@crvouga/mockingbird-service-otel 3.2.0 → 3.3.0

package/dist/{chunk-HRGWNDT2.js → chunk-T4AU5UCQ.js}

@@ -2189,7 +2189,7 @@ var stateAdminRoutes = (routes) => {
 };
 
 // ../core/dist/version.js
-var PACKAGE_VERSION = true ? "3.2.0" : UNRELEASED_VERSION;
+var PACKAGE_VERSION = true ? "3.3.0" : UNRELEASED_VERSION;
 
 // ../core/dist/webhooks.js
 var json4 = (status, body) => new Response(JSON.stringify(body), {
@@ -3046,10 +3046,66 @@ var presetRoutes = (presets, runtime, adminPrefix) => ({
   }
 });
 
+// src/cors.ts
+var DEFAULT_METHODS = ["GET", "POST", "HEAD"];
+var DEFAULT_HEADERS = ["accept", "content-type", "x-requested-with"];
+var corsEnabled = (cors) => cors.allowedOrigins.length > 0;
+var isPreflight = (request) => request.method === "OPTIONS" && request.headers.has("access-control-request-method");
+var originAllowed = (cors, origin) => {
+  const candidate = origin.toLowerCase();
+  return cors.allowedOrigins.some((allowed) => {
+    const pattern = allowed.toLowerCase();
+    const star = pattern.indexOf("*");
+    if (star < 0) return pattern === candidate;
+    const prefix = pattern.slice(0, star);
+    const suffix = pattern.slice(star + 1);
+    return candidate.length >= prefix.length + suffix.length && candidate.startsWith(prefix) && candidate.endsWith(suffix);
+  });
+};
+var allowOrigin = (cors, origin) => cors.allowedOrigins.includes("*") ? "*" : origin;
+var methodAllowed = (cors, method) => {
+  if (method === "OPTIONS") return true;
+  const methods = cors.allowedMethods?.length ? cors.allowedMethods : DEFAULT_METHODS;
+  return methods.some((allowed) => allowed.toUpperCase() === method);
+};
+var headersAllowed = (cors, requested) => {
+  if (requested === null) return true;
+  const allowed = cors.allowedHeaders?.length ? cors.allowedHeaders : DEFAULT_HEADERS;
+  if (allowed.includes("*")) return true;
+  const names = new Set(allowed.map((name) => name.toLowerCase()));
+  return requested.split(",").map((name) => name.trim().toLowerCase()).every((name) => name === "" || names.has(name));
+};
+var preflightResponse = (request, cors) => {
+  const headers = new Headers({
+    vary: "Origin, Access-Control-Request-Method, Access-Control-Request-Headers"
+  });
+  const origin = request.headers.get("origin");
+  const method = request.headers.get("access-control-request-method") ?? "";
+  const requested = request.headers.get("access-control-request-headers");
+  if (origin && originAllowed(cors, origin) && methodAllowed(cors, method) && headersAllowed(cors, requested)) {
+    headers.set("access-control-allow-origin", allowOrigin(cors, origin));
+    headers.set("access-control-allow-methods", method);
+    if (requested) headers.set("access-control-allow-headers", requested);
+    headers.set("access-control-allow-credentials", "true");
+    if (cors.maxAge) headers.set("access-control-max-age", String(Math.max(0, cors.maxAge)));
+  }
+  return new Response(null, { status: 204, headers });
+};
+var applyCors = (request, response, cors) => {
+  response.headers.append("vary", "Origin");
+  const origin = request.headers.get("origin");
+  if (!origin || !originAllowed(cors, origin) || !methodAllowed(cors, request.method)) return;
+  response.headers.set("access-control-allow-origin", allowOrigin(cors, origin));
+  if (cors.exposedHeaders?.length) {
+    response.headers.set("access-control-expose-headers", cors.exposedHeaders.join(", "));
+  }
+  response.headers.set("access-control-allow-credentials", "true");
+};
+
 // src/generated/openapi.ts
-var document = JSON.parse(`{"openapi":"3.1.0","info":{"title":"OTLP/HTTP collector and OpenObserve search (Mockingbird subset)","description":"An OTLP/HTTP receiver (traces, logs, metrics; JSON and protobuf) in front of the\\nOpenObserve (O2) search API, over one store: a test emits a span or a structured \`event\`\\nlog and queries it back with the same SQL our clients send.\\n","version":"1","x-mockingbird-upstream":{"note":"OTLP/HTTP per opentelemetry-proto v1 (https://opentelemetry.io/docs/specs/otlp/); the O2 routes follow OpenObserve's API (/api-doc/openapi.json, v0.92) trimmed to what our clients call."}},"servers":[{"url":"https://otel.acme.example"},{"url":"https://observe.acme.example"}],"security":[{"bearerAuth":[]}],"paths":{"/v1/traces":{"post":{"operationId":"ExportTraces","summary":"OTLP/HTTP trace export (ExportTraceServiceRequest)","x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":false}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExportTraceServiceRequest"}},"application/x-protobuf":{"schema":{"type":"string","format":"binary"}}}},"responses":{"200":{"description":"Accepted. JSON requests get \`{partialSuccess: {}}\`; protobuf requests get an empty protobuf response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExportResponse"}},"application/x-protobuf":{"schema":{"type":"string","format":"binary"}}}},"400":{"description":"Undecodable payload","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"401":{"description":"Missing or unknown bearer token","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"415":{"description":"Neither application/json nor application/x-protobuf","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"429":{"description":"Throttled (retried by the SDK), with retry-after","headers":{"retry-after":{"schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"500":{"description":"Collector error (not retried by the SDK)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"502":{"description":"Bad gateway (retried)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"503":{"description":"Unavailable (retried)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"504":{"description":"Gateway timeout (retried)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}}}}},"/v1/logs":{"post":{"operationId":"ExportLogs","summary":"OTLP/HTTP log export (ExportLogsServiceRequest)","x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":false}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExportLogsServiceRequest"}},"application/x-protobuf":{"schema":{"type":"string","format":"binary"}}}},"responses":{"200":{"description":"Accepted. JSON requests get \`{partialSuccess: {}}\`; protobuf requests get an empty protobuf response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExportResponse"}},"application/x-protobuf":{"schema":{"type":"string","format":"binary"}}}},"400":{"description":"Undecodable payload","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"401":{"description":"Missing or unknown bearer token","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"415":{"description":"Neither application/json nor application/x-protobuf","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"429":{"description":"Throttled (retried by the SDK), with retry-after","headers":{"retry-after":{"schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"500":{"description":"Collector error (not retried by the SDK)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"502":{"description":"Bad gateway (retried)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"503":{"description":"Unavailable (retried)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"504":{"description":"Gateway timeout (retried)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}}}}},"/v1/metrics":{"post":{"operationId":"ExportMetrics","summary":"OTLP/HTTP metrics export: accepted and counted, never stored","x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":false}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExportMetricsServiceRequest"}},"application/x-protobuf":{"schema":{"type":"string","format":"binary"}}}},"responses":{"200":{"description":"Accepted. JSON requests get \`{partialSuccess: {}}\`; protobuf requests get an empty protobuf response.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExportResponse"}},"application/x-protobuf":{"schema":{"type":"string","format":"binary"}}}},"400":{"description":"Undecodable payload","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"401":{"description":"Missing or unknown bearer token","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"415":{"description":"Neither application/json nor application/x-protobuf","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"429":{"description":"Throttled (retried by the SDK), with retry-after","headers":{"retry-after":{"schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"500":{"description":"Collector error (not retried by the SDK)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"502":{"description":"Bad gateway (retried)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"503":{"description":"Unavailable (retried)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"504":{"description":"Gateway timeout (retried)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}}}}},"/api/organizations":{"get":{"operationId":"ListOrganizations","summary":"O2: the organizations the Basic user belongs to (display name \u2192 identifier)","security":[{"basicAuth":[]}],"x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":true}},"responses":{"200":{"description":"Organizations","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Organizations"}}}},"401":{"description":"Bad Basic credentials, or an org the user cannot see \u2014 including an org's display name in place of its identifier","content":{"text/plain":{"schema":{"type":"string"}}}}}}},"/api/{org}/streams":{"parameters":[{"name":"org","in":"path","required":true,"description":"The org **identifier** (not its display name)","schema":{"type":"string","x-mockingbird-resource-ref":{"type":"organization","missing":"no-such-org"}}}],"get":{"operationId":"ListStreams","summary":"O2: the org's streams of one type","security":[{"basicAuth":[]}],"x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":true}},"parameters":[{"name":"type","in":"query","required":false,"schema":{"type":"string","enum":["logs","traces"]}}],"responses":{"200":{"description":"Streams","content":{"application/json":{"schema":{"$ref":"#/components/schemas/StreamList"}}}},"401":{"description":"Bad Basic credentials, or an org the user cannot see \u2014 including an org's display name in place of its identifier","content":{"text/plain":{"schema":{"type":"string"}}}}}}},"/api/{org}/streams/{stream}/schema":{"parameters":[{"name":"org","in":"path","required":true,"description":"The org **identifier** (not its display name)","schema":{"type":"string","x-mockingbird-resource-ref":{"type":"organization","missing":"no-such-org"}}},{"name":"stream","in":"path","required":true,"schema":{"type":"string","enum":["default","other"]}}],"get":{"operationId":"GetStreamSchema","summary":"O2: a stream's schema (\`schema[].name\` are the queryable, lowercased, flattened fields)","security":[{"basicAuth":[]}],"x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":true}},"parameters":[{"name":"type","in":"query","required":false,"schema":{"type":"string","enum":["logs","traces"]}}],"responses":{"200":{"description":"Schema","content":{"application/json":{"schema":{"$ref":"#/components/schemas/StreamSchema"}}}},"401":{"description":"Bad Basic credentials, or an org the user cannot see \u2014 including an org's display name in place of its identifier","content":{"text/plain":{"schema":{"type":"string"}}}},"404":{"description":"Nothing has been ingested into this stream","content":{"application/json":{"schema":{"$ref":"#/components/schemas/O2Error"}}}}}}},"/api/{org}/_search":{"parameters":[{"name":"org","in":"path","required":true,"description":"The org **identifier** (not its display name)","schema":{"type":"string","x-mockingbird-resource-ref":{"type":"organization","missing":"no-such-org"}}}],"post":{"operationId":"Search","summary":"O2: SQL search over a stream","security":[{"basicAuth":[]}],"x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":true}},"parameters":[{"name":"type","in":"query","required":false,"schema":{"type":"string","enum":["logs","traces"]}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["query"],"properties":{"query":{"type":"object","required":["sql"],"properties":{"sql":{"anyOf":[{"type":"string","enum":["SELECT * FROM \\"default\\" WHERE event IS NOT NULL ORDER BY _timestamp DESC","SELECT * FROM \\"default\\" WHERE event IN ('checkout_completed') ORDER BY _timestamp DESC","SELECT service_name, count(*) AS n FROM \\"default\\" GROUP BY service_name ORDER BY n DESC","SELECT * FROM \\"default\\" WHERE severity_text IN ('ERROR', 'FATAL')","SELECT * FROM \\"default\\" WHERE clientUserId = '1'"]},{"type":"string","maxLength":200}]},"start_time":{"type":"integer","minimum":0,"description":"\xB5s since epoch"},"end_time":{"type":"integer","minimum":0,"description":"\xB5s since epoch"},"from":{"type":"integer","minimum":0,"maximum":100},"size":{"type":"integer","minimum":-1,"maximum":1000}}},"search_type":{"type":"string","maxLength":20}}}}}},"responses":{"200":{"description":"Hits","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SearchResponse"}}}},"400":{"description":"Unsupported SQL, or an unknown field (O2 lowercases every field; a camelCase column is unknown)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/O2Error"}}}},"401":{"description":"Bad Basic credentials, or an org the user cannot see \u2014 including an org's display name in place of its identifier","content":{"text/plain":{"schema":{"type":"string"}}}}}}}},"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"},"basicAuth":{"type":"http","scheme":"basic"}},"schemas":{"KeyValue":{"type":"object","required":["key","value"],"properties":{"key":{"type":"string","enum":["service.name","event","clientUserId","http.method","deployment.environment.name","attempt"]},"value":{"type":"object","properties":{"stringValue":{"type":"string","maxLength":20},"intValue":{"type":["string","integer"]},"boolValue":{"type":"boolean"},"doubleValue":{"type":"number"}}}}},"ExportTraceServiceRequest":{"type":"object","properties":{"resourceSpans":{"type":"array","maxItems":2,"items":{"type":"object","properties":{"resource":{"type":"object","properties":{"attributes":{"type":"array","maxItems":4,"items":{"$ref":"#/components/schemas/KeyValue"}}}},"scopeSpans":{"type":"array","maxItems":2,"items":{"type":"object","properties":{"scope":{"type":"object","properties":{"name":{"type":"string","maxLength":20}}},"spans":{"type":"array","maxItems":3,"items":{"type":"object","required":["traceId","spanId","name"],"properties":{"traceId":{"type":"string","pattern":"^[0-9a-f]{32}$"},"spanId":{"type":"string","pattern":"^[0-9a-f]{16}$"},"parentSpanId":{"type":"string","pattern":"^[0-9a-f]{16}$"},"name":{"type":"string","maxLength":30},"kind":{"type":"integer","minimum":0,"maximum":5},"startTimeUnixNano":{"type":"string","pattern":"^1[0-9]{18}$"},"endTimeUnixNano":{"type":"string","pattern":"^1[0-9]{18}$"},"attributes":{"type":"array","maxItems":4,"items":{"$ref":"#/components/schemas/KeyValue"}},"status":{"type":"object","properties":{"code":{"type":"integer","minimum":0,"maximum":2},"message":{"type":"string","maxLength":40}}}}}}}}}}}}}},"ExportLogsServiceRequest":{"type":"object","properties":{"resourceLogs":{"type":"array","maxItems":2,"items":{"type":"object","properties":{"resource":{"type":"object","properties":{"attributes":{"type":"array","maxItems":4,"items":{"$ref":"#/components/schemas/KeyValue"}}}},"scopeLogs":{"type":"array","maxItems":2,"items":{"type":"object","properties":{"scope":{"type":"object","properties":{"name":{"type":"string","maxLength":20}}},"logRecords":{"type":"array","maxItems":3,"items":{"type":"object","properties":{"timeUnixNano":{"type":"string","pattern":"^1[0-9]{18}$"},"observedTimeUnixNano":{"type":"string","pattern":"^1[0-9]{18}$"},"severityNumber":{"type":"integer","minimum":0,"maximum":24},"severityText":{"type":"string","enum":["TRACE","DEBUG","INFO","WARN","ERROR","FATAL","info","error"]},"body":{"type":"object","properties":{"stringValue":{"type":"string","maxLength":40}}},"attributes":{"type":"array","maxItems":4,"items":{"$ref":"#/components/schemas/KeyValue"}},"traceId":{"type":"string","pattern":"^[0-9a-f]{32}$"},"spanId":{"type":"string","pattern":"^[0-9a-f]{16}$"}}}}}}}}}}}},"ExportMetricsServiceRequest":{"type":"object","properties":{"resourceMetrics":{"type":"array","maxItems":2,"items":{"type":"object","properties":{"resource":{"type":"object","properties":{"attributes":{"type":"array","maxItems":4,"items":{"$ref":"#/components/schemas/KeyValue"}}}},"scopeMetrics":{"type":"array","maxItems":2,"items":{"type":"object","properties":{"metrics":{"type":"array","maxItems":3,"items":{"type":"object","properties":{"name":{"type":"string","maxLength":30},"unit":{"type":"string","maxLength":10}}}}}}}}}}}},"ExportResponse":{"type":"object","required":["partialSuccess"],"properties":{"partialSuccess":{"type":"object","properties":{"rejectedSpans":{"type":["string","integer"]},"rejectedLogRecords":{"type":["string","integer"]},"rejectedDataPoints":{"type":["string","integer"]},"errorMessage":{"type":"string"}}}}},"RpcStatus":{"type":"object","required":["code","message"],"properties":{"code":{"type":"integer"},"message":{"type":"string"}}},"O2Error":{"type":"object","required":["code","message"],"properties":{"code":{"type":"integer"},"message":{"type":"string"},"error_detail":{"type":"string"}}},"Organizations":{"type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"type":"object","required":["identifier","name"],"properties":{"id":{"type":"integer"},"identifier":{"type":"string","x-mockingbird-resource":{"type":"organization","identity":true}},"name":{"type":"string"},"type":{"type":"string"}}}}}},"StreamList":{"type":"object","required":["list"],"properties":{"list":{"type":"array","items":{"type":"object","required":["name","stream_type"],"properties":{"name":{"type":"string"},"stream_type":{"type":"string"},"storage_type":{"type":"string"},"stats":{"type":"object"}}}}}},"StreamSchema":{"type":"object","required":["name","stream_type","schema"],"properties":{"name":{"type":"string"},"stream_type":{"type":"string"},"storage_type":{"type":"string"},"stats":{"type":"object"},"schema":{"type":"array","items":{"type":"object","required":["name","type"],"properties":{"name":{"type":"string"},"type":{"type":"string","enum":["Utf8","Int64","Float64","Boolean"]}}}},"settings":{"type":"object"}}},"SearchResponse":{"type":"object","required":["took","hits","total","from","size"],"properties":{"took":{"type":"integer","x-mockingbird-volatile":{"kind":"opaque"}},"hits":{"type":"array","items":{"type":"object"}},"total":{"type":"integer"},"from":{"type":"integer"},"size":{"type":"integer"},"scan_size":{"type":"integer"},"scan_records":{"type":"integer"},"is_partial":{"type":"boolean"},"cached_ratio":{"type":"integer"}}}}}}`);
-var operationIds = ["ExportTraces", "ExportLogs", "ExportMetrics", "ListOrganizations", "ListStreams", "GetStreamSchema", "Search"];
-var supportedOperationIds = ["ExportTraces", "ExportLogs", "ExportMetrics", "ListOrganizations", "ListStreams", "GetStreamSchema", "Search"];
+var document = JSON.parse(`{"openapi":"3.1.0","info":{"title":"OTLP/HTTP collector and OpenObserve search (Mockingbird subset)","description":"An OTLP/HTTP receiver (traces, logs, metrics; JSON and protobuf) in front of the\\nOpenObserve (O2) search API, over one store: a test emits a span or a structured \`event\`\\nlog and queries it back with the same SQL our clients send.\\n\\nThe receiver authenticates exports the way the collector it stands in for does, chosen by\\nthe \`ingestAuth\` setting: \`bearer\` (the default), \`basic\` (a hosted OTLP gateway's\\n\`Authorization: Basic base64(instanceId:token)\`) or \`none\` (a local collector). With\\n\`cors.allowedOrigins\` set it also answers a browser exporter's CORS preflight.\\n","version":"1","x-mockingbird-upstream":{"note":"OTLP/HTTP per opentelemetry-proto v1 (https://opentelemetry.io/docs/specs/otlp/); the O2 routes follow OpenObserve's API (/api-doc/openapi.json, v0.92) trimmed to what our clients call."}},"servers":[{"url":"https://otel.acme.example"},{"url":"https://observe.acme.example"}],"security":[{"bearerAuth":[]}],"paths":{"/v1/traces":{"post":{"operationId":"ExportTraces","summary":"OTLP/HTTP trace export (ExportTraceServiceRequest)","security":[{"bearerAuth":[]},{"basicAuth":[]},{}],"x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":false}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExportTraceServiceRequest"}},"application/x-protobuf":{"schema":{"type":"string","format":"binary"}}}},"responses":{"200":{"description":"Accepted. JSON requests get \`{partialSuccess: {}}\`; protobuf requests get an empty protobuf response.","headers":{"access-control-allow-origin":{"description":"With CORS on, the request's \`Origin\` when it is allowed (\`*\` when any origin is). Sent on every status, errors included.","schema":{"type":"string"}},"access-control-allow-credentials":{"description":"\`true\`, beside \`access-control-allow-origin\`","schema":{"type":"string"}},"access-control-expose-headers":{"description":"The configured \`cors.exposedHeaders\`","schema":{"type":"string"}},"vary":{"description":"\`Origin\`, whenever CORS is on","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExportResponse"}},"application/x-protobuf":{"schema":{"type":"string","format":"binary"}}}},"400":{"description":"Undecodable payload. Like every receiver error it is a \`google.rpc.Status\` in the request's encoding (binary for protobuf requests, JSON otherwise).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}},"application/x-protobuf":{"schema":{"type":"string","format":"binary"}}}},"401":{"description":"Credentials missing or not accepted for the \`ingestAuth\` mode: a bearer token (\`bearer\`, the default) or Basic credentials (\`basic\`). \`none\` mode refuses nothing.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}},"application/x-protobuf":{"schema":{"type":"string","format":"binary"}}}},"415":{"description":"Neither application/json nor application/x-protobuf","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"429":{"description":"Throttled (retried by the SDK), with retry-after","headers":{"retry-after":{"schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"500":{"description":"Collector error (not retried by the SDK)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"502":{"description":"Bad gateway (retried)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"503":{"description":"Unavailable (retried)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"504":{"description":"Gateway timeout (retried)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}}}},"options":{"operationId":"PreflightTraces","summary":"CORS preflight a browser exporter sends before \`POST /v1/traces\`","description":"Answered only when \`cors.allowedOrigins\` is set, and before authentication (a preflight carries no credentials). A refused preflight is the same 204 without the \`access-control-allow-*\` headers.","security":[],"x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":true}},"parameters":[{"name":"Origin","in":"header","required":false,"schema":{"type":"string","enum":["https://app.example.test"]}},{"name":"Access-Control-Request-Method","in":"header","required":false,"schema":{"type":"string","enum":["POST"]}},{"name":"Access-Control-Request-Headers","in":"header","required":false,"schema":{"type":"string","enum":["content-type","authorization,content-type,traceparent,tracestate"]}}],"responses":{"204":{"description":"Preflight answered. The \`access-control-allow-*\` headers are present only when the origin, the requested method and every requested header are allowed.","headers":{"access-control-allow-origin":{"description":"The request's \`Origin\` (\`*\` when any origin is allowed)","schema":{"type":"string"}},"access-control-allow-methods":{"description":"The requested method","schema":{"type":"string"}},"access-control-allow-headers":{"description":"The requested headers","schema":{"type":"string"}},"access-control-allow-credentials":{"schema":{"type":"string"}},"access-control-max-age":{"description":"The configured \`cors.maxAge\`, in seconds","schema":{"type":"string"}},"vary":{"schema":{"type":"string"}}}},"405":{"description":"CORS is off (no allowed origin), or the request names no \`Access-Control-Request-Method\`","content":{"text/plain":{"schema":{"type":"string"}}}}}}},"/v1/logs":{"post":{"operationId":"ExportLogs","summary":"OTLP/HTTP log export (ExportLogsServiceRequest)","security":[{"bearerAuth":[]},{"basicAuth":[]},{}],"x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":false}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExportLogsServiceRequest"}},"application/x-protobuf":{"schema":{"type":"string","format":"binary"}}}},"responses":{"200":{"description":"Accepted. JSON requests get \`{partialSuccess: {}}\`; protobuf requests get an empty protobuf response.","headers":{"access-control-allow-origin":{"description":"With CORS on, the request's \`Origin\` when it is allowed (\`*\` when any origin is). Sent on every status, errors included.","schema":{"type":"string"}},"access-control-allow-credentials":{"description":"\`true\`, beside \`access-control-allow-origin\`","schema":{"type":"string"}},"access-control-expose-headers":{"description":"The configured \`cors.exposedHeaders\`","schema":{"type":"string"}},"vary":{"description":"\`Origin\`, whenever CORS is on","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExportResponse"}},"application/x-protobuf":{"schema":{"type":"string","format":"binary"}}}},"400":{"description":"Undecodable payload. Like every receiver error it is a \`google.rpc.Status\` in the request's encoding (binary for protobuf requests, JSON otherwise).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}},"application/x-protobuf":{"schema":{"type":"string","format":"binary"}}}},"401":{"description":"Credentials missing or not accepted for the \`ingestAuth\` mode: a bearer token (\`bearer\`, the default) or Basic credentials (\`basic\`). \`none\` mode refuses nothing.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}},"application/x-protobuf":{"schema":{"type":"string","format":"binary"}}}},"415":{"description":"Neither application/json nor application/x-protobuf","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"429":{"description":"Throttled (retried by the SDK), with retry-after","headers":{"retry-after":{"schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"500":{"description":"Collector error (not retried by the SDK)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"502":{"description":"Bad gateway (retried)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"503":{"description":"Unavailable (retried)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"504":{"description":"Gateway timeout (retried)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}}}},"options":{"operationId":"PreflightLogs","summary":"CORS preflight a browser exporter sends before \`POST /v1/logs\`","description":"Answered only when \`cors.allowedOrigins\` is set, and before authentication (a preflight carries no credentials). A refused preflight is the same 204 without the \`access-control-allow-*\` headers.","security":[],"x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":true}},"parameters":[{"name":"Origin","in":"header","required":false,"schema":{"type":"string","enum":["https://app.example.test"]}},{"name":"Access-Control-Request-Method","in":"header","required":false,"schema":{"type":"string","enum":["POST"]}},{"name":"Access-Control-Request-Headers","in":"header","required":false,"schema":{"type":"string","enum":["content-type","authorization,content-type,traceparent,tracestate"]}}],"responses":{"204":{"description":"Preflight answered. The \`access-control-allow-*\` headers are present only when the origin, the requested method and every requested header are allowed.","headers":{"access-control-allow-origin":{"description":"The request's \`Origin\` (\`*\` when any origin is allowed)","schema":{"type":"string"}},"access-control-allow-methods":{"description":"The requested method","schema":{"type":"string"}},"access-control-allow-headers":{"description":"The requested headers","schema":{"type":"string"}},"access-control-allow-credentials":{"schema":{"type":"string"}},"access-control-max-age":{"description":"The configured \`cors.maxAge\`, in seconds","schema":{"type":"string"}},"vary":{"schema":{"type":"string"}}}},"405":{"description":"CORS is off (no allowed origin), or the request names no \`Access-Control-Request-Method\`","content":{"text/plain":{"schema":{"type":"string"}}}}}}},"/v1/metrics":{"post":{"operationId":"ExportMetrics","summary":"OTLP/HTTP metrics export: accepted and counted, never stored","security":[{"bearerAuth":[]},{"basicAuth":[]},{}],"x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":false}},"requestBody":{"required":true,"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExportMetricsServiceRequest"}},"application/x-protobuf":{"schema":{"type":"string","format":"binary"}}}},"responses":{"200":{"description":"Accepted. JSON requests get \`{partialSuccess: {}}\`; protobuf requests get an empty protobuf response.","headers":{"access-control-allow-origin":{"description":"With CORS on, the request's \`Origin\` when it is allowed (\`*\` when any origin is). Sent on every status, errors included.","schema":{"type":"string"}},"access-control-allow-credentials":{"description":"\`true\`, beside \`access-control-allow-origin\`","schema":{"type":"string"}},"access-control-expose-headers":{"description":"The configured \`cors.exposedHeaders\`","schema":{"type":"string"}},"vary":{"description":"\`Origin\`, whenever CORS is on","schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/ExportResponse"}},"application/x-protobuf":{"schema":{"type":"string","format":"binary"}}}},"400":{"description":"Undecodable payload. Like every receiver error it is a \`google.rpc.Status\` in the request's encoding (binary for protobuf requests, JSON otherwise).","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}},"application/x-protobuf":{"schema":{"type":"string","format":"binary"}}}},"401":{"description":"Credentials missing or not accepted for the \`ingestAuth\` mode: a bearer token (\`bearer\`, the default) or Basic credentials (\`basic\`). \`none\` mode refuses nothing.","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}},"application/x-protobuf":{"schema":{"type":"string","format":"binary"}}}},"415":{"description":"Neither application/json nor application/x-protobuf","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"429":{"description":"Throttled (retried by the SDK), with retry-after","headers":{"retry-after":{"schema":{"type":"string"}}},"content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"500":{"description":"Collector error (not retried by the SDK)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"502":{"description":"Bad gateway (retried)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"503":{"description":"Unavailable (retried)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}},"504":{"description":"Gateway timeout (retried)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/RpcStatus"}}}}}},"options":{"operationId":"PreflightMetrics","summary":"CORS preflight a browser exporter sends before \`POST /v1/metrics\`","description":"Answered only when \`cors.allowedOrigins\` is set, and before authentication (a preflight carries no credentials). A refused preflight is the same 204 without the \`access-control-allow-*\` headers.","security":[],"x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":true}},"parameters":[{"name":"Origin","in":"header","required":false,"schema":{"type":"string","enum":["https://app.example.test"]}},{"name":"Access-Control-Request-Method","in":"header","required":false,"schema":{"type":"string","enum":["POST"]}},{"name":"Access-Control-Request-Headers","in":"header","required":false,"schema":{"type":"string","enum":["content-type","authorization,content-type,traceparent,tracestate"]}}],"responses":{"204":{"description":"Preflight answered. The \`access-control-allow-*\` headers are present only when the origin, the requested method and every requested header are allowed.","headers":{"access-control-allow-origin":{"description":"The request's \`Origin\` (\`*\` when any origin is allowed)","schema":{"type":"string"}},"access-control-allow-methods":{"description":"The requested method","schema":{"type":"string"}},"access-control-allow-headers":{"description":"The requested headers","schema":{"type":"string"}},"access-control-allow-credentials":{"schema":{"type":"string"}},"access-control-max-age":{"description":"The configured \`cors.maxAge\`, in seconds","schema":{"type":"string"}},"vary":{"schema":{"type":"string"}}}},"405":{"description":"CORS is off (no allowed origin), or the request names no \`Access-Control-Request-Method\`","content":{"text/plain":{"schema":{"type":"string"}}}}}}},"/api/organizations":{"get":{"operationId":"ListOrganizations","summary":"O2: the organizations the Basic user belongs to (display name \u2192 identifier)","security":[{"basicAuth":[]}],"x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":true}},"responses":{"200":{"description":"Organizations","content":{"application/json":{"schema":{"$ref":"#/components/schemas/Organizations"}}}},"401":{"description":"Bad Basic credentials, or an org the user cannot see \u2014 including an org's display name in place of its identifier","content":{"text/plain":{"schema":{"type":"string"}}}}}}},"/api/{org}/streams":{"parameters":[{"name":"org","in":"path","required":true,"description":"The org **identifier** (not its display name)","schema":{"type":"string","x-mockingbird-resource-ref":{"type":"organization","missing":"no-such-org"}}}],"get":{"operationId":"ListStreams","summary":"O2: the org's streams of one type","security":[{"basicAuth":[]}],"x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":true}},"parameters":[{"name":"type","in":"query","required":false,"schema":{"type":"string","enum":["logs","traces"]}}],"responses":{"200":{"description":"Streams","content":{"application/json":{"schema":{"$ref":"#/components/schemas/StreamList"}}}},"401":{"description":"Bad Basic credentials, or an org the user cannot see \u2014 including an org's display name in place of its identifier","content":{"text/plain":{"schema":{"type":"string"}}}}}}},"/api/{org}/streams/{stream}/schema":{"parameters":[{"name":"org","in":"path","required":true,"description":"The org **identifier** (not its display name)","schema":{"type":"string","x-mockingbird-resource-ref":{"type":"organization","missing":"no-such-org"}}},{"name":"stream","in":"path","required":true,"schema":{"type":"string","enum":["default","other"]}}],"get":{"operationId":"GetStreamSchema","summary":"O2: a stream's schema (\`schema[].name\` are the queryable, lowercased, flattened fields)","security":[{"basicAuth":[]}],"x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":true}},"parameters":[{"name":"type","in":"query","required":false,"schema":{"type":"string","enum":["logs","traces"]}}],"responses":{"200":{"description":"Schema","content":{"application/json":{"schema":{"$ref":"#/components/schemas/StreamSchema"}}}},"401":{"description":"Bad Basic credentials, or an org the user cannot see \u2014 including an org's display name in place of its identifier","content":{"text/plain":{"schema":{"type":"string"}}}},"404":{"description":"Nothing has been ingested into this stream","content":{"application/json":{"schema":{"$ref":"#/components/schemas/O2Error"}}}}}}},"/api/{org}/_search":{"parameters":[{"name":"org","in":"path","required":true,"description":"The org **identifier** (not its display name)","schema":{"type":"string","x-mockingbird-resource-ref":{"type":"organization","missing":"no-such-org"}}}],"post":{"operationId":"Search","summary":"O2: SQL search over a stream","security":[{"basicAuth":[]}],"x-mockingbird":{"supported":true,"parity":{"enabled":true,"safe":true}},"parameters":[{"name":"type","in":"query","required":false,"schema":{"type":"string","enum":["logs","traces"]}}],"requestBody":{"required":true,"content":{"application/json":{"schema":{"type":"object","required":["query"],"properties":{"query":{"type":"object","required":["sql"],"properties":{"sql":{"anyOf":[{"type":"string","enum":["SELECT * FROM \\"default\\" WHERE event IS NOT NULL ORDER BY _timestamp DESC","SELECT * FROM \\"default\\" WHERE event IN ('checkout_completed') ORDER BY _timestamp DESC","SELECT service_name, count(*) AS n FROM \\"default\\" GROUP BY service_name ORDER BY n DESC","SELECT * FROM \\"default\\" WHERE severity_text IN ('ERROR', 'FATAL')","SELECT * FROM \\"default\\" WHERE clientUserId = '1'"]},{"type":"string","maxLength":200}]},"start_time":{"type":"integer","minimum":0,"description":"\xB5s since epoch"},"end_time":{"type":"integer","minimum":0,"description":"\xB5s since epoch"},"from":{"type":"integer","minimum":0,"maximum":100},"size":{"type":"integer","minimum":-1,"maximum":1000}}},"search_type":{"type":"string","maxLength":20}}}}}},"responses":{"200":{"description":"Hits","content":{"application/json":{"schema":{"$ref":"#/components/schemas/SearchResponse"}}}},"400":{"description":"Unsupported SQL, or an unknown field (O2 lowercases every field; a camelCase column is unknown)","content":{"application/json":{"schema":{"$ref":"#/components/schemas/O2Error"}}}},"401":{"description":"Bad Basic credentials, or an org the user cannot see \u2014 including an org's display name in place of its identifier","content":{"text/plain":{"schema":{"type":"string"}}}}}}}},"components":{"securitySchemes":{"bearerAuth":{"type":"http","scheme":"bearer"},"basicAuth":{"type":"http","scheme":"basic"}},"schemas":{"KeyValue":{"type":"object","required":["key","value"],"properties":{"key":{"type":"string","enum":["service.name","event","clientUserId","http.method","deployment.environment.name","attempt"]},"value":{"type":"object","properties":{"stringValue":{"type":"string","maxLength":20},"intValue":{"type":["string","integer"]},"boolValue":{"type":"boolean"},"doubleValue":{"type":"number"}}}}},"ExportTraceServiceRequest":{"type":"object","properties":{"resourceSpans":{"type":"array","maxItems":2,"items":{"type":"object","properties":{"resource":{"type":"object","properties":{"attributes":{"type":"array","maxItems":4,"items":{"$ref":"#/components/schemas/KeyValue"}}}},"scopeSpans":{"type":"array","maxItems":2,"items":{"type":"object","properties":{"scope":{"type":"object","properties":{"name":{"type":"string","maxLength":20}}},"spans":{"type":"array","maxItems":3,"items":{"type":"object","required":["traceId","spanId","name"],"properties":{"traceId":{"type":"string","pattern":"^[0-9a-f]{32}$"},"spanId":{"type":"string","pattern":"^[0-9a-f]{16}$"},"parentSpanId":{"type":"string","pattern":"^[0-9a-f]{16}$"},"name":{"type":"string","maxLength":30},"kind":{"type":"integer","minimum":0,"maximum":5},"startTimeUnixNano":{"type":"string","pattern":"^1[0-9]{18}$"},"endTimeUnixNano":{"type":"string","pattern":"^1[0-9]{18}$"},"attributes":{"type":"array","maxItems":4,"items":{"$ref":"#/components/schemas/KeyValue"}},"status":{"type":"object","properties":{"code":{"type":"integer","minimum":0,"maximum":2},"message":{"type":"string","maxLength":40}}}}}}}}}}}}}},"ExportLogsServiceRequest":{"type":"object","properties":{"resourceLogs":{"type":"array","maxItems":2,"items":{"type":"object","properties":{"resource":{"type":"object","properties":{"attributes":{"type":"array","maxItems":4,"items":{"$ref":"#/components/schemas/KeyValue"}}}},"scopeLogs":{"type":"array","maxItems":2,"items":{"type":"object","properties":{"scope":{"type":"object","properties":{"name":{"type":"string","maxLength":20}}},"logRecords":{"type":"array","maxItems":3,"items":{"type":"object","properties":{"timeUnixNano":{"type":"string","pattern":"^1[0-9]{18}$"},"observedTimeUnixNano":{"type":"string","pattern":"^1[0-9]{18}$"},"severityNumber":{"type":"integer","minimum":0,"maximum":24},"severityText":{"type":"string","enum":["TRACE","DEBUG","INFO","WARN","ERROR","FATAL","info","error"]},"body":{"type":"object","properties":{"stringValue":{"type":"string","maxLength":40}}},"attributes":{"type":"array","maxItems":4,"items":{"$ref":"#/components/schemas/KeyValue"}},"traceId":{"type":"string","pattern":"^[0-9a-f]{32}$"},"spanId":{"type":"string","pattern":"^[0-9a-f]{16}$"}}}}}}}}}}}},"ExportMetricsServiceRequest":{"type":"object","properties":{"resourceMetrics":{"type":"array","maxItems":2,"items":{"type":"object","properties":{"resource":{"type":"object","properties":{"attributes":{"type":"array","maxItems":4,"items":{"$ref":"#/components/schemas/KeyValue"}}}},"scopeMetrics":{"type":"array","maxItems":2,"items":{"type":"object","properties":{"metrics":{"type":"array","maxItems":3,"items":{"type":"object","properties":{"name":{"type":"string","maxLength":30},"unit":{"type":"string","maxLength":10}}}}}}}}}}}},"ExportResponse":{"type":"object","required":["partialSuccess"],"properties":{"partialSuccess":{"type":"object","properties":{"rejectedSpans":{"type":["string","integer"]},"rejectedLogRecords":{"type":["string","integer"]},"rejectedDataPoints":{"type":["string","integer"]},"errorMessage":{"type":"string"}}}}},"RpcStatus":{"type":"object","required":["code","message"],"properties":{"code":{"type":"integer"},"message":{"type":"string"}}},"O2Error":{"type":"object","required":["code","message"],"properties":{"code":{"type":"integer"},"message":{"type":"string"},"error_detail":{"type":"string"}}},"Organizations":{"type":"object","required":["data"],"properties":{"data":{"type":"array","items":{"type":"object","required":["identifier","name"],"properties":{"id":{"type":"integer"},"identifier":{"type":"string","x-mockingbird-resource":{"type":"organization","identity":true}},"name":{"type":"string"},"type":{"type":"string"}}}}}},"StreamList":{"type":"object","required":["list"],"properties":{"list":{"type":"array","items":{"type":"object","required":["name","stream_type"],"properties":{"name":{"type":"string"},"stream_type":{"type":"string"},"storage_type":{"type":"string"},"stats":{"type":"object"}}}}}},"StreamSchema":{"type":"object","required":["name","stream_type","schema"],"properties":{"name":{"type":"string"},"stream_type":{"type":"string"},"storage_type":{"type":"string"},"stats":{"type":"object"},"schema":{"type":"array","items":{"type":"object","required":["name","type"],"properties":{"name":{"type":"string"},"type":{"type":"string","enum":["Utf8","Int64","Float64","Boolean"]}}}},"settings":{"type":"object"}}},"SearchResponse":{"type":"object","required":["took","hits","total","from","size"],"properties":{"took":{"type":"integer","x-mockingbird-volatile":{"kind":"opaque"}},"hits":{"type":"array","items":{"type":"object"}},"total":{"type":"integer"},"from":{"type":"integer"},"size":{"type":"integer"},"scan_size":{"type":"integer"},"scan_records":{"type":"integer"},"is_partial":{"type":"boolean"},"cached_ratio":{"type":"integer"}}}}}}`);
+var operationIds = ["ExportTraces", "PreflightTraces", "ExportLogs", "PreflightLogs", "ExportMetrics", "PreflightMetrics", "ListOrganizations", "ListStreams", "GetStreamSchema", "Search"];
+var supportedOperationIds = ["ExportTraces", "PreflightTraces", "ExportLogs", "PreflightLogs", "ExportMetrics", "PreflightMetrics", "ListOrganizations", "ListStreams", "GetStreamSchema", "Search"];
 
 // src/otlp.ts
 var isRecord5 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
@@ -4100,13 +4156,17 @@ var execute = (query, rows) => {
 };
 
 // src/state.ts
+var INGEST_AUTH_MODES = ["bearer", "basic", "none"];
 var DEFAULT_ORGANIZATIONS = [
   { identifier: "default", name: "default" },
   { identifier: "30rBqcDevOrg7Hn2KmQ4xW9sLtY", name: "development" },
   { identifier: "3HSzeProdOrg5Jd8VpN1cR6gTfB", name: "production" }
 ];
 var DEFAULT_SETTINGS = {
+  ingestAuth: "bearer",
   ingestTokens: [],
+  ingestUsers: [],
+  cors: { allowedOrigins: [] },
   searchUsers: [],
   organizations: [...DEFAULT_ORGANIZATIONS],
   routing: { byEnvironment: { production: "production" }, default: "development" },
@@ -4132,8 +4192,9 @@ var OtelState = class {
       this.settings.insert("settings", { ...DEFAULT_SETTINGS, ...this.seed.settings });
     }
   }
+  /** Stored settings over the defaults, so a snapshot from before a setting existed still reads. */
   current() {
-    return this.settings.get("settings") ?? DEFAULT_SETTINGS;
+    return { ...DEFAULT_SETTINGS, ...this.settings.get("settings") };
   }
   update(patch) {
     const next = { ...this.current(), ...patch };
@@ -4197,6 +4258,28 @@ var OtelState = class {
   }
 };
 
+// src/status.ts
+var PROTOBUF = "application/x-protobuf";
+var mediaType = (request) => request.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() ?? "";
+var varint = (value) => {
+  const bytes = [];
+  let rest = value >>> 0;
+  while (rest > 127) {
+    bytes.push(rest & 127 | 128);
+    rest >>>= 7;
+  }
+  bytes.push(rest);
+  return bytes;
+};
+var encodeStatus = (code, message) => {
+  const text2 = new TextEncoder().encode(message);
+  return Uint8Array.from([
+    ...code === 0 ? [] : [8, ...varint(code)],
+    ...text2.length === 0 ? [] : [18, ...varint(text2.length), ...text2]
+  ]);
+};
+var rpcStatus = (request, status, code, message) => mediaType(request) === PROTOBUF ? new Response(encodeStatus(code, message), { status, headers: { "content-type": PROTOBUF } }) : jsonRes(status, { code, message });
+
 // src/runtime.ts
 var rpc = (code, message) => ({ code, message });
 var OTEL_PRESETS = {
@@ -4205,6 +4288,7 @@ var OTEL_PRESETS = {
     rules: [
       {
         pathPrefix: "/v1/",
+        method: "POST",
         status: 429,
         headers: { "retry-after": "1" },
         body: rpc(8, "rate limited")
@@ -4213,27 +4297,27 @@ var OTEL_PRESETS = {
   },
   bad_gateway: {
     description: "Exports answer 502 (the SDK retries)",
-    rules: [{ pathPrefix: "/v1/", status: 502, body: rpc(14, "bad gateway") }]
+    rules: [{ pathPrefix: "/v1/", method: "POST", status: 502, body: rpc(14, "bad gateway") }]
   },
   unavailable: {
     description: "Exports answer 503 (the SDK retries)",
-    rules: [{ pathPrefix: "/v1/", status: 503, body: rpc(14, "unavailable") }]
+    rules: [{ pathPrefix: "/v1/", method: "POST", status: 503, body: rpc(14, "unavailable") }]
   },
   gateway_timeout: {
     description: "Exports answer 504 (the SDK retries)",
-    rules: [{ pathPrefix: "/v1/", status: 504, body: rpc(4, "deadline exceeded") }]
+    rules: [{ pathPrefix: "/v1/", method: "POST", status: 504, body: rpc(4, "deadline exceeded") }]
   },
   server_error: {
     description: "Exports answer 500 (the SDK drops the batch: not retryable)",
-    rules: [{ pathPrefix: "/v1/", status: 500, body: rpc(13, "internal error") }]
+    rules: [{ pathPrefix: "/v1/", method: "POST", status: 500, body: rpc(13, "internal error") }]
   },
   unauthorized: {
-    description: "Exports answer 401 as if OTEL_AUTH_TOKEN were wrong (dropped, never retried)",
-    rules: [{ pathPrefix: "/v1/", status: 401, body: rpc(16, "Unauthenticated") }]
+    description: "Exports answer 401 as if the credentials were wrong (dropped, never retried)",
+    rules: [{ pathPrefix: "/v1/", method: "POST", status: 401, body: rpc(16, "Unauthenticated") }]
   },
   partial_success: {
     description: "Exports answer 200 with partialSuccess rejecting every item (JSON only); nothing is stored",
-    rules: [{ pathPrefix: "/v1/", effect: "partial_success" }]
+    rules: [{ pathPrefix: "/v1/", method: "POST", effect: "partial_success" }]
   },
   search_unavailable: {
     description: "O2 search answers 503 (our clients degrade: empty hops, error result)",
@@ -4252,6 +4336,24 @@ var matchesWhere = (row, where) => Object.entries(where).every(([key, value]) =>
   if (formatted in row) return same(row[formatted], value);
   return same(row[`service_${formatted}`], value);
 });
+var isStrings = (value) => Array.isArray(value) && value.every((item) => typeof item === "string");
+var CORS_SHAPE = "cors: {allowedOrigins: string[], allowedHeaders?: string[], allowedMethods?: string[], exposedHeaders?: string[], maxAge?: number}";
+var corsSettings = (value) => {
+  if (!isRecord6(value) || !isStrings(value.allowedOrigins)) return void 0;
+  const cors = { allowedOrigins: value.allowedOrigins };
+  for (const key of ["allowedHeaders", "allowedMethods", "exposedHeaders"]) {
+    const list2 = value[key];
+    if (list2 === void 0) continue;
+    if (!isStrings(list2)) return void 0;
+    cors[key] = list2;
+  }
+  if (value.maxAge !== void 0) {
+    if (typeof value.maxAge !== "number" || !Number.isInteger(value.maxAge)) return void 0;
+    cors.maxAge = value.maxAge;
+  }
+  return cors;
+};
+var users = (value) => Array.isArray(value) && value.every(isRecord6) ? value.map((u) => ({ username: String(u.username), password: String(u.password ?? "") })) : void 0;
 var WAIT_POLL_MS = 20;
 var MAX_WAIT_MS = 6e4;
 var adminRoutes = (runtime) => {
@@ -4328,18 +4430,30 @@ var adminRoutes = (runtime) => {
     "PUT /settings": ({ body, namespace }) => {
       if (!isRecord6(body)) return adminError4(400, "expected a JSON object");
       const patch = {};
+      if (body.ingestAuth !== void 0) {
+        if (!INGEST_AUTH_MODES.includes(body.ingestAuth)) {
+          return adminError4(400, `ingestAuth: ${INGEST_AUTH_MODES.join(" | ")}`);
+        }
+        patch.ingestAuth = body.ingestAuth;
+      }
       if (body.ingestTokens !== void 0) {
         if (!Array.isArray(body.ingestTokens)) return adminError4(400, "ingestTokens: string[]");
         patch.ingestTokens = body.ingestTokens.map(String);
       }
+      if (body.ingestUsers !== void 0) {
+        const ingestUsers = users(body.ingestUsers);
+        if (!ingestUsers) return adminError4(400, "ingestUsers: [{username, password}]");
+        patch.ingestUsers = ingestUsers;
+      }
+      if (body.cors !== void 0) {
+        const cors = corsSettings(body.cors);
+        if (!cors) return adminError4(400, CORS_SHAPE);
+        patch.cors = cors;
+      }
       if (body.searchUsers !== void 0) {
-        if (!Array.isArray(body.searchUsers) || !body.searchUsers.every(isRecord6)) {
-          return adminError4(400, "searchUsers: [{username, password}]");
-        }
-        patch.searchUsers = body.searchUsers.map((u) => ({
-          username: String(u.username),
-          password: String(u.password ?? "")
-        }));
+        const searchUsers = users(body.searchUsers);
+        if (!searchUsers) return adminError4(400, "searchUsers: [{username, password}]");
+        patch.searchUsers = searchUsers;
       }
       if (body.organizations !== void 0) {
         if (!Array.isArray(body.organizations) || !body.organizations.every(
@@ -4395,11 +4509,13 @@ var createRuntime2 = (options = {}) => createRuntime({
 
 // src/index.ts
 var OTEL_NAMESPACE = "otel";
-var PROTOBUF = "application/x-protobuf";
+var RECEIVER_PATHS = /* @__PURE__ */ new Set(["/v1/traces", "/v1/logs", "/v1/metrics"]);
 var otelCredential = (request) => bearerToken(request) ?? basicAuth(request)?.username;
 var isRecord7 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
-var mediaType = (request) => request.headers.get("content-type")?.split(";")[0]?.trim().toLowerCase() ?? "";
-var rpcStatus = (status, code, message) => jsonRes(status, { code, message });
+var methodNotAllowed = () => new Response("405 method not allowed, supported: [POST]", {
+  status: 405,
+  headers: { "content-type": "text/plain" }
+});
 var unauthorized = () => new Response("Unauthorized Access", {
   status: 401,
   headers: { "content-type": "text/plain; charset=utf-8" }
@@ -4420,6 +4536,9 @@ var OtelAPI = class {
       ExportTraces: (context) => this.export(context, "traces"),
       ExportLogs: (context) => this.export(context, "logs"),
       ExportMetrics: (context) => this.export(context, "metrics"),
+      PreflightTraces: (context) => this.preflight(context),
+      PreflightLogs: (context) => this.preflight(context),
+      PreflightMetrics: (context) => this.preflight(context),
       ListOrganizations: () => this.organizations(),
       ListStreams: (context) => this.streams(context),
       GetStreamSchema: (context) => this.schema(context),
@@ -4441,8 +4560,16 @@ var OtelAPI = class {
     this.app = this.service.app;
     this.sqlite = this.service.sqlite;
   }
-  /** Inflate `content-encoding: gzip` bodies (the exporters' `compression: "gzip"`). */
+  /** CORS wraps everything the receiver answers, its errors included. */
   async fetch(request) {
+    const response = await this.dispatch(request);
+    if (!RECEIVER_PATHS.has(new URL(request.url).pathname) || isPreflight(request)) return response;
+    const cors = this.settings().cors;
+    if (corsEnabled(cors)) applyCors(request, response, cors);
+    return response;
+  }
+  /** Inflate `content-encoding: gzip` bodies (the exporters' `compression: "gzip"`). */
+  async dispatch(request) {
     const encoding = request.headers.get("content-encoding")?.toLowerCase();
     if (encoding !== "gzip" || request.body === null) return this.service.fetch(request);
     let inflated;
@@ -4451,7 +4578,7 @@ var OtelAPI = class {
         request.body.pipeThrough(new DecompressionStream("gzip"))
       ).arrayBuffer();
     } catch {
-      return rpcStatus(400, 3, "invalid gzip body");
+      return rpcStatus(request, 400, 3, "invalid gzip body");
     }
     const headers = new Headers(request.headers);
     headers.delete("content-encoding");
@@ -4477,18 +4604,14 @@ var OtelAPI = class {
   }
   gate(context) {
     const operationId = context.operation.operationId;
+    if (operationId.startsWith("Preflight")) return void 0;
     if (operationId.startsWith("Export")) {
-      const token = bearerToken(context.request);
-      const accepted = this.settings().ingestTokens;
-      if (!token || accepted.length > 0 && !accepted.includes(token)) {
-        return rpcStatus(401, 16, "Unauthenticated");
-      }
-      return void 0;
+      return this.ingestAllowed(context.request) ? void 0 : rpcStatus(context.request, 401, 16, "Unauthenticated");
     }
     const credentials = basicAuth(context.request);
     if (!credentials) return unauthorized();
-    const users = this.settings().searchUsers;
-    if (users.length > 0 && !users.some((u) => u.username === credentials.username && u.password === credentials.password)) {
+    const users2 = this.settings().searchUsers;
+    if (users2.length > 0 && !users2.some((u) => u.username === credentials.username && u.password === credentials.password)) {
       return unauthorized();
     }
     const org = context.params.org;
@@ -4497,6 +4620,26 @@ var OtelAPI = class {
     }
     return void 0;
   }
+  /** The receiver's auth mode: nothing, Basic credentials, or (the default) a bearer token. */
+  ingestAllowed(request) {
+    const settings = this.settings();
+    if (settings.ingestAuth === "none") return true;
+    if (settings.ingestAuth === "basic") {
+      const credentials = basicAuth(request);
+      const users2 = settings.ingestUsers;
+      return credentials !== void 0 && (users2.length === 0 || users2.some(
+        (u) => u.username === credentials.username && u.password === credentials.password
+      ));
+    }
+    const token = bearerToken(request);
+    const accepted = settings.ingestTokens;
+    return token !== void 0 && (accepted.length === 0 || accepted.includes(token));
+  }
+  /** `OPTIONS` on a receiver route: a CORS preflight when CORS is on, else not a method it takes. */
+  preflight(context) {
+    const cors = this.settings().cors;
+    return corsEnabled(cors) && isPreflight(context.request) ? preflightResponse(context.request, cors) : methodNotAllowed();
+  }
   decode(context, kind) {
     const type = mediaType(context.request);
     const body = context.body;
@@ -4506,16 +4649,16 @@ var OtelAPI = class {
         const payload = kind === "traces" ? decodeTraceRequest(bytes) : kind === "logs" ? decodeLogsRequest(bytes) : { resourceMetrics: new Array(countMetricsRequest(bytes)).fill({}) };
         return { payload, protobuf: true, bytes: bytes.length };
       } catch (error) {
-        if (error instanceof ProtobufError) return rpcStatus(400, 3, error.message);
+        if (error instanceof ProtobufError) return rpcStatus(context.request, 400, 3, error.message);
         throw error;
       }
     }
     if (type !== "application/json") {
-      return rpcStatus(415, 3, `unsupported content type ${type || "(none)"}`);
+      return rpcStatus(context.request, 415, 3, `unsupported content type ${type || "(none)"}`);
     }
     if (body.kind === "empty") return { payload: {}, protobuf: false, bytes: 0 };
     if (body.kind !== "json" || !isRecord7(body.value)) {
-      return rpcStatus(400, 3, "request body is not an OTLP/JSON export request");
+      return rpcStatus(context.request, 400, 3, "request body is not an OTLP/JSON export request");
     }
     return { payload: body.value, protobuf: false, bytes: JSON.stringify(body.value).length };
   }
@@ -4688,6 +4831,7 @@ export {
   parseSql,
   referencedColumns,
   execute,
+  INGEST_AUTH_MODES,
   DEFAULT_ORGANIZATIONS,
   DEFAULT_SETTINGS,
   OTEL_PRESETS,
@@ -4697,4 +4841,4 @@ export {
   OtelAPI,
   adminRow
 };
-//# sourceMappingURL=chunk-HRGWNDT2.js.map
+//# sourceMappingURL=chunk-T4AU5UCQ.js.map