evlog 2.17.0 → 2.19.0

package/dist/{audit-pV5aLGP0.mjs → audit-BFwTUxBJ.mjs}

@@ -1,8 +1,118 @@
-import { colors, cssColors, detectEnvironment, escapeFormatString, formatDuration, getConsoleMethod, getCssLevelColor, getLevelColor, isBrowser, isDev, isLevelEnabled, matchesPattern } from "./utils.mjs";
-import { r as getHeader$1 } from "./headers-CU-QqnYg.mjs";
+import { colors, cssColors, detectEnvironment, escapeFormatString, formatDuration, getConsoleMethod, getCssLevelColor, getLevelColor, globToRegExp, isBrowser, isDev, isLevelEnabled, matchesPattern } from "./utils.mjs";
+import { i as registerPrettyErrorSnippetReader, n as buildErrorEntries } from "./pretty-error-CVVgwlTn.mjs";
+import { t as resolveDevTerminal } from "./dev-terminal-D4UaEm17.mjs";
+import { EvlogError } from "./error.mjs";
+import { r as getHeader$1 } from "./headers-VtmnWcfn.mjs";
 //#region src/redact.ts
 const DEFAULT_REPLACEMENT = "[REDACTED]";
 /**
+* Normalize a redact path pattern.
+* Single segments without wildcards are shorthand for `**.<segment>`.
+*/
+function normalizeRedactPathPattern(pattern) {
+	if (!pattern.includes("*") && !pattern.includes(".")) return `**.${pattern}`;
+	return pattern;
+}
+/**
+* Compile `RedactConfig.paths` into exact paths, path globs, and key globs.
+* Returns `undefined` when `patterns` is empty.
+*/
+function compileRedactPathMatchers(patterns) {
+	if (!patterns?.length) return void 0;
+	const exactPaths = /* @__PURE__ */ new Set();
+	const pathGlobs = [];
+	const keyGlobs = [];
+	const caseInsensitiveLeaves = /* @__PURE__ */ new Set();
+	for (const raw of patterns) {
+		if (!raw.includes("*")) {
+			if (raw.includes(".")) exactPaths.add(raw);
+			else addPathGlobPattern(normalizeRedactPathPattern(raw), exactPaths, pathGlobs, caseInsensitiveLeaves);
+			continue;
+		}
+		if (!raw.includes(".")) keyGlobs.push(globToRegExp(raw, "."));
+		else addPathGlobPattern(raw, exactPaths, pathGlobs, caseInsensitiveLeaves);
+	}
+	if (exactPaths.size === 0 && pathGlobs.length === 0 && keyGlobs.length === 0 && caseInsensitiveLeaves.size === 0) return;
+	return {
+		exactPaths,
+		pathGlobs,
+		keyGlobs,
+		caseInsensitiveLeaves
+	};
+}
+/** `**.segment` also matches a top-level `segment` field. */
+function addPathGlobPattern(pattern, exactPaths, pathGlobs, caseInsensitiveLeaves) {
+	pathGlobs.push(globToRegExp(pattern, "."));
+	const leaf = pattern.match(/^\*\*\.([^.?*]+)$/);
+	if (leaf) {
+		exactPaths.add(leaf[1]);
+		caseInsensitiveLeaves.add(leaf[1]);
+	}
+}
+/**
+* Whether a field at `fullPath` (dot-notation from root) with leaf key `leafKey`
+* should be fully redacted.
+*/
+function matchesRedactPath(fullPath, leafKey, matchers) {
+	if (matchers.exactPaths.has(fullPath)) return true;
+	const leafLower = leafKey.toLowerCase();
+	for (const name of matchers.caseInsensitiveLeaves) if (leafLower === name.toLowerCase()) return true;
+	for (const glob of matchers.pathGlobs) {
+		glob.lastIndex = 0;
+		if (glob.test(fullPath)) return true;
+	}
+	for (const glob of matchers.keyGlobs) {
+		glob.lastIndex = 0;
+		if (glob.test(leafKey)) return true;
+	}
+	return false;
+}
+/**
+* Redact fields matching path globs recursively. Mutates `obj` in place (use on a clone).
+*/
+function redactPathsInTree(obj, matchers, replacement, prefix = "") {
+	if (obj === null || obj === void 0) return;
+	if (Array.isArray(obj)) {
+		for (let i = 0; i < obj.length; i++) {
+			const segment = String(i);
+			const fullPath = prefix ? `${prefix}.${segment}` : segment;
+			redactPathsInTree(obj[i], matchers, replacement, fullPath);
+		}
+		return;
+	}
+	if (typeof obj === "object") {
+		const record = obj;
+		for (const key in record) {
+			const fullPath = prefix ? `${prefix}.${key}` : key;
+			if (matchesRedactPath(fullPath, key, matchers)) record[key] = replacement;
+			else redactPathsInTree(record[key], matchers, replacement, fullPath);
+		}
+	}
+}
+/**
+* Return a copy of `value` with path-pattern matches replaced by `replacement`.
+* Used by audit diffs; does not mutate the input.
+*
+* `pointerPath` is a JSON Pointer (e.g. `/user/password`).
+*/
+function redactValueByPaths(value, matchers, replacement, pointerPath = "") {
+	const segments = pointerPath.split("/").filter(Boolean);
+	const dotPath = segments.join(".");
+	const leafKey = segments.at(-1) ?? "";
+	if (value === null || typeof value !== "object") {
+		if (dotPath && matchesRedactPath(dotPath, leafKey, matchers)) return replacement;
+		return value;
+	}
+	if (Array.isArray(value)) return value.map((v, i) => redactValueByPaths(v, matchers, replacement, `${pointerPath}/${i}`));
+	if (!isPlainRecord(value)) return value;
+	const out = {};
+	for (const [k, v] of Object.entries(value)) {
+		const childPointer = pointerPath ? `${pointerPath}/${k}` : `/${k}`;
+		out[k] = matchesRedactPath(dotPath ? `${dotPath}.${k}` : k, k, matchers) ? replacement : redactValueByPaths(v, matchers, replacement, childPointer);
+	}
+	return out;
+}
+/**
 * Built-in PII detection patterns with smart masking.
 * Each builtin preserves just enough signal for debugging while scrubbing PII.
 */
@@ -89,32 +199,56 @@ function allBuiltinMaskers() {
 function cloneRegex(re) {
 	return new RegExp(re.source, re.flags);
 }
+/** @internal Set on wide events after initLogger redaction so middleware skips a second pass. */
+const globallyRedacted = Symbol.for("evlog.globallyRedacted");
+/** @internal Mark a wide event as already redacted by {@link initLogger}. */
+function markGloballyRedacted(event) {
+	Object.defineProperty(event, globallyRedacted, {
+		value: true,
+		enumerable: false,
+		configurable: true
+	});
+}
+/** @internal Whether global redaction already ran on this wide event. */
+function isGloballyRedacted(event) {
+	return Reflect.has(event, globallyRedacted);
+}
 /**
-* Redact sensitive data from a wide event in-place.
+* Clone before redaction. Wide events are JSON-shaped; fall back when
+* `structuredClone` rejects non-cloneable values (functions, symbols, etc.).
+*/
+function cloneForRedaction(event) {
+	try {
+		return structuredClone(event);
+	} catch {
+		try {
+			return JSON.parse(JSON.stringify(event));
+		} catch {
+			console.warn("[cloneForRedaction] Shallow clone used — nested objects may be mutated by redactPath, redactPatterns, and applyMaskersToTree");
+			return { ...event };
+		}
+	}
+}
+/**
+* Redact sensitive data from a wide event without mutating the input.
 *
-* Three strategies applied in order:
-* 1. **Path-based**: dot-notation paths — the leaf value is replaced with `replacement`.
+* Returns a deep clone with redaction applied. Three strategies run in order:
+* 1. **Path-based**: dot-notation paths with optional globs (`password`, `**.password`, `*_token`, `user.*`) — full value replacement.
 * 2. **Masker-based**: built-in patterns with smart partial masking (e.g. `****1111`).
-* 3. **Pattern-based**: custom RegExp patterns replaced with `replacement`.
+* 3. **Pattern-based**: custom RegExp patterns on string values replaced with `replacement`.
 *
-* @param event - The wide event object (mutated in-place).
+* @param event - The wide event object (not mutated).
 * @param config - Redaction configuration.
+* @returns A redacted deep clone of `event`.
 */
 function redactEvent(event, config) {
+	const clone = cloneForRedaction(event);
 	const replacement = config.replacement ?? DEFAULT_REPLACEMENT;
-	if (config.paths?.length) for (const path of config.paths) redactPath(event, path.split("."), replacement);
-	if (config._maskers?.length) applyMaskersToTree(event, config._maskers);
-	if (config.patterns?.length) redactPatterns(event, config.patterns, replacement);
-}
-function redactPath(obj, segments, replacement) {
-	let current = obj;
-	for (let i = 0; i < segments.length - 1; i++) {
-		if (current === null || current === void 0 || typeof current !== "object") return;
-		current = current[segments[i]];
-	}
-	if (current === null || current === void 0 || typeof current !== "object") return;
-	const leaf = segments[segments.length - 1];
-	if (leaf in current) current[leaf] = replacement;
+	const pathMatchers = compileRedactPathMatchers(config.paths);
+	if (pathMatchers) redactPathsInTree(clone, pathMatchers, replacement);
+	if (config._maskers?.length) applyMaskersToTree(clone, config._maskers);
+	if (config.patterns?.length) redactPatterns(clone, config.patterns, replacement);
+	return clone;
 }
 function redactPatterns(obj, patterns, replacement) {
 	if (obj === null || obj === void 0) return;
@@ -177,17 +311,34 @@ function normalizeRedactConfig(raw) {
 	if (typeof raw.replacement === "string") config.replacement = raw.replacement;
 	if (raw.builtins === false) config.builtins = false;
 	else if (Array.isArray(raw.builtins)) config.builtins = raw.builtins;
-	if (Array.isArray(raw.patterns)) config.patterns = raw.patterns.map((p) => {
-		if (p instanceof RegExp) return p;
-		if (typeof p === "string") return new RegExp(p, "g");
-		if (typeof p === "object" && p !== null) {
-			const obj = p;
-			return new RegExp(obj.source, obj.flags ?? "g");
-		}
-		return null;
-	}).filter((p) => p !== null);
+	if (Array.isArray(raw.patterns)) config.patterns = deserializeRegexList(raw.patterns);
 	return resolveRedactConfig(config);
 }
+function isPlainRecord(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
+function deserializeRegexList(raw) {
+	const patterns = [];
+	for (const p of raw) try {
+		if (p instanceof RegExp) {
+			patterns.push(cloneRegex(p));
+			continue;
+		}
+		if (typeof p === "string") {
+			patterns.push(new RegExp(p, "g"));
+			continue;
+		}
+		if (typeof p === "object" && p !== null && typeof p.source === "string") {
+			const flags = typeof p.flags === "string" ? p.flags : "g";
+			patterns.push(new RegExp(p.source, flags));
+		}
+	} catch {
+		console.warn("[normalizeRedactConfig] Ignoring invalid redact regex entry");
+	}
+	return patterns;
+}
 //#endregion
 //#region src/shared/plugin.ts
 /** Identity helper preserving plugin type inference. */
@@ -314,7 +465,7 @@ function getEmptyPluginRunner() {
 }
 //#endregion
 //#region src/logger.ts
-function isPlainObject(val) {
+function isPlainObject$1(val) {
 	return val !== null && typeof val === "object" && !Array.isArray(val);
 }
 const _tsDate = /* @__PURE__ */ new Date();
@@ -332,16 +483,38 @@ function mergeInto(target, source) {
 		const sourceVal = source[key];
 		if (sourceVal === void 0 || sourceVal === null) continue;
 		const targetVal = target[key];
-		if (isPlainObject(sourceVal) && isPlainObject(targetVal)) mergeInto(targetVal, sourceVal);
+		if (isPlainObject$1(sourceVal) && isPlainObject$1(targetVal)) mergeInto(targetVal, sourceVal);
 		else if (Array.isArray(targetVal) && Array.isArray(sourceVal)) target[key] = [...targetVal, ...sourceVal];
 		else target[key] = sourceVal;
 	}
 }
+const pendingDrainState = /* @__PURE__ */ new WeakMap();
+function isAiOnlyFieldUpdate(data) {
+	const keys = Object.keys(data);
+	return keys.length === 1 && keys[0] === "ai";
+}
+/**
+* Mark a wide event as past the post-emit AI merge window so late `log.set({ ai })`
+* calls warn again. Called by framework enrich/drain pipelines before drain runs.
+*
+* @internal Used by middleware and framework integrations.
+*/
+function markWideEventDrainStarted(event) {
+	if (!event) return;
+	const state = pendingDrainState.get(event);
+	if (state) state.drainStarted = true;
+}
 let globalEnv = {
 	service: "app",
 	environment: "development"
 };
 let globalPretty = isDev();
+let globalPrettyError = {
+	snippet: isDev(),
+	stackDepth: 2,
+	compact: isDev(),
+	detail: "full"
+};
 let globalSampling = {};
 let globalStringify = true;
 let globalDrain;
@@ -367,6 +540,7 @@ function initLogger(config = {}) {
 		region: config.env?.region ?? detected.region
 	};
 	globalPretty = config.pretty ?? isDev();
+	globalPrettyError = resolveDevTerminal(config).prettyError;
 	globalSampling = config.sampling ?? {};
 	globalStringify = config.stringify ?? true;
 	globalDrain = config.drain;
@@ -375,6 +549,11 @@ function initLogger(config = {}) {
 	globalMinLevel = config.minLevel ?? "debug";
 	globalPluginRunner = config.plugins?.length ? createPluginRunner(config.plugins) : getEmptyPluginRunner();
 	if (globalPluginRunner.plugins.length > 0) globalPluginRunner.runSetup({ env: { ...globalEnv } });
+	if (!isBrowser() && typeof process !== "undefined" && process.versions?.node) import("./pretty-error-snippet.node-c_bzjg7g.mjs").then((n) => n.t).then((mod) => {
+		registerPrettyErrorSnippetReader(mod.readCodeSnippetFromDisk);
+	}).catch(() => {
+		registerPrettyErrorSnippetReader(null);
+	});
 	const hasAnyDrain = !!globalDrain || globalPluginRunner.hasDrain;
 	if (globalSilent && !hasAnyDrain && !config._suppressDrainWarning) console.warn("[evlog] silent mode is enabled but no drain is configured. Events will be built and sampled but not output anywhere. Set a drain via initLogger({ drain }) or a framework hook (evlog:drain).");
 }
@@ -464,7 +643,10 @@ function emitWideEvent(level, event, options = {}) {
 		...event
 	};
 	finalizeAudit(formatted);
-	if (globalRedact) redactEvent(formatted, globalRedact);
+	if (globalRedact) {
+		formatted = redactEvent(formatted, globalRedact);
+		markGloballyRedacted(formatted);
+	}
 	if (!globalSilent) if (globalPretty) prettyPrintWideEvent(formatted);
 	else if (globalStringify) console[getConsoleMethod(level)](JSON.stringify(formatted));
 	else console[getConsoleMethod(level)](formatted);
@@ -505,7 +687,7 @@ function emitTaggedLog(level, tag, message) {
 }
 function formatValue(value) {
 	if (value === null || value === void 0) return String(value);
-	if (typeof value === "object") {
+	if (isPlainObject$1(value)) {
 		const pairs = [];
 		for (const [k, v] of Object.entries(value)) if (v !== void 0 && v !== null) if (typeof v === "object") pairs.push(`${k}=${JSON.stringify(v)}`);
 		else pairs.push(`${k}=${v}`);
@@ -518,6 +700,43 @@ function formatCost(cost) {
 	if (cost < 1) return `$${cost.toFixed(4)}`;
 	return `$${cost.toFixed(2)}`;
 }
+function asNumber(value) {
+	return typeof value === "number" ? value : void 0;
+}
+function asStringArray(value) {
+	if (!Array.isArray(value)) return void 0;
+	return value.every((item) => typeof item === "string") ? value : void 0;
+}
+function isToolUsageEntry(value) {
+	return isPlainObject$1(value) && typeof value.name === "string" && typeof value.durationMs === "number" && typeof value.success === "boolean";
+}
+function asToolUsageArray(value) {
+	if (!Array.isArray(value)) return void 0;
+	return value.every(isToolUsageEntry) ? value : void 0;
+}
+function serializeToolInput(input) {
+	if (typeof input === "string") return input;
+	const seen = /* @__PURE__ */ new WeakSet();
+	try {
+		return JSON.stringify(input, (_key, value) => {
+			if (typeof value === "bigint") return value.toString();
+			if (typeof value === "object" && value !== null) {
+				if (seen.has(value)) return "[Circular]";
+				seen.add(value);
+			}
+			return value;
+		}) ?? "";
+	} catch {
+		return "[unserializable tool input]";
+	}
+}
+function isToolCallEntry(value) {
+	return isPlainObject$1(value) && typeof value.name === "string" && "input" in value;
+}
+function asToolCallArray(value) {
+	if (!Array.isArray(value)) return void 0;
+	return value.every(isToolCallEntry) ? value : void 0;
+}
 function buildAIEntries(ai) {
 	const entries = [];
 	const headerParts = [];
@@ -526,15 +745,19 @@ function buildAIEntries(ai) {
 		if (ai.provider) m += ` (${ai.provider})`;
 		headerParts.push(m);
 	}
-	if (ai.calls) headerParts.push(`${ai.calls} call${ai.calls > 1 ? "s" : ""}`);
-	if (ai.steps && ai.steps > 1) headerParts.push(`${ai.steps} steps`);
+	if (ai.calls) {
+		const calls = asNumber(ai.calls);
+		if (calls !== void 0) headerParts.push(`${calls} call${calls > 1 ? "s" : ""}`);
+	}
+	const steps = asNumber(ai.steps);
+	if (steps !== void 0 && steps > 1) headerParts.push(`${steps} steps`);
 	entries.push({
 		key: "ai",
 		value: headerParts.join(" · ")
 	});
-	const inputTokens = ai.inputTokens;
-	const outputTokens = ai.outputTokens;
-	const totalTokens = ai.totalTokens;
+	const inputTokens = asNumber(ai.inputTokens);
+	const outputTokens = asNumber(ai.outputTokens);
+	const totalTokens = asNumber(ai.totalTokens);
 	if (inputTokens !== void 0 && outputTokens !== void 0) {
 		let tokLine = `${inputTokens} in → ${outputTokens} out`;
 		if (totalTokens) tokLine += ` (${totalTokens} total)`;
@@ -548,9 +771,9 @@ function buildAIEntries(ai) {
 			value: tokLine
 		});
 	}
-	const msFirst = ai.msToFirstChunk;
-	const msFinish = ai.msToFinish;
-	const tps = ai.tokensPerSecond;
+	const msFirst = asNumber(ai.msToFirstChunk);
+	const msFinish = asNumber(ai.msToFinish);
+	const tps = asNumber(ai.tokensPerSecond);
 	if (msFirst !== void 0 || msFinish !== void 0) {
 		const parts = [];
 		if (msFirst !== void 0) parts.push(`${formatDuration(msFirst)} to first chunk`);
@@ -562,25 +785,28 @@ function buildAIEntries(ai) {
 			value: streamLine
 		});
 	}
-	if (ai.estimatedCost !== void 0) entries.push({
+	const estimatedCost = asNumber(ai.estimatedCost);
+	if (estimatedCost !== void 0) entries.push({
 		key: "ai.cost",
-		value: formatCost(ai.estimatedCost)
+		value: formatCost(estimatedCost)
 	});
-	if (ai.totalDurationMs !== void 0) entries.push({
+	const totalDurationMs = asNumber(ai.totalDurationMs);
+	if (totalDurationMs !== void 0) entries.push({
 		key: "ai.totalDuration",
-		value: formatDuration(ai.totalDurationMs)
+		value: formatDuration(totalDurationMs)
 	});
-	const toolCalls = ai.toolCalls;
-	const tools = ai.tools;
-	const hasInputs = toolCalls?.length ? typeof toolCalls[0] === "object" : false;
+	const toolCalls = Array.isArray(ai.toolCalls) ? ai.toolCalls : void 0;
+	const tools = asToolUsageArray(ai.tools);
+	const toolCallEntries = toolCalls ? asToolCallArray(toolCalls) : void 0;
+	const hasInputs = toolCallEntries !== void 0 && toolCallEntries.length > 0;
 	if (tools?.length) {
 		const children = tools.map((t, idx) => {
 			const mark = t.success ? "✓" : "✗";
 			let line = `${t.name} ${formatDuration(t.durationMs)} ${mark}`;
 			if (t.error) line += ` ${t.error}`;
-			if (hasInputs && toolCalls && idx < toolCalls.length) {
-				const tc = toolCalls[idx];
-				const inputStr = typeof tc.input === "string" ? tc.input : JSON.stringify(tc.input);
+			if (hasInputs && toolCallEntries && idx < toolCallEntries.length) {
+				const tc = toolCallEntries[idx];
+				const inputStr = serializeToolInput(tc.input);
 				const truncated = inputStr.length > 100 ? `${inputStr.slice(0, 100)}…` : inputStr;
 				line += ` ${truncated}`;
 			}
@@ -591,9 +817,9 @@ function buildAIEntries(ai) {
 			value: "",
 			children
 		});
-	} else if (toolCalls?.length) if (hasInputs) {
-		const children = toolCalls.map((tc) => {
-			const inputStr = typeof tc.input === "string" ? tc.input : JSON.stringify(tc.input);
+	} else if (toolCalls?.length) if (toolCallEntries?.length) {
+		const children = toolCallEntries.map((tc) => {
+			const inputStr = serializeToolInput(tc.input);
 			const truncated = inputStr.length > 100 ? `${inputStr.slice(0, 100)}…` : inputStr;
 			return `${tc.name}(${truncated})`;
 		});
@@ -602,16 +828,20 @@ function buildAIEntries(ai) {
 			value: "",
 			children
 		});
-	} else entries.push({
-		key: "ai.tools",
-		value: toolCalls.join(", ")
-	});
-	const stepsUsage = ai.stepsUsage;
+	} else {
+		const names = asStringArray(toolCalls);
+		if (names?.length) entries.push({
+			key: "ai.tools",
+			value: names.join(", ")
+		});
+	}
+	const stepsUsage = Array.isArray(ai.stepsUsage) ? ai.stepsUsage.filter(isPlainObject$1) : void 0;
 	if (stepsUsage?.length) {
-		const allSameModel = stepsUsage.every((s) => s.model === stepsUsage[0].model);
+		const firstModel = stepsUsage[0]?.model;
+		const allSameModel = firstModel !== void 0 && stepsUsage.every((s) => s.model === firstModel);
 		const children = stepsUsage.map((s) => {
-			let line = `${allSameModel ? "" : `${s.model} `}${s.inputTokens} in → ${s.outputTokens} out`;
-			const stepTools = s.toolCalls;
+			let line = `${allSameModel ? "" : `${String(s.model)} `}${s.inputTokens} in → ${s.outputTokens} out`;
+			const stepTools = asStringArray(s.toolCalls);
 			if (stepTools?.length) line += ` [${stepTools.join(", ")}]`;
 			return line;
 		});
@@ -620,11 +850,11 @@ function buildAIEntries(ai) {
 			value: "",
 			children
 		});
-	} else if (ai.steps && ai.steps > 1) entries.push({
+	} else if (steps !== void 0 && steps > 1) entries.push({
 		key: "ai.steps",
-		value: String(ai.steps)
+		value: String(steps)
 	});
-	const embedding = ai.embedding;
+	const embedding = isPlainObject$1(ai.embedding) ? ai.embedding : void 0;
 	if (embedding) {
 		const parts = [];
 		if (embedding.model) parts.push(String(embedding.model));
@@ -650,19 +880,39 @@ function buildAIEntries(ai) {
 	});
 	return entries;
 }
+function flushPrettyLines(lines) {
+	if (lines.length === 0) return;
+	const text = `${lines.join("\n")}\n`;
+	if (typeof process !== "undefined" && typeof process.stdout?.write === "function" && !isBrowser() && process.env.VITEST !== "true") {
+		process.stdout.write(text);
+		return;
+	}
+	console.log(lines.join("\n"));
+}
 function prettyPrintWideEvent(event) {
 	const { timestamp, level, service, environment, version, ...rest } = event;
-	const ts = timestamp.slice(11, 23);
+	const ts = typeof timestamp === "string" ? timestamp.slice(11, 23) : "";
+	const levelLabel = typeof level === "string" ? level : "info";
 	const browser = isBrowser();
+	const lines = [];
+	const writeLine = (...args) => {
+		if (browser) {
+			console.log(...args);
+			return;
+		}
+		const [line] = args;
+		if (typeof line === "string") lines.push(line);
+	};
 	const parts = [];
 	const styles = [];
 	if (browser) {
-		const lc = getCssLevelColor(level);
-		parts.push(`%c${ts}%c %c${level.toUpperCase()}%c %c[${escapeFormatString(String(service))}]%c`);
+		const lc = getCssLevelColor(levelLabel);
+		parts.push(`%c${ts}%c %c${levelLabel.toUpperCase()}%c %c[${escapeFormatString(String(service))}]%c`);
 		styles.push(cssColors.dim, cssColors.reset, lc, cssColors.reset, cssColors.cyan, cssColors.reset);
 	} else {
-		const lc = getLevelColor(level);
-		parts.push(`${colors.dim}${ts}${colors.reset} ${lc}${level.toUpperCase()}${colors.reset} ${colors.cyan}[${service}]${colors.reset}`);
+		const lc = getLevelColor(levelLabel);
+		if (isDev()) parts.push(`${lc}${levelLabel.toUpperCase()}${colors.reset} ${colors.cyan}[${service}]${colors.reset}`);
+		else parts.push(`${colors.dim}${ts}${colors.reset} ${lc}${levelLabel.toUpperCase()}${colors.reset} ${colors.cyan}[${service}]${colors.reset}`);
 	}
 	if (rest.method && rest.path) {
 		parts.push(browser ? ` ${escapeFormatString(String(rest.method))} ${escapeFormatString(String(rest.path))}` : ` ${rest.method} ${rest.path}`);
@@ -670,7 +920,8 @@ function prettyPrintWideEvent(event) {
 		delete rest.path;
 	}
 	if (rest.status) {
-		const sc = browser ? rest.status >= 400 ? cssColors.red : cssColors.green : rest.status >= 400 ? colors.red : colors.green;
+		const statusCode = asNumber(rest.status) ?? Number(rest.status);
+		const sc = browser ? statusCode >= 400 ? cssColors.red : cssColors.green : statusCode >= 400 ? colors.red : colors.green;
 		if (browser) {
 			parts.push(` %c${rest.status}%c`);
 			styles.push(sc, cssColors.reset);
@@ -684,36 +935,53 @@ function prettyPrintWideEvent(event) {
 		} else parts.push(` ${colors.dim}in ${rest.duration}${colors.reset}`);
 		delete rest.duration;
 	}
-	console.log(parts.join(""), ...styles);
-	const aiData = rest.ai;
-	if (aiData && typeof aiData === "object") delete rest.ai;
+	writeLine(parts.join(""), ...styles);
+	const aiData = isPlainObject$1(rest.ai) ? rest.ai : void 0;
+	if (aiData) delete rest.ai;
+	const errorData = rest.error;
+	if (errorData !== void 0) delete rest.error;
 	const restEntries = Object.entries(rest).filter(([_, v]) => v !== void 0);
 	const aiEntries = aiData ? buildAIEntries(aiData) : [];
-	const allEntries = [...restEntries.map(([key, value]) => ({
+	const errorEntries = errorData !== void 0 ? buildErrorEntries(errorData, globalPrettyError) : [];
+	const contextEntries = [...restEntries.map(([key, value]) => ({
 		key,
 		value: formatValue(value)
 	})), ...aiEntries];
+	const allEntries = errorEntries.length > 0 ? [...errorEntries, ...contextEntries] : contextEntries;
 	for (let i = 0; i < allEntries.length; i++) {
 		const entry = allEntries[i];
-		const hasChildren = entry.children && entry.children.length > 0;
+		if (!entry) continue;
+		const { children } = entry;
+		const hasChildren = children !== void 0 && children.length > 0;
 		const prefix = i === allEntries.length - 1 && !hasChildren ? "└─" : "├─";
 		if (browser) {
 			const val = entry.value ? ` ${escapeFormatString(entry.value)}` : "";
-			console.log(`  %c${prefix}%c %c${escapeFormatString(entry.key)}:%c${val}`, cssColors.dim, cssColors.reset, cssColors.cyan, cssColors.reset);
+			writeLine(`  %c${prefix}%c %c${escapeFormatString(entry.key)}:%c${val}`, cssColors.dim, cssColors.reset, cssColors.cyan, cssColors.reset);
 		} else {
 			const val = entry.value ? ` ${entry.value}` : "";
-			console.log(`  ${colors.dim}${prefix}${colors.reset} ${colors.cyan}${entry.key}:${colors.reset}${val}`);
+			writeLine(`  ${colors.dim}${prefix}${colors.reset} ${colors.cyan}${entry.key}:${colors.reset}${val}`);
 		}
-		if (hasChildren) {
+		if (hasChildren && children) {
 			const connector = i === allEntries.length - 1 ? " " : "│";
-			for (let j = 0; j < entry.children.length; j++) {
-				const child = entry.children[j];
-				const childPrefix = j === entry.children.length - 1 ? "└─" : "├─";
-				if (browser) console.log(`  %c${connector}  ${childPrefix}%c ${escapeFormatString(child)}`, cssColors.dim, cssColors.reset);
-				else console.log(`  ${colors.dim}${connector}  ${childPrefix}${colors.reset} ${child}`);
+			for (let j = 0; j < children.length; j++) {
+				const child = children[j];
+				if (child === void 0) continue;
+				if (child === "__EVLOG_TREE_SPACER__") {
+					writeLine(`  ${colors.dim}${connector}${colors.reset}`);
+					continue;
+				}
+				const childPrefix = j === children.length - 1 ? "└─" : "├─";
+				if (child === "") {
+					writeLine("");
+					continue;
+				}
+				if (browser) writeLine(`  %c${connector}  ${childPrefix}%c ${escapeFormatString(child)}`, cssColors.dim, cssColors.reset);
+				else if (child.startsWith(" ") || child.startsWith("\x1B")) writeLine(`  ${colors.dim}${connector}${colors.reset}${child}`);
+				else writeLine(`  ${colors.dim}${connector}  ${childPrefix}${colors.reset} ${child}`);
 			}
 		}
 	}
+	if (!browser && lines.length > 0) flushPrettyLines(lines);
 }
 function createLogMethod(level) {
 	return function logMethod(tagOrEvent, message) {
@@ -739,6 +1007,7 @@ const _log = {
 };
 const noopLogger = {
 	set() {},
+	setLevel() {},
 	error() {},
 	info() {},
 	warn() {},
@@ -773,7 +1042,9 @@ function createLogger(initialContext = {}, internalOptions) {
 	const context = { ...initialContext };
 	let hasError = false;
 	let hasWarn = false;
+	let manualLevel;
 	let emitted = false;
+	let pendingWideEvent = null;
 	function addLog(level, message) {
 		if (!Array.isArray(context.requestLogs)) context.requestLogs = [];
 		context.requestLogs.push({
@@ -788,7 +1059,7 @@ function createLogger(initialContext = {}, internalOptions) {
 			return;
 		}
 		const fields = buildAuditFields(input);
-		if (!isPlainObject(context.audit)) context.audit = fields;
+		if (!isPlainObject$1(context.audit)) context.audit = fields;
 		else mergeInto(context.audit, fields);
 		context._auditForceKeep = true;
 	};
@@ -803,12 +1074,25 @@ function createLogger(initialContext = {}, internalOptions) {
 		audit: auditMethod,
 		set(data) {
 			if (emitted) {
-				const keys = Object.keys(data);
+				const record = data;
+				const pendingState = pendingWideEvent ? pendingDrainState.get(pendingWideEvent) : void 0;
+				if (pendingWideEvent && pendingState && !pendingState.drainStarted && isAiOnlyFieldUpdate(record)) {
+					mergeInto(pendingWideEvent, record);
+					return;
+				}
+				const keys = Object.keys(record);
 				warnPostEmit("log.set()", `Keys dropped: ${keys.length ? keys.join(", ") : "(empty)"}.`);
 				return;
 			}
 			mergeInto(context, data);
 		},
+		setLevel(level) {
+			if (emitted) {
+				warnPostEmit("log.setLevel()", `Level dropped: ${level}.`);
+				return;
+			}
+			manualLevel = level;
+		},
 		error(error, errorContext) {
 			if (emitted) {
 				warnPostEmit("log.error()", `Keys dropped: ${(errorContext ? [...Object.keys(errorContext), "error"] : ["error"]).join(", ")}.`);
@@ -833,7 +1117,14 @@ function createLogger(initialContext = {}, internalOptions) {
 				"cause",
 				"internal"
 			]) if (k in err) errorObj[k] = errRecord[k];
-			if (isPlainObject(context.error)) mergeInto(context.error, errorObj);
+			if (err instanceof EvlogError) {
+				if (err.code) errorObj.code = err.code;
+				if (err.why) errorObj.why = err.why;
+				if (err.fix) errorObj.fix = err.fix;
+				if (err.link) errorObj.link = err.link;
+				if (err.status) errorObj.status = err.status;
+			}
+			if (isPlainObject$1(context.error)) mergeInto(context.error, errorObj);
 			else context.error = errorObj;
 		},
 		info(message, infoContext) {
@@ -865,7 +1156,7 @@ function createLogger(initialContext = {}, internalOptions) {
 				return null;
 			}
 			const durationMs = Date.now() - startTime;
-			const level = hasError ? "error" : hasWarn ? "warn" : "info";
+			const level = manualLevel ?? (hasError ? "error" : hasWarn ? "warn" : "info");
 			let forceKeep = false;
 			if (overrides?._forceKeep) forceKeep = true;
 			else if (consumeAuditForceKeep(context)) forceKeep = true;
@@ -878,6 +1169,7 @@ function createLogger(initialContext = {}, internalOptions) {
 			});
 			if (!forceKeep && !shouldSample(level)) {
 				emitted = true;
+				pendingWideEvent = null;
 				return null;
 			}
 			if (overrides) {
@@ -891,6 +1183,8 @@ function createLogger(initialContext = {}, internalOptions) {
 				waitUntil
 			});
 			emitted = true;
+			pendingWideEvent = wide;
+			if (wide) pendingDrainState.set(wide, { drainStarted: !deferDrain });
 			return wide;
 		},
 		getContext() {
@@ -955,9 +1249,15 @@ const AUDIT_SCHEMA_VERSION = 1;
 * Used by `idempotencyKey` and `hash-chain` so the same logical event always
 * produces the same digest, regardless of how object keys were added.
 */
+function isPlainObject(value) {
+	if (typeof value !== "object" || value === null || Array.isArray(value)) return false;
+	if (Object.prototype.toString.call(value) !== "[object Object]") return false;
+	return Object.getPrototypeOf(value) === Object.prototype || value.constructor === Object;
+}
 function stableStringify(value) {
 	if (value === null || typeof value !== "object") return JSON.stringify(value);
 	if (Array.isArray(value)) return `[${value.map(stableStringify).join(",")}]`;
+	if (!isPlainObject(value)) return JSON.stringify(value);
 	return `{${Object.keys(value).sort().map((k) => `${JSON.stringify(k)}:${stableStringify(value[k])}`).join(",")}}`;
 }
 /**
@@ -1104,10 +1404,7 @@ function markForceKeep(logger) {
 * ```
 */
 function audit(input) {
-	const fields = buildAuditFields(input);
-	const wide = createLogger({ audit: fields }).emit({ _forceKeep: true });
-	_testCollector?.(fields, wide);
-	return wide;
+	return createLogger({ audit: buildAuditFields(input) }).emit({ _forceKeep: true });
 }
 /**
 * Wrap a function so its outcome (success / failure / denied) is automatically
@@ -1180,8 +1477,8 @@ var AuditDeniedError = class extends Error {
 * `changes` field. Output is a JSON Patch-style array (RFC 6902 subset:
 * `add`, `remove`, `replace`) — small enough to ship over the wire.
 *
-* Object keys whose name matches one of the `redactPaths` (dot-notation, e.g.
-* `'user.password'`, `'card.cvv'`) are replaced with `'[REDACTED]'` so PII
+* Fields matching `redactPaths` glob patterns (e.g. `'password'`, `'**.password'`,
+* `'*_token'`, `'user.email'`) are replaced with `'[REDACTED]'` so PII
 * never leaks through the diff.
 *
 * @example
@@ -1196,14 +1493,13 @@ var AuditDeniedError = class extends Error {
 */
 function auditDiff(before, after, options = {}) {
 	const replacement = options.replacement ?? "[REDACTED]";
-	const redactSet = new Set((options.redactPaths ?? []).map((p) => p));
+	const pathMatchers = compileRedactPathMatchers(options.redactPaths) ?? {
+		exactPaths: /* @__PURE__ */ new Set(),
+		pathGlobs: [],
+		keyGlobs: [],
+		caseInsensitiveLeaves: /* @__PURE__ */ new Set()
+	};
 	const patch = [];
-	function isRedacted(path) {
-		if (redactSet.size === 0) return false;
-		if (redactSet.has(path)) return true;
-		for (const p of redactSet) if (path.endsWith(`.${p}`)) return true;
-		return false;
-	}
 	function diff(a, b, path) {
 		if (a === b) return;
 		if (a === void 0 && b !== void 0) {
@@ -1233,16 +1529,7 @@ function auditDiff(before, after, options = {}) {
 		});
 	}
 	function redactValue(value, path) {
-		if (value === null || typeof value !== "object") {
-			const segs = path.split("/").filter(Boolean);
-			const last = segs[segs.length - 1];
-			if (last && isRedacted(last)) return replacement;
-			return value;
-		}
-		if (Array.isArray(value)) return value.map((v, i) => redactValue(v, `${path}/${i}`));
-		const out = {};
-		for (const [k, v] of Object.entries(value)) out[k] = isRedacted(k) ? replacement : redactValue(v, `${path}/${k}`);
-		return out;
+		return redactValueByPaths(value, pathMatchers, replacement, path);
 	}
 	diff(before, after, "");
 	const result = { patch };
@@ -1251,15 +1538,21 @@ function auditDiff(before, after, options = {}) {
 	return result;
 }
 /**
-* Define a typed audit action with an optional fixed target type.
+* Define a typed audit action with optional fixed target type and catalog metadata.
 *
 * Returns a curried helper that fills in the action name (and target shape
 * if provided) so call sites stay terse and the action set is discoverable
-* in one place.
+* in one place. Metadata (`description`, `severity`, `requiresChanges`, …)
+* is exposed on the factory for introspection, docs, and review tooling.
 *
 * @example
 * ```ts
-* const refund = defineAuditAction('invoice.refund', { target: 'invoice' })
+* const refund = defineAuditAction('invoice.refund', {
+*   target: 'invoice',
+*   severity: 'high',
+*   requiresChanges: true,
+*   redactPaths: ['cardNumber'],
+* })
 *
 * log.audit(refund({
 *   actor: { type: 'user', id: user.id },
@@ -1270,7 +1563,7 @@ function auditDiff(before, after, options = {}) {
 */
 function defineAuditAction(action, options) {
 	const targetType = options?.target;
-	return (input) => {
+	const factory = ((input) => {
 		const merged = {
 			...input,
 			action
@@ -1280,21 +1573,50 @@ function defineAuditAction(action, options) {
 			type: targetType
 		};
 		return merged;
-	};
+	});
+	Object.defineProperties(factory, {
+		action: {
+			value: action,
+			enumerable: true
+		},
+		target: {
+			value: options?.target,
+			enumerable: true
+		},
+		description: {
+			value: options?.description,
+			enumerable: true
+		},
+		severity: {
+			value: options?.severity,
+			enumerable: true
+		},
+		requiresChanges: {
+			value: options?.requiresChanges,
+			enumerable: true
+		},
+		requiresReason: {
+			value: options?.requiresReason,
+			enumerable: true
+		},
+		redactPaths: {
+			value: options?.redactPaths,
+			enumerable: true
+		}
+	});
+	return factory;
 }
 /**
 * Test helper that captures every audit event emitted while it is active.
 *
-* Returns `{ events, restore, expect }`:
+* Returns `{ events, restore, toIncludeAuditOf, assertAudit }`:
 * - `events` — live array of captured `AuditFields`, populated as audits fire.
 * - `restore()` — uninstall the collector. Call from `afterEach()`.
-* - `expect.toIncludeAuditOf(matcher)` — assertion helper used inside `expect`
-*   blocks, returns `true` if at least one captured event matches.
+* - `toIncludeAuditOf(matcher)` — returns `true` if at least one captured event matches.
+* - `assertAudit(matcher)` — returns the matched event or throws with a readable summary.
 *
-* Only captures audits going through `log.audit()` and the standalone
-* `audit()` function. Events emitted via raw `log.set({ audit })` skip the
-* collector by design — wrap them with `log.audit()` to make them visible to
-* tests.
+* Captures audits on emit from `log.audit()`, standalone `audit()`, and
+* `log.set({ audit })` — including auto-filled `idempotencyKey`.
 *
 * @example
 * ```ts
@@ -1318,6 +1640,18 @@ function mockAudit() {
 		},
 		toIncludeAuditOf(matcher) {
 			return events.some((event) => matchesAudit(event, matcher));
+		},
+		assertAudit(matcher) {
+			const match = events.find((event) => matchesAudit(event, matcher));
+			if (!match) {
+				const summary = events.map((e) => ({
+					action: e.action,
+					outcome: e.outcome
+				}));
+				const matcherStr = JSON.stringify(matcher, (_k, v) => v instanceof RegExp ? v.toString() : v);
+				throw new Error(`No audit event matched ${matcherStr}. Captured ${events.length} event(s): ${JSON.stringify(summary)}`);
+			}
+			return match;
 		}
 	};
 }
@@ -1358,7 +1692,9 @@ function consumeAuditForceKeep(context) {
 function finalizeAudit(event) {
 	const a = event.audit;
 	if (!a) return;
-	event.audit = decorateAudit(a, String(event.timestamp));
+	const decorated = decorateAudit(a, String(event.timestamp));
+	event.audit = decorated;
+	_testCollector?.(decorated, event);
 }
 /**
 * Enrich audit-bearing wide events with request, runtime, and tenant context.
@@ -1591,33 +1927,21 @@ function stripIntegrity(event) {
 * enough signal to be useful.
 */
 const auditRedactPreset = { paths: [
-	"audit.changes.before.password",
-	"audit.changes.before.passwordHash",
-	"audit.changes.before.token",
-	"audit.changes.before.apiKey",
-	"audit.changes.before.secret",
-	"audit.changes.before.accessToken",
-	"audit.changes.before.refreshToken",
-	"audit.changes.before.cardNumber",
-	"audit.changes.before.cvv",
-	"audit.changes.before.ssn",
-	"audit.changes.after.password",
-	"audit.changes.after.passwordHash",
-	"audit.changes.after.token",
-	"audit.changes.after.apiKey",
-	"audit.changes.after.secret",
-	"audit.changes.after.accessToken",
-	"audit.changes.after.refreshToken",
-	"audit.changes.after.cardNumber",
-	"audit.changes.after.cvv",
-	"audit.changes.after.ssn",
-	"headers.authorization",
-	"headers.cookie",
-	"headers.set-cookie",
-	"audit.context.headers.authorization",
-	"audit.context.headers.cookie"
+	"password",
+	"passwordHash",
+	"token",
+	"apiKey",
+	"secret",
+	"accessToken",
+	"refreshToken",
+	"cardNumber",
+	"cvv",
+	"ssn",
+	"authorization",
+	"cookie",
+	"set-cookie"
 ] };
 //#endregion
-export { normalizeRedactConfig as A, lockLogger as C, drainPlugin as D, definePlugin as E, resolveRedactConfig as M, enricherPlugin as O, isLoggerLocked as S, createPluginRunner as T, getEnvironment as _, auditEnricher as a, initLogger as b, buildAuditFields as c, signed as d, withAudit as f, createRequestLogger as g, createLogger as h, auditDiff as i, redactEvent as j, getEmptyPluginRunner as k, defineAuditAction as l, _log as m, AuditDeniedError as n, auditOnly as o, withAuditMethods as p, audit as r, auditRedactPreset as s, AUDIT_SCHEMA_VERSION as t, mockAudit as u, getGlobalDrain as v, shouldKeep as w, isEnabled as x, getGlobalPluginRunner as y };
+export { enricherPlugin as A, lockLogger as C, createPluginRunner as D, shouldKeep as E, resolveRedactConfig as F, isGloballyRedacted as M, normalizeRedactConfig as N, definePlugin as O, redactEvent as P, isLoggerLocked as S, mergeInto as T, getEnvironment as _, auditEnricher as a, initLogger as b, buildAuditFields as c, signed as d, withAudit as f, createRequestLogger as g, createLogger as h, auditDiff as i, getEmptyPluginRunner as j, drainPlugin as k, defineAuditAction as l, _log as m, AuditDeniedError as n, auditOnly as o, withAuditMethods as p, audit as r, auditRedactPreset as s, AUDIT_SCHEMA_VERSION as t, mockAudit as u, getGlobalDrain as v, markWideEventDrainStarted as w, isEnabled as x, getGlobalPluginRunner as y };
 
-//# sourceMappingURL=audit-pV5aLGP0.mjs.map
+//# sourceMappingURL=audit-BFwTUxBJ.mjs.map