From 849951be1d1a7ee9f9302006ccb187bf5b4e36f3 Mon Sep 17 00:00:00 2001
From: Paul Buetow <paul@buetow.org>
Date: Wed, 22 Jul 2026 23:51:18 +0300
Subject: =?UTF-8?q?feat:=20DTail=20fork=20=E2=80=94=20server/client=20feat?=
 =?UTF-8?q?ure=20development?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Squashed development of the snonux/dtail fork's product code (internal/, cmd/)
since diverging from mimecast/dtail. Major areas:

- Read/output path: the former "turbo" channel-less path is now the single,
  default server-side read/output path for cat/grep/tail and MapReduce; the old
  channel-based path and its config/env toggles were removed.
- MapReduce: single aggregate implementation (server + serverless) fed directly
  by a processor pipeline, with input-exhausted finalization via the shutdown
  coordinator; high-concurrency and data-race fixes.
- Journal source reads (journal:unit.service) via journalctl, Linux-gated behind
  a journal-v1 capability.
- Auth-key fast reconnect: in-memory per-user public-key cache with TTL/max-keys,
  registered over an authenticated session (AUTHKEY), checked before
  authorized_keys.
- Interactive query reload (--interactive-query) with SESSION START/UPDATE
  generation boundaries and capability negotiation.
- Client-side deadlines: --timeout / --shutdownAfter as context deadlines;
  follow shutdown handling.
- Client logging: diagnostics-only daily log by default, opt-in payload tee via
  --log-payload.
- Numerous correctness fixes (buffer-pool double-recycle races, EOF-sentinel
  leaks, glob-expansion cap, TOCTOU in CSV parsing) with accompanying unit tests.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 internal/mapr/queryvariables.go | 92 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 92 insertions(+)
 create mode 100644 internal/mapr/queryvariables.go

(limited to 'internal/mapr/queryvariables.go')

diff --git a/internal/mapr/queryvariables.go b/internal/mapr/queryvariables.go
new file mode 100644
index 0000000..0612a81
--- /dev/null
+++ b/internal/mapr/queryvariables.go
@@ -0,0 +1,92 @@
+package mapr
+
+import (
+	"sort"
+	"strings"
+)
+
+// EffectiveLogFormat returns the log format parser name that will be used to
+// evaluate the query. It centralises the parser-selection rule so that both the
+// server (resolveParserName) and the client-side plan-time diagnostics agree on
+// which parser a query targets.
+//
+// An explicit `logformat` clause always wins. Without one, a query lacking a
+// `from TABLE` clause downgrades to the "generic" parser (which exposes only the
+// common $-variables and no dynamic key=value fields). A query with a `from`
+// clause uses configuredDefault, or "default" when configuredDefault is empty.
+func (q *Query) EffectiveLogFormat(configuredDefault string) string {
+	if configuredDefault == "" {
+		configuredDefault = "default"
+	}
+	if q == nil {
+		return configuredDefault
+	}
+	if q.LogFormat != "" {
+		return q.LogFormat
+	}
+	if q.Table == "" {
+		return "generic"
+	}
+	return configuredDefault
+}
+
+// ReferencedVariables returns the sorted, de-duplicated set of $-prefixed field
+// variables the query references in its select, where, group-by and set clauses.
+//
+// Variables defined by the query itself via the `set` clause (the left-hand
+// side names) are excluded, because they are legitimately produced at runtime
+// even though no parser populates them. Bare (non-$) field names are dynamic
+// key=value fields that legitimately vary per line and are never returned; only
+// the reserved $-prefixed names are candidates for the unknown-variable
+// diagnostic.
+func (q *Query) ReferencedVariables() []string {
+	if q == nil {
+		return nil
+	}
+
+	produced := make(map[string]struct{}, len(q.Set))
+	for _, sc := range q.Set {
+		produced[sc.lString] = struct{}{}
+	}
+
+	referenced := make(map[string]struct{})
+	add := func(name string) {
+		if !strings.HasPrefix(name, "$") {
+			return
+		}
+		if _, isProduced := produced[name]; isProduced {
+			return
+		}
+		referenced[name] = struct{}{}
+	}
+
+	for _, sc := range q.Select {
+		add(sc.Field)
+	}
+	for _, groupBy := range q.GroupBy {
+		add(groupBy)
+	}
+	for _, wc := range q.Where {
+		if wc.lType == Field {
+			add(wc.lString)
+		}
+		if wc.rType == Field {
+			add(wc.rString)
+		}
+	}
+	for _, sc := range q.Set {
+		if sc.rType == Field || sc.rType == FunctionStack {
+			add(sc.rString)
+		}
+	}
+
+	if len(referenced) == 0 {
+		return nil
+	}
+	variables := make([]string, 0, len(referenced))
+	for name := range referenced {
+		variables = append(variables, name)
+	}
+	sort.Strings(variables)
+	return variables
+}
-- 
cgit v1.2.3