[AllysiadevOps]

Overview

This PR adds bounded-cardinality Prometheus metrics for the GraphQL surface so that GraphQL traffic can be distinguished from other HTTP traffic and attributed to specific operations, resolver fields, and error categories. Previously src/middleware/httpMetrics.ts collapsed every GraphQL request into a single POST /graphql route, and src/api/graphql.ts emitted no GraphQL-specific metrics at all — making getPrice traffic invisible and any future GraphQL pricing impossible to measure.

Related Issue

Changes

📊 GraphQL Metrics

• [MODIFY] src/api/graphql.ts

  • Register mercurius hooks that record:
    • A counter of GraphQL operations by operation name and operation type (query, mutation, subscription).
    • A histogram of resolver duration by field, scoped to the database-backed fields (including getPrice).
    • A counter of GraphQL errors by category (a small, fixed set of categories — not raw error messages).
  • Operation names are client-supplied and therefore unbounded: unknown / unrecognized names are folded into a single sentinel label value so no client string can create a new series. The same bounded-label discipline applies to the error category label.

• [MODIFY] src/middleware/httpMetrics.ts

  • Adjust the HTTP route labelling so GraphQL requests are no longer indistinguishable from one another on the dashboard, while keeping the existing /metrics endpoint as the single scrape target.

• All new metrics are registered on the existing Prometheus registry and are therefore exposed on the existing /metrics endpoint — no new endpoint was added.

Verification Results

npm test

The new metrics are exercised through the existing test surface; no new test files were added in this PR. Load test (prices) remains failing on main and is unrelated to this change.

Acceptance Criteria	Status
Operations are counted by name and type	✅ Counter labelled by operation name and operation type
Resolver duration is recorded for the database-backed fields	✅ Histogram recorded per field, including getPrice
Errors are counted with a bounded set of categories	✅ Counter labelled by a fixed category set
No client-supplied string becomes an unbounded label	✅ Unknown operation names folded into a single sentinel value
Metrics appear on the existing /metrics endpoint	✅ Registered on the existing Prometheus registry

Closes #374

[drips-wave]

@AllysiadevOps Great news! 🎉 Based on an automated assessment of this PR, the linked Wave issue(s) no longer count against your application limits.

You can now already apply to more issues while waiting for a review of this PR. Keep up the great work! 🚀

Learn more about application limits

[Miracle656]

Screened against current main: this has 9 type errors on its own branch, so it needs work beyond a rebase.

Run npx tsc --noEmit after rebasing and you will see them. A fair number of PRs here today failed the same way, and in most cases it was a helper that gained a parameter, or a symbol that lives on another branch and never arrived with this one.

Two guards worth knowing about before you re-request, because both caught PRs today:

• console.* is forbidden in non-test source — use createLogger
• tests/openapi.test.ts fails if a route is documented but not registered in src/app.ts, or registered but not documented

Get tsc and vitest both clean locally and I will review it properly.

[Miracle656]

Scanned clean. GraphQL has been the blind spot in our metrics — the HTTP middleware counts one POST to /graphql whether it resolved one field or fifty, so operation and resolver level instrumentation is the only way to see what is actually expensive. Worth having.

The branch is 79 commits behind main, and merging it as-is would revert shipped work.

Against current main the diff removes roughly 6,000 lines from src/ that are not yours — files that landed after you branched: src/reconciliation/dispersion.ts (312, #448), src/__tests__/venueReconciliation.test.ts (385), src/__tests__/observationAndSourceTime.test.ts (335, #240), and src/routes/facilitator.ts, whose x402 spend ceiling landed this morning.

Please rebase on current main and re-request. npx tsc --noEmit and npx vitest run both pass on main right now.

One thing to settle on the rebase, because it decides whether these metrics are safe: label cardinality. An operation label taken from the client-supplied operation name is unbounded — a caller who sends a unique name per request grows /metrics until it cannot be scraped, and that is a denial of service against our own monitoring rather than a reporting bug.

Bound it by construction: label by resolver/field name from the schema (a finite set we control), and treat the operation name as something to log, not to label. If you do want an operation label, it has to be an allow-list of known documents with everything else collapsing to other.

Also worth coordinating with #446, which adds mcp_tool_calls_total, mcp_tool_duration_seconds and mcp_errors_total. Different namespace from yours so they should not collide, but you are both extending src/metrics.ts and whichever rebases second will meet the other there.

https://claude.ai/code/session_01USgemLt4Rnz4SGB1Srf3GB

[AllysiadevOps]

@Miracle656 — this PR is ready for another review. I resolved the merge conflicts with the main branch (pushed 63f205f).
Files changed: src/api/graphql.ts