evlog 2.18.1 → 2.19.0

package/dist/{audit-BUI3af4w.mjs → audit-BFwTUxBJ.mjs}

@@ -1,8 +1,118 @@
-import { colors, cssColors, detectEnvironment, escapeFormatString, formatDuration, getConsoleMethod, getCssLevelColor, getLevelColor, isBrowser, isDev, isLevelEnabled, matchesPattern } from "./utils.mjs";
-import { r as getHeader$1 } from "./headers-CU-QqnYg.mjs";
+import { colors, cssColors, detectEnvironment, escapeFormatString, formatDuration, getConsoleMethod, getCssLevelColor, getLevelColor, globToRegExp, isBrowser, isDev, isLevelEnabled, matchesPattern } from "./utils.mjs";
+import { i as registerPrettyErrorSnippetReader, n as buildErrorEntries } from "./pretty-error-CVVgwlTn.mjs";
+import { t as resolveDevTerminal } from "./dev-terminal-D4UaEm17.mjs";
+import { EvlogError } from "./error.mjs";
+import { r as getHeader$1 } from "./headers-VtmnWcfn.mjs";
 //#region src/redact.ts
 const DEFAULT_REPLACEMENT = "[REDACTED]";
 /**
+* Normalize a redact path pattern.
+* Single segments without wildcards are shorthand for `**.<segment>`.
+*/
+function normalizeRedactPathPattern(pattern) {
+	if (!pattern.includes("*") && !pattern.includes(".")) return `**.${pattern}`;
+	return pattern;
+}
+/**
+* Compile `RedactConfig.paths` into exact paths, path globs, and key globs.
+* Returns `undefined` when `patterns` is empty.
+*/
+function compileRedactPathMatchers(patterns) {
+	if (!patterns?.length) return void 0;
+	const exactPaths = /* @__PURE__ */ new Set();
+	const pathGlobs = [];
+	const keyGlobs = [];
+	const caseInsensitiveLeaves = /* @__PURE__ */ new Set();
+	for (const raw of patterns) {
+		if (!raw.includes("*")) {
+			if (raw.includes(".")) exactPaths.add(raw);
+			else addPathGlobPattern(normalizeRedactPathPattern(raw), exactPaths, pathGlobs, caseInsensitiveLeaves);
+			continue;
+		}
+		if (!raw.includes(".")) keyGlobs.push(globToRegExp(raw, "."));
+		else addPathGlobPattern(raw, exactPaths, pathGlobs, caseInsensitiveLeaves);
+	}
+	if (exactPaths.size === 0 && pathGlobs.length === 0 && keyGlobs.length === 0 && caseInsensitiveLeaves.size === 0) return;
+	return {
+		exactPaths,
+		pathGlobs,
+		keyGlobs,
+		caseInsensitiveLeaves
+	};
+}
+/** `**.segment` also matches a top-level `segment` field. */
+function addPathGlobPattern(pattern, exactPaths, pathGlobs, caseInsensitiveLeaves) {
+	pathGlobs.push(globToRegExp(pattern, "."));
+	const leaf = pattern.match(/^\*\*\.([^.?*]+)$/);
+	if (leaf) {
+		exactPaths.add(leaf[1]);
+		caseInsensitiveLeaves.add(leaf[1]);
+	}
+}
+/**
+* Whether a field at `fullPath` (dot-notation from root) with leaf key `leafKey`
+* should be fully redacted.
+*/
+function matchesRedactPath(fullPath, leafKey, matchers) {
+	if (matchers.exactPaths.has(fullPath)) return true;
+	const leafLower = leafKey.toLowerCase();
+	for (const name of matchers.caseInsensitiveLeaves) if (leafLower === name.toLowerCase()) return true;
+	for (const glob of matchers.pathGlobs) {
+		glob.lastIndex = 0;
+		if (glob.test(fullPath)) return true;
+	}
+	for (const glob of matchers.keyGlobs) {
+		glob.lastIndex = 0;
+		if (glob.test(leafKey)) return true;
+	}
+	return false;
+}
+/**
+* Redact fields matching path globs recursively. Mutates `obj` in place (use on a clone).
+*/
+function redactPathsInTree(obj, matchers, replacement, prefix = "") {
+	if (obj === null || obj === void 0) return;
+	if (Array.isArray(obj)) {
+		for (let i = 0; i < obj.length; i++) {
+			const segment = String(i);
+			const fullPath = prefix ? `${prefix}.${segment}` : segment;
+			redactPathsInTree(obj[i], matchers, replacement, fullPath);
+		}
+		return;
+	}
+	if (typeof obj === "object") {
+		const record = obj;
+		for (const key in record) {
+			const fullPath = prefix ? `${prefix}.${key}` : key;
+			if (matchesRedactPath(fullPath, key, matchers)) record[key] = replacement;
+			else redactPathsInTree(record[key], matchers, replacement, fullPath);
+		}
+	}
+}
+/**
+* Return a copy of `value` with path-pattern matches replaced by `replacement`.
+* Used by audit diffs; does not mutate the input.
+*
+* `pointerPath` is a JSON Pointer (e.g. `/user/password`).
+*/
+function redactValueByPaths(value, matchers, replacement, pointerPath = "") {
+	const segments = pointerPath.split("/").filter(Boolean);
+	const dotPath = segments.join(".");
+	const leafKey = segments.at(-1) ?? "";
+	if (value === null || typeof value !== "object") {
+		if (dotPath && matchesRedactPath(dotPath, leafKey, matchers)) return replacement;
+		return value;
+	}
+	if (Array.isArray(value)) return value.map((v, i) => redactValueByPaths(v, matchers, replacement, `${pointerPath}/${i}`));
+	if (!isPlainRecord(value)) return value;
+	const out = {};
+	for (const [k, v] of Object.entries(value)) {
+		const childPointer = pointerPath ? `${pointerPath}/${k}` : `/${k}`;
+		out[k] = matchesRedactPath(dotPath ? `${dotPath}.${k}` : k, k, matchers) ? replacement : redactValueByPaths(v, matchers, replacement, childPointer);
+	}
+	return out;
+}
+/**
 * Built-in PII detection patterns with smart masking.
 * Each builtin preserves just enough signal for debugging while scrubbing PII.
 */
@@ -89,32 +199,56 @@ function allBuiltinMaskers() {
 function cloneRegex(re) {
 	return new RegExp(re.source, re.flags);
 }
+/** @internal Set on wide events after initLogger redaction so middleware skips a second pass. */
+const globallyRedacted = Symbol.for("evlog.globallyRedacted");
+/** @internal Mark a wide event as already redacted by {@link initLogger}. */
+function markGloballyRedacted(event) {
+	Object.defineProperty(event, globallyRedacted, {
+		value: true,
+		enumerable: false,
+		configurable: true
+	});
+}
+/** @internal Whether global redaction already ran on this wide event. */
+function isGloballyRedacted(event) {
+	return Reflect.has(event, globallyRedacted);
+}
+/**
+* Clone before redaction. Wide events are JSON-shaped; fall back when
+* `structuredClone` rejects non-cloneable values (functions, symbols, etc.).
+*/
+function cloneForRedaction(event) {
+	try {
+		return structuredClone(event);
+	} catch {
+		try {
+			return JSON.parse(JSON.stringify(event));
+		} catch {
+			console.warn("[cloneForRedaction] Shallow clone used — nested objects may be mutated by redactPath, redactPatterns, and applyMaskersToTree");
+			return { ...event };
+		}
+	}
+}
 /**
-* Redact sensitive data from a wide event in-place.
+* Redact sensitive data from a wide event without mutating the input.
 *
-* Three strategies applied in order:
-* 1. **Path-based**: dot-notation paths — the leaf value is replaced with `replacement`.
+* Returns a deep clone with redaction applied. Three strategies run in order:
+* 1. **Path-based**: dot-notation paths with optional globs (`password`, `**.password`, `*_token`, `user.*`) — full value replacement.
 * 2. **Masker-based**: built-in patterns with smart partial masking (e.g. `****1111`).
-* 3. **Pattern-based**: custom RegExp patterns replaced with `replacement`.
+* 3. **Pattern-based**: custom RegExp patterns on string values replaced with `replacement`.
 *
-* @param event - The wide event object (mutated in-place).
+* @param event - The wide event object (not mutated).
 * @param config - Redaction configuration.
+* @returns A redacted deep clone of `event`.
 */
 function redactEvent(event, config) {
+	const clone = cloneForRedaction(event);
 	const replacement = config.replacement ?? DEFAULT_REPLACEMENT;
-	if (config.paths?.length) for (const path of config.paths) redactPath(event, path.split("."), replacement);
-	if (config._maskers?.length) applyMaskersToTree(event, config._maskers);
-	if (config.patterns?.length) redactPatterns(event, config.patterns, replacement);
-}
-function redactPath(obj, segments, replacement) {
-	let current = obj;
-	for (let i = 0; i < segments.length - 1; i++) {
-		if (current === null || current === void 0 || typeof current !== "object") return;
-		current = current[segments[i]];
-	}
-	if (current === null || current === void 0 || typeof current !== "object") return;
-	const leaf = segments[segments.length - 1];
-	if (leaf in current) current[leaf] = replacement;
+	const pathMatchers = compileRedactPathMatchers(config.paths);
+	if (pathMatchers) redactPathsInTree(clone, pathMatchers, replacement);
+	if (config._maskers?.length) applyMaskersToTree(clone, config._maskers);
+	if (config.patterns?.length) redactPatterns(clone, config.patterns, replacement);
+	return clone;
 }
 function redactPatterns(obj, patterns, replacement) {
 	if (obj === null || obj === void 0) return;
@@ -177,17 +311,34 @@ function normalizeRedactConfig(raw) {
 	if (typeof raw.replacement === "string") config.replacement = raw.replacement;
 	if (raw.builtins === false) config.builtins = false;
 	else if (Array.isArray(raw.builtins)) config.builtins = raw.builtins;
-	if (Array.isArray(raw.patterns)) config.patterns = raw.patterns.map((p) => {
-		if (p instanceof RegExp) return p;
-		if (typeof p === "string") return new RegExp(p, "g");
-		if (typeof p === "object" && p !== null) {
-			const obj = p;
-			return new RegExp(obj.source, obj.flags ?? "g");
-		}
-		return null;
-	}).filter((p) => p !== null);
+	if (Array.isArray(raw.patterns)) config.patterns = deserializeRegexList(raw.patterns);
 	return resolveRedactConfig(config);
 }
+function isPlainRecord(value) {
+	if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
+function deserializeRegexList(raw) {
+	const patterns = [];
+	for (const p of raw) try {
+		if (p instanceof RegExp) {
+			patterns.push(cloneRegex(p));
+			continue;
+		}
+		if (typeof p === "string") {
+			patterns.push(new RegExp(p, "g"));
+			continue;
+		}
+		if (typeof p === "object" && p !== null && typeof p.source === "string") {
+			const flags = typeof p.flags === "string" ? p.flags : "g";
+			patterns.push(new RegExp(p.source, flags));
+		}
+	} catch {
+		console.warn("[normalizeRedactConfig] Ignoring invalid redact regex entry");
+	}
+	return patterns;
+}
 //#endregion
 //#region src/shared/plugin.ts
 /** Identity helper preserving plugin type inference. */
@@ -337,11 +488,33 @@ function mergeInto(target, source) {
 		else target[key] = sourceVal;
 	}
 }
+const pendingDrainState = /* @__PURE__ */ new WeakMap();
+function isAiOnlyFieldUpdate(data) {
+	const keys = Object.keys(data);
+	return keys.length === 1 && keys[0] === "ai";
+}
+/**
+* Mark a wide event as past the post-emit AI merge window so late `log.set({ ai })`
+* calls warn again. Called by framework enrich/drain pipelines before drain runs.
+*
+* @internal Used by middleware and framework integrations.
+*/
+function markWideEventDrainStarted(event) {
+	if (!event) return;
+	const state = pendingDrainState.get(event);
+	if (state) state.drainStarted = true;
+}
 let globalEnv = {
 	service: "app",
 	environment: "development"
 };
 let globalPretty = isDev();
+let globalPrettyError = {
+	snippet: isDev(),
+	stackDepth: 2,
+	compact: isDev(),
+	detail: "full"
+};
 let globalSampling = {};
 let globalStringify = true;
 let globalDrain;
@@ -367,6 +540,7 @@ function initLogger(config = {}) {
 		region: config.env?.region ?? detected.region
 	};
 	globalPretty = config.pretty ?? isDev();
+	globalPrettyError = resolveDevTerminal(config).prettyError;
 	globalSampling = config.sampling ?? {};
 	globalStringify = config.stringify ?? true;
 	globalDrain = config.drain;
@@ -375,6 +549,11 @@ function initLogger(config = {}) {
 	globalMinLevel = config.minLevel ?? "debug";
 	globalPluginRunner = config.plugins?.length ? createPluginRunner(config.plugins) : getEmptyPluginRunner();
 	if (globalPluginRunner.plugins.length > 0) globalPluginRunner.runSetup({ env: { ...globalEnv } });
+	if (!isBrowser() && typeof process !== "undefined" && process.versions?.node) import("./pretty-error-snippet.node-c_bzjg7g.mjs").then((n) => n.t).then((mod) => {
+		registerPrettyErrorSnippetReader(mod.readCodeSnippetFromDisk);
+	}).catch(() => {
+		registerPrettyErrorSnippetReader(null);
+	});
 	const hasAnyDrain = !!globalDrain || globalPluginRunner.hasDrain;
 	if (globalSilent && !hasAnyDrain && !config._suppressDrainWarning) console.warn("[evlog] silent mode is enabled but no drain is configured. Events will be built and sampled but not output anywhere. Set a drain via initLogger({ drain }) or a framework hook (evlog:drain).");
 }
@@ -464,7 +643,10 @@ function emitWideEvent(level, event, options = {}) {
 		...event
 	};
 	finalizeAudit(formatted);
-	if (globalRedact) redactEvent(formatted, globalRedact);
+	if (globalRedact) {
+		formatted = redactEvent(formatted, globalRedact);
+		markGloballyRedacted(formatted);
+	}
 	if (!globalSilent) if (globalPretty) prettyPrintWideEvent(formatted);
 	else if (globalStringify) console[getConsoleMethod(level)](JSON.stringify(formatted));
 	else console[getConsoleMethod(level)](formatted);
@@ -698,11 +880,29 @@ function buildAIEntries(ai) {
 	});
 	return entries;
 }
+function flushPrettyLines(lines) {
+	if (lines.length === 0) return;
+	const text = `${lines.join("\n")}\n`;
+	if (typeof process !== "undefined" && typeof process.stdout?.write === "function" && !isBrowser() && process.env.VITEST !== "true") {
+		process.stdout.write(text);
+		return;
+	}
+	console.log(lines.join("\n"));
+}
 function prettyPrintWideEvent(event) {
 	const { timestamp, level, service, environment, version, ...rest } = event;
 	const ts = typeof timestamp === "string" ? timestamp.slice(11, 23) : "";
 	const levelLabel = typeof level === "string" ? level : "info";
 	const browser = isBrowser();
+	const lines = [];
+	const writeLine = (...args) => {
+		if (browser) {
+			console.log(...args);
+			return;
+		}
+		const [line] = args;
+		if (typeof line === "string") lines.push(line);
+	};
 	const parts = [];
 	const styles = [];
 	if (browser) {
@@ -711,7 +911,8 @@ function prettyPrintWideEvent(event) {
 		styles.push(cssColors.dim, cssColors.reset, lc, cssColors.reset, cssColors.cyan, cssColors.reset);
 	} else {
 		const lc = getLevelColor(levelLabel);
-		parts.push(`${colors.dim}${ts}${colors.reset} ${lc}${levelLabel.toUpperCase()}${colors.reset} ${colors.cyan}[${service}]${colors.reset}`);
+		if (isDev()) parts.push(`${lc}${levelLabel.toUpperCase()}${colors.reset} ${colors.cyan}[${service}]${colors.reset}`);
+		else parts.push(`${colors.dim}${ts}${colors.reset} ${lc}${levelLabel.toUpperCase()}${colors.reset} ${colors.cyan}[${service}]${colors.reset}`);
 	}
 	if (rest.method && rest.path) {
 		parts.push(browser ? ` ${escapeFormatString(String(rest.method))} ${escapeFormatString(String(rest.path))}` : ` ${rest.method} ${rest.path}`);
@@ -734,15 +935,19 @@ function prettyPrintWideEvent(event) {
 		} else parts.push(` ${colors.dim}in ${rest.duration}${colors.reset}`);
 		delete rest.duration;
 	}
-	console.log(parts.join(""), ...styles);
+	writeLine(parts.join(""), ...styles);
 	const aiData = isPlainObject$1(rest.ai) ? rest.ai : void 0;
 	if (aiData) delete rest.ai;
+	const errorData = rest.error;
+	if (errorData !== void 0) delete rest.error;
 	const restEntries = Object.entries(rest).filter(([_, v]) => v !== void 0);
 	const aiEntries = aiData ? buildAIEntries(aiData) : [];
-	const allEntries = [...restEntries.map(([key, value]) => ({
+	const errorEntries = errorData !== void 0 ? buildErrorEntries(errorData, globalPrettyError) : [];
+	const contextEntries = [...restEntries.map(([key, value]) => ({
 		key,
 		value: formatValue(value)
 	})), ...aiEntries];
+	const allEntries = errorEntries.length > 0 ? [...errorEntries, ...contextEntries] : contextEntries;
 	for (let i = 0; i < allEntries.length; i++) {
 		const entry = allEntries[i];
 		if (!entry) continue;
@@ -751,22 +956,32 @@ function prettyPrintWideEvent(event) {
 		const prefix = i === allEntries.length - 1 && !hasChildren ? "└─" : "├─";
 		if (browser) {
 			const val = entry.value ? ` ${escapeFormatString(entry.value)}` : "";
-			console.log(`  %c${prefix}%c %c${escapeFormatString(entry.key)}:%c${val}`, cssColors.dim, cssColors.reset, cssColors.cyan, cssColors.reset);
+			writeLine(`  %c${prefix}%c %c${escapeFormatString(entry.key)}:%c${val}`, cssColors.dim, cssColors.reset, cssColors.cyan, cssColors.reset);
 		} else {
 			const val = entry.value ? ` ${entry.value}` : "";
-			console.log(`  ${colors.dim}${prefix}${colors.reset} ${colors.cyan}${entry.key}:${colors.reset}${val}`);
+			writeLine(`  ${colors.dim}${prefix}${colors.reset} ${colors.cyan}${entry.key}:${colors.reset}${val}`);
 		}
 		if (hasChildren && children) {
 			const connector = i === allEntries.length - 1 ? " " : "│";
 			for (let j = 0; j < children.length; j++) {
 				const child = children[j];
 				if (child === void 0) continue;
+				if (child === "__EVLOG_TREE_SPACER__") {
+					writeLine(`  ${colors.dim}${connector}${colors.reset}`);
+					continue;
+				}
 				const childPrefix = j === children.length - 1 ? "└─" : "├─";
-				if (browser) console.log(`  %c${connector}  ${childPrefix}%c ${escapeFormatString(child)}`, cssColors.dim, cssColors.reset);
-				else console.log(`  ${colors.dim}${connector}  ${childPrefix}${colors.reset} ${child}`);
+				if (child === "") {
+					writeLine("");
+					continue;
+				}
+				if (browser) writeLine(`  %c${connector}  ${childPrefix}%c ${escapeFormatString(child)}`, cssColors.dim, cssColors.reset);
+				else if (child.startsWith(" ") || child.startsWith("\x1B")) writeLine(`  ${colors.dim}${connector}${colors.reset}${child}`);
+				else writeLine(`  ${colors.dim}${connector}  ${childPrefix}${colors.reset} ${child}`);
 			}
 		}
 	}
+	if (!browser && lines.length > 0) flushPrettyLines(lines);
 }
 function createLogMethod(level) {
 	return function logMethod(tagOrEvent, message) {
@@ -829,6 +1044,7 @@ function createLogger(initialContext = {}, internalOptions) {
 	let hasWarn = false;
 	let manualLevel;
 	let emitted = false;
+	let pendingWideEvent = null;
 	function addLog(level, message) {
 		if (!Array.isArray(context.requestLogs)) context.requestLogs = [];
 		context.requestLogs.push({
@@ -858,7 +1074,13 @@ function createLogger(initialContext = {}, internalOptions) {
 		audit: auditMethod,
 		set(data) {
 			if (emitted) {
-				const keys = Object.keys(data);
+				const record = data;
+				const pendingState = pendingWideEvent ? pendingDrainState.get(pendingWideEvent) : void 0;
+				if (pendingWideEvent && pendingState && !pendingState.drainStarted && isAiOnlyFieldUpdate(record)) {
+					mergeInto(pendingWideEvent, record);
+					return;
+				}
+				const keys = Object.keys(record);
 				warnPostEmit("log.set()", `Keys dropped: ${keys.length ? keys.join(", ") : "(empty)"}.`);
 				return;
 			}
@@ -895,6 +1117,13 @@ function createLogger(initialContext = {}, internalOptions) {
 				"cause",
 				"internal"
 			]) if (k in err) errorObj[k] = errRecord[k];
+			if (err instanceof EvlogError) {
+				if (err.code) errorObj.code = err.code;
+				if (err.why) errorObj.why = err.why;
+				if (err.fix) errorObj.fix = err.fix;
+				if (err.link) errorObj.link = err.link;
+				if (err.status) errorObj.status = err.status;
+			}
 			if (isPlainObject$1(context.error)) mergeInto(context.error, errorObj);
 			else context.error = errorObj;
 		},
@@ -940,6 +1169,7 @@ function createLogger(initialContext = {}, internalOptions) {
 			});
 			if (!forceKeep && !shouldSample(level)) {
 				emitted = true;
+				pendingWideEvent = null;
 				return null;
 			}
 			if (overrides) {
@@ -953,6 +1183,8 @@ function createLogger(initialContext = {}, internalOptions) {
 				waitUntil
 			});
 			emitted = true;
+			pendingWideEvent = wide;
+			if (wide) pendingDrainState.set(wide, { drainStarted: !deferDrain });
 			return wide;
 		},
 		getContext() {
@@ -1172,10 +1404,7 @@ function markForceKeep(logger) {
 * ```
 */
 function audit(input) {
-	const fields = buildAuditFields(input);
-	const wide = createLogger({ audit: fields }).emit({ _forceKeep: true });
-	_testCollector?.(fields, wide);
-	return wide;
+	return createLogger({ audit: buildAuditFields(input) }).emit({ _forceKeep: true });
 }
 /**
 * Wrap a function so its outcome (success / failure / denied) is automatically
@@ -1248,8 +1477,8 @@ var AuditDeniedError = class extends Error {
 * `changes` field. Output is a JSON Patch-style array (RFC 6902 subset:
 * `add`, `remove`, `replace`) — small enough to ship over the wire.
 *
-* Object keys whose name matches one of the `redactPaths` (dot-notation, e.g.
-* `'user.password'`, `'card.cvv'`) are replaced with `'[REDACTED]'` so PII
+* Fields matching `redactPaths` glob patterns (e.g. `'password'`, `'**.password'`,
+* `'*_token'`, `'user.email'`) are replaced with `'[REDACTED]'` so PII
 * never leaks through the diff.
 *
 * @example
@@ -1264,14 +1493,13 @@ var AuditDeniedError = class extends Error {
 */
 function auditDiff(before, after, options = {}) {
 	const replacement = options.replacement ?? "[REDACTED]";
-	const redactSet = new Set((options.redactPaths ?? []).map((p) => p));
+	const pathMatchers = compileRedactPathMatchers(options.redactPaths) ?? {
+		exactPaths: /* @__PURE__ */ new Set(),
+		pathGlobs: [],
+		keyGlobs: [],
+		caseInsensitiveLeaves: /* @__PURE__ */ new Set()
+	};
 	const patch = [];
-	function isRedacted(path) {
-		if (redactSet.size === 0) return false;
-		if (redactSet.has(path)) return true;
-		for (const p of redactSet) if (path.endsWith(`.${p}`)) return true;
-		return false;
-	}
 	function diff(a, b, path) {
 		if (a === b) return;
 		if (a === void 0 && b !== void 0) {
@@ -1301,16 +1529,7 @@ function auditDiff(before, after, options = {}) {
 		});
 	}
 	function redactValue(value, path) {
-		if (value === null || typeof value !== "object") {
-			const segs = path.split("/").filter(Boolean);
-			const last = segs[segs.length - 1];
-			if (last && isRedacted(last)) return replacement;
-			return value;
-		}
-		if (Array.isArray(value)) return value.map((v, i) => redactValue(v, `${path}/${i}`));
-		const out = {};
-		for (const [k, v] of Object.entries(value)) out[k] = isRedacted(k) ? replacement : redactValue(v, `${path}/${k}`);
-		return out;
+		return redactValueByPaths(value, pathMatchers, replacement, path);
 	}
 	diff(before, after, "");
 	const result = { patch };
@@ -1319,15 +1538,21 @@ function auditDiff(before, after, options = {}) {
 	return result;
 }
 /**
-* Define a typed audit action with an optional fixed target type.
+* Define a typed audit action with optional fixed target type and catalog metadata.
 *
 * Returns a curried helper that fills in the action name (and target shape
 * if provided) so call sites stay terse and the action set is discoverable
-* in one place.
+* in one place. Metadata (`description`, `severity`, `requiresChanges`, …)
+* is exposed on the factory for introspection, docs, and review tooling.
 *
 * @example
 * ```ts
-* const refund = defineAuditAction('invoice.refund', { target: 'invoice' })
+* const refund = defineAuditAction('invoice.refund', {
+*   target: 'invoice',
+*   severity: 'high',
+*   requiresChanges: true,
+*   redactPaths: ['cardNumber'],
+* })
 *
 * log.audit(refund({
 *   actor: { type: 'user', id: user.id },
@@ -1338,7 +1563,7 @@ function auditDiff(before, after, options = {}) {
 */
 function defineAuditAction(action, options) {
 	const targetType = options?.target;
-	return (input) => {
+	const factory = ((input) => {
 		const merged = {
 			...input,
 			action
@@ -1348,21 +1573,50 @@ function defineAuditAction(action, options) {
 			type: targetType
 		};
 		return merged;
-	};
+	});
+	Object.defineProperties(factory, {
+		action: {
+			value: action,
+			enumerable: true
+		},
+		target: {
+			value: options?.target,
+			enumerable: true
+		},
+		description: {
+			value: options?.description,
+			enumerable: true
+		},
+		severity: {
+			value: options?.severity,
+			enumerable: true
+		},
+		requiresChanges: {
+			value: options?.requiresChanges,
+			enumerable: true
+		},
+		requiresReason: {
+			value: options?.requiresReason,
+			enumerable: true
+		},
+		redactPaths: {
+			value: options?.redactPaths,
+			enumerable: true
+		}
+	});
+	return factory;
 }
 /**
 * Test helper that captures every audit event emitted while it is active.
 *
-* Returns `{ events, restore, expect }`:
+* Returns `{ events, restore, toIncludeAuditOf, assertAudit }`:
 * - `events` — live array of captured `AuditFields`, populated as audits fire.
 * - `restore()` — uninstall the collector. Call from `afterEach()`.
-* - `expect.toIncludeAuditOf(matcher)` — assertion helper used inside `expect`
-*   blocks, returns `true` if at least one captured event matches.
+* - `toIncludeAuditOf(matcher)` — returns `true` if at least one captured event matches.
+* - `assertAudit(matcher)` — returns the matched event or throws with a readable summary.
 *
-* Only captures audits going through `log.audit()` and the standalone
-* `audit()` function. Events emitted via raw `log.set({ audit })` skip the
-* collector by design — wrap them with `log.audit()` to make them visible to
-* tests.
+* Captures audits on emit from `log.audit()`, standalone `audit()`, and
+* `log.set({ audit })` — including auto-filled `idempotencyKey`.
 *
 * @example
 * ```ts
@@ -1386,6 +1640,18 @@ function mockAudit() {
 		},
 		toIncludeAuditOf(matcher) {
 			return events.some((event) => matchesAudit(event, matcher));
+		},
+		assertAudit(matcher) {
+			const match = events.find((event) => matchesAudit(event, matcher));
+			if (!match) {
+				const summary = events.map((e) => ({
+					action: e.action,
+					outcome: e.outcome
+				}));
+				const matcherStr = JSON.stringify(matcher, (_k, v) => v instanceof RegExp ? v.toString() : v);
+				throw new Error(`No audit event matched ${matcherStr}. Captured ${events.length} event(s): ${JSON.stringify(summary)}`);
+			}
+			return match;
 		}
 	};
 }
@@ -1426,7 +1692,9 @@ function consumeAuditForceKeep(context) {
 function finalizeAudit(event) {
 	const a = event.audit;
 	if (!a) return;
-	event.audit = decorateAudit(a, String(event.timestamp));
+	const decorated = decorateAudit(a, String(event.timestamp));
+	event.audit = decorated;
+	_testCollector?.(decorated, event);
 }
 /**
 * Enrich audit-bearing wide events with request, runtime, and tenant context.
@@ -1659,33 +1927,21 @@ function stripIntegrity(event) {
 * enough signal to be useful.
 */
 const auditRedactPreset = { paths: [
-	"audit.changes.before.password",
-	"audit.changes.before.passwordHash",
-	"audit.changes.before.token",
-	"audit.changes.before.apiKey",
-	"audit.changes.before.secret",
-	"audit.changes.before.accessToken",
-	"audit.changes.before.refreshToken",
-	"audit.changes.before.cardNumber",
-	"audit.changes.before.cvv",
-	"audit.changes.before.ssn",
-	"audit.changes.after.password",
-	"audit.changes.after.passwordHash",
-	"audit.changes.after.token",
-	"audit.changes.after.apiKey",
-	"audit.changes.after.secret",
-	"audit.changes.after.accessToken",
-	"audit.changes.after.refreshToken",
-	"audit.changes.after.cardNumber",
-	"audit.changes.after.cvv",
-	"audit.changes.after.ssn",
-	"headers.authorization",
-	"headers.cookie",
-	"headers.set-cookie",
-	"audit.context.headers.authorization",
-	"audit.context.headers.cookie"
+	"password",
+	"passwordHash",
+	"token",
+	"apiKey",
+	"secret",
+	"accessToken",
+	"refreshToken",
+	"cardNumber",
+	"cvv",
+	"ssn",
+	"authorization",
+	"cookie",
+	"set-cookie"
 ] };
 //#endregion
-export { getEmptyPluginRunner as A, lockLogger as C, definePlugin as D, createPluginRunner as E, redactEvent as M, resolveRedactConfig as N, drainPlugin as O, isLoggerLocked as S, shouldKeep as T, getEnvironment as _, auditEnricher as a, initLogger as b, buildAuditFields as c, signed as d, withAudit as f, createRequestLogger as g, createLogger as h, auditDiff as i, normalizeRedactConfig as j, enricherPlugin as k, defineAuditAction as l, _log as m, AuditDeniedError as n, auditOnly as o, withAuditMethods as p, audit as r, auditRedactPreset as s, AUDIT_SCHEMA_VERSION as t, mockAudit as u, getGlobalDrain as v, mergeInto as w, isEnabled as x, getGlobalPluginRunner as y };
+export { enricherPlugin as A, lockLogger as C, createPluginRunner as D, shouldKeep as E, resolveRedactConfig as F, isGloballyRedacted as M, normalizeRedactConfig as N, definePlugin as O, redactEvent as P, isLoggerLocked as S, mergeInto as T, getEnvironment as _, auditEnricher as a, initLogger as b, buildAuditFields as c, signed as d, withAudit as f, createRequestLogger as g, createLogger as h, auditDiff as i, getEmptyPluginRunner as j, drainPlugin as k, defineAuditAction as l, _log as m, AuditDeniedError as n, auditOnly as o, withAuditMethods as p, audit as r, auditRedactPreset as s, AUDIT_SCHEMA_VERSION as t, mockAudit as u, getGlobalDrain as v, markWideEventDrainStarted as w, isEnabled as x, getGlobalPluginRunner as y };
 
-//# sourceMappingURL=audit-BUI3af4w.mjs.map
+//# sourceMappingURL=audit-BFwTUxBJ.mjs.map