@aforoai/metering 1.0.0

package/dist/cjs/idempotency.js

@@ -0,0 +1,31 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateIdempotencyKey = generateIdempotencyKey;
+exports.generateRandomKey = generateRandomKey;
+const node_crypto_1 = require("node:crypto");
+/**
+ * Generate a deterministic idempotency key from event fields.
+ * Uses SHA-256, truncated to 32 hex chars for compact storage.
+ *
+ * Formula: SHA256(customerId + metricName + quantity + occurredAt)
+ *
+ * NOT the client default any more. `occurredAt` only carries millisecond
+ * precision, so two genuinely distinct events for the same customer + metric
+ * + quantity inside one millisecond hash to the same key and the ingestor
+ * drops the second as a DUPLICATE — silent under-billing. Kept exported for
+ * callers who deliberately want content-addressed dedup (e.g. replaying a
+ * fixed batch) and pass the result to `track({ idempotencyKey })` themselves.
+ */
+function generateIdempotencyKey(customerId, metricName, quantity, occurredAt) {
+    const input = `${customerId}:${metricName}:${quantity}:${occurredAt}`;
+    return (0, node_crypto_1.createHash)('sha256').update(input).digest('hex').substring(0, 32);
+}
+/**
+ * Generate a random UUID v4. This is the default key for an event whose caller
+ * supplied none: every event gets its own key, so no two distinct events can
+ * collide. Dedup stays opt-in via an explicit `idempotencyKey`.
+ */
+function generateRandomKey() {
+    return (0, node_crypto_1.randomUUID)();
+}
+//# sourceMappingURL=idempotency.js.map

package/dist/cjs/idempotency.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"idempotency.js","sourceRoot":"","sources":["../../src/idempotency.ts"],"names":[],"mappings":";;AAeA,wDAQC;AAOD,8CAEC;AAhCD,6CAAqD;AAErD;;;;;;;;;;;;GAYG;AACH,SAAgB,sBAAsB,CACpC,UAAkB,EAClB,UAAkB,EAClB,QAAgB,EAChB,UAAkB;IAElB,MAAM,KAAK,GAAG,GAAG,UAAU,IAAI,UAAU,IAAI,QAAQ,IAAI,UAAU,EAAE,CAAC;IACtE,OAAO,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED;;;;GAIG;AACH,SAAgB,iBAAiB;IAC/B,OAAO,IAAA,wBAAU,GAAE,CAAC;AACtB,CAAC"}

package/dist/cjs/index.d.ts

@@ -0,0 +1,9 @@
+export { AforoClient } from './client';
+export { expressMiddleware, middleware } from './middleware/express';
+export { fastifyPlugin } from './middleware/fastify';
+export { koaMiddleware } from './middleware/koa';
+export { normalizePath } from './path-normalizer';
+export { DEFAULT_METRIC_NAME } from './middleware/common';
+export { MAX_LENGTHS, MAX_QUANTITY_DECIMAL_PLACES, MAX_QUANTITY_INTEGER_DIGITS, describeLimitViolation, } from './limits';
+export type { AforoOptions, TrackEvent, MiddlewareOptions, FlushResult, BatchRequest, BatchResponse, } from './types';
+//# sourceMappingURL=index.d.ts.map

package/dist/cjs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EACL,WAAW,EACX,2BAA2B,EAC3B,2BAA2B,EAC3B,sBAAsB,GACvB,MAAM,UAAU,CAAC;AAElB,YAAY,EACV,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,WAAW,EACX,YAAY,EACZ,aAAa,GACd,MAAM,SAAS,CAAC"}

package/dist/cjs/index.js

@@ -0,0 +1,23 @@
+"use strict";
+// Public API for @aforoai/metering
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.describeLimitViolation = exports.MAX_QUANTITY_INTEGER_DIGITS = exports.MAX_QUANTITY_DECIMAL_PLACES = exports.MAX_LENGTHS = exports.DEFAULT_METRIC_NAME = exports.normalizePath = exports.koaMiddleware = exports.fastifyPlugin = exports.middleware = exports.expressMiddleware = exports.AforoClient = void 0;
+var client_1 = require("./client");
+Object.defineProperty(exports, "AforoClient", { enumerable: true, get: function () { return client_1.AforoClient; } });
+var express_1 = require("./middleware/express");
+Object.defineProperty(exports, "expressMiddleware", { enumerable: true, get: function () { return express_1.expressMiddleware; } });
+Object.defineProperty(exports, "middleware", { enumerable: true, get: function () { return express_1.middleware; } });
+var fastify_1 = require("./middleware/fastify");
+Object.defineProperty(exports, "fastifyPlugin", { enumerable: true, get: function () { return fastify_1.fastifyPlugin; } });
+var koa_1 = require("./middleware/koa");
+Object.defineProperty(exports, "koaMiddleware", { enumerable: true, get: function () { return koa_1.koaMiddleware; } });
+var path_normalizer_1 = require("./path-normalizer");
+Object.defineProperty(exports, "normalizePath", { enumerable: true, get: function () { return path_normalizer_1.normalizePath; } });
+var common_1 = require("./middleware/common");
+Object.defineProperty(exports, "DEFAULT_METRIC_NAME", { enumerable: true, get: function () { return common_1.DEFAULT_METRIC_NAME; } });
+var limits_1 = require("./limits");
+Object.defineProperty(exports, "MAX_LENGTHS", { enumerable: true, get: function () { return limits_1.MAX_LENGTHS; } });
+Object.defineProperty(exports, "MAX_QUANTITY_DECIMAL_PLACES", { enumerable: true, get: function () { return limits_1.MAX_QUANTITY_DECIMAL_PLACES; } });
+Object.defineProperty(exports, "MAX_QUANTITY_INTEGER_DIGITS", { enumerable: true, get: function () { return limits_1.MAX_QUANTITY_INTEGER_DIGITS; } });
+Object.defineProperty(exports, "describeLimitViolation", { enumerable: true, get: function () { return limits_1.describeLimitViolation; } });
+//# sourceMappingURL=index.js.map

package/dist/cjs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";AAAA,mCAAmC;;;AAEnC,mCAAuC;AAA9B,qGAAA,WAAW,OAAA;AACpB,gDAAqE;AAA5D,4GAAA,iBAAiB,OAAA;AAAE,qGAAA,UAAU,OAAA;AACtC,gDAAqD;AAA5C,wGAAA,aAAa,OAAA;AACtB,wCAAiD;AAAxC,oGAAA,aAAa,OAAA;AACtB,qDAAkD;AAAzC,gHAAA,aAAa,OAAA;AACtB,8CAA0D;AAAjD,6GAAA,mBAAmB,OAAA;AAC5B,mCAKkB;AAJhB,qGAAA,WAAW,OAAA;AACX,qHAAA,2BAA2B,OAAA;AAC3B,qHAAA,2BAA2B,OAAA;AAC3B,gHAAA,sBAAsB,OAAA"}

package/dist/cjs/limits.d.ts

@@ -0,0 +1,80 @@
+/**
+ * Client-side mirror of the ingestor's per-event field constraints.
+ *
+ * An event that breaks one of these is rejected by the ingestor and never
+ * billed. The server reports it per event (`errors[]` in the batch response,
+ * indexed), so the rest of the batch survives — but the SDK sends in the
+ * background, so that report reaches nobody: the usage is simply gone. Checking
+ * the same limits at `track()` surfaces the problem to the caller, at the call
+ * site that produced it, while the event can still be corrected.
+ *
+ * Source: `dto/IngestUsageEventRequest` (aforo-nextgen-usage-ingestor-service) —
+ * the `@Size` and `@Digits` bean constraints, which are compiled into the
+ * server and therefore identical in every environment.
+ *
+ * Deliberately NOT mirrored here: the timestamp window (`max-age-days`,
+ * `future-tolerance-minutes`) and the metadata cap (`max-metadata-bytes`) in
+ * `validation/UsageEventValidator`. Each is a per-environment property — a
+ * tenant may raise `max-age-days` to 365 for backfills — so enforcing the
+ * default here would make the SDK refuse usage its own server would accept and
+ * bill. Refusing real usage is a worse failure than the rejection it prevents.
+ * Only `occurredAt`'s shape is checked, since a malformed timestamp is invalid
+ * under every configuration.
+ *
+ * Nothing here truncates or rounds — that would change what is billed. The
+ * offending event is rejected instead, naming the field, the limit, and the
+ * offending value.
+ */
+/** Maximum characters the ingestor accepts per string field (`@Size(max = ...)`). */
+export declare const MAX_LENGTHS: {
+    readonly customerId: 64;
+    readonly metricName: 255;
+    readonly idempotencyKey: 255;
+    readonly productType: 20;
+    readonly traceId: 128;
+    readonly spanId: 32;
+    readonly sessionId: 64;
+    readonly agentId: 36;
+    readonly toolName: 64;
+    readonly endpointPath: 512;
+    readonly httpMethod: 16;
+};
+/** `@Digits(integer = 14, fraction = 6)` — `usage_events.quantity` is NUMERIC(20,6). */
+export declare const MAX_QUANTITY_INTEGER_DIGITS = 14;
+export declare const MAX_QUANTITY_DECIMAL_PLACES = 6;
+/**
+ * Integer and decimal digit counts as the ingestor's `@Digits` sees them, i.e.
+ * as `BigDecimal` reads the number the SDK puts on the wire:
+ * `integerDigits = precision - scale`, `decimalPlaces = max(scale, 0)`.
+ *
+ * Works from the serialized text so exponent notation (`1e+21`, which
+ * `JSON.stringify` emits for large numbers) is counted the same way the server
+ * will count it.
+ */
+export declare function quantityDigits(serialized: string): {
+    integerDigits: number;
+    decimalPlaces: number;
+};
+/** The already-resolved event fields the limits apply to. */
+export interface LimitCheckedEvent {
+    customerId?: unknown;
+    metricName?: unknown;
+    quantity: number;
+    idempotencyKey?: unknown;
+    occurredAt: string;
+    productType?: unknown;
+    endpointPath?: unknown;
+    httpMethod?: unknown;
+    traceId?: unknown;
+    spanId?: unknown;
+    sessionId?: unknown;
+    agentId?: unknown;
+    toolName?: unknown;
+}
+/**
+ * Describe the first ingestor constraint this event breaks, or `null` when it
+ * would be accepted. Callers that must not throw (the framework middlewares)
+ * can use this to skip an event instead.
+ */
+export declare function describeLimitViolation(event: LimitCheckedEvent): string | null;
+//# sourceMappingURL=limits.d.ts.map

package/dist/cjs/limits.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,qFAAqF;AACrF,eAAO,MAAM,WAAW;;;;;;;;;;;;CAYd,CAAC;AAEX,wFAAwF;AACxF,eAAO,MAAM,2BAA2B,KAAK,CAAC;AAC9C,eAAO,MAAM,2BAA2B,IAAI,CAAC;AAoC7C;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG;IAAE,aAAa,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAA;CAAE,CAYnG;AA+BD,6DAA6D;AAC7D,MAAM,WAAW,iBAAiB;IAChC,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,iBAAiB,GAAG,MAAM,GAAG,IAAI,CAe9E"}

package/dist/cjs/limits.js

@@ -0,0 +1,143 @@
+"use strict";
+/**
+ * Client-side mirror of the ingestor's per-event field constraints.
+ *
+ * An event that breaks one of these is rejected by the ingestor and never
+ * billed. The server reports it per event (`errors[]` in the batch response,
+ * indexed), so the rest of the batch survives — but the SDK sends in the
+ * background, so that report reaches nobody: the usage is simply gone. Checking
+ * the same limits at `track()` surfaces the problem to the caller, at the call
+ * site that produced it, while the event can still be corrected.
+ *
+ * Source: `dto/IngestUsageEventRequest` (aforo-nextgen-usage-ingestor-service) —
+ * the `@Size` and `@Digits` bean constraints, which are compiled into the
+ * server and therefore identical in every environment.
+ *
+ * Deliberately NOT mirrored here: the timestamp window (`max-age-days`,
+ * `future-tolerance-minutes`) and the metadata cap (`max-metadata-bytes`) in
+ * `validation/UsageEventValidator`. Each is a per-environment property — a
+ * tenant may raise `max-age-days` to 365 for backfills — so enforcing the
+ * default here would make the SDK refuse usage its own server would accept and
+ * bill. Refusing real usage is a worse failure than the rejection it prevents.
+ * Only `occurredAt`'s shape is checked, since a malformed timestamp is invalid
+ * under every configuration.
+ *
+ * Nothing here truncates or rounds — that would change what is billed. The
+ * offending event is rejected instead, naming the field, the limit, and the
+ * offending value.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_QUANTITY_DECIMAL_PLACES = exports.MAX_QUANTITY_INTEGER_DIGITS = exports.MAX_LENGTHS = void 0;
+exports.quantityDigits = quantityDigits;
+exports.describeLimitViolation = describeLimitViolation;
+/** Maximum characters the ingestor accepts per string field (`@Size(max = ...)`). */
+exports.MAX_LENGTHS = {
+    customerId: 64,
+    metricName: 255,
+    idempotencyKey: 255,
+    productType: 20,
+    traceId: 128,
+    spanId: 32,
+    sessionId: 64,
+    agentId: 36,
+    toolName: 64,
+    endpointPath: 512,
+    httpMethod: 16,
+};
+/** `@Digits(integer = 14, fraction = 6)` — `usage_events.quantity` is NUMERIC(20,6). */
+exports.MAX_QUANTITY_INTEGER_DIGITS = 14;
+exports.MAX_QUANTITY_DECIMAL_PLACES = 6;
+/**
+ * ISO-8601 date-time, the shape Jackson can read into an `Instant`. The zone
+ * designator is optional here: the ingestor's example values all carry `Z`, but
+ * an offset-less value is not provably rejected, and falsely rejecting one
+ * would drop a billable event.
+ */
+const ISO_DATE_TIME = /^\d{4}-\d{2}-\d{2}[Tt]\d{2}:\d{2}(:\d{2}(\.\d{1,9})?)?([Zz]|[+-]\d{2}:?\d{2})?$/;
+/**
+ * Length as the ingestor counts it: `String.length()` in Java is UTF-16 code
+ * units, which is exactly what `String.prototype.length` returns.
+ */
+function lengthOf(value) {
+    return value.length;
+}
+function lengthError(field, value) {
+    if (value === undefined || value === null)
+        return null;
+    const text = String(value);
+    const max = exports.MAX_LENGTHS[field];
+    const len = lengthOf(text);
+    if (len <= max)
+        return null;
+    return `${field} is ${len} characters, exceeding the ingestor's ${max}-character limit `
+        + `(value starts "${text.slice(0, 32)}"). Shorten it — the SDK will not truncate it, `
+        + 'because a truncated id bills the wrong thing.';
+}
+/**
+ * Integer and decimal digit counts as the ingestor's `@Digits` sees them, i.e.
+ * as `BigDecimal` reads the number the SDK puts on the wire:
+ * `integerDigits = precision - scale`, `decimalPlaces = max(scale, 0)`.
+ *
+ * Works from the serialized text so exponent notation (`1e+21`, which
+ * `JSON.stringify` emits for large numbers) is counted the same way the server
+ * will count it.
+ */
+function quantityDigits(serialized) {
+    const match = /^[+-]?(\d*)(?:\.(\d*))?(?:[eE]([+-]?\d+))?$/.exec(serialized.trim());
+    if (!match)
+        return { integerDigits: 0, decimalPlaces: 0 };
+    const intPart = match[1] ?? '';
+    const fracPart = match[2] ?? '';
+    const exponent = match[3] ? parseInt(match[3], 10) : 0;
+    const digits = (intPart + fracPart).replace(/^0+/, '');
+    const precision = digits.length === 0 ? 1 : digits.length;
+    const scale = fracPart.length - exponent;
+    return { integerDigits: precision - scale, decimalPlaces: Math.max(scale, 0) };
+}
+function quantityError(quantity) {
+    // JSON.stringify is what the transport uses, so this is the exact text the
+    // ingestor will parse into the BigDecimal that @Digits inspects.
+    const serialized = JSON.stringify(quantity);
+    const { integerDigits, decimalPlaces } = quantityDigits(String(serialized));
+    if (integerDigits > exports.MAX_QUANTITY_INTEGER_DIGITS) {
+        return `quantity ${serialized} has ${integerDigits} integer digits, exceeding the ingestor's `
+            + `limit of ${exports.MAX_QUANTITY_INTEGER_DIGITS} (usage_events.quantity is NUMERIC(20,6)).`;
+    }
+    if (decimalPlaces > exports.MAX_QUANTITY_DECIMAL_PLACES) {
+        return `quantity ${serialized} has ${decimalPlaces} decimal places, exceeding the ingestor's `
+            + `limit of ${exports.MAX_QUANTITY_DECIMAL_PLACES}. Round it yourself before tracking — the SDK will `
+            + 'not round it, because that would change the quantity you are billed for.';
+    }
+    return null;
+}
+function occurredAtError(occurredAt) {
+    if (!ISO_DATE_TIME.test(occurredAt)) {
+        return `occurredAt "${occurredAt}" is not an ISO-8601 timestamp `
+            + '(expected e.g. "2026-03-01T14:30:00Z").';
+    }
+    if (Number.isNaN(Date.parse(occurredAt))) {
+        return `occurredAt "${occurredAt}" is not a valid date.`;
+    }
+    return null;
+}
+/**
+ * Describe the first ingestor constraint this event breaks, or `null` when it
+ * would be accepted. Callers that must not throw (the framework middlewares)
+ * can use this to skip an event instead.
+ */
+function describeLimitViolation(event) {
+    if (event.idempotencyKey !== undefined && event.idempotencyKey !== null
+        && !String(event.idempotencyKey).trim()) {
+        return 'idempotencyKey must not be blank when provided.';
+    }
+    for (const field of Object.keys(exports.MAX_LENGTHS)) {
+        const problem = lengthError(field, event[field]);
+        if (problem)
+            return problem;
+    }
+    const quantityProblem = quantityError(event.quantity);
+    if (quantityProblem)
+        return quantityProblem;
+    return occurredAtError(event.occurredAt);
+}
+//# sourceMappingURL=limits.js.map

package/dist/cjs/limits.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../../src/limits.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;;AAgEH,wCAYC;AAqDD,wDAeC;AA9ID,qFAAqF;AACxE,QAAA,WAAW,GAAG;IACzB,UAAU,EAAE,EAAE;IACd,UAAU,EAAE,GAAG;IACf,cAAc,EAAE,GAAG;IACnB,WAAW,EAAE,EAAE;IACf,OAAO,EAAE,GAAG;IACZ,MAAM,EAAE,EAAE;IACV,SAAS,EAAE,EAAE;IACb,OAAO,EAAE,EAAE;IACX,QAAQ,EAAE,EAAE;IACZ,YAAY,EAAE,GAAG;IACjB,UAAU,EAAE,EAAE;CACN,CAAC;AAEX,wFAAwF;AAC3E,QAAA,2BAA2B,GAAG,EAAE,CAAC;AACjC,QAAA,2BAA2B,GAAG,CAAC,CAAC;AAK7C;;;;;GAKG;AACH,MAAM,aAAa,GACjB,iFAAiF,CAAC;AAKpF;;;GAGG;AACH,SAAS,QAAQ,CAAC,KAAa;IAC7B,OAAO,KAAK,CAAC,MAAM,CAAC;AACtB,CAAC;AAED,SAAS,WAAW,CAAC,KAAyB,EAAE,KAAc;IAC5D,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,GAAG,GAAG,mBAAW,CAAC,KAAK,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3B,IAAI,GAAG,IAAI,GAAG;QAAE,OAAO,IAAI,CAAC;IAC5B,OAAO,GAAG,KAAK,OAAO,GAAG,yCAAyC,GAAG,mBAAmB;UACpF,kBAAkB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,iDAAiD;UACpF,+CAA+C,CAAC;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,SAAgB,cAAc,CAAC,UAAkB;IAC/C,MAAM,KAAK,GAAG,6CAA6C,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;IACpF,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,aAAa,EAAE,CAAC,EAAE,aAAa,EAAE,CAAC,EAAE,CAAC;IAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC/B,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEvD,MAAM,MAAM,GAAG,CAAC,OAAO,GAAG,QAAQ,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IAC1D,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,GAAG,QAAQ,CAAC;IAEzC,OAAO,EAAE,aAAa,EAAE,SAAS,GAAG,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,2EAA2E;IAC3E,iEAAiE;IACjE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC5C,MAAM,EAAE,aAAa,EAAE,aAAa,EAAE,GAAG,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;IAE5E,IAAI,aAAa,GAAG,mCAA2B,EAAE,CAAC;QAChD,OAAO,YAAY,UAAU,QAAQ,aAAa,4CAA4C;cAC1F,YAAY,mCAA2B,4CAA4C,CAAC;IAC1F,CAAC;IACD,IAAI,aAAa,GAAG,mCAA2B,EAAE,CAAC;QAChD,OAAO,YAAY,UAAU,QAAQ,aAAa,4CAA4C;cAC1F,YAAY,mCAA2B,qDAAqD;cAC5F,0EAA0E,CAAC;IACjF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB;IACzC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACpC,OAAO,eAAe,UAAU,iCAAiC;cAC7D,yCAAyC,CAAC;IAChD,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QACzC,OAAO,eAAe,UAAU,wBAAwB,CAAC;IAC3D,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAmBD;;;;GAIG;AACH,SAAgB,sBAAsB,CAAC,KAAwB;IAC7D,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS,IAAI,KAAK,CAAC,cAAc,KAAK,IAAI;WAChE,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,OAAO,iDAAiD,CAAC;IAC3D,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,mBAAW,CAAyB,EAAE,CAAC;QACrE,MAAM,OAAO,GAAG,WAAW,CAAC,KAAK,EAAG,KAA4C,CAAC,KAAK,CAAC,CAAC,CAAC;QACzF,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC9B,CAAC;IAED,MAAM,eAAe,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtD,IAAI,eAAe;QAAE,OAAO,eAAe,CAAC;IAE5C,OAAO,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;AAC3C,CAAC"}

package/dist/cjs/middleware/common.d.ts

@@ -0,0 +1,22 @@
+import { MiddlewareOptions } from '../types';
+/**
+ * Metric recorded for each request when `metricName` is not configured.
+ *
+ * It must exist in the tenant's Aforo metric catalog: the ingestor rejects an
+ * unknown metric, and because it validates a batch as a whole, one such event
+ * fails the entire batch with 400. The previous default, `"METHOD /path"`, is a
+ * name no catalog contains, so every event failed out of the box.
+ */
+export declare const DEFAULT_METRIC_NAME = "api_calls";
+/**
+ * CORS preflights are a browser protocol detail, not a billable call, and carry
+ * no credentials -- so they never have a customer. They are never metered.
+ */
+export declare function isPreflight(method: string | undefined): boolean;
+/** Resolve the metric: resolver function, then fixed name, then DEFAULT_METRIC_NAME. */
+export declare function resolveMetricName(options: MiddlewareOptions, req: any, res: any): string;
+/** Request path without its query string, capped to what the ingestor accepts. */
+export declare function endpointPathOf(url: string): string;
+/** First non-empty string among the candidates, or null. */
+export declare function firstNonEmpty(...values: unknown[]): string | null;
+//# sourceMappingURL=common.d.ts.map

package/dist/cjs/middleware/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../../src/middleware/common.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAE7C;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAE/C;;;GAGG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAE/D;AAED,wFAAwF;AACxF,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,CAKxF;AAKD,kFAAkF;AAClF,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAElD;AAED,4DAA4D;AAC5D,wBAAgB,aAAa,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,GAAG,IAAI,CAOjE"}

package/dist/cjs/middleware/common.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_METRIC_NAME = void 0;
+exports.isPreflight = isPreflight;
+exports.resolveMetricName = resolveMetricName;
+exports.endpointPathOf = endpointPathOf;
+exports.firstNonEmpty = firstNonEmpty;
+/**
+ * Metric recorded for each request when `metricName` is not configured.
+ *
+ * It must exist in the tenant's Aforo metric catalog: the ingestor rejects an
+ * unknown metric, and because it validates a batch as a whole, one such event
+ * fails the entire batch with 400. The previous default, `"METHOD /path"`, is a
+ * name no catalog contains, so every event failed out of the box.
+ */
+exports.DEFAULT_METRIC_NAME = 'api_calls';
+/**
+ * CORS preflights are a browser protocol detail, not a billable call, and carry
+ * no credentials -- so they never have a customer. They are never metered.
+ */
+function isPreflight(method) {
+    return (method || '').toUpperCase() === 'OPTIONS';
+}
+/** Resolve the metric: resolver function, then fixed name, then DEFAULT_METRIC_NAME. */
+function resolveMetricName(options, req, res) {
+    if (typeof options.metricName === 'function') {
+        return options.metricName(req, res) || exports.DEFAULT_METRIC_NAME;
+    }
+    return options.metricName || exports.DEFAULT_METRIC_NAME;
+}
+/** Longest endpointPath the ingestor accepts. */
+const MAX_ENDPOINT_PATH = 512;
+/** Request path without its query string, capped to what the ingestor accepts. */
+function endpointPathOf(url) {
+    return (url.split('?')[0] || '/').slice(0, MAX_ENDPOINT_PATH);
+}
+/** First non-empty string among the candidates, or null. */
+function firstNonEmpty(...values) {
+    for (const v of values) {
+        if (v === undefined || v === null)
+            continue;
+        const s = String(Array.isArray(v) ? v[0] : v).trim();
+        if (s)
+            return s;
+    }
+    return null;
+}
+//# sourceMappingURL=common.js.map

package/dist/cjs/middleware/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../../src/middleware/common.ts"],"names":[],"mappings":";;;AAgBA,kCAEC;AAGD,8CAKC;AAMD,wCAEC;AAGD,sCAOC;AA1CD;;;;;;;GAOG;AACU,QAAA,mBAAmB,GAAG,WAAW,CAAC;AAE/C;;;GAGG;AACH,SAAgB,WAAW,CAAC,MAA0B;IACpD,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,KAAK,SAAS,CAAC;AACpD,CAAC;AAED,wFAAwF;AACxF,SAAgB,iBAAiB,CAAC,OAA0B,EAAE,GAAQ,EAAE,GAAQ;IAC9E,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;QAC7C,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,2BAAmB,CAAC;IAC7D,CAAC;IACD,OAAO,OAAO,CAAC,UAAU,IAAI,2BAAmB,CAAC;AACnD,CAAC;AAED,iDAAiD;AACjD,MAAM,iBAAiB,GAAG,GAAG,CAAC;AAE9B,kFAAkF;AAClF,SAAgB,cAAc,CAAC,GAAW;IACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC;AAChE,CAAC;AAED,4DAA4D;AAC5D,SAAgB,aAAa,CAAC,GAAG,MAAiB;IAChD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI;YAAE,SAAS;QAC5C,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrD,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/cjs/middleware/express.d.ts

@@ -0,0 +1,15 @@
+import { MiddlewareOptions } from '../types';
+/**
+ * Express middleware that automatically captures API usage events.
+ *
+ * Hooks into `res.on('finish')` — runs AFTER the response is sent to the client.
+ * Zero latency impact on the API call itself.
+ *
+ * ```typescript
+ * import { expressMiddleware } from '@aforoai/metering/middleware/express';
+ * app.use(expressMiddleware({ apiKey: process.env.AFORO_API_KEY, productType: 'API' }));
+ * ```
+ */
+export declare function expressMiddleware(options: MiddlewareOptions): (req: any, res: any, next: any) => void;
+export declare const middleware: typeof expressMiddleware;
+//# sourceMappingURL=express.d.ts.map

package/dist/cjs/middleware/express.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.d.ts","sourceRoot":"","sources":["../../../src/middleware/express.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAK7C;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,iBAAiB,IAUlB,KAAK,GAAG,EAAE,KAAK,GAAG,EAAE,MAAM,GAAG,UAgEtE;AAeD,eAAO,MAAM,UAAU,0BAAoB,CAAC"}

package/dist/cjs/middleware/express.js

@@ -0,0 +1,104 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.middleware = void 0;
+exports.expressMiddleware = expressMiddleware;
+const client_1 = require("../client");
+const common_1 = require("./common");
+const DEFAULT_EXCLUDE_PATHS = ['/health', '/ready', '/metrics', '/favicon.ico'];
+/**
+ * Express middleware that automatically captures API usage events.
+ *
+ * Hooks into `res.on('finish')` — runs AFTER the response is sent to the client.
+ * Zero latency impact on the API call itself.
+ *
+ * ```typescript
+ * import { expressMiddleware } from '@aforoai/metering/middleware/express';
+ * app.use(expressMiddleware({ apiKey: process.env.AFORO_API_KEY, productType: 'API' }));
+ * ```
+ */
+function expressMiddleware(options) {
+    const client = new client_1.AforoClient({
+        apiKey: options.apiKey,
+        baseUrl: options.baseUrl,
+        ...options.clientOptions,
+    });
+    const excludePaths = options.excludePaths ?? DEFAULT_EXCLUDE_PATHS;
+    const excludeStatusCodes = options.excludeStatusCodes ?? [];
+    return function aforoMeteringMiddleware(req, res, next) {
+        // Capture timing
+        const startTime = Date.now();
+        res.on('finish', () => {
+            try {
+                const path = req.originalUrl || req.url || '/';
+                const method = req.method || 'UNKNOWN';
+                const statusCode = res.statusCode || 0;
+                // Check exclusions
+                if ((0, common_1.isPreflight)(method))
+                    return;
+                if (excludePaths.some((p) => path.startsWith(p)))
+                    return;
+                if (excludeStatusCodes.includes(statusCode))
+                    return;
+                // Resolve metric name (must be a metric in the tenant's catalog)
+                const metricName = (0, common_1.resolveMetricName)(options, req, res);
+                // Resolve quantity
+                let quantity;
+                if (typeof options.quantity === 'function') {
+                    quantity = options.quantity(req, res);
+                }
+                else {
+                    quantity = options.quantity ?? 1;
+                }
+                // Resolve customer ID
+                let customerId;
+                if (typeof options.customerId === 'function') {
+                    customerId = options.customerId(req);
+                }
+                else if (options.customerId) {
+                    customerId = options.customerId;
+                }
+                else {
+                    customerId = extractCustomerId(req);
+                }
+                if (!customerId)
+                    return; // Can't meter without a customer
+                if (!(quantity > 0))
+                    return; // The ingestor rejects quantity <= 0
+                // Build metadata
+                let metadata;
+                if (options.metadata) {
+                    metadata = options.metadata(req, res);
+                }
+                client.track({
+                    customerId,
+                    metricName,
+                    quantity,
+                    metadata,
+                    productType: options.productType,
+                    endpointPath: (0, common_1.endpointPathOf)(path),
+                    httpMethod: method,
+                    statusCode,
+                    responseTimeMs: Date.now() - startTime,
+                }).catch(() => { }); // Fire-and-forget
+            }
+            catch {
+                // Never let metering errors affect the API
+            }
+        });
+        next();
+    };
+}
+/**
+ * Default customer resolution: authenticated user id, then X-Customer-Id.
+ *
+ * The caller's X-Api-Key header is deliberately NOT used: that is the end
+ * user's secret, and using it as customerId wrote credentials into billing data
+ * while never matching an Aforo customer. Configure `customerId` to map your
+ * callers to Aforo customer ids.
+ */
+function extractCustomerId(req) {
+    return (0, common_1.firstNonEmpty)(req.user?.id, req.user?.sub, req.headers?.['x-customer-id']);
+}
+// Also export as `middleware` for convenience
+exports.middleware = expressMiddleware;
+//# sourceMappingURL=express.js.map

package/dist/cjs/middleware/express.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"express.js","sourceRoot":"","sources":["../../../src/middleware/express.ts"],"names":[],"mappings":";;;AAiBA,8CA0EC;AA3FD,sCAAwC;AAExC,qCAAyF;AAEzF,MAAM,qBAAqB,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;AAEhF;;;;;;;;;;GAUG;AACH,SAAgB,iBAAiB,CAAC,OAA0B;IAC1D,MAAM,MAAM,GAAG,IAAI,oBAAW,CAAC;QAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,OAAO,CAAC,aAAa;KACzB,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC;IACnE,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAE5D,OAAO,SAAS,uBAAuB,CAAC,GAAQ,EAAE,GAAQ,EAAE,IAAS;QACnE,iBAAiB;QACjB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAE7B,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YACpB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAW,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC;gBACvD,MAAM,MAAM,GAAW,GAAG,CAAC,MAAM,IAAI,SAAS,CAAC;gBAC/C,MAAM,UAAU,GAAW,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;gBAE/C,mBAAmB;gBACnB,IAAI,IAAA,oBAAW,EAAC,MAAM,CAAC;oBAAE,OAAO;gBAChC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;oBAAE,OAAO;gBACjE,IAAI,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC;oBAAE,OAAO;gBAEpD,iEAAiE;gBACjE,MAAM,UAAU,GAAG,IAAA,0BAAiB,EAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;gBAExD,mBAAmB;gBACnB,IAAI,QAAgB,CAAC;gBACrB,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;oBAC3C,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACxC,CAAC;qBAAM,CAAC;oBACN,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;gBACnC,CAAC;gBAED,sBAAsB;gBACtB,IAAI,UAAyB,CAAC;gBAC9B,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;oBAC7C,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBACvC,CAAC;qBAAM,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;oBAC9B,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;gBAClC,CAAC;qBAAM,CAAC;oBACN,UAAU,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;gBACtC,CAAC;gBAED,IAAI,CAAC,UAAU;oBAAE,OAAO,CAAC,iCAAiC;gBAC1D,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;oBAAE,OAAO,CAAC,qCAAqC;gBAElE,iBAAiB;gBACjB,IAAI,QAA+D,CAAC;gBACpE,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;oBACrB,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBACxC,CAAC;gBAED,MAAM,CAAC,KAAK,CAAC;oBACX,UAAU;oBACV,UAAU;oBACV,QAAQ;oBACR,QAAQ;oBACR,WAAW,EAAE,OAAO,CAAC,WAAW;oBAChC,YAAY,EAAE,IAAA,uBAAc,EAAC,IAAI,CAAC;oBAClC,UAAU,EAAE,MAAM;oBAClB,UAAU;oBACV,cAAc,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;iBACvC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,kBAAkB;YAExC,CAAC;YAAC,MAAM,CAAC;gBACP,2CAA2C;YAC7C,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,GAAQ;IACjC,OAAO,IAAA,sBAAa,EAAC,GAAG,CAAC,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,8CAA8C;AACjC,QAAA,UAAU,GAAG,iBAAiB,CAAC"}

package/dist/cjs/middleware/fastify.d.ts

@@ -0,0 +1,13 @@
+import { MiddlewareOptions } from '../types';
+/**
+ * Fastify plugin that automatically captures API usage events.
+ *
+ * Uses the `onResponse` hook — runs AFTER the response is sent.
+ *
+ * ```typescript
+ * import { fastifyPlugin } from '@aforoai/metering/middleware/fastify';
+ * fastify.register(fastifyPlugin, { apiKey: process.env.AFORO_API_KEY, productType: 'API' });
+ * ```
+ */
+export declare function fastifyPlugin(fastify: any, options: MiddlewareOptions): Promise<void>;
+//# sourceMappingURL=fastify.d.ts.map

package/dist/cjs/middleware/fastify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastify.d.ts","sourceRoot":"","sources":["../../../src/middleware/fastify.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAK7C;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,iBAAiB,iBAwE3E"}

package/dist/cjs/middleware/fastify.js

@@ -0,0 +1,90 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.fastifyPlugin = fastifyPlugin;
+const client_1 = require("../client");
+const common_1 = require("./common");
+const DEFAULT_EXCLUDE_PATHS = ['/health', '/ready', '/metrics', '/favicon.ico'];
+/**
+ * Fastify plugin that automatically captures API usage events.
+ *
+ * Uses the `onResponse` hook — runs AFTER the response is sent.
+ *
+ * ```typescript
+ * import { fastifyPlugin } from '@aforoai/metering/middleware/fastify';
+ * fastify.register(fastifyPlugin, { apiKey: process.env.AFORO_API_KEY, productType: 'API' });
+ * ```
+ */
+async function fastifyPlugin(fastify, options) {
+    const client = new client_1.AforoClient({
+        apiKey: options.apiKey,
+        baseUrl: options.baseUrl,
+        ...options.clientOptions,
+    });
+    const excludePaths = options.excludePaths ?? DEFAULT_EXCLUDE_PATHS;
+    const excludeStatusCodes = options.excludeStatusCodes ?? [];
+    fastify.addHook('onResponse', (request, reply, done) => {
+        try {
+            const path = request.url || '/';
+            const method = request.method || 'UNKNOWN';
+            const statusCode = reply.statusCode || 0;
+            if ((0, common_1.isPreflight)(method))
+                return done();
+            if (excludePaths.some((p) => path.startsWith(p)))
+                return done();
+            if (excludeStatusCodes.includes(statusCode))
+                return done();
+            const metricName = (0, common_1.resolveMetricName)(options, request, reply);
+            let quantity;
+            if (typeof options.quantity === 'function') {
+                quantity = options.quantity(request, reply);
+            }
+            else {
+                quantity = options.quantity ?? 1;
+            }
+            let customerId;
+            if (typeof options.customerId === 'function') {
+                customerId = options.customerId(request);
+            }
+            else if (options.customerId) {
+                customerId = options.customerId;
+            }
+            else {
+                // Never the caller's X-Api-Key: that is a secret, not a customer id.
+                customerId = (0, common_1.firstNonEmpty)(request.user?.id, request.headers?.['x-customer-id']);
+            }
+            if (!customerId)
+                return done();
+            if (!(quantity > 0))
+                return done(); // The ingestor rejects quantity <= 0
+            let metadata;
+            if (options.metadata) {
+                metadata = options.metadata(request, reply);
+            }
+            const elapsed = typeof reply.elapsedTime === 'number'
+                ? reply.elapsedTime
+                : typeof reply.getResponseTime === 'function' ? reply.getResponseTime() : undefined;
+            client.track({
+                customerId,
+                metricName,
+                quantity,
+                metadata,
+                productType: options.productType,
+                endpointPath: (0, common_1.endpointPathOf)(path),
+                httpMethod: method,
+                statusCode,
+                ...(typeof elapsed === 'number' ? { responseTimeMs: Math.round(elapsed) } : {}),
+            }).catch(() => { });
+        }
+        catch {
+            // Never let metering affect the API
+        }
+        done();
+    });
+    fastify.addHook('onClose', async () => {
+        await client.shutdown();
+    });
+}
+// Mark as fastify plugin
+fastifyPlugin[Symbol.for('skip-override')] = true;
+fastifyPlugin[Symbol.for('fastify.display-name')] = 'aforo-metering';
+//# sourceMappingURL=fastify.js.map

package/dist/cjs/middleware/fastify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"fastify.js","sourceRoot":"","sources":["../../../src/middleware/fastify.ts"],"names":[],"mappings":";;AAgBA,sCAwEC;AAxFD,sCAAwC;AAExC,qCAAyF;AAEzF,MAAM,qBAAqB,GAAG,CAAC,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;AAEhF;;;;;;;;;GASG;AACI,KAAK,UAAU,aAAa,CAAC,OAAY,EAAE,OAA0B;IAC1E,MAAM,MAAM,GAAG,IAAI,oBAAW,CAAC;QAC7B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,GAAG,OAAO,CAAC,aAAa;KACzB,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,OAAO,CAAC,YAAY,IAAI,qBAAqB,CAAC;IACnE,MAAM,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,IAAI,EAAE,CAAC;IAE5D,OAAO,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,OAAY,EAAE,KAAU,EAAE,IAAS,EAAE,EAAE;QACpE,IAAI,CAAC;YACH,MAAM,IAAI,GAAW,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC;YACxC,MAAM,MAAM,GAAW,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC;YACnD,MAAM,UAAU,GAAW,KAAK,CAAC,UAAU,IAAI,CAAC,CAAC;YAEjD,IAAI,IAAA,oBAAW,EAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YACvC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YACxE,IAAI,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC;YAE3D,MAAM,UAAU,GAAG,IAAA,0BAAiB,EAAC,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;YAE9D,IAAI,QAAgB,CAAC;YACrB,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;gBAC3C,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;iBAAM,CAAC;gBACN,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,CAAC,CAAC;YACnC,CAAC;YAED,IAAI,UAAyB,CAAC;YAC9B,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;gBAC7C,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;YAC3C,CAAC;iBAAM,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;gBAC9B,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACN,qEAAqE;gBACrE,UAAU,GAAG,IAAA,sBAAa,EAAE,OAAe,CAAC,IAAI,EAAE,EAAE,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;YAC5F,CAAC;YAED,IAAI,CAAC,UAAU;gBAAE,OAAO,IAAI,EAAE,CAAC;YAC/B,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,EAAE,CAAC,CAAC,qCAAqC;YAEzE,IAAI,QAA+D,CAAC;YACpE,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC;gBACrB,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC9C,CAAC;YAED,MAAM,OAAO,GAAG,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;gBACnD,CAAC,CAAC,KAAK,CAAC,WAAW;gBACnB,CAAC,CAAC,OAAO,KAAK,CAAC,eAAe,KAAK,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAEtF,MAAM,CAAC,KAAK,CAAC;gBACX,UAAU;gBACV,UAAU;gBACV,QAAQ;gBACR,QAAQ;gBACR,WAAW,EAAE,OAAO,CAAC,WAAW;gBAChC,YAAY,EAAE,IAAA,uBAAc,EAAC,IAAI,CAAC;gBAClC,UAAU,EAAE,MAAM;gBAClB,UAAU;gBACV,GAAG,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChF,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,oCAAoC;QACtC,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,IAAI,EAAE;QACpC,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yBAAyB;AACxB,aAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,GAAG,IAAI,CAAC;AAC1D,aAAqB,CAAC,MAAM,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,GAAG,gBAAgB,CAAC"}