logixia 1.12.6 → 1.13.3

package/dist/correlation.js

@@ -1,5 +1,6 @@
 const require_chunk = require('./chunk-nOFOJqeH.js');
-const require_async_context = require('./async-context-CSHWoHMB.js');
+const require_trace_utils = require('./trace.utils-DpBOLDtq.js');
+const require_async_context = require('./async-context-DyQQYq3I.js');
 let node_crypto = require("node:crypto");
 node_crypto = require_chunk.__toESM(node_crypto);
 
@@ -18,8 +19,6 @@ function generateCorrelationId() {
 	if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") return crypto.randomUUID();
 	return (0, node_crypto.randomUUID)();
 }
-const MAX_INCOMING_ID_LENGTH = 128;
-const VALID_INCOMING_ID = /^[A-Za-z0-9._:-]+$/;
 /**
 * Return an incoming correlation ID only if it is short and made of safe
 * characters. Anything else (over-long, empty, or containing newlines or other
@@ -27,8 +26,8 @@ const VALID_INCOMING_ID = /^[A-Za-z0-9._:-]+$/;
 * writing client-supplied text into every log line.
 */
 function validIncomingId(value) {
-	if (value === void 0 || value.length > MAX_INCOMING_ID_LENGTH) return void 0;
-	return VALID_INCOMING_ID.test(value) ? value : void 0;
+	if (typeof value === "string" && value.trim() !== value) return void 0;
+	return require_trace_utils.sanitizeIncomingId(value);
 }
 /**
 * Return the correlation ID from the current `LogixiaContext`, or `undefined`
@@ -69,11 +68,11 @@ function withCorrelationId(correlationId, callback) {
 * ```
 */
 function correlationMiddleware(options = {}) {
-	const { header = "x-correlation-id", originServiceHeader = "x-origin-service", generate = generateCorrelationId, setResponseHeader = true } = options;
+	const { header = "x-correlation-id", originServiceHeader = "x-origin-service", generate = generateCorrelationId, trustIncoming = true, setResponseHeader = true } = options;
 	return function logixiaCorrelationMiddleware(req, res, next) {
 		const headers = req["headers"] ?? {};
-		const correlationId = validIncomingId(headers[header.toLowerCase()]) ?? generate();
-		const originService = headers[originServiceHeader.toLowerCase()];
+		const correlationId = (trustIncoming ? validIncomingId(headers[header.toLowerCase()]) : void 0) ?? generate();
+		const originService = validIncomingId(headers[originServiceHeader.toLowerCase()]);
 		if (setResponseHeader) {
 			const setHeader = res["setHeader"];
 			if (typeof setHeader === "function") setHeader.call(res, header, correlationId);
@@ -96,11 +95,11 @@ function correlationMiddleware(options = {}) {
 * ```
 */
 function correlationFastifyHook(options = {}) {
-	const { header = "x-correlation-id", originServiceHeader = "x-origin-service", generate = generateCorrelationId, setResponseHeader = true } = options;
+	const { header = "x-correlation-id", originServiceHeader = "x-origin-service", generate = generateCorrelationId, trustIncoming = true, setResponseHeader = true } = options;
 	return function logixiaCorrelationFastifyHook(request, reply, done) {
 		const headers = request["headers"] ?? {};
-		const correlationId = validIncomingId(headers[header.toLowerCase()]) ?? generate();
-		const originService = headers[originServiceHeader.toLowerCase()];
+		const correlationId = (trustIncoming ? validIncomingId(headers[header.toLowerCase()]) : void 0) ?? generate();
+		const originService = validIncomingId(headers[originServiceHeader.toLowerCase()]);
 		if (setResponseHeader) {
 			const replyHeader = reply["header"];
 			if (typeof replyHeader === "function") replyHeader.call(reply, header, correlationId);
@@ -165,12 +164,16 @@ function createCorrelationAxiosInterceptor(options = {}) {
 		};
 	};
 }
+const MAX_USER_AGENT_LENGTH = 512;
+const MAX_IP_LENGTH = 64;
 /**
 * Create a child logger enriched with all correlation-relevant identifiers
 * extracted from the incoming HTTP request.
 *
 * The child logger's every call automatically includes:
-* `correlationId`, `requestId`, `method`, `url`, `userAgent`, `ip`
+* `correlationId`, `method`, `url`, `userAgent`, `ip`
+*
+* The IP comes from `req.ip` / the socket address unless `trustProxy` is set.
 *
 * @example
 * ```ts
@@ -188,21 +191,43 @@ function createCorrelationAxiosInterceptor(options = {}) {
 * ```
 */
 function childFromRequest(req, logger, options = {}) {
-	var _headers$xForwarded, _req$socket;
 	const correlationHeader = options.correlationHeader ?? "x-correlation-id";
 	const headers = req["headers"] ?? {};
 	const correlationId = validIncomingId(headers[correlationHeader.toLowerCase()]) ?? getCurrentCorrelationId() ?? generateCorrelationId();
 	const method = req["method"];
 	const url = req["url"] ?? req["originalUrl"];
-	const userAgent = headers["user-agent"];
-	const ip = ((_headers$xForwarded = headers["x-forwarded-for"]) === null || _headers$xForwarded === void 0 || (_headers$xForwarded = _headers$xForwarded.split(",")[0]) === null || _headers$xForwarded === void 0 ? void 0 : _headers$xForwarded.trim()) ?? ((_req$socket = req["socket"]) === null || _req$socket === void 0 ? void 0 : _req$socket["remoteAddress"]);
-	return logger.child({
+	const rawUserAgent = headers["user-agent"];
+	const userAgent = typeof rawUserAgent === "string" ? rawUserAgent.slice(0, MAX_USER_AGENT_LENGTH) : void 0;
+	const ip = resolveClientIp(req, headers, options.trustProxy === true);
+	const fields = {
 		correlationId,
 		...method !== void 0 ? { method } : {},
 		...url !== void 0 ? { url } : {},
 		...userAgent !== void 0 ? { userAgent } : {},
 		...ip !== void 0 ? { ip } : {}
-	});
+	};
+	const child = logger.child;
+	if (options.childContext !== void 0) return child.call(logger, options.childContext, fields);
+	if (usesStringContext(logger)) return child.call(logger, "request", fields);
+	return child.call(logger, fields);
+}
+/** ILogger implementations (LogixiaLogger, LogixiaLoggerService, mock logger) expose these methods. */
+function usesStringContext(logger) {
+	const l = logger;
+	return typeof l["getContext"] === "function" || typeof l["getAvailableTransports"] === "function";
+}
+function resolveClientIp(req, headers, trustProxy) {
+	var _req$socket;
+	if (trustProxy) {
+		var _forwarded$split$;
+		const forwarded = headers["x-forwarded-for"];
+		const first = typeof forwarded === "string" ? (_forwarded$split$ = forwarded.split(",")[0]) === null || _forwarded$split$ === void 0 ? void 0 : _forwarded$split$.trim() : void 0;
+		if (first) return first.slice(0, MAX_IP_LENGTH);
+	}
+	const fromReq = req["ip"];
+	if (typeof fromReq === "string" && fromReq) return fromReq.slice(0, MAX_IP_LENGTH);
+	const remote = (_req$socket = req["socket"]) === null || _req$socket === void 0 ? void 0 : _req$socket["remoteAddress"];
+	return typeof remote === "string" ? remote.slice(0, MAX_IP_LENGTH) : void 0;
 }
 /**
 * Extract a correlation context from a Kafka / RabbitMQ / SQS message object.
@@ -226,14 +251,14 @@ function extractMessageCorrelationId(message) {
 	const kafkaHeaders = message["headers"];
 	if (kafkaHeaders) {
 		const raw = kafkaHeaders["x-correlation-id"] ?? kafkaHeaders["correlationId"] ?? kafkaHeaders["correlation_id"];
-		if (raw !== void 0) return Buffer.isBuffer(raw) ? raw.toString("utf8") : String(raw);
+		if (raw !== void 0) return validIncomingId(Buffer.isBuffer(raw) ? raw.toString("utf8", 0, 512) : String(raw));
 	}
 	const sqsAttrs = message["MessageAttributes"];
 	if (sqsAttrs) {
 		var _sqsAttrs$xCorrelati, _sqsAttrs$correlation, _sqsAttrs$correlation2;
-		return ((_sqsAttrs$xCorrelati = sqsAttrs["x-correlation-id"]) === null || _sqsAttrs$xCorrelati === void 0 ? void 0 : _sqsAttrs$xCorrelati.StringValue) ?? ((_sqsAttrs$correlation = sqsAttrs["correlationId"]) === null || _sqsAttrs$correlation === void 0 ? void 0 : _sqsAttrs$correlation.StringValue) ?? ((_sqsAttrs$correlation2 = sqsAttrs["correlation_id"]) === null || _sqsAttrs$correlation2 === void 0 ? void 0 : _sqsAttrs$correlation2.StringValue);
+		return validIncomingId(((_sqsAttrs$xCorrelati = sqsAttrs["x-correlation-id"]) === null || _sqsAttrs$xCorrelati === void 0 ? void 0 : _sqsAttrs$xCorrelati.StringValue) ?? ((_sqsAttrs$correlation = sqsAttrs["correlationId"]) === null || _sqsAttrs$correlation === void 0 ? void 0 : _sqsAttrs$correlation.StringValue) ?? ((_sqsAttrs$correlation2 = sqsAttrs["correlation_id"]) === null || _sqsAttrs$correlation2 === void 0 ? void 0 : _sqsAttrs$correlation2.StringValue));
 	}
-	return message["correlationId"] ?? message["correlation_id"];
+	return validIncomingId(message["correlationId"] ?? message["correlation_id"]);
 }
 /**
 * Build Kafka message headers containing the current correlation context.

package/dist/correlation.js.map

@@ -1 +1 @@
-{"version":3,"file":"correlation.js","names":["LogixiaContext","ctx: CorrelationContext","headers: Record<string, string>"],"sources":["../src/correlation.ts"],"sourcesContent":["/**\n * logixia — Microservices Correlation ID Propagation\n *\n * Provides zero-boilerplate correlation ID generation and propagation for\n * distributed systems. A single correlation ID travels through every service\n * in a request fan-out, making it trivial to join logs across services.\n *\n * Features:\n *  - UUID v4 correlation ID generation (via `crypto.randomUUID()`)\n *  - Express / Fastify / NestJS incoming-request middleware\n *  - `correlationFetch()` — wraps global `fetch`, auto-injects `X-Correlation-ID`\n *  - `createCorrelationAxiosInterceptor()` — axios request interceptor\n *  - `childFromRequest(req, logger)` — child logger with all request identifiers\n *  - Kafka / SQS / RabbitMQ message context helpers\n *  - Integration with `LogixiaContext` (AsyncLocalStorage) so every `logger.info()`\n *    call automatically includes the correlationId without per-call passing.\n *\n * @example Express middleware\n * ```ts\n * import { correlationMiddleware } from 'logixia/correlation';\n * import { logger } from 'logixia';\n *\n * app.use(correlationMiddleware());\n *\n * app.get('/orders', (req, res) => {\n *   // correlationId is automatically in every log inside this request\n *   logger.info('Listing orders');\n *   res.json({ ok: true });\n * });\n * ```\n *\n * @example Outbound fetch with correlation\n * ```ts\n * import { correlationFetch } from 'logixia/correlation';\n *\n * // Reads correlationId from current LogixiaContext and injects it as header\n * const data = await correlationFetch('https://payments.internal/charge', {\n *   method: 'POST',\n *   body: JSON.stringify({ amount: 100 }),\n * });\n * ```\n *\n * @example Manual correlation context\n * ```ts\n * import { withCorrelationId } from 'logixia/correlation';\n *\n * await withCorrelationId('trace-abc-123', async () => {\n *   // All logs and outbound fetch calls in here carry 'trace-abc-123'\n *   await processOrder();\n * });\n * ```\n */\n\nimport { randomUUID } from 'node:crypto';\n\nimport { LogixiaContext } from './context/async-context';\n\n// ── Types ─────────────────────────────────────────────────────────────────────\n\n/** Fields injected into the log context by the correlation middleware. */\nexport interface CorrelationContext {\n  correlationId: string;\n  traceId?: string;\n  /** Service that originated the request (from `X-Origin-Service` header). */\n  originService?: string;\n  /** Index signature so CorrelationContext is assignable to LogContext. */\n  [key: string]: unknown;\n}\n\nexport interface CorrelationMiddlewareOptions {\n  /**\n   * HTTP header to read/write the correlation ID from/to.\n   * @default 'x-correlation-id'\n   */\n  header?: string;\n  /**\n   * HTTP header for the originating service name.\n   * @default 'x-origin-service'\n   */\n  originServiceHeader?: string;\n  /**\n   * Function to generate a new correlation ID when none is present in the request.\n   * @default () => crypto.randomUUID()\n   */\n  generate?: () => string;\n  /**\n   * When `true`, the response will include the correlation ID header so\n   * clients can log it client-side.\n   * @default true\n   */\n  setResponseHeader?: boolean;\n}\n\n// ── ID generation ─────────────────────────────────────────────────────────────\n\n/**\n * Generate a new correlation ID using `crypto.randomUUID()` (available in\n * Node.js 14.17+, all modern browsers, and Edge runtimes).\n *\n * When the Web Crypto global is unavailable (e.g. Node 18 without\n * `--experimental-global-webcrypto`), fall back to `node:crypto`'s\n * `randomUUID`, which returns a proper UUID v4 — matching the shape this\n * function's JSDoc and README promise. `logixia/correlation` is Node-only\n * (it builds on `AsyncLocalStorage`), so importing `node:crypto` is safe here.\n */\nexport function generateCorrelationId(): string {\n  if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function') {\n    return crypto.randomUUID();\n  }\n  return randomUUID();\n}\n\nconst MAX_INCOMING_ID_LENGTH = 128;\nconst VALID_INCOMING_ID = /^[A-Za-z0-9._:-]+$/;\n\n/**\n * Return an incoming correlation ID only if it is short and made of safe\n * characters. Anything else (over-long, empty, or containing newlines or other\n * control characters) is dropped so the caller generates a fresh ID instead of\n * writing client-supplied text into every log line.\n */\nfunction validIncomingId(value: string | undefined): string | undefined {\n  if (value === undefined || value.length > MAX_INCOMING_ID_LENGTH) return undefined;\n  return VALID_INCOMING_ID.test(value) ? value : undefined;\n}\n\n// ── Context helpers ───────────────────────────────────────────────────────────\n\n/**\n * Return the correlation ID from the current `LogixiaContext`, or `undefined`\n * when called outside any context scope.\n */\nexport function getCurrentCorrelationId(): string | undefined {\n  const ctx = LogixiaContext.get();\n  return ctx?.correlationId as string | undefined;\n}\n\n/**\n * Run `callback` inside a correlation context scope.\n *\n * If a correlation ID is not provided, a new UUID is generated.\n *\n * @example\n * ```ts\n * await withCorrelationId('cid-abc', async () => {\n *   logger.info('Processing message'); // → { correlationId: 'cid-abc', ... }\n *   await callDownstream();            // correlationFetch() picks up cid-abc\n * });\n * ```\n */\nexport function withCorrelationId<T>(correlationId: string | undefined, callback: () => T): T {\n  const id = correlationId ?? generateCorrelationId();\n  return LogixiaContext.run({ correlationId: id }, callback);\n}\n\n// ── Express / Connect middleware ──────────────────────────────────────────────\n\n/**\n * Express-compatible middleware that:\n * 1. Reads `X-Correlation-ID` from the incoming request (or generates a new one)\n * 2. Wraps the request in a `LogixiaContext` so all loggers in the handler\n *    automatically include `correlationId`\n * 3. Writes the correlation ID back to the response header (opt-out via options)\n *\n * @example\n * ```ts\n * import { correlationMiddleware } from 'logixia/correlation';\n * app.use(correlationMiddleware());\n * ```\n */\nexport function correlationMiddleware(options: CorrelationMiddlewareOptions = {}) {\n  const {\n    header = 'x-correlation-id',\n    originServiceHeader = 'x-origin-service',\n    generate = generateCorrelationId,\n    setResponseHeader = true,\n  } = options;\n\n  return function logixiaCorrelationMiddleware(\n    req: Record<string, unknown>,\n    res: Record<string, unknown>,\n    next: () => void\n  ): void {\n    const headers = (req['headers'] ?? {}) as Record<string, string | undefined>;\n\n    // Node lower-cases incoming header names, so look up with lower-cased keys.\n    const correlationId = validIncomingId(headers[header.toLowerCase()]) ?? generate();\n    const originService = headers[originServiceHeader.toLowerCase()];\n\n    if (setResponseHeader) {\n      const setHeader = res['setHeader'] as ((name: string, value: string) => void) | undefined;\n      if (typeof setHeader === 'function') {\n        setHeader.call(res, header, correlationId);\n      }\n    }\n\n    const ctx: CorrelationContext = {\n      correlationId,\n      ...(originService !== undefined ? { originService } : {}),\n    };\n\n    LogixiaContext.run(ctx, next);\n  };\n}\n\n// ── Fastify hook ──────────────────────────────────────────────────────────────\n\n/**\n * Fastify `onRequest` lifecycle hook — same functionality as `correlationMiddleware`\n * but adapted to Fastify's hook API.\n *\n * @example\n * ```ts\n * import { correlationFastifyHook } from 'logixia/correlation';\n * fastify.addHook('onRequest', correlationFastifyHook());\n * ```\n */\nexport function correlationFastifyHook(options: CorrelationMiddlewareOptions = {}) {\n  const {\n    header = 'x-correlation-id',\n    originServiceHeader = 'x-origin-service',\n    generate = generateCorrelationId,\n    setResponseHeader = true,\n  } = options;\n\n  return function logixiaCorrelationFastifyHook(\n    request: Record<string, unknown>,\n    reply: Record<string, unknown>,\n    done: () => void\n  ): void {\n    const headers = (request['headers'] ?? {}) as Record<string, string | undefined>;\n\n    // Node lower-cases incoming header names, so look up with lower-cased keys.\n    const correlationId = validIncomingId(headers[header.toLowerCase()]) ?? generate();\n    const originService = headers[originServiceHeader.toLowerCase()];\n\n    if (setResponseHeader) {\n      const replyHeader = reply['header'] as ((name: string, value: string) => void) | undefined;\n      if (typeof replyHeader === 'function') {\n        replyHeader.call(reply, header, correlationId);\n      }\n    }\n\n    const ctx: CorrelationContext = {\n      correlationId,\n      ...(originService !== undefined ? { originService } : {}),\n    };\n\n    LogixiaContext.run(ctx, done);\n  };\n}\n\n// ── Outbound fetch wrapper ────────────────────────────────────────────────────\n\n/**\n * A drop-in replacement for `fetch` that automatically injects the current\n * `correlationId` from `LogixiaContext` as an `X-Correlation-ID` request header.\n *\n * Falls back to the global `fetch` when no correlation context is active.\n *\n * @example\n * ```ts\n * import { correlationFetch } from 'logixia/correlation';\n *\n * // Inside a request handler with correlationMiddleware active:\n * const response = await correlationFetch('https://payments.internal/v1/charge', {\n *   method: 'POST',\n *   body: JSON.stringify({ amount: 100 }),\n * });\n * ```\n */\nexport async function correlationFetch(\n  input: string | URL | Request,\n  init: RequestInit = {},\n  options: { header?: string } = {}\n): Promise<Response> {\n  const header = options.header ?? 'x-correlation-id';\n  const correlationId = getCurrentCorrelationId();\n\n  // `init.headers` can be a plain object, a `Headers` instance, or an array of\n  // `[name, value]` tuples. Spreading it into a plain object loses everything\n  // but the object form: a `Headers` instance has no own enumerable properties,\n  // and an array spread yields numeric indices. `Headers` accepts all three, is\n  // case-insensitive, and is the shape `fetch` expects back.\n  //\n  // A `Request` carries headers of its own, and `fetch(request, { headers })`\n  // replaces them rather than merging them, so they are seeded first and the\n  // caller's `init.headers` is applied on top. Without this, accepting a\n  // `Request` here would drop its headers, which is the same defect one input\n  // shape over.\n  const headers = new Headers(input instanceof Request ? input.headers : undefined);\n  for (const [name, value] of new Headers(init.headers)) {\n    headers.set(name, value);\n  }\n  if (correlationId && !headers.has(header)) {\n    headers.set(header, correlationId);\n  }\n\n  return globalThis.fetch(input, { ...init, headers });\n}\n\n// ── Axios interceptor factory ─────────────────────────────────────────────────\n\n/**\n * Returns an axios request interceptor that automatically injects the current\n * correlation ID into outgoing axios requests.\n *\n * @example\n * ```ts\n * import axios from 'axios';\n * import { createCorrelationAxiosInterceptor } from 'logixia/correlation';\n *\n * axios.interceptors.request.use(createCorrelationAxiosInterceptor());\n * ```\n */\nexport function createCorrelationAxiosInterceptor(\n  options: { header?: string } = {}\n): (config: Record<string, unknown>) => Record<string, unknown> {\n  const header = options.header ?? 'x-correlation-id';\n\n  return function correlationAxiosInterceptor(\n    config: Record<string, unknown>\n  ): Record<string, unknown> {\n    const correlationId = getCurrentCorrelationId();\n    if (!correlationId) return config;\n\n    const headers = (config['headers'] ?? {}) as Record<string, unknown>;\n    if (!headers[header]) {\n      headers[header] = correlationId;\n    }\n\n    return { ...config, headers };\n  };\n}\n\n// ── Child logger from request ─────────────────────────────────────────────────\n\n/**\n * Create a child logger enriched with all correlation-relevant identifiers\n * extracted from the incoming HTTP request.\n *\n * The child logger's every call automatically includes:\n * `correlationId`, `requestId`, `method`, `url`, `userAgent`, `ip`\n *\n * @example\n * ```ts\n * import { childFromRequest } from 'logixia/correlation';\n * import { logger } from 'logixia';\n *\n * app.use((req, res, next) => {\n *   req.logger = childFromRequest(req, logger);\n *   next();\n * });\n *\n * app.get('/orders', (req, res) => {\n *   req.logger.info('Listing orders');  // → correlationId, requestId, method, url ...\n * });\n * ```\n */\nexport function childFromRequest<TLogger extends { child(ctx: Record<string, unknown>): TLogger }>(\n  req: Record<string, unknown>,\n  logger: TLogger,\n  options: { correlationHeader?: string } = {}\n): TLogger {\n  const correlationHeader = options.correlationHeader ?? 'x-correlation-id';\n\n  const headers = (req['headers'] ?? {}) as Record<string, string | undefined>;\n  // Node lower-cases incoming header names, so look up with a lower-cased key.\n  const correlationId =\n    validIncomingId(headers[correlationHeader.toLowerCase()]) ??\n    getCurrentCorrelationId() ??\n    generateCorrelationId();\n\n  const method = req['method'] as string | undefined;\n  const url = (req['url'] as string | undefined) ?? (req['originalUrl'] as string | undefined);\n  const userAgent = headers['user-agent'];\n  const ip =\n    (headers['x-forwarded-for'] as string | undefined)?.split(',')[0]?.trim() ??\n    ((req['socket'] as Record<string, unknown> | undefined)?.['remoteAddress'] as\n      string | undefined);\n\n  return logger.child({\n    correlationId,\n    ...(method !== undefined ? { method } : {}),\n    ...(url !== undefined ? { url } : {}),\n    ...(userAgent !== undefined ? { userAgent } : {}),\n    ...(ip !== undefined ? { ip } : {}),\n  });\n}\n\n// ── Message queue helpers ─────────────────────────────────────────────────────\n\n/**\n * Extract a correlation context from a Kafka / RabbitMQ / SQS message object.\n *\n * Looks for `correlationId`, `correlation_id`, or `x-correlation-id` in\n * `message.headers` (Kafka) or `message.MessageAttributes` (SQS).\n *\n * @example Kafka consumer\n * ```ts\n * import { extractMessageCorrelationId, withCorrelationId } from 'logixia/correlation';\n *\n * consumer.run({\n *   eachMessage: async ({ message }) => {\n *     const correlationId = extractMessageCorrelationId(message);\n *     await withCorrelationId(correlationId, () => processMessage(message));\n *   },\n * });\n * ```\n */\nexport function extractMessageCorrelationId(message: Record<string, unknown>): string | undefined {\n  // Kafka: message.headers is Record<string, Buffer | string>\n  const kafkaHeaders = message['headers'] as Record<string, Buffer | string> | undefined;\n  if (kafkaHeaders) {\n    const raw =\n      kafkaHeaders['x-correlation-id'] ??\n      kafkaHeaders['correlationId'] ??\n      kafkaHeaders['correlation_id'];\n    if (raw !== undefined) {\n      return Buffer.isBuffer(raw) ? raw.toString('utf8') : String(raw);\n    }\n  }\n\n  // SQS: message.MessageAttributes\n  const sqsAttrs = message['MessageAttributes'] as\n    Record<string, { StringValue?: string }> | undefined;\n  if (sqsAttrs) {\n    return (\n      sqsAttrs['x-correlation-id']?.StringValue ??\n      sqsAttrs['correlationId']?.StringValue ??\n      sqsAttrs['correlation_id']?.StringValue\n    );\n  }\n\n  // AMQP / generic envelope\n  return (\n    (message['correlationId'] as string | undefined) ??\n    (message['correlation_id'] as string | undefined)\n  );\n}\n\n/**\n * Build Kafka message headers containing the current correlation context.\n *\n * @example\n * ```ts\n * import { buildKafkaCorrelationHeaders } from 'logixia/correlation';\n *\n * await producer.send({\n *   topic: 'orders',\n *   messages: [{ value: JSON.stringify(order), headers: buildKafkaCorrelationHeaders() }],\n * });\n * ```\n */\nexport function buildKafkaCorrelationHeaders(): Record<string, string> {\n  const ctx = LogixiaContext.get();\n  const headers: Record<string, string> = {};\n\n  const correlationId = ctx?.correlationId as string | undefined;\n  if (correlationId) headers['x-correlation-id'] = correlationId;\n\n  const traceId = ctx?.traceId as string | undefined;\n  if (traceId) headers['x-trace-id'] = traceId;\n\n  return headers;\n}\n"],"mappings":";;;;;;;;;;;;;;;;AAyGA,SAAgB,wBAAgC;AAC9C,KAAI,OAAO,WAAW,eAAe,OAAO,OAAO,eAAe,WAChE,QAAO,OAAO,YAAY;AAE5B,qCAAmB;;AAGrB,MAAM,yBAAyB;AAC/B,MAAM,oBAAoB;;;;;;;AAQ1B,SAAS,gBAAgB,OAA+C;AACtE,KAAI,UAAU,UAAa,MAAM,SAAS,uBAAwB,QAAO;AACzE,QAAO,kBAAkB,KAAK,MAAM,GAAG,QAAQ;;;;;;AASjD,SAAgB,0BAA8C;CAC5D,MAAM,MAAMA,qCAAe,KAAK;AAChC,kDAAO,IAAK;;;;;;;;;;;;;;;AAgBd,SAAgB,kBAAqB,eAAmC,UAAsB;CAC5F,MAAM,KAAK,iBAAiB,uBAAuB;AACnD,QAAOA,qCAAe,IAAI,EAAE,eAAe,IAAI,EAAE,SAAS;;;;;;;;;;;;;;;AAkB5D,SAAgB,sBAAsB,UAAwC,EAAE,EAAE;CAChF,MAAM,EACJ,SAAS,oBACT,sBAAsB,oBACtB,WAAW,uBACX,oBAAoB,SAClB;AAEJ,QAAO,SAAS,6BACd,KACA,KACA,MACM;EACN,MAAM,UAAW,IAAI,cAAc,EAAE;EAGrC,MAAM,gBAAgB,gBAAgB,QAAQ,OAAO,aAAa,EAAE,IAAI,UAAU;EAClF,MAAM,gBAAgB,QAAQ,oBAAoB,aAAa;AAE/D,MAAI,mBAAmB;GACrB,MAAM,YAAY,IAAI;AACtB,OAAI,OAAO,cAAc,WACvB,WAAU,KAAK,KAAK,QAAQ,cAAc;;EAI9C,MAAMC,MAA0B;GAC9B;GACA,GAAI,kBAAkB,SAAY,EAAE,eAAe,GAAG,EAAE;GACzD;AAED,uCAAe,IAAI,KAAK,KAAK;;;;;;;;;;;;;AAgBjC,SAAgB,uBAAuB,UAAwC,EAAE,EAAE;CACjF,MAAM,EACJ,SAAS,oBACT,sBAAsB,oBACtB,WAAW,uBACX,oBAAoB,SAClB;AAEJ,QAAO,SAAS,8BACd,SACA,OACA,MACM;EACN,MAAM,UAAW,QAAQ,cAAc,EAAE;EAGzC,MAAM,gBAAgB,gBAAgB,QAAQ,OAAO,aAAa,EAAE,IAAI,UAAU;EAClF,MAAM,gBAAgB,QAAQ,oBAAoB,aAAa;AAE/D,MAAI,mBAAmB;GACrB,MAAM,cAAc,MAAM;AAC1B,OAAI,OAAO,gBAAgB,WACzB,aAAY,KAAK,OAAO,QAAQ,cAAc;;EAIlD,MAAMA,MAA0B;GAC9B;GACA,GAAI,kBAAkB,SAAY,EAAE,eAAe,GAAG,EAAE;GACzD;AAED,uCAAe,IAAI,KAAK,KAAK;;;;;;;;;;;;;;;;;;;;AAuBjC,eAAsB,iBACpB,OACA,OAAoB,EAAE,EACtB,UAA+B,EAAE,EACd;CACnB,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,gBAAgB,yBAAyB;CAa/C,MAAM,UAAU,IAAI,QAAQ,iBAAiB,UAAU,MAAM,UAAU,OAAU;AACjF,MAAK,MAAM,CAAC,MAAM,UAAU,IAAI,QAAQ,KAAK,QAAQ,CACnD,SAAQ,IAAI,MAAM,MAAM;AAE1B,KAAI,iBAAiB,CAAC,QAAQ,IAAI,OAAO,CACvC,SAAQ,IAAI,QAAQ,cAAc;AAGpC,QAAO,WAAW,MAAM,OAAO;EAAE,GAAG;EAAM;EAAS,CAAC;;;;;;;;;;;;;;AAiBtD,SAAgB,kCACd,UAA+B,EAAE,EAC6B;CAC9D,MAAM,SAAS,QAAQ,UAAU;AAEjC,QAAO,SAAS,4BACd,QACyB;EACzB,MAAM,gBAAgB,yBAAyB;AAC/C,MAAI,CAAC,cAAe,QAAO;EAE3B,MAAM,UAAW,OAAO,cAAc,EAAE;AACxC,MAAI,CAAC,QAAQ,QACX,SAAQ,UAAU;AAGpB,SAAO;GAAE,GAAG;GAAQ;GAAS;;;;;;;;;;;;;;;;;;;;;;;;;AA4BjC,SAAgB,iBACd,KACA,QACA,UAA0C,EAAE,EACnC;;CACT,MAAM,oBAAoB,QAAQ,qBAAqB;CAEvD,MAAM,UAAW,IAAI,cAAc,EAAE;CAErC,MAAM,gBACJ,gBAAgB,QAAQ,kBAAkB,aAAa,EAAE,IACzD,yBAAyB,IACzB,uBAAuB;CAEzB,MAAM,SAAS,IAAI;CACnB,MAAM,MAAO,IAAI,UAAkC,IAAI;CACvD,MAAM,YAAY,QAAQ;CAC1B,MAAM,6BACH,QAAQ,6GAA2C,MAAM,IAAI,CAAC,8EAAI,MAAM,qBACvE,IAAI,qEAAoD;AAG5D,QAAO,OAAO,MAAM;EAClB;EACA,GAAI,WAAW,SAAY,EAAE,QAAQ,GAAG,EAAE;EAC1C,GAAI,QAAQ,SAAY,EAAE,KAAK,GAAG,EAAE;EACpC,GAAI,cAAc,SAAY,EAAE,WAAW,GAAG,EAAE;EAChD,GAAI,OAAO,SAAY,EAAE,IAAI,GAAG,EAAE;EACnC,CAAC;;;;;;;;;;;;;;;;;;;;AAuBJ,SAAgB,4BAA4B,SAAsD;CAEhG,MAAM,eAAe,QAAQ;AAC7B,KAAI,cAAc;EAChB,MAAM,MACJ,aAAa,uBACb,aAAa,oBACb,aAAa;AACf,MAAI,QAAQ,OACV,QAAO,OAAO,SAAS,IAAI,GAAG,IAAI,SAAS,OAAO,GAAG,OAAO,IAAI;;CAKpE,MAAM,WAAW,QAAQ;AAEzB,KAAI,UAAU;;AACZ,kCACE,SAAS,iGAAqB,0CAC9B,SAAS,gGAAkB,2CAC3B,SAAS,mGAAmB;;AAKhC,QACG,QAAQ,oBACR,QAAQ;;;;;;;;;;;;;;;AAiBb,SAAgB,+BAAuD;CACrE,MAAM,MAAMD,qCAAe,KAAK;CAChC,MAAME,UAAkC,EAAE;CAE1C,MAAM,0DAAgB,IAAK;AAC3B,KAAI,cAAe,SAAQ,sBAAsB;CAEjD,MAAM,oDAAU,IAAK;AACrB,KAAI,QAAS,SAAQ,gBAAgB;AAErC,QAAO"}
+{"version":3,"file":"correlation.js","names":["sanitizeIncomingId","LogixiaContext","ctx: CorrelationContext","headers: Record<string, string>"],"sources":["../src/correlation.ts"],"sourcesContent":["/**\n * logixia — Microservices Correlation ID Propagation\n *\n * Provides zero-boilerplate correlation ID generation and propagation for\n * distributed systems. A single correlation ID travels through every service\n * in a request fan-out, making it trivial to join logs across services.\n *\n * Features:\n *  - UUID v4 correlation ID generation (via `crypto.randomUUID()`)\n *  - Express / Fastify / NestJS incoming-request middleware\n *  - `correlationFetch()` — wraps global `fetch`, auto-injects `X-Correlation-ID`\n *  - `createCorrelationAxiosInterceptor()` — axios request interceptor\n *  - `childFromRequest(req, logger)` — child logger with all request identifiers\n *  - Kafka / SQS / RabbitMQ message context helpers\n *  - Integration with `LogixiaContext` (AsyncLocalStorage) so every `logger.info()`\n *    call automatically includes the correlationId without per-call passing.\n *\n * @example Express middleware\n * ```ts\n * import { correlationMiddleware } from 'logixia/correlation';\n * import { logger } from 'logixia';\n *\n * app.use(correlationMiddleware());\n *\n * app.get('/orders', (req, res) => {\n *   // correlationId is automatically in every log inside this request\n *   logger.info('Listing orders');\n *   res.json({ ok: true });\n * });\n * ```\n *\n * @example Outbound fetch with correlation\n * ```ts\n * import { correlationFetch } from 'logixia/correlation';\n *\n * // Reads correlationId from current LogixiaContext and injects it as header\n * const data = await correlationFetch('https://payments.internal/charge', {\n *   method: 'POST',\n *   body: JSON.stringify({ amount: 100 }),\n * });\n * ```\n *\n * @example Manual correlation context\n * ```ts\n * import { withCorrelationId } from 'logixia/correlation';\n *\n * await withCorrelationId('trace-abc-123', async () => {\n *   // All logs and outbound fetch calls in here carry 'trace-abc-123'\n *   await processOrder();\n * });\n * ```\n */\n\nimport { randomUUID } from 'node:crypto';\n\nimport { LogixiaContext } from './context/async-context';\nimport { sanitizeIncomingId } from './utils/trace.utils';\n\n// ── Types ─────────────────────────────────────────────────────────────────────\n\n/** Fields injected into the log context by the correlation middleware. */\nexport interface CorrelationContext {\n  correlationId: string;\n  traceId?: string;\n  /** Service that originated the request (from `X-Origin-Service` header). */\n  originService?: string;\n  /** Index signature so CorrelationContext is assignable to LogContext. */\n  [key: string]: unknown;\n}\n\nexport interface CorrelationMiddlewareOptions {\n  /**\n   * HTTP header to read/write the correlation ID from/to.\n   * @default 'x-correlation-id'\n   */\n  header?: string;\n  /**\n   * HTTP header for the originating service name.\n   * @default 'x-origin-service'\n   */\n  originServiceHeader?: string;\n  /**\n   * Function to generate a new correlation ID when none is present in the request.\n   * @default () => crypto.randomUUID()\n   */\n  generate?: () => string;\n  /**\n   * When `false`, the incoming correlation header is ignored and a new ID is\n   * always generated. Use this at the edge when client-supplied IDs should not\n   * be trusted.\n   * @default true\n   */\n  trustIncoming?: boolean;\n  /**\n   * When `true`, the response will include the correlation ID header so\n   * clients can log it client-side.\n   * @default true\n   */\n  setResponseHeader?: boolean;\n}\n\n// ── ID generation ─────────────────────────────────────────────────────────────\n\n/**\n * Generate a new correlation ID using `crypto.randomUUID()` (available in\n * Node.js 14.17+, all modern browsers, and Edge runtimes).\n *\n * When the Web Crypto global is unavailable (e.g. Node 18 without\n * `--experimental-global-webcrypto`), fall back to `node:crypto`'s\n * `randomUUID`, which returns a proper UUID v4 — matching the shape this\n * function's JSDoc and README promise. `logixia/correlation` is Node-only\n * (it builds on `AsyncLocalStorage`), so importing `node:crypto` is safe here.\n */\nexport function generateCorrelationId(): string {\n  if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function') {\n    return crypto.randomUUID();\n  }\n  return randomUUID();\n}\n\n/**\n * Return an incoming correlation ID only if it is short and made of safe\n * characters. Anything else (over-long, empty, or containing newlines or other\n * control characters) is dropped so the caller generates a fresh ID instead of\n * writing client-supplied text into every log line.\n */\nfunction validIncomingId(value: unknown): string | undefined {\n  if (typeof value === 'string' && value.trim() !== value) return undefined;\n  return sanitizeIncomingId(value);\n}\n\n// ── Context helpers ───────────────────────────────────────────────────────────\n\n/**\n * Return the correlation ID from the current `LogixiaContext`, or `undefined`\n * when called outside any context scope.\n */\nexport function getCurrentCorrelationId(): string | undefined {\n  const ctx = LogixiaContext.get();\n  return ctx?.correlationId as string | undefined;\n}\n\n/**\n * Run `callback` inside a correlation context scope.\n *\n * If a correlation ID is not provided, a new UUID is generated.\n *\n * @example\n * ```ts\n * await withCorrelationId('cid-abc', async () => {\n *   logger.info('Processing message'); // → { correlationId: 'cid-abc', ... }\n *   await callDownstream();            // correlationFetch() picks up cid-abc\n * });\n * ```\n */\nexport function withCorrelationId<T>(correlationId: string | undefined, callback: () => T): T {\n  const id = correlationId ?? generateCorrelationId();\n  return LogixiaContext.run({ correlationId: id }, callback);\n}\n\n// ── Express / Connect middleware ──────────────────────────────────────────────\n\n/**\n * Express-compatible middleware that:\n * 1. Reads `X-Correlation-ID` from the incoming request (or generates a new one)\n * 2. Wraps the request in a `LogixiaContext` so all loggers in the handler\n *    automatically include `correlationId`\n * 3. Writes the correlation ID back to the response header (opt-out via options)\n *\n * @example\n * ```ts\n * import { correlationMiddleware } from 'logixia/correlation';\n * app.use(correlationMiddleware());\n * ```\n */\nexport function correlationMiddleware(options: CorrelationMiddlewareOptions = {}) {\n  const {\n    header = 'x-correlation-id',\n    originServiceHeader = 'x-origin-service',\n    generate = generateCorrelationId,\n    trustIncoming = true,\n    setResponseHeader = true,\n  } = options;\n\n  return function logixiaCorrelationMiddleware(\n    req: Record<string, unknown>,\n    res: Record<string, unknown>,\n    next: () => void\n  ): void {\n    const headers = (req['headers'] ?? {}) as Record<string, string | undefined>;\n\n    // Node lower-cases incoming header names, so look up with lower-cased keys.\n    const incomingId = trustIncoming ? validIncomingId(headers[header.toLowerCase()]) : undefined;\n    const correlationId = incomingId ?? generate();\n    const originService = validIncomingId(headers[originServiceHeader.toLowerCase()]);\n\n    if (setResponseHeader) {\n      const setHeader = res['setHeader'] as ((name: string, value: string) => void) | undefined;\n      if (typeof setHeader === 'function') {\n        setHeader.call(res, header, correlationId);\n      }\n    }\n\n    const ctx: CorrelationContext = {\n      correlationId,\n      ...(originService !== undefined ? { originService } : {}),\n    };\n\n    LogixiaContext.run(ctx, next);\n  };\n}\n\n// ── Fastify hook ──────────────────────────────────────────────────────────────\n\n/**\n * Fastify `onRequest` lifecycle hook — same functionality as `correlationMiddleware`\n * but adapted to Fastify's hook API.\n *\n * @example\n * ```ts\n * import { correlationFastifyHook } from 'logixia/correlation';\n * fastify.addHook('onRequest', correlationFastifyHook());\n * ```\n */\nexport function correlationFastifyHook(options: CorrelationMiddlewareOptions = {}) {\n  const {\n    header = 'x-correlation-id',\n    originServiceHeader = 'x-origin-service',\n    generate = generateCorrelationId,\n    trustIncoming = true,\n    setResponseHeader = true,\n  } = options;\n\n  return function logixiaCorrelationFastifyHook(\n    request: Record<string, unknown>,\n    reply: Record<string, unknown>,\n    done: () => void\n  ): void {\n    const headers = (request['headers'] ?? {}) as Record<string, string | undefined>;\n\n    // Node lower-cases incoming header names, so look up with lower-cased keys.\n    const incomingId = trustIncoming ? validIncomingId(headers[header.toLowerCase()]) : undefined;\n    const correlationId = incomingId ?? generate();\n    const originService = validIncomingId(headers[originServiceHeader.toLowerCase()]);\n\n    if (setResponseHeader) {\n      const replyHeader = reply['header'] as ((name: string, value: string) => void) | undefined;\n      if (typeof replyHeader === 'function') {\n        replyHeader.call(reply, header, correlationId);\n      }\n    }\n\n    const ctx: CorrelationContext = {\n      correlationId,\n      ...(originService !== undefined ? { originService } : {}),\n    };\n\n    LogixiaContext.run(ctx, done);\n  };\n}\n\n// ── Outbound fetch wrapper ────────────────────────────────────────────────────\n\n/**\n * A drop-in replacement for `fetch` that automatically injects the current\n * `correlationId` from `LogixiaContext` as an `X-Correlation-ID` request header.\n *\n * Falls back to the global `fetch` when no correlation context is active.\n *\n * @example\n * ```ts\n * import { correlationFetch } from 'logixia/correlation';\n *\n * // Inside a request handler with correlationMiddleware active:\n * const response = await correlationFetch('https://payments.internal/v1/charge', {\n *   method: 'POST',\n *   body: JSON.stringify({ amount: 100 }),\n * });\n * ```\n */\nexport async function correlationFetch(\n  input: string | URL | Request,\n  init: RequestInit = {},\n  options: { header?: string } = {}\n): Promise<Response> {\n  const header = options.header ?? 'x-correlation-id';\n  const correlationId = getCurrentCorrelationId();\n\n  // `init.headers` can be a plain object, a `Headers` instance, or an array of\n  // `[name, value]` tuples. Spreading it into a plain object loses everything\n  // but the object form: a `Headers` instance has no own enumerable properties,\n  // and an array spread yields numeric indices. `Headers` accepts all three, is\n  // case-insensitive, and is the shape `fetch` expects back.\n  //\n  // A `Request` carries headers of its own, and `fetch(request, { headers })`\n  // replaces them rather than merging them, so they are seeded first and the\n  // caller's `init.headers` is applied on top. Without this, accepting a\n  // `Request` here would drop its headers, which is the same defect one input\n  // shape over.\n  const headers = new Headers(input instanceof Request ? input.headers : undefined);\n  for (const [name, value] of new Headers(init.headers)) {\n    headers.set(name, value);\n  }\n  if (correlationId && !headers.has(header)) {\n    headers.set(header, correlationId);\n  }\n\n  return globalThis.fetch(input, { ...init, headers });\n}\n\n// ── Axios interceptor factory ─────────────────────────────────────────────────\n\n/**\n * Returns an axios request interceptor that automatically injects the current\n * correlation ID into outgoing axios requests.\n *\n * @example\n * ```ts\n * import axios from 'axios';\n * import { createCorrelationAxiosInterceptor } from 'logixia/correlation';\n *\n * axios.interceptors.request.use(createCorrelationAxiosInterceptor());\n * ```\n */\nexport function createCorrelationAxiosInterceptor(\n  options: { header?: string } = {}\n): (config: Record<string, unknown>) => Record<string, unknown> {\n  const header = options.header ?? 'x-correlation-id';\n\n  return function correlationAxiosInterceptor(\n    config: Record<string, unknown>\n  ): Record<string, unknown> {\n    const correlationId = getCurrentCorrelationId();\n    if (!correlationId) return config;\n\n    const headers = (config['headers'] ?? {}) as Record<string, unknown>;\n    if (!headers[header]) {\n      headers[header] = correlationId;\n    }\n\n    return { ...config, headers };\n  };\n}\n\n// ── Child logger from request ─────────────────────────────────────────────────\n\nconst MAX_USER_AGENT_LENGTH = 512;\nconst MAX_IP_LENGTH = 64;\n\nexport interface ChildFromRequestOptions {\n  /** Header to read the correlation ID from. @default 'x-correlation-id' */\n  correlationHeader?: string;\n  /**\n   * Take the client IP from the first `X-Forwarded-For` entry. Only enable this\n   * when the app sits behind a proxy that overwrites the header; otherwise any\n   * client can choose the logged IP.\n   * @default false\n   */\n  trustProxy?: boolean;\n  /**\n   * Context name passed as the first argument to `logger.child(context, data)`.\n   * When omitted, logixia loggers (detected by their `getContext` /\n   * `getAvailableTransports` methods) get `child('request', fields)` and any other\n   * logger gets `child(fields)`.\n   */\n  childContext?: string;\n}\n\n/**\n * Create a child logger enriched with all correlation-relevant identifiers\n * extracted from the incoming HTTP request.\n *\n * The child logger's every call automatically includes:\n * `correlationId`, `method`, `url`, `userAgent`, `ip`\n *\n * The IP comes from `req.ip` / the socket address unless `trustProxy` is set.\n *\n * @example\n * ```ts\n * import { childFromRequest } from 'logixia/correlation';\n * import { logger } from 'logixia';\n *\n * app.use((req, res, next) => {\n *   req.logger = childFromRequest(req, logger);\n *   next();\n * });\n *\n * app.get('/orders', (req, res) => {\n *   req.logger.info('Listing orders');  // → correlationId, requestId, method, url ...\n * });\n * ```\n */\nexport function childFromRequest<TLogger extends { child(...args: never[]): TLogger }>(\n  req: Record<string, unknown>,\n  logger: TLogger,\n  options: ChildFromRequestOptions = {}\n): TLogger {\n  const correlationHeader = options.correlationHeader ?? 'x-correlation-id';\n\n  const headers = (req['headers'] ?? {}) as Record<string, string | undefined>;\n  // Node lower-cases incoming header names, so look up with a lower-cased key.\n  const correlationId =\n    validIncomingId(headers[correlationHeader.toLowerCase()]) ??\n    getCurrentCorrelationId() ??\n    generateCorrelationId();\n\n  const method = req['method'] as string | undefined;\n  const url = (req['url'] as string | undefined) ?? (req['originalUrl'] as string | undefined);\n  const rawUserAgent = headers['user-agent'];\n  const userAgent =\n    typeof rawUserAgent === 'string' ? rawUserAgent.slice(0, MAX_USER_AGENT_LENGTH) : undefined;\n  const ip = resolveClientIp(req, headers, options.trustProxy === true);\n\n  const fields = {\n    correlationId,\n    ...(method !== undefined ? { method } : {}),\n    ...(url !== undefined ? { url } : {}),\n    ...(userAgent !== undefined ? { userAgent } : {}),\n    ...(ip !== undefined ? { ip } : {}),\n  };\n\n  const child = logger.child as (...args: unknown[]) => TLogger;\n  if (options.childContext !== undefined) {\n    return child.call(logger, options.childContext, fields);\n  }\n  // logixia's ILogger.child(context: string, data?) takes a string namespace;\n  // pino/winston-style loggers take a bindings object.\n  if (usesStringContext(logger)) {\n    return child.call(logger, 'request', fields);\n  }\n  return child.call(logger, fields);\n}\n\n/** ILogger implementations (LogixiaLogger, LogixiaLoggerService, mock logger) expose these methods. */\nfunction usesStringContext(logger: object): boolean {\n  const l = logger as Record<string, unknown>;\n  return typeof l['getContext'] === 'function' || typeof l['getAvailableTransports'] === 'function';\n}\n\nfunction resolveClientIp(\n  req: Record<string, unknown>,\n  headers: Record<string, string | undefined>,\n  trustProxy: boolean\n): string | undefined {\n  if (trustProxy) {\n    const forwarded = headers['x-forwarded-for'];\n    const first = typeof forwarded === 'string' ? forwarded.split(',')[0]?.trim() : undefined;\n    if (first) return first.slice(0, MAX_IP_LENGTH);\n  }\n  const fromReq = req['ip'];\n  if (typeof fromReq === 'string' && fromReq) return fromReq.slice(0, MAX_IP_LENGTH);\n  const remote = (req['socket'] as Record<string, unknown> | undefined)?.['remoteAddress'];\n  return typeof remote === 'string' ? remote.slice(0, MAX_IP_LENGTH) : undefined;\n}\n\n// ── Message queue helpers ─────────────────────────────────────────────────────\n\n/**\n * Extract a correlation context from a Kafka / RabbitMQ / SQS message object.\n *\n * Looks for `correlationId`, `correlation_id`, or `x-correlation-id` in\n * `message.headers` (Kafka) or `message.MessageAttributes` (SQS).\n *\n * @example Kafka consumer\n * ```ts\n * import { extractMessageCorrelationId, withCorrelationId } from 'logixia/correlation';\n *\n * consumer.run({\n *   eachMessage: async ({ message }) => {\n *     const correlationId = extractMessageCorrelationId(message);\n *     await withCorrelationId(correlationId, () => processMessage(message));\n *   },\n * });\n * ```\n */\nexport function extractMessageCorrelationId(message: Record<string, unknown>): string | undefined {\n  // Kafka: message.headers is Record<string, Buffer | string>\n  const kafkaHeaders = message['headers'] as Record<string, Buffer | string> | undefined;\n  if (kafkaHeaders) {\n    const raw =\n      kafkaHeaders['x-correlation-id'] ??\n      kafkaHeaders['correlationId'] ??\n      kafkaHeaders['correlation_id'];\n    if (raw !== undefined) {\n      return validIncomingId(Buffer.isBuffer(raw) ? raw.toString('utf8', 0, 512) : String(raw));\n    }\n  }\n\n  // SQS: message.MessageAttributes\n  const sqsAttrs = message['MessageAttributes'] as\n    Record<string, { StringValue?: string }> | undefined;\n  if (sqsAttrs) {\n    return validIncomingId(\n      sqsAttrs['x-correlation-id']?.StringValue ??\n        sqsAttrs['correlationId']?.StringValue ??\n        sqsAttrs['correlation_id']?.StringValue\n    );\n  }\n\n  // AMQP / generic envelope\n  return validIncomingId(message['correlationId'] ?? message['correlation_id']);\n}\n\n/**\n * Build Kafka message headers containing the current correlation context.\n *\n * @example\n * ```ts\n * import { buildKafkaCorrelationHeaders } from 'logixia/correlation';\n *\n * await producer.send({\n *   topic: 'orders',\n *   messages: [{ value: JSON.stringify(order), headers: buildKafkaCorrelationHeaders() }],\n * });\n * ```\n */\nexport function buildKafkaCorrelationHeaders(): Record<string, string> {\n  const ctx = LogixiaContext.get();\n  const headers: Record<string, string> = {};\n\n  const correlationId = ctx?.correlationId as string | undefined;\n  if (correlationId) headers['x-correlation-id'] = correlationId;\n\n  const traceId = ctx?.traceId as string | undefined;\n  if (traceId) headers['x-trace-id'] = traceId;\n\n  return headers;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAiHA,SAAgB,wBAAgC;AAC9C,KAAI,OAAO,WAAW,eAAe,OAAO,OAAO,eAAe,WAChE,QAAO,OAAO,YAAY;AAE5B,qCAAmB;;;;;;;;AASrB,SAAS,gBAAgB,OAAoC;AAC3D,KAAI,OAAO,UAAU,YAAY,MAAM,MAAM,KAAK,MAAO,QAAO;AAChE,QAAOA,uCAAmB,MAAM;;;;;;AASlC,SAAgB,0BAA8C;CAC5D,MAAM,MAAMC,qCAAe,KAAK;AAChC,kDAAO,IAAK;;;;;;;;;;;;;;;AAgBd,SAAgB,kBAAqB,eAAmC,UAAsB;CAC5F,MAAM,KAAK,iBAAiB,uBAAuB;AACnD,QAAOA,qCAAe,IAAI,EAAE,eAAe,IAAI,EAAE,SAAS;;;;;;;;;;;;;;;AAkB5D,SAAgB,sBAAsB,UAAwC,EAAE,EAAE;CAChF,MAAM,EACJ,SAAS,oBACT,sBAAsB,oBACtB,WAAW,uBACX,gBAAgB,MAChB,oBAAoB,SAClB;AAEJ,QAAO,SAAS,6BACd,KACA,KACA,MACM;EACN,MAAM,UAAW,IAAI,cAAc,EAAE;EAIrC,MAAM,iBADa,gBAAgB,gBAAgB,QAAQ,OAAO,aAAa,EAAE,GAAG,WAChD,UAAU;EAC9C,MAAM,gBAAgB,gBAAgB,QAAQ,oBAAoB,aAAa,EAAE;AAEjF,MAAI,mBAAmB;GACrB,MAAM,YAAY,IAAI;AACtB,OAAI,OAAO,cAAc,WACvB,WAAU,KAAK,KAAK,QAAQ,cAAc;;EAI9C,MAAMC,MAA0B;GAC9B;GACA,GAAI,kBAAkB,SAAY,EAAE,eAAe,GAAG,EAAE;GACzD;AAED,uCAAe,IAAI,KAAK,KAAK;;;;;;;;;;;;;AAgBjC,SAAgB,uBAAuB,UAAwC,EAAE,EAAE;CACjF,MAAM,EACJ,SAAS,oBACT,sBAAsB,oBACtB,WAAW,uBACX,gBAAgB,MAChB,oBAAoB,SAClB;AAEJ,QAAO,SAAS,8BACd,SACA,OACA,MACM;EACN,MAAM,UAAW,QAAQ,cAAc,EAAE;EAIzC,MAAM,iBADa,gBAAgB,gBAAgB,QAAQ,OAAO,aAAa,EAAE,GAAG,WAChD,UAAU;EAC9C,MAAM,gBAAgB,gBAAgB,QAAQ,oBAAoB,aAAa,EAAE;AAEjF,MAAI,mBAAmB;GACrB,MAAM,cAAc,MAAM;AAC1B,OAAI,OAAO,gBAAgB,WACzB,aAAY,KAAK,OAAO,QAAQ,cAAc;;EAIlD,MAAMA,MAA0B;GAC9B;GACA,GAAI,kBAAkB,SAAY,EAAE,eAAe,GAAG,EAAE;GACzD;AAED,uCAAe,IAAI,KAAK,KAAK;;;;;;;;;;;;;;;;;;;;AAuBjC,eAAsB,iBACpB,OACA,OAAoB,EAAE,EACtB,UAA+B,EAAE,EACd;CACnB,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,gBAAgB,yBAAyB;CAa/C,MAAM,UAAU,IAAI,QAAQ,iBAAiB,UAAU,MAAM,UAAU,OAAU;AACjF,MAAK,MAAM,CAAC,MAAM,UAAU,IAAI,QAAQ,KAAK,QAAQ,CACnD,SAAQ,IAAI,MAAM,MAAM;AAE1B,KAAI,iBAAiB,CAAC,QAAQ,IAAI,OAAO,CACvC,SAAQ,IAAI,QAAQ,cAAc;AAGpC,QAAO,WAAW,MAAM,OAAO;EAAE,GAAG;EAAM;EAAS,CAAC;;;;;;;;;;;;;;AAiBtD,SAAgB,kCACd,UAA+B,EAAE,EAC6B;CAC9D,MAAM,SAAS,QAAQ,UAAU;AAEjC,QAAO,SAAS,4BACd,QACyB;EACzB,MAAM,gBAAgB,yBAAyB;AAC/C,MAAI,CAAC,cAAe,QAAO;EAE3B,MAAM,UAAW,OAAO,cAAc,EAAE;AACxC,MAAI,CAAC,QAAQ,QACX,SAAQ,UAAU;AAGpB,SAAO;GAAE,GAAG;GAAQ;GAAS;;;AAMjC,MAAM,wBAAwB;AAC9B,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;AA6CtB,SAAgB,iBACd,KACA,QACA,UAAmC,EAAE,EAC5B;CACT,MAAM,oBAAoB,QAAQ,qBAAqB;CAEvD,MAAM,UAAW,IAAI,cAAc,EAAE;CAErC,MAAM,gBACJ,gBAAgB,QAAQ,kBAAkB,aAAa,EAAE,IACzD,yBAAyB,IACzB,uBAAuB;CAEzB,MAAM,SAAS,IAAI;CACnB,MAAM,MAAO,IAAI,UAAkC,IAAI;CACvD,MAAM,eAAe,QAAQ;CAC7B,MAAM,YACJ,OAAO,iBAAiB,WAAW,aAAa,MAAM,GAAG,sBAAsB,GAAG;CACpF,MAAM,KAAK,gBAAgB,KAAK,SAAS,QAAQ,eAAe,KAAK;CAErE,MAAM,SAAS;EACb;EACA,GAAI,WAAW,SAAY,EAAE,QAAQ,GAAG,EAAE;EAC1C,GAAI,QAAQ,SAAY,EAAE,KAAK,GAAG,EAAE;EACpC,GAAI,cAAc,SAAY,EAAE,WAAW,GAAG,EAAE;EAChD,GAAI,OAAO,SAAY,EAAE,IAAI,GAAG,EAAE;EACnC;CAED,MAAM,QAAQ,OAAO;AACrB,KAAI,QAAQ,iBAAiB,OAC3B,QAAO,MAAM,KAAK,QAAQ,QAAQ,cAAc,OAAO;AAIzD,KAAI,kBAAkB,OAAO,CAC3B,QAAO,MAAM,KAAK,QAAQ,WAAW,OAAO;AAE9C,QAAO,MAAM,KAAK,QAAQ,OAAO;;;AAInC,SAAS,kBAAkB,QAAyB;CAClD,MAAM,IAAI;AACV,QAAO,OAAO,EAAE,kBAAkB,cAAc,OAAO,EAAE,8BAA8B;;AAGzF,SAAS,gBACP,KACA,SACA,YACoB;;AACpB,KAAI,YAAY;;EACd,MAAM,YAAY,QAAQ;EAC1B,MAAM,QAAQ,OAAO,cAAc,gCAAW,UAAU,MAAM,IAAI,CAAC,0EAAI,MAAM,GAAG;AAChF,MAAI,MAAO,QAAO,MAAM,MAAM,GAAG,cAAc;;CAEjD,MAAM,UAAU,IAAI;AACpB,KAAI,OAAO,YAAY,YAAY,QAAS,QAAO,QAAQ,MAAM,GAAG,cAAc;CAClF,MAAM,wBAAU,IAAI,qEAAoD;AACxE,QAAO,OAAO,WAAW,WAAW,OAAO,MAAM,GAAG,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;AAuBvE,SAAgB,4BAA4B,SAAsD;CAEhG,MAAM,eAAe,QAAQ;AAC7B,KAAI,cAAc;EAChB,MAAM,MACJ,aAAa,uBACb,aAAa,oBACb,aAAa;AACf,MAAI,QAAQ,OACV,QAAO,gBAAgB,OAAO,SAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,GAAG,IAAI,GAAG,OAAO,IAAI,CAAC;;CAK7F,MAAM,WAAW,QAAQ;AAEzB,KAAI,UAAU;;AACZ,SAAO,yCACL,SAAS,iGAAqB,0CAC5B,SAAS,gGAAkB,2CAC3B,SAAS,mGAAmB,aAC/B;;AAIH,QAAO,gBAAgB,QAAQ,oBAAoB,QAAQ,kBAAkB;;;;;;;;;;;;;;;AAgB/E,SAAgB,+BAAuD;CACrE,MAAM,MAAMD,qCAAe,KAAK;CAChC,MAAME,UAAkC,EAAE;CAE1C,MAAM,0DAAgB,IAAK;AAC3B,KAAI,cAAe,SAAQ,sBAAsB;CAEjD,MAAM,oDAAU,IAAK;AACrB,KAAI,QAAS,SAAQ,gBAAgB;AAErC,QAAO"}

package/dist/correlation.mjs

@@ -1,4 +1,5 @@
-import { t as LogixiaContext } from "./async-context-CwBNMm2E.mjs";
+import { d as sanitizeIncomingId } from "./trace.utils-CvXgaiQT.mjs";
+import { t as LogixiaContext } from "./async-context-BzJrbfQs.mjs";
 import { randomUUID } from "node:crypto";
 
 //#region src/correlation.ts
@@ -16,8 +17,6 @@ function generateCorrelationId() {
 	if (typeof crypto !== "undefined" && typeof crypto.randomUUID === "function") return crypto.randomUUID();
 	return randomUUID();
 }
-const MAX_INCOMING_ID_LENGTH = 128;
-const VALID_INCOMING_ID = /^[A-Za-z0-9._:-]+$/;
 /**
 * Return an incoming correlation ID only if it is short and made of safe
 * characters. Anything else (over-long, empty, or containing newlines or other
@@ -25,8 +24,8 @@ const VALID_INCOMING_ID = /^[A-Za-z0-9._:-]+$/;
 * writing client-supplied text into every log line.
 */
 function validIncomingId(value) {
-	if (value === void 0 || value.length > MAX_INCOMING_ID_LENGTH) return void 0;
-	return VALID_INCOMING_ID.test(value) ? value : void 0;
+	if (typeof value === "string" && value.trim() !== value) return void 0;
+	return sanitizeIncomingId(value);
 }
 /**
 * Return the correlation ID from the current `LogixiaContext`, or `undefined`
@@ -67,11 +66,11 @@ function withCorrelationId(correlationId, callback) {
 * ```
 */
 function correlationMiddleware(options = {}) {
-	const { header = "x-correlation-id", originServiceHeader = "x-origin-service", generate = generateCorrelationId, setResponseHeader = true } = options;
+	const { header = "x-correlation-id", originServiceHeader = "x-origin-service", generate = generateCorrelationId, trustIncoming = true, setResponseHeader = true } = options;
 	return function logixiaCorrelationMiddleware(req, res, next) {
 		const headers = req["headers"] ?? {};
-		const correlationId = validIncomingId(headers[header.toLowerCase()]) ?? generate();
-		const originService = headers[originServiceHeader.toLowerCase()];
+		const correlationId = (trustIncoming ? validIncomingId(headers[header.toLowerCase()]) : void 0) ?? generate();
+		const originService = validIncomingId(headers[originServiceHeader.toLowerCase()]);
 		if (setResponseHeader) {
 			const setHeader = res["setHeader"];
 			if (typeof setHeader === "function") setHeader.call(res, header, correlationId);
@@ -94,11 +93,11 @@ function correlationMiddleware(options = {}) {
 * ```
 */
 function correlationFastifyHook(options = {}) {
-	const { header = "x-correlation-id", originServiceHeader = "x-origin-service", generate = generateCorrelationId, setResponseHeader = true } = options;
+	const { header = "x-correlation-id", originServiceHeader = "x-origin-service", generate = generateCorrelationId, trustIncoming = true, setResponseHeader = true } = options;
 	return function logixiaCorrelationFastifyHook(request, reply, done) {
 		const headers = request["headers"] ?? {};
-		const correlationId = validIncomingId(headers[header.toLowerCase()]) ?? generate();
-		const originService = headers[originServiceHeader.toLowerCase()];
+		const correlationId = (trustIncoming ? validIncomingId(headers[header.toLowerCase()]) : void 0) ?? generate();
+		const originService = validIncomingId(headers[originServiceHeader.toLowerCase()]);
 		if (setResponseHeader) {
 			const replyHeader = reply["header"];
 			if (typeof replyHeader === "function") replyHeader.call(reply, header, correlationId);
@@ -163,12 +162,16 @@ function createCorrelationAxiosInterceptor(options = {}) {
 		};
 	};
 }
+const MAX_USER_AGENT_LENGTH = 512;
+const MAX_IP_LENGTH = 64;
 /**
 * Create a child logger enriched with all correlation-relevant identifiers
 * extracted from the incoming HTTP request.
 *
 * The child logger's every call automatically includes:
-* `correlationId`, `requestId`, `method`, `url`, `userAgent`, `ip`
+* `correlationId`, `method`, `url`, `userAgent`, `ip`
+*
+* The IP comes from `req.ip` / the socket address unless `trustProxy` is set.
 *
 * @example
 * ```ts
@@ -186,21 +189,43 @@ function createCorrelationAxiosInterceptor(options = {}) {
 * ```
 */
 function childFromRequest(req, logger, options = {}) {
-	var _headers$xForwarded, _req$socket;
 	const correlationHeader = options.correlationHeader ?? "x-correlation-id";
 	const headers = req["headers"] ?? {};
 	const correlationId = validIncomingId(headers[correlationHeader.toLowerCase()]) ?? getCurrentCorrelationId() ?? generateCorrelationId();
 	const method = req["method"];
 	const url = req["url"] ?? req["originalUrl"];
-	const userAgent = headers["user-agent"];
-	const ip = ((_headers$xForwarded = headers["x-forwarded-for"]) === null || _headers$xForwarded === void 0 || (_headers$xForwarded = _headers$xForwarded.split(",")[0]) === null || _headers$xForwarded === void 0 ? void 0 : _headers$xForwarded.trim()) ?? ((_req$socket = req["socket"]) === null || _req$socket === void 0 ? void 0 : _req$socket["remoteAddress"]);
-	return logger.child({
+	const rawUserAgent = headers["user-agent"];
+	const userAgent = typeof rawUserAgent === "string" ? rawUserAgent.slice(0, MAX_USER_AGENT_LENGTH) : void 0;
+	const ip = resolveClientIp(req, headers, options.trustProxy === true);
+	const fields = {
 		correlationId,
 		...method !== void 0 ? { method } : {},
 		...url !== void 0 ? { url } : {},
 		...userAgent !== void 0 ? { userAgent } : {},
 		...ip !== void 0 ? { ip } : {}
-	});
+	};
+	const child = logger.child;
+	if (options.childContext !== void 0) return child.call(logger, options.childContext, fields);
+	if (usesStringContext(logger)) return child.call(logger, "request", fields);
+	return child.call(logger, fields);
+}
+/** ILogger implementations (LogixiaLogger, LogixiaLoggerService, mock logger) expose these methods. */
+function usesStringContext(logger) {
+	const l = logger;
+	return typeof l["getContext"] === "function" || typeof l["getAvailableTransports"] === "function";
+}
+function resolveClientIp(req, headers, trustProxy) {
+	var _req$socket;
+	if (trustProxy) {
+		var _forwarded$split$;
+		const forwarded = headers["x-forwarded-for"];
+		const first = typeof forwarded === "string" ? (_forwarded$split$ = forwarded.split(",")[0]) === null || _forwarded$split$ === void 0 ? void 0 : _forwarded$split$.trim() : void 0;
+		if (first) return first.slice(0, MAX_IP_LENGTH);
+	}
+	const fromReq = req["ip"];
+	if (typeof fromReq === "string" && fromReq) return fromReq.slice(0, MAX_IP_LENGTH);
+	const remote = (_req$socket = req["socket"]) === null || _req$socket === void 0 ? void 0 : _req$socket["remoteAddress"];
+	return typeof remote === "string" ? remote.slice(0, MAX_IP_LENGTH) : void 0;
 }
 /**
 * Extract a correlation context from a Kafka / RabbitMQ / SQS message object.
@@ -224,14 +249,14 @@ function extractMessageCorrelationId(message) {
 	const kafkaHeaders = message["headers"];
 	if (kafkaHeaders) {
 		const raw = kafkaHeaders["x-correlation-id"] ?? kafkaHeaders["correlationId"] ?? kafkaHeaders["correlation_id"];
-		if (raw !== void 0) return Buffer.isBuffer(raw) ? raw.toString("utf8") : String(raw);
+		if (raw !== void 0) return validIncomingId(Buffer.isBuffer(raw) ? raw.toString("utf8", 0, 512) : String(raw));
 	}
 	const sqsAttrs = message["MessageAttributes"];
 	if (sqsAttrs) {
 		var _sqsAttrs$xCorrelati, _sqsAttrs$correlation, _sqsAttrs$correlation2;
-		return ((_sqsAttrs$xCorrelati = sqsAttrs["x-correlation-id"]) === null || _sqsAttrs$xCorrelati === void 0 ? void 0 : _sqsAttrs$xCorrelati.StringValue) ?? ((_sqsAttrs$correlation = sqsAttrs["correlationId"]) === null || _sqsAttrs$correlation === void 0 ? void 0 : _sqsAttrs$correlation.StringValue) ?? ((_sqsAttrs$correlation2 = sqsAttrs["correlation_id"]) === null || _sqsAttrs$correlation2 === void 0 ? void 0 : _sqsAttrs$correlation2.StringValue);
+		return validIncomingId(((_sqsAttrs$xCorrelati = sqsAttrs["x-correlation-id"]) === null || _sqsAttrs$xCorrelati === void 0 ? void 0 : _sqsAttrs$xCorrelati.StringValue) ?? ((_sqsAttrs$correlation = sqsAttrs["correlationId"]) === null || _sqsAttrs$correlation === void 0 ? void 0 : _sqsAttrs$correlation.StringValue) ?? ((_sqsAttrs$correlation2 = sqsAttrs["correlation_id"]) === null || _sqsAttrs$correlation2 === void 0 ? void 0 : _sqsAttrs$correlation2.StringValue));
 	}
-	return message["correlationId"] ?? message["correlation_id"];
+	return validIncomingId(message["correlationId"] ?? message["correlation_id"]);
 }
 /**
 * Build Kafka message headers containing the current correlation context.

package/dist/correlation.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"correlation.mjs","names":["ctx: CorrelationContext","headers: Record<string, string>"],"sources":["../src/correlation.ts"],"sourcesContent":["/**\n * logixia — Microservices Correlation ID Propagation\n *\n * Provides zero-boilerplate correlation ID generation and propagation for\n * distributed systems. A single correlation ID travels through every service\n * in a request fan-out, making it trivial to join logs across services.\n *\n * Features:\n *  - UUID v4 correlation ID generation (via `crypto.randomUUID()`)\n *  - Express / Fastify / NestJS incoming-request middleware\n *  - `correlationFetch()` — wraps global `fetch`, auto-injects `X-Correlation-ID`\n *  - `createCorrelationAxiosInterceptor()` — axios request interceptor\n *  - `childFromRequest(req, logger)` — child logger with all request identifiers\n *  - Kafka / SQS / RabbitMQ message context helpers\n *  - Integration with `LogixiaContext` (AsyncLocalStorage) so every `logger.info()`\n *    call automatically includes the correlationId without per-call passing.\n *\n * @example Express middleware\n * ```ts\n * import { correlationMiddleware } from 'logixia/correlation';\n * import { logger } from 'logixia';\n *\n * app.use(correlationMiddleware());\n *\n * app.get('/orders', (req, res) => {\n *   // correlationId is automatically in every log inside this request\n *   logger.info('Listing orders');\n *   res.json({ ok: true });\n * });\n * ```\n *\n * @example Outbound fetch with correlation\n * ```ts\n * import { correlationFetch } from 'logixia/correlation';\n *\n * // Reads correlationId from current LogixiaContext and injects it as header\n * const data = await correlationFetch('https://payments.internal/charge', {\n *   method: 'POST',\n *   body: JSON.stringify({ amount: 100 }),\n * });\n * ```\n *\n * @example Manual correlation context\n * ```ts\n * import { withCorrelationId } from 'logixia/correlation';\n *\n * await withCorrelationId('trace-abc-123', async () => {\n *   // All logs and outbound fetch calls in here carry 'trace-abc-123'\n *   await processOrder();\n * });\n * ```\n */\n\nimport { randomUUID } from 'node:crypto';\n\nimport { LogixiaContext } from './context/async-context';\n\n// ── Types ─────────────────────────────────────────────────────────────────────\n\n/** Fields injected into the log context by the correlation middleware. */\nexport interface CorrelationContext {\n  correlationId: string;\n  traceId?: string;\n  /** Service that originated the request (from `X-Origin-Service` header). */\n  originService?: string;\n  /** Index signature so CorrelationContext is assignable to LogContext. */\n  [key: string]: unknown;\n}\n\nexport interface CorrelationMiddlewareOptions {\n  /**\n   * HTTP header to read/write the correlation ID from/to.\n   * @default 'x-correlation-id'\n   */\n  header?: string;\n  /**\n   * HTTP header for the originating service name.\n   * @default 'x-origin-service'\n   */\n  originServiceHeader?: string;\n  /**\n   * Function to generate a new correlation ID when none is present in the request.\n   * @default () => crypto.randomUUID()\n   */\n  generate?: () => string;\n  /**\n   * When `true`, the response will include the correlation ID header so\n   * clients can log it client-side.\n   * @default true\n   */\n  setResponseHeader?: boolean;\n}\n\n// ── ID generation ─────────────────────────────────────────────────────────────\n\n/**\n * Generate a new correlation ID using `crypto.randomUUID()` (available in\n * Node.js 14.17+, all modern browsers, and Edge runtimes).\n *\n * When the Web Crypto global is unavailable (e.g. Node 18 without\n * `--experimental-global-webcrypto`), fall back to `node:crypto`'s\n * `randomUUID`, which returns a proper UUID v4 — matching the shape this\n * function's JSDoc and README promise. `logixia/correlation` is Node-only\n * (it builds on `AsyncLocalStorage`), so importing `node:crypto` is safe here.\n */\nexport function generateCorrelationId(): string {\n  if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function') {\n    return crypto.randomUUID();\n  }\n  return randomUUID();\n}\n\nconst MAX_INCOMING_ID_LENGTH = 128;\nconst VALID_INCOMING_ID = /^[A-Za-z0-9._:-]+$/;\n\n/**\n * Return an incoming correlation ID only if it is short and made of safe\n * characters. Anything else (over-long, empty, or containing newlines or other\n * control characters) is dropped so the caller generates a fresh ID instead of\n * writing client-supplied text into every log line.\n */\nfunction validIncomingId(value: string | undefined): string | undefined {\n  if (value === undefined || value.length > MAX_INCOMING_ID_LENGTH) return undefined;\n  return VALID_INCOMING_ID.test(value) ? value : undefined;\n}\n\n// ── Context helpers ───────────────────────────────────────────────────────────\n\n/**\n * Return the correlation ID from the current `LogixiaContext`, or `undefined`\n * when called outside any context scope.\n */\nexport function getCurrentCorrelationId(): string | undefined {\n  const ctx = LogixiaContext.get();\n  return ctx?.correlationId as string | undefined;\n}\n\n/**\n * Run `callback` inside a correlation context scope.\n *\n * If a correlation ID is not provided, a new UUID is generated.\n *\n * @example\n * ```ts\n * await withCorrelationId('cid-abc', async () => {\n *   logger.info('Processing message'); // → { correlationId: 'cid-abc', ... }\n *   await callDownstream();            // correlationFetch() picks up cid-abc\n * });\n * ```\n */\nexport function withCorrelationId<T>(correlationId: string | undefined, callback: () => T): T {\n  const id = correlationId ?? generateCorrelationId();\n  return LogixiaContext.run({ correlationId: id }, callback);\n}\n\n// ── Express / Connect middleware ──────────────────────────────────────────────\n\n/**\n * Express-compatible middleware that:\n * 1. Reads `X-Correlation-ID` from the incoming request (or generates a new one)\n * 2. Wraps the request in a `LogixiaContext` so all loggers in the handler\n *    automatically include `correlationId`\n * 3. Writes the correlation ID back to the response header (opt-out via options)\n *\n * @example\n * ```ts\n * import { correlationMiddleware } from 'logixia/correlation';\n * app.use(correlationMiddleware());\n * ```\n */\nexport function correlationMiddleware(options: CorrelationMiddlewareOptions = {}) {\n  const {\n    header = 'x-correlation-id',\n    originServiceHeader = 'x-origin-service',\n    generate = generateCorrelationId,\n    setResponseHeader = true,\n  } = options;\n\n  return function logixiaCorrelationMiddleware(\n    req: Record<string, unknown>,\n    res: Record<string, unknown>,\n    next: () => void\n  ): void {\n    const headers = (req['headers'] ?? {}) as Record<string, string | undefined>;\n\n    // Node lower-cases incoming header names, so look up with lower-cased keys.\n    const correlationId = validIncomingId(headers[header.toLowerCase()]) ?? generate();\n    const originService = headers[originServiceHeader.toLowerCase()];\n\n    if (setResponseHeader) {\n      const setHeader = res['setHeader'] as ((name: string, value: string) => void) | undefined;\n      if (typeof setHeader === 'function') {\n        setHeader.call(res, header, correlationId);\n      }\n    }\n\n    const ctx: CorrelationContext = {\n      correlationId,\n      ...(originService !== undefined ? { originService } : {}),\n    };\n\n    LogixiaContext.run(ctx, next);\n  };\n}\n\n// ── Fastify hook ──────────────────────────────────────────────────────────────\n\n/**\n * Fastify `onRequest` lifecycle hook — same functionality as `correlationMiddleware`\n * but adapted to Fastify's hook API.\n *\n * @example\n * ```ts\n * import { correlationFastifyHook } from 'logixia/correlation';\n * fastify.addHook('onRequest', correlationFastifyHook());\n * ```\n */\nexport function correlationFastifyHook(options: CorrelationMiddlewareOptions = {}) {\n  const {\n    header = 'x-correlation-id',\n    originServiceHeader = 'x-origin-service',\n    generate = generateCorrelationId,\n    setResponseHeader = true,\n  } = options;\n\n  return function logixiaCorrelationFastifyHook(\n    request: Record<string, unknown>,\n    reply: Record<string, unknown>,\n    done: () => void\n  ): void {\n    const headers = (request['headers'] ?? {}) as Record<string, string | undefined>;\n\n    // Node lower-cases incoming header names, so look up with lower-cased keys.\n    const correlationId = validIncomingId(headers[header.toLowerCase()]) ?? generate();\n    const originService = headers[originServiceHeader.toLowerCase()];\n\n    if (setResponseHeader) {\n      const replyHeader = reply['header'] as ((name: string, value: string) => void) | undefined;\n      if (typeof replyHeader === 'function') {\n        replyHeader.call(reply, header, correlationId);\n      }\n    }\n\n    const ctx: CorrelationContext = {\n      correlationId,\n      ...(originService !== undefined ? { originService } : {}),\n    };\n\n    LogixiaContext.run(ctx, done);\n  };\n}\n\n// ── Outbound fetch wrapper ────────────────────────────────────────────────────\n\n/**\n * A drop-in replacement for `fetch` that automatically injects the current\n * `correlationId` from `LogixiaContext` as an `X-Correlation-ID` request header.\n *\n * Falls back to the global `fetch` when no correlation context is active.\n *\n * @example\n * ```ts\n * import { correlationFetch } from 'logixia/correlation';\n *\n * // Inside a request handler with correlationMiddleware active:\n * const response = await correlationFetch('https://payments.internal/v1/charge', {\n *   method: 'POST',\n *   body: JSON.stringify({ amount: 100 }),\n * });\n * ```\n */\nexport async function correlationFetch(\n  input: string | URL | Request,\n  init: RequestInit = {},\n  options: { header?: string } = {}\n): Promise<Response> {\n  const header = options.header ?? 'x-correlation-id';\n  const correlationId = getCurrentCorrelationId();\n\n  // `init.headers` can be a plain object, a `Headers` instance, or an array of\n  // `[name, value]` tuples. Spreading it into a plain object loses everything\n  // but the object form: a `Headers` instance has no own enumerable properties,\n  // and an array spread yields numeric indices. `Headers` accepts all three, is\n  // case-insensitive, and is the shape `fetch` expects back.\n  //\n  // A `Request` carries headers of its own, and `fetch(request, { headers })`\n  // replaces them rather than merging them, so they are seeded first and the\n  // caller's `init.headers` is applied on top. Without this, accepting a\n  // `Request` here would drop its headers, which is the same defect one input\n  // shape over.\n  const headers = new Headers(input instanceof Request ? input.headers : undefined);\n  for (const [name, value] of new Headers(init.headers)) {\n    headers.set(name, value);\n  }\n  if (correlationId && !headers.has(header)) {\n    headers.set(header, correlationId);\n  }\n\n  return globalThis.fetch(input, { ...init, headers });\n}\n\n// ── Axios interceptor factory ─────────────────────────────────────────────────\n\n/**\n * Returns an axios request interceptor that automatically injects the current\n * correlation ID into outgoing axios requests.\n *\n * @example\n * ```ts\n * import axios from 'axios';\n * import { createCorrelationAxiosInterceptor } from 'logixia/correlation';\n *\n * axios.interceptors.request.use(createCorrelationAxiosInterceptor());\n * ```\n */\nexport function createCorrelationAxiosInterceptor(\n  options: { header?: string } = {}\n): (config: Record<string, unknown>) => Record<string, unknown> {\n  const header = options.header ?? 'x-correlation-id';\n\n  return function correlationAxiosInterceptor(\n    config: Record<string, unknown>\n  ): Record<string, unknown> {\n    const correlationId = getCurrentCorrelationId();\n    if (!correlationId) return config;\n\n    const headers = (config['headers'] ?? {}) as Record<string, unknown>;\n    if (!headers[header]) {\n      headers[header] = correlationId;\n    }\n\n    return { ...config, headers };\n  };\n}\n\n// ── Child logger from request ─────────────────────────────────────────────────\n\n/**\n * Create a child logger enriched with all correlation-relevant identifiers\n * extracted from the incoming HTTP request.\n *\n * The child logger's every call automatically includes:\n * `correlationId`, `requestId`, `method`, `url`, `userAgent`, `ip`\n *\n * @example\n * ```ts\n * import { childFromRequest } from 'logixia/correlation';\n * import { logger } from 'logixia';\n *\n * app.use((req, res, next) => {\n *   req.logger = childFromRequest(req, logger);\n *   next();\n * });\n *\n * app.get('/orders', (req, res) => {\n *   req.logger.info('Listing orders');  // → correlationId, requestId, method, url ...\n * });\n * ```\n */\nexport function childFromRequest<TLogger extends { child(ctx: Record<string, unknown>): TLogger }>(\n  req: Record<string, unknown>,\n  logger: TLogger,\n  options: { correlationHeader?: string } = {}\n): TLogger {\n  const correlationHeader = options.correlationHeader ?? 'x-correlation-id';\n\n  const headers = (req['headers'] ?? {}) as Record<string, string | undefined>;\n  // Node lower-cases incoming header names, so look up with a lower-cased key.\n  const correlationId =\n    validIncomingId(headers[correlationHeader.toLowerCase()]) ??\n    getCurrentCorrelationId() ??\n    generateCorrelationId();\n\n  const method = req['method'] as string | undefined;\n  const url = (req['url'] as string | undefined) ?? (req['originalUrl'] as string | undefined);\n  const userAgent = headers['user-agent'];\n  const ip =\n    (headers['x-forwarded-for'] as string | undefined)?.split(',')[0]?.trim() ??\n    ((req['socket'] as Record<string, unknown> | undefined)?.['remoteAddress'] as\n      string | undefined);\n\n  return logger.child({\n    correlationId,\n    ...(method !== undefined ? { method } : {}),\n    ...(url !== undefined ? { url } : {}),\n    ...(userAgent !== undefined ? { userAgent } : {}),\n    ...(ip !== undefined ? { ip } : {}),\n  });\n}\n\n// ── Message queue helpers ─────────────────────────────────────────────────────\n\n/**\n * Extract a correlation context from a Kafka / RabbitMQ / SQS message object.\n *\n * Looks for `correlationId`, `correlation_id`, or `x-correlation-id` in\n * `message.headers` (Kafka) or `message.MessageAttributes` (SQS).\n *\n * @example Kafka consumer\n * ```ts\n * import { extractMessageCorrelationId, withCorrelationId } from 'logixia/correlation';\n *\n * consumer.run({\n *   eachMessage: async ({ message }) => {\n *     const correlationId = extractMessageCorrelationId(message);\n *     await withCorrelationId(correlationId, () => processMessage(message));\n *   },\n * });\n * ```\n */\nexport function extractMessageCorrelationId(message: Record<string, unknown>): string | undefined {\n  // Kafka: message.headers is Record<string, Buffer | string>\n  const kafkaHeaders = message['headers'] as Record<string, Buffer | string> | undefined;\n  if (kafkaHeaders) {\n    const raw =\n      kafkaHeaders['x-correlation-id'] ??\n      kafkaHeaders['correlationId'] ??\n      kafkaHeaders['correlation_id'];\n    if (raw !== undefined) {\n      return Buffer.isBuffer(raw) ? raw.toString('utf8') : String(raw);\n    }\n  }\n\n  // SQS: message.MessageAttributes\n  const sqsAttrs = message['MessageAttributes'] as\n    Record<string, { StringValue?: string }> | undefined;\n  if (sqsAttrs) {\n    return (\n      sqsAttrs['x-correlation-id']?.StringValue ??\n      sqsAttrs['correlationId']?.StringValue ??\n      sqsAttrs['correlation_id']?.StringValue\n    );\n  }\n\n  // AMQP / generic envelope\n  return (\n    (message['correlationId'] as string | undefined) ??\n    (message['correlation_id'] as string | undefined)\n  );\n}\n\n/**\n * Build Kafka message headers containing the current correlation context.\n *\n * @example\n * ```ts\n * import { buildKafkaCorrelationHeaders } from 'logixia/correlation';\n *\n * await producer.send({\n *   topic: 'orders',\n *   messages: [{ value: JSON.stringify(order), headers: buildKafkaCorrelationHeaders() }],\n * });\n * ```\n */\nexport function buildKafkaCorrelationHeaders(): Record<string, string> {\n  const ctx = LogixiaContext.get();\n  const headers: Record<string, string> = {};\n\n  const correlationId = ctx?.correlationId as string | undefined;\n  if (correlationId) headers['x-correlation-id'] = correlationId;\n\n  const traceId = ctx?.traceId as string | undefined;\n  if (traceId) headers['x-trace-id'] = traceId;\n\n  return headers;\n}\n"],"mappings":";;;;;;;;;;;;;;AAyGA,SAAgB,wBAAgC;AAC9C,KAAI,OAAO,WAAW,eAAe,OAAO,OAAO,eAAe,WAChE,QAAO,OAAO,YAAY;AAE5B,QAAO,YAAY;;AAGrB,MAAM,yBAAyB;AAC/B,MAAM,oBAAoB;;;;;;;AAQ1B,SAAS,gBAAgB,OAA+C;AACtE,KAAI,UAAU,UAAa,MAAM,SAAS,uBAAwB,QAAO;AACzE,QAAO,kBAAkB,KAAK,MAAM,GAAG,QAAQ;;;;;;AASjD,SAAgB,0BAA8C;CAC5D,MAAM,MAAM,eAAe,KAAK;AAChC,kDAAO,IAAK;;;;;;;;;;;;;;;AAgBd,SAAgB,kBAAqB,eAAmC,UAAsB;CAC5F,MAAM,KAAK,iBAAiB,uBAAuB;AACnD,QAAO,eAAe,IAAI,EAAE,eAAe,IAAI,EAAE,SAAS;;;;;;;;;;;;;;;AAkB5D,SAAgB,sBAAsB,UAAwC,EAAE,EAAE;CAChF,MAAM,EACJ,SAAS,oBACT,sBAAsB,oBACtB,WAAW,uBACX,oBAAoB,SAClB;AAEJ,QAAO,SAAS,6BACd,KACA,KACA,MACM;EACN,MAAM,UAAW,IAAI,cAAc,EAAE;EAGrC,MAAM,gBAAgB,gBAAgB,QAAQ,OAAO,aAAa,EAAE,IAAI,UAAU;EAClF,MAAM,gBAAgB,QAAQ,oBAAoB,aAAa;AAE/D,MAAI,mBAAmB;GACrB,MAAM,YAAY,IAAI;AACtB,OAAI,OAAO,cAAc,WACvB,WAAU,KAAK,KAAK,QAAQ,cAAc;;EAI9C,MAAMA,MAA0B;GAC9B;GACA,GAAI,kBAAkB,SAAY,EAAE,eAAe,GAAG,EAAE;GACzD;AAED,iBAAe,IAAI,KAAK,KAAK;;;;;;;;;;;;;AAgBjC,SAAgB,uBAAuB,UAAwC,EAAE,EAAE;CACjF,MAAM,EACJ,SAAS,oBACT,sBAAsB,oBACtB,WAAW,uBACX,oBAAoB,SAClB;AAEJ,QAAO,SAAS,8BACd,SACA,OACA,MACM;EACN,MAAM,UAAW,QAAQ,cAAc,EAAE;EAGzC,MAAM,gBAAgB,gBAAgB,QAAQ,OAAO,aAAa,EAAE,IAAI,UAAU;EAClF,MAAM,gBAAgB,QAAQ,oBAAoB,aAAa;AAE/D,MAAI,mBAAmB;GACrB,MAAM,cAAc,MAAM;AAC1B,OAAI,OAAO,gBAAgB,WACzB,aAAY,KAAK,OAAO,QAAQ,cAAc;;EAIlD,MAAMA,MAA0B;GAC9B;GACA,GAAI,kBAAkB,SAAY,EAAE,eAAe,GAAG,EAAE;GACzD;AAED,iBAAe,IAAI,KAAK,KAAK;;;;;;;;;;;;;;;;;;;;AAuBjC,eAAsB,iBACpB,OACA,OAAoB,EAAE,EACtB,UAA+B,EAAE,EACd;CACnB,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,gBAAgB,yBAAyB;CAa/C,MAAM,UAAU,IAAI,QAAQ,iBAAiB,UAAU,MAAM,UAAU,OAAU;AACjF,MAAK,MAAM,CAAC,MAAM,UAAU,IAAI,QAAQ,KAAK,QAAQ,CACnD,SAAQ,IAAI,MAAM,MAAM;AAE1B,KAAI,iBAAiB,CAAC,QAAQ,IAAI,OAAO,CACvC,SAAQ,IAAI,QAAQ,cAAc;AAGpC,QAAO,WAAW,MAAM,OAAO;EAAE,GAAG;EAAM;EAAS,CAAC;;;;;;;;;;;;;;AAiBtD,SAAgB,kCACd,UAA+B,EAAE,EAC6B;CAC9D,MAAM,SAAS,QAAQ,UAAU;AAEjC,QAAO,SAAS,4BACd,QACyB;EACzB,MAAM,gBAAgB,yBAAyB;AAC/C,MAAI,CAAC,cAAe,QAAO;EAE3B,MAAM,UAAW,OAAO,cAAc,EAAE;AACxC,MAAI,CAAC,QAAQ,QACX,SAAQ,UAAU;AAGpB,SAAO;GAAE,GAAG;GAAQ;GAAS;;;;;;;;;;;;;;;;;;;;;;;;;AA4BjC,SAAgB,iBACd,KACA,QACA,UAA0C,EAAE,EACnC;;CACT,MAAM,oBAAoB,QAAQ,qBAAqB;CAEvD,MAAM,UAAW,IAAI,cAAc,EAAE;CAErC,MAAM,gBACJ,gBAAgB,QAAQ,kBAAkB,aAAa,EAAE,IACzD,yBAAyB,IACzB,uBAAuB;CAEzB,MAAM,SAAS,IAAI;CACnB,MAAM,MAAO,IAAI,UAAkC,IAAI;CACvD,MAAM,YAAY,QAAQ;CAC1B,MAAM,6BACH,QAAQ,6GAA2C,MAAM,IAAI,CAAC,8EAAI,MAAM,qBACvE,IAAI,qEAAoD;AAG5D,QAAO,OAAO,MAAM;EAClB;EACA,GAAI,WAAW,SAAY,EAAE,QAAQ,GAAG,EAAE;EAC1C,GAAI,QAAQ,SAAY,EAAE,KAAK,GAAG,EAAE;EACpC,GAAI,cAAc,SAAY,EAAE,WAAW,GAAG,EAAE;EAChD,GAAI,OAAO,SAAY,EAAE,IAAI,GAAG,EAAE;EACnC,CAAC;;;;;;;;;;;;;;;;;;;;AAuBJ,SAAgB,4BAA4B,SAAsD;CAEhG,MAAM,eAAe,QAAQ;AAC7B,KAAI,cAAc;EAChB,MAAM,MACJ,aAAa,uBACb,aAAa,oBACb,aAAa;AACf,MAAI,QAAQ,OACV,QAAO,OAAO,SAAS,IAAI,GAAG,IAAI,SAAS,OAAO,GAAG,OAAO,IAAI;;CAKpE,MAAM,WAAW,QAAQ;AAEzB,KAAI,UAAU;;AACZ,kCACE,SAAS,iGAAqB,0CAC9B,SAAS,gGAAkB,2CAC3B,SAAS,mGAAmB;;AAKhC,QACG,QAAQ,oBACR,QAAQ;;;;;;;;;;;;;;;AAiBb,SAAgB,+BAAuD;CACrE,MAAM,MAAM,eAAe,KAAK;CAChC,MAAMC,UAAkC,EAAE;CAE1C,MAAM,0DAAgB,IAAK;AAC3B,KAAI,cAAe,SAAQ,sBAAsB;CAEjD,MAAM,oDAAU,IAAK;AACrB,KAAI,QAAS,SAAQ,gBAAgB;AAErC,QAAO"}
+{"version":3,"file":"correlation.mjs","names":["ctx: CorrelationContext","headers: Record<string, string>"],"sources":["../src/correlation.ts"],"sourcesContent":["/**\n * logixia — Microservices Correlation ID Propagation\n *\n * Provides zero-boilerplate correlation ID generation and propagation for\n * distributed systems. A single correlation ID travels through every service\n * in a request fan-out, making it trivial to join logs across services.\n *\n * Features:\n *  - UUID v4 correlation ID generation (via `crypto.randomUUID()`)\n *  - Express / Fastify / NestJS incoming-request middleware\n *  - `correlationFetch()` — wraps global `fetch`, auto-injects `X-Correlation-ID`\n *  - `createCorrelationAxiosInterceptor()` — axios request interceptor\n *  - `childFromRequest(req, logger)` — child logger with all request identifiers\n *  - Kafka / SQS / RabbitMQ message context helpers\n *  - Integration with `LogixiaContext` (AsyncLocalStorage) so every `logger.info()`\n *    call automatically includes the correlationId without per-call passing.\n *\n * @example Express middleware\n * ```ts\n * import { correlationMiddleware } from 'logixia/correlation';\n * import { logger } from 'logixia';\n *\n * app.use(correlationMiddleware());\n *\n * app.get('/orders', (req, res) => {\n *   // correlationId is automatically in every log inside this request\n *   logger.info('Listing orders');\n *   res.json({ ok: true });\n * });\n * ```\n *\n * @example Outbound fetch with correlation\n * ```ts\n * import { correlationFetch } from 'logixia/correlation';\n *\n * // Reads correlationId from current LogixiaContext and injects it as header\n * const data = await correlationFetch('https://payments.internal/charge', {\n *   method: 'POST',\n *   body: JSON.stringify({ amount: 100 }),\n * });\n * ```\n *\n * @example Manual correlation context\n * ```ts\n * import { withCorrelationId } from 'logixia/correlation';\n *\n * await withCorrelationId('trace-abc-123', async () => {\n *   // All logs and outbound fetch calls in here carry 'trace-abc-123'\n *   await processOrder();\n * });\n * ```\n */\n\nimport { randomUUID } from 'node:crypto';\n\nimport { LogixiaContext } from './context/async-context';\nimport { sanitizeIncomingId } from './utils/trace.utils';\n\n// ── Types ─────────────────────────────────────────────────────────────────────\n\n/** Fields injected into the log context by the correlation middleware. */\nexport interface CorrelationContext {\n  correlationId: string;\n  traceId?: string;\n  /** Service that originated the request (from `X-Origin-Service` header). */\n  originService?: string;\n  /** Index signature so CorrelationContext is assignable to LogContext. */\n  [key: string]: unknown;\n}\n\nexport interface CorrelationMiddlewareOptions {\n  /**\n   * HTTP header to read/write the correlation ID from/to.\n   * @default 'x-correlation-id'\n   */\n  header?: string;\n  /**\n   * HTTP header for the originating service name.\n   * @default 'x-origin-service'\n   */\n  originServiceHeader?: string;\n  /**\n   * Function to generate a new correlation ID when none is present in the request.\n   * @default () => crypto.randomUUID()\n   */\n  generate?: () => string;\n  /**\n   * When `false`, the incoming correlation header is ignored and a new ID is\n   * always generated. Use this at the edge when client-supplied IDs should not\n   * be trusted.\n   * @default true\n   */\n  trustIncoming?: boolean;\n  /**\n   * When `true`, the response will include the correlation ID header so\n   * clients can log it client-side.\n   * @default true\n   */\n  setResponseHeader?: boolean;\n}\n\n// ── ID generation ─────────────────────────────────────────────────────────────\n\n/**\n * Generate a new correlation ID using `crypto.randomUUID()` (available in\n * Node.js 14.17+, all modern browsers, and Edge runtimes).\n *\n * When the Web Crypto global is unavailable (e.g. Node 18 without\n * `--experimental-global-webcrypto`), fall back to `node:crypto`'s\n * `randomUUID`, which returns a proper UUID v4 — matching the shape this\n * function's JSDoc and README promise. `logixia/correlation` is Node-only\n * (it builds on `AsyncLocalStorage`), so importing `node:crypto` is safe here.\n */\nexport function generateCorrelationId(): string {\n  if (typeof crypto !== 'undefined' && typeof crypto.randomUUID === 'function') {\n    return crypto.randomUUID();\n  }\n  return randomUUID();\n}\n\n/**\n * Return an incoming correlation ID only if it is short and made of safe\n * characters. Anything else (over-long, empty, or containing newlines or other\n * control characters) is dropped so the caller generates a fresh ID instead of\n * writing client-supplied text into every log line.\n */\nfunction validIncomingId(value: unknown): string | undefined {\n  if (typeof value === 'string' && value.trim() !== value) return undefined;\n  return sanitizeIncomingId(value);\n}\n\n// ── Context helpers ───────────────────────────────────────────────────────────\n\n/**\n * Return the correlation ID from the current `LogixiaContext`, or `undefined`\n * when called outside any context scope.\n */\nexport function getCurrentCorrelationId(): string | undefined {\n  const ctx = LogixiaContext.get();\n  return ctx?.correlationId as string | undefined;\n}\n\n/**\n * Run `callback` inside a correlation context scope.\n *\n * If a correlation ID is not provided, a new UUID is generated.\n *\n * @example\n * ```ts\n * await withCorrelationId('cid-abc', async () => {\n *   logger.info('Processing message'); // → { correlationId: 'cid-abc', ... }\n *   await callDownstream();            // correlationFetch() picks up cid-abc\n * });\n * ```\n */\nexport function withCorrelationId<T>(correlationId: string | undefined, callback: () => T): T {\n  const id = correlationId ?? generateCorrelationId();\n  return LogixiaContext.run({ correlationId: id }, callback);\n}\n\n// ── Express / Connect middleware ──────────────────────────────────────────────\n\n/**\n * Express-compatible middleware that:\n * 1. Reads `X-Correlation-ID` from the incoming request (or generates a new one)\n * 2. Wraps the request in a `LogixiaContext` so all loggers in the handler\n *    automatically include `correlationId`\n * 3. Writes the correlation ID back to the response header (opt-out via options)\n *\n * @example\n * ```ts\n * import { correlationMiddleware } from 'logixia/correlation';\n * app.use(correlationMiddleware());\n * ```\n */\nexport function correlationMiddleware(options: CorrelationMiddlewareOptions = {}) {\n  const {\n    header = 'x-correlation-id',\n    originServiceHeader = 'x-origin-service',\n    generate = generateCorrelationId,\n    trustIncoming = true,\n    setResponseHeader = true,\n  } = options;\n\n  return function logixiaCorrelationMiddleware(\n    req: Record<string, unknown>,\n    res: Record<string, unknown>,\n    next: () => void\n  ): void {\n    const headers = (req['headers'] ?? {}) as Record<string, string | undefined>;\n\n    // Node lower-cases incoming header names, so look up with lower-cased keys.\n    const incomingId = trustIncoming ? validIncomingId(headers[header.toLowerCase()]) : undefined;\n    const correlationId = incomingId ?? generate();\n    const originService = validIncomingId(headers[originServiceHeader.toLowerCase()]);\n\n    if (setResponseHeader) {\n      const setHeader = res['setHeader'] as ((name: string, value: string) => void) | undefined;\n      if (typeof setHeader === 'function') {\n        setHeader.call(res, header, correlationId);\n      }\n    }\n\n    const ctx: CorrelationContext = {\n      correlationId,\n      ...(originService !== undefined ? { originService } : {}),\n    };\n\n    LogixiaContext.run(ctx, next);\n  };\n}\n\n// ── Fastify hook ──────────────────────────────────────────────────────────────\n\n/**\n * Fastify `onRequest` lifecycle hook — same functionality as `correlationMiddleware`\n * but adapted to Fastify's hook API.\n *\n * @example\n * ```ts\n * import { correlationFastifyHook } from 'logixia/correlation';\n * fastify.addHook('onRequest', correlationFastifyHook());\n * ```\n */\nexport function correlationFastifyHook(options: CorrelationMiddlewareOptions = {}) {\n  const {\n    header = 'x-correlation-id',\n    originServiceHeader = 'x-origin-service',\n    generate = generateCorrelationId,\n    trustIncoming = true,\n    setResponseHeader = true,\n  } = options;\n\n  return function logixiaCorrelationFastifyHook(\n    request: Record<string, unknown>,\n    reply: Record<string, unknown>,\n    done: () => void\n  ): void {\n    const headers = (request['headers'] ?? {}) as Record<string, string | undefined>;\n\n    // Node lower-cases incoming header names, so look up with lower-cased keys.\n    const incomingId = trustIncoming ? validIncomingId(headers[header.toLowerCase()]) : undefined;\n    const correlationId = incomingId ?? generate();\n    const originService = validIncomingId(headers[originServiceHeader.toLowerCase()]);\n\n    if (setResponseHeader) {\n      const replyHeader = reply['header'] as ((name: string, value: string) => void) | undefined;\n      if (typeof replyHeader === 'function') {\n        replyHeader.call(reply, header, correlationId);\n      }\n    }\n\n    const ctx: CorrelationContext = {\n      correlationId,\n      ...(originService !== undefined ? { originService } : {}),\n    };\n\n    LogixiaContext.run(ctx, done);\n  };\n}\n\n// ── Outbound fetch wrapper ────────────────────────────────────────────────────\n\n/**\n * A drop-in replacement for `fetch` that automatically injects the current\n * `correlationId` from `LogixiaContext` as an `X-Correlation-ID` request header.\n *\n * Falls back to the global `fetch` when no correlation context is active.\n *\n * @example\n * ```ts\n * import { correlationFetch } from 'logixia/correlation';\n *\n * // Inside a request handler with correlationMiddleware active:\n * const response = await correlationFetch('https://payments.internal/v1/charge', {\n *   method: 'POST',\n *   body: JSON.stringify({ amount: 100 }),\n * });\n * ```\n */\nexport async function correlationFetch(\n  input: string | URL | Request,\n  init: RequestInit = {},\n  options: { header?: string } = {}\n): Promise<Response> {\n  const header = options.header ?? 'x-correlation-id';\n  const correlationId = getCurrentCorrelationId();\n\n  // `init.headers` can be a plain object, a `Headers` instance, or an array of\n  // `[name, value]` tuples. Spreading it into a plain object loses everything\n  // but the object form: a `Headers` instance has no own enumerable properties,\n  // and an array spread yields numeric indices. `Headers` accepts all three, is\n  // case-insensitive, and is the shape `fetch` expects back.\n  //\n  // A `Request` carries headers of its own, and `fetch(request, { headers })`\n  // replaces them rather than merging them, so they are seeded first and the\n  // caller's `init.headers` is applied on top. Without this, accepting a\n  // `Request` here would drop its headers, which is the same defect one input\n  // shape over.\n  const headers = new Headers(input instanceof Request ? input.headers : undefined);\n  for (const [name, value] of new Headers(init.headers)) {\n    headers.set(name, value);\n  }\n  if (correlationId && !headers.has(header)) {\n    headers.set(header, correlationId);\n  }\n\n  return globalThis.fetch(input, { ...init, headers });\n}\n\n// ── Axios interceptor factory ─────────────────────────────────────────────────\n\n/**\n * Returns an axios request interceptor that automatically injects the current\n * correlation ID into outgoing axios requests.\n *\n * @example\n * ```ts\n * import axios from 'axios';\n * import { createCorrelationAxiosInterceptor } from 'logixia/correlation';\n *\n * axios.interceptors.request.use(createCorrelationAxiosInterceptor());\n * ```\n */\nexport function createCorrelationAxiosInterceptor(\n  options: { header?: string } = {}\n): (config: Record<string, unknown>) => Record<string, unknown> {\n  const header = options.header ?? 'x-correlation-id';\n\n  return function correlationAxiosInterceptor(\n    config: Record<string, unknown>\n  ): Record<string, unknown> {\n    const correlationId = getCurrentCorrelationId();\n    if (!correlationId) return config;\n\n    const headers = (config['headers'] ?? {}) as Record<string, unknown>;\n    if (!headers[header]) {\n      headers[header] = correlationId;\n    }\n\n    return { ...config, headers };\n  };\n}\n\n// ── Child logger from request ─────────────────────────────────────────────────\n\nconst MAX_USER_AGENT_LENGTH = 512;\nconst MAX_IP_LENGTH = 64;\n\nexport interface ChildFromRequestOptions {\n  /** Header to read the correlation ID from. @default 'x-correlation-id' */\n  correlationHeader?: string;\n  /**\n   * Take the client IP from the first `X-Forwarded-For` entry. Only enable this\n   * when the app sits behind a proxy that overwrites the header; otherwise any\n   * client can choose the logged IP.\n   * @default false\n   */\n  trustProxy?: boolean;\n  /**\n   * Context name passed as the first argument to `logger.child(context, data)`.\n   * When omitted, logixia loggers (detected by their `getContext` /\n   * `getAvailableTransports` methods) get `child('request', fields)` and any other\n   * logger gets `child(fields)`.\n   */\n  childContext?: string;\n}\n\n/**\n * Create a child logger enriched with all correlation-relevant identifiers\n * extracted from the incoming HTTP request.\n *\n * The child logger's every call automatically includes:\n * `correlationId`, `method`, `url`, `userAgent`, `ip`\n *\n * The IP comes from `req.ip` / the socket address unless `trustProxy` is set.\n *\n * @example\n * ```ts\n * import { childFromRequest } from 'logixia/correlation';\n * import { logger } from 'logixia';\n *\n * app.use((req, res, next) => {\n *   req.logger = childFromRequest(req, logger);\n *   next();\n * });\n *\n * app.get('/orders', (req, res) => {\n *   req.logger.info('Listing orders');  // → correlationId, requestId, method, url ...\n * });\n * ```\n */\nexport function childFromRequest<TLogger extends { child(...args: never[]): TLogger }>(\n  req: Record<string, unknown>,\n  logger: TLogger,\n  options: ChildFromRequestOptions = {}\n): TLogger {\n  const correlationHeader = options.correlationHeader ?? 'x-correlation-id';\n\n  const headers = (req['headers'] ?? {}) as Record<string, string | undefined>;\n  // Node lower-cases incoming header names, so look up with a lower-cased key.\n  const correlationId =\n    validIncomingId(headers[correlationHeader.toLowerCase()]) ??\n    getCurrentCorrelationId() ??\n    generateCorrelationId();\n\n  const method = req['method'] as string | undefined;\n  const url = (req['url'] as string | undefined) ?? (req['originalUrl'] as string | undefined);\n  const rawUserAgent = headers['user-agent'];\n  const userAgent =\n    typeof rawUserAgent === 'string' ? rawUserAgent.slice(0, MAX_USER_AGENT_LENGTH) : undefined;\n  const ip = resolveClientIp(req, headers, options.trustProxy === true);\n\n  const fields = {\n    correlationId,\n    ...(method !== undefined ? { method } : {}),\n    ...(url !== undefined ? { url } : {}),\n    ...(userAgent !== undefined ? { userAgent } : {}),\n    ...(ip !== undefined ? { ip } : {}),\n  };\n\n  const child = logger.child as (...args: unknown[]) => TLogger;\n  if (options.childContext !== undefined) {\n    return child.call(logger, options.childContext, fields);\n  }\n  // logixia's ILogger.child(context: string, data?) takes a string namespace;\n  // pino/winston-style loggers take a bindings object.\n  if (usesStringContext(logger)) {\n    return child.call(logger, 'request', fields);\n  }\n  return child.call(logger, fields);\n}\n\n/** ILogger implementations (LogixiaLogger, LogixiaLoggerService, mock logger) expose these methods. */\nfunction usesStringContext(logger: object): boolean {\n  const l = logger as Record<string, unknown>;\n  return typeof l['getContext'] === 'function' || typeof l['getAvailableTransports'] === 'function';\n}\n\nfunction resolveClientIp(\n  req: Record<string, unknown>,\n  headers: Record<string, string | undefined>,\n  trustProxy: boolean\n): string | undefined {\n  if (trustProxy) {\n    const forwarded = headers['x-forwarded-for'];\n    const first = typeof forwarded === 'string' ? forwarded.split(',')[0]?.trim() : undefined;\n    if (first) return first.slice(0, MAX_IP_LENGTH);\n  }\n  const fromReq = req['ip'];\n  if (typeof fromReq === 'string' && fromReq) return fromReq.slice(0, MAX_IP_LENGTH);\n  const remote = (req['socket'] as Record<string, unknown> | undefined)?.['remoteAddress'];\n  return typeof remote === 'string' ? remote.slice(0, MAX_IP_LENGTH) : undefined;\n}\n\n// ── Message queue helpers ─────────────────────────────────────────────────────\n\n/**\n * Extract a correlation context from a Kafka / RabbitMQ / SQS message object.\n *\n * Looks for `correlationId`, `correlation_id`, or `x-correlation-id` in\n * `message.headers` (Kafka) or `message.MessageAttributes` (SQS).\n *\n * @example Kafka consumer\n * ```ts\n * import { extractMessageCorrelationId, withCorrelationId } from 'logixia/correlation';\n *\n * consumer.run({\n *   eachMessage: async ({ message }) => {\n *     const correlationId = extractMessageCorrelationId(message);\n *     await withCorrelationId(correlationId, () => processMessage(message));\n *   },\n * });\n * ```\n */\nexport function extractMessageCorrelationId(message: Record<string, unknown>): string | undefined {\n  // Kafka: message.headers is Record<string, Buffer | string>\n  const kafkaHeaders = message['headers'] as Record<string, Buffer | string> | undefined;\n  if (kafkaHeaders) {\n    const raw =\n      kafkaHeaders['x-correlation-id'] ??\n      kafkaHeaders['correlationId'] ??\n      kafkaHeaders['correlation_id'];\n    if (raw !== undefined) {\n      return validIncomingId(Buffer.isBuffer(raw) ? raw.toString('utf8', 0, 512) : String(raw));\n    }\n  }\n\n  // SQS: message.MessageAttributes\n  const sqsAttrs = message['MessageAttributes'] as\n    Record<string, { StringValue?: string }> | undefined;\n  if (sqsAttrs) {\n    return validIncomingId(\n      sqsAttrs['x-correlation-id']?.StringValue ??\n        sqsAttrs['correlationId']?.StringValue ??\n        sqsAttrs['correlation_id']?.StringValue\n    );\n  }\n\n  // AMQP / generic envelope\n  return validIncomingId(message['correlationId'] ?? message['correlation_id']);\n}\n\n/**\n * Build Kafka message headers containing the current correlation context.\n *\n * @example\n * ```ts\n * import { buildKafkaCorrelationHeaders } from 'logixia/correlation';\n *\n * await producer.send({\n *   topic: 'orders',\n *   messages: [{ value: JSON.stringify(order), headers: buildKafkaCorrelationHeaders() }],\n * });\n * ```\n */\nexport function buildKafkaCorrelationHeaders(): Record<string, string> {\n  const ctx = LogixiaContext.get();\n  const headers: Record<string, string> = {};\n\n  const correlationId = ctx?.correlationId as string | undefined;\n  if (correlationId) headers['x-correlation-id'] = correlationId;\n\n  const traceId = ctx?.traceId as string | undefined;\n  if (traceId) headers['x-trace-id'] = traceId;\n\n  return headers;\n}\n"],"mappings":";;;;;;;;;;;;;;;AAiHA,SAAgB,wBAAgC;AAC9C,KAAI,OAAO,WAAW,eAAe,OAAO,OAAO,eAAe,WAChE,QAAO,OAAO,YAAY;AAE5B,QAAO,YAAY;;;;;;;;AASrB,SAAS,gBAAgB,OAAoC;AAC3D,KAAI,OAAO,UAAU,YAAY,MAAM,MAAM,KAAK,MAAO,QAAO;AAChE,QAAO,mBAAmB,MAAM;;;;;;AASlC,SAAgB,0BAA8C;CAC5D,MAAM,MAAM,eAAe,KAAK;AAChC,kDAAO,IAAK;;;;;;;;;;;;;;;AAgBd,SAAgB,kBAAqB,eAAmC,UAAsB;CAC5F,MAAM,KAAK,iBAAiB,uBAAuB;AACnD,QAAO,eAAe,IAAI,EAAE,eAAe,IAAI,EAAE,SAAS;;;;;;;;;;;;;;;AAkB5D,SAAgB,sBAAsB,UAAwC,EAAE,EAAE;CAChF,MAAM,EACJ,SAAS,oBACT,sBAAsB,oBACtB,WAAW,uBACX,gBAAgB,MAChB,oBAAoB,SAClB;AAEJ,QAAO,SAAS,6BACd,KACA,KACA,MACM;EACN,MAAM,UAAW,IAAI,cAAc,EAAE;EAIrC,MAAM,iBADa,gBAAgB,gBAAgB,QAAQ,OAAO,aAAa,EAAE,GAAG,WAChD,UAAU;EAC9C,MAAM,gBAAgB,gBAAgB,QAAQ,oBAAoB,aAAa,EAAE;AAEjF,MAAI,mBAAmB;GACrB,MAAM,YAAY,IAAI;AACtB,OAAI,OAAO,cAAc,WACvB,WAAU,KAAK,KAAK,QAAQ,cAAc;;EAI9C,MAAMA,MAA0B;GAC9B;GACA,GAAI,kBAAkB,SAAY,EAAE,eAAe,GAAG,EAAE;GACzD;AAED,iBAAe,IAAI,KAAK,KAAK;;;;;;;;;;;;;AAgBjC,SAAgB,uBAAuB,UAAwC,EAAE,EAAE;CACjF,MAAM,EACJ,SAAS,oBACT,sBAAsB,oBACtB,WAAW,uBACX,gBAAgB,MAChB,oBAAoB,SAClB;AAEJ,QAAO,SAAS,8BACd,SACA,OACA,MACM;EACN,MAAM,UAAW,QAAQ,cAAc,EAAE;EAIzC,MAAM,iBADa,gBAAgB,gBAAgB,QAAQ,OAAO,aAAa,EAAE,GAAG,WAChD,UAAU;EAC9C,MAAM,gBAAgB,gBAAgB,QAAQ,oBAAoB,aAAa,EAAE;AAEjF,MAAI,mBAAmB;GACrB,MAAM,cAAc,MAAM;AAC1B,OAAI,OAAO,gBAAgB,WACzB,aAAY,KAAK,OAAO,QAAQ,cAAc;;EAIlD,MAAMA,MAA0B;GAC9B;GACA,GAAI,kBAAkB,SAAY,EAAE,eAAe,GAAG,EAAE;GACzD;AAED,iBAAe,IAAI,KAAK,KAAK;;;;;;;;;;;;;;;;;;;;AAuBjC,eAAsB,iBACpB,OACA,OAAoB,EAAE,EACtB,UAA+B,EAAE,EACd;CACnB,MAAM,SAAS,QAAQ,UAAU;CACjC,MAAM,gBAAgB,yBAAyB;CAa/C,MAAM,UAAU,IAAI,QAAQ,iBAAiB,UAAU,MAAM,UAAU,OAAU;AACjF,MAAK,MAAM,CAAC,MAAM,UAAU,IAAI,QAAQ,KAAK,QAAQ,CACnD,SAAQ,IAAI,MAAM,MAAM;AAE1B,KAAI,iBAAiB,CAAC,QAAQ,IAAI,OAAO,CACvC,SAAQ,IAAI,QAAQ,cAAc;AAGpC,QAAO,WAAW,MAAM,OAAO;EAAE,GAAG;EAAM;EAAS,CAAC;;;;;;;;;;;;;;AAiBtD,SAAgB,kCACd,UAA+B,EAAE,EAC6B;CAC9D,MAAM,SAAS,QAAQ,UAAU;AAEjC,QAAO,SAAS,4BACd,QACyB;EACzB,MAAM,gBAAgB,yBAAyB;AAC/C,MAAI,CAAC,cAAe,QAAO;EAE3B,MAAM,UAAW,OAAO,cAAc,EAAE;AACxC,MAAI,CAAC,QAAQ,QACX,SAAQ,UAAU;AAGpB,SAAO;GAAE,GAAG;GAAQ;GAAS;;;AAMjC,MAAM,wBAAwB;AAC9B,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;AA6CtB,SAAgB,iBACd,KACA,QACA,UAAmC,EAAE,EAC5B;CACT,MAAM,oBAAoB,QAAQ,qBAAqB;CAEvD,MAAM,UAAW,IAAI,cAAc,EAAE;CAErC,MAAM,gBACJ,gBAAgB,QAAQ,kBAAkB,aAAa,EAAE,IACzD,yBAAyB,IACzB,uBAAuB;CAEzB,MAAM,SAAS,IAAI;CACnB,MAAM,MAAO,IAAI,UAAkC,IAAI;CACvD,MAAM,eAAe,QAAQ;CAC7B,MAAM,YACJ,OAAO,iBAAiB,WAAW,aAAa,MAAM,GAAG,sBAAsB,GAAG;CACpF,MAAM,KAAK,gBAAgB,KAAK,SAAS,QAAQ,eAAe,KAAK;CAErE,MAAM,SAAS;EACb;EACA,GAAI,WAAW,SAAY,EAAE,QAAQ,GAAG,EAAE;EAC1C,GAAI,QAAQ,SAAY,EAAE,KAAK,GAAG,EAAE;EACpC,GAAI,cAAc,SAAY,EAAE,WAAW,GAAG,EAAE;EAChD,GAAI,OAAO,SAAY,EAAE,IAAI,GAAG,EAAE;EACnC;CAED,MAAM,QAAQ,OAAO;AACrB,KAAI,QAAQ,iBAAiB,OAC3B,QAAO,MAAM,KAAK,QAAQ,QAAQ,cAAc,OAAO;AAIzD,KAAI,kBAAkB,OAAO,CAC3B,QAAO,MAAM,KAAK,QAAQ,WAAW,OAAO;AAE9C,QAAO,MAAM,KAAK,QAAQ,OAAO;;;AAInC,SAAS,kBAAkB,QAAyB;CAClD,MAAM,IAAI;AACV,QAAO,OAAO,EAAE,kBAAkB,cAAc,OAAO,EAAE,8BAA8B;;AAGzF,SAAS,gBACP,KACA,SACA,YACoB;;AACpB,KAAI,YAAY;;EACd,MAAM,YAAY,QAAQ;EAC1B,MAAM,QAAQ,OAAO,cAAc,gCAAW,UAAU,MAAM,IAAI,CAAC,0EAAI,MAAM,GAAG;AAChF,MAAI,MAAO,QAAO,MAAM,MAAM,GAAG,cAAc;;CAEjD,MAAM,UAAU,IAAI;AACpB,KAAI,OAAO,YAAY,YAAY,QAAS,QAAO,QAAQ,MAAM,GAAG,cAAc;CAClF,MAAM,wBAAU,IAAI,qEAAoD;AACxE,QAAO,OAAO,WAAW,WAAW,OAAO,MAAM,GAAG,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;AAuBvE,SAAgB,4BAA4B,SAAsD;CAEhG,MAAM,eAAe,QAAQ;AAC7B,KAAI,cAAc;EAChB,MAAM,MACJ,aAAa,uBACb,aAAa,oBACb,aAAa;AACf,MAAI,QAAQ,OACV,QAAO,gBAAgB,OAAO,SAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,GAAG,IAAI,GAAG,OAAO,IAAI,CAAC;;CAK7F,MAAM,WAAW,QAAQ;AAEzB,KAAI,UAAU;;AACZ,SAAO,yCACL,SAAS,iGAAqB,0CAC5B,SAAS,gGAAkB,2CAC3B,SAAS,mGAAmB,aAC/B;;AAIH,QAAO,gBAAgB,QAAQ,oBAAoB,QAAQ,kBAAkB;;;;;;;;;;;;;;;AAgB/E,SAAgB,+BAAuD;CACrE,MAAM,MAAM,eAAe,KAAK;CAChC,MAAMC,UAAkC,EAAE;CAE1C,MAAM,0DAAgB,IAAK;AAC3B,KAAI,cAAe,SAAQ,sBAAsB;CAEjD,MAAM,oDAAU,IAAK;AACrB,KAAI,QAAS,SAAQ,gBAAgB;AAErC,QAAO"}

package/dist/entry-fields-BJkuPnIg.mjs

@@ -0,0 +1,30 @@
+//#region src/transports/entry-fields.ts
+const PAYLOAD_PREFIX = "data_";
+const UNSAFE_KEYS = new Set(["__proto__"]);
+/**
+* Copies `core` and then the user payload into one object. The core fields stay
+* authoritative: a payload key that matches a core key (even one whose value is
+* undefined) or a reserved name is kept under a `data_` prefix instead. The
+* prefix is repeated until the name is free of core keys and of every other
+* payload key, so the result does not depend on key order and a payload's own
+* `data_level` stays where it is.
+*/
+function mergeCoreFields(core, data, extraReserved = []) {
+	const merged = { ...core };
+	if (!data) return merged;
+	const reserved = new Set([...Object.keys(core), ...extraReserved]);
+	const payloadKeys = new Set(Object.keys(data));
+	for (const key of payloadKeys) {
+		if (UNSAFE_KEYS.has(key)) continue;
+		let target = key;
+		if (reserved.has(target)) do
+			target = `${PAYLOAD_PREFIX}${target}`;
+		while (reserved.has(target) || payloadKeys.has(target));
+		merged[target] = data[key];
+	}
+	return merged;
+}
+
+//#endregion
+export { mergeCoreFields as t };
+//# sourceMappingURL=entry-fields-BJkuPnIg.mjs.map

package/dist/entry-fields-BJkuPnIg.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-fields-BJkuPnIg.mjs","names":["merged: Record<string, unknown>"],"sources":["../src/transports/entry-fields.ts"],"sourcesContent":["const PAYLOAD_PREFIX = 'data_';\nconst UNSAFE_KEYS = new Set(['__proto__']);\n\n/**\n * Copies `core` and then the user payload into one object. The core fields stay\n * authoritative: a payload key that matches a core key (even one whose value is\n * undefined) or a reserved name is kept under a `data_` prefix instead. The\n * prefix is repeated until the name is free of core keys and of every other\n * payload key, so the result does not depend on key order and a payload's own\n * `data_level` stays where it is.\n */\nexport function mergeCoreFields(\n  core: Record<string, unknown>,\n  data: Record<string, unknown> | undefined,\n  extraReserved: readonly string[] = []\n): Record<string, unknown> {\n  const merged: Record<string, unknown> = { ...core };\n  if (!data) return merged;\n  const reserved = new Set([...Object.keys(core), ...extraReserved]);\n  const payloadKeys = new Set(Object.keys(data));\n  for (const key of payloadKeys) {\n    if (UNSAFE_KEYS.has(key)) continue;\n    let target = key;\n    if (reserved.has(target)) {\n      do {\n        target = `${PAYLOAD_PREFIX}${target}`;\n      } while (reserved.has(target) || payloadKeys.has(target));\n    }\n    merged[target] = data[key];\n  }\n  return merged;\n}\n"],"mappings":";AAAA,MAAM,iBAAiB;AACvB,MAAM,cAAc,IAAI,IAAI,CAAC,YAAY,CAAC;;;;;;;;;AAU1C,SAAgB,gBACd,MACA,MACA,gBAAmC,EAAE,EACZ;CACzB,MAAMA,SAAkC,EAAE,GAAG,MAAM;AACnD,KAAI,CAAC,KAAM,QAAO;CAClB,MAAM,WAAW,IAAI,IAAI,CAAC,GAAG,OAAO,KAAK,KAAK,EAAE,GAAG,cAAc,CAAC;CAClE,MAAM,cAAc,IAAI,IAAI,OAAO,KAAK,KAAK,CAAC;AAC9C,MAAK,MAAM,OAAO,aAAa;AAC7B,MAAI,YAAY,IAAI,IAAI,CAAE;EAC1B,IAAI,SAAS;AACb,MAAI,SAAS,IAAI,OAAO,CACtB;AACE,YAAS,GAAG,iBAAiB;SACtB,SAAS,IAAI,OAAO,IAAI,YAAY,IAAI,OAAO;AAE1D,SAAO,UAAU,KAAK;;AAExB,QAAO"}

package/dist/entry-fields-BvOLFlJ4.js

@@ -0,0 +1,36 @@
+
+//#region src/transports/entry-fields.ts
+const PAYLOAD_PREFIX = "data_";
+const UNSAFE_KEYS = new Set(["__proto__"]);
+/**
+* Copies `core` and then the user payload into one object. The core fields stay
+* authoritative: a payload key that matches a core key (even one whose value is
+* undefined) or a reserved name is kept under a `data_` prefix instead. The
+* prefix is repeated until the name is free of core keys and of every other
+* payload key, so the result does not depend on key order and a payload's own
+* `data_level` stays where it is.
+*/
+function mergeCoreFields(core, data, extraReserved = []) {
+	const merged = { ...core };
+	if (!data) return merged;
+	const reserved = new Set([...Object.keys(core), ...extraReserved]);
+	const payloadKeys = new Set(Object.keys(data));
+	for (const key of payloadKeys) {
+		if (UNSAFE_KEYS.has(key)) continue;
+		let target = key;
+		if (reserved.has(target)) do
+			target = `${PAYLOAD_PREFIX}${target}`;
+		while (reserved.has(target) || payloadKeys.has(target));
+		merged[target] = data[key];
+	}
+	return merged;
+}
+
+//#endregion
+Object.defineProperty(exports, 'mergeCoreFields', {
+  enumerable: true,
+  get: function () {
+    return mergeCoreFields;
+  }
+});
+//# sourceMappingURL=entry-fields-BvOLFlJ4.js.map

package/dist/entry-fields-BvOLFlJ4.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"entry-fields-BvOLFlJ4.js","names":["merged: Record<string, unknown>"],"sources":["../src/transports/entry-fields.ts"],"sourcesContent":["const PAYLOAD_PREFIX = 'data_';\nconst UNSAFE_KEYS = new Set(['__proto__']);\n\n/**\n * Copies `core` and then the user payload into one object. The core fields stay\n * authoritative: a payload key that matches a core key (even one whose value is\n * undefined) or a reserved name is kept under a `data_` prefix instead. The\n * prefix is repeated until the name is free of core keys and of every other\n * payload key, so the result does not depend on key order and a payload's own\n * `data_level` stays where it is.\n */\nexport function mergeCoreFields(\n  core: Record<string, unknown>,\n  data: Record<string, unknown> | undefined,\n  extraReserved: readonly string[] = []\n): Record<string, unknown> {\n  const merged: Record<string, unknown> = { ...core };\n  if (!data) return merged;\n  const reserved = new Set([...Object.keys(core), ...extraReserved]);\n  const payloadKeys = new Set(Object.keys(data));\n  for (const key of payloadKeys) {\n    if (UNSAFE_KEYS.has(key)) continue;\n    let target = key;\n    if (reserved.has(target)) {\n      do {\n        target = `${PAYLOAD_PREFIX}${target}`;\n      } while (reserved.has(target) || payloadKeys.has(target));\n    }\n    merged[target] = data[key];\n  }\n  return merged;\n}\n"],"mappings":";;AAAA,MAAM,iBAAiB;AACvB,MAAM,cAAc,IAAI,IAAI,CAAC,YAAY,CAAC;;;;;;;;;AAU1C,SAAgB,gBACd,MACA,MACA,gBAAmC,EAAE,EACZ;CACzB,MAAMA,SAAkC,EAAE,GAAG,MAAM;AACnD,KAAI,CAAC,KAAM,QAAO;CAClB,MAAM,WAAW,IAAI,IAAI,CAAC,GAAG,OAAO,KAAK,KAAK,EAAE,GAAG,cAAc,CAAC;CAClE,MAAM,cAAc,IAAI,IAAI,OAAO,KAAK,KAAK,CAAC;AAC9C,MAAK,MAAM,OAAO,aAAa;AAC7B,MAAI,YAAY,IAAI,IAAI,CAAE;EAC1B,IAAI,SAAS;AACb,MAAI,SAAS,IAAI,OAAO,CACtB;AACE,YAAS,GAAG,iBAAiB;SACtB,SAAS,IAAI,OAAO,IAAI,YAAY,IAAI,OAAO;AAE1D,SAAO,UAAU,KAAK;;AAExB,QAAO"}

package/dist/gcp.d.mts

@@ -1,3 +1,3 @@
-import "./transport.types-B5vcyv2k.mjs";
-import { n as GCPTransport, r as GCPTransportConfig, t as GCPMonitoredResource } from "./gcp.transport-Bi6CUqZR.mjs";
+import "./transport.types-CtNr3D7S.mjs";
+import { n as GCPTransport, r as GCPTransportConfig, t as GCPMonitoredResource } from "./gcp.transport-zzNyIoih.mjs";
 export { GCPMonitoredResource, GCPTransport, GCPTransportConfig };

package/dist/gcp.d.ts

@@ -1,3 +1,3 @@
-import "./transport.types-BuY84TwO.js";
-import { n as GCPTransport, r as GCPTransportConfig, t as GCPMonitoredResource } from "./gcp.transport-BOhkVKlI.js";
+import "./transport.types-DqVLZTyf.js";
+import { n as GCPTransport, r as GCPTransportConfig, t as GCPMonitoredResource } from "./gcp.transport-m4fVw0b1.js";
 export { GCPMonitoredResource, GCPTransport, GCPTransportConfig };

package/dist/gcp.js

@@ -1,6 +1,7 @@
 require('./internal-log-BUJYMZbE.js');
 require('./safe-stringify-DWo3aZp_.js');
 require('./batch-buffer-BY-mRWIK.js');
-const require_gcp_transport = require('./gcp.transport-SHdtc1n0.js');
+require('./entry-fields-BvOLFlJ4.js');
+const require_gcp_transport = require('./gcp.transport-CHV8MGgz.js');
 
 exports.GCPTransport = require_gcp_transport.GCPTransport;