@bymax-one/nest-logger 1.0.3 → 1.0.5

package/CHANGELOG.md

@@ -11,6 +11,110 @@ heading here.
 
 ## [Unreleased]
 
+## [1.0.5] - 2026-07-30
+
+### Security
+
+- **Peer floors raised to exclude known-vulnerable NestJS versions.** `@nestjs/common ^11.0.0`
+  admitted 11.0.0–11.0.15, carrying [GHSA-cj7v-w2c7-cp7c](https://github.com/advisories/GHSA-cj7v-w2c7-cp7c)
+  (remote code execution via the `Content-Type` header, patched in 11.0.16), and
+  `@nestjs/core ^11.0.0` admitted everything up to 11.1.17, carrying
+  [GHSA-36xv-jgw5-4q75](https://github.com/advisories/GHSA-36xv-jgw5-4q75) (patched in 11.1.18).
+
+  A peer range states which versions this library supports. A floor below a published
+  advisory told a consumer a vulnerable install was supported, and nothing in their
+  tooling contradicted it — the install resolved cleanly and silently. Floors are now
+  `^11.0.16` and `^11.1.18`.
+
+  Shipped as a patch, which is where a security fix belongs; a minor would reach the
+  same installs anyway, since `^1.0.4` accepts `1.1.0` as readily as `1.0.5`. No
+  runtime behaviour changed.
+
+### Fixed
+
+- **The custom-destination examples did not compile against `ILogDestination`.**
+  The published interface takes a serialized line:
+
+  ```ts
+  write(payload: string): void | Promise<void>   // newline-terminated JSON, UTF-8
+  ```
+
+  All three examples in the README — `LokiDestination`, `PrismaLogDestination`,
+  `RollingFileDestination` — and the API reference table declared
+  `write(entry: LogEntry): void`, so anyone following the README to build a
+  destination got:
+
+  ```
+  TS2416: Property 'write' in type 'LokiDestination' is not assignable to the
+          same property in base type 'ILogDestination'.
+  ```
+
+  `ILogDestination` is this library's extension point, so the documentation was
+  teaching the wrong shape for the one thing consumers are meant to implement.
+  `RollingFileDestination` compounded it by re-serializing a payload that already
+  **is** newline-terminated JSON — anyone casting past the type error would have
+  written double-encoded lines to disk.
+
+  Each example now does what its own job requires rather than all three doing the
+  same thing: Loki buffers the line verbatim, Prisma parses because it stores
+  individual columns, rolling-file writes it through untouched.
+
+- **The request-id middleware typed `req` as the global DOM `Request`**, whose
+  `headers` is a `Headers` instance and cannot be indexed (`TS7052`). `1.0.4`
+  introduced `LoggableRequest` and `LoggableResponse` for exactly this and exports
+  them; the README never adopted them. It does now, and narrows the
+  `string | string[]` a repeated header produces.
+
+### Added
+
+- **`pnpm check:published`** — verifies that the README's links resolve, that its
+  TypeScript snippets and the type tests compile against the built package, and
+  that every `v*.*.*` tag has a `## [x.y.z]` CHANGELOG section. It resolves the
+  package through its `exports` map into `dist/`, which `test:types` cannot do:
+  that one maps the package to `./src` through tsconfig `paths` and so never
+  compiles what the README claims. Both defects above were found by it.
+
+  Runs in CI, in `release.yml`, and inside `prepublishOnly`.
+
+## [1.0.4] - 2026-07-29
+
+### Fixed
+
+- **The published declarations no longer depend on Express's types.** The HTTP
+  logging interceptor, the exception filter and the request-id middleware typed
+  their signatures with `Request` / `Response` / `NextFunction` from `express`,
+  so `dist/server/index.d.ts` imported from `express` and a consumer compiling
+  with `skipLibCheck: false` and no express types installed hit
+  `error TS2307: Cannot find module 'express'`. Present since 1.0.0; the imports
+  were `import type` only, so runtime was never affected and no express code was
+  ever bundled.
+
+  They are now typed by structural contracts declaring exactly the members this
+  package reads — `LoggableRequest` (`headers`, `method`, `url`, `ip`,
+  `user?.id`), `LoggableResponse` (`statusCode`, `setHeader`, `status().json()`)
+  and `NextHandler`. The emitted declarations import only `@nestjs/common`,
+  `pino` and `rxjs`, all declared peers.
+
+  **Not a breaking change:** an Express request and response satisfy the
+  contracts structurally, so existing call sites keep compiling with no cast —
+  the parameter types only widen what is accepted. The internal
+  `RequestWithUser` alias is gone, replaced by `LoggableRequest`; it was never
+  exported.
+
+### Added
+
+- `LoggableRequest`, `LoggableResponse`, `NextHandler` and `IncomingHeaders` are
+  exported from the package root: they type `RequestIdMiddleware.use()`, so a
+  consumer invoking it directly (in a test, say) can name them.
+
+### Removed
+
+- The `@types/express` optional peer dependency added in 1.0.3. With the
+  declarations self-contained it serves no purpose — nothing in the published
+  types names an express symbol. It stays a devDependency: the specs build
+  express-shaped mocks deliberately, to prove a real express request and
+  response still satisfy the contracts.
+
 ## [1.0.3] - 2026-07-29
 
 ### Fixed
@@ -148,7 +252,9 @@ published `dist/` is identical — no runtime behaviour changes for consumers.
 - Professional CI suite: `ci.yml`, `bench.yml`, `codeql.yml`, `scorecard.yml`,
   `release.yml`, Dependabot, and issue templates
 
-[Unreleased]: https://github.com/bymaxone/nest-logger/compare/v1.0.3...HEAD
+[Unreleased]: https://github.com/bymaxone/nest-logger/compare/v1.0.5...HEAD
+[1.0.5]: https://github.com/bymaxone/nest-logger/compare/v1.0.4...v1.0.5
+[1.0.4]: https://github.com/bymaxone/nest-logger/compare/v1.0.3...v1.0.4
 [1.0.3]: https://github.com/bymaxone/nest-logger/compare/v1.0.2...v1.0.3
 [1.0.2]: https://github.com/bymaxone/nest-logger/compare/v1.0.1...v1.0.2
 [1.0.1]: https://github.com/bymaxone/nest-logger/compare/v1.0.0...v1.0.1

package/README.md

@@ -144,15 +144,13 @@ pnpm add -D pino-pretty
 # Optional — OpenTelemetry trace correlation
 pnpm add @opentelemetry/api @opentelemetry/sdk-node
 
-# Optional — express types, only if you compile with `skipLibCheck: false`
-pnpm add -D @types/express
 ```
 
 > [!NOTE]
 > `@opentelemetry/api` is resolved lazily when the Pino instance is built. When it is absent the trace mixin silently steps aside — the logger never fails to start, and never warns, over an optional peer.
 
 > [!NOTE]
-> `@types/express` is an **optional type-only peer**. The HTTP interceptor, the exception filter and the request-id middleware type their signatures with express's `Request` / `Response` / `NextFunction`, so the published declarations import them. Nothing needs express at runtime — no express code is bundled. You only need the types installed if you compile with `skipLibCheck: false`; with the Nest CLI default (`skipLibCheck: true`), or on a non-express adapter, you can ignore it.
+> The published declarations depend on no HTTP framework's types. The HTTP interceptor, the exception filter and the request-id middleware are typed by structural contracts (`LoggableRequest`, `LoggableResponse`, `NextHandler`) that an Express request and response satisfy as-is, so nothing extra is needed even when you compile with `skipLibCheck: false`. The emitted `.d.ts` imports only `@nestjs/common`, `pino` and `rxjs`.
 
 ### 2. Register the module
 
@@ -339,15 +337,21 @@ Once active, every log entry automatically carries `traceId`, `spanId`, and `tra
 ```typescript
 // request-id.middleware.ts
 import { Injectable, NestMiddleware } from '@nestjs/common'
-import { LogContextService } from '@bymax-one/nest-logger'
+import {
+  LogContextService,
+  type LoggableRequest,
+  type LoggableResponse
+} from '@bymax-one/nest-logger'
 import { randomUUID } from 'node:crypto'
 
 @Injectable()
 export class RequestIdMiddleware implements NestMiddleware {
   constructor(private readonly logContext: LogContextService) {}
 
-  use(req: Request, res: Response, next: () => void) {
-    const requestId = req.headers['x-request-id'] ?? `r_${randomUUID()}`
+  use(req: LoggableRequest, res: LoggableResponse, next: () => void) {
+    // A header can arrive repeated, so its type is `string | string[]`.
+    const raw = req.headers['x-request-id']
+    const requestId = (Array.isArray(raw) ? raw[0] : raw) ?? `r_${randomUUID()}`
     this.logContext.run({ requestId }, next)
   }
 }
@@ -441,7 +445,8 @@ export class LokiDestination implements ILogDestination {
   private readonly url: string
   private readonly headers: Record<string, string>
   private readonly labels: Record<string, string>
-  private buffer: LogEntry[] = []
+  // Serialized lines, not objects — `write` receives the payload already encoded.
+  private buffer: string[] = []
   private flushTimer?: NodeJS.Timeout
 
   constructor(opts: {
@@ -468,8 +473,10 @@ export class LokiDestination implements ILogDestination {
     await this.flush()
   }
 
-  write(entry: LogEntry): void {
-    this.buffer.push(entry)
+  // `payload` already IS the serialized entry, newline-terminated. Buffer it as
+  // it arrives; parse only where a field is genuinely needed, as `flush` does.
+  write(payload: string): void {
+    this.buffer.push(payload)
     if (this.buffer.length >= 100) void this.flush()
   }
 
@@ -480,7 +487,10 @@ export class LokiDestination implements ILogDestination {
       streams: [
         {
           stream: this.labels,
-          values: batch.map((e) => [String(BigInt(e.time) * 1_000_000n), JSON.stringify(e)])
+          values: batch.map((line) => [
+            String(BigInt((JSON.parse(line) as LogEntry).time) * 1_000_000n),
+            line.trimEnd()
+          ])
         }
       ]
     })
@@ -522,7 +532,10 @@ export class PrismaLogDestination implements ILogDestination {
 
   constructor(private readonly prisma: PrismaClient) {}
 
-  write(entry: LogEntry): void {
+  write(payload: string): void {
+    // This destination stores individual columns, so it is one of the few that
+    // has to parse. A sink that forwards the line verbatim should not.
+    const entry = JSON.parse(payload) as LogEntry
     void this.prisma.applicationLog.create({
       data: {
         level: entry.level,
@@ -559,8 +572,9 @@ export class RollingFileDestination implements ILogDestination {
     await new Promise<void>((resolve) => this.stream?.end(resolve))
   }
 
-  write(entry: LogEntry): void {
-    this.stream?.write(JSON.stringify(entry) + '\n')
+  write(payload: string): void {
+    // Already newline-terminated JSON — re-serializing would double-encode it.
+    this.stream?.write(payload)
   }
 }
 ```
@@ -808,7 +822,8 @@ type LogEntry = {
 interface ILogDestination {
   readonly name: string
   readonly minLevel?: LogLevel
-  write(entry: LogEntry): void
+  /** `payload` is a newline-terminated JSON entry, UTF-8 encoded — not an object. */
+  write(payload: string): void | Promise<void>
   onInit?(): Promise<void>
   onShutdown?(): Promise<void>
 }

package/dist/server/index.cjs

@@ -1363,8 +1363,8 @@ exports.RequestIdMiddleware = class RequestIdMiddleware {
    * Echo or mint the `x-request-id`, expose it on the response, and run the
    * remainder of the request inside a fresh log-context scope.
    *
-   * @param req - The incoming Express request.
-   * @param res - The outgoing Express response.
+   * @param req - The incoming request (Express satisfies the contract).
+   * @param res - The outgoing response (Express satisfies the contract).
    * @param next - The next handler in the chain.
    */
   use(req, res, next) {

package/dist/server/index.d.cts

@@ -2,7 +2,6 @@ import * as _nestjs_common from '@nestjs/common';
 import { ModuleMetadata, Type, DynamicModule, INestApplication, LoggerService, OnApplicationShutdown, ExceptionFilter, ArgumentsHost, NestInterceptor, ExecutionContext, CallHandler, MiddlewareConsumer, NestMiddleware, CustomDecorator } from '@nestjs/common';
 import { Logger } from 'pino';
 import { Observable } from 'rxjs';
-import { Request, Response, NextFunction } from 'express';
 
 /**
  * Pino log levels (mirrored to NestJS-compatible names).
@@ -753,6 +752,66 @@ declare class HttpLoggingInterceptor implements NestInterceptor {
  */
 declare function applyRequestIdMiddleware(consumer: MiddlewareConsumer, routes?: string): void;
 
+/**
+ * Minimal HTTP request/response contracts the logging layer reads.
+ *
+ * Layer: server/interfaces — exported structural contracts shared by the HTTP
+ * logging interceptor, the exception filter and the request-id middleware. They
+ * are part of the public API: they appear in those components' published
+ * signatures, so a consumer calling `RequestIdMiddleware.use()` directly needs
+ * to be able to name them. Declared structurally, listing only the members
+ * those three actually touch, so the published declarations depend on no HTTP
+ * framework's types. Naming Express's
+ * `Request`/`Response` here would make the emitted `.d.ts` import from
+ * `express`, forcing every consumer that compiles with `skipLibCheck: false` to
+ * install `@types/express` whether or not they use those signatures.
+ *
+ * The shapes mirror what the Express adapter provides — `status().json()` and
+ * `setHeader()` are Express/Node response methods — so this is not an
+ * adapter-agnostic abstraction; a Fastify adapter remains unsupported. An
+ * Express request and response satisfy these contracts structurally, with no
+ * cast at the call site.
+ */
+/** Raw inbound headers, as the HTTP layer delivers them. */
+type IncomingHeaders = Record<string, string | string[] | undefined>;
+/**
+ * The inbound request members the logging layer reads.
+ *
+ * `user` is populated by upstream auth in the consumer app (a guard or
+ * middleware); only `id` is ever read, for the acting-user log field.
+ */
+interface LoggableRequest {
+    /** Inbound headers — read for correlation ids and the user agent. */
+    readonly headers: IncomingHeaders;
+    /** HTTP verb, logged as-is. */
+    readonly method: string;
+    /** Request target, normalized and query-stripped before it reaches a log. */
+    readonly url: string;
+    /** Client address when the adapter resolves one. */
+    readonly ip?: string | undefined;
+    /** Authenticated principal, when upstream auth attached one. */
+    readonly user?: {
+        readonly id?: string | undefined;
+    } | undefined;
+}
+/**
+ * The outbound response members the logging layer writes or reads: the status
+ * for the terminal log entry, `setHeader` to echo the correlation id, and the
+ * chainable `status().json()` used by the exception filter to emit a body.
+ */
+interface LoggableResponse {
+    /** Status code, read when logging the completed request. */
+    readonly statusCode: number;
+    /** Sets a response header (used for the correlation id). */
+    setHeader(name: string, value: string): void;
+    /** Selects the status code and returns the chainable body writer. */
+    status(code: number): {
+        json(body: unknown): unknown;
+    };
+}
+/** Continuation passed to a middleware; invoked with no arguments here. */
+type NextHandler = () => void;
+
 /**
  * Reads (or generates) the correlation id and starts the per-request log
  * context scope.
@@ -783,11 +842,11 @@ declare class RequestIdMiddleware implements NestMiddleware {
      * Echo or mint the `x-request-id`, expose it on the response, and run the
      * remainder of the request inside a fresh log-context scope.
      *
-     * @param req - The incoming Express request.
-     * @param res - The outgoing Express response.
+     * @param req - The incoming request (Express satisfies the contract).
+     * @param res - The outgoing response (Express satisfies the contract).
      * @param next - The next handler in the chain.
      */
-    use(req: Request, res: Response, next: NextFunction): void;
+    use(req: LoggableRequest, res: LoggableResponse, next: NextHandler): void;
 }
 
 /**
@@ -950,4 +1009,4 @@ declare const RESERVED_LOG_KEYS: Readonly<{
     readonly LOGGER_ENTRY_TRUNCATED: "LOGGER_ENTRY_TRUNCATED";
 }>;
 
-export { BymaxLoggerModule, type BymaxLoggerModuleAsyncOptions, type BymaxLoggerModuleOptions, type BymaxLoggerModuleOptionsFactory, DEFAULT_REDACT_PATHS, DefaultStdoutDestination, HttpExceptionFilter, HttpLoggingInterceptor, type HttpOptions, type ILogDestination, InjectLogger, LOGGER_DESTINATIONS_TOKEN, LOGGER_OPTIONS_TOKEN, LOGGER_PINO_INSTANCE_TOKEN, LOG_CONTEXT_METADATA_KEY, LOG_CONTEXT_TOKEN, LOG_KEYS_CONVENTION_REGEX, LogContext, type LogContext$1 as LogContextBag, LogContextService, type LogEntry, type LogLevel, LogPerformance, type OtelOptions, PinoLoggerService, PrettyDevDestination, RESERVED_LOG_KEYS, RequestIdMiddleware, type ResolvedBymaxLoggerModuleOptions, type ServiceMetadata, applyRequestIdMiddleware };
+export { BymaxLoggerModule, type BymaxLoggerModuleAsyncOptions, type BymaxLoggerModuleOptions, type BymaxLoggerModuleOptionsFactory, DEFAULT_REDACT_PATHS, DefaultStdoutDestination, HttpExceptionFilter, HttpLoggingInterceptor, type HttpOptions, type ILogDestination, type IncomingHeaders, InjectLogger, LOGGER_DESTINATIONS_TOKEN, LOGGER_OPTIONS_TOKEN, LOGGER_PINO_INSTANCE_TOKEN, LOG_CONTEXT_METADATA_KEY, LOG_CONTEXT_TOKEN, LOG_KEYS_CONVENTION_REGEX, LogContext, type LogContext$1 as LogContextBag, LogContextService, type LogEntry, type LogLevel, LogPerformance, type LoggableRequest, type LoggableResponse, type NextHandler, type OtelOptions, PinoLoggerService, PrettyDevDestination, RESERVED_LOG_KEYS, RequestIdMiddleware, type ResolvedBymaxLoggerModuleOptions, type ServiceMetadata, applyRequestIdMiddleware };

package/dist/server/index.d.ts

@@ -2,7 +2,6 @@ import * as _nestjs_common from '@nestjs/common';
 import { ModuleMetadata, Type, DynamicModule, INestApplication, LoggerService, OnApplicationShutdown, ExceptionFilter, ArgumentsHost, NestInterceptor, ExecutionContext, CallHandler, MiddlewareConsumer, NestMiddleware, CustomDecorator } from '@nestjs/common';
 import { Logger } from 'pino';
 import { Observable } from 'rxjs';
-import { Request, Response, NextFunction } from 'express';
 
 /**
  * Pino log levels (mirrored to NestJS-compatible names).
@@ -753,6 +752,66 @@ declare class HttpLoggingInterceptor implements NestInterceptor {
  */
 declare function applyRequestIdMiddleware(consumer: MiddlewareConsumer, routes?: string): void;
 
+/**
+ * Minimal HTTP request/response contracts the logging layer reads.
+ *
+ * Layer: server/interfaces — exported structural contracts shared by the HTTP
+ * logging interceptor, the exception filter and the request-id middleware. They
+ * are part of the public API: they appear in those components' published
+ * signatures, so a consumer calling `RequestIdMiddleware.use()` directly needs
+ * to be able to name them. Declared structurally, listing only the members
+ * those three actually touch, so the published declarations depend on no HTTP
+ * framework's types. Naming Express's
+ * `Request`/`Response` here would make the emitted `.d.ts` import from
+ * `express`, forcing every consumer that compiles with `skipLibCheck: false` to
+ * install `@types/express` whether or not they use those signatures.
+ *
+ * The shapes mirror what the Express adapter provides — `status().json()` and
+ * `setHeader()` are Express/Node response methods — so this is not an
+ * adapter-agnostic abstraction; a Fastify adapter remains unsupported. An
+ * Express request and response satisfy these contracts structurally, with no
+ * cast at the call site.
+ */
+/** Raw inbound headers, as the HTTP layer delivers them. */
+type IncomingHeaders = Record<string, string | string[] | undefined>;
+/**
+ * The inbound request members the logging layer reads.
+ *
+ * `user` is populated by upstream auth in the consumer app (a guard or
+ * middleware); only `id` is ever read, for the acting-user log field.
+ */
+interface LoggableRequest {
+    /** Inbound headers — read for correlation ids and the user agent. */
+    readonly headers: IncomingHeaders;
+    /** HTTP verb, logged as-is. */
+    readonly method: string;
+    /** Request target, normalized and query-stripped before it reaches a log. */
+    readonly url: string;
+    /** Client address when the adapter resolves one. */
+    readonly ip?: string | undefined;
+    /** Authenticated principal, when upstream auth attached one. */
+    readonly user?: {
+        readonly id?: string | undefined;
+    } | undefined;
+}
+/**
+ * The outbound response members the logging layer writes or reads: the status
+ * for the terminal log entry, `setHeader` to echo the correlation id, and the
+ * chainable `status().json()` used by the exception filter to emit a body.
+ */
+interface LoggableResponse {
+    /** Status code, read when logging the completed request. */
+    readonly statusCode: number;
+    /** Sets a response header (used for the correlation id). */
+    setHeader(name: string, value: string): void;
+    /** Selects the status code and returns the chainable body writer. */
+    status(code: number): {
+        json(body: unknown): unknown;
+    };
+}
+/** Continuation passed to a middleware; invoked with no arguments here. */
+type NextHandler = () => void;
+
 /**
  * Reads (or generates) the correlation id and starts the per-request log
  * context scope.
@@ -783,11 +842,11 @@ declare class RequestIdMiddleware implements NestMiddleware {
      * Echo or mint the `x-request-id`, expose it on the response, and run the
      * remainder of the request inside a fresh log-context scope.
      *
-     * @param req - The incoming Express request.
-     * @param res - The outgoing Express response.
+     * @param req - The incoming request (Express satisfies the contract).
+     * @param res - The outgoing response (Express satisfies the contract).
      * @param next - The next handler in the chain.
      */
-    use(req: Request, res: Response, next: NextFunction): void;
+    use(req: LoggableRequest, res: LoggableResponse, next: NextHandler): void;
 }
 
 /**
@@ -950,4 +1009,4 @@ declare const RESERVED_LOG_KEYS: Readonly<{
     readonly LOGGER_ENTRY_TRUNCATED: "LOGGER_ENTRY_TRUNCATED";
 }>;
 
-export { BymaxLoggerModule, type BymaxLoggerModuleAsyncOptions, type BymaxLoggerModuleOptions, type BymaxLoggerModuleOptionsFactory, DEFAULT_REDACT_PATHS, DefaultStdoutDestination, HttpExceptionFilter, HttpLoggingInterceptor, type HttpOptions, type ILogDestination, InjectLogger, LOGGER_DESTINATIONS_TOKEN, LOGGER_OPTIONS_TOKEN, LOGGER_PINO_INSTANCE_TOKEN, LOG_CONTEXT_METADATA_KEY, LOG_CONTEXT_TOKEN, LOG_KEYS_CONVENTION_REGEX, LogContext, type LogContext$1 as LogContextBag, LogContextService, type LogEntry, type LogLevel, LogPerformance, type OtelOptions, PinoLoggerService, PrettyDevDestination, RESERVED_LOG_KEYS, RequestIdMiddleware, type ResolvedBymaxLoggerModuleOptions, type ServiceMetadata, applyRequestIdMiddleware };
+export { BymaxLoggerModule, type BymaxLoggerModuleAsyncOptions, type BymaxLoggerModuleOptions, type BymaxLoggerModuleOptionsFactory, DEFAULT_REDACT_PATHS, DefaultStdoutDestination, HttpExceptionFilter, HttpLoggingInterceptor, type HttpOptions, type ILogDestination, type IncomingHeaders, InjectLogger, LOGGER_DESTINATIONS_TOKEN, LOGGER_OPTIONS_TOKEN, LOGGER_PINO_INSTANCE_TOKEN, LOG_CONTEXT_METADATA_KEY, LOG_CONTEXT_TOKEN, LOG_KEYS_CONVENTION_REGEX, LogContext, type LogContext$1 as LogContextBag, LogContextService, type LogEntry, type LogLevel, LogPerformance, type LoggableRequest, type LoggableResponse, type NextHandler, type OtelOptions, PinoLoggerService, PrettyDevDestination, RESERVED_LOG_KEYS, RequestIdMiddleware, type ResolvedBymaxLoggerModuleOptions, type ServiceMetadata, applyRequestIdMiddleware };

package/dist/server/index.mjs

@@ -1357,8 +1357,8 @@ var RequestIdMiddleware = class {
    * Echo or mint the `x-request-id`, expose it on the response, and run the
    * remainder of the request inside a fresh log-context scope.
    *
-   * @param req - The incoming Express request.
-   * @param res - The outgoing Express response.
+   * @param req - The incoming request (Express satisfies the contract).
+   * @param res - The outgoing response (Express satisfies the contract).
    * @param next - The next handler in the chain.
    */
   use(req, res, next) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-logger",
-  "version": "1.0.3",
+  "version": "1.0.5",
   "description": "Structured JSON logging for NestJS based on Pino 10, with optional OpenTelemetry correlation.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",
@@ -64,10 +64,9 @@
   },
   "dependencies": {},
   "peerDependencies": {
-    "@nestjs/common": "^11.0.0",
-    "@nestjs/core": "^11.0.0",
+    "@nestjs/common": "^11.0.16",
+    "@nestjs/core": "^11.1.18",
     "@opentelemetry/api": "^1.9.0",
-    "@types/express": "^4.17.21 || ^5.0.0",
     "pino": "^10.0.0",
     "pino-pretty": "^13.0.0",
     "reflect-metadata": "^0.2.0",
@@ -77,9 +76,6 @@
     "@opentelemetry/api": {
       "optional": true
     },
-    "@types/express": {
-      "optional": true
-    },
     "pino-pretty": {
       "optional": true
     }
@@ -146,23 +142,24 @@
     "registry": "https://registry.npmjs.org/"
   },
   "scripts": {
+    "bench": "node --expose-gc --import tsx bench/throughput.bench.ts",
     "build": "pnpm clean && tsup",
+    "check:exports": "attw --pack .",
+    "check:published": "node scripts/check-published-surface.mjs",
+    "clean": "rm -rf dist coverage",
     "lint": "eslint src",
     "lint:fix": "eslint src --fix",
-    "test": "jest",
-    "test:cov": "jest --coverage",
-    "test:watch": "jest --watch",
-    "test:e2e": "jest --config jest.e2e.config.ts",
-    "test:all": "pnpm test && pnpm test:e2e",
-    "test:cov:all": "jest --config jest.coverage.config.ts --coverage",
     "mutation": "stryker run",
-    "mutation:incremental": "stryker run --incremental",
     "mutation:dry-run": "stryker run --dryRunOnly",
-    "bench": "node --expose-gc --import tsx bench/throughput.bench.ts",
-    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.server.json",
+    "mutation:incremental": "stryker run --incremental",
+    "release": "pnpm publish --provenance",
     "size": "node scripts/check-size.mjs",
-    "check:exports": "attw --pack .",
-    "clean": "rm -rf dist coverage",
-    "release": "pnpm publish --provenance"
+    "test": "jest",
+    "test:all": "pnpm test && pnpm test:e2e",
+    "test:cov": "jest --coverage",
+    "test:cov:all": "jest --config jest.coverage.config.ts --coverage",
+    "test:e2e": "jest --config jest.e2e.config.ts",
+    "test:watch": "jest --watch",
+    "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.server.json"
   }
 }