@bymax-one/nest-logger 1.0.6 → 1.0.8

package/CHANGELOG.md

@@ -11,6 +11,76 @@ heading here.
 
 ## [Unreleased]
 
+## [1.0.8] - 2026-08-10
+
+Remediation of a local audit's redaction, attribution and correlation-id findings. No API
+changed; the fixes are in the default redact set, the acting-user resolution and the docs.
+
+### Fixed
+
+- **Root-level metadata is redacted.** The default redact set now lists each sensitive field at
+  depth 0 as well as depths 1–4, so a value spread into a log record's own root — as
+  `emitStructured` does with caller metadata — is scrubbed. The depth-1-and-deeper wildcards never
+  reached the root, so a field named `password` passed as metadata was written in clear.
+- **Acting-user attribution reads the JWT subject first.** The HTTP logging interceptor and the
+  exception filter now resolve the acting user as `sub ?? id`, so a JWT principal (every
+  `@bymax-one/nest-auth` token) is attributed to its subject rather than an ORM `id` when a
+  principal carries both.
+
+### Documentation
+
+- The advertised default redact-path count is corrected from 113 to **140** (27 fields across
+  depths 0–4, plus 5 absolute header paths) across the README and the technical specification.
+- The correlation-id charset comment now describes what the middleware actually does — echo
+  `x-request-id` and store `requestId` in the log context — instead of a non-existent
+  error-envelope `correlationId` field.
+
+## [1.0.7] - 2026-08-07
+
+**Documentation and tooling.** `dist/` differs from `1.0.6` only in the text of the comments
+described below; no runtime code changed.
+
+### Changed
+
+- **Equivalent mutants are documented in the source instead of only in the report, and the
+  rule against that was retired on a measurement.** The plan forbade inline
+  `// Stryker disable` comments on the ground that they would push the server subpath past
+  its 13.5 kB brotli budget. Measured: seven directives took the bundle from **12.84 to
+  12.94 kB** — **+0.10 kB** against 0.66 kB of headroom, because brotli compresses their
+  repeated prefixes almost for free. The assumed cost was roughly ten times the real one, and
+  no budget changed.
+
+  With the ten survivors now carrying their reason inline, the measured score moves from
+  **97.42%** to **100%** — no test and no production logic changed; Stryker excludes an
+  ignored mutant from the denominator instead of counting it as one the suite failed to kill.
+
+- **One suppression is recorded as what it is, not as an equivalent.** `otel-detector.ts:40`
+  is killed by the suite — applying the mutation by hand turns the suite red — but Stryker
+  fails to attribute the killing test to it under `perTest` coverage analysis. Its directive
+  says exactly that. Calling it equivalent to reach a rounder number would have been false.
+
+- Two reasons were corrected after review. `decodeStrings: false` claimed equivalence "for
+  every input"; with `true`, Node encodes the string using the write's encoding and this
+  stream decodes with `toString('utf-8')`, so a `write(chunk, 'latin1')` would change
+  non-ASCII bytes. Nothing writes here but Pino, which emits UTF-8 NDJSON at the default
+  encoding, and the reason now says so and names where it stops being true. The
+  `{ strict: false }` reason argued from a missing provider; it now gives the actual
+  mechanism — `NestApplicationContext.get` branches on `!(options && options.strict)`, so the
+  mutant's `{}` leaves `strict` undefined, which is falsy, and takes the same non-strict
+  lookup.
+
+### Added
+
+- `check:mutants` gate (`scripts/check-mutation-directives.mjs`) — validates every
+  `// Stryker` comment against the parser's own regular expression, rejecting a reason written
+  after `--` instead of a colon, a reason wrapped onto a second comment line, a stray comma in
+  the mutator list, and a mutator name Stryker does not know, which matches nothing and so
+  silences nothing. Wired into CI and `prepublishOnly`.
+
+### Fixed
+
+- The `[Unreleased]` compare link still pointed at `v1.0.5` after `1.0.6` shipped.
+
 ## [1.0.6] - 2026-08-06
 
 **Tests and documentation only.** `dist/` is byte-identical to `1.0.5`.
@@ -270,7 +340,9 @@ published `dist/` is identical — no runtime behaviour changes for consumers.
 - Professional CI suite: `ci.yml`, `bench.yml`, `codeql.yml`, `scorecard.yml`,
   `release.yml`, Dependabot, and issue templates
 
-[Unreleased]: https://github.com/bymaxone/nest-logger/compare/v1.0.5...HEAD
+[Unreleased]: https://github.com/bymaxone/nest-logger/compare/v1.0.8...HEAD
+[1.0.8]: https://github.com/bymaxone/nest-logger/compare/v1.0.7...v1.0.8
+[1.0.7]: https://github.com/bymaxone/nest-logger/compare/v1.0.6...v1.0.7
 [1.0.6]: https://github.com/bymaxone/nest-logger/compare/v1.0.5...v1.0.6
 [1.0.5]: https://github.com/bymaxone/nest-logger/compare/v1.0.4...v1.0.5
 [1.0.4]: https://github.com/bymaxone/nest-logger/compare/v1.0.3...v1.0.4

package/README.md

@@ -14,7 +14,7 @@
   <a href="https://www.npmjs.com/package/@bymax-one/nest-logger"><img src="https://img.shields.io/npm/dm/@bymax-one/nest-logger?style=flat-square&colorA=000000&colorB=000000" alt="npm downloads" /></a>
   <a href="https://github.com/bymaxone/nest-logger/actions/workflows/ci.yml"><img src="https://img.shields.io/github/actions/workflow/status/bymaxone/nest-logger/ci.yml?branch=main&style=flat-square&colorA=000000&label=CI" alt="CI status" /></a>
   <a href="https://github.com/bymaxone/nest-logger/actions/workflows/ci.yml"><img src="https://img.shields.io/badge/coverage-100%25-brightgreen?style=flat-square&colorA=000000" alt="coverage" /></a>
-  <a href="https://github.com/bymaxone/nest-logger/blob/main/docs/mutation_testing_results.md"><img src="https://img.shields.io/badge/mutation-97.42%25-brightgreen?style=flat-square&colorA=000000" alt="mutation score" /></a>
+  <a href="https://github.com/bymaxone/nest-logger/blob/main/docs/mutation_testing_results.md"><img src="https://img.shields.io/badge/mutation-100%25-brightgreen?style=flat-square&colorA=000000" alt="mutation score" /></a>
   <a href="https://scorecard.dev/viewer/?uri=github.com/bymaxone/nest-logger"><img src="https://api.scorecard.dev/projects/github.com/bymaxone/nest-logger/badge?style=flat-square" alt="OpenSSF Scorecard" /></a>
   <a href="https://github.com/bymaxone/nest-logger/blob/main/LICENSE"><img src="https://img.shields.io/github/license/bymaxone/nest-logger?style=flat-square&colorA=000000&colorB=000000" alt="license" /></a>
   <a href="https://www.typescriptlang.org/"><img src="https://img.shields.io/badge/TypeScript-strict-3178C6?style=flat-square&logo=typescript&logoColor=white" alt="TypeScript" /></a>
@@ -43,7 +43,7 @@ The library has **zero direct dependencies** — all packages arrive as peer dep
 
 - **🎯 One module, the whole pipeline** — Logger service, HTTP interceptor, exception filter, context propagation, redaction, and destinations arrive in a single `forRoot()`. No gluing together `pino-http`, a redaction layer, and a transport by hand.
 - **🔌 Your sinks, your rules** — The library defines `ILogDestination`. You implement it for Loki, Postgres, a rolling file, or anything else. No vendor lock-in, no hidden transport dependencies.
-- **🔒 Redacted by default** — 113 redact paths compile at bootstrap covering the standard set: passwords, tokens, PCI DSS card data, MFA secrets, and LGPD documents. Domain-specific field names are yours to add via `redactPaths`.
+- **🔒 Redacted by default** — 140 redact paths compile at bootstrap covering the standard set: passwords, tokens, PCI DSS card data, MFA secrets, and LGPD documents. Domain-specific field names are yours to add via `redactPaths`.
 - **⚡ On the hot path, so it stays cheap** — Singleton providers, one composed Pino mixin, and a pre-compiled redactor. No `Scope.REQUEST`, no per-log regex matching.
 - **🔭 Correlated when you need it** — When an OpenTelemetry span is active, `traceId`/`spanId`/`traceFlags` land in every entry. When the peer is absent, the mixin steps aside at zero cost.
 
@@ -65,7 +65,7 @@ pnpm add @bymax-one/nest-logger
 
 ### 🛡️ Security & Privacy
 
-- ✅ **PII Redaction by Default** — 113 paths covering passwords, tokens, and generic secrets — powered by `fast-redact`
+- ✅ **PII Redaction by Default** — 140 paths covering passwords, tokens, and generic secrets — powered by `fast-redact`
 - ✅ **PCI DSS & MFA Coverage** — card data and MFA secrets redacted out of the box, with common HTTP auth headers
 - ✅ **LGPD-Aware Paths** — CPF, CNPJ, and RG redacted by default for Brazilian workloads
 - ✅ **Append-Only Redact List** — `DEFAULT_REDACT_PATHS` never shrinks without a major version; extend it via `redactPaths`
@@ -374,7 +374,7 @@ Full options reference for `BymaxLoggerModule.forRoot(options)`:
 | `level`                      | `LogLevel`          | `'info'`        | Minimum log level. One of `fatal \| error \| warn \| info \| debug \| trace`                                             |
 | `isPretty`                   | `boolean`           | `!isProduction` | ⚠️ Reserved — not auto-wired. For pretty output add `new PrettyDevDestination()` to `destinations` (needs `pino-pretty`) |
 | `redactPaths`                | `string[]`          | `[]`            | Additional `fast-redact` paths merged with the defaults                                                                  |
-| `shouldDisableDefaultRedact` | `boolean`           | `false`         | Skip the 113 default PII paths. ⚠️ Emits a bootstrap warning — document why                                              |
+| `shouldDisableDefaultRedact` | `boolean`           | `false`         | Skip the 140 default PII paths. ⚠️ Emits a bootstrap warning — document why                                              |
 | `redactCensor`               | `string`            | `'[REDACTED]'`  | Replacement value written in place of every redacted field                                                               |
 | `maxEntrySizeBytes`          | `number`            | `65536`         | UTF-8 byte ceiling per serialized field (`err` + any custom serializer); over it the value becomes a truncation envelope |
 | `destinations`               | `ILogDestination[]` | `[]`            | Additional sinks (Loki, Postgres, rolling file, …) alongside default stdout                                              |
@@ -605,7 +605,7 @@ Application Service
               └── OTel span      → { traceId, spanId, traceFlags }
               │
               ▼
-         fast-redact             ← compiled redact function (113 paths)
+         fast-redact             ← compiled redact function (140 paths)
               │
               ▼
     ┌─────────────────────────────┐
@@ -622,7 +622,7 @@ Application Service
 | ----------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | **🪶 Singleton Scope**        | `AsyncLocalStorage` delivers per-request context at zero latency overhead — NestJS `Scope.REQUEST` adds ~5% on the injection graph, unacceptable on a logger that runs for every request         |
 | **🧬 One Composed Mixin**     | ALS context and OTel trace context merge into a single Pino mixin with a deterministic order: ALS first, then OTel — an active span is the authoritative trace identity, so it wins on conflicts |
-| **⚡ Compiled Redaction**     | 113 `fast-redact` paths compile once at module bootstrap into a specialized function; no per-log regex matching, under 3% throughput impact                                                      |
+| **⚡ Compiled Redaction**     | 140 `fast-redact` paths compile once at module bootstrap into a specialized function; no per-log regex matching, under 3% throughput impact                                                      |
 | **🔌 Interface-Driven Sinks** | `ILogDestination` is a contract — Loki, Postgres, rolling files, or anything else is a consumer implementation, never a dependency of this package                                               |
 | **🌳 Zero Runtime Deps**      | `"dependencies": {}` — every package arrives as a peer dependency, so consumers pin exact versions and the supply-chain surface stays theirs                                                     |
 
@@ -634,7 +634,7 @@ A logger sees every payload the application handles, so the security posture is
 
 ### Redaction by default
 
-The library ships **113 redact paths** compiled at initialization into a single `fast-redact` function (< 3% throughput impact). These cover:
+The library ships **140 redact paths** compiled at initialization into a single `fast-redact` function (< 3% throughput impact). These cover:
 
 | Category                  | Fields                                                                                                                                    |
 | ------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------- |
@@ -709,7 +709,7 @@ When integrating `@bymax-one/nest-logger` in production, verify each of the foll
 
 | Layer               | Implementation                                                                                                     |
 | ------------------- | ------------------------------------------------------------------------------------------------------------------ |
-| PII Redaction       | 113 `fast-redact` paths compiled once at bootstrap — no per-log regex matching                                     |
+| PII Redaction       | 140 `fast-redact` paths compiled once at bootstrap — no per-log regex matching                                     |
 | Credentials         | `password`, `passwordHash`, `token`, `accessToken`, `refreshToken`, `apiKey`, `apiSecret`, `privateKey`            |
 | MFA Secrets         | `mfaSecret`, `mfaRecoveryCodes`, `totpSecret` — redacted at wildcard depths 1–4                                    |
 | PCI DSS             | `cardNumber`, `cardCvv`, `cvv`, `cvc`, `cardExpiry`                                                                |
@@ -745,12 +745,12 @@ When integrating `@bymax-one/nest-logger` in production, verify each of the foll
 A logger runs on every request of every service that installs it, so the suite is held to a bar beyond "it runs" — every behavior is pinned so that a regression **fails a test**.
 
 - ✅ **100% line coverage** — statements, branches, functions, and lines, enforced as a release gate across unit + e2e
-- ✅ **97.42% mutation score** — verified with [Stryker](https://stryker-mutator.io/) against a
-  `break` threshold of 95. The ten survivors are documented equivalents rather than coverage gaps,
-  and they stay uncounted-against rather than silenced: this package's plan forbids inline
-  `// Stryker disable` comments because they ship in the unminified bundle (see the
-  [report](./docs/mutation_testing_results.md))
-- ✅ **Every survivor documented** — the 10 remaining mutants are equivalents, each recorded in [docs/mutation_testing_results.md](./docs/mutation_testing_results.md) rather than silenced with an inline comment, so the score is an accounting rather than a number
+- ✅ **100% mutation score** — verified with [Stryker](https://stryker-mutator.io/) against a
+  `break` threshold of 95. The ten mutants no test can kill each carry their reason on the line
+  they apply to; a rule against those comments was retired once their cost was measured at
+  **+0.10 kB brotli** against 0.66 kB of headroom, roughly a tenth of what it had been assumed
+  to be (see the [report](./docs/mutation_testing_results.md))
+- ✅ **Every suppression carries its reason** — each `// Stryker disable` names, after the `:` Stryker reads it from, why the mutant it silences cannot be observed; one of them is recorded as what it is, a mutant the suite kills but Stryker fails to attribute, rather than mislabelled an equivalent. `check:mutants` proves those reasons parse, so they reach the report rather than the `Ignored using a comment` fallback, and the score stays an accounting rather than a number
 - ✅ **No real I/O in unit tests** — the Pino instance and every destination are mocked; e2e tests exercise the wired module through `@nestjs/testing` and supertest
 
 ```bash

package/dist/server/index.cjs

@@ -520,7 +520,7 @@ exports.HttpExceptionFilter = class HttpExceptionFilter {
     const ctx = host.switchToHttp();
     const res = ctx.getResponse();
     const req = ctx.getRequest();
-    const userId = req.user?.id;
+    const userId = req.user?.sub ?? req.user?.id;
     const url = stripQueryString(req.url);
     if (exception instanceof common.HttpException) {
       const status2 = exception.getStatus();
@@ -605,7 +605,7 @@ exports.HttpLoggingInterceptor = class HttpLoggingInterceptor {
     }
     const rawUserAgent = req.headers["user-agent"];
     const userAgent = typeof rawUserAgent === "string" ? rawUserAgent : UNKNOWN_USER_AGENT;
-    const userId = req.user?.id;
+    const userId = req.user?.sub ?? req.user?.id;
     const normalizedUrl = normalizeUrl(url);
     const start = Date.now();
     this.logger.info(RESERVED_LOG_KEYS.HTTP_REQUEST_START, `${method} ${normalizedUrl}`, userId, {
@@ -820,6 +820,7 @@ var REDACT_ABSOLUTE_PATHS = [
   'res.headers["set-cookie"]'
 ];
 var DEFAULT_REDACT_PATHS = [
+  ...REDACT_COMMON_FIELDS,
   ...REDACT_COMMON_FIELDS.flatMap((field) => depth(field)),
   ...REDACT_ABSOLUTE_PATHS
 ];
@@ -849,6 +850,7 @@ function destinationToStream(destination) {
     // Keep string chunks as strings (Node's default re-encodes them to Buffers
     // before `_write`): the common Pino path emits NDJSON strings, so this skips
     // a string→Buffer→string round-trip on the hot logging path.
+    // Stryker disable next-line BooleanLiteral: equivalent for every chunk this stream receives — with `true`, Node encodes the string to a Buffer and `write()` below decodes it back with `toString('utf-8')`. Pino writes UTF-8 NDJSON strings at the default encoding, so the round-trip returns the identical string. It is NOT equivalent in general: a `write(chunk, 'latin1')` would round-trip through UTF-8 and change non-ASCII bytes, which is unreachable here because nothing writes to this stream but Pino. The flag stays because it skips the round-trip on the hot logging path.
     decodeStrings: false,
     write(chunk, _encoding, callback) {
       const onFailure = (cause) => {
@@ -1343,8 +1345,9 @@ var PrettyDevDestination = class {
 };
 var REQUEST_ID_HEADER = "x-request-id";
 var MAX_CORRELATION_ID_LENGTH = 256;
+var CORRELATION_ID_CHARSET = /^[A-Za-z0-9._:/+=-]+$/;
 function isAcceptableHeaderValue(value) {
-  return typeof value === "string" && value.length <= MAX_CORRELATION_ID_LENGTH;
+  return typeof value === "string" && value.length <= MAX_CORRELATION_ID_LENGTH && CORRELATION_ID_CHARSET.test(value);
 }
 exports.RequestIdMiddleware = class RequestIdMiddleware {
   /**

package/dist/server/index.d.cts

@@ -778,7 +778,11 @@ type IncomingHeaders = Record<string, string | string[] | undefined>;
  * The inbound request members the logging layer reads.
  *
  * `user` is populated by upstream auth in the consumer app (a guard or
- * middleware); only `id` is ever read, for the acting-user log field.
+ * middleware). The acting-user id is read as `sub` first, then `id`: a JWT principal
+ * (every `@bymax-one/nest-auth` token) names it `sub`, while an ORM-style principal
+ * names it `id`. The JWT subject wins when both are present, since it is the
+ * authenticated identity. Reading only `id` — as this once did — silently dropped
+ * the user field for every JWT-authenticated request.
  */
 interface LoggableRequest {
     /** Inbound headers — read for correlation ids and the user agent. */
@@ -789,9 +793,14 @@ interface LoggableRequest {
     readonly url: string;
     /** Client address when the adapter resolves one. */
     readonly ip?: string | undefined;
-    /** Authenticated principal, when upstream auth attached one. */
+    /**
+     * Authenticated principal, when upstream auth attached one. `id` is the
+     * ORM-style identifier; `sub` is the JWT subject claim. The logging layer reads
+     * whichever is present.
+     */
     readonly user?: {
         readonly id?: string | undefined;
+        readonly sub?: string | undefined;
     } | undefined;
 }
 /**
@@ -920,7 +929,16 @@ declare const LOG_CONTEXT_TOKEN: unique symbol;
 
 /**
  * Canonical list of redact paths merged into Pino's `redact.paths` option by
- * default. Expected length: 27 common fields × 4 depths + 5 absolute = **113**.
+ * default. Expected length: 27 root fields + 27 common fields × 4 depths + 5
+ * absolute = **140**.
+ *
+ * The bare field names come first, at depth 0 — the log record's own root.
+ * `emitStructured` spreads caller metadata there (`{ ...metadata, logKey, ... }`),
+ * so a field named `password` passed as metadata lands at the root, which the
+ * depth-1-and-deeper wildcards below never reach (`fast-redact`'s `*` matches a
+ * level, not the root). Without the bare name the library's own documented call
+ * `logger.info(key, msg, userId, { password })` would write the password in clear.
+ * Listing it makes the default set cover a sensitive field wherever it appears.
  */
 declare const DEFAULT_REDACT_PATHS: readonly string[];
 

package/dist/server/index.d.ts

@@ -778,7 +778,11 @@ type IncomingHeaders = Record<string, string | string[] | undefined>;
  * The inbound request members the logging layer reads.
  *
  * `user` is populated by upstream auth in the consumer app (a guard or
- * middleware); only `id` is ever read, for the acting-user log field.
+ * middleware). The acting-user id is read as `sub` first, then `id`: a JWT principal
+ * (every `@bymax-one/nest-auth` token) names it `sub`, while an ORM-style principal
+ * names it `id`. The JWT subject wins when both are present, since it is the
+ * authenticated identity. Reading only `id` — as this once did — silently dropped
+ * the user field for every JWT-authenticated request.
  */
 interface LoggableRequest {
     /** Inbound headers — read for correlation ids and the user agent. */
@@ -789,9 +793,14 @@ interface LoggableRequest {
     readonly url: string;
     /** Client address when the adapter resolves one. */
     readonly ip?: string | undefined;
-    /** Authenticated principal, when upstream auth attached one. */
+    /**
+     * Authenticated principal, when upstream auth attached one. `id` is the
+     * ORM-style identifier; `sub` is the JWT subject claim. The logging layer reads
+     * whichever is present.
+     */
     readonly user?: {
         readonly id?: string | undefined;
+        readonly sub?: string | undefined;
     } | undefined;
 }
 /**
@@ -920,7 +929,16 @@ declare const LOG_CONTEXT_TOKEN: unique symbol;
 
 /**
  * Canonical list of redact paths merged into Pino's `redact.paths` option by
- * default. Expected length: 27 common fields × 4 depths + 5 absolute = **113**.
+ * default. Expected length: 27 root fields + 27 common fields × 4 depths + 5
+ * absolute = **140**.
+ *
+ * The bare field names come first, at depth 0 — the log record's own root.
+ * `emitStructured` spreads caller metadata there (`{ ...metadata, logKey, ... }`),
+ * so a field named `password` passed as metadata lands at the root, which the
+ * depth-1-and-deeper wildcards below never reach (`fast-redact`'s `*` matches a
+ * level, not the root). Without the bare name the library's own documented call
+ * `logger.info(key, msg, userId, { password })` would write the password in clear.
+ * Listing it makes the default set cover a sensitive field wherever it appears.
  */
 declare const DEFAULT_REDACT_PATHS: readonly string[];
 

package/dist/server/index.mjs

@@ -514,7 +514,7 @@ var HttpExceptionFilter = class {
     const ctx = host.switchToHttp();
     const res = ctx.getResponse();
     const req = ctx.getRequest();
-    const userId = req.user?.id;
+    const userId = req.user?.sub ?? req.user?.id;
     const url = stripQueryString(req.url);
     if (exception instanceof HttpException) {
       const status2 = exception.getStatus();
@@ -599,7 +599,7 @@ var HttpLoggingInterceptor = class {
     }
     const rawUserAgent = req.headers["user-agent"];
     const userAgent = typeof rawUserAgent === "string" ? rawUserAgent : UNKNOWN_USER_AGENT;
-    const userId = req.user?.id;
+    const userId = req.user?.sub ?? req.user?.id;
     const normalizedUrl = normalizeUrl(url);
     const start = Date.now();
     this.logger.info(RESERVED_LOG_KEYS.HTTP_REQUEST_START, `${method} ${normalizedUrl}`, userId, {
@@ -814,6 +814,7 @@ var REDACT_ABSOLUTE_PATHS = [
   'res.headers["set-cookie"]'
 ];
 var DEFAULT_REDACT_PATHS = [
+  ...REDACT_COMMON_FIELDS,
   ...REDACT_COMMON_FIELDS.flatMap((field) => depth(field)),
   ...REDACT_ABSOLUTE_PATHS
 ];
@@ -843,6 +844,7 @@ function destinationToStream(destination) {
     // Keep string chunks as strings (Node's default re-encodes them to Buffers
     // before `_write`): the common Pino path emits NDJSON strings, so this skips
     // a string→Buffer→string round-trip on the hot logging path.
+    // Stryker disable next-line BooleanLiteral: equivalent for every chunk this stream receives — with `true`, Node encodes the string to a Buffer and `write()` below decodes it back with `toString('utf-8')`. Pino writes UTF-8 NDJSON strings at the default encoding, so the round-trip returns the identical string. It is NOT equivalent in general: a `write(chunk, 'latin1')` would round-trip through UTF-8 and change non-ASCII bytes, which is unreachable here because nothing writes to this stream but Pino. The flag stays because it skips the round-trip on the hot logging path.
     decodeStrings: false,
     write(chunk, _encoding, callback) {
       const onFailure = (cause) => {
@@ -1337,8 +1339,9 @@ var PrettyDevDestination = class {
 };
 var REQUEST_ID_HEADER = "x-request-id";
 var MAX_CORRELATION_ID_LENGTH = 256;
+var CORRELATION_ID_CHARSET = /^[A-Za-z0-9._:/+=-]+$/;
 function isAcceptableHeaderValue(value) {
-  return typeof value === "string" && value.length <= MAX_CORRELATION_ID_LENGTH;
+  return typeof value === "string" && value.length <= MAX_CORRELATION_ID_LENGTH && CORRELATION_ID_CHARSET.test(value);
 }
 var RequestIdMiddleware = class {
   /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-logger",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "description": "Structured JSON logging for NestJS based on Pino 10, with optional OpenTelemetry correlation.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",
@@ -57,15 +57,16 @@
     "bench": "node --expose-gc --import tsx bench/throughput.bench.ts",
     "build": "pnpm clean && tsup",
     "check:exports": "attw --pack .",
+    "check:mutants": "node scripts/check-mutation-directives.mjs",
     "check:published": "node scripts/check-published-surface.mjs",
     "clean": "rm -rf dist coverage",
     "lint": "eslint src",
     "lint:fix": "eslint src --fix",
     "mutation": "stryker run",
+    "mutation:full": "node -e \"require('node:fs').rmSync('reports/stryker-incremental.json',{force:true,recursive:true})\" && stryker run",
     "mutation:dry-run": "stryker run --dryRunOnly",
-    "mutation:incremental": "stryker run --incremental",
     "prepare": "husky",
-    "prepublishOnly": "pnpm clean && pnpm typecheck && pnpm lint && pnpm test:cov:all && pnpm build && pnpm check:published",
+    "prepublishOnly": "pnpm clean && pnpm typecheck && pnpm lint && pnpm check:mutants && pnpm test:cov:all && pnpm build && pnpm check:published",
     "release": "npm publish --provenance --access public",
     "size": "node scripts/check-size.mjs",
     "test": "jest",