@application-kit/observability 0.9.0 → 0.11.0

package/CHANGELOG.md

@@ -1,5 +1,23 @@
 # @application-kit/observability
 
+## 0.11.0
+
+### Minor Changes
+
+- 523d0e9: Строка лога о запросе больше не содержит секретов: `set-cookie` ответа заменяется маркером, значения параметров `token` и `code` вырезаются из `req.url`, `req.query` и заголовка `referer`, в том числе внутри другого параметра. Новые опции логгера `redactPaths` и `sensitiveQueryParameters` дополняют дефолт пакета.
+
+### Patch Changes
+
+- 8e10f98: Peer-зависимости принимают Nest 12, `@nestjs/graphql` и `@nestjs/mercurius` 14, `@nestjs/cqrs` 12 и `nestjs-pino` 5. `PinoLoggerConfig` задаёт `forRoutes` явно: с маршрутом nestjs-pino 5 по умолчанию запросы на Fastify не логировались.
+- Updated dependencies [8e10f98]
+  - @application-kit/typeorm@0.5.3
+
+## 0.10.0
+
+### Minor Changes
+
+- 3a17e1a: Корень наблюдаемости одним вызовом: вход `/nest` — `ObservabilityRootModule.forRoot({ imports, resolveClientIp })` (pino, логгер приложения под `OBSERVABILITY_LOGGER`, ядро health-чека) и `ObservabilityWebModule.forRoot({ publicRoute })` (HTTP-носители `/health` и `/metrics`). Вход `/logging/nest` — класс `ApplicationLogger`.
+
 ## 0.9.0
 
 ### Minor Changes

package/README.md

@@ -23,11 +23,35 @@ Peer-зависимости: `@nestjs/common`, `@prometheus-io/client`; оста
 | `@application-kit/observability/health/cli` | CLI-команда `<группа> health` | `/health` + `nestjs-console` |
 | `@application-kit/observability/http` | `resolveClientIp`, `resolveRequestFacts`, `firstHeaderValue` — IP клиента за прокси и факты запроса | ничего |
 | `@application-kit/observability/logging` | опции nestjs-pino, request-id, support-id, служебные пути, токен логгера | `@opentelemetry/api`, `class-validator`, `class-transformer`; типы — `nestjs-pino`, `pino` |
+| `@application-kit/observability/logging/nest` | `ApplicationLogger` — `PinoLogger` с контекстом приложения | `@nestjs/common`, `nestjs-pino` |
 | `@application-kit/observability/metrics` | реестр, гистограммы HTTP и GraphQL, `GET /metrics`, хуки Fastify, сервер `/metrics` | `@nestjs/common`, `@prometheus-io/client`; типы — `fastify`, `@nestjs/platform-fastify` |
+| `@application-kit/observability/nest` | `ObservabilityRootModule`, `ObservabilityWebModule` — сборка логирования, health и метрик | `nestjs-pino`, `pino` + зависимости `/health`, `/logging`, `/metrics` |
 | `@application-kit/observability/tracing` | `startTracing` — OpenTelemetry NodeSDK для `node --import`, только ESM | `@opentelemetry/sdk-node`, `@opentelemetry/instrumentation`, `@opentelemetry/instrumentation-http`, `@opentelemetry/exporter-trace-otlp-grpc`, `@opentelemetry/semantic-conventions` |
 
 Корневого входа нет: каждый вход несёт свои peer-зависимости, и лишнего потребитель не ставит.
 
+## Сборка процесса (`/nest`)
+
+`ObservabilityRootModule.forRoot` — глобальный корень на процесс: `LoggerModule` nestjs-pino, `ApplicationLogger` под
+`OBSERVABILITY_LOGGER`, ядро health-чека с логгером pino в terminus. `ObservabilityWebModule.forRoot` — только в
+web-графе: HTTP-носители `/health` и `/metrics`. `HealthGraphqlModule` подключается отдельно: его вход требует `@nestjs/graphql`.
+
+```ts
+@Module({
+  imports: [
+    ObservabilityRootModule.forRoot({
+      imports: [healthConfigsModule, loggerConfigsModule],
+      resolveClientIp: resolveRequestClientIp,
+    }),
+    ObservabilityWebModule.forRoot({ publicRoute: Public() }),
+    HealthGraphqlModule.forRoot({ publicRoute: Public() }),
+  ],
+})
+export class WebModule {}
+```
+
+`resolveClientIp` необязателен: дефолт и доверенные заголовки — раздел «IP клиента за прокси».
+
 ## Метрики
 
 - `MetricsRegistry` — провайдер с собственным `Registry` (не глобальным: экземпляры независимы) и метриками процесса
@@ -109,7 +133,7 @@ export class AppModule {}
 
 ## Health-чек (`/health`)
 
-`HealthModule.forRoot({ imports, logger })` — глобальное ядро процесса: terminus и `HealthChecks` (ping БД, heap, RSS,
+`HealthModule.forRoot({ imports, terminus })` — глобальное ядро процесса: terminus и `HealthChecks` (ping БД, heap, RSS,
 диск по корню; пороги — `HealthConfig`/`HealthEnvironment`). Носители подключаются там, где нужны, и берут состав
 отсюда — вердикт не зависит от того, каким путём спросили:
 
@@ -125,7 +149,7 @@ export class AppModule {}
 ```ts
 @Module({
   imports: [
-    HealthModule.forRoot({ imports: [healthConfigsModule], logger: Logger }),
+    HealthModule.forRoot({ imports: [healthConfigsModule], terminus: { logger: Logger } }),
     HealthHttpModule.forRoot({ publicRoute: Public() }),
     HealthGraphqlModule.forRoot({ publicRoute: Public() }),
   ],

package/dist/cjs/logging/index.d.ts

@@ -5,5 +5,6 @@ export * from './logger.environment.js';
 export * from './observability-logger.interface.js';
 export * from './pino-logger-options.interface.js';
 export * from './pino-logger.config.js';
+export * from './redact-query-parameters.js';
 export * from './resolve-request-id.js';
 export * from './resolve-support-id.js';

package/dist/cjs/logging/index.js

@@ -21,5 +21,6 @@ __exportStar(require("./logger.environment.js"), exports);
 __exportStar(require("./observability-logger.interface.js"), exports);
 __exportStar(require("./pino-logger-options.interface.js"), exports);
 __exportStar(require("./pino-logger.config.js"), exports);
+__exportStar(require("./redact-query-parameters.js"), exports);
 __exportStar(require("./resolve-request-id.js"), exports);
 __exportStar(require("./resolve-support-id.js"), exports);

package/dist/cjs/logging/nest/application-logger.d.ts

@@ -0,0 +1,5 @@
+import * as nestjsPino from 'nestjs-pino';
+import type { ObservabilityLoggerInterface } from '../observability-logger.interface.js';
+export declare class ApplicationLogger extends nestjsPino.PinoLogger implements ObservabilityLoggerInterface {
+    constructor(options: nestjsPino.Params);
+}

package/dist/cjs/logging/nest/application-logger.js

@@ -0,0 +1,59 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var ApplicationLogger_1;
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ApplicationLogger = void 0;
+const common_1 = require("@nestjs/common");
+const nestjsPino = __importStar(require("nestjs-pino"));
+let ApplicationLogger = ApplicationLogger_1 = class ApplicationLogger extends nestjsPino.PinoLogger {
+    constructor(options) {
+        super(options);
+        this.setContext(ApplicationLogger_1.name);
+    }
+};
+exports.ApplicationLogger = ApplicationLogger;
+exports.ApplicationLogger = ApplicationLogger = ApplicationLogger_1 = __decorate([
+    (0, common_1.Injectable)(),
+    __metadata("design:paramtypes", [Object])
+], ApplicationLogger);

package/dist/cjs/logging/nest/index.d.ts

@@ -0,0 +1 @@
+export * from './application-logger.js';

package/dist/cjs/logging/nest/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./application-logger.js"), exports);

package/dist/cjs/logging/pino-logger-options.interface.d.ts

@@ -1,5 +1,7 @@
 import type { ClientIpSourceInterface } from '../http/resolve-client-ip.js';
 export type ClientIpResolver = (request: ClientIpSourceInterface) => string;
 export interface PinoLoggerOptionsInterface {
+    readonly redactPaths?: readonly string[];
     readonly resolveClientIp?: ClientIpResolver;
+    readonly sensitiveQueryParameters?: readonly string[];
 }

package/dist/cjs/logging/pino-logger.config.js

@@ -18,6 +18,7 @@ const resolve_client_ip_js_1 = require("../http/resolve-client-ip.js");
 const active_span_context_js_1 = require("../shared/active-span-context.js");
 const infrastructure_paths_js_1 = require("./infrastructure-paths.js");
 const logger_environment_js_1 = require("./logger.environment.js");
+const redact_query_parameters_js_1 = require("./redact-query-parameters.js");
 const HTTP_STATUS_CLIENT_ERROR = 400;
 const HTTP_STATUS_SERVER_ERROR = 500;
 const isInfrastructureRequest = (url) => {
@@ -55,10 +56,19 @@ const REDACTED_LOG_PATHS = [
     'password',
     'req.headers.authorization',
     'req.headers.cookie',
+    'res.headers["set-cookie"]',
 ];
 const rawSocketPort = (request) => request.raw?.socket?.remotePort;
 const remotePort = (request) => request.socket?.remotePort
     ?? rawSocketPort(request);
+const withRedactedReferer = (headers, sensitiveNames) => (headers.referer === undefined
+    ? headers
+    : { ...headers, referer: (0, redact_query_parameters_js_1.redactUrlParameters)(headers.referer, sensitiveNames) });
+const sensitiveNamesOf = ({ sensitiveQueryParameters = [] }) => new Set([...redact_query_parameters_js_1.DEFAULT_SENSITIVE_QUERY_PARAMETERS, ...sensitiveQueryParameters]);
+const redactPathsOf = ({ redactPaths = [] }) => [
+    ...REDACTED_LOG_PATHS,
+    ...redactPaths,
+];
 let PinoLoggerConfig = class PinoLoggerConfig {
     environment;
     constructor(environment) {
@@ -66,7 +76,9 @@ let PinoLoggerConfig = class PinoLoggerConfig {
     }
     createOptions(options = {}) {
         const clientIp = options.resolveClientIp ?? resolve_client_ip_js_1.resolveClientIp;
+        const sensitiveNames = sensitiveNamesOf(options);
         return {
+            forRoutes: [{ method: common_1.RequestMethod.ALL, path: '/{*splat}' }],
             pinoHttp: {
                 autoLogging: true,
                 customLogLevel: exports.responseLogLevel,
@@ -79,17 +91,17 @@ let PinoLoggerConfig = class PinoLoggerConfig {
                 level: this.environment.LOG_LEVEL,
                 mixin: exports.traceContextMixin,
                 quietReqLogger: true,
-                redact: [...REDACTED_LOG_PATHS],
+                redact: redactPathsOf(options),
                 serializers: {
                     req: (request) => ({
-                        headers: request.headers,
+                        headers: withRedactedReferer(request.headers, sensitiveNames),
                         id: request.id,
                         method: request.method,
                         params: request.raw?.params,
-                        query: request.query,
+                        query: (0, redact_query_parameters_js_1.redactQueryObject)(request.query, sensitiveNames),
                         remoteAddress: clientIp(request),
                         remotePort: remotePort(request),
-                        url: request.url,
+                        url: (0, redact_query_parameters_js_1.redactUrlParameters)(request.url, sensitiveNames),
                     }),
                 },
             },

package/dist/cjs/logging/redact-query-parameters.d.ts

@@ -0,0 +1,3 @@
+export declare const DEFAULT_SENSITIVE_QUERY_PARAMETERS: readonly string[];
+export declare const redactUrlParameters: (value: unknown, sensitiveNames: ReadonlySet<string>) => unknown;
+export declare const redactQueryObject: (query: unknown, sensitiveNames: ReadonlySet<string>) => unknown;

package/dist/cjs/logging/redact-query-parameters.js

@@ -0,0 +1,33 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.redactQueryObject = exports.redactUrlParameters = exports.DEFAULT_SENSITIVE_QUERY_PARAMETERS = void 0;
+exports.DEFAULT_SENSITIVE_QUERY_PARAMETERS = ['code', 'token'];
+const REDACTED_VALUE = '[Redacted]';
+const PARAMETER_DELIMITER = /(?<delimiter>[&?])/u;
+const redactParameter = (parameter, sensitiveNames) => {
+    const assignmentIndex = parameter.indexOf('=');
+    return parameter.includes('=') && sensitiveNames.has(parameter.slice(0, assignmentIndex))
+        ? `${parameter.slice(0, assignmentIndex + 1)}${REDACTED_VALUE}`
+        : parameter;
+};
+const redactUrl = (url, sensitiveNames) => {
+    const [path, ...rest] = url.split(PARAMETER_DELIMITER);
+    return [path, ...rest.map((part) => redactParameter(part, sensitiveNames))].join('');
+};
+const redactUrlParameters = (value, sensitiveNames) => {
+    if (Array.isArray(value)) {
+        return value.map((item) => (0, exports.redactUrlParameters)(item, sensitiveNames));
+    }
+    return typeof value === 'string' ? redactUrl(value, sensitiveNames) : value;
+};
+exports.redactUrlParameters = redactUrlParameters;
+const redactQueryObject = (query, sensitiveNames) => {
+    if (typeof query !== 'object' || query === null) {
+        return query;
+    }
+    return Object.fromEntries(Object.entries(query).map(([name, value]) => [
+        name,
+        sensitiveNames.has(name) ? REDACTED_VALUE : (0, exports.redactUrlParameters)(value, sensitiveNames),
+    ]));
+};
+exports.redactQueryObject = redactQueryObject;

package/dist/cjs/nest/index.d.ts

@@ -0,0 +1,3 @@
+export * from './observability-root-module-options.interface.js';
+export * from './observability-root.module.js';
+export * from './observability-web.module.js';

package/dist/cjs/nest/index.js

@@ -0,0 +1,19 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./observability-root-module-options.interface.js"), exports);
+__exportStar(require("./observability-root.module.js"), exports);
+__exportStar(require("./observability-web.module.js"), exports);

package/dist/cjs/nest/observability-root-module-options.interface.d.ts

@@ -0,0 +1,5 @@
+import type { ModuleMetadata } from '@nestjs/common';
+import type { PinoLoggerOptionsInterface } from '../logging/pino-logger-options.interface.js';
+export interface ObservabilityRootModuleOptionsInterface extends PinoLoggerOptionsInterface {
+    readonly imports: NonNullable<ModuleMetadata['imports']>;
+}

package/dist/cjs/nest/observability-root-module-options.interface.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/nest/observability-root.module.d.ts

@@ -0,0 +1,5 @@
+import type { DynamicModule } from '@nestjs/common';
+import type { ObservabilityRootModuleOptionsInterface } from './observability-root-module-options.interface.js';
+export declare class ObservabilityRootModule {
+    static forRoot({ imports, ...loggerOptions }: ObservabilityRootModuleOptionsInterface): DynamicModule;
+}

package/dist/cjs/nest/observability-root.module.js

@@ -0,0 +1,37 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ObservabilityRootModule = void 0;
+const common_1 = require("@nestjs/common");
+const nestjs_pino_1 = require("nestjs-pino");
+const health_module_js_1 = require("../health/health.module.js");
+const constants_js_1 = require("../logging/constants.js");
+const application_logger_js_1 = require("../logging/nest/application-logger.js");
+const pino_logger_config_js_1 = require("../logging/pino-logger.config.js");
+let ObservabilityRootModule = class ObservabilityRootModule {
+    static forRoot({ imports, ...loggerOptions }) {
+        return {
+            exports: [application_logger_js_1.ApplicationLogger, constants_js_1.OBSERVABILITY_LOGGER],
+            global: true,
+            imports: [
+                nestjs_pino_1.LoggerModule.forRootAsync({
+                    imports,
+                    inject: [pino_logger_config_js_1.PinoLoggerConfig],
+                    useFactory: (config) => config.createOptions(loggerOptions),
+                }),
+                health_module_js_1.HealthModule.forRoot({ imports, terminus: { logger: nestjs_pino_1.Logger } }),
+            ],
+            module: this,
+            providers: [application_logger_js_1.ApplicationLogger, { provide: constants_js_1.OBSERVABILITY_LOGGER, useExisting: application_logger_js_1.ApplicationLogger }],
+        };
+    }
+};
+exports.ObservabilityRootModule = ObservabilityRootModule;
+exports.ObservabilityRootModule = ObservabilityRootModule = __decorate([
+    (0, common_1.Module)({})
+], ObservabilityRootModule);

package/dist/cjs/nest/observability-web.module.d.ts

@@ -0,0 +1,5 @@
+import type { DynamicModule } from '@nestjs/common';
+import type { HealthCarrierOptionsInterface } from '../health/health-module-options.interface.js';
+export declare class ObservabilityWebModule {
+    static forRoot(options?: HealthCarrierOptionsInterface): DynamicModule;
+}

package/dist/cjs/nest/observability-web.module.js

@@ -0,0 +1,24 @@
+"use strict";
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ObservabilityWebModule = void 0;
+const common_1 = require("@nestjs/common");
+const health_http_module_js_1 = require("../health/health-http.module.js");
+const metrics_http_module_js_1 = require("../metrics/metrics-http.module.js");
+let ObservabilityWebModule = class ObservabilityWebModule {
+    static forRoot(options = {}) {
+        return {
+            imports: [health_http_module_js_1.HealthHttpModule.forRoot(options), metrics_http_module_js_1.MetricsHttpModule.forRoot(options)],
+            module: this,
+        };
+    }
+};
+exports.ObservabilityWebModule = ObservabilityWebModule;
+exports.ObservabilityWebModule = ObservabilityWebModule = __decorate([
+    (0, common_1.Module)({})
+], ObservabilityWebModule);

package/dist/esm/logging/index.d.ts

@@ -5,5 +5,6 @@ export * from './logger.environment.js';
 export * from './observability-logger.interface.js';
 export * from './pino-logger-options.interface.js';
 export * from './pino-logger.config.js';
+export * from './redact-query-parameters.js';
 export * from './resolve-request-id.js';
 export * from './resolve-support-id.js';

package/dist/esm/logging/index.js

@@ -5,5 +5,6 @@ export * from './logger.environment.js';
 export * from './observability-logger.interface.js';
 export * from './pino-logger-options.interface.js';
 export * from './pino-logger.config.js';
+export * from './redact-query-parameters.js';
 export * from './resolve-request-id.js';
 export * from './resolve-support-id.js';

package/dist/esm/logging/nest/application-logger.d.ts

@@ -0,0 +1,5 @@
+import * as nestjsPino from 'nestjs-pino';
+import type { ObservabilityLoggerInterface } from '../observability-logger.interface.js';
+export declare class ApplicationLogger extends nestjsPino.PinoLogger implements ObservabilityLoggerInterface {
+    constructor(options: nestjsPino.Params);
+}

package/dist/esm/logging/nest/application-logger.js

@@ -0,0 +1,23 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+var __metadata = (this && this.__metadata) || function (k, v) {
+    if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
+};
+var ApplicationLogger_1;
+import { Injectable } from '@nestjs/common';
+import * as nestjsPino from 'nestjs-pino';
+let ApplicationLogger = ApplicationLogger_1 = class ApplicationLogger extends nestjsPino.PinoLogger {
+    constructor(options) {
+        super(options);
+        this.setContext(ApplicationLogger_1.name);
+    }
+};
+ApplicationLogger = ApplicationLogger_1 = __decorate([
+    Injectable(),
+    __metadata("design:paramtypes", [Object])
+], ApplicationLogger);
+export { ApplicationLogger };

package/dist/esm/logging/nest/index.d.ts

@@ -0,0 +1 @@
+export * from './application-logger.js';

package/dist/esm/logging/nest/index.js

@@ -0,0 +1 @@
+export * from './application-logger.js';

package/dist/esm/logging/pino-logger-options.interface.d.ts

@@ -1,5 +1,7 @@
 import type { ClientIpSourceInterface } from '../http/resolve-client-ip.js';
 export type ClientIpResolver = (request: ClientIpSourceInterface) => string;
 export interface PinoLoggerOptionsInterface {
+    readonly redactPaths?: readonly string[];
     readonly resolveClientIp?: ClientIpResolver;
+    readonly sensitiveQueryParameters?: readonly string[];
 }

package/dist/esm/logging/pino-logger.config.js

@@ -10,11 +10,12 @@ var __metadata = (this && this.__metadata) || function (k, v) {
 var __param = (this && this.__param) || function (paramIndex, decorator) {
     return function (target, key) { decorator(target, key, paramIndex); }
 };
-import { Inject, Injectable } from '@nestjs/common';
+import { Inject, Injectable, RequestMethod } from '@nestjs/common';
 import { resolveClientIp } from '../http/resolve-client-ip.js';
 import { activeSpanContext } from '../shared/active-span-context.js';
 import { isInfrastructurePath } from './infrastructure-paths.js';
 import { LoggerEnvironment } from './logger.environment.js';
+import { DEFAULT_SENSITIVE_QUERY_PARAMETERS, redactQueryObject, redactUrlParameters, } from './redact-query-parameters.js';
 const HTTP_STATUS_CLIENT_ERROR = 400;
 const HTTP_STATUS_SERVER_ERROR = 500;
 const isInfrastructureRequest = (url) => {
@@ -50,10 +51,19 @@ const REDACTED_LOG_PATHS = [
     'password',
     'req.headers.authorization',
     'req.headers.cookie',
+    'res.headers["set-cookie"]',
 ];
 const rawSocketPort = (request) => request.raw?.socket?.remotePort;
 const remotePort = (request) => request.socket?.remotePort
     ?? rawSocketPort(request);
+const withRedactedReferer = (headers, sensitiveNames) => (headers.referer === undefined
+    ? headers
+    : { ...headers, referer: redactUrlParameters(headers.referer, sensitiveNames) });
+const sensitiveNamesOf = ({ sensitiveQueryParameters = [] }) => new Set([...DEFAULT_SENSITIVE_QUERY_PARAMETERS, ...sensitiveQueryParameters]);
+const redactPathsOf = ({ redactPaths = [] }) => [
+    ...REDACTED_LOG_PATHS,
+    ...redactPaths,
+];
 let PinoLoggerConfig = class PinoLoggerConfig {
     environment;
     constructor(environment) {
@@ -61,7 +71,9 @@ let PinoLoggerConfig = class PinoLoggerConfig {
     }
     createOptions(options = {}) {
         const clientIp = options.resolveClientIp ?? resolveClientIp;
+        const sensitiveNames = sensitiveNamesOf(options);
         return {
+            forRoutes: [{ method: RequestMethod.ALL, path: '/{*splat}' }],
             pinoHttp: {
                 autoLogging: true,
                 customLogLevel: responseLogLevel,
@@ -74,17 +86,17 @@ let PinoLoggerConfig = class PinoLoggerConfig {
                 level: this.environment.LOG_LEVEL,
                 mixin: traceContextMixin,
                 quietReqLogger: true,
-                redact: [...REDACTED_LOG_PATHS],
+                redact: redactPathsOf(options),
                 serializers: {
                     req: (request) => ({
-                        headers: request.headers,
+                        headers: withRedactedReferer(request.headers, sensitiveNames),
                         id: request.id,
                         method: request.method,
                         params: request.raw?.params,
-                        query: request.query,
+                        query: redactQueryObject(request.query, sensitiveNames),
                         remoteAddress: clientIp(request),
                         remotePort: remotePort(request),
-                        url: request.url,
+                        url: redactUrlParameters(request.url, sensitiveNames),
                     }),
                 },
             },

package/dist/esm/logging/redact-query-parameters.d.ts

@@ -0,0 +1,3 @@
+export declare const DEFAULT_SENSITIVE_QUERY_PARAMETERS: readonly string[];
+export declare const redactUrlParameters: (value: unknown, sensitiveNames: ReadonlySet<string>) => unknown;
+export declare const redactQueryObject: (query: unknown, sensitiveNames: ReadonlySet<string>) => unknown;

package/dist/esm/logging/redact-query-parameters.js

@@ -0,0 +1,28 @@
+export const DEFAULT_SENSITIVE_QUERY_PARAMETERS = ['code', 'token'];
+const REDACTED_VALUE = '[Redacted]';
+const PARAMETER_DELIMITER = /(?<delimiter>[&?])/u;
+const redactParameter = (parameter, sensitiveNames) => {
+    const assignmentIndex = parameter.indexOf('=');
+    return parameter.includes('=') && sensitiveNames.has(parameter.slice(0, assignmentIndex))
+        ? `${parameter.slice(0, assignmentIndex + 1)}${REDACTED_VALUE}`
+        : parameter;
+};
+const redactUrl = (url, sensitiveNames) => {
+    const [path, ...rest] = url.split(PARAMETER_DELIMITER);
+    return [path, ...rest.map((part) => redactParameter(part, sensitiveNames))].join('');
+};
+export const redactUrlParameters = (value, sensitiveNames) => {
+    if (Array.isArray(value)) {
+        return value.map((item) => redactUrlParameters(item, sensitiveNames));
+    }
+    return typeof value === 'string' ? redactUrl(value, sensitiveNames) : value;
+};
+export const redactQueryObject = (query, sensitiveNames) => {
+    if (typeof query !== 'object' || query === null) {
+        return query;
+    }
+    return Object.fromEntries(Object.entries(query).map(([name, value]) => [
+        name,
+        sensitiveNames.has(name) ? REDACTED_VALUE : redactUrlParameters(value, sensitiveNames),
+    ]));
+};

package/dist/esm/nest/index.d.ts

@@ -0,0 +1,3 @@
+export * from './observability-root-module-options.interface.js';
+export * from './observability-root.module.js';
+export * from './observability-web.module.js';

package/dist/esm/nest/index.js

@@ -0,0 +1,3 @@
+export * from './observability-root-module-options.interface.js';
+export * from './observability-root.module.js';
+export * from './observability-web.module.js';

package/dist/esm/nest/observability-root-module-options.interface.d.ts

@@ -0,0 +1,5 @@
+import type { ModuleMetadata } from '@nestjs/common';
+import type { PinoLoggerOptionsInterface } from '../logging/pino-logger-options.interface.js';
+export interface ObservabilityRootModuleOptionsInterface extends PinoLoggerOptionsInterface {
+    readonly imports: NonNullable<ModuleMetadata['imports']>;
+}

package/dist/esm/nest/observability-root-module-options.interface.js

@@ -0,0 +1 @@
+export {};

package/dist/esm/nest/observability-root.module.d.ts

@@ -0,0 +1,5 @@
+import type { DynamicModule } from '@nestjs/common';
+import type { ObservabilityRootModuleOptionsInterface } from './observability-root-module-options.interface.js';
+export declare class ObservabilityRootModule {
+    static forRoot({ imports, ...loggerOptions }: ObservabilityRootModuleOptionsInterface): DynamicModule;
+}

package/dist/esm/nest/observability-root.module.js

@@ -0,0 +1,34 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Module } from '@nestjs/common';
+import { Logger, LoggerModule } from 'nestjs-pino';
+import { HealthModule } from '../health/health.module.js';
+import { OBSERVABILITY_LOGGER } from '../logging/constants.js';
+import { ApplicationLogger } from '../logging/nest/application-logger.js';
+import { PinoLoggerConfig } from '../logging/pino-logger.config.js';
+let ObservabilityRootModule = class ObservabilityRootModule {
+    static forRoot({ imports, ...loggerOptions }) {
+        return {
+            exports: [ApplicationLogger, OBSERVABILITY_LOGGER],
+            global: true,
+            imports: [
+                LoggerModule.forRootAsync({
+                    imports,
+                    inject: [PinoLoggerConfig],
+                    useFactory: (config) => config.createOptions(loggerOptions),
+                }),
+                HealthModule.forRoot({ imports, terminus: { logger: Logger } }),
+            ],
+            module: this,
+            providers: [ApplicationLogger, { provide: OBSERVABILITY_LOGGER, useExisting: ApplicationLogger }],
+        };
+    }
+};
+ObservabilityRootModule = __decorate([
+    Module({})
+], ObservabilityRootModule);
+export { ObservabilityRootModule };

package/dist/esm/nest/observability-web.module.d.ts

@@ -0,0 +1,5 @@
+import type { DynamicModule } from '@nestjs/common';
+import type { HealthCarrierOptionsInterface } from '../health/health-module-options.interface.js';
+export declare class ObservabilityWebModule {
+    static forRoot(options?: HealthCarrierOptionsInterface): DynamicModule;
+}

package/dist/esm/nest/observability-web.module.js

@@ -0,0 +1,21 @@
+var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
+    var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
+    if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
+    else for (var i = decorators.length - 1; i >= 0; i--) if (d = decorators[i]) r = (c < 3 ? d(r) : c > 3 ? d(target, key, r) : d(target, key)) || r;
+    return c > 3 && r && Object.defineProperty(target, key, r), r;
+};
+import { Module } from '@nestjs/common';
+import { HealthHttpModule } from '../health/health-http.module.js';
+import { MetricsHttpModule } from '../metrics/metrics-http.module.js';
+let ObservabilityWebModule = class ObservabilityWebModule {
+    static forRoot(options = {}) {
+        return {
+            imports: [HealthHttpModule.forRoot(options), MetricsHttpModule.forRoot(options)],
+            module: this,
+        };
+    }
+};
+ObservabilityWebModule = __decorate([
+    Module({})
+], ObservabilityWebModule);
+export { ObservabilityWebModule };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@application-kit/observability",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Наблюдаемость NestJS-процесса: метрики Prometheus и RED-гистограммы, health-чеки и пробы, опции pino с request-id и trace-контекстом, логирование CQRS-шин, реальный IP клиента за прокси, трейсинг OpenTelemetry",
   "keywords": [
     "cqrs",
@@ -89,6 +89,16 @@
         "default": "./dist/cjs/logging/index.js"
       }
     },
+    "./logging/nest": {
+      "import": {
+        "types": "./dist/esm/logging/nest/index.d.ts",
+        "default": "./dist/esm/logging/nest/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/logging/nest/index.d.ts",
+        "default": "./dist/cjs/logging/nest/index.js"
+      }
+    },
     "./metric-names.json": "./metric-names.json",
     "./metrics": {
       "import": {
@@ -100,6 +110,16 @@
         "default": "./dist/cjs/metrics/index.js"
       }
     },
+    "./nest": {
+      "import": {
+        "types": "./dist/esm/nest/index.d.ts",
+        "default": "./dist/esm/nest/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/nest/index.d.ts",
+        "default": "./dist/cjs/nest/index.js"
+      }
+    },
     "./package.json": "./package.json",
     "./tracing": {
       "import": {
@@ -116,22 +136,22 @@
     "metric-names.json"
   ],
   "scripts": {
-    "build": "rm -rf ./dist && node ../../scripts/barrels.mjs create ./src/cqrs && node ../../scripts/barrels.mjs create ./src/health --entry-only=cli,graphql && node ../../scripts/barrels.mjs create ./src/http && node ../../scripts/barrels.mjs create ./src/logging && node ../../scripts/barrels.mjs create ./src/metrics && node ../../scripts/barrels.mjs create ./src/tracing && tsc --project tsconfig.build.json && tsc --project tsconfig.build.cjs.json && node ../../scripts/barrels.mjs clean ./src && node ../../scripts/mark-cjs.mjs ./dist/cjs",
+    "build": "rm -rf ./dist && node ../../scripts/barrels.mjs create ./src/cqrs && node ../../scripts/barrels.mjs create ./src/health --entry-only=cli,graphql && node ../../scripts/barrels.mjs create ./src/http && node ../../scripts/barrels.mjs create ./src/logging --entry-only=nest && node ../../scripts/barrels.mjs create ./src/metrics && node ../../scripts/barrels.mjs create ./src/nest && node ../../scripts/barrels.mjs create ./src/tracing && tsc --project tsconfig.build.json && tsc --project tsconfig.build.cjs.json && node ../../scripts/barrels.mjs clean ./src && node ../../scripts/mark-cjs.mjs ./dist/cjs",
     "lint:tsc": "tsc --noEmit --pretty --project .",
     "test:mutation": "stryker run",
     "test:unit": "vitest run"
   },
   "dependencies": {
-    "@application-kit/typeorm": "^0.5.1"
+    "@application-kit/typeorm": "^0.5.3"
   },
   "devDependencies": {
-    "@nestjs/common": "^11.2.7",
-    "@nestjs/core": "^11.2.7",
-    "@nestjs/cqrs": "^11.0.3",
-    "@nestjs/graphql": "^13.4.5",
-    "@nestjs/platform-fastify": "^11.2.7",
+    "@nestjs/common": "^12.0.0",
+    "@nestjs/core": "^12.0.0",
+    "@nestjs/cqrs": "^12.0.0",
+    "@nestjs/graphql": "^14.0.0",
+    "@nestjs/platform-fastify": "^12.0.0",
     "@nestjs/terminus": "^12.1.0",
-    "@nestjs/testing": "^11.2.7",
+    "@nestjs/testing": "^12.0.0",
     "@nestjs/typeorm": "^12.0.2",
     "@opentelemetry/api": "^1.10.0",
     "@opentelemetry/exporter-trace-otlp-grpc": "^0.300.0",
@@ -149,19 +169,19 @@
     "graphql": "^17.0.2",
     "import-in-the-middle": "^3.5.2",
     "nestjs-console": "^10.0.0",
-    "nestjs-pino": "^4.6.1",
+    "nestjs-pino": "^5.0.0",
     "pino": "^10.3.1",
     "reflect-metadata": "^0.2.2",
     "rxjs": "^7.8.2",
     "typeorm": "^1.1.0",
     "typescript": "^6.0.3",
-    "vitest": "^4.1.11"
+    "vitest": "^5.0.0"
   },
   "peerDependencies": {
-    "@nestjs/common": "^11.0.0",
-    "@nestjs/cqrs": "^11.0.0",
-    "@nestjs/graphql": "^13.0.0",
-    "@nestjs/platform-fastify": "^11.0.0",
+    "@nestjs/common": "^11.0.0 || ^12.0.0",
+    "@nestjs/cqrs": "^11.0.0 || ^12.0.0",
+    "@nestjs/graphql": "^13.0.0 || ^14.0.0",
+    "@nestjs/platform-fastify": "^11.0.0 || ^12.0.0",
     "@nestjs/terminus": "^11.0.0 || ^12.0.0",
     "@nestjs/typeorm": "^11.0.0 || ^12.0.0",
     "@opentelemetry/api": "^1.10.0",
@@ -177,7 +197,7 @@
     "graphql": "^16.0.0 || ^17.0.0",
     "import-in-the-middle": "^3.3.3",
     "nestjs-console": "^10.0.0",
-    "nestjs-pino": "^4.6.1",
+    "nestjs-pino": "^4.6.1 || ^5.0.0",
     "pino": "^10.0.0",
     "typeorm": "^1.0.0"
   },