nuxt-observe 0.0.2

package/dist/runtime/shared/schema/overview.js

@@ -0,0 +1,9 @@
+import { z } from "zod";
+import { PERIODS } from "../utils/period.js";
+export const overviewQuerySchema = z.object({
+  period: z.enum(PERIODS).default("24h"),
+  /** service slug; resolved to an id and intersected with the caller's scope */
+  service: z.string().optional(),
+  /** group slug; expanded to member service ids and intersected with the caller's scope */
+  group: z.string().optional()
+});

package/dist/runtime/shared/schema/provisioning.d.ts

@@ -0,0 +1,230 @@
+import { z } from 'zod';
+/**
+ * Provisioning contracts (CP11). Pure zod + local only: this file loads in the
+ * browser UForm, the Nitro routes, and node unit tests, so it must never import
+ * #imports, node:crypto, or any server util (same rule as registry.ts).
+ *
+ * `type` is orthogonal to `kind`: `kind` (server|browser) drives dynamic CORS,
+ * `type` is a descriptive UI-only category (badge + icon + filter metadata).
+ */
+export declare const SERVICE_TYPES: readonly ["website", "webapp", "api", "service", "worker", "mobile", "other"];
+export type ServiceType = (typeof SERVICE_TYPES)[number];
+export declare const serviceTypeSchema: z.ZodEnum<{
+    service: "service";
+    other: "other";
+    website: "website";
+    webapp: "webapp";
+    api: "api";
+    worker: "worker";
+    mobile: "mobile";
+}>;
+export declare const SERVICE_KINDS: readonly ["server", "browser"];
+export type ServiceKind = (typeof SERVICE_KINDS)[number];
+export declare const serviceKindSchema: z.ZodEnum<{
+    server: "server";
+    browser: "browser";
+}>;
+/**
+ * Presentation map for the `type` axis: one source of truth for the USelectMenu
+ * options, the table badge, and the detail header. lucide names follow the repo's
+ * `i-lucide-*` convention. An unknown/hand-edited `type` falls back to `other`
+ * at render time (see serviceTypeMeta).
+ */
+export declare const SERVICE_TYPE_META: {
+    readonly website: {
+        readonly label: "Website";
+        readonly icon: "i-lucide-globe";
+    };
+    readonly webapp: {
+        readonly label: "Web app";
+        readonly icon: "i-lucide-app-window";
+    };
+    readonly api: {
+        readonly label: "API";
+        readonly icon: "i-lucide-webhook";
+    };
+    readonly service: {
+        readonly label: "Service";
+        readonly icon: "i-lucide-server";
+    };
+    readonly worker: {
+        readonly label: "Worker";
+        readonly icon: "i-lucide-cog";
+    };
+    readonly mobile: {
+        readonly label: "Mobile";
+        readonly icon: "i-lucide-smartphone";
+    };
+    readonly other: {
+        readonly label: "Other";
+        readonly icon: "i-lucide-box";
+    };
+};
+/** Lenient lookup: any unrecognised value renders as `other` rather than throwing. */
+export declare function serviceTypeMeta(type: string): {
+    label: string;
+    icon: string;
+};
+export declare const serviceCreateSchema: z.ZodObject<{
+    name: z.ZodString;
+    type: z.ZodDefault<z.ZodEnum<{
+        service: "service";
+        other: "other";
+        website: "website";
+        webapp: "webapp";
+        api: "api";
+        worker: "worker";
+        mobile: "mobile";
+    }>>;
+    kind: z.ZodDefault<z.ZodEnum<{
+        server: "server";
+        browser: "browser";
+    }>>;
+    appNames: z.ZodArray<z.ZodString>;
+    allowedOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    env: z.ZodOptional<z.ZodString>;
+    versionTracking: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+export declare const serviceUpdateSchema: z.ZodObject<{
+    name: z.ZodOptional<z.ZodString>;
+    type: z.ZodOptional<z.ZodEnum<{
+        service: "service";
+        other: "other";
+        website: "website";
+        webapp: "webapp";
+        api: "api";
+        worker: "worker";
+        mobile: "mobile";
+    }>>;
+    kind: z.ZodOptional<z.ZodEnum<{
+        server: "server";
+        browser: "browser";
+    }>>;
+    appNames: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    allowedOrigins: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    env: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    groupId: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+    versionTracking: z.ZodOptional<z.ZodBoolean>;
+    currentVersion: z.ZodOptional<z.ZodNullable<z.ZodString>>;
+}, z.core.$strip>;
+export declare const keyCreateSchema: z.ZodObject<{
+    label: z.ZodString;
+}, z.core.$strip>;
+export declare const groupCreateSchema: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strip>;
+export declare const groupUpdateSchema: z.ZodObject<{
+    name: z.ZodString;
+}, z.core.$strip>;
+export declare const groupMembershipSchema: z.ZodObject<{
+    serviceIds: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export declare const assignmentSchema: z.ZodObject<{
+    userIds: z.ZodArray<z.ZodString>;
+}, z.core.$strip>;
+export declare const serviceIdParams: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+export declare const keyIdParams: z.ZodObject<{
+    id: z.ZodString;
+    keyId: z.ZodString;
+}, z.core.$strip>;
+export declare const groupIdParams: z.ZodObject<{
+    id: z.ZodString;
+}, z.core.$strip>;
+export type ServiceCreate = z.infer<typeof serviceCreateSchema>;
+export type ServiceUpdate = z.infer<typeof serviceUpdateSchema>;
+export type KeyCreate = z.infer<typeof keyCreateSchema>;
+export type GroupCreate = z.infer<typeof groupCreateSchema>;
+export type GroupMembership = z.infer<typeof groupMembershipSchema>;
+/**
+ * Wire shapes the composables type against. Kept here (framework-free) so the
+ * client and the routes never drift on field names.
+ */
+export interface ServiceListItem {
+    id: string;
+    slug: string;
+    name: string;
+    type: ServiceType;
+    kind: ServiceKind;
+    env: string | null;
+    groupId: string | null;
+    versionTracking: boolean;
+    currentVersion: string | null;
+    keyCount: number;
+    managedByConfig: boolean;
+    deletedAt: number | null;
+    /** epoch ms at which a soft-deleted service is eligible for permanent purge, else null. */
+    purgeAt: number | null;
+}
+export interface ServiceDetail extends ServiceListItem {
+    appNames: string[];
+    allowedOrigins: string[];
+    group: {
+        id: string;
+        slug: string;
+        name: string;
+    } | null;
+}
+export interface KeyMeta {
+    id: string;
+    keyPrefix: string;
+    label: string | null;
+    createdAt: number;
+    revokedAt: number | null;
+    lastUsedAt: number | null;
+}
+export interface MintedKey {
+    key: string;
+    prefix: string;
+    ingestUrl: string;
+    snippet: {
+        rawUrl: string;
+        serverPluginSnippet: string;
+        configSnippet: string;
+    };
+}
+export interface GroupListItem {
+    id: string;
+    slug: string;
+    name: string;
+    serviceCount: number;
+}
+export interface UserPick {
+    id: string;
+    name: string;
+    role: string;
+    assignment: {
+        services: string[];
+        groups: string[];
+    };
+}
+/**
+ * Full DB-backed user (CP16), for the edit page. `services`/`groups` carry ids + per-scope
+ * role (the assignment editor edits by id); `assignment` carries slugs for display parity
+ * with UserPick. `disabled` is a boolean on the wire (0/1 in the row).
+ */
+export interface UserDetail {
+    id: string;
+    username: string;
+    displayName: string | null;
+    name: string;
+    role: string;
+    disabled: boolean;
+    source: string;
+    hasPassword: boolean;
+    createdAt: number;
+    updatedAt: number | null;
+    assignment: {
+        services: string[];
+        groups: string[];
+    };
+    services: Array<{
+        serviceId: string;
+        role: string;
+    }>;
+    groups: Array<{
+        groupId: string;
+        role: string;
+    }>;
+}

package/dist/runtime/shared/schema/provisioning.js

@@ -0,0 +1,52 @@
+import { z } from "zod";
+export const SERVICE_TYPES = ["website", "webapp", "api", "service", "worker", "mobile", "other"];
+export const serviceTypeSchema = z.enum(SERVICE_TYPES);
+export const SERVICE_KINDS = ["server", "browser"];
+export const serviceKindSchema = z.enum(SERVICE_KINDS);
+export const SERVICE_TYPE_META = {
+  website: { label: "Website", icon: "i-lucide-globe" },
+  webapp: { label: "Web app", icon: "i-lucide-app-window" },
+  api: { label: "API", icon: "i-lucide-webhook" },
+  service: { label: "Service", icon: "i-lucide-server" },
+  worker: { label: "Worker", icon: "i-lucide-cog" },
+  mobile: { label: "Mobile", icon: "i-lucide-smartphone" },
+  other: { label: "Other", icon: "i-lucide-box" }
+};
+export function serviceTypeMeta(type) {
+  return SERVICE_TYPE_META[type] ?? SERVICE_TYPE_META.other;
+}
+const originSchema = z.string().refine(
+  (v) => v === "*" || /^https?:\/\/[^/\s]+$/.test(v),
+  { message: 'must be an http(s) origin (e.g. https://app.example.com) or "*"' }
+);
+export const serviceCreateSchema = z.object({
+  name: z.string().min(1).max(80),
+  type: serviceTypeSchema.default("service"),
+  kind: serviceKindSchema.default("server"),
+  appNames: z.array(z.string().min(1)).min(1),
+  allowedOrigins: z.array(originSchema).default([]),
+  env: z.string().max(40).optional(),
+  versionTracking: z.boolean().optional()
+}).refine((s) => !(s.allowedOrigins.length && s.kind === "server"), {
+  path: ["allowedOrigins"],
+  message: 'allowedOrigins requires kind="browser"'
+});
+export const serviceUpdateSchema = z.object({
+  name: z.string().min(1).max(80).optional(),
+  type: serviceTypeSchema.optional(),
+  kind: serviceKindSchema.optional(),
+  appNames: z.array(z.string().min(1)).min(1).optional(),
+  allowedOrigins: z.array(originSchema).optional(),
+  env: z.string().max(40).nullable().optional(),
+  groupId: z.string().nullable().optional(),
+  versionTracking: z.boolean().optional(),
+  currentVersion: z.string().nullable().optional()
+});
+export const keyCreateSchema = z.object({ label: z.string().min(1).max(60) });
+export const groupCreateSchema = z.object({ name: z.string().min(1).max(80) });
+export const groupUpdateSchema = z.object({ name: z.string().min(1).max(80) });
+export const groupMembershipSchema = z.object({ serviceIds: z.array(z.string().min(1)) });
+export const assignmentSchema = z.object({ userIds: z.array(z.string().min(1)) });
+export const serviceIdParams = z.object({ id: z.string().min(1) });
+export const keyIdParams = z.object({ id: z.string().min(1), keyId: z.string().min(1) });
+export const groupIdParams = z.object({ id: z.string().min(1) });

package/dist/runtime/shared/schema/registry.d.ts

@@ -0,0 +1,115 @@
+import { z } from 'zod';
+/**
+ * Config-seed contracts for the service registry. Pure zod + local only: this
+ * file is part of the `nuxt-observe/schema` subpath and must never import
+ * node:crypto, #imports, or any server util.
+ */
+export declare const zServiceSeed: z.ZodPipe<z.ZodObject<{
+    slug: z.ZodString;
+    name: z.ZodString;
+    type: z.ZodDefault<z.ZodEnum<{
+        website: "website";
+        webapp: "webapp";
+        api: "api";
+        service: "service";
+        worker: "worker";
+        mobile: "mobile";
+        other: "other";
+    }>>;
+    kind: z.ZodDefault<z.ZodEnum<{
+        server: "server";
+        browser: "browser";
+    }>>;
+    appNames: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    allowedOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+    env: z.ZodOptional<z.ZodString>;
+    versionTracking: z.ZodOptional<z.ZodBoolean>;
+    currentVersion: z.ZodOptional<z.ZodString>;
+    group: z.ZodOptional<z.ZodString>;
+    key: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>, z.ZodTransform<{
+    slug: string;
+    name: string;
+    type: "website" | "webapp" | "api" | "service" | "worker" | "mobile" | "other";
+    kind: "server" | "browser";
+    appNames: string[];
+    allowedOrigins: string[];
+    env?: string | undefined;
+    versionTracking?: boolean | undefined;
+    currentVersion?: string | undefined;
+    group?: string | undefined;
+    key?: string | undefined;
+}, {
+    slug: string;
+    name: string;
+    type: "website" | "webapp" | "api" | "service" | "worker" | "mobile" | "other";
+    kind: "server" | "browser";
+    appNames: string[];
+    allowedOrigins: string[];
+    env?: string | undefined;
+    versionTracking?: boolean | undefined;
+    currentVersion?: string | undefined;
+    group?: string | undefined;
+    key?: string | undefined;
+}>>;
+export declare const zGroupSeed: z.ZodObject<{
+    slug: z.ZodString;
+    name: z.ZodString;
+}, z.core.$strip>;
+export declare const zObserveSeedConfig: z.ZodObject<{
+    services: z.ZodOptional<z.ZodArray<z.ZodPipe<z.ZodObject<{
+        slug: z.ZodString;
+        name: z.ZodString;
+        type: z.ZodDefault<z.ZodEnum<{
+            website: "website";
+            webapp: "webapp";
+            api: "api";
+            service: "service";
+            worker: "worker";
+            mobile: "mobile";
+            other: "other";
+        }>>;
+        kind: z.ZodDefault<z.ZodEnum<{
+            server: "server";
+            browser: "browser";
+        }>>;
+        appNames: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        allowedOrigins: z.ZodDefault<z.ZodArray<z.ZodString>>;
+        env: z.ZodOptional<z.ZodString>;
+        versionTracking: z.ZodOptional<z.ZodBoolean>;
+        currentVersion: z.ZodOptional<z.ZodString>;
+        group: z.ZodOptional<z.ZodString>;
+        key: z.ZodOptional<z.ZodString>;
+    }, z.core.$strip>, z.ZodTransform<{
+        slug: string;
+        name: string;
+        type: "website" | "webapp" | "api" | "service" | "worker" | "mobile" | "other";
+        kind: "server" | "browser";
+        appNames: string[];
+        allowedOrigins: string[];
+        env?: string | undefined;
+        versionTracking?: boolean | undefined;
+        currentVersion?: string | undefined;
+        group?: string | undefined;
+        key?: string | undefined;
+    }, {
+        slug: string;
+        name: string;
+        type: "website" | "webapp" | "api" | "service" | "worker" | "mobile" | "other";
+        kind: "server" | "browser";
+        appNames: string[];
+        allowedOrigins: string[];
+        env?: string | undefined;
+        versionTracking?: boolean | undefined;
+        currentVersion?: string | undefined;
+        group?: string | undefined;
+        key?: string | undefined;
+    }>>>>;
+    groups: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        slug: z.ZodString;
+        name: z.ZodString;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+export type ServiceSeed = z.input<typeof zServiceSeed>;
+export type GroupSeed = z.input<typeof zGroupSeed>;
+export type ObserveSeedConfig = z.input<typeof zObserveSeedConfig>;

package/dist/runtime/shared/schema/registry.js

@@ -0,0 +1,27 @@
+import { z } from "zod";
+import { serviceTypeSchema } from "./provisioning.js";
+export const zServiceSeed = z.object({
+  slug: z.string().min(1),
+  name: z.string().min(1),
+  type: serviceTypeSchema.default("service"),
+  kind: z.enum(["server", "browser"]).default("server"),
+  appNames: z.array(z.string().min(1)).default([]),
+  allowedOrigins: z.array(z.string().min(1)).default([]),
+  // browser origins, or the literal '*'
+  env: z.string().optional(),
+  versionTracking: z.boolean().optional(),
+  currentVersion: z.string().optional(),
+  group: z.string().optional(),
+  // group slug
+  key: z.string().optional()
+  // raw ingest key (from env); hashed at seed time, never stored raw
+  // Declaring allowedOrigins implies a browser source: coerce rather than hard-error for friendlier config.
+}).transform((s) => s.allowedOrigins.length && s.kind === "server" ? { ...s, kind: "browser" } : s);
+export const zGroupSeed = z.object({
+  slug: z.string().min(1),
+  name: z.string().min(1)
+});
+export const zObserveSeedConfig = z.object({
+  services: z.array(zServiceSeed).optional(),
+  groups: z.array(zGroupSeed).optional()
+});

package/dist/runtime/shared/schema/rollout.d.ts

@@ -0,0 +1,103 @@
+import { z } from 'zod';
+/**
+ * Contract for GET /api/observe/rollout/{versions,compare,regressions} (CP13): the
+ * per-version rollout view. Framework-free (zod only + pure fns) so it loads in
+ * node-env unit tests, the Nitro handlers, and the browser composable alike. The DB
+ * query builders live in server/utils/rollout.ts; everything here is pure, matching
+ * the CP12 precedent of keeping node-testable algorithms in shared/schema/*.
+ *
+ * NULL `version` is folded under the '(unversioned)' sentinel everywhere (SQL COALESCE
+ * on the query side, and this constant on the algorithm side) so a NULL never fragments
+ * or vanishes from a GROUP BY.
+ */
+export declare const UNVERSIONED = "(unversioned)";
+export declare const rolloutQuerySchema: z.ZodObject<{
+    period: z.ZodDefault<z.ZodEnum<{
+        "15m": "15m";
+        "1h": "1h";
+        "24h": "24h";
+        "7d": "7d";
+        "30d": "30d";
+    }>>;
+    service: z.ZodOptional<z.ZodString>;
+    group: z.ZodOptional<z.ZodString>;
+    env: z.ZodOptional<z.ZodString>;
+    bucketMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strip>;
+export type RolloutQuery = z.infer<typeof rolloutQuerySchema>;
+export interface VersionStat {
+    /** '(unversioned)' for NULL */
+    version: string;
+    total: number;
+    /** level = 0 count */
+    errors: number;
+    /** errors / total, 0 when total === 0 */
+    errorRate: number;
+    /** MIN(time) */
+    firstSeen: number;
+    /** MAX(time) */
+    lastSeen: number;
+}
+export interface VersionSeries {
+    version: string;
+    /** per-bucket event count, aligned to `buckets`, zero-filled */
+    volume: number[];
+    /** per-bucket errors/total, aligned to `buckets`, 0 for empty buckets */
+    errorRate: number[];
+}
+export interface VersionCompare {
+    /** contiguous ascending bucket start times, ms epoch */
+    buckets: number[];
+    /** one series per distinct version, volume-desc then version-asc for stable ordering */
+    series: VersionSeries[];
+}
+/** Flat grouped row from the CP8-shaped bucketed query, pre-pivot. */
+export interface VersionSeriesRow {
+    b: number;
+    version: string;
+    total: number;
+    errors: number | null;
+}
+export interface RegressionConfig {
+    /** ignore any version below this sample size */
+    minEvents: number;
+    /** absolute error-rate increase threshold (e.g. 0.05) */
+    errorRateDelta: number;
+    /** relative threshold (e.g. 1.5x baseline) */
+    errorRateMultiplier: number;
+    /** candidate must be first-seen within this of `now`; omit to skip the freshness gate */
+    baselineWindowMs?: number;
+}
+export interface RegressionFinding {
+    version: string;
+    errorRate: number;
+    baselineVersion: string | null;
+    baselineErrorRate: number;
+    /** candidate.errorRate - baseline.errorRate */
+    delta: number;
+    /** candidate.errorRate / baseline.errorRate (Infinity when baseline has zero errors) */
+    ratio: number;
+    /** candidate.total */
+    sampleSize: number;
+    severity: 'warn' | 'critical';
+}
+export interface RegressionResponse {
+    /** false when the single ?service has version_tracking = 0 */
+    trackingEnabled: boolean;
+    findings: RegressionFinding[];
+}
+/**
+ * Pivot flat {b, version, total, errors} rows into a chart-ready {buckets, series}.
+ * Pure + DB-free: the bucket-index math mirrors zeroFilledBuckets (floor(time/bucketMs))
+ * but is inlined so this stays free of any server import. Every series is the same
+ * length and aligns to the shared `buckets` x-axis; gaps are zero-filled.
+ */
+export declare function pivotVersionSeries(rows: VersionSeriesRow[], from: number, to: number, bucketMs: number): VersionCompare;
+/**
+ * Deterministic baseline-vs-candidate regression flag. Pure: `now` is injected so
+ * tests are stable and no wall-clock read happens inside. The candidate is the
+ * newest-by-firstSeen versioned build; the baseline is the highest-volume build that
+ * appeared strictly earlier. A spike is flagged only when the candidate clears BOTH
+ * the absolute delta and the relative multiplier over that baseline.
+ */
+export declare function detectRegressions(stats: VersionStat[], config: RegressionConfig, now: number): RegressionFinding[];

package/dist/runtime/shared/schema/rollout.js

@@ -0,0 +1,66 @@
+import { z } from "zod";
+import { PERIODS } from "../utils/period.js";
+export const UNVERSIONED = "(unversioned)";
+export const rolloutQuerySchema = z.object({
+  period: z.enum(PERIODS).default("24h"),
+  /** service slug; resolved to an id and intersected with the caller's scope */
+  service: z.string().optional(),
+  /** group slug; expanded to member ids and intersected with the caller's scope */
+  group: z.string().optional(),
+  /** exact env filter on the log row (matches stats' row-level env) */
+  env: z.string().optional(),
+  /** compare-only bucket-size override in ms; rejected with 400 when it yields > 500 buckets */
+  bucketMs: z.coerce.number().int().positive().optional()
+});
+export function pivotVersionSeries(rows, from, to, bucketMs) {
+  const bFrom = Math.floor(from / bucketMs);
+  const bTo = Math.floor(to / bucketMs);
+  const len = Math.max(0, bTo - bFrom + 1);
+  const buckets = [];
+  for (let i = 0; i < len; i++) buckets.push((bFrom + i) * bucketMs);
+  const byVersion = /* @__PURE__ */ new Map();
+  for (const row of rows) {
+    const idx = row.b - bFrom;
+    if (idx < 0 || idx >= len) continue;
+    let acc = byVersion.get(row.version);
+    if (!acc) {
+      acc = { volume: Array(len).fill(0), errors: Array(len).fill(0), total: 0 };
+      byVersion.set(row.version, acc);
+    }
+    const errors = row.errors ?? 0;
+    acc.volume[idx] = (acc.volume[idx] ?? 0) + row.total;
+    acc.errors[idx] = (acc.errors[idx] ?? 0) + errors;
+    acc.total += row.total;
+  }
+  const series = [...byVersion.entries()].sort((a, b) => b[1].total - a[1].total || a[0].localeCompare(b[0])).map(([version, acc]) => ({
+    version,
+    volume: acc.volume,
+    errorRate: acc.volume.map((v, i) => v ? acc.errors[i] / v : 0)
+  }));
+  return { buckets, series };
+}
+export function detectRegressions(stats, config, now) {
+  const { minEvents, errorRateDelta, errorRateMultiplier, baselineWindowMs } = config;
+  const eligible = stats.filter((s) => s.version !== UNVERSIONED && s.total >= minEvents);
+  if (eligible.length < 2) return [];
+  const sorted = [...eligible].sort((a, b) => a.firstSeen - b.firstSeen);
+  const candidate = sorted[sorted.length - 1];
+  if (baselineWindowMs != null && candidate.firstSeen < now - baselineWindowMs) return [];
+  const earlier = sorted.filter((s) => s.firstSeen < candidate.firstSeen);
+  if (earlier.length === 0) return [];
+  const baseline = earlier.reduce((best, s) => s.total > best.total ? s : best);
+  const delta = candidate.errorRate - baseline.errorRate;
+  const ratio = baseline.errorRate === 0 ? Infinity : candidate.errorRate / baseline.errorRate;
+  const passesMultiplier = baseline.errorRate === 0 || candidate.errorRate >= baseline.errorRate * errorRateMultiplier;
+  if (delta < errorRateDelta || !passesMultiplier) return [];
+  return [{
+    version: candidate.version,
+    errorRate: candidate.errorRate,
+    baselineVersion: baseline.version,
+    baselineErrorRate: baseline.errorRate,
+    delta,
+    ratio,
+    sampleSize: candidate.total,
+    severity: delta >= 2 * errorRateDelta ? "critical" : "warn"
+  }];
+}

package/dist/runtime/shared/schema/stats.d.ts

@@ -0,0 +1,64 @@
+import { z } from 'zod';
+/**
+ * Contract for GET /api/observe/stats (CP8): the bucketed time-series the charts
+ * render. Framework-free (zod only) so it loads in node-env unit tests, the Nitro
+ * handler, and the browser composable alike.
+ */
+export declare const statsQuerySchema: z.ZodObject<{
+    period: z.ZodDefault<z.ZodEnum<{
+        "15m": "15m";
+        "1h": "1h";
+        "24h": "24h";
+        "7d": "7d";
+        "30d": "30d";
+    }>>;
+    service: z.ZodOptional<z.ZodString>;
+    group: z.ZodOptional<z.ZodString>;
+    version: z.ZodOptional<z.ZodString>;
+    level: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+    bucketMs: z.ZodOptional<z.ZodCoercedNumber<unknown>>;
+}, z.core.$strip>;
+export type StatsQuery = z.infer<typeof statsQuerySchema>;
+/** Legend entry for the per-service breakdown; the folded tail is { id: 'other', slug: 'other', name: 'Other' }. */
+export interface StatsSeriesMeta {
+    id: string;
+    slug: string;
+    name: string;
+}
+export interface StatsBucket {
+    /** bucket start, ms epoch, aligned to floor(time / bucketMs) * bucketMs */
+    t: number;
+    count: number;
+    /** level = 0 */
+    errorCount: number;
+    /** level = 1 */
+    warnCount: number;
+    /** serviceId (or 'other') -> count; only top-N + 'other' keys present */
+    byService: Record<string, number>;
+}
+export interface StatsResponse {
+    period: {
+        from: number;
+        to: number;
+        label: string;
+    };
+    /** isAll=true for admin ('*'); serviceIds is [] then, not the full id list */
+    scope: {
+        serviceIds: string[];
+        isAll: boolean;
+    };
+    bucketMs: number;
+    /** zero-filled, contiguous, ascending by t */
+    buckets: StatsBucket[];
+    /** legend for the breakdown chart: top-N by volume desc, + 'other' when folded */
+    services: StatsSeriesMeta[];
+    totals: {
+        count: number;
+        errorCount: number;
+        warnCount: number;
+        /** errorCount / count * 100, 0 when count === 0 */
+        errorRatePct: number;
+    };
+}
+/** The db-derived slice getStats() assembles; the handler adds period + scope + bucketMs. */
+export type StatsData = Pick<StatsResponse, 'buckets' | 'services' | 'totals'>;

package/dist/runtime/shared/schema/stats.js

@@ -0,0 +1,15 @@
+import { z } from "zod";
+import { PERIODS } from "../utils/period.js";
+export const statsQuerySchema = z.object({
+  period: z.enum(PERIODS).default("24h"),
+  /** service slug; resolved to an id and intersected with the caller's scope */
+  service: z.string().optional(),
+  /** group slug; expanded to member service ids and intersected with the caller's scope */
+  group: z.string().optional(),
+  /** exact version filter (rides idx_logs_version) */
+  version: z.string().optional(),
+  /** exact-level filter, 0..5 */
+  level: z.coerce.number().int().min(0).max(5).optional(),
+  /** advanced bucket-size override in ms; rejected with 400 when it yields > 500 buckets */
+  bucketMs: z.coerce.number().int().positive().optional()
+});