@skrr-ai/cli 0.1.92 → 0.1.93

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/computerWire.d.ts

@@ -151,6 +151,14 @@ export declare const DAEMON_COMPUTER_EVENTS: {
      * `computer_declared_services_v1`.
      */
     readonly services: "daemon:computer:services";
+    /**
+     * Read the tail of the daemon's OWN process log (a bounded, redacted copy of
+     * what its logger wrote since it started), for the owner who asks why their
+     * machine reconnected. Carries a `requestId` and the principal the API
+     * authorized (`observe`); the daemon checks the principal against the grant
+     * set it holds. Needs `computer_daemon_log_v1`.
+     */
+    readonly daemonLog: "daemon:computer:log";
     /** The answer to any request that carried a `requestId`. */
     readonly ack: "daemon:computer:ack";
     readonly manifest: "daemon:computer:manifest";
@@ -295,6 +303,15 @@ export declare const COMPUTER_CAPABILITIES: {
      * browser; nothing is proxied to it. Announced by the relay that serves it.
      */
     readonly declaredServices: "computer_declared_services_v1";
+    /**
+     * The daemon serves the tail of its own process log
+     * (`daemon:computer:log`): an in-memory ring of lines its logger
+     * wrote, redacted before they enter the ring, read at the `watch` tier. It
+     * is NOT syslog or the journal and never reads either. Announced by the relay
+     * that serves it; a personal machine's daemon announces it too and refuses
+     * the read `consent_missing` until `skrr computer allow`.
+     */
+    readonly daemonLog: "computer_daemon_log_v1";
     /**
      * The page follows the controlling window (§6.2 "a stable viewport", §7.1,
      * OSK-13808): a browser `viewport` input, sent only by the attachment that
@@ -1080,3 +1097,54 @@ export declare function computerPowerPhaseForLeaseState(state: unknown): Compute
 export declare function computerShowsDesktop(phase: ComputerPowerPhase): boolean;
 /** Power actions are offered for a Dedicated Runtime only; a personal machine has none (§18). */
 export declare function computerOffersPowerActions(machineKind: ComputerMachineKind): boolean;
+/**
+ * Why the daemon's log is a wire feature at all: the tenant uid on a Dedicated
+ * Runtime guest cannot read syslog or the journal, so an owner could not see
+ * why their machine's daemon reconnected or failed. The daemon keeps the last
+ * lines its OWN logger wrote in memory and serves them; it opens no file and no
+ * system log for this.
+ */
+export declare const COMPUTER_DAEMON_LOG_LEVELS: readonly ["trace", "debug", "info", "warn", "error"];
+export type ComputerDaemonLogLevel = (typeof COMPUTER_DAEMON_LOG_LEVELS)[number];
+/** Every bound is the daemon's to enforce and the API's to validate against. */
+export declare const COMPUTER_DAEMON_LOG_LIMITS: {
+    /** Lines the daemon keeps in memory; older ones fall off the front. */
+    readonly ringLines: 2000;
+    /** A line longer than this is cut and marked, never kept whole. */
+    readonly lineChars: 1000;
+    /** Lines returned when the caller names none. */
+    readonly defaultLines: 100;
+    /** The most lines one answer carries. */
+    readonly maxLines: 500;
+    /** The most bytes (UTF-8) one answer's text carries; far under the 1 MiB SSE frame. */
+    readonly maxBytes: number;
+    /** The longest look-back a `sinceMs` may ask for (24 h; the ring is shorter anyway). */
+    readonly maxSinceMs: number;
+    /** Requests the daemon answers per `rateWindowMs`; one more is `rate_limited`. */
+    readonly rateMax: 30;
+    readonly rateWindowMs: number;
+};
+/** One line of the daemon's log as it leaves the daemon: redacted, time and level split out. */
+export interface ComputerDaemonLogLine {
+    /** Epoch milliseconds the daemon wrote it. */
+    at: number;
+    level: ComputerDaemonLogLevel;
+    text: string;
+}
+/**
+ * The answer to `daemon:computer:log`. `lines` are oldest first, at most
+ * the asked number of the NEWEST that match. `truncated` is true when more
+ * matched than were returned (by count or bytes); `ringFull` is true when the
+ * ring has already dropped older lines, so "no line before this" does not mean
+ * "the daemon logged nothing earlier". `startedAt` is the daemon process start:
+ * a reconnect that restarted the daemon is visible as a new one.
+ */
+export interface ComputerDaemonLogResult {
+    lines: ComputerDaemonLogLine[];
+    startedAt: number;
+    now: number;
+    truncated: boolean;
+    ringFull: boolean;
+    /** Lines the redaction rewrote anywhere in the ring (a count, never content). */
+    redactedLines: number;
+}

package/dist/node_modules/@skrr-ai/auth-core/dist/esm/computerWire.js

@@ -155,6 +155,14 @@ export const DAEMON_COMPUTER_EVENTS = {
      * `computer_declared_services_v1`.
      */
     services: 'daemon:computer:services',
+    /**
+     * Read the tail of the daemon's OWN process log (a bounded, redacted copy of
+     * what its logger wrote since it started), for the owner who asks why their
+     * machine reconnected. Carries a `requestId` and the principal the API
+     * authorized (`observe`); the daemon checks the principal against the grant
+     * set it holds. Needs `computer_daemon_log_v1`.
+     */
+    daemonLog: 'daemon:computer:log',
     // daemon → API
     /** The answer to any request that carried a `requestId`. */
     ack: 'daemon:computer:ack',
@@ -315,6 +323,15 @@ export const COMPUTER_CAPABILITIES = {
      * browser; nothing is proxied to it. Announced by the relay that serves it.
      */
     declaredServices: 'computer_declared_services_v1',
+    /**
+     * The daemon serves the tail of its own process log
+     * (`daemon:computer:log`): an in-memory ring of lines its logger
+     * wrote, redacted before they enter the ring, read at the `watch` tier. It
+     * is NOT syslog or the journal and never reads either. Announced by the relay
+     * that serves it; a personal machine's daemon announces it too and refuses
+     * the read `consent_missing` until `skrr computer allow`.
+     */
+    daemonLog: 'computer_daemon_log_v1',
     /**
      * The page follows the controlling window (§6.2 "a stable viewport", §7.1,
      * OSK-13808): a browser `viewport` input, sent only by the attachment that
@@ -1197,3 +1214,32 @@ export function computerShowsDesktop(phase) {
 export function computerOffersPowerActions(machineKind) {
     return machineKind === 'dedicated';
 }
+// ---------------------------------------------------------------------------
+// The daemon's own log (`computer_daemon_log_v1`)
+// ---------------------------------------------------------------------------
+/**
+ * Why the daemon's log is a wire feature at all: the tenant uid on a Dedicated
+ * Runtime guest cannot read syslog or the journal, so an owner could not see
+ * why their machine's daemon reconnected or failed. The daemon keeps the last
+ * lines its OWN logger wrote in memory and serves them; it opens no file and no
+ * system log for this.
+ */
+export const COMPUTER_DAEMON_LOG_LEVELS = ['trace', 'debug', 'info', 'warn', 'error'];
+/** Every bound is the daemon's to enforce and the API's to validate against. */
+export const COMPUTER_DAEMON_LOG_LIMITS = {
+    /** Lines the daemon keeps in memory; older ones fall off the front. */
+    ringLines: 2000,
+    /** A line longer than this is cut and marked, never kept whole. */
+    lineChars: 1000,
+    /** Lines returned when the caller names none. */
+    defaultLines: 100,
+    /** The most lines one answer carries. */
+    maxLines: 500,
+    /** The most bytes (UTF-8) one answer's text carries; far under the 1 MiB SSE frame. */
+    maxBytes: 192 * 1024,
+    /** The longest look-back a `sinceMs` may ask for (24 h; the ring is shorter anyway). */
+    maxSinceMs: 24 * 60 * 60 * 1000,
+    /** Requests the daemon answers per `rateWindowMs`; one more is `rate_limited`. */
+    rateMax: 30,
+    rateWindowMs: 60 * 1000,
+};

package/dist/node_modules/@skrr-ai/auth-core/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skrr-ai/auth-core",
-  "version": "0.4.16",
+  "version": "0.4.17",
   "main": "dist/cjs/index.js",
   "types": "dist/esm/index.d.ts",
   "exports": {