pi-harness-runtime 1.1.395 → 1.1.397

package/packages/logging/dist/config.js

@@ -12,6 +12,8 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { createR2Transport } from "./transports/r2.js";
 import { createWebhookTransport } from "./transports/webhook.js";
+import { resolveInstallationId } from "./installation.js";
+import { DEFAULT_CLASSIFICATION_POLICY, } from "./classification.js";
 function readKeyFile(keysDir, name) {
     const file = join(keysDir, name);
     if (!existsSync(file))
@@ -32,6 +34,19 @@ export function defaultKeysDir() {
 export function defaultSpoolDir() {
     return join(homedir(), ".pi-harness-runtime", "logs", "spool");
 }
+/**
+ * Build the classification policy.
+ *
+ * `PI_LOG_DIAGNOSTIC=1` is the explicit, user controlled diagnostic mode: it
+ * lets messages travel that the default policy keeps local. It never widens
+ * the event allowlist - only the message rule.
+ */
+function classificationFor(env) {
+    const diagnostic = env.PI_LOG_DIAGNOSTIC === "1" || env.PI_LOG_DIAGNOSTIC === "true";
+    if (!diagnostic)
+        return DEFAULT_CLASSIFICATION_POLICY;
+    return { ...DEFAULT_CLASSIFICATION_POLICY, allowRawMessages: true };
+}
 /**
  * Build the log sink configuration from the environment and the key files.
  */
@@ -40,14 +55,17 @@ export function resolveLogSinkConfig(options = {}) {
     const keysDir = options.keysDir ?? defaultKeysDir();
     const mode = (env.PI_LOG_SINK ?? "auto");
     const notes = [];
+    const installationId = options.installationId ?? env.PI_LOG_INSTALLATION_ID ?? resolveInstallationId();
     if (mode === "off") {
         return {
             enabled: false,
             app: env.PI_LOG_APP ?? "pi-harness",
+            installationId,
             transports: [],
             sampling: {},
             buffer: {},
             flushIntervalMs: 0,
+            classification: classificationFor(env),
             notes: ["logging disabled by PI_LOG_SINK=off"],
         };
     }
@@ -60,7 +78,19 @@ export function resolveLogSinkConfig(options = {}) {
         readKeyFile(keysDir, "r2-endpoint.txt") ??
         (accountId ? `https://${accountId}.r2.cloudflarestorage.com` : undefined);
     const r2Ready = Boolean(bucket && accessKeyId && secretAccessKey && endpoint);
-    const wantR2 = mode === "r2" || mode === "r2+webhook" || (mode === "auto" && r2Ready);
+    const webhookUrl = env.PI_LOG_WEBHOOK_URL;
+    /*
+     * Transport selection.
+     *
+     * The transports form a FALLBACK chain, not a broadcast: the first
+     * transport that accepts the batch wins and the later ones are not
+     * called. `auto` therefore prefers the webhook ingress when one is
+     * configured: the server is the single writer to R2, so client machines
+     * never need R2 credentials at all.
+     */
+    const wantR2 = mode === "r2" ||
+        mode === "r2+webhook" ||
+        (mode === "auto" && r2Ready && !webhookUrl);
     if (wantR2) {
         if (r2Ready) {
             transports.push(createR2Transport({
@@ -76,7 +106,6 @@ export function resolveLogSinkConfig(options = {}) {
             notes.push("r2 requested but credentials are incomplete - transport skipped");
         }
     }
-    const webhookUrl = env.PI_LOG_WEBHOOK_URL;
     const wantWebhook = mode === "webhook" || mode === "r2+webhook" || (mode === "auto" && Boolean(webhookUrl));
     if (wantWebhook) {
         if (webhookUrl) {
@@ -85,6 +114,9 @@ export function resolveLogSinkConfig(options = {}) {
                 token: env.PI_LOG_WEBHOOK_TOKEN,
             }));
             notes.push(`webhook enabled (${webhookUrl})`);
+            if (mode === "auto") {
+                notes.push("webhook is the client ingress point - the server writes to R2 (direct r2 transport skipped)");
+            }
         }
         else {
             notes.push("webhook requested but PI_LOG_WEBHOOK_URL is not set - transport skipped");
@@ -93,9 +125,10 @@ export function resolveLogSinkConfig(options = {}) {
     if (transports.length === 0) {
         notes.push("no transport configured - logs stay local");
     }
-    return {
+    const config = {
         enabled: true,
         app: env.PI_LOG_APP ?? "pi-harness",
+        installationId,
         transports,
         spoolDir: env.PI_LOG_SPOOL_DIR ?? defaultSpoolDir(),
         sampling: {
@@ -108,7 +141,11 @@ export function resolveLogSinkConfig(options = {}) {
             maxBatchSize: readNumber(env, "PI_LOG_BATCH_SIZE", 100),
         },
         flushIntervalMs: readNumber(env, "PI_LOG_FLUSH_INTERVAL_MS", 15_000),
+        classification: classificationFor(env),
         notes,
     };
+    if (env.PI_LOG_APP_VERSION)
+        config.appVersion = env.PI_LOG_APP_VERSION;
+    return config;
 }
 //# sourceMappingURL=config.js.map

package/packages/logging/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AA6BjE,SAAS,WAAW,CAAC,OAAe,EAAE,IAAY;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAClB,GAAuC,EACvC,GAAW,EACX,QAAgB;IAEhB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,cAAc;IAC7B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,eAAe;IAC9B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,qBAAqB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAO,GAAyB,EAAE;IACtE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,CAAgB,CAAC;IACxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,GAAG,EAAE,GAAG,CAAC,UAAU,IAAI,YAAY;YACnC,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,EAAE;YACV,eAAe,EAAE,CAAC;YAClB,KAAK,EAAE,CAAC,qCAAqC,CAAC;SAC9C,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAmB,EAAE,CAAC;IAEtC,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,IAAI,WAAW,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IAClF,MAAM,WAAW,GAChB,GAAG,CAAC,uBAAuB,IAAI,WAAW,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAC7E,MAAM,eAAe,GACpB,GAAG,CAAC,2BAA2B,IAAI,WAAW,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,GAAG,CAAC,oBAAoB,IAAI,WAAW,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACxF,MAAM,QAAQ,GACb,GAAG,CAAC,kBAAkB;QACtB,WAAW,CAAC,OAAO,EAAE,iBAAiB,CAAC;QACvC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,SAAS,2BAA2B,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAE3E,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,WAAW,IAAI,eAAe,IAAI,QAAQ,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,YAAY,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC;IAEtF,IAAI,MAAM,EAAE,CAAC;QACZ,IAAI,OAAO,EAAE,CAAC;YACb,UAAU,CAAC,IAAI,CACd,iBAAiB,CAAC;gBACjB,MAAM,EAAE,MAAgB;gBACxB,QAAQ,EAAE,QAAkB;gBAC5B,WAAW,EAAE,WAAqB;gBAClC,eAAe,EAAE,eAAyB;gBAC1C,MAAM,EAAE,GAAG,CAAC,gBAAgB,IAAI,cAAc;aAC9C,CAAC,CACF,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,GAAG,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACP,KAAK,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;QAC/E,CAAC;IACF,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,kBAAkB,CAAC;IAC1C,MAAM,WAAW,GAChB,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,YAAY,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAEzF,IAAI,WAAW,EAAE,CAAC;QACjB,IAAI,UAAU,EAAE,CAAC;YAChB,UAAU,CAAC,IAAI,CACd,sBAAsB,CAAC;gBACtB,GAAG,EAAE,UAAU;gBACf,KAAK,EAAE,GAAG,CAAC,oBAAoB;aAC/B,CAAC,CACF,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,oBAAoB,UAAU,GAAG,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACP,KAAK,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;QACvF,CAAC;IACF,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IACzD,CAAC;IAED,OAAO;QACN,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,GAAG,CAAC,UAAU,IAAI,YAAY;QACnC,UAAU;QACV,QAAQ,EAAE,GAAG,CAAC,gBAAgB,IAAI,eAAe,EAAE;QACnD,QAAQ,EAAE;YACT,QAAQ,EAAG,GAAG,CAAC,YAA2C,IAAI,MAAM;YACpE,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE,oBAAoB,EAAE,GAAG,CAAC;YACtD,kBAAkB,EAAE,UAAU,CAAC,GAAG,EAAE,mBAAmB,EAAE,EAAE,CAAC;SAC5D;QACD,MAAM,EAAE;YACP,OAAO,EAAE,UAAU,CAAC,GAAG,EAAE,oBAAoB,EAAE,IAAI,CAAC;YACpD,YAAY,EAAE,UAAU,CAAC,GAAG,EAAE,mBAAmB,EAAE,GAAG,CAAC;SACvD;QACD,eAAe,EAAE,UAAU,CAAC,GAAG,EAAE,0BAA0B,EAAE,MAAM,CAAC;QACpE,KAAK;KACL,CAAC;AACH,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EACN,6BAA6B,GAE7B,MAAM,qBAAqB,CAAC;AAqC7B,SAAS,WAAW,CAAC,OAAe,EAAE,IAAY;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAClB,GAAuC,EACvC,GAAW,EACX,QAAgB;IAEhB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,cAAc;IAC7B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,eAAe;IAC9B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,qBAAqB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CACzB,GAAuC;IAEvC,MAAM,UAAU,GAAG,GAAG,CAAC,iBAAiB,KAAK,GAAG,IAAI,GAAG,CAAC,iBAAiB,KAAK,MAAM,CAAC;IACrF,IAAI,CAAC,UAAU;QAAE,OAAO,6BAA6B,CAAC;IACtD,OAAO,EAAE,GAAG,6BAA6B,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;AACrE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAO,GAAyB,EAAE;IACtE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,CAAgB,CAAC;IACxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,cAAc,GACnB,OAAO,CAAC,cAAc,IAAI,GAAG,CAAC,sBAAsB,IAAI,qBAAqB,EAAE,CAAC;IAEjF,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,GAAG,EAAE,GAAG,CAAC,UAAU,IAAI,YAAY;YACnC,cAAc;YACd,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,EAAE;YACV,eAAe,EAAE,CAAC;YAClB,cAAc,EAAE,iBAAiB,CAAC,GAAG,CAAC;YACtC,KAAK,EAAE,CAAC,qCAAqC,CAAC;SAC9C,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAmB,EAAE,CAAC;IAEtC,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,IAAI,WAAW,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IAClF,MAAM,WAAW,GAChB,GAAG,CAAC,uBAAuB,IAAI,WAAW,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAC7E,MAAM,eAAe,GACpB,GAAG,CAAC,2BAA2B,IAAI,WAAW,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,GAAG,CAAC,oBAAoB,IAAI,WAAW,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACxF,MAAM,QAAQ,GACb,GAAG,CAAC,kBAAkB;QACtB,WAAW,CAAC,OAAO,EAAE,iBAAiB,CAAC;QACvC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,SAAS,2BAA2B,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAE3E,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,WAAW,IAAI,eAAe,IAAI,QAAQ,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,GAAG,CAAC,kBAAkB,CAAC;IAE1C;;;;;;;;OAQG;IACH,MAAM,MAAM,GACX,IAAI,KAAK,IAAI;QACb,IAAI,KAAK,YAAY;QACrB,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;IAE7C,IAAI,MAAM,EAAE,CAAC;QACZ,IAAI,OAAO,EAAE,CAAC;YACb,UAAU,CAAC,IAAI,CACd,iBAAiB,CAAC;gBACjB,MAAM,EAAE,MAAgB;gBACxB,QAAQ,EAAE,QAAkB;gBAC5B,WAAW,EAAE,WAAqB;gBAClC,eAAe,EAAE,eAAyB;gBAC1C,MAAM,EAAE,GAAG,CAAC,gBAAgB,IAAI,cAAc;aAC9C,CAAC,CACF,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,GAAG,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACP,KAAK,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;QAC/E,CAAC;IACF,CAAC;IAED,MAAM,WAAW,GAChB,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,YAAY,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAEzF,IAAI,WAAW,EAAE,CAAC;QACjB,IAAI,UAAU,EAAE,CAAC;YAChB,UAAU,CAAC,IAAI,CACd,sBAAsB,CAAC;gBACtB,GAAG,EAAE,UAAU;gBACf,KAAK,EAAE,GAAG,CAAC,oBAAoB;aAC/B,CAAC,CACF,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,oBAAoB,UAAU,GAAG,CAAC,CAAC;YAC9C,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrB,KAAK,CAAC,IAAI,CACT,6FAA6F,CAC7F,CAAC;YACH,CAAC;QACF,CAAC;aAAM,CAAC;YACP,KAAK,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;QACvF,CAAC;IACF,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,MAAM,GAAkB;QAC7B,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,GAAG,CAAC,UAAU,IAAI,YAAY;QACnC,cAAc;QACd,UAAU;QACV,QAAQ,EAAE,GAAG,CAAC,gBAAgB,IAAI,eAAe,EAAE;QACnD,QAAQ,EAAE;YACT,QAAQ,EAAG,GAAG,CAAC,YAA2C,IAAI,MAAM;YACpE,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE,oBAAoB,EAAE,GAAG,CAAC;YACtD,kBAAkB,EAAE,UAAU,CAAC,GAAG,EAAE,mBAAmB,EAAE,EAAE,CAAC;SAC5D;QACD,MAAM,EAAE;YACP,OAAO,EAAE,UAAU,CAAC,GAAG,EAAE,oBAAoB,EAAE,IAAI,CAAC;YACpD,YAAY,EAAE,UAAU,CAAC,GAAG,EAAE,mBAAmB,EAAE,GAAG,CAAC;SACvD;QACD,eAAe,EAAE,UAAU,CAAC,GAAG,EAAE,0BAA0B,EAAE,MAAM,CAAC;QACpE,cAAc,EAAE,iBAAiB,CAAC,GAAG,CAAC;QACtC,KAAK;KACL,CAAC;IAEF,IAAI,GAAG,CAAC,kBAAkB;QAAE,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,kBAAkB,CAAC;IAEvE,OAAO,MAAM,CAAC;AACf,CAAC"}

package/packages/logging/dist/index.d.ts

@@ -9,7 +9,7 @@
  * webhook server provides the live path, and the local spool is the
  * fallback that keeps data when both are unavailable.
  */
-export { LOG_LEVEL_SEVERITY } from "./types.js";
+export { LOG_LEVEL_SEVERITY, LOG_SCHEMA_VERSION } from "./types.js";
 export type { FlushStats, LogBatch, LogErrorInfo, LogInput, LogLevel, LogRecord, LogTransport, } from "./types.js";
 export { isSecretKey, isSensitiveValueKey, redactFields, redactText, redactValue, splitKeyTokens, } from "./redact.js";
 export type { JsonValue, RedactionOptions } from "./redact.js";
@@ -27,6 +27,14 @@ export { LogShipper } from "./shipper.js";
 export type { LogShipperOptions } from "./shipper.js";
 export { centralDebug, centralError, centralInfo, centralLog, centralWarn, getCentralLogConfig, getCentralShipper, initCentralLogging, shutdownCentralLogging, } from "./singleton.js";
 export type { InitCentralLoggingOptions } from "./singleton.js";
+export { INSTALLATION_ID_FILE, defaultInstallationIdPath, isValidInstallationId, resolveInstallationId, } from "./installation.js";
+export type { ResolveInstallationIdOptions } from "./installation.js";
+export { DEFAULT_CLASSIFICATION_POLICY, DEFAULT_LOCAL_EVENTS, DEFAULT_REMOTE_EVENTS, classifyRecord, filterRemoteRecords, isSanitizedMessage, prepareRemoteRecord, } from "./classification.js";
+export type { ClassificationPolicy } from "./classification.js";
+export { LOCAL_ONLY_FIELD_KEYS, isLocalOnlyFieldKey } from "./sensitive-keys.js";
+export { DEFAULT_BATCH_LIMITS, LOG_LEVELS, sanitizeRecord, validateBatch, } from "./ingest/schema.js";
+export type { BatchValidationError, BatchValidationLimits, BatchValidationResult, SanitizeRecordResult, } from "./ingest/schema.js";
+export * from "./server/index.js";
 export { defaultKeysDir, defaultSpoolDir, resolveLogSinkConfig, } from "./config.js";
 export type { LogSinkConfig, LogSinkMode, ResolveConfigOptions } from "./config.js";
 //# sourceMappingURL=index.d.ts.map

package/packages/logging/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,YAAY,EACX,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,YAAY,GACZ,MAAM,YAAY,CAAC;AAIpB,OAAO,EACN,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,WAAW,EACX,cAAc,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAI/D,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACnE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAInD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIpD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlD,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,YAAY,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAIvE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAItD,OAAO,EACN,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,GACtB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAIhE,OAAO,EACN,cAAc,EACd,eAAe,EACf,oBAAoB,GACpB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACpE,YAAY,EACX,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,YAAY,GACZ,MAAM,YAAY,CAAC;AAIpB,OAAO,EACN,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,WAAW,EACX,cAAc,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAI/D,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACnE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAInD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIpD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlD,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,YAAY,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAIvE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAItD,OAAO,EACN,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,GACtB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAIhE,OAAO,EACN,oBAAoB,EACpB,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAItE,OAAO,EACN,6BAA6B,EAC7B,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAIjF,OAAO,EACN,oBAAoB,EACpB,UAAU,EACV,cAAc,EACd,aAAa,GACb,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,GACpB,MAAM,oBAAoB,CAAC;AAI5B,cAAc,mBAAmB,CAAC;AAIlC,OAAO,EACN,cAAc,EACd,eAAe,EACf,oBAAoB,GACpB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC"}

package/packages/logging/dist/index.js

@@ -10,7 +10,7 @@
  * fallback that keeps data when both are unavailable.
  */
 // --- Types -----------------------------------------------------------------
-export { LOG_LEVEL_SEVERITY } from "./types.js";
+export { LOG_LEVEL_SEVERITY, LOG_SCHEMA_VERSION } from "./types.js";
 // --- Redaction -------------------------------------------------------------
 export { isSecretKey, isSensitiveValueKey, redactFields, redactText, redactValue, splitKeyTokens, } from "./redact.js";
 // --- Sampling --------------------------------------------------------------
@@ -26,6 +26,15 @@ export { createWebhookTransport } from "./transports/webhook.js";
 export { LogShipper } from "./shipper.js";
 // --- Process wide singleton -------------------------------------------------
 export { centralDebug, centralError, centralInfo, centralLog, centralWarn, getCentralLogConfig, getCentralShipper, initCentralLogging, shutdownCentralLogging, } from "./singleton.js";
+// --- Installation identity --------------------------------------------------
+export { INSTALLATION_ID_FILE, defaultInstallationIdPath, isValidInstallationId, resolveInstallationId, } from "./installation.js";
+// --- Classification (what may leave the machine) ----------------------------
+export { DEFAULT_CLASSIFICATION_POLICY, DEFAULT_LOCAL_EVENTS, DEFAULT_REMOTE_EVENTS, classifyRecord, filterRemoteRecords, isSanitizedMessage, prepareRemoteRecord, } from "./classification.js";
+export { LOCAL_ONLY_FIELD_KEYS, isLocalOnlyFieldKey } from "./sensitive-keys.js";
+// --- Ingest contract (shared by client and server) -------------------------
+export { DEFAULT_BATCH_LIMITS, LOG_LEVELS, sanitizeRecord, validateBatch, } from "./ingest/schema.js";
+// --- Server side ------------------------------------------------------------
+export * from "./server/index.js";
 // --- Configuration ---------------------------------------------------------
 export { defaultKeysDir, defaultSpoolDir, resolveLogSinkConfig, } from "./config.js";
 //# sourceMappingURL=index.js.map

package/packages/logging/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,8EAA8E;AAE9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAWhD,8EAA8E;AAE9E,OAAO,EACN,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,WAAW,EACX,cAAc,GACd,MAAM,aAAa,CAAC;AAGrB,8EAA8E;AAE9E,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAGnE,8EAA8E;AAE9E,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,8EAA8E;AAE9E,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGtC,8EAA8E;AAE9E,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAGjE,8EAA8E;AAE9E,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,+EAA+E;AAE/E,OAAO,EACN,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,GACtB,MAAM,gBAAgB,CAAC;AAGxB,8EAA8E;AAE9E,OAAO,EACN,cAAc,EACd,eAAe,EACf,oBAAoB,GACpB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,8EAA8E;AAE9E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAWpE,8EAA8E;AAE9E,OAAO,EACN,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,WAAW,EACX,cAAc,GACd,MAAM,aAAa,CAAC;AAGrB,8EAA8E;AAE9E,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAGnE,8EAA8E;AAE9E,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,8EAA8E;AAE9E,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGtC,8EAA8E;AAE9E,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAGjE,8EAA8E;AAE9E,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,+EAA+E;AAE/E,OAAO,EACN,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,GACtB,MAAM,gBAAgB,CAAC;AAGxB,+EAA+E;AAE/E,OAAO,EACN,oBAAoB,EACpB,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,GACrB,MAAM,mBAAmB,CAAC;AAG3B,+EAA+E;AAE/E,OAAO,EACN,6BAA6B,EAC7B,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,GACnB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAEjF,8EAA8E;AAE9E,OAAO,EACN,oBAAoB,EACpB,UAAU,EACV,cAAc,EACd,aAAa,GACb,MAAM,oBAAoB,CAAC;AAQ5B,+EAA+E;AAE/E,cAAc,mBAAmB,CAAC;AAElC,8EAA8E;AAE9E,OAAO,EACN,cAAc,EACd,eAAe,EACf,oBAAoB,GACpB,MAAM,aAAa,CAAC"}

package/packages/logging/dist/ingest/schema.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Ingest contract: strict validation and allowlisted redaction.
+ *
+ * The client and the server share this module, so both sides agree on what a
+ * batch is. The server never trusts the body:
+ *
+ *   - the tenant comes from the authenticated credential, never from the JSON,
+ *   - the batch is validated against a strict, versioned schema,
+ *   - the records are rebuilt from an allowlist, so an unknown property can
+ *     never smuggle data into the archive,
+ *   - every string is redacted again on the server (defence in depth).
+ */
+import { type LogBatch, type LogLevel, type LogRecord } from "../types.js";
+export declare const LOG_LEVELS: readonly LogLevel[];
+export interface BatchValidationLimits {
+    /** Maximum number of records in one batch. */
+    maxRecords: number;
+    /** Maximum length of a single string value. */
+    maxStringLength: number;
+    /** Maximum number of structured fields per record. */
+    maxFieldKeys: number;
+}
+export declare const DEFAULT_BATCH_LIMITS: BatchValidationLimits;
+export interface BatchValidationError {
+    code: string;
+    message: string;
+}
+export type BatchValidationResult = {
+    ok: true;
+    batch: LogBatch;
+    warnings: string[];
+} | {
+    ok: false;
+    error: BatchValidationError;
+};
+/**
+ * Validate an inbound batch.
+ *
+ * Unknown properties are NOT an error here - the sanitizer drops them. Only a
+ * structurally broken batch is rejected.
+ */
+export declare function validateBatch(input: unknown, options?: {
+    limits?: Partial<BatchValidationLimits>;
+}): BatchValidationResult;
+export type SanitizeRecordResult = {
+    ok: true;
+    record: LogRecord;
+} | {
+    ok: false;
+    error: BatchValidationError;
+};
+/**
+ * Rebuild one record from the allowlist and redact every string.
+ *
+ * Unknown properties are dropped, `error.name`, `error.message` and
+ * `error.stack` are redacted, and structured fields lose the keys that can
+ * carry private content.
+ */
+export declare function sanitizeRecord(input: unknown, limits?: Partial<BatchValidationLimits>): SanitizeRecordResult;
+//# sourceMappingURL=schema.d.ts.map

package/packages/logging/dist/ingest/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/ingest/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAsB,KAAK,QAAQ,EAAqB,KAAK,QAAQ,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAElH,eAAO,MAAM,UAAU,EAAE,SAAS,QAAQ,EAAuC,CAAC;AAElF,MAAM,WAAW,qBAAqB;IACrC,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,eAAe,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,YAAY,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,oBAAoB,EAAE,qBAIlC,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,qBAAqB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GACjD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAc9C;;;;;GAKG;AACH,wBAAgB,aAAa,CAC5B,KAAK,EAAE,OAAO,EACd,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAA;CAAO,GACvD,qBAAqB,CAmHvB;AA6BD,MAAM,MAAM,oBAAoB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GAC/B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAE9C;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC7B,KAAK,EAAE,OAAO,EACd,MAAM,GAAE,OAAO,CAAC,qBAAqB,CAAM,GACzC,oBAAoB,CAwEtB"}

package/packages/logging/dist/ingest/schema.js

@@ -0,0 +1,245 @@
+/**
+ * Ingest contract: strict validation and allowlisted redaction.
+ *
+ * The client and the server share this module, so both sides agree on what a
+ * batch is. The server never trusts the body:
+ *
+ *   - the tenant comes from the authenticated credential, never from the JSON,
+ *   - the batch is validated against a strict, versioned schema,
+ *   - the records are rebuilt from an allowlist, so an unknown property can
+ *     never smuggle data into the archive,
+ *   - every string is redacted again on the server (defence in depth).
+ */
+import { redactText, redactValue } from "../redact.js";
+import { isLocalOnlyFieldKey } from "../sensitive-keys.js";
+import { LOG_SCHEMA_VERSION } from "../types.js";
+export const LOG_LEVELS = ["debug", "info", "warn", "error"];
+export const DEFAULT_BATCH_LIMITS = {
+    maxRecords: 1000,
+    maxStringLength: 8192,
+    maxFieldKeys: 64,
+};
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isIsoTimestamp(value) {
+    return Number.isFinite(Date.parse(value));
+}
+/** Batch ids are opaque but must stay safe to use in an object key. */
+const BATCH_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
+const INSTALLATION_ID_PATTERN = /^[A-Za-z0-9._:-]{8,64}$/;
+/**
+ * Validate an inbound batch.
+ *
+ * Unknown properties are NOT an error here - the sanitizer drops them. Only a
+ * structurally broken batch is rejected.
+ */
+export function validateBatch(input, options = {}) {
+    const limits = { ...DEFAULT_BATCH_LIMITS, ...options.limits };
+    const warnings = [];
+    if (!isPlainObject(input)) {
+        return { ok: false, error: { code: "invalid_batch", message: "batch must be an object" } };
+    }
+    let schemaVersion = input.schemaVersion;
+    if (schemaVersion === undefined) {
+        // A client that predates the version marker sends v1.
+        schemaVersion = 1;
+        warnings.push("batch without a schema version, treated as legacy v1");
+    }
+    if (typeof schemaVersion !== "number" || !Number.isFinite(schemaVersion)) {
+        return {
+            ok: false,
+            error: { code: "invalid_schema_version", message: "schemaVersion must be a number" },
+        };
+    }
+    if (schemaVersion < 1) {
+        return {
+            ok: false,
+            error: { code: "invalid_schema_version", message: "schemaVersion must be >= 1" },
+        };
+    }
+    if (schemaVersion > LOG_SCHEMA_VERSION) {
+        return {
+            ok: false,
+            error: {
+                code: "unsupported_schema_version",
+                message: `schemaVersion ${schemaVersion} is newer than the supported version ${LOG_SCHEMA_VERSION}`,
+            },
+        };
+    }
+    if (schemaVersion < LOG_SCHEMA_VERSION) {
+        warnings.push(`legacy schemaVersion ${schemaVersion}`);
+    }
+    const batchId = input.batchId;
+    if (typeof batchId !== "string" || !BATCH_ID_PATTERN.test(batchId)) {
+        return {
+            ok: false,
+            error: { code: "invalid_batch_id", message: "batchId is missing or malformed" },
+        };
+    }
+    const app = input.app;
+    if (typeof app !== "string" || app.length === 0 || app.length > 64) {
+        return { ok: false, error: { code: "invalid_app", message: "app is missing or malformed" } };
+    }
+    const installationId = input.installationId;
+    if (installationId !== undefined && typeof installationId !== "string") {
+        return {
+            ok: false,
+            error: { code: "invalid_installation_id", message: "installationId must be a string" },
+        };
+    }
+    if (schemaVersion >= 2) {
+        if (typeof installationId !== "string" || !INSTALLATION_ID_PATTERN.test(installationId)) {
+            return {
+                ok: false,
+                error: { code: "invalid_installation_id", message: "installationId is missing or malformed" },
+            };
+        }
+    }
+    else if (!installationId) {
+        warnings.push("batch without an installation id");
+    }
+    const sentAt = input.sentAt;
+    if (typeof sentAt !== "string" || !isIsoTimestamp(sentAt)) {
+        return { ok: false, error: { code: "invalid_sent_at", message: "sentAt is not a timestamp" } };
+    }
+    const records = input.records;
+    if (!Array.isArray(records)) {
+        return { ok: false, error: { code: "invalid_records", message: "records must be an array" } };
+    }
+    if (records.length === 0) {
+        return { ok: false, error: { code: "empty_batch", message: "records must not be empty" } };
+    }
+    if (records.length > limits.maxRecords) {
+        return {
+            ok: false,
+            error: {
+                code: "too_many_records",
+                message: `records exceed the limit of ${limits.maxRecords}`,
+            },
+        };
+    }
+    const sanitized = [];
+    for (const record of records) {
+        const result = sanitizeRecord(record, limits);
+        if (!result.ok) {
+            return { ok: false, error: result.error };
+        }
+        sanitized.push(result.record);
+    }
+    const batch = {
+        schemaVersion,
+        batchId,
+        app,
+        installationId: typeof installationId === "string" ? installationId : "legacy",
+        sentAt,
+        records: sanitized,
+    };
+    if (typeof input.appVersion === "string")
+        batch.appVersion = input.appVersion.slice(0, 32);
+    if (typeof input.hostLabel === "string")
+        batch.hostLabel = input.hostLabel.slice(0, 128);
+    if (typeof input.sessionId === "string")
+        batch.sessionId = input.sessionId.slice(0, 128);
+    return { ok: true, batch, warnings };
+}
+/** Record keys that are accepted. Everything else is dropped. */
+const ALLOWED_RECORD_KEYS = new Set([
+    "ts",
+    "level",
+    "source",
+    "event",
+    "message",
+    "sessionId",
+    "durationMs",
+    "fields",
+    "error",
+]);
+/**
+ * Copy only the allowed properties of a record.
+ *
+ * This is the allowlist in action: a property the contract does not know is
+ * dropped before anything else happens to the record.
+ */
+function pickAllowedProperties(input) {
+    const picked = {};
+    for (const key of ALLOWED_RECORD_KEYS) {
+        if (key in input)
+            picked[key] = input[key];
+    }
+    return picked;
+}
+/**
+ * Rebuild one record from the allowlist and redact every string.
+ *
+ * Unknown properties are dropped, `error.name`, `error.message` and
+ * `error.stack` are redacted, and structured fields lose the keys that can
+ * carry private content.
+ */
+export function sanitizeRecord(input, limits = {}) {
+    const merged = { ...DEFAULT_BATCH_LIMITS, ...limits };
+    if (!isPlainObject(input)) {
+        return { ok: false, error: { code: "invalid_record", message: "record must be an object" } };
+    }
+    const allowed = pickAllowedProperties(input);
+    const ts = allowed.ts;
+    if (typeof ts !== "string" || !isIsoTimestamp(ts)) {
+        return { ok: false, error: { code: "invalid_ts", message: "ts is not a timestamp" } };
+    }
+    const level = allowed.level;
+    if (typeof level !== "string" || !LOG_LEVELS.includes(level)) {
+        return { ok: false, error: { code: "invalid_level", message: "level is not known" } };
+    }
+    const source = allowed.source;
+    if (typeof source !== "string" || source.length === 0 || source.length > 128) {
+        return { ok: false, error: { code: "invalid_source", message: "source is missing or malformed" } };
+    }
+    const event = allowed.event;
+    if (typeof event !== "string" || event.length === 0 || event.length > 128) {
+        return { ok: false, error: { code: "invalid_event", message: "event is missing or malformed" } };
+    }
+    const record = {
+        ts,
+        level: level,
+        source,
+        event,
+    };
+    if (typeof allowed.message === "string") {
+        record.message = redactText(allowed.message).slice(0, merged.maxStringLength);
+    }
+    if (typeof allowed.sessionId === "string") {
+        record.sessionId = allowed.sessionId.slice(0, 128);
+    }
+    if (typeof allowed.durationMs === "number" && Number.isFinite(allowed.durationMs)) {
+        record.durationMs = allowed.durationMs;
+    }
+    if (isPlainObject(allowed.fields)) {
+        const fields = {};
+        let kept = 0;
+        for (const [key, value] of Object.entries(allowed.fields)) {
+            if (kept >= merged.maxFieldKeys)
+                break;
+            if (isLocalOnlyFieldKey(key))
+                continue;
+            fields[key] = redactValue(value);
+            kept++;
+        }
+        if (Object.keys(fields).length > 0)
+            record.fields = fields;
+    }
+    if (isPlainObject(allowed.error)) {
+        const error = { name: "Error", message: "" };
+        if (typeof allowed.error.name === "string") {
+            error.name = redactText(allowed.error.name).slice(0, 256);
+        }
+        if (typeof allowed.error.message === "string") {
+            error.message = redactText(allowed.error.message).slice(0, merged.maxStringLength);
+        }
+        if (typeof allowed.error.stack === "string") {
+            error.stack = redactText(allowed.error.stack).slice(0, merged.maxStringLength);
+        }
+        record.error = error;
+    }
+    return { ok: true, record };
+}
+//# sourceMappingURL=schema.js.map

package/packages/logging/dist/ingest/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/ingest/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAmE,MAAM,aAAa,CAAC;AAElH,MAAM,CAAC,MAAM,UAAU,GAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAWlF,MAAM,CAAC,MAAM,oBAAoB,GAA0B;IAC1D,UAAU,EAAE,IAAI;IAChB,eAAe,EAAE,IAAI;IACrB,YAAY,EAAE,EAAE;CAChB,CAAC;AAWF,SAAS,aAAa,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AACpD,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC5B,KAAc,EACd,OAAO,GAAgD,EAAE;IAEzD,MAAM,MAAM,GAAG,EAAE,GAAG,oBAAoB,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAC9D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,CAAC;IAC5F,CAAC;IAED,IAAI,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IACxC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QACjC,sDAAsD;QACtD,aAAa,GAAG,CAAC,CAAC;QAClB,QAAQ,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC1E,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,gCAAgC,EAAE;SACpF,CAAC;IACH,CAAC;IACD,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,4BAA4B,EAAE;SAChF,CAAC;IACH,CAAC;IACD,IAAI,aAAa,GAAG,kBAAkB,EAAE,CAAC;QACxC,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACN,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,iBAAiB,aAAa,wCAAwC,kBAAkB,EAAE;aACnG;SACD,CAAC;IACH,CAAC;IACD,IAAI,aAAa,GAAG,kBAAkB,EAAE,CAAC;QACxC,QAAQ,CAAC,IAAI,CAAC,wBAAwB,aAAa,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpE,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,iCAAiC,EAAE;SAC/E,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,6BAA6B,EAAE,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,IAAI,cAAc,KAAK,SAAS,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QACxE,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,iCAAiC,EAAE;SACtF,CAAC;IACH,CAAC;IACD,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QACxB,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACzF,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,wCAAwC,EAAE;aAC7F,CAAC;QACH,CAAC;IACF,CAAC;SAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE,CAAC;IAChG,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,0BAA0B,EAAE,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACxC,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACN,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,+BAA+B,MAAM,CAAC,UAAU,EAAE;aAC3D;SACD,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC3C,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,KAAK,GAAa;QACvB,aAAa;QACb,OAAO;QACP,GAAG;QACH,cAAc,EAAE,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ;QAC9E,MAAM;QACN,OAAO,EAAE,SAAS;KAClB,CAAC;IAEF,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3F,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QAAE,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzF,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QAAE,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAEzF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAED,iEAAiE;AACjE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IACnC,IAAI;IACJ,OAAO;IACP,QAAQ;IACR,OAAO;IACP,SAAS;IACT,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,OAAO;CACP,CAAC,CAAC;AAEH;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,KAA8B;IAC5D,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAMD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC7B,KAAc,EACd,MAAM,GAAmC,EAAE;IAE3C,MAAM,MAAM,GAAG,EAAE,GAAG,oBAAoB,EAAE,GAAG,MAAM,EAAE,CAAC;IACtD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,0BAA0B,EAAE,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAE7C,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;IACtB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,CAAC;IACvF,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAiB,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,CAAC;IACvF,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC9E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,CAAC;IACpG,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,+BAA+B,EAAE,EAAE,CAAC;IAClG,CAAC;IAED,MAAM,MAAM,GAAc;QACzB,EAAE;QACF,KAAK,EAAE,KAAiB;QACxB,MAAM;QACN,KAAK;KACL,CAAC;IAEF,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACnF,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACxC,CAAC;IAED,IAAI,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,IAAI,IAAI,IAAI,MAAM,CAAC,YAAY;gBAAE,MAAM;YACvC,IAAI,mBAAmB,CAAC,GAAG,CAAC;gBAAE,SAAS;YACvC,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,EAAE,CAAC;QACR,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAC5D,CAAC;IAED,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,KAAK,GAAiB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC3D,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5C,KAAK,CAAC,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC/C,KAAK,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC7C,KAAK,CAAC,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC"}

package/packages/logging/dist/installation.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Stable installation identity.
+ *
+ * One random id per local install. It is created on first use, persisted
+ * under `~/.pi-harness-runtime/installation-id.txt` and sent with every
+ * batch so the server can tell two machines of the same user apart.
+ *
+ * The id is deliberately opaque:
+ *   - it never contains the hostname, the user name or a workspace path,
+ *   - it is not derived from anything that could identify a person,
+ *   - it is never used as an identity on the server (the tenant comes from
+ *     the authenticated credential).
+ */
+export declare const INSTALLATION_ID_FILE = "installation-id.txt";
+/** Default location of the installation id file. */
+export declare function defaultInstallationIdPath(): string;
+/** True when the value looks like a uuid (the only shape we write). */
+export declare function isValidInstallationId(value: string): boolean;
+export interface ResolveInstallationIdOptions {
+    /** File the id is read from and written to. */
+    path?: string;
+    /** Id factory (tests). */
+    generate?: () => string;
+}
+/**
+ * Resolve the installation id: read it when it exists, create it otherwise.
+ *
+ * A failed read or write never throws - the id is best effort metadata and
+ * must not break logging.
+ */
+export declare function resolveInstallationId(options?: ResolveInstallationIdOptions): string;
+//# sourceMappingURL=installation.d.ts.map

package/packages/logging/dist/installation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installation.d.ts","sourceRoot":"","sources":["../src/installation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,eAAO,MAAM,oBAAoB,wBAAwB,CAAC;AAE1D,oDAAoD;AACpD,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAID,uEAAuE;AACvE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,MAAM,WAAW,4BAA4B;IAC5C,+CAA+C;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,4BAAiC,GAAG,MAAM,CA6BxF"}

package/packages/logging/dist/installation.js

@@ -0,0 +1,64 @@
+/**
+ * Stable installation identity.
+ *
+ * One random id per local install. It is created on first use, persisted
+ * under `~/.pi-harness-runtime/installation-id.txt` and sent with every
+ * batch so the server can tell two machines of the same user apart.
+ *
+ * The id is deliberately opaque:
+ *   - it never contains the hostname, the user name or a workspace path,
+ *   - it is not derived from anything that could identify a person,
+ *   - it is never used as an identity on the server (the tenant comes from
+ *     the authenticated credential).
+ */
+import { randomUUID } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+export const INSTALLATION_ID_FILE = "installation-id.txt";
+/** Default location of the installation id file. */
+export function defaultInstallationIdPath() {
+    return join(homedir(), ".pi-harness-runtime", INSTALLATION_ID_FILE);
+}
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** True when the value looks like a uuid (the only shape we write). */
+export function isValidInstallationId(value) {
+    return UUID_PATTERN.test(value.trim());
+}
+/**
+ * Resolve the installation id: read it when it exists, create it otherwise.
+ *
+ * A failed read or write never throws - the id is best effort metadata and
+ * must not break logging.
+ */
+export function resolveInstallationId(options = {}) {
+    const path = options.path ?? defaultInstallationIdPath();
+    const generate = options.generate ?? randomUUID;
+    try {
+        if (existsSync(path)) {
+            const existing = readFileSync(path, "utf8").trim();
+            if (isValidInstallationId(existing))
+                return existing;
+        }
+    }
+    catch {
+        // Fall through and create a new id.
+    }
+    let id;
+    try {
+        id = generate();
+    }
+    catch {
+        id = randomUUID();
+    }
+    try {
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, `${id}\n`, { mode: 0o600 });
+        chmodSync(path, 0o600);
+    }
+    catch {
+        // The id still works for this process even when it cannot be persisted.
+    }
+    return id;
+}
+//# sourceMappingURL=installation.js.map

package/packages/logging/dist/installation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installation.js","sourceRoot":"","sources":["../src/installation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAE1D,oDAAoD;AACpD,MAAM,UAAU,yBAAyB;IACxC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,YAAY,GAAG,iEAAiE,CAAC;AAEvF,uEAAuE;AACvE,MAAM,UAAU,qBAAqB,CAAC,KAAa;IAClD,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACxC,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAO,GAAiC,EAAE;IAC/E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,yBAAyB,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC;IAEhD,IAAI,CAAC;QACJ,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,IAAI,qBAAqB,CAAC,QAAQ,CAAC;gBAAE,OAAO,QAAQ,CAAC;QACtD,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,oCAAoC;IACrC,CAAC;IAED,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACJ,EAAE,GAAG,QAAQ,EAAE,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACR,EAAE,GAAG,UAAU,EAAE,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACJ,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,wEAAwE;IACzE,CAAC;IAED,OAAO,EAAE,CAAC;AACX,CAAC"}

package/packages/logging/dist/sensitive-keys.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Keys that never leave the machine.
+ *
+ * A key name is a strong hint about its content: "prompt", "output" or
+ * "transcript" carry private text, "path" and "url" carry the shape of the
+ * user's workspace. The list is shared by the client side classifier and the
+ * server side sanitizer, so both sides agree on what is private.
+ */
+export declare const LOCAL_ONLY_FIELD_KEYS: string[];
+/** True when the key is one that must not be shipped. */
+export declare function isLocalOnlyFieldKey(key: string): boolean;
+//# sourceMappingURL=sensitive-keys.d.ts.map

package/packages/logging/dist/sensitive-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-keys.d.ts","sourceRoot":"","sources":["../src/sensitive-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,eAAO,MAAM,qBAAqB,UAwBjC,CAAC;AAEF,yDAAyD;AACzD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGxD"}