[versions]
micrometer = "1.17.0"

[libraries]
micrometer-core = { module = "io.micrometer:micrometer-core", version.ref = "micrometer" }
micrometer-registry-prometheus = { module = "io.micrometer:micrometer-registry-prometheus", version.ref = "micrometer" }
ktor-server-metrics-micrometer = { group = "io.ktor", name = "ktor-server-metrics-micrometer", version.ref = "ktor" }

package computer.whatthefuck.arcology.publishing

import computer.whatthefuck.arcology.database.RoamRepository
import io.micrometer.core.instrument.Counter
import io.micrometer.core.instrument.Timer
import io.micrometer.prometheusmetrics.PrometheusConfig
import io.micrometer.prometheusmetrics.PrometheusMeterRegistry
import kotlinx.coroutines.runBlocking
import kotlinx.serialization.Serializable
import kotlinx.serialization.encodeToString
import kotlinx.serialization.json.Json
import org.slf4j.LoggerFactory

enum class UaClass { BROWSER, FEED, HTTP_CLIENT, BOT, LLM, SOCIAL }

local function esc(s)
  s = tostring(s or "")
  s = s:gsub('\\', '\\\\')
  s = s:gsub('"', '\\"')
  return s
end
local VALID = { LLM=true, SOCIAL=true, FEED=true, HTTP_CLIENT=true, BOT=true, BROWSER=true }
local lines = {}
for _, row in ipairs(tbl) do
  local pattern = row[1] or ""
  local cls = row[2] or ""
  local group = row[3] or ""
  if pattern ~= "" and cls ~= "" then
    if not VALID[cls] then
      error("ua-patterns-table: invalid UaClass '" .. cls .. "' for pattern '" .. pattern .. "'")
    end
    if group ~= "" then
      table.insert(lines, "        // \xe2\x94\x80\xe2\x94\x80 " .. esc(group) .. " \xe2\x94\x80\xe2\x94\x80")
    end
    table.insert(lines, string.format('        "%s" to UaClass.%s,', esc(pattern), cls))
  end
end
return table.concat(lines, "\n")

/**
 * Ordered pattern list: first match wins. contains-matching so new agents
 * slot in by adding a row to ua-patterns-table. Unknown → BROWSER (the
 * "human" bucket). Generated from the [[ua-patterns-table]] via the
 * [[ua-patterns]] lua generator — edit the table, not this list.
 *
 * Corpus built from getarcis/well-known-bots (MIT) — SCRAPER category for
 * the HTTP-client block, AI_CRAWLER for LLM, SOCIAL for social previews,
 * feed fetchers cherry-picked from its SEARCH_ENGINE category — plus
 * monperrus/crawler-user-agents (MIT). ^-anchors preserved where the source
 * list anchors (curl, Java/, PHP/, Ruby, Apache-HttpClient, HTTPie,
 * Insomnia, Postman).
 */
object UserAgentBucketer {
    private val patterns: List<Pair<Regex, UaClass>> = listOf(
<<ua-patterns()>>
    ).map { (pattern, cls) -> Regex(pattern) to cls }

    fun classify(userAgent: String?): UaClass {
        if (userAgent.isNullOrBlank()) return UaClass.BROWSER
        return patterns.firstOrNull { (regex, _) -> regex.containsMatchIn(userAgent) }?.second
            ?: UaClass.BROWSER
    }
}

enum class RefererType { DIRECT, INTERNAL, SEARCH, SOCIAL, EXTERNAL }

object RefererClassifier {
    private val searchHosts = listOf(
        "google.", "bing.com", "duckduckgo.com", "kagi.com", "search.brave.com", "ecosia.org"
    )
    private val socialHosts = listOf(
        "twitter.com", "x.com", "t.co", "mastodon.", "fosstodon.org",
        "news.ycombinator.com", "reddit.com", "lobste.rs", "facebook.com",
        "linkedin.com", "bsky.app", "stribika"
    )

    fun classify(referer: String?, requestHost: String?): RefererType {
        if (referer.isNullOrBlank()) return RefererType.DIRECT
        val ref = referer.trim().lowercase()
        val host = requestHost?.substringBefore(":")?.trim()?.lowercase()
        if (host != null) {
            for (scheme in listOf("http://", "https://")) {
                if (ref == "$scheme$host/" || ref.startsWith("$scheme$host/")) return RefererType.INTERNAL
            }
        }
        if (searchHosts.any { it in ref }) return RefererType.SEARCH
        if (socialHosts.any { it in ref }) return RefererType.SOCIAL
        return RefererType.EXTERNAL
    }
}

/**
 * One JSON line per request under the "arcology.access" logger. The shape is
 * the log-aggregation contract: jq-able fields for site/path/status/duration
 * plus the classifier labels that mirror the Prometheus counter tags. The
 * raw [userAgent] rides along (null when the client sent none) so the
 * classifier's decision can be re-derived from the log when new agents show
 * up — the label stays tiny, the evidence stays queryable. [remoteHost] is
 * the TCP peer address and [forwardedFor] the raw =X-Forwarded-For= header
 * (null when absent): behind nginx the peer is the proxy, so the chain's
 * first hop is the client.
 */
@Serializable
data class AccessLogEvent(
    val timestamp: String,
    val method: String,
    val path: String,
    val host: String?,
    val site: String?,
    val status: Int,
    val durationMs: Long,
    val uaClass: String,
    val refererType: String,
    val remoteHost: String? = null,
    val forwardedFor: String? = null,
    val userAgent: String? = null,
    val extra: String = ""
)

object AccessLog {
    private val log = LoggerFactory.getLogger("arcology.access")
    private val json = Json { encodeDefaults = true }

    fun request(event: AccessLogEvent) {
        log.info(json.encodeToString(event))
    }

    fun error(uri: String, host: String?, message: String, throwable: Throwable?) {
        val stack = throwable?.let { "${it::class.simpleName}: ${it.message}" } ?: ""
        val event = AccessLogEvent(
            timestamp = java.time.Instant.now().toString(),
            method = "GET",
            path = uri,
            host = host,
            site = null,
            status = 500,
            durationMs = 0,
            uaClass = UaClass.BROWSER.name,
            refererType = RefererType.DIRECT.name,
            userAgent = null,
            extra = "error $message $stack".trim()
        )
        log.warn(json.encodeToString(event))
    }
}

/**
 * Normalizes a request path to a bounded-cardinality metric label value.
 * Per the design decision: real published paths get per-path granularity,
 * but the unbounded cases (attachment hashes, static-asset names, node-id
 * previews, scanner noise on the catch-all) collapse to fixed values so
 * crawlers cannot mint time series. The catch-all 404 branch passes
 * pathOverride="unknown" at the call site; this function handles the
 * path-shape rules for everything else.
 */
fun normalizePathLabel(path: String): String {
    val p = path.substringBefore('?').trim()
    if (p.isEmpty()) return "/"
    // attachment URLs carry a 64-hex source hash per variant — collapse them.
    if (p.startsWith("/attachment/")) return "/attachment"
    if (p.startsWith("/arcology/attachment/")) return "/arcology/attachment"
    // static assets and node previews carry per-file/per-node names
    if (p.startsWith("/static/")) return "/static"
    if (p.startsWith("/arcology/node/")) return "/arcology/node"
    return p
}

/**
 * Histogram config shared by every Arcology timer: server-side histogram
 * buckets so quantiles aggregate in PromQL (client-side percentiles are a
 * known aggregation footgun). Applied per-meter via the builder API rather
 * than as a registry-wide MeterFilter — filters must precede meter
 * registration on the shared registry.
 */
fun timerBuilder(name: String, description: String): Timer.Builder =
    Timer.builder(name)
        .description(description)
        .publishPercentileHistogram()

/**
 * Arcology-specific meters on the shared Prometheus registry. Request
 * counting and page timing live here (called from the server's
 * instrumentation point); cache and node-render meters are helpers for the
 * servePath / SitemapGraphBuilder instrumentation.
 */
class ArcologyMetrics(val registry: PrometheusMeterRegistry) {

    fun incRequest(
        site: String?,
        path: String,
        status: Int,
        uaClass: UaClass,
        refererType: RefererType
    ) {
        Counter.builder("arcology_requests_total")
            .description("Requests served by the Arcology web server")
            .tag("site", site ?: "localhost")
            .tag("path", path)
            .tag("status", status.toString())
            .tag("ua_class", uaClass.name)
            .tag("referer_type", refererType.name)
            .register(registry)
            .increment()
    }

    fun pageTimer(site: String?, path: String): Timer =
        timerBuilder("arcology_request_duration_seconds", "Time to build/serve a page")
            .tag("site", site ?: "localhost")
            .tag("path", path)
            .register(registry)

    /**
     * Lazily registered on first use: the server module may install
     * Ktor's MicrometerMetrics plugin (which registers a registry-wide
     * MeterFilter) after this object is constructed, and filters must
     * precede meter registration.
     */
    val nodeRenderTimer: Timer by lazy {
        timerBuilder("arcology_node_render_duration_seconds", "Time to parse + render one node body (cache miss)")
            .register(registry)
    }

    fun cacheHit(cache: String) {
        Counter.builder("arcology_cache_hits_total")
            .tag("cache", cache)
            .register(registry)
            .increment()
    }

    fun cacheMiss(cache: String) {
        Counter.builder("arcology_cache_misses_total")
            .tag("cache", cache)
            .register(registry)
            .increment()
    }
}

object MetricsConfiguration {
    /**
     * The shared, empty Prometheus registry. The JVM binders are bound by
     * Ktor's MicrometerMetrics plugin (its default =meterBinders= list)
     * during ~module()~ install — binding them here too would double-register
     * the same gauges (duplicate-registration warning, second copy dropped),
     * and binding anything here before the plugin installs would make the
     * plugin's registry-wide MeterFilter a late filter (which warns). The
     * ordering contract: bare registry → plugin install (binders + filter) →
     * any Arcology meters (all lazy/per-request).
     */
    fun registry(): PrometheusMeterRegistry =
        PrometheusMeterRegistry(PrometheusConfig.DEFAULT)
}

/**
 * Health check probe results. The status strings are the JSON contract the
 * Grafana alert (up == 0 via HTTP probe) and any external monitor rely on.
 */
object HealthCheck {
    @Serializable
    data class Report(val status: String, val checks: Map<String, String>)

    fun check(
        repository: RoamRepository,
        cacheDir: java.io.File,
        orgDir: String
    ): Report {
        val checks = linkedMapOf<String, String>()
        checks["database"] = try {
            runBlocking { repository.getNodeAncestors("health-probe-sentinel") }
            "ok"
        } catch (e: Exception) {
            "fail: ${e::class.simpleName}: ${e.message}"
        }
        checks["cache_dir"] = try {
            val probe = java.io.File.createTempFile("health-probe", ".tmp", cacheDir)
            probe.writeText("ok")
            probe.delete()
            "ok"
        } catch (e: Exception) {
            "fail: ${e::class.simpleName}: ${e.message}"
        }
        checks["org_dir"] = run {
            val dir = java.io.File(orgDir)
            if (dir.exists() && dir.isDirectory) "ok"
            else "fail: missing or not a directory"
        }
        val degraded = checks.values.any { it != "ok" }
        return Report(
            status = if (degraded) "degraded" else "ok",
            checks = checks
        )
    }
}

package computer.whatthefuck.arcology.publishing

import kotlinx.serialization.encodeToString
import kotlinx.serialization.json.Json
import kotlin.test.Test
import kotlin.test.assertEquals
import kotlin.test.assertTrue

class UserAgentBucketerTest {
    @Test
    fun `classifies known LLM crawlers`() {
        assertEquals(UaClass.LLM, UserAgentBucketer.classify("GPTBot/1.0 (+https://openai.com/gptbot)"))
        assertEquals(UaClass.LLM, UserAgentBucketer.classify("ClaudeBot/1.0"))
        assertEquals(UaClass.LLM, UserAgentBucketer.classify("Mozilla/5.0 (compatible; PerplexityBot/1.0)"))
        assertEquals(UaClass.LLM, UserAgentBucketer.classify("CCBot/2.0"))
        assertEquals(UaClass.LLM, UserAgentBucketer.classify("meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)"))
    }

    @Test
    fun `classifies http client libraries and cli tools as HTTP_CLIENT`() {
        assertEquals(UaClass.HTTP_CLIENT, UserAgentBucketer.classify("curl/8.5.0"))
        assertEquals(UaClass.HTTP_CLIENT, UserAgentBucketer.classify("Wget/1.21.4"))
        assertEquals(UaClass.HTTP_CLIENT, UserAgentBucketer.classify("python-requests/2.31.0"))
        assertEquals(UaClass.HTTP_CLIENT, UserAgentBucketer.classify("Python/3.12 aiohttp/3.9.1"))
        assertEquals(UaClass.HTTP_CLIENT, UserAgentBucketer.classify("python-httpx/0.27.0"))
        assertEquals(UaClass.HTTP_CLIENT, UserAgentBucketer.classify("Go-http-client/2.0"))
        assertEquals(UaClass.HTTP_CLIENT, UserAgentBucketer.classify("Java/17.0.1"))
        assertEquals(UaClass.HTTP_CLIENT, UserAgentBucketer.classify("Apache-HttpClient/4.5.13 (Java/17.0.1)"))
        assertEquals(UaClass.HTTP_CLIENT, UserAgentBucketer.classify("okhttp/4.11.0"))
        assertEquals(UaClass.HTTP_CLIENT, UserAgentBucketer.classify("axios/1.6.0"))
        assertEquals(UaClass.HTTP_CLIENT, UserAgentBucketer.classify("PostmanRuntime/7.36.0"))
        assertEquals(UaClass.HTTP_CLIENT, UserAgentBucketer.classify("HTTPie/3.2.2"))
        assertEquals(UaClass.HTTP_CLIENT, UserAgentBucketer.classify("Scrapy/2.11 (+https://scrapy.org)"))
        assertEquals(UaClass.HTTP_CLIENT, UserAgentBucketer.classify("HTTrack/3.0"))
    }

    @Test
    fun `curl-impersonating browsers stay BROWSER`() {
        // curl-impersonate spoofs real browser UA strings; a UA that contains
        // no library token is a browser by classification.
        assertEquals(UaClass.BROWSER, UserAgentBucketer.classify(
            "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36"
        ))
    }

    @Test
    fun `classifies known feed readers`() {
        assertEquals(UaClass.FEED, UserAgentBucketer.classify("Feedly/1.0 (+http://www.feedly.com/fetcher.html)"))
        assertEquals(UaClass.FEED, UserAgentBucketer.classify("Miniflux/2.2.0"))
        assertEquals(UaClass.FEED, UserAgentBucketer.classify("FreshRSS/1.20 (Linux; https://freshrss.org)"))
        assertEquals(UaClass.FEED, UserAgentBucketer.classify("NetNewsWire/6.1 (Mac)"))
    }

    @Test
    fun `classifies known search bots`() {
        assertEquals(UaClass.BOT, UserAgentBucketer.classify("Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"))
        assertEquals(UaClass.BOT, UserAgentBucketer.classify("bingbot/2.0"))
        assertEquals(UaClass.BOT, UserAgentBucketer.classify("Mozilla/5.0 (compatible; YandexBot/3.0)"))
        assertEquals(UaClass.BOT, UserAgentBucketer.classify("Mozilla/5.0 (compatible; AhrefsBot/7.0; +http://ahrefs.com/robot/)"))
        assertEquals(UaClass.BOT, UserAgentBucketer.classify("HeadlessChrome/126.0"))
    }

    @Test
    fun `classifies social preview bots`() {
        assertEquals(UaClass.SOCIAL, UserAgentBucketer.classify("facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)"))
        assertEquals(UaClass.SOCIAL, UserAgentBucketer.classify("Twitterbot/1.0"))
        assertEquals(UaClass.SOCIAL, UserAgentBucketer.classify("Slackbot-LinkExpanding 1.0"))
    }

    @Test
    fun `generic bot marker catches unknown crawlers`() {
        assertEquals(UaClass.BOT, UserAgentBucketer.classify("some-new-crawler/1.0 (spider)"))
        assertEquals(UaClass.BOT, UserAgentBucketer.classify("MysteryBot/2.0"))
    }

    @Test
    fun `browsers and unknown agents classify as BROWSER`() {
        assertEquals(UaClass.BROWSER, UserAgentBucketer.classify(null))
        assertEquals(UaClass.BROWSER, UserAgentBucketer.classify(""))
        assertEquals(UaClass.BROWSER, UserAgentBucketer.classify("   "))
        assertEquals(UaClass.BROWSER, UserAgentBucketer.classify(
            "Mozilla/5.0 (X11; Linux x86_64; rv:130.0) Gecko/20100101 Firefox/130.0"
        ))
        assertEquals(UaClass.BROWSER, UserAgentBucketer.classify(
            "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 Safari/605.1.15"
        ))
    }
}

class RefererClassifierTest {
    @Test
    fun `null blank referer is DIRECT`() {
        assertEquals(RefererType.DIRECT, RefererClassifier.classify(null, "example.com"))
        assertEquals(RefererType.DIRECT, RefererClassifier.classify("", "example.com"))
        assertEquals(RefererType.DIRECT, RefererClassifier.classify("   ", "example.com"))
    }

    @Test
    fun `same host with either scheme is INTERNAL`() {
        assertEquals(RefererType.INTERNAL, RefererClassifier.classify("https://example.com/some/page", "example.com"))
        assertEquals(RefererType.INTERNAL, RefererClassifier.classify("http://example.com/", "example.com"))
        // request host with a port is stripped
        assertEquals(RefererType.INTERNAL, RefererClassifier.classify("https://example.com/x", "example.com:8080"))
    }

    @Test
    fun `search engines classify as SEARCH`() {
        assertEquals(RefererType.SEARCH, RefererClassifier.classify("https://www.google.com/search?q=x", "example.com"))
        assertEquals(RefererType.SEARCH, RefererClassifier.classify("https://duckduckgo.com/?q=x", "example.com"))
        assertEquals(RefererType.SEARCH, RefererClassifier.classify("https://kagi.com/search?q=x", "example.com"))
    }

    @Test
    fun `social platforms classify as SOCIAL`() {
        assertEquals(RefererType.SOCIAL, RefererClassifier.classify("https://news.ycombinator.com/item?id=1", "example.com"))
        assertEquals(RefererType.SOCIAL, RefererClassifier.classify("https://t.co/abc", "example.com"))
        assertEquals(RefererType.SOCIAL, RefererClassifier.classify("https://bsky.app/profile/x", "example.com"))
    }

    @Test
    fun `other origins classify as EXTERNAL`() {
        assertEquals(RefererType.EXTERNAL, RefererClassifier.classify("https://someblog.example.net/links", "example.com"))
        // a different scheme that isn't a known host
        assertEquals(RefererType.EXTERNAL, RefererClassifier.classify("android-app://com.someapp", "example.com"))
    }
}

class NormalizePathLabelTest {
    @Test
    fun `attachment urls collapse to fixed label`() {
        val hash = "a".repeat(64)
        assertEquals("/attachment", normalizePathLabel("/attachment/$hash-1080.jpg"))
        assertEquals("/attachment", normalizePathLabel("/attachment/$hash-0.pdf"))
        assertEquals("/arcology/attachment", normalizePathLabel("/arcology/attachment/$hash-2160.jpg/html"))
    }

    @Test
    fun `static and node-preview urls collapse to fixed labels`() {
        assertEquals("/static", normalizePathLabel("/static/sitemap/sigma.min.js"))
        assertEquals("/arcology/node", normalizePathLabel("/arcology/node/some-node-id"))
    }

    @Test
    fun `query strings are dropped`() {
        assertEquals("/404", normalizePathLabel("/404?node=some-id"))
    }

    @Test
    fun `empty path normalizes to slash`() {
        assertEquals("/", normalizePathLabel(""))
        assertEquals("/", normalizePathLabel("?foo=bar"))
    }

    @Test
    fun `real paths pass through unchanged`() {
        assertEquals("/garden/index", normalizePathLabel("/garden/index"))
        assertEquals("/tags/tech", normalizePathLabel("/tags/tech"))
    }
}

class AccessLogEventTest {
    @Test
    fun `access log event serializes to compact JSON`() {
        val event = AccessLogEvent(
            timestamp = "2026-09-14T00:00:00Z",
            method = "GET",
            path = "/garden/index",
            host = "arcology.garden",
            site = "garden",
            status = 200,
            durationMs = 12,
            uaClass = "BROWSER",
            refererType = "DIRECT"
        )
        val json = Json { encodeDefaults = true }.encodeToString(event)
        assertTrue(json.contains("\"status\":200"))
        assertTrue(json.contains("\"uaClass\":\"BROWSER\""))
        assertTrue(json.contains("\"site\":\"garden\""))
        // extra has a default: encoded (encodeDefaults) with empty string
        assertTrue(json.contains("\"extra\":\"\""))
        // userAgent defaults to null and is encoded as such
        assertTrue(json.contains("\"userAgent\":null"))
    }

    @Test
    fun `raw user agent rides along in the log event`() {
        val ua = "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
        val event = AccessLogEvent(
            timestamp = "2026-09-14T00:00:00Z",
            method = "GET",
            path = "/garden/index",
            host = "arcology.garden",
            site = "garden",
            status = 200,
            durationMs = 12,
            uaClass = "BOT",
            refererType = "DIRECT",
            userAgent = ua
        )
        val json = Json { encodeDefaults = true }.encodeToString(event)
        assertTrue(json.contains("\"uaClass\":\"BOT\""))
        assertTrue(json.contains("\"userAgent\":\"$ua\""))
    }

    @Test
    fun `remote host and forwarded-for ride along in the log event`() {
        val event = AccessLogEvent(
            timestamp = "2026-09-14T00:00:00Z",
            method = "GET",
            path = "/garden/index",
            host = "arcology.garden",
            site = "garden",
            status = 200,
            durationMs = 12,
            uaClass = "BROWSER",
            refererType = "DIRECT",
            remoteHost = "127.0.0.1",
            forwardedFor = "203.0.113.7, 10.0.0.2"
        )
        val json = Json { encodeDefaults = true }.encodeToString(event)
        // Behind nginx the peer is the proxy; the XFF chain's first hop is
        // the client. Both fields present in the JSON contract.
        assertTrue(json.contains("\"remoteHost\":\"127.0.0.1\""))
        assertTrue(json.contains("\"forwardedFor\":\"203.0.113.7, 10.0.0.2\""))
    }
}

class ArcologyMetricsTest {
    @Test
    fun `request counter and page timer register with expected tags`() {
        val metrics = ArcologyMetrics(MetricsConfiguration.registry())
        metrics.incRequest("garden", "/index", 200, UaClass.BROWSER, RefererType.DIRECT)
        metrics.incRequest("garden", "/index", 404, UaClass.BOT, RefererType.EXTERNAL)
        metrics.pageTimer("garden", "/index").record(java.time.Duration.ofMillis(5))

        val scrape = metrics.registry.scrape()
        assertTrue(scrape.contains("arcology_requests_total"))
        assertTrue(scrape.contains("site=\"garden\""))
        assertTrue(scrape.contains("path=\"/index\""))
        assertTrue(scrape.contains("ua_class=\"BROWSER\""))
        assertTrue(scrape.contains("ua_class=\"BOT\""))
        assertTrue(scrape.contains("referer_type=\"DIRECT\""))
        assertTrue(scrape.contains("arcology_request_duration_seconds"))
    }

    @Test
    fun `cache counters and node render timer register`() {
        val metrics = ArcologyMetrics(MetricsConfiguration.registry())
        metrics.cacheHit("page")
        metrics.cacheMiss("page")
        metrics.cacheHit("sitemap")
        metrics.nodeRenderTimer.record(java.time.Duration.ofMillis(5))

        val scrape = metrics.registry.scrape()
        assertTrue(scrape.contains("arcology_cache_hits_total{cache=\"page\"}"))
        assertTrue(scrape.contains("arcology_cache_misses_total{cache=\"page\"}"))
        assertTrue(scrape.contains("cache=\"sitemap\""))
        assertTrue(scrape.contains("arcology_node_render_duration_seconds"))
    }

    @Test
    fun `registry exposes JVM binder metrics`() {
        // MetricsConfiguration.registry() is deliberately bare — the JVM
        // binders are the Ktor plugin's default meterBinders at install
        // time (see MetricsConfiguration docs). Binding the same set here
        // verifies the binder classes still expose the dashboard metrics.
        val registry = MetricsConfiguration.registry()
        listOf(
            io.micrometer.core.instrument.binder.jvm.JvmMemoryMetrics(),
            io.micrometer.core.instrument.binder.jvm.JvmGcMetrics(),
            io.micrometer.core.instrument.binder.system.ProcessorMetrics(),
            io.micrometer.core.instrument.binder.jvm.JvmThreadMetrics(),
            io.micrometer.core.instrument.binder.system.UptimeMetrics()
        ).forEach { it.bindTo(registry) }
        val scrape = registry.scrape()
        assertTrue(scrape.contains("jvm_memory_used_bytes"))
        assertTrue(scrape.contains("process_cpu_usage"))
        assertTrue(scrape.contains("process_uptime_seconds"))
    }
}

class HealthCheckTest {
    private val healthyRepo = EmptyRoamRepository()

    @Test
    fun `all checks pass on healthy inputs`() {
        val cacheDir = java.nio.file.Files.createTempDirectory("health-cache").toFile()
        val orgDir = java.nio.file.Files.createTempDirectory("health-org").toFile()
        val report = HealthCheck.check(healthyRepo, cacheDir, orgDir.absolutePath)
        assertEquals("ok", report.status)
        assertEquals("ok", report.checks["database"])
        assertEquals("ok", report.checks["cache_dir"])
        assertEquals("ok", report.checks["org_dir"])
    }

    @Test
    fun `missing org dir degrades the report`() {
        val cacheDir = java.nio.file.Files.createTempDirectory("health-cache").toFile()
        val report = HealthCheck.check(healthyRepo, cacheDir, "/does/not/exist")
        assertEquals("degraded", report.status)
        assertTrue(report.checks["org_dir"]!!.startsWith("fail"))
    }

    @Test
    fun `failing database degrades the report`() {
        val cacheDir = java.nio.file.Files.createTempDirectory("health-cache").toFile()
        val orgDir = java.nio.file.Files.createTempDirectory("health-org").toFile()
        val brokenRepo = object : EmptyRoamRepository() {
            override suspend fun getNodeAncestors(nodeId: String): List<String> {
                throw IllegalStateException("database is closed")
            }
        }
        val report = HealthCheck.check(brokenRepo, cacheDir, orgDir.absolutePath)
        assertEquals("degraded", report.status)
        assertTrue(report.checks["database"]!!.startsWith("fail"))
    }
}

<<metrics-preamble>>

<<ua-bucketer>>

<<referer-classifier>>

<<access-log-event>>

<<path-normalization>>

<<metrics-facade>>

<<health-check>>

<<metrics-test-prelude>>

<<metrics-test>>

<<metrics-test-end>>