Metadata-Version: 2.4
Name: paperbark
Version: 0.1.7
Summary: Configurable cross-source log capture, search, and analysis CLI.
Project-URL: Homepage, https://github.com/Good-Native/paperbark
Project-URL: Issues, https://github.com/Good-Native/paperbark/issues
Project-URL: Changelog, https://github.com/Good-Native/paperbark/blob/main/CHANGELOG.md
Author: Good-Native
License: MIT License
        
        Copyright (c) 2026 Good-Native
        
        Permission is hereby granted, free of charge, to any person obtaining a copy
        of this software and associated documentation files (the "Software"), to deal
        in the Software without restriction, including without limitation the rights
        to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
        copies of the Software, and to permit persons to whom the Software is
        furnished to do so, subject to the following conditions:
        
        The above copyright notice and this permission notice shall be included in
        all copies or substantial portions of the Software.
        
        THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
        IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
        FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
        AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
        LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
        OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
        THE SOFTWARE.
License-File: LICENSE
Keywords: cli,fly-io,logs,monitoring,observability
Classifier: Development Status :: 2 - Pre-Alpha
Classifier: Environment :: Console
Classifier: Intended Audience :: Developers
Classifier: Intended Audience :: System Administrators
Classifier: License :: OSI Approved :: MIT License
Classifier: Operating System :: MacOS
Classifier: Operating System :: POSIX
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: System :: Logging
Classifier: Topic :: System :: Monitoring
Classifier: Topic :: Utilities
Requires-Python: >=3.11
Requires-Dist: rich>=13.7
Requires-Dist: tomli>=2.0; python_version < '3.11'
Requires-Dist: tzdata>=2024.1; sys_platform == 'win32'
Provides-Extra: dev
Requires-Dist: mypy>=1.10; extra == 'dev'
Requires-Dist: pip-audit>=2.7; extra == 'dev'
Requires-Dist: pre-commit>=3.7; extra == 'dev'
Requires-Dist: pytest-cov>=5.0; extra == 'dev'
Requires-Dist: pytest>=8.2; extra == 'dev'
Requires-Dist: ruff>=0.5; extra == 'dev'
Description-Content-Type: text/markdown

# paperbark

Configurable cross-source log capture, search, and analysis CLI.

Paperbark captures logs from many sources (Fly.io, Cloudflare, Kubernetes,
CloudWatch, plain files, stdin), runs a configurable set of probes over
them, and writes a stable run-directory layout that downstream tooling can
search across.

> Status: v0.1.1 released to PyPI. The probe, format, source (flyctl),
> iteration, aggregate, cursor-filter, search, dispatcher, and analyse
> layers are all wired up; `paperbark monitor` runs end to end on a
> configurable cadence with a `rich.live` ticker. See
> [docs/ROADMAP.md](docs/ROADMAP.md) for current status.

## Install

```sh
# pipx (recommended for CLI use)
pipx install paperbark

# or uv
uv tool install paperbark
```

For local development, see [CONTRIBUTING.md](CONTRIBUTING.md).

## Quickstart

```sh
# write a starter config in the current directory
paperbark init

# add at least one source — uncomment the [[sources]] block in
# paperbark.toml and point `app` at your Fly app. monitor exits with
# "no sources configured" until you do.

# capture and analyse using config defaults (3s cadence, ~72 minutes)
paperbark monitor

# custom cadence, fixed run id, snapshots every 30s
paperbark monitor --interval 1s --run-id incident-pr349 --analyse-every 30s

# capture forever; press Ctrl+C to write the final report and exit
paperbark monitor --iterations 0

# search across captured runs
paperbark search --keyword "panic"

# re-run analysis over an existing run
paperbark analyse --run latest
```

Or skip Fly entirely and pipe pre-captured logs through stdin:

```sh
# one-shot run over a piped log; same probes, same run-dir layout
printf '[[sources]]\nname = "pipe"\ntype = "stdin"\n' > paperbark.toml
cat app.log | paperbark monitor --iterations 1
```

The `file` source is the on-disk equivalent — set `type = "file"` and
point `path` at the log file instead of piping.

## Configuration

Paperbark reads `./paperbark.toml` first, then
`~/.config/paperbark/config.toml`. Every CLI flag is also expressible as a
TOML key; flags override TOML at runtime. See [`docs/CONFIG.md`](docs/CONFIG.md)
for the full schema reference.

## Sources

| Source                               | Status                         |
| ------------------------------------ | ------------------------------ |
| Fly.io (`flyctl logs`)               | implemented                    |
| Cloudflare Workers (`wrangler tail`) | stub (interface only, post-v1) |
| Kubernetes (`kubectl logs`)          | stub (interface only, post-v1) |
| AWS CloudWatch                       | stub (interface only, post-v1) |
| Plain files                          | implemented                    |
| stdin                                | implemented                    |

See [`docs/SOURCES.md`](docs/SOURCES.md) for the `Source` interface and
how to add a new one.

## Log payload formats

Today: **JSON-keyed payloads only**. Per-source `format_keys` lets you
remap the canonical field names (timestamp / level / message / component)
to whatever JSON keys your app emits — see
[`docs/CONFIG.md`](docs/CONFIG.md#flyctl-options).

Coming in v0.2: **regex named-group formats** for non-JSON shapes
(pipe-delimited, syslog, Apache combined, nginx default, or any custom
pattern). The format layer already ships three presets
(`apache-combined`, `nginx-default`, `syslog-rfc5424`); they're not yet
wired into iteration. Until then, non-JSON sources will trip the
format-mismatch warning and probes will produce no findings.

## Probes

Severity rollup, panics and fatals, HTTP status, latency (p50/p95/p99),
heartbeat gap detection, process health, autoscaler events,
database/external errors, Sentry events, plus ad-hoc keyword and regex
matches. Each probe is config-toggleable; regex sets are
config-overridable. See [`docs/PROBES.md`](docs/PROBES.md) for the full
list, finding shapes, and how to add one.

## Licence

MIT — see [LICENSE](LICENSE).
