@bymax-one/nest-logger 1.2.5 → 1.2.6

package/CHANGELOG.md

@@ -11,6 +11,122 @@ heading here.
 
 ## [Unreleased]
 
+## [1.2.6] - 2026-08-15
+
+### Added
+
+- **`PrettyDevDestination` takes a `view`, so the terminal rendering is the consumer's choice.**
+  Requested with the measurement that makes the case — one real entry rendered three ways through
+  `pino-pretty`, where only the options differ:
+
+  ```
+  A) the built-in view                                   7 lines for one entry
+  B) singleLine + an extended ignore list                1 line, fields kept
+  C) hideObject + messageFormat '[{context}] {msg}'      1 line, message only
+  ```
+
+  All of it was reachable in `pino-pretty` and none of it was reachable through this library, which
+  hard-coded five options and read only `minLevel` from its constructor.
+
+  ```ts
+  new PrettyDevDestination({
+    view: { singleLine: true, ignore: 'pid,hostname,service,deployment,event.name' }
+  })
+  ```
+
+  `PrettyViewOptions` covers `singleLine`, `ignore`, `hideObject`, `messageFormat`, `translateTime`
+  and `colorize`. **Additive** — every field defaults to what it rendered before, so
+  `new PrettyDevDestination()` is unchanged.
+
+  **`destination` is deliberately not exposed.** The library owns where entries go; a redirected
+  stream would route around the multistream fan-out and the last-resort rescue. It is absent from
+  the type AND applied after the consumer's options are spread, so an untyped JavaScript caller
+  cannot smuggle one in either — omitting it from a type is a suggestion, ordering the spread is the
+  guarantee.
+
+  The options bag is this library's **own** interface rather than `pino-pretty`'s `PrettyOptions`,
+  and that is load-bearing rather than stylistic: a type import from the peer emits a hard
+  `import { PrettyOptions } from 'pino-pretty'` on line 4 of the published `.d.ts`, so every consumer
+  who type-checks without the optional peer installed would hit an unresolved module. That would make
+  an optional peer effectively required. Measured on the built artifact.
+
+### Fixed
+
+- **Entries emitted before the pretty transform exists are now rendered, not dumped raw.** A real
+  boot put **43 raw NDJSON lines on screen before the first rendered one** — every entry NestJS emits
+  while instantiating providers, because the transform cannot be built until `onInit` (loading the
+  optional peer is async). Nothing was ever lost, but a developer who had just enabled pretty output
+  saw a screen of JSON and concluded it had not worked. That is what was reported.
+
+  Those entries are now held and flushed **through** the transform once it exists, in arrival order.
+  Nothing is lost on any path, which is the property the raw passthrough had and the buffer had to
+  keep:
+
+  - **init fails** → the held entries are drained raw, because the renderer they were waiting for is
+    never coming;
+  - **a bound is reached** (1000 entries or 4 MiB, whichever trips first — nothing guarantees
+    `onInit` ever runs) → the buffer drains raw _before_ the entry that tripped it, so output stays
+    in order rather than replaying old entries after newer ones;
+  - **shutdown before init** → drained raw rather than dying with the process.
+
+  The byte ceiling is there because the entry count alone does not bound memory: a payload has no
+  whole-record size limit (`maxEntrySizeBytes` bounds what a serializer emits for one field, not the
+  entry), so 1000 held entries carrying large metadata could retain far more than the count suggests
+  — where the raw passthrough this buffer replaced retained nothing at all.
+
+- **A closed pipe can no longer crash the host, which the `try/catch` around
+  `process.stdout.write` never actually prevented.** Every fallback path in this library — the
+  last-resort NDJSON rescue, the pre-init drain, the destination failure reports — wrapped its raw
+  write in a `try/catch` and documented that as EPIPE protection. It is not, and this was measured
+  rather than argued:
+
+  ```
+  stdout error listeners at start: 0
+  sync result: no-throw          ← the try/catch caught nothing
+  UNCAUGHT:EPIPE                 ← arrived later, as an uncaught exception
+  child exit code: 42            ← the process died
+  ```
+
+  A closed pipe (`node app | head`) reports EPIPE **asynchronously**, through the stream's `'error'`
+  event, after `write()` has already returned. Node attaches no default handler, so the emit becomes
+  an uncaught exception. The guarantee was asserted in prose and absent from the code, on exactly the
+  paths whose purpose is to survive a broken sink.
+
+  Every library-owned write to a process stream now goes through one `safe-stdio` helper that
+  installs a swallow-EPIPE handler on first use, covering the asynchronous half; the `try/catch`
+  remains for the synchronous half, since either alone leaves a way to die. The handler is found by
+  identity rather than remembered, so anything that strips listeners from a process stream cannot
+  silently disable the protection permanently.
+
+  **This includes `DefaultStdoutDestination`, and that is the half that actually mattered.** The
+  first version of the fix guarded only the fallback paths — the rescue, the drain, the failure
+  reports — none of which a healthy application ever takes. The default sink, which is what a
+  consumer gets when they configure nothing, still called `process.stdout.write` directly, so the
+  ordinary install was exactly as crashable as before. Caught in review and then reproduced against
+  the built artifact: `0` listeners, no synchronous throw, `UNCAUGHT:EPIPE`, exit 42. Re-measured
+  after the fix: survived, exit 0.
+
+  `PrettyDevDestination` is deliberately **not** guarded by this library. `pino-pretty` receives
+  `process.stdout` and attaches two `'error'` listeners of its own; a child piped to a closed reader
+  survived and exited 0 with nothing from us on the stream, so a guard there would be code whose
+  need is disproven. A test pins that, and goes red if `pino-pretty` ever stops attaching them.
+
+  One consequence worth stating rather than burying: after the first log line, `process.stdout` has a
+  swallowing `'error'` listener that belongs to this library, so an EPIPE raised by **your** writes
+  to stdout also stops being an uncaught exception. That is the trade — the alternative is the crash
+  above — and your own `'error'` listener is never removed or replaced.
+
+  Reported by Copilot against the new pre-init buffer, then a second time against the incomplete
+  fix; the same ineffective pattern was already shipped in `1.2.3` and `1.2.5`, so this corrects
+  those paths too.
+
+- **A write after a failed init is verifiably dropped, not merely silent.** Adding the buffer made
+  "dropped" and "held" observationally identical — the existing case asserted only that nothing
+  reached stdout, and buffering produces the same silence. A **cold** mutation run caught it
+  (the incremental runs had been reporting 100% while the cold run read 99.62%, with all three
+  survivors in this file). The case now shuts down after the failed init, which drains anything
+  still held: a merely-buffered entry surfaces there, a dropped one does not.
+
 ## [1.2.5] - 2026-08-14
 
 ### Fixed
@@ -1014,7 +1130,8 @@ published `dist/` is identical — no runtime behaviour changes for consumers.
 - Professional CI suite: `ci.yml`, `bench.yml`, `codeql.yml`, `scorecard.yml`,
   `release.yml`, Dependabot, and issue templates
 
-[Unreleased]: https://github.com/bymaxone/nest-logger/compare/v1.2.5...HEAD
+[Unreleased]: https://github.com/bymaxone/nest-logger/compare/v1.2.6...HEAD
+[1.2.6]: https://github.com/bymaxone/nest-logger/compare/v1.2.5...v1.2.6
 [1.2.5]: https://github.com/bymaxone/nest-logger/compare/v1.2.4...v1.2.5
 [1.2.4]: https://github.com/bymaxone/nest-logger/compare/v1.2.3...v1.2.4
 [1.2.3]: https://github.com/bymaxone/nest-logger/compare/v1.2.2...v1.2.3

package/README.md

@@ -60,7 +60,7 @@ pnpm add @bymax-one/nest-logger
 - ✅ **Structured JSON** — every entry has `level`, `time`, `service`, `logKey`, `msg`, and arbitrary metadata fields
 - ✅ **`MODULE_ACTION_RESULT` Log Keys** — a naming convention enforced by an exported regex for CI validation
 - ✅ **NestJS `LoggerService` Bridge** — drop-in replacement; all NestJS internal logs flow through Pino
-- ✅ **Pretty-Print in Dev** — opt-in `PrettyDevDestination` for readable local output (requires optional `pino-pretty`)
+- ✅ **Pretty-Print in Dev** — opt-in `PrettyDevDestination` with a configurable `view` (single-line, hidden fields, message-only) for readable local output (requires optional `pino-pretty`)
 - ✅ **Field Size Guard** — a serialized field over the ceiling (default 64 KB) is replaced by a compact truncation envelope instead of flooding the sink
 
 ### 🛡️ Security & Privacy
@@ -753,6 +753,39 @@ The consequence worth knowing: a sink you supply may be the **only** one the app
 
 So the common accident — adding `new PrettyDevDestination()` without installing the optional `pino-pretty` — costs you colours and a line on stderr telling you why, never your logs.
 
+### Choosing how the dev terminal renders
+
+`PrettyDevDestination` takes a `view`. Every field defaults to what it rendered before, so `new PrettyDevDestination()` is unchanged — the options exist because the default view is deliberately verbose, and one entry can be seven lines.
+
+```typescript
+// One line per entry, with the fields your project repeats on every line hidden.
+new PrettyDevDestination({
+  view: { singleLine: true, ignore: 'pid,hostname,service,deployment,event.name' }
+})
+
+// Message only, with the context pulled back into the line.
+new PrettyDevDestination({
+  view: { hideObject: true, messageFormat: '[{context}] {msg}' }
+})
+```
+
+| Field           | Default                  | Notes                                                                        |
+| --------------- | ------------------------ | ---------------------------------------------------------------------------- |
+| `singleLine`    | `false`                  | The single biggest change to how a terminal reads                            |
+| `ignore`        | `'pid,hostname,service'` | Display-only — what a real sink receives is untouched                        |
+| `hideObject`    | `false`                  | Hides the record entirely; see the caveat below                              |
+| `messageFormat` | —                        | e.g. `'[{context}] {msg}'`; how to keep one field visible under `hideObject` |
+| `translateTime` | `'SYS:HH:MM:ss.l'`       | Or `false` for the raw timestamp                                             |
+| `colorize`      | `true`                   | ANSI colour                                                                  |
+
+> **`hideObject` hides it everywhere.** In pretty mode there is no JSON copy behind the rendering, because `destinations` **replaces** stdout — so a field hidden here, `logKey` included, is not visible anywhere. That is what the option is for; `messageFormat` is how you pull a specific field back.
+
+The shape is exported as `PrettyViewOptions` when you want to build the view separately — it is this library's own interface, not a re-export of `pino-pretty`'s `PrettyOptions`, so type-checking without the optional peer installed still resolves.
+
+> **`destination` is not exposed, by design.** The library owns where entries go — a redirected stream would route around the fan-out and the last-resort rescue above. It is absent from the type and applied after your options are merged, so it cannot be overridden from untyped JavaScript either.
+
+**The first entries of a boot are held, not lost.** The transform cannot exist until `onInit` — loading the optional peer is async — so everything NestJS emits while instantiating providers arrives before it. Those entries are buffered and then rendered through the transform in arrival order. If the peer is missing, the bound is reached, or the app shuts down before init, they are written as raw NDJSON instead: degraded, never dropped.
+
 ### Postgres destination (Prisma)
 
 ```typescript
@@ -975,6 +1008,14 @@ Trace context is never copied verbatim into a log entry. The OTel mixin reads th
 
 Every `write()` runs inside a try/catch. A destination that throws or rejects produces a `LOGGER_DESTINATION_WRITE_FAILED` line on `stderr` — never back through the logger, which would turn a broken sink into a write → log → write feedback loop — and the entry is dropped for that sink only. A destination whose `onInit()` rejects is reported as `LOGGER_DESTINATION_INIT_FAILED` and excluded from the shutdown sequence without blocking boot; it stays in the write fan-out, where the same fail-soft wrapper contains it. A logging backend going down degrades logging — it never takes the application with it.
 
+### A closed pipe does not kill the process
+
+`node app | head` closes the read end of stdout while the application is still writing. The stream reports that as `EPIPE` **asynchronously**, through its `'error'` event, after `write()` has already returned — so a `try/catch` around the write catches nothing, and because Node attaches no default handler to `process.stdout`, the emit becomes an uncaught exception and the process dies. Measured, not assumed: `0` listeners, no synchronous throw, `UNCAUGHT:EPIPE`, exit 42.
+
+Every write this library makes to a process stream — the default stdout sink, the last-resort rescue, the pre-init drain, the `stderr` failure reports — installs a swallowing `'error'` listener on first use. **The side effect is worth knowing:** that listener is on the shared `process.stdout`, so after the first log line an EPIPE raised by _your_ writes stops being an uncaught exception too. The alternative is the crash above. Your own `'error'` listener is never removed or replaced — this only ever adds one.
+
+If you write to `process.stdout` from a custom `ILogDestination`, do the same in your own sink; the [destinations guide](./docs/guidelines/DESTINATIONS-IMPLEMENTATION-GUIDELINES.md) has the exact pattern.
+
 ### Bounded field size
 
 Every serializer — the default `err` one and any you supply — is wrapped so a field whose serialized JSON exceeds `maxEntrySizeBytes` (64 KB by default) is replaced by a compact envelope: `_truncated`, `_logKey: 'LOGGER_ENTRY_TRUNCATED'`, `_originalSize`, and a 200-character `_preview`. An accidentally logged webhook payload costs a bounded number of bytes and leaves a record that truncation happened, instead of flooding the sink.

package/dist/server/index.cjs

@@ -586,6 +586,30 @@ function collectContextLoggerProviders() {
 function collectContextLoggerTokens() {
   return Array.from(contextTokens.values());
 }
+
+// src/server/utils/safe-stdio.util.ts
+var swallowStreamError = () => void 0;
+function ensureGuarded(stream) {
+  if (stream.listeners("error").includes(swallowStreamError)) {
+    return;
+  }
+  stream.on("error", swallowStreamError);
+}
+function writeSafely(stream, payload) {
+  try {
+    ensureGuarded(stream);
+    stream.write(payload);
+  } catch {
+  }
+}
+function writeStdoutSafely(payload) {
+  writeSafely(process.stdout, payload);
+}
+function writeStderrSafely(line) {
+  writeSafely(process.stderr, line);
+}
+
+// src/server/destinations/default-stdout.destination.ts
 exports.DefaultStdoutDestination = class DefaultStdoutDestination {
   /**
    * @param opts.minLevel — Optional minimum level filter. Entries below this
@@ -600,9 +624,17 @@ exports.DefaultStdoutDestination = class DefaultStdoutDestination {
   }
   /**
    * Write a serialized JSON log entry (terminated with `\n`) to `stdout`.
+   *
+   * Routed through {@link writeStdoutSafely} rather than calling
+   * `process.stdout.write` directly. This is the sink a consumer gets when they
+   * configure nothing, so it is the path that decides whether a closed pipe
+   * (`node app | head`) kills the application — and unguarded, it did: EPIPE
+   * arrives asynchronously through the stream's `'error'` event, Node attaches no
+   * default handler, and the emit becomes an uncaught exception. Measured on the
+   * built artifact, exit code 42.
    */
   write(payload) {
-    process.stdout.write(payload);
+    writeStdoutSafely(payload);
   }
 };
 exports.DefaultStdoutDestination = __decorateClass([
@@ -1034,7 +1066,7 @@ function reportDestinationFailure(logKey, name, cause, msg) {
       type: toSingleLineMessage(String(cause.name)),
       message: toSingleLineMessage(String(cause.message))
     } : { type: "UnknownError", message: toSingleLineMessage(String(cause)) };
-    process.stderr.write(
+    writeStderrSafely(
       JSON.stringify({
         level: "error",
         logKey,
@@ -1057,10 +1089,7 @@ function reportWriteFailure(name, cause) {
   );
 }
 function rescueToStdout(payload) {
-  try {
-    process.stdout.write(payload);
-  } catch {
-  }
+  writeStdoutSafely(payload);
 }
 function destinationToStream(destination, health) {
   return new stream.Writable({
@@ -1757,7 +1786,7 @@ var DestinationRegistry = class {
         await destination.onShutdown?.();
       } catch (cause) {
         const detail = cause instanceof Error ? cause.stack ?? cause.message : String(cause);
-        process.stderr.write(
+        writeStderrSafely(
           `[DestinationRegistry] Shutdown failed for "${destination.name}": ${detail}
 `
         );
@@ -2037,23 +2066,60 @@ exports.BymaxLoggerModule = __decorateClass([
 ], exports.BymaxLoggerModule);
 
 // src/server/destinations/pretty-dev.destination.ts
+var DEFAULT_VIEW = {
+  colorize: true,
+  translateTime: "SYS:HH:MM:ss.l",
+  ignore: "pid,hostname,service",
+  singleLine: false
+};
+var MAX_BUFFERED_ENTRIES = 1e3;
+var MAX_BUFFERED_BYTES = 4 * 1024 * 1024;
+function writeRawToStdout(payload) {
+  writeStdoutSafely(payload);
+}
 var PrettyDevDestination = class {
   /**
    * @param opts.minLevel — Optional minimum level filter applied by the
    *   destination registry's multi-stream wiring. Omit to accept every level.
+   * @param opts.view — Optional rendering overrides; see {@link PrettyViewOptions}.
+   *   Omitted fields keep their default, so `new PrettyDevDestination()` renders
+   *   exactly as it did before this option existed.
    */
   constructor(opts = {}) {
     this.name = "pretty-dev";
     /**
      * Set when {@link onInit} fails (e.g. `pino-pretty` absent). Distinguishes a
      * permanently-failed destination — whose writes are DROPPED, since the registry
-     * dropped it from the active set — from the transient pre-init window, where
-     * {@link write} falls back to raw stdout so a bootstrap log is not lost.
+     * dropped it from the active set — from the transient pre-init window.
      */
     this.initFailed = false;
+    /**
+     * Entries written before {@link onInit} built the transform, held so they can be
+     * RENDERED rather than printed raw.
+     *
+     * The transform cannot exist earlier: loading the optional peer is async, and
+     * `onInit` is the first moment the lifecycle offers. Before this buffer those
+     * entries went to stdout as raw NDJSON — correct, nothing lost, but a real boot
+     * put dozens of JSON lines on screen before the first rendered one, and a
+     * developer who had just turned pretty on reasonably concluded it had not
+     * worked. Reported from exactly that reading.
+     */
+    this.buffer = [];
+    /**
+     * Set once {@link MAX_BUFFERED_ENTRIES} is reached. From then on entries go
+     * straight to raw stdout — and the buffer is drained raw at the same moment, so
+     * the output stays in ORDER rather than replaying old entries after newer ones.
+     */
+    this.bufferOverflowed = false;
+    /**
+     * UTF-8 size of everything currently held, tracked incrementally so the bound
+     * costs one `Buffer.byteLength` per entry rather than a walk of the buffer.
+     */
+    this.bufferedBytes = 0;
     if (opts.minLevel !== void 0) {
       this.minLevel = opts.minLevel;
     }
+    this.view = opts.view ?? {};
   }
   /**
    * Lazily resolve `pino-pretty` and build the colorized transform that renders
@@ -2066,18 +2132,31 @@ var PrettyDevDestination = class {
     try {
       const { build } = await import('pino-pretty');
       this.stream = build({
-        colorize: true,
-        translateTime: "SYS:HH:MM:ss.l",
-        ignore: "pid,hostname,service",
-        singleLine: false,
+        ...DEFAULT_VIEW,
+        ...this.view,
+        // AFTER the consumer's view, deliberately. Omitting `destination` from
+        // `PrettyViewOptions` states that the library owns the sink; applying it
+        // last is what ENFORCES it, including against an untyped caller reaching
+        // in from JavaScript. A redirected stream would route around the fan-out
+        // and the last-resort rescue.
         destination: process.stdout
       });
     } catch {
       this.initFailed = true;
+      this.flushBuffer((payload) => {
+        writeRawToStdout(payload);
+      });
       throw new Error(
         "[PrettyDevDestination] pino-pretty is not installed. Install it as a peer dependency (`pnpm add -D pino-pretty`) or remove PrettyDevDestination from `destinations`."
       );
     }
+    this.flushBuffer((payload) => {
+      try {
+        this.stream?.write(payload);
+      } catch {
+        writeRawToStdout(payload);
+      }
+    });
   }
   /**
    * Write a serialized NDJSON entry to the pretty transform.
@@ -2088,8 +2167,10 @@ var PrettyDevDestination = class {
    *     fan-out already skips a failed destination before reaching this method
    *     (and rescues the entry when nothing else initialized); this branch is the
    *     belt to that, for any caller holding the destination directly;
-   *   - pre-init (transient window before {@link onInit}, e.g. a bootstrap log)
-   *     → fall back to raw stdout so the entry is not lost.
+   *   - pre-init (transient window before {@link onInit}, e.g. every entry NestJS
+   *     emits while instantiating providers) → BUFFERED, then rendered through
+   *     the transform once it exists. Nothing is lost on any path: if init fails
+   *     the buffer is drained raw, and if it overflows it is drained raw in order.
    *
    * @param payload — Newline-terminated JSON entry, UTF-8 encoded.
    */
@@ -2101,7 +2182,36 @@ var PrettyDevDestination = class {
     if (this.initFailed) {
       return;
     }
-    process.stdout.write(payload);
+    if (this.bufferOverflowed) {
+      writeRawToStdout(payload);
+      return;
+    }
+    const payloadBytes = Buffer.byteLength(payload, "utf8");
+    if (this.buffer.length >= MAX_BUFFERED_ENTRIES || this.bufferedBytes + payloadBytes > MAX_BUFFERED_BYTES) {
+      this.bufferOverflowed = true;
+      this.flushBuffer(writeRawToStdout);
+      writeRawToStdout(payload);
+      return;
+    }
+    this.buffer.push(payload);
+    this.bufferedBytes += payloadBytes;
+  }
+  /**
+   * Hand every buffered entry to `emit`, in arrival order, and empty the buffer.
+   *
+   * Emptying unconditionally is what makes this safe to call from both the
+   * success and failure paths: whichever runs first owns the entries, and the
+   * other finds nothing to emit twice.
+   *
+   * @param emit - Receives each buffered payload, oldest first.
+   */
+  flushBuffer(emit) {
+    const held = this.buffer;
+    this.buffer = [];
+    this.bufferedBytes = 0;
+    for (const payload of held) {
+      emit(payload);
+    }
   }
   /**
    * Flush and close the pretty transform, resolving once the stream has ended.
@@ -2110,6 +2220,7 @@ var PrettyDevDestination = class {
   async onShutdown() {
     const stream = this.stream;
     if (stream === void 0) {
+      this.flushBuffer(writeRawToStdout);
       return;
     }
     await new Promise((resolve, reject) => {

package/dist/server/index.d.cts

@@ -864,28 +864,104 @@ declare class DefaultStdoutDestination implements ILogDestination {
     });
     /**
      * Write a serialized JSON log entry (terminated with `\n`) to `stdout`.
+     *
+     * Routed through {@link writeStdoutSafely} rather than calling
+     * `process.stdout.write` directly. This is the sink a consumer gets when they
+     * configure nothing, so it is the path that decides whether a closed pipe
+     * (`node app | head`) kills the application — and unguarded, it did: EPIPE
+     * arrives asynchronously through the stream's `'error'` event, Node attaches no
+     * default handler, and the emit becomes an uncaught exception. Measured on the
+     * built artifact, exit code 42.
      */
     write(payload: string): void;
 }
 
+/**
+ * How the development terminal renders an entry — a VIEW over the record, never
+ * a change to it. Every field maps to the `pino-pretty` option of the same name.
+ *
+ * Declared here rather than reusing `pino-pretty`'s own `PrettyOptions`, and the
+ * reason is load-bearing: a type import from the peer emits a hard
+ * `import { PrettyOptions } from 'pino-pretty'` at the top of the published
+ * `.d.ts`, so every consumer who type-checks WITHOUT the optional peer installed
+ * would hit an unresolved module. That would make an optional peer effectively
+ * required — a worse regression than the missing options, and the same
+ * contradiction this library already refused when asked to hard-fail on a missing
+ * peer. Measured on the built artifact, not assumed.
+ *
+ * `destination` is deliberately absent. The library owns where entries go; a
+ * consumer redirecting the stream would route around the multistream fan-out and
+ * the last-resort rescue. Omitting it from this type states the intent — applying
+ * the library's own value AFTER the spread in {@link PrettyDevDestination.onInit}
+ * is what enforces it, including against an untyped JavaScript caller.
+ *
+ * @example
+ *   // One line per entry, with the fields a project repeats on every line hidden.
+ *   const view: PrettyViewOptions = {
+ *     singleLine: true,
+ *     ignore: 'pid,hostname,service,deployment,event.name'
+ *   }
+ */
+interface PrettyViewOptions {
+    /**
+     * Collapse the whole entry onto one line. The single biggest change to how a
+     * terminal reads — `false` is what expands one entry into a block.
+     * Default: `false`.
+     */
+    singleLine?: boolean;
+    /**
+     * Comma-separated field names to hide from the rendered line. Display-only:
+     * what a real sink receives is untouched. Extend rather than replace when the
+     * goal is quieter output — the default already hides the noisiest fields.
+     * Default: `'pid,hostname,service'`.
+     */
+    ignore?: string;
+    /**
+     * Render only the message line, hiding the record entirely. In pretty mode
+     * there is no JSON copy behind it (`destinations` REPLACES stdout), so a field
+     * hidden here is not visible anywhere — including `logKey`. That is the point
+     * of the option rather than a caveat; use `messageFormat` to pull a specific
+     * field back into the line. Default: `false`.
+     */
+    hideObject?: boolean;
+    /**
+     * Template for the message line, e.g. `'[{context}] {msg}'`. The way to keep a
+     * chosen field visible when `hideObject` is on.
+     */
+    messageFormat?: string;
+    /** Timestamp format, or `false` to leave it raw. Default: `'SYS:HH:MM:ss.l'`. */
+    translateTime?: string | boolean;
+    /** ANSI colour in the rendered line. Default: `true`. */
+    colorize?: boolean;
+}
 /**
  * Pretty-print destination backed by `pino-pretty`.
  *
  * Lifecycle contract (driven by `DestinationRegistry`):
- *   1. `onInit()` resolves `pino-pretty` and builds the transform (rendering to
- *      `process.stdout`).
+ *   1. `onInit()` resolves `pino-pretty`, builds the transform (rendering to
+ *      `process.stdout`), and flushes anything written before it existed.
  *   2. `write()` forwards each serialized line to the transform.
  *   3. `onShutdown()` flushes and closes the transform.
  *
  * @example
- *   BymaxLoggerModule.forRoot({
- *     service: { name: 'api', version: '1.0.0' },
- *     destinations: [new PrettyDevDestination()]
+ *   // Default view — unchanged by the options below.
+ *   new PrettyDevDestination()
+ *
+ *   // One line per entry, with this project's repeated fields hidden.
+ *   new PrettyDevDestination({
+ *     view: { singleLine: true, ignore: 'pid,hostname,service,deployment,event.name' }
+ *   })
+ *
+ *   // Message-only, with the context pulled back into the line.
+ *   new PrettyDevDestination({
+ *     view: { hideObject: true, messageFormat: '[{context}] {msg}' }
  *   })
  */
 declare class PrettyDevDestination implements ILogDestination {
     readonly name = "pretty-dev";
     readonly minLevel?: LogLevel;
+    /** Consumer-chosen view, merged over {@link DEFAULT_VIEW} at init. */
+    private readonly view;
     /**
      * The `pino-pretty` transform stream. Undefined until {@link onInit} succeeds.
      */
@@ -893,16 +969,42 @@ declare class PrettyDevDestination implements ILogDestination {
     /**
      * Set when {@link onInit} fails (e.g. `pino-pretty` absent). Distinguishes a
      * permanently-failed destination — whose writes are DROPPED, since the registry
-     * dropped it from the active set — from the transient pre-init window, where
-     * {@link write} falls back to raw stdout so a bootstrap log is not lost.
+     * dropped it from the active set — from the transient pre-init window.
      */
     private initFailed;
+    /**
+     * Entries written before {@link onInit} built the transform, held so they can be
+     * RENDERED rather than printed raw.
+     *
+     * The transform cannot exist earlier: loading the optional peer is async, and
+     * `onInit` is the first moment the lifecycle offers. Before this buffer those
+     * entries went to stdout as raw NDJSON — correct, nothing lost, but a real boot
+     * put dozens of JSON lines on screen before the first rendered one, and a
+     * developer who had just turned pretty on reasonably concluded it had not
+     * worked. Reported from exactly that reading.
+     */
+    private buffer;
+    /**
+     * Set once {@link MAX_BUFFERED_ENTRIES} is reached. From then on entries go
+     * straight to raw stdout — and the buffer is drained raw at the same moment, so
+     * the output stays in ORDER rather than replaying old entries after newer ones.
+     */
+    private bufferOverflowed;
+    /**
+     * UTF-8 size of everything currently held, tracked incrementally so the bound
+     * costs one `Buffer.byteLength` per entry rather than a walk of the buffer.
+     */
+    private bufferedBytes;
     /**
      * @param opts.minLevel — Optional minimum level filter applied by the
      *   destination registry's multi-stream wiring. Omit to accept every level.
+     * @param opts.view — Optional rendering overrides; see {@link PrettyViewOptions}.
+     *   Omitted fields keep their default, so `new PrettyDevDestination()` renders
+     *   exactly as it did before this option existed.
      */
     constructor(opts?: {
         minLevel?: LogLevel;
+        view?: PrettyViewOptions;
     });
     /**
      * Lazily resolve `pino-pretty` and build the colorized transform that renders
@@ -921,12 +1023,24 @@ declare class PrettyDevDestination implements ILogDestination {
      *     fan-out already skips a failed destination before reaching this method
      *     (and rescues the entry when nothing else initialized); this branch is the
      *     belt to that, for any caller holding the destination directly;
-     *   - pre-init (transient window before {@link onInit}, e.g. a bootstrap log)
-     *     → fall back to raw stdout so the entry is not lost.
+     *   - pre-init (transient window before {@link onInit}, e.g. every entry NestJS
+     *     emits while instantiating providers) → BUFFERED, then rendered through
+     *     the transform once it exists. Nothing is lost on any path: if init fails
+     *     the buffer is drained raw, and if it overflows it is drained raw in order.
      *
      * @param payload — Newline-terminated JSON entry, UTF-8 encoded.
      */
     write(payload: string): void;
+    /**
+     * Hand every buffered entry to `emit`, in arrival order, and empty the buffer.
+     *
+     * Emptying unconditionally is what makes this safe to call from both the
+     * success and failure paths: whichever runs first owns the entries, and the
+     * other finds nothing to emit twice.
+     *
+     * @param emit - Receives each buffered payload, oldest first.
+     */
+    private flushBuffer;
     /**
      * Flush and close the pretty transform, resolving once the stream has ended.
      * A no-op when {@link onInit} never ran.
@@ -1382,4 +1496,4 @@ interface LogEntry {
  */
 declare const LOG_KEYS_CONVENTION_REGEX: RegExp;
 
-export { BymaxLoggerModule, type BymaxLoggerModuleAsyncOptions, type BymaxLoggerModuleOptions, type BymaxLoggerModuleOptionsFactory, DEFAULT_REDACT_PATHS, DefaultStdoutDestination, type EmittedDeploymentResource, type EmittedServiceResource, HttpExceptionFilter, HttpLoggingInterceptor, type HttpOptions, type ILogDestination, type IncomingHeaders, InjectLogger, LOGGER_DESTINATIONS_TOKEN, LOGGER_OPTIONS_TOKEN, LOGGER_PINO_INSTANCE_TOKEN, LOG_CONTEXT_METADATA_KEY, LOG_CONTEXT_TOKEN, LOG_KEYS_CONVENTION_REGEX, LogContext, type LogContext$1 as LogContextBag, LogContextService, type LogEntry, type LogLevel, LogPerformance, type LoggableRequest, type LoggableResponse, type NextHandler, type OtelOptions, PINO_LEVEL_NAMES, PINO_LEVEL_NUMBERS, PinoLoggerService, PrettyDevDestination, RESERVED_LOG_KEYS, RESERVED_LOG_KEYS_NOT_EMITTED, RequestIdMiddleware, type ReservedLogKey, type ResolvedBymaxLoggerModuleOptions, type ResolvedServiceMetadata, type ServiceMetadata, applyRequestIdMiddleware };
+export { BymaxLoggerModule, type BymaxLoggerModuleAsyncOptions, type BymaxLoggerModuleOptions, type BymaxLoggerModuleOptionsFactory, DEFAULT_REDACT_PATHS, DefaultStdoutDestination, type EmittedDeploymentResource, type EmittedServiceResource, HttpExceptionFilter, HttpLoggingInterceptor, type HttpOptions, type ILogDestination, type IncomingHeaders, InjectLogger, LOGGER_DESTINATIONS_TOKEN, LOGGER_OPTIONS_TOKEN, LOGGER_PINO_INSTANCE_TOKEN, LOG_CONTEXT_METADATA_KEY, LOG_CONTEXT_TOKEN, LOG_KEYS_CONVENTION_REGEX, LogContext, type LogContext$1 as LogContextBag, LogContextService, type LogEntry, type LogLevel, LogPerformance, type LoggableRequest, type LoggableResponse, type NextHandler, type OtelOptions, PINO_LEVEL_NAMES, PINO_LEVEL_NUMBERS, PinoLoggerService, PrettyDevDestination, type PrettyViewOptions, RESERVED_LOG_KEYS, RESERVED_LOG_KEYS_NOT_EMITTED, RequestIdMiddleware, type ReservedLogKey, type ResolvedBymaxLoggerModuleOptions, type ResolvedServiceMetadata, type ServiceMetadata, applyRequestIdMiddleware };

package/dist/server/index.d.ts

@@ -864,28 +864,104 @@ declare class DefaultStdoutDestination implements ILogDestination {
     });
     /**
      * Write a serialized JSON log entry (terminated with `\n`) to `stdout`.
+     *
+     * Routed through {@link writeStdoutSafely} rather than calling
+     * `process.stdout.write` directly. This is the sink a consumer gets when they
+     * configure nothing, so it is the path that decides whether a closed pipe
+     * (`node app | head`) kills the application — and unguarded, it did: EPIPE
+     * arrives asynchronously through the stream's `'error'` event, Node attaches no
+     * default handler, and the emit becomes an uncaught exception. Measured on the
+     * built artifact, exit code 42.
      */
     write(payload: string): void;
 }
 
+/**
+ * How the development terminal renders an entry — a VIEW over the record, never
+ * a change to it. Every field maps to the `pino-pretty` option of the same name.
+ *
+ * Declared here rather than reusing `pino-pretty`'s own `PrettyOptions`, and the
+ * reason is load-bearing: a type import from the peer emits a hard
+ * `import { PrettyOptions } from 'pino-pretty'` at the top of the published
+ * `.d.ts`, so every consumer who type-checks WITHOUT the optional peer installed
+ * would hit an unresolved module. That would make an optional peer effectively
+ * required — a worse regression than the missing options, and the same
+ * contradiction this library already refused when asked to hard-fail on a missing
+ * peer. Measured on the built artifact, not assumed.
+ *
+ * `destination` is deliberately absent. The library owns where entries go; a
+ * consumer redirecting the stream would route around the multistream fan-out and
+ * the last-resort rescue. Omitting it from this type states the intent — applying
+ * the library's own value AFTER the spread in {@link PrettyDevDestination.onInit}
+ * is what enforces it, including against an untyped JavaScript caller.
+ *
+ * @example
+ *   // One line per entry, with the fields a project repeats on every line hidden.
+ *   const view: PrettyViewOptions = {
+ *     singleLine: true,
+ *     ignore: 'pid,hostname,service,deployment,event.name'
+ *   }
+ */
+interface PrettyViewOptions {
+    /**
+     * Collapse the whole entry onto one line. The single biggest change to how a
+     * terminal reads — `false` is what expands one entry into a block.
+     * Default: `false`.
+     */
+    singleLine?: boolean;
+    /**
+     * Comma-separated field names to hide from the rendered line. Display-only:
+     * what a real sink receives is untouched. Extend rather than replace when the
+     * goal is quieter output — the default already hides the noisiest fields.
+     * Default: `'pid,hostname,service'`.
+     */
+    ignore?: string;
+    /**
+     * Render only the message line, hiding the record entirely. In pretty mode
+     * there is no JSON copy behind it (`destinations` REPLACES stdout), so a field
+     * hidden here is not visible anywhere — including `logKey`. That is the point
+     * of the option rather than a caveat; use `messageFormat` to pull a specific
+     * field back into the line. Default: `false`.
+     */
+    hideObject?: boolean;
+    /**
+     * Template for the message line, e.g. `'[{context}] {msg}'`. The way to keep a
+     * chosen field visible when `hideObject` is on.
+     */
+    messageFormat?: string;
+    /** Timestamp format, or `false` to leave it raw. Default: `'SYS:HH:MM:ss.l'`. */
+    translateTime?: string | boolean;
+    /** ANSI colour in the rendered line. Default: `true`. */
+    colorize?: boolean;
+}
 /**
  * Pretty-print destination backed by `pino-pretty`.
  *
  * Lifecycle contract (driven by `DestinationRegistry`):
- *   1. `onInit()` resolves `pino-pretty` and builds the transform (rendering to
- *      `process.stdout`).
+ *   1. `onInit()` resolves `pino-pretty`, builds the transform (rendering to
+ *      `process.stdout`), and flushes anything written before it existed.
  *   2. `write()` forwards each serialized line to the transform.
  *   3. `onShutdown()` flushes and closes the transform.
  *
  * @example
- *   BymaxLoggerModule.forRoot({
- *     service: { name: 'api', version: '1.0.0' },
- *     destinations: [new PrettyDevDestination()]
+ *   // Default view — unchanged by the options below.
+ *   new PrettyDevDestination()
+ *
+ *   // One line per entry, with this project's repeated fields hidden.
+ *   new PrettyDevDestination({
+ *     view: { singleLine: true, ignore: 'pid,hostname,service,deployment,event.name' }
+ *   })
+ *
+ *   // Message-only, with the context pulled back into the line.
+ *   new PrettyDevDestination({
+ *     view: { hideObject: true, messageFormat: '[{context}] {msg}' }
  *   })
  */
 declare class PrettyDevDestination implements ILogDestination {
     readonly name = "pretty-dev";
     readonly minLevel?: LogLevel;
+    /** Consumer-chosen view, merged over {@link DEFAULT_VIEW} at init. */
+    private readonly view;
     /**
      * The `pino-pretty` transform stream. Undefined until {@link onInit} succeeds.
      */
@@ -893,16 +969,42 @@ declare class PrettyDevDestination implements ILogDestination {
     /**
      * Set when {@link onInit} fails (e.g. `pino-pretty` absent). Distinguishes a
      * permanently-failed destination — whose writes are DROPPED, since the registry
-     * dropped it from the active set — from the transient pre-init window, where
-     * {@link write} falls back to raw stdout so a bootstrap log is not lost.
+     * dropped it from the active set — from the transient pre-init window.
      */
     private initFailed;
+    /**
+     * Entries written before {@link onInit} built the transform, held so they can be
+     * RENDERED rather than printed raw.
+     *
+     * The transform cannot exist earlier: loading the optional peer is async, and
+     * `onInit` is the first moment the lifecycle offers. Before this buffer those
+     * entries went to stdout as raw NDJSON — correct, nothing lost, but a real boot
+     * put dozens of JSON lines on screen before the first rendered one, and a
+     * developer who had just turned pretty on reasonably concluded it had not
+     * worked. Reported from exactly that reading.
+     */
+    private buffer;
+    /**
+     * Set once {@link MAX_BUFFERED_ENTRIES} is reached. From then on entries go
+     * straight to raw stdout — and the buffer is drained raw at the same moment, so
+     * the output stays in ORDER rather than replaying old entries after newer ones.
+     */
+    private bufferOverflowed;
+    /**
+     * UTF-8 size of everything currently held, tracked incrementally so the bound
+     * costs one `Buffer.byteLength` per entry rather than a walk of the buffer.
+     */
+    private bufferedBytes;
     /**
      * @param opts.minLevel — Optional minimum level filter applied by the
      *   destination registry's multi-stream wiring. Omit to accept every level.
+     * @param opts.view — Optional rendering overrides; see {@link PrettyViewOptions}.
+     *   Omitted fields keep their default, so `new PrettyDevDestination()` renders
+     *   exactly as it did before this option existed.
      */
     constructor(opts?: {
         minLevel?: LogLevel;
+        view?: PrettyViewOptions;
     });
     /**
      * Lazily resolve `pino-pretty` and build the colorized transform that renders
@@ -921,12 +1023,24 @@ declare class PrettyDevDestination implements ILogDestination {
      *     fan-out already skips a failed destination before reaching this method
      *     (and rescues the entry when nothing else initialized); this branch is the
      *     belt to that, for any caller holding the destination directly;
-     *   - pre-init (transient window before {@link onInit}, e.g. a bootstrap log)
-     *     → fall back to raw stdout so the entry is not lost.
+     *   - pre-init (transient window before {@link onInit}, e.g. every entry NestJS
+     *     emits while instantiating providers) → BUFFERED, then rendered through
+     *     the transform once it exists. Nothing is lost on any path: if init fails
+     *     the buffer is drained raw, and if it overflows it is drained raw in order.
      *
      * @param payload — Newline-terminated JSON entry, UTF-8 encoded.
      */
     write(payload: string): void;
+    /**
+     * Hand every buffered entry to `emit`, in arrival order, and empty the buffer.
+     *
+     * Emptying unconditionally is what makes this safe to call from both the
+     * success and failure paths: whichever runs first owns the entries, and the
+     * other finds nothing to emit twice.
+     *
+     * @param emit - Receives each buffered payload, oldest first.
+     */
+    private flushBuffer;
     /**
      * Flush and close the pretty transform, resolving once the stream has ended.
      * A no-op when {@link onInit} never ran.
@@ -1382,4 +1496,4 @@ interface LogEntry {
  */
 declare const LOG_KEYS_CONVENTION_REGEX: RegExp;
 
-export { BymaxLoggerModule, type BymaxLoggerModuleAsyncOptions, type BymaxLoggerModuleOptions, type BymaxLoggerModuleOptionsFactory, DEFAULT_REDACT_PATHS, DefaultStdoutDestination, type EmittedDeploymentResource, type EmittedServiceResource, HttpExceptionFilter, HttpLoggingInterceptor, type HttpOptions, type ILogDestination, type IncomingHeaders, InjectLogger, LOGGER_DESTINATIONS_TOKEN, LOGGER_OPTIONS_TOKEN, LOGGER_PINO_INSTANCE_TOKEN, LOG_CONTEXT_METADATA_KEY, LOG_CONTEXT_TOKEN, LOG_KEYS_CONVENTION_REGEX, LogContext, type LogContext$1 as LogContextBag, LogContextService, type LogEntry, type LogLevel, LogPerformance, type LoggableRequest, type LoggableResponse, type NextHandler, type OtelOptions, PINO_LEVEL_NAMES, PINO_LEVEL_NUMBERS, PinoLoggerService, PrettyDevDestination, RESERVED_LOG_KEYS, RESERVED_LOG_KEYS_NOT_EMITTED, RequestIdMiddleware, type ReservedLogKey, type ResolvedBymaxLoggerModuleOptions, type ResolvedServiceMetadata, type ServiceMetadata, applyRequestIdMiddleware };
+export { BymaxLoggerModule, type BymaxLoggerModuleAsyncOptions, type BymaxLoggerModuleOptions, type BymaxLoggerModuleOptionsFactory, DEFAULT_REDACT_PATHS, DefaultStdoutDestination, type EmittedDeploymentResource, type EmittedServiceResource, HttpExceptionFilter, HttpLoggingInterceptor, type HttpOptions, type ILogDestination, type IncomingHeaders, InjectLogger, LOGGER_DESTINATIONS_TOKEN, LOGGER_OPTIONS_TOKEN, LOGGER_PINO_INSTANCE_TOKEN, LOG_CONTEXT_METADATA_KEY, LOG_CONTEXT_TOKEN, LOG_KEYS_CONVENTION_REGEX, LogContext, type LogContext$1 as LogContextBag, LogContextService, type LogEntry, type LogLevel, LogPerformance, type LoggableRequest, type LoggableResponse, type NextHandler, type OtelOptions, PINO_LEVEL_NAMES, PINO_LEVEL_NUMBERS, PinoLoggerService, PrettyDevDestination, type PrettyViewOptions, RESERVED_LOG_KEYS, RESERVED_LOG_KEYS_NOT_EMITTED, RequestIdMiddleware, type ReservedLogKey, type ResolvedBymaxLoggerModuleOptions, type ResolvedServiceMetadata, type ServiceMetadata, applyRequestIdMiddleware };

package/dist/server/index.mjs

@@ -583,6 +583,30 @@ function collectContextLoggerProviders() {
 function collectContextLoggerTokens() {
   return Array.from(contextTokens.values());
 }
+
+// src/server/utils/safe-stdio.util.ts
+var swallowStreamError = () => void 0;
+function ensureGuarded(stream) {
+  if (stream.listeners("error").includes(swallowStreamError)) {
+    return;
+  }
+  stream.on("error", swallowStreamError);
+}
+function writeSafely(stream, payload) {
+  try {
+    ensureGuarded(stream);
+    stream.write(payload);
+  } catch {
+  }
+}
+function writeStdoutSafely(payload) {
+  writeSafely(process.stdout, payload);
+}
+function writeStderrSafely(line) {
+  writeSafely(process.stderr, line);
+}
+
+// src/server/destinations/default-stdout.destination.ts
 var DefaultStdoutDestination = class {
   /**
    * @param opts.minLevel — Optional minimum level filter. Entries below this
@@ -597,9 +621,17 @@ var DefaultStdoutDestination = class {
   }
   /**
    * Write a serialized JSON log entry (terminated with `\n`) to `stdout`.
+   *
+   * Routed through {@link writeStdoutSafely} rather than calling
+   * `process.stdout.write` directly. This is the sink a consumer gets when they
+   * configure nothing, so it is the path that decides whether a closed pipe
+   * (`node app | head`) kills the application — and unguarded, it did: EPIPE
+   * arrives asynchronously through the stream's `'error'` event, Node attaches no
+   * default handler, and the emit becomes an uncaught exception. Measured on the
+   * built artifact, exit code 42.
    */
   write(payload) {
-    process.stdout.write(payload);
+    writeStdoutSafely(payload);
   }
 };
 DefaultStdoutDestination = __decorateClass([
@@ -1031,7 +1063,7 @@ function reportDestinationFailure(logKey, name, cause, msg) {
       type: toSingleLineMessage(String(cause.name)),
       message: toSingleLineMessage(String(cause.message))
     } : { type: "UnknownError", message: toSingleLineMessage(String(cause)) };
-    process.stderr.write(
+    writeStderrSafely(
       JSON.stringify({
         level: "error",
         logKey,
@@ -1054,10 +1086,7 @@ function reportWriteFailure(name, cause) {
   );
 }
 function rescueToStdout(payload) {
-  try {
-    process.stdout.write(payload);
-  } catch {
-  }
+  writeStdoutSafely(payload);
 }
 function destinationToStream(destination, health) {
   return new Writable({
@@ -1754,7 +1783,7 @@ var DestinationRegistry = class {
         await destination.onShutdown?.();
       } catch (cause) {
         const detail = cause instanceof Error ? cause.stack ?? cause.message : String(cause);
-        process.stderr.write(
+        writeStderrSafely(
           `[DestinationRegistry] Shutdown failed for "${destination.name}": ${detail}
 `
         );
@@ -2034,23 +2063,60 @@ BymaxLoggerModule = __decorateClass([
 ], BymaxLoggerModule);
 
 // src/server/destinations/pretty-dev.destination.ts
+var DEFAULT_VIEW = {
+  colorize: true,
+  translateTime: "SYS:HH:MM:ss.l",
+  ignore: "pid,hostname,service",
+  singleLine: false
+};
+var MAX_BUFFERED_ENTRIES = 1e3;
+var MAX_BUFFERED_BYTES = 4 * 1024 * 1024;
+function writeRawToStdout(payload) {
+  writeStdoutSafely(payload);
+}
 var PrettyDevDestination = class {
   /**
    * @param opts.minLevel — Optional minimum level filter applied by the
    *   destination registry's multi-stream wiring. Omit to accept every level.
+   * @param opts.view — Optional rendering overrides; see {@link PrettyViewOptions}.
+   *   Omitted fields keep their default, so `new PrettyDevDestination()` renders
+   *   exactly as it did before this option existed.
    */
   constructor(opts = {}) {
     this.name = "pretty-dev";
     /**
      * Set when {@link onInit} fails (e.g. `pino-pretty` absent). Distinguishes a
      * permanently-failed destination — whose writes are DROPPED, since the registry
-     * dropped it from the active set — from the transient pre-init window, where
-     * {@link write} falls back to raw stdout so a bootstrap log is not lost.
+     * dropped it from the active set — from the transient pre-init window.
      */
     this.initFailed = false;
+    /**
+     * Entries written before {@link onInit} built the transform, held so they can be
+     * RENDERED rather than printed raw.
+     *
+     * The transform cannot exist earlier: loading the optional peer is async, and
+     * `onInit` is the first moment the lifecycle offers. Before this buffer those
+     * entries went to stdout as raw NDJSON — correct, nothing lost, but a real boot
+     * put dozens of JSON lines on screen before the first rendered one, and a
+     * developer who had just turned pretty on reasonably concluded it had not
+     * worked. Reported from exactly that reading.
+     */
+    this.buffer = [];
+    /**
+     * Set once {@link MAX_BUFFERED_ENTRIES} is reached. From then on entries go
+     * straight to raw stdout — and the buffer is drained raw at the same moment, so
+     * the output stays in ORDER rather than replaying old entries after newer ones.
+     */
+    this.bufferOverflowed = false;
+    /**
+     * UTF-8 size of everything currently held, tracked incrementally so the bound
+     * costs one `Buffer.byteLength` per entry rather than a walk of the buffer.
+     */
+    this.bufferedBytes = 0;
     if (opts.minLevel !== void 0) {
       this.minLevel = opts.minLevel;
     }
+    this.view = opts.view ?? {};
   }
   /**
    * Lazily resolve `pino-pretty` and build the colorized transform that renders
@@ -2063,18 +2129,31 @@ var PrettyDevDestination = class {
     try {
       const { build } = await import('pino-pretty');
       this.stream = build({
-        colorize: true,
-        translateTime: "SYS:HH:MM:ss.l",
-        ignore: "pid,hostname,service",
-        singleLine: false,
+        ...DEFAULT_VIEW,
+        ...this.view,
+        // AFTER the consumer's view, deliberately. Omitting `destination` from
+        // `PrettyViewOptions` states that the library owns the sink; applying it
+        // last is what ENFORCES it, including against an untyped caller reaching
+        // in from JavaScript. A redirected stream would route around the fan-out
+        // and the last-resort rescue.
         destination: process.stdout
       });
     } catch {
       this.initFailed = true;
+      this.flushBuffer((payload) => {
+        writeRawToStdout(payload);
+      });
       throw new Error(
         "[PrettyDevDestination] pino-pretty is not installed. Install it as a peer dependency (`pnpm add -D pino-pretty`) or remove PrettyDevDestination from `destinations`."
       );
     }
+    this.flushBuffer((payload) => {
+      try {
+        this.stream?.write(payload);
+      } catch {
+        writeRawToStdout(payload);
+      }
+    });
   }
   /**
    * Write a serialized NDJSON entry to the pretty transform.
@@ -2085,8 +2164,10 @@ var PrettyDevDestination = class {
    *     fan-out already skips a failed destination before reaching this method
    *     (and rescues the entry when nothing else initialized); this branch is the
    *     belt to that, for any caller holding the destination directly;
-   *   - pre-init (transient window before {@link onInit}, e.g. a bootstrap log)
-   *     → fall back to raw stdout so the entry is not lost.
+   *   - pre-init (transient window before {@link onInit}, e.g. every entry NestJS
+   *     emits while instantiating providers) → BUFFERED, then rendered through
+   *     the transform once it exists. Nothing is lost on any path: if init fails
+   *     the buffer is drained raw, and if it overflows it is drained raw in order.
    *
    * @param payload — Newline-terminated JSON entry, UTF-8 encoded.
    */
@@ -2098,7 +2179,36 @@ var PrettyDevDestination = class {
     if (this.initFailed) {
       return;
     }
-    process.stdout.write(payload);
+    if (this.bufferOverflowed) {
+      writeRawToStdout(payload);
+      return;
+    }
+    const payloadBytes = Buffer.byteLength(payload, "utf8");
+    if (this.buffer.length >= MAX_BUFFERED_ENTRIES || this.bufferedBytes + payloadBytes > MAX_BUFFERED_BYTES) {
+      this.bufferOverflowed = true;
+      this.flushBuffer(writeRawToStdout);
+      writeRawToStdout(payload);
+      return;
+    }
+    this.buffer.push(payload);
+    this.bufferedBytes += payloadBytes;
+  }
+  /**
+   * Hand every buffered entry to `emit`, in arrival order, and empty the buffer.
+   *
+   * Emptying unconditionally is what makes this safe to call from both the
+   * success and failure paths: whichever runs first owns the entries, and the
+   * other finds nothing to emit twice.
+   *
+   * @param emit - Receives each buffered payload, oldest first.
+   */
+  flushBuffer(emit) {
+    const held = this.buffer;
+    this.buffer = [];
+    this.bufferedBytes = 0;
+    for (const payload of held) {
+      emit(payload);
+    }
   }
   /**
    * Flush and close the pretty transform, resolving once the stream has ended.
@@ -2107,6 +2217,7 @@ var PrettyDevDestination = class {
   async onShutdown() {
     const stream = this.stream;
     if (stream === void 0) {
+      this.flushBuffer(writeRawToStdout);
       return;
     }
     await new Promise((resolve, reject) => {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bymax-one/nest-logger",
-  "version": "1.2.5",
+  "version": "1.2.6",
   "description": "Structured JSON logging for NestJS based on Pino 10, with optional OpenTelemetry correlation.",
   "author": "Bymax One <support@bymax.one>",
   "license": "MIT",