logixia 2.0.6 → 2.0.7

package/dist/{logitron-logger-D22Yb61K.d.mts → logitron-logger-sYuk8fOb.d.mts}

@@ -1,4 +1,4 @@
-import { C as LogixiaLoggerInstance, L as LogixiaPlugin, b as LoggerConfig, p as ILoggerDefault, w as NamespaceLevels, x as LoggerWithLevels, y as LogLevelString } from "./index-BSTtFcQ6.mjs";
+import { C as LogixiaLoggerInstance, L as LogixiaPlugin, b as LoggerConfig, p as ILoggerDefault, w as NamespaceLevels, x as LoggerWithLevels, y as LogLevelString } from "./index-BAkPHp5D.mjs";
 /**
  * The logixia logger. Create instances with {@link createLogger} so that custom
  * levels from `levelOptions.levels` also become methods.
@@ -275,4 +275,4 @@ declare class LogixiaLogger<TConfig extends LoggerConfig<Record<string, number>>
  */
 declare function createLogger<T extends LoggerConfig<Record<string, number>>>(config: T, context?: string): LoggerWithLevels<T>;
 export { createLogger as n, LogixiaLogger as t };
-//# sourceMappingURL=logitron-logger-D22Yb61K.d.mts.map
+//# sourceMappingURL=logitron-logger-sYuk8fOb.d.mts.map

package/dist/{logitron-logger-D22Yb61K.d.mts.map → logitron-logger-sYuk8fOb.d.mts.map}

@@ -1 +1 @@
-{"version":3,"file":"logitron-logger-D22Yb61K.d.mts","names":[],"sources":["../src/core/logitron-logger.ts"],"mappings":";;;;;;;;;;;;;;cAyLa,cACX,gBAAgB,aAAa,0BAA0B,yBAC5C;GAEV;UAEO;UACA;UACA;UACA;UACA;UACA;;mBAGS;;UAIT;;UAEA;;UAEA;;mBAES;;UAET;;UAEA;;UAEA;;;;;UAKA;;UAEA;;UAEA;;UAEA;;mBAES;;mBAEA;;mBAEA;;UAET;EAEI,YAAA,QAAQ,SAAS,kBAAkB,SAAS,cAAc;UA4G9D;UAiBA;;;;;UAsBA;;;;;;EA2HF,MAAM,yBAAyB,OAAO,OAAO,0BAA0B;;EAYvE,KAAK,iBAAiB,OAAO,0BAA0B;;EAKvD,KAAK,iBAAiB,OAAO,0BAA0B;;EAKvD,MAAM,iBAAiB,OAAO,0BAA0B;;EAKxD,MAAM,iBAAiB,OAAO,0BAA0B;;EAKxD,QAAQ,iBAAiB,OAAO,0BAA0B;;;;;;EAS1D,SAAS,eAAe,iBAAiB,OAAO,0BAA0B;;EAOhF,KAAK;;;;;;;;;;;;;EAgBC,QAAQ,gBAAgB;EAmBxB,UAAU,GAAG,eAAe,UAAU,QAAQ,KAAK,QAAQ;;;;;;;;;;;;EAyBjE,SAAS,OAAO;;;;;;EAuBhB,YAAY;UAIJ;;;;;UAQA;;;;;;;;;;;;;;;;;;;EAkCR,mBAAmB,QAAQ;;EAS3B,qBAAqB,QAAQ;;EAO7B,sBAAsB;UAId;;EAMR,WAAW;;EAKX;;EAOA,YAAY;;EASZ,aAAa;;EASb,eAAe;;EASf,iBAAiB;;EAmBjB;;EAQA;;EAMA;;EAMA,mBAAmB,qBAAqB;;EAMxC,mBAAmB;EAMnB;;EAMA;;;;;;;;;;;;;EAkBA,MAAM,iBAAiB,OAAO,0BAA0B;;;;;;;;;;;;EA0BxD,IAAI,QAAQ;;;;;EASZ,MAAM;;EAQA,SAAS;;EAKT,eAAe;IAAU;IAAkB,SAAS;;;;;;;;;;;;;;;;EAqBpD,SAAS;UAsBD;;;;;UA8GN;;;;;;;;;;;UAgBA;UAwCA;UAgDA;;;;;;;;UAcA;;;UAuBM;;;;;;;;;;;;;;;;;;iBA+BA,aAAa,UAAU,aAAa,yBAClD,QAAQ,GACR,mBACC,iBAAiB"}
+{"version":3,"file":"logitron-logger-sYuk8fOb.d.mts","names":[],"sources":["../src/core/logitron-logger.ts"],"mappings":";;;;;;;;;;;;;;cAyLa,cACX,gBAAgB,aAAa,0BAA0B,yBAC5C;GAEV;UAEO;UACA;UACA;UACA;UACA;UACA;;mBAGS;;UAIT;;UAEA;;UAEA;;mBAES;;UAET;;UAEA;;UAEA;;;;;UAKA;;UAEA;;UAEA;;UAEA;;mBAES;;mBAEA;;mBAEA;;UAET;EAEI,YAAA,QAAQ,SAAS,kBAAkB,SAAS,cAAc;UA4G9D;UAiBA;;;;;UAsBA;;;;;;EA2HF,MAAM,yBAAyB,OAAO,OAAO,0BAA0B;;EAYvE,KAAK,iBAAiB,OAAO,0BAA0B;;EAKvD,KAAK,iBAAiB,OAAO,0BAA0B;;EAKvD,MAAM,iBAAiB,OAAO,0BAA0B;;EAKxD,MAAM,iBAAiB,OAAO,0BAA0B;;EAKxD,QAAQ,iBAAiB,OAAO,0BAA0B;;;;;;EAS1D,SAAS,eAAe,iBAAiB,OAAO,0BAA0B;;EAOhF,KAAK;;;;;;;;;;;;;EAgBC,QAAQ,gBAAgB;EAmBxB,UAAU,GAAG,eAAe,UAAU,QAAQ,KAAK,QAAQ;;;;;;;;;;;;EAyBjE,SAAS,OAAO;;;;;;EAuBhB,YAAY;UAIJ;;;;;UAQA;;;;;;;;;;;;;;;;;;;EAkCR,mBAAmB,QAAQ;;EAS3B,qBAAqB,QAAQ;;EAO7B,sBAAsB;UAId;;EAMR,WAAW;;EAKX;;EAOA,YAAY;;EASZ,aAAa;;EASb,eAAe;;EASf,iBAAiB;;EAmBjB;;EAQA;;EAMA;;EAMA,mBAAmB,qBAAqB;;EAMxC,mBAAmB;EAMnB;;EAMA;;;;;;;;;;;;;EAkBA,MAAM,iBAAiB,OAAO,0BAA0B;;;;;;;;;;;;EA0BxD,IAAI,QAAQ;;;;;EASZ,MAAM;;EAQA,SAAS;;EAKT,eAAe;IAAU;IAAkB,SAAS;;;;;;;;;;;;;;;;EAqBpD,SAAS;UAsBD;;;;;UA8GN;;;;;;;;;;;UAgBA;UAwCA;UAgDA;;;;;;;;UAcA;;;UAuBM;;;;;;;;;;;;;;;;;;iBA+BA,aAAa,UAAU,aAAa,yBAClD,QAAQ,GACR,mBACC,iBAAiB"}

package/dist/middleware.d.mts

@@ -1,5 +1,5 @@
 import { n as HttpResponseShape, t as HttpRequestShape } from "./http-shapes-BnBkJcid.mjs";
-import { u as IBaseLogger } from "./index-BSTtFcQ6.mjs";
+import { u as IBaseLogger } from "./index-BAkPHp5D.mjs";
 interface HttpLoggerOptions {
   /**
    * Skip logging for a request. Called before any I/O.

package/dist/middleware.d.ts

@@ -1,5 +1,5 @@
 import { n as HttpResponseShape, t as HttpRequestShape } from "./http-shapes-BnBkJcid.js";
-import { u as IBaseLogger } from "./index-CFDGkI8n.js";
+import { u as IBaseLogger } from "./index-e7LowmAu.js";
 interface HttpLoggerOptions {
   /**
    * Skip logging for a request. Called before any I/O.

package/dist/middleware.js

@@ -1,13 +1,13 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_own_property = require("./own-property-BWkibepN.js");
+const require_sensitive_names = require("./sensitive-names-CHMowujD.js");
 const require_request_trace = require("./request-trace-ByujsUZk.js");
-const require_internal_log = require("./internal-log-By4Govmu.js");
-const require_safe_stringify = require("./safe-stringify-J3sh-7YM.js");
+const require_internal_log = require("./internal-log-DwqTjhpb.js");
+const require_safe_stringify = require("./safe-stringify-CN7icp8S.js");
 // src/middleware/http-logger.ts
 function sanitizeHeaders(headers, redactSet) {
 	if (!headers) return {};
 	const out = {};
-	for (const [k, v] of Object.entries(headers)) require_own_property.assignOwn(out, k, redactSet.has(k.toLowerCase()) ? "[REDACTED]" : v);
+	for (const [k, v] of Object.entries(headers)) require_sensitive_names.assignOwn(out, k, redactSet.has(k.toLowerCase()) ? "[REDACTED]" : v);
 	return out;
 }
 /** Fire-and-forget a logger call; a failing log must never become an unhandled rejection. */
@@ -16,8 +16,8 @@ function fire(result) {
 }
 function resolveNameSets(options) {
 	return {
-		headers: require_internal_log.buildNameSet(require_internal_log.DEFAULT_REDACT_HEADERS, options.redactHeaders),
-		queryParams: require_internal_log.buildNameSet(require_internal_log.DEFAULT_REDACT_QUERY_PARAMS, options.redactQueryParams)
+		headers: require_sensitive_names.buildNameSet(require_sensitive_names.DEFAULT_REDACT_HEADERS, options.redactHeaders),
+		queryParams: require_sensitive_names.buildNameSet(require_sensitive_names.DEFAULT_REDACT_QUERY_PARAMS, options.redactQueryParams)
 	};
 }
 function buildBaseFields(req, traceId, options, { headers: redactSet, queryParams: paramSet }) {
@@ -25,7 +25,7 @@ function buildBaseFields(req, traceId, options, { headers: redactSet, queryParam
 	const fields = {
 		traceId,
 		method: ((_req$method = req.method) === null || _req$method === void 0 ? void 0 : _req$method.toUpperCase()) ?? "UNKNOWN",
-		url: require_internal_log.redactUrlQuery(req.url ?? "/", paramSet),
+		url: require_sensitive_names.redactUrlQuery(req.url ?? "/", paramSet),
 		ip: req.ip ?? ((_req$socket = req.socket) === null || _req$socket === void 0 ? void 0 : _req$socket.remoteAddress) ?? "unknown",
 		headers: sanitizeHeaders(req.headers, redactSet)
 	};
@@ -193,7 +193,7 @@ function pruneValue(value, budget, depth, ancestors) {
 				break;
 			}
 			budget.left -= k.length;
-			require_own_property.assignOwn(record, k, pruneValue(v, budget, depth + 1, ancestors));
+			require_sensitive_names.assignOwn(record, k, pruneValue(v, budget, depth + 1, ancestors));
 		}
 		return record;
 	} catch {

package/dist/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","names":["internalError","buildNameSet","DEFAULT_REDACT_HEADERS","DEFAULT_REDACT_QUERY_PARAMS","sanitizeUrl","resolveTraceHeaders","resolveRequestTraceId","stringifyForLog"],"sources":["../src/middleware/http-logger.ts"],"sourcesContent":["/**\n * HTTP request/response logging middleware — Morgan replacement.\n *\n * Fixes every documented Morgan bug:\n *  - statusCode always captured correctly, even for requests > 20 s\n *  - Logs request START (with traceId) and response FINISH (with duration)\n *  - Captures errors before and after response\n *  - Auto-redacts Authorization / Cookie / Set-Cookie headers\n *  - Slow-request warnings\n *  - Skip predicates for health-check routes / static assets\n *\n * @example Express\n * ```ts\n * import { createExpressMiddleware } from 'logixia/middleware';\n * app.use(createExpressMiddleware(logger));\n * ```\n *\n * @example Fastify\n * ```ts\n * import { createFastifyPlugin } from 'logixia/middleware';\n * await fastify.register(createFastifyPlugin(logger));\n * ```\n */\n\nimport type { IBaseLogger } from '../types';\nimport type { HttpRequestShape, HttpResponseShape } from '../types/http-shapes';\nimport { internalError } from '../utils/internal-log';\nimport { assignOwn } from '../utils/own-property';\nimport { resolveRequestTraceId, resolveTraceHeaders } from '../utils/request-trace';\nimport { stringifyForLog } from '../utils/safe-stringify';\nimport {\n  buildNameSet,\n  DEFAULT_REDACT_HEADERS,\n  DEFAULT_REDACT_QUERY_PARAMS,\n  redactUrlQuery as sanitizeUrl,\n} from '../utils/sensitive-names';\n\n// ── Shared types ─────────────────────────────────────────────────────────────\n\nexport interface HttpLoggerOptions {\n  /**\n   * Skip logging for a request. Called before any I/O.\n   * @example `skip: (req) => req.url === '/health'`\n   */\n  skip?: (req: IncomingRequest) => boolean;\n  /**\n   * Log request body (POST/PUT/PATCH). Capped at `bodyMaxBytes` (default: 4096).\n   * Redaction still applies to the captured body.\n   * Default: false.\n   */\n  logBody?: boolean;\n  /** Max bytes of body to capture. Default: 4096. */\n  bodyMaxBytes?: number;\n  /**\n   * Emit a WARN log when a request duration exceeds this threshold (ms).\n   * Default: 1000.\n   */\n  slowRequestThresholdMs?: number;\n  /**\n   * Additional fields to include in every log entry.\n   * @example `extraFields: (req) => ({ tenantId: req.headers['x-tenant-id'] })`\n   */\n  extraFields?: (req: IncomingRequest) => Record<string, unknown>;\n  /**\n   * Header name, or list of names tried in order, to read the trace ID from.\n   * Default: the library-wide list (`DEFAULT_TRACE_HEADERS`: traceparent,\n   * x-trace-id, x-request-id, x-correlation-id, trace-id).\n   * If none is present, `request.id` is used when it is not a framework counter,\n   * otherwise a UUID is generated and shared with the logixia context helpers.\n   */\n  traceIdHeader?: string | readonly string[];\n  /**\n   * Additional headers to redact from logged output. Merged with the defaults\n   * (authorization, cookie, set-cookie, x-api-key, proxy-authorization,\n   * x-auth-token, x-access-token, x-csrf-token, x-amz-security-token).\n   */\n  redactHeaders?: string[];\n  /**\n   * Additional query-string parameter names whose values are redacted from the\n   * logged URL. Merged with the defaults (token, access_token, refresh_token,\n   * code, password, secret, api_key, apikey, key, signature, sig, auth).\n   */\n  redactQueryParams?: string[];\n  /**\n   * Log level for request-start entries. Default: 'debug'.\n   * Set to 'silent' to suppress request-start logs entirely.\n   */\n  requestLevel?: string;\n  /** Log level for successful response entries. Default: 'info'. */\n  responseLevel?: string;\n  /** Log level for error responses (status ≥ 500). Default: 'error'. */\n  errorLevel?: string;\n}\n\n// Minimal structural types so we don't need @types/express / fastify in core\nexport type IncomingRequest = HttpRequestShape;\nexport type OutgoingResponse = HttpResponseShape;\n\n// ── Helpers ───────────────────────────────────────────────────────────────────\n\nfunction sanitizeHeaders(\n  headers: Record<string, string | string[] | undefined> | undefined,\n  redactSet: Set<string>\n): Record<string, unknown> {\n  if (!headers) return {};\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(headers)) {\n    assignOwn(out, k, redactSet.has(k.toLowerCase()) ? '[REDACTED]' : v);\n  }\n  return out;\n}\n\n/** Fire-and-forget a logger call; a failing log must never become an unhandled rejection. */\nfunction fire(result: unknown): void {\n  if (result && typeof (result as Promise<unknown>).catch === 'function') {\n    (result as Promise<unknown>).catch((error: unknown) =>\n      internalError('http-logger: log call failed', error)\n    );\n  }\n}\n\ninterface NameSets {\n  headers: Set<string>;\n  queryParams: Set<string>;\n}\n\nfunction resolveNameSets(options: HttpLoggerOptions): NameSets {\n  return {\n    headers: buildNameSet(DEFAULT_REDACT_HEADERS, options.redactHeaders),\n    queryParams: buildNameSet(DEFAULT_REDACT_QUERY_PARAMS, options.redactQueryParams),\n  };\n}\n\nfunction buildBaseFields(\n  req: IncomingRequest,\n  traceId: string,\n  options: HttpLoggerOptions,\n  { headers: redactSet, queryParams: paramSet }: NameSets\n): Record<string, unknown> {\n  const fields: Record<string, unknown> = {\n    traceId,\n    method: req.method?.toUpperCase() ?? 'UNKNOWN',\n    url: sanitizeUrl(req.url ?? '/', paramSet),\n    ip: req.ip ?? req.socket?.remoteAddress ?? 'unknown',\n    headers: sanitizeHeaders(req.headers, redactSet),\n  };\n\n  if (options.extraFields) {\n    Object.assign(fields, options.extraFields(req));\n  }\n\n  return fields;\n}\n\n// ── Express middleware ────────────────────────────────────────────────────────\n\n/**\n * Create an Express / Connect compatible middleware that replaces Morgan.\n */\nexport function createExpressMiddleware(\n  logger: IBaseLogger,\n  options: HttpLoggerOptions = {}\n): (req: IncomingRequest, res: OutgoingResponse, next: () => void) => void {\n  const {\n    skip,\n    logBody,\n    bodyMaxBytes,\n    traceIdHeader,\n    requestLevel = 'debug',\n    responseLevel = 'info',\n    errorLevel = 'error',\n    slowRequestThresholdMs = 1000,\n  } = options;\n  const nameSets = resolveNameSets(options);\n  const traceHeaders = resolveTraceHeaders(traceIdHeader);\n\n  return function logixiaHttpMiddleware(\n    req: IncomingRequest,\n    res: OutgoingResponse,\n    next: () => void\n  ): void {\n    if (skip?.(req)) {\n      next();\n      return;\n    }\n\n    const traceId = resolveRequestTraceId(req, traceHeaders);\n    const startMs = Date.now();\n    const baseFields = buildBaseFields(req, traceId, options, nameSets);\n\n    // Log request start\n    if (requestLevel !== 'silent') {\n      fire(\n        logger.logLevel(requestLevel, 'request started', {\n          ...baseFields,\n          ...(logBody && req.body ? { body: truncateBody(req.body, bodyMaxBytes) } : {}),\n        })\n      );\n    }\n\n    // Hook into the response 'finish' event — fires after headers + body are sent.\n    // This is what Morgan gets wrong for slow requests (it uses 'close' which may\n    // fire before the status code is set on some Node versions).\n    //\n    // BOTH 'finish' and 'close' fire on a normal response, so guard against\n    // logging the completion twice (which would duplicate the completed entry and\n    // the slow-request warning).\n    let completed = false;\n    const onFinish = (): void => {\n      if (completed) return;\n      completed = true;\n\n      const duration = Date.now() - startMs;\n      const status = res.statusCode ?? 0;\n      const level = status >= 500 ? errorLevel : responseLevel;\n\n      fire(\n        logger.logLevel(level, 'request completed', {\n          ...baseFields,\n          statusCode: status,\n          duration,\n        })\n      );\n\n      if (duration > slowRequestThresholdMs) {\n        fire(\n          logger.warn('slow request detected', {\n            ...baseFields,\n            statusCode: status,\n            duration,\n            threshold: slowRequestThresholdMs,\n          })\n        );\n      }\n    };\n\n    res.once?.('finish', onFinish);\n    // Fallback: also covers a client that disconnects before 'finish' fires. The\n    // `completed` guard ensures a normal finish+close pair logs only once.\n    res.once?.('close', onFinish);\n\n    next();\n  };\n}\n\n// ── Fastify plugin ─────────────────────────────────────────────────────────────\n\nexport interface FastifyInstance {\n  addHook: (name: string, fn: (req: unknown, reply: unknown, done: () => void) => void) => void;\n}\n\n/**\n * Create a Fastify plugin (a function you pass to `fastify.register()`).\n *\n * @example\n * ```ts\n * await fastify.register(createFastifyPlugin(logger, { slowRequestThresholdMs: 500 }));\n * ```\n */\nexport function createFastifyPlugin(logger: IBaseLogger, options: HttpLoggerOptions = {}) {\n  const {\n    skip,\n    traceIdHeader,\n    requestLevel = 'debug',\n    responseLevel = 'info',\n    errorLevel = 'error',\n    slowRequestThresholdMs = 1000,\n  } = options;\n  const nameSets = resolveNameSets(options);\n  const traceHeaders = resolveTraceHeaders(traceIdHeader);\n\n  function logixiaFastifyPlugin(fastify: FastifyInstance, _opts: unknown, done: () => void): void {\n    fastify.addHook('onRequest', (request: unknown, _reply: unknown, hookDone: () => void) => {\n      const req = request as IncomingRequest & { _logixiaStart?: number };\n      if (skip?.(req)) {\n        hookDone();\n        return;\n      }\n\n      const traceId = resolveRequestTraceId(req, traceHeaders);\n      req._logixiaStart = Date.now();\n\n      if (requestLevel !== 'silent') {\n        fire(\n          logger.logLevel(\n            requestLevel,\n            'request started',\n            buildBaseFields(req, traceId, options, nameSets)\n          )\n        );\n      }\n      hookDone();\n    });\n\n    fastify.addHook('onResponse', (request: unknown, reply: unknown, hookDone: () => void) => {\n      const req = request as IncomingRequest & { _logixiaStart?: number };\n      if (req._logixiaStart === undefined) {\n        hookDone();\n        return;\n      }\n\n      const rep = reply as { statusCode?: number };\n      const duration = Date.now() - req._logixiaStart;\n      const status = rep.statusCode ?? 0;\n      const traceId = resolveRequestTraceId(req, traceHeaders);\n      const level = status >= 500 ? errorLevel : responseLevel;\n      const baseFields = buildBaseFields(req, traceId, options, nameSets);\n\n      fire(\n        logger.logLevel(level, 'request completed', {\n          ...baseFields,\n          statusCode: status,\n          duration,\n        })\n      );\n\n      if (duration > slowRequestThresholdMs) {\n        fire(\n          logger.warn('slow request detected', {\n            traceId,\n            url: baseFields.url,\n            method: req.method,\n            duration,\n            threshold: slowRequestThresholdMs,\n          })\n        );\n      }\n\n      hookDone();\n    });\n\n    done();\n  }\n\n  return Object.assign(logixiaFastifyPlugin, {\n    [Symbol.for('skip-override')]: true,\n    [Symbol.for('fastify.display-name')]: 'logixia',\n  });\n}\n\n// ── Internal helpers ──────────────────────────────────────────────────────────\n\n/**\n * Bound the captured body without turning it into a string, so the logger's\n * path-based redaction still sees the original keys. Oversized structures are\n * pruned (extra keys/items dropped, long strings cut) rather than serialized.\n */\nfunction truncateBody(body: unknown, maxBytes = 4096): unknown {\n  if (typeof body === 'string') {\n    return body.length > maxBytes ? body.slice(0, maxBytes) + '…[truncated]' : body;\n  }\n  if (body && typeof body === 'object') {\n    const str = stringifyForLog(body);\n    if (str.length <= maxBytes) return body;\n    return pruneValue(body, { left: maxBytes }, 0, new Set());\n  }\n  return body;\n}\n\nconst TRUNCATED = '…[truncated]';\nconst MAX_PRUNE_DEPTH = 8;\n\nfunction pruneValue(\n  value: unknown,\n  budget: { left: number },\n  depth: number,\n  ancestors: Set<object>\n): unknown {\n  if (typeof value === 'string') {\n    const cut = value.slice(0, Math.max(0, budget.left));\n    budget.left -= cut.length;\n    return cut.length < value.length ? cut + TRUNCATED : cut;\n  }\n  if (value === null || typeof value !== 'object') {\n    budget.left -= 8;\n    return value;\n  }\n  if (value instanceof Date) {\n    budget.left -= 24;\n    return Number.isNaN(value.getTime()) ? 'Invalid Date' : value.toISOString();\n  }\n  if (value instanceof ArrayBuffer || ArrayBuffer.isView(value)) {\n    budget.left -= 16;\n    return `[Buffer ${value.byteLength} bytes]`;\n  }\n  if (value instanceof Error) return value;\n  if (ancestors.has(value) || depth >= MAX_PRUNE_DEPTH) return TRUNCATED;\n  ancestors.add(value);\n  try {\n    if (Array.isArray(value) || value instanceof Set || value instanceof Map) {\n      const items: unknown[] = [];\n      for (const item of value instanceof Map ? value.entries() : value) {\n        if (budget.left <= 0) {\n          items.push(TRUNCATED);\n          break;\n        }\n        items.push(pruneValue(item, budget, depth + 1, ancestors));\n      }\n      return items;\n    }\n    const toJSON = (value as { toJSON?: unknown }).toJSON;\n    if (typeof toJSON === 'function') {\n      const json: unknown = toJSON.call(value);\n      if (json !== value) return pruneValue(json, budget, depth + 1, ancestors);\n    }\n    const record: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(value)) {\n      if (budget.left <= 0) {\n        record['…'] = TRUNCATED;\n        break;\n      }\n      budget.left -= k.length;\n      assignOwn(record, k, pruneValue(v, budget, depth + 1, ancestors));\n    }\n    return record;\n  } catch {\n    return TRUNCATED;\n  } finally {\n    ancestors.delete(value);\n  }\n}\n"],"mappings":";;;;;;AAoGA,SAAS,gBACP,SACA,WACyB;CACzB,IAAI,CAAC,SAAS,OAAO,CAAC;CACtB,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,GACzC,qBAAA,UAAU,KAAK,GAAG,UAAU,IAAI,EAAE,YAAY,CAAC,IAAI,eAAe,CAAC;CAErE,OAAO;AACT;;AAGA,SAAS,KAAK,QAAuB;CACnC,IAAI,UAAU,OAAQ,OAA4B,UAAU,YAC1D,OAA6B,OAAO,UAClCA,qBAAAA,cAAc,gCAAgC,KAAK,CACrD;AAEJ;AAOA,SAAS,gBAAgB,SAAsC;CAC7D,OAAO;EACL,SAASC,qBAAAA,aAAaC,qBAAAA,wBAAwB,QAAQ,aAAa;EACnE,aAAaD,qBAAAA,aAAaE,qBAAAA,6BAA6B,QAAQ,iBAAiB;CAClF;AACF;AAEA,SAAS,gBACP,KACA,SACA,SACA,EAAE,SAAS,WAAW,aAAa,YACV;;CACzB,MAAM,SAAkC;EACtC;EACA,UAAA,cAAQ,IAAI,YAAA,QAAA,gBAAA,KAAA,IAAA,KAAA,IAAA,YAAQ,YAAY,MAAK;EACrC,KAAKC,qBAAAA,eAAY,IAAI,OAAO,KAAK,QAAQ;EACzC,IAAI,IAAI,QAAA,cAAM,IAAI,YAAA,QAAA,gBAAA,KAAA,IAAA,KAAA,IAAA,YAAQ,kBAAiB;EAC3C,SAAS,gBAAgB,IAAI,SAAS,SAAS;CACjD;CAEA,IAAI,QAAQ,aACV,OAAO,OAAO,QAAQ,QAAQ,YAAY,GAAG,CAAC;CAGhD,OAAO;AACT;;;;AAOA,SAAgB,wBACd,QACA,UAA6B,CAAC,GAC2C;CACzE,MAAM,EACJ,MACA,SACA,cACA,eACA,eAAe,SACf,gBAAgB,QAChB,aAAa,SACb,yBAAyB,QACvB;CACJ,MAAM,WAAW,gBAAgB,OAAO;CACxC,MAAM,eAAeC,sBAAAA,oBAAoB,aAAa;CAEtD,OAAO,SAAS,sBACd,KACA,KACA,MACM;;EACN,IAAA,SAAA,QAAA,SAAA,KAAA,IAAA,KAAA,IAAI,KAAO,GAAG,GAAG;GACf,KAAK;GACL;EACF;EAEA,MAAM,UAAUC,sBAAAA,sBAAsB,KAAK,YAAY;EACvD,MAAM,UAAU,KAAK,IAAI;EACzB,MAAM,aAAa,gBAAgB,KAAK,SAAS,SAAS,QAAQ;EAGlE,IAAI,iBAAiB,UACnB,KACE,OAAO,SAAS,cAAc,mBAAmB;GAC/C,GAAG;GACH,GAAI,WAAW,IAAI,OAAO,EAAE,MAAM,aAAa,IAAI,MAAM,YAAY,EAAE,IAAI,CAAC;EAC9E,CAAC,CACH;EAUF,IAAI,YAAY;EAChB,MAAM,iBAAuB;GAC3B,IAAI,WAAW;GACf,YAAY;GAEZ,MAAM,WAAW,KAAK,IAAI,IAAI;GAC9B,MAAM,SAAS,IAAI,cAAc;GACjC,MAAM,QAAQ,UAAU,MAAM,aAAa;GAE3C,KACE,OAAO,SAAS,OAAO,qBAAqB;IAC1C,GAAG;IACH,YAAY;IACZ;GACF,CAAC,CACH;GAEA,IAAI,WAAW,wBACb,KACE,OAAO,KAAK,yBAAyB;IACnC,GAAG;IACH,YAAY;IACZ;IACA,WAAW;GACb,CAAC,CACH;EAEJ;EAEA,CAAA,YAAA,IAAI,UAAA,QAAA,cAAA,KAAA,KAAA,UAAA,KAAA,KAAO,UAAU,QAAQ;EAG7B,CAAA,aAAA,IAAI,UAAA,QAAA,eAAA,KAAA,KAAA,WAAA,KAAA,KAAO,SAAS,QAAQ;EAE5B,KAAK;CACP;AACF;;;;;;;;;AAgBA,SAAgB,oBAAoB,QAAqB,UAA6B,CAAC,GAAG;CACxF,MAAM,EACJ,MACA,eACA,eAAe,SACf,gBAAgB,QAChB,aAAa,SACb,yBAAyB,QACvB;CACJ,MAAM,WAAW,gBAAgB,OAAO;CACxC,MAAM,eAAeD,sBAAAA,oBAAoB,aAAa;CAEtD,SAAS,qBAAqB,SAA0B,OAAgB,MAAwB;EAC9F,QAAQ,QAAQ,cAAc,SAAkB,QAAiB,aAAyB;GACxF,MAAM,MAAM;GACZ,IAAA,SAAA,QAAA,SAAA,KAAA,IAAA,KAAA,IAAI,KAAO,GAAG,GAAG;IACf,SAAS;IACT;GACF;GAEA,MAAM,UAAUC,sBAAAA,sBAAsB,KAAK,YAAY;GACvD,IAAI,gBAAgB,KAAK,IAAI;GAE7B,IAAI,iBAAiB,UACnB,KACE,OAAO,SACL,cACA,mBACA,gBAAgB,KAAK,SAAS,SAAS,QAAQ,CACjD,CACF;GAEF,SAAS;EACX,CAAC;EAED,QAAQ,QAAQ,eAAe,SAAkB,OAAgB,aAAyB;GACxF,MAAM,MAAM;GACZ,IAAI,IAAI,kBAAkB,KAAA,GAAW;IACnC,SAAS;IACT;GACF;GAEA,MAAM,MAAM;GACZ,MAAM,WAAW,KAAK,IAAI,IAAI,IAAI;GAClC,MAAM,SAAS,IAAI,cAAc;GACjC,MAAM,UAAUA,sBAAAA,sBAAsB,KAAK,YAAY;GACvD,MAAM,QAAQ,UAAU,MAAM,aAAa;GAC3C,MAAM,aAAa,gBAAgB,KAAK,SAAS,SAAS,QAAQ;GAElE,KACE,OAAO,SAAS,OAAO,qBAAqB;IAC1C,GAAG;IACH,YAAY;IACZ;GACF,CAAC,CACH;GAEA,IAAI,WAAW,wBACb,KACE,OAAO,KAAK,yBAAyB;IACnC;IACA,KAAK,WAAW;IAChB,QAAQ,IAAI;IACZ;IACA,WAAW;GACb,CAAC,CACH;GAGF,SAAS;EACX,CAAC;EAED,KAAK;CACP;CAEA,OAAO,OAAO,OAAO,sBAAsB;GACxC,OAAO,IAAI,eAAe,IAAI;GAC9B,OAAO,IAAI,sBAAsB,IAAI;CACxC,CAAC;AACH;;;;;;AASA,SAAS,aAAa,MAAe,WAAW,MAAe;CAC7D,IAAI,OAAO,SAAS,UAClB,OAAO,KAAK,SAAS,WAAW,KAAK,MAAM,GAAG,QAAQ,IAAI,iBAAiB;CAE7E,IAAI,QAAQ,OAAO,SAAS,UAAU;EAEpC,IADYC,uBAAAA,gBAAgB,IACtB,CAAC,CAAC,UAAU,UAAU,OAAO;EACnC,OAAO,WAAW,MAAM,EAAE,MAAM,SAAS,GAAG,mBAAG,IAAI,IAAI,CAAC;CAC1D;CACA,OAAO;AACT;AAEA,MAAM,YAAY;AAClB,MAAM,kBAAkB;AAExB,SAAS,WACP,OACA,QACA,OACA,WACS;CACT,IAAI,OAAO,UAAU,UAAU;EAC7B,MAAM,MAAM,MAAM,MAAM,GAAG,KAAK,IAAI,GAAG,OAAO,IAAI,CAAC;EACnD,OAAO,QAAQ,IAAI;EACnB,OAAO,IAAI,SAAS,MAAM,SAAS,MAAM,YAAY;CACvD;CACA,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;EAC/C,OAAO,QAAQ;EACf,OAAO;CACT;CACA,IAAI,iBAAiB,MAAM;EACzB,OAAO,QAAQ;EACf,OAAO,OAAO,MAAM,MAAM,QAAQ,CAAC,IAAI,iBAAiB,MAAM,YAAY;CAC5E;CACA,IAAI,iBAAiB,eAAe,YAAY,OAAO,KAAK,GAAG;EAC7D,OAAO,QAAQ;EACf,OAAO,WAAW,MAAM,WAAW;CACrC;CACA,IAAI,iBAAiB,OAAO,OAAO;CACnC,IAAI,UAAU,IAAI,KAAK,KAAK,SAAS,iBAAiB,OAAO;CAC7D,UAAU,IAAI,KAAK;CACnB,IAAI;EACF,IAAI,MAAM,QAAQ,KAAK,KAAK,iBAAiB,OAAO,iBAAiB,KAAK;GACxE,MAAM,QAAmB,CAAC;GAC1B,KAAK,MAAM,QAAQ,iBAAiB,MAAM,MAAM,QAAQ,IAAI,OAAO;IACjE,IAAI,OAAO,QAAQ,GAAG;KACpB,MAAM,KAAK,SAAS;KACpB;IACF;IACA,MAAM,KAAK,WAAW,MAAM,QAAQ,QAAQ,GAAG,SAAS,CAAC;GAC3D;GACA,OAAO;EACT;EACA,MAAM,SAAU,MAA+B;EAC/C,IAAI,OAAO,WAAW,YAAY;GAChC,MAAM,OAAgB,OAAO,KAAK,KAAK;GACvC,IAAI,SAAS,OAAO,OAAO,WAAW,MAAM,QAAQ,QAAQ,GAAG,SAAS;EAC1E;EACA,MAAM,SAAkC,CAAC;EACzC,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,KAAK,GAAG;GAC1C,IAAI,OAAO,QAAQ,GAAG;IACpB,OAAO,OAAO;IACd;GACF;GACA,OAAO,QAAQ,EAAE;GACjB,qBAAA,UAAU,QAAQ,GAAG,WAAW,GAAG,QAAQ,QAAQ,GAAG,SAAS,CAAC;EAClE;EACA,OAAO;CACT,QAAQ;EACN,OAAO;CACT,UAAU;EACR,UAAU,OAAO,KAAK;CACxB;AACF"}
+{"version":3,"file":"middleware.js","names":["internalError","buildNameSet","DEFAULT_REDACT_HEADERS","DEFAULT_REDACT_QUERY_PARAMS","sanitizeUrl","resolveTraceHeaders","resolveRequestTraceId","stringifyForLog"],"sources":["../src/middleware/http-logger.ts"],"sourcesContent":["/**\n * HTTP request/response logging middleware — Morgan replacement.\n *\n * Fixes every documented Morgan bug:\n *  - statusCode always captured correctly, even for requests > 20 s\n *  - Logs request START (with traceId) and response FINISH (with duration)\n *  - Captures errors before and after response\n *  - Auto-redacts Authorization / Cookie / Set-Cookie headers\n *  - Slow-request warnings\n *  - Skip predicates for health-check routes / static assets\n *\n * @example Express\n * ```ts\n * import { createExpressMiddleware } from 'logixia/middleware';\n * app.use(createExpressMiddleware(logger));\n * ```\n *\n * @example Fastify\n * ```ts\n * import { createFastifyPlugin } from 'logixia/middleware';\n * await fastify.register(createFastifyPlugin(logger));\n * ```\n */\n\nimport type { IBaseLogger } from '../types';\nimport type { HttpRequestShape, HttpResponseShape } from '../types/http-shapes';\nimport { internalError } from '../utils/internal-log';\nimport { assignOwn } from '../utils/own-property';\nimport { resolveRequestTraceId, resolveTraceHeaders } from '../utils/request-trace';\nimport { stringifyForLog } from '../utils/safe-stringify';\nimport {\n  buildNameSet,\n  DEFAULT_REDACT_HEADERS,\n  DEFAULT_REDACT_QUERY_PARAMS,\n  redactUrlQuery as sanitizeUrl,\n} from '../utils/sensitive-names';\n\n// ── Shared types ─────────────────────────────────────────────────────────────\n\nexport interface HttpLoggerOptions {\n  /**\n   * Skip logging for a request. Called before any I/O.\n   * @example `skip: (req) => req.url === '/health'`\n   */\n  skip?: (req: IncomingRequest) => boolean;\n  /**\n   * Log request body (POST/PUT/PATCH). Capped at `bodyMaxBytes` (default: 4096).\n   * Redaction still applies to the captured body.\n   * Default: false.\n   */\n  logBody?: boolean;\n  /** Max bytes of body to capture. Default: 4096. */\n  bodyMaxBytes?: number;\n  /**\n   * Emit a WARN log when a request duration exceeds this threshold (ms).\n   * Default: 1000.\n   */\n  slowRequestThresholdMs?: number;\n  /**\n   * Additional fields to include in every log entry.\n   * @example `extraFields: (req) => ({ tenantId: req.headers['x-tenant-id'] })`\n   */\n  extraFields?: (req: IncomingRequest) => Record<string, unknown>;\n  /**\n   * Header name, or list of names tried in order, to read the trace ID from.\n   * Default: the library-wide list (`DEFAULT_TRACE_HEADERS`: traceparent,\n   * x-trace-id, x-request-id, x-correlation-id, trace-id).\n   * If none is present, `request.id` is used when it is not a framework counter,\n   * otherwise a UUID is generated and shared with the logixia context helpers.\n   */\n  traceIdHeader?: string | readonly string[];\n  /**\n   * Additional headers to redact from logged output. Merged with the defaults\n   * (authorization, cookie, set-cookie, x-api-key, proxy-authorization,\n   * x-auth-token, x-access-token, x-csrf-token, x-amz-security-token).\n   */\n  redactHeaders?: string[];\n  /**\n   * Additional query-string parameter names whose values are redacted from the\n   * logged URL. Merged with the defaults (token, access_token, refresh_token,\n   * code, password, secret, api_key, apikey, key, signature, sig, auth).\n   */\n  redactQueryParams?: string[];\n  /**\n   * Log level for request-start entries. Default: 'debug'.\n   * Set to 'silent' to suppress request-start logs entirely.\n   */\n  requestLevel?: string;\n  /** Log level for successful response entries. Default: 'info'. */\n  responseLevel?: string;\n  /** Log level for error responses (status ≥ 500). Default: 'error'. */\n  errorLevel?: string;\n}\n\n// Minimal structural types so we don't need @types/express / fastify in core\nexport type IncomingRequest = HttpRequestShape;\nexport type OutgoingResponse = HttpResponseShape;\n\n// ── Helpers ───────────────────────────────────────────────────────────────────\n\nfunction sanitizeHeaders(\n  headers: Record<string, string | string[] | undefined> | undefined,\n  redactSet: Set<string>\n): Record<string, unknown> {\n  if (!headers) return {};\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(headers)) {\n    assignOwn(out, k, redactSet.has(k.toLowerCase()) ? '[REDACTED]' : v);\n  }\n  return out;\n}\n\n/** Fire-and-forget a logger call; a failing log must never become an unhandled rejection. */\nfunction fire(result: unknown): void {\n  if (result && typeof (result as Promise<unknown>).catch === 'function') {\n    (result as Promise<unknown>).catch((error: unknown) =>\n      internalError('http-logger: log call failed', error)\n    );\n  }\n}\n\ninterface NameSets {\n  headers: Set<string>;\n  queryParams: Set<string>;\n}\n\nfunction resolveNameSets(options: HttpLoggerOptions): NameSets {\n  return {\n    headers: buildNameSet(DEFAULT_REDACT_HEADERS, options.redactHeaders),\n    queryParams: buildNameSet(DEFAULT_REDACT_QUERY_PARAMS, options.redactQueryParams),\n  };\n}\n\nfunction buildBaseFields(\n  req: IncomingRequest,\n  traceId: string,\n  options: HttpLoggerOptions,\n  { headers: redactSet, queryParams: paramSet }: NameSets\n): Record<string, unknown> {\n  const fields: Record<string, unknown> = {\n    traceId,\n    method: req.method?.toUpperCase() ?? 'UNKNOWN',\n    url: sanitizeUrl(req.url ?? '/', paramSet),\n    ip: req.ip ?? req.socket?.remoteAddress ?? 'unknown',\n    headers: sanitizeHeaders(req.headers, redactSet),\n  };\n\n  if (options.extraFields) {\n    Object.assign(fields, options.extraFields(req));\n  }\n\n  return fields;\n}\n\n// ── Express middleware ────────────────────────────────────────────────────────\n\n/**\n * Create an Express / Connect compatible middleware that replaces Morgan.\n */\nexport function createExpressMiddleware(\n  logger: IBaseLogger,\n  options: HttpLoggerOptions = {}\n): (req: IncomingRequest, res: OutgoingResponse, next: () => void) => void {\n  const {\n    skip,\n    logBody,\n    bodyMaxBytes,\n    traceIdHeader,\n    requestLevel = 'debug',\n    responseLevel = 'info',\n    errorLevel = 'error',\n    slowRequestThresholdMs = 1000,\n  } = options;\n  const nameSets = resolveNameSets(options);\n  const traceHeaders = resolveTraceHeaders(traceIdHeader);\n\n  return function logixiaHttpMiddleware(\n    req: IncomingRequest,\n    res: OutgoingResponse,\n    next: () => void\n  ): void {\n    if (skip?.(req)) {\n      next();\n      return;\n    }\n\n    const traceId = resolveRequestTraceId(req, traceHeaders);\n    const startMs = Date.now();\n    const baseFields = buildBaseFields(req, traceId, options, nameSets);\n\n    // Log request start\n    if (requestLevel !== 'silent') {\n      fire(\n        logger.logLevel(requestLevel, 'request started', {\n          ...baseFields,\n          ...(logBody && req.body ? { body: truncateBody(req.body, bodyMaxBytes) } : {}),\n        })\n      );\n    }\n\n    // Hook into the response 'finish' event — fires after headers + body are sent.\n    // This is what Morgan gets wrong for slow requests (it uses 'close' which may\n    // fire before the status code is set on some Node versions).\n    //\n    // BOTH 'finish' and 'close' fire on a normal response, so guard against\n    // logging the completion twice (which would duplicate the completed entry and\n    // the slow-request warning).\n    let completed = false;\n    const onFinish = (): void => {\n      if (completed) return;\n      completed = true;\n\n      const duration = Date.now() - startMs;\n      const status = res.statusCode ?? 0;\n      const level = status >= 500 ? errorLevel : responseLevel;\n\n      fire(\n        logger.logLevel(level, 'request completed', {\n          ...baseFields,\n          statusCode: status,\n          duration,\n        })\n      );\n\n      if (duration > slowRequestThresholdMs) {\n        fire(\n          logger.warn('slow request detected', {\n            ...baseFields,\n            statusCode: status,\n            duration,\n            threshold: slowRequestThresholdMs,\n          })\n        );\n      }\n    };\n\n    res.once?.('finish', onFinish);\n    // Fallback: also covers a client that disconnects before 'finish' fires. The\n    // `completed` guard ensures a normal finish+close pair logs only once.\n    res.once?.('close', onFinish);\n\n    next();\n  };\n}\n\n// ── Fastify plugin ─────────────────────────────────────────────────────────────\n\nexport interface FastifyInstance {\n  addHook: (name: string, fn: (req: unknown, reply: unknown, done: () => void) => void) => void;\n}\n\n/**\n * Create a Fastify plugin (a function you pass to `fastify.register()`).\n *\n * @example\n * ```ts\n * await fastify.register(createFastifyPlugin(logger, { slowRequestThresholdMs: 500 }));\n * ```\n */\nexport function createFastifyPlugin(logger: IBaseLogger, options: HttpLoggerOptions = {}) {\n  const {\n    skip,\n    traceIdHeader,\n    requestLevel = 'debug',\n    responseLevel = 'info',\n    errorLevel = 'error',\n    slowRequestThresholdMs = 1000,\n  } = options;\n  const nameSets = resolveNameSets(options);\n  const traceHeaders = resolveTraceHeaders(traceIdHeader);\n\n  function logixiaFastifyPlugin(fastify: FastifyInstance, _opts: unknown, done: () => void): void {\n    fastify.addHook('onRequest', (request: unknown, _reply: unknown, hookDone: () => void) => {\n      const req = request as IncomingRequest & { _logixiaStart?: number };\n      if (skip?.(req)) {\n        hookDone();\n        return;\n      }\n\n      const traceId = resolveRequestTraceId(req, traceHeaders);\n      req._logixiaStart = Date.now();\n\n      if (requestLevel !== 'silent') {\n        fire(\n          logger.logLevel(\n            requestLevel,\n            'request started',\n            buildBaseFields(req, traceId, options, nameSets)\n          )\n        );\n      }\n      hookDone();\n    });\n\n    fastify.addHook('onResponse', (request: unknown, reply: unknown, hookDone: () => void) => {\n      const req = request as IncomingRequest & { _logixiaStart?: number };\n      if (req._logixiaStart === undefined) {\n        hookDone();\n        return;\n      }\n\n      const rep = reply as { statusCode?: number };\n      const duration = Date.now() - req._logixiaStart;\n      const status = rep.statusCode ?? 0;\n      const traceId = resolveRequestTraceId(req, traceHeaders);\n      const level = status >= 500 ? errorLevel : responseLevel;\n      const baseFields = buildBaseFields(req, traceId, options, nameSets);\n\n      fire(\n        logger.logLevel(level, 'request completed', {\n          ...baseFields,\n          statusCode: status,\n          duration,\n        })\n      );\n\n      if (duration > slowRequestThresholdMs) {\n        fire(\n          logger.warn('slow request detected', {\n            traceId,\n            url: baseFields.url,\n            method: req.method,\n            duration,\n            threshold: slowRequestThresholdMs,\n          })\n        );\n      }\n\n      hookDone();\n    });\n\n    done();\n  }\n\n  return Object.assign(logixiaFastifyPlugin, {\n    [Symbol.for('skip-override')]: true,\n    [Symbol.for('fastify.display-name')]: 'logixia',\n  });\n}\n\n// ── Internal helpers ──────────────────────────────────────────────────────────\n\n/**\n * Bound the captured body without turning it into a string, so the logger's\n * path-based redaction still sees the original keys. Oversized structures are\n * pruned (extra keys/items dropped, long strings cut) rather than serialized.\n */\nfunction truncateBody(body: unknown, maxBytes = 4096): unknown {\n  if (typeof body === 'string') {\n    return body.length > maxBytes ? body.slice(0, maxBytes) + '…[truncated]' : body;\n  }\n  if (body && typeof body === 'object') {\n    const str = stringifyForLog(body);\n    if (str.length <= maxBytes) return body;\n    return pruneValue(body, { left: maxBytes }, 0, new Set());\n  }\n  return body;\n}\n\nconst TRUNCATED = '…[truncated]';\nconst MAX_PRUNE_DEPTH = 8;\n\nfunction pruneValue(\n  value: unknown,\n  budget: { left: number },\n  depth: number,\n  ancestors: Set<object>\n): unknown {\n  if (typeof value === 'string') {\n    const cut = value.slice(0, Math.max(0, budget.left));\n    budget.left -= cut.length;\n    return cut.length < value.length ? cut + TRUNCATED : cut;\n  }\n  if (value === null || typeof value !== 'object') {\n    budget.left -= 8;\n    return value;\n  }\n  if (value instanceof Date) {\n    budget.left -= 24;\n    return Number.isNaN(value.getTime()) ? 'Invalid Date' : value.toISOString();\n  }\n  if (value instanceof ArrayBuffer || ArrayBuffer.isView(value)) {\n    budget.left -= 16;\n    return `[Buffer ${value.byteLength} bytes]`;\n  }\n  if (value instanceof Error) return value;\n  if (ancestors.has(value) || depth >= MAX_PRUNE_DEPTH) return TRUNCATED;\n  ancestors.add(value);\n  try {\n    if (Array.isArray(value) || value instanceof Set || value instanceof Map) {\n      const items: unknown[] = [];\n      for (const item of value instanceof Map ? value.entries() : value) {\n        if (budget.left <= 0) {\n          items.push(TRUNCATED);\n          break;\n        }\n        items.push(pruneValue(item, budget, depth + 1, ancestors));\n      }\n      return items;\n    }\n    const toJSON = (value as { toJSON?: unknown }).toJSON;\n    if (typeof toJSON === 'function') {\n      const json: unknown = toJSON.call(value);\n      if (json !== value) return pruneValue(json, budget, depth + 1, ancestors);\n    }\n    const record: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(value)) {\n      if (budget.left <= 0) {\n        record['…'] = TRUNCATED;\n        break;\n      }\n      budget.left -= k.length;\n      assignOwn(record, k, pruneValue(v, budget, depth + 1, ancestors));\n    }\n    return record;\n  } catch {\n    return TRUNCATED;\n  } finally {\n    ancestors.delete(value);\n  }\n}\n"],"mappings":";;;;;;AAoGA,SAAS,gBACP,SACA,WACyB;CACzB,IAAI,CAAC,SAAS,OAAO,CAAC;CACtB,MAAM,MAA+B,CAAC;CACtC,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,OAAO,GACzC,wBAAA,UAAU,KAAK,GAAG,UAAU,IAAI,EAAE,YAAY,CAAC,IAAI,eAAe,CAAC;CAErE,OAAO;AACT;;AAGA,SAAS,KAAK,QAAuB;CACnC,IAAI,UAAU,OAAQ,OAA4B,UAAU,YAC1D,OAA6B,OAAO,UAClCA,qBAAAA,cAAc,gCAAgC,KAAK,CACrD;AAEJ;AAOA,SAAS,gBAAgB,SAAsC;CAC7D,OAAO;EACL,SAASC,wBAAAA,aAAaC,wBAAAA,wBAAwB,QAAQ,aAAa;EACnE,aAAaD,wBAAAA,aAAaE,wBAAAA,6BAA6B,QAAQ,iBAAiB;CAClF;AACF;AAEA,SAAS,gBACP,KACA,SACA,SACA,EAAE,SAAS,WAAW,aAAa,YACV;;CACzB,MAAM,SAAkC;EACtC;EACA,UAAA,cAAQ,IAAI,YAAA,QAAA,gBAAA,KAAA,IAAA,KAAA,IAAA,YAAQ,YAAY,MAAK;EACrC,KAAKC,wBAAAA,eAAY,IAAI,OAAO,KAAK,QAAQ;EACzC,IAAI,IAAI,QAAA,cAAM,IAAI,YAAA,QAAA,gBAAA,KAAA,IAAA,KAAA,IAAA,YAAQ,kBAAiB;EAC3C,SAAS,gBAAgB,IAAI,SAAS,SAAS;CACjD;CAEA,IAAI,QAAQ,aACV,OAAO,OAAO,QAAQ,QAAQ,YAAY,GAAG,CAAC;CAGhD,OAAO;AACT;;;;AAOA,SAAgB,wBACd,QACA,UAA6B,CAAC,GAC2C;CACzE,MAAM,EACJ,MACA,SACA,cACA,eACA,eAAe,SACf,gBAAgB,QAChB,aAAa,SACb,yBAAyB,QACvB;CACJ,MAAM,WAAW,gBAAgB,OAAO;CACxC,MAAM,eAAeC,sBAAAA,oBAAoB,aAAa;CAEtD,OAAO,SAAS,sBACd,KACA,KACA,MACM;;EACN,IAAA,SAAA,QAAA,SAAA,KAAA,IAAA,KAAA,IAAI,KAAO,GAAG,GAAG;GACf,KAAK;GACL;EACF;EAEA,MAAM,UAAUC,sBAAAA,sBAAsB,KAAK,YAAY;EACvD,MAAM,UAAU,KAAK,IAAI;EACzB,MAAM,aAAa,gBAAgB,KAAK,SAAS,SAAS,QAAQ;EAGlE,IAAI,iBAAiB,UACnB,KACE,OAAO,SAAS,cAAc,mBAAmB;GAC/C,GAAG;GACH,GAAI,WAAW,IAAI,OAAO,EAAE,MAAM,aAAa,IAAI,MAAM,YAAY,EAAE,IAAI,CAAC;EAC9E,CAAC,CACH;EAUF,IAAI,YAAY;EAChB,MAAM,iBAAuB;GAC3B,IAAI,WAAW;GACf,YAAY;GAEZ,MAAM,WAAW,KAAK,IAAI,IAAI;GAC9B,MAAM,SAAS,IAAI,cAAc;GACjC,MAAM,QAAQ,UAAU,MAAM,aAAa;GAE3C,KACE,OAAO,SAAS,OAAO,qBAAqB;IAC1C,GAAG;IACH,YAAY;IACZ;GACF,CAAC,CACH;GAEA,IAAI,WAAW,wBACb,KACE,OAAO,KAAK,yBAAyB;IACnC,GAAG;IACH,YAAY;IACZ;IACA,WAAW;GACb,CAAC,CACH;EAEJ;EAEA,CAAA,YAAA,IAAI,UAAA,QAAA,cAAA,KAAA,KAAA,UAAA,KAAA,KAAO,UAAU,QAAQ;EAG7B,CAAA,aAAA,IAAI,UAAA,QAAA,eAAA,KAAA,KAAA,WAAA,KAAA,KAAO,SAAS,QAAQ;EAE5B,KAAK;CACP;AACF;;;;;;;;;AAgBA,SAAgB,oBAAoB,QAAqB,UAA6B,CAAC,GAAG;CACxF,MAAM,EACJ,MACA,eACA,eAAe,SACf,gBAAgB,QAChB,aAAa,SACb,yBAAyB,QACvB;CACJ,MAAM,WAAW,gBAAgB,OAAO;CACxC,MAAM,eAAeD,sBAAAA,oBAAoB,aAAa;CAEtD,SAAS,qBAAqB,SAA0B,OAAgB,MAAwB;EAC9F,QAAQ,QAAQ,cAAc,SAAkB,QAAiB,aAAyB;GACxF,MAAM,MAAM;GACZ,IAAA,SAAA,QAAA,SAAA,KAAA,IAAA,KAAA,IAAI,KAAO,GAAG,GAAG;IACf,SAAS;IACT;GACF;GAEA,MAAM,UAAUC,sBAAAA,sBAAsB,KAAK,YAAY;GACvD,IAAI,gBAAgB,KAAK,IAAI;GAE7B,IAAI,iBAAiB,UACnB,KACE,OAAO,SACL,cACA,mBACA,gBAAgB,KAAK,SAAS,SAAS,QAAQ,CACjD,CACF;GAEF,SAAS;EACX,CAAC;EAED,QAAQ,QAAQ,eAAe,SAAkB,OAAgB,aAAyB;GACxF,MAAM,MAAM;GACZ,IAAI,IAAI,kBAAkB,KAAA,GAAW;IACnC,SAAS;IACT;GACF;GAEA,MAAM,MAAM;GACZ,MAAM,WAAW,KAAK,IAAI,IAAI,IAAI;GAClC,MAAM,SAAS,IAAI,cAAc;GACjC,MAAM,UAAUA,sBAAAA,sBAAsB,KAAK,YAAY;GACvD,MAAM,QAAQ,UAAU,MAAM,aAAa;GAC3C,MAAM,aAAa,gBAAgB,KAAK,SAAS,SAAS,QAAQ;GAElE,KACE,OAAO,SAAS,OAAO,qBAAqB;IAC1C,GAAG;IACH,YAAY;IACZ;GACF,CAAC,CACH;GAEA,IAAI,WAAW,wBACb,KACE,OAAO,KAAK,yBAAyB;IACnC;IACA,KAAK,WAAW;IAChB,QAAQ,IAAI;IACZ;IACA,WAAW;GACb,CAAC,CACH;GAGF,SAAS;EACX,CAAC;EAED,KAAK;CACP;CAEA,OAAO,OAAO,OAAO,sBAAsB;GACxC,OAAO,IAAI,eAAe,IAAI;GAC9B,OAAO,IAAI,sBAAsB,IAAI;CACxC,CAAC;AACH;;;;;;AASA,SAAS,aAAa,MAAe,WAAW,MAAe;CAC7D,IAAI,OAAO,SAAS,UAClB,OAAO,KAAK,SAAS,WAAW,KAAK,MAAM,GAAG,QAAQ,IAAI,iBAAiB;CAE7E,IAAI,QAAQ,OAAO,SAAS,UAAU;EAEpC,IADYC,uBAAAA,gBAAgB,IACtB,CAAC,CAAC,UAAU,UAAU,OAAO;EACnC,OAAO,WAAW,MAAM,EAAE,MAAM,SAAS,GAAG,mBAAG,IAAI,IAAI,CAAC;CAC1D;CACA,OAAO;AACT;AAEA,MAAM,YAAY;AAClB,MAAM,kBAAkB;AAExB,SAAS,WACP,OACA,QACA,OACA,WACS;CACT,IAAI,OAAO,UAAU,UAAU;EAC7B,MAAM,MAAM,MAAM,MAAM,GAAG,KAAK,IAAI,GAAG,OAAO,IAAI,CAAC;EACnD,OAAO,QAAQ,IAAI;EACnB,OAAO,IAAI,SAAS,MAAM,SAAS,MAAM,YAAY;CACvD;CACA,IAAI,UAAU,QAAQ,OAAO,UAAU,UAAU;EAC/C,OAAO,QAAQ;EACf,OAAO;CACT;CACA,IAAI,iBAAiB,MAAM;EACzB,OAAO,QAAQ;EACf,OAAO,OAAO,MAAM,MAAM,QAAQ,CAAC,IAAI,iBAAiB,MAAM,YAAY;CAC5E;CACA,IAAI,iBAAiB,eAAe,YAAY,OAAO,KAAK,GAAG;EAC7D,OAAO,QAAQ;EACf,OAAO,WAAW,MAAM,WAAW;CACrC;CACA,IAAI,iBAAiB,OAAO,OAAO;CACnC,IAAI,UAAU,IAAI,KAAK,KAAK,SAAS,iBAAiB,OAAO;CAC7D,UAAU,IAAI,KAAK;CACnB,IAAI;EACF,IAAI,MAAM,QAAQ,KAAK,KAAK,iBAAiB,OAAO,iBAAiB,KAAK;GACxE,MAAM,QAAmB,CAAC;GAC1B,KAAK,MAAM,QAAQ,iBAAiB,MAAM,MAAM,QAAQ,IAAI,OAAO;IACjE,IAAI,OAAO,QAAQ,GAAG;KACpB,MAAM,KAAK,SAAS;KACpB;IACF;IACA,MAAM,KAAK,WAAW,MAAM,QAAQ,QAAQ,GAAG,SAAS,CAAC;GAC3D;GACA,OAAO;EACT;EACA,MAAM,SAAU,MAA+B;EAC/C,IAAI,OAAO,WAAW,YAAY;GAChC,MAAM,OAAgB,OAAO,KAAK,KAAK;GACvC,IAAI,SAAS,OAAO,OAAO,WAAW,MAAM,QAAQ,QAAQ,GAAG,SAAS;EAC1E;EACA,MAAM,SAAkC,CAAC;EACzC,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,KAAK,GAAG;GAC1C,IAAI,OAAO,QAAQ,GAAG;IACpB,OAAO,OAAO;IACd;GACF;GACA,OAAO,QAAQ,EAAE;GACjB,wBAAA,UAAU,QAAQ,GAAG,WAAW,GAAG,QAAQ,QAAQ,GAAG,SAAS,CAAC;EAClE;EACA,OAAO;CACT,QAAQ;EACN,OAAO;CACT,UAAU;EACR,UAAU,OAAO,KAAK;CACxB;AACF"}

package/dist/middleware.mjs

@@ -1,7 +1,7 @@
-import { t as assignOwn } from "./own-property-CjFw9qwZ.mjs";
+import { a as buildNameSet, l as assignOwn, n as DEFAULT_REDACT_QUERY_PARAMS, o as redactUrlQuery, t as DEFAULT_REDACT_HEADERS } from "./sensitive-names-o__1PUUR.mjs";
 import { n as resolveTraceHeaders, t as resolveRequestTraceId } from "./request-trace-BgNykH9M.mjs";
-import { a as DEFAULT_REDACT_QUERY_PARAMS, c as buildNameSet, i as DEFAULT_REDACT_HEADERS, l as redactUrlQuery, t as internalError } from "./internal-log-Bg4V1cPg.mjs";
-import { i as stringifyForLog } from "./safe-stringify-B5p5ktFe.mjs";
+import { t as internalError } from "./internal-log-Cy5nF1ZL.mjs";
+import { i as stringifyForLog } from "./safe-stringify--7gbe95n.mjs";
 // src/middleware/http-logger.ts
 function sanitizeHeaders(headers, redactSet) {
 	if (!headers) return {};

package/dist/nest.d.mts

@@ -1,5 +1,5 @@
-import { A as TraceIdConfig, b as LoggerConfig, y as LogLevelString } from "./index-BSTtFcQ6.mjs";
-import { t as LogixiaLogger } from "./logitron-logger-D22Yb61K.mjs";
+import { A as TraceIdConfig, b as LoggerConfig, y as LogLevelString } from "./index-BAkPHp5D.mjs";
+import { t as LogixiaLogger } from "./logitron-logger-sYuk8fOb.mjs";
 import { ArgumentsHost, CallHandler, ExceptionFilter, ExecutionContext, InjectionToken, LoggerService, MiddlewareConsumer, ModuleMetadata, NestInterceptor, NestMiddleware, NestModule, OptionalFactoryDependency, Type } from "@nestjs/common";
 import { Observable } from "rxjs";
 import { NextFunction, Request, Response } from "express";
@@ -455,6 +455,13 @@ interface LogixiaExceptionFilterOptions {
    * @default false
    */
   exposeCause?: boolean;
+  /**
+   * Extra query parameter names whose values are replaced with `[REDACTED]` in the
+   * logged `url`, the response `path`, and any copy of those values inside the error
+   * message, stack or details. Merged with the defaults (`token`, `code`, `password`,
+   * `api_key`, …) and `LoggerConfig.redact.queryParams`.
+   */
+  redactQueryParams?: readonly string[];
 }
 /** Injection token for {@link LogixiaExceptionFilterOptions}. */
 export declare const LOGIXIA_EXCEPTION_FILTER_OPTIONS = "LOGIXIA_EXCEPTION_FILTER_OPTIONS";
@@ -462,6 +469,7 @@ export declare class LogixiaExceptionFilter implements ExceptionFilter {
   private readonly _logger;
   private readonly _traceConfig;
   private readonly _options;
+  private readonly _redactParams;
   constructor(logger?: LogixiaLoggerService, loggerConfig?: Partial<LoggerConfig>, options?: LogixiaExceptionFilterOptions);
   catch(exception: unknown, host: ArgumentsHost): void;
 }
@@ -475,7 +483,8 @@ declare global {
 export declare class TraceMiddleware implements NestMiddleware {
   private readonly config?;
   private readonly ctx;
-  constructor(config?: TraceIdConfig | undefined);
+  private readonly redactParams;
+  constructor(config?: TraceIdConfig | undefined, redactQueryParams?: readonly string[]);
   use(req: Request, res: Response, next: NextFunction): void;
 }
 /**

package/dist/nest.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"nest.d.mts","names":[],"sources":["../src/core/logitron-nestjs.service.ts","../src/core/kafka-trace.interceptor.ts","../src/core/websocket-trace.interceptor.ts","../src/core/logitron-logger.module.ts","../src/core/nestjs-extras.ts","../src/core/trace.middleware.ts","../src/nest.ts"],"mappings":";;;;;;;;;;KAiCK;;;;;;;;;KAWA,0BAA0B,gBAAgB,sCACnC,WAAW,WAAW,UAAU,gCAAgC,cACxE,iBACA,OAAO,4BACJ;;;;;;;;YAUK,yBAAyB,UAAU,aAAa,2BAC1D;EAA4B,cAAc;IACtC,UAAU,yBACR,uBAAuB,0BAA0B,KACjD,uBACF;;;;KAKD,yBAAyB,KAAK;EAAY;IAAiB,eAAe;;IAC3E,UAAU,yBACR,cAAc,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAmCpB,mBAAmB,mBAAmB,2BAChD,mCAEI,KAAK,mBAAmB,QAAQ,GAAG,yBAAyB,yBAAyB,MACnF,iBAAiB,OAAO,4BAA4B;qBAS/C,gCAAgC;GAE1C;UAEO;UACA;UACA;EAEI,YAAA,SAAS;UA+Cb;;;;;;;EAyBR,IAAI,kBAAkB;;;;;;EAYhB,KAAK,iBAAiB,OAAO,0BAA0B;;;;;;;EAY7D,MAAM,kBAAkB,OAAO,MAAM,0BAA0B;;;;;;EAO/D,MAAM,kBAAkB,gBAAgB;;;;;;EAoCxC,KAAK,iBAAiB,MAAM,0BAA0B;;;;;;EAOtD,KAAK,kBAAkB;;;;;;EAmBvB,MAAM,iBAAiB,MAAM,0BAA0B;;;;;;EAOvD,MAAM,kBAAkB;;;;;;;EAoBxB,QAAQ,iBAAiB,MAAM,0BAA0B;;;;;;EAOzD,QAAQ,kBAAkB;;;;EAoBpB,MAAM,iBAAiB,OAAO,0BAA0B;;;;EAO9D,SAAS,eAAe,iBAAiB,OAAO,0BAA0B;EAM1E,KAAK;EAIC,QAAQ,gBAAgB;EAIxB,UAAU,GAAG,eAAe,UAAU,QAAQ,KAAK,QAAQ;EAMjE,WAAW;EAMX;EAIA,SAAS,OAAO;EAIhB,YAAY;EAMZ,MAAM,iBAAiB,OAAO,0BAA0B;EASxD;;MAKI;EAIE,SAAS;SAIR,OAAO,UAAU,aAAa,yBACnC,SAAS,IACR,yBAAyB;EAI5B,aAAa;UAML;UAUA;;;;;;;;;;;UCjaO;;EAEf;;EAEA;;EAEA;;qBAIW,iCAAiC;mBA+BzB;;;;;kBA1BH,SAAS;;SAOlB;mBAMU;mBACA;;;;;;;;;EAWf,YAAA,SAAS,eACQ;EAcnB,UAAU,SAAS,kBAAkB,MAAM,cAAc;;qBChE9C,qCAAqC;mBAC/B;mBACA;EAEL,YAAA,SAAS;EAcrB,UAAU,SAAS,kBAAkB,MAAM,cAAc;;qBCL9C;qBACA;qBACA;iBAcI,4BAA4B,KAAK;EAChD,cAAc,KAAK;EACnB,WAAW,KAAK;EAChB,iBAAiB,oBAAoB,QAAQ,QAAQ,iBAAiB,QAAQ;EAC9E,SAAS,MAAM,iBAAiB;;iBAIjB;EACf,wBAAwB,QAAQ,QAAQ,iBAAiB,QAAQ;;;;;qBAOtD,+BAA+B;UAClC;iBACO;;;;;;SAWR,eAAe;;;;;;;;;;;;;SAcf,iBAAiB,SAAS;;SAY1B;;;;;;;;;;;;;;;;;;;SAsBA,mBAAmB;EAI1B,UAAU,UAAU;;;;SAkCb,QAAQ,SAAS,QAAQ;;;;;;;;;;;;;;MAsBG,aAAA,cAAA,QAAQ,kBAAa;;;;;MAmCtB,aAAA,aAAA,8BAAyB;;;;;MAMzB,aAAA,aAAA,8BAAyB;;;;;;;;;;SAkBpD,aAAa,SAAS;;;;;MAjMN,gBAAA,oBAAc,QAAQ,QAAQ,iBAAiB,QAAQ;;;;MAuTvC,aAAA,gBAAA,0BAAqB,QAAA,QAAA,aAAA;;;;;;;MA9GzB,aAAA,cAAA,QAAQ,kBAAa;;;;MASrB,aAAA,cAAA,QAAQ,kBAAa;;;;MAqCtB,aAAA,aAAA,8BAAyB;;;;MAMzB,aAAA,aAAA,8BAAyB;;;;;;;;;SAkBpD,WAAW;;;;MAOe,aAAA,YAAA,yBAAoB;;;;;iBAUtC;iBAaA;;;;;;;;;;;;;;;;;;qBCnRJ,eAAgB,qBAAmB;UAO/B;;;;;EAKf,QAAQ;;;;;;EAMR;;;;;EAKA;;;;;EAKA;;;;EAIA;;;;;;;;;;;;;;;;;wBAkBc,UAAU,UAAS,mBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAkJ1C;;;;;EAKf;;;;;EAKA;;;qBAIW;qBAGA,kCAAkC;mBAC5B;mBACA;mBACA;EAKf,YAAA,SAAS,sBAGT,eAAe,QAAQ,eAGvB,UAAU;EAaZ,MAAM,oBAAoB,MAAM;;QCnQ1B;YACI;cACE;MACR;;;;qBAOO,2BAA2B;mBAGG;mBAFxB;EAEwB,YAAA,SAAS;EAqBlD,IAAI,KAAK,SAAS,KAAK,UAAU,MAAM;;;;;;;wBCjDzB,oBAAoB,SAAS,QAAQ,gBAAgB"}
+{"version":3,"file":"nest.d.mts","names":[],"sources":["../src/core/logitron-nestjs.service.ts","../src/core/kafka-trace.interceptor.ts","../src/core/websocket-trace.interceptor.ts","../src/core/logitron-logger.module.ts","../src/core/nestjs-extras.ts","../src/core/trace.middleware.ts","../src/nest.ts"],"mappings":";;;;;;;;;;KAiCK;;;;;;;;;KAWA,0BAA0B,gBAAgB,sCACnC,WAAW,WAAW,UAAU,gCAAgC,cACxE,iBACA,OAAO,4BACJ;;;;;;;;YAUK,yBAAyB,UAAU,aAAa,2BAC1D;EAA4B,cAAc;IACtC,UAAU,yBACR,uBAAuB,0BAA0B,KACjD,uBACF;;;;KAKD,yBAAyB,KAAK;EAAY;IAAiB,eAAe;;IAC3E,UAAU,yBACR,cAAc,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAmCpB,mBAAmB,mBAAmB,2BAChD,mCAEI,KAAK,mBAAmB,QAAQ,GAAG,yBAAyB,yBAAyB,MACnF,iBAAiB,OAAO,4BAA4B;qBAS/C,gCAAgC;GAE1C;UAEO;UACA;UACA;EAEI,YAAA,SAAS;UA+Cb;;;;;;;EAyBR,IAAI,kBAAkB;;;;;;EAYhB,KAAK,iBAAiB,OAAO,0BAA0B;;;;;;;EAY7D,MAAM,kBAAkB,OAAO,MAAM,0BAA0B;;;;;;EAO/D,MAAM,kBAAkB,gBAAgB;;;;;;EAoCxC,KAAK,iBAAiB,MAAM,0BAA0B;;;;;;EAOtD,KAAK,kBAAkB;;;;;;EAmBvB,MAAM,iBAAiB,MAAM,0BAA0B;;;;;;EAOvD,MAAM,kBAAkB;;;;;;;EAoBxB,QAAQ,iBAAiB,MAAM,0BAA0B;;;;;;EAOzD,QAAQ,kBAAkB;;;;EAoBpB,MAAM,iBAAiB,OAAO,0BAA0B;;;;EAO9D,SAAS,eAAe,iBAAiB,OAAO,0BAA0B;EAM1E,KAAK;EAIC,QAAQ,gBAAgB;EAIxB,UAAU,GAAG,eAAe,UAAU,QAAQ,KAAK,QAAQ;EAMjE,WAAW;EAMX;EAIA,SAAS,OAAO;EAIhB,YAAY;EAMZ,MAAM,iBAAiB,OAAO,0BAA0B;EASxD;;MAKI;EAIE,SAAS;SAIR,OAAO,UAAU,aAAa,yBACnC,SAAS,IACR,yBAAyB;EAI5B,aAAa;UAML;UAUA;;;;;;;;;;;UCjaO;;EAEf;;EAEA;;EAEA;;qBAIW,iCAAiC;mBA+BzB;;;;;kBA1BH,SAAS;;SAOlB;mBAMU;mBACA;;;;;;;;;EAWf,YAAA,SAAS,eACQ;EAcnB,UAAU,SAAS,kBAAkB,MAAM,cAAc;;qBChE9C,qCAAqC;mBAC/B;mBACA;EAEL,YAAA,SAAS;EAcrB,UAAU,SAAS,kBAAkB,MAAM,cAAc;;qBCL9C;qBACA;qBACA;iBAcI,4BAA4B,KAAK;EAChD,cAAc,KAAK;EACnB,WAAW,KAAK;EAChB,iBAAiB,oBAAoB,QAAQ,QAAQ,iBAAiB,QAAQ;EAC9E,SAAS,MAAM,iBAAiB;;iBAIjB;EACf,wBAAwB,QAAQ,QAAQ,iBAAiB,QAAQ;;;;;qBAOtD,+BAA+B;UAClC;iBACO;;;;;;SAWR,eAAe;;;;;;;;;;;;;SAcf,iBAAiB,SAAS;;SAY1B;;;;;;;;;;;;;;;;;;;SAsBA,mBAAmB;EAI1B,UAAU,UAAU;;;;SAqCb,QAAQ,SAAS,QAAQ;;;;;;;;;;;;;;MAsBG,aAAA,cAAA,QAAQ,kBAAa;;;;;MAmCtB,aAAA,aAAA,8BAAyB;;;;;MAMzB,aAAA,aAAA,8BAAyB;;;;;;;;;;SAkBpD,aAAa,SAAS;;;;;MApMN,gBAAA,oBAAc,QAAQ,QAAQ,iBAAiB,QAAQ;;;;MA0TvC,aAAA,gBAAA,0BAAqB,QAAA,QAAA,aAAA;;;;;;;MA9GzB,aAAA,cAAA,QAAQ,kBAAa;;;;MASrB,aAAA,cAAA,QAAQ,kBAAa;;;;MAqCtB,aAAA,aAAA,8BAAyB;;;;MAMzB,aAAA,aAAA,8BAAyB;;;;;;;;;SAkBpD,WAAW;;;;MAOe,aAAA,YAAA,yBAAoB;;;;;iBAUtC;iBAaA;;;;;;;;;;;;;;;;;;qBC5QJ,eAAgB,qBAAmB;UAO/B;;;;;EAKf,QAAQ;;;;;;EAMR;;;;;EAKA;;;;;EAKA;;;;EAIA;;;;;;;;;;;;;;;;;wBAkBc,UAAU,UAAS,mBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAkJ1C;;;;;EAKf;;;;;EAKA;;;;;;;EAOA;;;qBAIW;qBAuGA,kCAAkC;mBAC5B;mBACA;mBACA;mBACA;EAKf,YAAA,SAAS,sBAGT,eAAe,QAAQ,eAGvB,UAAU;EAiBZ,MAAM,oBAAoB,MAAM;;QCxX1B;YACI;cACE;MACR;;;;qBAmBO,2BAA2B;mBAKP;mBAJd;mBACA;EAGc,YAAA,SAAS,2BAGtC;EAuBF,IAAI,KAAK,SAAS,KAAK,UAAU,MAAM;;;;;;;wBCzEzB,oBAAoB,SAAS,QAAQ,gBAAgB"}

package/dist/nest.d.ts

@@ -1,5 +1,5 @@
-import { A as TraceIdConfig, b as LoggerConfig, y as LogLevelString } from "./index-CFDGkI8n.js";
-import { t as LogixiaLogger } from "./logitron-logger-D_MYYrQt.js";
+import { A as TraceIdConfig, b as LoggerConfig, y as LogLevelString } from "./index-e7LowmAu.js";
+import { t as LogixiaLogger } from "./logitron-logger-Qh3y9-WH.js";
 import { ArgumentsHost, CallHandler, ExceptionFilter, ExecutionContext, InjectionToken, LoggerService, MiddlewareConsumer, ModuleMetadata, NestInterceptor, NestMiddleware, NestModule, OptionalFactoryDependency, Type } from "@nestjs/common";
 import { Observable } from "rxjs";
 import { NextFunction, Request, Response } from "express";
@@ -455,6 +455,13 @@ interface LogixiaExceptionFilterOptions {
    * @default false
    */
   exposeCause?: boolean;
+  /**
+   * Extra query parameter names whose values are replaced with `[REDACTED]` in the
+   * logged `url`, the response `path`, and any copy of those values inside the error
+   * message, stack or details. Merged with the defaults (`token`, `code`, `password`,
+   * `api_key`, …) and `LoggerConfig.redact.queryParams`.
+   */
+  redactQueryParams?: readonly string[];
 }
 /** Injection token for {@link LogixiaExceptionFilterOptions}. */
 export declare const LOGIXIA_EXCEPTION_FILTER_OPTIONS = "LOGIXIA_EXCEPTION_FILTER_OPTIONS";
@@ -462,6 +469,7 @@ export declare class LogixiaExceptionFilter implements ExceptionFilter {
   private readonly _logger;
   private readonly _traceConfig;
   private readonly _options;
+  private readonly _redactParams;
   constructor(logger?: LogixiaLoggerService, loggerConfig?: Partial<LoggerConfig>, options?: LogixiaExceptionFilterOptions);
   catch(exception: unknown, host: ArgumentsHost): void;
 }
@@ -475,7 +483,8 @@ declare global {
 export declare class TraceMiddleware implements NestMiddleware {
   private readonly config?;
   private readonly ctx;
-  constructor(config?: TraceIdConfig | undefined);
+  private readonly redactParams;
+  constructor(config?: TraceIdConfig | undefined, redactQueryParams?: readonly string[]);
   use(req: Request, res: Response, next: NextFunction): void;
 }
 /**

package/dist/nest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"nest.d.ts","names":[],"sources":["../src/core/logitron-nestjs.service.ts","../src/core/kafka-trace.interceptor.ts","../src/core/websocket-trace.interceptor.ts","../src/core/logitron-logger.module.ts","../src/core/nestjs-extras.ts","../src/core/trace.middleware.ts","../src/nest.ts"],"mappings":";;;;;;;;;;KAiCK;;;;;;;;;KAWA,0BAA0B,gBAAgB,sCACnC,WAAW,WAAW,UAAU,gCAAgC,cACxE,iBACA,OAAO,4BACJ;;;;;;;;YAUK,yBAAyB,UAAU,aAAa,2BAC1D;EAA4B,cAAc;IACtC,UAAU,yBACR,uBAAuB,0BAA0B,KACjD,uBACF;;;;KAKD,yBAAyB,KAAK;EAAY;IAAiB,eAAe;;IAC3E,UAAU,yBACR,cAAc,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAmCpB,mBAAmB,mBAAmB,2BAChD,mCAEI,KAAK,mBAAmB,QAAQ,GAAG,yBAAyB,yBAAyB,MACnF,iBAAiB,OAAO,4BAA4B;qBAS/C,gCAAgC;GAE1C;UAEO;UACA;UACA;EAEI,YAAA,SAAS;UA+Cb;;;;;;;EAyBR,IAAI,kBAAkB;;;;;;EAYhB,KAAK,iBAAiB,OAAO,0BAA0B;;;;;;;EAY7D,MAAM,kBAAkB,OAAO,MAAM,0BAA0B;;;;;;EAO/D,MAAM,kBAAkB,gBAAgB;;;;;;EAoCxC,KAAK,iBAAiB,MAAM,0BAA0B;;;;;;EAOtD,KAAK,kBAAkB;;;;;;EAmBvB,MAAM,iBAAiB,MAAM,0BAA0B;;;;;;EAOvD,MAAM,kBAAkB;;;;;;;EAoBxB,QAAQ,iBAAiB,MAAM,0BAA0B;;;;;;EAOzD,QAAQ,kBAAkB;;;;EAoBpB,MAAM,iBAAiB,OAAO,0BAA0B;;;;EAO9D,SAAS,eAAe,iBAAiB,OAAO,0BAA0B;EAM1E,KAAK;EAIC,QAAQ,gBAAgB;EAIxB,UAAU,GAAG,eAAe,UAAU,QAAQ,KAAK,QAAQ;EAMjE,WAAW;EAMX;EAIA,SAAS,OAAO;EAIhB,YAAY;EAMZ,MAAM,iBAAiB,OAAO,0BAA0B;EASxD;;MAKI;EAIE,SAAS;SAIR,OAAO,UAAU,aAAa,yBACnC,SAAS,IACR,yBAAyB;EAI5B,aAAa;UAML;UAUA;;;;;;;;;;;UCjaO;;EAEf;;EAEA;;EAEA;;qBAIW,iCAAiC;mBA+BzB;;;;;kBA1BH,SAAS;;SAOlB;mBAMU;mBACA;;;;;;;;;EAWf,YAAA,SAAS,eACQ;EAcnB,UAAU,SAAS,kBAAkB,MAAM,cAAc;;qBChE9C,qCAAqC;mBAC/B;mBACA;EAEL,YAAA,SAAS;EAcrB,UAAU,SAAS,kBAAkB,MAAM,cAAc;;qBCL9C;qBACA;qBACA;iBAcI,4BAA4B,KAAK;EAChD,cAAc,KAAK;EACnB,WAAW,KAAK;EAChB,iBAAiB,oBAAoB,QAAQ,QAAQ,iBAAiB,QAAQ;EAC9E,SAAS,MAAM,iBAAiB;;iBAIjB;EACf,wBAAwB,QAAQ,QAAQ,iBAAiB,QAAQ;;;;;qBAOtD,+BAA+B;UAClC;iBACO;;;;;;SAWR,eAAe;;;;;;;;;;;;;SAcf,iBAAiB,SAAS;;SAY1B;;;;;;;;;;;;;;;;;;;SAsBA,mBAAmB;EAI1B,UAAU,UAAU;;;;SAkCb,QAAQ,SAAS,QAAQ;;;;;;;;;;;;;;MAsBG,aAAA,cAAA,QAAQ,kBAAa;;;;;MAmCtB,aAAA,aAAA,8BAAyB;;;;;MAMzB,aAAA,aAAA,8BAAyB;;;;;;;;;;SAkBpD,aAAa,SAAS;;;;;MAjMN,gBAAA,oBAAc,QAAQ,QAAQ,iBAAiB,QAAQ;;;;MAuTvC,aAAA,gBAAA,0BAAqB,QAAA,QAAA,aAAA;;;;;;;MA9GzB,aAAA,cAAA,QAAQ,kBAAa;;;;MASrB,aAAA,cAAA,QAAQ,kBAAa;;;;MAqCtB,aAAA,aAAA,8BAAyB;;;;MAMzB,aAAA,aAAA,8BAAyB;;;;;;;;;SAkBpD,WAAW;;;;MAOe,aAAA,YAAA,yBAAoB;;;;;iBAUtC;iBAaA;;;;;;;;;;;;;;;;;;qBCnRJ,eAAgB,qBAAmB;UAO/B;;;;;EAKf,QAAQ;;;;;;EAMR;;;;;EAKA;;;;;EAKA;;;;EAIA;;;;;;;;;;;;;;;;;wBAkBc,UAAU,UAAS,mBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAkJ1C;;;;;EAKf;;;;;EAKA;;;qBAIW;qBAGA,kCAAkC;mBAC5B;mBACA;mBACA;EAKf,YAAA,SAAS,sBAGT,eAAe,QAAQ,eAGvB,UAAU;EAaZ,MAAM,oBAAoB,MAAM;;QCnQ1B;YACI;cACE;MACR;;;;qBAOO,2BAA2B;mBAGG;mBAFxB;EAEwB,YAAA,SAAS;EAqBlD,IAAI,KAAK,SAAS,KAAK,UAAU,MAAM;;;;;;;wBCjDzB,oBAAoB,SAAS,QAAQ,gBAAgB"}
+{"version":3,"file":"nest.d.ts","names":[],"sources":["../src/core/logitron-nestjs.service.ts","../src/core/kafka-trace.interceptor.ts","../src/core/websocket-trace.interceptor.ts","../src/core/logitron-logger.module.ts","../src/core/nestjs-extras.ts","../src/core/trace.middleware.ts","../src/nest.ts"],"mappings":";;;;;;;;;;KAiCK;;;;;;;;;KAWA,0BAA0B,gBAAgB,sCACnC,WAAW,WAAW,UAAU,gCAAgC,cACxE,iBACA,OAAO,4BACJ;;;;;;;;YAUK,yBAAyB,UAAU,aAAa,2BAC1D;EAA4B,cAAc;IACtC,UAAU,yBACR,uBAAuB,0BAA0B,KACjD,uBACF;;;;KAKD,yBAAyB,KAAK;EAAY;IAAiB,eAAe;;IAC3E,UAAU,yBACR,cAAc,YAAY;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;YAmCpB,mBAAmB,mBAAmB,2BAChD,mCAEI,KAAK,mBAAmB,QAAQ,GAAG,yBAAyB,yBAAyB,MACnF,iBAAiB,OAAO,4BAA4B;qBAS/C,gCAAgC;GAE1C;UAEO;UACA;UACA;EAEI,YAAA,SAAS;UA+Cb;;;;;;;EAyBR,IAAI,kBAAkB;;;;;;EAYhB,KAAK,iBAAiB,OAAO,0BAA0B;;;;;;;EAY7D,MAAM,kBAAkB,OAAO,MAAM,0BAA0B;;;;;;EAO/D,MAAM,kBAAkB,gBAAgB;;;;;;EAoCxC,KAAK,iBAAiB,MAAM,0BAA0B;;;;;;EAOtD,KAAK,kBAAkB;;;;;;EAmBvB,MAAM,iBAAiB,MAAM,0BAA0B;;;;;;EAOvD,MAAM,kBAAkB;;;;;;;EAoBxB,QAAQ,iBAAiB,MAAM,0BAA0B;;;;;;EAOzD,QAAQ,kBAAkB;;;;EAoBpB,MAAM,iBAAiB,OAAO,0BAA0B;;;;EAO9D,SAAS,eAAe,iBAAiB,OAAO,0BAA0B;EAM1E,KAAK;EAIC,QAAQ,gBAAgB;EAIxB,UAAU,GAAG,eAAe,UAAU,QAAQ,KAAK,QAAQ;EAMjE,WAAW;EAMX;EAIA,SAAS,OAAO;EAIhB,YAAY;EAMZ,MAAM,iBAAiB,OAAO,0BAA0B;EASxD;;MAKI;EAIE,SAAS;SAIR,OAAO,UAAU,aAAa,yBACnC,SAAS,IACR,yBAAyB;EAI5B,aAAa;UAML;UAUA;;;;;;;;;;;UCjaO;;EAEf;;EAEA;;EAEA;;qBAIW,iCAAiC;mBA+BzB;;;;;kBA1BH,SAAS;;SAOlB;mBAMU;mBACA;;;;;;;;;EAWf,YAAA,SAAS,eACQ;EAcnB,UAAU,SAAS,kBAAkB,MAAM,cAAc;;qBChE9C,qCAAqC;mBAC/B;mBACA;EAEL,YAAA,SAAS;EAcrB,UAAU,SAAS,kBAAkB,MAAM,cAAc;;qBCL9C;qBACA;qBACA;iBAcI,4BAA4B,KAAK;EAChD,cAAc,KAAK;EACnB,WAAW,KAAK;EAChB,iBAAiB,oBAAoB,QAAQ,QAAQ,iBAAiB,QAAQ;EAC9E,SAAS,MAAM,iBAAiB;;iBAIjB;EACf,wBAAwB,QAAQ,QAAQ,iBAAiB,QAAQ;;;;;qBAOtD,+BAA+B;UAClC;iBACO;;;;;;SAWR,eAAe;;;;;;;;;;;;;SAcf,iBAAiB,SAAS;;SAY1B;;;;;;;;;;;;;;;;;;;SAsBA,mBAAmB;EAI1B,UAAU,UAAU;;;;SAqCb,QAAQ,SAAS,QAAQ;;;;;;;;;;;;;;MAsBG,aAAA,cAAA,QAAQ,kBAAa;;;;;MAmCtB,aAAA,aAAA,8BAAyB;;;;;MAMzB,aAAA,aAAA,8BAAyB;;;;;;;;;;SAkBpD,aAAa,SAAS;;;;;MApMN,gBAAA,oBAAc,QAAQ,QAAQ,iBAAiB,QAAQ;;;;MA0TvC,aAAA,gBAAA,0BAAqB,QAAA,QAAA,aAAA;;;;;;;MA9GzB,aAAA,cAAA,QAAQ,kBAAa;;;;MASrB,aAAA,cAAA,QAAQ,kBAAa;;;;MAqCtB,aAAA,aAAA,8BAAyB;;;;MAMzB,aAAA,aAAA,8BAAyB;;;;;;;;;SAkBpD,WAAW;;;;MAOe,aAAA,YAAA,yBAAoB;;;;;iBAUtC;iBAaA;;;;;;;;;;;;;;;;;;qBC5QJ,eAAgB,qBAAmB;UAO/B;;;;;EAKf,QAAQ;;;;;;EAMR;;;;;EAKA;;;;;EAKA;;;;EAIA;;;;;;;;;;;;;;;;;wBAkBc,UAAU,UAAS,mBAAwB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;UAkJ1C;;;;;EAKf;;;;;EAKA;;;;;;;EAOA;;;qBAIW;qBAuGA,kCAAkC;mBAC5B;mBACA;mBACA;mBACA;EAKf,YAAA,SAAS,sBAGT,eAAe,QAAQ,eAGvB,UAAU;EAiBZ,MAAM,oBAAoB,MAAM;;QCxX1B;YACI;cACE;MACR;;;;qBAmBO,2BAA2B;mBAKP;mBAJd;mBACA;EAGc,YAAA,SAAS,2BAGtC;EAuBF,IAAI,KAAK,SAAS,KAAK,UAAU,MAAM;;;;;;;wBCzEzB,oBAAoB,SAAS,QAAQ,gBAAgB"}

package/dist/nest.js

@@ -1,8 +1,9 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_secret_config = require("./secret-config-CmK2wVkr.js");
-const require_builder = require("./builder-yFvJrz7o.js");
+const require_secret_config = require("./secret-config-BvFl2dC8.js");
+const require_builder = require("./builder-CzmM_4Ub.js");
+const require_sensitive_names = require("./sensitive-names-CHMowujD.js");
 const require_request_trace = require("./request-trace-ByujsUZk.js");
-const require_internal_log = require("./internal-log-By4Govmu.js");
+const require_internal_log = require("./internal-log-DwqTjhpb.js");
 const require_coerce_utils = require("./coerce.utils-C1C5sIX0.js");
 let _nestjs_common = require("@nestjs/common");
 let rxjs = require("rxjs");
@@ -303,10 +304,18 @@ function writeTraceHeader(res, header, traceId) {
 		else if (typeof r.header === "function") r.header(header, traceId);
 	} catch {}
 }
+/** Injection token for extra query parameter names redacted in the trace context `url`. */
+const LOGIXIA_TRACE_REDACT_QUERY_PARAMS = "LOGIXIA_TRACE_REDACT_QUERY_PARAMS";
+/** The request URL as stored in the trace context: `originalUrl`, sensitive query values redacted. */
+function traceUrl(req, names) {
+	const raw = req.originalUrl ?? req.url;
+	return raw === void 0 ? void 0 : require_sensitive_names.redactUrlQuery(raw, names);
+}
 let TraceMiddleware = class TraceMiddleware {
-	constructor(config) {
+	constructor(config, redactQueryParams) {
 		this.config = config;
 		this.ctx = require_request_trace.TraceContext.instance;
+		this.redactParams = require_sensitive_names.buildNameSet(require_sensitive_names.DEFAULT_REDACT_QUERY_PARAMS, redactQueryParams);
 		const defaultExtractor = {
 			header: require_request_trace.DEFAULT_TRACE_HEADERS,
 			query: ["traceId", "trace_id"]
@@ -339,7 +348,7 @@ let TraceMiddleware = class TraceMiddleware {
 		if (header) writeTraceHeader(res, header, traceId);
 		this.ctx.run(traceId, () => next(), {
 			method: req.method,
-			url: req.url,
+			url: traceUrl(req, this.redactParams),
 			userAgent: req.get("User-Agent"),
 			ip: req.ip || ((_req$socket = req.socket) === null || _req$socket === void 0 ? void 0 : _req$socket.remoteAddress) || ((_req$connection = req.connection) === null || _req$connection === void 0 ? void 0 : _req$connection.remoteAddress)
 		});
@@ -348,7 +357,9 @@ let TraceMiddleware = class TraceMiddleware {
 TraceMiddleware = __decorate([
 	(0, _nestjs_common.Injectable)(),
 	__decorateParam(0, (0, _nestjs_common.Optional)()),
-	__decorateMetadata("design:paramtypes", [Object])
+	__decorateParam(1, (0, _nestjs_common.Optional)()),
+	__decorateParam(1, (0, _nestjs_common.Inject)(LOGIXIA_TRACE_REDACT_QUERY_PARAMS)),
+	__decorateMetadata("design:paramtypes", [Object, Array])
 ], TraceMiddleware);
 // src/core/websocket-trace.interceptor.ts
 let WebSocketTraceInterceptor = class WebSocketTraceInterceptor {
@@ -470,6 +481,7 @@ let LogixiaLoggerModule = class LogixiaLoggerModule {
 		return _LogixiaLoggerModule._globalLogger;
 	}
 	configure(consumer) {
+		var _LogixiaLoggerModule$;
 		const { forRoutes = DEFAULT_ROUTES, exclude } = this.config;
 		let resolvedTraceConfig;
 		if (typeof _LogixiaLoggerModule.loggerConfig.traceId === "object") resolvedTraceConfig = _LogixiaLoggerModule.loggerConfig.traceId;
@@ -478,7 +490,7 @@ let LogixiaLoggerModule = class LogixiaLoggerModule {
 			contextKey: "traceId",
 			generator: () => require_request_trace.TraceContext.instance.generate()
 		};
-		const middleware = new TraceMiddleware(resolvedTraceConfig);
+		const middleware = new TraceMiddleware(resolvedTraceConfig, (_LogixiaLoggerModule$ = _LogixiaLoggerModule.loggerConfig.redact) === null || _LogixiaLoggerModule$ === void 0 ? void 0 : _LogixiaLoggerModule$.queryParams);
 		const middlewareConfig = (req, res, next) => middleware.use(req, res, next);
 		if (exclude) consumer.apply(middlewareConfig).exclude(...exclude).forRoutes(...forRoutes);
 		else consumer.apply(middlewareConfig).forRoutes(...forRoutes);
@@ -765,9 +777,86 @@ function LogMethod(options = {}) {
 }
 /** Injection token for {@link LogixiaExceptionFilterOptions}. */
 const LOGIXIA_EXCEPTION_FILTER_OPTIONS = "LOGIXIA_EXCEPTION_FILTER_OPTIONS";
+const MAX_SCRUB_DEPTH = 8;
+/** Copy `value` with every string passed through `clean`; the input is never modified. */
+function cleanDeep(value, clean, depth = 0) {
+	if (typeof value === "string") return clean(value);
+	if (value === null || typeof value !== "object" || depth >= MAX_SCRUB_DEPTH) return value;
+	if (Array.isArray(value)) return value.map((item) => cleanDeep(item, clean, depth + 1));
+	const out = {};
+	for (const [key, item] of Object.entries(value)) out[key] = cleanDeep(item, clean, depth + 1);
+	return out;
+}
+function scrubErrorResponse(response, clean) {
+	const { error, debug } = response;
+	return {
+		...response,
+		error: cleanDeep(error, clean),
+		...debug !== void 0 ? { debug: cleanDeep(debug, clean) } : {}
+	};
+}
+const MAX_ERROR_DEPTH = 6;
+/** Scrub string VALUES of an already serialized tree; keys stay so key-based redaction still applies. */
+function scrubSerialized(value, clean, depth, seen) {
+	if (typeof value === "string") return clean(value);
+	if (value === null || typeof value !== "object") return typeof value === "function" || typeof value === "symbol" ? "[Unserializable]" : value;
+	if (seen.has(value)) return "[Circular]";
+	if (depth >= MAX_ERROR_DEPTH) return "[MaxDepth]";
+	seen.add(value);
+	try {
+		if (Array.isArray(value)) return value.map((item) => scrubSerialized(item, clean, depth + 1, seen));
+		const out = {};
+		for (const [key, item] of Object.entries(value)) require_sensitive_names.assignOwn(out, key, scrubSerialized(item, clean, depth + 1, seen));
+		return out;
+	} finally {
+		seen.delete(value);
+	}
+}
+/** Minimal copy used when the full sanitize step fails; never throws. */
+function fallbackError(exception, clean) {
+	let name = "Error";
+	let message = "[Unserializable]";
+	try {
+		if (exception instanceof Error) {
+			name = exception.name;
+			message = clean(exception.message);
+		}
+	} catch {}
+	const copy = new Error(message);
+	copy.name = name;
+	require_sensitive_names.assignOwn(copy, "serialization", "[Unserializable]");
+	return copy;
+}
+/**
+* A fresh Error safe to log. Built from `serializeError` (class instances walked by key,
+* so the logger's key-based redaction still sees `authorization`, `x-api-key`, ...), with
+* string values scrubbed. Keeps name, message, stack, cause and custom properties.
+* The original is untouched and this never throws.
+*/
+function sanitizedError(exception, clean) {
+	try {
+		if (!(exception instanceof Error)) return new Error(clean(String(exception)));
+		const scrubbed = scrubSerialized(require_builder.serializeError(exception), clean, 0, /* @__PURE__ */ new WeakSet());
+		const copy = new Error(String(scrubbed["message"] ?? ""));
+		for (const [key, value] of Object.entries(scrubbed)) {
+			if (key === "message") continue;
+			if (key === "stack" || key === "name") Object.defineProperty(copy, key, {
+				value,
+				writable: true,
+				configurable: true
+			});
+			else require_sensitive_names.assignOwn(copy, key, value);
+		}
+		return copy;
+	} catch {
+		return fallbackError(exception, clean);
+	}
+}
 let LogixiaExceptionFilter = class LogixiaExceptionFilter {
 	constructor(logger, loggerConfig, options) {
+		var _loggerConfig$redact;
 		this._options = options ?? {};
+		this._redactParams = require_sensitive_names.buildNameSet(require_sensitive_names.DEFAULT_REDACT_QUERY_PARAMS, [...(loggerConfig === null || loggerConfig === void 0 || (_loggerConfig$redact = loggerConfig.redact) === null || _loggerConfig$redact === void 0 ? void 0 : _loggerConfig$redact.queryParams) ?? [], ...this._options.redactQueryParams ?? []]);
 		this._logger = logger ?? LogixiaLoggerModule._globalLogger ?? void 0;
 		this._traceConfig = typeof (loggerConfig === null || loggerConfig === void 0 ? void 0 : loggerConfig.traceId) === "object" ? loggerConfig.traceId : void 0;
 	}
@@ -777,18 +866,39 @@ let LogixiaExceptionFilter = class LogixiaExceptionFilter {
 		const request = ctx.getRequest();
 		const response = ctx.getResponse();
 		const traceId = require_request_trace.TraceContext.instance.getCurrentTraceId() ?? require_request_trace.sanitizeIncomingId((_request$headers = request.headers) === null || _request$headers === void 0 ? void 0 : _request$headers["x-trace-id"]) ?? require_request_trace.sanitizeIncomingId(request.id) ?? void 0;
-		const { response: errorResponse, httpStatus } = require_builder.ErrorResponseBuilder.build({
-			exception,
-			traceId,
-			path: request.url ?? "/",
-			startTime: request.startTime,
-			exposeDebug: this._options.exposeDebug === true,
-			exposeCause: this._options.exposeCause === true
-		});
+		const rawUrl = request.originalUrl ?? request.url ?? "";
+		const url = require_sensitive_names.redactUrlQuery(rawUrl, this._redactParams);
+		const secrets = require_sensitive_names.sensitiveQueryValues(rawUrl, this._redactParams);
+		const clean = (text) => require_sensitive_names.sanitizeText(text, this._redactParams, secrets);
+		const buildFor = (input) => {
+			const { response: built, httpStatus: status } = require_builder.ErrorResponseBuilder.build({
+				exception: input,
+				traceId,
+				path: url || "/",
+				startTime: request.startTime,
+				exposeDebug: this._options.exposeDebug === true,
+				exposeCause: this._options.exposeCause === true
+			});
+			return {
+				errorResponse: scrubErrorResponse(built, clean),
+				httpStatus: status
+			};
+		};
+		let result;
+		try {
+			result = buildFor(exception);
+		} catch {
+			result = buildFor(fallbackError(exception, clean));
+		}
+		const { errorResponse, httpStatus } = result;
+		let logixiaException = false;
+		try {
+			logixiaException = require_builder.isLogixiaException(exception);
+		} catch {}
 		if (this._logger) {
 			const requestMeta = {
 				method: request.method ?? "",
-				url: request.url ?? "",
+				url,
 				status: httpStatus,
 				...errorResponse.meta.trace_id !== void 0 ? { trace_id: errorResponse.meta.trace_id } : {}
 			};
@@ -796,10 +906,8 @@ let LogixiaExceptionFilter = class LogixiaExceptionFilter {
 				require_internal_log.internalError(`ExceptionFilter failed to write log entry: ${String(err)}`);
 			};
 			let logPromise;
-			if (httpStatus >= 500) {
-				const err = exception instanceof Error ? exception : new Error(String(exception));
-				logPromise = this._logger.error(err, requestMeta);
-			} else if (require_builder.isLogixiaException(exception)) logPromise = this._logger.warn(`[${errorResponse.error.code}] ${errorResponse.error.message}`, requestMeta);
+			if (httpStatus >= 500) logPromise = this._logger.error(sanitizedError(exception, clean), requestMeta);
+			else if (logixiaException) logPromise = this._logger.warn(`[${errorResponse.error.code}] ${errorResponse.error.message}`, requestMeta);
 			else logPromise = this._logger.warn(`[${httpStatus}] ${errorResponse.error.message}`, requestMeta);
 			if (logPromise && typeof logPromise.catch === "function") logPromise.catch(onLogFailure);
 		}