rterm-backend 2.9.4 → 2.9.5

package/bin/gybackend.js

@@ -252183,6 +252183,477 @@ var init_orchestratedPlaybookRunner = __esm({
   }
 });
 
+// packages/backend/src/services/apm/spanLedger.ts
+var spanLedger_exports = {};
+__export(spanLedger_exports, {
+  SpanLedger: () => SpanLedger,
+  ingestOtlp: () => ingestOtlp,
+  newSpanId: () => newSpanId,
+  parseOtlpJson: () => parseOtlpJson,
+  stableId: () => stableId
+});
+function percentile(sorted, p) {
+  if (sorted.length === 0) return void 0;
+  return sorted[Math.min(sorted.length - 1, Math.floor(p / 100 * sorted.length))];
+}
+function parseOtlpJson(payload, defaultService = "unknown") {
+  const out = [];
+  const root = payload;
+  const rs = root?.resourceSpans;
+  if (!Array.isArray(rs)) return out;
+  for (const r of rs) {
+    const rr = r;
+    let service = defaultService;
+    const attrs2 = rr?.resource?.attributes ?? [];
+    const svc = attrs2.find((a) => a.key === "service.name")?.value?.stringValue;
+    if (svc) service = svc;
+    const scopeSpans = rr?.scopeSpans;
+    if (!Array.isArray(scopeSpans)) continue;
+    for (const ss of scopeSpans) {
+      const spans = ss?.spans;
+      if (!Array.isArray(spans)) continue;
+      for (const sp of spans) {
+        const s = sp;
+        if (!s.traceId || !s.spanId) continue;
+        const startNs = Number(s.startTimeUnixNano ?? 0);
+        const endNs = Number(s.endTimeUnixNano ?? 0);
+        const startMs = startNs / 1e6;
+        const durationMs = Math.max(0, (endNs - startNs) / 1e6);
+        const isErr = s.status?.code === 2 || s.status?.code === "STATUS_CODE_ERROR" || s.status?.code === "Error";
+        out.push({
+          traceId: String(s.traceId),
+          spanId: String(s.spanId),
+          ...s.parentSpanId ? { parentSpanId: String(s.parentSpanId) } : {},
+          service,
+          name: s.name ?? "span",
+          startMs,
+          durationMs,
+          status: isErr ? "error" : "ok"
+        });
+      }
+    }
+  }
+  return out;
+}
+function ingestOtlp(ledger, payload, defaultService = "unknown") {
+  const spans = parseOtlpJson(payload, defaultService);
+  return ledger.ingestBatch(spans);
+}
+function stableId(seed) {
+  return (0, import_crypto7.createHash)("sha1").update(seed).digest("hex").slice(0, 16);
+}
+function newSpanId() {
+  return (0, import_crypto7.randomUUID)().replace(/-/g, "").slice(0, 16);
+}
+var import_crypto7, DEFAULT_LIMIT, SpanLedger;
+var init_spanLedger = __esm({
+  "packages/backend/src/services/apm/spanLedger.ts"() {
+    "use strict";
+    import_crypto7 = require("crypto");
+    DEFAULT_LIMIT = 5e4;
+    SpanLedger = class {
+      spans = /* @__PURE__ */ new Map();
+      // traceId -> spans
+      order = [];
+      // traceIds in insert order
+      spanLimit;
+      totalSpans = 0;
+      constructor(opts = {}) {
+        this.spanLimit = opts.spanLimit ?? DEFAULT_LIMIT;
+      }
+      /** Ingest one span. */
+      ingest(span) {
+        let arr3 = this.spans.get(span.traceId);
+        if (!arr3) {
+          arr3 = [];
+          this.spans.set(span.traceId, arr3);
+          this.order.push(span.traceId);
+        }
+        arr3.push(span);
+        this.totalSpans += 1;
+        while (this.totalSpans > this.spanLimit && this.order.length > 0) {
+          const oldest = this.order.shift();
+          const old = this.spans.get(oldest) ?? [];
+          this.totalSpans -= old.length;
+          this.spans.delete(oldest);
+        }
+      }
+      /** Ingest many spans. */
+      ingestBatch(spans) {
+        for (const s of spans) this.ingest(s);
+        return spans.length;
+      }
+      /** All spans for a trace. */
+      trace(traceId) {
+        return this.spans.get(traceId) ?? [];
+      }
+      traceIds() {
+        return this.order;
+      }
+      /** Summarize a trace (root service, span count, total duration, error). */
+      summarize(traceId) {
+        const spans = this.spans.get(traceId);
+        if (!spans || spans.length === 0) return void 0;
+        const root = spans.find((s) => !s.parentSpanId) ?? spans[0];
+        const services = Array.from(new Set(spans.map((s) => s.service)));
+        const hasError = spans.some((s) => s.status === "error");
+        const start = Math.min(...spans.map((s) => s.startMs));
+        const end = Math.max(...spans.map((s) => s.startMs + s.durationMs));
+        return {
+          traceId,
+          rootService: root.service,
+          spanCount: spans.length,
+          totalDurationMs: end - start,
+          hasError,
+          services,
+          at: start
+        };
+      }
+      /** Per-service stats over a window. */
+      serviceStats(opts = {}) {
+        const byService = /* @__PURE__ */ new Map();
+        for (const arr3 of this.spans.values()) {
+          for (const s of arr3) {
+            if (opts.sinceMs !== void 0 && s.startMs < opts.sinceMs) continue;
+            if (opts.service && s.service !== opts.service) continue;
+            let e = byService.get(s.service);
+            if (!e) {
+              e = { durations: [], errors: 0 };
+              byService.set(s.service, e);
+            }
+            e.durations.push(s.durationMs);
+            if (s.status === "error") e.errors += 1;
+          }
+        }
+        const out = [];
+        for (const [service, e] of byService) {
+          const durations = e.durations.slice().sort((a, b) => a - b);
+          out.push({
+            service,
+            spanCount: durations.length,
+            errorCount: e.errors,
+            errorRate: durations.length > 0 ? e.errors / durations.length : 0,
+            p50Ms: percentile(durations, 50),
+            p95Ms: percentile(durations, 95),
+            p99Ms: percentile(durations, 99),
+            maxMs: durations.length > 0 ? durations[durations.length - 1] : void 0
+          });
+        }
+        return out.sort((a, b) => (b.p95Ms ?? 0) - (a.p95Ms ?? 0));
+      }
+      /** Slowest traces by total duration. */
+      slowestTraces(limit2 = 10, opts = {}) {
+        const summaries = [];
+        for (const id of this.order) {
+          const s = this.summarize(id);
+          if (!s) continue;
+          if (opts.sinceMs !== void 0 && s.at < opts.sinceMs) continue;
+          summaries.push(s);
+        }
+        return summaries.sort((a, b) => b.totalDurationMs - a.totalDurationMs).slice(0, limit2);
+      }
+      /** Services ranked by total error count (bottleneck/failing services). */
+      bottleneckServices(opts = {}) {
+        return this.serviceStats(opts).sort((a, b) => b.errorCount - a.errorCount);
+      }
+      /** Total stored spans. */
+      size() {
+        return this.totalSpans;
+      }
+      clear() {
+        this.spans.clear();
+        this.order.length = 0;
+        this.totalSpans = 0;
+      }
+    };
+  }
+});
+
+// packages/backend/src/services/infra/infraMonitor.ts
+var infraMonitor_exports = {};
+__export(infraMonitor_exports, {
+  InfraMonitor: () => InfraMonitor,
+  clusterHealth: () => clusterHealth,
+  newClusterContextId: () => newClusterContextId,
+  parseKubectlPods: () => parseKubectlPods,
+  podUnhealthy: () => podUnhealthy
+});
+function parseKubectlPods(text) {
+  const out = [];
+  const lines = text.split(/\r?\n/).map((l) => l.trimEnd()).filter((l) => l.trim() !== "");
+  const header = lines.find((l) => /^NAME(SPACE)?\s+/.test(l));
+  const hasNamespaceCol = header !== void 0 && /^NAMESPACE\s+/.test(header);
+  for (let i = 0; i < lines.length; i += 1) {
+    const l = lines[i];
+    if (/^NAME(SPACE)?\s+/.test(l)) continue;
+    const parts = l.trim().split(/\s+/);
+    const minFields = hasNamespaceCol ? 6 : 5;
+    if (parts.length < minFields) continue;
+    let namespace = "default";
+    let name;
+    let readyFrac;
+    let status;
+    let restartsStr;
+    if (hasNamespaceCol) {
+      ;
+      [namespace, name, readyFrac, status, restartsStr] = parts;
+    } else {
+      ;
+      [name, readyFrac, status, restartsStr] = parts;
+    }
+    const [readyNum, readyDen] = (readyFrac ?? "0/1").split("/").map((x) => parseInt(x, 10));
+    const restarts = parseInt((restartsStr ?? "0").replace(/\D.*$/, ""), 10) || 0;
+    const phase = ["Pending", "Running", "Succeeded", "Failed", "Unknown"].includes(status) ? status : "Unknown";
+    out.push({
+      name,
+      namespace,
+      phase,
+      restarts,
+      ready: readyNum === readyDen && readyDen > 0 && status === "Running"
+    });
+  }
+  return out;
+}
+function clusterHealth(context2, pods, nodes) {
+  const running = pods.filter((p) => p.phase === "Running");
+  const notReady = pods.filter((p) => !p.ready).length;
+  const crashLoop = pods.filter((p) => p.restarts >= 5 || p.phase === "Unknown" && p.restarts > 0).length;
+  const totalRestarts = pods.reduce((s, p) => s + p.restarts, 0);
+  const nodesReady = nodes.filter((n2) => n2.ready).length;
+  let cpuPct;
+  let memPct;
+  const withCpu = pods.filter((p) => typeof p.cpuMillicores === "number" && typeof p.cpuLimitMillicores === "number" && p.cpuLimitMillicores > 0);
+  if (withCpu.length > 0) {
+    const used = withCpu.reduce((s, p) => s + (p.cpuMillicores ?? 0), 0);
+    const limit2 = withCpu.reduce((s, p) => s + (p.cpuLimitMillicores ?? 0), 0);
+    cpuPct = limit2 > 0 ? used / limit2 * 100 : void 0;
+  }
+  const withMem = pods.filter((p) => typeof p.memMiB === "number" && typeof p.memLimitMiB === "number" && p.memLimitMiB > 0);
+  if (withMem.length > 0) {
+    const used = withMem.reduce((s, p) => s + (p.memMiB ?? 0), 0);
+    const limit2 = withMem.reduce((s, p) => s + (p.memLimitMiB ?? 0), 0);
+    memPct = limit2 > 0 ? used / limit2 * 100 : void 0;
+  }
+  return {
+    context: context2,
+    totalPods: pods.length,
+    runningPods: running.length,
+    notReadyPods: notReady,
+    crashLoopPods: crashLoop,
+    totalRestarts,
+    nodesReady,
+    nodesTotal: nodes.length,
+    ...cpuPct !== void 0 ? { cpuUsagePercentOfLimit: cpuPct } : {},
+    ...memPct !== void 0 ? { memUsagePercentOfLimit: memPct } : {}
+  };
+}
+function podUnhealthy(p) {
+  return !p.ready || p.phase === "Failed" || p.phase === "Unknown" || p.restarts >= 5;
+}
+function newClusterContextId(name) {
+  return `k8s-${name}-${(0, import_crypto8.randomUUID)().slice(0, 6)}`;
+}
+var import_crypto8, InfraMonitor;
+var init_infraMonitor = __esm({
+  "packages/backend/src/services/infra/infraMonitor.ts"() {
+    "use strict";
+    import_crypto8 = require("crypto");
+    InfraMonitor = class {
+      clusters = /* @__PURE__ */ new Map();
+      instances = /* @__PURE__ */ new Map();
+      constructor(_deps = {}) {
+      }
+      /** Record a cluster health snapshot. */
+      recordCluster(context2, pods, nodes) {
+        const h = clusterHealth(context2, pods, nodes);
+        this.clusters.set(context2, h);
+        return h;
+      }
+      cluster(context2) {
+        return this.clusters.get(context2);
+      }
+      clusters_() {
+        return Array.from(this.clusters.values());
+      }
+      /** Unhealthy pods for a cluster (for alerting). */
+      unhealthyPods(pods) {
+        return pods.filter(podUnhealthy);
+      }
+      /** Record a cloud instance state. */
+      recordInstance(inst) {
+        this.instances.set(inst.id, inst);
+      }
+      instance(id) {
+        return this.instances.get(id);
+      }
+      /** Instances that are not healthy (stopped/failed). */
+      unhealthyInstances() {
+        return Array.from(this.instances.values()).filter((i) => i.statusOk === false || /stopped|terminated|failed/i.test(i.state));
+      }
+      clear() {
+        this.clusters.clear();
+        this.instances.clear();
+      }
+    };
+  }
+});
+
+// packages/backend/src/services/etw/etwService.ts
+var etwService_exports = {};
+__export(etwService_exports, {
+  ETW_PROVIDERS: () => ETW_PROVIDERS,
+  EtwService: () => EtwService,
+  buildCounterQuery: () => buildCounterQuery,
+  buildStartCommands: () => buildStartCommands,
+  buildStopCommands: () => buildStopCommands,
+  buildWinEventQuery: () => buildWinEventQuery,
+  extractFields: () => extractFields,
+  parseCounterJson: () => parseCounterJson,
+  parseWinEventJson: () => parseWinEventJson,
+  parseWinEventText: () => parseWinEventText,
+  topCounters: () => topCounters
+});
+function buildStartCommands(session) {
+  const cmds = [];
+  for (const kind of session.providers) {
+    const provider = ETW_PROVIDERS[kind];
+    const name = `${session.name}-${kind}`;
+    cmds.push(`logman create trace "${name}" -p "${provider}" -o "${session.outFile}-${kind}.etl" -ets`);
+  }
+  return cmds;
+}
+function buildStopCommands(session) {
+  return session.providers.map((kind) => `logman stop "${session.name}-${kind}" -ets`);
+}
+function buildWinEventQuery(logName, maxEvents = 100, filter) {
+  const filterPart = filter ? ` | Where-Object { ${filter} }` : "";
+  return `Get-WinEvent -LogName '${logName}' -MaxEvents ${maxEvents}${filterPart} | Select-Object TimeCreated,Id,ProviderName,Message | ConvertTo-Json -Depth 3 -Compress`;
+}
+function buildCounterQuery(counterPath, samples = 1) {
+  return `Get-Counter -Counter '${counterPath}' -MaxSamples ${samples} | Select-Object -ExpandProperty CounterSamples | Select-Object Path,CookedValue | ConvertTo-Json -Depth 3 -Compress`;
+}
+function parseWinEventJson(output) {
+  const trimmed = output.trim();
+  if (!trimmed) return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch {
+    return parseWinEventText(trimmed);
+  }
+  const arr3 = Array.isArray(parsed) ? parsed : [parsed];
+  const out = [];
+  for (const item of arr3) {
+    const o = item;
+    if (!o || typeof o !== "object") continue;
+    const message = (o.Message ?? "").toString().trim();
+    if (!message) continue;
+    out.push({
+      at: o.TimeCreated,
+      provider: o.ProviderName,
+      message,
+      fields: extractFields(message)
+    });
+  }
+  return out;
+}
+function parseWinEventText(output) {
+  const out = [];
+  const blocks2 = output.split(/\r?\n\r?\n/);
+  for (const b of blocks2) {
+    const msg = b.trim();
+    if (!msg) continue;
+    out.push({ message: msg.split(/\r?\n/).slice(0, 4).join(" "), fields: extractFields(msg) });
+  }
+  return out;
+}
+function extractFields(message) {
+  const fields = {};
+  const ip = message.match(/\b(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})\b/);
+  if (ip) fields.ip = ip[1];
+  const port = message.match(/[Pp]ort[:\s]+(\d{1,5})/);
+  if (port) fields.port = port[1];
+  const path32 = message.match(/([A-Za-z]:\\[^\s"',;]+)/);
+  if (path32) fields.path = path32[1];
+  const key = message.match(/(HKLM|HKCU|HKCR|HKU)\\[^\s"',;]+/i);
+  if (key) fields.key = key[0];
+  const proc = message.match(/[Pp]rocess(?:Name)?[:\s]+([A-Za-z0-9_.-]+\.exe)/);
+  if (proc) fields.processName = proc[1];
+  const pid = message.match(/[Pp]rocess\s*[Ii]d[:\s]+(\d+)/);
+  if (pid) fields.pid = pid[1];
+  return fields;
+}
+function parseCounterJson(output) {
+  const trimmed = output.trim();
+  if (!trimmed) return [];
+  let parsed;
+  try {
+    parsed = JSON.parse(trimmed);
+  } catch {
+    return [];
+  }
+  const arr3 = Array.isArray(parsed) ? parsed : [parsed];
+  const out = [];
+  for (const item of arr3) {
+    const o = item;
+    if (!o || o.Path === void 0) continue;
+    const value = typeof o.CookedValue === "number" ? o.CookedValue : parseFloat(String(o.CookedValue ?? "NaN"));
+    if (Number.isFinite(value)) out.push({ path: o.Path, value });
+  }
+  return out;
+}
+function topCounters(points, n2 = 5) {
+  return points.slice().sort((a, b) => b.value - a.value).slice(0, n2);
+}
+var import_crypto9, ETW_PROVIDERS, now0, EtwService;
+var init_etwService = __esm({
+  "packages/backend/src/services/etw/etwService.ts"() {
+    "use strict";
+    import_crypto9 = require("crypto");
+    ETW_PROVIDERS = {
+      network: "Microsoft-Windows-Kernel-Network",
+      file: "Microsoft-Windows-Kernel-File",
+      registry: "Microsoft-Windows-Kernel-Registry",
+      process: "Microsoft-Windows-Kernel-Process",
+      dns: "Microsoft-Windows-DNS-Client",
+      power: "Microsoft-Windows-Kernel-Power"
+    };
+    now0 = () => Date.now();
+    EtwService = class {
+      sessions = /* @__PURE__ */ new Map();
+      now;
+      constructor(deps = {}) {
+        this.now = deps.now ?? now0;
+      }
+      /** Create a session descriptor (commands are built from it by buildStartCommands). */
+      createSession(name, providers, outDir = "C:\\temp") {
+        const clean = name.replace(/[^A-Za-z0-9_-]/g, "");
+        const s = {
+          id: `etw-${(0, import_crypto9.randomUUID)().slice(0, 8)}`,
+          name: clean,
+          providers,
+          outFile: `${outDir}\\${clean}`,
+          createdAt: this.now()
+        };
+        this.sessions.set(s.id, s);
+        return s;
+      }
+      session(id) {
+        return this.sessions.get(id);
+      }
+      sessions_() {
+        return Array.from(this.sessions.values());
+      }
+      removeSession(id) {
+        return this.sessions.delete(id);
+      }
+      clear() {
+        this.sessions.clear();
+      }
+    };
+  }
+});
+
 // packages/backend/src/services/history/HistorySqliteStore.ts
 var HistorySqliteStore_exports = {};
 __export(HistorySqliteStore_exports, {
@@ -254755,7 +255226,7 @@ var require_websocket = __commonJS({
     var http2 = require("http");
     var net2 = require("net");
     var tls = require("tls");
-    var { randomBytes: randomBytes3, createHash: createHash6 } = require("crypto");
+    var { randomBytes: randomBytes3, createHash: createHash7 } = require("crypto");
     var { Duplex, Readable } = require("stream");
     var { URL: URL5 } = require("url");
     var PerMessageDeflate = require_permessage_deflate();
@@ -255415,7 +255886,7 @@ var require_websocket = __commonJS({
           abortHandshake(websocket, socket, "Invalid Upgrade header");
           return;
         }
-        const digest = createHash6("sha1").update(key + GUID).digest("base64");
+        const digest = createHash7("sha1").update(key + GUID).digest("base64");
         if (res.headers["sec-websocket-accept"] !== digest) {
           abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
           return;
@@ -255782,7 +256253,7 @@ var require_websocket_server = __commonJS({
     var EventEmitter4 = require("events");
     var http2 = require("http");
     var { Duplex } = require("stream");
-    var { createHash: createHash6 } = require("crypto");
+    var { createHash: createHash7 } = require("crypto");
     var extension = require_extension();
     var PerMessageDeflate = require_permessage_deflate();
     var subprotocol = require_subprotocol();
@@ -256083,7 +256554,7 @@ var require_websocket_server = __commonJS({
           );
         }
         if (this._state > RUNNING) return abortHandshake(socket, 503);
-        const digest = createHash6("sha1").update(key + GUID).digest("base64");
+        const digest = createHash7("sha1").update(key + GUID).digest("base64");
         const headers = [
           "HTTP/1.1 101 Switching Protocols",
           "Upgrade: websocket",
@@ -342379,6 +342850,30 @@ var BUILTIN_TOOL_INFO = [
   {
     name: "get_live_dashboard",
     description: "Live multi-client dashboard \u2014 read the current unified dashboard state/summary, or the number of connected dashboard subscribers."
+  },
+  {
+    name: "ingest_apm_spans",
+    description: "Ingest OTLP/HTTP-JSON distributed-trace spans into the APM trace store (feeds bottleneck/slowest-trace analysis and the dashboard APM section)."
+  },
+  {
+    name: "get_apm_summary",
+    description: "Read the APM summary \u2014 traces, spans, per-service error rates and p95 latency."
+  },
+  {
+    name: "ingest_dem_beacon",
+    description: "Ingest a Core Web Vitals RUM beacon (page, LCP/INP/CLS/TTFB, JS errors) into the DEM store (feeds per-page p75 + error rate and the dashboard DEM section)."
+  },
+  {
+    name: "get_dem_summary",
+    description: "Read the DEM summary \u2014 sessions, pages, p75 Core Web Vitals, error rate."
+  },
+  {
+    name: "collect_infra",
+    description: "Collect Kubernetes cluster health \u2014 runs `kubectl get pods -A -o json` (or accepts the payload), feeds the infra monitor (pod readiness, restarts, CrashLoopBackOff)."
+  },
+  {
+    name: "manage_etw",
+    description: "Windows ETW diagnostics \u2014 start/stop a trace (logman), parse captured Get-WinEvent/Get-Counter output, list sessions. Use against a Windows host for network/file/registry/process/DNS diagnostics."
   }
 ];
 function buildReadFileDescription(support) {
@@ -346791,6 +347286,152 @@ async function getLiveDashboard(args, context2) {
   emit9(context2, "get_live_dashboard", args, out);
   return out;
 }
+var ingestApmSpansSchema = external_exports.object({
+  payload: external_exports.any().describe("OTLP/HTTP-JSON payload: {resourceSpans:[...]} with spans (traceId/spanId/name/startTimeUnixNano/endTimeUnixNano/status)."),
+  defaultService: external_exports.string().optional().describe("Fallback service name when a span has none.")
+});
+async function ingestApmSpans(args, context2) {
+  const { o, msg } = obs(context2, "ingest_apm_spans", args);
+  if (!o) return msg;
+  const { ingestOtlp: ingestOtlp2 } = await Promise.resolve().then(() => (init_spanLedger(), spanLedger_exports));
+  const n2 = ingestOtlp2(o.spanLedger, args.payload, args.defaultService);
+  const out = `Ingested ${n2} APM span(s) into the trace store.`;
+  emit9(context2, "ingest_apm_spans", args, out);
+  return out;
+}
+var getApmSummarySchema = external_exports.object({});
+async function getApmSummary(_args, context2) {
+  const { o, msg } = obs(context2, "get_apm_summary", _args);
+  if (!o) return msg;
+  const stats = o.spanLedger.serviceStats();
+  const out = stats.length ? `APM: ${o.spanLedger.size()} spans across ${stats.length} service(s). ` + stats.map((x) => `${x.service}(${x.spans}${x.errors ? ", " + x.errors + " err" : ""})`).join(", ") : "APM: no spans ingested yet.";
+  emit9(context2, "get_apm_summary", _args, out);
+  return out;
+}
+var ingestDemBeaconSchema = external_exports.object({
+  payload: external_exports.any().describe("RUM beacon: {page, route?, region?, userAgent?, lcpMs?, inpMs?, cls?, ttfbMs?, jsErrors?, at?}.")
+});
+async function ingestDemBeacon(args, context2) {
+  const { o, msg } = obs(context2, "ingest_dem_beacon", args);
+  if (!o) return msg;
+  const s = o.rumLedger.ingestBeacon(args.payload);
+  const out = s ? `Ingested RUM beacon for ${s.page}${s.lcpMs ? ` (LCP ${s.lcpMs}ms)` : ""}.` : "Beacon ignored \u2014 needs a `page` field.";
+  emit9(context2, "ingest_dem_beacon", args, out);
+  return out;
+}
+var getDemSummarySchema = external_exports.object({});
+async function getDemSummary(_args, context2) {
+  const { o, msg } = obs(context2, "get_dem_summary", _args);
+  if (!o) return msg;
+  const pages = o.rumLedger.pageStats();
+  const out = pages.length ? `DEM: ${o.rumLedger.size()} sessions across ${pages.length} page(s). ` + pages.map((p) => `${p.page}(${p.sessions}${p.errorRate ? `, ${(p.errorRate * 100).toFixed(0)}% err` : ""})`).join(", ") : "DEM: no RUM sessions ingested yet.";
+  emit9(context2, "get_dem_summary", _args, out);
+  return out;
+}
+var collectInfraSchema = external_exports.object({
+  context: external_exports.string().optional().describe("Cluster context name (default 'default')."),
+  kubectlJson: external_exports.any().optional().describe("Parsed `kubectl get pods -A -o json` payload (or its text). If omitted, runs kubectl on the local shell.")
+});
+async function collectInfra(args, context2) {
+  const { o, msg } = obs(context2, "collect_infra", args);
+  if (!o) return msg;
+  const { parseKubectlPods: parseKubectlPods2 } = await Promise.resolve().then(() => (init_infraMonitor(), infraMonitor_exports));
+  const clusterCtx = args.context ?? "default";
+  let out;
+  try {
+    let payload = args.kubectlJson;
+    if (payload === void 0) {
+      const { execFile: execFile2 } = await import("node:child_process");
+      payload = await new Promise((resolve2, reject) => {
+        execFile2("kubectl", ["get", "pods", "-A"], { timeout: 3e4, maxBuffer: 16 * 1024 * 1024 }, (err, stdout) => {
+          if (err) return reject(err);
+          resolve2(stdout);
+        });
+      });
+    }
+    const text = typeof payload === "string" ? payload : JSON.stringify(payload);
+    let pods = parseKubectlPods2(text);
+    if (pods.length === 0 && typeof payload === "object" && payload !== null) {
+      const jsonObj = payload;
+      const items = jsonObj.items ?? [];
+      const table = ["NAMESPACE NAME READY STATUS RESTARTS AGE", ...items.map((it) => {
+        const ns = it.metadata?.namespace ?? "default";
+        const name = it.metadata?.name ?? "pod";
+        const cs = it.status?.containerStatuses ?? [];
+        const ready = `${cs.filter((c) => c.ready).length}/${cs.length || 1}`;
+        const status = it.status?.phase ?? "Unknown";
+        const restarts = String(cs.reduce((s, c) => s + (c.restartCount ?? 0), 0));
+        return `${ns} ${name} ${ready} ${status} ${restarts} 1d`;
+      })].join("\n");
+      pods = parseKubectlPods2(table);
+    }
+    const health = o.infraMonitor.recordCluster(clusterCtx, pods, []);
+    out = `k8s ${clusterCtx}: ${pods.length} pods, ${health.notReadyPods} not-ready, ${health.crashLoopPods} CrashLoopBackOff.`;
+  } catch (e) {
+    out = `infra collect failed (kubectl or cluster unavailable): ${e instanceof Error ? e.message : String(e)}`;
+  }
+  emit9(context2, "collect_infra", args, out);
+  return out;
+}
+var manageEtwSchema = external_exports.object({
+  action: external_exports.enum(["start", "stop", "parse", "sessions"]).describe("start a trace, stop it, parse captured output, or list sessions."),
+  name: external_exports.string().optional().describe("Trace name (start)."),
+  providers: external_exports.array(external_exports.enum(["network", "file", "registry", "process", "dns", "power"])).optional().describe("ETW providers to trace (start)."),
+  sessionId: external_exports.string().optional().describe("Session id (stop)."),
+  output: external_exports.string().optional().describe("Captured Get-WinEvent/Get-Counter output (parse)."),
+  format: external_exports.enum(["winevent", "counter"]).optional().describe("Parse format (parse).")
+});
+async function manageEtw(args, context2) {
+  const { o, msg } = obs(context2, "manage_etw", args);
+  if (!o) return msg;
+  const svc = o.etwService;
+  let out;
+  try {
+    if (args.action === "start") {
+      if (!args.name || !args.providers?.length) {
+        out = "start requires name + providers.";
+      } else {
+        const s = svc.createSession(args.name, args.providers);
+        const { buildStartCommands: buildStartCommands2 } = await Promise.resolve().then(() => (init_etwService(), etwService_exports));
+        out = `ETW session ${s.id} created (${args.providers.join(", ")}). Start commands:
+${buildStartCommands2(s).join("\n")}`;
+      }
+    } else if (args.action === "stop") {
+      if (!args.sessionId) {
+        out = "stop requires sessionId.";
+      } else {
+        const s = svc.session(args.sessionId);
+        if (!s) {
+          out = `No ETW session ${args.sessionId}.`;
+        } else {
+          const { buildStopCommands: buildStopCommands2 } = await Promise.resolve().then(() => (init_etwService(), etwService_exports));
+          out = `Stop commands for ${args.sessionId}:
+${buildStopCommands2(s).join("\n")}`;
+        }
+      }
+    } else if (args.action === "parse") {
+      if (!args.output) {
+        out = "parse requires output.";
+      } else {
+        const { parseWinEventJson: parseWinEventJson2, parseWinEventText: parseWinEventText2, parseCounterJson: parseCounterJson2 } = await Promise.resolve().then(() => (init_etwService(), etwService_exports));
+        if (args.format === "counter") {
+          const c = parseCounterJson2(args.output);
+          out = `${c.length} counter sample(s).`;
+        } else {
+          const ev = parseWinEventJson2(args.output) ?? parseWinEventText2(args.output);
+          out = `${ev.length} event(s) parsed.`;
+        }
+      }
+    } else {
+      const sessions = svc.sessions_();
+      out = sessions.length ? sessions.map((s) => `- ${s.id} (${s.name}): ${s.providers.join(",")}`).join("\n") : "No ETW sessions.";
+    }
+  } catch (e) {
+    out = `etw error: ${e instanceof Error ? e.message : String(e)}`;
+  }
+  emit9(context2, "manage_etw", args, out);
+  return out;
+}
 
 // packages/backend/src/services/AgentHelper/tools/skill_tools.ts
 var skillToolSchema = external_exports.object({
@@ -347104,6 +347745,36 @@ function buildToolsForModel(readFileSupport) {
       name: "get_live_dashboard",
       description: "Live multi-client dashboard \u2014 read the current unified dashboard state/summary, or the number of connected dashboard subscribers.",
       schema: getLiveDashboardSchema
+    },
+    {
+      name: "ingest_apm_spans",
+      description: "Ingest OTLP/HTTP-JSON distributed-trace spans into the APM trace store (feeds bottleneck/slowest-trace analysis and the dashboard APM section).",
+      schema: ingestApmSpansSchema
+    },
+    {
+      name: "get_apm_summary",
+      description: "Read the APM summary \u2014 traces, spans, per-service error rates and p95 latency.",
+      schema: getApmSummarySchema
+    },
+    {
+      name: "ingest_dem_beacon",
+      description: "Ingest a Core Web Vitals RUM beacon (page, LCP/INP/CLS/TTFB, JS errors) into the DEM store (feeds per-page p75 + error rate and the dashboard DEM section).",
+      schema: ingestDemBeaconSchema
+    },
+    {
+      name: "get_dem_summary",
+      description: "Read the DEM summary \u2014 sessions, pages, p75 Core Web Vitals, error rate.",
+      schema: getDemSummarySchema
+    },
+    {
+      name: "collect_infra",
+      description: "Collect Kubernetes cluster health \u2014 runs `kubectl get pods -A -o json` (or accepts the payload), feeds the infra monitor (pod readiness, restarts, CrashLoopBackOff).",
+      schema: collectInfraSchema
+    },
+    {
+      name: "manage_etw",
+      description: "Windows ETW diagnostics \u2014 start/stop a trace (logman), parse captured Get-WinEvent/Get-Counter output, list sessions. Use against a Windows host for network/file/registry/process/DNS diagnostics.",
+      schema: manageEtwSchema
     }
   ].map((tool2) => convertToOpenAITool(tool2));
 }
@@ -347149,6 +347820,12 @@ var toolImplementations = {
   managePlaybookVersion,
   getCloudInventory,
   getLiveDashboard,
+  ingestApmSpans,
+  getApmSummary,
+  ingestDemBeacon,
+  getDemSummary,
+  collectInfra,
+  manageEtw,
   writeFile,
   editFile,
   writeAndEdit,
@@ -361696,6 +362373,60 @@ Actually, your intention might be different. Please re-read the description of t
           }
           break;
         }
+        case "ingest_apm_spans": {
+          try {
+            const validatedArgs = ingestApmSpansSchema.parse(toolCall.args || {});
+            result = await toolImplementations.ingestApmSpans(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for ingest_apm_spans: ${err.message}`;
+          }
+          break;
+        }
+        case "get_apm_summary": {
+          try {
+            const validatedArgs = getApmSummarySchema.parse(toolCall.args || {});
+            result = await toolImplementations.getApmSummary(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for get_apm_summary: ${err.message}`;
+          }
+          break;
+        }
+        case "ingest_dem_beacon": {
+          try {
+            const validatedArgs = ingestDemBeaconSchema.parse(toolCall.args || {});
+            result = await toolImplementations.ingestDemBeacon(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for ingest_dem_beacon: ${err.message}`;
+          }
+          break;
+        }
+        case "get_dem_summary": {
+          try {
+            const validatedArgs = getDemSummarySchema.parse(toolCall.args || {});
+            result = await toolImplementations.getDemSummary(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for get_dem_summary: ${err.message}`;
+          }
+          break;
+        }
+        case "collect_infra": {
+          try {
+            const validatedArgs = collectInfraSchema.parse(toolCall.args || {});
+            result = await toolImplementations.collectInfra(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for collect_infra: ${err.message}`;
+          }
+          break;
+        }
+        case "manage_etw": {
+          try {
+            const validatedArgs = manageEtwSchema.parse(toolCall.args || {});
+            result = await toolImplementations.manageEtw(validatedArgs, executionContext);
+          } catch (err) {
+            result = `Parameter validation error for manage_etw: ${err.message}`;
+          }
+          break;
+        }
         case "manage_device_memory": {
           try {
             const validatedArgs = manageDeviceMemorySchema.parse(toolCall.args || {});
@@ -377698,7 +378429,7 @@ var AgentSettingProfileService = class {
 };
 
 // packages/backend/src/services/automation/triggerEngine.ts
-var import_crypto7 = require("crypto");
+var import_crypto10 = require("crypto");
 var DEFAULT_COOLDOWN_S = 300;
 var HISTORY_LIMIT_DEFAULT2 = 200;
 var MAX_CONCURRENT_DEFAULT = 3;
@@ -377742,7 +378473,7 @@ var TriggerEngine = class {
     }
     const entry = {
       ...input,
-      id: input.id ?? `trg-${(0, import_crypto7.randomUUID)().slice(0, 8)}`,
+      id: input.id ?? `trg-${(0, import_crypto10.randomUUID)().slice(0, 8)}`,
       createdAt: this.now(),
       fireCount: 0
     };
@@ -377847,7 +378578,7 @@ var TriggerEngine = class {
     t.lastFiredAt = now;
     t.fireCount = (t.fireCount ?? 0) + 1;
     const rec = {
-      id: `fire-${(0, import_crypto7.randomUUID)().slice(0, 8)}`,
+      id: `fire-${(0, import_crypto10.randomUUID)().slice(0, 8)}`,
       triggerId: t.id,
       triggerName: t.name,
       at: now,
@@ -377939,7 +378670,7 @@ var import_node_module2 = require("node:module");
 var import_node_path27 = __toESM(require("node:path"), 1);
 
 // packages/backend/src/services/sre/metricsLedger.ts
-var DEFAULT_LIMIT = 1e4;
+var DEFAULT_LIMIT2 = 1e4;
 function flattenSnapshot(host, snap) {
   const p = { host, at: snap.timestamp };
   if (snap.cpu && typeof snap.cpu.usagePercent === "number") p.cpuUsagePercent = snap.cpu.usagePercent;
@@ -377963,7 +378694,7 @@ var MetricsLedger = class {
   points = /* @__PURE__ */ new Map();
   perHostLimit;
   constructor(opts = {}) {
-    this.perHostLimit = opts.perHostLimit ?? DEFAULT_LIMIT;
+    this.perHostLimit = opts.perHostLimit ?? DEFAULT_LIMIT2;
   }
   /** Ingest a resource snapshot for a host. Returns the stored point. */
   record(host, snap) {
@@ -378042,7 +378773,7 @@ var MetricsLedger = class {
 
 // packages/backend/src/services/sre/goldenSignals.ts
 var DEFAULT_WINDOW = 36e5;
-function percentile(sorted, p) {
+function percentile2(sorted, p) {
   if (sorted.length === 0) return void 0;
   const rank = Math.max(1, Math.ceil(p / 100 * sorted.length));
   return sorted[Math.min(rank, sorted.length) - 1];
@@ -378071,9 +378802,9 @@ var GoldenSignals = class {
     if (this.deps.latencyFor) {
       const samples = this.deps.latencyFor(host, since).map((s) => s.ms).sort((a, b) => a - b);
       if (samples.length > 0) {
-        r.latencyP50Ms = percentile(samples, 50);
-        r.latencyP95Ms = percentile(samples, 95);
-        r.latencyP99Ms = percentile(samples, 99);
+        r.latencyP50Ms = percentile2(samples, 50);
+        r.latencyP95Ms = percentile2(samples, 95);
+        r.latencyP99Ms = percentile2(samples, 99);
       }
     }
     if (this.deps.errorRateFor) {
@@ -378104,7 +378835,7 @@ var GoldenSignals = class {
 };
 
 // packages/backend/src/services/sre/sloService.ts
-var import_crypto8 = require("crypto");
+var import_crypto11 = require("crypto");
 var DEFAULT_FAST_BURN = 2;
 var SloService = class {
   constructor(deps) {
@@ -378128,7 +378859,7 @@ var SloService = class {
     }
     const entry = {
       ...def,
-      id: def.id ?? `slo-${(0, import_crypto8.randomUUID)().slice(0, 8)}`,
+      id: def.id ?? `slo-${(0, import_crypto11.randomUUID)().slice(0, 8)}`,
       createdAt: this.now()
     };
     this.slos.set(entry.id, entry);
@@ -378195,7 +378926,7 @@ var SloService = class {
 };
 
 // packages/backend/src/services/sre/uptimeWatchdog.ts
-var import_crypto9 = require("crypto");
+var import_crypto12 = require("crypto");
 var UptimeWatchdog = class {
   constructor(deps) {
     this.deps = deps;
@@ -378207,7 +378938,7 @@ var UptimeWatchdog = class {
   upsert(target) {
     const t = {
       ...target,
-      id: target.id ?? `wt-${(0, import_crypto9.randomUUID)().slice(0, 8)}`,
+      id: target.id ?? `wt-${(0, import_crypto12.randomUUID)().slice(0, 8)}`,
       downAfter: target.downAfter ?? 3,
       intervalMs: target.intervalMs ?? 6e4
     };
@@ -378306,7 +379037,7 @@ var UptimeWatchdog = class {
 };
 
 // packages/backend/src/services/sre/alertService.ts
-var import_crypto10 = require("crypto");
+var import_crypto13 = require("crypto");
 var SEV_ORDER = { info: 0, warning: 1, critical: 2 };
 var DEFAULT_DEDUPE_MS = 3e5;
 var DEFAULT_HISTORY = 200;
@@ -378331,7 +379062,7 @@ var AlertService = class {
   }
   /** Create a silence that suppresses matching alerts until `untilMs`. */
   silence(matcher, untilMs, opts = {}) {
-    const s = { id: `sil-${(0, import_crypto10.randomUUID)().slice(0, 8)}`, matcher, until: untilMs, ...opts };
+    const s = { id: `sil-${(0, import_crypto13.randomUUID)().slice(0, 8)}`, matcher, until: untilMs, ...opts };
     this.silences.set(s.id, s);
     return s;
   }
@@ -378428,8 +379159,8 @@ var AlertService = class {
 };
 
 // packages/backend/src/services/sre/incidentLedger.ts
-var import_crypto11 = require("crypto");
-var DEFAULT_LIMIT2 = 500;
+var import_crypto14 = require("crypto");
+var DEFAULT_LIMIT3 = 500;
 var IncidentLedger = class {
   incidents = /* @__PURE__ */ new Map();
   order = [];
@@ -378437,7 +379168,7 @@ var IncidentLedger = class {
   historyLimit;
   constructor(opts = {}) {
     this.now = opts.now ?? (() => Date.now());
-    this.historyLimit = opts.historyLimit ?? DEFAULT_LIMIT2;
+    this.historyLimit = opts.historyLimit ?? DEFAULT_LIMIT3;
   }
   /** Create (or return the existing open incident for the same title+source). */
   create(input) {
@@ -378450,7 +379181,7 @@ var IncidentLedger = class {
     }
     const at = this.now();
     const inc = {
-      id: `inc-${(0, import_crypto11.randomUUID)().slice(0, 8)}`,
+      id: `inc-${(0, import_crypto14.randomUUID)().slice(0, 8)}`,
       title: input.title,
       severity: input.severity ?? "sev3",
       status: "open",
@@ -378550,12 +379281,12 @@ Linked playbook: ${inc.runbookPlaybookId}` : ""
 };
 
 // packages/backend/src/services/sre/syntheticChecks.ts
-var DEFAULT_LIMIT3 = 1e3;
+var DEFAULT_LIMIT4 = 1e3;
 var SyntheticChecks = class {
   constructor(deps) {
     this.deps = deps;
     this.now = deps.now ?? (() => Date.now());
-    this.perCheckLimit = deps.perCheckLimit ?? DEFAULT_LIMIT3;
+    this.perCheckLimit = deps.perCheckLimit ?? DEFAULT_LIMIT4;
   }
   checks = /* @__PURE__ */ new Map();
   results = /* @__PURE__ */ new Map();
@@ -378673,7 +379404,7 @@ var SyntheticChecks = class {
 };
 
 // packages/backend/src/services/sre/driftDetector.ts
-var import_crypto12 = require("crypto");
+var import_crypto15 = require("crypto");
 function normalize2(text, ignorePatterns = []) {
   const lines = text.split(/\r?\n/).map((l) => l.trimEnd()).filter((l) => l.trim() !== "");
   const regexes = ignorePatterns.map((p) => {
@@ -378709,7 +379440,7 @@ var DriftDetector = class {
   lastResults = /* @__PURE__ */ new Map();
   now;
   upsert(target) {
-    const t = { ...target, id: target.id ?? `drift-${(0, import_crypto12.randomUUID)().slice(0, 8)}` };
+    const t = { ...target, id: target.id ?? `drift-${(0, import_crypto15.randomUUID)().slice(0, 8)}` };
     this.targets.set(t.id, t);
     return t;
   }
@@ -378769,130 +379500,11 @@ var DriftDetector = class {
   }
 };
 
-// packages/backend/src/services/apm/spanLedger.ts
-var DEFAULT_LIMIT4 = 5e4;
-function percentile2(sorted, p) {
-  if (sorted.length === 0) return void 0;
-  return sorted[Math.min(sorted.length - 1, Math.floor(p / 100 * sorted.length))];
-}
-var SpanLedger = class {
-  spans = /* @__PURE__ */ new Map();
-  // traceId -> spans
-  order = [];
-  // traceIds in insert order
-  spanLimit;
-  totalSpans = 0;
-  constructor(opts = {}) {
-    this.spanLimit = opts.spanLimit ?? DEFAULT_LIMIT4;
-  }
-  /** Ingest one span. */
-  ingest(span) {
-    let arr3 = this.spans.get(span.traceId);
-    if (!arr3) {
-      arr3 = [];
-      this.spans.set(span.traceId, arr3);
-      this.order.push(span.traceId);
-    }
-    arr3.push(span);
-    this.totalSpans += 1;
-    while (this.totalSpans > this.spanLimit && this.order.length > 0) {
-      const oldest = this.order.shift();
-      const old = this.spans.get(oldest) ?? [];
-      this.totalSpans -= old.length;
-      this.spans.delete(oldest);
-    }
-  }
-  /** Ingest many spans. */
-  ingestBatch(spans) {
-    for (const s of spans) this.ingest(s);
-    return spans.length;
-  }
-  /** All spans for a trace. */
-  trace(traceId) {
-    return this.spans.get(traceId) ?? [];
-  }
-  traceIds() {
-    return this.order;
-  }
-  /** Summarize a trace (root service, span count, total duration, error). */
-  summarize(traceId) {
-    const spans = this.spans.get(traceId);
-    if (!spans || spans.length === 0) return void 0;
-    const root = spans.find((s) => !s.parentSpanId) ?? spans[0];
-    const services = Array.from(new Set(spans.map((s) => s.service)));
-    const hasError = spans.some((s) => s.status === "error");
-    const start = Math.min(...spans.map((s) => s.startMs));
-    const end = Math.max(...spans.map((s) => s.startMs + s.durationMs));
-    return {
-      traceId,
-      rootService: root.service,
-      spanCount: spans.length,
-      totalDurationMs: end - start,
-      hasError,
-      services,
-      at: start
-    };
-  }
-  /** Per-service stats over a window. */
-  serviceStats(opts = {}) {
-    const byService = /* @__PURE__ */ new Map();
-    for (const arr3 of this.spans.values()) {
-      for (const s of arr3) {
-        if (opts.sinceMs !== void 0 && s.startMs < opts.sinceMs) continue;
-        if (opts.service && s.service !== opts.service) continue;
-        let e = byService.get(s.service);
-        if (!e) {
-          e = { durations: [], errors: 0 };
-          byService.set(s.service, e);
-        }
-        e.durations.push(s.durationMs);
-        if (s.status === "error") e.errors += 1;
-      }
-    }
-    const out = [];
-    for (const [service, e] of byService) {
-      const durations = e.durations.slice().sort((a, b) => a - b);
-      out.push({
-        service,
-        spanCount: durations.length,
-        errorCount: e.errors,
-        errorRate: durations.length > 0 ? e.errors / durations.length : 0,
-        p50Ms: percentile2(durations, 50),
-        p95Ms: percentile2(durations, 95),
-        p99Ms: percentile2(durations, 99),
-        maxMs: durations.length > 0 ? durations[durations.length - 1] : void 0
-      });
-    }
-    return out.sort((a, b) => (b.p95Ms ?? 0) - (a.p95Ms ?? 0));
-  }
-  /** Slowest traces by total duration. */
-  slowestTraces(limit2 = 10, opts = {}) {
-    const summaries = [];
-    for (const id of this.order) {
-      const s = this.summarize(id);
-      if (!s) continue;
-      if (opts.sinceMs !== void 0 && s.at < opts.sinceMs) continue;
-      summaries.push(s);
-    }
-    return summaries.sort((a, b) => b.totalDurationMs - a.totalDurationMs).slice(0, limit2);
-  }
-  /** Services ranked by total error count (bottleneck/failing services). */
-  bottleneckServices(opts = {}) {
-    return this.serviceStats(opts).sort((a, b) => b.errorCount - a.errorCount);
-  }
-  /** Total stored spans. */
-  size() {
-    return this.totalSpans;
-  }
-  clear() {
-    this.spans.clear();
-    this.order.length = 0;
-    this.totalSpans = 0;
-  }
-};
+// packages/backend/src/services/observability.ts
+init_spanLedger();
 
 // packages/backend/src/services/dem/rumLedger.ts
-var import_crypto13 = require("crypto");
+var import_crypto16 = require("crypto");
 var DEFAULT_LIMIT5 = 5e4;
 function percentile3(sorted, p) {
   if (sorted.length === 0) return void 0;
@@ -378910,7 +379522,7 @@ var RumLedger = class {
   ingest(session) {
     const s = {
       ...session,
-      id: session.id ?? `rum-${(0, import_crypto13.randomUUID)().slice(0, 12)}`,
+      id: session.id ?? `rum-${(0, import_crypto16.randomUUID)().slice(0, 12)}`,
       at: session.at ?? this.now()
     };
     this.sessions.push(s);
@@ -378988,116 +379600,9 @@ var RumLedger = class {
   }
 };
 
-// packages/backend/src/services/infra/infraMonitor.ts
-function clusterHealth(context2, pods, nodes) {
-  const running = pods.filter((p) => p.phase === "Running");
-  const notReady = pods.filter((p) => !p.ready).length;
-  const crashLoop = pods.filter((p) => p.restarts >= 5 || p.phase === "Unknown" && p.restarts > 0).length;
-  const totalRestarts = pods.reduce((s, p) => s + p.restarts, 0);
-  const nodesReady = nodes.filter((n2) => n2.ready).length;
-  let cpuPct;
-  let memPct;
-  const withCpu = pods.filter((p) => typeof p.cpuMillicores === "number" && typeof p.cpuLimitMillicores === "number" && p.cpuLimitMillicores > 0);
-  if (withCpu.length > 0) {
-    const used = withCpu.reduce((s, p) => s + (p.cpuMillicores ?? 0), 0);
-    const limit2 = withCpu.reduce((s, p) => s + (p.cpuLimitMillicores ?? 0), 0);
-    cpuPct = limit2 > 0 ? used / limit2 * 100 : void 0;
-  }
-  const withMem = pods.filter((p) => typeof p.memMiB === "number" && typeof p.memLimitMiB === "number" && p.memLimitMiB > 0);
-  if (withMem.length > 0) {
-    const used = withMem.reduce((s, p) => s + (p.memMiB ?? 0), 0);
-    const limit2 = withMem.reduce((s, p) => s + (p.memLimitMiB ?? 0), 0);
-    memPct = limit2 > 0 ? used / limit2 * 100 : void 0;
-  }
-  return {
-    context: context2,
-    totalPods: pods.length,
-    runningPods: running.length,
-    notReadyPods: notReady,
-    crashLoopPods: crashLoop,
-    totalRestarts,
-    nodesReady,
-    nodesTotal: nodes.length,
-    ...cpuPct !== void 0 ? { cpuUsagePercentOfLimit: cpuPct } : {},
-    ...memPct !== void 0 ? { memUsagePercentOfLimit: memPct } : {}
-  };
-}
-function podUnhealthy(p) {
-  return !p.ready || p.phase === "Failed" || p.phase === "Unknown" || p.restarts >= 5;
-}
-var InfraMonitor = class {
-  clusters = /* @__PURE__ */ new Map();
-  instances = /* @__PURE__ */ new Map();
-  constructor(_deps = {}) {
-  }
-  /** Record a cluster health snapshot. */
-  recordCluster(context2, pods, nodes) {
-    const h = clusterHealth(context2, pods, nodes);
-    this.clusters.set(context2, h);
-    return h;
-  }
-  cluster(context2) {
-    return this.clusters.get(context2);
-  }
-  clusters_() {
-    return Array.from(this.clusters.values());
-  }
-  /** Unhealthy pods for a cluster (for alerting). */
-  unhealthyPods(pods) {
-    return pods.filter(podUnhealthy);
-  }
-  /** Record a cloud instance state. */
-  recordInstance(inst) {
-    this.instances.set(inst.id, inst);
-  }
-  instance(id) {
-    return this.instances.get(id);
-  }
-  /** Instances that are not healthy (stopped/failed). */
-  unhealthyInstances() {
-    return Array.from(this.instances.values()).filter((i) => i.statusOk === false || /stopped|terminated|failed/i.test(i.state));
-  }
-  clear() {
-    this.clusters.clear();
-    this.instances.clear();
-  }
-};
-
-// packages/backend/src/services/etw/etwService.ts
-var import_crypto14 = require("crypto");
-var now0 = () => Date.now();
-var EtwService = class {
-  sessions = /* @__PURE__ */ new Map();
-  now;
-  constructor(deps = {}) {
-    this.now = deps.now ?? now0;
-  }
-  /** Create a session descriptor (commands are built from it by buildStartCommands). */
-  createSession(name, providers, outDir = "C:\\temp") {
-    const clean = name.replace(/[^A-Za-z0-9_-]/g, "");
-    const s = {
-      id: `etw-${(0, import_crypto14.randomUUID)().slice(0, 8)}`,
-      name: clean,
-      providers,
-      outFile: `${outDir}\\${clean}`,
-      createdAt: this.now()
-    };
-    this.sessions.set(s.id, s);
-    return s;
-  }
-  session(id) {
-    return this.sessions.get(id);
-  }
-  sessions_() {
-    return Array.from(this.sessions.values());
-  }
-  removeSession(id) {
-    return this.sessions.delete(id);
-  }
-  clear() {
-    this.sessions.clear();
-  }
-};
+// packages/backend/src/services/observability.ts
+init_infraMonitor();
+init_etwService();
 
 // packages/backend/src/services/dashboard/dashboardService.ts
 var DEFAULT_LIMIT6 = 10;
@@ -381916,7 +382421,7 @@ var safeLoadAll = renamed("safeLoadAll", "loadAll");
 var safeDump = renamed("safeDump", "dump");
 
 // packages/backend/src/services/dagu/daguParser.ts
-var import_crypto15 = require("crypto");
+var import_crypto17 = require("crypto");
 init_dagScheduler();
 function stepId(step, index2) {
   return (step.id ?? step.name ?? `step-${index2 + 1}`).toString().replace(/[^A-Za-z0-9_-]/g, "-");
@@ -381979,7 +382484,7 @@ function parseDaguWorkflow(doc, opts = {}) {
     return { name, ...d !== "" ? { defaultValue: d } : {} };
   }) : void 0;
   const playbook = {
-    id: `dagu-${(0, import_crypto15.randomUUID)().slice(0, 8)}`,
+    id: `dagu-${(0, import_crypto17.randomUUID)().slice(0, 8)}`,
     name: opts.name ?? doc.name ?? "dagu workflow",
     steps,
     ...doc.description || opts.description ? { description: opts.description ?? doc.description } : {},
@@ -382008,7 +382513,7 @@ function daguExecutionPlan(playbook) {
 // packages/backend/src/services/plugin/pluginRegistry.ts
 var import_node_path26 = __toESM(require("node:path"), 1);
 var import_node_fs11 = require("node:fs");
-var import_crypto16 = require("crypto");
+var import_crypto18 = require("crypto");
 var DEFAULT_ENTRY_CANDIDATES = ["index.js", "index.ts", "index.mjs"];
 var PluginRegistry = class {
   constructor(opts) {
@@ -382075,7 +382580,7 @@ var PluginRegistry = class {
       this.plugins.delete(existing.id);
     }
     const record2 = {
-      id: `plugin-${(0, import_crypto16.randomUUID)().slice(0, 8)}`,
+      id: `plugin-${(0, import_crypto18.randomUUID)().slice(0, 8)}`,
       dir,
       manifest,
       enabled: true,
@@ -382170,7 +382675,7 @@ var PluginRegistry = class {
 };
 
 // packages/backend/src/services/evals/evalHarness.ts
-var import_crypto17 = require("crypto");
+var import_crypto19 = require("crypto");
 function subset(needles, haystack) {
   return needles.every((n2) => haystack.includes(n2));
 }
@@ -382233,7 +382738,7 @@ var EvalHarness = class {
       return arr3.length > 0 ? arr3.filter((r) => r.pass).length / arr3.length * 100 : void 0;
     };
     return {
-      id: `eval-${(0, import_crypto17.randomUUID)().slice(0, 8)}`,
+      id: `eval-${(0, import_crypto19.randomUUID)().slice(0, 8)}`,
       at: this.now(),
       total: results.length,
       passed,
@@ -382516,7 +383021,7 @@ var BehaviorLedger = class {
 };
 
 // packages/backend/src/services/aperf/aperfService.ts
-var import_crypto18 = require("crypto");
+var import_crypto20 = require("crypto");
 var DEFAULT_HOST_DIR = "/tmp/aperf";
 var DEFAULT_INTERVAL = 1;
 var DEFAULT_PERIOD = 60;
@@ -382615,7 +383120,7 @@ var AperfService = class {
   now;
   /** Full deep-dive: install aperf if needed, record, report, parse, return. */
   async deepDive(host, opts = {}) {
-    const runName = `rterm-${(0, import_crypto18.randomUUID)().slice(0, 8)}`;
+    const runName = `rterm-${(0, import_crypto20.randomUUID)().slice(0, 8)}`;
     const plan = {
       runName,
       intervalSec: opts.intervalSec ?? DEFAULT_INTERVAL,
@@ -382658,18 +383163,18 @@ function aperfSummaryToMetricPoint(result) {
 }
 
 // packages/backend/src/services/audit/auditLedger.ts
-var import_crypto19 = require("crypto");
+var import_crypto21 = require("crypto");
 var GENESIS_HASH = "0".repeat(64);
 function computeRecordHash(kind, actor, target, summary, detail, at, seq2) {
   const payload = JSON.stringify({ kind, actor, target, summary, detail, at, seq: seq2 });
-  return (0, import_crypto19.createHash)("sha256").update(payload).digest("hex");
+  return (0, import_crypto21.createHash)("sha256").update(payload).digest("hex");
 }
 var AuditLedger = class _AuditLedger {
   records = [];
   hashFn;
   now;
   constructor(deps = {}) {
-    this.hashFn = deps.hashFn ?? ((data) => (0, import_crypto19.createHash)("sha256").update(data).digest("hex"));
+    this.hashFn = deps.hashFn ?? ((data) => (0, import_crypto21.createHash)("sha256").update(data).digest("hex"));
     this.now = deps.now ?? (() => Date.now());
   }
   /** Append an event to the audit ledger. Returns the record with hash + chain. */
@@ -382686,9 +383191,9 @@ var AuditLedger = class _AuditLedger {
       at,
       seq2
     );
-    const hash2 = (0, import_crypto19.createHash)("sha256").update(contentHash + prevHash).digest("hex");
+    const hash2 = (0, import_crypto21.createHash)("sha256").update(contentHash + prevHash).digest("hex");
     const record2 = {
-      id: `audit-${(0, import_crypto19.randomUUID)().slice(0, 12)}`,
+      id: `audit-${(0, import_crypto21.randomUUID)().slice(0, 12)}`,
       kind: event.kind,
       actor: event.actor,
       target: event.target,
@@ -382739,7 +383244,7 @@ var AuditLedger = class _AuditLedger {
         record2.at,
         record2.seq
       );
-      const expectedHash = (0, import_crypto19.createHash)("sha256").update(expectedContentHash + record2.prevHash).digest("hex");
+      const expectedHash = (0, import_crypto21.createHash)("sha256").update(expectedContentHash + record2.prevHash).digest("hex");
       if (record2.hash !== expectedHash) {
         return { valid: false, brokenAt: record2.seq, detail: `hash mismatch at seq ${record2.seq}` };
       }
@@ -382786,7 +383291,7 @@ var AuditLedger = class _AuditLedger {
 };
 
 // packages/backend/src/services/audit/evidenceSealer.ts
-var import_crypto20 = require("crypto");
+var import_crypto22 = require("crypto");
 function computeMerkleRoot(hashes) {
   if (hashes.length === 0) return "0".repeat(64);
   if (hashes.length === 1) return hashes[0];
@@ -382794,7 +383299,7 @@ function computeMerkleRoot(hashes) {
   for (let i = 0; i < hashes.length; i += 2) {
     const left = hashes[i];
     const right = i + 1 < hashes.length ? hashes[i + 1] : left;
-    nextLevel.push((0, import_crypto20.createHash)("sha256").update(left + right).digest("hex"));
+    nextLevel.push((0, import_crypto22.createHash)("sha256").update(left + right).digest("hex"));
   }
   return computeMerkleRoot(nextLevel);
 }
@@ -383275,17 +383780,17 @@ var OtelExporter = class {
 };
 
 // packages/backend/src/services/secrets/secretsVault.ts
-var import_crypto21 = require("crypto");
+var import_crypto23 = require("crypto");
 var KEY_RE = /^[a-zA-Z0-9][a-zA-Z0-9._/-]{0,127}$/;
 var NONCE_LEN = 12;
 function deriveKey(masterKey, salt) {
-  return (0, import_crypto21.scryptSync)(masterKey, salt, 32);
+  return (0, import_crypto23.scryptSync)(masterKey, salt, 32);
 }
 function defaultSalt(masterKey) {
-  return (0, import_crypto21.createHash)("sha256").update(Buffer.concat([Buffer.from("rterm-secrets-v1"), Buffer.from(masterKey)])).digest().subarray(0, 16);
+  return (0, import_crypto23.createHash)("sha256").update(Buffer.concat([Buffer.from("rterm-secrets-v1"), Buffer.from(masterKey)])).digest().subarray(0, 16);
 }
 function encryptSecret(plaintext, key, nonce) {
-  const cipher = (0, import_crypto21.createCipheriv)("aes-256-gcm", key, nonce);
+  const cipher = (0, import_crypto23.createCipheriv)("aes-256-gcm", key, nonce);
   const ct = Buffer.concat([cipher.update(plaintext, "utf8"), cipher.final()]);
   const tag = cipher.getAuthTag();
   return Buffer.concat([nonce, tag, ct]).toString("base64");
@@ -383296,7 +383801,7 @@ function decryptSecret(blob, key) {
   const nonce = buf.subarray(0, NONCE_LEN);
   const tag = buf.subarray(NONCE_LEN, NONCE_LEN + 16);
   const ct = buf.subarray(NONCE_LEN + 16);
-  const decipher = (0, import_crypto21.createDecipheriv)("aes-256-gcm", key, nonce);
+  const decipher = (0, import_crypto23.createDecipheriv)("aes-256-gcm", key, nonce);
   decipher.setAuthTag(tag);
   return Buffer.concat([decipher.update(ct), decipher.final()]).toString("utf8");
 }
@@ -383308,7 +383813,7 @@ var SecretsVault = class {
   onAudit;
   constructor(opts = {}) {
     this.now = opts.now ?? Date.now;
-    this.rand = opts.randomBytes ?? import_crypto21.randomBytes;
+    this.rand = opts.randomBytes ?? import_crypto23.randomBytes;
     this.onAudit = opts.onAudit;
     if (opts.masterKey !== void 0) {
       const salt = opts.salt ?? defaultSalt(opts.masterKey);
@@ -383424,7 +383929,7 @@ var SecretsVault = class {
 };
 
 // packages/backend/src/services/oncall/escalationService.ts
-var import_crypto22 = require("crypto");
+var import_crypto24 = require("crypto");
 var EscalationService = class {
   policies = /* @__PURE__ */ new Map();
   pages = /* @__PURE__ */ new Map();
@@ -383464,7 +383969,7 @@ var EscalationService = class {
     if (!policy) throw new Error(`unknown escalation policy: ${input.policyId}`);
     const at = this.now();
     const page = {
-      id: (0, import_crypto22.randomUUID)(),
+      id: (0, import_crypto24.randomUUID)(),
       incidentId: input.incidentId,
       policyId: input.policyId,
       levelIndex: 0,
@@ -383678,7 +384183,7 @@ var CostBudgetService = class {
 };
 
 // packages/backend/src/services/recording/sessionRecorder.ts
-var import_crypto23 = require("crypto");
+var import_crypto25 = require("crypto");
 function toAsciinema(rec) {
   const header = {
     version: 2,
@@ -383707,7 +384212,7 @@ var SessionRecorder = class {
   }
   /** Start recording a terminal. Returns the recording id. */
   start(terminalId, opts = {}) {
-    const id = (0, import_crypto23.randomUUID)();
+    const id = (0, import_crypto25.randomUUID)();
     this.recordings.set(id, {
       id,
       terminalId,
@@ -383772,7 +384277,7 @@ var SessionRecorder = class {
 };
 
 // packages/backend/src/services/gitops/gitOpsService.ts
-var import_crypto24 = require("crypto");
+var import_crypto26 = require("crypto");
 function stableStringify(v) {
   if (v === null || typeof v !== "object") return JSON.stringify(v);
   if (Array.isArray(v)) return `[${v.map(stableStringify).join(",")}]`;
@@ -383780,11 +384285,11 @@ function stableStringify(v) {
   return `{${Object.keys(o).sort().map((k) => `${JSON.stringify(k)}:${stableStringify(o[k])}`).join(",")}}`;
 }
 function specHash(spec) {
-  return (0, import_crypto24.createHash)("sha256").update(stableStringify(spec)).digest("hex").slice(0, 12);
+  return (0, import_crypto26.createHash)("sha256").update(stableStringify(spec)).digest("hex").slice(0, 12);
 }
 function buildManifest(entities) {
   const sorted = [...entities].sort((a, b) => a.id.localeCompare(b.id));
-  const stateHash = (0, import_crypto24.createHash)("sha256").update(sorted.map((e) => `${e.id}:${specHash(e.spec)}`).join("\n")).digest("hex");
+  const stateHash = (0, import_crypto26.createHash)("sha256").update(sorted.map((e) => `${e.id}:${specHash(e.spec)}`).join("\n")).digest("hex");
   return { version: 1, stateHash, entities: sorted };
 }
 function specDiff(repo, live) {
@@ -383877,9 +384382,9 @@ var GitOpsService = class {
 };
 
 // packages/backend/src/services/automation/playbookVersioning.ts
-var import_crypto25 = require("crypto");
+var import_crypto27 = require("crypto");
 function hashDef(def) {
-  return (0, import_crypto25.createHash)("sha256").update(JSON.stringify(def)).digest("hex").slice(0, 16);
+  return (0, import_crypto27.createHash)("sha256").update(JSON.stringify(def)).digest("hex").slice(0, 16);
 }
 function lintPlaybook(def) {
   const issues = [];
@@ -384070,7 +384575,7 @@ function diffText(aText, bText, aLabel = "a", bLabel = "b") {
 }
 
 // packages/backend/src/services/cloud/cloudInventory.ts
-var import_crypto26 = require("crypto");
+var import_crypto28 = require("crypto");
 function parseAwsInstances(payload, accountId = "") {
   const out = [];
   const reservations = payload?.Reservations ?? [];
@@ -384083,7 +384588,7 @@ function parseAwsInstances(payload, accountId = "") {
         if (t?.Key) tags[t.Key] = t.Value ?? "";
       }
       out.push({
-        id: `aws:${accountId}:${String(i.InstanceId ?? (0, import_crypto26.randomUUID)())}`,
+        id: `aws:${accountId}:${String(i.InstanceId ?? (0, import_crypto28.randomUUID)())}`,
         provider: "aws",
         kind: "instance",
         name: tags["Name"] ?? String(i.InstanceId ?? ""),
@@ -384115,7 +384620,7 @@ function parseGcpInstances(payload, accountId = "") {
     const accessCfgs = nics[0]?.accessConfigs ?? [];
     const publicIp = accessCfgs[0]?.natIP;
     out.push({
-      id: `gcp:${accountId}:${String(i.id ?? i.name ?? (0, import_crypto26.randomUUID)())}`,
+      id: `gcp:${accountId}:${String(i.id ?? i.name ?? (0, import_crypto28.randomUUID)())}`,
       provider: "gcp",
       kind: "instance",
       name: String(i.name ?? ""),
@@ -384137,7 +384642,7 @@ function parseAzureVms(payload, accountId = "") {
     const v = vm;
     const props = v.properties ?? {};
     out.push({
-      id: `azure:${accountId}:${String(v.id ?? v.name ?? (0, import_crypto26.randomUUID)())}`,
+      id: `azure:${accountId}:${String(v.id ?? v.name ?? (0, import_crypto28.randomUUID)())}`,
       provider: "azure",
       kind: "vm",
       name: String(v.name ?? ""),
@@ -384760,6 +385265,69 @@ function createObservabilityBridge(deps) {
       requireObs(deps).cloud.addAccount(params);
       return { ok: true };
     },
+    // ── APM (OTLP span ingestion) ───────────────────────────────────────────
+    apmIngestSpans: async (params) => {
+      const { ingestOtlp: ingestOtlp2 } = await Promise.resolve().then(() => (init_spanLedger(), spanLedger_exports));
+      const count = ingestOtlp2(requireObs(deps).spanLedger, params.payload, params.defaultService);
+      return { ingested: count };
+    },
+    apmSummary: async () => ({
+      spans: requireObs(deps).spanLedger.size(),
+      traces: requireObs(deps).spanLedger.traceIds().length,
+      byService: requireObs(deps).spanLedger.serviceStats()
+    }),
+    // ── DEM (RUM beacon ingestion) ──────────────────────────────────────────
+    demIngestBeacon: async (params) => {
+      const s = requireObs(deps).rumLedger.ingestBeacon(params.payload);
+      return { ingested: s !== void 0, id: s?.id };
+    },
+    demSummary: async () => ({
+      sessions: requireObs(deps).rumLedger.size(),
+      byPage: requireObs(deps).rumLedger.pageStats()
+    }),
+    // ── Infra (k8s collect) ─────────────────────────────────────────────────
+    infraCollect: async (params) => {
+      const { parseKubectlPods: parseKubectlPods2 } = await Promise.resolve().then(() => (init_infraMonitor(), infraMonitor_exports));
+      const context2 = params.context ?? "default";
+      let podsPayload = params.kubectlJson;
+      if (podsPayload === void 0) {
+        if (!params.execKubectl) throw new Error("infraCollect needs kubectlJson or an injected execKubectl");
+        podsPayload = await params.execKubectl();
+      }
+      const text = typeof podsPayload === "string" ? podsPayload : JSON.stringify(podsPayload);
+      let pods = parseKubectlPods2(text);
+      if (pods.length === 0 && typeof podsPayload === "object" && podsPayload !== null) {
+        const items = podsPayload.items ?? [];
+        const table = ["NAMESPACE NAME READY STATUS RESTARTS AGE", ...items.map((it) => {
+          const ns = it.metadata?.namespace ?? "default";
+          const name = it.metadata?.name ?? "pod";
+          const cs = it.status?.containerStatuses ?? [];
+          const ready = `${cs.filter((c) => c.ready).length}/${cs.length || 1}`;
+          const status = it.status?.phase ?? "Unknown";
+          const restarts = String(cs.reduce((s, c) => s + (c.restartCount ?? 0), 0));
+          return `${ns} ${name} ${ready} ${status} ${restarts} 1d`;
+        })].join("\n");
+        pods = parseKubectlPods2(table);
+      }
+      const health = requireObs(deps).infraMonitor.recordCluster(context2, pods, []);
+      return { context: context2, pods: pods.length, notReady: health.notReadyPods, crashLoop: health.crashLoopPods };
+    },
+    infraClusters: async () => requireObs(deps).infraMonitor.clusters_(),
+    infraUnhealthy: async () => requireObs(deps).infraMonitor.unhealthyInstances(),
+    // ── ETW (Windows trace) ─────────────────────────────────────────────────
+    etwStartTrace: async (params) => requireObs(deps).etwService.createSession(params.name, params.providers, params.outDir),
+    etwStopTrace: async (params) => {
+      const s = requireObs(deps).etwService.session(params.sessionId);
+      if (!s) throw new Error(`etw session not found: ${params.sessionId}`);
+      const { buildStopCommands: buildStopCommands2 } = await Promise.resolve().then(() => (init_etwService(), etwService_exports));
+      return { commands: buildStopCommands2(s) };
+    },
+    etwParse: async (params) => {
+      const { parseWinEventJson: parseWinEventJson2, parseWinEventText: parseWinEventText2, parseCounterJson: parseCounterJson2 } = await Promise.resolve().then(() => (init_etwService(), etwService_exports));
+      if (params.format === "counter") return { counters: parseCounterJson2(params.output) };
+      return { events: parseWinEventJson2(params.output) ?? parseWinEventText2(params.output) };
+    },
+    etwSessions: async () => requireObs(deps).etwService.sessions_(),
     // ── live dashboard hub ──────────────────────────────────────────────────
     liveDashboardState: async () => requireObs(deps).liveDashboard.lastState() ?? await requireObs(deps).dashboard.state(),
     liveDashboardSubscriberCount: async () => ({ count: requireObs(deps).liveDashboard.subscriberCount() }),