From 574f400b0f5ee426ae202d7557fb37605126d55f Mon Sep 17 00:00:00 2001
From: usr-bin-roygbiv <roy@davai.fyi>
Date: Tue, 28 Jul 2026 15:12:21 +0000
Subject: [PATCH] fix(utils): pin logger rotation entrypoint

(cherry picked from commit 6dc31019848a20053e66df947c48e087cce8566a)
---
 bun.lock                                           | 2 +-
 package.json                                       | 2 +-
 packages/utils/src/logger.ts                       | 2 ++
 packages/utils/test/logger-runtime-closure.test.ts | 9 +++++++++
 4 files changed, 13 insertions(+), 2 deletions(-)

diff --git a/bun.lock b/bun.lock
index da77d3ed5..961f374ab 100644
--- a/bun.lock
+++ b/bun.lock
@@ -440,7 +440,7 @@
     "vite": "^8.1.4",
     "vite-plugin-solid": "^2.11.12",
     "winston": "^3.19.0",
-    "winston-daily-rotate-file": "^5.0.0",
+    "winston-daily-rotate-file": "5.0.0",
     "zod": "^4",
   },
   "packages": {
diff --git a/package.json b/package.json
index b4442f445..cea6799a3 100644
--- a/package.json
+++ b/package.json
@@ -95,7 +95,7 @@
       "vite": "^8.1.4",
       "vite-plugin-solid": "^2.11.12",
       "winston": "^3.19.0",
-      "winston-daily-rotate-file": "^5.0.0",
+      "winston-daily-rotate-file": "5.0.0",
       "zod": "^4"
     }
   },
diff --git a/packages/utils/src/logger.ts b/packages/utils/src/logger.ts
index 0e058c138..2e6ae71f9 100644
--- a/packages/utils/src/logger.ts
+++ b/packages/utils/src/logger.ts
@@ -17,6 +17,8 @@ import * as os from "node:os";
 import * as path from "node:path";
 import { isPromise } from "node:util/types";
 import type DailyRotateFile from "winston-daily-rotate-file";
+// Import the implementation directly because the package index imports and mutates
+// Winston. The exact workspace catalog pin protects this internal entrypoint.
 import DailyRotateFileImplementation from "winston-daily-rotate-file/daily-rotate-file.js";
 import { getLogsDir } from "./dirs";
 import { drainModuleLoadEvents } from "./timing-buffer";
diff --git a/packages/utils/test/logger-runtime-closure.test.ts b/packages/utils/test/logger-runtime-closure.test.ts
index 32eb2982a..e29d375f1 100644
--- a/packages/utils/test/logger-runtime-closure.test.ts
+++ b/packages/utils/test/logger-runtime-closure.test.ts
@@ -97,4 +97,13 @@ describe("central logger runtime closure", () => {
 		expect(filed.stdout).toBe("");
 		expect(filed.stderr).toBe("");
 	});
+	test("pins the deep rotation entrypoint to the reviewed package layout", async () => {
+		const rootPackage = JSON.parse(
+			await fs.readFile(path.resolve(import.meta.dir, "../../..", "package.json"), "utf8"),
+		) as { workspaces?: { catalog?: Record<string, string> } };
+		expect(rootPackage.workspaces?.catalog?.["winston-daily-rotate-file"]).toBe("5.0.0");
+		expect(Bun.resolveSync("winston-daily-rotate-file/daily-rotate-file.js", import.meta.dir)).toEndWith(
+			"/winston-daily-rotate-file/daily-rotate-file.js",
+		);
+	});
 });