pi-harness-runtime 1.1.396 → 1.1.397

package/packages/logging/dist/ingest/schema.js

@@ -0,0 +1,245 @@
+/**
+ * Ingest contract: strict validation and allowlisted redaction.
+ *
+ * The client and the server share this module, so both sides agree on what a
+ * batch is. The server never trusts the body:
+ *
+ *   - the tenant comes from the authenticated credential, never from the JSON,
+ *   - the batch is validated against a strict, versioned schema,
+ *   - the records are rebuilt from an allowlist, so an unknown property can
+ *     never smuggle data into the archive,
+ *   - every string is redacted again on the server (defence in depth).
+ */
+import { redactText, redactValue } from "../redact.js";
+import { isLocalOnlyFieldKey } from "../sensitive-keys.js";
+import { LOG_SCHEMA_VERSION } from "../types.js";
+export const LOG_LEVELS = ["debug", "info", "warn", "error"];
+export const DEFAULT_BATCH_LIMITS = {
+    maxRecords: 1000,
+    maxStringLength: 8192,
+    maxFieldKeys: 64,
+};
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isIsoTimestamp(value) {
+    return Number.isFinite(Date.parse(value));
+}
+/** Batch ids are opaque but must stay safe to use in an object key. */
+const BATCH_ID_PATTERN = /^[A-Za-z0-9._:-]{1,128}$/;
+const INSTALLATION_ID_PATTERN = /^[A-Za-z0-9._:-]{8,64}$/;
+/**
+ * Validate an inbound batch.
+ *
+ * Unknown properties are NOT an error here - the sanitizer drops them. Only a
+ * structurally broken batch is rejected.
+ */
+export function validateBatch(input, options = {}) {
+    const limits = { ...DEFAULT_BATCH_LIMITS, ...options.limits };
+    const warnings = [];
+    if (!isPlainObject(input)) {
+        return { ok: false, error: { code: "invalid_batch", message: "batch must be an object" } };
+    }
+    let schemaVersion = input.schemaVersion;
+    if (schemaVersion === undefined) {
+        // A client that predates the version marker sends v1.
+        schemaVersion = 1;
+        warnings.push("batch without a schema version, treated as legacy v1");
+    }
+    if (typeof schemaVersion !== "number" || !Number.isFinite(schemaVersion)) {
+        return {
+            ok: false,
+            error: { code: "invalid_schema_version", message: "schemaVersion must be a number" },
+        };
+    }
+    if (schemaVersion < 1) {
+        return {
+            ok: false,
+            error: { code: "invalid_schema_version", message: "schemaVersion must be >= 1" },
+        };
+    }
+    if (schemaVersion > LOG_SCHEMA_VERSION) {
+        return {
+            ok: false,
+            error: {
+                code: "unsupported_schema_version",
+                message: `schemaVersion ${schemaVersion} is newer than the supported version ${LOG_SCHEMA_VERSION}`,
+            },
+        };
+    }
+    if (schemaVersion < LOG_SCHEMA_VERSION) {
+        warnings.push(`legacy schemaVersion ${schemaVersion}`);
+    }
+    const batchId = input.batchId;
+    if (typeof batchId !== "string" || !BATCH_ID_PATTERN.test(batchId)) {
+        return {
+            ok: false,
+            error: { code: "invalid_batch_id", message: "batchId is missing or malformed" },
+        };
+    }
+    const app = input.app;
+    if (typeof app !== "string" || app.length === 0 || app.length > 64) {
+        return { ok: false, error: { code: "invalid_app", message: "app is missing or malformed" } };
+    }
+    const installationId = input.installationId;
+    if (installationId !== undefined && typeof installationId !== "string") {
+        return {
+            ok: false,
+            error: { code: "invalid_installation_id", message: "installationId must be a string" },
+        };
+    }
+    if (schemaVersion >= 2) {
+        if (typeof installationId !== "string" || !INSTALLATION_ID_PATTERN.test(installationId)) {
+            return {
+                ok: false,
+                error: { code: "invalid_installation_id", message: "installationId is missing or malformed" },
+            };
+        }
+    }
+    else if (!installationId) {
+        warnings.push("batch without an installation id");
+    }
+    const sentAt = input.sentAt;
+    if (typeof sentAt !== "string" || !isIsoTimestamp(sentAt)) {
+        return { ok: false, error: { code: "invalid_sent_at", message: "sentAt is not a timestamp" } };
+    }
+    const records = input.records;
+    if (!Array.isArray(records)) {
+        return { ok: false, error: { code: "invalid_records", message: "records must be an array" } };
+    }
+    if (records.length === 0) {
+        return { ok: false, error: { code: "empty_batch", message: "records must not be empty" } };
+    }
+    if (records.length > limits.maxRecords) {
+        return {
+            ok: false,
+            error: {
+                code: "too_many_records",
+                message: `records exceed the limit of ${limits.maxRecords}`,
+            },
+        };
+    }
+    const sanitized = [];
+    for (const record of records) {
+        const result = sanitizeRecord(record, limits);
+        if (!result.ok) {
+            return { ok: false, error: result.error };
+        }
+        sanitized.push(result.record);
+    }
+    const batch = {
+        schemaVersion,
+        batchId,
+        app,
+        installationId: typeof installationId === "string" ? installationId : "legacy",
+        sentAt,
+        records: sanitized,
+    };
+    if (typeof input.appVersion === "string")
+        batch.appVersion = input.appVersion.slice(0, 32);
+    if (typeof input.hostLabel === "string")
+        batch.hostLabel = input.hostLabel.slice(0, 128);
+    if (typeof input.sessionId === "string")
+        batch.sessionId = input.sessionId.slice(0, 128);
+    return { ok: true, batch, warnings };
+}
+/** Record keys that are accepted. Everything else is dropped. */
+const ALLOWED_RECORD_KEYS = new Set([
+    "ts",
+    "level",
+    "source",
+    "event",
+    "message",
+    "sessionId",
+    "durationMs",
+    "fields",
+    "error",
+]);
+/**
+ * Copy only the allowed properties of a record.
+ *
+ * This is the allowlist in action: a property the contract does not know is
+ * dropped before anything else happens to the record.
+ */
+function pickAllowedProperties(input) {
+    const picked = {};
+    for (const key of ALLOWED_RECORD_KEYS) {
+        if (key in input)
+            picked[key] = input[key];
+    }
+    return picked;
+}
+/**
+ * Rebuild one record from the allowlist and redact every string.
+ *
+ * Unknown properties are dropped, `error.name`, `error.message` and
+ * `error.stack` are redacted, and structured fields lose the keys that can
+ * carry private content.
+ */
+export function sanitizeRecord(input, limits = {}) {
+    const merged = { ...DEFAULT_BATCH_LIMITS, ...limits };
+    if (!isPlainObject(input)) {
+        return { ok: false, error: { code: "invalid_record", message: "record must be an object" } };
+    }
+    const allowed = pickAllowedProperties(input);
+    const ts = allowed.ts;
+    if (typeof ts !== "string" || !isIsoTimestamp(ts)) {
+        return { ok: false, error: { code: "invalid_ts", message: "ts is not a timestamp" } };
+    }
+    const level = allowed.level;
+    if (typeof level !== "string" || !LOG_LEVELS.includes(level)) {
+        return { ok: false, error: { code: "invalid_level", message: "level is not known" } };
+    }
+    const source = allowed.source;
+    if (typeof source !== "string" || source.length === 0 || source.length > 128) {
+        return { ok: false, error: { code: "invalid_source", message: "source is missing or malformed" } };
+    }
+    const event = allowed.event;
+    if (typeof event !== "string" || event.length === 0 || event.length > 128) {
+        return { ok: false, error: { code: "invalid_event", message: "event is missing or malformed" } };
+    }
+    const record = {
+        ts,
+        level: level,
+        source,
+        event,
+    };
+    if (typeof allowed.message === "string") {
+        record.message = redactText(allowed.message).slice(0, merged.maxStringLength);
+    }
+    if (typeof allowed.sessionId === "string") {
+        record.sessionId = allowed.sessionId.slice(0, 128);
+    }
+    if (typeof allowed.durationMs === "number" && Number.isFinite(allowed.durationMs)) {
+        record.durationMs = allowed.durationMs;
+    }
+    if (isPlainObject(allowed.fields)) {
+        const fields = {};
+        let kept = 0;
+        for (const [key, value] of Object.entries(allowed.fields)) {
+            if (kept >= merged.maxFieldKeys)
+                break;
+            if (isLocalOnlyFieldKey(key))
+                continue;
+            fields[key] = redactValue(value);
+            kept++;
+        }
+        if (Object.keys(fields).length > 0)
+            record.fields = fields;
+    }
+    if (isPlainObject(allowed.error)) {
+        const error = { name: "Error", message: "" };
+        if (typeof allowed.error.name === "string") {
+            error.name = redactText(allowed.error.name).slice(0, 256);
+        }
+        if (typeof allowed.error.message === "string") {
+            error.message = redactText(allowed.error.message).slice(0, merged.maxStringLength);
+        }
+        if (typeof allowed.error.stack === "string") {
+            error.stack = redactText(allowed.error.stack).slice(0, merged.maxStringLength);
+        }
+        record.error = error;
+    }
+    return { ok: true, record };
+}
+//# sourceMappingURL=schema.js.map

package/packages/logging/dist/ingest/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../src/ingest/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,kBAAkB,EAAmE,MAAM,aAAa,CAAC;AAElH,MAAM,CAAC,MAAM,UAAU,GAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAWlF,MAAM,CAAC,MAAM,oBAAoB,GAA0B;IAC1D,UAAU,EAAE,IAAI;IAChB,eAAe,EAAE,IAAI;IACrB,YAAY,EAAE,EAAE;CAChB,CAAC;AAWF,SAAS,aAAa,CAAC,KAAc;IACpC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACpC,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AAC3C,CAAC;AAED,uEAAuE;AACvE,MAAM,gBAAgB,GAAG,0BAA0B,CAAC;AACpD,MAAM,uBAAuB,GAAG,yBAAyB,CAAC;AAE1D;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC5B,KAAc,EACd,OAAO,GAAgD,EAAE;IAEzD,MAAM,MAAM,GAAG,EAAE,GAAG,oBAAoB,EAAE,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAC9D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,yBAAyB,EAAE,EAAE,CAAC;IAC5F,CAAC;IAED,IAAI,aAAa,GAAG,KAAK,CAAC,aAAa,CAAC;IACxC,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;QACjC,sDAAsD;QACtD,aAAa,GAAG,CAAC,CAAC;QAClB,QAAQ,CAAC,IAAI,CAAC,sDAAsD,CAAC,CAAC;IACvE,CAAC;IACD,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,CAAC;QAC1E,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,gCAAgC,EAAE;SACpF,CAAC;IACH,CAAC;IACD,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,4BAA4B,EAAE;SAChF,CAAC;IACH,CAAC;IACD,IAAI,aAAa,GAAG,kBAAkB,EAAE,CAAC;QACxC,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACN,IAAI,EAAE,4BAA4B;gBAClC,OAAO,EAAE,iBAAiB,aAAa,wCAAwC,kBAAkB,EAAE;aACnG;SACD,CAAC;IACH,CAAC;IACD,IAAI,aAAa,GAAG,kBAAkB,EAAE,CAAC;QACxC,QAAQ,CAAC,IAAI,CAAC,wBAAwB,aAAa,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpE,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,iCAAiC,EAAE;SAC/E,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACpE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,6BAA6B,EAAE,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC5C,IAAI,cAAc,KAAK,SAAS,IAAI,OAAO,cAAc,KAAK,QAAQ,EAAE,CAAC;QACxE,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,iCAAiC,EAAE;SACtF,CAAC;IACH,CAAC;IACD,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QACxB,IAAI,OAAO,cAAc,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;YACzF,OAAO;gBACN,EAAE,EAAE,KAAK;gBACT,KAAK,EAAE,EAAE,IAAI,EAAE,yBAAyB,EAAE,OAAO,EAAE,wCAAwC,EAAE;aAC7F,CAAC;QACH,CAAC;IACF,CAAC;SAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAC5B,QAAQ,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE,CAAC;IAChG,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,0BAA0B,EAAE,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,EAAE,2BAA2B,EAAE,EAAE,CAAC;IAC5F,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;QACxC,OAAO;YACN,EAAE,EAAE,KAAK;YACT,KAAK,EAAE;gBACN,IAAI,EAAE,kBAAkB;gBACxB,OAAO,EAAE,+BAA+B,MAAM,CAAC,UAAU,EAAE;aAC3D;SACD,CAAC;IACH,CAAC;IAED,MAAM,SAAS,GAAgB,EAAE,CAAC;IAClC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;QAC3C,CAAC;QACD,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED,MAAM,KAAK,GAAa;QACvB,aAAa;QACb,OAAO;QACP,GAAG;QACH,cAAc,EAAE,OAAO,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ;QAC9E,MAAM;QACN,OAAO,EAAE,SAAS;KAClB,CAAC;IAEF,IAAI,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QAAE,KAAK,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3F,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QAAE,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzF,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QAAE,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAEzF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAED,iEAAiE;AACjE,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IACnC,IAAI;IACJ,OAAO;IACP,QAAQ;IACR,OAAO;IACP,SAAS;IACT,WAAW;IACX,YAAY;IACZ,QAAQ;IACR,OAAO;CACP,CAAC,CAAC;AAEH;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,KAA8B;IAC5D,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,KAAK,MAAM,GAAG,IAAI,mBAAmB,EAAE,CAAC;QACvC,IAAI,GAAG,IAAI,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAMD;;;;;;GAMG;AACH,MAAM,UAAU,cAAc,CAC7B,KAAc,EACd,MAAM,GAAmC,EAAE;IAE3C,MAAM,MAAM,GAAG,EAAE,GAAG,oBAAoB,EAAE,GAAG,MAAM,EAAE,CAAC;IACtD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,0BAA0B,EAAE,EAAE,CAAC;IAC9F,CAAC;IAED,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAE7C,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;IACtB,IAAI,OAAO,EAAE,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,CAAC;QACnD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,uBAAuB,EAAE,EAAE,CAAC;IACvF,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,KAAiB,CAAC,EAAE,CAAC;QAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,oBAAoB,EAAE,EAAE,CAAC;IACvF,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC9B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC9E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,gCAAgC,EAAE,EAAE,CAAC;IACpG,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC3E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,+BAA+B,EAAE,EAAE,CAAC;IAClG,CAAC;IAED,MAAM,MAAM,GAAc;QACzB,EAAE;QACF,KAAK,EAAE,KAAiB;QACxB,MAAM;QACN,KAAK;KACL,CAAC;IAEF,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzC,MAAM,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;IAC/E,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;QAC3C,MAAM,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,CAAC;QACnF,MAAM,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACxC,CAAC;IAED,IAAI,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,IAAI,IAAI,IAAI,MAAM,CAAC,YAAY;gBAAE,MAAM;YACvC,IAAI,mBAAmB,CAAC,GAAG,CAAC;gBAAE,SAAS;YACvC,MAAM,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;YACjC,IAAI,EAAE,CAAC;QACR,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAC5D,CAAC;IAED,IAAI,aAAa,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,KAAK,GAAiB,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC3D,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC5C,KAAK,CAAC,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC3D,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC/C,KAAK,CAAC,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;QACpF,CAAC;QACD,IAAI,OAAO,OAAO,CAAC,KAAK,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC7C,KAAK,CAAC,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,eAAe,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,CAAC,KAAK,GAAG,KAAK,CAAC;IACtB,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC"}

package/packages/logging/dist/installation.d.ts

@@ -0,0 +1,32 @@
+/**
+ * Stable installation identity.
+ *
+ * One random id per local install. It is created on first use, persisted
+ * under `~/.pi-harness-runtime/installation-id.txt` and sent with every
+ * batch so the server can tell two machines of the same user apart.
+ *
+ * The id is deliberately opaque:
+ *   - it never contains the hostname, the user name or a workspace path,
+ *   - it is not derived from anything that could identify a person,
+ *   - it is never used as an identity on the server (the tenant comes from
+ *     the authenticated credential).
+ */
+export declare const INSTALLATION_ID_FILE = "installation-id.txt";
+/** Default location of the installation id file. */
+export declare function defaultInstallationIdPath(): string;
+/** True when the value looks like a uuid (the only shape we write). */
+export declare function isValidInstallationId(value: string): boolean;
+export interface ResolveInstallationIdOptions {
+    /** File the id is read from and written to. */
+    path?: string;
+    /** Id factory (tests). */
+    generate?: () => string;
+}
+/**
+ * Resolve the installation id: read it when it exists, create it otherwise.
+ *
+ * A failed read or write never throws - the id is best effort metadata and
+ * must not break logging.
+ */
+export declare function resolveInstallationId(options?: ResolveInstallationIdOptions): string;
+//# sourceMappingURL=installation.d.ts.map

package/packages/logging/dist/installation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installation.d.ts","sourceRoot":"","sources":["../src/installation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAOH,eAAO,MAAM,oBAAoB,wBAAwB,CAAC;AAE1D,oDAAoD;AACpD,wBAAgB,yBAAyB,IAAI,MAAM,CAElD;AAID,uEAAuE;AACvE,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,MAAM,WAAW,4BAA4B;IAC5C,+CAA+C;IAC/C,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,0BAA0B;IAC1B,QAAQ,CAAC,EAAE,MAAM,MAAM,CAAC;CACxB;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,4BAAiC,GAAG,MAAM,CA6BxF"}

package/packages/logging/dist/installation.js

@@ -0,0 +1,64 @@
+/**
+ * Stable installation identity.
+ *
+ * One random id per local install. It is created on first use, persisted
+ * under `~/.pi-harness-runtime/installation-id.txt` and sent with every
+ * batch so the server can tell two machines of the same user apart.
+ *
+ * The id is deliberately opaque:
+ *   - it never contains the hostname, the user name or a workspace path,
+ *   - it is not derived from anything that could identify a person,
+ *   - it is never used as an identity on the server (the tenant comes from
+ *     the authenticated credential).
+ */
+import { randomUUID } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { dirname, join } from "node:path";
+export const INSTALLATION_ID_FILE = "installation-id.txt";
+/** Default location of the installation id file. */
+export function defaultInstallationIdPath() {
+    return join(homedir(), ".pi-harness-runtime", INSTALLATION_ID_FILE);
+}
+const UUID_PATTERN = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** True when the value looks like a uuid (the only shape we write). */
+export function isValidInstallationId(value) {
+    return UUID_PATTERN.test(value.trim());
+}
+/**
+ * Resolve the installation id: read it when it exists, create it otherwise.
+ *
+ * A failed read or write never throws - the id is best effort metadata and
+ * must not break logging.
+ */
+export function resolveInstallationId(options = {}) {
+    const path = options.path ?? defaultInstallationIdPath();
+    const generate = options.generate ?? randomUUID;
+    try {
+        if (existsSync(path)) {
+            const existing = readFileSync(path, "utf8").trim();
+            if (isValidInstallationId(existing))
+                return existing;
+        }
+    }
+    catch {
+        // Fall through and create a new id.
+    }
+    let id;
+    try {
+        id = generate();
+    }
+    catch {
+        id = randomUUID();
+    }
+    try {
+        mkdirSync(dirname(path), { recursive: true });
+        writeFileSync(path, `${id}\n`, { mode: 0o600 });
+        chmodSync(path, 0o600);
+    }
+    catch {
+        // The id still works for this process even when it cannot be persisted.
+    }
+    return id;
+}
+//# sourceMappingURL=installation.js.map

package/packages/logging/dist/installation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installation.js","sourceRoot":"","sources":["../src/installation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AACxF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,MAAM,CAAC,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAE1D,oDAAoD;AACpD,MAAM,UAAU,yBAAyB;IACxC,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,qBAAqB,EAAE,oBAAoB,CAAC,CAAC;AACrE,CAAC;AAED,MAAM,YAAY,GAAG,iEAAiE,CAAC;AAEvF,uEAAuE;AACvE,MAAM,UAAU,qBAAqB,CAAC,KAAa;IAClD,OAAO,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACxC,CAAC;AASD;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAO,GAAiC,EAAE;IAC/E,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,yBAAyB,EAAE,CAAC;IACzD,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,UAAU,CAAC;IAEhD,IAAI,CAAC;QACJ,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtB,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;YACnD,IAAI,qBAAqB,CAAC,QAAQ,CAAC;gBAAE,OAAO,QAAQ,CAAC;QACtD,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,oCAAoC;IACrC,CAAC;IAED,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACJ,EAAE,GAAG,QAAQ,EAAE,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACR,EAAE,GAAG,UAAU,EAAE,CAAC;IACnB,CAAC;IAED,IAAI,CAAC;QACJ,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChD,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACR,wEAAwE;IACzE,CAAC;IAED,OAAO,EAAE,CAAC;AACX,CAAC"}

package/packages/logging/dist/sensitive-keys.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Keys that never leave the machine.
+ *
+ * A key name is a strong hint about its content: "prompt", "output" or
+ * "transcript" carry private text, "path" and "url" carry the shape of the
+ * user's workspace. The list is shared by the client side classifier and the
+ * server side sanitizer, so both sides agree on what is private.
+ */
+export declare const LOCAL_ONLY_FIELD_KEYS: string[];
+/** True when the key is one that must not be shipped. */
+export declare function isLocalOnlyFieldKey(key: string): boolean;
+//# sourceMappingURL=sensitive-keys.d.ts.map

package/packages/logging/dist/sensitive-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-keys.d.ts","sourceRoot":"","sources":["../src/sensitive-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,eAAO,MAAM,qBAAqB,UAwBjC,CAAC;AAEF,yDAAyD;AACzD,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAGxD"}

package/packages/logging/dist/sensitive-keys.js

@@ -0,0 +1,39 @@
+/**
+ * Keys that never leave the machine.
+ *
+ * A key name is a strong hint about its content: "prompt", "output" or
+ * "transcript" carry private text, "path" and "url" carry the shape of the
+ * user's workspace. The list is shared by the client side classifier and the
+ * server side sanitizer, so both sides agree on what is private.
+ */
+export const LOCAL_ONLY_FIELD_KEYS = [
+    "prompt",
+    "response",
+    "message",
+    "content",
+    "transcript",
+    "output",
+    "stdout",
+    "stderr",
+    "command",
+    "text",
+    "body",
+    "payload",
+    "code",
+    "diff",
+    "file",
+    "path",
+    "url",
+    "uri",
+    "email",
+    "user",
+    "chat",
+    "question",
+    "answer",
+];
+/** True when the key is one that must not be shipped. */
+export function isLocalOnlyFieldKey(key) {
+    const lower = key.toLowerCase();
+    return LOCAL_ONLY_FIELD_KEYS.some((needle) => lower.includes(needle));
+}
+//# sourceMappingURL=sensitive-keys.js.map

package/packages/logging/dist/sensitive-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-keys.js","sourceRoot":"","sources":["../src/sensitive-keys.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACpC,QAAQ;IACR,UAAU;IACV,SAAS;IACT,SAAS;IACT,YAAY;IACZ,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,MAAM;IACN,MAAM;IACN,SAAS;IACT,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,KAAK;IACL,OAAO;IACP,MAAM;IACN,MAAM;IACN,UAAU;IACV,QAAQ;CACR,CAAC;AAEF,yDAAyD;AACzD,MAAM,UAAU,mBAAmB,CAAC,GAAW;IAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IAChC,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;AACvE,CAAC"}

package/packages/logging/dist/server/credentials.d.ts

@@ -0,0 +1,85 @@
+/**
+ * Scoped ingest credentials.
+ *
+ * The tenant is derived from the credential, never from the request body:
+ * a client cannot claim a tenant it does not own.
+ *
+ * Two credential shapes are supported:
+ *
+ *   1. A credential store (`log-ingest-credentials.json`) with one entry per
+ *      installation. Tokens are stored as SHA-256 hashes, so the file is safe
+ *      to keep in the key directory and a token can be revoked by removing
+ *      or revoking its entry.
+ *   2. A single shared token (`LOG_INGEST_TOKEN` or the
+ *      `log-ingest-token.txt` key file) for a single-tenant deployment. It
+ *      maps to the tenant `LOG_INGEST_TENANT` (default `default`).
+ *
+ * When neither is configured the store is NOT configured: the ingest
+ * endpoint then refuses every write (fail closed) instead of accepting
+ * anonymous batches.
+ */
+export interface LogCredential {
+    /** Stable id of the credential (safe to log). */
+    id: string;
+    /** The tenant this credential may write for. */
+    tenantId: string;
+    /** Human readable label, e.g. "laptop". */
+    label?: string;
+    /** Allowed scopes, e.g. ["logs:write", "logs:read"]. */
+    scopes: string[];
+    /** SHA-256 hash of the token, prefixed with the algorithm. */
+    tokenHash: string;
+    createdAt: string;
+    /** Set when the credential was revoked. */
+    revokedAt?: string | null;
+}
+export interface CredentialFile {
+    credentials: LogCredential[];
+}
+export interface AuthenticatedCredential {
+    credentialId: string;
+    tenantId: string;
+    scopes: string[];
+    /** True when the credential came from the shared token. */
+    shared: boolean;
+}
+export interface LogCredentialStoreOptions {
+    /** Path of the credential store file. */
+    path?: string;
+    /** Environment used for the shared token. */
+    env?: Record<string, string | undefined>;
+    /** Directory holding the key files. */
+    keysDir?: string;
+}
+export declare const DEFAULT_TENANT_ID = "default";
+export declare const LOG_WRITE_SCOPE = "logs:write";
+export declare const LOG_READ_SCOPE = "logs:read";
+/** Hash a token the way the store does. */
+export declare function hashToken(token: string): string;
+export declare class LogCredentialStore {
+    private readonly credentials;
+    private readonly shared;
+    private constructor();
+    /**
+     * Load the store from the credential file and the shared token.
+     *
+     * A malformed credential file is ignored (and reported through
+     * `loadErrors`), never fatal: the endpoint then fails closed.
+     */
+    static load(options?: LogCredentialStoreOptions): LogCredentialStore;
+    /** True when at least one usable credential exists. */
+    get configured(): boolean;
+    /** The credentials without their token hashes. */
+    list(): Omit<LogCredential, "tokenHash">[];
+    /**
+     * Authenticate a presented token.
+     *
+     * Returns null when the token is missing, unknown or revoked.
+     */
+    authenticate(token: string | undefined): AuthenticatedCredential | null;
+}
+/**
+ * Extract the bearer token from an Authorization header.
+ */
+export declare function readBearerToken(header: string | undefined): string | undefined;
+//# sourceMappingURL=credentials.d.ts.map

package/packages/logging/dist/server/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/server/credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAOH,MAAM,WAAW,aAAa;IAC7B,iDAAiD;IACjD,EAAE,EAAE,MAAM,CAAC;IACX,gDAAgD;IAChD,QAAQ,EAAE,MAAM,CAAC;IACjB,2CAA2C;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,wDAAwD;IACxD,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,8DAA8D;IAC9D,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC9B,WAAW,EAAE,aAAa,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACvC,YAAY,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,2DAA2D;IAC3D,MAAM,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACzC,yCAAyC;IACzC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6CAA6C;IAC7C,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,eAAO,MAAM,iBAAiB,YAAY,CAAC;AAC3C,eAAO,MAAM,eAAe,eAAe,CAAC;AAC5C,eAAO,MAAM,cAAc,cAAc,CAAC;AAE1C,2CAA2C;AAC3C,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAmBD,qBAAa,kBAAkB;IAC9B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAkB;IAC9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAkD;IAEzE,OAAO,eAGN;IAED;;;;;OAKG;IACH,MAAM,CAAC,IAAI,CAAC,OAAO,GAAE,yBAA8B,GAAG,kBAAkB,CAsCvE;IAED,uDAAuD;IACvD,IAAI,UAAU,IAAI,OAAO,CAKxB;IAED,kDAAkD;IAClD,IAAI,IAAI,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,EAAE,CAEzC;IAED;;;;OAIG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,uBAAuB,GAAG,IAAI,CAyBtE;CACD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAI9E"}

package/packages/logging/dist/server/credentials.js

@@ -0,0 +1,147 @@
+/**
+ * Scoped ingest credentials.
+ *
+ * The tenant is derived from the credential, never from the request body:
+ * a client cannot claim a tenant it does not own.
+ *
+ * Two credential shapes are supported:
+ *
+ *   1. A credential store (`log-ingest-credentials.json`) with one entry per
+ *      installation. Tokens are stored as SHA-256 hashes, so the file is safe
+ *      to keep in the key directory and a token can be revoked by removing
+ *      or revoking its entry.
+ *   2. A single shared token (`LOG_INGEST_TOKEN` or the
+ *      `log-ingest-token.txt` key file) for a single-tenant deployment. It
+ *      maps to the tenant `LOG_INGEST_TENANT` (default `default`).
+ *
+ * When neither is configured the store is NOT configured: the ingest
+ * endpoint then refuses every write (fail closed) instead of accepting
+ * anonymous batches.
+ */
+import { createHash, timingSafeEqual } from "node:crypto";
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+export const DEFAULT_TENANT_ID = "default";
+export const LOG_WRITE_SCOPE = "logs:write";
+export const LOG_READ_SCOPE = "logs:read";
+/** Hash a token the way the store does. */
+export function hashToken(token) {
+    return `sha256:${createHash("sha256").update(token, "utf8").digest("hex")}`;
+}
+function safeEqual(a, b) {
+    const left = Buffer.from(a, "utf8");
+    const right = Buffer.from(b, "utf8");
+    if (left.length !== right.length)
+        return false;
+    return timingSafeEqual(left, right);
+}
+function readFileTrimmed(path) {
+    try {
+        if (!existsSync(path))
+            return undefined;
+        const value = readFileSync(path, "utf8").trim();
+        return value.length > 0 ? value : undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+export class LogCredentialStore {
+    credentials;
+    shared;
+    constructor(credentials, shared) {
+        this.credentials = credentials;
+        this.shared = shared;
+    }
+    /**
+     * Load the store from the credential file and the shared token.
+     *
+     * A malformed credential file is ignored (and reported through
+     * `loadErrors`), never fatal: the endpoint then fails closed.
+     */
+    static load(options = {}) {
+        const env = options.env ?? process.env;
+        const keysDir = options.keysDir ?? join(homedir(), ".pi-harness-runtime", "keys");
+        const path = options.path ?? join(keysDir, "log-ingest-credentials.json");
+        const credentials = [];
+        try {
+            if (existsSync(path)) {
+                const parsed = JSON.parse(readFileSync(path, "utf8"));
+                if (Array.isArray(parsed?.credentials)) {
+                    for (const entry of parsed.credentials) {
+                        if (entry &&
+                            typeof entry.id === "string" &&
+                            typeof entry.tenantId === "string" &&
+                            typeof entry.tokenHash === "string") {
+                            credentials.push({
+                                ...entry,
+                                scopes: Array.isArray(entry.scopes) ? entry.scopes : [LOG_WRITE_SCOPE],
+                                createdAt: entry.createdAt ?? new Date(0).toISOString(),
+                                revokedAt: entry.revokedAt ?? null,
+                            });
+                        }
+                    }
+                }
+            }
+        }
+        catch {
+            // A broken file must not open the door: the store stays unconfigured.
+        }
+        const sharedToken = env.LOG_INGEST_TOKEN ?? readFileTrimmed(join(keysDir, "log-ingest-token.txt"));
+        const shared = sharedToken
+            ? { token: sharedToken, tenantId: env.LOG_INGEST_TENANT ?? DEFAULT_TENANT_ID }
+            : undefined;
+        return new LogCredentialStore(credentials, shared);
+    }
+    /** True when at least one usable credential exists. */
+    get configured() {
+        return (this.shared !== undefined ||
+            this.credentials.some((credential) => !credential.revokedAt));
+    }
+    /** The credentials without their token hashes. */
+    list() {
+        return this.credentials.map(({ tokenHash: _tokenHash, ...rest }) => rest);
+    }
+    /**
+     * Authenticate a presented token.
+     *
+     * Returns null when the token is missing, unknown or revoked.
+     */
+    authenticate(token) {
+        if (!token)
+            return null;
+        if (this.shared && safeEqual(hashToken(token), hashToken(this.shared.token))) {
+            return {
+                credentialId: "shared",
+                tenantId: this.shared.tenantId,
+                scopes: [LOG_WRITE_SCOPE, LOG_READ_SCOPE],
+                shared: true,
+            };
+        }
+        const presented = hashToken(token);
+        for (const credential of this.credentials) {
+            if (credential.revokedAt)
+                continue;
+            if (!safeEqual(presented, credential.tokenHash))
+                continue;
+            return {
+                credentialId: credential.id,
+                tenantId: credential.tenantId,
+                scopes: credential.scopes,
+                shared: false,
+            };
+        }
+        return null;
+    }
+}
+/**
+ * Extract the bearer token from an Authorization header.
+ */
+export function readBearerToken(header) {
+    if (!header)
+        return undefined;
+    const match = /^Bearer\s+(.+)$/i.exec(header.trim());
+    return match ? match[1].trim() : undefined;
+}
+//# sourceMappingURL=credentials.js.map