@merittdev/horus 0.8.11 → 0.8.12

package/dist/index.cjs

@@ -65880,7 +65880,7 @@ init_cjs_shims();
 
 // ../../packages/core/src/version.ts
 init_cjs_shims();
-var HORUS_VERSION = true ? "0.8.11" : "dev";
+var HORUS_VERSION = true ? "0.8.12" : "dev";
 var PINNED_SOURCE_VERSION = "1.5.1";
 
 // ../../packages/core/src/evidence.ts
@@ -71571,6 +71571,18 @@ function buildLevelFilter(m5, minLevel) {
   );
   return { terms: { [m5.levelField]: stringLevels } };
 }
+function buildWhereFilters(where) {
+  if (where === void 0 || where.length === 0) return [];
+  return where.map((w4) => ({
+    bool: {
+      should: [
+        { term: { [w4.field]: w4.value } },
+        { term: { [`${w4.field}.keyword`]: w4.value } }
+      ],
+      minimum_should_match: 1
+    }
+  }));
+}
 function buildTextMust(q2, mapping = MERITT_FIELD_MAPPING) {
   if (q2.text === void 0) return [{ match_all: {} }];
   if (q2.broadText === true) {
@@ -71595,6 +71607,7 @@ function buildSearchBody(q2, mapping = MERITT_FIELD_MAPPING) {
   if (q2.service !== void 0) {
     filters.push({ term: { [serviceTermField(mapping)]: q2.service } });
   }
+  filters.push(...buildWhereFilters(q2.where));
   const mustClause = buildTextMust(q2, mapping);
   return {
     query: {
@@ -71623,6 +71636,7 @@ function buildErrorAggBody(q2, field, mapping = MERITT_FIELD_MAPPING) {
   if (q2.eventCode !== void 0) {
     filters.push({ term: { [signatureTermField(mapping)]: q2.eventCode } });
   }
+  filters.push(...buildWhereFilters(q2.where));
   const aggField = field === mapping.eventCodeField ? signatureTermField(mapping) : `${field}.keyword`;
   return {
     size: 0,
@@ -71857,6 +71871,7 @@ function buildErrorAnalysisBody(q2, field = "event_code", mapping = MERITT_FIELD
   if (q2.eventCode !== void 0) {
     filters.push({ term: { [sigTerm]: q2.eventCode } });
   }
+  filters.push(...buildWhereFilters(q2.where));
   const mustClause = buildTextMust(q2, mapping);
   return {
     size: 0,
@@ -112108,6 +112123,19 @@ function resolveRawLevel(opts) {
   if (opts.allLevels) return void 0;
   return opts.level ?? "error";
 }
+function parseWhere(raw) {
+  if (raw === void 0) return [];
+  return raw.map((entry2) => {
+    const eq2 = entry2.indexOf("=");
+    if (eq2 <= 0) {
+      throw new Error(
+        `Invalid --where "${entry2}" \u2014 expected field=value, e.g. --where context.brand_id=42`
+      );
+    }
+    return { field: entry2.slice(0, eq2).trim(), value: entry2.slice(eq2 + 1).trim() };
+  });
+}
+var whereLabel = (where) => where.map((w4) => `${w4.field}=${w4.value}`).join(", ");
 function levelColor(level, text2) {
   if (level === "error" || level === "fatal") return import_picocolors27.default.red(text2);
   if (level === "warn") return import_picocolors27.default.yellow(text2);
@@ -112123,6 +112151,15 @@ function matchServiceLabel(requested, candidates) {
 }
 async function runLogs(service, opts) {
   try {
+    let where;
+    try {
+      where = parseWhere(opts.where);
+    } catch (err2) {
+      console.error(import_picocolors27.default.red(err2.message));
+      return 1;
+    }
+    const hasWhere = where.length > 0;
+    const whereArg = hasWhere ? where : void 0;
     const config2 = await loadConfig(opts.config, { name: opts.name });
     let renv;
     try {
@@ -112174,8 +112211,9 @@ async function runLogs(service, opts) {
     const from = sinceToIso(opts.since) ?? new Date(Date.now() - 7 * 864e5).toISOString();
     const fromDisplay = from.slice(0, 16).replace("T", " ");
     if (opts.raw === true) {
-      const rawLevel = resolveRawLevel(opts);
-      const limit = opts.limit !== void 0 ? Math.min(Number(opts.limit), 1e3) : 20;
+      const rawLevel = hasWhere && opts.level === void 0 ? void 0 : resolveRawLevel(opts);
+      const defaultLimit = hasWhere ? 200 : 20;
+      const limit = opts.limit !== void 0 ? Math.min(Number(opts.limit), 1e3) : defaultLimit;
       const records = await logs.searchLogs({
         service: resolvedService,
         from,
@@ -112184,8 +112222,10 @@ async function runLogs(service, opts) {
         // grep searches message + detail + context.* so error strings buried
         // outside the message field are still found (HOR-216).
         broadText: opts.grep !== void 0,
+        where: whereArg,
         limit
       });
+      const truncated = records.length === limit;
       if (opts.json) {
         console.log(
           JSON.stringify(
@@ -112197,7 +112237,9 @@ async function runLogs(service, opts) {
                 index: indexPattern,
                 from,
                 level: rawLevel ?? "all",
-                grep: opts.grep ?? null
+                grep: opts.grep ?? null,
+                where: whereArg ?? null,
+                truncated
               },
               records: records.map((r) => ({
                 timestamp: r.timestamp,
@@ -112219,6 +112261,11 @@ async function runLogs(service, opts) {
         );
         return 0;
       }
+      console.error(
+        import_picocolors27.default.dim(
+          `logs: ${renv.project}/${renv.env}` + (resolvedService ? ` \xB7 service ${resolvedService}` : "") + ` \xB7 from ${fromDisplay} UTC \xB7 level ${rawLevel ?? "all"}` + (hasWhere ? ` \xB7 where ${whereLabel(where)}` : "") + (opts.grep ? ` \xB7 grep "${opts.grep}"` : "") + (rawLevel === "error" && !hasWhere ? "  (error+ only \u2014 use --all-levels for info/debug)" : "")
+        )
+      );
       if (records.length === 0) {
         console.log(import_picocolors27.default.dim("No logs matched."));
         return 0;
@@ -112233,6 +112280,13 @@ async function runLogs(service, opts) {
           console.log(import_picocolors27.default.dim(`    ${key}: ${value.slice(0, 200)}`));
         }
       }
+      if (truncated) {
+        console.error(
+          import_picocolors27.default.yellow(
+            `[warn] showing the first ${limit} record(s) \u2014 results may be truncated. Narrow with --where/--since/--level or raise --limit (max 1000).`
+          )
+        );
+      }
       return 0;
     }
     if (opts.groupBy !== void 0) {
@@ -112242,7 +112296,8 @@ async function runLogs(service, opts) {
           service: resolvedService,
           from,
           text: opts.grep,
-          broadText: opts.grep !== void 0
+          broadText: opts.grep !== void 0,
+          where: whereArg
         },
         field
       );
@@ -112258,6 +112313,7 @@ async function runLogs(service, opts) {
                 from,
                 severity: "error+",
                 grep: opts.grep ?? null,
+                where: whereArg ?? null,
                 groupBy: field
               },
               buckets
@@ -112270,7 +112326,7 @@ async function runLogs(service, opts) {
       }
       console.log(
         import_picocolors27.default.bold(`Top ${field}`) + import_picocolors27.default.dim(
-          ` \u2014 ${renv.project}/${renv.env}` + (resolvedService ? ` \xB7 service ${resolvedService}` : "") + (opts.grep ? ` \xB7 grep "${opts.grep}"` : "")
+          ` \u2014 ${renv.project}/${renv.env}` + (resolvedService ? ` \xB7 service ${resolvedService}` : "") + (opts.grep ? ` \xB7 grep "${opts.grep}"` : "") + (hasWhere ? ` \xB7 where ${whereLabel(where)}` : "")
         )
       );
       console.log(import_picocolors27.default.dim(`  index: ${indexPattern} \xB7 from: ${fromDisplay} UTC \xB7 severity: error+`));
@@ -112291,12 +112347,13 @@ async function runLogs(service, opts) {
       service: resolvedService,
       from,
       text: opts.grep,
-      broadText: opts.grep !== void 0
+      broadText: opts.grep !== void 0,
+      where: whereArg
     });
     let scopeService = resolvedService;
     let broadeningNote;
     if (analysis.signatures.length === 0 && resolvedService !== void 0) {
-      const broader = await logs.analyzeErrors({ from, text: opts.grep, broadText: opts.grep !== void 0 });
+      const broader = await logs.analyzeErrors({ from, text: opts.grep, broadText: opts.grep !== void 0, where: whereArg });
       if (broader.signatures.length > 0) {
         const match = matchServiceLabel(resolvedService, broader.affectedServices);
         if (match.kind === "unique" && match.matched !== void 0 && match.matched !== resolvedService) {
@@ -112304,7 +112361,8 @@ async function runLogs(service, opts) {
             service: match.matched,
             from,
             text: opts.grep,
-            broadText: opts.grep !== void 0
+            broadText: opts.grep !== void 0,
+            where: whereArg
           });
           if (scoped.signatures.length > 0) {
             analysis = scoped;
@@ -112337,7 +112395,8 @@ async function runLogs(service, opts) {
               index: indexPattern,
               from,
               severity: "error+",
-              grep: opts.grep ?? null
+              grep: opts.grep ?? null,
+              where: whereArg ?? null
             },
             totalErrors: analysis.totalErrors,
             signatures: analysis.signatures,
@@ -112352,7 +112411,7 @@ async function runLogs(service, opts) {
     }
     console.log(
       import_picocolors27.default.bold(`Error analysis`) + import_picocolors27.default.dim(
-        ` \u2014 ${renv.project}/${renv.env}` + (scopeService ? ` \xB7 service ${scopeService}` : "") + (opts.grep ? ` \xB7 grep "${opts.grep}"` : "")
+        ` \u2014 ${renv.project}/${renv.env}` + (scopeService ? ` \xB7 service ${scopeService}` : "") + (opts.grep ? ` \xB7 grep "${opts.grep}"` : "") + (hasWhere ? ` \xB7 where ${whereLabel(where)}` : "")
       )
     );
     console.log(import_picocolors27.default.dim(`  index: ${indexPattern} \xB7 from: ${fromDisplay} UTC \xB7 severity: error+`));
@@ -116652,7 +116711,12 @@ Examples:
   });
   program2.command("logs [service]").description(
     "Synthesize error evidence from logs (signatures, first/last, affected services); --raw for lines"
-  ).option("-c, --config <path>", "path to horus.config.ts").option("--name <name>", "registered project name (resolves via the registry)").option("--project <name>", "project name").option("--env <name>", "environment name (e.g. production)").option("--since <when>", "time window, e.g. 24h, 7d, or an ISO date").option("--level <level>", "minimum level (with --raw): trace|debug|info|warn|error|fatal").option("--grep <text>", "match text in the message").option("--raw", "dump individual log lines instead of synthesized evidence (error+ by default)").option("--all-levels", "with --raw: show all severity levels, not just error+").option("--group-by <field>", "aggregate error counts by a context field, e.g. context.brand_id").option("--limit <n>", "max records (with --raw)").option("--json", "output JSON").option("--ai", "append AI narration of error signatures (default mode only, not --raw or --json)").option("--ai-model <model>", "override the AI model (default: claude-opus-4-8)").action(
+  ).option("-c, --config <path>", "path to horus.config.ts").option("--name <name>", "registered project name (resolves via the registry)").option("--project <name>", "project name").option("--env <name>", "environment name (e.g. production)").option("--since <when>", "time window, e.g. 24h, 7d, or an ISO date").option("--level <level>", "minimum level (with --raw): trace|debug|info|warn|error|fatal").option("--grep <text>", "match text in the message").option("--raw", "dump individual log lines instead of synthesized evidence (error+ by default)").option("--all-levels", "with --raw: show all severity levels, not just error+").option("--group-by <field>", "aggregate error counts by a context field, e.g. context.brand_id").option(
+    "--where <field=value>",
+    "filter by a structured context field (repeatable, AND-combined), e.g. --where context.brand_id=42",
+    (val, acc) => [...acc, val],
+    []
+  ).option("--limit <n>", "max records (with --raw)").option("--json", "output JSON").option("--ai", "append AI narration of error signatures (default mode only, not --raw or --json)").option("--ai-model <model>", "override the AI model (default: claude-opus-4-8)").action(
     async (service, opts) => {
       process.exitCode = await runLogs(service, opts);
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@merittdev/horus",
-  "version": "0.8.11",
+  "version": "0.8.12",
   "description": "Local-first, source-aware production-incident investigation engine",
   "type": "module",
   "bin": {