@bymax-one/nest-core 1.5.2 → 1.6.0

package/dist/health.transition-B_IgXJTz.d.cts

@@ -0,0 +1,119 @@
+/**
+ * @fileoverview The readiness transition contract: a sink that receives one
+ * event each time a check changes state, and the cause that says why.
+ *
+ * This exists because a readiness failure can otherwise leave no record an
+ * operator will ever read. There are three ways for a check to be down, and the
+ * aggregator is the only place that can tell them apart: the indicator rejected,
+ * the indicator reported `down` on purpose, or the aggregator gave up waiting.
+ * The third is knowledge that exists nowhere else — an indicator the aggregator
+ * abandoned is never told, so it cannot report anything — and it is the shape a
+ * hung dependency takes. A database under load, a network partition and a paused
+ * container all hang; a refusal comes back immediately.
+ *
+ * Two decisions elsewhere combine to make that silence total in a typical
+ * deployment, and each is right on its own. Probe paths are excluded from the
+ * HTTP log surface, because probes are the highest-volume request a backend
+ * serves. And a well-written indicator returns `{ status: 'down' }` rather than
+ * throwing, because readiness is usually unauthenticated and a driver's error
+ * carries hosts, ports and sometimes credentials — which is exactly the row this
+ * package's own contract steers implementations toward.
+ *
+ * **Transitions, not outcomes.** The sink is called once per *change* of state
+ * per check name, never once per probe. That rule lives in the aggregator rather
+ * than in the sink deliberately: a readiness check runs every few seconds, so a
+ * line per failure turns one outage into thousands of identical records that
+ * bury the one carrying the cause. Leaving the de-duplication to each consumer
+ * would mean every backend re-deriving the same rule, and re-deriving it subtly
+ * differently. A sink that never sees raw outcomes cannot get it wrong.
+ * @layer Contract
+ */
+/**
+ * Why a check is down, as only the aggregator can distinguish it.
+ *
+ * A discriminated union rather than a string, so a consumer switches
+ * exhaustively and the compiler reports the arm it has not handled when a future
+ * version adds one. "The dependency answered that it is down" and "the
+ * dependency accepted the work and never answered" are different outages calling
+ * for different responses, and the readiness body cannot tell them apart because
+ * it carries only `up` or `down`.
+ */
+type HealthTransitionCause = {
+    /** The indicator rejected, or threw synchronously. */
+    readonly kind: 'rejected';
+    /**
+     * The rejection's top-level message, truncated to 300 characters. Never
+     * the raw error, its stack, or any nested cause.
+     *
+     * This reaches the sink whether or not `health.exposeIndicatorErrors` is
+     * set: that option governs what is written into the HTTP response, which
+     * is typically unauthenticated, while a sink is application-side code at
+     * the same trust level as the logger. An indicator usually does not author
+     * this text — it lets a driver's error propagate — so treat it as
+     * potentially carrying hosts and ports, and send it where access is
+     * already controlled.
+     */
+    readonly message: string;
+} | {
+    /** The indicator answered, and reported its dependency unhealthy. */
+    readonly kind: 'reported-down';
+} | {
+    /** The aggregator gave up waiting for the indicator. */
+    readonly kind: 'timed-out';
+    /** The bound that elapsed, from `health.indicatorTimeoutMs`. */
+    readonly timeoutMs: number;
+};
+/**
+ * One change of state for one check.
+ *
+ * A discriminated union on `isUp` rather than an object with an optional cause,
+ * so the compiler guarantees that a transition to `down` carries one and that a
+ * transition to `up` does not — a recovery has no cause to describe.
+ */
+type HealthTransition = {
+    /** The check's name, as {@link IHealthIndicator.name} declares it. */
+    readonly name: string;
+    /** The dependency is reachable again. */
+    readonly isUp: true;
+} | {
+    /** The check's name, as {@link IHealthIndicator.name} declares it. */
+    readonly name: string;
+    /** The dependency is not reachable. */
+    readonly isUp: false;
+    /** Why, as far as the aggregator can tell. */
+    readonly cause: HealthTransitionCause;
+};
+/**
+ * Receives one event per change of readiness state, per check.
+ *
+ * Bind an implementation under `BYMAX_HEALTH_TRANSITION_SINK` from a module of
+ * your own marked `@Global()`. Nothing is bound by default, and with no sink the
+ * aggregator writes its own transition lines to Nest's logger, so a readiness
+ * failure is never silent.
+ *
+ * Binding a sink stands that line down. Both destinations are usually the same
+ * logger in a consuming application, so keeping it would put two records of one
+ * transition side by side — the noise this feature exists to remove. The sink is
+ * handed the cause as structured data, strictly more than the line renders, so
+ * what reaches the log after that is the consumer's decision.
+ *
+ * Called synchronously from the readiness path, so an implementation must be
+ * cheap and must not block: hand the event to a logger and return. A throw is
+ * caught and reported by the aggregator rather than failing the probe — a
+ * readiness endpoint that answers `500` because its *logging* broke would take a
+ * healthy deployment out of rotation — but do not rely on that as flow control.
+ *
+ * Takes a single object, matching `ITimingSink.record`, so a later field is an
+ * additive change rather than a new positional parameter.
+ */
+interface IHealthTransitionSink {
+    /**
+     * Record one change of readiness state.
+     *
+     * @param transition - The check that changed, its new state, and the cause
+     *   when it went down.
+     */
+    record(transition: HealthTransition): void;
+}
+
+export type { HealthTransition as H, IHealthTransitionSink as I, HealthTransitionCause as a };

package/dist/health.transition-B_IgXJTz.d.ts

@@ -0,0 +1,119 @@
+/**
+ * @fileoverview The readiness transition contract: a sink that receives one
+ * event each time a check changes state, and the cause that says why.
+ *
+ * This exists because a readiness failure can otherwise leave no record an
+ * operator will ever read. There are three ways for a check to be down, and the
+ * aggregator is the only place that can tell them apart: the indicator rejected,
+ * the indicator reported `down` on purpose, or the aggregator gave up waiting.
+ * The third is knowledge that exists nowhere else — an indicator the aggregator
+ * abandoned is never told, so it cannot report anything — and it is the shape a
+ * hung dependency takes. A database under load, a network partition and a paused
+ * container all hang; a refusal comes back immediately.
+ *
+ * Two decisions elsewhere combine to make that silence total in a typical
+ * deployment, and each is right on its own. Probe paths are excluded from the
+ * HTTP log surface, because probes are the highest-volume request a backend
+ * serves. And a well-written indicator returns `{ status: 'down' }` rather than
+ * throwing, because readiness is usually unauthenticated and a driver's error
+ * carries hosts, ports and sometimes credentials — which is exactly the row this
+ * package's own contract steers implementations toward.
+ *
+ * **Transitions, not outcomes.** The sink is called once per *change* of state
+ * per check name, never once per probe. That rule lives in the aggregator rather
+ * than in the sink deliberately: a readiness check runs every few seconds, so a
+ * line per failure turns one outage into thousands of identical records that
+ * bury the one carrying the cause. Leaving the de-duplication to each consumer
+ * would mean every backend re-deriving the same rule, and re-deriving it subtly
+ * differently. A sink that never sees raw outcomes cannot get it wrong.
+ * @layer Contract
+ */
+/**
+ * Why a check is down, as only the aggregator can distinguish it.
+ *
+ * A discriminated union rather than a string, so a consumer switches
+ * exhaustively and the compiler reports the arm it has not handled when a future
+ * version adds one. "The dependency answered that it is down" and "the
+ * dependency accepted the work and never answered" are different outages calling
+ * for different responses, and the readiness body cannot tell them apart because
+ * it carries only `up` or `down`.
+ */
+type HealthTransitionCause = {
+    /** The indicator rejected, or threw synchronously. */
+    readonly kind: 'rejected';
+    /**
+     * The rejection's top-level message, truncated to 300 characters. Never
+     * the raw error, its stack, or any nested cause.
+     *
+     * This reaches the sink whether or not `health.exposeIndicatorErrors` is
+     * set: that option governs what is written into the HTTP response, which
+     * is typically unauthenticated, while a sink is application-side code at
+     * the same trust level as the logger. An indicator usually does not author
+     * this text — it lets a driver's error propagate — so treat it as
+     * potentially carrying hosts and ports, and send it where access is
+     * already controlled.
+     */
+    readonly message: string;
+} | {
+    /** The indicator answered, and reported its dependency unhealthy. */
+    readonly kind: 'reported-down';
+} | {
+    /** The aggregator gave up waiting for the indicator. */
+    readonly kind: 'timed-out';
+    /** The bound that elapsed, from `health.indicatorTimeoutMs`. */
+    readonly timeoutMs: number;
+};
+/**
+ * One change of state for one check.
+ *
+ * A discriminated union on `isUp` rather than an object with an optional cause,
+ * so the compiler guarantees that a transition to `down` carries one and that a
+ * transition to `up` does not — a recovery has no cause to describe.
+ */
+type HealthTransition = {
+    /** The check's name, as {@link IHealthIndicator.name} declares it. */
+    readonly name: string;
+    /** The dependency is reachable again. */
+    readonly isUp: true;
+} | {
+    /** The check's name, as {@link IHealthIndicator.name} declares it. */
+    readonly name: string;
+    /** The dependency is not reachable. */
+    readonly isUp: false;
+    /** Why, as far as the aggregator can tell. */
+    readonly cause: HealthTransitionCause;
+};
+/**
+ * Receives one event per change of readiness state, per check.
+ *
+ * Bind an implementation under `BYMAX_HEALTH_TRANSITION_SINK` from a module of
+ * your own marked `@Global()`. Nothing is bound by default, and with no sink the
+ * aggregator writes its own transition lines to Nest's logger, so a readiness
+ * failure is never silent.
+ *
+ * Binding a sink stands that line down. Both destinations are usually the same
+ * logger in a consuming application, so keeping it would put two records of one
+ * transition side by side — the noise this feature exists to remove. The sink is
+ * handed the cause as structured data, strictly more than the line renders, so
+ * what reaches the log after that is the consumer's decision.
+ *
+ * Called synchronously from the readiness path, so an implementation must be
+ * cheap and must not block: hand the event to a logger and return. A throw is
+ * caught and reported by the aggregator rather than failing the probe — a
+ * readiness endpoint that answers `500` because its *logging* broke would take a
+ * healthy deployment out of rotation — but do not rely on that as flow control.
+ *
+ * Takes a single object, matching `ITimingSink.record`, so a later field is an
+ * additive change rather than a new positional parameter.
+ */
+interface IHealthTransitionSink {
+    /**
+     * Record one change of readiness state.
+     *
+     * @param transition - The check that changed, its new state, and the cause
+     *   when it went down.
+     */
+    record(transition: HealthTransition): void;
+}
+
+export type { HealthTransition as H, IHealthTransitionSink as I, HealthTransitionCause as a };

package/dist/index.cjs

@@ -157,6 +157,9 @@ var BYMAX_TIMING_SINK = /* @__PURE__ */ Symbol.for("@bymax-one/nest-core:timing-
 var BYMAX_HEALTH_INDICATORS = /* @__PURE__ */ Symbol.for(
   "@bymax-one/nest-core:health-indicators"
 );
+var BYMAX_HEALTH_TRANSITION_SINK = /* @__PURE__ */ Symbol.for(
+  "@bymax-one/nest-core:health-transition-sink"
+);
 var BYMAX_METRICS_REGISTRY = /* @__PURE__ */ Symbol.for(
   "@bymax-one/nest-core:metrics-registry"
 );
@@ -636,6 +639,13 @@ function selectAsyncExceptionFilter(options, correlation, adapterHost) {
   return options.envelope.enabled ? new exports.BymaxExceptionFilter(options, correlation, adapterHost) : new PassThroughExceptionFilter(adapterHost);
 }
 
+// src/contain-rejection.ts
+function containRejection(returned, onFailure) {
+  if (typeof returned?.then === "function") {
+    Promise.resolve(returned).catch(onFailure);
+  }
+}
+
 // src/discovery.ts
 function labelFor(className, token) {
   return className === "" ? String(token) : className;
@@ -687,7 +697,7 @@ var TRUNCATION_ELLIPSIS = "...";
 function summarizeRejection(reason) {
   let message;
   try {
-    message = reason instanceof Error ? reason.message : String(reason);
+    message = String(reason instanceof Error ? reason.message : reason);
   } catch {
     message = "Unknown error";
   }
@@ -696,17 +706,27 @@ function summarizeRejection(reason) {
   }
   return `${message.slice(0, MAX_ERROR_MESSAGE_LENGTH - TRUNCATION_ELLIPSIS.length)}${TRUNCATION_ELLIPSIS}`;
 }
-async function runIndicator(indicator, timeoutMs, exposeErrors, logger) {
+async function runIndicator(indicator, timeoutMs, exposeErrors) {
   let timer;
   const timedOut = new Promise((resolve) => {
     timer = setTimeout(() => {
-      resolve({ name: indicator.name, status: "down", details: { timedOutAfterMs: timeoutMs } });
+      resolve({
+        entry: { name: indicator.name, status: "down", details: { timedOutAfterMs: timeoutMs } },
+        isUp: false,
+        cause: { kind: "timed-out", timeoutMs }
+      });
     }, timeoutMs);
   });
-  const checked = Promise.resolve().then(() => indicator.check()).then((result) => ({ ...result, name: indicator.name })).catch((reason) => {
+  const checked = Promise.resolve().then(() => indicator.check()).then((result) => {
+    const entry = { ...result, name: indicator.name };
+    return result.status === "up" ? { entry, isUp: true } : { entry, isUp: false, cause: { kind: "reported-down" } };
+  }).catch((reason) => {
     const message = summarizeRejection(reason);
-    logger.warn(`Health indicator "${indicator.name}" reported down: ${message}`);
-    return exposeErrors ? { name: indicator.name, status: "down", details: { error: message } } : { name: indicator.name, status: "down" };
+    return {
+      entry: exposeErrors ? { name: indicator.name, status: "down", details: { error: message } } : { name: indicator.name, status: "down" },
+      isUp: false,
+      cause: { kind: "rejected", message }
+    };
   });
   try {
     return await Promise.race([checked, timedOut]);
@@ -714,6 +734,16 @@ async function runIndicator(indicator, timeoutMs, exposeErrors, logger) {
     clearTimeout(timer);
   }
 }
+function describeCause(cause) {
+  switch (cause.kind) {
+    case "rejected":
+      return `the indicator rejected: ${cause.message}`;
+    case "timed-out":
+      return `the indicator did not answer within ${cause.timeoutMs}ms`;
+    case "reported-down":
+      return "the indicator reported it down";
+  }
+}
 var HealthService = class {
   /**
    * @param indicators - Every explicitly registered indicator; empty when none
@@ -728,18 +758,169 @@ var HealthService = class {
    *   without it when the feature is off.
    * @param reflector - Nest's metadata reader, used to match the indicator
    *   marker. Optional for the same reason.
+   * @param transitionSink - Receives one event per change of readiness state.
+   *   `@Optional()` and bound to nothing by default, for the same reason as the
+   *   indicator array: a local default here would shadow a consumer's override.
    */
-  constructor(indicators = [], options, discovery, reflector) {
+  constructor(indicators = [], options, discovery, reflector, transitionSink) {
     this.indicators = indicators;
     this.options = options;
     this.discovery = discovery;
     this.reflector = reflector;
+    this.transitionSink = transitionSink;
     /**
      * Nest's own logger, scoped to this class. The failure reason of a `down`
      * indicator is written here rather than into the HTTP response, so the
      * diagnostic survives without being served to whoever can reach the probe.
      */
     this.logger = new common.Logger(HealthService.name);
+    /**
+     * The last state observed per check name, absent until the first observation,
+     * tagged with the probe that observed it. Keyed by name, so one map serves
+     * every check and one dependency can neither trigger nor suppress another's
+     * line. This is the state that makes the difference between a line per change
+     * and a line per probe.
+     */
+    this.lastState = /* @__PURE__ */ new Map();
+    /**
+     * Counts readiness probes, so an outcome can be ordered against what is
+     * already recorded. Readiness is not called one at a time: an orchestrator's
+     * probe and a load balancer's health check reach this concurrently, and this
+     * feature's own subject — a dependency that hangs until `indicatorTimeoutMs`
+     * elapses — is exactly what makes an earlier probe finish after a later one.
+     * Comparing states alone would then let the stale observation win.
+     */
+    this.probeSequence = 0;
+  }
+  /**
+   * Report one check's current state, emitting only when it differs from the
+   * last state observed for that name.
+   *
+   * The asymmetry on a first observation is deliberate. A first observation that
+   * is FAILING is a transition: a process that boots against a dependency
+   * already down would otherwise look healthy in the log forever. A first
+   * observation that is HEALTHY is not: that is the expected state, and
+   * announcing it would write one line per dependency on every boot — the noise
+   * the probe-path exclusion exists to keep out.
+   *
+   * A cause is recorded at the transition, so a dependency that stays down while
+   * its failure mode changes underneath keeps the first one. That is the cost of
+   * one line per outage instead of one per probe.
+   *
+   * @param outcome - The indicator's resolved outcome for this probe.
+   * @param seq - The probe that produced it, from {@link probeSequence}.
+   */
+  reportTransition(outcome, seq) {
+    const name = outcome.entry.name;
+    const previous = this.lastState.get(name);
+    if (previous !== void 0 && seq <= previous.seq) {
+      return;
+    }
+    const changed = previous?.isUp !== outcome.isUp;
+    this.lastState.set(name, { isUp: outcome.isUp, seq });
+    if (!changed) {
+      return;
+    }
+    if (outcome.isUp) {
+      if (previous === void 0) {
+        return;
+      }
+      this.describe(`Health check "${name}" recovered`, false);
+      this.emit({ name, isUp: true });
+      return;
+    }
+    this.describe(`Health check "${name}" went down: ${describeCause(outcome.cause)}`, true);
+    this.emit({ name, isUp: false, cause: outcome.cause });
+  }
+  /**
+   * Write a transition to this package's own logger, unless a sink is bound —
+   * the reasoning for standing down is on `IHealthTransitionSink`.
+   *
+   * Down is a warning, not an error: an unreachable dependency is what readiness
+   * exists to route around, while `error` is what pages someone.
+   *
+   * @param message - The line to write.
+   * @param isDown - Whether it describes a check going down, which sets the level.
+   */
+  describe(message, isDown) {
+    if (this.transitionSink !== void 0) {
+      return;
+    }
+    this.writeLine(message, isDown);
+  }
+  /**
+   * Write one line to this package's logger, absorbing a logger that fails.
+   *
+   * Nest's logger is replaceable, so what this calls is application code. It can
+   * throw — most plausibly for the very reason a transition is being reported at
+   * all, when the sink and the logger share a backend that is down. Uncontained
+   * that throw leaves the readiness path: synchronously it rejects the probe,
+   * and from the asynchronous sink handler it becomes an unhandled rejection.
+   * Either way a healthy deployment leaves rotation because its logging broke,
+   * which is the outcome this whole seam exists to prevent.
+   *
+   * The failure is swallowed rather than reported, because a logger is the last
+   * place a failure could be reported to. There is nowhere left to go.
+   *
+   * @param message - The line to write.
+   * @param asWarning - Whether to write it at warning level.
+   */
+  writeLine(message, asWarning) {
+    try {
+      if (asWarning) {
+        this.logger.warn(message);
+        return;
+      }
+      this.logger.log(message);
+    } catch {
+    }
+  }
+  /**
+   * Hand a transition to the consumer's sink, if one is bound. A failure is
+   * contained: readiness answering `500` because its own logging broke would
+   * take a healthy deployment out of rotation over an observability fault.
+   *
+   * Both ways a sink can fail are caught, for the same reason `runIndicator`
+   * defends against an indicator that throws synchronously — a public seam
+   * cannot assume the implementation behind it honors its own signature.
+   * `record` is declared to return `void`, but TypeScript accepts any return
+   * value in a void-returning position, so `async record()` compiles and is the
+   * shape a consumer reaches for when the logger it delegates to is async. Its
+   * rejection lands a microtask after the `try` block has exited, which is an
+   * unhandled rejection rather than the contained failure documented on the
+   * contract.
+   *
+   * Whatever comes back is assimilated with `Promise.resolve`, not tested with
+   * `instanceof Promise`: `Promise` is a per-realm binding, so an `async` sink
+   * defined in another realm returns a native promise that fails `instanceof`
+   * here, and a userland promise library's result is not an instance either.
+   * Assimilation is the language's own thenable test, and it is inert for the
+   * `undefined` an ordinary synchronous sink returns.
+   *
+   * @param transition - The event to deliver.
+   */
+  emit(transition) {
+    if (this.transitionSink === void 0) {
+      return;
+    }
+    try {
+      containRejection(this.transitionSink.record(transition), (error) => {
+        this.reportSinkFailure(error);
+      });
+    } catch (error) {
+      this.reportSinkFailure(error);
+    }
+  }
+  /**
+   * Log a sink failure, without letting it reach the probe.
+   *
+   * @param error - Whatever the sink threw or rejected with.
+   */
+  reportSinkFailure(error) {
+    this.writeLine(
+      `Health transition sink threw and was ignored: ${summarizeRejection(error)}`,
+      true
+    );
   }
   /**
    * Resolve the readiness set once the whole container is instantiated.
@@ -801,11 +982,14 @@ var HealthService = class {
   async checkReadiness() {
     const timeoutMs = this.options.health.indicatorTimeoutMs;
     const exposeErrors = this.options.health.exposeIndicatorErrors;
-    const checks = await Promise.all(
-      this.resolveIndicators().map(
-        (indicator) => runIndicator(indicator, timeoutMs, exposeErrors, this.logger)
-      )
+    const seq = ++this.probeSequence;
+    const outcomes = await Promise.all(
+      this.resolveIndicators().map((indicator) => runIndicator(indicator, timeoutMs, exposeErrors))
     );
+    for (const outcome of outcomes) {
+      this.reportTransition(outcome, seq);
+    }
+    const checks = outcomes.map((outcome) => outcome.entry);
     const status = checks.every((check) => check.status === "up") ? "ok" : "error";
     return { status, checks };
   }
@@ -818,7 +1002,9 @@ HealthService = __decorateClass([
   __decorateParam(2, common.Optional()),
   __decorateParam(2, common.Inject(core.DiscoveryService)),
   __decorateParam(3, common.Optional()),
-  __decorateParam(3, common.Inject(core.Reflector))
+  __decorateParam(3, common.Inject(core.Reflector)),
+  __decorateParam(4, common.Optional()),
+  __decorateParam(4, common.Inject(BYMAX_HEALTH_TRANSITION_SINK))
 ], HealthService);
 
 // src/health/health.controller.ts
@@ -1206,6 +1392,13 @@ function buildTimingSample(input) {
     ...trace !== void 0 ? { traceId: trace.traceId, spanId: trace.spanId } : {}
   };
 }
+function deliverSample(sink, sample) {
+  try {
+    containRejection(sink.record(sample), () => {
+    });
+  } catch {
+  }
+}
 
 // src/timing/timing.middleware.ts
 exports.BymaxTimingMiddleware = class BymaxTimingMiddleware {
@@ -1255,7 +1448,8 @@ exports.BymaxTimingMiddleware = class BymaxTimingMiddleware {
     next();
   }
   /**
-   * Build the sample and hand it to the sink, guarding both steps.
+   * Build the sample and deliver it. `deliverSample` absorbs whatever the sink
+   * does with it, so a broken sink never reaches the request it observes.
    *
    * @param request - The framework request object.
    * @param response - The framework response object.
@@ -1273,10 +1467,7 @@ exports.BymaxTimingMiddleware = class BymaxTimingMiddleware {
       threshold: this.options.timing.slowRequestThresholdMs,
       trace
     });
-    try {
-      this.sink.record(sample);
-    } catch {
-    }
+    deliverSample(this.sink, sample);
   }
 };
 exports.BymaxTimingMiddleware = __decorateClass([
@@ -1397,9 +1588,12 @@ exports.BymaxCoreModule = class BymaxCoreModule extends BymaxCoreModuleBase {
    * it is scoped to, while `'{*splat}'` — the form Nest 11's migration guide
    * prescribes for "all routes" — stops matching the prefixed root once an
    * application calls `setGlobalPrefix`. That was reported as nest#14520 and
-   * fixed by nest#14522, whose regression test covers Fastify; on
-   * `@nestjs/core` 11.1.28 with the Express adapter the prefixed root still
-   * reaches no middleware while resolving to `200`.
+   * fixed by nest#14522, whose regression test covers Fastify; on the Express
+   * adapter the prefixed root still reaches no middleware while resolving to
+   * `200`. Measured on `@nestjs/core` 11.1.28 and re-measured unchanged on
+   * 11.2.1 — a minor release is exactly where this would plausibly have been
+   * fixed, so the version this was last confirmed against is part of the
+   * claim rather than a footnote to it.
    *
    * On Fastify the same `'/'` is an exact match rather than a mount — one of
    * three requests reached the middleware — so the wildcard is the only form
@@ -1589,9 +1783,8 @@ exports.TimingInterceptor = class TimingInterceptor {
     return error instanceof common.HttpException ? error.getStatus() : UNKNOWN_ERROR_STATUS;
   }
   /**
-   * Build the sample and deliver it to the sink inside a try/catch that
-   * silences any failure: a throwing sink must never affect the request it is
-   * observing.
+   * Build the sample and deliver it. `deliverSample` absorbs whatever the sink
+   * does with it: a broken sink must never affect the request it observes.
    *
    * @param method - HTTP method of the request.
    * @param route - Route template of the request.
@@ -1607,10 +1800,7 @@ exports.TimingInterceptor = class TimingInterceptor {
       threshold: this.options.timing.slowRequestThresholdMs,
       trace: readTraceContext(this.traceContext)
     });
-    try {
-      this.sink.record(sample);
-    } catch {
-    }
+    deliverSample(this.sink, sample);
   }
 };
 exports.TimingInterceptor = __decorateClass([
@@ -1632,6 +1822,7 @@ exports.BYMAX_CORRELATION_PROVIDER = BYMAX_CORRELATION_PROVIDER;
 exports.BYMAX_FORBIDDEN = BYMAX_FORBIDDEN;
 exports.BYMAX_GATEWAY_TIMEOUT = BYMAX_GATEWAY_TIMEOUT;
 exports.BYMAX_HEALTH_INDICATORS = BYMAX_HEALTH_INDICATORS;
+exports.BYMAX_HEALTH_TRANSITION_SINK = BYMAX_HEALTH_TRANSITION_SINK;
 exports.BYMAX_INTERNAL_ERROR = BYMAX_INTERNAL_ERROR;
 exports.BYMAX_METRICS_REGISTRY = BYMAX_METRICS_REGISTRY;
 exports.BYMAX_NOT_FOUND = BYMAX_NOT_FOUND;