@namzu/sdk 27.0.0 → 28.0.0

package/dist/utils/log/redact.js

@@ -0,0 +1,71 @@
+// Scrubs anything secret-shaped out of a record before any sink sees it.
+//
+// Runs once, in the pipeline, ahead of sink dispatch — not inside
+// jsonLinesSink, and not inside any other individual sink. A scan that only
+// jsonLinesSink ran would leave prettySink (the one `namzu run` actually
+// uses) and every host-supplied sink with no second layer at all, which is
+// the gap a scoped-to-one-sink design would reintroduce: the machine-read
+// path would be the only protected one.
+//
+// This is defence in depth, not the guarantee — the primary control is the
+// output guardrail upstream (`runtime/query/guardrail-presets.ts`) and the
+// allowlist that keeps untrusted text out of attribute values in the first
+// place. A match here means that allowlist already had a hole.
+import { LOG_SECRET_PATTERNS } from '../../constants/secret-patterns.js';
+export function redactRecord(record, counters) {
+    const body = redactString(record.body);
+    const attributes = redactAttributes(record.attributes);
+    if (body === record.body && attributes === record.attributes)
+        return record;
+    counters.redacted++;
+    return { ...record, body, attributes };
+}
+function redactString(text) {
+    let out = text;
+    for (const [label, pattern] of LOG_SECRET_PATTERNS) {
+        // Fresh lastIndex: these are module-level /g regexes, reused across
+        // every record — the same caution guardrail-presets.ts already takes
+        // on the same table.
+        pattern.lastIndex = 0;
+        if (!pattern.test(out))
+            continue;
+        pattern.lastIndex = 0;
+        out = out.replace(pattern, `[REDACTED:${label}]`);
+    }
+    return out;
+}
+function redactAttributes(attributes) {
+    let changed = false;
+    const next = {};
+    for (const [key, value] of Object.entries(attributes)) {
+        const redacted = redactValue(value);
+        if (redacted !== value)
+            changed = true;
+        next[key] = redacted;
+    }
+    return changed ? next : attributes;
+}
+// Strings and arrays of primitives are the shapes `LogAttributes` will
+// eventually restrict values to (a later increment); anything else passes
+// through untouched rather than being stringified, which would be a second,
+// unrelated way for structured data to leak.
+function redactValue(value) {
+    if (typeof value === 'string')
+        return redactString(value);
+    if (Array.isArray(value)) {
+        let changed = false;
+        const next = value.map((entry) => {
+            const redacted = redactValue(entry);
+            if (redacted !== entry)
+                changed = true;
+            return redacted;
+        });
+        // Only allocate a new array when something inside it actually changed —
+        // `.map()` always returns a fresh array, and comparing that fresh
+        // array's reference against the input would mark every array-valued
+        // attribute "redacted" whether or not a pattern ever matched.
+        return changed ? next : value;
+    }
+    return value;
+}
+//# sourceMappingURL=redact.js.map

package/dist/utils/log/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../../src/utils/log/redact.ts"],"names":[],"mappings":"AAAA,yEAAyE;AACzE,EAAE;AACF,kEAAkE;AAClE,4EAA4E;AAC5E,yEAAyE;AACzE,2EAA2E;AAC3E,0EAA0E;AAC1E,wCAAwC;AACxC,EAAE;AACF,2EAA2E;AAC3E,2EAA2E;AAC3E,2EAA2E;AAC3E,+DAA+D;AAE/D,OAAO,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAA;AAGxE,MAAM,UAAU,YAAY,CAAC,MAAiB,EAAE,QAAgC;IAC/E,MAAM,IAAI,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;IACtC,MAAM,UAAU,GAAG,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;IAEtD,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI,IAAI,UAAU,KAAK,MAAM,CAAC,UAAU;QAAE,OAAO,MAAM,CAAA;IAE3E,QAAQ,CAAC,QAAQ,EAAE,CAAA;IACnB,OAAO,EAAE,GAAG,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,CAAA;AACvC,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IACjC,IAAI,GAAG,GAAG,IAAI,CAAA;IACd,KAAK,MAAM,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,mBAAmB,EAAE,CAAC;QACpD,oEAAoE;QACpE,qEAAqE;QACrE,qBAAqB;QACrB,OAAO,CAAC,SAAS,GAAG,CAAC,CAAA;QACrB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,SAAQ;QAChC,OAAO,CAAC,SAAS,GAAG,CAAC,CAAA;QACrB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,aAAa,KAAK,GAAG,CAAC,CAAA;IAClD,CAAC;IACD,OAAO,GAAG,CAAA;AACX,CAAC;AAED,SAAS,gBAAgB,CACxB,UAA6C;IAE7C,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,MAAM,IAAI,GAA4B,EAAE,CAAA;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACvD,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;QACnC,IAAI,QAAQ,KAAK,KAAK;YAAE,OAAO,GAAG,IAAI,CAAA;QACtC,IAAI,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAA;IACrB,CAAC;IACD,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAA;AACnC,CAAC;AAED,uEAAuE;AACvE,0EAA0E;AAC1E,4EAA4E;AAC5E,6CAA6C;AAC7C,SAAS,WAAW,CAAC,KAAc;IAClC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,KAAK,CAAC,CAAA;IAEzD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,IAAI,OAAO,GAAG,KAAK,CAAA;QACnB,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;YAChC,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAA;YACnC,IAAI,QAAQ,KAAK,KAAK;gBAAE,OAAO,GAAG,IAAI,CAAA;YACtC,OAAO,QAAQ,CAAA;QAChB,CAAC,CAAC,CAAA;QACF,wEAAwE;QACxE,kEAAkE;QAClE,oEAAoE;QACpE,8DAA8D;QAC9D,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAA;IAC9B,CAAC;IAED,OAAO,KAAK,CAAA;AACb,CAAC"}

package/dist/utils/log/sinks.d.ts

@@ -0,0 +1,43 @@
+import type { LogSink } from './types.js';
+/**
+ * Delivers nothing, by construction. `createLogger`'s dispatch identity-
+ * checks the configured sink against this exact reference and counts the
+ * record as dropped rather than calling `emit` — a no-op `emit` and a real
+ * delivery both return `undefined`, so without the identity check nothing
+ * downstream could ever tell "configured to discard" from "silently eating
+ * every record".
+ */
+export declare const NOOP_SINK: LogSink;
+/**
+ * One JSON object per line — the canonical wire format for the machine-read
+ * path (`namzu run-stream`'s stderr). JSON string-escaping neutralises
+ * `\n`/`\r` by construction, closing the log-forging surface without a
+ * single character-stripping call site, which is bypassable anyway.
+ *
+ * `JSON.stringify` leaves U+2028 and U+2029 literal in its output, and some
+ * readers — older V8, some log shippers — treat either codepoint as a line
+ * terminator regardless of the JSON quoting around it. Escaped here so a
+ * record can never masquerade as two lines to a reader that split on them.
+ */
+export declare function jsonLinesSink(stream: NodeJS.WritableStream): LogSink;
+/**
+ * Human-readable line, one record per line — the boot narrative's renderer.
+ *
+ * Three things it does that a generic sink does not, each answering a
+ * specific half of "the logs tell me nothing":
+ *
+ * - **`+Nms` instead of an absolute timestamp.** Elapsed since the previous
+ *   record ON THIS SINK, so the column reads as which phase was slow. The
+ *   state is a closure variable rather than module-level: two sinks in one
+ *   process each measure their own stream, and a shared `lastTimestamp`
+ *   would make each one's deltas depend on the other's traffic.
+ * - **A fixed-width scope column, coloured by a stable hash.** A dozen
+ *   module initialisations read as structure rather than scroll.
+ * - **A template per boot event**, so `info` shows the two attributes that
+ *   matter rather than all forty as JSON.
+ *
+ * Colour is emitted only when the stream reports `isTTY`, so a redirected
+ * log has no escape bytes in it at all.
+ */
+export declare function prettySink(stream: NodeJS.WritableStream): LogSink;
+//# sourceMappingURL=sinks.d.ts.map

package/dist/utils/log/sinks.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sinks.d.ts","sourceRoot":"","sources":["../../../src/utils/log/sinks.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAa,OAAO,EAAE,MAAM,YAAY,CAAA;AAEpD;;;;;;;GAOG;AACH,eAAO,MAAM,SAAS,EAAE,OAEvB,CAAA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,GAAG,OAAO,CAkBpE;AA2ED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC,cAAc,GAAG,OAAO,CA8DjE"}

package/dist/utils/log/sinks.js

@@ -0,0 +1,184 @@
+// Built-in sinks. All three receive already-redacted, already-capped
+// records — see redact.ts and caps.ts — so nothing here re-implements
+// either concern; a sink's only job is to render.
+import { applyTemplate, columnLabel, scopeColour } from './templates.js';
+/**
+ * Delivers nothing, by construction. `createLogger`'s dispatch identity-
+ * checks the configured sink against this exact reference and counts the
+ * record as dropped rather than calling `emit` — a no-op `emit` and a real
+ * delivery both return `undefined`, so without the identity check nothing
+ * downstream could ever tell "configured to discard" from "silently eating
+ * every record".
+ */
+export const NOOP_SINK = {
+    emit() { },
+};
+/**
+ * One JSON object per line — the canonical wire format for the machine-read
+ * path (`namzu run-stream`'s stderr). JSON string-escaping neutralises
+ * `\n`/`\r` by construction, closing the log-forging surface without a
+ * single character-stripping call site, which is bypassable anyway.
+ *
+ * `JSON.stringify` leaves U+2028 and U+2029 literal in its output, and some
+ * readers — older V8, some log shippers — treat either codepoint as a line
+ * terminator regardless of the JSON quoting around it. Escaped here so a
+ * record can never masquerade as two lines to a reader that split on them.
+ */
+export function jsonLinesSink(stream) {
+    return {
+        emit(record) {
+            // U+2028/U+2029 built via fromCharCode rather than a \u escape in a
+            // regex literal — either escape, typed directly, risks becoming the raw
+            // codepoint again instead of the six characters of escape text; a raw
+            // U+2028/U+2029 inside a regex literal is a LineTerminator to the JS
+            // parser itself and fails to compile.
+            const lineSeparator = String.fromCharCode(0x2028);
+            const paragraphSeparator = String.fromCharCode(0x2029);
+            const line = JSON.stringify(record)
+                .split(lineSeparator)
+                .join('\\u2028')
+                .split(paragraphSeparator)
+                .join('\\u2029');
+            stream.write(`${line}\n`);
+        },
+    };
+}
+const SEVERITY_LABEL = {
+    debug: 'DEBUG',
+    info: 'INFO',
+    warn: 'WARN',
+    error: 'ERROR',
+};
+// Every C0 control byte (0x00-0x1F) and DEL (0x7F) becomes its `\xNN`
+// form — ESC included, so a full ANSI CSI/OSC sequence survives as inert,
+// readable text (`\x1b[31m`) rather than as live bytes a terminal would
+// act on. Deleting the escape byte outright was the first draft of this
+// function and is worse: it silently drops information (nothing in the
+// output says an escape sequence was even there) for no extra safety
+// over converting it to text, since every OTHER control byte already gets
+// the same visible treatment.
+// `body` and `scope` reach this renderer as plain strings with no upstream
+// guarantee yet that either is a constant (that lands with the CI gate in
+// later work) — a remote MCP server that names itself an escape sequence
+// erasing the previous line and printing a fake refusal is a real forging
+// attempt against the terminal `namzu run` writes to today, not a
+// hypothetical one.
+// biome-ignore lint/suspicious/noControlCharactersInRegex: this pattern IS the control-character filter — the escapes below are ASCII text (`\x00`-`\x1F`, `\x7F`), not raw bytes pasted into the source.
+const CONTROL_BYTE = /[\x00-\x1F\x7F]/g;
+// U+2028 (LINE SEPARATOR) and U+2029 (PARAGRAPH SEPARATOR) are not ASCII
+// control bytes, so CONTROL_BYTE above never matches either — but both are
+// LineTerminator characters to a reader that splits on them, the exact gap
+// jsonLinesSink above documents and closes for its own NDJSON output.
+// `JSON.stringify` does not escape either codepoint, so the attribute half
+// of a record — which reaches this file as already-serialized JSON text,
+// below — can still carry either straight through unescaped. Built via
+// `fromCharCode` and plain `.split()/.join()` rather than a backslash-u
+// escape in a regex literal, for the same reason jsonLinesSink's own
+// separators are: typed directly, either escape risks becoming the raw
+// codepoint again instead of the six characters of escape text, and a raw
+// instance of either inside a regex literal is a LineTerminator to the JS
+// parser itself and fails to compile.
+const LINE_SEPARATOR = String.fromCharCode(0x2028);
+const PARAGRAPH_SEPARATOR = String.fromCharCode(0x2029);
+function escapeForDisplay(text) {
+    return text
+        .replace(CONTROL_BYTE, (byte) => `\\x${byte.charCodeAt(0).toString(16).padStart(2, '0')}`)
+        .split(LINE_SEPARATOR)
+        .join('\\u2028')
+        .split(PARAGRAPH_SEPARATOR)
+        .join('\\u2029');
+}
+/** Column width for the scope label. Long labels overflow rather than truncate. */
+const SCOPE_WIDTH = 12;
+/**
+ * The marker between the scope column and the body.
+ *
+ * A glyph rather than a `[WARN]` label, because at `info` the overwhelming
+ * majority of boot lines are ordinary and a label on each one is the wall
+ * this renderer exists to remove. The two that are not ordinary have to be
+ * findable by eye in a column, which a bracketed word at variable position
+ * is not.
+ */
+const MARKER = {
+    debug: ' ',
+    info: ' ',
+    warn: '!',
+    error: '✗',
+};
+/** `+Nms`, left-padded so the numbers line up in a column. */
+function elapsedColumn(deltaMs) {
+    return `+${deltaMs}ms`.padStart(7);
+}
+/**
+ * Human-readable line, one record per line — the boot narrative's renderer.
+ *
+ * Three things it does that a generic sink does not, each answering a
+ * specific half of "the logs tell me nothing":
+ *
+ * - **`+Nms` instead of an absolute timestamp.** Elapsed since the previous
+ *   record ON THIS SINK, so the column reads as which phase was slow. The
+ *   state is a closure variable rather than module-level: two sinks in one
+ *   process each measure their own stream, and a shared `lastTimestamp`
+ *   would make each one's deltas depend on the other's traffic.
+ * - **A fixed-width scope column, coloured by a stable hash.** A dozen
+ *   module initialisations read as structure rather than scroll.
+ * - **A template per boot event**, so `info` shows the two attributes that
+ *   matter rather than all forty as JSON.
+ *
+ * Colour is emitted only when the stream reports `isTTY`, so a redirected
+ * log has no escape bytes in it at all.
+ */
+export function prettySink(stream) {
+    // Per-instance, deliberately. See the note above.
+    let previousTimestamp;
+    // Read once. A stream does not become a TTY part-way through a process,
+    // and re-reading per record would let a mid-run reassignment change the
+    // shape of a file somebody is already tailing.
+    const colour = stream.isTTY === true;
+    return {
+        emit(record) {
+            // Seeded from the FIRST record rather than from sink construction,
+            // so the first line is `+0ms` and not however long the process
+            // spent before anything was logged — which is not a phase anybody
+            // can act on.
+            const delta = previousTimestamp === undefined ? 0 : record.timestamp - previousTimestamp;
+            previousTimestamp = record.timestamp;
+            const label = escapeForDisplay(columnLabel(record));
+            const templated = applyTemplate(record);
+            const marker = MARKER[record.severityText];
+            if (templated !== undefined) {
+                const painted = colour ? `\x1b[${scopeColour(label)}m${label}\x1b[0m` : label;
+                // Padding is computed from the UNPAINTED label: the escape
+                // bytes have no width on screen but do have length in a string,
+                // so padding the painted form shortens every coloured column by
+                // exactly the length of its escape sequence.
+                const pad = ' '.repeat(Math.max(1, SCOPE_WIDTH - label.length));
+                stream.write(`  ${elapsedColumn(delta)}  ${painted}${pad}${marker} ${escapeForDisplay(templated)}\n`);
+                return;
+            }
+            // Everything that is not a boot event keeps the original shape.
+            // A record from a foreign vocabulary has no template to be right
+            // about, and inventing a column layout for it would drop the
+            // attributes it does carry.
+            const timestamp = new Date(record.timestamp).toISOString();
+            const level = SEVERITY_LABEL[record.severityText];
+            const scope = escapeForDisplay(record.scope.name);
+            const body = escapeForDisplay(record.body);
+            // JSON.stringify turns every ASCII control byte 0x00-0x1F — ESC
+            // included — into literal `\uXXXX` text inside each attribute value,
+            // but it does not touch DEL (0x7F) or U+2028/U+2029: none of the
+            // three are in JSON's mandatory escape set, so all three used to
+            // reach this stream exactly as JSON.stringify left them — DEL as a
+            // raw byte, U+2028/U+2029 as raw codepoints — the same gap
+            // jsonLinesSink already closed on its own path, just left open
+            // here. Running escapeForDisplay over the already-serialized JSON
+            // text closes it: every OTHER control byte JSON.stringify already
+            // turned into backslash text has no raw byte left for the regex to
+            // match, so this only ever touches the three it left behind.
+            const attributeKeys = Object.keys(record.attributes);
+            const attributes = attributeKeys.length > 0 ? ` ${escapeForDisplay(JSON.stringify(record.attributes))}` : '';
+            stream.write(`[${timestamp}] [${level}] [${scope}] ${body}${attributes}\n`);
+        },
+    };
+}
+//# sourceMappingURL=sinks.js.map

package/dist/utils/log/sinks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sinks.js","sourceRoot":"","sources":["../../../src/utils/log/sinks.ts"],"names":[],"mappings":"AAAA,qEAAqE;AACrE,sEAAsE;AACtE,kDAAkD;AAElD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,gBAAgB,CAAA;AAGxE;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,SAAS,GAAY;IACjC,IAAI,KAAI,CAAC;CACT,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,MAA6B;IAC1D,OAAO;QACN,IAAI,CAAC,MAAiB;YACrB,oEAAoE;YACpE,wEAAwE;YACxE,sEAAsE;YACtE,qEAAqE;YACrE,sCAAsC;YACtC,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YACjD,MAAM,kBAAkB,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;YACtD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;iBACjC,KAAK,CAAC,aAAa,CAAC;iBACpB,IAAI,CAAC,SAAS,CAAC;iBACf,KAAK,CAAC,kBAAkB,CAAC;iBACzB,IAAI,CAAC,SAAS,CAAC,CAAA;YACjB,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAA;QAC1B,CAAC;KACD,CAAA;AACF,CAAC;AAED,MAAM,cAAc,GAA8C;IACjE,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,KAAK,EAAE,OAAO;CACd,CAAA;AAED,sEAAsE;AACtE,0EAA0E;AAC1E,wEAAwE;AACxE,wEAAwE;AACxE,uEAAuE;AACvE,qEAAqE;AACrE,0EAA0E;AAC1E,8BAA8B;AAC9B,2EAA2E;AAC3E,0EAA0E;AAC1E,yEAAyE;AACzE,0EAA0E;AAC1E,kEAAkE;AAClE,oBAAoB;AACpB,0MAA0M;AAC1M,MAAM,YAAY,GAAG,kBAAkB,CAAA;AAEvC,yEAAyE;AACzE,2EAA2E;AAC3E,2EAA2E;AAC3E,sEAAsE;AACtE,2EAA2E;AAC3E,yEAAyE;AACzE,uEAAuE;AACvE,wEAAwE;AACxE,qEAAqE;AACrE,uEAAuE;AACvE,0EAA0E;AAC1E,0EAA0E;AAC1E,sCAAsC;AACtC,MAAM,cAAc,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;AAClD,MAAM,mBAAmB,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAA;AAEvD,SAAS,gBAAgB,CAAC,IAAY;IACrC,OAAO,IAAI;SACT,OAAO,CAAC,YAAY,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;SACzF,KAAK,CAAC,cAAc,CAAC;SACrB,IAAI,CAAC,SAAS,CAAC;SACf,KAAK,CAAC,mBAAmB,CAAC;SAC1B,IAAI,CAAC,SAAS,CAAC,CAAA;AAClB,CAAC;AAED,mFAAmF;AACnF,MAAM,WAAW,GAAG,EAAE,CAAA;AAEtB;;;;;;;;GAQG;AACH,MAAM,MAAM,GAA8C;IACzD,KAAK,EAAE,GAAG;IACV,IAAI,EAAE,GAAG;IACT,IAAI,EAAE,GAAG;IACT,KAAK,EAAE,GAAG;CACV,CAAA;AAED,8DAA8D;AAC9D,SAAS,aAAa,CAAC,OAAe;IACrC,OAAO,IAAI,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;AACnC,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,UAAU,CAAC,MAA6B;IACvD,kDAAkD;IAClD,IAAI,iBAAqC,CAAA;IAEzC,wEAAwE;IACxE,wEAAwE;IACxE,+CAA+C;IAC/C,MAAM,MAAM,GAAI,MAA6B,CAAC,KAAK,KAAK,IAAI,CAAA;IAE5D,OAAO;QACN,IAAI,CAAC,MAAiB;YACrB,mEAAmE;YACnE,+DAA+D;YAC/D,kEAAkE;YAClE,cAAc;YACd,MAAM,KAAK,GAAG,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,GAAG,iBAAiB,CAAA;YACxF,iBAAiB,GAAG,MAAM,CAAC,SAAS,CAAA;YAEpC,MAAM,KAAK,GAAG,gBAAgB,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAA;YACnD,MAAM,SAAS,GAAG,aAAa,CAAC,MAAM,CAAC,CAAA;YACvC,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;YAE1C,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;gBAC7B,MAAM,OAAO,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,WAAW,CAAC,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC7E,2DAA2D;gBAC3D,gEAAgE;gBAChE,gEAAgE;gBAChE,6CAA6C;gBAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAA;gBAC/D,MAAM,CAAC,KAAK,CACX,KAAK,aAAa,CAAC,KAAK,CAAC,KAAK,OAAO,GAAG,GAAG,GAAG,MAAM,IAAI,gBAAgB,CAAC,SAAS,CAAC,IAAI,CACvF,CAAA;gBACD,OAAM;YACP,CAAC;YAED,gEAAgE;YAChE,iEAAiE;YACjE,6DAA6D;YAC7D,4BAA4B;YAC5B,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAA;YAC1D,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,CAAC,YAAY,CAAC,CAAA;YACjD,MAAM,KAAK,GAAG,gBAAgB,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;YACjD,MAAM,IAAI,GAAG,gBAAgB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;YAE1C,gEAAgE;YAChE,qEAAqE;YACrE,iEAAiE;YACjE,iEAAiE;YACjE,mEAAmE;YACnE,2DAA2D;YAC3D,+DAA+D;YAC/D,kEAAkE;YAClE,kEAAkE;YAClE,mEAAmE;YACnE,6DAA6D;YAC7D,MAAM,aAAa,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,CAAA;YACpD,MAAM,UAAU,GACf,aAAa,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAA;YAE1F,MAAM,CAAC,KAAK,CAAC,IAAI,SAAS,MAAM,KAAK,MAAM,KAAK,KAAK,IAAI,GAAG,UAAU,IAAI,CAAC,CAAA;QAC5E,CAAC;KACD,CAAA;AACF,CAAC"}

package/dist/utils/log/templates.d.ts

@@ -0,0 +1,63 @@
+import { type BootEventName } from '../../constants/telemetry/index.js';
+import type { LogRecord } from './types.js';
+/**
+ * How a boot record is turned into one readable line.
+ *
+ * The complaint this exists to answer is that the logs say nothing when the
+ * project starts. A record already carries everything — the problem is the
+ * shape it arrives in: an absolute ISO timestamp nobody can subtract in
+ * their head, and every attribute dumped as JSON, so the two facts that
+ * matter sit inside forty that do not.
+ *
+ * Two things fix most of it, and neither is a freebie of a generic sink.
+ * The `+Nms` column turns a wall of timestamps into a readout of which
+ * phase was slow. And a template per event decides which attributes are
+ * worth a line at `info`, instead of printing all of them.
+ *
+ * **Display only.** Nothing here may mutate a record, and no machine-read
+ * path sees any of it — `jsonLinesSink` renders the same records
+ * byte-identically whether or not this file is loaded.
+ */
+/**
+ * A template returns the text after the marker, or `undefined` to fall
+ * through to the default rendering.
+ *
+ * It receives the record rather than just the attributes because several
+ * lines are the body with two attributes appended, and re-deriving the body
+ * from attributes would let the rendered line disagree with what the
+ * emitter actually said.
+ */
+export type BootTemplate = (record: LogRecord) => string | undefined;
+/**
+ * One template per boot event, as a TOTAL map over the union.
+ *
+ * `Record<BootEventName, …>` rather than `Partial<…>` on purpose: adding a
+ * member to `BOOT_EVENT_NAMES` then fails to compile here until somebody
+ * decides how it should read. A partial map would let a new event silently
+ * fall through to the default dump, which is the exact outcome this file
+ * exists to prevent — and nothing would fail.
+ */
+export declare const BOOT_TEMPLATES: Record<BootEventName, BootTemplate>;
+/**
+ * The column label: `namzu.config.resolved` reads as `config`.
+ *
+ * Derived from the event name rather than `scope.name` because the scope of
+ * every one of these is the process that emitted it — `cli` for all eleven —
+ * which would make the column a constant and buy nothing. A record with no
+ * event name keeps its scope, which is the only thing it has.
+ */
+export declare function columnLabel(record: LogRecord): string;
+/** The rendered body for a record, or `undefined` to use the default. */
+export declare function applyTemplate(record: LogRecord): string | undefined;
+/**
+ * FNV-1a, written out rather than imported.
+ *
+ * The requirement is that the same scope gets the same colour in a
+ * different process on a different day, so nothing here may touch process
+ * state — no `Math.random`, no insertion order, no `Date`. Written out
+ * because a dependency could change its algorithm in a patch release and
+ * every colour in every terminal would move at once, for a bump nobody
+ * reviewed as a display change.
+ */
+export declare function scopeColour(scope: string): number;
+//# sourceMappingURL=templates.d.ts.map

package/dist/utils/log/templates.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.d.ts","sourceRoot":"","sources":["../../../src/utils/log/templates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,oCAAoC,CAAA;AACzF,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAA;AAE3C;;;;;;;;;;;;;;;;;GAiBG;AAEH;;;;;;;;GAQG;AACH,MAAM,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,SAAS,KAAK,MAAM,GAAG,SAAS,CAAA;AA+BpE;;;;;;;;GAQG;AACH,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,aAAa,EAAE,YAAY,CA2B9D,CAAA;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,CAQrD;AAID,yEAAyE;AACzE,wBAAgB,aAAa,CAAC,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,SAAS,CAInE;AAeD;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUjD"}

package/dist/utils/log/templates.js

@@ -0,0 +1,119 @@
+import { BOOT_EVENT_NAMES } from '../../constants/telemetry/index.js';
+function attr(record, key) {
+    const value = record.attributes[key];
+    if (value === undefined || value === null)
+        return undefined;
+    return typeof value === 'string' ? value : JSON.stringify(value);
+}
+/** `a · b · c`, skipping anything absent, or `undefined` if all are. */
+function joined(parts) {
+    const kept = parts.filter((p) => p !== undefined && p !== '');
+    return kept.length > 0 ? kept.join(' · ') : undefined;
+}
+/** The body, with a `key=value` tail for the named attributes that exist. */
+function bodyWith(record, keys) {
+    const tail = keys
+        .map((key) => {
+        const value = attr(record, key);
+        return value === undefined ? undefined : `${shortKey(key)}=${value}`;
+    })
+        .filter((p) => p !== undefined);
+    return tail.length > 0 ? `${record.body}  ${tail.join(' ')}` : record.body;
+}
+/** `namzu.config.key.count` reads as `count` in a column already labelled `config`. */
+function shortKey(key) {
+    const parts = key.split('.');
+    return parts[parts.length - 1] ?? key;
+}
+/**
+ * One template per boot event, as a TOTAL map over the union.
+ *
+ * `Record<BootEventName, …>` rather than `Partial<…>` on purpose: adding a
+ * member to `BOOT_EVENT_NAMES` then fails to compile here until somebody
+ * decides how it should read. A partial map would let a new event silently
+ * fall through to the default dump, which is the exact outcome this file
+ * exists to prevent — and nothing would fail.
+ */
+export const BOOT_TEMPLATES = {
+    [BOOT_EVENT_NAMES.BOOT_START]: (r) => bodyWith(r, ['namzu.boot.cwd', 'namzu.boot.argv']),
+    [BOOT_EVENT_NAMES.CONFIG_RESOLVED]: (r) => joined([r.body, attr(r, 'namzu.config.key.count'), attr(r, 'namzu.config.sources')]),
+    [BOOT_EVENT_NAMES.SANDBOX_RESOLVED]: (r) => bodyWith(r, ['namzu.sandbox.backend', 'namzu.sandbox.enforces']),
+    [BOOT_EVENT_NAMES.PROVIDER_RESOLVED]: (r) => bodyWith(r, ['namzu.provider.chain', 'namzu.provider.constructed']),
+    [BOOT_EVENT_NAMES.CAPABILITY_DETECTED]: (r) => bodyWith(r, ['namzu.capability.name']),
+    [BOOT_EVENT_NAMES.CAPABILITY_BROKEN]: (r) => bodyWith(r, ['namzu.capability.name', 'namzu.capability.reason']),
+    [BOOT_EVENT_NAMES.TELEMETRY_STATUS]: (r) => r.body,
+    // `kind`, not `root`. This asked for `namzu.migration.root`, which NOTHING
+    // has ever written — neither `loggingMigrationSink` nor the
+    // nothing-to-do branch in `runtime/query/index.ts` — so the operator's
+    // migration line rendered the body and appended an empty string. `kind`
+    // is the fact worth seeing: migrated, already_migrated, or noop_no_legacy.
+    [BOOT_EVENT_NAMES.MIGRATION_COMPLETED]: (r) => bodyWith(r, ['namzu.migration.kind']),
+    [BOOT_EVENT_NAMES.DISCOVERY_COMPLETED]: (r) => joined([
+        r.body,
+        attr(r, 'namzu.discovery.plugins'),
+        attr(r, 'namzu.discovery.skills'),
+        attr(r, 'namzu.discovery.connectors'),
+    ]),
+    [BOOT_EVENT_NAMES.BOOT_REFUSED]: (r) => bodyWith(r, ['namzu.boot.refusal.reason']),
+    [BOOT_EVENT_NAMES.BOOT_READY]: (r) => bodyWith(r, ['namzu.boot.duration.ms']),
+};
+/**
+ * The column label: `namzu.config.resolved` reads as `config`.
+ *
+ * Derived from the event name rather than `scope.name` because the scope of
+ * every one of these is the process that emitted it — `cli` for all eleven —
+ * which would make the column a constant and buy nothing. A record with no
+ * event name keeps its scope, which is the only thing it has.
+ */
+export function columnLabel(record) {
+    const name = record.eventName;
+    if (!name)
+        return record.scope.name;
+    const parts = name.split('.');
+    // `namzu.<area>.<verb>` → `<area>`; anything else keeps its whole name so
+    // a foreign vocabulary is not silently truncated into a wrong label.
+    if (parts.length === 3 && parts[0] === 'namzu')
+        return parts[1];
+    return name;
+}
+const BOOT_EVENT_SET = new Set(Object.values(BOOT_EVENT_NAMES));
+/** The rendered body for a record, or `undefined` to use the default. */
+export function applyTemplate(record) {
+    const name = record.eventName;
+    if (!name || !BOOT_EVENT_SET.has(name))
+        return undefined;
+    return BOOT_TEMPLATES[name](record);
+}
+// ─── the scope column's colour ───────────────────────────────────────────
+/**
+ * Eight ANSI foreground colours, pinned here.
+ *
+ * Not 256-colour and not truecolour: this has to be legible on a default
+ * terminal profile, and the bright/dim variants of these eight are the only
+ * ones a user's own theme is guaranteed to have already made readable
+ * against their background. Black and white are absent because one of the
+ * two disappears on any given background.
+ */
+const PALETTE = [31, 32, 33, 34, 35, 36, 91, 92];
+/**
+ * FNV-1a, written out rather than imported.
+ *
+ * The requirement is that the same scope gets the same colour in a
+ * different process on a different day, so nothing here may touch process
+ * state — no `Math.random`, no insertion order, no `Date`. Written out
+ * because a dependency could change its algorithm in a patch release and
+ * every colour in every terminal would move at once, for a bump nobody
+ * reviewed as a display change.
+ */
+export function scopeColour(scope) {
+    let hash = 0x811c9dc5;
+    for (let i = 0; i < scope.length; i++) {
+        hash ^= scope.charCodeAt(i);
+        // `Math.imul` keeps this in 32-bit integer space; `hash * 16777619`
+        // exceeds 2^53 and starts losing low bits, which is where a hash
+        // stops distributing.
+        hash = Math.imul(hash, 0x01000193);
+    }
+    return PALETTE[Math.abs(hash) % PALETTE.length];
+}
+//# sourceMappingURL=templates.js.map

package/dist/utils/log/templates.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"templates.js","sourceRoot":"","sources":["../../../src/utils/log/templates.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAsB,MAAM,oCAAoC,CAAA;AAiCzF,SAAS,IAAI,CAAC,MAAiB,EAAE,GAAW;IAC3C,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;IACpC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAA;IAC3D,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAA;AACjE,CAAC;AAED,wEAAwE;AACxE,SAAS,MAAM,CAAC,KAA6B;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,EAAE,CAAC,CAAA;IAC1E,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AACtD,CAAC;AAED,6EAA6E;AAC7E,SAAS,QAAQ,CAAC,MAAiB,EAAE,IAAc;IAClD,MAAM,IAAI,GAAG,IAAI;SACf,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QACZ,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;QAC/B,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,EAAE,CAAA;IACrE,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAA;IAC7C,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAA;AAC3E,CAAC;AAED,uFAAuF;AACvF,SAAS,QAAQ,CAAC,GAAW;IAC5B,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC5B,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,CAAA;AACtC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,cAAc,GAAwC;IAClE,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,CAAC,CAAC;IACxF,CAAC,gBAAgB,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CACzC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,EAAE,wBAAwB,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAAC,CAAC;IACrF,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAC1C,QAAQ,CAAC,CAAC,EAAE,CAAC,uBAAuB,EAAE,wBAAwB,CAAC,CAAC;IACjE,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3C,QAAQ,CAAC,CAAC,EAAE,CAAC,sBAAsB,EAAE,4BAA4B,CAAC,CAAC;IACpE,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,uBAAuB,CAAC,CAAC;IACrF,CAAC,gBAAgB,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAC3C,QAAQ,CAAC,CAAC,EAAE,CAAC,uBAAuB,EAAE,yBAAyB,CAAC,CAAC;IAClE,CAAC,gBAAgB,CAAC,gBAAgB,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI;IAClD,2EAA2E;IAC3E,4DAA4D;IAC5D,uEAAuE;IACvE,wEAAwE;IACxE,2EAA2E;IAC3E,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,sBAAsB,CAAC,CAAC;IACpF,CAAC,gBAAgB,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAC7C,MAAM,CAAC;QACN,CAAC,CAAC,IAAI;QACN,IAAI,CAAC,CAAC,EAAE,yBAAyB,CAAC;QAClC,IAAI,CAAC,CAAC,EAAE,wBAAwB,CAAC;QACjC,IAAI,CAAC,CAAC,EAAE,4BAA4B,CAAC;KACrC,CAAC;IACH,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,2BAA2B,CAAC,CAAC;IAClF,CAAC,gBAAgB,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,wBAAwB,CAAC,CAAC;CAC7E,CAAA;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,MAAiB;IAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAA;IAC7B,IAAI,CAAC,IAAI;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAA;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC7B,0EAA0E;IAC1E,qEAAqE;IACrE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC,CAAC,CAAW,CAAA;IACzE,OAAO,IAAI,CAAA;AACZ,CAAC;AAED,MAAM,cAAc,GAAwB,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAA;AAEpF,yEAAyE;AACzE,MAAM,UAAU,aAAa,CAAC,MAAiB;IAC9C,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAA;IAC7B,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAA;IACxD,OAAO,cAAc,CAAC,IAAqB,CAAC,CAAC,MAAM,CAAC,CAAA;AACrD,CAAC;AAED,4EAA4E;AAE5E;;;;;;;;GAQG;AACH,MAAM,OAAO,GAAG,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAU,CAAA;AAEzD;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CAAC,KAAa;IACxC,IAAI,IAAI,GAAG,UAAU,CAAA;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,IAAI,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAC3B,oEAAoE;QACpE,iEAAiE;QACjE,sBAAsB;QACtB,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,CAAW,CAAA;AAC1D,CAAC"}