@bymax-one/nest-logger 1.1.0 → 1.2.0

package/dist/server/index.mjs

@@ -5,7 +5,7 @@ import pino from 'pino';
 import { createRequire } from 'module';
 import { join } from 'path';
 import { Writable } from 'stream';
-import { AsyncLocalStorage } from 'async_hooks';
+import { AsyncLocalStorage, AsyncResource } from 'async_hooks';
 import { randomUUID } from 'crypto';
 
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -58,6 +58,7 @@ function applyDefaults(options) {
     isGlobal: options.isGlobal ?? true,
     shouldUseAsNestLogger: options.shouldUseAsNestLogger ?? true,
     redactPaths: Object.freeze([...options.redactPaths ?? []]),
+    redactStrategy: options.redactStrategy ?? "names",
     redactCensor: options.redactCensor ?? "[REDACTED]",
     shouldDisableDefaultRedact: options.shouldDisableDefaultRedact ?? false,
     destinations: Object.freeze([...options.destinations ?? []]),
@@ -83,7 +84,7 @@ var PINO_LEVEL_NUMBERS = Object.freeze({
   debug: 20,
   trace: 10
 });
-Object.freeze(
+var PINO_LEVEL_NAMES = Object.freeze(
   Object.fromEntries(
     Object.entries(PINO_LEVEL_NUMBERS).map(([name, num]) => [num, name])
     // keys of PINO_LEVEL_NUMBERS are always LogLevel
@@ -120,16 +121,105 @@ function validateOptions(options) {
   if (options.maxEntrySizeBytes !== void 0 && options.maxEntrySizeBytes <= 0) {
     throw new Error("[BymaxLoggerModule] options.maxEntrySizeBytes must be > 0");
   }
+  if (options.redactStrategy !== void 0 && options.redactStrategy !== "names" && options.redactStrategy !== "paths") {
+    throw new Error(
+      `[BymaxLoggerModule] options.redactStrategy must be 'names' or 'paths'. Got: ${String(
+        options.redactStrategy
+      )}`
+    );
+  }
 }
 
 // src/server/constants/injection-tokens.constants.ts
 var LOGGER_OPTIONS_TOKEN = /* @__PURE__ */ Symbol("BYMAX_LOGGER_OPTIONS");
 var LOGGER_PINO_INSTANCE_TOKEN = /* @__PURE__ */ Symbol("BYMAX_LOGGER_PINO_INSTANCE");
 var LOGGER_DESTINATIONS_TOKEN = /* @__PURE__ */ Symbol("BYMAX_LOGGER_DESTINATIONS");
+var LOGGER_REDACTOR_TOKEN = /* @__PURE__ */ Symbol("BYMAX_LOGGER_REDACTOR");
 var LOG_CONTEXT_TOKEN = /* @__PURE__ */ Symbol("BYMAX_LOGGER_LOG_CONTEXT");
+
+// src/shared/constants/reserved-log-keys.constants.ts
+var RESERVED_LOG_KEYS = Object.freeze({
+  LOGGER_BOOTSTRAP_OK: "LOGGER_BOOTSTRAP_OK",
+  LOGGER_BOOTSTRAP_WARNING: "LOGGER_BOOTSTRAP_WARNING",
+  LOGGER_SHUTDOWN_OK: "LOGGER_SHUTDOWN_OK",
+  HTTP_REQUEST_START: "HTTP_REQUEST_START",
+  HTTP_REQUEST_SUCCESS: "HTTP_REQUEST_SUCCESS",
+  HTTP_REQUEST_REDIRECT: "HTTP_REQUEST_REDIRECT",
+  HTTP_REQUEST_CLIENT_ERROR: "HTTP_REQUEST_CLIENT_ERROR",
+  HTTP_REQUEST_SERVER_ERROR: "HTTP_REQUEST_SERVER_ERROR",
+  HTTP_REQUEST_COMPLETED: "HTTP_REQUEST_COMPLETED",
+  HTTP_REQUEST_ABORTED: "HTTP_REQUEST_ABORTED",
+  HTTP_EXCEPTION_HANDLED: "HTTP_EXCEPTION_HANDLED",
+  HTTP_EXCEPTION_UNHANDLED: "HTTP_EXCEPTION_UNHANDLED",
+  METHOD_EXECUTION: "METHOD_EXECUTION",
+  METHOD_SLOW_EXECUTION: "METHOD_SLOW_EXECUTION",
+  LOGGER_DESTINATION_INIT_FAILED: "LOGGER_DESTINATION_INIT_FAILED",
+  LOGGER_DESTINATION_WRITE_FAILED: "LOGGER_DESTINATION_WRITE_FAILED",
+  LOGGER_ENTRY_TRUNCATED: "LOGGER_ENTRY_TRUNCATED",
+  LOGGER_REDACTION_FAILED: "LOGGER_REDACTION_FAILED"
+});
+var RESERVED_LOG_KEYS_NOT_EMITTED = Object.freeze({
+  /**
+   * Superseded before it was ever used. The request lifecycle terminates in one
+   * of `HTTP_REQUEST_SUCCESS` / `_REDIRECT` / `_CLIENT_ERROR` / `_SERVER_ERROR`,
+   * each carrying the same `duration` a generic "completed" entry would. Emitting
+   * it as well would double the terminal access-log volume to say nothing new.
+   * It stays claimed so an application cannot repurpose a name that reads like a
+   * library event.
+   */
+  HTTP_REQUEST_COMPLETED: "reserved: superseded by the four status-specific terminal keys"
+});
+
+// src/server/constants/prototype-polluting-keys.constants.ts
+var PROTOTYPE_POLLUTING_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype"
+]);
+
+// src/server/services/pino-logger.service.ts
+var OWNED_PAYLOAD_KEYS = ["logKey", "userId", "context"];
+function withoutOwnedKeys(metadata) {
+  if (metadata === void 0) {
+    return {};
+  }
+  try {
+    const safe = {};
+    for (const key of Object.keys(metadata)) {
+      if (!OWNED_PAYLOAD_KEYS.includes(key) && !PROTOTYPE_POLLUTING_KEYS.has(key)) {
+        Reflect.set(safe, key, Reflect.get(metadata, key));
+      }
+    }
+    return safe;
+  } catch {
+    return {
+      _redactionFailed: true,
+      _logKey: RESERVED_LOG_KEYS.LOGGER_REDACTION_FAILED
+    };
+  }
+}
+function safeErrorMessage(error) {
+  try {
+    return String(error.message);
+  } catch {
+    return "Unreadable error message";
+  }
+}
+function assignIfDefined(payload, key, value) {
+  if (value !== void 0) {
+    Reflect.defineProperty(payload, key, { value, enumerable: true });
+  }
+}
 var PinoLoggerService = class {
-  constructor(pino2) {
+  /**
+   * @param pino - The wrapped Pino instance.
+   * @param redact - The DEFAULT-coverage redactor, applied to `child()` bindings.
+   *   Defaults to the identity so a hand-built instance (benchmarks, unit tests)
+   *   still works; the module always injects the configured one.
+   */
+  constructor(pino2, redact = (value) => value) {
     this.pino = pino2;
+    this.redact = redact;
   }
   // ─── NestJS LoggerService variadic interface ──────────────────────────────
   /**
@@ -152,18 +242,16 @@ var PinoLoggerService = class {
    */
   error(message, ...optionalParams) {
     if (message instanceof Error) {
-      this.pino.error(
-        { context: this.resolveContext(optionalParams), err: this.serializeError(message) },
-        message.message
-      );
+      const payload2 = { err: this.serializeError(message) };
+      assignIfDefined(payload2, "context", this.resolveContext(optionalParams));
+      this.pino.error(payload2, safeErrorMessage(message));
       return;
     }
     const stack = typeof optionalParams[0] === "string" ? optionalParams[0] : void 0;
     const context = typeof optionalParams[1] === "string" ? optionalParams[1] : this.context;
-    const payload = { context };
-    if (stack !== void 0) {
-      payload["stack"] = stack;
-    }
+    const payload = {};
+    assignIfDefined(payload, "context", context);
+    assignIfDefined(payload, "stack", stack);
     this.pino.error(payload, typeof message === "string" ? message : String(message));
   }
   /**
@@ -238,10 +326,14 @@ var PinoLoggerService = class {
    * @param metadata - Optional extra structured fields.
    */
   errorStructured(logKey, error, userId, metadata) {
-    this.pino.error(
-      { ...metadata, logKey, userId, context: this.context, err: this.serializeError(error) },
-      error.message
-    );
+    const payload = {
+      ...withoutOwnedKeys(metadata),
+      logKey,
+      err: this.serializeError(error)
+    };
+    assignIfDefined(payload, "userId", userId);
+    assignIfDefined(payload, "context", this.context);
+    this.pino.error(payload, safeErrorMessage(error));
   }
   // ─── Helpers / escape hatches ─────────────────────────────────────────────
   /**
@@ -274,7 +366,8 @@ var PinoLoggerService = class {
    * @returns A new `PinoLoggerService` wrapping the Pino child.
    */
   child(bindings) {
-    const childService = new PinoLoggerService(this.pino.child(bindings));
+    const safeBindings = this.redact(bindings, true);
+    const childService = new PinoLoggerService(this.pino.child(safeBindings), this.redact);
     if (this.context !== void 0) {
       childService.setContext(this.context);
     }
@@ -299,7 +392,11 @@ var PinoLoggerService = class {
    * dashboards for every exception logged through `HttpExceptionFilter`.
    */
   serializeError(error) {
-    return { type: error.name, message: error.message, stack: error.stack };
+    try {
+      return { type: error.name, message: error.message, stack: error.stack };
+    } catch {
+      return { type: "SanitizeFailed", message: "Failed to read the thrown value" };
+    }
   }
   /** Resolve the context: last string param wins, else the instance context. */
   resolveContext(optionalParams) {
@@ -308,12 +405,9 @@ var PinoLoggerService = class {
   }
   /** Emit a structured payload at info or warn level. */
   emitStructured(level, logKey, message, userId, metadata) {
-    const payload = {
-      ...metadata,
-      logKey,
-      userId,
-      context: this.context
-    };
+    const payload = { ...withoutOwnedKeys(metadata), logKey };
+    assignIfDefined(payload, "userId", userId);
+    assignIfDefined(payload, "context", this.context);
     if (level === "info") {
       this.pino.info(payload, message);
     } else {
@@ -322,7 +416,8 @@ var PinoLoggerService = class {
   }
   /** Emit a NestJS-style variadic log, dispatching by level without computed indexing. */
   emitNestStyle(level, message, optionalParams) {
-    const payload = { context: this.resolveContext(optionalParams) };
+    const payload = {};
+    assignIfDefined(payload, "context", this.resolveContext(optionalParams));
     const msg = typeof message === "string" ? message : String(message);
     switch (level) {
       case "info":
@@ -345,7 +440,8 @@ var PinoLoggerService = class {
 };
 PinoLoggerService = __decorateClass([
   Injectable(),
-  __decorateParam(0, Inject(LOGGER_PINO_INSTANCE_TOKEN))
+  __decorateParam(0, Inject(LOGGER_PINO_INSTANCE_TOKEN)),
+  __decorateParam(1, Inject(LOGGER_REDACTOR_TOKEN))
 ], PinoLoggerService);
 
 // src/server/decorators/inject-logger.provider.ts
@@ -395,26 +491,6 @@ DefaultStdoutDestination = __decorateClass([
   Injectable()
 ], DefaultStdoutDestination);
 
-// src/shared/constants/reserved-log-keys.constants.ts
-var RESERVED_LOG_KEYS = Object.freeze({
-  LOGGER_BOOTSTRAP_OK: "LOGGER_BOOTSTRAP_OK",
-  LOGGER_BOOTSTRAP_WARNING: "LOGGER_BOOTSTRAP_WARNING",
-  LOGGER_SHUTDOWN_OK: "LOGGER_SHUTDOWN_OK",
-  HTTP_REQUEST_START: "HTTP_REQUEST_START",
-  HTTP_REQUEST_SUCCESS: "HTTP_REQUEST_SUCCESS",
-  HTTP_REQUEST_REDIRECT: "HTTP_REQUEST_REDIRECT",
-  HTTP_REQUEST_CLIENT_ERROR: "HTTP_REQUEST_CLIENT_ERROR",
-  HTTP_REQUEST_SERVER_ERROR: "HTTP_REQUEST_SERVER_ERROR",
-  HTTP_REQUEST_COMPLETED: "HTTP_REQUEST_COMPLETED",
-  HTTP_EXCEPTION_HANDLED: "HTTP_EXCEPTION_HANDLED",
-  HTTP_EXCEPTION_UNHANDLED: "HTTP_EXCEPTION_UNHANDLED",
-  METHOD_EXECUTION: "METHOD_EXECUTION",
-  METHOD_SLOW_EXECUTION: "METHOD_SLOW_EXECUTION",
-  LOGGER_DESTINATION_INIT_FAILED: "LOGGER_DESTINATION_INIT_FAILED",
-  LOGGER_DESTINATION_WRITE_FAILED: "LOGGER_DESTINATION_WRITE_FAILED",
-  LOGGER_ENTRY_TRUNCATED: "LOGGER_ENTRY_TRUNCATED"
-});
-
 // src/server/utils/normalize-url.util.ts
 var UUID_REGEX = /\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}(?![0-9a-f])/gi;
 var ULID_REGEX = /\/[0-9A-HJKMNP-TV-Z]{26}(?![0-9A-HJKMNP-TV-Z])/g;
@@ -555,11 +631,39 @@ HttpExceptionFilter = __decorateClass([
   Catch(),
   __decorateParam(0, Inject(PinoLoggerService))
 ], HttpExceptionFilter);
-var HTTP_SUCCESS_MIN = 200;
+
+// src/server/utils/http-log-state.util.ts
 var HTTP_REDIRECT_MIN = 300;
 var HTTP_CLIENT_ERROR_MIN = 400;
 var HTTP_SERVER_ERROR_MIN = 500;
 var UNKNOWN_USER_AGENT = "unknown";
+var RECORDER_ACTIVE = /* @__PURE__ */ Symbol("bymax-one/nest-logger:recorder");
+var RECORDED_ERROR = /* @__PURE__ */ Symbol("bymax-one/nest-logger:error");
+function markRecorderActive(req) {
+  Reflect.set(req, RECORDER_ACTIVE, true);
+}
+function isRecorderActive(req) {
+  return Reflect.get(req, RECORDER_ACTIVE) === true;
+}
+function recordError(req, error) {
+  Reflect.set(req, RECORDED_ERROR, { error });
+}
+function readRecordedError(req) {
+  return Reflect.get(req, RECORDED_ERROR);
+}
+function toError(thrown) {
+  return thrown instanceof Error ? thrown : new Error(String(thrown));
+}
+function readUserId(req) {
+  return req.user?.sub ?? req.user?.id;
+}
+function readUserAgent(req) {
+  const raw = req.headers["user-agent"];
+  return typeof raw === "string" ? raw : UNKNOWN_USER_AGENT;
+}
+
+// src/server/interceptors/http-logging.interceptor.ts
+var HTTP_SUCCESS_MIN = 200;
 var HttpLoggingInterceptor = class {
   /**
    * @param logger - The structured logger the lifecycle entries are written to.
@@ -593,13 +697,15 @@ var HttpLoggingInterceptor = class {
     const http = context.switchToHttp();
     const req = http.getRequest();
     const res = http.getResponse();
+    if (isRecorderActive(req)) {
+      return this.recordOnly(req, next);
+    }
     const { method, url, ip } = req;
     if (this.isExcluded(stripQueryString(url))) {
       return next.handle();
     }
-    const rawUserAgent = req.headers["user-agent"];
-    const userAgent = typeof rawUserAgent === "string" ? rawUserAgent : UNKNOWN_USER_AGENT;
-    const userId = req.user?.sub ?? req.user?.id;
+    const userAgent = readUserAgent(req);
+    const userId = readUserId(req);
     const normalizedUrl = normalizeUrl(url);
     const start = Date.now();
     this.logger.info(RESERVED_LOG_KEYS.HTTP_REQUEST_START, `${method} ${normalizedUrl}`, userId, {
@@ -622,6 +728,28 @@ var HttpLoggingInterceptor = class {
       })
     );
   }
+  /**
+   * Hand the lifecycle to the access-log middleware, recording only the thrown
+   * error for its terminal entry.
+   *
+   * The interceptor cannot be the recorder: it never runs for a request a guard
+   * rejected or one that matched no route. It also cannot judge DELIVERY — at the
+   * moment it completes, the response has not been flushed yet, which is why an
+   * aborted request used to be logged as the 200 the handler intended. What it
+   * uniquely has is the thrown value, so that is all it contributes.
+   *
+   * @param req - The request whose lifecycle the middleware owns.
+   * @param next - The downstream call handler.
+   * @returns The response stream, unmodified and with exceptions re-thrown.
+   */
+  recordOnly(req, next) {
+    return next.handle().pipe(
+      catchError((err) => {
+        recordError(req, toError(err));
+        return throwError(() => err);
+      })
+    );
+  }
   /**
    * Log a non-throwing completion: SUCCESS for 2xx, REDIRECT for 3xx, nothing
    * for any other status (those are surfaced via the error path instead).
@@ -680,12 +808,12 @@ var HttpLoggingInterceptor = class {
       }
       return;
     }
-    this.logger.errorStructured(
-      RESERVED_LOG_KEYS.HTTP_REQUEST_SERVER_ERROR,
-      err instanceof Error ? err : new Error(String(err)),
-      userId,
-      { method, url, statusCode: HttpStatus.INTERNAL_SERVER_ERROR, duration }
-    );
+    this.logger.errorStructured(RESERVED_LOG_KEYS.HTTP_REQUEST_SERVER_ERROR, toError(err), userId, {
+      method,
+      url,
+      statusCode: HttpStatus.INTERNAL_SERVER_ERROR,
+      duration
+    });
   }
 };
 HttpLoggingInterceptor = __decorateClass([
@@ -720,48 +848,6 @@ var {
   // disabled" without a dead nullish branch.
   global: extras.isGlobal !== false
 })).build();
-function detectOtelTraceApi() {
-  try {
-    const requireFromCwd = createRequire(join(process.cwd(), "noop.cjs"));
-    const mod = requireFromCwd("@opentelemetry/api");
-    return mod.trace;
-  } catch {
-    return void 0;
-  }
-}
-function isValidTraceId(traceId) {
-  return /^[0-9a-f]{32}$/.test(traceId) && !/^0+$/.test(traceId);
-}
-function isValidSpanId(spanId) {
-  return /^[0-9a-f]{16}$/.test(spanId) && !/^0+$/.test(spanId);
-}
-
-// src/server/mixins/trace-context.mixin.ts
-function createTraceContextMixin(logContext, opts) {
-  const traceApi = opts.shouldAutoInjectTraceContext ? detectOtelTraceApi() : void 0;
-  return function mixin(_mergeObject, _level, _logger) {
-    const merged = {};
-    const store = logContext.getStore();
-    if (store) {
-      Object.assign(merged, store);
-    }
-    if (traceApi) {
-      const span = traceApi.getActiveSpan();
-      if (span) {
-        const ctx = span.spanContext();
-        if (isValidTraceId(ctx.traceId) && isValidSpanId(ctx.spanId)) {
-          Reflect.set(merged, opts.traceIdField, ctx.traceId);
-          Reflect.set(merged, opts.spanIdField, ctx.spanId);
-          if (typeof ctx.traceFlags === "number") {
-            const flagsByte = ctx.traceFlags & 255;
-            Reflect.set(merged, opts.traceFlagsField, flagsByte.toString(16).padStart(2, "0"));
-          }
-        }
-      }
-    }
-    return merged;
-  };
-}
 
 // src/server/constants/default-redact-paths.constants.ts
 var REDACT_MAX_DEPTH = 4;
@@ -804,7 +890,20 @@ var REDACT_COMMON_FIELDS = [
   "signingSecret",
   "privateKey",
   // Conservative PII (1) — consumer can disable if logging email is justified
-  "email"
+  "email",
+  // Credential-bearing HTTP header names (5). These also appear in
+  // {@link REDACT_ABSOLUTE_PATHS}, pinned to the `req.headers` / `res.headers`
+  // shapes — which covered ONLY those two shapes. A headers bag logged under any
+  // other key (`logger.info(k, m, u, { headers: req.headers })`, one of the most
+  // common things written while debugging an integration) wrote the bearer token
+  // in clear. Listed here as bare names, they are caught wherever they appear.
+  // Node lower-cases inbound header names, so the lower-case spelling is the one
+  // that can actually reach a log.
+  "authorization",
+  "cookie",
+  "set-cookie",
+  "x-api-key",
+  "x-auth-token"
 ];
 var REDACT_ABSOLUTE_PATHS = [
   "req.headers.authorization",
@@ -818,6 +917,48 @@ var DEFAULT_REDACT_PATHS = [
   ...REDACT_COMMON_FIELDS.flatMap((field) => depth(field)),
   ...REDACT_ABSOLUTE_PATHS
 ];
+function detectOtelTraceApi() {
+  try {
+    const requireFromCwd = createRequire(join(process.cwd(), "noop.cjs"));
+    const mod = requireFromCwd("@opentelemetry/api");
+    return mod.trace;
+  } catch {
+    return void 0;
+  }
+}
+function isValidTraceId(traceId) {
+  return /^[0-9a-f]{32}$/.test(traceId) && !/^0+$/.test(traceId);
+}
+function isValidSpanId(spanId) {
+  return /^[0-9a-f]{16}$/.test(spanId) && !/^0+$/.test(spanId);
+}
+
+// src/server/mixins/trace-context.mixin.ts
+function createTraceContextMixin(logContext, opts) {
+  const traceApi = opts.shouldAutoInjectTraceContext ? detectOtelTraceApi() : void 0;
+  return function mixin(_mergeObject, _level, _logger) {
+    const merged = {};
+    const store = logContext.getStore();
+    if (store) {
+      Object.assign(merged, store);
+    }
+    if (traceApi) {
+      const span = traceApi.getActiveSpan();
+      if (span) {
+        const ctx = span.spanContext();
+        if (isValidTraceId(ctx.traceId) && isValidSpanId(ctx.spanId)) {
+          Reflect.set(merged, opts.traceIdField, ctx.traceId);
+          Reflect.set(merged, opts.spanIdField, ctx.spanId);
+          if (typeof ctx.traceFlags === "number") {
+            const flagsByte = ctx.traceFlags & 255;
+            Reflect.set(merged, opts.traceFlagsField, flagsByte.toString(16).padStart(2, "0"));
+          }
+        }
+      }
+    }
+    return merged;
+  };
+}
 
 // src/server/utils/compile-redact-paths.util.ts
 function compileRedactPaths(extraPaths, shouldSkipDefaults) {
@@ -866,6 +1007,120 @@ function destinationToStream(destination) {
   });
 }
 
+// src/server/utils/redact-by-name.util.ts
+var REDACT_MAX_TRAVERSAL_DEPTH = 100;
+var REDACT_DEPTH_EXCEEDED = "[REDACTION_DEPTH_EXCEEDED]";
+var REDACT_CIRCULAR = "[Circular]";
+function resolveToJson(value) {
+  let getter;
+  let candidate;
+  let current = value;
+  while (current !== null) {
+    const descriptor = Object.getOwnPropertyDescriptor(current, "toJSON");
+    if (descriptor !== void 0) {
+      getter = descriptor.get;
+      candidate = getter === void 0 ? descriptor.value : getter.call(value);
+      break;
+    }
+    current = Object.getPrototypeOf(current);
+  }
+  return {
+    method: typeof candidate === "function" ? candidate : void 0,
+    fromAccessor: getter !== void 0
+  };
+}
+function cloneError(error) {
+  const clone = Object.create(
+    Object.getPrototypeOf(error),
+    Object.getOwnPropertyDescriptors(error)
+  );
+  const { stack } = error;
+  if (typeof stack === "string") {
+    Reflect.defineProperty(clone, "stack", { value: stack, enumerable: false });
+  }
+  return clone;
+}
+var BUFFER_TO_JSON = Buffer.prototype.toJSON;
+var WRITE_FAILED = new Error();
+function defineOwn(target, key, value) {
+  if (!Reflect.defineProperty(target, key, { value, enumerable: true })) {
+    throw WRITE_FAILED;
+  }
+}
+function walkArray(value, sensitive, censor, depth2, ancestors) {
+  const length = value.length;
+  const copy = [];
+  for (let index = 0; index < length; index++) {
+    Reflect.set(
+      copy,
+      index,
+      walk(Reflect.get(value, index), sensitive, censor, depth2 + 1, ancestors)
+    );
+  }
+  return copy;
+}
+function walk(value, sensitive, censor, depth2, ancestors, honorToJson = true) {
+  if (value === null) {
+    return value;
+  }
+  if (typeof value !== "object" && typeof value !== "function") {
+    return value;
+  }
+  if (depth2 > REDACT_MAX_TRAVERSAL_DEPTH) {
+    return REDACT_DEPTH_EXCEEDED;
+  }
+  if (ancestors.has(value)) {
+    return REDACT_CIRCULAR;
+  }
+  const resolvedToJson = resolveToJson(value);
+  if (!resolvedToJson.fromAccessor && resolvedToJson.method === BUFFER_TO_JSON) {
+    return value;
+  }
+  ancestors.add(value);
+  try {
+    const toJson = honorToJson ? resolvedToJson.method : void 0;
+    if (toJson !== void 0) {
+      if (Object.keys(value).some((key) => sensitive.has(key.toLowerCase()))) {
+        return censor;
+      }
+      return walk(toJson.call(value), sensitive, censor, depth2 + 1, ancestors);
+    }
+    if (typeof value === "function") {
+      return value;
+    }
+    if (Array.isArray(value)) {
+      return walkArray(value, sensitive, censor, depth2, ancestors);
+    }
+    const source = value;
+    const keys = Object.keys(source);
+    const copy = value instanceof Error ? cloneError(value) : {};
+    for (const key of keys) {
+      const current = Reflect.get(source, key);
+      defineOwn(
+        copy,
+        key,
+        sensitive.has(key.toLowerCase()) ? censor : walk(current, sensitive, censor, depth2 + 1, ancestors)
+      );
+    }
+    return copy;
+  } finally {
+    ancestors.delete(value);
+  }
+}
+function createNameRedactor(fieldNames, censor) {
+  const sensitive = new Set(fieldNames.map((name) => name.toLowerCase()));
+  return (value, isRecordRoot = false) => {
+    try {
+      return walk(value, sensitive, censor, 0, /* @__PURE__ */ new Set(), !isRecordRoot);
+    } catch {
+      return {
+        _redactionFailed: true,
+        _logKey: RESERVED_LOG_KEYS.LOGGER_REDACTION_FAILED
+      };
+    }
+  };
+}
+
 // src/server/utils/truncate-large-entries.ts
 var PREVIEW_LENGTH = 200;
 function createSizeBoundedSerializer(baseSerializer, maxBytes) {
@@ -894,25 +1149,56 @@ function createSizeBoundedSerializer(baseSerializer, maxBytes) {
 }
 
 // src/server/pino-factory.ts
+var PATH_SEGMENT = /\[\s*['"]([^'"]+)['"]\s*\]|([^.[\]]+)/g;
+var INDEX_SEGMENT = /^\d+$/;
+function leafNameOf(path) {
+  let leaf;
+  for (const match of path.matchAll(PATH_SEGMENT)) {
+    const quoted = match[1];
+    const name = quoted ?? (match[2] !== void 0 && INDEX_SEGMENT.test(match[2]) ? void 0 : match[2]);
+    if (name !== void 0 && name !== "*") {
+      leaf = name;
+    }
+  }
+  return leaf;
+}
+var PASS_THROUGH = (value) => value;
+function resolveNameRedactor(options) {
+  if (options.redactStrategy !== "names") {
+    return PASS_THROUGH;
+  }
+  const names = [
+    ...options.shouldDisableDefaultRedact ? [] : REDACT_COMMON_FIELDS,
+    ...options.redactPaths.flatMap((path) => leafNameOf(path) ?? [])
+  ];
+  if (names.length === 0) {
+    return PASS_THROUGH;
+  }
+  return createNameRedactor(names, options.redactCensor);
+}
+function resolveRedactOption(options) {
+  const paths = options.redactStrategy === "paths" ? compileRedactPaths(options.redactPaths, options.shouldDisableDefaultRedact) : [...new Set(options.redactPaths)];
+  if (paths.length === 0) {
+    return void 0;
+  }
+  return { paths, censor: options.redactCensor };
+}
 function buildPinoInstance(options, logContext, destinations) {
   const maxBytes = options.maxEntrySizeBytes;
+  const redact = resolveNameRedactor(options);
+  const bound = (serializer) => createSizeBoundedSerializer((input) => redact(serializer(input)), maxBytes);
   const serializers = {
-    err: createSizeBoundedSerializer(pino.stdSerializers.err, maxBytes),
+    err: bound(pino.stdSerializers.err),
     ...Object.fromEntries(
       Object.entries(options.serializers).map(
-        ([key, serializer]) => [
-          key,
-          createSizeBoundedSerializer(serializer, maxBytes)
-        ]
+        ([key, serializer]) => [key, bound(serializer)]
       )
     )
   };
+  const redactOption = resolveRedactOption(options);
   const pinoOptions = {
     level: options.level,
-    redact: {
-      paths: compileRedactPaths(options.redactPaths, options.shouldDisableDefaultRedact),
-      censor: options.redactCensor
-    },
+    ...redactOption === void 0 ? {} : { redact: redactOption },
     base: { service: options.service },
     // Pino requires the timestamp fn to emit the `,"time":"..."` fragment.
     timestamp: () => `,"time":"${options.timestamp()}"`,
@@ -920,10 +1206,42 @@ function buildPinoInstance(options, logContext, destinations) {
       // Emit the level as a string label instead of the numeric code — easier
       // for log aggregators. Trace context is injected via `mixin`, never via
       // `formatters.log` (which cannot see ambient ALS / OTel state).
-      level: (label) => ({ level: label })
+      level: (label) => ({ level: label }),
+      // `base` bindings never reach `formatters.log` — Pino pre-serializes them
+      // into the instance's `chindings`, the same reason `child()` has to redact
+      // its own. That matters because `service` is CONSUMER-supplied and
+      // `applyDefaults` keeps whatever it was given: a `{ name, version, apiKey }`
+      // went out in clear, where the path expansion had covered it via `*.*.apiKey`.
+      // Redacting here rather than trimming to the two declared fields keeps a
+      // consumer's extra metadata instead of silently dropping it. Runs ONCE, at
+      // logger construction — no per-entry cost. `true`: bindings are a record
+      // root, iterated rather than serialized.
+      bindings: (bindings) => redact(bindings, true),
+      // The name-walk redactor runs here, on the merged record (mixin output +
+      // the caller's object), which is exactly the surface a caller controls.
+      // `base` and child bindings are NOT visible at this hook — they are
+      // library-owned (`service`, the `@InjectLogger` context) and carry nothing
+      // sensitive, which `pino-factory.spec.ts` pins.
+      log: (record) => redact(record, true)
     },
     serializers,
-    mixin: createTraceContextMixin(logContext, options.otel)
+    mixin: createTraceContextMixin(logContext, options.otel),
+    // `formatters.log` is NOT the first code to touch the caller's object: Pino
+    // merges the mixin result with it first, and the default strategy's
+    // `Object.assign` invokes every own getter. A throwing getter therefore
+    // crashed the log call before the redactor could return its fail-closed
+    // envelope. Owning the merge moves that boundary inside the guarantee.
+    mixinMergeStrategy: (mergeObject, mixinObject) => {
+      try {
+        return Object.assign({}, mixinObject, mergeObject);
+      } catch {
+        return {
+          ...mixinObject,
+          _redactionFailed: true,
+          _logKey: RESERVED_LOG_KEYS.LOGGER_REDACTION_FAILED
+        };
+      }
+    }
   };
   const streams = destinations.map((destination) => ({
     level: destination.minLevel ?? options.level,
@@ -939,9 +1257,10 @@ var DestinationRegistry = class {
    * @param logger - Structured logger used to report init failures. Injected by
    *   token explicitly for the same bundling reason.
    */
-  constructor(registered, logger) {
+  constructor(registered, logger, options) {
     this.registered = registered;
     this.logger = logger;
+    this.options = options;
     /**
      * Destinations that initialized successfully, in registration order.
      *
@@ -973,6 +1292,35 @@ var DestinationRegistry = class {
         );
       }
     }
+    this.announceBootstrap();
+  }
+  /**
+   * Emit the one-shot bootstrap entries, AFTER every destination has been
+   * initialized.
+   *
+   * Ordering is the whole point of doing this here rather than from an eagerly
+   * instantiated provider factory: a provider factory runs while Nest is still
+   * building the graph, before `onModuleInit`, so a sink that only accepts
+   * writes once its own `onInit()` has run would drop these entries — including
+   * `LOGGER_BOOTSTRAP_WARNING`, which exists precisely so a security review can
+   * see that PII redaction was turned off. A signal that a custom destination
+   * can silently swallow is not an audit trail. Emitting from the registry that
+   * owns destination initialization makes the ordering structural instead of a
+   * cross-provider hook-order assumption.
+   */
+  announceBootstrap() {
+    this.logger.info(RESERVED_LOG_KEYS.LOGGER_BOOTSTRAP_OK, "BymaxLoggerModule initialized");
+    if (this.options.shouldDisableDefaultRedact) {
+      this.logger.warnStructured(
+        RESERVED_LOG_KEYS.LOGGER_BOOTSTRAP_WARNING,
+        "Default PII redaction is DISABLED \u2014 sensitive fields will be logged verbatim unless every one of them is listed in options.redactPaths",
+        void 0,
+        {
+          shouldDisableDefaultRedact: true,
+          redactPathCount: this.options.redactPaths.length
+        }
+      );
+    }
   }
   /**
    * Flush and close active destinations in REVERSE registration order, so a
@@ -981,6 +1329,15 @@ var DestinationRegistry = class {
    * point in the shutdown sequence.
    */
   async onApplicationShutdown() {
+    this.logger.info(
+      RESERVED_LOG_KEYS.LOGGER_SHUTDOWN_OK,
+      "BymaxLoggerModule shutting down",
+      void 0,
+      { destinations: this.active.length }
+    );
+    await new Promise((resolve) => {
+      setImmediate(resolve);
+    });
     for (const destination of [...this.active].reverse()) {
       try {
         await destination.onShutdown?.();
@@ -1005,9 +1362,10 @@ var DestinationRegistry = class {
 DestinationRegistry = __decorateClass([
   Injectable(),
   __decorateParam(0, Inject(LOGGER_DESTINATIONS_TOKEN)),
-  __decorateParam(1, Inject(PinoLoggerService))
+  __decorateParam(1, Inject(PinoLoggerService)),
+  __decorateParam(2, Inject(LOGGER_OPTIONS_TOKEN))
 ], DestinationRegistry);
-var FORBIDDEN_CONTEXT_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var FORBIDDEN_CONTEXT_KEYS = PROTOTYPE_POLLUTING_KEYS;
 var LogContextService = class {
   constructor() {
     this.als = new AsyncLocalStorage();
@@ -1093,24 +1451,21 @@ LogContextService = __decorateClass([
 ], LogContextService);
 
 // src/server/logger.module.ts
-var LOGGER_BOOTSTRAP_TOKEN = /* @__PURE__ */ Symbol("BYMAX_LOGGER_BOOTSTRAP");
 function resolveDestinations(options) {
   return options.destinations.length > 0 ? options.destinations : [new DefaultStdoutDestination()];
 }
-function bootstrapProvider() {
-  return {
-    provide: LOGGER_BOOTSTRAP_TOKEN,
-    useFactory: (logger) => {
-      logger.info(RESERVED_LOG_KEYS.LOGGER_BOOTSTRAP_OK, "BymaxLoggerModule initialized");
-      return true;
-    },
-    inject: [PinoLoggerService]
-  };
-}
 function buildCommonProviders() {
   return [
     LogContextService,
     { provide: LOG_CONTEXT_TOKEN, useExisting: LogContextService },
+    {
+      // The DEFAULT-coverage redactor, shared by the Pino factory's hooks and by
+      // `PinoLoggerService.child()`. The latter needs it as a provider because
+      // Pino pre-serializes child bindings before `formatters.log` can see them.
+      provide: LOGGER_REDACTOR_TOKEN,
+      useFactory: (options) => resolveNameRedactor(options),
+      inject: [LOGGER_OPTIONS_TOKEN]
+    },
     {
       provide: LOGGER_PINO_INSTANCE_TOKEN,
       useFactory: (options, logContext, destinations) => buildPinoInstance(options, logContext, destinations),
@@ -1126,8 +1481,7 @@ function buildCommonProviders() {
     // exported — consumers never inject it directly.
     DestinationRegistry,
     // One child-logger provider per context discovered from @InjectLogger(context).
-    ...collectContextLoggerProviders(),
-    bootstrapProvider()
+    ...collectContextLoggerProviders()
   ];
 }
 function asyncHttpInterceptorProvider() {
@@ -1147,6 +1501,7 @@ function augmentLoggerModule(base, providers) {
       LOGGER_OPTIONS_TOKEN,
       LOGGER_PINO_INSTANCE_TOKEN,
       LOGGER_DESTINATIONS_TOKEN,
+      LOGGER_REDACTOR_TOKEN,
       LOG_CONTEXT_TOKEN,
       LogContextService,
       PinoLoggerService,
@@ -1337,6 +1692,119 @@ var PrettyDevDestination = class {
     });
   }
 };
+var HttpAccessLogMiddleware = class {
+  /**
+   * @param logger - The structured logger the access entries are written to.
+   *   Injected by token explicitly: the package is bundled without
+   *   `emitDecoratorMetadata`, so implicit class-type injection would not resolve.
+   * @param options - Resolved module options (read for `http.excludePaths`).
+   */
+  constructor(logger, options) {
+    this.logger = logger;
+    this.isEnabled = options.http.isEnabled;
+    this.excludePaths = options.http.excludePaths;
+  }
+  /**
+   * Emit START, arm the terminal entry on `'close'`, and continue the chain.
+   *
+   * @param req - The incoming request (Express satisfies the contract).
+   * @param res - The outgoing response (Express satisfies the contract).
+   * @param next - The next handler in the chain.
+   */
+  use(req, res, next) {
+    if (!this.isEnabled) {
+      next();
+      return;
+    }
+    const target = req.originalUrl ?? req.url;
+    const path = stripQueryString(target);
+    if (this.excludePaths.some((pattern) => pattern.test(path))) {
+      next();
+      return;
+    }
+    markRecorderActive(req);
+    const method = req.method;
+    const url = normalizeUrl(target);
+    const start = Date.now();
+    this.logger.info(RESERVED_LOG_KEYS.HTTP_REQUEST_START, `${method} ${url}`, readUserId(req), {
+      method,
+      url,
+      // Query string stripped: it may carry secrets (reset tokens, OAuth codes)
+      // that no key-name redaction can scrub out of a string VALUE.
+      fullUrl: path,
+      // Conventional for an access log and personal data under GDPR/LGPD. Its
+      // fidelity is the app's to establish: behind a proxy it is only the real
+      // client when the app configures `trust proxy`, and a value the app has not
+      // established is attacker-chosen. Suppress with `redactPaths: ['ip']`.
+      ip: req.ip,
+      userAgent: readUserAgent(req)
+    });
+    res.on(
+      "close",
+      AsyncResource.bind(() => {
+        this.logTerminal(req, res, method, url, Date.now() - start);
+      })
+    );
+    next();
+  }
+  /**
+   * Emit the terminal entry for a closed request.
+   *
+   * `userId` is read HERE rather than at START because authentication runs in a
+   * guard, downstream of this middleware — at START there is no principal yet.
+   *
+   * @param req - The request, carrying any error the interceptor recorded.
+   * @param res - The closed response.
+   * @param method - The HTTP method.
+   * @param url - The normalized request URL.
+   * @param duration - Elapsed milliseconds.
+   */
+  logTerminal(req, res, method, url, duration) {
+    const statusCode = res.statusCode;
+    const userId = readUserId(req);
+    const meta = { method, url, statusCode, duration };
+    if (!res.writableFinished) {
+      this.logger.warnStructured(
+        RESERVED_LOG_KEYS.HTTP_REQUEST_ABORTED,
+        `${method} ${url} \u2192 ${statusCode} not delivered (${duration}ms)`,
+        userId,
+        meta
+      );
+      return;
+    }
+    if (statusCode >= HTTP_SERVER_ERROR_MIN) {
+      const recorded = readRecordedError(req);
+      this.logger.errorStructured(
+        RESERVED_LOG_KEYS.HTTP_REQUEST_SERVER_ERROR,
+        recorded?.error ?? new Error(`${method} ${url} \u2192 ${statusCode}`),
+        userId,
+        meta
+      );
+      return;
+    }
+    if (statusCode >= HTTP_CLIENT_ERROR_MIN) {
+      const recorded = readRecordedError(req);
+      this.logger.warnStructured(
+        RESERVED_LOG_KEYS.HTTP_REQUEST_CLIENT_ERROR,
+        `${method} ${url} \u2192 ${statusCode}`,
+        userId,
+        recorded === void 0 ? meta : { ...meta, errorMessage: recorded.error.message }
+      );
+      return;
+    }
+    this.logger.info(
+      statusCode >= HTTP_REDIRECT_MIN ? RESERVED_LOG_KEYS.HTTP_REQUEST_REDIRECT : RESERVED_LOG_KEYS.HTTP_REQUEST_SUCCESS,
+      `${method} ${url} \u2192 ${statusCode} (${duration}ms)`,
+      userId,
+      meta
+    );
+  }
+};
+HttpAccessLogMiddleware = __decorateClass([
+  Injectable(),
+  __decorateParam(0, Inject(PinoLoggerService)),
+  __decorateParam(1, Inject(LOGGER_OPTIONS_TOKEN))
+], HttpAccessLogMiddleware);
 var REQUEST_ID_HEADER = "x-request-id";
 var MAX_CORRELATION_ID_LENGTH = 256;
 var CORRELATION_ID_CHARSET = /^[A-Za-z0-9._:/+=-]+$/;
@@ -1387,9 +1855,9 @@ RequestIdMiddleware = __decorateClass([
 ], RequestIdMiddleware);
 
 // src/server/middlewares/apply-request-id-middleware.ts
-var ALL_ROUTES = "*";
+var ALL_ROUTES = "/";
 function applyRequestIdMiddleware(consumer, routes = ALL_ROUTES) {
-  consumer.apply(RequestIdMiddleware).forRoutes(routes);
+  consumer.apply(RequestIdMiddleware, HttpAccessLogMiddleware).forRoutes(routes);
 }
 var INJECT_LOGGER_CONTEXT_METADATA_KEY = "bymax_logger:context";
 function InjectLogger(context) {
@@ -1452,4 +1920,4 @@ function LogPerformance(thresholdMs = DEFAULT_THRESHOLD_MS) {
 // src/shared/constants/log-keys-convention.constants.ts
 var LOG_KEYS_CONVENTION_REGEX = /^[A-Z][A-Z0-9_]+_[A-Z][A-Z0-9_]+(_[A-Z][A-Z0-9_]+)?$/;
 
-export { BymaxLoggerModule, DEFAULT_REDACT_PATHS, DefaultStdoutDestination, HttpExceptionFilter, HttpLoggingInterceptor, InjectLogger, LOGGER_DESTINATIONS_TOKEN, LOGGER_OPTIONS_TOKEN, LOGGER_PINO_INSTANCE_TOKEN, LOG_CONTEXT_METADATA_KEY, LOG_CONTEXT_TOKEN, LOG_KEYS_CONVENTION_REGEX, LogContext, LogContextService, LogPerformance, PinoLoggerService, PrettyDevDestination, RESERVED_LOG_KEYS, RequestIdMiddleware, applyRequestIdMiddleware };
+export { BymaxLoggerModule, DEFAULT_REDACT_PATHS, DefaultStdoutDestination, HttpExceptionFilter, HttpLoggingInterceptor, InjectLogger, LOGGER_DESTINATIONS_TOKEN, LOGGER_OPTIONS_TOKEN, LOGGER_PINO_INSTANCE_TOKEN, LOG_CONTEXT_METADATA_KEY, LOG_CONTEXT_TOKEN, LOG_KEYS_CONVENTION_REGEX, LogContext, LogContextService, LogPerformance, PINO_LEVEL_NAMES, PINO_LEVEL_NUMBERS, PinoLoggerService, PrettyDevDestination, RESERVED_LOG_KEYS, RESERVED_LOG_KEYS_NOT_EMITTED, RequestIdMiddleware, applyRequestIdMiddleware };