logixia 2.0.0 → 2.0.6

package/dist/worker-entry.js

@@ -1,4 +1,4 @@
-//#region rolldown:runtime
+// \0rolldown/runtime.js
 var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
@@ -15,26 +15,19 @@ var __copyProps = (to, from, except, desc) => {
 	}
 	return to;
 };
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", {
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(isNodeMode || !mod || !mod.__esModule || !__hasOwnProp.call(mod, "default") ? __defProp(target, "default", {
 	value: mod,
 	enumerable: true
 }) : target, mod));
-
-//#endregion
 let node_worker_threads = require("node:worker_threads");
-node_worker_threads = __toESM(node_worker_threads);
 let node_fs = require("node:fs");
 node_fs = __toESM(node_fs);
 let node_path = require("node:path");
 node_path = __toESM(node_path);
 let node_stream_promises = require("node:stream/promises");
-node_stream_promises = __toESM(node_stream_promises);
 let node_util = require("node:util");
-node_util = __toESM(node_util);
 let node_zlib = require("node:zlib");
-node_zlib = __toESM(node_zlib);
-
-//#region src/utils/coerce.utils.ts
+// src/utils/coerce.utils.ts
 /**
 * Defensive value coercion helpers for Logixia.
 *
@@ -68,9 +61,55 @@ function safeToString(value) {
 	} catch {}
 	return `[${((_constructor = value.constructor) === null || _constructor === void 0 ? void 0 : _constructor.name) ?? "object"}]`;
 }
-
-//#endregion
-//#region src/utils/safe-stringify.ts
+// src/utils/own-property.ts
+/**
+* True for the one key that must never be assigned with `target[key] = value`.
+*
+* Assigning `constructor` or `prototype` on a fresh plain object only creates an
+* own property, which is harmless. Only `__proto__` invokes the prototype setter.
+*/
+function isProtoKey(key) {
+	return key === "__proto__";
+}
+/**
+* Copy `value` onto `target[key]` as an own, enumerable data property.
+*
+* Normal keys use a plain assignment, which is the fast path. `__proto__` goes
+* through `Object.defineProperty` so that a key taken from logged or parsed data
+* becomes an own property instead of replacing the object's prototype.
+*/
+function assignOwn(target, key, value) {
+	if (key === "__proto__") Object.defineProperty(target, key, {
+		value,
+		enumerable: true,
+		writable: true,
+		configurable: true
+	});
+	else target[key] = value;
+}
+// src/utils/safe-stringify.ts
+/**
+* logixia — robust JSON serialization for log payloads.
+*
+* Modern Winston/Pino already neutralize circular refs to `[Circular]` (via
+* safe-stable-stringify / fast-safe-stringify), so merely "surviving cycles" is
+* not a differentiator. This goes one notch further:
+*
+*  - **BigInt** → serialized (as a string by default; JSON.stringify throws on
+*    BigInt, which silently breaks logging of e.g. DB bigint ids).
+*  - **Deterministic key order** (optional) so identical objects hash/diff equal.
+*  - **True decycle** (optional) — replace repeated references with JSONPath
+*    `$ref` pointers that round-trip back to the original object graph, instead
+*    of the lossy `[Circular]` tag. Useful when you need to reconstruct shared
+*    structure downstream.
+*
+* @example
+* ```ts
+* safeStringify({ id: 10n, self: obj });          // → BigInt + cycle safe
+* safeStringify(graph, { decycle: true });         // → round-trippable $ref pointers
+* const back = retrocycle(JSON.parse(json));       // → reconstruct shared refs
+* ```
+*/
 /** Build a JSONPath like `$["a"][0]["b"]` for a decycle pointer. */
 function jsonPath(parts) {
 	let path = "$";
@@ -100,10 +139,7 @@ function safeStringify(value, options = {}) {
 			const rec = val;
 			const keys = deterministic ? Object.keys(rec).sort() : Object.keys(rec);
 			const obj = {};
-			for (const k of keys) {
-				if (k === "__proto__" || k === "constructor" || k === "prototype") continue;
-				obj[k] = transform(rec[k]);
-			}
+			for (const k of keys) assignOwn(obj, k, transform(rec[k]));
 			out = obj;
 		}
 		seen.delete(val);
@@ -128,10 +164,7 @@ function decycleValue(value, bigint = "string") {
 		if (Array.isArray(val)) return val.map((item, i) => walk(item, [...path, i]));
 		const rec = val;
 		const obj = {};
-		for (const k of Object.keys(rec)) {
-			if (k === "__proto__" || k === "constructor" || k === "prototype") continue;
-			obj[k] = walk(rec[k], [...path, k]);
-		}
+		for (const k of Object.keys(rec)) assignOwn(obj, k, walk(rec[k], [...path, k]));
 		return obj;
 	};
 	return walk(value, []);
@@ -154,9 +187,7 @@ function stringifyForLog(value) {
 		}
 	}
 }
-
-//#endregion
-//#region src/utils/sanitize.utils.ts
+// src/utils/sanitize.utils.ts
 /**
 * Control-character stripping for text-mode log output.
 *
@@ -172,11 +203,8 @@ const VISIBLE_ESCAPES = {
 function stripControlChars(value) {
 	return value.replace(CONTROL_CHARS_RE, (ch) => VISIBLE_ESCAPES[ch] ?? "");
 }
-
-//#endregion
-//#region src/transports/entry-fields.ts
+// src/transports/entry-fields.ts
 const PAYLOAD_PREFIX = "data_";
-const UNSAFE_KEYS = new Set(["__proto__"]);
 /**
 * Copies `core` and then the user payload into one object. The core fields stay
 * authoritative: a payload key that matches a core key (even one whose value is
@@ -184,14 +212,19 @@ const UNSAFE_KEYS = new Set(["__proto__"]);
 * prefix is repeated until the name is free of core keys and of every other
 * payload key, so the result does not depend on key order and a payload's own
 * `data_level` stays where it is.
+*
+* Exception: a payload `traceId` equal to the core `traceId` is a duplicate (the
+* context middleware copies the trace id into the payload) and is dropped rather
+* than emitted again as `data_traceId`. A different value is still kept.
 */
 function mergeCoreFields(core, data, extraReserved = []) {
 	const merged = { ...core };
 	if (!data) return merged;
-	const reserved = new Set([...Object.keys(core), ...extraReserved]);
+	const reserved = /* @__PURE__ */ new Set([...Object.keys(core), ...extraReserved]);
 	const payloadKeys = new Set(Object.keys(data));
 	for (const key of payloadKeys) {
-		if (UNSAFE_KEYS.has(key)) continue;
+		if (isProtoKey(key)) continue;
+		if (key === "traceId" && core["traceId"] !== void 0 && data[key] === core["traceId"]) continue;
 		let target = key;
 		if (reserved.has(target)) do
 			target = `${PAYLOAD_PREFIX}${target}`;
@@ -200,9 +233,7 @@ function mergeCoreFields(core, data, extraReserved = []) {
 	}
 	return merged;
 }
-
-//#endregion
-//#region src/transports/console.transport.ts
+// src/transports/console.transport.ts
 /**
 * Writes log entries to stdout (info/debug/verbose) and stderr (error/warn).
 *
@@ -212,32 +243,13 @@ function mergeCoreFields(core, data, extraReserved = []) {
 * transports: { console: { format: 'json' } }
 */
 var ConsoleTransport = class ConsoleTransport {
-	static #_ = this.COLORS = new Map([
-		["black", "\x1B[30m"],
-		["red", "\x1B[31m"],
-		["green", "\x1B[32m"],
-		["yellow", "\x1B[33m"],
-		["blue", "\x1B[34m"],
-		["magenta", "\x1B[35m"],
-		["cyan", "\x1B[36m"],
-		["white", "\x1B[37m"],
-		["gray", "\x1B[90m"],
-		["grey", "\x1B[90m"],
-		["brightred", "\x1B[91m"],
-		["brightgreen", "\x1B[92m"],
-		["brightyellow", "\x1B[93m"],
-		["brightblue", "\x1B[94m"],
-		["brightmagenta", "\x1B[95m"],
-		["brightcyan", "\x1B[96m"],
-		["brightwhite", "\x1B[97m"],
-		["reset", "\x1B[0m"]
-	]);
 	static sanitize(value) {
 		return stripControlChars(safeToString(value));
 	}
 	constructor(config = {}) {
 		this.config = config;
 		this.name = "console";
+		this.level = config.level;
 		if (config.filter) this.filter = config.filter;
 	}
 	write(entry) {
@@ -300,10 +312,28 @@ var ConsoleTransport = class ConsoleTransport {
 	close() {
 		return Promise.resolve();
 	}
+	static #_ = () => this.COLORS = /* @__PURE__ */ new Map([
+		["black", "\x1B[30m"],
+		["red", "\x1B[31m"],
+		["green", "\x1B[32m"],
+		["yellow", "\x1B[33m"],
+		["blue", "\x1B[34m"],
+		["magenta", "\x1B[35m"],
+		["cyan", "\x1B[36m"],
+		["white", "\x1B[37m"],
+		["gray", "\x1B[90m"],
+		["grey", "\x1B[90m"],
+		["brightred", "\x1B[91m"],
+		["brightgreen", "\x1B[92m"],
+		["brightyellow", "\x1B[93m"],
+		["brightblue", "\x1B[94m"],
+		["brightmagenta", "\x1B[95m"],
+		["brightcyan", "\x1B[96m"],
+		["brightwhite", "\x1B[97m"],
+		["reset", "\x1B[0m"]
+	]);
 };
-
-//#endregion
-//#region src/utils/internal-log.ts
+// src/utils/internal-log.ts
 /**
 * Internal logging helpers for use within the logixia library itself.
 *
@@ -322,14 +352,26 @@ var ConsoleTransport = class ConsoleTransport {
 * behavior was previously unreliable because the value was frozen at load.
 */
 function isSilent() {
-	return process.env.LOGIXIA_SILENT_INTERNAL === "1";
+	var _process$env;
+	if (typeof process !== "undefined" && ((_process$env = process.env) === null || _process$env === void 0 ? void 0 : _process$env.LOGIXIA_SILENT_INTERNAL) === "1") return true;
+	const flag = globalThis["LOGIXIA_SILENT_INTERNAL"];
+	return flag === "1" || flag === 1 || flag === true;
+}
+/**
+* Write a line to stderr, falling back to the matching console method where
+* `process` is unavailable (browsers, Cloudflare Workers, Deno without Node compat).
+*/
+function writeLine(method, line) {
+	var _process$stderr;
+	if (typeof process !== "undefined" && typeof ((_process$stderr = process.stderr) === null || _process$stderr === void 0 ? void 0 : _process$stderr.write) === "function") process.stderr.write(`${line}\n`);
+	else if (typeof console !== "undefined" && typeof console[method] === "function") console[method](line);
 }
 /**
 * Emit an internal warning to stderr.
 * Use when something is misconfigured but logixia can continue operating.
 */
 function internalWarn(message) {
-	if (!isSilent()) process.stderr.write(`[logixia:warn] ${message}\n`);
+	if (!isSilent()) writeLine("warn", `[logixia:warn] ${message}`);
 }
 /**
 * Emit an internal error to stderr.
@@ -340,12 +382,10 @@ function internalError(message, error) {
 		let errStr = "";
 		if (error instanceof Error) errStr = ` — ${error.message}`;
 		else if (error != null) errStr = ` — ${String(error)}`;
-		process.stderr.write(`[logixia:error] ${message}${errStr}\n`);
+		writeLine("error", `[logixia:error] ${message}${errStr}`);
 	}
 }
-
-//#endregion
-//#region src/transports/buffer-cap.ts
+// src/transports/buffer-cap.ts
 const DEFAULT_BUFFER_CAP = 1e4;
 const DROP_WARN_INTERVAL_MS$1 = 5e3;
 /**
@@ -361,8 +401,10 @@ var BufferCap = class {
 		this.dropped = 0;
 		this.lastWarning = 0;
 		let max = fallback;
-		if (requested !== void 0) if (Number.isInteger(requested) && requested >= 1) max = requested;
-		else internalWarn(`${name}: maxBufferSize ${String(requested)} is not a positive integer; using ${fallback}`);
+		if (requested !== void 0) {
+			if (Number.isInteger(requested) && requested >= 1) max = requested;
+			else internalWarn(`${name}: maxBufferSize ${String(requested)} is not a positive integer; using ${fallback}`);
+		}
 		this.max = Math.max(max, batchSize);
 	}
 	/** Drops the oldest items beyond the cap, in place. */
@@ -384,9 +426,256 @@ var BufferCap = class {
 		this.lastWarning = now;
 	}
 };
-
-//#endregion
-//#region src/transports/database.transport.ts
+// src/utils/sensitive-names.ts
+/**
+* The one list of sensitive names. Log redaction (redact.utils), the HTTP logger
+* middleware and transport secret handling (transports/secret-config) all read it,
+* so the lists cannot drift. No imports: safe from any module, including browser code.
+*/
+/** Field names redacted by name, wherever they appear in logged data. */
+const SENSITIVE_KEY_NAMES = [
+	"password",
+	"passwd",
+	"secret",
+	"token",
+	"apiKey",
+	"api_key",
+	"accessToken",
+	"access_token",
+	"refreshToken",
+	"refresh_token",
+	"authorization",
+	"credentials",
+	"privateKey",
+	"private_key",
+	"clientSecret",
+	"client_secret",
+	"cookie",
+	"set-cookie",
+	"x-api-key",
+	"session",
+	"proxy-authorization",
+	"x-auth-token",
+	"x-access-token",
+	"aws_secret_access_key",
+	"awsSecretAccessKey",
+	"secretAccessKey"
+];
+/**
+* Extra names that only mean "secret" inside transport configuration, where
+* short words like `key` or `signature` are credentials, not log fields.
+*/
+const TRANSPORT_CONFIG_SECRET_NAMES = [
+	"writeKey",
+	"apiSecret",
+	"connectionString",
+	"sessionToken",
+	"passphrase",
+	"signature",
+	"pwd",
+	"pfx",
+	"cert",
+	"key",
+	"auth"
+];
+/** Query-string parameters whose values are never logged. */
+const DEFAULT_REDACT_QUERY_PARAMS = [
+	"token",
+	"access_token",
+	"refresh_token",
+	"code",
+	"password",
+	"secret",
+	"api_key",
+	"apikey",
+	"key",
+	"signature",
+	"sig",
+	"auth"
+];
+// src/transports/secret-config.ts
+/**
+* Keeps credentials out of serialized transport output and error text.
+*
+* `protectSecrets()` replaces each listed field with a non-enumerable accessor backed
+* by a WeakMap, whether or not the field is assigned yet, so later assignments (a
+* connection opened on first write, a refreshed token) stay hidden too. It also
+* installs `toJSON()` and a Node inspect hook returning a redacted view: scalar
+* fields stay for debugging, secret-looking keys become '[REDACTED]', URLs lose
+* userinfo, query and fragment. No Node imports, so browser bundles can use it.
+*/
+const REDACTED = "[REDACTED]";
+const INSPECT_CUSTOM = Symbol.for("nodejs.util.inspect.custom");
+const MAX_DEPTH = 4;
+const MIN_SECRET_LENGTH = 4;
+const SCHEME_PREFIX = /^[a-z][a-z0-9+.-]*:\/\//i;
+/** `scheme://userinfo@`: userinfo runs to the LAST `@` before the path, so `p@ss` is covered. */
+const USERINFO = /(\b[a-z][a-z0-9+.-]*:\/\/)[^\s/?#]*@/gi;
+function normalizeName(name) {
+	return name.toLowerCase().replaceAll("-", "").replaceAll("_", "");
+}
+const SECRET_NAMES = [...SENSITIVE_KEY_NAMES, ...TRANSPORT_CONFIG_SECRET_NAMES].map(normalizeName);
+const QUERY_NAMES = new Set(DEFAULT_REDACT_QUERY_PARAMS.map(normalizeName));
+/** Exact match for short names (`key`, `pfx`), suffix match for longer ones (`azureClientSecret`). */
+function isSecretKey(key) {
+	const name = normalizeName(key);
+	return SECRET_NAMES.some((n) => name === n || n.length >= 5 && name.endsWith(n));
+}
+function isUrlKey(key) {
+	return /url|uri|endpoint|href/i.test(key);
+}
+function isPlainObject(value) {
+	const proto = Object.getPrototypeOf(value);
+	return proto === Object.prototype || proto === null;
+}
+function safeDecode(value) {
+	try {
+		return decodeURIComponent(value.replaceAll("+", " "));
+	} catch {
+		return value;
+	}
+}
+/** Absolute URL: `scheme://host` only. Relative or unparseable: path kept, query and fragment cut. */
+function redactUrl(raw) {
+	if (typeof raw !== "string") return `${raw.protocol}//${raw.host}`;
+	if (SCHEME_PREFIX.test(raw)) try {
+		const url = new URL(raw);
+		return `${url.protocol}//${url.host}`;
+	} catch {
+		return REDACTED;
+	}
+	return raw.split(/[?#]/, 1)[0] ?? "";
+}
+function redactHeaders(headers) {
+	if (!headers || typeof headers !== "object") return headers;
+	return Object.fromEntries(Object.keys(headers).map((name) => [name, REDACTED]));
+}
+/** Redacted deep copy of a config-like value. Never throws, never returns a secret. */
+function redactConfig(value, depth = 0, key = "") {
+	var _value$constructor;
+	if (value === null || value === void 0) return value;
+	if (typeof value === "string") return SCHEME_PREFIX.test(value) || isUrlKey(key) ? redactUrl(value) : value;
+	if (typeof value === "number" || typeof value === "boolean") return value;
+	if (typeof value === "function") return "[Function]";
+	if (typeof value !== "object") return "[Unserializable]";
+	if (typeof URL !== "undefined" && value instanceof URL) return redactUrl(value);
+	if (Array.isArray(value)) return depth >= MAX_DEPTH ? "[Array]" : value.map((v) => redactConfig(v, depth + 1, key));
+	if (!isPlainObject(value) || depth >= MAX_DEPTH) return `[${((_value$constructor = value.constructor) === null || _value$constructor === void 0 ? void 0 : _value$constructor.name) ?? "Object"}]`;
+	const out = {};
+	for (const [name, inner] of Object.entries(value)) if (isSecretKey(name)) assignOwn(out, name, inner === void 0 ? void 0 : REDACTED);
+	else if (name.toLowerCase() === "headers") assignOwn(out, name, redactHeaders(inner));
+	else assignOwn(out, name, redactConfig(inner, depth + 1, name));
+	return out;
+}
+const hiddenKeys = /* @__PURE__ */ new WeakMap();
+const hiddenValues = /* @__PURE__ */ new WeakMap();
+function viewOf(target) {
+	var _target$constructor;
+	const hidden = hiddenKeys.get(target) ?? /* @__PURE__ */ new Set();
+	const values = hiddenValues.get(target);
+	const view = { class: (_target$constructor = target.constructor) === null || _target$constructor === void 0 ? void 0 : _target$constructor.name };
+	for (const key of /* @__PURE__ */ new Set([...Object.keys(target), ...hidden])) {
+		const inner = hidden.has(key) ? values === null || values === void 0 ? void 0 : values.get(key) : target[key];
+		if (isSecretKey(key)) view[key] = inner === void 0 ? void 0 : REDACTED;
+		else if (key.toLowerCase() === "headers") view[key] = redactHeaders(inner);
+		else if (inner !== null && typeof inner === "object" && !hidden.has(key) && !(inner instanceof URL)) view[key] = "[Object]";
+		else if (hidden.has(key) && typeof inner === "string" && !isUrlKey(key)) view[key] = REDACTED;
+		else view[key] = redactConfig(inner, 0, key);
+	}
+	return view;
+}
+/**
+* Hides `keys` on `target` (assigned or not yet) and gives it a redacted `toJSON()` /
+* inspect view. Fields stay readable and writable. Safe to call more than once.
+* Throws when the target cannot carry the protection (frozen or sealed), instead of
+* silently leaving the secret enumerable.
+*/
+function protectSecrets(target, keys) {
+	if (!Object.isExtensible(target)) {
+		var _target$constructor2;
+		throw new TypeError(`protectSecrets: ${((_target$constructor2 = target.constructor) === null || _target$constructor2 === void 0 ? void 0 : _target$constructor2.name) ?? "object"} is not extensible`);
+	}
+	let hidden = hiddenKeys.get(target);
+	let values = hiddenValues.get(target);
+	if (!hidden || !values) {
+		hidden = /* @__PURE__ */ new Set();
+		values = /* @__PURE__ */ new Map();
+		hiddenKeys.set(target, hidden);
+		hiddenValues.set(target, values);
+		const view = () => viewOf(target);
+		Object.defineProperty(target, "toJSON", {
+			value: view,
+			enumerable: false,
+			configurable: true
+		});
+		Object.defineProperty(target, INSPECT_CUSTOM, {
+			value: view,
+			enumerable: false,
+			configurable: true
+		});
+	}
+	const store = values;
+	for (const key of keys) {
+		if (hidden.has(key)) continue;
+		const desc = Object.getOwnPropertyDescriptor(target, key);
+		if (desc && !desc.configurable) throw new TypeError(`protectSecrets: "${key}" is not configurable`);
+		if (desc && "value" in desc) store.set(key, desc.value);
+		hidden.add(key);
+		Object.defineProperty(target, key, {
+			enumerable: false,
+			configurable: true,
+			get: () => store.get(key),
+			set: (next) => void store.set(key, next)
+		});
+	}
+}
+/** The raw, decoded and percent-encoded spellings of a secret. */
+function variantsOf(secret) {
+	return [
+		secret,
+		safeDecode(secret),
+		encodeURIComponent(secret),
+		encodeURI(secret)
+	];
+}
+/** Secret parts of a URL string: the password and the values of sensitive query parameters. */
+function urlSecrets(raw) {
+	const text = typeof raw === "string" ? raw : raw.href;
+	const out = [];
+	const userinfo = new RegExp(USERINFO.source, "i").exec(text);
+	if (userinfo) {
+		const info = text.slice(userinfo[1].length, userinfo.index + userinfo[0].length - 1);
+		const colon = info.indexOf(":");
+		if (colon !== -1) out.push(info.slice(colon + 1));
+	}
+	const queryStart = text.indexOf("?");
+	if (queryStart !== -1) {
+		const query = text.slice(queryStart + 1).split("#", 1)[0] ?? "";
+		for (const pair of query.split("&")) {
+			const eq = pair.indexOf("=");
+			if (eq > 0 && QUERY_NAMES.has(normalizeName(safeDecode(pair.slice(0, eq))))) out.push(pair.slice(eq + 1));
+		}
+	}
+	return out.flatMap(variantsOf);
+}
+/** Replaces URL userinfo and every spelling of the given secret values in `text`. */
+function scrubSecrets(text, secrets) {
+	let out = text.replace(USERINFO, `$1${REDACTED}@`);
+	const all = new Set(secrets.flatMap((s) => s && s.length >= MIN_SECRET_LENGTH ? variantsOf(s) : []));
+	for (const secret of [...all].sort((a, b) => b.length - a.length)) if (secret.length >= MIN_SECRET_LENGTH) out = out.split(secret).join(REDACTED);
+	return out;
+}
+/** Scrubs message, stack and the cause chain of `err` in place; returns it. */
+function scrubError(err, secrets, depth = 0) {
+	if (!(err instanceof Error) || depth > 3) return err;
+	try {
+		err.message = scrubSecrets(err.message, secrets);
+		if (err.stack) err.stack = scrubSecrets(err.stack, secrets);
+		scrubError(err.cause, secrets, depth + 1);
+	} catch {}
+	return err;
+}
+// src/transports/database.transport.ts
 /**
 * Validates that a SQL identifier (table/index name) contains only safe characters.
 * Prevents SQL injection via user-supplied table names.
@@ -409,7 +698,7 @@ const PG_DATA_CLASSES = [
 	"23",
 	"54"
 ];
-const MYSQL_DATA_CODES = new Set([
+const MYSQL_DATA_CODES = /* @__PURE__ */ new Set([
 	"ER_DATA_TOO_LONG",
 	"ER_TRUNCATED_WRONG_VALUE",
 	"ER_TRUNCATED_WRONG_VALUE_FOR_FIELD",
@@ -419,7 +708,7 @@ const MYSQL_DATA_CODES = new Set([
 	"ER_INVALID_JSON_TEXT",
 	"ER_INVALID_CHARACTER_STRING"
 ]);
-const MYSQL_DATA_ERRNOS = new Set([
+const MYSQL_DATA_ERRNOS = /* @__PURE__ */ new Set([
 	1048,
 	1062,
 	1264,
@@ -428,12 +717,12 @@ const MYSQL_DATA_ERRNOS = new Set([
 	1406,
 	3140
 ]);
-const SQLITE_DATA_CODES = new Set([
+const SQLITE_DATA_CODES = /* @__PURE__ */ new Set([
 	"SQLITE_CONSTRAINT",
 	"SQLITE_TOOBIG",
 	"SQLITE_MISMATCH"
 ]);
-const MONGO_DATA_CODES = new Set([
+const MONGO_DATA_CODES = /* @__PURE__ */ new Set([
 	2,
 	121,
 	10334,
@@ -495,13 +784,23 @@ var DatabaseTransport = class {
 		this.name = "database";
 		this.batch = [];
 		this.isConnected = false;
+		protectSecrets(this, ["config", "connection"]);
 		this.batchSize = config.batchSize || 100;
 		this.flushInterval = config.flushInterval || 5e3;
 		this.cap = new BufferCap("DatabaseTransport", config.maxBufferSize, this.batchSize);
+		this.level = config.level;
 		if (config.filter) this.filter = config.filter;
 		if (config.table) validateSqlIdentifier(config.table, "table");
 		this.setupFlushTimer();
 	}
+	secretValues() {
+		const { connectionString, password } = this.config;
+		return [
+			connectionString,
+			password,
+			...connectionString ? urlSecrets(connectionString) : []
+		];
+	}
 	async write(entry) {
 		if (!this.isConnected) await this.connect();
 		this.addToBatch(entry);
@@ -562,6 +861,13 @@ var DatabaseTransport = class {
 		this.cap.enforce(this.batch);
 	}
 	async writeEntries(entries) {
+		try {
+			await this.writeEntriesUnscrubbed(entries);
+		} catch (error) {
+			throw scrubError(error, this.secretValues());
+		}
+	}
+	async writeEntriesUnscrubbed(entries) {
 		switch (this.config.type) {
 			case "mongodb":
 				await this.flushToMongoDB(entries);
@@ -640,13 +946,12 @@ var DatabaseTransport = class {
 				case "mysql":
 					await this.connectMySQL();
 					break;
-				case "sqlite":
-					await this.connectSQLite();
-					break;
+				case "sqlite": await this.connectSQLite();
 			}
 			this.isConnected = true;
 		} catch (error) {
 			this.isConnected = false;
+			scrubError(error, this.secretValues());
 			throw new Error(`Database connection failed: ${error}`, { cause: error });
 		}
 	}
@@ -655,7 +960,8 @@ var DatabaseTransport = class {
 			const { MongoClient } = await import("mongodb").catch(() => {
 				throw new Error("MongoDB driver not installed. Run: npm install mongodb");
 			});
-			this.connection = new MongoClient(this.config.connectionString || `mongodb://${this.config.host}:${this.config.port}/${this.config.database}`);
+			const connectionString = this.config.connectionString || `mongodb://${this.config.host}:${this.config.port}/${this.config.database}`;
+			this.connection = new MongoClient(connectionString);
 			await this.connection.connect();
 			await this.connection.db(this.config.database).admin().ping();
 		} catch (error) {
@@ -767,12 +1073,13 @@ var DatabaseTransport = class {
 			entry.environment
 		].map((value, column) => stripNul(column === 3 ? stripJsonNulEscape(value) : value))), POSTGRES_ROWS_PER_INSERT);
 		const insertChunk = async (rows) => {
+			const placeholders = rows.map((_, i) => {
+				return `(${Array.from({ length: POSTGRES_COLUMNS }, (_unused, c) => `$${i * POSTGRES_COLUMNS + c + 1}`).join(", ")})`;
+			}).join(", ");
 			const query = `
       INSERT INTO ${tableName} 
       (timestamp, level, message, payload, context, trace_id, app_name, environment)
-      VALUES ${rows.map((_, i) => {
-				return `(${Array.from({ length: POSTGRES_COLUMNS }, (_unused, c) => `$${i * POSTGRES_COLUMNS + c + 1}`).join(", ")})`;
-			}).join(", ")}
+      VALUES ${placeholders}
     `;
 			await this.connection.query(query, rows.flat());
 		};
@@ -936,9 +1243,7 @@ var DatabaseTransport = class {
 			case "mysql":
 				await this.connection.end();
 				break;
-			case "sqlite":
-				await this.connection.close();
-				break;
+			case "sqlite": await this.connection.close();
 		}
 		this.isConnected = false;
 	}
@@ -979,9 +1284,7 @@ var DatabaseTransport = class {
 		}
 	}
 };
-
-//#endregion
-//#region src/transports/file.transport.ts
+// src/transports/file.transport.ts
 const appendFile = (0, node_util.promisify)(node_fs.appendFile);
 const rename = (0, node_util.promisify)(node_fs.rename);
 const unlink = (0, node_util.promisify)(node_fs.unlink);
@@ -1244,7 +1547,6 @@ var FileTransport = class {
 				csvField(entry.traceId),
 				csvField(stringifyForLog(entry.data || {}))
 			].join(",");
-			case "text":
 			default: return `${entry.timestamp.toISOString()} [${stripControlChars(safeToString(entry.level)).toUpperCase()}] ${stripControlChars(safeToString(entry.message))}${entry.data ? " " + stringifyForLog(entry.data) : ""}`;
 		}
 	}
@@ -1270,22 +1572,22 @@ var FileTransport = class {
 			await this.append(content);
 			return;
 		}
-		let chunk$1 = "";
+		let chunk = "";
 		let chunkBytes = 0;
 		for (const entry of entries) {
 			const line = this.formatEntry(entry) + "\n";
 			const lineBytes = Buffer.byteLength(line);
 			const used = this.bytesWritten + chunkBytes;
 			if (used > 0 && used + lineBytes > this.maxBytes) {
-				if (chunk$1) await this.append(chunk$1, chunkBytes);
-				chunk$1 = "";
+				if (chunk) await this.append(chunk, chunkBytes);
+				chunk = "";
 				chunkBytes = 0;
 				await this.rotateFile();
 			}
-			chunk$1 += line;
+			chunk += line;
 			chunkBytes += lineBytes;
 		}
-		if (chunk$1) await this.append(chunk$1, chunkBytes);
+		if (chunk) await this.append(chunk, chunkBytes);
 	}
 	async append(content, bytes = Buffer.byteLength(content)) {
 		await appendFile(this.currentFilePath, content, { mode: this.fileMode });
@@ -1314,7 +1616,7 @@ var FileTransport = class {
 	}
 	parseInterval(interval) {
 		const match = /^(\d{1,6})([hdwmy])$/i.exec(interval.trim());
-		if (!match) return 1440 * 60 * 1e3;
+		if (!match) return 864e5;
 		const value = Number.parseInt(match[1] || "1", 10);
 		switch ((match[2] || "h").toLowerCase()) {
 			case "h": return value * 60 * 60 * 1e3;
@@ -1429,12 +1731,41 @@ var FileTransport = class {
 		this.reportDropped(0);
 	}
 };
-
-//#endregion
-//#region src/transports/worker-entry.ts
+// src/transports/level-filter.ts
+/** Severity values of the built-in levels; lower is more severe (same scale as the logger). */
+const BUILTIN_LEVEL_VALUES = {
+	error: 0,
+	warn: 1,
+	info: 2,
+	debug: 3,
+	trace: 4,
+	verbose: 5
+};
+/** Built-in levels plus the logger's custom `levelOptions.levels`. */
+function buildLevelValues(custom) {
+	return new Map([...Object.entries(BUILTIN_LEVEL_VALUES), ...Object.entries(custom ?? {})]);
+}
+function lookup(values, level) {
+	return values.get(level) ?? values.get(level.toLowerCase());
+}
+/**
+* Whether an entry at `level` passes a transport's minimum `threshold`, using the
+* logger's scale (an entry passes when its value is <= the threshold's value).
+* The logger has already rejected unknown entry levels, so an unknown entry level
+* or threshold here does not filter.
+*/
+function meetsTransportLevel(threshold, level, values) {
+	if (!threshold) return true;
+	const min = lookup(values, threshold);
+	const actual = lookup(values, level);
+	if (min === void 0 || actual === void 0) return true;
+	return actual <= min;
+}
+// src/transports/worker-entry.ts
 const port = node_worker_threads.parentPort;
 if (!port) throw new Error("worker-entry must run inside a worker thread");
-const { transportType, transportConfig } = node_worker_threads.workerData;
+const { transportType, transportConfig, levels } = node_worker_threads.workerData;
+const levelValues = buildLevelValues(levels);
 function createTransport() {
 	const config = transportConfig;
 	switch (transportType) {
@@ -1458,16 +1789,18 @@ const flushTransport = async () => {
 	if (typeof transport.flush === "function") await transport.flush();
 };
 async function handle(msg) {
-	if (msg.type === "write") try {
-		await transport.write(msg.entry);
-	} catch (err) {
-		port === null || port === void 0 || port.postMessage({
-			type: "write-error",
-			error: errorMessage(err),
-			entry: msg.entry
-		});
-	}
-	else if (msg.type === "flush") try {
+	if (msg.type === "write") {
+		if (!meetsTransportLevel(transport.level, msg.entry.level, levelValues)) return;
+		try {
+			await transport.write(msg.entry);
+		} catch (err) {
+			port === null || port === void 0 || port.postMessage({
+				type: "write-error",
+				error: errorMessage(err),
+				entry: msg.entry
+			});
+		}
+	} else if (msg.type === "flush") try {
 		await flushTransport();
 		port === null || port === void 0 || port.postMessage({ type: "flushed" });
 	} catch (err) {
@@ -1489,5 +1822,3 @@ port.on("message", (msg) => {
 	queue = queue.then(() => handle(msg));
 });
 port.postMessage({ type: "ready" });
-
-//#endregion