@creezio/observability 0.22.0

package/dist/ops/rules.js

@@ -0,0 +1,98 @@
+/**
+ * Boîte noire — moteur d'anomalies générique.
+ * Extrait de TempoFlow ops-rules.ts (R4).
+ */
+import { currentBootSummary, readPreviousBootSummaries, track, } from "./journal.js";
+/**
+ * Règle 1 — décision négative répétée : si la MÊME décision négative est
+ * prise à N boots consécutifs, quelque chose ne s'auto-répare pas.
+ */
+const NEGATIVE_OUTCOMES = {
+    "meili.ready": ["full-reindex", "skip-no-meili"],
+    "meili.start": ["unavailable"],
+    "tunnel.connect": ["error"],
+};
+const REPEAT_BOOTS = 2;
+/** Règle 2 — durée anormale par kind (ms). */
+const DURATION_THRESHOLDS_MS = {
+    "boot.done": 8 * 60_000,
+    "index.run": 10 * 60_000,
+    "migrations.done": 3 * 60_000,
+    "catalog.ensure": 30 * 60_000,
+};
+/** Règle 3 — erreurs récurrentes dans un même boot. */
+const ERROR_COUNT_THRESHOLD = 10;
+function isNegative(kind, outcome) {
+    if (!outcome)
+        return false;
+    return (NEGATIVE_OUTCOMES[kind] || []).includes(outcome);
+}
+/** Pure — testable sans I/O. */
+export function evaluateRulesPure(current, previous) {
+    const findings = [];
+    for (const [kind, d] of Object.entries(current.decisions || {})) {
+        if (!isNegative(kind, d.outcome))
+            continue;
+        let consecutive = 1;
+        for (const prev of previous) {
+            const pd = prev.decisions?.[kind];
+            if (pd && isNegative(kind, pd.outcome))
+                consecutive++;
+            else
+                break;
+        }
+        if (consecutive >= REPEAT_BOOTS) {
+            findings.push({
+                rule: "repeated-negative-decision",
+                kind,
+                detail: `${kind} outcome=${d.outcome} sur ${consecutive} boots consécutifs (reason=${d.reason || "?"})`,
+                ctx: {
+                    outcome: d.outcome,
+                    reason: d.reason,
+                    consecutiveBoots: consecutive,
+                },
+            });
+        }
+    }
+    for (const [kind, threshold] of Object.entries(DURATION_THRESHOLDS_MS)) {
+        const observed = current.durations?.[kind];
+        if (observed != null && observed > threshold) {
+            findings.push({
+                rule: "duration-over-threshold",
+                kind,
+                detail: `${kind} a duré ${Math.round(observed / 1000)}s (seuil ${Math.round(threshold / 1000)}s)`,
+                ctx: { durationMs: observed, thresholdMs: threshold },
+            });
+        }
+    }
+    const errorCount = (current.counts?.error || 0) + (current.counts?.crash || 0);
+    if (errorCount >= ERROR_COUNT_THRESHOLD) {
+        findings.push({
+            rule: "recurring-errors",
+            kind: "boot.errors",
+            detail: `${errorCount} erreurs/crashes pendant le boot`,
+            ctx: { errorCount },
+        });
+    }
+    return findings;
+}
+/** À appeler en fin de boot (après persistBootSummary). Jamais de throw. */
+export function evaluateBootRules() {
+    try {
+        const findings = evaluateRulesPure(currentBootSummary(), readPreviousBootSummaries(REPEAT_BOOTS + 2));
+        for (const f of findings) {
+            track({
+                level: "anomaly",
+                kind: `anomaly.${f.rule}`,
+                outcome: f.kind,
+                reason: f.detail,
+                ctx: f.ctx,
+            });
+        }
+        return findings;
+    }
+    catch {
+        return [];
+    }
+}
+//# sourceMappingURL=rules.js.map

package/dist/ops/rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../src/ops/rules.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EACL,kBAAkB,EAClB,yBAAyB,EACzB,KAAK,GACN,MAAM,cAAc,CAAC;AAGtB;;;GAGG;AACH,MAAM,iBAAiB,GAA6B;IAClD,aAAa,EAAE,CAAC,cAAc,EAAE,eAAe,CAAC;IAChD,aAAa,EAAE,CAAC,aAAa,CAAC;IAC9B,gBAAgB,EAAE,CAAC,OAAO,CAAC;CAC5B,CAAC;AACF,MAAM,YAAY,GAAG,CAAC,CAAC;AAEvB,8CAA8C;AAC9C,MAAM,sBAAsB,GAA2B;IACrD,WAAW,EAAE,CAAC,GAAG,MAAM;IACvB,WAAW,EAAE,EAAE,GAAG,MAAM;IACxB,iBAAiB,EAAE,CAAC,GAAG,MAAM;IAC7B,gBAAgB,EAAE,EAAE,GAAG,MAAM;CAC9B,CAAC;AAEF,uDAAuD;AACvD,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAEjC,SAAS,UAAU,CAAC,IAAY,EAAE,OAAgB;IAChD,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAC3B,OAAO,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;AAC3D,CAAC;AAYD,gCAAgC;AAChC,MAAM,UAAU,iBAAiB,CAC/B,OAAuB,EACvB,QAA0B;IAE1B,MAAM,QAAQ,GAAsB,EAAE,CAAC;IAEvC,KAAK,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC,EAAE,CAAC;QAChE,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC;YAAE,SAAS;QAC3C,IAAI,WAAW,GAAG,CAAC,CAAC;QACpB,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC;YAClC,IAAI,EAAE,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC;gBAAE,WAAW,EAAE,CAAC;;gBACjD,MAAM;QACb,CAAC;QACD,IAAI,WAAW,IAAI,YAAY,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,4BAA4B;gBAClC,IAAI;gBACJ,MAAM,EAAE,GAAG,IAAI,YAAY,CAAC,CAAC,OAAO,QAAQ,WAAW,8BAA8B,CAAC,CAAC,MAAM,IAAI,GAAG,GAAG;gBACvG,GAAG,EAAE;oBACH,OAAO,EAAE,CAAC,CAAC,OAAO;oBAClB,MAAM,EAAE,CAAC,CAAC,MAAM;oBAChB,gBAAgB,EAAE,WAAW;iBAC9B;aACF,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,KAAK,MAAM,CAAC,IAAI,EAAE,SAAS,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,sBAAsB,CAAC,EAAE,CAAC;QACvE,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,QAAQ,IAAI,IAAI,IAAI,QAAQ,GAAG,SAAS,EAAE,CAAC;YAC7C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,yBAAyB;gBAC/B,IAAI;gBACJ,MAAM,EAAE,GAAG,IAAI,WAAW,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC,IAAI;gBACjG,GAAG,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE;aACtD,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC;IAC/E,IAAI,UAAU,IAAI,qBAAqB,EAAE,CAAC;QACxC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,kBAAkB;YACxB,IAAI,EAAE,aAAa;YACnB,MAAM,EAAE,GAAG,UAAU,kCAAkC;YACvD,GAAG,EAAE,EAAE,UAAU,EAAE;SACpB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,iBAAiB,CAChC,kBAAkB,EAAE,EACpB,yBAAyB,CAAC,YAAY,GAAG,CAAC,CAAC,CAC5C,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,KAAK,CAAC;gBACJ,KAAK,EAAE,SAAS;gBAChB,IAAI,EAAE,WAAW,CAAC,CAAC,IAAI,EAAE;gBACzB,OAAO,EAAE,CAAC,CAAC,IAAI;gBACf,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,GAAG,EAAE,CAAC,CAAC,GAAG;aACX,CAAC,CAAC;QACL,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/ops/types.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Boîte noire desktop — types + helpers PURS (aucun import Electron).
+ * Contrat JSONL ops (R4 / P29) — préfixe d'émission historique `TF2EVENT`
+ * conservé (wire sous-process Electron ×3). Lecture = dual-read via
+ * `OPS_EVENT_PREFIXES` ; ne pas retirer `TF2EVENT` sans cutover marques.
+ */
+export declare const TF2EVENT_PREFIX = "TF2EVENT ";
+/** Alias générique — même valeur que `TF2EVENT_PREFIX` (émission). */
+export declare const OPS_EVENT_PREFIX = "TF2EVENT ";
+/**
+ * Préfixes stdout acceptés en lecture (M7p / P29) :
+ * - émission SoT = `TF2EVENT`
+ * - `CertivanEVENT` = dual-read legacy marques (ne pas casser)
+ */
+export declare const OPS_EVENT_PREFIXES: readonly ["TF2EVENT ", "CertivanEVENT "];
+export type OpsLevel = "decision" | "event" | "anomaly" | "error" | "crash";
+export declare const OPS_LEVELS: readonly OpsLevel[];
+/** Événement tel qu'émis par le code appelant. */
+export type OpsEventInput = {
+    level: OpsLevel;
+    /** Taxonomie stable `domaine.action` : meili.ready, boot.done, updater.check… */
+    kind: string;
+    /** Process émetteur — défaut "main" côté journal. */
+    source?: string;
+    /** Branche choisie : skip, full-reindex, present, downloaded, ok, error… */
+    outcome?: string;
+    /** POURQUOI : fingerprint-absent, timeout, http-503… */
+    reason?: string;
+    durationMs?: number;
+    /** Contexte libre, redacté et plafonné à MAX_CTX_BYTES. */
+    ctx?: Record<string, unknown>;
+};
+/** Événement complet, tel que persisté dans le JSONL. */
+export type OpsEvent = OpsEventInput & {
+    ts: string;
+    bootId: string;
+    seq: number;
+    source: string;
+};
+/** Taille max du ctx sérialisé (au-delà : tronqué avec marqueur). */
+export declare const MAX_CTX_BYTES = 4096;
+/** Redaction récursive : clés sensibles masquées, motifs secrets dans les strings. */
+export declare function redactOpsCtx(value: unknown, depth?: number): unknown;
+/** Valide + normalise un input (renvoie null si inutilisable). */
+export declare function sanitizeOpsEventInput(raw: unknown): OpsEventInput | null;
+/** Sérialise en plafonnant le ctx (jamais de throw). */
+export declare function serializeOpsEvent(evt: OpsEvent): string;
+/**
+ * Parse une ligne stdout d'un sous-process.
+ * Renvoie l'input si la ligne est un TF2EVENT valide, sinon null.
+ */
+export declare function parseOpsLine(line: string): OpsEventInput | null;
+/** Résumé d'un boot (ops/index.json + heartbeat flotte). */
+export type OpsBootSummary = {
+    bootId: string;
+    startedAt: string;
+    endedAt?: string;
+    appVersion?: string;
+    durationMs?: number;
+    counts: Partial<Record<OpsLevel, number>>;
+    /** Décisions du boot : kind → { outcome, reason }. */
+    decisions: Record<string, {
+        outcome?: string;
+        reason?: string;
+    }>;
+    /** Durée max observée par kind (événements portant durationMs). */
+    durations: Record<string, number>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/ops/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/ops/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,eAAe,cAAc,CAAC;AAC3C,sEAAsE;AACtE,eAAO,MAAM,gBAAgB,cAAkB,CAAC;AAChD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,0CAGrB,CAAC;AAEX,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,OAAO,GAAG,OAAO,CAAC;AAE5E,eAAO,MAAM,UAAU,EAAE,SAAS,QAAQ,EAMzC,CAAC;AAEF,kDAAkD;AAClD,MAAM,MAAM,aAAa,GAAG;IAC1B,KAAK,EAAE,QAAQ,CAAC;IAChB,iFAAiF;IACjF,IAAI,EAAE,MAAM,CAAC;IACb,qDAAqD;IACrD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4EAA4E;IAC5E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAEF,yDAAyD;AACzD,MAAM,MAAM,QAAQ,GAAG,aAAa,GAAG;IACrC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,qEAAqE;AACrE,eAAO,MAAM,aAAa,OAAO,CAAC;AAOlC,sFAAsF;AACtF,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,EAAE,KAAK,SAAI,GAAG,OAAO,CAmB/D;AAED,kEAAkE;AAClE,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,aAAa,GAAG,IAAI,CAsBxE;AAED,wDAAwD;AACxD,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,QAAQ,GAAG,MAAM,CAkBvD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,IAAI,CAW/D;AAED,4DAA4D;AAC5D,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1C,sDAAsD;IACtD,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACjE,mEAAmE;IACnE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CACnC,CAAC"}

package/dist/ops/types.js

@@ -0,0 +1,119 @@
+/**
+ * Boîte noire desktop — types + helpers PURS (aucun import Electron).
+ * Contrat JSONL ops (R4 / P29) — préfixe d'émission historique `TF2EVENT`
+ * conservé (wire sous-process Electron ×3). Lecture = dual-read via
+ * `OPS_EVENT_PREFIXES` ; ne pas retirer `TF2EVENT` sans cutover marques.
+ */
+export const TF2EVENT_PREFIX = "TF2EVENT ";
+/** Alias générique — même valeur que `TF2EVENT_PREFIX` (émission). */
+export const OPS_EVENT_PREFIX = TF2EVENT_PREFIX;
+/**
+ * Préfixes stdout acceptés en lecture (M7p / P29) :
+ * - émission SoT = `TF2EVENT`
+ * - `CertivanEVENT` = dual-read legacy marques (ne pas casser)
+ */
+export const OPS_EVENT_PREFIXES = [
+    TF2EVENT_PREFIX,
+    "CertivanEVENT ",
+];
+export const OPS_LEVELS = [
+    "decision",
+    "event",
+    "anomaly",
+    "error",
+    "crash",
+];
+/** Taille max du ctx sérialisé (au-delà : tronqué avec marqueur). */
+export const MAX_CTX_BYTES = 4096;
+const SECRET_KEY_RE = /token|secret|password|passwd|api[-_]?key|jwt|auth|bearer|cookie|master[-_]?key/i;
+const SECRET_VALUE_RE = /(sk-[A-Za-z0-9_-]{10,}|tf2_live_[A-Za-z0-9_-]+|eyJ[A-Za-z0-9_-]{20,}|Bearer\s+[A-Za-z0-9._-]{10,})/g;
+/** Redaction récursive : clés sensibles masquées, motifs secrets dans les strings. */
+export function redactOpsCtx(value, depth = 0) {
+    if (depth > 6)
+        return "[depth]";
+    if (typeof value === "string") {
+        return value.replace(SECRET_VALUE_RE, "[redacted]").slice(0, 800);
+    }
+    if (typeof value === "number" || typeof value === "boolean" || value === null) {
+        return value;
+    }
+    if (Array.isArray(value)) {
+        return value.slice(0, 50).map((v) => redactOpsCtx(v, depth + 1));
+    }
+    if (typeof value === "object" && value !== undefined) {
+        const out = {};
+        for (const [k, v] of Object.entries(value)) {
+            out[k] = SECRET_KEY_RE.test(k) ? "[redacted]" : redactOpsCtx(v, depth + 1);
+        }
+        return out;
+    }
+    return value === undefined ? undefined : String(value);
+}
+/** Valide + normalise un input (renvoie null si inutilisable). */
+export function sanitizeOpsEventInput(raw) {
+    if (!raw || typeof raw !== "object")
+        return null;
+    const o = raw;
+    const level = OPS_LEVELS.includes(o.level)
+        ? o.level
+        : null;
+    const kind = typeof o.kind === "string" && /^[a-z0-9_-]+\.[a-z0-9._-]+$/i.test(o.kind)
+        ? o.kind.slice(0, 80)
+        : null;
+    if (!level || !kind)
+        return null;
+    const evt = { level, kind };
+    if (typeof o.source === "string")
+        evt.source = o.source.slice(0, 40);
+    if (typeof o.outcome === "string")
+        evt.outcome = o.outcome.slice(0, 120);
+    if (typeof o.reason === "string")
+        evt.reason = o.reason.slice(0, 300);
+    if (typeof o.durationMs === "number" && Number.isFinite(o.durationMs)) {
+        evt.durationMs = Math.max(0, Math.round(o.durationMs));
+    }
+    if (o.ctx && typeof o.ctx === "object" && !Array.isArray(o.ctx)) {
+        evt.ctx = redactOpsCtx(o.ctx);
+    }
+    return evt;
+}
+/** Sérialise en plafonnant le ctx (jamais de throw). */
+export function serializeOpsEvent(evt) {
+    try {
+        let line = JSON.stringify(evt);
+        if (evt.ctx && Buffer.byteLength(line, "utf8") > MAX_CTX_BYTES + 1024) {
+            line = JSON.stringify({ ...evt, ctx: { _truncated: true } });
+        }
+        return line;
+    }
+    catch {
+        return JSON.stringify({
+            ts: evt.ts,
+            bootId: evt.bootId,
+            seq: evt.seq,
+            source: evt.source,
+            level: evt.level,
+            kind: evt.kind,
+            reason: "serialize-error",
+        });
+    }
+}
+/**
+ * Parse une ligne stdout d'un sous-process.
+ * Renvoie l'input si la ligne est un TF2EVENT valide, sinon null.
+ */
+export function parseOpsLine(line) {
+    const trimmed = line.trim();
+    for (const prefix of OPS_EVENT_PREFIXES) {
+        if (!trimmed.startsWith(prefix))
+            continue;
+        try {
+            return sanitizeOpsEventInput(JSON.parse(trimmed.slice(prefix.length)));
+        }
+        catch {
+            return null;
+        }
+    }
+    return null;
+}
+//# sourceMappingURL=types.js.map

package/dist/ops/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/ops/types.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAG,WAAW,CAAC;AAC3C,sEAAsE;AACtE,MAAM,CAAC,MAAM,gBAAgB,GAAG,eAAe,CAAC;AAChD;;;;GAIG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,eAAe;IACf,gBAAgB;CACR,CAAC;AAIX,MAAM,CAAC,MAAM,UAAU,GAAwB;IAC7C,UAAU;IACV,OAAO;IACP,SAAS;IACT,OAAO;IACP,OAAO;CACR,CAAC;AA0BF,qEAAqE;AACrE,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC;AAElC,MAAM,aAAa,GACjB,iFAAiF,CAAC;AACpF,MAAM,eAAe,GACnB,qGAAqG,CAAC;AAExG,sFAAsF;AACtF,MAAM,UAAU,YAAY,CAAC,KAAc,EAAE,KAAK,GAAG,CAAC;IACpD,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC9E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACnE,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACrD,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,CAAC,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACzD,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACjD,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAiB,CAAC;QACpD,CAAC,CAAE,CAAC,CAAC,KAAkB;QACvB,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,IAAI,GACR,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QACvE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACrB,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,GAAG,GAAkB,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAC3C,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACrE,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;QAAE,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ;QAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,IAAI,OAAO,CAAC,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,GAAG,CAA4B,CAAC;IAC3D,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,iBAAiB,CAAC,GAAa;IAC7C,IAAI,CAAC;QACH,IAAI,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,aAAa,GAAG,IAAI,EAAE,CAAC;YACtE,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,GAAG,EAAE,GAAG,EAAE,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,SAAS,CAAC;YACpB,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,GAAG,EAAE,GAAG,CAAC,GAAG;YACZ,MAAM,EAAE,GAAG,CAAC,MAAM;YAClB,KAAK,EAAE,GAAG,CAAC,KAAK;YAChB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,iBAAiB;SAC1B,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,KAAK,MAAM,MAAM,IAAI,kBAAkB,EAAE,CAAC;QACxC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,SAAS;QAC1C,IAAI,CAAC;YACH,OAAO,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACzE,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/request-logs/config.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Injection host pour request-logs (évite imports `@/` marque).
+ * O5 — noyau générique kit.
+ */
+export type RequestLogsConfig = {
+    /**
+     * Répertoire miroir jsonl pour l’agent flotte Electron.
+     * Défaut : `CREEZIO_FLEET_STATE_DIR`, sinon la variable
+     * `${envPrefix}_FLEET_STATE_DIR` dérivée du manifest marque (posée par le
+     * host — voir brand-host-stack) : aucun préfixe marque énuméré ici.
+     */
+    getFleetStateDir?: () => string | undefined;
+};
+export declare function configureRequestLogs(next: RequestLogsConfig): void;
+export declare function getRequestLogsConfig(): RequestLogsConfig;
+export declare function resetRequestLogsConfigForTests(): void;
+/** Résout le dir miroir (config marque, env générique, ou envKey manifest). */
+export declare function resolveFleetStateDir(): string | undefined;
+//# sourceMappingURL=config.d.ts.map

package/dist/request-logs/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/request-logs/config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;;;;OAKG;IACH,gBAAgB,CAAC,EAAE,MAAM,MAAM,GAAG,SAAS,CAAC;CAC7C,CAAC;AAIF,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,iBAAiB,GAAG,IAAI,CAElE;AAED,wBAAgB,oBAAoB,IAAI,iBAAiB,CAExD;AAED,wBAAgB,8BAA8B,IAAI,IAAI,CAErD;AAID,+EAA+E;AAC/E,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,SAAS,CAkBzD"}

package/dist/request-logs/config.js

@@ -0,0 +1,36 @@
+/**
+ * Injection host pour request-logs (évite imports `@/` marque).
+ * O5 — noyau générique kit.
+ */
+let config = {};
+export function configureRequestLogs(next) {
+    config = next ?? {};
+}
+export function getRequestLogsConfig() {
+    return config;
+}
+export function resetRequestLogsConfigForTests() {
+    config = {};
+}
+const FLEET_STATE_DIR_SUFFIX = "_FLEET_STATE_DIR";
+/** Résout le dir miroir (config marque, env générique, ou envKey manifest). */
+export function resolveFleetStateDir() {
+    const custom = config.getFleetStateDir?.();
+    if (custom)
+        return custom;
+    const generic = process.env.CREEZIO_FLEET_STATE_DIR;
+    if (generic)
+        return generic;
+    // Dérivation manifest/envKey : le host pose `${envPrefix}_FLEET_STATE_DIR`
+    // (préfixe issu du manifest marque) — on accepte n'importe quel préfixe,
+    // ce qui couvre aussi les préfixes legacy sans les câbler ici.
+    for (const [key, value] of Object.entries(process.env)) {
+        if (value &&
+            key.endsWith(FLEET_STATE_DIR_SUFFIX) &&
+            key !== "CREEZIO_FLEET_STATE_DIR") {
+            return value;
+        }
+    }
+    return undefined;
+}
+//# sourceMappingURL=config.js.map

package/dist/request-logs/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/request-logs/config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAYH,IAAI,MAAM,GAAsB,EAAE,CAAC;AAEnC,MAAM,UAAU,oBAAoB,CAAC,IAAuB;IAC1D,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,oBAAoB;IAClC,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,8BAA8B;IAC5C,MAAM,GAAG,EAAE,CAAC;AACd,CAAC;AAED,MAAM,sBAAsB,GAAG,kBAAkB,CAAC;AAElD,+EAA+E;AAC/E,MAAM,UAAU,oBAAoB;IAClC,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,EAAE,EAAE,CAAC;IAC3C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC;IACpD,IAAI,OAAO;QAAE,OAAO,OAAO,CAAC;IAC5B,2EAA2E;IAC3E,yEAAyE;IACzE,+DAA+D;IAC/D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,IACE,KAAK;YACL,GAAG,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YACpC,GAAG,KAAK,yBAAyB,EACjC,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/request-logs/http-routes.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Admin — lecture / purge des logs API + MCP (session UI).
+ * Hono « nu » : hors doc OpenAPI publique.
+ * O5 — extrait TempoFlow (gold). Auth owner reste côté marque (montage).
+ */
+import { Hono } from "hono";
+export declare function createRequestLogsRoutes(): Hono;
+//# sourceMappingURL=http-routes.d.ts.map

package/dist/request-logs/http-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-routes.d.ts","sourceRoot":"","sources":["../../src/request-logs/http-routes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAO5B,wBAAgB,uBAAuB,IAAI,IAAI,CA0B9C"}

package/dist/request-logs/http-routes.js

@@ -0,0 +1,29 @@
+/**
+ * Admin — lecture / purge des logs API + MCP (session UI).
+ * Hono « nu » : hors doc OpenAPI publique.
+ * O5 — extrait TempoFlow (gold). Auth owner reste côté marque (montage).
+ */
+import { Hono } from "hono";
+import { clearRequestLogs, listRequestLogs, } from "./request-logs.js";
+export function createRequestLogsRoutes() {
+    const app = new Hono();
+    app.get("/request-logs", (c) => {
+        const limit = Number(c.req.query("limit")) || 100;
+        const sourceRaw = (c.req.query("source") || "all").toLowerCase();
+        const source = sourceRaw === "mcp" || sourceRaw === "api"
+            ? sourceRaw
+            : "all";
+        const q = c.req.query("q") || undefined;
+        const errorsOnly = c.req.query("errorsOnly") === "1" ||
+            c.req.query("errorsOnly") === "true" ||
+            c.req.query("errors") === "1";
+        const result = listRequestLogs({ limit, source, q, errorsOnly });
+        return c.json(result);
+    });
+    app.delete("/request-logs", (c) => {
+        const { cleared } = clearRequestLogs();
+        return c.json({ ok: true, cleared });
+    });
+    return app;
+}
+//# sourceMappingURL=http-routes.js.map

package/dist/request-logs/http-routes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-routes.js","sourceRoot":"","sources":["../../src/request-logs/http-routes.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EACL,gBAAgB,EAChB,eAAe,GAEhB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,UAAU,uBAAuB;IACrC,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IAEvB,GAAG,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,GAAG,CAAC;QAClD,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;QACjE,MAAM,MAAM,GACV,SAAS,KAAK,KAAK,IAAI,SAAS,KAAK,KAAK;YACxC,CAAC,CAAE,SAA8B;YACjC,CAAC,CAAC,KAAK,CAAC;QACZ,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,SAAS,CAAC;QACxC,MAAM,UAAU,GACd,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,GAAG;YACjC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,MAAM;YACpC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC;QAEhC,MAAM,MAAM,GAAG,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC;QACjE,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC,CAAC,EAAE,EAAE;QAChC,MAAM,EAAE,OAAO,EAAE,GAAG,gBAAgB,EAAE,CAAC;QACvC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/request-logs/index.d.ts

@@ -0,0 +1,6 @@
+export { configureRequestLogs, getRequestLogsConfig, resetRequestLogsConfigForTests, resolveFleetStateDir, type RequestLogsConfig, } from "./config.js";
+export type { RequestLogSource, RequestLogDetail, RequestLogEntry, ListRequestLogsOpts, } from "./request-logs.js";
+export { getRequestLogCapacity, _resetRequestLogsForTests, isSecretKey, redactSecrets, pushRequestLog, listRequestLogs, clearRequestLogs, parseJsonRpcMessages, summarizeMcpRequest, summarizeMcpResponse, extractApiErrorMessage, shouldSkipRequestLog, } from "./request-logs.js";
+export { requestLogApiMiddleware, requestLogMcpMiddleware, } from "./middleware.js";
+export { createRequestLogsRoutes } from "./http-routes.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/request-logs/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/request-logs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,8BAA8B,EAC9B,oBAAoB,EACpB,KAAK,iBAAiB,GACvB,MAAM,aAAa,CAAC;AAErB,YAAY,EACV,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EACf,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,WAAW,EACX,aAAa,EACb,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/request-logs/index.js

@@ -0,0 +1,5 @@
+export { configureRequestLogs, getRequestLogsConfig, resetRequestLogsConfigForTests, resolveFleetStateDir, } from "./config.js";
+export { getRequestLogCapacity, _resetRequestLogsForTests, isSecretKey, redactSecrets, pushRequestLog, listRequestLogs, clearRequestLogs, parseJsonRpcMessages, summarizeMcpRequest, summarizeMcpResponse, extractApiErrorMessage, shouldSkipRequestLog, } from "./request-logs.js";
+export { requestLogApiMiddleware, requestLogMcpMiddleware, } from "./middleware.js";
+export { createRequestLogsRoutes } from "./http-routes.js";
+//# sourceMappingURL=index.js.map

package/dist/request-logs/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/request-logs/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,oBAAoB,EACpB,oBAAoB,EACpB,8BAA8B,EAC9B,oBAAoB,GAErB,MAAM,aAAa,CAAC;AASrB,OAAO,EACL,qBAAqB,EACrB,yBAAyB,EACzB,WAAW,EACX,aAAa,EACb,cAAc,EACd,eAAe,EACf,gBAAgB,EAChB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,sBAAsB,EACtB,oBAAoB,GACrB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EACL,uBAAuB,EACvB,uBAAuB,GACxB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/request-logs/middleware.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Middlewares de collecte des logs API / MCP → ring buffer mémoire.
+ * Ne doit jamais faire échouer la requête (tout est try/catch).
+ * O5 — extrait TempoFlow (gold).
+ */
+import type { MiddlewareHandler } from "hono";
+/** Middleware API v1 — à brancher tôt (avant auth). */
+export declare const requestLogApiMiddleware: MiddlewareHandler;
+/** Middleware MCP `/mcp` uniquement (pas OAuth). */
+export declare const requestLogMcpMiddleware: MiddlewareHandler;
+//# sourceMappingURL=middleware.d.ts.map

package/dist/request-logs/middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.d.ts","sourceRoot":"","sources":["../../src/request-logs/middleware.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,KAAK,EAAW,iBAAiB,EAAE,MAAM,MAAM,CAAC;AA+GvD,uDAAuD;AACvD,eAAO,MAAM,uBAAuB,EAAE,iBA6CrC,CAAC;AAEF,oDAAoD;AACpD,eAAO,MAAM,uBAAuB,EAAE,iBAwDrC,CAAC"}

package/dist/request-logs/middleware.js

@@ -0,0 +1,198 @@
+import { extractApiErrorMessage, pushRequestLog, redactSecrets, shouldSkipRequestLog, summarizeMcpRequest, summarizeMcpResponse, } from "./request-logs.js";
+async function safeReadText(resOrReq) {
+    try {
+        return await resOrReq.text();
+    }
+    catch {
+        return null;
+    }
+}
+function safeJsonParse(text) {
+    if (!text)
+        return null;
+    const t = text.trim();
+    if (!t)
+        return null;
+    try {
+        return JSON.parse(t);
+    }
+    catch {
+        return null;
+    }
+}
+function queryRecord(c) {
+    try {
+        const url = new URL(c.req.url);
+        const out = {};
+        url.searchParams.forEach((v, k) => {
+            out[k] = isSecretLookingParam(k) ? "[redacted]" : String(redactSecrets(v));
+        });
+        return Object.keys(out).length ? out : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+function isSecretLookingParam(key) {
+    return /token|secret|password|key|jwt|auth/i.test(key);
+}
+async function readRequestJson(c) {
+    const method = c.req.method.toUpperCase();
+    if (method === "GET" ||
+        method === "HEAD" ||
+        method === "OPTIONS" ||
+        method === "DELETE") {
+        return null;
+    }
+    const ct = (c.req.header("content-type") || "").toLowerCase();
+    if (ct && !ct.includes("json") && !ct.includes("text/plain")) {
+        return { _skipped: `content-type ${ct.split(";")[0]}` };
+    }
+    const text = await safeReadText(c.req.raw.clone());
+    if (!text)
+        return null;
+    if (text.length > 64_000) {
+        return { _truncated: true, preview: redactSecrets(text.slice(0, 2000)) };
+    }
+    const parsed = safeJsonParse(text);
+    return parsed != null
+        ? redactSecrets(parsed)
+        : { _raw: redactSecrets(text.slice(0, 500)) };
+}
+async function readResponseJson(c) {
+    const res = c.res;
+    if (!res)
+        return null;
+    const ct = (res.headers.get("content-type") || "").toLowerCase();
+    if (ct && !ct.includes("json") && !ct.includes("text/plain"))
+        return null;
+    const len = res.headers.get("content-length");
+    if (len && Number(len) > 256_000)
+        return null;
+    const text = await safeReadText(res.clone());
+    if (!text || text.length > 256_000)
+        return null;
+    return safeJsonParse(text);
+}
+function commitLog(source, c, started, detail) {
+    try {
+        const pathName = c.req.path || new URL(c.req.url).pathname;
+        if (shouldSkipRequestLog(pathName))
+            return;
+        const status = c.res?.status ?? 0;
+        pushRequestLog({
+            ts: new Date(started).toISOString(),
+            source,
+            method: c.req.method.toUpperCase(),
+            path: pathName,
+            status,
+            durationMs: Math.max(0, Date.now() - started),
+            detail,
+        });
+    }
+    catch (err) {
+        console.error("[request-logs] commit failed", err);
+    }
+}
+/** Middleware API v1 — à brancher tôt (avant auth). */
+export const requestLogApiMiddleware = async (c, next) => {
+    const started = Date.now();
+    const pathName = c.req.path || "";
+    if (shouldSkipRequestLog(pathName) || c.req.method.toUpperCase() === "OPTIONS") {
+        await next();
+        return;
+    }
+    let body = null;
+    try {
+        body = await readRequestJson(c);
+    }
+    catch {
+        body = null;
+    }
+    try {
+        await next();
+    }
+    catch (err) {
+        commitLog("api", c, started, {
+            query: queryRecord(c),
+            body: body ?? undefined,
+            ok: false,
+            error: err instanceof Error ? err.message : String(err),
+        });
+        throw err;
+    }
+    const detail = {
+        query: queryRecord(c),
+        body: body ?? undefined,
+    };
+    const status = c.res?.status ?? 0;
+    if (status >= 400) {
+        try {
+            const resp = await readResponseJson(c);
+            const msg = extractApiErrorMessage(resp);
+            if (msg)
+                detail.error = msg;
+            detail.ok = false;
+        }
+        catch {
+            detail.ok = false;
+        }
+    }
+    else {
+        detail.ok = true;
+    }
+    commitLog("api", c, started, detail);
+};
+/** Middleware MCP `/mcp` uniquement (pas OAuth). */
+export const requestLogMcpMiddleware = async (c, next) => {
+    const started = Date.now();
+    if (c.req.method.toUpperCase() === "OPTIONS") {
+        await next();
+        return;
+    }
+    let detail = {};
+    try {
+        const text = await safeReadText(c.req.raw.clone());
+        const parsed = safeJsonParse(text);
+        if (parsed != null) {
+            detail = summarizeMcpRequest(parsed);
+        }
+    }
+    catch {
+        /* ignore */
+    }
+    try {
+        await next();
+    }
+    catch (err) {
+        detail.ok = false;
+        detail.error = err instanceof Error ? err.message : String(err);
+        commitLog("mcp", c, started, detail);
+        throw err;
+    }
+    try {
+        const auth = c.get("mcpAuth");
+        if (auth) {
+            detail.authType = auth.authType;
+            detail.clientId = auth.clientId;
+            detail.userId = auth.userId;
+        }
+        const resp = await readResponseJson(c);
+        if (resp != null) {
+            const summary = summarizeMcpResponse(resp);
+            detail = { ...detail, ...summary };
+        }
+        else {
+            const status = c.res?.status ?? 0;
+            detail.ok = status > 0 && status < 400;
+            if (!detail.ok && status >= 400) {
+                detail.error = detail.error || `HTTP ${status}`;
+            }
+        }
+    }
+    catch {
+        /* ignore */
+    }
+    commitLog("mcp", c, started, detail);
+};
+//# sourceMappingURL=middleware.js.map