@obsunified/collector 2.4.3 → 2.4.4

package/dist/index.js

@@ -9,7 +9,7 @@ import {
   randomHex,
   sha256Hex,
   sqlDbFor
-} from "./chunk-2FALTDCE.js";
+} from "./chunk-VSOZJO6Y.js";
 import {
   LlmCallError,
   aiEvaluationEvidenceReferences,
@@ -3575,22 +3575,66 @@ var isPrivateIpv4 = (o) => o[0] === 0 || // "this" network / unspecified
 o[0] === 10 || o[0] === 127 || o[0] === 100 && o[1] >= 64 && o[1] <= 127 || // CGNAT
 o[0] === 169 && o[1] === 254 || // link-local incl. cloud metadata
 o[0] === 172 && o[1] >= 16 && o[1] <= 31 || o[0] === 192 && o[1] === 168 || o[0] >= 224;
+var parseIpv6 = (literal) => {
+  let text = literal.replace(/%.*$/, "");
+  const tail = /:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(text);
+  let tailGroups = [];
+  if (tail) {
+    const v4 = parseIpv4(tail[1]);
+    if (!v4) return null;
+    tailGroups = [v4[0] << 8 | v4[1], v4[2] << 8 | v4[3]];
+    text = text.slice(0, -tail[1].length);
+    if (text.endsWith(":") && !text.endsWith("::")) text = text.slice(0, -1);
+  }
+  const halves = text.split("::");
+  if (halves.length > 2) return null;
+  const toGroups = (part) => {
+    if (part === "") return [];
+    const groups = [];
+    for (const g of part.split(":")) {
+      if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
+      groups.push(Number.parseInt(g, 16));
+    }
+    return groups;
+  };
+  const head = toGroups(halves[0]);
+  const rest = halves.length === 2 ? toGroups(halves[1]) : [];
+  if (!head || !rest) return null;
+  const explicit = head.length + rest.length + tailGroups.length;
+  if (halves.length === 1) {
+    return explicit === 8 ? [...head, ...tailGroups] : null;
+  }
+  if (explicit > 7) return null;
+  return [
+    ...head,
+    ...new Array(8 - explicit).fill(0),
+    ...rest,
+    ...tailGroups
+  ];
+};
+var embeddedIpv4 = (hi, lo) => [
+  hi >> 8,
+  hi & 255,
+  lo >> 8,
+  lo & 255
+];
 var isPrivateIpv6 = (host) => {
   const literal = host.replace(/^\[|\]$/g, "").toLowerCase();
-  if (literal === "::" || literal === "::1") return true;
-  const dotted = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(literal);
-  if (dotted) {
-    const v4 = parseIpv4(dotted[1]);
-    return v4 ? isPrivateIpv4(v4) : true;
-  }
-  const hex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(literal);
-  if (hex) {
-    const hi = Number.parseInt(hex[1], 16);
-    const lo = Number.parseInt(hex[2], 16);
-    return isPrivateIpv4([hi >> 8, hi & 255, lo >> 8, lo & 255]);
-  }
-  const first = Number.parseInt(literal.split(":")[0] || "0", 16);
-  if (Number.isNaN(first)) return true;
+  const g = parseIpv6(literal);
+  if (!g) return true;
+  const zeroPrefix = (n) => g.slice(0, n).every((x) => x === 0);
+  if (zeroPrefix(6)) {
+    if (g[6] === 0 && (g[7] === 0 || g[7] === 1)) return true;
+    return isPrivateIpv4(embeddedIpv4(g[6], g[7]));
+  }
+  if (zeroPrefix(5) && g[5] === 65535) {
+    return isPrivateIpv4(embeddedIpv4(g[6], g[7]));
+  }
+  if (g[0] === 100 && g[1] === 65435 && g.slice(2, 6).every((x) => x === 0)) {
+    return isPrivateIpv4(embeddedIpv4(g[6], g[7]));
+  }
+  if (g[0] === 8194) return isPrivateIpv4(embeddedIpv4(g[1], g[2]));
+  const first = g[0];
   if ((first & 65024) === 64512) return true;
   if ((first & 65472) === 65152) return true;
   if ((first & 65280) === 65280) return true;
@@ -8502,6 +8546,17 @@ var createTelemetryCollectorApp = (pluginsOrConfig) => {
     app.use("/v1/*", config.auth.middleware);
   } else if (config.auth?.ingest) {
     app.use("/v1/*", config.auth.ingest);
+  } else if (!config.allowUnauthenticatedIngest) {
+    let warned = false;
+    app.use("/v1/*", async (_c, next) => {
+      if (!warned) {
+        warned = true;
+        runtime.logger.warn(
+          "[collector] WARNING: /v1/* ingest is UNAUTHENTICATED \u2014 this app was built without `auth`, so anyone who can reach it can write telemetry. Pass `auth: { middleware: createIngestAuth() }` (and set INGEST_KEY or create a key in the dashboard), or set `allowUnauthenticatedIngest: true` to acknowledge and silence this warning."
+        );
+      }
+      await next();
+    });
   }
   if (config.dashboardAuth) {
     const { middleware } = config.dashboardAuth;
@@ -13750,9 +13805,12 @@ var AlertsStore = class {
     const cutoff = new Date(
       Date.now() - params.hours * 60 * 60 * 1e3
     ).toISOString();
-    const rs = await this.db.prepare(
+    const limit = Math.min(params.limit ?? 500, 1e3);
+    const rs = params.projectId ? await this.db.prepare(
+      `SELECT * FROM alert_evaluations WHERE rule_id = ? AND project_id = ? AND evaluated_at >= ? ORDER BY evaluated_at DESC LIMIT ?`
+    ).bind(params.ruleId, params.projectId, cutoff, limit).all() : await this.db.prepare(
       `SELECT * FROM alert_evaluations WHERE rule_id = ? AND evaluated_at >= ? ORDER BY evaluated_at DESC LIMIT ?`
-    ).bind(params.ruleId, cutoff, Math.min(params.limit ?? 500, 1e3)).all();
+    ).bind(params.ruleId, cutoff, limit).all();
     const rows = rs.results ?? [];
     const projectId = params.projectId ?? rows[0]?.project_id;
     const rule = projectId ? await this.getRule(params.ruleId, projectId) : null;
@@ -17706,6 +17764,7 @@ var filterPprofByTraceId = async (profile, traceIdFilter) => {
 var DEFAULT_CHUNK_LIMIT = 100;
 var MAX_CHUNK_LIMIT = 500;
 var REPLAY_CHUNK_FETCH_CONCURRENCY = 8;
+var REPLAY_RESPONSE_BYTE_BUDGET = 64 * 1024 * 1024;
 async function mapWithConcurrency2(items, concurrency, mapper) {
   const results = new Array(items.length);
   let nextIndex = 0;
@@ -17720,6 +17779,23 @@ async function mapWithConcurrency2(items, concurrency, mapper) {
   );
   return results;
 }
+function selectReplayChunkPage(objects, offset, limit, byteBudget = REPLAY_RESPONSE_BYTE_BUDGET) {
+  const window = objects.slice(offset, offset + limit);
+  let bytes = 0;
+  let count = 0;
+  for (const obj of window) {
+    const size = typeof obj.size === "number" && obj.size > 0 ? obj.size : 0;
+    if (count > 0 && bytes + size > byteBudget) break;
+    bytes += size;
+    count++;
+  }
+  const selected = window.slice(0, count);
+  const end = offset + count;
+  return {
+    selected,
+    nextChunkOffset: end < objects.length ? end : null
+  };
+}
 async function fetchReplayChunks(bucket, objects, concurrency = REPLAY_CHUNK_FETCH_CONCURRENCY) {
   const chunks2 = await mapWithConcurrency2(objects, concurrency, async (obj) => {
     const objectData = await bucket.get(obj.key);
@@ -17786,15 +17862,11 @@ var replayQueryRoutesPlugin = {
           ) || DEFAULT_CHUNK_LIMIT
         )
       );
-      const selectedObjects = objects.slice(
-        chunkOffset,
-        chunkOffset + chunkLimit
-      );
+      const { selected: selectedObjects, nextChunkOffset } = selectReplayChunkPage(objects, chunkOffset, chunkLimit);
       const events = await fetchReplayChunks(
         c.env.REPLAYS_BUCKET,
         selectedObjects
       );
-      const nextChunkOffset = chunkOffset + chunkLimit < objects.length ? chunkOffset + chunkLimit : null;
       return c.json({
         metadata,
         events,
@@ -20805,19 +20877,34 @@ var anyValueToString = (v) => {
       return bytesToBase64(v.value.value);
     case "arrayValue":
     case "kvlistValue":
-      return JSON.stringify(adaptAnyValue(v));
+      return JSON.stringify(adaptAnyValueAt(v, 1));
     default:
       return "";
   }
 };
-var keyValuesToRecord = (kvs) => {
+var MAX_ANY_VALUE_DEPTH = 64;
+var TRUNCATED_DEPTH_MARKER = `[truncated: nested deeper than ${MAX_ANY_VALUE_DEPTH} levels]`;
+var setOwn = (out, key, value) => {
+  if (key === "__proto__") {
+    Object.defineProperty(out, key, {
+      value,
+      enumerable: true,
+      writable: true,
+      configurable: true
+    });
+  } else {
+    out[key] = value;
+  }
+};
+var keyValuesToRecord = (kvs) => keyValuesToRecordAt(kvs, 0);
+var keyValuesToRecordAt = (kvs, depth) => {
   const out = {};
   for (const kv of kvs) {
-    out[kv.key] = anyValueToJson(kv.value);
+    setOwn(out, kv.key, anyValueToJson(kv.value, depth + 1));
   }
   return out;
 };
-var anyValueToJson = (v) => {
+var anyValueToJson = (v, depth) => {
   if (!v) return null;
   switch (v.value.case) {
     case "stringValue":
@@ -20831,18 +20918,21 @@ var anyValueToJson = (v) => {
     case "bytesValue":
       return bytesToBase64(v.value.value);
     case "arrayValue":
-      return v.value.value.values.map((x) => anyValueToJson(x));
+      if (depth > MAX_ANY_VALUE_DEPTH) return TRUNCATED_DEPTH_MARKER;
+      return v.value.value.values.map((x) => anyValueToJson(x, depth + 1));
     case "kvlistValue":
-      return keyValuesToRecord(v.value.value.values);
+      if (depth > MAX_ANY_VALUE_DEPTH) return TRUNCATED_DEPTH_MARKER;
+      return keyValuesToRecordAt(v.value.value.values, depth);
     default:
       return null;
   }
 };
-var adaptKeyValue = (kv) => ({
+var adaptKeyValue = (kv) => adaptKeyValueAt(kv, 0);
+var adaptKeyValueAt = (kv, depth) => ({
   key: kv.key,
-  value: kv.value ? adaptAnyValue(kv.value) : void 0
+  value: kv.value ? adaptAnyValueAt(kv.value, depth + 1) : void 0
 });
-var adaptAnyValue = (v) => {
+var adaptAnyValueAt = (v, depth) => {
   switch (v.value.case) {
     case "stringValue":
       return { stringValue: v.value.value };
@@ -20853,15 +20943,21 @@ var adaptAnyValue = (v) => {
     case "doubleValue":
       return { doubleValue: v.value.value };
     case "arrayValue":
+      if (depth > MAX_ANY_VALUE_DEPTH)
+        return { stringValue: TRUNCATED_DEPTH_MARKER };
       return {
         arrayValue: {
-          values: v.value.value.values.map((x) => adaptAnyValue(x))
+          values: v.value.value.values.map(
+            (x) => adaptAnyValueAt(x, depth + 1)
+          )
         }
       };
     case "kvlistValue":
+      if (depth > MAX_ANY_VALUE_DEPTH)
+        return { stringValue: TRUNCATED_DEPTH_MARKER };
       return {
         kvlistValue: {
-          values: v.value.value.values.map(adaptKeyValue)
+          values: v.value.value.values.map((kv) => adaptKeyValueAt(kv, depth))
         }
       };
     case "bytesValue":
@@ -20889,7 +20985,7 @@ var bytesToBase64 = (bytes) => {
 };
 
 // src/otlp/decode/logs.ts
-var decodeLogsRequest = (body) => {
+var decodeLogsRequestCapped = (body, maxRecords) => {
   let msg;
   try {
     msg = body.wireFormat === "protobuf" ? fromBinary(ExportLogsServiceRequestSchema, body.bytes) : fromJson(ExportLogsServiceRequestSchema, decodeJsonBody(body.bytes));
@@ -20900,16 +20996,25 @@ var decodeLogsRequest = (body) => {
     );
   }
   const out = [];
+  let rejected = 0;
   for (const rl of msg.resourceLogs) {
+    if (out.length >= maxRecords) {
+      for (const sl of rl.scopeLogs) rejected += sl.logRecords.length;
+      continue;
+    }
     const serviceName = extractServiceName(rl.resource?.attributes);
     for (const sl of rl.scopeLogs) {
       const loggerName = sl.scope?.name || null;
       for (const log of sl.logRecords) {
+        if (out.length >= maxRecords) {
+          rejected++;
+          continue;
+        }
         out.push(adaptLogRecord(log, serviceName, loggerName));
       }
     }
   }
-  return out;
+  return { records: out, rejected };
 };
 var adaptLogRecord = (log, serviceName, loggerName) => {
   const ts = log.timeUnixNano || log.observedTimeUnixNano;
@@ -20959,7 +21064,7 @@ var ExportMetricsServiceResponseSchema = /* @__PURE__ */ messageDesc6(file_opent
 var ExportMetricsPartialSuccessSchema = /* @__PURE__ */ messageDesc6(file_opentelemetry_proto_collector_metrics_v1_metrics_service, 2);
 
 // src/otlp/decode/metrics.ts
-var decodeMetricsRequest = (body) => {
+var decodeMetricsRequestCapped = (body, maxPoints) => {
   let msg;
   try {
     msg = body.wireFormat === "protobuf" ? fromBinary2(ExportMetricsServiceRequestSchema, body.bytes) : fromJson2(
@@ -20973,7 +21078,18 @@ var decodeMetricsRequest = (body) => {
     );
   }
   const out = [];
+  let rejected = 0;
   for (const rm of msg.resourceMetrics) {
+    if (out.length >= maxPoints) {
+      for (const sm of rm.scopeMetrics) rejected += countPoints(sm);
+      continue;
+    }
+    const remaining = maxPoints - out.length;
+    const total = rm.scopeMetrics.reduce((n, sm) => n + countPoints(sm), 0);
+    if (total > remaining) {
+      rejected += total - remaining;
+      trimScopeMetrics(rm.scopeMetrics, remaining);
+    }
     const resourceAttrs = rm.resource?.attributes ?? [];
     const resourceAttrsJson = resourceAttrs.length ? JSON.stringify(keyValuesToRecord(resourceAttrs)) : null;
     const serviceName = extractServiceName(resourceAttrs);
@@ -20981,7 +21097,34 @@ var decodeMetricsRequest = (body) => {
       addMetrics(out, rm, sm, serviceName, resourceAttrsJson);
     }
   }
-  return out;
+  return { points: out, rejected };
+};
+var metricPointCount = (metric) => {
+  switch (metric.data.case) {
+    case "gauge":
+    case "sum":
+    case "histogram":
+    case "exponentialHistogram":
+    case "summary":
+      return metric.data.value.dataPoints.length;
+    default:
+      return 0;
+  }
+};
+var countPoints = (sm) => sm.metrics.reduce((n, m) => n + metricPointCount(m), 0);
+var trimScopeMetrics = (scopeMetrics, budget) => {
+  let left = budget;
+  for (const sm of scopeMetrics) {
+    for (const metric of sm.metrics) {
+      const n = metricPointCount(metric);
+      if (n === 0) continue;
+      if (n > left) {
+        const data = metric.data.value;
+        data.dataPoints = data.dataPoints.slice(0, left);
+      }
+      left -= Math.min(n, left);
+    }
+  }
 };
 var addMetrics = (out, rm, sm, serviceName, resourceAttrsJson) => {
   const scopeName = sm.scope?.name || null;
@@ -21225,7 +21368,31 @@ var ExportTraceServiceResponseSchema = /* @__PURE__ */ messageDesc8(file_opentel
 var ExportTracePartialSuccessSchema = /* @__PURE__ */ messageDesc8(file_opentelemetry_proto_collector_trace_v1_trace_service, 2);
 
 // src/otlp/decode/traces.ts
-var decodeTraceRequest = (body) => {
+var decodeTraceRequestCapped = (body, maxSpans) => {
+  const msg = parseTraceMessage(body);
+  let accepted = 0;
+  let rejected = 0;
+  const resourceSpans = [];
+  for (const rs of msg.resourceSpans) {
+    for (const ss of rs.scopeSpans) {
+      const kept = [];
+      for (const s of ss.spans) {
+        if (!hasValidIds(s)) continue;
+        if (accepted >= maxSpans) {
+          rejected++;
+        } else {
+          kept.push(s);
+          accepted++;
+        }
+      }
+      ss.spans = kept;
+    }
+    resourceSpans.push(adaptResourceSpans(rs));
+  }
+  return { request: { resourceSpans }, accepted, rejected };
+};
+var hasValidIds = (s) => s.traceId.length === 16 && s.spanId.length === 8;
+var parseTraceMessage = (body) => {
   let msg;
   try {
     msg = body.wireFormat === "protobuf" ? fromBinary3(ExportTraceServiceRequestSchema, body.bytes) : fromJson3(ExportTraceServiceRequestSchema, decodeJsonBody(body.bytes));
@@ -21235,14 +21402,14 @@ var decodeTraceRequest = (body) => {
       400
     );
   }
-  return { resourceSpans: msg.resourceSpans.map(adaptResourceSpans) };
+  return msg;
 };
 var adaptResourceSpans = (rs) => ({
   resource: rs.resource ? { attributes: rs.resource.attributes.map(adaptKeyValue) } : void 0,
   scopeSpans: rs.scopeSpans.map((ss) => ({
     scope: ss.scope ? { name: ss.scope.name, version: ss.scope.version } : void 0,
     spans: ss.spans.flatMap((s) => {
-      if (s.traceId.length !== 16 || s.spanId.length !== 8) return [];
+      if (!hasValidIds(s)) return [];
       return [
         {
           traceId: bytesToHex(s.traceId),
@@ -21353,19 +21520,18 @@ var logsReceiverPlugin = {
         throw err;
       }
       let decoded;
+      let rejected = 0;
       try {
-        decoded = decodeLogsRequest(body);
+        ({ records: decoded, rejected } = decodeLogsRequestCapped(
+          body,
+          MAX_LOGS_PER_REQUEST
+        ));
       } catch (err) {
         if (err instanceof OtlpDecodeError) {
           return c.json({ error: err.message }, err.status);
         }
         throw err;
       }
-      let rejected = 0;
-      if (decoded.length > MAX_LOGS_PER_REQUEST) {
-        rejected = decoded.length - MAX_LOGS_PER_REQUEST;
-        decoded = decoded.slice(0, MAX_LOGS_PER_REQUEST);
-      }
       const store = new LogsStore(sqlDbFor(c.env));
       const retentionHours = getConfiguredRetentionHours5(c.env.RETENTION_HOURS);
       const now = /* @__PURE__ */ new Date();
@@ -21474,19 +21640,18 @@ var metricsReceiverPlugin = {
         throw err;
       }
       let points;
+      let rejected = 0;
       try {
-        points = decodeMetricsRequest(body);
+        ({ points, rejected } = decodeMetricsRequestCapped(
+          body,
+          MAX_POINTS_PER_REQUEST
+        ));
       } catch (err) {
         if (err instanceof OtlpDecodeError) {
           return c.json({ error: err.message }, err.status);
         }
         throw err;
       }
-      let rejected = 0;
-      if (points.length > MAX_POINTS_PER_REQUEST) {
-        rejected = points.length - MAX_POINTS_PER_REQUEST;
-        points = points.slice(0, MAX_POINTS_PER_REQUEST);
-      }
       const retentionHours = getConfiguredRetentionHours6(c.env.RETENTION_HOURS);
       const now = /* @__PURE__ */ new Date();
       const receivedAt = now.toISOString();
@@ -21743,34 +21908,18 @@ var otlpReceiverPlugin = {
         }
         throw err;
       }
-      let payload;
+      let capped;
       try {
-        payload = decodeTraceRequest(body);
+        capped = decodeTraceRequestCapped(body, MAX_SPANS_PER_REQUEST);
       } catch (err) {
         if (err instanceof OtlpDecodeError) {
           return c.json({ error: err.message }, err.status);
         }
         throw err;
       }
-      let total = 0;
-      let rejected = 0;
-      const trimmedResourceSpans = [];
-      for (const rs of payload.resourceSpans ?? []) {
-        const scopeSpans = [];
-        for (const ss of rs.scopeSpans ?? []) {
-          const spans2 = [];
-          for (const s of ss.spans ?? []) {
-            if (total >= MAX_SPANS_PER_REQUEST) {
-              rejected++;
-            } else {
-              spans2.push(s);
-              total++;
-            }
-          }
-          scopeSpans.push({ ...ss, spans: spans2 });
-        }
-        trimmedResourceSpans.push({ ...rs, scopeSpans });
-      }
+      const total = capped.accepted;
+      const rejected = capped.rejected;
+      const trimmedResourceSpans = capped.request.resourceSpans;
       const parsedSpans = toStoredSpans(
         { resourceSpans: trimmedResourceSpans },
         projectId,
@@ -21973,6 +22122,7 @@ var profileId = () => {
   for (let i = 0; i < 16; i++) randStr += ENCODING[bytes[i] % 32];
   return timeStr + randStr;
 };
+var safeFilenamePart = (value) => value.replace(/[^A-Za-z0-9_.-]/g, "_");
 var parseNonNegInt = (value, fallback) => {
   if (value == null) return fallback;
   const parsed = Number.parseInt(value, 10);
@@ -22128,7 +22278,7 @@ var profileRoutesPlugin = {
               headers: {
                 "Content-Type": "application/octet-stream",
                 "Content-Encoding": "gzip",
-                "Content-Disposition": `attachment; filename="${id}-trace-${filterTraceId.slice(0, 8)}.pprof.gz"`,
+                "Content-Disposition": `attachment; filename="${safeFilenamePart(id)}-trace-${safeFilenamePart(filterTraceId.slice(0, 8))}.pprof.gz"`,
                 // Surface the size shrink so the UI can show savings.
                 "X-Obs-Filter-Original-Bytes": String(raw.byteLength),
                 "X-Obs-Filter-Filtered-Bytes": String(filtered.byteLength)
@@ -22148,7 +22298,7 @@ var profileRoutesPlugin = {
         return new Response(obj.body, {
           headers: {
             "Content-Type": "application/octet-stream",
-            "Content-Disposition": `attachment; filename="${id}.pprof.gz"`
+            "Content-Disposition": `attachment; filename="${safeFilenamePart(id)}.pprof.gz"`
           }
         });
       }
@@ -24762,7 +24912,8 @@ var createDefaultCollectorApp = (config) => createTelemetryCollectorApp({
   dashboardAuth: config?.dashboardAuth,
   logger: config?.logger,
   withChildSpan: config?.withChildSpan,
-  sqlDb: config?.sqlDb
+  sqlDb: config?.sqlDb,
+  allowUnauthenticatedIngest: config?.allowUnauthenticatedIngest
 });
 var src_default = createTelemetryCollectorApp(allPlugins);
 export {