logixia 2.0.0 → 2.0.4

package/dist/middleware.d.ts

@@ -1,8 +1,4 @@
-import "./transport.types-CGoHpWQR.js";
-import { u as IBaseLogger } from "./index-DhIoploR.js";
-
-//#region src/middleware/http-logger.d.ts
-
+import { u as IBaseLogger } from "./index-DwozbmB4.js";
 interface HttpLoggerOptions {
   /**
    * Skip logging for a request. Called before any I/O.
@@ -28,10 +24,13 @@ interface HttpLoggerOptions {
    */
   extraFields?: (req: IncomingRequest) => Record<string, unknown>;
   /**
-   * Trace ID header. Default: 'x-trace-id'.
-   * If the header is absent, a short random ID is generated.
+   * Header name, or list of names tried in order, to read the trace ID from.
+   * Default: the library-wide list (`DEFAULT_TRACE_HEADERS`: traceparent,
+   * x-trace-id, x-request-id, x-correlation-id, trace-id).
+   * If none is present, `request.id` is used when it is not a framework counter,
+   * otherwise a UUID is generated and shared with the logixia context helpers.
    */
-  traceIdHeader?: string;
+  traceIdHeader?: string | readonly string[];
   /**
    * Additional headers to redact from logged output. Merged with the defaults
    * (authorization, cookie, set-cookie, x-api-key, proxy-authorization,
@@ -73,7 +72,7 @@ interface OutgoingResponse {
 /**
  * Create an Express / Connect compatible middleware that replaces Morgan.
  */
-declare function createExpressMiddleware(logger: IBaseLogger, options?: HttpLoggerOptions): (req: IncomingRequest, res: OutgoingResponse, next: () => void) => void;
+export declare function createExpressMiddleware(logger: IBaseLogger, options?: HttpLoggerOptions): (req: IncomingRequest, res: OutgoingResponse, next: () => void) => void;
 interface FastifyInstance {
   addHook: (name: string, fn: (req: unknown, reply: unknown, done: () => void) => void) => void;
 }
@@ -85,9 +84,8 @@ interface FastifyInstance {
  * await fastify.register(createFastifyPlugin(logger, { slowRequestThresholdMs: 500 }));
  * ```
  */
-declare function createFastifyPlugin(logger: IBaseLogger, options?: HttpLoggerOptions): ((fastify: FastifyInstance, _opts: unknown, done: () => void) => void) & {
+export declare function createFastifyPlugin(logger: IBaseLogger, options?: HttpLoggerOptions): ((fastify: FastifyInstance, _opts: unknown, done: () => void) => void) & {
   [x: symbol]: string | boolean;
 };
-//#endregion
-export { type FastifyInstance, type HttpLoggerOptions, type IncomingRequest, type OutgoingResponse, createExpressMiddleware, createFastifyPlugin };
+export type { FastifyInstance, HttpLoggerOptions, IncomingRequest, OutgoingResponse };
 //# sourceMappingURL=middleware.d.ts.map

package/dist/middleware.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.d.ts","names":[],"sources":["../src/middleware/http-logger.ts"],"sourcesContent":[],"mappings":";;;;;UA+BiB,iBAAA;;;;;eAKF;;;;;;;;;;;;;;;;;;sBAkBO,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;UA8BzB,eAAA;;;YAGL;;;;;;;UAMK,gBAAA;;;;;;;;;iBAsID,uBAAA,SACN,uBACC,0BACF,sBAAsB;UAqFd,eAAA;;;;;;;;;;;iBAYD,mBAAA,SAA4B,uBAAsB,+BAYzB"}
+{"version":3,"file":"middleware.d.ts","names":[],"sources":["../src/middleware/http-logger.ts"],"mappings":";UAgCiB;;;;;EAKf,QAAQ,KAAK;;;;;;EAMb;;EAEA;;;;;EAKA;;;;;EAKA,eAAe,KAAK,oBAAoB;;;;;;;;EAQxC;;;;;;EAMA;;;;;;EAMA;;;;;EAKA;;EAEA;;EAEA;;UAIe;EACf;EACA;EACA,UAAU;EACV;EACA;IAAW;;EACX;;UAGe;EACf;EACA,MAAM,eAAe;EACrB,QAAQ,eAAe;EACvB,aAAa;;;;;wBAkGC,wBACd,QAAQ,aACR,UAAS,qBACP,KAAK,iBAAiB,KAAK,kBAAkB;UAqFhC;EACf,UAAU,cAAc,KAAK,cAAc,gBAAgB;;;;;;;;;;wBAW7C,oBAAoB,QAAQ,aAAa,UAAS,sBAAsB,SAY/C,iBAAe,gBAAgB"}

package/dist/middleware.js

@@ -1,33 +1,8 @@
-const require_internal_log = require('./internal-log-BUJYMZbE.js');
-const require_safe_stringify = require('./safe-stringify-DWo3aZp_.js');
-const require_trace_utils = require('./trace.utils-DpBOLDtq.js');
-
-//#region src/middleware/http-logger.ts
-const DEFAULT_REDACT_HEADERS = [
-	"authorization",
-	"cookie",
-	"set-cookie",
-	"x-api-key",
-	"proxy-authorization",
-	"x-auth-token",
-	"x-access-token",
-	"x-csrf-token",
-	"x-amz-security-token"
-];
-const DEFAULT_REDACT_QUERY_PARAMS = [
-	"token",
-	"access_token",
-	"refresh_token",
-	"code",
-	"password",
-	"secret",
-	"api_key",
-	"apikey",
-	"key",
-	"signature",
-	"sig",
-	"auth"
-];
+Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
+const require_request_trace = require("./request-trace-wTJdKp6-.js");
+const require_internal_log = require("./internal-log-b0Vp4qrB.js");
+const require_safe_stringify = require("./safe-stringify-DLz1Kz3o.js");
+// src/middleware/http-logger.ts
 function buildNameSet(defaults, extra) {
 	return new Set([...defaults, ...extra ?? []].map((n) => n.toLowerCase()));
 }
@@ -68,13 +43,10 @@ function sanitizeHeaders(headers, redactSet) {
 function fire(result) {
 	if (result && typeof result.catch === "function") result.catch((error) => require_internal_log.internalError("http-logger: log call failed", error));
 }
-function shortId() {
-	return Math.random().toString(36).slice(2, 10);
-}
 function resolveNameSets(options) {
 	return {
-		headers: buildNameSet(DEFAULT_REDACT_HEADERS, options.redactHeaders),
-		queryParams: buildNameSet(DEFAULT_REDACT_QUERY_PARAMS, options.redactQueryParams)
+		headers: buildNameSet(require_internal_log.DEFAULT_REDACT_HEADERS, options.redactHeaders),
+		queryParams: buildNameSet(require_internal_log.DEFAULT_REDACT_QUERY_PARAMS, options.redactQueryParams)
 	};
 }
 function buildBaseFields(req, traceId, options, { headers: redactSet, queryParams: paramSet }) {
@@ -93,16 +65,16 @@ function buildBaseFields(req, traceId, options, { headers: redactSet, queryParam
 * Create an Express / Connect compatible middleware that replaces Morgan.
 */
 function createExpressMiddleware(logger, options = {}) {
-	const { skip, logBody, bodyMaxBytes, traceIdHeader = "x-trace-id", requestLevel = "debug", responseLevel = "info", errorLevel = "error", slowRequestThresholdMs = 1e3 } = options;
+	const { skip, logBody, bodyMaxBytes, traceIdHeader, requestLevel = "debug", responseLevel = "info", errorLevel = "error", slowRequestThresholdMs = 1e3 } = options;
 	const nameSets = resolveNameSets(options);
-	const traceHeaderName = traceIdHeader.toLowerCase();
+	const traceHeaders = require_request_trace.resolveTraceHeaders(traceIdHeader);
 	return function logixiaHttpMiddleware(req, res, next) {
-		var _req$headers, _res$once, _res$once2;
+		var _res$once, _res$once2;
 		if (skip === null || skip === void 0 ? void 0 : skip(req)) {
 			next();
 			return;
 		}
-		const traceId = require_trace_utils.sanitizeIncomingId((_req$headers = req.headers) === null || _req$headers === void 0 ? void 0 : _req$headers[traceHeaderName]) ?? shortId();
+		const traceId = require_request_trace.resolveRequestTraceId(req, traceHeaders);
 		const startMs = Date.now();
 		const baseFields = buildBaseFields(req, traceId, options, nameSets);
 		if (requestLevel !== "silent") fire(logger.logLevel(requestLevel, "request started", {
@@ -142,20 +114,18 @@ function createExpressMiddleware(logger, options = {}) {
 * ```
 */
 function createFastifyPlugin(logger, options = {}) {
-	const { skip, traceIdHeader = "x-trace-id", requestLevel = "debug", responseLevel = "info", errorLevel = "error", slowRequestThresholdMs = 1e3 } = options;
+	const { skip, traceIdHeader, requestLevel = "debug", responseLevel = "info", errorLevel = "error", slowRequestThresholdMs = 1e3 } = options;
 	const nameSets = resolveNameSets(options);
-	const traceHeaderName = traceIdHeader.toLowerCase();
+	const traceHeaders = require_request_trace.resolveTraceHeaders(traceIdHeader);
 	function logixiaFastifyPlugin(fastify, _opts, done) {
 		fastify.addHook("onRequest", (request, _reply, hookDone) => {
-			var _req$headers2;
 			const req = request;
 			if (skip === null || skip === void 0 ? void 0 : skip(req)) {
 				hookDone();
 				return;
 			}
-			const traceId = require_trace_utils.sanitizeIncomingId((_req$headers2 = req.headers) === null || _req$headers2 === void 0 ? void 0 : _req$headers2[traceHeaderName]) ?? shortId();
+			const traceId = require_request_trace.resolveRequestTraceId(req, traceHeaders);
 			req._logixiaStart = Date.now();
-			req._logixiaId = traceId;
 			if (requestLevel !== "silent") fire(logger.logLevel(requestLevel, "request started", buildBaseFields(req, traceId, options, nameSets)));
 			hookDone();
 		});
@@ -168,7 +138,7 @@ function createFastifyPlugin(logger, options = {}) {
 			const rep = reply;
 			const duration = Date.now() - req._logixiaStart;
 			const status = rep.statusCode ?? 0;
-			const traceId = req._logixiaId ?? shortId();
+			const traceId = require_request_trace.resolveRequestTraceId(req, traceHeaders);
 			const level = status >= 500 ? errorLevel : responseLevel;
 			const baseFields = buildBaseFields(req, traceId, options, nameSets);
 			fire(logger.logLevel(level, "request completed", {
@@ -262,8 +232,7 @@ function pruneValue(value, budget, depth, ancestors) {
 		ancestors.delete(value);
 	}
 }
-
-//#endregion
 exports.createExpressMiddleware = createExpressMiddleware;
 exports.createFastifyPlugin = createFastifyPlugin;
+
 //# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","names":["out: Record<string, unknown>","internalError","fields: Record<string, unknown>","sanitizeIncomingId","stringifyForLog","items: unknown[]","json: unknown","record: Record<string, unknown>"],"sources":["../src/middleware/http-logger.ts"],"sourcesContent":["/**\n * HTTP request/response logging middleware — Morgan replacement.\n *\n * Fixes every documented Morgan bug:\n *  - statusCode always captured correctly, even for requests > 20 s\n *  - Logs request START (with traceId) and response FINISH (with duration)\n *  - Captures errors before and after response\n *  - Auto-redacts Authorization / Cookie / Set-Cookie headers\n *  - Slow-request warnings\n *  - Skip predicates for health-check routes / static assets\n *\n * @example Express\n * ```ts\n * import { createExpressMiddleware } from 'logixia/middleware';\n * app.use(createExpressMiddleware(logger));\n * ```\n *\n * @example Fastify\n * ```ts\n * import { createFastifyPlugin } from 'logixia/middleware';\n * await fastify.register(createFastifyPlugin(logger));\n * ```\n */\n\nimport type { IBaseLogger } from '../types';\nimport { internalError } from '../utils/internal-log';\nimport { stringifyForLog } from '../utils/safe-stringify';\nimport { sanitizeIncomingId } from '../utils/trace.utils';\n\n// ── Shared types ─────────────────────────────────────────────────────────────\n\nexport interface HttpLoggerOptions {\n  /**\n   * Skip logging for a request. Called before any I/O.\n   * @example `skip: (req) => req.url === '/health'`\n   */\n  skip?: (req: IncomingRequest) => boolean;\n  /**\n   * Log request body (POST/PUT/PATCH). Capped at `bodyMaxBytes` (default: 4096).\n   * Redaction still applies to the captured body.\n   * Default: false.\n   */\n  logBody?: boolean;\n  /** Max bytes of body to capture. Default: 4096. */\n  bodyMaxBytes?: number;\n  /**\n   * Emit a WARN log when a request duration exceeds this threshold (ms).\n   * Default: 1000.\n   */\n  slowRequestThresholdMs?: number;\n  /**\n   * Additional fields to include in every log entry.\n   * @example `extraFields: (req) => ({ tenantId: req.headers['x-tenant-id'] })`\n   */\n  extraFields?: (req: IncomingRequest) => Record<string, unknown>;\n  /**\n   * Trace ID header. Default: 'x-trace-id'.\n   * If the header is absent, a short random ID is generated.\n   */\n  traceIdHeader?: string;\n  /**\n   * Additional headers to redact from logged output. Merged with the defaults\n   * (authorization, cookie, set-cookie, x-api-key, proxy-authorization,\n   * x-auth-token, x-access-token, x-csrf-token, x-amz-security-token).\n   */\n  redactHeaders?: string[];\n  /**\n   * Additional query-string parameter names whose values are redacted from the\n   * logged URL. Merged with the defaults (token, access_token, refresh_token,\n   * code, password, secret, api_key, apikey, key, signature, sig, auth).\n   */\n  redactQueryParams?: string[];\n  /**\n   * Log level for request-start entries. Default: 'debug'.\n   * Set to 'silent' to suppress request-start logs entirely.\n   */\n  requestLevel?: string;\n  /** Log level for successful response entries. Default: 'info'. */\n  responseLevel?: string;\n  /** Log level for error responses (status ≥ 500). Default: 'error'. */\n  errorLevel?: string;\n}\n\n// Minimal structural types so we don't need @types/express / fastify in core\nexport interface IncomingRequest {\n  method?: string;\n  url?: string;\n  headers?: Record<string, string | string[] | undefined>;\n  body?: unknown;\n  socket?: { remoteAddress?: string };\n  ip?: string;\n}\n\nexport interface OutgoingResponse {\n  statusCode?: number;\n  on?: (event: string, cb: () => void) => void;\n  once?: (event: string, cb: () => void) => void;\n  getHeader?: (name: string) => string | number | string[] | undefined;\n}\n\n// ── Helpers ───────────────────────────────────────────────────────────────────\n\nconst DEFAULT_REDACT_HEADERS = [\n  'authorization',\n  'cookie',\n  'set-cookie',\n  'x-api-key',\n  'proxy-authorization',\n  'x-auth-token',\n  'x-access-token',\n  'x-csrf-token',\n  'x-amz-security-token',\n];\n\nconst DEFAULT_REDACT_QUERY_PARAMS = [\n  'token',\n  'access_token',\n  'refresh_token',\n  'code',\n  'password',\n  'secret',\n  'api_key',\n  'apikey',\n  'key',\n  'signature',\n  'sig',\n  'auth',\n];\n\nfunction buildNameSet(defaults: readonly string[], extra: readonly string[] | undefined) {\n  return new Set([...defaults, ...(extra ?? [])].map((n) => n.toLowerCase()));\n}\n\nfunction safeDecode(value: string): string {\n  try {\n    return decodeURIComponent(value.replace(/\\+/g, ' '));\n  } catch {\n    return value;\n  }\n}\n\n/** Replace the values of sensitive query parameters, leaving the rest verbatim. */\nfunction sanitizeUrl(url: string, redactParams: Set<string>): string {\n  const q = url.indexOf('?');\n  if (q === -1) return url;\n  const hashAt = url.indexOf('#', q);\n  const query = url.slice(q + 1, hashAt === -1 ? undefined : hashAt);\n  const hash = hashAt === -1 ? '' : url.slice(hashAt);\n  const cleaned = query\n    .split('&')\n    .map((pair) => {\n      const eq = pair.indexOf('=');\n      const rawKey = eq === -1 ? pair : pair.slice(0, eq);\n      const decoded = safeDecode(rawKey);\n      const bracket = decoded.indexOf('[');\n      const name = (bracket === -1 ? decoded : decoded.slice(0, bracket)).toLowerCase();\n      return redactParams.has(name) && eq !== -1 ? `${rawKey}=[REDACTED]` : pair;\n    })\n    .join('&');\n  return `${url.slice(0, q)}?${cleaned}${hash}`;\n}\n\nfunction sanitizeHeaders(\n  headers: Record<string, string | string[] | undefined> | undefined,\n  redactSet: Set<string>\n): Record<string, unknown> {\n  if (!headers) return {};\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(headers)) {\n    if (k === '__proto__' || k === 'constructor' || k === 'prototype') continue;\n    out[k] = redactSet.has(k.toLowerCase()) ? '[REDACTED]' : v;\n  }\n  return out;\n}\n\n/** Fire-and-forget a logger call; a failing log must never become an unhandled rejection. */\nfunction fire(result: unknown): void {\n  if (result && typeof (result as Promise<unknown>).catch === 'function') {\n    (result as Promise<unknown>).catch((error: unknown) =>\n      internalError('http-logger: log call failed', error)\n    );\n  }\n}\n\nfunction shortId(): string {\n  // eslint-disable-next-line sonarjs/pseudo-random -- non-security request ID\n  return Math.random().toString(36).slice(2, 10);\n}\n\ninterface NameSets {\n  headers: Set<string>;\n  queryParams: Set<string>;\n}\n\nfunction resolveNameSets(options: HttpLoggerOptions): NameSets {\n  return {\n    headers: buildNameSet(DEFAULT_REDACT_HEADERS, options.redactHeaders),\n    queryParams: buildNameSet(DEFAULT_REDACT_QUERY_PARAMS, options.redactQueryParams),\n  };\n}\n\nfunction buildBaseFields(\n  req: IncomingRequest,\n  traceId: string,\n  options: HttpLoggerOptions,\n  { headers: redactSet, queryParams: paramSet }: NameSets\n): Record<string, unknown> {\n  const fields: Record<string, unknown> = {\n    traceId,\n    method: req.method?.toUpperCase() ?? 'UNKNOWN',\n    url: sanitizeUrl(req.url ?? '/', paramSet),\n    ip: req.ip ?? req.socket?.remoteAddress ?? 'unknown',\n    headers: sanitizeHeaders(req.headers, redactSet),\n  };\n\n  if (options.extraFields) {\n    Object.assign(fields, options.extraFields(req));\n  }\n\n  return fields;\n}\n\n// ── Express middleware ────────────────────────────────────────────────────────\n\n/**\n * Create an Express / Connect compatible middleware that replaces Morgan.\n */\nexport function createExpressMiddleware(\n  logger: IBaseLogger,\n  options: HttpLoggerOptions = {}\n): (req: IncomingRequest, res: OutgoingResponse, next: () => void) => void {\n  const {\n    skip,\n    logBody,\n    bodyMaxBytes,\n    traceIdHeader = 'x-trace-id',\n    requestLevel = 'debug',\n    responseLevel = 'info',\n    errorLevel = 'error',\n    slowRequestThresholdMs = 1000,\n  } = options;\n  const nameSets = resolveNameSets(options);\n  const traceHeaderName = traceIdHeader.toLowerCase();\n\n  return function logixiaHttpMiddleware(\n    req: IncomingRequest,\n    res: OutgoingResponse,\n    next: () => void\n  ): void {\n    if (skip?.(req)) {\n      next();\n      return;\n    }\n\n    const traceId = sanitizeIncomingId(req.headers?.[traceHeaderName]) ?? shortId();\n    const startMs = Date.now();\n    const baseFields = buildBaseFields(req, traceId, options, nameSets);\n\n    // Log request start\n    if (requestLevel !== 'silent') {\n      fire(\n        logger.logLevel(requestLevel, 'request started', {\n          ...baseFields,\n          ...(logBody && req.body ? { body: truncateBody(req.body, bodyMaxBytes) } : {}),\n        })\n      );\n    }\n\n    // Hook into the response 'finish' event — fires after headers + body are sent.\n    // This is what Morgan gets wrong for slow requests (it uses 'close' which may\n    // fire before the status code is set on some Node versions).\n    //\n    // BOTH 'finish' and 'close' fire on a normal response, so guard against\n    // logging the completion twice (which would duplicate the completed entry and\n    // the slow-request warning).\n    let completed = false;\n    const onFinish = (): void => {\n      if (completed) return;\n      completed = true;\n\n      const duration = Date.now() - startMs;\n      const status = res.statusCode ?? 0;\n      const level = status >= 500 ? errorLevel : responseLevel;\n\n      fire(\n        logger.logLevel(level, 'request completed', {\n          ...baseFields,\n          statusCode: status,\n          duration,\n        })\n      );\n\n      if (duration > slowRequestThresholdMs) {\n        fire(\n          logger.warn('slow request detected', {\n            ...baseFields,\n            statusCode: status,\n            duration,\n            threshold: slowRequestThresholdMs,\n          })\n        );\n      }\n    };\n\n    res.once?.('finish', onFinish);\n    // Fallback: also covers a client that disconnects before 'finish' fires. The\n    // `completed` guard ensures a normal finish+close pair logs only once.\n    res.once?.('close', onFinish);\n\n    next();\n  };\n}\n\n// ── Fastify plugin ─────────────────────────────────────────────────────────────\n\nexport interface FastifyInstance {\n  addHook: (name: string, fn: (req: unknown, reply: unknown, done: () => void) => void) => void;\n}\n\n/**\n * Create a Fastify plugin (a function you pass to `fastify.register()`).\n *\n * @example\n * ```ts\n * await fastify.register(createFastifyPlugin(logger, { slowRequestThresholdMs: 500 }));\n * ```\n */\nexport function createFastifyPlugin(logger: IBaseLogger, options: HttpLoggerOptions = {}) {\n  const {\n    skip,\n    traceIdHeader = 'x-trace-id',\n    requestLevel = 'debug',\n    responseLevel = 'info',\n    errorLevel = 'error',\n    slowRequestThresholdMs = 1000,\n  } = options;\n  const nameSets = resolveNameSets(options);\n  const traceHeaderName = traceIdHeader.toLowerCase();\n\n  function logixiaFastifyPlugin(fastify: FastifyInstance, _opts: unknown, done: () => void): void {\n    fastify.addHook('onRequest', (request: unknown, _reply: unknown, hookDone: () => void) => {\n      const req = request as IncomingRequest & { _logixiaStart?: number; _logixiaId?: string };\n      if (skip?.(req)) {\n        hookDone();\n        return;\n      }\n\n      const traceId = sanitizeIncomingId(req.headers?.[traceHeaderName]) ?? shortId();\n      req._logixiaStart = Date.now();\n      req._logixiaId = traceId;\n\n      if (requestLevel !== 'silent') {\n        fire(\n          logger.logLevel(\n            requestLevel,\n            'request started',\n            buildBaseFields(req, traceId, options, nameSets)\n          )\n        );\n      }\n      hookDone();\n    });\n\n    fastify.addHook('onResponse', (request: unknown, reply: unknown, hookDone: () => void) => {\n      const req = request as IncomingRequest & { _logixiaStart?: number; _logixiaId?: string };\n      if (req._logixiaStart === undefined) {\n        hookDone();\n        return;\n      }\n\n      const rep = reply as { statusCode?: number };\n      const duration = Date.now() - req._logixiaStart;\n      const status = rep.statusCode ?? 0;\n      const traceId = req._logixiaId ?? shortId();\n      const level = status >= 500 ? errorLevel : responseLevel;\n      const baseFields = buildBaseFields(req, traceId, options, nameSets);\n\n      fire(\n        logger.logLevel(level, 'request completed', {\n          ...baseFields,\n          statusCode: status,\n          duration,\n        })\n      );\n\n      if (duration > slowRequestThresholdMs) {\n        fire(\n          logger.warn('slow request detected', {\n            traceId,\n            url: baseFields.url,\n            method: req.method,\n            duration,\n            threshold: slowRequestThresholdMs,\n          })\n        );\n      }\n\n      hookDone();\n    });\n\n    done();\n  }\n\n  return Object.assign(logixiaFastifyPlugin, {\n    [Symbol.for('skip-override')]: true,\n    [Symbol.for('fastify.display-name')]: 'logixia',\n  });\n}\n\n// ── Internal helpers ──────────────────────────────────────────────────────────\n\n/**\n * Bound the captured body without turning it into a string, so the logger's\n * path-based redaction still sees the original keys. Oversized structures are\n * pruned (extra keys/items dropped, long strings cut) rather than serialized.\n */\nfunction truncateBody(body: unknown, maxBytes = 4096): unknown {\n  if (typeof body === 'string') {\n    return body.length > maxBytes ? body.slice(0, maxBytes) + '…[truncated]' : body;\n  }\n  if (body && typeof body === 'object') {\n    const str = stringifyForLog(body);\n    if (str.length <= maxBytes) return body;\n    return pruneValue(body, { left: maxBytes }, 0, new Set());\n  }\n  return body;\n}\n\nconst TRUNCATED = '…[truncated]';\nconst MAX_PRUNE_DEPTH = 8;\n\nfunction pruneValue(\n  value: unknown,\n  budget: { left: number },\n  depth: number,\n  ancestors: Set<object>\n): unknown {\n  if (typeof value === 'string') {\n    const cut = value.slice(0, Math.max(0, budget.left));\n    budget.left -= cut.length;\n    return cut.length < value.length ? cut + TRUNCATED : cut;\n  }\n  if (value === null || typeof value !== 'object') {\n    budget.left -= 8;\n    return value;\n  }\n  if (value instanceof Date) {\n    budget.left -= 24;\n    return Number.isNaN(value.getTime()) ? 'Invalid Date' : value.toISOString();\n  }\n  if (value instanceof ArrayBuffer || ArrayBuffer.isView(value)) {\n    budget.left -= 16;\n    return `[Buffer ${value.byteLength} bytes]`;\n  }\n  if (value instanceof Error) return value;\n  if (ancestors.has(value) || depth >= MAX_PRUNE_DEPTH) return TRUNCATED;\n  ancestors.add(value);\n  try {\n    if (Array.isArray(value) || value instanceof Set || value instanceof Map) {\n      const items: unknown[] = [];\n      for (const item of value instanceof Map ? value.entries() : value) {\n        if (budget.left <= 0) {\n          items.push(TRUNCATED);\n          break;\n        }\n        items.push(pruneValue(item, budget, depth + 1, ancestors));\n      }\n      return items;\n    }\n    const toJSON = (value as { toJSON?: unknown }).toJSON;\n    if (typeof toJSON === 'function') {\n      const json: unknown = toJSON.call(value);\n      if (json !== value) return pruneValue(json, budget, depth + 1, ancestors);\n    }\n    const record: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(value)) {\n      if (k === '__proto__' || k === 'constructor' || k === 'prototype') continue;\n      if (budget.left <= 0) {\n        record['…'] = TRUNCATED;\n        break;\n      }\n      budget.left -= k.length;\n      record[k] = pruneValue(v, budget, depth + 1, ancestors);\n    }\n    return record;\n  } catch {\n    return TRUNCATED;\n  } finally {\n    ancestors.delete(value);\n  }\n}\n"],"mappings":";;;;;AAsGA,MAAM,yBAAyB;CAC7B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;AAED,MAAM,8BAA8B;CAClC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;AAED,SAAS,aAAa,UAA6B,OAAsC;AACvF,QAAO,IAAI,IAAI,CAAC,GAAG,UAAU,GAAI,SAAS,EAAE,CAAE,CAAC,KAAK,MAAM,EAAE,aAAa,CAAC,CAAC;;AAG7E,SAAS,WAAW,OAAuB;AACzC,KAAI;AACF,SAAO,mBAAmB,MAAM,QAAQ,OAAO,IAAI,CAAC;SAC9C;AACN,SAAO;;;;AAKX,SAAS,YAAY,KAAa,cAAmC;CACnE,MAAM,IAAI,IAAI,QAAQ,IAAI;AAC1B,KAAI,MAAM,GAAI,QAAO;CACrB,MAAM,SAAS,IAAI,QAAQ,KAAK,EAAE;CAClC,MAAM,QAAQ,IAAI,MAAM,IAAI,GAAG,WAAW,KAAK,SAAY,OAAO;CAClE,MAAM,OAAO,WAAW,KAAK,KAAK,IAAI,MAAM,OAAO;CACnD,MAAM,UAAU,MACb,MAAM,IAAI,CACV,KAAK,SAAS;EACb,MAAM,KAAK,KAAK,QAAQ,IAAI;EAC5B,MAAM,SAAS,OAAO,KAAK,OAAO,KAAK,MAAM,GAAG,GAAG;EACnD,MAAM,UAAU,WAAW,OAAO;EAClC,MAAM,UAAU,QAAQ,QAAQ,IAAI;EACpC,MAAM,QAAQ,YAAY,KAAK,UAAU,QAAQ,MAAM,GAAG,QAAQ,EAAE,aAAa;AACjF,SAAO,aAAa,IAAI,KAAK,IAAI,OAAO,KAAK,GAAG,OAAO,eAAe;GACtE,CACD,KAAK,IAAI;AACZ,QAAO,GAAG,IAAI,MAAM,GAAG,EAAE,CAAC,GAAG,UAAU;;AAGzC,SAAS,gBACP,SACA,WACyB;AACzB,KAAI,CAAC,QAAS,QAAO,EAAE;CACvB,MAAMA,MAA+B,EAAE;AACvC,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,QAAQ,EAAE;AAC5C,MAAI,MAAM,eAAe,MAAM,iBAAiB,MAAM,YAAa;AACnE,MAAI,KAAK,UAAU,IAAI,EAAE,aAAa,CAAC,GAAG,eAAe;;AAE3D,QAAO;;;AAIT,SAAS,KAAK,QAAuB;AACnC,KAAI,UAAU,OAAQ,OAA4B,UAAU,WAC1D,CAAC,OAA4B,OAAO,UAClCC,mCAAc,gCAAgC,MAAM,CACrD;;AAIL,SAAS,UAAkB;AAEzB,QAAO,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,GAAG,GAAG;;AAQhD,SAAS,gBAAgB,SAAsC;AAC7D,QAAO;EACL,SAAS,aAAa,wBAAwB,QAAQ,cAAc;EACpE,aAAa,aAAa,6BAA6B,QAAQ,kBAAkB;EAClF;;AAGH,SAAS,gBACP,KACA,SACA,SACA,EAAE,SAAS,WAAW,aAAa,YACV;;CACzB,MAAMC,SAAkC;EACtC;EACA,wBAAQ,IAAI,kEAAQ,aAAa,KAAI;EACrC,KAAK,YAAY,IAAI,OAAO,KAAK,SAAS;EAC1C,IAAI,IAAI,sBAAM,IAAI,kEAAQ,kBAAiB;EAC3C,SAAS,gBAAgB,IAAI,SAAS,UAAU;EACjD;AAED,KAAI,QAAQ,YACV,QAAO,OAAO,QAAQ,QAAQ,YAAY,IAAI,CAAC;AAGjD,QAAO;;;;;AAQT,SAAgB,wBACd,QACA,UAA6B,EAAE,EAC0C;CACzE,MAAM,EACJ,MACA,SACA,cACA,gBAAgB,cAChB,eAAe,SACf,gBAAgB,QAChB,aAAa,SACb,yBAAyB,QACvB;CACJ,MAAM,WAAW,gBAAgB,QAAQ;CACzC,MAAM,kBAAkB,cAAc,aAAa;AAEnD,QAAO,SAAS,sBACd,KACA,KACA,MACM;;AACN,kDAAI,KAAO,IAAI,EAAE;AACf,SAAM;AACN;;EAGF,MAAM,UAAUC,uDAAmB,IAAI,qEAAU,iBAAiB,IAAI,SAAS;EAC/E,MAAM,UAAU,KAAK,KAAK;EAC1B,MAAM,aAAa,gBAAgB,KAAK,SAAS,SAAS,SAAS;AAGnE,MAAI,iBAAiB,SACnB,MACE,OAAO,SAAS,cAAc,mBAAmB;GAC/C,GAAG;GACH,GAAI,WAAW,IAAI,OAAO,EAAE,MAAM,aAAa,IAAI,MAAM,aAAa,EAAE,GAAG,EAAE;GAC9E,CAAC,CACH;EAUH,IAAI,YAAY;EAChB,MAAM,iBAAuB;AAC3B,OAAI,UAAW;AACf,eAAY;GAEZ,MAAM,WAAW,KAAK,KAAK,GAAG;GAC9B,MAAM,SAAS,IAAI,cAAc;GACjC,MAAM,QAAQ,UAAU,MAAM,aAAa;AAE3C,QACE,OAAO,SAAS,OAAO,qBAAqB;IAC1C,GAAG;IACH,YAAY;IACZ;IACD,CAAC,CACH;AAED,OAAI,WAAW,uBACb,MACE,OAAO,KAAK,yBAAyB;IACnC,GAAG;IACH,YAAY;IACZ;IACA,WAAW;IACZ,CAAC,CACH;;AAIL,mBAAI,8DAAO,UAAU,SAAS;AAG9B,oBAAI,gEAAO,SAAS,SAAS;AAE7B,QAAM;;;;;;;;;;;AAkBV,SAAgB,oBAAoB,QAAqB,UAA6B,EAAE,EAAE;CACxF,MAAM,EACJ,MACA,gBAAgB,cAChB,eAAe,SACf,gBAAgB,QAChB,aAAa,SACb,yBAAyB,QACvB;CACJ,MAAM,WAAW,gBAAgB,QAAQ;CACzC,MAAM,kBAAkB,cAAc,aAAa;CAEnD,SAAS,qBAAqB,SAA0B,OAAgB,MAAwB;AAC9F,UAAQ,QAAQ,cAAc,SAAkB,QAAiB,aAAyB;;GACxF,MAAM,MAAM;AACZ,mDAAI,KAAO,IAAI,EAAE;AACf,cAAU;AACV;;GAGF,MAAM,UAAUA,wDAAmB,IAAI,uEAAU,iBAAiB,IAAI,SAAS;AAC/E,OAAI,gBAAgB,KAAK,KAAK;AAC9B,OAAI,aAAa;AAEjB,OAAI,iBAAiB,SACnB,MACE,OAAO,SACL,cACA,mBACA,gBAAgB,KAAK,SAAS,SAAS,SAAS,CACjD,CACF;AAEH,aAAU;IACV;AAEF,UAAQ,QAAQ,eAAe,SAAkB,OAAgB,aAAyB;GACxF,MAAM,MAAM;AACZ,OAAI,IAAI,kBAAkB,QAAW;AACnC,cAAU;AACV;;GAGF,MAAM,MAAM;GACZ,MAAM,WAAW,KAAK,KAAK,GAAG,IAAI;GAClC,MAAM,SAAS,IAAI,cAAc;GACjC,MAAM,UAAU,IAAI,cAAc,SAAS;GAC3C,MAAM,QAAQ,UAAU,MAAM,aAAa;GAC3C,MAAM,aAAa,gBAAgB,KAAK,SAAS,SAAS,SAAS;AAEnE,QACE,OAAO,SAAS,OAAO,qBAAqB;IAC1C,GAAG;IACH,YAAY;IACZ;IACD,CAAC,CACH;AAED,OAAI,WAAW,uBACb,MACE,OAAO,KAAK,yBAAyB;IACnC;IACA,KAAK,WAAW;IAChB,QAAQ,IAAI;IACZ;IACA,WAAW;IACZ,CAAC,CACH;AAGH,aAAU;IACV;AAEF,QAAM;;AAGR,QAAO,OAAO,OAAO,sBAAsB;GACxC,OAAO,IAAI,gBAAgB,GAAG;GAC9B,OAAO,IAAI,uBAAuB,GAAG;EACvC,CAAC;;;;;;;AAUJ,SAAS,aAAa,MAAe,WAAW,MAAe;AAC7D,KAAI,OAAO,SAAS,SAClB,QAAO,KAAK,SAAS,WAAW,KAAK,MAAM,GAAG,SAAS,GAAG,iBAAiB;AAE7E,KAAI,QAAQ,OAAO,SAAS,UAAU;AAEpC,MADYC,uCAAgB,KAAK,CACzB,UAAU,SAAU,QAAO;AACnC,SAAO,WAAW,MAAM,EAAE,MAAM,UAAU,EAAE,mBAAG,IAAI,KAAK,CAAC;;AAE3D,QAAO;;AAGT,MAAM,YAAY;AAClB,MAAM,kBAAkB;AAExB,SAAS,WACP,OACA,QACA,OACA,WACS;AACT,KAAI,OAAO,UAAU,UAAU;EAC7B,MAAM,MAAM,MAAM,MAAM,GAAG,KAAK,IAAI,GAAG,OAAO,KAAK,CAAC;AACpD,SAAO,QAAQ,IAAI;AACnB,SAAO,IAAI,SAAS,MAAM,SAAS,MAAM,YAAY;;AAEvD,KAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC/C,SAAO,QAAQ;AACf,SAAO;;AAET,KAAI,iBAAiB,MAAM;AACzB,SAAO,QAAQ;AACf,SAAO,OAAO,MAAM,MAAM,SAAS,CAAC,GAAG,iBAAiB,MAAM,aAAa;;AAE7E,KAAI,iBAAiB,eAAe,YAAY,OAAO,MAAM,EAAE;AAC7D,SAAO,QAAQ;AACf,SAAO,WAAW,MAAM,WAAW;;AAErC,KAAI,iBAAiB,MAAO,QAAO;AACnC,KAAI,UAAU,IAAI,MAAM,IAAI,SAAS,gBAAiB,QAAO;AAC7D,WAAU,IAAI,MAAM;AACpB,KAAI;AACF,MAAI,MAAM,QAAQ,MAAM,IAAI,iBAAiB,OAAO,iBAAiB,KAAK;GACxE,MAAMC,QAAmB,EAAE;AAC3B,QAAK,MAAM,QAAQ,iBAAiB,MAAM,MAAM,SAAS,GAAG,OAAO;AACjE,QAAI,OAAO,QAAQ,GAAG;AACpB,WAAM,KAAK,UAAU;AACrB;;AAEF,UAAM,KAAK,WAAW,MAAM,QAAQ,QAAQ,GAAG,UAAU,CAAC;;AAE5D,UAAO;;EAET,MAAM,SAAU,MAA+B;AAC/C,MAAI,OAAO,WAAW,YAAY;GAChC,MAAMC,OAAgB,OAAO,KAAK,MAAM;AACxC,OAAI,SAAS,MAAO,QAAO,WAAW,MAAM,QAAQ,QAAQ,GAAG,UAAU;;EAE3E,MAAMC,SAAkC,EAAE;AAC1C,OAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,MAAM,EAAE;AAC1C,OAAI,MAAM,eAAe,MAAM,iBAAiB,MAAM,YAAa;AACnE,OAAI,OAAO,QAAQ,GAAG;AACpB,WAAO,OAAO;AACd;;AAEF,UAAO,QAAQ,EAAE;AACjB,UAAO,KAAK,WAAW,GAAG,QAAQ,QAAQ,GAAG,UAAU;;AAEzD,SAAO;SACD;AACN,SAAO;WACC;AACR,YAAU,OAAO,MAAM"}
+{"version":3,"file":"middleware.js","names":["internalError","DEFAULT_REDACT_HEADERS","DEFAULT_REDACT_QUERY_PARAMS","resolveTraceHeaders","resolveRequestTraceId","stringifyForLog"],"sources":["../src/middleware/http-logger.ts"],"sourcesContent":["/**\n * HTTP request/response logging middleware — Morgan replacement.\n *\n * Fixes every documented Morgan bug:\n *  - statusCode always captured correctly, even for requests > 20 s\n *  - Logs request START (with traceId) and response FINISH (with duration)\n *  - Captures errors before and after response\n *  - Auto-redacts Authorization / Cookie / Set-Cookie headers\n *  - Slow-request warnings\n *  - Skip predicates for health-check routes / static assets\n *\n * @example Express\n * ```ts\n * import { createExpressMiddleware } from 'logixia/middleware';\n * app.use(createExpressMiddleware(logger));\n * ```\n *\n * @example Fastify\n * ```ts\n * import { createFastifyPlugin } from 'logixia/middleware';\n * await fastify.register(createFastifyPlugin(logger));\n * ```\n */\n\nimport type { IBaseLogger } from '../types';\nimport { internalError } from '../utils/internal-log';\nimport { resolveRequestTraceId, resolveTraceHeaders } from '../utils/request-trace';\nimport { stringifyForLog } from '../utils/safe-stringify';\nimport { DEFAULT_REDACT_HEADERS, DEFAULT_REDACT_QUERY_PARAMS } from '../utils/sensitive-names';\n\n// ── Shared types ─────────────────────────────────────────────────────────────\n\nexport interface HttpLoggerOptions {\n  /**\n   * Skip logging for a request. Called before any I/O.\n   * @example `skip: (req) => req.url === '/health'`\n   */\n  skip?: (req: IncomingRequest) => boolean;\n  /**\n   * Log request body (POST/PUT/PATCH). Capped at `bodyMaxBytes` (default: 4096).\n   * Redaction still applies to the captured body.\n   * Default: false.\n   */\n  logBody?: boolean;\n  /** Max bytes of body to capture. Default: 4096. */\n  bodyMaxBytes?: number;\n  /**\n   * Emit a WARN log when a request duration exceeds this threshold (ms).\n   * Default: 1000.\n   */\n  slowRequestThresholdMs?: number;\n  /**\n   * Additional fields to include in every log entry.\n   * @example `extraFields: (req) => ({ tenantId: req.headers['x-tenant-id'] })`\n   */\n  extraFields?: (req: IncomingRequest) => Record<string, unknown>;\n  /**\n   * Header name, or list of names tried in order, to read the trace ID from.\n   * Default: the library-wide list (`DEFAULT_TRACE_HEADERS`: traceparent,\n   * x-trace-id, x-request-id, x-correlation-id, trace-id).\n   * If none is present, `request.id` is used when it is not a framework counter,\n   * otherwise a UUID is generated and shared with the logixia context helpers.\n   */\n  traceIdHeader?: string | readonly string[];\n  /**\n   * Additional headers to redact from logged output. Merged with the defaults\n   * (authorization, cookie, set-cookie, x-api-key, proxy-authorization,\n   * x-auth-token, x-access-token, x-csrf-token, x-amz-security-token).\n   */\n  redactHeaders?: string[];\n  /**\n   * Additional query-string parameter names whose values are redacted from the\n   * logged URL. Merged with the defaults (token, access_token, refresh_token,\n   * code, password, secret, api_key, apikey, key, signature, sig, auth).\n   */\n  redactQueryParams?: string[];\n  /**\n   * Log level for request-start entries. Default: 'debug'.\n   * Set to 'silent' to suppress request-start logs entirely.\n   */\n  requestLevel?: string;\n  /** Log level for successful response entries. Default: 'info'. */\n  responseLevel?: string;\n  /** Log level for error responses (status ≥ 500). Default: 'error'. */\n  errorLevel?: string;\n}\n\n// Minimal structural types so we don't need @types/express / fastify in core\nexport interface IncomingRequest {\n  method?: string;\n  url?: string;\n  headers?: Record<string, string | string[] | undefined>;\n  body?: unknown;\n  socket?: { remoteAddress?: string };\n  ip?: string;\n}\n\nexport interface OutgoingResponse {\n  statusCode?: number;\n  on?: (event: string, cb: () => void) => void;\n  once?: (event: string, cb: () => void) => void;\n  getHeader?: (name: string) => string | number | string[] | undefined;\n}\n\n// ── Helpers ───────────────────────────────────────────────────────────────────\n\nfunction buildNameSet(defaults: readonly string[], extra: readonly string[] | undefined) {\n  return new Set([...defaults, ...(extra ?? [])].map((n) => n.toLowerCase()));\n}\n\nfunction safeDecode(value: string): string {\n  try {\n    return decodeURIComponent(value.replace(/\\+/g, ' '));\n  } catch {\n    return value;\n  }\n}\n\n/** Replace the values of sensitive query parameters, leaving the rest verbatim. */\nfunction sanitizeUrl(url: string, redactParams: Set<string>): string {\n  const q = url.indexOf('?');\n  if (q === -1) return url;\n  const hashAt = url.indexOf('#', q);\n  const query = url.slice(q + 1, hashAt === -1 ? undefined : hashAt);\n  const hash = hashAt === -1 ? '' : url.slice(hashAt);\n  const cleaned = query\n    .split('&')\n    .map((pair) => {\n      const eq = pair.indexOf('=');\n      const rawKey = eq === -1 ? pair : pair.slice(0, eq);\n      const decoded = safeDecode(rawKey);\n      const bracket = decoded.indexOf('[');\n      const name = (bracket === -1 ? decoded : decoded.slice(0, bracket)).toLowerCase();\n      return redactParams.has(name) && eq !== -1 ? `${rawKey}=[REDACTED]` : pair;\n    })\n    .join('&');\n  return `${url.slice(0, q)}?${cleaned}${hash}`;\n}\n\nfunction sanitizeHeaders(\n  headers: Record<string, string | string[] | undefined> | undefined,\n  redactSet: Set<string>\n): Record<string, unknown> {\n  if (!headers) return {};\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(headers)) {\n    if (k === '__proto__' || k === 'constructor' || k === 'prototype') continue;\n    out[k] = redactSet.has(k.toLowerCase()) ? '[REDACTED]' : v;\n  }\n  return out;\n}\n\n/** Fire-and-forget a logger call; a failing log must never become an unhandled rejection. */\nfunction fire(result: unknown): void {\n  if (result && typeof (result as Promise<unknown>).catch === 'function') {\n    (result as Promise<unknown>).catch((error: unknown) =>\n      internalError('http-logger: log call failed', error)\n    );\n  }\n}\n\ninterface NameSets {\n  headers: Set<string>;\n  queryParams: Set<string>;\n}\n\nfunction resolveNameSets(options: HttpLoggerOptions): NameSets {\n  return {\n    headers: buildNameSet(DEFAULT_REDACT_HEADERS, options.redactHeaders),\n    queryParams: buildNameSet(DEFAULT_REDACT_QUERY_PARAMS, options.redactQueryParams),\n  };\n}\n\nfunction buildBaseFields(\n  req: IncomingRequest,\n  traceId: string,\n  options: HttpLoggerOptions,\n  { headers: redactSet, queryParams: paramSet }: NameSets\n): Record<string, unknown> {\n  const fields: Record<string, unknown> = {\n    traceId,\n    method: req.method?.toUpperCase() ?? 'UNKNOWN',\n    url: sanitizeUrl(req.url ?? '/', paramSet),\n    ip: req.ip ?? req.socket?.remoteAddress ?? 'unknown',\n    headers: sanitizeHeaders(req.headers, redactSet),\n  };\n\n  if (options.extraFields) {\n    Object.assign(fields, options.extraFields(req));\n  }\n\n  return fields;\n}\n\n// ── Express middleware ────────────────────────────────────────────────────────\n\n/**\n * Create an Express / Connect compatible middleware that replaces Morgan.\n */\nexport function createExpressMiddleware(\n  logger: IBaseLogger,\n  options: HttpLoggerOptions = {}\n): (req: IncomingRequest, res: OutgoingResponse, next: () => void) => void {\n  const {\n    skip,\n    logBody,\n    bodyMaxBytes,\n    traceIdHeader,\n    requestLevel = 'debug',\n    responseLevel = 'info',\n    errorLevel = 'error',\n    slowRequestThresholdMs = 1000,\n  } = options;\n  const nameSets = resolveNameSets(options);\n  const traceHeaders = resolveTraceHeaders(traceIdHeader);\n\n  return function logixiaHttpMiddleware(\n    req: IncomingRequest,\n    res: OutgoingResponse,\n    next: () => void\n  ): void {\n    if (skip?.(req)) {\n      next();\n      return;\n    }\n\n    const traceId = resolveRequestTraceId(req, traceHeaders);\n    const startMs = Date.now();\n    const baseFields = buildBaseFields(req, traceId, options, nameSets);\n\n    // Log request start\n    if (requestLevel !== 'silent') {\n      fire(\n        logger.logLevel(requestLevel, 'request started', {\n          ...baseFields,\n          ...(logBody && req.body ? { body: truncateBody(req.body, bodyMaxBytes) } : {}),\n        })\n      );\n    }\n\n    // Hook into the response 'finish' event — fires after headers + body are sent.\n    // This is what Morgan gets wrong for slow requests (it uses 'close' which may\n    // fire before the status code is set on some Node versions).\n    //\n    // BOTH 'finish' and 'close' fire on a normal response, so guard against\n    // logging the completion twice (which would duplicate the completed entry and\n    // the slow-request warning).\n    let completed = false;\n    const onFinish = (): void => {\n      if (completed) return;\n      completed = true;\n\n      const duration = Date.now() - startMs;\n      const status = res.statusCode ?? 0;\n      const level = status >= 500 ? errorLevel : responseLevel;\n\n      fire(\n        logger.logLevel(level, 'request completed', {\n          ...baseFields,\n          statusCode: status,\n          duration,\n        })\n      );\n\n      if (duration > slowRequestThresholdMs) {\n        fire(\n          logger.warn('slow request detected', {\n            ...baseFields,\n            statusCode: status,\n            duration,\n            threshold: slowRequestThresholdMs,\n          })\n        );\n      }\n    };\n\n    res.once?.('finish', onFinish);\n    // Fallback: also covers a client that disconnects before 'finish' fires. The\n    // `completed` guard ensures a normal finish+close pair logs only once.\n    res.once?.('close', onFinish);\n\n    next();\n  };\n}\n\n// ── Fastify plugin ─────────────────────────────────────────────────────────────\n\nexport interface FastifyInstance {\n  addHook: (name: string, fn: (req: unknown, reply: unknown, done: () => void) => void) => void;\n}\n\n/**\n * Create a Fastify plugin (a function you pass to `fastify.register()`).\n *\n * @example\n * ```ts\n * await fastify.register(createFastifyPlugin(logger, { slowRequestThresholdMs: 500 }));\n * ```\n */\nexport function createFastifyPlugin(logger: IBaseLogger, options: HttpLoggerOptions = {}) {\n  const {\n    skip,\n    traceIdHeader,\n    requestLevel = 'debug',\n    responseLevel = 'info',\n    errorLevel = 'error',\n    slowRequestThresholdMs = 1000,\n  } = options;\n  const nameSets = resolveNameSets(options);\n  const traceHeaders = resolveTraceHeaders(traceIdHeader);\n\n  function logixiaFastifyPlugin(fastify: FastifyInstance, _opts: unknown, done: () => void): void {\n    fastify.addHook('onRequest', (request: unknown, _reply: unknown, hookDone: () => void) => {\n      const req = request as IncomingRequest & { _logixiaStart?: number };\n      if (skip?.(req)) {\n        hookDone();\n        return;\n      }\n\n      const traceId = resolveRequestTraceId(req, traceHeaders);\n      req._logixiaStart = Date.now();\n\n      if (requestLevel !== 'silent') {\n        fire(\n          logger.logLevel(\n            requestLevel,\n            'request started',\n            buildBaseFields(req, traceId, options, nameSets)\n          )\n        );\n      }\n      hookDone();\n    });\n\n    fastify.addHook('onResponse', (request: unknown, reply: unknown, hookDone: () => void) => {\n      const req = request as IncomingRequest & { _logixiaStart?: number };\n      if (req._logixiaStart === undefined) {\n        hookDone();\n        return;\n      }\n\n      const rep = reply as { statusCode?: number };\n      const duration = Date.now() - req._logixiaStart;\n      const status = rep.statusCode ?? 0;\n      const traceId = resolveRequestTraceId(req, traceHeaders);\n      const level = status >= 500 ? errorLevel : responseLevel;\n      const baseFields = buildBaseFields(req, traceId, options, nameSets);\n\n      fire(\n        logger.logLevel(level, 'request completed', {\n          ...baseFields,\n          statusCode: status,\n          duration,\n        })\n      );\n\n      if (duration > slowRequestThresholdMs) {\n        fire(\n          logger.warn('slow request detected', {\n            traceId,\n            url: baseFields.url,\n            method: req.method,\n            duration,\n            threshold: slowRequestThresholdMs,\n          })\n        );\n      }\n\n      hookDone();\n    });\n\n    done();\n  }\n\n  return Object.assign(logixiaFastifyPlugin, {\n    [Symbol.for('skip-override')]: true,\n    [Symbol.for('fastify.display-name')]: 'logixia',\n  });\n}\n\n// ── Internal helpers ──────────────────────────────────────────────────────────\n\n/**\n * Bound the captured body without turning it into a string, so the logger's\n * path-based redaction still sees the original keys. Oversized structures are\n * pruned (extra keys/items dropped, long strings cut) rather than serialized.\n */\nfunction truncateBody(body: unknown, maxBytes = 4096): unknown {\n  if (typeof body === 'string') {\n    return body.length > maxBytes ? body.slice(0, maxBytes) + '…[truncated]' : body;\n  }\n  if (body && typeof body === 'object') {\n    const str = stringifyForLog(body);\n    if (str.length <= maxBytes) return body;\n    return pruneValue(body, { left: maxBytes }, 0, new Set());\n  }\n  return body;\n}\n\nconst TRUNCATED = '…[truncated]';\nconst MAX_PRUNE_DEPTH = 8;\n\nfunction pruneValue(\n  value: unknown,\n  budget: { left: number },\n  depth: number,\n  ancestors: Set<object>\n): unknown {\n  if (typeof value === 'string') {\n    const cut = value.slice(0, Math.max(0, budget.left));\n    budget.left -= cut.length;\n    return cut.length < value.length ? cut + TRUNCATED : cut;\n  }\n  if (value === null || typeof value !== 'object') {\n    budget.left -= 8;\n    return value;\n  }\n  if (value instanceof Date) {\n    budget.left -= 24;\n    return Number.isNaN(value.getTime()) ? 'Invalid Date' : value.toISOString();\n  }\n  if (value instanceof ArrayBuffer || ArrayBuffer.isView(value)) {\n    budget.left -= 16;\n    return `[Buffer ${value.byteLength} bytes]`;\n  }\n  if (value instanceof Error) return value;\n  if (ancestors.has(value) || depth >= MAX_PRUNE_DEPTH) return TRUNCATED;\n  ancestors.add(value);\n  try {\n    if (Array.isArray(value) || value instanceof Set || value instanceof Map) {\n      const items: unknown[] = [];\n      for (const item of value instanceof Map ? value.entries() : value) {\n        if (budget.left <= 0) {\n          items.push(TRUNCATED);\n          break;\n        }\n        items.push(pruneValue(item, budget, depth + 1, ancestors));\n      }\n      return items;\n    }\n    const toJSON = (value as { toJSON?: unknown }).toJSON;\n    if (typeof toJSON === 'function') {\n      const json: unknown = toJSON.call(value);\n      if (json !== value) return pruneValue(json, budget, depth + 1, ancestors);\n    }\n    const record: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(value)) {\n      if (k === '__proto__' || k === 'constructor' || k === 'prototype') continue;\n      if (budget.left <= 0) {\n        record['…'] = TRUNCATED;\n        break;\n      }\n      budget.left -= k.length;\n      record[k] = pruneValue(v, budget, depth + 1, ancestors);\n    }\n    return record;\n  } catch {\n    return TRUNCATED;\n  } finally {\n    ancestors.delete(value);\n  }\n}\n"],"mappings":";;;;;AA0GA,SAAS,aAAa,UAA6B,OAAsC;CACvF,OAAO,IAAI,IAAI,CAAC,GAAG,UAAU,GAAI,SAAS,CAAC,CAAE,CAAC,CAAC,KAAK,MAAM,EAAE,YAAY,CAAC,CAAC;AAC5E;AAEA,SAAS,WAAW,OAAuB;CACzC,IAAI;EACF,OAAO,mBAAmB,MAAM,QAAQ,OAAO,GAAG,CAAC;CACrD,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAS,YAAY,KAAa,cAAmC;CACnE,MAAM,IAAI,IAAI,QAAQ,GAAG;CACzB,IAAI,MAAM,IAAI,OAAO;CACrB,MAAM,SAAS,IAAI,QAAQ,KAAK,CAAC;CACjC,MAAM,QAAQ,IAAI,MAAM,IAAI,GAAG,WAAW,KAAK,KAAA,IAAY,MAAM;CACjE,MAAM,OAAO,WAAW,KAAK,KAAK,IAAI,MAAM,MAAM;CAClD,MAAM,UAAU,MACb,MAAM,GAAG,CAAC,CACV,KAAK,SAAS;EACb,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,MAAM,SAAS,OAAO,KAAK,OAAO,KAAK,MAAM,GAAG,EAAE;EAClD,MAAM,UAAU,WAAW,MAAM;EACjC,MAAM,UAAU,QAAQ,QAAQ,GAAG;EACnC,MAAM,QAAQ,YAAY,KAAK,UAAU,QAAQ,MAAM,GAAG,OAAO,EAAA,CAAG,YAAY;EAChF,OAAO,aAAa,IAAI,IAAI,KAAK,OAAO,KAAK,GAAG,OAAO,eAAe;CACxE,CAAC,CAAC,CACD,KAAK,GAAG;CACX,OAAO,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,UAAU;AACzC;AAEA,SAAS,gBACP,SACA,WACyB;CACzB,IAAI,CAAC,SAAS,OAAO,CAAC;CACtB,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,GAAG;EAC5C,IAAI,MAAM,eAAe,MAAM,iBAAiB,MAAM,aAAa;EACnE,IAAI,KAAK,UAAU,IAAI,EAAE,YAAY,CAAC,IAAI,eAAe;CAC3D;CACA,OAAO;AACT;;AAGA,SAAS,KAAK,QAAuB;CACnC,IAAI,UAAU,OAAQ,OAA4B,UAAU,YAC1D,OAA6B,OAAO,UAClCA,qBAAAA,cAAc,gCAAgC,KAAK,CACrD;AAEJ;AAOA,SAAS,gBAAgB,SAAsC;CAC7D,OAAO;EACL,SAAS,aAAaC,qBAAAA,wBAAwB,QAAQ,aAAa;EACnE,aAAa,aAAaC,qBAAAA,6BAA6B,QAAQ,iBAAiB;CAClF;AACF;AAEA,SAAS,gBACP,KACA,SACA,SACA,EAAE,SAAS,WAAW,aAAa,YACV;;CACzB,MAAM,SAAkC;EACtC;EACA,UAAA,cAAQ,IAAI,YAAA,QAAA,gBAAA,KAAA,IAAA,KAAA,IAAA,YAAQ,YAAY,MAAK;EACrC,KAAK,YAAY,IAAI,OAAO,KAAK,QAAQ;EACzC,IAAI,IAAI,QAAA,cAAM,IAAI,YAAA,QAAA,gBAAA,KAAA,IAAA,KAAA,IAAA,YAAQ,kBAAiB;EAC3C,SAAS,gBAAgB,IAAI,SAAS,SAAS;CACjD;CAEA,IAAI,QAAQ,aACV,OAAO,OAAO,QAAQ,QAAQ,YAAY,GAAG,CAAC;CAGhD,OAAO;AACT;;;;AAOA,SAAgB,wBACd,QACA,UAA6B,CAAC,GAC2C;CACzE,MAAM,EACJ,MACA,SACA,cACA,eACA,eAAe,SACf,gBAAgB,QAChB,aAAa,SACb,yBAAyB,QACvB;CACJ,MAAM,WAAW,gBAAgB,OAAO;CACxC,MAAM,eAAeC,sBAAAA,oBAAoB,aAAa;CAEtD,OAAO,SAAS,sBACd,KACA,KACA,MACM;;EACN,IAAA,SAAA,QAAA,SAAA,KAAA,IAAA,KAAA,IAAI,KAAO,GAAG,GAAG;GACf,KAAK;GACL;EACF;EAEA,MAAM,UAAUC,sBAAAA,sBAAsB,KAAK,YAAY;EACvD,MAAM,UAAU,KAAK,IAAI;EACzB,MAAM,aAAa,gBAAgB,KAAK,SAAS,SAAS,QAAQ;EAGlE,IAAI,iBAAiB,UACnB,KACE,OAAO,SAAS,cAAc,mBAAmB;GAC/C,GAAG;GACH,GAAI,WAAW,IAAI,OAAO,EAAE,MAAM,aAAa,IAAI,MAAM,YAAY,EAAE,IAAI,CAAC;EAC9E,CAAC,CACH;EAUF,IAAI,YAAY;EAChB,MAAM,iBAAuB;GAC3B,IAAI,WAAW;GACf,YAAY;GAEZ,MAAM,WAAW,KAAK,IAAI,IAAI;GAC9B,MAAM,SAAS,IAAI,cAAc;GACjC,MAAM,QAAQ,UAAU,MAAM,aAAa;GAE3C,KACE,OAAO,SAAS,OAAO,qBAAqB;IAC1C,GAAG;IACH,YAAY;IACZ;GACF,CAAC,CACH;GAEA,IAAI,WAAW,wBACb,KACE,OAAO,KAAK,yBAAyB;IACnC,GAAG;IACH,YAAY;IACZ;IACA,WAAW;GACb,CAAC,CACH;EAEJ;EAEA,CAAA,YAAA,IAAI,UAAA,QAAA,cAAA,KAAA,KAAA,UAAA,KAAA,KAAO,UAAU,QAAQ;EAG7B,CAAA,aAAA,IAAI,UAAA,QAAA,eAAA,KAAA,KAAA,WAAA,KAAA,KAAO,SAAS,QAAQ;EAE5B,KAAK;CACP;AACF;;;;;;;;;AAgBA,SAAgB,oBAAoB,QAAqB,UAA6B,CAAC,GAAG;CACxF,MAAM,EACJ,MACA,eACA,eAAe,SACf,gBAAgB,QAChB,aAAa,SACb,yBAAyB,QACvB;CACJ,MAAM,WAAW,gBAAgB,OAAO;CACxC,MAAM,eAAeD,sBAAAA,oBAAoB,aAAa;CAEtD,SAAS,qBAAqB,SAA0B,OAAgB,MAAwB;EAC9F,QAAQ,QAAQ,cAAc,SAAkB,QAAiB,aAAyB;GACxF,MAAM,MAAM;GACZ,IAAA,SAAA,QAAA,SAAA,KAAA,IAAA,KAAA,IAAI,KAAO,GAAG,GAAG;IACf,SAAS;IACT;GACF;GAEA,MAAM,UAAUC,sBAAAA,sBAAsB,KAAK,YAAY;GACvD,IAAI,gBAAgB,KAAK,IAAI;GAE7B,IAAI,iBAAiB,UACnB,KACE,OAAO,SACL,cACA,mBACA,gBAAgB,KAAK,SAAS,SAAS,QAAQ,CACjD,CACF;GAEF,SAAS;EACX,CAAC;EAED,QAAQ,QAAQ,eAAe,SAAkB,OAAgB,aAAyB;GACxF,MAAM,MAAM;GACZ,IAAI,IAAI,kBAAkB,KAAA,GAAW;IACnC,SAAS;IACT;GACF;GAEA,MAAM,MAAM;GACZ,MAAM,WAAW,KAAK,IAAI,IAAI,IAAI;GAClC,MAAM,SAAS,IAAI,cAAc;GACjC,MAAM,UAAUA,sBAAAA,sBAAsB,KAAK,YAAY;GACvD,MAAM,QAAQ,UAAU,MAAM,aAAa;GAC3C,MAAM,aAAa,gBAAgB,KAAK,SAAS,SAAS,QAAQ;GAElE,KACE,OAAO,SAAS,OAAO,qBAAqB;IAC1C,GAAG;IACH,YAAY;IACZ;GACF,CAAC,CACH;GAEA,IAAI,WAAW,wBACb,KACE,OAAO,KAAK,yBAAyB;IACnC;IACA,KAAK,WAAW;IAChB,QAAQ,IAAI;IACZ;IACA,WAAW;GACb,CAAC,CACH;GAGF,SAAS;EACX,CAAC;EAED,KAAK;CACP;CAEA,OAAO,OAAO,OAAO,sBAAsB;GACxC,OAAO,IAAI,eAAe,IAAI;GAC9B,OAAO,IAAI,sBAAsB,IAAI;CACxC,CAAC;AACH;;;;;;AASA,SAAS,aAAa,MAAe,WAAW,MAAe;CAC7D,IAAI,OAAO,SAAS,UAClB,OAAO,KAAK,SAAS,WAAW,KAAK,MAAM,GAAG,QAAQ,IAAI,iBAAiB;CAE7E,IAAI,QAAQ,OAAO,SAAS,UAAU;EAEpC,IADYC,uBAAAA,gBAAgB,IACtB,CAAC,CAAC,UAAU,UAAU,OAAO;EACnC,OAAO,WAAW,MAAM,EAAE,MAAM,SAAS,GAAG,mBAAG,IAAI,IAAI,CAAC;CAC1D;CACA,OAAO;AACT;AAEA,MAAM,YAAY;AAClB,MAAM,kBAAkB;AAExB,SAAS,WACP,OACA,QACA,OACA,WACS;CACT,IAAI,OAAO,UAAU,UAAU;EAC7B,MAAM,MAAM,MAAM,MAAM,GAAG,KAAK,IAAI,GAAG,OAAO,IAAI,CAAC;EACnD,OAAO,QAAQ,IAAI;EACnB,OAAO,IAAI,SAAS,MAAM,SAAS,MAAM,YAAY;CACvD;CACA,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;EAC/C,OAAO,QAAQ;EACf,OAAO;CACT;CACA,IAAI,iBAAiB,MAAM;EACzB,OAAO,QAAQ;EACf,OAAO,OAAO,MAAM,MAAM,QAAQ,CAAC,IAAI,iBAAiB,MAAM,YAAY;CAC5E;CACA,IAAI,iBAAiB,eAAe,YAAY,OAAO,KAAK,GAAG;EAC7D,OAAO,QAAQ;EACf,OAAO,WAAW,MAAM,WAAW;CACrC;CACA,IAAI,iBAAiB,OAAO,OAAO;CACnC,IAAI,UAAU,IAAI,KAAK,KAAK,SAAS,iBAAiB,OAAO;CAC7D,UAAU,IAAI,KAAK;CACnB,IAAI;EACF,IAAI,MAAM,QAAQ,KAAK,KAAK,iBAAiB,OAAO,iBAAiB,KAAK;GACxE,MAAM,QAAmB,CAAC;GAC1B,KAAK,MAAM,QAAQ,iBAAiB,MAAM,MAAM,QAAQ,IAAI,OAAO;IACjE,IAAI,OAAO,QAAQ,GAAG;KACpB,MAAM,KAAK,SAAS;KACpB;IACF;IACA,MAAM,KAAK,WAAW,MAAM,QAAQ,QAAQ,GAAG,SAAS,CAAC;GAC3D;GACA,OAAO;EACT;EACA,MAAM,SAAU,MAA+B;EAC/C,IAAI,OAAO,WAAW,YAAY;GAChC,MAAM,OAAgB,OAAO,KAAK,KAAK;GACvC,IAAI,SAAS,OAAO,OAAO,WAAW,MAAM,QAAQ,QAAQ,GAAG,SAAS;EAC1E;EACA,MAAM,SAAkC,CAAC;EACzC,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,KAAK,GAAG;GAC1C,IAAI,MAAM,eAAe,MAAM,iBAAiB,MAAM,aAAa;GACnE,IAAI,OAAO,QAAQ,GAAG;IACpB,OAAO,OAAO;IACd;GACF;GACA,OAAO,QAAQ,EAAE;GACjB,OAAO,KAAK,WAAW,GAAG,QAAQ,QAAQ,GAAG,SAAS;EACxD;EACA,OAAO;CACT,QAAQ;EACN,OAAO;CACT,UAAU;EACR,UAAU,OAAO,KAAK;CACxB;AACF"}

package/dist/middleware.mjs

@@ -1,33 +1,7 @@
-import { t as internalError } from "./internal-log-Cm8SOWSV.mjs";
-import { i as stringifyForLog } from "./safe-stringify-DJ66tW5I.mjs";
-import { d as sanitizeIncomingId } from "./trace.utils-CvXgaiQT.mjs";
-
-//#region src/middleware/http-logger.ts
-const DEFAULT_REDACT_HEADERS = [
-	"authorization",
-	"cookie",
-	"set-cookie",
-	"x-api-key",
-	"proxy-authorization",
-	"x-auth-token",
-	"x-access-token",
-	"x-csrf-token",
-	"x-amz-security-token"
-];
-const DEFAULT_REDACT_QUERY_PARAMS = [
-	"token",
-	"access_token",
-	"refresh_token",
-	"code",
-	"password",
-	"secret",
-	"api_key",
-	"apikey",
-	"key",
-	"signature",
-	"sig",
-	"auth"
-];
+import { n as resolveTraceHeaders, t as resolveRequestTraceId } from "./request-trace-C_fvIDv4.mjs";
+import { a as DEFAULT_REDACT_QUERY_PARAMS, i as DEFAULT_REDACT_HEADERS, t as internalError } from "./internal-log-uCSd1PMc.mjs";
+import { i as stringifyForLog } from "./safe-stringify-BMRl3EX3.mjs";
+// src/middleware/http-logger.ts
 function buildNameSet(defaults, extra) {
 	return new Set([...defaults, ...extra ?? []].map((n) => n.toLowerCase()));
 }
@@ -68,9 +42,6 @@ function sanitizeHeaders(headers, redactSet) {
 function fire(result) {
 	if (result && typeof result.catch === "function") result.catch((error) => internalError("http-logger: log call failed", error));
 }
-function shortId() {
-	return Math.random().toString(36).slice(2, 10);
-}
 function resolveNameSets(options) {
 	return {
 		headers: buildNameSet(DEFAULT_REDACT_HEADERS, options.redactHeaders),
@@ -93,16 +64,16 @@ function buildBaseFields(req, traceId, options, { headers: redactSet, queryParam
 * Create an Express / Connect compatible middleware that replaces Morgan.
 */
 function createExpressMiddleware(logger, options = {}) {
-	const { skip, logBody, bodyMaxBytes, traceIdHeader = "x-trace-id", requestLevel = "debug", responseLevel = "info", errorLevel = "error", slowRequestThresholdMs = 1e3 } = options;
+	const { skip, logBody, bodyMaxBytes, traceIdHeader, requestLevel = "debug", responseLevel = "info", errorLevel = "error", slowRequestThresholdMs = 1e3 } = options;
 	const nameSets = resolveNameSets(options);
-	const traceHeaderName = traceIdHeader.toLowerCase();
+	const traceHeaders = resolveTraceHeaders(traceIdHeader);
 	return function logixiaHttpMiddleware(req, res, next) {
-		var _req$headers, _res$once, _res$once2;
+		var _res$once, _res$once2;
 		if (skip === null || skip === void 0 ? void 0 : skip(req)) {
 			next();
 			return;
 		}
-		const traceId = sanitizeIncomingId((_req$headers = req.headers) === null || _req$headers === void 0 ? void 0 : _req$headers[traceHeaderName]) ?? shortId();
+		const traceId = resolveRequestTraceId(req, traceHeaders);
 		const startMs = Date.now();
 		const baseFields = buildBaseFields(req, traceId, options, nameSets);
 		if (requestLevel !== "silent") fire(logger.logLevel(requestLevel, "request started", {
@@ -142,20 +113,18 @@ function createExpressMiddleware(logger, options = {}) {
 * ```
 */
 function createFastifyPlugin(logger, options = {}) {
-	const { skip, traceIdHeader = "x-trace-id", requestLevel = "debug", responseLevel = "info", errorLevel = "error", slowRequestThresholdMs = 1e3 } = options;
+	const { skip, traceIdHeader, requestLevel = "debug", responseLevel = "info", errorLevel = "error", slowRequestThresholdMs = 1e3 } = options;
 	const nameSets = resolveNameSets(options);
-	const traceHeaderName = traceIdHeader.toLowerCase();
+	const traceHeaders = resolveTraceHeaders(traceIdHeader);
 	function logixiaFastifyPlugin(fastify, _opts, done) {
 		fastify.addHook("onRequest", (request, _reply, hookDone) => {
-			var _req$headers2;
 			const req = request;
 			if (skip === null || skip === void 0 ? void 0 : skip(req)) {
 				hookDone();
 				return;
 			}
-			const traceId = sanitizeIncomingId((_req$headers2 = req.headers) === null || _req$headers2 === void 0 ? void 0 : _req$headers2[traceHeaderName]) ?? shortId();
+			const traceId = resolveRequestTraceId(req, traceHeaders);
 			req._logixiaStart = Date.now();
-			req._logixiaId = traceId;
 			if (requestLevel !== "silent") fire(logger.logLevel(requestLevel, "request started", buildBaseFields(req, traceId, options, nameSets)));
 			hookDone();
 		});
@@ -168,7 +137,7 @@ function createFastifyPlugin(logger, options = {}) {
 			const rep = reply;
 			const duration = Date.now() - req._logixiaStart;
 			const status = rep.statusCode ?? 0;
-			const traceId = req._logixiaId ?? shortId();
+			const traceId = resolveRequestTraceId(req, traceHeaders);
 			const level = status >= 500 ? errorLevel : responseLevel;
 			const baseFields = buildBaseFields(req, traceId, options, nameSets);
 			fire(logger.logLevel(level, "request completed", {
@@ -262,7 +231,6 @@ function pruneValue(value, budget, depth, ancestors) {
 		ancestors.delete(value);
 	}
 }
-
-//#endregion
 export { createExpressMiddleware, createFastifyPlugin };
+
 //# sourceMappingURL=middleware.mjs.map

package/dist/middleware.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.mjs","names":["out: Record<string, unknown>","fields: Record<string, unknown>","items: unknown[]","json: unknown","record: Record<string, unknown>"],"sources":["../src/middleware/http-logger.ts"],"sourcesContent":["/**\n * HTTP request/response logging middleware — Morgan replacement.\n *\n * Fixes every documented Morgan bug:\n *  - statusCode always captured correctly, even for requests > 20 s\n *  - Logs request START (with traceId) and response FINISH (with duration)\n *  - Captures errors before and after response\n *  - Auto-redacts Authorization / Cookie / Set-Cookie headers\n *  - Slow-request warnings\n *  - Skip predicates for health-check routes / static assets\n *\n * @example Express\n * ```ts\n * import { createExpressMiddleware } from 'logixia/middleware';\n * app.use(createExpressMiddleware(logger));\n * ```\n *\n * @example Fastify\n * ```ts\n * import { createFastifyPlugin } from 'logixia/middleware';\n * await fastify.register(createFastifyPlugin(logger));\n * ```\n */\n\nimport type { IBaseLogger } from '../types';\nimport { internalError } from '../utils/internal-log';\nimport { stringifyForLog } from '../utils/safe-stringify';\nimport { sanitizeIncomingId } from '../utils/trace.utils';\n\n// ── Shared types ─────────────────────────────────────────────────────────────\n\nexport interface HttpLoggerOptions {\n  /**\n   * Skip logging for a request. Called before any I/O.\n   * @example `skip: (req) => req.url === '/health'`\n   */\n  skip?: (req: IncomingRequest) => boolean;\n  /**\n   * Log request body (POST/PUT/PATCH). Capped at `bodyMaxBytes` (default: 4096).\n   * Redaction still applies to the captured body.\n   * Default: false.\n   */\n  logBody?: boolean;\n  /** Max bytes of body to capture. Default: 4096. */\n  bodyMaxBytes?: number;\n  /**\n   * Emit a WARN log when a request duration exceeds this threshold (ms).\n   * Default: 1000.\n   */\n  slowRequestThresholdMs?: number;\n  /**\n   * Additional fields to include in every log entry.\n   * @example `extraFields: (req) => ({ tenantId: req.headers['x-tenant-id'] })`\n   */\n  extraFields?: (req: IncomingRequest) => Record<string, unknown>;\n  /**\n   * Trace ID header. Default: 'x-trace-id'.\n   * If the header is absent, a short random ID is generated.\n   */\n  traceIdHeader?: string;\n  /**\n   * Additional headers to redact from logged output. Merged with the defaults\n   * (authorization, cookie, set-cookie, x-api-key, proxy-authorization,\n   * x-auth-token, x-access-token, x-csrf-token, x-amz-security-token).\n   */\n  redactHeaders?: string[];\n  /**\n   * Additional query-string parameter names whose values are redacted from the\n   * logged URL. Merged with the defaults (token, access_token, refresh_token,\n   * code, password, secret, api_key, apikey, key, signature, sig, auth).\n   */\n  redactQueryParams?: string[];\n  /**\n   * Log level for request-start entries. Default: 'debug'.\n   * Set to 'silent' to suppress request-start logs entirely.\n   */\n  requestLevel?: string;\n  /** Log level for successful response entries. Default: 'info'. */\n  responseLevel?: string;\n  /** Log level for error responses (status ≥ 500). Default: 'error'. */\n  errorLevel?: string;\n}\n\n// Minimal structural types so we don't need @types/express / fastify in core\nexport interface IncomingRequest {\n  method?: string;\n  url?: string;\n  headers?: Record<string, string | string[] | undefined>;\n  body?: unknown;\n  socket?: { remoteAddress?: string };\n  ip?: string;\n}\n\nexport interface OutgoingResponse {\n  statusCode?: number;\n  on?: (event: string, cb: () => void) => void;\n  once?: (event: string, cb: () => void) => void;\n  getHeader?: (name: string) => string | number | string[] | undefined;\n}\n\n// ── Helpers ───────────────────────────────────────────────────────────────────\n\nconst DEFAULT_REDACT_HEADERS = [\n  'authorization',\n  'cookie',\n  'set-cookie',\n  'x-api-key',\n  'proxy-authorization',\n  'x-auth-token',\n  'x-access-token',\n  'x-csrf-token',\n  'x-amz-security-token',\n];\n\nconst DEFAULT_REDACT_QUERY_PARAMS = [\n  'token',\n  'access_token',\n  'refresh_token',\n  'code',\n  'password',\n  'secret',\n  'api_key',\n  'apikey',\n  'key',\n  'signature',\n  'sig',\n  'auth',\n];\n\nfunction buildNameSet(defaults: readonly string[], extra: readonly string[] | undefined) {\n  return new Set([...defaults, ...(extra ?? [])].map((n) => n.toLowerCase()));\n}\n\nfunction safeDecode(value: string): string {\n  try {\n    return decodeURIComponent(value.replace(/\\+/g, ' '));\n  } catch {\n    return value;\n  }\n}\n\n/** Replace the values of sensitive query parameters, leaving the rest verbatim. */\nfunction sanitizeUrl(url: string, redactParams: Set<string>): string {\n  const q = url.indexOf('?');\n  if (q === -1) return url;\n  const hashAt = url.indexOf('#', q);\n  const query = url.slice(q + 1, hashAt === -1 ? undefined : hashAt);\n  const hash = hashAt === -1 ? '' : url.slice(hashAt);\n  const cleaned = query\n    .split('&')\n    .map((pair) => {\n      const eq = pair.indexOf('=');\n      const rawKey = eq === -1 ? pair : pair.slice(0, eq);\n      const decoded = safeDecode(rawKey);\n      const bracket = decoded.indexOf('[');\n      const name = (bracket === -1 ? decoded : decoded.slice(0, bracket)).toLowerCase();\n      return redactParams.has(name) && eq !== -1 ? `${rawKey}=[REDACTED]` : pair;\n    })\n    .join('&');\n  return `${url.slice(0, q)}?${cleaned}${hash}`;\n}\n\nfunction sanitizeHeaders(\n  headers: Record<string, string | string[] | undefined> | undefined,\n  redactSet: Set<string>\n): Record<string, unknown> {\n  if (!headers) return {};\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(headers)) {\n    if (k === '__proto__' || k === 'constructor' || k === 'prototype') continue;\n    out[k] = redactSet.has(k.toLowerCase()) ? '[REDACTED]' : v;\n  }\n  return out;\n}\n\n/** Fire-and-forget a logger call; a failing log must never become an unhandled rejection. */\nfunction fire(result: unknown): void {\n  if (result && typeof (result as Promise<unknown>).catch === 'function') {\n    (result as Promise<unknown>).catch((error: unknown) =>\n      internalError('http-logger: log call failed', error)\n    );\n  }\n}\n\nfunction shortId(): string {\n  // eslint-disable-next-line sonarjs/pseudo-random -- non-security request ID\n  return Math.random().toString(36).slice(2, 10);\n}\n\ninterface NameSets {\n  headers: Set<string>;\n  queryParams: Set<string>;\n}\n\nfunction resolveNameSets(options: HttpLoggerOptions): NameSets {\n  return {\n    headers: buildNameSet(DEFAULT_REDACT_HEADERS, options.redactHeaders),\n    queryParams: buildNameSet(DEFAULT_REDACT_QUERY_PARAMS, options.redactQueryParams),\n  };\n}\n\nfunction buildBaseFields(\n  req: IncomingRequest,\n  traceId: string,\n  options: HttpLoggerOptions,\n  { headers: redactSet, queryParams: paramSet }: NameSets\n): Record<string, unknown> {\n  const fields: Record<string, unknown> = {\n    traceId,\n    method: req.method?.toUpperCase() ?? 'UNKNOWN',\n    url: sanitizeUrl(req.url ?? '/', paramSet),\n    ip: req.ip ?? req.socket?.remoteAddress ?? 'unknown',\n    headers: sanitizeHeaders(req.headers, redactSet),\n  };\n\n  if (options.extraFields) {\n    Object.assign(fields, options.extraFields(req));\n  }\n\n  return fields;\n}\n\n// ── Express middleware ────────────────────────────────────────────────────────\n\n/**\n * Create an Express / Connect compatible middleware that replaces Morgan.\n */\nexport function createExpressMiddleware(\n  logger: IBaseLogger,\n  options: HttpLoggerOptions = {}\n): (req: IncomingRequest, res: OutgoingResponse, next: () => void) => void {\n  const {\n    skip,\n    logBody,\n    bodyMaxBytes,\n    traceIdHeader = 'x-trace-id',\n    requestLevel = 'debug',\n    responseLevel = 'info',\n    errorLevel = 'error',\n    slowRequestThresholdMs = 1000,\n  } = options;\n  const nameSets = resolveNameSets(options);\n  const traceHeaderName = traceIdHeader.toLowerCase();\n\n  return function logixiaHttpMiddleware(\n    req: IncomingRequest,\n    res: OutgoingResponse,\n    next: () => void\n  ): void {\n    if (skip?.(req)) {\n      next();\n      return;\n    }\n\n    const traceId = sanitizeIncomingId(req.headers?.[traceHeaderName]) ?? shortId();\n    const startMs = Date.now();\n    const baseFields = buildBaseFields(req, traceId, options, nameSets);\n\n    // Log request start\n    if (requestLevel !== 'silent') {\n      fire(\n        logger.logLevel(requestLevel, 'request started', {\n          ...baseFields,\n          ...(logBody && req.body ? { body: truncateBody(req.body, bodyMaxBytes) } : {}),\n        })\n      );\n    }\n\n    // Hook into the response 'finish' event — fires after headers + body are sent.\n    // This is what Morgan gets wrong for slow requests (it uses 'close' which may\n    // fire before the status code is set on some Node versions).\n    //\n    // BOTH 'finish' and 'close' fire on a normal response, so guard against\n    // logging the completion twice (which would duplicate the completed entry and\n    // the slow-request warning).\n    let completed = false;\n    const onFinish = (): void => {\n      if (completed) return;\n      completed = true;\n\n      const duration = Date.now() - startMs;\n      const status = res.statusCode ?? 0;\n      const level = status >= 500 ? errorLevel : responseLevel;\n\n      fire(\n        logger.logLevel(level, 'request completed', {\n          ...baseFields,\n          statusCode: status,\n          duration,\n        })\n      );\n\n      if (duration > slowRequestThresholdMs) {\n        fire(\n          logger.warn('slow request detected', {\n            ...baseFields,\n            statusCode: status,\n            duration,\n            threshold: slowRequestThresholdMs,\n          })\n        );\n      }\n    };\n\n    res.once?.('finish', onFinish);\n    // Fallback: also covers a client that disconnects before 'finish' fires. The\n    // `completed` guard ensures a normal finish+close pair logs only once.\n    res.once?.('close', onFinish);\n\n    next();\n  };\n}\n\n// ── Fastify plugin ─────────────────────────────────────────────────────────────\n\nexport interface FastifyInstance {\n  addHook: (name: string, fn: (req: unknown, reply: unknown, done: () => void) => void) => void;\n}\n\n/**\n * Create a Fastify plugin (a function you pass to `fastify.register()`).\n *\n * @example\n * ```ts\n * await fastify.register(createFastifyPlugin(logger, { slowRequestThresholdMs: 500 }));\n * ```\n */\nexport function createFastifyPlugin(logger: IBaseLogger, options: HttpLoggerOptions = {}) {\n  const {\n    skip,\n    traceIdHeader = 'x-trace-id',\n    requestLevel = 'debug',\n    responseLevel = 'info',\n    errorLevel = 'error',\n    slowRequestThresholdMs = 1000,\n  } = options;\n  const nameSets = resolveNameSets(options);\n  const traceHeaderName = traceIdHeader.toLowerCase();\n\n  function logixiaFastifyPlugin(fastify: FastifyInstance, _opts: unknown, done: () => void): void {\n    fastify.addHook('onRequest', (request: unknown, _reply: unknown, hookDone: () => void) => {\n      const req = request as IncomingRequest & { _logixiaStart?: number; _logixiaId?: string };\n      if (skip?.(req)) {\n        hookDone();\n        return;\n      }\n\n      const traceId = sanitizeIncomingId(req.headers?.[traceHeaderName]) ?? shortId();\n      req._logixiaStart = Date.now();\n      req._logixiaId = traceId;\n\n      if (requestLevel !== 'silent') {\n        fire(\n          logger.logLevel(\n            requestLevel,\n            'request started',\n            buildBaseFields(req, traceId, options, nameSets)\n          )\n        );\n      }\n      hookDone();\n    });\n\n    fastify.addHook('onResponse', (request: unknown, reply: unknown, hookDone: () => void) => {\n      const req = request as IncomingRequest & { _logixiaStart?: number; _logixiaId?: string };\n      if (req._logixiaStart === undefined) {\n        hookDone();\n        return;\n      }\n\n      const rep = reply as { statusCode?: number };\n      const duration = Date.now() - req._logixiaStart;\n      const status = rep.statusCode ?? 0;\n      const traceId = req._logixiaId ?? shortId();\n      const level = status >= 500 ? errorLevel : responseLevel;\n      const baseFields = buildBaseFields(req, traceId, options, nameSets);\n\n      fire(\n        logger.logLevel(level, 'request completed', {\n          ...baseFields,\n          statusCode: status,\n          duration,\n        })\n      );\n\n      if (duration > slowRequestThresholdMs) {\n        fire(\n          logger.warn('slow request detected', {\n            traceId,\n            url: baseFields.url,\n            method: req.method,\n            duration,\n            threshold: slowRequestThresholdMs,\n          })\n        );\n      }\n\n      hookDone();\n    });\n\n    done();\n  }\n\n  return Object.assign(logixiaFastifyPlugin, {\n    [Symbol.for('skip-override')]: true,\n    [Symbol.for('fastify.display-name')]: 'logixia',\n  });\n}\n\n// ── Internal helpers ──────────────────────────────────────────────────────────\n\n/**\n * Bound the captured body without turning it into a string, so the logger's\n * path-based redaction still sees the original keys. Oversized structures are\n * pruned (extra keys/items dropped, long strings cut) rather than serialized.\n */\nfunction truncateBody(body: unknown, maxBytes = 4096): unknown {\n  if (typeof body === 'string') {\n    return body.length > maxBytes ? body.slice(0, maxBytes) + '…[truncated]' : body;\n  }\n  if (body && typeof body === 'object') {\n    const str = stringifyForLog(body);\n    if (str.length <= maxBytes) return body;\n    return pruneValue(body, { left: maxBytes }, 0, new Set());\n  }\n  return body;\n}\n\nconst TRUNCATED = '…[truncated]';\nconst MAX_PRUNE_DEPTH = 8;\n\nfunction pruneValue(\n  value: unknown,\n  budget: { left: number },\n  depth: number,\n  ancestors: Set<object>\n): unknown {\n  if (typeof value === 'string') {\n    const cut = value.slice(0, Math.max(0, budget.left));\n    budget.left -= cut.length;\n    return cut.length < value.length ? cut + TRUNCATED : cut;\n  }\n  if (value === null || typeof value !== 'object') {\n    budget.left -= 8;\n    return value;\n  }\n  if (value instanceof Date) {\n    budget.left -= 24;\n    return Number.isNaN(value.getTime()) ? 'Invalid Date' : value.toISOString();\n  }\n  if (value instanceof ArrayBuffer || ArrayBuffer.isView(value)) {\n    budget.left -= 16;\n    return `[Buffer ${value.byteLength} bytes]`;\n  }\n  if (value instanceof Error) return value;\n  if (ancestors.has(value) || depth >= MAX_PRUNE_DEPTH) return TRUNCATED;\n  ancestors.add(value);\n  try {\n    if (Array.isArray(value) || value instanceof Set || value instanceof Map) {\n      const items: unknown[] = [];\n      for (const item of value instanceof Map ? value.entries() : value) {\n        if (budget.left <= 0) {\n          items.push(TRUNCATED);\n          break;\n        }\n        items.push(pruneValue(item, budget, depth + 1, ancestors));\n      }\n      return items;\n    }\n    const toJSON = (value as { toJSON?: unknown }).toJSON;\n    if (typeof toJSON === 'function') {\n      const json: unknown = toJSON.call(value);\n      if (json !== value) return pruneValue(json, budget, depth + 1, ancestors);\n    }\n    const record: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(value)) {\n      if (k === '__proto__' || k === 'constructor' || k === 'prototype') continue;\n      if (budget.left <= 0) {\n        record['…'] = TRUNCATED;\n        break;\n      }\n      budget.left -= k.length;\n      record[k] = pruneValue(v, budget, depth + 1, ancestors);\n    }\n    return record;\n  } catch {\n    return TRUNCATED;\n  } finally {\n    ancestors.delete(value);\n  }\n}\n"],"mappings":";;;;;AAsGA,MAAM,yBAAyB;CAC7B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;AAED,MAAM,8BAA8B;CAClC;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACD;AAED,SAAS,aAAa,UAA6B,OAAsC;AACvF,QAAO,IAAI,IAAI,CAAC,GAAG,UAAU,GAAI,SAAS,EAAE,CAAE,CAAC,KAAK,MAAM,EAAE,aAAa,CAAC,CAAC;;AAG7E,SAAS,WAAW,OAAuB;AACzC,KAAI;AACF,SAAO,mBAAmB,MAAM,QAAQ,OAAO,IAAI,CAAC;SAC9C;AACN,SAAO;;;;AAKX,SAAS,YAAY,KAAa,cAAmC;CACnE,MAAM,IAAI,IAAI,QAAQ,IAAI;AAC1B,KAAI,MAAM,GAAI,QAAO;CACrB,MAAM,SAAS,IAAI,QAAQ,KAAK,EAAE;CAClC,MAAM,QAAQ,IAAI,MAAM,IAAI,GAAG,WAAW,KAAK,SAAY,OAAO;CAClE,MAAM,OAAO,WAAW,KAAK,KAAK,IAAI,MAAM,OAAO;CACnD,MAAM,UAAU,MACb,MAAM,IAAI,CACV,KAAK,SAAS;EACb,MAAM,KAAK,KAAK,QAAQ,IAAI;EAC5B,MAAM,SAAS,OAAO,KAAK,OAAO,KAAK,MAAM,GAAG,GAAG;EACnD,MAAM,UAAU,WAAW,OAAO;EAClC,MAAM,UAAU,QAAQ,QAAQ,IAAI;EACpC,MAAM,QAAQ,YAAY,KAAK,UAAU,QAAQ,MAAM,GAAG,QAAQ,EAAE,aAAa;AACjF,SAAO,aAAa,IAAI,KAAK,IAAI,OAAO,KAAK,GAAG,OAAO,eAAe;GACtE,CACD,KAAK,IAAI;AACZ,QAAO,GAAG,IAAI,MAAM,GAAG,EAAE,CAAC,GAAG,UAAU;;AAGzC,SAAS,gBACP,SACA,WACyB;AACzB,KAAI,CAAC,QAAS,QAAO,EAAE;CACvB,MAAMA,MAA+B,EAAE;AACvC,MAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,QAAQ,EAAE;AAC5C,MAAI,MAAM,eAAe,MAAM,iBAAiB,MAAM,YAAa;AACnE,MAAI,KAAK,UAAU,IAAI,EAAE,aAAa,CAAC,GAAG,eAAe;;AAE3D,QAAO;;;AAIT,SAAS,KAAK,QAAuB;AACnC,KAAI,UAAU,OAAQ,OAA4B,UAAU,WAC1D,CAAC,OAA4B,OAAO,UAClC,cAAc,gCAAgC,MAAM,CACrD;;AAIL,SAAS,UAAkB;AAEzB,QAAO,KAAK,QAAQ,CAAC,SAAS,GAAG,CAAC,MAAM,GAAG,GAAG;;AAQhD,SAAS,gBAAgB,SAAsC;AAC7D,QAAO;EACL,SAAS,aAAa,wBAAwB,QAAQ,cAAc;EACpE,aAAa,aAAa,6BAA6B,QAAQ,kBAAkB;EAClF;;AAGH,SAAS,gBACP,KACA,SACA,SACA,EAAE,SAAS,WAAW,aAAa,YACV;;CACzB,MAAMC,SAAkC;EACtC;EACA,wBAAQ,IAAI,kEAAQ,aAAa,KAAI;EACrC,KAAK,YAAY,IAAI,OAAO,KAAK,SAAS;EAC1C,IAAI,IAAI,sBAAM,IAAI,kEAAQ,kBAAiB;EAC3C,SAAS,gBAAgB,IAAI,SAAS,UAAU;EACjD;AAED,KAAI,QAAQ,YACV,QAAO,OAAO,QAAQ,QAAQ,YAAY,IAAI,CAAC;AAGjD,QAAO;;;;;AAQT,SAAgB,wBACd,QACA,UAA6B,EAAE,EAC0C;CACzE,MAAM,EACJ,MACA,SACA,cACA,gBAAgB,cAChB,eAAe,SACf,gBAAgB,QAChB,aAAa,SACb,yBAAyB,QACvB;CACJ,MAAM,WAAW,gBAAgB,QAAQ;CACzC,MAAM,kBAAkB,cAAc,aAAa;AAEnD,QAAO,SAAS,sBACd,KACA,KACA,MACM;;AACN,kDAAI,KAAO,IAAI,EAAE;AACf,SAAM;AACN;;EAGF,MAAM,UAAU,mCAAmB,IAAI,qEAAU,iBAAiB,IAAI,SAAS;EAC/E,MAAM,UAAU,KAAK,KAAK;EAC1B,MAAM,aAAa,gBAAgB,KAAK,SAAS,SAAS,SAAS;AAGnE,MAAI,iBAAiB,SACnB,MACE,OAAO,SAAS,cAAc,mBAAmB;GAC/C,GAAG;GACH,GAAI,WAAW,IAAI,OAAO,EAAE,MAAM,aAAa,IAAI,MAAM,aAAa,EAAE,GAAG,EAAE;GAC9E,CAAC,CACH;EAUH,IAAI,YAAY;EAChB,MAAM,iBAAuB;AAC3B,OAAI,UAAW;AACf,eAAY;GAEZ,MAAM,WAAW,KAAK,KAAK,GAAG;GAC9B,MAAM,SAAS,IAAI,cAAc;GACjC,MAAM,QAAQ,UAAU,MAAM,aAAa;AAE3C,QACE,OAAO,SAAS,OAAO,qBAAqB;IAC1C,GAAG;IACH,YAAY;IACZ;IACD,CAAC,CACH;AAED,OAAI,WAAW,uBACb,MACE,OAAO,KAAK,yBAAyB;IACnC,GAAG;IACH,YAAY;IACZ;IACA,WAAW;IACZ,CAAC,CACH;;AAIL,mBAAI,8DAAO,UAAU,SAAS;AAG9B,oBAAI,gEAAO,SAAS,SAAS;AAE7B,QAAM;;;;;;;;;;;AAkBV,SAAgB,oBAAoB,QAAqB,UAA6B,EAAE,EAAE;CACxF,MAAM,EACJ,MACA,gBAAgB,cAChB,eAAe,SACf,gBAAgB,QAChB,aAAa,SACb,yBAAyB,QACvB;CACJ,MAAM,WAAW,gBAAgB,QAAQ;CACzC,MAAM,kBAAkB,cAAc,aAAa;CAEnD,SAAS,qBAAqB,SAA0B,OAAgB,MAAwB;AAC9F,UAAQ,QAAQ,cAAc,SAAkB,QAAiB,aAAyB;;GACxF,MAAM,MAAM;AACZ,mDAAI,KAAO,IAAI,EAAE;AACf,cAAU;AACV;;GAGF,MAAM,UAAU,oCAAmB,IAAI,uEAAU,iBAAiB,IAAI,SAAS;AAC/E,OAAI,gBAAgB,KAAK,KAAK;AAC9B,OAAI,aAAa;AAEjB,OAAI,iBAAiB,SACnB,MACE,OAAO,SACL,cACA,mBACA,gBAAgB,KAAK,SAAS,SAAS,SAAS,CACjD,CACF;AAEH,aAAU;IACV;AAEF,UAAQ,QAAQ,eAAe,SAAkB,OAAgB,aAAyB;GACxF,MAAM,MAAM;AACZ,OAAI,IAAI,kBAAkB,QAAW;AACnC,cAAU;AACV;;GAGF,MAAM,MAAM;GACZ,MAAM,WAAW,KAAK,KAAK,GAAG,IAAI;GAClC,MAAM,SAAS,IAAI,cAAc;GACjC,MAAM,UAAU,IAAI,cAAc,SAAS;GAC3C,MAAM,QAAQ,UAAU,MAAM,aAAa;GAC3C,MAAM,aAAa,gBAAgB,KAAK,SAAS,SAAS,SAAS;AAEnE,QACE,OAAO,SAAS,OAAO,qBAAqB;IAC1C,GAAG;IACH,YAAY;IACZ;IACD,CAAC,CACH;AAED,OAAI,WAAW,uBACb,MACE,OAAO,KAAK,yBAAyB;IACnC;IACA,KAAK,WAAW;IAChB,QAAQ,IAAI;IACZ;IACA,WAAW;IACZ,CAAC,CACH;AAGH,aAAU;IACV;AAEF,QAAM;;AAGR,QAAO,OAAO,OAAO,sBAAsB;GACxC,OAAO,IAAI,gBAAgB,GAAG;GAC9B,OAAO,IAAI,uBAAuB,GAAG;EACvC,CAAC;;;;;;;AAUJ,SAAS,aAAa,MAAe,WAAW,MAAe;AAC7D,KAAI,OAAO,SAAS,SAClB,QAAO,KAAK,SAAS,WAAW,KAAK,MAAM,GAAG,SAAS,GAAG,iBAAiB;AAE7E,KAAI,QAAQ,OAAO,SAAS,UAAU;AAEpC,MADY,gBAAgB,KAAK,CACzB,UAAU,SAAU,QAAO;AACnC,SAAO,WAAW,MAAM,EAAE,MAAM,UAAU,EAAE,mBAAG,IAAI,KAAK,CAAC;;AAE3D,QAAO;;AAGT,MAAM,YAAY;AAClB,MAAM,kBAAkB;AAExB,SAAS,WACP,OACA,QACA,OACA,WACS;AACT,KAAI,OAAO,UAAU,UAAU;EAC7B,MAAM,MAAM,MAAM,MAAM,GAAG,KAAK,IAAI,GAAG,OAAO,KAAK,CAAC;AACpD,SAAO,QAAQ,IAAI;AACnB,SAAO,IAAI,SAAS,MAAM,SAAS,MAAM,YAAY;;AAEvD,KAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;AAC/C,SAAO,QAAQ;AACf,SAAO;;AAET,KAAI,iBAAiB,MAAM;AACzB,SAAO,QAAQ;AACf,SAAO,OAAO,MAAM,MAAM,SAAS,CAAC,GAAG,iBAAiB,MAAM,aAAa;;AAE7E,KAAI,iBAAiB,eAAe,YAAY,OAAO,MAAM,EAAE;AAC7D,SAAO,QAAQ;AACf,SAAO,WAAW,MAAM,WAAW;;AAErC,KAAI,iBAAiB,MAAO,QAAO;AACnC,KAAI,UAAU,IAAI,MAAM,IAAI,SAAS,gBAAiB,QAAO;AAC7D,WAAU,IAAI,MAAM;AACpB,KAAI;AACF,MAAI,MAAM,QAAQ,MAAM,IAAI,iBAAiB,OAAO,iBAAiB,KAAK;GACxE,MAAMC,QAAmB,EAAE;AAC3B,QAAK,MAAM,QAAQ,iBAAiB,MAAM,MAAM,SAAS,GAAG,OAAO;AACjE,QAAI,OAAO,QAAQ,GAAG;AACpB,WAAM,KAAK,UAAU;AACrB;;AAEF,UAAM,KAAK,WAAW,MAAM,QAAQ,QAAQ,GAAG,UAAU,CAAC;;AAE5D,UAAO;;EAET,MAAM,SAAU,MAA+B;AAC/C,MAAI,OAAO,WAAW,YAAY;GAChC,MAAMC,OAAgB,OAAO,KAAK,MAAM;AACxC,OAAI,SAAS,MAAO,QAAO,WAAW,MAAM,QAAQ,QAAQ,GAAG,UAAU;;EAE3E,MAAMC,SAAkC,EAAE;AAC1C,OAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,MAAM,EAAE;AAC1C,OAAI,MAAM,eAAe,MAAM,iBAAiB,MAAM,YAAa;AACnE,OAAI,OAAO,QAAQ,GAAG;AACpB,WAAO,OAAO;AACd;;AAEF,UAAO,QAAQ,EAAE;AACjB,UAAO,KAAK,WAAW,GAAG,QAAQ,QAAQ,GAAG,UAAU;;AAEzD,SAAO;SACD;AACN,SAAO;WACC;AACR,YAAU,OAAO,MAAM"}
+{"version":3,"file":"middleware.mjs","names":[],"sources":["../src/middleware/http-logger.ts"],"sourcesContent":["/**\n * HTTP request/response logging middleware — Morgan replacement.\n *\n * Fixes every documented Morgan bug:\n *  - statusCode always captured correctly, even for requests > 20 s\n *  - Logs request START (with traceId) and response FINISH (with duration)\n *  - Captures errors before and after response\n *  - Auto-redacts Authorization / Cookie / Set-Cookie headers\n *  - Slow-request warnings\n *  - Skip predicates for health-check routes / static assets\n *\n * @example Express\n * ```ts\n * import { createExpressMiddleware } from 'logixia/middleware';\n * app.use(createExpressMiddleware(logger));\n * ```\n *\n * @example Fastify\n * ```ts\n * import { createFastifyPlugin } from 'logixia/middleware';\n * await fastify.register(createFastifyPlugin(logger));\n * ```\n */\n\nimport type { IBaseLogger } from '../types';\nimport { internalError } from '../utils/internal-log';\nimport { resolveRequestTraceId, resolveTraceHeaders } from '../utils/request-trace';\nimport { stringifyForLog } from '../utils/safe-stringify';\nimport { DEFAULT_REDACT_HEADERS, DEFAULT_REDACT_QUERY_PARAMS } from '../utils/sensitive-names';\n\n// ── Shared types ─────────────────────────────────────────────────────────────\n\nexport interface HttpLoggerOptions {\n  /**\n   * Skip logging for a request. Called before any I/O.\n   * @example `skip: (req) => req.url === '/health'`\n   */\n  skip?: (req: IncomingRequest) => boolean;\n  /**\n   * Log request body (POST/PUT/PATCH). Capped at `bodyMaxBytes` (default: 4096).\n   * Redaction still applies to the captured body.\n   * Default: false.\n   */\n  logBody?: boolean;\n  /** Max bytes of body to capture. Default: 4096. */\n  bodyMaxBytes?: number;\n  /**\n   * Emit a WARN log when a request duration exceeds this threshold (ms).\n   * Default: 1000.\n   */\n  slowRequestThresholdMs?: number;\n  /**\n   * Additional fields to include in every log entry.\n   * @example `extraFields: (req) => ({ tenantId: req.headers['x-tenant-id'] })`\n   */\n  extraFields?: (req: IncomingRequest) => Record<string, unknown>;\n  /**\n   * Header name, or list of names tried in order, to read the trace ID from.\n   * Default: the library-wide list (`DEFAULT_TRACE_HEADERS`: traceparent,\n   * x-trace-id, x-request-id, x-correlation-id, trace-id).\n   * If none is present, `request.id` is used when it is not a framework counter,\n   * otherwise a UUID is generated and shared with the logixia context helpers.\n   */\n  traceIdHeader?: string | readonly string[];\n  /**\n   * Additional headers to redact from logged output. Merged with the defaults\n   * (authorization, cookie, set-cookie, x-api-key, proxy-authorization,\n   * x-auth-token, x-access-token, x-csrf-token, x-amz-security-token).\n   */\n  redactHeaders?: string[];\n  /**\n   * Additional query-string parameter names whose values are redacted from the\n   * logged URL. Merged with the defaults (token, access_token, refresh_token,\n   * code, password, secret, api_key, apikey, key, signature, sig, auth).\n   */\n  redactQueryParams?: string[];\n  /**\n   * Log level for request-start entries. Default: 'debug'.\n   * Set to 'silent' to suppress request-start logs entirely.\n   */\n  requestLevel?: string;\n  /** Log level for successful response entries. Default: 'info'. */\n  responseLevel?: string;\n  /** Log level for error responses (status ≥ 500). Default: 'error'. */\n  errorLevel?: string;\n}\n\n// Minimal structural types so we don't need @types/express / fastify in core\nexport interface IncomingRequest {\n  method?: string;\n  url?: string;\n  headers?: Record<string, string | string[] | undefined>;\n  body?: unknown;\n  socket?: { remoteAddress?: string };\n  ip?: string;\n}\n\nexport interface OutgoingResponse {\n  statusCode?: number;\n  on?: (event: string, cb: () => void) => void;\n  once?: (event: string, cb: () => void) => void;\n  getHeader?: (name: string) => string | number | string[] | undefined;\n}\n\n// ── Helpers ───────────────────────────────────────────────────────────────────\n\nfunction buildNameSet(defaults: readonly string[], extra: readonly string[] | undefined) {\n  return new Set([...defaults, ...(extra ?? [])].map((n) => n.toLowerCase()));\n}\n\nfunction safeDecode(value: string): string {\n  try {\n    return decodeURIComponent(value.replace(/\\+/g, ' '));\n  } catch {\n    return value;\n  }\n}\n\n/** Replace the values of sensitive query parameters, leaving the rest verbatim. */\nfunction sanitizeUrl(url: string, redactParams: Set<string>): string {\n  const q = url.indexOf('?');\n  if (q === -1) return url;\n  const hashAt = url.indexOf('#', q);\n  const query = url.slice(q + 1, hashAt === -1 ? undefined : hashAt);\n  const hash = hashAt === -1 ? '' : url.slice(hashAt);\n  const cleaned = query\n    .split('&')\n    .map((pair) => {\n      const eq = pair.indexOf('=');\n      const rawKey = eq === -1 ? pair : pair.slice(0, eq);\n      const decoded = safeDecode(rawKey);\n      const bracket = decoded.indexOf('[');\n      const name = (bracket === -1 ? decoded : decoded.slice(0, bracket)).toLowerCase();\n      return redactParams.has(name) && eq !== -1 ? `${rawKey}=[REDACTED]` : pair;\n    })\n    .join('&');\n  return `${url.slice(0, q)}?${cleaned}${hash}`;\n}\n\nfunction sanitizeHeaders(\n  headers: Record<string, string | string[] | undefined> | undefined,\n  redactSet: Set<string>\n): Record<string, unknown> {\n  if (!headers) return {};\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(headers)) {\n    if (k === '__proto__' || k === 'constructor' || k === 'prototype') continue;\n    out[k] = redactSet.has(k.toLowerCase()) ? '[REDACTED]' : v;\n  }\n  return out;\n}\n\n/** Fire-and-forget a logger call; a failing log must never become an unhandled rejection. */\nfunction fire(result: unknown): void {\n  if (result && typeof (result as Promise<unknown>).catch === 'function') {\n    (result as Promise<unknown>).catch((error: unknown) =>\n      internalError('http-logger: log call failed', error)\n    );\n  }\n}\n\ninterface NameSets {\n  headers: Set<string>;\n  queryParams: Set<string>;\n}\n\nfunction resolveNameSets(options: HttpLoggerOptions): NameSets {\n  return {\n    headers: buildNameSet(DEFAULT_REDACT_HEADERS, options.redactHeaders),\n    queryParams: buildNameSet(DEFAULT_REDACT_QUERY_PARAMS, options.redactQueryParams),\n  };\n}\n\nfunction buildBaseFields(\n  req: IncomingRequest,\n  traceId: string,\n  options: HttpLoggerOptions,\n  { headers: redactSet, queryParams: paramSet }: NameSets\n): Record<string, unknown> {\n  const fields: Record<string, unknown> = {\n    traceId,\n    method: req.method?.toUpperCase() ?? 'UNKNOWN',\n    url: sanitizeUrl(req.url ?? '/', paramSet),\n    ip: req.ip ?? req.socket?.remoteAddress ?? 'unknown',\n    headers: sanitizeHeaders(req.headers, redactSet),\n  };\n\n  if (options.extraFields) {\n    Object.assign(fields, options.extraFields(req));\n  }\n\n  return fields;\n}\n\n// ── Express middleware ────────────────────────────────────────────────────────\n\n/**\n * Create an Express / Connect compatible middleware that replaces Morgan.\n */\nexport function createExpressMiddleware(\n  logger: IBaseLogger,\n  options: HttpLoggerOptions = {}\n): (req: IncomingRequest, res: OutgoingResponse, next: () => void) => void {\n  const {\n    skip,\n    logBody,\n    bodyMaxBytes,\n    traceIdHeader,\n    requestLevel = 'debug',\n    responseLevel = 'info',\n    errorLevel = 'error',\n    slowRequestThresholdMs = 1000,\n  } = options;\n  const nameSets = resolveNameSets(options);\n  const traceHeaders = resolveTraceHeaders(traceIdHeader);\n\n  return function logixiaHttpMiddleware(\n    req: IncomingRequest,\n    res: OutgoingResponse,\n    next: () => void\n  ): void {\n    if (skip?.(req)) {\n      next();\n      return;\n    }\n\n    const traceId = resolveRequestTraceId(req, traceHeaders);\n    const startMs = Date.now();\n    const baseFields = buildBaseFields(req, traceId, options, nameSets);\n\n    // Log request start\n    if (requestLevel !== 'silent') {\n      fire(\n        logger.logLevel(requestLevel, 'request started', {\n          ...baseFields,\n          ...(logBody && req.body ? { body: truncateBody(req.body, bodyMaxBytes) } : {}),\n        })\n      );\n    }\n\n    // Hook into the response 'finish' event — fires after headers + body are sent.\n    // This is what Morgan gets wrong for slow requests (it uses 'close' which may\n    // fire before the status code is set on some Node versions).\n    //\n    // BOTH 'finish' and 'close' fire on a normal response, so guard against\n    // logging the completion twice (which would duplicate the completed entry and\n    // the slow-request warning).\n    let completed = false;\n    const onFinish = (): void => {\n      if (completed) return;\n      completed = true;\n\n      const duration = Date.now() - startMs;\n      const status = res.statusCode ?? 0;\n      const level = status >= 500 ? errorLevel : responseLevel;\n\n      fire(\n        logger.logLevel(level, 'request completed', {\n          ...baseFields,\n          statusCode: status,\n          duration,\n        })\n      );\n\n      if (duration > slowRequestThresholdMs) {\n        fire(\n          logger.warn('slow request detected', {\n            ...baseFields,\n            statusCode: status,\n            duration,\n            threshold: slowRequestThresholdMs,\n          })\n        );\n      }\n    };\n\n    res.once?.('finish', onFinish);\n    // Fallback: also covers a client that disconnects before 'finish' fires. The\n    // `completed` guard ensures a normal finish+close pair logs only once.\n    res.once?.('close', onFinish);\n\n    next();\n  };\n}\n\n// ── Fastify plugin ─────────────────────────────────────────────────────────────\n\nexport interface FastifyInstance {\n  addHook: (name: string, fn: (req: unknown, reply: unknown, done: () => void) => void) => void;\n}\n\n/**\n * Create a Fastify plugin (a function you pass to `fastify.register()`).\n *\n * @example\n * ```ts\n * await fastify.register(createFastifyPlugin(logger, { slowRequestThresholdMs: 500 }));\n * ```\n */\nexport function createFastifyPlugin(logger: IBaseLogger, options: HttpLoggerOptions = {}) {\n  const {\n    skip,\n    traceIdHeader,\n    requestLevel = 'debug',\n    responseLevel = 'info',\n    errorLevel = 'error',\n    slowRequestThresholdMs = 1000,\n  } = options;\n  const nameSets = resolveNameSets(options);\n  const traceHeaders = resolveTraceHeaders(traceIdHeader);\n\n  function logixiaFastifyPlugin(fastify: FastifyInstance, _opts: unknown, done: () => void): void {\n    fastify.addHook('onRequest', (request: unknown, _reply: unknown, hookDone: () => void) => {\n      const req = request as IncomingRequest & { _logixiaStart?: number };\n      if (skip?.(req)) {\n        hookDone();\n        return;\n      }\n\n      const traceId = resolveRequestTraceId(req, traceHeaders);\n      req._logixiaStart = Date.now();\n\n      if (requestLevel !== 'silent') {\n        fire(\n          logger.logLevel(\n            requestLevel,\n            'request started',\n            buildBaseFields(req, traceId, options, nameSets)\n          )\n        );\n      }\n      hookDone();\n    });\n\n    fastify.addHook('onResponse', (request: unknown, reply: unknown, hookDone: () => void) => {\n      const req = request as IncomingRequest & { _logixiaStart?: number };\n      if (req._logixiaStart === undefined) {\n        hookDone();\n        return;\n      }\n\n      const rep = reply as { statusCode?: number };\n      const duration = Date.now() - req._logixiaStart;\n      const status = rep.statusCode ?? 0;\n      const traceId = resolveRequestTraceId(req, traceHeaders);\n      const level = status >= 500 ? errorLevel : responseLevel;\n      const baseFields = buildBaseFields(req, traceId, options, nameSets);\n\n      fire(\n        logger.logLevel(level, 'request completed', {\n          ...baseFields,\n          statusCode: status,\n          duration,\n        })\n      );\n\n      if (duration > slowRequestThresholdMs) {\n        fire(\n          logger.warn('slow request detected', {\n            traceId,\n            url: baseFields.url,\n            method: req.method,\n            duration,\n            threshold: slowRequestThresholdMs,\n          })\n        );\n      }\n\n      hookDone();\n    });\n\n    done();\n  }\n\n  return Object.assign(logixiaFastifyPlugin, {\n    [Symbol.for('skip-override')]: true,\n    [Symbol.for('fastify.display-name')]: 'logixia',\n  });\n}\n\n// ── Internal helpers ──────────────────────────────────────────────────────────\n\n/**\n * Bound the captured body without turning it into a string, so the logger's\n * path-based redaction still sees the original keys. Oversized structures are\n * pruned (extra keys/items dropped, long strings cut) rather than serialized.\n */\nfunction truncateBody(body: unknown, maxBytes = 4096): unknown {\n  if (typeof body === 'string') {\n    return body.length > maxBytes ? body.slice(0, maxBytes) + '…[truncated]' : body;\n  }\n  if (body && typeof body === 'object') {\n    const str = stringifyForLog(body);\n    if (str.length <= maxBytes) return body;\n    return pruneValue(body, { left: maxBytes }, 0, new Set());\n  }\n  return body;\n}\n\nconst TRUNCATED = '…[truncated]';\nconst MAX_PRUNE_DEPTH = 8;\n\nfunction pruneValue(\n  value: unknown,\n  budget: { left: number },\n  depth: number,\n  ancestors: Set<object>\n): unknown {\n  if (typeof value === 'string') {\n    const cut = value.slice(0, Math.max(0, budget.left));\n    budget.left -= cut.length;\n    return cut.length < value.length ? cut + TRUNCATED : cut;\n  }\n  if (value === null || typeof value !== 'object') {\n    budget.left -= 8;\n    return value;\n  }\n  if (value instanceof Date) {\n    budget.left -= 24;\n    return Number.isNaN(value.getTime()) ? 'Invalid Date' : value.toISOString();\n  }\n  if (value instanceof ArrayBuffer || ArrayBuffer.isView(value)) {\n    budget.left -= 16;\n    return `[Buffer ${value.byteLength} bytes]`;\n  }\n  if (value instanceof Error) return value;\n  if (ancestors.has(value) || depth >= MAX_PRUNE_DEPTH) return TRUNCATED;\n  ancestors.add(value);\n  try {\n    if (Array.isArray(value) || value instanceof Set || value instanceof Map) {\n      const items: unknown[] = [];\n      for (const item of value instanceof Map ? value.entries() : value) {\n        if (budget.left <= 0) {\n          items.push(TRUNCATED);\n          break;\n        }\n        items.push(pruneValue(item, budget, depth + 1, ancestors));\n      }\n      return items;\n    }\n    const toJSON = (value as { toJSON?: unknown }).toJSON;\n    if (typeof toJSON === 'function') {\n      const json: unknown = toJSON.call(value);\n      if (json !== value) return pruneValue(json, budget, depth + 1, ancestors);\n    }\n    const record: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(value)) {\n      if (k === '__proto__' || k === 'constructor' || k === 'prototype') continue;\n      if (budget.left <= 0) {\n        record['…'] = TRUNCATED;\n        break;\n      }\n      budget.left -= k.length;\n      record[k] = pruneValue(v, budget, depth + 1, ancestors);\n    }\n    return record;\n  } catch {\n    return TRUNCATED;\n  } finally {\n    ancestors.delete(value);\n  }\n}\n"],"mappings":";;;;AA0GA,SAAS,aAAa,UAA6B,OAAsC;CACvF,OAAO,IAAI,IAAI,CAAC,GAAG,UAAU,GAAI,SAAS,CAAC,CAAE,CAAC,CAAC,KAAK,MAAM,EAAE,YAAY,CAAC,CAAC;AAC5E;AAEA,SAAS,WAAW,OAAuB;CACzC,IAAI;EACF,OAAO,mBAAmB,MAAM,QAAQ,OAAO,GAAG,CAAC;CACrD,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAS,YAAY,KAAa,cAAmC;CACnE,MAAM,IAAI,IAAI,QAAQ,GAAG;CACzB,IAAI,MAAM,IAAI,OAAO;CACrB,MAAM,SAAS,IAAI,QAAQ,KAAK,CAAC;CACjC,MAAM,QAAQ,IAAI,MAAM,IAAI,GAAG,WAAW,KAAK,KAAA,IAAY,MAAM;CACjE,MAAM,OAAO,WAAW,KAAK,KAAK,IAAI,MAAM,MAAM;CAClD,MAAM,UAAU,MACb,MAAM,GAAG,CAAC,CACV,KAAK,SAAS;EACb,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,MAAM,SAAS,OAAO,KAAK,OAAO,KAAK,MAAM,GAAG,EAAE;EAClD,MAAM,UAAU,WAAW,MAAM;EACjC,MAAM,UAAU,QAAQ,QAAQ,GAAG;EACnC,MAAM,QAAQ,YAAY,KAAK,UAAU,QAAQ,MAAM,GAAG,OAAO,EAAA,CAAG,YAAY;EAChF,OAAO,aAAa,IAAI,IAAI,KAAK,OAAO,KAAK,GAAG,OAAO,eAAe;CACxE,CAAC,CAAC,CACD,KAAK,GAAG;CACX,OAAO,GAAG,IAAI,MAAM,GAAG,CAAC,EAAE,GAAG,UAAU;AACzC;AAEA,SAAS,gBACP,SACA,WACyB;CACzB,IAAI,CAAC,SAAS,OAAO,CAAC;CACtB,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,GAAG;EAC5C,IAAI,MAAM,eAAe,MAAM,iBAAiB,MAAM,aAAa;EACnE,IAAI,KAAK,UAAU,IAAI,EAAE,YAAY,CAAC,IAAI,eAAe;CAC3D;CACA,OAAO;AACT;;AAGA,SAAS,KAAK,QAAuB;CACnC,IAAI,UAAU,OAAQ,OAA4B,UAAU,YAC1D,OAA6B,OAAO,UAClC,cAAc,gCAAgC,KAAK,CACrD;AAEJ;AAOA,SAAS,gBAAgB,SAAsC;CAC7D,OAAO;EACL,SAAS,aAAa,wBAAwB,QAAQ,aAAa;EACnE,aAAa,aAAa,6BAA6B,QAAQ,iBAAiB;CAClF;AACF;AAEA,SAAS,gBACP,KACA,SACA,SACA,EAAE,SAAS,WAAW,aAAa,YACV;;CACzB,MAAM,SAAkC;EACtC;EACA,UAAA,cAAQ,IAAI,YAAA,QAAA,gBAAA,KAAA,IAAA,KAAA,IAAA,YAAQ,YAAY,MAAK;EACrC,KAAK,YAAY,IAAI,OAAO,KAAK,QAAQ;EACzC,IAAI,IAAI,QAAA,cAAM,IAAI,YAAA,QAAA,gBAAA,KAAA,IAAA,KAAA,IAAA,YAAQ,kBAAiB;EAC3C,SAAS,gBAAgB,IAAI,SAAS,SAAS;CACjD;CAEA,IAAI,QAAQ,aACV,OAAO,OAAO,QAAQ,QAAQ,YAAY,GAAG,CAAC;CAGhD,OAAO;AACT;;;;AAOA,SAAgB,wBACd,QACA,UAA6B,CAAC,GAC2C;CACzE,MAAM,EACJ,MACA,SACA,cACA,eACA,eAAe,SACf,gBAAgB,QAChB,aAAa,SACb,yBAAyB,QACvB;CACJ,MAAM,WAAW,gBAAgB,OAAO;CACxC,MAAM,eAAe,oBAAoB,aAAa;CAEtD,OAAO,SAAS,sBACd,KACA,KACA,MACM;;EACN,IAAA,SAAA,QAAA,SAAA,KAAA,IAAA,KAAA,IAAI,KAAO,GAAG,GAAG;GACf,KAAK;GACL;EACF;EAEA,MAAM,UAAU,sBAAsB,KAAK,YAAY;EACvD,MAAM,UAAU,KAAK,IAAI;EACzB,MAAM,aAAa,gBAAgB,KAAK,SAAS,SAAS,QAAQ;EAGlE,IAAI,iBAAiB,UACnB,KACE,OAAO,SAAS,cAAc,mBAAmB;GAC/C,GAAG;GACH,GAAI,WAAW,IAAI,OAAO,EAAE,MAAM,aAAa,IAAI,MAAM,YAAY,EAAE,IAAI,CAAC;EAC9E,CAAC,CACH;EAUF,IAAI,YAAY;EAChB,MAAM,iBAAuB;GAC3B,IAAI,WAAW;GACf,YAAY;GAEZ,MAAM,WAAW,KAAK,IAAI,IAAI;GAC9B,MAAM,SAAS,IAAI,cAAc;GACjC,MAAM,QAAQ,UAAU,MAAM,aAAa;GAE3C,KACE,OAAO,SAAS,OAAO,qBAAqB;IAC1C,GAAG;IACH,YAAY;IACZ;GACF,CAAC,CACH;GAEA,IAAI,WAAW,wBACb,KACE,OAAO,KAAK,yBAAyB;IACnC,GAAG;IACH,YAAY;IACZ;IACA,WAAW;GACb,CAAC,CACH;EAEJ;EAEA,CAAA,YAAA,IAAI,UAAA,QAAA,cAAA,KAAA,KAAA,UAAA,KAAA,KAAO,UAAU,QAAQ;EAG7B,CAAA,aAAA,IAAI,UAAA,QAAA,eAAA,KAAA,KAAA,WAAA,KAAA,KAAO,SAAS,QAAQ;EAE5B,KAAK;CACP;AACF;;;;;;;;;AAgBA,SAAgB,oBAAoB,QAAqB,UAA6B,CAAC,GAAG;CACxF,MAAM,EACJ,MACA,eACA,eAAe,SACf,gBAAgB,QAChB,aAAa,SACb,yBAAyB,QACvB;CACJ,MAAM,WAAW,gBAAgB,OAAO;CACxC,MAAM,eAAe,oBAAoB,aAAa;CAEtD,SAAS,qBAAqB,SAA0B,OAAgB,MAAwB;EAC9F,QAAQ,QAAQ,cAAc,SAAkB,QAAiB,aAAyB;GACxF,MAAM,MAAM;GACZ,IAAA,SAAA,QAAA,SAAA,KAAA,IAAA,KAAA,IAAI,KAAO,GAAG,GAAG;IACf,SAAS;IACT;GACF;GAEA,MAAM,UAAU,sBAAsB,KAAK,YAAY;GACvD,IAAI,gBAAgB,KAAK,IAAI;GAE7B,IAAI,iBAAiB,UACnB,KACE,OAAO,SACL,cACA,mBACA,gBAAgB,KAAK,SAAS,SAAS,QAAQ,CACjD,CACF;GAEF,SAAS;EACX,CAAC;EAED,QAAQ,QAAQ,eAAe,SAAkB,OAAgB,aAAyB;GACxF,MAAM,MAAM;GACZ,IAAI,IAAI,kBAAkB,KAAA,GAAW;IACnC,SAAS;IACT;GACF;GAEA,MAAM,MAAM;GACZ,MAAM,WAAW,KAAK,IAAI,IAAI,IAAI;GAClC,MAAM,SAAS,IAAI,cAAc;GACjC,MAAM,UAAU,sBAAsB,KAAK,YAAY;GACvD,MAAM,QAAQ,UAAU,MAAM,aAAa;GAC3C,MAAM,aAAa,gBAAgB,KAAK,SAAS,SAAS,QAAQ;GAElE,KACE,OAAO,SAAS,OAAO,qBAAqB;IAC1C,GAAG;IACH,YAAY;IACZ;GACF,CAAC,CACH;GAEA,IAAI,WAAW,wBACb,KACE,OAAO,KAAK,yBAAyB;IACnC;IACA,KAAK,WAAW;IAChB,QAAQ,IAAI;IACZ;IACA,WAAW;GACb,CAAC,CACH;GAGF,SAAS;EACX,CAAC;EAED,KAAK;CACP;CAEA,OAAO,OAAO,OAAO,sBAAsB;GACxC,OAAO,IAAI,eAAe,IAAI;GAC9B,OAAO,IAAI,sBAAsB,IAAI;CACxC,CAAC;AACH;;;;;;AASA,SAAS,aAAa,MAAe,WAAW,MAAe;CAC7D,IAAI,OAAO,SAAS,UAClB,OAAO,KAAK,SAAS,WAAW,KAAK,MAAM,GAAG,QAAQ,IAAI,iBAAiB;CAE7E,IAAI,QAAQ,OAAO,SAAS,UAAU;EAEpC,IADY,gBAAgB,IACtB,CAAC,CAAC,UAAU,UAAU,OAAO;EACnC,OAAO,WAAW,MAAM,EAAE,MAAM,SAAS,GAAG,mBAAG,IAAI,IAAI,CAAC;CAC1D;CACA,OAAO;AACT;AAEA,MAAM,YAAY;AAClB,MAAM,kBAAkB;AAExB,SAAS,WACP,OACA,QACA,OACA,WACS;CACT,IAAI,OAAO,UAAU,UAAU;EAC7B,MAAM,MAAM,MAAM,MAAM,GAAG,KAAK,IAAI,GAAG,OAAO,IAAI,CAAC;EACnD,OAAO,QAAQ,IAAI;EACnB,OAAO,IAAI,SAAS,MAAM,SAAS,MAAM,YAAY;CACvD;CACA,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;EAC/C,OAAO,QAAQ;EACf,OAAO;CACT;CACA,IAAI,iBAAiB,MAAM;EACzB,OAAO,QAAQ;EACf,OAAO,OAAO,MAAM,MAAM,QAAQ,CAAC,IAAI,iBAAiB,MAAM,YAAY;CAC5E;CACA,IAAI,iBAAiB,eAAe,YAAY,OAAO,KAAK,GAAG;EAC7D,OAAO,QAAQ;EACf,OAAO,WAAW,MAAM,WAAW;CACrC;CACA,IAAI,iBAAiB,OAAO,OAAO;CACnC,IAAI,UAAU,IAAI,KAAK,KAAK,SAAS,iBAAiB,OAAO;CAC7D,UAAU,IAAI,KAAK;CACnB,IAAI;EACF,IAAI,MAAM,QAAQ,KAAK,KAAK,iBAAiB,OAAO,iBAAiB,KAAK;GACxE,MAAM,QAAmB,CAAC;GAC1B,KAAK,MAAM,QAAQ,iBAAiB,MAAM,MAAM,QAAQ,IAAI,OAAO;IACjE,IAAI,OAAO,QAAQ,GAAG;KACpB,MAAM,KAAK,SAAS;KACpB;IACF;IACA,MAAM,KAAK,WAAW,MAAM,QAAQ,QAAQ,GAAG,SAAS,CAAC;GAC3D;GACA,OAAO;EACT;EACA,MAAM,SAAU,MAA+B;EAC/C,IAAI,OAAO,WAAW,YAAY;GAChC,MAAM,OAAgB,OAAO,KAAK,KAAK;GACvC,IAAI,SAAS,OAAO,OAAO,WAAW,MAAM,QAAQ,QAAQ,GAAG,SAAS;EAC1E;EACA,MAAM,SAAkC,CAAC;EACzC,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,KAAK,GAAG;GAC1C,IAAI,MAAM,eAAe,MAAM,iBAAiB,MAAM,aAAa;GACnE,IAAI,OAAO,QAAQ,GAAG;IACpB,OAAO,OAAO;IACd;GACF;GACA,OAAO,QAAQ,EAAE;GACjB,OAAO,KAAK,WAAW,GAAG,QAAQ,QAAQ,GAAG,SAAS;EACxD;EACA,OAAO;CACT,QAAQ;EACN,OAAO;CACT,UAAU;EACR,UAAU,OAAO,KAAK;CACxB;AACF"}