logixia 1.10.2 → 1.10.3

package/dist/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","names":["out: Record<string, unknown>","fields: Record<string, unknown>"],"sources":["../src/middleware/http-logger.ts"],"sourcesContent":["/**\n * HTTP request/response logging middleware — Morgan replacement.\n *\n * Fixes every documented Morgan bug:\n *  - statusCode always captured correctly, even for requests > 20 s\n *  - Logs request START (with traceId) and response FINISH (with duration)\n *  - Captures errors before and after response\n *  - Auto-redacts Authorization / Cookie / Set-Cookie headers\n *  - Slow-request warnings\n *  - Skip predicates for health-check routes / static assets\n *\n * @example Express\n * ```ts\n * import { createExpressMiddleware } from 'logixia/middleware';\n * app.use(createExpressMiddleware(logger));\n * ```\n *\n * @example Fastify\n * ```ts\n * import { createFastifyPlugin } from 'logixia/middleware';\n * await fastify.register(createFastifyPlugin(logger));\n * ```\n */\n\n/* eslint-disable sonarjs/void-use -- intentional fire-and-forget in sync middleware callbacks */\nimport type { IBaseLogger } from '../types';\n\n// ── Shared types ─────────────────────────────────────────────────────────────\n\nexport interface HttpLoggerOptions {\n  /**\n   * Skip logging for a request. Called before any I/O.\n   * @example `skip: (req) => req.url === '/health'`\n   */\n  skip?: (req: IncomingRequest) => boolean;\n  /**\n   * Log request body (POST/PUT/PATCH). Capped at `bodyMaxBytes` (default: 4096).\n   * Redaction still applies to the captured body.\n   * Default: false.\n   */\n  logBody?: boolean;\n  /** Max bytes of body to capture. Default: 4096. */\n  bodyMaxBytes?: number;\n  /**\n   * Emit a WARN log when a request duration exceeds this threshold (ms).\n   * Default: 1000.\n   */\n  slowRequestThresholdMs?: number;\n  /**\n   * Additional fields to include in every log entry.\n   * @example `extraFields: (req) => ({ tenantId: req.headers['x-tenant-id'] })`\n   */\n  extraFields?: (req: IncomingRequest) => Record<string, unknown>;\n  /**\n   * Trace ID header. Default: 'x-trace-id'.\n   * If the header is absent, a short random ID is generated.\n   */\n  traceIdHeader?: string;\n  /**\n   * Headers to redact from logged output.\n   * Default: ['authorization', 'cookie', 'set-cookie', 'x-api-key'].\n   */\n  redactHeaders?: string[];\n  /**\n   * Log level for request-start entries. Default: 'debug'.\n   * Set to 'silent' to suppress request-start logs entirely.\n   */\n  requestLevel?: string;\n  /** Log level for successful response entries. Default: 'info'. */\n  responseLevel?: string;\n  /** Log level for error responses (status ≥ 500). Default: 'error'. */\n  errorLevel?: string;\n}\n\n// Minimal structural types so we don't need @types/express / fastify in core\nexport interface IncomingRequest {\n  method?: string;\n  url?: string;\n  headers?: Record<string, string | string[] | undefined>;\n  body?: unknown;\n  socket?: { remoteAddress?: string };\n  ip?: string;\n}\n\nexport interface OutgoingResponse {\n  statusCode?: number;\n  on?: (event: string, cb: () => void) => void;\n  once?: (event: string, cb: () => void) => void;\n  getHeader?: (name: string) => string | number | string[] | undefined;\n}\n\n// ── Helpers ───────────────────────────────────────────────────────────────────\n\nconst DEFAULT_REDACT_HEADERS = new Set(['authorization', 'cookie', 'set-cookie', 'x-api-key']);\n\nfunction sanitizeHeaders(\n  headers: Record<string, string | string[] | undefined> | undefined,\n  redactSet: Set<string>\n): Record<string, unknown> {\n  if (!headers) return {};\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(headers)) {\n    if (k === '__proto__' || k === 'constructor' || k === 'prototype') continue;\n    out[k] = redactSet.has(k.toLowerCase()) ? '[REDACTED]' : v;\n  }\n  return out;\n}\n\nfunction shortId(): string {\n  // eslint-disable-next-line sonarjs/pseudo-random -- non-security request ID\n  return Math.random().toString(36).slice(2, 10);\n}\n\nfunction buildBaseFields(\n  req: IncomingRequest,\n  traceId: string,\n  options: HttpLoggerOptions\n): Record<string, unknown> {\n  const redactSet = options.redactHeaders\n    ? new Set(options.redactHeaders.map((h) => h.toLowerCase()))\n    : DEFAULT_REDACT_HEADERS;\n\n  const fields: Record<string, unknown> = {\n    traceId,\n    method: req.method?.toUpperCase() ?? 'UNKNOWN',\n    url: req.url ?? '/',\n    ip: req.ip ?? req.socket?.remoteAddress ?? 'unknown',\n    headers: sanitizeHeaders(req.headers, redactSet),\n  };\n\n  if (options.extraFields) {\n    Object.assign(fields, options.extraFields(req));\n  }\n\n  return fields;\n}\n\n// ── Express middleware ────────────────────────────────────────────────────────\n\n/**\n * Create an Express / Connect compatible middleware that replaces Morgan.\n */\nexport function createExpressMiddleware(\n  logger: IBaseLogger,\n  options: HttpLoggerOptions = {}\n): (req: IncomingRequest, res: OutgoingResponse, next: () => void) => void {\n  const {\n    skip,\n    logBody,\n    bodyMaxBytes,\n    traceIdHeader = 'x-trace-id',\n    requestLevel = 'debug',\n    responseLevel = 'info',\n    errorLevel = 'error',\n    slowRequestThresholdMs = 1000,\n  } = options;\n\n  return function logixiaHttpMiddleware(\n    req: IncomingRequest,\n    res: OutgoingResponse,\n    next: () => void\n  ): void {\n    if (skip?.(req)) {\n      next();\n      return;\n    }\n\n    const traceId = (req.headers?.[traceIdHeader] as string | undefined) ?? shortId();\n    const startMs = Date.now();\n    const baseFields = buildBaseFields(req, traceId, options);\n\n    // Log request start\n    if (requestLevel !== 'silent') {\n      void logger.logLevel(requestLevel, 'request started', {\n        ...baseFields,\n        ...(logBody && req.body ? { body: truncateBody(req.body, bodyMaxBytes) } : {}),\n      });\n    }\n\n    // Hook into the response 'finish' event — fires after headers + body are sent.\n    // This is what Morgan gets wrong for slow requests (it uses 'close' which may\n    // fire before the status code is set on some Node versions).\n    const onFinish = (): void => {\n      const duration = Date.now() - startMs;\n      const status = res.statusCode ?? 0;\n      const level = status >= 500 ? errorLevel : responseLevel;\n\n      void logger.logLevel(level, 'request completed', {\n        ...baseFields,\n        statusCode: status,\n        duration,\n      });\n\n      if (duration > slowRequestThresholdMs) {\n        void logger.warn('slow request detected', {\n          ...baseFields,\n          statusCode: status,\n          duration,\n          threshold: slowRequestThresholdMs,\n        });\n      }\n    };\n\n    res.once?.('finish', onFinish);\n    // Fallback: also listen to 'close' (client disconnected before response finished)\n    res.once?.('close', () => {\n      if ((res.statusCode ?? 0) === 0) onFinish();\n    });\n\n    next();\n  };\n}\n\n// ── Fastify plugin ─────────────────────────────────────────────────────────────\n\nexport interface FastifyInstance {\n  addHook: (name: string, fn: (req: unknown, reply: unknown, done: () => void) => void) => void;\n}\n\n/**\n * Create a Fastify plugin (a function you pass to `fastify.register()`).\n *\n * @example\n * ```ts\n * await fastify.register(createFastifyPlugin(logger, { slowRequestThresholdMs: 500 }));\n * ```\n */\nexport function createFastifyPlugin(logger: IBaseLogger, options: HttpLoggerOptions = {}) {\n  const {\n    skip,\n    traceIdHeader = 'x-trace-id',\n    requestLevel = 'debug',\n    responseLevel = 'info',\n    errorLevel = 'error',\n    slowRequestThresholdMs = 1000,\n  } = options;\n\n  return function logixiaFastifyPlugin(\n    fastify: FastifyInstance,\n    _opts: unknown,\n    done: () => void\n  ): void {\n    fastify.addHook('onRequest', (request: unknown, _reply: unknown, hookDone: () => void) => {\n      const req = request as IncomingRequest & { _logixiaStart?: number; _logixiaId?: string };\n      if (skip?.(req)) {\n        hookDone();\n        return;\n      }\n\n      const traceId = (req.headers?.[traceIdHeader] as string | undefined) ?? shortId();\n      req._logixiaStart = Date.now();\n      req._logixiaId = traceId;\n\n      if (requestLevel !== 'silent') {\n        void logger.logLevel(\n          requestLevel,\n          'request started',\n          buildBaseFields(req, traceId, options)\n        );\n      }\n      hookDone();\n    });\n\n    fastify.addHook('onResponse', (request: unknown, reply: unknown, hookDone: () => void) => {\n      const req = request as IncomingRequest & { _logixiaStart?: number; _logixiaId?: string };\n      const rep = reply as { statusCode?: number };\n      const duration = Date.now() - (req._logixiaStart ?? Date.now());\n      const status = rep.statusCode ?? 0;\n      const traceId = req._logixiaId ?? shortId();\n      const level = status >= 500 ? errorLevel : responseLevel;\n\n      void logger.logLevel(level, 'request completed', {\n        ...buildBaseFields(req, traceId, options),\n        statusCode: status,\n        duration,\n      });\n\n      if (duration > slowRequestThresholdMs) {\n        void logger.warn('slow request detected', {\n          traceId,\n          url: req.url,\n          method: req.method,\n          duration,\n          threshold: slowRequestThresholdMs,\n        });\n      }\n\n      hookDone();\n    });\n\n    done();\n  };\n}\n\n// ── Internal helpers ──────────────────────────────────────────────────────────\n\nfunction truncateBody(body: unknown, maxBytes = 4096): unknown {\n  if (typeof body === 'string') {\n    return body.length > maxBytes ? body.slice(0, maxBytes) + '…[truncated]' : body;\n  }\n  if (body && typeof body === 'object') {\n    const str = JSON.stringify(body);\n    if (str.length > maxBytes) {\n      return str.slice(0, maxBytes) + '…[truncated]';\n    }\n  }\n  return body;\n}\n"],"mappings":";;AA6FA,MAAM,yBAAyB,IAAI,IAAI;CAAC;CAAiB;CAAU;CAAc;CAAY,CAAC;AAE9F,SAAS,gBACP,SACA,WACyB;AACzB,KAAI,CAAC,QAAS,QAAO,EAAE;CACvB,MAAMA,MAA+B,EAAE;AACvC,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,QAAQ,EAAE;AAC5C,MAAI,MAAM,eAAe,MAAM,iBAAiB,MAAM,YAAa;AACnE,MAAI,KAAK,UAAU,IAAI,EAAE,aAAa,CAAC,GAAG,eAAe;;AAE3D,QAAO;;AAGT,SAAS,UAAkB;AAEzB,QAAO,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,GAAG,GAAG;;AAGhD,SAAS,gBACP,KACA,SACA,SACyB;;CACzB,MAAM,YAAY,QAAQ,gBACtB,IAAI,IAAI,QAAQ,cAAc,KAAK,MAAM,EAAE,aAAa,CAAC,CAAC,GAC1D;CAEJ,MAAMC,SAAkC;EACtC;EACA,wBAAQ,IAAI,kEAAQ,aAAa,KAAI;EACrC,KAAK,IAAI,OAAO;EAChB,IAAI,IAAI,sBAAM,IAAI,kEAAQ,kBAAiB;EAC3C,SAAS,gBAAgB,IAAI,SAAS,UAAU;EACjD;AAED,KAAI,QAAQ,YACV,QAAO,OAAO,QAAQ,QAAQ,YAAY,IAAI,CAAC;AAGjD,QAAO;;;;;AAQT,SAAgB,wBACd,QACA,UAA6B,EAAE,EAC0C;CACzE,MAAM,EACJ,MACA,SACA,cACA,gBAAgB,cAChB,eAAe,SACf,gBAAgB,QAChB,aAAa,SACb,yBAAyB,QACvB;AAEJ,QAAO,SAAS,sBACd,KACA,KACA,MACM;;AACN,kDAAI,KAAO,IAAI,EAAE;AACf,SAAM;AACN;;EAGF,MAAM,2BAAW,IAAI,qEAAU,mBAAyC,SAAS;EACjF,MAAM,UAAU,KAAK,KAAK;EAC1B,MAAM,aAAa,gBAAgB,KAAK,SAAS,QAAQ;AAGzD,MAAI,iBAAiB,SACnB,CAAK,OAAO,SAAS,cAAc,mBAAmB;GACpD,GAAG;GACH,GAAI,WAAW,IAAI,OAAO,EAAE,MAAM,aAAa,IAAI,MAAM,aAAa,EAAE,GAAG,EAAE;GAC9E,CAAC;EAMJ,MAAM,iBAAuB;GAC3B,MAAM,WAAW,KAAK,KAAK,GAAG;GAC9B,MAAM,SAAS,IAAI,cAAc;GACjC,MAAM,QAAQ,UAAU,MAAM,aAAa;AAE3C,GAAK,OAAO,SAAS,OAAO,qBAAqB;IAC/C,GAAG;IACH,YAAY;IACZ;IACD,CAAC;AAEF,OAAI,WAAW,uBACb,CAAK,OAAO,KAAK,yBAAyB;IACxC,GAAG;IACH,YAAY;IACZ;IACA,WAAW;IACZ,CAAC;;AAIN,mBAAI,8DAAO,UAAU,SAAS;AAE9B,oBAAI,gEAAO,eAAe;AACxB,QAAK,IAAI,cAAc,OAAO,EAAG,WAAU;IAC3C;AAEF,QAAM;;;;;;;;;;;AAkBV,SAAgB,oBAAoB,QAAqB,UAA6B,EAAE,EAAE;CACxF,MAAM,EACJ,MACA,gBAAgB,cAChB,eAAe,SACf,gBAAgB,QAChB,aAAa,SACb,yBAAyB,QACvB;AAEJ,QAAO,SAAS,qBACd,SACA,OACA,MACM;AACN,UAAQ,QAAQ,cAAc,SAAkB,QAAiB,aAAyB;;GACxF,MAAM,MAAM;AACZ,mDAAI,KAAO,IAAI,EAAE;AACf,cAAU;AACV;;GAGF,MAAM,4BAAW,IAAI,uEAAU,mBAAyC,SAAS;AACjF,OAAI,gBAAgB,KAAK,KAAK;AAC9B,OAAI,aAAa;AAEjB,OAAI,iBAAiB,SACnB,CAAK,OAAO,SACV,cACA,mBACA,gBAAgB,KAAK,SAAS,QAAQ,CACvC;AAEH,aAAU;IACV;AAEF,UAAQ,QAAQ,eAAe,SAAkB,OAAgB,aAAyB;GACxF,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,MAAM,WAAW,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK;GAC9D,MAAM,SAAS,IAAI,cAAc;GACjC,MAAM,UAAU,IAAI,cAAc,SAAS;GAC3C,MAAM,QAAQ,UAAU,MAAM,aAAa;AAE3C,GAAK,OAAO,SAAS,OAAO,qBAAqB;IAC/C,GAAG,gBAAgB,KAAK,SAAS,QAAQ;IACzC,YAAY;IACZ;IACD,CAAC;AAEF,OAAI,WAAW,uBACb,CAAK,OAAO,KAAK,yBAAyB;IACxC;IACA,KAAK,IAAI;IACT,QAAQ,IAAI;IACZ;IACA,WAAW;IACZ,CAAC;AAGJ,aAAU;IACV;AAEF,QAAM;;;AAMV,SAAS,aAAa,MAAe,WAAW,MAAe;AAC7D,KAAI,OAAO,SAAS,SAClB,QAAO,KAAK,SAAS,WAAW,KAAK,MAAM,GAAG,SAAS,GAAG,iBAAiB;AAE7E,KAAI,QAAQ,OAAO,SAAS,UAAU;EACpC,MAAM,MAAM,KAAK,UAAU,KAAK;AAChC,MAAI,IAAI,SAAS,SACf,QAAO,IAAI,MAAM,GAAG,SAAS,GAAG;;AAGpC,QAAO"}
+{"version":3,"file":"middleware.js","names":["out: Record<string, unknown>","fields: Record<string, unknown>"],"sources":["../src/middleware/http-logger.ts"],"sourcesContent":["/**\n * HTTP request/response logging middleware — Morgan replacement.\n *\n * Fixes every documented Morgan bug:\n *  - statusCode always captured correctly, even for requests > 20 s\n *  - Logs request START (with traceId) and response FINISH (with duration)\n *  - Captures errors before and after response\n *  - Auto-redacts Authorization / Cookie / Set-Cookie headers\n *  - Slow-request warnings\n *  - Skip predicates for health-check routes / static assets\n *\n * @example Express\n * ```ts\n * import { createExpressMiddleware } from 'logixia/middleware';\n * app.use(createExpressMiddleware(logger));\n * ```\n *\n * @example Fastify\n * ```ts\n * import { createFastifyPlugin } from 'logixia/middleware';\n * await fastify.register(createFastifyPlugin(logger));\n * ```\n */\n\n/* eslint-disable sonarjs/void-use -- intentional fire-and-forget in sync middleware callbacks */\nimport type { IBaseLogger } from '../types';\n\n// ── Shared types ─────────────────────────────────────────────────────────────\n\nexport interface HttpLoggerOptions {\n  /**\n   * Skip logging for a request. Called before any I/O.\n   * @example `skip: (req) => req.url === '/health'`\n   */\n  skip?: (req: IncomingRequest) => boolean;\n  /**\n   * Log request body (POST/PUT/PATCH). Capped at `bodyMaxBytes` (default: 4096).\n   * Redaction still applies to the captured body.\n   * Default: false.\n   */\n  logBody?: boolean;\n  /** Max bytes of body to capture. Default: 4096. */\n  bodyMaxBytes?: number;\n  /**\n   * Emit a WARN log when a request duration exceeds this threshold (ms).\n   * Default: 1000.\n   */\n  slowRequestThresholdMs?: number;\n  /**\n   * Additional fields to include in every log entry.\n   * @example `extraFields: (req) => ({ tenantId: req.headers['x-tenant-id'] })`\n   */\n  extraFields?: (req: IncomingRequest) => Record<string, unknown>;\n  /**\n   * Trace ID header. Default: 'x-trace-id'.\n   * If the header is absent, a short random ID is generated.\n   */\n  traceIdHeader?: string;\n  /**\n   * Headers to redact from logged output.\n   * Default: ['authorization', 'cookie', 'set-cookie', 'x-api-key'].\n   */\n  redactHeaders?: string[];\n  /**\n   * Log level for request-start entries. Default: 'debug'.\n   * Set to 'silent' to suppress request-start logs entirely.\n   */\n  requestLevel?: string;\n  /** Log level for successful response entries. Default: 'info'. */\n  responseLevel?: string;\n  /** Log level for error responses (status ≥ 500). Default: 'error'. */\n  errorLevel?: string;\n}\n\n// Minimal structural types so we don't need @types/express / fastify in core\nexport interface IncomingRequest {\n  method?: string;\n  url?: string;\n  headers?: Record<string, string | string[] | undefined>;\n  body?: unknown;\n  socket?: { remoteAddress?: string };\n  ip?: string;\n}\n\nexport interface OutgoingResponse {\n  statusCode?: number;\n  on?: (event: string, cb: () => void) => void;\n  once?: (event: string, cb: () => void) => void;\n  getHeader?: (name: string) => string | number | string[] | undefined;\n}\n\n// ── Helpers ───────────────────────────────────────────────────────────────────\n\nconst DEFAULT_REDACT_HEADERS = new Set(['authorization', 'cookie', 'set-cookie', 'x-api-key']);\n\nfunction sanitizeHeaders(\n  headers: Record<string, string | string[] | undefined> | undefined,\n  redactSet: Set<string>\n): Record<string, unknown> {\n  if (!headers) return {};\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(headers)) {\n    if (k === '__proto__' || k === 'constructor' || k === 'prototype') continue;\n    out[k] = redactSet.has(k.toLowerCase()) ? '[REDACTED]' : v;\n  }\n  return out;\n}\n\nfunction shortId(): string {\n  // eslint-disable-next-line sonarjs/pseudo-random -- non-security request ID\n  return Math.random().toString(36).slice(2, 10);\n}\n\nfunction buildBaseFields(\n  req: IncomingRequest,\n  traceId: string,\n  options: HttpLoggerOptions\n): Record<string, unknown> {\n  const redactSet = options.redactHeaders\n    ? new Set(options.redactHeaders.map((h) => h.toLowerCase()))\n    : DEFAULT_REDACT_HEADERS;\n\n  const fields: Record<string, unknown> = {\n    traceId,\n    method: req.method?.toUpperCase() ?? 'UNKNOWN',\n    url: req.url ?? '/',\n    ip: req.ip ?? req.socket?.remoteAddress ?? 'unknown',\n    headers: sanitizeHeaders(req.headers, redactSet),\n  };\n\n  if (options.extraFields) {\n    Object.assign(fields, options.extraFields(req));\n  }\n\n  return fields;\n}\n\n// ── Express middleware ────────────────────────────────────────────────────────\n\n/**\n * Create an Express / Connect compatible middleware that replaces Morgan.\n */\nexport function createExpressMiddleware(\n  logger: IBaseLogger,\n  options: HttpLoggerOptions = {}\n): (req: IncomingRequest, res: OutgoingResponse, next: () => void) => void {\n  const {\n    skip,\n    logBody,\n    bodyMaxBytes,\n    traceIdHeader = 'x-trace-id',\n    requestLevel = 'debug',\n    responseLevel = 'info',\n    errorLevel = 'error',\n    slowRequestThresholdMs = 1000,\n  } = options;\n\n  return function logixiaHttpMiddleware(\n    req: IncomingRequest,\n    res: OutgoingResponse,\n    next: () => void\n  ): void {\n    if (skip?.(req)) {\n      next();\n      return;\n    }\n\n    const traceId = (req.headers?.[traceIdHeader] as string | undefined) ?? shortId();\n    const startMs = Date.now();\n    const baseFields = buildBaseFields(req, traceId, options);\n\n    // Log request start\n    if (requestLevel !== 'silent') {\n      void logger.logLevel(requestLevel, 'request started', {\n        ...baseFields,\n        ...(logBody && req.body ? { body: truncateBody(req.body, bodyMaxBytes) } : {}),\n      });\n    }\n\n    // Hook into the response 'finish' event — fires after headers + body are sent.\n    // This is what Morgan gets wrong for slow requests (it uses 'close' which may\n    // fire before the status code is set on some Node versions).\n    //\n    // BOTH 'finish' and 'close' fire on a normal response, so guard against\n    // logging the completion twice (which would duplicate the completed entry and\n    // the slow-request warning).\n    let completed = false;\n    const onFinish = (): void => {\n      if (completed) return;\n      completed = true;\n\n      const duration = Date.now() - startMs;\n      const status = res.statusCode ?? 0;\n      const level = status >= 500 ? errorLevel : responseLevel;\n\n      void logger.logLevel(level, 'request completed', {\n        ...baseFields,\n        statusCode: status,\n        duration,\n      });\n\n      if (duration > slowRequestThresholdMs) {\n        void logger.warn('slow request detected', {\n          ...baseFields,\n          statusCode: status,\n          duration,\n          threshold: slowRequestThresholdMs,\n        });\n      }\n    };\n\n    res.once?.('finish', onFinish);\n    // Fallback: also covers a client that disconnects before 'finish' fires. The\n    // `completed` guard ensures a normal finish+close pair logs only once.\n    res.once?.('close', onFinish);\n\n    next();\n  };\n}\n\n// ── Fastify plugin ─────────────────────────────────────────────────────────────\n\nexport interface FastifyInstance {\n  addHook: (name: string, fn: (req: unknown, reply: unknown, done: () => void) => void) => void;\n}\n\n/**\n * Create a Fastify plugin (a function you pass to `fastify.register()`).\n *\n * @example\n * ```ts\n * await fastify.register(createFastifyPlugin(logger, { slowRequestThresholdMs: 500 }));\n * ```\n */\nexport function createFastifyPlugin(logger: IBaseLogger, options: HttpLoggerOptions = {}) {\n  const {\n    skip,\n    traceIdHeader = 'x-trace-id',\n    requestLevel = 'debug',\n    responseLevel = 'info',\n    errorLevel = 'error',\n    slowRequestThresholdMs = 1000,\n  } = options;\n\n  return function logixiaFastifyPlugin(\n    fastify: FastifyInstance,\n    _opts: unknown,\n    done: () => void\n  ): void {\n    fastify.addHook('onRequest', (request: unknown, _reply: unknown, hookDone: () => void) => {\n      const req = request as IncomingRequest & { _logixiaStart?: number; _logixiaId?: string };\n      if (skip?.(req)) {\n        hookDone();\n        return;\n      }\n\n      const traceId = (req.headers?.[traceIdHeader] as string | undefined) ?? shortId();\n      req._logixiaStart = Date.now();\n      req._logixiaId = traceId;\n\n      if (requestLevel !== 'silent') {\n        void logger.logLevel(\n          requestLevel,\n          'request started',\n          buildBaseFields(req, traceId, options)\n        );\n      }\n      hookDone();\n    });\n\n    fastify.addHook('onResponse', (request: unknown, reply: unknown, hookDone: () => void) => {\n      const req = request as IncomingRequest & { _logixiaStart?: number; _logixiaId?: string };\n      const rep = reply as { statusCode?: number };\n      const duration = Date.now() - (req._logixiaStart ?? Date.now());\n      const status = rep.statusCode ?? 0;\n      const traceId = req._logixiaId ?? shortId();\n      const level = status >= 500 ? errorLevel : responseLevel;\n\n      void logger.logLevel(level, 'request completed', {\n        ...buildBaseFields(req, traceId, options),\n        statusCode: status,\n        duration,\n      });\n\n      if (duration > slowRequestThresholdMs) {\n        void logger.warn('slow request detected', {\n          traceId,\n          url: req.url,\n          method: req.method,\n          duration,\n          threshold: slowRequestThresholdMs,\n        });\n      }\n\n      hookDone();\n    });\n\n    done();\n  };\n}\n\n// ── Internal helpers ──────────────────────────────────────────────────────────\n\nfunction truncateBody(body: unknown, maxBytes = 4096): unknown {\n  if (typeof body === 'string') {\n    return body.length > maxBytes ? body.slice(0, maxBytes) + '…[truncated]' : body;\n  }\n  if (body && typeof body === 'object') {\n    const str = JSON.stringify(body);\n    if (str.length > maxBytes) {\n      return str.slice(0, maxBytes) + '…[truncated]';\n    }\n  }\n  return body;\n}\n"],"mappings":";;AA6FA,MAAM,yBAAyB,IAAI,IAAI;CAAC;CAAiB;CAAU;CAAc;CAAY,CAAC;AAE9F,SAAS,gBACP,SACA,WACyB;AACzB,KAAI,CAAC,QAAS,QAAO,EAAE;CACvB,MAAMA,MAA+B,EAAE;AACvC,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,QAAQ,EAAE;AAC5C,MAAI,MAAM,eAAe,MAAM,iBAAiB,MAAM,YAAa;AACnE,MAAI,KAAK,UAAU,IAAI,EAAE,aAAa,CAAC,GAAG,eAAe;;AAE3D,QAAO;;AAGT,SAAS,UAAkB;AAEzB,QAAO,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,GAAG,GAAG;;AAGhD,SAAS,gBACP,KACA,SACA,SACyB;;CACzB,MAAM,YAAY,QAAQ,gBACtB,IAAI,IAAI,QAAQ,cAAc,KAAK,MAAM,EAAE,aAAa,CAAC,CAAC,GAC1D;CAEJ,MAAMC,SAAkC;EACtC;EACA,wBAAQ,IAAI,kEAAQ,aAAa,KAAI;EACrC,KAAK,IAAI,OAAO;EAChB,IAAI,IAAI,sBAAM,IAAI,kEAAQ,kBAAiB;EAC3C,SAAS,gBAAgB,IAAI,SAAS,UAAU;EACjD;AAED,KAAI,QAAQ,YACV,QAAO,OAAO,QAAQ,QAAQ,YAAY,IAAI,CAAC;AAGjD,QAAO;;;;;AAQT,SAAgB,wBACd,QACA,UAA6B,EAAE,EAC0C;CACzE,MAAM,EACJ,MACA,SACA,cACA,gBAAgB,cAChB,eAAe,SACf,gBAAgB,QAChB,aAAa,SACb,yBAAyB,QACvB;AAEJ,QAAO,SAAS,sBACd,KACA,KACA,MACM;;AACN,kDAAI,KAAO,IAAI,EAAE;AACf,SAAM;AACN;;EAGF,MAAM,2BAAW,IAAI,qEAAU,mBAAyC,SAAS;EACjF,MAAM,UAAU,KAAK,KAAK;EAC1B,MAAM,aAAa,gBAAgB,KAAK,SAAS,QAAQ;AAGzD,MAAI,iBAAiB,SACnB,CAAK,OAAO,SAAS,cAAc,mBAAmB;GACpD,GAAG;GACH,GAAI,WAAW,IAAI,OAAO,EAAE,MAAM,aAAa,IAAI,MAAM,aAAa,EAAE,GAAG,EAAE;GAC9E,CAAC;EAUJ,IAAI,YAAY;EAChB,MAAM,iBAAuB;AAC3B,OAAI,UAAW;AACf,eAAY;GAEZ,MAAM,WAAW,KAAK,KAAK,GAAG;GAC9B,MAAM,SAAS,IAAI,cAAc;GACjC,MAAM,QAAQ,UAAU,MAAM,aAAa;AAE3C,GAAK,OAAO,SAAS,OAAO,qBAAqB;IAC/C,GAAG;IACH,YAAY;IACZ;IACD,CAAC;AAEF,OAAI,WAAW,uBACb,CAAK,OAAO,KAAK,yBAAyB;IACxC,GAAG;IACH,YAAY;IACZ;IACA,WAAW;IACZ,CAAC;;AAIN,mBAAI,8DAAO,UAAU,SAAS;AAG9B,oBAAI,gEAAO,SAAS,SAAS;AAE7B,QAAM;;;;;;;;;;;AAkBV,SAAgB,oBAAoB,QAAqB,UAA6B,EAAE,EAAE;CACxF,MAAM,EACJ,MACA,gBAAgB,cAChB,eAAe,SACf,gBAAgB,QAChB,aAAa,SACb,yBAAyB,QACvB;AAEJ,QAAO,SAAS,qBACd,SACA,OACA,MACM;AACN,UAAQ,QAAQ,cAAc,SAAkB,QAAiB,aAAyB;;GACxF,MAAM,MAAM;AACZ,mDAAI,KAAO,IAAI,EAAE;AACf,cAAU;AACV;;GAGF,MAAM,4BAAW,IAAI,uEAAU,mBAAyC,SAAS;AACjF,OAAI,gBAAgB,KAAK,KAAK;AAC9B,OAAI,aAAa;AAEjB,OAAI,iBAAiB,SACnB,CAAK,OAAO,SACV,cACA,mBACA,gBAAgB,KAAK,SAAS,QAAQ,CACvC;AAEH,aAAU;IACV;AAEF,UAAQ,QAAQ,eAAe,SAAkB,OAAgB,aAAyB;GACxF,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,MAAM,WAAW,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK;GAC9D,MAAM,SAAS,IAAI,cAAc;GACjC,MAAM,UAAU,IAAI,cAAc,SAAS;GAC3C,MAAM,QAAQ,UAAU,MAAM,aAAa;AAE3C,GAAK,OAAO,SAAS,OAAO,qBAAqB;IAC/C,GAAG,gBAAgB,KAAK,SAAS,QAAQ;IACzC,YAAY;IACZ;IACD,CAAC;AAEF,OAAI,WAAW,uBACb,CAAK,OAAO,KAAK,yBAAyB;IACxC;IACA,KAAK,IAAI;IACT,QAAQ,IAAI;IACZ;IACA,WAAW;IACZ,CAAC;AAGJ,aAAU;IACV;AAEF,QAAM;;;AAMV,SAAS,aAAa,MAAe,WAAW,MAAe;AAC7D,KAAI,OAAO,SAAS,SAClB,QAAO,KAAK,SAAS,WAAW,KAAK,MAAM,GAAG,SAAS,GAAG,iBAAiB;AAE7E,KAAI,QAAQ,OAAO,SAAS,UAAU;EACpC,MAAM,MAAM,KAAK,UAAU,KAAK;AAChC,MAAI,IAAI,SAAS,SACf,QAAO,IAAI,MAAM,GAAG,SAAS,GAAG;;AAGpC,QAAO"}

package/dist/middleware.mjs

@@ -48,7 +48,10 @@ function createExpressMiddleware(logger, options = {}) {
 			...baseFields,
 			...logBody && req.body ? { body: truncateBody(req.body, bodyMaxBytes) } : {}
 		});
+		let completed = false;
 		const onFinish = () => {
+			if (completed) return;
+			completed = true;
 			const duration = Date.now() - startMs;
 			const status = res.statusCode ?? 0;
 			const level = status >= 500 ? errorLevel : responseLevel;
@@ -65,9 +68,7 @@ function createExpressMiddleware(logger, options = {}) {
 			});
 		};
 		(_res$once = res.once) === null || _res$once === void 0 || _res$once.call(res, "finish", onFinish);
-		(_res$once2 = res.once) === null || _res$once2 === void 0 || _res$once2.call(res, "close", () => {
-			if ((res.statusCode ?? 0) === 0) onFinish();
-		});
+		(_res$once2 = res.once) === null || _res$once2 === void 0 || _res$once2.call(res, "close", onFinish);
 		next();
 	};
 }

package/dist/middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.mjs","names":["out: Record<string, unknown>","fields: Record<string, unknown>"],"sources":["../src/middleware/http-logger.ts"],"sourcesContent":["/**\n * HTTP request/response logging middleware — Morgan replacement.\n *\n * Fixes every documented Morgan bug:\n *  - statusCode always captured correctly, even for requests > 20 s\n *  - Logs request START (with traceId) and response FINISH (with duration)\n *  - Captures errors before and after response\n *  - Auto-redacts Authorization / Cookie / Set-Cookie headers\n *  - Slow-request warnings\n *  - Skip predicates for health-check routes / static assets\n *\n * @example Express\n * ```ts\n * import { createExpressMiddleware } from 'logixia/middleware';\n * app.use(createExpressMiddleware(logger));\n * ```\n *\n * @example Fastify\n * ```ts\n * import { createFastifyPlugin } from 'logixia/middleware';\n * await fastify.register(createFastifyPlugin(logger));\n * ```\n */\n\n/* eslint-disable sonarjs/void-use -- intentional fire-and-forget in sync middleware callbacks */\nimport type { IBaseLogger } from '../types';\n\n// ── Shared types ─────────────────────────────────────────────────────────────\n\nexport interface HttpLoggerOptions {\n  /**\n   * Skip logging for a request. Called before any I/O.\n   * @example `skip: (req) => req.url === '/health'`\n   */\n  skip?: (req: IncomingRequest) => boolean;\n  /**\n   * Log request body (POST/PUT/PATCH). Capped at `bodyMaxBytes` (default: 4096).\n   * Redaction still applies to the captured body.\n   * Default: false.\n   */\n  logBody?: boolean;\n  /** Max bytes of body to capture. Default: 4096. */\n  bodyMaxBytes?: number;\n  /**\n   * Emit a WARN log when a request duration exceeds this threshold (ms).\n   * Default: 1000.\n   */\n  slowRequestThresholdMs?: number;\n  /**\n   * Additional fields to include in every log entry.\n   * @example `extraFields: (req) => ({ tenantId: req.headers['x-tenant-id'] })`\n   */\n  extraFields?: (req: IncomingRequest) => Record<string, unknown>;\n  /**\n   * Trace ID header. Default: 'x-trace-id'.\n   * If the header is absent, a short random ID is generated.\n   */\n  traceIdHeader?: string;\n  /**\n   * Headers to redact from logged output.\n   * Default: ['authorization', 'cookie', 'set-cookie', 'x-api-key'].\n   */\n  redactHeaders?: string[];\n  /**\n   * Log level for request-start entries. Default: 'debug'.\n   * Set to 'silent' to suppress request-start logs entirely.\n   */\n  requestLevel?: string;\n  /** Log level for successful response entries. Default: 'info'. */\n  responseLevel?: string;\n  /** Log level for error responses (status ≥ 500). Default: 'error'. */\n  errorLevel?: string;\n}\n\n// Minimal structural types so we don't need @types/express / fastify in core\nexport interface IncomingRequest {\n  method?: string;\n  url?: string;\n  headers?: Record<string, string | string[] | undefined>;\n  body?: unknown;\n  socket?: { remoteAddress?: string };\n  ip?: string;\n}\n\nexport interface OutgoingResponse {\n  statusCode?: number;\n  on?: (event: string, cb: () => void) => void;\n  once?: (event: string, cb: () => void) => void;\n  getHeader?: (name: string) => string | number | string[] | undefined;\n}\n\n// ── Helpers ───────────────────────────────────────────────────────────────────\n\nconst DEFAULT_REDACT_HEADERS = new Set(['authorization', 'cookie', 'set-cookie', 'x-api-key']);\n\nfunction sanitizeHeaders(\n  headers: Record<string, string | string[] | undefined> | undefined,\n  redactSet: Set<string>\n): Record<string, unknown> {\n  if (!headers) return {};\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(headers)) {\n    if (k === '__proto__' || k === 'constructor' || k === 'prototype') continue;\n    out[k] = redactSet.has(k.toLowerCase()) ? '[REDACTED]' : v;\n  }\n  return out;\n}\n\nfunction shortId(): string {\n  // eslint-disable-next-line sonarjs/pseudo-random -- non-security request ID\n  return Math.random().toString(36).slice(2, 10);\n}\n\nfunction buildBaseFields(\n  req: IncomingRequest,\n  traceId: string,\n  options: HttpLoggerOptions\n): Record<string, unknown> {\n  const redactSet = options.redactHeaders\n    ? new Set(options.redactHeaders.map((h) => h.toLowerCase()))\n    : DEFAULT_REDACT_HEADERS;\n\n  const fields: Record<string, unknown> = {\n    traceId,\n    method: req.method?.toUpperCase() ?? 'UNKNOWN',\n    url: req.url ?? '/',\n    ip: req.ip ?? req.socket?.remoteAddress ?? 'unknown',\n    headers: sanitizeHeaders(req.headers, redactSet),\n  };\n\n  if (options.extraFields) {\n    Object.assign(fields, options.extraFields(req));\n  }\n\n  return fields;\n}\n\n// ── Express middleware ────────────────────────────────────────────────────────\n\n/**\n * Create an Express / Connect compatible middleware that replaces Morgan.\n */\nexport function createExpressMiddleware(\n  logger: IBaseLogger,\n  options: HttpLoggerOptions = {}\n): (req: IncomingRequest, res: OutgoingResponse, next: () => void) => void {\n  const {\n    skip,\n    logBody,\n    bodyMaxBytes,\n    traceIdHeader = 'x-trace-id',\n    requestLevel = 'debug',\n    responseLevel = 'info',\n    errorLevel = 'error',\n    slowRequestThresholdMs = 1000,\n  } = options;\n\n  return function logixiaHttpMiddleware(\n    req: IncomingRequest,\n    res: OutgoingResponse,\n    next: () => void\n  ): void {\n    if (skip?.(req)) {\n      next();\n      return;\n    }\n\n    const traceId = (req.headers?.[traceIdHeader] as string | undefined) ?? shortId();\n    const startMs = Date.now();\n    const baseFields = buildBaseFields(req, traceId, options);\n\n    // Log request start\n    if (requestLevel !== 'silent') {\n      void logger.logLevel(requestLevel, 'request started', {\n        ...baseFields,\n        ...(logBody && req.body ? { body: truncateBody(req.body, bodyMaxBytes) } : {}),\n      });\n    }\n\n    // Hook into the response 'finish' event — fires after headers + body are sent.\n    // This is what Morgan gets wrong for slow requests (it uses 'close' which may\n    // fire before the status code is set on some Node versions).\n    const onFinish = (): void => {\n      const duration = Date.now() - startMs;\n      const status = res.statusCode ?? 0;\n      const level = status >= 500 ? errorLevel : responseLevel;\n\n      void logger.logLevel(level, 'request completed', {\n        ...baseFields,\n        statusCode: status,\n        duration,\n      });\n\n      if (duration > slowRequestThresholdMs) {\n        void logger.warn('slow request detected', {\n          ...baseFields,\n          statusCode: status,\n          duration,\n          threshold: slowRequestThresholdMs,\n        });\n      }\n    };\n\n    res.once?.('finish', onFinish);\n    // Fallback: also listen to 'close' (client disconnected before response finished)\n    res.once?.('close', () => {\n      if ((res.statusCode ?? 0) === 0) onFinish();\n    });\n\n    next();\n  };\n}\n\n// ── Fastify plugin ─────────────────────────────────────────────────────────────\n\nexport interface FastifyInstance {\n  addHook: (name: string, fn: (req: unknown, reply: unknown, done: () => void) => void) => void;\n}\n\n/**\n * Create a Fastify plugin (a function you pass to `fastify.register()`).\n *\n * @example\n * ```ts\n * await fastify.register(createFastifyPlugin(logger, { slowRequestThresholdMs: 500 }));\n * ```\n */\nexport function createFastifyPlugin(logger: IBaseLogger, options: HttpLoggerOptions = {}) {\n  const {\n    skip,\n    traceIdHeader = 'x-trace-id',\n    requestLevel = 'debug',\n    responseLevel = 'info',\n    errorLevel = 'error',\n    slowRequestThresholdMs = 1000,\n  } = options;\n\n  return function logixiaFastifyPlugin(\n    fastify: FastifyInstance,\n    _opts: unknown,\n    done: () => void\n  ): void {\n    fastify.addHook('onRequest', (request: unknown, _reply: unknown, hookDone: () => void) => {\n      const req = request as IncomingRequest & { _logixiaStart?: number; _logixiaId?: string };\n      if (skip?.(req)) {\n        hookDone();\n        return;\n      }\n\n      const traceId = (req.headers?.[traceIdHeader] as string | undefined) ?? shortId();\n      req._logixiaStart = Date.now();\n      req._logixiaId = traceId;\n\n      if (requestLevel !== 'silent') {\n        void logger.logLevel(\n          requestLevel,\n          'request started',\n          buildBaseFields(req, traceId, options)\n        );\n      }\n      hookDone();\n    });\n\n    fastify.addHook('onResponse', (request: unknown, reply: unknown, hookDone: () => void) => {\n      const req = request as IncomingRequest & { _logixiaStart?: number; _logixiaId?: string };\n      const rep = reply as { statusCode?: number };\n      const duration = Date.now() - (req._logixiaStart ?? Date.now());\n      const status = rep.statusCode ?? 0;\n      const traceId = req._logixiaId ?? shortId();\n      const level = status >= 500 ? errorLevel : responseLevel;\n\n      void logger.logLevel(level, 'request completed', {\n        ...buildBaseFields(req, traceId, options),\n        statusCode: status,\n        duration,\n      });\n\n      if (duration > slowRequestThresholdMs) {\n        void logger.warn('slow request detected', {\n          traceId,\n          url: req.url,\n          method: req.method,\n          duration,\n          threshold: slowRequestThresholdMs,\n        });\n      }\n\n      hookDone();\n    });\n\n    done();\n  };\n}\n\n// ── Internal helpers ──────────────────────────────────────────────────────────\n\nfunction truncateBody(body: unknown, maxBytes = 4096): unknown {\n  if (typeof body === 'string') {\n    return body.length > maxBytes ? body.slice(0, maxBytes) + '…[truncated]' : body;\n  }\n  if (body && typeof body === 'object') {\n    const str = JSON.stringify(body);\n    if (str.length > maxBytes) {\n      return str.slice(0, maxBytes) + '…[truncated]';\n    }\n  }\n  return body;\n}\n"],"mappings":";AA6FA,MAAM,yBAAyB,IAAI,IAAI;CAAC;CAAiB;CAAU;CAAc;CAAY,CAAC;AAE9F,SAAS,gBACP,SACA,WACyB;AACzB,KAAI,CAAC,QAAS,QAAO,EAAE;CACvB,MAAMA,MAA+B,EAAE;AACvC,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,QAAQ,EAAE;AAC5C,MAAI,MAAM,eAAe,MAAM,iBAAiB,MAAM,YAAa;AACnE,MAAI,KAAK,UAAU,IAAI,EAAE,aAAa,CAAC,GAAG,eAAe;;AAE3D,QAAO;;AAGT,SAAS,UAAkB;AAEzB,QAAO,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,GAAG,GAAG;;AAGhD,SAAS,gBACP,KACA,SACA,SACyB;;CACzB,MAAM,YAAY,QAAQ,gBACtB,IAAI,IAAI,QAAQ,cAAc,KAAK,MAAM,EAAE,aAAa,CAAC,CAAC,GAC1D;CAEJ,MAAMC,SAAkC;EACtC;EACA,wBAAQ,IAAI,kEAAQ,aAAa,KAAI;EACrC,KAAK,IAAI,OAAO;EAChB,IAAI,IAAI,sBAAM,IAAI,kEAAQ,kBAAiB;EAC3C,SAAS,gBAAgB,IAAI,SAAS,UAAU;EACjD;AAED,KAAI,QAAQ,YACV,QAAO,OAAO,QAAQ,QAAQ,YAAY,IAAI,CAAC;AAGjD,QAAO;;;;;AAQT,SAAgB,wBACd,QACA,UAA6B,EAAE,EAC0C;CACzE,MAAM,EACJ,MACA,SACA,cACA,gBAAgB,cAChB,eAAe,SACf,gBAAgB,QAChB,aAAa,SACb,yBAAyB,QACvB;AAEJ,QAAO,SAAS,sBACd,KACA,KACA,MACM;;AACN,kDAAI,KAAO,IAAI,EAAE;AACf,SAAM;AACN;;EAGF,MAAM,2BAAW,IAAI,qEAAU,mBAAyC,SAAS;EACjF,MAAM,UAAU,KAAK,KAAK;EAC1B,MAAM,aAAa,gBAAgB,KAAK,SAAS,QAAQ;AAGzD,MAAI,iBAAiB,SACnB,CAAK,OAAO,SAAS,cAAc,mBAAmB;GACpD,GAAG;GACH,GAAI,WAAW,IAAI,OAAO,EAAE,MAAM,aAAa,IAAI,MAAM,aAAa,EAAE,GAAG,EAAE;GAC9E,CAAC;EAMJ,MAAM,iBAAuB;GAC3B,MAAM,WAAW,KAAK,KAAK,GAAG;GAC9B,MAAM,SAAS,IAAI,cAAc;GACjC,MAAM,QAAQ,UAAU,MAAM,aAAa;AAE3C,GAAK,OAAO,SAAS,OAAO,qBAAqB;IAC/C,GAAG;IACH,YAAY;IACZ;IACD,CAAC;AAEF,OAAI,WAAW,uBACb,CAAK,OAAO,KAAK,yBAAyB;IACxC,GAAG;IACH,YAAY;IACZ;IACA,WAAW;IACZ,CAAC;;AAIN,mBAAI,8DAAO,UAAU,SAAS;AAE9B,oBAAI,gEAAO,eAAe;AACxB,QAAK,IAAI,cAAc,OAAO,EAAG,WAAU;IAC3C;AAEF,QAAM;;;;;;;;;;;AAkBV,SAAgB,oBAAoB,QAAqB,UAA6B,EAAE,EAAE;CACxF,MAAM,EACJ,MACA,gBAAgB,cAChB,eAAe,SACf,gBAAgB,QAChB,aAAa,SACb,yBAAyB,QACvB;AAEJ,QAAO,SAAS,qBACd,SACA,OACA,MACM;AACN,UAAQ,QAAQ,cAAc,SAAkB,QAAiB,aAAyB;;GACxF,MAAM,MAAM;AACZ,mDAAI,KAAO,IAAI,EAAE;AACf,cAAU;AACV;;GAGF,MAAM,4BAAW,IAAI,uEAAU,mBAAyC,SAAS;AACjF,OAAI,gBAAgB,KAAK,KAAK;AAC9B,OAAI,aAAa;AAEjB,OAAI,iBAAiB,SACnB,CAAK,OAAO,SACV,cACA,mBACA,gBAAgB,KAAK,SAAS,QAAQ,CACvC;AAEH,aAAU;IACV;AAEF,UAAQ,QAAQ,eAAe,SAAkB,OAAgB,aAAyB;GACxF,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,MAAM,WAAW,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK;GAC9D,MAAM,SAAS,IAAI,cAAc;GACjC,MAAM,UAAU,IAAI,cAAc,SAAS;GAC3C,MAAM,QAAQ,UAAU,MAAM,aAAa;AAE3C,GAAK,OAAO,SAAS,OAAO,qBAAqB;IAC/C,GAAG,gBAAgB,KAAK,SAAS,QAAQ;IACzC,YAAY;IACZ;IACD,CAAC;AAEF,OAAI,WAAW,uBACb,CAAK,OAAO,KAAK,yBAAyB;IACxC;IACA,KAAK,IAAI;IACT,QAAQ,IAAI;IACZ;IACA,WAAW;IACZ,CAAC;AAGJ,aAAU;IACV;AAEF,QAAM;;;AAMV,SAAS,aAAa,MAAe,WAAW,MAAe;AAC7D,KAAI,OAAO,SAAS,SAClB,QAAO,KAAK,SAAS,WAAW,KAAK,MAAM,GAAG,SAAS,GAAG,iBAAiB;AAE7E,KAAI,QAAQ,OAAO,SAAS,UAAU;EACpC,MAAM,MAAM,KAAK,UAAU,KAAK;AAChC,MAAI,IAAI,SAAS,SACf,QAAO,IAAI,MAAM,GAAG,SAAS,GAAG;;AAGpC,QAAO"}
+{"version":3,"file":"middleware.mjs","names":["out: Record<string, unknown>","fields: Record<string, unknown>"],"sources":["../src/middleware/http-logger.ts"],"sourcesContent":["/**\n * HTTP request/response logging middleware — Morgan replacement.\n *\n * Fixes every documented Morgan bug:\n *  - statusCode always captured correctly, even for requests > 20 s\n *  - Logs request START (with traceId) and response FINISH (with duration)\n *  - Captures errors before and after response\n *  - Auto-redacts Authorization / Cookie / Set-Cookie headers\n *  - Slow-request warnings\n *  - Skip predicates for health-check routes / static assets\n *\n * @example Express\n * ```ts\n * import { createExpressMiddleware } from 'logixia/middleware';\n * app.use(createExpressMiddleware(logger));\n * ```\n *\n * @example Fastify\n * ```ts\n * import { createFastifyPlugin } from 'logixia/middleware';\n * await fastify.register(createFastifyPlugin(logger));\n * ```\n */\n\n/* eslint-disable sonarjs/void-use -- intentional fire-and-forget in sync middleware callbacks */\nimport type { IBaseLogger } from '../types';\n\n// ── Shared types ─────────────────────────────────────────────────────────────\n\nexport interface HttpLoggerOptions {\n  /**\n   * Skip logging for a request. Called before any I/O.\n   * @example `skip: (req) => req.url === '/health'`\n   */\n  skip?: (req: IncomingRequest) => boolean;\n  /**\n   * Log request body (POST/PUT/PATCH). Capped at `bodyMaxBytes` (default: 4096).\n   * Redaction still applies to the captured body.\n   * Default: false.\n   */\n  logBody?: boolean;\n  /** Max bytes of body to capture. Default: 4096. */\n  bodyMaxBytes?: number;\n  /**\n   * Emit a WARN log when a request duration exceeds this threshold (ms).\n   * Default: 1000.\n   */\n  slowRequestThresholdMs?: number;\n  /**\n   * Additional fields to include in every log entry.\n   * @example `extraFields: (req) => ({ tenantId: req.headers['x-tenant-id'] })`\n   */\n  extraFields?: (req: IncomingRequest) => Record<string, unknown>;\n  /**\n   * Trace ID header. Default: 'x-trace-id'.\n   * If the header is absent, a short random ID is generated.\n   */\n  traceIdHeader?: string;\n  /**\n   * Headers to redact from logged output.\n   * Default: ['authorization', 'cookie', 'set-cookie', 'x-api-key'].\n   */\n  redactHeaders?: string[];\n  /**\n   * Log level for request-start entries. Default: 'debug'.\n   * Set to 'silent' to suppress request-start logs entirely.\n   */\n  requestLevel?: string;\n  /** Log level for successful response entries. Default: 'info'. */\n  responseLevel?: string;\n  /** Log level for error responses (status ≥ 500). Default: 'error'. */\n  errorLevel?: string;\n}\n\n// Minimal structural types so we don't need @types/express / fastify in core\nexport interface IncomingRequest {\n  method?: string;\n  url?: string;\n  headers?: Record<string, string | string[] | undefined>;\n  body?: unknown;\n  socket?: { remoteAddress?: string };\n  ip?: string;\n}\n\nexport interface OutgoingResponse {\n  statusCode?: number;\n  on?: (event: string, cb: () => void) => void;\n  once?: (event: string, cb: () => void) => void;\n  getHeader?: (name: string) => string | number | string[] | undefined;\n}\n\n// ── Helpers ───────────────────────────────────────────────────────────────────\n\nconst DEFAULT_REDACT_HEADERS = new Set(['authorization', 'cookie', 'set-cookie', 'x-api-key']);\n\nfunction sanitizeHeaders(\n  headers: Record<string, string | string[] | undefined> | undefined,\n  redactSet: Set<string>\n): Record<string, unknown> {\n  if (!headers) return {};\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(headers)) {\n    if (k === '__proto__' || k === 'constructor' || k === 'prototype') continue;\n    out[k] = redactSet.has(k.toLowerCase()) ? '[REDACTED]' : v;\n  }\n  return out;\n}\n\nfunction shortId(): string {\n  // eslint-disable-next-line sonarjs/pseudo-random -- non-security request ID\n  return Math.random().toString(36).slice(2, 10);\n}\n\nfunction buildBaseFields(\n  req: IncomingRequest,\n  traceId: string,\n  options: HttpLoggerOptions\n): Record<string, unknown> {\n  const redactSet = options.redactHeaders\n    ? new Set(options.redactHeaders.map((h) => h.toLowerCase()))\n    : DEFAULT_REDACT_HEADERS;\n\n  const fields: Record<string, unknown> = {\n    traceId,\n    method: req.method?.toUpperCase() ?? 'UNKNOWN',\n    url: req.url ?? '/',\n    ip: req.ip ?? req.socket?.remoteAddress ?? 'unknown',\n    headers: sanitizeHeaders(req.headers, redactSet),\n  };\n\n  if (options.extraFields) {\n    Object.assign(fields, options.extraFields(req));\n  }\n\n  return fields;\n}\n\n// ── Express middleware ────────────────────────────────────────────────────────\n\n/**\n * Create an Express / Connect compatible middleware that replaces Morgan.\n */\nexport function createExpressMiddleware(\n  logger: IBaseLogger,\n  options: HttpLoggerOptions = {}\n): (req: IncomingRequest, res: OutgoingResponse, next: () => void) => void {\n  const {\n    skip,\n    logBody,\n    bodyMaxBytes,\n    traceIdHeader = 'x-trace-id',\n    requestLevel = 'debug',\n    responseLevel = 'info',\n    errorLevel = 'error',\n    slowRequestThresholdMs = 1000,\n  } = options;\n\n  return function logixiaHttpMiddleware(\n    req: IncomingRequest,\n    res: OutgoingResponse,\n    next: () => void\n  ): void {\n    if (skip?.(req)) {\n      next();\n      return;\n    }\n\n    const traceId = (req.headers?.[traceIdHeader] as string | undefined) ?? shortId();\n    const startMs = Date.now();\n    const baseFields = buildBaseFields(req, traceId, options);\n\n    // Log request start\n    if (requestLevel !== 'silent') {\n      void logger.logLevel(requestLevel, 'request started', {\n        ...baseFields,\n        ...(logBody && req.body ? { body: truncateBody(req.body, bodyMaxBytes) } : {}),\n      });\n    }\n\n    // Hook into the response 'finish' event — fires after headers + body are sent.\n    // This is what Morgan gets wrong for slow requests (it uses 'close' which may\n    // fire before the status code is set on some Node versions).\n    //\n    // BOTH 'finish' and 'close' fire on a normal response, so guard against\n    // logging the completion twice (which would duplicate the completed entry and\n    // the slow-request warning).\n    let completed = false;\n    const onFinish = (): void => {\n      if (completed) return;\n      completed = true;\n\n      const duration = Date.now() - startMs;\n      const status = res.statusCode ?? 0;\n      const level = status >= 500 ? errorLevel : responseLevel;\n\n      void logger.logLevel(level, 'request completed', {\n        ...baseFields,\n        statusCode: status,\n        duration,\n      });\n\n      if (duration > slowRequestThresholdMs) {\n        void logger.warn('slow request detected', {\n          ...baseFields,\n          statusCode: status,\n          duration,\n          threshold: slowRequestThresholdMs,\n        });\n      }\n    };\n\n    res.once?.('finish', onFinish);\n    // Fallback: also covers a client that disconnects before 'finish' fires. The\n    // `completed` guard ensures a normal finish+close pair logs only once.\n    res.once?.('close', onFinish);\n\n    next();\n  };\n}\n\n// ── Fastify plugin ─────────────────────────────────────────────────────────────\n\nexport interface FastifyInstance {\n  addHook: (name: string, fn: (req: unknown, reply: unknown, done: () => void) => void) => void;\n}\n\n/**\n * Create a Fastify plugin (a function you pass to `fastify.register()`).\n *\n * @example\n * ```ts\n * await fastify.register(createFastifyPlugin(logger, { slowRequestThresholdMs: 500 }));\n * ```\n */\nexport function createFastifyPlugin(logger: IBaseLogger, options: HttpLoggerOptions = {}) {\n  const {\n    skip,\n    traceIdHeader = 'x-trace-id',\n    requestLevel = 'debug',\n    responseLevel = 'info',\n    errorLevel = 'error',\n    slowRequestThresholdMs = 1000,\n  } = options;\n\n  return function logixiaFastifyPlugin(\n    fastify: FastifyInstance,\n    _opts: unknown,\n    done: () => void\n  ): void {\n    fastify.addHook('onRequest', (request: unknown, _reply: unknown, hookDone: () => void) => {\n      const req = request as IncomingRequest & { _logixiaStart?: number; _logixiaId?: string };\n      if (skip?.(req)) {\n        hookDone();\n        return;\n      }\n\n      const traceId = (req.headers?.[traceIdHeader] as string | undefined) ?? shortId();\n      req._logixiaStart = Date.now();\n      req._logixiaId = traceId;\n\n      if (requestLevel !== 'silent') {\n        void logger.logLevel(\n          requestLevel,\n          'request started',\n          buildBaseFields(req, traceId, options)\n        );\n      }\n      hookDone();\n    });\n\n    fastify.addHook('onResponse', (request: unknown, reply: unknown, hookDone: () => void) => {\n      const req = request as IncomingRequest & { _logixiaStart?: number; _logixiaId?: string };\n      const rep = reply as { statusCode?: number };\n      const duration = Date.now() - (req._logixiaStart ?? Date.now());\n      const status = rep.statusCode ?? 0;\n      const traceId = req._logixiaId ?? shortId();\n      const level = status >= 500 ? errorLevel : responseLevel;\n\n      void logger.logLevel(level, 'request completed', {\n        ...buildBaseFields(req, traceId, options),\n        statusCode: status,\n        duration,\n      });\n\n      if (duration > slowRequestThresholdMs) {\n        void logger.warn('slow request detected', {\n          traceId,\n          url: req.url,\n          method: req.method,\n          duration,\n          threshold: slowRequestThresholdMs,\n        });\n      }\n\n      hookDone();\n    });\n\n    done();\n  };\n}\n\n// ── Internal helpers ──────────────────────────────────────────────────────────\n\nfunction truncateBody(body: unknown, maxBytes = 4096): unknown {\n  if (typeof body === 'string') {\n    return body.length > maxBytes ? body.slice(0, maxBytes) + '…[truncated]' : body;\n  }\n  if (body && typeof body === 'object') {\n    const str = JSON.stringify(body);\n    if (str.length > maxBytes) {\n      return str.slice(0, maxBytes) + '…[truncated]';\n    }\n  }\n  return body;\n}\n"],"mappings":";AA6FA,MAAM,yBAAyB,IAAI,IAAI;CAAC;CAAiB;CAAU;CAAc;CAAY,CAAC;AAE9F,SAAS,gBACP,SACA,WACyB;AACzB,KAAI,CAAC,QAAS,QAAO,EAAE;CACvB,MAAMA,MAA+B,EAAE;AACvC,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,QAAQ,EAAE;AAC5C,MAAI,MAAM,eAAe,MAAM,iBAAiB,MAAM,YAAa;AACnE,MAAI,KAAK,UAAU,IAAI,EAAE,aAAa,CAAC,GAAG,eAAe;;AAE3D,QAAO;;AAGT,SAAS,UAAkB;AAEzB,QAAO,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,GAAG,GAAG;;AAGhD,SAAS,gBACP,KACA,SACA,SACyB;;CACzB,MAAM,YAAY,QAAQ,gBACtB,IAAI,IAAI,QAAQ,cAAc,KAAK,MAAM,EAAE,aAAa,CAAC,CAAC,GAC1D;CAEJ,MAAMC,SAAkC;EACtC;EACA,wBAAQ,IAAI,kEAAQ,aAAa,KAAI;EACrC,KAAK,IAAI,OAAO;EAChB,IAAI,IAAI,sBAAM,IAAI,kEAAQ,kBAAiB;EAC3C,SAAS,gBAAgB,IAAI,SAAS,UAAU;EACjD;AAED,KAAI,QAAQ,YACV,QAAO,OAAO,QAAQ,QAAQ,YAAY,IAAI,CAAC;AAGjD,QAAO;;;;;AAQT,SAAgB,wBACd,QACA,UAA6B,EAAE,EAC0C;CACzE,MAAM,EACJ,MACA,SACA,cACA,gBAAgB,cAChB,eAAe,SACf,gBAAgB,QAChB,aAAa,SACb,yBAAyB,QACvB;AAEJ,QAAO,SAAS,sBACd,KACA,KACA,MACM;;AACN,kDAAI,KAAO,IAAI,EAAE;AACf,SAAM;AACN;;EAGF,MAAM,2BAAW,IAAI,qEAAU,mBAAyC,SAAS;EACjF,MAAM,UAAU,KAAK,KAAK;EAC1B,MAAM,aAAa,gBAAgB,KAAK,SAAS,QAAQ;AAGzD,MAAI,iBAAiB,SACnB,CAAK,OAAO,SAAS,cAAc,mBAAmB;GACpD,GAAG;GACH,GAAI,WAAW,IAAI,OAAO,EAAE,MAAM,aAAa,IAAI,MAAM,aAAa,EAAE,GAAG,EAAE;GAC9E,CAAC;EAUJ,IAAI,YAAY;EAChB,MAAM,iBAAuB;AAC3B,OAAI,UAAW;AACf,eAAY;GAEZ,MAAM,WAAW,KAAK,KAAK,GAAG;GAC9B,MAAM,SAAS,IAAI,cAAc;GACjC,MAAM,QAAQ,UAAU,MAAM,aAAa;AAE3C,GAAK,OAAO,SAAS,OAAO,qBAAqB;IAC/C,GAAG;IACH,YAAY;IACZ;IACD,CAAC;AAEF,OAAI,WAAW,uBACb,CAAK,OAAO,KAAK,yBAAyB;IACxC,GAAG;IACH,YAAY;IACZ;IACA,WAAW;IACZ,CAAC;;AAIN,mBAAI,8DAAO,UAAU,SAAS;AAG9B,oBAAI,gEAAO,SAAS,SAAS;AAE7B,QAAM;;;;;;;;;;;AAkBV,SAAgB,oBAAoB,QAAqB,UAA6B,EAAE,EAAE;CACxF,MAAM,EACJ,MACA,gBAAgB,cAChB,eAAe,SACf,gBAAgB,QAChB,aAAa,SACb,yBAAyB,QACvB;AAEJ,QAAO,SAAS,qBACd,SACA,OACA,MACM;AACN,UAAQ,QAAQ,cAAc,SAAkB,QAAiB,aAAyB;;GACxF,MAAM,MAAM;AACZ,mDAAI,KAAO,IAAI,EAAE;AACf,cAAU;AACV;;GAGF,MAAM,4BAAW,IAAI,uEAAU,mBAAyC,SAAS;AACjF,OAAI,gBAAgB,KAAK,KAAK;AAC9B,OAAI,aAAa;AAEjB,OAAI,iBAAiB,SACnB,CAAK,OAAO,SACV,cACA,mBACA,gBAAgB,KAAK,SAAS,QAAQ,CACvC;AAEH,aAAU;IACV;AAEF,UAAQ,QAAQ,eAAe,SAAkB,OAAgB,aAAyB;GACxF,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,MAAM,WAAW,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK;GAC9D,MAAM,SAAS,IAAI,cAAc;GACjC,MAAM,UAAU,IAAI,cAAc,SAAS;GAC3C,MAAM,QAAQ,UAAU,MAAM,aAAa;AAE3C,GAAK,OAAO,SAAS,OAAO,qBAAqB;IAC/C,GAAG,gBAAgB,KAAK,SAAS,QAAQ;IACzC,YAAY;IACZ;IACD,CAAC;AAEF,OAAI,WAAW,uBACb,CAAK,OAAO,KAAK,yBAAyB;IACxC;IACA,KAAK,IAAI;IACT,QAAQ,IAAI;IACZ;IACA,WAAW;IACZ,CAAC;AAGJ,aAAU;IACV;AAEF,QAAM;;;AAMV,SAAS,aAAa,MAAe,WAAW,MAAe;AAC7D,KAAI,OAAO,SAAS,SAClB,QAAO,KAAK,SAAS,WAAW,KAAK,MAAM,GAAG,SAAS,GAAG,iBAAiB;AAE7E,KAAI,QAAQ,OAAO,SAAS,UAAU;EACpC,MAAM,MAAM,KAAK,UAAU,KAAK;AAChC,MAAI,IAAI,SAAS,SACf,QAAO,IAAI,MAAM,GAAG,SAAS,GAAG;;AAGpC,QAAO"}

package/dist/nest.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"nest.d.mts","names":[],"sources":["../src/core/trace.middleware.ts"],"sourcesContent":[],"mappings":";;;;;;;QA6DyC,MAAA,CAAA;EAxBD,UAAA,OAAA,CAAA;IAAc,UAAA,OAAA,CAAA;;;;;cAAzC,eAAA,YAA2B;;;uBAGY;WAqBzC,cAAc,gBAAgB"}
+{"version":3,"file":"nest.d.mts","names":[],"sources":["../src/core/trace.middleware.ts"],"sourcesContent":[],"mappings":";;;;;;;QAkFyC,MAAA,CAAA;EAxBD,UAAA,OAAA,CAAA;IAAc,UAAA,OAAA,CAAA;;;;;cAAzC,eAAA,YAA2B;;;uBAGY;WAqBzC,cAAc,gBAAgB"}

package/dist/nest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nest.d.ts","names":[],"sources":["../src/core/trace.middleware.ts"],"sourcesContent":[],"mappings":";;;;;;;QA6DyC,MAAA,CAAA;EAxBD,UAAA,OAAA,CAAA;IAAc,UAAA,OAAA,CAAA;;;;;cAAzC,eAAA,YAA2B;;;uBAGY;WAqBzC,cAAc,gBAAgB"}
+{"version":3,"file":"nest.d.ts","names":[],"sources":["../src/core/trace.middleware.ts"],"sourcesContent":[],"mappings":";;;;;;;QAkFyC,MAAA,CAAA;EAxBD,UAAA,OAAA,CAAA;IAAc,UAAA,OAAA,CAAA;;;;;cAAzC,eAAA,YAA2B;;;uBAGY;WAqBzC,cAAc,gBAAgB"}

package/dist/nest.js

@@ -1,5 +1,5 @@
-require('./transport.manager-zgEZCJhR.js');
-const require_logitron_logger_module = require('./logitron-logger.module-bJ1hGhaL.js');
+require('./transport.manager-B9LF9uDd.js');
+const require_logitron_logger_module = require('./logitron-logger.module-Dlf5GwJ9.js');
 
 Object.defineProperty(exports, 'KafkaTraceInterceptor', {
   enumerable: true,

package/dist/nest.mjs

@@ -1,4 +1,4 @@
-import "./transport.manager-CaL4XuLD.mjs";
-import { a as TraceMiddleware, c as KafkaTraceInterceptor, i as WebSocketTraceInterceptor, l as LogixiaLoggerService, n as LOGIXIA_LOGGER_PREFIX, r as LogixiaLoggerModule, t as LOGIXIA_LOGGER_CONFIG } from "./logitron-logger.module-Bt_Jei1V.mjs";
+import "./transport.manager-Cij_sA-b.mjs";
+import { a as TraceMiddleware, c as KafkaTraceInterceptor, i as WebSocketTraceInterceptor, l as LogixiaLoggerService, n as LOGIXIA_LOGGER_PREFIX, r as LogixiaLoggerModule, t as LOGIXIA_LOGGER_CONFIG } from "./logitron-logger.module-BBC9nO5q.mjs";
 
 export { KafkaTraceInterceptor, LOGIXIA_LOGGER_CONFIG, LOGIXIA_LOGGER_PREFIX, LogixiaLoggerModule, LogixiaLoggerService, TraceMiddleware, WebSocketTraceInterceptor };

package/dist/{transport.manager-zgEZCJhR.js → transport.manager-B9LF9uDd.js}

@@ -29,8 +29,12 @@ let node_fs = require("node:fs");
 node_fs = __toESM(node_fs);
 let node_path = require("node:path");
 node_path = __toESM(node_path);
+let node_stream_promises = require("node:stream/promises");
+node_stream_promises = __toESM(node_stream_promises);
 let node_util = require("node:util");
 node_util = __toESM(node_util);
+let node_zlib = require("node:zlib");
+node_zlib = __toESM(node_zlib);
 
 //#region src/utils/internal-log.ts
 /**
@@ -44,28 +48,36 @@ node_util = __toESM(node_util);
 * helpers instead so that internal output can be silenced in tests by setting
 * the LOGIXIA_SILENT_INTERNAL=1 environment variable.
 */
-const silent = process.env.LOGIXIA_SILENT_INTERNAL === "1";
+/**
+* Read the silence flag on each call rather than caching it at import time, so
+* setting LOGIXIA_SILENT_INTERNAL=1 AFTER the module is first imported (e.g. in
+* a test setup file) still takes effect — the documented test-silencing
+* behavior was previously unreliable because the value was frozen at load.
+*/
+function isSilent() {
+	return process.env.LOGIXIA_SILENT_INTERNAL === "1";
+}
 /**
 * Emit an internal debug/info message to stderr.
 * Use for field-enable/disable notifications that a developer might want to see
 * during development but should not appear in production log streams.
 */
 function internalLog(message) {
-	if (!silent) process.stderr.write(`[logixia] ${message}\n`);
+	if (!isSilent()) process.stderr.write(`[logixia] ${message}\n`);
 }
 /**
 * Emit an internal warning to stderr.
 * Use when something is misconfigured but logixia can continue operating.
 */
 function internalWarn(message) {
-	if (!silent) process.stderr.write(`[logixia:warn] ${message}\n`);
+	if (!isSilent()) process.stderr.write(`[logixia:warn] ${message}\n`);
 }
 /**
 * Emit an internal error to stderr.
 * Use when a transport write fails or a serious internal error occurs.
 */
 function internalError(message, error) {
-	if (!silent) {
+	if (!isSilent()) {
 		let errStr = "";
 		if (error instanceof Error) errStr = ` — ${error.message}`;
 		else if (error != null) errStr = ` — ${String(error)}`;
@@ -95,6 +107,7 @@ function internalError(message, error) {
 *   `String(value)` for circular refs / values without a stringifier.
 */
 function safeToString(value) {
+	var _constructor;
 	if (typeof value === "string") return value;
 	if (value === void 0 || value === null) return "";
 	if (value instanceof Error) return value.message;
@@ -102,11 +115,10 @@ function safeToString(value) {
 	if (typeof value === "symbol") return value.toString();
 	if (typeof value === "function") return `[Function: ${value.name || "anonymous"}]`;
 	try {
-		return JSON.stringify(value);
-	} catch {
-		var _constructor;
-		return `[${((_constructor = value.constructor) === null || _constructor === void 0 ? void 0 : _constructor.name) ?? "object"}]`;
-	}
+		const json = JSON.stringify(value);
+		if (json !== void 0) return json;
+	} catch {}
+	return `[${((_constructor = value.constructor) === null || _constructor === void 0 ? void 0 : _constructor.name) ?? "object"}]`;
 }
 
 //#endregion
@@ -239,7 +251,6 @@ var DatabaseTransport = class {
 		this.config = config;
 		this.name = "database";
 		this.batch = [];
-		this.isFlushing = false;
 		this.isConnected = false;
 		this.batchSize = config.batchSize || 100;
 		this.flushInterval = config.flushInterval || 5e3;
@@ -256,33 +267,44 @@ var DatabaseTransport = class {
 		this.batch.push(entry);
 	}
 	async flush() {
-		if (this.batch.length === 0) return;
-		if (this.isFlushing) return;
-		this.isFlushing = true;
-		const entriesToFlush = [...this.batch];
-		this.batch = [];
-		try {
-			switch (this.config.type) {
-				case "mongodb":
-					await this.flushToMongoDB(entriesToFlush);
-					break;
-				case "postgresql":
-					await this.flushToPostgreSQL(entriesToFlush);
-					break;
-				case "mysql":
-					await this.flushToMySQL(entriesToFlush);
-					break;
-				case "sqlite":
-					await this.flushToSQLite(entriesToFlush);
-					break;
-				default: throw new Error(`Unsupported database type: ${this.config.type}`);
+		if (!this.flushPromise) this.flushPromise = this.drain().finally(() => {
+			this.flushPromise = void 0;
+		});
+		await this.flushPromise;
+	}
+	/**
+	* Drains the batch to the database one snapshot at a time. The current batch
+	* is detached SYNCHRONOUSLY before awaiting the write, so entries appended by
+	* concurrent write() calls land in a fresh array and are never written twice.
+	* On write failure the snapshot is restored to the front of the batch for the
+	* next flush cycle and the loop stops, so a persistently failing DB does not
+	* hot-spin retrying the same entries.
+	*/
+	async drain() {
+		while (this.batch.length > 0) {
+			const entriesToFlush = this.batch;
+			this.batch = [];
+			try {
+				switch (this.config.type) {
+					case "mongodb":
+						await this.flushToMongoDB(entriesToFlush);
+						break;
+					case "postgresql":
+						await this.flushToPostgreSQL(entriesToFlush);
+						break;
+					case "mysql":
+						await this.flushToMySQL(entriesToFlush);
+						break;
+					case "sqlite":
+						await this.flushToSQLite(entriesToFlush);
+						break;
+					default: throw new Error(`Unsupported database type: ${this.config.type}`);
+				}
+			} catch (error) {
+				internalError("Database flush error", error);
+				this.batch.unshift(...entriesToFlush);
+				throw error;
 			}
-		} catch (error) {
-			internalError("Database flush error", error);
-			this.batch.unshift(...entriesToFlush);
-			throw error;
-		} finally {
-			this.isFlushing = false;
 		}
 	}
 	async isReady() {
@@ -295,7 +317,10 @@ var DatabaseTransport = class {
 	}
 	async connect() {
 		if (this.connectionPromise) return this.connectionPromise;
-		this.connectionPromise = this.establishConnection();
+		this.connectionPromise = this.establishConnection().catch((error) => {
+			this.connectionPromise = void 0;
+			throw error;
+		});
 		return this.connectionPromise;
 	}
 	async establishConnection() {
@@ -526,8 +551,17 @@ var DatabaseTransport = class {
 		}, this.flushInterval);
 	}
 	async close() {
-		if (this.flushTimer) clearInterval(this.flushTimer);
-		await this.flush();
+		if (this.flushTimer) {
+			clearInterval(this.flushTimer);
+			this.flushTimer = void 0;
+		}
+		const MAX_CLOSE_FLUSH_ATTEMPTS = 3;
+		for (let attempt = 0; attempt < MAX_CLOSE_FLUSH_ATTEMPTS && this.batch.length > 0; attempt += 1) try {
+			await this.flush();
+		} catch (error) {
+			internalError("Database flush during close failed; entries remain buffered", error);
+		}
+		if (this.batch.length > 0) internalError(`Database transport closing with ${this.batch.length} unflushed log entr${this.batch.length === 1 ? "y" : "ies"} after ${MAX_CLOSE_FLUSH_ATTEMPTS} attempts`);
 		if (this.connection) switch (this.config.type) {
 			case "mongodb":
 				await this.connection.close();
@@ -563,7 +597,8 @@ var DatabaseTransport = class {
 					var _result$rows, _result$;
 					const tableName = this.config.table || "logs";
 					const result = await this.connection.query(`SELECT COUNT(*) as count FROM ${tableName}`);
-					return ((_result$rows = result.rows) === null || _result$rows === void 0 || (_result$rows = _result$rows[0]) === null || _result$rows === void 0 ? void 0 : _result$rows.count) || ((_result$ = result[0]) === null || _result$ === void 0 ? void 0 : _result$.count) || 0;
+					const rawCount = ((_result$rows = result.rows) === null || _result$rows === void 0 || (_result$rows = _result$rows[0]) === null || _result$rows === void 0 ? void 0 : _result$rows.count) ?? ((_result$ = result[0]) === null || _result$ === void 0 ? void 0 : _result$.count) ?? 0;
+					return Number(rawCount) || 0;
 				}
 				default: return 0;
 			}
@@ -606,23 +641,43 @@ var AnalyticsTransport = class {
 		}, this.config.flushInterval);
 	}
 	async flush() {
-		if (this.batch.length === 0) return;
-		const entriesToSend = [...this.batch];
-		this.batch = [];
 		if (this.batchTimer) {
 			clearTimeout(this.batchTimer);
-			delete this.batchTimer;
+			this.batchTimer = void 0;
 		}
-		try {
-			await this.sendBatch(entriesToSend);
-		} catch (error) {
-			internalError(`Analytics transport ${this.name} flush failed`, error);
-			this.batch.unshift(...entriesToSend);
+		if (!this.flushPromise) this.flushPromise = this.drain().finally(() => {
+			this.flushPromise = void 0;
+		});
+		await this.flushPromise;
+	}
+	/**
+	* Drains the batch to the provider one snapshot at a time. The batch is
+	* detached SYNCHRONOUSLY before awaiting sendBatch(), so entries appended by
+	* concurrent writes land in a fresh array and are never sent twice. On failure
+	* the snapshot is restored to the front of the batch for the next flush and
+	* the loop stops, so a failing provider does not hot-spin.
+	*/
+	async drain() {
+		while (this.batch.length > 0) {
+			const entriesToSend = this.batch;
+			this.batch = [];
+			try {
+				await this.sendBatch(entriesToSend);
+			} catch (error) {
+				internalError(`Analytics transport ${this.name} flush failed`, error);
+				this.batch.unshift(...entriesToSend);
+				return;
+			}
 		}
 	}
 	async close() {
-		await this.flush();
-		if (this.batchTimer) clearTimeout(this.batchTimer);
+		if (this.batchTimer) {
+			clearTimeout(this.batchTimer);
+			this.batchTimer = void 0;
+		}
+		const MAX_CLOSE_FLUSH_ATTEMPTS = 3;
+		for (let attempt = 0; attempt < MAX_CLOSE_FLUSH_ATTEMPTS && this.batch.length > 0; attempt += 1) await this.flush();
+		if (this.batch.length > 0) internalError(`Analytics transport ${this.name} closing with ${this.batch.length} unflushed entr${this.batch.length === 1 ? "y" : "ies"} after ${MAX_CLOSE_FLUSH_ATTEMPTS} attempts`);
 		await this.cleanup();
 	}
 	shouldSkipEntry(entry) {
@@ -1048,15 +1103,34 @@ var FileTransport = class {
 			await mkdir(dir, { recursive: true });
 		} catch {}
 	}
-	async compressFile(_filePath) {}
+	/**
+	* Gzip the rotated file to `<file>.gz` and remove the original. Streams the
+	* data so large log files don't have to be buffered in memory. Best-effort:
+	* any failure is logged and leaves the original file intact rather than
+	* throwing out of the rotation path.
+	*/
+	async compressFile(filePath) {
+		const gzPath = `${filePath}.gz`;
+		try {
+			await (0, node_stream_promises.pipeline)(node_fs.createReadStream(filePath), (0, node_zlib.createGzip)(), node_fs.createWriteStream(gzPath));
+			await unlink(filePath);
+		} catch (error) {
+			internalError("Failed to compress rotated log file", error);
+			try {
+				await unlink(gzPath);
+			} catch {}
+		}
+	}
 	async cleanupOldFiles() {
 		var _this$config$rotation4;
 		if (!((_this$config$rotation4 = this.config.rotation) === null || _this$config$rotation4 === void 0 ? void 0 : _this$config$rotation4.maxFiles)) return;
 		try {
 			const dir = this.resolveDir();
 			const files = await readdir(dir);
-			const base = node_path.basename(this.config.filename, node_path.extname(this.config.filename));
-			const logFiles = files.filter((file) => file.startsWith(base)).map(async (file) => {
+			const ext = node_path.extname(this.config.filename);
+			const base = node_path.basename(this.config.filename, ext);
+			const isOwnRotatedFile = (file) => file.startsWith(`${base}-`) && (file.endsWith(ext) || file.endsWith(`${ext}.gz`));
+			const logFiles = files.filter(isOwnRotatedFile).map(async (file) => {
 				const filePath = node_path.join(dir, file);
 				return {
 					path: filePath,
@@ -1857,7 +1931,7 @@ var TransportManager = class extends node_events.EventEmitter {
 			const writeTime = Date.now() - startTime;
 			metrics.logsWritten++;
 			metrics.lastWrite = new Date(startTime);
-			metrics.averageWriteTime = (metrics.averageWriteTime + writeTime) / 2;
+			metrics.averageWriteTime += (writeTime - metrics.averageWriteTime) / metrics.logsWritten;
 			this.emit("log", entry);
 		} catch (error) {
 			metrics.errors++;
@@ -2168,4 +2242,4 @@ Object.defineProperty(exports, 'safeToString', {
     return safeToString;
   }
 });
-//# sourceMappingURL=transport.manager-zgEZCJhR.js.map
+//# sourceMappingURL=transport.manager-B9LF9uDd.js.map