@wtfalch/reporting 0.5.1 → 0.8.1

package/dist/housekeeping/index.d.ts

@@ -64,3 +64,5 @@ export interface Housekeeping {
 export declare function createHousekeeping(options: HousekeepingOptions): Housekeeping;
 export { pruneEvents, retentionLag } from './tasks.js';
 export { pruneAnalytics, rollupAnalytics, rollupAnalyticsWeekly } from '../analytics/tasks.js';
+export { pruneOpenErrors } from '../errors/tasks.js';
+export { pruneErrors } from '../errors/tasks.js';

package/dist/housekeeping/index.js

@@ -209,3 +209,5 @@ export function createHousekeeping(options) {
 }
 export { pruneEvents, retentionLag } from './tasks.js';
 export { pruneAnalytics, rollupAnalytics, rollupAnalyticsWeekly } from '../analytics/tasks.js';
+export { pruneOpenErrors } from '../errors/tasks.js';
+export { pruneErrors } from '../errors/tasks.js';

package/dist/index.js

@@ -4,6 +4,7 @@ import { ANALYTICS_NAME_PATTERN, normalisePath, propsSchema } from './analytics/
 import { insertAnalytics } from './analytics/write.js';
 import { createCapture } from './errors/capture.js';
 import { eventsPage } from './reader.js';
+import { RequestCounter } from './requests.js';
 import { environmentSchema, siteSchema } from './schema.js';
 import { getSettings, getTenantRetention, setSettings, setTenantRetention } from './settings.js';
 import { tables } from './tables.js';
@@ -54,6 +55,13 @@ export function createReporting(options) {
         batchSize: options.batchSize ?? 500,
         flushEveryMs: options.flushEveryMs ?? 1000,
     });
+    const requests = new RequestCounter({
+        db: options.db,
+        log: options.log,
+        site,
+        now,
+        flushEveryMs: options.requestFlushEveryMs ?? 10_000,
+    });
     // One alerting path, shared by `reporting.alert()` and a new-or-reopened
     // capture (errors/capture.ts's `alert` option): an `alert.<check>` row,
     // already indexed and pruned the same as everything else on the
@@ -91,7 +99,11 @@ export function createReporting(options) {
         event: (input) => writer.event(input),
         captureError: (error, context) => capture(error, context),
         alert: fireAlert,
-        flush: (opts) => writer.flush(opts),
+        flush: async (opts) => {
+            await writer.flush(opts);
+            await requests.flush();
+        },
+        requests: { record: (status) => requests.record(status) },
         events: { page: (opts) => eventsPage(options.db, opts) },
         settings: {
             get: () => getSettings(options.db),

package/dist/migrations/0001_reporting.sql

@@ -5,10 +5,9 @@
 -- after the host copies this file into its drizzle/ directory as the next
 -- number (reporting-migrations); never edited there.
 --
--- Estate-shaped: the DO block at the end assumes the runtime-role convention
--- (a role named <database>_rt that owns nothing and serves the app). A host
--- without that role gets the tables and the function and no revokes take
--- effect, which the package README says plainly.
+-- The SQL names no role and no schema. The host applies it into its own
+-- schema and makes the runtime role itself; the package README lists the
+-- privileges to pass to ensureRuntimeRole.
 
 create table if not exists reporting_events (
   id              bigint generated always as identity primary key,
@@ -114,7 +113,7 @@ create or replace function reporting_prune_events(retention interval, batch inte
 returns integer
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 declare
   w interval := greatest(interval '7 days', least(coalesce(retention, interval '30 days'), interval '400 days'));
@@ -136,18 +135,5 @@ revoke all on function reporting_prune_events(interval, integer) from public;
 
 -- The runtime role keeps SELECT and INSERT on all three tables, UPDATE on
 -- tasks and settings because the claim protocol and the settings page write
--- them, and nothing that deletes. The host's default privileges granted the
--- rest at create time; the revokes here win because they run later in the
--- same file.
-do $$
-declare
-  rt text := current_database() || '_rt';
-begin
-  if exists (select 1 from pg_roles where rolname = rt) then
-    execute format('revoke update, delete, truncate on reporting_events from %I', rt);
-    execute format('revoke delete, truncate on reporting_tasks from %I', rt);
-    execute format('revoke delete, truncate on reporting_settings from %I', rt);
-    execute format('grant execute on function reporting_prune_events(interval, integer) to %I', rt);
-  end if;
-end
-$$;
+-- them, and nothing that deletes. The host's ensureRuntimeRole call sets
+-- that; see the README.

package/dist/migrations/0002_analytics.sql

@@ -135,7 +135,7 @@ create or replace function reporting_rollup_day(d date)
 returns integer
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 declare
   n integer;
@@ -231,7 +231,7 @@ create or replace function reporting_rollup_week(w date)
 returns integer
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 declare
   n integer;
@@ -282,7 +282,7 @@ create or replace function reporting_prune_analytics(retention interval, batch i
 returns integer
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 declare
   w interval := greatest(interval '7 days', least(coalesce(retention, interval '90 days'), interval '400 days'));
@@ -316,7 +316,7 @@ create or replace function reporting_erase_person(subject text)
 returns integer
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 declare
   n integer;
@@ -332,19 +332,5 @@ $$;
 revoke all on function reporting_erase_person(text) from public;
 
 -- The runtime role inserts and reads raw rows, reads the rollups, and
--- changes either only through the functions above.
-do $$
-declare
-  rt text := current_database() || '_rt';
-begin
-  if exists (select 1 from pg_roles where rolname = rt) then
-    execute format('revoke update, delete, truncate on reporting_analytics from %I', rt);
-    execute format('revoke insert, update, delete, truncate on reporting_analytics_daily from %I', rt);
-    execute format('revoke insert, update, delete, truncate on reporting_analytics_weekly from %I', rt);
-    execute format('grant execute on function reporting_rollup_day(date) to %I', rt);
-    execute format('grant execute on function reporting_rollup_week(date) to %I', rt);
-    execute format('grant execute on function reporting_prune_analytics(interval, integer, date) to %I', rt);
-    execute format('grant execute on function reporting_erase_person(text) to %I', rt);
-  end if;
-end
-$$;
+-- changes either only through the functions above (the host's
+-- ensureRuntimeRole call; see the README).

package/dist/migrations/0003_errors.sql

@@ -7,10 +7,8 @@
 -- copies this file into its drizzle/ directory as the next number
 -- (reporting-migrations); never edited there.
 --
--- Estate-shaped: the DO block at the end assumes the runtime-role convention
--- (a role named <database>_rt that owns nothing and serves the app). A host
--- without that role gets the table and no revokes take effect, which the
--- package README says plainly.
+-- The SQL names no role and no schema; the host's ensureRuntimeRole call
+-- sets the runtime role's privileges (see the README).
 
 create table if not exists reporting_errors (
   fingerprint     text primary key,
@@ -77,7 +75,7 @@ create or replace function reporting_prune_errors(retention interval, batch inte
 returns integer
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 declare
   w interval := greatest(interval '7 days', least(coalesce(retention, interval '30 days'), interval '400 days'));
@@ -105,14 +103,4 @@ comment on function reporting_prune_errors(interval, integer) is
 -- on repeat occurrences and an operator moves state through this table.
 -- Nothing that deletes, the same as reporting_tasks and reporting_settings;
 -- reporting_prune_errors runs as the function owner, not the runtime role,
--- so the grant below is execute only, same shape as reporting_prune_events.
-do $$
-declare
-  rt text := current_database() || '_rt';
-begin
-  if exists (select 1 from pg_roles where rolname = rt) then
-    execute format('revoke delete, truncate on reporting_errors from %I', rt);
-    execute format('grant execute on function reporting_prune_errors(interval, integer) to %I', rt);
-  end if;
-end
-$$;
+-- so the runtime role needs execute only, same shape as reporting_prune_events.

package/dist/migrations/0006_tenant_settings.sql

@@ -45,7 +45,7 @@ create or replace function reporting_prune_events(retention interval, batch inte
 returns integer
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 declare
   w interval := greatest(interval '7 days', least(coalesce(retention, interval '30 days'), interval '400 days'));
@@ -82,7 +82,7 @@ create or replace function reporting_prune_analytics(retention interval, batch i
 returns integer
 language plpgsql
 security definer
-set search_path = pg_catalog, public
+set search_path from current
 as $$
 declare
   w interval := greatest(interval '7 days', least(coalesce(retention, interval '90 days'), interval '400 days'));
@@ -121,22 +121,4 @@ revoke all on function reporting_prune_analytics(interval, integer, date) from p
 -- The runtime role reads and edits overrides (an operator's settings page),
 -- same shape as reporting_settings: select, insert, update, nothing that
 -- deletes -- clearing an override is a value update, not a row removal.
---
--- CREATE OR REPLACE FUNCTION keeps the two prune functions' existing grants
--- (their signatures are unchanged from 0001/0002); the two re-grants below
--- are a no-op on a host that already has them and a safety net on one
--- whose grants somehow drifted, cheap either way.
-do $$
-declare
-  rt text := current_database() || '_rt';
-begin
-  if exists (select 1 from pg_roles where rolname = rt) then
-    execute format('revoke delete, truncate on reporting_tenant_settings from %I', rt);
-    execute format('grant execute on function reporting_prune_events(interval, integer) to %I', rt);
-    execute format(
-      'grant execute on function reporting_prune_analytics(interval, integer, date) to %I',
-      rt
-    );
-  end if;
-end
-$$;
+-- The host's ensureRuntimeRole call sets that; see the README.

package/dist/migrations/0007_errors_open_cap.sql

@@ -0,0 +1,42 @@
+-- @wtfalch/reporting 0.6.0: a ceiling on open error groups per site.
+--
+-- reporting_prune_errors (0003) never deletes an 'open' row, on purpose. But
+-- the public ingest route lets an unauthenticated caller create a new group
+-- per distinct message, so "never" also means "without bound". This function
+-- is the bound: when a site holds more than `cap` open groups, the ones seen
+-- least recently leave first. An incident that is still firing keeps its
+-- group, because every occurrence moves last_seen_at forward; a flood of
+-- one-off messages pushes out only other one-off messages. Idempotent.
+--
+-- `cap` is clamped to at least 100 so a bad argument cannot empty the table;
+-- `batch` to between 1 and 5,000, same as reporting_prune_errors.
+create or replace function reporting_prune_open_errors(cap integer, batch integer)
+returns integer
+language plpgsql
+security definer
+set search_path from current
+as $$
+declare
+  c integer := greatest(100, coalesce(cap, 5000));
+  b integer := greatest(1, least(coalesce(batch, 5000), 5000));
+  n integer;
+begin
+  with ranked as (
+    select fingerprint,
+           row_number() over (partition by site order by last_seen_at desc, fingerprint) as rn
+      from reporting_errors
+     where state = 'open'
+  ),
+  victims as (
+    select fingerprint from ranked where rn > c order by rn desc limit b
+  )
+  delete from reporting_errors e using victims v where e.fingerprint = v.fingerprint;
+  get diagnostics n = row_count;
+  return n;
+end
+$$;
+revoke all on function reporting_prune_open_errors(integer, integer) from public;
+
+comment on function reporting_prune_open_errors(integer, integer) is
+  'Deletes the least recently seen open groups beyond `cap` per site. The only way an open row leaves on a timer: a bound on unauthenticated ingest, not an age limit.';
+

package/dist/migrations/0008_error_tenants.sql

@@ -0,0 +1,35 @@
+-- @wtfalch/reporting 0.6.0: per-tenant occurrence tracking for error groups.
+-- Mirrors src/tables.ts.
+--
+-- reporting_errors keeps one row per fingerprint, so two tenants that hit the
+-- same bug share a row whose tenant_id is whichever occurrence came last.
+-- That silently moves the group between tenants and gives a tenant-scoped
+-- reader nothing to filter on. This table records, per fingerprint and
+-- tenant, that the tenant saw the error, how often and when. Readers filter
+-- and count from here when given a tenantId; the shared row is unchanged.
+--
+-- The foreign key cascades, so a pruned group takes its tenant rows with it
+-- (the prune functions run as the table owner; the runtime role never
+-- deletes). Every statement is idempotent.
+
+create table if not exists reporting_error_tenants (
+  fingerprint     text not null references reporting_errors (fingerprint) on delete cascade,
+  tenant_id       uuid not null,
+  occurrences     bigint not null default 1,
+  first_seen_at   timestamptz not null,
+  last_seen_at    timestamptz not null,
+  constraint reporting_error_tenants_pkey primary key (fingerprint, tenant_id),
+  constraint reporting_error_tenants_fingerprint_check check (fingerprint ~ '^[0-9a-f]{32}$'),
+  constraint reporting_error_tenants_occurrences_check check (occurrences > 0),
+  constraint reporting_error_tenants_seen_check check (last_seen_at >= first_seen_at)
+);
+
+create index if not exists reporting_error_tenants_tenant_idx
+  on reporting_error_tenants (tenant_id, last_seen_at desc);
+
+-- No backfill. reporting_errors holds only the latest tenant per group, so
+-- copying its occurrences to that tenant would credit it with every other
+-- tenant's history. Counts per tenant start at the deploy of 0.6.0.
+
+-- Select, insert and update for the runtime role; nothing that deletes (the
+-- host's ensureRuntimeRole call sets that; see the README).

package/dist/migrations/0009_release_color.sql

@@ -0,0 +1,33 @@
+-- @wtfalch/reporting 0.8.0: the release and color a row was written under.
+-- Mirrors src/tables.ts.
+--
+-- A blue/green deploy runs two copies of an app against one database. The
+-- host gets REPORTING_RELEASE (an image digest) and REPORTING_COLOR (blue or
+-- green) from its platform, and the package stamps both on every row it
+-- writes. Both are nullable: rows written before this file, and rows from an
+-- app with no color, carry null. reporting_errors already has `release`.
+--
+-- Same shape as 0004_environment.sql: `add column if not exists` takes only a
+-- catalog lock, and the CHECK goes in `not valid` then `validate constraint`
+-- so the scan of a large table does not hold ACCESS EXCLUSIVE. Every
+-- statement is idempotent; no backfill.
+
+alter table reporting_events add column if not exists release text;
+alter table reporting_events add column if not exists color text;
+alter table reporting_events drop constraint if exists reporting_events_color_check;
+alter table reporting_events add constraint reporting_events_color_check
+  check (color is null or color in ('blue', 'green')) not valid;
+alter table reporting_events validate constraint reporting_events_color_check;
+
+alter table reporting_analytics add column if not exists release text;
+alter table reporting_analytics add column if not exists color text;
+alter table reporting_analytics drop constraint if exists reporting_analytics_color_check;
+alter table reporting_analytics add constraint reporting_analytics_color_check
+  check (color is null or color in ('blue', 'green')) not valid;
+alter table reporting_analytics validate constraint reporting_analytics_color_check;
+
+alter table reporting_errors add column if not exists color text;
+alter table reporting_errors drop constraint if exists reporting_errors_color_check;
+alter table reporting_errors add constraint reporting_errors_color_check
+  check (color is null or color in ('blue', 'green')) not valid;
+alter table reporting_errors validate constraint reporting_errors_color_check;

package/dist/migrations/0010_requests.sql

@@ -0,0 +1,27 @@
+-- @wtfalch/reporting 0.8.0: a request counter, one row per minute.
+-- Mirrors src/tables.ts.
+--
+-- Blue/green judges a new color by its share of failed responses, which needs
+-- a count of all requests, not one event per request. The app counts in
+-- memory and writes one upsert per minute bucket, color and release.
+-- `errors` is responses with status >= 500. `color` and `release` are the
+-- empty string, not null, when the app has none, so they can sit in the
+-- primary key. Counts only; nothing here identifies a person or a request.
+-- Every statement is idempotent.
+--
+-- The table is new, so there are no live rows to scan and the CHECKs go in
+-- the plain way. Select, insert and update for the runtime role; nothing that
+-- deletes (the host's ensureRuntimeRole call sets that; see the README).
+
+create table if not exists reporting_requests (
+  bucket    timestamptz not null,
+  site      text not null,
+  color     text not null default '',
+  release   text not null default '',
+  requests  bigint not null default 0,
+  errors    bigint not null default 0,
+  constraint reporting_requests_pkey primary key (bucket, site, color, release),
+  constraint reporting_requests_site_check check (site ~ '^[a-z][a-z0-9-]{0,63}$'),
+  constraint reporting_requests_color_check check (color in ('', 'blue', 'green')),
+  constraint reporting_requests_counts_check check (requests >= 0 and errors between 0 and requests)
+);

package/dist/migrations-dir.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Absolute path of the directory holding this package's numbered `.sql`
+ * migrations. The host passes it to `runMigrationSources` as
+ * `{ name: 'reporting', dir: migrationsDir }`.
+ *
+ * Its own subpath (`@wtfalch/reporting/migrations-dir`) and no other
+ * imports: a migration image imports this without the Drizzle, React and
+ * Next the main entry pulls in, and a bundler never meets this file's
+ * `import.meta.url` through the main entry.
+ */
+export declare const migrationsDir: string;

package/dist/migrations-dir.js

@@ -0,0 +1,12 @@
+import { fileURLToPath } from 'node:url';
+/**
+ * Absolute path of the directory holding this package's numbered `.sql`
+ * migrations. The host passes it to `runMigrationSources` as
+ * `{ name: 'reporting', dir: migrationsDir }`.
+ *
+ * Its own subpath (`@wtfalch/reporting/migrations-dir`) and no other
+ * imports: a migration image imports this without the Drizzle, React and
+ * Next the main entry pulls in, and a bundler never meets this file's
+ * `import.meta.url` through the main entry.
+ */
+export const migrationsDir = fileURLToPath(new URL('./migrations/', import.meta.url));

package/dist/next/index.d.ts

@@ -3,6 +3,7 @@ import { deviceOf } from '../analytics/schema.js';
 import type { Reporting } from '../types.js';
 import { type ClientErrorCollectorOptions } from './client-errors.js';
 import { type EdgeErrorIngestOptions } from './edge-errors.js';
+export { releaseHealthHandler, withRequestCount, type ReleaseHealthOptions, } from './release-health.js';
 export { edgeErrorHandler, type EdgeCaptureOptions, type EdgeErrorReport } from './edge-errors.js';
 /**
  * The Next bindings: everything in the package that knows what a request is.

package/dist/next/index.js

@@ -6,6 +6,7 @@ import { createCollector } from '../analytics/collector.js';
 import { countryOf, deviceOf } from '../analytics/schema.js';
 import { createClientErrorCollector } from './client-errors.js';
 import { createEdgeErrorIngestCollector } from './edge-errors.js';
+export { releaseHealthHandler, withRequestCount, } from './release-health.js';
 export { edgeErrorHandler } from './edge-errors.js';
 /**
  * The Next bindings: everything in the package that knows what a request is.

package/dist/next/release-health.d.ts

@@ -0,0 +1,22 @@
+import type { Db, Reporting } from '../types.js';
+export interface ReleaseHealthOptions {
+    readonly db: Db;
+    readonly reporting: Pick<Reporting, 'site' | 'log'>;
+    /** Defaults to `process.env.REPORTING_HEALTH_TOKEN`, read on each request. */
+    readonly token?: () => string | undefined;
+}
+/**
+ * `GET /api/reporting/release-health?from=<ISO>&to=<ISO>`: the counts foundry
+ * judges a new color by. Request and 5xx totals per color over [from, to),
+ * and the per-day average of the seven days before `from`. Counts only; no
+ * event, error or request content is read. Bearer token from
+ * `REPORTING_HEALTH_TOKEN`: unset is 503, missing or wrong is 401.
+ */
+export declare function releaseHealthHandler(options: ReleaseHealthOptions): (request: Request) => Promise<Response>;
+/**
+ * Wraps a route handler so each response is counted. A handler that throws is
+ * counted as a 500 and the throw goes on. Next's own control-flow throws
+ * (`redirect()`, `notFound()` and the like) are counted as a request, not an
+ * error, so they cannot push a release toward rollback.
+ */
+export declare function withRequestCount<A extends unknown[]>(reporting: Pick<Reporting, 'requests'>, handler: (...args: A) => Promise<Response> | Response): (...args: A) => Promise<Response>;

package/dist/next/release-health.js

@@ -0,0 +1,122 @@
+import { timingSafeEqual } from 'node:crypto';
+import { and, gte, lt, sql } from 'drizzle-orm';
+import { unstable_rethrow } from 'next/navigation';
+import { connection } from 'next/server';
+import { z } from 'zod';
+import { reportingRequests } from '../tables.js';
+const DAY_MS = 86_400_000;
+const BASELINE_DAYS = 7;
+const MAX_RANGE_MS = 8 * DAY_MS;
+const iso = z.iso.datetime({ offset: true });
+function tokenMatches(provided, expected) {
+    const a = Buffer.from(provided);
+    const b = Buffer.from(expected);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+function json(body, status) {
+    return Response.json(body, { status, headers: { 'cache-control': 'no-store' } });
+}
+/**
+ * `GET /api/reporting/release-health?from=<ISO>&to=<ISO>`: the counts foundry
+ * judges a new color by. Request and 5xx totals per color over [from, to),
+ * and the per-day average of the seven days before `from`. Counts only; no
+ * event, error or request content is read. Bearer token from
+ * `REPORTING_HEALTH_TOKEN`: unset is 503, missing or wrong is 401.
+ */
+export function releaseHealthHandler(options) {
+    const token = options.token ?? (() => process.env.REPORTING_HEALTH_TOKEN);
+    const site = options.reporting.site;
+    return async (request) => {
+        await connection();
+        const expected = token();
+        if (!expected)
+            return json({ error: 'not configured' }, 503);
+        const header = request.headers.get('authorization') ?? '';
+        const match = /^Bearer (.+)$/.exec(header);
+        if (!match?.[1] || !tokenMatches(match[1], expected)) {
+            return json({ error: 'unauthorized' }, 401);
+        }
+        const params = new URL(request.url).searchParams;
+        const fromRaw = iso.safeParse(params.get('from'));
+        const toRaw = iso.safeParse(params.get('to'));
+        if (!fromRaw.success || !toRaw.success) {
+            return json({ error: 'from and to must be ISO timestamps' }, 400);
+        }
+        const from = new Date(fromRaw.data);
+        const to = new Date(toRaw.data);
+        if (!(from.getTime() < to.getTime()) || to.getTime() - from.getTime() > MAX_RANGE_MS) {
+            return json({ error: 'from must be before to, at most 8 days apart' }, 400);
+        }
+        try {
+            const sums = {
+                requests: sql `coalesce(sum(${reportingRequests.requests}), 0)`,
+                errors: sql `coalesce(sum(${reportingRequests.errors}), 0)`,
+            };
+            const inSite = sql `${reportingRequests.site} = ${site}`;
+            const byColor = await options.db
+                .select({ color: reportingRequests.color, ...sums })
+                .from(reportingRequests)
+                .where(and(inSite, gte(reportingRequests.bucket, from), lt(reportingRequests.bucket, to)))
+                .groupBy(reportingRequests.color);
+            const baselineFrom = new Date(from.getTime() - BASELINE_DAYS * DAY_MS);
+            const [baseline] = await options.db
+                .select(sums)
+                .from(reportingRequests)
+                .where(and(inSite, gte(reportingRequests.bucket, baselineFrom), lt(reportingRequests.bucket, from)));
+            const colors = {
+                blue: { requests: 0, errors: 0 },
+                green: { requests: 0, errors: 0 },
+            };
+            for (const row of byColor) {
+                if (row.color === 'blue' || row.color === 'green') {
+                    colors[row.color] = { requests: Number(row.requests), errors: Number(row.errors) };
+                }
+            }
+            return json({
+                colors,
+                daily: {
+                    days: BASELINE_DAYS,
+                    requestsPerDay: Number(baseline?.requests ?? 0) / BASELINE_DAYS,
+                    errorsPerDay: Number(baseline?.errors ?? 0) / BASELINE_DAYS,
+                },
+                from: from.toISOString(),
+                to: to.toISOString(),
+            }, 200);
+        }
+        catch (error) {
+            options.reporting.log.error({ err: error instanceof Error ? error.name : 'unknown' }, 'reporting: release health read failed');
+            return json({ error: 'read failed' }, 500);
+        }
+    };
+}
+// Any status under 500: the request is counted, and not as an error.
+const CONTROL_FLOW_STATUS = 307;
+function isNextControlFlow(error) {
+    try {
+        unstable_rethrow(error);
+        return false;
+    }
+    catch {
+        // unstable_rethrow throws only for Next's internal control-flow errors.
+        return true;
+    }
+}
+/**
+ * Wraps a route handler so each response is counted. A handler that throws is
+ * counted as a 500 and the throw goes on. Next's own control-flow throws
+ * (`redirect()`, `notFound()` and the like) are counted as a request, not an
+ * error, so they cannot push a release toward rollback.
+ */
+export function withRequestCount(reporting, handler) {
+    return async (...args) => {
+        try {
+            const response = await handler(...args);
+            reporting.requests.record(response.status);
+            return response;
+        }
+        catch (error) {
+            reporting.requests.record(isNextControlFlow(error) ? CONTROL_FLOW_STATUS : 500);
+            throw error;
+        }
+    };
+}

package/dist/react/errors.d.ts

@@ -1,4 +1,4 @@
-import type { ReportingErrorRow } from '../tables.js';
+import type { ReportingErrorRow, TenantErrorRow } from '../tables.js';
 /**
  * The operator's error list: a plain table over the rows `errorsPage()`
  * already returned, newest last-seen first — the same props-in split as
@@ -7,6 +7,6 @@ import type { ReportingErrorRow } from '../tables.js';
  * renders the group's summary columns.
  */
 export declare function ErrorsTable(props: {
-    readonly rows: readonly ReportingErrorRow[];
+    readonly rows: readonly (ReportingErrorRow | TenantErrorRow)[];
     readonly label?: string;
 }): import("react").JSX.Element;

package/dist/react/errors.js

@@ -10,7 +10,7 @@ export function ErrorsTable(props) {
     if (props.rows.length === 0) {
         return _jsx("p", { "data-reporting-errors-empty": "", children: "No errors captured. All clear." });
     }
-    return (_jsxs("table", { "data-reporting-errors": "", "aria-label": props.label ?? 'Errors, newest last seen first', children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { scope: "col", children: "Kind" }), _jsx("th", { scope: "col", children: "Message" }), _jsx("th", { scope: "col", children: "Occurrences" }), _jsx("th", { scope: "col", children: "First seen" }), _jsx("th", { scope: "col", children: "Last seen" }), _jsx("th", { scope: "col", children: "Runtime" }), _jsx("th", { scope: "col", children: "Release" }), _jsx("th", { scope: "col", children: "State" })] }) }), _jsx("tbody", { children: props.rows.map((row) => (_jsxs("tr", { children: [_jsx("td", { children: row.kind }), _jsx("td", { style: { maxWidth: '32rem', overflowWrap: 'anywhere', wordBreak: 'break-word' }, title: row.message, children: row.message }), _jsx("td", { style: { fontVariantNumeric: 'tabular-nums' }, children: String(row.occurrences) }), _jsx("td", { children: formatTimestamp(row.firstSeenAt) }), _jsx("td", { children: formatTimestamp(row.lastSeenAt) }), _jsx("td", { children: row.runtime }), _jsx("td", { children: row.release ?? '—' }), _jsx("td", { children: row.state })] }, row.fingerprint))) })] }));
+    return (_jsxs("table", { "data-reporting-errors": "", "aria-label": props.label ?? 'Errors, newest last seen first', children: [_jsx("thead", { children: _jsxs("tr", { children: [_jsx("th", { scope: "col", children: "Kind" }), _jsx("th", { scope: "col", children: "Message" }), _jsx("th", { scope: "col", children: "Occurrences" }), _jsx("th", { scope: "col", children: "First seen" }), _jsx("th", { scope: "col", children: "Last seen" }), _jsx("th", { scope: "col", children: "Runtime" }), _jsx("th", { scope: "col", children: "Release" }), _jsx("th", { scope: "col", children: "State" })] }) }), _jsx("tbody", { children: props.rows.map((row) => (_jsxs("tr", { children: [_jsx("td", { children: row.kind }), _jsx("td", { style: { maxWidth: '32rem', overflowWrap: 'anywhere', wordBreak: 'break-word' }, title: row.message ?? undefined, children: row.message ?? '—' }), _jsx("td", { style: { fontVariantNumeric: 'tabular-nums' }, children: String(row.occurrences) }), _jsx("td", { children: formatTimestamp(row.firstSeenAt) }), _jsx("td", { children: formatTimestamp(row.lastSeenAt) }), _jsx("td", { children: row.runtime ?? '—' }), _jsx("td", { children: row.release ?? '—' }), _jsx("td", { children: row.state })] }, row.fingerprint))) })] }));
 }
 function formatTimestamp(value) {
     return `${value.toISOString().slice(0, 19).replace('T', ' ')} UTC`;

package/dist/requests.d.ts

@@ -0,0 +1,22 @@
+import type { Db, Logger } from './types.js';
+export interface RequestCounterOptions {
+    db: Db;
+    log: Logger;
+    site: string;
+    now: () => Date;
+    flushEveryMs: number;
+}
+/**
+ * Counts responses in memory and writes one upsert per minute bucket, so a
+ * request costs a map increment and the database sees a handful of rows a
+ * minute. `errors` is status >= 500. A failed write puts its counts back for
+ * the next one; the process dying loses at most `flushEveryMs` of counts.
+ */
+export declare class RequestCounter {
+    private readonly o;
+    private readonly buckets;
+    private timer;
+    constructor(o: RequestCounterOptions);
+    record(status: number): void;
+    flush(): Promise<void>;
+}