@hyperdrive.bot/fleet-server 0.3.99

package/dist/server/server/ingestion/testing/claim-and-hang.js

@@ -0,0 +1,21 @@
+// Test-only. Claims one ledger item in a REAL separate process, then hangs forever so the
+// caller can SIGKILL it. It deliberately never calls close(): the point is to leave an
+// unmarked claim and an unclosed WAL on disk, which is exactly what a crashed daemon
+// leaves behind.
+//
+// This exists because the e2e daemon harness (test-utils/paseo-daemon.ts) runs the daemon
+// IN-PROCESS, so `process.kill(pid, "SIGKILL")` would kill the vitest worker rather than
+// the daemon. The ungraceful half of the restart proof has to happen in a child.
+import { IngestionLedger } from "../ledger.js";
+const [paseoHome, filterId, itemKey, runId] = process.argv.slice(2);
+if (!paseoHome || !filterId || !itemKey || !runId) {
+    process.stderr.write("usage: claim-and-hang <paseoHome> <filterId> <itemKey> <runId>\n");
+    process.exit(2);
+}
+const ledger = new IngestionLedger({ paseoHome });
+ledger.touch(filterId, itemKey, {});
+const won = ledger.claim(filterId, itemKey, { runId });
+process.stdout.write(won ? "READY\n" : "LOST\n");
+// Hold the process open. No close(), no checkpoint - wait to be killed.
+setInterval(() => { }, 1000);
+//# sourceMappingURL=claim-and-hang.js.map

package/dist/server/server/ingestion/testing/cohort-crash.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cohort-crash.d.ts.map

package/dist/server/server/ingestion/testing/cohort-crash.js

@@ -0,0 +1,89 @@
+// Test-only. Writes a REAL half-dispatched cohort into a real `paseo.sqlite` in a
+// separate process, then hangs so the caller can SIGKILL it.
+//
+// The e2e daemon harness runs the daemon IN-PROCESS (`createTestPaseoDaemon`
+// calls `createPaseoDaemon()` directly), so `process.kill(pid, "SIGKILL")` would
+// kill the vitest worker rather than the daemon. The ungraceful half of the
+// restart proof has to happen in a child, exactly as `claim-and-hang.ts` does for
+// the ledger.
+//
+// It deliberately never calls `close()`: no checkpoint, no graceful anything.
+// What is left on disk is what a crashed daemon leaves behind.
+import { CohortStore } from "../cohort-store.js";
+import { IngestionLedger } from "../ledger.js";
+const [paseoHome, filterId, cohortId, cancelledCohortId] = process.argv.slice(2);
+if (!paseoHome || !filterId || !cohortId || !cancelledCohortId) {
+    process.stderr.write("usage: cohort-crash <paseoHome> <filterId> <cohortId> <cancelledCohortId>\n");
+    process.exit(2);
+}
+/** Six groups of two items each, keyed to match the gateway double's item keys. */
+const GROUPS = Array.from({ length: 6 }, (_, index) => ({
+    key: `thread-${index}`,
+    itemKeys: [`crash-item-${index}`, `crash-item-${index + 6}`],
+}));
+const ledger = new IngestionLedger({ paseoHome });
+const store = new CohortStore({ db: ledger.database, now: () => Date.now() });
+store.create({
+    cohortId,
+    filterId,
+    mode: "apply",
+    requested: 12,
+    groupsTotal: GROUPS.length,
+    truncated: 0,
+    capPerDay: 10,
+    groups: GROUPS,
+});
+// g0, g1: dispatched and finished before the crash.
+for (const index of [0, 1]) {
+    const group = GROUPS[index];
+    if (!group)
+        continue;
+    store.markGroup({
+        cohortId,
+        groupKey: group.key,
+        status: "running",
+        runId: `crash-run-${index}`,
+    });
+    store.markGroup({
+        cohortId,
+        groupKey: group.key,
+        status: "succeeded",
+        agentId: `agent-${index}`,
+    });
+    for (const itemKey of group.itemKeys) {
+        ledger.touch(filterId, itemKey, {});
+        ledger.mark(filterId, itemKey, { outcome: "applied", contentHash: `crash-hash-${itemKey}` });
+    }
+}
+// g2: dispatched, still running when the process dies. Its ledger rows are
+// CLAIMED and unmarked, which is what `releaseStaleClaims()` has to find.
+const running = GROUPS[2];
+if (running) {
+    store.markGroup({ cohortId, groupKey: running.key, status: "running", runId: "crash-run-2" });
+    for (const itemKey of running.itemKeys) {
+        ledger.touch(filterId, itemKey, {});
+        ledger.claim(filterId, itemKey, { runId: "crash-run-2", agentId: null });
+    }
+}
+// g3, g4, g5 stay `pending`. They are the three the restart owes.
+// A SECOND cohort, cancelled, with a pending group that must NOT be resumed.
+// The pending row is inserted directly because `cancelRemaining` flips every
+// pending row it finds - this is the shape a dispatch racing a cancel leaves.
+store.create({
+    cohortId: cancelledCohortId,
+    filterId,
+    mode: "apply",
+    requested: 2,
+    groupsTotal: 1,
+    truncated: 0,
+    capPerDay: 10,
+    groups: [{ key: "thread-cancelled", itemKeys: ["crash-item-cancelled"] }],
+});
+store.cancelRemaining(cancelledCohortId);
+ledger.database
+    .prepare("INSERT INTO ingestion_cohort_groups (cohort_id, group_key, item_keys, status, run_id, agent_id) VALUES (?, 'thread-late', ?, 'pending', NULL, NULL)")
+    .run(cancelledCohortId, JSON.stringify(["crash-item-late"]));
+process.stdout.write("READY\n");
+// Hold the process open. No close(), no checkpoint - wait to be killed.
+setInterval(() => { }, 1000);
+//# sourceMappingURL=cohort-crash.js.map

package/dist/server/server/ingestion/types.d.ts

@@ -0,0 +1,226 @@
+/**
+ * Contracts for the ingestion module.
+ *
+ * These shapes are the normalization layer over two aggregators whose native
+ * APIs differ. The adapters absorb that difference, so no caller downstream
+ * ever branches on kind.
+ */
+/**
+ * The aggregator kinds that can back an ingestion source.
+ *
+ * ONE constant, because this list appears in every selector and in the
+ * resolver: an aggregator added to the codebase but forgotten in one of those
+ * places would vanish from all of them in silence. Pairing this list with the
+ * `Record<SourceKind, ...>` registry in `adapters.ts` turns that silence into
+ * a compile error.
+ */
+export declare const SOURCE_CAPABLE_KINDS: readonly ["pipedream", "composio"];
+export type SourceKind = (typeof SOURCE_CAPABLE_KINDS)[number];
+/** Where to reach an aggregator's remote MCP server for a single agent turn. */
+export interface McpTarget {
+    url: string;
+    /**
+     * Authorization headers for the remote MCP server. Built per turn, never
+     * persisted, never returned to a client.
+     */
+    headers: Record<string, string>;
+}
+/** One app in an aggregator catalogue, normalized. Slugs are opaque runtime strings. */
+export interface SourceCatalogueEntry {
+    /** Aggregator-native slug, used for connect and for the MCP target (e.g. "gmail"). */
+    slug: string;
+    name: string;
+    imgSrc: string;
+    description: string;
+}
+/** One page of the catalogue. The cursor is opaque; never parse it. */
+export interface SourceCataloguePage {
+    items: SourceCatalogueEntry[];
+    nextCursor: string | null;
+}
+/** Where to send the user to authorize. The page belongs to the aggregator, not to paseo. */
+export interface SourceConnectHandoff {
+    redirectUrl: string;
+    /** ISO 8601, or null when the aggregator does not expose an expiry. */
+    expiresAt: string | null;
+}
+/**
+ * An account the user has already authorized for an app.
+ * Normalized across aggregators:
+ *   Pipedream  healthy true -> "active", false -> "inactive"
+ *   Composio   ACTIVE -> "active", INITIALIZING -> "pending", INACTIVE -> "inactive"
+ * "pending" means the user is still inside the hosted OAuth popup. Story 1.5 polls
+ * for "active" and must be able to tell that apart from a failed authorization.
+ */
+export interface SourceAccount {
+    id: string;
+    status: "active" | "pending" | "inactive";
+}
+export interface PipedreamConfig {
+    clientId?: string | undefined;
+    clientSecret?: string | undefined;
+    projectId?: string | undefined;
+    /**
+     * Defaults to "development". Read from PASEO_PIPEDREAM_ENVIRONMENT, which
+     * degrades to "development" on any other value rather than failing boot.
+     *
+     * Narrowed from `string` in Story 1.2: the SDK's `projectEnvironment` option
+     * is this exact union, so a wider type here only defers the same error to a
+     * cast at the call site.
+     */
+    environment: "development" | "production";
+    /**
+     * Origins Pipedream will accept the hosted connect popup from.
+     *
+     * Computed once in config.ts from appBaseUrl + corsAllowedOrigins rather than
+     * passed per call, which is what keeps the gateway a pure function of its
+     * config and its tests hermetic.
+     */
+    allowedOrigins: string[];
+}
+export interface ComposioConfig {
+    apiKey?: string | undefined;
+}
+export interface IngestionConfig {
+    pipedream: PipedreamConfig;
+    composio: ComposioConfig;
+}
+/**
+ * A single-field object on purpose: later stories add a logger here without
+ * changing the signature of every adapter factory.
+ */
+export interface IngestionDeps {
+    readonly config: IngestionConfig;
+}
+/**
+ * One item read back out of a source's history, normalized.
+ *
+ * This is what `listItems` returns and what the backfill preview evaluates a
+ * filter's match against. It is deliberately NOT `MatchedItem`: a MatchedItem
+ * has already survived a filter and is on its way to a prompt, whereas a
+ * SourceItem is a candidate that may well be discarded.
+ *
+ * `key` and `contentHash` are produced by the ADAPTER, using `fingerprint()`
+ * from `fingerprint.ts` - the same helper the ledger keys its rows with.
+ * Nothing downstream re-derives either one. A second key function is a second
+ * identity for the same item, and an identity that disagrees with the ledger's
+ * re-dispatches a backlog the user already cleared.
+ *
+ * No credential field, and never one: a SourceItem crosses the wire (projected
+ * into `BackfillItem`), so a header, token or bearer landing here would land in
+ * a client.
+ */
+export interface SourceItem {
+    /** Ledger identity, from `fingerprint()`. Stable across reads of the same item. */
+    key: string;
+    /** Content fingerprint, from `fingerprint()`. Compared against the ledger row to decide "already handled". */
+    contentHash: string;
+    /**
+     * Epoch ms. The backfill window is closed at the start and open at the end
+     * against this value, so an adapter that cannot date an item must not invent
+     * a timestamp - it drops the item instead.
+     */
+    timestampMs: number;
+    /** One-line human label for a row. Never a credential; never the raw payload. */
+    title: string;
+    /** Secondary human label for a row. */
+    subtitle: string;
+    /**
+     * The raw aggregator event body, opaque. A filter clause's dotted `field`
+     * path resolves against this by string lookup only: app slugs and payload
+     * field names are runtime strings from a user-authored document, so nothing
+     * in code may enumerate them.
+     */
+    payload: Record<string, unknown>;
+}
+/**
+ * The one seam every aggregator implements. Credentials live behind it and
+ * never cross back out to a client.
+ */
+export interface SourceGateway {
+    /** False when the server has no credentials for this aggregator. */
+    readonly configured: boolean;
+    listSources(query: string, cursor?: string): Promise<SourceCataloguePage>;
+    connect(externalUserId: string, appSlug: string): Promise<SourceConnectHandoff>;
+    listAccounts(externalUserId: string, appSlug: string): Promise<SourceAccount[]>;
+    /**
+     * One page of a source's HISTORY, oldest boundary supplied by the caller.
+     *
+     * This is a READ and only a read. It resolves no MCP target, mints no
+     * session and writes nothing: `runBackfill` calls it to show a user what a
+     * filter would have matched, and a read that could arm something is not a
+     * preview. `cursor` is opaque and is passed straight back; never parse it.
+     *
+     * `sinceMs` is a hint the adapter passes to the aggregator where the
+     * aggregator supports one. The authoritative window trim is `runBackfill`'s,
+     * against `SourceItem.timestampMs`, so an aggregator that ignores the hint
+     * costs bandwidth and never correctness.
+     */
+    listItems(input: {
+        /** The aggregator-side isolation key for this daemon's user. */
+        externalUserId: string;
+        /** The app whose history is being read, e.g. "gmail". An opaque runtime string. */
+        appSlug: string;
+        /** The connected account, as persisted in `StoredSource.externalAccountId`. */
+        accountId: string;
+        /** Epoch ms. The oldest item worth returning. */
+        sinceMs: number;
+        /** Opaque page cursor from a previous call, or null for the first page. */
+        cursor: string | null;
+        /** Maximum items in this page. */
+        limit: number;
+    }): Promise<{
+        items: SourceItem[];
+        cursor: string | null;
+    }>;
+    /**
+     * The remote MCP endpoint plus the headers that authorize it.
+     *
+     * The result is built per turn, never persisted, never returned to a client.
+     * It carries a live platform credential, so anything that widens its reach
+     * (a cache, a store write, an RPC response) is a credential leak.
+     */
+    mcpTarget(externalUserId: string, appSlug: string): Promise<McpTarget>;
+}
+/**
+ * One item a source filter matched, as handed to grouping and then to the prompt
+ * composer.
+ *
+ * Deliberately NOT carried here: any dedupe state (`verifiedAt`, `status`, a ledger
+ * id). Dedupe is Epic 3's concern, and a status field on this type would invite the
+ * dispatch path to start deciding it.
+ *
+ * No zod schema, on purpose: this shape never crosses the wire and never lands on
+ * disk in this epic. `StoredFilterSchema` is the only new persisted shape, and its
+ * frozen key allow-list test would fail the moment these fields leaked into it.
+ */
+export interface MatchedItem {
+    /** Ledger identity. Epic 3 dedupes against this; grouping only ever sorts and echoes it. */
+    key: string;
+    /**
+     * Rendered into the prompt by `buildSourceRunPrompt`. Grouping never reads it:
+     * comparing hashes is Epic 3's dedupe, not this module's job.
+     */
+    contentHash: string;
+    /** ISO 8601 UTC. Used only for deterministic ordering, never for freshness. */
+    observedAt: string;
+    /**
+     * The raw aggregator event body. Opaque: app slugs and payload field names are
+     * runtime strings from a user-authored filter document, so nothing in code may
+     * enumerate them. The group key path is read against this by string lookup only.
+     */
+    payload: Record<string, unknown>;
+}
+/**
+ * The matched items that mint ONE session together, under the key they resolved to.
+ *
+ * `items` is never empty and is deterministically ordered (`observedAt` ascending,
+ * ties broken on `key` ascending, both byte-wise). `key` is always a real string:
+ * an item whose group key path resolves to nothing falls back to its own `key` and
+ * becomes a singleton group, so an unmatched path can never silently drop an item.
+ */
+export interface MatchedItemGroup {
+    key: string;
+    items: MatchedItem[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/server/server/ingestion/types.js

@@ -0,0 +1,18 @@
+/**
+ * Contracts for the ingestion module.
+ *
+ * These shapes are the normalization layer over two aggregators whose native
+ * APIs differ. The adapters absorb that difference, so no caller downstream
+ * ever branches on kind.
+ */
+/**
+ * The aggregator kinds that can back an ingestion source.
+ *
+ * ONE constant, because this list appears in every selector and in the
+ * resolver: an aggregator added to the codebase but forgotten in one of those
+ * places would vanish from all of them in silence. Pairing this list with the
+ * `Record<SourceKind, ...>` registry in `adapters.ts` turns that silence into
+ * a compile error.
+ */
+export const SOURCE_CAPABLE_KINDS = ["pipedream", "composio"];
+//# sourceMappingURL=types.js.map

package/dist/server/server/ingestion/utc-day.d.ts

@@ -0,0 +1,27 @@
+/**
+ * `date +%F` under UTC - the calendar day `now` falls on.
+ *
+ * A CALENDAR DATE, not a rolling 24h window, and that is the ported behaviour:
+ * `run-agent.sh:47` builds `/tmp/loop-locks/${name}.alert.$(date +%F).${sig}`.
+ * Two failures at 23:50 and 00:10 fall on different dates and both alert. Do
+ * not "improve" this into a 24h window - a quiet night is exactly when an
+ * operator most needs the second heads-up.
+ *
+ * The returned string is zero-padded `YYYY-MM-DD`, which is what makes
+ * lexicographic order equal chronological order, which is what
+ * `IngestionLedger.prune()`'s `day < ?` clause depends on.
+ */
+export declare function utcDateKey(now: Date): string;
+/**
+ * Epoch ms of the next UTC midnight STRICTLY AFTER `now`.
+ *
+ * `Date.UTC(y, m, d + 1)` rather than "add 86_400_000": the arithmetic version
+ * is wrong twice - it carries `now`'s time-of-day along instead of landing on
+ * midnight, and it would need a separate month/year-end branch. `Date.UTC`
+ * normalizes an overflowing day-of-month itself, so 2026-12-31 gives
+ * 2027-01-01 and 2028-02-28 gives 2028-02-29 with no special case.
+ *
+ * This is `CapReport.resetsAt`: when the caller's budget comes back.
+ */
+export declare function nextUtcMidnight(now: Date): number;
+//# sourceMappingURL=utc-day.d.ts.map

package/dist/server/server/ingestion/utc-day.js

@@ -0,0 +1,44 @@
+// THE ONE day-key implementation in `ingestion/`.
+//
+// Two modules need "what UTC day is it": Story 3.3's once-per-day alert marker
+// (`ingestion_items.alerted_on`) and Story 3.4's dispatch budget
+// (`ingestion_dispatch_budget.day`). Two implementations of that question in one
+// directory is how one of them ends up on local time and the pair silently
+// disagree for three hours every day in `America/Sao_Paulo` - the alert would
+// fire twice on one calendar day while the budget rolled over on another.
+//
+// So there is exactly one, and a grep in the story's AC #10 fails the build if a
+// second appears. That same grep also bans every local-time `Date` accessor and
+// every locale-formatting method from this directory: the only date parts read
+// anywhere under `ingestion/` are the `getUTC*` family.
+/**
+ * `date +%F` under UTC - the calendar day `now` falls on.
+ *
+ * A CALENDAR DATE, not a rolling 24h window, and that is the ported behaviour:
+ * `run-agent.sh:47` builds `/tmp/loop-locks/${name}.alert.$(date +%F).${sig}`.
+ * Two failures at 23:50 and 00:10 fall on different dates and both alert. Do
+ * not "improve" this into a 24h window - a quiet night is exactly when an
+ * operator most needs the second heads-up.
+ *
+ * The returned string is zero-padded `YYYY-MM-DD`, which is what makes
+ * lexicographic order equal chronological order, which is what
+ * `IngestionLedger.prune()`'s `day < ?` clause depends on.
+ */
+export function utcDateKey(now) {
+    return now.toISOString().slice(0, 10);
+}
+/**
+ * Epoch ms of the next UTC midnight STRICTLY AFTER `now`.
+ *
+ * `Date.UTC(y, m, d + 1)` rather than "add 86_400_000": the arithmetic version
+ * is wrong twice - it carries `now`'s time-of-day along instead of landing on
+ * midnight, and it would need a separate month/year-end branch. `Date.UTC`
+ * normalizes an overflowing day-of-month itself, so 2026-12-31 gives
+ * 2027-01-01 and 2028-02-28 gives 2028-02-29 with no special case.
+ *
+ * This is `CapReport.resetsAt`: when the caller's budget comes back.
+ */
+export function nextUtcMidnight(now) {
+    return Date.UTC(now.getUTCFullYear(), now.getUTCMonth(), now.getUTCDate() + 1);
+}
+//# sourceMappingURL=utc-day.js.map

package/dist/server/server/json-utils.d.ts

@@ -0,0 +1,11 @@
+export type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+/**
+ * Coerce arbitrary values into JSON-safe structures.
+ * Unlike the previous implementation, this never throws on undefined—
+ * it replaces unsupported values (undefined, functions, symbols) with null
+ * so responses always make it back to the client.
+ */
+export declare function ensureValidJson<T>(value: T): T;
+//# sourceMappingURL=json-utils.d.ts.map

package/dist/server/server/json-utils.js

@@ -0,0 +1,45 @@
+/**
+ * Coerce arbitrary values into JSON-safe structures.
+ * Unlike the previous implementation, this never throws on undefined—
+ * it replaces unsupported values (undefined, functions, symbols) with null
+ * so responses always make it back to the client.
+ */
+export function ensureValidJson(value) {
+    const seen = new WeakSet();
+    const sanitize = (current) => {
+        if (current === null || current === undefined) {
+            return null;
+        }
+        if (typeof current === "string" || typeof current === "number") {
+            return current;
+        }
+        if (typeof current === "boolean") {
+            return current;
+        }
+        if (typeof current === "bigint") {
+            return current.toString();
+        }
+        if (current instanceof Date) {
+            return current.toISOString();
+        }
+        if (Array.isArray(current)) {
+            return current.map((item) => sanitize(item));
+        }
+        if (typeof current === "object") {
+            if (seen.has(current)) {
+                throw new Error("Cannot serialize circular structure to JSON");
+            }
+            seen.add(current);
+            const obj = {};
+            for (const [key, val] of Object.entries(current)) {
+                obj[key] = sanitize(val);
+            }
+            seen.delete(current);
+            return obj;
+        }
+        // functions, symbols, undefined, etc.
+        return null;
+    };
+    return sanitize(value);
+}
+//# sourceMappingURL=json-utils.js.map

package/dist/server/server/lifecycle-reasons.d.ts

@@ -0,0 +1,4 @@
+export declare const CLIENT_SHUTDOWN_RPC_REASON = "client_shutdown_rpc";
+export declare const DEFAULT_CLIENT_RESTART_RPC_REASON = "client_restart_rpc";
+export declare function normalizeClientRestartRpcReason(reason: string | undefined): string;
+//# sourceMappingURL=lifecycle-reasons.d.ts.map

package/dist/server/server/lifecycle-reasons.js

@@ -0,0 +1,6 @@
+export const CLIENT_SHUTDOWN_RPC_REASON = "client_shutdown_rpc";
+export const DEFAULT_CLIENT_RESTART_RPC_REASON = "client_restart_rpc";
+export function normalizeClientRestartRpcReason(reason) {
+    return reason?.trim() || DEFAULT_CLIENT_RESTART_RPC_REASON;
+}
+//# sourceMappingURL=lifecycle-reasons.js.map

package/dist/server/server/logger.d.ts

@@ -0,0 +1,29 @@
+import pino from "pino";
+import type { PersistedConfig } from "./persisted-config.js";
+export type LogLevel = "trace" | "debug" | "info" | "warn" | "error" | "fatal";
+export type LogFormat = "pretty" | "json";
+export interface ResolvedLogConfig {
+    level: LogLevel;
+    console: {
+        level: LogLevel;
+        format: LogFormat;
+    };
+    file?: {
+        level: LogLevel;
+        path: string;
+    };
+}
+interface LegacyLogConfig {
+    level?: LogLevel;
+    format?: LogFormat;
+}
+type LoggerConfigInput = PersistedConfig | LegacyLogConfig | undefined;
+interface ResolveLogConfigOptions {
+    paseoHome?: string;
+    file?: boolean;
+}
+export declare function resolveLogConfig(configInput: LoggerConfigInput, options?: ResolveLogConfigOptions): ResolvedLogConfig;
+export declare function createRootLogger(configInput: LoggerConfigInput, options?: ResolveLogConfigOptions): pino.Logger;
+export declare function createChildLogger(parent: pino.Logger, name: string): pino.Logger;
+export {};
+//# sourceMappingURL=logger.d.ts.map

package/dist/server/server/logger.js

@@ -0,0 +1,125 @@
+import { mkdirSync } from "node:fs";
+import path from "node:path";
+import pino from "pino";
+import pretty from "pino-pretty";
+import { resolvePaseoHome } from "./paseo-home.js";
+const LOG_LEVEL_PRIORITIES = {
+    trace: 10,
+    debug: 20,
+    info: 30,
+    warn: 40,
+    error: 50,
+    fatal: 60,
+};
+const DEFAULT_CONSOLE_LEVEL = "info";
+const DEFAULT_CONSOLE_FORMAT = "json";
+const DEFAULT_FILE_LEVEL = "info";
+const DEFAULT_DAEMON_LOG_FILENAME = "daemon.log";
+const REDACT_PATHS = [
+    "authorization",
+    "Authorization",
+    "headers.authorization",
+    "headers.Authorization",
+    "req.headers.authorization",
+    "req.headers.Authorization",
+    '["sec-websocket-protocol"]',
+    "Sec-WebSocket-Protocol",
+    'headers["sec-websocket-protocol"]',
+    "headers.Sec-WebSocket-Protocol",
+    'req.headers["sec-websocket-protocol"]',
+    "req.headers.Sec-WebSocket-Protocol",
+];
+function resolveFilePath(paseoHome, configuredPath) {
+    const fallback = path.join(paseoHome, DEFAULT_DAEMON_LOG_FILENAME);
+    if (!configuredPath) {
+        return fallback;
+    }
+    if (path.isAbsolute(configuredPath)) {
+        return configuredPath;
+    }
+    return path.resolve(paseoHome, configuredPath);
+}
+function minLogLevel(levels) {
+    let minLevel = levels[0];
+    for (const level of levels) {
+        if (LOG_LEVEL_PRIORITIES[level] < LOG_LEVEL_PRIORITIES[minLevel]) {
+            minLevel = level;
+        }
+    }
+    return minLevel;
+}
+function resolveConfiguredPaseoHome(options) {
+    if (options?.paseoHome) {
+        return options.paseoHome;
+    }
+    return resolvePaseoHome();
+}
+function normalizeLoggerConfigInput(config) {
+    if (!config) {
+        return undefined;
+    }
+    if ("log" in config) {
+        return config;
+    }
+    if ("level" in config || "format" in config) {
+        const legacy = config;
+        return {
+            log: {
+                ...(legacy.level ? { level: legacy.level } : {}),
+                ...(legacy.format ? { format: legacy.format } : {}),
+            },
+        };
+    }
+    return config;
+}
+function resolveLogLevelsAndFormat(persistedLog) {
+    const persistedGlobalLevel = persistedLog?.level;
+    const consoleLevel = persistedLog?.console?.level ?? persistedGlobalLevel ?? DEFAULT_CONSOLE_LEVEL;
+    const fileLevel = persistedLog?.file
+        ? (persistedLog.file.level ?? persistedGlobalLevel ?? DEFAULT_FILE_LEVEL)
+        : undefined;
+    const consoleFormat = persistedLog?.console?.format ?? persistedLog?.format ?? DEFAULT_CONSOLE_FORMAT;
+    return { consoleLevel, fileLevel, consoleFormat };
+}
+export function resolveLogConfig(configInput, options) {
+    const persistedConfig = normalizeLoggerConfigInput(configInput);
+    const paseoHome = resolveConfiguredPaseoHome(options);
+    const persistedLog = persistedConfig?.log;
+    const { consoleLevel, fileLevel, consoleFormat } = resolveLogLevelsAndFormat(persistedLog);
+    const file = options?.file !== false && persistedLog?.file
+        ? {
+            level: fileLevel ?? DEFAULT_FILE_LEVEL,
+            path: resolveFilePath(paseoHome, persistedLog.file.path),
+        }
+        : undefined;
+    return {
+        level: minLogLevel(file ? [consoleLevel, file.level] : [consoleLevel]),
+        console: {
+            level: consoleLevel,
+            format: consoleFormat,
+        },
+        ...(file ? { file } : {}),
+    };
+}
+export function createRootLogger(configInput, options) {
+    const config = resolveLogConfig(configInput, options);
+    if (config.file) {
+        mkdirSync(path.dirname(config.file.path), { recursive: true });
+    }
+    const stream = config.console.format === "pretty"
+        ? pretty({
+            colorize: true,
+            singleLine: true,
+            ignore: "pid,hostname",
+            destination: config.file?.path ?? 1,
+        })
+        : pino.destination({ dest: config.file?.path ?? 1, sync: false });
+    return pino({
+        level: config.file?.level ?? config.console.level,
+        redact: { paths: REDACT_PATHS, remove: true },
+    }, stream);
+}
+export function createChildLogger(parent, name) {
+    return parent.child({ name });
+}
+//# sourceMappingURL=logger.js.map