@marinoscar/platform-api 0.0.0-stage → 0.1.0-next.3

package/dist/telemetry/dashboard/telemetry-dashboard.service.js

@@ -0,0 +1,904 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var __param = (this && this.__param) || function (paramIndex, decorator) {
+    return function (target, key) { decorator(target, key, paramIndex); }
+};
+var TelemetryDashboardService_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.UNKNOWN_ROUTES_TOP_N = exports.TelemetryDashboardService = exports.SharedTtlCache = exports.TELEMETRY_DASHBOARD_AUDIT_ACTION = exports.DASHBOARD_LOG_Q_MAX = exports.RUNTIME_MIN_BUCKET_SECONDS = exports.LAST_DATA_LOOKBACK_MS = exports.DASHBOARD_CACHE_MAX_ENTRIES = exports.DASHBOARD_DISTINCT_CACHE_MS = exports.DASHBOARD_RESULT_CACHE_MS = void 0;
+exports.resolveWindow = resolveWindow;
+exports.catalogOf = catalogOf;
+exports.encodeCursor = encodeCursor;
+exports.decodeCursor = decodeCursor;
+exports.nsToMs = nsToMs;
+exports.toDate = toDate;
+exports.bucketStarts = bucketStarts;
+exports.unknownRoutesOf = unknownRoutesOf;
+exports.parseSeverities = parseSeverities;
+exports.auditParams = auditParams;
+const common_1 = require("@nestjs/common");
+const telemetry_dashboard_dto_1 = require("../dto/telemetry-dashboard.dto");
+const greptime_client_1 = require("../greptime/greptime.client");
+const sql_guard_1 = require("../query/sql-guard");
+const telemetry_availability_1 = require("../query/telemetry-availability");
+const telemetry_query_errors_1 = require("../query/telemetry-query.errors");
+const telemetry_schema_service_1 = require("../query/telemetry-schema.service");
+const ports_1 = require("../ports");
+const telemetry_settings_service_1 = require("../telemetry-settings.service");
+const metric_catalog_1 = require("../metrics/metric-catalog");
+const metric_group_1 = require("../metrics/metric-group");
+const metric_sql_1 = require("../metrics/metric-sql");
+const metric_verdict_1 = require("../metrics/metric-verdict");
+const telemetry_dashboard_sql_1 = require("./telemetry-dashboard.sql");
+const telemetry_options_1 = require("../telemetry.options");
+const telemetry_dashboard_verdict_1 = require("./telemetry-dashboard.verdict");
+const verdict_policy_1 = require("./verdict-policy");
+// =============================================================================
+// TelemetryDashboardService — the fixed dashboard over the telemetry store
+// (issue #577, epic #576)
+// =============================================================================
+//
+// Unlike the explorer, NOTHING here is caller-supplied SQL: every statement is
+// a template of `telemetry-dashboard.sql.ts`, filled with validated values.
+// The flow of every route:
+//
+//   1. preconditions (`requireQueryablePolicy`): 503 not configured, 409
+//      disabled — checked before the cache, so a disabled store never serves
+//      a cached answer;
+//   2. the window: `range` (relative to now) or `from`/`to`, bucket size =
+//      span/buckets rounded UP to an allowed size; the previous window is the
+//      same span ending at `from`;
+//   3. the 15-second RESULT CACHE, keyed by route + normalized params (a
+//      relative range keys by its name, not its instants), with concurrent
+//      identical requests sharing one in-flight promise;
+//   4. on a miss: which tables/columns exist (`TelemetrySchemaService`,
+//      cached 30 s) so a fresh store degrades to empty panels rather than
+//      failing; `service`/`instance` checked against the DISTINCT values seen
+//      in the range (cached 60 s) → 400 TELEMETRY_DASHBOARD_BAD_FILTER; then
+//      the statements, through the READ-ONLY reader pool with the policy's
+//      client-side timeout (summary: all at once, `Promise.all`);
+//   5. an audit row per store read (`telemetry:dashboard`), failures too. A
+//      cache hit is not audited: nothing was read from the store.
+//
+// NOT A QUEUE JOB (CLAUDE.md): every statement is bounded by the policy
+// timeout and a literal LIMIT, and none outlives the request. No @Cron, no
+// @OnEvent, no detached promise; the caches expire lazily on read.
+//
+// ⚠ Never log `q` beyond 64 characters, and never log rows.
+// =============================================================================
+exports.DASHBOARD_RESULT_CACHE_MS = 15_000;
+exports.DASHBOARD_DISTINCT_CACHE_MS = 60_000;
+/** Entries each cache keeps at most (oldest evicted first). */
+exports.DASHBOARD_CACHE_MAX_ENTRIES = 500;
+/** How far back "latest data" looks. */
+exports.LAST_DATA_LOOKBACK_MS = 7 * 24 * 60 * 60_000;
+/** Runtime metrics are exported every 60 s: a finer bucket would be half empty. */
+exports.RUNTIME_MIN_BUCKET_SECONDS = 60;
+/** How much of `q` an audit row or log line keeps. */
+exports.DASHBOARD_LOG_Q_MAX = 64;
+exports.TELEMETRY_DASHBOARD_AUDIT_ACTION = 'telemetry:dashboard';
+/** The request's window at `now`. The DTO has already refused conflicting or oversized windows. */
+function resolveWindow(query, now = Date.now()) {
+    const buckets = Number(query.buckets ?? telemetry_dashboard_dto_1.DASHBOARD_BUCKET_COUNTS[telemetry_dashboard_dto_1.DASHBOARD_BUCKET_COUNTS.length - 1]);
+    let from;
+    let to;
+    let key;
+    if (query.from && query.to) {
+        from = new Date(query.from);
+        to = new Date(query.to);
+        key = `from=${from.toISOString()}&to=${to.toISOString()}`;
+    }
+    else {
+        const range = query.range ?? telemetry_dashboard_dto_1.DEFAULT_DASHBOARD_RANGE;
+        to = new Date(now);
+        from = new Date(now - telemetry_dashboard_dto_1.DASHBOARD_RANGE_MS[range]);
+        key = `range=${range}`;
+    }
+    const spanMs = to.getTime() - from.getTime();
+    return {
+        from,
+        to,
+        spanMs,
+        previousFrom: new Date(from.getTime() - spanMs),
+        bucketSeconds: (0, telemetry_dashboard_sql_1.bucketSecondsFor)(spanMs, buckets),
+        key: `${key}&buckets=${buckets}`,
+        spanKey: key,
+    };
+}
+/** A TTL cache whose concurrent misses for one key share one promise. Failures are not cached. */
+class SharedTtlCache {
+    ttlMs;
+    maxEntries;
+    entries = new Map();
+    inflight = new Map();
+    constructor(ttlMs, maxEntries = exports.DASHBOARD_CACHE_MAX_ENTRIES) {
+        this.ttlMs = ttlMs;
+        this.maxEntries = maxEntries;
+    }
+    get(key, load) {
+        const hit = this.entries.get(key);
+        if (hit && Date.now() - hit.at < this.ttlMs)
+            return Promise.resolve(hit.value);
+        if (hit)
+            this.entries.delete(key);
+        const pending = this.inflight.get(key);
+        if (pending)
+            return pending;
+        const promise = load()
+            .then((value) => {
+            this.entries.set(key, { value, at: Date.now() });
+            this.evict();
+            return value;
+        })
+            .finally(() => {
+            this.inflight.delete(key);
+        });
+        this.inflight.set(key, promise);
+        return promise;
+    }
+    clear() {
+        this.entries.clear();
+    }
+    evict() {
+        const now = Date.now();
+        for (const [key, entry] of this.entries) {
+            if (now - entry.at >= this.ttlMs)
+                this.entries.delete(key);
+        }
+        while (this.entries.size > this.maxEntries) {
+            const oldest = this.entries.keys().next().value;
+            this.entries.delete(oldest);
+        }
+    }
+}
+exports.SharedTtlCache = SharedTtlCache;
+function catalogOf(schema) {
+    const columns = (table) => {
+        const found = schema.tables.find((t) => t.name === table);
+        return found ? new Set(found.columns.map((c) => c.name)) : null;
+    };
+    const traces = columns(telemetry_dashboard_sql_1.TRACES_TABLE);
+    const logs = columns(telemetry_dashboard_sql_1.LOGS_TABLE);
+    return {
+        traces: !!traces && telemetry_dashboard_sql_1.REQUIRED_TRACE_COLUMNS.every((c) => traces.has(c)),
+        tracesHaveInstance: !!traces && traces.has(telemetry_dashboard_sql_1.TRACE_COLUMNS.instance),
+        tracesHaveRouteMatched: !!traces && traces.has(telemetry_dashboard_sql_1.TRACE_COLUMNS.routeMatched),
+        tracesHaveBearer: !!traces && traces.has(telemetry_dashboard_sql_1.TRACE_COLUMNS.bearer),
+        logs: !!logs && telemetry_dashboard_sql_1.REQUIRED_LOG_COLUMNS.every((c) => logs.has(c)),
+        heap: columns(telemetry_dashboard_sql_1.HEAP_USED_TABLE) !== null,
+        eventLoop: columns(telemetry_dashboard_sql_1.EVENT_LOOP_P99_TABLE) !== null,
+    };
+}
+// ---- cursor ------------------------------------------------------------------
+function encodeCursor(cursor) {
+    return Buffer.from(JSON.stringify({ ts: cursor.ts, spanId: cursor.spanId }), 'utf8').toString('base64url');
+}
+/** Strictly decodes a cursor, or throws 400 TELEMETRY_DASHBOARD_BAD_CURSOR. */
+function decodeCursor(raw) {
+    const bad = () => new telemetry_query_errors_1.TelemetryHttpError(telemetry_query_errors_1.TELEMETRY_ERROR_REASONS.DASHBOARD_BAD_CURSOR, 'The events cursor is not valid.');
+    if (!/^[A-Za-z0-9_-]+$/.test(raw))
+        throw bad();
+    let parsed;
+    try {
+        parsed = JSON.parse(Buffer.from(raw, 'base64url').toString('utf8'));
+    }
+    catch {
+        throw bad();
+    }
+    if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed))
+        throw bad();
+    const keys = Object.keys(parsed).sort();
+    if (keys.length !== 2 || keys[0] !== 'spanId' || keys[1] !== 'ts')
+        throw bad();
+    const { ts, spanId } = parsed;
+    if (typeof ts !== 'string' || typeof spanId !== 'string')
+        throw bad();
+    if (!telemetry_dashboard_sql_1.EVENT_CURSOR_TS_PATTERN.test(ts) || !telemetry_dashboard_sql_1.EVENT_CURSOR_SPAN_PATTERN.test(spanId))
+        throw bad();
+    if (!Number.isFinite(Date.parse(toIsoText(ts))))
+        throw bad();
+    return { ts, spanId };
+}
+// ---- value conversion ----------------------------------------------------------
+function num(value) {
+    const n = typeof value === 'number' ? value : Number(value);
+    return Number.isFinite(n) ? n : 0;
+}
+/** ns (number or UInt64 text) → ms rounded to 0.1, or null. */
+function nsToMs(value) {
+    if (value === null || value === undefined || value === '')
+        return null;
+    const n = Number(value);
+    return Number.isFinite(n) ? Math.round(n / 1e5) / 10 : null;
+}
+function round2(value) {
+    return Math.round(value * 100) / 100;
+}
+/** The store's timestamp text (`2026-09-27 22:21:00.000000`, UTC) as ISO with `T` and `Z`, full precision. */
+function toIsoText(text) {
+    const t = text.replace(' ', 'T');
+    return t.endsWith('Z') ? t : `${t}Z`;
+}
+/** A store timestamp as a Date, or null. */
+function toDate(value) {
+    if (value === null || value === undefined || value === '')
+        return null;
+    if (value instanceof Date)
+        return Number.isFinite(value.getTime()) ? value : null;
+    const ms = Date.parse(toIsoText(String(value)));
+    return Number.isFinite(ms) ? new Date(ms) : null;
+}
+function toIso(value) {
+    return toDate(value)?.toISOString() ?? null;
+}
+function str(value) {
+    return value === null || value === undefined || value === '' ? null : String(value);
+}
+/** Bucket starts covering `[from, to)`, aligned to the epoch like `date_bin`. */
+function bucketStarts(from, to, bucketSeconds) {
+    const size = bucketSeconds * 1000;
+    const starts = [];
+    for (let t = Math.floor(from.getTime() / size) * size; t < to.getTime(); t += size)
+        starts.push(t);
+    return starts;
+}
+/** Rows keyed by their bucket start (ms), from a column `t`. */
+function byBucket(result) {
+    const map = new Map();
+    if (!result)
+        return map;
+    const index = result.fields.findIndex((f) => f.name === 't');
+    for (const row of result.rows) {
+        const t = toDate(row[index]);
+        if (t)
+            map.set(t.getTime(), row);
+    }
+    return map;
+}
+function column(result, name) {
+    return result ? result.fields.findIndex((f) => f.name === name) : -1;
+}
+/** Row objects keyed by field name. */
+function objects(result) {
+    if (!result)
+        return [];
+    return result.rows.map((row) => Object.fromEntries(result.fields.map((f, i) => [f.name, row[i]])));
+}
+function periods(result) {
+    const rows = objects(result);
+    return {
+        current: rows.find((r) => r.period === 'current') ?? {},
+        previous: rows.find((r) => r.period === 'previous') ?? {},
+    };
+}
+function severityLabel(severityNumber, text) {
+    const label = str(text);
+    if (label)
+        return label.toLowerCase();
+    const n = num(severityNumber);
+    if (n >= 17)
+        return 'error';
+    if (n >= 13)
+        return 'warn';
+    if (n >= 9)
+        return 'info';
+    return 'other';
+}
+/** Collects the statements a request ran, in order, and runs them. */
+class StatementRunner {
+    greptime;
+    timeoutMs;
+    sql = [];
+    constructor(greptime, timeoutMs) {
+        this.greptime = greptime;
+        this.timeoutMs = timeoutMs;
+    }
+    async run(sql) {
+        this.sql.push(sql);
+        try {
+            return await this.greptime.queryReader(sql, { timeoutMs: this.timeoutMs });
+        }
+        catch (error) {
+            throw (0, telemetry_availability_1.toTelemetryHttpError)(error);
+        }
+    }
+    /** `run`, or null without running when `sql` is null. */
+    maybe(sql) {
+        return sql ? this.run(sql) : Promise.resolve(null);
+    }
+}
+let TelemetryDashboardService = TelemetryDashboardService_1 = class TelemetryDashboardService {
+    greptime;
+    settings;
+    schema;
+    auditSink;
+    verdictPolicy;
+    thresholds;
+    metricFreshMs;
+    logger = new common_1.Logger(TelemetryDashboardService_1.name);
+    results = new SharedTtlCache(exports.DASHBOARD_RESULT_CACHE_MS);
+    distinct = new SharedTtlCache(exports.DASHBOARD_DISTINCT_CACHE_MS);
+    constructor(greptime, settings, schema, auditSink, verdictPolicy = new verdict_policy_1.DefaultVerdictPolicy(), thresholds = telemetry_dashboard_verdict_1.DEFAULT_VERDICT_THRESHOLDS, metricFreshMs = metric_group_1.METRIC_FRESH_MS) {
+        this.greptime = greptime;
+        this.settings = settings;
+        this.schema = schema;
+        this.auditSink = auditSink;
+        this.verdictPolicy = verdictPolicy;
+        this.thresholds = thresholds;
+        this.metricFreshMs = metricFreshMs;
+    }
+    async summary(userId, query) {
+        return this.cached(userId, 'summary', query, {}, (ctx) => this.computeSummary(ctx));
+    }
+    async timeseries(userId, query) {
+        return this.cached(userId, 'timeseries', query, { panel: query.panel }, (ctx) => this.computeTimeseries(ctx, query.panel));
+    }
+    async top(userId, query) {
+        return this.cached(userId, 'top', query, { kind: query.kind }, (ctx) => this.computeTop(ctx, query.kind));
+    }
+    /** One metric group of the catalog (#601): tiles, series and tables. */
+    async metrics(userId, query) {
+        return this.cached(userId, 'metrics', query, { group: query.group }, (ctx) => this.computeMetrics(ctx, query.group));
+    }
+    async events(userId, query) {
+        // Validated before the cache, so a malformed cursor is a 400 every time.
+        const cursor = query.cursor ? decodeCursor(query.cursor) : null;
+        const severities = parseSeverities(query.severity);
+        return this.cached(userId, 'events', query, { severity: severities.join(','), q: query.q ?? '', cursor: query.cursor ?? '' }, (ctx) => this.computeEvents(ctx, severities, query.q ?? null, cursor));
+    }
+    async filters(userId, query) {
+        const policy = await (0, telemetry_availability_1.requireQueryablePolicy)(this.greptime, this.settings);
+        const window = resolveWindow(query);
+        const timeoutMs = policy.query.timeoutSeconds * 1000;
+        const started = Date.now();
+        const values = await this.distinct.get(window.spanKey, () => this.audited(userId, 'filters', query, started, () => this.loadDistinct(window, timeoutMs)));
+        return {
+            range: rangeOf(window),
+            generatedAt: values.generatedAt,
+            truncated: values.truncated,
+            sql: values.sql,
+            services: values.services,
+            instances: values.instances,
+            hosts: values.hosts,
+        };
+    }
+    // ---------------------------------------------------------------------------
+    /** Preconditions, window, result cache, audit. */
+    async cached(userId, route, query, extra, compute) {
+        const policy = await (0, telemetry_availability_1.requireQueryablePolicy)(this.greptime, this.settings);
+        const window = resolveWindow(query);
+        const key = [
+            route,
+            window.key,
+            `service=${query.service ?? ''}`,
+            `instance=${query.instance ?? ''}`,
+            `host=${query.host ?? ''}`,
+            ...Object.entries(extra)
+                .sort(([a], [b]) => (a < b ? -1 : 1))
+                .map(([k, v]) => `${k}=${v}`),
+        ].join('\u0000');
+        const value = await this.results.get(key, () => {
+            const started = Date.now();
+            return this.audited(userId, route, { ...query, ...extra }, started, async () => {
+                const runner = new StatementRunner(this.greptime, policy.query.timeoutSeconds * 1000);
+                const schema = await this.schema.getSchema();
+                const catalog = catalogOf(schema);
+                const tables = (0, metric_catalog_1.metricTablesOf)(schema);
+                const filters = await this.validateFilters(window, query, { catalog, tables }, policy.query.timeoutSeconds * 1000);
+                return compute({ window, filters, catalog, tables, runner });
+            });
+        });
+        return value;
+    }
+    /** Runs `work`, then writes the audit row (for a failure too) and logs the outcome. */
+    async audited(userId, route, params, started, work) {
+        let result;
+        try {
+            result = await work();
+        }
+        catch (error) {
+            const elapsedMs = Date.now() - started;
+            await this.audit(userId, route, params, {
+                elapsedMs,
+                error: error instanceof Error ? error.message : String(error),
+                ...(error instanceof telemetry_query_errors_1.TelemetryHttpError ? { reason: error.reason } : {}),
+            }).catch((auditError) => {
+                this.logger.warn(`Could not audit a failed telemetry dashboard read: ${auditError instanceof Error ? auditError.message : String(auditError)}`);
+            });
+            throw error;
+        }
+        const elapsedMs = Date.now() - started;
+        const statements = Array.isArray(result.sql) ? result.sql.length : 1;
+        this.logger.debug(`Telemetry dashboard ${route}: ${statements} statement(s) in ${elapsedMs} ms`);
+        await this.audit(userId, route, params, { elapsedMs, statements, truncated: result.truncated });
+        return result;
+    }
+    async audit(userId, route, params, meta) {
+        await this.auditSink.record({
+            actorUserId: userId,
+            action: exports.TELEMETRY_DASHBOARD_AUDIT_ACTION,
+            targetType: 'telemetry_store',
+            targetId: this.greptime.database,
+            meta: { route, params: auditParams(params), ...meta },
+        });
+    }
+    /** `service`/`instance`/`host` as SQL filters, or 400 when one was not seen in the range. */
+    async validateFilters(window, query, known, timeoutMs) {
+        const filters = {
+            tracesHaveInstance: known.catalog.tracesHaveInstance,
+            tracesHaveRouteMatched: known.catalog.tracesHaveRouteMatched,
+            tracesHaveBearer: known.catalog.tracesHaveBearer,
+        };
+        if (!query.service && !query.instance && !query.host)
+            return filters;
+        const values = await this.distinct.get(window.spanKey, () => this.loadDistinct(window, timeoutMs, known));
+        for (const field of ['service', 'instance', 'host']) {
+            const wanted = query[field];
+            if (wanted === undefined)
+                continue;
+            const known = field === 'service' ? values.services : field === 'instance' ? values.instances : values.hosts;
+            if (!known.includes(wanted)) {
+                throw new telemetry_query_errors_1.TelemetryHttpError(telemetry_query_errors_1.TELEMETRY_ERROR_REASONS.DASHBOARD_BAD_FILTER, `The ${field} is not among those seen in the selected range.`, { field });
+            }
+            filters[field] = wanted;
+        }
+        return filters;
+    }
+    async loadDistinct(window, timeoutMs, known) {
+        let catalog = known?.catalog;
+        let metricTables = known?.tables;
+        if (!catalog || !metricTables) {
+            const schema = await this.schema.getSchema();
+            catalog = catalogOf(schema);
+            metricTables = (0, metric_catalog_1.metricTablesOf)(schema);
+        }
+        const runner = new StatementRunner(this.greptime, timeoutMs);
+        const tables = { traces: catalog.traces, logs: catalog.logs };
+        const [services, instances, hosts] = await Promise.all([
+            runner.maybe((0, telemetry_dashboard_sql_1.distinctServicesSql)(window.from, window.to, tables)),
+            runner.maybe((0, telemetry_dashboard_sql_1.distinctInstancesSql)(window.from, window.to, { traces: catalog.tracesHaveInstance, logs: catalog.logs })),
+            runner.maybe((0, metric_sql_1.distinctHostsSql)(metricTables.get(metric_catalog_1.HOST_DISTINCT_TABLE) ?? null, metric_catalog_1.HOST_DISTINCT_TABLE, window.from, window.to, telemetry_dashboard_sql_1.DISTINCT_VALUES_MAX + 1)),
+        ]);
+        const list = (result) => (result?.rows ?? []).map((row) => str(row[0])).filter((v) => v !== null);
+        const s = list(services);
+        const i = list(instances);
+        const h = list(hosts);
+        return {
+            services: s.slice(0, telemetry_dashboard_sql_1.DISTINCT_VALUES_MAX),
+            instances: i.slice(0, telemetry_dashboard_sql_1.DISTINCT_VALUES_MAX),
+            hosts: h.slice(0, telemetry_dashboard_sql_1.DISTINCT_VALUES_MAX),
+            truncated: s.length > telemetry_dashboard_sql_1.DISTINCT_VALUES_MAX || i.length > telemetry_dashboard_sql_1.DISTINCT_VALUES_MAX || h.length > telemetry_dashboard_sql_1.DISTINCT_VALUES_MAX,
+            sql: runner.sql,
+            generatedAt: new Date(Date.now()).toISOString(),
+        };
+    }
+    // ---- summary ---------------------------------------------------------------
+    async computeSummary({ window, filters, catalog, tables, runner }) {
+        const now = new Date(Date.now());
+        const runtimeBucket = Math.max(window.bucketSeconds, exports.RUNTIME_MIN_BUCKET_SECONDS);
+        const runtimeService = filters.service ?? null;
+        const lastDataSince = new Date(now.getTime() - exports.LAST_DATA_LOOKBACK_MS);
+        // Infrastructure verdict inputs (#601): one small statement per rule
+        // family, null (not run) when its tables are absent.
+        const probeSql = (0, metric_verdict_1.verdictProbeSql)(tables, window);
+        // Unknown API routes (#650): only when the store has the matched column
+        // (see UNKNOWN_ROUTE_PREDICATE); the templates return null otherwise.
+        const unknownSql = catalog.traces
+            ? {
+                totals: (0, telemetry_dashboard_sql_1.unknownRoutesTotalsSql)(window.previousFrom, window, filters),
+                top: (0, telemetry_dashboard_sql_1.topUnknownRoutesSql)(window, filters, exports.UNKNOWN_ROUTES_TOP_N + 1),
+            }
+            : { totals: null, top: null };
+        const [apiTotals, apiSeries, logsTotals, logsSeries, last, routes, errors, heap, eventLoop, probeResults, unknownTotals, unknownTop] = await Promise.all([
+            runner.maybe(catalog.traces ? (0, telemetry_dashboard_sql_1.apiTotalsSql)(window.previousFrom, window, filters) : null),
+            runner.maybe(catalog.traces ? (0, telemetry_dashboard_sql_1.apiTimeseriesSql)(window, filters) : null),
+            runner.maybe(catalog.logs ? (0, telemetry_dashboard_sql_1.logsTotalsSql)(window.previousFrom, window, filters) : null),
+            runner.maybe(catalog.logs ? (0, telemetry_dashboard_sql_1.logsTimeseriesSql)(window, filters) : null),
+            runner.maybe(catalog.traces || catalog.logs
+                ? (0, telemetry_dashboard_sql_1.lastDataSql)(lastDataSince, new Date(now.getTime() + 60_000), filters, {
+                    traces: catalog.traces,
+                    logs: catalog.logs,
+                })
+                : null),
+            runner.maybe(catalog.traces ? (0, telemetry_dashboard_sql_1.topRoutesSql)(window, filters) : null),
+            runner.maybe(catalog.logs ? (0, telemetry_dashboard_sql_1.topErrorsSql)(window, filters, 1) : null),
+            runner.maybe(catalog.heap ? (0, telemetry_dashboard_sql_1.heapUsedSql)(window.previousFrom, window.to, runtimeBucket, runtimeService) : null),
+            runner.maybe(catalog.eventLoop ? (0, telemetry_dashboard_sql_1.eventLoopDelayP99Sql)(window.previousFrom, window.to, runtimeBucket, runtimeService) : null),
+            Promise.all(metric_verdict_1.VERDICT_PROBES.map((probe) => runner.maybe(probeSql[probe]))),
+            runner.maybe(unknownSql.totals),
+            runner.maybe(unknownSql.top),
+        ]);
+        const infrastructure = (0, metric_verdict_1.verdictInputsFrom)(Object.fromEntries(metric_verdict_1.VERDICT_PROBES.map((probe, i) => [probe, probeResults[i]])), new Date(Math.min(now.getTime(), window.to.getTime())));
+        const api = periods(apiTotals);
+        const logs = periods(logsTotals);
+        const requests = num(api.current.requests);
+        const previousRequests = num(api.previous.requests);
+        const errors5xx = num(api.current.errors);
+        const previousErrors5xx = num(api.previous.errors);
+        const p95Ms = nsToMs(api.current.p95_ns);
+        const errorLogs = num(logs.current.error);
+        const previousErrorLogs = num(logs.previous.error);
+        const lastRow = objects(last)[0] ?? {};
+        const lastDates = [toDate(lastRow.traces_last), toDate(lastRow.logs_last)].filter((d) => d !== null);
+        const lastDataAt = lastDates.length ? new Date(Math.max(...lastDates.map((d) => d.getTime()))) : null;
+        const routeRows = objects(routes);
+        const topErrorRow = routeRows.find((r) => num(r.errors) > 0);
+        // Streaming (SSE) routes are never the latency offender: their span is the
+        // connection's lifetime (see STREAM_SPAN_PREDICATE).
+        const slowest = routeRows.filter((r) => !(0, telemetry_dashboard_sql_1.isStreamingRoute)(str(r.route))).reduce((worst, r) => ((nsToMs(r.p95_ns) ?? -1) > (worst ? nsToMs(worst.p95_ns) ?? -1 : -1) ? r : worst), null);
+        const routeLabel = (r) => r ? [str(r.method), str(r.route)].filter(Boolean).join(' ') || null : null;
+        // `sql`: the two statements exactly as run above (per-route list first),
+        // for the panel's "Open in Explorer" without parsing the summary's `sql`.
+        const unknownRoutes = unknownSql.totals
+            ? unknownRoutesOf(unknownTotals, unknownTop, [unknownSql.top, unknownSql.totals].filter((q) => !!q))
+            : null;
+        const verdict = this.verdictPolicy.compute({
+            now,
+            lastDataAt,
+            requests,
+            errors5xx,
+            p95Ms,
+            errorLogs,
+            previousErrorLogs,
+            topErrorRoute: routeLabel(topErrorRow),
+            slowestRoute: routeLabel(slowest),
+            topErrorMessage: str(objects(errors)[0]?.message),
+            unknownRoutes: unknownRoutes
+                ? {
+                    bearerRequests: unknownRoutes.bearer,
+                    bearerRoutes: unknownRoutes.topRoutes.filter((r) => r.bearer > 0).length,
+                    topRoute: routeLabel(unknownRoutes.topRoutes.find((r) => r.bearer > 0)),
+                }
+                : null,
+            ...infrastructure,
+        }, this.thresholds);
+        const starts = bucketStarts(window.from, window.to, window.bucketSeconds);
+        const apiBuckets = byBucket(apiSeries);
+        const logBuckets = byBucket(logsSeries);
+        const at = (result, name) => column(result, name);
+        const spanMin = window.spanMs / 60_000;
+        const bucketMin = window.bucketSeconds / 60;
+        const apiSpark = (pick) => starts.map((t) => {
+            const row = apiBuckets.get(t);
+            return row ? pick(row) : null;
+        });
+        const totalAt = at(apiSeries, 'total');
+        const s5xxAt = at(apiSeries, 's5xx');
+        const p95At = at(apiSeries, 'p95_ns');
+        const tiles = [
+            {
+                key: 'requestsPerMin',
+                label: 'Requests / min',
+                value: round2(requests / spanMin),
+                previous: round2(previousRequests / spanMin),
+                unit: 'req/min',
+                sparkline: starts.map((t) => round2(num(apiBuckets.get(t)?.[totalAt]) / bucketMin)),
+            },
+            {
+                key: 'errorRatePct',
+                label: '5xx rate',
+                value: requests ? round2((errors5xx / requests) * 100) : null,
+                previous: previousRequests ? round2((previousErrors5xx / previousRequests) * 100) : null,
+                unit: '%',
+                sparkline: apiSpark((row) => {
+                    const total = num(row[totalAt]);
+                    return total ? round2((num(row[s5xxAt]) / total) * 100) : null;
+                }),
+            },
+            {
+                key: 'p95Ms',
+                label: 'p95 latency',
+                value: p95Ms,
+                previous: nsToMs(api.previous.p95_ns),
+                unit: 'ms',
+                sparkline: apiSpark((row) => nsToMs(row[p95At])),
+            },
+            {
+                key: 'errorLogs',
+                label: 'Error logs',
+                value: errorLogs,
+                previous: previousErrorLogs,
+                unit: 'count',
+                sparkline: starts.map((t) => num(logBuckets.get(t)?.[at(logsSeries, 'error')])),
+            },
+            {
+                key: 'warnLogs',
+                label: 'Warning logs',
+                value: num(logs.current.warn),
+                previous: num(logs.previous.warn),
+                unit: 'count',
+                sparkline: starts.map((t) => num(logBuckets.get(t)?.[at(logsSeries, 'warn')])),
+            },
+            {
+                // #650: requests answered by the not-found handler. Null when the
+                // store has no `app.route.matched` column yet (old data): unknown,
+                // not zero. The bearer/anonymous split is `unknownRoutes` below.
+                key: 'unknownRoutes',
+                label: 'Unknown API routes',
+                value: unknownRoutes ? unknownRoutes.requests : null,
+                previous: unknownRoutes ? unknownRoutes.previousRequests : null,
+                unit: 'count',
+                sparkline: [],
+            },
+            {
+                key: 'lastDataAt',
+                label: 'Last data',
+                value: lastDataAt?.toISOString() ?? null,
+                previous: null,
+                unit: 'timestamp',
+                sparkline: [],
+            },
+        ];
+        const runtime = [];
+        if (catalog.heap)
+            runtime.push(runtimeTile('heapUsedBytes', 'Heap used', 'bytes', heap, window, runtimeBucket, (v) => Math.round(v)));
+        if (catalog.eventLoop) {
+            runtime.push(runtimeTile('eventLoopDelayP99Ms', 'Event-loop delay p99', 'ms', eventLoop, window, runtimeBucket, (v) => Math.round(v * 10) / 10));
+        }
+        return {
+            range: rangeOf(window),
+            generatedAt: now.toISOString(),
+            truncated: false,
+            sql: runner.sql,
+            verdict,
+            tiles,
+            ...(runtime.length ? { runtime } : {}),
+            ...(unknownRoutes ? { unknownRoutes } : {}),
+        };
+    }
+    // ---- metrics (#601) --------------------------------------------------------
+    async computeMetrics({ window, filters, tables, runner }, group) {
+        const now = new Date(Date.now());
+        const freshMs = this.metricFreshMs ?? metric_group_1.METRIC_FRESH_MS;
+        const result = await (0, metric_group_1.computeMetricGroup)({ group, window, filters, tables, runner, now, freshMs });
+        return {
+            range: { from: window.from.toISOString(), to: window.to.toISOString(), bucketSeconds: result.bucketSeconds },
+            generatedAt: now.toISOString(),
+            truncated: result.truncated,
+            sql: runner.sql,
+            group,
+            available: result.available,
+            tiles: result.tiles,
+            series: result.series,
+            tables: result.tables,
+            skipped: result.skipped,
+            freshMs,
+        };
+    }
+    // ---- timeseries --------------------------------------------------------------
+    async computeTimeseries({ window, filters, catalog, runner }, panel) {
+        const starts = bucketStarts(window.from, window.to, window.bucketSeconds);
+        const envelope = (sql) => ({
+            range: rangeOf(window),
+            generatedAt: new Date(Date.now()).toISOString(),
+            truncated: false,
+            sql: sql[0] ?? '',
+        });
+        if (panel === 'api') {
+            const result = await runner.maybe(catalog.traces ? (0, telemetry_dashboard_sql_1.apiTimeseriesSql)(window, filters) : null);
+            const rows = byBucket(result);
+            const i = (name) => column(result, name);
+            return {
+                ...envelope(runner.sql),
+                panel,
+                buckets: starts.map((t) => {
+                    const row = rows.get(t);
+                    return {
+                        t: new Date(t).toISOString(),
+                        s2xx: num(row?.[i('s2xx')]),
+                        s3xx: num(row?.[i('s3xx')]),
+                        s4xx: num(row?.[i('s4xx')]),
+                        s5xx: num(row?.[i('s5xx')]),
+                        p95Ms: row ? nsToMs(row[i('p95_ns')]) : null,
+                    };
+                }),
+            };
+        }
+        const result = await runner.maybe(catalog.logs ? (0, telemetry_dashboard_sql_1.logsTimeseriesSql)(window, filters) : null);
+        const rows = byBucket(result);
+        const i = (name) => column(result, name);
+        return {
+            ...envelope(runner.sql),
+            panel,
+            buckets: starts.map((t) => {
+                const row = rows.get(t);
+                return {
+                    t: new Date(t).toISOString(),
+                    error: num(row?.[i('error')]),
+                    warn: num(row?.[i('warn')]),
+                    info: num(row?.[i('info')]),
+                    other: num(row?.[i('other')]),
+                };
+            }),
+        };
+    }
+    // ---- top ---------------------------------------------------------------------
+    async computeTop({ window, filters, catalog, runner }, kind) {
+        const base = () => ({ range: rangeOf(window), generatedAt: new Date(Date.now()).toISOString(), sql: runner.sql[0] ?? '' });
+        if (kind === 'routes') {
+            const rows = objects(await runner.maybe(catalog.traces ? (0, telemetry_dashboard_sql_1.topRoutesSql)(window, filters) : null));
+            return {
+                ...base(),
+                truncated: rows.length > telemetry_dashboard_sql_1.TOP_N,
+                kind,
+                items: rows.slice(0, telemetry_dashboard_sql_1.TOP_N).map((r) => {
+                    const count = num(r.requests);
+                    const errors = num(r.errors);
+                    const unknownRequests = num(r.unknown_requests);
+                    return {
+                        method: str(r.method),
+                        route: str(r.route),
+                        count,
+                        errors,
+                        errorRatePct: count ? round2((errors / count) * 100) : 0,
+                        clientErrors: num(r.client_errors),
+                        unknownRequests,
+                        unknown: unknownRequests > 0,
+                        p95Ms: nsToMs(r.p95_ns),
+                    };
+                }),
+            };
+        }
+        const rows = objects(await runner.maybe(catalog.logs ? (0, telemetry_dashboard_sql_1.topErrorsSql)(window, filters) : null));
+        return {
+            ...base(),
+            truncated: rows.length > telemetry_dashboard_sql_1.TOP_N,
+            kind,
+            items: rows.slice(0, telemetry_dashboard_sql_1.TOP_N).map((r) => ({
+                message: str(r.message),
+                count: num(r.occurrences),
+                firstSeen: toIso(r.first_seen),
+                lastSeen: toIso(r.last_seen),
+                sampleTraceId: str(r.sample_trace_id),
+                service: str(r.service),
+            })),
+        };
+    }
+    // ---- events ------------------------------------------------------------------
+    async computeEvents({ window, filters, catalog, runner }, severities, q, cursor) {
+        const envelope = { range: rangeOf(window), generatedAt: new Date(Date.now()).toISOString(), truncated: false };
+        if (!catalog.logs) {
+            return { ...envelope, sql: '', items: [], nextCursor: null };
+        }
+        const sql = (0, telemetry_dashboard_sql_1.eventsSql)(window, filters, { severities, q, cursor, limit: telemetry_dashboard_sql_1.EVENTS_PAGE_SIZE + 1 });
+        // Defence in depth: the statement is server-authored, but it carries user
+        // text, so it must still be exactly one read-only statement.
+        try {
+            (0, sql_guard_1.analyzeStatement)(sql);
+        }
+        catch (error) {
+            throw (0, telemetry_availability_1.toTelemetryHttpError)(error);
+        }
+        const rows = objects(await runner.run(sql));
+        const keyOf = (r) => `${String(r.ts)}\u0000${String(r.span_id ?? '')}`;
+        let page = rows.slice(0, telemetry_dashboard_sql_1.EVENTS_PAGE_SIZE);
+        const more = rows.length > telemetry_dashboard_sql_1.EVENTS_PAGE_SIZE;
+        if (more) {
+            // Keyset pagination is strict on (timestamp, span_id): rows sharing the
+            // boundary key with the first row of the NEXT page would be skipped, so
+            // the page ends before them (unless the whole page shares one key).
+            const boundary = keyOf(rows[telemetry_dashboard_sql_1.EVENTS_PAGE_SIZE]);
+            let end = telemetry_dashboard_sql_1.EVENTS_PAGE_SIZE;
+            while (end > 0 && keyOf(rows[end - 1]) === boundary)
+                end--;
+            if (end > 0)
+                page = rows.slice(0, end);
+        }
+        const last = page[page.length - 1];
+        return {
+            ...envelope,
+            sql,
+            items: page.map((r) => ({
+                timestamp: toIsoText(String(r.ts)),
+                severity: severityLabel(r.severity_number, r.severity_text),
+                service: str(r.service),
+                body: r.body === null || r.body === undefined ? null : String(r.body),
+                traceId: str(r.trace_id),
+                spanId: str(r.span_id),
+            })),
+            nextCursor: more && last ? encodeCursor({ ts: String(last.ts), spanId: String(last.span_id ?? '') }) : null,
+        };
+    }
+};
+exports.TelemetryDashboardService = TelemetryDashboardService;
+exports.TelemetryDashboardService = TelemetryDashboardService = TelemetryDashboardService_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __param(3, (0, common_1.Inject)(ports_1.TELEMETRY_AUDIT_SINK)),
+    __param(4, (0, common_1.Inject)(verdict_policy_1.VERDICT_POLICY)),
+    __param(5, (0, common_1.Inject)(telemetry_options_1.TELEMETRY_VERDICT_THRESHOLDS)),
+    __param(6, (0, common_1.Optional)()),
+    __param(6, (0, common_1.Inject)(telemetry_options_1.TELEMETRY_METRIC_FRESH_MS)),
+    __metadata("design:paramtypes", [greptime_client_1.GreptimeClient,
+        telemetry_settings_service_1.TelemetrySettingsService,
+        telemetry_schema_service_1.TelemetrySchemaService, Object, Object, Object, Number])
+], TelemetryDashboardService);
+/** Unknown API routes the summary lists (#650); a short list, the verdict only needs 3 or more. */
+exports.UNKNOWN_ROUTES_TOP_N = 5;
+/** The summary's `unknownRoutes` block from its two statements (#650). */
+function unknownRoutesOf(totals, top, sql) {
+    const p = periods(totals);
+    const requests = num(p.current.requests);
+    const bearer = num(p.current.bearer);
+    const previousRequests = num(p.previous.requests);
+    const previousBearer = num(p.previous.bearer);
+    const rows = objects(top);
+    return {
+        requests,
+        bearer,
+        anonymous: Math.max(requests - bearer, 0),
+        previousRequests,
+        previousBearer,
+        topRoutes: rows.slice(0, exports.UNKNOWN_ROUTES_TOP_N).map((r) => {
+            const count = num(r.requests);
+            const withBearer = num(r.bearer);
+            return {
+                method: str(r.method),
+                route: str(r.route),
+                count,
+                bearer: withBearer,
+                anonymous: Math.max(count - withBearer, 0),
+            };
+        }),
+        truncated: rows.length > exports.UNKNOWN_ROUTES_TOP_N,
+        sql,
+    };
+}
+function rangeOf(window) {
+    return { from: window.from.toISOString(), to: window.to.toISOString(), bucketSeconds: window.bucketSeconds };
+}
+function parseSeverities(raw) {
+    if (!raw)
+        return ['error', 'warn'];
+    const wanted = new Set(raw.split(','));
+    return telemetry_dashboard_sql_1.EVENT_SEVERITIES.filter((s) => wanted.has(s));
+}
+/**
+ * Request parameters as an audit row keeps them: control characters removed
+ * (PostgreSQL's jsonb refuses `\u0000`), `q` cut to 64 characters, the cursor
+ * only as present.
+ */
+function auditParams(params) {
+    const out = {};
+    for (const [key, value] of Object.entries(params)) {
+        if (value === undefined || value === null || value === '')
+            continue;
+        const text = String(value).replace(/[\u0000-\u001f\u007f]/g, '');
+        if (key === 'q')
+            out.q = text.slice(0, exports.DASHBOARD_LOG_Q_MAX);
+        else if (key === 'cursor')
+            out.cursor = true;
+        else
+            out[key] = text;
+    }
+    return out;
+}
+function runtimeTile(key, label, unit, result, window, bucketSeconds, round) {
+    const rows = byBucket(result);
+    const vAt = column(result, 'v');
+    const value = (row) => {
+        if (!row)
+            return null;
+        const v = row[vAt];
+        if (v === null || v === undefined || v === '')
+            return null;
+        const n = Number(v);
+        return Number.isFinite(n) ? round(n) : null;
+    };
+    const sparkline = bucketStarts(window.from, window.to, bucketSeconds).map((t) => value(rows.get(t)));
+    const lastOf = (list) => [...list].reverse().find((v) => v !== null) ?? null;
+    const fromMs = window.from.getTime();
+    const previous = [...rows.entries()]
+        .filter(([t]) => t < fromMs)
+        .sort(([a], [b]) => a - b)
+        .map(([, row]) => value(row));
+    return { key, label, value: lastOf(sparkline), previous: lastOf(previous), unit, sparkline };
+}
+//# sourceMappingURL=telemetry-dashboard.service.js.map