feat: DTail fork — server/client feature development

Squashed development of the snonux/dtail fork's product code (internal/, cmd/)
since diverging from mimecast/dtail. Major areas:

- Read/output path: the former "turbo" channel-less path is now the single,
  default server-side read/output path for cat/grep/tail and MapReduce; the old
  channel-based path and its config/env toggles were removed.
- MapReduce: single aggregate implementation (server + serverless) fed directly
  by a processor pipeline, with input-exhausted finalization via the shutdown
  coordinator; high-concurrency and data-race fixes.
- Journal source reads (journal:unit.service) via journalctl, Linux-gated behind
  a journal-v1 capability.
- Auth-key fast reconnect: in-memory per-user public-key cache with TTL/max-keys,
  registered over an authenticated session (AUTHKEY), checked before
  authorized_keys.
- Interactive query reload (--interactive-query) with SESSION START/UPDATE
  generation boundaries and capability negotiation.
- Client-side deadlines: --timeout / --shutdownAfter as context deadlines;
  follow shutdown handling.
- Client logging: diagnostics-only daily log by default, opt-in payload tee via
  --log-payload.
- Numerous correctness fixes (buffer-pool double-recycle races, EOF-sentinel
  leaks, glob-expansion cap, TOCTOU in CSV parsing) with accompanying unit tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 92 insertions, 0 deletions

diff --git a/internal/mapr/queryvariables.go b/internal/mapr/queryvariables.go
new file mode 100644
index 0000000..0612a81
--- /dev/null
+++ b/internal/mapr/queryvariables.go
@@ -0,0 +1,92 @@
+package mapr
+
+import (
+	"sort"
+	"strings"
+)
+
+// EffectiveLogFormat returns the log format parser name that will be used to
+// evaluate the query. It centralises the parser-selection rule so that both the
+// server (resolveParserName) and the client-side plan-time diagnostics agree on
+// which parser a query targets.
+//
+// An explicit `logformat` clause always wins. Without one, a query lacking a
+// `from TABLE` clause downgrades to the "generic" parser (which exposes only the
+// common $-variables and no dynamic key=value fields). A query with a `from`
+// clause uses configuredDefault, or "default" when configuredDefault is empty.
+func (q *Query) EffectiveLogFormat(configuredDefault string) string {
+	if configuredDefault == "" {
+		configuredDefault = "default"
+	}
+	if q == nil {
+		return configuredDefault
+	}
+	if q.LogFormat != "" {
+		return q.LogFormat
+	}
+	if q.Table == "" {
+		return "generic"
+	}
+	return configuredDefault
+}
+
+// ReferencedVariables returns the sorted, de-duplicated set of $-prefixed field
+// variables the query references in its select, where, group-by and set clauses.
+//
+// Variables defined by the query itself via the `set` clause (the left-hand
+// side names) are excluded, because they are legitimately produced at runtime
+// even though no parser populates them. Bare (non-$) field names are dynamic
+// key=value fields that legitimately vary per line and are never returned; only
+// the reserved $-prefixed names are candidates for the unknown-variable
+// diagnostic.
+func (q *Query) ReferencedVariables() []string {
+	if q == nil {
+		return nil
+	}
+
+	produced := make(map[string]struct{}, len(q.Set))
+	for _, sc := range q.Set {
+		produced[sc.lString] = struct{}{}
+	}
+
+	referenced := make(map[string]struct{})
+	add := func(name string) {
+		if !strings.HasPrefix(name, "$") {
+			return
+		}
+		if _, isProduced := produced[name]; isProduced {
+			return
+		}
+		referenced[name] = struct{}{}
+	}
+
+	for _, sc := range q.Select {
+		add(sc.Field)
+	}
+	for _, groupBy := range q.GroupBy {
+		add(groupBy)
+	}
+	for _, wc := range q.Where {
+		if wc.lType == Field {
+			add(wc.lString)
+		}
+		if wc.rType == Field {
+			add(wc.rString)
+		}
+	}
+	for _, sc := range q.Set {
+		if sc.rType == Field || sc.rType == FunctionStack {
+			add(sc.rString)
+		}
+	}
+
+	if len(referenced) == 0 {
+		return nil
+	}
+	variables := make([]string, 0, len(referenced))
+	for name := range referenced {
+		variables = append(variables, name)
+	}
+	sort.Strings(variables)
+	return variables
+}