cabloy 5.1.218 → 5.1.220

package/vona/src/suite-vendor/a-vona/modules/a-executor/src/bean/bean.executor.ts

@@ -1,12 +1,12 @@
-import type { FunctionAsync } from 'vona';
+import type { FunctionAsync, VonaContext } from 'vona';
 import type { IApiPathRecordMethodMap } from 'vona-module-a-web';
 
 import { isNil } from '@cabloy/utils';
-import { BeanBase } from 'vona';
+import { BeanBase, captureRequestBoundary } from 'vona';
 import { Bean } from 'vona-module-a-bean';
 import { ServiceTransactionAsyncLocalStorage } from 'vona-module-a-orm';
 
-import type { INewCtxOptions, IPerformActionOptions } from '../types/executor.ts';
+import type { INewCtxLifecycle, INewCtxOptions, IPerformActionOptions } from '../types/executor.ts';
 
 import { __delegateProperties } from '../lib/utils.ts';
 
@@ -30,6 +30,7 @@ export class BeanExecutor extends BeanBase {
   async newCtxIsolate<RESULT>(
     fn: FunctionAsync<RESULT>,
     options?: INewCtxOptions,
+    lifecycle?: INewCtxLifecycle,
   ): Promise<RESULT> {
     options = Object.assign({}, options);
     // instanceName !== undefined means isolate
@@ -39,83 +40,133 @@ export class BeanExecutor extends BeanBase {
       options.locale = options.locale === undefined ? this.ctx?.locale : options.locale;
       options.tz = options.tz === undefined ? this.ctx?.tz : options.tz;
     }
-    return this.newCtx(fn, options);
+    return this.newCtx(fn, options, lifecycle);
   }
 
-  async mockCtx<RESULT>(fn: FunctionAsync<RESULT>, options?: INewCtxOptions): Promise<RESULT> {
+  async mockCtx<RESULT>(
+    fn: FunctionAsync<RESULT>,
+    options?: INewCtxOptions,
+    lifecycle?: INewCtxLifecycle,
+  ): Promise<RESULT> {
     options = Object.assign({}, options);
     options.dbInfo = isNil(options.dbInfo) ? { level: 1 } : options.dbInfo;
     options.instanceName =
       options.instanceName === undefined ? (this.ctx?.instanceName ?? '') : options.instanceName;
     options.instance = !isNil(options.instanceName);
-    return this.newCtx(fn, options);
+    return this.newCtx(fn, options, lifecycle);
   }
 
-  async newCtx<RESULT>(fn: FunctionAsync<RESULT>, options?: INewCtxOptions): Promise<RESULT> {
-    return this._newCtxInnerStep1(() => {
-      if (isNil(options?.dbInfo)) return this._newCtxInnerStep2(fn, options);
-      return this.bean.database.switchDb(() => {
-        return this._newCtxInnerStep2(fn, options);
-      }, options?.dbInfo);
-    }, options);
+  async newCtx<RESULT>(
+    fn: FunctionAsync<RESULT>,
+    options?: INewCtxOptions,
+    lifecycle?: INewCtxLifecycle,
+  ): Promise<RESULT> {
+    return this._newCtxInnerStep1(
+      () => {
+        if (isNil(options?.dbInfo)) return this._newCtxInnerStep2(fn, options);
+        return this.bean.database.switchDb(() => {
+          return this._newCtxInnerStep2(fn, options);
+        }, options?.dbInfo);
+      },
+      options,
+      lifecycle,
+    );
   }
 
   private async _newCtxInnerStep1<RESULT>(
     fn: FunctionAsync<RESULT>,
-    options?: INewCtxOptions,
+    options: INewCtxOptions = {},
+    lifecycle?: INewCtxLifecycle,
   ): Promise<RESULT> {
-    options = Object.assign({}, options);
-    // innerAccess
-    const innerAccess = options.innerAccess !== false;
-    // isolate
-    const isolate =
-      !this.ctx ||
-      options.instanceName !== undefined ||
-      (!innerAccess && this.ctx?.instanceName === null);
-    const ctxCaller = !isolate && this.ctx ? this.ctx : undefined;
-    // locale/tz/instanceName
-    if (!isolate && this.ctx) {
-      options.locale = options.locale === undefined ? this.ctx.locale : options.locale;
-      options.tz = options.tz === undefined ? this.ctx.tz : options.tz;
-      options.instanceName =
-        options.instanceName === undefined
-          ? !innerAccess && this.ctx.instanceName === null
-            ? undefined
-            : this.ctx.instanceName
-          : options.instanceName;
-    }
-    // run
-    const ctx = this.app.createAnonymousContext(options.req, options.res);
-    return await this.app.ctxStorage.run(ctx, async () => {
+    const capture = captureRequestBoundary();
+    const onScopeOutcome = lifecycle?.onScopeOutcome;
+    let ctx: VonaContext | undefined;
+    try {
+      options = Object.assign({}, options);
       // innerAccess
-      ctx.innerAccess = innerAccess;
-      // locale
-      if (options.locale !== undefined) {
-        ctx.locale = options.locale;
+      const innerAccess = options.innerAccess !== false;
+      // isolate
+      const isolate =
+        !this.ctx ||
+        options.instanceName !== undefined ||
+        (!innerAccess && this.ctx?.instanceName === null);
+      const ctxCaller = !isolate && this.ctx ? this.ctx : undefined;
+      // locale/tz/instanceName
+      if (!isolate && this.ctx) {
+        options.locale = options.locale === undefined ? this.ctx.locale : options.locale;
+        options.tz = options.tz === undefined ? this.ctx.tz : options.tz;
+        options.instanceName =
+          options.instanceName === undefined
+            ? !innerAccess && this.ctx.instanceName === null
+              ? undefined
+              : this.ctx.instanceName
+            : options.instanceName;
       }
-      // tz
-      if (options.tz !== undefined) {
-        ctx.tz = options.tz;
-      }
-      // instanceName: undefined/null is different
-      if (options.instanceName !== undefined) {
-        ctx.instanceName = options.instanceName;
-      }
-      // ctxCaller
-      if (ctxCaller) {
-        // delegateProperties
-        __delegateProperties(ctx, ctxCaller);
+      // run
+      ctx = this.app.createAnonymousContext(options.req, options.res);
+      const context = ctx;
+      const execute = async () => {
+        const initialized: unknown = lifecycle?.initializeContext?.(context);
+        if (initialized && (typeof initialized === 'object' || typeof initialized === 'function')) {
+          const then = (initialized as PromiseLike<unknown>).then;
+          if (typeof then === 'function') {
+            await new Promise<unknown>((resolve, reject) => {
+              then.call(initialized, resolve, reject);
+            }).catch(() => undefined);
+            throw new Error('Context initializer must be synchronous');
+          }
+        }
+        // innerAccess
+        context.innerAccess = innerAccess;
+        // locale
+        if (options.locale !== undefined) {
+          context.locale = options.locale;
+        }
+        // tz
+        if (options.tz !== undefined) {
+          context.tz = options.tz;
+        }
+        // instanceName: undefined/null is different
+        if (options.instanceName !== undefined) {
+          context.instanceName = options.instanceName;
+        }
         // ctxCaller
-        ctx.ctxCaller = ctxCaller;
-      } else {
-        // isolate: extraData
-        if (options.extraData) {
+        if (ctxCaller) {
           // delegateProperties
-          __delegateProperties(ctx, options.extraData);
+          __delegateProperties(context, ctxCaller);
+          // ctxCaller
+          context.ctxCaller = ctxCaller;
+        } else {
+          // isolate: extraData
+          if (options.extraData) {
+            // delegateProperties
+            __delegateProperties(context, options.extraData);
+          }
+        }
+        return await this.bean._getBean(ServiceTransactionAsyncLocalStorage).run(fn, isolate);
+      };
+      return onScopeOutcome
+        ? await this.app.ctxStorage.runObserved(context, execute, onScopeOutcome)
+        : await this.app.ctxStorage.run(context, execute);
+    } catch (error) {
+      if (!ctx && onScopeOutcome) {
+        try {
+          const result: unknown = onScopeOutcome('not_created');
+          if (result && (typeof result === 'object' || typeof result === 'function')) {
+            const then = (result as PromiseLike<unknown>).then;
+            if (typeof then === 'function') {
+              capture?.reportFailure('observer_failed');
+              void new Promise<unknown>((resolve, reject) => {
+                then.call(result, resolve, reject);
+              }).catch(() => {});
+            }
+          }
+        } catch {
+          capture?.reportFailure('observer_failed');
         }
       }
-      return await this.bean._getBean(ServiceTransactionAsyncLocalStorage).run(fn, isolate);
-    });
+      throw error;
+    }
   }
 
   private async _newCtxInnerStep2<RESULT>(

package/vona/src/suite-vendor/a-vona/modules/a-executor/src/service/executor.ts

@@ -1,7 +1,7 @@
 import type { IApiPathRecordMethodMap } from 'vona-module-a-web';
 
 import { combineParamsAndQuery } from '@cabloy/utils';
-import { BeanBase, cast, deepExtend } from 'vona';
+import { BeanBase, cast, deepExtend, getRequestBoundary } from 'vona';
 import { Aspect } from 'vona-module-a-aspect';
 import { Service } from 'vona-module-a-bean';
 
@@ -19,8 +19,8 @@ export class ServiceExecutor extends BeanBase {
   ): Promise<any> {
     // app
     const app = this.app;
-    const telemetry = this.$scope.telemetry.service.telemetry;
-    const span = telemetry.enabled
+    const telemetry = getRequestBoundary() ? undefined : this.$scope.telemetry.service.telemetry;
+    const span = telemetry?.enabled
       ? telemetry.startSpan(`vona.action ${method.toUpperCase()}`, {
           attributes: { 'vona.action.internal': true, 'http.request.method': method.toUpperCase() },
         })
@@ -83,16 +83,16 @@ export class ServiceExecutor extends BeanBase {
             state: {
               ...options?.extraData?.state,
               telemetry: span
-                ? { context: telemetry.createContext(span), span, internalAction: true }
+                ? { context: telemetry!.createContext(span), span, internalAction: true }
                 : undefined,
             },
           },
         },
       );
     try {
-      return await (span ? telemetry.withSpan(span, execute) : execute());
+      return await (span ? telemetry!.withSpan(span, execute) : execute());
     } catch (err) {
-      if (span) telemetry.recordException(span, err);
+      if (span) telemetry!.recordException(span, err);
       throw err;
     } finally {
       span?.end();

package/vona/src/suite-vendor/a-vona/modules/a-executor/src/types/executor.ts

@@ -1,4 +1,11 @@
-import type { ContextState, IInstanceRecord, ILocaleRecord, PowerPartial } from 'vona';
+import type {
+  ContextState,
+  IInstanceRecord,
+  ILocaleRecord,
+  PowerPartial,
+  VonaContext,
+  VonaScopeOutcomeObserver,
+} from 'vona';
 import type { ConfigOnions } from 'vona-module-a-onion';
 import type { IDbInfo, ITransactionOptions } from 'vona-module-a-orm';
 
@@ -15,6 +22,11 @@ export interface INewCtxOptions extends INewCtxBaseOptions {
   dbInfo?: Partial<IDbInfo>;
 }
 
+export interface INewCtxLifecycle {
+  initializeContext?: (ctx: VonaContext) => void;
+  onScopeOutcome?: VonaScopeOutcomeObserver;
+}
+
 export interface INewCtxBaseOptions {
   locale?: keyof ILocaleRecord;
   tz?: string;

package/vona/src/suite-vendor/a-vona/modules/a-jwt/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-jwt",
-  "version": "5.1.18",
+  "version": "5.1.19",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-jwt/src/lib/jwtClientLogging.test.ts

@@ -0,0 +1,182 @@
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+import { registerHooks } from 'node:module';
+import { test } from 'node:test';
+import ts from 'typescript';
+
+const previousApp = Object.getOwnPropertyDescriptor(globalThis, '__app__');
+const vonaUrl = new URL('../../../../../../../', import.meta.url);
+const clientUrl = new URL('../service/jwtClient.ts?fixture=jwtLogging', import.meta.url).href;
+const formatterUrl = new URL('packages-vona/vona-core/src/lib/core/logger/utils.ts', vonaUrl).href;
+const checkUrl = new URL('packages-utils/utils/src/check.ts', vonaUrl).href;
+const utilsUrl = new URL('packages-utils/utils/src/utils.ts', vonaUrl).href;
+const castUrl = new URL('packages-vona/vona-core/src/types/utils/cast.ts', vonaUrl).href;
+const fixture = (source: string) => `data:text/javascript,${encodeURIComponent(source)}`;
+const frameworkFixture = fixture(`
+  export class BeanBase {}
+  export { cast } from ${JSON.stringify(castUrl)};
+  export function deepExtend() { throw new Error('unexpected client initialization'); }
+`);
+const utilityFixture = fixture(`
+  export { isNil } from ${JSON.stringify(checkUrl)};
+  export { catchError } from ${JSON.stringify(utilsUrl)};
+`);
+const hooks = registerHooks({
+  resolve(specifier, context, nextResolve) {
+    if (context.parentURL === clientUrl) {
+      if (specifier === 'vona') return { url: frameworkFixture, shortCircuit: true };
+      if (specifier === '@cabloy/utils') return { url: utilityFixture, shortCircuit: true };
+      if (specifier === 'vona-module-a-bean') {
+        return {
+          url: fixture('export function Service() { return () => {}; }'),
+          shortCircuit: true,
+        };
+      }
+    }
+    if (context.parentURL === formatterUrl) {
+      if (specifier === '@cabloy/utils') return { url: checkUrl, shortCircuit: true };
+      if (specifier === '../../framework/useApp.ts') {
+        return {
+          url: fixture(
+            'export function useApp() { throw new Error("unexpected application access"); }',
+          ),
+          shortCircuit: true,
+        };
+      }
+    }
+    return nextResolve(specifier, context);
+  },
+  load(url, context, nextLoad) {
+    if (url === clientUrl) {
+      return {
+        format: 'module',
+        source: ts.transpileModule(readFileSync(new URL(url), 'utf8'), {
+          compilerOptions: {
+            experimentalDecorators: true,
+            target: ts.ScriptTarget.ESNext,
+            module: ts.ModuleKind.ESNext,
+          },
+        }).outputText,
+        shortCircuit: true,
+      };
+    }
+    return nextLoad(url, context);
+  },
+});
+const { ServiceJwtClient, formatLoggerFilter } = await (async () => {
+  try {
+    return { ...(await import(clientUrl)), ...(await import(formatterUrl)) };
+  } finally {
+    hooks.deregister();
+  }
+})();
+
+const secret = 'synthetic-jwt-secret-sentinel';
+
+for (const operation of ['sign', 'verify'] as const) {
+  for (const failure of [false, true]) {
+    test(`actual JWT ${operation} debug log, ${failure ? 'error' : 'success'}`, async () => {
+      const output: string[] = [];
+      const filter = formatLoggerFilter({ level: 'debug', child: undefined });
+      const error = new Error(secret);
+      const payloadData = Object.freeze({ value: secret });
+      const options = Object.freeze({ path: '/callback', expiresIn: 60 });
+      const signOptions = Object.freeze({ issuer: 'synthetic-test' });
+      const verifyOptions = Object.freeze({ issuer: 'synthetic-test' });
+      let calls = 0;
+      const fake: any = {
+        _clientName: 'access',
+        _clientOptions: { secret, signOptions, verifyOptions },
+        fieldClient: 'client',
+        fieldPath: 'path',
+        fieldData: 'data',
+        _signInner: ServiceJwtClient.prototype['_signInner'],
+        _verifyInner: ServiceJwtClient.prototype['_verifyInner'],
+        _checkVerifyPath: ServiceJwtClient.prototype._checkVerifyPath,
+        scope: { service: { jwtExtract: { fromAllWays: () => secret } } },
+        app: {
+          throw: () => {
+            throw new Error('unexpected authentication change');
+          },
+        },
+        $loggerChild: (name: string) => {
+          assert.equal(name, 'jwt');
+          return {
+            debug: (message: any) => {
+              const info = filter.transform({ level: 'debug', message }, filter.options);
+              assert.ok(info);
+              output.push(JSON.stringify(info));
+            },
+          };
+        },
+        _jwtInstance: {
+          sign: (payload: any, key: string, passedOptions: any, callback: any) => {
+            calls++;
+            assert.equal(key, secret);
+            assert.equal(payload.data, payloadData);
+            assert.equal(payload.client, 'access');
+            assert.equal(payload.path, '/callback');
+            assert.deepEqual(passedOptions, { ...signOptions, expiresIn: 60 });
+            callback(failure ? error : null, failure ? undefined : secret);
+          },
+          verify: (token: string, key: string, passedOptions: any, callback: any) => {
+            calls++;
+            assert.equal(token, secret);
+            assert.equal(key, secret);
+            assert.equal(passedOptions, verifyOptions);
+            callback(
+              failure ? error : null,
+              failure
+                ? undefined
+                : {
+                    client: 'access',
+                    path: '/callback',
+                    data: payloadData,
+                  },
+            );
+          },
+        },
+      };
+      const execution =
+        operation === 'sign'
+          ? ServiceJwtClient.prototype.sign.call(fake, payloadData, options)
+          : ServiceJwtClient.prototype.verify.call(fake, secret, options);
+      if (failure) {
+        await assert.rejects(execution, value => value === error);
+      } else {
+        assert.equal(await execution, operation === 'sign' ? secret : payloadData);
+      }
+      assert.equal(calls, 1);
+      assert.equal(output.length, 1);
+      assert.equal(output.join('\n').includes(secret), false);
+      assert.equal(
+        JSON.parse(output[0]!).message,
+        `jwt.${operation}: ${failure ? 'failed' : 'completed'}`,
+      );
+      assert.deepEqual(Object.getOwnPropertyDescriptor(globalThis, '__app__'), previousApp);
+    });
+  }
+}
+
+test('JWT extraction and missing-token behavior retain safe debug diagnostics', async () => {
+  const output: string[] = [];
+  let extracted = 0;
+  const fake = {
+    _clientName: 'access',
+    scope: {
+      service: {
+        jwtExtract: {
+          fromAllWays: () => {
+            extracted++;
+            return undefined;
+          },
+        },
+      },
+    },
+    _verifyInner: ServiceJwtClient.prototype['_verifyInner'],
+    $loggerChild: () => ({ debug: (message: () => string) => output.push(message()) }),
+  };
+  assert.equal(await ServiceJwtClient.prototype.verify.call(fake as any), undefined);
+  assert.equal(extracted, 1);
+  assert.deepEqual(output, ['jwt.verify: completed']);
+});

package/vona/src/suite-vendor/a-vona/modules/a-jwt/src/service/jwtClient.ts

@@ -53,10 +53,7 @@ export class ServiceJwtClient extends BeanBase {
     const [res, error] = await catchError(() => {
       return this._signInner(payloadData, options);
     });
-    this.$loggerChild('jwt').debug(
-      () =>
-        `jwt.sign: client:${this._clientName}, token:${res}${error ? `, error: ${error.message}` : ''}`,
-    );
+    this.$loggerChild('jwt').debug(() => `jwt.sign: ${error ? 'failed' : 'completed'}`);
     if (error) throw error;
     return res;
   }
@@ -99,10 +96,7 @@ export class ServiceJwtClient extends BeanBase {
     const [res, error] = await catchError(() => {
       return this._verifyInner(token, options);
     });
-    this.$loggerChild('jwt').debug(
-      () =>
-        `jwt.verify: client:${this._clientName}, token:${token}${error ? `, error: ${error.message}` : ''}`,
-    );
+    this.$loggerChild('jwt').debug(() => `jwt.verify: ${error ? 'failed' : 'completed'}`);
     if (error) throw error;
     return res;
   }

package/vona/src/suite-vendor/a-vona/modules/a-logger/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vona-module-a-logger",
-  "version": "5.1.16",
+  "version": "5.1.17",
   "gitHead": "a79189b882c17af5911573896a781bbb0046d37d",
   "description": "",
   "keywords": [

package/vona/src/suite-vendor/a-vona/modules/a-logger/src/bean/aopMethod.log.ts

@@ -8,7 +8,7 @@ import type {
 import type winston from 'winston';
 
 import { evaluateExpressions } from '@cabloy/utils';
-import { BeanAopMethodBase, SymbolBeanFullName } from 'vona';
+import { BeanAopMethodBase, getRequestBoundary, SymbolBeanFullName } from 'vona';
 import { AopMethod } from 'vona-module-a-aspect';
 
 export interface IAopMethodOptionsLog extends IDecoratorAopMethodOptions {
@@ -28,6 +28,7 @@ export class AopMethodLog
   implements IAopMethodGet, IAopMethodSet, IAopMethodExecute
 {
   get(options: IAopMethodOptionsLog, next: NextSync, receiver: any, prop: string): any {
+    if (getRequestBoundary()) return next();
     const context = this._getContext(options, receiver);
     const message = `${receiver[SymbolBeanFullName]}#${prop}(get)`;
     const logger = this.app.meta.logger.child(options.childName, options.clientName);
@@ -51,6 +52,7 @@ export class AopMethodLog
     receiver: any,
     prop: string,
   ): boolean {
+    if (getRequestBoundary()) return next();
     const context = this._getContext(options, receiver);
     const message = `${receiver[SymbolBeanFullName]}#${prop}(set)`;
     const logger = this.app.meta.logger.child(options.childName, options.clientName);
@@ -74,6 +76,7 @@ export class AopMethodLog
     receiver: any,
     prop: string,
   ): Promise<any> | any {
+    if (getRequestBoundary()) return next();
     const context = this._getContext(options, receiver);
     const message = `${receiver[SymbolBeanFullName]}#${prop}`;
     const logger = this.app.meta.logger.child(options.childName, options.clientName);

package/vona/src/suite-vendor/a-vona/modules/a-logger/src/bean/bean.logger.ts

@@ -9,11 +9,14 @@ import type * as Transport from 'winston-transport';
 
 import {
   BeanBase,
+  formatLoggerBoundary,
   formatLoggerConsole,
   formatLoggerCtx,
   formatLoggerDummy,
   formatLoggerErrors,
   formatLoggerFilter,
+  getRequestBoundary,
+  getSuppressedDiagnosticLogger,
 } from 'vona';
 import { Bean } from 'vona-module-a-bean';
 import * as Winston from 'winston';
@@ -39,10 +42,12 @@ export class BeanLogger extends BeanBase {
   }
 
   public get default(): Winston.Logger {
+    if (getRequestBoundary()) return getSuppressedDiagnosticLogger();
     return this.app.meta.logger.get();
   }
 
   public get(clientName?: keyof ILoggerClientRecord): Winston.Logger {
+    if (getRequestBoundary()) return getSuppressedDiagnosticLogger();
     return this.app.meta.logger.get(clientName);
   }
 
@@ -50,11 +55,13 @@ export class BeanLogger extends BeanBase {
     childName: keyof ILoggerChildRecord,
     clientName?: keyof ILoggerClientRecord,
   ): Winston.Logger {
+    if (getRequestBoundary()) return getSuppressedDiagnosticLogger();
     return this.app.meta.logger.get(clientName).child({ name: childName });
   }
 
   public makeFormatBase(opts: ILoggerFormatOpts) {
     return Winston.format.combine(
+      formatLoggerBoundary(),
       formatLoggerErrors(opts),
       formatLoggerCtx(),
       Winston.format.splat(),
@@ -71,6 +78,7 @@ export class BeanLogger extends BeanBase {
     return this.app.meta.logger.createTransportFile(fileName, clientInfo, {
       level: levelStrict ?? 'silly',
       format: Winston.format.combine(
+        formatLoggerBoundary(),
         formatLoggerFilter({
           child: childStrict ?? clientInfo.child,
           level: levelStrict ?? clientInfo.level,
@@ -85,6 +93,7 @@ export class BeanLogger extends BeanBase {
     return new Winston.transports.Console({
       level: 'silly',
       format: Winston.format.combine(
+        formatLoggerBoundary(),
         formatLoggerDummy(),
         formatLoggerFilter({ child: clientInfo.child, level: clientInfo.level, silly: true }),
         Winston.format.colorize(),

package/vona/src/suite-vendor/a-vona/modules/a-logger/src/bean/middlewareSystem.httpLog.ts

@@ -5,9 +5,10 @@ import type {
 } from 'vona-module-a-aspect';
 
 import StdSerializers from 'pino-std-serializers';
-import { BeanBase } from 'vona';
+import { BeanBase, getRequestBoundary } from 'vona';
 import { MiddlewareSystem } from 'vona-module-a-aspect';
 
+import { redactHttpLogHeaders, redactHttpLogUrl } from '../lib/redactHttpLog.ts';
 import { redactIsolatedReadyHeader } from '../lib/redactIsolatedReadyHeader.ts';
 
 export interface IMiddlewareSystemOptionsHttpLog extends IDecoratorMiddlewareSystemOptions {}
@@ -15,28 +16,40 @@ export interface IMiddlewareSystemOptionsHttpLog extends IDecoratorMiddlewareSys
 @MiddlewareSystem<IMiddlewareSystemOptionsHttpLog>()
 export class MiddlewareSystemHttpLog extends BeanBase implements IMiddlewareSystemExecute {
   async execute(_options: IMiddlewareSystemOptionsHttpLog, next: Next) {
+    if (getRequestBoundary()) return next();
     const ctx = this.ctx;
     // start
-    const req = StdSerializers.req(ctx.req);
-    req.headers = redactIsolatedReadyHeader(
-      req.headers,
-      ctx.path,
-      this.app.meta.env.VONA_TEST_RUN_ID,
-      ['x-vona-test-challenge', 'x-vona-test-stop-nonce', 'x-vona-test-stop-authorization'],
-    );
+    const serialized = StdSerializers.req(ctx.req);
+    // Do not retain serializer query/params/raw extensions or request bodies in logs.
+    const req = {
+      method: serialized.method,
+      url: redactHttpLogUrl(serialized.url),
+      headers: redactHttpLogHeaders(
+        redactIsolatedReadyHeader(
+          serialized.headers,
+          ctx.path,
+          this.app.meta.env.VONA_TEST_RUN_ID,
+          ['x-vona-test-challenge', 'x-vona-test-stop-nonce', 'x-vona-test-stop-authorization'],
+        ),
+      ),
+      remoteAddress: serialized.remoteAddress,
+      remotePort: serialized.remotePort,
+    };
     this.$loggerChild('req').http(() => JSON.stringify(req));
     const profiler = this.$loggerChild('res').startTimer();
     // next
     await next();
     // end
-    const headers = redactIsolatedReadyHeader(
-      ctx.res.getHeaders(),
-      ctx.path,
-      this.app.meta.env.VONA_TEST_RUN_ID,
-      ['x-vona-test-proof', 'x-vona-test-stop-proof'],
+    const headers = redactHttpLogHeaders(
+      redactIsolatedReadyHeader(
+        ctx.res.getHeaders(),
+        ctx.path,
+        this.app.meta.env.VONA_TEST_RUN_ID,
+        ['x-vona-test-proof', 'x-vona-test-stop-proof'],
+      ),
     );
     const res = {
-      url: ctx.req.url,
+      url: redactHttpLogUrl(ctx.req.url),
       statusCode: ctx.res.statusCode,
       headers,
     };