@easyweb/logging 1.0.0

package/README.md

@@ -0,0 +1,110 @@
+# @easyweb/logging
+
+One pino configuration for every Easyweb service, request-scoped context that
+does not have to be threaded by hand, an HTTP access log, and the redaction a
+log needs before it leaves the pod.
+
+## Why it exists
+
+`src/lib/logger.ts` was copy-pasted into 21 services. It had drifted into two
+variants; `domain` and `moderation` both defaulted their service name to
+`"billing-service"`; and seven services were missing the guard that stops
+pino-pretty's worker thread making Jest exit 1 under a green report.
+
+The bigger problem was correlation. `getLogger(req)` returned a child bound to
+`requestId` and had to be passed down as an explicit `log` parameter. Roughly
+100 call sites did that; the other ~1,300 logged through the module-level root
+logger and carried no request id at all.
+
+## The mixin
+
+`createServiceLogger` installs a pino `mixin` that reads an `AsyncLocalStorage`
+store. Every existing call site gains the ambient fields with no edit:
+
+```ts
+// unchanged call site
+log.info({ projectId }, "Project created");
+
+// what it now emits
+{ "service": "project-service", "requestId": "…", "userId": "…", "projectId": "…" }
+```
+
+pino merges the mixin UNDER the object the call site passed, so an explicit
+field always wins over an ambient one.
+
+## Usage
+
+```ts
+// src/lib/logger.ts
+import { createServiceLogger } from "@easyweb/logging";
+import config from "../config";
+
+const { logger, getLogger } = createServiceLogger({
+  serviceName: config.serviceName,
+  logLevel: config.logLevel,
+});
+
+export { getLogger };
+export default logger;
+```
+
+```ts
+// src/app.ts — the access log needs the scope, so it goes after requestContext
+app.use(requestContext);
+app.use(createHttpLogger(logger));
+```
+
+Opening a scope outside a request — a BullMQ job, a broker handler:
+
+```ts
+await runWithContext({ jobId: job.id, job: job.data.type }, () => handle(job));
+```
+
+Adding to a scope already running — `authenticate` does this once it has
+verified the token:
+
+```ts
+bindContext({ userId: decoded.sub });
+```
+
+## The access log
+
+One line per finished request, `msg: "request"`.
+
+`route` is the route **pattern** (`/billing/me/invoices/:invoiceId`), and that
+is a contract rather than a convenience: the RED metrics are recording rules
+over it, so a per-id value would make the series unbounded. `path` carries the
+real path beside it, from `req.originalUrl` — Express strips the mount prefix
+off `req.path` during router dispatch, so reading that in the finish callback
+names a route that does not exist.
+
+The query string is never logged. `?token=…` on the verification route is a live
+credential.
+
+`/health`, `/livez`, `/readyz` and `/metrics` are skipped — the kubelet would
+otherwise make the readiness probe the largest log stream in the cluster.
+
+## Redaction
+
+Two mechanisms, covering different shapes:
+
+- **`REDACT_PATHS`** — pino's fixed-path redaction, for our own payloads.
+  Passwords, tokens, cookies and auth headers, at the top level and one level
+  down.
+- **`scrubResponseData`** — a recursive, depth- and size-capped walk over
+  `err.response.data`, for payloads we do not control. Xendit, Stripe, Resend,
+  Meta, Apify, Cloudflare and Gitea all put personal data in an error body, and
+  407 `logger.error({ err })` call sites fed it into the log verbatim and
+  uncapped.
+
+`err.response.data` is capped at 2 KB **after** scrubbing, not instead of it —
+truncating first would keep whatever fitted, which for a failed charge is the
+payer block.
+
+## What is deliberately NOT redacted
+
+Email addresses. auth-service logs one on three lines — signup, an
+operator-create refusal, and a Google registration — and they are the signup
+audit trail: `userId` alone cannot answer "which address did they sign up
+with". The exposure is real and bounded by log retention. See
+`docs/platform/ADR-0001`.

package/dist/context.d.ts

@@ -0,0 +1,60 @@
+/**
+ * The fields every log line in a scope carries, without any call site naming
+ * them.
+ *
+ * This is the whole reason the package exists. The platform had ~1,389
+ * `logger.info({...}, "...")` call sites and correlation reached almost none of
+ * them: `getLogger(req)` returned a child bound to `requestId` and had to be
+ * threaded down by hand as an explicit `log` parameter, so anything not handed
+ * one fell back to the module-level root logger and logged no requestId at all.
+ * Threading it through the remaining ~1,300 signatures was never going to
+ * happen. A pino `mixin` reading this store injects the fields at log time
+ * instead, so every existing call site correlates with no edit.
+ *
+ * The index signature is deliberate: a caller may add anything it wants to see
+ * on every line for the rest of the scope. What must NOT go in are values that
+ * are large, that change per line, or that are secret — the whole object is
+ * serialized onto every single log record inside the scope.
+ */
+export interface LogContext {
+    /** From `x-request-id`, or minted. The join key across services. */
+    requestId?: string;
+    /** Bound by `authenticate` once the access token is verified. */
+    userId?: string;
+    sessionId?: string;
+    projectId?: string;
+    /** Broker consume scope. */
+    exchange?: string;
+    routingKey?: string;
+    queue?: string;
+    retryCount?: number;
+    /** BullMQ job scope. */
+    jobId?: string;
+    job?: string;
+    [key: string]: unknown;
+}
+/**
+ * Runs `fn` with `fields` merged over whatever scope is already active.
+ *
+ * Nesting is additive rather than replacing, so a broker handler that opens a
+ * job scope inside a request scope keeps the requestId. A FRESH object is
+ * created each time, which is what makes `bindContext`'s mutation safe.
+ */
+export declare function runWithContext<T>(fields: LogContext, fn: () => T): T;
+/**
+ * Adds fields to the scope that is ALREADY running.
+ *
+ * `authenticate` needs this: the scope is opened by `requestContext` before any
+ * token has been read, and `userId` only becomes known several middlewares
+ * later. Mutating in place is what makes that visible to a log line emitted
+ * earlier-registered-but-later-run — notably the access log's `res.on("finish")`
+ * callback, which captures the store by reference at request start.
+ *
+ * A no-op outside a scope. That is deliberate: a seeder or a script calling a
+ * service method directly has no request, and throwing there would make the
+ * logging layer the thing that breaks `npm run seed`.
+ */
+export declare function bindContext(fields: LogContext): void;
+/** The active scope, or undefined outside one. */
+export declare function getContext(): LogContext | undefined;
+//# sourceMappingURL=context.d.ts.map

package/dist/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,UAAU;IACzB,oEAAoE;IACpE,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iEAAiE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB,4BAA4B;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IAEpB,wBAAwB;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,GAAG,CAAC,EAAE,MAAM,CAAC;IAEb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAID;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAGpE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,UAAU,GAAG,IAAI,CAIpD;AAED,kDAAkD;AAClD,wBAAgB,UAAU,IAAI,UAAU,GAAG,SAAS,CAEnD"}

package/dist/context.js

@@ -0,0 +1,42 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runWithContext = runWithContext;
+exports.bindContext = bindContext;
+exports.getContext = getContext;
+const async_hooks_1 = require("async_hooks");
+const storage = new async_hooks_1.AsyncLocalStorage();
+/**
+ * Runs `fn` with `fields` merged over whatever scope is already active.
+ *
+ * Nesting is additive rather than replacing, so a broker handler that opens a
+ * job scope inside a request scope keeps the requestId. A FRESH object is
+ * created each time, which is what makes `bindContext`'s mutation safe.
+ */
+function runWithContext(fields, fn) {
+    const parent = storage.getStore();
+    return storage.run({ ...parent, ...fields }, fn);
+}
+/**
+ * Adds fields to the scope that is ALREADY running.
+ *
+ * `authenticate` needs this: the scope is opened by `requestContext` before any
+ * token has been read, and `userId` only becomes known several middlewares
+ * later. Mutating in place is what makes that visible to a log line emitted
+ * earlier-registered-but-later-run — notably the access log's `res.on("finish")`
+ * callback, which captures the store by reference at request start.
+ *
+ * A no-op outside a scope. That is deliberate: a seeder or a script calling a
+ * service method directly has no request, and throwing there would make the
+ * logging layer the thing that breaks `npm run seed`.
+ */
+function bindContext(fields) {
+    const store = storage.getStore();
+    if (!store)
+        return;
+    Object.assign(store, fields);
+}
+/** The active scope, or undefined outside one. */
+function getContext() {
+    return storage.getStore();
+}
+//# sourceMappingURL=context.js.map

package/dist/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":";;AAkDA,wCAGC;AAeD,kCAIC;AAGD,gCAEC;AA7ED,6CAAgD;AAyChD,MAAM,OAAO,GAAG,IAAI,+BAAiB,EAAc,CAAC;AAEpD;;;;;;GAMG;AACH,SAAgB,cAAc,CAAI,MAAkB,EAAE,EAAW;IAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAClC,OAAO,OAAO,CAAC,GAAG,CAAC,EAAE,GAAG,MAAM,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAgB,WAAW,CAAC,MAAkB;IAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IACjC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,kDAAkD;AAClD,SAAgB,UAAU;IACxB,OAAO,OAAO,CAAC,QAAQ,EAAE,CAAC;AAC5B,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,7 @@
+export * from "./context";
+export * from "./logger";
+export * from "./middleware";
+export * from "./redact";
+export * from "./serialize";
+export * from "./transport";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,WAAW,CAAC;AAC1B,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,UAAU,CAAC;AACzB,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC"}

package/dist/index.js

@@ -0,0 +1,23 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./context"), exports);
+__exportStar(require("./logger"), exports);
+__exportStar(require("./middleware"), exports);
+__exportStar(require("./redact"), exports);
+__exportStar(require("./serialize"), exports);
+__exportStar(require("./transport"), exports);
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,4CAA0B;AAC1B,2CAAyB;AACzB,+CAA6B;AAC7B,2CAAyB;AACzB,8CAA4B;AAC5B,8CAA4B"}

package/dist/logger.d.ts

@@ -0,0 +1,44 @@
+import pino from "pino";
+import type { Request } from "express";
+export interface ServiceLoggerOptions {
+    /**
+     * The `service` field on every line, and the rotated filename under
+     * `LOG_DIR`. Pass `config.serviceName` — every service already has one and
+     * every one of them is correct, which the duplicated logger.ts was not:
+     * domain's and moderation's both defaulted to "billing-service".
+     */
+    serviceName: string;
+    /** `config.logLevel`. Falls back to info in production, debug elsewhere. */
+    logLevel?: string | undefined;
+    logDir?: string | undefined;
+    env?: string | undefined;
+    /**
+     * Where the logger writes, when no `transport` is built.
+     *
+     * Exists for tests, which need to read back what was actually emitted —
+     * redaction and the mixin both happen inside pino, so asserting on them from
+     * the outside means capturing the stream. Under NODE_ENV=test there is no
+     * transport anyway (see `shouldPretty`), so this never competes with one.
+     */
+    destination?: pino.DestinationStream | undefined;
+}
+export interface ServiceLogger {
+    logger: pino.Logger;
+    /**
+     * Kept for the ~42 files that import it. It is now redundant — the mixin
+     * already puts `requestId` on every line inside a request — but harmless, and
+     * removing it would be a 42-file change for no behaviour.
+     */
+    getLogger: (req: Request) => pino.Logger;
+}
+/**
+ * Builds the service's root logger.
+ *
+ * The one genuinely new thing here is `mixin`. pino calls it on every level
+ * method and merges the result UNDER the object the call site passed, so an
+ * explicit field always wins over the ambient one. That is what lets every
+ * existing `log.info({ projectId }, "...")` gain a requestId without being
+ * touched.
+ */
+export declare function createServiceLogger(options: ServiceLoggerOptions): ServiceLogger;
+//# sourceMappingURL=logger.d.ts.map

package/dist/logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAMvC,MAAM,WAAW,oBAAoB;IACnC;;;;;OAKG;IACH,WAAW,EAAE,MAAM,CAAC;IACpB,4EAA4E;IAC5E,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB;;;;;;;OAOG;IACH,WAAW,CAAC,EAAE,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC;CAClD;AAED,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;IACpB;;;;OAIG;IACH,SAAS,EAAE,CAAC,GAAG,EAAE,OAAO,KAAK,IAAI,CAAC,MAAM,CAAC;CAC1C;AAED;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,OAAO,EAAE,oBAAoB,GAC5B,aAAa,CAoDf"}

package/dist/logger.js

@@ -0,0 +1,69 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createServiceLogger = createServiceLogger;
+const pino_1 = __importDefault(require("pino"));
+const context_1 = require("./context");
+const redact_1 = require("./redact");
+const serialize_1 = require("./serialize");
+const transport_1 = require("./transport");
+/**
+ * Builds the service's root logger.
+ *
+ * The one genuinely new thing here is `mixin`. pino calls it on every level
+ * method and merges the result UNDER the object the call site passed, so an
+ * explicit field always wins over the ambient one. That is what lets every
+ * existing `log.info({ projectId }, "...")` gain a requestId without being
+ * touched.
+ */
+function createServiceLogger(options) {
+    const env = options.env ?? process.env.NODE_ENV ?? "development";
+    const logDir = options.logDir ?? process.env.LOG_DIR;
+    // `...(x ? { x } : {})` rather than `transport: buildTransport(...)`.
+    // `exactOptionalPropertyTypes` is on in this package and OFF in every
+    // service, so the shape that compiled when this file was duplicated 21 times
+    // does not compile here. The spread is the repo's documented idiom for it.
+    const transport = (0, transport_1.buildTransport)(logDir, options.serviceName, (0, transport_1.shouldPretty)(env));
+    const pinoOptions = {
+        level: options.logLevel || (env === "production" ? "info" : "debug"),
+        base: {
+            service: options.serviceName,
+            env,
+        },
+        timestamp: pino_1.default.stdTimeFunctions.isoTime,
+        /**
+         * Never throws. A mixin that threw would take down the log call, and log
+         * calls are overwhelmingly on error paths — the failure would swallow
+         * exactly the line somebody needed.
+         */
+        mixin() {
+            try {
+                return (0, context_1.getContext)() ?? {};
+            }
+            catch {
+                return {};
+            }
+        },
+        serializers: {
+            err: serialize_1.serializeError,
+            error: serialize_1.serializeError,
+        },
+        redact: redact_1.REDACT,
+        ...(transport ? { transport } : {}),
+    };
+    // Two call forms rather than `pino(opts, undefined)`: pino's second parameter
+    // is a real destination, and handing it an explicit undefined relies on an
+    // internal falsy check rather than the documented overload.
+    const logger = options.destination
+        ? (0, pino_1.default)(pinoOptions, options.destination)
+        : (0, pino_1.default)(pinoOptions);
+    // Read defensively rather than importing the global `Express.Request`
+    // augmentation from @easyweb/authentication: that package depends on THIS
+    // one, so importing it back would be a cycle. Same call common-errors'
+    // errorHandler makes, for the same reason.
+    const getLogger = (req) => logger.child({ requestId: req.requestId });
+    return { logger, getLogger };
+}
+//# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":";;;;;AAiDA,kDAsDC;AAvGD,gDAAwB;AAExB,uCAAuC;AACvC,qCAAkC;AAClC,2CAA6C;AAC7C,2CAA2D;AAmC3D;;;;;;;;GAQG;AACH,SAAgB,mBAAmB,CACjC,OAA6B;IAE7B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,QAAQ,IAAI,aAAa,CAAC;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC;IAErD,sEAAsE;IACtE,sEAAsE;IACtE,6EAA6E;IAC7E,2EAA2E;IAC3E,MAAM,SAAS,GAAG,IAAA,0BAAc,EAAC,MAAM,EAAE,OAAO,CAAC,WAAW,EAAE,IAAA,wBAAY,EAAC,GAAG,CAAC,CAAC,CAAC;IAEjF,MAAM,WAAW,GAAuB;QACtC,KAAK,EAAE,OAAO,CAAC,QAAQ,IAAI,CAAC,GAAG,KAAK,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QACpE,IAAI,EAAE;YACJ,OAAO,EAAE,OAAO,CAAC,WAAW;YAC5B,GAAG;SACJ;QACD,SAAS,EAAE,cAAI,CAAC,gBAAgB,CAAC,OAAO;QACxC;;;;WAIG;QACH,KAAK;YACH,IAAI,CAAC;gBACH,OAAO,IAAA,oBAAU,GAAE,IAAI,EAAE,CAAC;YAC5B,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,EAAE,CAAC;YACZ,CAAC;QACH,CAAC;QACD,WAAW,EAAE;YACX,GAAG,EAAE,0BAAc;YACnB,KAAK,EAAE,0BAAc;SACtB;QACD,MAAM,EAAE,eAAM;QACd,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpC,CAAC;IAEF,8EAA8E;IAC9E,2EAA2E;IAC3E,4DAA4D;IAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,WAAW;QAChC,CAAC,CAAC,IAAA,cAAI,EAAC,WAAW,EAAE,OAAO,CAAC,WAAW,CAAC;QACxC,CAAC,CAAC,IAAA,cAAI,EAAC,WAAW,CAAC,CAAC;IAEtB,sEAAsE;IACtE,0EAA0E;IAC1E,uEAAuE;IACvE,2CAA2C;IAC3C,MAAM,SAAS,GAAG,CAAC,GAAY,EAAe,EAAE,CAC9C,MAAM,CAAC,KAAK,CAAC,EAAE,SAAS,EAAG,GAA8B,CAAC,SAAS,EAAE,CAAC,CAAC;IAEzE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AAC/B,CAAC"}

package/dist/middleware/http-logger.d.ts

@@ -0,0 +1,14 @@
+import type { RequestHandler } from "express";
+import type pino from "pino";
+/**
+ * One line per finished request.
+ *
+ * The platform had NO access log of any kind: the only per-request line came
+ * from the shared error handler, and only for 5xx — `logClientErrors` defaults
+ * false, so every 400, 401, 403, 404 and 422 in the platform was invisible. A
+ * customer reporting "it says my session expired" produced nothing to look at.
+ *
+ * Mount it immediately after `requestContext`, so the ALS scope exists.
+ */
+export declare function createHttpLogger(logger: pino.Logger): RequestHandler;
+//# sourceMappingURL=http-logger.d.ts.map

package/dist/middleware/http-logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-logger.d.ts","sourceRoot":"","sources":["../../src/middleware/http-logger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAyB,cAAc,EAAY,MAAM,SAAS,CAAC;AAC/E,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AA6D7B;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,GAAG,cAAc,CA6DpE"}

package/dist/middleware/http-logger.js

@@ -0,0 +1,119 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createHttpLogger = createHttpLogger;
+const context_1 = require("../context");
+/**
+ * Probe paths. The kubelet hits `/livez` every 20s and `/health` every 10s
+ * against ~30 pods, so logging them would make the readiness probe the single
+ * largest log stream in the cluster and push everything else out of retention.
+ *
+ * A probe FAILURE is still visible — the readiness gate shows up as an endpoint
+ * leaving the Service, which is a metric rather than a log line.
+ */
+const SKIP_PATHS = new Set(["/health", "/livez", "/readyz", "/metrics"]);
+/**
+ * The route PATTERN, not the URL.
+ *
+ * This field is a contract, not a convenience: the RED metrics are recording
+ * rules over it, so `/billing/me/invoices/:id` must stay one value rather than
+ * one per invoice. `req.path` is logged alongside it for the actual id, and
+ * carries no query string — same reason admin-service's audit row excludes one:
+ * `?token=…` on the verification route would put a live credential in the log.
+ */
+function routeOf(req) {
+    const raw = req.route?.path;
+    const base = req.baseUrl ?? "";
+    const join = (p) => `${base}${p === "/" ? "" : p}` || "/";
+    if (typeof raw === "string")
+        return join(raw);
+    if (Array.isArray(raw))
+        return raw.map((p) => join(String(p))).join("|");
+    if (raw !== undefined)
+        return `${base}(pattern)`;
+    // No route matched — a 404, or a middleware that answered before routing.
+    return base ? `${base}(unmatched)` : "(unmatched)";
+}
+/**
+ * The caller's address, best effort.
+ *
+ * `req.ip` is only the real client where `trust proxy` is set, which is true in
+ * exactly three services (admin, analytics, auth). Everywhere else it is the
+ * ingress-nginx pod. Reading the first `x-forwarded-for` hop directly gives a
+ * useful answer in the other eighteen without changing `trust proxy`, which
+ * feeds real security decisions and is not something a logging change should
+ * touch.
+ *
+ * It is spoofable by anyone who can set the header. That is acceptable for a
+ * log field and would NOT be for an authorization one.
+ */
+function clientIp(req) {
+    const forwarded = req.headers["x-forwarded-for"];
+    const first = typeof forwarded === "string"
+        ? forwarded.split(",")[0]
+        : Array.isArray(forwarded)
+            ? forwarded[0]
+            : undefined;
+    return first?.trim() || req.ip;
+}
+/**
+ * One line per finished request.
+ *
+ * The platform had NO access log of any kind: the only per-request line came
+ * from the shared error handler, and only for 5xx — `logClientErrors` defaults
+ * false, so every 400, 401, 403, 404 and 422 in the platform was invisible. A
+ * customer reporting "it says my session expired" produced nothing to look at.
+ *
+ * Mount it immediately after `requestContext`, so the ALS scope exists.
+ */
+function createHttpLogger(logger) {
+    return function httpLogger(req, res, next) {
+        /**
+         * From `originalUrl`, never `req.path`.
+         *
+         * Express STRIPS the mount point off `req.url` while a mounted router
+         * dispatches, and `req.path` is a getter over it — so by the time the
+         * finish callback runs, a request to `/billing/me/invoices/x` reports
+         * `/me/invoices/x`. Every service in this platform mounts its router at a
+         * prefix, so that is every request, and the logged path would name a route
+         * that does not exist. `originalUrl` is not mutated.
+         *
+         * The query string is cut rather than logged: `?token=…` on the
+         * verification route is a live credential, and admin-service's audit row
+         * excludes one for the same reason.
+         */
+        const originalUrl = req.originalUrl || req.url;
+        const queryAt = originalUrl.indexOf("?");
+        const path = queryAt === -1 ? originalUrl : originalUrl.slice(0, queryAt);
+        if (SKIP_PATHS.has(path))
+            return next();
+        const startedAt = process.hrtime.bigint();
+        /**
+         * Captured by REFERENCE at request start, not read inside the callback.
+         *
+         * `res.on("finish")` fires from the socket write path, and whether the ALS
+         * scope is still active there depends on how the response was flushed —
+         * which is not a thing to make the access log depend on. `bindContext`
+         * mutates this same object, so `userId` set later by `authenticate` is
+         * still visible here.
+         */
+        const context = (0, context_1.getContext)();
+        const fallback = req.requestId;
+        res.on("finish", () => {
+            const status = res.statusCode;
+            const level = status >= 500 ? "error" : status >= 400 ? "warn" : "info";
+            const contentLength = Number(res.getHeader("content-length"));
+            logger[level]({
+                ...(context ?? (fallback ? { requestId: fallback } : {})),
+                method: req.method,
+                route: routeOf(req),
+                path,
+                status,
+                durationMs: Math.round(Number(process.hrtime.bigint() - startedAt) / 1e5) / 10,
+                ...(Number.isFinite(contentLength) ? { bytes: contentLength } : {}),
+                ...(clientIp(req) ? { ip: clientIp(req) } : {}),
+            }, "request");
+        });
+        next();
+    };
+}
+//# sourceMappingURL=http-logger.js.map

package/dist/middleware/http-logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"http-logger.js","sourceRoot":"","sources":["../../src/middleware/http-logger.ts"],"names":[],"mappings":";;AAwEA,4CA6DC;AAnID,wCAAwC;AAExC;;;;;;;GAOG;AACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;AAEzE;;;;;;;;GAQG;AACH,SAAS,OAAO,CAAC,GAAY;IAC3B,MAAM,GAAG,GAAa,GAAsC,CAAC,KAAK,EAAE,IAAI,CAAC;IACzE,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAE/B,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,GAAG,CAAC;IAElE,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,GAAG,IAAI,WAAW,CAAC;IAEjD,0EAA0E;IAC1E,OAAO,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,QAAQ,CAAC,GAAY;IAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACjD,MAAM,KAAK,GACT,OAAO,SAAS,KAAK,QAAQ;QAC3B,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YACxB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;YACd,CAAC,CAAC,SAAS,CAAC;IAElB,OAAO,KAAK,EAAE,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE,CAAC;AACjC,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,gBAAgB,CAAC,MAAmB;IAClD,OAAO,SAAS,UAAU,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB;QACxE;;;;;;;;;;;;;WAaG;QACH,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,GAAG,CAAC;QAC/C,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAE1E,IAAI,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAExC,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;QAE1C;;;;;;;;WAQG;QACH,MAAM,OAAO,GAAG,IAAA,oBAAU,GAAE,CAAC;QAC7B,MAAM,QAAQ,GAAI,GAA8B,CAAC,SAAS,CAAC;QAE3D,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;YACpB,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC;YAC9B,MAAM,KAAK,GACT,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;YAE5D,MAAM,aAAa,GAAG,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC;YAE9D,MAAM,CAAC,KAAK,CAAC,CACX;gBACE,GAAG,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBACzD,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC;gBACnB,IAAI;gBACJ,MAAM;gBACN,UAAU,EACR,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,SAAS,CAAC,GAAG,GAAG,CAAC,GAAG,EAAE;gBACpE,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACnE,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChD,EACD,SAAS,CACV,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC"}

package/dist/middleware/index.d.ts

@@ -0,0 +1,2 @@
+export * from "./http-logger";
+//# sourceMappingURL=index.d.ts.map

package/dist/middleware/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":"AAAA,cAAc,eAAe,CAAC"}

package/dist/middleware/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./http-logger"), exports);
+//# sourceMappingURL=index.js.map

package/dist/middleware/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/middleware/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,gDAA8B"}

package/dist/redact.d.ts

@@ -0,0 +1,16 @@
+/**
+ * pino's `redact.paths`, which is a fixed-path mechanism: `a.b.c`, `a[*].b` and
+ * `*.b` only. It cannot walk to arbitrary depth, which is why
+ * `scrubResponseData` in serialize.ts exists as well — these two are not
+ * alternatives, they cover different shapes.
+ *
+ * This list covers OUR payloads. The service inherited only the last ten
+ * entries, all of them axios auth headers, so a request body reaching a log
+ * carried its password in the clear.
+ */
+export declare const REDACT_PATHS: string[];
+export declare const REDACT: {
+    paths: string[];
+    censor: string;
+};
+//# sourceMappingURL=redact.d.ts.map

package/dist/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":"AAEA;;;;;;;;;GASG;AACH,eAAO,MAAM,YAAY,EAAE,MAAM,EAqDhC,CAAC;AAEF,eAAO,MAAM,MAAM;;;CAGlB,CAAC"}

package/dist/redact.js

@@ -0,0 +1,69 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REDACT = exports.REDACT_PATHS = void 0;
+const serialize_1 = require("./serialize");
+/**
+ * pino's `redact.paths`, which is a fixed-path mechanism: `a.b.c`, `a[*].b` and
+ * `*.b` only. It cannot walk to arbitrary depth, which is why
+ * `scrubResponseData` in serialize.ts exists as well — these two are not
+ * alternatives, they cover different shapes.
+ *
+ * This list covers OUR payloads. The service inherited only the last ten
+ * entries, all of them axios auth headers, so a request body reaching a log
+ * carried its password in the clear.
+ */
+exports.REDACT_PATHS = [
+    // Credentials at the top level of a logged object.
+    "password",
+    "newPassword",
+    "currentPassword",
+    "confirmPassword",
+    "passwordHash",
+    "token",
+    "accessToken",
+    "refreshToken",
+    "apiKey",
+    "secret",
+    "clientSecret",
+    // …and one level down, which is where a logged `body` or `payload` puts them.
+    "*.password",
+    "*.newPassword",
+    "*.currentPassword",
+    "*.confirmPassword",
+    "*.passwordHash",
+    "*.token",
+    "*.accessToken",
+    "*.refreshToken",
+    "*.apiKey",
+    "*.secret",
+    "*.clientSecret",
+    // Session material. `set-cookie` needs bracket form — the hyphen is not a
+    // valid bare path segment.
+    "cookie",
+    "*.cookie",
+    'headers["set-cookie"]',
+    'res.headers["set-cookie"]',
+    "headers.cookie",
+    "headers.Cookie",
+    "req.headers.cookie",
+    "req.headers.Cookie",
+    // The ten inherited entries — axios request/response auth headers.
+    "err.config.auth",
+    "err.config.headers.authorization",
+    "err.config.headers.Authorization",
+    "err.request._header",
+    "config.auth",
+    "config.headers.authorization",
+    "config.headers.Authorization",
+    "headers.authorization",
+    "headers.Authorization",
+    "*.auth.username",
+    // The same, on the shape the access log and error handler produce.
+    "req.headers.authorization",
+    "req.headers.Authorization",
+];
+exports.REDACT = {
+    paths: exports.REDACT_PATHS,
+    censor: serialize_1.CENSOR,
+};
+//# sourceMappingURL=redact.js.map

package/dist/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../src/redact.ts"],"names":[],"mappings":";;;AAAA,2CAAqC;AAErC;;;;;;;;;GASG;AACU,QAAA,YAAY,GAAa;IACpC,mDAAmD;IACnD,UAAU;IACV,aAAa;IACb,iBAAiB;IACjB,iBAAiB;IACjB,cAAc;IACd,OAAO;IACP,aAAa;IACb,cAAc;IACd,QAAQ;IACR,QAAQ;IACR,cAAc;IAEd,8EAA8E;IAC9E,YAAY;IACZ,eAAe;IACf,mBAAmB;IACnB,mBAAmB;IACnB,gBAAgB;IAChB,SAAS;IACT,eAAe;IACf,gBAAgB;IAChB,UAAU;IACV,UAAU;IACV,gBAAgB;IAEhB,0EAA0E;IAC1E,2BAA2B;IAC3B,QAAQ;IACR,UAAU;IACV,uBAAuB;IACvB,2BAA2B;IAC3B,gBAAgB;IAChB,gBAAgB;IAChB,oBAAoB;IACpB,oBAAoB;IAEpB,mEAAmE;IACnE,iBAAiB;IACjB,kCAAkC;IAClC,kCAAkC;IAClC,qBAAqB;IACrB,aAAa;IACb,8BAA8B;IAC9B,8BAA8B;IAC9B,uBAAuB;IACvB,uBAAuB;IACvB,iBAAiB;IAEjB,mEAAmE;IACnE,2BAA2B;IAC3B,2BAA2B;CAC5B,CAAC;AAEW,QAAA,MAAM,GAAG;IACpB,KAAK,EAAE,oBAAY;IACnB,MAAM,EAAE,kBAAM;CACf,CAAC"}

package/dist/serialize.d.ts

@@ -0,0 +1,27 @@
+/**
+ * How much of a third party's error body is worth keeping. Enough for the
+ * gateway's own message and error code, not enough for a page of JSON.
+ */
+export declare const MAX_DATA_BYTES = 2048;
+export declare const CENSOR = "[redacted]";
+/**
+ * Redacts personal and credential keys inside a third party's response body,
+ * then caps the whole thing.
+ *
+ * The cap is applied AFTER redaction rather than instead of it: truncating
+ * first would leave whatever fitted in the first 2 KB, which for a Xendit
+ * charge failure is the payer block.
+ *
+ * Exported so a service can scrub a body it logs deliberately, outside an
+ * error.
+ */
+export declare function scrubResponseData(data: unknown): unknown;
+/**
+ * The `err` / `error` serializer every service uses.
+ *
+ * The axios branch is unchanged in shape from the copy that was duplicated 21
+ * times — the same eight fields, so nothing that reads these logs has to
+ * change. What is new is that `data` and `stack` are bounded and scrubbed.
+ */
+export declare function serializeError(err: any): unknown;
+//# sourceMappingURL=serialize.d.ts.map

package/dist/serialize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize.d.ts","sourceRoot":"","sources":["../src/serialize.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,eAAO,MAAM,cAAc,OAAO,CAAC;AAKnC,eAAO,MAAM,MAAM,eAAe,CAAC;AAkDnC;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAuBxD;AASD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAehD"}

package/dist/serialize.js

@@ -0,0 +1,124 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CENSOR = exports.MAX_DATA_BYTES = void 0;
+exports.scrubResponseData = scrubResponseData;
+exports.serializeError = serializeError;
+const pino_1 = __importDefault(require("pino"));
+/**
+ * How much of a third party's error body is worth keeping. Enough for the
+ * gateway's own message and error code, not enough for a page of JSON.
+ */
+exports.MAX_DATA_BYTES = 2048;
+const MAX_STACK_CHARS = 4096;
+const MAX_DEPTH = 6;
+const MAX_ARRAY_ITEMS = 20;
+exports.CENSOR = "[redacted]";
+/**
+ * Keys whose VALUES are personal data, matched case-insensitively at any depth
+ * inside a third party's response body.
+ *
+ * This list is not about our own payloads — `redact.paths` covers those. It is
+ * about what Xendit, Stripe, Resend, Meta, Apify, Cloudflare and Gitea put in
+ * an error body, which we neither control nor review. Before this, 407
+ * `logger.error({ err, ... })` call sites fed `err.response.data` into the log
+ * verbatim and uncapped, and the payment gateways alone return payer name,
+ * email, VA number and card last-4 in a failed-charge body.
+ */
+const PII_KEY = /(^|_)(email|phone|msisdn|whatsapp|address|nik|npwp|dob|birth_?date)($|_)|(^|_)(full|first|last|given|family|customer|payer|holder|account|recipient|sender)_?name($|_)|card|va_?number|account_?(number|holder)|payer|recipient/i;
+/**
+ * Keys whose values are credentials. Same matching, same reason: a gateway that
+ * echoes the request back in its error body echoes the key with it.
+ */
+const SECRET_KEY = /(^|_)(password|passwd|secret|token|apikey|api_key|authorization|auth|signature|cookie|credential|private_?key)($|_)|token$|secret$/i;
+function scrubValue(value, depth) {
+    if (value === null || value === undefined)
+        return value;
+    if (Array.isArray(value)) {
+        if (depth >= MAX_DEPTH)
+            return "[depth]";
+        const kept = value.slice(0, MAX_ARRAY_ITEMS).map((v) => scrubValue(v, depth + 1));
+        return value.length > MAX_ARRAY_ITEMS
+            ? [...kept, `[+${value.length - MAX_ARRAY_ITEMS} more]`]
+            : kept;
+    }
+    if (typeof value === "object") {
+        if (depth >= MAX_DEPTH)
+            return "[depth]";
+        const out = {};
+        for (const [key, inner] of Object.entries(value)) {
+            if (SECRET_KEY.test(key) || PII_KEY.test(key)) {
+                out[key] = exports.CENSOR;
+                continue;
+            }
+            out[key] = scrubValue(inner, depth + 1);
+        }
+        return out;
+    }
+    return value;
+}
+/**
+ * Redacts personal and credential keys inside a third party's response body,
+ * then caps the whole thing.
+ *
+ * The cap is applied AFTER redaction rather than instead of it: truncating
+ * first would leave whatever fitted in the first 2 KB, which for a Xendit
+ * charge failure is the payer block.
+ *
+ * Exported so a service can scrub a body it logs deliberately, outside an
+ * error.
+ */
+function scrubResponseData(data) {
+    if (data === null || data === undefined)
+        return data;
+    if (typeof data === "string") {
+        return data.length > exports.MAX_DATA_BYTES
+            ? `${data.slice(0, exports.MAX_DATA_BYTES)}…[truncated]`
+            : data;
+    }
+    const scrubbed = scrubValue(data, 0);
+    let serialized;
+    try {
+        serialized = JSON.stringify(scrubbed) ?? "";
+    }
+    catch {
+        // Circular, or a BigInt — `JSON.stringify` throws on both, and a logger
+        // that throws while logging an error loses the error it was called about.
+        return "[unserializable]";
+    }
+    if (serialized.length <= exports.MAX_DATA_BYTES)
+        return scrubbed;
+    return `${serialized.slice(0, exports.MAX_DATA_BYTES)}…[truncated ${serialized.length} bytes]`;
+}
+function capStack(stack) {
+    if (typeof stack !== "string")
+        return stack;
+    return stack.length > MAX_STACK_CHARS
+        ? `${stack.slice(0, MAX_STACK_CHARS)}…[truncated]`
+        : stack;
+}
+/**
+ * The `err` / `error` serializer every service uses.
+ *
+ * The axios branch is unchanged in shape from the copy that was duplicated 21
+ * times — the same eight fields, so nothing that reads these logs has to
+ * change. What is new is that `data` and `stack` are bounded and scrubbed.
+ */
+function serializeError(err) {
+    if (err && (err.isAxiosError || err.config)) {
+        return {
+            name: err.name,
+            message: err.message,
+            code: err.code,
+            status: err.response?.status,
+            data: scrubResponseData(err.response?.data),
+            method: err.config?.method,
+            url: err.config?.url,
+            stack: capStack(err.stack),
+        };
+    }
+    return pino_1.default.stdSerializers.err(err);
+}
+//# sourceMappingURL=serialize.js.map

package/dist/serialize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize.js","sourceRoot":"","sources":["../src/serialize.ts"],"names":[],"mappings":";;;;;;AAwEA,8CAuBC;AAgBD,wCAeC;AA9HD,gDAAwB;AAExB;;;GAGG;AACU,QAAA,cAAc,GAAG,IAAI,CAAC;AACnC,MAAM,eAAe,GAAG,IAAI,CAAC;AAC7B,MAAM,SAAS,GAAG,CAAC,CAAC;AACpB,MAAM,eAAe,GAAG,EAAE,CAAC;AAEd,QAAA,MAAM,GAAG,YAAY,CAAC;AAEnC;;;;;;;;;;GAUG;AACH,MAAM,OAAO,GACX,kOAAkO,CAAC;AAErO;;;GAGG;AACH,MAAM,UAAU,GACd,qIAAqI,CAAC;AAExI,SAAS,UAAU,CAAC,KAAc,EAAE,KAAa;IAC/C,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAExD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,IAAI,KAAK,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QAClF,OAAO,KAAK,CAAC,MAAM,GAAG,eAAe;YACnC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,KAAK,KAAK,CAAC,MAAM,GAAG,eAAe,QAAQ,CAAC;YACxD,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QACzC,MAAM,GAAG,GAA4B,EAAE,CAAC;QACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YAC5E,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC9C,GAAG,CAAC,GAAG,CAAC,GAAG,cAAM,CAAC;gBAClB,SAAS;YACX,CAAC;YACD,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;QAC1C,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,iBAAiB,CAAC,IAAa;IAC7C,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAErD,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,OAAO,IAAI,CAAC,MAAM,GAAG,sBAAc;YACjC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAc,CAAC,cAAc;YAChD,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAED,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAErC,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,wEAAwE;QACxE,0EAA0E;QAC1E,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED,IAAI,UAAU,CAAC,MAAM,IAAI,sBAAc;QAAE,OAAO,QAAQ,CAAC;IAEzD,OAAO,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,sBAAc,CAAC,eAAe,UAAU,CAAC,MAAM,SAAS,CAAC;AACzF,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,KAAK,CAAC,MAAM,GAAG,eAAe;QACnC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,cAAc;QAClD,CAAC,CAAC,KAAK,CAAC;AACZ,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,cAAc,CAAC,GAAQ;IACrC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,YAAY,IAAI,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QAC5C,OAAO;YACL,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,MAAM,EAAE,GAAG,CAAC,QAAQ,EAAE,MAAM;YAC5B,IAAI,EAAE,iBAAiB,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,CAAC;YAC3C,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM;YAC1B,GAAG,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG;YACpB,KAAK,EAAE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;SAC3B,CAAC;IACJ,CAAC;IAED,OAAO,cAAI,CAAC,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;AACtC,CAAC"}

package/dist/transport.d.ts

@@ -0,0 +1,36 @@
+import pino from "pino";
+/**
+ * Unchanged from the copy that lived in all 21 services, deliberately — the
+ * local-dev experience and the `LOG_DIR` rotation behaviour are not what this
+ * package is changing.
+ *
+ * `LOG_DIR` is unset in every k8s ConfigMap on purpose, so nothing here writes
+ * to disk in a deployed environment. That is what allows
+ * `readOnlyRootFilesystem: true` on every Deployment, and it is why the
+ * aggregation story is "pino writes JSON to stdout and an agent tails the
+ * node's pod logs" rather than a sidecar over a shared volume.
+ */
+export declare function buildTransport(logDir?: string, name?: string, pretty?: boolean): {
+    targets: pino.TransportTargetOptions[];
+} | undefined;
+/**
+ * Pretty everywhere but production — EXCEPT under test.
+ *
+ * pino-pretty is a `transport`, and a transport is a worker thread
+ * (thread-stream). Jest cannot reap it: every suite passes, Jest prints a green
+ * summary, and then the process exits 1 because the worker outlived it. It is a
+ * race, so it stays invisible on a fast machine and fails on a contended CI
+ * runner — the failure reads as "Process completed with exit code 1" under a
+ * fully green report.
+ *
+ * `tests/setup/env.ts` deletes LOG_DIR believing that disables the transport.
+ * It does not: `buildTransport` pushes pino-pretty on `pretty` alone,
+ * independent of logDir.
+ *
+ * Fourteen services carried this guard and SEVEN did not — domain, moderation,
+ * analytics, admin, support, memory and design were all one contended runner
+ * away from the same green-but-exit-1 failure. Having it in one place is half
+ * the reason this package exists.
+ */
+export declare function shouldPretty(nodeEnv?: string | undefined): boolean;
+//# sourceMappingURL=transport.d.ts.map

package/dist/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,MAAM,CAAC;AAExB;;;;;;;;;;GAUG;AACH,wBAAgB,cAAc,CAC5B,MAAM,CAAC,EAAE,MAAM,EACf,IAAI,SAAQ,EACZ,MAAM,UAAQ,GACb;IAAE,OAAO,EAAE,IAAI,CAAC,sBAAsB,EAAE,CAAA;CAAE,GAAG,SAAS,CA2BxD;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAgB,YAAY,CAAC,OAAO,qBAAuB,GAAG,OAAO,CAEpE"}

package/dist/transport.js

@@ -0,0 +1,63 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildTransport = buildTransport;
+exports.shouldPretty = shouldPretty;
+/**
+ * Unchanged from the copy that lived in all 21 services, deliberately — the
+ * local-dev experience and the `LOG_DIR` rotation behaviour are not what this
+ * package is changing.
+ *
+ * `LOG_DIR` is unset in every k8s ConfigMap on purpose, so nothing here writes
+ * to disk in a deployed environment. That is what allows
+ * `readOnlyRootFilesystem: true` on every Deployment, and it is why the
+ * aggregation story is "pino writes JSON to stdout and an agent tails the
+ * node's pod logs" rather than a sidecar over a shared volume.
+ */
+function buildTransport(logDir, name = "app", pretty = false) {
+    const targets = [];
+    if (pretty) {
+        targets.push({ target: "pino-pretty", options: { colorize: true } });
+    }
+    if (logDir) {
+        if (!pretty) {
+            // destination 1 = stdout fd
+            targets.push({ target: "pino/file", options: { destination: 1 } });
+        }
+        targets.push({
+            target: "pino-roll",
+            options: {
+                file: `${logDir}/${name}`,
+                frequency: "daily",
+                dateFormat: "yyyy-MM-dd",
+                extension: ".log",
+                mkdir: true,
+                symlink: true,
+                limit: { count: 30, removeOtherLogFiles: true },
+            },
+        });
+    }
+    return targets.length ? { targets } : undefined;
+}
+/**
+ * Pretty everywhere but production — EXCEPT under test.
+ *
+ * pino-pretty is a `transport`, and a transport is a worker thread
+ * (thread-stream). Jest cannot reap it: every suite passes, Jest prints a green
+ * summary, and then the process exits 1 because the worker outlived it. It is a
+ * race, so it stays invisible on a fast machine and fails on a contended CI
+ * runner — the failure reads as "Process completed with exit code 1" under a
+ * fully green report.
+ *
+ * `tests/setup/env.ts` deletes LOG_DIR believing that disables the transport.
+ * It does not: `buildTransport` pushes pino-pretty on `pretty` alone,
+ * independent of logDir.
+ *
+ * Fourteen services carried this guard and SEVEN did not — domain, moderation,
+ * analytics, admin, support, memory and design were all one contended runner
+ * away from the same green-but-exit-1 failure. Having it in one place is half
+ * the reason this package exists.
+ */
+function shouldPretty(nodeEnv = process.env.NODE_ENV) {
+    return nodeEnv !== "production" && nodeEnv !== "test";
+}
+//# sourceMappingURL=transport.js.map

package/dist/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../src/transport.ts"],"names":[],"mappings":";;AAaA,wCA+BC;AAqBD,oCAEC;AAjED;;;;;;;;;;GAUG;AACH,SAAgB,cAAc,CAC5B,MAAe,EACf,IAAI,GAAG,KAAK,EACZ,MAAM,GAAG,KAAK;IAEd,MAAM,OAAO,GAAkC,EAAE,CAAC;IAElD,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,4BAA4B;YAC5B,OAAO,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC;YACX,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE;gBACP,IAAI,EAAE,GAAG,MAAM,IAAI,IAAI,EAAE;gBACzB,SAAS,EAAE,OAAO;gBAClB,UAAU,EAAE,YAAY;gBACxB,SAAS,EAAE,MAAM;gBACjB,KAAK,EAAE,IAAI;gBACX,OAAO,EAAE,IAAI;gBACb,KAAK,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE;aAChD;SACF,CAAC,CAAC;IACL,CAAC;IAED,OAAO,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAgB,YAAY,CAAC,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ;IACzD,OAAO,OAAO,KAAK,YAAY,IAAI,OAAO,KAAK,MAAM,CAAC;AACxD,CAAC"}

package/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "@easyweb/logging",
+  "version": "1.0.0",
+  "description": "Shared structured logging for Easyweb microservices: one pino configuration, request-scoped context over AsyncLocalStorage, an HTTP access log, and the redaction every service needs before its logs leave the pod",
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "exports": {
+    ".": {
+      "require": "./dist/index.js",
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "scripts": {
+    "build": "npm run clean && tsc",
+    "build:watch": "tsc --watch",
+    "prepublishOnly": "npm run build",
+    "clean": "rimraf dist",
+    "test": "jest",
+    "typecheck": "tsc --noEmit",
+    "typecheck:test": "tsc -p tsconfig.test.json --noEmit"
+  },
+  "keywords": [
+    "microservices",
+    "express",
+    "logging",
+    "pino",
+    "observability"
+  ],
+  "author": "Easy Web Team",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/Alpine-Solusi/website-builder.git",
+    "directory": "common-logging"
+  },
+  "peerDependencies": {
+    "express": "^5.0.0",
+    "pino": "^10.0.0"
+  },
+  "devDependencies": {
+    "@swc/core": "^1.15.47",
+    "@swc/jest": "^0.2.39",
+    "@types/express": "^5.0.6",
+    "@types/jest": "^30.0.0",
+    "@types/node": "^26.0.1",
+    "express": "^5.1.0",
+    "jest": "^30.4.2",
+    "pino": "^10.3.1",
+    "rimraf": "^6.1.3",
+    "typescript": "^6.0.3"
+  },
+  "engines": {
+    "node": ">=18.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  }
+}