@obsunified/collector 2.4.3 → 2.4.4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@obsunified/collector",
-  "version": "2.4.3",
+  "version": "2.4.4",
   "description": "Plugin-based observability collector runtime with pluggable SQL/blob storage.",
   "license": "MIT",
   "repository": {
@@ -37,7 +37,7 @@
   "sideEffects": false,
   "dependencies": {
     "@bufbuild/protobuf": "^2.11.0",
-    "@obsunified/pprof-decoder": "2.0.2",
+    "@obsunified/pprof-decoder": "2.0.3",
     "@obsunified/types": "2.4.1"
   },
   "peerDependencies": {

package/src/framework/collector.ts

@@ -129,6 +129,13 @@ export interface CollectorConfig {
 	 * client can never make the host buffer an ingest-sized body.
 	 */
 	maxAuthBodyBytes?: number;
+	/**
+	 * Acknowledge that this app runs without `auth` on `/v1/*` (e.g. a local
+	 * sandbox behind a trusted proxy). It changes nothing about request
+	 * handling; it only silences the one-time warning logged when the first
+	 * ingest request reaches an app that has no ingest auth configured.
+	 */
+	allowUnauthenticatedIngest?: boolean;
 }
 
 export class CollectorRuntime implements CollectorPluginContext {
@@ -350,6 +357,21 @@ export const createTelemetryCollectorApp = (
 	} else if (config.auth?.ingest) {
 		// Legacy: explicit ingest-only middleware
 		app.use("/v1/*", config.auth.ingest);
+	} else if (!config.allowUnauthenticatedIngest) {
+		// No ingest auth: /v1/* accepts anonymous writes. Behaviour is kept
+		// for compatibility, but say so loudly — once, on the first ingest
+		// request, so merely importing the package (whose default export
+		// builds an auth-less app) never logs.
+		let warned = false;
+		app.use("/v1/*", async (_c, next) => {
+			if (!warned) {
+				warned = true;
+				runtime.logger.warn(
+					"[collector] WARNING: /v1/* ingest is UNAUTHENTICATED — this app was built without `auth`, so anyone who can reach it can write telemetry. Pass `auth: { middleware: createIngestAuth() }` (and set INGEST_KEY or create a key in the dashboard), or set `allowUnauthenticatedIngest: true` to acknowledge and silence this warning.",
+				);
+			}
+			await next();
+		});
 	}
 
 	// Dashboard auth (session cookie or programmatic bearer token) — owns /internal/* and /dashboard/* when configured.

package/src/framework/ingest-auth-warning.test.ts

@@ -0,0 +1,71 @@
+/**
+ * An app built without ingest auth keeps accepting anonymous `/v1/*` writes
+ * (back-compat), but logs one loud warning on the first ingest request.
+ */
+
+import { describe, expect, it, vi } from "vitest";
+import type { CollectorPlugin } from "./collector";
+import { createTelemetryCollectorApp } from "./collector";
+import type { CollectorEnv } from "./env";
+import type { Logger } from "./logger";
+
+const okPlugin: CollectorPlugin = {
+	name: "ok",
+	register(app) {
+		app.post("/v1/traces", (c) => c.json({ ok: true }));
+	},
+};
+
+const spyLogger = () => {
+	const warn = vi.fn<Logger["warn"]>();
+	const logger: Logger = {
+		debug: vi.fn(),
+		info: vi.fn(),
+		warn,
+		error: vi.fn(),
+	};
+	return { logger, warn };
+};
+
+const ingest = (app: ReturnType<typeof createTelemetryCollectorApp>) =>
+	app.request("/v1/traces", { method: "POST", body: "{}" }, {} as CollectorEnv);
+
+const unauthWarnings = ({ warn }: ReturnType<typeof spyLogger>) =>
+	warn.mock.calls.filter(([m]) => String(m).includes("UNAUTHENTICATED"));
+
+describe("unauthenticated ingest warning", () => {
+	it("warns exactly once and still accepts the request", async () => {
+		const spy = spyLogger();
+		const { logger } = spy;
+		const app = createTelemetryCollectorApp({ plugins: [okPlugin], logger });
+		expect(unauthWarnings(spy)).toHaveLength(0); // not at build time
+		for (let i = 0; i < 3; i++) {
+			expect((await ingest(app)).status).toBe(200);
+		}
+		expect(unauthWarnings(spy)).toHaveLength(1);
+	});
+
+	it("stays silent when ingest auth is configured", async () => {
+		const spy = spyLogger();
+		const { logger } = spy;
+		const app = createTelemetryCollectorApp({
+			plugins: [okPlugin],
+			logger,
+			auth: { middleware: async (_c, next) => next() },
+		});
+		expect((await ingest(app)).status).toBe(200);
+		expect(unauthWarnings(spy)).toHaveLength(0);
+	});
+
+	it("stays silent with the explicit allowUnauthenticatedIngest opt-in", async () => {
+		const spy = spyLogger();
+		const { logger } = spy;
+		const app = createTelemetryCollectorApp({
+			plugins: [okPlugin],
+			logger,
+			allowUnauthenticatedIngest: true,
+		});
+		expect((await ingest(app)).status).toBe(200);
+		expect(unauthWarnings(spy)).toHaveLength(0);
+	});
+});

package/src/index.ts

@@ -286,6 +286,7 @@ export const createDefaultCollectorApp = (config?: Partial<CollectorConfig>) =>
 		logger: config?.logger,
 		withChildSpan: config?.withChildSpan,
 		sqlDb: config?.sqlDb,
+		allowUnauthenticatedIngest: config?.allowUnauthenticatedIngest,
 	});
 
 export default createTelemetryCollectorApp(allPlugins);

package/src/lib/alerts-store.test.ts

@@ -66,6 +66,37 @@ describe("AlertsStore.deleteRule", () => {
 	});
 });
 
+describe("AlertsStore.listEvaluations project scoping", () => {
+	it("does not return another project's evaluation history for a known rule id", async () => {
+		const db = createMigratedSqliteDb();
+		const projects = new ProjectsStore(db);
+		const alphaProject = await projects.createProject({ name: "A", slug: "a" });
+		const betaProject = await projects.createProject({ name: "B", slug: "b" });
+		const store = new AlertsStore(db);
+		const beta = await store.createRule(
+			betaProject.id,
+			input({ name: "beta" }),
+		);
+		await store.recordEvaluation(beta.id, beta.projectId, 5, "firing", true);
+
+		const own = await store.listEvaluations({
+			ruleId: beta.id,
+			projectId: betaProject.id,
+			hours: 24,
+		});
+		expect(own.evaluations).toHaveLength(1);
+
+		const foreign = await store.listEvaluations({
+			ruleId: beta.id,
+			projectId: alphaProject.id,
+			hours: 24,
+		});
+		expect(foreign.evaluations).toEqual([]);
+		expect(foreign.evidenceReferences).toBeUndefined();
+		db.close();
+	});
+});
+
 describe("AlertsStore.validateInput webhook targets", () => {
 	const store = new AlertsStore(createMigratedSqliteDb());
 

package/src/lib/alerts-store.ts

@@ -719,12 +719,23 @@ export class AlertsStore {
 		const cutoff = new Date(
 			Date.now() - params.hours * 60 * 60 * 1000,
 		).toISOString();
-		const rs = await this.db
-			.prepare(
-				`SELECT * FROM alert_evaluations WHERE rule_id = ? AND evaluated_at >= ? ORDER BY evaluated_at DESC LIMIT ?`,
-			)
-			.bind(params.ruleId, cutoff, Math.min(params.limit ?? 500, 1000))
-			.all<AlertEvaluationRow>();
+		const limit = Math.min(params.limit ?? 500, 1000);
+		// Scope by project whenever the caller knows it (every HTTP route does)
+		// so a rule id from another project cannot read its evaluation history.
+		// `projectId` stays optional on this public store API for back-compat.
+		const rs = params.projectId
+			? await this.db
+					.prepare(
+						`SELECT * FROM alert_evaluations WHERE rule_id = ? AND project_id = ? AND evaluated_at >= ? ORDER BY evaluated_at DESC LIMIT ?`,
+					)
+					.bind(params.ruleId, params.projectId, cutoff, limit)
+					.all<AlertEvaluationRow>()
+			: await this.db
+					.prepare(
+						`SELECT * FROM alert_evaluations WHERE rule_id = ? AND evaluated_at >= ? ORDER BY evaluated_at DESC LIMIT ?`,
+					)
+					.bind(params.ruleId, cutoff, limit)
+					.all<AlertEvaluationRow>();
 		const rows = rs.results ?? [];
 		const projectId = params.projectId ?? rows[0]?.project_id;
 		const rule = projectId

package/src/lib/projects-store.test.ts

@@ -1,4 +1,4 @@
-import { describe, expect, it } from "vitest";
+import { describe, expect, it, vi } from "vitest";
 import { sha256Hex } from "./hash";
 import { displayPrefix, ProjectsStore } from "./projects-store";
 import { createMigratedSqliteDb } from "./test-utils/node-sqlite-db";
@@ -60,3 +60,46 @@ describe("bootstrap key display prefix", () => {
 		db.close();
 	});
 });
+
+describe("ProjectsStore.bootstrapEnvKey rotation", () => {
+	it("warns (without revoking) when INGEST_KEY changes while the old bootstrap key is active", async () => {
+		const db = createMigratedSqliteDb();
+		const store = new ProjectsStore(db);
+		const warn = vi.spyOn(console, "warn").mockImplementation(() => {});
+		try {
+			await store.bootstrapEnvKey("first-bootstrap-key-0001");
+			await store.bootstrapEnvKey("first-bootstrap-key-0001"); // idempotent
+			expect(warn).not.toHaveBeenCalled();
+
+			await store.bootstrapEnvKey("second-bootstrap-key-0002");
+			expect(warn).toHaveBeenCalledTimes(1);
+			const message = String(warn.mock.calls[0]?.[0]);
+			expect(message).toContain("INGEST_KEY changed");
+			expect(message).toContain("revoke");
+			expect(message).not.toContain("first-bootstrap-key-0001");
+
+			// Nothing is auto-revoked: both keys still authenticate.
+			for (const key of [
+				"first-bootstrap-key-0001",
+				"second-bootstrap-key-0002",
+			]) {
+				expect(
+					(await store.findByKeyHash(await sha256Hex(key)))?.projectId,
+				).toBe("default");
+			}
+
+			// Once the old one is revoked, a restart with the new key is quiet.
+			const old = (await store.listKeys("default")).find(
+				(k) => k.name === "bootstrap" && k.keyPrefix.startsWith("first"),
+			);
+			expect(old).toBeDefined();
+			await store.revokeKey(old?.id ?? "", "default");
+			warn.mockClear();
+			await store.bootstrapEnvKey("second-bootstrap-key-0002");
+			expect(warn).not.toHaveBeenCalled();
+		} finally {
+			warn.mockRestore();
+			db.close();
+		}
+	});
+});

package/src/lib/projects-store.ts

@@ -215,6 +215,15 @@ export class ProjectsStore {
 			return;
 		}
 
+		// A different, still-active bootstrap key means INGEST_KEY was rotated.
+		// The old key is deliberately NOT revoked here: other instances (or
+		// clients mid-rollout) may still be using it. Tell the operator instead.
+		const previous = await this.db
+			.prepare(
+				`SELECT id, created_at FROM ingest_keys WHERE project_id = 'default' AND name = 'bootstrap' AND revoked_at IS NULL`,
+			)
+			.all<{ id: string; created_at: string }>();
+
 		const id = randomHex(16);
 		const createdAt = new Date().toISOString();
 		await this.db
@@ -223,5 +232,17 @@ export class ProjectsStore {
 			)
 			.bind(id, keyHash, keyPrefix, createdAt)
 			.run();
+
+		const stale = previous.results ?? [];
+		if (stale.length > 0) {
+			console.warn(
+				`[projects-store] INGEST_KEY changed: registered a new bootstrap ingest key (${keyPrefix}…) but ${stale.length} earlier bootstrap key(s) are still active and keep accepting ingest: ${stale
+					// Ids only: legacy rows may still hold a long key_prefix.
+					.map((row) => `id ${row.id} (created ${row.created_at})`)
+					.join(
+						", ",
+					)}. Once every client uses the new key, revoke the old one in the dashboard (Projects → default → Keys) or with DELETE /internal/projects/default/keys/<keyId>.`,
+			);
+		}
 	}
 }

package/src/lib/webhook-url.test.ts

@@ -53,6 +53,41 @@ describe("assertSafeWebhookUrl", () => {
 		}
 	});
 
+	it("rejects IPv4 embedded in IPv6 (compatible, mapped, NAT64, 6to4)", () => {
+		for (const url of [
+			"http://[::7f00:1]/hook",
+			"http://[::127.0.0.1]/hook",
+			"http://[::a9fe:a9fe]/hook",
+			"http://[::ffff:7f00:1]/hook",
+			"http://[0:0:0:0:0:ffff:127.0.0.1]/hook",
+			"http://[64:ff9b::7f00:1]/hook",
+			"http://[64:ff9b::169.254.169.254]/hook",
+			"http://[2002:7f00:1::]/hook",
+			"http://[2002:a00:1::1]/hook",
+			"http://[::]/hook",
+		]) {
+			expect(() => assertSafeWebhookUrl(url), url).toThrow(WebhookUrlError);
+			// The documented opt-out still unlocks every one of them.
+			expect(
+				() => assertSafeWebhookUrl(url, { allowPrivateNetworks: true }),
+				url,
+			).not.toThrow();
+		}
+	});
+
+	it("keeps public IPv6 and public embedded IPv4 reachable", () => {
+		for (const url of [
+			"https://[2606:4700:4700::1111]/hook",
+			"https://[64:ff9b::808:808]/hook",
+			"https://[2002:808:808::1]/hook",
+			"https://[::ffff:8.8.8.8]/hook",
+			"https://198.20.0.1/hook",
+			"https://198.17.255.1/hook",
+		]) {
+			expect(() => assertSafeWebhookUrl(url), url).not.toThrow();
+		}
+	});
+
 	it("allows private hosts only with the explicit opt-in", () => {
 		const url = "http://alertmanager.internal:9093/api/v2/alerts";
 		expect(() => assertSafeWebhookUrl(url)).toThrow(WebhookUrlError);
@@ -107,6 +142,20 @@ describe("redactWebhookUrl", () => {
 		expect(
 			await resolveWebhookHost("v6.example", async () => ["fd00::1"]),
 		).toBe("private");
+		for (const answer of [
+			"::ffff:127.0.0.1",
+			"64:ff9b::a00:1",
+			"2002:a9fe:a9fe::",
+			"fe80::1%eth0",
+		]) {
+			expect(
+				await resolveWebhookHost("v6.example", async () => [answer]),
+				answer,
+			).toBe("private");
+		}
+		expect(
+			await resolveWebhookHost("v6.example", async () => ["2606:4700::1111"]),
+		).toBe("public");
 		// IP literals were judged already by the literal check.
 		expect(await resolveWebhookHost("10.0.0.8", lookup)).toBe("public");
 		// No answer is never "safe": the delivery fetch would resolve on its own.

package/src/lib/webhook-url.ts

@@ -38,25 +38,83 @@ const isPrivateIpv4 = (o: number[]): boolean =>
 	(o[0] === 192 && o[1] === 168) ||
 	o[0] >= 224; // multicast, reserved, broadcast
 
+/**
+ * Expand an IPv6 literal (no brackets, optional `%zone`) into its eight
+ * 16-bit groups. Accepts a trailing dotted IPv4 tail (`::127.0.0.1`).
+ * Returns null for anything that is not a well-formed address.
+ */
+const parseIpv6 = (literal: string): number[] | null => {
+	let text = literal.replace(/%.*$/, "");
+	const tail = /:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(text);
+	let tailGroups: number[] = [];
+	if (tail) {
+		const v4 = parseIpv4(tail[1]);
+		if (!v4) return null;
+		tailGroups = [(v4[0] << 8) | v4[1], (v4[2] << 8) | v4[3]];
+		text = text.slice(0, -tail[1].length);
+		// "::1.2.3.4" leaves "::", "64:ff9b::1.2.3.4" leaves "64:ff9b::",
+		// "::ffff:1.2.3.4" leaves "::ffff:"; drop the dangling separator
+		// unless it is part of "::".
+		if (text.endsWith(":") && !text.endsWith("::")) text = text.slice(0, -1);
+	}
+	const halves = text.split("::");
+	if (halves.length > 2) return null;
+	const toGroups = (part: string): number[] | null => {
+		if (part === "") return [];
+		const groups: number[] = [];
+		for (const g of part.split(":")) {
+			if (!/^[0-9a-f]{1,4}$/.test(g)) return null;
+			groups.push(Number.parseInt(g, 16));
+		}
+		return groups;
+	};
+	const head = toGroups(halves[0]);
+	const rest = halves.length === 2 ? toGroups(halves[1]) : [];
+	if (!head || !rest) return null;
+	const explicit = head.length + rest.length + tailGroups.length;
+	if (halves.length === 1) {
+		return explicit === 8 ? [...head, ...tailGroups] : null;
+	}
+	if (explicit > 7) return null;
+	return [
+		...head,
+		...new Array<number>(8 - explicit).fill(0),
+		...rest,
+		...tailGroups,
+	];
+};
+
+const embeddedIpv4 = (hi: number, lo: number): number[] => [
+	hi >> 8,
+	hi & 0xff,
+	lo >> 8,
+	lo & 0xff,
+];
+
 const isPrivateIpv6 = (host: string): boolean => {
 	// URL.hostname keeps the brackets for IPv6 literals.
 	const literal = host.replace(/^\[|\]$/g, "").toLowerCase();
-	if (literal === "::" || literal === "::1") return true;
-	// IPv4-mapped (::ffff:a.b.c.d). The WHATWG URL parser serializes the
-	// embedded address as two hex groups (::ffff:a00:1), so accept both.
-	const dotted = /^::ffff:(\d{1,3}(?:\.\d{1,3}){3})$/.exec(literal);
-	if (dotted) {
-		const v4 = parseIpv4(dotted[1]);
-		return v4 ? isPrivateIpv4(v4) : true;
+	const g = parseIpv6(literal);
+	if (!g) return true; // not a parseable address: fail closed
+	const zeroPrefix = (n: number) => g.slice(0, n).every((x) => x === 0);
+	// :: (unspecified), ::1 (loopback) and the deprecated IPv4-compatible
+	// ::a.b.c.d form (which the WHATWG URL parser serializes as ::7f00:1).
+	if (zeroPrefix(6)) {
+		if (g[6] === 0 && (g[7] === 0 || g[7] === 1)) return true;
+		return isPrivateIpv4(embeddedIpv4(g[6], g[7]));
+	}
+	// IPv4-mapped ::ffff:a.b.c.d (serialized as ::ffff:a00:1).
+	if (zeroPrefix(5) && g[5] === 0xffff) {
+		return isPrivateIpv4(embeddedIpv4(g[6], g[7]));
 	}
-	const hex = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/.exec(literal);
-	if (hex) {
-		const hi = Number.parseInt(hex[1], 16);
-		const lo = Number.parseInt(hex[2], 16);
-		return isPrivateIpv4([hi >> 8, hi & 0xff, lo >> 8, lo & 0xff]);
+	// NAT64 well-known prefix 64:ff9b::/96 — the gateway forwards to the
+	// embedded IPv4 address.
+	if (g[0] === 0x64 && g[1] === 0xff9b && g.slice(2, 6).every((x) => x === 0)) {
+		return isPrivateIpv4(embeddedIpv4(g[6], g[7]));
 	}
-	const first = Number.parseInt(literal.split(":")[0] || "0", 16);
-	if (Number.isNaN(first)) return true;
+	// 6to4 2002::/16 carries the IPv4 relay address in groups 1-2.
+	if (g[0] === 0x2002) return isPrivateIpv4(embeddedIpv4(g[1], g[2]));
+	const first = g[0];
 	if ((first & 0xfe00) === 0xfc00) return true; // fc00::/7 unique local
 	if ((first & 0xffc0) === 0xfe80) return true; // fe80::/10 link-local
 	if ((first & 0xff00) === 0xff00) return true; // ff00::/8 multicast

package/src/otlp/decode/logs.ts

@@ -41,7 +41,26 @@ export interface DecodedLogRecord {
  * storage. Resource `service.name` and scope name are denormalized onto each
  * record so downstream code doesn't need to traverse the hierarchy.
  */
-export const decodeLogsRequest = (body: ReadBodyResult): DecodedLogRecord[] => {
+export const decodeLogsRequest = (body: ReadBodyResult): DecodedLogRecord[] =>
+	decodeLogsRequestCapped(body, Number.POSITIVE_INFINITY).records;
+
+export interface CappedLogsRequest {
+	/** First `maxRecords` records, in wire order. */
+	records: DecodedLogRecord[];
+	/** Records beyond the cap that were counted but never adapted. */
+	rejected: number;
+}
+
+/**
+ * Like {@link decodeLogsRequest}, but stops adapting once `maxRecords`
+ * records have been produced, so an oversized batch never gets a second,
+ * adapted in-memory copy. Output is identical to decoding everything and
+ * slicing the first `maxRecords`.
+ */
+export const decodeLogsRequestCapped = (
+	body: ReadBodyResult,
+	maxRecords: number,
+): CappedLogsRequest => {
 	let msg: ExportLogsServiceRequest;
 	try {
 		msg =
@@ -56,16 +75,25 @@ export const decodeLogsRequest = (body: ReadBodyResult): DecodedLogRecord[] => {
 	}
 
 	const out: DecodedLogRecord[] = [];
+	let rejected = 0;
 	for (const rl of msg.resourceLogs) {
+		if (out.length >= maxRecords) {
+			for (const sl of rl.scopeLogs) rejected += sl.logRecords.length;
+			continue;
+		}
 		const serviceName = extractServiceName(rl.resource?.attributes);
 		for (const sl of rl.scopeLogs) {
 			const loggerName = sl.scope?.name || null;
 			for (const log of sl.logRecords) {
+				if (out.length >= maxRecords) {
+					rejected++;
+					continue;
+				}
 				out.push(adaptLogRecord(log, serviceName, loggerName));
 			}
 		}
 	}
-	return out;
+	return { records: out, rejected };
 };
 
 const adaptLogRecord = (

package/src/otlp/decode/metrics.ts

@@ -78,7 +78,26 @@ export interface DecodedMetricPoint {
 
 export const decodeMetricsRequest = (
 	body: ReadBodyResult,
-): DecodedMetricPoint[] => {
+): DecodedMetricPoint[] =>
+	decodeMetricsRequestCapped(body, Number.POSITIVE_INFINITY).points;
+
+export interface CappedMetricsRequest {
+	/** First `maxPoints` points, in wire order. */
+	points: DecodedMetricPoint[];
+	/** Points beyond the cap that were counted but never adapted. */
+	rejected: number;
+}
+
+/**
+ * Like {@link decodeMetricsRequest}, but stops adapting once `maxPoints`
+ * points have been produced, so an oversized batch never gets a second,
+ * adapted in-memory copy. Output is identical to decoding everything and
+ * slicing the first `maxPoints`.
+ */
+export const decodeMetricsRequestCapped = (
+	body: ReadBodyResult,
+	maxPoints: number,
+): CappedMetricsRequest => {
 	let msg: ExportMetricsServiceRequest;
 	try {
 		msg =
@@ -96,7 +115,20 @@ export const decodeMetricsRequest = (
 	}
 
 	const out: DecodedMetricPoint[] = [];
+	let rejected = 0;
 	for (const rm of msg.resourceMetrics) {
+		if (out.length >= maxPoints) {
+			for (const sm of rm.scopeMetrics) rejected += countPoints(sm);
+			continue;
+		}
+		const remaining = maxPoints - out.length;
+		const total = rm.scopeMetrics.reduce((n, sm) => n + countPoints(sm), 0);
+		if (total > remaining) {
+			// Trim this resource's data points in place (wire order) so the
+			// adapters below only ever build `remaining` points.
+			rejected += total - remaining;
+			trimScopeMetrics(rm.scopeMetrics, remaining);
+		}
 		const resourceAttrs = rm.resource?.attributes ?? [];
 		const resourceAttrsJson = resourceAttrs.length
 			? JSON.stringify(keyValuesToRecord(resourceAttrs))
@@ -106,7 +138,40 @@ export const decodeMetricsRequest = (
 			addMetrics(out, rm, sm, serviceName, resourceAttrsJson);
 		}
 	}
-	return out;
+	return { points: out, rejected };
+};
+
+/** Data-point count of the metric kinds `addMetrics` emits. */
+const metricPointCount = (metric: Metric): number => {
+	switch (metric.data.case) {
+		case "gauge":
+		case "sum":
+		case "histogram":
+		case "exponentialHistogram":
+		case "summary":
+			return metric.data.value.dataPoints.length;
+		default:
+			return 0;
+	}
+};
+
+const countPoints = (sm: ScopeMetrics): number =>
+	sm.metrics.reduce((n, m) => n + metricPointCount(m), 0);
+
+/** Keep only the first `budget` emitted data points, in wire order. */
+const trimScopeMetrics = (scopeMetrics: ScopeMetrics[], budget: number) => {
+	let left = budget;
+	for (const sm of scopeMetrics) {
+		for (const metric of sm.metrics) {
+			const n = metricPointCount(metric);
+			if (n === 0) continue;
+			if (n > left) {
+				const data = metric.data.value as { dataPoints: unknown[] };
+				data.dataPoints = data.dataPoints.slice(0, left);
+			}
+			left -= Math.min(n, left);
+		}
+	}
 };
 
 const addMetrics = (