@bymax-one/nest-logger 1.1.0 → 1.2.1

package/dist/server/index.mjs

@@ -1,11 +1,12 @@
+import { join } from 'path';
+import { fileURLToPath } from 'url';
 import { Injectable, Inject, HttpStatus, Catch, ConfigurableModuleBuilder, Module, HttpException, SetMetadata } from '@nestjs/common';
 import { APP_INTERCEPTOR, APP_FILTER } from '@nestjs/core';
 import { tap, catchError, throwError } from 'rxjs';
 import pino from 'pino';
 import { createRequire } from 'module';
-import { join } from 'path';
 import { Writable } from 'stream';
-import { AsyncLocalStorage } from 'async_hooks';
+import { AsyncLocalStorage, AsyncResource } from 'async_hooks';
 import { randomUUID } from 'crypto';
 
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -17,6 +18,8 @@ var __decorateClass = (decorators, target, key, kind) => {
   return result;
 };
 var __decorateParam = (index, decorator) => (target, key) => decorator(target, key, index);
+var getFilename = () => fileURLToPath(import.meta.url);
+var __filename$1 = /* @__PURE__ */ getFilename();
 
 // src/server/config/default-options.ts
 var DEFAULT_HTTP = {
@@ -58,6 +61,15 @@ function applyDefaults(options) {
     isGlobal: options.isGlobal ?? true,
     shouldUseAsNestLogger: options.shouldUseAsNestLogger ?? true,
     redactPaths: Object.freeze([...options.redactPaths ?? []]),
+    redactStrategy: options.redactStrategy ?? "names",
+    // `'nested'` keeps the shape every existing consumer already queries.
+    resourceFormat: options.resourceFormat ?? "nested",
+    // `??` rather than `||`: `false` is a meaningful value here (emit nothing)
+    // and `||` would silently replace it with the default.
+    eventNameField: options.eventNameField ?? "event.name",
+    // `'pino'` by default: the semconv attributes are additive value, but the
+    // legacy shape is what existing dashboards and alerts already query.
+    errorFormat: options.errorFormat ?? "pino",
     redactCensor: options.redactCensor ?? "[REDACTED]",
     shouldDisableDefaultRedact: options.shouldDisableDefaultRedact ?? false,
     destinations: Object.freeze([...options.destinations ?? []]),
@@ -83,7 +95,7 @@ var PINO_LEVEL_NUMBERS = Object.freeze({
   debug: 20,
   trace: 10
 });
-Object.freeze(
+var PINO_LEVEL_NAMES = Object.freeze(
   Object.fromEntries(
     Object.entries(PINO_LEVEL_NUMBERS).map(([name, num]) => [num, name])
     // keys of PINO_LEVEL_NUMBERS are always LogLevel
@@ -120,16 +132,143 @@ function validateOptions(options) {
   if (options.maxEntrySizeBytes !== void 0 && options.maxEntrySizeBytes <= 0) {
     throw new Error("[BymaxLoggerModule] options.maxEntrySizeBytes must be > 0");
   }
+  if (options.redactStrategy !== void 0 && options.redactStrategy !== "names" && options.redactStrategy !== "paths") {
+    throw new Error(
+      `[BymaxLoggerModule] options.redactStrategy must be 'names' or 'paths'. Got: ${String(
+        options.redactStrategy
+      )}`
+    );
+  }
+  if (options.resourceFormat !== void 0 && options.resourceFormat !== "nested" && options.resourceFormat !== "flat") {
+    throw new Error(
+      `[BymaxLoggerModule] options.resourceFormat must be 'nested' or 'flat'. Got: ${String(
+        options.resourceFormat
+      )}`
+    );
+  }
+  if (options.errorFormat !== void 0 && options.errorFormat !== "pino" && options.errorFormat !== "semconv" && options.errorFormat !== "both") {
+    throw new Error(
+      `[BymaxLoggerModule] options.errorFormat must be 'pino', 'semconv' or 'both'. Got: ${String(
+        options.errorFormat
+      )}`
+    );
+  }
+  if (options.eventNameField !== void 0 && options.eventNameField !== false && (typeof options.eventNameField !== "string" || options.eventNameField.length === 0)) {
+    throw new Error(
+      `[BymaxLoggerModule] options.eventNameField must be a non-empty string or false. Got: ${String(
+        options.eventNameField
+      )}`
+    );
+  }
 }
 
 // src/server/constants/injection-tokens.constants.ts
 var LOGGER_OPTIONS_TOKEN = /* @__PURE__ */ Symbol("BYMAX_LOGGER_OPTIONS");
 var LOGGER_PINO_INSTANCE_TOKEN = /* @__PURE__ */ Symbol("BYMAX_LOGGER_PINO_INSTANCE");
 var LOGGER_DESTINATIONS_TOKEN = /* @__PURE__ */ Symbol("BYMAX_LOGGER_DESTINATIONS");
+var LOGGER_REDACTOR_TOKEN = /* @__PURE__ */ Symbol("BYMAX_LOGGER_REDACTOR");
 var LOG_CONTEXT_TOKEN = /* @__PURE__ */ Symbol("BYMAX_LOGGER_LOG_CONTEXT");
+
+// src/shared/constants/reserved-log-keys.constants.ts
+var RESERVED_LOG_KEYS = Object.freeze({
+  LOGGER_BOOTSTRAP_OK: "LOGGER_BOOTSTRAP_OK",
+  LOGGER_BOOTSTRAP_WARNING: "LOGGER_BOOTSTRAP_WARNING",
+  LOGGER_SHUTDOWN_OK: "LOGGER_SHUTDOWN_OK",
+  HTTP_REQUEST_START: "HTTP_REQUEST_START",
+  HTTP_REQUEST_SUCCESS: "HTTP_REQUEST_SUCCESS",
+  HTTP_REQUEST_REDIRECT: "HTTP_REQUEST_REDIRECT",
+  HTTP_REQUEST_CLIENT_ERROR: "HTTP_REQUEST_CLIENT_ERROR",
+  HTTP_REQUEST_SERVER_ERROR: "HTTP_REQUEST_SERVER_ERROR",
+  HTTP_REQUEST_COMPLETED: "HTTP_REQUEST_COMPLETED",
+  HTTP_REQUEST_ABORTED: "HTTP_REQUEST_ABORTED",
+  HTTP_EXCEPTION_HANDLED: "HTTP_EXCEPTION_HANDLED",
+  HTTP_EXCEPTION_UNHANDLED: "HTTP_EXCEPTION_UNHANDLED",
+  METHOD_EXECUTION: "METHOD_EXECUTION",
+  METHOD_SLOW_EXECUTION: "METHOD_SLOW_EXECUTION",
+  LOGGER_DESTINATION_INIT_FAILED: "LOGGER_DESTINATION_INIT_FAILED",
+  LOGGER_DESTINATION_WRITE_FAILED: "LOGGER_DESTINATION_WRITE_FAILED",
+  LOGGER_ENTRY_TRUNCATED: "LOGGER_ENTRY_TRUNCATED",
+  LOGGER_REDACTION_FAILED: "LOGGER_REDACTION_FAILED"
+});
+var RESERVED_LOG_KEYS_NOT_EMITTED = Object.freeze({
+  /**
+   * Superseded before it was ever used. The request lifecycle terminates in one
+   * of `HTTP_REQUEST_SUCCESS` / `_REDIRECT` / `_CLIENT_ERROR` / `_SERVER_ERROR`,
+   * each carrying the same `duration` a generic "completed" entry would. Emitting
+   * it as well would double the terminal access-log volume to say nothing new.
+   * It stays claimed so an application cannot repurpose a name that reads like a
+   * library event.
+   */
+  HTTP_REQUEST_COMPLETED: "reserved: superseded by the four status-specific terminal keys"
+});
+
+// src/server/constants/prototype-polluting-keys.constants.ts
+var PROTOTYPE_POLLUTING_KEYS = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype"
+]);
+
+// src/server/utils/escape-log-text.util.ts
+var LINE_TERMINATORS = /* @__PURE__ */ new Set(["\r", "\n", "\x85", "\u2028", "\u2029"]);
+var UNSAFE_IN_SINGLE_LINE = /[\u0000-\u0008\u000A-\u001F\u007F-\u009F\u2028\u2029]/g;
+var UNSAFE_IN_MULTILINE = /[\u0000-\u0008\u000B-\u001F\u007F-\u009F\u2028\u2029]/g;
+function toEscapeSequence(char) {
+  return `\\u${char.charCodeAt(0).toString(16).padStart(4, "0")}`;
+}
+function toSingleLineMessage(text) {
+  return text.replace(
+    UNSAFE_IN_SINGLE_LINE,
+    (char) => LINE_TERMINATORS.has(char) ? "\\n" : toEscapeSequence(char)
+  );
+}
+function escapeControlCharacters(text) {
+  return text.replace(UNSAFE_IN_MULTILINE, toEscapeSequence);
+}
+
+// src/server/services/pino-logger.service.ts
+var OWNED_PAYLOAD_KEYS = ["logKey", "userId", "context"];
+function withoutOwnedKeys(metadata) {
+  if (metadata === void 0) {
+    return {};
+  }
+  try {
+    const safe = {};
+    for (const key of Object.keys(metadata)) {
+      if (!OWNED_PAYLOAD_KEYS.includes(key) && !PROTOTYPE_POLLUTING_KEYS.has(key)) {
+        Reflect.set(safe, key, Reflect.get(metadata, key));
+      }
+    }
+    return safe;
+  } catch {
+    return {
+      _redactionFailed: true,
+      _logKey: RESERVED_LOG_KEYS.LOGGER_REDACTION_FAILED
+    };
+  }
+}
+function safeErrorMessage(error) {
+  try {
+    return toSingleLineMessage(String(error.message));
+  } catch {
+    return "Unreadable error message";
+  }
+}
+function assignIfDefined(payload, key, value) {
+  if (value !== void 0) {
+    Reflect.defineProperty(payload, key, { value, enumerable: true });
+  }
+}
 var PinoLoggerService = class {
-  constructor(pino2) {
+  /**
+   * @param pino - The wrapped Pino instance.
+   * @param redact - The DEFAULT-coverage redactor, applied to `child()` bindings.
+   *   Defaults to the identity so a hand-built instance (benchmarks, unit tests)
+   *   still works; the module always injects the configured one.
+   */
+  constructor(pino2, redact = (value) => value) {
     this.pino = pino2;
+    this.redact = redact;
   }
   // ─── NestJS LoggerService variadic interface ──────────────────────────────
   /**
@@ -152,19 +291,20 @@ var PinoLoggerService = class {
    */
   error(message, ...optionalParams) {
     if (message instanceof Error) {
-      this.pino.error(
-        { context: this.resolveContext(optionalParams), err: this.serializeError(message) },
-        message.message
-      );
+      const payload2 = { err: message };
+      assignIfDefined(payload2, "context", this.resolveContext(optionalParams));
+      this.pino.error(payload2, safeErrorMessage(message));
       return;
     }
     const stack = typeof optionalParams[0] === "string" ? optionalParams[0] : void 0;
     const context = typeof optionalParams[1] === "string" ? optionalParams[1] : this.context;
-    const payload = { context };
-    if (stack !== void 0) {
-      payload["stack"] = stack;
-    }
-    this.pino.error(payload, typeof message === "string" ? message : String(message));
+    const payload = {};
+    assignIfDefined(payload, "context", context);
+    assignIfDefined(payload, "stack", stack);
+    this.pino.error(
+      payload,
+      toSingleLineMessage(typeof message === "string" ? message : String(message))
+    );
   }
   /**
    * NestJS `warn` (warn level).
@@ -238,10 +378,19 @@ var PinoLoggerService = class {
    * @param metadata - Optional extra structured fields.
    */
   errorStructured(logKey, error, userId, metadata) {
-    this.pino.error(
-      { ...metadata, logKey, userId, context: this.context, err: this.serializeError(error) },
-      error.message
-    );
+    const payload = {
+      ...withoutOwnedKeys(metadata),
+      logKey,
+      // The RAW value, not a pre-serialized copy. Pre-serializing was what let
+      // Pino's standard `err` serializer re-derive `type` from the resulting
+      // plain object's constructor and emit `"Object"` for every typed
+      // exception — and it discarded the cause chain on the way. The configured
+      // serializer owns the shape now.
+      err: error
+    };
+    assignIfDefined(payload, "userId", userId);
+    assignIfDefined(payload, "context", this.context);
+    this.pino.error(payload, safeErrorMessage(error));
   }
   // ─── Helpers / escape hatches ─────────────────────────────────────────────
   /**
@@ -274,7 +423,8 @@ var PinoLoggerService = class {
    * @returns A new `PinoLoggerService` wrapping the Pino child.
    */
   child(bindings) {
-    const childService = new PinoLoggerService(this.pino.child(bindings));
+    const safeBindings = this.redact(bindings, true);
+    const childService = new PinoLoggerService(this.pino.child(safeBindings), this.redact);
     if (this.context !== void 0) {
       childService.setContext(this.context);
     }
@@ -288,19 +438,6 @@ var PinoLoggerService = class {
   onApplicationShutdown() {
   }
   // ─── Private ──────────────────────────────────────────────────────────────
-  /**
-   * Serialize an Error into a plain, log-safe object matching Pino's built-in
-   * `err` serializer shape (`type`, `message`, `stack`).
-   *
-   * Reads `error.name` (NOT `error.constructor.name`) for `type`: native
-   * subclasses set `name` to their class name, and a sanitized plain-object error
-   * (from `sanitizeError`) carries the real class name on `name` — whereas its
-   * `constructor.name` would be the unhelpful `'Object'`, breaking `err.type`
-   * dashboards for every exception logged through `HttpExceptionFilter`.
-   */
-  serializeError(error) {
-    return { type: error.name, message: error.message, stack: error.stack };
-  }
   /** Resolve the context: last string param wins, else the instance context. */
   resolveContext(optionalParams) {
     const last = optionalParams[optionalParams.length - 1];
@@ -308,22 +445,21 @@ var PinoLoggerService = class {
   }
   /** Emit a structured payload at info or warn level. */
   emitStructured(level, logKey, message, userId, metadata) {
-    const payload = {
-      ...metadata,
-      logKey,
-      userId,
-      context: this.context
-    };
+    const payload = { ...withoutOwnedKeys(metadata), logKey };
+    assignIfDefined(payload, "userId", userId);
+    assignIfDefined(payload, "context", this.context);
+    const line = toSingleLineMessage(message);
     if (level === "info") {
-      this.pino.info(payload, message);
+      this.pino.info(payload, line);
     } else {
-      this.pino.warn(payload, message);
+      this.pino.warn(payload, line);
     }
   }
   /** Emit a NestJS-style variadic log, dispatching by level without computed indexing. */
   emitNestStyle(level, message, optionalParams) {
-    const payload = { context: this.resolveContext(optionalParams) };
-    const msg = typeof message === "string" ? message : String(message);
+    const payload = {};
+    assignIfDefined(payload, "context", this.resolveContext(optionalParams));
+    const msg = toSingleLineMessage(typeof message === "string" ? message : String(message));
     switch (level) {
       case "info":
         this.pino.info(payload, msg);
@@ -345,7 +481,8 @@ var PinoLoggerService = class {
 };
 PinoLoggerService = __decorateClass([
   Injectable(),
-  __decorateParam(0, Inject(LOGGER_PINO_INSTANCE_TOKEN))
+  __decorateParam(0, Inject(LOGGER_PINO_INSTANCE_TOKEN)),
+  __decorateParam(1, Inject(LOGGER_REDACTOR_TOKEN))
 ], PinoLoggerService);
 
 // src/server/decorators/inject-logger.provider.ts
@@ -395,26 +532,6 @@ DefaultStdoutDestination = __decorateClass([
   Injectable()
 ], DefaultStdoutDestination);
 
-// src/shared/constants/reserved-log-keys.constants.ts
-var RESERVED_LOG_KEYS = Object.freeze({
-  LOGGER_BOOTSTRAP_OK: "LOGGER_BOOTSTRAP_OK",
-  LOGGER_BOOTSTRAP_WARNING: "LOGGER_BOOTSTRAP_WARNING",
-  LOGGER_SHUTDOWN_OK: "LOGGER_SHUTDOWN_OK",
-  HTTP_REQUEST_START: "HTTP_REQUEST_START",
-  HTTP_REQUEST_SUCCESS: "HTTP_REQUEST_SUCCESS",
-  HTTP_REQUEST_REDIRECT: "HTTP_REQUEST_REDIRECT",
-  HTTP_REQUEST_CLIENT_ERROR: "HTTP_REQUEST_CLIENT_ERROR",
-  HTTP_REQUEST_SERVER_ERROR: "HTTP_REQUEST_SERVER_ERROR",
-  HTTP_REQUEST_COMPLETED: "HTTP_REQUEST_COMPLETED",
-  HTTP_EXCEPTION_HANDLED: "HTTP_EXCEPTION_HANDLED",
-  HTTP_EXCEPTION_UNHANDLED: "HTTP_EXCEPTION_UNHANDLED",
-  METHOD_EXECUTION: "METHOD_EXECUTION",
-  METHOD_SLOW_EXECUTION: "METHOD_SLOW_EXECUTION",
-  LOGGER_DESTINATION_INIT_FAILED: "LOGGER_DESTINATION_INIT_FAILED",
-  LOGGER_DESTINATION_WRITE_FAILED: "LOGGER_DESTINATION_WRITE_FAILED",
-  LOGGER_ENTRY_TRUNCATED: "LOGGER_ENTRY_TRUNCATED"
-});
-
 // src/server/utils/normalize-url.util.ts
 var UUID_REGEX = /\/[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}(?![0-9a-f])/gi;
 var ULID_REGEX = /\/[0-9A-HJKMNP-TV-Z]{26}(?![0-9A-HJKMNP-TV-Z])/g;
@@ -437,9 +554,16 @@ function sanitizeError(err, options) {
   const maxCauseDepth = DEFAULT_MAX_CAUSE_DEPTH;
   return toSanitizedError(err, /* @__PURE__ */ new WeakSet(), 0, maxCauseDepth);
 }
+function isErrorLike(value) {
+  if (typeof value !== "object" || value === null) {
+    return false;
+  }
+  const candidate = value;
+  return typeof candidate.name === "string" && typeof candidate.message === "string";
+}
 function toSanitizedError(value, seen, depth2, maxDepth) {
   try {
-    if (!(value instanceof Error)) {
+    if (!isErrorLike(value)) {
       return { name: "UnknownError", message: String(value) };
     }
     seen.add(value);
@@ -477,7 +601,9 @@ function readAggregatedErrors(value) {
   return Array.isArray(candidate) ? candidate : void 0;
 }
 function scrubStack(stack) {
-  return stack.split("\n").filter((line) => !line.includes("node_modules")).join("\n");
+  return escapeControlCharacters(
+    stack.split("\n").filter((line) => !line.includes("node_modules")).join("\n")
+  );
 }
 function isObject(value) {
   return typeof value === "object" && value !== null;
@@ -555,11 +681,39 @@ HttpExceptionFilter = __decorateClass([
   Catch(),
   __decorateParam(0, Inject(PinoLoggerService))
 ], HttpExceptionFilter);
-var HTTP_SUCCESS_MIN = 200;
+
+// src/server/utils/http-log-state.util.ts
 var HTTP_REDIRECT_MIN = 300;
 var HTTP_CLIENT_ERROR_MIN = 400;
 var HTTP_SERVER_ERROR_MIN = 500;
 var UNKNOWN_USER_AGENT = "unknown";
+var RECORDER_ACTIVE = /* @__PURE__ */ Symbol("bymax-one/nest-logger:recorder");
+var RECORDED_ERROR = /* @__PURE__ */ Symbol("bymax-one/nest-logger:error");
+function markRecorderActive(req) {
+  Reflect.set(req, RECORDER_ACTIVE, true);
+}
+function isRecorderActive(req) {
+  return Reflect.get(req, RECORDER_ACTIVE) === true;
+}
+function recordError(req, error) {
+  Reflect.set(req, RECORDED_ERROR, { error });
+}
+function readRecordedError(req) {
+  return Reflect.get(req, RECORDED_ERROR);
+}
+function toError(thrown) {
+  return thrown instanceof Error ? thrown : new Error(String(thrown));
+}
+function readUserId(req) {
+  return req.user?.sub ?? req.user?.id;
+}
+function readUserAgent(req) {
+  const raw = req.headers["user-agent"];
+  return typeof raw === "string" ? raw : UNKNOWN_USER_AGENT;
+}
+
+// src/server/interceptors/http-logging.interceptor.ts
+var HTTP_SUCCESS_MIN = 200;
 var HttpLoggingInterceptor = class {
   /**
    * @param logger - The structured logger the lifecycle entries are written to.
@@ -578,8 +732,8 @@ var HttpLoggingInterceptor = class {
    * @param path - The query-stripped request path.
    * @returns `true` when the path matches a configured exclude pattern.
    */
-  isExcluded(path) {
-    return this.excludePaths.some((pattern) => pattern.test(path));
+  isExcluded(path2) {
+    return this.excludePaths.some((pattern) => pattern.test(path2));
   }
   /**
    * Emit the START entry, then attach success/redirect/error logging to the
@@ -593,13 +747,15 @@ var HttpLoggingInterceptor = class {
     const http = context.switchToHttp();
     const req = http.getRequest();
     const res = http.getResponse();
+    if (isRecorderActive(req)) {
+      return this.recordOnly(req, next);
+    }
     const { method, url, ip } = req;
     if (this.isExcluded(stripQueryString(url))) {
       return next.handle();
     }
-    const rawUserAgent = req.headers["user-agent"];
-    const userAgent = typeof rawUserAgent === "string" ? rawUserAgent : UNKNOWN_USER_AGENT;
-    const userId = req.user?.sub ?? req.user?.id;
+    const userAgent = readUserAgent(req);
+    const userId = readUserId(req);
     const normalizedUrl = normalizeUrl(url);
     const start = Date.now();
     this.logger.info(RESERVED_LOG_KEYS.HTTP_REQUEST_START, `${method} ${normalizedUrl}`, userId, {
@@ -622,6 +778,28 @@ var HttpLoggingInterceptor = class {
       })
     );
   }
+  /**
+   * Hand the lifecycle to the access-log middleware, recording only the thrown
+   * error for its terminal entry.
+   *
+   * The interceptor cannot be the recorder: it never runs for a request a guard
+   * rejected or one that matched no route. It also cannot judge DELIVERY — at the
+   * moment it completes, the response has not been flushed yet, which is why an
+   * aborted request used to be logged as the 200 the handler intended. What it
+   * uniquely has is the thrown value, so that is all it contributes.
+   *
+   * @param req - The request whose lifecycle the middleware owns.
+   * @param next - The downstream call handler.
+   * @returns The response stream, unmodified and with exceptions re-thrown.
+   */
+  recordOnly(req, next) {
+    return next.handle().pipe(
+      catchError((err) => {
+        recordError(req, toError(err));
+        return throwError(() => err);
+      })
+    );
+  }
   /**
    * Log a non-throwing completion: SUCCESS for 2xx, REDIRECT for 3xx, nothing
    * for any other status (those are surfaced via the error path instead).
@@ -680,12 +858,12 @@ var HttpLoggingInterceptor = class {
       }
       return;
     }
-    this.logger.errorStructured(
-      RESERVED_LOG_KEYS.HTTP_REQUEST_SERVER_ERROR,
-      err instanceof Error ? err : new Error(String(err)),
-      userId,
-      { method, url, statusCode: HttpStatus.INTERNAL_SERVER_ERROR, duration }
-    );
+    this.logger.errorStructured(RESERVED_LOG_KEYS.HTTP_REQUEST_SERVER_ERROR, toError(err), userId, {
+      method,
+      url,
+      statusCode: HttpStatus.INTERNAL_SERVER_ERROR,
+      duration
+    });
   }
 };
 HttpLoggingInterceptor = __decorateClass([
@@ -720,48 +898,6 @@ var {
   // disabled" without a dead nullish branch.
   global: extras.isGlobal !== false
 })).build();
-function detectOtelTraceApi() {
-  try {
-    const requireFromCwd = createRequire(join(process.cwd(), "noop.cjs"));
-    const mod = requireFromCwd("@opentelemetry/api");
-    return mod.trace;
-  } catch {
-    return void 0;
-  }
-}
-function isValidTraceId(traceId) {
-  return /^[0-9a-f]{32}$/.test(traceId) && !/^0+$/.test(traceId);
-}
-function isValidSpanId(spanId) {
-  return /^[0-9a-f]{16}$/.test(spanId) && !/^0+$/.test(spanId);
-}
-
-// src/server/mixins/trace-context.mixin.ts
-function createTraceContextMixin(logContext, opts) {
-  const traceApi = opts.shouldAutoInjectTraceContext ? detectOtelTraceApi() : void 0;
-  return function mixin(_mergeObject, _level, _logger) {
-    const merged = {};
-    const store = logContext.getStore();
-    if (store) {
-      Object.assign(merged, store);
-    }
-    if (traceApi) {
-      const span = traceApi.getActiveSpan();
-      if (span) {
-        const ctx = span.spanContext();
-        if (isValidTraceId(ctx.traceId) && isValidSpanId(ctx.spanId)) {
-          Reflect.set(merged, opts.traceIdField, ctx.traceId);
-          Reflect.set(merged, opts.spanIdField, ctx.spanId);
-          if (typeof ctx.traceFlags === "number") {
-            const flagsByte = ctx.traceFlags & 255;
-            Reflect.set(merged, opts.traceFlagsField, flagsByte.toString(16).padStart(2, "0"));
-          }
-        }
-      }
-    }
-    return merged;
-  };
-}
 
 // src/server/constants/default-redact-paths.constants.ts
 var REDACT_MAX_DEPTH = 4;
@@ -804,7 +940,20 @@ var REDACT_COMMON_FIELDS = [
   "signingSecret",
   "privateKey",
   // Conservative PII (1) — consumer can disable if logging email is justified
-  "email"
+  "email",
+  // Credential-bearing HTTP header names (5). These also appear in
+  // {@link REDACT_ABSOLUTE_PATHS}, pinned to the `req.headers` / `res.headers`
+  // shapes — which covered ONLY those two shapes. A headers bag logged under any
+  // other key (`logger.info(k, m, u, { headers: req.headers })`, one of the most
+  // common things written while debugging an integration) wrote the bearer token
+  // in clear. Listed here as bare names, they are caught wherever they appear.
+  // Node lower-cases inbound header names, so the lower-case spelling is the one
+  // that can actually reach a log.
+  "authorization",
+  "cookie",
+  "set-cookie",
+  "x-api-key",
+  "x-auth-token"
 ];
 var REDACT_ABSOLUTE_PATHS = [
   "req.headers.authorization",
@@ -818,6 +967,51 @@ var DEFAULT_REDACT_PATHS = [
   ...REDACT_COMMON_FIELDS.flatMap((field) => depth(field)),
   ...REDACT_ABSOLUTE_PATHS
 ];
+function loadTraceApiFrom(anchor) {
+  try {
+    const requireFrom = createRequire(anchor());
+    const mod = requireFrom("@opentelemetry/api");
+    return mod.trace;
+  } catch {
+    return void 0;
+  }
+}
+function detectOtelTraceApi() {
+  return loadTraceApiFrom(() => __filename$1) ?? loadTraceApiFrom(() => join(process.cwd(), "noop.cjs"));
+}
+function isValidTraceId(traceId) {
+  return /^[0-9a-f]{32}$/.test(traceId) && !/^0+$/.test(traceId);
+}
+function isValidSpanId(spanId) {
+  return /^[0-9a-f]{16}$/.test(spanId) && !/^0+$/.test(spanId);
+}
+
+// src/server/mixins/trace-context.mixin.ts
+function createTraceContextMixin(logContext, opts) {
+  const traceApi = opts.shouldAutoInjectTraceContext ? detectOtelTraceApi() : void 0;
+  return function mixin(_mergeObject, _level, _logger) {
+    const merged = {};
+    const store = logContext.getStore();
+    if (store) {
+      Object.assign(merged, store);
+    }
+    if (traceApi) {
+      const span = traceApi.getActiveSpan();
+      if (span) {
+        const ctx = span.spanContext();
+        if (isValidTraceId(ctx.traceId) && isValidSpanId(ctx.spanId)) {
+          Reflect.set(merged, opts.traceIdField, ctx.traceId);
+          Reflect.set(merged, opts.spanIdField, ctx.spanId);
+          if (typeof ctx.traceFlags === "number") {
+            const flagsByte = ctx.traceFlags & 255;
+            Reflect.set(merged, opts.traceFlagsField, flagsByte.toString(16).padStart(2, "0"));
+          }
+        }
+      }
+    }
+    return merged;
+  };
+}
 
 // src/server/utils/compile-redact-paths.util.ts
 function compileRedactPaths(extraPaths, shouldSkipDefaults) {
@@ -866,6 +1060,241 @@ function destinationToStream(destination) {
   });
 }
 
+// src/server/utils/redact-by-name.util.ts
+var REDACT_MAX_TRAVERSAL_DEPTH = 100;
+var REDACT_DEPTH_EXCEEDED = "[REDACTION_DEPTH_EXCEEDED]";
+var REDACT_CIRCULAR = "[Circular]";
+function resolveToJson(value) {
+  let getter;
+  let candidate;
+  let current = value;
+  while (current !== null) {
+    const descriptor = Object.getOwnPropertyDescriptor(current, "toJSON");
+    if (descriptor !== void 0) {
+      getter = descriptor.get;
+      candidate = getter === void 0 ? descriptor.value : getter.call(value);
+      break;
+    }
+    current = Object.getPrototypeOf(current);
+  }
+  return {
+    method: typeof candidate === "function" ? candidate : void 0,
+    fromAccessor: getter !== void 0
+  };
+}
+function cloneError(error) {
+  const clone = Object.create(
+    Object.getPrototypeOf(error),
+    Object.getOwnPropertyDescriptors(error)
+  );
+  const { stack } = error;
+  if (typeof stack === "string") {
+    Reflect.defineProperty(clone, "stack", { value: stack, enumerable: false });
+  }
+  return clone;
+}
+var BUFFER_TO_JSON = Buffer.prototype.toJSON;
+var WRITE_FAILED = new Error();
+function defineOwn(target, key, value) {
+  if (!Reflect.defineProperty(target, key, { value, enumerable: true })) {
+    throw WRITE_FAILED;
+  }
+}
+function walkArray(value, sensitive, censor, depth2, ancestors) {
+  const length = value.length;
+  const copy = [];
+  for (let index = 0; index < length; index++) {
+    Reflect.set(
+      copy,
+      index,
+      walk(Reflect.get(value, index), sensitive, censor, depth2 + 1, ancestors)
+    );
+  }
+  return copy;
+}
+function walk(value, sensitive, censor, depth2, ancestors, honorToJson = true) {
+  if (value === null) {
+    return value;
+  }
+  if (typeof value !== "object" && typeof value !== "function") {
+    return value;
+  }
+  if (depth2 > REDACT_MAX_TRAVERSAL_DEPTH) {
+    return REDACT_DEPTH_EXCEEDED;
+  }
+  if (ancestors.has(value)) {
+    return REDACT_CIRCULAR;
+  }
+  const resolvedToJson = resolveToJson(value);
+  if (!resolvedToJson.fromAccessor && resolvedToJson.method === BUFFER_TO_JSON) {
+    return value;
+  }
+  ancestors.add(value);
+  try {
+    const toJson = honorToJson ? resolvedToJson.method : void 0;
+    if (toJson !== void 0) {
+      if (Object.keys(value).some((key) => sensitive.has(key.toLowerCase()))) {
+        return censor;
+      }
+      return walk(toJson.call(value), sensitive, censor, depth2 + 1, ancestors);
+    }
+    if (typeof value === "function") {
+      return value;
+    }
+    if (Array.isArray(value)) {
+      return walkArray(value, sensitive, censor, depth2, ancestors);
+    }
+    const source = value;
+    const keys = Object.keys(source);
+    const copy = value instanceof Error ? cloneError(value) : {};
+    for (const key of keys) {
+      const current = Reflect.get(source, key);
+      defineOwn(
+        copy,
+        key,
+        sensitive.has(key.toLowerCase()) ? censor : walk(current, sensitive, censor, depth2 + 1, ancestors)
+      );
+    }
+    return copy;
+  } finally {
+    ancestors.delete(value);
+  }
+}
+function createNameRedactor(fieldNames, censor) {
+  const sensitive = new Set(fieldNames.map((name) => name.toLowerCase()));
+  return (value, isRecordRoot = false) => {
+    try {
+      return walk(value, sensitive, censor, 0, /* @__PURE__ */ new Set(), !isRecordRoot);
+    } catch {
+      return {
+        _redactionFailed: true,
+        _logKey: RESERVED_LOG_KEYS.LOGGER_REDACTION_FAILED
+      };
+    }
+  };
+}
+
+// src/server/utils/resolve-resource.util.ts
+var ATTR_NAMESPACE = "service.namespace";
+var ATTR_VERSION = "service.version";
+var ATTR_NAME = "service.name";
+var ATTR_INSTANCE_ID = "service.instance.id";
+var ATTR_ENVIRONMENT = "deployment.environment.name";
+function parseResourceAttributes(raw) {
+  const parsed = {};
+  if (raw === void 0) {
+    return parsed;
+  }
+  for (const pair of raw.split(",")) {
+    const separator = pair.indexOf("=");
+    if (separator <= 0) {
+      continue;
+    }
+    const key = pair.slice(0, separator).trim();
+    const rawValue = pair.slice(separator + 1).trim();
+    if (rawValue.length === 0) {
+      continue;
+    }
+    let value;
+    try {
+      value = decodeURIComponent(rawValue);
+    } catch {
+      value = rawValue;
+    }
+    Object.defineProperty(parsed, key, { value, enumerable: true, configurable: true });
+  }
+  return parsed;
+}
+function attribute(attributes, key) {
+  const value = Object.hasOwn(attributes, key) ? Reflect.get(attributes, key) : void 0;
+  return typeof value === "string" ? value : void 0;
+}
+function firstNonEmpty(...candidates) {
+  const found = candidates.find(
+    (candidate) => typeof candidate === "string" && candidate.length > 0
+  );
+  return found;
+}
+function resolveServiceMetadata(service, env = process.env) {
+  const attributes = parseResourceAttributes(env["OTEL_RESOURCE_ATTRIBUTES"]);
+  const resolved = {
+    // The spec's precedence: OTEL_SERVICE_NAME beats service.name in the
+    // attribute list. Explicit configuration still beats both.
+    name: firstNonEmpty(service.name, env["OTEL_SERVICE_NAME"], attribute(attributes, ATTR_NAME)) ?? "",
+    version: firstNonEmpty(service.version, attribute(attributes, ATTR_VERSION)) ?? ""
+  };
+  const namespace = firstNonEmpty(service.namespace, attribute(attributes, ATTR_NAMESPACE));
+  if (namespace !== void 0) {
+    resolved.namespace = namespace;
+  }
+  const instanceId = firstNonEmpty(service.instanceId, attribute(attributes, ATTR_INSTANCE_ID));
+  if (instanceId !== void 0) {
+    resolved.instanceId = instanceId;
+  }
+  const environment = firstNonEmpty(
+    service.environment,
+    attribute(attributes, ATTR_ENVIRONMENT),
+    env["NODE_ENV"]
+  );
+  if (environment !== void 0) {
+    resolved.environment = environment;
+  }
+  return resolved;
+}
+function buildResourceBindings(resolved, format, extras = {}) {
+  if (format === "flat") {
+    const flat = {
+      [ATTR_NAME]: resolved.name,
+      [ATTR_VERSION]: resolved.version
+    };
+    for (const [key, value] of Object.entries(extras)) {
+      Reflect.set(flat, `service.${key}`, value);
+    }
+    if (resolved.namespace !== void 0) {
+      Reflect.set(flat, ATTR_NAMESPACE, resolved.namespace);
+    }
+    if (resolved.instanceId !== void 0) {
+      Reflect.set(flat, ATTR_INSTANCE_ID, resolved.instanceId);
+    }
+    if (resolved.environment !== void 0) {
+      Reflect.set(flat, ATTR_ENVIRONMENT, resolved.environment);
+    }
+    return flat;
+  }
+  const service = {
+    ...extras,
+    name: resolved.name,
+    version: resolved.version
+  };
+  if (resolved.namespace !== void 0) {
+    service["namespace"] = resolved.namespace;
+  }
+  if (resolved.instanceId !== void 0) {
+    service["instance"] = { id: resolved.instanceId };
+  }
+  const bindings = { service };
+  if (resolved.environment !== void 0) {
+    bindings["deployment"] = { environment: { name: resolved.environment } };
+  }
+  return bindings;
+}
+var OWNED_SERVICE_KEYS = /* @__PURE__ */ new Set([
+  "name",
+  "version",
+  "namespace",
+  "instanceId",
+  "environment"
+]);
+function extraServiceFields(service) {
+  const extras = {};
+  for (const [key, value] of Object.entries({ ...service })) {
+    if (!OWNED_SERVICE_KEYS.has(key)) {
+      Reflect.set(extras, key, value);
+    }
+  }
+  return extras;
+}
+
 // src/server/utils/truncate-large-entries.ts
 var PREVIEW_LENGTH = 200;
 function createSizeBoundedSerializer(baseSerializer, maxBytes) {
@@ -894,36 +1323,188 @@ function createSizeBoundedSerializer(baseSerializer, maxBytes) {
 }
 
 // src/server/pino-factory.ts
+var PATH_SEGMENT = /\[\s*['"]([^'"]+)['"]\s*\]|([^.[\]]+)/g;
+var INDEX_SEGMENT = /^\d+$/;
+function leafNameOf(path2) {
+  let leaf;
+  for (const match of path2.matchAll(PATH_SEGMENT)) {
+    const quoted = match[1];
+    const name = quoted ?? (match[2] !== void 0 && INDEX_SEGMENT.test(match[2]) ? void 0 : match[2]);
+    if (name !== void 0 && name !== "*") {
+      leaf = name;
+    }
+  }
+  return leaf;
+}
+var DERIVED_ERROR_FIELDS = /* @__PURE__ */ new Set([
+  "name",
+  "message",
+  "stack",
+  "cause",
+  "errors"
+]);
+function serializeErrorValue(value_) {
+  const sanitized = sanitizeError(value_);
+  const serialized = {
+    // `type` rather than `name`: the field consumers already query.
+    type: sanitized.name,
+    message: sanitized.message
+  };
+  if (sanitized.stack !== void 0) {
+    serialized["stack"] = sanitized.stack;
+  }
+  if (sanitized.cause !== void 0) {
+    serialized["cause"] = sanitized.cause;
+  }
+  if (sanitized.errors !== void 0) {
+    serialized["errors"] = sanitized.errors;
+  }
+  try {
+    const source = (
+      // Stryker disable next-line ConditionalExpression: equivalent BY CONSTRUCTION, not untested — the never-throw catch below makes the mutant observationally identical: with the null check flipped to true, `Object.entries(null)` throws, the catch swallows it, and the emitted envelope is byte-for-byte the same. The guard stays because routing the ordinary null case through exception control flow would trade an explicit branch for a hidden one.
+      typeof value_ === "object" && value_ !== null && !Array.isArray(value_) ? value_ : {}
+    );
+    for (const [key, value] of Object.entries(source)) {
+      if (!Object.hasOwn(serialized, key) && !DERIVED_ERROR_FIELDS.has(key)) {
+        Reflect.set(serialized, key, value);
+      }
+    }
+  } catch {
+  }
+  return serialized;
+}
+function withSemconvException(record, format) {
+  if (format === "pino") {
+    return record;
+  }
+  try {
+    const candidate = record["err"];
+    if (typeof candidate?.name === "string") {
+      record["exception.type"] = candidate.name;
+      record["error.type"] = candidate.name;
+    }
+    if (typeof candidate?.message === "string") {
+      record["exception.message"] = candidate.message;
+    }
+    if (typeof candidate?.stack === "string") {
+      record["exception.stacktrace"] = scrubStack(candidate.stack);
+    }
+    if (format === "semconv") {
+      const withoutErr = {};
+      for (const [key, value] of Object.entries(record)) {
+        if (key !== "err") {
+          Reflect.set(withoutErr, key, value);
+        }
+      }
+      return withoutErr;
+    }
+  } catch {
+  }
+  return record;
+}
+function toEventName(logKey) {
+  return logKey.toLowerCase().replaceAll("_", ".");
+}
+function withEventName(record, field) {
+  if (field === false) {
+    return record;
+  }
+  const logKey = record["logKey"];
+  if (typeof logKey === "string" && logKey.length > 0) {
+    Reflect.set(record, field, toEventName(logKey));
+  }
+  return record;
+}
+var PASS_THROUGH = (value) => value;
+function resolveNameRedactor(options) {
+  if (options.redactStrategy !== "names") {
+    return PASS_THROUGH;
+  }
+  const names = [
+    ...options.shouldDisableDefaultRedact ? [] : REDACT_COMMON_FIELDS,
+    ...options.redactPaths.flatMap((path2) => leafNameOf(path2) ?? [])
+  ];
+  if (names.length === 0) {
+    return PASS_THROUGH;
+  }
+  return createNameRedactor(names, options.redactCensor);
+}
+function resolveRedactOption(options) {
+  const paths = options.redactStrategy === "paths" ? compileRedactPaths(options.redactPaths, options.shouldDisableDefaultRedact) : [...new Set(options.redactPaths)];
+  if (paths.length === 0) {
+    return void 0;
+  }
+  return { paths, censor: options.redactCensor };
+}
 function buildPinoInstance(options, logContext, destinations) {
   const maxBytes = options.maxEntrySizeBytes;
+  const redact = resolveNameRedactor(options);
+  const bound = (serializer) => createSizeBoundedSerializer((input) => redact(serializer(input)), maxBytes);
   const serializers = {
-    err: createSizeBoundedSerializer(pino.stdSerializers.err, maxBytes),
+    err: bound(serializeErrorValue),
     ...Object.fromEntries(
       Object.entries(options.serializers).map(
-        ([key, serializer]) => [
-          key,
-          createSizeBoundedSerializer(serializer, maxBytes)
-        ]
+        ([key, serializer]) => [key, bound(serializer)]
       )
     )
   };
+  const redactOption = resolveRedactOption(options);
   const pinoOptions = {
     level: options.level,
-    redact: {
-      paths: compileRedactPaths(options.redactPaths, options.shouldDisableDefaultRedact),
-      censor: options.redactCensor
-    },
-    base: { service: options.service },
+    ...redactOption === void 0 ? {} : { redact: redactOption },
+    // Resource identity, resolved ONCE here rather than per entry: Pino
+    // pre-serializes `base` into the instance's chindings, so the cost of the
+    // extra attributes is one string built at construction, not work per log.
+    base: buildResourceBindings(
+      resolveServiceMetadata(options.service),
+      options.resourceFormat,
+      extraServiceFields(options.service)
+    ),
     // Pino requires the timestamp fn to emit the `,"time":"..."` fragment.
     timestamp: () => `,"time":"${options.timestamp()}"`,
     formatters: {
       // Emit the level as a string label instead of the numeric code — easier
       // for log aggregators. Trace context is injected via `mixin`, never via
       // `formatters.log` (which cannot see ambient ALS / OTel state).
-      level: (label) => ({ level: label })
+      level: (label) => ({ level: label }),
+      // `base` bindings never reach `formatters.log` — Pino pre-serializes them
+      // into the instance's `chindings`, the same reason `child()` has to redact
+      // its own. That matters because `service` is CONSUMER-supplied and
+      // `applyDefaults` keeps whatever it was given: a `{ name, version, apiKey }`
+      // went out in clear, where the path expansion had covered it via `*.*.apiKey`.
+      // Redacting here rather than trimming to the two declared fields keeps a
+      // consumer's extra metadata instead of silently dropping it. Runs ONCE, at
+      // logger construction — no per-entry cost. `true`: bindings are a record
+      // root, iterated rather than serialized.
+      bindings: (bindings) => redact(bindings, true),
+      // The name-walk redactor runs here, on the merged record (mixin output +
+      // the caller's object), which is exactly the surface a caller controls.
+      // `base` and child bindings are NOT visible at this hook — they are
+      // library-owned (`service`, the `@InjectLogger` context) and carry nothing
+      // sensitive, which `pino-factory.spec.ts` pins.
+      log: (record) => withSemconvException(
+        withEventName(redact(record, true), options.eventNameField),
+        options.errorFormat
+      )
     },
     serializers,
-    mixin: createTraceContextMixin(logContext, options.otel)
+    mixin: createTraceContextMixin(logContext, options.otel),
+    // `formatters.log` is NOT the first code to touch the caller's object: Pino
+    // merges the mixin result with it first, and the default strategy's
+    // `Object.assign` invokes every own getter. A throwing getter therefore
+    // crashed the log call before the redactor could return its fail-closed
+    // envelope. Owning the merge moves that boundary inside the guarantee.
+    mixinMergeStrategy: (mergeObject, mixinObject) => {
+      try {
+        return Object.assign({}, mixinObject, mergeObject);
+      } catch {
+        return {
+          ...mixinObject,
+          _redactionFailed: true,
+          _logKey: RESERVED_LOG_KEYS.LOGGER_REDACTION_FAILED
+        };
+      }
+    }
   };
   const streams = destinations.map((destination) => ({
     level: destination.minLevel ?? options.level,
@@ -939,9 +1520,10 @@ var DestinationRegistry = class {
    * @param logger - Structured logger used to report init failures. Injected by
    *   token explicitly for the same bundling reason.
    */
-  constructor(registered, logger) {
+  constructor(registered, logger, options) {
     this.registered = registered;
     this.logger = logger;
+    this.options = options;
     /**
      * Destinations that initialized successfully, in registration order.
      *
@@ -973,6 +1555,43 @@ var DestinationRegistry = class {
         );
       }
     }
+    this.announceBootstrap();
+  }
+  /**
+   * Emit the one-shot bootstrap entries, AFTER every destination has been
+   * initialized.
+   *
+   * Ordering is the whole point of doing this here rather than from an eagerly
+   * instantiated provider factory: a provider factory runs while Nest is still
+   * building the graph, before `onModuleInit`, so a sink that only accepts
+   * writes once its own `onInit()` has run would drop these entries — including
+   * `LOGGER_BOOTSTRAP_WARNING`, which exists precisely so a security review can
+   * see that PII redaction was turned off. A signal that a custom destination
+   * can silently swallow is not an audit trail. Emitting from the registry that
+   * owns destination initialization makes the ordering structural instead of a
+   * cross-provider hook-order assumption.
+   */
+  announceBootstrap() {
+    this.logger.info(RESERVED_LOG_KEYS.LOGGER_BOOTSTRAP_OK, "BymaxLoggerModule initialized");
+    if (this.options.shouldDisableDefaultRedact) {
+      this.logger.warnStructured(
+        RESERVED_LOG_KEYS.LOGGER_BOOTSTRAP_WARNING,
+        "Default PII redaction is DISABLED \u2014 sensitive fields will be logged verbatim unless every one of them is listed in options.redactPaths",
+        void 0,
+        {
+          shouldDisableDefaultRedact: true,
+          redactPathCount: this.options.redactPaths.length
+        }
+      );
+    }
+    if (this.options.otel.shouldAutoInjectTraceContext && detectOtelTraceApi() === void 0) {
+      this.logger.warnStructured(
+        RESERVED_LOG_KEYS.LOGGER_BOOTSTRAP_WARNING,
+        "Trace-context auto-injection is enabled but @opentelemetry/api could not be resolved \u2014 traceId and spanId will be absent from every entry",
+        void 0,
+        { reason: "OTEL_API_UNAVAILABLE", shouldAutoInjectTraceContext: true }
+      );
+    }
   }
   /**
    * Flush and close active destinations in REVERSE registration order, so a
@@ -981,6 +1600,15 @@ var DestinationRegistry = class {
    * point in the shutdown sequence.
    */
   async onApplicationShutdown() {
+    this.logger.info(
+      RESERVED_LOG_KEYS.LOGGER_SHUTDOWN_OK,
+      "BymaxLoggerModule shutting down",
+      void 0,
+      { destinations: this.active.length }
+    );
+    await new Promise((resolve) => {
+      setImmediate(resolve);
+    });
     for (const destination of [...this.active].reverse()) {
       try {
         await destination.onShutdown?.();
@@ -1005,9 +1633,10 @@ var DestinationRegistry = class {
 DestinationRegistry = __decorateClass([
   Injectable(),
   __decorateParam(0, Inject(LOGGER_DESTINATIONS_TOKEN)),
-  __decorateParam(1, Inject(PinoLoggerService))
+  __decorateParam(1, Inject(PinoLoggerService)),
+  __decorateParam(2, Inject(LOGGER_OPTIONS_TOKEN))
 ], DestinationRegistry);
-var FORBIDDEN_CONTEXT_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+var FORBIDDEN_CONTEXT_KEYS = PROTOTYPE_POLLUTING_KEYS;
 var LogContextService = class {
   constructor() {
     this.als = new AsyncLocalStorage();
@@ -1093,24 +1722,21 @@ LogContextService = __decorateClass([
 ], LogContextService);
 
 // src/server/logger.module.ts
-var LOGGER_BOOTSTRAP_TOKEN = /* @__PURE__ */ Symbol("BYMAX_LOGGER_BOOTSTRAP");
 function resolveDestinations(options) {
   return options.destinations.length > 0 ? options.destinations : [new DefaultStdoutDestination()];
 }
-function bootstrapProvider() {
-  return {
-    provide: LOGGER_BOOTSTRAP_TOKEN,
-    useFactory: (logger) => {
-      logger.info(RESERVED_LOG_KEYS.LOGGER_BOOTSTRAP_OK, "BymaxLoggerModule initialized");
-      return true;
-    },
-    inject: [PinoLoggerService]
-  };
-}
 function buildCommonProviders() {
   return [
     LogContextService,
     { provide: LOG_CONTEXT_TOKEN, useExisting: LogContextService },
+    {
+      // The DEFAULT-coverage redactor, shared by the Pino factory's hooks and by
+      // `PinoLoggerService.child()`. The latter needs it as a provider because
+      // Pino pre-serializes child bindings before `formatters.log` can see them.
+      provide: LOGGER_REDACTOR_TOKEN,
+      useFactory: (options) => resolveNameRedactor(options),
+      inject: [LOGGER_OPTIONS_TOKEN]
+    },
     {
       provide: LOGGER_PINO_INSTANCE_TOKEN,
       useFactory: (options, logContext, destinations) => buildPinoInstance(options, logContext, destinations),
@@ -1126,8 +1752,7 @@ function buildCommonProviders() {
     // exported — consumers never inject it directly.
     DestinationRegistry,
     // One child-logger provider per context discovered from @InjectLogger(context).
-    ...collectContextLoggerProviders(),
-    bootstrapProvider()
+    ...collectContextLoggerProviders()
   ];
 }
 function asyncHttpInterceptorProvider() {
@@ -1147,6 +1772,7 @@ function augmentLoggerModule(base, providers) {
       LOGGER_OPTIONS_TOKEN,
       LOGGER_PINO_INSTANCE_TOKEN,
       LOGGER_DESTINATIONS_TOKEN,
+      LOGGER_REDACTOR_TOKEN,
       LOG_CONTEXT_TOKEN,
       LogContextService,
       PinoLoggerService,
@@ -1337,6 +1963,126 @@ var PrettyDevDestination = class {
     });
   }
 };
+var HttpAccessLogMiddleware = class {
+  /**
+   * @param logger - The structured logger the access entries are written to.
+   *   Injected by token explicitly: the package is bundled without
+   *   `emitDecoratorMetadata`, so implicit class-type injection would not resolve.
+   * @param options - Resolved module options (read for `http.excludePaths`).
+   */
+  constructor(logger, logContext, options) {
+    this.logger = logger;
+    this.logContext = logContext;
+    this.isEnabled = options.http.isEnabled;
+    this.excludePaths = options.http.excludePaths;
+  }
+  /**
+   * Emit START, arm the terminal entry on `'close'`, and continue the chain.
+   *
+   * @param req - The incoming request (Express satisfies the contract).
+   * @param res - The outgoing response (Express satisfies the contract).
+   * @param next - The next handler in the chain.
+   */
+  use(req, res, next) {
+    if (!this.isEnabled) {
+      next();
+      return;
+    }
+    const target = req.originalUrl ?? req.url;
+    const path2 = stripQueryString(target);
+    if (this.excludePaths.some((pattern) => pattern.test(path2))) {
+      next();
+      return;
+    }
+    markRecorderActive(req);
+    const method = req.method;
+    const url = normalizeUrl(target);
+    const start = Date.now();
+    this.logger.info(RESERVED_LOG_KEYS.HTTP_REQUEST_START, `${method} ${url}`, readUserId(req), {
+      method,
+      url,
+      // Query string stripped: it may carry secrets (reset tokens, OAuth codes)
+      // that no key-name redaction can scrub out of a string VALUE.
+      fullUrl: path2,
+      // Conventional for an access log and personal data under GDPR/LGPD. Its
+      // fidelity is the app's to establish: behind a proxy it is only the real
+      // client when the app configures `trust proxy`, and a value the app has not
+      // established is attacker-chosen. Suppress with `redactPaths: ['ip']`.
+      ip: req.ip,
+      userAgent: readUserAgent(req)
+    });
+    const emitTerminal = () => {
+      this.logTerminal(req, res, method, url, Date.now() - start);
+    };
+    const bound = AsyncResource.bind(emitTerminal);
+    res.on("close", () => {
+      if (this.logContext.getStore() !== void 0) {
+        emitTerminal();
+      } else {
+        bound();
+      }
+    });
+    next();
+  }
+  /**
+   * Emit the terminal entry for a closed request.
+   *
+   * `userId` is read HERE rather than at START because authentication runs in a
+   * guard, downstream of this middleware — at START there is no principal yet.
+   *
+   * @param req - The request, carrying any error the interceptor recorded.
+   * @param res - The closed response.
+   * @param method - The HTTP method.
+   * @param url - The normalized request URL.
+   * @param duration - Elapsed milliseconds.
+   */
+  logTerminal(req, res, method, url, duration) {
+    const statusCode = res.statusCode;
+    const userId = readUserId(req);
+    const meta = { method, url, statusCode, duration };
+    if (!res.writableFinished) {
+      this.logger.warnStructured(
+        RESERVED_LOG_KEYS.HTTP_REQUEST_ABORTED,
+        `${method} ${url} \u2192 ${statusCode} not delivered (${duration}ms)`,
+        userId,
+        meta
+      );
+      return;
+    }
+    if (statusCode >= HTTP_SERVER_ERROR_MIN) {
+      const recorded = readRecordedError(req);
+      this.logger.errorStructured(
+        RESERVED_LOG_KEYS.HTTP_REQUEST_SERVER_ERROR,
+        recorded?.error ?? new Error(`${method} ${url} \u2192 ${statusCode}`),
+        userId,
+        meta
+      );
+      return;
+    }
+    if (statusCode >= HTTP_CLIENT_ERROR_MIN) {
+      const recorded = readRecordedError(req);
+      this.logger.warnStructured(
+        RESERVED_LOG_KEYS.HTTP_REQUEST_CLIENT_ERROR,
+        `${method} ${url} \u2192 ${statusCode}`,
+        userId,
+        recorded === void 0 ? meta : { ...meta, errorMessage: recorded.error.message }
+      );
+      return;
+    }
+    this.logger.info(
+      statusCode >= HTTP_REDIRECT_MIN ? RESERVED_LOG_KEYS.HTTP_REQUEST_REDIRECT : RESERVED_LOG_KEYS.HTTP_REQUEST_SUCCESS,
+      `${method} ${url} \u2192 ${statusCode} (${duration}ms)`,
+      userId,
+      meta
+    );
+  }
+};
+HttpAccessLogMiddleware = __decorateClass([
+  Injectable(),
+  __decorateParam(0, Inject(PinoLoggerService)),
+  __decorateParam(1, Inject(LogContextService)),
+  __decorateParam(2, Inject(LOGGER_OPTIONS_TOKEN))
+], HttpAccessLogMiddleware);
 var REQUEST_ID_HEADER = "x-request-id";
 var MAX_CORRELATION_ID_LENGTH = 256;
 var CORRELATION_ID_CHARSET = /^[A-Za-z0-9._:/+=-]+$/;
@@ -1387,9 +2133,9 @@ RequestIdMiddleware = __decorateClass([
 ], RequestIdMiddleware);
 
 // src/server/middlewares/apply-request-id-middleware.ts
-var ALL_ROUTES = "*";
+var ALL_ROUTES = "/";
 function applyRequestIdMiddleware(consumer, routes = ALL_ROUTES) {
-  consumer.apply(RequestIdMiddleware).forRoutes(routes);
+  consumer.apply(RequestIdMiddleware, HttpAccessLogMiddleware).forRoutes(routes);
 }
 var INJECT_LOGGER_CONTEXT_METADATA_KEY = "bymax_logger:context";
 function InjectLogger(context) {
@@ -1452,4 +2198,4 @@ function LogPerformance(thresholdMs = DEFAULT_THRESHOLD_MS) {
 // src/shared/constants/log-keys-convention.constants.ts
 var LOG_KEYS_CONVENTION_REGEX = /^[A-Z][A-Z0-9_]+_[A-Z][A-Z0-9_]+(_[A-Z][A-Z0-9_]+)?$/;
 
-export { BymaxLoggerModule, DEFAULT_REDACT_PATHS, DefaultStdoutDestination, HttpExceptionFilter, HttpLoggingInterceptor, InjectLogger, LOGGER_DESTINATIONS_TOKEN, LOGGER_OPTIONS_TOKEN, LOGGER_PINO_INSTANCE_TOKEN, LOG_CONTEXT_METADATA_KEY, LOG_CONTEXT_TOKEN, LOG_KEYS_CONVENTION_REGEX, LogContext, LogContextService, LogPerformance, PinoLoggerService, PrettyDevDestination, RESERVED_LOG_KEYS, RequestIdMiddleware, applyRequestIdMiddleware };
+export { BymaxLoggerModule, DEFAULT_REDACT_PATHS, DefaultStdoutDestination, HttpExceptionFilter, HttpLoggingInterceptor, InjectLogger, LOGGER_DESTINATIONS_TOKEN, LOGGER_OPTIONS_TOKEN, LOGGER_PINO_INSTANCE_TOKEN, LOG_CONTEXT_METADATA_KEY, LOG_CONTEXT_TOKEN, LOG_KEYS_CONVENTION_REGEX, LogContext, LogContextService, LogPerformance, PINO_LEVEL_NAMES, PINO_LEVEL_NUMBERS, PinoLoggerService, PrettyDevDestination, RESERVED_LOG_KEYS, RESERVED_LOG_KEYS_NOT_EMITTED, RequestIdMiddleware, applyRequestIdMiddleware };