@naylence/advanced-security 0.3.7-test.120 → 0.3.7-test.122

package/dist/node/index.mjs

@@ -18,14 +18,14 @@ import { X509Certificate } from '@peculiar/x509';
 import { getLogger, secureDigest as secureDigest$1, validateHostLogical, CERTIFICATE_MANAGER_FACTORY_BASE_TYPE, CertificateManagerFactory, SigningConfigClass as SigningConfigClass$1 } from '@naylence/runtime/node';
 
 // This file is auto-generated during build - do not edit manually
-// Generated from package.json version: 0.3.7-test.120
+// Generated from package.json version: 0.3.7-test.122
 /**
  * The package version, injected at build time.
  * @internal
  */
-const VERSION = '0.3.7-test.120';
+const VERSION = '0.3.7-test.122';
 
-const logger$g = getLogger("naylence.fame.security.cert.util");
+const logger$h = getLogger("naylence.fame.security.cert.util");
 const CACHE_LIMIT = 512;
 const OID_ED25519 = "1.3.101.112";
 const textEncoder = new TextEncoder();
@@ -39,7 +39,7 @@ function publicKeyFromX5c(x5c, options = {}) {
     const trustStorePem = normalizeTrustStoreOption(options.trustStorePem ?? null);
     const returnCertificate = options.returnCertificate ?? false;
     const { parsed, chainBytes } = parseCertificateChain(x5c);
-    logger$g.debug("public_key_from_x5c_called", {
+    logger$h.debug("public_key_from_x5c_called", {
         call_id: callId,
         x5c_count: parsed.length,
         enforce_name_constraints: enforceNameConstraints,
@@ -51,13 +51,13 @@ function publicKeyFromX5c(x5c, options = {}) {
         cacheKey = buildCacheKey(chainBytes, trustStorePem, enforceNameConstraints);
         const cached = getCachedPublicKey(cacheKey);
         if (cached) {
-            logger$g.debug("certificate_cache_hit", {
+            logger$h.debug("certificate_cache_hit", {
                 call_id: callId,
                 cache_key: cacheKey,
             });
             return cached;
         }
-        logger$g.debug("certificate_cache_miss", {
+        logger$h.debug("certificate_cache_miss", {
             call_id: callId,
             cache_key: cacheKey,
         });
@@ -228,13 +228,13 @@ function validateTrustAnchor(chain, trustStorePem) {
     if (trustedCerts.length === 0) {
         throw new Error("No valid certificates found in trust store");
     }
-    logger$g.debug("trust_anchor_validation_start", {
+    logger$h.debug("trust_anchor_validation_start", {
         chain_length: chain.length,
         trust_store_cert_count: trustedCerts.length,
     });
     const chainInfo = chain.map((cert, index) => `[${index}] ${cert.subjectName} (Serial: ${cert.serialNumber})`);
     const trustedInfo = trustedCerts.map((cert, index) => `[${index}] ${cert.subjectName} (Serial: ${cert.serialNumber})`);
-    logger$g.debug("certificate_chain_validation", {
+    logger$h.debug("certificate_chain_validation", {
         chain_certificates: chainInfo,
         trust_store_certificates: trustedInfo,
     });
@@ -244,7 +244,7 @@ function validateTrustAnchor(chain, trustStorePem) {
         const match = trustedCerts.find((trusted) => trusted.serialNumber === cert.serialNumber &&
             namesEqual(trusted.certificate.tbsCertificate.subject, cert.certificate.tbsCertificate.subject));
         if (match) {
-            logger$g.debug("certificate_chain_trust_validation_passed", {
+            logger$h.debug("certificate_chain_trust_validation_passed", {
                 matching_serial: match.serialNumber,
                 validation_strategy: `direct_trust_cert_${i}`,
             });
@@ -257,7 +257,7 @@ function validateTrustAnchor(chain, trustStorePem) {
         if (namesEqual(trusted.certificate.tbsCertificate.subject, leaf.certificate.tbsCertificate.issuer) &&
             trusted.serialNumber !== leaf.serialNumber) {
             verifyCertificateSignature(leaf.certificate, trusted.certificate);
-            logger$g.debug("certificate_chain_trust_validation_passed", {
+            logger$h.debug("certificate_chain_trust_validation_passed", {
                 matching_serial: trusted.serialNumber,
                 validation_strategy: "leaf_issuer_trust",
             });
@@ -271,7 +271,7 @@ function validateTrustAnchor(chain, trustStorePem) {
             if (namesEqual(trusted.certificate.tbsCertificate.subject, intermediate.certificate.tbsCertificate.issuer) &&
                 trusted.serialNumber !== intermediate.serialNumber) {
                 verifyCertificateSignature(intermediate.certificate, trusted.certificate);
-                logger$g.debug("certificate_chain_trust_validation_passed", {
+                logger$h.debug("certificate_chain_trust_validation_passed", {
                     matching_serial: trusted.serialNumber,
                     validation_strategy: `intermediate_issuer_trust_cert_${index}`,
                 });
@@ -279,7 +279,7 @@ function validateTrustAnchor(chain, trustStorePem) {
             }
         }
     }
-    logger$g.warning("certificate_chain_trust_validation_failed", {
+    logger$h.warning("certificate_chain_trust_validation_failed", {
         leaf_subject: leaf.subjectName,
         leaf_issuer: leaf.issuerName,
         leaf_serial: leaf.serialNumber,
@@ -301,7 +301,7 @@ function parseTrustStore(trustStorePem) {
         }
         catch (error) {
             const reason = error instanceof Error ? error.message : String(error);
-            logger$g.debug("trust_store_certificate_parse_failed", { reason });
+            logger$h.debug("trust_store_certificate_parse_failed", { reason });
         }
     }
     return parsed;
@@ -321,12 +321,12 @@ function validateChainContinuity(chain) {
     if (chain.length <= 1) {
         return;
     }
-    logger$g.debug("validating_chain_continuity", { chain_length: chain.length });
+    logger$h.debug("validating_chain_continuity", { chain_length: chain.length });
     for (let index = 0; index < chain.length - 1; index += 1) {
         const cert = chain[index];
         const issuer = chain[index + 1];
         if (!namesEqual(cert.certificate.tbsCertificate.issuer, issuer.certificate.tbsCertificate.subject)) {
-            logger$g.warning("certificate_chain_continuity_failed", {
+            logger$h.warning("certificate_chain_continuity_failed", {
                 cert_index: index,
                 cert_subject: cert.subjectName,
                 cert_issuer: cert.issuerName,
@@ -337,7 +337,7 @@ function validateChainContinuity(chain) {
         }
         try {
             verifyCertificateSignature(cert.certificate, issuer.certificate);
-            logger$g.debug("chain_continuity_verification_success", {
+            logger$h.debug("chain_continuity_verification_success", {
                 cert_index: index,
                 cert_serial: cert.serialNumber,
                 issuer_serial: issuer.serialNumber,
@@ -345,7 +345,7 @@ function validateChainContinuity(chain) {
         }
         catch (error) {
             const reason = error instanceof Error ? error.message : String(error);
-            logger$g.warning("certificate_chain_continuity_failed", {
+            logger$h.warning("certificate_chain_continuity_failed", {
                 cert_index: index,
                 cert_subject: cert.subjectName,
                 issuer_subject: issuer.subjectName,
@@ -357,7 +357,7 @@ function validateChainContinuity(chain) {
             throw new Error(`Certificate chain continuity broken: certificate at index ${index} was not signed by certificate at index ${index + 1}: ${reason}`);
         }
     }
-    logger$g.debug("chain_continuity_validation_passed", {
+    logger$h.debug("chain_continuity_validation_passed", {
         chain_length: chain.length,
     });
 }
@@ -491,7 +491,7 @@ function getCachedPublicKey(cacheKey) {
     }
     if (Date.now() > entry.expiresAt) {
         trustCache.delete(cacheKey);
-        logger$g.debug("certificate_cache_expired", { cache_key: cacheKey });
+        logger$h.debug("certificate_cache_expired", { cache_key: cacheKey });
         return null;
     }
     return entry.value.slice();
@@ -503,13 +503,13 @@ function setCachedPublicKey(cacheKey, value, notAfter) {
             break;
         }
         trustCache.delete(firstKey);
-        logger$g.debug("certificate_cache_evicted", { cache_key: firstKey });
+        logger$h.debug("certificate_cache_evicted", { cache_key: firstKey });
     }
     trustCache.set(cacheKey, {
         value: value.slice(),
         expiresAt: notAfter.getTime(),
     });
-    logger$g.debug("certificate_cache_stored", {
+    logger$h.debug("certificate_cache_stored", {
         cache_key: cacheKey,
         expires_at: notAfter.toISOString(),
         cache_size: trustCache.size,
@@ -689,7 +689,7 @@ const NODE_ID_OID = "1.3.6.1.4.1.58530.4";
  * Provides async HTTP client to request certificates from the CA signing service.
  */
 // Simple logger for now - TODO: integrate with runtime logging
-const logger$f = {
+const logger$g = {
     debug: (_event, _meta) => {
         // console.log(`[DEBUG] ${event}`, meta);
     },
@@ -1161,13 +1161,13 @@ class CAServiceClient {
                     const result = await response.json();
                     const certificatePem = result.certificate_pem;
                     const certificateChainPem = result.certificate_chain_pem || certificatePem;
-                    logger$f.debug("certificate_request_successful", {
+                    logger$g.debug("certificate_request_successful", {
                         requester_id: requesterId,
                         expires_at: result.expires_at,
                     });
                     // Extract and log certificate information with structured logging
                     const certInfo = extractCertificateInfo(certificatePem);
-                    logger$f.debug("certificate_details", {
+                    logger$g.debug("certificate_details", {
                         requester_id: requesterId,
                         certificate_type: "issued_certificate",
                         ...certInfo,
@@ -1186,7 +1186,7 @@ class CAServiceClient {
                                     // First cert in chain is usually the issued certificate
                                     if (certPemBlock.trim() !== certificatePem.trim()) {
                                         const chainCertInfo = extractCertificateInfo(certPemBlock);
-                                        logger$f.debug("certificate_chain_details", {
+                                        logger$g.debug("certificate_chain_details", {
                                             requester_id: requesterId,
                                             certificate_type: "certificate_chain",
                                             chain_index: i,
@@ -1197,7 +1197,7 @@ class CAServiceClient {
                                 else {
                                     // Subsequent certs are intermediate/root CAs
                                     const caCertInfo = extractCertificateInfo(certPemBlock);
-                                    logger$f.debug("certificate_chain_details", {
+                                    logger$g.debug("certificate_chain_details", {
                                         requester_id: requesterId,
                                         certificate_type: "ca_certificate",
                                         chain_index: i,
@@ -1225,7 +1225,7 @@ class CAServiceClient {
                         // Body read failed entirely
                         errorDetail = `HTTP ${response.status}`;
                     }
-                    logger$f.error("certificate_request_failed", {
+                    logger$g.error("certificate_request_failed", {
                         requester_id: requesterId,
                         status_code: response.status,
                         error: errorDetail,
@@ -1242,13 +1242,13 @@ class CAServiceClient {
                 throw error;
             }
             if (error instanceof Error && error.name === "AbortError") {
-                logger$f.error("certificate_request_timeout", {
+                logger$g.error("certificate_request_timeout", {
                     requester_id: requesterId,
                     timeout_seconds: this.timeoutSeconds,
                 });
                 throw new CertificateRequestError(`Certificate request timed out after ${this.timeoutSeconds} seconds`);
             }
-            logger$f.error("certificate_request_network_error", {
+            logger$g.error("certificate_request_network_error", {
                 requester_id: requesterId,
                 error: String(error),
             });
@@ -1257,7 +1257,7 @@ class CAServiceClient {
     }
 }
 
-const logger$e = getLogger$1("naylence.fame.security.encryption.sealed.x25519_encryption_manager");
+const logger$f = getLogger$1("naylence.fame.security.encryption.sealed.x25519_encryption_manager");
 class X25519EncryptionManager {
     constructor({ keyProvider, nodeLike = null, cryptoProvider = null, }) {
         this.pendingEnvelopes = new Map();
@@ -1274,7 +1274,7 @@ class X25519EncryptionManager {
         // KeyManagementHandler will queue the envelope and send KeyRequest.
         // X25519 should NOT queue here to avoid dual queueing.
         if (opts?.requestAddress) {
-            logger$e.debug("key_not_found_delegating_to_key_management", {
+            logger$f.debug("key_not_found_delegating_to_key_management", {
                 envelope_id: envelope.id,
                 request_address: String(opts.requestAddress),
             });
@@ -1290,7 +1290,7 @@ class X25519EncryptionManager {
             return await this.encryptWithKey(envelope, recipPub, recipKid);
         }
         catch (error) {
-            logger$e.error("x25519_encryption_failed", {
+            logger$f.error("x25519_encryption_failed", {
                 error: error instanceof Error ? error.message : String(error),
             });
             return EncryptionResult.skipped(envelope);
@@ -1328,20 +1328,20 @@ class X25519EncryptionManager {
             return envelope;
         }
         catch (error) {
-            logger$e.error("x25519_decryption_failed", {
+            logger$f.error("x25519_decryption_failed", {
                 error: error instanceof Error ? error.message : String(error),
             });
             return envelope;
         }
     }
     async notifyKeyAvailable(keyId) {
-        logger$e.debug("x25519_notify_key_available_called", {
+        logger$f.debug("x25519_notify_key_available_called", {
             key_id: keyId,
             pending_keys: Array.from(this.pendingEnvelopes.keys()),
         });
         const queued = this.pendingEnvelopes.get(keyId);
         if (!queued || queued.length === 0) {
-            logger$e.debug("no_queued_envelopes_for_key", {
+            logger$f.debug("no_queued_envelopes_for_key", {
                 key_id: keyId,
                 has_queue: this.pendingEnvelopes.has(keyId),
                 queue_length: queued?.length ?? 0,
@@ -1353,13 +1353,13 @@ class X25519EncryptionManager {
         this.keyRequestsInProgress.delete(keyId);
         const node = this.nodeLike;
         if (!node) {
-            logger$e.debug("discarding_queued_envelopes_no_node", {
+            logger$f.debug("discarding_queued_envelopes_no_node", {
                 key_id: keyId,
                 count: queued.length,
             });
             return;
         }
-        logger$e.debug("replaying_envelopes_for_key", {
+        logger$f.debug("replaying_envelopes_for_key", {
             key_id: keyId,
             count: queued.length,
         });
@@ -1368,7 +1368,7 @@ class X25519EncryptionManager {
                 await node.deliver(envelope);
             }
             catch (error) {
-                logger$e.error("failed_to_replay_envelope", {
+                logger$f.error("failed_to_replay_envelope", {
                     key_id: keyId,
                     envelope_id: envelope.id,
                     error: error instanceof Error ? error.message : String(error),
@@ -1469,7 +1469,7 @@ class X25519EncryptionManager {
                 ? this.extractPrivateKeyFromRecord(providerRecord)
                 : null;
             if (providerRecordKey) {
-                logger$e.debug("using_provider_key_record_private_key", {
+                logger$f.debug("using_provider_key_record_private_key", {
                     kid,
                     provider_key_id: providerKeyId,
                     mismatched_kid: kid && providerKeyId !== kid ? kid : null,
@@ -1479,7 +1479,7 @@ class X25519EncryptionManager {
         }
         if (!providerPem) {
             if (kid && providerKeyId && providerKeyId !== kid) {
-                logger$e.debug("crypto_provider_key_id_mismatch_no_private_key", {
+                logger$f.debug("crypto_provider_key_id_mismatch_no_private_key", {
                     kid,
                     provider_key_id: providerKeyId,
                 });
@@ -1491,13 +1491,13 @@ class X25519EncryptionManager {
             return null;
         }
         if (!kid || providerKeyId === kid) {
-            logger$e.debug("using_crypto_provider_private_key_fallback", {
+            logger$f.debug("using_crypto_provider_private_key_fallback", {
                 kid: kid ?? null,
                 provider_key_id: providerKeyId,
             });
         }
         else {
-            logger$e.warning("crypto_provider_key_id_mismatch_using_private_key", {
+            logger$f.warning("crypto_provider_key_id_mismatch_using_private_key", {
                 kid,
                 provider_key_id: providerKeyId,
                 key_record_present: Boolean(record),
@@ -1506,7 +1506,7 @@ class X25519EncryptionManager {
         return fallbackKey;
     }
     async queueEnvelopeForKey(envelope, opts, recipientKeyId) {
-        logger$e.debug("queueing_envelope_for_sealed_encryption", {
+        logger$f.debug("queueing_envelope_for_sealed_encryption", {
             envelope_id: envelope.id,
             recipient_key_id: recipientKeyId,
             request_address: opts?.requestAddress
@@ -1554,7 +1554,7 @@ class X25519EncryptionManager {
             await node.deliver(keyRequestEnvelope, context);
         }
         catch (error) {
-            logger$e.error("failed_to_request_recipient_key", {
+            logger$f.error("failed_to_request_recipient_key", {
                 recipient_key_id: recipientKeyId,
                 error: error instanceof Error ? error.message : String(error),
             });
@@ -1567,7 +1567,7 @@ class X25519EncryptionManager {
             return this.extractPublicKeyFromRecord(record);
         }
         catch (error) {
-            logger$e.debug("recipient_key_lookup_failed", {
+            logger$f.debug("recipient_key_lookup_failed", {
                 kid,
                 error: error instanceof Error ? error.message : String(error),
             });
@@ -1582,7 +1582,7 @@ class X25519EncryptionManager {
             return await this.keyProvider.getKey(kid);
         }
         catch (error) {
-            logger$e.debug("private_key_lookup_failed", {
+            logger$f.debug("private_key_lookup_failed", {
                 kid,
                 error: error instanceof Error ? error.message : String(error),
             });
@@ -1653,7 +1653,7 @@ class X25519EncryptionManager {
         const base64 = base64Lines.join("");
         const der = this.decodeBase64Flexible(base64);
         if (!der) {
-            logger$e.debug("pem_decode_failed", {
+            logger$f.debug("pem_decode_failed", {
                 key_type: keyType,
             });
             return null;
@@ -1886,7 +1886,7 @@ var index$1 = /*#__PURE__*/Object.freeze({
     X25519EncryptionManagerFactory: X25519EncryptionManagerFactory
 });
 
-const logger$d = getLogger$1("naylence.fame.security.encryption.channel.channel_encryption_manager");
+const logger$e = getLogger$1("naylence.fame.security.encryption.channel.channel_encryption_manager");
 const SUPPORTED_CHANNEL_ALGORITHMS = ["chacha20-poly1305-channel"];
 const CHANNEL_ENCRYPTION_ALGORITHM = "chacha20-poly1305-channel";
 const HANDSHAKE_ALGORITHM = "CHACHA20P1305";
@@ -2037,13 +2037,13 @@ class ChannelEncryptionManager {
         const destination = opts?.destination ?? envelope.to ?? null;
         const destinationStr = toDestinationString(destination);
         if (!destinationStr) {
-            logger$d.warning("no_destination_for_channel_encryption", {
+            logger$e.warning("no_destination_for_channel_encryption", {
                 envelope_id: envelope.id,
             });
             return EncryptionResult.skipped(envelope);
         }
         if (!this.secureChannelManager) {
-            logger$d.warning("no_secure_channel_manager_available", {
+            logger$e.warning("no_secure_channel_manager_available", {
                 envelope_id: envelope.id,
             });
             return EncryptionResult.skipped(envelope);
@@ -2054,7 +2054,7 @@ class ChannelEncryptionManager {
                 return this.encryptWithChannel(envelope, existingChannelId);
             }
             catch (error) {
-                logger$d.error("channel_encryption_failed", {
+                logger$e.error("channel_encryption_failed", {
                     error: error instanceof Error ? error.message : String(error),
                     channel_id: existingChannelId,
                 });
@@ -2081,35 +2081,35 @@ class ChannelEncryptionManager {
         }
         const channelId = encHeader.kid;
         if (!channelId) {
-            logger$d.error("missing_channel_id_in_encryption_header", {
+            logger$e.error("missing_channel_id_in_encryption_header", {
                 envelope_id: envelope.id,
             });
             return envelope;
         }
         const nonce = this.decodeNonceValue(encHeader.val ?? "");
         if (!nonce) {
-            logger$d.error("invalid_nonce_in_encryption_header", {
+            logger$e.error("invalid_nonce_in_encryption_header", {
                 envelope_id: envelope.id,
                 value_present: Boolean(encHeader.val),
             });
             return envelope;
         }
         if (!this.secureChannelManager) {
-            logger$d.warning("no_secure_channel_manager_for_decryption", {
+            logger$e.warning("no_secure_channel_manager_for_decryption", {
                 envelope_id: envelope.id,
             });
             return envelope;
         }
         const channelState = this.getChannelState(channelId);
         if (!channelState) {
-            logger$d.error("channel_not_available_for_decryption", {
+            logger$e.error("channel_not_available_for_decryption", {
                 channel_id: channelId,
             });
             return envelope;
         }
         const ciphertext = this.extractCiphertext(frame.payload);
         if (!ciphertext) {
-            logger$d.error("invalid_ciphertext_payload", { envelope_id: envelope.id });
+            logger$e.error("invalid_ciphertext_payload", { envelope_id: envelope.id });
             return envelope;
         }
         try {
@@ -2134,7 +2134,7 @@ class ChannelEncryptionManager {
             return envelope;
         }
         catch (error) {
-            logger$d.error("channel_decryption_failed", {
+            logger$e.error("channel_decryption_failed", {
                 channel_id: channelId,
                 error: error instanceof Error ? error.message : String(error),
             });
@@ -2142,24 +2142,24 @@ class ChannelEncryptionManager {
         }
     }
     async notifyChannelEstablished(channelId) {
-        logger$d.debug("channel_encryption_manager_notified", {
+        logger$e.debug("channel_encryption_manager_notified", {
             channel_id: channelId,
             manager_type: "channel",
         });
         if (!channelId.startsWith("auto-")) {
-            logger$d.warning("unexpected_channel_id_format", { channel_id: channelId });
+            logger$e.warning("unexpected_channel_id_format", { channel_id: channelId });
             return;
         }
         const destinationStr = this.extractDestinationFromChannelId(channelId);
         if (!destinationStr) {
-            logger$d.warning("cannot_parse_destination_from_channel_id", {
+            logger$e.warning("cannot_parse_destination_from_channel_id", {
                 channel_id: channelId,
             });
             return;
         }
         this.handshakeInProgress.delete(destinationStr);
         if (!this.pendingEnvelopes.has(destinationStr)) {
-            logger$d.debug("no_pending_queue_for_destination", {
+            logger$e.debug("no_pending_queue_for_destination", {
                 destination: destinationStr,
             });
             return;
@@ -2167,7 +2167,7 @@ class ChannelEncryptionManager {
         const queuedEnvelopes = this.pendingEnvelopes.get(destinationStr) ?? [];
         this.pendingEnvelopes.delete(destinationStr);
         if (!this.secureChannelManager) {
-            logger$d.error("no_secure_channel_manager_for_queue_drain", {
+            logger$e.error("no_secure_channel_manager_for_queue_drain", {
                 channel_id: channelId,
             });
             return;
@@ -2176,7 +2176,7 @@ class ChannelEncryptionManager {
             try {
                 const result = this.encryptWithChannel(envelope, channelId);
                 if (!result.envelope) {
-                    logger$d.warning("failed_to_encrypt_queued_envelope", {
+                    logger$e.warning("failed_to_encrypt_queued_envelope", {
                         envelope_id: envelope.id,
                         channel_id: channelId,
                     });
@@ -2186,7 +2186,7 @@ class ChannelEncryptionManager {
                 this.runAsyncTask(() => this.deliverEnvelope(encryptedEnvelope), `deliver-queued-${envelope.id}`);
             }
             catch (error) {
-                logger$d.error("failed_to_encrypt_queued_envelope", {
+                logger$e.error("failed_to_encrypt_queued_envelope", {
                     envelope_id: envelope.id,
                     error: error instanceof Error ? error.message : String(error),
                 });
@@ -2194,19 +2194,19 @@ class ChannelEncryptionManager {
         }
     }
     async notifyChannelFailed(channelId, reason = "handshake_failed") {
-        logger$d.debug("channel_encryption_manager_notified_failure", {
+        logger$e.debug("channel_encryption_manager_notified_failure", {
             channel_id: channelId,
             reason,
         });
         if (!channelId.startsWith("auto-")) {
-            logger$d.warning("unexpected_channel_id_format_on_failure", {
+            logger$e.warning("unexpected_channel_id_format_on_failure", {
                 channel_id: channelId,
             });
             return;
         }
         const destinationStr = this.extractDestinationFromChannelId(channelId);
         if (!destinationStr) {
-            logger$d.warning("cannot_parse_destination_from_channel_id_on_failure", {
+            logger$e.warning("cannot_parse_destination_from_channel_id_on_failure", {
                 channel_id: channelId,
             });
             return;
@@ -2216,14 +2216,14 @@ class ChannelEncryptionManager {
         const cachedChannelId = this.addrChannelMap.get(destinationStr);
         if (cachedChannelId === channelId) {
             this.addrChannelMap.delete(destinationStr);
-            logger$d.debug("cleared_channel_cache_for_failed_channel", {
+            logger$e.debug("cleared_channel_cache_for_failed_channel", {
                 destination: destinationStr,
                 channel_id: channelId,
             });
         }
         const queuedEnvelopes = this.pendingEnvelopes.get(destinationStr);
         if (!queuedEnvelopes || queuedEnvelopes.length === 0) {
-            logger$d.debug("no_pending_queue_for_failed_destination", {
+            logger$e.debug("no_pending_queue_for_failed_destination", {
                 destination: destinationStr,
             });
             return;
@@ -2242,7 +2242,7 @@ class ChannelEncryptionManager {
         const cached = this.addrChannelMap.get(destination);
         if (cached) {
             this.addrChannelMap.delete(destination);
-            logger$d.debug("cleared_channel_cache_for_destination", {
+            logger$e.debug("cleared_channel_cache_for_destination", {
                 destination,
                 cached_channel_id: cached,
             });
@@ -2260,14 +2260,14 @@ class ChannelEncryptionManager {
         }
         const cached = this.addrChannelMap.get(destination);
         if (cached && this.getChannelState(cached)) {
-            logger$d.debug("using_cached_channel", { destination, channel_id: cached });
+            logger$e.debug("using_cached_channel", { destination, channel_id: cached });
             return cached;
         }
         const channels = this.secureChannelManager.channels;
         for (const channelId of Object.keys(channels)) {
             if (channelId.startsWith(`auto-${destination}-`)) {
                 this.addrChannelMap.set(destination, channelId);
-                logger$d.debug("using_existing_channel", {
+                logger$e.debug("using_existing_channel", {
                     destination,
                     channel_id: channelId,
                 });
@@ -2280,12 +2280,12 @@ class ChannelEncryptionManager {
         const queue = this.pendingEnvelopes.get(destinationStr) ?? [];
         queue.push(envelope);
         this.pendingEnvelopes.set(destinationStr, queue);
-        logger$d.debug("queued_envelope_for_channel_handshake", {
+        logger$e.debug("queued_envelope_for_channel_handshake", {
             envelope_id: envelope.id,
             destination: destinationStr,
         });
         if (this.handshakeInProgress.has(destinationStr)) {
-            logger$d.debug("handshake_already_in_progress", {
+            logger$e.debug("handshake_already_in_progress", {
                 destination: destinationStr,
             });
             return;
@@ -2303,7 +2303,7 @@ class ChannelEncryptionManager {
     }
     async initiateChannelHandshakeAsync(destination, destinationStr, opts) {
         if (!this.secureChannelManager) {
-            logger$d.error("no_secure_channel_manager_for_async_handshake_initiation");
+            logger$e.error("no_secure_channel_manager_for_async_handshake_initiation");
             return;
         }
         const channelId = this.generateChannelId(destinationStr);
@@ -2311,19 +2311,19 @@ class ChannelEncryptionManager {
             const openFrame = this.secureChannelManager.generateOpenFrame(channelId, HANDSHAKE_ALGORITHM);
             const success = await this.sendSecureOpenFrameAsync(openFrame, destination);
             if (success) {
-                logger$d.debug("sent_secure_open_frame_async", {
+                logger$e.debug("sent_secure_open_frame_async", {
                     channel_id: channelId,
                     destination: destinationStr,
                 });
             }
             else {
-                logger$d.warning("failed_to_send_secure_open_frame_async", {
+                logger$e.warning("failed_to_send_secure_open_frame_async", {
                     channel_id: channelId,
                 });
             }
         }
         catch (error) {
-            logger$d.error("async_channel_handshake_initiation_failed", {
+            logger$e.error("async_channel_handshake_initiation_failed", {
                 destination: destinationStr,
                 error: error instanceof Error ? error.message : String(error),
             });
@@ -2332,22 +2332,22 @@ class ChannelEncryptionManager {
     async sendSecureOpenFrameAsync(openFrame, destination) {
         const node = this.nodeLike;
         if (!node) {
-            logger$d.error("no_node_available_for_sending_secure_open_async");
+            logger$e.error("no_node_available_for_sending_secure_open_async");
             return false;
         }
         const envelopeFactory = node.envelopeFactory;
         if (!envelopeFactory) {
-            logger$d.error("no_envelope_factory_available_for_secure_open_async");
+            logger$e.error("no_envelope_factory_available_for_secure_open_async");
             return false;
         }
         const replyTo = this.buildSystemReplyTo();
         if (!replyTo) {
-            logger$d.error("no_physical_path_available_for_reply_to_async");
+            logger$e.error("no_physical_path_available_for_reply_to_async");
             return false;
         }
         const toAddress = toFameAddress(destination);
         if (!toAddress) {
-            logger$d.error("invalid_destination_for_secure_open", {
+            logger$e.error("invalid_destination_for_secure_open", {
                 destination: String(destination),
             });
             return false;
@@ -2359,7 +2359,7 @@ class ChannelEncryptionManager {
             corrId: generateId(),
         });
         await this.deliverEnvelope(envelope);
-        logger$d.debug("delivered_secure_open_frame_async", {
+        logger$e.debug("delivered_secure_open_frame_async", {
             channel_id: openFrame.cid,
         });
         return true;
@@ -2367,7 +2367,7 @@ class ChannelEncryptionManager {
     async deliverEnvelope(envelope) {
         const node = this.nodeLike;
         if (!node) {
-            logger$d.error("no_node_available_for_delivery", {
+            logger$e.error("no_node_available_for_delivery", {
                 envelope_id: envelope.id,
             });
             return;
@@ -2377,19 +2377,19 @@ class ChannelEncryptionManager {
     }
     encryptWithChannel(envelope, channelId) {
         if (!this.secureChannelManager) {
-            logger$d.error("no_secure_channel_manager_for_encryption");
+            logger$e.error("no_secure_channel_manager_for_encryption");
             return EncryptionResult.skipped(envelope);
         }
         const frame = envelope.frame;
         if (!this.isDataFrame(frame)) {
-            logger$d.error("attempted_to_encrypt_non_dataframe", {
+            logger$e.error("attempted_to_encrypt_non_dataframe", {
                 frame_type: frame.type ?? typeof frame,
             });
             return EncryptionResult.skipped(envelope);
         }
         const channelState = this.getChannelState(channelId);
         if (!channelState) {
-            logger$d.error("channel_not_in_channels", { channel_id: channelId });
+            logger$e.error("channel_not_in_channels", { channel_id: channelId });
             return EncryptionResult.skipped(envelope);
         }
         const payloadBytes = this.serializePayload(frame.payload);
@@ -2448,7 +2448,7 @@ class ChannelEncryptionManager {
                 return decodeBase64$1(payload);
             }
             catch (error) {
-                logger$d.error("failed_to_decode_base64_ciphertext", {
+                logger$e.error("failed_to_decode_base64_ciphertext", {
                     error: error instanceof Error ? error.message : String(error),
                 });
                 return null;
@@ -2478,7 +2478,7 @@ class ChannelEncryptionManager {
         return parts.slice(1, -1).join("-");
     }
     async handleFailedEnvelope(envelope, destinationStr, channelId, reason) {
-        logger$d.warning("envelope_failed_due_to_channel_handshake_failure", {
+        logger$e.warning("envelope_failed_due_to_channel_handshake_failure", {
             envelope_id: envelope.id,
             destination: destinationStr,
             channel_id: channelId,
@@ -2486,14 +2486,14 @@ class ChannelEncryptionManager {
         });
         const frame = envelope.frame;
         if (!this.isDataFrame(frame)) {
-            logger$d.debug("skipping_nack_for_non_dataframe", {
+            logger$e.debug("skipping_nack_for_non_dataframe", {
                 envelope_id: envelope.id,
                 frame_type: frame.type ?? typeof frame,
             });
             return;
         }
         if (!envelope.replyTo) {
-            logger$d.debug("skipping_nack_no_reply_to", { envelope_id: envelope.id });
+            logger$e.debug("skipping_nack_no_reply_to", { envelope_id: envelope.id });
             return;
         }
         await this.sendDeliveryNack(envelope, `channel_handshake_failed: ${reason}`);
@@ -2501,17 +2501,17 @@ class ChannelEncryptionManager {
     async sendDeliveryNack(envelope, failureReason) {
         const node = this.nodeLike;
         if (!node) {
-            logger$d.error("no_node_available_for_sending_delivery_nack");
+            logger$e.error("no_node_available_for_sending_delivery_nack");
             return;
         }
         const envelopeFactory = node.envelopeFactory;
         if (!envelopeFactory) {
-            logger$d.error("no_envelope_factory_available_for_delivery_nack");
+            logger$e.error("no_envelope_factory_available_for_delivery_nack");
             return;
         }
         const replyTo = toFameAddress(envelope.replyTo ?? null);
         if (!replyTo) {
-            logger$d.error("invalid_reply_to_for_delivery_nack", {
+            logger$e.error("invalid_reply_to_for_delivery_nack", {
                 reply_to: envelope.replyTo,
             });
             return;
@@ -2528,7 +2528,7 @@ class ChannelEncryptionManager {
             corrId: envelope.corrId ?? generateId(),
         });
         await this.deliverEnvelope(nackEnvelope);
-        logger$d.debug("delivered_delivery_nack", {
+        logger$e.debug("delivered_delivery_nack", {
             original_envelope_id: envelope.id,
             nack_envelope_id: nackEnvelope.id,
         });
@@ -2566,7 +2566,7 @@ class ChannelEncryptionManager {
                 await task();
             }
             catch (error) {
-                logger$d.error("async_task_failed", {
+                logger$e.error("async_task_failed", {
                     task_name: name,
                     error: error instanceof Error ? error.message : String(error),
                 });
@@ -2620,7 +2620,7 @@ class ChannelEncryptionManager {
     }
 }
 
-const logger$c = getLogger$1("naylence.fame.security.encryption.channel.channel_encryption_manager_factory");
+const logger$d = getLogger$1("naylence.fame.security.encryption.channel.channel_encryption_manager_factory");
 const DEFAULT_SUPPORTED_ALGORITHMS = ["chacha20-poly1305-channel"];
 const FACTORY_META$c = {
     base: ENCRYPTION_MANAGER_FACTORY_BASE_TYPE,
@@ -2652,7 +2652,7 @@ class ChannelEncryptionManagerFactory extends EncryptionManagerFactory {
     async create(_config, ...factoryArgs) {
         const [dependencies] = factoryArgs;
         const resolvedDependencies = this.resolveDependencies(dependencies);
-        logger$c.debug("creating_channel_encryption_manager", {
+        logger$d.debug("creating_channel_encryption_manager", {
             has_secure_channel_manager: Boolean(resolvedDependencies.secureChannelManager),
             has_node_like: Boolean(resolvedDependencies.nodeLike),
             has_task_spawner: Boolean(resolvedDependencies.taskSpawner),
@@ -2714,7 +2714,7 @@ var index = /*#__PURE__*/Object.freeze({
     ChannelEncryptionManagerFactory: ChannelEncryptionManagerFactory
 });
 
-const logger$b = getLogger$1("naylence.fame.security.encryption.default_secure_channel_manager");
+const logger$c = getLogger$1("naylence.fame.security.encryption.default_secure_channel_manager");
 const DEFAULT_ALGORITHM = "CHACHA20P1305";
 const CHANNEL_KEY_LENGTH = 32;
 const NONCE_PREFIX_LENGTH = 4;
@@ -2761,7 +2761,7 @@ class DefaultSecureChannelManager {
         const privateKey = x25519.utils.randomSecretKey();
         const publicKey = x25519.scalarMultBase(privateKey);
         this.ephemeralKeys.set(channelId, privateKey);
-        logger$b.debug("generated_channel_open", { cid: channelId, algorithm });
+        logger$c.debug("generated_channel_open", { cid: channelId, algorithm });
         return {
             type: "SecureOpen",
             cid: channelId,
@@ -2774,7 +2774,7 @@ class DefaultSecureChannelManager {
         requireCryptoSupport();
         const algorithm = frame.alg || DEFAULT_ALGORITHM;
         if (!this.isSupportedAlgorithm(algorithm)) {
-            logger$b.warning("unsupported_channel_algorithm", {
+            logger$c.warning("unsupported_channel_algorithm", {
                 cid: frame.cid,
                 alg: algorithm,
             });
@@ -2792,7 +2792,7 @@ class DefaultSecureChannelManager {
             peerPublicKey = decodeBase64(frame.ephPub);
         }
         catch (error) {
-            logger$b.warning("invalid_peer_public_key", {
+            logger$c.warning("invalid_peer_public_key", {
                 cid: frame.cid,
                 error: error instanceof Error ? error.message : String(error),
             });
@@ -2814,7 +2814,7 @@ class DefaultSecureChannelManager {
             algorithm,
         });
         this.channelsMap.set(frame.cid, channelState);
-        logger$b.debug("channel_established", { cid: frame.cid, algorithm });
+        logger$c.debug("channel_established", { cid: frame.cid, algorithm });
         myPrivateKey.fill(0);
         sharedSecret.fill(0);
         return {
@@ -2828,7 +2828,7 @@ class DefaultSecureChannelManager {
     async handleAcceptFrame(frame) {
         requireCryptoSupport();
         if (frame.ok === false) {
-            logger$b.warning("channel_rejected", {
+            logger$c.warning("channel_rejected", {
                 cid: frame.cid,
                 error: frame.reason,
             });
@@ -2837,7 +2837,7 @@ class DefaultSecureChannelManager {
         }
         const privateKey = this.ephemeralKeys.get(frame.cid);
         if (!privateKey) {
-            logger$b.error("no_ephemeral_key", { cid: frame.cid });
+            logger$c.error("no_ephemeral_key", { cid: frame.cid });
             return false;
         }
         let peerPublicKey;
@@ -2845,7 +2845,7 @@ class DefaultSecureChannelManager {
             peerPublicKey = decodeBase64(frame.ephPub);
         }
         catch (error) {
-            logger$b.warning("invalid_accept_public_key", {
+            logger$c.warning("invalid_accept_public_key", {
                 cid: frame.cid,
                 error: error instanceof Error ? error.message : String(error),
             });
@@ -2860,17 +2860,17 @@ class DefaultSecureChannelManager {
             algorithm,
         });
         this.channelsMap.set(frame.cid, channelState);
-        logger$b.debug("channel_completed", { cid: frame.cid, algorithm });
+        logger$c.debug("channel_completed", { cid: frame.cid, algorithm });
         sharedSecret.fill(0);
         this.cleanupEphemeralKey(frame.cid);
         return true;
     }
     handleCloseFrame(frame) {
         if (this.channelsMap.delete(frame.cid)) {
-            logger$b.debug("channel_closed", { cid: frame.cid, reason: frame.reason });
+            logger$c.debug("channel_closed", { cid: frame.cid, reason: frame.reason });
         }
         else {
-            logger$b.warning("close_unknown_channel", { cid: frame.cid });
+            logger$c.warning("close_unknown_channel", { cid: frame.cid });
         }
         this.cleanupEphemeralKey(frame.cid);
     }
@@ -2897,7 +2897,7 @@ class DefaultSecureChannelManager {
     }
     closeChannel(channelId, reason = "User requested") {
         if (this.channelsMap.delete(channelId)) {
-            logger$b.debug("channel_closed_by_user", { cid: channelId, reason });
+            logger$c.debug("channel_closed_by_user", { cid: channelId, reason });
         }
         this.cleanupEphemeralKey(channelId);
         return {
@@ -2914,7 +2914,7 @@ class DefaultSecureChannelManager {
                 this.channelsMap.delete(channelId);
                 this.cleanupEphemeralKey(channelId);
                 removed += 1;
-                logger$b.debug("channel_expired_cleanup", { cid: channelId });
+                logger$c.debug("channel_expired_cleanup", { cid: channelId });
             }
         }
         return removed;
@@ -2943,7 +2943,7 @@ class DefaultSecureChannelManager {
             if (channelId.startsWith(prefix)) {
                 if (this.removeChannel(channelId)) {
                     removed += 1;
-                    logger$b.debug("removed_channel_for_destination", {
+                    logger$c.debug("removed_channel_for_destination", {
                         channel_id: channelId,
                         destination,
                     });
@@ -2951,7 +2951,7 @@ class DefaultSecureChannelManager {
             }
         }
         if (removed > 0) {
-            logger$b.info("cleanup_channels_for_destination", {
+            logger$c.info("cleanup_channels_for_destination", {
                 destination,
                 channels_removed: removed,
             });
@@ -3044,7 +3044,7 @@ var defaultSecureChannelManagerFactory = /*#__PURE__*/Object.freeze({
     default: DefaultSecureChannelManagerFactory
 });
 
-const logger$a = getLogger$1("naylence.fame.security.encryption.encryption_manager_registry");
+const logger$b = getLogger$1("naylence.fame.security.encryption.encryption_manager_registry");
 class EncryptionManagerFactoryRegistry {
     constructor(autoDiscover = true) {
         this.factories = [];
@@ -3066,7 +3066,7 @@ class EncryptionManagerFactoryRegistry {
             let registeredCount = 0;
             for (const [factoryName, info] of extensionInfos) {
                 if (factoryName === "CompositeEncryptionManager") {
-                    logger$a.debug("skipping_composite_factory_to_avoid_circular_dependency", {
+                    logger$b.debug("skipping_composite_factory_to_avoid_circular_dependency", {
                         factory_name: factoryName,
                     });
                     continue;
@@ -3076,7 +3076,7 @@ class EncryptionManagerFactoryRegistry {
                         ExtensionManager.getGlobalFactory(ENCRYPTION_MANAGER_FACTORY_BASE_TYPE, factoryName));
                     this.registerFactory(factoryInstance, { autoDiscovered: true });
                     registeredCount += 1;
-                    logger$a.debug("auto_discovered_factory", {
+                    logger$b.debug("auto_discovered_factory", {
                         factory_name: factoryName,
                         factory_class: factoryInstance.constructor.name,
                         algorithms: factoryInstance.getSupportedAlgorithms(),
@@ -3085,21 +3085,21 @@ class EncryptionManagerFactoryRegistry {
                     });
                 }
                 catch (error) {
-                    logger$a.warning("failed_to_auto_register_factory", {
+                    logger$b.warning("failed_to_auto_register_factory", {
                         factory_name: factoryName,
                         error: error instanceof Error ? error.message : String(error),
                     });
                 }
             }
             this.autoDiscovered = true;
-            logger$a.debug("completed_auto_discovery", {
+            logger$b.debug("completed_auto_discovery", {
                 registered_factories: registeredCount,
                 total_discovered: extensionInfos.size,
                 skipped_composite: true,
             });
         }
         catch (error) {
-            logger$a.warning("failed_auto_discovery_of_factories", {
+            logger$b.warning("failed_auto_discovery_of_factories", {
                 error: error instanceof Error ? error.message : String(error),
             });
         }
@@ -3117,7 +3117,7 @@ class EncryptionManagerFactoryRegistry {
             const existing = this.algorithmToFactory.get(algorithm);
             if (!existing || factory.getPriority() > existing.getPriority()) {
                 this.algorithmToFactory.set(algorithm, factory);
-                logger$a.debug("registered_algorithm_mapping", {
+                logger$b.debug("registered_algorithm_mapping", {
                     algorithm,
                     factory: factory.constructor.name,
                     priority: factory.getPriority(),
@@ -3129,7 +3129,7 @@ class EncryptionManagerFactoryRegistry {
         typeFactories.push(factory);
         typeFactories.sort((a, b) => b.getPriority() - a.getPriority());
         this.typeToFactories.set(encryptionType, typeFactories);
-        logger$a.debug("registered_encryption_manager_factory", {
+        logger$b.debug("registered_encryption_manager_factory", {
             factory: factory.constructor.name,
             encryption_type: encryptionType,
             algorithms: factory.getSupportedAlgorithms(),
@@ -3145,14 +3145,14 @@ class EncryptionManagerFactoryRegistry {
         this.ensureAutoDiscovery();
         for (const factory of this.factories) {
             if (factory.supportsOptions(opts ?? undefined)) {
-                logger$a.debug("found_factory_for_options", {
+                logger$b.debug("found_factory_for_options", {
                     factory: factory.constructor.name,
                     encryption_type: factory.getEncryptionType(),
                 });
                 return factory;
             }
         }
-        logger$a.debug("no_factory_found_for_options", { opts });
+        logger$b.debug("no_factory_found_for_options", { opts });
         return undefined;
     }
     getFactoriesByType(encryptionType) {
@@ -3205,7 +3205,7 @@ function getEncryptionManagerFactoryRegistry() {
     return globalRegistry;
 }
 
-const logger$9 = getLogger$1("naylence.fame.security.encryption.composite_encryption_manager");
+const logger$a = getLogger$1("naylence.fame.security.encryption.composite_encryption_manager");
 const DEFAULT_SEALED_ALGORITHMS = [
     "X25519",
     "ECDH-ES+A256GCM",
@@ -3244,7 +3244,7 @@ class CompositeEncryptionManager {
             return await manager.encryptEnvelope(envelope, opts);
         }
         catch (error) {
-            logger$9.error("composite_encrypt_failed", {
+            logger$a.error("composite_encrypt_failed", {
                 error: error instanceof Error ? error.message : String(error),
             });
             return EncryptionResult.skipped(envelope);
@@ -3263,7 +3263,7 @@ class CompositeEncryptionManager {
             return await manager.decryptEnvelope(envelope, opts);
         }
         catch (error) {
-            logger$9.error("composite_decrypt_failed", {
+            logger$a.error("composite_decrypt_failed", {
                 algorithm,
                 error: error instanceof Error ? error.message : String(error),
             });
@@ -3275,14 +3275,14 @@ class CompositeEncryptionManager {
         if (factories.length === 0) {
             return;
         }
-        logger$9.debug("composite_notify_channel_established", {
+        logger$a.debug("composite_notify_channel_established", {
             channel_id: channelId,
         });
         await this.notifyManagers(factories, async (manager, factoryKey) => {
             const channelAware = manager;
             if (typeof channelAware.notifyChannelEstablished === "function") {
                 await channelAware.notifyChannelEstablished(channelId);
-                logger$9.debug("composite_channel_established_notified", {
+                logger$a.debug("composite_channel_established_notified", {
                     factory: factoryKey,
                     channel_id: channelId,
                 });
@@ -3294,7 +3294,7 @@ class CompositeEncryptionManager {
         if (factories.length === 0) {
             return;
         }
-        logger$9.debug("composite_notify_channel_failed", {
+        logger$a.debug("composite_notify_channel_failed", {
             channel_id: channelId,
             reason,
         });
@@ -3302,7 +3302,7 @@ class CompositeEncryptionManager {
             const channelAware = manager;
             if (typeof channelAware.notifyChannelFailed === "function") {
                 await channelAware.notifyChannelFailed(channelId, reason);
-                logger$9.debug("composite_channel_failed_notified", {
+                logger$a.debug("composite_channel_failed_notified", {
                     factory: factoryKey,
                     channel_id: channelId,
                     reason,
@@ -3315,12 +3315,12 @@ class CompositeEncryptionManager {
         if (factories.length === 0) {
             return;
         }
-        logger$9.debug("composite_notify_key_available", { key_id: keyId });
+        logger$a.debug("composite_notify_key_available", { key_id: keyId });
         await this.notifyManagers(factories, async (manager, factoryKey) => {
             const sealedAware = manager;
             if (typeof sealedAware.notifyKeyAvailable === "function") {
                 await sealedAware.notifyKeyAvailable(keyId);
-                logger$9.debug("composite_key_available_notified", {
+                logger$a.debug("composite_key_available_notified", {
                     factory: factoryKey,
                     key_id: keyId,
                 });
@@ -3361,7 +3361,7 @@ class CompositeEncryptionManager {
     async getManagerForOptions(opts) {
         const factory = this.factoryRegistry.getFactoryForOptions(opts ?? undefined);
         if (!factory) {
-            logger$9.debug("composite_no_factory_for_options", { opts });
+            logger$a.debug("composite_no_factory_for_options", { opts });
             return null;
         }
         return await this.getOrCreateManager(factory, "options");
@@ -3369,7 +3369,7 @@ class CompositeEncryptionManager {
     async getManagerForAlgorithm(algorithm) {
         const factory = this.factoryRegistry.getFactoryForAlgorithm(algorithm);
         if (!factory) {
-            logger$9.debug("composite_no_factory_for_algorithm", { algorithm });
+            logger$a.debug("composite_no_factory_for_algorithm", { algorithm });
             return null;
         }
         return await this.getOrCreateManager(factory, algorithm);
@@ -3394,7 +3394,7 @@ class CompositeEncryptionManager {
             const manager = await factory.create(null, dependencies);
             this.managerInstances.set(key, manager);
             await this.applyNodeContext(manager, key);
-            logger$9.debug("composite_created_manager", {
+            logger$a.debug("composite_created_manager", {
                 factory: key,
                 context,
                 manager_type: manager.constructor.name,
@@ -3402,7 +3402,7 @@ class CompositeEncryptionManager {
             return manager;
         }
         catch (error) {
-            logger$9.error("composite_create_manager_failed", {
+            logger$a.error("composite_create_manager_failed", {
                 factory: key,
                 context,
                 error: error instanceof Error ? error.message : String(error),
@@ -3415,7 +3415,7 @@ class CompositeEncryptionManager {
             const factoryKey = this.resolveFactoryKey(factory);
             const manager = this.managerInstances.get(factoryKey);
             if (!manager) {
-                logger$9.debug("composite_skip_notification_no_manager", {
+                logger$a.debug("composite_skip_notification_no_manager", {
                     factory: factoryKey,
                 });
                 continue;
@@ -3424,7 +3424,7 @@ class CompositeEncryptionManager {
                 await callback(manager, factoryKey);
             }
             catch (error) {
-                logger$9.error("composite_notify_manager_failed", {
+                logger$a.error("composite_notify_manager_failed", {
                     factory: factoryKey,
                     error: error instanceof Error ? error.message : String(error),
                 });
@@ -3440,7 +3440,7 @@ class CompositeEncryptionManager {
                 await callback(manager);
             }
             catch (error) {
-                logger$9.error("composite_node_event_failed", {
+                logger$a.error("composite_node_event_failed", {
                     manager: manager.constructor.name,
                     error: error instanceof Error ? error.message : String(error),
                 });
@@ -3457,7 +3457,7 @@ class CompositeEncryptionManager {
             await manager.onNodeStarted?.(this.nodeLike);
         }
         catch (error) {
-            logger$9.error("composite_apply_node_context_failed", {
+            logger$a.error("composite_apply_node_context_failed", {
                 stage: "onNodeStarted",
                 factory: factoryKey,
                 error: error instanceof Error ? error.message : String(error),
@@ -3470,7 +3470,7 @@ class CompositeEncryptionManager {
             await manager.onNodeAttachToUpstream?.(this.nodeLike, this.lastAttachInfo);
         }
         catch (error) {
-            logger$9.error("composite_apply_node_context_failed", {
+            logger$a.error("composite_apply_node_context_failed", {
                 stage: "onNodeAttachToUpstream",
                 factory: factoryKey,
                 error: error instanceof Error ? error.message : String(error),
@@ -3493,7 +3493,7 @@ class CompositeEncryptionManager {
                 const channelAware = manager;
                 if (typeof channelAware.clearChannelCacheForDestination === "function") {
                     channelAware.clearChannelCacheForDestination(destination);
-                    logger$9.debug("composite_cleared_channel_cache", {
+                    logger$a.debug("composite_cleared_channel_cache", {
                         destination,
                         factory: factoryKey,
                     });
@@ -3513,7 +3513,7 @@ class CompositeEncryptionManager {
             "function") {
             const removed = this.secureChannelManager.removeChannelsForDestination(destination);
             if (removed > 0) {
-                logger$9.debug("composite_removed_channels", {
+                logger$a.debug("composite_removed_channels", {
                     destination,
                     count: removed,
                 });
@@ -3524,7 +3524,7 @@ class CompositeEncryptionManager {
     }
 }
 
-const logger$8 = getLogger$1("naylence.fame.security.encryption.composite_encryption_manager_factory");
+const logger$9 = getLogger$1("naylence.fame.security.encryption.composite_encryption_manager_factory");
 const DEFAULT_PRIORITY = 1000;
 const DEFAULT_ENCRYPTION_TYPE = "composite";
 const FACTORY_META$a = {
@@ -3562,7 +3562,7 @@ class CompositeEncryptionManagerFactory extends EncryptionManagerFactory {
         const supportedChannelAlgorithms = runtimeConfig?.supportedChannelAlgorithms ??
             this.supportedChannelAlgorithms ??
             undefined;
-        logger$8.debug("creating_composite_encryption_manager", {
+        logger$9.debug("creating_composite_encryption_manager", {
             has_secure_channel_manager: Boolean(resolved.secureChannelManager),
             has_key_provider: Boolean(resolved.keyProvider),
             has_crypto_provider: Boolean(resolved.cryptoProvider),
@@ -3935,7 +3935,7 @@ var eddsaEnvelopeVerifierFactory = /*#__PURE__*/Object.freeze({
     default: AdvancedEdDSAEnvelopeVerifierFactory
 });
 
-const logger$7 = getLogger$1("naylence.fame.security.keys.x5c_key_manager");
+const logger$8 = getLogger$1("naylence.fame.security.keys.x5c_key_manager");
 let x509ModulePromise$1 = null;
 async function loadX509Module$1() {
     if (!x509ModulePromise$1) {
@@ -3947,7 +3947,7 @@ async function loadX509Module$1() {
             return null;
         })
             .catch((error) => {
-            logger$7.warning("certificate_module_unavailable", {
+            logger$8.warning("certificate_module_unavailable", {
                 error: error instanceof Error ? error.message : String(error),
             });
             return null;
@@ -3978,16 +3978,16 @@ class X5CKeyManager extends TaskSpawner {
     async onNodeStarted(node) {
         await this.inner.onNodeStarted(node);
         this.startPurgeLoop();
-        logger$7.debug("x5c_key_manager_started", {
+        logger$8.debug("x5c_key_manager_started", {
             cert_purge_interval: this.certPurgeInterval,
         });
     }
     async onNodeStopped(node) {
-        logger$7.debug("x5c_key_manager_stopping");
+        logger$8.debug("x5c_key_manager_stopping");
         await this.shutdownTasks({ gracePeriod: 50, joinTimeout: 100 });
         this.purgeTask = null;
         await this.inner.onNodeStopped(node);
-        logger$7.debug("x5c_key_manager_stopped");
+        logger$8.debug("x5c_key_manager_stopped");
     }
     async getKey(kid) {
         return this.inner.getKey(kid);
@@ -4024,7 +4024,7 @@ class X5CKeyManager extends TaskSpawner {
             }
             catch (error) {
                 if (error instanceof JWKValidationError) {
-                    logger$7.warning("rejected_invalid_jwk_in_announce", {
+                    logger$8.warning("rejected_invalid_jwk_in_announce", {
                         kid: typeof key?.kid === "string" ? key.kid : "unknown",
                         from_system_id: systemId,
                         from_physical_path: physicalPath,
@@ -4037,7 +4037,7 @@ class X5CKeyManager extends TaskSpawner {
             }
         }
         if (validKeys.length === 0) {
-            logger$7.warning("no_valid_keys_in_announce", {
+            logger$8.warning("no_valid_keys_in_announce", {
                 from_system_id: systemId,
                 from_physical_path: physicalPath,
                 total_keys: keys.length,
@@ -4045,7 +4045,7 @@ class X5CKeyManager extends TaskSpawner {
             });
             return;
         }
-        logger$7.debug("adding_keys", {
+        logger$8.debug("adding_keys", {
             key_ids: validKeys.map((key) => typeof key?.kid === "string" ? key.kid : "unknown"),
             source_system_id: systemId,
             from_physical_path: physicalPath,
@@ -4056,7 +4056,7 @@ class X5CKeyManager extends TaskSpawner {
         });
         const hasEncryptionKeys = validKeys.some((key) => typeof key?.use === "string" && key.use === "enc");
         if (hasEncryptionKeys) {
-            logger$7.debug("checking_for_old_encryption_keys_to_remove", {
+            logger$8.debug("checking_for_old_encryption_keys_to_remove", {
                 physical_path: physicalPath,
                 origin,
                 new_enc_keys: validKeys
@@ -4084,7 +4084,7 @@ class X5CKeyManager extends TaskSpawner {
                     }
                 }
                 if (existingEncKeyIds.size > 0) {
-                    logger$7.debug("found_existing_encryption_keys_across_paths", {
+                    logger$8.debug("found_existing_encryption_keys_across_paths", {
                         physical_path: physicalPath,
                         paths_checked: pathsWithOldKeys,
                         existing_enc_key_ids: Array.from(existingEncKeyIds),
@@ -4095,7 +4095,7 @@ class X5CKeyManager extends TaskSpawner {
                         .filter((kid) => kid.length > 0));
                     const keysToRemove = Array.from(existingEncKeyIds).filter((kid) => !newEncKeyIds.has(kid));
                     if (keysToRemove.length > 0) {
-                        logger$7.info("removing_old_encryption_keys_for_key_rotation", {
+                        logger$8.info("removing_old_encryption_keys_for_key_rotation", {
                             physical_path: physicalPath,
                             paths_with_old_keys: pathsWithOldKeys,
                             old_key_ids: keysToRemove,
@@ -4104,7 +4104,7 @@ class X5CKeyManager extends TaskSpawner {
                         });
                         for (const kid of keysToRemove) {
                             await this.keyStore.removeKey(kid);
-                            logger$7.debug("removed_old_encryption_key_from_all_paths", {
+                            logger$8.debug("removed_old_encryption_key_from_all_paths", {
                                 kid,
                             });
                         }
@@ -4112,7 +4112,7 @@ class X5CKeyManager extends TaskSpawner {
                 }
             }
             catch (error) {
-                logger$7.warning("failed_to_remove_old_encryption_keys", {
+                logger$8.warning("failed_to_remove_old_encryption_keys", {
                     physical_path: physicalPath,
                     error: error instanceof Error ? error.message : String(error),
                     origin,
@@ -4146,10 +4146,10 @@ class X5CKeyManager extends TaskSpawner {
         return this.inner.getKeysForPath(physicalPath);
     }
     async purgeExpiredCertificates() {
-        logger$7.debug("certificate_purge_starting");
+        logger$8.debug("certificate_purge_starting");
         const module = await loadX509Module$1();
         if (!module) {
-            logger$7.warning("certificate_purge_skipped", {
+            logger$8.warning("certificate_purge_skipped", {
                 reason: "x509_module_unavailable",
             });
             return 0;
@@ -4172,7 +4172,7 @@ class X5CKeyManager extends TaskSpawner {
                     const cert = new module.X509Certificate(raw);
                     const expiration = cert.notAfter;
                     if (expiration && expiration.getTime() < now.getTime()) {
-                        logger$7.debug("expired_certificate_found", {
+                        logger$8.debug("expired_certificate_found", {
                             kid: typeof key.kid === "string" ? key.kid : "unknown",
                             physical_path: typeof key.physical_path === "string"
                                 ? key.physical_path
@@ -4191,7 +4191,7 @@ class X5CKeyManager extends TaskSpawner {
                     }
                 }
                 catch (error) {
-                    logger$7.warning("certificate_parsing_failed_during_purge", {
+                    logger$8.warning("certificate_parsing_failed_during_purge", {
                         kid: typeof key.kid === "string" ? key.kid : "unknown",
                         error: error instanceof Error ? error.message : String(error),
                         message: "Could not parse certificate for expiry check",
@@ -4205,20 +4205,20 @@ class X5CKeyManager extends TaskSpawner {
                 const removed = await this.keyStore.removeKey(keyInfo.kid);
                 if (removed) {
                     purgedCount += 1;
-                    logger$7.debug("expired_certificate_purged", {
+                    logger$8.debug("expired_certificate_purged", {
                         kid: keyInfo.kid,
                         physical_path: keyInfo.physicalPath ?? "unknown",
                     });
                 }
             }
             catch (error) {
-                logger$7.error("certificate_purge_failed", {
+                logger$8.error("certificate_purge_failed", {
                     kid: keyInfo.kid,
                     error: error instanceof Error ? error.message : String(error),
                 });
             }
         }
-        logger$7.debug("certificate_purge_completed", {
+        logger$8.debug("certificate_purge_completed", {
             purged_count: purgedCount,
         });
         return purgedCount;
@@ -4228,7 +4228,7 @@ class X5CKeyManager extends TaskSpawner {
             return;
         }
         this.purgeTask = this.spawn(async (signal) => {
-            logger$7.debug("certificate_purge_loop_started", {
+            logger$8.debug("certificate_purge_loop_started", {
                 interval_seconds: this.certPurgeInterval,
             });
             try {
@@ -4249,13 +4249,13 @@ class X5CKeyManager extends TaskSpawner {
                     try {
                         const purged = await this.purgeExpiredCertificates();
                         if (purged > 0) {
-                            logger$7.debug("certificate_purge_cycle_completed", {
+                            logger$8.debug("certificate_purge_cycle_completed", {
                                 purged_count: purged,
                             });
                         }
                     }
                     catch (error) {
-                        logger$7.error("certificate_purge_cycle_failed", {
+                        logger$8.error("certificate_purge_cycle_failed", {
                             error: error instanceof Error ? error.message : String(error),
                         });
                     }
@@ -4263,16 +4263,16 @@ class X5CKeyManager extends TaskSpawner {
             }
             catch (error) {
                 if (signal?.aborted) {
-                    logger$7.debug("certificate_purge_loop_cancelled");
+                    logger$8.debug("certificate_purge_loop_cancelled");
                 }
                 else {
-                    logger$7.error("certificate_purge_loop_failed", {
+                    logger$8.error("certificate_purge_loop_failed", {
                         error: error instanceof Error ? error.message : String(error),
                     });
                 }
             }
             finally {
-                logger$7.debug("certificate_purge_loop_stopped");
+                logger$8.debug("certificate_purge_loop_stopped");
             }
         }, { name: "cert-purge" });
     }
@@ -4289,7 +4289,7 @@ function validateJwkX5cCertificateWrapper(options) {
         });
     }
     catch (error) {
-        logger$7.warning("rejected_key_due_to_certificate_validation_failure", {
+        logger$8.warning("rejected_key_due_to_certificate_validation_failure", {
             kid: typeof jwk.kid === "string" ? jwk.kid : "unknown",
             from_system_id: systemId,
             from_physical_path: physicalPath,
@@ -4306,7 +4306,7 @@ function validateJwkX5cCertificateWrapper(options) {
     if (result.isValid) {
         return { accepted: true, skip: false };
     }
-    logger$7.warning("rejected_key_due_to_certificate_validation_failure", {
+    logger$8.warning("rejected_key_due_to_certificate_validation_failure", {
         kid: typeof jwk.kid === "string" ? jwk.kid : "unknown",
         from_system_id: systemId,
         from_physical_path: physicalPath,
@@ -4331,7 +4331,7 @@ function resolveTrustStorePath() {
         return process.env.FAME_CA_CERT_FILE ?? null;
     }
     catch (error) {
-        logger$7.debug("trust_store_resolution_failed", {
+        logger$8.debug("trust_store_resolution_failed", {
             error: error instanceof Error ? error.message : String(error),
         });
         return null;
@@ -4539,7 +4539,7 @@ function utf8Decode(data) {
     return decodeURIComponent(escape(str));
 }
 
-const logger$6 = getLogger$1("naylence.fame.stickiness.aft_signer");
+const logger$7 = getLogger$1("naylence.fame.stickiness.aft_signer");
 class AbstractAFTSigner {
     constructor(kid, maxTtlSec = 7200) {
         this.kid = kid;
@@ -4631,7 +4631,7 @@ class SignedAFTSigner extends AbstractAFTSigner {
             return token;
         }
         catch (error) {
-            logger$6.error("aft_signing_failed", {
+            logger$7.error("aft_signing_failed", {
                 kid: this.kid,
                 algorithm: this.algorithm,
                 error: error instanceof Error ? error.message : String(error),
@@ -4643,7 +4643,7 @@ class SignedAFTSigner extends AbstractAFTSigner {
         if (!this.cryptoKeyPromise) {
             this.cryptoKeyPromise = importPKCS8(this.privateKeyPem, this.algorithm).catch((error) => {
                 this.cryptoKeyPromise = null;
-                logger$6.error("aft_private_key_import_failed", {
+                logger$7.error("aft_private_key_import_failed", {
                     kid: this.kid,
                     algorithm: this.algorithm,
                     error: error instanceof Error ? error.message : String(error),
@@ -4681,7 +4681,7 @@ function createAftSigner(options) {
     }
 }
 
-const logger$5 = getLogger$1("naylence.fame.stickiness.aft_helper");
+const logger$6 = getLogger$1("naylence.fame.stickiness.aft_helper");
 class AFTHelper {
     constructor(options) {
         this.signer = options.signer;
@@ -4695,7 +4695,7 @@ class AFTHelper {
         let clientSid;
         if (context?.stickySid) {
             clientSid = context.stickySid;
-            logger$5.debug("client_sticky_sid_extracted", { client_sid: clientSid });
+            logger$6.debug("client_sticky_sid_extracted", { client_sid: clientSid });
         }
         const signOptions = {
             sid: this.nodeSid,
@@ -4717,7 +4717,7 @@ class AFTHelper {
                 envelope.meta.set = setMeta;
             }
             setMeta.aft = aftToken;
-            logger$5.debug("aft_instruction_added", {
+            logger$6.debug("aft_instruction_added", {
                 envelope_id: envelope.id,
                 ttl_sec: ttlSec,
                 scope,
@@ -4726,7 +4726,7 @@ class AFTHelper {
             return true;
         }
         catch (error) {
-            logger$5.error("aft_generation_failed", {
+            logger$6.error("aft_generation_failed", {
                 envelope_id: envelope.id,
                 error: error instanceof Error ? error.message : String(error),
             });
@@ -4750,7 +4750,7 @@ function createAftHelper(options) {
 }
 const DEFAULT_STICKINESS_SECURITY_LEVEL = StickinessMode.SIGNED_OPTIONAL;
 
-const logger$4 = getLogger$1("naylence.fame.stickiness.aft_verifier");
+const logger$5 = getLogger$1("naylence.fame.stickiness.aft_verifier");
 function decodeToken(token) {
     const parts = token.split(".");
     if (parts.length !== 3) {
@@ -4783,7 +4783,7 @@ function decodeToken(token) {
         return { header, claims };
     }
     catch (error) {
-        logger$4.debug("aft_decoding_failed", {
+        logger$5.debug("aft_decoding_failed", {
             error: error instanceof Error ? error.message : String(error),
         });
         return null;
@@ -4845,7 +4845,7 @@ class BaseAFTVerifier {
             signatureValid = await this.verifySignature(token, header, claims);
         }
         catch (error) {
-            logger$4.debug("aft_signature_verification_failed", {
+            logger$5.debug("aft_signature_verification_failed", {
                 kid: header.kid,
                 algorithm: header.alg,
                 error: error instanceof Error ? error.message : String(error),
@@ -4891,7 +4891,7 @@ class StrictAFTVerifier extends BaseAFTVerifier {
             keyRecord = await this.keyProvider.getKey(header.kid);
         }
         catch (error) {
-            logger$4.debug("aft_public_key_missing", {
+            logger$5.debug("aft_public_key_missing", {
                 kid: header.kid,
                 error: error instanceof Error ? error.message : String(error),
             });
@@ -4906,7 +4906,7 @@ class StrictAFTVerifier extends BaseAFTVerifier {
             return protectedHeader.alg === header.alg;
         }
         catch (error) {
-            logger$4.debug("aft_jws_verification_failed", {
+            logger$5.debug("aft_jws_verification_failed", {
                 kid: header.kid,
                 algorithm: header.alg,
                 error: error instanceof Error ? error.message : String(error),
@@ -4935,7 +4935,7 @@ class SignedOptionalAFTVerifier extends BaseAFTVerifier {
             keyRecord = await this.keyProvider.getKey(header.kid);
         }
         catch (error) {
-            logger$4.debug("aft_public_key_missing", {
+            logger$5.debug("aft_public_key_missing", {
                 kid: header.kid,
                 error: error instanceof Error ? error.message : String(error),
             });
@@ -4950,7 +4950,7 @@ class SignedOptionalAFTVerifier extends BaseAFTVerifier {
             return protectedHeader.alg === header.alg;
         }
         catch (error) {
-            logger$4.debug("aft_jws_verification_failed", {
+            logger$5.debug("aft_jws_verification_failed", {
                 kid: header.kid,
                 algorithm: header.alg,
                 error: error instanceof Error ? error.message : String(error),
@@ -4985,7 +4985,7 @@ async function resolveVerificationKey(keyRecord, algorithm) {
             return key;
         }
         catch (error) {
-            logger$4.debug("aft_jwk_import_failed", {
+            logger$5.debug("aft_jwk_import_failed", {
                 kid: keyRecord.kid,
                 algorithm,
                 error: error instanceof Error ? error.message : String(error),
@@ -5006,14 +5006,14 @@ async function resolveVerificationKey(keyRecord, algorithm) {
             return key;
         }
         catch (error) {
-            logger$4.debug("aft_spki_import_failed", {
+            logger$5.debug("aft_spki_import_failed", {
                 kid: keyRecord.kid,
                 algorithm,
                 error: error instanceof Error ? error.message : String(error),
             });
         }
     }
-    logger$4.debug("aft_verification_key_unavailable", {
+    logger$5.debug("aft_verification_key_unavailable", {
         kid: keyRecord.kid,
         algorithm,
     });
@@ -5036,7 +5036,7 @@ function createAftVerifier(options) {
     }
 }
 
-const logger$3 = getLogger$1("naylence.fame.stickiness.aft_load_balancer_stickiness_manager");
+const logger$4 = getLogger$1("naylence.fame.stickiness.aft_load_balancer_stickiness_manager");
 class AFTAssociation {
     constructor(params) {
         this.replicaId = params.replicaId;
@@ -5075,7 +5075,7 @@ class AFTLoadBalancerStickinessManager extends BaseNodeEventListener {
         };
         this.config = config;
         this.verifier = verifier;
-        logger$3.debug("stickiness_manager_initialized", {
+        logger$4.debug("stickiness_manager_initialized", {
             enabled: this.config.enabled,
             security_level: this.config.securityLevel,
             verifier_type: verifier.constructor.name,
@@ -5093,14 +5093,14 @@ class AFTLoadBalancerStickinessManager extends BaseNodeEventListener {
     negotiate(stickiness) {
         if (!stickiness) {
             if (this.config.enabled) {
-                logger$3.debug("stickiness_negotiated_no_offer_attr_fallback");
+                logger$4.debug("stickiness_negotiated_no_offer_attr_fallback");
                 return { enabled: true, mode: "attr", version: 1 };
             }
             return null;
         }
         const version = stickiness.version ?? 1;
         if (!this.config.enabled) {
-            logger$3.debug("stickiness_negotiation_disabled_by_config");
+            logger$4.debug("stickiness_negotiation_disabled_by_config");
             return { enabled: false, version };
         }
         const childModes = new Set();
@@ -5121,32 +5121,32 @@ class AFTLoadBalancerStickinessManager extends BaseNodeEventListener {
                 ttlSec: ttl,
                 version,
             };
-            logger$3.debug("stickiness_negotiated", { mode: policy.mode, ttl });
+            logger$4.debug("stickiness_negotiated", { mode: policy.mode, ttl });
             return policy;
         }
         if (childModes.has("attr")) {
             const policy = { enabled: true, mode: "attr", version };
-            logger$3.debug("stickiness_negotiated", { mode: policy.mode });
+            logger$4.debug("stickiness_negotiated", { mode: policy.mode });
             return policy;
         }
-        logger$3.debug("stickiness_negotiation_no_common_mode");
+        logger$4.debug("stickiness_negotiation_no_common_mode");
         return { enabled: false, version };
     }
     async handleOutboundEnvelope(envelope, replicaId) {
         if (!this.config.enabled) {
-            logger$3.debug("stickiness_disabled", { envelope_id: envelope.id });
+            logger$4.debug("stickiness_disabled", { envelope_id: envelope.id });
             return null;
         }
         const aftToken = extractAftInstruction(envelope);
         if (!aftToken) {
-            logger$3.debug("no_aft_instruction", {
+            logger$4.debug("no_aft_instruction", {
                 envelope_id: envelope.id,
                 has_meta: Boolean(envelope.meta),
             });
             return null;
         }
         if (typeof aftToken !== "string") {
-            logger$3.warning("invalid_aft_instruction", {
+            logger$4.warning("invalid_aft_instruction", {
                 envelope_id: envelope.id,
                 replica_id: replicaId,
                 reason: "set.aft value is not a string",
@@ -5156,7 +5156,7 @@ class AFTLoadBalancerStickinessManager extends BaseNodeEventListener {
         const verification = await this.verifier.verify(aftToken, envelope.sid ?? undefined);
         if (!verification.valid) {
             this.metrics.verifyFailures += 1;
-            logger$3.warning("aft_verification_failed", {
+            logger$4.warning("aft_verification_failed", {
                 envelope_id: envelope.id,
                 replica_id: replicaId,
                 error: verification.error,
@@ -5174,14 +5174,14 @@ class AFTLoadBalancerStickinessManager extends BaseNodeEventListener {
         });
         if (verification.clientSid) {
             this.sidCache.set(verification.clientSid, replicaId);
-            logger$3.debug("sid_cache_updated", {
+            logger$4.debug("sid_cache_updated", {
                 envelope_id: envelope.id,
                 client_sid: verification.clientSid,
                 replica_id: replicaId,
             });
         }
         this.metrics.associationsCreated += 1;
-        logger$3.debug("aft_association_created", {
+        logger$4.debug("aft_association_created", {
             envelope_id: envelope.id,
             replica_id: replicaId,
             sid: verification.sid,
@@ -5193,14 +5193,14 @@ class AFTLoadBalancerStickinessManager extends BaseNodeEventListener {
     }
     getStickyReplicaSegment(envelope, segments) {
         if (!this.config.enabled) {
-            logger$3.debug("stickiness_disabled", { envelope_id: envelope.id });
+            logger$4.debug("stickiness_disabled", { envelope_id: envelope.id });
             return null;
         }
         if (envelope.aft) {
             const replicaId = this.routeByAft(envelope.aft, envelope);
             if (replicaId) {
                 this.metrics.cacheHits += 1;
-                logger$3.debug("aft_routed_envelope", {
+                logger$4.debug("aft_routed_envelope", {
                     envelope_id: envelope.id,
                     replica_id: replicaId,
                     routing_type: "aft_direct",
@@ -5213,7 +5213,7 @@ class AFTLoadBalancerStickinessManager extends BaseNodeEventListener {
             if (cachedReplica) {
                 if (this.config.securityLevel === StickinessMode.SID_ONLY) {
                     this.metrics.cacheHits += 1;
-                    logger$3.debug("sid_cache_routed_envelope", {
+                    logger$4.debug("sid_cache_routed_envelope", {
                         envelope_id: envelope.id,
                         replica_id: cachedReplica,
                         sid: envelope.sid,
@@ -5226,7 +5226,7 @@ class AFTLoadBalancerStickinessManager extends BaseNodeEventListener {
                         !association.isExpired()) {
                         envelope.aft = token;
                         this.metrics.cacheHits += 1;
-                        logger$3.debug("sid_cache_routed_envelope", {
+                        logger$4.debug("sid_cache_routed_envelope", {
                             envelope_id: envelope.id,
                             replica_id: cachedReplica,
                             sid: envelope.sid,
@@ -5236,7 +5236,7 @@ class AFTLoadBalancerStickinessManager extends BaseNodeEventListener {
                     }
                 }
                 this.metrics.cacheHits += 1;
-                logger$3.debug("sid_cache_routed_envelope", {
+                logger$4.debug("sid_cache_routed_envelope", {
                     envelope_id: envelope.id,
                     replica_id: cachedReplica,
                     sid: envelope.sid,
@@ -5244,7 +5244,7 @@ class AFTLoadBalancerStickinessManager extends BaseNodeEventListener {
                 });
                 return cachedReplica;
             }
-            logger$3.debug("no_cached_replica_for_sid", {
+            logger$4.debug("no_cached_replica_for_sid", {
                 envelope_id: envelope.id,
                 sid: envelope.sid,
             });
@@ -5253,7 +5253,7 @@ class AFTLoadBalancerStickinessManager extends BaseNodeEventListener {
             const index = computeDeterministicIndex(envelope.sid, segments.length);
             const chosen = segments[index];
             this.metrics.cacheHits += 1;
-            logger$3.debug("sid_based_deterministic_choice", {
+            logger$4.debug("sid_based_deterministic_choice", {
                 envelope_id: envelope.id,
                 sid: envelope.sid,
                 chosen,
@@ -5262,7 +5262,7 @@ class AFTLoadBalancerStickinessManager extends BaseNodeEventListener {
             return chosen;
         }
         this.metrics.cacheMisses += 1;
-        logger$3.debug("no_stickiness_routing", {
+        logger$4.debug("no_stickiness_routing", {
             envelope_id: envelope.id,
             has_aft: Boolean(envelope.aft),
             has_sid: Boolean(envelope.sid),
@@ -5282,7 +5282,7 @@ class AFTLoadBalancerStickinessManager extends BaseNodeEventListener {
         }
         if (expiredTokens.length > 0) {
             this.metrics.associationsExpired += expiredTokens.length;
-            logger$3.debug("cleaned_expired_associations", {
+            logger$4.debug("cleaned_expired_associations", {
                 count: expiredTokens.length,
             });
         }
@@ -5298,7 +5298,7 @@ class AFTLoadBalancerStickinessManager extends BaseNodeEventListener {
             this.removeAssociation(token);
         }
         if (tokensToRemove.length > 0) {
-            logger$3.debug("removed_associations_for_departed_replica", {
+            logger$4.debug("removed_associations_for_departed_replica", {
                 replica_id: replicaId,
                 count: tokensToRemove.length,
             });
@@ -5306,7 +5306,7 @@ class AFTLoadBalancerStickinessManager extends BaseNodeEventListener {
     }
     handleReplicaLeft(replicaId) {
         this.replicaLeft(replicaId);
-        logger$3.debug("stickiness_replica_cleanup", { replica_id: replicaId });
+        logger$4.debug("stickiness_replica_cleanup", { replica_id: replicaId });
     }
     getMetrics() {
         return {
@@ -5339,7 +5339,7 @@ class AFTLoadBalancerStickinessManager extends BaseNodeEventListener {
         const misses = this.metrics.cacheMisses;
         const total = hits + misses;
         const hitRate = total > 0 ? Math.round((hits / total) * 10000) / 100 : 0;
-        logger$3.info("stickiness_metrics_report", {
+        logger$4.info("stickiness_metrics_report", {
             enabled: this.config.enabled,
             security_level: this.config.securityLevel,
             cache_hits: hits,
@@ -5353,7 +5353,7 @@ class AFTLoadBalancerStickinessManager extends BaseNodeEventListener {
         });
     }
     async onDeliver(_node, envelope, context) {
-        logger$3.debug("stickiness_manager_on_deliver", {
+        logger$4.debug("stickiness_manager_on_deliver", {
             envelope_id: envelope.id,
             origin_type: context?.originType ?? "unknown",
             from_system_id: context?.fromSystemId ?? null,
@@ -5361,7 +5361,7 @@ class AFTLoadBalancerStickinessManager extends BaseNodeEventListener {
         if (context?.originType === DeliveryOriginType$1.DOWNSTREAM) {
             const sourceRoute = context.fromSystemId;
             if (sourceRoute) {
-                logger$3.debug("processing_downstream_envelope", {
+                logger$4.debug("processing_downstream_envelope", {
                     envelope_id: envelope.id,
                     source_route: sourceRoute,
                 });
@@ -5369,7 +5369,7 @@ class AFTLoadBalancerStickinessManager extends BaseNodeEventListener {
                     envelope.sid &&
                     !this.sidCache.has(envelope.sid)) {
                     this.sidCache.set(envelope.sid, sourceRoute);
-                    logger$3.debug("sid_only_association_recorded", {
+                    logger$4.debug("sid_only_association_recorded", {
                         envelope_id: envelope.id,
                         sid: envelope.sid,
                         replica_id: sourceRoute,
@@ -5378,27 +5378,27 @@ class AFTLoadBalancerStickinessManager extends BaseNodeEventListener {
                 const hadInstruction = Boolean(extractAftInstruction(envelope));
                 const token = await this.handleOutboundEnvelope(envelope, sourceRoute);
                 if (hadInstruction) {
-                    logger$3.debug("processed_aft_setter_instruction", {
+                    logger$4.debug("processed_aft_setter_instruction", {
                         envelope_id: envelope.id,
                         source_route: sourceRoute,
                         client_echo: Boolean(token),
                     });
                 }
                 else {
-                    logger$3.debug("no_aft_setter_instruction", {
+                    logger$4.debug("no_aft_setter_instruction", {
                         envelope_id: envelope.id,
                         source_route: sourceRoute,
                     });
                 }
             }
             else {
-                logger$3.debug("downstream_envelope_without_source_route", {
+                logger$4.debug("downstream_envelope_without_source_route", {
                     envelope_id: envelope.id,
                 });
             }
         }
         else {
-            logger$3.debug("envelope_not_from_downstream", {
+            logger$4.debug("envelope_not_from_downstream", {
                 envelope_id: envelope.id,
             });
         }
@@ -5439,7 +5439,7 @@ class AFTLoadBalancerStickinessManager extends BaseNodeEventListener {
         }
         if (this.verifier.securityLevel === StickinessMode.STRICT &&
             association.isLowTrust()) {
-            logger$3.warning("rejecting_low_trust_association", {
+            logger$4.warning("rejecting_low_trust_association", {
                 envelope_id: envelope.id,
                 replica_id: association.replicaId,
                 reason: "strict mode rejects low-trust associations",
@@ -5546,7 +5546,7 @@ var aftLoadBalancerStickinessManagerFactory = /*#__PURE__*/Object.freeze({
     default: AFTLoadBalancerStickinessManagerFactory
 });
 
-const logger$2 = getLogger$1("naylence.fame.stickiness.aft_replica_stickiness_manager");
+const logger$3 = getLogger$1("naylence.fame.stickiness.aft_replica_stickiness_manager");
 function isStickinessRequired(context) {
     if (typeof context.stickinessRequired === "boolean") {
         return context.stickinessRequired;
@@ -5566,14 +5566,14 @@ class AFTReplicaStickinessManager extends BaseNodeEventListener {
         this.isInitialized = this.aftHelper !== null;
         this.negotiatedStickiness = null;
         if (this.aftHelper) {
-            logger$2.debug("aft_replica_stickiness_manager_initialized", {
+            logger$3.debug("aft_replica_stickiness_manager_initialized", {
                 helper_type: this.aftHelper.signer.constructor.name,
                 security_level: this.aftHelper.signer.securityLevel,
                 max_ttl_sec: this.aftHelper.maxTtlSec,
             });
         }
         else {
-            logger$2.debug("aft_replica_stickiness_manager_created", {
+            logger$3.debug("aft_replica_stickiness_manager_created", {
                 security_level: this.securityLevel,
                 max_ttl_sec: this.maxTtlSec,
             });
@@ -5584,7 +5584,7 @@ class AFTReplicaStickinessManager extends BaseNodeEventListener {
     }
     accept(stickiness) {
         this.negotiatedStickiness = stickiness ?? null;
-        logger$2.debug("replica_stickiness_policy_set", {
+        logger$3.debug("replica_stickiness_policy_set", {
             enabled: stickiness?.enabled ?? null,
             mode: stickiness?.mode ?? null,
             ttl: stickiness?.ttlSec ?? null,
@@ -5596,7 +5596,7 @@ class AFTReplicaStickinessManager extends BaseNodeEventListener {
         }
         const helper = this.aftHelper;
         if (!helper) {
-            logger$2.debug("aft_helper_not_ready_skip_injection", {
+            logger$3.debug("aft_helper_not_ready_skip_injection", {
                 envelope_id: envelope.id,
                 delivery_origin: context.originType ?? null,
                 reason: "not_initialized",
@@ -5612,7 +5612,7 @@ class AFTReplicaStickinessManager extends BaseNodeEventListener {
                     (negotiated.mode !== null &&
                         negotiated.mode !== undefined &&
                         negotiated.mode !== "aft")) {
-                    logger$2.debug("aft_injection_skipped_due_to_policy", {
+                    logger$3.debug("aft_injection_skipped_due_to_policy", {
                         envelope_id: envelope.id,
                         policy_mode: negotiated.mode ?? null,
                         policy_enabled: negotiated.enabled ?? null,
@@ -5620,7 +5620,7 @@ class AFTReplicaStickinessManager extends BaseNodeEventListener {
                     return envelope;
                 }
             }
-            logger$2.debug("applying_aft_for_upstream_stickiness_required", {
+            logger$3.debug("applying_aft_for_upstream_stickiness_required", {
                 envelope_id: envelope.id,
                 from_system_id: context.fromSystemId ?? null,
                 delivery_origin: context.originType ?? null,
@@ -5631,14 +5631,14 @@ class AFTReplicaStickinessManager extends BaseNodeEventListener {
                 context: stickinessContext,
             });
             if (success) {
-                logger$2.debug("aft_token_applied_via_context_flag_upstream", {
+                logger$3.debug("aft_token_applied_via_context_flag_upstream", {
                     envelope_id: envelope.id,
                     from_system_id: context.fromSystemId ?? null,
                     delivery_origin: context.originType ?? null,
                 });
             }
             else {
-                logger$2.debug("aft_token_not_applied_upstream", {
+                logger$3.debug("aft_token_not_applied_upstream", {
                     envelope_id: envelope.id,
                     delivery_origin: context.originType ?? null,
                     reason: "helper_returned_false",
@@ -5654,19 +5654,19 @@ class AFTReplicaStickinessManager extends BaseNodeEventListener {
         }
         if (this.aftHelper && node.sid) {
             this.updateNodeSid(node.sid);
-            logger$2.debug("aft_replica_stickiness_manager_sid_updated", {
+            logger$3.debug("aft_replica_stickiness_manager_sid_updated", {
                 node_id: node.id ?? "unknown",
                 node_sid: node.sid,
                 security_level: this.aftHelper.signer.securityLevel,
             });
         }
         else if (!node.sid) {
-            logger$2.warning("aft_replica_stickiness_manager_no_sid_available", {
+            logger$3.warning("aft_replica_stickiness_manager_no_sid_available", {
                 node_id: node.id ?? "unknown",
             });
         }
         else {
-            logger$2.error("aft_replica_stickiness_manager_node_missing_sid", {
+            logger$3.error("aft_replica_stickiness_manager_node_missing_sid", {
                 node_type: node.constructor?.name ?? typeof node,
             });
         }
@@ -5674,7 +5674,7 @@ class AFTReplicaStickinessManager extends BaseNodeEventListener {
     updateNodeSid(nodeSid) {
         if (this.aftHelper) {
             this.aftHelper.nodeSid = nodeSid;
-            logger$2.debug("aft_replica_stickiness_manager_sid_updated", {
+            logger$3.debug("aft_replica_stickiness_manager_sid_updated", {
                 new_sid: nodeSid,
             });
         }
@@ -5682,14 +5682,14 @@ class AFTReplicaStickinessManager extends BaseNodeEventListener {
     async initializeAftHelper(node) {
         const nodeSid = node.sid;
         if (!nodeSid) {
-            logger$2.error("aft_replica_stickiness_manager_cannot_initialize_no_sid", {
+            logger$3.error("aft_replica_stickiness_manager_cannot_initialize_no_sid", {
                 node_id: node.id ?? "unknown",
             });
             return;
         }
         const cryptoProvider = node.cryptoProvider ?? null;
         if (!cryptoProvider) {
-            logger$2.error("aft_replica_stickiness_manager_cannot_initialize_no_crypto_provider", {
+            logger$3.error("aft_replica_stickiness_manager_cannot_initialize_no_crypto_provider", {
                 node_id: node.id ?? "unknown",
             });
             return;
@@ -5702,7 +5702,7 @@ class AFTReplicaStickinessManager extends BaseNodeEventListener {
             ? cryptoProvider.signingPrivatePem
             : null;
         if (this.securityLevel === StickinessMode.STRICT && !privateKeyPem) {
-            logger$2.error("aft_replica_stickiness_manager_initialization_failed", {
+            logger$3.error("aft_replica_stickiness_manager_initialization_failed", {
                 node_id: node.id ?? "unknown",
                 error: "Missing signing private key for strict security level",
             });
@@ -5718,7 +5718,7 @@ class AFTReplicaStickinessManager extends BaseNodeEventListener {
             });
             this.aftHelper = helper;
             this.isInitialized = true;
-            logger$2.debug("aft_replica_stickiness_manager_initialized", {
+            logger$3.debug("aft_replica_stickiness_manager_initialized", {
                 node_id: node.id ?? "unknown",
                 node_sid: nodeSid,
                 key_id: keyId,
@@ -5726,7 +5726,7 @@ class AFTReplicaStickinessManager extends BaseNodeEventListener {
             });
         }
         catch (error) {
-            logger$2.error("aft_replica_stickiness_manager_initialization_failed", {
+            logger$3.error("aft_replica_stickiness_manager_initialization_failed", {
                 node_id: node.id ?? "unknown",
                 error: error instanceof Error ? error.message : String(error),
             });
@@ -5796,7 +5796,7 @@ var aftReplicaStickinessManagerFactory = /*#__PURE__*/Object.freeze({
     default: AFTReplicaStickinessManagerFactory
 });
 
-const logger$1 = getLogger$1("naylence.fame.welcome.advanced_welcome_service");
+const logger$2 = getLogger$1("naylence.fame.welcome.advanced_welcome_service");
 const ENV_VAR_SHOW_ENVELOPES = "FAME_SHOW_ENVELOPES";
 const DEFAULT_TTL_SEC = 3600;
 const showEnvelopes = typeof process !== "undefined" &&
@@ -5839,7 +5839,7 @@ class AdvancedWelcomeService {
             typeof options.ttlSec === "number" && Number.isFinite(options.ttlSec)
                 ? Math.max(0, options.ttlSec)
                 : DEFAULT_TTL_SEC;
-        logger$1.debug("initialized_advanced_welcome_service", {
+        logger$2.debug("initialized_advanced_welcome_service", {
             ca_service_url: this.caServiceUrl,
             ttl_sec: this.ttlSec,
         });
@@ -5859,7 +5859,7 @@ class AdvancedWelcomeService {
             // eslint-disable-next-line no-console
             console.log(`\n${formatTimestampForConsole()} - ${color("Received envelope 📨", AnsiColor.BLUE)}\n${prettyModel(normalizedHello)}`);
         }
-        logger$1.debug("starting_hello_frame_processing", {
+        logger$2.debug("starting_hello_frame_processing", {
             instanceId: normalizedHello.instanceId,
             systemId,
             logicals: normalizedHello.logicals,
@@ -5876,35 +5876,35 @@ class AdvancedWelcomeService {
                 fullMetadata.instance_id = normalizedHello.instanceId;
             }
         }
-        logger$1.debug("system_id_assignment_completed", {
+        logger$2.debug("system_id_assignment_completed", {
             systemId,
             wasAssigned,
         });
         if (normalizedHello.logicals?.length) {
-            logger$1.debug("validating_logicals_for_dns_compatibility", {
+            logger$2.debug("validating_logicals_for_dns_compatibility", {
                 logicals: normalizedHello.logicals,
             });
             const [pathsValid, pathError] = validateHostLogicals(normalizedHello.logicals);
             if (!pathsValid) {
-                logger$1.error("logical_validation_failed", {
+                logger$2.error("logical_validation_failed", {
                     error: pathError,
                     logicals: normalizedHello.logicals,
                 });
                 throw new Error(`Invalid logical format: ${pathError}`);
             }
-            logger$1.debug("logicals_validation_successful");
+            logger$2.debug("logicals_validation_successful");
         }
-        logger$1.debug("requesting_node_placement", { systemId });
+        logger$2.debug("requesting_node_placement", { systemId });
         const placementResult = await this.placementStrategy.place(normalizedHello);
         if (!placementResult.accept) {
-            logger$1.error("node_placement_rejected", {
+            logger$2.error("node_placement_rejected", {
                 systemId,
                 reason: placementResult.reason,
             });
             throw new Error(placementResult.reason || "Node not accepted");
         }
         const assignedPath = placementResult.assignedPath;
-        logger$1.debug("node_placement_accepted", {
+        logger$2.debug("node_placement_accepted", {
             systemId,
             assignedPath,
             targetPhysicalPath: placementResult.targetPhysicalPath ?? null,
@@ -5916,7 +5916,7 @@ class AdvancedWelcomeService {
         const acceptedLogicals = coercePlacementMetadataValue(placementResult.metadata, "acceptedLogicals", "accepted_logicals") ??
             normalizedHello.logicals ??
             null;
-        logger$1.debug("processing_placement_result_metadata", {
+        logger$2.debug("processing_placement_result_metadata", {
             acceptedCapabilities,
             acceptedLogicals,
             hasPlacementMetadata: placementResult.metadata !== undefined &&
@@ -5930,7 +5930,7 @@ class AdvancedWelcomeService {
             normalizedHello.instanceId ||
             generateId();
         if (placementResult.targetSystemId) {
-            logger$1.debug("issuing_node_attach_token", {
+            logger$2.debug("issuing_node_attach_token", {
                 systemId,
                 assignedPath,
             });
@@ -5942,10 +5942,10 @@ class AdvancedWelcomeService {
                 accepted_logicals: acceptedLogicals,
                 instance_id: metadataInstanceId,
             });
-            logger$1.debug("token_issued_successfully");
-            logger$1.debug("provisioning_transport", { systemId });
+            logger$2.debug("token_issued_successfully");
+            logger$2.debug("provisioning_transport", { systemId });
             const transportInfo = await this.transportProvisioner.provision(placementResult, normalizedHello, fullMetadata, nodeAttachToken);
-            logger$1.debug("transport_provisioned_successfully", {
+            logger$2.debug("transport_provisioned_successfully", {
                 systemId,
                 directiveType: transportInfo.connectionGrant &&
                     typeof transportInfo.connectionGrant === "object"
@@ -5989,7 +5989,7 @@ class AdvancedWelcomeService {
             metadata: Object.keys(fullMetadata).length > 0 ? fullMetadata : undefined,
             expiresAt: expiry.toISOString(),
         };
-        logger$1.debug("hello_frame_processing_completed_successfully", {
+        logger$2.debug("hello_frame_processing_completed_successfully", {
             systemId,
             assignedPath,
             acceptedLogicals,
@@ -7665,7 +7665,7 @@ function encodeBitString(signature) {
     return result.buffer;
 }
 
-const logger = getLogger$1("naylence.fame.security.cert.default_certificate_manager");
+const logger$1 = getLogger$1("naylence.fame.security.cert.default_certificate_manager");
 const CONNECTION_GRANTS_CAMEL = "connectionGrants";
 const CONNECTION_GRANTS_SNAKE = "connection_grants";
 class DefaultCertificateManager {
@@ -7694,7 +7694,7 @@ class DefaultCertificateManager {
         this.prepareProviderContext(node);
         const requiresCertificate = this.requiresCertificates();
         if (requiresCertificate) {
-            logger.debug("node_certificate_required_on_start", {
+            logger$1.debug("node_certificate_required_on_start", {
                 node_id: node.id,
                 physical_path: node.physicalPath,
                 has_parent: node.hasParent,
@@ -7708,7 +7708,7 @@ class DefaultCertificateManager {
             const welcomeFrame = this.pendingWelcomeFrame ?? fallbackWelcome;
             const success = await this.ensureCertificate(welcomeFrame, this.caServiceUrl ? { caServiceUrl: this.caServiceUrl } : undefined);
             if (!success) {
-                logger.warning("node_certificate_unavailable_on_start", {
+                logger$1.warning("node_certificate_unavailable_on_start", {
                     node_id: node.id,
                     physical_path: node.physicalPath,
                     message: "Certificate provisioning was requested but did not complete",
@@ -7722,7 +7722,7 @@ class DefaultCertificateManager {
     async onWelcome(welcomeFrame) {
         const requiresCertificate = this.requiresCertificates(welcomeFrame);
         if (!requiresCertificate) {
-            logger.debug("welcome_does_not_require_certificate", {
+            logger$1.debug("welcome_does_not_require_certificate", {
                 system_id: welcomeFrame.systemId ?? null,
             });
             this.pendingWelcomeFrame = null;
@@ -7733,14 +7733,14 @@ class DefaultCertificateManager {
             return;
         }
         if (!this.node) {
-            logger.debug("certificate_provisioning_deferred_until_node_start", {
+            logger$1.debug("certificate_provisioning_deferred_until_node_start", {
                 system_id: welcomeFrame.systemId ?? null,
                 assigned_path: welcomeFrame.assignedPath ?? null,
             });
             return;
         }
         const nodeId = welcomeFrame.systemId ?? "unknown";
-        logger.warning("certificate_provisioning_not_completed", {
+        logger$1.warning("certificate_provisioning_not_completed", {
             node_id: nodeId,
             assigned_path: welcomeFrame.assignedPath ?? null,
             message: "Continuing without a provisioned certificate (development mode)",
@@ -7756,13 +7756,13 @@ class DefaultCertificateManager {
         const cryptoProvider = this.resolveCryptoProvider();
         if (!cryptoProvider) {
             if (!this.node) {
-                logger.debug("crypto_provider_pending_node_start", {
+                logger$1.debug("crypto_provider_pending_node_start", {
                     system_id: welcomeFrame.systemId ?? null,
                     assigned_path: welcomeFrame.assignedPath ?? null,
                 });
             }
             else {
-                logger.error("crypto_provider_unavailable_for_certificate", {
+                logger$1.error("crypto_provider_unavailable_for_certificate", {
                     system_id: welcomeFrame.systemId ?? null,
                     assigned_path: welcomeFrame.assignedPath ?? null,
                 });
@@ -7781,7 +7781,7 @@ class DefaultCertificateManager {
         const connectionGrants = readFrameValue(welcomeFrame, CONNECTION_GRANTS_CAMEL, CONNECTION_GRANTS_SNAKE);
         const caSignGrant = this.getCaSignGrant(connectionGrants);
         if (!caSignGrant) {
-            logger.warning("welcome_frame_missing_ca_sign_grant", {
+            logger$1.warning("welcome_frame_missing_ca_sign_grant", {
                 system_id: nodeId,
                 grant_count: Array.isArray(connectionGrants)
                     ? connectionGrants.length
@@ -7792,7 +7792,7 @@ class DefaultCertificateManager {
         if (caSignGrant) {
             material = await this.requestCertificateFromCa(cryptoProvider, welcomeFrame, caSignGrant, options);
             if (!material) {
-                logger.warning("ca_certificate_request_failed_falling_back_to_env", {
+                logger$1.warning("ca_certificate_request_failed_falling_back_to_env", {
                     system_id: nodeId,
                     ca_service_url: options?.caServiceUrl ?? this.caServiceUrl ?? caSignGrant.url,
                 });
@@ -7802,13 +7802,13 @@ class DefaultCertificateManager {
             material = await this.resolveCertificateMaterialFromInjectedSources(cryptoProvider, nodeId);
         }
         if (!material) {
-            logger.debug("attempting_certificate_resolution_from_environment", {
+            logger$1.debug("attempting_certificate_resolution_from_environment", {
                 system_id: nodeId,
             });
             material = await resolveCertificateMaterialFromEnvironment();
         }
         if (!material) {
-            logger.warning("certificate_material_not_found", {
+            logger$1.warning("certificate_material_not_found", {
                 system_id: nodeId,
                 assigned_path: readFrameString(welcomeFrame, "assignedPath", "assigned_path"),
                 ca_service_url: options?.caServiceUrl ?? this.caServiceUrl,
@@ -7817,7 +7817,7 @@ class DefaultCertificateManager {
         }
         const stored = await this.storeCertificateMaterial(cryptoProvider, material, nodeId);
         if (!stored) {
-            logger.warning("certificate_storage_not_supported", {
+            logger$1.warning("certificate_storage_not_supported", {
                 system_id: nodeId,
             });
             return false;
@@ -7826,7 +7826,7 @@ class DefaultCertificateManager {
         if (!validated) {
             return false;
         }
-        logger.debug("certificate_material_applied", {
+        logger$1.debug("certificate_material_applied", {
             system_id: nodeId,
             has_chain: Boolean(material.certificateChainPem),
         });
@@ -7889,12 +7889,12 @@ class DefaultCertificateManager {
         }
         const validated = await this.validateProviderCertificate(provider, nodeId);
         if (!validated) {
-            logger.error("existing_certificate_validation_failed", {
+            logger$1.error("existing_certificate_validation_failed", {
                 node_id: nodeId,
             });
             return false;
         }
-        logger.debug("existing_certificate_validated", {
+        logger$1.debug("existing_certificate_validated", {
             node_id: nodeId,
         });
         return true;
@@ -7902,7 +7902,7 @@ class DefaultCertificateManager {
     async resolveCertificateMaterialFromInjectedSources(provider, nodeId) {
         const providerMaterial = await this.resolveCertificateMaterialFromProvider(provider, nodeId);
         if (providerMaterial) {
-            logger.debug("certificate_material_resolved_from_provider", {
+            logger$1.debug("certificate_material_resolved_from_provider", {
                 system_id: nodeId,
             });
             return providerMaterial;
@@ -7911,14 +7911,14 @@ class DefaultCertificateManager {
             try {
                 const material = await this.certificateMaterialResolver();
                 if (material) {
-                    logger.debug("certificate_material_resolved_from_options", {
+                    logger$1.debug("certificate_material_resolved_from_options", {
                         system_id: nodeId,
                     });
                     return material;
                 }
             }
             catch (error) {
-                logger.debug("certificate_material_option_resolution_failed", {
+                logger$1.debug("certificate_material_option_resolution_failed", {
                     system_id: nodeId,
                     error: error instanceof Error ? error.message : String(error),
                 });
@@ -7935,7 +7935,7 @@ class DefaultCertificateManager {
             return normalizeCertificateMaterial(material ?? null);
         }
         catch (error) {
-            logger.debug("provider_certificate_material_resolution_failed", {
+            logger$1.debug("provider_certificate_material_resolution_failed", {
                 system_id: nodeId,
                 error: error instanceof Error ? error.message : String(error),
             });
@@ -7957,7 +7957,7 @@ class DefaultCertificateManager {
             }
             const url = readRecordString(grantRecord, "url", "baseUrl", "base_url");
             if (!url) {
-                logger.warning("ca_sign_grant_missing_url", {
+                logger$1.warning("ca_sign_grant_missing_url", {
                     grant_keys: Object.keys(grantRecord),
                 });
                 continue;
@@ -7976,12 +7976,12 @@ class DefaultCertificateManager {
                 ? provider.signatureKeyId
                 : null);
         if (!nodeId) {
-            logger.warning("certificate_request_missing_node_id");
+            logger$1.warning("certificate_request_missing_node_id");
             return null;
         }
         const physicalPath = readFrameString(welcomeFrame, "assignedPath", "assigned_path");
         if (!physicalPath) {
-            logger.warning("certificate_request_missing_physical_path", {
+            logger$1.warning("certificate_request_missing_physical_path", {
                 node_id: nodeId,
             });
             return null;
@@ -7995,7 +7995,7 @@ class DefaultCertificateManager {
         }
         const caServiceUrl = options?.caServiceUrl ?? this.caServiceUrl ?? grant.url;
         if (!caServiceUrl) {
-            logger.error("ca_service_url_unavailable", {
+            logger$1.error("ca_service_url_unavailable", {
                 node_id: nodeId,
             });
             return null;
@@ -8008,7 +8008,7 @@ class DefaultCertificateManager {
             authStrategy = await this.createAuthStrategyForGrant(grant);
         }
         catch (error) {
-            logger.error("ca_sign_auth_strategy_creation_failed", {
+            logger$1.error("ca_sign_auth_strategy_creation_failed", {
                 node_id: nodeId,
                 error: error instanceof Error ? error.message : String(error),
             });
@@ -8020,7 +8020,7 @@ class DefaultCertificateManager {
                 await authStrategy.apply(client);
             }
             const [certificatePem, certificateChainPem] = await client.requestCertificate(csrPem, nodeId, physicalPath, logicals);
-            logger.debug("certificate_received_from_ca_service", {
+            logger$1.debug("certificate_received_from_ca_service", {
                 node_id: nodeId,
                 has_chain: Boolean(certificateChainPem),
                 ca_service_url: caServiceUrl,
@@ -8032,13 +8032,13 @@ class DefaultCertificateManager {
         }
         catch (error) {
             if (error instanceof CertificateRequestError) {
-                logger.error("certificate_request_failed", {
+                logger$1.error("certificate_request_failed", {
                     node_id: nodeId,
                     error: error.message,
                 });
             }
             else {
-                logger.error("certificate_request_unhandled_error", {
+                logger$1.error("certificate_request_unhandled_error", {
                     node_id: nodeId,
                     error: error instanceof Error ? error.message : String(error),
                 });
@@ -8051,7 +8051,7 @@ class DefaultCertificateManager {
                     await authStrategy.cleanup();
                 }
                 catch (cleanupError) {
-                    logger.debug("auth_strategy_cleanup_failed", {
+                    logger$1.debug("auth_strategy_cleanup_failed", {
                         error: cleanupError instanceof Error
                             ? cleanupError.message
                             : String(cleanupError),
@@ -8074,14 +8074,14 @@ class DefaultCertificateManager {
     async validateProviderCertificate(provider, nodeId) {
         const { pem: trustStorePem, reason } = await this.resolveTrustStorePemValue(provider, nodeId);
         if (!trustStorePem) {
-            logger.error("trust_anchor_validation_failed", {
+            logger$1.error("trust_anchor_validation_failed", {
                 node_id: nodeId,
                 reason: reason ?? "trust_store_unavailable",
             });
             return false;
         }
         if (typeof provider.nodeJwk !== "function") {
-            logger.error("trust_anchor_validation_failed", {
+            logger$1.error("trust_anchor_validation_failed", {
                 node_id: nodeId,
                 reason: "crypto_provider_lacks_node_jwk",
             });
@@ -8092,7 +8092,7 @@ class DefaultCertificateManager {
             jwk = provider.nodeJwk() ?? null;
         }
         catch (error) {
-            logger.error("trust_anchor_validation_failed", {
+            logger$1.error("trust_anchor_validation_failed", {
                 node_id: nodeId,
                 reason: "node_jwk_retrieval_failed",
                 error: error instanceof Error ? error.message : String(error),
@@ -8100,7 +8100,7 @@ class DefaultCertificateManager {
             return false;
         }
         if (!jwk) {
-            logger.error("trust_anchor_validation_failed", {
+            logger$1.error("trust_anchor_validation_failed", {
                 node_id: nodeId,
                 reason: "node_jwk_missing",
             });
@@ -8110,7 +8110,7 @@ class DefaultCertificateManager {
         if (!Array.isArray(x5c) ||
             x5c.length === 0 ||
             x5c.some((entry) => typeof entry !== "string")) {
-            logger.error("trust_anchor_validation_failed", {
+            logger$1.error("trust_anchor_validation_failed", {
                 node_id: nodeId,
                 reason: "invalid_certificate_chain",
             });
@@ -8124,19 +8124,19 @@ class DefaultCertificateManager {
                 strict: false,
             });
             if (!result.isValid) {
-                logger.error("trust_anchor_validation_failed", {
+                logger$1.error("trust_anchor_validation_failed", {
                     node_id: nodeId,
                     reason: result.error ?? "validation_failed",
                 });
                 return false;
             }
-            logger.debug("certificate_chain_validation_successful", {
+            logger$1.debug("certificate_chain_validation_successful", {
                 node_id: nodeId,
             });
             return true;
         }
         catch (error) {
-            logger.error("trust_anchor_validation_failed", {
+            logger$1.error("trust_anchor_validation_failed", {
                 node_id: nodeId,
                 reason: "validation_error",
                 error: error instanceof Error ? error.message : String(error),
@@ -8147,7 +8147,7 @@ class DefaultCertificateManager {
     async resolveTrustStorePemValue(provider, nodeId) {
         const providerPem = await this.resolveTrustStorePemFromProvider(provider, nodeId);
         if (providerPem) {
-            logger.debug("trust_store_resolved_from_provider", {
+            logger$1.debug("trust_store_resolved_from_provider", {
                 node_id: nodeId,
             });
             return { pem: providerPem };
@@ -8157,14 +8157,14 @@ class DefaultCertificateManager {
                 const pem = await this.trustStorePemResolver();
                 const normalized = normalizePemOrNull(pem);
                 if (normalized) {
-                    logger.debug("trust_store_resolved_from_options", {
+                    logger$1.debug("trust_store_resolved_from_options", {
                         node_id: nodeId,
                     });
                     return { pem: normalized };
                 }
             }
             catch (error) {
-                logger.debug("trust_store_option_resolution_failed", {
+                logger$1.debug("trust_store_option_resolution_failed", {
                     node_id: nodeId,
                     error: error instanceof Error ? error.message : String(error),
                 });
@@ -8185,7 +8185,7 @@ class DefaultCertificateManager {
             return normalizePemOrNull(pem);
         }
         catch (error) {
-            logger.debug("provider_trust_store_resolution_failed", {
+            logger$1.debug("provider_trust_store_resolution_failed", {
                 node_id: nodeId,
                 error: error instanceof Error ? error.message : String(error),
             });
@@ -8200,7 +8200,7 @@ class DefaultCertificateManager {
                 stored = true;
             }
             catch (error) {
-                logger.warning("failed_to_store_certificate", {
+                logger$1.warning("failed_to_store_certificate", {
                     error: error instanceof Error ? error.message : String(error),
                 });
             }
@@ -8218,7 +8218,7 @@ class DefaultCertificateManager {
                 stored = true;
             }
             catch (error) {
-                logger.debug("certificate_persistence_hook_failed", {
+                logger$1.debug("certificate_persistence_hook_failed", {
                     node_id: nodeId,
                     error: error instanceof Error ? error.message : String(error),
                 });
@@ -8229,7 +8229,7 @@ class DefaultCertificateManager {
     async buildCertificateSigningRequest(provider, nodeId, physicalPath, logicals) {
         const trimmedPath = physicalPath.trim();
         if (!trimmedPath) {
-            logger.warning("certificate_request_missing_physical_path", {
+            logger$1.warning("certificate_request_missing_physical_path", {
                 node_id: nodeId,
             });
             return null;
@@ -8238,7 +8238,7 @@ class DefaultCertificateManager {
         const privateKeyPem = pemSource.signingPrivatePem?.trim() ?? "";
         const publicKeyPem = pemSource.signingPublicPem?.trim() ?? "";
         if (!privateKeyPem || !publicKeyPem) {
-            logger.error("crypto_provider_missing_signing_material", {
+            logger$1.error("crypto_provider_missing_signing_material", {
                 node_id: nodeId,
                 has_private: Boolean(privateKeyPem),
                 has_public: Boolean(publicKeyPem),
@@ -8256,7 +8256,7 @@ class DefaultCertificateManager {
             return csrPem;
         }
         catch (error) {
-            logger.error("csr_generation_failed", {
+            logger$1.error("csr_generation_failed", {
                 node_id: nodeId,
                 error: error instanceof Error ? error.message : String(error),
             });
@@ -8340,7 +8340,7 @@ async function resolvePemFromEnvironment(envVar, fileVar) {
         return null;
     }
     if (!isNodeProcess()) {
-        logger.debug("pem_file_unavailable_in_browser", {
+        logger$1.debug("pem_file_unavailable_in_browser", {
             env_var: fileVar,
         });
         return null;
@@ -8351,7 +8351,7 @@ async function resolvePemFromEnvironment(envVar, fileVar) {
         return normalizePemOrNull(content);
     }
     catch (error) {
-        logger.warning("failed_to_read_certificate_file", {
+        logger$1.warning("failed_to_read_certificate_file", {
             file: filePath,
             error: error instanceof Error ? error.message : String(error),
         });
@@ -8382,7 +8382,7 @@ function providerHasCertificate(provider) {
             return Boolean(provider.hasCertificate());
         }
         catch (error) {
-            logger.debug("has_certificate_check_failed", {
+            logger$1.debug("has_certificate_check_failed", {
                 error: error instanceof Error ? error.message : String(error),
             });
         }
@@ -8392,7 +8392,7 @@ function providerHasCertificate(provider) {
             return Boolean(provider.nodeCertificatePem());
         }
         catch (error) {
-            logger.debug("node_certificate_check_failed", {
+            logger$1.debug("node_certificate_check_failed", {
                 error: error instanceof Error ? error.message : String(error),
             });
         }
@@ -8446,7 +8446,7 @@ function normalizeAuthConfig(candidate) {
     }
     const normalized = candidate;
     if (!normalized.type || typeof normalized.type !== "string") {
-        logger.warning("auth_strategy_missing_type", {
+        logger$1.warning("auth_strategy_missing_type", {
             provided_keys: Object.keys(candidate),
         });
         return null;
@@ -8464,7 +8464,7 @@ async function resolveTrustStorePemFromEnvironment() {
     }
     catch (error) {
         const message = error instanceof Error ? error.message : String(error);
-        logger.debug("trust_store_provider_resolution_failed", {
+        logger$1.debug("trust_store_provider_resolution_failed", {
             error: message,
         });
         return null;
@@ -8659,16 +8659,7 @@ function bytesToUtf8$1(data) {
 
 const DEFAULT_REFRESH_INTERVAL_MS = 86400000; // 24 hours
 const MIN_REFRESH_INTERVAL_MS = 60000; // 1 minute
-const consoleLogger = {
-    debug: (...args) => {
-        if (!isProductionEnvironment()) {
-            console.debug("[trust-bundle]", ...args);
-        }
-    },
-    warn: (...args) => {
-        console.warn("[trust-bundle]", ...args);
-    },
-};
+const logger = getLogger$1("naylence.fame.security.cert.trust_store.http_bundle_provider");
 function isTruthyFlag(value) {
     if (typeof value === "boolean") {
         return value;
@@ -8721,7 +8712,7 @@ class HttpBundleProvider {
             if (!(this.allowInsecureHttp && devMode && isLoopbackHost)) {
                 throw new Error("Trust bundle URL must use HTTPS (set allowInsecureHttp or FAME_TRUST_BUNDLE_ALLOW_HTTP for dev-only http)");
             }
-            consoleLogger.warn("Allowing insecure trust bundle URL", {
+            logger.warning("allowing_insecure_trust_bundle_url", {
                 url: parsed.toString(),
                 devMode,
                 isLoopbackHost,
@@ -8753,7 +8744,9 @@ class HttpBundleProvider {
         if (stale || !this.anchors) {
             this.inflight = this.fetchLatest()
                 .catch((error) => {
-                consoleLogger.warn("Trust bundle refresh failed", error);
+                logger.warning("trust_bundle_refresh_failed", {
+                    error: error instanceof Error ? error.message : String(error),
+                });
                 if (this.anchors) {
                     return this.anchors;
                 }
@@ -8793,14 +8786,16 @@ class HttpBundleProvider {
             const cached = await loadCache(this.cacheKey);
             if (cached) {
                 this.applyCachedEntry(cached);
-                consoleLogger.debug("Loaded trust bundle from cache", {
+                logger.debug("loaded_trust_bundle_from_cache", {
                     url: this.url.href,
                     anchorCount: cached.anchors.length,
                 });
             }
         }
         catch (error) {
-            consoleLogger.warn("Failed to load cached trust bundle", error);
+            logger.warning("failed_to_load_cached_trust_bundle", {
+                error: error instanceof Error ? error.message : String(error),
+            });
         }
         this.initialized = true;
     }
@@ -8886,7 +8881,9 @@ class HttpBundleProvider {
                 callback();
             }
             catch (error) {
-                consoleLogger.warn("Trust bundle listener failed", error);
+                logger.warning("trust_bundle_listener_failed", {
+                    error: error instanceof Error ? error.message : String(error),
+                });
             }
         }
     }
@@ -9133,7 +9130,9 @@ async function openIndexedDbStore() {
             });
         };
         request.onerror = () => {
-            consoleLogger.warn("IndexedDB unavailable for trust bundle caching", request.error);
+            logger.warning("indexeddb_unavailable_for_trust_bundle_caching", {
+                error: request.error ? String(request.error) : "unknown",
+            });
             resolve(null);
         };
     });