@tungthedev/streams-server 0.2.0

package/src/profiles/otelTraces/otlp.ts

@@ -0,0 +1,1002 @@
+import { gunzipSync } from "node:zlib";
+import { Result } from "better-result";
+import type { OtlpTraceExportError, OtlpTraceExportResult } from "../profile";
+import {
+  DEFAULT_OTLP_LIMITS,
+  normalizeOtelDecodedSpanResult,
+  type DecodedOtelEvent,
+  type DecodedOtelLink,
+  type DecodedOtelSpan,
+  type OtelTraceOtlpLimits,
+  type OtelTracesStreamProfile,
+} from "./normalize";
+
+const JSON_TEXT_DECODER = new TextDecoder();
+const JSON_CONTENT_TYPE = "application/json";
+const PROTOBUF_CONTENT_TYPE = "application/x-protobuf";
+
+type ResourceSpansDecoded = {
+  resourceAttributes: Record<string, unknown>;
+  resourceSchemaUrl: string | null;
+  scopeSpans: ScopeSpansDecoded[];
+};
+
+type ScopeSpansDecoded = {
+  scope: {
+    name: string | null;
+    version: string | null;
+    schemaUrl: string | null;
+    attributes: Record<string, unknown>;
+  };
+  spans: Array<Omit<DecodedOtelSpan, "resourceAttributes" | "resourceSchemaUrl" | "instrumentationScope">>;
+};
+
+type DecodedExport = {
+  spans: DecodedOtelSpan[];
+  rejectedSpans: number;
+  warnings: string[];
+};
+
+function baseContentType(value: string): string {
+  return value.split(";")[0]?.trim().toLowerCase() ?? "";
+}
+
+function hexFromBytes(bytes: Uint8Array): string {
+  return Array.from(bytes)
+    .map((byte) => byte.toString(16).padStart(2, "0"))
+    .join("");
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return !!value && typeof value === "object" && !Array.isArray(value);
+}
+
+function normalizeString(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed === "" ? null : trimmed;
+}
+
+function normalizeNanoString(value: unknown): string | null {
+  if (value == null) return null;
+  if (typeof value === "bigint") return value >= 0n ? value.toString() : null;
+  if (typeof value === "number" && Number.isFinite(value) && Number.isInteger(value) && value >= 0) return BigInt(value).toString();
+  if (typeof value === "string") {
+    const trimmed = value.trim();
+    if (/^(0|[1-9][0-9]*)$/.test(trimmed)) return trimmed;
+  }
+  return null;
+}
+
+function appendWarning(warnings: string[], message: string): void {
+  if (warnings.includes(message)) return;
+  if (warnings.length < 8) warnings.push(message);
+}
+
+function checkAnyValueDepthResult(depth: number, limits: OtelTraceOtlpLimits): Result<void, { message: string }> {
+  if (depth > limits.maxAnyValueDepth) {
+    return Result.err({ message: `OTLP AnyValue nesting too deep (max ${limits.maxAnyValueDepth})` });
+  }
+  return Result.ok(undefined);
+}
+
+function anyValueFromJsonResult(raw: unknown, limits: OtelTraceOtlpLimits, depth = 0): Result<unknown, { message: string }> {
+  const depthRes = checkAnyValueDepthResult(depth, limits);
+  if (Result.isError(depthRes)) return depthRes;
+  if (!isPlainObject(raw)) return Result.ok(structuredClone(raw));
+  if (Object.prototype.hasOwnProperty.call(raw, "stringValue")) return Result.ok(normalizeString(raw.stringValue) ?? "");
+  if (Object.prototype.hasOwnProperty.call(raw, "boolValue")) return Result.ok(raw.boolValue === true);
+  if (Object.prototype.hasOwnProperty.call(raw, "intValue")) {
+    const value = raw.intValue;
+    if (typeof value === "string" && /^-?(0|[1-9][0-9]*)$/.test(value.trim())) return Result.ok(value.trim());
+    if (typeof value === "number" && Number.isFinite(value)) return Result.ok(Math.trunc(value));
+    return Result.ok(null);
+  }
+  if (Object.prototype.hasOwnProperty.call(raw, "doubleValue")) {
+    return Result.ok(typeof raw.doubleValue === "number" ? raw.doubleValue : Number(raw.doubleValue));
+  }
+  if (Object.prototype.hasOwnProperty.call(raw, "bytesValue")) return Result.ok(normalizeString(raw.bytesValue) ?? "");
+  if (isPlainObject(raw.arrayValue) && Array.isArray(raw.arrayValue.values)) {
+    if (raw.arrayValue.values.length > limits.maxArrayValuesPerAnyValue) {
+      return Result.err({ message: `OTLP AnyValue array too large (max ${limits.maxArrayValuesPerAnyValue})` });
+    }
+    const out: unknown[] = [];
+    for (const item of raw.arrayValue.values) {
+      const valueRes = anyValueFromJsonResult(item, limits, depth + 1);
+      if (Result.isError(valueRes)) return valueRes;
+      out.push(valueRes.value);
+    }
+    return Result.ok(out);
+  }
+  if (isPlainObject(raw.kvlistValue) && Array.isArray(raw.kvlistValue.values)) {
+    return keyValuesFromJsonResult(raw.kvlistValue.values, limits, depth + 1, true);
+  }
+  return Result.ok(structuredClone(raw));
+}
+
+function keyValuesFromJsonResult(
+  raw: unknown,
+  limits: OtelTraceOtlpLimits,
+  depth: number,
+  enforceCollectionLimit: boolean
+): Result<Record<string, unknown>, { message: string }> {
+  const depthRes = checkAnyValueDepthResult(depth, limits);
+  if (Result.isError(depthRes)) return depthRes;
+  const out: Record<string, unknown> = {};
+  if (!Array.isArray(raw)) return Result.ok(out);
+  if (enforceCollectionLimit && raw.length > limits.maxKvListValuesPerAnyValue) {
+    return Result.err({ message: `OTLP AnyValue kvlist too large (max ${limits.maxKvListValuesPerAnyValue})` });
+  }
+  for (const item of raw) {
+    if (!isPlainObject(item)) continue;
+    const key = normalizeString(item.key);
+    if (!key) continue;
+    const valueRes = anyValueFromJsonResult(item.value, limits, depth);
+    if (Result.isError(valueRes)) return valueRes;
+    out[key] = valueRes.value;
+  }
+  return Result.ok(out);
+}
+
+function eventFromJsonResult(raw: unknown, limits: OtelTraceOtlpLimits): Result<DecodedOtelEvent | null, { message: string }> {
+  if (!isPlainObject(raw)) return Result.ok(null);
+  const attrsRes = keyValuesFromJsonResult(raw.attributes, limits, 0, false);
+  if (Result.isError(attrsRes)) return attrsRes;
+  return Result.ok({
+    timeUnixNano: normalizeNanoString(raw.timeUnixNano),
+    name: normalizeString(raw.name) ?? "",
+    attributes: attrsRes.value,
+    droppedAttributesCount: typeof raw.droppedAttributesCount === "number" ? raw.droppedAttributesCount : Number(raw.droppedAttributesCount ?? 0),
+  });
+}
+
+function linkFromJsonResult(raw: unknown, limits: OtelTraceOtlpLimits): Result<DecodedOtelLink | null, { message: string }> {
+  if (!isPlainObject(raw)) return Result.ok(null);
+  const traceId = normalizeString(raw.traceId);
+  const spanId = normalizeString(raw.spanId);
+  if (!traceId || !spanId) return Result.ok(null);
+  const attrsRes = keyValuesFromJsonResult(raw.attributes, limits, 0, false);
+  if (Result.isError(attrsRes)) return attrsRes;
+  return Result.ok({
+    traceId,
+    spanId,
+    traceState: normalizeString(raw.traceState),
+    attributes: attrsRes.value,
+    droppedAttributesCount: typeof raw.droppedAttributesCount === "number" ? raw.droppedAttributesCount : Number(raw.droppedAttributesCount ?? 0),
+  });
+}
+
+function spanFromJsonResult(
+  raw: unknown,
+  limits: OtelTraceOtlpLimits
+): Result<Omit<DecodedOtelSpan, "resourceAttributes" | "resourceSchemaUrl" | "instrumentationScope"> | null, { message: string }> {
+  if (!isPlainObject(raw)) return Result.ok(null);
+  const traceId = normalizeString(raw.traceId);
+  const spanId = normalizeString(raw.spanId);
+  if (!traceId || !spanId) return Result.ok(null);
+  const status = isPlainObject(raw.status) ? raw.status : {};
+  const attrsRes = keyValuesFromJsonResult(raw.attributes, limits, 0, false);
+  if (Result.isError(attrsRes)) return attrsRes;
+  const events: DecodedOtelEvent[] = [];
+  if (Array.isArray(raw.events)) {
+    for (const eventRaw of raw.events) {
+      const eventRes = eventFromJsonResult(eventRaw, limits);
+      if (Result.isError(eventRes)) return eventRes;
+      if (eventRes.value) events.push(eventRes.value);
+    }
+  }
+  const links: DecodedOtelLink[] = [];
+  if (Array.isArray(raw.links)) {
+    for (const linkRaw of raw.links) {
+      const linkRes = linkFromJsonResult(linkRaw, limits);
+      if (Result.isError(linkRes)) return linkRes;
+      if (linkRes.value) links.push(linkRes.value);
+    }
+  }
+  return Result.ok({
+    traceId,
+    spanId,
+    parentSpanId: normalizeString(raw.parentSpanId),
+    traceState: normalizeString(raw.traceState),
+    traceFlags: typeof raw.flags === "number" ? raw.flags : Number(raw.flags ?? raw.traceFlags ?? 0),
+    name: normalizeString(raw.name) ?? "",
+    kind: raw.kind as number | string | null | undefined,
+    startUnixNano: normalizeNanoString(raw.startTimeUnixNano),
+    endUnixNano: normalizeNanoString(raw.endTimeUnixNano),
+    status: {
+      code: status.code as number | string | null | undefined,
+      message: normalizeString(status.message),
+    },
+    attributes: attrsRes.value,
+    events,
+    links,
+    droppedAttributesCount: typeof raw.droppedAttributesCount === "number" ? raw.droppedAttributesCount : Number(raw.droppedAttributesCount ?? 0),
+    droppedEventsCount: typeof raw.droppedEventsCount === "number" ? raw.droppedEventsCount : Number(raw.droppedEventsCount ?? 0),
+    droppedLinksCount: typeof raw.droppedLinksCount === "number" ? raw.droppedLinksCount : Number(raw.droppedLinksCount ?? 0),
+  });
+}
+
+type OtlpDecodeCounters = {
+  resourceSpans: number;
+  scopeSpans: number;
+  spans: number;
+  rejectedSpans: number;
+  warnings: string[];
+};
+
+function incrementLimitCounter(
+  counters: OtlpDecodeCounters,
+  key: "resourceSpans" | "scopeSpans",
+  max: number,
+  label: string
+): Result<void, { message: string }> {
+  counters[key] += 1;
+  if (counters[key] > max) return Result.err({ message: `too many ${label} in OTLP request (max ${max})` });
+  return Result.ok(undefined);
+}
+
+function acceptSpanForDecode(counters: OtlpDecodeCounters, limits: OtelTraceOtlpLimits): boolean {
+  counters.spans += 1;
+  if (counters.spans <= limits.maxSpansPerRequest) return true;
+  counters.rejectedSpans += 1;
+  appendWarning(counters.warnings, `too many spans in OTLP request (max ${limits.maxSpansPerRequest})`);
+  return false;
+}
+
+function decodeJsonExportResult(body: Uint8Array, limits: OtelTraceOtlpLimits): Result<DecodedExport, { message: string }> {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(JSON_TEXT_DECODER.decode(body));
+  } catch {
+    return Result.err({ message: "invalid OTLP JSON" });
+  }
+  if (!isPlainObject(parsed)) return Result.err({ message: "OTLP JSON request must be an object" });
+  const out: DecodedOtelSpan[] = [];
+  const counters: OtlpDecodeCounters = { resourceSpans: 0, scopeSpans: 0, spans: 0, rejectedSpans: 0, warnings: [] };
+  const resourceSpans = Array.isArray(parsed.resourceSpans) ? parsed.resourceSpans : [];
+  for (const resourceSpanRaw of resourceSpans) {
+    const resourceLimitRes = incrementLimitCounter(counters, "resourceSpans", limits.maxResourceSpansPerRequest, "resourceSpans");
+    if (Result.isError(resourceLimitRes)) return resourceLimitRes;
+    if (!isPlainObject(resourceSpanRaw)) continue;
+    const resource = isPlainObject(resourceSpanRaw.resource) ? resourceSpanRaw.resource : {};
+    const resourceAttributesRes = keyValuesFromJsonResult(resource.attributes, limits, 0, false);
+    if (Result.isError(resourceAttributesRes)) return resourceAttributesRes;
+    const resourceAttributes = resourceAttributesRes.value;
+    const resourceSchemaUrl = normalizeString(resourceSpanRaw.schemaUrl);
+    const scopeSpans = [
+      ...(Array.isArray(resourceSpanRaw.scopeSpans) ? resourceSpanRaw.scopeSpans : []),
+      ...(Array.isArray(resourceSpanRaw.instrumentationLibrarySpans) ? resourceSpanRaw.instrumentationLibrarySpans : []),
+    ];
+    for (const scopeSpanRaw of scopeSpans) {
+      const scopeLimitRes = incrementLimitCounter(counters, "scopeSpans", limits.maxScopeSpansPerRequest, "scopeSpans");
+      if (Result.isError(scopeLimitRes)) return scopeLimitRes;
+      if (!isPlainObject(scopeSpanRaw)) continue;
+      const scopeRaw = isPlainObject(scopeSpanRaw.scope) ? scopeSpanRaw.scope : isPlainObject(scopeSpanRaw.instrumentationLibrary) ? scopeSpanRaw.instrumentationLibrary : {};
+      const scopeAttrsRes = keyValuesFromJsonResult(scopeRaw.attributes, limits, 0, false);
+      if (Result.isError(scopeAttrsRes)) return scopeAttrsRes;
+      const scope = {
+        name: normalizeString(scopeRaw.name),
+        version: normalizeString(scopeRaw.version),
+        schemaUrl: normalizeString(scopeSpanRaw.schemaUrl),
+        attributes: scopeAttrsRes.value,
+      };
+      const spans = Array.isArray(scopeSpanRaw.spans) ? scopeSpanRaw.spans : [];
+      for (const spanRaw of spans) {
+        if (!acceptSpanForDecode(counters, limits)) continue;
+        const spanRes = spanFromJsonResult(spanRaw, limits);
+        if (Result.isError(spanRes)) return spanRes;
+        const span = spanRes.value;
+        if (!span) continue;
+        out.push({
+          ...span,
+          resourceAttributes,
+          resourceSchemaUrl,
+          instrumentationScope: scope,
+        });
+      }
+    }
+  }
+  return Result.ok({ spans: out, rejectedSpans: counters.rejectedSpans, warnings: counters.warnings });
+}
+
+class ProtoReader {
+  private pos = 0;
+
+  constructor(private readonly bytes: Uint8Array) {}
+
+  eof(): boolean {
+    return this.pos >= this.bytes.byteLength;
+  }
+
+  readTag(): Result<{ field: number; wire: number }, { message: string }> {
+    const tagRes = this.readVarint();
+    if (Result.isError(tagRes)) return tagRes;
+    const tag = Number(tagRes.value);
+    if (tag === 0) return Result.err({ message: "invalid protobuf tag" });
+    return Result.ok({ field: tag >>> 3, wire: tag & 7 });
+  }
+
+  readVarint(): Result<bigint, { message: string }> {
+    let shift = 0n;
+    let out = 0n;
+    while (shift <= 63n) {
+      if (this.pos >= this.bytes.byteLength) return Result.err({ message: "truncated protobuf varint" });
+      const byte = this.bytes[this.pos++]!;
+      out |= BigInt(byte & 0x7f) << shift;
+      if ((byte & 0x80) === 0) return Result.ok(out);
+      shift += 7n;
+    }
+    return Result.err({ message: "protobuf varint too long" });
+  }
+
+  readFixed32(): Result<number, { message: string }> {
+    if (this.pos + 4 > this.bytes.byteLength) return Result.err({ message: "truncated protobuf fixed32" });
+    const view = new DataView(this.bytes.buffer, this.bytes.byteOffset + this.pos, 4);
+    this.pos += 4;
+    return Result.ok(view.getUint32(0, true));
+  }
+
+  readFixed64(): Result<bigint, { message: string }> {
+    if (this.pos + 8 > this.bytes.byteLength) return Result.err({ message: "truncated protobuf fixed64" });
+    const view = new DataView(this.bytes.buffer, this.bytes.byteOffset + this.pos, 8);
+    this.pos += 8;
+    return Result.ok(view.getBigUint64(0, true));
+  }
+
+  readDouble(): Result<number, { message: string }> {
+    if (this.pos + 8 > this.bytes.byteLength) return Result.err({ message: "truncated protobuf double" });
+    const view = new DataView(this.bytes.buffer, this.bytes.byteOffset + this.pos, 8);
+    this.pos += 8;
+    return Result.ok(view.getFloat64(0, true));
+  }
+
+  readBytes(): Result<Uint8Array, { message: string }> {
+    const lenRes = this.readVarint();
+    if (Result.isError(lenRes)) return lenRes;
+    const len = Number(lenRes.value);
+    if (!Number.isSafeInteger(len) || len < 0 || this.pos + len > this.bytes.byteLength) {
+      return Result.err({ message: "truncated protobuf bytes" });
+    }
+    const out = this.bytes.slice(this.pos, this.pos + len);
+    this.pos += len;
+    return Result.ok(out);
+  }
+
+  readString(): Result<string, { message: string }> {
+    const bytesRes = this.readBytes();
+    if (Result.isError(bytesRes)) return bytesRes;
+    return Result.ok(JSON_TEXT_DECODER.decode(bytesRes.value));
+  }
+
+  skip(wire: number): Result<void, { message: string }> {
+    if (wire === 0) {
+      const res = this.readVarint();
+      return Result.isError(res) ? res : Result.ok(undefined);
+    }
+    if (wire === 1) {
+      const res = this.readFixed64();
+      return Result.isError(res) ? res : Result.ok(undefined);
+    }
+    if (wire === 2) {
+      const res = this.readBytes();
+      return Result.isError(res) ? res : Result.ok(undefined);
+    }
+    if (wire === 5) {
+      const res = this.readFixed32();
+      return Result.isError(res) ? res : Result.ok(undefined);
+    }
+    return Result.err({ message: `unsupported protobuf wire type ${wire}` });
+  }
+}
+
+function signedInt64(value: bigint): string {
+  return value > 9_223_372_036_854_775_807n ? (value - 18_446_744_073_709_551_616n).toString() : value.toString();
+}
+
+function decodeAnyValue(bytes: Uint8Array, limits: OtelTraceOtlpLimits, depth = 0): Result<unknown, { message: string }> {
+  const depthRes = checkAnyValueDepthResult(depth, limits);
+  if (Result.isError(depthRes)) return depthRes;
+  const reader = new ProtoReader(bytes);
+  let value: unknown = null;
+  while (!reader.eof()) {
+    const tagRes = reader.readTag();
+    if (Result.isError(tagRes)) return tagRes;
+    const { field, wire } = tagRes.value;
+    if (field === 1 && wire === 2) {
+      const res = reader.readString();
+      if (Result.isError(res)) return res;
+      value = res.value;
+    } else if (field === 2 && wire === 0) {
+      const res = reader.readVarint();
+      if (Result.isError(res)) return res;
+      value = res.value !== 0n;
+    } else if (field === 3 && wire === 0) {
+      const res = reader.readVarint();
+      if (Result.isError(res)) return res;
+      value = signedInt64(res.value);
+    } else if (field === 4 && wire === 1) {
+      const res = reader.readDouble();
+      if (Result.isError(res)) return res;
+      value = res.value;
+    } else if (field === 5 && wire === 2) {
+      const bytesRes = reader.readBytes();
+      if (Result.isError(bytesRes)) return bytesRes;
+      const arrayRes = decodeArrayValue(bytesRes.value, limits, depth + 1);
+      if (Result.isError(arrayRes)) return arrayRes;
+      value = arrayRes.value;
+    } else if (field === 6 && wire === 2) {
+      const bytesRes = reader.readBytes();
+      if (Result.isError(bytesRes)) return bytesRes;
+      const kvRes = decodeKeyValueList(bytesRes.value, limits, depth + 1, true);
+      if (Result.isError(kvRes)) return kvRes;
+      value = kvRes.value;
+    } else if (field === 7 && wire === 2) {
+      const bytesRes = reader.readBytes();
+      if (Result.isError(bytesRes)) return bytesRes;
+      value = Buffer.from(bytesRes.value).toString("base64");
+    } else {
+      const skipRes = reader.skip(wire);
+      if (Result.isError(skipRes)) return skipRes;
+    }
+  }
+  return Result.ok(value);
+}
+
+function decodeArrayValue(bytes: Uint8Array, limits: OtelTraceOtlpLimits, depth: number): Result<unknown[], { message: string }> {
+  const depthRes = checkAnyValueDepthResult(depth, limits);
+  if (Result.isError(depthRes)) return depthRes;
+  const reader = new ProtoReader(bytes);
+  const out: unknown[] = [];
+  while (!reader.eof()) {
+    const tagRes = reader.readTag();
+    if (Result.isError(tagRes)) return tagRes;
+    if (tagRes.value.field === 1 && tagRes.value.wire === 2) {
+      if (out.length >= limits.maxArrayValuesPerAnyValue) {
+        return Result.err({ message: `OTLP AnyValue array too large (max ${limits.maxArrayValuesPerAnyValue})` });
+      }
+      const bytesRes = reader.readBytes();
+      if (Result.isError(bytesRes)) return bytesRes;
+      const valueRes = decodeAnyValue(bytesRes.value, limits, depth);
+      if (Result.isError(valueRes)) return valueRes;
+      out.push(valueRes.value);
+    } else {
+      const skipRes = reader.skip(tagRes.value.wire);
+      if (Result.isError(skipRes)) return skipRes;
+    }
+  }
+  return Result.ok(out);
+}
+
+function decodeKeyValue(bytes: Uint8Array, limits: OtelTraceOtlpLimits, depth: number): Result<{ key: string; value: unknown } | null, { message: string }> {
+  const reader = new ProtoReader(bytes);
+  let key = "";
+  let value: unknown = null;
+  while (!reader.eof()) {
+    const tagRes = reader.readTag();
+    if (Result.isError(tagRes)) return tagRes;
+    const { field, wire } = tagRes.value;
+    if (field === 1 && wire === 2) {
+      const keyRes = reader.readString();
+      if (Result.isError(keyRes)) return keyRes;
+      key = keyRes.value;
+    } else if (field === 2 && wire === 2) {
+      const bytesRes = reader.readBytes();
+      if (Result.isError(bytesRes)) return bytesRes;
+      const valueRes = decodeAnyValue(bytesRes.value, limits, depth);
+      if (Result.isError(valueRes)) return valueRes;
+      value = valueRes.value;
+    } else {
+      const skipRes = reader.skip(wire);
+      if (Result.isError(skipRes)) return skipRes;
+    }
+  }
+  return Result.ok(key === "" ? null : { key, value });
+}
+
+function decodeKeyValueList(
+  bytes: Uint8Array,
+  limits: OtelTraceOtlpLimits,
+  depth: number,
+  enforceCollectionLimit: boolean
+): Result<Record<string, unknown>, { message: string }> {
+  const depthRes = checkAnyValueDepthResult(depth, limits);
+  if (Result.isError(depthRes)) return depthRes;
+  const reader = new ProtoReader(bytes);
+  const out: Record<string, unknown> = {};
+  let count = 0;
+  while (!reader.eof()) {
+    const tagRes = reader.readTag();
+    if (Result.isError(tagRes)) return tagRes;
+    if (tagRes.value.field === 1 && tagRes.value.wire === 2) {
+      count += 1;
+      if (enforceCollectionLimit && count > limits.maxKvListValuesPerAnyValue) {
+        return Result.err({ message: `OTLP AnyValue kvlist too large (max ${limits.maxKvListValuesPerAnyValue})` });
+      }
+      const bytesRes = reader.readBytes();
+      if (Result.isError(bytesRes)) return bytesRes;
+      const kvRes = decodeKeyValue(bytesRes.value, limits, depth);
+      if (Result.isError(kvRes)) return kvRes;
+      if (kvRes.value) out[kvRes.value.key] = kvRes.value.value;
+    } else {
+      const skipRes = reader.skip(tagRes.value.wire);
+      if (Result.isError(skipRes)) return skipRes;
+    }
+  }
+  return Result.ok(out);
+}
+
+function decodeResource(bytes: Uint8Array, limits: OtelTraceOtlpLimits): Result<Record<string, unknown>, { message: string }> {
+  return decodeKeyValueList(bytes, limits, 0, false);
+}
+
+function decodeScope(bytes: Uint8Array, limits: OtelTraceOtlpLimits): Result<ScopeSpansDecoded["scope"], { message: string }> {
+  const reader = new ProtoReader(bytes);
+  const scope: ScopeSpansDecoded["scope"] = { name: null, version: null, schemaUrl: null, attributes: {} };
+  while (!reader.eof()) {
+    const tagRes = reader.readTag();
+    if (Result.isError(tagRes)) return tagRes;
+    const { field, wire } = tagRes.value;
+    if (field === 1 && wire === 2) {
+      const res = reader.readString();
+      if (Result.isError(res)) return res;
+      scope.name = res.value;
+    } else if (field === 2 && wire === 2) {
+      const res = reader.readString();
+      if (Result.isError(res)) return res;
+      scope.version = res.value;
+    } else if (field === 3 && wire === 2) {
+      const bytesRes = reader.readBytes();
+      if (Result.isError(bytesRes)) return bytesRes;
+      const kvRes = decodeKeyValue(bytesRes.value, limits, 0);
+      if (Result.isError(kvRes)) return kvRes;
+      if (kvRes.value) scope.attributes[kvRes.value.key] = kvRes.value.value;
+    } else {
+      const skipRes = reader.skip(wire);
+      if (Result.isError(skipRes)) return skipRes;
+    }
+  }
+  return Result.ok(scope);
+}
+
+function decodeStatus(bytes: Uint8Array): Result<{ code?: number; message?: string | null }, { message: string }> {
+  const reader = new ProtoReader(bytes);
+  const status: { code?: number; message?: string | null } = {};
+  while (!reader.eof()) {
+    const tagRes = reader.readTag();
+    if (Result.isError(tagRes)) return tagRes;
+    const { field, wire } = tagRes.value;
+    if ((field === 1 || field === 3) && wire === 0) {
+      const res = reader.readVarint();
+      if (Result.isError(res)) return res;
+      status.code = Number(res.value);
+    } else if (field === 2 && wire === 2) {
+      const res = reader.readString();
+      if (Result.isError(res)) return res;
+      status.message = res.value;
+    } else {
+      const skipRes = reader.skip(wire);
+      if (Result.isError(skipRes)) return skipRes;
+    }
+  }
+  return Result.ok(status);
+}
+
+function decodeEvent(bytes: Uint8Array, limits: OtelTraceOtlpLimits): Result<DecodedOtelEvent, { message: string }> {
+  const reader = new ProtoReader(bytes);
+  const event: DecodedOtelEvent = { timeUnixNano: null, name: "", attributes: {}, droppedAttributesCount: 0 };
+  while (!reader.eof()) {
+    const tagRes = reader.readTag();
+    if (Result.isError(tagRes)) return tagRes;
+    const { field, wire } = tagRes.value;
+    if (field === 1 && (wire === 1 || wire === 0)) {
+      const res = wire === 1 ? reader.readFixed64() : reader.readVarint();
+      if (Result.isError(res)) return res;
+      event.timeUnixNano = res.value.toString();
+    } else if (field === 2 && wire === 2) {
+      const res = reader.readString();
+      if (Result.isError(res)) return res;
+      event.name = res.value;
+    } else if (field === 3 && wire === 2) {
+      const bytesRes = reader.readBytes();
+      if (Result.isError(bytesRes)) return bytesRes;
+      const kvRes = decodeKeyValue(bytesRes.value, limits, 0);
+      if (Result.isError(kvRes)) return kvRes;
+      if (kvRes.value) event.attributes[kvRes.value.key] = kvRes.value.value;
+    } else if (field === 4 && wire === 0) {
+      const res = reader.readVarint();
+      if (Result.isError(res)) return res;
+      event.droppedAttributesCount = Number(res.value);
+    } else {
+      const skipRes = reader.skip(wire);
+      if (Result.isError(skipRes)) return skipRes;
+    }
+  }
+  return Result.ok(event);
+}
+
+function decodeLink(bytes: Uint8Array, limits: OtelTraceOtlpLimits): Result<DecodedOtelLink, { message: string }> {
+  const reader = new ProtoReader(bytes);
+  const link: DecodedOtelLink = { traceId: "", spanId: "", traceState: null, attributes: {}, droppedAttributesCount: 0 };
+  while (!reader.eof()) {
+    const tagRes = reader.readTag();
+    if (Result.isError(tagRes)) return tagRes;
+    const { field, wire } = tagRes.value;
+    if (field === 1 && wire === 2) {
+      const res = reader.readBytes();
+      if (Result.isError(res)) return res;
+      link.traceId = hexFromBytes(res.value);
+    } else if (field === 2 && wire === 2) {
+      const res = reader.readBytes();
+      if (Result.isError(res)) return res;
+      link.spanId = hexFromBytes(res.value);
+    } else if (field === 3 && wire === 2) {
+      const res = reader.readString();
+      if (Result.isError(res)) return res;
+      link.traceState = res.value;
+    } else if (field === 4 && wire === 2) {
+      const bytesRes = reader.readBytes();
+      if (Result.isError(bytesRes)) return bytesRes;
+      const kvRes = decodeKeyValue(bytesRes.value, limits, 0);
+      if (Result.isError(kvRes)) return kvRes;
+      if (kvRes.value) link.attributes[kvRes.value.key] = kvRes.value.value;
+    } else if (field === 5 && wire === 0) {
+      const res = reader.readVarint();
+      if (Result.isError(res)) return res;
+      link.droppedAttributesCount = Number(res.value);
+    } else {
+      const skipRes = reader.skip(wire);
+      if (Result.isError(skipRes)) return skipRes;
+    }
+  }
+  return Result.ok(link);
+}
+
+function decodeSpan(
+  bytes: Uint8Array,
+  limits: OtelTraceOtlpLimits
+): Result<Omit<DecodedOtelSpan, "resourceAttributes" | "resourceSchemaUrl" | "instrumentationScope">, { message: string }> {
+  const reader = new ProtoReader(bytes);
+  const span: Omit<DecodedOtelSpan, "resourceAttributes" | "resourceSchemaUrl" | "instrumentationScope"> = {
+    traceId: "",
+    spanId: "",
+    parentSpanId: null,
+    traceState: null,
+    traceFlags: null,
+    name: "",
+    kind: 0,
+    startUnixNano: null,
+    endUnixNano: null,
+    status: { code: 0, message: null },
+    attributes: {},
+    events: [],
+    links: [],
+    droppedAttributesCount: 0,
+    droppedEventsCount: 0,
+    droppedLinksCount: 0,
+  };
+  while (!reader.eof()) {
+    const tagRes = reader.readTag();
+    if (Result.isError(tagRes)) return tagRes;
+    const { field, wire } = tagRes.value;
+    if (field === 1 && wire === 2) {
+      const res = reader.readBytes();
+      if (Result.isError(res)) return res;
+      span.traceId = hexFromBytes(res.value);
+    } else if (field === 2 && wire === 2) {
+      const res = reader.readBytes();
+      if (Result.isError(res)) return res;
+      span.spanId = hexFromBytes(res.value);
+    } else if (field === 3 && wire === 2) {
+      const res = reader.readString();
+      if (Result.isError(res)) return res;
+      span.traceState = res.value;
+    } else if (field === 4 && wire === 2) {
+      const res = reader.readBytes();
+      if (Result.isError(res)) return res;
+      span.parentSpanId = res.value.byteLength === 0 ? null : hexFromBytes(res.value);
+    } else if (field === 5 && wire === 2) {
+      const res = reader.readString();
+      if (Result.isError(res)) return res;
+      span.name = res.value;
+    } else if (field === 6 && wire === 0) {
+      const res = reader.readVarint();
+      if (Result.isError(res)) return res;
+      span.kind = Number(res.value);
+    } else if ((field === 7 || field === 8) && (wire === 1 || wire === 0)) {
+      const res = wire === 1 ? reader.readFixed64() : reader.readVarint();
+      if (Result.isError(res)) return res;
+      if (field === 7) span.startUnixNano = res.value.toString();
+      else span.endUnixNano = res.value.toString();
+    } else if (field === 9 && wire === 2) {
+      const bytesRes = reader.readBytes();
+      if (Result.isError(bytesRes)) return bytesRes;
+      const kvRes = decodeKeyValue(bytesRes.value, limits, 0);
+      if (Result.isError(kvRes)) return kvRes;
+      if (kvRes.value) span.attributes[kvRes.value.key] = kvRes.value.value;
+    } else if (field === 10 && wire === 0) {
+      const res = reader.readVarint();
+      if (Result.isError(res)) return res;
+      span.droppedAttributesCount = Number(res.value);
+    } else if (field === 11 && wire === 2) {
+      const bytesRes = reader.readBytes();
+      if (Result.isError(bytesRes)) return bytesRes;
+      const eventRes = decodeEvent(bytesRes.value, limits);
+      if (Result.isError(eventRes)) return eventRes;
+      span.events.push(eventRes.value);
+    } else if (field === 12 && wire === 0) {
+      const res = reader.readVarint();
+      if (Result.isError(res)) return res;
+      span.droppedEventsCount = Number(res.value);
+    } else if (field === 13 && wire === 2) {
+      const bytesRes = reader.readBytes();
+      if (Result.isError(bytesRes)) return bytesRes;
+      const linkRes = decodeLink(bytesRes.value, limits);
+      if (Result.isError(linkRes)) return linkRes;
+      span.links.push(linkRes.value);
+    } else if (field === 14 && wire === 0) {
+      const res = reader.readVarint();
+      if (Result.isError(res)) return res;
+      span.droppedLinksCount = Number(res.value);
+    } else if (field === 15 && wire === 2) {
+      const bytesRes = reader.readBytes();
+      if (Result.isError(bytesRes)) return bytesRes;
+      const statusRes = decodeStatus(bytesRes.value);
+      if (Result.isError(statusRes)) return statusRes;
+      span.status = statusRes.value;
+    } else if (field === 16 && (wire === 5 || wire === 0)) {
+      if (wire === 5) {
+        const res = reader.readFixed32();
+        if (Result.isError(res)) return res;
+        span.traceFlags = res.value;
+      } else {
+        const res = reader.readVarint();
+        if (Result.isError(res)) return res;
+        span.traceFlags = Number(res.value);
+      }
+    } else {
+      const skipRes = reader.skip(wire);
+      if (Result.isError(skipRes)) return skipRes;
+    }
+  }
+  return Result.ok(span);
+}
+
+function decodeScopeSpans(bytes: Uint8Array, limits: OtelTraceOtlpLimits, counters: OtlpDecodeCounters): Result<ScopeSpansDecoded, { message: string }> {
+  const reader = new ProtoReader(bytes);
+  const out: ScopeSpansDecoded = {
+    scope: { name: null, version: null, schemaUrl: null, attributes: {} },
+    spans: [],
+  };
+  while (!reader.eof()) {
+    const tagRes = reader.readTag();
+    if (Result.isError(tagRes)) return tagRes;
+    const { field, wire } = tagRes.value;
+    if ((field === 1 || field === 1000) && wire === 2) {
+      const bytesRes = reader.readBytes();
+      if (Result.isError(bytesRes)) return bytesRes;
+      const scopeRes = decodeScope(bytesRes.value, limits);
+      if (Result.isError(scopeRes)) return scopeRes;
+      out.scope = { ...out.scope, ...scopeRes.value };
+    } else if (field === 2 && wire === 2) {
+      const bytesRes = reader.readBytes();
+      if (Result.isError(bytesRes)) return bytesRes;
+      if (!acceptSpanForDecode(counters, limits)) continue;
+      const spanRes = decodeSpan(bytesRes.value, limits);
+      if (Result.isError(spanRes)) return spanRes;
+      out.spans.push(spanRes.value);
+    } else if (field === 3 && wire === 2) {
+      const res = reader.readString();
+      if (Result.isError(res)) return res;
+      out.scope.schemaUrl = res.value;
+    } else {
+      const skipRes = reader.skip(wire);
+      if (Result.isError(skipRes)) return skipRes;
+    }
+  }
+  return Result.ok(out);
+}
+
+function decodeResourceSpans(bytes: Uint8Array, limits: OtelTraceOtlpLimits, counters: OtlpDecodeCounters): Result<ResourceSpansDecoded, { message: string }> {
+  const reader = new ProtoReader(bytes);
+  const out: ResourceSpansDecoded = { resourceAttributes: {}, resourceSchemaUrl: null, scopeSpans: [] };
+  while (!reader.eof()) {
+    const tagRes = reader.readTag();
+    if (Result.isError(tagRes)) return tagRes;
+    const { field, wire } = tagRes.value;
+    if (field === 1 && wire === 2) {
+      const bytesRes = reader.readBytes();
+      if (Result.isError(bytesRes)) return bytesRes;
+      const resourceRes = decodeResource(bytesRes.value, limits);
+      if (Result.isError(resourceRes)) return resourceRes;
+      out.resourceAttributes = resourceRes.value;
+    } else if ((field === 2 || field === 1000) && wire === 2) {
+      const scopeLimitRes = incrementLimitCounter(counters, "scopeSpans", limits.maxScopeSpansPerRequest, "scopeSpans");
+      if (Result.isError(scopeLimitRes)) return scopeLimitRes;
+      const bytesRes = reader.readBytes();
+      if (Result.isError(bytesRes)) return bytesRes;
+      const scopeRes = decodeScopeSpans(bytesRes.value, limits, counters);
+      if (Result.isError(scopeRes)) return scopeRes;
+      out.scopeSpans.push(scopeRes.value);
+    } else if (field === 3 && wire === 2) {
+      const res = reader.readString();
+      if (Result.isError(res)) return res;
+      out.resourceSchemaUrl = res.value;
+    } else {
+      const skipRes = reader.skip(wire);
+      if (Result.isError(skipRes)) return skipRes;
+    }
+  }
+  return Result.ok(out);
+}
+
+function decodeProtobufExportResult(body: Uint8Array, limits: OtelTraceOtlpLimits): Result<DecodedExport, { message: string }> {
+  const reader = new ProtoReader(body);
+  const out: DecodedOtelSpan[] = [];
+  const counters: OtlpDecodeCounters = { resourceSpans: 0, scopeSpans: 0, spans: 0, rejectedSpans: 0, warnings: [] };
+  while (!reader.eof()) {
+    const tagRes = reader.readTag();
+    if (Result.isError(tagRes)) return tagRes;
+    if (tagRes.value.field === 1 && tagRes.value.wire === 2) {
+      const resourceLimitRes = incrementLimitCounter(counters, "resourceSpans", limits.maxResourceSpansPerRequest, "resourceSpans");
+      if (Result.isError(resourceLimitRes)) return resourceLimitRes;
+      const bytesRes = reader.readBytes();
+      if (Result.isError(bytesRes)) return bytesRes;
+      const resourceSpansRes = decodeResourceSpans(bytesRes.value, limits, counters);
+      if (Result.isError(resourceSpansRes)) return resourceSpansRes;
+      for (const scopeSpans of resourceSpansRes.value.scopeSpans) {
+        for (const span of scopeSpans.spans) {
+          out.push({
+            ...span,
+            resourceAttributes: resourceSpansRes.value.resourceAttributes,
+            resourceSchemaUrl: resourceSpansRes.value.resourceSchemaUrl,
+            instrumentationScope: scopeSpans.scope,
+          });
+        }
+      }
+    } else {
+      const skipRes = reader.skip(tagRes.value.wire);
+      if (Result.isError(skipRes)) return skipRes;
+    }
+  }
+  return Result.ok({ spans: out, rejectedSpans: counters.rejectedSpans, warnings: counters.warnings });
+}
+
+function decodeBody(args: {
+  contentType: string;
+  contentEncoding: string | null;
+  body: Uint8Array;
+  maxDecodedBytes: number;
+  limits: OtelTraceOtlpLimits;
+}): Result<DecodedExport & { responseEncoding: "protobuf" | "json" }, OtlpTraceExportError> {
+  let body = args.body;
+  const maxDecodedBytes = Math.min(args.maxDecodedBytes, args.limits.maxDecodedBytes);
+  const encoding = args.contentEncoding?.trim().toLowerCase() ?? "";
+  if (encoding !== "" && encoding !== "identity" && encoding !== "gzip") {
+    return Result.err({ status: 415, message: "unsupported content-encoding" });
+  }
+  if (encoding === "gzip") {
+    if (body.byteLength > args.limits.maxCompressedBytes) {
+      return Result.err({ status: 413, message: `compressed OTLP body too large (max ${args.limits.maxCompressedBytes})` });
+    }
+    try {
+      body = new Uint8Array(gunzipSync(body, { maxOutputLength: maxDecodedBytes }));
+    } catch (error) {
+      const code = typeof error === "object" && error && "code" in error ? String((error as { code?: unknown }).code) : "";
+      if (code === "ERR_BUFFER_TOO_LARGE") {
+        return Result.err({ status: 413, message: `decoded OTLP body too large (max ${maxDecodedBytes})` });
+      }
+      return Result.err({ status: 400, message: "invalid gzip body" });
+    }
+  }
+  if (body.byteLength > maxDecodedBytes) {
+    return Result.err({ status: 413, message: `decoded OTLP body too large (max ${maxDecodedBytes})` });
+  }
+
+  const contentType = baseContentType(args.contentType);
+  if (contentType === JSON_CONTENT_TYPE) {
+    const spansRes = decodeJsonExportResult(body, args.limits);
+    if (Result.isError(spansRes)) return Result.err({ status: 400, message: spansRes.error.message });
+    return Result.ok({ ...spansRes.value, responseEncoding: "json" });
+  }
+  if (contentType === PROTOBUF_CONTENT_TYPE) {
+    const spansRes = decodeProtobufExportResult(body, args.limits);
+    if (Result.isError(spansRes)) return Result.err({ status: 400, message: spansRes.error.message });
+    return Result.ok({ ...spansRes.value, responseEncoding: "protobuf" });
+  }
+  return Result.err({ status: 415, message: "OTLP traces require application/x-protobuf or application/json" });
+}
+
+export function decodeOtlpTraceExportRequestResult(args: {
+  stream: string;
+  profile: OtelTracesStreamProfile;
+  contentType: string;
+  contentEncoding: string | null;
+  body: Uint8Array;
+  maxDecodedBytes: number;
+}): Result<OtlpTraceExportResult, OtlpTraceExportError> {
+  const limits = { ...DEFAULT_OTLP_LIMITS, ...(args.profile.otlpLimits ?? {}) };
+  const decodedRes = decodeBody({ ...args, limits });
+  if (Result.isError(decodedRes)) return decodedRes;
+  const records: OtlpTraceExportResult["records"] = [];
+  const warnings: string[] = [...decodedRes.value.warnings];
+  let rejectedSpans = decodedRes.value.rejectedSpans;
+  for (const span of decodedRes.value.spans) {
+    const normalizedRes = normalizeOtelDecodedSpanResult(args.profile, span);
+    if (Result.isError(normalizedRes)) {
+      rejectedSpans += 1;
+      if (warnings.length < 8) warnings.push(normalizedRes.error.message);
+      continue;
+    }
+    records.push({
+      value: normalizedRes.value,
+      routingKey: normalizedRes.value.traceId,
+    });
+  }
+  return Result.ok({
+    records,
+    acceptedSpans: records.length,
+    rejectedSpans,
+    warnings,
+    responseEncoding: decodedRes.value.responseEncoding,
+  });
+}
+
+function writeVarint(out: number[], value: bigint): void {
+  let n = value;
+  while (n >= 0x80n) {
+    out.push(Number((n & 0x7fn) | 0x80n));
+    n >>= 7n;
+  }
+  out.push(Number(n));
+}
+
+function writeTag(out: number[], field: number, wire: number): void {
+  writeVarint(out, BigInt((field << 3) | wire));
+}
+
+function writeString(out: number[], field: number, value: string): void {
+  const bytes = new TextEncoder().encode(value);
+  writeTag(out, field, 2);
+  writeVarint(out, BigInt(bytes.byteLength));
+  out.push(...bytes);
+}
+
+function writeInt64(out: number[], field: number, value: bigint): void {
+  writeTag(out, field, 0);
+  writeVarint(out, value);
+}
+
+function writeMessage(out: number[], field: number, body: number[]): void {
+  writeTag(out, field, 2);
+  writeVarint(out, BigInt(body.length));
+  out.push(...body);
+}
+
+export function encodeOtlpTraceExportResponse(result: Pick<OtlpTraceExportResult, "rejectedSpans" | "warnings" | "responseEncoding">): {
+  contentType: string;
+  body: Uint8Array | string;
+} {
+  const message =
+    result.rejectedSpans > 0
+      ? `${result.rejectedSpans} spans rejected${result.warnings.length > 0 ? `: ${result.warnings.join("; ")}` : ""}`
+      : "";
+  if (result.responseEncoding === "json") {
+    if (result.rejectedSpans === 0) return { contentType: "application/json; charset=utf-8", body: "{}" };
+    return {
+      contentType: "application/json; charset=utf-8",
+      body: JSON.stringify({
+        partialSuccess: {
+          rejectedSpans: result.rejectedSpans,
+          errorMessage: message,
+        },
+      }),
+    };
+  }
+  if (result.rejectedSpans === 0) return { contentType: PROTOBUF_CONTENT_TYPE, body: new Uint8Array() };
+  const partial: number[] = [];
+  writeInt64(partial, 1, BigInt(result.rejectedSpans));
+  writeString(partial, 2, message);
+  const response: number[] = [];
+  writeMessage(response, 1, partial);
+  return { contentType: PROTOBUF_CONTENT_TYPE, body: new Uint8Array(response) };
+}