REFERENCE
Every package, one row each
49 packages, grouped by where they sit in a request. Each one opens on its own page: what it does, where it sits, and every public declaration with the sentence its author wrote for it.
REFERENCE
49 packages, grouped by where they sit in a request. Each one opens on its own page: what it does, where it sits, and every public declaration with the sentence its author wrote for it.
EDGE
serviceEDGEServiceConf (typed config: name, host, port, timeout, log level) + Server tie the application and a middleware onion into one runnable ASGI application; logging is a built-in layer.
middlewareEDGEThe onion layers that wrap the app: recovery (500 instead of a panic), cors (Access-Control-* headers), and request_id (x-request-id per request).
groupEDGEGroup registers a set of routes under a shared path prefix, so related endpoints are declared without repeating the prefix.
routeEDGEThe settings a route carries into its own registration: a JWT with a rotation window, a signature verifier, a deadline, a body cap, the priority shedder, a prefix and server-sent events. Each is a field of RouteOptions and a hoop on the route.
hoopsEDGEOne hoop per option that can refuse a request, applied where the route is registered: the token, the signature, the declared body length, the deadline enforced by racing the handler, the shedder's ticket, and the event-stream headers.
filesEDGEA file-serving layer over an in-memory set: a GET under a prefix whose remaining path names a registered file is answered with it, with a content-derived ETag and a 304 for a conditional request. The bytes live in a value, so a test serves a file it built and a deployment loads a directory once.
mountEDGERead every regular file under a directory into the set files serves, keyed by its path relative to that directory: one call at start-up turns a build output, a fixture tree or a directory of assets into a mount.
gunzipEDGERead a Content-Encoding: gzip body, inflate it, and hand the application the plain bytes, with an optional cap on the inflated size so a compression bomb stops at the limit rather than in memory.
signatureEDGEThe X-Content-Security request signature: an RSA-sealed envelope carrying the MAC key, the time and the payload type; a MAC over the timestamp, method, path, query and body digest; a tolerance on the timestamp; and an AES-ECB payload when the envelope says the body is sealed.
rsaEDGEThe RSA decrypter a content-security key set is built from: raw RSA private operation, PKCS#1 v1.5 unpadding, and a PEM or DER reader that is a pure function of the text.
jwtEDGEbase64url plus compact-JWT signing and verification under HS256: jwt_sign / jwt_verify check the signature in constant time and enforce exp/nbf, rejecting the alg:none downgrade.
authEDGEThe auth middleware requires every HTTP request to carry a valid Authorization: Bearer <jwt>, rejecting absent/malformed/tampered/expired tokens with 401 before the app runs.
metricsEDGETwo Prometheus families over the process registry: a duration histogram and a code counter, labelled path, method and code — three labels, so a dashboard can select on any one of them.
tracingEDGEA server span per request, joined to the trace the request arrived with and written to whatever sink the tracer was built over, plus the convenience x-trace-id header next to the standard traceparent.
CONTROL
configCONTROLParse a JSON or YAML config string into a ServiceConf: a strict derived FromJson path plus lenient ServiceConf::from_json / from_yaml loaders that fill omitted fields from the new() defaults, so a document may name only what it changes.
engineCONTROLRestEngine reads a RestConf and assembles one ASGI application: it builds the clock, the metrics, the connection budget, the breaker, the shaper, the tracer and the span recorder the middlewares run on, installs the layers the config asked for in a fixed order, and keeps the spans so a test can read a trace without a collector.
confCONTROLThe canonical config-key form: lowercased, _ and - dropped, so MaxBytes, maxBytes, max_bytes and max-bytes all name one field and a config document written in any of them loads unchanged.
restconfCONTROLWhich built-in layers the engine installs (MiddlewaresConf), every flag on by default, so an etc/*.yaml that says nothing about middleware still gets the whole chain.
logxCONTROLStructured logging over moonlog's sink: the four level names an etc/*.yaml carries, the @timestamp / content keys a collector indexes, the WithDuration view, and a logger whose level and destination move at runtime.
loggingCONTROLRequestLog captures typed access-log fields (method, path, status, duration, request-id, client-ip, user-agent) and renders one JSON line per request; the structured_logging middleware emits it, timed on the clock.
refusalCONTROLWhat a request refused by a middleware receives: 503 for an open breaker, a spent connection budget or a passed deadline, 429 for a rate limit, 413 for a body too large. Each is a parameter.
clockCONTROLA millisecond time source injected into the resilience middlewares so their timing is a pure function of an explicit clock; ManualClock drives them deterministically in tests.
shutdownCONTROLA ShutdownCoordinator that drains in-flight zRPC calls: dispatch_graceful counts each call for its duration, initiate_shutdown makes new calls come back Unavailable while in-flight ones finish, and is_drained reports when the last one has completed.
telemetryCONTROLThe tracer a service runs on when nobody configured one: ids from the platform entropy source, spans to a caller-named sink, and every request sampled.
RESILIENCE
breakerRESILIENCEThe Google SRE client-side throttling breaker over moonward's: it reads the last ten seconds of outcomes and sheds a computed fraction of calls rather than opening, and the breaker middleware answers 503 for a shed one.
shedderRESILIENCEThe adaptive shedder over moonward's, wired from RestConf.CpuThreshold: while the CPU is above the threshold, or was within the last second, it sheds once more requests are in flight than recent throughput and latency can carry.
ratelimitRESILIENCEA token-bucket limiter over moonward's bucket, on the millisecond clock, and the rate_limit middleware, which answers 429 when it is empty.
limitsRESILIENCEThe timeout middleware, which starts a moonward Deadline per request and enforces it on the response path (preemptive cancel is the async boundary), and maxbytes, which rejects an over-limit Content-Length with 413.
limitingRESILIENCEThe concurrency limiter that sheds load past a ceiling — releasing its permit with defer, so cancellation cannot wedge it shut — and the period limiter that counts requests per window.
ROUTING
rpcROUTINGAn RpcServer (config-driven) registers moonrpc Method handlers by gRPC path and dispatches unary calls, returning Unimplemented for unknown methods; RpcGroup registers a set of methods under one package.Service.
zrpcROUTINGRpcServer::to_h2 exposes the registered handlers as a moonrpc H2Server, and RpcChannel drives real unary, server/client-streaming, and bidirectional calls over that transport: HPACK-coded HEADERS, length-prefixed DATA frames, and the grpc-status trailer read back off the reply. A BidiCall keeps the stream open both ways — send returns the replies produced right then, close_send runs the server's on_end and reports the final grpc-status.
socketROUTINGA Listener puts an RpcServer on TCP with the same handler table and the same interceptor chain the in-process transport runs; port 0 asks the system for a free one and bind answers the number it picked, so a test connects to the port that exists rather than to a number it chose. A SocketChannel multiplexes calls as HTTP/2 streams over one connection and speaks h2c to any gRPC peer.
balanceROUTINGBalancers over moonpool's RoundRobin and Weighted, and a LoadBalancedChannel that resolves a service through the Resolve interface, picks an instance, and dials it over the h2c transport. Registries come from moonsd and the clients that implement it; a View of moonsd's is what a program resolves through.
discovROUTINGA moonsd Discovery over a file: publish writes what a memory registry holds, FileDiscovery resolves from it and watches it through moonbitlang/async's fs.
p2cROUTINGChoose two instances at random and take the less loaded: sqrt(lag + 1) * (inflight + 1), with the lag and success counts moving averages that decay over ten seconds and a one-second window after which an unpicked instance is forced.
interceptorROUTINGOne shape for both halves of the wire: an invoker turns a call into a result, an interceptor wraps an invoker, and the transport is the innermost one.
clientinterceptorsROUTINGTracing, the duration log, the Prometheus families, the breaker and the deadline — the five layers a call passes on its way out.
serverinterceptorsROUTINGAuthentication, tracing, recovery, the stat log, the Prometheus families, the breaker, shedding and the deadline — the eight layers a call passes on its way in, with authentication outermost so a refused peer cannot push the breaker open.
rpcconfROUTINGThe server and client blocks: the timeout, both CPU thresholds, authentication, and one flag per interceptor, all loading from a config document with their defaults.
DATA
cacheDATARead through a store, run the loader once per key however many callers arrive, and write the answer back with a jittered lifetime. An absent value is not cached.
sqlDATAStatements, rows, single values and transactions over a database driver the caller supplies; a transaction commits when its body returns and rolls back when it raises.
redisDATAThe same Store contract the memory store implements, over a redis client and a key prefix, so a cache moves from one process to a fleet by changing the value passed in — plus the counter and expiry operations a cache does not use.
collectionDATAA cache with a size limit and an optional expiry over a doubly linked recency list, so a hit is constant work, and a fixed-size ring that keeps the newest samples.
syncxDATAA second caller asking for a key while the first is still running waits for that answer instead of issuing a second call, and every one of them receives the same result or the same failure.
mrDATAA mapper that sees one item and emits any number of values, a finish step for the aggregate that only makes sense at the end, and a reducer over everything emitted — sequentially or across tasks, with the parallel run emitting in input order.
fxDATACall a body until it stops raising, with a predicate that stops the ladder early for a failure that will not change; the same over a backoff; and a deadline that tells a slow answer (None) from a wrong one (an error).
threadingDATAA fan-out group that is collected first and joined at wait, a queue drained by one consumer for work that must not run on the request's own task, and a queue that keeps only the newest pending item so a burst collapses to its last value.
servicesDATAA group whose members share one lifetime: every service is a task that runs until it returns or is cancelled, so a failure cancels the rest instead of leaving half a process running.
onceDATAA body that runs at most once, for the initialisation that must not happen twice, and a pool that builds its objects on the first take and hands them back.