pi-harness-runtime 1.1.396 → 1.1.398

package/packages/logging/README.md

@@ -3,17 +3,26 @@
 Centralized structured application logging for pi-harness.
 
 ```text
-producer -> redact -> sample -> buffer -> R2 -> webhook -> local spool
+client: producer -> classify -> redact -> sample -> buffer -> webhook -> local spool
+server: POST /api/logs -> authenticate -> validate -> durable outbox -> 202
+                                                        |
+                                                        v
+                                              worker -> R2 -> done
 ```
 
+- **Classification**: an event allowlist decides what may leave the machine. Prompts,
+  responses, command output and the catch-all `harness.log` mirror stay local.
 - **Redaction**: credential-looking keys, bearer tokens, JWTs and long token runs are
   replaced; strings are truncated and structures are depth limited.
 - **Sampling**: minimum level, a deterministic sample rate for `debug` records and a
   per source+event rate limit. Errors are never sampled away.
 - **Buffering**: bounded in-memory buffer; when it is full the least severe record is
   dropped and the drop is counted.
-- **Delivery**: transports are tried in order (R2, webhook). If all of them fail the
-  batch is spooled to disk as NDJSON and retried on the next flush.
+- **Delivery**: transports are a FALLBACK chain (the first success wins, the rest are
+  skipped - never a broadcast). If all of them fail the batch is spooled to disk as
+  NDJSON and retried on the next flush.
+- **Durability**: the server only answers `202` after the batch is written to its
+  durable outbox. A background worker uploads it to R2 with a bounded backoff.
 
 ## Usage
 
@@ -21,17 +30,43 @@ producer -> redact -> sample -> buffer -> R2 -> webhook -> local spool
 import { centralInfo, centralWarn, initCentralLogging } from "./packages/logging/dist/index.js";
 
 initCentralLogging();                       // reads the environment and the key files
-centralInfo("harness", "startup", "ready", { pid: process.pid });
+centralInfo("harness.service-diagnostics", "service.check", "service is up", { durationMs: 3 });
 ```
 
+The event name decides whether the record may be shipped: use an allowlisted shape
+(`service.*`, `session.*`, `validation.*`, `harness.service-diagnostics.*`,
+`harness.planner.decision`, `harness.glm-quota.quota`) or a `warn`/`error` level.
+
 ## Transports
 
 | Transport | Purpose |
 |-----------|---------|
-| `createR2Transport` | Cloudflare R2 (S3 API), gzipped NDJSON under a date prefix |
-| `createWebhookTransport` | HTTP POST to the unified webhook server (`/api/logs`) |
+| `createWebhookTransport` | HTTP POST to the unified webhook server (`/api/logs`) - the client ingress point |
+| `createR2Transport` | Cloudflare R2 (S3 API), gzipped NDJSON under a date prefix - normally used by the server, not by clients |
 | `LogSpool` | Local NDJSON fallback, rotated by size, with retention |
 
+## Server side
+
+```ts
+import {
+  LogCredentialStore,
+  LogIndexStore,
+  LogIngestService,
+  LogOutbox,
+  LogOutboxWorker,
+  createLogHttpHandler,
+} from "./packages/logging/dist/index.js";
+
+const credentials = LogCredentialStore.load();
+const outbox = new LogOutbox({ dir: `${home}/.pi-harness-runtime/logs/outbox` });
+const index = new LogIndexStore({ dir: `${home}/.pi-harness-runtime/logs/index` });
+const service = new LogIngestService({ credentials, outbox, index });
+const handler = createLogHttpHandler({ service, outbox, index });
+```
+
+The credential store decides whether the endpoint exists: without a credential every
+write is refused (`503`). The tenant comes from the credential, never from the body.
+
 ## Configuration
 
 See the "Centralized Application Logging" section in the repository `AGENTS.md`.

package/packages/logging/dist/classification.d.ts

@@ -0,0 +1,65 @@
+/**
+ * What may leave the machine.
+ *
+ * The local log file keeps everything. The centralized archive keeps what an
+ * operator actually needs: service state, event codes, sanitized errors,
+ * durations and opaque identifiers.
+ *
+ * Two rules decide:
+ *
+ *   1. The event decides. A catch-all mirror of a local log line
+ *      (`harness.log`) or anything that smells like a prompt, a response or
+ *      command output never leaves the machine.
+ *   2. The payload decides. A message only travels when it looks like a
+ *      sanitized summary: short, one line, no path and no URL with a query
+ *      string. Fields with a private key name are dropped.
+ *
+ * The diagnostic mode (`PI_LOG_DIAGNOSTIC=1`) relaxes rule 2 for a user who
+ * explicitly asked for more, and nothing else.
+ */
+import type { LogRecord } from "./types.js";
+export interface ClassificationPolicy {
+    /** Events that may go remote. */
+    remoteEvents: RegExp[];
+    /** Events that never go remote, whatever the level is. */
+    localEvents: RegExp[];
+    /** Keep a message even when it does not look sanitized. */
+    allowRawMessages: boolean;
+    /** Maximum length of a message that is kept. */
+    maxMessageLength: number;
+}
+/**
+ * Events that stay local.
+ *
+ * `harness.log` is the mirror of the catch-all local log line - it carries
+ * whatever the harness printed, so it is never remote.
+ */
+export declare const DEFAULT_LOCAL_EVENTS: RegExp[];
+/**
+ * Events that may go remote.
+ *
+ * They are structured: a service state change, a session lifecycle event, a
+ * validation tier, a provider or quota event.
+ */
+export declare const DEFAULT_REMOTE_EVENTS: RegExp[];
+export declare const DEFAULT_CLASSIFICATION_POLICY: ClassificationPolicy;
+/**
+ * True when a message looks like a sanitized summary and may travel.
+ */
+export declare function isSanitizedMessage(message: string, policy: ClassificationPolicy): boolean;
+/**
+ * Classify one record.
+ *
+ * "remote" means the record may be shipped; "local" means it must stay on
+ * the machine.
+ */
+export declare function classifyRecord(record: LogRecord, policy?: ClassificationPolicy): "remote" | "local";
+/**
+ * Build the version of a record that may leave the machine.
+ *
+ * Returns null when the record must stay local.
+ */
+export declare function prepareRemoteRecord(record: LogRecord, policy?: ClassificationPolicy): LogRecord | null;
+/** Keep only the records that may leave the machine. */
+export declare function filterRemoteRecords(records: LogRecord[], policy?: ClassificationPolicy): LogRecord[];
+//# sourceMappingURL=classification.d.ts.map

package/packages/logging/dist/classification.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"classification.d.ts","sourceRoot":"","sources":["../src/classification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAE5C,MAAM,WAAW,oBAAoB;IACpC,iCAAiC;IACjC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,0DAA0D;IAC1D,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,2DAA2D;IAC3D,gBAAgB,EAAE,OAAO,CAAC;IAC1B,gDAAgD;IAChD,gBAAgB,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,MAAM,EAUxC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,MAAM,EAiBzC,CAAC;AAEF,eAAO,MAAM,6BAA6B,EAAE,oBAK3C,CAAC;AAKF;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAOzF;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC7B,MAAM,EAAE,SAAS,EACjB,MAAM,GAAE,oBAAoD,GAC1D,QAAQ,GAAG,OAAO,CAapB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,SAAS,EACjB,MAAM,GAAE,oBAAoD,GAC1D,SAAS,GAAG,IAAI,CA8BlB;AAED,wDAAwD;AACxD,wBAAgB,mBAAmB,CAClC,OAAO,EAAE,SAAS,EAAE,EACpB,MAAM,GAAE,oBAAoD,GAC1D,SAAS,EAAE,CAOb"}

package/packages/logging/dist/classification.js

@@ -0,0 +1,155 @@
+/**
+ * What may leave the machine.
+ *
+ * The local log file keeps everything. The centralized archive keeps what an
+ * operator actually needs: service state, event codes, sanitized errors,
+ * durations and opaque identifiers.
+ *
+ * Two rules decide:
+ *
+ *   1. The event decides. A catch-all mirror of a local log line
+ *      (`harness.log`) or anything that smells like a prompt, a response or
+ *      command output never leaves the machine.
+ *   2. The payload decides. A message only travels when it looks like a
+ *      sanitized summary: short, one line, no path and no URL with a query
+ *      string. Fields with a private key name are dropped.
+ *
+ * The diagnostic mode (`PI_LOG_DIAGNOSTIC=1`) relaxes rule 2 for a user who
+ * explicitly asked for more, and nothing else.
+ */
+import { isLocalOnlyFieldKey } from "./sensitive-keys.js";
+/**
+ * Events that stay local.
+ *
+ * `harness.log` is the mirror of the catch-all local log line - it carries
+ * whatever the harness printed, so it is never remote.
+ */
+export const DEFAULT_LOCAL_EVENTS = [
+    /^harness\.log$/,
+    /prompt/i,
+    /response/i,
+    /transcript/i,
+    /output/i,
+    /command/i,
+    /content/i,
+    /message\.text/i,
+    /notification\.text/i,
+];
+/**
+ * Events that may go remote.
+ *
+ * They are structured: a service state change, a session lifecycle event, a
+ * validation tier, a provider or quota event.
+ */
+export const DEFAULT_REMOTE_EVENTS = [
+    /^harness\.service-diagnostics\./,
+    /^harness\.session\./,
+    /^harness\.startup\./,
+    /^harness\.shutdown\./,
+    /^harness\.planner\.decision$/,
+    /^harness\.glm-quota\.quota$/,
+    /^validation\./,
+    /^tier\./,
+    /^service\./,
+    /^session\./,
+    /^startup\./,
+    /^config\./,
+    /^provider\./,
+    /^quota\./,
+    /^logging\./,
+    /^jest\./,
+];
+export const DEFAULT_CLASSIFICATION_POLICY = {
+    remoteEvents: DEFAULT_REMOTE_EVENTS,
+    localEvents: DEFAULT_LOCAL_EVENTS,
+    allowRawMessages: false,
+    maxMessageLength: 200,
+};
+const ABSOLUTE_PATH = /(?:^|\s)\/(?:[\w.-]+\/)+[\w.-]+/;
+const URL_WITH_QUERY = /https?:\/\/\S+\?\S+/;
+/**
+ * True when a message looks like a sanitized summary and may travel.
+ */
+export function isSanitizedMessage(message, policy) {
+    if (policy.allowRawMessages)
+        return true;
+    if (message.length > policy.maxMessageLength)
+        return false;
+    if (message.includes("\n"))
+        return false;
+    if (ABSOLUTE_PATH.test(message))
+        return false;
+    if (URL_WITH_QUERY.test(message))
+        return false;
+    return true;
+}
+/**
+ * Classify one record.
+ *
+ * "remote" means the record may be shipped; "local" means it must stay on
+ * the machine.
+ */
+export function classifyRecord(record, policy = DEFAULT_CLASSIFICATION_POLICY) {
+    for (const pattern of policy.localEvents) {
+        if (pattern.test(record.event))
+            return "local";
+    }
+    for (const pattern of policy.remoteEvents) {
+        if (pattern.test(record.event))
+            return "remote";
+    }
+    // Errors stay valuable even when the event is unknown: the message and
+    // the fields are sanitized anyway.
+    if (record.level === "warn" || record.level === "error")
+        return "remote";
+    // Unknown events are local by default: an allowlist is safer than a
+    // denylist.
+    return "local";
+}
+/**
+ * Build the version of a record that may leave the machine.
+ *
+ * Returns null when the record must stay local.
+ */
+export function prepareRemoteRecord(record, policy = DEFAULT_CLASSIFICATION_POLICY) {
+    if (classifyRecord(record, policy) === "local")
+        return null;
+    const remote = {
+        ts: record.ts,
+        level: record.level,
+        source: record.source,
+        event: record.event,
+    };
+    if (record.message !== undefined && isSanitizedMessage(record.message, policy)) {
+        remote.message = record.message;
+    }
+    if (record.sessionId)
+        remote.sessionId = record.sessionId;
+    if (typeof record.durationMs === "number")
+        remote.durationMs = record.durationMs;
+    if (record.fields) {
+        const fields = {};
+        for (const [key, value] of Object.entries(record.fields)) {
+            if (isLocalOnlyFieldKey(key))
+                continue;
+            fields[key] = value;
+        }
+        if (Object.keys(fields).length > 0)
+            remote.fields = fields;
+    }
+    if (record.error) {
+        remote.error = { ...record.error };
+    }
+    return remote;
+}
+/** Keep only the records that may leave the machine. */
+export function filterRemoteRecords(records, policy = DEFAULT_CLASSIFICATION_POLICY) {
+    const remote = [];
+    for (const record of records) {
+        const prepared = prepareRemoteRecord(record, policy);
+        if (prepared)
+            remote.push(prepared);
+    }
+    return remote;
+}
+//# sourceMappingURL=classification.js.map

package/packages/logging/dist/classification.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"classification.js","sourceRoot":"","sources":["../src/classification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAc1D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAa;IAC7C,gBAAgB;IAChB,SAAS;IACT,WAAW;IACX,aAAa;IACb,SAAS;IACT,UAAU;IACV,UAAU;IACV,gBAAgB;IAChB,qBAAqB;CACrB,CAAC;AAEF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAa;IAC9C,iCAAiC;IACjC,qBAAqB;IACrB,qBAAqB;IACrB,sBAAsB;IACtB,8BAA8B;IAC9B,6BAA6B;IAC7B,eAAe;IACf,SAAS;IACT,YAAY;IACZ,YAAY;IACZ,YAAY;IACZ,WAAW;IACX,aAAa;IACb,UAAU;IACV,YAAY;IACZ,SAAS;CACT,CAAC;AAEF,MAAM,CAAC,MAAM,6BAA6B,GAAyB;IAClE,YAAY,EAAE,qBAAqB;IACnC,WAAW,EAAE,oBAAoB;IACjC,gBAAgB,EAAE,KAAK;IACvB,gBAAgB,EAAE,GAAG;CACrB,CAAC;AAEF,MAAM,aAAa,GAAG,iCAAiC,CAAC;AACxD,MAAM,cAAc,GAAG,qBAAqB,CAAC;AAE7C;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,MAA4B;IAC/E,IAAI,MAAM,CAAC,gBAAgB;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,OAAO,CAAC,MAAM,GAAG,MAAM,CAAC,gBAAgB;QAAE,OAAO,KAAK,CAAC;IAC3D,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAC7B,MAAiB,EACjB,MAAM,GAAyB,6BAA6B;IAE5D,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,WAAW,EAAE,CAAC;QAC1C,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,OAAO,CAAC;IAChD,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QAC3C,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;IACjD,CAAC;IACD,uEAAuE;IACvE,mCAAmC;IACnC,IAAI,MAAM,CAAC,KAAK,KAAK,MAAM,IAAI,MAAM,CAAC,KAAK,KAAK,OAAO;QAAE,OAAO,QAAQ,CAAC;IACzE,oEAAoE;IACpE,YAAY;IACZ,OAAO,OAAO,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAClC,MAAiB,EACjB,MAAM,GAAyB,6BAA6B;IAE5D,IAAI,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAE5D,MAAM,MAAM,GAAc;QACzB,EAAE,EAAE,MAAM,CAAC,EAAE;QACb,KAAK,EAAE,MAAM,CAAC,KAAK;QACnB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,KAAK,EAAE,MAAM,CAAC,KAAK;KACnB,CAAC;IAEF,IAAI,MAAM,CAAC,OAAO,KAAK,SAAS,IAAI,kBAAkB,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QAChF,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;IACjC,CAAC;IACD,IAAI,MAAM,CAAC,SAAS;QAAE,MAAM,CAAC,SAAS,GAAG,MAAM,CAAC,SAAS,CAAC;IAC1D,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ;QAAE,MAAM,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;IAEjF,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1D,IAAI,mBAAmB,CAAC,GAAG,CAAC;gBAAE,SAAS;YACvC,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACrB,CAAC;QACD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC;IAC5D,CAAC;IAED,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,CAAC,KAAK,GAAG,EAAE,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC;IACpC,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,mBAAmB,CAClC,OAAoB,EACpB,MAAM,GAAyB,6BAA6B;IAE5D,MAAM,MAAM,GAAgB,EAAE,CAAC;IAC/B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,mBAAmB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACrD,IAAI,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC"}

package/packages/logging/dist/config.d.ts

@@ -7,6 +7,7 @@
  * Secrets are never hardcoded here. A key file that is missing simply means
  * the corresponding transport is not configured.
  */
+import { type ClassificationPolicy } from "./classification.js";
 import type { LogBufferOptions } from "./buffer.js";
 import type { SamplingPolicy } from "./sampler.js";
 import type { LogTransport } from "./types.js";
@@ -16,6 +17,10 @@ export interface LogSinkConfig {
     enabled: boolean;
     /** Application name reported with every batch. */
     app: string;
+    /** Version of the emitting application. */
+    appVersion?: string;
+    /** Stable id of this installation. */
+    installationId: string;
     /** Transports in delivery priority order. */
     transports: LogTransport[];
     /** Directory of the local spool (undefined when logging is off). */
@@ -23,6 +28,8 @@ export interface LogSinkConfig {
     sampling: Partial<SamplingPolicy>;
     buffer: LogBufferOptions;
     flushIntervalMs: number;
+    /** What may leave the machine. */
+    classification: ClassificationPolicy;
     /** Human readable notes about what was enabled and why. */
     notes: string[];
 }
@@ -30,6 +37,8 @@ export interface ResolveConfigOptions {
     env?: Record<string, string | undefined>;
     /** Directory holding the credential key files. */
     keysDir?: string;
+    /** Overrides the installation id (tests, containers). */
+    installationId?: string;
 }
 export declare function defaultKeysDir(): string;
 export declare function defaultSpoolDir(): string;

package/packages/logging/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,CAAC;AAE3E,MAAM,WAAW,aAAa;IAC7B,sEAAsE;IACtE,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,6CAA6C;IAC7C,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAClC,MAAM,EAAE,gBAAgB,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,2DAA2D;IAC3D,KAAK,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAoBD,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,oBAAyB,GAAG,aAAa,CA0FtF"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAQH,OAAO,EAEN,KAAK,oBAAoB,EACzB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,MAAM,MAAM,WAAW,GAAG,KAAK,GAAG,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,YAAY,CAAC;AAE3E,MAAM,WAAW,aAAa;IAC7B,sEAAsE;IACtE,OAAO,EAAE,OAAO,CAAC;IACjB,kDAAkD;IAClD,GAAG,EAAE,MAAM,CAAC;IACZ,2CAA2C;IAC3C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,cAAc,EAAE,MAAM,CAAC;IACvB,6CAA6C;IAC7C,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IAClC,MAAM,EAAE,gBAAgB,CAAC;IACzB,eAAe,EAAE,MAAM,CAAC;IACxB,kCAAkC;IAClC,cAAc,EAAE,oBAAoB,CAAC;IACrC,2DAA2D;IAC3D,KAAK,EAAE,MAAM,EAAE,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACpC,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;IACzC,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yDAAyD;IACzD,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB;AAoBD,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED,wBAAgB,eAAe,IAAI,MAAM,CAExC;AAiBD;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,GAAE,oBAAyB,GAAG,aAAa,CAuHtF"}

package/packages/logging/dist/config.js

@@ -12,6 +12,8 @@ import { homedir } from "node:os";
 import { join } from "node:path";
 import { createR2Transport } from "./transports/r2.js";
 import { createWebhookTransport } from "./transports/webhook.js";
+import { resolveInstallationId } from "./installation.js";
+import { DEFAULT_CLASSIFICATION_POLICY, } from "./classification.js";
 function readKeyFile(keysDir, name) {
     const file = join(keysDir, name);
     if (!existsSync(file))
@@ -32,6 +34,19 @@ export function defaultKeysDir() {
 export function defaultSpoolDir() {
     return join(homedir(), ".pi-harness-runtime", "logs", "spool");
 }
+/**
+ * Build the classification policy.
+ *
+ * `PI_LOG_DIAGNOSTIC=1` is the explicit, user controlled diagnostic mode: it
+ * lets messages travel that the default policy keeps local. It never widens
+ * the event allowlist - only the message rule.
+ */
+function classificationFor(env) {
+    const diagnostic = env.PI_LOG_DIAGNOSTIC === "1" || env.PI_LOG_DIAGNOSTIC === "true";
+    if (!diagnostic)
+        return DEFAULT_CLASSIFICATION_POLICY;
+    return { ...DEFAULT_CLASSIFICATION_POLICY, allowRawMessages: true };
+}
 /**
  * Build the log sink configuration from the environment and the key files.
  */
@@ -40,14 +55,17 @@ export function resolveLogSinkConfig(options = {}) {
     const keysDir = options.keysDir ?? defaultKeysDir();
     const mode = (env.PI_LOG_SINK ?? "auto");
     const notes = [];
+    const installationId = options.installationId ?? env.PI_LOG_INSTALLATION_ID ?? resolveInstallationId();
     if (mode === "off") {
         return {
             enabled: false,
             app: env.PI_LOG_APP ?? "pi-harness",
+            installationId,
             transports: [],
             sampling: {},
             buffer: {},
             flushIntervalMs: 0,
+            classification: classificationFor(env),
             notes: ["logging disabled by PI_LOG_SINK=off"],
         };
     }
@@ -60,7 +78,19 @@ export function resolveLogSinkConfig(options = {}) {
         readKeyFile(keysDir, "r2-endpoint.txt") ??
         (accountId ? `https://${accountId}.r2.cloudflarestorage.com` : undefined);
     const r2Ready = Boolean(bucket && accessKeyId && secretAccessKey && endpoint);
-    const wantR2 = mode === "r2" || mode === "r2+webhook" || (mode === "auto" && r2Ready);
+    const webhookUrl = env.PI_LOG_WEBHOOK_URL;
+    /*
+     * Transport selection.
+     *
+     * The transports form a FALLBACK chain, not a broadcast: the first
+     * transport that accepts the batch wins and the later ones are not
+     * called. `auto` therefore prefers the webhook ingress when one is
+     * configured: the server is the single writer to R2, so client machines
+     * never need R2 credentials at all.
+     */
+    const wantR2 = mode === "r2" ||
+        mode === "r2+webhook" ||
+        (mode === "auto" && r2Ready && !webhookUrl);
     if (wantR2) {
         if (r2Ready) {
             transports.push(createR2Transport({
@@ -76,7 +106,6 @@ export function resolveLogSinkConfig(options = {}) {
             notes.push("r2 requested but credentials are incomplete - transport skipped");
         }
     }
-    const webhookUrl = env.PI_LOG_WEBHOOK_URL;
     const wantWebhook = mode === "webhook" || mode === "r2+webhook" || (mode === "auto" && Boolean(webhookUrl));
     if (wantWebhook) {
         if (webhookUrl) {
@@ -85,6 +114,9 @@ export function resolveLogSinkConfig(options = {}) {
                 token: env.PI_LOG_WEBHOOK_TOKEN,
             }));
             notes.push(`webhook enabled (${webhookUrl})`);
+            if (mode === "auto") {
+                notes.push("webhook is the client ingress point - the server writes to R2 (direct r2 transport skipped)");
+            }
         }
         else {
             notes.push("webhook requested but PI_LOG_WEBHOOK_URL is not set - transport skipped");
@@ -93,9 +125,10 @@ export function resolveLogSinkConfig(options = {}) {
     if (transports.length === 0) {
         notes.push("no transport configured - logs stay local");
     }
-    return {
+    const config = {
         enabled: true,
         app: env.PI_LOG_APP ?? "pi-harness",
+        installationId,
         transports,
         spoolDir: env.PI_LOG_SPOOL_DIR ?? defaultSpoolDir(),
         sampling: {
@@ -108,7 +141,11 @@ export function resolveLogSinkConfig(options = {}) {
             maxBatchSize: readNumber(env, "PI_LOG_BATCH_SIZE", 100),
         },
         flushIntervalMs: readNumber(env, "PI_LOG_FLUSH_INTERVAL_MS", 15_000),
+        classification: classificationFor(env),
         notes,
     };
+    if (env.PI_LOG_APP_VERSION)
+        config.appVersion = env.PI_LOG_APP_VERSION;
+    return config;
 }
 //# sourceMappingURL=config.js.map

package/packages/logging/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AA6BjE,SAAS,WAAW,CAAC,OAAe,EAAE,IAAY;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAClB,GAAuC,EACvC,GAAW,EACX,QAAgB;IAEhB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,cAAc;IAC7B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,eAAe;IAC9B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,qBAAqB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAO,GAAyB,EAAE;IACtE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,CAAgB,CAAC;IACxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,GAAG,EAAE,GAAG,CAAC,UAAU,IAAI,YAAY;YACnC,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,EAAE;YACV,eAAe,EAAE,CAAC;YAClB,KAAK,EAAE,CAAC,qCAAqC,CAAC;SAC9C,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAmB,EAAE,CAAC;IAEtC,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,IAAI,WAAW,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IAClF,MAAM,WAAW,GAChB,GAAG,CAAC,uBAAuB,IAAI,WAAW,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAC7E,MAAM,eAAe,GACpB,GAAG,CAAC,2BAA2B,IAAI,WAAW,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,GAAG,CAAC,oBAAoB,IAAI,WAAW,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACxF,MAAM,QAAQ,GACb,GAAG,CAAC,kBAAkB;QACtB,WAAW,CAAC,OAAO,EAAE,iBAAiB,CAAC;QACvC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,SAAS,2BAA2B,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAE3E,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,WAAW,IAAI,eAAe,IAAI,QAAQ,CAAC,CAAC;IAC9E,MAAM,MAAM,GAAG,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,YAAY,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,CAAC;IAEtF,IAAI,MAAM,EAAE,CAAC;QACZ,IAAI,OAAO,EAAE,CAAC;YACb,UAAU,CAAC,IAAI,CACd,iBAAiB,CAAC;gBACjB,MAAM,EAAE,MAAgB;gBACxB,QAAQ,EAAE,QAAkB;gBAC5B,WAAW,EAAE,WAAqB;gBAClC,eAAe,EAAE,eAAyB;gBAC1C,MAAM,EAAE,GAAG,CAAC,gBAAgB,IAAI,cAAc;aAC9C,CAAC,CACF,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,GAAG,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACP,KAAK,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;QAC/E,CAAC;IACF,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,kBAAkB,CAAC;IAC1C,MAAM,WAAW,GAChB,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,YAAY,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAEzF,IAAI,WAAW,EAAE,CAAC;QACjB,IAAI,UAAU,EAAE,CAAC;YAChB,UAAU,CAAC,IAAI,CACd,sBAAsB,CAAC;gBACtB,GAAG,EAAE,UAAU;gBACf,KAAK,EAAE,GAAG,CAAC,oBAAoB;aAC/B,CAAC,CACF,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,oBAAoB,UAAU,GAAG,CAAC,CAAC;QAC/C,CAAC;aAAM,CAAC;YACP,KAAK,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;QACvF,CAAC;IACF,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IACzD,CAAC;IAED,OAAO;QACN,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,GAAG,CAAC,UAAU,IAAI,YAAY;QACnC,UAAU;QACV,QAAQ,EAAE,GAAG,CAAC,gBAAgB,IAAI,eAAe,EAAE;QACnD,QAAQ,EAAE;YACT,QAAQ,EAAG,GAAG,CAAC,YAA2C,IAAI,MAAM;YACpE,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE,oBAAoB,EAAE,GAAG,CAAC;YACtD,kBAAkB,EAAE,UAAU,CAAC,GAAG,EAAE,mBAAmB,EAAE,EAAE,CAAC;SAC5D;QACD,MAAM,EAAE;YACP,OAAO,EAAE,UAAU,CAAC,GAAG,EAAE,oBAAoB,EAAE,IAAI,CAAC;YACpD,YAAY,EAAE,UAAU,CAAC,GAAG,EAAE,mBAAmB,EAAE,GAAG,CAAC;SACvD;QACD,eAAe,EAAE,UAAU,CAAC,GAAG,EAAE,0BAA0B,EAAE,MAAM,CAAC;QACpE,KAAK;KACL,CAAC;AACH,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,OAAO,EACN,6BAA6B,GAE7B,MAAM,qBAAqB,CAAC;AAqC7B,SAAS,WAAW,CAAC,OAAe,EAAE,IAAY;IACjD,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAChD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7C,CAAC;AAED,SAAS,UAAU,CAClB,GAAuC,EACvC,GAAW,EACX,QAAgB;IAEhB,MAAM,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,IAAI,CAAC,GAAG;QAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC3B,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,cAAc;IAC7B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,eAAe;IAC9B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,qBAAqB,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;GAMG;AACH,SAAS,iBAAiB,CACzB,GAAuC;IAEvC,MAAM,UAAU,GAAG,GAAG,CAAC,iBAAiB,KAAK,GAAG,IAAI,GAAG,CAAC,iBAAiB,KAAK,MAAM,CAAC;IACrF,IAAI,CAAC,UAAU;QAAE,OAAO,6BAA6B,CAAC;IACtD,OAAO,EAAE,GAAG,6BAA6B,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC;AACrE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAO,GAAyB,EAAE;IACtE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,cAAc,EAAE,CAAC;IACpD,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,WAAW,IAAI,MAAM,CAAgB,CAAC;IACxD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,cAAc,GACnB,OAAO,CAAC,cAAc,IAAI,GAAG,CAAC,sBAAsB,IAAI,qBAAqB,EAAE,CAAC;IAEjF,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO;YACN,OAAO,EAAE,KAAK;YACd,GAAG,EAAE,GAAG,CAAC,UAAU,IAAI,YAAY;YACnC,cAAc;YACd,UAAU,EAAE,EAAE;YACd,QAAQ,EAAE,EAAE;YACZ,MAAM,EAAE,EAAE;YACV,eAAe,EAAE,CAAC;YAClB,cAAc,EAAE,iBAAiB,CAAC,GAAG,CAAC;YACtC,KAAK,EAAE,CAAC,qCAAqC,CAAC;SAC9C,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAmB,EAAE,CAAC;IAEtC,MAAM,MAAM,GAAG,GAAG,CAAC,gBAAgB,IAAI,WAAW,CAAC,OAAO,EAAE,oBAAoB,CAAC,CAAC;IAClF,MAAM,WAAW,GAChB,GAAG,CAAC,uBAAuB,IAAI,WAAW,CAAC,OAAO,EAAE,sBAAsB,CAAC,CAAC;IAC7E,MAAM,eAAe,GACpB,GAAG,CAAC,2BAA2B,IAAI,WAAW,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,GAAG,CAAC,oBAAoB,IAAI,WAAW,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC;IACxF,MAAM,QAAQ,GACb,GAAG,CAAC,kBAAkB;QACtB,WAAW,CAAC,OAAO,EAAE,iBAAiB,CAAC;QACvC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,SAAS,2BAA2B,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAE3E,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,IAAI,WAAW,IAAI,eAAe,IAAI,QAAQ,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,GAAG,CAAC,kBAAkB,CAAC;IAE1C;;;;;;;;OAQG;IACH,MAAM,MAAM,GACX,IAAI,KAAK,IAAI;QACb,IAAI,KAAK,YAAY;QACrB,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,UAAU,CAAC,CAAC;IAE7C,IAAI,MAAM,EAAE,CAAC;QACZ,IAAI,OAAO,EAAE,CAAC;YACb,UAAU,CAAC,IAAI,CACd,iBAAiB,CAAC;gBACjB,MAAM,EAAE,MAAgB;gBACxB,QAAQ,EAAE,QAAkB;gBAC5B,WAAW,EAAE,WAAqB;gBAClC,eAAe,EAAE,eAAyB;gBAC1C,MAAM,EAAE,GAAG,CAAC,gBAAgB,IAAI,cAAc;aAC9C,CAAC,CACF,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,sBAAsB,MAAM,GAAG,CAAC,CAAC;QAC7C,CAAC;aAAM,CAAC;YACP,KAAK,CAAC,IAAI,CAAC,iEAAiE,CAAC,CAAC;QAC/E,CAAC;IACF,CAAC;IAED,MAAM,WAAW,GAChB,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,YAAY,IAAI,CAAC,IAAI,KAAK,MAAM,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC;IAEzF,IAAI,WAAW,EAAE,CAAC;QACjB,IAAI,UAAU,EAAE,CAAC;YAChB,UAAU,CAAC,IAAI,CACd,sBAAsB,CAAC;gBACtB,GAAG,EAAE,UAAU;gBACf,KAAK,EAAE,GAAG,CAAC,oBAAoB;aAC/B,CAAC,CACF,CAAC;YACF,KAAK,CAAC,IAAI,CAAC,oBAAoB,UAAU,GAAG,CAAC,CAAC;YAC9C,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;gBACrB,KAAK,CAAC,IAAI,CACT,6FAA6F,CAC7F,CAAC;YACH,CAAC;QACF,CAAC;aAAM,CAAC;YACP,KAAK,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;QACvF,CAAC;IACF,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,2CAA2C,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,MAAM,GAAkB;QAC7B,OAAO,EAAE,IAAI;QACb,GAAG,EAAE,GAAG,CAAC,UAAU,IAAI,YAAY;QACnC,cAAc;QACd,UAAU;QACV,QAAQ,EAAE,GAAG,CAAC,gBAAgB,IAAI,eAAe,EAAE;QACnD,QAAQ,EAAE;YACT,QAAQ,EAAG,GAAG,CAAC,YAA2C,IAAI,MAAM;YACpE,UAAU,EAAE,UAAU,CAAC,GAAG,EAAE,oBAAoB,EAAE,GAAG,CAAC;YACtD,kBAAkB,EAAE,UAAU,CAAC,GAAG,EAAE,mBAAmB,EAAE,EAAE,CAAC;SAC5D;QACD,MAAM,EAAE;YACP,OAAO,EAAE,UAAU,CAAC,GAAG,EAAE,oBAAoB,EAAE,IAAI,CAAC;YACpD,YAAY,EAAE,UAAU,CAAC,GAAG,EAAE,mBAAmB,EAAE,GAAG,CAAC;SACvD;QACD,eAAe,EAAE,UAAU,CAAC,GAAG,EAAE,0BAA0B,EAAE,MAAM,CAAC;QACpE,cAAc,EAAE,iBAAiB,CAAC,GAAG,CAAC;QACtC,KAAK;KACL,CAAC;IAEF,IAAI,GAAG,CAAC,kBAAkB;QAAE,MAAM,CAAC,UAAU,GAAG,GAAG,CAAC,kBAAkB,CAAC;IAEvE,OAAO,MAAM,CAAC;AACf,CAAC"}

package/packages/logging/dist/index.d.ts

@@ -9,7 +9,7 @@
  * webhook server provides the live path, and the local spool is the
  * fallback that keeps data when both are unavailable.
  */
-export { LOG_LEVEL_SEVERITY } from "./types.js";
+export { LOG_LEVEL_SEVERITY, LOG_SCHEMA_VERSION } from "./types.js";
 export type { FlushStats, LogBatch, LogErrorInfo, LogInput, LogLevel, LogRecord, LogTransport, } from "./types.js";
 export { isSecretKey, isSensitiveValueKey, redactFields, redactText, redactValue, splitKeyTokens, } from "./redact.js";
 export type { JsonValue, RedactionOptions } from "./redact.js";
@@ -27,6 +27,14 @@ export { LogShipper } from "./shipper.js";
 export type { LogShipperOptions } from "./shipper.js";
 export { centralDebug, centralError, centralInfo, centralLog, centralWarn, getCentralLogConfig, getCentralShipper, initCentralLogging, shutdownCentralLogging, } from "./singleton.js";
 export type { InitCentralLoggingOptions } from "./singleton.js";
+export { INSTALLATION_ID_FILE, defaultInstallationIdPath, isValidInstallationId, resolveInstallationId, } from "./installation.js";
+export type { ResolveInstallationIdOptions } from "./installation.js";
+export { DEFAULT_CLASSIFICATION_POLICY, DEFAULT_LOCAL_EVENTS, DEFAULT_REMOTE_EVENTS, classifyRecord, filterRemoteRecords, isSanitizedMessage, prepareRemoteRecord, } from "./classification.js";
+export type { ClassificationPolicy } from "./classification.js";
+export { LOCAL_ONLY_FIELD_KEYS, isLocalOnlyFieldKey } from "./sensitive-keys.js";
+export { DEFAULT_BATCH_LIMITS, LOG_LEVELS, sanitizeRecord, validateBatch, } from "./ingest/schema.js";
+export type { BatchValidationError, BatchValidationLimits, BatchValidationResult, SanitizeRecordResult, } from "./ingest/schema.js";
+export * from "./server/index.js";
 export { defaultKeysDir, defaultSpoolDir, resolveLogSinkConfig, } from "./config.js";
 export type { LogSinkConfig, LogSinkMode, ResolveConfigOptions } from "./config.js";
 //# sourceMappingURL=index.d.ts.map

package/packages/logging/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,YAAY,EACX,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,YAAY,GACZ,MAAM,YAAY,CAAC;AAIpB,OAAO,EACN,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,WAAW,EACX,cAAc,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAI/D,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACnE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAInD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIpD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlD,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,YAAY,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAIvE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAItD,OAAO,EACN,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,GACtB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAIhE,OAAO,EACN,cAAc,EACd,eAAe,EACf,oBAAoB,GACpB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AACpE,YAAY,EACX,UAAU,EACV,QAAQ,EACR,YAAY,EACZ,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,YAAY,GACZ,MAAM,YAAY,CAAC;AAIpB,OAAO,EACN,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,WAAW,EACX,cAAc,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,SAAS,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAI/D,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACnE,YAAY,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAInD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,YAAY,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAIpD,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,YAAY,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAIlD,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAC7D,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,YAAY,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAIvE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,YAAY,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAItD,OAAO,EACN,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,GACtB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAIhE,OAAO,EACN,oBAAoB,EACpB,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,GACrB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,4BAA4B,EAAE,MAAM,mBAAmB,CAAC;AAItE,OAAO,EACN,6BAA6B,EAC7B,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,GACnB,MAAM,qBAAqB,CAAC;AAC7B,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAEhE,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAIjF,OAAO,EACN,oBAAoB,EACpB,UAAU,EACV,cAAc,EACd,aAAa,GACb,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EACX,oBAAoB,EACpB,qBAAqB,EACrB,qBAAqB,EACrB,oBAAoB,GACpB,MAAM,oBAAoB,CAAC;AAI5B,cAAc,mBAAmB,CAAC;AAIlC,OAAO,EACN,cAAc,EACd,eAAe,EACf,oBAAoB,GACpB,MAAM,aAAa,CAAC;AACrB,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC"}

package/packages/logging/dist/index.js

@@ -10,7 +10,7 @@
  * fallback that keeps data when both are unavailable.
  */
 // --- Types -----------------------------------------------------------------
-export { LOG_LEVEL_SEVERITY } from "./types.js";
+export { LOG_LEVEL_SEVERITY, LOG_SCHEMA_VERSION } from "./types.js";
 // --- Redaction -------------------------------------------------------------
 export { isSecretKey, isSensitiveValueKey, redactFields, redactText, redactValue, splitKeyTokens, } from "./redact.js";
 // --- Sampling --------------------------------------------------------------
@@ -26,6 +26,15 @@ export { createWebhookTransport } from "./transports/webhook.js";
 export { LogShipper } from "./shipper.js";
 // --- Process wide singleton -------------------------------------------------
 export { centralDebug, centralError, centralInfo, centralLog, centralWarn, getCentralLogConfig, getCentralShipper, initCentralLogging, shutdownCentralLogging, } from "./singleton.js";
+// --- Installation identity --------------------------------------------------
+export { INSTALLATION_ID_FILE, defaultInstallationIdPath, isValidInstallationId, resolveInstallationId, } from "./installation.js";
+// --- Classification (what may leave the machine) ----------------------------
+export { DEFAULT_CLASSIFICATION_POLICY, DEFAULT_LOCAL_EVENTS, DEFAULT_REMOTE_EVENTS, classifyRecord, filterRemoteRecords, isSanitizedMessage, prepareRemoteRecord, } from "./classification.js";
+export { LOCAL_ONLY_FIELD_KEYS, isLocalOnlyFieldKey } from "./sensitive-keys.js";
+// --- Ingest contract (shared by client and server) -------------------------
+export { DEFAULT_BATCH_LIMITS, LOG_LEVELS, sanitizeRecord, validateBatch, } from "./ingest/schema.js";
+// --- Server side ------------------------------------------------------------
+export * from "./server/index.js";
 // --- Configuration ---------------------------------------------------------
 export { defaultKeysDir, defaultSpoolDir, resolveLogSinkConfig, } from "./config.js";
 //# sourceMappingURL=index.js.map

package/packages/logging/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,8EAA8E;AAE9E,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAWhD,8EAA8E;AAE9E,OAAO,EACN,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,WAAW,EACX,cAAc,GACd,MAAM,aAAa,CAAC;AAGrB,8EAA8E;AAE9E,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAGnE,8EAA8E;AAE9E,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,8EAA8E;AAE9E,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGtC,8EAA8E;AAE9E,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAGjE,8EAA8E;AAE9E,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,+EAA+E;AAE/E,OAAO,EACN,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,GACtB,MAAM,gBAAgB,CAAC;AAGxB,8EAA8E;AAE9E,OAAO,EACN,cAAc,EACd,eAAe,EACf,oBAAoB,GACpB,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,8EAA8E;AAE9E,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAWpE,8EAA8E;AAE9E,OAAO,EACN,WAAW,EACX,mBAAmB,EACnB,YAAY,EACZ,UAAU,EACV,WAAW,EACX,cAAc,GACd,MAAM,aAAa,CAAC;AAGrB,8EAA8E;AAE9E,OAAO,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAGnE,8EAA8E;AAE9E,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAGxC,8EAA8E;AAE9E,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAGtC,8EAA8E;AAE9E,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AAGjE,8EAA8E;AAE9E,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAG1C,+EAA+E;AAE/E,OAAO,EACN,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,UAAU,EACV,WAAW,EACX,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EAClB,sBAAsB,GACtB,MAAM,gBAAgB,CAAC;AAGxB,+EAA+E;AAE/E,OAAO,EACN,oBAAoB,EACpB,yBAAyB,EACzB,qBAAqB,EACrB,qBAAqB,GACrB,MAAM,mBAAmB,CAAC;AAG3B,+EAA+E;AAE/E,OAAO,EACN,6BAA6B,EAC7B,oBAAoB,EACpB,qBAAqB,EACrB,cAAc,EACd,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,GACnB,MAAM,qBAAqB,CAAC;AAG7B,OAAO,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAEjF,8EAA8E;AAE9E,OAAO,EACN,oBAAoB,EACpB,UAAU,EACV,cAAc,EACd,aAAa,GACb,MAAM,oBAAoB,CAAC;AAQ5B,+EAA+E;AAE/E,cAAc,mBAAmB,CAAC;AAElC,8EAA8E;AAE9E,OAAO,EACN,cAAc,EACd,eAAe,EACf,oBAAoB,GACpB,MAAM,aAAa,CAAC"}

package/packages/logging/dist/ingest/schema.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Ingest contract: strict validation and allowlisted redaction.
+ *
+ * The client and the server share this module, so both sides agree on what a
+ * batch is. The server never trusts the body:
+ *
+ *   - the tenant comes from the authenticated credential, never from the JSON,
+ *   - the batch is validated against a strict, versioned schema,
+ *   - the records are rebuilt from an allowlist, so an unknown property can
+ *     never smuggle data into the archive,
+ *   - every string is redacted again on the server (defence in depth).
+ */
+import { type LogBatch, type LogLevel, type LogRecord } from "../types.js";
+export declare const LOG_LEVELS: readonly LogLevel[];
+export interface BatchValidationLimits {
+    /** Maximum number of records in one batch. */
+    maxRecords: number;
+    /** Maximum length of a single string value. */
+    maxStringLength: number;
+    /** Maximum number of structured fields per record. */
+    maxFieldKeys: number;
+}
+export declare const DEFAULT_BATCH_LIMITS: BatchValidationLimits;
+export interface BatchValidationError {
+    code: string;
+    message: string;
+}
+export type BatchValidationResult = {
+    ok: true;
+    batch: LogBatch;
+    warnings: string[];
+} | {
+    ok: false;
+    error: BatchValidationError;
+};
+/**
+ * Validate an inbound batch.
+ *
+ * Unknown properties are NOT an error here - the sanitizer drops them. Only a
+ * structurally broken batch is rejected.
+ */
+export declare function validateBatch(input: unknown, options?: {
+    limits?: Partial<BatchValidationLimits>;
+}): BatchValidationResult;
+export type SanitizeRecordResult = {
+    ok: true;
+    record: LogRecord;
+} | {
+    ok: false;
+    error: BatchValidationError;
+};
+/**
+ * Rebuild one record from the allowlist and redact every string.
+ *
+ * Unknown properties are dropped, `error.name`, `error.message` and
+ * `error.stack` are redacted, and structured fields lose the keys that can
+ * carry private content.
+ */
+export declare function sanitizeRecord(input: unknown, limits?: Partial<BatchValidationLimits>): SanitizeRecordResult;
+//# sourceMappingURL=schema.d.ts.map

package/packages/logging/dist/ingest/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/ingest/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAIH,OAAO,EAAsB,KAAK,QAAQ,EAAqB,KAAK,QAAQ,EAAE,KAAK,SAAS,EAAE,MAAM,aAAa,CAAC;AAElH,eAAO,MAAM,UAAU,EAAE,SAAS,QAAQ,EAAuC,CAAC;AAElF,MAAM,WAAW,qBAAqB;IACrC,8CAA8C;IAC9C,UAAU,EAAE,MAAM,CAAC;IACnB,+CAA+C;IAC/C,eAAe,EAAE,MAAM,CAAC;IACxB,sDAAsD;IACtD,YAAY,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,oBAAoB,EAAE,qBAIlC,CAAC;AAEF,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,qBAAqB,GAC9B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,QAAQ,CAAC;IAAC,QAAQ,EAAE,MAAM,EAAE,CAAA;CAAE,GACjD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAc9C;;;;;GAKG;AACH,wBAAgB,aAAa,CAC5B,KAAK,EAAE,OAAO,EACd,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC,qBAAqB,CAAC,CAAA;CAAO,GACvD,qBAAqB,CAmHvB;AA6BD,MAAM,MAAM,oBAAoB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,SAAS,CAAA;CAAE,GAC/B;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,oBAAoB,CAAA;CAAE,CAAC;AAE9C;;;;;;GAMG;AACH,wBAAgB,cAAc,CAC7B,KAAK,EAAE,OAAO,EACd,MAAM,GAAE,OAAO,CAAC,qBAAqB,CAAM,GACzC,oBAAoB,CAwEtB"}