@rivetkit/engine 1.0.0

package/packages/guard/tests/parse_actor_path.rs

@@ -0,0 +1,240 @@
+use rivet_guard::routing::parse_actor_path;
+
+#[test]
+fn test_parse_actor_path_with_token() {
+	// Basic path with token using @ syntax
+	let path = "/gateway/actor-123@my-token/api/v1/endpoint";
+	let result = parse_actor_path(path).unwrap();
+	assert_eq!(result.actor_id, "actor-123");
+	assert_eq!(result.token, Some("my-token".to_string()));
+	assert_eq!(result.remaining_path, "/api/v1/endpoint");
+}
+
+#[test]
+fn test_parse_actor_path_without_token() {
+	// Path without token
+	let path = "/gateway/actor-123/api/v1/endpoint";
+	let result = parse_actor_path(path).unwrap();
+	assert_eq!(result.actor_id, "actor-123");
+	assert_eq!(result.token, None);
+	assert_eq!(result.remaining_path, "/api/v1/endpoint");
+}
+
+#[test]
+fn test_parse_actor_path_with_uuid() {
+	// Path with UUID as actor ID
+	let path = "/gateway/12345678-1234-1234-1234-123456789abc/status";
+	let result = parse_actor_path(path).unwrap();
+	assert_eq!(result.actor_id, "12345678-1234-1234-1234-123456789abc");
+	assert_eq!(result.token, None);
+	assert_eq!(result.remaining_path, "/status");
+}
+
+#[test]
+fn test_parse_actor_path_with_query_params() {
+	// Path with query parameters
+	let path = "/gateway/actor-456/api/endpoint?foo=bar&baz=qux";
+	let result = parse_actor_path(path).unwrap();
+	assert_eq!(result.actor_id, "actor-456");
+	assert_eq!(result.token, None);
+	assert_eq!(result.remaining_path, "/api/endpoint?foo=bar&baz=qux");
+
+	// Path with token and query parameters
+	let path = "/gateway/actor-456@token123/api?key=value";
+	let result = parse_actor_path(path).unwrap();
+	assert_eq!(result.actor_id, "actor-456");
+	assert_eq!(result.token, Some("token123".to_string()));
+	assert_eq!(result.remaining_path, "/api?key=value");
+}
+
+#[test]
+fn test_parse_actor_path_with_fragment() {
+	// Path with fragment
+	let path = "/gateway/actor-789/page#section";
+	let result = parse_actor_path(path).unwrap();
+	assert_eq!(result.actor_id, "actor-789");
+	assert_eq!(result.token, None);
+	// Fragment is stripped during parsing
+	assert_eq!(result.remaining_path, "/page");
+}
+
+#[test]
+fn test_parse_actor_path_empty_remaining() {
+	// Path with no remaining path
+	let path = "/gateway/actor-000";
+	let result = parse_actor_path(path).unwrap();
+	assert_eq!(result.actor_id, "actor-000");
+	assert_eq!(result.token, None);
+	assert_eq!(result.remaining_path, "/");
+
+	// With token and no remaining path
+	let path = "/gateway/actor-000@tok";
+	let result = parse_actor_path(path).unwrap();
+	assert_eq!(result.actor_id, "actor-000");
+	assert_eq!(result.token, Some("tok".to_string()));
+	assert_eq!(result.remaining_path, "/");
+}
+
+#[test]
+fn test_parse_actor_path_with_trailing_slash() {
+	// Path with trailing slash
+	let path = "/gateway/actor-111/api/";
+	let result = parse_actor_path(path).unwrap();
+	assert_eq!(result.actor_id, "actor-111");
+	assert_eq!(result.token, None);
+	assert_eq!(result.remaining_path, "/api/");
+}
+
+#[test]
+fn test_parse_actor_path_complex_remaining() {
+	// Complex remaining path with multiple segments
+	let path = "/gateway/actor-complex@secure-token/api/v2/users/123/profile/settings";
+	let result = parse_actor_path(path).unwrap();
+	assert_eq!(result.actor_id, "actor-complex");
+	assert_eq!(result.token, Some("secure-token".to_string()));
+	assert_eq!(result.remaining_path, "/api/v2/users/123/profile/settings");
+}
+
+#[test]
+fn test_parse_actor_path_special_characters() {
+	// Actor ID with allowed special characters
+	let path = "/gateway/actor_id-123.test/endpoint";
+	let result = parse_actor_path(path).unwrap();
+	assert_eq!(result.actor_id, "actor_id-123.test");
+	assert_eq!(result.token, None);
+	assert_eq!(result.remaining_path, "/endpoint");
+}
+
+#[test]
+fn test_parse_actor_path_encoded_characters() {
+	// URL encoded characters in remaining path
+	let path = "/gateway/actor-123/api%20endpoint/test%2Fpath";
+	let result = parse_actor_path(path).unwrap();
+	assert_eq!(result.actor_id, "actor-123");
+	assert_eq!(result.token, None);
+	assert_eq!(result.remaining_path, "/api%20endpoint/test%2Fpath");
+}
+
+#[test]
+fn test_parse_actor_path_encoded_actor_id() {
+	// URL encoded characters in actor_id (e.g., actor-123 with hyphen encoded)
+	let path = "/gateway/actor%2D123/endpoint";
+	let result = parse_actor_path(path).unwrap();
+	assert_eq!(result.actor_id, "actor-123");
+	assert_eq!(result.token, None);
+	assert_eq!(result.remaining_path, "/endpoint");
+}
+
+#[test]
+fn test_parse_actor_path_encoded_token() {
+	// URL encoded characters in token (e.g., @ symbol encoded in token)
+	let path = "/gateway/actor-123@tok%40en/endpoint";
+	let result = parse_actor_path(path).unwrap();
+	assert_eq!(result.actor_id, "actor-123");
+	assert_eq!(result.token, Some("tok@en".to_string()));
+	assert_eq!(result.remaining_path, "/endpoint");
+}
+
+#[test]
+fn test_parse_actor_path_encoded_actor_id_and_token() {
+	// URL encoded characters in both actor_id and token
+	let path = "/gateway/actor%2D123@token%2Dwith%2Dencoded/endpoint";
+	let result = parse_actor_path(path).unwrap();
+	assert_eq!(result.actor_id, "actor-123");
+	assert_eq!(result.token, Some("token-with-encoded".to_string()));
+	assert_eq!(result.remaining_path, "/endpoint");
+}
+
+#[test]
+fn test_parse_actor_path_encoded_spaces() {
+	// URL encoded spaces in actor_id
+	let path = "/gateway/actor%20with%20spaces/endpoint";
+	let result = parse_actor_path(path).unwrap();
+	assert_eq!(result.actor_id, "actor with spaces");
+	assert_eq!(result.token, None);
+	assert_eq!(result.remaining_path, "/endpoint");
+}
+
+// Invalid path tests
+
+#[test]
+fn test_parse_actor_path_invalid_prefix() {
+	// Wrong prefix
+	assert!(parse_actor_path("/api/123/endpoint").is_none());
+	assert!(parse_actor_path("/actor/123/endpoint").is_none());
+}
+
+#[test]
+fn test_parse_actor_path_too_short() {
+	// Too few segments
+	assert!(parse_actor_path("/gateway").is_none());
+}
+
+#[test]
+fn test_parse_actor_path_malformed_token() {
+	// Token without actor_id (empty before @)
+	assert!(parse_actor_path("/gateway/@tok/api").is_none());
+	// Empty token (nothing after @)
+	assert!(parse_actor_path("/gateway/actor-123@/api").is_none());
+}
+
+#[test]
+fn test_parse_actor_path_empty_values() {
+	// Empty actor_id
+	assert!(parse_actor_path("/gateway//endpoint").is_none());
+}
+
+#[test]
+fn test_parse_actor_path_double_slash() {
+	// Double slashes in path
+	let path = "/gateway//actor-123/endpoint";
+	// This will fail because the double slash creates an empty segment
+	assert!(parse_actor_path(path).is_none());
+}
+
+#[test]
+fn test_parse_actor_path_case_sensitive() {
+	// Keywords are case sensitive
+	assert!(parse_actor_path("/Gateway/123/endpoint").is_none());
+}
+
+#[test]
+fn test_parse_actor_path_query_and_fragment() {
+	// Path with both query and fragment
+	let path = "/gateway/actor-123/api?query=1#section";
+	let result = parse_actor_path(path).unwrap();
+	assert_eq!(result.actor_id, "actor-123");
+	assert_eq!(result.token, None);
+	// Fragment is stripped, query is preserved
+	assert_eq!(result.remaining_path, "/api?query=1");
+}
+
+#[test]
+fn test_parse_actor_path_only_query_string() {
+	// Path ending after actor_id but having query string
+	let path = "/gateway/actor-123?direct=true";
+	let result = parse_actor_path(path).unwrap();
+	assert_eq!(result.actor_id, "actor-123");
+	assert_eq!(result.token, None);
+	assert_eq!(result.remaining_path, "/?direct=true");
+}
+
+#[test]
+fn test_parse_actor_path_token_with_special_chars() {
+	// Token containing special characters
+	let path = "/gateway/actor-123@token_with-chars.123/endpoint";
+	let result = parse_actor_path(path).unwrap();
+	assert_eq!(result.actor_id, "actor-123");
+	assert_eq!(result.token, Some("token_with-chars.123".to_string()));
+	assert_eq!(result.remaining_path, "/endpoint");
+}
+
+#[test]
+fn test_parse_actor_path_multiple_at_signs() {
+	// Multiple @ signs - only first one is used for token splitting
+	let path = "/gateway/actor-123@token@with@ats/endpoint";
+	let result = parse_actor_path(path).unwrap();
+	assert_eq!(result.actor_id, "actor-123");
+	assert_eq!(result.token, Some("token@with@ats".to_string()));
+	assert_eq!(result.remaining_path, "/endpoint");
+}

package/packages/guard-core/Cargo.toml

@@ -0,0 +1,58 @@
+[package]
+name = "rivet-guard-core"
+version.workspace = true
+edition.workspace = true
+authors.workspace = true
+license.workspace = true
+
+[features]
+ops = ["dep:gas", "dep:clickhouse-user-query", "dep:once_cell"]
+
+[dependencies]
+anyhow.workspace = true
+async-trait.workspace = true
+bytes.workspace = true
+clickhouse-inserter.workspace = true
+futures-util.workspace = true
+futures.workspace = true
+http-body-util.workspace = true
+http-body.workspace = true
+http.workspace = true
+# TODO: Make this use workspace version
+hyper = { version = "1.6.0", features = ["full", "http1", "http2"] }
+hyper-tungstenite.workspace = true
+hyper-util = { workspace = true, features = ["full"] }
+indoc.workspace = true
+lazy_static.workspace = true
+moka = { workspace = true, features = ["future"] }
+rand.workspace = true
+regex.workspace = true
+rivet-api-builder.workspace = true
+rivet-config.workspace = true
+rivet-error.workspace = true
+rivet-metrics.workspace = true
+rivet-runner-protocol.workspace = true
+rivet-runtime.workspace = true
+rivet-util.workspace = true
+rustls-pemfile.workspace = true
+rustls.workspace = true
+serde_json.workspace = true
+serde.workspace = true
+tokio-rustls.workspace = true
+tokio-tungstenite.workspace = true
+tokio.workspace = true
+tracing-subscriber = { workspace = true, features = ["env-filter"] }
+tracing.workspace = true
+url.workspace = true
+uuid = { workspace = true, features = ["v4", "serde"] }
+
+# Optional dependencies for ops feature
+gas = { workspace = true, optional = true }
+clickhouse-user-query = { workspace = true, optional = true }
+once_cell = { workspace = true, optional = true }
+
+[dev-dependencies]
+futures-util.workspace = true
+futures.workspace = true
+reqwest.workspace = true
+tokio-stream.workspace = true

package/packages/guard-core/src/analytics.rs

@@ -0,0 +1,46 @@
+use serde::{Deserialize, Serialize};
+
+// Properties not currently collected but should be added in future iterations:
+// - client_ssl_cipher: Requires TLS connection introspection
+// - client_ssl_protocol: Requires TLS connection introspection
+// - client_tcp_rtt_ms: Requires network-level measurements
+// - client_request_bytes: Total request size including headers
+// - service_dns_response_time_ms: Requires DNS timing instrumentation
+// - service_ssl_protocol: Requires upstream TLS introspection
+// - service_tcp_handshake_duration_ms: Requires connection-level timing
+// - service_tls_handshake_duration_ms: Requires TLS handshake timing
+// - service_request_header_send_duration_ms: Requires granular timing
+// - service_response_header_receive_duration_ms: Requires granular timing
+// - guard_response_bytes: Total response size including headers
+// - guard_time_to_first_byte_ms: Requires granular timing
+// - security_rule_id: Requires security/firewall rule integration
+
+#[derive(Debug, Clone, Serialize, Deserialize)]
+pub struct GuardHttpRequest {
+	// TODO:
+	// pub request_id: Id,
+	// pub ray_id: Id,
+	pub client_ip: String,
+	pub client_request_body_bytes: u64,
+	pub client_request_host: String,
+	pub client_request_method: String,
+	pub client_request_path: String,
+	pub client_request_protocol: String,
+	pub client_request_referer: String,
+	pub client_request_scheme: String,
+	pub client_request_uri: String,
+	pub client_request_user_agent: String,
+	pub client_src_port: u16,
+	pub client_x_requested_with: String,
+	pub guard_end_timestamp: u64,
+	pub guard_response_body_bytes: u64,
+	pub guard_response_content_type: String,
+	pub guard_response_status: u16,
+	pub guard_start_timestamp: u64,
+	pub service_ip: String,
+	pub service_response_duration_ms: u32,
+	pub service_response_http_expires: String,
+	pub service_response_http_last_modified: String,
+	pub service_response_status: u16,
+	pub service_actor_id: String,
+}

package/packages/guard-core/src/cert_resolver.rs

@@ -0,0 +1,61 @@
+use rustls::server::{ClientHello, ResolvesServerCert};
+use rustls::{ServerConfig, sign::CertifiedKey};
+use std::sync::Arc;
+
+/// Type signature for a function that resolves a TLS certificate based on the server name
+pub type CertResolverFn = Arc<
+	dyn Fn(&str) -> Result<Arc<CertifiedKey>, Box<dyn std::error::Error + Send + Sync>>
+		+ Send
+		+ Sync,
+>;
+
+/// Custom certificate resolver implementation that delegates to a resolver function
+pub(crate) struct CertResolver {
+	resolver_fn: CertResolverFn,
+}
+
+impl std::fmt::Debug for CertResolver {
+	fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+		f.debug_struct("CertResolver")
+			.field("resolver_fn", &"<function>")
+			.finish()
+	}
+}
+
+impl CertResolver {
+	pub fn new(resolver_fn: CertResolverFn) -> Self {
+		Self { resolver_fn }
+	}
+}
+
+impl ResolvesServerCert for CertResolver {
+	fn resolve(&self, client_hello: ClientHello) -> Option<Arc<CertifiedKey>> {
+		// Extract the server name if available
+		if let Some(server_name) = client_hello.server_name() {
+			tracing::debug!("SNI server name requested: {}", server_name);
+
+			// Call the resolver function with the server name directly
+			let resolver_fn = &self.resolver_fn;
+			match (resolver_fn)(server_name) {
+				Ok(cert) => {
+					tracing::debug!("Resolved certificate for {}", server_name);
+					return Some(cert);
+				}
+				Err(e) => {
+					// Log the error but don't fall back to a default certificate
+					tracing::debug!("Error resolving certificate for {}: {}", server_name, e);
+					return None;
+				}
+			}
+		} else {
+			tracing::debug!("No SNI server name provided");
+			return None;
+		}
+	}
+}
+
+pub fn create_tls_config(resolver_fn: CertResolverFn) -> ServerConfig {
+	ServerConfig::builder()
+		.with_no_client_auth()
+		.with_cert_resolver(Arc::new(CertResolver::new(resolver_fn)))
+}

package/packages/guard-core/src/custom_serve.rs

@@ -0,0 +1,52 @@
+use anyhow::{Result, bail};
+use async_trait::async_trait;
+use bytes::Bytes;
+use http_body_util::Full;
+use hyper::{Request, Response};
+use rivet_runner_protocol as protocol;
+use tokio_tungstenite::tungstenite::protocol::frame::CloseFrame;
+
+use crate::WebSocketHandle;
+use crate::proxy_service::ResponseBody;
+use crate::request_context::RequestContext;
+
+pub enum HibernationResult {
+	Continue,
+	Close,
+}
+
+/// Trait for custom request serving logic that can handle both HTTP and WebSocket requests
+#[async_trait]
+pub trait CustomServeTrait: Send + Sync {
+	/// Handle a regular HTTP request
+	async fn handle_request(
+		&self,
+		req: Request<Full<Bytes>>,
+		request_context: &mut RequestContext,
+		request_id: protocol::RequestId,
+	) -> Result<Response<ResponseBody>>;
+
+	/// Handle a WebSocket connection after upgrade. Supports connection retries.
+	async fn handle_websocket(
+		&self,
+		_websocket: WebSocketHandle,
+		_headers: &hyper::HeaderMap,
+		_path: &str,
+		_request_context: &mut RequestContext,
+		// Identifies the websocket across retries.
+		_unique_request_id: protocol::RequestId,
+		// True if this websocket is reconnecting after hibernation.
+		_after_hibernation: bool,
+	) -> Result<Option<CloseFrame>> {
+		bail!("service does not support websockets");
+	}
+
+	/// Returns true if the websocket should close.
+	async fn handle_websocket_hibernation(
+		&self,
+		_websocket: WebSocketHandle,
+		_unique_request_id: protocol::RequestId,
+	) -> Result<HibernationResult> {
+		bail!("service does not support websocket hibernation");
+	}
+}

package/packages/guard-core/src/errors.rs

@@ -0,0 +1,113 @@
+use rivet_error::*;
+use rivet_util::Id;
+use serde::{Deserialize, Serialize};
+
+#[derive(RivetError, Serialize, Deserialize)]
+#[error(
+	"guard",
+	"rate_limit",
+	"Too many requests. Try again later.",
+	"Too many requests to '{method} {path}' (actor_id: {actor_id:?}) from IP {ip}."
+)]
+pub struct RateLimit {
+	pub actor_id: Option<Id>,
+	pub method: String,
+	pub path: String,
+	pub ip: String,
+}
+
+#[derive(RivetError, Serialize, Deserialize)]
+#[error(
+	"guard",
+	"http_request_build_failed",
+	"Failed to build HTTP request.",
+	"Failed to build HTTP request: {0}."
+)]
+pub struct HttpRequestBuildFailed(pub String);
+
+#[derive(RivetError, Serialize, Deserialize)]
+#[error(
+	"guard",
+	"uri_parse_error",
+	"URI parse error.",
+	"URI parse error: {0}."
+)]
+pub struct UriParseError(pub String);
+
+#[derive(RivetError, Serialize, Deserialize)]
+#[error(
+	"guard",
+	"request_build_error",
+	"Request build error.",
+	"Request build error: {0}."
+)]
+pub struct RequestBuildError(pub String);
+
+#[derive(RivetError)]
+#[error("guard", "upstream_error", "Upstream error.", "Upstream error: {0}")]
+pub struct UpstreamError(pub String);
+
+#[derive(RivetError, Serialize, Deserialize)]
+#[error(
+	"guard",
+	"request_timeout",
+	"Request timed out.",
+	"Request timed out after {timeout_seconds} seconds."
+)]
+pub struct RequestTimeout {
+	pub timeout_seconds: u64,
+}
+
+#[derive(RivetError, Serialize, Deserialize)]
+#[error("guard", "no_route_targets", "No targets found.")]
+pub struct NoRouteTargets;
+
+#[derive(RivetError, Serialize, Deserialize)]
+#[error(
+	"guard",
+	"retry_attempts_exceeded",
+	"Retry attempts exceeded.",
+	"All {attempts} retry attempts failed."
+)]
+pub struct RetryAttemptsExceeded {
+	pub attempts: u32,
+}
+
+#[derive(RivetError, Serialize, Deserialize)]
+#[error("guard", "connection_error", "Connection error: {error_message}.")]
+pub struct ConnectionError {
+	pub error_message: String,
+	pub remote_addr: String,
+}
+
+#[derive(RivetError, Serialize, Deserialize)]
+#[error("guard", "service_unavailable", "Service unavailable.")]
+pub struct ServiceUnavailable;
+
+#[derive(RivetError, Serialize, Deserialize)]
+#[error(
+	"guard",
+	"websocket_service_unavailable",
+	"WebSocket service unavailable."
+)]
+pub struct WebSocketServiceUnavailable;
+
+#[derive(RivetError, Serialize, Deserialize)]
+#[error(
+	"guard",
+	"websocket_service_hibernate",
+	"Initiate WebSocket service hibernation."
+)]
+pub struct WebSocketServiceHibernate;
+
+#[derive(RivetError, Serialize, Deserialize)]
+#[error("guard", "websocket_service_timeout", "WebSocket service timed out.")]
+pub struct WebSocketServiceTimeout;
+
+#[derive(RivetError, Serialize, Deserialize)]
+#[error(
+	"guard",
+	"target_changed",
+	"WebSocket target changed, retry not possible."
+)]
+pub struct WebSocketTargetChanged;

package/packages/guard-core/src/lib.rs

@@ -0,0 +1,25 @@
+pub mod analytics;
+pub mod cert_resolver;
+pub mod custom_serve;
+pub mod errors;
+pub mod metrics;
+pub mod proxy_service;
+pub mod request_context;
+mod server;
+mod task_group;
+pub mod types;
+pub mod websocket_handle;
+
+pub use cert_resolver::CertResolverFn;
+pub use custom_serve::CustomServeTrait;
+pub use proxy_service::{
+	CacheKeyFn, MiddlewareFn, ProxyService, ProxyState, RouteTarget, RoutingFn, RoutingOutput,
+};
+pub use websocket_handle::WebSocketHandle;
+
+// Re-export hyper StatusCode for use in other crates
+pub mod status {
+	pub use hyper::StatusCode;
+}
+pub use server::run_server;
+pub use types::{EndpointType, GameGuardProtocol};

package/packages/guard-core/src/metrics.rs

@@ -0,0 +1,64 @@
+use lazy_static::lazy_static;
+use rivet_metrics::{
+	BUCKETS,
+	otel::{global::*, metrics::*},
+};
+
+lazy_static! {
+	static ref METER: Meter = meter("rivet-guard");
+
+	// MARK: Internal
+	/// Has no expected attributes
+	pub static ref ROUTE_CACHE_COUNT: Gauge<u64> = METER.u64_gauge("rivet_guard_route_cache_count")
+		.with_description("Number of entries in the route cache")
+		.build();
+	/// Has no expected attributes
+	pub static ref RATE_LIMITER_COUNT: Gauge<u64> = METER.u64_gauge("rivet_guard_rate_limiter_count")
+		.with_description("Number of active rate limiters")
+		.build();
+	/// Has no expected attributes
+	pub static ref IN_FLIGHT_COUNTER_COUNT: Gauge<u64> = METER.u64_gauge("rivet_guard_in_flight_counter_count")
+		.with_description("Number of active in-flight counters")
+		.build();
+
+	// MARK: TCP
+	/// Has no expected attributes
+	pub static ref TCP_CONNECTION_TOTAL: Counter<u64> = METER.u64_counter("rivet_guard_tcp_connection_total")
+		.with_description("Total number of TCP connections ever")
+		.build();
+	/// Has no expected attributes
+	pub static ref TCP_CONNECTION_PENDING: UpDownCounter<i64> = METER.i64_up_down_counter("rivet_guard_tcp_connection_pending")
+		.with_description("Total number of open TCP connections")
+		.build();
+	/// Has no expected attributes
+	pub static ref TCP_CONNECTION_DURATION: Histogram<f64> = METER.f64_histogram("rivet_guard_tcp_connection_duration")
+		.with_description("TCP connection duration in seconds")
+		.with_boundaries(BUCKETS.to_vec())
+		.build();
+
+	// MARK: Pre-proxy
+	/// Has no expected attributes
+	pub static ref RESOLVE_ROUTE_DURATION: Histogram<f64> = METER.f64_histogram("rivet_guard_resolve_route_duration")
+		.with_description("Time to resolve request route in seconds")
+		.with_boundaries(BUCKETS.to_vec())
+		.build();
+
+	// MARK: Proxy requests
+	/// Has no expected attributes
+	pub static ref PROXY_REQUEST_TOTAL: Counter<u64> = METER.u64_counter("rivet_guard_proxy_request_total")
+		.with_description("Total number of requests to actor")
+		.build();
+	/// Has no expected attributes
+	pub static ref PROXY_REQUEST_PENDING: UpDownCounter<i64> = METER.i64_up_down_counter("rivet_guard_proxy_request_pending")
+		.with_description("Number of pending requests to actor")
+		.build();
+	/// Expected attributes: "status"
+	pub static ref PROXY_REQUEST_DURATION: Histogram<f64> = METER.f64_histogram("rivet_guard_proxy_request_duration")
+		.with_description("Request duration in seconds")
+		.with_boundaries(BUCKETS.to_vec())
+		.build();
+	/// Expected attributes: "error_type"
+	pub static ref PROXY_REQUEST_ERROR: Counter<u64> = METER.u64_counter("rivet_guard_proxy_request_errors_total")
+		.with_description("Total number of errors when proxying requests to actor")
+		.build();
+}