@obsunified/collector 2.0.1 → 2.1.1

package/dist/{ingest-auth-HFVO1zIp.d.ts → ingest-auth-C5-8Mly5.d.ts}

@@ -73,10 +73,19 @@ interface CollectorEnv {
     INGEST_KEY?: string;
     /** Password for dashboard login */
     DASHBOARD_PASSWORD?: string;
+    /** Programmatic read/admin bearer token for /internal/* endpoints (e.g. MCP server) */
+    DASHBOARD_TOKEN?: string;
     /** Comma-separated allowed origins for CORS (e.g. "https://my-app.com,https://staging.my-app.com") */
     ALLOWED_ORIGINS?: string;
     /** Set to "true" to allow unauthenticated ingest (local dev only) */
     ALLOW_UNAUTHENTICATED?: string;
+    /** Raw request body cap in bytes for /v1/* and /internal/* (default 10 MiB). */
+    MAX_BODY_BYTES?: string;
+    /**
+     * Set to "true" to let alert webhooks target loopback / private / link-local
+     * hosts (self-hosted receivers). Off by default to block SSRF.
+     */
+    ALERT_WEBHOOK_ALLOW_PRIVATE?: string;
     TELEMETRY_REDACT_FIELDS?: string;
     /**
      * Local/test escape hatch for payload capture. Production should prefer the

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@obsunified/collector",
-  "version": "2.0.1",
+  "version": "2.1.1",
   "description": "Plugin-based observability collector runtime with pluggable SQL/blob storage.",
   "license": "MIT",
   "repository": {
     "type": "git",
-    "url": "https://github.com/obs-unified/obs-unified.git",
+    "url": "https://github.com/dev-sawan-ruparel/obs-unified.git",
     "directory": "packages/obs-collector"
   },
   "keywords": [
@@ -38,8 +38,8 @@
   "sideEffects": false,
   "dependencies": {
     "@bufbuild/protobuf": "^2.11.0",
-    "@obsunified/pprof-decoder": "2.0.1",
-    "@obsunified/types": "2.0.1"
+    "@obsunified/pprof-decoder": "2.0.2",
+    "@obsunified/types": "2.0.2"
   },
   "peerDependencies": {
     "hono": "^4.7.0",
@@ -54,7 +54,7 @@
     "@bufbuild/buf": "^1.68.1",
     "@bufbuild/protoc-gen-es": "^2.11.0",
     "@types/pg": "^8.11.10",
-    "hono": "^4.12.11",
+    "hono": "^4.13.13",
     "pg": "^8.13.1",
     "tsup": "^8.3.5",
     "typescript": "^6.0.2"

package/src/analyses/derive.ts

@@ -59,7 +59,7 @@ const fetchShape = async (
 			 FROM telemetry_spans
 			 WHERE project_id = ?
 			   AND service_name IS NOT NULL
-			   AND received_at >= datetime('now', '-1 hour')`,
+			   AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')`,
 		)
 		.bind(projectId)
 		.all<{ service_name: string }>();
@@ -83,7 +83,7 @@ const fetchShape = async (
 			  AND parent.trace_id   = child.trace_id
 			  AND parent.span_id    = child.parent_span_id
 			 WHERE child.project_id = ?
-			   AND child.received_at >= datetime('now', '-1 hour')
+			   AND child.received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
 			   AND parent.service_name IS NOT NULL
 			   AND child.service_name  IS NOT NULL
 			   AND parent.service_name <> child.service_name`,
@@ -101,7 +101,7 @@ const fetchShape = async (
 			`SELECT DISTINCT json_extract(attributes_json, '$."messaging.destination"') AS topic
 			 FROM telemetry_spans
 			 WHERE project_id = ?
-			   AND received_at >= datetime('now', '-1 hour')
+			   AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
 			   AND json_extract(attributes_json, '$."messaging.destination"') IS NOT NULL`,
 		)
 		.bind(projectId)
@@ -121,7 +121,7 @@ const fetchShape = async (
 			`SELECT 1
 			 FROM telemetry_spans
 			 WHERE project_id = ?
-			   AND received_at >= datetime('now', '-1 hour')
+			   AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
 			   AND (
 			     json_extract(attributes_json, '$."openinference.span.kind"') = 'LLM'
 			     OR json_extract(attributes_json, '$."gen_ai.system"') IS NOT NULL
@@ -194,7 +194,7 @@ const makeServiceErrorRate = (
 			FROM telemetry_spans
 			WHERE project_id   = '${sqlEscape(projectId)}'
 				AND service_name = '${sqlEscape(service)}'
-				AND received_at >= datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 		),
 		base_window AS (
 			SELECT
@@ -203,8 +203,8 @@ const makeServiceErrorRate = (
 			FROM telemetry_spans
 			WHERE project_id   = '${sqlEscape(projectId)}'
 				AND service_name = '${sqlEscape(service)}'
-				AND received_at >= datetime('now', '-1 hour')
-				AND received_at <  datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
+				AND received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 		),
 		spark AS (
 			SELECT
@@ -214,7 +214,7 @@ const makeServiceErrorRate = (
 			FROM telemetry_spans
 			WHERE project_id   = '${sqlEscape(projectId)}'
 				AND service_name = '${sqlEscape(service)}'
-				AND received_at >= datetime('now', '-30 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-30 minutes')
 			GROUP BY minute
 			ORDER BY minute ASC
 		)
@@ -280,7 +280,7 @@ const makeServiceLatencyP95 = (
 			FROM telemetry_spans
 			WHERE project_id   = '${sqlEscape(projectId)}'
 				AND service_name = '${sqlEscape(service)}'
-				AND received_at >= datetime('now', '-1 hour')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
 		),
 		base AS (
 			SELECT duration_ms,
@@ -289,8 +289,8 @@ const makeServiceLatencyP95 = (
 			FROM telemetry_spans
 			WHERE project_id   = '${sqlEscape(projectId)}'
 				AND service_name = '${sqlEscape(service)}'
-				AND received_at >= datetime('now', '-25 hours')
-				AND received_at <  datetime('now', '-24 hours')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-25 hours')
+				AND received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-24 hours')
 		),
 		cur_p95 AS (
 			SELECT duration_ms FROM cur
@@ -360,7 +360,7 @@ const makeDependencyHealth = (
 			WHERE child.project_id   = '${sqlEscape(projectId)}'
 				AND parent.service_name = '${sqlEscape(source)}'
 				AND child.service_name  = '${sqlEscape(target)}'
-				AND child.received_at >= datetime('now', '-5 minutes')
+				AND child.received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 		),
 		edge_base AS (
 			SELECT child.status_code AS sc
@@ -372,8 +372,8 @@ const makeDependencyHealth = (
 			WHERE child.project_id   = '${sqlEscape(projectId)}'
 				AND parent.service_name = '${sqlEscape(source)}'
 				AND child.service_name  = '${sqlEscape(target)}'
-				AND child.received_at >= datetime('now', '-1 hour')
-				AND child.received_at <  datetime('now', '-5 minutes')
+				AND child.received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
+				AND child.received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 		),
 		now_agg AS (
 			SELECT COUNT(*) AS total,
@@ -438,7 +438,7 @@ const makeMessagingLag = (
 			WHERE project_id = '${sqlEscape(projectId)}'
 				AND span_kind = 4
 				AND json_extract(attributes_json, '$."messaging.destination"') = '${sqlEscape(topic)}'
-				AND received_at >= datetime('now', '-15 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-15 minutes')
 		),
 		consumers AS (
 			SELECT trace_id,
@@ -448,7 +448,7 @@ const makeMessagingLag = (
 			WHERE project_id = '${sqlEscape(projectId)}'
 				AND span_kind = 5
 				AND json_extract(attributes_json, '$."messaging.destination"') = '${sqlEscape(topic)}'
-				AND received_at >= datetime('now', '-15 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-15 minutes')
 		),
 		gaps AS (
 			SELECT
@@ -514,15 +514,15 @@ const makeAiCostBurn = (projectId: string): AnalysisDefinition => ({
 			       COUNT(*) AS n
 			FROM ai_calls
 			WHERE project_id = '${sqlEscape(projectId)}'
-				AND received_at >= datetime('now', '-1 hour')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
 		),
 		prev AS (
 			SELECT COALESCE(SUM(total_cost_usd), 0) AS cost,
 			       COUNT(*) AS n
 			FROM ai_calls
 			WHERE project_id = '${sqlEscape(projectId)}'
-				AND received_at >= datetime('now', '-2 hours')
-				AND received_at <  datetime('now', '-1 hour')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-2 hours')
+				AND received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
 		),
 		delta AS (
 			SELECT CASE
@@ -560,25 +560,26 @@ const makeAiErrorRate = (projectId: string): AnalysisDefinition => ({
 	// AI error rate is per-call; 5 min cadence balances signal vs cost on
 	// installs with hundreds of LLM spans.
 	refreshSeconds: 300,
-	// is_error = 1 fraction in the last 5 minutes vs trailing 1h baseline.
+	// is_error fraction in the last 5 minutes vs trailing 1h baseline. Tested
+	// as a bare boolean so it works for INTEGER 0/1 (D1) and BOOLEAN (Postgres).
 	// Same thresholds as overall_error_rate.
 	sql: `
 		WITH now_window AS (
 			SELECT
 				COUNT(*) AS total,
-				SUM(CASE WHEN is_error = 1 THEN 1 ELSE 0 END) AS errors
+				SUM(CASE WHEN is_error THEN 1 ELSE 0 END) AS errors
 			FROM ai_calls
 			WHERE project_id = '${sqlEscape(projectId)}'
-				AND received_at >= datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 		),
 		base_window AS (
 			SELECT
 				COUNT(*) AS total,
-				SUM(CASE WHEN is_error = 1 THEN 1 ELSE 0 END) AS errors
+				SUM(CASE WHEN is_error THEN 1 ELSE 0 END) AS errors
 			FROM ai_calls
 			WHERE project_id = '${sqlEscape(projectId)}'
-				AND received_at >= datetime('now', '-1 hour')
-				AND received_at <  datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
+				AND received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 		)
 		SELECT
 			CASE

package/src/analyses/investigations.ts

@@ -48,7 +48,7 @@ const errorTopOffenders: AnalysisDefinition = {
 				COUNT(*) AS errors
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 				AND status_code = 2
 			GROUP BY service_name
 			ORDER BY errors DESC
@@ -59,8 +59,8 @@ const errorTopOffenders: AnalysisDefinition = {
 				COUNT(*) AS errors
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-1 hour')
-				AND received_at <  datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
+				AND received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 				AND status_code = 2
 			GROUP BY service_name
 			ORDER BY errors DESC
@@ -128,7 +128,7 @@ const latencyOutlierAttribution: AnalysisDefinition = {
 				COUNT(*)    OVER ()                            AS n
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-15 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-15 minutes')
 		),
 		p95_cut AS (
 			-- Conservatively call "tail" the slowest 5% of the window.
@@ -203,12 +203,12 @@ const logAnomalySummary: AnalysisDefinition = {
 				(SELECT l2.message FROM logs l2
 					WHERE l2.project_id = '{{PROJECT_ID}}'
 						AND COALESCE(l2.logger_name, '<unknown>') = COALESCE(l1.logger_name, '<unknown>')
-						AND l2.received_at >= datetime('now', '-5 minutes')
+						AND l2.received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 						AND l2.severity_number >= 17
 					ORDER BY l2.received_at DESC LIMIT 1) AS sample_message
 			FROM logs l1
 			WHERE l1.project_id = '{{PROJECT_ID}}'
-				AND l1.received_at >= datetime('now', '-5 minutes')
+				AND l1.received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 				AND l1.severity_number >= 17
 			GROUP BY l1.logger_name
 		),
@@ -216,8 +216,8 @@ const logAnomalySummary: AnalysisDefinition = {
 			SELECT DISTINCT COALESCE(logger_name, '<unknown>') AS logger
 			FROM logs
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-1 hour')
-				AND received_at <  datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
+				AND received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 				AND severity_number >= 17
 		),
 		newcomers AS (

package/src/analyses/tier0.ts

@@ -40,7 +40,7 @@ const overallErrorRate: AnalysisDefinition = {
 				SUM(CASE WHEN status_code = 2 THEN 1 ELSE 0 END) AS errors
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 		),
 		base_window AS (
 			SELECT
@@ -48,8 +48,8 @@ const overallErrorRate: AnalysisDefinition = {
 				SUM(CASE WHEN status_code = 2 THEN 1 ELSE 0 END) AS errors
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-1 hour')
-				AND received_at <  datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
+				AND received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 		),
 		spark AS (
 			-- per-minute error rate over the last 30 minutes for sparkline rendering
@@ -59,7 +59,7 @@ const overallErrorRate: AnalysisDefinition = {
 				SUM(CASE WHEN status_code = 2 THEN 1 ELSE 0 END) AS errors
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-30 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-30 minutes')
 			GROUP BY minute
 			ORDER BY minute ASC
 		)
@@ -123,7 +123,7 @@ const topErrorServices: AnalysisDefinition = {
 				SUM(CASE WHEN status_code = 2 THEN 1 ELSE 0 END) AS errors
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 			GROUP BY service
 		),
 		top5 AS (
@@ -183,7 +183,7 @@ const latencyP95Overall: AnalysisDefinition = {
 				COUNT(*)    OVER () AS n
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-1 hour')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
 		),
 		base AS (
 			SELECT duration_ms,
@@ -191,8 +191,8 @@ const latencyP95Overall: AnalysisDefinition = {
 				COUNT(*)    OVER () AS n
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-25 hours')
-				AND received_at <  datetime('now', '-24 hours')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-25 hours')
+				AND received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-24 hours')
 		),
 		cur_p95 AS (
 			SELECT duration_ms FROM cur
@@ -214,7 +214,7 @@ const latencyP95Overall: AnalysisDefinition = {
 				COUNT(*) AS n
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-1 hour')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
 			GROUP BY bucket
 			ORDER BY bucket ASC
 		),
@@ -271,7 +271,7 @@ const throughputSlope: AnalysisDefinition = {
 				COUNT(*)    OVER () AS n
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-30 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-30 minutes')
 		),
 		prev AS (
 			SELECT duration_ms,
@@ -279,8 +279,8 @@ const throughputSlope: AnalysisDefinition = {
 				COUNT(*)    OVER () AS n
 			FROM telemetry_spans
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-60 minutes')
-				AND received_at <  datetime('now', '-30 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-60 minutes')
+				AND received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-30 minutes')
 		),
 		cur_n   AS (SELECT COALESCE((SELECT n FROM cur LIMIT 1), 0) AS n),
 		prev_n  AS (SELECT COALESCE((SELECT n FROM prev LIMIT 1), 0) AS n),
@@ -347,7 +347,7 @@ const activeSessions: AnalysisDefinition = {
 			SELECT COUNT(DISTINCT session_id) AS n
 			FROM usage_events
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-15 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-15 minutes')
 		),
 		hourly AS (
 			SELECT
@@ -355,7 +355,7 @@ const activeSessions: AnalysisDefinition = {
 				COUNT(DISTINCT session_id) AS sessions
 			FROM usage_events
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-24 hours')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-24 hours')
 			GROUP BY hour
 			ORDER BY hour ASC
 		)
@@ -400,7 +400,7 @@ const logErrorRate: AnalysisDefinition = {
 				SUM(CASE WHEN severity_number >= 17 THEN 1 ELSE 0 END) AS errors
 			FROM logs
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 		),
 		base_window AS (
 			SELECT
@@ -408,8 +408,8 @@ const logErrorRate: AnalysisDefinition = {
 				SUM(CASE WHEN severity_number >= 17 THEN 1 ELSE 0 END) AS errors
 			FROM logs
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-1 hour')
-				AND received_at <  datetime('now', '-5 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-1 hour')
+				AND received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 		),
 		spark AS (
 			SELECT
@@ -418,7 +418,7 @@ const logErrorRate: AnalysisDefinition = {
 				SUM(CASE WHEN severity_number >= 17 THEN 1 ELSE 0 END) AS errors
 			FROM logs
 			WHERE project_id = '{{PROJECT_ID}}'
-				AND received_at >= datetime('now', '-30 minutes')
+				AND received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-30 minutes')
 			GROUP BY minute
 			ORDER BY minute ASC
 		)
@@ -490,19 +490,19 @@ const serviceCpuUtilization: AnalysisDefinition = {
 			WHERE s.project_id = '{{PROJECT_ID}}'
 				AND s.name = 'process.cpu.utilization'
 				AND s.service_name IS NOT NULL
-				AND p.received_at >= datetime('now', '-30 minutes')
+				AND p.received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-30 minutes')
 		),
 		now_window AS (
 			SELECT service_name, AVG(value) AS avg_util
 			FROM cpu_points
-			WHERE received_at >= datetime('now', '-5 minutes')
+			WHERE received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 			GROUP BY service_name
 		),
 		base_window AS (
 			SELECT service_name, AVG(value) AS avg_util
 			FROM cpu_points
-			WHERE received_at >= datetime('now', '-30 minutes')
-				AND received_at <  datetime('now', '-5 minutes')
+			WHERE received_at >= strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-30 minutes')
+				AND received_at <  strftime('%Y-%m-%dT%H:%M:%fZ', 'now', '-5 minutes')
 			GROUP BY service_name
 		),
 			top_now AS (