@growth-labs/monitoring

Operational observability for Growth Labs Cloudflare Workers: synthetic probes, authenticated browser canary primitives, browser error capture, uptime/error schemas, alerting, and a small public status page.

Install

pnpm add @growth-labs/monitoring @growth-labs/notify @growth-labs/analytics

Peer: astro ^6.0.0 for the status-page app. Runtime deps: @growth-labs/notify, @growth-labs/analytics, drizzle-orm, zod.

Modules

| Subpath | Purpose | | --- | --- | | @growth-labs/monitoring | Umbrella exports for the main factories. | | @growth-labs/monitoring/canary | Authenticated browser canary schemas, HTTP asset runner, browser error normalization, privacy-safe beacon/persistence helpers, and synthetic traffic naming. | | @growth-labs/monitoring/prober | createProber(config) for Cron Workers that run GET, POST, and happy-path checks. | | @growth-labs/monitoring/tail | createTailWorker(config) for Cloudflare Tail Worker trace batches. | | @growth-labs/monitoring/alerting | Threshold, dedup, incident, escalation, and notify delegation helpers. | | @growth-labs/monitoring/status-page | Astro integration that injects the status page and JSON route. | | @growth-labs/monitoring/schemas | Drizzle schema matching the shipped D1 migrations. |

Raw SQL migrations ship at:

node_modules/@growth-labs/monitoring/src/schemas/migrations
node_modules/@growth-labs/monitoring/dist/schemas/migrations

Prober

import { createProber } from '@growth-labs/monitoring/prober'

const prober = createProber({
	realmId: 'fulcrum-labs',
	d1Binding: 'MONITORING_DB',
	notifyConfig: {
		channels: ['slack', 'email'],
		emailProvider: 'resend',
	},
	alertingConfig: { consecutiveFailuresToOpen: 2, minSeverity: 'warning' },
	surfaces: [
		{
			name: 'fronts.co:login',
			kind: 'get',
			schedule: '*/5 * * * *',
			url: 'https://fronts.co/login/',
			assertions: { statusCode: 200, contentMarker: 'auth-eyebrow' },
			timeoutMs: 10_000,
		},
	],
})

export default { scheduled: prober.scheduledHandler }

auth-monitor must use emailProvider: 'resend' when email alerts are enabled. The monitor exists partly to detect Cloudflare auth delivery failures, so alert email must not depend on Cloudflare Email.

Tail Worker

import { createTailWorker } from '@growth-labs/monitoring/tail'

const tail = createTailWorker({
	realmId: 'fulcrum-labs',
	d1Binding: 'MONITORING_DB',
	waeBinding: 'MONITORING_ERRORS',
	notifyConfig: { channels: ['slack', 'email'], emailProvider: 'resend' },
	alertingConfig: {
		newErrorDedupWindowMs: 60 * 60 * 1000,
		rateSpikeThreshold: 10,
		rateSpikeWindowMs: 5 * 60 * 1000,
	},
	sampling: {
		exceptionsPct: 1,
		fivexxPct: 1,
		consoleErrorPct: 1,
		consoleWarnPct: 0.1,
		slowRequestsPct: 0.01,
		slowRequestThresholdMs: 1000,
	},
})

export default { tail: tail.tailHandler }

Fingerprints are computed before redaction. Every persisted error is redacted and truncated before D1/WAE writes.

Status Page

import { createStatusPageApp } from '@growth-labs/monitoring/status-page'

export default {
	integrations: [
		createStatusPageApp({
			realm: 'fulcrum-labs',
			d1Binding: 'MONITORING_DB',
			surfaces: [{ name: 'fronts.co:login' }],
		}),
	],
}

The status page is read-only. It injects / and /api/status.json by default and reads only the gl_uptime_checks, gl_uptime_incidents, and gl_errors tables.

Authenticated Browser Canary Primitives

import {
	createSyntheticTrafficIdentity,
	evaluateCanaryRun,
	videoPlaybackSurfaceSchema,
} from '@growth-labs/monitoring/canary'

const surface = videoPlaybackSurfaceSchema.parse({
	name: 'fronts:subscriber-video',
	surface: 'media.video-playback',
	runner: 'browser.playwright',
	site: 'fronts',
	environment: 'production',
	role: 'subscriber',
	targetUrl: 'https://fronts.co/video/golden-story',
	firstPartyHosts: ['fronts.co'],
	credentialBinding: 'SUBSCRIBER_CANARY_CREDENTIALS',
	selectors: {
		player: '[data-test=vidstack-player]',
		blockedMarkers: ['[data-test=paywall]'],
	},
})

const traffic = createSyntheticTrafficIdentity({
	tool: 'authenticated-browser-canary',
	version: '1.0.0',
	realm: 'fulcrum-labs',
	site: 'fronts',
	environment: 'production',
	surface: surface.surface,
	runId: crypto.randomUUID(),
})

const result = await evaluateCanaryRun(surface, {
	runId: traffic.runId,
	startedAt: Date.now(),
	finishedAt: Date.now() + 4_000,
	userAgent: traffic.userAgent,
	statusCode: 200,
	finalUrl: surface.targetUrl,
	matchedMarkers: ['[data-test=vidstack-player]'],
	blockedMarkersSeen: [],
	playerMounted: true,
	currentTimeSeconds: 3.4,
	tracks: [],
	errors: [],
	artifacts: [],
})

Package-owned scope:

• surface schemas, assertion/result evaluation, privacy-safe beacon defaults, browser error normalization, and D1 migration columns
• reusable asset.http runner plus runner interfaces for browser.puppeteer and browser.playwright

Runtime-owned scope:

• cron cadence, Browser Rendering/Playwright adapter wiring, credential provisioning, artifact storage, and alert/incident policy configuration

Canary surfaces take binding names, not secrets. Pass values like SUBSCRIBER_CANARY_CREDENTIALS or PUBLISHER_CANARY_CREDENTIALS in runtime config and let the consumer Worker resolve them. Never inline cookies, Authorization headers, magic-link URLs, session tokens, raw email contents, or full page HTML in package config or persisted artifacts.

Browser error beacons default to sampleRate: 0.1 and maxEventsPerMinute: 5 per page context. Both synthetic and real-user browser events flow through the same normalization and redaction path before persistence.