@zudojs/logger 1.1.0 → 1.2.0

package/README.md

@@ -3,6 +3,12 @@
 Structured logging with transports, formatters, log levels, secret
 redaction, and context propagation for Zudojs applications.
 
+<!-- zudo-docs:start -->
+
+**Documentation:** [zudojs.oyinlola.site/docs/packages-logger](https://zudojs.oyinlola.site/docs/packages-logger) · **For AI agents:** [Markdown version](https://zudojs.oyinlola.site/docs/packages-logger.md), [llms.txt](https://zudojs.oyinlola.site/llms.txt)
+
+<!-- zudo-docs:end -->
+
 ## Installation
 
 ```bash
@@ -39,6 +45,15 @@ Built in: `createConsoleLoggerTransport`, and the composites
 `createBufferedLoggerTransport`. File and HTTP transports are not
 included — implement the `LoggerTransport` interface for those.
 
+The multi and conditional composites forward `flush()` and `close()` to
+the transports they wrap, so a buffered or file transport nested inside
+is drained and released by the logger's own `flush()`/`close()`. The
+multi transport writes to every sink even when one throws; the failures
+are reported afterwards (several as one `AggregateError`). The buffered
+transport writes each entry independently, so a failing write loses only
+that entry, and a failure from a timer-triggered flush is rethrown by the
+next `flush()` or `close()`.
+
 `transportTimeout` (default 10s) bounds every transport write, so a
 transport that stops responding cannot hang `flush()` or `close()`.
 
@@ -48,21 +63,35 @@ log call itself; a failure from an asynchronous transport (or with
 `asynchronous: true`) cannot, so it is rethrown by the next `flush()` or
 `close()`, which still flush and close the transports first.
 
+`flush()` and `close()` isolate each transport: one that throws does not
+stop the rest from being flushed and closed, and `close()` always leaves
+the logger disposed. The failures are rethrown afterwards (several as one
+`AggregateError`).
+
 ## Flushing
 
 Dispatch completes synchronously when every transport is synchronous.
 With an asynchronous transport — or with `asynchronous: true`, which
 always defers so the caller stays off the transport's critical path —
 writes are in flight until drained. `flush()` and `close()` drain them,
-so nothing is lost at exit.
+including writes started by child loggers (`child()`, `withContext()`),
+so nothing is lost at exit. A child reports itself disposed once its root
+logger is closed.
 
 ## Secret redaction
 
 Redaction is **on by default**. Metadata and context fields whose NAME
-looks like a secret — password, secret, token, api key, private key,
-credential, authorization, cookie — are replaced with `"[REDACTED]"`
-before the entry reaches any formatter or transport. Nested objects,
-arrays and getters are all covered.
+looks like a secret are replaced with `"[REDACTED]"` before the entry
+reaches any formatter or transport. Names are split into words
+(`x-api-key`, `api_key` and `apiKey` all read as `api key`) and matched
+against `DEFAULT_LOGGER_SECRET_FIELDS` — password, passphrase, secret,
+token, jwt, bearer, auth, authorization, cookie, session, sid,
+credential, api key, private key, client secret, card number, cvv, ssn,
+pin, otp and more — so `sessionId` and `cardNumber` are redacted while
+`passenger` and `authorId` are not. Nested objects, arrays and getters
+are all covered. Passing `redact.pattern` replaces the word matcher with
+your own RegExp (the old substring default is still exported as
+`DEFAULT_LOGGER_SECRET_PATTERN`).
 
 ```typescript
 logger.info("login", { user: "alice", password: "hunter2" });
@@ -74,11 +103,14 @@ createLogger({ redact: { enabled: false } }); // opt out
 
 ## Log injection
 
-Text-shaped formatters escape control characters in the message, the
-logger name, metadata keys and values, context values and source
-locations. A newline or ANSI escape inside attacker-supplied text
-becomes `\n` / `\u001b` rather than forging an extra log record or
-driving the operator's terminal. The JSON formatter relies on
+Text-shaped formatters escape control characters (C0, DEL, C1 and
+U+2028/U+2029) in the message, the level, the logger name, metadata keys
+and values, context values, source locations and error stacks. A newline
+or ANSI escape inside attacker-supplied text becomes `\n` / `\u001b`
+rather than forging an extra log record or driving the operator's
+terminal. In a stack trace only the frame lines break the line: the
+error's name and message are escaped as one line, and every frame line is
+indented so none can start at column 0 and pass for a record. The JSON formatter relies on
 `JSON.stringify`, which escapes the same characters.
 
 Metadata is normalized before serialization, so circular references

package/dist/loggerCore/core/loggerCore.core.d.ts

@@ -35,7 +35,13 @@ export declare class ZudojsLogger implements Logger, ZudojsLoggerContext {
     private readonly _pending;
     private readonly _dispatchFailures;
     private _droppedFailures;
-    constructor(options?: LoggerOptions, contextStorage?: LoggerContextStorage);
+    private readonly _root;
+    /**
+     * @param root - The logger this one was derived from. A child's
+     *   dispatches are tracked by its root, so the root's flush()/close()
+     *   drains them, and a child reports itself disposed once its root is.
+     */
+    constructor(options?: LoggerOptions, contextStorage?: LoggerContextStorage, root?: ZudojsLogger);
     get configuration(): LoggerConfiguration;
     get contextStorage(): LoggerContextStorage;
     get name(): string;

package/dist/loggerCore/core/loggerCore.core.js

@@ -20,7 +20,14 @@ export class ZudojsLogger {
     _pending = new Set();
     _dispatchFailures = [];
     _droppedFailures = 0;
-    constructor(options = {}, contextStorage) {
+    _root;
+    /**
+     * @param root - The logger this one was derived from. A child's
+     *   dispatches are tracked by its root, so the root's flush()/close()
+     *   drains them, and a child reports itself disposed once its root is.
+     */
+    constructor(options = {}, contextStorage, root) {
+        this._root = root;
         this._configuration = resolveLoggerOptions(options);
         this._contextStorage = contextStorage ?? createLoggerContextStorage();
         this._configuration = normalizeConfiguration(this._configuration);
@@ -90,7 +97,7 @@ export class ZudojsLogger {
         return this._closing;
     }
     assertActive() {
-        assertActiveHelper(this._disposed, this._configuration.name);
+        assertActiveHelper(this.isDisposed(), this._configuration.name);
     }
     assertMutable() {
         assertMutableHelper(this._configuration.mutable);
@@ -99,7 +106,7 @@ export class ZudojsLogger {
         handleInfrastructureErrorHelper(this._configuration.throwTransportErrors, error);
     }
     isDisposed() {
-        return this._disposed;
+        return this._disposed || (this._root?.isDisposed() ?? false);
     }
     markDisposed() {
         this._disposed = true;
@@ -108,9 +115,13 @@ export class ZudojsLogger {
         this._configuration = Object.freeze(config);
     }
     createChildLogger(options) {
-        return new ZudojsLogger(options, this._contextStorage);
+        return new ZudojsLogger(options, this._contextStorage, this._root ?? this);
     }
     trackDispatch(dispatch) {
+        if (this._root) {
+            this._root.trackDispatch(dispatch);
+            return;
+        }
         // A dispatch rejects only when handleError threw — i.e. when
         // `throwTransportErrors` is on and an asynchronous transport failed.
         // Nothing can throw from the log call that started it, so the failure
@@ -134,6 +145,9 @@ export class ZudojsLogger {
         this._pending.add(tracked);
     }
     async drainDispatches() {
+        if (this._root) {
+            return this._root.drainDispatches();
+        }
         // A dispatch can start further dispatches (a transport that logs),
         // so drain until the set is genuinely empty.
         while (this._pending.size > 0) {

package/dist/loggerCore/helpers/loggerCoreMethods/loggerCoreMethods.lifecycle.d.ts

@@ -17,10 +17,19 @@ export declare function enableLogger(ctx: ZudojsLoggerContext): void;
 export declare function disableLogger(ctx: ZudojsLoggerContext): void;
 /**
  * Flushes all transport buffers.
+ *
+ * In-flight dispatches land in the transports before they are flushed.
+ * Every transport is flushed even when a dispatch or another transport
+ * failed; the failures are rethrown afterwards (several as one
+ * AggregateError).
  */
 export declare function flushLogger(ctx: ZudojsLoggerContext): Promise<void>;
 /**
  * Closes all transports and marks logger as disposed.
+ *
+ * Closing is terminal: every transport is flushed and closed and the
+ * logger is marked disposed even when a dispatch or a transport failed;
+ * the failures are rethrown afterwards.
  */
 export declare function closeLogger(ctx: ZudojsLoggerContext): Promise<void>;
 //# sourceMappingURL=loggerCoreMethods.lifecycle.d.ts.map

package/dist/loggerCore/helpers/loggerCoreMethods/loggerCoreMethods.lifecycle.js

@@ -5,6 +5,7 @@ import { LoggerLevel } from "../../../loggerLevel/loggerLevel.type.js";
 import { createLoggerTransport } from "../../../loggerTransport/loggerTransport.core.js";
 import { isLoggerTransport } from "../../../loggerTransport/loggerTransportGuard.js";
 import { LoggerConfigurationError } from "../../../loggerErrors/loggerError.base.js";
+import { throwCollectedFailures } from "../../../loggerErrors/loggerError.helpers.js";
 /**
  * Sets the logger level.
  */
@@ -44,72 +45,73 @@ export function disableLogger(ctx) {
     });
 }
 /**
- * Flushes all transport buffers.
+ * Flushes (and optionally closes) every configured transport, isolating
+ * each one: a failing sink is collected and the walk continues, so one
+ * bad transport cannot leave every later transport unflushed/unclosed.
  */
-export async function flushLogger(ctx) {
-    ctx.assertActive();
-    // In-flight dispatches must land in the transports before those
-    // transports are asked to flush, otherwise flush() is a no-op for
-    // everything logged in the same tick. A dispatch failure (surfaced
-    // when `throwTransportErrors` is on) is rethrown only after the
-    // transports have still been flushed.
-    let failure;
-    let failed = false;
-    try {
-        await ctx.drainDispatches();
-    }
-    catch (error) {
-        failure = error;
-        failed = true;
-    }
+async function settleTransports(ctx, close, failures) {
     for (const transport of ctx.configuration.transports) {
-        if (!isLoggerTransport(transport)) {
+        if (!isLoggerTransport(transport))
             continue;
-        }
         const registered = createLoggerTransport(transport);
-        if (!registered.enabled) {
+        if (!close && !registered.enabled)
             continue;
+        const steps = close
+            ? [() => registered.flush?.(), () => registered.close?.()]
+            : [() => registered.flush?.()];
+        for (const step of steps) {
+            try {
+                await step();
+            }
+            catch (error) {
+                failures.push(error);
+            }
         }
-        if (registered.flush) {
-            await registered.flush();
-        }
     }
-    if (failed)
-        throw failure;
+}
+/** Drains in-flight dispatches, collecting (not throwing) a failure. */
+async function drainInto(ctx, failures) {
+    try {
+        await ctx.drainDispatches();
+    }
+    catch (error) {
+        failures.push(error);
+    }
+}
+/**
+ * Flushes all transport buffers.
+ *
+ * In-flight dispatches land in the transports before they are flushed.
+ * Every transport is flushed even when a dispatch or another transport
+ * failed; the failures are rethrown afterwards (several as one
+ * AggregateError).
+ */
+export async function flushLogger(ctx) {
+    ctx.assertActive();
+    const failures = [];
+    await drainInto(ctx, failures);
+    await settleTransports(ctx, false, failures);
+    throwCollectedFailures(failures, "Logger flush failed.");
 }
 /**
  * Closes all transports and marks logger as disposed.
+ *
+ * Closing is terminal: every transport is flushed and closed and the
+ * logger is marked disposed even when a dispatch or a transport failed;
+ * the failures are rethrown afterwards.
  */
 export async function closeLogger(ctx) {
     if (ctx.isDisposed()) {
         return;
     }
-    // Closing is terminal: transports are flushed and closed and the logger
-    // is marked disposed even when a dispatch failed; the failure is rethrown
-    // afterwards.
-    let failure;
-    let failed = false;
+    const failures = [];
     try {
-        await ctx.drainDispatches();
+        await drainInto(ctx, failures);
+        await settleTransports(ctx, true, failures);
     }
-    catch (error) {
-        failure = error;
-        failed = true;
-    }
-    for (const transport of ctx.configuration.transports) {
-        if (!isLoggerTransport(transport)) {
-            continue;
-        }
-        const registered = createLoggerTransport(transport);
-        if (registered.flush) {
-            await registered.flush();
-        }
-        if (registered.close) {
-            await registered.close();
-        }
+    finally {
+        ctx.markDisposed();
     }
-    ctx.markDisposed();
-    if (failed)
-        throw failure;
+    throwCollectedFailures(failures, "Logger close failed.");
 }
 //# sourceMappingURL=loggerCoreMethods.lifecycle.js.map

package/dist/loggerEntry/index.d.ts

@@ -5,4 +5,5 @@
  */
 export * from "./loggerEntryHelpers/index.js";
 export * from "./loggerEntry.core.js";
+export { DEFAULT_LOGGER_SECRET_FIELDS, createDefaultSecretFieldMatcher, } from "./loggerEntry.secretFields.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/loggerEntry/index.js

@@ -5,4 +5,5 @@
  */
 export * from "./loggerEntryHelpers/index.js";
 export * from "./loggerEntry.core.js";
+export { DEFAULT_LOGGER_SECRET_FIELDS, createDefaultSecretFieldMatcher, } from "./loggerEntry.secretFields.js";
 //# sourceMappingURL=index.js.map

package/dist/loggerEntry/loggerEntry.secretFields.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Default secret-field matching for logger redaction.
+ *
+ * Field names are split into words (`x-api-key`, `api_key` and `apiKey`
+ * all become `api key`) and matched on whole-word runs, the same scheme
+ * @zudojs/observability's `isSensitiveField` uses. A raw substring test
+ * redacted `passenger`, `compass` and `bypassCache` (they contain `pass`)
+ * while missing `auth`, `sessionId`, `sid`, `jwt`, `ssn`, `cardNumber`,
+ * `cvv` and `otp` entirely.
+ */
+/**
+ * Secret field names matched on whole words by default.
+ */
+export declare const DEFAULT_LOGGER_SECRET_FIELDS: readonly string[];
+/**
+ * Builds the default secret-field predicate from a word list.
+ */
+export declare function createDefaultSecretFieldMatcher(fields?: readonly string[]): (key: string) => boolean;
+//# sourceMappingURL=loggerEntry.secretFields.d.ts.map

package/dist/loggerEntry/loggerEntry.secretFields.js

@@ -0,0 +1,90 @@
+/**
+ * Default secret-field matching for logger redaction.
+ *
+ * Field names are split into words (`x-api-key`, `api_key` and `apiKey`
+ * all become `api key`) and matched on whole-word runs, the same scheme
+ * @zudojs/observability's `isSensitiveField` uses. A raw substring test
+ * redacted `passenger`, `compass` and `bypassCache` (they contain `pass`)
+ * while missing `auth`, `sessionId`, `sid`, `jwt`, `ssn`, `cardNumber`,
+ * `cvv` and `otp` entirely.
+ */
+/**
+ * Secret field names matched on whole words by default.
+ */
+export const DEFAULT_LOGGER_SECRET_FIELDS = Object.freeze([
+    "password",
+    "passwd",
+    "passphrase",
+    "pwd",
+    "secret",
+    "token",
+    "jwt",
+    "bearer",
+    "authorization",
+    "auth",
+    "cookie",
+    "session",
+    "sid",
+    "credential",
+    "credentials",
+    "api_key",
+    "private_key",
+    "client_secret",
+    "credit_card",
+    "card_number",
+    "cvv",
+    "cvc",
+    "ssn",
+    "social_security",
+    "pin",
+    "otp",
+]);
+/**
+ * Unambiguous secret words that are also matched as a substring of a
+ * lowercase run-together name (`userpassword`, `accesstoken`), which the
+ * word split alone cannot see.
+ */
+const SUBSTRING_SECRET_WORDS = Object.freeze([
+    "password",
+    "passwd",
+    "secret",
+    "token",
+    "apikey",
+    "privatekey",
+    "credential",
+    "authorization",
+    "cookie",
+]);
+/** Splits a field name into lowercase words. */
+function splitWords(key) {
+    return key
+        .replace(/([a-z0-9])([A-Z])/gu, "$1 $2")
+        .replace(/([A-Z]+)([A-Z][a-z])/gu, "$1 $2")
+        .toLowerCase()
+        .split(/[^a-z0-9]+/u)
+        .filter(Boolean);
+}
+/** Normalizes a field-list entry the way word runs are joined. */
+function normalizeField(field) {
+    return field.toLowerCase().replace(/[^a-z0-9]/gu, "");
+}
+/**
+ * Builds the default secret-field predicate from a word list.
+ */
+export function createDefaultSecretFieldMatcher(fields = DEFAULT_LOGGER_SECRET_FIELDS) {
+    const targets = new Set(fields.map(normalizeField).filter(Boolean));
+    return (key) => {
+        const words = splitWords(key);
+        for (let start = 0; start < words.length; start += 1) {
+            let joined = "";
+            for (let end = start; end < words.length; end += 1) {
+                joined += words[end] ?? "";
+                if (targets.has(joined))
+                    return true;
+            }
+        }
+        const compact = key.toLowerCase().replace(/[^a-z0-9]/gu, "");
+        return SUBSTRING_SECRET_WORDS.some((word) => compact.includes(word));
+    };
+}
+//# sourceMappingURL=loggerEntry.secretFields.js.map

package/dist/loggerEntry/loggerEntryHelpers/loggerEntryHelpers.sanitize.d.ts

@@ -13,10 +13,13 @@
  */
 export declare const LOGGER_REDACTION_TOKEN = "[REDACTED]";
 /**
- * Field names treated as secrets by default.
+ * Legacy substring pattern for secret field names.
  *
- * Matching is case-insensitive and substring-based so `dbPassword`,
- * `X-Api-Key` and `refresh_token` are all covered.
+ * @deprecated No longer the default: it redacted `passenger`/`compass`
+ * and missed `auth`, `sessionId`, `ssn`, `cardNumber`, `cvv` and `otp`.
+ * The default is now the word-based matcher over
+ * `DEFAULT_LOGGER_SECRET_FIELDS`. Pass this as `redact.pattern` to opt
+ * back into the old behaviour.
  */
 export declare const DEFAULT_LOGGER_SECRET_PATTERN: RegExp;
 /**
@@ -32,8 +35,9 @@ export interface LoggerRedactionOptions {
      */
     readonly keys?: readonly string[];
     /**
-     * Field-name pattern. Defaults to DEFAULT_LOGGER_SECRET_PATTERN.
-     * Pass a pattern that never matches to rely on `keys` alone.
+     * Field-name pattern. When omitted, the word-based default matcher over
+     * `DEFAULT_LOGGER_SECRET_FIELDS` is used. Pass a pattern that never
+     * matches to rely on `keys` alone.
      */
     readonly pattern?: RegExp;
     /**
@@ -45,8 +49,8 @@ export interface LoggerRedactionOptions {
  * Escapes control characters that could forge log records.
  *
  * CR, LF, TAB and the ANSI escape byte become printable escapes; every
- * other C0 control character and DEL becomes `\xNN`. Ordinary text,
- * including every non-ASCII character, is returned unchanged.
+ * other C0/C1 control character and DEL becomes `\xNN`, and U+2028 /
+ * U+2029 become `\u2028` / `\u2029`. All other text is unchanged.
  */
 export declare function escapeLogText(value: string): string;
 /**

package/dist/loggerEntry/loggerEntryHelpers/loggerEntryHelpers.sanitize.js

@@ -8,28 +8,33 @@
  * terminal. Every string that reaches a text-shaped formatter is
  * therefore escaped here first.
  */
+import { createDefaultSecretFieldMatcher } from "../loggerEntry.secretFields.js";
 /**
- * Matches C0 control characters plus DEL — everything that can forge a
- * record boundary or drive a terminal.
+ * Matches C0 controls, DEL, C1 controls (NEL, CSI) and the Unicode
+ * line/paragraph separators — everything that can forge a record
+ * boundary or drive a terminal.
  */
-const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f]/g;
+const CONTROL_CHARACTERS = /[\u0000-\u001f\u007f-\u009f\u2028\u2029]/g;
 /**
  * Replacement token written in place of a redacted value.
  */
 export const LOGGER_REDACTION_TOKEN = "[REDACTED]";
 /**
- * Field names treated as secrets by default.
+ * Legacy substring pattern for secret field names.
  *
- * Matching is case-insensitive and substring-based so `dbPassword`,
- * `X-Api-Key` and `refresh_token` are all covered.
+ * @deprecated No longer the default: it redacted `passenger`/`compass`
+ * and missed `auth`, `sessionId`, `ssn`, `cardNumber`, `cvv` and `otp`.
+ * The default is now the word-based matcher over
+ * `DEFAULT_LOGGER_SECRET_FIELDS`. Pass this as `redact.pattern` to opt
+ * back into the old behaviour.
  */
 export const DEFAULT_LOGGER_SECRET_PATTERN = /(pass(word|wd)?|secret|token|api[-_.]?key|private[-_.]?key|credential|authorization|cookie)/i;
 /**
  * Escapes control characters that could forge log records.
  *
  * CR, LF, TAB and the ANSI escape byte become printable escapes; every
- * other C0 control character and DEL becomes `\xNN`. Ordinary text,
- * including every non-ASCII character, is returned unchanged.
+ * other C0/C1 control character and DEL becomes `\xNN`, and U+2028 /
+ * U+2029 become `\u2028` / `\u2029`. All other text is unchanged.
  */
 export function escapeLogText(value) {
     return value.replace(CONTROL_CHARACTERS, (character) => {
@@ -42,6 +47,10 @@ export function escapeLogText(value) {
                 return "\\t";
             case "\u001b":
                 return "\\u001b";
+            case "\u2028":
+                return "\\u2028";
+            case "\u2029":
+                return "\\u2029";
             default: {
                 const code = character.charCodeAt(0);
                 return `\\x${code.toString(16).padStart(2, "0")}`;
@@ -62,14 +71,18 @@ export function createSecretMatcher(options = {}) {
     if (options.enabled === false) {
         return () => false;
     }
+    const exact = new Set((options.keys ?? []).map((key) => key.toLowerCase()));
+    const configured = options.pattern;
+    if (configured === undefined) {
+        const isDefaultSecret = createDefaultSecretFieldMatcher();
+        return (key) => exact.has(key.toLowerCase()) || isDefaultSecret(key);
+    }
     // Copy the pattern without `g`/`y`: those flags make `test()` advance
     // `lastIndex`, so a shared pattern would match a secret-named field on
     // one entry and let it through unredacted on the next.
-    const configured = options.pattern ?? DEFAULT_LOGGER_SECRET_PATTERN;
     const pattern = configured.global || configured.sticky
         ? new RegExp(configured.source, configured.flags.replace(/[gy]/gu, ""))
         : configured;
-    const exact = new Set((options.keys ?? []).map((key) => key.toLowerCase()));
     return (key) => exact.has(key.toLowerCase()) || pattern.test(key);
 }
 /**

package/dist/loggerErrors/loggerError.helpers.d.ts

@@ -12,4 +12,15 @@ export declare function getLoggerErrorCause(error: unknown): unknown;
 export declare function createLoggerTransportError(transportName: string, error: unknown): LoggerTransportError;
 /** Creates a formatter error while preserving the original failure. */
 export declare function createLoggerFormatterError(formatterName: string, error: unknown): LoggerFormatterError;
+/**
+ * Rethrows collected failures: the single failure itself, or an
+ * AggregateError when more than one step failed. Does nothing when the
+ * list is empty.
+ */
+export declare function throwCollectedFailures(failures: readonly unknown[], message: string): void;
+/**
+ * Runs every step even when earlier ones fail, then rethrows the
+ * collected failures via {@link throwCollectedFailures}.
+ */
+export declare function settleAllOrThrow(steps: readonly (() => unknown)[], message: string): Promise<void>;
 //# sourceMappingURL=loggerError.helpers.d.ts.map

package/dist/loggerErrors/loggerError.helpers.js

@@ -38,4 +38,25 @@ export function createLoggerFormatterError(formatterName, error) {
     const message = error instanceof Error ? error.message : String(error);
     return new LoggerFormatterError(`Logger formatter "${formatterName}" failed: ${message}`, { formatterName, cause });
 }
+/**
+ * Rethrows collected failures: the single failure itself, or an
+ * AggregateError when more than one step failed. Does nothing when the
+ * list is empty.
+ */
+export function throwCollectedFailures(failures, message) {
+    if (failures.length === 0)
+        return;
+    if (failures.length === 1)
+        throw failures[0];
+    throw new AggregateError(failures, message);
+}
+/**
+ * Runs every step even when earlier ones fail, then rethrows the
+ * collected failures via {@link throwCollectedFailures}.
+ */
+export async function settleAllOrThrow(steps, message) {
+    const results = await Promise.allSettled(steps.map(async (step) => step()));
+    const failures = results.flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+    throwCollectedFailures(failures, message);
+}
 //# sourceMappingURL=loggerError.helpers.js.map

package/dist/loggerFormatter/loggerFormatterFormatters/loggerFormatterFormatters.js

@@ -11,7 +11,7 @@ import { createTextLoggerFormatter } from "./loggerFormatterFormatters.text.js";
  */
 export function createCompactLoggerFormatter(options = {}) {
     return createLoggerFormatter((entry) => {
-        const level = entry.levelName.toUpperCase();
+        const level = escapeLogText(entry.levelName.toUpperCase());
         const logger = entry.logger ? ` ${escapeLogText(entry.logger)}:` : "";
         return `${level}${logger} ${escapeLogText(entry.message)}`;
     }, {

package/dist/loggerFormatter/loggerFormatterFormatters/loggerFormatterFormatters.metadata.d.ts

@@ -11,6 +11,12 @@ export declare function formatMetadata(metadata: Record<string, unknown>, separa
 export declare function formatValue(value: unknown): string;
 /**
  * Formats an Error.
+ *
+ * With a stack trace the output is intentionally multi-line, but only
+ * the frame lines break the line: the header (which carries the
+ * attacker-influenceable message) is escaped as a single line, and every
+ * frame line is escaped and indented so none of them can start at
+ * column 0 and parse as a record of its own.
  */
 export declare function formatError(error: Error, includeStackTrace: boolean): string;
 //# sourceMappingURL=loggerFormatterFormatters.metadata.d.ts.map

package/dist/loggerFormatter/loggerFormatterFormatters/loggerFormatterFormatters.metadata.js

@@ -23,28 +23,63 @@ export function formatValue(value) {
     }
     if (typeof value === "string") {
         if (/\s/.test(value)) {
-            return JSON.stringify(value);
+            // JSON escapes C0 controls but not DEL, C1 or U+2028/U+2029.
+            return escapeLogText(JSON.stringify(value));
         }
         // A value with no whitespace can still carry ANSI escapes or other
         // C0 controls, which used to reach the sink verbatim.
         return escapeLogText(value);
     }
     if (typeof value === "object") {
-        return JSON.stringify(serializeLoggerValue(value));
+        return escapeLogText(JSON.stringify(serializeLoggerValue(value)));
     }
     return escapeLogText(String(value));
 }
+/**
+ * Splits an error's stack into its header (name and message) and its
+ * frame lines.
+ *
+ * The header is derived from the error itself rather than from the first
+ * stack line, because the message can contain newlines of its own and
+ * would otherwise spill across several "lines" of the stack.
+ */
+function splitStack(error, stack) {
+    const message = String(error.message ?? "");
+    const header = message ? `${error.name}: ${message}` : String(error.name);
+    if (stack.startsWith(header)) {
+        const rest = stack.slice(header.length).replace(/^\r?\n/u, "");
+        return { header, frames: rest ? rest.split("\n") : [] };
+    }
+    const lines = stack.split("\n");
+    const firstFrame = lines.findIndex((line) => /^\s+at\s/u.test(line));
+    if (firstFrame === -1) {
+        return { header: stack, frames: [] };
+    }
+    return {
+        header: lines.slice(0, firstFrame).join("\n"),
+        frames: lines.slice(firstFrame),
+    };
+}
 /**
  * Formats an Error.
+ *
+ * With a stack trace the output is intentionally multi-line, but only
+ * the frame lines break the line: the header (which carries the
+ * attacker-influenceable message) is escaped as a single line, and every
+ * frame line is escaped and indented so none of them can start at
+ * column 0 and parse as a record of its own.
  */
 export function formatError(error, includeStackTrace) {
-    if (includeStackTrace && error.stack) {
-        // A stack trace is intentionally multi-line, but everything in it
-        // that came from user input (the message) must not be able to
-        // introduce a further record boundary of its own.
-        return `\n${error.stack.split("\n").map(escapeLogText).join("\n")}`;
+    if (includeStackTrace && typeof error.stack === "string" && error.stack) {
+        const { header, frames } = splitStack(error, error.stack);
+        const lines = [escapeLogText(header)];
+        for (const frame of frames) {
+            const escaped = escapeLogText(frame);
+            lines.push(/^\s/u.test(escaped) ? escaped : `    ${escaped}`);
+        }
+        return `\n${lines.join("\n")}`;
     }
     const serialized = serializeLoggerError(error);
-    return `error=${JSON.stringify(serialized)}`;
+    return `error=${escapeLogText(JSON.stringify(serialized))}`;
 }
 //# sourceMappingURL=loggerFormatterFormatters.metadata.js.map

package/dist/loggerFormatter/loggerFormatterFormatters/loggerFormatterFormatters.text.js

@@ -43,7 +43,7 @@ export function createTextLoggerFormatter(options = {}) {
         // output. Colour codes are emitted only on explicit opt-in, and
         // only around the fixed level name — never around user text,
         // which stays escaped.
-        const levelTag = `[${entry.levelName.toUpperCase()}]`;
+        const levelTag = `[${escapeLogText(entry.levelName.toUpperCase())}]`;
         parts.push(context.colors ? colorizeLevel(entry.levelName, levelTag) : levelTag);
         if (includeLogger && entry.logger) {
             parts.push(`[${escapeLogText(entry.logger)}]`);

package/dist/loggerTransport/loggerTransportComposite/loggerTransportComposite.buffered.js

@@ -2,7 +2,8 @@
  * Buffered logger transport.
  */
 import { createLoggerTransport, writeLoggerTransport, } from "../loggerTransport.core.js";
-import { isLoggerTransportObject } from "../loggerTransportGuard.js";
+import { closeLoggerTransport, flushLoggerTransport, } from "../loggerTransportHelpers/loggerTransportHelpers.js";
+import { throwCollectedFailures } from "../../loggerErrors/loggerError.helpers.js";
 /**
  * Creates a transport that buffers entries before forwarding
  * them to another transport.
@@ -12,14 +13,50 @@ export function createBufferedLoggerTransport(transport, options = {}) {
     const maxSize = options.maxSize ?? 100;
     const flushInterval = options.flushInterval ?? 0;
     let timer;
-    const flush = async () => {
+    let deferredFailure;
+    // Each entry is written on its own: one failing write used to abort the
+    // loop after the whole batch had already been spliced out, losing every
+    // entry behind it. Only the entries that actually failed are dropped.
+    const drain = async () => {
         if (buffer.length === 0) {
             return;
         }
         const entries = buffer.splice(0, buffer.length);
+        const failures = [];
         for (const entry of entries) {
-            await writeLoggerTransport(transport, entry);
+            try {
+                await writeLoggerTransport(transport, entry);
+            }
+            catch (error) {
+                failures.push(error);
+            }
         }
+        throwCollectedFailures(failures, `${failures.length} buffered log entries failed to write.`);
+    };
+    // A failure from a timer-triggered drain has no caller to reach, so it
+    // is kept and rethrown by the next explicit flush()/close().
+    const takeDeferredFailure = () => {
+        if (!deferredFailure)
+            return [];
+        const { error } = deferredFailure;
+        deferredFailure = undefined;
+        return [error];
+    };
+    const flush = async () => {
+        const failures = takeDeferredFailure();
+        try {
+            await drain();
+        }
+        catch (error) {
+            failures.push(error);
+        }
+        try {
+            await flushLoggerTransport(transport);
+        }
+        catch (error) {
+            failures.push(error);
+        }
+        throwCollectedFailures(failures, "Buffered logger transport flush failed.");
     };
     const scheduleFlush = () => {
         if (flushInterval <= 0 || timer) {
@@ -28,10 +65,10 @@ export function createBufferedLoggerTransport(transport, options = {}) {
         timer = setTimeout(async () => {
             timer = undefined;
             try {
-                await flush();
+                await drain();
             }
-            catch {
-                /* deliberate no-op */
+            catch (error) {
+                deferredFailure ??= { error };
             }
         }, flushInterval);
         // A pending flush is housekeeping, not work: left referenced it kept a
@@ -45,7 +82,7 @@ export function createBufferedLoggerTransport(transport, options = {}) {
         async write(entry) {
             buffer.push(entry);
             if (buffer.length >= maxSize) {
-                await flush();
+                await drain();
             }
             else {
                 scheduleFlush();
@@ -57,10 +94,20 @@ export function createBufferedLoggerTransport(transport, options = {}) {
                 clearTimeout(timer);
                 timer = undefined;
             }
-            await flush();
-            if (isLoggerTransportObject(transport) && transport.close) {
-                await transport.close();
+            const failures = [];
+            try {
+                await flush();
+            }
+            catch (error) {
+                failures.push(error);
+            }
+            try {
+                await closeLoggerTransport(transport);
+            }
+            catch (error) {
+                failures.push(error);
             }
+            throwCollectedFailures(failures, "Buffered logger transport close failed.");
         },
     };
     return createLoggerTransport(buffered, options);

package/dist/loggerTransport/loggerTransportComposite/loggerTransportComposite.d.ts

@@ -7,11 +7,20 @@ import { createBufferedLoggerTransport } from "./loggerTransportComposite.buffer
 /**
  * Creates a transport that forwards entries to another
  * transport only when a predicate passes.
+ *
+ * `flush()` and `close()` are forwarded to the inner transport, so a
+ * buffered or file transport nested inside is drained and released by
+ * the logger's own `flush()`/`close()`.
  */
 export declare function createConditionalLoggerTransport(transport: LoggerTransportLike, predicate: (entry: LoggerEntry) => boolean | Promise<boolean>, options?: LoggerTransportOptions): RegisteredLoggerTransport;
 /**
  * Creates a transport that forwards entries to multiple
  * transports.
+ *
+ * Every sink receives every entry even when another sink throws: writes
+ * are settled independently and the failures are rethrown afterwards
+ * (one failure as itself, several as an AggregateError). `flush()` and
+ * `close()` fan out to every inner transport the same way.
  */
 export declare function createMultiLoggerTransport(transports: readonly LoggerTransportLike[], options?: LoggerTransportOptions): RegisteredLoggerTransport;
 export { createBufferedLoggerTransport };

package/dist/loggerTransport/loggerTransportComposite/loggerTransportComposite.js

@@ -2,27 +2,48 @@
  * Composite logger transports.
  */
 import { createLoggerTransport, writeLoggerTransport, } from "../loggerTransport.core.js";
+import { createLoggerTransportId } from "../loggerTransportGuard.js";
+import { closeLoggerTransport, flushLoggerTransport, } from "../loggerTransportHelpers/loggerTransportHelpers.js";
+import { settleAllOrThrow } from "../../loggerErrors/loggerError.helpers.js";
 import { createBufferedLoggerTransport } from "./loggerTransportComposite.buffered.js";
 /**
  * Creates a transport that forwards entries to another
  * transport only when a predicate passes.
+ *
+ * `flush()` and `close()` are forwarded to the inner transport, so a
+ * buffered or file transport nested inside is drained and released by
+ * the logger's own `flush()`/`close()`.
  */
 export function createConditionalLoggerTransport(transport, predicate, options = {}) {
-    return createLoggerTransport(async (entry, context) => {
-        if (await predicate(entry)) {
-            await writeLoggerTransport(transport, entry, context);
-        }
+    return createLoggerTransport({
+        name: options.name ?? createLoggerTransportId(),
+        enabled: options.enabled ?? true,
+        async write(entry, context) {
+            if (await predicate(entry)) {
+                await writeLoggerTransport(transport, entry, context);
+            }
+        },
+        flush: () => flushLoggerTransport(transport),
+        close: () => closeLoggerTransport(transport),
     }, options);
 }
 /**
  * Creates a transport that forwards entries to multiple
  * transports.
+ *
+ * Every sink receives every entry even when another sink throws: writes
+ * are settled independently and the failures are rethrown afterwards
+ * (one failure as itself, several as an AggregateError). `flush()` and
+ * `close()` fan out to every inner transport the same way.
  */
 export function createMultiLoggerTransport(transports, options = {}) {
-    return createLoggerTransport(async (entry, context) => {
-        for (const transport of transports) {
-            await writeLoggerTransport(transport, entry, context);
-        }
+    const sinks = [...transports];
+    return createLoggerTransport({
+        name: options.name ?? createLoggerTransportId(),
+        enabled: options.enabled ?? true,
+        write: (entry, context) => settleAllOrThrow(sinks.map((sink) => () => writeLoggerTransport(sink, entry, context)), "Multiple logger transports failed to write an entry."),
+        flush: () => settleAllOrThrow(sinks.map((sink) => () => flushLoggerTransport(sink)), "Multiple logger transports failed to flush."),
+        close: () => settleAllOrThrow(sinks.map((sink) => () => closeLoggerTransport(sink)), "Multiple logger transports failed to close."),
     }, options);
 }
 export { createBufferedLoggerTransport };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zudojs/logger",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "description": "Structured logging with transports, log levels, and context propagation for Zudojs applications.",
   "license": "MIT",
   "author": {
@@ -28,7 +28,7 @@
     "node": ">=24.0.0"
   },
   "dependencies": {
-    "@zudojs/errors": "1.0.1"
+    "@zudojs/errors": "1.1.0"
   },
   "devDependencies": {
     "typescript": "7.0.2",