logixia 1.13.0 → 2.0.0

package/dist/cli/index.js

@@ -31,6 +31,25 @@ commander = __toESM(commander);
 let picocolors = require("picocolors");
 picocolors = __toESM(picocolors);
 
+//#region src/utils/csv.utils.ts
+const CSV_FORMULA_PREFIX = /^[=+\-@\t\r]/;
+/**
+* Render one CSV field. String values that a spreadsheet would treat as a
+* formula (leading `=`, `+`, `-`, `@`, tab or CR) are prefixed with `'`.
+* Objects are JSON-encoded. Fields containing a comma, quote, CR or LF are quoted;
+* `alwaysQuote` quotes every field. `null` / `undefined` render as empty.
+*/
+function csvField(value, alwaysQuote = false) {
+	if (value === void 0 || value === null) return alwaysQuote ? "\"\"" : "";
+	let str;
+	if (typeof value === "string") str = CSV_FORMULA_PREFIX.test(value) ? `'${value}` : value;
+	else if (typeof value === "object") str = JSON.stringify(value);
+	else str = String(value);
+	if (alwaysQuote || /[",\r\n]/.test(str)) return `"${str.replace(/"/g, "\"\"")}"`;
+	return str;
+}
+
+//#endregion
 //#region src/cli/utils.ts
 /**
 * Render a single cell value. Uses a null/undefined check rather than `||` so
@@ -38,12 +57,33 @@ picocolors = __toESM(picocolors);
 * `statusCode=0` field must not silently display as blank.
 */
 function cellText(value) {
-	return value === null || value === void 0 ? "" : String(value);
+	return value === null || value === void 0 ? "" : sanitizeInline(String(value));
+}
+const TERMINAL_UNSAFE = /[\u0000-\u0008\u000b-\u001f\u007f-\u009f\u2028\u2029]/g;
+function escapeChar(ch) {
+	const code = ch.charCodeAt(0);
+	return code <= 255 ? `\\x${code.toString(16).padStart(2, "0")}` : `\\u${code.toString(16).padStart(4, "0")}`;
+}
+/**
+* Make untrusted log text safe to print: control characters (ESC, CR, BEL, C1
+* codes, ...) are replaced by a visible `\xNN` escape. Tabs and newlines are kept
+* so multi-line output the CLI formats itself is unaffected.
+*/
+function sanitizeForTerminal(text) {
+	return text.replace(TERMINAL_UNSAFE, escapeChar);
+}
+/** Like {@link sanitizeForTerminal} but also escapes newlines and tabs (single-line cells). */
+function sanitizeInline(text) {
+	return sanitizeForTerminal(text).replace(/\n/g, "\\n").replace(/\t/g, "\\t");
+}
+/** Escape regular-expression metacharacters so `text` matches literally. */
+function escapeRegExp(text) {
+	return text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function formatAsTable(rows, columns) {
-	const colWidths = columns.map((c) => Math.max(c.length, ...rows.map((r) => cellText(r[c]).length)));
+	const colWidths = columns.map((c) => Math.max(sanitizeInline(c).length, ...rows.map((r) => cellText(r[c]).length)));
 	return [
-		columns.map((c, i) => c.padEnd(colWidths[i] ?? 0)).join(" | "),
+		columns.map((c, i) => sanitizeInline(c).padEnd(colWidths[i] ?? 0)).join(" | "),
 		colWidths.map((w) => "-".repeat(w)).join("-|-"),
 		rows.map((r) => columns.map((c, i) => cellText(r[c]).padEnd(colWidths[i] ?? 0)).join(" | ")).join("\n")
 	].join("\n");
@@ -90,7 +130,7 @@ async function analyzeFileContents(raw, opts = {}) {
 		});
 	}
 	if (opts.level) filtered = filtered.filter((e) => (e["level"] ?? "").toLowerCase() === opts.level.toLowerCase());
-	const byLevel = {};
+	const byLevel = Object.create(null);
 	for (const e of filtered) {
 		const l = (e.level || "info").toUpperCase();
 		byLevel[l] = (byLevel[l] || 0) + 1;
@@ -112,7 +152,7 @@ const analyzeCommand = new commander.Command("analyze").description("Analyze log
 	}
 	const result = await analyzeFileContents(node_fs.default.readFileSync(full, "utf8"), opts);
 	if (opts.format === "json") {
-		console.log(JSON.stringify(result, null, 2));
+		console.log(sanitizeForTerminal(JSON.stringify(result, null, 2)));
 		return;
 	}
 	console.log(result);
@@ -178,10 +218,10 @@ function formatTime(ts) {
 	if (!ts) return "            ";
 	try {
 		const d = new Date(String(ts));
-		if (Number.isNaN(d.getTime())) return String(ts).slice(0, 12).padEnd(12);
+		if (Number.isNaN(d.getTime())) return sanitizeInline(String(ts).slice(0, 12)).padEnd(12);
 		return `${String(d.getHours()).padStart(2, "0")}:${String(d.getMinutes()).padStart(2, "0")}:${String(d.getSeconds()).padStart(2, "0")}.${String(d.getMilliseconds()).padStart(3, "0")}`;
 	} catch {
-		return String(ts).slice(0, 12).padEnd(12);
+		return sanitizeInline(String(ts).slice(0, 12)).padEnd(12);
 	}
 }
 function syntaxColorJson(line) {
@@ -204,12 +244,12 @@ function buildDetailLines(entry) {
 	if (!entry) return [picocolors.default.dim("  No entry selected")];
 	const lines = [];
 	const { stack,...rest } = entry;
-	const jsonText = JSON.stringify(rest, null, 2);
+	const jsonText = sanitizeForTerminal(JSON.stringify(rest, null, 2));
 	for (const l of jsonText.split("\n")) lines.push("  " + syntaxColorJson(l));
 	if (stack) {
 		lines.push("");
 		lines.push(picocolors.default.bold(picocolors.default.red("  ▼ STACK TRACE")));
-		for (const sl of String(stack).split("\n")) {
+		for (const sl of sanitizeForTerminal(String(stack)).split("\n")) {
 			if (!sl.trim()) continue;
 			if (sl.trim().startsWith("at ")) lines.push(coloriseStackFrame(sl));
 			else lines.push("  " + picocolors.default.red(sl.trim()));
@@ -367,18 +407,18 @@ var TUIExplorer = class {
 			}
 			const entry = this.filteredEntries[entryIdx];
 			const isSelected = entryIdx === this.selectedIndex;
-			const level = normalizeLevel(entry.level);
+			const level = sanitizeInline(normalizeLevel(entry.level));
 			const time = formatTime(entry.timestamp);
-			const msg = String(entry.message ?? "");
-			const extraFields = Object.entries(entry).filter(([k]) => ![
+			const msg = sanitizeInline(String(entry.message ?? ""));
+			const extraFieldsSafe = sanitizeInline(Object.entries(entry).filter(([k]) => ![
 				"timestamp",
 				"level",
 				"message",
 				"stack"
-			].includes(k)).map(([k, v]) => `${k}=${typeof v === "object" ? JSON.stringify(v) : String(v)}`).join(" ");
+			].includes(k)).map(([k, v]) => `${k}=${typeof v === "object" ? JSON.stringify(v) : String(v)}`).join(" "));
 			const msgSlot = Math.floor(msgWidth * .65);
 			const msgPart = this.truncate(msg, msgSlot);
-			const extraPart = this.truncate(extraFields, msgWidth - msgPart.length - 2);
+			const extraPart = this.truncate(extraFieldsSafe, msgWidth - msgPart.length - 2);
 			const msgDisplay = msgPart + (extraPart ? picocolors.default.dim("  " + extraPart) : "");
 			const line = ` ${time} ` + levelBadge(level) + " " + this.pad(msgDisplay, msgWidth);
 			if (isSelected) {
@@ -550,10 +590,10 @@ var TUIExplorer = class {
 			if (ext === ".csv") {
 				const entries = this.filteredEntries;
 				const allKeys = [...new Set(entries.flatMap((e) => Object.keys(e)))];
-				const header = allKeys.join(",");
+				const header = allKeys.map((k) => csvField(k)).join(",");
 				const rows = entries.map((e) => allKeys.map((k) => {
 					const v = e[k];
-					return `"${(typeof v === "string" ? v : JSON.stringify(v ?? "")).replace(/"/g, "\"\"")}"`;
+					return csvField(v, true);
 				}).join(","));
 				node_fs.default.writeFileSync(resolved, [header, ...rows].join("\n"), "utf8");
 			} else if (ext === ".ndjson" || ext === ".jsonl") node_fs.default.writeFileSync(resolved, this.filteredEntries.map((e) => JSON.stringify(e)).join("\n"), "utf8");
@@ -653,15 +693,9 @@ function exportAsCSV(entries, fields) {
 	if (entries.length === 0) return "";
 	const columns = fields || Object.keys(entries[0] || {});
 	const lines = [];
-	lines.push(columns.join(","));
+	lines.push(columns.map((c) => csvField(c)).join(","));
 	for (const entry of entries) {
-		const row = columns.map((col) => {
-			const value = entry[col];
-			if (value === void 0 || value === null) return "";
-			const str = String(value);
-			if (str.includes(",") || str.includes("\"") || str.includes("\n")) return `"${str.replace(/"/g, "\"\"")}"`;
-			return str;
-		});
+		const row = columns.map((col) => csvField(entry[col]));
 		lines.push(row.join(","));
 	}
 	return lines.join("\n");
@@ -728,6 +762,20 @@ function parseTimeRange(value) {
 	const parsed = new Date(value);
 	return Number.isNaN(parsed.getTime()) ? void 0 : parsed;
 }
+/** Replace the contents of quoted literals with `_` (same length) so clause keywords inside them are ignored. */
+function maskQuoted(sql) {
+	let out = "";
+	let quote = null;
+	for (const ch of sql) if (quote !== null) if (ch === quote) {
+		quote = null;
+		out += ch;
+	} else out += "_";
+	else {
+		if (ch === "'" || ch === "\"") quote = ch;
+		out += ch;
+	}
+	return out;
+}
 function parseSQL(sql) {
 	const result = {
 		select: "*",
@@ -737,6 +785,8 @@ function parseSQL(sql) {
 		limit: null
 	};
 	const upper = sql.trim().toUpperCase();
+	const masked = maskQuoted(sql.trim());
+	const maskedUpper = masked.toUpperCase();
 	{
 		const m = /^COUNT\s+BY\s+(\w+)/i.exec(sql.trim());
 		if (m) {
@@ -771,22 +821,22 @@ function parseSQL(sql) {
 		}
 	}
 	if (upper.startsWith("SELECT")) {
-		const fromIdx = upper.indexOf(" FROM ");
+		const fromIdx = maskedUpper.indexOf(" FROM ");
 		if (fromIdx !== -1) {
 			const selectPart = sql.slice(6, fromIdx + sql.length - upper.length).trim();
 			if (selectPart !== "*") result.select = selectPart.split(",").map((s) => s.trim()).filter(Boolean);
 		}
 	}
 	const remainder = sql.trim();
-	const whereTokenIdx = remainder.toUpperCase().indexOf("WHERE ");
+	const whereTokenIdx = maskedUpper.indexOf("WHERE ");
 	if (whereTokenIdx !== -1) {
 		const afterWhere = remainder.slice(whereTokenIdx + 6).trimStart();
-		const upperAfter = afterWhere.toUpperCase();
+		const upperAfter = maskedUpper.slice(whereTokenIdx + 6).trimStart();
 		const candidates = [upperAfter.indexOf(" ORDER BY "), upperAfter.indexOf(" LIMIT ")].filter((i) => i !== -1);
 		const endIdx = candidates.length > 0 ? Math.min(...candidates) : afterWhere.length;
 		result.where = parseWhereClause(afterWhere.slice(0, endIdx).trim());
 	}
-	const orderMatch = /ORDER\s+BY\s+(\w+)(?:\s+(ASC|DESC))?/i.exec(remainder);
+	const orderMatch = /ORDER\s+BY\s+(\w+)(?:\s+(ASC|DESC))?/i.exec(masked);
 	if (orderMatch) {
 		var _orderMatch$;
 		result.orderBy = {
@@ -794,7 +844,7 @@ function parseSQL(sql) {
 			dir: ((_orderMatch$ = orderMatch[2]) === null || _orderMatch$ === void 0 ? void 0 : _orderMatch$.toUpperCase()) ?? "ASC"
 		};
 	}
-	const limitMatch = /LIMIT\s+(\d+)/i.exec(remainder);
+	const limitMatch = /LIMIT\s+(\d+)/i.exec(masked);
 	if (limitMatch) result.limit = Number.parseInt(limitMatch[1], 10);
 	return result;
 }
@@ -922,6 +972,21 @@ function parseCondition(expr) {
 	}
 	return null;
 }
+/** Build a case-insensitive regex for a SQL LIKE pattern; only `%` and `_` are special. */
+function likeToRegExp(pattern) {
+	let source = "";
+	let lastWasWildcard = false;
+	for (const ch of pattern) {
+		if (ch === "%") {
+			if (!lastWasWildcard) source += ".*";
+			lastWasWildcard = true;
+			continue;
+		}
+		lastWasWildcard = false;
+		source += ch === "_" ? "." : escapeRegExp(ch);
+	}
+	return new RegExp(`^${source}$`, "i");
+}
 function matchesCondition(row, cond) {
 	const rawFieldValue = row[cond.field];
 	if (rawFieldValue === void 0) return false;
@@ -934,14 +999,8 @@ function matchesCondition(row, cond) {
 		case ">=": return Number(rawFieldValue) >= Number(cond.value);
 		case "<": return Number(rawFieldValue) < Number(cond.value);
 		case "<=": return Number(rawFieldValue) <= Number(cond.value);
-		case "LIKE": {
-			const pattern = condStr.replace(/%/g, ".*").replace(/_/g, ".");
-			return new RegExp(`^${pattern}$`, "i").test(fieldStr);
-		}
-		case "NOT LIKE": {
-			const pattern = condStr.replace(/%/g, ".*").replace(/_/g, ".");
-			return !new RegExp(`^${pattern}$`, "i").test(fieldStr);
-		}
+		case "LIKE": return likeToRegExp(condStr).test(fieldStr);
+		case "NOT LIKE": return !likeToRegExp(condStr).test(fieldStr);
 		case "IN": return cond.value.some((v) => String(rawFieldValue) === v);
 		case "NOT IN": return !cond.value.some((v) => String(rawFieldValue) === v);
 		default: return false;
@@ -961,18 +1020,19 @@ function matchesNode(row, node) {
 function runAggregation(entries, agg) {
 	const { fn, field, groupBy } = agg;
 	if (!groupBy) return picocolors.default.yellow("Aggregation requires a GROUP BY field");
-	const groups = {};
+	const groups = /* @__PURE__ */ new Map();
 	for (const entry of entries) {
 		const key = String(entry[groupBy] ?? "(empty)");
-		if (!groups[key]) groups[key] = [];
-		groups[key].push(entry);
+		const bucket = groups.get(key);
+		if (bucket) bucket.push(entry);
+		else groups.set(key, [entry]);
 	}
-	if (fn === "COUNT" || fn === "GROUP") return formatAsTable(Object.entries(groups).map(([k, v]) => ({
+	if (fn === "COUNT" || fn === "GROUP") return formatAsTable([...groups.entries()].map(([k, v]) => ({
 		[groupBy]: k,
 		count: v.length
 	})).sort((a, b) => b.count - a.count), [groupBy, "count"]);
 	if (!field) return picocolors.default.yellow("Numeric aggregation requires a field: AVG(field) BY group");
-	return formatAsTable(Object.entries(groups).map(([k, v]) => {
+	return formatAsTable([...groups.entries()].map(([k, v]) => {
 		const nums = v.map((e) => Number(e[field])).filter((n) => !Number.isNaN(n));
 		let result;
 		switch (fn) {
@@ -1012,12 +1072,12 @@ function projectRow(row, select) {
 }
 function formatResults(results, format) {
 	if (results.length === 0) return picocolors.default.yellow("No results found");
-	if (format === "json") return JSON.stringify(results, null, 2);
-	if (format === "ndjson") return results.map((r) => JSON.stringify(r)).join("\n");
+	if (format === "json") return sanitizeForTerminal(JSON.stringify(results, null, 2));
+	if (format === "ndjson") return results.map((r) => sanitizeForTerminal(JSON.stringify(r))).join("\n");
 	if (format === "table") return formatAsTable(results, Object.keys(results[0] || {}).slice(0, 6));
 	return results.map((r) => {
 		const level = (r.level || "").toUpperCase();
-		const line = JSON.stringify(r);
+		const line = sanitizeForTerminal(JSON.stringify(r));
 		if (level === "ERROR" || level === "CRITICAL") return picocolors.default.red(line);
 		if (level === "WARN") return picocolors.default.yellow(line);
 		if (level === "DEBUG" || level === "VERBOSE") return picocolors.default.gray(line);
@@ -1048,36 +1108,39 @@ function executeQuery(entries, opts) {
 		results: [],
 		aggregationOutput: runAggregation(rows, query.aggregation)
 	};
-	rows = rows.map((row) => projectRow(row, query.select));
 	const orderField = ((_query$orderBy = query.orderBy) === null || _query$orderBy === void 0 ? void 0 : _query$orderBy.field) ?? opts.orderBy;
 	if (orderField) {
 		var _query$orderBy2;
 		const dir = ((_query$orderBy2 = query.orderBy) === null || _query$orderBy2 === void 0 ? void 0 : _query$orderBy2.dir) ?? "ASC";
-		rows.sort((a, b) => {
+		rows = [...rows].sort((a, b) => {
 			const av = a[orderField];
 			const bv = b[orderField];
-			if (av === void 0 && bv === void 0) return 0;
-			if (av === void 0) return dir === "ASC" ? 1 : -1;
-			if (bv === void 0) return dir === "ASC" ? -1 : 1;
+			const aMissing = av === void 0 || av === null;
+			const bMissing = bv === void 0 || bv === null;
+			if (aMissing && bMissing) return 0;
+			if (aMissing) return 1;
+			if (bMissing) return -1;
 			if (typeof av === "number" && typeof bv === "number") return dir === "ASC" ? av - bv : bv - av;
 			return dir === "ASC" ? String(av).localeCompare(String(bv)) : String(bv).localeCompare(String(av));
 		});
 	}
 	const limitN = query.limit ?? opts.limit;
-	if (limitN && limitN > 0) rows = rows.slice(0, limitN);
+	if (typeof limitN === "number" && limitN >= 0) rows = rows.slice(0, limitN);
+	rows = rows.map((row) => projectRow(row, query.select));
 	return {
 		results: rows,
 		aggregationOutput: null
 	};
 }
-const queryCommand = new commander.Command("query").description("Query log files with SQL-like syntax\n\n  Examples:\n    logixia query app.log --sql \"SELECT * FROM logs WHERE level='error'\"\n    logixia query app.log --sql \"COUNT BY level\"\n    logixia query app.log --sql \"AVG(duration) BY endpoint\"\n    logixia query app.log --since \"last 2 hours\" --format table\n    logixia query app.log --follow --sql \"WHERE level='error'\"\n").argument("<file>", "Path to NDJSON or JSON log file").option("--sql <query>", "SQL-like query string").option("--since <time>", "Only include entries after this time (e.g. \"last 2 hours\", \"today\")").option("--until <time>", "Only include entries before this time").option("--limit <n>", "Maximum number of results to return", "0").option("--order-by <field>", "Sort results by this field").option("--format <fmt>", "Output format: line, table, json, ndjson", "line").option("--follow", "Follow file for new entries matching the query (tail mode)", false).action(async (file, opts) => {
+const queryCommand = new commander.Command("query").description("Query log files with SQL-like syntax\n\n  Examples:\n    logixia query app.log --sql \"SELECT * FROM logs WHERE level='error'\"\n    logixia query app.log --sql \"COUNT BY level\"\n    logixia query app.log --sql \"AVG(duration) BY endpoint\"\n    logixia query app.log --since \"last 2 hours\" --format table\n    logixia query app.log --follow --sql \"WHERE level='error'\"\n").argument("<file>", "Path to NDJSON or JSON log file").option("--sql <query>", "SQL-like query string").option("--since <time>", "Only include entries after this time (e.g. \"last 2 hours\", \"today\")").option("--until <time>", "Only include entries before this time").option("--limit <n>", "Maximum number of results to return").option("--order-by <field>", "Sort results by this field").option("--format <fmt>", "Output format: line, table, json, ndjson", "line").option("--follow", "Follow file for new entries matching the query (tail mode)", false).action(async (file, opts) => {
 	const full = node_path.default.resolve(process.cwd(), file);
 	if (!node_fs.default.existsSync(full)) {
 		console.error(picocolors.default.red(`File not found: ${full}`));
 		process.exit(2);
 	}
 	const entries = safeParseLogs(node_fs.default.readFileSync(full, "utf8"));
-	const limitN = opts.limit ? Number.parseInt(opts.limit, 10) : 0;
+	const parsedLimit = opts.limit === void 0 ? NaN : Number.parseInt(opts.limit, 10);
+	const limitN = Number.isNaN(parsedLimit) ? void 0 : parsedLimit;
 	const { results, aggregationOutput } = executeQuery(entries, {
 		sql: opts.sql,
 		since: opts.since,
@@ -1115,7 +1178,7 @@ const queryCommand = new commander.Command("query").description("Query log files
 					});
 					if (tailResults.length > 0) console.log(formatResults(tailResults, opts.format || "line"));
 				} catch {
-					if (!opts.sql) console.log(line);
+					if (!opts.sql) console.log(sanitizeForTerminal(line));
 				}
 			});
 			rs.on("end", () => {
@@ -1148,14 +1211,14 @@ async function searchLogs(raw, opts = {}) {
 	});
 }
 function formatSearchResults(results, format, _context) {
-	if (format === "json") return JSON.stringify(results, null, 2);
+	if (format === "json") return sanitizeForTerminal(JSON.stringify(results, null, 2));
 	if (format === "table") {
 		if (results.length === 0) return picocolors.default.yellow("No results found");
 		return formatAsTable(results, Object.keys(results[0] || {}).slice(0, 4));
 	}
 	if (results.length === 0) return picocolors.default.yellow("No results found");
 	return results.map((r, idx) => {
-		const line = JSON.stringify(r);
+		const line = sanitizeForTerminal(JSON.stringify(r));
 		return `${picocolors.default.gray(String(idx + 1) + ":")} ${line}`;
 	}).join("\n");
 }
@@ -1179,11 +1242,11 @@ const searchCommand = new commander.Command("search").description("Search log fi
 async function generateStats(raw, opts = {}) {
 	const entries = safeParseLogs(raw);
 	const group = opts.groupBy || "level";
-	const agg = {};
+	const agg = Object.create(null);
 	let minTime = null;
 	let maxTime = null;
 	for (const e of entries) {
-		const key = (e[group] || e.level || "unknown").toString().toUpperCase();
+		const key = String(e[group] || e.level || "unknown").toUpperCase();
 		agg[key] = (agg[key] || 0) + 1;
 		if (e.timestamp) {
 			const ts = new Date(e.timestamp);
@@ -1204,14 +1267,15 @@ async function generateStats(raw, opts = {}) {
 function formatStatsOutput(stats, filename) {
 	const s = stats;
 	const lines = [];
-	lines.push(picocolors.default.bold(`\nLog Statistics for ${node_path.default.basename(filename)}`));
+	lines.push(picocolors.default.bold(`\nLog Statistics for ${sanitizeInline(node_path.default.basename(filename))}`));
 	lines.push(picocolors.default.bold("=".repeat(50)));
 	lines.push(picocolors.default.cyan(`Total Entries: ${s["total"].toLocaleString()}`));
 	if (s["timeRange"]) lines.push(picocolors.default.cyan(`Time Range: ${s["timeRange"]["start"].toISOString()} - ${s["timeRange"]["end"].toISOString()}`));
 	lines.push("");
-	lines.push(picocolors.default.bold(`${s["groupBy"].charAt(0).toUpperCase() + s["groupBy"].slice(1)} Distribution:`));
+	lines.push(picocolors.default.bold(`${sanitizeInline(s["groupBy"].charAt(0).toUpperCase() + s["groupBy"].slice(1))} Distribution:`));
 	const sorted = Object.entries(s["distribution"]).sort(([, a], [, b]) => b - a);
-	for (const [key, count] of sorted) {
+	for (const [rawKey, count] of sorted) {
+		const key = sanitizeInline(rawKey);
 		const percentage = (count / s["total"] * 100).toFixed(1);
 		const bar = "█".repeat(Math.floor(count / s["total"] * 30));
 		let colorFn = picocolors.default.white;
@@ -1231,7 +1295,7 @@ const statsCommand = new commander.Command("stats").description("Show statistics
 		process.exit(2);
 	}
 	const stats = await generateStats(node_fs.default.readFileSync(full, "utf8"), opts);
-	if (opts.format === "json") console.log(JSON.stringify(stats, null, 2));
+	if (opts.format === "json") console.log(sanitizeForTerminal(JSON.stringify(stats, null, 2)));
 	else console.log(formatStatsOutput(stats, file));
 });
 
@@ -1256,17 +1320,18 @@ function applyFilter(line, filter) {
 		return line.toLowerCase().includes(filter.value.toLowerCase());
 	}
 }
-function highlightLine(line, highlight) {
+function highlightLine(rawLine, highlight) {
+	const line = sanitizeForTerminal(rawLine);
 	if (!highlight) return line;
 	try {
-		const level = (JSON.parse(line).level || "").toUpperCase();
+		const level = (JSON.parse(rawLine).level || "").toUpperCase();
 		if (level === "ERROR") return picocolors.default.red(line);
 		if (level === "WARN") return picocolors.default.yellow(line);
 		if (level === "INFO") return picocolors.default.blue(line);
 		if (level === "DEBUG") return picocolors.default.gray(line);
 		return line;
 	} catch {
-		const regex = new RegExp(highlight, "gi");
+		const regex = new RegExp(escapeRegExp(sanitizeForTerminal(highlight)), "gi");
 		return line.replace(regex, (match) => picocolors.default.bgYellow(picocolors.default.black(match)));
 	}
 }

package/dist/cloudwatch.d.mts

@@ -1,3 +1,3 @@
-import "./transport.types-B5vcyv2k.mjs";
-import { n as CloudWatchTransportConfig, t as CloudWatchTransport } from "./cloudwatch.transport-CGHY4buE.mjs";
+import "./transport.types-BMnurPcc.mjs";
+import { n as CloudWatchTransportConfig, t as CloudWatchTransport } from "./cloudwatch.transport-UlyZFWMn.mjs";
 export { CloudWatchTransport, CloudWatchTransportConfig };

package/dist/cloudwatch.d.ts

@@ -1,3 +1,3 @@
-import "./transport.types-BuY84TwO.js";
-import { n as CloudWatchTransportConfig, t as CloudWatchTransport } from "./cloudwatch.transport-DK_8cKd3.js";
+import "./transport.types-CGoHpWQR.js";
+import { n as CloudWatchTransportConfig, t as CloudWatchTransport } from "./cloudwatch.transport-DsEq633o.js";
 export { CloudWatchTransport, CloudWatchTransportConfig };

package/dist/cloudwatch.js

@@ -1,6 +1,7 @@
 require('./internal-log-BUJYMZbE.js');
 require('./safe-stringify-DWo3aZp_.js');
 require('./batch-buffer-BY-mRWIK.js');
-const require_cloudwatch_transport = require('./cloudwatch.transport-pNBNWJLt.js');
+const require_cloudwatch_transport = require('./cloudwatch.transport-BO1ahxw-.js');
+require('./entry-fields-BvOLFlJ4.js');
 
 exports.CloudWatchTransport = require_cloudwatch_transport.CloudWatchTransport;

package/dist/cloudwatch.mjs

@@ -1,6 +1,7 @@
 import "./internal-log-Cm8SOWSV.mjs";
 import "./safe-stringify-DJ66tW5I.mjs";
 import "./batch-buffer-PGvSgbmd.mjs";
-import { t as CloudWatchTransport } from "./cloudwatch.transport-yBwm4OeO.mjs";
+import { t as CloudWatchTransport } from "./cloudwatch.transport-DZ6ies7g.mjs";
+import "./entry-fields-BJkuPnIg.mjs";
 
 export { CloudWatchTransport };

package/dist/{cloudwatch.transport-pNBNWJLt.js → cloudwatch.transport-BO1ahxw-.js}

@@ -2,6 +2,7 @@ const require_chunk = require('./chunk-nOFOJqeH.js');
 const require_internal_log = require('./internal-log-BUJYMZbE.js');
 const require_safe_stringify = require('./safe-stringify-DWo3aZp_.js');
 const require_batch_buffer = require('./batch-buffer-BY-mRWIK.js');
+const require_entry_fields = require('./entry-fields-BvOLFlJ4.js');
 let node_fs = require("node:fs");
 node_fs = require_chunk.__toESM(node_fs);
 let node_os = require("node:os");
@@ -202,6 +203,7 @@ function signV4(opts) {
 //#endregion
 //#region src/transports/cloudwatch.transport.ts
 const MAX_EVENTS_PER_PUT = 1e4;
+const EMF_MAX_METRICS = 100;
 /** Error types worth retrying even though CloudWatch reports them as HTTP 400. */
 const RETRYABLE_TYPES = new Set([
 	"ThrottlingException",
@@ -237,6 +239,7 @@ var CloudWatchTransport = class {
 		this.emfNamespace = config.emfNamespace ?? "Logixia";
 		this.flushInterval = config.flushIntervalMs ?? 5e3;
 		this.emf = config.emf ?? false;
+		this.emfMetrics = config.emfMetrics ? new Set(config.emfMetrics) : void 0;
 		this.level = config.level;
 		this.requestTimeoutMs = config.requestTimeoutMs ?? require_batch_buffer.DEFAULT_REQUEST_TIMEOUT_MS;
 		this.buffer = new require_batch_buffer.BatchBuffer({
@@ -277,25 +280,29 @@ var CloudWatchTransport = class {
 	}
 	toEmf(entry) {
 		const { level, message, data: payload, timestamp } = entry;
-		const numericFields = {};
-		for (const [k, v] of Object.entries(payload ?? {})) if (typeof v === "number") numericFields[k] = v;
-		return require_safe_stringify.stringifyForLog({
-			_aws: {
-				Timestamp: timestamp ? new Date(timestamp).getTime() : Date.now(),
-				CloudWatchMetrics: Object.keys(numericFields).length > 0 ? [{
-					Namespace: this.emfNamespace,
-					Dimensions: [["level"]],
-					Metrics: Object.keys(numericFields).map((n) => ({
-						Name: n,
-						Unit: "None"
-					}))
-				}] : []
-			},
+		const fields = require_entry_fields.mergeCoreFields({
+			_aws: void 0,
 			level,
-			message,
-			...payload,
-			...numericFields
-		});
+			message
+		}, payload);
+		const metricNames = [];
+		for (const [k, v] of Object.entries(fields)) {
+			if (k === "_aws" || k === "level" || k === "message" || typeof v !== "number") continue;
+			if (this.emfMetrics && !this.emfMetrics.has(k)) continue;
+			if (metricNames.length < EMF_MAX_METRICS) metricNames.push(k);
+		}
+		fields["_aws"] = {
+			Timestamp: timestamp ? new Date(timestamp).getTime() : Date.now(),
+			CloudWatchMetrics: metricNames.length > 0 ? [{
+				Namespace: this.emfNamespace,
+				Dimensions: [["level"]],
+				Metrics: metricNames.map((n) => ({
+					Name: n,
+					Unit: "None"
+				}))
+			}] : []
+		};
+		return require_safe_stringify.stringifyForLog(fields);
 	}
 	async putLogEvents(events) {
 		await this.ensureStream();
@@ -367,4 +374,4 @@ Object.defineProperty(exports, 'CloudWatchTransport', {
     return CloudWatchTransport;
   }
 });
-//# sourceMappingURL=cloudwatch.transport-pNBNWJLt.js.map
+//# sourceMappingURL=cloudwatch.transport-BO1ahxw-.js.map

package/dist/cloudwatch.transport-BO1ahxw-.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudwatch.transport-BO1ahxw-.js","names":["out: Record<string, Record<string, string>>","section: Record<string, string> | undefined","path","os","text: string","fs","headers: Record<string, string>","httpRequest","crypto","headers: Record<string, string>","HttpError","DEFAULT_REQUEST_TIMEOUT_MS","BatchBuffer","DEFAULT_MAX_BUFFER_SIZE","isPermanentHttpError","stringifyForLog","mergeCoreFields","metricNames: string[]","httpRequest"],"sources":["../src/transports/aws-credentials.ts","../src/transports/aws-sigv4.ts","../src/transports/cloudwatch.transport.ts"],"sourcesContent":["/**\n * AWS credential resolution without the SDK.\n *\n * Order: explicit config, environment variables, shared credentials file,\n * ECS/container credentials, EC2 instance metadata (IMDSv2).\n * Not supported: SSO, assume-role profiles, credential_process, web identity.\n */\n\nimport * as fs from 'node:fs';\nimport * as os from 'node:os';\nimport * as path from 'node:path';\n\nimport { internalWarn } from '../utils/internal-log';\nimport { type AwsCredentials } from './aws-sigv4';\nimport { httpRequest } from './batch-buffer';\n\nconst REFRESH_MARGIN_MS = 5 * 60 * 1000;\nconst FAILURE_BACKOFF_MS = 30 * 1000;\nconst METADATA_TIMEOUT_MS = 2000;\n\nexport interface AwsCredentialConfig {\n  accessKeyId?: string | undefined;\n  secretAccessKey?: string | undefined;\n  sessionToken?: string | undefined;\n}\n\n/** Parse the sections of an AWS ini file into `{ section: { key: value } }`. */\nexport function parseIni(text: string): Record<string, Record<string, string>> {\n  const out: Record<string, Record<string, string>> = {};\n  let section: Record<string, string> | undefined;\n  for (const raw of text.split(/\\r?\\n/)) {\n    const line = raw.trim();\n    if (!line || line.startsWith('#') || line.startsWith(';')) continue;\n    const header = /^\\[(.+)\\]$/.exec(line);\n    if (header) {\n      section = out[header[1]!.trim()] = out[header[1]!.trim()] ?? {};\n      continue;\n    }\n    const eq = line.indexOf('=');\n    if (eq > 0 && section) section[line.slice(0, eq).trim()] = line.slice(eq + 1).trim();\n  }\n  return out;\n}\n\nfunction fromEnv(): AwsCredentials | undefined {\n  const accessKeyId = process.env['AWS_ACCESS_KEY_ID'];\n  const secretAccessKey = process.env['AWS_SECRET_ACCESS_KEY'];\n  if (!accessKeyId || !secretAccessKey) return undefined;\n  return { accessKeyId, secretAccessKey, sessionToken: process.env['AWS_SESSION_TOKEN'] };\n}\n\nfunction fromSharedFile(): AwsCredentials | undefined {\n  const file =\n    process.env['AWS_SHARED_CREDENTIALS_FILE'] ?? path.join(os.homedir(), '.aws', 'credentials');\n  const profile = process.env['AWS_PROFILE'] ?? 'default';\n  let text: string;\n  try {\n    text = fs.readFileSync(file, 'utf8');\n  } catch {\n    return undefined;\n  }\n  const section = parseIni(text)[profile];\n  const accessKeyId = section?.['aws_access_key_id'];\n  const secretAccessKey = section?.['aws_secret_access_key'];\n  if (!accessKeyId || !secretAccessKey) return undefined;\n  return { accessKeyId, secretAccessKey, sessionToken: section?.['aws_session_token'] };\n}\n\ninterface CredentialDocument {\n  AccessKeyId?: string;\n  SecretAccessKey?: string;\n  Token?: string;\n  Expiration?: string;\n}\n\nfunction fromDocument(raw: string): AwsCredentials | undefined {\n  const doc = JSON.parse(raw) as CredentialDocument;\n  if (!doc.AccessKeyId || !doc.SecretAccessKey) return undefined;\n  const expiresAt = doc.Expiration ? Date.parse(doc.Expiration) : Number.NaN;\n  return {\n    accessKeyId: doc.AccessKeyId,\n    secretAccessKey: doc.SecretAccessKey,\n    sessionToken: doc.Token,\n    expiresAt: Number.isNaN(expiresAt) ? undefined : expiresAt,\n  };\n}\n\nconst CONTAINER_HOSTS = new Set([\n  // eslint-disable-next-line sonarjs/no-hardcoded-ip -- fixed ECS credentials endpoint\n  '169.254.170.2',\n  // eslint-disable-next-line sonarjs/no-hardcoded-ip -- fixed EKS pod identity endpoint\n  '169.254.170.23',\n  '[fd00:ec2::23]',\n  'localhost',\n  '[::1]',\n]);\n\n/** Same rule as the AWS SDKs: never send the container token to an arbitrary http host. */\nfunction isAllowedContainerHost(url: URL): boolean {\n  if (url.protocol === 'https:') return true;\n  if (url.protocol !== 'http:') return false;\n  return CONTAINER_HOSTS.has(url.hostname) || /^127(?:\\.\\d{1,3}){3}$/.test(url.hostname);\n}\n\nasync function fromContainer(): Promise<AwsCredentials | undefined> {\n  const relative = process.env['AWS_CONTAINER_CREDENTIALS_RELATIVE_URI'];\n  const full = process.env['AWS_CONTAINER_CREDENTIALS_FULL_URI'];\n  if (!relative && !full) return undefined;\n  const url = new URL(relative ? `http://169.254.170.2${relative}` : (full as string));\n  if (!relative && !isAllowedContainerHost(url)) {\n    internalWarn(\n      `ignoring AWS_CONTAINER_CREDENTIALS_FULL_URI: ${url.host} is not https or a loopback / ECS / EKS address`\n    );\n    return undefined;\n  }\n  const headers: Record<string, string> = {};\n  const tokenFile = process.env['AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE'];\n  const token = tokenFile\n    ? fs.readFileSync(tokenFile, 'utf8').trim()\n    : process.env['AWS_CONTAINER_AUTHORIZATION_TOKEN'];\n  if (token) headers['Authorization'] = token;\n  const res = await httpRequest({\n    url,\n    method: 'GET',\n    headers,\n    timeoutMs: METADATA_TIMEOUT_MS,\n    label: 'AWS container credentials',\n  });\n  return fromDocument(res.body);\n}\n\nasync function fromInstanceMetadata(): Promise<AwsCredentials | undefined> {\n  if (process.env['AWS_EC2_METADATA_DISABLED'] === 'true') return undefined;\n  const base = process.env['AWS_EC2_METADATA_SERVICE_ENDPOINT'] ?? 'http://169.254.169.254';\n  const get = (p: string, method: string, headers: Record<string, string>) =>\n    httpRequest({\n      url: new URL(p, base),\n      method,\n      headers,\n      timeoutMs: METADATA_TIMEOUT_MS,\n      label: 'EC2 instance metadata',\n    });\n  const session = await get('/latest/api/token', 'PUT', {\n    'X-aws-ec2-metadata-token-ttl-seconds': '21600',\n  });\n  const auth = { 'X-aws-ec2-metadata-token': session.body.trim() };\n  const roles = await get('/latest/meta-data/iam/security-credentials/', 'GET', auth);\n  const role = roles.body.split('\\n')[0]?.trim();\n  if (!role) return undefined;\n  const creds = await get(\n    `/latest/meta-data/iam/security-credentials/${encodeURIComponent(role)}`,\n    'GET',\n    auth\n  );\n  return fromDocument(creds.body);\n}\n\nexport class AwsCredentialProvider {\n  private cached: AwsCredentials | undefined;\n  private failedAt = 0;\n  private readonly explicit: AwsCredentials | undefined;\n\n  constructor(config: AwsCredentialConfig) {\n    if (config.accessKeyId && config.secretAccessKey) {\n      this.explicit = {\n        accessKeyId: config.accessKeyId,\n        secretAccessKey: config.secretAccessKey,\n        sessionToken: config.sessionToken,\n      };\n    }\n  }\n\n  /** Throws when no source yields credentials, so the caller keeps its buffer. */\n  async get(): Promise<AwsCredentials> {\n    if (this.explicit) return this.explicit;\n    const env = fromEnv();\n    if (env) return env;\n    if (this.cached && !this.isExpiring(this.cached)) return this.cached;\n    if (Date.now() - this.failedAt < FAILURE_BACKOFF_MS) {\n      throw new Error('no AWS credentials found (retrying shortly)');\n    }\n\n    let found = fromSharedFile();\n    for (const source of [fromContainer, fromInstanceMetadata]) {\n      if (found) break;\n      try {\n        found = await source();\n      } catch {\n        /* source not available here; try the next */\n      }\n    }\n    if (!found) {\n      this.failedAt = Date.now();\n      throw new Error(\n        'no AWS credentials found: set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, a shared credentials file, container credentials, or run on EC2 with an instance role'\n      );\n    }\n    this.cached = found;\n    return found;\n  }\n\n  invalidate(): void {\n    this.cached = undefined;\n    this.failedAt = 0;\n  }\n\n  private isExpiring(c: AwsCredentials): boolean {\n    return c.expiresAt !== undefined && c.expiresAt - Date.now() < REFRESH_MARGIN_MS;\n  }\n}\n","/**\n * AWS Signature Version 4 request signing, dependency-free.\n */\n\nimport * as crypto from 'node:crypto';\n\nexport interface AwsCredentials {\n  accessKeyId: string;\n  secretAccessKey: string;\n  sessionToken?: string | undefined;\n  /** Epoch ms after which the credentials are no longer valid. */\n  expiresAt?: number | undefined;\n}\n\nexport interface SignV4Options {\n  method: string;\n  path: string;\n  query?: string;\n  /** Must include `host`. Names are lowercased before signing. */\n  headers: Record<string, string>;\n  body: string;\n  region: string;\n  service: string;\n  credentials: AwsCredentials;\n  date?: Date;\n}\n\nconst sha256Hex = (data: string): string => crypto.createHash('sha256').update(data).digest('hex');\n\nconst hmac = (key: Buffer | string, msg: string): Buffer =>\n  crypto.createHmac('sha256', key).update(msg).digest();\n\n/** Returns the request headers (lowercase names) with `x-amz-date` and `authorization` added. */\nexport function signV4(opts: SignV4Options): Record<string, string> {\n  const {\n    method,\n    path,\n    query = '',\n    body,\n    region,\n    service,\n    credentials,\n    headers: input,\n    date,\n  } = opts;\n  const amzDate = (date ?? new Date()).toISOString().replace(/[:-]|\\.\\d{3}/g, '');\n  const dateStamp = amzDate.slice(0, 8);\n\n  const headers: Record<string, string> = {};\n  for (const [k, v] of Object.entries(input)) headers[k.toLowerCase()] = v;\n  headers['x-amz-date'] = amzDate;\n  if (credentials.sessionToken) headers['x-amz-security-token'] = credentials.sessionToken;\n\n  const names = Object.keys(headers).sort();\n  const canonicalHeaders = names\n    .map((n) => `${n}:${headers[n]!.trim().replace(/\\s+/g, ' ')}\\n`)\n    .join('');\n  const signedHeaders = names.join(';');\n\n  const canonicalRequest = [\n    method,\n    path,\n    query,\n    canonicalHeaders,\n    signedHeaders,\n    sha256Hex(body),\n  ].join('\\n');\n  const scope = `${dateStamp}/${region}/${service}/aws4_request`;\n  const stringToSign = ['AWS4-HMAC-SHA256', amzDate, scope, sha256Hex(canonicalRequest)].join('\\n');\n\n  const signingKey = hmac(\n    hmac(hmac(hmac(`AWS4${credentials.secretAccessKey}`, dateStamp), region), service),\n    'aws4_request'\n  );\n  const signature = crypto.createHmac('sha256', signingKey).update(stringToSign).digest('hex');\n\n  headers['authorization'] =\n    `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, ` +\n    `SignedHeaders=${signedHeaders}, Signature=${signature}`;\n  return headers;\n}\n","/**\n * logixia — AWS CloudWatch Logs transport\n *\n * Sends log entries to AWS CloudWatch Logs via the PutLogEvents API.\n * Supports EMF (Embedded Metric Format) for automatic metric extraction.\n *\n * Auth, in order: explicit config, environment variables, the shared\n * credentials file (AWS_PROFILE, AWS_SHARED_CREDENTIALS_FILE), ECS container\n * credentials, then EC2 instance metadata (IMDSv2). SSO, assume-role profiles\n * and credential_process are not supported. No SDK dependency — raw HTTPS with\n * AWS Signature Version 4.\n *\n * The log group and stream are created on first use if they do not exist.\n *\n * @example\n * ```ts\n * import { CloudWatchTransport } from 'logixia';\n *\n * const logger = createLogger({\n *   transports: {\n *     cloudwatch: new CloudWatchTransport({\n *       region: 'us-east-1',\n *       logGroupName: '/myapp/production',\n *       logStreamName: `api-${process.env.HOSTNAME}`,\n *       batchSize: 100,\n *       flushIntervalMs: 5000,\n *     }),\n *   },\n * });\n * ```\n */\n\nimport type { IAsyncTransport, TransportLogEntry } from '../types/transport.types';\nimport { internalWarn } from '../utils/internal-log';\nimport { stringifyForLog } from '../utils/safe-stringify';\nimport { AwsCredentialProvider } from './aws-credentials';\nimport { signV4 } from './aws-sigv4';\nimport {\n  BatchBuffer,\n  DEFAULT_MAX_BUFFER_SIZE,\n  DEFAULT_REQUEST_TIMEOUT_MS,\n  HttpError,\n  httpRequest,\n  isPermanentHttpError,\n} from './batch-buffer';\nimport { mergeCoreFields } from './entry-fields';\n\nexport interface CloudWatchTransportConfig {\n  /** AWS region, e.g. `'us-east-1'`. Falls back to `AWS_REGION` env var. */\n  region?: string;\n  /** CloudWatch Logs group name. Created automatically if it does not exist. */\n  logGroupName: string;\n  /** CloudWatch Logs stream name. Defaults to hostname + process PID. */\n  logStreamName?: string;\n  /** Override the Logs endpoint, e.g. for LocalStack. Default: `https://logs.<region>.amazonaws.com`. */\n  endpoint?: string;\n  /** AWS access key ID. Falls back to the credential chain described above. */\n  accessKeyId?: string;\n  /** AWS secret access key. Used together with `accessKeyId`. */\n  secretAccessKey?: string;\n  /** AWS session token for temporary credentials. Used together with `accessKeyId`. */\n  sessionToken?: string;\n  /**\n   * Number of log events to batch before flushing.\n   * CloudWatch allows max 10,000 events per PutLogEvents call; larger values are capped.\n   * @default 100\n   */\n  batchSize?: number;\n  /**\n   * Max ms between flushes even if batchSize is not reached.\n   * @default 5000\n   */\n  flushIntervalMs?: number;\n  /**\n   * Enable EMF (Embedded Metric Format) — wraps log entries as CloudWatch\n   * metric namespaces so numeric fields become CloudWatch Metrics automatically.\n   * @default false\n   */\n  emf?: boolean;\n  /** CloudWatch Metrics namespace used by EMF. @default 'Logixia' */\n  emfNamespace?: string;\n  /**\n   * Payload fields published as EMF metrics. When set, only these numeric\n   * fields become metrics; when unset every numeric payload field does (up to\n   * the EMF limit of 100 per entry).\n   */\n  emfMetrics?: string[];\n  /** Abort a request that has not finished after this many ms. @default 10000 */\n  requestTimeoutMs?: number;\n  /** Max buffered events; the oldest are dropped past this. @default 10000 */\n  maxBufferSize?: number;\n  /** Minimum log level to forward. */\n  level?: string;\n}\n\nconst MAX_EVENTS_PER_PUT = 10_000;\nconst EMF_MAX_METRICS = 100;\n\n/** Error types worth retrying even though CloudWatch reports them as HTTP 400. */\nconst RETRYABLE_TYPES = new Set([\n  'ThrottlingException',\n  'ThrottledException',\n  'LimitExceededException',\n  'ServiceUnavailableException',\n  'ExpiredTokenException',\n  'ResourceNotFoundException',\n]);\n\nfunction awsErrorType(err: unknown): string | undefined {\n  if (!(err instanceof HttpError)) return undefined;\n  try {\n    const type = (JSON.parse(err.body) as { __type?: string }).__type;\n    return type?.split('#').pop();\n  } catch {\n    return undefined;\n  }\n}\n\ninterface CwLogEvent {\n  timestamp: number;\n  message: string;\n}\n\n/**\n * AWS CloudWatch Logs transport with EMF support and batched PutLogEvents calls.\n */\nexport class CloudWatchTransport implements IAsyncTransport {\n  public readonly name = 'cloudwatch';\n  public readonly batchSize: number;\n  public readonly flushInterval: number;\n  public readonly level: string | undefined;\n\n  private readonly buffer: BatchBuffer<CwLogEvent>;\n  private readonly requestTimeoutMs: number;\n  private flushTimer: NodeJS.Timeout | null = null;\n  private readonly credentials: AwsCredentialProvider;\n  private readonly endpoint: URL;\n  private streamReady = false;\n\n  private readonly region: string;\n  private readonly logGroupName: string;\n  private readonly logStreamName: string;\n  private readonly emf: boolean;\n  private readonly emfNamespace: string;\n  private readonly emfMetrics: ReadonlySet<string> | undefined;\n\n  constructor(config: CloudWatchTransportConfig) {\n    this.region =\n      config.region ??\n      process.env['AWS_REGION'] ??\n      process.env['AWS_DEFAULT_REGION'] ??\n      'us-east-1';\n    this.logGroupName = config.logGroupName;\n    this.logStreamName =\n      config.logStreamName ?? `${process.env['HOSTNAME'] ?? 'node'}-${process.pid}`;\n    this.credentials = new AwsCredentialProvider(config);\n    this.endpoint = new URL(config.endpoint ?? `https://logs.${this.region}.amazonaws.com`);\n    this.batchSize = Math.min(config.batchSize ?? 100, MAX_EVENTS_PER_PUT);\n    this.emfNamespace = config.emfNamespace ?? 'Logixia';\n    this.flushInterval = config.flushIntervalMs ?? 5000;\n    this.emf = config.emf ?? false;\n    this.emfMetrics = config.emfMetrics ? new Set(config.emfMetrics) : undefined;\n    this.level = config.level;\n    this.requestTimeoutMs = config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;\n    this.buffer = new BatchBuffer<CwLogEvent>({\n      name: 'CloudWatchTransport',\n      batchSize: this.batchSize,\n      maxBufferSize: config.maxBufferSize ?? DEFAULT_MAX_BUFFER_SIZE,\n      send: (events) => this.putLogEvents(events),\n      shouldRetry: (err) =>\n        !isPermanentHttpError(err) || RETRYABLE_TYPES.has(awsErrorType(err) ?? ''),\n    });\n\n    this.flushTimer = setInterval(() => {\n      this.flush().catch(() => {});\n    }, this.flushInterval);\n    if (this.flushTimer.unref) this.flushTimer.unref();\n  }\n\n  write(entry: TransportLogEntry): void {\n    const timestamp = entry.timestamp ? new Date(entry.timestamp).getTime() : Date.now();\n    const message = this.emf ? this.toEmf(entry) : stringifyForLog(entry);\n    this.buffer.push({ timestamp, message });\n    this.buffer.flushIfFull();\n  }\n\n  flush(): Promise<void> {\n    return this.buffer.flush();\n  }\n\n  /**\n   * Flush remaining events and stop the interval timer on shutdown. Without this\n   * the manager's close() skips the transport (close was undefined) and any\n   * buffered events were lost on deploy. Waits for any in-flight send first.\n   */\n  async close(): Promise<void> {\n    if (this.flushTimer) {\n      clearInterval(this.flushTimer);\n      this.flushTimer = null;\n    }\n    await this.buffer.close();\n  }\n\n  private toEmf(entry: TransportLogEntry): string {\n    const { level, message, data: payload, timestamp } = entry;\n    const fields = mergeCoreFields({ _aws: undefined, level, message }, payload);\n    const metricNames: string[] = [];\n    for (const [k, v] of Object.entries(fields)) {\n      if (k === '_aws' || k === 'level' || k === 'message' || typeof v !== 'number') continue;\n      if (this.emfMetrics && !this.emfMetrics.has(k)) continue;\n      if (metricNames.length < EMF_MAX_METRICS) metricNames.push(k);\n    }\n    fields['_aws'] = {\n      Timestamp: timestamp ? new Date(timestamp).getTime() : Date.now(),\n      CloudWatchMetrics:\n        metricNames.length > 0\n          ? [\n              {\n                Namespace: this.emfNamespace,\n                Dimensions: [['level']],\n                Metrics: metricNames.map((n) => ({ Name: n, Unit: 'None' })),\n              },\n            ]\n          : [],\n    };\n    return stringifyForLog(fields);\n  }\n\n  private async putLogEvents(events: CwLogEvent[]): Promise<void> {\n    await this.ensureStream();\n    const logEvents = [...events].sort((a, b) => a.timestamp - b.timestamp);\n    try {\n      await this.call('PutLogEvents', {\n        logGroupName: this.logGroupName,\n        logStreamName: this.logStreamName,\n        logEvents,\n      });\n    } catch (err) {\n      const type = awsErrorType(err);\n      if (type === 'DataAlreadyAcceptedException') return;\n      if (type === 'ResourceNotFoundException') this.streamReady = false;\n      if (type === 'ExpiredTokenException') this.credentials.invalidate();\n      throw err;\n    }\n  }\n\n  private async ensureStream(): Promise<void> {\n    if (this.streamReady) return;\n    try {\n      await this.call('CreateLogGroup', { logGroupName: this.logGroupName });\n    } catch (err) {\n      if (awsErrorType(err) === 'ExpiredTokenException') this.credentials.invalidate();\n      if (!(err instanceof HttpError)) throw err;\n      if (awsErrorType(err) !== 'ResourceAlreadyExistsException') {\n        internalWarn(`CloudWatchTransport: CreateLogGroup failed, continuing (${err.message})`);\n      }\n    }\n    try {\n      await this.call('CreateLogStream', {\n        logGroupName: this.logGroupName,\n        logStreamName: this.logStreamName,\n      });\n    } catch (err) {\n      if (awsErrorType(err) !== 'ResourceAlreadyExistsException') throw err;\n    }\n    this.streamReady = true;\n  }\n\n  private async call(action: string, payload: Record<string, unknown>): Promise<void> {\n    const credentials = await this.credentials.get();\n    const body = stringifyForLog(payload);\n    const { host } = this.endpoint;\n    const headers = signV4({\n      method: 'POST',\n      path: '/',\n      headers: {\n        host,\n        'content-type': 'application/x-amz-json-1.1',\n        'x-amz-target': `Logs_20140328.${action}`,\n      },\n      body,\n      region: this.region,\n      service: 'logs',\n      credentials,\n    });\n    await httpRequest({\n      url: this.endpoint,\n      headers,\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: `CloudWatch ${action}`,\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAgBA,MAAM,oBAAoB,MAAS;AACnC,MAAM,qBAAqB,KAAK;AAChC,MAAM,sBAAsB;;AAS5B,SAAgB,SAAS,MAAsD;CAC7E,MAAMA,MAA8C,EAAE;CACtD,IAAIC;AACJ,MAAK,MAAM,OAAO,KAAK,MAAM,QAAQ,EAAE;EACrC,MAAM,OAAO,IAAI,MAAM;AACvB,MAAI,CAAC,QAAQ,KAAK,WAAW,IAAI,IAAI,KAAK,WAAW,IAAI,CAAE;EAC3D,MAAM,SAAS,aAAa,KAAK,KAAK;AACtC,MAAI,QAAQ;AACV,aAAU,IAAI,OAAO,GAAI,MAAM,IAAI,IAAI,OAAO,GAAI,MAAM,KAAK,EAAE;AAC/D;;EAEF,MAAM,KAAK,KAAK,QAAQ,IAAI;AAC5B,MAAI,KAAK,KAAK,QAAS,SAAQ,KAAK,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,KAAK,MAAM,KAAK,EAAE,CAAC,MAAM;;AAEtF,QAAO;;AAGT,SAAS,UAAsC;CAC7C,MAAM,cAAc,QAAQ,IAAI;CAChC,MAAM,kBAAkB,QAAQ,IAAI;AACpC,KAAI,CAAC,eAAe,CAAC,gBAAiB,QAAO;AAC7C,QAAO;EAAE;EAAa;EAAiB,cAAc,QAAQ,IAAI;EAAsB;;AAGzF,SAAS,iBAA6C;CACpD,MAAM,OACJ,QAAQ,IAAI,kCAAkCC,UAAK,KAAKC,QAAG,SAAS,EAAE,QAAQ,cAAc;CAC9F,MAAM,UAAU,QAAQ,IAAI,kBAAkB;CAC9C,IAAIC;AACJ,KAAI;AACF,SAAOC,QAAG,aAAa,MAAM,OAAO;SAC9B;AACN;;CAEF,MAAM,UAAU,SAAS,KAAK,CAAC;CAC/B,MAAM,gEAAc,QAAU;CAC9B,MAAM,oEAAkB,QAAU;AAClC,KAAI,CAAC,eAAe,CAAC,gBAAiB,QAAO;AAC7C,QAAO;EAAE;EAAa;EAAiB,gEAAc,QAAU;EAAsB;;AAUvF,SAAS,aAAa,KAAyC;CAC7D,MAAM,MAAM,KAAK,MAAM,IAAI;AAC3B,KAAI,CAAC,IAAI,eAAe,CAAC,IAAI,gBAAiB,QAAO;CACrD,MAAM,YAAY,IAAI,aAAa,KAAK,MAAM,IAAI,WAAW,GAAG;AAChE,QAAO;EACL,aAAa,IAAI;EACjB,iBAAiB,IAAI;EACrB,cAAc,IAAI;EAClB,WAAW,OAAO,MAAM,UAAU,GAAG,SAAY;EAClD;;AAGH,MAAM,kBAAkB,IAAI,IAAI;CAE9B;CAEA;CACA;CACA;CACA;CACD,CAAC;;AAGF,SAAS,uBAAuB,KAAmB;AACjD,KAAI,IAAI,aAAa,SAAU,QAAO;AACtC,KAAI,IAAI,aAAa,QAAS,QAAO;AACrC,QAAO,gBAAgB,IAAI,IAAI,SAAS,IAAI,wBAAwB,KAAK,IAAI,SAAS;;AAGxF,eAAe,gBAAqD;CAClE,MAAM,WAAW,QAAQ,IAAI;CAC7B,MAAM,OAAO,QAAQ,IAAI;AACzB,KAAI,CAAC,YAAY,CAAC,KAAM,QAAO;CAC/B,MAAM,MAAM,IAAI,IAAI,WAAW,uBAAuB,aAAc,KAAgB;AACpF,KAAI,CAAC,YAAY,CAAC,uBAAuB,IAAI,EAAE;AAC7C,oCACE,gDAAgD,IAAI,KAAK,iDAC1D;AACD;;CAEF,MAAMC,UAAkC,EAAE;CAC1C,MAAM,YAAY,QAAQ,IAAI;CAC9B,MAAM,QAAQ,YACVD,QAAG,aAAa,WAAW,OAAO,CAAC,MAAM,GACzC,QAAQ,IAAI;AAChB,KAAI,MAAO,SAAQ,mBAAmB;AAQtC,QAAO,cAPK,MAAME,iCAAY;EAC5B;EACA,QAAQ;EACR;EACA,WAAW;EACX,OAAO;EACR,CAAC,EACsB,KAAK;;AAG/B,eAAe,uBAA4D;;AACzE,KAAI,QAAQ,IAAI,iCAAiC,OAAQ,QAAO;CAChE,MAAM,OAAO,QAAQ,IAAI,wCAAwC;CACjE,MAAM,OAAO,GAAW,QAAgB,YACtCA,iCAAY;EACV,KAAK,IAAI,IAAI,GAAG,KAAK;EACrB;EACA;EACA,WAAW;EACX,OAAO;EACR,CAAC;CACJ,MAAM,UAAU,MAAM,IAAI,qBAAqB,OAAO,EACpD,wCAAwC,SACzC,CAAC;CACF,MAAM,OAAO,EAAE,4BAA4B,QAAQ,KAAK,MAAM,EAAE;CAEhE,MAAM,8BADQ,MAAM,IAAI,+CAA+C,OAAO,KAAK,EAChE,KAAK,MAAM,KAAK,CAAC,4EAAI,MAAM;AAC9C,KAAI,CAAC,KAAM,QAAO;AAMlB,QAAO,cALO,MAAM,IAClB,8CAA8C,mBAAmB,KAAK,IACtE,OACA,KACD,EACyB,KAAK;;AAGjC,IAAa,wBAAb,MAAmC;CAKjC,YAAY,QAA6B;kBAHtB;AAIjB,MAAI,OAAO,eAAe,OAAO,gBAC/B,MAAK,WAAW;GACd,aAAa,OAAO;GACpB,iBAAiB,OAAO;GACxB,cAAc,OAAO;GACtB;;;CAKL,MAAM,MAA+B;AACnC,MAAI,KAAK,SAAU,QAAO,KAAK;EAC/B,MAAM,MAAM,SAAS;AACrB,MAAI,IAAK,QAAO;AAChB,MAAI,KAAK,UAAU,CAAC,KAAK,WAAW,KAAK,OAAO,CAAE,QAAO,KAAK;AAC9D,MAAI,KAAK,KAAK,GAAG,KAAK,WAAW,mBAC/B,OAAM,IAAI,MAAM,8CAA8C;EAGhE,IAAI,QAAQ,gBAAgB;AAC5B,OAAK,MAAM,UAAU,CAAC,eAAe,qBAAqB,EAAE;AAC1D,OAAI,MAAO;AACX,OAAI;AACF,YAAQ,MAAM,QAAQ;WAChB;;AAIV,MAAI,CAAC,OAAO;AACV,QAAK,WAAW,KAAK,KAAK;AAC1B,SAAM,IAAI,MACR,+JACD;;AAEH,OAAK,SAAS;AACd,SAAO;;CAGT,aAAmB;AACjB,OAAK,SAAS;AACd,OAAK,WAAW;;CAGlB,AAAQ,WAAW,GAA4B;AAC7C,SAAO,EAAE,cAAc,UAAa,EAAE,YAAY,KAAK,KAAK,GAAG;;;;;;ACpLnE,MAAM,aAAa,SAAyBC,YAAO,WAAW,SAAS,CAAC,OAAO,KAAK,CAAC,OAAO,MAAM;AAElG,MAAM,QAAQ,KAAsB,QAClCA,YAAO,WAAW,UAAU,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ;;AAGvD,SAAgB,OAAO,MAA6C;CAClE,MAAM,EACJ,QACA,MACA,QAAQ,IACR,MACA,QACA,SACA,aACA,SAAS,OACT,SACE;CACJ,MAAM,WAAW,wBAAQ,IAAI,MAAM,EAAE,aAAa,CAAC,QAAQ,iBAAiB,GAAG;CAC/E,MAAM,YAAY,QAAQ,MAAM,GAAG,EAAE;CAErC,MAAMC,UAAkC,EAAE;AAC1C,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,MAAM,CAAE,SAAQ,EAAE,aAAa,IAAI;AACvE,SAAQ,gBAAgB;AACxB,KAAI,YAAY,aAAc,SAAQ,0BAA0B,YAAY;CAE5E,MAAM,QAAQ,OAAO,KAAK,QAAQ,CAAC,MAAM;CACzC,MAAM,mBAAmB,MACtB,KAAK,MAAM,GAAG,EAAE,GAAG,QAAQ,GAAI,MAAM,CAAC,QAAQ,QAAQ,IAAI,CAAC,IAAI,CAC/D,KAAK,GAAG;CACX,MAAM,gBAAgB,MAAM,KAAK,IAAI;CAErC,MAAM,mBAAmB;EACvB;EACA;EACA;EACA;EACA;EACA,UAAU,KAAK;EAChB,CAAC,KAAK,KAAK;CACZ,MAAM,QAAQ,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ;CAChD,MAAM,eAAe;EAAC;EAAoB;EAAS;EAAO,UAAU,iBAAiB;EAAC,CAAC,KAAK,KAAK;CAEjG,MAAM,aAAa,KACjB,KAAK,KAAK,KAAK,OAAO,YAAY,mBAAmB,UAAU,EAAE,OAAO,EAAE,QAAQ,EAClF,eACD;CACD,MAAM,YAAYD,YAAO,WAAW,UAAU,WAAW,CAAC,OAAO,aAAa,CAAC,OAAO,MAAM;AAE5F,SAAQ,mBACN,+BAA+B,YAAY,YAAY,GAAG,MAAM,kBAC/C,cAAc,cAAc;AAC/C,QAAO;;;;;ACgBT,MAAM,qBAAqB;AAC3B,MAAM,kBAAkB;;AAGxB,MAAM,kBAAkB,IAAI,IAAI;CAC9B;CACA;CACA;CACA;CACA;CACA;CACD,CAAC;AAEF,SAAS,aAAa,KAAkC;AACtD,KAAI,EAAE,eAAeE,gCAAY,QAAO;AACxC,KAAI;EACF,MAAM,OAAQ,KAAK,MAAM,IAAI,KAAK,CAAyB;AAC3D,qDAAO,KAAM,MAAM,IAAI,CAAC,KAAK;SACvB;AACN;;;;;;AAYJ,IAAa,sBAAb,MAA4D;CAoB1D,YAAY,QAAmC;cAnBxB;oBAOqB;qBAGtB;AAUpB,OAAK,SACH,OAAO,UACP,QAAQ,IAAI,iBACZ,QAAQ,IAAI,yBACZ;AACF,OAAK,eAAe,OAAO;AAC3B,OAAK,gBACH,OAAO,iBAAiB,GAAG,QAAQ,IAAI,eAAe,OAAO,GAAG,QAAQ;AAC1E,OAAK,cAAc,IAAI,sBAAsB,OAAO;AACpD,OAAK,WAAW,IAAI,IAAI,OAAO,YAAY,gBAAgB,KAAK,OAAO,gBAAgB;AACvF,OAAK,YAAY,KAAK,IAAI,OAAO,aAAa,KAAK,mBAAmB;AACtE,OAAK,eAAe,OAAO,gBAAgB;AAC3C,OAAK,gBAAgB,OAAO,mBAAmB;AAC/C,OAAK,MAAM,OAAO,OAAO;AACzB,OAAK,aAAa,OAAO,aAAa,IAAI,IAAI,OAAO,WAAW,GAAG;AACnE,OAAK,QAAQ,OAAO;AACpB,OAAK,mBAAmB,OAAO,oBAAoBC;AACnD,OAAK,SAAS,IAAIC,iCAAwB;GACxC,MAAM;GACN,WAAW,KAAK;GAChB,eAAe,OAAO,iBAAiBC;GACvC,OAAO,WAAW,KAAK,aAAa,OAAO;GAC3C,cAAc,QACZ,CAACC,0CAAqB,IAAI,IAAI,gBAAgB,IAAI,aAAa,IAAI,IAAI,GAAG;GAC7E,CAAC;AAEF,OAAK,aAAa,kBAAkB;AAClC,QAAK,OAAO,CAAC,YAAY,GAAG;KAC3B,KAAK,cAAc;AACtB,MAAI,KAAK,WAAW,MAAO,MAAK,WAAW,OAAO;;CAGpD,MAAM,OAAgC;EACpC,MAAM,YAAY,MAAM,YAAY,IAAI,KAAK,MAAM,UAAU,CAAC,SAAS,GAAG,KAAK,KAAK;EACpF,MAAM,UAAU,KAAK,MAAM,KAAK,MAAM,MAAM,GAAGC,uCAAgB,MAAM;AACrE,OAAK,OAAO,KAAK;GAAE;GAAW;GAAS,CAAC;AACxC,OAAK,OAAO,aAAa;;CAG3B,QAAuB;AACrB,SAAO,KAAK,OAAO,OAAO;;;;;;;CAQ5B,MAAM,QAAuB;AAC3B,MAAI,KAAK,YAAY;AACnB,iBAAc,KAAK,WAAW;AAC9B,QAAK,aAAa;;AAEpB,QAAM,KAAK,OAAO,OAAO;;CAG3B,AAAQ,MAAM,OAAkC;EAC9C,MAAM,EAAE,OAAO,SAAS,MAAM,SAAS,cAAc;EACrD,MAAM,SAASC,qCAAgB;GAAE,MAAM;GAAW;GAAO;GAAS,EAAE,QAAQ;EAC5E,MAAMC,cAAwB,EAAE;AAChC,OAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,EAAE;AAC3C,OAAI,MAAM,UAAU,MAAM,WAAW,MAAM,aAAa,OAAO,MAAM,SAAU;AAC/E,OAAI,KAAK,cAAc,CAAC,KAAK,WAAW,IAAI,EAAE,CAAE;AAChD,OAAI,YAAY,SAAS,gBAAiB,aAAY,KAAK,EAAE;;AAE/D,SAAO,UAAU;GACf,WAAW,YAAY,IAAI,KAAK,UAAU,CAAC,SAAS,GAAG,KAAK,KAAK;GACjE,mBACE,YAAY,SAAS,IACjB,CACE;IACE,WAAW,KAAK;IAChB,YAAY,CAAC,CAAC,QAAQ,CAAC;IACvB,SAAS,YAAY,KAAK,OAAO;KAAE,MAAM;KAAG,MAAM;KAAQ,EAAE;IAC7D,CACF,GACD,EAAE;GACT;AACD,SAAOF,uCAAgB,OAAO;;CAGhC,MAAc,aAAa,QAAqC;AAC9D,QAAM,KAAK,cAAc;EACzB,MAAM,YAAY,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,MAAM,EAAE,YAAY,EAAE,UAAU;AACvE,MAAI;AACF,SAAM,KAAK,KAAK,gBAAgB;IAC9B,cAAc,KAAK;IACnB,eAAe,KAAK;IACpB;IACD,CAAC;WACK,KAAK;GACZ,MAAM,OAAO,aAAa,IAAI;AAC9B,OAAI,SAAS,+BAAgC;AAC7C,OAAI,SAAS,4BAA6B,MAAK,cAAc;AAC7D,OAAI,SAAS,wBAAyB,MAAK,YAAY,YAAY;AACnE,SAAM;;;CAIV,MAAc,eAA8B;AAC1C,MAAI,KAAK,YAAa;AACtB,MAAI;AACF,SAAM,KAAK,KAAK,kBAAkB,EAAE,cAAc,KAAK,cAAc,CAAC;WAC/D,KAAK;AACZ,OAAI,aAAa,IAAI,KAAK,wBAAyB,MAAK,YAAY,YAAY;AAChF,OAAI,EAAE,eAAeL,gCAAY,OAAM;AACvC,OAAI,aAAa,IAAI,KAAK,iCACxB,mCAAa,2DAA2D,IAAI,QAAQ,GAAG;;AAG3F,MAAI;AACF,SAAM,KAAK,KAAK,mBAAmB;IACjC,cAAc,KAAK;IACnB,eAAe,KAAK;IACrB,CAAC;WACK,KAAK;AACZ,OAAI,aAAa,IAAI,KAAK,iCAAkC,OAAM;;AAEpE,OAAK,cAAc;;CAGrB,MAAc,KAAK,QAAgB,SAAiD;EAClF,MAAM,cAAc,MAAM,KAAK,YAAY,KAAK;EAChD,MAAM,OAAOK,uCAAgB,QAAQ;EACrC,MAAM,EAAE,SAAS,KAAK;EACtB,MAAM,UAAU,OAAO;GACrB,QAAQ;GACR,MAAM;GACN,SAAS;IACP;IACA,gBAAgB;IAChB,gBAAgB,iBAAiB;IAClC;GACD;GACA,QAAQ,KAAK;GACb,SAAS;GACT;GACD,CAAC;AACF,QAAMG,iCAAY;GAChB,KAAK,KAAK;GACV;GACA;GACA,WAAW,KAAK;GAChB,OAAO,cAAc;GACtB,CAAC"}