logixia 1.12.4 → 1.12.6

package/dist/async-context-CSHWoHMB.js

@@ -0,0 +1,88 @@
+const require_chunk = require('./chunk-nOFOJqeH.js');
+let node_crypto = require("node:crypto");
+node_crypto = require_chunk.__toESM(node_crypto);
+let node_async_hooks = require("node:async_hooks");
+node_async_hooks = require_chunk.__toESM(node_async_hooks);
+
+//#region src/context/async-context.ts
+/** Generates an 8-character random ID using Node's crypto module. */
+function randomShortId() {
+	return (0, node_crypto.randomUUID)().slice(0, 8);
+}
+const _storage = new node_async_hooks.AsyncLocalStorage();
+const LogixiaContext = {
+	run(store, callback) {
+		const parent = _storage.getStore() ?? {};
+		return _storage.run({
+			...parent,
+			...store
+		}, callback);
+	},
+	get() {
+		return _storage.getStore();
+	},
+	set(fields) {
+		const store = _storage.getStore();
+		if (!store) return;
+		Object.assign(store, fields);
+	},
+	getStorage() {
+		return _storage;
+	}
+};
+/**
+* Create an Express/Connect-compatible middleware that wraps each request in
+* a `LogixiaContext.run()` scope populated with common request fields.
+*
+* @example
+* ```ts
+* import { createExpressContextMiddleware } from 'logixia';
+* app.use(createExpressContextMiddleware());
+* ```
+*/
+function createExpressContextMiddleware(options = {}) {
+	const { enrich, traceIdHeader = "x-trace-id" } = options;
+	return function logixiaContextMiddleware(req, _res, next) {
+		const base = { traceId: (req["headers"] ?? {})[traceIdHeader] ?? randomShortId() };
+		LogixiaContext.run({
+			...base,
+			...enrich ? enrich(req) : {}
+		}, next);
+	};
+}
+/**
+* Create a Fastify lifecycle hook that wraps each request in a context scope.
+*
+* Register with `fastify.addHook('onRequest', createFastifyContextHook())`.
+*/
+function createFastifyContextHook(options = {}) {
+	const { enrich, traceIdHeader = "x-trace-id" } = options;
+	return function logixiaFastifyHook(request, _reply, done) {
+		const base = { traceId: (request["headers"] ?? {})[traceIdHeader] ?? request["id"] ?? randomShortId() };
+		LogixiaContext.run({
+			...base,
+			...enrich ? enrich(request) : {}
+		}, done);
+	};
+}
+
+//#endregion
+Object.defineProperty(exports, 'LogixiaContext', {
+  enumerable: true,
+  get: function () {
+    return LogixiaContext;
+  }
+});
+Object.defineProperty(exports, 'createExpressContextMiddleware', {
+  enumerable: true,
+  get: function () {
+    return createExpressContextMiddleware;
+  }
+});
+Object.defineProperty(exports, 'createFastifyContextHook', {
+  enumerable: true,
+  get: function () {
+    return createFastifyContextHook;
+  }
+});
+//# sourceMappingURL=async-context-CSHWoHMB.js.map

package/dist/async-context-CSHWoHMB.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"async-context-CSHWoHMB.js","names":["AsyncLocalStorage","base: LogContext"],"sources":["../src/context/async-context.ts"],"sourcesContent":["/**\n * LogixiaContext — Zero-boilerplate AsyncLocalStorage context propagation.\n *\n * Lets every `logger.info()` call inside a context automatically pick up stored\n * fields (requestId, userId, tenantId, …) without passing them through every function.\n *\n * Works across `Promise.all`, `setTimeout`, and event emitters — anything that\n * inherits the async execution context.\n *\n * @example\n * ```ts\n * import { LogixiaContext } from 'logixia';\n *\n * // Wrap a request handler:\n * app.use((req, res, next) => {\n *   LogixiaContext.run({ requestId: req.id, userId: req.user?.id }, next);\n * });\n *\n * // Anywhere deeper in the call tree:\n * async function processOrder(orderId: string) {\n *   const ctx = LogixiaContext.get();  // { requestId, userId, orderId }\n *   logger.info('Processing order', { orderId, ...ctx });\n * }\n * ```\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { randomUUID } from 'node:crypto';\n\n/** Generates an 8-character random ID using Node's crypto module. */\nfunction randomShortId(): string {\n  return randomUUID().slice(0, 8);\n}\n\nexport interface LogContext {\n  traceId?: string;\n  spanId?: string;\n  userId?: string;\n  tenantId?: string;\n  sessionId?: string;\n  [key: string]: unknown;\n}\n\n// Module-level singleton so all loggers share the same ALS store.\nconst _storage = new AsyncLocalStorage<LogContext>();\n\nexport const LogixiaContext = {\n  /**\n   * Run `callback` inside an async context that carries `store` fields.\n   * All loggers queried within `callback` (and its async descendants) will\n   * automatically see these fields.\n   *\n   * @example\n   * ```ts\n   * LogixiaContext.run({ requestId: 'abc', userId: '42' }, async () => {\n   *   await processOrder();   // sees requestId + userId in every log\n   * });\n   * ```\n   */\n  run<T>(store: LogContext, callback: () => T): T {\n    const parent = _storage.getStore() ?? {};\n    return _storage.run({ ...parent, ...store }, callback);\n  },\n\n  /**\n   * Return the context fields active in the current async scope.\n   * Returns `undefined` when called outside any `LogixiaContext.run()`.\n   */\n  get(): LogContext | undefined {\n    return _storage.getStore();\n  },\n\n  /**\n   * Merge `fields` into the **existing** context for the current scope.\n   * If called outside a `run()` context this is a no-op (logs a dev warning).\n   */\n  set(fields: Partial<LogContext>): void {\n    const store = _storage.getStore();\n    if (!store) {\n      // Silently ignore — avoids crashing in code that may call setContext\n      // before a request context is established (e.g. background jobs).\n      return;\n    }\n    Object.assign(store, fields);\n  },\n\n  /**\n   * Retrieve the underlying `AsyncLocalStorage` instance.\n   * Useful for advanced use-cases like custom middleware.\n   */\n  getStorage(): AsyncLocalStorage<LogContext> {\n    return _storage;\n  },\n};\n\n/**\n * Create an Express/Connect-compatible middleware that wraps each request in\n * a `LogixiaContext.run()` scope populated with common request fields.\n *\n * @example\n * ```ts\n * import { createExpressContextMiddleware } from 'logixia';\n * app.use(createExpressContextMiddleware());\n * ```\n */\nexport function createExpressContextMiddleware(\n  options: {\n    /** Extract additional fields from the request. */\n    enrich?: (req: Record<string, unknown>) => Partial<LogContext>;\n    /** Header to read the traceId from. Default: 'x-trace-id'. */\n    traceIdHeader?: string;\n  } = {}\n) {\n  const { enrich, traceIdHeader = 'x-trace-id' } = options;\n\n  return function logixiaContextMiddleware(\n    req: Record<string, unknown>,\n    _res: unknown,\n    next: () => void\n  ): void {\n    const headers = (req['headers'] ?? {}) as Record<string, string | undefined>;\n    const traceId = headers[traceIdHeader] ?? randomShortId();\n    const base: LogContext = { traceId };\n    LogixiaContext.run({ ...base, ...(enrich ? enrich(req) : {}) }, next);\n  };\n}\n\n/**\n * Create a Fastify lifecycle hook that wraps each request in a context scope.\n *\n * Register with `fastify.addHook('onRequest', createFastifyContextHook())`.\n */\nexport function createFastifyContextHook(\n  options: {\n    enrich?: (request: Record<string, unknown>) => Partial<LogContext>;\n    traceIdHeader?: string;\n  } = {}\n) {\n  const { enrich, traceIdHeader = 'x-trace-id' } = options;\n\n  return function logixiaFastifyHook(\n    request: Record<string, unknown>,\n    _reply: unknown,\n    done: () => void\n  ): void {\n    const headers = (request['headers'] ?? {}) as Record<string, string | undefined>;\n    const traceId =\n      headers[traceIdHeader] ?? (request['id'] as string | undefined) ?? randomShortId();\n    const base: LogContext = { traceId };\n    LogixiaContext.run({ ...base, ...(enrich ? enrich(request) : {}) }, done);\n  };\n}\n"],"mappings":";;;;;;;;AA8BA,SAAS,gBAAwB;AAC/B,qCAAmB,CAAC,MAAM,GAAG,EAAE;;AAajC,MAAM,WAAW,IAAIA,oCAA+B;AAEpD,MAAa,iBAAiB;CAa5B,IAAO,OAAmB,UAAsB;EAC9C,MAAM,SAAS,SAAS,UAAU,IAAI,EAAE;AACxC,SAAO,SAAS,IAAI;GAAE,GAAG;GAAQ,GAAG;GAAO,EAAE,SAAS;;CAOxD,MAA8B;AAC5B,SAAO,SAAS,UAAU;;CAO5B,IAAI,QAAmC;EACrC,MAAM,QAAQ,SAAS,UAAU;AACjC,MAAI,CAAC,MAGH;AAEF,SAAO,OAAO,OAAO,OAAO;;CAO9B,aAA4C;AAC1C,SAAO;;CAEV;;;;;;;;;;;AAYD,SAAgB,+BACd,UAKI,EAAE,EACN;CACA,MAAM,EAAE,QAAQ,gBAAgB,iBAAiB;AAEjD,QAAO,SAAS,yBACd,KACA,MACA,MACM;EAGN,MAAMC,OAAmB,EAAE,UAFV,IAAI,cAAc,EAAE,EACb,kBAAkB,eAAe,EACrB;AACpC,iBAAe,IAAI;GAAE,GAAG;GAAM,GAAI,SAAS,OAAO,IAAI,GAAG,EAAE;GAAG,EAAE,KAAK;;;;;;;;AASzE,SAAgB,yBACd,UAGI,EAAE,EACN;CACA,MAAM,EAAE,QAAQ,gBAAgB,iBAAiB;AAEjD,QAAO,SAAS,mBACd,SACA,QACA,MACM;EAIN,MAAMA,OAAmB,EAAE,UAHV,QAAQ,cAAc,EAAE,EAE/B,kBAAmB,QAAQ,SAAgC,eAAe,EAChD;AACpC,iBAAe,IAAI;GAAE,GAAG;GAAM,GAAI,SAAS,OAAO,QAAQ,GAAG,EAAE;GAAG,EAAE,KAAK"}

package/dist/async-context-CwBNMm2E.mjs

@@ -0,0 +1,68 @@
+import { randomUUID } from "node:crypto";
+import { AsyncLocalStorage } from "node:async_hooks";
+
+//#region src/context/async-context.ts
+/** Generates an 8-character random ID using Node's crypto module. */
+function randomShortId() {
+	return randomUUID().slice(0, 8);
+}
+const _storage = new AsyncLocalStorage();
+const LogixiaContext = {
+	run(store, callback) {
+		const parent = _storage.getStore() ?? {};
+		return _storage.run({
+			...parent,
+			...store
+		}, callback);
+	},
+	get() {
+		return _storage.getStore();
+	},
+	set(fields) {
+		const store = _storage.getStore();
+		if (!store) return;
+		Object.assign(store, fields);
+	},
+	getStorage() {
+		return _storage;
+	}
+};
+/**
+* Create an Express/Connect-compatible middleware that wraps each request in
+* a `LogixiaContext.run()` scope populated with common request fields.
+*
+* @example
+* ```ts
+* import { createExpressContextMiddleware } from 'logixia';
+* app.use(createExpressContextMiddleware());
+* ```
+*/
+function createExpressContextMiddleware(options = {}) {
+	const { enrich, traceIdHeader = "x-trace-id" } = options;
+	return function logixiaContextMiddleware(req, _res, next) {
+		const base = { traceId: (req["headers"] ?? {})[traceIdHeader] ?? randomShortId() };
+		LogixiaContext.run({
+			...base,
+			...enrich ? enrich(req) : {}
+		}, next);
+	};
+}
+/**
+* Create a Fastify lifecycle hook that wraps each request in a context scope.
+*
+* Register with `fastify.addHook('onRequest', createFastifyContextHook())`.
+*/
+function createFastifyContextHook(options = {}) {
+	const { enrich, traceIdHeader = "x-trace-id" } = options;
+	return function logixiaFastifyHook(request, _reply, done) {
+		const base = { traceId: (request["headers"] ?? {})[traceIdHeader] ?? request["id"] ?? randomShortId() };
+		LogixiaContext.run({
+			...base,
+			...enrich ? enrich(request) : {}
+		}, done);
+	};
+}
+
+//#endregion
+export { createExpressContextMiddleware as n, createFastifyContextHook as r, LogixiaContext as t };
+//# sourceMappingURL=async-context-CwBNMm2E.mjs.map

package/dist/async-context-CwBNMm2E.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"async-context-CwBNMm2E.mjs","names":["base: LogContext"],"sources":["../src/context/async-context.ts"],"sourcesContent":["/**\n * LogixiaContext — Zero-boilerplate AsyncLocalStorage context propagation.\n *\n * Lets every `logger.info()` call inside a context automatically pick up stored\n * fields (requestId, userId, tenantId, …) without passing them through every function.\n *\n * Works across `Promise.all`, `setTimeout`, and event emitters — anything that\n * inherits the async execution context.\n *\n * @example\n * ```ts\n * import { LogixiaContext } from 'logixia';\n *\n * // Wrap a request handler:\n * app.use((req, res, next) => {\n *   LogixiaContext.run({ requestId: req.id, userId: req.user?.id }, next);\n * });\n *\n * // Anywhere deeper in the call tree:\n * async function processOrder(orderId: string) {\n *   const ctx = LogixiaContext.get();  // { requestId, userId, orderId }\n *   logger.info('Processing order', { orderId, ...ctx });\n * }\n * ```\n */\n\nimport { AsyncLocalStorage } from 'node:async_hooks';\nimport { randomUUID } from 'node:crypto';\n\n/** Generates an 8-character random ID using Node's crypto module. */\nfunction randomShortId(): string {\n  return randomUUID().slice(0, 8);\n}\n\nexport interface LogContext {\n  traceId?: string;\n  spanId?: string;\n  userId?: string;\n  tenantId?: string;\n  sessionId?: string;\n  [key: string]: unknown;\n}\n\n// Module-level singleton so all loggers share the same ALS store.\nconst _storage = new AsyncLocalStorage<LogContext>();\n\nexport const LogixiaContext = {\n  /**\n   * Run `callback` inside an async context that carries `store` fields.\n   * All loggers queried within `callback` (and its async descendants) will\n   * automatically see these fields.\n   *\n   * @example\n   * ```ts\n   * LogixiaContext.run({ requestId: 'abc', userId: '42' }, async () => {\n   *   await processOrder();   // sees requestId + userId in every log\n   * });\n   * ```\n   */\n  run<T>(store: LogContext, callback: () => T): T {\n    const parent = _storage.getStore() ?? {};\n    return _storage.run({ ...parent, ...store }, callback);\n  },\n\n  /**\n   * Return the context fields active in the current async scope.\n   * Returns `undefined` when called outside any `LogixiaContext.run()`.\n   */\n  get(): LogContext | undefined {\n    return _storage.getStore();\n  },\n\n  /**\n   * Merge `fields` into the **existing** context for the current scope.\n   * If called outside a `run()` context this is a no-op (logs a dev warning).\n   */\n  set(fields: Partial<LogContext>): void {\n    const store = _storage.getStore();\n    if (!store) {\n      // Silently ignore — avoids crashing in code that may call setContext\n      // before a request context is established (e.g. background jobs).\n      return;\n    }\n    Object.assign(store, fields);\n  },\n\n  /**\n   * Retrieve the underlying `AsyncLocalStorage` instance.\n   * Useful for advanced use-cases like custom middleware.\n   */\n  getStorage(): AsyncLocalStorage<LogContext> {\n    return _storage;\n  },\n};\n\n/**\n * Create an Express/Connect-compatible middleware that wraps each request in\n * a `LogixiaContext.run()` scope populated with common request fields.\n *\n * @example\n * ```ts\n * import { createExpressContextMiddleware } from 'logixia';\n * app.use(createExpressContextMiddleware());\n * ```\n */\nexport function createExpressContextMiddleware(\n  options: {\n    /** Extract additional fields from the request. */\n    enrich?: (req: Record<string, unknown>) => Partial<LogContext>;\n    /** Header to read the traceId from. Default: 'x-trace-id'. */\n    traceIdHeader?: string;\n  } = {}\n) {\n  const { enrich, traceIdHeader = 'x-trace-id' } = options;\n\n  return function logixiaContextMiddleware(\n    req: Record<string, unknown>,\n    _res: unknown,\n    next: () => void\n  ): void {\n    const headers = (req['headers'] ?? {}) as Record<string, string | undefined>;\n    const traceId = headers[traceIdHeader] ?? randomShortId();\n    const base: LogContext = { traceId };\n    LogixiaContext.run({ ...base, ...(enrich ? enrich(req) : {}) }, next);\n  };\n}\n\n/**\n * Create a Fastify lifecycle hook that wraps each request in a context scope.\n *\n * Register with `fastify.addHook('onRequest', createFastifyContextHook())`.\n */\nexport function createFastifyContextHook(\n  options: {\n    enrich?: (request: Record<string, unknown>) => Partial<LogContext>;\n    traceIdHeader?: string;\n  } = {}\n) {\n  const { enrich, traceIdHeader = 'x-trace-id' } = options;\n\n  return function logixiaFastifyHook(\n    request: Record<string, unknown>,\n    _reply: unknown,\n    done: () => void\n  ): void {\n    const headers = (request['headers'] ?? {}) as Record<string, string | undefined>;\n    const traceId =\n      headers[traceIdHeader] ?? (request['id'] as string | undefined) ?? randomShortId();\n    const base: LogContext = { traceId };\n    LogixiaContext.run({ ...base, ...(enrich ? enrich(request) : {}) }, done);\n  };\n}\n"],"mappings":";;;;;AA8BA,SAAS,gBAAwB;AAC/B,QAAO,YAAY,CAAC,MAAM,GAAG,EAAE;;AAajC,MAAM,WAAW,IAAI,mBAA+B;AAEpD,MAAa,iBAAiB;CAa5B,IAAO,OAAmB,UAAsB;EAC9C,MAAM,SAAS,SAAS,UAAU,IAAI,EAAE;AACxC,SAAO,SAAS,IAAI;GAAE,GAAG;GAAQ,GAAG;GAAO,EAAE,SAAS;;CAOxD,MAA8B;AAC5B,SAAO,SAAS,UAAU;;CAO5B,IAAI,QAAmC;EACrC,MAAM,QAAQ,SAAS,UAAU;AACjC,MAAI,CAAC,MAGH;AAEF,SAAO,OAAO,OAAO,OAAO;;CAO9B,aAA4C;AAC1C,SAAO;;CAEV;;;;;;;;;;;AAYD,SAAgB,+BACd,UAKI,EAAE,EACN;CACA,MAAM,EAAE,QAAQ,gBAAgB,iBAAiB;AAEjD,QAAO,SAAS,yBACd,KACA,MACA,MACM;EAGN,MAAMA,OAAmB,EAAE,UAFV,IAAI,cAAc,EAAE,EACb,kBAAkB,eAAe,EACrB;AACpC,iBAAe,IAAI;GAAE,GAAG;GAAM,GAAI,SAAS,OAAO,IAAI,GAAG,EAAE;GAAG,EAAE,KAAK;;;;;;;;AASzE,SAAgB,yBACd,UAGI,EAAE,EACN;CACA,MAAM,EAAE,QAAQ,gBAAgB,iBAAiB;AAEjD,QAAO,SAAS,mBACd,SACA,QACA,MACM;EAIN,MAAMA,OAAmB,EAAE,UAHV,QAAQ,cAAc,EAAE,EAE/B,kBAAmB,QAAQ,SAAgC,eAAe,EAChD;AACpC,iBAAe,IAAI;GAAE,GAAG;GAAM,GAAI,SAAS,OAAO,QAAQ,GAAG,EAAE;GAAG,EAAE,KAAK"}

package/dist/azure-monitor.transport-CG7ClkYj.d.ts

@@ -0,0 +1,62 @@
+import { p as TransportLogEntry, s as IAsyncTransport } from "./transport.types-BuY84TwO.js";
+
+//#region src/transports/azure-monitor.transport.d.ts
+
+interface AzureMonitorTransportConfig {
+  /** DCE (Data Collection Endpoint) URL, e.g. `https://<name>.ingest.monitor.azure.com`. */
+  endpoint: string;
+  /** Data Collection Rule immutable ID (from Azure portal). */
+  ruleId: string;
+  /** Stream name defined in the DCR, e.g. `'Custom-LogixiaLogs_CL'`. */
+  streamName: string;
+  /** Azure AD tenant ID for OAuth2 client-credentials flow. */
+  tenantId?: string;
+  /** Azure AD app (service principal) client ID. */
+  clientId?: string;
+  /** Azure AD app client secret. */
+  clientSecret?: string;
+  /** Number of entries to batch. @default 200 */
+  batchSize?: number;
+  /** Flush interval in ms. @default 5000 */
+  flushIntervalMs?: number;
+  /** Abort a request that has not finished after this many ms. @default 10000 */
+  requestTimeoutMs?: number;
+  /** Max buffered entries; the oldest are dropped past this. @default 10000 */
+  maxBufferSize?: number;
+  level?: string;
+}
+/**
+ * Azure Monitor Logs Ingestion transport.
+ */
+declare class AzureMonitorTransport implements IAsyncTransport {
+  readonly name = "azure-monitor";
+  readonly batchSize: number;
+  readonly flushInterval: number;
+  readonly level: string | undefined;
+  private readonly buffer;
+  private readonly requestTimeoutMs;
+  private flushTimer;
+  private accessToken;
+  private tokenExpiry;
+  private readonly endpoint;
+  private readonly ruleId;
+  private readonly streamName;
+  private readonly tenantId;
+  private readonly clientId;
+  private readonly clientSecret;
+  constructor(config: AzureMonitorTransportConfig);
+  write(entry: TransportLogEntry): void;
+  flush(): Promise<void>;
+  /**
+   * Flush remaining entries and stop the interval timer on shutdown. Without
+   * this the manager's close() skipped the transport (close was undefined) and
+   * buffered entries were lost on deploy. Waits for any in-flight send first.
+   */
+  close(): Promise<void>;
+  private toAzureRecord;
+  private getAccessToken;
+  private sendEntries;
+}
+//#endregion
+export { AzureMonitorTransportConfig as n, AzureMonitorTransport as t };
+//# sourceMappingURL=azure-monitor.transport-CG7ClkYj.d.ts.map

package/dist/azure-monitor.transport-CG7ClkYj.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-monitor.transport-CG7ClkYj.d.ts","names":[],"sources":["../src/transports/azure-monitor.transport.ts"],"sourcesContent":[],"mappings":";;;;UAkDiB,2BAAA;;;;;;;;;;;;;;;;;;;;;;;;;;cAwCJ,qBAAA,YAAiC;;;;;;;;;;;;;;;;sBAmBxB;eAwBP;WAKJ;;;;;;WASM"}

package/dist/azure-monitor.transport-CHnjVRF-.mjs

@@ -0,0 +1,152 @@
+import { r as internalWarn, t as internalError } from "./internal-log-Cm8SOWSV.mjs";
+import { i as stringifyForLog } from "./safe-stringify-DJ66tW5I.mjs";
+import { a as httpRequest, n as DEFAULT_MAX_BUFFER_SIZE, r as DEFAULT_REQUEST_TIMEOUT_MS, t as BatchBuffer } from "./batch-buffer-PGvSgbmd.mjs";
+
+//#region src/transports/azure-monitor.transport.ts
+/**
+* Azure AD tenant IDs are either a GUID or a verified domain (e.g. `contoso.onmicrosoft.com`).
+* This pattern is deliberately permissive on structure but strict on character
+* set — it rejects the breakout characters (`/`, `@`, `:`, `?`, `#`, whitespace)
+* that would let a hostile config smuggle a different host, path, or query into
+* the OAuth token URL.
+*/
+const AZURE_TENANT_RE = /^[a-z0-9][a-z0-9.-]{1,253}$/i;
+const SEVERITY_MAP = {
+	verbose: 0,
+	trace: 0,
+	debug: 1,
+	info: 1,
+	log: 1,
+	warn: 2,
+	warning: 2,
+	error: 3,
+	critical: 4,
+	fatal: 4
+};
+/**
+* Azure Monitor Logs Ingestion transport.
+*/
+var AzureMonitorTransport = class {
+	constructor(config) {
+		this.name = "azure-monitor";
+		this.flushTimer = null;
+		this.accessToken = null;
+		this.tokenExpiry = 0;
+		this.endpoint = config.endpoint.replace(/\/$/, "");
+		this.ruleId = config.ruleId;
+		this.streamName = config.streamName;
+		this.tenantId = config.tenantId ?? process.env["AZURE_TENANT_ID"];
+		this.clientId = config.clientId ?? process.env["AZURE_CLIENT_ID"];
+		this.clientSecret = config.clientSecret ?? process.env["AZURE_CLIENT_SECRET"];
+		this.batchSize = config.batchSize ?? 200;
+		this.flushInterval = config.flushIntervalMs ?? 5e3;
+		this.level = config.level;
+		this.requestTimeoutMs = config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+		this.buffer = new BatchBuffer({
+			name: "AzureMonitorTransport",
+			batchSize: this.batchSize,
+			maxBufferSize: config.maxBufferSize ?? DEFAULT_MAX_BUFFER_SIZE,
+			send: (entries) => this.sendEntries(entries)
+		});
+		this.flushTimer = setInterval(() => {
+			this.flush().catch(() => {});
+		}, this.flushInterval);
+		if (this.flushTimer.unref) this.flushTimer.unref();
+	}
+	write(entry) {
+		this.buffer.push(entry);
+		this.buffer.flushIfFull();
+	}
+	flush() {
+		return this.buffer.flush();
+	}
+	/**
+	* Flush remaining entries and stop the interval timer on shutdown. Without
+	* this the manager's close() skipped the transport (close was undefined) and
+	* buffered entries were lost on deploy. Waits for any in-flight send first.
+	*/
+	async close() {
+		if (this.flushTimer) {
+			clearInterval(this.flushTimer);
+			this.flushTimer = null;
+		}
+		await this.buffer.close();
+	}
+	toAzureRecord(entry) {
+		return {
+			TimeGenerated: entry.timestamp ?? (/* @__PURE__ */ new Date()).toISOString(),
+			SeverityLevel: SEVERITY_MAP[entry.level.toLowerCase()] ?? 1,
+			Message: entry.message,
+			AppName: entry.appName,
+			Context: entry.context ?? "",
+			TraceId: entry.traceId ?? "",
+			Properties: stringifyForLog(entry.data ?? {})
+		};
+	}
+	async getAccessToken() {
+		if (this.accessToken && Date.now() < this.tokenExpiry) return this.accessToken;
+		if (!this.tenantId || !this.clientId || !this.clientSecret) {
+			internalWarn("AzureMonitorTransport: missing credentials — set tenantId, clientId, clientSecret");
+			return null;
+		}
+		const body = new URLSearchParams({
+			grant_type: "client_credentials",
+			client_id: this.clientId,
+			client_secret: this.clientSecret,
+			scope: "https://monitor.azure.com/.default"
+		}).toString();
+		const tenantId = this.tenantId;
+		if (!AZURE_TENANT_RE.test(tenantId)) {
+			internalWarn(`AzureMonitorTransport: refusing to request token — tenantId "${tenantId}" is not a valid GUID or domain`);
+			return null;
+		}
+		const reqUrl = new URL(`https://login.microsoftonline.com/${encodeURIComponent(tenantId)}/oauth2/v2.0/token`);
+		try {
+			const res = await httpRequest({
+				url: reqUrl,
+				headers: { "Content-Type": "application/x-www-form-urlencoded" },
+				body,
+				timeoutMs: this.requestTimeoutMs,
+				label: "Azure token request"
+			});
+			const parsed = JSON.parse(res.body);
+			if (!parsed.access_token) return null;
+			this.accessToken = parsed.access_token;
+			this.tokenExpiry = Date.now() + (parsed.expires_in ?? 3600) * 1e3 - 6e4;
+			return this.accessToken;
+		} catch (err) {
+			internalError("AzureMonitorTransport token request failed", err);
+			return null;
+		}
+	}
+	async sendEntries(entries) {
+		const token = await this.getAccessToken();
+		if (!token) throw new Error("AzureMonitorTransport: no access token available");
+		const body = stringifyForLog(entries.map((e) => this.toAzureRecord(e)));
+		let reqUrl;
+		try {
+			reqUrl = new URL(`dataCollectionRules/${encodeURIComponent(this.ruleId)}/streams/${encodeURIComponent(this.streamName)}?api-version=2023-01-01`, this.endpoint.endsWith("/") ? this.endpoint : `${this.endpoint}/`);
+		} catch (error) {
+			internalError(`AzureMonitorTransport: invalid endpoint "${this.endpoint}"`, error);
+			return;
+		}
+		if (reqUrl.protocol !== "https:") {
+			internalError(`AzureMonitorTransport: endpoint must use https (got ${reqUrl.protocol})`);
+			return;
+		}
+		await httpRequest({
+			url: reqUrl,
+			headers: {
+				Authorization: `Bearer ${token}`,
+				"Content-Type": "application/json"
+			},
+			body,
+			timeoutMs: this.requestTimeoutMs,
+			label: "Azure Monitor API"
+		});
+	}
+};
+
+//#endregion
+export { AzureMonitorTransport as t };
+//# sourceMappingURL=azure-monitor.transport-CHnjVRF-.mjs.map

package/dist/azure-monitor.transport-CHnjVRF-.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-monitor.transport-CHnjVRF-.mjs","names":["SEVERITY_MAP: Record<string, number>","reqUrl: URL"],"sources":["../src/transports/azure-monitor.transport.ts"],"sourcesContent":["/**\n * logixia — Azure Monitor / Application Insights transport\n *\n * Sends log entries to Azure Monitor via the Data Collection Rules (DCR) API\n * using the Logs Ingestion API (the modern replacement for the legacy HTTP\n * Data Collector API).\n *\n * Maps logixia levels to Application Insights severity levels:\n *   verbose → 0, debug → 1, info → 1, warn → 2, error → 3, critical → 4\n *\n * @example\n * ```ts\n * import { AzureMonitorTransport } from 'logixia';\n *\n * const logger = createLogger({\n *   transports: {\n *     azure: new AzureMonitorTransport({\n *       // Logs Ingestion API endpoint (from your DCR)\n *       endpoint: 'https://<dce>.ingest.monitor.azure.com',\n *       ruleId: 'dcr-xxxxxxxxxxxxxxxx',\n *       streamName: 'Custom-LogixiaLogs',\n *       // Client credentials (or managed identity via no-credential mode)\n *       tenantId: process.env.AZURE_TENANT_ID,\n *       clientId: process.env.AZURE_CLIENT_ID,\n *       clientSecret: process.env.AZURE_CLIENT_SECRET,\n *     }),\n *   },\n * });\n * ```\n */\n\nimport type { IAsyncTransport, TransportLogEntry } from '../types/transport.types';\nimport { internalError, internalWarn } from '../utils/internal-log';\nimport { stringifyForLog } from '../utils/safe-stringify';\nimport {\n  BatchBuffer,\n  DEFAULT_MAX_BUFFER_SIZE,\n  DEFAULT_REQUEST_TIMEOUT_MS,\n  httpRequest,\n} from './batch-buffer';\n\n/**\n * Azure AD tenant IDs are either a GUID or a verified domain (e.g. `contoso.onmicrosoft.com`).\n * This pattern is deliberately permissive on structure but strict on character\n * set — it rejects the breakout characters (`/`, `@`, `:`, `?`, `#`, whitespace)\n * that would let a hostile config smuggle a different host, path, or query into\n * the OAuth token URL.\n */\nconst AZURE_TENANT_RE = /^[a-z0-9][a-z0-9.-]{1,253}$/i;\n\nexport interface AzureMonitorTransportConfig {\n  /** DCE (Data Collection Endpoint) URL, e.g. `https://<name>.ingest.monitor.azure.com`. */\n  endpoint: string;\n  /** Data Collection Rule immutable ID (from Azure portal). */\n  ruleId: string;\n  /** Stream name defined in the DCR, e.g. `'Custom-LogixiaLogs_CL'`. */\n  streamName: string;\n  /** Azure AD tenant ID for OAuth2 client-credentials flow. */\n  tenantId?: string;\n  /** Azure AD app (service principal) client ID. */\n  clientId?: string;\n  /** Azure AD app client secret. */\n  clientSecret?: string;\n  /** Number of entries to batch. @default 200 */\n  batchSize?: number;\n  /** Flush interval in ms. @default 5000 */\n  flushIntervalMs?: number;\n  /** Abort a request that has not finished after this many ms. @default 10000 */\n  requestTimeoutMs?: number;\n  /** Max buffered entries; the oldest are dropped past this. @default 10000 */\n  maxBufferSize?: number;\n  level?: string;\n}\n\nconst SEVERITY_MAP: Record<string, number> = {\n  verbose: 0,\n  trace: 0,\n  debug: 1,\n  info: 1,\n  log: 1,\n  warn: 2,\n  warning: 2,\n  error: 3,\n  critical: 4,\n  fatal: 4,\n};\n\n/**\n * Azure Monitor Logs Ingestion transport.\n */\nexport class AzureMonitorTransport implements IAsyncTransport {\n  public readonly name = 'azure-monitor';\n  public readonly batchSize: number;\n  public readonly flushInterval: number;\n  public readonly level: string | undefined;\n\n  private readonly buffer: BatchBuffer<TransportLogEntry>;\n  private readonly requestTimeoutMs: number;\n  private flushTimer: NodeJS.Timeout | null = null;\n  private accessToken: string | null = null;\n  private tokenExpiry = 0;\n\n  private readonly endpoint: string;\n  private readonly ruleId: string;\n  private readonly streamName: string;\n  private readonly tenantId: string | undefined;\n  private readonly clientId: string | undefined;\n  private readonly clientSecret: string | undefined;\n\n  constructor(config: AzureMonitorTransportConfig) {\n    this.endpoint = config.endpoint.replace(/\\/$/, '');\n    this.ruleId = config.ruleId;\n    this.streamName = config.streamName;\n    this.tenantId = config.tenantId ?? process.env['AZURE_TENANT_ID'];\n    this.clientId = config.clientId ?? process.env['AZURE_CLIENT_ID'];\n    this.clientSecret = config.clientSecret ?? process.env['AZURE_CLIENT_SECRET'];\n    this.batchSize = config.batchSize ?? 200;\n    this.flushInterval = config.flushIntervalMs ?? 5000;\n    this.level = config.level;\n    this.requestTimeoutMs = config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;\n    this.buffer = new BatchBuffer<TransportLogEntry>({\n      name: 'AzureMonitorTransport',\n      batchSize: this.batchSize,\n      maxBufferSize: config.maxBufferSize ?? DEFAULT_MAX_BUFFER_SIZE,\n      send: (entries) => this.sendEntries(entries),\n    });\n\n    this.flushTimer = setInterval(() => {\n      this.flush().catch(() => {});\n    }, this.flushInterval);\n    if (this.flushTimer.unref) this.flushTimer.unref();\n  }\n\n  write(entry: TransportLogEntry): void {\n    this.buffer.push(entry);\n    this.buffer.flushIfFull();\n  }\n\n  flush(): Promise<void> {\n    return this.buffer.flush();\n  }\n\n  /**\n   * Flush remaining entries and stop the interval timer on shutdown. Without\n   * this the manager's close() skipped the transport (close was undefined) and\n   * buffered entries were lost on deploy. Waits for any in-flight send first.\n   */\n  async close(): Promise<void> {\n    if (this.flushTimer) {\n      clearInterval(this.flushTimer);\n      this.flushTimer = null;\n    }\n    await this.buffer.close();\n  }\n\n  private toAzureRecord(entry: TransportLogEntry): Record<string, unknown> {\n    return {\n      TimeGenerated: entry.timestamp ?? new Date().toISOString(),\n      SeverityLevel: SEVERITY_MAP[entry.level.toLowerCase()] ?? 1,\n      Message: entry.message,\n      AppName: entry.appName,\n      Context: entry.context ?? '',\n      TraceId: entry.traceId ?? '',\n      Properties: stringifyForLog(entry.data ?? {}),\n    };\n  }\n\n  private async getAccessToken(): Promise<string | null> {\n    if (this.accessToken && Date.now() < this.tokenExpiry) return this.accessToken;\n\n    if (!this.tenantId || !this.clientId || !this.clientSecret) {\n      internalWarn(\n        'AzureMonitorTransport: missing credentials — set tenantId, clientId, clientSecret'\n      );\n      return null;\n    }\n\n    const body = new URLSearchParams({\n      grant_type: 'client_credentials',\n      client_id: this.clientId,\n      client_secret: this.clientSecret,\n      scope: 'https://monitor.azure.com/.default',\n    }).toString();\n\n    const tenantId = this.tenantId;\n    if (!AZURE_TENANT_RE.test(tenantId)) {\n      internalWarn(\n        `AzureMonitorTransport: refusing to request token — tenantId \"${tenantId}\" is not a valid GUID or domain`\n      );\n      return null;\n    }\n\n    const reqUrl = new URL(\n      `https://login.microsoftonline.com/${encodeURIComponent(tenantId)}/oauth2/v2.0/token`\n    );\n    try {\n      const res = await httpRequest({\n        url: reqUrl,\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        body,\n        timeoutMs: this.requestTimeoutMs,\n        label: 'Azure token request',\n      });\n      const parsed = JSON.parse(res.body) as { access_token?: string; expires_in?: number };\n      if (!parsed.access_token) return null;\n      this.accessToken = parsed.access_token;\n      this.tokenExpiry = Date.now() + (parsed.expires_in ?? 3600) * 1000 - 60_000;\n      return this.accessToken;\n    } catch (err) {\n      internalError('AzureMonitorTransport token request failed', err);\n      return null;\n    }\n  }\n\n  private async sendEntries(entries: TransportLogEntry[]): Promise<void> {\n    const token = await this.getAccessToken();\n    if (!token) throw new Error('AzureMonitorTransport: no access token available');\n\n    const records = entries.map((e) => this.toAzureRecord(e));\n    const body = stringifyForLog(records);\n    let reqUrl: URL;\n    try {\n      // Build from the user-configured DCE endpoint; encodeURIComponent-ing the\n      // ruleId/streamName stops a hostile config from smuggling extra path\n      // segments or query params into the request.\n      reqUrl = new URL(\n        `dataCollectionRules/${encodeURIComponent(this.ruleId)}/streams/${encodeURIComponent(this.streamName)}?api-version=2023-01-01`,\n        this.endpoint.endsWith('/') ? this.endpoint : `${this.endpoint}/`\n      );\n    } catch (error) {\n      internalError(`AzureMonitorTransport: invalid endpoint \"${this.endpoint}\"`, error);\n      return;\n    }\n    if (reqUrl.protocol !== 'https:') {\n      internalError(`AzureMonitorTransport: endpoint must use https (got ${reqUrl.protocol})`);\n      return;\n    }\n\n    await httpRequest({\n      url: reqUrl,\n      headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: 'Azure Monitor API',\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAgDA,MAAM,kBAAkB;AA0BxB,MAAMA,eAAuC;CAC3C,SAAS;CACT,OAAO;CACP,OAAO;CACP,MAAM;CACN,KAAK;CACL,MAAM;CACN,SAAS;CACT,OAAO;CACP,UAAU;CACV,OAAO;CACR;;;;AAKD,IAAa,wBAAb,MAA8D;CAmB5D,YAAY,QAAqC;cAlB1B;oBAOqB;qBACP;qBACf;AAUpB,OAAK,WAAW,OAAO,SAAS,QAAQ,OAAO,GAAG;AAClD,OAAK,SAAS,OAAO;AACrB,OAAK,aAAa,OAAO;AACzB,OAAK,WAAW,OAAO,YAAY,QAAQ,IAAI;AAC/C,OAAK,WAAW,OAAO,YAAY,QAAQ,IAAI;AAC/C,OAAK,eAAe,OAAO,gBAAgB,QAAQ,IAAI;AACvD,OAAK,YAAY,OAAO,aAAa;AACrC,OAAK,gBAAgB,OAAO,mBAAmB;AAC/C,OAAK,QAAQ,OAAO;AACpB,OAAK,mBAAmB,OAAO,oBAAoB;AACnD,OAAK,SAAS,IAAI,YAA+B;GAC/C,MAAM;GACN,WAAW,KAAK;GAChB,eAAe,OAAO,iBAAiB;GACvC,OAAO,YAAY,KAAK,YAAY,QAAQ;GAC7C,CAAC;AAEF,OAAK,aAAa,kBAAkB;AAClC,QAAK,OAAO,CAAC,YAAY,GAAG;KAC3B,KAAK,cAAc;AACtB,MAAI,KAAK,WAAW,MAAO,MAAK,WAAW,OAAO;;CAGpD,MAAM,OAAgC;AACpC,OAAK,OAAO,KAAK,MAAM;AACvB,OAAK,OAAO,aAAa;;CAG3B,QAAuB;AACrB,SAAO,KAAK,OAAO,OAAO;;;;;;;CAQ5B,MAAM,QAAuB;AAC3B,MAAI,KAAK,YAAY;AACnB,iBAAc,KAAK,WAAW;AAC9B,QAAK,aAAa;;AAEpB,QAAM,KAAK,OAAO,OAAO;;CAG3B,AAAQ,cAAc,OAAmD;AACvE,SAAO;GACL,eAAe,MAAM,8BAAa,IAAI,MAAM,EAAC,aAAa;GAC1D,eAAe,aAAa,MAAM,MAAM,aAAa,KAAK;GAC1D,SAAS,MAAM;GACf,SAAS,MAAM;GACf,SAAS,MAAM,WAAW;GAC1B,SAAS,MAAM,WAAW;GAC1B,YAAY,gBAAgB,MAAM,QAAQ,EAAE,CAAC;GAC9C;;CAGH,MAAc,iBAAyC;AACrD,MAAI,KAAK,eAAe,KAAK,KAAK,GAAG,KAAK,YAAa,QAAO,KAAK;AAEnE,MAAI,CAAC,KAAK,YAAY,CAAC,KAAK,YAAY,CAAC,KAAK,cAAc;AAC1D,gBACE,oFACD;AACD,UAAO;;EAGT,MAAM,OAAO,IAAI,gBAAgB;GAC/B,YAAY;GACZ,WAAW,KAAK;GAChB,eAAe,KAAK;GACpB,OAAO;GACR,CAAC,CAAC,UAAU;EAEb,MAAM,WAAW,KAAK;AACtB,MAAI,CAAC,gBAAgB,KAAK,SAAS,EAAE;AACnC,gBACE,gEAAgE,SAAS,iCAC1E;AACD,UAAO;;EAGT,MAAM,SAAS,IAAI,IACjB,qCAAqC,mBAAmB,SAAS,CAAC,oBACnE;AACD,MAAI;GACF,MAAM,MAAM,MAAM,YAAY;IAC5B,KAAK;IACL,SAAS,EAAE,gBAAgB,qCAAqC;IAChE;IACA,WAAW,KAAK;IAChB,OAAO;IACR,CAAC;GACF,MAAM,SAAS,KAAK,MAAM,IAAI,KAAK;AACnC,OAAI,CAAC,OAAO,aAAc,QAAO;AACjC,QAAK,cAAc,OAAO;AAC1B,QAAK,cAAc,KAAK,KAAK,IAAI,OAAO,cAAc,QAAQ,MAAO;AACrE,UAAO,KAAK;WACL,KAAK;AACZ,iBAAc,8CAA8C,IAAI;AAChE,UAAO;;;CAIX,MAAc,YAAY,SAA6C;EACrE,MAAM,QAAQ,MAAM,KAAK,gBAAgB;AACzC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,mDAAmD;EAG/E,MAAM,OAAO,gBADG,QAAQ,KAAK,MAAM,KAAK,cAAc,EAAE,CAAC,CACpB;EACrC,IAAIC;AACJ,MAAI;AAIF,YAAS,IAAI,IACX,uBAAuB,mBAAmB,KAAK,OAAO,CAAC,WAAW,mBAAmB,KAAK,WAAW,CAAC,0BACtG,KAAK,SAAS,SAAS,IAAI,GAAG,KAAK,WAAW,GAAG,KAAK,SAAS,GAChE;WACM,OAAO;AACd,iBAAc,4CAA4C,KAAK,SAAS,IAAI,MAAM;AAClF;;AAEF,MAAI,OAAO,aAAa,UAAU;AAChC,iBAAc,uDAAuD,OAAO,SAAS,GAAG;AACxF;;AAGF,QAAM,YAAY;GAChB,KAAK;GACL,SAAS;IAAE,eAAe,UAAU;IAAS,gBAAgB;IAAoB;GACjF;GACA,WAAW,KAAK;GAChB,OAAO;GACR,CAAC"}

package/dist/azure-monitor.transport-Cm74kXZS.d.mts

@@ -0,0 +1,62 @@
+import { p as TransportLogEntry, s as IAsyncTransport } from "./transport.types-B5vcyv2k.mjs";
+
+//#region src/transports/azure-monitor.transport.d.ts
+
+interface AzureMonitorTransportConfig {
+  /** DCE (Data Collection Endpoint) URL, e.g. `https://<name>.ingest.monitor.azure.com`. */
+  endpoint: string;
+  /** Data Collection Rule immutable ID (from Azure portal). */
+  ruleId: string;
+  /** Stream name defined in the DCR, e.g. `'Custom-LogixiaLogs_CL'`. */
+  streamName: string;
+  /** Azure AD tenant ID for OAuth2 client-credentials flow. */
+  tenantId?: string;
+  /** Azure AD app (service principal) client ID. */
+  clientId?: string;
+  /** Azure AD app client secret. */
+  clientSecret?: string;
+  /** Number of entries to batch. @default 200 */
+  batchSize?: number;
+  /** Flush interval in ms. @default 5000 */
+  flushIntervalMs?: number;
+  /** Abort a request that has not finished after this many ms. @default 10000 */
+  requestTimeoutMs?: number;
+  /** Max buffered entries; the oldest are dropped past this. @default 10000 */
+  maxBufferSize?: number;
+  level?: string;
+}
+/**
+ * Azure Monitor Logs Ingestion transport.
+ */
+declare class AzureMonitorTransport implements IAsyncTransport {
+  readonly name = "azure-monitor";
+  readonly batchSize: number;
+  readonly flushInterval: number;
+  readonly level: string | undefined;
+  private readonly buffer;
+  private readonly requestTimeoutMs;
+  private flushTimer;
+  private accessToken;
+  private tokenExpiry;
+  private readonly endpoint;
+  private readonly ruleId;
+  private readonly streamName;
+  private readonly tenantId;
+  private readonly clientId;
+  private readonly clientSecret;
+  constructor(config: AzureMonitorTransportConfig);
+  write(entry: TransportLogEntry): void;
+  flush(): Promise<void>;
+  /**
+   * Flush remaining entries and stop the interval timer on shutdown. Without
+   * this the manager's close() skipped the transport (close was undefined) and
+   * buffered entries were lost on deploy. Waits for any in-flight send first.
+   */
+  close(): Promise<void>;
+  private toAzureRecord;
+  private getAccessToken;
+  private sendEntries;
+}
+//#endregion
+export { AzureMonitorTransportConfig as n, AzureMonitorTransport as t };
+//# sourceMappingURL=azure-monitor.transport-Cm74kXZS.d.mts.map

package/dist/azure-monitor.transport-Cm74kXZS.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-monitor.transport-Cm74kXZS.d.mts","names":[],"sources":["../src/transports/azure-monitor.transport.ts"],"sourcesContent":[],"mappings":";;;;UAkDiB,2BAAA;;;;;;;;;;;;;;;;;;;;;;;;;;cAwCJ,qBAAA,YAAiC;;;;;;;;;;;;;;;;sBAmBxB;eAwBP;WAKJ;;;;;;WASM"}

package/dist/azure-monitor.transport-CrvfHd9C.js

@@ -0,0 +1,157 @@
+const require_internal_log = require('./internal-log-BUJYMZbE.js');
+const require_safe_stringify = require('./safe-stringify-DWo3aZp_.js');
+const require_batch_buffer = require('./batch-buffer-BY-mRWIK.js');
+
+//#region src/transports/azure-monitor.transport.ts
+/**
+* Azure AD tenant IDs are either a GUID or a verified domain (e.g. `contoso.onmicrosoft.com`).
+* This pattern is deliberately permissive on structure but strict on character
+* set — it rejects the breakout characters (`/`, `@`, `:`, `?`, `#`, whitespace)
+* that would let a hostile config smuggle a different host, path, or query into
+* the OAuth token URL.
+*/
+const AZURE_TENANT_RE = /^[a-z0-9][a-z0-9.-]{1,253}$/i;
+const SEVERITY_MAP = {
+	verbose: 0,
+	trace: 0,
+	debug: 1,
+	info: 1,
+	log: 1,
+	warn: 2,
+	warning: 2,
+	error: 3,
+	critical: 4,
+	fatal: 4
+};
+/**
+* Azure Monitor Logs Ingestion transport.
+*/
+var AzureMonitorTransport = class {
+	constructor(config) {
+		this.name = "azure-monitor";
+		this.flushTimer = null;
+		this.accessToken = null;
+		this.tokenExpiry = 0;
+		this.endpoint = config.endpoint.replace(/\/$/, "");
+		this.ruleId = config.ruleId;
+		this.streamName = config.streamName;
+		this.tenantId = config.tenantId ?? process.env["AZURE_TENANT_ID"];
+		this.clientId = config.clientId ?? process.env["AZURE_CLIENT_ID"];
+		this.clientSecret = config.clientSecret ?? process.env["AZURE_CLIENT_SECRET"];
+		this.batchSize = config.batchSize ?? 200;
+		this.flushInterval = config.flushIntervalMs ?? 5e3;
+		this.level = config.level;
+		this.requestTimeoutMs = config.requestTimeoutMs ?? require_batch_buffer.DEFAULT_REQUEST_TIMEOUT_MS;
+		this.buffer = new require_batch_buffer.BatchBuffer({
+			name: "AzureMonitorTransport",
+			batchSize: this.batchSize,
+			maxBufferSize: config.maxBufferSize ?? require_batch_buffer.DEFAULT_MAX_BUFFER_SIZE,
+			send: (entries) => this.sendEntries(entries)
+		});
+		this.flushTimer = setInterval(() => {
+			this.flush().catch(() => {});
+		}, this.flushInterval);
+		if (this.flushTimer.unref) this.flushTimer.unref();
+	}
+	write(entry) {
+		this.buffer.push(entry);
+		this.buffer.flushIfFull();
+	}
+	flush() {
+		return this.buffer.flush();
+	}
+	/**
+	* Flush remaining entries and stop the interval timer on shutdown. Without
+	* this the manager's close() skipped the transport (close was undefined) and
+	* buffered entries were lost on deploy. Waits for any in-flight send first.
+	*/
+	async close() {
+		if (this.flushTimer) {
+			clearInterval(this.flushTimer);
+			this.flushTimer = null;
+		}
+		await this.buffer.close();
+	}
+	toAzureRecord(entry) {
+		return {
+			TimeGenerated: entry.timestamp ?? (/* @__PURE__ */ new Date()).toISOString(),
+			SeverityLevel: SEVERITY_MAP[entry.level.toLowerCase()] ?? 1,
+			Message: entry.message,
+			AppName: entry.appName,
+			Context: entry.context ?? "",
+			TraceId: entry.traceId ?? "",
+			Properties: require_safe_stringify.stringifyForLog(entry.data ?? {})
+		};
+	}
+	async getAccessToken() {
+		if (this.accessToken && Date.now() < this.tokenExpiry) return this.accessToken;
+		if (!this.tenantId || !this.clientId || !this.clientSecret) {
+			require_internal_log.internalWarn("AzureMonitorTransport: missing credentials — set tenantId, clientId, clientSecret");
+			return null;
+		}
+		const body = new URLSearchParams({
+			grant_type: "client_credentials",
+			client_id: this.clientId,
+			client_secret: this.clientSecret,
+			scope: "https://monitor.azure.com/.default"
+		}).toString();
+		const tenantId = this.tenantId;
+		if (!AZURE_TENANT_RE.test(tenantId)) {
+			require_internal_log.internalWarn(`AzureMonitorTransport: refusing to request token — tenantId "${tenantId}" is not a valid GUID or domain`);
+			return null;
+		}
+		const reqUrl = new URL(`https://login.microsoftonline.com/${encodeURIComponent(tenantId)}/oauth2/v2.0/token`);
+		try {
+			const res = await require_batch_buffer.httpRequest({
+				url: reqUrl,
+				headers: { "Content-Type": "application/x-www-form-urlencoded" },
+				body,
+				timeoutMs: this.requestTimeoutMs,
+				label: "Azure token request"
+			});
+			const parsed = JSON.parse(res.body);
+			if (!parsed.access_token) return null;
+			this.accessToken = parsed.access_token;
+			this.tokenExpiry = Date.now() + (parsed.expires_in ?? 3600) * 1e3 - 6e4;
+			return this.accessToken;
+		} catch (err) {
+			require_internal_log.internalError("AzureMonitorTransport token request failed", err);
+			return null;
+		}
+	}
+	async sendEntries(entries) {
+		const token = await this.getAccessToken();
+		if (!token) throw new Error("AzureMonitorTransport: no access token available");
+		const body = require_safe_stringify.stringifyForLog(entries.map((e) => this.toAzureRecord(e)));
+		let reqUrl;
+		try {
+			reqUrl = new URL(`dataCollectionRules/${encodeURIComponent(this.ruleId)}/streams/${encodeURIComponent(this.streamName)}?api-version=2023-01-01`, this.endpoint.endsWith("/") ? this.endpoint : `${this.endpoint}/`);
+		} catch (error) {
+			require_internal_log.internalError(`AzureMonitorTransport: invalid endpoint "${this.endpoint}"`, error);
+			return;
+		}
+		if (reqUrl.protocol !== "https:") {
+			require_internal_log.internalError(`AzureMonitorTransport: endpoint must use https (got ${reqUrl.protocol})`);
+			return;
+		}
+		await require_batch_buffer.httpRequest({
+			url: reqUrl,
+			headers: {
+				Authorization: `Bearer ${token}`,
+				"Content-Type": "application/json"
+			},
+			body,
+			timeoutMs: this.requestTimeoutMs,
+			label: "Azure Monitor API"
+		});
+	}
+};
+
+//#endregion
+Object.defineProperty(exports, 'AzureMonitorTransport', {
+  enumerable: true,
+  get: function () {
+    return AzureMonitorTransport;
+  }
+});
+//# sourceMappingURL=azure-monitor.transport-CrvfHd9C.js.map