autotel-aws 0.12.16 → 0.12.18

package/README.md

@@ -347,6 +347,150 @@ export const publishEvent = traceKinesis({
 });
 ```
 
+## CloudWatch native OTLP endpoints
+
+As of late 2025 / early 2026, CloudWatch accepts OTLP/HTTP directly — no collector required. Three SigV4-authed endpoints:
+
+| Signal | Endpoint | Lands in |
+|---|---|---|
+| Traces | `https://xray.<region>.amazonaws.com/v1/traces` | X-Ray + Application Signals + Transaction Search |
+| Logs | `https://logs.<region>.amazonaws.com/v1/logs` | CloudWatch Logs (Logs Insights / LiveTail) |
+| Metrics | `https://monitoring.<region>.amazonaws.com/v1/metrics` | CloudWatch Metrics (PromQL-queryable) |
+
+`autotel-aws/cloudwatch` ships SpanExporter / LogRecordExporter / PushMetricExporter implementations that serialize OTLP/JSON, sign with SigV4, and POST via `globalThis.fetch` — usable directly from a Lambda or any Node 18+ runtime, no sidecar.
+
+### Install the optional peers
+
+```bash
+pnpm add autotel-aws autotel \
+  @smithy/signature-v4 @aws-crypto/sha256-js \
+  @aws-sdk/credential-providers \
+  @opentelemetry/sdk-trace-base \
+  @opentelemetry/sdk-logs \
+  @opentelemetry/sdk-metrics \
+  @opentelemetry/otlp-transformer
+```
+
+Only the peers you actually use are needed (e.g. drop `sdk-logs` / `sdk-metrics` if you only export traces).
+
+### Traces
+
+```typescript
+import { init } from 'autotel';
+import { BatchSpanProcessor } from '@opentelemetry/sdk-trace-base';
+import { CloudWatchTraceExporter } from 'autotel-aws/cloudwatch';
+
+init({
+  service: 'my-service',
+  spanProcessors: [
+    new BatchSpanProcessor(
+      new CloudWatchTraceExporter({ region: 'eu-west-1' }),
+    ),
+  ],
+});
+```
+
+In Lambda, call `provider.forceFlush()` before the handler returns, or use `SimpleSpanProcessor` for synchronous export — otherwise the runtime freezes the process before the batch ships.
+
+### Logs
+
+The logs exporter needs an existing CloudWatch log group + stream. In Lambda the runtime provisions both and exposes them as `AWS_LAMBDA_LOG_GROUP_NAME` / `AWS_LAMBDA_LOG_STREAM_NAME` (read by default).
+
+```typescript
+import { BatchLogRecordProcessor, LoggerProvider } from '@opentelemetry/sdk-logs';
+import { CloudWatchLogExporter } from 'autotel-aws/cloudwatch';
+
+const provider = new LoggerProvider({
+  processors: [new BatchLogRecordProcessor(new CloudWatchLogExporter())],
+});
+```
+
+### Metrics
+
+```typescript
+import { MeterProvider, PeriodicExportingMetricReader } from '@opentelemetry/sdk-metrics';
+import { CloudWatchMetricExporter } from 'autotel-aws/cloudwatch';
+
+const provider = new MeterProvider({
+  readers: [
+    new PeriodicExportingMetricReader({
+      exporter: new CloudWatchMetricExporter({ region: 'eu-west-1' }),
+      exportIntervalMillis: 60_000,
+    }),
+  ],
+});
+```
+
+### Direct vs ADOT collector layer
+
+You have two integration paths:
+
+| | In-process (`autotel-aws/cloudwatch`) | ADOT Lambda extension layer |
+|---|---|---|
+| Sidecar | None | Yes (extension layer) |
+| Export latency | In the billed handler time | Outside billed time |
+| Cold start cost | Bundle size + SigV4 init | Layer init |
+| Best for | Low-volume functions, custom transports | Higher-throughput functions |
+
+Pick one — running both ships duplicate spans.
+
+### ADOT collector config (SigV4)
+
+If you prefer the ADOT Lambda extension layer, configure the collector with
+`sigv4auth` and signal-specific endpoints:
+
+```yaml
+extensions:
+  sigv4auth:
+    region: us-west-2
+    service: xray
+
+receivers:
+  otlp:
+    protocols:
+      http:
+
+exporters:
+  otlphttp/traces:
+    endpoint: https://xray.us-west-2.amazonaws.com/v1/traces
+    auth:
+      authenticator: sigv4auth
+
+service:
+  extensions: [sigv4auth]
+  pipelines:
+    traces:
+      receivers: [otlp]
+      exporters: [otlphttp/traces]
+```
+
+For logs/metrics use the same pattern with:
+- logs endpoint `https://logs.<region>.amazonaws.com/v1/logs`, service `logs`
+- metrics endpoint `https://monitoring.<region>.amazonaws.com/v1/metrics`, service `monitoring`
+
+### Production checklist
+
+- Set `AWS_REGION` explicitly and keep endpoint region + signer region aligned.
+- Grant IAM permissions for every signal you export (X-Ray, Logs, Metrics).
+- For logs endpoint, ensure log group + stream exist (`CloudWatchLogExporter` can read Lambda defaults).
+- Flush before Lambda return (or use ADOT mode) so buffered spans/logs/metrics are not dropped on freeze.
+- Monitor 4xx/429 responses and tune batch size / export interval to stay within quotas.
+- Choose one export path per signal (direct exporters or ADOT collector), not both.
+- Keep payload sizes within endpoint limits and use gzip where appropriate.
+- Keep runtime clocks in sync (timestamp windows are enforced).
+
+### Limits to remember
+
+- **Traces**: 5 MB / request, 10 000 spans / batch, 200 KB / span, timestamps within `[-14d, +2h]`.
+- **Logs**: 1 MB / request (20 MB in some regions for LLO-backed events). 1 MB / log event before truncation.
+- **Metrics**: 500 TPS / account, 150 labels / datapoint, 1 MB / request, 1 000 datapoints / request.
+
+### Payload format note
+
+`autotel-aws/cloudwatch` currently sends OTLP over HTTP using JSON payloads. CloudWatch endpoints also accept protobuf payloads, but protobuf transport is not currently wired in these exporters.
+
+Full details: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-OTLPEndpoint.html
+
 ## X-Ray Annotations
 
 For users sending traces to AWS X-Ray, annotations are indexed for filtering:

package/dist/cloudwatch.cjs

@@ -0,0 +1,396 @@
+'use strict';
+
+require('./chunk-JEQ2X3Z6.cjs');
+var core = require('@opentelemetry/core');
+var otlpTransformer = require('@opentelemetry/otlp-transformer');
+var sdkMetrics = require('@opentelemetry/sdk-metrics');
+
+// src/cloudwatch/endpoints.ts
+function cloudWatchTracesEndpoint({ region }) {
+  return `https://xray.${region}.amazonaws.com/v1/traces`;
+}
+function cloudWatchLogsEndpoint({ region }) {
+  return `https://logs.${region}.amazonaws.com/v1/logs`;
+}
+function cloudWatchMetricsEndpoint({ region }) {
+  return `https://monitoring.${region}.amazonaws.com/v1/metrics`;
+}
+var SIGV4_SERVICE = {
+  traces: "xray",
+  logs: "logs",
+  metrics: "monitoring"
+};
+
+// src/cloudwatch/sigv4.ts
+async function signCloudWatchOtlpRequest(input) {
+  const { SignatureV4 } = await loadSigV4();
+  const { Sha256 } = await loadSha256();
+  const credentials = await resolveCredentials(input.credentials);
+  const parsed = new URL(input.url);
+  const contentType = input.contentType ?? "application/json";
+  const headers = {
+    host: parsed.host,
+    "content-type": contentType,
+    ...input.contentEncoding && { "content-encoding": input.contentEncoding },
+    ...input.additionalHeaders
+  };
+  const signer = new SignatureV4({
+    service: SIGV4_SERVICE[input.signal],
+    region: input.region,
+    credentials,
+    sha256: Sha256
+  });
+  const signed = await signer.sign({
+    method: "POST",
+    protocol: parsed.protocol,
+    hostname: parsed.hostname,
+    port: parsed.port ? Number(parsed.port) : void 0,
+    path: parsed.pathname + parsed.search,
+    headers,
+    body: input.body
+  });
+  return signed.headers;
+}
+async function resolveCredentials(source) {
+  if (typeof source === "function") return source();
+  if (source) return source;
+  return loadDefaultCredentials();
+}
+async function loadDefaultCredentials() {
+  try {
+    const mod = await import('@aws-sdk/credential-providers');
+    return await mod.fromNodeProviderChain()();
+  } catch (error) {
+    throw new Error(
+      "autotel-aws/cloudwatch: no credentials supplied and `@aws-sdk/credential-providers` is not installed. Either pass `credentials` explicitly or install the package.",
+      { cause: error }
+    );
+  }
+}
+async function loadSigV4() {
+  try {
+    return await import('@smithy/signature-v4');
+  } catch (error) {
+    throw new Error(
+      "autotel-aws/cloudwatch: `@smithy/signature-v4` is required to sign OTLP requests. Install it (and `@aws-crypto/sha256-js`) alongside autotel-aws.",
+      { cause: error }
+    );
+  }
+}
+async function loadSha256() {
+  try {
+    return await import('@aws-crypto/sha256-js');
+  } catch (error) {
+    throw new Error(
+      "autotel-aws/cloudwatch: `@aws-crypto/sha256-js` is required to sign OTLP requests. Install it alongside `@smithy/signature-v4`.",
+      { cause: error }
+    );
+  }
+}
+var CloudWatchTraceExporter = class {
+  region;
+  endpoint;
+  credentials;
+  timeoutMs;
+  fetchImpl;
+  shutdownOnce = false;
+  constructor(config = {}) {
+    const region = config.region ?? process.env.AWS_REGION;
+    if (!region) {
+      throw new Error(
+        "CloudWatchTraceExporter: `region` is required (pass it explicitly or set AWS_REGION)."
+      );
+    }
+    this.region = region;
+    this.endpoint = config.endpoint ?? cloudWatchTracesEndpoint({ region });
+    this.credentials = config.credentials;
+    this.timeoutMs = config.timeoutMs ?? 1e4;
+    this.fetchImpl = config.fetchImpl ?? globalThis.fetch;
+    if (typeof this.fetchImpl !== "function") {
+      throw new TypeError(
+        "CloudWatchTraceExporter: global `fetch` is not available \u2014 pass `fetchImpl` explicitly (Node 18+ has it natively)."
+      );
+    }
+  }
+  export(spans, resultCallback) {
+    if (this.shutdownOnce) {
+      resultCallback({
+        code: core.ExportResultCode.FAILED,
+        error: new Error("CloudWatchTraceExporter: already shut down")
+      });
+      return;
+    }
+    if (spans.length === 0) {
+      resultCallback({ code: core.ExportResultCode.SUCCESS });
+      return;
+    }
+    this.sendBatch(spans).then(
+      () => resultCallback({ code: core.ExportResultCode.SUCCESS }),
+      (error) => resultCallback({
+        code: core.ExportResultCode.FAILED,
+        error: error instanceof Error ? error : new Error(String(error))
+      })
+    );
+  }
+  async shutdown() {
+    this.shutdownOnce = true;
+  }
+  async forceFlush() {
+  }
+  async sendBatch(spans) {
+    const body = otlpTransformer.JsonTraceSerializer.serializeRequest(spans);
+    if (!body) {
+      throw new Error("CloudWatchTraceExporter: serializer produced no body");
+    }
+    const headers = await signCloudWatchOtlpRequest({
+      url: this.endpoint,
+      body,
+      region: this.region,
+      signal: "traces",
+      credentials: this.credentials,
+      contentType: "application/json"
+    });
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    let response;
+    try {
+      response = await this.fetchImpl(this.endpoint, {
+        method: "POST",
+        headers,
+        body,
+        signal: controller.signal
+      });
+    } finally {
+      clearTimeout(timer);
+    }
+    if (!response.ok) {
+      const text = await safeReadText(response);
+      throw new Error(
+        `CloudWatchTraceExporter: HTTP ${response.status} ${response.statusText} ${text}`.trim()
+      );
+    }
+  }
+};
+async function safeReadText(response) {
+  try {
+    return await response.text();
+  } catch {
+    return "";
+  }
+}
+var CloudWatchLogExporter = class {
+  region;
+  endpoint;
+  credentials;
+  logGroup;
+  logStream;
+  truncatableFields;
+  timeoutMs;
+  fetchImpl;
+  shutdownOnce = false;
+  constructor(config = {}) {
+    const region = config.region ?? process.env.AWS_REGION;
+    if (!region) {
+      throw new Error(
+        "CloudWatchLogExporter: `region` is required (pass it explicitly or set AWS_REGION)."
+      );
+    }
+    const logGroup = config.logGroup ?? process.env.AWS_LAMBDA_LOG_GROUP_NAME;
+    const logStream = config.logStream ?? process.env.AWS_LAMBDA_LOG_STREAM_NAME;
+    if (!logGroup || !logStream) {
+      throw new Error(
+        "CloudWatchLogExporter: `logGroup` and `logStream` are required (in Lambda they come from AWS_LAMBDA_LOG_GROUP_NAME / AWS_LAMBDA_LOG_STREAM_NAME)."
+      );
+    }
+    this.region = region;
+    this.endpoint = config.endpoint ?? cloudWatchLogsEndpoint({ region });
+    this.credentials = config.credentials;
+    this.logGroup = logGroup;
+    this.logStream = logStream;
+    this.truncatableFields = config.truncatableFields;
+    this.timeoutMs = config.timeoutMs ?? 1e4;
+    this.fetchImpl = config.fetchImpl ?? globalThis.fetch;
+    if (typeof this.fetchImpl !== "function") {
+      throw new TypeError(
+        "CloudWatchLogExporter: global `fetch` is not available \u2014 pass `fetchImpl` explicitly."
+      );
+    }
+  }
+  export(logs, resultCallback) {
+    if (this.shutdownOnce) {
+      resultCallback({
+        code: core.ExportResultCode.FAILED,
+        error: new Error("CloudWatchLogExporter: already shut down")
+      });
+      return;
+    }
+    if (logs.length === 0) {
+      resultCallback({ code: core.ExportResultCode.SUCCESS });
+      return;
+    }
+    this.sendBatch(logs).then(
+      () => resultCallback({ code: core.ExportResultCode.SUCCESS }),
+      (error) => resultCallback({
+        code: core.ExportResultCode.FAILED,
+        error: error instanceof Error ? error : new Error(String(error))
+      })
+    );
+  }
+  async shutdown() {
+    this.shutdownOnce = true;
+  }
+  async forceFlush() {
+  }
+  async sendBatch(logs) {
+    const body = otlpTransformer.JsonLogsSerializer.serializeRequest(logs);
+    if (!body) {
+      throw new Error("CloudWatchLogExporter: serializer produced no body");
+    }
+    const additionalHeaders = {
+      "x-aws-log-group": this.logGroup,
+      "x-aws-log-stream": this.logStream
+    };
+    if (this.truncatableFields) {
+      additionalHeaders["x-aws-truncatable-fields"] = this.truncatableFields;
+    }
+    const headers = await signCloudWatchOtlpRequest({
+      url: this.endpoint,
+      body,
+      region: this.region,
+      signal: "logs",
+      credentials: this.credentials,
+      contentType: "application/json",
+      additionalHeaders
+    });
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    let response;
+    try {
+      response = await this.fetchImpl(this.endpoint, {
+        method: "POST",
+        headers,
+        body,
+        signal: controller.signal
+      });
+    } finally {
+      clearTimeout(timer);
+    }
+    if (!response.ok) {
+      const text = await safeReadText2(response);
+      throw new Error(
+        `CloudWatchLogExporter: HTTP ${response.status} ${response.statusText} ${text}`.trim()
+      );
+    }
+  }
+};
+async function safeReadText2(response) {
+  try {
+    return await response.text();
+  } catch {
+    return "";
+  }
+}
+var DEFAULT_TEMPORALITY = (_instrumentType) => sdkMetrics.AggregationTemporality.DELTA;
+var CloudWatchMetricExporter = class {
+  region;
+  endpoint;
+  credentials;
+  timeoutMs;
+  fetchImpl;
+  temporalitySelector;
+  shutdownOnce = false;
+  constructor(config = {}) {
+    const region = config.region ?? process.env.AWS_REGION;
+    if (!region) {
+      throw new Error(
+        "CloudWatchMetricExporter: `region` is required (pass it explicitly or set AWS_REGION)."
+      );
+    }
+    this.region = region;
+    this.endpoint = config.endpoint ?? cloudWatchMetricsEndpoint({ region });
+    this.credentials = config.credentials;
+    this.timeoutMs = config.timeoutMs ?? 1e4;
+    this.fetchImpl = config.fetchImpl ?? globalThis.fetch;
+    this.temporalitySelector = config.temporalitySelector ?? DEFAULT_TEMPORALITY;
+    if (typeof this.fetchImpl !== "function") {
+      throw new TypeError(
+        "CloudWatchMetricExporter: global `fetch` is not available \u2014 pass `fetchImpl` explicitly."
+      );
+    }
+  }
+  export(metrics, resultCallback) {
+    if (this.shutdownOnce) {
+      resultCallback({
+        code: core.ExportResultCode.FAILED,
+        error: new Error("CloudWatchMetricExporter: already shut down")
+      });
+      return;
+    }
+    this.sendBatch(metrics).then(
+      () => resultCallback({ code: core.ExportResultCode.SUCCESS }),
+      (error) => resultCallback({
+        code: core.ExportResultCode.FAILED,
+        error: error instanceof Error ? error : new Error(String(error))
+      })
+    );
+  }
+  async shutdown() {
+    this.shutdownOnce = true;
+  }
+  async forceFlush() {
+  }
+  selectAggregationTemporality(instrumentType) {
+    return this.temporalitySelector(instrumentType);
+  }
+  async sendBatch(metrics) {
+    const body = otlpTransformer.JsonMetricsSerializer.serializeRequest(metrics);
+    if (!body) {
+      throw new Error("CloudWatchMetricExporter: serializer produced no body");
+    }
+    const headers = await signCloudWatchOtlpRequest({
+      url: this.endpoint,
+      body,
+      region: this.region,
+      signal: "metrics",
+      credentials: this.credentials,
+      contentType: "application/json"
+    });
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+    let response;
+    try {
+      response = await this.fetchImpl(this.endpoint, {
+        method: "POST",
+        headers,
+        body,
+        signal: controller.signal
+      });
+    } finally {
+      clearTimeout(timer);
+    }
+    if (!response.ok) {
+      const text = await safeReadText3(response);
+      throw new Error(
+        `CloudWatchMetricExporter: HTTP ${response.status} ${response.statusText} ${text}`.trim()
+      );
+    }
+  }
+};
+async function safeReadText3(response) {
+  try {
+    return await response.text();
+  } catch {
+    return "";
+  }
+}
+
+exports.CloudWatchLogExporter = CloudWatchLogExporter;
+exports.CloudWatchMetricExporter = CloudWatchMetricExporter;
+exports.CloudWatchTraceExporter = CloudWatchTraceExporter;
+exports.SIGV4_SERVICE = SIGV4_SERVICE;
+exports.cloudWatchLogsEndpoint = cloudWatchLogsEndpoint;
+exports.cloudWatchMetricsEndpoint = cloudWatchMetricsEndpoint;
+exports.cloudWatchTracesEndpoint = cloudWatchTracesEndpoint;
+exports.signCloudWatchOtlpRequest = signCloudWatchOtlpRequest;
+//# sourceMappingURL=cloudwatch.cjs.map
+//# sourceMappingURL=cloudwatch.cjs.map

package/dist/cloudwatch.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cloudwatch/endpoints.ts","../src/cloudwatch/sigv4.ts","../src/cloudwatch/trace-exporter.ts","../src/cloudwatch/log-exporter.ts","../src/cloudwatch/metric-exporter.ts"],"names":["ExportResultCode","JsonTraceSerializer","JsonLogsSerializer","safeReadText","AggregationTemporality","JsonMetricsSerializer"],"mappings":";;;;;;;;AAkBO,SAAS,wBAAA,CAAyB,EAAE,MAAA,EAAO,EAAoC;AACpF,EAAA,OAAO,gBAAgB,MAAM,CAAA,wBAAA,CAAA;AAC/B;AAGO,SAAS,sBAAA,CAAuB,EAAE,MAAA,EAAO,EAAoC;AAClF,EAAA,OAAO,gBAAgB,MAAM,CAAA,sBAAA,CAAA;AAC/B;AAGO,SAAS,yBAAA,CAA0B,EAAE,MAAA,EAAO,EAAoC;AACrF,EAAA,OAAO,sBAAsB,MAAM,CAAA,yBAAA,CAAA;AACrC;AAOO,IAAM,aAAA,GAAgB;AAAA,EAC3B,MAAA,EAAQ,MAAA;AAAA,EACR,IAAA,EAAM,MAAA;AAAA,EACN,OAAA,EAAS;AACX;;;ACKA,eAAsB,0BACpB,KAAA,EACiC;AACjC,EAAA,MAAM,EAAE,WAAA,EAAY,GAAI,MAAM,SAAA,EAAU;AACxC,EAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,UAAA,EAAW;AAEpC,EAAA,MAAM,WAAA,GAAc,MAAM,kBAAA,CAAmB,KAAA,CAAM,WAAW,CAAA;AAC9D,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,KAAA,CAAM,GAAG,CAAA;AAChC,EAAA,MAAM,WAAA,GAAc,MAAM,WAAA,IAAe,kBAAA;AAEzC,EAAA,MAAM,OAAA,GAAkC;AAAA,IACtC,MAAM,MAAA,CAAO,IAAA;AAAA,IACb,cAAA,EAAgB,WAAA;AAAA,IAChB,GAAI,KAAA,CAAM,eAAA,IAAmB,EAAE,kBAAA,EAAoB,MAAM,eAAA,EAAgB;AAAA,IACzE,GAAG,KAAA,CAAM;AAAA,GACX;AAEA,EAAA,MAAM,MAAA,GAAS,IAAI,WAAA,CAAY;AAAA,IAC7B,OAAA,EAAS,aAAA,CAAc,KAAA,CAAM,MAAM,CAAA;AAAA,IACnC,QAAQ,KAAA,CAAM,MAAA;AAAA,IACd,WAAA;AAAA,IACA,MAAA,EAAQ;AAAA,GACT,CAAA;AAED,EAAA,MAAM,MAAA,GAAS,MAAM,MAAA,CAAO,IAAA,CAAK;AAAA,IAC/B,MAAA,EAAQ,MAAA;AAAA,IACR,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,UAAU,MAAA,CAAO,QAAA;AAAA,IACjB,MAAM,MAAA,CAAO,IAAA,GAAO,MAAA,CAAO,MAAA,CAAO,IAAI,CAAA,GAAI,MAAA;AAAA,IAC1C,IAAA,EAAM,MAAA,CAAO,QAAA,GAAW,MAAA,CAAO,MAAA;AAAA,IAC/B,OAAA;AAAA,IACA,MAAM,KAAA,CAAM;AAAA,GACb,CAAA;AAED,EAAA,OAAO,MAAA,CAAO,OAAA;AAChB;AAEA,eAAe,mBACb,MAAA,EAC6B;AAC7B,EAAA,IAAI,OAAO,MAAA,KAAW,UAAA,EAAY,OAAO,MAAA,EAAO;AAChD,EAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,EAAA,OAAO,sBAAA,EAAuB;AAChC;AAEA,eAAe,sBAAA,GAAsD;AACnE,EAAA,IAAI;AAEF,IAAA,MAAM,GAAA,GAAM,MAAM,OAAO,+BAA+B,CAAA;AACxD,IAAA,OAAO,MAAM,GAAA,CAAI,qBAAA,EAAsB,EAAE;AAAA,EAC3C,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,oKAAA;AAAA,MAEA,EAAE,OAAO,KAAA;AAAM,KACjB;AAAA,EACF;AACF;AAEA,eAAe,SAAA,GAA4D;AACzE,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,OAAO,sBAAsB,CAAA;AAAA,EAC5C,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,mJAAA;AAAA,MAEA,EAAE,OAAO,KAAA;AAAM,KACjB;AAAA,EACF;AACF;AAEA,eAAe,UAAA,GAA8D;AAC3E,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,OAAO,uBAAuB,CAAA;AAAA,EAC7C,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,iIAAA;AAAA,MAEA,EAAE,OAAO,KAAA;AAAM,KACjB;AAAA,EACF;AACF;AChFO,IAAM,0BAAN,MAAsD;AAAA,EAC1C,MAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACT,YAAA,GAAe,KAAA;AAAA,EAEvB,WAAA,CAAY,MAAA,GAAwC,EAAC,EAAG;AACtD,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,IAAU,OAAA,CAAQ,GAAA,CAAI,UAAA;AAC5C,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,WAAW,MAAA,CAAO,QAAA,IAAY,wBAAA,CAAyB,EAAE,QAAQ,CAAA;AACtE,IAAA,IAAA,CAAK,cAAc,MAAA,CAAO,WAAA;AAC1B,IAAA,IAAA,CAAK,SAAA,GAAY,OAAO,SAAA,IAAa,GAAA;AACrC,IAAA,IAAA,CAAK,SAAA,GAAY,MAAA,CAAO,SAAA,IAAa,UAAA,CAAW,KAAA;AAChD,IAAA,IAAI,OAAO,IAAA,CAAK,SAAA,KAAc,UAAA,EAAY;AACxC,MAAA,MAAM,IAAI,SAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAA,CACE,OACA,cAAA,EACM;AACN,IAAA,IAAI,KAAK,YAAA,EAAc;AACrB,MAAA,cAAA,CAAe;AAAA,QACb,MAAMA,qBAAA,CAAiB,MAAA;AAAA,QACvB,KAAA,EAAO,IAAI,KAAA,CAAM,4CAA4C;AAAA,OAC9D,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,MAAA,cAAA,CAAe,EAAE,IAAA,EAAMA,qBAAA,CAAiB,OAAA,EAAS,CAAA;AACjD,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,SAAA,CAAU,KAAK,CAAA,CAAE,IAAA;AAAA,MACpB,MAAM,cAAA,CAAe,EAAE,IAAA,EAAMA,qBAAA,CAAiB,SAAS,CAAA;AAAA,MACvD,CAAC,UACC,cAAA,CAAe;AAAA,QACb,MAAMA,qBAAA,CAAiB,MAAA;AAAA,QACvB,KAAA,EAAO,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC;AAAA,OAChE;AAAA,KACL;AAAA,EACF;AAAA,EAEA,MAAM,QAAA,GAA0B;AAC9B,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AAAA,EACtB;AAAA,EAEA,MAAM,UAAA,GAA4B;AAAA,EAElC;AAAA,EAEA,MAAc,UAAU,KAAA,EAAsC;AAC5D,IAAA,MAAM,IAAA,GAAOC,mCAAA,CAAoB,gBAAA,CAAiB,KAAK,CAAA;AACvD,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,MAAM,IAAI,MAAM,sDAAsD,CAAA;AAAA,IACxE;AAEA,IAAA,MAAM,OAAA,GAAU,MAAM,yBAAA,CAA0B;AAAA,MAC9C,KAAK,IAAA,CAAK,QAAA;AAAA,MACV,IAAA;AAAA,MACA,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,MAAA,EAAQ,QAAA;AAAA,MACR,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,WAAA,EAAa;AAAA,KACd,CAAA;AAED,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAEjE,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,QAAA,EAAU;AAAA,QAC7C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA;AAAA,QACA,IAAA;AAAA,QACA,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAAA,IACH,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAEA,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAA,GAAO,MAAM,YAAA,CAAa,QAAQ,CAAA;AACxC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,8BAAA,EAAiC,SAAS,MAAM,CAAA,CAAA,EAAI,SAAS,UAAU,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,CAAG,IAAA;AAAK,OACzF;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAe,aAAa,QAAA,EAAqC;AAC/D,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,SAAS,IAAA,EAAK;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAA;AAAA,EACT;AACF;ACxGO,IAAM,wBAAN,MAAyD;AAAA,EAC7C,MAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,QAAA;AAAA,EACA,SAAA;AAAA,EACA,iBAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACT,YAAA,GAAe,KAAA;AAAA,EAEvB,WAAA,CAAY,MAAA,GAAsC,EAAC,EAAG;AACpD,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,IAAU,OAAA,CAAQ,GAAA,CAAI,UAAA;AAC5C,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,MAAM,QAAA,GAAW,MAAA,CAAO,QAAA,IAAY,OAAA,CAAQ,GAAA,CAAI,yBAAA;AAChD,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,SAAA,IAAa,OAAA,CAAQ,GAAA,CAAI,0BAAA;AAClD,IAAA,IAAI,CAAC,QAAA,IAAY,CAAC,SAAA,EAAW;AAC3B,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OAEF;AAAA,IACF;AACA,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,WAAW,MAAA,CAAO,QAAA,IAAY,sBAAA,CAAuB,EAAE,QAAQ,CAAA;AACpE,IAAA,IAAA,CAAK,cAAc,MAAA,CAAO,WAAA;AAC1B,IAAA,IAAA,CAAK,QAAA,GAAW,QAAA;AAChB,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AACjB,IAAA,IAAA,CAAK,oBAAoB,MAAA,CAAO,iBAAA;AAChC,IAAA,IAAA,CAAK,SAAA,GAAY,OAAO,SAAA,IAAa,GAAA;AACrC,IAAA,IAAA,CAAK,SAAA,GAAY,MAAA,CAAO,SAAA,IAAa,UAAA,CAAW,KAAA;AAChD,IAAA,IAAI,OAAO,IAAA,CAAK,SAAA,KAAc,UAAA,EAAY;AACxC,MAAA,MAAM,IAAI,SAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAA,CACE,MACA,cAAA,EACM;AACN,IAAA,IAAI,KAAK,YAAA,EAAc;AACrB,MAAA,cAAA,CAAe;AAAA,QACb,MAAMD,qBAAAA,CAAiB,MAAA;AAAA,QACvB,KAAA,EAAO,IAAI,KAAA,CAAM,0CAA0C;AAAA,OAC5D,CAAA;AACD,MAAA;AAAA,IACF;AACA,IAAA,IAAI,IAAA,CAAK,WAAW,CAAA,EAAG;AACrB,MAAA,cAAA,CAAe,EAAE,IAAA,EAAMA,qBAAAA,CAAiB,OAAA,EAAS,CAAA;AACjD,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA,CAAE,IAAA;AAAA,MACnB,MAAM,cAAA,CAAe,EAAE,IAAA,EAAMA,qBAAAA,CAAiB,SAAS,CAAA;AAAA,MACvD,CAAC,UACC,cAAA,CAAe;AAAA,QACb,MAAMA,qBAAAA,CAAiB,MAAA;AAAA,QACvB,KAAA,EAAO,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC;AAAA,OAChE;AAAA,KACL;AAAA,EACF;AAAA,EAEA,MAAM,QAAA,GAA0B;AAC9B,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AAAA,EACtB;AAAA,EAEA,MAAM,UAAA,GAA4B;AAAA,EAAC;AAAA,EAEnC,MAAc,UAAU,IAAA,EAA0C;AAChE,IAAA,MAAM,IAAA,GAAOE,kCAAA,CAAmB,gBAAA,CAAiB,IAAI,CAAA;AACrD,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,MAAM,IAAI,MAAM,oDAAoD,CAAA;AAAA,IACtE;AAEA,IAAA,MAAM,iBAAA,GAA4C;AAAA,MAChD,mBAAmB,IAAA,CAAK,QAAA;AAAA,MACxB,oBAAoB,IAAA,CAAK;AAAA,KAC3B;AACA,IAAA,IAAI,KAAK,iBAAA,EAAmB;AAC1B,MAAA,iBAAA,CAAkB,0BAA0B,IAAI,IAAA,CAAK,iBAAA;AAAA,IACvD;AAEA,IAAA,MAAM,OAAA,GAAU,MAAM,yBAAA,CAA0B;AAAA,MAC9C,KAAK,IAAA,CAAK,QAAA;AAAA,MACV,IAAA;AAAA,MACA,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,MAAA,EAAQ,MAAA;AAAA,MACR,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,WAAA,EAAa,kBAAA;AAAA,MACb;AAAA,KACD,CAAA;AAED,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAEjE,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,QAAA,EAAU;AAAA,QAC7C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA;AAAA,QACA,IAAA;AAAA,QACA,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAAA,IACH,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAEA,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAA,GAAO,MAAMC,aAAAA,CAAa,QAAQ,CAAA;AACxC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,4BAAA,EAA+B,SAAS,MAAM,CAAA,CAAA,EAAI,SAAS,UAAU,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,CAAG,IAAA;AAAK,OACvF;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAeA,cAAa,QAAA,EAAqC;AAC/D,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,SAAS,IAAA,EAAK;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAA;AAAA,EACT;AACF;ACzIA,IAAM,mBAAA,GAAsD,CAC1D,eAAA,KACGC,iCAAA,CAAuB,KAAA;AAErB,IAAM,2BAAN,MAA6D;AAAA,EACjD,MAAA;AAAA,EACA,QAAA;AAAA,EACA,WAAA;AAAA,EACA,SAAA;AAAA,EACA,SAAA;AAAA,EACA,mBAAA;AAAA,EACT,YAAA,GAAe,KAAA;AAAA,EAEvB,WAAA,CAAY,MAAA,GAAyC,EAAC,EAAG;AACvD,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,MAAA,IAAU,OAAA,CAAQ,GAAA,CAAI,UAAA;AAC5C,IAAA,IAAI,CAAC,MAAA,EAAQ;AACX,MAAA,MAAM,IAAI,KAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAA,CAAK,MAAA,GAAS,MAAA;AACd,IAAA,IAAA,CAAK,WAAW,MAAA,CAAO,QAAA,IAAY,yBAAA,CAA0B,EAAE,QAAQ,CAAA;AACvE,IAAA,IAAA,CAAK,cAAc,MAAA,CAAO,WAAA;AAC1B,IAAA,IAAA,CAAK,SAAA,GAAY,OAAO,SAAA,IAAa,GAAA;AACrC,IAAA,IAAA,CAAK,SAAA,GAAY,MAAA,CAAO,SAAA,IAAa,UAAA,CAAW,KAAA;AAChD,IAAA,IAAA,CAAK,mBAAA,GACH,OAAO,mBAAA,IAAuB,mBAAA;AAChC,IAAA,IAAI,OAAO,IAAA,CAAK,SAAA,KAAc,UAAA,EAAY;AACxC,MAAA,MAAM,IAAI,SAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAA,CACE,SACA,cAAA,EACM;AACN,IAAA,IAAI,KAAK,YAAA,EAAc;AACrB,MAAA,cAAA,CAAe;AAAA,QACb,MAAMJ,qBAAAA,CAAiB,MAAA;AAAA,QACvB,KAAA,EAAO,IAAI,KAAA,CAAM,6CAA6C;AAAA,OAC/D,CAAA;AACD,MAAA;AAAA,IACF;AAEA,IAAA,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA,CAAE,IAAA;AAAA,MACtB,MAAM,cAAA,CAAe,EAAE,IAAA,EAAMA,qBAAAA,CAAiB,SAAS,CAAA;AAAA,MACvD,CAAC,UACC,cAAA,CAAe;AAAA,QACb,MAAMA,qBAAAA,CAAiB,MAAA;AAAA,QACvB,KAAA,EAAO,iBAAiB,KAAA,GAAQ,KAAA,GAAQ,IAAI,KAAA,CAAM,MAAA,CAAO,KAAK,CAAC;AAAA,OAChE;AAAA,KACL;AAAA,EACF;AAAA,EAEA,MAAM,QAAA,GAA0B;AAC9B,IAAA,IAAA,CAAK,YAAA,GAAe,IAAA;AAAA,EACtB;AAAA,EAEA,MAAM,UAAA,GAA4B;AAAA,EAAC;AAAA,EAEnC,6BACE,cAAA,EACwB;AACxB,IAAA,OAAO,IAAA,CAAK,oBAAoB,cAAc,CAAA;AAAA,EAChD;AAAA,EAEA,MAAc,UAAU,OAAA,EAAyC;AAC/D,IAAA,MAAM,IAAA,GAAOK,qCAAA,CAAsB,gBAAA,CAAiB,OAAO,CAAA;AAC3D,IAAA,IAAI,CAAC,IAAA,EAAM;AACT,MAAA,MAAM,IAAI,MAAM,uDAAuD,CAAA;AAAA,IACzE;AAEA,IAAA,MAAM,OAAA,GAAU,MAAM,yBAAA,CAA0B;AAAA,MAC9C,KAAK,IAAA,CAAK,QAAA;AAAA,MACV,IAAA;AAAA,MACA,QAAQ,IAAA,CAAK,MAAA;AAAA,MACb,MAAA,EAAQ,SAAA;AAAA,MACR,aAAa,IAAA,CAAK,WAAA;AAAA,MAClB,WAAA,EAAa;AAAA,KACd,CAAA;AAED,IAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,IAAA,MAAM,QAAQ,UAAA,CAAW,MAAM,WAAW,KAAA,EAAM,EAAG,KAAK,SAAS,CAAA;AAEjE,IAAA,IAAI,QAAA;AACJ,IAAA,IAAI;AACF,MAAA,QAAA,GAAW,MAAM,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,QAAA,EAAU;AAAA,QAC7C,MAAA,EAAQ,MAAA;AAAA,QACR,OAAA;AAAA,QACA,IAAA;AAAA,QACA,QAAQ,UAAA,CAAW;AAAA,OACpB,CAAA;AAAA,IACH,CAAA,SAAE;AACA,MAAA,YAAA,CAAa,KAAK,CAAA;AAAA,IACpB;AAEA,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,IAAA,GAAO,MAAMF,aAAAA,CAAa,QAAQ,CAAA;AACxC,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,+BAAA,EAAkC,SAAS,MAAM,CAAA,CAAA,EAAI,SAAS,UAAU,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,CAAG,IAAA;AAAK,OAC1F;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAeA,cAAa,QAAA,EAAqC;AAC/D,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,SAAS,IAAA,EAAK;AAAA,EAC7B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAA;AAAA,EACT;AACF","file":"cloudwatch.cjs","sourcesContent":["/**\n * CloudWatch native OTLP HTTP endpoints.\n *\n * Reference: https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-OTLPEndpoint.html\n *\n * All three endpoints accept OTLP/HTTP (JSON or protobuf, optional gzip)\n * and require AWS Signature V4 authentication. They land data in:\n *\n *   - traces  → X-Ray + Application Signals + Transaction Search\n *   - logs    → CloudWatch Logs (needs x-aws-log-group + x-aws-log-stream headers)\n *   - metrics → CloudWatch Metrics, queryable via PromQL\n */\n\nexport interface CloudWatchEndpointInput {\n  readonly region: string;\n}\n\n/** Traces — signed against the `xray` service. */\nexport function cloudWatchTracesEndpoint({ region }: CloudWatchEndpointInput): string {\n  return `https://xray.${region}.amazonaws.com/v1/traces`;\n}\n\n/** Logs — signed against the `logs` service. Requires log group/stream headers. */\nexport function cloudWatchLogsEndpoint({ region }: CloudWatchEndpointInput): string {\n  return `https://logs.${region}.amazonaws.com/v1/logs`;\n}\n\n/** Metrics — signed against the `monitoring` service. */\nexport function cloudWatchMetricsEndpoint({ region }: CloudWatchEndpointInput): string {\n  return `https://monitoring.${region}.amazonaws.com/v1/metrics`;\n}\n\n/**\n * The SigV4 service name used when signing requests for each endpoint.\n * These do NOT always match the host prefix — they're the canonical\n * AWS service identifiers used by the SigV4 signer.\n */\nexport const SIGV4_SERVICE = {\n  traces: 'xray',\n  logs: 'logs',\n  metrics: 'monitoring',\n} as const;\n\nexport type CloudWatchSignal = keyof typeof SIGV4_SERVICE;\n","/**\n * SigV4 signing helper for CloudWatch OTLP HTTP endpoints.\n *\n * Uses `@smithy/signature-v4` + `@aws-crypto/sha256-js` (optional peer deps).\n * Returns the headers required to POST a signed OTLP request.\n */\n\nimport type { CloudWatchSignal } from './endpoints';\nimport { SIGV4_SERVICE } from './endpoints';\n\nexport interface AwsCredentialsLike {\n  readonly accessKeyId: string;\n  readonly secretAccessKey: string;\n  readonly sessionToken?: string;\n}\n\nexport type AwsCredentialsProvider =\n  | AwsCredentialsLike\n  | (() => AwsCredentialsLike | Promise<AwsCredentialsLike>);\n\nexport interface SignOtlpRequestInput {\n  /** The full endpoint URL (e.g. https://xray.eu-west-1.amazonaws.com/v1/traces). */\n  url: string;\n  /** OTLP payload — already serialized + (optionally) gzipped. */\n  body: Uint8Array;\n  /** AWS region (e.g. \"eu-west-1\"). Must match the host. */\n  region: string;\n  /** Which CloudWatch endpoint we're hitting (selects the SigV4 service name). */\n  signal: CloudWatchSignal;\n  /** Static credentials or a provider. Falls back to the AWS SDK default chain when omitted. */\n  credentials?: AwsCredentialsProvider;\n  /** Extra headers to include in the canonical request (signed). */\n  additionalHeaders?: Record<string, string>;\n  /** Content-Type — defaults to OTLP/JSON. Use `application/x-protobuf` for proto. */\n  contentType?: 'application/json' | 'application/x-protobuf';\n  /** Content-Encoding (e.g. \"gzip\"). Omit for identity. */\n  contentEncoding?: 'gzip';\n}\n\n/**\n * Compute SigV4-signed headers for an OTLP HTTP POST to a CloudWatch endpoint.\n *\n * Throws if the optional `@smithy/signature-v4` / `@aws-crypto/sha256-js`\n * peer dependencies aren't installed — install them alongside autotel-aws\n * when you want to ship telemetry directly from app code (no collector).\n */\nexport async function signCloudWatchOtlpRequest(\n  input: SignOtlpRequestInput,\n): Promise<Record<string, string>> {\n  const { SignatureV4 } = await loadSigV4();\n  const { Sha256 } = await loadSha256();\n\n  const credentials = await resolveCredentials(input.credentials);\n  const parsed = new URL(input.url);\n  const contentType = input.contentType ?? 'application/json';\n\n  const headers: Record<string, string> = {\n    host: parsed.host,\n    'content-type': contentType,\n    ...(input.contentEncoding && { 'content-encoding': input.contentEncoding }),\n    ...input.additionalHeaders,\n  };\n\n  const signer = new SignatureV4({\n    service: SIGV4_SERVICE[input.signal],\n    region: input.region,\n    credentials,\n    sha256: Sha256,\n  });\n\n  const signed = await signer.sign({\n    method: 'POST',\n    protocol: parsed.protocol,\n    hostname: parsed.hostname,\n    port: parsed.port ? Number(parsed.port) : undefined,\n    path: parsed.pathname + parsed.search,\n    headers,\n    body: input.body,\n  });\n\n  return signed.headers as Record<string, string>;\n}\n\nasync function resolveCredentials(\n  source: AwsCredentialsProvider | undefined,\n): Promise<AwsCredentialsLike> {\n  if (typeof source === 'function') return source();\n  if (source) return source;\n  return loadDefaultCredentials();\n}\n\nasync function loadDefaultCredentials(): Promise<AwsCredentialsLike> {\n  try {\n    // Optional peer dep — only required when caller doesn't pass credentials.\n    const mod = await import('@aws-sdk/credential-providers');\n    return await mod.fromNodeProviderChain()();\n  } catch (error) {\n    throw new Error(\n      'autotel-aws/cloudwatch: no credentials supplied and `@aws-sdk/credential-providers` is not installed. ' +\n        'Either pass `credentials` explicitly or install the package.',\n      { cause: error },\n    );\n  }\n}\n\nasync function loadSigV4(): Promise<typeof import('@smithy/signature-v4')> {\n  try {\n    return await import('@smithy/signature-v4');\n  } catch (error) {\n    throw new Error(\n      'autotel-aws/cloudwatch: `@smithy/signature-v4` is required to sign OTLP requests. ' +\n        'Install it (and `@aws-crypto/sha256-js`) alongside autotel-aws.',\n      { cause: error },\n    );\n  }\n}\n\nasync function loadSha256(): Promise<typeof import('@aws-crypto/sha256-js')> {\n  try {\n    return await import('@aws-crypto/sha256-js');\n  } catch (error) {\n    throw new Error(\n      'autotel-aws/cloudwatch: `@aws-crypto/sha256-js` is required to sign OTLP requests. ' +\n        'Install it alongside `@smithy/signature-v4`.',\n      { cause: error },\n    );\n  }\n}\n","/**\n * SpanExporter that ships OTLP/JSON straight to the CloudWatch traces\n * endpoint (https://xray.<region>.amazonaws.com/v1/traces) using SigV4.\n *\n * No collector required. Useful in Lambda when you don't want to attach\n * the ADOT extension layer, or any other env where you'd rather not run\n * a sidecar.\n *\n * Lands in: X-Ray + Application Signals + Transaction Search.\n */\n\nimport type { ExportResult } from '@opentelemetry/core';\nimport { ExportResultCode } from '@opentelemetry/core';\nimport { JsonTraceSerializer } from '@opentelemetry/otlp-transformer';\nimport type {\n  ReadableSpan,\n  SpanExporter,\n} from '@opentelemetry/sdk-trace-base';\n\nimport { cloudWatchTracesEndpoint } from './endpoints';\nimport {\n  signCloudWatchOtlpRequest,\n  type AwsCredentialsProvider,\n} from './sigv4';\n\nexport interface CloudWatchTraceExporterConfig {\n  /** AWS region — defaults to `process.env.AWS_REGION`. */\n  region?: string;\n  /** Override the endpoint (mainly for tests / VPC endpoints). */\n  endpoint?: string;\n  /** Static credentials or a provider. Defaults to the AWS SDK default chain. */\n  credentials?: AwsCredentialsProvider;\n  /** Per-export timeout in ms. Defaults to 10s (CloudWatch's documented soft cap). */\n  timeoutMs?: number;\n  /** Optional `fetch` override (Node 18+ has it globally; useful in tests). */\n  fetchImpl?: typeof fetch;\n}\n\n/**\n * OTLP/JSON exporter for CloudWatch's traces endpoint.\n *\n * Use with `BatchSpanProcessor` or `SimpleSpanProcessor` from\n * `@opentelemetry/sdk-trace-base`. For Lambda, `SimpleSpanProcessor`\n * (synchronous export per span) is fine for small workloads;\n * `BatchSpanProcessor` is better for higher-throughput functions but\n * needs `forceFlush()` before the handler returns.\n */\nexport class CloudWatchTraceExporter implements SpanExporter {\n  private readonly region: string;\n  private readonly endpoint: string;\n  private readonly credentials?: AwsCredentialsProvider;\n  private readonly timeoutMs: number;\n  private readonly fetchImpl: typeof fetch;\n  private shutdownOnce = false;\n\n  constructor(config: CloudWatchTraceExporterConfig = {}) {\n    const region = config.region ?? process.env.AWS_REGION;\n    if (!region) {\n      throw new Error(\n        'CloudWatchTraceExporter: `region` is required (pass it explicitly or set AWS_REGION).',\n      );\n    }\n    this.region = region;\n    this.endpoint = config.endpoint ?? cloudWatchTracesEndpoint({ region });\n    this.credentials = config.credentials;\n    this.timeoutMs = config.timeoutMs ?? 10_000;\n    this.fetchImpl = config.fetchImpl ?? globalThis.fetch;\n    if (typeof this.fetchImpl !== 'function') {\n      throw new TypeError(\n        'CloudWatchTraceExporter: global `fetch` is not available — pass `fetchImpl` explicitly (Node 18+ has it natively).',\n      );\n    }\n  }\n\n  export(\n    spans: ReadableSpan[],\n    resultCallback: (result: ExportResult) => void,\n  ): void {\n    if (this.shutdownOnce) {\n      resultCallback({\n        code: ExportResultCode.FAILED,\n        error: new Error('CloudWatchTraceExporter: already shut down'),\n      });\n      return;\n    }\n    if (spans.length === 0) {\n      resultCallback({ code: ExportResultCode.SUCCESS });\n      return;\n    }\n\n    this.sendBatch(spans).then(\n      () => resultCallback({ code: ExportResultCode.SUCCESS }),\n      (error: unknown) =>\n        resultCallback({\n          code: ExportResultCode.FAILED,\n          error: error instanceof Error ? error : new Error(String(error)),\n        }),\n    );\n  }\n\n  async shutdown(): Promise<void> {\n    this.shutdownOnce = true;\n  }\n\n  async forceFlush(): Promise<void> {\n    // Batching is the responsibility of the span processor. Nothing to flush here.\n  }\n\n  private async sendBatch(spans: ReadableSpan[]): Promise<void> {\n    const body = JsonTraceSerializer.serializeRequest(spans);\n    if (!body) {\n      throw new Error('CloudWatchTraceExporter: serializer produced no body');\n    }\n\n    const headers = await signCloudWatchOtlpRequest({\n      url: this.endpoint,\n      body,\n      region: this.region,\n      signal: 'traces',\n      credentials: this.credentials,\n      contentType: 'application/json',\n    });\n\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n\n    let response: Response;\n    try {\n      response = await this.fetchImpl(this.endpoint, {\n        method: 'POST',\n        headers,\n        body,\n        signal: controller.signal,\n      });\n    } finally {\n      clearTimeout(timer);\n    }\n\n    if (!response.ok) {\n      const text = await safeReadText(response);\n      throw new Error(\n        `CloudWatchTraceExporter: HTTP ${response.status} ${response.statusText} ${text}`.trim(),\n      );\n    }\n  }\n}\n\nasync function safeReadText(response: Response): Promise<string> {\n  try {\n    return await response.text();\n  } catch {\n    return '';\n  }\n}\n","/**\n * LogRecordExporter that ships OTLP/JSON logs to the CloudWatch logs\n * endpoint (https://logs.<region>.amazonaws.com/v1/logs) using SigV4.\n *\n * CloudWatch Logs requires `x-aws-log-group` and `x-aws-log-stream`\n * headers — both must already exist (this exporter does NOT create them).\n *\n * In Lambda, the runtime auto-provisions a log group + stream per function;\n * read them from `AWS_LAMBDA_LOG_GROUP_NAME` / `AWS_LAMBDA_LOG_STREAM_NAME`\n * (set automatically when the function runs).\n */\n\nimport type { ExportResult } from '@opentelemetry/core';\nimport { ExportResultCode } from '@opentelemetry/core';\nimport { JsonLogsSerializer } from '@opentelemetry/otlp-transformer';\nimport type {\n  LogRecordExporter,\n  ReadableLogRecord,\n} from '@opentelemetry/sdk-logs';\n\nimport { cloudWatchLogsEndpoint } from './endpoints';\nimport {\n  signCloudWatchOtlpRequest,\n  type AwsCredentialsProvider,\n} from './sigv4';\n\nexport interface CloudWatchLogExporterConfig {\n  region?: string;\n  endpoint?: string;\n  credentials?: AwsCredentialsProvider;\n  /**\n   * Existing CloudWatch log group to write into. Defaults to\n   * `AWS_LAMBDA_LOG_GROUP_NAME` (set automatically by the Lambda runtime).\n   */\n  logGroup?: string;\n  /**\n   * Existing CloudWatch log stream. Defaults to\n   * `AWS_LAMBDA_LOG_STREAM_NAME`.\n   */\n  logStream?: string;\n  /**\n   * Optional comma-separated list of field paths CloudWatch may truncate\n   * if the event exceeds 1 MB (sent as `x-aws-truncatable-fields`).\n   */\n  truncatableFields?: string;\n  timeoutMs?: number;\n  fetchImpl?: typeof fetch;\n}\n\nexport class CloudWatchLogExporter implements LogRecordExporter {\n  private readonly region: string;\n  private readonly endpoint: string;\n  private readonly credentials?: AwsCredentialsProvider;\n  private readonly logGroup: string;\n  private readonly logStream: string;\n  private readonly truncatableFields?: string;\n  private readonly timeoutMs: number;\n  private readonly fetchImpl: typeof fetch;\n  private shutdownOnce = false;\n\n  constructor(config: CloudWatchLogExporterConfig = {}) {\n    const region = config.region ?? process.env.AWS_REGION;\n    if (!region) {\n      throw new Error(\n        'CloudWatchLogExporter: `region` is required (pass it explicitly or set AWS_REGION).',\n      );\n    }\n    const logGroup = config.logGroup ?? process.env.AWS_LAMBDA_LOG_GROUP_NAME;\n    const logStream = config.logStream ?? process.env.AWS_LAMBDA_LOG_STREAM_NAME;\n    if (!logGroup || !logStream) {\n      throw new Error(\n        'CloudWatchLogExporter: `logGroup` and `logStream` are required ' +\n          '(in Lambda they come from AWS_LAMBDA_LOG_GROUP_NAME / AWS_LAMBDA_LOG_STREAM_NAME).',\n      );\n    }\n    this.region = region;\n    this.endpoint = config.endpoint ?? cloudWatchLogsEndpoint({ region });\n    this.credentials = config.credentials;\n    this.logGroup = logGroup;\n    this.logStream = logStream;\n    this.truncatableFields = config.truncatableFields;\n    this.timeoutMs = config.timeoutMs ?? 10_000;\n    this.fetchImpl = config.fetchImpl ?? globalThis.fetch;\n    if (typeof this.fetchImpl !== 'function') {\n      throw new TypeError(\n        'CloudWatchLogExporter: global `fetch` is not available — pass `fetchImpl` explicitly.',\n      );\n    }\n  }\n\n  export(\n    logs: ReadableLogRecord[],\n    resultCallback: (result: ExportResult) => void,\n  ): void {\n    if (this.shutdownOnce) {\n      resultCallback({\n        code: ExportResultCode.FAILED,\n        error: new Error('CloudWatchLogExporter: already shut down'),\n      });\n      return;\n    }\n    if (logs.length === 0) {\n      resultCallback({ code: ExportResultCode.SUCCESS });\n      return;\n    }\n\n    this.sendBatch(logs).then(\n      () => resultCallback({ code: ExportResultCode.SUCCESS }),\n      (error: unknown) =>\n        resultCallback({\n          code: ExportResultCode.FAILED,\n          error: error instanceof Error ? error : new Error(String(error)),\n        }),\n    );\n  }\n\n  async shutdown(): Promise<void> {\n    this.shutdownOnce = true;\n  }\n\n  async forceFlush(): Promise<void> {}\n\n  private async sendBatch(logs: ReadableLogRecord[]): Promise<void> {\n    const body = JsonLogsSerializer.serializeRequest(logs);\n    if (!body) {\n      throw new Error('CloudWatchLogExporter: serializer produced no body');\n    }\n\n    const additionalHeaders: Record<string, string> = {\n      'x-aws-log-group': this.logGroup,\n      'x-aws-log-stream': this.logStream,\n    };\n    if (this.truncatableFields) {\n      additionalHeaders['x-aws-truncatable-fields'] = this.truncatableFields;\n    }\n\n    const headers = await signCloudWatchOtlpRequest({\n      url: this.endpoint,\n      body,\n      region: this.region,\n      signal: 'logs',\n      credentials: this.credentials,\n      contentType: 'application/json',\n      additionalHeaders,\n    });\n\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n\n    let response: Response;\n    try {\n      response = await this.fetchImpl(this.endpoint, {\n        method: 'POST',\n        headers,\n        body,\n        signal: controller.signal,\n      });\n    } finally {\n      clearTimeout(timer);\n    }\n\n    if (!response.ok) {\n      const text = await safeReadText(response);\n      throw new Error(\n        `CloudWatchLogExporter: HTTP ${response.status} ${response.statusText} ${text}`.trim(),\n      );\n    }\n  }\n}\n\nasync function safeReadText(response: Response): Promise<string> {\n  try {\n    return await response.text();\n  } catch {\n    return '';\n  }\n}\n","/**\n * PushMetricExporter that ships OTLP/JSON metrics to the CloudWatch\n * metrics endpoint (https://monitoring.<region>.amazonaws.com/v1/metrics)\n * using SigV4.\n *\n * Lands in: CloudWatch Metrics — queryable via PromQL alongside the AWS\n * vended namespaces.\n */\n\nimport type { ExportResult } from '@opentelemetry/core';\nimport { ExportResultCode } from '@opentelemetry/core';\nimport { JsonMetricsSerializer } from '@opentelemetry/otlp-transformer';\nimport {\n  AggregationTemporality,\n  type AggregationTemporalitySelector,\n  type InstrumentType,\n  type PushMetricExporter,\n  type ResourceMetrics,\n} from '@opentelemetry/sdk-metrics';\n\nimport { cloudWatchMetricsEndpoint } from './endpoints';\nimport {\n  signCloudWatchOtlpRequest,\n  type AwsCredentialsProvider,\n} from './sigv4';\n\nexport interface CloudWatchMetricExporterConfig {\n  region?: string;\n  endpoint?: string;\n  credentials?: AwsCredentialsProvider;\n  timeoutMs?: number;\n  fetchImpl?: typeof fetch;\n  /**\n   * Aggregation temporality. CloudWatch's OTLP metrics endpoint accepts\n   * delta and cumulative; delta is generally cheaper for counters.\n   */\n  temporalitySelector?: AggregationTemporalitySelector;\n}\n\nconst DEFAULT_TEMPORALITY: AggregationTemporalitySelector = (\n  _instrumentType: InstrumentType,\n) => AggregationTemporality.DELTA;\n\nexport class CloudWatchMetricExporter implements PushMetricExporter {\n  private readonly region: string;\n  private readonly endpoint: string;\n  private readonly credentials?: AwsCredentialsProvider;\n  private readonly timeoutMs: number;\n  private readonly fetchImpl: typeof fetch;\n  private readonly temporalitySelector: AggregationTemporalitySelector;\n  private shutdownOnce = false;\n\n  constructor(config: CloudWatchMetricExporterConfig = {}) {\n    const region = config.region ?? process.env.AWS_REGION;\n    if (!region) {\n      throw new Error(\n        'CloudWatchMetricExporter: `region` is required (pass it explicitly or set AWS_REGION).',\n      );\n    }\n    this.region = region;\n    this.endpoint = config.endpoint ?? cloudWatchMetricsEndpoint({ region });\n    this.credentials = config.credentials;\n    this.timeoutMs = config.timeoutMs ?? 10_000;\n    this.fetchImpl = config.fetchImpl ?? globalThis.fetch;\n    this.temporalitySelector =\n      config.temporalitySelector ?? DEFAULT_TEMPORALITY;\n    if (typeof this.fetchImpl !== 'function') {\n      throw new TypeError(\n        'CloudWatchMetricExporter: global `fetch` is not available — pass `fetchImpl` explicitly.',\n      );\n    }\n  }\n\n  export(\n    metrics: ResourceMetrics,\n    resultCallback: (result: ExportResult) => void,\n  ): void {\n    if (this.shutdownOnce) {\n      resultCallback({\n        code: ExportResultCode.FAILED,\n        error: new Error('CloudWatchMetricExporter: already shut down'),\n      });\n      return;\n    }\n\n    this.sendBatch(metrics).then(\n      () => resultCallback({ code: ExportResultCode.SUCCESS }),\n      (error: unknown) =>\n        resultCallback({\n          code: ExportResultCode.FAILED,\n          error: error instanceof Error ? error : new Error(String(error)),\n        }),\n    );\n  }\n\n  async shutdown(): Promise<void> {\n    this.shutdownOnce = true;\n  }\n\n  async forceFlush(): Promise<void> {}\n\n  selectAggregationTemporality(\n    instrumentType: InstrumentType,\n  ): AggregationTemporality {\n    return this.temporalitySelector(instrumentType);\n  }\n\n  private async sendBatch(metrics: ResourceMetrics): Promise<void> {\n    const body = JsonMetricsSerializer.serializeRequest(metrics);\n    if (!body) {\n      throw new Error('CloudWatchMetricExporter: serializer produced no body');\n    }\n\n    const headers = await signCloudWatchOtlpRequest({\n      url: this.endpoint,\n      body,\n      region: this.region,\n      signal: 'metrics',\n      credentials: this.credentials,\n      contentType: 'application/json',\n    });\n\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), this.timeoutMs);\n\n    let response: Response;\n    try {\n      response = await this.fetchImpl(this.endpoint, {\n        method: 'POST',\n        headers,\n        body,\n        signal: controller.signal,\n      });\n    } finally {\n      clearTimeout(timer);\n    }\n\n    if (!response.ok) {\n      const text = await safeReadText(response);\n      throw new Error(\n        `CloudWatchMetricExporter: HTTP ${response.status} ${response.statusText} ${text}`.trim(),\n      );\n    }\n  }\n}\n\nasync function safeReadText(response: Response): Promise<string> {\n  try {\n    return await response.text();\n  } catch {\n    return '';\n  }\n}\n"]}