@withbuddi/buddi 0.1.0-pre.35 → 0.1.0-pre.37

package/node_modules/imapflow/dist/cjs/imap-flow.d.ts

@@ -356,7 +356,7 @@ export declare class ImapFlow extends EventEmitter {
      * Sets flags for a message or message range
      *
      * @param range Range to filter the messages
-     * @param flags Array of flags to set. Only flags that are permitted to set are used, other flags are ignored
+     * @param flags Array of flags to set. Only flags that are permitted to set are used, other flags are ignored. An empty array clears every flag, but a non-empty array with nothing usable in it is refused rather than clearing the message
      * @param options Store options
      * @returns Did the operation succeed or not
      *

package/node_modules/imapflow/dist/cjs/imap-flow.js

@@ -2631,7 +2631,7 @@ class ImapFlow extends node_events_1.EventEmitter {
      * Sets flags for a message or message range
      *
      * @param range Range to filter the messages
-     * @param flags Array of flags to set. Only flags that are permitted to set are used, other flags are ignored
+     * @param flags Array of flags to set. Only flags that are permitted to set are used, other flags are ignored. An empty array clears every flag, but a non-empty array with nothing usable in it is refused rather than clearing the message
      * @param options Store options
      * @returns Did the operation succeed or not
      *

package/node_modules/imapflow/dist/cjs/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "imapflow";
-export declare const version = "2.2.1";
+export declare const version = "2.2.2";
 export declare const homepage = "https://imapflow.com/";

package/node_modules/imapflow/dist/cjs/package-info.js

@@ -3,5 +3,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.homepage = exports.version = exports.name = void 0;
 exports.name = "imapflow";
-exports.version = "2.2.1";
+exports.version = "2.2.2";
 exports.homepage = "https://imapflow.com/";

package/node_modules/imapflow/dist/esm/commands/append.js

@@ -34,10 +34,34 @@ export default async function append(connection, destination, content, flags, id
     let selected = getSelectedMailbox(connection);
     // The selected mailbox when appending to it, false otherwise
     const targetMailbox = selected && comparePaths(connection, selected.path, destination) ? selected : false;
-    // Validate and format flags. Only flags allowed by the mailbox's permanentFlags are included.
+    // Flags are only filtered when a read-write selection of the destination itself says what it
+    // accepts: the permanentFlags of an unrelated mailbox say nothing about the destination, and a
+    // read-only selection reports an empty PERMANENTFLAGS list (Dovecot does), which canUseFlag()
+    // reads as deny-all. Otherwise they go to the server unfiltered and it decides (RFC 9051).
+    const flagSource = targetMailbox && !targetMailbox.readOnly ? targetMailbox : false;
+    const dropped = [];
     flags = (Array.isArray(flags) ? flags : [].concat(flags || []))
-        .map(flag => flag && formatFlag(flag.toString()))
-        .filter((flag) => !!flag && canUseFlag(connection.mailbox, flag));
+        .map(flag => {
+        const formatted = flag && formatFlag(flag.toString());
+        if (!formatted || !canUseFlag(flagSource, formatted)) {
+            if (flag) {
+                dropped.push(flag.toString());
+            }
+            return false;
+        }
+        return formatted;
+    })
+        .filter((flag) => !!flag);
+    // The stored message simply ends up without them, and the caller is told nothing, so leave
+    // a trail for the flags that never reached the server.
+    if (dropped.length) {
+        connection.log.warn({
+            msg: 'Dropped flags the mailbox does not accept',
+            cid: connection.id,
+            path: destination,
+            dropped
+        });
+    }
     // APPEND command format: APPEND <mailbox> [<flags>] [<date-time>] <literal>
     let attributes = [{ type: 'ATOM', value: encodePath(connection, destination) }];
     // Internal date: the date the server should record for this message.

package/node_modules/imapflow/dist/esm/commands/store.js

@@ -28,8 +28,11 @@ export default async function store(connection, range, flags, options) {
     else if (options.silent) {
         operation = `${operation}.SILENT`;
     }
+    // Normalized once: the raw value is also compared below, and a mixed-case 'SET' must not
+    // take the set branch here and the add branch there.
+    const operationName = (options.operation || '').toLowerCase();
     // Prefix determines the operation: none = set (replace), + = add, - = remove
-    switch ((options.operation || '').toLowerCase()) {
+    switch (operationName) {
         case 'set':
             break;
         case 'remove':
@@ -40,20 +43,42 @@ export default async function store(connection, range, flags, options) {
             operation = `+${operation}`;
             break;
     }
-    // Validate each flag: format it (normalize backslash prefix for system flags),
-    // then check if the mailbox's permanentFlags allow it. Removal is always allowed
+    // Only an explicitly empty array asks for every flag to be cleared. A missing value is not
+    // that request, and neither is a 'set' whose flags all get dropped below: either would
+    // compile to "FLAGS ()" and wipe the message instead of storing what was asked for. The
+    // line is drawn at destroying flags, not at fidelity, so a set that keeps some of the
+    // requested flags still runs, as the documented contract for those methods says.
+    const clearAll = operationName === 'set' && Array.isArray(flags) && !flags.length;
+    // permanentFlags lists the IMAP keywords the mailbox accepts and says nothing about Gmail
+    // labels, so it is not consulted for X-GM-LABELS - the same reason an unrelated mailbox's
+    // flags are not consulted for APPEND (issue #415).
+    const flagSource = options.useLabels ? false : mailbox;
+    // Validate each flag: format it (normalize backslash prefix for system flags, reject the
+    // server-owned \Recent), then check that the mailbox allows it. Removal is always allowed
     // since it doesn't require the flag to be in permanentFlags.
+    const dropped = [];
     flags = (Array.isArray(flags) ? flags : [].concat(flags || []))
         .map(flag => {
         let formatted = formatFlag(flag);
-        if (!canUseFlag(mailbox, formatted) && options.operation !== 'remove') {
+        if (!formatted || (!canUseFlag(flagSource, formatted) && operationName !== 'remove')) {
+            dropped.push(flag);
             return false;
         }
         return formatted;
     })
         .filter((flag) => !!flag);
-    // Allow empty flags only for 'set' operation (which clears all flags)
-    if (!flags.length && options.operation !== 'set') {
+    // The caller is told nothing by the boolean this returns, so leave a trail for the flags
+    // that never reached the server.
+    if (dropped.length) {
+        connection.log.warn({
+            msg: 'Dropped flags the mailbox does not accept',
+            cid: connection.id,
+            path: mailbox.path,
+            operation,
+            dropped
+        });
+    }
+    if (!flags.length && !clearAll) {
         return false;
     }
     let attributes = [

package/node_modules/imapflow/dist/esm/imap-flow.d.ts

@@ -356,7 +356,7 @@ export declare class ImapFlow extends EventEmitter {
      * Sets flags for a message or message range
      *
      * @param range Range to filter the messages
-     * @param flags Array of flags to set. Only flags that are permitted to set are used, other flags are ignored
+     * @param flags Array of flags to set. Only flags that are permitted to set are used, other flags are ignored. An empty array clears every flag, but a non-empty array with nothing usable in it is refused rather than clearing the message
      * @param options Store options
      * @returns Did the operation succeed or not
      *

package/node_modules/imapflow/dist/esm/imap-flow.js

@@ -2590,7 +2590,7 @@ export class ImapFlow extends EventEmitter {
      * Sets flags for a message or message range
      *
      * @param range Range to filter the messages
-     * @param flags Array of flags to set. Only flags that are permitted to set are used, other flags are ignored
+     * @param flags Array of flags to set. Only flags that are permitted to set are used, other flags are ignored. An empty array clears every flag, but a non-empty array with nothing usable in it is refused rather than clearing the message
      * @param options Store options
      * @returns Did the operation succeed or not
      *

package/node_modules/imapflow/dist/esm/package-info.d.ts

@@ -1,3 +1,3 @@
 export declare const name = "imapflow";
-export declare const version = "2.2.1";
+export declare const version = "2.2.2";
 export declare const homepage = "https://imapflow.com/";

package/node_modules/imapflow/dist/esm/package-info.js

@@ -1,4 +1,4 @@
 // Generated by scripts/build.js from package.json. Do not edit by hand.
 export const name = "imapflow";
-export const version = "2.2.1";
+export const version = "2.2.2";
 export const homepage = "https://imapflow.com/";

package/node_modules/imapflow/package.json

@@ -1,6 +1,6 @@
 {
     "name": "imapflow",
-    "version": "2.2.1",
+    "version": "2.2.2",
     "description": "IMAP Client for Node",
     "type": "module",
     "main": "./dist/cjs/imap-flow.js",
@@ -70,7 +70,7 @@
     "devDependencies": {
         "@types/node": "20.19.43",
         "c8": "12.0.0",
-        "eslint": "10.11.0",
+        "eslint": "10.12.0",
         "eslint-config-prettier": "10.1.8",
         "globals": "17.13.0",
         "prettier": "3.9.9",
@@ -78,7 +78,7 @@
         "types-node-legacy": "npm:@types/node@20.0.0",
         "typescript": "6.0.3",
         "typescript-eslint": "8.71.0",
-        "wrangler": "4.145.0"
+        "wrangler": "4.147.0"
     },
     "dependencies": {
         "@zone-eu/mailsplit": "5.4.19",
@@ -87,7 +87,7 @@
         "libbase64": "1.3.1",
         "libmime": "5.4.6",
         "libqp": "2.1.2",
-        "pino": "10.3.1",
+        "pino": "10.4.0",
         "socks": "2.8.10"
     },
     "engines": {

package/node_modules/pino/CONTRIBUTING.md

@@ -18,6 +18,10 @@ There are a few basic ground-rules for contributors:
 1. All pull-requests for new features **must** target the `main` branch. PRs to fix bugs in LTS releases are also allowed.
 1. Contributors should attempt to adhere to the prevailing code-style.
 1. 100% code coverage
+1. Pure-AI contributions with no human in the loop are not welcome. Pull
+requests ***MUST*** be opened by a human. Pull requests opened by bots not
+managed by the Pino organization will result in the bot being banned
+from the organization.
 
 ## Releases
 
@@ -27,4 +31,4 @@ Declaring formal releases remains the prerogative of the project maintainer.
 
 This is an experiment and feedback is welcome! This document may also be subject to pull-requests or changes by contributors where you believe you have something valuable to add or change.
 
------------------------------------------
+-----------------------------------------

package/node_modules/pino/LICENSE

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2016-2025 Matteo Collina, David Mark Clements and the Pino contributors listed at <https://github.com/pinojs/pino#the-team> and in the README file.
+Copyright (c) 2016-present Matteo Collina, David Mark Clements and the Pino contributors listed at <https://github.com/pinojs/pino#the-team> and in the README file.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/node_modules/pino/README.md

@@ -31,7 +31,7 @@ Pino is built to run on [Node.js](http://nodejs.org).
 
 ### Bare
 
-Pino works on [Bare](https://github.com/holepunchto/bare) with the [`pino-bare`](https://github.com/pinojs/pino-bare) compatability module.
+Pino works on [Bare](https://github.com/holepunchto/bare) with the [`pino-bare`](https://github.com/pinojs/pino-bare) compatibility module.
 
 ### Pear
 

package/node_modules/pino/SECURITY.md

@@ -16,8 +16,24 @@ Pino trusts the applications using it and the environment that it is running in.
 This includes all the application code, the transport, the filesystem and all
 non-externally provided input.
 
-Pino assumes all objects being logged, `logger.info(obj, message)`, are json-serializable.
-Use the `serializers` and `redact` features to sanitize them.
+Pino assumes all objects being logged, `logger.info(obj, message)`, are JSON-serializable.
+Applications are responsible for the data structures their code constructs and logs,
+including ensuring that their size, depth, breadth, and reference topology can be
+serialized within acceptable CPU, memory, and output-size bounds. Resource exhaustion
+caused by logging an application-constructed data structure is an application-level
+concern. The `depthLimit` and `edgeLimit` options apply only to Pino's fallback
+serializer after `JSON.stringify` throws; they are not general resource limits.
+Use the `serializers` and `redact` features to sanitize logged objects.
+
+Pino also assumes that applications control the top-level keys of logged objects
+and child logger bindings. Do not pass externally supplied objects directly as
+`logger.info(untrustedObject)` or `logger.child(untrustedObject)`. Top-level
+keys are written at the root of the log line and can conflict with Pino fields
+such as `level`, `time`, or `msg`, as well as application or security fields.
+If untrusted data must be logged, place it under an application-controlled key,
+for example `logger.info({ untrusted })` or `logger.child({ untrusted })`, and
+apply appropriate serialization and redaction. As a matter of good security
+hygiene, prefer not to log untrusted data at all unless it is necessary.
 
 Pino is not hardened against external prototype pollution attacks, but we
 will accept a vulnerability if Pino can be misused to cause a prototype pollution.

package/node_modules/pino/browser.js

@@ -1,9 +1,34 @@
 'use strict'
 
 const format = require('quick-format-unescaped')
+const Redact = require('@pinojs/redact')
 
 module.exports = pino
 
+const CENSOR = '[Redacted]'
+
+function handleRedactOpts (opts) {
+  if (Array.isArray(opts)) {
+    return { paths: opts, censor: CENSOR }
+  }
+  const { paths, censor = CENSOR, remove } = opts
+  if (!Array.isArray(paths)) {
+    throw Error('pino – redact must contain an array of strings')
+  }
+  return { paths, censor: remove ? undefined : censor, remove }
+}
+
+function buildRedactFn (redact) {
+  if (!redact) return null
+  const { paths, censor, remove } = handleRedactOpts(redact)
+  return Redact({
+    paths,
+    censor,
+    remove,
+    serialize: false
+  })
+}
+
 const _console = pfGlobalThisOrFallback().console || {}
 const stdSerializers = {
   mapHttpRequest: mock,
@@ -24,6 +49,9 @@ function levelToValue (level, logger) {
 const baseLogFunctionSymbol = Symbol('pino.logFuncs')
 const hierarchySymbol = Symbol('pino.hierarchy')
 
+const ownBindingsSymbol = Symbol('pino.ownBindings')
+const bindingsSymbol = Symbol('pino.bindings')
+
 const logFallbackMap = {
   error: 'log',
   fatal: 'error',
@@ -97,6 +125,8 @@ function pino (opts) {
   // setup root hierarchy entry
   appendChildLogger({}, logger)
 
+  logger[bindingsSymbol] = {}
+
   Object.defineProperty(logger, 'levelVal', {
     get: getLevelVal
   })
@@ -105,6 +135,8 @@ function pino (opts) {
     set: setLevel
   })
 
+  const redactFn = buildRedactFn(opts.redact)
+
   const setOpts = {
     transmit,
     serialize,
@@ -115,7 +147,8 @@ function pino (opts) {
     levels,
     timestamp: getTimeFunction(opts),
     messageKey: opts.messageKey || 'msg',
-    onChild: opts.onChild || noop
+    onChild: opts.onChild || noop,
+    redactFn
   }
   logger.levels = getLevels(opts)
   logger.level = level
@@ -139,6 +172,21 @@ function pino (opts) {
   logger._stdErrSerialize = stdErrSerialize
   logger.child = function (...args) { return child.call(this, setOpts, ...args) }
 
+  logger.bindings = function () {
+    return Object.assign({}, this[bindingsSymbol])
+  }
+
+  logger.setBindings = function (newBindings) {
+    this[ownBindingsSymbol] = Object.assign({}, this[ownBindingsSymbol], newBindings)
+    this[bindingsSymbol] = Object.assign({}, this[bindingsSymbol], newBindings)
+    if (this._logEvent) {
+      this._logEvent.bindings.push(newBindings)
+    }
+    // reassigning the level rebuilds the log functions so the updated
+    // bindings are prepended to subsequent log calls
+    this.level = this._level
+  }
+
   if (transmit) logger._logEvent = createLogEventShape()
 
   function getLevelVal () {
@@ -187,7 +235,13 @@ function pino (opts) {
       this._childLevel = (parent._childLevel | 0) + 1
 
       // make sure bindings are available in the `set` function
-      this.bindings = bindings
+      this[ownBindingsSymbol] = bindings
+
+      this[bindingsSymbol] = Object.assign(
+        {},
+        parent[bindingsSymbol],
+        bindings
+      )
 
       if (childSerializers) {
         this.serializers = childSerializers
@@ -258,16 +312,16 @@ pino.stdTimeFunctions = Object.assign({}, { nullTime, epochTime, unixTime, isoTi
 
 function getBindingChain (logger) {
   const bindings = []
-  if (logger.bindings) {
-    bindings.push(logger.bindings)
+  if (logger[ownBindingsSymbol]) {
+    bindings.push(logger[ownBindingsSymbol])
   }
 
   // traverse up the tree to get all bindings
   let hierarchy = logger[hierarchySymbol]
   while (hierarchy.parent) {
     hierarchy = hierarchy.parent
-    if (hierarchy.logger.bindings) {
-      bindings.push(hierarchy.logger.bindings)
+    if (hierarchy.logger[ownBindingsSymbol]) {
+      bindings.push(hierarchy.logger[ownBindingsSymbol])
     }
   }
 
@@ -393,7 +447,10 @@ function asObject (logger, level, args, ts, opts) {
       }
     }
 
-    const formattedLogObject = logObjectFormatter(logObject)
+    let formattedLogObject = logObjectFormatter(logObject)
+    if (opts.redactFn) {
+      formattedLogObject = opts.redactFn(formattedLogObject)
+    }
     return [formattedLogObject, ...argsCloned]
   } else {
     // deliberate, catching objects, arrays
@@ -405,7 +462,10 @@ function asObject (logger, level, args, ts, opts) {
     } else if (typeof msg === 'string') msg = format(argsCloned.shift(), argsCloned)
     if (msg !== undefined) logObject[opts.messageKey] = msg
 
-    const formattedLogObject = logObjectFormatter(logObject)
+    let formattedLogObject = logObjectFormatter(logObject)
+    if (opts.redactFn) {
+      formattedLogObject = opts.redactFn(formattedLogObject)
+    }
     return [formattedLogObject]
   }
 }

package/node_modules/pino/docs/api.md

@@ -137,13 +137,19 @@ logger.info('hello') // Will throw an error saying info is not found in logger o
 
 Default: `5`
 
-Option to limit stringification at a specific nesting depth when logging circular objects.
+Maximum nesting depth used by Pino's fallback serializer.
 
 #### `edgeLimit` (Number)
 
 Default: `100`
 
-Option to limit stringification of properties/elements when logging a specific object/array with circular references.
+Maximum number of properties/elements per object or array used by Pino's fallback serializer.
+
+Pino uses the fallback serializer, and therefore applies `depthLimit` and `edgeLimit`, only after
+`JSON.stringify` throws. These options are not general limits on serialization work or output size.
+For example, `JSON.stringify` successfully serializes a non-circular object graph that contains
+repeated references to the same object. In that case, every reference is traversed and serialized
+in full, without applying either limit.
 
 <a id="opt-mixin"></a>
 #### `mixin` (Function):
@@ -411,7 +417,7 @@ Changes the shape of the log level. The default shape is `{ level: number }`.
 The function takes two arguments, the label of the level (e.g. `'info'`)
 and the numeric value (e.g. `30`).
 
-ps: The log level cannot be customized when using multiple transports
+When using multiple transport targets, the log record must keep a numeric `level` field for per-target routing. Because of that, `formatters.level` cannot be used to replace `level` with a string or rename it in multi-target mode. `timestamp` customization is still supported.
 
 ```js
 const formatters = {
@@ -465,6 +471,13 @@ in the serializers. The only exception is the `err` serializer as it is also app
 the object is an instance of `Error`, e.g. `logger.info(new Error('kaboom'))`.
 See `errorKey` option to change `err` namespace.
 
+Serializers are also applied to the [bindings passed to `logger.child()`](#logger-child-bindings).
+Child bindings are serialized once, when the child logger is created, so a matching
+serializer runs at that point rather than on every subsequent log call. This is
+deliberate: it allows a child logger to precompute its bindings and stay fast at log
+time. If a serializer needs to run per log call, pass the value to the log method
+instead of to `child()`.
+
 * See [pino.stdSerializers](#pino-stdserializers)
 
 #### `msgPrefix` (String)
@@ -724,6 +737,25 @@ logger.info({MIX: {IN: true}})
 // {"level":30,"time":1531254555820,"pid":55956,"hostname":"x","MIX":{"IN":true}}
 ```
 
+Do not pass an externally supplied object directly as the `mergingObject`.
+Top-level keys are written at the root of the log line and can conflict with
+Pino fields such as `level`, `time`, or `msg`, as well as application or
+security fields. If untrusted data must be logged, place it under an
+application-controlled key:
+
+```js
+// Avoid: user-controlled keys become top-level log fields
+logger.info(untrustedObject)
+
+// Prefer: user-controlled keys are contained under a trusted namespace
+logger.info({ untrusted: untrustedObject })
+```
+
+As a matter of good security hygiene, prefer not to log untrusted data at all
+unless it is necessary. When it is necessary, sanitize and redact it first.
+The same top-level key guidance applies to [`logger.child()` bindings](#logger-child-bindings)
+and [`logger.setBindings()`](#logger-set-bindings).
+
 If the object is of type Error, it is wrapped in an object containing a property err (`{ err: mergingObject }`).
 This allows for a unified error handling flow.
 
@@ -926,6 +958,24 @@ child.info('child!')
 
 The `bindings` object may contain any key except for reserved configuration keys `level` and `serializers`.
 
+Do not pass externally supplied objects directly as child bindings. Binding keys
+are top-level log fields emitted on every log line from the child logger, so
+user-controlled keys can conflict with Pino fields such as `level`, `time`, or
+`msg`, as well as application or security fields. If untrusted data must be
+included in child bindings, place it under an application-controlled key:
+
+```js
+// Avoid: user-controlled keys become top-level fields on every child log line
+const child = logger.child(untrustedObject)
+
+// Prefer: user-controlled keys are contained under a trusted namespace
+const child = logger.child({ untrusted: untrustedObject })
+```
+
+As a matter of good security hygiene, prefer not to log untrusted data at all
+unless it is necessary. When it is necessary, sanitize and redact it first.
+See also [`mergingObject`](#mergingobject) and [`logger.setBindings()`](#logger-set-bindings).
+
 ##### `bindings.serializers` (Object) - DEPRECATED
 
 Use `options.serializers` instead.
@@ -1023,6 +1073,11 @@ Adds to the bindings of this logger instance.
 **Note:** Does not overwrite bindings. Can potentially result in duplicate keys in
 log lines.
 
+Do not pass externally supplied objects directly as bindings. Binding keys are
+top-level log fields and can conflict with Pino fields or application fields.
+If untrusted data must be added, place it under an application-controlled key,
+for example `logger.setBindings({ untrusted })`, and sanitize or redact it first.
+
 * See [`bindings` parameter in `logger.child`](#logger-child-bindings)
 
 <a id="flush"></a>
@@ -1042,8 +1097,14 @@ and safer logging at low demand periods.
 
 If there is a need to wait for the logs to be flushed, a callback should be used.
 
+**Note:** `logger.flush()` does not flush the output of `pino-pretty`. See
+[Flush Limitations with `pino-pretty`](/docs/asynchronous.md) for more details.
+
+**Note:** in the browser this method is a no-op and `cb` is never invoked. See
+[Node.js-only APIs](/docs/browser.md#nodejs-only-apis).
+
 * See [`destination` parameter](#destination)
-* See [Asynchronous Logging ⇗](/docs/asynchronous.md)
+* See [Asynchronous Logging ⇗](./asynchronous.md)
 
 <a id="logger-level"></a>
 ### `logger.level` (String) [Getter/Setter]
@@ -1139,6 +1200,10 @@ register its own serializer upon instantiation the serializers of the parent wil
 
 The logger instance is also an [`EventEmitter ⇗`](https://nodejs.org/dist/latest/docs/api/events.html#events_class_eventemitter)
 
+**Note:** the `EventEmitter` methods are no-ops in the browser, so this event
+never fires there. See
+[Node.js-only APIs](/docs/browser.md#nodejs-only-apis).
+
 A listener function can be attached to a logger via the `level-change` event
 
 The listener is passed five arguments:
@@ -1194,6 +1259,8 @@ Exposes the cumulative `msgPrefix` of the logger.
 Create a Pino Destination instance: a stream-like object with
 significantly more throughput than a standard Node.js stream.
 
+**Note:** this is not available in the browser build. See [Node.js-only APIs](/docs/browser.md#nodejs-only-apis).
+
 ```js
 const pino = require('pino')
 const logger = pino(pino.destination('./my-file'))
@@ -1228,6 +1295,8 @@ A `pino.destination` instance can also be used to reopen closed files
 Create a stream that routes logs to a worker thread that
 wraps around a [Pino Transport](/docs/transports.md).
 
+**Note:** this is not available in the browser build. See [Node.js-only APIs](/docs/browser.md#nodejs-only-apis).
+
 ```js
 const pino = require('pino')
 const transport = pino.transport({
@@ -1348,6 +1417,8 @@ Notes:
 Create a stream composed by multiple destination streams and returns an
 object implementing the [MultiStreamRes](#multistreamres) interface.
 
+**Note:** this is not available in the browser build. See [Node.js-only APIs](/docs/browser.md#nodejs-only-apis).
+
 ```js
 var fs = require('node:fs')
 var pino = require('pino')

package/node_modules/pino/docs/asynchronous.md

@@ -21,9 +21,12 @@ output stream as the messages are generated with a _blocking_ operation.
 
 ### AWS Lambda
 
-Asynchronous logging is disabled by default on AWS Lambda or any other environment
-that modifies `process.stdout`. If forcefully turned on, we recommend calling `dest.flushSync()` at the end
-of each function execution to avoid losing data.
+Asynchronous logging in AWS Lambda functions will tend to cause delayed
+or lost log messages, as logs may not be written to the destination
+before the runtime is frozen.
+
+For Lambda deployments, it's recommended to always use a destination
+with `sync: true`.
 
 ## Caveats
 
@@ -34,6 +37,18 @@ Asynchronous logging has a couple of important caveats:
 * There is a possibility of the most recently buffered log messages being lost
   in case of a system failure, e.g. a power cut.
 
+### Flush Limitations with `pino-pretty`
+
+`logger.flush()` does not flush the output of `pino-pretty` because:
+
+1. **Transport Architecture**: `pino-pretty` runs in a separate worker thread via the transport mechanism.
+
+2. **Cross-Thread Flush**: `logger.flush(cb)` does reach the worker. Since [thread-stream#198](https://github.com/pinojs/thread-stream/pull/198) the worker waits for the shared buffer to be drained, then looks for a flush primitive on the destination the transport returned: `flush`, `flushSync`, or a pending `drain`.
+
+3. **No Flush Primitive**: The stream `pino-pretty` returns exposes none of those. Its buffered `SonicBoom` is reachable only through the internal `pump`, so the worker has nothing to call and acknowledges the flush right away.
+
+This means that even with `logger.flush()`, your formatted logs may not appear immediately. The flush only guarantees that the main thread buffer was written and that the worker drained the shared buffer, not that `pino-pretty` has written its formatted output.
+
 See also:
 
 * [`pino.destination` API](/docs/api.md#pino-destination)