@dunx/http 3.1.3 → 3.2.0

package/README.md

@@ -1,8 +1,9 @@
 # @dunx/http
 
-`Bun.serve` adapter for [dunx](https://github.com/petarzarkov/dunx). Class-based
-controllers **and WebSocket gateways**, standard decorators, and no JavaScript
-router - Bun's native `routes` does path params and per-method dispatch in Zig.
+`Bun.serve` adapter for [dunx](https://github.com/petarzarkov/dunx): class-based
+controllers, **WebSocket gateways**, and standard decorators. There is no
+JavaScript router - Bun's native `routes` does path params and per-method
+dispatch in Zig.
 
 `Bun.serve` takes `routes` and `websocket` in one call, so both live here: one
 `listen()`, one server, one port. No `express`, no `ws`, no `socket.io`.
@@ -62,6 +63,8 @@ The guide is canonical for every row; this table is the index.
 | Middleware and guards   | One extension point, `@UseGuards`, `@Roles`, `@Public`      | [Middleware and guards](../../docs/guide/08-middleware-and-guards.md) |
 | WebSocket gateways      | `@Gateway`, handlers, `PubSub`, multi-node relay            | [WebSockets](../../docs/guide/09-websockets.md)                   |
 | Request logging         | One structured entry per request, on by default             | [Logging](../../docs/guide/13-logging.md)                         |
+| Trace context           | W3C `traceparent` adopted and propagated, on by default     | [Logging](../../docs/guide/13-logging.md)                         |
+| Metrics                 | Per-route counts and timings, off by default                | [Metrics](../../docs/guide/22-metrics.md)                         |
 | Health and draining     | `/health/live`, `/health/ready`, readiness during a rollout | [Health checks](../../docs/guide/20-health-checks.md)             |
 | Throttling              | `@Throttle`, `@SkipThrottle`, memory and Redis counters     | [Middleware and guards](../../docs/guide/08-middleware-and-guards.md) |
 | Static files            | `Bun.file` behind a mount, with a cache policy              | [Deployment](../../docs/guide/19-deployment.md)                   |
@@ -89,7 +92,14 @@ from, and it may change in any release.
 - Handlers may return a `Response`, any JSON-serialisable value, or `undefined`
   for a 204.
 - Schemas, parsers and the status resolve at boot into the same closure the
-  middleware chain folds into, so a request reads no metadata and does no lookup.
+  middleware chain folds into. A request reads no metadata and does no lookup.
+- Every request adopts W3C Trace Context, so `traceId`, `spanId`, `parentSpanId`
+  and `traceFlags` reach every line it writes and `traceresponse` goes out on the
+  response. `requestLogging: { trace: false }` removes both;
+  `{ traceResponse: false }` keeps the trace and drops the header, which is ~500
+  ns. W3C Trace Context is the only correlation id; there is no second one.
+- `metrics: true` adds per-route counts and a nanosecond histogram at +35.2 ns a
+  request, folded into the `.then` request logging already allocates.
 
 ## License
 

package/dist/{chunk-sz4pvqxy.js → chunk-9x3evk19.js}

@@ -105,4 +105,73 @@ var HttpStatusCode = Object.freeze({
   GATEWAY_TIMEOUT: 504
 });
 
-export { __privateGet, __privateAdd, __decoratorStart, __decoratorMetadata, __runInitializers, __decorateElement, HttpStatusCode };
+// src/server/trace-context.ts
+var TRACEPARENT_HEADER = "traceparent";
+var TRACESTATE_HEADER = "tracestate";
+var TRACERESPONSE_HEADER = "traceresponse";
+var HEX_32 = /^[0-9a-f]{32}$/;
+var HEX_16 = /^[0-9a-f]{16}$/;
+var HEX_2 = /^[0-9a-f]{2}$/;
+var ZERO_TRACE = "0".repeat(32);
+var ZERO_SPAN = "0".repeat(16);
+var SAMPLED = 1;
+var DEFAULT_FLAGS = "01";
+var TRACE = Symbol.for("dunx.http.trace");
+var EXPOSE = Symbol.for("dunx.http.trace.expose");
+var mint = (bytes) => crypto.getRandomValues(new Uint8Array(bytes)).toHex();
+
+class TraceContext {
+  static adopt(req, expose = true) {
+    const inbound = TraceContext.#parse(req.headers.get(TRACEPARENT_HEADER));
+    const state = req.headers.get(TRACESTATE_HEADER);
+    const trace = inbound === undefined ? { traceId: mint(16), spanId: mint(8), flags: DEFAULT_FLAGS } : {
+      traceId: inbound.traceId,
+      spanId: mint(8),
+      parentSpanId: inbound.spanId,
+      flags: inbound.flags,
+      ...state === null ? {} : { state }
+    };
+    req[TRACE] = trace;
+    if (expose)
+      req[EXPOSE] = true;
+    return trace;
+  }
+  static of(req) {
+    return req[TRACE];
+  }
+  static header(trace) {
+    return `00-${trace.traceId}-${trace.spanId}-${trace.flags}`;
+  }
+  static stamp(response, req) {
+    const traced = req;
+    const trace = traced[TRACE];
+    if (trace !== undefined && traced[EXPOSE] === true) {
+      response.headers.set(TRACERESPONSE_HEADER, TraceContext.header(trace));
+    }
+    return response;
+  }
+  static sampled(trace) {
+    return (Number.parseInt(trace.flags, 16) & SAMPLED) === SAMPLED;
+  }
+  static #parse(header) {
+    if (header === null)
+      return;
+    const parts = header.split("-");
+    if (parts.length < 4)
+      return;
+    const [version, traceId, spanId, flags] = parts;
+    if (!HEX_2.test(version) || version === "ff")
+      return;
+    if (version === "00" && parts.length !== 4)
+      return;
+    if (!HEX_32.test(traceId) || traceId === ZERO_TRACE)
+      return;
+    if (!HEX_16.test(spanId) || spanId === ZERO_SPAN)
+      return;
+    if (!HEX_2.test(flags))
+      return;
+    return { traceId, spanId, flags };
+  }
+}
+
+export { __privateGet, __privateAdd, __decoratorStart, __decoratorMetadata, __runInitializers, __decorateElement, HttpStatusCode, TRACEPARENT_HEADER, TRACESTATE_HEADER, TRACERESPONSE_HEADER, TraceContext };

package/dist/{chunk-7xrtwbx3.js → chunk-e8a9c6j2.js}

@@ -1,7 +1,7 @@
 // @bun
 import {
   HttpStatusCode
-} from "./chunk-sz4pvqxy.js";
+} from "./chunk-9x3evk19.js";
 
 // src/client/errors.ts
 import { AppError } from "@dunx/core";

package/dist/{chunk-53cs6qek.js → chunk-y85wcdhw.js}

@@ -1,13 +1,14 @@
 // @bun
 import {
   HttpStatusCode,
+  TraceContext,
   __decorateElement,
   __decoratorMetadata,
   __decoratorStart,
   __privateAdd,
   __privateGet,
   __runInitializers
-} from "./chunk-sz4pvqxy.js";
+} from "./chunk-9x3evk19.js";
 
 // src/route/marker.ts
 var ROUTE = Symbol.for("dunx.route");
@@ -570,26 +571,6 @@ class WsRelay {
   }
 }
 
-// src/server/request-id.ts
-var REQUEST_ID_HEADER = "x-request-id";
-var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
-var traceId = (inbound) => inbound !== null && inbound.length === 36 && UUID.test(inbound) ? inbound : crypto.randomUUID();
-var ID = Symbol.for("dunx.http.requestId");
-
-class RequestIds {
-  static assign(req) {
-    const id = traceId(req.headers.get(REQUEST_ID_HEADER));
-    req[ID] = id;
-    return id;
-  }
-  static stamp(response, req) {
-    const id = req[ID];
-    if (id !== undefined)
-      response.headers.set(REQUEST_ID_HEADER, id);
-    return response;
-  }
-}
-
 // src/server/context.ts
 var EMPTY = new Map;
 var buildContext = (route) => {
@@ -843,7 +824,7 @@ var buildFallback = (middleware = [], onError = defaultErrorMapper, cors, notFou
     try {
       return await compose(middleware, unmatchedContext(req, notFound === "public"), miss)(req);
     } catch (error) {
-      return RequestIds.stamp(onError(error, req), req);
+      return TraceContext.stamp(onError(error, req), req);
     }
   };
   return cors ? withCors(cors, run) : run;
@@ -900,7 +881,7 @@ var buildRoutes = (discovered, middleware = [], onError = defaultErrorMapper, co
       try {
         return await chained(req);
       } catch (error) {
-        return RequestIds.stamp(onError(error, req), req);
+        return TraceContext.stamp(onError(error, req), req);
       }
     };
     const byMethod = routes[route.path] ??= {};
@@ -1313,4 +1294,4 @@ __runInitializers(_init, 1, HiddenHealthController);
 __decoratorMetadata(_init, HiddenHealthController);
 let _HiddenHealthController = HiddenHealthController;
 
-export { defaultStatusFor, Controller, Get, Post, Put, Patch, Delete, metaKey, meta, ROLES, PUBLIC, HIDDEN, UNMATCHED, Roles, Public, ApiHidden, UseGuards, guardsOf, metaOf, mergeMeta, HttpError, ValidationError, ErrorFilter, isErrorFilter, toErrorMapper, errorMapper, defaultErrorMapper, joinPath, discoverRoutes, encode, decode, HandlerKind, markHandler, markGateway, isGateway, composeSocket, observe, buildRuntime, buildGateways, buildWebSocket, normalizePath, discoverGateway, discoverGateways, DEFAULT_RELAY_CHANNEL, defaultRelayError, encodeRelay, decodeRelay, WsRelay, RawBody, REQUEST_ID_HEADER, RequestIds, buildContext, withCors, preflight, compose, assertNoCollisions, assertNoGatewayCollisions, withUpgradeRoutes, buildFallback, buildRoutes, StaticOptions, normalizePrefix, negotiate, CompressionEncoding, isCompressibleType, CompressionOptions, defaultRelayUrl, RedisRelay, HEALTH_REPORT_SCHEMA, HealthOptions, HealthRegistry, HealthController, HiddenHealthController };
+export { defaultStatusFor, Controller, Get, Post, Put, Patch, Delete, metaKey, meta, ROLES, PUBLIC, HIDDEN, UNMATCHED, Roles, Public, ApiHidden, UseGuards, guardsOf, metaOf, mergeMeta, HttpError, ValidationError, ErrorFilter, isErrorFilter, toErrorMapper, errorMapper, defaultErrorMapper, joinPath, discoverRoutes, encode, decode, HandlerKind, markHandler, markGateway, isGateway, composeSocket, observe, buildRuntime, buildGateways, buildWebSocket, normalizePath, discoverGateway, discoverGateways, DEFAULT_RELAY_CHANNEL, defaultRelayError, encodeRelay, decodeRelay, WsRelay, RawBody, buildContext, withCors, preflight, compose, assertNoCollisions, assertNoGatewayCollisions, withUpgradeRoutes, buildFallback, buildRoutes, StaticOptions, normalizePrefix, negotiate, CompressionEncoding, isCompressibleType, CompressionOptions, defaultRelayUrl, RedisRelay, HEALTH_REPORT_SCHEMA, HealthOptions, HealthRegistry, HealthController, HiddenHealthController };

package/dist/client/options.d.ts

@@ -16,21 +16,17 @@ export interface HttpClientOptionsInit {
     /** Sent on every request, under anything a call sets itself. */
     readonly headers?: Readonly<Record<string, string>>;
     readonly retry?: RetryOptions<unknown>;
-    /**
-     * Forward the inbound request id to the upstream, so one trace spans both
-     * services. `true` uses `x-request-id`; a string names the header. Read from
-     * `RequestContext`, so it only carries when there is a request in scope.
-     *
-     * @default true
-     */
-    readonly propagateRequestId?: boolean | string;
     /**
      * Forward W3C Trace Context upstream as `traceparent`, so the callee's spans
-     * join this request's trace.
+     * join this request's trace and one trace spans both services.
      *
      * Read from `RequestContext`, so it only carries when a trace is in scope -
-     * which means `requestLogging: { trace: true }` on the inbound side. With that
-     * off there is nothing to send and this costs one property read.
+     * which the inbound side puts there unless `requestLogging: { trace: false }`
+     * removed it. With that off there is nothing to send and this costs one
+     * property read.
+     *
+     * The caller's `traceFlags` are sent as they arrived, so a trace an upstream
+     * sampler declined is not re-sampled at this hop.
      *
      * @default true
      */
@@ -67,7 +63,6 @@ export interface HttpClientOptionsInit {
     /** How many redirects to follow before rejecting. */
     readonly maxRedirects?: number;
 }
-export declare const DEFAULT_REQUEST_ID_HEADER = "x-request-id";
 /**
  * The resolved options, as a class so it is both the injection token and the type
  * a factory annotates - the same trick `RedisOptions` and `ConfigService` use.
@@ -77,7 +72,6 @@ export declare class HttpClientOptions {
     readonly timeoutMs: number;
     readonly headers: Readonly<Record<string, string>>;
     readonly retry: RetryOptions<unknown>;
-    readonly requestIdHeader: string | undefined;
     readonly propagateTrace: boolean;
     readonly name: string | undefined;
     readonly fetchOptions: Readonly<Record<string, unknown>>;

package/dist/client/service.d.ts

@@ -42,8 +42,8 @@ export interface RequestConfig<TRequest = unknown, TResponse = unknown> {
 }
 type BaseOptions<TRequest, TResponse> = Omit<RequestConfig<TRequest, TResponse>, 'method' | 'url' | 'payload'>;
 /**
- * A `fetch` client with a per-request timeout, retry with backoff, request-id
- * propagation and one log line per call. `fetch` and nothing else, so there is no
+ * A `fetch` client with a per-request timeout, retry with backoff, W3C Trace
+ * Context propagation and one log line per call. `fetch` and nothing else, so there is no
  * client dependency; what it adds is the parts every caller otherwise
  * reimplements - the timeout, the retry policy, `Retry-After`, url building, and
  * a failure that says which call failed.

package/dist/client.d.ts

@@ -6,7 +6,7 @@
  * `@dunx/http` does not load any of this.
  */
 export { FetchError, FetchTransportError } from './client/errors.js';
-export { DEFAULT_REQUEST_ID_HEADER, HttpClientOptions, type HttpClientOptionsInit, } from './client/options.js';
+export { HttpClientOptions, type HttpClientOptionsInit, } from './client/options.js';
 export type { BackoffOptions, RetryOptions } from './client/retry.js';
 export { httpClient, HttpModule, type ClientTarget } from './client/module.js';
 export { HttpService, type HeaderFactory, type RequestConfig, type RequestMethod, } from './client/service.js';

package/dist/client.js

@@ -1,25 +1,22 @@
 // @bun
-import {
-  TRACEPARENT_HEADER,
-  TraceContext
-} from "./chunk-25g22350.js";
 import {
   FetchError,
   FetchTransportError,
   executeWithRetry,
   isJsonBody,
   safeStringify
-} from "./chunk-7xrtwbx3.js";
-import"./chunk-sz4pvqxy.js";
+} from "./chunk-e8a9c6j2.js";
+import {
+  TRACEPARENT_HEADER,
+  TRACESTATE_HEADER,
+  TraceContext
+} from "./chunk-9x3evk19.js";
 // src/client/options.ts
-var DEFAULT_REQUEST_ID_HEADER = "x-request-id";
-
 class HttpClientOptions {
   baseUrl;
   timeoutMs;
   headers;
   retry;
-  requestIdHeader;
   propagateTrace;
   name;
   fetchOptions;
@@ -30,8 +27,6 @@ class HttpClientOptions {
     this.retry = init.retry ?? {};
     this.name = init.name;
     this.propagateTrace = init.propagateTrace ?? true;
-    const propagate = init.propagateRequestId ?? true;
-    this.requestIdHeader = propagate === false ? undefined : propagate === true ? DEFAULT_REQUEST_ID_HEADER : propagate;
     this.fetchOptions = Object.fromEntries([
       ["proxy", init.proxy],
       ["tls", init.tls],
@@ -213,19 +208,18 @@ class HttpService extends UrlHelper {
     return { body: serialised, serialised, json: true };
   }
   async send(config, url, body, serialised, accept = "application/json") {
-    const requestId = this.options.requestIdHeader === undefined ? undefined : this.requestContext.getContext().requestId;
     const trace = this.options.propagateTrace ? this.requestContext.getContext() : undefined;
     const headers = {
       accept,
       ...serialised === "" ? {} : { "content-type": "application/json" },
       ...this.options.headers,
-      ...requestId === undefined || this.options.requestIdHeader === undefined ? {} : { [this.options.requestIdHeader]: requestId },
       ...typeof trace?.traceId === "string" && typeof trace.spanId === "string" ? {
         [TRACEPARENT_HEADER]: TraceContext.header({
           traceId: trace.traceId,
           spanId: trace.spanId,
-          flags: "01"
-        })
+          flags: typeof trace.traceFlags === "string" ? trace.traceFlags : "01"
+        }),
+        ...typeof trace.traceState === "string" ? { [TRACESTATE_HEADER]: trace.traceState } : {}
       } : {},
       ...config.headerFactory?.({
         timestamp: Math.floor(Date.now() / 1000),
@@ -344,7 +338,6 @@ class HttpModule {
   }
 }
 export {
-  DEFAULT_REQUEST_ID_HEADER,
   FetchError,
   FetchTransportError,
   HttpClientOptions,

package/dist/index.d.ts

@@ -8,9 +8,9 @@ export type { CorsOptions, CorsOrigin } from './server/cors.js';
 export { defaultErrorMapper, ErrorFilter, errorMapper, HttpError, ValidationError, type ErrorHandler, type ErrorMapper, type HttpErrorOptions, type InputSource, type ValidationIssue, } from './server/errors.js';
 export { HttpFactory, type HttpApp, type HttpOptions, } from './server/factory.js';
 export { DefaultHttpOptions, HttpOptionsProvider, } from './server/options-provider.js';
-export { REQUEST_ID_HEADER } from './server/request-id.js';
-export { TRACEPARENT_HEADER, TRACESTATE_HEADER, TraceContext, type Trace, } from './server/trace-context.js';
+export { TRACEPARENT_HEADER, TRACERESPONSE_HEADER, TRACESTATE_HEADER, TraceContext, type Trace, } from './server/trace-context.js';
 export { RequestLoggingMiddleware, type RequestLoggingOptions, } from './server/request-logging.js';
+export { MetricsMiddleware, RequestMetrics, UNMATCHED_ROUTE, type HttpStatsReport, type RouteStats, } from './server/metrics.js';
 export type { Middleware, Next, RouteHandler } from './server/middleware.js';
 export type { AppSettings } from './server/settings.js';
 export { StaticFiles } from './static/files.js';

package/dist/index.js

@@ -1,9 +1,4 @@
 // @bun
-import {
-  TRACEPARENT_HEADER,
-  TRACESTATE_HEADER,
-  TraceContext
-} from "./chunk-25g22350.js";
 import {
   ApiHidden,
   CompressionEncoding,
@@ -26,11 +21,9 @@ import {
   Post,
   Public,
   Put,
-  REQUEST_ID_HEADER,
   ROLES,
   RawBody,
   RedisRelay,
-  RequestIds,
   Roles,
   StaticOptions,
   UNMATCHED,
@@ -61,14 +54,18 @@ import {
   observe,
   toErrorMapper,
   withUpgradeRoutes
-} from "./chunk-53cs6qek.js";
+} from "./chunk-y85wcdhw.js";
 import {
   HttpStatusCode,
+  TRACEPARENT_HEADER,
+  TRACERESPONSE_HEADER,
+  TRACESTATE_HEADER,
+  TraceContext,
   __decorateElement,
   __decoratorMetadata,
   __decoratorStart,
   __runInitializers
-} from "./chunk-sz4pvqxy.js";
+} from "./chunk-9x3evk19.js";
 // src/server/client-address.ts
 import { AppError } from "@dunx/core";
 var trustedHops = (setting) => {
@@ -112,6 +109,98 @@ import {
   RequestContext as RequestContext3
 } from "@dunx/core";
 
+// src/server/metrics.ts
+import { Durations } from "@dunx/core";
+var UNMATCHED_ROUTE = "(unmatched)";
+var seriesFor = (route, method) => ({
+  route,
+  method,
+  count: 0,
+  byStatus: {},
+  duration: new Durations,
+  slowestNs: 0,
+  slowestTraceId: undefined
+});
+
+class RequestMetrics {
+  #series = new Map;
+  #unmatched = new Map;
+  #since = new Date;
+  #server;
+  observe(ctx, status, durationNs, traceId) {
+    let series = this.#series.get(ctx);
+    if (series === undefined) {
+      if (ctx.get(UNMATCHED) === true) {
+        series = this.#unmatched.get(ctx.method);
+        if (series === undefined) {
+          series = seriesFor(UNMATCHED_ROUTE, ctx.method);
+          this.#unmatched.set(ctx.method, series);
+        }
+      } else {
+        series = seriesFor(ctx.path, ctx.method);
+        this.#series.set(ctx, series);
+      }
+    }
+    series.count += 1;
+    const key = String(status);
+    series.byStatus[key] = (series.byStatus[key] ?? 0) + 1;
+    series.duration.record(durationNs);
+    if (durationNs > series.slowestNs) {
+      series.slowestNs = durationNs;
+      series.slowestTraceId = traceId;
+    }
+  }
+  snapshot() {
+    const routes = [];
+    for (const series of [
+      ...this.#series.values(),
+      ...this.#unmatched.values()
+    ]) {
+      routes.push({
+        route: series.route,
+        method: series.method,
+        count: series.count,
+        byStatus: { ...series.byStatus },
+        duration: series.duration.snapshot(),
+        ...series.slowestTraceId === undefined ? {} : { slowestTraceId: series.slowestTraceId }
+      });
+    }
+    return {
+      routes,
+      inFlight: this.#server?.pendingRequests ?? 0,
+      pendingWebSockets: this.#server?.pendingWebSockets ?? 0,
+      since: this.#since.toISOString()
+    };
+  }
+  reset() {
+    this.#series.clear();
+    this.#unmatched.clear();
+    this.#since = new Date;
+  }
+  attach(server) {
+    this.#server = server;
+  }
+}
+var usesMetricsMiddleware = (options) => options.metrics === true && options.requestLogging === false;
+
+class MetricsMiddleware {
+  metrics;
+  constructor(metrics) {
+    this.metrics = metrics;
+  }
+  handle(_req, ctx, next) {
+    const started = Bun.nanoseconds();
+    return next().then((response) => {
+      this.metrics.observe(ctx, response.status, Bun.nanoseconds() - started);
+      return response;
+    }, (error) => {
+      this.metrics.observe(ctx, error instanceof HttpError ? error.status : HttpStatusCode.INTERNAL_SERVER_ERROR, Bun.nanoseconds() - started);
+      throw error;
+    });
+  }
+}
+Object.defineProperty(MetricsMiddleware, Symbol.for("dunx.deps"), { value: () => [RequestMetrics] });
+
 // src/ws/logging.ts
 import { Logger, LogLevel, RequestContext } from "@dunx/core";
 var LIFECYCLE_LABEL = {
@@ -378,7 +467,9 @@ class RequestLoggingMiddleware {
   #correlateIgnored;
   #correlate;
   #trace;
-  constructor(logger, context, options = {}) {
+  #traceResponse;
+  #metrics;
+  constructor(logger, context, options = {}, metrics) {
     this.logger = logger;
     this.context = context;
     this.#limit = options.maxBodyLength ?? 2048;
@@ -388,7 +479,9 @@ class RequestLoggingMiddleware {
     this.#ignorePrefix = options.ignorePrefix ?? [];
     this.#correlateIgnored = options.correlateIgnored ?? false;
     this.#correlate = options.correlate ?? true;
-    this.#trace = options.trace ?? false;
+    this.#trace = options.trace ?? true;
+    this.#traceResponse = options.traceResponse ?? true;
+    this.#metrics = metrics;
   }
   #ignored(path) {
     if (this.#ignore.size > 0 && this.#ignore.has(path))
@@ -403,28 +496,32 @@ class RequestLoggingMiddleware {
     const mark = from === -1 ? -1 : url.indexOf("?", from);
     const path = from === -1 ? "/" : mark === -1 ? url.slice(from) : url.slice(from, mark);
     if (this.#ignored(path)) {
+      if (this.#metrics !== undefined) {
+        return this.#ignoredWithMetrics(req, ctx, path, next);
+      }
       return this.#correlateIgnored ? this.#correlated(req, ctx, path, next) : next();
     }
     const started = Bun.nanoseconds();
-    const requestId = RequestIds.assign(req);
     const scope = {
-      requestId,
       method: ctx.method,
       event: path,
       flow: "http",
       context: `${ctx.controller}.${ctx.handler}`
     };
     if (this.#trace) {
-      const trace = TraceContext.adopt(req, requestId);
+      const trace = TraceContext.adopt(req, this.#traceResponse);
       scope.traceId = trace.traceId;
       scope.spanId = trace.spanId;
+      scope.traceFlags = trace.flags;
       if (trace.parentSpanId !== undefined) {
         scope.parentSpanId = trace.parentSpanId;
       }
+      if (trace.state !== undefined)
+        scope.traceState = trace.state;
     }
-    return this.#correlate ? this.context.runWithContext(scope, () => this.#begin(req, ctx, url, mark, path, requestId, started, next, undefined)) : this.#begin(req, ctx, url, mark, path, requestId, started, next, scope);
+    return this.#correlate ? this.context.runWithContext(scope, () => this.#begin(req, ctx, url, mark, path, started, next, undefined)) : this.#begin(req, ctx, url, mark, path, started, next, scope);
   }
-  #begin(req, ctx, url, mark, path, requestId, started, next, scope) {
+  #begin(req, ctx, url, mark, path, started, next, scope) {
     const request = {};
     if (mark !== -1) {
       request["query"] = Object.fromEntries(new URLSearchParams(url.slice(mark + 1)));
@@ -432,13 +529,13 @@ class RequestLoggingMiddleware {
     const body = this.#body(req, ctx);
     if (body === undefined) {
       request["userAgent"] = req.headers.get("user-agent");
-      return this.#dispatch(req, path, requestId, started, request, next, scope);
+      return this.#dispatch(req, ctx, path, started, request, next, scope);
     }
     return body.then((value) => {
       if (value !== undefined)
         request["body"] = value;
       request["userAgent"] = req.headers.get("user-agent");
-      return this.#dispatch(req, path, requestId, started, request, next, scope);
+      return this.#dispatch(req, ctx, path, started, request, next, scope);
     });
   }
   #shared(req, request) {
@@ -453,36 +550,56 @@ class RequestLoggingMiddleware {
     if (value !== undefined)
       request["body"] = value;
   }
-  #correlated(req, ctx, path, next) {
-    const requestId = RequestIds.assign(req);
-    const stamp = (response) => {
-      response.headers.set(REQUEST_ID_HEADER, requestId);
-      return response;
+  #ignoredWithMetrics(req, ctx, path, next) {
+    const started = Bun.nanoseconds();
+    const failed = (error) => {
+      this.#observe(req, ctx, error instanceof HttpError ? error.status : HttpStatusCode.INTERNAL_SERVER_ERROR, started);
+      throw error;
     };
+    let settled;
+    try {
+      settled = this.#correlateIgnored ? this.#correlated(req, ctx, path, next) : next();
+    } catch (error) {
+      return failed(error);
+    }
+    return settled.then((response) => {
+      this.#observe(req, ctx, response.status, started);
+      return response;
+    }, failed);
+  }
+  #correlated(req, ctx, path, next) {
+    const trace = this.#trace ? TraceContext.adopt(req, this.#traceResponse) : undefined;
+    const stamp = (response) => trace === undefined ? response : TraceContext.stamp(response, req);
     if (!this.#correlate)
       return next().then(stamp);
     return this.context.runWithContext({
-      requestId,
+      ...trace === undefined ? {} : {
+        traceId: trace.traceId,
+        spanId: trace.spanId,
+        traceFlags: trace.flags,
+        ...trace.parentSpanId === undefined ? {} : { parentSpanId: trace.parentSpanId },
+        ...trace.state === undefined ? {} : { traceState: trace.state }
+      },
       method: ctx.method,
       event: path,
       flow: "http",
       context: `${ctx.controller}.${ctx.handler}`
     }, () => next().then(stamp));
   }
-  #dispatch(req, path, requestId, started, request, next, scope) {
+  #dispatch(req, ctx, path, started, request, next, scope) {
     let settled;
     try {
       settled = next();
     } catch (error) {
-      this.#failed(req, path, started, request, error, scope);
+      this.#failed(req, ctx, path, started, request, error, scope);
       throw error;
     }
-    return settled.then((response) => this.#succeeded(req, path, requestId, started, request, response, scope), (error) => {
-      this.#failed(req, path, started, request, error, scope);
+    return settled.then((response) => this.#succeeded(req, ctx, path, started, request, response, scope), (error) => {
+      this.#failed(req, ctx, path, started, request, error, scope);
       throw error;
     });
   }
-  #failed(req, path, started, request, error, scope) {
+  #failed(req, ctx, path, started, request, error, scope) {
     this.#shared(req, request);
     const status = error instanceof HttpError ? error.status : HttpStatusCode.INTERNAL_SERVER_ERROR;
     const entry = {
@@ -492,6 +609,7 @@ class RequestLoggingMiddleware {
       statusCode: status,
       elapsedMs: elapsedMs2(started)
     };
+    this.#observe(req, ctx, status, started);
     const line = `${req.method} ${path} ${status}`;
     if (status < HttpStatusCode.INTERNAL_SERVER_ERROR) {
       this.logger.warn(line, entry);
@@ -499,8 +617,9 @@ class RequestLoggingMiddleware {
       this.logger.error(line, entry);
     }
   }
-  #succeeded(req, path, requestId, started, request, response, scope) {
+  #succeeded(req, ctx, path, started, request, response, scope) {
     this.#shared(req, request);
+    this.#observe(req, ctx, response.status, started);
     const body = this.#responseFields(response);
     if (body === undefined) {
       this.logger.info(`${req.method} ${path} ${response.status}`, {
@@ -509,8 +628,7 @@ class RequestLoggingMiddleware {
         statusCode: response.status,
         elapsedMs: elapsedMs2(started)
       });
-      response.headers.set(REQUEST_ID_HEADER, requestId);
-      return response;
+      return TraceContext.stamp(response, req);
     }
     return body.then((value) => {
       this.logger.info(`${req.method} ${path} ${response.status}`, {
@@ -520,10 +638,14 @@ class RequestLoggingMiddleware {
         ...value === undefined ? {} : { responseBody: value },
         elapsedMs: elapsedMs2(started)
       });
-      response.headers.set(REQUEST_ID_HEADER, requestId);
-      return response;
+      return TraceContext.stamp(response, req);
     });
   }
+  #observe(req, ctx, status, started) {
+    if (this.#metrics === undefined)
+      return;
+    this.#metrics.observe(ctx, status, Bun.nanoseconds() - started, TraceContext.of(req)?.traceId);
+  }
   #body(req, ctx) {
     if (!this.#requestBody)
       return;
@@ -547,7 +669,7 @@ class RequestLoggingMiddleware {
     return response.clone().text().then((text) => parse(text, this.#limit));
   }
 }
-Object.defineProperty(RequestLoggingMiddleware, Symbol.for("dunx.deps"), { value: () => [Logger2, RequestContext2, { unresolved: "options: RequestLoggingOptions = {}", optional: true }] });
+Object.defineProperty(RequestLoggingMiddleware, Symbol.for("dunx.deps"), { value: () => [Logger2, RequestContext2, { unresolved: "options: RequestLoggingOptions = {}", optional: true }, { unresolved: "metrics?: RequestMetrics", typeOnly: "RequestMetrics" }] });
 
 // src/server/settings.ts
 var defaultSettings = () => ({ "trust proxy": false });
@@ -584,6 +706,7 @@ class HttpApplication {
     this.#discovered = discovered;
     this.#middleware = [
       ...options.requestLogging === false ? [] : [RequestLoggingMiddleware],
+      ...usesMetricsMiddleware(options) ? [MetricsMiddleware] : [],
       ...options.middleware ?? []
     ];
     this.#onError = options.onError === undefined ? errorMapper(app.get(Logger3)) : toErrorMapper(options.onError, (token) => app.get(token, root));
@@ -666,6 +789,7 @@ class HttpApplication {
       server: this.#server,
       trustProxy: this.#settings["trust proxy"]
     });
+    this.#app.get(RequestMetrics).attach(this.#server);
     const pubsub = this.#app.get(PubSub);
     pubsub.attach(this.#server);
     if (this.#relay) {
@@ -776,6 +900,9 @@ class HttpOptionsProvider {
   get socketLogging() {
     return true;
   }
+  get metrics() {
+    return false;
+  }
   get onError() {
     return;
   }
@@ -806,6 +933,7 @@ function resolveHttpOptions(settings, given) {
     cors: settings.cors,
     requestLogging: settings.requestLogging,
     socketLogging: settings.socketLogging,
+    metrics: settings.metrics,
     onError: settings.onError,
     websocket: settings.websocket,
     relay: settings.relay,
@@ -828,15 +956,24 @@ var pick = (given, fallback) => {
 class HttpFactory {
   static async create(root, options = {}) {
     const logging = provide(RequestLoggingMiddleware, {
-      useFactory: (logger, context, settings) => new RequestLoggingMiddleware(logger, context, pick(options.requestLogging, settings.requestLogging)),
-      inject: [Logger4, RequestContext3, HttpOptionsProvider]
+      useFactory: (logger, context, settings, metrics) => new RequestLoggingMiddleware(logger, context, pick(options.requestLogging, settings.requestLogging), options.metrics ?? settings.metrics ? metrics : undefined),
+      inject: [
+        Logger4,
+        RequestContext3,
+        HttpOptionsProvider,
+        RequestMetrics
+      ]
+    });
+    const metricsMiddleware = provide(MetricsMiddleware, {
+      useFactory: (metrics) => new MetricsMiddleware(metrics),
+      inject: [RequestMetrics]
     });
     const socketLogging = provide(SocketLoggingMiddleware, {
       useFactory: (logger, context, settings) => new SocketLoggingMiddleware(logger, context, pick(options.socketLogging, settings.socketLogging)),
       inject: [Logger4, RequestContext3, HttpOptionsProvider]
     });
-    const services = [PubSub, ClientAddress];
-    const providers = [...services, logging, socketLogging];
+    const services = [PubSub, ClientAddress, RequestMetrics];
+    const providers = [...services, logging, metricsMiddleware, socketLogging];
     const scope = {
       module: HttpModule,
       global: true,
@@ -1819,6 +1956,7 @@ export {
   MemoryIndicator,
   MemoryOptions,
   MemoryThrottleStore,
+  MetricsMiddleware,
   OnClose,
   OnDrain,
   OnMessage,
@@ -1836,7 +1974,6 @@ export {
   Public,
   Put,
   QueryProbe,
-  REQUEST_ID_HEADER,
   ROLES,
   Readiness,
   ReadinessOptions,
@@ -1845,6 +1982,7 @@ export {
   RedisThrottleStore,
   RelayConnectionOptions,
   RequestLoggingMiddleware,
+  RequestMetrics,
   Roles,
   SKIP_THROTTLE,
   SkipThrottle,
@@ -1854,6 +1992,7 @@ export {
   StaticOptions,
   THROTTLE,
   TRACEPARENT_HEADER,
+  TRACERESPONSE_HEADER,
   TRACESTATE_HEADER,
   Throttle,
   ThrottleGuard,
@@ -1862,6 +2001,7 @@ export {
   ThrottleStore,
   TraceContext,
   UNMATCHED,
+  UNMATCHED_ROUTE,
   UseGuards,
   ValidationError,
   WsRelay,

package/dist/internal.js

@@ -36,7 +36,7 @@ import {
   toErrorMapper,
   withCors,
   withUpgradeRoutes
-} from "./chunk-53cs6qek.js";
+} from "./chunk-y85wcdhw.js";
 import {
   backoffDelay,
   executeWithRetry,
@@ -45,8 +45,8 @@ import {
   isRetryableStatus,
   retryAfterMs,
   safeStringify
-} from "./chunk-7xrtwbx3.js";
-import"./chunk-sz4pvqxy.js";
+} from "./chunk-e8a9c6j2.js";
+import"./chunk-9x3evk19.js";
 // src/inspect.ts
 import {
   collectModules,

package/dist/server/application.d.ts

@@ -50,6 +50,14 @@ export interface HttpOptions extends AppOptions {
      * See {@link RequestLoggingMiddleware}.
      */
     readonly requestLogging?: boolean | RequestLoggingOptions;
+    /**
+     * Count requests and time them per route, readable through
+     * {@link RequestMetrics}. Off by default; `+35.2 ns` per request when
+     * `requestLogging` is on, because the entry it already builds shares the
+     * timing. With `requestLogging: false` a `MetricsMiddleware` pays for its own
+     * `.then` instead, at +175.9 ns.
+     */
+    readonly metrics?: boolean;
     /**
      * One entry at `listen()` naming every route and gateway served. On by default,
      * and switched separately from `requestLogging`: one is per process, the other

package/dist/server/metrics.d.ts

@@ -0,0 +1,80 @@
+import { type HistogramSnapshot } from '@dunx/core';
+import type { BunRequest, Server } from 'bun';
+import type { RouteContext } from './context.js';
+import type { Middleware, Next } from './middleware.js';
+/** Every path Bun matched nothing for, collapsed into one series. */
+export declare const UNMATCHED_ROUTE = "(unmatched)";
+export interface RouteStats {
+    /** The route pattern, so `/users/1` and `/users/2` share one series. */
+    readonly route: string;
+    readonly method: string;
+    readonly count: number;
+    /** Keyed by status code as a string, because that is what JSON gives back. */
+    readonly byStatus: Readonly<Record<string, number>>;
+    /** Nanoseconds. */
+    readonly duration: HistogramSnapshot;
+    /**
+     * The trace of the slowest request on this route so far, which is the only
+     * question a p99 provokes: which request was it, and where are its logs.
+     */
+    readonly slowestTraceId?: string;
+}
+export interface HttpStatsReport {
+    readonly routes: readonly RouteStats[];
+    /** Read off `Bun.serve` at 14.7 ns rather than counted, so dunx counts nothing. */
+    readonly inFlight: number;
+    readonly pendingWebSockets: number;
+    /** When the counters were last reset, or boot. */
+    readonly since: string;
+}
+/**
+ * One series per route, keyed on the frozen `RouteContext` that `buildContext`
+ * makes once at boot. That object identity is the label set: a `Map` lookup on it
+ * is 8.8 ns, where building `${method} ${path}` and hashing it is 206.6 ns.
+ *
+ * Series count is bounded by the handler count, because `ctx.path` is the route
+ * pattern rather than the request's path.
+ *
+ * Bound by `HttpFactory`'s global wrapper, like `PubSub` and `ClientAddress`: an
+ * unbound class self-binds into whichever scope asks first, so a second consumer
+ * would be a boot error.
+ *
+ * `observe` takes everything as parameters and reads no ambient store, which is
+ * what keeps it at 35.2 ns folded into the `.then` request logging already
+ * allocates.
+ */
+export declare class RequestMetrics {
+    #private;
+    observe(ctx: RouteContext, status: number, durationNs: number, traceId?: string): void;
+    snapshot(): HttpStatsReport;
+    /**
+     * Drops every series rather than zeroing them, so a route that stopped being
+     * called stops being reported. A cumulative histogram over a week has a p99
+     * reflecting a deploy three days ago; who calls this is the app's decision.
+     */
+    reset(): void;
+    /** Internal: `listen()` hands the bound server to the resolved singleton. */
+    attach(server: Server<unknown>): void;
+}
+/**
+ * Whether `MetricsMiddleware` is the thing doing the observing.
+ *
+ * With request logging on - the default - `RequestLoggingMiddleware` observes
+ * from the `.then` it already allocates and this middleware would double-count.
+ * Exported because `HttpFactory` binds it and `HttpApplication` installs it, and
+ * the two disagreeing would mean either no metrics or twice as many.
+ */
+export declare const usesMetricsMiddleware: (options: {
+    readonly metrics?: boolean;
+    readonly requestLogging?: unknown;
+}) => boolean;
+/**
+ * Installed by `HttpFactory` only when `requestLogging: false`. With logging on -
+ * the default - `RequestLoggingMiddleware` calls `observe` from the `.then` it
+ * already allocates, at 35.2 ns against this middleware's 175.9 ns standalone.
+ */
+export declare class MetricsMiddleware implements Middleware {
+    private readonly metrics;
+    constructor(metrics: RequestMetrics);
+    handle(_req: BunRequest, ctx: RouteContext, next: Next): Promise<Response>;
+}

package/dist/server/options-provider.d.ts

@@ -75,6 +75,8 @@ export declare abstract class HttpOptionsProvider {
     /** `false` removes the middleware from the chain; an object tunes it. */
     get requestLogging(): boolean | RequestLoggingOptions;
     get socketLogging(): boolean | SocketLoggingOptions;
+    /** Per-route counts and timings. Off by default; see {@link RequestMetrics}. */
+    get metrics(): boolean;
     /**
      * Replaces the default mapper. Prefer an `ErrorFilter` class over a bare
      * function: a class is resolved from the container and can inject.

package/dist/server/request-logging.d.ts

@@ -2,6 +2,7 @@ import { Logger, RequestContext } from '@dunx/core';
 import type { BunRequest } from 'bun';
 import type { RouteContext } from './context.js';
 import type { Middleware, Next } from './middleware.js';
+import type { RequestMetrics } from './metrics.js';
 export interface RequestLoggingOptions {
     /** Bodies past this many characters are logged as a size. Default 2048. `0` omits them. */
     readonly maxBodyLength?: number;
@@ -17,7 +18,7 @@ export interface RequestLoggingOptions {
      * materialised string by the time this clones it. */
     readonly responseBody?: boolean;
     /**
-     * Paths to skip entirely: no entry, no `x-request-id`, and no
+     * Paths to skip entirely: no entry, no trace, no `traceresponse`, and no
      * `AsyncLocalStorage` scope, so anything the handler logs is uncorrelated.
      * `correlateIgnored` buys the correlation back.
      */
@@ -33,24 +34,37 @@ export interface RequestLoggingOptions {
      */
     readonly ignorePrefix?: readonly string[];
     /**
-     * Keep the request id and the async scope on an `ignore`d path. Default
-     * `false`. The path still writes no entry; it gets an id on the response and
-     * everything the handler logs carries it. Costs ~2.2 us of the ~5.4 us the
-     * default path spends.
+     * Keep the trace and the async scope on an `ignore`d path. Default `false`.
+     * The path still writes no entry; it gets a `traceresponse` and everything the
+     * handler logs carries the trace. Costs ~2.2 us of the ~5.4 us the default path
+     * spends.
      */
     readonly correlateIgnored?: boolean;
     /**
      * Wrap every request in an `AsyncLocalStorage` scope. Default `true`, +0.91 us.
-     * It is what lets a service four frames down log `requestId` without being
+     * It is what lets a service four frames down log `traceId` without being
      * handed a request. `correlate: false` skips it; this middleware's own entry is
-     * unchanged, but every other line the request writes loses its id.
+     * unchanged, but every other line the request writes loses its trace.
      */
     readonly correlate?: boolean;
     /**
-     * Adopt W3C Trace Context, so `traceId`, `spanId` and `parentSpanId` join
-     * `requestId`. Default `false`: it costs a header read and 8 random bytes, and
-     * `requestId` already spans two dunx services. `@dunx/http/client` sends the
-     * adopted trace upstream.
+     * Put `traceresponse` on the response. Default `true`, and ~500 ns of the 4.7 us
+     * the path costs, which is the largest thing here that can go without losing a
+     * field from a line.
+     *
+     * `false` keeps the trace on this middleware's own lines, in the async scope and
+     * on the metrics exemplar, and withholds the header from every response
+     * including a failure's: the error mapper stamps from what `TraceContext.adopt`
+     * marked, and this stops it marking.
+     */
+    readonly traceResponse?: boolean;
+    /**
+     * Adopt W3C Trace Context, putting `traceId`, `spanId`, `parentSpanId` and
+     * `traceFlags` on every line the request writes and `traceresponse` on its
+     * response. Default `true`, at 49.2 ns to mint both ids plus one header read.
+     * `@dunx/http/client` sends the adopted trace upstream.
+     *
+     * `false` removes it, and a request then carries no correlation id at all.
      */
     readonly trace?: boolean;
 }
@@ -70,6 +84,6 @@ export declare class RequestLoggingMiddleware implements Middleware {
     #private;
     private readonly logger;
     private readonly context;
-    constructor(logger: Logger, context: RequestContext, options?: RequestLoggingOptions);
+    constructor(logger: Logger, context: RequestContext, options?: RequestLoggingOptions, metrics?: RequestMetrics);
     handle(req: BunRequest, ctx: RouteContext, next: Next): Promise<Response>;
 }

package/dist/server/trace-context.d.ts

@@ -1,5 +1,17 @@
 export declare const TRACEPARENT_HEADER = "traceparent";
 export declare const TRACESTATE_HEADER = "tracestate";
+/**
+ * The span that answered, sent back so a caller can record which of the callee's
+ * spans its own span points at. Same four fields as `traceparent`, and the
+ * the one correlation id a response carries.
+ *
+ * A W3C Distributed Tracing Working Group proposal rather than a ratified
+ * standard: `traceparent` and `tracestate` are the Recommendation, and the
+ * published Trace Context Level 2 Candidate Recommendation Draft covers those two
+ * request headers and not this response one. The format is specified and stable,
+ * and adoption is thin, so treat a caller reading it as a bonus.
+ */
+export declare const TRACERESPONSE_HEADER = "traceresponse";
 export interface Trace {
     /** 32 hex digits, shared by every span in the trace. */
     readonly traceId: string;
@@ -15,14 +27,18 @@ export interface Trace {
 /**
  * W3C Trace Context, propagated across services.
  *
- * The whole of it is one header parsed and one header written. There is no
- * exporter, no sampler and no dependency: what this buys is that every log line a
- * request writes carries the same `traceId` the service upstream logged, so the
- * two can be joined without either of them running a collector.
+ * The whole of it is one header parsed and two written. There is no exporter, no
+ * sampler and no dependency: every log line a request writes carries the same
+ * `traceId` the service upstream logged, so the two join without either of them
+ * running a collector.
+ *
+ * `traceId`, `spanId` and `parentSpanId` are the OpenTelemetry log data model's
+ * own fields, so a collector that ingests these lines correlates them with spans
+ * emitted by anything else speaking the standard. Bun 1.4.0 runs OpenTelemetry's
+ * Node instrumentation, and a trace adopted here is the trace those spans join.
  *
- * `@dunx/http` does not turn this on by itself - `requestLogging: { trace: true }`
- * does. Adopting a trace costs a header read and 8 random bytes on every request,
- * which is not worth spending in a service that has nothing to correlate with.
+ * On by default. `requestLogging: { trace: false }` removes it, at which point a
+ * request carries no correlation id at all.
  */
 export declare class TraceContext {
     #private;
@@ -32,10 +48,15 @@ export declare class TraceContext {
      * higher version keeps its first four fields, so a future format still
      * propagates.
      *
-     * With nothing inbound, `traceId` is the request id minus its hyphens - a UUID
-     * is 16 bytes, exactly a trace id, so there is no second `crypto` call.
+     * A trace that arrived is continued with a span of this server's own, and the
+     * caller's sampling decision is kept rather than overridden.
+     *
+     * `expose: false` adopts the trace without marking it for {@link stamp}, so no
+     * `traceresponse` is written - by this middleware or by the error mapper, which
+     * builds its own `Response` from what was recorded here. Everything inward is
+     * unchanged: the scope, the log lines, the metrics exemplar.
      */
-    static adopt(req: Request, requestId: string): Trace;
+    static adopt(req: Request, expose?: boolean): Trace;
     /** The trace adopted for this request, if one was. */
     static of(req: Request): Trace | undefined;
     /**
@@ -43,5 +64,15 @@ export declare class TraceContext {
      * parent, so the two link without inventing a span nothing logged.
      */
     static header(trace: Pick<Trace, 'traceId' | 'spanId' | 'flags'>): string;
+    /**
+     * The response, carrying `traceresponse` if this request adopted a trace.
+     *
+     * The logging middleware sets the header on a response it returns, and a
+     * failure is never one: the error mapper builds a fresh `Response` outside the
+     * chain, so a guard's 401, a validation 400 and every unmatched 404 would go out
+     * bare. Read back from the request rather than threaded through the mapper,
+     * which an app writes its own of.
+     */
+    static stamp(response: Response, req: Request): Response;
     static sampled(trace: Pick<Trace, 'flags'>): boolean;
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dunx/http",
-  "version": "3.1.3",
+  "version": "3.2.0",
   "description": "Bun.serve adapter for the dunx framework: controllers, middleware and WebSocket gateways",
   "keywords": [
     "bun",
@@ -56,13 +56,16 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@arkv/shared": "^0.8.0"
+    "@arkv/shared": "0.8.0"
   },
   "devDependencies": {
-    "@dunx/core": "workspace:*"
+    "@dunx/core": "workspace:*",
+    "@opentelemetry/api": "1.9.1",
+    "@opentelemetry/core": "2.11.0",
+    "@opentelemetry/sdk-trace-node": "2.11.0"
   },
   "peerDependencies": {
-    "@dunx/core": "^3.1.3",
+    "@dunx/core": "^3.2.0",
     "@types/bun": ">=1.3.0"
   },
   "peerDependenciesMeta": {

package/dist/chunk-25g22350.js

@@ -1,58 +0,0 @@
-// @bun
-// src/server/trace-context.ts
-var TRACEPARENT_HEADER = "traceparent";
-var TRACESTATE_HEADER = "tracestate";
-var HEX_32 = /^[0-9a-f]{32}$/;
-var HEX_16 = /^[0-9a-f]{16}$/;
-var HEX_2 = /^[0-9a-f]{2}$/;
-var ZERO_TRACE = "0".repeat(32);
-var ZERO_SPAN = "0".repeat(16);
-var SAMPLED = 1;
-var TRACE = Symbol.for("dunx.http.trace");
-var mintSpanId = () => Buffer.from(crypto.getRandomValues(new Uint8Array(8))).toString("hex");
-
-class TraceContext {
-  static adopt(req, requestId) {
-    const inbound = TraceContext.#parse(req.headers.get(TRACEPARENT_HEADER));
-    const state = req.headers.get(TRACESTATE_HEADER);
-    const trace = {
-      traceId: inbound?.traceId ?? requestId.replaceAll("-", ""),
-      spanId: mintSpanId(),
-      ...inbound === undefined ? {} : { parentSpanId: inbound.spanId },
-      flags: inbound?.flags ?? "01",
-      ...inbound !== undefined && state !== null ? { state } : {}
-    };
-    req[TRACE] = trace;
-    return trace;
-  }
-  static of(req) {
-    return req[TRACE];
-  }
-  static header(trace) {
-    return `00-${trace.traceId}-${trace.spanId}-${trace.flags}`;
-  }
-  static sampled(trace) {
-    return (Number.parseInt(trace.flags, 16) & SAMPLED) === SAMPLED;
-  }
-  static #parse(header) {
-    if (header === null)
-      return;
-    const parts = header.split("-");
-    if (parts.length < 4)
-      return;
-    const [version, traceId, spanId, flags] = parts;
-    if (!HEX_2.test(version) || version === "ff")
-      return;
-    if (version === "00" && parts.length !== 4)
-      return;
-    if (!HEX_32.test(traceId) || traceId === ZERO_TRACE)
-      return;
-    if (!HEX_16.test(spanId) || spanId === ZERO_SPAN)
-      return;
-    if (!HEX_2.test(flags))
-      return;
-    return { traceId, spanId, flags };
-  }
-}
-
-export { TRACEPARENT_HEADER, TRACESTATE_HEADER, TraceContext };

package/dist/server/request-id.d.ts

@@ -1,22 +0,0 @@
-export declare const REQUEST_ID_HEADER = "x-request-id";
-/**
- * The request id, and the only thing that decides a request has one.
- *
- * The logging middleware sets the header on a response it returns, and a failure
- * is never one - the error mapper builds a fresh `Response` outside the chain. So
- * a guard's 401, a validation 400 and every unmatched 404 went out with no id.
- *
- * Recorded against the request rather than threaded through the mapper, which an
- * app writes its own of. {@link stamp} reads back what {@link assign} recorded, so
- * a path nothing minted an id for is still answered without a header.
- */
-export declare class RequestIds {
-    /**
-     * Called by `RequestLoggingMiddleware` and by nothing else. Splitting minting
-     * from recording would let a second caller invent an id the log line does not
-     * carry.
-     */
-    static assign(req: Request): string;
-    /** The response, with this request's id on it if it was ever given one. */
-    static stamp(response: Response, req: Request): Response;
-}