@nodii/telemetry 0.11.0 → 0.13.0

package/dist/index.d.ts

@@ -1,7 +1,8 @@
 export { initTelemetry } from "./init.js";
 export { forceFlush, getOtlpAdapterHandle, installOtlpAdapter, shutdownOtlpAdapter, } from "./otlp-adapter.js";
 export type { OtlpAdapterHandle, OtlpAdapterConfig } from "./otlp-adapter.js";
-export { logger } from "./logger.js";
+export { logger, createLogger } from "./logger.js";
+export type { NodiiLogger, LoggerOptions, LogSink, ErrSerializer, } from "./logger.js";
 export { tracer, withSpanAttributes, getSagaTracer } from "./tracer.js";
 export { getActiveSpan } from "./active-span.js";
 export type { ActiveSpanRef } from "./active-span.js";
@@ -17,7 +18,8 @@ export type { ConfigureTelemetryOptions } from "./configure.js";
 export { intent, IntentTypeNotRegistered } from "./intent.js";
 export { agentInvocable, readAgentRegistry, AGENT_INVOCABLE_METADATA, } from "./agent-invocable.js";
 export { getContext, requireContext, withContext, } from "./context.js";
-export { isPiiFieldName, redactString, redactFields, PII_FIELD_NAMES, } from "./redaction.js";
+export { isPiiFieldName, redactString, redactFields, isLuhnValid, scrubPanString, PII_FIELD_NAMES, } from "./redaction.js";
+export type { RedactionConfig } from "./redaction.js";
 export { uuidv7, isUuidv7 } from "./uuid.js";
 export { TelemetryNotInitialized } from "./types.js";
 export type { ActorType, AgentInvocableAuthTier, AgentInvocableConfig, AgentInvocableIdempotency, AgentInvocableMode, AgentInvocableRateLimit, AgentInvocableSideEffect, AutoInstrumentationConfig, ErrorHandlingConfig, ExportFailureReason, InitTelemetryConfig, IntentTypeDefinition, IntentTypeRegistry, LogEnvelope, LogLevel, MetricFamily, MetricVocabularyEntry, MetricVocabularyRegistry, NodiiContext, OtlpAuthConfig, OtlpTokenProvider, ResourceAttributes, SamplingConfig, } from "./types.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,YAAY,EACV,oBAAoB,EACpB,IAAI,EACJ,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,EACV,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EACV,aAAa,EACb,WAAW,EACX,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,gCAAgC,EAChC,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,8BAA8B,EAC9B,KAAK,EACL,iBAAiB,EACjB,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,SAAS,EACT,UAAU,EACV,SAAS,EACT,iBAAiB,EACjB,UAAU,EACV,aAAa,EACb,YAAY,EACZ,WAAW,EACX,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,YAAY,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,UAAU,EACV,cAAc,EACd,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AACrD,YAAY,EACV,SAAS,EACT,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EAClB,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,qBAAqB,EACrB,wBAAwB,EACxB,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AACnD,YAAY,EACV,WAAW,EACX,aAAa,EACb,OAAO,EACP,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACtD,YAAY,EACV,oBAAoB,EACpB,IAAI,EACJ,QAAQ,EACR,WAAW,EACX,UAAU,EACV,UAAU,EACV,UAAU,GACX,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5E,YAAY,EACV,aAAa,EACb,WAAW,EACX,eAAe,EACf,UAAU,EACV,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,gCAAgC,EAChC,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,8BAA8B,EAC9B,KAAK,EACL,iBAAiB,EACjB,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,YAAY,EACV,SAAS,EACT,UAAU,EACV,SAAS,EACT,iBAAiB,EACjB,UAAU,EACV,aAAa,EACb,YAAY,EACZ,WAAW,EACX,0BAA0B,GAC3B,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,YAAY,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,UAAU,EACV,cAAc,EACd,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,cAAc,EACd,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AACrD,YAAY,EACV,SAAS,EACT,sBAAsB,EACtB,oBAAoB,EACpB,yBAAyB,EACzB,kBAAkB,EAClB,uBAAuB,EACvB,wBAAwB,EACxB,yBAAyB,EACzB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,oBAAoB,EACpB,kBAAkB,EAClB,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,qBAAqB,EACrB,wBAAwB,EACxB,YAAY,EACZ,cAAc,EACd,iBAAiB,EACjB,kBAAkB,EAClB,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -8,6 +8,11 @@
 //                                 that SET NodiiContext at the entry seam.
 //   - @nodii/telemetry/outbox   — Outbox emit + propagation-column adapter.
 //   - @nodii/telemetry/drizzle  — Drizzle audit_event schema fragments.
+//   - @nodii/telemetry/lambda   — AWS Lambda lifecycle wrapper (C4 lock):
+//                                 cold-start init at module-load +
+//                                 force-flush-on-return so spans/metrics/
+//                                 logs survive the post-handler freeze.
+//                                 First consumer: s2s-auth-service.
 //
 // Not yet shipped (D44 § 6.5 lists them; no implementation exists yet —
 // they are tracked as follow-on requests, NOT advertised as vapor):
@@ -23,7 +28,7 @@
 //            type NodiiContext } from '@nodii/telemetry';
 export { initTelemetry } from "./init.js";
 export { forceFlush, getOtlpAdapterHandle, installOtlpAdapter, shutdownOtlpAdapter, } from "./otlp-adapter.js";
-export { logger } from "./logger.js";
+export { logger, createLogger } from "./logger.js";
 export { tracer, withSpanAttributes, getSagaTracer } from "./tracer.js";
 export { getActiveSpan } from "./active-span.js";
 export { forensicParentValue, parseTraceparent, resolveSpanParent, } from "./traceparent.js";
@@ -34,7 +39,7 @@ export { configureTelemetry } from "./configure.js";
 export { intent, IntentTypeNotRegistered } from "./intent.js";
 export { agentInvocable, readAgentRegistry, AGENT_INVOCABLE_METADATA, } from "./agent-invocable.js";
 export { getContext, requireContext, withContext, } from "./context.js";
-export { isPiiFieldName, redactString, redactFields, PII_FIELD_NAMES, } from "./redaction.js";
+export { isPiiFieldName, redactString, redactFields, isLuhnValid, scrubPanString, PII_FIELD_NAMES, } from "./redaction.js";
 export { uuidv7, isUuidv7 } from "./uuid.js";
 export { TelemetryNotInitialized } from "./types.js";
 export { DEFAULT_SAMPLING_CONFIG, METRIC_FAMILIES, AGENT_INVOCABLE_SIDE_EFFECTS, REPLICA_CONSUMER_VOCABULARY, } from "./types.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,EAAE;AACF,0EAA0E;AAC1E,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,4EAA4E;AAC5E,2EAA2E;AAC3E,4EAA4E;AAC5E,wEAAwE;AACxE,EAAE;AACF,wEAAwE;AACxE,oEAAoE;AACpE,uEAAuE;AACvE,8DAA8D;AAC9D,mDAAmD;AACnD,EAAE;AACF,oEAAoE;AACpE,gBAAgB;AAChB,EAAE;AACF,oEAAoE;AACpE,gEAAgE;AAChE,0DAA0D;AAE1D,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAWjD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAS5E,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,gCAAgC,EAChC,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,8BAA8B,EAC9B,KAAK,EACL,iBAAiB,EACjB,cAAc,GACf,MAAM,YAAY,CAAC;AAYpB,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,UAAU,EACV,cAAc,EACd,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,eAAe,GAChB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AA0BrD,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,oCAAoC;AACpC,EAAE;AACF,0EAA0E;AAC1E,EAAE;AACF,0EAA0E;AAC1E,yEAAyE;AACzE,4EAA4E;AAC5E,2EAA2E;AAC3E,4EAA4E;AAC5E,wEAAwE;AACxE,0EAA0E;AAC1E,mEAAmE;AACnE,0EAA0E;AAC1E,wEAAwE;AACxE,oEAAoE;AACpE,EAAE;AACF,wEAAwE;AACxE,oEAAoE;AACpE,uEAAuE;AACvE,8DAA8D;AAC9D,mDAAmD;AACnD,EAAE;AACF,oEAAoE;AACpE,gBAAgB;AAChB,EAAE;AACF,oEAAoE;AACpE,gEAAgE;AAChE,0DAA0D;AAE1D,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EACL,UAAU,EACV,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAOnD,OAAO,EAAE,MAAM,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACxE,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAWjD,OAAO,EACL,mBAAmB,EACnB,gBAAgB,EAChB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAS5E,OAAO,EACL,cAAc,EACd,kBAAkB,EAClB,wBAAwB,EACxB,gCAAgC,EAChC,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,8BAA8B,EAC9B,KAAK,EACL,iBAAiB,EACjB,cAAc,GACf,MAAM,YAAY,CAAC;AAYpB,OAAO,EAAE,2BAA2B,EAAE,MAAM,YAAY,CAAC;AACzD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAEpD,OAAO,EAAE,MAAM,EAAE,uBAAuB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EACL,cAAc,EACd,iBAAiB,EACjB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,UAAU,EACV,cAAc,EACd,WAAW,GACZ,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,cAAc,EACd,YAAY,EACZ,YAAY,EACZ,WAAW,EACX,cAAc,EACd,eAAe,GAChB,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AA0BrD,OAAO,EACL,uBAAuB,EACvB,eAAe,EACf,4BAA4B,EAC5B,2BAA2B,GAC5B,MAAM,YAAY,CAAC"}

package/dist/lambda/index.d.ts

@@ -0,0 +1,77 @@
+import type { InitTelemetryConfig, MetricFamily } from "../types.js";
+/**
+ * A minimal structural AWS Lambda handler. We intentionally do NOT depend
+ * on `aws-lambda` types — the wrapper is event-shape agnostic so it works
+ * for an APIGW-proxied Hono app (`handle(app)` from `hono/aws-lambda`), a
+ * raw SQS/SNS/EventBridge handler, or any other `async (event, context)`
+ * function. `Event` / `Result` are inferred from the wrapped handler.
+ */
+export type LambdaHandler<Event = unknown, Result = unknown> = (event: Event, context?: unknown) => Promise<Result> | Result;
+/** Config for the cold-start counter tick (C4: `s2s.cold_start_total`). */
+export interface ColdStartMetricConfig {
+    /**
+     * The vocabulary-registered counter name to increment once per cold
+     * boot (e.g. `"s2s.cold_start_total"`). MUST be registered by the
+     * consumer via `initTelemetry({ vocabularyRegistry })` — the name is
+     * service-specific, so the wrapper cannot hardcode it.
+     *
+     * If the name is NOT registered (vocabulary miss), the increment is a
+     * caught no-op + a one-line warn — a metric mis-config must NOT crash
+     * module-load (R1 / pillar 5).
+     */
+    name: string;
+    /** The metric family for the counter. Defaults to `"request_handler"`. */
+    family?: MetricFamily;
+    /** Static labels stamped on the cold-start tick. */
+    labels?: Record<string, string | number>;
+}
+/**
+ * `initLambdaTelemetry({...})` argument shape. Extends the base
+ * `initTelemetry` config (serviceName + env + otlp + vocabulary, …) with
+ * the Lambda-specific cold-start knob.
+ */
+export interface InitLambdaTelemetryConfig extends InitTelemetryConfig {
+    /**
+     * Counter to increment once per cold boot. Omit to skip the cold-start
+     * tick entirely (some services track cold starts via a log line only).
+     */
+    coldStartMetric?: ColdStartMetricConfig;
+    /**
+     * Name of the per-invocation request span opened by `wrap`. Defaults to
+     * `"<serviceName>.lambda.invoke"`.
+     */
+    requestSpanName?: string;
+}
+/** The handle returned by `initLambdaTelemetry`. */
+export interface LambdaTelemetry {
+    /**
+     * Wrap a Lambda handler so every invocation:
+     *   1. runs inside a request span (`requestSpanName`);
+     *   2. force-flushes the trace + log + metric providers BEFORE the
+     *      handler's result returns (success AND error paths), so nothing
+     *      is lost when Lambda freezes;
+     *   3. is RESILIENT — a flush failure is caught + logged and never
+     *      propagates; the handler's own result / error is what returns.
+     */
+    wrap<Event, Result>(handler: LambdaHandler<Event, Result>): (event: Event, context?: unknown) => Promise<Result>;
+    /**
+     * Force-flush the active OTLP pipelines (trace + log + metric). No-op
+     * when no OTLP adapter is installed (e.g. `disableOtlp` / no endpoint).
+     * Exposed for callers that flush at custom lifecycle points.
+     */
+    forceFlush(): Promise<void>;
+}
+/**
+ * Boot telemetry for a Lambda at MODULE LOAD (per C4). Call this once at
+ * the top of the handler module — not per invocation. Returns a
+ * `LambdaTelemetry` handle whose `wrap` adds the per-invocation request
+ * span + force-flush-on-return.
+ *
+ * Idempotency: `initTelemetry` is itself idempotent (a second call
+ * warn-no-ops), so a doubly-imported / re-required handler module does
+ * NOT double-configure the SDK. The cold-start tick is likewise fired
+ * only on the call that actually performs init (the first one) — a second
+ * `initLambdaTelemetry` will not re-tick, matching "once per cold boot".
+ */
+export declare function initLambdaTelemetry(config: InitLambdaTelemetryConfig): LambdaTelemetry;
+//# sourceMappingURL=index.d.ts.map

package/dist/lambda/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/lambda/index.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,mBAAmB,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAErE;;;;;;GAMG;AACH,MAAM,MAAM,aAAa,CAAC,KAAK,GAAG,OAAO,EAAE,MAAM,GAAG,OAAO,IAAI,CAC7D,KAAK,EAAE,KAAK,EACZ,OAAO,CAAC,EAAE,OAAO,KACd,OAAO,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC;AAE9B,2EAA2E;AAC3E,MAAM,WAAW,qBAAqB;IACpC;;;;;;;;;OASG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,oDAAoD;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;CAC1C;AAED;;;;GAIG;AACH,MAAM,WAAW,yBAA0B,SAAQ,mBAAmB;IACpE;;;OAGG;IACH,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC;;;OAGG;IACH,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B;;;;;;;;OAQG;IACH,IAAI,CAAC,KAAK,EAAE,MAAM,EAChB,OAAO,EAAE,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC,GACpC,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACxD;;;;OAIG;IACH,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7B;AAyBD;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,MAAM,EAAE,yBAAyB,GAChC,eAAe,CAiDjB"}

package/dist/lambda/index.js

@@ -0,0 +1,130 @@
+// `@nodii/telemetry/lambda` — the Lambda lifecycle wrapper.
+//
+// Spec: C4 lock — `services/s2s-auth-service/features/telemetry-instrumentation.md`
+//       § "The `@nodii/telemetry/lambda` sub-package" + `nodii-libs/telemetry.md`
+//       § 10 (subpath exports). First consumer: s2s-auth-service (Lambda-shaped).
+//
+// AWS Lambda freezes the execution environment the instant a handler
+// returns. The OTel batch processors buffer spans / logs / metrics and
+// flush them on a timer — so on a Lambda that timer rarely fires before
+// the freeze, and signals are LOST. Two lifecycle hooks fix this, both
+// locked by C4:
+//
+//   1. Cold-start init at module-load — `initLambdaTelemetry({...})` is
+//      called once at the top of the handler module (NOT per-invocation).
+//      It boots the SDK (idempotent — a second call warn-no-ops, see
+//      `initTelemetry`) and ticks a cold-start counter exactly once per
+//      cold boot.
+//
+//   2. `forceFlush()` before the handler returns — `handle.wrap(fn)`
+//      runs the handler inside a request span and `await`s a force-flush
+//      of the trace + log + metric providers BEFORE returning (and on the
+//      error path), so nothing is lost when the environment freezes.
+//
+// RESILIENCE (telemetry-doctrine pillar 5 / R1 — dependency-down path):
+//   a force-flush FAILURE (collector down / OTLP timeout) MUST NOT break
+//   the Lambda. A flaky telemetry backend cannot be allowed to take down
+//   the function. `wrap` therefore catches + logs any flush rejection and
+//   STILL returns the handler's result (or re-throws the handler's own
+//   error). The only thing that propagates out of the wrapper is the
+//   handler's own outcome — never a telemetry-plumbing failure.
+//
+// Lives behind a subpath so non-Lambda services never pull this lifecycle
+// glue into their bundle.
+import { getTelemetryOrNull, initTelemetry } from "../init.js";
+import { metrics } from "../metrics.js";
+import { forceFlush as flushOtlpPipelines } from "../otlp-adapter.js";
+import { tracer } from "../tracer.js";
+/**
+ * Increment the cold-start counter exactly once, defensively. A
+ * vocabulary miss (name not registered) or any other metric error is
+ * caught + warn-logged — a cold-start metric mis-config must NOT crash
+ * the Lambda at module load (R1 / pillar 5).
+ */
+function tickColdStart(cfg) {
+    try {
+        const counter = metrics.counter(cfg.name, {
+            family: cfg.family ?? "request_handler",
+            description: "Lambda cold-start counter (incremented once per cold boot)",
+            labelKeys: Object.keys(cfg.labels ?? {}),
+        });
+        counter.inc(cfg.labels ?? {});
+    }
+    catch (err) {
+        const cause = err instanceof Error ? err.message : String(err);
+        // eslint-disable-next-line no-console
+        console.warn(`[@nodii/telemetry/lambda] cold-start counter "${cfg.name}" could not be incremented (is it in the vocabularyRegistry?). Continuing — a metric mis-config must not crash module-load. Cause: ${cause}`);
+    }
+}
+/**
+ * Boot telemetry for a Lambda at MODULE LOAD (per C4). Call this once at
+ * the top of the handler module — not per invocation. Returns a
+ * `LambdaTelemetry` handle whose `wrap` adds the per-invocation request
+ * span + force-flush-on-return.
+ *
+ * Idempotency: `initTelemetry` is itself idempotent (a second call
+ * warn-no-ops), so a doubly-imported / re-required handler module does
+ * NOT double-configure the SDK. The cold-start tick is likewise fired
+ * only on the call that actually performs init (the first one) — a second
+ * `initLambdaTelemetry` will not re-tick, matching "once per cold boot".
+ */
+export function initLambdaTelemetry(config) {
+    // Was the SDK already initialized before this call? If so, this is a
+    // redundant init (re-imported module / double-call) and we must NOT
+    // re-tick the cold-start counter — "once per cold boot".
+    const alreadyInitialized = getTelemetryOrNull() !== null;
+    // `initTelemetry` consumes only the base config keys; the extra
+    // Lambda-specific keys are ignored by it (excess-property tolerant at
+    // runtime). It is idempotent — a second call warn-no-ops.
+    initTelemetry(config);
+    if (!alreadyInitialized && config.coldStartMetric) {
+        tickColdStart(config.coldStartMetric);
+    }
+    const spanName = config.requestSpanName ?? `${config.serviceName}.lambda.invoke`;
+    // The handle is built first so `wrap` can route its flush through
+    // `handle.forceFlush` — that is the single flush seam (and the one a
+    // test spies on to fault-inject a flush failure).
+    const handle = {
+        async forceFlush() {
+            await flushOtlpPipelines();
+        },
+        wrap(handler) {
+            return async (event, context) => {
+                try {
+                    // Run the handler inside a request span. `tracer.span` opens +
+                    // closes the span and applies D27 status mapping.
+                    const result = await tracer.span(spanName, () => Promise.resolve(handler(event, context)));
+                    // Flush BEFORE returning — but a flush failure must NOT mask a
+                    // successful handler result.
+                    await safeFlush(handle);
+                    return result;
+                }
+                catch (handlerErr) {
+                    // The handler itself threw. Still flush (so the error span +
+                    // partial signals aren't lost on freeze) — non-fatally — then
+                    // re-throw the handler's OWN error (NOT a flush error).
+                    await safeFlush(handle);
+                    throw handlerErr;
+                }
+            };
+        },
+    };
+    return handle;
+}
+/**
+ * Force-flush via `handle.forceFlush` but NEVER throw. A flush failure
+ * (collector down / OTLP timeout) is caught + warn-logged; the Lambda
+ * result must not be lost to a flaky telemetry backend (pillar 5 / R1
+ * dependency-down path).
+ */
+async function safeFlush(handle) {
+    try {
+        await handle.forceFlush();
+    }
+    catch (err) {
+        const cause = err instanceof Error ? err.message : String(err);
+        // eslint-disable-next-line no-console
+        console.warn(`[@nodii/telemetry/lambda] forceFlush() failed before return (telemetry backend down?). Swallowed — the handler result is returned regardless. Cause: ${cause}`);
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/lambda/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/lambda/index.ts"],"names":[],"mappings":"AAAA,4DAA4D;AAC5D,EAAE;AACF,oFAAoF;AACpF,kFAAkF;AAClF,kFAAkF;AAClF,EAAE;AACF,qEAAqE;AACrE,uEAAuE;AACvE,wEAAwE;AACxE,uEAAuE;AACvE,gBAAgB;AAChB,EAAE;AACF,wEAAwE;AACxE,0EAA0E;AAC1E,qEAAqE;AACrE,wEAAwE;AACxE,kBAAkB;AAClB,EAAE;AACF,qEAAqE;AACrE,yEAAyE;AACzE,0EAA0E;AAC1E,qEAAqE;AACrE,EAAE;AACF,wEAAwE;AACxE,yEAAyE;AACzE,yEAAyE;AACzE,0EAA0E;AAC1E,uEAAuE;AACvE,qEAAqE;AACrE,gEAAgE;AAChE,EAAE;AACF,0EAA0E;AAC1E,0BAA0B;AAE1B,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,UAAU,IAAI,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AA0EtC;;;;;GAKG;AACH,SAAS,aAAa,CAAC,GAA0B;IAC/C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE;YACxC,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,iBAAiB;YACvC,WAAW,EAAE,4DAA4D;YACzE,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;SACzC,CAAC,CAAC;QACH,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACV,iDAAiD,GAAG,CAAC,IAAI,sIAAsI,KAAK,EAAE,CACvM,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CACjC,MAAiC;IAEjC,qEAAqE;IACrE,oEAAoE;IACpE,yDAAyD;IACzD,MAAM,kBAAkB,GAAG,kBAAkB,EAAE,KAAK,IAAI,CAAC;IAEzD,gEAAgE;IAChE,sEAAsE;IACtE,0DAA0D;IAC1D,aAAa,CAAC,MAAM,CAAC,CAAC;IAEtB,IAAI,CAAC,kBAAkB,IAAI,MAAM,CAAC,eAAe,EAAE,CAAC;QAClD,aAAa,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,QAAQ,GACZ,MAAM,CAAC,eAAe,IAAI,GAAG,MAAM,CAAC,WAAW,gBAAgB,CAAC;IAElE,kEAAkE;IAClE,qEAAqE;IACrE,kDAAkD;IAClD,MAAM,MAAM,GAAoB;QAC9B,KAAK,CAAC,UAAU;YACd,MAAM,kBAAkB,EAAE,CAAC;QAC7B,CAAC;QACD,IAAI,CAAgB,OAAqC;YACvD,OAAO,KAAK,EAAE,KAAY,EAAE,OAAiB,EAAmB,EAAE;gBAChE,IAAI,CAAC;oBACH,+DAA+D;oBAC/D,kDAAkD;oBAClD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,EAAE,CAC9C,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CACzC,CAAC;oBACF,+DAA+D;oBAC/D,6BAA6B;oBAC7B,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;oBACxB,OAAO,MAAM,CAAC;gBAChB,CAAC;gBAAC,OAAO,UAAU,EAAE,CAAC;oBACpB,6DAA6D;oBAC7D,8DAA8D;oBAC9D,wDAAwD;oBACxD,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;oBACxB,MAAM,UAAU,CAAC;gBACnB,CAAC;YACH,CAAC,CAAC;QACJ,CAAC;KACF,CAAC;IAEF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,SAAS,CAAC,MAAuB;IAC9C,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,KAAK,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAC/D,sCAAsC;QACtC,OAAO,CAAC,IAAI,CACV,wJAAwJ,KAAK,EAAE,CAChK,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/logger.d.ts

@@ -1,3 +1,4 @@
+import { type RedactionConfig } from "./redaction.js";
 import type { LogEnvelope } from "./types.js";
 /** A sink that consumes formed log envelopes. Default = JSON to stdio. */
 export type LogSink = (envelope: LogEnvelope, fields: Record<string, unknown>) => void;
@@ -9,11 +10,59 @@ export type LogSink = (envelope: LogEnvelope, fields: Record<string, unknown>) =
 export declare function _setLogSink(s: LogSink): void;
 /** Test-only restore. */
 export declare function _resetLogSinkForTests(): void;
-/** D13/D14 logger. Envelope fields are SDK-injected; do not supply them. */
-export declare const logger: {
-    readonly debug: (msg: string, fields?: Record<string, unknown>) => void;
-    readonly info: (msg: string, fields?: Record<string, unknown>) => void;
-    readonly warn: (msg: string, fields?: Record<string, unknown>) => void;
-    readonly error: (msg: string, fields?: Record<string, unknown>) => void;
-};
+/**
+ * Serializes an Error into a plain record for structured logging. The
+ * factory accepts a custom one (`errSerializer`) so a service can match
+ * its pino-era shape; the default mirrors pino's `{ type, message,
+ * stack }`. The serialized object still flows through D15 redaction.
+ */
+export type ErrSerializer = (err: Error) => Record<string, unknown>;
+/**
+ * B3 logger options (drift f2336404 / req 6e0dc381). A service builds a
+ * logger matching its needs via {@link createLogger} instead of
+ * self-rolling pino. All fields optional; omitting all of them yields
+ * the legacy 4-method singleton behaviour.
+ */
+export interface LoggerOptions {
+    /** Base bindings merged into every line's fields (e.g. `{ component }`). */
+    readonly bindings?: Record<string, unknown>;
+    /** Extra redaction (REDACT_PATHS + Luhn PAN scrub). */
+    readonly redaction?: RedactionConfig;
+    /** Custom destination sink. Default: JSON to stdout/stderr. */
+    readonly sink?: LogSink;
+    /** Custom Error serializer for the `err` field. */
+    readonly errSerializer?: ErrSerializer;
+}
+/** The D13/D14 logger surface, extended with B3 child/redact. */
+export interface NodiiLogger {
+    debug(msg: string, fields?: Record<string, unknown>): void;
+    info(msg: string, fields?: Record<string, unknown>): void;
+    warn(msg: string, fields?: Record<string, unknown>): void;
+    error(msg: string, fields?: Record<string, unknown>): void;
+    /**
+     * Returns a child logger that carries `bindings` on every emitted
+     * line, merged under (overridden by) per-call fields. The parent is
+     * unaffected. Child bindings stack with the parent's.
+     */
+    child(bindings: Record<string, unknown>): NodiiLogger;
+    /**
+     * Returns a logger that additionally masks `paths` (REDACT_PATHS) on
+     * top of the D2 PII list. Additive with any existing redaction config.
+     */
+    redact(paths: readonly string[]): NodiiLogger;
+}
+/**
+ * B3 factory (drift f2336404 / req 6e0dc381). Construct a logger with
+ * base bindings, a custom destination sink, a custom Error serializer,
+ * and extra redaction (REDACT_PATHS + Luhn PAN scrub) — so a service
+ * adopts the SDK logger instead of self-rolling pino, WITHOUT losing
+ * D15 PII redaction.
+ */
+export declare function createLogger(options?: LoggerOptions): NodiiLogger;
+/**
+ * D13/D14 logger. Envelope fields are SDK-injected; do not supply them.
+ * This is the default instance (no bindings, default redaction + sink);
+ * `.child()` / `.redact()` derive configured loggers from it.
+ */
+export declare const logger: NodiiLogger;
 //# sourceMappingURL=logger.d.ts.map

package/dist/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAqBA,OAAO,KAAK,EAAE,WAAW,EAAY,MAAM,YAAY,CAAC;AAExD,0EAA0E;AAC1E,MAAM,MAAM,OAAO,GAAG,CACpB,QAAQ,EAAE,WAAW,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,IAAI,CAAC;AAIV;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAE5C;AAED,yBAAyB;AACzB,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AA+DD,4EAA4E;AAC5E,eAAO,MAAM,MAAM;0BACN,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,IAAI;yBAGhD,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,IAAI;yBAG/C,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,IAAI;0BAG9C,MAAM,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAG,IAAI;CAGlD,CAAC"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAmBA,OAAO,EAGL,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAExB,OAAO,KAAK,EAAE,WAAW,EAAY,MAAM,YAAY,CAAC;AAExD,0EAA0E;AAC1E,MAAM,MAAM,OAAO,GAAG,CACpB,QAAQ,EAAE,WAAW,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAC5B,IAAI,CAAC;AAIV;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,OAAO,GAAG,IAAI,CAE5C;AAED,yBAAyB;AACzB,wBAAgB,qBAAqB,IAAI,IAAI,CAE5C;AAgBD;;;;;GAKG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,GAAG,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAMpE;;;;;GAKG;AACH,MAAM,WAAW,aAAa;IAC5B,4EAA4E;IAC5E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5C,uDAAuD;IACvD,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,mDAAmD;IACnD,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC;CACxC;AAED,iEAAiE;AACjE,MAAM,WAAW,WAAW;IAC1B,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC1D,KAAK,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAC3D;;;;OAIG;IACH,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW,CAAC;IACtD;;;OAGG;IACH,MAAM,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,WAAW,CAAC;CAC/C;AA6GD;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,OAAO,GAAE,aAAkB,GAAG,WAAW,CAOrE;AAED;;;;GAIG;AACH,eAAO,MAAM,MAAM,EAAE,WAA4B,CAAC"}

package/dist/logger.js

@@ -16,7 +16,7 @@
 import { getActiveSpan } from "./active-span.js";
 import { getContext } from "./context.js";
 import { requireTelemetry } from "./init.js";
-import { attemptRedactFields, attemptRedactString } from "./redaction.js";
+import { attemptRedactFields, attemptRedactString, } from "./redaction.js";
 import { incSdkCounter } from "./sdk-counters.js";
 let sink = defaultJsonSink;
 /**
@@ -42,20 +42,31 @@ function defaultJsonSink(envelope, fields) {
         process.stdout.write(`${line}\n`);
     }
 }
-function emit(level, msg, fields) {
+function defaultErrSerializer(err) {
+    return { type: err.name, message: err.message, stack: err.stack };
+}
+function emit(opts, level, msg, callFields) {
     const cfg = requireTelemetry();
     const ctx = getContext();
-    // D15 redaction (fail-closed). Run BOTH passes before forming the
-    // envelope; if either throws, drop the line + bump the counter.
-    const msgResult = attemptRedactString(msg);
+    // Merge base bindings (child stack) under per-call fields. An `err`
+    // value that is an Error is serialized via the (possibly custom)
+    // serializer BEFORE redaction so the serialized shape is scrubbed too.
+    const merged = { ...opts.bindings, ...callFields };
+    if (merged.err instanceof Error) {
+        merged.err = opts.errSerializer(merged.err);
+    }
+    // D15 redaction (fail-closed) + B3 config. Run BOTH passes before
+    // forming the envelope; if either throws, drop the line + bump.
+    const msgResult = attemptRedactString(msg, opts.redaction);
     if (!msgResult.ok) {
         incSdkCounter("telemetry.sdk.redaction_failure_total", {
             reason: msgResult.reason,
         });
         return;
     }
-    const fieldsResult = fields
-        ? attemptRedactFields(fields)
+    const hasFields = Object.keys(merged).length > 0;
+    const fieldsResult = hasFields
+        ? attemptRedactFields(merged, opts.redaction)
         : { ok: true, redacted: {} };
     if (!fieldsResult.ok) {
         incSdkCounter("telemetry.sdk.redaction_failure_total", {
@@ -79,21 +90,65 @@ function emit(level, msg, fields) {
         span_id: span?.span_id ?? null,
         intent_id: ctx?.intent_id ?? null,
     };
-    sink(envelope, fieldsResult.redacted);
+    // Per-logger sink overrides the module-global sink (factory
+    // destination); otherwise fall through to the installed global sink
+    // (which the OTel adapter swaps in TS-12).
+    const target = opts.sink ?? sink;
+    target(envelope, fieldsResult.redacted);
+}
+function mergeRedaction(base, extraPaths) {
+    return {
+        extraPaths: [...(base?.extraPaths ?? []), ...extraPaths],
+        scrubPan: base?.scrubPan,
+    };
+}
+function makeLogger(opts) {
+    return {
+        debug(msg, fields) {
+            emit(opts, "debug", msg, fields);
+        },
+        info(msg, fields) {
+            emit(opts, "info", msg, fields);
+        },
+        warn(msg, fields) {
+            emit(opts, "warn", msg, fields);
+        },
+        error(msg, fields) {
+            emit(opts, "error", msg, fields);
+        },
+        child(bindings) {
+            return makeLogger({
+                ...opts,
+                bindings: { ...opts.bindings, ...bindings },
+            });
+        },
+        redact(paths) {
+            return makeLogger({
+                ...opts,
+                redaction: mergeRedaction(opts.redaction, paths),
+            });
+        },
+    };
 }
-/** D13/D14 logger. Envelope fields are SDK-injected; do not supply them. */
-export const logger = {
-    debug(msg, fields) {
-        emit("debug", msg, fields);
-    },
-    info(msg, fields) {
-        emit("info", msg, fields);
-    },
-    warn(msg, fields) {
-        emit("warn", msg, fields);
-    },
-    error(msg, fields) {
-        emit("error", msg, fields);
-    },
-};
+/**
+ * B3 factory (drift f2336404 / req 6e0dc381). Construct a logger with
+ * base bindings, a custom destination sink, a custom Error serializer,
+ * and extra redaction (REDACT_PATHS + Luhn PAN scrub) — so a service
+ * adopts the SDK logger instead of self-rolling pino, WITHOUT losing
+ * D15 PII redaction.
+ */
+export function createLogger(options = {}) {
+    return makeLogger({
+        bindings: options.bindings ? { ...options.bindings } : {},
+        redaction: options.redaction,
+        sink: options.sink,
+        errSerializer: options.errSerializer ?? defaultErrSerializer,
+    });
+}
+/**
+ * D13/D14 logger. Envelope fields are SDK-injected; do not supply them.
+ * This is the default instance (no bindings, default redaction + sink);
+ * `.child()` / `.redact()` derive configured loggers from it.
+ */
+export const logger = createLogger();
 //# sourceMappingURL=logger.js.map

package/dist/logger.js.map

@@ -1 +1 @@
-{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAC1B,EAAE;AACF,OAAO;AACP,sDAAsD;AACtD,EAAE;AACF,qEAAqE;AACrE,qEAAqE;AACrE,gEAAgE;AAChE,qEAAqE;AACrE,wCAAwC;AACxC,qEAAqE;AACrE,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,wCAAwC;AAExC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AASlD,IAAI,IAAI,GAAY,eAAe,CAAC;AAEpC;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,CAAU;IACpC,IAAI,GAAG,CAAC,CAAC;AACX,CAAC;AAED,yBAAyB;AACzB,MAAM,UAAU,qBAAqB;IACnC,IAAI,GAAG,eAAe,CAAC;AACzB,CAAC;AAED,SAAS,eAAe,CACtB,QAAqB,EACrB,MAA+B;IAE/B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IACxD,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,IAAI,QAAQ,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC5D,sCAAsC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,sCAAsC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CACX,KAAe,EACf,GAAW,EACX,MAA2C;IAE3C,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IAEzB,kEAAkE;IAClE,gEAAgE;IAChE,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,aAAa,CAAC,uCAAuC,EAAE;YACrD,MAAM,EAAE,SAAS,CAAC,MAAM;SACzB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,YAAY,GAAG,MAAM;QACzB,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC;QAC7B,CAAC,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACxC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,aAAa,CAAC,uCAAuC,EAAE;YACrD,MAAM,EAAE,YAAY,CAAC,MAAM;SAC5B,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAgB;QAC5B,KAAK;QACL,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,GAAG,EAAE,SAAS,CAAC,QAAQ;QACvB,OAAO,EAAE,GAAG,CAAC,WAAW;QACxB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,SAAS,EAAE,GAAG,EAAE,SAAS,IAAI,EAAE;QAC/B,OAAO,EAAE,GAAG,EAAE,OAAO,IAAI,IAAI;QAC7B,YAAY,EAAE,GAAG,EAAE,YAAY,IAAI,IAAI;QACvC,UAAU,EAAE,GAAG,EAAE,UAAU;QAC3B,UAAU,EAAE,GAAG,EAAE,UAAU,IAAI,EAAE;QACjC,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,IAAI;QAChC,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,IAAI;QAC9B,SAAS,EAAE,GAAG,EAAE,SAAS,IAAI,IAAI;KAClC,CAAC;IAEF,IAAI,CAAC,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,MAAM,MAAM,GAAG;IACpB,KAAK,CAAC,GAAW,EAAE,MAAgC;QACjD,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;IACD,IAAI,CAAC,GAAW,EAAE,MAAgC;QAChD,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC;IACD,IAAI,CAAC,GAAW,EAAE,MAAgC;QAChD,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC5B,CAAC;IACD,KAAK,CAAC,GAAW,EAAE,MAAgC;QACjD,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC;CACO,CAAC"}
+{"version":3,"file":"logger.js","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,0BAA0B;AAC1B,EAAE;AACF,OAAO;AACP,sDAAsD;AACtD,EAAE;AACF,qEAAqE;AACrE,qEAAqE;AACrE,gEAAgE;AAChE,qEAAqE;AACrE,wCAAwC;AACxC,qEAAqE;AACrE,EAAE;AACF,oEAAoE;AACpE,qEAAqE;AACrE,wCAAwC;AAExC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EACL,mBAAmB,EACnB,mBAAmB,GAEpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AASlD,IAAI,IAAI,GAAY,eAAe,CAAC;AAEpC;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,CAAU;IACpC,IAAI,GAAG,CAAC,CAAC;AACX,CAAC;AAED,yBAAyB;AACzB,MAAM,UAAU,qBAAqB;IACnC,IAAI,GAAG,eAAe,CAAC;AACzB,CAAC;AAED,SAAS,eAAe,CACtB,QAAqB,EACrB,MAA+B;IAE/B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,GAAG,MAAM,EAAE,CAAC,CAAC;IACxD,IAAI,QAAQ,CAAC,KAAK,KAAK,OAAO,IAAI,QAAQ,CAAC,KAAK,KAAK,MAAM,EAAE,CAAC;QAC5D,sCAAsC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,sCAAsC;QACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IACpC,CAAC;AACH,CAAC;AAUD,SAAS,oBAAoB,CAAC,GAAU;IACtC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC;AACpE,CAAC;AA6CD,SAAS,IAAI,CACX,IAA2B,EAC3B,KAAe,EACf,GAAW,EACX,UAA+C;IAE/C,MAAM,GAAG,GAAG,gBAAgB,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,UAAU,EAAE,CAAC;IAEzB,oEAAoE;IACpE,iEAAiE;IACjE,uEAAuE;IACvE,MAAM,MAAM,GAA4B,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,UAAU,EAAE,CAAC;IAC5E,IAAI,MAAM,CAAC,GAAG,YAAY,KAAK,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC9C,CAAC;IAED,kEAAkE;IAClE,gEAAgE;IAChE,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAC3D,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,aAAa,CAAC,uCAAuC,EAAE;YACrD,MAAM,EAAE,SAAS,CAAC,MAAM;SACzB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;IACjD,MAAM,YAAY,GAAG,SAAS;QAC5B,CAAC,CAAC,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC;QAC7C,CAAC,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACxC,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,aAAa,CAAC,uCAAuC,EAAE;YACrD,MAAM,EAAE,YAAY,CAAC,MAAM;SAC5B,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,MAAM,QAAQ,GAAgB;QAC5B,KAAK;QACL,EAAE,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC5B,GAAG,EAAE,SAAS,CAAC,QAAQ;QACvB,OAAO,EAAE,GAAG,CAAC,WAAW;QACxB,GAAG,EAAE,GAAG,CAAC,GAAG;QACZ,SAAS,EAAE,GAAG,EAAE,SAAS,IAAI,EAAE;QAC/B,OAAO,EAAE,GAAG,EAAE,OAAO,IAAI,IAAI;QAC7B,YAAY,EAAE,GAAG,EAAE,YAAY,IAAI,IAAI;QACvC,UAAU,EAAE,GAAG,EAAE,UAAU;QAC3B,UAAU,EAAE,GAAG,EAAE,UAAU,IAAI,EAAE;QACjC,QAAQ,EAAE,IAAI,EAAE,QAAQ,IAAI,IAAI;QAChC,OAAO,EAAE,IAAI,EAAE,OAAO,IAAI,IAAI;QAC9B,SAAS,EAAE,GAAG,EAAE,SAAS,IAAI,IAAI;KAClC,CAAC;IAEF,4DAA4D;IAC5D,oEAAoE;IACpE,2CAA2C;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC;IACjC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,QAAQ,CAAC,CAAC;AAC1C,CAAC;AAED,SAAS,cAAc,CACrB,IAAiC,EACjC,UAA6B;IAE7B,OAAO;QACL,UAAU,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,UAAU,IAAI,EAAE,CAAC,EAAE,GAAG,UAAU,CAAC;QACxD,QAAQ,EAAE,IAAI,EAAE,QAAQ;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,IAA2B;IAC7C,OAAO;QACL,KAAK,CAAC,GAAG,EAAE,MAAM;YACf,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,MAAM;YACd,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,CAAC,GAAG,EAAE,MAAM;YACd,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QAClC,CAAC;QACD,KAAK,CAAC,GAAG,EAAE,MAAM;YACf,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;QACnC,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,OAAO,UAAU,CAAC;gBAChB,GAAG,IAAI;gBACP,QAAQ,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,QAAQ,EAAE;aAC5C,CAAC,CAAC;QACL,CAAC;QACD,MAAM,CAAC,KAAK;YACV,OAAO,UAAU,CAAC;gBAChB,GAAG,IAAI;gBACP,SAAS,EAAE,cAAc,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC;aACjD,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,UAAyB,EAAE;IACtD,OAAO,UAAU,CAAC;QAChB,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE;QACzD,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,aAAa,EAAE,OAAO,CAAC,aAAa,IAAI,oBAAoB;KAC7D,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,MAAM,GAAgB,YAAY,EAAE,CAAC"}

package/dist/redaction.d.ts

@@ -13,6 +13,42 @@ export declare const PII_FIELD_NAMES: readonly string[];
  * beyond `toLowerCase()`).
  */
 export declare function isPiiFieldName(key: string): boolean;
+/**
+ * B3 redaction config (drift f2336404 / req 6e0dc381). Extends the
+ * canonical D15 passes with caller-supplied options so a service (e.g.
+ * billing) can adopt the SDK logger instead of self-rolling pino:
+ *
+ *   - `extraPaths` — additional field names (REDACT_PATHS) masked to
+ *     `[REDACTED]` on top of the D2 PII list. Case-insensitive bare-key
+ *     match, same semantics as `PII_FIELD_NAMES`.
+ *   - `scrubPan` — when true (default), a Luhn-VALIDATED PAN scrubber
+ *     masks card-number-like digit runs in strings, but ONLY if they
+ *     pass the Luhn checksum. This is stricter (and safer against
+ *     over-redaction) than the loose `credit_card` regex: a 16-digit
+ *     run that fails Luhn is left intact.
+ *
+ * The config is purely additive — `undefined` reproduces the legacy
+ * v0.1.0 behaviour byte-for-byte.
+ */
+export interface RedactionConfig {
+    /** Extra field names to mask (REDACT_PATHS), on top of the D2 list. */
+    readonly extraPaths?: readonly string[];
+    /** Luhn-validated PAN scrub on string values. Default: true. */
+    readonly scrubPan?: boolean;
+}
+/**
+ * Luhn checksum. Returns true iff the digit string passes the Luhn
+ * (mod-10) check used by real card PANs. Used by the PAN scrubber so a
+ * non-card digit run (an order id, a phone-less numeric token) is NOT
+ * masked — preventing the over-redaction the loose regex causes.
+ */
+export declare function isLuhnValid(digits: string): boolean;
+/**
+ * Mask Luhn-valid PAN-shaped digit runs in a string. A run is masked to
+ * `[REDACTED]` ONLY when its bare digits pass `isLuhnValid`; non-Luhn
+ * runs of the same length are left untouched (no over-redaction).
+ */
+export declare function scrubPanString(s: string): string;
 /**
  * Redacts an arbitrary record by replacing values whose keys match the
  * D2 PII list with `[REDACTED]`. Nested records are walked recursively.
@@ -23,13 +59,13 @@ export declare function isPiiFieldName(key: string): boolean;
  * object (e.g. circular reference encountered via JSON.stringify
  * elsewhere) the caller wraps this in `attemptRedaction()` to catch.
  */
-export declare function redactFields(input: Record<string, unknown>): Record<string, unknown>;
+export declare function redactFields(input: Record<string, unknown>, cfg?: RedactionConfig): Record<string, unknown>;
 /**
  * Apply the D15 regex pass to a string. Returns the redacted string.
  * Each pattern that fires replaces its match with [REDACTED]; multiple
  * matches per string are all replaced.
  */
-export declare function redactString(s: string): string;
+export declare function redactString(s: string, cfg?: RedactionConfig): string;
 /**
  * Fail-closed wrapper. Returns:
  *   - `{ ok: true, redacted }` when redaction succeeded.
@@ -46,6 +82,6 @@ export type RedactionResult<T> = {
     ok: false;
     reason: string;
 };
-export declare function attemptRedactFields(input: Record<string, unknown>): RedactionResult<Record<string, unknown>>;
-export declare function attemptRedactString(s: string): RedactionResult<string>;
+export declare function attemptRedactFields(input: Record<string, unknown>, cfg?: RedactionConfig): RedactionResult<Record<string, unknown>>;
+export declare function attemptRedactString(s: string, cfg?: RedactionConfig): RedactionResult<string>;
 //# sourceMappingURL=redaction.d.ts.map

package/dist/redaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAaA;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAyCnC,CAAC;AAwCX;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUzB;AAYD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAM9C;AAED;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,CAAC,CAAA;CAAE,GACzB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAS1C;AAED,wBAAgB,mBAAmB,CAAC,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAStE"}
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAaA;;;;;;;GAOG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAyCnC,CAAC;AAwCX;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,WAAW,eAAe;IAC9B,uEAAuE;IACvE,QAAQ,CAAC,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACxC,gEAAgE;IAChE,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAuBD;;;;;GAKG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAgBnD;AAOD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAKhD;AAED;;;;;;;;;GASG;AACH,wBAAgB,YAAY,CAC1B,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,GAAG,CAAC,EAAE,eAAe,GACpB,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAGzB;AA2BD;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,eAAe,GAAG,MAAM,CAErE;AAiBD;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,CAAC,CAAC,IACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,CAAC,CAAA;CAAE,GACzB;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElC,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,GAAG,CAAC,EAAE,eAAe,GACpB,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAS1C;AAED,wBAAgB,mBAAmB,CACjC,CAAC,EAAE,MAAM,EACT,GAAG,CAAC,EAAE,eAAe,GACpB,eAAe,CAAC,MAAM,CAAC,CASzB"}

package/dist/redaction.js

@@ -103,6 +103,56 @@ const REGEX_PATTERNS = [
 export function isPiiFieldName(key) {
     return PII_FIELD_SET.has(key.toLowerCase());
 }
+function resolveConfig(cfg) {
+    const extraSet = new Set();
+    if (cfg?.extraPaths) {
+        for (const p of cfg.extraPaths)
+            extraSet.add(p.toLowerCase());
+    }
+    // PAN scrub defaults ON. It only ever masks Luhn-valid runs, so it is
+    // safe to enable by default for the configurable layer.
+    const scrubPan = cfg?.scrubPan ?? true;
+    return { extraSet, scrubPan };
+}
+/**
+ * Luhn checksum. Returns true iff the digit string passes the Luhn
+ * (mod-10) check used by real card PANs. Used by the PAN scrubber so a
+ * non-card digit run (an order id, a phone-less numeric token) is NOT
+ * masked — preventing the over-redaction the loose regex causes.
+ */
+export function isLuhnValid(digits) {
+    if (!/^\d+$/.test(digits) || digits.length < 12 || digits.length > 19) {
+        return false;
+    }
+    let sum = 0;
+    let double = false;
+    for (let i = digits.length - 1; i >= 0; i--) {
+        let d = digits.charCodeAt(i) - 48;
+        if (double) {
+            d *= 2;
+            if (d > 9)
+                d -= 9;
+        }
+        sum += d;
+        double = !double;
+    }
+    return sum % 10 === 0;
+}
+// PAN candidate: 12–19 digits, optionally grouped by single spaces or
+// dashes (the common `4111 1111 1111 1111` / `4111-1111-...` shapes).
+// We extract the bare digits, Luhn-check them, and only mask on a pass.
+const PAN_CANDIDATE_RE = /\b\d(?:[ -]?\d){11,18}\b/g;
+/**
+ * Mask Luhn-valid PAN-shaped digit runs in a string. A run is masked to
+ * `[REDACTED]` ONLY when its bare digits pass `isLuhnValid`; non-Luhn
+ * runs of the same length are left untouched (no over-redaction).
+ */
+export function scrubPanString(s) {
+    return s.replace(PAN_CANDIDATE_RE, (match) => {
+        const bare = match.replace(/[ -]/g, "");
+        return isLuhnValid(bare) ? REDACTED : match;
+    });
+}
 /**
  * Redacts an arbitrary record by replacing values whose keys match the
  * D2 PII list with `[REDACTED]`. Nested records are walked recursively.
@@ -113,26 +163,30 @@ export function isPiiFieldName(key) {
  * object (e.g. circular reference encountered via JSON.stringify
  * elsewhere) the caller wraps this in `attemptRedaction()` to catch.
  */
-export function redactFields(input) {
+export function redactFields(input, cfg) {
+    const resolved = resolveConfig(cfg);
+    return redactFieldsResolved(input, resolved);
+}
+function redactFieldsResolved(input, resolved) {
     const out = {};
     for (const [k, v] of Object.entries(input)) {
-        if (isPiiFieldName(k)) {
+        if (isPiiFieldName(k) || resolved.extraSet.has(k.toLowerCase())) {
             out[k] = REDACTED;
             continue;
         }
-        out[k] = redactValue(v);
+        out[k] = redactValue(v, resolved);
     }
     return out;
 }
-function redactValue(v) {
+function redactValue(v, resolved) {
     if (v === null || v === undefined)
         return v;
     if (typeof v === "string")
-        return redactString(v);
+        return redactStringResolved(v, resolved);
     if (Array.isArray(v))
-        return v.map(redactValue);
+        return v.map((e) => redactValue(e, resolved));
     if (typeof v === "object") {
-        return redactFields(v);
+        return redactFieldsResolved(v, resolved);
     }
     return v;
 }
@@ -141,16 +195,26 @@ function redactValue(v) {
  * Each pattern that fires replaces its match with [REDACTED]; multiple
  * matches per string are all replaced.
  */
-export function redactString(s) {
+export function redactString(s, cfg) {
+    return redactStringResolved(s, resolveConfig(cfg));
+}
+function redactStringResolved(s, resolved) {
     let out = s;
+    // PAN-Luhn scrub runs FIRST: it's stricter than the loose credit_card
+    // regex (Luhn-validated), so masking valid PANs here leaves the regex
+    // pass to catch the remaining looser shapes without double work on the
+    // already-masked bytes.
+    if (resolved.scrubPan) {
+        out = scrubPanString(out);
+    }
     for (const { re } of REGEX_PATTERNS) {
         out = out.replace(re, REDACTED);
     }
     return out;
 }
-export function attemptRedactFields(input) {
+export function attemptRedactFields(input, cfg) {
     try {
-        return { ok: true, redacted: redactFields(input) };
+        return { ok: true, redacted: redactFields(input, cfg) };
     }
     catch (err) {
         return {
@@ -159,9 +223,9 @@ export function attemptRedactFields(input) {
         };
     }
 }
-export function attemptRedactString(s) {
+export function attemptRedactString(s, cfg) {
     try {
-        return { ok: true, redacted: redactString(s) };
+        return { ok: true, redacted: redactString(s, cfg) };
     }
     catch (err) {
         return {

package/dist/redaction.js.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,uDAAuD;AACvD,yCAAyC;AACzC,EAAE;AACF,2DAA2D;AAC3D,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,kEAAkE;AAClE,8BAA8B;AAE9B,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,cAAc;IACd,eAAe;IACf,UAAU;IACV,SAAS;IACT,QAAQ;IACR,aAAa;IACb,eAAe;IACf,YAAY;IACZ,QAAQ;IACR,eAAe;IACf,KAAK;IACL,QAAQ;IACR,KAAK;IACL,SAAS;IACT,aAAa;IACb,aAAa;IACb,KAAK;IACL,MAAM;IACN,gBAAgB;IAChB,gBAAgB;IAChB,OAAO;IACP,cAAc;IACd,QAAQ;IACR,OAAO;IACP,eAAe;IACf,SAAS;IACT,QAAQ;IACR,aAAa;IACb,KAAK;IACL,KAAK;IACL,eAAe;IACf,YAAY;IACZ,WAAW;IACX,WAAW;IACX,UAAU;IACV,iBAAiB;CACT,CAAC;AAEX,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAE3E;;;;;;;GAOG;AACH,MAAM,cAAc,GAA4C;IAC9D,uEAAuE;IACvE;QACE,IAAI,EAAE,KAAK;QACX,EAAE,EAAE,wDAAwD;KAC7D;IACD,wEAAwE;IACxE;QACE,IAAI,EAAE,aAAa;QACnB,EAAE,EAAE,yBAAyB;KAC9B;IACD,mBAAmB;IACnB;QACE,IAAI,EAAE,OAAO;QACb,EAAE,EAAE,mDAAmD;KACxD;IACD,yBAAyB;IACzB;QACE,IAAI,EAAE,KAAK;QACX,EAAE,EAAE,wBAAwB;KAC7B;IACD,6EAA6E;IAC7E;QACE,IAAI,EAAE,YAAY;QAClB,EAAE,EAAE,yBAAyB;KAC9B;CACO,CAAC;AAEX;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,KAA8B;IAE9B,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;YACtB,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC;YAClB,SAAS;QACX,CAAC;QACD,GAAG,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,CAAU;IAC7B,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;IAClD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IAChD,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,YAAY,CAAC,CAA4B,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,cAAc,EAAE,CAAC;QACpC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAeD,MAAM,UAAU,mBAAmB,CACjC,KAA8B;IAE9B,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;IACrD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB;SAC5D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,CAAS;IAC3C,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB;SAC5D,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,uDAAuD;AACvD,yCAAyC;AACzC,EAAE;AACF,2DAA2D;AAC3D,yEAAyE;AACzE,wEAAwE;AACxE,sEAAsE;AACtE,kEAAkE;AAClE,8BAA8B;AAE9B,MAAM,QAAQ,GAAG,YAAY,CAAC;AAE9B;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,UAAU;IACV,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,cAAc;IACd,eAAe;IACf,UAAU;IACV,SAAS;IACT,QAAQ;IACR,aAAa;IACb,eAAe;IACf,YAAY;IACZ,QAAQ;IACR,eAAe;IACf,KAAK;IACL,QAAQ;IACR,KAAK;IACL,SAAS;IACT,aAAa;IACb,aAAa;IACb,KAAK;IACL,MAAM;IACN,gBAAgB;IAChB,gBAAgB;IAChB,OAAO;IACP,cAAc;IACd,QAAQ;IACR,OAAO;IACP,eAAe;IACf,SAAS;IACT,QAAQ;IACR,aAAa;IACb,KAAK;IACL,KAAK;IACL,eAAe;IACf,YAAY;IACZ,WAAW;IACX,WAAW;IACX,UAAU;IACV,iBAAiB;CACT,CAAC;AAEX,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;AAE3E;;;;;;;GAOG;AACH,MAAM,cAAc,GAA4C;IAC9D,uEAAuE;IACvE;QACE,IAAI,EAAE,KAAK;QACX,EAAE,EAAE,wDAAwD;KAC7D;IACD,wEAAwE;IACxE;QACE,IAAI,EAAE,aAAa;QACnB,EAAE,EAAE,yBAAyB;KAC9B;IACD,mBAAmB;IACnB;QACE,IAAI,EAAE,OAAO;QACb,EAAE,EAAE,mDAAmD;KACxD;IACD,yBAAyB;IACzB;QACE,IAAI,EAAE,KAAK;QACX,EAAE,EAAE,wBAAwB;KAC7B;IACD,6EAA6E;IAC7E;QACE,IAAI,EAAE,YAAY;QAClB,EAAE,EAAE,yBAAyB;KAC9B;CACO,CAAC;AAEX;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,OAAO,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AAC9C,CAAC;AAoCD,SAAS,aAAa,CAAC,GAAgC;IACrD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,IAAI,GAAG,EAAE,UAAU,EAAE,CAAC;QACpB,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,UAAU;YAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,sEAAsE;IACtE,wDAAwD;IACxD,MAAM,QAAQ,GAAG,GAAG,EAAE,QAAQ,IAAI,IAAI,CAAC;IACvC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc;IACxC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,IAAI,MAAM,CAAC,MAAM,GAAG,EAAE,EAAE,CAAC;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5C,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QAClC,IAAI,MAAM,EAAE,CAAC;YACX,CAAC,IAAI,CAAC,CAAC;YACP,IAAI,CAAC,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,GAAG,IAAI,CAAC,CAAC;QACT,MAAM,GAAG,CAAC,MAAM,CAAC;IACnB,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAC;AACxB,CAAC;AAED,sEAAsE;AACtE,sEAAsE;AACtE,wEAAwE;AACxE,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAErD;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,OAAO,CAAC,CAAC,OAAO,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACxC,OAAO,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAC1B,KAA8B,EAC9B,GAAqB;IAErB,MAAM,QAAQ,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;IACpC,OAAO,oBAAoB,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAA8B,EAC9B,QAA2B;IAE3B,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3C,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC;YAClB,SAAS;QACX,CAAC;QACD,GAAG,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,WAAW,CAAC,CAAU,EAAE,QAA2B;IAC1D,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,oBAAoB,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpE,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,oBAAoB,CAAC,CAA4B,EAAE,QAAQ,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,CAAS,EAAE,GAAqB;IAC3D,OAAO,oBAAoB,CAAC,CAAC,EAAE,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAS,EAAE,QAA2B;IAClE,IAAI,GAAG,GAAG,CAAC,CAAC;IACZ,sEAAsE;IACtE,sEAAsE;IACtE,uEAAuE;IACvE,wBAAwB;IACxB,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;QACtB,GAAG,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IACD,KAAK,MAAM,EAAE,EAAE,EAAE,IAAI,cAAc,EAAE,CAAC;QACpC,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAeD,MAAM,UAAU,mBAAmB,CACjC,KAA8B,EAC9B,GAAqB;IAErB,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;IAC1D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB;SAC5D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,CAAS,EACT,GAAqB;IAErB,IAAI,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,iBAAiB;SAC5D,CAAC;IACJ,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nodii/telemetry",
-  "version": "0.11.0",
+  "version": "0.13.0",
   "description": "Substrate observability library for the Nodii microservice stack — OTel wrapper, log envelope, intent lifecycle, audit signal, agent registry, context propagation. Spec: planning hub docKey=telemetry.",
   "license": "MIT",
   "type": "module",
@@ -22,6 +22,10 @@
     "./outbox": {
       "types": "./dist/outbox/index.d.ts",
       "default": "./dist/outbox/index.js"
+    },
+    "./lambda": {
+      "types": "./dist/lambda/index.d.ts",
+      "default": "./dist/lambda/index.js"
     }
   },
   "files": [