pi-harness-runtime 1.1.395 → 1.1.397

package/packages/logging/dist/server/outbox.js

@@ -0,0 +1,247 @@
+/**
+ * Durable server-side outbox.
+ *
+ * The ingest endpoint must not tell a client "accepted" before the batch
+ * survived a crash. The outbox is the durable hand-off point between the
+ * HTTP request and the R2 upload:
+ *
+ *   request -> validate -> enqueue (durable) -> 202
+ *                                         |
+ *                                         v
+ *                               worker -> upload -> done
+ *
+ * The queue is a directory of JSON files, one per accepted batch:
+ *
+ *   <dir>/pending/<key>.json        the batch payload
+ *   <dir>/pending/<key>.meta.json   attempts, next attempt, last error
+ *   <dir>/done/<key>.json           uploaded batches (pruned after a while)
+ *
+ * A plain file queue is used on purpose: the server runs under Bun, which
+ * has no `node:sqlite`, and the queue stays inspectable with `ls`/`jq`.
+ *
+ * The key is derived from (tenant, installation, batch), so the same batch
+ * is enqueued only once - the ingest endpoint is idempotent.
+ */
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import { join } from "node:path";
+/** Make a value safe to use inside a file name. */
+export function safeSegment(value, maxLength = 48) {
+    const cleaned = value
+        .replace(/\.\./g, "_")
+        .replace(/[^A-Za-z0-9._-]/g, "_")
+        .slice(0, maxLength)
+        .replace(/^\.+/, "_");
+    return cleaned.length > 0 ? cleaned : "unknown";
+}
+/**
+ * Build the queue key of a batch.
+ *
+ * The key is unique per (tenant, installation, batch) and contains no
+ * user controlled path segment.
+ */
+export function outboxKey(batch) {
+    const digest = createHash("sha256")
+        .update(`${batch.tenantId}|${batch.installationId}|${batch.batchId}`, "utf8")
+        .digest("hex")
+        .slice(0, 12);
+    return `${safeSegment(batch.tenantId)}--${safeSegment(batch.batchId)}--${digest}`;
+}
+export class LogOutbox {
+    dir;
+    pendingDir;
+    doneDir;
+    retentionMs;
+    constructor(options) {
+        this.dir = options.dir;
+        this.pendingDir = join(options.dir, "pending");
+        this.doneDir = join(options.dir, "done");
+        this.retentionMs = options.retentionMs ?? 7 * 24 * 60 * 60 * 1000;
+        try {
+            mkdirSync(this.pendingDir, { recursive: true });
+            mkdirSync(this.doneDir, { recursive: true });
+        }
+        catch {
+            // The enqueue call reports the failure with a retryable error.
+        }
+    }
+    /** Directory of the queue. */
+    get directory() {
+        return this.dir;
+    }
+    /**
+     * Store a batch durably.
+     *
+     * The write is atomic (write to a temp file, then rename), so a crash
+     * can never leave a half written batch behind.
+     */
+    enqueue(batch) {
+        const key = outboxKey(batch);
+        const payloadPath = join(this.pendingDir, `${key}.json`);
+        if (existsSync(payloadPath) || existsSync(join(this.doneDir, `${key}.json`))) {
+            return { accepted: true, duplicate: true };
+        }
+        const tempPath = `${payloadPath}.tmp`;
+        try {
+            writeFileSync(tempPath, `${JSON.stringify(batch)}\n`, { mode: 0o600 });
+            renameSync(tempPath, payloadPath);
+        }
+        catch (error) {
+            try {
+                rmSync(tempPath, { force: true });
+            }
+            catch {
+                // Nothing else to do.
+            }
+            throw error;
+        }
+        this.writeMeta(key, {
+            attempts: 0,
+            nextAttemptAt: Date.now(),
+            createdAt: Date.now(),
+        });
+        return { accepted: true, duplicate: false };
+    }
+    /** The batches waiting for an upload, oldest first. */
+    listPending(limit = 100) {
+        const entries = [];
+        let names;
+        try {
+            names = readdirSync(this.pendingDir);
+        }
+        catch {
+            return entries;
+        }
+        for (const name of names) {
+            if (!name.endsWith(".json") || name.endsWith(".meta.json"))
+                continue;
+            const entry = this.readEntry(join(this.pendingDir, name));
+            if (entry)
+                entries.push(entry);
+        }
+        entries.sort((a, b) => a.createdAt - b.createdAt);
+        return entries.slice(0, limit);
+    }
+    /** Mark a batch as uploaded and move it out of the pending directory. */
+    markUploaded(entry) {
+        try {
+            renameSync(entry.path, join(this.doneDir, `${entry.key}.json`));
+        }
+        catch {
+            // The file may have been moved already; nothing to do.
+        }
+        try {
+            rmSync(join(this.pendingDir, `${entry.key}.meta.json`), { force: true });
+        }
+        catch {
+            // Ignore.
+        }
+    }
+    /**
+     * Record a failed upload and schedule the next attempt.
+     */
+    markFailed(entry, error, nextAttemptAt) {
+        this.writeMeta(entry.key, {
+            attempts: entry.attempts + 1,
+            nextAttemptAt,
+            lastError: error,
+            createdAt: entry.createdAt,
+        });
+    }
+    /** Queue depth, oldest pending age and failure information. */
+    stats(now = Date.now()) {
+        const entries = this.listPending(Number.MAX_SAFE_INTEGER);
+        let oldestPendingAgeMs = 0;
+        let failures = 0;
+        let lastError;
+        for (const entry of entries) {
+            const age = now - entry.createdAt;
+            if (oldestPendingAgeMs === 0 || age > oldestPendingAgeMs)
+                oldestPendingAgeMs = age;
+            if (entry.attempts > 0)
+                failures++;
+            if (entry.lastError)
+                lastError = entry.lastError;
+        }
+        return { pending: entries.length, oldestPendingAgeMs, failures, lastError };
+    }
+    /** Delete uploaded batches that are older than the retention period. */
+    prune(now = Date.now()) {
+        let removed = 0;
+        let names;
+        try {
+            names = readdirSync(this.doneDir);
+        }
+        catch {
+            return 0;
+        }
+        for (const name of names) {
+            const path = join(this.doneDir, name);
+            try {
+                const age = now - statSync(path).mtimeMs;
+                if (age > this.retentionMs) {
+                    rmSync(path, { force: true });
+                    removed++;
+                }
+            }
+            catch {
+                // Ignore a file that vanished.
+            }
+        }
+        return removed;
+    }
+    writeMeta(key, meta) {
+        const path = join(this.pendingDir, `${key}.meta.json`);
+        const tempPath = `${path}.tmp`;
+        try {
+            writeFileSync(tempPath, `${JSON.stringify(meta)}\n`, { mode: 0o600 });
+            renameSync(tempPath, path);
+        }
+        catch {
+            // The meta file is an optimisation: without it the batch is still
+            // retried, only without the backoff hint.
+        }
+    }
+    readEntry(path) {
+        const key = path.slice(path.lastIndexOf("/") + 1).replace(/\.json$/, "");
+        try {
+            const batch = JSON.parse(readFileSync(path, "utf8"));
+            let meta = {
+                attempts: 0,
+                nextAttemptAt: 0,
+                createdAt: 0,
+            };
+            try {
+                const metaPath = join(this.pendingDir, `${key}.meta.json`);
+                if (existsSync(metaPath)) {
+                    meta = { ...meta, ...JSON.parse(readFileSync(metaPath, "utf8")) };
+                }
+            }
+            catch {
+                // Fall back to the defaults.
+            }
+            let createdAt = meta.createdAt;
+            if (!createdAt) {
+                try {
+                    createdAt = statSync(path).mtimeMs;
+                }
+                catch {
+                    createdAt = Date.now();
+                }
+            }
+            return {
+                key,
+                path,
+                batch,
+                attempts: meta.attempts ?? 0,
+                nextAttemptAt: meta.nextAttemptAt ?? 0,
+                lastError: meta.lastError,
+                createdAt,
+            };
+        }
+        catch {
+            return null;
+        }
+    }
+}
+//# sourceMappingURL=outbox.js.map

package/packages/logging/dist/server/outbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"outbox.js","sourceRoot":"","sources":["../../src/server/outbox.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EACN,UAAU,EACV,SAAS,EACT,WAAW,EACX,YAAY,EACZ,UAAU,EACV,MAAM,EACN,QAAQ,EACR,aAAa,GACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAmDjC,mDAAmD;AACnD,MAAM,UAAU,WAAW,CAAC,KAAa,EAAE,SAAS,GAAG,EAAE;IACxD,MAAM,OAAO,GAAG,KAAK;SACnB,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC;SACrB,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC;SAChC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC;SACnB,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvB,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,KAIzB;IACA,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC;SACjC,MAAM,CAAC,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC;SAC5E,MAAM,CAAC,KAAK,CAAC;SACb,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACf,OAAO,GAAG,WAAW,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,WAAW,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,MAAM,EAAE,CAAC;AACnF,CAAC;AAED,MAAM,OAAO,SAAS;IACJ,GAAG,CAAS;IACZ,UAAU,CAAS;IACnB,OAAO,CAAS;IAChB,WAAW,CAAS;IAErC,YAAY,OAAyB;QACpC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QAC/C,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;QAClE,IAAI,CAAC;YACJ,SAAS,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAChD,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC;QAAC,MAAM,CAAC;YACR,+DAA+D;QAChE,CAAC;IACF,CAAC;IAED,8BAA8B;IAC9B,IAAI,SAAS;QACZ,OAAO,IAAI,CAAC,GAAG,CAAC;IACjB,CAAC;IAED;;;;;OAKG;IACH,OAAO,CAAC,KAAkB;QACzB,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;QAC7B,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC;QAEzD,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC;YAC9E,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;QAC5C,CAAC;QAED,MAAM,QAAQ,GAAG,GAAG,WAAW,MAAM,CAAC;QACtC,IAAI,CAAC;YACJ,aAAa,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACvE,UAAU,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACnC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,CAAC;gBACJ,MAAM,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACnC,CAAC;YAAC,MAAM,CAAC;gBACR,sBAAsB;YACvB,CAAC;YACD,MAAM,KAAK,CAAC;QACb,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE;YACnB,QAAQ,EAAE,CAAC;YACX,aAAa,EAAE,IAAI,CAAC,GAAG,EAAE;YACzB,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACrB,CAAC,CAAC;QAEH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IAED,uDAAuD;IACvD,WAAW,CAAC,KAAK,GAAG,GAAG;QACtB,MAAM,OAAO,GAAkB,EAAE,CAAC;QAClC,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACJ,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACtC,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,OAAO,CAAC;QAChB,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC;gBAAE,SAAS;YACrE,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC,CAAC;YAC1D,IAAI,KAAK;gBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAChC,CAAC;QAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC,CAAC;QAClD,OAAO,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAChC,CAAC;IAED,yEAAyE;IACzE,YAAY,CAAC,KAAkB;QAC9B,IAAI,CAAC;YACJ,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACR,uDAAuD;QACxD,CAAC;QACD,IAAI,CAAC;YACJ,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,KAAK,CAAC,GAAG,YAAY,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACR,UAAU;QACX,CAAC;IACF,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,KAAkB,EAAE,KAAa,EAAE,aAAqB;QAClE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,EAAE;YACzB,QAAQ,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC;YAC5B,aAAa;YACb,SAAS,EAAE,KAAK;YAChB,SAAS,EAAE,KAAK,CAAC,SAAS;SAC1B,CAAC,CAAC;IACJ,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACrB,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;QAC1D,IAAI,kBAAkB,GAAG,CAAC,CAAC;QAC3B,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,IAAI,SAA6B,CAAC;QAElC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC7B,MAAM,GAAG,GAAG,GAAG,GAAG,KAAK,CAAC,SAAS,CAAC;YAClC,IAAI,kBAAkB,KAAK,CAAC,IAAI,GAAG,GAAG,kBAAkB;gBAAE,kBAAkB,GAAG,GAAG,CAAC;YACnF,IAAI,KAAK,CAAC,QAAQ,GAAG,CAAC;gBAAE,QAAQ,EAAE,CAAC;YACnC,IAAI,KAAK,CAAC,SAAS;gBAAE,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC;QAClD,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;IAC7E,CAAC;IAED,wEAAwE;IACxE,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;QACrB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,KAAe,CAAC;QACpB,IAAI,CAAC;YACJ,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnC,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,CAAC,CAAC;QACV,CAAC;QACD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YAC1B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC;gBACJ,MAAM,GAAG,GAAG,GAAG,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;gBACzC,IAAI,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;oBAC5B,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;oBAC9B,OAAO,EAAE,CAAC;gBACX,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,+BAA+B;YAChC,CAAC;QACF,CAAC;QACD,OAAO,OAAO,CAAC;IAChB,CAAC;IAEO,SAAS,CAChB,GAAW,EACX,IAAwF;QAExF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,GAAG,YAAY,CAAC,CAAC;QACvD,MAAM,QAAQ,GAAG,GAAG,IAAI,MAAM,CAAC;QAC/B,IAAI,CAAC;YACJ,aAAa,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YACtE,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACR,kEAAkE;YAClE,0CAA0C;QAC3C,CAAC;IACF,CAAC;IAEO,SAAS,CAAC,IAAY;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC;YACJ,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAgB,CAAC;YACpE,IAAI,IAAI,GAAuF;gBAC9F,QAAQ,EAAE,CAAC;gBACX,aAAa,EAAE,CAAC;gBAChB,SAAS,EAAE,CAAC;aACZ,CAAC;YACF,IAAI,CAAC;gBACJ,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,GAAG,YAAY,CAAC,CAAC;gBAC3D,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC1B,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,GAAI,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAiB,EAAE,CAAC;gBACpF,CAAC;YACF,CAAC;YAAC,MAAM,CAAC;gBACR,6BAA6B;YAC9B,CAAC;YACD,IAAI,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;YAC/B,IAAI,CAAC,SAAS,EAAE,CAAC;gBAChB,IAAI,CAAC;oBACJ,SAAS,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC;gBACpC,CAAC;gBAAC,MAAM,CAAC;oBACR,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACxB,CAAC;YACF,CAAC;YACD,OAAO;gBACN,GAAG;gBACH,IAAI;gBACJ,KAAK;gBACL,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC;gBAC5B,aAAa,EAAE,IAAI,CAAC,aAAa,IAAI,CAAC;gBACtC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,SAAS;aACT,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACR,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;CACD"}

package/packages/logging/dist/server/service.d.ts

@@ -0,0 +1,83 @@
+/**
+ * The log ingest service.
+ *
+ * The HTTP handler is a thin adapter around this class, so the whole ingest
+ * and query policy is testable without a socket:
+ *
+ *   - authentication happens BEFORE the body is parsed,
+ *   - the tenant comes from the credential, never from the request body,
+ *   - a batch is only acknowledged after it is durably queued,
+ *   - a query is always scoped to the tenant of the caller.
+ */
+import { type BatchValidationLimits } from "../ingest/schema.js";
+import { type AuthenticatedCredential, type LogCredentialStore } from "./credentials.js";
+import type { LogIndexStore, LogQueryParams, LogQueryResult } from "./index-store.js";
+import type { LogOutbox } from "./outbox.js";
+export interface IngestSuccess {
+    accepted: number;
+    batchId: string;
+    duplicate: boolean;
+    tenantId: string;
+    queued: true;
+}
+export interface IngestFailure {
+    error: string;
+    code: string;
+}
+export interface IngestResult {
+    status: number;
+    body: IngestSuccess | IngestFailure;
+}
+export interface QuerySuccess {
+    entries: LogQueryResult["entries"];
+    nextCursor?: string;
+    hasMore: boolean;
+    scannedFiles: number;
+    truncated: boolean;
+    tenantId: string;
+}
+export interface LogIngestServiceOptions {
+    credentials: LogCredentialStore;
+    outbox: LogOutbox;
+    index: LogIndexStore;
+    /** Validation limits for an inbound batch. */
+    limits?: Partial<BatchValidationLimits>;
+}
+export declare class LogIngestService {
+    private readonly credentials;
+    private readonly outbox;
+    private readonly index;
+    private readonly limits;
+    constructor(options: LogIngestServiceOptions);
+    /** True when the ingest endpoint has at least one usable credential. */
+    get configured(): boolean;
+    /**
+     * Authenticate a presented bearer token.
+     *
+     * The HTTP layer uses it to reject a request before the body is read.
+     */
+    authenticate(token: string | undefined): AuthenticatedCredential | null;
+    /**
+     * Accept a batch.
+     *
+     * The status codes matter:
+     *   503 - no credential is configured (fail closed) or the queue is
+     *         unavailable. The client keeps the batch in its spool.
+     *   401 - the credential is missing or unknown.
+     *   403 - the credential may not write.
+     *   400 - the batch does not match the schema.
+     *   202 - the batch is durably queued.
+     */
+    ingest(body: unknown, bearerToken: string | undefined): IngestResult;
+    /**
+     * Query the metadata index for the tenant of the caller.
+     *
+     * The `tenantId` of the request is ignored on purpose - only the
+     * credential decides whose records are visible.
+     */
+    query(params: Omit<LogQueryParams, "tenantId">, bearerToken: string | undefined): {
+        status: number;
+        body: QuerySuccess | IngestFailure;
+    };
+}
+//# sourceMappingURL=service.d.ts.map

package/packages/logging/dist/server/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/server/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAiB,KAAK,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAChF,OAAO,EAGN,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,KAAK,EAAE,aAAa,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACtF,OAAO,KAAK,EAAE,SAAS,EAAe,MAAM,aAAa,CAAC;AAE1D,MAAM,WAAW,aAAa;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,IAAI,CAAC;CACb;AAED,MAAM,WAAW,aAAa;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,YAAY;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,aAAa,GAAG,aAAa,CAAC;CACpC;AAED,MAAM,WAAW,YAAY;IAC5B,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,EAAE,OAAO,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,uBAAuB;IACvC,WAAW,EAAE,kBAAkB,CAAC;IAChC,MAAM,EAAE,SAAS,CAAC;IAClB,KAAK,EAAE,aAAa,CAAC;IACrB,8CAA8C;IAC9C,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAC;CACxC;AAED,qBAAa,gBAAgB;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAqB;IACjD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAgB;IACtC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAiC;IAExD,YAAY,OAAO,EAAE,uBAAuB,EAK3C;IAED,wEAAwE;IACxE,IAAI,UAAU,IAAI,OAAO,CAExB;IAED;;;;OAIG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,uBAAuB,GAAG,IAAI,CAEtE;IAED;;;;;;;;;;OAUG;IACH,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG,YAAY,CA6DnE;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,EAAE,WAAW,EAAE,MAAM,GAAG,SAAS,GAAG;QACjF,MAAM,EAAE,MAAM,CAAC;QACf,IAAI,EAAE,YAAY,GAAG,aAAa,CAAC;KACnC,CA0BA;CACD"}

package/packages/logging/dist/server/service.js

@@ -0,0 +1,144 @@
+/**
+ * The log ingest service.
+ *
+ * The HTTP handler is a thin adapter around this class, so the whole ingest
+ * and query policy is testable without a socket:
+ *
+ *   - authentication happens BEFORE the body is parsed,
+ *   - the tenant comes from the credential, never from the request body,
+ *   - a batch is only acknowledged after it is durably queued,
+ *   - a query is always scoped to the tenant of the caller.
+ */
+import { validateBatch } from "../ingest/schema.js";
+import { LOG_READ_SCOPE, LOG_WRITE_SCOPE, } from "./credentials.js";
+import { serverObjectKey } from "./keys.js";
+export class LogIngestService {
+    credentials;
+    outbox;
+    index;
+    limits;
+    constructor(options) {
+        this.credentials = options.credentials;
+        this.outbox = options.outbox;
+        this.index = options.index;
+        this.limits = options.limits ?? {};
+    }
+    /** True when the ingest endpoint has at least one usable credential. */
+    get configured() {
+        return this.credentials.configured;
+    }
+    /**
+     * Authenticate a presented bearer token.
+     *
+     * The HTTP layer uses it to reject a request before the body is read.
+     */
+    authenticate(token) {
+        return this.credentials.authenticate(token);
+    }
+    /**
+     * Accept a batch.
+     *
+     * The status codes matter:
+     *   503 - no credential is configured (fail closed) or the queue is
+     *         unavailable. The client keeps the batch in its spool.
+     *   401 - the credential is missing or unknown.
+     *   403 - the credential may not write.
+     *   400 - the batch does not match the schema.
+     *   202 - the batch is durably queued.
+     */
+    ingest(body, bearerToken) {
+        if (!this.credentials.configured) {
+            return {
+                status: 503,
+                body: { error: "log ingest is not configured", code: "ingest_unconfigured" },
+            };
+        }
+        const auth = this.credentials.authenticate(bearerToken);
+        if (!auth) {
+            return { status: 401, body: { error: "unauthorized", code: "unauthorized" } };
+        }
+        if (!auth.scopes.includes(LOG_WRITE_SCOPE)) {
+            return { status: 403, body: { error: "forbidden", code: "forbidden" } };
+        }
+        const validation = validateBatch(body, { limits: this.limits });
+        if (!validation.ok) {
+            return {
+                status: 400,
+                body: { error: validation.error.message, code: validation.error.code },
+            };
+        }
+        const incoming = validation.batch;
+        const batch = {
+            tenantId: auth.tenantId,
+            installationId: incoming.installationId,
+            batchId: incoming.batchId,
+            app: incoming.app,
+            sentAt: incoming.sentAt,
+            records: incoming.records,
+        };
+        if (incoming.appVersion)
+            batch.appVersion = incoming.appVersion;
+        if (incoming.hostLabel)
+            batch.hostLabel = incoming.hostLabel;
+        if (incoming.sessionId)
+            batch.sessionId = incoming.sessionId;
+        try {
+            const result = this.outbox.enqueue(batch);
+            // The metadata index is best effort: a failing index never loses
+            // the batch itself.
+            this.index.append(batch, serverObjectKey(batch));
+            return {
+                status: 202,
+                body: {
+                    accepted: batch.records.length,
+                    batchId: batch.batchId,
+                    duplicate: result.duplicate,
+                    tenantId: batch.tenantId,
+                    queued: true,
+                },
+            };
+        }
+        catch (error) {
+            return {
+                status: 503,
+                body: {
+                    error: `log queue unavailable: ${error instanceof Error ? error.message : String(error)}`,
+                    code: "queue_unavailable",
+                },
+            };
+        }
+    }
+    /**
+     * Query the metadata index for the tenant of the caller.
+     *
+     * The `tenantId` of the request is ignored on purpose - only the
+     * credential decides whose records are visible.
+     */
+    query(params, bearerToken) {
+        if (!this.credentials.configured) {
+            return {
+                status: 503,
+                body: { error: "log ingest is not configured", code: "ingest_unconfigured" },
+            };
+        }
+        const auth = this.credentials.authenticate(bearerToken);
+        if (!auth) {
+            return { status: 401, body: { error: "unauthorized", code: "unauthorized" } };
+        }
+        if (!auth.scopes.includes(LOG_READ_SCOPE)) {
+            return { status: 403, body: { error: "forbidden", code: "forbidden" } };
+        }
+        const result = this.index.query({ ...params, tenantId: auth.tenantId });
+        const body = {
+            entries: result.entries,
+            hasMore: result.hasMore,
+            scannedFiles: result.scannedFiles,
+            truncated: result.truncated,
+            tenantId: auth.tenantId,
+        };
+        if (result.nextCursor)
+            body.nextCursor = result.nextCursor;
+        return { status: 200, body };
+    }
+}
+//# sourceMappingURL=service.js.map

package/packages/logging/dist/server/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/server/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,aAAa,EAA8B,MAAM,qBAAqB,CAAC;AAChF,OAAO,EACN,cAAc,EACd,eAAe,GAGf,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,WAAW,CAAC;AAuC5C,MAAM,OAAO,gBAAgB;IACX,WAAW,CAAqB;IAChC,MAAM,CAAY;IAClB,KAAK,CAAgB;IACrB,MAAM,CAAiC;IAExD,YAAY,OAAgC;QAC3C,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;IACpC,CAAC;IAED,wEAAwE;IACxE,IAAI,UAAU;QACb,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC;IACpC,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,KAAyB;QACrC,OAAO,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;;;OAUG;IACH,MAAM,CAAC,IAAa,EAAE,WAA+B;QACpD,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;YAClC,OAAO;gBACN,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,qBAAqB,EAAE;aAC5E,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;YAC5C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;QACzE,CAAC;QAED,MAAM,UAAU,GAAG,aAAa,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;YACpB,OAAO;gBACN,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,UAAU,CAAC,KAAK,CAAC,IAAI,EAAE;aACtE,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC;QAClC,MAAM,KAAK,GAAgB;YAC1B,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,cAAc,EAAE,QAAQ,CAAC,cAAc;YACvC,OAAO,EAAE,QAAQ,CAAC,OAAO;YACzB,GAAG,EAAE,QAAQ,CAAC,GAAG;YACjB,MAAM,EAAE,QAAQ,CAAC,MAAM;YACvB,OAAO,EAAE,QAAQ,CAAC,OAAO;SACzB,CAAC;QACF,IAAI,QAAQ,CAAC,UAAU;YAAE,KAAK,CAAC,UAAU,GAAG,QAAQ,CAAC,UAAU,CAAC;QAChE,IAAI,QAAQ,CAAC,SAAS;YAAE,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QAC7D,IAAI,QAAQ,CAAC,SAAS;YAAE,KAAK,CAAC,SAAS,GAAG,QAAQ,CAAC,SAAS,CAAC;QAE7D,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;YAC1C,iEAAiE;YACjE,oBAAoB;YACpB,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;YACjD,OAAO;gBACN,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACL,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,MAAM;oBAC9B,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,SAAS,EAAE,MAAM,CAAC,SAAS;oBAC3B,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,MAAM,EAAE,IAAI;iBACZ;aACD,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO;gBACN,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE;oBACL,KAAK,EAAE,0BAA0B,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE;oBACzF,IAAI,EAAE,mBAAmB;iBACzB;aACD,CAAC;QACH,CAAC;IACF,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAwC,EAAE,WAA+B;QAI9E,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;YAClC,OAAO;gBACN,MAAM,EAAE,GAAG;gBACX,IAAI,EAAE,EAAE,KAAK,EAAE,8BAA8B,EAAE,IAAI,EAAE,qBAAqB,EAAE;aAC5E,CAAC;QACH,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,IAAI,EAAE,cAAc,EAAE,EAAE,CAAC;QAC/E,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YAC3C,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,CAAC;QACzE,CAAC;QAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;QACxE,MAAM,IAAI,GAAiB;YAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,OAAO,EAAE,MAAM,CAAC,OAAO;YACvB,YAAY,EAAE,MAAM,CAAC,YAAY;YACjC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACvB,CAAC;QACF,IAAI,MAAM,CAAC,UAAU;YAAE,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QAC3D,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC9B,CAAC;CACD"}

package/packages/logging/dist/shipper.d.ts

@@ -10,15 +10,25 @@
  * next flush, so a temporary outage costs latency, not data.
  */
 import { type LogBufferOptions } from "./buffer.js";
+import { type ClassificationPolicy } from "./classification.js";
 import { type RedactionOptions } from "./redact.js";
 import { type SamplingPolicy } from "./sampler.js";
 import { LogSpool } from "./spool.js";
-import type { FlushStats, LogInput, LogLevel, LogTransport } from "./types.js";
+import { type FlushStats, type LogInput, type LogLevel, type LogTransport } from "./types.js";
 export interface LogShipperOptions {
     /** Application name reported with every batch. */
     app?: string;
-    /** Host name reported with every batch. */
-    host?: string;
+    /** Version of the emitting application. */
+    appVersion?: string;
+    /** Stable id of this installation. */
+    installationId?: string;
+    /**
+     * Optional display label for the machine (never an identity).
+     * Defaults to the hostname, which is display metadata only.
+     */
+    hostLabel?: string;
+    /** Opaque session id attached to the batch when the records agree. */
+    sessionId?: string;
     /** Transports in priority order. */
     transports?: LogTransport[];
     /** Local spool used when every transport fails. */
@@ -29,6 +39,8 @@ export interface LogShipperOptions {
     sampling?: Partial<SamplingPolicy>;
     /** Redaction limits. */
     redaction?: RedactionOptions;
+    /** What may leave the machine. */
+    classification?: ClassificationPolicy;
     /** Interval for the automatic flush timer. Default 15000 ms. */
     flushIntervalMs?: number;
     /** Clock injection (tests). */
@@ -38,12 +50,16 @@ export interface LogShipperOptions {
 }
 export declare class LogShipper {
     private readonly app;
-    private readonly host;
+    private readonly appVersion;
+    private readonly installationId;
+    private readonly hostLabel;
+    private readonly sessionId;
     private readonly transports;
     private readonly spool;
     private readonly buffer;
     private readonly sampler;
     private readonly redaction;
+    private readonly classification;
     private readonly flushIntervalMs;
     private readonly now;
     private readonly createBatchId;

package/packages/logging/dist/shipper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shipper.d.ts","sourceRoot":"","sources":["../src/shipper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAa,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAc,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,KAAK,EAAE,UAAU,EAA0B,QAAQ,EAAE,QAAQ,EAAa,YAAY,EAAE,MAAM,YAAY,CAAC;AAElH,MAAM,WAAW,iBAAiB;IACjC,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,oCAAoC;IACpC,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAC5B,mDAAmD;IACnD,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,qBAAqB;IACrB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,uBAAuB;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACnC,wBAAwB;IACxB,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+BAA+B;IAC/B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,gCAAgC;IAChC,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAgBD,qBAAa,UAAU;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiB;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuB;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAe;IAC7C,OAAO,CAAC,KAAK,CAA6C;IAC1D,OAAO,CAAC,QAAQ,CAA4B;IAC5C,OAAO,CAAC,KAAK,CAMX;IAEF,YAAY,OAAO,GAAE,iBAAsB,EAW1C;IAED,wCAAwC;IACxC,GAAG,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAczB;IAED,2CAA2C;IAC3C,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAE7F;IAED,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAE5F;IAED,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAE5F;IAED,KAAK,CACJ,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,KAAK,CAAC,EAAE,OAAO,GACb,IAAI,CAEN;IAED,oEAAoE;IAC9D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAM3B;IAED;;;OAGG;IACH,SAAS,IAAI,IAAI,CAWhB;IAED,sCAAsC;IACtC,KAAK,IAAI,IAAI,CAOZ;IAED,0CAA0C;IACpC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAM1B;IAED,QAAQ,IAAI,UAAU,CAMrB;IAED,OAAO,CAAC,WAAW;IA6BnB,OAAO,CAAC,UAAU;YAUJ,OAAO;IAyBrB,8EAA8E;YAChE,OAAO;IAarB,yDAAyD;YAC3C,UAAU;CAgBxB;AAED,YAAY,EAAE,QAAQ,EAAE,CAAC"}
+{"version":3,"file":"shipper.d.ts","sourceRoot":"","sources":["../src/shipper.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAGH,OAAO,EAAa,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/D,OAAO,EAGN,KAAK,oBAAoB,EACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAA4B,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC9E,OAAO,EAAc,KAAK,cAAc,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAEN,KAAK,UAAU,EAGf,KAAK,QAAQ,EACb,KAAK,QAAQ,EAEb,KAAK,YAAY,EACjB,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,iBAAiB;IACjC,kDAAkD;IAClD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sEAAsE;IACtE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,oCAAoC;IACpC,UAAU,CAAC,EAAE,YAAY,EAAE,CAAC;IAC5B,mDAAmD;IACnD,KAAK,CAAC,EAAE,QAAQ,CAAC;IACjB,qBAAqB;IACrB,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,uBAAuB;IACvB,QAAQ,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACnC,wBAAwB;IACxB,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,kCAAkC;IAClC,cAAc,CAAC,EAAE,oBAAoB,CAAC;IACtC,gEAAgE;IAChE,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,+BAA+B;IAC/B,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,gCAAgC;IAChC,aAAa,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAgBD,qBAAa,UAAU;IACtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAS;IAC7B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAqB;IAChD,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAqB;IAC/C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAiB;IAC5C,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAuB;IAC7C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAY;IACnC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAa;IACrC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAmB;IAC7C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAuB;IACtD,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAS;IACzC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAe;IAC7C,OAAO,CAAC,KAAK,CAA6C;IAC1D,OAAO,CAAC,QAAQ,CAA4B;IAC5C,OAAO,CAAC,KAAK,CAOX;IAEF,YAAY,OAAO,GAAE,iBAAsB,EAe1C;IAED,wCAAwC;IACxC,GAAG,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAoBzB;IAED,2CAA2C;IAC3C,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAE7F;IAED,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAE5F;IAED,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAE5F;IAED,KAAK,CACJ,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,EAChB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAChC,KAAK,CAAC,EAAE,OAAO,GACb,IAAI,CAEN;IAED,oEAAoE;IAC9D,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAM3B;IAED;;;OAGG;IACH,SAAS,IAAI,IAAI,CAWhB;IAED,sCAAsC;IACtC,KAAK,IAAI,IAAI,CAOZ;IAED,0CAA0C;IACpC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAM1B;IAED,QAAQ,IAAI,UAAU,CAMrB;IAED,OAAO,CAAC,WAAW;IA6BnB,OAAO,CAAC,UAAU;YAgBJ,OAAO;IAyBrB,8EAA8E;YAChE,OAAO;IAarB,yDAAyD;YAC3C,UAAU;CAgBxB;AAED,YAAY,EAAE,QAAQ,EAAE,CAAC"}

package/packages/logging/dist/shipper.js

@@ -11,8 +11,10 @@
  */
 import { hostname } from "node:os";
 import { LogBuffer } from "./buffer.js";
+import { DEFAULT_CLASSIFICATION_POLICY, prepareRemoteRecord, } from "./classification.js";
 import { redactFields, redactText } from "./redact.js";
 import { LogSampler } from "./sampler.js";
+import { LOG_SCHEMA_VERSION, } from "./types.js";
 function defaultBatchId() {
     const stamp = new Date().toISOString().replace(/[-:.]/g, "").slice(0, 15);
     return `${stamp}-${Math.random().toString(36).slice(2, 8)}`;
@@ -28,12 +30,16 @@ function toErrorInfo(error) {
 }
 export class LogShipper {
     app;
-    host;
+    appVersion;
+    installationId;
+    hostLabel;
+    sessionId;
     transports;
     spool;
     buffer;
     sampler;
     redaction;
+    classification;
     flushIntervalMs;
     now;
     createBatchId;
@@ -44,16 +50,21 @@ export class LogShipper {
         spooled: 0,
         dropped: 0,
         sampled: 0,
+        localOnly: 0,
         errors: {},
     };
     constructor(options = {}) {
         this.app = options.app ?? "pi-harness";
-        this.host = options.host ?? hostname();
+        this.appVersion = options.appVersion;
+        this.installationId = options.installationId ?? "unknown";
+        this.hostLabel = options.hostLabel ?? hostname();
+        this.sessionId = options.sessionId;
         this.transports = options.transports ?? [];
         this.spool = options.spool;
         this.buffer = new LogBuffer(options.buffer);
         this.sampler = new LogSampler(options.sampling);
         this.redaction = options.redaction ?? {};
+        this.classification = options.classification ?? DEFAULT_CLASSIFICATION_POLICY;
         this.flushIntervalMs = options.flushIntervalMs ?? 15_000;
         this.now = options.now ?? (() => Date.now());
         this.createBatchId = options.createBatchId ?? defaultBatchId;
@@ -66,7 +77,13 @@ export class LogShipper {
                 this.stats.sampled++;
                 return;
             }
-            this.buffer.push(record);
+            // What must stay on the machine never enters the shipping path.
+            const remote = prepareRemoteRecord(record, this.classification);
+            if (!remote) {
+                this.stats.localOnly++;
+                return;
+            }
+            this.buffer.push(remote);
             if (this.buffer.size >= this.buffer.batchSize) {
                 void this.flush();
             }
@@ -169,13 +186,22 @@ export class LogShipper {
         return record;
     }
     buildBatch(records) {
-        return {
+        const sessionId = this.sessionId ?? records.find((record) => record.sessionId)?.sessionId;
+        const batch = {
+            schemaVersion: LOG_SCHEMA_VERSION,
             batchId: this.createBatchId(),
             app: this.app,
-            host: this.host,
+            installationId: this.installationId,
             sentAt: new Date(this.now()).toISOString(),
             records,
         };
+        if (this.appVersion)
+            batch.appVersion = this.appVersion;
+        if (this.hostLabel)
+            batch.hostLabel = this.hostLabel;
+        if (sessionId)
+            batch.sessionId = sessionId;
+        return batch;
     }
     async doFlush() {
         try {