@senad-d/observme 0.1.4 → 0.1.5

package/src/privacy/secret-patterns.ts

@@ -49,7 +49,12 @@ export const GITHUB_TOKEN_PATTERN = /(gh[pousr]_\w{36,}|github_pat_\w{22,255})/g
 export const OPENAI_LIKE_KEY_PATTERN = /sk-[A-Za-z0-9_-]{20,}/gu;
 export const ANTHROPIC_LIKE_KEY_PATTERN = /sk-ant-[A-Za-z0-9_-]{20,}/gu;
 export const SLACK_TOKEN_PATTERN = /xox[baprs]-[A-Za-z0-9-]{10,}/gu;
-export const PRIVATE_KEY_BLOCK_PATTERN = /-----BEGIN [A-Z ]*PRIVATE KEY-----/gu;
+export const MAX_PRIVATE_KEY_BODY_CHARS = 1_000_000;
+const PRIVATE_KEY_LABEL_PATTERN = "([A-Z ]{0,64}PRIVATE KEY)";
+export const PRIVATE_KEY_BLOCK_PATTERN = new RegExp(
+  String.raw`-----BEGIN ${PRIVATE_KEY_LABEL_PATTERN}-----[\s\S]{0,${MAX_PRIVATE_KEY_BODY_CHARS}}?(?:-----END \1-----|$)`,
+  "gu",
+);
 export const PASSWORD_ASSIGNMENT_PATTERN = /(password|passwd|pwd)\s*[:=]\s*[^\s]+/giu;
 export const API_KEY_ASSIGNMENT_PATTERN = /(api[_-]?key|token|secret|client[_-]?secret)\s*[:=]\s*[^\s]+/giu;
 export const URL_CREDENTIALS_PATTERN = /[a-z][a-z0-9+.-]{0,63}:\/\/[^\s:/?#]{1,1024}:[^\s@/]{1,1024}@/gu;

package/src/query/grafana-readiness.ts

@@ -1,5 +1,10 @@
 import type { GrafanaDatasourceUidsConfig, ObservMeConfig } from "../config/schema.ts";
 import { hasUnresolvedEnvironmentPlaceholder, normalizeConfiguredGrafanaSecret } from "./grafana-transport.ts";
+import type { GrafanaUrlSecurityFailureClass } from "./grafana-url.ts";
+import {
+  classifyGrafanaUrlSecurityFailure,
+  formatGrafanaUrlSecurityFailure,
+} from "./grafana-url.ts";
 
 export type GrafanaQueryDatasourceKey = keyof GrafanaDatasourceUidsConfig;
 export type GrafanaQueryReadinessStatus = "ready" | "disabled" | "not_ready";
@@ -66,12 +71,23 @@ function validateGrafanaUrl(url: string): GrafanaQueryReadinessIssue[] {
 function validateGrafanaUrlProtocol(url: string): GrafanaQueryReadinessIssue[] {
   try {
     const parsed = new URL(url);
-    if (parsed.protocol === "http:" || parsed.protocol === "https:") return [];
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") return [createInvalidGrafanaUrlIssue()];
+
+    const securityFailure = classifyGrafanaUrlSecurityFailure(parsed);
+    return securityFailure ? [createEmbeddedGrafanaCredentialsIssue(securityFailure)] : [];
   } catch (error) {
     return [createInvalidGrafanaUrlIssue(readUrlParseFailureKind(error))];
   }
+}
 
-  return [createInvalidGrafanaUrlIssue()];
+function createEmbeddedGrafanaCredentialsIssue(
+  failureClass: GrafanaUrlSecurityFailureClass,
+): GrafanaQueryReadinessIssue {
+  return createGrafanaReadinessIssue(
+    "embedded_grafana_url_credentials",
+    "query.grafana.url",
+    formatGrafanaUrlSecurityFailure(failureClass),
+  );
 }
 
 function createInvalidGrafanaUrlIssue(failureKind?: string): GrafanaQueryReadinessIssue {

package/src/query/grafana-transport.ts

@@ -2,9 +2,11 @@ import type { ClientRequest, IncomingHttpHeaders, IncomingMessage, RequestOption
 import { request as requestHttp } from "node:http";
 import type { RequestOptions as HttpsRequestOptions } from "node:https";
 import { request as requestHttps } from "node:https";
+import { Readable } from "node:stream";
 import type { ObservMeConfig } from "../config/schema.ts";
 import { readDiagnosticMessage, sanitizeDiagnosticText } from "../diagnostics/sanitize.ts";
 import { hasUnresolvedEnvironmentPlaceholder } from "../safety/sensitive-input.ts";
+import { assertCredentialFreeGrafanaUrl } from "./grafana-url.ts";
 
 export type GrafanaFetch = (input: string | URL, init?: RequestInit) => Promise<Response>;
 export type GrafanaAuthMode = "bearer" | "basic" | "none";
@@ -48,6 +50,33 @@ const tlsErrorCodes = new Set<string>([
 const dnsErrorCodes = new Set<string>(["ENOTFOUND", "EAI_AGAIN"]);
 const connectionTimeoutErrorCodes = new Set<string>(["ETIMEDOUT", "UND_ERR_CONNECT_TIMEOUT"]);
 
+type GrafanaResponseChunk = Uint8Array<ArrayBuffer>;
+
+class BufferedGrafanaResponseBodySource implements UnderlyingSource<GrafanaResponseChunk> {
+  #chunks: (GrafanaResponseChunk | undefined)[];
+  #index = 0;
+
+  constructor(chunks: GrafanaResponseChunk[]) {
+    this.#chunks = chunks;
+  }
+
+  pull(controller: ReadableStreamController<GrafanaResponseChunk>): void {
+    const chunk = this.#chunks[this.#index];
+    if (chunk === undefined) {
+      controller.close();
+      return;
+    }
+
+    this.#chunks[this.#index] = undefined;
+    this.#index += 1;
+    controller.enqueue(chunk);
+  }
+
+  cancel(): void {
+    this.#chunks = [];
+  }
+}
+
 export class GrafanaTransportClient {
   readonly #config: ObservMeConfig;
   readonly #fetcher: GrafanaFetch;
@@ -76,6 +105,7 @@ export class GrafanaTransportClient {
   }
 
   async fetch(input: string | URL, options: GrafanaTransportFetchOptions = {}): Promise<Response> {
+    assertCredentialFreeGrafanaUrl(input);
     return fetchGrafanaRequest(
       this.#fetcher,
       input,
@@ -99,6 +129,7 @@ export function createGrafanaTransport(
 
 export function buildGrafanaApiUrl(baseUrl: string, apiPath: string): URL {
   const url = new URL(baseUrl.trim());
+  assertCredentialFreeGrafanaUrl(url);
   const basePath = removeTrailingSlashes(url.pathname);
   const path = removeLeadingSlashes(apiPath);
   url.pathname = `${basePath}/${path}`;
@@ -204,7 +235,8 @@ async function fetchGrafanaRequest(
   const timeout = setTimeout(() => controller.abort(), timeoutMs);
 
   try {
-    return await fetcher(input, { ...init, signal: controller.signal });
+    const response = await fetcher(input, { ...init, signal: controller.signal });
+    return await readBoundedGrafanaResponse(response, MAX_GRAFANA_RESPONSE_BODY_BYTES, controller.signal);
   } catch (error) {
     throw normalizeGrafanaTransportError(error, timeoutMessage);
   } finally {
@@ -212,6 +244,113 @@ async function fetchGrafanaRequest(
   }
 }
 
+async function readBoundedGrafanaResponse(
+  response: Response,
+  maxBytes: number,
+  signal: AbortSignal,
+): Promise<Response> {
+  const declaredBytes = readDeclaredResponseBodyBytes(response.headers);
+  if (declaredBytes !== undefined && declaredBytes > maxBytes) {
+    const error = createGrafanaResponseBodyLimitError(maxBytes);
+    cancelGrafanaResponseBody(response.body, error);
+    throw error;
+  }
+
+  if (response.body === null) return response;
+
+  const chunks = await readBoundedResponseBody(response.body, maxBytes, signal);
+  return createBufferedGrafanaResponse(response, chunks);
+}
+
+async function readBoundedResponseBody(
+  body: ReadableStream<Uint8Array>,
+  maxBytes: number,
+  signal: AbortSignal,
+): Promise<GrafanaResponseChunk[]> {
+  const reader = body.getReader();
+  const chunks: GrafanaResponseChunk[] = [];
+  let totalBytes = 0;
+
+  try {
+    while (true) {
+      const result = await readGrafanaResponseChunk(reader, signal);
+      if (result.done) return chunks;
+
+      totalBytes += result.value.byteLength;
+      if (totalBytes > maxBytes) throw createGrafanaResponseBodyLimitError(maxBytes);
+      chunks.push(normalizeGrafanaResponseChunk(result.value));
+    }
+  } catch (error) {
+    cancelGrafanaResponseReader(reader, error);
+    throw error;
+  } finally {
+    reader.releaseLock();
+  }
+}
+
+function readGrafanaResponseChunk(
+  reader: ReadableStreamDefaultReader<Uint8Array>,
+  signal: AbortSignal,
+): Promise<ReadableStreamReadResult<Uint8Array>> {
+  if (signal.aborted) return Promise.reject(createAbortError());
+
+  return new Promise((resolve, reject) => {
+    const abortRead = () => {
+      const error = createAbortError();
+      cancelGrafanaResponseReader(reader, error);
+      reject(error);
+    };
+    const removeAbortListener = () => signal.removeEventListener("abort", abortRead);
+
+    signal.addEventListener("abort", abortRead, { once: true });
+    reader.read().then(
+      result => {
+        removeAbortListener();
+        resolve(result);
+      },
+      error => {
+        removeAbortListener();
+        reject(error);
+      },
+    );
+  });
+}
+
+function normalizeGrafanaResponseChunk(chunk: Uint8Array): GrafanaResponseChunk {
+  if (chunk.buffer instanceof ArrayBuffer) return chunk as GrafanaResponseChunk;
+  return new Uint8Array(chunk);
+}
+
+function readDeclaredResponseBodyBytes(headers: Headers): number | undefined {
+  const value = headers.get("content-length")?.trim();
+  if (!value || !/^\d+$/u.test(value)) return undefined;
+
+  const bytes = Number(value);
+  return Number.isSafeInteger(bytes) ? bytes : Number.POSITIVE_INFINITY;
+}
+
+function createBufferedGrafanaResponse(response: Response, chunks: GrafanaResponseChunk[]): Response {
+  const body = new ReadableStream<GrafanaResponseChunk>(new BufferedGrafanaResponseBodySource(chunks));
+  return new Response(body, {
+    status: response.status,
+    statusText: response.statusText,
+    headers: response.headers,
+  });
+}
+
+function cancelGrafanaResponseBody(body: ReadableStream<Uint8Array> | null, reason: unknown): void {
+  if (body === null) return;
+  void body.cancel(reason).catch(ignoreCancellationFailure);
+}
+
+function cancelGrafanaResponseReader(reader: ReadableStreamDefaultReader<Uint8Array>, reason: unknown): void {
+  void reader.cancel(reason).catch(ignoreCancellationFailure);
+}
+
+function ignoreCancellationFailure(): void {
+  // Stream cancellation is best-effort after the original transport failure is already known.
+}
+
 function createGrafanaRequestInit(config: ObservMeConfig, options: GrafanaTransportFetchOptions): RequestInit {
   return {
     method: options.method ?? "GET",
@@ -238,8 +377,9 @@ export async function fetchGrafanaWithNode(
 ): Promise<Response> {
   const url = new URL(input);
   assertSupportedGrafanaUrl(url);
+  assertCredentialFreeGrafanaUrl(url);
 
-  const requestOptions = createNodeRequestOptions(config, init);
+  const requestOptions = createGrafanaNodeRequestOptions(config, init);
   const body = normalizeRequestBody(init?.body);
   return requestNodeUrl(url, requestOptions, body, init?.signal);
 }
@@ -288,7 +428,10 @@ function describeMissingGrafanaAuth(config: ObservMeConfig): string {
   return "Grafana authentication is not configured. Configure query.grafana.token or query.grafana.username/password.";
 }
 
-function createNodeRequestOptions(config: ObservMeConfig, init: RequestInit | undefined): HttpRequestOptions | HttpsRequestOptions {
+export function createGrafanaNodeRequestOptions(
+  config: ObservMeConfig,
+  init?: RequestInit,
+): HttpRequestOptions | HttpsRequestOptions {
   const options: HttpRequestOptions | HttpsRequestOptions = {
     method: init?.method ?? "GET",
     headers: normalizeRequestHeaders(init?.headers),
@@ -345,7 +488,7 @@ async function requestNodeUrl(
   return new Promise((resolve, reject) => {
     const client = url.protocol === "https:" ? requestHttps : requestHttp;
     const request = client(url, options, response => {
-      readNodeResponse(response).then(resolve, reject);
+      resolve(createNodeResponse(response));
     });
     const removeAbortListener = attachAbortSignal(request, signal);
 
@@ -372,31 +515,11 @@ function attachAbortSignal(request: ClientRequest, signal: AbortSignal | null |
   return () => signal.removeEventListener("abort", abortRequest);
 }
 
-async function readNodeResponse(response: IncomingMessage): Promise<Response> {
-  const body = await readNodeResponseBody(response, MAX_GRAFANA_RESPONSE_BODY_BYTES);
+function createNodeResponse(response: IncomingMessage): Response {
+  const body = Readable.toWeb(response) as ReadableStream<Uint8Array>;
   const status = normalizeResponseStatus(response.statusCode);
   const statusText = response.statusMessage ?? "";
-  return new Response(body.toString("utf8"), { status, statusText, headers: normalizeResponseHeaders(response.headers) });
-}
-
-async function readNodeResponseBody(response: IncomingMessage, maxBytes: number): Promise<Buffer> {
-  const chunks: Buffer[] = [];
-  let totalBytes = 0;
-
-  for await (const chunk of response) {
-    const buffer = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk);
-    totalBytes += buffer.byteLength;
-    if (totalBytes > maxBytes) throw destroyOversizedNodeResponse(response, maxBytes);
-    chunks.push(buffer);
-  }
-
-  return Buffer.concat(chunks, totalBytes);
-}
-
-function destroyOversizedNodeResponse(response: IncomingMessage, maxBytes: number): GrafanaResponseBodyLimitError {
-  const error = createGrafanaResponseBodyLimitError(maxBytes);
-  response.destroy(error);
-  return error;
+  return new Response(body, { status, statusText, headers: normalizeResponseHeaders(response.headers) });
 }
 
 function createGrafanaResponseBodyLimitError(maxBytes: number): GrafanaResponseBodyLimitError {

package/src/query/grafana-url.ts

@@ -0,0 +1,36 @@
+export type GrafanaUrlSecurityFailureClass = "embedded_credentials";
+
+const embeddedCredentialsFailureClass: GrafanaUrlSecurityFailureClass = "embedded_credentials";
+const grafanaUrlSecurityFailureMessages = {
+  embedded_credentials:
+    "query.grafana.url is invalid (embedded_credentials). Configure authentication through query.grafana.token or query.grafana.username/password.",
+} satisfies Readonly<Record<GrafanaUrlSecurityFailureClass, string>>;
+
+export function classifyGrafanaUrlSecurityFailure(
+  value: string | URL,
+): GrafanaUrlSecurityFailureClass | undefined {
+  const url = parseGrafanaUrl(value);
+  if (!url || (!url.username && !url.password)) return undefined;
+  return embeddedCredentialsFailureClass;
+}
+
+export function formatGrafanaUrlSecurityFailure(failureClass: GrafanaUrlSecurityFailureClass): string {
+  return grafanaUrlSecurityFailureMessages[failureClass];
+}
+
+export function assertCredentialFreeGrafanaUrl(value: string | URL): void {
+  const failureClass = classifyGrafanaUrlSecurityFailure(value);
+  if (!failureClass) return;
+
+  throw new Error(formatGrafanaUrlSecurityFailure(failureClass));
+}
+
+function parseGrafanaUrl(value: string | URL): URL | undefined {
+  if (value instanceof URL) return value;
+
+  try {
+    return new URL(value);
+  } catch {
+    return undefined;
+  }
+}

package/src/query/grafana.ts

@@ -1,10 +1,12 @@
 import type { ObservMeConfig } from "../config/schema.ts";
 import { readDiagnosticMessage, sanitizeDiagnosticText } from "../diagnostics/sanitize.ts";
-import { assertNoSensitiveQueryInput } from "../safety/sensitive-input.ts";
 import type { GrafanaTransportClient, GrafanaTransportOptions } from "./grafana-transport.ts";
 import { createGrafanaTransport } from "./grafana-transport.ts";
 import type { GrafanaQueryDatasourceKey } from "./grafana-readiness.ts";
 import { formatGrafanaQueryReadiness, getGrafanaQueryReadiness } from "./grafana-readiness.ts";
+import { buildGrafanaTraceLink } from "./trace-link.ts";
+
+export { buildGrafanaTraceLink as getGrafanaTraceLink } from "./trace-link.ts";
 
 export type { GrafanaFetch } from "./grafana-transport.ts";
 export type GrafanaHealthCheckKind = "service" | "datasource";
@@ -38,58 +40,11 @@ interface GrafanaDatasourceDefinition {
   readonly fallbackHealthPath?: string;
 }
 
-interface TraceTemplateReplacement {
-  readonly pattern: RegExp;
-  readonly key: TraceTemplateValueKey;
-}
-
-type TraceTemplateValueKey = "traceId" | "tempoDatasourceUid";
-
-type TraceTemplateValues = Record<TraceTemplateValueKey, string>;
-
-interface GrafanaExploreDatasourceRef {
-  readonly type: "tempo";
-  readonly uid: string;
-}
-
-interface GrafanaTraceQuery {
-  readonly refId: "A";
-  readonly datasource: GrafanaExploreDatasourceRef;
-  readonly queryType: "traceId";
-  readonly query: string;
-}
-
-interface GrafanaExplorePane {
-  readonly datasource: string;
-  readonly queries: readonly GrafanaTraceQuery[];
-  readonly range: {
-    readonly from: "now-1h";
-    readonly to: "now";
-  };
-}
-
-type GrafanaExplorePanes = Record<string, GrafanaExplorePane>;
-
-const traceIdPattern = /^[a-f0-9]{32}$/iu;
-const zeroTraceIdPattern = /^0{32}$/u;
-const traceIdTemplatePattern = /\{\{\s*traceId\s*\}\}|\{traceId\}|\$\{traceId\}|%TRACE_ID%/u;
-const fallbackTraceTemplateMarkerPattern = /\.\.\./u;
 const datasourceDefinitions = [
   { label: "Tempo datasource", key: "tempo", fallbackHealthPath: "/ready" },
   { label: "Loki datasource", key: "loki", fallbackHealthPath: undefined },
   { label: "Metrics datasource", key: "prometheus", fallbackHealthPath: undefined },
 ] as const;
-const traceTemplateReplacements: readonly TraceTemplateReplacement[] = [
-  { pattern: /\{\{\s*traceId\s*\}\}/gu, key: "traceId" },
-  { pattern: /\$\{traceId\}/gu, key: "traceId" },
-  { pattern: /\{traceId\}/gu, key: "traceId" },
-  { pattern: /%TRACE_ID%/gu, key: "traceId" },
-  { pattern: /\{\{\s*tempoDatasourceUid\s*\}\}/gu, key: "tempoDatasourceUid" },
-  { pattern: /\$\{tempoDatasourceUid\}/gu, key: "tempoDatasourceUid" },
-  { pattern: /\{tempoDatasourceUid\}/gu, key: "tempoDatasourceUid" },
-  { pattern: /%TEMPO_DATASOURCE_UID%/gu, key: "tempoDatasourceUid" },
-];
-
 export class GrafanaQueryClient {
   readonly #config: ObservMeConfig;
   readonly #transport: GrafanaTransportClient;
@@ -104,7 +59,7 @@ export class GrafanaQueryClient {
   }
 
   getTraceLink(traceId: string): string {
-    return getGrafanaTraceLink(this.#config, traceId);
+    return buildGrafanaTraceLink(this.#config, traceId);
   }
 }
 
@@ -134,16 +89,6 @@ async function getGrafanaHealthWithTransport(
   return { timeoutMs: transport.timeoutMs, checks };
 }
 
-export function getGrafanaTraceLink(config: ObservMeConfig, traceId: string): string {
-  const normalizedTraceId = normalizeTraceId(traceId);
-  const template = config.query.links.traceUrlTemplate.trim();
-
-  if (hasTraceIdTemplatePlaceholder(template)) return renderTraceUrlTemplate(template, config, normalizedTraceId);
-  if (isFallbackTraceTemplate(template)) return buildDefaultGrafanaTraceLink(config, normalizedTraceId);
-
-  throw new Error("Grafana traceUrlTemplate must include a traceId placeholder or use the default Grafana link fallback.");
-}
-
 async function checkGrafanaReachability(
   config: ObservMeConfig,
   transport: GrafanaTransportClient,
@@ -285,83 +230,6 @@ function skippedHealthResult(label: string, kind: GrafanaHealthCheckKind, detail
   return { label, kind, status: "skipped", detail };
 }
 
-function buildDefaultGrafanaTraceLink(config: ObservMeConfig, traceId: string): string {
-  const baseUrl = config.query.grafana.url.trim();
-  if (!baseUrl) throw new Error("Grafana URL is not configured for trace-link construction.");
-
-  const url = new URL(baseUrl);
-  const basePath = removeTrailingSlashes(url.pathname);
-  url.pathname = `${basePath}/explore`;
-  url.search = "";
-  url.hash = "";
-  url.searchParams.set("schemaVersion", "1");
-  url.searchParams.set("panes", JSON.stringify(createDefaultExplorePanes(config, traceId)));
-  return url.toString();
-}
-
-function removeTrailingSlashes(value: string): string {
-  let end = value.length;
-  while (end > 0 && value[end - 1] === "/") end -= 1;
-  return value.slice(0, end);
-}
-
-function createDefaultExplorePanes(config: ObservMeConfig, traceId: string): GrafanaExplorePanes {
-  const tempoUid = config.query.grafana.datasourceUids.tempo;
-  return {
-    observmeTrace: {
-      datasource: tempoUid,
-      queries: [
-        {
-          refId: "A",
-          datasource: { type: "tempo", uid: tempoUid },
-          queryType: "traceId",
-          query: traceId,
-        },
-      ],
-      range: { from: "now-1h", to: "now" },
-    },
-  };
-}
-
-function renderTraceUrlTemplate(template: string, config: ObservMeConfig, traceId: string): string {
-  const values = createTraceTemplateValues(config, traceId);
-  let rendered = template;
-
-  for (const replacement of traceTemplateReplacements) {
-    rendered = rendered.replace(replacement.pattern, values[replacement.key]);
-  }
-
-  return rendered;
-}
-
-function createTraceTemplateValues(config: ObservMeConfig, traceId: string): TraceTemplateValues {
-  return {
-    traceId: encodeURIComponent(traceId),
-    tempoDatasourceUid: encodeURIComponent(config.query.grafana.datasourceUids.tempo),
-  };
-}
-
-function normalizeTraceId(traceId: string): string {
-  const trimmed = traceId.trim();
-  assertNoSensitiveQueryInput(trimmed, "Grafana traceId");
-
-  if (!traceIdPattern.test(trimmed) || zeroTraceIdPattern.test(trimmed)) {
-    throw new Error(
-      "Unsafe Grafana traceId: expected a non-zero 32-character hexadecimal OpenTelemetry trace id; raw prompts, commands, paths, and environment values are not query inputs.",
-    );
-  }
-
-  return trimmed.toLowerCase();
-}
-
-function hasTraceIdTemplatePlaceholder(template: string): boolean {
-  return traceIdTemplatePattern.test(template);
-}
-
-function isFallbackTraceTemplate(template: string): boolean {
-  return template === "" || fallbackTraceTemplateMarkerPattern.test(template);
-}
-
 function formatHealthFailure(error: unknown): string {
   return formatError(error);
 }

package/src/query/loki.ts

@@ -1,3 +1,4 @@
+import { normalizeQueryResultCount } from "../config/query-limits.ts";
 import type { ObservMeConfig } from "../config/schema.ts";
 import type { GrafanaFetch, GrafanaTransportClient } from "./grafana-transport.ts";
 import { createGrafanaTransport } from "./grafana-transport.ts";
@@ -27,7 +28,6 @@ interface NormalizedTimeRange {
   readonly to: Date;
 }
 
-const minimumMaxLogs = 1;
 const maxLogQlQueryLength = 4096;
 const safeLokiAttributeNamePattern = /^[A-Za-z_][A-Za-z0-9_.]*$/u;
 const lokiIdentifierStartPattern = /^[A-Za-z_]$/u;
@@ -326,7 +326,5 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 }
 
 function resolveMaxLogs(config: ObservMeConfig): number {
-  const maxLogs = config.query.maxLogs;
-  if (!Number.isFinite(maxLogs) || maxLogs < minimumMaxLogs) return minimumMaxLogs;
-  return Math.trunc(maxLogs);
+  return normalizeQueryResultCount(config.query.maxLogs);
 }

package/src/query/prometheus.ts

@@ -1,7 +1,9 @@
+import { normalizeQueryResultCount } from "../config/query-limits.ts";
 import type { ObservMeConfig } from "../config/schema.ts";
 import { LOG_ATTRIBUTES } from "../semconv/attributes.ts";
 import type { GrafanaFetch, GrafanaTransportClient } from "./grafana-transport.ts";
 import { createGrafanaTransport } from "./grafana-transport.ts";
+import { normalizeObsBackendLabel } from "../safety/display-bounds.ts";
 import { assertNoSensitiveQueryInput } from "../safety/sensitive-input.ts";
 import { assertGrafanaQueryReady } from "./grafana-readiness.ts";
 
@@ -77,7 +79,6 @@ const allForbiddenHighCardinalityPrometheusLabels = [
   ...forbiddenHighCardinalityPrometheusLabelAliases,
 ] as const;
 const minimumMaxMetricSeries = 1;
-const minimumMaxAgents = 1;
 const maxPromQlQueryLength = 4096;
 
 export class PrometheusQueryClient {
@@ -310,8 +311,9 @@ function readStringRecord(value: unknown): Record<string, string> {
   if (!isRecord(value)) return record;
 
   for (const [key, item] of Object.entries(value)) {
-    const text = readStringOrNumber(item);
-    if (text !== undefined) record[key] = text;
+    const normalizedKey = normalizeObsBackendLabel(key);
+    const normalizedValue = normalizeObsBackendLabel(readStringOrNumber(item));
+    if (normalizedKey && normalizedValue !== undefined) record[normalizedKey] = normalizedValue;
   }
 
   return record;
@@ -354,19 +356,15 @@ function normalizeExplicitResultLimit(limit: number): number {
     throw new Error("Prometheus result limit must be a positive finite number.");
   }
 
-  return Math.trunc(limit);
+  return normalizeQueryResultCount(limit);
 }
 
 function resolveMaxMetricSeries(config: ObservMeConfig): number {
-  const maxMetricSeries = config.query.maxMetricSeries;
-  if (!Number.isFinite(maxMetricSeries) || maxMetricSeries < minimumMaxMetricSeries) return minimumMaxMetricSeries;
-  return Math.trunc(maxMetricSeries);
+  return normalizeQueryResultCount(config.query.maxMetricSeries);
 }
 
 function resolveMaxAgents(config: ObservMeConfig): number {
-  const maxAgents = config.query.maxAgents;
-  if (!Number.isFinite(maxAgents) || maxAgents < minimumMaxAgents) return minimumMaxAgents;
-  return Math.trunc(maxAgents);
+  return normalizeQueryResultCount(config.query.maxAgents);
 }
 
 function formatPrometheusTimestamp(date: Date): string {

package/src/query/tempo.ts

@@ -1,3 +1,4 @@
+import { normalizeQueryResultCount } from "../config/query-limits.ts";
 import type { ObservMeConfig } from "../config/schema.ts";
 import type { GrafanaFetch, GrafanaTransportClient } from "./grafana-transport.ts";
 import { createGrafanaTransport } from "./grafana-transport.ts";
@@ -45,7 +46,6 @@ interface NormalizedTimeRange {
   readonly to: Date;
 }
 
-const minimumMaxTraces = 1;
 const maxTempoSearchAttributes = 8;
 const maxTempoSearchAttributeValueLength = 256;
 const safeTempoAttributeKeyPattern = /^[A-Za-z_][A-Za-z0-9_.-]*$/u;
@@ -326,7 +326,5 @@ function isRecord(value: unknown): value is Record<string, unknown> {
 }
 
 function resolveMaxTraces(config: ObservMeConfig): number {
-  const maxTraces = config.query.maxTraces;
-  if (!Number.isFinite(maxTraces) || maxTraces < minimumMaxTraces) return minimumMaxTraces;
-  return Math.trunc(maxTraces);
+  return normalizeQueryResultCount(config.query.maxTraces);
 }