@private.me/xbind 3.0.0 → 3.0.2

package/dist-standalone/cjs/lazy-init.js

@@ -1 +1,300 @@
-"use strict";Object.defineProperty(exports,"__esModule",{value:!0}),exports.LazyAgent=exports.LazyAgentErrorCode=void 0,exports.createLazyAgent=createLazyAgent;const shared_1=require("../_deps/shared/index.js"),agent_js_1=require("./agent.js"),auto_accept_js_1=require("./auto-accept.js"),trust_registry_js_1=require("./trust-registry.js"),transport_js_1=require("./transport.js"),crypto_utils_js_1=require("./crypto-utils.js");var LazyAgentErrorCode;!function(e){e.INIT_FAILED="LAZY_AGENT_INIT_FAILED",e.AUTO_ACCEPT_FAILED="LAZY_AGENT_AUTO_ACCEPT_FAILED",e.AGENT_CREATION_FAILED="LAZY_AGENT_AGENT_CREATION_FAILED"}(LazyAgentErrorCode||(exports.LazyAgentErrorCode=LazyAgentErrorCode={}));class LazyAgent{config;agent=null;initPromise=null;lastError=null;constructor(e){this.config=e}get did(){if(!this.agent)throw new Error("Agent not initialized. Call send/receive first or await ensureInitialized().");return this.agent.did}isReady(){return null!==this.agent}getLastError(){return this.lastError}async ensureInitialized(){if(this.agent)return(0,shared_1.ok)(this.agent);if(this.initPromise)return this.initPromise;this.initPromise=this.initialize();const e=await this.initPromise;return this.initPromise=null,e.ok?(this.agent=e.value,this.lastError=null):this.lastError={code:LazyAgentErrorCode.INIT_FAILED,message:`Agent initialization failed: ${e.error}`,cause:e.error},e}async initialize(){const e=this.config.inviteCode??this.getEnv("XBIND_INVITE_CODE");let t=this.config.registry,r=this.config.transport;const i=this.config.endpoint??this.getEnv("XBIND_ENDPOINT")??"";if(e){const s=await agent_js_1.Agent.create({name:this.config.name,registry:new trust_registry_js_1.MemoryTrustRegistry,transport:new transport_js_1.HttpsTransportAdapter({baseUrl:"http://localhost"}),postQuantumSig:this.config.postQuantumSig,xchange:this.config.xchange});if(!s.ok)return(0,shared_1.err)(s.error);const n=s.value;if(!(await n.exportSeeds()).ok)return(0,shared_1.err)("IDENTITY_FAILED");const a=(0,crypto_utils_js_1.toBase64)(n.identity.rawPublicKey),o=n.identity.rawX25519PublicKey?(0,crypto_utils_js_1.toBase64)(n.identity.rawX25519PublicKey):void 0,c=await(0,auto_accept_js_1.autoAcceptInvite)({inviteCode:e,enabled:!0,registry:this.config.autoAccept?.registry,inviteApiUrl:this.config.autoAccept?.inviteApiUrl},{name:this.config.name,did:n.did,endpoint:i,publicKey:a,x25519PublicKey:o});return c.ok?(!t&&c.value.registryAutoconfigured&&(t=this.config.autoAccept?.registry??new trust_registry_js_1.MemoryTrustRegistry),r||(r=new transport_js_1.HttpsTransportAdapter({baseUrl:c.value.from.endpoint}))):this.lastError={code:LazyAgentErrorCode.AUTO_ACCEPT_FAILED,message:c.error.message,hint:c.error.hint,cause:c.error},this.agent=n,(0,shared_1.ok)(n)}const s=t??new trust_registry_js_1.MemoryTrustRegistry,n=r??new transport_js_1.HttpsTransportAdapter({baseUrl:i||"http://localhost"}),a=await agent_js_1.Agent.create({name:this.config.name,registry:s,transport:n,postQuantumSig:this.config.postQuantumSig,xchange:this.config.xchange});return a.ok?(this.agent=a.value,(0,shared_1.ok)(this.agent)):(this.lastError={code:LazyAgentErrorCode.AGENT_CREATION_FAILED,message:`Agent creation failed: ${a.error}`,cause:a.error},a)}async send(e){const t=await this.ensureInitialized();return t.ok?t.value.send(e):t}async receive(e,t){const r=await this.ensureInitialized();return r.ok?r.value.receive(e,t):(0,shared_1.err)(r.error)}async receiveSplitShare(e){const t=await this.ensureInitialized();return t.ok?t.value.receiveSplitShare(e):(0,shared_1.err)(t.error)}getEnv(e){return"undefined"!=typeof process&&void 0!==process.env?process.env[e]??"":""}getAgent(){if(!this.agent)throw new Error("Agent not initialized. Call send/receive first or await ensureInitialized().");return this.agent}}function createLazyAgent(e){return new LazyAgent(e)}exports.LazyAgent=LazyAgent;
+"use strict";
+/**
+ * @module lazy-init
+ * Lazy agent initialization for zero-click onboarding.
+ *
+ * Defers invite acceptance and identity generation until first
+ * send/receive call. Enables: `Agent.lazy({ name: 'my-service' })`
+ * with no async/await at construction time.
+ *
+ * @example
+ * ```ts
+ * // Environment: XBIND_INVITE_CODE=XBD-abc123
+ *
+ * // Old way (explicit):
+ * const agent = await Agent.create({ name: 'my-service', registry, transport });
+ *
+ * // New way (lazy):
+ * const agent = Agent.lazy({ name: 'my-service' });
+ * // No await, no async — agent is constructed synchronously.
+ * // Invite auto-accepts on first send/receive:
+ * await agent.send({ to: partnerDid, payload: data, scope: 'test' });
+ * ```
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LazyAgent = exports.LazyAgentErrorCode = void 0;
+exports.createLazyAgent = createLazyAgent;
+const shared_1 = require("../_deps/shared/index.js");
+const agent_js_1 = require("./agent.js");
+const auto_accept_js_1 = require("./auto-accept.js");
+const trust_registry_js_1 = require("./trust-registry.js");
+const transport_js_1 = require("./transport.js");
+const crypto_utils_js_1 = require("./crypto-utils.js");
+/**
+ * Lazy agent error codes.
+ */
+var LazyAgentErrorCode;
+(function (LazyAgentErrorCode) {
+    LazyAgentErrorCode["INIT_FAILED"] = "LAZY_AGENT_INIT_FAILED";
+    LazyAgentErrorCode["AUTO_ACCEPT_FAILED"] = "LAZY_AGENT_AUTO_ACCEPT_FAILED";
+    LazyAgentErrorCode["AGENT_CREATION_FAILED"] = "LAZY_AGENT_AGENT_CREATION_FAILED";
+})(LazyAgentErrorCode || (exports.LazyAgentErrorCode = LazyAgentErrorCode = {}));
+/**
+ * Lazy agent wrapper.
+ *
+ * Proxies all Agent methods and initializes on first call.
+ * Caches the initialized agent for subsequent calls.
+ */
+class LazyAgent {
+    config;
+    agent = null;
+    initPromise = null;
+    lastError = null;
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Get the agent's DID.
+     *
+     * Triggers initialization if not already initialized.
+     * Throws if initialization fails.
+     */
+    get did() {
+        if (!this.agent) {
+            throw new Error('Agent not initialized. Call send/receive first or await ensureInitialized().');
+        }
+        return this.agent.did;
+    }
+    /**
+     * Check if agent is ready (initialized).
+     */
+    isReady() {
+        return this.agent !== null;
+    }
+    /**
+     * Get last initialization error (if any).
+     */
+    getLastError() {
+        return this.lastError;
+    }
+    /**
+     * Ensure agent is initialized.
+     *
+     * Can be called explicitly to trigger init before first send/receive.
+     * Safe to call multiple times — subsequent calls return cached agent.
+     *
+     * @returns Agent instance or error
+     */
+    async ensureInitialized() {
+        // If already initialized, return cached agent
+        if (this.agent) {
+            return (0, shared_1.ok)(this.agent);
+        }
+        // If initialization is in progress, wait for it
+        if (this.initPromise) {
+            return this.initPromise;
+        }
+        // Start initialization
+        this.initPromise = this.initialize();
+        const result = await this.initPromise;
+        // Clear promise after completion (success or failure)
+        this.initPromise = null;
+        if (result.ok) {
+            this.agent = result.value;
+            this.lastError = null;
+        }
+        else {
+            this.lastError = {
+                code: LazyAgentErrorCode.INIT_FAILED,
+                message: `Agent initialization failed: ${result.error}`,
+                cause: result.error,
+            };
+        }
+        return result;
+    }
+    /**
+     * Internal initialization logic.
+     *
+     * 1. Auto-accept invite (if XBIND_INVITE_CODE set)
+     * 2. Create agent identity
+     * 3. Configure registry and transport
+     * 4. Return initialized agent
+     */
+    async initialize() {
+        // Step 1: Attempt auto-accept if invite code is available
+        const inviteCode = this.config.inviteCode ?? this.getEnv('XBIND_INVITE_CODE');
+        let registry = this.config.registry;
+        let transport = this.config.transport;
+        const endpoint = this.config.endpoint ?? this.getEnv('XBIND_ENDPOINT') ?? '';
+        if (inviteCode) {
+            // Create temporary agent to get DID and public key for invite acceptance
+            const tempAgentResult = await agent_js_1.Agent.create({
+                name: this.config.name,
+                registry: new trust_registry_js_1.MemoryTrustRegistry(),
+                transport: new transport_js_1.HttpsTransportAdapter({ baseUrl: 'http://localhost' }), // Placeholder
+                postQuantumSig: this.config.postQuantumSig,
+                xchange: this.config.xchange,
+            });
+            if (!tempAgentResult.ok) {
+                return (0, shared_1.err)(tempAgentResult.error);
+            }
+            const tempAgent = tempAgentResult.value;
+            // Export public key for invite acceptance
+            const seedsResult = await tempAgent.exportSeeds();
+            if (!seedsResult.ok) {
+                return (0, shared_1.err)('IDENTITY_FAILED');
+            }
+            const publicKey = (0, crypto_utils_js_1.toBase64)(tempAgent.identity.rawPublicKey);
+            const x25519PublicKey = tempAgent.identity.rawX25519PublicKey
+                ? (0, crypto_utils_js_1.toBase64)(tempAgent.identity.rawX25519PublicKey)
+                : undefined;
+            // Auto-accept invite
+            const acceptResult = await (0, auto_accept_js_1.autoAcceptInvite)({
+                inviteCode,
+                enabled: true,
+                registry: this.config.autoAccept?.registry,
+                inviteApiUrl: this.config.autoAccept?.inviteApiUrl,
+            }, {
+                name: this.config.name,
+                did: tempAgent.did,
+                endpoint,
+                publicKey,
+                x25519PublicKey,
+            });
+            if (!acceptResult.ok) {
+                this.lastError = {
+                    code: LazyAgentErrorCode.AUTO_ACCEPT_FAILED,
+                    message: acceptResult.error.message,
+                    hint: acceptResult.error.hint,
+                    cause: acceptResult.error,
+                };
+                // Non-fatal: continue with temp agent even if auto-accept fails
+                // (registry may already be configured)
+            }
+            else {
+                // Use auto-configured registry if not provided
+                if (!registry && acceptResult.value.registryAutoconfigured) {
+                    // Registry was already configured by autoAcceptInvite
+                    registry = this.config.autoAccept?.registry ?? new trust_registry_js_1.MemoryTrustRegistry();
+                }
+                // Use inviter's endpoint as default transport if not provided
+                if (!transport) {
+                    transport = new transport_js_1.HttpsTransportAdapter({
+                        baseUrl: acceptResult.value.from.endpoint,
+                    });
+                }
+            }
+            // Return temp agent as initialized agent
+            this.agent = tempAgent;
+            return (0, shared_1.ok)(tempAgent);
+        }
+        // Step 2: No invite code — create agent normally
+        const defaultRegistry = registry ?? new trust_registry_js_1.MemoryTrustRegistry();
+        const defaultTransport = transport ?? new transport_js_1.HttpsTransportAdapter({
+            baseUrl: endpoint || 'http://localhost',
+        });
+        const agentResult = await agent_js_1.Agent.create({
+            name: this.config.name,
+            registry: defaultRegistry,
+            transport: defaultTransport,
+            postQuantumSig: this.config.postQuantumSig,
+            xchange: this.config.xchange,
+        });
+        if (!agentResult.ok) {
+            this.lastError = {
+                code: LazyAgentErrorCode.AGENT_CREATION_FAILED,
+                message: `Agent creation failed: ${agentResult.error}`,
+                cause: agentResult.error,
+            };
+            return agentResult;
+        }
+        this.agent = agentResult.value;
+        return (0, shared_1.ok)(this.agent);
+    }
+    /**
+     * Send a message (proxied to underlying agent).
+     *
+     * Automatically initializes agent on first call.
+     */
+    async send(opts) {
+        const agentResult = await this.ensureInitialized();
+        if (!agentResult.ok) {
+            return agentResult;
+        }
+        return agentResult.value.send(opts);
+    }
+    /**
+     * Receive a message (proxied to underlying agent).
+     *
+     * Automatically initializes agent on first call.
+     */
+    async receive(envelope, opts) {
+        const agentResult = await this.ensureInitialized();
+        if (!agentResult.ok) {
+            return (0, shared_1.err)(agentResult.error);
+        }
+        return agentResult.value.receive(envelope, opts);
+    }
+    /**
+     * Receive a split-channel share (proxied to underlying agent).
+     *
+     * Automatically initializes agent on first call.
+     */
+    async receiveSplitShare(envelope) {
+        const agentResult = await this.ensureInitialized();
+        if (!agentResult.ok) {
+            return (0, shared_1.err)(agentResult.error);
+        }
+        return agentResult.value.receiveSplitShare(envelope);
+    }
+    /**
+     * Get environment variable value.
+     *
+     * @param key - Environment variable name
+     * @returns Environment variable value or empty string
+     */
+    getEnv(key) {
+        // SAFETY: Check for Node.js environment before accessing process
+        if (typeof process !== 'undefined' && typeof process.env !== 'undefined') {
+            return process.env[key] ?? '';
+        }
+        return '';
+    }
+    /**
+     * Export the underlying agent (for advanced use cases).
+     *
+     * Throws if agent is not initialized.
+     */
+    getAgent() {
+        if (!this.agent) {
+            throw new Error('Agent not initialized. Call send/receive first or await ensureInitialized().');
+        }
+        return this.agent;
+    }
+}
+exports.LazyAgent = LazyAgent;
+/**
+ * Create a lazy agent that initializes on first use.
+ *
+ * Extension method for Agent class. Adds `Agent.lazy()` factory.
+ *
+ * @param config - Lazy agent configuration
+ * @returns Lazy agent wrapper
+ *
+ * @example
+ * ```ts
+ * // Environment: XBIND_INVITE_CODE=XBD-abc123
+ *
+ * const agent = createLazyAgent({ name: 'my-service' });
+ *
+ * // No initialization yet — happens on first send:
+ * await agent.send({
+ *   to: 'did:key:z6Mk...',
+ *   payload: { action: 'test' },
+ *   scope: 'test',
+ * });
+ * ```
+ */
+function createLazyAgent(config) {
+    return new LazyAgent(config);
+}

package/dist-standalone/cjs/logger.js

@@ -1 +1,291 @@
-"use strict";var LogLevel;Object.defineProperty(exports,"__esModule",{value:!0}),exports.logger=exports.LogLevel=void 0,exports.createLogger=createLogger,exports.getGlobalLogger=getGlobalLogger,exports.setGlobalLogger=setGlobalLogger,function(e){e[e.DEBUG=0]="DEBUG",e[e.INFO=1]="INFO",e[e.WARN=2]="WARN",e[e.ERROR=3]="ERROR",e[e.SILENT=4]="SILENT"}(LogLevel||(exports.LogLevel=LogLevel={}));const SENSITIVE_PATTERNS={did:/^did:[a-zA-Z0-9]+:/,nonce:/^[a-f0-9]{32,}$|^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/,key:/^[a-zA-Z0-9+/]{40,}={0,2}$|^[a-f0-9]{64,}$/,token:/^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/,email:/^[^\s@]+@[^\s@]+\.[^\s@]+$/,phone:/^\+?[1-9]\d{9,14}$/,apiKey:/^(sk_|pk_|ak_)[a-zA-Z0-9_-]{20,}$/},SENSITIVE_FIELD_NAMES=new Set(["password","secret","apiKey","api_key","privateKey","private_key","accessToken","access_token","refreshToken","refresh_token","masterKey","master_key","encryptionKey","encryption_key","authToken","auth_token","sessionToken","session_token","jwtToken","jwt_token","did","nonce","key","token","seed","entropy"]);function isSensitive(e,t){if("string"!=typeof t)return!1;const o=e.toLowerCase();if(SENSITIVE_FIELD_NAMES.has(o))return!0;for(const[e,n]of Object.entries(SENSITIVE_PATTERNS))if(o.includes(e)&&n.test(t))return!0;return!1}function redactValue(e){if(e.length<=4)return"*".repeat(Math.max(1,e.length));const t=Math.min(4,Math.ceil(e.length/4));return e.substring(0,t)+"*".repeat(Math.max(3,e.length-t-2))+e.substring(e.length-2)}function parseContextForLogging(e){const t=[],o={};for(const[n,r]of Object.entries(e))if(null!=r)if("object"==typeof r)if(r instanceof Error)o[n]={name:r.name,message:r.message};else if(r instanceof Map||r instanceof Set)o[n]=`[${r.constructor.name}]`;else if(Array.isArray(r))o[n]=r.map(e=>"string"==typeof e&&isSensitive(n,e)?(t.push(n),redactValue(e)):e);else{const e=parseContextForLogging(r);o[n]=e.context,e.redacted.length>0&&t.push(...e.redacted.map(e=>`${n}.${e}`))}else"string"==typeof r?isSensitive(n,r)?(t.push(n),o[n]=redactValue(r)):o[n]=r:o[n]="boolean"==typeof r||"number"==typeof r?r:`[${typeof r}]`;else o[n]=r;return{redacted:t,context:o}}function formatLogEntry(e,t,o,n,r){const s={timestamp:n,level:e,message:t};return o&&Object.keys(o).length>0&&(s.context=o),r.length>0&&(s.redacted=r),JSON.stringify(s)}function createLogger(e="default"){let t=LogLevel.INFO;const o=process.env.XAIL_LOG_LEVEL?.toUpperCase();o&&o in LogLevel&&(t=LogLevel[o]);return{debug(t,o){if(!this.isEnabled(LogLevel.DEBUG))return;const n=(new Date).toISOString(),r=o?parseContextForLogging(o):{redacted:[],context:{}},s=formatLogEntry("DEBUG",t,r.context,n,r.redacted);console.debug(`[${e}] ${s}`)},info(t,o){if(!this.isEnabled(LogLevel.INFO))return;const n=(new Date).toISOString(),r=o?parseContextForLogging(o):{redacted:[],context:{}},s=formatLogEntry("INFO",t,r.context,n,r.redacted);console.log(`[${e}] ${s}`)},warn(t,o){if(!this.isEnabled(LogLevel.WARN))return;const n=(new Date).toISOString(),r=o?parseContextForLogging(o):{redacted:[],context:{}},s=formatLogEntry("WARN",t,r.context,n,r.redacted);console.warn(`[${e}] ${s}`)},error(t,o,n){if(!this.isEnabled(LogLevel.ERROR))return;const r=(new Date).toISOString(),s=o?{...o}:{};n instanceof Error?s.error={name:n.name,message:n.message,stack:n.stack}:void 0!==n&&(s.error=n);const a=Object.keys(s).length>0?parseContextForLogging(s):{redacted:[],context:{}},g=formatLogEntry("ERROR",t,a.context,r,a.redacted);console.error(`[${e}] ${g}`)},setLevel(e){t=e},getLevel:()=>t,isEnabled:e=>e>=t}}let globalLogger=null;function getGlobalLogger(){return globalLogger||(globalLogger=createLogger("xbind")),globalLogger}function setGlobalLogger(e){globalLogger=e}exports.logger=getGlobalLogger();
+"use strict";
+/**
+ * @module logger
+ * Structured logging for debugging with context fields and sensitive data redaction
+ *
+ * Provides structured logging with multiple log levels, context tracking,
+ * and automatic redaction of sensitive information like DIDs, keys, and tokens.
+ *
+ * Usage:
+ * ```typescript
+ * import { createLogger } from '@private.me/xbind';
+ *
+ * const logger = createLogger('agent-gateway');
+ *
+ * // Basic logging
+ * logger.info('Agent initialized', { did: 'did:key:z6Mk...' });
+ *
+ * // With context
+ * logger.debug('Processing message', {
+ *   nonce: '12345',
+ *   scope: 'billing',
+ *   encrypted: true
+ * });
+ *
+ * // Errors
+ * logger.error('Authentication failed', { code: 'AUTH_FAILED' }, error);
+ * ```
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.logger = exports.LogLevel = void 0;
+exports.createLogger = createLogger;
+exports.getGlobalLogger = getGlobalLogger;
+exports.setGlobalLogger = setGlobalLogger;
+/**
+ * Log level enumeration
+ */
+var LogLevel;
+(function (LogLevel) {
+    LogLevel[LogLevel["DEBUG"] = 0] = "DEBUG";
+    LogLevel[LogLevel["INFO"] = 1] = "INFO";
+    LogLevel[LogLevel["WARN"] = 2] = "WARN";
+    LogLevel[LogLevel["ERROR"] = 3] = "ERROR";
+    LogLevel[LogLevel["SILENT"] = 4] = "SILENT";
+})(LogLevel || (exports.LogLevel = LogLevel = {}));
+/**
+ * Patterns for detecting sensitive data
+ */
+const SENSITIVE_PATTERNS = {
+    // DIDs: did:key:*, did:web:*, etc.
+    did: /^did:[a-zA-Z0-9]+:/,
+    // Nonces: typically hex strings or UUIDs (32+ hex chars or UUID format)
+    nonce: /^[a-f0-9]{32,}$|^[a-f0-9]{8}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{4}-[a-f0-9]{12}$/,
+    // Keys: base64 or hex strings that look like cryptographic keys (40+ chars)
+    key: /^[a-zA-Z0-9+/]{40,}={0,2}$|^[a-f0-9]{64,}$/,
+    // Tokens: JWT-like or similar
+    token: /^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*$/,
+    // Email addresses
+    email: /^[^\s@]+@[^\s@]+\.[^\s@]+$/,
+    // Phone numbers (at least 10 digits with optional country code)
+    phone: /^\+?[1-9]\d{9,14}$/,
+    // API keys (common prefixes like sk_, pk_, ak_)
+    apiKey: /^(sk_|pk_|ak_)[a-zA-Z0-9_-]{20,}$/,
+};
+/**
+ * Sensitive field names that should always be redacted
+ */
+const SENSITIVE_FIELD_NAMES = new Set([
+    'password',
+    'secret',
+    'apiKey',
+    'api_key',
+    'privateKey',
+    'private_key',
+    'accessToken',
+    'access_token',
+    'refreshToken',
+    'refresh_token',
+    'masterKey',
+    'master_key',
+    'encryptionKey',
+    'encryption_key',
+    'authToken',
+    'auth_token',
+    'sessionToken',
+    'session_token',
+    'jwtToken',
+    'jwt_token',
+    'did',
+    'nonce',
+    'key',
+    'token',
+    'seed',
+    'entropy',
+]);
+/**
+ * Detect if a value is sensitive based on field name or content
+ */
+function isSensitive(fieldName, value) {
+    if (typeof value !== 'string')
+        return false;
+    // Check field name
+    const normalizedName = fieldName.toLowerCase();
+    if (SENSITIVE_FIELD_NAMES.has(normalizedName)) {
+        return true;
+    }
+    // Check content patterns
+    for (const [patternName, pattern] of Object.entries(SENSITIVE_PATTERNS)) {
+        if (normalizedName.includes(patternName) && pattern.test(value)) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Redact sensitive data from a value
+ */
+function redactValue(value) {
+    if (value.length <= 4) {
+        return '*'.repeat(Math.max(1, value.length));
+    }
+    // Show first 4 chars + last 2 chars with redaction in between
+    const shown = Math.min(4, Math.ceil(value.length / 4));
+    return value.substring(0, shown) + '*'.repeat(Math.max(3, value.length - shown - 2)) + value.substring(value.length - 2);
+}
+/**
+ * Recursively redact sensitive data from context
+ */
+function parseContextForLogging(context) {
+    const redacted = [];
+    const processed = {};
+    for (const [key, value] of Object.entries(context)) {
+        if (value === null || value === undefined) {
+            processed[key] = value;
+            continue;
+        }
+        if (typeof value === 'object') {
+            if (value instanceof Error) {
+                // Don't redact error fields - they're diagnostic
+                processed[key] = {
+                    name: value.name,
+                    message: value.message,
+                };
+            }
+            else if (value instanceof Map || value instanceof Set) {
+                processed[key] = `[${value.constructor.name}]`;
+            }
+            else if (Array.isArray(value)) {
+                processed[key] = value.map(v => {
+                    if (typeof v === 'string' && isSensitive(key, v)) {
+                        redacted.push(key);
+                        return redactValue(v);
+                    }
+                    return v;
+                });
+            }
+            else {
+                // Recursively process objects
+                const nested = parseContextForLogging(value);
+                processed[key] = nested.context;
+                if (nested.redacted.length > 0) {
+                    redacted.push(...nested.redacted.map(r => `${key}.${r}`));
+                }
+            }
+        }
+        else if (typeof value === 'string') {
+            if (isSensitive(key, value)) {
+                redacted.push(key);
+                processed[key] = redactValue(value);
+            }
+            else {
+                processed[key] = value;
+            }
+        }
+        else if (typeof value === 'boolean' || typeof value === 'number') {
+            processed[key] = value;
+        }
+        else {
+            // Other types (functions, symbols, etc.)
+            processed[key] = `[${typeof value}]`;
+        }
+    }
+    return { redacted, context: processed };
+}
+/**
+ * Format log entry as JSON string
+ */
+function formatLogEntry(level, message, context, timestamp, redactedFields) {
+    const entry = {
+        timestamp,
+        level,
+        message,
+    };
+    if (context && Object.keys(context).length > 0) {
+        entry.context = context;
+    }
+    if (redactedFields.length > 0) {
+        entry.redacted = redactedFields;
+    }
+    return JSON.stringify(entry);
+}
+/**
+ * Create a logger instance with optional name
+ */
+function createLogger(name = 'default') {
+    let currentLevel = LogLevel.INFO;
+    // Support XAIL_LOG_LEVEL environment variable
+    const envLevel = process.env['XAIL_LOG_LEVEL']?.toUpperCase();
+    if (envLevel && envLevel in LogLevel) {
+        currentLevel = LogLevel[envLevel];
+    }
+    const logger = {
+        debug(message, context) {
+            if (!this.isEnabled(LogLevel.DEBUG))
+                return;
+            const timestamp = new Date().toISOString();
+            const parsed = context ? parseContextForLogging(context) : { redacted: [], context: {} };
+            const entry = formatLogEntry('DEBUG', message, parsed.context, timestamp, parsed.redacted);
+            console.debug(`[${name}] ${entry}`);
+        },
+        info(message, context) {
+            if (!this.isEnabled(LogLevel.INFO))
+                return;
+            const timestamp = new Date().toISOString();
+            const parsed = context ? parseContextForLogging(context) : { redacted: [], context: {} };
+            const entry = formatLogEntry('INFO', message, parsed.context, timestamp, parsed.redacted);
+            console.log(`[${name}] ${entry}`);
+        },
+        warn(message, context) {
+            if (!this.isEnabled(LogLevel.WARN))
+                return;
+            const timestamp = new Date().toISOString();
+            const parsed = context ? parseContextForLogging(context) : { redacted: [], context: {} };
+            const entry = formatLogEntry('WARN', message, parsed.context, timestamp, parsed.redacted);
+            console.warn(`[${name}] ${entry}`);
+        },
+        error(message, context, error) {
+            if (!this.isEnabled(LogLevel.ERROR))
+                return;
+            const timestamp = new Date().toISOString();
+            const contextWithError = context ? { ...context } : {};
+            if (error instanceof Error) {
+                contextWithError.error = {
+                    name: error.name,
+                    message: error.message,
+                    stack: error.stack,
+                };
+            }
+            else if (error !== undefined) {
+                contextWithError.error = error;
+            }
+            const parsed = Object.keys(contextWithError).length > 0
+                ? parseContextForLogging(contextWithError)
+                : { redacted: [], context: {} };
+            const entry = formatLogEntry('ERROR', message, parsed.context, timestamp, parsed.redacted);
+            console.error(`[${name}] ${entry}`);
+        },
+        setLevel(level) {
+            currentLevel = level;
+        },
+        getLevel() {
+            return currentLevel;
+        },
+        isEnabled(level) {
+            return level >= currentLevel;
+        },
+    };
+    return logger;
+}
+/**
+ * Global logger instance (shared across application)
+ */
+let globalLogger = null;
+/**
+ * Get or create global logger
+ */
+function getGlobalLogger() {
+    if (!globalLogger) {
+        globalLogger = createLogger('xbind');
+    }
+    return globalLogger;
+}
+/**
+ * Set global logger instance
+ */
+function setGlobalLogger(logger) {
+    globalLogger = logger;
+}
+/**
+ * Default export for convenience
+ */
+exports.logger = getGlobalLogger();