@aywengo/mercury-fleet 0.0.1-bootstrap

package/dist/metrics.js

@@ -0,0 +1,226 @@
+/**
+ * Metrics rollup (docs/fleet-design.md section 12, Phase 6): scrape every child's `/metrics`, merge, serve one
+ * Prometheus endpoint.
+ *
+ * Two decisions worth stating, because both were tempting to get wrong:
+ *
+ * **Series are relabelled, not summed.** Summing across hosts would destroy the per-host view, which is the
+ * entire reason to run a fleet, and would be actively wrong for some series -- summing a gauge of lease
+ * timestamps or a per-status count across heterogeneous hosts produces a number that means nothing. Instead
+ * every series gains `host="<hostId>"` and Prometheus aggregates with `sum by (...)` at query time, which is
+ * what it is good at and what keeps the choice reversible.
+ *
+ * **A scrape failure is data, not an exception.** One unreachable child must not blank the fleet dashboard, so
+ * the rollup always renders whatever came back and publishes `mercury_fleet_scrape_success` per host. Without
+ * that gauge a host vanishing from the output is indistinguishable from a host with nothing to report.
+ */
+/** The label Fleet adds to every scraped series. */
+export const HOST_LABEL = 'host';
+/**
+ * Parse the Prometheus text exposition format into families.
+ *
+ * Deliberately strict about what it does not understand: an unrecognised line is reported rather than skipped,
+ * because silently dropping a metric family is how a rollup ends up quietly under-reporting.
+ */
+export function parseExposition(text) {
+    const families = [];
+    const unparsed = [];
+    const byName = new Map();
+    let pendingHelp = null;
+    let pendingType = null;
+    const family = (name) => {
+        let f = byName.get(name);
+        if (!f) {
+            f = { name, help: null, type: null, samples: [] };
+            byName.set(name, f);
+            families.push(f);
+        }
+        return f;
+    };
+    for (const raw of text.split('\n')) {
+        const line = raw.trimEnd();
+        if (line === '')
+            continue;
+        if (line.startsWith('#')) {
+            const m = /^#\s*(HELP|TYPE)\s+(\S+)\s*(.*)$/.exec(line);
+            if (!m) {
+                // A comment we do not recognise (a `# UNIT`, a human note). Not a violation, but not silently eaten.
+                unparsed.push(line);
+                continue;
+            }
+            const [, kind, name, rest] = m;
+            if (kind === 'HELP') {
+                pendingHelp = rest;
+                family(name).help = rest;
+            }
+            else {
+                pendingType = rest;
+                family(name).type = rest;
+            }
+            continue;
+        }
+        // Sample line: name{labels} value [timestamp]
+        // Metric names allow ':' as well as word characters -- recording rules produce names like
+        // `job:mercury_runs:rate5m`, and a regex restricted to \w would report those as unparsed and drop a valid
+        // family out of the rollup.
+        const m = /^([a-zA-Z_:][a-zA-Z0-9_:]*)(?:\{([^}]*)\})?\s+(-?[0-9eE+._infNaNinf]+)(?:\s+\S+)?\s*$/.exec(line);
+        if (!m) {
+            unparsed.push(line);
+            continue;
+        }
+        const [, name, labelText] = m;
+        // A histogram bucket carries `le`, a summary carries `quantile`; the family is the name without the suffix.
+        const base = name.replace(/_(bucket|sum|count)$/, '');
+        const f = family(base);
+        if (f.help === null && pendingHelp !== null)
+            f.help = pendingHelp;
+        if (f.type === null && pendingType !== null)
+            f.type = pendingType;
+        f.samples.push({ name, labels: parseLabels(labelText ?? ''), value: m[3] });
+    }
+    return { families, unparsed };
+}
+/**
+ * Split a label list. Handles escaped quotes inside values, because a label value containing a quote is exactly
+ * what a hostile or merely unlucky metric can produce.
+ */
+export function parseLabels(text) {
+    const out = [];
+    let i = 0;
+    while (i < text.length) {
+        while (i < text.length && (text[i] === ',' || text[i] === ' '))
+            i++;
+        const eq = text.indexOf('=', i);
+        if (eq === -1)
+            break;
+        const key = text.slice(i, eq).trim();
+        if (text[eq + 1] !== '"')
+            break;
+        let j = eq + 2;
+        let value = '';
+        while (j < text.length) {
+            const ch = text[j];
+            if (ch === '\\' && j + 1 < text.length) {
+                value += text[j + 1];
+                j += 2;
+                continue;
+            }
+            if (ch === '"') {
+                j++;
+                break;
+            }
+            value += ch;
+            j++;
+        }
+        if (key)
+            out.push([key, value]);
+        i = j;
+    }
+    return out;
+}
+function escapeValue(v) {
+    return v.replace(/\\/g, '\\\\').replace(/"/g, '\\"').replace(/\n/g, '\\n');
+}
+function renderLabels(labels) {
+    if (labels.length === 0)
+        return '';
+    const sorted = [...labels].sort(([a], [b]) => (a < b ? -1 : 1));
+    return '{' + sorted.map(([k, v]) => `${k}="${escapeValue(v)}"`).join(',') + '}';
+}
+/**
+ * Merge scrapes into one exposition.
+ *
+ * Pure, and returns the unparsed lines rather than logging them, so a test can assert on exactly what was
+ * dropped and why. A rollup that quietly loses a family is worse than one that fails loudly.
+ */
+export function mergeRollup(results) {
+    const dropped = [];
+    // Family order follows first-seen order across hosts, and HELP/TYPE are emitted once no matter how many
+    // children declared them -- duplicate TYPE lines make the whole scrape invalid to Prometheus.
+    const order = [];
+    const merged = new Map();
+    const slot = (name) => {
+        let s = merged.get(name);
+        if (!s) {
+            s = { help: null, type: null, lines: [] };
+            merged.set(name, s);
+            order.push(name);
+        }
+        return s;
+    };
+    for (const scrape of results) {
+        const success = slot('mercury_fleet_scrape_success');
+        success.help ??= 'Whether Fleet could scrape this host (1) or not (0).';
+        success.type ??= 'gauge';
+        success.lines.push(`${HOST_LABEL}_placeholder`); // replaced below; keeps ordering simple
+        if (scrape.text === null) {
+            dropped.push(`${scrape.hostId}: ${scrape.reason ?? 'scrape failed'}`);
+            continue;
+        }
+        const { families, unparsed } = parseExposition(scrape.text);
+        for (const line of unparsed)
+            dropped.push(`${scrape.hostId}: unparsed line ${JSON.stringify(line)}`);
+        for (const f of families) {
+            const s = slot(f.name);
+            if (s.help === null && f.help !== null)
+                s.help = f.help;
+            if (s.type === null && f.type !== null)
+                s.type = f.type;
+            else if (s.type !== null && f.type !== null && s.type !== f.type) {
+                // Two children disagreeing about a type cannot both be honoured: the first wins and the disagreement is
+                // reported, because a silent mismatch makes one host's series unreadable in a way nobody notices.
+                dropped.push(`${scrape.hostId}: TYPE mismatch for ${f.name} (${s.type} kept, ${f.type} ignored)`);
+            }
+            for (const sample of f.samples) {
+                const keys = new Set(sample.labels.map(([k]) => k));
+                if (keys.size !== sample.labels.length) {
+                    // A child emitting `t{a="1",a="2"}` produces text Prometheus rejects outright, and it rejects the
+                    // whole scrape rather than the one line. Same reasoning as the host-label guard below: one malformed
+                    // series must not take the fleet endpoint down.
+                    dropped.push(`${scrape.hostId}: series ${sample.name} has duplicate label keys; skipped`);
+                    continue;
+                }
+                if (sample.labels.some(([k]) => k === HOST_LABEL)) {
+                    // Defensive: Mercury never labels a series `host` today. If a child ever does, emitting two labels
+                    // with the same name produces text Prometheus rejects outright, so dropping one with a report beats
+                    // poisoning the whole endpoint.
+                    dropped.push(`${scrape.hostId}: series ${sample.name} already carries a ${HOST_LABEL} label; skipped`);
+                    continue;
+                }
+                s.lines.push(`${sample.name}${renderLabels([...sample.labels, [HOST_LABEL, scrape.hostId]])} ${sample.value}`);
+            }
+        }
+    }
+    const out = [];
+    for (const name of order) {
+        const s = merged.get(name);
+        if (s.help !== null)
+            out.push(`# HELP ${name} ${s.help}`);
+        if (s.type !== null)
+            out.push(`# TYPE ${name} ${s.type}`);
+        if (name === 'mercury_fleet_scrape_success') {
+            for (const scrape of results) {
+                out.push(`mercury_fleet_scrape_success${renderLabels([[HOST_LABEL, scrape.hostId]])} ${scrape.text === null ? 0 : 1}`);
+            }
+            continue;
+        }
+        out.push(...s.lines.filter((l) => l !== `${HOST_LABEL}_placeholder`));
+    }
+    return { text: out.join('\n') + '\n', dropped };
+}
+/** Scrape every named host in parallel. Each scrape is independently bounded by the child client's timeout. */
+export async function scrapeAll(deps, hostIds) {
+    return Promise.all(hostIds.map(async (hostId) => {
+        const host = deps.registry.get(hostId);
+        if (!host)
+            return { hostId, text: null, reason: 'not in the registry' };
+        const token = deps.resolveToken(host.credentialRef);
+        if (!token)
+            return { hostId, text: null, reason: 'credential unavailable' };
+        const res = await deps.child.getMetrics({ baseUrl: host.baseUrl, token });
+        if (res.kind !== 'ok') {
+            return { hostId, text: null, reason: res.kind === 'rejected' ? `child answered ${res.status}` : res.reason };
+        }
+        return { hostId, text: res.value, reason: null };
+    }));
+}

package/dist/probe.js

@@ -0,0 +1,224 @@
+/**
+ * Probe one Mercury host over HTTP.
+ *
+ * Three endpoints, each answering a different question, and the outcomes are kept separate on purpose:
+ *
+ *   GET /healthz          is anything there, and is it Mercury?          (public, no credential)
+ *   GET /healthz/workers  is it actually serving work?                    (public, no credential)
+ *   GET /api/agents       is our credential good, and what can it run?    (requires credential)
+ *
+ * Collapsing these into "down" is the mistake the design calls out in section 7: a host that refuses our
+ * token, a host whose worker is not running, and a host that is unplugged all need different fixes, and a
+ * single status string would send the operator to the wrong one.
+ */
+/**
+ * Strip terminal control sequences from text a CHILD produced.
+ *
+ * Fleet's trust boundary is HTTP: it may be pointed at a Mercury it did not build, and any child it can
+ * reach can answer with arbitrary JSON. Without this, a hostile or compromised child returns
+ * `{"error": "\u001b]0;pwned\u0007..."}` from /healthz/workers and writes raw escapes into the operator's
+ * terminal -- enough to set the window title, clear the screen, or print a line that looks like Fleet's own
+ * output. Verified against a live fake before this function existed.
+ *
+ * Applied where child text enters the system rather than at each print site, so a future command cannot
+ * forget to sanitize. Control characters are removed rather than escaped: `detail` is a single-line
+ * diagnostic, and a newline is exactly how a child would forge a second one.
+ */
+export function stripTerminalControls(raw) {
+    return raw
+        .replace(/\u001b\][^\u0007\u001b]*(?:\u0007|\u001b\\)/g, '') // OSC ... BEL or ST
+        .replace(/\u001b\[[0-9;?]*[ -/]*[@-~]/g, '') // CSI ... final byte
+        .replace(/[\u0000-\u001f\u007f]/g, ''); // remaining C0 (incl. CR/LF/TAB) and DEL
+}
+/**
+ * One HTTP call with a hard deadline.
+ *
+ * The timeout is per request rather than per probe: a host that answers /healthz instantly and then hangs on
+ * /api/agents must still report what /healthz told us, and must not hold the sweep open for three times the
+ * timeout.
+ */
+async function call(fetchImpl, url, token, timeoutMs) {
+    const headers = { accept: 'application/json' };
+    if (token)
+        headers.authorization = `Bearer ${token}`;
+    let res;
+    try {
+        res = await fetchImpl(url, { method: 'GET', headers, signal: AbortSignal.timeout(timeoutMs) });
+    }
+    catch (err) {
+        const e = err;
+        // AbortSignal.timeout surfaces as TimeoutError; a plain abort would be named AbortError. Naming the
+        // difference matters in the report: a slow host and a refused host are different problems.
+        const timedOut = e.name === 'TimeoutError' || e.name === 'AbortError';
+        return { status: 0, json: null, transportError: e, timedOut };
+    }
+    let json = null;
+    try {
+        json = await res.json();
+    }
+    catch {
+        // Non-JSON body. Left null so the caller can report the status, which is the useful part.
+    }
+    return { status: res.status, json, transportError: null, timedOut: false };
+}
+function describeTransportError(err) {
+    const cause = err.cause;
+    if (cause?.code)
+        return `${cause.code}`;
+    return err.message.slice(0, 200);
+}
+/** Probe a host. Never throws: every failure mode becomes a classified outcome, because a sweep must
+ * report on all hosts rather than abort on the first bad one. */
+export async function probeHost(target, fetchImpl = fetch) {
+    const base = target.baseUrl;
+    const empty = {
+        outcome: 'unreachable',
+        detail: null,
+        activeRuns: null,
+        queueDepth: null,
+        workerCount: null,
+        workerId: null,
+        agents: null,
+        lastError: null,
+    };
+    // 1) Liveness. Nothing else is meaningful until we know something is listening.
+    const health = await call(fetchImpl, `${base}/healthz`, null, target.timeoutMs);
+    if (health.transportError) {
+        return {
+            ...empty,
+            outcome: health.timedOut ? 'timeout' : 'unreachable',
+            detail: health.timedOut
+                ? `no response within ${target.timeoutMs} ms`
+                : describeTransportError(health.transportError),
+            lastError: health.transportError.message.slice(0, 300),
+        };
+    }
+    if (health.status === 404) {
+        return {
+            ...empty,
+            outcome: 'not_mercury',
+            detail: 'answered but has no /healthz, so this is not a Mercury API',
+            lastError: `HTTP 404 from ${base}/healthz`,
+        };
+    }
+    if (health.status < 200 || health.status >= 300) {
+        return {
+            ...empty,
+            outcome: 'http_error',
+            detail: `HTTP ${health.status} from /healthz`,
+            lastError: `HTTP ${health.status} from ${base}/healthz`,
+        };
+    }
+    // 2) Serving. /healthz proves the API process; this proves a worker is claiming work.
+    const workers = await call(fetchImpl, `${base}/healthz/workers`, null, target.timeoutMs);
+    let activeRuns = null;
+    let queueDepth = null;
+    let workerCount = null;
+    let workerId = null;
+    let notServingDetail = null;
+    let capacityUnknown = null;
+    if (workers.transportError) {
+        return {
+            ...empty,
+            outcome: workers.timedOut ? 'timeout' : 'unreachable',
+            detail: `/healthz answered but /healthz/workers failed: ${describeTransportError(workers.transportError)}`,
+            lastError: workers.transportError.message.slice(0, 300),
+        };
+    }
+    if (workers.status === 503) {
+        // Reachable and serving HTTP, but no queue wired up: this Mercury cannot execute anything. Distinct
+        // from unreachable because the fix is operator-side configuration, not a network or host problem.
+        notServingDetail = stripTerminalControls(workers.json?.error ?? 'queue not configured');
+    }
+    else if (workers.status === 404) {
+        // An older Mercury that predates the endpoint. It is still perfectly dispatchable, so this is NOT
+        // not_serving: that outcome means "cannot execute anything", and claiming it here would take a healthy
+        // host out of rotation because of a missing telemetry route.
+        capacityUnknown = 'no /healthz/workers endpoint; capacity unknown (older Mercury?)';
+    }
+    else if (workers.status < 200 || workers.status >= 300) {
+        return {
+            ...empty,
+            outcome: 'http_error',
+            detail: `HTTP ${workers.status} from /healthz/workers`,
+            lastError: `HTTP ${workers.status} from ${base}/healthz/workers`,
+        };
+    }
+    else {
+        const body = (workers.json ?? {});
+        const list = Array.isArray(body.workers) ? body.workers : [];
+        workerCount = list.length;
+        // Sum rather than take one: a host may run several workers, and "how busy is this machine" is the
+        // question routing will eventually ask.
+        activeRuns = list.reduce((sum, w) => sum + (typeof w.activeRuns === 'number' ? w.activeRuns : 0), 0);
+        workerId = list.map((w) => w.workerId).filter((x) => typeof x === 'string').join(',') || null;
+        queueDepth = typeof body.queueDepth === 'number' ? body.queueDepth : null;
+    }
+    // 3) Credential and capability. This is the only authenticated call, so it is where a bad token shows up.
+    const agents = await call(fetchImpl, `${base}/api/agents`, target.token, target.timeoutMs);
+    let agentList = null;
+    let agentsDetail = null;
+    let unauthorized = false;
+    if (agents.transportError) {
+        return {
+            ...empty,
+            outcome: agents.timedOut ? 'timeout' : 'unreachable',
+            detail: `/healthz answered but /api/agents failed: ${describeTransportError(agents.transportError)}`,
+            lastError: agents.transportError.message.slice(0, 300),
+        };
+    }
+    if (agents.status === 401 || agents.status === 403) {
+        unauthorized = true;
+        agentsDetail = `HTTP ${agents.status} from /api/agents: the host is reachable but this credential was ` +
+            `rejected. Check credential_ref; do not assume the host is down.`;
+    }
+    else if (agents.status >= 200 && agents.status < 300) {
+        const raw = agents.json?.agents;
+        agentList = Array.isArray(raw)
+            ? raw.filter((x) => typeof x === 'string').map(stripTerminalControls)
+            : [];
+    }
+    else {
+        agentsDetail = `HTTP ${agents.status} from /api/agents`;
+    }
+    // Precedence: a host we cannot authenticate against is reported as unauthorized even though it is
+    // healthy, because that is the condition blocking Fleet from using it.
+    if (unauthorized) {
+        return { ...empty, outcome: 'unauthorized', detail: agentsDetail, agents: null,
+            activeRuns, queueDepth, workerCount, workerId, lastError: agentsDetail };
+    }
+    if (notServingDetail) {
+        return { ...empty, outcome: 'not_serving', detail: notServingDetail, agents: agentList,
+            activeRuns, queueDepth, workerCount, workerId, lastError: notServingDetail };
+    }
+    if (agentsDetail) {
+        return { ...empty, outcome: 'http_error', detail: agentsDetail, agents: agentList,
+            activeRuns, queueDepth, workerCount, workerId, lastError: agentsDetail };
+    }
+    return {
+        outcome: 'ok',
+        detail: capacityUnknown,
+        activeRuns,
+        queueDepth,
+        workerCount,
+        workerId,
+        agents: agentList,
+        lastError: null,
+    };
+}
+/** Run a probe and shape it into a registry record. */
+export async function probeAndRecord(target, fetchImpl = fetch) {
+    const r = await probeHost(target, fetchImpl);
+    return {
+        hostId: target.hostId,
+        outcome: r.outcome,
+        detail: r.detail,
+        activeRuns: r.activeRuns,
+        queueDepth: r.queueDepth,
+        workerCount: r.workerCount,
+        workerId: r.workerId,
+        agents: r.agents,
+        probedAt: new Date().toISOString(),
+        lastError: r.lastError,
+    };
+}

package/dist/prober.js

@@ -0,0 +1,94 @@
+/**
+ * The sweep: probe every enabled host on a timer and write the results to the cache table.
+ *
+ * Design section 12 puts this in Phase 0 alongside the registry. Two properties matter more than the
+ * details. Hosts are probed concurrently, because a serial sweep over a fleet with one dead host spends its
+ * whole budget waiting on the dead one. And the timer is unref'd, so an imported prober never keeps a
+ * process alive by itself.
+ */
+import { probeAndRecord } from "./probe.js";
+export function createProber(opts) {
+    let timer = null;
+    let sweeping = null;
+    async function runSweep() {
+        const hosts = opts.registry.list().filter((h) => h.enabled);
+        return await (async () => {
+            const results = await Promise.all(hosts.map(async (host) => {
+                let token;
+                try {
+                    token = opts.resolveToken(host.credentialRef);
+                }
+                catch (err) {
+                    // A missing ref is Fleet's own misconfiguration, not the host's fault. Recorded as
+                    // unauthorized because the actionable message is the same: the host may be perfectly healthy,
+                    // and Fleet is the side that cannot prove otherwise.
+                    const detail = `credential ref "${host.credentialRef}" could not be resolved: ` +
+                        `${err.message}. Host not contacted.`;
+                    const rec = {
+                        hostId: host.id, outcome: 'unauthorized', detail, activeRuns: null, queueDepth: null,
+                        workerCount: null, workerId: null, agents: null,
+                        probedAt: new Date().toISOString(), lastError: detail,
+                    };
+                    opts.registry.recordProbe(rec);
+                    return rec;
+                }
+                try {
+                    const rec = await probeAndRecord({ hostId: host.id, baseUrl: host.baseUrl, token, timeoutMs: opts.timeoutMs }, opts.fetchImpl);
+                    opts.registry.recordProbe(rec);
+                    return rec;
+                }
+                catch (err) {
+                    // probeAndRecord classifies rather than throwing, so this is a bug or an unexpected rejection.
+                    // Swallowing it silently would leave the cache showing a stale "up".
+                    const e = err;
+                    opts.onError?.(host.id, e);
+                    const rec = {
+                        hostId: host.id, outcome: 'http_error', detail: `probe raised: ${e.message}`.slice(0, 300),
+                        activeRuns: null, queueDepth: null, workerCount: null, workerId: null, agents: null,
+                        probedAt: new Date().toISOString(), lastError: e.message.slice(0, 300),
+                    };
+                    opts.registry.recordProbe(rec);
+                    return rec;
+                }
+            }));
+            return results;
+        })();
+    }
+    /**
+     * Overlap guard: a sweep that outlives its interval (many hosts, all slow) must not stack up, or a fleet
+     * behind a saturated network spawns a fresh sweep every interval forever.
+     *
+     * The flag is assigned synchronously, before any await. It used to be set after an `await import()`, so
+     * two concurrent callers both read the flag as unset and both started a sweep -- which the overlap test
+     * caught as two sweeps one millisecond apart.
+     */
+    function sweepOnce() {
+        if (sweeping)
+            return sweeping;
+        sweeping = runSweep().finally(() => {
+            sweeping = null;
+        });
+        return sweeping;
+    }
+    return {
+        sweepOnce,
+        start() {
+            if (timer)
+                return;
+            timer = setInterval(() => {
+                // The sweep never rejects (every branch records a result), but an unexpected rejection must not
+                // become an unhandled rejection that takes the process down.
+                void sweepOnce().catch(() => { });
+            }, opts.intervalMs);
+            timer.unref?.();
+        },
+        stop() {
+            if (timer)
+                clearInterval(timer);
+            timer = null;
+        },
+        get running() {
+            return timer !== null;
+        },
+    };
+}

package/dist/redact.js

@@ -0,0 +1,72 @@
+/**
+ * Redaction for Fleet's own logs.
+ *
+ * Fleet cannot import Mercury's redactor -- the coupling rule in docs/fleet-design.md section 11 forbids it
+ * -- and this is not cosmetic parity. Fleet holds a credential for every Mercury on the network, so a single
+ * bearer token reaching a log file is a fleet-wide compromise sitting in a file with journald's retention.
+ * The realistic path is mundane: an HTTP client error can echo request headers, and a stack trace that
+ * carries a request object carries the Authorization header with it.
+ *
+ * Two mechanisms, because they fail differently:
+ *
+ *   - a generic pattern pass catches `Authorization: Bearer ...` wherever it appears, including in text
+ *     written by code that forgot to be careful;
+ *   - an exact-value pass over the known secrets catches a token that appears BARE, with no header name to
+ *     anchor on. This is why the store is seeded at startup from the credential file: a pattern pass alone
+ *     cannot recognise a secret it has no label for.
+ */
+export const REDACTED = '[REDACTED]';
+/**
+ * Header-shaped secrets, matched structurally so unknown token formats are still caught.
+ *
+ * The value class stops at whitespace and quotes so a match cannot run past the end of the header into
+ * surrounding text and redact a whole line, which would turn a leak into an unreadable log.
+ */
+const PATTERNS = [
+    /\b(authorization|proxy-authorization|x-api-key|x-auth-token)\b\s*[:=]\s*(?:bearer|basic|token)?\s*["']?[A-Za-z0-9._~+/=-]{8,}/gi,
+    /\bbearer\s+[A-Za-z0-9._~+/=-]{8,}/gi,
+    // A URL that embedded credentials, e.g. after a fetch failure echoes the request target.
+    /\b[a-z][a-z0-9+.-]*:\/\/[^/\s:@"'`]+:[^@\s@"'`]+@/gi,
+];
+export function createRedactor(secrets = []) {
+    // Longest first. Redacting a short secret before a longer one that contains it would leave the tail of
+    // the long secret visible, which is still enough to correlate a leak.
+    const values = [...new Set([...secrets].filter((s) => typeof s === 'string' && s.length >= 4))]
+        .sort((a, b) => b.length - a.length);
+    const escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    const literal = values.length === 0 ? null : new RegExp(values.map(escapeRe).join('|'), 'g');
+    return {
+        redact(text) {
+            if (typeof text !== 'string' || text.length === 0)
+                return text;
+            let out = text;
+            for (const re of PATTERNS) {
+                out = out.replace(re, (m) => {
+                    const sep = m.match(/[:=]/);
+                    // Keep the header name so the log still says WHAT leaked, without saying what it leaked.
+                    return sep ? `${m.slice(0, m.indexOf(sep[0]))}=${REDACTED}`.replace('=', ': ') : REDACTED;
+                });
+            }
+            if (literal)
+                out = out.replace(literal, REDACTED);
+            return out;
+        },
+        get seededCount() {
+            return values.length;
+        },
+    };
+}
+/**
+ * Build the redactor a running Fleet service needs.
+ *
+ * Extracted from the serve path so that "every secret class Fleet holds is seeded" is a tested invariant
+ * rather than a comment. It used to be a comment that was wrong: the code seeded child credentials only,
+ * so a bare caller or admin token reaching a log line through an exception message went unredacted.
+ */
+export function createServiceRedactor(sources) {
+    return createRedactor([
+        ...sources.childSecrets,
+        ...sources.callerTokens,
+        ...(sources.adminToken ? [sources.adminToken] : []),
+    ]);
+}