@geekmidas/logger 10.0.0-alpha.9 → 10.0.0-alpha.90

package/dist/otel.mjs

@@ -0,0 +1,110 @@
+import { SeverityNumber, logs } from "@opentelemetry/api-logs";
+//#region src/otel.ts
+/**
+* The bridge from pino to OpenTelemetry logs.
+*
+* A pino record is also emitted through `@opentelemetry/api-logs` when a
+* `LoggerProvider` is registered globally — as the generated telemetry setup
+* of a production server does. Nothing hooks module loading, so it works the
+* same in a single bundled file as from `node_modules`.
+*
+* `@opentelemetry/api-logs` keeps its provider on `globalThis` under a
+* `Symbol.for` key, so the copy imported here and the copy the SDK registered
+* through share one provider even when a bundle holds both. That is why the
+* provider is looked up per record rather than once: a logger obtained before
+* the SDK registered — or through another copy's proxy — would stay a no-op.
+*
+* @module
+*/
+/** The instrumentation scope every bridged record carries. */
+const OTEL_SCOPE = "@geekmidas/logger";
+/** Pino's level labels, upper-cased as the logger prints them. */
+const SEVERITY = {
+	TRACE: SeverityNumber.TRACE,
+	DEBUG: SeverityNumber.DEBUG,
+	INFO: SeverityNumber.INFO,
+	WARN: SeverityNumber.WARN,
+	ERROR: SeverityNumber.ERROR,
+	FATAL: SeverityNumber.FATAL
+};
+/** Pino's numeric levels, for a record whose level was not formatted. */
+function severityFromNumber(level) {
+	if (level >= 60) return SeverityNumber.FATAL;
+	if (level >= 50) return SeverityNumber.ERROR;
+	if (level >= 40) return SeverityNumber.WARN;
+	if (level >= 30) return SeverityNumber.INFO;
+	if (level >= 20) return SeverityNumber.DEBUG;
+	return SeverityNumber.TRACE;
+}
+const SEVERITY_TEXT = {
+	[SeverityNumber.TRACE]: "TRACE",
+	[SeverityNumber.DEBUG]: "DEBUG",
+	[SeverityNumber.INFO]: "INFO",
+	[SeverityNumber.WARN]: "WARN",
+	[SeverityNumber.ERROR]: "ERROR",
+	[SeverityNumber.FATAL]: "FATAL"
+};
+let cached;
+/** The bridge's logger from whichever provider is registered now. */
+function otelLogger() {
+	const provider = logs.getLoggerProvider();
+	if (cached?.provider !== provider) cached = {
+		provider,
+		logger: provider.getLogger(OTEL_SCOPE)
+	};
+	return cached.logger;
+}
+/**
+* Emit one serialized pino line through OpenTelemetry, when a provider is
+* registered that wants it.
+*
+* The line is what pino is about to write — after path redaction and the
+* URL-credential redaction — so the exported copy is exactly as redacted as
+* stdout. It runs synchronously inside the log call, so the active context —
+* and with it the trace and span ids — is the caller's.
+*
+* Without a registered provider the logger is a no-op whose `enabled()` is
+* false, and the line is not parsed.
+*/
+function emitToOtel(line) {
+	const logger = otelLogger();
+	if (!logger.enabled()) return;
+	let record;
+	try {
+		record = JSON.parse(line);
+	} catch {
+		return;
+	}
+	const { level, time, msg, ...attributes } = record;
+	const severityNumber = typeof level === "number" ? severityFromNumber(level) : SEVERITY[String(level).toUpperCase()] ?? SeverityNumber.UNSPECIFIED;
+	if (!logger.enabled({ severityNumber })) return;
+	logger.emit({
+		severityNumber,
+		severityText: SEVERITY_TEXT[severityNumber] ?? (level === void 0 ? void 0 : String(level)),
+		...msg !== void 0 && { body: String(msg) },
+		...typeof time === "number" && { timestamp: time },
+		attributes
+	});
+}
+/**
+* The bridge as a pino `streamWrite` hook, for a logger made with `pino()`
+* directly rather than `createLogger` — which installs it already.
+*
+* @example
+* ```typescript
+* import pino from 'pino';
+* import { otelStreamWrite } from '@geekmidas/logger/otel';
+*
+* const logger = pino({ hooks: { streamWrite: otelStreamWrite } });
+* ```
+*/
+function otelStreamWrite(line) {
+	try {
+		emitToOtel(line);
+	} catch {}
+	return line;
+}
+//#endregion
+export { OTEL_SCOPE, emitToOtel, otelStreamWrite };
+
+//# sourceMappingURL=otel.mjs.map

package/dist/otel.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"otel.mjs","names":[],"sources":["../src/otel.ts"],"sourcesContent":["/**\n * The bridge from pino to OpenTelemetry logs.\n *\n * A pino record is also emitted through `@opentelemetry/api-logs` when a\n * `LoggerProvider` is registered globally — as the generated telemetry setup\n * of a production server does. Nothing hooks module loading, so it works the\n * same in a single bundled file as from `node_modules`.\n *\n * `@opentelemetry/api-logs` keeps its provider on `globalThis` under a\n * `Symbol.for` key, so the copy imported here and the copy the SDK registered\n * through share one provider even when a bundle holds both. That is why the\n * provider is looked up per record rather than once: a logger obtained before\n * the SDK registered — or through another copy's proxy — would stay a no-op.\n *\n * @module\n */\nimport {\n\ttype AnyValueMap,\n\ttype Logger,\n\ttype LoggerProvider,\n\tlogs,\n\tSeverityNumber,\n} from '@opentelemetry/api-logs';\n\n/** The instrumentation scope every bridged record carries. */\nexport const OTEL_SCOPE = '@geekmidas/logger';\n\n/** Pino's level labels, upper-cased as the logger prints them. */\nconst SEVERITY: Record<string, SeverityNumber> = {\n\tTRACE: SeverityNumber.TRACE,\n\tDEBUG: SeverityNumber.DEBUG,\n\tINFO: SeverityNumber.INFO,\n\tWARN: SeverityNumber.WARN,\n\tERROR: SeverityNumber.ERROR,\n\tFATAL: SeverityNumber.FATAL,\n};\n\n/** Pino's numeric levels, for a record whose level was not formatted. */\nfunction severityFromNumber(level: number): SeverityNumber {\n\tif (level >= 60) return SeverityNumber.FATAL;\n\tif (level >= 50) return SeverityNumber.ERROR;\n\tif (level >= 40) return SeverityNumber.WARN;\n\tif (level >= 30) return SeverityNumber.INFO;\n\tif (level >= 20) return SeverityNumber.DEBUG;\n\treturn SeverityNumber.TRACE;\n}\n\nconst SEVERITY_TEXT: Partial<Record<SeverityNumber, string>> = {\n\t[SeverityNumber.TRACE]: 'TRACE',\n\t[SeverityNumber.DEBUG]: 'DEBUG',\n\t[SeverityNumber.INFO]: 'INFO',\n\t[SeverityNumber.WARN]: 'WARN',\n\t[SeverityNumber.ERROR]: 'ERROR',\n\t[SeverityNumber.FATAL]: 'FATAL',\n};\n\nlet cached: { provider: LoggerProvider; logger: Logger } | undefined;\n\n/** The bridge's logger from whichever provider is registered now. */\nfunction otelLogger(): Logger {\n\tconst provider = logs.getLoggerProvider();\n\tif (cached?.provider !== provider) {\n\t\tcached = { provider, logger: provider.getLogger(OTEL_SCOPE) };\n\t}\n\treturn cached.logger;\n}\n\n/**\n * Emit one serialized pino line through OpenTelemetry, when a provider is\n * registered that wants it.\n *\n * The line is what pino is about to write — after path redaction and the\n * URL-credential redaction — so the exported copy is exactly as redacted as\n * stdout. It runs synchronously inside the log call, so the active context —\n * and with it the trace and span ids — is the caller's.\n *\n * Without a registered provider the logger is a no-op whose `enabled()` is\n * false, and the line is not parsed.\n */\nexport function emitToOtel(line: string): void {\n\tconst logger = otelLogger();\n\tif (!logger.enabled()) return;\n\n\tlet record: Record<string, unknown>;\n\ttry {\n\t\trecord = JSON.parse(line);\n\t} catch {\n\t\treturn;\n\t}\n\n\tconst { level, time, msg, ...attributes } = record;\n\tconst severityNumber =\n\t\ttypeof level === 'number'\n\t\t\t? severityFromNumber(level)\n\t\t\t: (SEVERITY[String(level).toUpperCase()] ?? SeverityNumber.UNSPECIFIED);\n\n\tif (!logger.enabled({ severityNumber })) return;\n\n\tlogger.emit({\n\t\tseverityNumber,\n\t\tseverityText:\n\t\t\tSEVERITY_TEXT[severityNumber] ??\n\t\t\t(level === undefined ? undefined : String(level)),\n\t\t...(msg !== undefined && { body: String(msg) }),\n\t\t...(typeof time === 'number' && { timestamp: time }),\n\t\tattributes: attributes as AnyValueMap,\n\t});\n}\n\n/**\n * The bridge as a pino `streamWrite` hook, for a logger made with `pino()`\n * directly rather than `createLogger` — which installs it already.\n *\n * @example\n * ```typescript\n * import pino from 'pino';\n * import { otelStreamWrite } from '@geekmidas/logger/otel';\n *\n * const logger = pino({ hooks: { streamWrite: otelStreamWrite } });\n * ```\n */\nexport function otelStreamWrite(line: string): string {\n\ttry {\n\t\temitToOtel(line);\n\t} catch {\n\t\t// Exporting a log is never a reason to lose it from stdout.\n\t}\n\treturn line;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAyBA,MAAa,aAAa;;AAG1B,MAAM,WAA2C;CAChD,OAAO,eAAe;CACtB,OAAO,eAAe;CACtB,MAAM,eAAe;CACrB,MAAM,eAAe;CACrB,OAAO,eAAe;CACtB,OAAO,eAAe;AACvB;;AAGA,SAAS,mBAAmB,OAA+B;CAC1D,IAAI,SAAS,IAAI,OAAO,eAAe;CACvC,IAAI,SAAS,IAAI,OAAO,eAAe;CACvC,IAAI,SAAS,IAAI,OAAO,eAAe;CACvC,IAAI,SAAS,IAAI,OAAO,eAAe;CACvC,IAAI,SAAS,IAAI,OAAO,eAAe;CACvC,OAAO,eAAe;AACvB;AAEA,MAAM,gBAAyD;EAC7D,eAAe,QAAQ;EACvB,eAAe,QAAQ;EACvB,eAAe,OAAO;EACtB,eAAe,OAAO;EACtB,eAAe,QAAQ;EACvB,eAAe,QAAQ;AACzB;AAEA,IAAI;;AAGJ,SAAS,aAAqB;CAC7B,MAAM,WAAW,KAAK,kBAAkB;CACxC,IAAI,QAAQ,aAAa,UACxB,SAAS;EAAE;EAAU,QAAQ,SAAS,UAAU,UAAU;CAAE;CAE7D,OAAO,OAAO;AACf;;;;;;;;;;;;;AAcA,SAAgB,WAAW,MAAoB;CAC9C,MAAM,SAAS,WAAW;CAC1B,IAAI,CAAC,OAAO,QAAQ,GAAG;CAEvB,IAAI;CACJ,IAAI;EACH,SAAS,KAAK,MAAM,IAAI;CACzB,QAAQ;EACP;CACD;CAEA,MAAM,EAAE,OAAO,MAAM,KAAK,GAAG,eAAe;CAC5C,MAAM,iBACL,OAAO,UAAU,WACd,mBAAmB,KAAK,IACvB,SAAS,OAAO,KAAK,CAAC,CAAC,YAAY,MAAM,eAAe;CAE7D,IAAI,CAAC,OAAO,QAAQ,EAAE,eAAe,CAAC,GAAG;CAEzC,OAAO,KAAK;EACX;EACA,cACC,cAAc,oBACb,UAAU,KAAA,IAAY,KAAA,IAAY,OAAO,KAAK;EAChD,GAAI,QAAQ,KAAA,KAAa,EAAE,MAAM,OAAO,GAAG,EAAE;EAC7C,GAAI,OAAO,SAAS,YAAY,EAAE,WAAW,KAAK;EACtC;CACb,CAAC;AACF;;;;;;;;;;;;;AAcA,SAAgB,gBAAgB,MAAsB;CACrD,IAAI;EACH,WAAW,IAAI;CAChB,QAAQ,CAER;CACA,OAAO;AACR"}

package/dist/pino.cjs

@@ -1,44 +1,54 @@
-//#region rolldown:runtime
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __copyProps = (to, from, except, desc) => {
-	if (from && typeof from === "object" || typeof from === "function") for (var keys = __getOwnPropNames(from), i = 0, n = keys.length, key; i < n; i++) {
-		key = keys[i];
-		if (!__hasOwnProp.call(to, key) && key !== except) __defProp(to, key, {
-			get: ((k) => from[k]).bind(null, key),
-			enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable
-		});
-	}
-	return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
-	value: mod,
-	enumerable: true
-}) : target, mod));
-
-//#endregion
-const require_redact_paths = require('./redact-paths-D0m0DIuQ.cjs');
-const pino = __toESM(require("pino"));
-
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_otel = require("./otel.cjs");
+const require_redact_paths = require("./redact-paths.cjs");
+let pino = require("pino");
 //#region src/pino.ts
 /**
+* Pino logger with built-in redaction support for sensitive data.
+*
+* Redaction is on by default: a logger that was never told about passwords
+* and tokens still masks them. `redact: false` is the explicit opt-out.
+*
+* @example
+* ```typescript
+* import { createLogger, DEFAULT_REDACT_PATHS } from '@geekmidas/logger/pino';
+*
+* // Redaction with sensible defaults — the same as `redact: true`
+* const logger = createLogger();
+*
+* // Sensitive data is automatically masked
+* logger.info({ password: 'secret123', user: 'john' }, 'Login');
+* // Output: { password: '[Redacted]', user: 'john' } Login
+*
+* // Add custom paths (merged with defaults)
+* const logger2 = createLogger({ redact: ['user.ssn'] });
+*
+* // Override defaults for full control
+* const logger3 = createLogger({
+*   redact: {
+*     paths: ['onlyThis'],
+*     resolution: 'override',
+*   }
+* });
+* ```
+*
+* @module
+*/
+/**
 * Resolves redaction configuration from options.
-* Returns undefined if redaction is disabled, or a pino-compatible redact config.
+* Returns undefined only when redaction is turned off with `false`; leaving it
+* unset is the same as `true`, so sensitive paths are masked unless someone
+* decides they should not be.
 *
 * By default (resolution: 'merge'), custom paths are merged with DEFAULT_REDACT_PATHS.
 * With resolution: 'override', only the custom paths are used.
 */
 function resolveRedactConfig(redact) {
-	if (redact === void 0 || redact === false) return void 0;
-	if (redact === true) return require_redact_paths.DEFAULT_REDACT_PATHS;
+	if (redact === false) return;
+	if (redact === void 0 || redact === true) return require_redact_paths.DEFAULT_REDACT_PATHS;
 	if (Array.isArray(redact)) return [...require_redact_paths.DEFAULT_REDACT_PATHS, ...redact];
 	const { resolution = "merge", paths, censor, remove } = redact;
-	const resolvedPaths = resolution === "override" ? paths : [...require_redact_paths.DEFAULT_REDACT_PATHS, ...paths];
-	const config = { paths: resolvedPaths };
+	const config = { paths: resolution === "override" ? paths : [...require_redact_paths.DEFAULT_REDACT_PATHS, ...paths] };
 	if (censor !== void 0) config.censor = censor;
 	if (remove !== void 0) config.remove = remove;
 	return config;
@@ -51,28 +61,45 @@ function resolveRedactConfig(redact) {
 *
 * @example
 * ```typescript
-* // Basic logger
+* // Basic logger — sensitive paths are redacted by default
 * const logger = createLogger({ level: 'debug' });
 *
-* // With redaction enabled
-* const secureLogger = createLogger({ redact: true });
+* // Opt out of redaction
+* const rawLogger = createLogger({ redact: false });
 *
 * // Pretty printing in development
-* const devLogger = createLogger({ pretty: true, redact: true });
+* const devLogger = createLogger({ pretty: true });
 * ```
 */
 function createLogger(options = {}) {
-	const pretty = options?.pretty && process.NODE_ENV !== "production";
+	const pretty = options?.pretty && process.env.NODE_ENV !== "production";
 	const baseOptions = pretty ? { transport: {
 		target: "pino-pretty",
 		options: { colorize: true }
 	} } : {};
 	const redact = resolveRedactConfig(options.redact);
-	return (0, pino.pino)({
+	const serializeError = (value) => {
+		const serialized = pino.stdSerializers.err(value);
+		if (!redact || serialized === value) return serialized;
+		return require_redact_paths.redactUrlCredentialsIn({ ...serialized });
+	};
+	const pinoOptions = {
 		...baseOptions,
 		...options.level && { level: options.level },
 		...redact && { redact },
+		serializers: {
+			err: serializeError,
+			error: serializeError
+		},
+		hooks: {
+			...redact && { logMethod(args, method) {
+				const redacted = args.map((arg) => typeof arg === "string" ? require_redact_paths.redactUrlCredentials(arg) : arg);
+				return method.apply(this, redacted);
+			} },
+			streamWrite: require_otel.otelStreamWrite
+		},
 		formatters: {
+			...redact && { log: (object) => require_redact_paths.redactUrlCredentialsIn(object) },
 			bindings() {
 				return { nodeVersion: process.version };
 			},
@@ -80,10 +107,11 @@ function createLogger(options = {}) {
 				return { level: label.toUpperCase() };
 			}
 		}
-	});
+	};
+	return options.destination && !pretty ? (0, pino.pino)(pinoOptions, options.destination) : (0, pino.pino)(pinoOptions);
 }
-
 //#endregion
 exports.DEFAULT_REDACT_PATHS = require_redact_paths.DEFAULT_REDACT_PATHS;
 exports.createLogger = createLogger;
+
 //# sourceMappingURL=pino.cjs.map

package/dist/pino.cjs.map

@@ -1 +1 @@
-{"version":3,"file":"pino.cjs","names":["redact: boolean | RedactOptions | undefined","DEFAULT_REDACT_PATHS","config: PinoRedactConfig","options: CreateLoggerOptions"],"sources":["../src/pino.ts"],"sourcesContent":["/**\n * Pino logger with built-in redaction support for sensitive data.\n *\n * @example\n * ```typescript\n * import { createLogger, DEFAULT_REDACT_PATHS } from '@geekmidas/logger/pino';\n *\n * // Enable redaction with sensible defaults\n * const logger = createLogger({ redact: true });\n *\n * // Sensitive data is automatically masked\n * logger.info({ password: 'secret123', user: 'john' }, 'Login');\n * // Output: { password: '[Redacted]', user: 'john' } Login\n *\n * // Add custom paths (merged with defaults)\n * const logger2 = createLogger({ redact: ['user.ssn'] });\n *\n * // Override defaults for full control\n * const logger3 = createLogger({\n *   redact: {\n *     paths: ['onlyThis'],\n *     resolution: 'override',\n *   }\n * });\n * ```\n *\n * @module\n */\nimport { pino } from 'pino';\nimport { DEFAULT_REDACT_PATHS } from './redact-paths';\nimport type { CreateLoggerOptions, RedactOptions } from './types';\n\n// Re-export for backwards compatibility\nexport { DEFAULT_REDACT_PATHS } from './redact-paths';\n\n/**\n * Type for the resolved pino redact config (without our custom resolution field).\n */\ntype PinoRedactConfig =\n\t| string[]\n\t| {\n\t\t\tpaths: string[];\n\t\t\tcensor?: string | ((value: unknown, path: string[]) => unknown);\n\t\t\tremove?: boolean;\n\t  };\n\n/**\n * Resolves redaction configuration from options.\n * Returns undefined if redaction is disabled, or a pino-compatible redact config.\n *\n * By default (resolution: 'merge'), custom paths are merged with DEFAULT_REDACT_PATHS.\n * With resolution: 'override', only the custom paths are used.\n */\nfunction resolveRedactConfig(\n\tredact: boolean | RedactOptions | undefined,\n): PinoRedactConfig | undefined {\n\tif (redact === undefined || redact === false) {\n\t\treturn undefined;\n\t}\n\n\tif (redact === true) {\n\t\treturn DEFAULT_REDACT_PATHS;\n\t}\n\n\t// Array syntax - merge with defaults\n\tif (Array.isArray(redact)) {\n\t\treturn [...DEFAULT_REDACT_PATHS, ...redact];\n\t}\n\n\t// Object syntax - check resolution mode\n\tconst { resolution = 'merge', paths, censor, remove } = redact;\n\n\tconst resolvedPaths =\n\t\tresolution === 'override' ? paths : [...DEFAULT_REDACT_PATHS, ...paths];\n\n\t// Return clean pino config without our resolution field\n\tconst config: PinoRedactConfig = { paths: resolvedPaths };\n\tif (censor !== undefined) config.censor = censor;\n\tif (remove !== undefined) config.remove = remove;\n\n\treturn config;\n}\n\n/**\n * Creates a pino logger instance with optional redaction support.\n *\n * @param options - Logger configuration options\n * @returns A configured pino logger instance\n *\n * @example\n * ```typescript\n * // Basic logger\n * const logger = createLogger({ level: 'debug' });\n *\n * // With redaction enabled\n * const secureLogger = createLogger({ redact: true });\n *\n * // Pretty printing in development\n * const devLogger = createLogger({ pretty: true, redact: true });\n * ```\n */\nexport function createLogger(options: CreateLoggerOptions = {}) {\n\t// @ts-expect-error\n\tconst pretty = options?.pretty && process.NODE_ENV !== 'production';\n\tconst baseOptions = pretty\n\t\t? {\n\t\t\t\ttransport: {\n\t\t\t\t\ttarget: 'pino-pretty',\n\t\t\t\t\toptions: { colorize: true },\n\t\t\t\t},\n\t\t\t}\n\t\t: {};\n\n\tconst redact = resolveRedactConfig(options.redact);\n\n\treturn pino({\n\t\t...baseOptions,\n\t\t...(options.level && { level: options.level }),\n\t\t...(redact && { redact }),\n\t\tformatters: {\n\t\t\tbindings() {\n\t\t\t\treturn { nodeVersion: process.version };\n\t\t\t},\n\t\t\tlevel: (label) => {\n\t\t\t\treturn { level: label.toUpperCase() };\n\t\t\t},\n\t\t},\n\t});\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqDA,SAAS,oBACRA,QAC+B;AAC/B,KAAI,qBAAwB,WAAW,MACtC;AAGD,KAAI,WAAW,KACd,QAAOC;AAIR,KAAI,MAAM,QAAQ,OAAO,CACxB,QAAO,CAAC,GAAGA,2CAAsB,GAAG,MAAO;CAI5C,MAAM,EAAE,aAAa,SAAS,OAAO,QAAQ,QAAQ,GAAG;CAExD,MAAM,gBACL,eAAe,aAAa,QAAQ,CAAC,GAAGA,2CAAsB,GAAG,KAAM;CAGxE,MAAMC,SAA2B,EAAE,OAAO,cAAe;AACzD,KAAI,kBAAsB,QAAO,SAAS;AAC1C,KAAI,kBAAsB,QAAO,SAAS;AAE1C,QAAO;AACP;;;;;;;;;;;;;;;;;;;AAoBD,SAAgB,aAAaC,UAA+B,CAAE,GAAE;CAE/D,MAAM,SAAS,SAAS,UAAU,QAAQ,aAAa;CACvD,MAAM,cAAc,SACjB,EACA,WAAW;EACV,QAAQ;EACR,SAAS,EAAE,UAAU,KAAM;CAC3B,EACD,IACA,CAAE;CAEL,MAAM,SAAS,oBAAoB,QAAQ,OAAO;AAElD,QAAO,eAAK;EACX,GAAG;EACH,GAAI,QAAQ,SAAS,EAAE,OAAO,QAAQ,MAAO;EAC7C,GAAI,UAAU,EAAE,OAAQ;EACxB,YAAY;GACX,WAAW;AACV,WAAO,EAAE,aAAa,QAAQ,QAAS;GACvC;GACD,OAAO,CAAC,UAAU;AACjB,WAAO,EAAE,OAAO,MAAM,aAAa,CAAE;GACrC;EACD;CACD,EAAC;AACF"}
+{"version":3,"file":"pino.cjs","names":["DEFAULT_REDACT_PATHS","stdSerializers","redactUrlCredentialsIn","redactUrlCredentials","otelStreamWrite"],"sources":["../src/pino.ts"],"sourcesContent":["/**\n * Pino logger with built-in redaction support for sensitive data.\n *\n * Redaction is on by default: a logger that was never told about passwords\n * and tokens still masks them. `redact: false` is the explicit opt-out.\n *\n * @example\n * ```typescript\n * import { createLogger, DEFAULT_REDACT_PATHS } from '@geekmidas/logger/pino';\n *\n * // Redaction with sensible defaults — the same as `redact: true`\n * const logger = createLogger();\n *\n * // Sensitive data is automatically masked\n * logger.info({ password: 'secret123', user: 'john' }, 'Login');\n * // Output: { password: '[Redacted]', user: 'john' } Login\n *\n * // Add custom paths (merged with defaults)\n * const logger2 = createLogger({ redact: ['user.ssn'] });\n *\n * // Override defaults for full control\n * const logger3 = createLogger({\n *   redact: {\n *     paths: ['onlyThis'],\n *     resolution: 'override',\n *   }\n * });\n * ```\n *\n * @module\n */\nimport { type LogFn, type Logger, pino, stdSerializers } from 'pino';\nimport { otelStreamWrite } from './otel';\nimport {\n\tDEFAULT_REDACT_PATHS,\n\tredactUrlCredentials,\n\tredactUrlCredentialsIn,\n} from './redact-paths';\nimport type { CreateLoggerOptions, RedactOptions } from './types';\n\n// Re-export for backwards compatibility\nexport { DEFAULT_REDACT_PATHS } from './redact-paths';\n\n/**\n * Type for the resolved pino redact config (without our custom resolution field).\n */\ntype PinoRedactConfig =\n\t| string[]\n\t| {\n\t\t\tpaths: string[];\n\t\t\tcensor?: string | ((value: unknown, path: string[]) => unknown);\n\t\t\tremove?: boolean;\n\t  };\n\n/**\n * Resolves redaction configuration from options.\n * Returns undefined only when redaction is turned off with `false`; leaving it\n * unset is the same as `true`, so sensitive paths are masked unless someone\n * decides they should not be.\n *\n * By default (resolution: 'merge'), custom paths are merged with DEFAULT_REDACT_PATHS.\n * With resolution: 'override', only the custom paths are used.\n */\nfunction resolveRedactConfig(\n\tredact: boolean | RedactOptions | undefined,\n): PinoRedactConfig | undefined {\n\tif (redact === false) {\n\t\treturn undefined;\n\t}\n\n\tif (redact === undefined || redact === true) {\n\t\treturn DEFAULT_REDACT_PATHS;\n\t}\n\n\t// Array syntax - merge with defaults\n\tif (Array.isArray(redact)) {\n\t\treturn [...DEFAULT_REDACT_PATHS, ...redact];\n\t}\n\n\t// Object syntax - check resolution mode\n\tconst { resolution = 'merge', paths, censor, remove } = redact;\n\n\tconst resolvedPaths =\n\t\tresolution === 'override' ? paths : [...DEFAULT_REDACT_PATHS, ...paths];\n\n\t// Return clean pino config without our resolution field\n\tconst config: PinoRedactConfig = { paths: resolvedPaths };\n\tif (censor !== undefined) config.censor = censor;\n\tif (remove !== undefined) config.remove = remove;\n\n\treturn config;\n}\n\n/**\n * Creates a pino logger instance with optional redaction support.\n *\n * @param options - Logger configuration options\n * @returns A configured pino logger instance\n *\n * @example\n * ```typescript\n * // Basic logger — sensitive paths are redacted by default\n * const logger = createLogger({ level: 'debug' });\n *\n * // Opt out of redaction\n * const rawLogger = createLogger({ redact: false });\n *\n * // Pretty printing in development\n * const devLogger = createLogger({ pretty: true });\n * ```\n */\nexport function createLogger(options: CreateLoggerOptions = {}) {\n\t// Pretty printing spawns a transport worker and writes for humans; in\n\t// production the output is for a log pipeline, so `pretty` is ignored there.\n\tconst pretty = options?.pretty && process.env.NODE_ENV !== 'production';\n\tconst baseOptions = pretty\n\t\t? {\n\t\t\t\ttransport: {\n\t\t\t\t\ttarget: 'pino-pretty',\n\t\t\t\t\toptions: { colorize: true },\n\t\t\t\t},\n\t\t\t}\n\t\t: {};\n\n\tconst redact = resolveRedactConfig(options.redact);\n\n\t// An Error is serialized only under a key pino has a serializer for — `err`\n\t// by default — and anything else is JSON.stringify'd, which an Error survives\n\t// as `{}`: no message, no stack. `logger.error({ error }, …)` is how most\n\t// code writes it, so `error` gets the same serializer as `err`.\n\t//\n\t// The serialized copy is a plain object, so URL credentials in the message\n\t// or the stack are masked like any other field; path redaction runs after\n\t// serializers, so `err.message` and `error.stack` are paths it can reach.\n\tconst serializeError = (value: unknown) => {\n\t\tconst serialized = stdSerializers.err(value as Error);\n\t\tif (!redact || serialized === value) return serialized;\n\t\treturn redactUrlCredentialsIn({ ...serialized });\n\t};\n\n\tconst pinoOptions = {\n\t\t...baseOptions,\n\t\t...(options.level && { level: options.level }),\n\t\t...(redact && { redact }),\n\t\tserializers: { err: serializeError, error: serializeError },\n\t\thooks: {\n\t\t\t// Redaction also masks the credentials of any URL, in any field or\n\t\t\t// in the message: `s3://KEY:SECRET@uploads` is logged with its\n\t\t\t// secret under a name no path list can predict.\n\t\t\t...(redact && {\n\t\t\t\tlogMethod(this: Logger, args: Parameters<LogFn>, method: LogFn) {\n\t\t\t\t\tconst redacted = args.map((arg) =>\n\t\t\t\t\t\ttypeof arg === 'string' ? redactUrlCredentials(arg) : arg,\n\t\t\t\t\t) as Parameters<LogFn>;\n\t\t\t\t\treturn method.apply(this, redacted);\n\t\t\t\t},\n\t\t\t}),\n\t\t\t// Each line, once redacted and serialized, also goes to\n\t\t\t// OpenTelemetry when a LoggerProvider is registered. On the calling\n\t\t\t// thread, before any transport, so the active span is the caller's.\n\t\t\tstreamWrite: otelStreamWrite,\n\t\t},\n\t\tformatters: {\n\t\t\t...(redact && {\n\t\t\t\tlog: (object: Record<string, unknown>) =>\n\t\t\t\t\tredactUrlCredentialsIn(object),\n\t\t\t}),\n\t\t\tbindings() {\n\t\t\t\treturn { nodeVersion: process.version };\n\t\t\t},\n\t\t\tlevel: (label: string) => {\n\t\t\t\treturn { level: label.toUpperCase() };\n\t\t\t},\n\t\t},\n\t};\n\n\t// A transport writes on its own worker, so a destination only applies when\n\t// the logger is not pretty-printing.\n\treturn options.destination && !pretty\n\t\t? pino(pinoOptions, options.destination)\n\t\t: pino(pinoOptions);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+DA,SAAS,oBACR,QAC+B;CAC/B,IAAI,WAAW,OACd;CAGD,IAAI,WAAW,KAAA,KAAa,WAAW,MACtC,OAAOA,qBAAAA;CAIR,IAAI,MAAM,QAAQ,MAAM,GACvB,OAAO,CAAC,GAAGA,qBAAAA,sBAAsB,GAAG,MAAM;CAI3C,MAAM,EAAE,aAAa,SAAS,OAAO,QAAQ,WAAW;CAMxD,MAAM,SAA2B,EAAE,OAHlC,eAAe,aAAa,QAAQ,CAAC,GAAGA,qBAAAA,sBAAsB,GAAG,KAAK,EAGf;CACxD,IAAI,WAAW,KAAA,GAAW,OAAO,SAAS;CAC1C,IAAI,WAAW,KAAA,GAAW,OAAO,SAAS;CAE1C,OAAO;AACR;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,aAAa,UAA+B,CAAC,GAAG;CAG/D,MAAM,SAAS,SAAS,UAAU,QAAQ,IAAI,aAAa;CAC3D,MAAM,cAAc,SACjB,EACA,WAAW;EACV,QAAQ;EACR,SAAS,EAAE,UAAU,KAAK;CAC3B,EACD,IACC,CAAC;CAEJ,MAAM,SAAS,oBAAoB,QAAQ,MAAM;CAUjD,MAAM,kBAAkB,UAAmB;EAC1C,MAAM,aAAaC,KAAAA,eAAe,IAAI,KAAc;EACpD,IAAI,CAAC,UAAU,eAAe,OAAO,OAAO;EAC5C,OAAOC,qBAAAA,uBAAuB,EAAE,GAAG,WAAW,CAAC;CAChD;CAEA,MAAM,cAAc;EACnB,GAAG;EACH,GAAI,QAAQ,SAAS,EAAE,OAAO,QAAQ,MAAM;EAC5C,GAAI,UAAU,EAAE,OAAO;EACvB,aAAa;GAAE,KAAK;GAAgB,OAAO;EAAe;EAC1D,OAAO;GAIN,GAAI,UAAU,EACb,UAAwB,MAAyB,QAAe;IAC/D,MAAM,WAAW,KAAK,KAAK,QAC1B,OAAO,QAAQ,WAAWC,qBAAAA,qBAAqB,GAAG,IAAI,GACvD;IACA,OAAO,OAAO,MAAM,MAAM,QAAQ;GACnC,EACD;GAIA,aAAaC,aAAAA;EACd;EACA,YAAY;GACX,GAAI,UAAU,EACb,MAAM,WACLF,qBAAAA,uBAAuB,MAAM,EAC/B;GACA,WAAW;IACV,OAAO,EAAE,aAAa,QAAQ,QAAQ;GACvC;GACA,QAAQ,UAAkB;IACzB,OAAO,EAAE,OAAO,MAAM,YAAY,EAAE;GACrC;EACD;CACD;CAIA,OAAO,QAAQ,eAAe,CAAC,UAAA,GAC5B,KAAA,KAAA,CAAK,aAAa,QAAQ,WAAW,KAAA,GACrC,KAAA,KAAA,CAAK,WAAW;AACpB"}

package/dist/pino.d.cts

@@ -1,9 +1,7 @@
-import { CreateLoggerOptions } from "./types-Dk_k2-f_.cjs";
-import { DEFAULT_REDACT_PATHS } from "./redact-paths-CsK0_uz-.cjs";
-import * as pino0 from "pino";
-
+import { CreateLoggerOptions } from "./types.cjs";
+import { DEFAULT_REDACT_PATHS } from "./redact-paths.cjs";
+import { Logger } from "pino";
 //#region src/pino.d.ts
-
 /**
  * Creates a pino logger instance with optional redaction support.
  *
@@ -12,18 +10,17 @@ import * as pino0 from "pino";
  *
  * @example
  * ```typescript
- * // Basic logger
+ * // Basic logger — sensitive paths are redacted by default
  * const logger = createLogger({ level: 'debug' });
  *
- * // With redaction enabled
- * const secureLogger = createLogger({ redact: true });
+ * // Opt out of redaction
+ * const rawLogger = createLogger({ redact: false });
  *
  * // Pretty printing in development
- * const devLogger = createLogger({ pretty: true, redact: true });
+ * const devLogger = createLogger({ pretty: true });
  * ```
  */
-declare function createLogger(options?: CreateLoggerOptions): pino0.Logger<never, boolean>;
-//# sourceMappingURL=pino.d.ts.map
+export declare function createLogger(options?: CreateLoggerOptions): Logger<never, boolean>;
 //#endregion
-export { DEFAULT_REDACT_PATHS, createLogger };
+export { DEFAULT_REDACT_PATHS };
 //# sourceMappingURL=pino.d.cts.map

package/dist/pino.d.cts.map

@@ -1 +1 @@
-{"version":3,"file":"pino.d.cts","names":[],"sources":["../src/pino.ts"],"sourcesContent":[],"mappings":";;;;;;;;;AAqGA;;;;AAA8D;;;;;;;;;;;iBAA9C,YAAA,WAAsB,sBAAwB,KAAA,CAAA"}
+{"version":3,"file":"pino.d.cts","names":[],"sources":["../src/pino.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;wBA+GgB,aAAa,UAAS,sBAAwB"}

package/dist/pino.d.mts

@@ -1,9 +1,7 @@
-import { CreateLoggerOptions } from "./types-BDdpcrpy.mjs";
-import { DEFAULT_REDACT_PATHS } from "./redact-paths-D07eTMlH.mjs";
-import * as pino0 from "pino";
-
+import { CreateLoggerOptions } from "./types.mjs";
+import { DEFAULT_REDACT_PATHS } from "./redact-paths.mjs";
+import { Logger } from "pino";
 //#region src/pino.d.ts
-
 /**
  * Creates a pino logger instance with optional redaction support.
  *
@@ -12,18 +10,17 @@ import * as pino0 from "pino";
  *
  * @example
  * ```typescript
- * // Basic logger
+ * // Basic logger — sensitive paths are redacted by default
  * const logger = createLogger({ level: 'debug' });
  *
- * // With redaction enabled
- * const secureLogger = createLogger({ redact: true });
+ * // Opt out of redaction
+ * const rawLogger = createLogger({ redact: false });
  *
  * // Pretty printing in development
- * const devLogger = createLogger({ pretty: true, redact: true });
+ * const devLogger = createLogger({ pretty: true });
  * ```
  */
-declare function createLogger(options?: CreateLoggerOptions): pino0.Logger<never, boolean>;
-//# sourceMappingURL=pino.d.ts.map
+export declare function createLogger(options?: CreateLoggerOptions): Logger<never, boolean>;
 //#endregion
-export { DEFAULT_REDACT_PATHS, createLogger };
+export { DEFAULT_REDACT_PATHS };
 //# sourceMappingURL=pino.d.mts.map

package/dist/pino.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"pino.d.mts","names":[],"sources":["../src/pino.ts"],"sourcesContent":[],"mappings":";;;;;;;;;AAqGA;;;;AAA8D;;;;;;;;;;;iBAA9C,YAAA,WAAsB,sBAAwB,KAAA,CAAA"}
+{"version":3,"file":"pino.d.mts","names":[],"sources":["../src/pino.ts"],"mappings":";;;;;;;;;;;;;;;;;;;;;;wBA+GgB,aAAa,UAAS,sBAAwB"}

package/dist/pino.mjs

@@ -1,21 +1,53 @@
-import { DEFAULT_REDACT_PATHS } from "./redact-paths-DQoIXhkS.mjs";
-import { pino } from "pino";
-
+import { otelStreamWrite } from "./otel.mjs";
+import { DEFAULT_REDACT_PATHS, redactUrlCredentials, redactUrlCredentialsIn } from "./redact-paths.mjs";
+import { pino, stdSerializers } from "pino";
 //#region src/pino.ts
 /**
+* Pino logger with built-in redaction support for sensitive data.
+*
+* Redaction is on by default: a logger that was never told about passwords
+* and tokens still masks them. `redact: false` is the explicit opt-out.
+*
+* @example
+* ```typescript
+* import { createLogger, DEFAULT_REDACT_PATHS } from '@geekmidas/logger/pino';
+*
+* // Redaction with sensible defaults — the same as `redact: true`
+* const logger = createLogger();
+*
+* // Sensitive data is automatically masked
+* logger.info({ password: 'secret123', user: 'john' }, 'Login');
+* // Output: { password: '[Redacted]', user: 'john' } Login
+*
+* // Add custom paths (merged with defaults)
+* const logger2 = createLogger({ redact: ['user.ssn'] });
+*
+* // Override defaults for full control
+* const logger3 = createLogger({
+*   redact: {
+*     paths: ['onlyThis'],
+*     resolution: 'override',
+*   }
+* });
+* ```
+*
+* @module
+*/
+/**
 * Resolves redaction configuration from options.
-* Returns undefined if redaction is disabled, or a pino-compatible redact config.
+* Returns undefined only when redaction is turned off with `false`; leaving it
+* unset is the same as `true`, so sensitive paths are masked unless someone
+* decides they should not be.
 *
 * By default (resolution: 'merge'), custom paths are merged with DEFAULT_REDACT_PATHS.
 * With resolution: 'override', only the custom paths are used.
 */
 function resolveRedactConfig(redact) {
-	if (redact === void 0 || redact === false) return void 0;
-	if (redact === true) return DEFAULT_REDACT_PATHS;
+	if (redact === false) return;
+	if (redact === void 0 || redact === true) return DEFAULT_REDACT_PATHS;
 	if (Array.isArray(redact)) return [...DEFAULT_REDACT_PATHS, ...redact];
 	const { resolution = "merge", paths, censor, remove } = redact;
-	const resolvedPaths = resolution === "override" ? paths : [...DEFAULT_REDACT_PATHS, ...paths];
-	const config = { paths: resolvedPaths };
+	const config = { paths: resolution === "override" ? paths : [...DEFAULT_REDACT_PATHS, ...paths] };
 	if (censor !== void 0) config.censor = censor;
 	if (remove !== void 0) config.remove = remove;
 	return config;
@@ -28,28 +60,45 @@ function resolveRedactConfig(redact) {
 *
 * @example
 * ```typescript
-* // Basic logger
+* // Basic logger — sensitive paths are redacted by default
 * const logger = createLogger({ level: 'debug' });
 *
-* // With redaction enabled
-* const secureLogger = createLogger({ redact: true });
+* // Opt out of redaction
+* const rawLogger = createLogger({ redact: false });
 *
 * // Pretty printing in development
-* const devLogger = createLogger({ pretty: true, redact: true });
+* const devLogger = createLogger({ pretty: true });
 * ```
 */
 function createLogger(options = {}) {
-	const pretty = options?.pretty && process.NODE_ENV !== "production";
+	const pretty = options?.pretty && process.env.NODE_ENV !== "production";
 	const baseOptions = pretty ? { transport: {
 		target: "pino-pretty",
 		options: { colorize: true }
 	} } : {};
 	const redact = resolveRedactConfig(options.redact);
-	return pino({
+	const serializeError = (value) => {
+		const serialized = stdSerializers.err(value);
+		if (!redact || serialized === value) return serialized;
+		return redactUrlCredentialsIn({ ...serialized });
+	};
+	const pinoOptions = {
 		...baseOptions,
 		...options.level && { level: options.level },
 		...redact && { redact },
+		serializers: {
+			err: serializeError,
+			error: serializeError
+		},
+		hooks: {
+			...redact && { logMethod(args, method) {
+				const redacted = args.map((arg) => typeof arg === "string" ? redactUrlCredentials(arg) : arg);
+				return method.apply(this, redacted);
+			} },
+			streamWrite: otelStreamWrite
+		},
 		formatters: {
+			...redact && { log: (object) => redactUrlCredentialsIn(object) },
 			bindings() {
 				return { nodeVersion: process.version };
 			},
@@ -57,9 +106,10 @@ function createLogger(options = {}) {
 				return { level: label.toUpperCase() };
 			}
 		}
-	});
+	};
+	return options.destination && !pretty ? pino(pinoOptions, options.destination) : pino(pinoOptions);
 }
-
 //#endregion
 export { DEFAULT_REDACT_PATHS, createLogger };
+
 //# sourceMappingURL=pino.mjs.map

package/dist/pino.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"pino.mjs","names":["redact: boolean | RedactOptions | undefined","config: PinoRedactConfig","options: CreateLoggerOptions"],"sources":["../src/pino.ts"],"sourcesContent":["/**\n * Pino logger with built-in redaction support for sensitive data.\n *\n * @example\n * ```typescript\n * import { createLogger, DEFAULT_REDACT_PATHS } from '@geekmidas/logger/pino';\n *\n * // Enable redaction with sensible defaults\n * const logger = createLogger({ redact: true });\n *\n * // Sensitive data is automatically masked\n * logger.info({ password: 'secret123', user: 'john' }, 'Login');\n * // Output: { password: '[Redacted]', user: 'john' } Login\n *\n * // Add custom paths (merged with defaults)\n * const logger2 = createLogger({ redact: ['user.ssn'] });\n *\n * // Override defaults for full control\n * const logger3 = createLogger({\n *   redact: {\n *     paths: ['onlyThis'],\n *     resolution: 'override',\n *   }\n * });\n * ```\n *\n * @module\n */\nimport { pino } from 'pino';\nimport { DEFAULT_REDACT_PATHS } from './redact-paths';\nimport type { CreateLoggerOptions, RedactOptions } from './types';\n\n// Re-export for backwards compatibility\nexport { DEFAULT_REDACT_PATHS } from './redact-paths';\n\n/**\n * Type for the resolved pino redact config (without our custom resolution field).\n */\ntype PinoRedactConfig =\n\t| string[]\n\t| {\n\t\t\tpaths: string[];\n\t\t\tcensor?: string | ((value: unknown, path: string[]) => unknown);\n\t\t\tremove?: boolean;\n\t  };\n\n/**\n * Resolves redaction configuration from options.\n * Returns undefined if redaction is disabled, or a pino-compatible redact config.\n *\n * By default (resolution: 'merge'), custom paths are merged with DEFAULT_REDACT_PATHS.\n * With resolution: 'override', only the custom paths are used.\n */\nfunction resolveRedactConfig(\n\tredact: boolean | RedactOptions | undefined,\n): PinoRedactConfig | undefined {\n\tif (redact === undefined || redact === false) {\n\t\treturn undefined;\n\t}\n\n\tif (redact === true) {\n\t\treturn DEFAULT_REDACT_PATHS;\n\t}\n\n\t// Array syntax - merge with defaults\n\tif (Array.isArray(redact)) {\n\t\treturn [...DEFAULT_REDACT_PATHS, ...redact];\n\t}\n\n\t// Object syntax - check resolution mode\n\tconst { resolution = 'merge', paths, censor, remove } = redact;\n\n\tconst resolvedPaths =\n\t\tresolution === 'override' ? paths : [...DEFAULT_REDACT_PATHS, ...paths];\n\n\t// Return clean pino config without our resolution field\n\tconst config: PinoRedactConfig = { paths: resolvedPaths };\n\tif (censor !== undefined) config.censor = censor;\n\tif (remove !== undefined) config.remove = remove;\n\n\treturn config;\n}\n\n/**\n * Creates a pino logger instance with optional redaction support.\n *\n * @param options - Logger configuration options\n * @returns A configured pino logger instance\n *\n * @example\n * ```typescript\n * // Basic logger\n * const logger = createLogger({ level: 'debug' });\n *\n * // With redaction enabled\n * const secureLogger = createLogger({ redact: true });\n *\n * // Pretty printing in development\n * const devLogger = createLogger({ pretty: true, redact: true });\n * ```\n */\nexport function createLogger(options: CreateLoggerOptions = {}) {\n\t// @ts-expect-error\n\tconst pretty = options?.pretty && process.NODE_ENV !== 'production';\n\tconst baseOptions = pretty\n\t\t? {\n\t\t\t\ttransport: {\n\t\t\t\t\ttarget: 'pino-pretty',\n\t\t\t\t\toptions: { colorize: true },\n\t\t\t\t},\n\t\t\t}\n\t\t: {};\n\n\tconst redact = resolveRedactConfig(options.redact);\n\n\treturn pino({\n\t\t...baseOptions,\n\t\t...(options.level && { level: options.level }),\n\t\t...(redact && { redact }),\n\t\tformatters: {\n\t\t\tbindings() {\n\t\t\t\treturn { nodeVersion: process.version };\n\t\t\t},\n\t\t\tlevel: (label) => {\n\t\t\t\treturn { level: label.toUpperCase() };\n\t\t\t},\n\t\t},\n\t});\n}\n"],"mappings":";;;;;;;;;;;AAqDA,SAAS,oBACRA,QAC+B;AAC/B,KAAI,qBAAwB,WAAW,MACtC;AAGD,KAAI,WAAW,KACd,QAAO;AAIR,KAAI,MAAM,QAAQ,OAAO,CACxB,QAAO,CAAC,GAAG,sBAAsB,GAAG,MAAO;CAI5C,MAAM,EAAE,aAAa,SAAS,OAAO,QAAQ,QAAQ,GAAG;CAExD,MAAM,gBACL,eAAe,aAAa,QAAQ,CAAC,GAAG,sBAAsB,GAAG,KAAM;CAGxE,MAAMC,SAA2B,EAAE,OAAO,cAAe;AACzD,KAAI,kBAAsB,QAAO,SAAS;AAC1C,KAAI,kBAAsB,QAAO,SAAS;AAE1C,QAAO;AACP;;;;;;;;;;;;;;;;;;;AAoBD,SAAgB,aAAaC,UAA+B,CAAE,GAAE;CAE/D,MAAM,SAAS,SAAS,UAAU,QAAQ,aAAa;CACvD,MAAM,cAAc,SACjB,EACA,WAAW;EACV,QAAQ;EACR,SAAS,EAAE,UAAU,KAAM;CAC3B,EACD,IACA,CAAE;CAEL,MAAM,SAAS,oBAAoB,QAAQ,OAAO;AAElD,QAAO,KAAK;EACX,GAAG;EACH,GAAI,QAAQ,SAAS,EAAE,OAAO,QAAQ,MAAO;EAC7C,GAAI,UAAU,EAAE,OAAQ;EACxB,YAAY;GACX,WAAW;AACV,WAAO,EAAE,aAAa,QAAQ,QAAS;GACvC;GACD,OAAO,CAAC,UAAU;AACjB,WAAO,EAAE,OAAO,MAAM,aAAa,CAAE;GACrC;EACD;CACD,EAAC;AACF"}
+{"version":3,"file":"pino.mjs","names":[],"sources":["../src/pino.ts"],"sourcesContent":["/**\n * Pino logger with built-in redaction support for sensitive data.\n *\n * Redaction is on by default: a logger that was never told about passwords\n * and tokens still masks them. `redact: false` is the explicit opt-out.\n *\n * @example\n * ```typescript\n * import { createLogger, DEFAULT_REDACT_PATHS } from '@geekmidas/logger/pino';\n *\n * // Redaction with sensible defaults — the same as `redact: true`\n * const logger = createLogger();\n *\n * // Sensitive data is automatically masked\n * logger.info({ password: 'secret123', user: 'john' }, 'Login');\n * // Output: { password: '[Redacted]', user: 'john' } Login\n *\n * // Add custom paths (merged with defaults)\n * const logger2 = createLogger({ redact: ['user.ssn'] });\n *\n * // Override defaults for full control\n * const logger3 = createLogger({\n *   redact: {\n *     paths: ['onlyThis'],\n *     resolution: 'override',\n *   }\n * });\n * ```\n *\n * @module\n */\nimport { type LogFn, type Logger, pino, stdSerializers } from 'pino';\nimport { otelStreamWrite } from './otel';\nimport {\n\tDEFAULT_REDACT_PATHS,\n\tredactUrlCredentials,\n\tredactUrlCredentialsIn,\n} from './redact-paths';\nimport type { CreateLoggerOptions, RedactOptions } from './types';\n\n// Re-export for backwards compatibility\nexport { DEFAULT_REDACT_PATHS } from './redact-paths';\n\n/**\n * Type for the resolved pino redact config (without our custom resolution field).\n */\ntype PinoRedactConfig =\n\t| string[]\n\t| {\n\t\t\tpaths: string[];\n\t\t\tcensor?: string | ((value: unknown, path: string[]) => unknown);\n\t\t\tremove?: boolean;\n\t  };\n\n/**\n * Resolves redaction configuration from options.\n * Returns undefined only when redaction is turned off with `false`; leaving it\n * unset is the same as `true`, so sensitive paths are masked unless someone\n * decides they should not be.\n *\n * By default (resolution: 'merge'), custom paths are merged with DEFAULT_REDACT_PATHS.\n * With resolution: 'override', only the custom paths are used.\n */\nfunction resolveRedactConfig(\n\tredact: boolean | RedactOptions | undefined,\n): PinoRedactConfig | undefined {\n\tif (redact === false) {\n\t\treturn undefined;\n\t}\n\n\tif (redact === undefined || redact === true) {\n\t\treturn DEFAULT_REDACT_PATHS;\n\t}\n\n\t// Array syntax - merge with defaults\n\tif (Array.isArray(redact)) {\n\t\treturn [...DEFAULT_REDACT_PATHS, ...redact];\n\t}\n\n\t// Object syntax - check resolution mode\n\tconst { resolution = 'merge', paths, censor, remove } = redact;\n\n\tconst resolvedPaths =\n\t\tresolution === 'override' ? paths : [...DEFAULT_REDACT_PATHS, ...paths];\n\n\t// Return clean pino config without our resolution field\n\tconst config: PinoRedactConfig = { paths: resolvedPaths };\n\tif (censor !== undefined) config.censor = censor;\n\tif (remove !== undefined) config.remove = remove;\n\n\treturn config;\n}\n\n/**\n * Creates a pino logger instance with optional redaction support.\n *\n * @param options - Logger configuration options\n * @returns A configured pino logger instance\n *\n * @example\n * ```typescript\n * // Basic logger — sensitive paths are redacted by default\n * const logger = createLogger({ level: 'debug' });\n *\n * // Opt out of redaction\n * const rawLogger = createLogger({ redact: false });\n *\n * // Pretty printing in development\n * const devLogger = createLogger({ pretty: true });\n * ```\n */\nexport function createLogger(options: CreateLoggerOptions = {}) {\n\t// Pretty printing spawns a transport worker and writes for humans; in\n\t// production the output is for a log pipeline, so `pretty` is ignored there.\n\tconst pretty = options?.pretty && process.env.NODE_ENV !== 'production';\n\tconst baseOptions = pretty\n\t\t? {\n\t\t\t\ttransport: {\n\t\t\t\t\ttarget: 'pino-pretty',\n\t\t\t\t\toptions: { colorize: true },\n\t\t\t\t},\n\t\t\t}\n\t\t: {};\n\n\tconst redact = resolveRedactConfig(options.redact);\n\n\t// An Error is serialized only under a key pino has a serializer for — `err`\n\t// by default — and anything else is JSON.stringify'd, which an Error survives\n\t// as `{}`: no message, no stack. `logger.error({ error }, …)` is how most\n\t// code writes it, so `error` gets the same serializer as `err`.\n\t//\n\t// The serialized copy is a plain object, so URL credentials in the message\n\t// or the stack are masked like any other field; path redaction runs after\n\t// serializers, so `err.message` and `error.stack` are paths it can reach.\n\tconst serializeError = (value: unknown) => {\n\t\tconst serialized = stdSerializers.err(value as Error);\n\t\tif (!redact || serialized === value) return serialized;\n\t\treturn redactUrlCredentialsIn({ ...serialized });\n\t};\n\n\tconst pinoOptions = {\n\t\t...baseOptions,\n\t\t...(options.level && { level: options.level }),\n\t\t...(redact && { redact }),\n\t\tserializers: { err: serializeError, error: serializeError },\n\t\thooks: {\n\t\t\t// Redaction also masks the credentials of any URL, in any field or\n\t\t\t// in the message: `s3://KEY:SECRET@uploads` is logged with its\n\t\t\t// secret under a name no path list can predict.\n\t\t\t...(redact && {\n\t\t\t\tlogMethod(this: Logger, args: Parameters<LogFn>, method: LogFn) {\n\t\t\t\t\tconst redacted = args.map((arg) =>\n\t\t\t\t\t\ttypeof arg === 'string' ? redactUrlCredentials(arg) : arg,\n\t\t\t\t\t) as Parameters<LogFn>;\n\t\t\t\t\treturn method.apply(this, redacted);\n\t\t\t\t},\n\t\t\t}),\n\t\t\t// Each line, once redacted and serialized, also goes to\n\t\t\t// OpenTelemetry when a LoggerProvider is registered. On the calling\n\t\t\t// thread, before any transport, so the active span is the caller's.\n\t\t\tstreamWrite: otelStreamWrite,\n\t\t},\n\t\tformatters: {\n\t\t\t...(redact && {\n\t\t\t\tlog: (object: Record<string, unknown>) =>\n\t\t\t\t\tredactUrlCredentialsIn(object),\n\t\t\t}),\n\t\t\tbindings() {\n\t\t\t\treturn { nodeVersion: process.version };\n\t\t\t},\n\t\t\tlevel: (label: string) => {\n\t\t\t\treturn { level: label.toUpperCase() };\n\t\t\t},\n\t\t},\n\t};\n\n\t// A transport writes on its own worker, so a destination only applies when\n\t// the logger is not pretty-printing.\n\treturn options.destination && !pretty\n\t\t? pino(pinoOptions, options.destination)\n\t\t: pino(pinoOptions);\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA+DA,SAAS,oBACR,QAC+B;CAC/B,IAAI,WAAW,OACd;CAGD,IAAI,WAAW,KAAA,KAAa,WAAW,MACtC,OAAO;CAIR,IAAI,MAAM,QAAQ,MAAM,GACvB,OAAO,CAAC,GAAG,sBAAsB,GAAG,MAAM;CAI3C,MAAM,EAAE,aAAa,SAAS,OAAO,QAAQ,WAAW;CAMxD,MAAM,SAA2B,EAAE,OAHlC,eAAe,aAAa,QAAQ,CAAC,GAAG,sBAAsB,GAAG,KAAK,EAGf;CACxD,IAAI,WAAW,KAAA,GAAW,OAAO,SAAS;CAC1C,IAAI,WAAW,KAAA,GAAW,OAAO,SAAS;CAE1C,OAAO;AACR;;;;;;;;;;;;;;;;;;;AAoBA,SAAgB,aAAa,UAA+B,CAAC,GAAG;CAG/D,MAAM,SAAS,SAAS,UAAU,QAAQ,IAAI,aAAa;CAC3D,MAAM,cAAc,SACjB,EACA,WAAW;EACV,QAAQ;EACR,SAAS,EAAE,UAAU,KAAK;CAC3B,EACD,IACC,CAAC;CAEJ,MAAM,SAAS,oBAAoB,QAAQ,MAAM;CAUjD,MAAM,kBAAkB,UAAmB;EAC1C,MAAM,aAAa,eAAe,IAAI,KAAc;EACpD,IAAI,CAAC,UAAU,eAAe,OAAO,OAAO;EAC5C,OAAO,uBAAuB,EAAE,GAAG,WAAW,CAAC;CAChD;CAEA,MAAM,cAAc;EACnB,GAAG;EACH,GAAI,QAAQ,SAAS,EAAE,OAAO,QAAQ,MAAM;EAC5C,GAAI,UAAU,EAAE,OAAO;EACvB,aAAa;GAAE,KAAK;GAAgB,OAAO;EAAe;EAC1D,OAAO;GAIN,GAAI,UAAU,EACb,UAAwB,MAAyB,QAAe;IAC/D,MAAM,WAAW,KAAK,KAAK,QAC1B,OAAO,QAAQ,WAAW,qBAAqB,GAAG,IAAI,GACvD;IACA,OAAO,OAAO,MAAM,MAAM,QAAQ;GACnC,EACD;GAIA,aAAa;EACd;EACA,YAAY;GACX,GAAI,UAAU,EACb,MAAM,WACL,uBAAuB,MAAM,EAC/B;GACA,WAAW;IACV,OAAO,EAAE,aAAa,QAAQ,QAAQ;GACvC;GACA,QAAQ,UAAkB;IACzB,OAAO,EAAE,OAAO,MAAM,YAAY,EAAE;GACrC;EACD;CACD;CAIA,OAAO,QAAQ,eAAe,CAAC,SAC5B,KAAK,aAAa,QAAQ,WAAW,IACrC,KAAK,WAAW;AACpB"}