<boolean>;
+export declare function listGroupsForPrincipal(event: H3Event, principal: Principal, ctx?: Ctx): Promise<GroupListItem[]>;
+export declare function createGroupFromInput(name: string, ctx?: Ctx): Promise<{
+    ok: true;
+    group: GroupRow;
+} | {
+    ok: false;
+    conflict: true;
+}>;
+export declare function updateGroupById(id: string, name: string, ctx?: Ctx): Promise<GroupRow | null>;
+export declare function deleteGroupById(id: string, ctx?: Ctx): Promise<boolean>;
+/**
+ * Reconcile a group's membership to exactly `serviceIds` (direct services.group_id FK):
+ * detach the removed, attach the added, in one transaction.
+ */
+export declare function setGroupMembership(groupId: string, serviceIds: string[], ctx?: Ctx): Promise<void>;
+export declare function getGroupDetail(id: string, ctx?: Ctx): Promise<{
+    group: GroupRow;
+    services: ServiceListItem[];
+} | null>;
+/** Config-seeded users (observe.auth.users). The list surface while the config provider is active. */
+export declare function listUsers(): UserPick[];
+/** True when the DB provider is the active primary (drives the /users data-source switch). */
+export declare function isDbProviderActive(): boolean;
+/** DB-backed users -> UserPick[] (same wire shape as listUsers, slug assignment). */
+export declare function listDbUsers(ctx?: Ctx): Promise<UserPick[]>;
+export declare function getUserDetail(id: string, ctx?: Ctx): Promise<UserDetail | null>;