observability-toolkit 1.8.5 → 2.1.0

package/dist/backends/signoz-api.js

@@ -1,1016 +0,0 @@
-/**
- * SigNoz Cloud API backend for querying traces, metrics, and logs
- *
- * SigNoz has two separate endpoints:
- * - Ingest: https://ingest.{region}.signoz.cloud (OTLP for sending data)
- * - Query API: https://{tenant}.signoz.io or SIGNOZ_QUERY_URL (for reading data)
- *
- * This backend uses the Query API (v5) for reading telemetry data.
- *
- * ## TLS/HTTPS Security
- *
- * This backend enforces HTTPS-only connections (HTTP URLs are rejected).
- * Node.js `fetch()` uses the system certificate store by default, which
- * provides standard TLS certificate validation.
- *
- * For enterprise deployments requiring:
- * - **Custom CA certificates**: Set `NODE_EXTRA_CA_CERTS` environment variable
- * - **Certificate pinning**: Not currently supported; use network-level controls
- * - **Self-signed certificates**: Not recommended for production; use proper PKI
- *
- * @see https://nodejs.org/api/cli.html#node_extra_ca_certsfile
- */
-import { SIGNOZ_API_KEY, CIRCUIT_BREAKER, RATE_LIMITER, getSpanKind } from '../lib/constants.js';
-import { escapeFilterValueSafe, escapeLikeValueSafe, sanitizeIdentifier, } from '../lib/query-sanitizer.js';
-/**
- * Whitelist of safe path prefixes for backward compatibility
- * These are common patterns for SigNoz deployments and reverse proxies
- */
-const SAFE_PATH_PREFIXES = [
-    '/v1/', // OTLP standard paths
-    '/api/', // SigNoz API paths
-    '/signoz/', // Common reverse proxy prefix
-    '/query/', // Query service prefix
-];
-/**
- * Validate and sanitize a URL to prevent SSRF attacks
- * Only allows HTTPS URLs to external hosts
- * Preserves whitelisted path prefixes for backward compatibility
- */
-function validateAndSanitizeUrl(url) {
-    if (!url)
-        return '';
-    try {
-        const parsed = new URL(url);
-        // Only allow HTTPS protocol (prevent http://, file://, etc.)
-        if (parsed.protocol !== 'https:') {
-            console.error('[SECURITY] Invalid URL protocol - only HTTPS allowed');
-            return '';
-        }
-        // Block internal/private network addresses (SSRF protection)
-        const hostname = parsed.hostname.toLowerCase();
-        // Normalize IPv6 for comparison (handles bracketed and various formats)
-        // Strip zone IDs (e.g., fe80::1%eth0) to prevent SSRF bypass attempts
-        const normalizedHost = hostname.replace(/^\[|\]$/g, '').split('%')[0];
-        // Check for localhost variants (full 127.0.0.0/8 loopback range)
-        if (normalizedHost === 'localhost' ||
-            /^127\./.test(normalizedHost) || // Full 127.0.0.0/8 loopback range
-            normalizedHost === '0.0.0.0' ||
-            // IPv6 localhost variants
-            normalizedHost === '::1' ||
-            normalizedHost === '0:0:0:0:0:0:0:1' ||
-            normalizedHost === '0000:0000:0000:0000:0000:0000:0000:0001' ||
-            // IPv4-mapped IPv6 localhost (full loopback range)
-            /^::ffff:127\./.test(normalizedHost) ||
-            normalizedHost === '::ffff:7f00:1' ||
-            // .localhost TLD (reserved for localhost)
-            normalizedHost.endsWith('.localhost')) {
-            console.error('[SECURITY] Localhost addresses not allowed for SigNoz URL');
-            return '';
-        }
-        // Check for cloud metadata endpoints (169.254.0.0/16 link-local)
-        // AWS: 169.254.169.254, GCP: 169.254.169.254, Azure: 169.254.169.254
-        if (/^169\.254\./.test(normalizedHost) ||
-            /^::ffff:169\.254\./.test(normalizedHost)) {
-            console.error('[SECURITY] Cloud metadata addresses not allowed for SigNoz URL');
-            return '';
-        }
-        // Check for private network ranges
-        if (normalizedHost.startsWith('192.168.') ||
-            normalizedHost.startsWith('10.') ||
-            /^172\.(1[6-9]|2[0-9]|3[0-1])\./.test(normalizedHost) ||
-            // IPv6 private ranges
-            normalizedHost.startsWith('fc') || // Unique local addresses fc00::/7
-            normalizedHost.startsWith('fd') || // Unique local addresses
-            normalizedHost.startsWith('fe80') || // Link-local addresses
-            // IPv4-mapped private ranges
-            normalizedHost.startsWith('::ffff:192.168.') ||
-            normalizedHost.startsWith('::ffff:10.') ||
-            /^::ffff:172\.(1[6-9]|2[0-9]|3[0-1])\./.test(normalizedHost)) {
-            console.error('[SECURITY] Private network addresses not allowed for SigNoz URL');
-            return '';
-        }
-        // Check for reserved domain suffixes
-        if (normalizedHost.endsWith('.local') ||
-            normalizedHost.endsWith('.internal') ||
-            normalizedHost.endsWith('.localdomain') ||
-            normalizedHost.endsWith('.home.arpa') // RFC 8375 home network
-        ) {
-            console.error('[SECURITY] Reserved domain names not allowed for SigNoz URL');
-            return '';
-        }
-        // Check if path starts with a whitelisted prefix
-        const path = parsed.pathname;
-        const hasWhitelistedPath = SAFE_PATH_PREFIXES.some(prefix => path.startsWith(prefix));
-        if (hasWhitelistedPath) {
-            // Preserve whitelisted path, but strip query params and fragment for safety
-            return `${parsed.origin}${path}`;
-        }
-        // Return origin only for non-whitelisted paths (strips path, query, fragment)
-        return parsed.origin;
-    }
-    catch (error) {
-        console.error('[SECURITY] Invalid SIGNOZ_QUERY_URL format');
-        return '';
-    }
-}
-// SigNoz Query API URL (separate from ingest URL) - validated for SSRF protection
-const SIGNOZ_QUERY_URL = validateAndSanitizeUrl(process.env.SIGNOZ_QUERY_URL || '');
-function startTiming() {
-    const start = performance.now();
-    return {
-        end: () => performance.now() - start
-    };
-}
-const SLOW_QUERY_THRESHOLD_MS = 500;
-/** Maximum hours ago for timestamp queries (1 year) */
-const MAX_HOURS_AGO = 8760;
-/** Default timeout for HTTP requests (30 seconds) */
-const DEFAULT_TIMEOUT_MS = 30000;
-/**
- * Token bucket rate limiter to prevent API abuse
- * Allows burst traffic up to maxTokens, then refills at refillRate tokens/second
- */
-export class TokenBucketRateLimiter {
-    tokens;
-    lastRefill;
-    maxTokens;
-    refillRate;
-    constructor(maxTokens, refillRate) {
-        this.maxTokens = maxTokens ?? RATE_LIMITER.MAX_TOKENS;
-        this.refillRate = refillRate ?? RATE_LIMITER.REFILL_RATE;
-        this.tokens = this.maxTokens;
-        this.lastRefill = Date.now();
-    }
-    /**
-     * Refill tokens based on elapsed time
-     * H1: Cap elapsed time to prevent precision loss in long-running processes
-     */
-    refill() {
-        const now = Date.now();
-        // Cap elapsed time to maxTokens/refillRate seconds (time to fully refill bucket)
-        // This prevents precision issues with very large elapsed times
-        const maxUsefulElapsedMs = (this.maxTokens / this.refillRate) * 1000;
-        const elapsedMs = Math.min(now - this.lastRefill, maxUsefulElapsedMs);
-        const tokensToAdd = Math.floor((elapsedMs / 1000) * this.refillRate);
-        if (tokensToAdd > 0) {
-            this.tokens = Math.min(this.maxTokens, this.tokens + tokensToAdd);
-            this.lastRefill = now;
-        }
-    }
-    /**
-     * Try to consume a token. Returns true if allowed, false if rate limited.
-     */
-    tryConsume() {
-        this.refill();
-        if (this.tokens > 0) {
-            this.tokens--;
-            return true;
-        }
-        console.warn(`[obs-toolkit] Rate limit exceeded (0/${this.maxTokens} tokens available)`);
-        return false;
-    }
-    /**
-     * Get current available tokens (for monitoring/testing)
-     */
-    getAvailableTokens() {
-        this.refill();
-        return this.tokens;
-    }
-    /**
-     * Refund a single token (used when request is rejected by circuit breaker)
-     * This prevents the circuit breaker from consuming rate limit tokens for requests it blocks
-     */
-    refund() {
-        this.tokens = Math.min(this.maxTokens, this.tokens + 1);
-    }
-    /**
-     * Reset the rate limiter to full capacity (for testing only)
-     */
-    reset() {
-        this.tokens = this.maxTokens;
-        this.lastRefill = Date.now();
-    }
-}
-/**
- * Simple circuit breaker for API calls with integrated rate limiting
- */
-class ApiCircuitBreaker {
-    failures = 0;
-    lastFailure = 0;
-    state = 'closed';
-    rateLimiter;
-    /** Prevents multiple concurrent requests during half-open state */
-    halfOpenRequestInFlight = false;
-    maxFailures;
-    resetMs;
-    constructor() {
-        this.maxFailures = CIRCUIT_BREAKER.MAX_FAILURES;
-        this.resetMs = CIRCUIT_BREAKER.RESET_MS;
-        this.rateLimiter = new TokenBucketRateLimiter();
-    }
-    canRequest() {
-        // Check rate limit first
-        if (!this.rateLimiter.tryConsume()) {
-            return false;
-        }
-        if (this.state === 'open') {
-            if (Date.now() - this.lastFailure > this.resetMs) {
-                // Prevent race condition: only allow one request through during half-open
-                if (this.halfOpenRequestInFlight) {
-                    this.rateLimiter.refund();
-                    return false; // Another half-open request is already testing
-                }
-                this.halfOpenRequestInFlight = true;
-                console.info(`[obs-toolkit] Circuit breaker entering HALF-OPEN state (reset timeout elapsed)`);
-                this.state = 'half-open';
-                return true;
-            }
-            // Refund the single consumed token since we're not making the request
-            this.rateLimiter.refund();
-            return false;
-        }
-        // In half-open state, reject if a request is already in flight
-        if (this.state === 'half-open' && this.halfOpenRequestInFlight) {
-            this.rateLimiter.refund();
-            return false;
-        }
-        return true;
-    }
-    recordSuccess() {
-        this.halfOpenRequestInFlight = false;
-        if (this.state === 'half-open') {
-            console.info(`[obs-toolkit] Circuit breaker CLOSED after successful request`);
-        }
-        this.failures = 0;
-        this.state = 'closed';
-    }
-    recordFailure() {
-        this.halfOpenRequestInFlight = false;
-        this.failures++;
-        this.lastFailure = Date.now();
-        if (this.failures >= this.maxFailures && this.state !== 'open') {
-            const previousState = this.state;
-            this.state = 'open';
-            console.warn(`[obs-toolkit] Circuit breaker OPENED after ${this.failures} consecutive failures (was: ${previousState})`);
-        }
-    }
-    getState() {
-        return this.state;
-    }
-    /**
-     * Check if rate limited (for health check reporting)
-     */
-    isRateLimited() {
-        return this.rateLimiter.getAvailableTokens() === 0;
-    }
-    /**
-     * Get available tokens (for monitoring)
-     */
-    getAvailableTokens() {
-        return this.rateLimiter.getAvailableTokens();
-    }
-}
-/**
- * Encode cursor data to opaque base64 string
- */
-function encodeCursor(data) {
-    return Buffer.from(JSON.stringify(data)).toString('base64');
-}
-/**
- * Decode cursor from base64 string, returns null on invalid cursor
- */
-function decodeCursor(cursor) {
-    try {
-        const decoded = Buffer.from(cursor, 'base64').toString('utf-8');
-        const data = JSON.parse(decoded);
-        if (typeof data.ts !== 'number' || typeof data.offset !== 'number') {
-            return null;
-        }
-        return data;
-    }
-    catch {
-        console.warn('[obs-toolkit] Invalid pagination cursor, resetting to start');
-        return null;
-    }
-}
-export class SigNozApiBackend {
-    name = 'signoz-api';
-    baseUrl;
-    apiKey;
-    circuitBreaker = new ApiCircuitBreaker();
-    constructor(baseUrl, apiKey) {
-        // Use SIGNOZ_QUERY_URL for queries - must be explicitly set
-        // Cannot be derived from ingest URL (different domain pattern)
-        // Example: SIGNOZ_QUERY_URL=https://your-tenant.us.signoz.cloud
-        // Validate URL to prevent SSRF attacks
-        const queryUrl = baseUrl ? validateAndSanitizeUrl(baseUrl) : SIGNOZ_QUERY_URL;
-        this.baseUrl = queryUrl.replace(/\/+$/, '');
-        this.apiKey = apiKey || SIGNOZ_API_KEY;
-    }
-    async fetch(path, options) {
-        if (!this.baseUrl || !this.apiKey) {
-            throw new Error('SigNoz Query URL or API key not configured. Set SIGNOZ_QUERY_URL and SIGNOZ_API_KEY');
-        }
-        if (!this.circuitBreaker.canRequest()) {
-            // canRequest() returns false for both rate limiting and circuit breaker
-            // Check which one triggered the rejection
-            if (this.circuitBreaker.getState() === 'open') {
-                throw new Error('Circuit breaker open - SigNoz API unavailable');
-            }
-            throw new Error('Rate limit exceeded - too many requests');
-        }
-        const url = `${this.baseUrl}${path}`;
-        const headers = {
-            'SIGNOZ-API-KEY': this.apiKey,
-            'Content-Type': 'application/json',
-        };
-        // Create AbortController for timeout
-        const controller = new AbortController();
-        const timeoutId = setTimeout(() => controller.abort(), DEFAULT_TIMEOUT_MS);
-        try {
-            const response = await fetch(url, {
-                ...options,
-                headers: { ...headers, ...options?.headers },
-                signal: controller.signal,
-            });
-            clearTimeout(timeoutId);
-            if (!response.ok) {
-                // Security: sanitize error message to avoid leaking internal system information
-                // Log full error server-side, return sanitized message to client
-                const text = await response.text();
-                console.error(`SigNoz API error (${response.status}): ${text}`);
-                throw new Error(`SigNoz API error: ${response.status} - Request failed`);
-            }
-            this.circuitBreaker.recordSuccess();
-            // Validate Content-Type before parsing JSON (headers may be absent in test mocks)
-            const contentType = response.headers?.get?.('content-type');
-            if (contentType && !contentType.includes('application/json')) {
-                throw new Error(`SigNoz API returned unexpected Content-Type: ${contentType}`);
-            }
-            return response.json();
-        }
-        catch (error) {
-            clearTimeout(timeoutId);
-            this.circuitBreaker.recordFailure();
-            // Convert AbortError to timeout error for clarity
-            if (error instanceof Error && error.name === 'AbortError') {
-                throw new Error(`SigNoz API request timeout after ${DEFAULT_TIMEOUT_MS}ms`);
-            }
-            throw error;
-        }
-    }
-    /**
-     * Get millisecond timestamp for SigNoz v5 API queries
-     * @param dateStr - Optional date string to parse
-     * @param defaultHoursAgo - Hours ago for default timestamp (max 8760 = 1 year)
-     */
-    getMillisTime(dateStr, defaultHoursAgo = 1) {
-        if (dateStr) {
-            return new Date(dateStr).getTime();
-        }
-        // Clamp defaultHoursAgo to prevent integer overflow (max 1 year)
-        const clampedHours = Math.min(Math.max(0, defaultHoursAgo), MAX_HOURS_AGO);
-        return Date.now() - clampedHours * 60 * 60 * 1000;
-    }
-    async queryTraces(options) {
-        const timer = startTiming();
-        const logTiming = () => {
-            const durationMs = timer.end();
-            if (durationMs > SLOW_QUERY_THRESHOLD_MS) {
-                console.warn(`[obs-toolkit] Slow query: queryTraces took ${durationMs.toFixed(1)}ms`);
-            }
-        };
-        const start = this.getMillisTime(options.startDate, 1);
-        const end = this.getMillisTime(options.endDate ? options.endDate + 'T23:59:59Z' : undefined, 0);
-        const limit = options.limit || 100;
-        // Build filter expression with input validation and escaping
-        const filterParts = [];
-        if (options.traceId) {
-            filterParts.push(`traceID = '${escapeFilterValueSafe(options.traceId, 'traceId')}'`);
-        }
-        if (options.serviceName) {
-            filterParts.push(`serviceName = '${escapeFilterValueSafe(options.serviceName, 'serviceName')}'`);
-        }
-        if (options.spanName) {
-            filterParts.push(`name LIKE '%${escapeLikeValueSafe(options.spanName, 'spanName')}%'`);
-        }
-        if (options.minDurationMs) {
-            filterParts.push(`durationNano >= ${options.minDurationMs * 1_000_000}`);
-        }
-        if (options.maxDurationMs) {
-            filterParts.push(`durationNano <= ${options.maxDurationMs * 1_000_000}`);
-        }
-        // Build v5 API payload using builder_query
-        const body = {
-            start,
-            end,
-            requestType: 'raw',
-            compositeQuery: {
-                queries: [{
-                        type: 'builder_query',
-                        spec: {
-                            name: 'A',
-                            signal: 'traces',
-                            stepInterval: 60,
-                            aggregations: [],
-                            filter: filterParts.length > 0 ? { expression: filterParts.join(' AND ') } : undefined,
-                            selectFields: [
-                                { name: 'traceID' },
-                                { name: 'spanID' },
-                                { name: 'parentSpanID' },
-                                { name: 'name' },
-                                { name: 'serviceName' },
-                                { name: 'kind' },
-                                { name: 'durationNano' },
-                                { name: 'statusCode' },
-                                { name: 'statusMessage' },
-                            ],
-                            order: [{ key: { name: 'timestamp' }, direction: 'desc' }],
-                            limit,
-                            offset: 0,
-                            disabled: false,
-                        },
-                    }],
-            },
-        };
-        try {
-            const response = await this.fetch('/api/v5/query_range', {
-                method: 'POST',
-                body: JSON.stringify(body),
-            });
-            const results = [];
-            for (const result of response.data?.data?.results || []) {
-                for (const row of result.rows || []) {
-                    const d = row.data || {};
-                    results.push({
-                        traceId: String(d.trace_id || d.traceID || ''),
-                        spanId: String(d.span_id || d.spanID || ''),
-                        parentSpanId: d.parent_span_id || d.parentSpanID ? String(d.parent_span_id || d.parentSpanID) : undefined,
-                        name: String(d.name || ''),
-                        kind: getSpanKind(d.kind !== undefined ? Number(d.kind) : undefined),
-                        startTimeUnixNano: row.timestamp ? new Date(row.timestamp).getTime() * 1_000_000 : 0,
-                        durationMs: Number(d.duration_nano || d.durationNano || 0) / 1_000_000,
-                        status: d.response_status_code ? { code: Number(d.response_status_code), message: '' } : undefined,
-                        attributes: { serviceName: String(d['service.name'] || d.serviceName || '') },
-                    });
-                }
-            }
-            logTiming();
-            return results;
-        }
-        catch (error) {
-            logTiming();
-            if (error instanceof Error && (error.message.includes('Circuit breaker') || error.message.includes('Rate limit'))) {
-                return [];
-            }
-            throw error;
-        }
-    }
-    async queryLogs(options) {
-        const timer = startTiming();
-        const logTiming = () => {
-            const durationMs = timer.end();
-            if (durationMs > SLOW_QUERY_THRESHOLD_MS) {
-                console.warn(`[obs-toolkit] Slow query: queryLogs took ${durationMs.toFixed(1)}ms`);
-            }
-        };
-        const start = this.getMillisTime(options.startDate, 1);
-        const end = this.getMillisTime(options.endDate ? options.endDate + 'T23:59:59Z' : undefined, 0);
-        const limit = options.limit || 100;
-        // Build filter expression with input validation and escaping
-        const filterParts = [];
-        if (options.severity) {
-            filterParts.push(`severity_text = '${escapeFilterValueSafe(options.severity.toUpperCase(), 'severity')}'`);
-        }
-        if (options.traceId) {
-            filterParts.push(`trace_id = '${escapeFilterValueSafe(options.traceId, 'traceId')}'`);
-        }
-        if (options.search) {
-            filterParts.push(`body LIKE '%${escapeLikeValueSafe(options.search, 'search')}%'`);
-        }
-        // Build v5 API payload
-        const body = {
-            start,
-            end,
-            requestType: 'raw',
-            compositeQuery: {
-                queries: [{
-                        type: 'builder_query',
-                        spec: {
-                            name: 'A',
-                            signal: 'logs',
-                            stepInterval: 60,
-                            aggregations: [],
-                            filter: filterParts.length > 0 ? { expression: filterParts.join(' AND ') } : undefined,
-                            selectFields: [
-                                { name: 'timestamp' },
-                                { name: 'severity_text' },
-                                { name: 'body' },
-                                { name: 'trace_id' },
-                                { name: 'span_id' },
-                            ],
-                            order: [{ key: { name: 'timestamp' }, direction: 'desc' }],
-                            limit,
-                            offset: 0,
-                            disabled: false,
-                        },
-                    }],
-            },
-        };
-        try {
-            const response = await this.fetch('/api/v5/query_range', {
-                method: 'POST',
-                body: JSON.stringify(body),
-            });
-            const results = [];
-            for (const result of response.data?.data?.results || []) {
-                for (const row of result.rows || []) {
-                    const d = row.data || {};
-                    results.push({
-                        timestamp: row.timestamp || new Date().toISOString(),
-                        severity: d.severity_text || 'INFO',
-                        body: d.body || '',
-                        traceId: d.trace_id,
-                        spanId: d.span_id,
-                        attributes: d.attributes_string || {},
-                    });
-                }
-            }
-            logTiming();
-            return results;
-        }
-        catch (error) {
-            logTiming();
-            if (error instanceof Error && (error.message.includes('Circuit breaker') || error.message.includes('Rate limit'))) {
-                return [];
-            }
-            throw error;
-        }
-    }
-    async queryMetrics(options) {
-        const timer = startTiming();
-        const logTiming = () => {
-            const durationMs = timer.end();
-            if (durationMs > SLOW_QUERY_THRESHOLD_MS) {
-                console.warn(`[obs-toolkit] Slow query: queryMetrics took ${durationMs.toFixed(1)}ms`);
-            }
-        };
-        const start = this.getMillisTime(options.startDate, 1);
-        const end = this.getMillisTime(options.endDate ? options.endDate + 'T23:59:59Z' : undefined, 0);
-        if (!options.metricName) {
-            throw new Error('metricName is required for SigNoz metric queries');
-        }
-        // Sanitize metric name (identifiers allow alphanumeric, underscore, dot)
-        const sanitizedMetricName = sanitizeIdentifier(options.metricName);
-        if (!sanitizedMetricName) {
-            throw new Error('Invalid metricName: must contain alphanumeric characters');
-        }
-        // Map aggregation options to SigNoz format
-        // Percentiles: p50, p95, p99 map to SigNoz percentile functions
-        // rate: maps to SigNoz rate aggregation
-        const spaceAggMap = {
-            'sum': 'sum', 'avg': 'avg', 'min': 'min', 'max': 'max', 'count': 'sum',
-            'p50': 'p50', 'p95': 'p95', 'p99': 'p99', 'rate': 'rate',
-        };
-        const spaceAgg = spaceAggMap[options.aggregation || 'sum'] || 'sum';
-        // Sanitize groupBy identifiers
-        const sanitizedGroupBy = (options.groupBy || []).map(g => sanitizeIdentifier(g)).filter(g => g);
-        // Build v5 API payload for metrics
-        const body = {
-            start,
-            end,
-            requestType: 'time_series',
-            compositeQuery: {
-                queries: [{
-                        type: 'builder_query',
-                        spec: {
-                            name: 'A',
-                            signal: 'metrics',
-                            stepInterval: 60,
-                            aggregations: [{
-                                    metricName: sanitizedMetricName,
-                                    timeAggregation: 'rate',
-                                    spaceAggregation: spaceAgg,
-                                }],
-                            groupBy: sanitizedGroupBy.map(g => ({ name: g })),
-                            order: [],
-                            limit: options.limit || 100,
-                            offset: 0,
-                            disabled: false,
-                        },
-                    }],
-            },
-        };
-        try {
-            const response = await this.fetch('/api/v5/query_range', {
-                method: 'POST',
-                body: JSON.stringify(body),
-            });
-            const results = [];
-            for (const result of response.data?.data?.results || []) {
-                for (const agg of result.aggregations || []) {
-                    for (const series of agg.series || []) {
-                        for (const point of series.values || []) {
-                            results.push({
-                                timestamp: new Date(point.timestamp).toISOString(),
-                                name: options.metricName,
-                                value: point.value,
-                                attributes: series.labels,
-                            });
-                        }
-                    }
-                }
-            }
-            logTiming();
-            return results.slice(0, options.limit || 100);
-        }
-        catch (error) {
-            logTiming();
-            if (error instanceof Error && (error.message.includes('Circuit breaker') || error.message.includes('Rate limit'))) {
-                return [];
-            }
-            throw error;
-        }
-    }
-    /**
-     * Query traces with cursor-based pagination
-     */
-    async queryTracesPaginated(options) {
-        const limit = options.limit || 100;
-        // Decode cursor if provided
-        let cursorData = null;
-        if (options.cursor) {
-            cursorData = decodeCursor(options.cursor);
-        }
-        // Adjust start time based on cursor (query from last seen timestamp)
-        const start = cursorData
-            ? cursorData.ts
-            : this.getMillisTime(options.startDate, 1);
-        const end = this.getMillisTime(options.endDate ? options.endDate + 'T23:59:59Z' : undefined, 0);
-        // Calculate offset based on cursor
-        const offset = cursorData?.offset || options.offset || 0;
-        // Build filter expression with input validation and escaping
-        const filterParts = [];
-        if (options.traceId) {
-            filterParts.push(`traceID = '${escapeFilterValueSafe(options.traceId, 'traceId')}'`);
-        }
-        if (options.serviceName) {
-            filterParts.push(`serviceName = '${escapeFilterValueSafe(options.serviceName, 'serviceName')}'`);
-        }
-        if (options.spanName) {
-            filterParts.push(`name LIKE '%${escapeLikeValueSafe(options.spanName, 'spanName')}%'`);
-        }
-        if (options.minDurationMs) {
-            filterParts.push(`durationNano >= ${options.minDurationMs * 1_000_000}`);
-        }
-        if (options.maxDurationMs) {
-            filterParts.push(`durationNano <= ${options.maxDurationMs * 1_000_000}`);
-        }
-        // Request limit + 1 to detect if there are more results
-        const requestLimit = limit + 1;
-        // Build v5 API payload using builder_query
-        const body = {
-            start,
-            end,
-            requestType: 'raw',
-            compositeQuery: {
-                queries: [{
-                        type: 'builder_query',
-                        spec: {
-                            name: 'A',
-                            signal: 'traces',
-                            stepInterval: 60,
-                            aggregations: [],
-                            filter: filterParts.length > 0 ? { expression: filterParts.join(' AND ') } : undefined,
-                            selectFields: [
-                                { name: 'traceID' },
-                                { name: 'spanID' },
-                                { name: 'parentSpanID' },
-                                { name: 'name' },
-                                { name: 'serviceName' },
-                                { name: 'kind' },
-                                { name: 'durationNano' },
-                                { name: 'statusCode' },
-                                { name: 'statusMessage' },
-                            ],
-                            order: [{ key: { name: 'timestamp' }, direction: 'desc' }],
-                            limit: requestLimit,
-                            offset,
-                            disabled: false,
-                        },
-                    }],
-            },
-        };
-        try {
-            const response = await this.fetch('/api/v5/query_range', {
-                method: 'POST',
-                body: JSON.stringify(body),
-            });
-            const results = [];
-            let lastTimestamp = 0;
-            for (const result of response.data?.data?.results || []) {
-                for (const row of result.rows || []) {
-                    const d = row.data || {};
-                    const ts = row.timestamp ? new Date(row.timestamp).getTime() : 0;
-                    lastTimestamp = ts;
-                    results.push({
-                        traceId: String(d.trace_id || d.traceID || ''),
-                        spanId: String(d.span_id || d.spanID || ''),
-                        parentSpanId: d.parent_span_id || d.parentSpanID ? String(d.parent_span_id || d.parentSpanID) : undefined,
-                        name: String(d.name || ''),
-                        kind: getSpanKind(d.kind !== undefined ? Number(d.kind) : undefined),
-                        startTimeUnixNano: ts * 1_000_000,
-                        durationMs: Number(d.duration_nano || d.durationNano || 0) / 1_000_000,
-                        status: d.response_status_code ? { code: Number(d.response_status_code), message: '' } : undefined,
-                        attributes: { serviceName: String(d['service.name'] || d.serviceName || '') },
-                    });
-                }
-            }
-            // Determine if there are more results
-            const hasMore = results.length > limit;
-            const data = hasMore ? results.slice(0, limit) : results;
-            // Generate next cursor if there are more results
-            let nextCursor;
-            if (hasMore && data.length > 0) {
-                const lastItem = data[data.length - 1];
-                const lastTs = lastItem.startTimeUnixNano / 1_000_000; // Convert back to ms
-                nextCursor = encodeCursor({ ts: lastTs, offset: offset + limit });
-            }
-            return { data, nextCursor, hasMore };
-        }
-        catch (error) {
-            if (error instanceof Error && (error.message.includes('Circuit breaker') || error.message.includes('Rate limit'))) {
-                return { data: [], hasMore: false };
-            }
-            throw error;
-        }
-    }
-    /**
-     * Query logs with cursor-based pagination
-     */
-    async queryLogsPaginated(options) {
-        const limit = options.limit || 100;
-        // Decode cursor if provided
-        let cursorData = null;
-        if (options.cursor) {
-            cursorData = decodeCursor(options.cursor);
-        }
-        // Adjust start time based on cursor (query from last seen timestamp)
-        const start = cursorData
-            ? cursorData.ts
-            : this.getMillisTime(options.startDate, 1);
-        const end = this.getMillisTime(options.endDate ? options.endDate + 'T23:59:59Z' : undefined, 0);
-        // Calculate offset based on cursor
-        const offset = cursorData?.offset || options.offset || 0;
-        // Build filter expression with input validation and escaping
-        const filterParts = [];
-        if (options.severity) {
-            filterParts.push(`severity_text = '${escapeFilterValueSafe(options.severity.toUpperCase(), 'severity')}'`);
-        }
-        if (options.traceId) {
-            filterParts.push(`trace_id = '${escapeFilterValueSafe(options.traceId, 'traceId')}'`);
-        }
-        if (options.search) {
-            filterParts.push(`body LIKE '%${escapeLikeValueSafe(options.search, 'search')}%'`);
-        }
-        // Request limit + 1 to detect if there are more results
-        const requestLimit = limit + 1;
-        // Build v5 API payload
-        const body = {
-            start,
-            end,
-            requestType: 'raw',
-            compositeQuery: {
-                queries: [{
-                        type: 'builder_query',
-                        spec: {
-                            name: 'A',
-                            signal: 'logs',
-                            stepInterval: 60,
-                            aggregations: [],
-                            filter: filterParts.length > 0 ? { expression: filterParts.join(' AND ') } : undefined,
-                            selectFields: [
-                                { name: 'timestamp' },
-                                { name: 'severity_text' },
-                                { name: 'body' },
-                                { name: 'trace_id' },
-                                { name: 'span_id' },
-                            ],
-                            order: [{ key: { name: 'timestamp' }, direction: 'desc' }],
-                            limit: requestLimit,
-                            offset,
-                            disabled: false,
-                        },
-                    }],
-            },
-        };
-        try {
-            const response = await this.fetch('/api/v5/query_range', {
-                method: 'POST',
-                body: JSON.stringify(body),
-            });
-            const results = [];
-            let lastTimestamp = '';
-            for (const result of response.data?.data?.results || []) {
-                for (const row of result.rows || []) {
-                    const d = row.data || {};
-                    lastTimestamp = row.timestamp || new Date().toISOString();
-                    results.push({
-                        timestamp: lastTimestamp,
-                        severity: d.severity_text || 'INFO',
-                        body: d.body || '',
-                        traceId: d.trace_id,
-                        spanId: d.span_id,
-                        attributes: d.attributes_string || {},
-                    });
-                }
-            }
-            // Determine if there are more results
-            const hasMore = results.length > limit;
-            const data = hasMore ? results.slice(0, limit) : results;
-            // Generate next cursor if there are more results
-            let nextCursor;
-            if (hasMore && data.length > 0) {
-                const lastItem = data[data.length - 1];
-                const lastTs = new Date(lastItem.timestamp).getTime();
-                nextCursor = encodeCursor({ ts: lastTs, offset: offset + limit });
-            }
-            return { data, nextCursor, hasMore };
-        }
-        catch (error) {
-            if (error instanceof Error && (error.message.includes('Circuit breaker') || error.message.includes('Rate limit'))) {
-                return { data: [], hasMore: false };
-            }
-            throw error;
-        }
-    }
-    /**
-     * Query metrics with cursor-based pagination
-     */
-    async queryMetricsPaginated(options) {
-        const limit = options.limit || 100;
-        // Decode cursor if provided
-        let cursorData = null;
-        if (options.cursor) {
-            cursorData = decodeCursor(options.cursor);
-        }
-        // Adjust start time based on cursor
-        const start = cursorData
-            ? cursorData.ts
-            : this.getMillisTime(options.startDate, 1);
-        const end = this.getMillisTime(options.endDate ? options.endDate + 'T23:59:59Z' : undefined, 0);
-        if (!options.metricName) {
-            throw new Error('metricName is required for SigNoz metric queries');
-        }
-        // Sanitize metric name (identifiers allow alphanumeric, underscore, dot)
-        const sanitizedMetricName = sanitizeIdentifier(options.metricName);
-        if (!sanitizedMetricName) {
-            throw new Error('Invalid metricName: must contain alphanumeric characters');
-        }
-        // Map aggregation options to SigNoz format
-        // Percentiles: p50, p95, p99 map to SigNoz percentile functions
-        // rate: maps to SigNoz rate aggregation
-        const spaceAggMap = {
-            'sum': 'sum', 'avg': 'avg', 'min': 'min', 'max': 'max', 'count': 'sum',
-            'p50': 'p50', 'p95': 'p95', 'p99': 'p99', 'rate': 'rate',
-        };
-        const spaceAgg = spaceAggMap[options.aggregation || 'sum'] || 'sum';
-        // Sanitize groupBy identifiers
-        const sanitizedGroupBy = (options.groupBy || []).map(g => sanitizeIdentifier(g)).filter(g => g);
-        // Calculate offset based on cursor
-        const offset = cursorData?.offset || options.offset || 0;
-        // Request limit + 1 to detect if there are more results
-        const requestLimit = limit + 1;
-        // Build v5 API payload for metrics
-        const body = {
-            start,
-            end,
-            requestType: 'time_series',
-            compositeQuery: {
-                queries: [{
-                        type: 'builder_query',
-                        spec: {
-                            name: 'A',
-                            signal: 'metrics',
-                            stepInterval: 60,
-                            aggregations: [{
-                                    metricName: sanitizedMetricName,
-                                    timeAggregation: 'rate',
-                                    spaceAggregation: spaceAgg,
-                                }],
-                            groupBy: sanitizedGroupBy.map(g => ({ name: g })),
-                            order: [],
-                            limit: requestLimit,
-                            offset,
-                            disabled: false,
-                        },
-                    }],
-            },
-        };
-        try {
-            const response = await this.fetch('/api/v5/query_range', {
-                method: 'POST',
-                body: JSON.stringify(body),
-            });
-            const results = [];
-            for (const result of response.data?.data?.results || []) {
-                for (const agg of result.aggregations || []) {
-                    for (const series of agg.series || []) {
-                        for (const point of series.values || []) {
-                            results.push({
-                                timestamp: new Date(point.timestamp).toISOString(),
-                                name: options.metricName,
-                                value: point.value,
-                                attributes: series.labels,
-                            });
-                        }
-                    }
-                }
-            }
-            // Determine if there are more results
-            const hasMore = results.length > limit;
-            const data = hasMore ? results.slice(0, limit) : results;
-            // Generate next cursor if there are more results
-            let nextCursor;
-            if (hasMore && data.length > 0) {
-                const lastItem = data[data.length - 1];
-                const lastTs = new Date(lastItem.timestamp).getTime();
-                nextCursor = encodeCursor({ ts: lastTs, offset: offset + limit });
-            }
-            return { data, nextCursor, hasMore };
-        }
-        catch (error) {
-            if (error instanceof Error && (error.message.includes('Circuit breaker') || error.message.includes('Rate limit'))) {
-                return { data: [], hasMore: false };
-            }
-            throw error;
-        }
-    }
-    async healthCheck() {
-        if (!this.baseUrl) {
-            return { status: 'error', message: 'SigNoz Query URL not configured. Set SIGNOZ_QUERY_URL', configured: false };
-        }
-        if (!this.apiKey) {
-            return { status: 'error', message: 'SigNoz API key not configured. Set SIGNOZ_API_KEY', configured: false };
-        }
-        if (this.circuitBreaker.getState() === 'open') {
-            return { status: 'error', message: 'Circuit breaker open - API temporarily unavailable', configured: true };
-        }
-        if (this.circuitBreaker.isRateLimited()) {
-            return { status: 'error', message: 'Rate limit exceeded - too many requests', configured: true };
-        }
-        try {
-            // Try a simple query as health check - query last 5 minutes of traces
-            const body = {
-                start: Date.now() - 5 * 60 * 1000,
-                end: Date.now(),
-                requestType: 'raw',
-                compositeQuery: {
-                    queries: [{
-                            type: 'builder_query',
-                            spec: {
-                                name: 'A',
-                                signal: 'traces',
-                                stepInterval: 60,
-                                aggregations: [],
-                                limit: 1,
-                                offset: 0,
-                                disabled: false,
-                            },
-                        }],
-                },
-            };
-            const response = await this.fetch('/api/v5/query_range', {
-                method: 'POST',
-                body: JSON.stringify(body),
-            });
-            if (response.status === 'success') {
-                return { status: 'ok', message: `Connected to ${this.baseUrl}`, configured: true };
-            }
-            return { status: 'error', message: 'Unexpected response from SigNoz API', configured: true };
-        }
-        catch (error) {
-            // Security: sanitize error messages - known safe errors pass through,
-            // others get a generic message to prevent information disclosure
-            const message = error instanceof Error ? error.message : 'Unknown error';
-            const isSafeMessage = message.includes('Circuit breaker') ||
-                message.includes('Rate limit') ||
-                message.includes('SigNoz') ||
-                message.includes('API');
-            return {
-                status: 'error',
-                message: isSafeMessage ? message : 'Connection failed',
-                configured: true,
-            };
-        }
-    }
-    /**
-     * Get SigNoz trace viewer URL for a trace ID
-     */
-    getTraceUrl(traceId) {
-        // The query API URL is already the correct format for the UI
-        return `${this.baseUrl}/trace/${traceId}`;
-    }
-}
-//# sourceMappingURL=signoz-api.js.map