@wtfalch/reporting 0.7.0 → 0.9.0

package/README.md

@@ -64,6 +64,7 @@ await ensureRuntimeRole({
     'reporting_errors',
     'reporting_tenant_settings',
     'reporting_error_tenants',
+    'reporting_requests',
   ],
   grants: [ // the seven security definer functions, schema-qualified
     'myservice.reporting_prune_events(interval, integer)',
@@ -79,7 +80,7 @@ await ensureRuntimeRole({
 
 Run `ensureRuntimeRole` after every migration run: the lists apply to the
 tables that exist at that moment. `grants` entries are spliced into SQL, so
-they are trusted text. Without `noDelete` the role can delete from those five
+they are trusted text. Without `noDelete` the role can delete from those six
 tables. These are the privileges the
 package's own tests check, on a real Postgres, in a named schema.
 
@@ -98,6 +99,7 @@ await assertRuntimeRole(connection.database, {
     'myservice.reporting_errors',
     'myservice.reporting_tenant_settings',
     'myservice.reporting_error_tenants',
+    'myservice.reporting_requests',
   ],
 });
 ```
@@ -205,6 +207,58 @@ edit can shorten history to a week and no further. Pass `audit` to
 `createReporting` to have every change handed to your audit ledger after it
 commits.
 
+## Release health (0.8.0)
+
+With `REPORTING_RELEASE` (an image digest) and `REPORTING_COLOR` (`blue` or
+`green`) set, every event, analytics and error row carries both. Count each
+response and mount the read foundry judges a new color by:
+
+```ts
+// app/api/reporting/release-health/route.ts
+import { releaseHealthHandler } from '@wtfalch/reporting/next';
+export const GET = releaseHealthHandler({ db, reporting });
+
+// any route handler: counted per minute, color and release (status >= 500 is an error)
+import { withRequestCount } from '@wtfalch/reporting/next';
+export const POST = withRequestCount(reporting, async (req) => Response.json({ ok: true }));
+```
+
+`reporting.requests.record(status)` is the same count for a host that has no
+route handler to wrap. Counts sit in memory and are written once per minute
+bucket (every 10 seconds by default; `reporting.flush()` writes them now). The
+read needs `Authorization: Bearer $REPORTING_HEALTH_TOKEN`: 401 for a missing or
+wrong token, 503 when the variable is unset. It answers `from` and `to` (ISO,
+`from` before `to`, at most 8 days; otherwise 400) with request and 5xx counts
+per color and the per-day average of the 7 days before `from`. Counts only; no
+event content. Rows of `reporting_requests` are not pruned.
+
+### Count every request (0.9.0)
+
+`withRequestCount` counts one route handler. To count every request with no
+change per route, add one line to `proxy.ts` and one to `instrumentation.ts`:
+
+```ts
+// src/proxy.ts: wrap the proxy function you already export
+import { countRequests } from '@wtfalch/reporting/next';
+export const proxy = countRequests(reporting, async (request) => { /* as before */ });
+
+// src/instrumentation.ts: pass the handler you already export (Sentry's, say) as the second argument
+import { countRequestErrors } from '@wtfalch/reporting/next';
+export const onRequestError = countRequestErrors(reporting, Sentry.captureRequestError);
+```
+
+The proxy counts each request it sees with the status it answers with (a
+redirect or a 403 is a request; its own throw is a 500). A request it passes
+through is counted as a request there, and a page, route handler or Server
+Action that then throws reaches `onRequestError`, which adds the 5xx. A route
+handler that returns a 500 without throwing is not seen; use `withRequestCount`
+there. `/api/health` and `/api/reporting/release-health` are not counted
+(`skipPaths` replaces that list). Do not wrap a route in `withRequestCount`
+when the proxy matcher covers it: it would be counted twice. In Next 16
+`proxy.ts` runs on the Node runtime only, which is where the in-memory counter
+and its Postgres flush work; on the Edge runtime both functions count nothing.
+A counting failure is logged and never fails the request.
+
 ## Shutdown
 
 ```ts
@@ -291,11 +345,10 @@ the rollups hold nothing to erase. Call it in the host's erasure transaction.
 
 ## Tests
 
-```ts
-import { createFakeReporting } from '@wtfalch/reporting/fake';
-```
-
-Same validation, no database; `fake.rows` is the table.
+No package ships a stand-in for a service. `createFakeReporting` (same
+validation, no database, `fake.rows` is the table) is this package's own
+unexported test double, under `src/test/`, for its own test files only -- a
+host writes its own double, or runs this package against a real database.
 
 ## What this package never does
 

package/dist/analytics/write.js

@@ -1,7 +1,9 @@
+import { deployTags } from '../deploy.js';
 import { reportingAnalytics } from '../tables.js';
 export async function insertAnalytics(db, rows) {
     if (rows.length === 0)
         return;
+    const tags = deployTags();
     await db.insert(reportingAnalytics).values(rows.map((r) => ({
         occurredAt: r.occurredAt,
         receivedAt: r.receivedAt,
@@ -16,5 +18,6 @@ export async function insertAnalytics(db, rows) {
         device: r.device,
         country: r.country,
         props: r.props,
+        ...tags,
     })));
 }

package/dist/deploy.d.ts

@@ -0,0 +1,11 @@
+export type Color = 'blue' | 'green';
+export interface DeployTags {
+    readonly release: string | null;
+    readonly color: Color | null;
+}
+/**
+ * The release and color the platform gave this container
+ * (`REPORTING_RELEASE`, `REPORTING_COLOR`). A color that is not blue or green
+ * is null, so a bad value cannot fail a write on the column's CHECK.
+ */
+export declare function deployTags(env?: NodeJS.ProcessEnv): DeployTags;

package/dist/deploy.js

@@ -0,0 +1,13 @@
+/**
+ * The release and color the platform gave this container
+ * (`REPORTING_RELEASE`, `REPORTING_COLOR`). A color that is not blue or green
+ * is null, so a bad value cannot fail a write on the column's CHECK.
+ */
+export function deployTags(env = process.env) {
+    const color = env.REPORTING_COLOR;
+    const release = env.REPORTING_RELEASE?.slice(0, 128);
+    return {
+        release: release ? release : null,
+        color: color === 'blue' || color === 'green' ? color : null,
+    };
+}

package/dist/errors/capture.js

@@ -1,4 +1,5 @@
 import { eq, sql } from 'drizzle-orm';
+import { deployTags } from '../deploy.js';
 import { ERROR_RUNTIMES, KIND_PATTERN, LIMITS } from '../schema.js';
 import { reportingErrorTenants, reportingErrors } from '../tables.js';
 import { describe } from '../writer.js';
@@ -122,6 +123,7 @@ async function upsertGroup(db, site, s, log) {
             stack: s.stack,
             runtime: s.runtime,
             release: s.release,
+            color: s.color,
             environment: s.environment,
             firstSeenAt: s.at,
             lastSeenAt: s.at,
@@ -139,6 +141,7 @@ async function upsertGroup(db, site, s, log) {
                 tenantId: s.tenantId,
                 requestId: s.requestId,
                 release: s.release,
+                color: s.color,
                 environment: s.environment,
                 state: reopened,
                 resolvedAt: sql `case when ${reportingErrors.state} in ('resolved', 'ignored') then null else ${reportingErrors.resolvedAt} end`,
@@ -237,6 +240,7 @@ export function createCapture(o) {
                 stack,
                 runtime,
                 release,
+                color: deployTags().color,
                 environment,
                 tenantId,
                 requestId,

package/dist/errors/reader.js

@@ -35,6 +35,7 @@ function tenantColumns() {
         stack: sql `null`.as('stack'),
         runtime: sql `null`.as('runtime'),
         release: sql `null`.as('release'),
+        color: sql `null`.as('color'),
         requestId: sql `null`.as('request_id'),
         resolvedBy: sql `null`.as('resolved_by'),
         state: sql `null`.as('state'),

package/dist/index.js

@@ -4,6 +4,7 @@ import { ANALYTICS_NAME_PATTERN, normalisePath, propsSchema } from './analytics/
 import { insertAnalytics } from './analytics/write.js';
 import { createCapture } from './errors/capture.js';
 import { eventsPage } from './reader.js';
+import { RequestCounter } from './requests.js';
 import { environmentSchema, siteSchema } from './schema.js';
 import { getSettings, getTenantRetention, setSettings, setTenantRetention } from './settings.js';
 import { tables } from './tables.js';
@@ -54,6 +55,13 @@ export function createReporting(options) {
         batchSize: options.batchSize ?? 500,
         flushEveryMs: options.flushEveryMs ?? 1000,
     });
+    const requests = new RequestCounter({
+        db: options.db,
+        log: options.log,
+        site,
+        now,
+        flushEveryMs: options.requestFlushEveryMs ?? 10_000,
+    });
     // One alerting path, shared by `reporting.alert()` and a new-or-reopened
     // capture (errors/capture.ts's `alert` option): an `alert.<check>` row,
     // already indexed and pruned the same as everything else on the
@@ -91,7 +99,14 @@ export function createReporting(options) {
         event: (input) => writer.event(input),
         captureError: (error, context) => capture(error, context),
         alert: fireAlert,
-        flush: (opts) => writer.flush(opts),
+        flush: async (opts) => {
+            await writer.flush(opts);
+            await requests.flush();
+        },
+        requests: {
+            record: (status) => requests.record(status),
+            recordError: () => requests.recordError(),
+        },
         events: { page: (opts) => eventsPage(options.db, opts) },
         settings: {
             get: () => getSettings(options.db),

package/dist/migrations/0009_release_color.sql

@@ -0,0 +1,33 @@
+-- @wtfalch/reporting 0.8.0: the release and color a row was written under.
+-- Mirrors src/tables.ts.
+--
+-- A blue/green deploy runs two copies of an app against one database. The
+-- host gets REPORTING_RELEASE (an image digest) and REPORTING_COLOR (blue or
+-- green) from its platform, and the package stamps both on every row it
+-- writes. Both are nullable: rows written before this file, and rows from an
+-- app with no color, carry null. reporting_errors already has `release`.
+--
+-- Same shape as 0004_environment.sql: `add column if not exists` takes only a
+-- catalog lock, and the CHECK goes in `not valid` then `validate constraint`
+-- so the scan of a large table does not hold ACCESS EXCLUSIVE. Every
+-- statement is idempotent; no backfill.
+
+alter table reporting_events add column if not exists release text;
+alter table reporting_events add column if not exists color text;
+alter table reporting_events drop constraint if exists reporting_events_color_check;
+alter table reporting_events add constraint reporting_events_color_check
+  check (color is null or color in ('blue', 'green')) not valid;
+alter table reporting_events validate constraint reporting_events_color_check;
+
+alter table reporting_analytics add column if not exists release text;
+alter table reporting_analytics add column if not exists color text;
+alter table reporting_analytics drop constraint if exists reporting_analytics_color_check;
+alter table reporting_analytics add constraint reporting_analytics_color_check
+  check (color is null or color in ('blue', 'green')) not valid;
+alter table reporting_analytics validate constraint reporting_analytics_color_check;
+
+alter table reporting_errors add column if not exists color text;
+alter table reporting_errors drop constraint if exists reporting_errors_color_check;
+alter table reporting_errors add constraint reporting_errors_color_check
+  check (color is null or color in ('blue', 'green')) not valid;
+alter table reporting_errors validate constraint reporting_errors_color_check;

package/dist/migrations/0010_requests.sql

@@ -0,0 +1,27 @@
+-- @wtfalch/reporting 0.8.0: a request counter, one row per minute.
+-- Mirrors src/tables.ts.
+--
+-- Blue/green judges a new color by its share of failed responses, which needs
+-- a count of all requests, not one event per request. The app counts in
+-- memory and writes one upsert per minute bucket, color and release.
+-- `errors` is responses with status >= 500. `color` and `release` are the
+-- empty string, not null, when the app has none, so they can sit in the
+-- primary key. Counts only; nothing here identifies a person or a request.
+-- Every statement is idempotent.
+--
+-- The table is new, so there are no live rows to scan and the CHECKs go in
+-- the plain way. Select, insert and update for the runtime role; nothing that
+-- deletes (the host's ensureRuntimeRole call sets that; see the README).
+
+create table if not exists reporting_requests (
+  bucket    timestamptz not null,
+  site      text not null,
+  color     text not null default '',
+  release   text not null default '',
+  requests  bigint not null default 0,
+  errors    bigint not null default 0,
+  constraint reporting_requests_pkey primary key (bucket, site, color, release),
+  constraint reporting_requests_site_check check (site ~ '^[a-z][a-z0-9-]{0,63}$'),
+  constraint reporting_requests_color_check check (color in ('', 'blue', 'green')),
+  constraint reporting_requests_counts_check check (requests >= 0 and errors between 0 and requests)
+);

package/dist/next/count.d.ts

@@ -0,0 +1,49 @@
+import type { Reporting } from '../types.js';
+/**
+ * Counting for every request, with no change per route. Two halves, because
+ * Next gives each half only part of the picture:
+ *
+ * - `countRequests` wraps the app's `proxy.ts` function. It runs on every
+ *   matched request before the page or route, so it counts the request. It
+ *   sees the status the proxy itself answers with (a redirect, a 403, a 500
+ *   from its own throw); a request it lets through is a pass-through there,
+ *   and the page's real status is not known yet.
+ * - `countRequestErrors` is `onRequestError` in `instrumentation.ts`. Next calls
+ *   it for each error a page, route handler or Server Action throws, which is
+ *   the 5xx; it adds an error to a request the proxy already counted.
+ *
+ * Runtime: in Next 16 `proxy.ts` runs on the Node runtime only (Edge is not
+ * supported there), and `onRequestError` runs in whichever runtime threw. The
+ * counter is an in-memory map flushed to Postgres, so it works in Node. In an
+ * Edge runtime the call is skipped (see `isEdge`): an Edge instance has no
+ * database and its own memory, so a count there would never be written.
+ *
+ * Do not also wrap a route in `withRequestCount` when the proxy matcher
+ * covers it: the request would be counted twice, and a throw as two errors.
+ * `withRequestCount` stays for a path the proxy matcher excludes.
+ *
+ * Neither function ever fails a request: a counting error is logged.
+ */
+/** The probe and the release-health read are not traffic; counting them would swamp the signal. */
+export declare const DEFAULT_UNCOUNTED_PATHS: readonly string[];
+export interface CountOptions {
+    /** Paths (exact, or a prefix followed by `/`) that are not counted. Replaces the default list. */
+    readonly skipPaths?: readonly string[];
+}
+/**
+ * Wraps the app's proxy function: `export const proxy = countRequests(reporting, handler)`.
+ * Counts the status the proxy answers with; a throw counts as a 500 and goes on.
+ */
+export declare function countRequests<A extends {
+    url: string;
+}, R extends {
+    status: number;
+} | undefined>(reporting: Pick<Reporting, 'requests' | 'log'>, handler: (request: A) => Promise<R> | R, options?: CountOptions): (request: A) => Promise<R>;
+type RequestErrorArgs = Parameters<import('./index.js').NextOnRequestError>;
+/**
+ * `export const onRequestError = countRequestErrors(reporting)`. Pass the
+ * handler you already export (Sentry's, `errorHandler(reporting)`) as `next`
+ * and it still runs, after the count and whatever the count does.
+ */
+export declare function countRequestErrors(reporting: Pick<Reporting, 'requests' | 'log'>, next?: (...args: RequestErrorArgs) => void | Promise<void>, options?: CountOptions): (...args: RequestErrorArgs) => void | Promise<void>;
+export {};

package/dist/next/count.js

@@ -0,0 +1,100 @@
+/**
+ * Counting for every request, with no change per route. Two halves, because
+ * Next gives each half only part of the picture:
+ *
+ * - `countRequests` wraps the app's `proxy.ts` function. It runs on every
+ *   matched request before the page or route, so it counts the request. It
+ *   sees the status the proxy itself answers with (a redirect, a 403, a 500
+ *   from its own throw); a request it lets through is a pass-through there,
+ *   and the page's real status is not known yet.
+ * - `countRequestErrors` is `onRequestError` in `instrumentation.ts`. Next calls
+ *   it for each error a page, route handler or Server Action throws, which is
+ *   the 5xx; it adds an error to a request the proxy already counted.
+ *
+ * Runtime: in Next 16 `proxy.ts` runs on the Node runtime only (Edge is not
+ * supported there), and `onRequestError` runs in whichever runtime threw. The
+ * counter is an in-memory map flushed to Postgres, so it works in Node. In an
+ * Edge runtime the call is skipped (see `isEdge`): an Edge instance has no
+ * database and its own memory, so a count there would never be written.
+ *
+ * Do not also wrap a route in `withRequestCount` when the proxy matcher
+ * covers it: the request would be counted twice, and a throw as two errors.
+ * `withRequestCount` stays for a path the proxy matcher excludes.
+ *
+ * Neither function ever fails a request: a counting error is logged.
+ */
+/** The probe and the release-health read are not traffic; counting them would swamp the signal. */
+export const DEFAULT_UNCOUNTED_PATHS = [
+    '/api/health',
+    '/api/reporting/release-health',
+];
+const isEdge = () => process.env.NEXT_RUNTIME === 'edge';
+function isSkipped(pathname, skip) {
+    return skip.some((p) => pathname === p || pathname.startsWith(`${p}/`));
+}
+function pathnameOf(url) {
+    try {
+        return new URL(url).pathname;
+    }
+    catch {
+        // A request path (`/x?y=1`) rather than a full URL, as onRequestError hands over.
+        return url.split('?')[0] ?? url;
+    }
+}
+function safely(reporting, what, fn) {
+    try {
+        fn();
+    }
+    catch (error) {
+        try {
+            reporting.log.error({ err: error instanceof Error ? error.name : 'unknown' }, `reporting: ${what} failed`);
+        }
+        catch (logError) {
+            // The logger itself threw; counting must still never fail a request.
+            console.error(`reporting: ${what} failed and so did the logger`, logError);
+        }
+    }
+}
+/**
+ * Wraps the app's proxy function: `export const proxy = countRequests(reporting, handler)`.
+ * Counts the status the proxy answers with; a throw counts as a 500 and goes on.
+ */
+export function countRequests(reporting, handler, options = {}) {
+    const skip = options.skipPaths ?? DEFAULT_UNCOUNTED_PATHS;
+    const count = (request, status) => safely(reporting, 'request count', () => {
+        if (isEdge() || isSkipped(pathnameOf(request.url), skip))
+            return;
+        reporting.requests.record(status);
+    });
+    return async (request) => {
+        let response;
+        try {
+            response = await handler(request);
+        }
+        catch (error) {
+            count(request, 500);
+            throw error;
+        }
+        count(request, response?.status ?? 200);
+        return response;
+    };
+}
+/**
+ * `export const onRequestError = countRequestErrors(reporting)`. Pass the
+ * handler you already export (Sentry's, `errorHandler(reporting)`) as `next`
+ * and it still runs, after the count and whatever the count does.
+ */
+export function countRequestErrors(reporting, next, options = {}) {
+    const skip = options.skipPaths ?? DEFAULT_UNCOUNTED_PATHS;
+    return (...args) => {
+        safely(reporting, 'request error count', () => {
+            // A throw in the proxy is already counted by `countRequests` as a 500; Next also reports it here.
+            if (args[2].routeType === 'proxy')
+                return;
+            if (isEdge() || isSkipped(pathnameOf(args[1].path), skip))
+                return;
+            reporting.requests.recordError();
+        });
+        return next?.(...args);
+    };
+}

package/dist/next/index.d.ts

@@ -3,6 +3,8 @@ import { deviceOf } from '../analytics/schema.js';
 import type { Reporting } from '../types.js';
 import { type ClientErrorCollectorOptions } from './client-errors.js';
 import { type EdgeErrorIngestOptions } from './edge-errors.js';
+export { releaseHealthHandler, withRequestCount, type ReleaseHealthOptions, } from './release-health.js';
+export { countRequestErrors, countRequests, DEFAULT_UNCOUNTED_PATHS, type CountOptions, } from './count.js';
 export { edgeErrorHandler, type EdgeCaptureOptions, type EdgeErrorReport } from './edge-errors.js';
 /**
  * The Next bindings: everything in the package that knows what a request is.

package/dist/next/index.js

@@ -6,6 +6,8 @@ import { createCollector } from '../analytics/collector.js';
 import { countryOf, deviceOf } from '../analytics/schema.js';
 import { createClientErrorCollector } from './client-errors.js';
 import { createEdgeErrorIngestCollector } from './edge-errors.js';
+export { releaseHealthHandler, withRequestCount, } from './release-health.js';
+export { countRequestErrors, countRequests, DEFAULT_UNCOUNTED_PATHS, } from './count.js';
 export { edgeErrorHandler } from './edge-errors.js';
 /**
  * The Next bindings: everything in the package that knows what a request is.

package/dist/next/release-health.d.ts

@@ -0,0 +1,24 @@
+import type { Db, Reporting } from '../types.js';
+export interface ReleaseHealthOptions {
+    readonly db: Db;
+    readonly reporting: Pick<Reporting, 'site' | 'log'>;
+    /** Defaults to `process.env.REPORTING_HEALTH_TOKEN`, read on each request. */
+    readonly token?: () => string | undefined;
+}
+/**
+ * `GET /api/reporting/release-health?from=<ISO>&to=<ISO>`: the counts foundry
+ * judges a new color by. Request and 5xx totals per color over [from, to),
+ * and the per-day average of the seven days before `from`. Counts only; no
+ * event, error or request content is read. Bearer token from
+ * `REPORTING_HEALTH_TOKEN`: unset is 503, missing or wrong is 401.
+ */
+export declare function releaseHealthHandler(options: ReleaseHealthOptions): (request: Request) => Promise<Response>;
+/**
+ * Wraps a route handler so each response is counted. A handler that throws is
+ * counted as a 500 and the throw goes on. Next's own control-flow throws
+ * (`redirect()`, `notFound()` and the like) are counted as a request, not an
+ * error, so they cannot push a release toward rollback.
+ */
+export declare function withRequestCount<A extends unknown[]>(reporting: {
+    requests: Pick<Reporting['requests'], 'record'>;
+}, handler: (...args: A) => Promise<Response> | Response): (...args: A) => Promise<Response>;

package/dist/next/release-health.js

@@ -0,0 +1,122 @@
+import { timingSafeEqual } from 'node:crypto';
+import { and, gte, lt, sql } from 'drizzle-orm';
+import { unstable_rethrow } from 'next/navigation';
+import { connection } from 'next/server';
+import { z } from 'zod';
+import { reportingRequests } from '../tables.js';
+const DAY_MS = 86_400_000;
+const BASELINE_DAYS = 7;
+const MAX_RANGE_MS = 8 * DAY_MS;
+const iso = z.iso.datetime({ offset: true });
+function tokenMatches(provided, expected) {
+    const a = Buffer.from(provided);
+    const b = Buffer.from(expected);
+    return a.length === b.length && timingSafeEqual(a, b);
+}
+function json(body, status) {
+    return Response.json(body, { status, headers: { 'cache-control': 'no-store' } });
+}
+/**
+ * `GET /api/reporting/release-health?from=<ISO>&to=<ISO>`: the counts foundry
+ * judges a new color by. Request and 5xx totals per color over [from, to),
+ * and the per-day average of the seven days before `from`. Counts only; no
+ * event, error or request content is read. Bearer token from
+ * `REPORTING_HEALTH_TOKEN`: unset is 503, missing or wrong is 401.
+ */
+export function releaseHealthHandler(options) {
+    const token = options.token ?? (() => process.env.REPORTING_HEALTH_TOKEN);
+    const site = options.reporting.site;
+    return async (request) => {
+        await connection();
+        const expected = token();
+        if (!expected)
+            return json({ error: 'not configured' }, 503);
+        const header = request.headers.get('authorization') ?? '';
+        const match = /^Bearer (.+)$/.exec(header);
+        if (!match?.[1] || !tokenMatches(match[1], expected)) {
+            return json({ error: 'unauthorized' }, 401);
+        }
+        const params = new URL(request.url).searchParams;
+        const fromRaw = iso.safeParse(params.get('from'));
+        const toRaw = iso.safeParse(params.get('to'));
+        if (!fromRaw.success || !toRaw.success) {
+            return json({ error: 'from and to must be ISO timestamps' }, 400);
+        }
+        const from = new Date(fromRaw.data);
+        const to = new Date(toRaw.data);
+        if (!(from.getTime() < to.getTime()) || to.getTime() - from.getTime() > MAX_RANGE_MS) {
+            return json({ error: 'from must be before to, at most 8 days apart' }, 400);
+        }
+        try {
+            const sums = {
+                requests: sql `coalesce(sum(${reportingRequests.requests}), 0)`,
+                errors: sql `coalesce(sum(${reportingRequests.errors}), 0)`,
+            };
+            const inSite = sql `${reportingRequests.site} = ${site}`;
+            const byColor = await options.db
+                .select({ color: reportingRequests.color, ...sums })
+                .from(reportingRequests)
+                .where(and(inSite, gte(reportingRequests.bucket, from), lt(reportingRequests.bucket, to)))
+                .groupBy(reportingRequests.color);
+            const baselineFrom = new Date(from.getTime() - BASELINE_DAYS * DAY_MS);
+            const [baseline] = await options.db
+                .select(sums)
+                .from(reportingRequests)
+                .where(and(inSite, gte(reportingRequests.bucket, baselineFrom), lt(reportingRequests.bucket, from)));
+            const colors = {
+                blue: { requests: 0, errors: 0 },
+                green: { requests: 0, errors: 0 },
+            };
+            for (const row of byColor) {
+                if (row.color === 'blue' || row.color === 'green') {
+                    colors[row.color] = { requests: Number(row.requests), errors: Number(row.errors) };
+                }
+            }
+            return json({
+                colors,
+                daily: {
+                    days: BASELINE_DAYS,
+                    requestsPerDay: Number(baseline?.requests ?? 0) / BASELINE_DAYS,
+                    errorsPerDay: Number(baseline?.errors ?? 0) / BASELINE_DAYS,
+                },
+                from: from.toISOString(),
+                to: to.toISOString(),
+            }, 200);
+        }
+        catch (error) {
+            options.reporting.log.error({ err: error instanceof Error ? error.name : 'unknown' }, 'reporting: release health read failed');
+            return json({ error: 'read failed' }, 500);
+        }
+    };
+}
+// Any status under 500: the request is counted, and not as an error.
+const CONTROL_FLOW_STATUS = 307;
+function isNextControlFlow(error) {
+    try {
+        unstable_rethrow(error);
+        return false;
+    }
+    catch {
+        // unstable_rethrow throws only for Next's internal control-flow errors.
+        return true;
+    }
+}
+/**
+ * Wraps a route handler so each response is counted. A handler that throws is
+ * counted as a 500 and the throw goes on. Next's own control-flow throws
+ * (`redirect()`, `notFound()` and the like) are counted as a request, not an
+ * error, so they cannot push a release toward rollback.
+ */
+export function withRequestCount(reporting, handler) {
+    return async (...args) => {
+        try {
+            const response = await handler(...args);
+            reporting.requests.record(response.status);
+            return response;
+        }
+        catch (error) {
+            reporting.requests.record(isNextControlFlow(error) ? CONTROL_FLOW_STATUS : 500);
+            throw error;
+        }
+    };
+}

package/dist/requests.d.ts

@@ -0,0 +1,29 @@
+import type { Db, Logger } from './types.js';
+export interface RequestCounterOptions {
+    db: Db;
+    log: Logger;
+    site: string;
+    now: () => Date;
+    flushEveryMs: number;
+}
+/**
+ * Counts responses in memory and writes one upsert per minute bucket, so a
+ * request costs a map increment and the database sees a handful of rows a
+ * minute. `errors` is status >= 500. A failed write puts its counts back for
+ * the next one; the process dying loses at most `flushEveryMs` of counts.
+ */
+export declare class RequestCounter {
+    private readonly o;
+    private readonly buckets;
+    private timer;
+    constructor(o: RequestCounterOptions);
+    /** Counts one response. */
+    record(status: number): void;
+    /**
+     * Counts one 5xx for a request already counted by `record`, such as a page
+     * that threw after the proxy let it through. Adds no request.
+     */
+    recordError(): void;
+    private add;
+    flush(): Promise<void>;
+}