burstlib

Shared tenant values and small utilities with no independent policy authority.

The diagnostics package provides five structured log levels, text/JSON formatting, sensitive-attribute redaction, correlation IDs and a protected loopback diagnostics/pprof handler. Services must exclude payloads and credentials from log fields regardless of the formatter's redaction support.

NewID/ValidID provide shared canonical resource IDs compatible with existing records. The client package provides bounded HTTPS JSON calls with cookie-jar or mTLS authentication, CSRF/idempotency headers, cancellation, typed API errors and redirect rejection. It never retries mutations automatically.

Diagnostics includes bounded Prometheus request counters and duration summaries. The control command records requests and exposes /metrics on the protected diagnostics listener when enabled. No resource IDs, URLs or principal labels are exported. OpenTelemetry integration and generated typed SDKs are separate extensions.

Run go test -race ./...; see troubleshooting.