logixia 1.13.3 → 2.0.4

package/dist/{azure-monitor.transport-CHnjVRF-.mjs → azure-monitor.transport-BPbgjATu.mjs}

@@ -1,8 +1,8 @@
-import { r as internalWarn, t as internalError } from "./internal-log-Cm8SOWSV.mjs";
-import { i as stringifyForLog } from "./safe-stringify-DJ66tW5I.mjs";
-import { a as httpRequest, n as DEFAULT_MAX_BUFFER_SIZE, r as DEFAULT_REQUEST_TIMEOUT_MS, t as BatchBuffer } from "./batch-buffer-PGvSgbmd.mjs";
-
-//#region src/transports/azure-monitor.transport.ts
+import { r as internalWarn, t as internalError } from "./internal-log-uCSd1PMc.mjs";
+import { i as scrubSecrets, n as protectSecrets, o as urlSecrets, r as scrubError } from "./secret-config-BegMLkYl.mjs";
+import { i as stringifyForLog } from "./safe-stringify-BMRl3EX3.mjs";
+import { a as httpRequest, t as BatchBuffer } from "./batch-buffer-0fgLmIPn.mjs";
+// src/transports/azure-monitor.transport.ts
 /**
 * Azure AD tenant IDs are either a GUID or a verified domain (e.g. `contoso.onmicrosoft.com`).
 * This pattern is deliberately permissive on structure but strict on character
@@ -32,6 +32,7 @@ var AzureMonitorTransport = class {
 		this.flushTimer = null;
 		this.accessToken = null;
 		this.tokenExpiry = 0;
+		protectSecrets(this, ["clientSecret", "accessToken"]);
 		this.endpoint = config.endpoint.replace(/\/$/, "");
 		this.ruleId = config.ruleId;
 		this.streamName = config.streamName;
@@ -41,12 +42,13 @@ var AzureMonitorTransport = class {
 		this.batchSize = config.batchSize ?? 200;
 		this.flushInterval = config.flushIntervalMs ?? 5e3;
 		this.level = config.level;
-		this.requestTimeoutMs = config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;
+		this.requestTimeoutMs = config.requestTimeoutMs ?? 1e4;
 		this.buffer = new BatchBuffer({
 			name: "AzureMonitorTransport",
 			batchSize: this.batchSize,
-			maxBufferSize: config.maxBufferSize ?? DEFAULT_MAX_BUFFER_SIZE,
-			send: (entries) => this.sendEntries(entries)
+			maxBufferSize: config.maxBufferSize ?? 1e4,
+			send: (entries) => this.sendEntries(entries),
+			secrets: () => this.secretValues()
 		});
 		this.flushTimer = setInterval(() => {
 			this.flush().catch(() => {});
@@ -83,6 +85,14 @@ var AzureMonitorTransport = class {
 			Properties: stringifyForLog(entry.data ?? {})
 		};
 	}
+	secretValues(token) {
+		return [
+			this.clientSecret,
+			this.accessToken ?? void 0,
+			token,
+			...urlSecrets(this.endpoint)
+		];
+	}
 	async getAccessToken() {
 		if (this.accessToken && Date.now() < this.tokenExpiry) return this.accessToken;
 		if (!this.tenantId || !this.clientId || !this.clientSecret) {
@@ -107,7 +117,8 @@ var AzureMonitorTransport = class {
 				headers: { "Content-Type": "application/x-www-form-urlencoded" },
 				body,
 				timeoutMs: this.requestTimeoutMs,
-				label: "Azure token request"
+				label: "Azure token request",
+				secrets: () => this.secretValues()
 			});
 			const parsed = JSON.parse(res.body);
 			if (!parsed.access_token) return null;
@@ -122,12 +133,13 @@ var AzureMonitorTransport = class {
 	async sendEntries(entries) {
 		const token = await this.getAccessToken();
 		if (!token) throw new Error("AzureMonitorTransport: no access token available");
-		const body = stringifyForLog(entries.map((e) => this.toAzureRecord(e)));
+		const records = entries.map((e) => this.toAzureRecord(e));
+		const body = stringifyForLog(records);
 		let reqUrl;
 		try {
 			reqUrl = new URL(`dataCollectionRules/${encodeURIComponent(this.ruleId)}/streams/${encodeURIComponent(this.streamName)}?api-version=2023-01-01`, this.endpoint.endsWith("/") ? this.endpoint : `${this.endpoint}/`);
 		} catch (error) {
-			internalError(`AzureMonitorTransport: invalid endpoint "${this.endpoint}"`, error);
+			internalError(`AzureMonitorTransport: invalid endpoint "${scrubSecrets(this.endpoint, urlSecrets(this.endpoint))}"`, scrubError(error, urlSecrets(this.endpoint)));
 			return;
 		}
 		if (reqUrl.protocol !== "https:") {
@@ -142,11 +154,11 @@ var AzureMonitorTransport = class {
 			},
 			body,
 			timeoutMs: this.requestTimeoutMs,
-			label: "Azure Monitor API"
+			label: "Azure Monitor API",
+			secrets: () => this.secretValues(token)
 		});
 	}
 };
-
-//#endregion
 export { AzureMonitorTransport as t };
-//# sourceMappingURL=azure-monitor.transport-CHnjVRF-.mjs.map
+
+//# sourceMappingURL=azure-monitor.transport-BPbgjATu.mjs.map

package/dist/azure-monitor.transport-BPbgjATu.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-monitor.transport-BPbgjATu.mjs","names":[],"sources":["../src/transports/azure-monitor.transport.ts"],"sourcesContent":["/**\n * logixia — Azure Monitor / Application Insights transport\n *\n * Sends log entries to Azure Monitor via the Data Collection Rules (DCR) API\n * using the Logs Ingestion API (the modern replacement for the legacy HTTP\n * Data Collector API).\n *\n * Maps logixia levels to Application Insights severity levels:\n *   verbose → 0, debug → 1, info → 1, warn → 2, error → 3, critical → 4\n *\n * @example\n * ```ts\n * import { AzureMonitorTransport } from 'logixia';\n *\n * const logger = createLogger({\n *   transports: {\n *     azure: new AzureMonitorTransport({\n *       // Logs Ingestion API endpoint (from your DCR)\n *       endpoint: 'https://<dce>.ingest.monitor.azure.com',\n *       ruleId: 'dcr-xxxxxxxxxxxxxxxx',\n *       streamName: 'Custom-LogixiaLogs',\n *       // Client credentials (or managed identity via no-credential mode)\n *       tenantId: process.env.AZURE_TENANT_ID,\n *       clientId: process.env.AZURE_CLIENT_ID,\n *       clientSecret: process.env.AZURE_CLIENT_SECRET,\n *     }),\n *   },\n * });\n * ```\n */\n\nimport type { IAsyncTransport, TransportLogEntry } from '../types/transport.types';\nimport { internalError, internalWarn } from '../utils/internal-log';\nimport { stringifyForLog } from '../utils/safe-stringify';\nimport {\n  BatchBuffer,\n  DEFAULT_MAX_BUFFER_SIZE,\n  DEFAULT_REQUEST_TIMEOUT_MS,\n  httpRequest,\n} from './batch-buffer';\nimport { protectSecrets, scrubError, scrubSecrets, urlSecrets } from './secret-config';\n\n/**\n * Azure AD tenant IDs are either a GUID or a verified domain (e.g. `contoso.onmicrosoft.com`).\n * This pattern is deliberately permissive on structure but strict on character\n * set — it rejects the breakout characters (`/`, `@`, `:`, `?`, `#`, whitespace)\n * that would let a hostile config smuggle a different host, path, or query into\n * the OAuth token URL.\n */\nconst AZURE_TENANT_RE = /^[a-z0-9][a-z0-9.-]{1,253}$/i;\n\nexport interface AzureMonitorTransportConfig {\n  /** DCE (Data Collection Endpoint) URL, e.g. `https://<name>.ingest.monitor.azure.com`. */\n  endpoint: string;\n  /** Data Collection Rule immutable ID (from Azure portal). */\n  ruleId: string;\n  /** Stream name defined in the DCR, e.g. `'Custom-LogixiaLogs_CL'`. */\n  streamName: string;\n  /** Azure AD tenant ID for OAuth2 client-credentials flow. */\n  tenantId?: string;\n  /** Azure AD app (service principal) client ID. */\n  clientId?: string;\n  /** Azure AD app client secret. */\n  clientSecret?: string;\n  /** Number of entries to batch. @default 200 */\n  batchSize?: number;\n  /** Flush interval in ms. @default 5000 */\n  flushIntervalMs?: number;\n  /** Abort a request that has not finished after this many ms. @default 10000 */\n  requestTimeoutMs?: number;\n  /** Max buffered entries; the oldest are dropped past this. @default 10000 */\n  maxBufferSize?: number;\n  level?: string;\n}\n\nconst SEVERITY_MAP: Record<string, number> = {\n  verbose: 0,\n  trace: 0,\n  debug: 1,\n  info: 1,\n  log: 1,\n  warn: 2,\n  warning: 2,\n  error: 3,\n  critical: 4,\n  fatal: 4,\n};\n\n/**\n * Azure Monitor Logs Ingestion transport.\n */\nexport class AzureMonitorTransport implements IAsyncTransport {\n  public readonly name = 'azure-monitor';\n  public readonly batchSize: number;\n  public readonly flushInterval: number;\n  public readonly level: string | undefined;\n\n  private readonly buffer: BatchBuffer<TransportLogEntry>;\n  private readonly requestTimeoutMs: number;\n  private flushTimer: NodeJS.Timeout | null = null;\n  private accessToken: string | null = null;\n  private tokenExpiry = 0;\n\n  private readonly endpoint: string;\n  private readonly ruleId: string;\n  private readonly streamName: string;\n  private readonly tenantId: string | undefined;\n  private readonly clientId: string | undefined;\n  private readonly clientSecret: string | undefined;\n\n  constructor(config: AzureMonitorTransportConfig) {\n    protectSecrets(this, ['clientSecret', 'accessToken']);\n    this.endpoint = config.endpoint.replace(/\\/$/, '');\n    this.ruleId = config.ruleId;\n    this.streamName = config.streamName;\n    this.tenantId = config.tenantId ?? process.env['AZURE_TENANT_ID'];\n    this.clientId = config.clientId ?? process.env['AZURE_CLIENT_ID'];\n    this.clientSecret = config.clientSecret ?? process.env['AZURE_CLIENT_SECRET'];\n    this.batchSize = config.batchSize ?? 200;\n    this.flushInterval = config.flushIntervalMs ?? 5000;\n    this.level = config.level;\n    this.requestTimeoutMs = config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;\n    this.buffer = new BatchBuffer<TransportLogEntry>({\n      name: 'AzureMonitorTransport',\n      batchSize: this.batchSize,\n      maxBufferSize: config.maxBufferSize ?? DEFAULT_MAX_BUFFER_SIZE,\n      send: (entries) => this.sendEntries(entries),\n      secrets: () => this.secretValues(),\n    });\n\n    this.flushTimer = setInterval(() => {\n      this.flush().catch(() => {});\n    }, this.flushInterval);\n    if (this.flushTimer.unref) this.flushTimer.unref();\n  }\n\n  write(entry: TransportLogEntry): void {\n    this.buffer.push(entry);\n    this.buffer.flushIfFull();\n  }\n\n  flush(): Promise<void> {\n    return this.buffer.flush();\n  }\n\n  /**\n   * Flush remaining entries and stop the interval timer on shutdown. Without\n   * this the manager's close() skipped the transport (close was undefined) and\n   * buffered entries were lost on deploy. Waits for any in-flight send first.\n   */\n  async close(): Promise<void> {\n    if (this.flushTimer) {\n      clearInterval(this.flushTimer);\n      this.flushTimer = null;\n    }\n    await this.buffer.close();\n  }\n\n  private toAzureRecord(entry: TransportLogEntry): Record<string, unknown> {\n    return {\n      TimeGenerated: entry.timestamp ?? new Date().toISOString(),\n      SeverityLevel: SEVERITY_MAP[entry.level.toLowerCase()] ?? 1,\n      Message: entry.message,\n      AppName: entry.appName,\n      Context: entry.context ?? '',\n      TraceId: entry.traceId ?? '',\n      Properties: stringifyForLog(entry.data ?? {}),\n    };\n  }\n\n  private secretValues(token?: string): (string | undefined)[] {\n    return [this.clientSecret, this.accessToken ?? undefined, token, ...urlSecrets(this.endpoint)];\n  }\n\n  private async getAccessToken(): Promise<string | null> {\n    if (this.accessToken && Date.now() < this.tokenExpiry) return this.accessToken;\n\n    if (!this.tenantId || !this.clientId || !this.clientSecret) {\n      internalWarn(\n        'AzureMonitorTransport: missing credentials — set tenantId, clientId, clientSecret'\n      );\n      return null;\n    }\n\n    const body = new URLSearchParams({\n      grant_type: 'client_credentials',\n      client_id: this.clientId,\n      client_secret: this.clientSecret,\n      scope: 'https://monitor.azure.com/.default',\n    }).toString();\n\n    const tenantId = this.tenantId;\n    if (!AZURE_TENANT_RE.test(tenantId)) {\n      internalWarn(\n        `AzureMonitorTransport: refusing to request token — tenantId \"${tenantId}\" is not a valid GUID or domain`\n      );\n      return null;\n    }\n\n    const reqUrl = new URL(\n      `https://login.microsoftonline.com/${encodeURIComponent(tenantId)}/oauth2/v2.0/token`\n    );\n    try {\n      const res = await httpRequest({\n        url: reqUrl,\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        body,\n        timeoutMs: this.requestTimeoutMs,\n        label: 'Azure token request',\n        secrets: () => this.secretValues(),\n      });\n      const parsed = JSON.parse(res.body) as { access_token?: string; expires_in?: number };\n      if (!parsed.access_token) return null;\n      this.accessToken = parsed.access_token;\n      this.tokenExpiry = Date.now() + (parsed.expires_in ?? 3600) * 1000 - 60_000;\n      return this.accessToken;\n    } catch (err) {\n      internalError('AzureMonitorTransport token request failed', err);\n      return null;\n    }\n  }\n\n  private async sendEntries(entries: TransportLogEntry[]): Promise<void> {\n    const token = await this.getAccessToken();\n    if (!token) throw new Error('AzureMonitorTransport: no access token available');\n\n    const records = entries.map((e) => this.toAzureRecord(e));\n    const body = stringifyForLog(records);\n    let reqUrl: URL;\n    try {\n      // Build from the user-configured DCE endpoint; encodeURIComponent-ing the\n      // ruleId/streamName stops a hostile config from smuggling extra path\n      // segments or query params into the request.\n      reqUrl = new URL(\n        `dataCollectionRules/${encodeURIComponent(this.ruleId)}/streams/${encodeURIComponent(this.streamName)}?api-version=2023-01-01`,\n        this.endpoint.endsWith('/') ? this.endpoint : `${this.endpoint}/`\n      );\n    } catch (error) {\n      internalError(\n        `AzureMonitorTransport: invalid endpoint \"${scrubSecrets(this.endpoint, urlSecrets(this.endpoint))}\"`,\n        scrubError(error, urlSecrets(this.endpoint))\n      );\n      return;\n    }\n    if (reqUrl.protocol !== 'https:') {\n      internalError(`AzureMonitorTransport: endpoint must use https (got ${reqUrl.protocol})`);\n      return;\n    }\n\n    await httpRequest({\n      url: reqUrl,\n      headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: 'Azure Monitor API',\n      secrets: () => this.secretValues(token),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAiDA,MAAM,kBAAkB;AA0BxB,MAAM,eAAuC;CAC3C,SAAS;CACT,OAAO;CACP,OAAO;CACP,MAAM;CACN,KAAK;CACL,MAAM;CACN,SAAS;CACT,OAAO;CACP,UAAU;CACV,OAAO;AACT;;;;AAKA,IAAa,wBAAb,MAA8D;CAmB5D,YAAY,QAAqC;EAlB1B,KAAA,OAAA;EAOqB,KAAA,aAAA;EACP,KAAA,cAAA;EACf,KAAA,cAAA;EAUpB,eAAe,MAAM,CAAC,gBAAgB,aAAa,CAAC;EACpD,KAAK,WAAW,OAAO,SAAS,QAAQ,OAAO,EAAE;EACjD,KAAK,SAAS,OAAO;EACrB,KAAK,aAAa,OAAO;EACzB,KAAK,WAAW,OAAO,YAAY,QAAQ,IAAI;EAC/C,KAAK,WAAW,OAAO,YAAY,QAAQ,IAAI;EAC/C,KAAK,eAAe,OAAO,gBAAgB,QAAQ,IAAI;EACvD,KAAK,YAAY,OAAO,aAAa;EACrC,KAAK,gBAAgB,OAAO,mBAAmB;EAC/C,KAAK,QAAQ,OAAO;EACpB,KAAK,mBAAmB,OAAO,oBAAA;EAC/B,KAAK,SAAS,IAAI,YAA+B;GAC/C,MAAM;GACN,WAAW,KAAK;GAChB,eAAe,OAAO,iBAAA;GACtB,OAAO,YAAY,KAAK,YAAY,OAAO;GAC3C,eAAe,KAAK,aAAa;EACnC,CAAC;EAED,KAAK,aAAa,kBAAkB;GAClC,KAAK,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;EAC7B,GAAG,KAAK,aAAa;EACrB,IAAI,KAAK,WAAW,OAAO,KAAK,WAAW,MAAM;CACnD;CAEA,MAAM,OAAgC;EACpC,KAAK,OAAO,KAAK,KAAK;EACtB,KAAK,OAAO,YAAY;CAC1B;CAEA,QAAuB;EACrB,OAAO,KAAK,OAAO,MAAM;CAC3B;;;;;;CAOA,MAAM,QAAuB;EAC3B,IAAI,KAAK,YAAY;GACnB,cAAc,KAAK,UAAU;GAC7B,KAAK,aAAa;EACpB;EACA,MAAM,KAAK,OAAO,MAAM;CAC1B;CAEA,cAAsB,OAAmD;EACvE,OAAO;GACL,eAAe,MAAM,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;GACzD,eAAe,aAAa,MAAM,MAAM,YAAY,MAAM;GAC1D,SAAS,MAAM;GACf,SAAS,MAAM;GACf,SAAS,MAAM,WAAW;GAC1B,SAAS,MAAM,WAAW;GAC1B,YAAY,gBAAgB,MAAM,QAAQ,CAAC,CAAC;EAC9C;CACF;CAEA,aAAqB,OAAwC;EAC3D,OAAO;GAAC,KAAK;GAAc,KAAK,eAAe,KAAA;GAAW;GAAO,GAAG,WAAW,KAAK,QAAQ;EAAC;CAC/F;CAEA,MAAc,iBAAyC;EACrD,IAAI,KAAK,eAAe,KAAK,IAAI,IAAI,KAAK,aAAa,OAAO,KAAK;EAEnE,IAAI,CAAC,KAAK,YAAY,CAAC,KAAK,YAAY,CAAC,KAAK,cAAc;GAC1D,aACE,mFACF;GACA,OAAO;EACT;EAEA,MAAM,OAAO,IAAI,gBAAgB;GAC/B,YAAY;GACZ,WAAW,KAAK;GAChB,eAAe,KAAK;GACpB,OAAO;EACT,CAAC,CAAC,CAAC,SAAS;EAEZ,MAAM,WAAW,KAAK;EACtB,IAAI,CAAC,gBAAgB,KAAK,QAAQ,GAAG;GACnC,aACE,gEAAgE,SAAS,gCAC3E;GACA,OAAO;EACT;EAEA,MAAM,SAAS,IAAI,IACjB,qCAAqC,mBAAmB,QAAQ,EAAE,mBACpE;EACA,IAAI;GACF,MAAM,MAAM,MAAM,YAAY;IAC5B,KAAK;IACL,SAAS,EAAE,gBAAgB,oCAAoC;IAC/D;IACA,WAAW,KAAK;IAChB,OAAO;IACP,eAAe,KAAK,aAAa;GACnC,CAAC;GACD,MAAM,SAAS,KAAK,MAAM,IAAI,IAAI;GAClC,IAAI,CAAC,OAAO,cAAc,OAAO;GACjC,KAAK,cAAc,OAAO;GAC1B,KAAK,cAAc,KAAK,IAAI,KAAK,OAAO,cAAc,QAAQ,MAAO;GACrE,OAAO,KAAK;EACd,SAAS,KAAK;GACZ,cAAc,8CAA8C,GAAG;GAC/D,OAAO;EACT;CACF;CAEA,MAAc,YAAY,SAA6C;EACrE,MAAM,QAAQ,MAAM,KAAK,eAAe;EACxC,IAAI,CAAC,OAAO,MAAM,IAAI,MAAM,kDAAkD;EAE9E,MAAM,UAAU,QAAQ,KAAK,MAAM,KAAK,cAAc,CAAC,CAAC;EACxD,MAAM,OAAO,gBAAgB,OAAO;EACpC,IAAI;EACJ,IAAI;GAIF,SAAS,IAAI,IACX,uBAAuB,mBAAmB,KAAK,MAAM,EAAE,WAAW,mBAAmB,KAAK,UAAU,EAAE,0BACtG,KAAK,SAAS,SAAS,GAAG,IAAI,KAAK,WAAW,GAAG,KAAK,SAAS,EACjE;EACF,SAAS,OAAO;GACd,cACE,4CAA4C,aAAa,KAAK,UAAU,WAAW,KAAK,QAAQ,CAAC,EAAE,IACnG,WAAW,OAAO,WAAW,KAAK,QAAQ,CAAC,CAC7C;GACA;EACF;EACA,IAAI,OAAO,aAAa,UAAU;GAChC,cAAc,uDAAuD,OAAO,SAAS,EAAE;GACvF;EACF;EAEA,MAAM,YAAY;GAChB,KAAK;GACL,SAAS;IAAE,eAAe,UAAU;IAAS,gBAAgB;GAAmB;GAChF;GACA,WAAW,KAAK;GAChB,OAAO;GACP,eAAe,KAAK,aAAa,KAAK;EACxC,CAAC;CACH;AACF"}

package/dist/{azure-monitor.transport-BDFO4F-i.d.ts → azure-monitor.transport-C7kYyZUW.d.mts}

@@ -1,7 +1,4 @@
-import { p as TransportLogEntry, s as IAsyncTransport } from "./transport.types-DqVLZTyf.js";
-
-//#region src/transports/azure-monitor.transport.d.ts
-
+import { p as TransportLogEntry, s as IAsyncTransport } from "./transport.types-BJVL1QQl.mjs";
 interface AzureMonitorTransportConfig {
   /** DCE (Data Collection Endpoint) URL, e.g. `https://<name>.ingest.monitor.azure.com`. */
   endpoint: string;
@@ -54,9 +51,9 @@ declare class AzureMonitorTransport implements IAsyncTransport {
    */
   close(): Promise<void>;
   private toAzureRecord;
+  private secretValues;
   private getAccessToken;
   private sendEntries;
 }
-//#endregion
 export { AzureMonitorTransportConfig as n, AzureMonitorTransport as t };
-//# sourceMappingURL=azure-monitor.transport-BDFO4F-i.d.ts.map
+//# sourceMappingURL=azure-monitor.transport-C7kYyZUW.d.mts.map

package/dist/azure-monitor.transport-C7kYyZUW.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-monitor.transport-C7kYyZUW.d.mts","names":[],"sources":["../src/transports/azure-monitor.transport.ts"],"mappings":";UAmDiB;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;EACA;;;;;cAmBW,iCAAiC;WAC5B;WACA;WACA;WACA;mBAEC;mBACA;UACT;UACA;UACA;mBAES;mBACA;mBACA;mBACA;mBACA;mBACA;EAEL,YAAA,QAAQ;EA0BpB,MAAM,OAAO;EAKb,SAAS;;;;;;EASH,SAAS;UAQP;UAYA;UAIM;UAgDA"}

package/dist/{azure-monitor.transport-CrvfHd9C.js → azure-monitor.transport-CwbOLZHB.js}

@@ -1,8 +1,8 @@
-const require_internal_log = require('./internal-log-BUJYMZbE.js');
-const require_safe_stringify = require('./safe-stringify-DWo3aZp_.js');
-const require_batch_buffer = require('./batch-buffer-BY-mRWIK.js');
-
-//#region src/transports/azure-monitor.transport.ts
+const require_secret_config = require("./secret-config-CBZBs0p1.js");
+const require_internal_log = require("./internal-log-b0Vp4qrB.js");
+const require_safe_stringify = require("./safe-stringify-DLz1Kz3o.js");
+const require_batch_buffer = require("./batch-buffer-DT4gdXmf.js");
+// src/transports/azure-monitor.transport.ts
 /**
 * Azure AD tenant IDs are either a GUID or a verified domain (e.g. `contoso.onmicrosoft.com`).
 * This pattern is deliberately permissive on structure but strict on character
@@ -32,6 +32,7 @@ var AzureMonitorTransport = class {
 		this.flushTimer = null;
 		this.accessToken = null;
 		this.tokenExpiry = 0;
+		require_secret_config.protectSecrets(this, ["clientSecret", "accessToken"]);
 		this.endpoint = config.endpoint.replace(/\/$/, "");
 		this.ruleId = config.ruleId;
 		this.streamName = config.streamName;
@@ -41,12 +42,13 @@ var AzureMonitorTransport = class {
 		this.batchSize = config.batchSize ?? 200;
 		this.flushInterval = config.flushIntervalMs ?? 5e3;
 		this.level = config.level;
-		this.requestTimeoutMs = config.requestTimeoutMs ?? require_batch_buffer.DEFAULT_REQUEST_TIMEOUT_MS;
+		this.requestTimeoutMs = config.requestTimeoutMs ?? 1e4;
 		this.buffer = new require_batch_buffer.BatchBuffer({
 			name: "AzureMonitorTransport",
 			batchSize: this.batchSize,
-			maxBufferSize: config.maxBufferSize ?? require_batch_buffer.DEFAULT_MAX_BUFFER_SIZE,
-			send: (entries) => this.sendEntries(entries)
+			maxBufferSize: config.maxBufferSize ?? 1e4,
+			send: (entries) => this.sendEntries(entries),
+			secrets: () => this.secretValues()
 		});
 		this.flushTimer = setInterval(() => {
 			this.flush().catch(() => {});
@@ -83,6 +85,14 @@ var AzureMonitorTransport = class {
 			Properties: require_safe_stringify.stringifyForLog(entry.data ?? {})
 		};
 	}
+	secretValues(token) {
+		return [
+			this.clientSecret,
+			this.accessToken ?? void 0,
+			token,
+			...require_secret_config.urlSecrets(this.endpoint)
+		];
+	}
 	async getAccessToken() {
 		if (this.accessToken && Date.now() < this.tokenExpiry) return this.accessToken;
 		if (!this.tenantId || !this.clientId || !this.clientSecret) {
@@ -107,7 +117,8 @@ var AzureMonitorTransport = class {
 				headers: { "Content-Type": "application/x-www-form-urlencoded" },
 				body,
 				timeoutMs: this.requestTimeoutMs,
-				label: "Azure token request"
+				label: "Azure token request",
+				secrets: () => this.secretValues()
 			});
 			const parsed = JSON.parse(res.body);
 			if (!parsed.access_token) return null;
@@ -122,12 +133,13 @@ var AzureMonitorTransport = class {
 	async sendEntries(entries) {
 		const token = await this.getAccessToken();
 		if (!token) throw new Error("AzureMonitorTransport: no access token available");
-		const body = require_safe_stringify.stringifyForLog(entries.map((e) => this.toAzureRecord(e)));
+		const records = entries.map((e) => this.toAzureRecord(e));
+		const body = require_safe_stringify.stringifyForLog(records);
 		let reqUrl;
 		try {
 			reqUrl = new URL(`dataCollectionRules/${encodeURIComponent(this.ruleId)}/streams/${encodeURIComponent(this.streamName)}?api-version=2023-01-01`, this.endpoint.endsWith("/") ? this.endpoint : `${this.endpoint}/`);
 		} catch (error) {
-			require_internal_log.internalError(`AzureMonitorTransport: invalid endpoint "${this.endpoint}"`, error);
+			require_internal_log.internalError(`AzureMonitorTransport: invalid endpoint "${require_secret_config.scrubSecrets(this.endpoint, require_secret_config.urlSecrets(this.endpoint))}"`, require_secret_config.scrubError(error, require_secret_config.urlSecrets(this.endpoint)));
 			return;
 		}
 		if (reqUrl.protocol !== "https:") {
@@ -142,16 +154,16 @@ var AzureMonitorTransport = class {
 			},
 			body,
 			timeoutMs: this.requestTimeoutMs,
-			label: "Azure Monitor API"
+			label: "Azure Monitor API",
+			secrets: () => this.secretValues(token)
 		});
 	}
 };
-
-//#endregion
-Object.defineProperty(exports, 'AzureMonitorTransport', {
-  enumerable: true,
-  get: function () {
-    return AzureMonitorTransport;
-  }
+Object.defineProperty(exports, "AzureMonitorTransport", {
+	enumerable: true,
+	get: function() {
+		return AzureMonitorTransport;
+	}
 });
-//# sourceMappingURL=azure-monitor.transport-CrvfHd9C.js.map
+
+//# sourceMappingURL=azure-monitor.transport-CwbOLZHB.js.map

package/dist/azure-monitor.transport-CwbOLZHB.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-monitor.transport-CwbOLZHB.js","names":["BatchBuffer","stringifyForLog","urlSecrets","httpRequest","scrubSecrets","scrubError"],"sources":["../src/transports/azure-monitor.transport.ts"],"sourcesContent":["/**\n * logixia — Azure Monitor / Application Insights transport\n *\n * Sends log entries to Azure Monitor via the Data Collection Rules (DCR) API\n * using the Logs Ingestion API (the modern replacement for the legacy HTTP\n * Data Collector API).\n *\n * Maps logixia levels to Application Insights severity levels:\n *   verbose → 0, debug → 1, info → 1, warn → 2, error → 3, critical → 4\n *\n * @example\n * ```ts\n * import { AzureMonitorTransport } from 'logixia';\n *\n * const logger = createLogger({\n *   transports: {\n *     azure: new AzureMonitorTransport({\n *       // Logs Ingestion API endpoint (from your DCR)\n *       endpoint: 'https://<dce>.ingest.monitor.azure.com',\n *       ruleId: 'dcr-xxxxxxxxxxxxxxxx',\n *       streamName: 'Custom-LogixiaLogs',\n *       // Client credentials (or managed identity via no-credential mode)\n *       tenantId: process.env.AZURE_TENANT_ID,\n *       clientId: process.env.AZURE_CLIENT_ID,\n *       clientSecret: process.env.AZURE_CLIENT_SECRET,\n *     }),\n *   },\n * });\n * ```\n */\n\nimport type { IAsyncTransport, TransportLogEntry } from '../types/transport.types';\nimport { internalError, internalWarn } from '../utils/internal-log';\nimport { stringifyForLog } from '../utils/safe-stringify';\nimport {\n  BatchBuffer,\n  DEFAULT_MAX_BUFFER_SIZE,\n  DEFAULT_REQUEST_TIMEOUT_MS,\n  httpRequest,\n} from './batch-buffer';\nimport { protectSecrets, scrubError, scrubSecrets, urlSecrets } from './secret-config';\n\n/**\n * Azure AD tenant IDs are either a GUID or a verified domain (e.g. `contoso.onmicrosoft.com`).\n * This pattern is deliberately permissive on structure but strict on character\n * set — it rejects the breakout characters (`/`, `@`, `:`, `?`, `#`, whitespace)\n * that would let a hostile config smuggle a different host, path, or query into\n * the OAuth token URL.\n */\nconst AZURE_TENANT_RE = /^[a-z0-9][a-z0-9.-]{1,253}$/i;\n\nexport interface AzureMonitorTransportConfig {\n  /** DCE (Data Collection Endpoint) URL, e.g. `https://<name>.ingest.monitor.azure.com`. */\n  endpoint: string;\n  /** Data Collection Rule immutable ID (from Azure portal). */\n  ruleId: string;\n  /** Stream name defined in the DCR, e.g. `'Custom-LogixiaLogs_CL'`. */\n  streamName: string;\n  /** Azure AD tenant ID for OAuth2 client-credentials flow. */\n  tenantId?: string;\n  /** Azure AD app (service principal) client ID. */\n  clientId?: string;\n  /** Azure AD app client secret. */\n  clientSecret?: string;\n  /** Number of entries to batch. @default 200 */\n  batchSize?: number;\n  /** Flush interval in ms. @default 5000 */\n  flushIntervalMs?: number;\n  /** Abort a request that has not finished after this many ms. @default 10000 */\n  requestTimeoutMs?: number;\n  /** Max buffered entries; the oldest are dropped past this. @default 10000 */\n  maxBufferSize?: number;\n  level?: string;\n}\n\nconst SEVERITY_MAP: Record<string, number> = {\n  verbose: 0,\n  trace: 0,\n  debug: 1,\n  info: 1,\n  log: 1,\n  warn: 2,\n  warning: 2,\n  error: 3,\n  critical: 4,\n  fatal: 4,\n};\n\n/**\n * Azure Monitor Logs Ingestion transport.\n */\nexport class AzureMonitorTransport implements IAsyncTransport {\n  public readonly name = 'azure-monitor';\n  public readonly batchSize: number;\n  public readonly flushInterval: number;\n  public readonly level: string | undefined;\n\n  private readonly buffer: BatchBuffer<TransportLogEntry>;\n  private readonly requestTimeoutMs: number;\n  private flushTimer: NodeJS.Timeout | null = null;\n  private accessToken: string | null = null;\n  private tokenExpiry = 0;\n\n  private readonly endpoint: string;\n  private readonly ruleId: string;\n  private readonly streamName: string;\n  private readonly tenantId: string | undefined;\n  private readonly clientId: string | undefined;\n  private readonly clientSecret: string | undefined;\n\n  constructor(config: AzureMonitorTransportConfig) {\n    protectSecrets(this, ['clientSecret', 'accessToken']);\n    this.endpoint = config.endpoint.replace(/\\/$/, '');\n    this.ruleId = config.ruleId;\n    this.streamName = config.streamName;\n    this.tenantId = config.tenantId ?? process.env['AZURE_TENANT_ID'];\n    this.clientId = config.clientId ?? process.env['AZURE_CLIENT_ID'];\n    this.clientSecret = config.clientSecret ?? process.env['AZURE_CLIENT_SECRET'];\n    this.batchSize = config.batchSize ?? 200;\n    this.flushInterval = config.flushIntervalMs ?? 5000;\n    this.level = config.level;\n    this.requestTimeoutMs = config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;\n    this.buffer = new BatchBuffer<TransportLogEntry>({\n      name: 'AzureMonitorTransport',\n      batchSize: this.batchSize,\n      maxBufferSize: config.maxBufferSize ?? DEFAULT_MAX_BUFFER_SIZE,\n      send: (entries) => this.sendEntries(entries),\n      secrets: () => this.secretValues(),\n    });\n\n    this.flushTimer = setInterval(() => {\n      this.flush().catch(() => {});\n    }, this.flushInterval);\n    if (this.flushTimer.unref) this.flushTimer.unref();\n  }\n\n  write(entry: TransportLogEntry): void {\n    this.buffer.push(entry);\n    this.buffer.flushIfFull();\n  }\n\n  flush(): Promise<void> {\n    return this.buffer.flush();\n  }\n\n  /**\n   * Flush remaining entries and stop the interval timer on shutdown. Without\n   * this the manager's close() skipped the transport (close was undefined) and\n   * buffered entries were lost on deploy. Waits for any in-flight send first.\n   */\n  async close(): Promise<void> {\n    if (this.flushTimer) {\n      clearInterval(this.flushTimer);\n      this.flushTimer = null;\n    }\n    await this.buffer.close();\n  }\n\n  private toAzureRecord(entry: TransportLogEntry): Record<string, unknown> {\n    return {\n      TimeGenerated: entry.timestamp ?? new Date().toISOString(),\n      SeverityLevel: SEVERITY_MAP[entry.level.toLowerCase()] ?? 1,\n      Message: entry.message,\n      AppName: entry.appName,\n      Context: entry.context ?? '',\n      TraceId: entry.traceId ?? '',\n      Properties: stringifyForLog(entry.data ?? {}),\n    };\n  }\n\n  private secretValues(token?: string): (string | undefined)[] {\n    return [this.clientSecret, this.accessToken ?? undefined, token, ...urlSecrets(this.endpoint)];\n  }\n\n  private async getAccessToken(): Promise<string | null> {\n    if (this.accessToken && Date.now() < this.tokenExpiry) return this.accessToken;\n\n    if (!this.tenantId || !this.clientId || !this.clientSecret) {\n      internalWarn(\n        'AzureMonitorTransport: missing credentials — set tenantId, clientId, clientSecret'\n      );\n      return null;\n    }\n\n    const body = new URLSearchParams({\n      grant_type: 'client_credentials',\n      client_id: this.clientId,\n      client_secret: this.clientSecret,\n      scope: 'https://monitor.azure.com/.default',\n    }).toString();\n\n    const tenantId = this.tenantId;\n    if (!AZURE_TENANT_RE.test(tenantId)) {\n      internalWarn(\n        `AzureMonitorTransport: refusing to request token — tenantId \"${tenantId}\" is not a valid GUID or domain`\n      );\n      return null;\n    }\n\n    const reqUrl = new URL(\n      `https://login.microsoftonline.com/${encodeURIComponent(tenantId)}/oauth2/v2.0/token`\n    );\n    try {\n      const res = await httpRequest({\n        url: reqUrl,\n        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n        body,\n        timeoutMs: this.requestTimeoutMs,\n        label: 'Azure token request',\n        secrets: () => this.secretValues(),\n      });\n      const parsed = JSON.parse(res.body) as { access_token?: string; expires_in?: number };\n      if (!parsed.access_token) return null;\n      this.accessToken = parsed.access_token;\n      this.tokenExpiry = Date.now() + (parsed.expires_in ?? 3600) * 1000 - 60_000;\n      return this.accessToken;\n    } catch (err) {\n      internalError('AzureMonitorTransport token request failed', err);\n      return null;\n    }\n  }\n\n  private async sendEntries(entries: TransportLogEntry[]): Promise<void> {\n    const token = await this.getAccessToken();\n    if (!token) throw new Error('AzureMonitorTransport: no access token available');\n\n    const records = entries.map((e) => this.toAzureRecord(e));\n    const body = stringifyForLog(records);\n    let reqUrl: URL;\n    try {\n      // Build from the user-configured DCE endpoint; encodeURIComponent-ing the\n      // ruleId/streamName stops a hostile config from smuggling extra path\n      // segments or query params into the request.\n      reqUrl = new URL(\n        `dataCollectionRules/${encodeURIComponent(this.ruleId)}/streams/${encodeURIComponent(this.streamName)}?api-version=2023-01-01`,\n        this.endpoint.endsWith('/') ? this.endpoint : `${this.endpoint}/`\n      );\n    } catch (error) {\n      internalError(\n        `AzureMonitorTransport: invalid endpoint \"${scrubSecrets(this.endpoint, urlSecrets(this.endpoint))}\"`,\n        scrubError(error, urlSecrets(this.endpoint))\n      );\n      return;\n    }\n    if (reqUrl.protocol !== 'https:') {\n      internalError(`AzureMonitorTransport: endpoint must use https (got ${reqUrl.protocol})`);\n      return;\n    }\n\n    await httpRequest({\n      url: reqUrl,\n      headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: 'Azure Monitor API',\n      secrets: () => this.secretValues(token),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;AAiDA,MAAM,kBAAkB;AA0BxB,MAAM,eAAuC;CAC3C,SAAS;CACT,OAAO;CACP,OAAO;CACP,MAAM;CACN,KAAK;CACL,MAAM;CACN,SAAS;CACT,OAAO;CACP,UAAU;CACV,OAAO;AACT;;;;AAKA,IAAa,wBAAb,MAA8D;CAmB5D,YAAY,QAAqC;EAlB1B,KAAA,OAAA;EAOqB,KAAA,aAAA;EACP,KAAA,cAAA;EACf,KAAA,cAAA;EAUpB,sBAAA,eAAe,MAAM,CAAC,gBAAgB,aAAa,CAAC;EACpD,KAAK,WAAW,OAAO,SAAS,QAAQ,OAAO,EAAE;EACjD,KAAK,SAAS,OAAO;EACrB,KAAK,aAAa,OAAO;EACzB,KAAK,WAAW,OAAO,YAAY,QAAQ,IAAI;EAC/C,KAAK,WAAW,OAAO,YAAY,QAAQ,IAAI;EAC/C,KAAK,eAAe,OAAO,gBAAgB,QAAQ,IAAI;EACvD,KAAK,YAAY,OAAO,aAAa;EACrC,KAAK,gBAAgB,OAAO,mBAAmB;EAC/C,KAAK,QAAQ,OAAO;EACpB,KAAK,mBAAmB,OAAO,oBAAA;EAC/B,KAAK,SAAS,IAAIA,qBAAAA,YAA+B;GAC/C,MAAM;GACN,WAAW,KAAK;GAChB,eAAe,OAAO,iBAAA;GACtB,OAAO,YAAY,KAAK,YAAY,OAAO;GAC3C,eAAe,KAAK,aAAa;EACnC,CAAC;EAED,KAAK,aAAa,kBAAkB;GAClC,KAAK,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;EAC7B,GAAG,KAAK,aAAa;EACrB,IAAI,KAAK,WAAW,OAAO,KAAK,WAAW,MAAM;CACnD;CAEA,MAAM,OAAgC;EACpC,KAAK,OAAO,KAAK,KAAK;EACtB,KAAK,OAAO,YAAY;CAC1B;CAEA,QAAuB;EACrB,OAAO,KAAK,OAAO,MAAM;CAC3B;;;;;;CAOA,MAAM,QAAuB;EAC3B,IAAI,KAAK,YAAY;GACnB,cAAc,KAAK,UAAU;GAC7B,KAAK,aAAa;EACpB;EACA,MAAM,KAAK,OAAO,MAAM;CAC1B;CAEA,cAAsB,OAAmD;EACvE,OAAO;GACL,eAAe,MAAM,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;GACzD,eAAe,aAAa,MAAM,MAAM,YAAY,MAAM;GAC1D,SAAS,MAAM;GACf,SAAS,MAAM;GACf,SAAS,MAAM,WAAW;GAC1B,SAAS,MAAM,WAAW;GAC1B,YAAYC,uBAAAA,gBAAgB,MAAM,QAAQ,CAAC,CAAC;EAC9C;CACF;CAEA,aAAqB,OAAwC;EAC3D,OAAO;GAAC,KAAK;GAAc,KAAK,eAAe,KAAA;GAAW;GAAO,GAAGC,sBAAAA,WAAW,KAAK,QAAQ;EAAC;CAC/F;CAEA,MAAc,iBAAyC;EACrD,IAAI,KAAK,eAAe,KAAK,IAAI,IAAI,KAAK,aAAa,OAAO,KAAK;EAEnE,IAAI,CAAC,KAAK,YAAY,CAAC,KAAK,YAAY,CAAC,KAAK,cAAc;GAC1D,qBAAA,aACE,mFACF;GACA,OAAO;EACT;EAEA,MAAM,OAAO,IAAI,gBAAgB;GAC/B,YAAY;GACZ,WAAW,KAAK;GAChB,eAAe,KAAK;GACpB,OAAO;EACT,CAAC,CAAC,CAAC,SAAS;EAEZ,MAAM,WAAW,KAAK;EACtB,IAAI,CAAC,gBAAgB,KAAK,QAAQ,GAAG;GACnC,qBAAA,aACE,gEAAgE,SAAS,gCAC3E;GACA,OAAO;EACT;EAEA,MAAM,SAAS,IAAI,IACjB,qCAAqC,mBAAmB,QAAQ,EAAE,mBACpE;EACA,IAAI;GACF,MAAM,MAAM,MAAMC,qBAAAA,YAAY;IAC5B,KAAK;IACL,SAAS,EAAE,gBAAgB,oCAAoC;IAC/D;IACA,WAAW,KAAK;IAChB,OAAO;IACP,eAAe,KAAK,aAAa;GACnC,CAAC;GACD,MAAM,SAAS,KAAK,MAAM,IAAI,IAAI;GAClC,IAAI,CAAC,OAAO,cAAc,OAAO;GACjC,KAAK,cAAc,OAAO;GAC1B,KAAK,cAAc,KAAK,IAAI,KAAK,OAAO,cAAc,QAAQ,MAAO;GACrE,OAAO,KAAK;EACd,SAAS,KAAK;GACZ,qBAAA,cAAc,8CAA8C,GAAG;GAC/D,OAAO;EACT;CACF;CAEA,MAAc,YAAY,SAA6C;EACrE,MAAM,QAAQ,MAAM,KAAK,eAAe;EACxC,IAAI,CAAC,OAAO,MAAM,IAAI,MAAM,kDAAkD;EAE9E,MAAM,UAAU,QAAQ,KAAK,MAAM,KAAK,cAAc,CAAC,CAAC;EACxD,MAAM,OAAOF,uBAAAA,gBAAgB,OAAO;EACpC,IAAI;EACJ,IAAI;GAIF,SAAS,IAAI,IACX,uBAAuB,mBAAmB,KAAK,MAAM,EAAE,WAAW,mBAAmB,KAAK,UAAU,EAAE,0BACtG,KAAK,SAAS,SAAS,GAAG,IAAI,KAAK,WAAW,GAAG,KAAK,SAAS,EACjE;EACF,SAAS,OAAO;GACd,qBAAA,cACE,4CAA4CG,sBAAAA,aAAa,KAAK,UAAUF,sBAAAA,WAAW,KAAK,QAAQ,CAAC,EAAE,IACnGG,sBAAAA,WAAW,OAAOH,sBAAAA,WAAW,KAAK,QAAQ,CAAC,CAC7C;GACA;EACF;EACA,IAAI,OAAO,aAAa,UAAU;GAChC,qBAAA,cAAc,uDAAuD,OAAO,SAAS,EAAE;GACvF;EACF;EAEA,MAAMC,qBAAAA,YAAY;GAChB,KAAK;GACL,SAAS;IAAE,eAAe,UAAU;IAAS,gBAAgB;GAAmB;GAChF;GACA,WAAW,KAAK;GAChB,OAAO;GACP,eAAe,KAAK,aAAa,KAAK;EACxC,CAAC;CACH;AACF"}

package/dist/{azure-monitor.transport-D5wQEH04.d.mts → azure-monitor.transport-DV03Z5P4.d.ts}

@@ -1,7 +1,4 @@
-import { p as TransportLogEntry, s as IAsyncTransport } from "./transport.types-CtNr3D7S.mjs";
-
-//#region src/transports/azure-monitor.transport.d.ts
-
+import { p as TransportLogEntry, s as IAsyncTransport } from "./transport.types-BJVL1QQl.js";
 interface AzureMonitorTransportConfig {
   /** DCE (Data Collection Endpoint) URL, e.g. `https://<name>.ingest.monitor.azure.com`. */
   endpoint: string;
@@ -54,9 +51,9 @@ declare class AzureMonitorTransport implements IAsyncTransport {
    */
   close(): Promise<void>;
   private toAzureRecord;
+  private secretValues;
   private getAccessToken;
   private sendEntries;
 }
-//#endregion
 export { AzureMonitorTransportConfig as n, AzureMonitorTransport as t };
-//# sourceMappingURL=azure-monitor.transport-D5wQEH04.d.mts.map
+//# sourceMappingURL=azure-monitor.transport-DV03Z5P4.d.ts.map

package/dist/azure-monitor.transport-DV03Z5P4.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"azure-monitor.transport-DV03Z5P4.d.ts","names":[],"sources":["../src/transports/azure-monitor.transport.ts"],"mappings":";UAmDiB;;EAEf;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;;EAEA;EACA;;;;;cAmBW,iCAAiC;WAC5B;WACA;WACA;WACA;mBAEC;mBACA;UACT;UACA;UACA;mBAES;mBACA;mBACA;mBACA;mBACA;mBACA;EAEL,YAAA,QAAQ;EA0BpB,MAAM,OAAO;EAKb,SAAS;;;;;;EASH,SAAS;UAQP;UAYA;UAIM;UAgDA"}

package/dist/azure.d.mts

@@ -1,3 +1,2 @@
-import "./transport.types-CtNr3D7S.mjs";
-import { n as AzureMonitorTransportConfig, t as AzureMonitorTransport } from "./azure-monitor.transport-D5wQEH04.mjs";
+import { n as AzureMonitorTransportConfig, t as AzureMonitorTransport } from "./azure-monitor.transport-C7kYyZUW.mjs";
 export { AzureMonitorTransport, AzureMonitorTransportConfig };

package/dist/azure.d.ts

@@ -1,3 +1,2 @@
-import "./transport.types-DqVLZTyf.js";
-import { n as AzureMonitorTransportConfig, t as AzureMonitorTransport } from "./azure-monitor.transport-BDFO4F-i.js";
+import { n as AzureMonitorTransportConfig, t as AzureMonitorTransport } from "./azure-monitor.transport-DV03Z5P4.js";
 export { AzureMonitorTransport, AzureMonitorTransportConfig };

package/dist/azure.js

@@ -1,6 +1,3 @@
-require('./internal-log-BUJYMZbE.js');
-require('./safe-stringify-DWo3aZp_.js');
-require('./batch-buffer-BY-mRWIK.js');
-const require_azure_monitor_transport = require('./azure-monitor.transport-CrvfHd9C.js');
-
-exports.AzureMonitorTransport = require_azure_monitor_transport.AzureMonitorTransport;
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_azure_monitor_transport = require("./azure-monitor.transport-CwbOLZHB.js");
+exports.AzureMonitorTransport = require_azure_monitor_transport.AzureMonitorTransport;

package/dist/azure.mjs

@@ -1,6 +1 @@
-import "./internal-log-Cm8SOWSV.mjs";
-import "./safe-stringify-DJ66tW5I.mjs";
-import "./batch-buffer-PGvSgbmd.mjs";
-import { t as AzureMonitorTransport } from "./azure-monitor.transport-CHnjVRF-.mjs";
-
-export { AzureMonitorTransport };
+export { t as AzureMonitorTransport } from "./azure-monitor.transport-BPbgjATu.mjs";

package/dist/{batch-buffer-PGvSgbmd.mjs → batch-buffer-0fgLmIPn.mjs}

@@ -1,8 +1,18 @@
-import { r as internalWarn, t as internalError } from "./internal-log-Cm8SOWSV.mjs";
+import { r as internalWarn, t as internalError } from "./internal-log-uCSd1PMc.mjs";
+import { a as scrubbing, r as scrubError } from "./secret-config-BegMLkYl.mjs";
 import * as http from "node:http";
 import * as https from "node:https";
-
-//#region src/transports/batch-buffer.ts
+// src/transports/batch-buffer.ts
+/**
+* Shared batching core for the network transports (OTLP, CloudWatch, GCP, Azure).
+*
+* - one send in flight at a time; flush() and close() join it instead of
+*   racing it, so close() cannot return while a request is still on the wire
+* - a failed batch goes back to the front in its original order
+* - 4xx responses other than 429 drop the batch with a warning instead of
+*   retrying a request the server will never accept
+* - the buffer is capped; when full the oldest entries are dropped
+*/
 const DEFAULT_REQUEST_TIMEOUT_MS = 1e4;
 const DEFAULT_MAX_BUFFER_SIZE = 1e4;
 const WARN_INTERVAL_MS = 1e4;
@@ -22,6 +32,9 @@ function isPermanentHttpError(err) {
 }
 /** One request with a hard timeout. Rejects with HttpError on any non-2xx status. */
 function httpRequest(opts) {
+	return sendRequest(opts).catch(scrubbing(opts.secrets ?? (() => [])));
+}
+function sendRequest(opts) {
 	const { url, method = "POST", headers = {}, body, timeoutMs, label } = opts;
 	const transport = url.protocol === "http:" ? http : https;
 	return new Promise((resolve, reject) => {
@@ -99,6 +112,8 @@ var BatchBuffer = class {
 				await this.opts.send(batch);
 				this.failures = 0;
 			} catch (err) {
+				var _this$opts$secrets, _this$opts;
+				scrubError(err, ((_this$opts$secrets = (_this$opts = this.opts).secrets) === null || _this$opts$secrets === void 0 ? void 0 : _this$opts$secrets.call(_this$opts)) ?? []);
 				if (!(this.opts.shouldRetry ? this.opts.shouldRetry(err) : !isPermanentHttpError(err))) {
 					internalWarn(`${this.opts.name}: dropping ${batch.length} entr${batch.length === 1 ? "y" : "ies"} the server rejected (${err instanceof Error ? err.message : String(err)})`);
 					continue;
@@ -113,7 +128,7 @@ var BatchBuffer = class {
 		}
 	}
 	enforceCap() {
-		const max = this.opts.maxBufferSize ?? DEFAULT_MAX_BUFFER_SIZE;
+		const max = this.opts.maxBufferSize ?? 1e4;
 		const excess = this.items.length - max;
 		if (excess <= 0) return;
 		this.items.splice(0, excess);
@@ -126,7 +141,6 @@ var BatchBuffer = class {
 		}
 	}
 };
-
-//#endregion
 export { httpRequest as a, HttpError as i, DEFAULT_MAX_BUFFER_SIZE as n, isPermanentHttpError as o, DEFAULT_REQUEST_TIMEOUT_MS as r, BatchBuffer as t };
-//# sourceMappingURL=batch-buffer-PGvSgbmd.mjs.map
+
+//# sourceMappingURL=batch-buffer-0fgLmIPn.mjs.map

package/dist/batch-buffer-0fgLmIPn.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch-buffer-0fgLmIPn.mjs","names":[],"sources":["../src/transports/batch-buffer.ts"],"sourcesContent":["/**\n * Shared batching core for the network transports (OTLP, CloudWatch, GCP, Azure).\n *\n * - one send in flight at a time; flush() and close() join it instead of\n *   racing it, so close() cannot return while a request is still on the wire\n * - a failed batch goes back to the front in its original order\n * - 4xx responses other than 429 drop the batch with a warning instead of\n *   retrying a request the server will never accept\n * - the buffer is capped; when full the oldest entries are dropped\n */\n\nimport * as http from 'node:http';\nimport * as https from 'node:https';\n\nimport { internalError, internalWarn } from '../utils/internal-log';\nimport { scrubbing, scrubError } from './secret-config';\n\nexport const DEFAULT_REQUEST_TIMEOUT_MS = 10_000;\nexport const DEFAULT_MAX_BUFFER_SIZE = 10_000;\nconst WARN_INTERVAL_MS = 10_000;\nconst MAX_ERROR_BODY = 500;\nconst MAX_BACKOFF_MS = 30_000;\n\nexport class HttpError extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly body: string,\n    label: string\n  ) {\n    const detail = body ? `: ${body.slice(0, MAX_ERROR_BODY)}` : '';\n    super(`${label} returned HTTP ${status}${detail}`);\n    this.name = 'HttpError';\n  }\n}\n\nexport function isPermanentHttpError(err: unknown): boolean {\n  return err instanceof HttpError && err.status >= 400 && err.status < 500 && err.status !== 429;\n}\n\nexport interface HttpRequestOptions {\n  url: URL;\n  method?: string;\n  headers?: Record<string, string>;\n  body?: string;\n  timeoutMs: number;\n  label: string;\n  /** Secret values to scrub from any error this request raises. URL userinfo is always scrubbed. */\n  secrets?: () => (string | undefined)[];\n}\n\nexport interface HttpResult {\n  status: number;\n  body: string;\n}\n\n/** One request with a hard timeout. Rejects with HttpError on any non-2xx status. */\nexport function httpRequest(opts: HttpRequestOptions): Promise<HttpResult> {\n  return sendRequest(opts).catch(scrubbing(opts.secrets ?? (() => [])));\n}\n\nfunction sendRequest(opts: HttpRequestOptions): Promise<HttpResult> {\n  const { url, method = 'POST', headers = {}, body, timeoutMs, label } = opts;\n  const transport = url.protocol === 'http:' ? http : https;\n  return new Promise<HttpResult>((resolve, reject) => {\n    const req = transport.request(\n      {\n        protocol: url.protocol,\n        hostname: url.hostname,\n        port: url.port || undefined,\n        path: `${url.pathname}${url.search}`,\n        method,\n        headers:\n          body === undefined ? headers : { ...headers, 'Content-Length': Buffer.byteLength(body) },\n      },\n      (res) => {\n        let raw = '';\n        res.on('data', (c: Buffer) => (raw += c.toString()));\n        res.on('end', () => {\n          const status = res.statusCode ?? 0;\n          if (status >= 200 && status < 300) resolve({ status, body: raw });\n          else reject(new HttpError(status, raw, label));\n        });\n        res.on('error', reject);\n      }\n    );\n    req.setTimeout(timeoutMs, () => {\n      req.destroy(new Error(`${label} timed out after ${timeoutMs}ms`));\n    });\n    req.on('error', reject);\n    if (body !== undefined) req.write(body);\n    req.end();\n  });\n}\n\nexport interface BatchBufferOptions<T> {\n  name: string;\n  batchSize: number;\n  maxBufferSize?: number;\n  send: (items: T[]) => Promise<void>;\n  /** Secret values to scrub from send errors before they are stored or logged. */\n  secrets?: () => (string | undefined)[];\n  /** Overrides the default drop-on-4xx rule. Return true to keep and retry the batch. */\n  shouldRetry?: (err: unknown) => boolean;\n}\n\nexport class BatchBuffer<T> {\n  private items: T[] = [];\n  private inFlight: Promise<void> | undefined;\n  private dropped = 0;\n  private lastDropWarn = 0;\n  private failures = 0;\n  private retryAfter = 0;\n\n  constructor(private readonly opts: BatchBufferOptions<T>) {}\n\n  get length(): number {\n    return this.items.length;\n  }\n\n  get batchSize(): number {\n    return this.opts.batchSize;\n  }\n\n  push(item: T): void {\n    this.items.push(item);\n    this.enforceCap();\n  }\n\n  /** Threshold flush for write(): skipped while a send is running or the endpoint is backing off. */\n  flushIfFull(): void {\n    if (this.items.length < this.opts.batchSize || this.inFlight || Date.now() < this.retryAfter) {\n      return;\n    }\n    this.flush().catch(() => {});\n  }\n\n  flush(): Promise<void> {\n    if (!this.inFlight) {\n      this.inFlight = this.drain().finally(() => {\n        this.inFlight = undefined;\n      });\n    }\n    return this.inFlight;\n  }\n\n  /** Flush up to `attempts` times, then report whatever is still undelivered. */\n  async close(attempts = 3): Promise<void> {\n    await this.inFlight;\n    for (let i = 0; i < attempts && this.items.length > 0; i += 1) {\n      await this.flush();\n    }\n    if (this.items.length > 0) {\n      internalError(\n        `${this.opts.name} closing with ${this.items.length} undelivered entr${this.items.length === 1 ? 'y' : 'ies'}`\n      );\n    }\n  }\n\n  private async drain(): Promise<void> {\n    while (this.items.length > 0) {\n      const batch = this.items.splice(0, this.opts.batchSize);\n      try {\n        await this.opts.send(batch);\n        this.failures = 0;\n      } catch (err) {\n        scrubError(err, this.opts.secrets?.() ?? []);\n        const retry = this.opts.shouldRetry\n          ? this.opts.shouldRetry(err)\n          : !isPermanentHttpError(err);\n        if (!retry) {\n          internalWarn(\n            `${this.opts.name}: dropping ${batch.length} entr${batch.length === 1 ? 'y' : 'ies'} the server rejected (${err instanceof Error ? err.message : String(err)})`\n          );\n          continue;\n        }\n        internalError(`${this.opts.name} flush error`, err);\n        this.items.unshift(...batch);\n        this.enforceCap();\n        this.failures += 1;\n        this.retryAfter = Date.now() + Math.min(MAX_BACKOFF_MS, 1000 * 2 ** (this.failures - 1));\n        return;\n      }\n    }\n  }\n\n  private enforceCap(): void {\n    const max = this.opts.maxBufferSize ?? DEFAULT_MAX_BUFFER_SIZE;\n    const excess = this.items.length - max;\n    if (excess <= 0) return;\n    this.items.splice(0, excess);\n    this.dropped += excess;\n    const now = Date.now();\n    if (now - this.lastDropWarn >= WARN_INTERVAL_MS) {\n      internalWarn(\n        `${this.opts.name}: buffer full (${max}), dropped ${this.dropped} oldest entr${this.dropped === 1 ? 'y' : 'ies'}`\n      );\n      this.dropped = 0;\n      this.lastDropWarn = now;\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;AAiBA,MAAa,6BAA6B;AAC1C,MAAa,0BAA0B;AACvC,MAAM,mBAAmB;AACzB,MAAM,iBAAiB;AACvB,MAAM,iBAAiB;AAEvB,IAAa,YAAb,cAA+B,MAAM;CACnC,YACE,QACA,MACA,OACA;EACA,MAAM,SAAS,OAAO,KAAK,KAAK,MAAM,GAAG,cAAc,MAAM;EAC7D,MAAM,GAAG,MAAM,iBAAiB,SAAS,QAAQ;EALjC,KAAA,SAAA;EACA,KAAA,OAAA;EAKhB,KAAK,OAAO;CACd;AACF;AAEA,SAAgB,qBAAqB,KAAuB;CAC1D,OAAO,eAAe,aAAa,IAAI,UAAU,OAAO,IAAI,SAAS,OAAO,IAAI,WAAW;AAC7F;;AAmBA,SAAgB,YAAY,MAA+C;CACzE,OAAO,YAAY,IAAI,CAAC,CAAC,MAAM,UAAU,KAAK,kBAAkB,CAAC,EAAE,CAAC;AACtE;AAEA,SAAS,YAAY,MAA+C;CAClE,MAAM,EAAE,KAAK,SAAS,QAAQ,UAAU,CAAC,GAAG,MAAM,WAAW,UAAU;CACvE,MAAM,YAAY,IAAI,aAAa,UAAU,OAAO;CACpD,OAAO,IAAI,SAAqB,SAAS,WAAW;EAClD,MAAM,MAAM,UAAU,QACpB;GACE,UAAU,IAAI;GACd,UAAU,IAAI;GACd,MAAM,IAAI,QAAQ,KAAA;GAClB,MAAM,GAAG,IAAI,WAAW,IAAI;GAC5B;GACA,SACE,SAAS,KAAA,IAAY,UAAU;IAAE,GAAG;IAAS,kBAAkB,OAAO,WAAW,IAAI;GAAE;EAC3F,IACC,QAAQ;GACP,IAAI,MAAM;GACV,IAAI,GAAG,SAAS,MAAe,OAAO,EAAE,SAAS,CAAE;GACnD,IAAI,GAAG,aAAa;IAClB,MAAM,SAAS,IAAI,cAAc;IACjC,IAAI,UAAU,OAAO,SAAS,KAAK,QAAQ;KAAE;KAAQ,MAAM;IAAI,CAAC;SAC3D,OAAO,IAAI,UAAU,QAAQ,KAAK,KAAK,CAAC;GAC/C,CAAC;GACD,IAAI,GAAG,SAAS,MAAM;EACxB,CACF;EACA,IAAI,WAAW,iBAAiB;GAC9B,IAAI,wBAAQ,IAAI,MAAM,GAAG,MAAM,mBAAmB,UAAU,GAAG,CAAC;EAClE,CAAC;EACD,IAAI,GAAG,SAAS,MAAM;EACtB,IAAI,SAAS,KAAA,GAAW,IAAI,MAAM,IAAI;EACtC,IAAI,IAAI;CACV,CAAC;AACH;AAaA,IAAa,cAAb,MAA4B;CAQ1B,YAAY,MAA8C;EAA7B,KAAA,OAAA;EAPR,KAAA,QAAA,CAAC;EAEJ,KAAA,UAAA;EACK,KAAA,eAAA;EACJ,KAAA,WAAA;EACE,KAAA,aAAA;CAEsC;CAE3D,IAAI,SAAiB;EACnB,OAAO,KAAK,MAAM;CACpB;CAEA,IAAI,YAAoB;EACtB,OAAO,KAAK,KAAK;CACnB;CAEA,KAAK,MAAe;EAClB,KAAK,MAAM,KAAK,IAAI;EACpB,KAAK,WAAW;CAClB;;CAGA,cAAoB;EAClB,IAAI,KAAK,MAAM,SAAS,KAAK,KAAK,aAAa,KAAK,YAAY,KAAK,IAAI,IAAI,KAAK,YAChF;EAEF,KAAK,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;CAC7B;CAEA,QAAuB;EACrB,IAAI,CAAC,KAAK,UACR,KAAK,WAAW,KAAK,MAAM,CAAC,CAAC,cAAc;GACzC,KAAK,WAAW,KAAA;EAClB,CAAC;EAEH,OAAO,KAAK;CACd;;CAGA,MAAM,MAAM,WAAW,GAAkB;EACvC,MAAM,KAAK;EACX,KAAK,IAAI,IAAI,GAAG,IAAI,YAAY,KAAK,MAAM,SAAS,GAAG,KAAK,GAC1D,MAAM,KAAK,MAAM;EAEnB,IAAI,KAAK,MAAM,SAAS,GACtB,cACE,GAAG,KAAK,KAAK,KAAK,gBAAgB,KAAK,MAAM,OAAO,mBAAmB,KAAK,MAAM,WAAW,IAAI,MAAM,OACzG;CAEJ;CAEA,MAAc,QAAuB;EACnC,OAAO,KAAK,MAAM,SAAS,GAAG;GAC5B,MAAM,QAAQ,KAAK,MAAM,OAAO,GAAG,KAAK,KAAK,SAAS;GACtD,IAAI;IACF,MAAM,KAAK,KAAK,KAAK,KAAK;IAC1B,KAAK,WAAW;GAClB,SAAS,KAAK;;IACZ,WAAW,OAAA,sBAAA,aAAK,KAAK,KAAA,CAAK,aAAA,QAAA,uBAAA,KAAA,IAAA,KAAA,IAAA,mBAAA,KAAA,UAAU,MAAK,CAAC,CAAC;IAI3C,IAAI,EAHU,KAAK,KAAK,cACpB,KAAK,KAAK,YAAY,GAAG,IACzB,CAAC,qBAAqB,GAAG,IACjB;KACV,aACE,GAAG,KAAK,KAAK,KAAK,aAAa,MAAM,OAAO,OAAO,MAAM,WAAW,IAAI,MAAM,MAAM,wBAAwB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE,EAC/J;KACA;IACF;IACA,cAAc,GAAG,KAAK,KAAK,KAAK,eAAe,GAAG;IAClD,KAAK,MAAM,QAAQ,GAAG,KAAK;IAC3B,KAAK,WAAW;IAChB,KAAK,YAAY;IACjB,KAAK,aAAa,KAAK,IAAI,IAAI,KAAK,IAAI,gBAAgB,MAAO,MAAM,KAAK,WAAW,EAAE;IACvF;GACF;EACF;CACF;CAEA,aAA2B;EACzB,MAAM,MAAM,KAAK,KAAK,iBAAA;EACtB,MAAM,SAAS,KAAK,MAAM,SAAS;EACnC,IAAI,UAAU,GAAG;EACjB,KAAK,MAAM,OAAO,GAAG,MAAM;EAC3B,KAAK,WAAW;EAChB,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,MAAM,KAAK,gBAAgB,kBAAkB;GAC/C,aACE,GAAG,KAAK,KAAK,KAAK,iBAAiB,IAAI,aAAa,KAAK,QAAQ,cAAc,KAAK,YAAY,IAAI,MAAM,OAC5G;GACA,KAAK,UAAU;GACf,KAAK,eAAe;EACtB;CACF;AACF"}

package/dist/{batch-buffer-BY-mRWIK.js → batch-buffer-DT4gdXmf.js}

@@ -1,11 +1,20 @@
-const require_chunk = require('./chunk-nOFOJqeH.js');
-const require_internal_log = require('./internal-log-BUJYMZbE.js');
+const require_secret_config = require("./secret-config-CBZBs0p1.js");
+const require_internal_log = require("./internal-log-b0Vp4qrB.js");
 let node_http = require("node:http");
-node_http = require_chunk.__toESM(node_http);
+node_http = require_secret_config.__toESM(node_http);
 let node_https = require("node:https");
-node_https = require_chunk.__toESM(node_https);
-
-//#region src/transports/batch-buffer.ts
+node_https = require_secret_config.__toESM(node_https);
+// src/transports/batch-buffer.ts
+/**
+* Shared batching core for the network transports (OTLP, CloudWatch, GCP, Azure).
+*
+* - one send in flight at a time; flush() and close() join it instead of
+*   racing it, so close() cannot return while a request is still on the wire
+* - a failed batch goes back to the front in its original order
+* - 4xx responses other than 429 drop the batch with a warning instead of
+*   retrying a request the server will never accept
+* - the buffer is capped; when full the oldest entries are dropped
+*/
 const DEFAULT_REQUEST_TIMEOUT_MS = 1e4;
 const DEFAULT_MAX_BUFFER_SIZE = 1e4;
 const WARN_INTERVAL_MS = 1e4;
@@ -25,6 +34,9 @@ function isPermanentHttpError(err) {
 }
 /** One request with a hard timeout. Rejects with HttpError on any non-2xx status. */
 function httpRequest(opts) {
+	return sendRequest(opts).catch(require_secret_config.scrubbing(opts.secrets ?? (() => [])));
+}
+function sendRequest(opts) {
 	const { url, method = "POST", headers = {}, body, timeoutMs, label } = opts;
 	const transport = url.protocol === "http:" ? node_http : node_https;
 	return new Promise((resolve, reject) => {
@@ -102,6 +114,8 @@ var BatchBuffer = class {
 				await this.opts.send(batch);
 				this.failures = 0;
 			} catch (err) {
+				var _this$opts$secrets, _this$opts;
+				require_secret_config.scrubError(err, ((_this$opts$secrets = (_this$opts = this.opts).secrets) === null || _this$opts$secrets === void 0 ? void 0 : _this$opts$secrets.call(_this$opts)) ?? []);
 				if (!(this.opts.shouldRetry ? this.opts.shouldRetry(err) : !isPermanentHttpError(err))) {
 					require_internal_log.internalWarn(`${this.opts.name}: dropping ${batch.length} entr${batch.length === 1 ? "y" : "ies"} the server rejected (${err instanceof Error ? err.message : String(err)})`);
 					continue;
@@ -116,7 +130,7 @@ var BatchBuffer = class {
 		}
 	}
 	enforceCap() {
-		const max = this.opts.maxBufferSize ?? DEFAULT_MAX_BUFFER_SIZE;
+		const max = this.opts.maxBufferSize ?? 1e4;
 		const excess = this.items.length - max;
 		if (excess <= 0) return;
 		this.items.splice(0, excess);
@@ -129,42 +143,41 @@ var BatchBuffer = class {
 		}
 	}
 };
-
-//#endregion
-Object.defineProperty(exports, 'BatchBuffer', {
-  enumerable: true,
-  get: function () {
-    return BatchBuffer;
-  }
+Object.defineProperty(exports, "BatchBuffer", {
+	enumerable: true,
+	get: function() {
+		return BatchBuffer;
+	}
 });
-Object.defineProperty(exports, 'DEFAULT_MAX_BUFFER_SIZE', {
-  enumerable: true,
-  get: function () {
-    return DEFAULT_MAX_BUFFER_SIZE;
-  }
+Object.defineProperty(exports, "DEFAULT_MAX_BUFFER_SIZE", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_MAX_BUFFER_SIZE;
+	}
 });
-Object.defineProperty(exports, 'DEFAULT_REQUEST_TIMEOUT_MS', {
-  enumerable: true,
-  get: function () {
-    return DEFAULT_REQUEST_TIMEOUT_MS;
-  }
+Object.defineProperty(exports, "DEFAULT_REQUEST_TIMEOUT_MS", {
+	enumerable: true,
+	get: function() {
+		return DEFAULT_REQUEST_TIMEOUT_MS;
+	}
 });
-Object.defineProperty(exports, 'HttpError', {
-  enumerable: true,
-  get: function () {
-    return HttpError;
-  }
+Object.defineProperty(exports, "HttpError", {
+	enumerable: true,
+	get: function() {
+		return HttpError;
+	}
 });
-Object.defineProperty(exports, 'httpRequest', {
-  enumerable: true,
-  get: function () {
-    return httpRequest;
-  }
+Object.defineProperty(exports, "httpRequest", {
+	enumerable: true,
+	get: function() {
+		return httpRequest;
+	}
 });
-Object.defineProperty(exports, 'isPermanentHttpError', {
-  enumerable: true,
-  get: function () {
-    return isPermanentHttpError;
-  }
+Object.defineProperty(exports, "isPermanentHttpError", {
+	enumerable: true,
+	get: function() {
+		return isPermanentHttpError;
+	}
 });
-//# sourceMappingURL=batch-buffer-BY-mRWIK.js.map
+
+//# sourceMappingURL=batch-buffer-DT4gdXmf.js.map

package/dist/batch-buffer-DT4gdXmf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"batch-buffer-DT4gdXmf.js","names":["scrubbing","http","https"],"sources":["../src/transports/batch-buffer.ts"],"sourcesContent":["/**\n * Shared batching core for the network transports (OTLP, CloudWatch, GCP, Azure).\n *\n * - one send in flight at a time; flush() and close() join it instead of\n *   racing it, so close() cannot return while a request is still on the wire\n * - a failed batch goes back to the front in its original order\n * - 4xx responses other than 429 drop the batch with a warning instead of\n *   retrying a request the server will never accept\n * - the buffer is capped; when full the oldest entries are dropped\n */\n\nimport * as http from 'node:http';\nimport * as https from 'node:https';\n\nimport { internalError, internalWarn } from '../utils/internal-log';\nimport { scrubbing, scrubError } from './secret-config';\n\nexport const DEFAULT_REQUEST_TIMEOUT_MS = 10_000;\nexport const DEFAULT_MAX_BUFFER_SIZE = 10_000;\nconst WARN_INTERVAL_MS = 10_000;\nconst MAX_ERROR_BODY = 500;\nconst MAX_BACKOFF_MS = 30_000;\n\nexport class HttpError extends Error {\n  constructor(\n    public readonly status: number,\n    public readonly body: string,\n    label: string\n  ) {\n    const detail = body ? `: ${body.slice(0, MAX_ERROR_BODY)}` : '';\n    super(`${label} returned HTTP ${status}${detail}`);\n    this.name = 'HttpError';\n  }\n}\n\nexport function isPermanentHttpError(err: unknown): boolean {\n  return err instanceof HttpError && err.status >= 400 && err.status < 500 && err.status !== 429;\n}\n\nexport interface HttpRequestOptions {\n  url: URL;\n  method?: string;\n  headers?: Record<string, string>;\n  body?: string;\n  timeoutMs: number;\n  label: string;\n  /** Secret values to scrub from any error this request raises. URL userinfo is always scrubbed. */\n  secrets?: () => (string | undefined)[];\n}\n\nexport interface HttpResult {\n  status: number;\n  body: string;\n}\n\n/** One request with a hard timeout. Rejects with HttpError on any non-2xx status. */\nexport function httpRequest(opts: HttpRequestOptions): Promise<HttpResult> {\n  return sendRequest(opts).catch(scrubbing(opts.secrets ?? (() => [])));\n}\n\nfunction sendRequest(opts: HttpRequestOptions): Promise<HttpResult> {\n  const { url, method = 'POST', headers = {}, body, timeoutMs, label } = opts;\n  const transport = url.protocol === 'http:' ? http : https;\n  return new Promise<HttpResult>((resolve, reject) => {\n    const req = transport.request(\n      {\n        protocol: url.protocol,\n        hostname: url.hostname,\n        port: url.port || undefined,\n        path: `${url.pathname}${url.search}`,\n        method,\n        headers:\n          body === undefined ? headers : { ...headers, 'Content-Length': Buffer.byteLength(body) },\n      },\n      (res) => {\n        let raw = '';\n        res.on('data', (c: Buffer) => (raw += c.toString()));\n        res.on('end', () => {\n          const status = res.statusCode ?? 0;\n          if (status >= 200 && status < 300) resolve({ status, body: raw });\n          else reject(new HttpError(status, raw, label));\n        });\n        res.on('error', reject);\n      }\n    );\n    req.setTimeout(timeoutMs, () => {\n      req.destroy(new Error(`${label} timed out after ${timeoutMs}ms`));\n    });\n    req.on('error', reject);\n    if (body !== undefined) req.write(body);\n    req.end();\n  });\n}\n\nexport interface BatchBufferOptions<T> {\n  name: string;\n  batchSize: number;\n  maxBufferSize?: number;\n  send: (items: T[]) => Promise<void>;\n  /** Secret values to scrub from send errors before they are stored or logged. */\n  secrets?: () => (string | undefined)[];\n  /** Overrides the default drop-on-4xx rule. Return true to keep and retry the batch. */\n  shouldRetry?: (err: unknown) => boolean;\n}\n\nexport class BatchBuffer<T> {\n  private items: T[] = [];\n  private inFlight: Promise<void> | undefined;\n  private dropped = 0;\n  private lastDropWarn = 0;\n  private failures = 0;\n  private retryAfter = 0;\n\n  constructor(private readonly opts: BatchBufferOptions<T>) {}\n\n  get length(): number {\n    return this.items.length;\n  }\n\n  get batchSize(): number {\n    return this.opts.batchSize;\n  }\n\n  push(item: T): void {\n    this.items.push(item);\n    this.enforceCap();\n  }\n\n  /** Threshold flush for write(): skipped while a send is running or the endpoint is backing off. */\n  flushIfFull(): void {\n    if (this.items.length < this.opts.batchSize || this.inFlight || Date.now() < this.retryAfter) {\n      return;\n    }\n    this.flush().catch(() => {});\n  }\n\n  flush(): Promise<void> {\n    if (!this.inFlight) {\n      this.inFlight = this.drain().finally(() => {\n        this.inFlight = undefined;\n      });\n    }\n    return this.inFlight;\n  }\n\n  /** Flush up to `attempts` times, then report whatever is still undelivered. */\n  async close(attempts = 3): Promise<void> {\n    await this.inFlight;\n    for (let i = 0; i < attempts && this.items.length > 0; i += 1) {\n      await this.flush();\n    }\n    if (this.items.length > 0) {\n      internalError(\n        `${this.opts.name} closing with ${this.items.length} undelivered entr${this.items.length === 1 ? 'y' : 'ies'}`\n      );\n    }\n  }\n\n  private async drain(): Promise<void> {\n    while (this.items.length > 0) {\n      const batch = this.items.splice(0, this.opts.batchSize);\n      try {\n        await this.opts.send(batch);\n        this.failures = 0;\n      } catch (err) {\n        scrubError(err, this.opts.secrets?.() ?? []);\n        const retry = this.opts.shouldRetry\n          ? this.opts.shouldRetry(err)\n          : !isPermanentHttpError(err);\n        if (!retry) {\n          internalWarn(\n            `${this.opts.name}: dropping ${batch.length} entr${batch.length === 1 ? 'y' : 'ies'} the server rejected (${err instanceof Error ? err.message : String(err)})`\n          );\n          continue;\n        }\n        internalError(`${this.opts.name} flush error`, err);\n        this.items.unshift(...batch);\n        this.enforceCap();\n        this.failures += 1;\n        this.retryAfter = Date.now() + Math.min(MAX_BACKOFF_MS, 1000 * 2 ** (this.failures - 1));\n        return;\n      }\n    }\n  }\n\n  private enforceCap(): void {\n    const max = this.opts.maxBufferSize ?? DEFAULT_MAX_BUFFER_SIZE;\n    const excess = this.items.length - max;\n    if (excess <= 0) return;\n    this.items.splice(0, excess);\n    this.dropped += excess;\n    const now = Date.now();\n    if (now - this.lastDropWarn >= WARN_INTERVAL_MS) {\n      internalWarn(\n        `${this.opts.name}: buffer full (${max}), dropped ${this.dropped} oldest entr${this.dropped === 1 ? 'y' : 'ies'}`\n      );\n      this.dropped = 0;\n      this.lastDropWarn = now;\n    }\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAiBA,MAAa,6BAA6B;AAC1C,MAAa,0BAA0B;AACvC,MAAM,mBAAmB;AACzB,MAAM,iBAAiB;AACvB,MAAM,iBAAiB;AAEvB,IAAa,YAAb,cAA+B,MAAM;CACnC,YACE,QACA,MACA,OACA;EACA,MAAM,SAAS,OAAO,KAAK,KAAK,MAAM,GAAG,cAAc,MAAM;EAC7D,MAAM,GAAG,MAAM,iBAAiB,SAAS,QAAQ;EALjC,KAAA,SAAA;EACA,KAAA,OAAA;EAKhB,KAAK,OAAO;CACd;AACF;AAEA,SAAgB,qBAAqB,KAAuB;CAC1D,OAAO,eAAe,aAAa,IAAI,UAAU,OAAO,IAAI,SAAS,OAAO,IAAI,WAAW;AAC7F;;AAmBA,SAAgB,YAAY,MAA+C;CACzE,OAAO,YAAY,IAAI,CAAC,CAAC,MAAMA,sBAAAA,UAAU,KAAK,kBAAkB,CAAC,EAAE,CAAC;AACtE;AAEA,SAAS,YAAY,MAA+C;CAClE,MAAM,EAAE,KAAK,SAAS,QAAQ,UAAU,CAAC,GAAG,MAAM,WAAW,UAAU;CACvE,MAAM,YAAY,IAAI,aAAa,UAAUC,YAAOC;CACpD,OAAO,IAAI,SAAqB,SAAS,WAAW;EAClD,MAAM,MAAM,UAAU,QACpB;GACE,UAAU,IAAI;GACd,UAAU,IAAI;GACd,MAAM,IAAI,QAAQ,KAAA;GAClB,MAAM,GAAG,IAAI,WAAW,IAAI;GAC5B;GACA,SACE,SAAS,KAAA,IAAY,UAAU;IAAE,GAAG;IAAS,kBAAkB,OAAO,WAAW,IAAI;GAAE;EAC3F,IACC,QAAQ;GACP,IAAI,MAAM;GACV,IAAI,GAAG,SAAS,MAAe,OAAO,EAAE,SAAS,CAAE;GACnD,IAAI,GAAG,aAAa;IAClB,MAAM,SAAS,IAAI,cAAc;IACjC,IAAI,UAAU,OAAO,SAAS,KAAK,QAAQ;KAAE;KAAQ,MAAM;IAAI,CAAC;SAC3D,OAAO,IAAI,UAAU,QAAQ,KAAK,KAAK,CAAC;GAC/C,CAAC;GACD,IAAI,GAAG,SAAS,MAAM;EACxB,CACF;EACA,IAAI,WAAW,iBAAiB;GAC9B,IAAI,wBAAQ,IAAI,MAAM,GAAG,MAAM,mBAAmB,UAAU,GAAG,CAAC;EAClE,CAAC;EACD,IAAI,GAAG,SAAS,MAAM;EACtB,IAAI,SAAS,KAAA,GAAW,IAAI,MAAM,IAAI;EACtC,IAAI,IAAI;CACV,CAAC;AACH;AAaA,IAAa,cAAb,MAA4B;CAQ1B,YAAY,MAA8C;EAA7B,KAAA,OAAA;EAPR,KAAA,QAAA,CAAC;EAEJ,KAAA,UAAA;EACK,KAAA,eAAA;EACJ,KAAA,WAAA;EACE,KAAA,aAAA;CAEsC;CAE3D,IAAI,SAAiB;EACnB,OAAO,KAAK,MAAM;CACpB;CAEA,IAAI,YAAoB;EACtB,OAAO,KAAK,KAAK;CACnB;CAEA,KAAK,MAAe;EAClB,KAAK,MAAM,KAAK,IAAI;EACpB,KAAK,WAAW;CAClB;;CAGA,cAAoB;EAClB,IAAI,KAAK,MAAM,SAAS,KAAK,KAAK,aAAa,KAAK,YAAY,KAAK,IAAI,IAAI,KAAK,YAChF;EAEF,KAAK,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;CAC7B;CAEA,QAAuB;EACrB,IAAI,CAAC,KAAK,UACR,KAAK,WAAW,KAAK,MAAM,CAAC,CAAC,cAAc;GACzC,KAAK,WAAW,KAAA;EAClB,CAAC;EAEH,OAAO,KAAK;CACd;;CAGA,MAAM,MAAM,WAAW,GAAkB;EACvC,MAAM,KAAK;EACX,KAAK,IAAI,IAAI,GAAG,IAAI,YAAY,KAAK,MAAM,SAAS,GAAG,KAAK,GAC1D,MAAM,KAAK,MAAM;EAEnB,IAAI,KAAK,MAAM,SAAS,GACtB,qBAAA,cACE,GAAG,KAAK,KAAK,KAAK,gBAAgB,KAAK,MAAM,OAAO,mBAAmB,KAAK,MAAM,WAAW,IAAI,MAAM,OACzG;CAEJ;CAEA,MAAc,QAAuB;EACnC,OAAO,KAAK,MAAM,SAAS,GAAG;GAC5B,MAAM,QAAQ,KAAK,MAAM,OAAO,GAAG,KAAK,KAAK,SAAS;GACtD,IAAI;IACF,MAAM,KAAK,KAAK,KAAK,KAAK;IAC1B,KAAK,WAAW;GAClB,SAAS,KAAK;;IACZ,sBAAA,WAAW,OAAA,sBAAA,aAAK,KAAK,KAAA,CAAK,aAAA,QAAA,uBAAA,KAAA,IAAA,KAAA,IAAA,mBAAA,KAAA,UAAU,MAAK,CAAC,CAAC;IAI3C,IAAI,EAHU,KAAK,KAAK,cACpB,KAAK,KAAK,YAAY,GAAG,IACzB,CAAC,qBAAqB,GAAG,IACjB;KACV,qBAAA,aACE,GAAG,KAAK,KAAK,KAAK,aAAa,MAAM,OAAO,OAAO,MAAM,WAAW,IAAI,MAAM,MAAM,wBAAwB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE,EAC/J;KACA;IACF;IACA,qBAAA,cAAc,GAAG,KAAK,KAAK,KAAK,eAAe,GAAG;IAClD,KAAK,MAAM,QAAQ,GAAG,KAAK;IAC3B,KAAK,WAAW;IAChB,KAAK,YAAY;IACjB,KAAK,aAAa,KAAK,IAAI,IAAI,KAAK,IAAI,gBAAgB,MAAO,MAAM,KAAK,WAAW,EAAE;IACvF;GACF;EACF;CACF;CAEA,aAA2B;EACzB,MAAM,MAAM,KAAK,KAAK,iBAAA;EACtB,MAAM,SAAS,KAAK,MAAM,SAAS;EACnC,IAAI,UAAU,GAAG;EACjB,KAAK,MAAM,OAAO,GAAG,MAAM;EAC3B,KAAK,WAAW;EAChB,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,MAAM,KAAK,gBAAgB,kBAAkB;GAC/C,qBAAA,aACE,GAAG,KAAK,KAAK,KAAK,iBAAiB,IAAI,aAAa,KAAK,QAAQ,cAAc,KAAK,YAAY,IAAI,MAAM,OAC5G;GACA,KAAK,UAAU;GACf,KAAK,eAAe;EACtB;CACF;AACF"}