metrics

var (

	// TunnelAgentInfo is an info metric that exports version labels. Always set to 1.
	TunnelAgentInfo = prometheus.NewGaugeVec(
		prometheus.GaugeOpts{
			Name: "tunnel_agent_info",
			Help: "Agent build information. Always 1.",
		},
		[]string{"version", "build_date", "commit"},
	)
	// TunnelAgentUptimeSeconds reports agent process uptime.
	TunnelAgentUptimeSeconds = prometheus.NewGaugeFunc(
		prometheus.GaugeOpts{
			Name: "tunnel_agent_uptime_seconds",
			Help: "Seconds since the agent process started.",
		},
		func() float64 { return time.Since(startTime).Seconds() },
	)
	// TunnelRelayRTTSeconds reports the latency to each relay the agent holds a
	// live session with: the smoothed RTT QUIC continuously measures on the
	// control connection (falling back to probe/connect time before the first
	// measurement). The series is deleted when the session ends.
	TunnelRelayRTTSeconds = prometheus.NewGaugeVec(
		prometheus.GaugeOpts{
			Name: "tunnel_relay_rtt_seconds",
			Help: "Smoothed round-trip time to the connected relay, as measured by QUIC.",
		},
		[]string{"relay"},
	)
	// TunnelRelayPacketsLost counts packets QUIC declared lost on the control
	// connection, by relay and loss reason ("timeout", "reordering", "other").
	// Loss rate is usually a better "tunnel feels slow" signal than RTT.
	TunnelRelayPacketsLost = prometheus.NewCounterVec(
		prometheus.CounterOpts{
			Name: "tunnel_relay_packets_lost_total",
			Help: "Packets declared lost by QUIC on the relay control connection.",
		},
		[]string{"relay", "reason"},
	)
	// TunnelRelayPTOs counts QUIC probe timeouts on the control connection —
	// full stalls where nothing was ACKed for a whole probe interval. A rising
	// rate means the path to that relay is dying, not just congested.
	TunnelRelayPTOs = prometheus.NewCounterVec(
		prometheus.CounterOpts{
			Name: "tunnel_relay_ptos_total",
			Help: "QUIC probe timeouts (PTO) on the relay control connection.",
		},
		[]string{"relay"},
	)
	// TunnelConnectionReconnects counts reconnection attempts across all connections.
	TunnelConnectionReconnects = prometheus.NewCounter(
		prometheus.CounterOpts{
			Name: "tunnel_connection_reconnects_total",
			Help: "Total number of tunnel reconnection attempts.",
		},
	)

	// TunnelServer metrics.
	TunnelPingRequests = prometheus.NewCounter(
		prometheus.CounterOpts{
			Name: "tunnel_ping_requests_total",
			Help: "Total number of ping requests for latency probing.",
		},
	)
	TunnelConnectionRequests = prometheus.NewCounter(
		prometheus.CounterOpts{
			Name: "tunnel_connection_requests_total",
			Help: "Total number of connection requests to the tunnel server.",
		},
	)
	TunnelConnectionsActive = prometheus.NewGauge(
		prometheus.GaugeOpts{
			Name: "tunnel_connections_active",
			Help: "Number of currently active tunnel connections.",
		},
	)
	TunnelConnectionFailures = prometheus.NewCounterVec(
		prometheus.CounterOpts{
			Name: "tunnel_connection_failures_total",
			Help: "Total number of failed connection attempts.",
		},
		[]string{"reason"},
	)
	TunnelNodesManaged = prometheus.NewGauge(
		prometheus.GaugeOpts{
			Name: "tunnel_nodes_managed_total",
			Help: "Number of currently managed tunnel nodes.",
		},
	)

	// MuxedConn metrics.
	TunnelPacketsSent = prometheus.NewCounter(
		prometheus.CounterOpts{
			Name: "tunnel_packets_sent_total",
			Help: "Total number of packets sent through the tunnel.",
		},
	)
	TunnelBytesSent = prometheus.NewCounter(
		prometheus.CounterOpts{
			Name: "tunnel_bytes_sent_total",
			Help: "Total number of bytes sent through the tunnel.",
		},
	)
	// TunnelPacketsSentErrors tracks packet send errors with labels.
	// Common error_type values: "invalid_ip", "no_tunnel", "invalid_connection_type", "write_error"
	TunnelPacketsSentErrors = prometheus.NewCounterVec(
		prometheus.CounterOpts{
			Name: "tunnel_packets_sent_errors_total",
			Help: "Total number of packets sent through the tunnel with errors.",
		},
		[]string{"error_type"},
	)
	TunnelPacketsReceived = prometheus.NewCounter(
		prometheus.CounterOpts{
			Name: "tunnel_packets_received_total",
			Help: "Total number of packets received from the tunnel.",
		},
	)
	TunnelBytesReceived = prometheus.NewCounter(
		prometheus.CounterOpts{
			Name: "tunnel_bytes_received_total",
			Help: "Total number of bytes received from the tunnel.",
		},
	)
	// TunnelPacketsReceivedErrors tracks packet receive errors with labels.
	// Common error_type values: "read_error", "connection_closed"
	TunnelPacketsReceivedErrors = prometheus.NewCounterVec(
		prometheus.CounterOpts{
			Name: "tunnel_packets_received_errors_total",
			Help: "Total number of packets received from the tunnel with errors.",
		},
		[]string{"error_type"},
	)
	// TunnelPacketsDropped tracks packets that were dropped.
	// Common reason values: "channel_full", "channel_closed"
	TunnelPacketsDropped = prometheus.NewCounterVec(
		prometheus.CounterOpts{
			Name: "tunnel_packets_dropped_total",
			Help: "Total number of packets dropped by the tunnel.",
		},
		[]string{"reason"},
	)

	// Per-protocol packet and byte counters.
	// Protocol values: "tcp", "udp", "icmp", "other".
	// Direction values: "tx", "rx".
	TunnelPacketsByProtocol = prometheus.NewCounterVec(
		prometheus.CounterOpts{
			Name: "tunnel_packets_by_protocol_total",
			Help: "Total packets broken down by IP protocol and direction.",
		},
		[]string{"protocol", "direction"},
	)
	TunnelBytesByProtocol = prometheus.NewCounterVec(
		prometheus.CounterOpts{
			Name: "tunnel_bytes_by_protocol_total",
			Help: "Total bytes broken down by IP protocol and direction.",
		},
		[]string{"protocol", "direction"},
	)

	// TunnelConnectIPICMPReturned counts ICMP packets that CONNECT-IP
	// synthesized in response to an outbound-write failure (notably the QUIC
	// DatagramTooLargeError path that emits an ICMPv6 Packet-Too-Big back at
	// the sender for PMTUD). Cross-reference with tunnel_icmp6_packet_too_big_*
	// to detect PTB generation vs. propagation issues.
	// TODO(APO-543): remove once PMTUD-over-tunnel is verified healthy.
	TunnelConnectIPICMPReturned = prometheus.NewCounter(
		prometheus.CounterOpts{
			Name: "tunnel_connect_ip_icmp_returned_total",
			Help: "ICMP packets synthesized by connect-ip-go on WritePacket failure (e.g. QUIC DatagramTooLargeError → ICMPv6 PTB).",
		},
	)
)