/**
 * Theme D — /api/metrics
 *
 * Prometheus scrape endpoint. Returns text/plain; no auth required at
 * the application layer because:
 *   - The endpoint exposes operational metrics only (counters, gauges,
 *     histograms) — no user data, no credentials.
 *   - Production deployments should put this behind network ACLs at the
 *     ingress (allow only the Prometheus scraper's source IP) rather
 *     than rely on app-level auth, which would break the standard
 *     scrape protocol.
 *
 * If the operator needs auth, set an env var and gate it via middleware.
 */
import { registry } from '@/lib/observability/metrics';

export const dynamic = 'force-dynamic';

export async function GET() {
    const body = await registry.metrics();
    return new Response(body, {
        status: 200,
        headers: {
            'Content-Type': registry.contentType,
            'Cache-Control': 'no-store',
        },
    });
}