{{- /*
ServiceMonitor — Prometheus scrape for the newapi Service (Wave 15,
PR #1674 follow-up).

Surfaces the bridge handler's `newapi_admin_token_mint_requests_total`
counter (labels {tool, status}) once the catalyst-api binary that mounts
`platform/newapi/internal/handler.SandboxToken` is rolled out behind
this Service. The dashboard panel "newapi Token Mint Requests / hour"
(platform/sandbox/chart/templates/grafana-dashboard.yaml panel #7) reads
this metric filtered by tool="sandbox-controller".

DEFAULT FALSE per docs/BLUEPRINT-AUTHORING.md §11.2 — Prometheus
Operator (monitoring.coreos.com/v1) is NOT in the bootstrap-kit prior to
slot 25 (kube-prometheus-stack), so a ServiceMonitor shipped enabled-by-
default would generate Helm install errors on a Sovereign that hasn't
reached Phase 2 yet. The `.Capabilities.APIVersions.Has` guard also
skip-renders on a cluster where the CRD has not yet reconciled — pattern
matches platform/harbor/chart/templates/servicemonitor.yaml.
*/}}
{{- if and .Values.newapi.enabled .Values.serviceMonitor.enabled (.Capabilities.APIVersions.Has "monitoring.coreos.com/v1") }}
apiVersion: monitoring.coreos.com/v1
kind: ServiceMonitor
metadata:
  name: {{ include "bp-newapi.fullname" . }}
  namespace: {{ .Release.Namespace }}
  labels:
    {{- include "bp-newapi.labels" . | nindent 4 }}
    {{- with .Values.serviceMonitor.labels }}
    {{- toYaml . | nindent 4 }}
    {{- end }}
spec:
  selector:
    matchLabels:
      {{- include "bp-newapi.selectorLabels" . | nindent 6 }}
  namespaceSelector:
    matchNames:
      - {{ .Release.Namespace }}
  endpoints:
    - port: http
      path: {{ .Values.serviceMonitor.path | default "/metrics" }}
      interval: {{ .Values.serviceMonitor.interval | default "30s" }}
      scrapeTimeout: {{ .Values.serviceMonitor.scrapeTimeout | default "10s" }}
{{- end }}
