@withbuddi/buddi 0.1.0-pre.37 → 0.1.0-pre.38

package/node_modules/imapflow/dist/esm/search-compiler.js

@@ -1,5 +1,7 @@
 /* eslint no-control-regex:0 */
 import { formatDate, formatFlag, toValidDate, isRev2Active } from './tools.js';
+// Matches any character outside the ASCII range
+const UNICODE_PATTERN = /[^\x00-\x7F]/;
 /**
  * Sets a boolean flag in the IMAP search attributes.
  * Automatically handles UN- prefixing for falsy values.
@@ -35,6 +37,17 @@ let setBoolOpt = (attributes, term, value) => {
  * @returns The joined sequence set string
  */
 let toSequenceValue = (value) => [].concat(value).join(',');
+/**
+ * Builds the token for a search value. A quoted string may only carry 7-bit
+ * characters (RFC 3501 section 9), so a non-ASCII value is sent as a literal;
+ * strict servers reply BAD to UTF-8 inside a quoted string. A literal can not
+ * carry NUL either (CHAR8 is %x01-ff), so such a value stays an ATOM and the
+ * compiler rejects it.
+ *
+ * @param value - The search value
+ * @returns An ATOM token (quoted by the compiler when needed), or a LITERAL token
+ */
+let toSearchValue = (value) => UNICODE_PATTERN.test(value) && !value.includes('\0') ? { type: 'LITERAL', value: Buffer.from(value) } : { type: 'ATOM', value };
 /**
  * Adds a search option with its value(s) to the attributes array.
  * Handles NOT operations and array values.
@@ -51,10 +64,10 @@ let setOpt = (attributes, term, value) => {
     attributes.push({ type: 'ATOM', value: term.toUpperCase() });
     // Handle array values (e.g. HEADER name/value pairs)
     if (Array.isArray(value)) {
-        value.forEach(entry => attributes.push({ type: 'ATOM', value: (entry || '').toString() }));
+        value.forEach(entry => attributes.push(toSearchValue((entry || '').toString())));
     }
     else {
-        attributes.push({ type: 'ATOM', value: value.toString() });
+        attributes.push(toSearchValue(value.toString()));
     }
 };
 /**
@@ -86,8 +99,6 @@ let processDateField = (attributes, term, value) => {
     }
     setOpt(attributes, term, formatted);
 };
-// Pre-compiled regex for better performance
-const UNICODE_PATTERN = /[^\x00-\x7F]/;
 /**
  * Throws a coded search compilation error.
  *
@@ -100,20 +111,13 @@ let fail = (code, message) => {
     throw error;
 };
 /**
- * Checks if a string contains Unicode characters.
- * Used to determine if CHARSET UTF-8 needs to be specified.
+ * Checks whether any search value was compiled into a literal, which only
+ * happens for non-ASCII values and means CHARSET UTF-8 needs to be specified.
  *
- * @param str - String to check
- * @returns True if string contains non-ASCII characters
+ * @param attributes - Compiled search attributes
+ * @returns True if a LITERAL token is present
  */
-let isUnicodeString = (str) => {
-    if (!str || typeof str !== 'string') {
-        return false;
-    }
-    // Regex test is ~3-5x faster than Buffer.byteLength
-    // Matches any character outside ASCII range (0x00-0x7F)
-    return UNICODE_PATTERN.test(str);
-};
+let hasLiteral = (attributes) => attributes.some(attr => (Array.isArray(attr) ? hasLiteral(attr) : attr.type === 'LITERAL'));
 /**
  * Compiles a JavaScript object query into IMAP search command attributes.
  * Supports standard IMAP search criteria and extensions like OBJECTID and Gmail extensions.
@@ -142,8 +146,6 @@ let isUnicodeString = (str) => {
  */
 export const searchCompiler = (connection, query) => {
     const attributes = [];
-    // Track if we need to specify UTF-8 charset
-    let hasUnicode = false;
     /**
      * Recursively walks through the query object and builds IMAP attributes.
      * @param params - Query parameters to process
@@ -233,9 +235,6 @@ export const searchCompiler = (connection, query) => {
                 case 'SUBJECT':
                 case 'TEXT':
                 case 'TO':
-                    if (isUnicodeString(params[term])) {
-                        hasUnicode = true;
-                    }
                     if (params[term]) {
                         setOpt(attributes, term, params[term]);
                     }
@@ -283,9 +282,6 @@ export const searchCompiler = (connection, query) => {
                 case 'GMRAW':
                 case 'GMAILRAW': // alias for GMRAW
                     if (connection.capabilities.has('X-GM-EXT-1')) {
-                        if (isUnicodeString(params[term])) {
-                            hasUnicode = true;
-                        }
                         setOpt(attributes, 'X-GM-RAW', params[term]);
                     }
                     else {
@@ -326,9 +322,6 @@ export const searchCompiler = (connection, query) => {
                         fail('MissingServerExtension', 'Server does not support X-GM-EXT-1 extension required for label search');
                     }
                     let rawQuery = rawParts.join(' ');
-                    if (isUnicodeString(rawQuery)) {
-                        hasUnicode = true;
-                    }
                     setOpt(attributes, 'X-GM-RAW', rawQuery);
                     break;
                 }
@@ -388,9 +381,6 @@ export const searchCompiler = (connection, query) => {
                             if (typeof value !== 'string') {
                                 return;
                             }
-                            if (isUnicodeString(value)) {
-                                hasUnicode = true;
-                            }
                             setOpt(attributes, term, [header.toUpperCase().trim(), value]);
                         });
                     }
@@ -470,7 +460,7 @@ export const searchCompiler = (connection, query) => {
     walk(query);
     // If we encountered Unicode strings and UTF-8 is not already accepted,
     // prepend CHARSET UTF-8 to the search command
-    if (hasUnicode && !connection.enabled.has('UTF8=ACCEPT')) {
+    if (!connection.enabled.has('UTF8=ACCEPT') && hasLiteral(attributes)) {
         attributes.unshift({ type: 'ATOM', value: 'UTF-8' });
         attributes.unshift({ type: 'ATOM', value: 'CHARSET' });
     }

package/node_modules/imapflow/package.json

@@ -1,6 +1,6 @@
 {
     "name": "imapflow",
-    "version": "2.2.2",
+    "version": "2.2.4",
     "description": "IMAP Client for Node",
     "type": "module",
     "main": "./dist/cjs/imap-flow.js",
@@ -87,7 +87,7 @@
         "libbase64": "1.3.1",
         "libmime": "5.4.6",
         "libqp": "2.1.2",
-        "pino": "10.4.0",
+        "pino": "10.3.1",
         "socks": "2.8.10"
     },
     "engines": {

package/node_modules/pino/CONTRIBUTING.md

@@ -18,10 +18,6 @@ There are a few basic ground-rules for contributors:
 1. All pull-requests for new features **must** target the `main` branch. PRs to fix bugs in LTS releases are also allowed.
 1. Contributors should attempt to adhere to the prevailing code-style.
 1. 100% code coverage
-1. Pure-AI contributions with no human in the loop are not welcome. Pull
-requests ***MUST*** be opened by a human. Pull requests opened by bots not
-managed by the Pino organization will result in the bot being banned
-from the organization.
 
 ## Releases
 
@@ -31,4 +27,4 @@ Declaring formal releases remains the prerogative of the project maintainer.
 
 This is an experiment and feedback is welcome! This document may also be subject to pull-requests or changes by contributors where you believe you have something valuable to add or change.
 
------------------------------------------
+-----------------------------------------

package/node_modules/pino/LICENSE

@@ -1,6 +1,6 @@
 The MIT License (MIT)
 
-Copyright (c) 2016-present Matteo Collina, David Mark Clements and the Pino contributors listed at <https://github.com/pinojs/pino#the-team> and in the README file.
+Copyright (c) 2016-2025 Matteo Collina, David Mark Clements and the Pino contributors listed at <https://github.com/pinojs/pino#the-team> and in the README file.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

package/node_modules/pino/README.md

@@ -31,7 +31,7 @@ Pino is built to run on [Node.js](http://nodejs.org).
 
 ### Bare
 
-Pino works on [Bare](https://github.com/holepunchto/bare) with the [`pino-bare`](https://github.com/pinojs/pino-bare) compatibility module.
+Pino works on [Bare](https://github.com/holepunchto/bare) with the [`pino-bare`](https://github.com/pinojs/pino-bare) compatability module.
 
 ### Pear
 

package/node_modules/pino/SECURITY.md

@@ -16,24 +16,8 @@ Pino trusts the applications using it and the environment that it is running in.
 This includes all the application code, the transport, the filesystem and all
 non-externally provided input.
 
-Pino assumes all objects being logged, `logger.info(obj, message)`, are JSON-serializable.
-Applications are responsible for the data structures their code constructs and logs,
-including ensuring that their size, depth, breadth, and reference topology can be
-serialized within acceptable CPU, memory, and output-size bounds. Resource exhaustion
-caused by logging an application-constructed data structure is an application-level
-concern. The `depthLimit` and `edgeLimit` options apply only to Pino's fallback
-serializer after `JSON.stringify` throws; they are not general resource limits.
-Use the `serializers` and `redact` features to sanitize logged objects.
-
-Pino also assumes that applications control the top-level keys of logged objects
-and child logger bindings. Do not pass externally supplied objects directly as
-`logger.info(untrustedObject)` or `logger.child(untrustedObject)`. Top-level
-keys are written at the root of the log line and can conflict with Pino fields
-such as `level`, `time`, or `msg`, as well as application or security fields.
-If untrusted data must be logged, place it under an application-controlled key,
-for example `logger.info({ untrusted })` or `logger.child({ untrusted })`, and
-apply appropriate serialization and redaction. As a matter of good security
-hygiene, prefer not to log untrusted data at all unless it is necessary.
+Pino assumes all objects being logged, `logger.info(obj, message)`, are json-serializable.
+Use the `serializers` and `redact` features to sanitize them.
 
 Pino is not hardened against external prototype pollution attacks, but we
 will accept a vulnerability if Pino can be misused to cause a prototype pollution.

package/node_modules/pino/browser.js

@@ -1,34 +1,9 @@
 'use strict'
 
 const format = require('quick-format-unescaped')
-const Redact = require('@pinojs/redact')
 
 module.exports = pino
 
-const CENSOR = '[Redacted]'
-
-function handleRedactOpts (opts) {
-  if (Array.isArray(opts)) {
-    return { paths: opts, censor: CENSOR }
-  }
-  const { paths, censor = CENSOR, remove } = opts
-  if (!Array.isArray(paths)) {
-    throw Error('pino – redact must contain an array of strings')
-  }
-  return { paths, censor: remove ? undefined : censor, remove }
-}
-
-function buildRedactFn (redact) {
-  if (!redact) return null
-  const { paths, censor, remove } = handleRedactOpts(redact)
-  return Redact({
-    paths,
-    censor,
-    remove,
-    serialize: false
-  })
-}
-
 const _console = pfGlobalThisOrFallback().console || {}
 const stdSerializers = {
   mapHttpRequest: mock,
@@ -49,9 +24,6 @@ function levelToValue (level, logger) {
 const baseLogFunctionSymbol = Symbol('pino.logFuncs')
 const hierarchySymbol = Symbol('pino.hierarchy')
 
-const ownBindingsSymbol = Symbol('pino.ownBindings')
-const bindingsSymbol = Symbol('pino.bindings')
-
 const logFallbackMap = {
   error: 'log',
   fatal: 'error',
@@ -125,8 +97,6 @@ function pino (opts) {
   // setup root hierarchy entry
   appendChildLogger({}, logger)
 
-  logger[bindingsSymbol] = {}
-
   Object.defineProperty(logger, 'levelVal', {
     get: getLevelVal
   })
@@ -135,8 +105,6 @@ function pino (opts) {
     set: setLevel
   })
 
-  const redactFn = buildRedactFn(opts.redact)
-
   const setOpts = {
     transmit,
     serialize,
@@ -147,8 +115,7 @@ function pino (opts) {
     levels,
     timestamp: getTimeFunction(opts),
     messageKey: opts.messageKey || 'msg',
-    onChild: opts.onChild || noop,
-    redactFn
+    onChild: opts.onChild || noop
   }
   logger.levels = getLevels(opts)
   logger.level = level
@@ -172,21 +139,6 @@ function pino (opts) {
   logger._stdErrSerialize = stdErrSerialize
   logger.child = function (...args) { return child.call(this, setOpts, ...args) }
 
-  logger.bindings = function () {
-    return Object.assign({}, this[bindingsSymbol])
-  }
-
-  logger.setBindings = function (newBindings) {
-    this[ownBindingsSymbol] = Object.assign({}, this[ownBindingsSymbol], newBindings)
-    this[bindingsSymbol] = Object.assign({}, this[bindingsSymbol], newBindings)
-    if (this._logEvent) {
-      this._logEvent.bindings.push(newBindings)
-    }
-    // reassigning the level rebuilds the log functions so the updated
-    // bindings are prepended to subsequent log calls
-    this.level = this._level
-  }
-
   if (transmit) logger._logEvent = createLogEventShape()
 
   function getLevelVal () {
@@ -235,13 +187,7 @@ function pino (opts) {
       this._childLevel = (parent._childLevel | 0) + 1
 
       // make sure bindings are available in the `set` function
-      this[ownBindingsSymbol] = bindings
-
-      this[bindingsSymbol] = Object.assign(
-        {},
-        parent[bindingsSymbol],
-        bindings
-      )
+      this.bindings = bindings
 
       if (childSerializers) {
         this.serializers = childSerializers
@@ -312,16 +258,16 @@ pino.stdTimeFunctions = Object.assign({}, { nullTime, epochTime, unixTime, isoTi
 
 function getBindingChain (logger) {
   const bindings = []
-  if (logger[ownBindingsSymbol]) {
-    bindings.push(logger[ownBindingsSymbol])
+  if (logger.bindings) {
+    bindings.push(logger.bindings)
   }
 
   // traverse up the tree to get all bindings
   let hierarchy = logger[hierarchySymbol]
   while (hierarchy.parent) {
     hierarchy = hierarchy.parent
-    if (hierarchy.logger[ownBindingsSymbol]) {
-      bindings.push(hierarchy.logger[ownBindingsSymbol])
+    if (hierarchy.logger.bindings) {
+      bindings.push(hierarchy.logger.bindings)
     }
   }
 
@@ -447,10 +393,7 @@ function asObject (logger, level, args, ts, opts) {
       }
     }
 
-    let formattedLogObject = logObjectFormatter(logObject)
-    if (opts.redactFn) {
-      formattedLogObject = opts.redactFn(formattedLogObject)
-    }
+    const formattedLogObject = logObjectFormatter(logObject)
     return [formattedLogObject, ...argsCloned]
   } else {
     // deliberate, catching objects, arrays
@@ -462,10 +405,7 @@ function asObject (logger, level, args, ts, opts) {
     } else if (typeof msg === 'string') msg = format(argsCloned.shift(), argsCloned)
     if (msg !== undefined) logObject[opts.messageKey] = msg
 
-    let formattedLogObject = logObjectFormatter(logObject)
-    if (opts.redactFn) {
-      formattedLogObject = opts.redactFn(formattedLogObject)
-    }
+    const formattedLogObject = logObjectFormatter(logObject)
     return [formattedLogObject]
   }
 }

package/node_modules/pino/docs/api.md

@@ -137,19 +137,13 @@ logger.info('hello') // Will throw an error saying info is not found in logger o
 
 Default: `5`
 
-Maximum nesting depth used by Pino's fallback serializer.
+Option to limit stringification at a specific nesting depth when logging circular objects.
 
 #### `edgeLimit` (Number)
 
 Default: `100`
 
-Maximum number of properties/elements per object or array used by Pino's fallback serializer.
-
-Pino uses the fallback serializer, and therefore applies `depthLimit` and `edgeLimit`, only after
-`JSON.stringify` throws. These options are not general limits on serialization work or output size.
-For example, `JSON.stringify` successfully serializes a non-circular object graph that contains
-repeated references to the same object. In that case, every reference is traversed and serialized
-in full, without applying either limit.
+Option to limit stringification of properties/elements when logging a specific object/array with circular references.
 
 <a id="opt-mixin"></a>
 #### `mixin` (Function):
@@ -417,7 +411,7 @@ Changes the shape of the log level. The default shape is `{ level: number }`.
 The function takes two arguments, the label of the level (e.g. `'info'`)
 and the numeric value (e.g. `30`).
 
-When using multiple transport targets, the log record must keep a numeric `level` field for per-target routing. Because of that, `formatters.level` cannot be used to replace `level` with a string or rename it in multi-target mode. `timestamp` customization is still supported.
+ps: The log level cannot be customized when using multiple transports
 
 ```js
 const formatters = {
@@ -471,13 +465,6 @@ in the serializers. The only exception is the `err` serializer as it is also app
 the object is an instance of `Error`, e.g. `logger.info(new Error('kaboom'))`.
 See `errorKey` option to change `err` namespace.
 
-Serializers are also applied to the [bindings passed to `logger.child()`](#logger-child-bindings).
-Child bindings are serialized once, when the child logger is created, so a matching
-serializer runs at that point rather than on every subsequent log call. This is
-deliberate: it allows a child logger to precompute its bindings and stay fast at log
-time. If a serializer needs to run per log call, pass the value to the log method
-instead of to `child()`.
-
 * See [pino.stdSerializers](#pino-stdserializers)
 
 #### `msgPrefix` (String)
@@ -737,25 +724,6 @@ logger.info({MIX: {IN: true}})
 // {"level":30,"time":1531254555820,"pid":55956,"hostname":"x","MIX":{"IN":true}}
 ```
 
-Do not pass an externally supplied object directly as the `mergingObject`.
-Top-level keys are written at the root of the log line and can conflict with
-Pino fields such as `level`, `time`, or `msg`, as well as application or
-security fields. If untrusted data must be logged, place it under an
-application-controlled key:
-
-```js
-// Avoid: user-controlled keys become top-level log fields
-logger.info(untrustedObject)
-
-// Prefer: user-controlled keys are contained under a trusted namespace
-logger.info({ untrusted: untrustedObject })
-```
-
-As a matter of good security hygiene, prefer not to log untrusted data at all
-unless it is necessary. When it is necessary, sanitize and redact it first.
-The same top-level key guidance applies to [`logger.child()` bindings](#logger-child-bindings)
-and [`logger.setBindings()`](#logger-set-bindings).
-
 If the object is of type Error, it is wrapped in an object containing a property err (`{ err: mergingObject }`).
 This allows for a unified error handling flow.
 
@@ -958,24 +926,6 @@ child.info('child!')
 
 The `bindings` object may contain any key except for reserved configuration keys `level` and `serializers`.
 
-Do not pass externally supplied objects directly as child bindings. Binding keys
-are top-level log fields emitted on every log line from the child logger, so
-user-controlled keys can conflict with Pino fields such as `level`, `time`, or
-`msg`, as well as application or security fields. If untrusted data must be
-included in child bindings, place it under an application-controlled key:
-
-```js
-// Avoid: user-controlled keys become top-level fields on every child log line
-const child = logger.child(untrustedObject)
-
-// Prefer: user-controlled keys are contained under a trusted namespace
-const child = logger.child({ untrusted: untrustedObject })
-```
-
-As a matter of good security hygiene, prefer not to log untrusted data at all
-unless it is necessary. When it is necessary, sanitize and redact it first.
-See also [`mergingObject`](#mergingobject) and [`logger.setBindings()`](#logger-set-bindings).
-
 ##### `bindings.serializers` (Object) - DEPRECATED
 
 Use `options.serializers` instead.
@@ -1073,11 +1023,6 @@ Adds to the bindings of this logger instance.
 **Note:** Does not overwrite bindings. Can potentially result in duplicate keys in
 log lines.
 
-Do not pass externally supplied objects directly as bindings. Binding keys are
-top-level log fields and can conflict with Pino fields or application fields.
-If untrusted data must be added, place it under an application-controlled key,
-for example `logger.setBindings({ untrusted })`, and sanitize or redact it first.
-
 * See [`bindings` parameter in `logger.child`](#logger-child-bindings)
 
 <a id="flush"></a>
@@ -1097,14 +1042,8 @@ and safer logging at low demand periods.
 
 If there is a need to wait for the logs to be flushed, a callback should be used.
 
-**Note:** `logger.flush()` does not flush the output of `pino-pretty`. See
-[Flush Limitations with `pino-pretty`](/docs/asynchronous.md) for more details.
-
-**Note:** in the browser this method is a no-op and `cb` is never invoked. See
-[Node.js-only APIs](/docs/browser.md#nodejs-only-apis).
-
 * See [`destination` parameter](#destination)
-* See [Asynchronous Logging ⇗](./asynchronous.md)
+* See [Asynchronous Logging ⇗](/docs/asynchronous.md)
 
 <a id="logger-level"></a>
 ### `logger.level` (String) [Getter/Setter]
@@ -1200,10 +1139,6 @@ register its own serializer upon instantiation the serializers of the parent wil
 
 The logger instance is also an [`EventEmitter ⇗`](https://nodejs.org/dist/latest/docs/api/events.html#events_class_eventemitter)
 
-**Note:** the `EventEmitter` methods are no-ops in the browser, so this event
-never fires there. See
-[Node.js-only APIs](/docs/browser.md#nodejs-only-apis).
-
 A listener function can be attached to a logger via the `level-change` event
 
 The listener is passed five arguments:
@@ -1259,8 +1194,6 @@ Exposes the cumulative `msgPrefix` of the logger.
 Create a Pino Destination instance: a stream-like object with
 significantly more throughput than a standard Node.js stream.
 
-**Note:** this is not available in the browser build. See [Node.js-only APIs](/docs/browser.md#nodejs-only-apis).
-
 ```js
 const pino = require('pino')
 const logger = pino(pino.destination('./my-file'))
@@ -1295,8 +1228,6 @@ A `pino.destination` instance can also be used to reopen closed files
 Create a stream that routes logs to a worker thread that
 wraps around a [Pino Transport](/docs/transports.md).
 
-**Note:** this is not available in the browser build. See [Node.js-only APIs](/docs/browser.md#nodejs-only-apis).
-
 ```js
 const pino = require('pino')
 const transport = pino.transport({
@@ -1417,8 +1348,6 @@ Notes:
 Create a stream composed by multiple destination streams and returns an
 object implementing the [MultiStreamRes](#multistreamres) interface.
 
-**Note:** this is not available in the browser build. See [Node.js-only APIs](/docs/browser.md#nodejs-only-apis).
-
 ```js
 var fs = require('node:fs')
 var pino = require('pino')

package/node_modules/pino/docs/asynchronous.md

@@ -21,12 +21,9 @@ output stream as the messages are generated with a _blocking_ operation.
 
 ### AWS Lambda
 
-Asynchronous logging in AWS Lambda functions will tend to cause delayed
-or lost log messages, as logs may not be written to the destination
-before the runtime is frozen.
-
-For Lambda deployments, it's recommended to always use a destination
-with `sync: true`.
+Asynchronous logging is disabled by default on AWS Lambda or any other environment
+that modifies `process.stdout`. If forcefully turned on, we recommend calling `dest.flushSync()` at the end
+of each function execution to avoid losing data.
 
 ## Caveats
 
@@ -37,18 +34,6 @@ Asynchronous logging has a couple of important caveats:
 * There is a possibility of the most recently buffered log messages being lost
   in case of a system failure, e.g. a power cut.
 
-### Flush Limitations with `pino-pretty`
-
-`logger.flush()` does not flush the output of `pino-pretty` because:
-
-1. **Transport Architecture**: `pino-pretty` runs in a separate worker thread via the transport mechanism.
-
-2. **Cross-Thread Flush**: `logger.flush(cb)` does reach the worker. Since [thread-stream#198](https://github.com/pinojs/thread-stream/pull/198) the worker waits for the shared buffer to be drained, then looks for a flush primitive on the destination the transport returned: `flush`, `flushSync`, or a pending `drain`.
-
-3. **No Flush Primitive**: The stream `pino-pretty` returns exposes none of those. Its buffered `SonicBoom` is reachable only through the internal `pump`, so the worker has nothing to call and acknowledges the flush right away.
-
-This means that even with `logger.flush()`, your formatted logs may not appear immediately. The flush only guarantees that the main thread buffer was written and that the worker drained the shared buffer, not that `pino-pretty` has written its formatted output.
-
 See also:
 
 * [`pino.destination` API](/docs/api.md#pino-destination)

package/node_modules/pino/docs/browser.md

@@ -7,69 +7,6 @@ This can be useful with isomorphic/universal JavaScript code.
 By default, in the browser,
 `pino` uses corresponding [Log4j](https://en.wikipedia.org/wiki/Log4j) `console` methods (`console.error`, `console.warn`, `console.info`, `console.debug`, `console.trace`) and uses `console.error` for any `fatal` level logs.
 
-<a id="nodejs-only-apis"></a>
-## Node.js-only APIs
-
-The browser build (`browser.js`, selected through the `browser` field in
-`package.json`) does not implement the parts of the API that depend on the file
-system or on worker threads. Accessing them in the browser throws a
-`TypeError`, because the export is simply absent:
-
-```js
-const pino = require('pino')
-pino.destination('./my-file') // TypeError: pino.destination is not a function
-```
-
-The following statics are available in Node.js only:
-
-| Static | Why it is Node.js only |
-| --- | --- |
-| [`pino.destination()`](/docs/api.md#pino-destination) | Returns a [`SonicBoom`](https://github.com/pinojs/sonic-boom) instance writing to a file descriptor. |
-| [`pino.transport()`](/docs/api.md#pino-transport) | Runs a [transport](/docs/transports.md) on a worker thread. |
-| [`pino.multistream()`](/docs/api.md#pino-multistream) | Fans out to multiple destination streams. |
-
-`pino.levels`, `pino.stdSerializers` and `pino.stdTimeFunctions` are available in
-both environments.
-
-### Methods that are no-ops in the browser
-
-These exist on a browser logger, so calling them is safe, but they do nothing:
-
-* [`logger.flush([cb])`](/docs/api.md#flush) — there is no write buffer
-  to flush. Note that a callback passed to it is **not** invoked.
-* Every `EventEmitter` method (`on`, `once`, `emit`, `removeListener`,
-  `listeners`, ...). As a consequence the
-  [`level-change`](/docs/api.md#level-change) event never fires in the
-  browser.
-
-### Writing isomorphic code
-
-Code shared between a server and a browser bundle should not call the Node.js
-only statics unconditionally. Guard the call rather than the environment, so the
-same branch works under any bundler:
-
-```js
-const pino = require('pino')
-
-const logger = pino.destination
-  ? pino(pino.destination('./my-file')) // Node.js
-  : pino({ browser: { asObject: true } }) // browser
-```
-
-Note that the browser build's `pino()` accepts the options object only. A second
-`destination` argument is accepted but ignored, so a logger constructed with one
-still writes to the console rather than failing:
-
-```js
-// in the browser the second argument is ignored, not honoured
-const logger = pino({ level: 'info' }, someDestination)
-logger.info('still goes to the console')
-```
-
-Assigning a no-op shim onto the `pino` export (`pino.destination = () => {}`)
-works too, but it mutates a module object shared with every other importer in the
-bundle; guarding the call site keeps the change local.
-
 ## Options
 
 Pino can be passed a `browser` object in the options object,

package/node_modules/pino/docs/child-loggers.md

@@ -20,26 +20,6 @@ module.exports = {
 }
 ```
 
-Child logger bindings are top-level fields on every log line emitted by the
-child logger. Do not create child loggers from externally supplied objects or
-user-controlled binding names, because those keys can conflict with Pino fields
-such as `level`, `time`, or `msg`, as well as application or security fields.
-If untrusted data must be associated with logs, place it under an
-application-controlled key:
-
-```js
-// Avoid: user-controlled keys become top-level fields on every child log line
-const child = logger.child(untrustedObject)
-
-// Prefer: user-controlled keys are contained under a trusted namespace
-const child = logger.child({ untrusted: untrustedObject })
-```
-
-As a matter of good security hygiene, prefer not to log untrusted data at all
-unless it is necessary. When it is necessary, sanitize and redact it first.
-See also [`logger.child()` in the API documentation](/docs/api.md#child) and
-[`mergingObject`](/docs/api.md#mergingobject).
-
 ## Cost of child logging
 
 Child logger creation is fast:
@@ -108,8 +88,7 @@ behavior.
 
 There may be cases where this edge case becomes problematic if a JSON parser with alternative behavior
 is used to process the logs. It's recommended to be conscious of namespace conflicts with child loggers,
-in light of an expected log processing approach. This is especially important for untrusted data: do not
-allow externally supplied objects or user-controlled key names to become child logger bindings.
+in light of an expected log processing approach.
 
 One of Pino's performance tricks is to avoid building objects and stringifying
 them, so we're building strings instead. This is why duplicate keys between