Add Duration-type metric param: elapsed time since previous same-label match (ticket 023)

MetricPrimitiveKind::Duration/MetricPrimitive::Duration(i64 ms) is a
new primitive kind. On a metric's Value-role param (ticket 022), kind
Duration is special-cased in apply_metric_to_log: instead of parsing
the captured text, the value is derived as elapsed time since the
previous counter event with the same label set, using the ingestion
timestamp. That "previous event" lookup is tracked via a new
IndexKey::LastMetricEvent/DataValue::LastEventTimestamp bookkeeping
entry rather than Bucket.values itself, because a label set's first
occurrence has nothing to diff against and pushes no Bucket entry at
all (per spec: omit, don't emit a bogus zero) — but it still needs to
be recorded so the *next* occurrence has something to diff against.

Duration values compose with the existing bucket/PromQL surface
unchanged (coerce_to_f64, filter comparisons, histogram()/gauge()).
On any other param (Label-role metric param, or a standalone
ParamDeclaration), Duration kind instead parses captured text as a
literal i64 millisecond count, same as Number. Profile round-trip
(ProfileMetricPrimitiveKind) and the Metrics.tsx declaration form are
updated to match.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XFUNZwCvz3kcod3352ZR2o

src/engine.rs

@@ -266,6 +266,12 @@ fn parse_metric_primitive(raw: &str, kind: MetricPrimitiveKind) -> Option<Metric
                 .ok()
                 .map(MetricPrimitive::Timestamp)
         }
+        // A `Value`-role param never reaches this branch (see
+        // `apply_metric_to_log`, which derives its value from elapsed time
+        // instead of parsing captured text). Reached only for a `Label`-role
+        // metric param or a standalone `ParamDeclaration` of kind `Duration`,
+        // where the captured text is parsed as a literal millisecond count.
+        MetricPrimitiveKind::Duration => raw.parse::<i64>().ok().map(MetricPrimitive::Duration),
     }
 }
 
@@ -286,6 +292,18 @@ fn parse_metric_primitive(raw: &str, kind: MetricPrimitiveKind) -> Option<Metric
 /// capture group doesn't match, or its captured text fails to parse as its
 /// declared `kind`, the whole match is skipped for this line rather than
 /// storing a partially-labeled bucket.
+///
+/// A `Value`-role param of kind `Duration` (ticket 023) is a special case: its
+/// value isn't parsed from captured text at all. It's derived as the elapsed
+/// time (using this event's ingestion `timestamp`) since the *previous*
+/// counter event with this exact label set, tracked independently via
+/// `IndexKey::LastMetricEvent` (not `Bucket.values` itself, since — see
+/// below — a `Bucket` entry isn't always pushed). On the first occurrence of
+/// a given label set there is no previous event to diff against, so — per the
+/// ticket's "omit rather than emit a bogus zero" requirement — no `Bucket`
+/// entry is pushed for that occurrence at all, rather than a zero/placeholder
+/// duration; the occurrence is still recorded in `LastMetricEvent` so the
+/// *next* occurrence of that label set has something to diff against.
 fn apply_metric_to_log(
     index: &mut BTreeMap<IndexKey, DataValue>,
     metric_name: &str,
@@ -301,10 +319,15 @@ fn apply_metric_to_log(
 
     let mut labels = BTreeMap::new();
     let mut value = None;
+    let mut is_duration = false;
     for matcher in params {
         let Some(raw) = captures.name(&matcher.capture_group) else {
             return;
         };
+        if matcher.role == ParamRole::Value && matcher.kind == MetricPrimitiveKind::Duration {
+            is_duration = true;
+            continue;
+        }
         let Some(parsed) = parse_metric_primitive(raw.as_str(), matcher.kind) else {
             return;
         };
@@ -318,12 +341,37 @@ fn apply_metric_to_log(
         }
     }
 
+    let value = if is_duration {
+        // Bookkeeping key is separate from the `Bucket` key below: a
+        // `Duration` value's first occurrence for this label set pushes no
+        // `Bucket` entry (nothing to diff against), so the "last event"
+        // timestamp can't live inside `Bucket.values` — it has to be tracked
+        // independently so the *next* occurrence still has something to
+        // diff against.
+        let last_event_key =
+            IndexKey::LastMetricEvent { metric_name: metric_name.to_string(), labels: labels.clone() };
+        let previous_timestamp = match index.get(&last_event_key) {
+            Some(DataValue::LastEventTimestamp { timestamp: previous }) => Some(*previous),
+            _ => None,
+        };
+        index.insert(last_event_key, DataValue::LastEventTimestamp { timestamp });
+        match previous_timestamp {
+            Some(previous) => {
+                MetricPrimitive::Duration(timestamp.as_millis() - previous.as_millis())
+            }
+            None => return,
+        }
+    } else {
+        value.unwrap_or(MetricPrimitive::Number(Number::Int(1)))
+    };
+
     let key = IndexKey::Bucket { metric_name: metric_name.to_string(), labels };
+
     let entry = index
         .entry(key)
         .or_insert_with(|| DataValue::BucketValue { values: Vec::new() });
     if let DataValue::BucketValue { values } = entry {
-        values.push((sequence, timestamp, value.unwrap_or(MetricPrimitive::Number(Number::Int(1)))));
+        values.push((sequence, timestamp, value));
     }
 }
 
@@ -580,6 +628,13 @@ fn compare_metric_primitive(
         (MetricPrimitive::String(s), FilterValue::Number(n)) => {
             s.as_str().partial_cmp(n.to_string().as_str())
         }
+        (MetricPrimitive::Duration(ms), FilterValue::Number(v)) => (*ms as f64).partial_cmp(v),
+        (MetricPrimitive::Duration(ms), FilterValue::Raw(raw)) => {
+            let v: f64 = raw
+                .parse()
+                .map_err(|_| format!("expected a numeric value, got {raw:?}"))?;
+            (*ms as f64).partial_cmp(&v)
+        }
     };
     Ok(ordering.is_some_and(|ordering| apply_compare_op(ordering, op)))
 }
@@ -899,6 +954,7 @@ fn coerce_to_f64(value: &MetricPrimitive) -> f64 {
             Number::Float(v) => *v,
         },
         MetricPrimitive::Timestamp(ts) => ts.as_millis() as f64,
+        MetricPrimitive::Duration(ms) => *ms as f64,
         MetricPrimitive::String(_) => 1.0,
     }
 }
@@ -1653,6 +1709,72 @@ mod tests {
         assert_eq!(series[2].points[0].1, 1.0);
     }
 
+    fn declare_login_duration_metric(index: &mut BTreeMap<IndexKey, DataValue>) {
+        declare_metric(
+            index,
+            metric_request_with_roles(
+                "login_gap",
+                r"user=(?P<user>\S+) logged in",
+                vec![
+                    ("user", "user", MetricPrimitiveKind::String, ParamRole::Label),
+                    ("gap", "user", MetricPrimitiveKind::Duration, ParamRole::Value),
+                ],
+            ),
+        )
+        .unwrap();
+    }
+
+    #[test]
+    fn duration_value_param_computes_elapsed_time_since_previous_same_labels_event() {
+        let mut index = BTreeMap::new();
+        declare_login_duration_metric(&mut index);
+
+        ingest_log(&mut index, 0, "user=alice logged in");
+        ingest_log(&mut index, 1, "user=bob logged in");
+        ingest_log(&mut index, 2, "user=alice logged in");
+
+        let values: Vec<_> = bucket_values(&index, "login_gap", None).collect();
+        // First occurrences (alice@0, bob@1) produce no duration value at all —
+        // only alice's second occurrence (sequence 2) has a previous event to
+        // diff against.
+        assert_eq!(values.len(), 1);
+        let (labels, (sequence, timestamp, value)) = &values[0];
+        assert_eq!(labels.get("user").map(|v| v.to_string()), Some("alice".to_string()));
+        assert_eq!(*sequence, 2);
+        // `ingest_log`'s helper timestamps by `sequence as millis`.
+        assert_eq!(timestamp.as_millis(), 2);
+        assert_eq!(*value, MetricPrimitive::Duration(2));
+    }
+
+    #[test]
+    fn duration_diffs_against_the_immediately_preceding_event_not_the_first() {
+        let mut index = BTreeMap::new();
+        declare_login_duration_metric(&mut index);
+
+        ingest_log(&mut index, 0, "user=alice logged in");
+        ingest_log(&mut index, 3, "user=alice logged in");
+        ingest_log(&mut index, 9, "user=alice logged in");
+
+        let values: Vec<_> = bucket_values(&index, "login_gap", None).collect();
+        assert_eq!(values.len(), 2);
+        assert_eq!(values[0].1.2, MetricPrimitive::Duration(3));
+        assert_eq!(values[1].1.2, MetricPrimitive::Duration(6));
+    }
+
+    #[test]
+    fn duration_values_are_queryable_via_promql_like_any_other_metric() {
+        let mut index = BTreeMap::new();
+        declare_login_duration_metric(&mut index);
+        ingest_log(&mut index, 0, "user=alice logged in");
+        ingest_log(&mut index, 10, "user=alice logged in");
+
+        let parsed = promql::parse_query("login_gap").unwrap();
+        let series = evaluate_promql(&index, &parsed, None, None);
+
+        assert_eq!(series.len(), 1);
+        assert_eq!(series[0].points, vec![(10, 10.0)]);
+    }
+
     #[test]
     fn handle_query_promql_rejects_malformed_query() {
         let index = BTreeMap::new();