🥮 mooncakes.io

moonlogfmt-lens

Parse, contract-check, redact, profile, and diff logfmt data in MoonBit

logfmt
logs
schema
redaction
drift
moonbit
moon add sqhyyy/moonlogfmt-lens@0.2.1
Download zip
Author
Version
0.2.1
License
Apache-2.0
Repository
Last updated
18 days ago
Downloads
4
README

#MoonLogfmt Lens

MoonLogfmt Lens is a MoonBit-native data-contract and quality toolkit for logfmt records. It parses existing log text, classifies semantic values, checks executable contracts, removes sensitive data, profiles batches, and explains schema drift without introducing a logging framework or telemetry stack.

The package is designed for CI pipelines, command-line tools, support bundles, build logs, and service diagnostics. It has no external runtime dependencies and keeps all analysis deterministic across MoonBit targets.

#Why This Exists

Human-readable key/value logs are easy to emit but difficult to govern. Duplicate keys can hide values, a field can silently change from an integer to text, newly added fields can leak credentials, and one release can drift away from the schema observed in the previous release.

MoonLogfmt Lens answers five separate questions:

  • Is the record syntactically valid and unambiguous?
  • Do its fields satisfy an executable log contract?
  • Does it contain credentials, personal data, payment data, or network identity?
  • What value-free shapes and semantic types occur in a batch?
  • Did the current batch drift materially from a known-good baseline?

#Install

moon add sqhyyy/moonlogfmt-lens

The public repository is prepared for sqhyyy/moonlogfmt-lens, and the Mooncakes owner is sqhyyy.

#Parse And Audit

let parsed = @lens.parse(
  "level=info msg=\"service ready\" request_id=req-42",
)

if parsed.is_valid() {
  println(parsed.get("msg"))
  println(parsed.normalized())
}

let audit = @lens.audit_line_with_policy(
  "level=warn msg=one msg=two dry_run",
  @lens.AuditPolicy::ci(),
)
println(audit.text_report())

The scanner supports bare values, quoted values, common escapes, explicit blank values, and flag fields. It preserves field order and offsets and reports malformed keys, unexpected equals signs, bare quotes, and unterminated strings.

#Semantic Values

inspect(@lens.classify_value("503"), content="ValueInteger")
inspect(@lens.classify_value("1.5s"), content="ValueDuration")
inspect(@lens.classify_value("2026-07-29T12:30:00Z"), content="ValueTimestamp")

The deterministic classifier recognizes flags, blanks, booleans, integers, decimals, durations, byte sizes, timestamps, IPv4 values, UUIDs, email addresses, hexadecimal values, identifiers, and free text. These types form the shared vocabulary used by contract inference and drift analysis.

#Executable Contracts

let contract = @lens.LogContract::new(
  "api-service",
  [
    @lens.FieldRule::typed("level", @lens.ValueIdentifier, required=true)
    .with_allowed_values(["info", "warn", "error"]),
    @lens.FieldRule::text("msg", required=true).with_max_length(240),
    @lens.FieldRule::typed("status", @lens.ValueInteger),
    @lens.FieldRule::typed("duration", @lens.ValueDuration),
  ],
  unknown_fields=@lens.UnknownReject,
)

let report = @lens.validate_contract(
  "level=info msg=ready status=200 duration=12ms",
  contract,
)
println(report.decision())

Contracts support required fields, semantic types, blank/flag controls, maximum lengths, controlled vocabularies, record field limits, duplicate rejection, and allow/warn/reject policies for unknown fields. Built-in service and CI contracts are available for quick adoption.

#Schema Inference

let inference = @lens.infer_schema([
  "level=info status=200 duration=12ms",
  "level=warn status=503 duration=1.5s",
  "level=info status=201 duration=9ms",
])

println(inference.text_report())
let candidate = inference.contract()

Inference reports field prevalence, type distribution, dominant type, confidence, distinct sample values, and observed maximum length. It produces a candidate contract while limiting enum inference to genuinely categorical fields such as level, environment, state, and outcome.

#Privacy-Safe Logs

let result = @lens.redact_line(
  "level=info email=user@example.com api_token=secret peer=10.0.0.8",
  policy=@lens.RedactionPolicy::strict(),
)

println(result.safe_line())
println(result.json_report())

Privacy analysis combines key-aware rules with value-aware detection for bearer credentials, provider access keys, three-segment tokens, private-key markers, email addresses, formatted phone numbers, checksum-valid payment cards, high-entropy secrets, and optional IP-address protection.

Redaction modes include full masking, last-four masking, and deterministic stable tokens. Reports never serialize the original sensitive value.

#Batch Profiles

let batch = @lens.analyze_batch(
  [
    "level=info msg=ready status=200",
    "level=warn msg=slow status=503",
  ],
  policy=@lens.BatchPolicy::ci(),
)

let decision = @lens.evaluate_batch(
  batch,
  policy=@lens.BatchGatePolicy::ci(),
)
println(decision.label())

Batch analysis provides valid/invalid rates, risk bands, aggregate scores, field profiles, and value-free structural clusters. Canonical shapes are independent of field order, and stable fingerprints allow logs to be compared without retaining their concrete values.

Batch gates support invalid-line budgets, high-risk budgets, average risk limits, shape-cardinality limits, and required-key prevalence.

#Drift Detection

let baseline = @lens.analyze_batch([
  "level=info msg=ready status=200 duration=12ms",
  "level=warn msg=slow status=503 duration=80ms",
])

let current = @lens.analyze_batch([
  "level=info msg=ready status=ok region=us",
  "level=warn msg=slow status=failed region=eu",
])

let drift = @lens.compare_batches(
  baseline,
  current,
  policy=@lens.DriftPolicy::ci(),
)
println(drift.text_report())

Drift findings cover added and removed fields, semantic type changes, type confidence drops, prevalence changes, value-length growth, new and retired shapes, invalid-rate regressions, and aggregate-risk regressions. A known-good batch can also be frozen into a reusable LogContract.

#CLI

moon run cmd/main -- audit level=info msg="service ready"
moon run cmd/main -- contract level=info msg=ready service=api
moon run cmd/main -- privacy level=info api_token=secret
moon run cmd/main -- profile status=503 duration=12ms
moon run cmd/main -- template level=info msg=ready status=200

Omitting the mode keeps compatibility with the original audit command.

#Runnable Examples

moon run examples/basic
moon run examples/advanced
moon run examples/privacy
moon run examples/drift

The advanced example infers and freezes a baseline contract. The privacy example demonstrates stable-token redaction. The drift example intentionally introduces a field-type regression, a removed field, a new field, a new shape, and malformed input.

#Verification

moon fmt
moon check
moon build
moon test
moon package --list

The current suite contains 95 tests covering parsing, auditing, semantic classification, contracts, inference, redaction, batch gates, structural fingerprints, and drift reports.

#Boundaries

MoonLogfmt Lens consumes in-memory logfmt records. It does not emit application logs, tail files, collect telemetry, export OpenTelemetry data, parse JSON, or replace logging frameworks. File readers, network collectors, and dashboards can build on top of the dependency-free core.

#Contributing

Development and verification instructions are available in CONTRIBUTING.md.

#License

Apache-2.0.

#
AuditPolicy

source
pub struct AuditPolicy {
  max_fields : Int
  max_value_length : Int
  flag_duplicate_keys : Bool
  flag_blank_values : Bool
  flag_flag_fields : Bool
  required_keys : Array[String]
} derive(
Debug)

#
AuditPolicy::ci

source

#
AuditPolicy::default

source
fn AuditPolicy::default() -> AuditPolicy

#
AuditPolicy::relaxed

source
fn AuditPolicy::relaxed() -> AuditPolicy

#
AuditPolicy::with_required_keys

source
fn AuditPolicy::with_required_keys(self : AuditPolicy, keys : Array[String]) -> AuditPolicy

#
AuditReport

source
pub struct AuditReport {
  parsed : ParseResult
  findings : Array[Finding]
} derive(
Debug)

#
AuditReport::count_severity

source
fn AuditReport::count_severity(self : AuditReport, severity : Severity) -> Int

#
AuditReport::critical_count

source
fn AuditReport::critical_count(self : AuditReport) -> Int

#
AuditReport::finding_count

source
fn AuditReport::finding_count(self : AuditReport) -> Int

#
AuditReport::findings

source
fn AuditReport::findings(self : AuditReport) -> Array[Finding]

#
AuditReport::info_count

source
fn AuditReport::info_count(self : AuditReport) -> Int

#
AuditReport::json_report

source
fn AuditReport::json_report(self : AuditReport) -> String

#
AuditReport::parsed

source
fn AuditReport::parsed(self : AuditReport) -> ParseResult

#
AuditReport::recommended_action

source
fn AuditReport::recommended_action(self : AuditReport) -> String

#
AuditReport::risk_level

source
fn AuditReport::risk_level(self : AuditReport) -> String

#
AuditReport::risk_score

source
fn AuditReport::risk_score(self : AuditReport) -> Int

#
AuditReport::text_report

source
fn AuditReport::text_report(self : AuditReport) -> String

#
AuditReport::warning_count

source
fn AuditReport::warning_count(self : AuditReport) -> Int

#
BatchDecision

source
pub struct BatchDecision {
  accepted : Bool
  reasons : Array[String]
} derive(Eq, 
Debug)

#
BatchDecision::accepted

source
fn BatchDecision::accepted(self : BatchDecision) -> Bool

#
BatchDecision::label

source
fn BatchDecision::label(self : BatchDecision) -> String

#
BatchDecision::reasons

source
fn BatchDecision::reasons(self : BatchDecision) -> Array[String]

#
BatchDecision::text_report

source
fn BatchDecision::text_report(self : BatchDecision) -> String

#
BatchGatePolicy

source
pub struct BatchGatePolicy {
  max_invalid_percent : Int
  max_high_risk_percent : Int
  max_average_risk_score : Int
  reject_shape_overflow : Bool
  required_keys : Array[String]
  min_required_prevalence : Int
} derive(Eq, 
Debug)

#
BatchGatePolicy::ci

source

#
BatchGatePolicy::default

source

#
BatchGatePolicy::with_error_budget

source
fn BatchGatePolicy::with_error_budget(self : BatchGatePolicy, max_invalid_percent : Int, max_high_risk_percent : Int) -> BatchGatePolicy

#
BatchGatePolicy::with_required_keys

source
fn BatchGatePolicy::with_required_keys(self : BatchGatePolicy, required_keys : Array[String], min_prevalence? : Int) -> BatchGatePolicy

#
BatchPolicy

source
pub struct BatchPolicy {
  audit_policy : AuditPolicy
  skip_blank_lines : Bool
  max_distinct_shapes : Int
} derive(
Debug)

Controls batch analysis without introducing file-system or process I/O.

#
BatchPolicy::ci

source

#
BatchPolicy::default

source
fn BatchPolicy::default() -> BatchPolicy

#
BatchPolicy::exploratory

source
fn BatchPolicy::exploratory() -> BatchPolicy

#
BatchPolicy::with_audit_policy

source
fn BatchPolicy::with_audit_policy(self : BatchPolicy, audit_policy : AuditPolicy) -> BatchPolicy

#
BatchPolicy::with_blank_lines

source
fn BatchPolicy::with_blank_lines(self : BatchPolicy, skip_blank_lines : Bool) -> BatchPolicy

#
BatchPolicy::with_shape_limit

source
fn BatchPolicy::with_shape_limit(self : BatchPolicy, max_distinct_shapes : Int) -> BatchPolicy

#
BatchReport

source
pub struct BatchReport {
  input_lines : Int
  processed_lines : Int
  skipped_blank_lines : Int
  valid_lines : Int
  invalid_lines : Int
  clean_lines : Int
  low_risk_lines : Int
  medium_risk_lines : Int
  high_risk_lines : Int
  aggregate_risk_score : Int
  reviews : Array[LineReview]
  profiles : Array[FieldProfile]
  shapes : Array[ShapeStat]
  shape_limit_exceeded : Bool
} derive(
Debug)

#
BatchReport::aggregate_risk_score

source
fn BatchReport::aggregate_risk_score(self : BatchReport) -> Int

#
BatchReport::average_risk_score

source
fn BatchReport::average_risk_score(self : BatchReport) -> Int

#
BatchReport::clean_lines

source
fn BatchReport::clean_lines(self : BatchReport) -> Int

#
BatchReport::high_risk_lines

source
fn BatchReport::high_risk_lines(self : BatchReport) -> Int

#
BatchReport::high_risk_percent

source
fn BatchReport::high_risk_percent(self : BatchReport) -> Int

#
BatchReport::input_lines

source
fn BatchReport::input_lines(self : BatchReport) -> Int

#
BatchReport::invalid_lines

source
fn BatchReport::invalid_lines(self : BatchReport) -> Int

#
BatchReport::invalid_percent

source
fn BatchReport::invalid_percent(self : BatchReport) -> Int

#
BatchReport::json_report

source
fn BatchReport::json_report(self : BatchReport) -> String

#
BatchReport::low_risk_lines

source
fn BatchReport::low_risk_lines(self : BatchReport) -> Int

#
BatchReport::medium_risk_lines

source
fn BatchReport::medium_risk_lines(self : BatchReport) -> Int

#
BatchReport::most_common_shape

source
fn BatchReport::most_common_shape(self : BatchReport) -> ShapeStat?

#
BatchReport::processed_lines

source
fn BatchReport::processed_lines(self : BatchReport) -> Int

#
BatchReport::profile_for

source
fn BatchReport::profile_for(self : BatchReport, key : String) -> FieldProfile?

#
BatchReport::profiles

source
fn BatchReport::profiles(self : BatchReport) -> Array[FieldProfile]

#
BatchReport::reviews

source
fn BatchReport::reviews(self : BatchReport) -> Array[LineReview]

#
BatchReport::shape_count

source
fn BatchReport::shape_count(self : BatchReport) -> Int

#
BatchReport::shape_for_fingerprint

source
fn BatchReport::shape_for_fingerprint(self : BatchReport, fingerprint : String) -> ShapeStat?

#
BatchReport::shape_limit_exceeded

source
fn BatchReport::shape_limit_exceeded(self : BatchReport) -> Bool

#
BatchReport::shapes

source
fn BatchReport::shapes(self : BatchReport) -> Array[ShapeStat]

#
BatchReport::skipped_blank_lines

source
fn BatchReport::skipped_blank_lines(self : BatchReport) -> Int

#
BatchReport::text_report

source
fn BatchReport::text_report(self : BatchReport) -> String

#
BatchReport::valid_lines

source
fn BatchReport::valid_lines(self : BatchReport) -> Int

#
ContractReport

source
pub struct ContractReport {
  contract_name : String
  parsed : ParseResult
  violations : Array[ContractViolation]
} derive(
Debug)

#
ContractReport::contract_name

source
fn ContractReport::contract_name(self : ContractReport) -> String

#
ContractReport::critical_count

source
fn ContractReport::critical_count(self : ContractReport) -> Int

#
ContractReport::decision

source
fn ContractReport::decision(self : ContractReport) -> String

#
ContractReport::is_conformant

source
fn ContractReport::is_conformant(self : ContractReport) -> Bool

#
ContractReport::json_report

source
fn ContractReport::json_report(self : ContractReport) -> String

#
ContractReport::parsed

source

#
ContractReport::text_report

source
fn ContractReport::text_report(self : ContractReport) -> String

#
ContractReport::violation_count

source
fn ContractReport::violation_count(self : ContractReport) -> Int

#
ContractReport::violations

source

#
ContractReport::warning_count

source
fn ContractReport::warning_count(self : ContractReport) -> Int

#
ContractViolation

source
pub struct ContractViolation {
  kind : ContractViolationKind
  severity : Severity
  key : String
  expected : String
  actual : String
  message : String
  offset : Int
} derive(Eq, 
Debug)

#
ContractViolation::actual

source
fn ContractViolation::actual(self : ContractViolation) -> String

#
ContractViolation::expected

source
fn ContractViolation::expected(self : ContractViolation) -> String

#
ContractViolation::key

source
fn ContractViolation::key(self : ContractViolation) -> String

#
ContractViolation::kind

source

#
ContractViolation::message

source
fn ContractViolation::message(self : ContractViolation) -> String

#
ContractViolation::offset

source
fn ContractViolation::offset(self : ContractViolation) -> Int

#
ContractViolation::severity

source

#
ContractViolationKind

source
pub(all) enum ContractViolationKind {
  ContractSyntaxError
  ContractMissingField
  ContractUnexpectedField
  ContractWrongType
  ContractBlankDisallowed
  ContractFlagDisallowed
  ContractValueTooLong
  ContractValueNotAllowed
  ContractDuplicateField
  ContractFieldLimit
} derive(Eq, 
Debug)

#
ContractViolationKind::label

source
fn ContractViolationKind::label(self : ContractViolationKind) -> String

#
DriftFinding

source
pub struct DriftFinding {
  kind : DriftKind
  severity : Severity
  subject : String
  baseline : String
  current : String
  message : String
} derive(Eq, 
Debug)

#
DriftFinding::baseline

source
fn DriftFinding::baseline(self : DriftFinding) -> String

#
DriftFinding::current

source
fn DriftFinding::current(self : DriftFinding) -> String

#
DriftFinding::kind

source
fn DriftFinding::kind(self : DriftFinding) -> DriftKind

#
DriftFinding::message

source
fn DriftFinding::message(self : DriftFinding) -> String

#
DriftFinding::severity

source
fn DriftFinding::severity(self : DriftFinding) -> Severity

#
DriftFinding::subject

source
fn DriftFinding::subject(self : DriftFinding) -> String

#
DriftKind

source
pub(all) enum DriftKind {
  DriftAddedField
  DriftRemovedField
  DriftTypeChanged
  DriftTypeConfidenceDrop
  DriftPrevalenceIncrease
  DriftPrevalenceDecrease
  DriftValueLengthGrowth
  DriftNewShape
  DriftRetiredShape
  DriftInvalidRateIncrease
  DriftRiskIncrease
} derive(Eq, 
Debug)

Explainable changes detected between two logfmt batches.

#
DriftKind::label

source
fn DriftKind::label(self : DriftKind) -> String

#
DriftPolicy

source
pub struct DriftPolicy {
  prevalence_delta : Int
  confidence_drop : Int
  max_length_growth : Int
  invalid_rate_delta : Int
  average_risk_delta : Int
  min_field_prevalence : Int
  report_retired_shapes : Bool
} derive(Eq, 
Debug)

#
DriftPolicy::ci

source

#
DriftPolicy::default

source
fn DriftPolicy::default() -> DriftPolicy

#
DriftPolicy::exploratory

source
fn DriftPolicy::exploratory() -> DriftPolicy

#
DriftPolicy::with_invalid_budget

source
fn DriftPolicy::with_invalid_budget(self : DriftPolicy, invalid_rate_delta : Int) -> DriftPolicy

#
DriftPolicy::with_prevalence_delta

source
fn DriftPolicy::with_prevalence_delta(self : DriftPolicy, prevalence_delta : Int) -> DriftPolicy

#
DriftPolicy::with_retired_shapes

source
fn DriftPolicy::with_retired_shapes(self : DriftPolicy, report_retired_shapes : Bool) -> DriftPolicy

#
DriftReport

source
pub struct DriftReport {
  baseline_lines : Int
  current_lines : Int
  findings : Array[DriftFinding]
} derive(Eq, 
Debug)

#
DriftReport::baseline_lines

source
fn DriftReport::baseline_lines(self : DriftReport) -> Int

#
DriftReport::critical_count

source
fn DriftReport::critical_count(self : DriftReport) -> Int

#
DriftReport::current_lines

source
fn DriftReport::current_lines(self : DriftReport) -> Int

#
DriftReport::decision

source
fn DriftReport::decision(self : DriftReport) -> String

#
DriftReport::finding_count

source
fn DriftReport::finding_count(self : DriftReport) -> Int

#
DriftReport::findings

source
fn DriftReport::findings(self : DriftReport) -> Array[DriftFinding]

#
DriftReport::json_report

source
fn DriftReport::json_report(self : DriftReport) -> String

#
DriftReport::risk_score

source
fn DriftReport::risk_score(self : DriftReport) -> Int

#
DriftReport::text_report

source
fn DriftReport::text_report(self : DriftReport) -> String

#
DriftReport::warning_count

source
fn DriftReport::warning_count(self : DriftReport) -> Int

#
Field

source
pub struct Field {
  key : String
  value : String
  quoted : Bool
  flag : Bool
  offset : Int
} derive(Eq, 
Debug)

One parsed logfmt field.

#
Field::is_flag

source
fn Field::is_flag(self : Field) -> Bool

#
Field::key

source
fn Field::key(self : Field) -> String

#
Field::new

source
fn Field::new(key : String, value : String, quoted? : Bool, flag? : Bool, offset? : Int) -> Field

#
Field::offset

source
fn Field::offset(self : Field) -> Int

#
Field::pair

source
fn Field::pair(self : Field) -> String

#
Field::quoted

source
fn Field::quoted(self : Field) -> Bool

#
Field::value

source
fn Field::value(self : Field) -> String

#
FieldProfile

source
pub struct FieldProfile {
  key : String
  lines_seen : Int
  values_seen : Int
  max_length : Int
  distinct_values : Array[String]
  distribution : ValueDistribution
} derive(Eq, 
Debug)

#
FieldProfile::distinct_values

source
fn FieldProfile::distinct_values(self : FieldProfile) -> Array[String]

#
FieldProfile::distribution

source
fn FieldProfile::distribution(self : FieldProfile) -> ValueDistribution

#
FieldProfile::dominant_kind

source
fn FieldProfile::dominant_kind(self : FieldProfile) -> ValueKind

#
FieldProfile::key

source
fn FieldProfile::key(self : FieldProfile) -> String

#
FieldProfile::lines_seen

source
fn FieldProfile::lines_seen(self : FieldProfile) -> Int

#
FieldProfile::max_length

source
fn FieldProfile::max_length(self : FieldProfile) -> Int

#
FieldProfile::prevalence_percent

source
fn FieldProfile::prevalence_percent(self : FieldProfile, valid_lines : Int) -> Int

#
FieldProfile::summary

source
fn FieldProfile::summary(self : FieldProfile, valid_lines : Int) -> String

#
FieldProfile::type_confidence

source
fn FieldProfile::type_confidence(self : FieldProfile) -> Int

#
FieldProfile::values_seen

source
fn FieldProfile::values_seen(self : FieldProfile) -> Int

#
FieldRule

source
pub struct FieldRule {
  key : String
  expected_kind : ValueKind
  required : Bool
  allow_blank : Bool
  allow_flag : Bool
  max_length : Int
  allowed_values : Array[String]
} derive(Eq, 
Debug)

One executable field rule in a log contract.

#
FieldRule::allowed_values

source
fn FieldRule::allowed_values(self : FieldRule) -> Array[String]

#
FieldRule::allows_blank

source
fn FieldRule::allows_blank(self : FieldRule) -> Bool

#
FieldRule::allows_flag

source
fn FieldRule::allows_flag(self : FieldRule) -> Bool

#
FieldRule::describe

source
fn FieldRule::describe(self : FieldRule) -> String

#
FieldRule::expected_kind

source
fn FieldRule::expected_kind(self : FieldRule) -> ValueKind

#
FieldRule::key

source
fn FieldRule::key(self : FieldRule) -> String

#
FieldRule::max_length

source
fn FieldRule::max_length(self : FieldRule) -> Int

#
FieldRule::required

source
fn FieldRule::required(self : FieldRule) -> Bool

#
FieldRule::text

source
fn FieldRule::text(key : String, required? : Bool) -> FieldRule

#
FieldRule::typed

source
fn FieldRule::typed(key : String, expected_kind : ValueKind, required? : Bool) -> FieldRule

#
FieldRule::with_allowed_values

source
fn FieldRule::with_allowed_values(self : FieldRule, allowed_values : Array[String]) -> FieldRule

#
FieldRule::with_blank

source
fn FieldRule::with_blank(self : FieldRule, allow_blank : Bool) -> FieldRule

#
FieldRule::with_flag

source
fn FieldRule::with_flag(self : FieldRule, allow_flag : Bool) -> FieldRule

#
FieldRule::with_max_length

source
fn FieldRule::with_max_length(self : FieldRule, max_length : Int) -> FieldRule

#
FieldRule::with_required

source
fn FieldRule::with_required(self : FieldRule, required : Bool) -> FieldRule

#
Finding

source
pub struct Finding {
  kind : FindingKind
  severity : Severity
  key : String
  message : String
  offset : Int
} derive(Eq, 
Debug)

#
Finding::key

source
fn Finding::key(self : Finding) -> String

#
Finding::kind

source
fn Finding::kind(self : Finding) -> FindingKind

#
Finding::message

source
fn Finding::message(self : Finding) -> String

#
Finding::new

source
fn Finding::new(kind : FindingKind, severity : Severity, key : String, message : String, offset? : Int) -> Finding

#
Finding::offset

source
fn Finding::offset(self : Finding) -> Int

#
Finding::severity

source
fn Finding::severity(self : Finding) -> Severity

#
FindingKind

source
pub(all) enum FindingKind {
  SyntaxError
  DuplicateKey
  RequiredKeyMissing
  TooManyFields
  ValueTooLong
  BlankValue
  FlagField
  ControlCharacter
} derive(Eq, 
Debug)

Audit finding kinds for logfmt quality and CI review.

#
FindingKind::label

source
fn FindingKind::label(self : FindingKind) -> String

#
InferencePolicy

source
pub struct InferencePolicy {
  required_percent : Int
  type_confidence_percent : Int
  enum_cardinality_limit : Int
  unknown_fields : UnknownFieldPolicy
} derive(Eq, 
Debug)

#
InferencePolicy::default

source

#
InferencePolicy::enum_cardinality_limit

source
fn InferencePolicy::enum_cardinality_limit(self : InferencePolicy) -> Int

#
InferencePolicy::exploratory

source
fn InferencePolicy::exploratory() -> InferencePolicy

#
InferencePolicy::required_percent

source
fn InferencePolicy::required_percent(self : InferencePolicy) -> Int

#
InferencePolicy::strict

source

#
InferencePolicy::type_confidence_percent

source
fn InferencePolicy::type_confidence_percent(self : InferencePolicy) -> Int

#
LineReview

source
pub struct LineReview {
  line_number : Int
  shape : String
  fingerprint : String
  report : AuditReport
} derive(
Debug)

Per-line analysis intentionally omits the original source text.

#
LineReview::fingerprint

source
fn LineReview::fingerprint(self : LineReview) -> String

#
LineReview::is_valid

source
fn LineReview::is_valid(self : LineReview) -> Bool

#
LineReview::line_number

source
fn LineReview::line_number(self : LineReview) -> Int

#
LineReview::report

source
fn LineReview::report(self : LineReview) -> AuditReport

#
LineReview::risk_level

source
fn LineReview::risk_level(self : LineReview) -> String

#
LineReview::shape

source
fn LineReview::shape(self : LineReview) -> String

#
LogContract

source
pub struct LogContract {
  name : String
  rules : Array[FieldRule]
  unknown_fields : UnknownFieldPolicy
  max_fields : Int
} derive(
Debug)

A named, executable schema for logfmt records.

#
LogContract::ci_event

source
fn LogContract::ci_event() -> LogContract

A compact contract suited to build and CI logs.

#
LogContract::describe

source
fn LogContract::describe(self : LogContract) -> String

#
LogContract::has_rule

source
fn LogContract::has_rule(self : LogContract, key : String) -> Bool

#
LogContract::max_fields

source
fn LogContract::max_fields(self : LogContract) -> Int

#
LogContract::name

source
fn LogContract::name(self : LogContract) -> String

#
LogContract::new

source
fn LogContract::new(name : String, rules : Array[FieldRule], unknown_fields? : UnknownFieldPolicy, max_fields? : Int) -> LogContract

#
LogContract::required_count

source
fn LogContract::required_count(self : LogContract) -> Int

#
LogContract::rule_count

source
fn LogContract::rule_count(self : LogContract) -> Int

#
LogContract::rules

source
fn LogContract::rules(self : LogContract) -> Array[FieldRule]

#
LogContract::service

source
fn LogContract::service() -> LogContract

A practical contract for ordinary service logs.

#
LogContract::unknown_field_policy

source
fn LogContract::unknown_field_policy(self : LogContract) -> UnknownFieldPolicy

#
ParseError

source
pub struct ParseError {
  kind : ParseErrorKind
  message : String
  offset : Int
} derive(Eq, 
Debug)

#
ParseError::kind

source

#
ParseError::message

source
fn ParseError::message(self : ParseError) -> String

#
ParseError::offset

source
fn ParseError::offset(self : ParseError) -> Int

#
ParseErrorKind

source
pub(all) enum ParseErrorKind {
  EmptyKey
  InvalidKey
  UnexpectedEquals
  UnterminatedQuote
  BareQuote
} derive(Eq, 
Debug)

Syntax problems found while parsing one logfmt line.

#
ParseErrorKind::label

source
fn ParseErrorKind::label(self : ParseErrorKind) -> String

#
ParseResult

source
pub struct ParseResult {
  source : String
  fields : Array[Field]
  errors : Array[ParseError]
} derive(
Debug)

#
ParseResult::error_count

source
fn ParseResult::error_count(self : ParseResult) -> Int

#
ParseResult::errors

source
fn ParseResult::errors(self : ParseResult) -> Array[ParseError]

#
ParseResult::field_count

source
fn ParseResult::field_count(self : ParseResult) -> Int

#
ParseResult::fields

source
fn ParseResult::fields(self : ParseResult) -> Array[Field]

#
ParseResult::get

source
fn ParseResult::get(self : ParseResult, key : String) -> String

#
ParseResult::has_key

source
fn ParseResult::has_key(self : ParseResult, key : String) -> Bool

#
ParseResult::is_valid

source
fn ParseResult::is_valid(self : ParseResult) -> Bool

#
ParseResult::normalized

source
fn ParseResult::normalized(self : ParseResult) -> String

#
ParseResult::source

source
fn ParseResult::source(self : ParseResult) -> String

#
ParseResult::summary

source
fn ParseResult::summary(self : ParseResult) -> String

#
PrivacyFinding

source
pub struct PrivacyFinding {
  key : String
  kind : SensitiveKind
  reason : String
  offset : Int
} derive(Eq, 
Debug)

#
PrivacyFinding::key

source
fn PrivacyFinding::key(self : PrivacyFinding) -> String

#
PrivacyFinding::kind

source

#
PrivacyFinding::offset

source
fn PrivacyFinding::offset(self : PrivacyFinding) -> Int

#
PrivacyFinding::reason

source
fn PrivacyFinding::reason(self : PrivacyFinding) -> String

#
PrivacyFinding::severity

source
fn PrivacyFinding::severity(self : PrivacyFinding) -> Severity

#
RedactionMode

source
pub(all) enum RedactionMode {
  RedactFull
  RedactKeepLastFour
  RedactStableToken
} derive(Eq, 
Debug)

How a sensitive value should be represented in safe output.

#
RedactionMode::label

source
fn RedactionMode::label(self : RedactionMode) -> String

#
RedactionPolicy

source
pub struct RedactionPolicy {
  mode : RedactionMode
  secret_key_fragments : Array[String]
  personal_key_fragments : Array[String]
  payment_key_fragments : Array[String]
  network_key_fragments : Array[String]
  allow_keys : Array[String]
  detect_values : Bool
  redact_network_values : Bool
} derive(
Debug)

Privacy rules for key-aware and value-aware redaction.

#
RedactionPolicy::default

source

#
RedactionPolicy::key_only

source

#
RedactionPolicy::mode

source

#
RedactionPolicy::strict

source

#
RedactionPolicy::with_allow_keys

source
fn RedactionPolicy::with_allow_keys(self : RedactionPolicy, allow_keys : Array[String]) -> RedactionPolicy

#
RedactionPolicy::with_mode

source

#
RedactionPolicy::with_network_values

source
fn RedactionPolicy::with_network_values(self : RedactionPolicy, redact_network_values : Bool) -> RedactionPolicy

#
RedactionPolicy::with_value_detection

source
fn RedactionPolicy::with_value_detection(self : RedactionPolicy, detect_values : Bool) -> RedactionPolicy

#
RedactionResult

source
pub struct RedactionResult {
  parsed : ParseResult
  safe_line : String
  findings : Array[PrivacyFinding]
  redacted_keys : Array[String]
} derive(
Debug)

The privacy-safe projection of one parsed line.

Reports never include the original sensitive values. The original source is retained only through the parsed result for in-process callers and is not serialized by the report methods.

#
RedactionResult::critical_count

source
fn RedactionResult::critical_count(self : RedactionResult) -> Int

#
RedactionResult::decision

source
fn RedactionResult::decision(self : RedactionResult) -> String

#
RedactionResult::finding_count

source
fn RedactionResult::finding_count(self : RedactionResult) -> Int

#
RedactionResult::findings

source

#
RedactionResult::is_safe

source
fn RedactionResult::is_safe(self : RedactionResult) -> Bool

#
RedactionResult::json_report

source
fn RedactionResult::json_report(self : RedactionResult) -> String

#
RedactionResult::parsed

source

#
RedactionResult::redacted_count

source
fn RedactionResult::redacted_count(self : RedactionResult) -> Int

#
RedactionResult::redacted_keys

source
fn RedactionResult::redacted_keys(self : RedactionResult) -> Array[String]

#
RedactionResult::safe_line

source
fn RedactionResult::safe_line(self : RedactionResult) -> String

#
RedactionResult::text_report

source
fn RedactionResult::text_report(self : RedactionResult) -> String

#
SchemaInference

source
pub struct SchemaInference {
  total_lines : Int
  valid_lines : Int
  invalid_lines : Int
  profiles : Array[FieldProfile]
  contract : LogContract
} derive(
Debug)

#
SchemaInference::contract

source

#
SchemaInference::invalid_lines

source
fn SchemaInference::invalid_lines(self : SchemaInference) -> Int

#
SchemaInference::json_report

source
fn SchemaInference::json_report(self : SchemaInference) -> String

#
SchemaInference::profile_for

source
fn SchemaInference::profile_for(self : SchemaInference, key : String) -> FieldProfile?

#
SchemaInference::profiles

source

#
SchemaInference::text_report

source
fn SchemaInference::text_report(self : SchemaInference) -> String

#
SchemaInference::total_lines

source
fn SchemaInference::total_lines(self : SchemaInference) -> Int

#
SchemaInference::valid_lines

source
fn SchemaInference::valid_lines(self : SchemaInference) -> Int

#
SensitiveKind

source
pub(all) enum SensitiveKind {
  SensitiveSecret
  SensitiveCredential
  SensitivePersonal
  SensitivePayment
  SensitiveNetwork
} derive(Eq, 
Debug)

Categories used by the privacy scanner.

#
SensitiveKind::label

source
fn SensitiveKind::label(self : SensitiveKind) -> String

#
SensitiveKind::severity

source
fn SensitiveKind::severity(self : SensitiveKind) -> Severity

#
Severity

source
pub(all) enum Severity {
  Info
  Warning
  Critical
} derive(Eq, 
Debug)

Severity assigned to an audit finding.

#
Severity::label

source
fn Severity::label(self : Severity) -> String

#
Severity::score

source
fn Severity::score(self : Severity) -> Int

#
ShapeStat

source
pub struct ShapeStat {
  shape : String
  fingerprint : String
  count : Int
  first_line : Int
} derive(Eq, 
Debug)

A value-free structural cluster. Shape strings contain only field names, semantic kinds, and flag markers.

#
ShapeStat::count

source
fn ShapeStat::count(self : ShapeStat) -> Int

#
ShapeStat::fingerprint

source
fn ShapeStat::fingerprint(self : ShapeStat) -> String

#
ShapeStat::first_line

source
fn ShapeStat::first_line(self : ShapeStat) -> Int

#
ShapeStat::shape

source
fn ShapeStat::shape(self : ShapeStat) -> String

#
ShapeStat::summary

source
fn ShapeStat::summary(self : ShapeStat) -> String

#
UnknownFieldPolicy

source
pub(all) enum UnknownFieldPolicy {
  UnknownAllow
  UnknownWarn
  UnknownReject
} derive(Eq, 
Debug)

Policy used when a contract encounters a key it does not declare.

#
UnknownFieldPolicy::label

source
fn UnknownFieldPolicy::label(self : UnknownFieldPolicy) -> String

#
ValueDistribution

source
pub struct ValueDistribution {
  flag_count : Int
  empty_count : Int
  boolean_count : Int
  integer_count : Int
  decimal_count : Int
  duration_count : Int
  byte_size_count : Int
  timestamp_count : Int
  ipv4_count : Int
  uuid_count : Int
  email_count : Int
  hex_count : Int
  identifier_count : Int
  text_count : Int
} derive(Eq, 
Debug)

A compact distribution of value kinds.

#
ValueDistribution::count

source
fn ValueDistribution::count(self : ValueDistribution, kind : ValueKind) -> Int

#
ValueDistribution::distinct_kind_count

source
fn ValueDistribution::distinct_kind_count(self : ValueDistribution) -> Int

#
ValueDistribution::dominant_kind

source
fn ValueDistribution::dominant_kind(self : ValueDistribution) -> ValueKind

#
ValueDistribution::dominant_percent

source
fn ValueDistribution::dominant_percent(self : ValueDistribution) -> Int

#
ValueDistribution::empty

source

#
ValueDistribution::summary

source
fn ValueDistribution::summary(self : ValueDistribution) -> String

#
ValueDistribution::total

source
fn ValueDistribution::total(self : ValueDistribution) -> Int

#
ValueDistribution::with_kind

source

#
ValueKind

source
pub(all) enum ValueKind {
  ValueFlag
  ValueEmpty
  ValueBoolean
  ValueInteger
  ValueDecimal
  ValueDuration
  ValueByteSize
  ValueTimestamp
  ValueIPv4
  ValueUuid
  ValueEmail
  ValueHex
  ValueIdentifier
  ValueText
} derive(Eq, 
Debug)

Semantic value families recognized by MoonLogfmt Lens.

The classifier is intentionally deterministic and dependency-free. It does not try to replace a full date, network, or identity parser. Its purpose is to give contract inference and drift analysis a stable vocabulary.

#
ValueKind::accepts

source
fn ValueKind::accepts(self : ValueKind, actual : ValueKind) -> Bool

Returns true when values of actual are accepted by a rule for expected.

Integer values are accepted by decimal rules, while every value can be represented as text. Empty and flag values remain explicit so callers can decide whether they are allowed.

#
ValueKind::label

source
fn ValueKind::label(self : ValueKind) -> String

#
analyze_batch

source
fn analyze_batch(lines : Array[String], policy? : BatchPolicy) -> BatchReport

#
audit

source
fn audit(parsed : ParseResult, policy : AuditPolicy) -> AuditReport

#
audit_line

source
fn audit_line(line : String) -> AuditReport

#
audit_line_with_policy

source
fn audit_line_with_policy(line : String, policy : AuditPolicy) -> AuditReport

#
classify_field

source
fn classify_field(field : Field) -> ValueKind

Classifies a parsed field while preserving the distinction between an implicit flag and an explicit boolean value.

#
classify_value

source
fn classify_value(value : String) -> ValueKind

Classifies one logfmt value using a stable, ordered set of recognizers.

#
compare_batches

source
fn compare_batches(baseline : BatchReport, current : BatchReport, policy? : DriftPolicy) -> DriftReport

#
contract_from_batch

source
fn contract_from_batch(report : BatchReport, name? : String, required_percent? : Int, unknown_fields? : UnknownFieldPolicy) -> LogContract

Freezes a reusable contract from a previously analyzed baseline.

#
evaluate_batch

source
fn evaluate_batch(report : BatchReport, policy? : BatchGatePolicy) -> BatchDecision

#
infer_schema

source
fn infer_schema(lines : Array[String], policy? : InferencePolicy) -> SchemaInference

#
is_valid

source
fn is_valid(line : String) -> Bool

#
parse

source
fn parse(line : String) -> ParseResult

#
profile_values

source
fn profile_values(values : Array[String]) -> ValueDistribution

#
redact_line

source
fn redact_line(line : String, policy? : RedactionPolicy) -> RedactionResult

#
redact_parsed

source
fn redact_parsed(parsed : ParseResult, policy : RedactionPolicy) -> RedactionResult

#
scan_privacy

source
fn scan_privacy(line : String) -> RedactionResult

Scans without changing policy defaults. The returned safe line can be used directly in diagnostics, fixtures, or support bundles.

#
shape_fingerprint

source
fn shape_fingerprint(shape : String) -> String

Stable, non-cryptographic identifier for a value-free structural shape.

#
structural_shape

source
fn structural_shape(parsed : ParseResult) -> String

Returns a canonical shape independent of field order and field values.

#
structural_template

source
fn structural_template(line : String) -> String

Returns a value-free template in original field order.

#
validate_contract

source
fn validate_contract(line : String, contract : LogContract) -> ContractReport

#
validate_parsed_contract

source
fn validate_parsed_contract(parsed : ParseResult, contract : LogContract) -> ContractReport

Source Files

Powered by MoonBit

Site sourceReport issuePackagesBuild queueSkillsStatistics

© 2026 mooncakes.io