tinylogs 0.1.0

package/dist/cli.js

@@ -0,0 +1,635 @@
+#!/usr/bin/env node
+
+// src/cli.ts
+import { createInterface } from "node:readline/promises";
+import { existsSync as existsSync2 } from "node:fs";
+
+// src/config.ts
+import { createHash, randomBytes } from "node:crypto";
+import { readFileSync, writeFileSync } from "node:fs";
+import { dirname, isAbsolute, join, resolve } from "node:path";
+var DEFAULTS = {
+  port: 4700,
+  host: "127.0.0.1",
+  dbPath: "tinylogs.db",
+  retentionDays: 14,
+  maxSizeMB: 500,
+  bufferSize: 2e3
+};
+function resolveConfigPath(flag) {
+  if (flag) return flag;
+  if (process.env.TINYLOGS_CONFIG) return process.env.TINYLOGS_CONFIG;
+  return join(process.cwd(), "tinylogs.config.json");
+}
+function hashToken(token) {
+  return createHash("sha256").update(token, "utf8").digest("hex");
+}
+function generateSecrets() {
+  const sessionSecret = randomBytes(32).toString("hex");
+  const token = randomBytes(24).toString("base64url");
+  return { sessionSecret, token, ingestTokenHash: hashToken(token) };
+}
+function saveConfig(path, cfg) {
+  writeFileSync(path, JSON.stringify(cfg, null, 2) + "\n", { mode: 384 });
+}
+function loadConfig(path) {
+  const raw = readFileSync(path, "utf8");
+  const cfg = JSON.parse(raw);
+  for (const k of ["port", "host", "dbPath", "sessionSecret", "ingestTokenHash"]) {
+    if (cfg[k] === void 0) throw new Error(`config missing field: ${k}`);
+  }
+  return cfg;
+}
+function resolveDbPath(configPath, cfg) {
+  if (isAbsolute(cfg.dbPath)) return cfg.dbPath;
+  return resolve(dirname(configPath), cfg.dbPath);
+}
+
+// src/storage/db.ts
+import Database from "better-sqlite3";
+var MIGRATIONS = [
+  `CREATE TABLE logs (
+     id      INTEGER PRIMARY KEY AUTOINCREMENT,
+     ts      INTEGER NOT NULL,
+     service TEXT    NOT NULL,
+     message TEXT    NOT NULL,
+     labels  TEXT    NOT NULL
+   );
+   CREATE INDEX idx_logs_ts ON logs(ts);
+   CREATE INDEX idx_logs_service ON logs(service);
+   CREATE TABLE log_labels (
+     log_id INTEGER NOT NULL REFERENCES logs(id) ON DELETE CASCADE,
+     key    TEXT    NOT NULL,
+     value  TEXT    NOT NULL
+   );
+   CREATE INDEX idx_labels_kv ON log_labels(key, value);
+   CREATE INDEX idx_labels_logid ON log_labels(log_id);
+   CREATE TABLE users (
+     id            INTEGER PRIMARY KEY AUTOINCREMENT,
+     username      TEXT UNIQUE NOT NULL,
+     password_hash TEXT NOT NULL,
+     role          TEXT NOT NULL DEFAULT 'admin',
+     created_at    INTEGER NOT NULL
+   );`
+];
+function openDb(path) {
+  const db = new Database(path);
+  db.pragma("journal_mode = WAL");
+  db.pragma("foreign_keys = ON");
+  db.exec("CREATE TABLE IF NOT EXISTS schema_migrations (version INTEGER PRIMARY KEY)");
+  const current = db.prepare("SELECT COALESCE(MAX(version),0) v FROM schema_migrations").get().v;
+  const apply = db.transaction((from) => {
+    for (let i = from; i < MIGRATIONS.length; i++) {
+      db.exec(MIGRATIONS[i]);
+      db.prepare("INSERT INTO schema_migrations (version) VALUES (?)").run(i + 1);
+    }
+  });
+  apply(current);
+  return db;
+}
+function insertLog(db, rec) {
+  const txn = db.transaction((r) => {
+    const info = db.prepare("INSERT INTO logs (ts, service, message, labels) VALUES (?,?,?,?)").run(r.ts, r.service, r.message, JSON.stringify(r.labels ?? {}));
+    const logId = Number(info.lastInsertRowid);
+    const ins = db.prepare("INSERT INTO log_labels (log_id, key, value) VALUES (?,?,?)");
+    for (const [k, v] of Object.entries(r.labels ?? {})) ins.run(logId, k, String(v));
+    return logId;
+  });
+  return txn(rec);
+}
+function dbSizeBytes(db) {
+  const pageCount = db.pragma("page_count", { simple: true });
+  const pageSize = db.pragma("page_size", { simple: true });
+  return pageCount * pageSize;
+}
+
+// src/auth.ts
+import bcrypt from "bcryptjs";
+import { createHmac, timingSafeEqual } from "node:crypto";
+function hashPassword(pw) {
+  return bcrypt.hashSync(pw, 10);
+}
+function createUser(db, username, pw, role = "admin") {
+  const info = db.prepare(
+    "INSERT INTO users (username, password_hash, role, created_at) VALUES (?,?,?,?)"
+  ).run(username, hashPassword(pw), role, Date.now());
+  return Number(info.lastInsertRowid);
+}
+function verifyUser(db, username, pw) {
+  const row = db.prepare("SELECT password_hash FROM users WHERE username=?").get(username);
+  if (!row) {
+    bcrypt.compareSync(pw, "$2a$10$0000000000000000000000000000000000000000000000000000");
+    return false;
+  }
+  return bcrypt.compareSync(pw, row.password_hash);
+}
+function safeEqualHex(a, b) {
+  const ab = Buffer.from(a, "hex");
+  const bb = Buffer.from(b, "hex");
+  if (ab.length !== bb.length || ab.length === 0) return false;
+  return timingSafeEqual(ab, bb);
+}
+function verifyIngestToken(bearer, ingestTokenHash) {
+  if (!bearer || !bearer.startsWith("Bearer ")) return false;
+  const token = bearer.slice("Bearer ".length);
+  return safeEqualHex(hashToken(token), ingestTokenHash);
+}
+function signSession(username, secret) {
+  const mac = createHmac("sha256", secret).update(username).digest("hex");
+  return `${username}.${mac}`;
+}
+function verifySession(cookieVal, secret) {
+  if (!cookieVal) return null;
+  const dot = cookieVal.lastIndexOf(".");
+  if (dot <= 0) return null;
+  const username = cookieVal.slice(0, dot);
+  const mac = cookieVal.slice(dot + 1);
+  const expected = createHmac("sha256", secret).update(username).digest("hex");
+  if (mac.length !== expected.length) return null;
+  if (!timingSafeEqual(Buffer.from(mac), Buffer.from(expected))) return null;
+  return username;
+}
+
+// src/wizard.ts
+function buildInitConfig(opts) {
+  const s = generateSecrets();
+  const config = {
+    port: opts.port,
+    host: opts.host,
+    dbPath: opts.dbPath,
+    retentionDays: opts.retentionDays,
+    maxSizeMB: opts.maxSizeMB,
+    bufferSize: DEFAULTS.bufferSize,
+    sessionSecret: s.sessionSecret,
+    ingestTokenHash: s.ingestTokenHash
+  };
+  return { config, token: s.token };
+}
+async function runInit(configPath, opts, io) {
+  const port = opts.port ?? (Number(await io.prompt(`Port [${DEFAULTS.port}]: `)) || DEFAULTS.port);
+  const host = opts.host ?? (await io.prompt(`Host [${DEFAULTS.host}]: `) || DEFAULTS.host);
+  const username = opts.username ?? (await io.prompt("Admin username [admin]: ") || "admin");
+  const password = opts.password ?? await io.promptHidden("Admin password: ");
+  if (!password || password.length === 0) throw new Error("password must not be empty");
+  const retentionDays = opts.retentionDays ?? (Number(await io.prompt(`Retention days [${DEFAULTS.retentionDays}]: `)) || DEFAULTS.retentionDays);
+  const maxSizeMB = opts.maxSizeMB ?? (Number(await io.prompt(`Max DB size MB [${DEFAULTS.maxSizeMB}]: `)) || DEFAULTS.maxSizeMB);
+  const dbPath = opts.dbPath ?? DEFAULTS.dbPath;
+  const { config, token } = buildInitConfig({ port, host, retentionDays, maxSizeMB, dbPath });
+  const db = openDb(resolveDbPath(configPath, config));
+  createUser(db, username, password);
+  db.close();
+  saveConfig(configPath, config);
+  io.log("");
+  io.log(`  tinylogs configured \u2192 ${configPath}`);
+  io.log(`  Ingest token (shown once, store it now):`);
+  io.log(`    ${token}`);
+  io.log("");
+  io.log(`  Start with: npx tinylogs start`);
+}
+
+// src/server/index.ts
+import { createServer } from "node:http";
+
+// src/storage/retention.ts
+function pruneByAge(db, retentionDays, now) {
+  const cutoff = now - retentionDays * 864e5;
+  return db.prepare("DELETE FROM logs WHERE ts < ?").run(cutoff).changes;
+}
+function pruneBySize(db, maxSizeMB, batch = 1e3) {
+  const maxBytes = maxSizeMB * 1024 * 1024;
+  let deleted = 0;
+  while (dbSizeBytes(db) > maxBytes) {
+    const changes = db.prepare(
+      "DELETE FROM logs WHERE id IN (SELECT id FROM logs ORDER BY id ASC LIMIT ?)"
+    ).run(batch).changes;
+    if (changes === 0) break;
+    deleted += changes;
+  }
+  return deleted;
+}
+function runRetention(db, opts) {
+  try {
+    const now = opts.now ?? Date.now();
+    pruneByAge(db, opts.retentionDays, now);
+    pruneBySize(db, opts.maxSizeMB);
+    db.exec("VACUUM");
+  } catch (err) {
+    console.error("[tinylogs] retention failed:", err.message);
+  }
+}
+
+// src/buffer.ts
+var RingBuffer = class {
+  constructor(capacity) {
+    this.capacity = capacity;
+  }
+  items = [];
+  push(rec) {
+    this.items.push(rec);
+    if (this.items.length > this.capacity) this.items.shift();
+  }
+  snapshot() {
+    return this.items.slice();
+  }
+  get size() {
+    return this.items.length;
+  }
+};
+
+// src/server/app.ts
+import express from "express";
+import { existsSync } from "node:fs";
+import { dirname as dirname2, join as join2 } from "node:path";
+import { fileURLToPath } from "node:url";
+
+// src/server/ingest.ts
+var MAX_MESSAGE = 16384;
+var MAX_LABELS = 50;
+var MAX_KV = 512;
+var MAX_BATCH = 1e3;
+function validateRecord(raw) {
+  if (typeof raw !== "object" || raw === null) return { ok: false, error: "record must be an object" };
+  if (typeof raw.service !== "string" || raw.service.length === 0) return { ok: false, error: "service required" };
+  if (typeof raw.message !== "string" || raw.message.length === 0) return { ok: false, error: "message required" };
+  if (raw.message.length > MAX_MESSAGE) return { ok: false, error: "message too long" };
+  if (raw.service.length > MAX_KV) return { ok: false, error: "service too long" };
+  const labels = {};
+  if (raw.labels !== void 0) {
+    if (typeof raw.labels !== "object" || raw.labels === null || Array.isArray(raw.labels))
+      return { ok: false, error: "labels must be an object" };
+    const keys = Object.keys(raw.labels);
+    if (keys.length > MAX_LABELS) return { ok: false, error: "too many labels" };
+    for (const k of keys) {
+      const v = raw.labels[k];
+      if (typeof v !== "string") return { ok: false, error: `label ${k} must be a string` };
+      if (k.length > MAX_KV || v.length > MAX_KV) return { ok: false, error: `label ${k} too long` };
+      labels[k] = v;
+    }
+  }
+  const ts = typeof raw.ts === "number" && Number.isFinite(raw.ts) ? raw.ts : Date.now();
+  return { ok: true, rec: { ts, service: raw.service, message: raw.message, labels } };
+}
+function registerIngest(app) {
+  app.post("/ingest", (req, res) => {
+    const deps = app.get("deps");
+    if (!verifyIngestToken(req.header("authorization"), deps.cfg.ingestTokenHash)) {
+      return res.status(401).json({ error: "invalid token" });
+    }
+    const body = req.body;
+    const records = Array.isArray(body) ? body : [body];
+    if (records.length > MAX_BATCH) return res.status(400).json({ error: "batch too large" });
+    const validated = [];
+    for (const raw of records) {
+      const v = validateRecord(raw);
+      if (!v.ok) return res.status(400).json({ error: v.error });
+      validated.push(v.rec);
+    }
+    try {
+      for (const rec of validated) {
+        const id = insertLog(deps.db, rec);
+        const stored = { ...rec, id };
+        deps.buffer.push(stored);
+        deps.broadcast(stored);
+      }
+      return res.json({ accepted: validated.length });
+    } catch (err) {
+      console.error("[tinylogs] ingest error:", err.message);
+      return res.status(500).json({ error: "internal error" });
+    }
+  });
+}
+
+// src/server/queryRoutes.ts
+import { parse as parseCookie } from "cookie";
+
+// src/storage/query.ts
+function rowToRecord(row) {
+  return { id: row.id, ts: row.ts, service: row.service, message: row.message, labels: JSON.parse(row.labels) };
+}
+function queryLogs(db, params) {
+  const where = [];
+  const args = [];
+  if (params.service) {
+    where.push("logs.service = ?");
+    args.push(params.service);
+  }
+  if (params.q) {
+    where.push("logs.message LIKE ? COLLATE NOCASE");
+    args.push(`%${params.q}%`);
+  }
+  if (params.from !== void 0) {
+    where.push("logs.ts >= ?");
+    args.push(params.from);
+  }
+  if (params.to !== void 0) {
+    where.push("logs.ts < ?");
+    args.push(params.to);
+  }
+  if (params.before !== void 0) {
+    where.push("logs.id < ?");
+    args.push(params.before);
+  }
+  for (const l of params.labels ?? []) {
+    where.push("logs.id IN (SELECT log_id FROM log_labels WHERE key = ? AND value = ?)");
+    args.push(l.key, l.value);
+  }
+  const limit = Math.min(Math.max(params.limit ?? 200, 1), 1e3);
+  const sql = `SELECT id, ts, service, message, labels FROM logs
+               ${where.length ? "WHERE " + where.join(" AND ") : ""}
+               ORDER BY logs.id DESC LIMIT ?`;
+  return db.prepare(sql).all(...args, limit).map(rowToRecord);
+}
+function queryLabels(db, opts = {}) {
+  const services = db.prepare(
+    "SELECT service, COUNT(*) count FROM logs GROUP BY service ORDER BY count DESC"
+  ).all();
+  let labels;
+  if (opts.service) {
+    labels = db.prepare(
+      `SELECT ll.key, ll.value, COUNT(*) count FROM log_labels ll
+       JOIN logs ON logs.id = ll.log_id WHERE logs.service = ?
+       GROUP BY ll.key, ll.value ORDER BY ll.key, count DESC`
+    ).all(opts.service);
+  } else {
+    labels = db.prepare(
+      `SELECT key, value, COUNT(*) count FROM log_labels
+       GROUP BY key, value ORDER BY key, count DESC`
+    ).all();
+  }
+  return { services, labels };
+}
+
+// src/server/queryRoutes.ts
+function requireSession(app) {
+  return (req, res, next) => {
+    const deps = app.get("deps");
+    const cookies = parseCookie(req.header("cookie") ?? "");
+    const user = verifySession(cookies["tl_session"], deps.cfg.sessionSecret);
+    if (!user) return res.status(401).json({ error: "unauthorized" });
+    req.user = user;
+    next();
+  };
+}
+function parseQuery(query) {
+  const p = {};
+  if (typeof query.service === "string") p.service = query.service;
+  if (typeof query.q === "string") p.q = query.q;
+  if (query.from !== void 0) p.from = Number(query.from);
+  if (query.to !== void 0) p.to = Number(query.to);
+  if (query.limit !== void 0) p.limit = Number(query.limit);
+  if (query.before !== void 0) p.before = Number(query.before);
+  const rawLabels = query.label === void 0 ? [] : Array.isArray(query.label) ? query.label : [query.label];
+  p.labels = rawLabels.map((s) => {
+    const i = s.indexOf("=");
+    return i < 0 ? null : { key: s.slice(0, i), value: s.slice(i + 1) };
+  }).filter(Boolean);
+  return p;
+}
+function registerQueryRoutes(app) {
+  const guard = requireSession(app);
+  app.get("/api/logs", guard, (req, res) => {
+    const deps = app.get("deps");
+    const logs = queryLogs(deps.db, parseQuery(req.query));
+    res.json({ logs });
+  });
+  app.get("/api/labels", guard, (req, res) => {
+    const deps = app.get("deps");
+    const service = typeof req.query.service === "string" ? req.query.service : void 0;
+    res.json(queryLabels(deps.db, { service }));
+  });
+}
+
+// src/server/authRoutes.ts
+import { serialize as serializeCookie } from "cookie";
+function makeLoginLimiter(maxAttempts = 10, windowMs = 5 * 6e4) {
+  const hits = /* @__PURE__ */ new Map();
+  return (req, res, next) => {
+    const now = Date.now();
+    const ip = req.ip ?? "unknown";
+    const rec = hits.get(ip);
+    if (!rec || now > rec.reset) {
+      hits.set(ip, { count: 1, reset: now + windowMs });
+      return next();
+    }
+    rec.count += 1;
+    if (rec.count > maxAttempts) return res.status(429).json({ error: "too many attempts" });
+    next();
+  };
+}
+function registerAuthRoutes(app) {
+  const limiter = makeLoginLimiter();
+  app.post("/api/login", limiter, (req, res) => {
+    const deps = app.get("deps");
+    const { username, password } = req.body ?? {};
+    if (typeof username !== "string" || typeof password !== "string")
+      return res.status(400).json({ error: "username and password required" });
+    if (!verifyUser(deps.db, username, password))
+      return res.status(401).json({ error: "invalid credentials" });
+    const cookie = serializeCookie("tl_session", signSession(username, deps.cfg.sessionSecret), {
+      httpOnly: true,
+      sameSite: "strict",
+      path: "/",
+      maxAge: 60 * 60 * 24 * 30
+    });
+    res.setHeader("Set-Cookie", cookie);
+    res.json({ ok: true, username });
+  });
+  app.post("/api/logout", (_req, res) => {
+    res.setHeader("Set-Cookie", serializeCookie("tl_session", "", { httpOnly: true, path: "/", maxAge: 0 }));
+    res.json({ ok: true });
+  });
+}
+
+// src/server/app.ts
+function createApp(deps) {
+  const app = express();
+  app.set("trust proxy", true);
+  app.set("deps", deps);
+  app.get("/api/health", (_req, res) => res.json({ ok: true }));
+  app.use("/ingest", express.json({ limit: "5mb" }));
+  app.use("/api", express.json({ limit: "1mb" }));
+  registerIngest(app);
+  registerQueryRoutes(app);
+  registerAuthRoutes(app);
+  const here = dirname2(fileURLToPath(import.meta.url));
+  const uiDir = [join2(here, "ui"), join2(here, "..", "ui"), join2(process.cwd(), "dist", "ui")].find((d) => existsSync(join2(d, "bundle.js")));
+  if (uiDir) app.use(express.static(uiDir));
+  return app;
+}
+
+// src/server/stream.ts
+import { parse as parseCookie2 } from "cookie";
+import { WebSocketServer } from "ws";
+function attachWebSocket(server, deps) {
+  const wss = new WebSocketServer({ server, path: "/ws" });
+  wss.on("connection", (ws, req) => {
+    const cookies = parseCookie2(req.headers.cookie ?? "");
+    const user = verifySession(cookies["tl_session"], deps.cfg.sessionSecret);
+    if (!user) {
+      ws.close(4401, "unauthorized");
+      return;
+    }
+    ws.isAlive = true;
+    ws.on("pong", () => {
+      ws.isAlive = true;
+    });
+    ws.send(JSON.stringify({ type: "buffer", data: deps.buffer.snapshot() }));
+    deps.clients.add(ws);
+    ws.on("close", () => deps.clients.delete(ws));
+    ws.on("error", () => deps.clients.delete(ws));
+  });
+  const interval = setInterval(() => {
+    for (const ws of wss.clients) {
+      if (ws.isAlive === false) {
+        ws.terminate();
+        continue;
+      }
+      ws.isAlive = false;
+      try {
+        ws.ping();
+      } catch {
+      }
+    }
+  }, 3e4);
+  interval.unref();
+  wss.on("close", () => clearInterval(interval));
+  return wss;
+}
+
+// src/server/index.ts
+async function start(configPath = resolveConfigPath()) {
+  const cfg = loadConfig(configPath);
+  const db = openDb(resolveDbPath(configPath, cfg));
+  const buffer = new RingBuffer(cfg.bufferSize);
+  const wsClients = /* @__PURE__ */ new Set();
+  const broadcast = (r) => {
+    const msg = JSON.stringify({ type: "log", data: r });
+    for (const c of wsClients) {
+      try {
+        if (c.readyState === 1) c.send(msg);
+      } catch {
+      }
+    }
+  };
+  const app = createApp({ db, buffer, cfg, broadcast });
+  const server = createServer(app);
+  attachWebSocket(server, { buffer, cfg, clients: wsClients });
+  const retentionTimer = setInterval(
+    () => runRetention(db, { retentionDays: cfg.retentionDays, maxSizeMB: cfg.maxSizeMB }),
+    6e4
+  );
+  retentionTimer.unref();
+  await new Promise((resolve2) => server.listen(cfg.port, cfg.host, resolve2));
+  const addr = server.address();
+  const port = typeof addr === "object" && addr ? addr.port : cfg.port;
+  console.log(`[tinylogs] listening on http://${cfg.host}:${port}`);
+  return {
+    port,
+    close: () => new Promise((resolve2) => {
+      clearInterval(retentionTimer);
+      for (const c of wsClients) {
+        try {
+          c.close();
+        } catch {
+        }
+      }
+      server.close(() => {
+        db.close();
+        resolve2();
+      });
+    })
+  };
+}
+
+// src/cli.ts
+function parseFlags(argv) {
+  const out = {};
+  for (let i = 0; i < argv.length; i++) {
+    const a = argv[i];
+    if (a.startsWith("--")) {
+      const key = a.slice(2);
+      const next = argv[i + 1];
+      if (next && !next.startsWith("--")) {
+        out[key] = next;
+        i++;
+      } else out[key] = true;
+    }
+  }
+  return out;
+}
+function makeIo() {
+  const rl = createInterface({ input: process.stdin, output: process.stdout });
+  return {
+    io: {
+      prompt: (q) => rl.question(q),
+      // NOTE: not truly hidden; acceptable for a pet tool. Prefer --password / TINYLOGS_PASSWORD in scripts.
+      promptHidden: (q) => rl.question(q),
+      log: (s) => console.log(s)
+    },
+    done: () => rl.close()
+  };
+}
+async function main() {
+  const [cmd, ...rest] = process.argv.slice(2);
+  const flags = parseFlags(rest);
+  const configPath = resolveConfigPath(typeof flags.config === "string" ? flags.config : void 0);
+  if (cmd === "init") {
+    const nonInteractive = flags.yes === true || flags.y === true;
+    const opts = {
+      port: flags.port ? Number(flags.port) : void 0,
+      host: typeof flags.host === "string" ? flags.host : void 0,
+      username: typeof flags.username === "string" ? flags.username : void 0,
+      password: (typeof flags.password === "string" ? flags.password : void 0) ?? process.env.TINYLOGS_PASSWORD,
+      retentionDays: flags["retention-days"] ? Number(flags["retention-days"]) : void 0,
+      maxSizeMB: flags["max-size-mb"] ? Number(flags["max-size-mb"]) : void 0,
+      dbPath: typeof flags["db-path"] === "string" ? flags["db-path"] : void 0
+    };
+    if (existsSync2(configPath) && !flags.force) {
+      console.error(`Config already exists at ${configPath} (use --force to overwrite).`);
+      process.exit(1);
+    }
+    if (nonInteractive) {
+      if (!opts.password) {
+        console.error("Non-interactive init requires --password or TINYLOGS_PASSWORD.");
+        process.exit(1);
+      }
+      await runInit(configPath, { ...opts, username: opts.username ?? "admin" }, { prompt: async () => "", promptHidden: async () => "", log: (s) => console.log(s) });
+    } else {
+      const { io, done } = makeIo();
+      try {
+        await runInit(configPath, opts, io);
+      } finally {
+        done();
+      }
+    }
+    return;
+  }
+  if (cmd === "start") {
+    if (!existsSync2(configPath)) {
+      console.error(`No config at ${configPath}. Run: npx tinylogs init`);
+      process.exit(1);
+    }
+    await start(configPath);
+    return;
+  }
+  if (cmd === "rotate-token") {
+    if (!existsSync2(configPath)) {
+      console.error(`No config at ${configPath}.`);
+      process.exit(1);
+    }
+    const cfg = loadConfig(configPath);
+    const s = generateSecrets();
+    cfg.ingestTokenHash = s.ingestTokenHash;
+    saveConfig(configPath, cfg);
+    console.log("New ingest token (shown once):");
+    console.log(`  ${s.token}`);
+    return;
+  }
+  console.log("tinylogs \u2014 usage:\n  tinylogs init [--yes --password ...]\n  tinylogs start\n  tinylogs rotate-token");
+  if (cmd && cmd !== "help") process.exit(1);
+}
+main().catch((err) => {
+  console.error(err);
+  process.exit(1);
+});
+//# sourceMappingURL=cli.js.map