@decocms/blocks 7.37.0 → 7.37.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decocms/blocks",
-  "version": "7.37.0",
+  "version": "7.37.2",
   "type": "module",
   "engines": {
     "node": ">=24"

package/src/middleware/observability.test.ts

@@ -7,6 +7,7 @@
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import {
   configureMeter,
+  normalizePath,
   type MeterAdapter,
   MetricNames,
   recordCacheMetric,
@@ -256,3 +257,37 @@ describe("recordCommerceMetric (D-11)", () => {
     ).not.toThrow();
   });
 });
+
+/**
+ * `http.route` is the highest-cardinality risk on the highest-volume metric.
+ * These cases are the real paths measured on production when the label reached
+ * 20,714 distinct values across 6 tenants.
+ */
+describe("normalizePath cardinality", () => {
+  it("collapses CMS content slugs", () => {
+    expect(normalizePath("/mochila-de-couro")).toBe("/:slug");
+    expect(normalizePath("/moveis/quarto-infantil")).toBe("/moveis/:slug");
+    expect(normalizePath("/granado/eau-de-toilette-spritz-100ml")).toBe("/granado/:slug");
+    expect(normalizePath("/moveis/quarto-adulto/cabeceiras-mesa-de-cabeceiras")).toBe(
+      "/moveis/:slug/:slug",
+    );
+  });
+
+  it("leaves bounded framework and API routes intact", () => {
+    expect(normalizePath("/")).toBe("/");
+    expect(normalizePath("/api/sessions")).toBe("/api/sessions");
+    expect(normalizePath("/deco/invoke/magento/loaders/features")).toBe(
+      "/deco/invoke/magento/loaders/features",
+    );
+  });
+
+  it("keeps dotfile segments readable", () => {
+    expect(normalizePath("/.well-known/passkey-endpoints")).toBe("/.well-known/:slug");
+  });
+
+  it("still collapses ids and product pages", () => {
+    expect(normalizePath("/produto/12345")).toBe("/produto/:id");
+    expect(normalizePath("/a/deadbeefcafe")).toBe("/a/:id");
+    expect(normalizePath("/some-product/p")).toBe("/:slug/p");
+  });
+});

package/src/middleware/observability.ts

@@ -611,10 +611,33 @@ export function recordLoaderError(name: string) {
  */
 export function normalizePath(path: string): string {
   // Collapse dynamic segments to reduce cardinality
-  return path
+  const collapsed = path
     .replace(/\/[0-9a-f]{8,}/gi, "/:id")
     .replace(/\/\d+/g, "/:id")
     .replace(/\/[^/]+\/p$/, "/:slug/p");
+
+  // Content slugs are the case none of the rules above catch: they carry no
+  // digits, no hex id and no `/p` suffix, so a CMS page passes through as its
+  // own literal path and becomes its own series.
+  //
+  //   /mochila-de-couro
+  //   /moveis/quarto-infantil
+  //   /granado/eau-de-toilette-spritz-100ml
+  //
+  // Measured on the production ClickHouse, `http.route` reached 20,714
+  // distinct values across only 6 tenants — on `http.server.request.duration`,
+  // the highest-volume metric in the pipeline (19M rows / 3h).
+  //
+  // A hyphen is the discriminator. CMS slugs are hyphenated by construction,
+  // while framework and API segments are single words (`api`, `sessions`,
+  // `deco`, `invoke`, `loaders`, `render`). Dotfile segments such as
+  // `.well-known` are excluded so they keep their meaning.
+  return collapsed
+    .split("/")
+    .map((segment) =>
+      segment.includes("-") && !segment.startsWith(".") ? ":slug" : segment,
+    )
+    .join("/");
 }
 
 // ---------------------------------------------------------------------------