@rapidrest/core 1.14.0 → 2.0.0

package/dist/lib/JWTUtils.js

@@ -1,7 +1,7 @@
 ///////////////////////////////////////////////////////////////////////////////
 // Copyright (C) 2020-2026 Jean-Philippe Steinmetz
 ///////////////////////////////////////////////////////////////////////////////
-import crypto from "crypto";
+import crypto, { KeyObject } from "crypto";
 import jwt from "jsonwebtoken";
 import zlib from "zlib";
 /**
@@ -19,78 +19,161 @@ export var JWTUtilsCompressionMethods;
  */
 export class JWTUtils {
     /**
-     * Throws if `config.secret` looks like an asymmetric (RSA/EC) key but `config.options.algorithms` was not
-     * explicitly restricted. Signing/verifying with an asymmetric key while leaving `algorithms` unset opens the
-     * door to algorithm-confusion attacks (e.g. an attacker forging an HS256 token using the public key as the
-     * HMAC secret). HMAC secrets (plain strings/buffers that aren't PEM-encoded) are unaffected.
+     * Returns `true` if `secret` is a form that is only ever usable as a genuine HMAC secret - a plain
+     * string/Buffer that isn't PEM-encoded, or a `KeyObject` of type `"secret"`. Anything else (a PEM
+     * string/Buffer, an asymmetric `KeyObject`, a `{ key, passphrase }` wrapper, a `GetPublicKeyOrSecret`
+     * callback, a JWK-shaped object, etc.) is *not* considered safe, since it may resolve to a non-secret
+     * (public) value that an attacker could use to forge an HS256/384/512 token.
+     */
+    static isKnownSafeHmacSecret(secret) {
+        const pemPattern = /-----BEGIN [A-Z ]*(PRIVATE|PUBLIC) KEY-----/;
+        if (typeof secret === "string") {
+            return !pemPattern.test(secret);
+        }
+        // `fs.readFileSync()` - the idiomatic way to load a key file - returns a Buffer, not a string, so both
+        // representations must be checked here.
+        if (Buffer.isBuffer(secret)) {
+            return !pemPattern.test(secret.toString("utf8"));
+        }
+        if (secret instanceof KeyObject) {
+            return secret.type === "secret";
+        }
+        return false;
+    }
+    /**
+     * Throws unless `config.secret` is a known-safe plain HMAC secret. Any other secret shape is treated
+     * conservatively as potentially asymmetric (fail closed, rather than only matching a fixed allowlist of
+     * asymmetric shapes seen so far) and requires `config.options.algorithms` to be explicitly set to a list
+     * that does not itself include an HMAC algorithm. Without this, signing/verifying with e.g. an RSA key
+     * while leaving `algorithms` unset - or restricting it to `["RS256", "HS256"]` - opens the door to
+     * algorithm-confusion attacks: an attacker holding only the public half of the key pair can forge a token
+     * by signing it with HS256 using that public value as the HMAC secret.
      *
      * @param config The JWT configuration to validate.
      */
     static assertSafeAlgorithm(config) {
         const secret = config.secret;
-        const pemPattern = /-----BEGIN [A-Z ]*(PRIVATE|PUBLIC) KEY-----/;
-        // `fs.readFileSync()` - the idiomatic way to load a key file - returns a Buffer, not a string, so both
-        // representations must be checked or the guard below is trivially bypassed.
-        const looksAsymmetric = (typeof secret === "string" && pemPattern.test(secret)) ||
-            (Buffer.isBuffer(secret) && pemPattern.test(secret.toString("utf8")));
-        if (looksAsymmetric && (!config.options?.algorithms || config.options.algorithms.length === 0)) {
+        if (JWTUtils.isKnownSafeHmacSecret(secret)) {
+            return;
+        }
+        const algorithms = config.options?.algorithms;
+        if (!algorithms || algorithms.length === 0) {
             throw new Error("config.secret appears to be an asymmetric key. config.options.algorithms must be explicitly set " +
                 "(e.g. ['RS256']) to prevent algorithm-confusion attacks.");
         }
+        if (algorithms.some((alg) => JWTUtils.HMAC_ALGORITHMS.has(alg))) {
+            throw new Error("config.options.algorithms includes an HMAC algorithm (HS256/HS384/HS512) alongside a " +
+                "non-HMAC secret. This would allow an attacker holding the public half of the key to forge " +
+                "tokens via algorithm confusion. Remove HMAC algorithms from config.options.algorithms.");
+        }
     }
     /**
-     * Generates a new JWT token for the given config and user object. The user object must be a valid RapidREST
-     * user.
+     * Returns the key length, in bytes, required by `algorithm` (e.g. 32 for `aes-256-cbc`, 24 for
+     * `aes-192-cbc`), so the scrypt-derived key `deriveKey`/`deriveKeySync` produce always matches whatever
+     * cipher `passwordOptions.algorithm` actually names, instead of a length hard-coded for one specific
+     * algorithm. Throws a clear error for an algorithm Node's `crypto` module doesn't recognize, rather than
+     * letting `createCipheriv`/`createDecipheriv` fail later with an opaque "Invalid key length".
+     */
+    static resolveKeyLength(algorithm) {
+        const info = crypto.getCipherInfo(algorithm);
+        if (!info?.keyLength) {
+            throw new Error(`Unknown or unsupported cipher algorithm: "${algorithm}".`);
+        }
+        return info.keyLength;
+    }
+    /**
+     * Derives a symmetric encryption key from `password`/`salt` for use with `algorithm`.
+     */
+    static deriveKey(password, salt, algorithm) {
+        const keyLength = JWTUtils.resolveKeyLength(algorithm);
+        return new Promise((resolve, reject) => crypto.scrypt(password, salt, keyLength, (err, key) => (err ? reject(err) : resolve(key))));
+    }
+    /**
+     * Synchronous counterpart to `deriveKey()`. **Blocks the event loop** for the duration of the scrypt
+     * derivation (deliberately CPU-expensive, typically tens of milliseconds) - `createTokenSync`/
+     * `decodeTokenSync` should therefore be avoided on a request-handling path when password-based payload
+     * encryption is configured; prefer `createToken`/`decodeToken` there.
+     */
+    static deriveKeySync(password, salt, algorithm) {
+        return crypto.scryptSync(password, salt, JWTUtils.resolveKeyLength(algorithm));
+    }
+    /**
+     * Encrypts `plaintext` for `publicKey` using hybrid encryption: `plaintext` is encrypted with a fresh
+     * AES-256-GCM key, which is itself wrapped with RSA. This avoids `crypto.publicEncrypt`'s fixed plaintext-size
+     * limit (e.g. ~214 bytes for a 2048-bit key with OAEP padding), which a raw JSON user profile easily exceeds.
      *
-     * @param config The JWT configuration to use when generating the token.
-     * @param user The user to encode into the token's payload.
+     * @param publicKey The RSA public key to wrap the AES key with.
+     * @param plaintext The data to encrypt.
+     * @returns The encrypted data, encoded as `<wrapped-key>.<iv>.<authTag>.<ciphertext>`, all base64.
+     */
+    static hybridEncrypt(publicKey, plaintext) {
+        const aesKey = crypto.randomBytes(32);
+        const iv = crypto.randomBytes(12);
+        const cipher = crypto.createCipheriv("aes-256-gcm", aesKey, iv);
+        let ciphertext = cipher.update(plaintext, "utf8", "base64");
+        ciphertext += cipher.final("base64");
+        const authTag = cipher.getAuthTag();
+        const wrappedKey = crypto.publicEncrypt(publicKey, aesKey);
+        return [wrappedKey.toString("base64"), iv.toString("base64"), authTag.toString("base64"), ciphertext].join(".");
+    }
+    /**
+     * Returns the base64-encoded authentication tag for `cipher` if it's an AEAD cipher, otherwise `""`. Rather
+     * than pattern-matching the algorithm name (which only recognizes a fixed list of known AEAD naming
+     * conventions), this asks the cipher itself via `getAuthTag()`, which throws for any non-AEAD cipher - so
+     * any AEAD cipher/alias supported by the current Node/OpenSSL build is handled correctly, including ones
+     * not known when this was last updated.
      */
-    static deriveKey(password, salt) {
-        return new Promise((resolve, reject) => crypto.scrypt(password, salt, 24, (err, key) => (err ? reject(err) : resolve(key))));
+    static getAuthTagIfAEAD(cipher) {
+        try {
+            return cipher.getAuthTag().toString("base64");
+        }
+        catch {
+            return "";
+        }
     }
     /**
-     * Generates a new JWT token for the given config and user object. The user object must be a valid RapidREST
-     * user.
+     * Decrypts data produced by `hybridEncrypt`.
      *
-     * @param config The JWT configuration to use when generating the token.
-     * @param user The user to encode into the token's payload.
+     * @param privateKey The RSA private key to unwrap the AES key with.
+     * @param encoded The encrypted data, as produced by `hybridEncrypt`.
      */
-    static deriveKeySync(password, salt) {
-        return crypto.scryptSync(password, salt, 24);
+    static hybridDecrypt(privateKey, encoded) {
+        const parts = encoded.split(".");
+        // Mirrors the length check `finishPasswordDecryption`'s caller performs for the password-based format:
+        // without it, a malformed `profile` (e.g. from an outdated/different format) throws an untyped
+        // `TypeError` out of `Buffer.from(undefined, ...)` below instead of a clear, identifiable error.
+        if (parts.length !== 4) {
+            throw new Error("Encrypted profile uses an unrecognized or outdated format and cannot be decoded.");
+        }
+        const [wrappedKeyB64, ivB64, authTagB64, ciphertext] = parts;
+        const aesKey = crypto.privateDecrypt(privateKey, Buffer.from(wrappedKeyB64, "base64"));
+        const iv = Buffer.from(ivB64, "base64");
+        const authTag = Buffer.from(authTagB64, "base64");
+        const decipher = crypto.createDecipheriv("aes-256-gcm", aesKey, iv);
+        decipher.setAuthTag(authTag);
+        let decrypted = decipher.update(ciphertext, "base64", "utf8");
+        decrypted += decipher.final("utf8");
+        return decrypted;
     }
-    static async createToken(config, user, data) {
-        // Validate the required config options
+    /**
+     * Builds the signable payload shared by `createToken`/`createTokenSync`: validates `config`/`user`, spreads
+     * `data`, compresses the profile if requested, and - for public-key encryption only, which has no async
+     * dependency - encrypts it. Password-based encryption is left for the caller to finish via
+     * `finishPasswordEncryption()`, since deriving the key is the one step that differs between the sync and
+     * async entry points.
+     */
+    static preparePayload(config, user, data) {
         if (!config.secret) {
             throw new Error("Invalid configuration provided.");
         }
-        // Validate the user object
         if (!user || !user.uid) {
             throw new Error("Invalid or null user object provided.");
         }
         // `data` is spread before `profile` so that a `profile` key present in caller-supplied `data` can never
         // silently override the authoritative, server-derived user profile before signing.
-        let payload = { ...data, profile: JSON.stringify(user) };
-        // Encrypt the profile if desired
-        if (config.payload && config.payload.encrypt) {
-            const payloadOptions = config.payload;
-            if (payloadOptions.public_key) {
-                const keyOptions = payloadOptions;
-                const encrypted = crypto.publicEncrypt(keyOptions.public_key, Buffer.from(payload.profile));
-                payload.profile = encrypted.toString("base64");
-            }
-            else {
-                const pwOtions = payloadOptions;
-                const iv = Buffer.from(pwOtions.iv);
-                const salt = crypto.randomBytes(16);
-                const key = await JWTUtils.deriveKey(pwOtions.password, salt);
-                const cipher = crypto.createCipheriv(pwOtions.algorithm, key, iv);
-                let encrypted = cipher.update(payload.profile, "utf8", "base64");
-                encrypted += cipher.final("base64");
-                payload.profile = salt.toString("base64") + ":" + encrypted;
-            }
-            payload.encryption = true;
-        }
-        // Compress the profile if desired
+        const payload = { ...data, profile: JSON.stringify(user) };
+        // Compress the profile if desired. Done *before* encryption so encryption (and, for RSA, its fixed
+        // plaintext-size limit) operates on the smaller compressed representation rather than the raw JSON.
         if (config.payload && config.payload.compress) {
             if (config.payload.compress === JWTUtilsCompressionMethods.ZLIB) {
                 const buf = Buffer.from(payload.profile, "utf-8");
@@ -98,94 +181,124 @@ export class JWTUtils {
                 payload.compression = "zlib";
             }
         }
-        JWTUtils.assertSafeAlgorithm(config);
-        return jwt.sign(payload, config.secret, config.options);
-    }
-    static createTokenSync(config, user, data) {
-        // Validate the required config options
-        if (!config.secret) {
-            throw new Error("Invalid configuration provided.");
-        }
-        // Validate the user object
-        if (!user || !user.uid) {
-            throw new Error("Invalid or null user object provided.");
-        }
-        // `data` is spread before `profile` so that a `profile` key present in caller-supplied `data` can never
-        // silently override the authoritative, server-derived user profile before signing.
-        let payload = { ...data, profile: JSON.stringify(user) };
-        // Encrypt the profile if desired
+        let passwordOptions;
         if (config.payload && config.payload.encrypt) {
             const payloadOptions = config.payload;
             if (payloadOptions.public_key) {
                 const keyOptions = payloadOptions;
-                const encrypted = crypto.publicEncrypt(keyOptions.public_key, Buffer.from(payload.profile));
-                payload.profile = encrypted.toString("base64");
+                payload.profile = JWTUtils.hybridEncrypt(keyOptions.public_key, payload.profile);
+                payload.encryption = true;
             }
             else {
-                const pwOtions = payloadOptions;
-                const iv = Buffer.from(pwOtions.iv);
-                const salt = crypto.randomBytes(16);
-                const key = JWTUtils.deriveKeySync(pwOtions.password, salt);
-                const cipher = crypto.createCipheriv(pwOtions.algorithm, key, iv);
-                let encrypted = cipher.update(payload.profile, "utf8", "base64");
-                encrypted += cipher.final("base64");
-                payload.profile = salt.toString("base64") + ":" + encrypted;
+                passwordOptions = payloadOptions;
             }
-            payload.encryption = true;
         }
-        // Compress the profile if desired
-        if (config.payload && config.payload.compress) {
-            if (config.payload.compress === JWTUtilsCompressionMethods.ZLIB) {
-                const buf = Buffer.from(payload.profile, "utf-8");
-                payload.profile = zlib.gzipSync(buf).toString("base64");
-                payload.compression = "zlib";
-            }
+        return { payload, passwordOptions };
+    }
+    /** Finishes password-based payload encryption once `key` has been derived (sync or async). */
+    static finishPasswordEncryption(payload, passwordOptions, key, salt) {
+        const iv = Buffer.from(passwordOptions.iv);
+        const cipher = crypto.createCipheriv(passwordOptions.algorithm, key, iv);
+        let encrypted = cipher.update(payload.profile, "utf8", "base64");
+        encrypted += cipher.final("base64");
+        // AEAD ciphers (e.g. aes-256-gcm) require the auth tag to be captured here and verified on decrypt via
+        // setAuthTag(), otherwise decoding throws "Unsupported state or unable to authenticate data" on every
+        // token. `final()` must be called before `getAuthTag()` - the tag isn't available until encryption
+        // has finished.
+        const authTag = JWTUtils.getAuthTagIfAEAD(cipher);
+        payload.profile = salt.toString("base64") + ":" + authTag + ":" + encrypted;
+        payload.encryption = true;
+    }
+    static async createToken(config, user, data) {
+        const { payload, passwordOptions } = JWTUtils.preparePayload(config, user, data);
+        if (passwordOptions) {
+            const salt = crypto.randomBytes(16);
+            const key = await JWTUtils.deriveKey(passwordOptions.password, salt, passwordOptions.algorithm);
+            JWTUtils.finishPasswordEncryption(payload, passwordOptions, key, salt);
         }
         JWTUtils.assertSafeAlgorithm(config);
         return jwt.sign(payload, config.secret, config.options);
     }
     /**
-     * Decodes the given JWT authentication token using the provided configuration. If the token is not valid an
-     * error is thrown with the reason. Returns the encoded user object payload upon success.
-     *
-     * @param config The JWT configuration to use when validating the token.
-     * @param token The JWT token to validate.
-     * @returns The data encoded in the token's payload.
+     * Synchronous counterpart to `createToken()`. **Blocks the event loop** while deriving the encryption key
+     * when password-based payload encryption is configured (see `deriveKeySync`) - prefer `createToken()` on a
+     * request-handling path in that case.
      */
-    static async decodeToken(config, token) {
+    static createTokenSync(config, user, data) {
+        const { payload, passwordOptions } = JWTUtils.preparePayload(config, user, data);
+        if (passwordOptions) {
+            const salt = crypto.randomBytes(16);
+            const key = JWTUtils.deriveKeySync(passwordOptions.password, salt, passwordOptions.algorithm);
+            JWTUtils.finishPasswordEncryption(payload, passwordOptions, key, salt);
+        }
         JWTUtils.assertSafeAlgorithm(config);
-        // Decode the token
-        let payload = jwt.verify(token, config.secret, config.options);
-        // Validate the payload
+        return jwt.sign(payload, config.secret, config.options);
+    }
+    /**
+     * Verifies `token` and prepares its payload for `decodeToken`/`decodeTokenSync`: validates the signature/
+     * shape, and - for private-key decryption only, which has no async dependency - decrypts it in place.
+     * Password-based decryption is left for the caller to finish via `finishPasswordDecryption()`, since
+     * deriving the key is the one step that differs between the sync and async entry points.
+     */
+    static preDecode(config, token) {
+        JWTUtils.assertSafeAlgorithm(config);
+        const payload = jwt.verify(token, config.secret, config.options);
         if (!payload || !payload.profile) {
             throw new Error("Token is invalid or missing data.");
         }
-        // Decompress the payload if desired
-        if (payload.compression === JWTUtilsCompressionMethods.ZLIB) {
-            const buf = Buffer.from(payload.profile, "base64");
-            payload.profile = zlib.gunzipSync(buf).toString("utf-8");
-        }
-        // Decrypt the payload if desired
+        let passwordOptions;
+        let salt;
+        let authTagB64;
+        let encryptedProfile;
+        // Decrypt the payload if desired. Must happen before decompression since compression is applied *before*
+        // encryption when the token is created, so decryption must be undone first.
         if (payload.encryption && config.payload && config.payload.encrypt) {
             const payloadOptions = config.payload;
             if (payloadOptions.private_key) {
                 const keyOptions = payloadOptions;
-                const decrypted = crypto.privateDecrypt(keyOptions.private_key, Buffer.from(payload.profile, "base64"));
-                payload.profile = decrypted.toString("utf8");
+                payload.profile = JWTUtils.hybridDecrypt(keyOptions.private_key, payload.profile);
             }
             else {
-                const pwOtions = payloadOptions;
-                const iv = Buffer.from(pwOtions.iv);
-                const [saltB64, profile] = payload.profile.split(":");
-                const salt = Buffer.from(saltB64, "base64");
-                const key = await JWTUtils.deriveKey(pwOtions.password, salt);
-                const decipher = crypto.createDecipheriv(pwOtions.algorithm, key, iv);
-                let decrypted = decipher.update(profile, "base64", "utf8");
-                decrypted += decipher.final("utf8");
-                payload.profile = decrypted;
+                passwordOptions = payloadOptions;
+                const parts = payload.profile.split(":");
+                // The current format is `<salt>:<authTag>:<ciphertext>` (3 parts). A 2-part `<salt>:<ciphertext>`
+                // payload is the pre-AEAD-auth-tag format from before this method required an auth tag; without
+                // this check, `encryptedProfile` would silently come back `undefined` and decryption would be
+                // skipped, surfacing as an opaque JSON.parse SyntaxError in finalizePayload() instead of a clear
+                // error identifying the actual problem.
+                if (parts.length !== 3) {
+                    throw new Error("Token payload uses an unrecognized or outdated encrypted format and cannot be decoded.");
+                }
+                const [saltB64, tagB64, profile] = parts;
+                salt = Buffer.from(saltB64, "base64");
+                authTagB64 = tagB64;
+                encryptedProfile = profile;
             }
         }
-        // Make sure the profile is an parsed
+        return { payload, passwordOptions, salt, authTagB64, encryptedProfile };
+    }
+    /** Finishes password-based payload decryption once `key` has been derived (sync or async). */
+    static finishPasswordDecryption(payload, passwordOptions, key, encryptedProfile, authTagB64) {
+        const iv = Buffer.from(passwordOptions.iv);
+        const decipher = crypto.createDecipheriv(passwordOptions.algorithm, key, iv);
+        if (authTagB64) {
+            decipher.setAuthTag(Buffer.from(authTagB64, "base64"));
+        }
+        let decrypted = decipher.update(encryptedProfile, "base64", "utf8");
+        decrypted += decipher.final("utf8");
+        payload.profile = decrypted;
+    }
+    /** Decompresses (if applicable) and parses the final payload profile shared by both decode entry points. */
+    static finalizePayload(payload) {
+        if (payload.compression === JWTUtilsCompressionMethods.ZLIB) {
+            const buf = Buffer.from(payload.profile, "base64");
+            // Cap decompressed size against a decompression bomb (a small compressed payload expanding to consume
+            // excessive memory). Requires a validly-signed token, but costs nothing to bound given every other
+            // cache/store in this codebase is similarly size-limited.
+            payload.profile = zlib
+                .gunzipSync(buf, { maxOutputLength: JWTUtils.MAX_DECOMPRESSED_PROFILE_BYTES })
+                .toString("utf-8");
+        }
         payload.profile = JSON.parse(payload.profile);
         return payload;
     }
@@ -197,43 +310,35 @@ export class JWTUtils {
      * @param token The JWT token to validate.
      * @returns The data encoded in the token's payload.
      */
-    static decodeTokenSync(config, token) {
-        JWTUtils.assertSafeAlgorithm(config);
-        // Decode the token
-        let payload = jwt.verify(token, config.secret, config.options);
-        // Validate the payload
-        if (!payload || !payload.profile) {
-            throw new Error("Token is invalid or missing data.");
-        }
-        // Decompress the payload if desired
-        if (payload.compression === JWTUtilsCompressionMethods.ZLIB) {
-            const buf = Buffer.from(payload.profile, "base64");
-            payload.profile = zlib.gunzipSync(buf).toString("utf-8");
+    static async decodeToken(config, token) {
+        const { payload, passwordOptions, salt, authTagB64, encryptedProfile } = JWTUtils.preDecode(config, token);
+        if (passwordOptions && salt && encryptedProfile !== undefined) {
+            const key = await JWTUtils.deriveKey(passwordOptions.password, salt, passwordOptions.algorithm);
+            JWTUtils.finishPasswordDecryption(payload, passwordOptions, key, encryptedProfile, authTagB64);
         }
-        // Decrypt the payload if desired
-        if (payload.encryption && config.payload && config.payload.encrypt) {
-            const payloadOptions = config.payload;
-            if (payloadOptions.private_key) {
-                const keyOptions = payloadOptions;
-                const decrypted = crypto.privateDecrypt(keyOptions.private_key, Buffer.from(payload.profile, "base64"));
-                payload.profile = decrypted.toString("utf8");
-            }
-            else {
-                const pwOtions = payloadOptions;
-                const iv = Buffer.from(pwOtions.iv);
-                const [saltB64, profile] = payload.profile.split(":");
-                const salt = Buffer.from(saltB64, "base64");
-                const key = JWTUtils.deriveKeySync(pwOtions.password, salt);
-                const decipher = crypto.createDecipheriv(pwOtions.algorithm, key, iv);
-                let decrypted = decipher.update(profile, "base64", "utf8");
-                decrypted += decipher.final("utf8");
-                payload.profile = decrypted;
-            }
+        return JWTUtils.finalizePayload(payload);
+    }
+    /**
+     * Synchronous counterpart to `decodeToken()`. **Blocks the event loop** while deriving the decryption key
+     * when password-based payload encryption is configured (see `deriveKeySync`) - prefer `decodeToken()` on a
+     * request-handling path in that case.
+     *
+     * @param config The JWT configuration to use when validating the token.
+     * @param token The JWT token to validate.
+     * @returns The data encoded in the token's payload.
+     */
+    static decodeTokenSync(config, token) {
+        const { payload, passwordOptions, salt, authTagB64, encryptedProfile } = JWTUtils.preDecode(config, token);
+        if (passwordOptions && salt && encryptedProfile !== undefined) {
+            const key = JWTUtils.deriveKeySync(passwordOptions.password, salt, passwordOptions.algorithm);
+            JWTUtils.finishPasswordDecryption(payload, passwordOptions, key, encryptedProfile, authTagB64);
         }
-        // Make sure the profile is an parsed
-        payload.profile = JSON.parse(payload.profile);
-        return payload;
+        return JWTUtils.finalizePayload(payload);
     }
 }
-JWTUtils._parsedKeyCache = new Map();
+/** HMAC algorithm names that must never be permitted alongside a non-HMAC secret (see `assertSafeAlgorithm`). */
+JWTUtils.HMAC_ALGORITHMS = new Set(["HS256", "HS384", "HS512"]);
+/** Maximum size, in bytes, a compressed profile is allowed to decompress to (see `finalizePayload`). Guards
+ * against a decompression bomb - a small compressed payload expanding to consume excessive memory. */
+JWTUtils.MAX_DECOMPRESSED_PROFILE_BYTES = 10 * 1024 * 1024;
 //# sourceMappingURL=JWTUtils.js.map

package/dist/lib/JWTUtils.js.map

@@ -1 +1 @@
-{"version":3,"file":"JWTUtils.js","sourceRoot":"","sources":["../../src/JWTUtils.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAC/E,OAAO,MAAM,MAAM,QAAQ,CAAC;AAC5B,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,IAAI,MAAM,MAAM,CAAC;AAmDxB;;GAEG;AACH,MAAM,CAAN,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IAClC,wCAAwC;IACxC,2CAAa,CAAA;AACjB,CAAC,EAHW,0BAA0B,KAA1B,0BAA0B,QAGrC;AAkFD;;;;GAIG;AACH,MAAM,OAAO,QAAQ;IAGjB;;;;;;;OAOG;IACK,MAAM,CAAC,mBAAmB,CAAC,MAAsB;QACrD,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;QAC7B,MAAM,UAAU,GAAG,6CAA6C,CAAC;QACjE,uGAAuG;QACvG,4EAA4E;QAC5E,MAAM,eAAe,GACjB,CAAC,OAAO,MAAM,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACvD,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,eAAe,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,UAAU,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAC7F,MAAM,IAAI,KAAK,CACX,kGAAkG;gBAC9F,0DAA0D,CACjE,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,SAAS,CAAC,QAAgB,EAAE,IAAY;QACnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CACnC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CACtF,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,aAAa,CAAC,QAAgB,EAAE,IAAY;QACvD,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IACjD,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAsB,EAAE,IAAa,EAAE,IAAU;QAC7E,uCAAuC;QACvC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACvD,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC7D,CAAC;QAED,wGAAwG;QACxG,mFAAmF;QACnF,IAAI,OAAO,GAAQ,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAE9D,iCAAiC;QACjC,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC3C,MAAM,cAAc,GAAQ,MAAM,CAAC,OAAO,CAAC;YAC3C,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAA8B,cAA2C,CAAC;gBAC1F,MAAM,SAAS,GAAW,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBACpG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACJ,MAAM,QAAQ,GAAmC,cAAgD,CAAC;gBAClG,MAAM,EAAE,GAAW,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBACpC,MAAM,GAAG,GAAW,MAAM,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACtE,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBAElE,IAAI,SAAS,GAAW,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACzE,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACpC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,GAAG,SAAS,CAAC;YAChE,CAAC;YACD,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;QAC9B,CAAC;QAED,kCAAkC;QAClC,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,0BAA0B,CAAC,IAAI,EAAE,CAAC;gBAC9D,MAAM,GAAG,GAAW,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC1D,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACxD,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC;YACjC,CAAC;QACL,CAAC;QAED,QAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAsC,CAAC,CAAC;IAC3F,CAAC;IAEM,MAAM,CAAC,eAAe,CAAC,MAAsB,EAAE,IAAa,EAAE,IAAU;QAC3E,uCAAuC;QACvC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACvD,CAAC;QAED,2BAA2B;QAC3B,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC7D,CAAC;QAED,wGAAwG;QACxG,mFAAmF;QACnF,IAAI,OAAO,GAAQ,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAE9D,iCAAiC;QACjC,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC3C,MAAM,cAAc,GAAQ,MAAM,CAAC,OAAO,CAAC;YAC3C,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAA8B,cAA2C,CAAC;gBAC1F,MAAM,SAAS,GAAW,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;gBACpG,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACnD,CAAC;iBAAM,CAAC;gBACJ,MAAM,QAAQ,GAAmC,cAAgD,CAAC;gBAClG,MAAM,EAAE,GAAW,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;gBACpC,MAAM,GAAG,GAAW,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACpE,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBAElE,IAAI,SAAS,GAAW,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACzE,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;gBACpC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,GAAG,SAAS,CAAC;YAChE,CAAC;YACD,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;QAC9B,CAAC;QAED,kCAAkC;QAClC,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,0BAA0B,CAAC,IAAI,EAAE,CAAC;gBAC9D,MAAM,GAAG,GAAW,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC1D,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACxD,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC;YACjC,CAAC;QACL,CAAC;QAED,QAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAsC,CAAC,CAAC;IAC3F,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAsB,EAAE,KAAa;QACjE,QAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACrC,mBAAmB;QACnB,IAAI,OAAO,GAAQ,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAEpE,uBAAuB;QACvB,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACzD,CAAC;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,WAAW,KAAK,0BAA0B,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,GAAG,GAAW,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAiB,EAAE,QAAQ,CAAC,CAAC;YACrE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7D,CAAC;QAED,iCAAiC;QACjC,IAAI,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACjE,MAAM,cAAc,GAAQ,MAAM,CAAC,OAAO,CAAC;YAC3C,IAAI,cAAc,CAAC,WAAW,EAAE,CAAC;gBAC7B,MAAM,UAAU,GAA8B,cAA2C,CAAC;gBAC1F,MAAM,SAAS,GAAW,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAChH,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACJ,MAAM,QAAQ,GAAmC,cAAgD,CAAC;gBAClG,MAAM,EAAE,GAAW,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC5C,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC5C,MAAM,GAAG,GAAW,MAAM,QAAQ,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACtE,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBAEtE,IAAI,SAAS,GAAW,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACnE,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACpC,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;YAChC,CAAC;QACL,CAAC;QAED,qCAAqC;QACrC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE9C,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,eAAe,CAAC,MAAsB,EAAE,KAAa;QAC/D,QAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACrC,mBAAmB;QACnB,IAAI,OAAO,GAAQ,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAEpE,uBAAuB;QACvB,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACzD,CAAC;QAED,oCAAoC;QACpC,IAAI,OAAO,CAAC,WAAW,KAAK,0BAA0B,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,GAAG,GAAW,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAiB,EAAE,QAAQ,CAAC,CAAC;YACrE,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC7D,CAAC;QAED,iCAAiC;QACjC,IAAI,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACjE,MAAM,cAAc,GAAQ,MAAM,CAAC,OAAO,CAAC;YAC3C,IAAI,cAAc,CAAC,WAAW,EAAE,CAAC;gBAC7B,MAAM,UAAU,GAA8B,cAA2C,CAAC;gBAC1F,MAAM,SAAS,GAAW,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC;gBAChH,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACJ,MAAM,QAAQ,GAAmC,cAAgD,CAAC;gBAClG,MAAM,EAAE,GAAW,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;gBAC5C,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACtD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBAC5C,MAAM,GAAG,GAAW,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;gBACpE,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;gBAEtE,IAAI,SAAS,GAAW,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;gBACnE,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;gBACpC,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;YAChC,CAAC;QACL,CAAC;QAED,qCAAqC;QACrC,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAE9C,OAAO,OAAO,CAAC;IACnB,CAAC;;AAxPc,wBAAe,GAAG,IAAI,GAAG,EAAE,CAAC"}
+{"version":3,"file":"JWTUtils.js","sourceRoot":"","sources":["../../src/JWTUtils.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,kDAAkD;AAClD,+EAA+E;AAC/E,OAAO,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AAC3C,OAAO,GAAG,MAAM,cAAc,CAAC;AAC/B,OAAO,IAAI,MAAM,MAAM,CAAC;AAmDxB;;GAEG;AACH,MAAM,CAAN,IAAY,0BAGX;AAHD,WAAY,0BAA0B;IAClC,wCAAwC;IACxC,2CAAa,CAAA;AACjB,CAAC,EAHW,0BAA0B,KAA1B,0BAA0B,QAGrC;AAkFD;;;;GAIG;AACH,MAAM,OAAO,QAAQ;IAOjB;;;;;;OAMG;IACK,MAAM,CAAC,qBAAqB,CAAC,MAAW;QAC5C,MAAM,UAAU,GAAG,6CAA6C,CAAC;QACjE,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC7B,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,uGAAuG;QACvG,wCAAwC;QACxC,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,MAAM,YAAY,SAAS,EAAE,CAAC;YAC9B,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC;QACpC,CAAC;QACD,OAAO,KAAK,CAAC;IACjB,CAAC;IAED;;;;;;;;;;OAUG;IACK,MAAM,CAAC,mBAAmB,CAAC,MAAsB;QACrD,MAAM,MAAM,GAAQ,MAAM,CAAC,MAAM,CAAC;QAClC,IAAI,QAAQ,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,CAAC;YACzC,OAAO;QACX,CAAC;QAED,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,EAAE,UAAU,CAAC;QAC9C,IAAI,CAAC,UAAU,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACX,kGAAkG;gBAC9F,0DAA0D,CACjE,CAAC;QACN,CAAC;QACD,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,IAAI,KAAK,CACX,uFAAuF;gBACnF,4FAA4F;gBAC5F,wFAAwF,CAC/F,CAAC;QACN,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,gBAAgB,CAAC,SAAiB;QAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC7C,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,6CAA6C,SAAS,IAAI,CAAC,CAAC;QAChF,CAAC;QACD,OAAO,IAAI,CAAC,SAAS,CAAC;IAC1B,CAAC;IAED;;OAEG;IACK,MAAM,CAAC,SAAS,CAAC,QAAgB,EAAE,IAAY,EAAE,SAAiB;QACtE,MAAM,SAAS,GAAG,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACvD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,CACnC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAC7F,CAAC;IACN,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,aAAa,CAAC,QAAgB,EAAE,IAAY,EAAE,SAAiB;QAC1E,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,IAAI,EAAE,QAAQ,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC,CAAC;IACnF,CAAC;IAED;;;;;;;;OAQG;IACK,MAAM,CAAC,aAAa,CAAC,SAAiB,EAAE,SAAiB;QAC7D,MAAM,MAAM,GAAW,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC9C,MAAM,EAAE,GAAW,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;QAC1C,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QAChE,IAAI,UAAU,GAAW,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACpE,UAAU,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,OAAO,GAAW,MAAM,CAAC,UAAU,EAAE,CAAC;QAC5C,MAAM,UAAU,GAAW,MAAM,CAAC,aAAa,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACnE,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,UAAU,CAAC,CAAC,IAAI,CACtG,GAAG,CACN,CAAC;IACN,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,gBAAgB,CAAC,MAA8D;QAC1F,IAAI,CAAC;YACD,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClD,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,EAAE,CAAC;QACd,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,aAAa,CAAC,UAAkB,EAAE,OAAe;QAC5D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACjC,uGAAuG;QACvG,+FAA+F;QAC/F,iGAAiG;QACjG,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,kFAAkF,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,CAAC,aAAa,EAAE,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,GAAG,KAAK,CAAC;QAC7D,MAAM,MAAM,GAAW,MAAM,CAAC,cAAc,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC;QAC/F,MAAM,EAAE,GAAW,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAChD,MAAM,OAAO,GAAW,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,EAAE,CAAC,CAAC;QACpE,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,SAAS,GAAW,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACtE,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,SAAS,CAAC;IACrB,CAAC;IAED;;;;;;OAMG;IACK,MAAM,CAAC,cAAc,CACzB,MAAsB,EACtB,IAAa,EACb,IAAU;QAEV,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;YACrB,MAAM,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC;QAC7D,CAAC;QAED,wGAAwG;QACxG,mFAAmF;QACnF,MAAM,OAAO,GAAQ,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAEhE,mGAAmG;QACnG,oGAAoG;QACpG,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC5C,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,0BAA0B,CAAC,IAAI,EAAE,CAAC;gBAC9D,MAAM,GAAG,GAAW,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC1D,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;gBACxD,OAAO,CAAC,WAAW,GAAG,MAAM,CAAC;YACjC,CAAC;QACL,CAAC;QAED,IAAI,eAA2D,CAAC;QAChE,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC3C,MAAM,cAAc,GAAQ,MAAM,CAAC,OAAO,CAAC;YAC3C,IAAI,cAAc,CAAC,UAAU,EAAE,CAAC;gBAC5B,MAAM,UAAU,GAA8B,cAA2C,CAAC;gBAC1F,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;gBACjF,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACJ,eAAe,GAAG,cAAgD,CAAC;YACvE,CAAC;QACL,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IACxC,CAAC;IAED,8FAA8F;IACtF,MAAM,CAAC,wBAAwB,CACnC,OAAY,EACZ,eAA+C,EAC/C,GAAW,EACX,IAAY;QAEZ,MAAM,EAAE,GAAW,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,MAAM,CAAC,cAAc,CAAC,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAEzE,IAAI,SAAS,GAAW,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACzE,SAAS,IAAI,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpC,uGAAuG;QACvG,sGAAsG;QACtG,mGAAmG;QACnG,gBAAgB;QAChB,MAAM,OAAO,GAAW,QAAQ,CAAC,gBAAgB,CAAC,MAA0B,CAAC,CAAC;QAC9E,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,GAAG,OAAO,GAAG,GAAG,GAAG,SAAS,CAAC;QAC5E,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC;IAC9B,CAAC;IAEM,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAsB,EAAE,IAAa,EAAE,IAAU;QAC7E,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,QAAQ,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACjF,IAAI,eAAe,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACpC,MAAM,GAAG,GAAW,MAAM,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;YACxG,QAAQ,CAAC,wBAAwB,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3E,CAAC;QAED,QAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAsC,CAAC,CAAC;IAC3F,CAAC;IAED;;;;OAIG;IACI,MAAM,CAAC,eAAe,CAAC,MAAsB,EAAE,IAAa,EAAE,IAAU;QAC3E,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,GAAG,QAAQ,CAAC,cAAc,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC;QACjF,IAAI,eAAe,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;YACpC,MAAM,GAAG,GAAW,QAAQ,CAAC,aAAa,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;YACtG,QAAQ,CAAC,wBAAwB,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC3E,CAAC;QAED,QAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACrC,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAsC,CAAC,CAAC;IAC3F,CAAC;IAED;;;;;OAKG;IACK,MAAM,CAAC,SAAS,CACpB,MAAsB,EACtB,KAAa;QAQb,QAAQ,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC;QACrC,MAAM,OAAO,GAAQ,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAEtE,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACzD,CAAC;QAED,IAAI,eAA2D,CAAC;QAChE,IAAI,IAAwB,CAAC;QAC7B,IAAI,UAA8B,CAAC;QACnC,IAAI,gBAAoC,CAAC;QAEzC,yGAAyG;QACzG,4EAA4E;QAC5E,IAAI,OAAO,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;YACjE,MAAM,cAAc,GAAQ,MAAM,CAAC,OAAO,CAAC;YAC3C,IAAI,cAAc,CAAC,WAAW,EAAE,CAAC;gBAC7B,MAAM,UAAU,GAA8B,cAA2C,CAAC;gBAC1F,OAAO,CAAC,OAAO,GAAG,QAAQ,CAAC,aAAa,CAAC,UAAU,CAAC,WAAW,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC;YACtF,CAAC;iBAAM,CAAC;gBACJ,eAAe,GAAG,cAAgD,CAAC;gBACnE,MAAM,KAAK,GAAa,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBACnD,kGAAkG;gBAClG,gGAAgG;gBAChG,8FAA8F;gBAC9F,iGAAiG;gBACjG,wCAAwC;gBACxC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACrB,MAAM,IAAI,KAAK,CACX,wFAAwF,CAC3F,CAAC;gBACN,CAAC;gBACD,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC;gBACzC,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;gBACtC,UAAU,GAAG,MAAM,CAAC;gBACpB,gBAAgB,GAAG,OAAO,CAAC;YAC/B,CAAC;QACL,CAAC;QAED,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,CAAC;IAC5E,CAAC;IAED,8FAA8F;IACtF,MAAM,CAAC,wBAAwB,CACnC,OAAY,EACZ,eAA+C,EAC/C,GAAW,EACX,gBAAwB,EACxB,UAA8B;QAE9B,MAAM,EAAE,GAAW,MAAM,CAAC,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,gBAAgB,CAAC,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,EAAE,CAAC,CAAC;QAC7E,IAAI,UAAU,EAAE,CAAC;YACZ,QAA+B,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;QACnF,CAAC;QAED,IAAI,SAAS,GAAW,QAAQ,CAAC,MAAM,CAAC,gBAAgB,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC5E,SAAS,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpC,OAAO,CAAC,OAAO,GAAG,SAAS,CAAC;IAChC,CAAC;IAED,4GAA4G;IACpG,MAAM,CAAC,eAAe,CAAC,OAAY;QACvC,IAAI,OAAO,CAAC,WAAW,KAAK,0BAA0B,CAAC,IAAI,EAAE,CAAC;YAC1D,MAAM,GAAG,GAAW,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAiB,EAAE,QAAQ,CAAC,CAAC;YACrE,sGAAsG;YACtG,mGAAmG;YACnG,0DAA0D;YAC1D,OAAO,CAAC,OAAO,GAAG,IAAI;iBACjB,UAAU,CAAC,GAAG,EAAE,EAAE,eAAe,EAAE,QAAQ,CAAC,8BAA8B,EAAE,CAAC;iBAC7E,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC9C,OAAO,OAAO,CAAC;IACnB,CAAC;IAED;;;;;;;OAOG;IACI,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,MAAsB,EAAE,KAAa;QACjE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3G,IAAI,eAAe,IAAI,IAAI,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAW,MAAM,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;YACxG,QAAQ,CAAC,wBAAwB,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED;;;;;;;;OAQG;IACI,MAAM,CAAC,eAAe,CAAC,MAAsB,EAAE,KAAa;QAC/D,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QAC3G,IAAI,eAAe,IAAI,IAAI,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YAC5D,MAAM,GAAG,GAAW,QAAQ,CAAC,aAAa,CAAC,eAAe,CAAC,QAAQ,EAAE,IAAI,EAAE,eAAe,CAAC,SAAS,CAAC,CAAC;YACtG,QAAQ,CAAC,wBAAwB,CAAC,OAAO,EAAE,eAAe,EAAE,GAAG,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;QACnG,CAAC;QACD,OAAO,QAAQ,CAAC,eAAe,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;;AA9XD,iHAAiH;AACzF,wBAAe,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;AAC/E;sGACsG;AAC9E,uCAA8B,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC"}

package/dist/lib/Logger.js

@@ -3,13 +3,10 @@
 ///////////////////////////////////////////////////////////////////////////////
 import { fileURLToPath } from "url";
 import winston from "winston";
+import { CacheUtils } from "./CacheUtils.js";
 const { format, transports } = winston;
 const { combine, timestamp, printf } = format;
 export const FILENAME = fileURLToPath(import.meta.url).replace(/\\/g, "/");
-// The default stack trace limit (10) is too shallow once a few frames of winston/logform internals are on the
-// stack, causing the real caller frame that `source()` below looks for to be truncated. Widen it so the caller is
-// always captured.
-Error.stackTraceLimit = Math.max(Error.stackTraceLimit, 30);
 export const logFormat = printf((info) => {
     const prefix = info.source ? `[${info.source}] ` : "";
     return `${prefix}${info.timestamp} ${info.level}: ${info.message}`;
@@ -24,7 +21,14 @@ export const logFormat = printf((info) => {
  * call stack in either case.
  */
 export const source = format((info) => {
+    // The default stack trace limit (10) is too shallow once a few frames of winston/logform internals are on
+    // the stack, causing the real caller frame below to be truncated. The limit is widened only for the duration
+    // of this capture (rather than mutated globally for the whole process) so every other `Error` thrown
+    // anywhere in the application doesn't pay the cost of a permanently-widened trace.
+    const originalStackTraceLimit = Error.stackTraceLimit;
+    Error.stackTraceLimit = Math.max(originalStackTraceLimit, 30);
     const stack = new Error().stack?.split("\n") ?? [];
+    Error.stackTraceLimit = originalStackTraceLimit;
     for (const line of stack) {
         if (line.includes(FILENAME) || line.includes("node_modules") || line.includes("node:internal")) {
             continue;
@@ -44,6 +48,11 @@ export const source = format((info) => {
     }
     return info;
 });
+/** Maximum number of distinct `${level}:${file}` logger instances to keep cached. Each `file`-bound entry holds
+ * open file descriptors via winston's `File` transport, so an unbounded cache would leak descriptors indefinitely
+ * for any caller that varies `file` per call (e.g. a per-request or per-session name) instead of reusing a fixed
+ * small set of names. */
+const MAX_CACHED_LOGGERS = 100;
 const _loggerCache = new Map();
 /**
  * Creates (or retrieves a cached) logger with the specified level and file name to output logs to.
@@ -54,18 +63,41 @@ const _loggerCache = new Map();
 export const Logger = function (level = "debug", file = undefined) {
     const cacheKey = `${level}:${file ?? ""}`;
     if (_loggerCache.has(cacheKey)) {
-        return _loggerCache.get(cacheKey);
+        const cached = _loggerCache.get(cacheKey);
+        // Move to the end of the Map's iteration order so a frequently-reused logger isn't evicted (and its
+        // file transport closed, possibly mid-write) ahead of one that's actually gone idle - Map.set() on an
+        // already-present key doesn't reorder it by itself.
+        _loggerCache.delete(cacheKey);
+        _loggerCache.set(cacheKey, cached);
+        return cached;
     }
-    const transport = [new transports.Console()];
+    // `colorize()` wraps `info.level` in ANSI escape codes unconditionally - it doesn't detect whether the
+    // destination is a TTY. It must stay Console-only rather than living in the logger-level `format` below:
+    // winston applies the logger-level format to every transport that doesn't supply its own override -
+    // including the File transports, and any transport a caller adds later via `logger.add()` - so baking
+    // colorize() into it would corrupt on-disk logs and any other attached transport with escape sequences that
+    // break grep/log shippers/aggregators expecting a plain-text level field. The logger-level format is left as
+    // the uncolored base precisely so those other transports still inherit sensible plain-text formatting.
+    const base = combine(format.splat(), format.simple(), timestamp(), source(), logFormat);
+    const transport = [new transports.Console({ format: combine(format.colorize(), base) })];
     if (file) {
         transport.push(new winston.transports.File({ filename: file + "error.log", level: "error" }));
         transport.push(new winston.transports.File({ filename: file + ".log" }));
     }
     const logger = winston.createLogger({
         level,
-        format: combine(format.splat(), format.simple(), format.colorize(), timestamp(), source(), logFormat),
+        format: base,
         transports: transport,
     });
+    if (_loggerCache.size >= MAX_CACHED_LOGGERS) {
+        // Non-null: the size check above guarantees the cache is non-empty, so `.next()` always yields a real key.
+        const oldestKey = _loggerCache.keys().next().value;
+        const oldest = _loggerCache.get(oldestKey);
+        CacheUtils.evictOldest(_loggerCache);
+        // Close the evicted logger's transports so its file descriptors are actually released, not just
+        // dropped from the cache while still held open by winston.
+        oldest?.close?.();
+    }
     _loggerCache.set(cacheKey, logger);
     return logger;
 };