@heavybit/shared-lib 1.3.2 → 2.7.0

package/dist/cjs/knex/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/knex/index.ts"],"names":[],"mappings":";;AAQA,kCAEC;AAGD,gCAEC;AAGD,gCAGC;AAGD,oCAGC;AAGD,4BAEC;AAMD,4CAYC;AAGD,8CAYC;AAGD,0BAIC;AAtED;;;GAGG;AAEH,2CAA2C;AAC3C,SAAgB,WAAW,CAAC,KAA8B,EAAE,IAAI,GAAG,IAAI;IACrE,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,EAAE,CAAC;AAC/D,CAAC;AAED,iGAAiG;AACjG,SAAgB,UAAU,CAAC,KAAuD,EAAE,IAAY;IAC9F,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;AAC9C,CAAC;AAED,gFAAgF;AAChF,SAAgB,UAAU,CAAC,KAA8B,EAAE,IAAU;IACnE,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;IAC1G,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC,CAAC;AAC3I,CAAC;AAED,8EAA8E;AAC9E,SAAgB,YAAY,CAAC,KAA8B;IACzD,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC3C,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,QAAQ,EAAE,CAAC;AAC7C,CAAC;AAED,qCAAqC;AACrC,SAAgB,QAAQ,CAAC,KAAuD,EAAE,IAAY;IAC5F,OAAO,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AACjD,CAAC;AAED;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CAAC,IAAU,EAAE,WAAmB,EAAE,OAAiD;IACvH,MAAM,IAAI,GAAG,GAAG,WAAW,SAAS,CAAC;IACrC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO;IAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;QAC5C,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,UAAU,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,CAAC;QACrD,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,OAAO,CAAC,KAAK,CAAC,CAAC;QACf,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxB,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,wDAAwD;AACjD,KAAK,UAAU,iBAAiB,CAAC,IAAU,EAAE,IAAI,GAAG,cAAc;IACvE,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO;IAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;QAC5C,WAAW,CAAC,KAAK,CAAC,CAAC;QACnB,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/C,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;QACpC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;QAChE,KAAK,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3C,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,CAAC,CAAC;QAC1G,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC3C,KAAK,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,SAAgB,OAAO,CAAC,KAA8B;IACpD,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvB,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzB,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;AACtC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/knex/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAiBA,4CAYC;AAGD,8CAGC;AAGD,0BAIC;AAzCD,+DAAkE;AAClE,6CAA2F;AAC3F,iEAAuD;AAEvD,+CAA6B;AAC7B,yDAAuC;AAEvC;;;GAGG;AAEH;;;GAGG;AACI,KAAK,UAAU,gBAAgB,CAAC,IAAU,EAAE,WAAmB,EAAE,OAAiD;IACvH,MAAM,IAAI,GAAG,GAAG,WAAW,SAAS,CAAC;IACrC,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO;IAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE;QAC5C,IAAA,wBAAW,EAAC,KAAK,CAAC,CAAC;QACnB,IAAA,uBAAU,EAAC,KAAK,EAAE,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,CAAC;QACrD,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;QAClE,OAAO,CAAC,KAAK,CAAC,CAAC;QACf,IAAA,yBAAY,EAAC,KAAK,CAAC,CAAC;QACpB,IAAA,uBAAU,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QACxB,KAAK,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6FAA6F;AACtF,KAAK,UAAU,iBAAiB,CAAC,IAAU,EAAE,IAAI,GAAG,qCAAoB;IAC7E,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO;IAC7C,MAAM,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAA,oCAAa,EAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AAC7E,CAAC;AAED,0EAA0E;AAC1E,SAAgB,OAAO,CAAC,KAA8B;IACpD,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvB,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACzB,KAAK,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;AACtC,CAAC"}

package/dist/cjs/knex/migration-helpers.js

@@ -0,0 +1,57 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.outboxColumns = outboxColumns;
+exports.processedEventsColumns = processedEventsColumns;
+exports.schedulerRunsColumns = schedulerRunsColumns;
+exports.scopedIndex = scopedIndex;
+const table_names_js_1 = require("../database/table-names.js");
+const columns_js_1 = require("./columns.js");
+/**
+ * Outbox columns: id, routing_key, exchange, payload, correlation_id, attempts, last_error, created_at,
+ * published_at (+ relay index).
+ */
+function outboxColumns(t, knex) {
+    (0, columns_js_1.ulidPrimary)(t);
+    t.string('routing_key', 191).notNullable();
+    t.enu('exchange', [...table_names_js_1.OUTBOX_EXCHANGES]).notNullable().defaultTo('events');
+    t.json('payload').notNullable();
+    t.string('correlation_id', 64).nullable();
+    t.integer('attempts').unsigned().notNullable().defaultTo(0);
+    t.string('last_error', 500).nullable();
+    (0, columns_js_1.createdAtColumn)(t, knex, 'created_at');
+    (0, columns_js_1.datetime)(t, 'published_at').nullable();
+    t.index(['published_at', 'id']);
+}
+/** Consumer idempotency columns: id, consumer, event_id (unique together), processed_at. */
+function processedEventsColumns(t, knex) {
+    (0, columns_js_1.ulidPrimary)(t);
+    t.string('consumer', 191).notNullable();
+    t.string('event_id', 64).notNullable();
+    (0, columns_js_1.createdAtColumn)(t, knex, 'processed_at');
+    t.unique(['consumer', 'event_id']);
+    t.index(['processed_at']);
+}
+/** Scheduler run columns: id, job, run_key (unique together), status, error, started_at, finished_at. */
+function schedulerRunsColumns(t, knex) {
+    (0, columns_js_1.ulidPrimary)(t);
+    t.string('job', 191).notNullable();
+    t.string('run_key', 191).notNullable();
+    t.enu('status', [...table_names_js_1.SCHEDULER_RUN_STATUSES]).notNullable().defaultTo('running');
+    t.string('error', 500).nullable();
+    (0, columns_js_1.createdAtColumn)(t, knex, 'started_at');
+    (0, columns_js_1.datetime)(t, 'finished_at').nullable();
+    t.unique(['job', 'run_key']);
+    t.index(['job', 'started_at']);
+}
+/**
+ * Index that always leads with the scope column (TEN-4); `columns` follow in order, duplicates of
+ * the scope column are dropped.
+ *
+ * @example scopedIndex(t, 'workspace_id', ['status', 'created_at'])
+ */
+function scopedIndex(t, scopeColumn, columns = [], indexName) {
+    if (!scopeColumn)
+        throw new Error('scopedIndex needs a scope column');
+    t.index([scopeColumn, ...columns.filter((c) => c !== scopeColumn)], indexName);
+}
+//# sourceMappingURL=migration-helpers.js.map

package/dist/cjs/knex/migration-helpers.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"migration-helpers.js","sourceRoot":"","sources":["../../../src/knex/migration-helpers.ts"],"names":[],"mappings":";;AAoBA,sCAWC;AAGD,wDAOC;AAGD,oDAUC;AAQD,kCAGC;AAhED,+DAAsF;AACtF,6CAAsE;AActE;;;GAGG;AACH,SAAgB,aAAa,CAAC,CAAU,EAAE,IAAU;IAClD,IAAA,wBAAW,EAAC,CAAC,CAAC,CAAC;IACf,CAAC,CAAC,MAAM,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3C,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,GAAG,iCAAgB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC3E,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAChC,CAAC,CAAC,MAAM,CAAC,gBAAgB,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAC1C,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IAC5D,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvC,IAAA,4BAAe,EAAC,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IACvC,IAAA,qBAAQ,EAAC,CAAC,EAAE,cAAc,CAAC,CAAC,QAAQ,EAAE,CAAC;IACvC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,4FAA4F;AAC5F,SAAgB,sBAAsB,CAAC,CAAU,EAAE,IAAU;IAC3D,IAAA,wBAAW,EAAC,CAAC,CAAC,CAAC;IACf,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACxC,CAAC,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IACvC,IAAA,4BAAe,EAAC,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;IACzC,CAAC,CAAC,MAAM,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC,CAAC;IACnC,CAAC,CAAC,KAAK,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC;AAC5B,CAAC;AAED,yGAAyG;AACzG,SAAgB,oBAAoB,CAAC,CAAU,EAAE,IAAU;IACzD,IAAA,wBAAW,EAAC,CAAC,CAAC,CAAC;IACf,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACnC,CAAC,CAAC,MAAM,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACvC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,GAAG,uCAAsB,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAChF,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClC,IAAA,4BAAe,EAAC,CAAC,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;IACvC,IAAA,qBAAQ,EAAC,CAAC,EAAE,aAAa,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7B,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC,CAAC;AACjC,CAAC;AAED;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,CAAmC,EAAE,WAAmB,EAAE,UAAoB,EAAE,EAAE,SAAkB;IAC9H,IAAI,CAAC,WAAW;QAAE,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtE,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;AACjF,CAAC"}

package/dist/cjs/logging/index.js

@@ -3,60 +3,91 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.silentLogger = exports.DEFAULT_REDACT_KEYS = void 0;
+exports.silentLogger = exports.redactValue = exports.maskPhonesInText = exports.maskPhoneForLog = exports.createKeyClassifier = exports.REDACTED = exports.DEFAULT_REDACT_KEYS = exports.DEFAULT_ALLOW_KEYS = void 0;
 exports.createLogger = createLogger;
 exports.childLogger = childLogger;
 const winston_1 = __importDefault(require("winston"));
-const { combine, timestamp, json, errors, colorize, printf, splat } = winston_1.default.format;
-/** Keys whose values are replaced with `[REDACTED]` anywhere in log metadata. */
-exports.DEFAULT_REDACT_KEYS = [
-    'password', 'newPassword', 'currentPassword', 'passwordHash', 'token', 'accessToken', 'refreshToken',
-    'secret', 'clientSecret', 'apiKey', 'authorization', 'cookie', 'otp', 'pass', 'smtpPassword',
-];
-function redactValue(value, keys, depth = 0) {
-    if (depth > 6 || value === null || typeof value !== 'object')
-        return value;
-    if (Array.isArray(value))
-        return value.map((v) => redactValue(v, keys, depth + 1));
-    if (value instanceof Error)
-        return value;
-    const out = {};
-    for (const [k, v] of Object.entries(value)) {
-        out[k] = keys.has(k) || k.endsWith('Enc') || k.endsWith('_enc') ? '[REDACTED]' : redactValue(v, keys, depth + 1);
-    }
-    return out;
-}
-const redact = (keys) => winston_1.default.format((info) => {
-    for (const k of Object.keys(info)) {
-        if (keys.has(k))
-            info[k] = '[REDACTED]';
-        else if (k !== 'message' && k !== 'level')
-            info[k] = redactValue(info[k], keys);
-    }
+const index_js_1 = require("../context/index.js");
+const redact_js_1 = require("./redact.js");
+var redact_js_2 = require("./redact.js");
+Object.defineProperty(exports, "DEFAULT_ALLOW_KEYS", { enumerable: true, get: function () { return redact_js_2.DEFAULT_ALLOW_KEYS; } });
+Object.defineProperty(exports, "DEFAULT_REDACT_KEYS", { enumerable: true, get: function () { return redact_js_2.DEFAULT_REDACT_KEYS; } });
+Object.defineProperty(exports, "REDACTED", { enumerable: true, get: function () { return redact_js_2.REDACTED; } });
+Object.defineProperty(exports, "createKeyClassifier", { enumerable: true, get: function () { return redact_js_2.createKeyClassifier; } });
+Object.defineProperty(exports, "maskPhoneForLog", { enumerable: true, get: function () { return redact_js_2.maskPhoneForLog; } });
+Object.defineProperty(exports, "maskPhonesInText", { enumerable: true, get: function () { return redact_js_2.maskPhonesInText; } });
+Object.defineProperty(exports, "redactValue", { enumerable: true, get: function () { return redact_js_2.redactValue; } });
+const { combine, timestamp, errors, colorize, printf, splat } = winston_1.default.format;
+/** Winston bookkeeping keys that never appear as metadata. */
+const RESERVED_KEYS = new Set(['level', 'message', 'timestamp', 'splat']);
+/** Ids the library itself puts on a line; never redacted or phone-masked. */
+const CONTEXT_KEYS = new Set(['service', 'correlationId', 'userId', 'scopes']);
+/** Adds the request context (correlation id, user id, scopes, service) unless the line already has it. */
+const withContext = winston_1.default.format((info) => {
+    const ctx = (0, index_js_1.getRequestContext)();
+    if (!ctx)
+        return info;
+    const line = info;
+    line.correlationId ??= ctx.correlationId;
+    if (ctx.userId !== undefined)
+        line.userId ??= ctx.userId;
+    if (ctx.scopes && Object.keys(ctx.scopes).length > 0)
+        line.scopes ??= ctx.scopes;
+    if (ctx.service !== undefined)
+        line.service ??= ctx.service;
+    return info;
+});
+/** Redacts secrets and masks phones in the message and every metadata value. */
+const redact = (classifier) => winston_1.default.format((info) => {
+    const line = info;
+    if (typeof line.message === 'string')
+        line.message = (0, redact_js_1.maskPhonesInText)(line.message);
+    const meta = Object.fromEntries(Object.entries(line).filter(([key]) => !RESERVED_KEYS.has(key) && !CONTEXT_KEYS.has(key)));
+    Object.assign(line, (0, redact_js_1.redactValue)(meta, classifier));
     return info;
-})();
-const devFormat = printf((info) => {
+});
+/** One JSON object per line: `{ level, time, msg, service, correlationId, userId, scopes, ...meta }`. */
+const jsonLine = printf((info) => {
+    const { level, message, timestamp: time, service, correlationId, userId, scopes, ...meta } = info;
+    return JSON.stringify({ level, time, msg: message, service, correlationId, userId, scopes, ...meta });
+});
+const prettyLine = printf((info) => {
     const { level, message, timestamp: ts, service, stack, ...rest } = info;
-    const meta = Object.fromEntries(Object.entries(rest).filter(([k]) => typeof k === 'string' && k !== 'splat'));
-    const metaStr = Object.keys(meta).length ? ` ${JSON.stringify(meta)}` : '';
+    const metaStr = Object.keys(rest).length ? ` ${JSON.stringify(rest)}` : '';
     return `${String(ts ?? '')} ${String(level)}: ${service ? `[${String(service)}] ` : ''}${String(message)}${metaStr}${stack ? `\n${String(stack)}` : ''}`;
 });
-/** Structured logger with secret redaction. JSON to stdout in production, pretty otherwise. */
+/**
+ * Structured logger. Every line carries `service` and, inside a request or {@link runWithContext}, the
+ * context's `correlationId`, `userId` and `scopes`. Secrets are redacted by key word (see
+ * {@link DEFAULT_REDACT_KEYS}) and phone numbers are masked to their last 4 digits, in the message and
+ * at any depth of the metadata. Writes to stdout (JSON in production, pretty otherwise; silent under
+ * `NODE_ENV=test` unless `LOG_IN_TESTS` is set) plus an optional file and stream.
+ *
+ * @param service Service name on every line.
+ * @param options Level, format, extra redact/allow keys, file path, stream.
+ * @returns A winston logger that satisfies {@link Logger}.
+ * @example const logger = createLogger('api', { filePath: 'logs/api.log' });
+ */
 function createLogger(service, options = {}) {
     const isProduction = process.env.NODE_ENV === 'production';
     const level = options.level ?? process.env.LOG_LEVEL ?? (isProduction ? 'info' : 'debug');
     const format = options.format ?? process.env.LOG_FORMAT ?? (isProduction ? 'json' : 'pretty');
-    const keys = new Set([...exports.DEFAULT_REDACT_KEYS, ...(options.redactKeys ?? [])]);
+    const classifier = (0, redact_js_1.createKeyClassifier)(options.redactKeys, options.allowKeys);
+    const transports = [
+        new winston_1.default.transports.Console({
+            silent: process.env.NODE_ENV === 'test' && !process.env.LOG_IN_TESTS,
+            format: format === 'json' ? jsonLine : combine(colorize({ level: true }), prettyLine),
+        }),
+    ];
+    if (options.filePath)
+        transports.push(new winston_1.default.transports.File({ filename: options.filePath, format: jsonLine }));
+    if (options.stream)
+        transports.push(new winston_1.default.transports.Stream({ stream: options.stream, format: jsonLine }));
     return winston_1.default.createLogger({
         level,
         defaultMeta: { service },
-        format: combine(errors({ stack: true }), splat(), redact(keys), timestamp()),
-        transports: [
-            new winston_1.default.transports.Console({
-                silent: process.env.NODE_ENV === 'test' && !process.env.LOG_IN_TESTS,
-                format: format === 'json' ? json() : combine(colorize({ level: true }), devFormat),
-            }),
-        ],
+        format: combine(errors({ stack: true }), splat(), withContext(), redact(classifier)(), timestamp()),
+        transports,
     });
 }
 /** Logger that discards everything — handy default for libraries and tests. */
@@ -66,6 +97,11 @@ exports.silentLogger = { debug: () => { }, info: () => { }, warn: () => { }, err
  * meta wins on a key clash. `undefined` context values are dropped so lines never carry empty keys.
  * Works over any {@link Logger} (winston, a test spy, or another child), so handlers can create one
  * per message and pass it down.
+ *
+ * @param logger The logger to write through.
+ * @param context Values added to every line.
+ * @returns A {@link Logger}.
+ * @example const log = childLogger(logger, { jobId });
  */
 function childLogger(logger, context) {
     const base = Object.fromEntries(Object.entries(context).filter(([, v]) => v !== undefined));

package/dist/cjs/logging/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/logging/index.ts"],"names":[],"mappings":";;;;;;AA8CA,oCAiBC;AAWD,kCAKC;AA/ED,sDAA8B;AAG9B,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,iBAAO,CAAC,MAAM,CAAC;AAErF,iFAAiF;AACpE,QAAA,mBAAmB,GAAG;IACjC,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,EAAE,cAAc;IACpG,QAAQ,EAAE,cAAc,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc;CAC7F,CAAC;AAEF,SAAS,WAAW,CAAC,KAAc,EAAE,IAAiB,EAAE,KAAK,GAAG,CAAC;IAC/D,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC3E,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC;IACzC,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACtE,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,IAAiB,EAAE,EAAE,CACnC,iBAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;IACtB,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAAG,IAAgC,CAAC,CAAC,CAAC,GAAG,YAAY,CAAC;aAChE,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,OAAO;YAAG,IAAgC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAE,IAAgC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC5I,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC,EAAE,CAAC;AAEP,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;IAChC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,IAA+B,CAAC;IACnG,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC;IAC9G,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,OAAO,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC3J,CAAC,CAAC,CAAC;AASH,+FAA+F;AAC/F,SAAgB,YAAY,CAAC,OAAe,EAAE,UAAyB,EAAE;IACvE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAK,OAAO,CAAC,GAAG,CAAC,UAA4C,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACjI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,2BAAmB,EAAE,GAAG,CAAC,OAAO,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAE9E,OAAO,iBAAO,CAAC,YAAY,CAAC;QAC1B,KAAK;QACL,WAAW,EAAE,EAAE,OAAO,EAAE;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,SAAS,EAAE,CAAC;QAC5E,UAAU,EAAE;YACV,IAAI,iBAAO,CAAC,UAAU,CAAC,OAAO,CAAC;gBAC7B,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY;gBACpE,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,SAAS,CAAC;aACnF,CAAC;SACH;KACF,CAA4B,CAAC;AAChC,CAAC;AAED,+EAA+E;AAClE,QAAA,YAAY,GAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;AAEzG;;;;;GAKG;AACH,SAAgB,WAAW,CAAC,MAAc,EAAE,OAAgC;IAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,CAAC,KAAmB,EAAE,EAAE,CAAC,CAAC,OAAe,EAAE,IAA8B,EAAE,EAAE,CACzF,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;AACpG,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/logging/index.ts"],"names":[],"mappings":";;;;;;AA8EA,oCAqBC;AAgBD,kCAKC;AAvHD,sDAA8B;AAC9B,kDAAwD;AAExD,2CAAqG;AAErG,yCAAqJ;AAA5I,+GAAA,kBAAkB,OAAA;AAAE,gHAAA,mBAAmB,OAAA;AAAE,qGAAA,QAAQ,OAAA;AAAE,gHAAA,mBAAmB,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAAE,wGAAA,WAAW,OAAA;AAG/H,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,iBAAO,CAAC,MAAM,CAAC;AAE/E,8DAA8D;AAC9D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAC1E,6EAA6E;AAC7E,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,eAAe,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE/E,0GAA0G;AAC1G,MAAM,WAAW,GAAG,iBAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;IAC1C,MAAM,GAAG,GAAG,IAAA,4BAAiB,GAAE,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,MAAM,IAAI,GAAG,IAA+B,CAAC;IAC7C,IAAI,CAAC,aAAa,KAAK,GAAG,CAAC,aAAa,CAAC;IACzC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS;QAAE,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC;IACzD,IAAI,GAAG,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,MAAM,KAAK,GAAG,CAAC,MAAM,CAAC;IACjF,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,KAAK,GAAG,CAAC,OAAO,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC,CAAC,CAAC;AAEH,gFAAgF;AAChF,MAAM,MAAM,GAAG,CAAC,UAAyB,EAAE,EAAE,CAC3C,iBAAO,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;IACtB,MAAM,IAAI,GAAG,IAA+B,CAAC;IAC7C,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;QAAE,IAAI,CAAC,OAAO,GAAG,IAAA,4BAAgB,EAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACpF,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3H,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAA,uBAAW,EAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;IACnD,OAAO,IAAI,CAAC;AACd,CAAC,CAAC,CAAC;AAEL,yGAAyG;AACzG,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;IAC/B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,IAA+B,CAAC;IAC7H,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;AACxG,CAAC,CAAC,CAAC;AAEH,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;IACjC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,IAAI,EAAE,GAAG,IAA+B,CAAC;IACnG,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3E,OAAO,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,IAAI,MAAM,CAAC,KAAK,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC3J,CAAC,CAAC,CAAC;AAkBH;;;;;;;;;;;GAWG;AACH,SAAgB,YAAY,CAAC,OAAe,EAAE,UAAyB,EAAE;IACvE,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,YAAY,CAAC;IAC3D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,SAAS,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1F,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAK,OAAO,CAAC,GAAG,CAAC,UAA4C,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACjI,MAAM,UAAU,GAAG,IAAA,+BAAmB,EAAC,OAAO,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAE9E,MAAM,UAAU,GAAwB;QACtC,IAAI,iBAAO,CAAC,UAAU,CAAC,OAAO,CAAC;YAC7B,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY;YACpE,MAAM,EAAE,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,UAAU,CAAC;SACtF,CAAC;KACH,CAAC;IACF,IAAI,OAAO,CAAC,QAAQ;QAAE,UAAU,CAAC,IAAI,CAAC,IAAI,iBAAO,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACrH,IAAI,OAAO,CAAC,MAAM;QAAE,UAAU,CAAC,IAAI,CAAC,IAAI,iBAAO,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IAEjH,OAAO,iBAAO,CAAC,YAAY,CAAC;QAC1B,KAAK;QACL,WAAW,EAAE,EAAE,OAAO,EAAE;QACxB,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,CAAC;QACnG,UAAU;KACX,CAA4B,CAAC;AAChC,CAAC;AAED,+EAA+E;AAClE,QAAA,YAAY,GAAW,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,GAAE,CAAC,EAAE,CAAC;AAEzG;;;;;;;;;;GAUG;AACH,SAAgB,WAAW,CAAC,MAAc,EAAE,OAAgC;IAC1E,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC;IAC5F,MAAM,KAAK,GAAG,CAAC,KAAmB,EAAE,EAAE,CAAC,CAAC,OAAe,EAAE,IAA8B,EAAE,EAAE,CACzF,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAC/C,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;AACpG,CAAC"}

package/dist/cjs/logging/redact.js

@@ -0,0 +1,112 @@
+"use strict";
+/**
+ * Secret redaction and phone masking for log lines. Matching is by key *word*, not substring: a key is
+ * split on camelCase and separators (`refresh_token` → `refresh`, `token`; `OTPCode` → `otp`, `code`),
+ * and it is sensitive when a word (or two adjacent words joined, e.g. `api`+`key`) equals a listed term
+ * or its plural. So `accessToken` and `Set-Cookie` are redacted while `pinned` or `spinner` are not.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.maskPhoneForLog = exports.REDACTED = exports.DEFAULT_ALLOW_KEYS = exports.DEFAULT_REDACT_KEYS = void 0;
+exports.maskPhonesInText = maskPhonesInText;
+exports.createKeyClassifier = createKeyClassifier;
+exports.redactValue = redactValue;
+const phone_js_1 = require("../common/phone.js");
+/** Words whose values are always replaced with `[REDACTED]`. Apps add their own via `redactKeys`. */
+exports.DEFAULT_REDACT_KEYS = [
+    'password', 'pass', 'passphrase', 'token', 'secret', 'code', 'otp', 'authorization', 'cookie', 'credential',
+    'pin', 'apikey', 'jwt', 'signature',
+];
+/** Keys that are never redacted although they contain a listed word (error, status and reference codes). */
+exports.DEFAULT_ALLOW_KEYS = ['errorCode', 'statusCode', 'countryCode', 'currencyCode', 'postalCode', 'zipCode'];
+/** Words that mark a value as a phone number, masked to its last 4 digits. */
+const PHONE_KEY_WORDS = new Set(['phone', 'msisdn', 'mobile', 'tel']);
+/** 9–15 digits, optionally with a leading `+`, not part of a longer word or number. */
+const PHONE_IN_TEXT = /(?<![\w+]|\d\.)\+?\d{9,15}(?!\w|\.\d)/g;
+/** The marker that replaces a secret value. */
+exports.REDACTED = '[REDACTED]';
+const MAX_DEPTH = 8;
+/**
+ * Masks every digit except the last four; the same rule as `maskPhone` in common (one rule for logs and UI).
+ *
+ * @param value A phone number in any format.
+ * @returns e.g. `********5678`; values with fewer than 5 digits are fully masked.
+ * @example maskPhoneForLog('15551234567') // '*******4567'
+ */
+exports.maskPhoneForLog = phone_js_1.maskPhone;
+/**
+ * Masks phone-number-looking runs inside free text.
+ *
+ * @param text Any string (a log message or value).
+ * @returns The text with each 9–15 digit run masked to its last 4 digits.
+ * @example maskPhonesInText('OTP sent to 15551234567') // 'OTP sent to *******4567'
+ */
+function maskPhonesInText(text) {
+    return text.replace(PHONE_IN_TEXT, exports.maskPhoneForLog);
+}
+function keyWords(key) {
+    return key
+        .replace(/([a-z0-9])([A-Z])/g, '$1 $2')
+        .replace(/([A-Z])([A-Z][a-z])/g, '$1 $2')
+        .toLowerCase()
+        .split(/[^a-z0-9]+/)
+        .filter(Boolean);
+}
+/**
+ * Builds a key classifier from the default terms plus app-specific ones.
+ *
+ * @param extraKeys Extra words (matched like the defaults, case-insensitive).
+ * @param allowKeys Exact keys never treated as secret (defaults to {@link DEFAULT_ALLOW_KEYS}).
+ * @returns The classifier.
+ * @example createKeyClassifier(['nationalId']).isSecret('nationalId') // true
+ */
+function createKeyClassifier(extraKeys = [], allowKeys = exports.DEFAULT_ALLOW_KEYS) {
+    const terms = new Set([...exports.DEFAULT_REDACT_KEYS, ...extraKeys].map((k) => keyWords(k).join('')));
+    const allow = new Set(allowKeys);
+    const matches = (word) => terms.has(word) || (word.endsWith('s') && terms.has(word.slice(0, -1)));
+    return {
+        isSecret(key) {
+            if (allow.has(key))
+                return false;
+            if (key.endsWith('Enc') || key.endsWith('_enc'))
+                return true;
+            const words = keyWords(key);
+            if (matches(words.join('')))
+                return true;
+            return words.some((word, i) => matches(word) || (i > 0 && matches(`${words[i - 1]}${word}`)));
+        },
+        isPhone(key) {
+            return keyWords(key).some((word) => PHONE_KEY_WORDS.has(word));
+        },
+    };
+}
+/**
+ * Returns a copy of `value` with secrets replaced by `[REDACTED]` and phone numbers masked, at any depth
+ * (up to 8 levels; deeper values are dropped as `[TRUNCATED]`). Errors are kept as-is.
+ *
+ * @param value Log metadata (object, array or scalar).
+ * @param classifier From {@link createKeyClassifier}.
+ * @param depth Internal recursion depth; callers omit it.
+ * @returns The redacted copy; the input is not modified.
+ * @example redactValue({ user: { otp: '1234', phone: '15551234567' } }, createKeyClassifier())
+ */
+function redactValue(value, classifier, depth = 0) {
+    if (typeof value === 'string')
+        return maskPhonesInText(value);
+    if (value === null || typeof value !== 'object' || value instanceof Error || value instanceof Date)
+        return value;
+    if (depth >= MAX_DEPTH)
+        return '[TRUNCATED]';
+    if (Array.isArray(value))
+        return value.map((v) => redactValue(v, classifier, depth + 1));
+    const out = {};
+    for (const [key, v] of Object.entries(value)) {
+        if (classifier.isSecret(key))
+            out[key] = exports.REDACTED;
+        else if (classifier.isPhone(key) && (typeof v === 'string' || typeof v === 'number'))
+            out[key] = (0, exports.maskPhoneForLog)(String(v));
+        else
+            out[key] = redactValue(v, classifier, depth + 1);
+    }
+    return out;
+}
+//# sourceMappingURL=redact.js.map

package/dist/cjs/logging/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../../src/logging/redact.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAuCH,4CAEC;AAyBD,kDAgBC;AAYD,kCAYC;AAxGD,iDAA+C;AAE/C,qGAAqG;AACxF,QAAA,mBAAmB,GAAsB;IACpD,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,EAAE,QAAQ,EAAE,YAAY;IAC3G,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW;CACpC,CAAC;AAEF,4GAA4G;AAC/F,QAAA,kBAAkB,GAAsB,CAAC,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;AAEzI,8EAA8E;AAC9E,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;AAEtE,uFAAuF;AACvF,MAAM,aAAa,GAAG,wCAAwC,CAAC;AAE/D,+CAA+C;AAClC,QAAA,QAAQ,GAAG,YAAY,CAAC;AACrC,MAAM,SAAS,GAAG,CAAC,CAAC;AAEpB;;;;;;GAMG;AACU,QAAA,eAAe,GAA8B,oBAAS,CAAC;AAEpE;;;;;;GAMG;AACH,SAAgB,gBAAgB,CAAC,IAAY;IAC3C,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,uBAAe,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW;IAC3B,OAAO,GAAG;SACP,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC;SACtC,OAAO,CAAC,sBAAsB,EAAE,OAAO,CAAC;SACxC,WAAW,EAAE;SACb,KAAK,CAAC,YAAY,CAAC;SACnB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAQD;;;;;;;GAOG;AACH,SAAgB,mBAAmB,CAAC,YAA+B,EAAE,EAAE,YAA+B,0BAAkB;IACtH,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,2BAAmB,EAAE,GAAG,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC/F,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC;IACjC,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1G,OAAO;QACL,QAAQ,CAAC,GAAG;YACV,IAAI,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC;gBAAE,OAAO,KAAK,CAAC;YACjC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC7D,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YACzC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChG,CAAC;QACD,OAAO,CAAC,GAAG;YACT,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QACjE,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,WAAW,CAAC,KAAc,EAAE,UAAyB,EAAE,KAAK,GAAG,CAAC;IAC9E,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC;IAC9D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,YAAY,KAAK,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,KAAK,CAAC;IACjH,IAAI,KAAK,IAAI,SAAS;QAAE,OAAO,aAAa,CAAC;IAC7C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QACxE,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,gBAAQ,CAAC;aAC7C,IAAI,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,IAAA,uBAAe,EAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;;YACvH,GAAG,CAAC,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,GAAG,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/cjs/messaging/base-consumer.js

@@ -0,0 +1,36 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BaseConsumer = void 0;
+/**
+ * Base for a service's queue consumers (one class per queue in `src/consumers/`). The subclass declares
+ * its queue, bindings, payload schema, retry policy, dedupe and scope in the constructor and implements
+ * {@link BaseConsumer.handle}; `worker.ts` registers it. Validation, dedupe, retries, dead-lettering and
+ * context restore are done by {@link MessageConsumer}.
+ *
+ * @typeParam T Validated payload type.
+ * @typeParam TTx Dedupe transaction type (`DbExecutor` with `ProcessedEventsDeduper`).
+ * @example
+ * class ThingCreatedConsumer extends BaseConsumer<ThingCreated, DbExecutor> {
+ *   constructor(private readonly things: ThingService, dedupe: ProcessedEventsDeduper) {
+ *     super({ queue: 'thing-created', bindings: [{ exchange: 'events', routingKey: 'thing.created' }],
+ *       schema: thingCreatedSchema, dedupe, scopeFrom: (d) => ({ tenantId: d.tenantId }) });
+ *   }
+ *   protected handle({ data, tx, scope }: InboundMessage<ThingCreated, DbExecutor>) { return this.things.onCreated(scope!, data, tx!); }
+ * }
+ */
+class BaseConsumer {
+    definition;
+    constructor(definition) {
+        this.definition = definition;
+    }
+    /**
+     * Subscribes this consumer.
+     *
+     * @param consumer The service's {@link MessageConsumer}.
+     */
+    register(consumer) {
+        return consumer.subscribe({ ...this.definition, handler: (message) => this.handle(message) });
+    }
+}
+exports.BaseConsumer = BaseConsumer;
+//# sourceMappingURL=base-consumer.js.map

package/dist/cjs/messaging/base-consumer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-consumer.js","sourceRoot":"","sources":["../../../src/messaging/base-consumer.ts"],"names":[],"mappings":";;;AAKA;;;;;;;;;;;;;;;;GAgBG;AACH,MAAsB,YAAY;IACS;IAAzC,YAAyC,UAAsC;QAAtC,eAAU,GAAV,UAAU,CAA4B;IAAG,CAAC;IAKnF;;;;OAIG;IACH,QAAQ,CAAC,QAAyB;QAChC,OAAO,QAAQ,CAAC,SAAS,CAAS,EAAE,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACxG,CAAC;CACF;AAdD,oCAcC"}