@onesub/server 0.23.3 → 0.24.0

package/dist/log-format.d.ts

@@ -0,0 +1,68 @@
+/**
+ * Renders a log call into exactly one string.
+ *
+ * Why this module exists, and why it is pure. `logger.ts` holds process-global
+ * state, so anything tested through it needs `setLogger` juggling to keep one test
+ * file from capturing another's output. Every security property below is a property
+ * of a function from arguments to a string, so it belongs somewhere with no state
+ * at all — see `log-format.test.ts`.
+ *
+ * ## The invariant
+ *
+ * **No byte supplied by a caller can begin a line.**
+ *
+ * That is the whole security claim, and it is weaker than "the output contains no
+ * newlines" on purpose. Demanding no newlines at all is what backed this server
+ * into a corner earlier: a stack trace is multi-line by nature and is the main
+ * reason to log an `Error`, so flattening it destroys the thing you wanted. Framing
+ * it as "attacker text may appear inside a record, never at the start of one" keeps
+ * the trace readable *and* makes forgery impossible.
+ *
+ * It holds mechanically: the message and every field value pass through `esc`,
+ * which leaves no line terminator behind, so the only newlines in the result are the
+ * ones this module writes itself as part of `LOG_CONTINUATION`. A forged
+ * `[onesub] admin granted premium to mallory` line cannot be produced.
+ *
+ * `LOG_CONTINUATION` begins with whitespace, which is what Fluent Bit, Loki and
+ * Docker multiline rules already use to join a line to the record above it. And
+ * grepping `[onesub/` still returns one hit per event, not one per stack frame.
+ *
+ * ## Output grammar
+ *
+ * ```text
+ * <message>[ <key>=<value>]*[<CONT><line>]*
+ * ```
+ *
+ * ## Field vocabulary
+ *
+ * Use these names and no synonyms — `userId`, not `user` or `uid`. The point of
+ * moving values out of the message is that an operator can filter on them, and that
+ * is lost the moment the same thing is called three things across 16 files:
+ *
+ *   route · provider · userId · appId · platform · productId · transactionId ·
+ *   originalTransactionId · purchaseToken · orderId · bundleId · packageName ·
+ *   notificationType · status · httpStatus · environment · err
+ *
+ * `err` is reserved: it always routes through the error renderer.
+ *
+ * Messages are static literals. Write `log.warn('bundle id mismatch', { bundleId,
+ * expected })`, never `` log.warn(`mismatch: ${a} !== ${b}`) `` — an interpolated
+ * value is a value that cannot be filtered on, and one that has to be escaped
+ * rather than simply carried.
+ */
+/**
+ * Prefix for every line after the first. Leading whitespace is deliberate: it is
+ * what existing log-shipper multiline rules key on.
+ */
+export declare const LOG_CONTINUATION = "\n    | ";
+/**
+ * Render a whole log call into one string.
+ *
+ * Argument handling is generic rather than a fixed `(message, fields)` shape, and
+ * that is what makes the call-site migration incremental: a site still passing
+ * printf-style varargs renders sensibly, so files can move one PR at a time with no
+ * flag day. Strings join the message, plain objects contribute their entries as
+ * fields, `Error`s go through the error renderer wherever they appear.
+ */
+export declare function formatLogArgs(args: readonly unknown[]): string;
+//# sourceMappingURL=log-format.d.ts.map

package/dist/log-format.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"log-format.d.ts","sourceRoot":"","sources":["../src/log-format.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmDG;AAEH;;;GAGG;AACH,eAAO,MAAM,gBAAgB,aAAa,CAAC;AA+K3C;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,CAgC9D"}

package/dist/logger.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAcnD,wBAAgB,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,IAAI,CAEhE;AAgED,eAAO,MAAM,GAAG,EAAE,YAIjB,CAAC"}
+{"version":3,"file":"logger.d.ts","sourceRoot":"","sources":["../src/logger.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAkCnD,wBAAgB,SAAS,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,IAAI,CAEhE;AAED,eAAO,MAAM,GAAG,EAAE,YAIjB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@onesub/server",
-  "version": "0.23.3",
+  "version": "0.24.0",
   "description": "Server-side receipt validation middleware for react-native-iap. Apple StoreKit 2 + Google Play Billing. One line.",
   "main": "dist/index.cjs",
   "module": "dist/index.js",
@@ -55,7 +55,7 @@
   },
   "license": "MIT",
   "dependencies": {
-    "@onesub/shared": "0.15.0",
+    "@onesub/shared": "0.15.1",
     "jose": "^6.2.3",
     "zod": "^4.4.3"
   },