@spinajs/telemetry 2.0.482

package/lib/cjs/metrics.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The metric abstraction lives in `@spinajs/telemetry-common`, which depends on nothing but
+ * `@spinajs/di` and prom-client.
+ *
+ * It was extracted for one reason: `@spinajs/orm` publishes connection-pool telemetry, and this
+ * package depends on `@spinajs/http`, `@spinajs/log`, `@spinajs/validation` and
+ * `@spinajs/configuration`. An ORM that depended on `@spinajs/telemetry` would put the whole HTTP
+ * stack underneath every database connection. Same reason `@spinajs/configuration-common` and
+ * `@spinajs/log-common` exist.
+ *
+ * Re-exported here so `import { Metrics } from '@spinajs/telemetry'` keeps working, and so both
+ * packages share ONE `Metrics` class identity — DI resolves the singleton by that identity, and a
+ * second copy would mean a second, separate registry.
+ */
+export * from '@spinajs/telemetry-common';
+//# sourceMappingURL=metrics.d.ts.map

package/lib/cjs/metrics.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../src/metrics.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,cAAc,2BAA2B,CAAC"}

package/lib/cjs/metrics.js

@@ -0,0 +1,32 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+/**
+ * The metric abstraction lives in `@spinajs/telemetry-common`, which depends on nothing but
+ * `@spinajs/di` and prom-client.
+ *
+ * It was extracted for one reason: `@spinajs/orm` publishes connection-pool telemetry, and this
+ * package depends on `@spinajs/http`, `@spinajs/log`, `@spinajs/validation` and
+ * `@spinajs/configuration`. An ORM that depended on `@spinajs/telemetry` would put the whole HTTP
+ * stack underneath every database connection. Same reason `@spinajs/configuration-common` and
+ * `@spinajs/log-common` exist.
+ *
+ * Re-exported here so `import { Metrics } from '@spinajs/telemetry'` keeps working, and so both
+ * packages share ONE `Metrics` class identity — DI resolves the singleton by that identity, and a
+ * second copy would mean a second, separate registry.
+ */
+__exportStar(require("@spinajs/telemetry-common"), exports);
+//# sourceMappingURL=metrics.js.map

package/lib/cjs/metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../../src/metrics.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;;GAaG;AACH,4DAA0C"}

package/lib/cjs/middleware.d.ts

@@ -0,0 +1,81 @@
+import * as express from 'express';
+import { Log } from '@spinajs/log';
+import { ServerMiddleware, Request as sRequest } from '@spinajs/http';
+import { Counter, Gauge, Histogram } from 'prom-client';
+import { Metrics } from './metrics.js';
+import { TelemetryStore } from './store.js';
+/**
+ * Default metric-name prefix for the HTTP telemetry metrics.
+ */
+export declare const DEFAULT_PREFIX = "http";
+/**
+ * Histogram bucket boundaries ( ms ) for request duration.
+ */
+export declare const DURATION_BUCKETS_MS: number[];
+/**
+ * HTTP request-timing / metrics middleware.
+ *
+ * Times every request and records:
+ *  - `${prefix}_requests_total{method,route,status}` — a Counter,
+ *  - `${prefix}_request_duration_ms{method,route,status}` — a Histogram,
+ *  - `${prefix}_requests_in_flight` — a Gauge,
+ * against the DI-resolved {@link Metrics} registry, and feeds the shared
+ * {@link TelemetryStore} that backs the JSON stats endpoints.
+ *
+ * All of the end-of-request work runs from a `res.on( 'finish' )` handler
+ * registered in `before()` — `ServerMiddleware.after()` is never reached for a
+ * normal matched route, the same reason http's own `AccessLog` / `PerfRollup`
+ * middlewares work this way. A `res.on( 'close' )` handler balances the in-flight
+ * gauge — and only the gauge — for requests the client aborted, where `'finish'`
+ * never fires. Every bit of it is guarded so telemetry can never break a request.
+ */
+export declare class TelemetryMiddleware extends ServerMiddleware {
+    protected Log: Log;
+    /**
+     * The shared aggregates. This middleware is the only writer.
+     */
+    protected Store: TelemetryStore;
+    /**
+     * Metric-name prefix. Set it with the `telemetry.prefix` configuration key —
+     * that is the supported way to re-prefix, and it needs no subclass.
+     *
+     * The precedence implemented in {@link ensureMetrics} is: a value assigned to
+     * this field that differs from {@link DEFAULT_PREFIX} wins, otherwise
+     * `telemetry.prefix` is used, otherwise {@link DEFAULT_PREFIX}. That override
+     * exists for subclasses that are replacing the middleware wholesale — see the
+     * README's "Replacing the middleware" section, which also covers the
+     * double-registration hazard of subclassing. Do NOT subclass merely to change
+     * the prefix.
+     */
+    protected Prefix: string;
+    protected ConfiguredPrefix: string;
+    protected Buckets: number[];
+    protected metrics: Metrics;
+    protected requestsTotal: Counter<string>;
+    protected requestDuration: Histogram<string>;
+    protected inFlight: Gauge<string>;
+    private defined;
+    constructor();
+    /**
+     * Lazily resolve {@link Metrics} and define the metric set on first use.
+     * Idempotent — {@link Metrics.defineMetrics} removes+recreates duplicates.
+     */
+    protected ensureMetrics(): void;
+    /**
+     * Derive a stable, low-cardinality route label. Prefers the matched route
+     * path ( `req.route.path` or `req.storage.route` ) over the raw request path.
+     */
+    protected routeLabel(req: sRequest): string;
+    /**
+     * Do the end-of-request accounting. Called from the response `finish` event,
+     * never from `after()`.
+     */
+    protected onFinish(req: sRequest, res: express.Response): void;
+    before(): (req: sRequest, res: express.Response, next: express.NextFunction) => void;
+    /**
+     * Nothing to do after the controllers — express does not run this for a
+     * matched route. See {@link onFinish}.
+     */
+    after(): null;
+}
+//# sourceMappingURL=middleware.d.ts.map

package/lib/cjs/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,OAAO,MAAM,SAAS,CAAC;AAGnC,OAAO,EAAU,GAAG,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,gBAAgB,EAAE,OAAO,IAAI,QAAQ,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,OAAO,EAAa,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAE5C;;GAEG;AACH,eAAO,MAAM,cAAc,SAAS,CAAC;AAErC;;GAEG;AACH,eAAO,MAAM,mBAAmB,UAA0D,CAAC;AAO3F;;;;;;;;;;;;;;;;GAgBG;AACH,qBACa,mBAAoB,SAAQ,gBAAgB;IAEvD,SAAS,CAAC,GAAG,EAAG,GAAG,CAAC;IAEpB;;OAEG;IAEH,SAAS,CAAC,KAAK,EAAG,cAAc,CAAC;IAEjC;;;;;;;;;;;OAWG;IACH,SAAS,CAAC,MAAM,SAAkB;IAGlC,SAAS,CAAC,gBAAgB,EAAG,MAAM,CAAC;IAGpC,SAAS,CAAC,OAAO,EAAG,MAAM,EAAE,CAAC;IAE7B,SAAS,CAAC,OAAO,EAAG,OAAO,CAAC;IAC5B,SAAS,CAAC,aAAa,EAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC1C,SAAS,CAAC,eAAe,EAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAC9C,SAAS,CAAC,QAAQ,EAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAEnC,OAAO,CAAC,OAAO,CAAS;;IASxB;;;OAGG;IACH,SAAS,CAAC,aAAa,IAAI,IAAI;IAmC/B;;;OAGG;IACH,SAAS,CAAC,UAAU,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM;IAO3C;;;OAGG;IACH,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,GAAG,IAAI;IA0BvD,MAAM,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,YAAY,KAAK,IAAI;IA0C3F;;;OAGG;IACI,KAAK,IAAI,IAAI;CAGrB"}

package/lib/cjs/middleware.js

@@ -0,0 +1,210 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TelemetryMiddleware = exports.DURATION_BUCKETS_MS = exports.DEFAULT_PREFIX = void 0;
+const di_1 = require("@spinajs/di");
+const configuration_1 = require("@spinajs/configuration");
+const log_1 = require("@spinajs/log");
+const http_1 = require("@spinajs/http");
+const metrics_js_1 = require("./metrics.js");
+const store_js_1 = require("./store.js");
+/**
+ * Default metric-name prefix for the HTTP telemetry metrics.
+ */
+exports.DEFAULT_PREFIX = 'http';
+/**
+ * Histogram bucket boundaries ( ms ) for request duration.
+ */
+exports.DURATION_BUCKETS_MS = [5, 10, 25, 50, 100, 250, 500, 1000, 2500, 5000, 10000];
+/**
+ * Storage key under `req.storage` holding the per-request start time.
+ */
+const START_KEY = '__telemetryStart';
+/**
+ * HTTP request-timing / metrics middleware.
+ *
+ * Times every request and records:
+ *  - `${prefix}_requests_total{method,route,status}` — a Counter,
+ *  - `${prefix}_request_duration_ms{method,route,status}` — a Histogram,
+ *  - `${prefix}_requests_in_flight` — a Gauge,
+ * against the DI-resolved {@link Metrics} registry, and feeds the shared
+ * {@link TelemetryStore} that backs the JSON stats endpoints.
+ *
+ * All of the end-of-request work runs from a `res.on( 'finish' )` handler
+ * registered in `before()` — `ServerMiddleware.after()` is never reached for a
+ * normal matched route, the same reason http's own `AccessLog` / `PerfRollup`
+ * middlewares work this way. A `res.on( 'close' )` handler balances the in-flight
+ * gauge — and only the gauge — for requests the client aborted, where `'finish'`
+ * never fires. Every bit of it is guarded so telemetry can never break a request.
+ */
+let TelemetryMiddleware = class TelemetryMiddleware extends http_1.ServerMiddleware {
+    constructor() {
+        super();
+        /**
+         * Metric-name prefix. Set it with the `telemetry.prefix` configuration key —
+         * that is the supported way to re-prefix, and it needs no subclass.
+         *
+         * The precedence implemented in {@link ensureMetrics} is: a value assigned to
+         * this field that differs from {@link DEFAULT_PREFIX} wins, otherwise
+         * `telemetry.prefix` is used, otherwise {@link DEFAULT_PREFIX}. That override
+         * exists for subclasses that are replacing the middleware wholesale — see the
+         * README's "Replacing the middleware" section, which also covers the
+         * double-registration hazard of subclassing. Do NOT subclass merely to change
+         * the prefix.
+         */
+        this.Prefix = exports.DEFAULT_PREFIX;
+        this.defined = false;
+        // Needs req.storage ( ReqStorage = -2 ) and sits alongside RequestId /
+        // AccessLog ( Order 2 ).
+        this.Order = 2;
+    }
+    /**
+     * Lazily resolve {@link Metrics} and define the metric set on first use.
+     * Idempotent — {@link Metrics.defineMetrics} removes+recreates duplicates.
+     */
+    ensureMetrics() {
+        if (this.defined)
+            return;
+        this.metrics = di_1.DI.get(metrics_js_1.Metrics) ?? di_1.DI.resolve(metrics_js_1.Metrics);
+        // A subclass that overrode Prefix keeps it; otherwise configuration wins.
+        const prefix = this.Prefix !== exports.DEFAULT_PREFIX ? this.Prefix : this.ConfiguredPrefix ?? exports.DEFAULT_PREFIX;
+        const map = this.metrics.defineMetrics(prefix, [
+            {
+                name: 'requests_total',
+                help: 'Total number of HTTP requests',
+                type: 'counter',
+                labelNames: ['method', 'route', 'status'],
+            },
+            {
+                name: 'request_duration_ms',
+                help: 'HTTP request duration in milliseconds',
+                type: 'histogram',
+                labelNames: ['method', 'route', 'status'],
+                buckets: this.Buckets ?? exports.DURATION_BUCKETS_MS,
+            },
+            {
+                name: 'requests_in_flight',
+                help: 'Number of HTTP requests currently in flight',
+                type: 'gauge',
+            },
+        ]);
+        this.requestsTotal = map['requests_total'];
+        this.requestDuration = map['request_duration_ms'];
+        this.inFlight = map['requests_in_flight'];
+        this.defined = true;
+    }
+    /**
+     * Derive a stable, low-cardinality route label. Prefers the matched route
+     * path ( `req.route.path` or `req.storage.route` ) over the raw request path.
+     */
+    routeLabel(req) {
+        const anyReq = req;
+        const matched = anyReq.route?.path ?? req.storage?.route;
+        if (typeof matched === 'string' && matched.length > 0)
+            return matched;
+        return req.path ?? anyReq.originalUrl ?? 'unknown';
+    }
+    /**
+     * Do the end-of-request accounting. Called from the response `finish` event,
+     * never from `after()`.
+     */
+    onFinish(req, res) {
+        try {
+            const start = req.storage?.[START_KEY];
+            const durationMs = start !== undefined ? Number(process.hrtime.bigint() - start) / 1e6 : 0;
+            const method = req.method ?? 'GET';
+            // Read the route label HERE, not in before(): `req.route` is only
+            // populated once the router has matched.
+            const route = this.routeLabel(req);
+            const status = res.statusCode;
+            const labels = { method, route, status: String(status) };
+            // Balance before()'s inc() FIRST: a throw from anything below would
+            // otherwise strand the gauge one higher for the rest of the process.
+            this.inFlight.dec();
+            this.requestDuration.observe(labels, durationMs);
+            this.requestsTotal.inc(labels);
+            this.Store.record(method, route, status, durationMs);
+        }
+        catch (err) {
+            this.Log?.warn(err, 'telemetry finish handler failed');
+        }
+    }
+    before() {
+        return (req, res, next) => {
+            try {
+                this.ensureMetrics();
+                req.storage[START_KEY] = process.hrtime.bigint();
+                this.inFlight.inc();
+                // The inc() above must be balanced exactly once, whichever event wins.
+                // 'finish' does NOT fire when the client disconnects mid-response, only
+                // 'close' does — without the 'close' arm the gauge drifts monotonically
+                // upward for the life of the process behind a load balancer with client
+                // timeouts. On a normal request both fire, 'finish' first, so the flag
+                // is what keeps the gauge from being decremented twice.
+                let settled = false;
+                res.on('finish', () => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    this.onFinish(req, res);
+                });
+                res.on('close', () => {
+                    if (settled)
+                        return;
+                    settled = true;
+                    // Aborted request: balance the gauge and NOTHING else. `res.statusCode`
+                    // is still the un-sent default here, so recording it would pollute the
+                    // status-class counters and the route stats with a response that was
+                    // never sent.
+                    try {
+                        this.inFlight.dec();
+                    }
+                    catch (err) {
+                        this.Log?.warn(err, 'telemetry close handler failed');
+                    }
+                });
+            }
+            catch (err) {
+                this.Log?.warn(err, 'telemetry before() failed');
+            }
+            next();
+        };
+    }
+    /**
+     * Nothing to do after the controllers — express does not run this for a
+     * matched route. See {@link onFinish}.
+     */
+    after() {
+        return null;
+    }
+};
+exports.TelemetryMiddleware = TelemetryMiddleware;
+__decorate([
+    (0, log_1.Logger)('telemetry'),
+    __metadata("design:type", log_1.Log)
+], TelemetryMiddleware.prototype, "Log", void 0);
+__decorate([
+    (0, di_1.Autoinject)(store_js_1.TelemetryStore),
+    __metadata("design:type", store_js_1.TelemetryStore)
+], TelemetryMiddleware.prototype, "Store", void 0);
+__decorate([
+    (0, configuration_1.Config)('telemetry.prefix', { defaultValue: exports.DEFAULT_PREFIX }),
+    __metadata("design:type", String)
+], TelemetryMiddleware.prototype, "ConfiguredPrefix", void 0);
+__decorate([
+    (0, configuration_1.Config)('telemetry.buckets', { defaultValue: exports.DURATION_BUCKETS_MS }),
+    __metadata("design:type", Array)
+], TelemetryMiddleware.prototype, "Buckets", void 0);
+exports.TelemetryMiddleware = TelemetryMiddleware = __decorate([
+    (0, di_1.Injectable)(http_1.ServerMiddleware),
+    __metadata("design:paramtypes", [])
+], TelemetryMiddleware);
+//# sourceMappingURL=middleware.js.map

package/lib/cjs/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../src/middleware.ts"],"names":[],"mappings":";;;;;;;;;;;;AACA,oCAAyD;AACzD,0DAAgD;AAChD,sCAA2C;AAC3C,wCAAsE;AAGtE,6CAAkD;AAClD,yCAA4C;AAE5C;;GAEG;AACU,QAAA,cAAc,GAAG,MAAM,CAAC;AAErC;;GAEG;AACU,QAAA,mBAAmB,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AAE3F;;GAEG;AACH,MAAM,SAAS,GAAG,kBAAkB,CAAC;AAErC;;;;;;;;;;;;;;;;GAgBG;AAEI,IAAM,mBAAmB,GAAzB,MAAM,mBAAoB,SAAQ,uBAAgB;IAqCvD;QACE,KAAK,EAAE,CAAC;QA5BV;;;;;;;;;;;WAWG;QACO,WAAM,GAAG,sBAAc,CAAC;QAa1B,YAAO,GAAG,KAAK,CAAC;QAItB,uEAAuE;QACvE,yBAAyB;QACzB,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;IACjB,CAAC;IAED;;;OAGG;IACO,aAAa;QACrB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QAEzB,IAAI,CAAC,OAAO,GAAG,OAAE,CAAC,GAAG,CAAC,oBAAO,CAAC,IAAI,OAAE,CAAC,OAAO,CAAC,oBAAO,CAAC,CAAC;QAEtD,0EAA0E;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,sBAAc,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,gBAAgB,IAAI,sBAAc,CAAC;QAEtG,MAAM,GAAG,GAAc,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,EAAE;YACxD;gBACE,IAAI,EAAE,gBAAgB;gBACtB,IAAI,EAAE,+BAA+B;gBACrC,IAAI,EAAE,SAAS;gBACf,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;aAC1C;YACD;gBACE,IAAI,EAAE,qBAAqB;gBAC3B,IAAI,EAAE,uCAAuC;gBAC7C,IAAI,EAAE,WAAW;gBACjB,UAAU,EAAE,CAAC,QAAQ,EAAE,OAAO,EAAE,QAAQ,CAAC;gBACzC,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,2BAAmB;aAC7C;YACD;gBACE,IAAI,EAAE,oBAAoB;gBAC1B,IAAI,EAAE,6CAA6C;gBACnD,IAAI,EAAE,OAAO;aACd;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC,gBAAgB,CAAoB,CAAC;QAC9D,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC,qBAAqB,CAAsB,CAAC;QACvE,IAAI,CAAC,QAAQ,GAAG,GAAG,CAAC,oBAAoB,CAAkB,CAAC;QAC3D,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;IACtB,CAAC;IAED;;;OAGG;IACO,UAAU,CAAC,GAAa;QAChC,MAAM,MAAM,GAAG,GAAU,CAAC;QAC1B,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,IAAK,GAAG,CAAC,OAAe,EAAE,KAAK,CAAC;QAClE,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,OAAO,CAAC;QACtE,OAAO,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,WAAW,IAAI,SAAS,CAAC;IACrD,CAAC;IAED;;;OAGG;IACO,QAAQ,CAAC,GAAa,EAAE,GAAqB;QACrD,IAAI,CAAC;YACH,MAAM,KAAK,GAAI,GAAG,CAAC,OAAe,EAAE,CAAC,SAAS,CAAuB,CAAC;YACtE,MAAM,UAAU,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;YAE3F,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,CAAC;YAEnC,kEAAkE;YAClE,yCAAyC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC;YAC9B,MAAM,MAAM,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAEzD,oEAAoE;YACpE,qEAAqE;YACrE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;YAEpB,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACjD,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YAE/B,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAY,EAAE,iCAAiC,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IAEM,MAAM;QACX,OAAO,CAAC,GAAa,EAAE,GAAqB,EAAE,IAA0B,EAAE,EAAE;YAC1E,IAAI,CAAC;gBACH,IAAI,CAAC,aAAa,EAAE,CAAC;gBACpB,GAAG,CAAC,OAAe,CAAC,SAAS,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBAC1D,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;gBAEpB,uEAAuE;gBACvE,wEAAwE;gBACxE,wEAAwE;gBACxE,wEAAwE;gBACxE,uEAAuE;gBACvE,wDAAwD;gBACxD,IAAI,OAAO,GAAG,KAAK,CAAC;gBAEpB,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;oBACpB,IAAI,OAAO;wBAAE,OAAO;oBACpB,OAAO,GAAG,IAAI,CAAC;oBACf,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC1B,CAAC,CAAC,CAAC;gBAEH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;oBACnB,IAAI,OAAO;wBAAE,OAAO;oBACpB,OAAO,GAAG,IAAI,CAAC;oBAEf,wEAAwE;oBACxE,uEAAuE;oBACvE,qEAAqE;oBACrE,cAAc;oBACd,IAAI,CAAC;wBACH,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;oBACtB,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAY,EAAE,gCAAgC,CAAC,CAAC;oBACjE,CAAC;gBACH,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,GAAY,EAAE,2BAA2B,CAAC,CAAC;YAC5D,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACI,KAAK;QACV,OAAO,IAAI,CAAC;IACd,CAAC;CACF,CAAA;AA7KY,kDAAmB;AAEpB;IADT,IAAA,YAAM,EAAC,WAAW,CAAC;8BACJ,SAAG;gDAAC;AAMV;IADT,IAAA,eAAU,EAAC,yBAAc,CAAC;8BACT,yBAAc;kDAAC;AAiBvB;IADT,IAAA,sBAAM,EAAC,kBAAkB,EAAE,EAAE,YAAY,EAAE,sBAAc,EAAE,CAAC;;6DACzB;AAG1B;IADT,IAAA,sBAAM,EAAC,mBAAmB,EAAE,EAAE,YAAY,EAAE,2BAAmB,EAAE,CAAC;;oDACtC;8BA5BlB,mBAAmB;IAD/B,IAAA,eAAU,EAAC,uBAAgB,CAAC;;GAChB,mBAAmB,CA6K/B"}

package/lib/cjs/package.json

@@ -0,0 +1 @@
+{"type":"commonjs"}

package/lib/cjs/policies/PublicPolicy.d.ts

@@ -0,0 +1,16 @@
+import { BasePolicy, IController, IRoute, Request } from '@spinajs/http';
+/**
+ * A policy that permits everything. Used as the explicit default for the
+ * liveness / readiness endpoints, which must be reachable by kubelet probes and
+ * load balancers that cannot carry a token.
+ *
+ * This exists so the config can name a real class. Leaving the policy config
+ * key empty would work, but the http layer logs `No policy named ... is
+ * registered` on every boot for an unresolvable value, which reads like a
+ * misconfiguration.
+ */
+export declare class PublicPolicy extends BasePolicy {
+    isEnabled(_action: IRoute, _instance: IController): boolean;
+    execute(_req: Request): Promise<void>;
+}
+//# sourceMappingURL=PublicPolicy.d.ts.map

package/lib/cjs/policies/PublicPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"PublicPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/PublicPolicy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAEzE;;;;;;;;;GASG;AACH,qBACa,YAAa,SAAQ,UAAU;IACnC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO;IAI3D,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAG7C"}

package/lib/cjs/policies/PublicPolicy.js

@@ -0,0 +1,34 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PublicPolicy = void 0;
+const di_1 = require("@spinajs/di");
+const http_1 = require("@spinajs/http");
+/**
+ * A policy that permits everything. Used as the explicit default for the
+ * liveness / readiness endpoints, which must be reachable by kubelet probes and
+ * load balancers that cannot carry a token.
+ *
+ * This exists so the config can name a real class. Leaving the policy config
+ * key empty would work, but the http layer logs `No policy named ... is
+ * registered` on every boot for an unresolvable value, which reads like a
+ * misconfiguration.
+ */
+let PublicPolicy = class PublicPolicy extends http_1.BasePolicy {
+    isEnabled(_action, _instance) {
+        return true;
+    }
+    execute(_req) {
+        return Promise.resolve();
+    }
+};
+exports.PublicPolicy = PublicPolicy;
+exports.PublicPolicy = PublicPolicy = __decorate([
+    (0, di_1.Injectable)(http_1.BasePolicy)
+], PublicPolicy);
+//# sourceMappingURL=PublicPolicy.js.map

package/lib/cjs/policies/PublicPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"PublicPolicy.js","sourceRoot":"","sources":["../../../src/policies/PublicPolicy.ts"],"names":[],"mappings":";;;;;;;;;AAAA,oCAAyC;AACzC,wCAAyE;AAEzE;;;;;;;;;GASG;AAEI,IAAM,YAAY,GAAlB,MAAM,YAAa,SAAQ,iBAAU;IACnC,SAAS,CAAC,OAAe,EAAE,SAAsB;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,OAAO,CAAC,IAAa;QAC1B,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;IAC3B,CAAC;CACF,CAAA;AARY,oCAAY;uBAAZ,YAAY;IADxB,IAAA,eAAU,EAAC,iBAAU,CAAC;GACV,YAAY,CAQxB"}

package/lib/cjs/policies/TelemetryTokenPolicy.d.ts

@@ -0,0 +1,19 @@
+import { BasePolicy, IController, IRoute, Request } from '@spinajs/http';
+import { Log } from '@spinajs/log';
+/**
+ * Shared-token guard for the telemetry endpoints. Reads the expected token from
+ * `telemetry.auth.token` and compares it against the `x-metrics-token` header.
+ * The header name is deliberately unchanged from the retired
+ * `@spinajs/metrics` package so existing scrape configs keep working.
+ *
+ * Bypassed entirely in development.
+ */
+export declare class TelemetryTokenPolicy extends BasePolicy {
+    protected Log: Log;
+    protected Token: string;
+    protected isDev: boolean;
+    protected HEADER_TOKEN_FIELD: string;
+    isEnabled(_action: IRoute, _instance: IController): boolean;
+    execute(req: Request): Promise<void>;
+}
+//# sourceMappingURL=TelemetryTokenPolicy.d.ts.map

package/lib/cjs/policies/TelemetryTokenPolicy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TelemetryTokenPolicy.d.ts","sourceRoot":"","sources":["../../../src/policies/TelemetryTokenPolicy.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAEzE,OAAO,EAAE,GAAG,EAAU,MAAM,cAAc,CAAC;AAG3C;;;;;;;GAOG;AACH,qBACa,oBAAqB,SAAQ,UAAU;IAElD,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;IAGnB,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC;IAGxB,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC;IAEzB,SAAS,CAAC,kBAAkB,SAAqB;IAE1C,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,WAAW,GAAG,OAAO;IAIrD,OAAO,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC;CAgBlD"}

package/lib/cjs/policies/TelemetryTokenPolicy.js

@@ -0,0 +1,65 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TelemetryTokenPolicy = void 0;
+const configuration_1 = require("@spinajs/configuration");
+const http_1 = require("@spinajs/http");
+const exceptions_1 = require("@spinajs/exceptions");
+const log_1 = require("@spinajs/log");
+const di_1 = require("@spinajs/di");
+/**
+ * Shared-token guard for the telemetry endpoints. Reads the expected token from
+ * `telemetry.auth.token` and compares it against the `x-metrics-token` header.
+ * The header name is deliberately unchanged from the retired
+ * `@spinajs/metrics` package so existing scrape configs keep working.
+ *
+ * Bypassed entirely in development.
+ */
+let TelemetryTokenPolicy = class TelemetryTokenPolicy extends http_1.BasePolicy {
+    constructor() {
+        super(...arguments);
+        this.HEADER_TOKEN_FIELD = 'x-metrics-token';
+    }
+    isEnabled(_action, _instance) {
+        return true;
+    }
+    async execute(req) {
+        if (this.isDev) {
+            return;
+        }
+        const token = req.headers[this.HEADER_TOKEN_FIELD];
+        if (!token) {
+            this.Log.warn(`No token is set for restricted area, header field: ${this.HEADER_TOKEN_FIELD}, policy: TelemetryTokenPolicy, ip: ${req.storage.realIp}`);
+            throw new exceptions_1.Forbidden('access token is not set');
+        }
+        if (token !== this.Token) {
+            this.Log.warn(`Invalid access token received, header field: ${this.HEADER_TOKEN_FIELD}, policy: TelemetryTokenPolicy, ip: ${req.storage.realIp}`);
+            throw new exceptions_1.Forbidden('invalid access token');
+        }
+    }
+};
+exports.TelemetryTokenPolicy = TelemetryTokenPolicy;
+__decorate([
+    (0, log_1.Logger)('Security'),
+    __metadata("design:type", log_1.Log)
+], TelemetryTokenPolicy.prototype, "Log", void 0);
+__decorate([
+    (0, configuration_1.Config)('telemetry.auth.token'),
+    __metadata("design:type", String)
+], TelemetryTokenPolicy.prototype, "Token", void 0);
+__decorate([
+    (0, configuration_1.Config)('configuration.isDevelopment'),
+    __metadata("design:type", Boolean)
+], TelemetryTokenPolicy.prototype, "isDev", void 0);
+exports.TelemetryTokenPolicy = TelemetryTokenPolicy = __decorate([
+    (0, di_1.Injectable)(http_1.BasePolicy)
+], TelemetryTokenPolicy);
+//# sourceMappingURL=TelemetryTokenPolicy.js.map

package/lib/cjs/policies/TelemetryTokenPolicy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TelemetryTokenPolicy.js","sourceRoot":"","sources":["../../../src/policies/TelemetryTokenPolicy.ts"],"names":[],"mappings":";;;;;;;;;;;;AAAA,0DAAgD;AAChD,wCAAyE;AACzE,oDAAgD;AAChD,sCAA2C;AAC3C,oCAAyC;AAEzC;;;;;;;GAOG;AAEI,IAAM,oBAAoB,GAA1B,MAAM,oBAAqB,SAAQ,iBAAU;IAA7C;;QAUK,uBAAkB,GAAG,iBAAiB,CAAC;IAsBnD,CAAC;IApBQ,SAAS,CAAC,OAAe,EAAE,SAAsB;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAEM,KAAK,CAAC,OAAO,CAAC,GAAY;QAC/B,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO;QACT,CAAC;QAED,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QACnD,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,sDAAsD,IAAI,CAAC,kBAAkB,uCAAuC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YACxJ,MAAM,IAAI,sBAAS,CAAC,yBAAyB,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,KAAK,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gDAAgD,IAAI,CAAC,kBAAkB,uCAAuC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;YAClJ,MAAM,IAAI,sBAAS,CAAC,sBAAsB,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;CACF,CAAA;AAhCY,oDAAoB;AAErB;IADT,IAAA,YAAM,EAAC,UAAU,CAAC;8BACJ,SAAG;iDAAC;AAGT;IADT,IAAA,sBAAM,EAAC,sBAAsB,CAAC;;mDACP;AAGd;IADT,IAAA,sBAAM,EAAC,6BAA6B,CAAC;;mDACb;+BARd,oBAAoB;IADhC,IAAA,eAAU,EAAC,iBAAU,CAAC;GACV,oBAAoB,CAgChC"}

package/lib/cjs/requestStats.d.ts

@@ -0,0 +1,81 @@
+/**
+ * Serializable snapshot of {@link RequestStats}.
+ */
+export interface IRequestStatsSnapshot {
+    requests: number;
+    responses: number;
+    errors: number;
+    info: number;
+    success: number;
+    redirect: number;
+    client_error: number;
+    server_error: number;
+    total_time: number;
+    max_time: number;
+    min_time: number;
+    avg_time: number;
+    apdex_satisfied: number;
+    apdex_tolerated: number;
+    apdex_score: number;
+    req_rate: number;
+    err_rate: number;
+}
+/**
+ * Port of swagger-stats' `swsReqResStats` — accumulates request/response
+ * counters, response-time aggregates ( total / max / min / avg ), an Apdex
+ * score, and request/error rates over its lifetime.
+ *
+ * Pure and dependency-free; time is always passed in so it is deterministic.
+ */
+export declare class RequestStats {
+    /**
+     * Apdex satisfied-response threshold, in milliseconds. Responses up to
+     * `4 * threshold` are "tolerated".
+     */
+    readonly apdexThreshold: number;
+    requests: number;
+    responses: number;
+    errors: number;
+    info: number;
+    success: number;
+    redirect: number;
+    client_error: number;
+    server_error: number;
+    totalTime: number;
+    maxTime: number;
+    minTime: number;
+    avgTime: number;
+    apdexSatisfied: number;
+    apdexTolerated: number;
+    reqRate: number;
+    errRate: number;
+    constructor(apdexThreshold?: number);
+    /**
+     * Count an inbound request ( before the response is known ).
+     */
+    countRequest(): void;
+    /**
+     * Count a completed response, updating status-class counters, response-time
+     * aggregates and Apdex.
+     *
+     * @param statusCode - the HTTP status code of the response
+     * @param durationMs - the request duration in milliseconds
+     */
+    countResponse(statusCode: number, durationMs: number): void;
+    /**
+     * The current Apdex score: `(satisfied + tolerated/2) / responses`.
+     * Returns 0 when there are no responses yet.
+     */
+    apdex(): number;
+    /**
+     * Recompute request/error rates ( per second ) over an elapsed window.
+     *
+     * @param elapsedMs - the width of the window in milliseconds
+     */
+    updateRates(elapsedMs: number): void;
+    /**
+     * A plain-object snapshot of the current stats.
+     */
+    toJSON(): IRequestStatsSnapshot;
+}
+//# sourceMappingURL=requestStats.d.ts.map

package/lib/cjs/requestStats.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requestStats.d.ts","sourceRoot":"","sources":["../../src/requestStats.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IAEf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IAErB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IAEjB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IAEpB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAID;;;;;;GAMG;AACH,qBAAa,YAAY;IACvB;;;OAGG;IACH,SAAgB,cAAc,EAAE,MAAM,CAAC;IAGhC,QAAQ,SAAK;IACb,SAAS,SAAK;IACd,MAAM,SAAK;IAGX,IAAI,SAAK;IACT,OAAO,SAAK;IACZ,QAAQ,SAAK;IACb,YAAY,SAAK;IACjB,YAAY,SAAK;IAGjB,SAAS,SAAK;IACd,OAAO,SAAK;IACZ,OAAO,SAAK;IACZ,OAAO,SAAK;IAGZ,cAAc,SAAK;IACnB,cAAc,SAAK;IAGnB,OAAO,SAAK;IACZ,OAAO,SAAK;gBAEP,cAAc,GAAE,MAAmC;IAI/D;;OAEG;IACI,YAAY,IAAI,IAAI;IAI3B;;;;;;OAMG;IACI,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,IAAI;IA6BlE;;;OAGG;IACI,KAAK,IAAI,MAAM;IAKtB;;;;OAIG;IACI,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAW3C;;OAEG;IACI,MAAM,IAAI,qBAAqB;CAyBvC"}