@autter/otlp-ingester 1.3.3 → 1.4.0

package/dist/clickhouse.d.ts

@@ -2,6 +2,7 @@ import type { IngesterConfig } from "./config.js";
 import { type LatencyHistogram } from "./latency.js";
 import { type ProfileSample } from "./profiles.js";
 import { type MemorySample, type PlatformEvent } from "./memory.js";
+import { type RuntimeLogRecord } from "./logs.js";
 import { type Migration } from "./migrations.js";
 import type { IngestContext, RuntimeLlmCall, RuntimeMetricPoint, RuntimeOccurrence, RuntimeSpanRow } from "./types.js";
 export declare class ClickHouseStore {
@@ -25,6 +26,7 @@ export declare class ClickHouseStore {
     ping(): Promise<boolean>;
     insertOccurrences(ctx: IngestContext, occurrences: RuntimeOccurrence[]): Promise<void>;
     insertSpans(ctx: IngestContext, spans: RuntimeSpanRow[]): Promise<void>;
+    insertLogs(ctx: IngestContext, logs: RuntimeLogRecord[]): Promise<void>;
     insertProfileSamples(ctx: IngestContext, samples: ProfileSample[]): Promise<void>;
     insertMemorySamples(ctx: IngestContext, samples: MemorySample[]): Promise<void>;
     insertPlatformEvent(ctx: IngestContext, event: PlatformEvent): Promise<void>;

package/dist/clickhouse.js

@@ -3,6 +3,7 @@ import { latencyTableDDL } from "./latency.js";
 import { profileTableDDL } from "./profiles.js";
 import { memoryTableDDL, platformEventTableDDL } from "./memory.js";
 import { sourceMapTableDDL } from "./source-maps.js";
+import { logTableDDL } from "./logs.js";
 import { MIGRATIONS, migrationsTableDDL, } from "./migrations.js";
 /**
  * ClickHouse persistence. The schema is idempotent and applied lazily once
@@ -53,6 +54,7 @@ export class ClickHouseStore {
             memoryTableDDL(db),
             platformEventTableDDL(db),
             sourceMapTableDDL(db),
+            logTableDDL(db),
             `CREATE TABLE IF NOT EXISTS ${db}.runtime_error_occurrences (
 				org_id             String,
 				repository_id      String,
@@ -265,6 +267,19 @@ export class ClickHouseStore {
             })),
         });
     }
+    async insertLogs(ctx, logs) {
+        if (!logs.length)
+            return;
+        if (!this.configured)
+            throw new Error("CLICKHOUSE_URL is not configured");
+        await this.ensureSchema();
+        await this.getClient().insert({ table: this.table("runtime_logs"), format: "JSONEachRow", clickhouse_settings: INSERT_SETTINGS,
+            values: logs.map((row) => ({ org_id: ctx.orgId, repository_id: ctx.repositoryId, event_id: row.id,
+                service: row.service, environment: row.environment, release: row.release, trace_id: row.traceId,
+                span_id: row.spanId, operation_id: row.operationId, operation: row.operation, event_type: row.type,
+                severity: row.severity, message: row.message, outcome: row.outcome, duration_ms: row.durationMs,
+                attributes: JSON.stringify(row.attributes), occurred_at: row.occurredAt.toISOString() })) });
+    }
     async insertProfileSamples(ctx, samples) {
         if (!samples.length)
             return;

package/dist/context.d.ts

@@ -0,0 +1,19 @@
+/** Bounded, defensive privacy boundary for custom telemetry from any OTLP SDK. */
+export declare function sanitizeRuntimeContext(input: unknown): Record<string, unknown>;
+export interface OtlpValue {
+    stringValue?: string;
+    intValue?: string | number;
+    doubleValue?: number;
+    boolValue?: boolean;
+    arrayValue?: {
+        values?: OtlpValue[];
+    };
+    kvlistValue?: {
+        values?: OtlpAttribute[];
+    };
+}
+export interface OtlpAttribute {
+    key?: string;
+    value?: OtlpValue;
+}
+export declare function decodeOtlpAttributes(attributes: OtlpAttribute[] | undefined): Record<string, unknown>;

package/dist/context.js

@@ -0,0 +1,92 @@
+/** Bounded, defensive privacy boundary for custom telemetry from any OTLP SDK. */
+export function sanitizeRuntimeContext(input) {
+    let budget = 512;
+    const seen = new WeakSet();
+    const scrub = (value) => value
+        .replace(/[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}/gi, "[redacted]")
+        .replace(/\b(?:bearer\s+[A-Za-z0-9._~+\/=~-]{10,}|eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+|gh[pousr]_[A-Za-z0-9]{20,}|sk-[A-Za-z0-9_-]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|autter_(?:rt|pat)_[A-Za-z0-9_-]{10,}|(?:AKIA|ASIA)[A-Z0-9]{16})\b/gi, "[redacted]")
+        .replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g, "[redacted]")
+        .replace(/([a-z][a-z0-9+.-]*:\/\/)[^\s/:@]+:[^\s/@]+@/gi, "$1[redacted]@")
+        .replace(/(https?:\/\/[^\s?#]+)[?#][^\s]*/gi, "$1");
+    const visit = (value, key, depth) => {
+        if (--budget < 0 || depth > 6)
+            return "[truncated]";
+        if (/__proto__|constructor|prototype/i.test(key))
+            return undefined;
+        const usage = /(?:^|\.)(?:input|output|total|prompt|completion)_?tokens$/i.test(key) &&
+            typeof value === "number" &&
+            Number.isFinite(value) &&
+            value >= 0;
+        if (!usage &&
+            /password|passwd|secret|token|credential|authorization|cookie|email|phone|ssn|card[._-]?number|connection[._-]?string|api[._-]?key|private[._-]?key|request[._-]?body|response[._-]?body|headers|url[._-]?query/i.test(key))
+            return "[redacted]";
+        if (typeof value === "string") {
+            // Serialized custom context crosses the same privacy boundary as nested values.
+            if (/^\s*[\[{]/.test(value)) {
+                try {
+                    return visit(JSON.parse(value), key, depth + 1);
+                }
+                catch {
+                    /* plain text */
+                }
+            }
+            const text = /(?:url|path|route|target)$/i.test(key)
+                ? value.split(/[?#]/)[0]
+                : value;
+            return scrub(text).slice(0, /stack/i.test(key) ? 32000 : 2048);
+        }
+        if (typeof value === "number")
+            return Number.isFinite(value) ? value : undefined;
+        if (typeof value === "boolean" || value === null)
+            return value;
+        if (!value || typeof value !== "object")
+            return undefined;
+        if (seen.has(value))
+            return "[circular]";
+        seen.add(value);
+        if (Array.isArray(value))
+            return value.slice(0, 64).map((v) => visit(v, key, depth + 1));
+        const result = {};
+        for (const [k, v] of Object.entries(value).slice(0, 128)) {
+            const safe = visit(v, k, depth + 1);
+            if (safe !== undefined)
+                result[k.slice(0, 200)] = safe;
+        }
+        return result;
+    };
+    const result = visit(input, "", 0);
+    return result && typeof result === "object" && !Array.isArray(result)
+        ? result
+        : {};
+}
+export function decodeOtlpAttributes(attributes) {
+    const decode = (v, depth = 0) => {
+        if (!v || depth > 6)
+            return undefined;
+        if (v.stringValue !== undefined)
+            return v.stringValue;
+        if (v.intValue !== undefined)
+            return Number(v.intValue);
+        if (v.doubleValue !== undefined)
+            return v.doubleValue;
+        if (v.boolValue !== undefined)
+            return v.boolValue;
+        if (v.arrayValue)
+            return (v.arrayValue.values ?? [])
+                .slice(0, 64)
+                .map((value) => decode(value, depth + 1));
+        if (v.kvlistValue)
+            return Object.fromEntries((v.kvlistValue.values ?? [])
+                .slice(0, 128)
+                .filter((a) => a.key && !/^(?:__proto__|constructor|prototype)$/.test(a.key))
+                .map((a) => [a.key, decode(a.value, depth + 1)]));
+        return undefined;
+    };
+    return sanitizeRuntimeContext(Object.fromEntries((attributes ?? [])
+        .slice()
+        .sort((a, b) => Number(/^autter\.(?:operation|event)\./.test(b.key ?? "")) -
+        Number(/^autter\.(?:operation|event)\./.test(a.key ?? "")))
+        .slice(0, 128)
+        .filter((a) => a.key && !/^(?:__proto__|constructor|prototype)$/.test(a.key))
+        .map((a) => [a.key, decode(a.value)])));
+}

package/dist/logs.d.ts

@@ -0,0 +1,42 @@
+import { type OtlpAttribute, type OtlpValue } from "./context.js";
+export interface RuntimeLogRecord {
+    id: string;
+    service: string;
+    environment: string;
+    release: string;
+    traceId: string;
+    spanId: string;
+    operationId: string;
+    operation: string;
+    type: "log" | "operation";
+    severity: string;
+    message: string;
+    outcome: string;
+    durationMs: number;
+    attributes: Record<string, unknown>;
+    occurredAt: Date;
+}
+export interface OtlpLogsRequest {
+    resourceLogs?: Array<{
+        resource?: {
+            attributes?: OtlpAttribute[];
+        };
+        scopeLogs?: Array<{
+            scope?: {
+                name?: string;
+            };
+            logRecords?: Array<{
+                timeUnixNano?: string | number;
+                observedTimeUnixNano?: string | number;
+                severityNumber?: number;
+                severityText?: string;
+                traceId?: string;
+                spanId?: string;
+                body?: OtlpValue;
+                attributes?: OtlpAttribute[];
+            }>;
+        }>;
+    }>;
+}
+export declare function normalizeLogs(request: OtlpLogsRequest): RuntimeLogRecord[];
+export declare function logTableDDL(db: string): string;

package/dist/logs.js

@@ -0,0 +1,126 @@
+import { createHash } from "node:crypto";
+import { decodeOtlpAttributes, sanitizeRuntimeContext, } from "./context.js";
+import { normalizeRoute } from "./fingerprint.js";
+export function normalizeLogs(request) {
+    if (!request || !Array.isArray(request.resourceLogs))
+        throw new Error("resourceLogs must be an array");
+    const rows = [];
+    if (request.resourceLogs.length > 128)
+        throw new Error("too many log resources");
+    for (const resource of request.resourceLogs) {
+        if (!resource ||
+            (resource.scopeLogs && !Array.isArray(resource.scopeLogs)) ||
+            (resource.scopeLogs?.length ?? 0) > 128)
+            throw new Error("invalid log scopes");
+        const info = decodeOtlpAttributes(resource.resource?.attributes);
+        for (const scope of resource.scopeLogs ?? []) {
+            if (!scope || (scope.logRecords && !Array.isArray(scope.logRecords)))
+                throw new Error("invalid log records");
+            for (const record of scope.logRecords ?? []) {
+                if (!record || typeof record !== "object")
+                    throw new Error("invalid log record");
+                if (rows.length >= 2000)
+                    throw new Error("too many log records");
+                const attrs = decodeOtlpAttributes(record.attributes);
+                let event = {};
+                const decodedBody = decodeOtlpAttributes([
+                    { key: "event", value: record.body },
+                ]).event;
+                const body = typeof decodedBody === "string"
+                    ? decodedBody
+                    : decodedBody == null
+                        ? ""
+                        : JSON.stringify(decodedBody);
+                if (decodedBody &&
+                    typeof decodedBody === "object" &&
+                    !Array.isArray(decodedBody))
+                    event = sanitizeRuntimeContext(decodedBody);
+                const metadata = Object.fromEntries(Object.entries(attrs).filter(([key]) => /^autter\.(?:operation|event)\./.test(key)));
+                const attributes = sanitizeRuntimeContext({
+                    ...metadata,
+                    ...event,
+                    ...attrs,
+                });
+                const nanos = record.timeUnixNano ?? record.observedTimeUnixNano;
+                const occurredAt = nanos === undefined
+                    ? new Date()
+                    : new Date(Number(BigInt(String(nanos)) / 1000000n));
+                if (!Number.isFinite(occurredAt.getTime()))
+                    throw new Error("invalid log timestamp");
+                const number = Number(record.severityNumber ?? 9);
+                const text = String(record.severityText ?? event.level ?? "").toLowerCase();
+                const severity = number >= 21 || text === "fatal"
+                    ? "fatal"
+                    : number >= 17 || text === "error"
+                        ? "error"
+                        : number >= 13 || /warn/.test(text)
+                            ? "warning"
+                            : number < 9 || text === "debug"
+                                ? "debug"
+                                : "info";
+                const errorMessage = event.error && typeof event.error === "object"
+                    ? event.error.message
+                    : event.error;
+                const message = String(sanitizeRuntimeContext({
+                    message: event.message ?? errorMessage ?? body,
+                }).message ?? "").slice(0, 4000);
+                const operationId = String(attributes["autter.operation.id"] ?? "").slice(0, 128);
+                const traceId = /^[a-f0-9]{32}$/i.test(record.traceId ?? "")
+                    ? record.traceId.toLowerCase().replace(/^0+$/, "")
+                    : "";
+                const spanId = /^[a-f0-9]{16}$/i.test(record.spanId ?? "")
+                    ? record.spanId.toLowerCase().replace(/^0+$/, "")
+                    : "";
+                if (typeof attributes.path === "string")
+                    attributes.path = normalizeRoute(attributes.path.split(/[?#]/)[0]);
+                rows.push({
+                    id: createHash("sha256")
+                        .update(JSON.stringify([
+                        info,
+                        nanos,
+                        traceId,
+                        spanId,
+                        severity,
+                        attributes,
+                        message,
+                    ]))
+                        .digest("hex")
+                        .slice(0, 32),
+                    service: String(info["service.name"] ?? "unknown").slice(0, 200),
+                    environment: String(info["deployment.environment.name"] ??
+                        info["deployment.environment"] ??
+                        "production").slice(0, 100),
+                    release: String(info["service.version"] ?? "").slice(0, 200),
+                    traceId,
+                    spanId,
+                    operationId,
+                    operation: String(attributes["autter.operation.name"] ?? "").slice(0, 200),
+                    type: attributes["autter.event.type"] === "operation"
+                        ? "operation"
+                        : "log",
+                    severity,
+                    message,
+                    outcome: String(attributes["autter.operation.outcome"] ?? "").slice(0, 30),
+                    durationMs: Math.max(0, Number(attributes["autter.operation.duration_ms"]) || 0),
+                    attributes,
+                    occurredAt,
+                });
+            }
+        }
+    }
+    return rows;
+}
+export function logTableDDL(db) {
+    return `CREATE TABLE IF NOT EXISTS ${db}.runtime_logs (
+		org_id String, repository_id String, event_id String,
+		service LowCardinality(String), environment LowCardinality(String), release String DEFAULT '',
+		trace_id String DEFAULT '', span_id String DEFAULT '', operation_id String DEFAULT '',
+		operation String DEFAULT '', event_type LowCardinality(String) DEFAULT 'log',
+		severity LowCardinality(String) DEFAULT 'info', message String CODEC(ZSTD(1)),
+		outcome LowCardinality(String) DEFAULT '', duration_ms Float64 DEFAULT 0,
+		attributes String DEFAULT '{}' CODEC(ZSTD(1)), occurred_at DateTime64(3, 'UTC'),
+		ingested_at DateTime64(3, 'UTC') DEFAULT now64(3)
+	) ENGINE = ReplacingMergeTree PARTITION BY toDate(occurred_at)
+	ORDER BY (org_id, repository_id, occurred_at, event_id)
+	TTL toDateTime(occurred_at) + INTERVAL 14 DAY`;
+}

package/dist/memory.d.ts

@@ -24,15 +24,15 @@ export declare const platformEventSchema: z.ZodObject<{
     service: string;
     environment: string;
     release: string;
+    kind: "oom_kill" | "restart";
     instanceId: string;
     platform: "ecs" | "kubernetes" | "other";
-    kind: "oom_kill" | "restart";
     occurredAt: string;
 }, {
     service: string;
+    kind: "oom_kill" | "restart";
     instanceId: string;
     platform: "ecs" | "kubernetes" | "other";
-    kind: "oom_kill" | "restart";
     occurredAt: string;
     environment?: string | undefined;
     release?: string | undefined;

package/dist/migrations.js

@@ -35,6 +35,7 @@
 import { latencyTableDDL } from "./latency.js";
 import { profileTableDDL } from "./profiles.js";
 import { sourceMapTableDDL } from "./source-maps.js";
+import { logTableDDL } from "./logs.js";
 import { memoryTableDDL, platformEventTableDDL } from "./memory.js";
 export const MIGRATIONS = [
     // 0001 intentionally reserved as the baseline marker: databases created
@@ -127,6 +128,7 @@ export const MIGRATIONS = [
     { id: "0010-memory-temporality", statements: [
             `ALTER TABLE {db}.runtime_memory_samples ADD COLUMN IF NOT EXISTS temporality LowCardinality(String) DEFAULT 'gauge'`,
         ] },
+    { id: "0011-runtime-logs", statements: [logTableDDL("{db}")] },
 ];
 /** The tracking table itself — created by the runner before anything else. */
 export function migrationsTableDDL(db) {

package/dist/normalize-browser.d.ts

@@ -8,7 +8,7 @@ export declare const browserPayloadSchema: z.ZodObject<{
     release: z.ZodOptional<z.ZodString>;
     events: z.ZodArray<z.ZodObject<{
         id: z.ZodOptional<z.ZodString>;
-        type: z.ZodEnum<["exception", "unhandled_rejection", "message", "session_start", "track_event", "outcome", "request_failure", "timing"]>;
+        type: z.ZodEnum<["exception", "unhandled_rejection", "message", "session_start", "track_event", "outcome", "request_failure", "csp_violation", "timing"]>;
         timestamp: z.ZodString;
         /** exception/message events: signal level. Defaults per type. */
         severity: z.ZodOptional<z.ZodEnum<["fatal", "error", "warning", "info"]>>;
@@ -25,10 +25,11 @@ export declare const browserPayloadSchema: z.ZodObject<{
         route: z.ZodOptional<z.ZodString>;
         context: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>;
     }, "strip", z.ZodTypeAny, {
-        type: "exception" | "message" | "unhandled_rejection" | "session_start" | "track_event" | "outcome" | "request_failure" | "timing";
+        type: "exception" | "message" | "unhandled_rejection" | "session_start" | "track_event" | "outcome" | "request_failure" | "csp_violation" | "timing";
         message: string;
         timestamp: string;
         durationMs?: number | undefined;
+        route?: string | undefined;
         filename?: string | undefined;
         id?: string | undefined;
         severity?: "fatal" | "error" | "warning" | "info" | undefined;
@@ -37,12 +38,12 @@ export declare const browserPayloadSchema: z.ZodObject<{
         errorType?: string | undefined;
         line?: number | undefined;
         column?: number | undefined;
-        route?: string | undefined;
         context?: Record<string, unknown> | undefined;
     }, {
-        type: "exception" | "message" | "unhandled_rejection" | "session_start" | "track_event" | "outcome" | "request_failure" | "timing";
+        type: "exception" | "message" | "unhandled_rejection" | "session_start" | "track_event" | "outcome" | "request_failure" | "csp_violation" | "timing";
         timestamp: string;
         durationMs?: number | undefined;
+        route?: string | undefined;
         message?: string | undefined;
         filename?: string | undefined;
         id?: string | undefined;
@@ -52,7 +53,6 @@ export declare const browserPayloadSchema: z.ZodObject<{
         errorType?: string | undefined;
         line?: number | undefined;
         column?: number | undefined;
-        route?: string | undefined;
         context?: Record<string, unknown> | undefined;
     }>, "many">;
 }, "strip", z.ZodTypeAny, {
@@ -60,10 +60,11 @@ export declare const browserPayloadSchema: z.ZodObject<{
     environment: string;
     version: 1;
     events: {
-        type: "exception" | "message" | "unhandled_rejection" | "session_start" | "track_event" | "outcome" | "request_failure" | "timing";
+        type: "exception" | "message" | "unhandled_rejection" | "session_start" | "track_event" | "outcome" | "request_failure" | "csp_violation" | "timing";
         message: string;
         timestamp: string;
         durationMs?: number | undefined;
+        route?: string | undefined;
         filename?: string | undefined;
         id?: string | undefined;
         severity?: "fatal" | "error" | "warning" | "info" | undefined;
@@ -72,7 +73,6 @@ export declare const browserPayloadSchema: z.ZodObject<{
         errorType?: string | undefined;
         line?: number | undefined;
         column?: number | undefined;
-        route?: string | undefined;
         context?: Record<string, unknown> | undefined;
     }[];
     release?: string | undefined;
@@ -82,9 +82,10 @@ export declare const browserPayloadSchema: z.ZodObject<{
     environment: string;
     version: 1;
     events: {
-        type: "exception" | "message" | "unhandled_rejection" | "session_start" | "track_event" | "outcome" | "request_failure" | "timing";
+        type: "exception" | "message" | "unhandled_rejection" | "session_start" | "track_event" | "outcome" | "request_failure" | "csp_violation" | "timing";
         timestamp: string;
         durationMs?: number | undefined;
+        route?: string | undefined;
         message?: string | undefined;
         filename?: string | undefined;
         id?: string | undefined;
@@ -94,7 +95,6 @@ export declare const browserPayloadSchema: z.ZodObject<{
         errorType?: string | undefined;
         line?: number | undefined;
         column?: number | undefined;
-        route?: string | undefined;
         context?: Record<string, unknown> | undefined;
     }[];
     release?: string | undefined;

package/dist/normalize-browser.js

@@ -17,6 +17,7 @@ const browserEventSchema = z.object({
         "track_event",
         "outcome",
         "request_failure",
+        "csp_violation",
         "timing",
     ]),
     timestamp: z.string().datetime(),
@@ -49,6 +50,7 @@ const TYPE_TO_ERROR_TYPE = {
     message: "Message",
     outcome: "OutcomeFailure",
     request_failure: "HttpRequestError",
+    csp_violation: "CspViolation",
 };
 // Content-level gate for the free-form `context` bag. The schema whitelist
 // above is structural; this masks obvious PII/secrets inside whatever a
@@ -78,6 +80,7 @@ const TYPE_TO_SEVERITY = {
     message: "warning",
     outcome: "error",
     request_failure: "error",
+    csp_violation: "error",
 };
 export function normalizeBrowserPayload(payload) {
     const occurrences = [];

package/dist/normalize-otlp.d.ts

@@ -1,3 +1,4 @@
+import { type OtlpValue } from "./context.js";
 import { type RuntimeLlmCall, type RuntimeMetricPoint, type RuntimeOccurrenceInput, type RuntimeSpanRow } from "./types.js";
 /**
  * OTLP/HTTP JSON → runtime signal. Structural types cover only the fields
@@ -10,12 +11,7 @@ import { type RuntimeLlmCall, type RuntimeMetricPoint, type RuntimeOccurrenceInp
  */
 interface OtlpKeyValue {
     key?: string;
-    value?: {
-        stringValue?: string;
-        intValue?: string | number;
-        doubleValue?: number;
-        boolValue?: boolean;
-    };
+    value?: OtlpValue;
 }
 interface OtlpEvent {
     name?: string;

package/dist/normalize-otlp.js

@@ -1,3 +1,4 @@
+import { decodeOtlpAttributes, sanitizeRuntimeContext } from "./context.js";
 import { normalizeRoute } from "./fingerprint.js";
 import { extractLlmCall } from "./llm.js";
 import { asSeverity, } from "./types.js";
@@ -96,6 +97,7 @@ function severityOf(eventAttrs, spanAttrs) {
 const MAX_SPANS_PER_REQUEST = 5000;
 export function normalizeTraces(request) {
     const occurrences = [];
+    const occurrenceSpanIds = [];
     const spans = [];
     const llmCalls = [];
     const rollups = new Map();
@@ -132,6 +134,7 @@ export function normalizeTraces(request) {
                     statusCode,
                     durationMs,
                     attributes: {
+                        ...decodeOtlpAttributes(span.attributes),
                         "http.request.method": (attrs.get("http.request.method") ?? attrs.get("http.method") ?? "").slice(0, 20),
                     },
                     startedAt,
@@ -143,6 +146,7 @@ export function normalizeTraces(request) {
                 for (const event of exceptionEvents) {
                     const eventAttrs = attrMap(event.attributes);
                     const handled = eventAttrs.get("autter.handled") === "true";
+                    occurrenceSpanIds.push(span.spanId ?? "");
                     occurrences.push({
                         source: "server",
                         severity: severityOf(eventAttrs, attrs),
@@ -160,10 +164,8 @@ export function normalizeTraces(request) {
                         statusCode,
                         traceId: span.traceId ?? null,
                         sessionId: null,
-                        attributes: handled ? {
-                            "autter.handled": true,
-                            "autter.sampled": eventAttrs.get("autter.sampled") === "true",
-                        } : null,
+                        attributes: sanitizeRuntimeContext({ ...decodeOtlpAttributes(span.attributes), ...decodeOtlpAttributes(event.attributes),
+                            ...(handled ? { "autter.handled": true, "autter.sampled": eventAttrs.get("autter.sampled") === "true" } : {}) }),
                         occurredAt: nanosToDate(event.timeUnixNano ?? span.startTimeUnixNano),
                     });
                 }
@@ -175,17 +177,20 @@ export function normalizeTraces(request) {
                 for (const event of failedOutcomes) {
                     const outcome = attrMap(event.attributes);
                     const name = (outcome.get("autter.outcome.name") ?? "operation").replace(EMAIL_VALUE_RE, "[redacted]").slice(0, 200);
+                    occurrenceSpanIds.push(span.spanId ?? "");
                     occurrences.push({
                         source: "server", severity: "error", service: resource.service,
                         environment: resource.environment, release: resource.release,
                         errorType: "OutcomeFailure",
                         message: `${name}: ${(outcome.get("autter.outcome.message") ?? "failed").replace(EMAIL_VALUE_RE, "[redacted]").slice(0, 1000)}`,
-                        stack: null, route, method: methodOf(attrs), statusCode,
-                        traceId: span.traceId ?? null, sessionId: null, attributes: null,
+                        stack: String(decodeOtlpAttributes(event.attributes)["autter.outcome.stack"] ?? "") || null, route, method: methodOf(attrs), statusCode,
+                        traceId: span.traceId ?? null, sessionId: null,
+                        attributes: sanitizeRuntimeContext({ ...decodeOtlpAttributes(span.attributes), ...decodeOtlpAttributes(event.attributes) }),
                         occurredAt: nanosToDate(event.timeUnixNano ?? span.startTimeUnixNano),
                     });
                 }
                 if (exceptionEvents.length === 0 && failedOutcomes.length === 0 && isError) {
+                    occurrenceSpanIds.push(span.spanId ?? "");
                     occurrences.push({
                         source: "server",
                         severity: severityOf(new Map(), attrs),
@@ -202,7 +207,7 @@ export function normalizeTraces(request) {
                         statusCode,
                         traceId: span.traceId ?? null,
                         sessionId: null,
-                        attributes: null,
+                        attributes: decodeOtlpAttributes(span.attributes),
                         occurredAt: startedAt,
                     });
                 }
@@ -270,6 +275,7 @@ export function normalizeTraces(request) {
             }
         }
     }
+    inheritHttpFromParent(occurrences, occurrenceSpanIds, spans);
     return {
         occurrences,
         spans,
@@ -278,6 +284,62 @@ export function normalizeTraces(request) {
         spanCount,
     };
 }
+/**
+ * Exception spans are often children named "Error" with no HTTP attributes.
+ * Copy method, route, status, and duration from the server span in the same
+ * trace so the issue can name the API that failed.
+ */
+function inheritHttpFromParent(occurrences, occurrenceSpanIds, spans) {
+    const byId = new Map();
+    for (const span of spans) {
+        if (span.spanId)
+            byId.set(span.spanId, span);
+    }
+    for (let i = 0; i < occurrences.length; i++) {
+        const occurrence = occurrences[i];
+        const spanId = occurrenceSpanIds[i];
+        if (!occurrence || !spanId)
+            continue;
+        const http = httpServerAncestor(byId, spanId);
+        if (!http)
+            continue;
+        if (!occurrence.route && http.route)
+            occurrence.route = http.route;
+        const method = methodFromSpan(http);
+        if (!occurrence.method && method)
+            occurrence.method = method;
+        if ((occurrence.statusCode == null || occurrence.statusCode === 0) &&
+            http.statusCode != null &&
+            http.statusCode > 0) {
+            occurrence.statusCode = http.statusCode;
+        }
+        if (http.durationMs > 0) {
+            const attributes = { ...(occurrence.attributes ?? {}) };
+            if (attributes["http.server.duration_ms"] == null) {
+                attributes["http.server.duration_ms"] = Math.round(http.durationMs);
+                occurrence.attributes = attributes;
+            }
+        }
+    }
+}
+function httpServerAncestor(byId, spanId) {
+    let current = byId.get(spanId) ?? null;
+    const seen = new Set();
+    while (current && current.spanId && !seen.has(current.spanId)) {
+        seen.add(current.spanId);
+        if (current.kind === "server")
+            return current;
+        const parentId = current.parentSpanId;
+        if (!parentId)
+            return null;
+        current = byId.get(parentId) ?? null;
+    }
+    return null;
+}
+function methodFromSpan(span) {
+    const raw = span.attributes?.["http.request.method"];
+    return typeof raw === "string" && raw.trim() ? raw.trim().toUpperCase().slice(0, 16) : null;
+}
 function minuteBucket(date) {
     return new Date(Math.floor(date.getTime() / 60_000) * 60_000);
 }

package/dist/otlp-proto.d.ts

@@ -1,3 +1,5 @@
 import type { OtlpMetricsRequest, OtlpTraceRequest } from "./normalize-otlp.js";
+import type { OtlpLogsRequest } from "./logs.js";
 export declare function decodeTraceRequest(body: Buffer): OtlpTraceRequest;
 export declare function decodeMetricsRequest(body: Buffer): OtlpMetricsRequest;
+export declare function decodeLogsRequest(body: Buffer): OtlpLogsRequest;

package/dist/otlp-proto.js

@@ -21,10 +21,27 @@ message AnyValue {
     bool bool_value = 2;
     int64 int_value = 3;
     double double_value = 4;
+    ArrayValue array_value = 5;
+    KeyValueList kvlist_value = 6;
   }
 }
+message ArrayValue { repeated AnyValue values = 1; }
+message KeyValueList { repeated KeyValue values = 1; }
 message KeyValue { string key = 1; AnyValue value = 2; }
 message Resource { repeated KeyValue attributes = 1; }
+message ExportLogsServiceRequest { repeated ResourceLogs resource_logs = 1; }
+message ResourceLogs { Resource resource = 1; repeated ScopeLogs scope_logs = 2; }
+message ScopeLogs { repeated LogRecord log_records = 2; }
+message LogRecord {
+  fixed64 time_unix_nano = 1;
+  int32 severity_number = 2;
+  string severity_text = 3;
+  AnyValue body = 5;
+  repeated KeyValue attributes = 6;
+  bytes trace_id = 9;
+  bytes span_id = 10;
+  fixed64 observed_time_unix_nano = 11;
+}
 
 message ExportTraceServiceRequest { repeated ResourceSpans resource_spans = 1; }
 message ResourceSpans { Resource resource = 1; repeated ScopeSpans scope_spans = 2; }
@@ -80,6 +97,7 @@ message HistogramDataPoint {
 const root = protobuf.parse(PROTO).root;
 const TraceRequest = root.lookupType("otlp.ExportTraceServiceRequest");
 const MetricsRequest = root.lookupType("otlp.ExportMetricsServiceRequest");
+const LogsRequest = root.lookupType("otlp.ExportLogsServiceRequest");
 const TO_OBJECT_OPTIONS = {
     longs: String, // 64-bit ints → strings (matches OTLP/JSON)
     defaults: false,
@@ -110,3 +128,6 @@ export function decodeMetricsRequest(body) {
     const message = MetricsRequest.decode(body);
     return hexifyIds(MetricsRequest.toObject(message, TO_OBJECT_OPTIONS));
 }
+export function decodeLogsRequest(body) {
+    return hexifyIds(LogsRequest.toObject(LogsRequest.decode(body), TO_OBJECT_OPTIONS));
+}

package/dist/server.js

@@ -5,7 +5,8 @@ import { normalizeLatencyHistograms } from "./latency.js";
 import { deriveFields, fingerprintOccurrence, occurrenceIdFor, } from "./fingerprint.js";
 import { browserPayloadSchema, normalizeBrowserPayload, } from "./normalize-browser.js";
 import { normalizeMetrics, normalizeTraces, } from "./normalize-otlp.js";
-import { decodeMetricsRequest, decodeTraceRequest } from "./otlp-proto.js";
+import { decodeMetricsRequest, decodeTraceRequest, decodeLogsRequest } from "./otlp-proto.js";
+import { normalizeLogs } from "./logs.js";
 import { decodeProfile } from "./profiles.js";
 import { normalizeMemoryMetrics, normalizePlatformEvent, platformEventSchema } from "./memory.js";
 import { validateSourceMap } from "./source-maps.js";
@@ -262,6 +263,29 @@ export function createIngesterApp(config) {
         sink?.enqueue(ctx, fingerprinted, metricPoints, llmCalls);
         otlpSuccess(req, res);
     });
+    app.post("/v1/logs", async (req, res) => {
+        const ctx = await authenticate(req, res, "otlp");
+        if (!ctx)
+            return;
+        let logs;
+        try {
+            logs = normalizeLogs(req.is("application/x-protobuf") ? decodeLogsRequest(req.body) : req.body);
+        }
+        catch {
+            res.status(400).json({ error: "invalid OTLP logs payload" });
+            return;
+        }
+        try {
+            await store.insertLogs(ctx, logs);
+        }
+        catch (err) {
+            storageError(res, err);
+            return;
+        }
+        // Logs are diagnostic evidence. Exceptions and failed outcomes use the trace sink,
+        // so one operation does not create duplicate issues through two export paths.
+        otlpSuccess(req, res);
+    });
     app.post("/v1/metrics", async (req, res) => {
         const ctx = await authenticate(req, res, "otlp");
         if (!ctx)

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@autter/otlp-ingester",
-	"version": "1.3.3",
+	"version": "1.4.0",
 	"description": "Self-hostable OTLP + browser-error ingest service for Autter Runtime: normalises telemetry into a per-repo ClickHouse data model",
 	"license": "MIT",
 	"type": "module",