create-bcp-app 0.2.6 → 0.2.7

package/README.md

@@ -92,10 +92,10 @@ Example:
   "schemaVersion": 1,
   "framework": "bcp",
   "projectName": "my-app",
-  "frameworkPackage": "npm:@chidchanun/bcp@0.2.6",
+  "frameworkPackage": "npm:@chidchanun/bcp@0.2.7",
   "createdWith": {
     "package": "create-bcp-app",
-    "version": "0.2.6"
+    "version": "0.2.7"
   },
   "packageManager": "npm",
   "presets": {
@@ -326,6 +326,37 @@ import {
 
 Authorization and CSRF checks must remain on the server; hiding UI controls in client code is not an authorization boundary.
 
+## Observability — 0.2.7+
+
+Generated projects can opt into process-local metrics and health/readiness without adding another dependency:
+
+```ts
+import {
+    createHealthRegistry,
+    createMetricsRegistry,
+    createRequestMetricsMiddleware,
+} from "bcp/observability";
+
+export const metrics =
+    createMetricsRegistry();
+
+export const health =
+    createHealthRegistry();
+
+export const requestMetrics =
+    createRequestMetricsMiddleware(
+        metrics
+    );
+```
+
+Expose metrics from an application API route with `createMetricsResponse(metrics)`. The response uses Prometheus-compatible text format.
+
+Health endpoints can return `health.response()`, which uses HTTP `200` when all checks pass and `503` when any dependency check fails or times out.
+
+The default HTTP request metrics use `method` and `status` labels only. Raw paths are intentionally excluded to avoid high-cardinality metric series.
+
+`bcp/observability` is server-only. Protect metrics and operational health detail with an appropriate network or authorization boundary when needed.
+
 ## Application Packaging — 0.2.4+
 
 Generated projects include:
@@ -407,5 +438,5 @@ npx create-bcp-app my-app --yes
 The `--bcp` option is mainly for prerelease/local package verification:
 
 ```bash
-npx create-bcp-app my-app --bcp file:../chidchanun-bcp-0.2.6.tgz
+npx create-bcp-app my-app --bcp file:../chidchanun-bcp-0.2.7.tgz
 ```

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-bcp-app",
-  "version": "0.2.6",
+  "version": "0.2.7",
   "description": "Create a new BCP Framework application.",
   "type": "module",
   "license": "MIT",

package/template/README.md

@@ -94,6 +94,37 @@ import {
 
 Authorization must always be enforced server-side. Client UI visibility is not a security boundary.
 
+## Observability — BCP 0.2.7+
+
+Create process-local metrics and health/readiness registries:
+
+```ts
+import {
+    createHealthRegistry,
+    createMetricsRegistry,
+    createRequestMetricsMiddleware,
+} from "bcp/observability";
+
+export const metrics =
+    createMetricsRegistry();
+
+export const health =
+    createHealthRegistry();
+
+export const requestMetrics =
+    createRequestMetricsMiddleware(
+        metrics
+    );
+```
+
+Expose Prometheus-compatible metrics with `createMetricsResponse(metrics)` from a server API route.
+
+Use `health.response()` for readiness endpoints. It returns HTTP `200` when all checks pass and `503` when a check fails or times out.
+
+The default request metrics use bounded `method` and `status` labels and do not include raw paths.
+
+Protect operational endpoints when their contents should not be public.
+
 ## Generate framework files
 
 BCP can generate common project files: