@haatlabs-core/logger 0.0.0-stage → 0.11.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Haatlabs
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -1,3 +1,11 @@
-# Temporary Holding Version
+# @haatlabs-core/logger
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Pino, with secrets scrubbed from every record: sensitive keys, credentials in URLs, SQL
+parameters in database errors.
+
+    import { createLogger } from '@haatlabs-core/logger';
+    const logger = createLogger({ name: 'api', level: 'info' });
+
+## Install
+
+    pnpm add @haatlabs-core/logger

package/dist/cjs/index.d.ts

@@ -0,0 +1,14 @@
+import type { Logger as PinoLogger } from 'pino';
+export type Logger = PinoLogger;
+export declare const REDACTED = "[REDACTED]";
+export declare const TRUNCATED = "[TRUNCATED]";
+export declare const CIRCULAR = "[CIRCULAR]";
+export declare const MAX_SCRUB_DEPTH = 12;
+export declare const SENSITIVE_KEYS: readonly ["accessToken", "access_token", "accessTokenEncrypted", "apiSecret", "clientSecret", "client_secret", "password", "passwordHash", "token", "sessionToken", "subject_token", "apiKey", "keyHash", "csrfToken", "authorization", "cookie", "set-cookie", "x-shopify-access-token", "x-shopify-hmac-sha256", "x-csrf-token", "sessionId", "secret", "code", "hmac", "state", "browserNonceHash", "encryptionKey", "databaseUrl", "url", "systemUrl"];
+export declare function createLogger(options: {
+    level: string;
+    name: string;
+    destination?: NodeJS.WritableStream;
+}): Logger;
+export { watchRedis } from './redis-watch.js';
+export type { RedisWatchLogger, WatchedRedis } from './redis-watch.js';

package/dist/cjs/index.js

@@ -0,0 +1,167 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var index_exports = {};
+__export(index_exports, {
+  CIRCULAR: () => CIRCULAR,
+  MAX_SCRUB_DEPTH: () => MAX_SCRUB_DEPTH,
+  REDACTED: () => REDACTED,
+  SENSITIVE_KEYS: () => SENSITIVE_KEYS,
+  TRUNCATED: () => TRUNCATED,
+  createLogger: () => createLogger,
+  watchRedis: () => import_redis_watch.watchRedis
+});
+module.exports = __toCommonJS(index_exports);
+var import_api = require("@opentelemetry/api");
+var import_pino = require("pino");
+var import_redis_watch = require("./redis-watch.js");
+const REDACTED = "[REDACTED]";
+const TRUNCATED = "[TRUNCATED]";
+const CIRCULAR = "[CIRCULAR]";
+const MAX_SCRUB_DEPTH = 12;
+const SENSITIVE_KEYS = [
+  "accessToken",
+  "access_token",
+  "accessTokenEncrypted",
+  "apiSecret",
+  "clientSecret",
+  "client_secret",
+  "password",
+  "passwordHash",
+  "token",
+  "sessionToken",
+  "subject_token",
+  "apiKey",
+  "keyHash",
+  "csrfToken",
+  "authorization",
+  "cookie",
+  "set-cookie",
+  "x-shopify-access-token",
+  "x-shopify-hmac-sha256",
+  "x-csrf-token",
+  "sessionId",
+  "secret",
+  "code",
+  "hmac",
+  "state",
+  "browserNonceHash",
+  "encryptionKey",
+  "databaseUrl",
+  "url",
+  "systemUrl"
+];
+const SENSITIVE_LOOKUP = new Set(SENSITIVE_KEYS.map((key) => key.toLowerCase()));
+const URL_CREDENTIALS = /([a-z][a-z0-9+.-]*:\/\/[^\s:@/]*:)[^\s/]*@/gi;
+const PARAMS_LINE = /^params:/m;
+const FAILED_QUERY_PREFIX = "Failed query:";
+const QUERY_FAILED_TEXT = "Database query failed";
+const ERROR_CODE_LABEL = /^[A-Z][A-Z0-9_]{0,63}$/;
+const scrubUrlCredentials = (text) => text.replace(URL_CREDENTIALS, `$1${REDACTED}@`);
+function scrubQueryText(text) {
+  const paramsAt = text.search(PARAMS_LINE);
+  if (paramsAt < 0)
+    return text;
+  const head = text.slice(0, paramsAt).trimEnd();
+  return head.startsWith(FAILED_QUERY_PREFIX) ? QUERY_FAILED_TEXT : head;
+}
+function scrubErrorMessage(message) {
+  return scrubUrlCredentials(scrubQueryText(message));
+}
+function scrubErrorStack(stack, message) {
+  if (message === "" || !stack.includes(message))
+    return scrubUrlCredentials(scrubQueryText(stack));
+  return scrubUrlCredentials(stack.replace(message, () => scrubErrorMessage(message)));
+}
+const isWrappedQueryError = (error) => "query" in error && "params" in error;
+function isPlainObject(value) {
+  const prototype = Object.getPrototypeOf(value);
+  return prototype === Object.prototype || prototype === null;
+}
+function scrubValue(value, depth, ancestors) {
+  if (typeof value === "string")
+    return scrubUrlCredentials(value);
+  if (typeof value !== "object" || value === null)
+    return value;
+  if (ancestors.includes(value))
+    return CIRCULAR;
+  if (depth > MAX_SCRUB_DEPTH)
+    return TRUNCATED;
+  const path = [...ancestors, value];
+  if (Array.isArray(value))
+    return value.map((item) => scrubValue(item, depth + 1, path));
+  const isError = value instanceof Error;
+  if (!isError && !isPlainObject(value))
+    return value;
+  const result = {};
+  if (isError) {
+    result.type = value.name;
+    result.message = scrubErrorMessage(value.message);
+    if (value.stack !== void 0)
+      result.stack = scrubErrorStack(value.stack, value.message);
+    if (value.cause !== void 0)
+      result.cause = scrubValue(value.cause, depth + 1, path);
+  }
+  const wrappedQuery = isError && isWrappedQueryError(value);
+  for (const [key, child] of Object.entries(value)) {
+    if (wrappedQuery && (key === "query" || key === "params"))
+      continue;
+    const keepErrorCode = isError && key === "code" && ERROR_CODE_LABEL.test(String(child));
+    result[key] = SENSITIVE_LOOKUP.has(key.toLowerCase()) && !keepErrorCode ? REDACTED : scrubValue(child, depth + 1, path);
+  }
+  return result;
+}
+function scrub(record) {
+  const scrubbed = scrubValue(record, 0, []);
+  return typeof scrubbed === "object" && scrubbed !== null ? scrubbed : {};
+}
+function withScrubbedChildren(logger) {
+  const child = logger.child.bind(logger);
+  const scrubbedChild = (bindings, childOptions) => withScrubbedChildren(child(scrub(bindings), childOptions));
+  Object.defineProperty(logger, "child", {
+    value: scrubbedChild,
+    configurable: true,
+    writable: true
+  });
+  return logger;
+}
+function traceIds() {
+  const context = import_api.trace.getActiveSpan()?.spanContext();
+  return context && (0, import_api.isSpanContextValid)(context) ? { trace_id: context.traceId, span_id: context.spanId } : {};
+}
+function createLogger(options) {
+  return withScrubbedChildren((0, import_pino.pino)({
+    name: options.name,
+    level: options.level,
+    // Scrubbing runs on the whole record before serializers, so errors are
+    // converted here and the default `err` serializer is replaced by identity.
+    formatters: { log: scrub, bindings: scrub },
+    serializers: { err: (value) => value },
+    timestamp: import_pino.pino.stdTimeFunctions.isoTime,
+    mixin: traceIds
+  }, options.destination ?? import_pino.pino.destination({ sync: false })));
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CIRCULAR,
+  MAX_SCRUB_DEPTH,
+  REDACTED,
+  SENSITIVE_KEYS,
+  TRUNCATED,
+  createLogger,
+  watchRedis
+});

package/dist/cjs/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/dist/cjs/redis-watch.d.ts

@@ -0,0 +1,17 @@
+/** What watchRedis logs through: the warn and info of any pino-style logger. */
+export interface RedisWatchLogger {
+    warn(fields: Record<string, unknown>, msg: string): void;
+    info(fields: Record<string, unknown>, msg: string): void;
+}
+/** An ioredis client, or anything else that emits its 'error' and 'ready' events. */
+export interface WatchedRedis {
+    on(event: 'error', listener: (err: Error) => void): unknown;
+    on(event: 'ready', listener: () => void): unknown;
+}
+/**
+ * Logs a Redis client's outages: once when it becomes unreachable, with the error, and once
+ * when it is back, with how many errors it saw meanwhile. ioredis emits an error on every
+ * reconnect attempt, and without a listener prints each as "Unhandled error event". `name`
+ * says which Redis (queue, api, cache) in each line.
+ */
+export declare function watchRedis<T extends WatchedRedis>(redis: T, logger: RedisWatchLogger, name: string): T;

package/dist/cjs/redis-watch.js

@@ -0,0 +1,40 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var redis_watch_exports = {};
+__export(redis_watch_exports, {
+  watchRedis: () => watchRedis
+});
+module.exports = __toCommonJS(redis_watch_exports);
+function watchRedis(redis, logger, name) {
+  let errors = 0;
+  redis.on("error", (err) => {
+    errors += 1;
+    if (errors === 1)
+      logger.warn({ redis: name, err }, "Redis unreachable");
+  });
+  redis.on("ready", () => {
+    if (errors > 0)
+      logger.info({ redis: name, errors }, "Redis reachable again");
+    errors = 0;
+  });
+  return redis;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  watchRedis
+});

package/dist/index.d.ts

@@ -0,0 +1,14 @@
+import type { Logger as PinoLogger } from 'pino';
+export type Logger = PinoLogger;
+export declare const REDACTED = "[REDACTED]";
+export declare const TRUNCATED = "[TRUNCATED]";
+export declare const CIRCULAR = "[CIRCULAR]";
+export declare const MAX_SCRUB_DEPTH = 12;
+export declare const SENSITIVE_KEYS: readonly ["accessToken", "access_token", "accessTokenEncrypted", "apiSecret", "clientSecret", "client_secret", "password", "passwordHash", "token", "sessionToken", "subject_token", "apiKey", "keyHash", "csrfToken", "authorization", "cookie", "set-cookie", "x-shopify-access-token", "x-shopify-hmac-sha256", "x-csrf-token", "sessionId", "secret", "code", "hmac", "state", "browserNonceHash", "encryptionKey", "databaseUrl", "url", "systemUrl"];
+export declare function createLogger(options: {
+    level: string;
+    name: string;
+    destination?: NodeJS.WritableStream;
+}): Logger;
+export { watchRedis } from './redis-watch.js';
+export type { RedisWatchLogger, WatchedRedis } from './redis-watch.js';

package/dist/index.js

@@ -0,0 +1,148 @@
+import { isSpanContextValid, trace } from '@opentelemetry/api';
+import { pino } from 'pino';
+export const REDACTED = '[REDACTED]';
+export const TRUNCATED = '[TRUNCATED]';
+export const CIRCULAR = '[CIRCULAR]';
+export const MAX_SCRUB_DEPTH = 12;
+export const SENSITIVE_KEYS = [
+    'accessToken',
+    'access_token',
+    'accessTokenEncrypted',
+    'apiSecret',
+    'clientSecret',
+    'client_secret',
+    'password',
+    'passwordHash',
+    'token',
+    'sessionToken',
+    'subject_token',
+    'apiKey',
+    'keyHash',
+    'csrfToken',
+    'authorization',
+    'cookie',
+    'set-cookie',
+    'x-shopify-access-token',
+    'x-shopify-hmac-sha256',
+    'x-csrf-token',
+    'sessionId',
+    'secret',
+    'code',
+    'hmac',
+    'state',
+    'browserNonceHash',
+    'encryptionKey',
+    'databaseUrl',
+    'url',
+    'systemUrl',
+];
+const SENSITIVE_LOOKUP = new Set(SENSITIVE_KEYS.map((key) => key.toLowerCase()));
+/** `scheme://user:password@host`: the password is replaced, the rest stays readable. */
+const URL_CREDENTIALS = /([a-z][a-z0-9+.-]*:\/\/[^\s:@/]*:)[^\s/]*@/gi;
+const PARAMS_LINE = /^params:/m;
+const FAILED_QUERY_PREFIX = 'Failed query:';
+const QUERY_FAILED_TEXT = 'Database query failed';
+/** An error's own `code` (ECONNRESET, SHOPIFY_AUTH_ERROR) is a label, not an OAuth code. */
+const ERROR_CODE_LABEL = /^[A-Z][A-Z0-9_]{0,63}$/;
+const scrubUrlCredentials = (text) => text.replace(URL_CREDENTIALS, `$1${REDACTED}@`);
+/** Bound query parameters follow a `params:` line; the SQL precedes it. Neither is logged. */
+function scrubQueryText(text) {
+    const paramsAt = text.search(PARAMS_LINE);
+    if (paramsAt < 0)
+        return text;
+    const head = text.slice(0, paramsAt).trimEnd();
+    return head.startsWith(FAILED_QUERY_PREFIX) ? QUERY_FAILED_TEXT : head;
+}
+function scrubErrorMessage(message) {
+    return scrubUrlCredentials(scrubQueryText(message));
+}
+/** Keeps the frames of a stack whose message was rewritten; cuts at `params:` if the message is absent. */
+function scrubErrorStack(stack, message) {
+    if (message === '' || !stack.includes(message))
+        return scrubUrlCredentials(scrubQueryText(stack));
+    return scrubUrlCredentials(stack.replace(message, () => scrubErrorMessage(message)));
+}
+/** Drizzle puts the SQL and the bound values on the error as `query` and `params`. */
+const isWrappedQueryError = (error) => 'query' in error && 'params' in error;
+function isPlainObject(value) {
+    const prototype = Object.getPrototypeOf(value);
+    return prototype === Object.prototype || prototype === null;
+}
+function scrubValue(value, depth, ancestors) {
+    if (typeof value === 'string')
+        return scrubUrlCredentials(value);
+    if (typeof value !== 'object' || value === null)
+        return value;
+    if (ancestors.includes(value))
+        return CIRCULAR;
+    if (depth > MAX_SCRUB_DEPTH)
+        return TRUNCATED;
+    const path = [...ancestors, value];
+    if (Array.isArray(value))
+        return value.map((item) => scrubValue(item, depth + 1, path));
+    const isError = value instanceof Error;
+    if (!isError && !isPlainObject(value))
+        return value;
+    const result = {};
+    if (isError) {
+        // Error fields are non-enumerable, so copy the ones that make an error useful.
+        result.type = value.name;
+        result.message = scrubErrorMessage(value.message);
+        if (value.stack !== undefined)
+            result.stack = scrubErrorStack(value.stack, value.message);
+        if (value.cause !== undefined)
+            result.cause = scrubValue(value.cause, depth + 1, path);
+    }
+    const wrappedQuery = isError && isWrappedQueryError(value);
+    for (const [key, child] of Object.entries(value)) {
+        if (wrappedQuery && (key === 'query' || key === 'params'))
+            continue;
+        const keepErrorCode = isError && key === 'code' && ERROR_CODE_LABEL.test(String(child));
+        result[key] =
+            SENSITIVE_LOOKUP.has(key.toLowerCase()) && !keepErrorCode
+                ? REDACTED
+                : scrubValue(child, depth + 1, path);
+    }
+    return result;
+}
+function scrub(record) {
+    const scrubbed = scrubValue(record, 0, []);
+    return typeof scrubbed === 'object' && scrubbed !== null
+        ? scrubbed
+        : {};
+}
+// Pino does not run `formatters.bindings` on child bindings, so child() is wrapped.
+function withScrubbedChildren(logger) {
+    const child = logger.child.bind(logger);
+    const scrubbedChild = (bindings, childOptions) => withScrubbedChildren(child(scrub(bindings), childOptions));
+    Object.defineProperty(logger, 'child', {
+        value: scrubbedChild,
+        configurable: true,
+        writable: true,
+    });
+    return logger;
+}
+/**
+ * The active span's IDs, so a line can be followed to its trace (Grafana links `trace_id` to
+ * Tempo). Nothing outside a span, or when tracing is off.
+ */
+function traceIds() {
+    const context = trace.getActiveSpan()?.spanContext();
+    return context && isSpanContextValid(context)
+        ? { trace_id: context.traceId, span_id: context.spanId }
+        : {};
+}
+export function createLogger(options) {
+    return withScrubbedChildren(pino({
+        name: options.name,
+        level: options.level,
+        // Scrubbing runs on the whole record before serializers, so errors are
+        // converted here and the default `err` serializer is replaced by identity.
+        formatters: { log: scrub, bindings: scrub },
+        serializers: { err: (value) => value },
+        timestamp: pino.stdTimeFunctions.isoTime,
+        mixin: traceIds,
+    }, options.destination ?? pino.destination({ sync: false })));
+}
+export { watchRedis } from './redis-watch.js';
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC/D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAI5B,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AACrC,MAAM,CAAC,MAAM,SAAS,GAAG,aAAa,CAAC;AACvC,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AACrC,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,aAAa;IACb,cAAc;IACd,sBAAsB;IACtB,WAAW;IACX,cAAc;IACd,eAAe;IACf,UAAU;IACV,cAAc;IACd,OAAO;IACP,cAAc;IACd,eAAe;IACf,QAAQ;IACR,SAAS;IACT,WAAW;IACX,eAAe;IACf,QAAQ;IACR,YAAY;IACZ,wBAAwB;IACxB,uBAAuB;IACvB,cAAc;IACd,WAAW;IACX,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,kBAAkB;IAClB,eAAe;IACf,aAAa;IACb,KAAK;IACL,WAAW;CACH,CAAC;AAEX,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CACnD,cAAc,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAC/C,CAAC;AAEF,wFAAwF;AACxF,MAAM,eAAe,GAAG,8CAA8C,CAAC;AACvE,MAAM,WAAW,GAAG,WAAW,CAAC;AAChC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AAC5C,MAAM,iBAAiB,GAAG,uBAAuB,CAAC;AAClD,4FAA4F;AAC5F,MAAM,gBAAgB,GAAG,wBAAwB,CAAC;AAElD,MAAM,mBAAmB,GAAG,CAAC,IAAY,EAAU,EAAE,CACnD,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,QAAQ,GAAG,CAAC,CAAC;AAElD,8FAA8F;AAC9F,SAAS,cAAc,CAAC,IAAY;IAClC,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,QAAQ,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,OAAO,EAAE,CAAC;IAC/C,OAAO,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,mBAAmB,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,2GAA2G;AAC3G,SAAS,eAAe,CAAC,KAAa,EAAE,OAAe;IACrD,IAAI,OAAO,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,mBAAmB,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,CAAC;IAClG,OAAO,mBAAmB,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACvF,CAAC;AAED,sFAAsF;AACtF,MAAM,mBAAmB,GAAG,CAAC,KAAY,EAAW,EAAE,CAAC,OAAO,IAAI,KAAK,IAAI,QAAQ,IAAI,KAAK,CAAC;AAE7F,SAAS,aAAa,CAAC,KAAa;IAClC,MAAM,SAAS,GAAY,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IACxD,OAAO,SAAS,KAAK,MAAM,CAAC,SAAS,IAAI,SAAS,KAAK,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,UAAU,CAAC,KAAc,EAAE,KAAa,EAAE,SAAmB;IACpE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,mBAAmB,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IAC9D,IAAI,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,KAAK,GAAG,eAAe;QAAE,OAAO,SAAS,CAAC;IAE9C,MAAM,IAAI,GAAG,CAAC,GAAG,SAAS,EAAE,KAAK,CAAC,CAAC;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC;IAExF,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC;IACvC,IAAI,CAAC,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAEpD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,IAAI,OAAO,EAAE,CAAC;QACZ,+EAA+E;QAC/E,MAAM,CAAC,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACzB,MAAM,CAAC,OAAO,GAAG,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC1F,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,MAAM,CAAC,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IACzF,CAAC;IACD,MAAM,YAAY,GAAG,OAAO,IAAI,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3D,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,YAAY,IAAI,CAAC,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,QAAQ,CAAC;YAAE,SAAS;QACpE,MAAM,aAAa,GAAG,OAAO,IAAI,GAAG,KAAK,MAAM,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QACxF,MAAM,CAAC,GAAG,CAAC;YACT,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,CAAC,aAAa;gBACvD,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;IAC3C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,KAAK,CAAC,MAAc;IAC3B,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3C,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,IAAI;QACtD,CAAC,CAAE,QAAoC;QACvC,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,oFAAoF;AACpF,SAAS,oBAAoB,CAAC,MAAc;IAC1C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,CAAC,QAAuB,EAAE,YAAsC,EAAU,EAAE,CAChG,oBAAoB,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC;IAC7D,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,OAAO,EAAE;QACrC,KAAK,EAAE,aAAa;QACpB,YAAY,EAAE,IAAI;QAClB,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;IACH,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,SAAS,QAAQ;IACf,MAAM,OAAO,GAAG,KAAK,CAAC,aAAa,EAAE,EAAE,WAAW,EAAE,CAAC;IACrD,OAAO,OAAO,IAAI,kBAAkB,CAAC,OAAO,CAAC;QAC3C,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE;QACxD,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,OAI5B;IACC,OAAO,oBAAoB,CACzB,IAAI,CACF;QACE,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,uEAAuE;QACvE,2EAA2E;QAC3E,UAAU,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE;QAC3C,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC,KAAc,EAAE,EAAE,CAAC,KAAK,EAAE;QAC/C,SAAS,EAAE,IAAI,CAAC,gBAAgB,CAAC,OAAO;QACxC,KAAK,EAAE,QAAQ;KAChB,EACD,OAAO,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CACzD,CACF,CAAC;AACJ,CAAC;AAED,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/redis-watch.d.ts

@@ -0,0 +1,17 @@
+/** What watchRedis logs through: the warn and info of any pino-style logger. */
+export interface RedisWatchLogger {
+    warn(fields: Record<string, unknown>, msg: string): void;
+    info(fields: Record<string, unknown>, msg: string): void;
+}
+/** An ioredis client, or anything else that emits its 'error' and 'ready' events. */
+export interface WatchedRedis {
+    on(event: 'error', listener: (err: Error) => void): unknown;
+    on(event: 'ready', listener: () => void): unknown;
+}
+/**
+ * Logs a Redis client's outages: once when it becomes unreachable, with the error, and once
+ * when it is back, with how many errors it saw meanwhile. ioredis emits an error on every
+ * reconnect attempt, and without a listener prints each as "Unhandled error event". `name`
+ * says which Redis (queue, api, cache) in each line.
+ */
+export declare function watchRedis<T extends WatchedRedis>(redis: T, logger: RedisWatchLogger, name: string): T;

package/dist/redis-watch.js

@@ -0,0 +1,21 @@
+/**
+ * Logs a Redis client's outages: once when it becomes unreachable, with the error, and once
+ * when it is back, with how many errors it saw meanwhile. ioredis emits an error on every
+ * reconnect attempt, and without a listener prints each as "Unhandled error event". `name`
+ * says which Redis (queue, api, cache) in each line.
+ */
+export function watchRedis(redis, logger, name) {
+    let errors = 0;
+    redis.on('error', (err) => {
+        errors += 1;
+        if (errors === 1)
+            logger.warn({ redis: name, err }, 'Redis unreachable');
+    });
+    redis.on('ready', () => {
+        if (errors > 0)
+            logger.info({ redis: name, errors }, 'Redis reachable again');
+        errors = 0;
+    });
+    return redis;
+}
+//# sourceMappingURL=redis-watch.js.map

package/dist/redis-watch.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redis-watch.js","sourceRoot":"","sources":["../src/redis-watch.ts"],"names":[],"mappings":"AAYA;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CACxB,KAAQ,EACR,MAAwB,EACxB,IAAY;IAEZ,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACxB,MAAM,IAAI,CAAC,CAAC;QACZ,IAAI,MAAM,KAAK,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,EAAE,mBAAmB,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACrB,IAAI,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,uBAAuB,CAAC,CAAC;QAC9E,MAAM,GAAG,CAAC,CAAC;IACb,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC;AACf,CAAC"}

package/package.json

@@ -1,6 +1,56 @@
 {
   "name": "@haatlabs-core/logger",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.11.0",
+  "description": "Pino logging with secrets scrubbed from every record.",
+  "keywords": [
+    "haatlabs",
+    "pino"
+  ],
+  "homepage": "https://haatlabs.shop/docs/packages/logger/",
+  "license": "Apache-2.0",
+  "type": "module",
+  "engines": {
+    "node": ">=24"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Haatlabs/haatlabs-platform.git",
+    "directory": "packages/logger"
+  },
+  "publishConfig": {
+    "access": "public",
+    "registry": "https://registry.npmjs.org"
+  },
+  "files": [
+    "dist"
+  ],
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.js"
+      },
+      "require": {
+        "types": "./dist/cjs/index.d.ts",
+        "default": "./dist/cjs/index.js"
+      }
+    }
+  },
+  "dependencies": {
+    "@opentelemetry/api": "^1.9.1",
+    "pino": "^10.4.0"
+  },
+  "devDependencies": {
+    "@opentelemetry/sdk-trace-node": "^2.11.0",
+    "@haatlabs-core/observability": "0.11.0",
+    "@haatlabs-core/tsconfig": "0.11.0",
+    "@haatlabs-core/vitest-config": "0.11.0"
+  },
+  "scripts": {
+    "build": "rm -rf dist && tsc -p tsconfig.build.json && node ../../scripts/build-cjs.mjs",
+    "typecheck": "tsc --noEmit",
+    "test": "vitest run",
+    "check:package": "publint --strict && attw --pack . --profile node16"
+  },
+  "platformRegistry": "npm"
+}