@getstrata/core 1.1.8 → 2.0.0

package/dist/entries/http/metricsMiddleware.js

@@ -1,6 +1,50 @@
 // @bun
+var __esm = (fn, res, err) => () => {
+  if (fn)
+    try {
+      res = fn(fn = 0);
+    } catch (e) {
+      err = [e];
+    }
+  if (err)
+    throw err[0];
+  return res;
+};
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+var init_asyncContextStore = () => {};
+
 // ../../src/core/metrics/prometheus.ts
+var HTTP_DURATION_BUCKETS_MS = [5, 10, 25, 50, 100, 250, 500, 1000, 2500, 5000, 1e4];
+function emptyHistogram() {
+  return {
+    cumulative: HTTP_DURATION_BUCKETS_MS.map(() => 0),
+    sum: 0,
+    count: 0
+  };
+}
+
 class PrometheusRegistry {
+  maxSeries;
+  seriesLabels = new Map;
+  constructor(maxSeries = 4096) {
+    this.maxSeries = maxSeries;
+    if (!Number.isSafeInteger(maxSeries) || maxSeries < 1) {
+      throw new Error("Metrics maxSeries must be a positive safe integer.");
+    }
+  }
   httpRequestsTotal = new Map;
   httpRequestDurationMs = new Map;
   incrementHttpRequest(labels) {
@@ -8,10 +52,20 @@ class PrometheusRegistry {
     this.httpRequestsTotal.set(key, (this.httpRequestsTotal.get(key) ?? 0) + 1);
   }
   observeHttpDuration(labels, durationMs) {
+    if (!Number.isFinite(durationMs) || durationMs < 0)
+      return;
     const key = this.metricKey(labels);
-    const samples = this.httpRequestDurationMs.get(key) ?? [];
-    samples.push(durationMs);
-    this.httpRequestDurationMs.set(key, samples);
+    const histogram = this.httpRequestDurationMs.get(key) ?? emptyHistogram();
+    histogram.count += 1;
+    histogram.sum += durationMs;
+    for (let index = 0;index < HTTP_DURATION_BUCKETS_MS.length; index += 1) {
+      const bound = HTTP_DURATION_BUCKETS_MS[index];
+      if (bound !== undefined && durationMs <= bound) {
+        const count = histogram.cumulative[index] ?? 0;
+        histogram.cumulative[index] = count + 1;
+      }
+    }
+    this.httpRequestDurationMs.set(key, histogram);
   }
   renderMetrics() {
     const lines = [
@@ -21,16 +75,22 @@ class PrometheusRegistry {
     for (const [key, value] of this.httpRequestsTotal) {
       lines.push(`http_requests_total{${key}} ${value}`);
     }
-    lines.push("# HELP http_request_duration_ms_sum Sum of HTTP request durations in milliseconds.", "# TYPE http_request_duration_ms_sum counter");
-    for (const [key, samples] of this.httpRequestDurationMs) {
-      const sum = samples.reduce((total, sample) => total + sample, 0);
-      lines.push(`http_request_duration_ms_sum{${key}} ${sum}`);
+    lines.push("# HELP http_request_duration_ms HTTP request duration in milliseconds.", "# TYPE http_request_duration_ms histogram");
+    for (const [key, histogram] of this.httpRequestDurationMs) {
+      for (let index = 0;index < HTTP_DURATION_BUCKETS_MS.length; index += 1) {
+        const bound = HTTP_DURATION_BUCKETS_MS[index];
+        lines.push(`http_request_duration_ms_bucket{${key},le="${bound}"} ${histogram.cumulative[index] ?? 0}`);
+      }
+      lines.push(`http_request_duration_ms_bucket{${key},le="+Inf"} ${histogram.count}`);
+      lines.push(`http_request_duration_ms_sum{${key}} ${histogram.sum}`);
+      lines.push(`http_request_duration_ms_count{${key}} ${histogram.count}`);
     }
     return `${lines.join(`
 `)}
 `;
   }
   resetForTests() {
+    this.seriesLabels.clear();
     this.httpRequestsTotal.clear();
     this.httpRequestDurationMs.clear();
   }
@@ -40,9 +100,10 @@ class PrometheusRegistry {
     let totalRequests = 0;
     for (const [key, count] of this.httpRequestsTotal) {
       totalRequests += count;
-      const method = key.match(/method="([^"]+)"/)?.[1] ?? "GET";
-      const path = key.match(/path="([^"]+)"/)?.[1] ?? "/";
-      const status = key.match(/status="([^"]+)"/)?.[1] ?? "200";
+      const labels = this.seriesLabels.get(key);
+      if (!labels)
+        continue;
+      const { method, path, status } = labels;
       byStatus[status] = (byStatus[status] ?? 0) + count;
       const pathKey = `${method} ${path}`;
       const existing = pathCounts.get(pathKey);
@@ -59,33 +120,69 @@ class PrometheusRegistry {
       topPaths
     };
   }
+  getStorageStats() {
+    return {
+      series: this.seriesLabels.size,
+      histograms: this.httpRequestDurationMs.size,
+      bucketCounters: this.httpRequestDurationMs.size * HTTP_DURATION_BUCKETS_MS.length
+    };
+  }
   metricKey(labels) {
-    return `method="${labels.method}",path="${labels.path}",status="${labels.status}"`;
+    const normalized = {
+      method: /^(GET|HEAD|POST|PUT|PATCH|DELETE|CONNECT|OPTIONS|TRACE)$/.test(labels.method) ? labels.method : "OTHER",
+      path: labels.path.length <= 512 ? labels.path : "__overflow__",
+      status: /^[1-5][0-9]{2}$/.test(labels.status) ? labels.status : "000"
+    };
+    const escapeLabel = (value) => value.replaceAll("\\", "\\\\").replaceAll(`
+`, "\\n").replaceAll('"', "\\\"");
+    const encode = (value) => `method="${value.method}",path="${escapeLabel(value.path)}",status="${value.status}"`;
+    let key = encode(normalized);
+    if (!this.seriesLabels.has(key)) {
+      if (this.seriesLabels.size >= this.maxSeries) {
+        const overflow = { method: "OTHER", path: "__overflow__", status: "000" };
+        key = encode(overflow);
+        this.seriesLabels.set(key, overflow);
+      } else {
+        this.seriesLabels.set(key, normalized);
+      }
+    }
+    return key;
   }
 }
 var prometheusRegistry = new PrometheusRegistry;
 
-// ../../src/core/http/metricsMiddleware.ts
-function normalizeMetricPath(pathname) {
-  return pathname.replace(/\/\d+/g, "/:id").replace(/\/[0-9a-f-]{36}/gi, "/:id");
+// ../../src/core/http/requestMetaContext.ts
+init_asyncContextStore();
+var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
+function runWithRequestMeta(meta, callback) {
+  return requestMetaContext.run(meta, callback);
+}
+function currentRequestMeta() {
+  return requestMetaContext.getStore() ?? {
+    ipAddress: null,
+    userAgent: null
+  };
 }
+
+// ../../src/core/http/metricsMiddleware.ts
 function createMetricsMiddleware() {
   return async (request, next) => {
     const startedAt = performance.now();
-    const response = await next();
-    const durationMs = performance.now() - startedAt;
-    const path = normalizeMetricPath(new URL(request.url).pathname);
-    const labels = {
-      method: request.method,
-      path,
-      status: String(response.status)
-    };
-    prometheusRegistry.incrementHttpRequest(labels);
-    prometheusRegistry.observeHttpDuration(labels, durationMs);
-    return response;
+    let response;
+    try {
+      response = await next();
+      return response;
+    } finally {
+      const labels = {
+        method: request.method,
+        path: currentRequestMeta().routeTemplate ?? "__unmatched__",
+        status: String(response?.status ?? 500)
+      };
+      prometheusRegistry.incrementHttpRequest(labels);
+      prometheusRegistry.observeHttpDuration(labels, performance.now() - startedAt);
+    }
   };
 }
 export {
-  createMetricsMiddleware,
-  normalizeMetricPath
+  createMetricsMiddleware
 };

package/dist/entries/http/response.js

@@ -1,4 +1,105 @@
 // @bun
+var __esm = (fn, res, err) => () => {
+  if (fn)
+    try {
+      res = fn(fn = 0);
+    } catch (e) {
+      err = [e];
+    }
+  if (err)
+    throw err[0];
+  return res;
+};
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+var init_asyncContextStore = () => {};
+
+// ../../src/core/database/transactionControl.ts
+function unwrapTransactionRollback(error, depth = 0) {
+  if (error instanceof TransactionRollback) {
+    return error;
+  }
+  if (depth >= 5 || !(error instanceof Error) || error.cause === undefined) {
+    return null;
+  }
+  return unwrapTransactionRollback(error.cause, depth + 1);
+}
+function requestTransactionRollback() {
+  const state = transactionScopes.getStore();
+  const index = state ? state.rollback.length - 1 : -1;
+  if (!state || index < 0) {
+    return;
+  }
+  const flags = state.rollback;
+  const current = flags[index];
+  if (current === undefined) {
+    return;
+  }
+  flags[index] = true;
+}
+function scopeRequestsRollback() {
+  const state = transactionScopes.getStore();
+  if (!state || state.rollback.length === 0) {
+    return false;
+  }
+  return state.rollback[state.rollback.length - 1] === true;
+}
+async function commitOrRollbackScope(result) {
+  if (scopeRequestsRollback()) {
+    throw new TransactionRollback(result);
+  }
+  return result;
+}
+async function settleTransaction(work) {
+  try {
+    return await work();
+  } catch (error) {
+    const rollback = unwrapTransactionRollback(error);
+    if (rollback) {
+      return rollback.result;
+    }
+    throw error;
+  }
+}
+async function runWithTransactionScope(callback) {
+  const existing = transactionScopes.getStore();
+  if (existing) {
+    existing.rollback.push(false);
+    try {
+      return await callback();
+    } finally {
+      existing.rollback.pop();
+    }
+  }
+  const state = { rollback: [false] };
+  return await transactionScopes.run(state, callback);
+}
+var TransactionRollback, transactionScopes;
+var init_transactionControl = __esm(() => {
+  init_asyncContextStore();
+  TransactionRollback = class TransactionRollback extends Error {
+    result;
+    constructor(result) {
+      super("Transaction rolled back");
+      this.name = "TransactionRollback";
+      this.result = result;
+    }
+  };
+  transactionScopes = createAsyncContextStore("@getstrata/transactionScopes");
+});
+
 // ../../src/core/http/response.ts
 import { toHttpError as toHttpError3 } from "@getstrata/core/errors/http";
 
@@ -121,6 +222,9 @@ function isUniqueConstraintError(error) {
   return getPostgresSqlState(error) === "23505";
 }
 
+// ../../src/core/http/response.ts
+init_transactionControl();
+
 // ../../src/core/http/webErrorResponse.ts
 import { toHttpError as toHttpError2, ValidationError } from "@getstrata/core/errors/http";
 import { appLogger } from "@getstrata/core/logging/logger";
@@ -430,6 +534,7 @@ function withErrorHandling(handler) {
     try {
       return await handler(...args);
     } catch (error) {
+      requestTransactionRollback();
       const request = args.find((arg) => arg instanceof Request);
       const webResponse = await webErrorResponse(error, request);
       if (webResponse) {
@@ -444,6 +549,7 @@ function withJsonErrorHandling(handler) {
     try {
       return await handler(...args);
     } catch (error) {
+      requestTransactionRollback();
       return errorResponse(error);
     }
   };
@@ -453,6 +559,7 @@ function createJsonErrorMiddleware() {
     try {
       return await next();
     } catch (error) {
+      requestTransactionRollback();
       return errorResponse(error);
     }
   };

package/dist/entries/http/routeMiddleware.js

@@ -1,4 +1,44 @@
 // @bun
+var __esm = (fn, res, err) => () => {
+  if (fn)
+    try {
+      res = fn(fn = 0);
+    } catch (e) {
+      err = [e];
+    }
+  if (err)
+    throw err[0];
+  return res;
+};
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+var init_asyncContextStore = () => {};
+
+// ../../src/core/http/requestMetaContext.ts
+init_asyncContextStore();
+var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
+function runWithRequestMeta(meta, callback) {
+  return requestMetaContext.run(meta, callback);
+}
+function currentRequestMeta() {
+  return requestMetaContext.getStore() ?? {
+    ipAddress: null,
+    userAgent: null
+  };
+}
+
 // ../../src/core/http/middleware.ts
 function composeMiddleware(...middleware) {
   return (handler) => {

package/dist/entries/http/throttleMiddleware.js

@@ -1,5 +1,33 @@
 // @bun
+var __esm = (fn, res, err) => () => {
+  if (fn)
+    try {
+      res = fn(fn = 0);
+    } catch (e) {
+      err = [e];
+    }
+  if (err)
+    throw err[0];
+  return res;
+};
+
+// ../../src/core/runtime/asyncContextStore.ts
+import { AsyncLocalStorage } from "async_hooks";
+function createAsyncContextStore(key) {
+  const symbol = Symbol.for(key);
+  const globalRecord = globalThis;
+  const existing = globalRecord[symbol];
+  if (existing) {
+    return existing;
+  }
+  const store = new AsyncLocalStorage;
+  globalRecord[symbol] = store;
+  return store;
+}
+var init_asyncContextStore = () => {};
+
 // ../../src/core/http/throttleMiddleware.ts
+import { createHash } from "crypto";
 import { currentAuthUser } from "@getstrata/core/auth/authContext";
 import { currentTenant, rateLimitMultiplierForPlan } from "@getstrata/core/tenant/tenantContext";
 var {RedisClient } = globalThis.Bun;
@@ -122,6 +150,19 @@ function readClientIp(request, env = process.env) {
   return currentRequestMeta().ipAddress ?? undefined;
 }
 
+// ../../src/core/http/requestMetaContext.ts
+init_asyncContextStore();
+var requestMetaContext = createAsyncContextStore("@getstrata/requestMetaContext");
+function runWithRequestMeta(meta, callback) {
+  return requestMetaContext.run(meta, callback);
+}
+function currentRequestMeta2() {
+  return requestMetaContext.getStore() ?? {
+    ipAddress: null,
+    userAgent: null
+  };
+}
+
 // ../../src/core/runtime/frontendMode.ts
 var FRONTEND_MODES = ["api", "server-htmx", "spa-react", "hybrid"];
 var DEFAULT_SPA_PREFIX = "/app";
@@ -162,7 +203,7 @@ function readSpaPrefix() {
 }
 
 // ../../src/core/view/webErrorView.ts
-import { currentRequestMeta as currentRequestMeta2 } from "@getstrata/core/http/requestMetaContext";
+import { currentRequestMeta as currentRequestMeta3 } from "@getstrata/core/http/requestMetaContext";
 
 // ../../src/core/http/safeInternalPath.ts
 var NESTED_REDIRECT_KEYS = new Set(["redirect", "next", "return", "returnTo", "return_to"]);
@@ -281,7 +322,7 @@ async function renderWebErrorHtml(input) {
   try {
     return await render({
       ...input,
-      request: input.request ?? currentRequestMeta2().request
+      request: input.request ?? currentRequestMeta3().request
     });
   } catch {
     return renderKernelErrorChrome(input);
@@ -348,16 +389,84 @@ function resolveThrottleIdentity(request) {
   }
   return readClientIp(request) ?? "unknown";
 }
+var CONSUME_THROTTLE = `
+local count = redis.call('INCR', KEYS[1])
+local ttl = redis.call('PTTL', KEYS[1])
+if ttl < 0 then
+  redis.call('PEXPIRE', KEYS[1], ARGV[1])
+end
+return count
+`;
+function redisThrottleKey(request, prefix, identity) {
+  const bucket = JSON.stringify([
+    currentTenant()?.id ?? null,
+    request.method,
+    currentRequestMeta2().routeTemplate ?? "__unmatched__",
+    identity
+  ]);
+  return namespacedRedisKey(`${prefix}:${createHash("sha256").update(bucket).digest("hex")}`);
+}
+async function consumeRedisThrottle(client, key, decaySeconds, timeoutMs = 1000) {
+  if (!Number.isFinite(decaySeconds) || decaySeconds < 0 || !Number.isSafeInteger(timeoutMs) || timeoutMs < 1) {
+    throw new Error("Invalid throttle expiry or command timeout.");
+  }
+  let timer;
+  try {
+    const result = await Promise.race([
+      client.send("EVAL", [
+        CONSUME_THROTTLE,
+        "1",
+        key,
+        String(Math.max(1, Math.ceil(decaySeconds * 1000)))
+      ]),
+      new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(new Error("Throttle store deadline exceeded.")), timeoutMs);
+      })
+    ]);
+    const count = Number(result);
+    if (!Number.isSafeInteger(count) || count < 1)
+      throw new Error("Invalid throttle store response.");
+    return count;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function createRedisThrottleConsumer(options) {
+  let ownedClient;
+  return async (key, decaySeconds) => {
+    if (!options.redisClient && !ownedClient) {
+      ownedClient = new RedisClient(options.redisUrl, { autoReconnect: false, maxRetries: 0 });
+    }
+    const client = options.redisClient ?? ownedClient;
+    if (!client)
+      throw new Error("Throttle client is required.");
+    try {
+      return await consumeRedisThrottle(client, key, decaySeconds, options.commandTimeoutMs);
+    } catch (error) {
+      if (client === ownedClient) {
+        ownedClient.close();
+        ownedClient = undefined;
+      }
+      throw error;
+    }
+  };
+}
+function throttleUnavailableResponse() {
+  return Response.json({ error: "Rate limiting is temporarily unavailable." }, {
+    status: 503,
+    headers: { "retry-after": "1" }
+  });
+}
 function createThrottleMiddleware(options) {
-  const client = new RedisClient(options.redisUrl);
-  const prefix = options.keyPrefix ?? namespacedRedisKey("throttle:");
+  const consume = createRedisThrottleConsumer(options);
+  const prefix = options.keyPrefix ?? "throttle";
   return async (request, next) => {
-    const identity = resolveThrottleIdentity(request);
-    const path = new URL(request.url).pathname;
-    const throttleKey = `${prefix}${identity}:${path}`;
-    const attempts = Number(await client.incr(throttleKey));
-    if (attempts === 1) {
-      await client.expire(throttleKey, options.decaySeconds);
+    const key = redisThrottleKey(request, prefix, resolveThrottleIdentity(request));
+    let attempts;
+    try {
+      attempts = await consume(key, options.decaySeconds);
+    } catch {
+      return throttleUnavailableResponse();
     }
     const maxAttempts = options.maxAttempts * rateLimitMultiplierForPlan(currentTenant()?.plan ?? "free");
     if (attempts > maxAttempts) {
@@ -367,6 +476,10 @@ function createThrottleMiddleware(options) {
   };
 }
 export {
+  consumeRedisThrottle,
+  createRedisThrottleConsumer,
   createThrottleMiddleware,
-  resolveThrottleIdentity
+  redisThrottleKey,
+  resolveThrottleIdentity,
+  throttleUnavailableResponse
 };