feat: Phase 2 - incidents, logs, monitor expansion, query compiler (#8)

feat: add incidents, logs, monitor expansion, and query compiler (Phase 2)

Incidents (API v3): list, get, create, ack, resolve, escalate, delete,
timeline with colored status output (started/acknowledged/resolved).

Monitor expansion: update command with field-level edits, availability/SLA
endpoint, response-times with nested region breakdown.

Logs: sources listing via Telemetry API, raw SQL queries via ClickHouse
Query API with Basic auth, simple filter query compiler (level:error,
status:>=500, wildcards, AND/OR), and polling-based live tail.

Query compiler translates human filters to ClickHouse SQL with duration
parsing (1h, 30m, 7d), exact match, numeric comparison, wildcard, quoted
contains, and boolean combinators. Includes 9 unit tests.

Adds v3 HTTP helpers, shared parse_one/check_status, paginate_all_v3,
telemetry client factory, SqlClient with HTTP Basic auth, and optional
telemetry client in AppContext with env var override support.

Author: sounak98

src/adapters/http/incidents.rs

@@ -0,0 +1,66 @@
+use anyhow::Result;
+
+use super::retry::with_retry;
+use super::{HttpClient, check_status, parse_one};
+use crate::types::{CreateIncidentRequest, IncidentFilters, IncidentResource, TimelineEvent};
+
+impl HttpClient {
+    pub async fn list_incidents(&self, filters: &IncidentFilters) -> Result<Vec<IncidentResource>> {
+        let mut params: Vec<(&str, &str)> = Vec::new();
+        if let Some(ref status) = filters.status {
+            params.push(("status", status.as_str()));
+        }
+        if let Some(ref monitor_id) = filters.monitor_id {
+            params.push(("monitor_id", monitor_id.as_str()));
+        }
+        if let Some(ref from) = filters.from {
+            params.push(("from", from.as_str()));
+        }
+        if let Some(ref to) = filters.to {
+            params.push(("to", to.as_str()));
+        }
+
+        self.paginate_all_v3("/incidents", &params).await
+    }
+
+    pub async fn get_incident(&self, id: &str) -> Result<IncidentResource> {
+        let path = format!("/incidents/{id}");
+        let resp = with_retry(|| async { Ok(self.get_v3(&path).send().await?) }).await?;
+        parse_one(resp).await
+    }
+
+    pub async fn create_incident(&self, req: &CreateIncidentRequest) -> Result<IncidentResource> {
+        let resp =
+            with_retry(|| async { Ok(self.post_v3("/incidents").json(req).send().await?) }).await?;
+        parse_one(resp).await
+    }
+
+    pub async fn acknowledge_incident(&self, id: &str) -> Result<IncidentResource> {
+        let path = format!("/incidents/{id}/acknowledge");
+        let resp = with_retry(|| async { Ok(self.post_v3(&path).send().await?) }).await?;
+        parse_one(resp).await
+    }
+
+    pub async fn resolve_incident(&self, id: &str) -> Result<IncidentResource> {
+        let path = format!("/incidents/{id}/resolve");
+        let resp = with_retry(|| async { Ok(self.post_v3(&path).send().await?) }).await?;
+        parse_one(resp).await
+    }
+
+    pub async fn escalate_incident(&self, id: &str) -> Result<IncidentResource> {
+        let path = format!("/incidents/{id}/escalate");
+        let resp = with_retry(|| async { Ok(self.post_v3(&path).send().await?) }).await?;
+        parse_one(resp).await
+    }
+
+    pub async fn delete_incident(&self, id: &str) -> Result<()> {
+        let path = format!("/incidents/{id}");
+        let resp = with_retry(|| async { Ok(self.delete_v3(&path).send().await?) }).await?;
+        check_status(resp).await
+    }
+
+    pub async fn incident_timeline(&self, id: &str) -> Result<Vec<TimelineEvent>> {
+        let path = format!("/incidents/{id}/timeline");
+        self.paginate_all_v3(&path, &[]).await
+    }
+}

src/adapters/http/mod.rs

@@ -1,9 +1,15 @@
+pub mod incidents;
 pub mod pagination;
 pub mod retry;
+pub mod sql;
+pub mod telemetry;
 pub mod uptime;
 
+use anyhow::{Context, Result, bail};
 use reqwest::header::{AUTHORIZATION, CONTENT_TYPE, HeaderMap, HeaderValue};
 
+use crate::types::SingleResponse;
+
 pub struct HttpClient {
     client: reqwest::Client,
     base_url: String,
@@ -39,14 +45,27 @@ impl HttpClient {
         format!("{}{}", self.base_url, path)
     }
 
+    pub fn url_v3(&self, path: &str) -> String {
+        let v3_base = self.base_url.replace("/api/v2", "/api/v3");
+        format!("{}{}", v3_base, path)
+    }
+
     pub fn get(&self, path: &str) -> reqwest::RequestBuilder {
         self.client.get(self.url(path)).headers(self.headers())
     }
 
+    pub fn get_v3(&self, path: &str) -> reqwest::RequestBuilder {
+        self.client.get(self.url_v3(path)).headers(self.headers())
+    }
+
     pub fn post(&self, path: &str) -> reqwest::RequestBuilder {
         self.client.post(self.url(path)).headers(self.headers())
     }
 
+    pub fn post_v3(&self, path: &str) -> reqwest::RequestBuilder {
+        self.client.post(self.url_v3(path)).headers(self.headers())
+    }
+
     pub fn patch(&self, path: &str) -> reqwest::RequestBuilder {
         self.client.patch(self.url(path)).headers(self.headers())
     }
@@ -55,7 +74,34 @@ impl HttpClient {
         self.client.delete(self.url(path)).headers(self.headers())
     }
 
+    pub fn delete_v3(&self, path: &str) -> reqwest::RequestBuilder {
+        self.client
+            .delete(self.url_v3(path))
+            .headers(self.headers())
+    }
+
     pub fn get_absolute(&self, url: &str) -> reqwest::RequestBuilder {
         self.client.get(url).headers(self.headers())
     }
 }
+
+/// Parse a single-resource response, or return an API error.
+pub async fn parse_one<T: serde::de::DeserializeOwned>(resp: reqwest::Response) -> Result<T> {
+    let status = resp.status();
+    if !status.is_success() {
+        let body = resp.text().await.unwrap_or_default();
+        bail!("API error ({}): {}", status, body);
+    }
+    let single: SingleResponse<T> = resp.json().await.context("Failed to parse response")?;
+    Ok(single.data)
+}
+
+/// Check response status and return an error with body if not successful.
+pub async fn check_status(resp: reqwest::Response) -> Result<()> {
+    if !resp.status().is_success() {
+        let status = resp.status();
+        let body = resp.text().await.unwrap_or_default();
+        bail!("API error ({}): {}", status, body);
+    }
+    Ok(())
+}

src/adapters/http/pagination.rs

@@ -12,6 +12,25 @@ impl HttpClient {
         &self,
         path: &str,
         query_params: &[(&str, &str)],
+    ) -> Result<Vec<T>> {
+        self.paginate_all_with_builder(self.get(path), query_params)
+            .await
+    }
+
+    /// Fetches all pages from a v3 paginated endpoint, following `pagination.next` links.
+    pub async fn paginate_all_v3<T: DeserializeOwned>(
+        &self,
+        path: &str,
+        query_params: &[(&str, &str)],
+    ) -> Result<Vec<T>> {
+        self.paginate_all_with_builder(self.get_v3(path), query_params)
+            .await
+    }
+
+    async fn paginate_all_with_builder<T: DeserializeOwned>(
+        &self,
+        initial_req: reqwest::RequestBuilder,
+        query_params: &[(&str, &str)],
     ) -> Result<Vec<T>> {
         let mut all = Vec::new();
         let mut next_url: Option<String> = None;
@@ -20,7 +39,7 @@ impl HttpClient {
             let resp = if let Some(ref url) = next_url {
                 with_retry(|| async { Ok(self.get_absolute(url).send().await?) }).await?
             } else {
-                let mut req = self.get(path);
+                let mut req = initial_req.try_clone().expect("request clone failed");
                 for (k, v) in query_params {
                     req = req.query(&[(*k, *v)]);
                 }

src/adapters/http/sql.rs

@@ -0,0 +1,59 @@
+use anyhow::{Context, Result, bail};
+
+use super::retry::with_retry;
+
+pub struct SqlClient {
+    client: reqwest::Client,
+    base_url: String,
+    username: String,
+    password: String,
+}
+
+impl SqlClient {
+    pub fn new(region: &str, username: &str, password: &str) -> Self {
+        let base_url = format!("https://{region}-connect.betterstackdata.com");
+        Self {
+            client: reqwest::Client::new(),
+            base_url,
+            username: username.to_string(),
+            password: password.to_string(),
+        }
+    }
+
+    pub async fn query(&self, sql: &str) -> Result<String> {
+        let url = &self.base_url;
+        let resp = with_retry(|| async {
+            Ok(self
+                .client
+                .post(url)
+                .basic_auth(&self.username, Some(&self.password))
+                .body(format!("{sql} FORMAT JSONEachRow"))
+                .send()
+                .await?)
+        })
+        .await?;
+
+        let status = resp.status();
+        if !status.is_success() {
+            let body = resp.text().await.unwrap_or_default();
+            bail!("SQL query error ({}): {}", status, body);
+        }
+
+        resp.text().await.context("Failed to read SQL response")
+    }
+
+    pub async fn query_json(&self, sql: &str) -> Result<Vec<serde_json::Value>> {
+        let raw = self.query(sql).await?;
+        let mut rows = Vec::new();
+        for line in raw.lines() {
+            let line = line.trim();
+            if line.is_empty() {
+                continue;
+            }
+            let value: serde_json::Value =
+                serde_json::from_str(line).context("Failed to parse SQL result row")?;
+            rows.push(value);
+        }
+        Ok(rows)
+    }
+}

src/adapters/http/telemetry.rs

@@ -0,0 +1,21 @@
+use anyhow::Result;
+
+use super::retry::with_retry;
+use super::{HttpClient, parse_one};
+use crate::types::SourceResource;
+
+impl HttpClient {
+    pub fn telemetry(token: &str) -> Self {
+        Self::new("https://telemetry.betterstack.com/api/v1", token)
+    }
+
+    pub async fn list_sources(&self) -> Result<Vec<SourceResource>> {
+        self.paginate_all("/sources", &[]).await
+    }
+
+    pub async fn get_source(&self, id: &str) -> Result<SourceResource> {
+        let path = format!("/sources/{id}");
+        let resp = with_retry(|| async { Ok(self.get(&path).send().await?) }).await?;
+        parse_one(resp).await
+    }
+}

src/adapters/http/uptime.rs

@@ -1,29 +1,11 @@
-use anyhow::{Context, Result, bail};
+use anyhow::Result;
 
-use super::HttpClient;
 use super::retry::with_retry;
-use crate::types::{CreateMonitorRequest, MonitorFilters, MonitorResource, SingleResponse};
-
-/// Parse a single-resource response, or return an API error.
-async fn parse_one<T: serde::de::DeserializeOwned>(resp: reqwest::Response) -> Result<T> {
-    let status = resp.status();
-    if !status.is_success() {
-        let body = resp.text().await.unwrap_or_default();
-        bail!("API error ({}): {}", status, body);
-    }
-    let single: SingleResponse<T> = resp.json().await.context("Failed to parse response")?;
-    Ok(single.data)
-}
-
-/// Check response status and return an error with body if not successful.
-async fn check_status(resp: reqwest::Response) -> Result<()> {
-    if !resp.status().is_success() {
-        let status = resp.status();
-        let body = resp.text().await.unwrap_or_default();
-        bail!("API error ({}): {}", status, body);
-    }
-    Ok(())
-}
+use super::{HttpClient, check_status, parse_one};
+use crate::types::{
+    CreateMonitorRequest, MonitorFilters, MonitorResource, ResponseTimesResource, SlaResource,
+    UpdateMonitorRequest,
+};
 
 impl HttpClient {
     pub async fn list_monitors(&self, filters: &MonitorFilters) -> Result<Vec<MonitorResource>> {
@@ -64,9 +46,61 @@ impl HttpClient {
         parse_one(resp).await
     }
 
+    pub async fn update_monitor(
+        &self,
+        id: &str,
+        req: &UpdateMonitorRequest,
+    ) -> Result<MonitorResource> {
+        let path = format!("/monitors/{id}");
+        let resp = with_retry(|| async { Ok(self.patch(&path).json(req).send().await?) }).await?;
+        parse_one(resp).await
+    }
+
     pub async fn delete_monitor(&self, id: &str) -> Result<()> {
         let path = format!("/monitors/{id}");
         let resp = with_retry(|| async { Ok(self.delete_req(&path).send().await?) }).await?;
         check_status(resp).await
     }
+
+    pub async fn monitor_sla(
+        &self,
+        id: &str,
+        from: Option<&str>,
+        to: Option<&str>,
+    ) -> Result<SlaResource> {
+        let path = format!("/monitors/{id}/sla");
+        let resp = with_retry(|| async {
+            let mut req = self.get(&path);
+            if let Some(f) = from {
+                req = req.query(&[("from", f)]);
+            }
+            if let Some(t) = to {
+                req = req.query(&[("to", t)]);
+            }
+            Ok(req.send().await?)
+        })
+        .await?;
+        parse_one(resp).await
+    }
+
+    pub async fn monitor_response_times(
+        &self,
+        id: &str,
+        from: Option<&str>,
+        to: Option<&str>,
+    ) -> Result<ResponseTimesResource> {
+        let path = format!("/monitors/{id}/response-times");
+        let resp = with_retry(|| async {
+            let mut req = self.get(&path);
+            if let Some(f) = from {
+                req = req.query(&[("from", f)]);
+            }
+            if let Some(t) = to {
+                req = req.query(&[("to", t)]);
+            }
+            Ok(req.send().await?)
+        })
+        .await?;
+        parse_one(resp).await
+    }
 }