logixia 2.1.0 → 2.3.0

package/dist/{gcp.transport-Cw3Qke85.mjs → gcp.transport-BY1Z3cS0.mjs}

@@ -1,9 +1,9 @@
 import { t as __require } from "./rolldown-runtime-D3PmRqjj.mjs";
-import { n as protectSecrets } from "./secret-config-GKmb15Me.mjs";
+import { n as protectSecrets } from "./secret-config-Cng7XPLx.mjs";
 import { t as internalError } from "./internal-log-Cy5nF1ZL.mjs";
 import { i as stringifyForLog } from "./safe-stringify-B5p5ktFe.mjs";
 import { t as mergeCoreFields } from "./entry-fields-J1OBi24o.mjs";
-import { a as httpRequest, t as BatchBuffer } from "./batch-buffer-CM-lK_Qy.mjs";
+import { a as httpRequest, t as BatchBuffer } from "./batch-buffer-BnmVCCwI.mjs";
 import * as https from "node:https";
 // src/transports/gcp.transport.ts
 /**
@@ -241,4 +241,4 @@ var GCPTransport = class {
 };
 export { GCPTransport as t };
 
-//# sourceMappingURL=gcp.transport-Cw3Qke85.mjs.map
+//# sourceMappingURL=gcp.transport-BY1Z3cS0.mjs.map

package/dist/{gcp.transport-Cw3Qke85.mjs.map → gcp.transport-BY1Z3cS0.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"gcp.transport-Cw3Qke85.mjs","names":[],"sources":["../src/transports/gcp.transport.ts"],"sourcesContent":["/**\n * logixia — Google Cloud Logging (Stackdriver) transport\n *\n * Maps logixia log entries to the GCP Logging REST API format:\n *   - Maps `level` → `severity` (INFO, WARNING, ERROR, CRITICAL…)\n *   - Injects `logging.googleapis.com/trace` for Cloud Trace correlation\n *   - Sets `traceSampled: true` whenever a trace id is present\n *     (`logging.googleapis.com/spanId` and `sourceLocation` are not populated)\n *   - Supports structured `jsonPayload` and plain `textPayload`\n *\n * Auth: the metadata server on GCE/GKE/Cloud Run, or a service-account key passed\n * as `credentials`. The `GOOGLE_APPLICATION_CREDENTIALS` key-file variable is not\n * read; full ADC is not supported.\n *\n * @example\n * ```ts\n * import { createLogger } from 'logixia';\n * import { GCPTransport } from 'logixia/gcp';\n *\n * const logger = createLogger({\n *   transports: {\n *     custom: [\n *       new GCPTransport({\n *         projectId: process.env.GOOGLE_CLOUD_PROJECT,\n *         logName: 'projects/my-project/logs/api',\n *         resource: { type: 'gce_instance', labels: { instance_id: '123' } },\n *       }),\n *     ],\n *   },\n * });\n * ```\n */\n\nimport * as https from 'node:https';\n\nimport type { IAsyncTransport, TransportLogEntry } from '../types/transport.types';\nimport { internalError } from '../utils/internal-log';\nimport { stringifyForLog } from '../utils/safe-stringify';\nimport {\n  BatchBuffer,\n  DEFAULT_MAX_BUFFER_SIZE,\n  DEFAULT_REQUEST_TIMEOUT_MS,\n  httpRequest,\n} from './batch-buffer';\nimport { mergeCoreFields } from './entry-fields';\nimport { protectSecrets } from './secret-config';\n\nexport interface GCPMonitoredResource {\n  type: string;\n  labels?: Record<string, string>;\n}\n\nexport interface GCPTransportConfig {\n  /** GCP project ID. Falls back to `GOOGLE_CLOUD_PROJECT` or `GCLOUD_PROJECT` env vars. */\n  projectId?: string;\n  /**\n   * Full log name, e.g. `'projects/my-project/logs/api'`.\n   * If omitted, defaults to `projects/{projectId}/logs/logixia`.\n   */\n  logName?: string;\n  /** Monitored resource descriptor. Defaults to `global`. */\n  resource?: GCPMonitoredResource;\n  /**\n   * Service account key JSON (parsed). If omitted, only the metadata server\n   * (GCE/GKE/Cloud Run) is tried; the key-file env var is not read.\n   */\n  credentials?: {\n    client_email: string;\n    private_key: string;\n  };\n  /** Number of entries to batch. @default 200 */\n  batchSize?: number;\n  /** Flush interval in ms. @default 5000 */\n  flushIntervalMs?: number;\n  /** Abort a request that has not finished after this many ms. @default 10000 */\n  requestTimeoutMs?: number;\n  /** Max buffered entries; the oldest are dropped past this. @default 10000 */\n  maxBufferSize?: number;\n  level?: string;\n}\n\ntype GcpSeverity =\n  | 'DEFAULT'\n  | 'DEBUG'\n  | 'INFO'\n  | 'NOTICE'\n  | 'WARNING'\n  | 'ERROR'\n  | 'CRITICAL'\n  | 'ALERT'\n  | 'EMERGENCY';\n\nfunction toGcpSeverity(level: string): GcpSeverity {\n  switch (level.toLowerCase()) {\n    case 'trace':\n    case 'verbose':\n    case 'debug':\n      return 'DEBUG';\n    case 'info':\n    case 'log':\n      return 'INFO';\n    case 'warn':\n    case 'warning':\n      return 'WARNING';\n    case 'error':\n      return 'ERROR';\n    case 'critical':\n    case 'fatal':\n      return 'CRITICAL';\n    default:\n      return 'DEFAULT';\n  }\n}\n\n/**\n * Google Cloud Logging transport with trace correlation and GCP severity mapping.\n */\nexport class GCPTransport implements IAsyncTransport {\n  public readonly name = 'gcp';\n  public readonly batchSize: number;\n  public readonly flushInterval: number;\n  public readonly level: string | undefined;\n\n  private readonly buffer: BatchBuffer<TransportLogEntry>;\n  private readonly requestTimeoutMs: number;\n  private flushTimer: NodeJS.Timeout | null = null;\n  private accessToken: string | null = null;\n  private tokenExpiry = 0;\n\n  private readonly projectId: string;\n  private readonly logName: string;\n  private readonly resource: GCPMonitoredResource;\n  private readonly credentials: { client_email: string; private_key: string } | undefined;\n\n  constructor(config: GCPTransportConfig) {\n    protectSecrets(this, ['credentials', 'accessToken']);\n    this.projectId =\n      config.projectId ??\n      process.env['GOOGLE_CLOUD_PROJECT'] ??\n      process.env['GCLOUD_PROJECT'] ??\n      'unknown-project';\n    this.logName = config.logName ?? `projects/${this.projectId}/logs/logixia`;\n    this.resource = config.resource ?? { type: 'global' };\n    this.credentials = config.credentials;\n    this.batchSize = config.batchSize ?? 200;\n    this.flushInterval = config.flushIntervalMs ?? 5000;\n    this.level = config.level;\n    this.requestTimeoutMs = config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;\n    this.buffer = new BatchBuffer<TransportLogEntry>({\n      name: 'GCPTransport',\n      batchSize: this.batchSize,\n      maxBufferSize: config.maxBufferSize ?? DEFAULT_MAX_BUFFER_SIZE,\n      send: (entries) => this.writeEntries(entries),\n      secrets: () => this.secretValues(),\n    });\n\n    this.flushTimer = setInterval(() => {\n      this.flush().catch(() => {});\n    }, this.flushInterval);\n    if (this.flushTimer.unref) this.flushTimer.unref();\n  }\n\n  write(entry: TransportLogEntry): void {\n    this.buffer.push(entry);\n    this.buffer.flushIfFull();\n  }\n\n  flush(): Promise<void> {\n    return this.buffer.flush();\n  }\n\n  /**\n   * Flush remaining entries and stop the interval timer on shutdown. Without\n   * this the manager's close() skipped the transport (close was undefined) and\n   * buffered entries were lost on deploy. Waits for any in-flight send first.\n   */\n  async close(): Promise<void> {\n    if (this.flushTimer) {\n      clearInterval(this.flushTimer);\n      this.flushTimer = null;\n    }\n    await this.buffer.close();\n  }\n\n  private buildLogEntry(entry: TransportLogEntry): Record<string, unknown> {\n    const gcpEntry: Record<string, unknown> = {\n      logName: this.logName,\n      resource: this.resource,\n      severity: toGcpSeverity(entry.level),\n      timestamp: entry.timestamp ?? new Date().toISOString(),\n      jsonPayload: mergeCoreFields(\n        { message: entry.message, appName: entry.appName, context: entry.context },\n        entry.data\n      ),\n    };\n\n    // GCP Cloud Trace correlation\n    if (entry.traceId) {\n      gcpEntry['trace'] = `projects/${this.projectId}/traces/${entry.traceId}`;\n      gcpEntry['traceSampled'] = true;\n    }\n\n    return gcpEntry;\n  }\n\n  private async getAccessToken(): Promise<string | null> {\n    if (this.accessToken && Date.now() < this.tokenExpiry) return this.accessToken;\n\n    // Try ADC metadata server (GCE/GKE/Cloud Run)\n    try {\n      const token = await this.fetchFromMetadataServer();\n      if (token) {\n        this.accessToken = token;\n        this.tokenExpiry = Date.now() + 55 * 60 * 1000; // 55 minutes\n        return this.accessToken;\n      }\n    } catch {\n      /* fall through to service account */\n    }\n\n    // Try service account key\n    if (this.credentials) {\n      try {\n        const token = await this.fetchServiceAccountToken();\n        if (token) {\n          this.accessToken = token;\n          this.tokenExpiry = Date.now() + 55 * 60 * 1000;\n          return this.accessToken;\n        }\n      } catch (err) {\n        internalError('GCPTransport service account token error', err);\n      }\n    }\n\n    return null;\n  }\n\n  private fetchFromMetadataServer(): Promise<string | null> {\n    return new Promise((resolve, reject) => {\n      const req = https.request(\n        {\n          hostname: 'metadata.google.internal',\n          path: '/computeMetadata/v1/instance/service-accounts/default/token',\n          headers: { 'Metadata-Flavor': 'Google' },\n          timeout: 3000,\n        },\n        (res) => {\n          let raw = '';\n          res.on('data', (c: Buffer) => (raw += c.toString()));\n          res.on('end', () => {\n            if (res.statusCode === 200) {\n              try {\n                const parsed = JSON.parse(raw) as { access_token?: string };\n                resolve(parsed.access_token ?? null);\n              } catch {\n                resolve(null);\n              }\n            } else {\n              resolve(null);\n            }\n          });\n        }\n      );\n      req.on('error', reject);\n      req.on('timeout', () => {\n        req.destroy();\n        reject(new Error('metadata timeout'));\n      });\n      req.end();\n    });\n  }\n\n  private fetchServiceAccountToken(): Promise<string | null> {\n    // Minimal JWT creation for service account — only for environments without\n    // the full Google Auth Library. For production workloads, prefer ADC.\n    if (!this.credentials) return Promise.resolve(null);\n\n    const iat = Math.floor(Date.now() / 1000);\n    const exp = iat + 3600;\n    const scope = 'https://www.googleapis.com/auth/logging.write';\n\n    const header = Buffer.from(JSON.stringify({ alg: 'RS256', typ: 'JWT' })).toString('base64url');\n    const payload = Buffer.from(\n      JSON.stringify({\n        iss: this.credentials.client_email,\n        scope,\n        aud: 'https://oauth2.googleapis.com/token',\n        exp,\n        iat,\n      })\n    ).toString('base64url');\n\n    const signingInput = `${header}.${payload}`;\n\n    let signature: string;\n    try {\n      // eslint-disable-next-line @typescript-eslint/no-require-imports\n      const sign = require('node:crypto').createSign('RSA-SHA256');\n      sign.update(signingInput);\n      signature = sign.sign(this.credentials.private_key, 'base64url') as string;\n    } catch {\n      return Promise.resolve(null);\n    }\n\n    const jwt = `${signingInput}.${signature}`;\n    const body = `grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=${jwt}`;\n\n    return httpRequest({\n      url: new URL('https://oauth2.googleapis.com/token'),\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: 'GCP token request',\n    }).then(\n      (res) => (JSON.parse(res.body) as { access_token?: string }).access_token ?? null,\n      () => null\n    );\n  }\n\n  private secretValues(token?: string): (string | undefined)[] {\n    return [\n      ...(this.credentials?.private_key.split('\\n') ?? []),\n      this.credentials?.private_key,\n      this.accessToken ?? undefined,\n      token,\n    ];\n  }\n\n  private async writeEntries(entries: TransportLogEntry[]): Promise<void> {\n    const token = await this.getAccessToken();\n    if (!token) {\n      throw new Error('GCPTransport: no access token available');\n    }\n\n    const body = stringifyForLog({\n      logName: this.logName,\n      resource: this.resource,\n      entries: entries.map((e) => this.buildLogEntry(e)),\n    });\n\n    await httpRequest({\n      url: new URL('https://logging.googleapis.com/v2/entries:write'),\n      headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: 'GCP Logging API',\n      secrets: () => this.secretValues(token),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4FA,SAAS,cAAc,OAA4B;CACjD,QAAQ,MAAM,YAAY,GAA1B;EACE,KAAK;EACL,KAAK;EACL,KAAK,SACH,OAAO;EACT,KAAK;EACL,KAAK,OACH,OAAO;EACT,KAAK;EACL,KAAK,WACH,OAAO;EACT,KAAK,SACH,OAAO;EACT,KAAK;EACL,KAAK,SACH,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;AAKA,IAAa,eAAb,MAAqD;CACnD,OAAuB;CACvB;CACA;CACA;CAEA;CACA;CACA,aAA4C;CAC5C,cAAqC;CACrC,cAAsB;CAEtB;CACA;CACA;CACA;CAEA,YAAY,QAA4B;EACtC,eAAe,MAAM,CAAC,eAAe,aAAa,CAAC;EACnD,KAAK,YACH,OAAO,aACP,QAAQ,IAAI,2BACZ,QAAQ,IAAI,qBACZ;EACF,KAAK,UAAU,OAAO,WAAW,YAAY,KAAK,UAAU;EAC5D,KAAK,WAAW,OAAO,YAAY,EAAE,MAAM,SAAS;EACpD,KAAK,cAAc,OAAO;EAC1B,KAAK,YAAY,OAAO,aAAa;EACrC,KAAK,gBAAgB,OAAO,mBAAmB;EAC/C,KAAK,QAAQ,OAAO;EACpB,KAAK,mBAAmB,OAAO,oBAAA;EAC/B,KAAK,SAAS,IAAI,YAA+B;GAC/C,MAAM;GACN,WAAW,KAAK;GAChB,eAAe,OAAO,iBAAA;GACtB,OAAO,YAAY,KAAK,aAAa,OAAO;GAC5C,eAAe,KAAK,aAAa;EACnC,CAAC;EAED,KAAK,aAAa,kBAAkB;GAClC,KAAK,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;EAC7B,GAAG,KAAK,aAAa;EACrB,IAAI,KAAK,WAAW,OAAO,KAAK,WAAW,MAAM;CACnD;CAEA,MAAM,OAAgC;EACpC,KAAK,OAAO,KAAK,KAAK;EACtB,KAAK,OAAO,YAAY;CAC1B;CAEA,QAAuB;EACrB,OAAO,KAAK,OAAO,MAAM;CAC3B;;;;;;CAOA,MAAM,QAAuB;EAC3B,IAAI,KAAK,YAAY;GACnB,cAAc,KAAK,UAAU;GAC7B,KAAK,aAAa;EACpB;EACA,MAAM,KAAK,OAAO,MAAM;CAC1B;CAEA,cAAsB,OAAmD;EACvE,MAAM,WAAoC;GACxC,SAAS,KAAK;GACd,UAAU,KAAK;GACf,UAAU,cAAc,MAAM,KAAK;GACnC,WAAW,MAAM,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;GACrD,aAAa,gBACX;IAAE,SAAS,MAAM;IAAS,SAAS,MAAM;IAAS,SAAS,MAAM;GAAQ,GACzE,MAAM,IACR;EACF;EAGA,IAAI,MAAM,SAAS;GACjB,SAAS,WAAW,YAAY,KAAK,UAAU,UAAU,MAAM;GAC/D,SAAS,kBAAkB;EAC7B;EAEA,OAAO;CACT;CAEA,MAAc,iBAAyC;EACrD,IAAI,KAAK,eAAe,KAAK,IAAI,IAAI,KAAK,aAAa,OAAO,KAAK;EAGnE,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,wBAAwB;GACjD,IAAI,OAAO;IACT,KAAK,cAAc;IACnB,KAAK,cAAc,KAAK,IAAI,IAAI;IAChC,OAAO,KAAK;GACd;EACF,QAAQ,CAER;EAGA,IAAI,KAAK,aACP,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,yBAAyB;GAClD,IAAI,OAAO;IACT,KAAK,cAAc;IACnB,KAAK,cAAc,KAAK,IAAI,IAAI;IAChC,OAAO,KAAK;GACd;EACF,SAAS,KAAK;GACZ,cAAc,4CAA4C,GAAG;EAC/D;EAGF,OAAO;CACT;CAEA,0BAA0D;EACxD,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,MAAM,MAAM,MAAM,QAChB;IACE,UAAU;IACV,MAAM;IACN,SAAS,EAAE,mBAAmB,SAAS;IACvC,SAAS;GACX,IACC,QAAQ;IACP,IAAI,MAAM;IACV,IAAI,GAAG,SAAS,MAAe,OAAO,EAAE,SAAS,CAAE;IACnD,IAAI,GAAG,aAAa;KAClB,IAAI,IAAI,eAAe,KACrB,IAAI;MAEF,QADe,KAAK,MAAM,GACb,CAAC,CAAC,gBAAgB,IAAI;KACrC,QAAQ;MACN,QAAQ,IAAI;KACd;UAEA,QAAQ,IAAI;IAEhB,CAAC;GACH,CACF;GACA,IAAI,GAAG,SAAS,MAAM;GACtB,IAAI,GAAG,iBAAiB;IACtB,IAAI,QAAQ;IACZ,uBAAO,IAAI,MAAM,kBAAkB,CAAC;GACtC,CAAC;GACD,IAAI,IAAI;EACV,CAAC;CACH;CAEA,2BAA2D;EAGzD,IAAI,CAAC,KAAK,aAAa,OAAO,QAAQ,QAAQ,IAAI;EAElD,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC,MAAM,MAAM,MAAM;EAclB,MAAM,eAAe,GAXN,OAAO,KAAK,KAAK,UAAU;GAAE,KAAK;GAAS,KAAK;EAAM,CAAC,CAAC,CAAC,CAAC,SAAS,WAWrD,EAAE,GAVf,OAAO,KACrB,KAAK,UAAU;GACb,KAAK,KAAK,YAAY;GACtB,OAAA;GACA,KAAK;GACL;GACA;EACF,CAAC,CACH,CAAC,CAAC,SAAS,WAE6B;EAExC,IAAI;EACJ,IAAI;GAEF,MAAM,OAAA,UAAe,aAAa,CAAC,CAAC,WAAW,YAAY;GAC3D,KAAK,OAAO,YAAY;GACxB,YAAY,KAAK,KAAK,KAAK,YAAY,aAAa,WAAW;EACjE,QAAQ;GACN,OAAO,QAAQ,QAAQ,IAAI;EAC7B;EAGA,MAAM,OAAO,8EAA8E,GAD5E,aAAa,GAAG;EAG/B,OAAO,YAAY;GACjB,KAAK,IAAI,IAAI,qCAAqC;GAClD,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D;GACA,WAAW,KAAK;GAChB,OAAO;EACT,CAAC,CAAC,CAAC,MACA,QAAS,KAAK,MAAM,IAAI,IAAI,CAAC,CAA+B,gBAAgB,YACvE,IACR;CACF;CAEA,aAAqB,OAAwC;;EAC3D,OAAO;GACL,KAAA,oBAAI,KAAK,iBAAA,QAAA,sBAAA,KAAA,IAAA,KAAA,IAAA,kBAAa,YAAY,MAAM,IAAI,MAAK,CAAC;IAClD,qBAAA,KAAK,iBAAA,QAAA,uBAAA,KAAA,IAAA,KAAA,IAAA,mBAAa;GAClB,KAAK,eAAe,KAAA;GACpB;EACF;CACF;CAEA,MAAc,aAAa,SAA6C;EACtE,MAAM,QAAQ,MAAM,KAAK,eAAe;EACxC,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,yCAAyC;EAG3D,MAAM,OAAO,gBAAgB;GAC3B,SAAS,KAAK;GACd,UAAU,KAAK;GACf,SAAS,QAAQ,KAAK,MAAM,KAAK,cAAc,CAAC,CAAC;EACnD,CAAC;EAED,MAAM,YAAY;GAChB,KAAK,IAAI,IAAI,iDAAiD;GAC9D,SAAS;IAAE,eAAe,UAAU;IAAS,gBAAgB;GAAmB;GAChF;GACA,WAAW,KAAK;GAChB,OAAO;GACP,eAAe,KAAK,aAAa,KAAK;EACxC,CAAC;CACH;AACF"}
+{"version":3,"file":"gcp.transport-BY1Z3cS0.mjs","names":[],"sources":["../src/transports/gcp.transport.ts"],"sourcesContent":["/**\n * logixia — Google Cloud Logging (Stackdriver) transport\n *\n * Maps logixia log entries to the GCP Logging REST API format:\n *   - Maps `level` → `severity` (INFO, WARNING, ERROR, CRITICAL…)\n *   - Injects `logging.googleapis.com/trace` for Cloud Trace correlation\n *   - Sets `traceSampled: true` whenever a trace id is present\n *     (`logging.googleapis.com/spanId` and `sourceLocation` are not populated)\n *   - Supports structured `jsonPayload` and plain `textPayload`\n *\n * Auth: the metadata server on GCE/GKE/Cloud Run, or a service-account key passed\n * as `credentials`. The `GOOGLE_APPLICATION_CREDENTIALS` key-file variable is not\n * read; full ADC is not supported.\n *\n * @example\n * ```ts\n * import { createLogger } from 'logixia';\n * import { GCPTransport } from 'logixia/gcp';\n *\n * const logger = createLogger({\n *   transports: {\n *     custom: [\n *       new GCPTransport({\n *         projectId: process.env.GOOGLE_CLOUD_PROJECT,\n *         logName: 'projects/my-project/logs/api',\n *         resource: { type: 'gce_instance', labels: { instance_id: '123' } },\n *       }),\n *     ],\n *   },\n * });\n * ```\n */\n\nimport * as https from 'node:https';\n\nimport type { IAsyncTransport, TransportLogEntry } from '../types/transport.types';\nimport { internalError } from '../utils/internal-log';\nimport { stringifyForLog } from '../utils/safe-stringify';\nimport {\n  BatchBuffer,\n  DEFAULT_MAX_BUFFER_SIZE,\n  DEFAULT_REQUEST_TIMEOUT_MS,\n  httpRequest,\n} from './batch-buffer';\nimport { mergeCoreFields } from './entry-fields';\nimport { protectSecrets } from './secret-config';\n\nexport interface GCPMonitoredResource {\n  type: string;\n  labels?: Record<string, string>;\n}\n\nexport interface GCPTransportConfig {\n  /** GCP project ID. Falls back to `GOOGLE_CLOUD_PROJECT` or `GCLOUD_PROJECT` env vars. */\n  projectId?: string;\n  /**\n   * Full log name, e.g. `'projects/my-project/logs/api'`.\n   * If omitted, defaults to `projects/{projectId}/logs/logixia`.\n   */\n  logName?: string;\n  /** Monitored resource descriptor. Defaults to `global`. */\n  resource?: GCPMonitoredResource;\n  /**\n   * Service account key JSON (parsed). If omitted, only the metadata server\n   * (GCE/GKE/Cloud Run) is tried; the key-file env var is not read.\n   */\n  credentials?: {\n    client_email: string;\n    private_key: string;\n  };\n  /** Number of entries to batch. @default 200 */\n  batchSize?: number;\n  /** Flush interval in ms. @default 5000 */\n  flushIntervalMs?: number;\n  /** Abort a request that has not finished after this many ms. @default 10000 */\n  requestTimeoutMs?: number;\n  /** Max buffered entries; the oldest are dropped past this. @default 10000 */\n  maxBufferSize?: number;\n  level?: string;\n}\n\ntype GcpSeverity =\n  | 'DEFAULT'\n  | 'DEBUG'\n  | 'INFO'\n  | 'NOTICE'\n  | 'WARNING'\n  | 'ERROR'\n  | 'CRITICAL'\n  | 'ALERT'\n  | 'EMERGENCY';\n\nfunction toGcpSeverity(level: string): GcpSeverity {\n  switch (level.toLowerCase()) {\n    case 'trace':\n    case 'verbose':\n    case 'debug':\n      return 'DEBUG';\n    case 'info':\n    case 'log':\n      return 'INFO';\n    case 'warn':\n    case 'warning':\n      return 'WARNING';\n    case 'error':\n      return 'ERROR';\n    case 'critical':\n    case 'fatal':\n      return 'CRITICAL';\n    default:\n      return 'DEFAULT';\n  }\n}\n\n/**\n * Google Cloud Logging transport with trace correlation and GCP severity mapping.\n */\nexport class GCPTransport implements IAsyncTransport {\n  public readonly name = 'gcp';\n  public readonly batchSize: number;\n  public readonly flushInterval: number;\n  public readonly level: string | undefined;\n\n  private readonly buffer: BatchBuffer<TransportLogEntry>;\n  private readonly requestTimeoutMs: number;\n  private flushTimer: NodeJS.Timeout | null = null;\n  private accessToken: string | null = null;\n  private tokenExpiry = 0;\n\n  private readonly projectId: string;\n  private readonly logName: string;\n  private readonly resource: GCPMonitoredResource;\n  private readonly credentials: { client_email: string; private_key: string } | undefined;\n\n  constructor(config: GCPTransportConfig) {\n    protectSecrets(this, ['credentials', 'accessToken']);\n    this.projectId =\n      config.projectId ??\n      process.env['GOOGLE_CLOUD_PROJECT'] ??\n      process.env['GCLOUD_PROJECT'] ??\n      'unknown-project';\n    this.logName = config.logName ?? `projects/${this.projectId}/logs/logixia`;\n    this.resource = config.resource ?? { type: 'global' };\n    this.credentials = config.credentials;\n    this.batchSize = config.batchSize ?? 200;\n    this.flushInterval = config.flushIntervalMs ?? 5000;\n    this.level = config.level;\n    this.requestTimeoutMs = config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;\n    this.buffer = new BatchBuffer<TransportLogEntry>({\n      name: 'GCPTransport',\n      batchSize: this.batchSize,\n      maxBufferSize: config.maxBufferSize ?? DEFAULT_MAX_BUFFER_SIZE,\n      send: (entries) => this.writeEntries(entries),\n      secrets: () => this.secretValues(),\n    });\n\n    this.flushTimer = setInterval(() => {\n      this.flush().catch(() => {});\n    }, this.flushInterval);\n    if (this.flushTimer.unref) this.flushTimer.unref();\n  }\n\n  write(entry: TransportLogEntry): void {\n    this.buffer.push(entry);\n    this.buffer.flushIfFull();\n  }\n\n  flush(): Promise<void> {\n    return this.buffer.flush();\n  }\n\n  /**\n   * Flush remaining entries and stop the interval timer on shutdown. Without\n   * this the manager's close() skipped the transport (close was undefined) and\n   * buffered entries were lost on deploy. Waits for any in-flight send first.\n   */\n  async close(): Promise<void> {\n    if (this.flushTimer) {\n      clearInterval(this.flushTimer);\n      this.flushTimer = null;\n    }\n    await this.buffer.close();\n  }\n\n  private buildLogEntry(entry: TransportLogEntry): Record<string, unknown> {\n    const gcpEntry: Record<string, unknown> = {\n      logName: this.logName,\n      resource: this.resource,\n      severity: toGcpSeverity(entry.level),\n      timestamp: entry.timestamp ?? new Date().toISOString(),\n      jsonPayload: mergeCoreFields(\n        { message: entry.message, appName: entry.appName, context: entry.context },\n        entry.data\n      ),\n    };\n\n    // GCP Cloud Trace correlation\n    if (entry.traceId) {\n      gcpEntry['trace'] = `projects/${this.projectId}/traces/${entry.traceId}`;\n      gcpEntry['traceSampled'] = true;\n    }\n\n    return gcpEntry;\n  }\n\n  private async getAccessToken(): Promise<string | null> {\n    if (this.accessToken && Date.now() < this.tokenExpiry) return this.accessToken;\n\n    // Try ADC metadata server (GCE/GKE/Cloud Run)\n    try {\n      const token = await this.fetchFromMetadataServer();\n      if (token) {\n        this.accessToken = token;\n        this.tokenExpiry = Date.now() + 55 * 60 * 1000; // 55 minutes\n        return this.accessToken;\n      }\n    } catch {\n      /* fall through to service account */\n    }\n\n    // Try service account key\n    if (this.credentials) {\n      try {\n        const token = await this.fetchServiceAccountToken();\n        if (token) {\n          this.accessToken = token;\n          this.tokenExpiry = Date.now() + 55 * 60 * 1000;\n          return this.accessToken;\n        }\n      } catch (err) {\n        internalError('GCPTransport service account token error', err);\n      }\n    }\n\n    return null;\n  }\n\n  private fetchFromMetadataServer(): Promise<string | null> {\n    return new Promise((resolve, reject) => {\n      const req = https.request(\n        {\n          hostname: 'metadata.google.internal',\n          path: '/computeMetadata/v1/instance/service-accounts/default/token',\n          headers: { 'Metadata-Flavor': 'Google' },\n          timeout: 3000,\n        },\n        (res) => {\n          let raw = '';\n          res.on('data', (c: Buffer) => (raw += c.toString()));\n          res.on('end', () => {\n            if (res.statusCode === 200) {\n              try {\n                const parsed = JSON.parse(raw) as { access_token?: string };\n                resolve(parsed.access_token ?? null);\n              } catch {\n                resolve(null);\n              }\n            } else {\n              resolve(null);\n            }\n          });\n        }\n      );\n      req.on('error', reject);\n      req.on('timeout', () => {\n        req.destroy();\n        reject(new Error('metadata timeout'));\n      });\n      req.end();\n    });\n  }\n\n  private fetchServiceAccountToken(): Promise<string | null> {\n    // Minimal JWT creation for service account — only for environments without\n    // the full Google Auth Library. For production workloads, prefer ADC.\n    if (!this.credentials) return Promise.resolve(null);\n\n    const iat = Math.floor(Date.now() / 1000);\n    const exp = iat + 3600;\n    const scope = 'https://www.googleapis.com/auth/logging.write';\n\n    const header = Buffer.from(JSON.stringify({ alg: 'RS256', typ: 'JWT' })).toString('base64url');\n    const payload = Buffer.from(\n      JSON.stringify({\n        iss: this.credentials.client_email,\n        scope,\n        aud: 'https://oauth2.googleapis.com/token',\n        exp,\n        iat,\n      })\n    ).toString('base64url');\n\n    const signingInput = `${header}.${payload}`;\n\n    let signature: string;\n    try {\n      // eslint-disable-next-line @typescript-eslint/no-require-imports\n      const sign = require('node:crypto').createSign('RSA-SHA256');\n      sign.update(signingInput);\n      signature = sign.sign(this.credentials.private_key, 'base64url') as string;\n    } catch {\n      return Promise.resolve(null);\n    }\n\n    const jwt = `${signingInput}.${signature}`;\n    const body = `grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=${jwt}`;\n\n    return httpRequest({\n      url: new URL('https://oauth2.googleapis.com/token'),\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: 'GCP token request',\n    }).then(\n      (res) => (JSON.parse(res.body) as { access_token?: string }).access_token ?? null,\n      () => null\n    );\n  }\n\n  private secretValues(token?: string): (string | undefined)[] {\n    return [\n      ...(this.credentials?.private_key.split('\\n') ?? []),\n      this.credentials?.private_key,\n      this.accessToken ?? undefined,\n      token,\n    ];\n  }\n\n  private async writeEntries(entries: TransportLogEntry[]): Promise<void> {\n    const token = await this.getAccessToken();\n    if (!token) {\n      throw new Error('GCPTransport: no access token available');\n    }\n\n    const body = stringifyForLog({\n      logName: this.logName,\n      resource: this.resource,\n      entries: entries.map((e) => this.buildLogEntry(e)),\n    });\n\n    await httpRequest({\n      url: new URL('https://logging.googleapis.com/v2/entries:write'),\n      headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: 'GCP Logging API',\n      secrets: () => this.secretValues(token),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4FA,SAAS,cAAc,OAA4B;CACjD,QAAQ,MAAM,YAAY,GAA1B;EACE,KAAK;EACL,KAAK;EACL,KAAK,SACH,OAAO;EACT,KAAK;EACL,KAAK,OACH,OAAO;EACT,KAAK;EACL,KAAK,WACH,OAAO;EACT,KAAK,SACH,OAAO;EACT,KAAK;EACL,KAAK,SACH,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;AAKA,IAAa,eAAb,MAAqD;CACnD,OAAuB;CACvB;CACA;CACA;CAEA;CACA;CACA,aAA4C;CAC5C,cAAqC;CACrC,cAAsB;CAEtB;CACA;CACA;CACA;CAEA,YAAY,QAA4B;EACtC,eAAe,MAAM,CAAC,eAAe,aAAa,CAAC;EACnD,KAAK,YACH,OAAO,aACP,QAAQ,IAAI,2BACZ,QAAQ,IAAI,qBACZ;EACF,KAAK,UAAU,OAAO,WAAW,YAAY,KAAK,UAAU;EAC5D,KAAK,WAAW,OAAO,YAAY,EAAE,MAAM,SAAS;EACpD,KAAK,cAAc,OAAO;EAC1B,KAAK,YAAY,OAAO,aAAa;EACrC,KAAK,gBAAgB,OAAO,mBAAmB;EAC/C,KAAK,QAAQ,OAAO;EACpB,KAAK,mBAAmB,OAAO,oBAAA;EAC/B,KAAK,SAAS,IAAI,YAA+B;GAC/C,MAAM;GACN,WAAW,KAAK;GAChB,eAAe,OAAO,iBAAA;GACtB,OAAO,YAAY,KAAK,aAAa,OAAO;GAC5C,eAAe,KAAK,aAAa;EACnC,CAAC;EAED,KAAK,aAAa,kBAAkB;GAClC,KAAK,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;EAC7B,GAAG,KAAK,aAAa;EACrB,IAAI,KAAK,WAAW,OAAO,KAAK,WAAW,MAAM;CACnD;CAEA,MAAM,OAAgC;EACpC,KAAK,OAAO,KAAK,KAAK;EACtB,KAAK,OAAO,YAAY;CAC1B;CAEA,QAAuB;EACrB,OAAO,KAAK,OAAO,MAAM;CAC3B;;;;;;CAOA,MAAM,QAAuB;EAC3B,IAAI,KAAK,YAAY;GACnB,cAAc,KAAK,UAAU;GAC7B,KAAK,aAAa;EACpB;EACA,MAAM,KAAK,OAAO,MAAM;CAC1B;CAEA,cAAsB,OAAmD;EACvE,MAAM,WAAoC;GACxC,SAAS,KAAK;GACd,UAAU,KAAK;GACf,UAAU,cAAc,MAAM,KAAK;GACnC,WAAW,MAAM,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;GACrD,aAAa,gBACX;IAAE,SAAS,MAAM;IAAS,SAAS,MAAM;IAAS,SAAS,MAAM;GAAQ,GACzE,MAAM,IACR;EACF;EAGA,IAAI,MAAM,SAAS;GACjB,SAAS,WAAW,YAAY,KAAK,UAAU,UAAU,MAAM;GAC/D,SAAS,kBAAkB;EAC7B;EAEA,OAAO;CACT;CAEA,MAAc,iBAAyC;EACrD,IAAI,KAAK,eAAe,KAAK,IAAI,IAAI,KAAK,aAAa,OAAO,KAAK;EAGnE,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,wBAAwB;GACjD,IAAI,OAAO;IACT,KAAK,cAAc;IACnB,KAAK,cAAc,KAAK,IAAI,IAAI;IAChC,OAAO,KAAK;GACd;EACF,QAAQ,CAER;EAGA,IAAI,KAAK,aACP,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,yBAAyB;GAClD,IAAI,OAAO;IACT,KAAK,cAAc;IACnB,KAAK,cAAc,KAAK,IAAI,IAAI;IAChC,OAAO,KAAK;GACd;EACF,SAAS,KAAK;GACZ,cAAc,4CAA4C,GAAG;EAC/D;EAGF,OAAO;CACT;CAEA,0BAA0D;EACxD,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,MAAM,MAAM,MAAM,QAChB;IACE,UAAU;IACV,MAAM;IACN,SAAS,EAAE,mBAAmB,SAAS;IACvC,SAAS;GACX,IACC,QAAQ;IACP,IAAI,MAAM;IACV,IAAI,GAAG,SAAS,MAAe,OAAO,EAAE,SAAS,CAAE;IACnD,IAAI,GAAG,aAAa;KAClB,IAAI,IAAI,eAAe,KACrB,IAAI;MAEF,QADe,KAAK,MAAM,GACb,CAAC,CAAC,gBAAgB,IAAI;KACrC,QAAQ;MACN,QAAQ,IAAI;KACd;UAEA,QAAQ,IAAI;IAEhB,CAAC;GACH,CACF;GACA,IAAI,GAAG,SAAS,MAAM;GACtB,IAAI,GAAG,iBAAiB;IACtB,IAAI,QAAQ;IACZ,uBAAO,IAAI,MAAM,kBAAkB,CAAC;GACtC,CAAC;GACD,IAAI,IAAI;EACV,CAAC;CACH;CAEA,2BAA2D;EAGzD,IAAI,CAAC,KAAK,aAAa,OAAO,QAAQ,QAAQ,IAAI;EAElD,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC,MAAM,MAAM,MAAM;EAclB,MAAM,eAAe,GAXN,OAAO,KAAK,KAAK,UAAU;GAAE,KAAK;GAAS,KAAK;EAAM,CAAC,CAAC,CAAC,CAAC,SAAS,WAWrD,EAAE,GAVf,OAAO,KACrB,KAAK,UAAU;GACb,KAAK,KAAK,YAAY;GACtB,OAAA;GACA,KAAK;GACL;GACA;EACF,CAAC,CACH,CAAC,CAAC,SAAS,WAE6B;EAExC,IAAI;EACJ,IAAI;GAEF,MAAM,OAAA,UAAe,aAAa,CAAC,CAAC,WAAW,YAAY;GAC3D,KAAK,OAAO,YAAY;GACxB,YAAY,KAAK,KAAK,KAAK,YAAY,aAAa,WAAW;EACjE,QAAQ;GACN,OAAO,QAAQ,QAAQ,IAAI;EAC7B;EAGA,MAAM,OAAO,8EAA8E,GAD5E,aAAa,GAAG;EAG/B,OAAO,YAAY;GACjB,KAAK,IAAI,IAAI,qCAAqC;GAClD,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D;GACA,WAAW,KAAK;GAChB,OAAO;EACT,CAAC,CAAC,CAAC,MACA,QAAS,KAAK,MAAM,IAAI,IAAI,CAAC,CAA+B,gBAAgB,YACvE,IACR;CACF;CAEA,aAAqB,OAAwC;;EAC3D,OAAO;GACL,KAAA,oBAAI,KAAK,iBAAA,QAAA,sBAAA,KAAA,IAAA,KAAA,IAAA,kBAAa,YAAY,MAAM,IAAI,MAAK,CAAC;IAClD,qBAAA,KAAK,iBAAA,QAAA,uBAAA,KAAA,IAAA,KAAA,IAAA,mBAAa;GAClB,KAAK,eAAe,KAAA;GACpB;EACF;CACF;CAEA,MAAc,aAAa,SAA6C;EACtE,MAAM,QAAQ,MAAM,KAAK,eAAe;EACxC,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,yCAAyC;EAG3D,MAAM,OAAO,gBAAgB;GAC3B,SAAS,KAAK;GACd,UAAU,KAAK;GACf,SAAS,QAAQ,KAAK,MAAM,KAAK,cAAc,CAAC,CAAC;EACnD,CAAC;EAED,MAAM,YAAY;GAChB,KAAK,IAAI,IAAI,iDAAiD;GAC9D,SAAS;IAAE,eAAe,UAAU;IAAS,gBAAgB;GAAmB;GAChF;GACA,WAAW,KAAK;GAChB,OAAO;GACP,eAAe,KAAK,aAAa,KAAK;EACxC,CAAC;CACH;AACF"}

package/dist/{gcp.transport-Ct0BtKFo.d.ts → gcp.transport-Bo60F-_3.d.ts}

@@ -1,4 +1,4 @@
-import { _ as TransportLogEntry, l as IAsyncTransport } from "./transport.types-B1ejJJP6.js";
+import { _ as TransportLogEntry, l as IAsyncTransport } from "./transport.types-MjMDjOQ7.js";
 interface GCPMonitoredResource {
   type: string;
   labels?: Record<string, string>;
@@ -65,4 +65,4 @@ declare class GCPTransport implements IAsyncTransport {
   private writeEntries;
 }
 export { GCPTransport as n, GCPTransportConfig as r, GCPMonitoredResource as t };
-//# sourceMappingURL=gcp.transport-Ct0BtKFo.d.ts.map
+//# sourceMappingURL=gcp.transport-Bo60F-_3.d.ts.map

package/dist/{gcp.transport-Ct0BtKFo.d.ts.map → gcp.transport-Bo60F-_3.d.ts.map}

@@ -1 +1 @@
-{"version":3,"file":"gcp.transport-Ct0BtKFo.d.ts","names":[],"sources":["../src/transports/gcp.transport.ts"],"mappings":";UA+CiB;EACf;EACA,SAAS;;UAGM;;EAEf;;;;;EAKA;;EAEA,WAAW;;;;;EAKX;IACE;IACA;;;EAGF;;EAEA;;EAEA;;EAEA;EACA;;;;;cAuCW,wBAAwB;WACnB;WACA;WACA;WACA;mBAEC;mBACA;UACT;UACA;UACA;mBAES;mBACA;mBACA;mBACA;EAEL,YAAA,QAAQ;EA4BpB,MAAM,OAAO;EAKb,SAAS;;;;;;EASH,SAAS;UAQP;UAqBM;UAgCN;UAmCA;UA+CA;UASM"}
+{"version":3,"file":"gcp.transport-Bo60F-_3.d.ts","names":[],"sources":["../src/transports/gcp.transport.ts"],"mappings":";UA+CiB;EACf;EACA,SAAS;;UAGM;;EAEf;;;;;EAKA;;EAEA,WAAW;;;;;EAKX;IACE;IACA;;;EAGF;;EAEA;;EAEA;;EAEA;EACA;;;;;cAuCW,wBAAwB;WACnB;WACA;WACA;WACA;mBAEC;mBACA;UACT;UACA;UACA;mBAES;mBACA;mBACA;mBACA;EAEL,YAAA,QAAQ;EA4BpB,MAAM,OAAO;EAKb,SAAS;;;;;;EASH,SAAS;UAQP;UAqBM;UAgCN;UAmCA;UA+CA;UASM"}

package/dist/{gcp.transport-5-ZIjN8r.js → gcp.transport-V9R4dwdT.js}

@@ -1,8 +1,8 @@
-const require_secret_config = require("./secret-config--cVTOWwp.js");
+const require_secret_config = require("./secret-config-OqmIPmpV.js");
 const require_internal_log = require("./internal-log-DwqTjhpb.js");
 const require_safe_stringify = require("./safe-stringify-J3sh-7YM.js");
 const require_entry_fields = require("./entry-fields-BSLkzw18.js");
-const require_batch_buffer = require("./batch-buffer-BLmVvJAZ.js");
+const require_batch_buffer = require("./batch-buffer-C-ETEX3Y.js");
 let node_https = require("node:https");
 node_https = require_secret_config.__toESM(node_https);
 // src/transports/gcp.transport.ts
@@ -246,4 +246,4 @@ Object.defineProperty(exports, "GCPTransport", {
 	}
 });
 
-//# sourceMappingURL=gcp.transport-5-ZIjN8r.js.map
+//# sourceMappingURL=gcp.transport-V9R4dwdT.js.map

package/dist/{gcp.transport-5-ZIjN8r.js.map → gcp.transport-V9R4dwdT.js.map}

@@ -1 +1 @@
-{"version":3,"file":"gcp.transport-5-ZIjN8r.js","names":["BatchBuffer","mergeCoreFields","https","httpRequest","stringifyForLog"],"sources":["../src/transports/gcp.transport.ts"],"sourcesContent":["/**\n * logixia — Google Cloud Logging (Stackdriver) transport\n *\n * Maps logixia log entries to the GCP Logging REST API format:\n *   - Maps `level` → `severity` (INFO, WARNING, ERROR, CRITICAL…)\n *   - Injects `logging.googleapis.com/trace` for Cloud Trace correlation\n *   - Sets `traceSampled: true` whenever a trace id is present\n *     (`logging.googleapis.com/spanId` and `sourceLocation` are not populated)\n *   - Supports structured `jsonPayload` and plain `textPayload`\n *\n * Auth: the metadata server on GCE/GKE/Cloud Run, or a service-account key passed\n * as `credentials`. The `GOOGLE_APPLICATION_CREDENTIALS` key-file variable is not\n * read; full ADC is not supported.\n *\n * @example\n * ```ts\n * import { createLogger } from 'logixia';\n * import { GCPTransport } from 'logixia/gcp';\n *\n * const logger = createLogger({\n *   transports: {\n *     custom: [\n *       new GCPTransport({\n *         projectId: process.env.GOOGLE_CLOUD_PROJECT,\n *         logName: 'projects/my-project/logs/api',\n *         resource: { type: 'gce_instance', labels: { instance_id: '123' } },\n *       }),\n *     ],\n *   },\n * });\n * ```\n */\n\nimport * as https from 'node:https';\n\nimport type { IAsyncTransport, TransportLogEntry } from '../types/transport.types';\nimport { internalError } from '../utils/internal-log';\nimport { stringifyForLog } from '../utils/safe-stringify';\nimport {\n  BatchBuffer,\n  DEFAULT_MAX_BUFFER_SIZE,\n  DEFAULT_REQUEST_TIMEOUT_MS,\n  httpRequest,\n} from './batch-buffer';\nimport { mergeCoreFields } from './entry-fields';\nimport { protectSecrets } from './secret-config';\n\nexport interface GCPMonitoredResource {\n  type: string;\n  labels?: Record<string, string>;\n}\n\nexport interface GCPTransportConfig {\n  /** GCP project ID. Falls back to `GOOGLE_CLOUD_PROJECT` or `GCLOUD_PROJECT` env vars. */\n  projectId?: string;\n  /**\n   * Full log name, e.g. `'projects/my-project/logs/api'`.\n   * If omitted, defaults to `projects/{projectId}/logs/logixia`.\n   */\n  logName?: string;\n  /** Monitored resource descriptor. Defaults to `global`. */\n  resource?: GCPMonitoredResource;\n  /**\n   * Service account key JSON (parsed). If omitted, only the metadata server\n   * (GCE/GKE/Cloud Run) is tried; the key-file env var is not read.\n   */\n  credentials?: {\n    client_email: string;\n    private_key: string;\n  };\n  /** Number of entries to batch. @default 200 */\n  batchSize?: number;\n  /** Flush interval in ms. @default 5000 */\n  flushIntervalMs?: number;\n  /** Abort a request that has not finished after this many ms. @default 10000 */\n  requestTimeoutMs?: number;\n  /** Max buffered entries; the oldest are dropped past this. @default 10000 */\n  maxBufferSize?: number;\n  level?: string;\n}\n\ntype GcpSeverity =\n  | 'DEFAULT'\n  | 'DEBUG'\n  | 'INFO'\n  | 'NOTICE'\n  | 'WARNING'\n  | 'ERROR'\n  | 'CRITICAL'\n  | 'ALERT'\n  | 'EMERGENCY';\n\nfunction toGcpSeverity(level: string): GcpSeverity {\n  switch (level.toLowerCase()) {\n    case 'trace':\n    case 'verbose':\n    case 'debug':\n      return 'DEBUG';\n    case 'info':\n    case 'log':\n      return 'INFO';\n    case 'warn':\n    case 'warning':\n      return 'WARNING';\n    case 'error':\n      return 'ERROR';\n    case 'critical':\n    case 'fatal':\n      return 'CRITICAL';\n    default:\n      return 'DEFAULT';\n  }\n}\n\n/**\n * Google Cloud Logging transport with trace correlation and GCP severity mapping.\n */\nexport class GCPTransport implements IAsyncTransport {\n  public readonly name = 'gcp';\n  public readonly batchSize: number;\n  public readonly flushInterval: number;\n  public readonly level: string | undefined;\n\n  private readonly buffer: BatchBuffer<TransportLogEntry>;\n  private readonly requestTimeoutMs: number;\n  private flushTimer: NodeJS.Timeout | null = null;\n  private accessToken: string | null = null;\n  private tokenExpiry = 0;\n\n  private readonly projectId: string;\n  private readonly logName: string;\n  private readonly resource: GCPMonitoredResource;\n  private readonly credentials: { client_email: string; private_key: string } | undefined;\n\n  constructor(config: GCPTransportConfig) {\n    protectSecrets(this, ['credentials', 'accessToken']);\n    this.projectId =\n      config.projectId ??\n      process.env['GOOGLE_CLOUD_PROJECT'] ??\n      process.env['GCLOUD_PROJECT'] ??\n      'unknown-project';\n    this.logName = config.logName ?? `projects/${this.projectId}/logs/logixia`;\n    this.resource = config.resource ?? { type: 'global' };\n    this.credentials = config.credentials;\n    this.batchSize = config.batchSize ?? 200;\n    this.flushInterval = config.flushIntervalMs ?? 5000;\n    this.level = config.level;\n    this.requestTimeoutMs = config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;\n    this.buffer = new BatchBuffer<TransportLogEntry>({\n      name: 'GCPTransport',\n      batchSize: this.batchSize,\n      maxBufferSize: config.maxBufferSize ?? DEFAULT_MAX_BUFFER_SIZE,\n      send: (entries) => this.writeEntries(entries),\n      secrets: () => this.secretValues(),\n    });\n\n    this.flushTimer = setInterval(() => {\n      this.flush().catch(() => {});\n    }, this.flushInterval);\n    if (this.flushTimer.unref) this.flushTimer.unref();\n  }\n\n  write(entry: TransportLogEntry): void {\n    this.buffer.push(entry);\n    this.buffer.flushIfFull();\n  }\n\n  flush(): Promise<void> {\n    return this.buffer.flush();\n  }\n\n  /**\n   * Flush remaining entries and stop the interval timer on shutdown. Without\n   * this the manager's close() skipped the transport (close was undefined) and\n   * buffered entries were lost on deploy. Waits for any in-flight send first.\n   */\n  async close(): Promise<void> {\n    if (this.flushTimer) {\n      clearInterval(this.flushTimer);\n      this.flushTimer = null;\n    }\n    await this.buffer.close();\n  }\n\n  private buildLogEntry(entry: TransportLogEntry): Record<string, unknown> {\n    const gcpEntry: Record<string, unknown> = {\n      logName: this.logName,\n      resource: this.resource,\n      severity: toGcpSeverity(entry.level),\n      timestamp: entry.timestamp ?? new Date().toISOString(),\n      jsonPayload: mergeCoreFields(\n        { message: entry.message, appName: entry.appName, context: entry.context },\n        entry.data\n      ),\n    };\n\n    // GCP Cloud Trace correlation\n    if (entry.traceId) {\n      gcpEntry['trace'] = `projects/${this.projectId}/traces/${entry.traceId}`;\n      gcpEntry['traceSampled'] = true;\n    }\n\n    return gcpEntry;\n  }\n\n  private async getAccessToken(): Promise<string | null> {\n    if (this.accessToken && Date.now() < this.tokenExpiry) return this.accessToken;\n\n    // Try ADC metadata server (GCE/GKE/Cloud Run)\n    try {\n      const token = await this.fetchFromMetadataServer();\n      if (token) {\n        this.accessToken = token;\n        this.tokenExpiry = Date.now() + 55 * 60 * 1000; // 55 minutes\n        return this.accessToken;\n      }\n    } catch {\n      /* fall through to service account */\n    }\n\n    // Try service account key\n    if (this.credentials) {\n      try {\n        const token = await this.fetchServiceAccountToken();\n        if (token) {\n          this.accessToken = token;\n          this.tokenExpiry = Date.now() + 55 * 60 * 1000;\n          return this.accessToken;\n        }\n      } catch (err) {\n        internalError('GCPTransport service account token error', err);\n      }\n    }\n\n    return null;\n  }\n\n  private fetchFromMetadataServer(): Promise<string | null> {\n    return new Promise((resolve, reject) => {\n      const req = https.request(\n        {\n          hostname: 'metadata.google.internal',\n          path: '/computeMetadata/v1/instance/service-accounts/default/token',\n          headers: { 'Metadata-Flavor': 'Google' },\n          timeout: 3000,\n        },\n        (res) => {\n          let raw = '';\n          res.on('data', (c: Buffer) => (raw += c.toString()));\n          res.on('end', () => {\n            if (res.statusCode === 200) {\n              try {\n                const parsed = JSON.parse(raw) as { access_token?: string };\n                resolve(parsed.access_token ?? null);\n              } catch {\n                resolve(null);\n              }\n            } else {\n              resolve(null);\n            }\n          });\n        }\n      );\n      req.on('error', reject);\n      req.on('timeout', () => {\n        req.destroy();\n        reject(new Error('metadata timeout'));\n      });\n      req.end();\n    });\n  }\n\n  private fetchServiceAccountToken(): Promise<string | null> {\n    // Minimal JWT creation for service account — only for environments without\n    // the full Google Auth Library. For production workloads, prefer ADC.\n    if (!this.credentials) return Promise.resolve(null);\n\n    const iat = Math.floor(Date.now() / 1000);\n    const exp = iat + 3600;\n    const scope = 'https://www.googleapis.com/auth/logging.write';\n\n    const header = Buffer.from(JSON.stringify({ alg: 'RS256', typ: 'JWT' })).toString('base64url');\n    const payload = Buffer.from(\n      JSON.stringify({\n        iss: this.credentials.client_email,\n        scope,\n        aud: 'https://oauth2.googleapis.com/token',\n        exp,\n        iat,\n      })\n    ).toString('base64url');\n\n    const signingInput = `${header}.${payload}`;\n\n    let signature: string;\n    try {\n      // eslint-disable-next-line @typescript-eslint/no-require-imports\n      const sign = require('node:crypto').createSign('RSA-SHA256');\n      sign.update(signingInput);\n      signature = sign.sign(this.credentials.private_key, 'base64url') as string;\n    } catch {\n      return Promise.resolve(null);\n    }\n\n    const jwt = `${signingInput}.${signature}`;\n    const body = `grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=${jwt}`;\n\n    return httpRequest({\n      url: new URL('https://oauth2.googleapis.com/token'),\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: 'GCP token request',\n    }).then(\n      (res) => (JSON.parse(res.body) as { access_token?: string }).access_token ?? null,\n      () => null\n    );\n  }\n\n  private secretValues(token?: string): (string | undefined)[] {\n    return [\n      ...(this.credentials?.private_key.split('\\n') ?? []),\n      this.credentials?.private_key,\n      this.accessToken ?? undefined,\n      token,\n    ];\n  }\n\n  private async writeEntries(entries: TransportLogEntry[]): Promise<void> {\n    const token = await this.getAccessToken();\n    if (!token) {\n      throw new Error('GCPTransport: no access token available');\n    }\n\n    const body = stringifyForLog({\n      logName: this.logName,\n      resource: this.resource,\n      entries: entries.map((e) => this.buildLogEntry(e)),\n    });\n\n    await httpRequest({\n      url: new URL('https://logging.googleapis.com/v2/entries:write'),\n      headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: 'GCP Logging API',\n      secrets: () => this.secretValues(token),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4FA,SAAS,cAAc,OAA4B;CACjD,QAAQ,MAAM,YAAY,GAA1B;EACE,KAAK;EACL,KAAK;EACL,KAAK,SACH,OAAO;EACT,KAAK;EACL,KAAK,OACH,OAAO;EACT,KAAK;EACL,KAAK,WACH,OAAO;EACT,KAAK,SACH,OAAO;EACT,KAAK;EACL,KAAK,SACH,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;AAKA,IAAa,eAAb,MAAqD;CACnD,OAAuB;CACvB;CACA;CACA;CAEA;CACA;CACA,aAA4C;CAC5C,cAAqC;CACrC,cAAsB;CAEtB;CACA;CACA;CACA;CAEA,YAAY,QAA4B;EACtC,sBAAA,eAAe,MAAM,CAAC,eAAe,aAAa,CAAC;EACnD,KAAK,YACH,OAAO,aACP,QAAQ,IAAI,2BACZ,QAAQ,IAAI,qBACZ;EACF,KAAK,UAAU,OAAO,WAAW,YAAY,KAAK,UAAU;EAC5D,KAAK,WAAW,OAAO,YAAY,EAAE,MAAM,SAAS;EACpD,KAAK,cAAc,OAAO;EAC1B,KAAK,YAAY,OAAO,aAAa;EACrC,KAAK,gBAAgB,OAAO,mBAAmB;EAC/C,KAAK,QAAQ,OAAO;EACpB,KAAK,mBAAmB,OAAO,oBAAA;EAC/B,KAAK,SAAS,IAAIA,qBAAAA,YAA+B;GAC/C,MAAM;GACN,WAAW,KAAK;GAChB,eAAe,OAAO,iBAAA;GACtB,OAAO,YAAY,KAAK,aAAa,OAAO;GAC5C,eAAe,KAAK,aAAa;EACnC,CAAC;EAED,KAAK,aAAa,kBAAkB;GAClC,KAAK,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;EAC7B,GAAG,KAAK,aAAa;EACrB,IAAI,KAAK,WAAW,OAAO,KAAK,WAAW,MAAM;CACnD;CAEA,MAAM,OAAgC;EACpC,KAAK,OAAO,KAAK,KAAK;EACtB,KAAK,OAAO,YAAY;CAC1B;CAEA,QAAuB;EACrB,OAAO,KAAK,OAAO,MAAM;CAC3B;;;;;;CAOA,MAAM,QAAuB;EAC3B,IAAI,KAAK,YAAY;GACnB,cAAc,KAAK,UAAU;GAC7B,KAAK,aAAa;EACpB;EACA,MAAM,KAAK,OAAO,MAAM;CAC1B;CAEA,cAAsB,OAAmD;EACvE,MAAM,WAAoC;GACxC,SAAS,KAAK;GACd,UAAU,KAAK;GACf,UAAU,cAAc,MAAM,KAAK;GACnC,WAAW,MAAM,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;GACrD,aAAaC,qBAAAA,gBACX;IAAE,SAAS,MAAM;IAAS,SAAS,MAAM;IAAS,SAAS,MAAM;GAAQ,GACzE,MAAM,IACR;EACF;EAGA,IAAI,MAAM,SAAS;GACjB,SAAS,WAAW,YAAY,KAAK,UAAU,UAAU,MAAM;GAC/D,SAAS,kBAAkB;EAC7B;EAEA,OAAO;CACT;CAEA,MAAc,iBAAyC;EACrD,IAAI,KAAK,eAAe,KAAK,IAAI,IAAI,KAAK,aAAa,OAAO,KAAK;EAGnE,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,wBAAwB;GACjD,IAAI,OAAO;IACT,KAAK,cAAc;IACnB,KAAK,cAAc,KAAK,IAAI,IAAI;IAChC,OAAO,KAAK;GACd;EACF,QAAQ,CAER;EAGA,IAAI,KAAK,aACP,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,yBAAyB;GAClD,IAAI,OAAO;IACT,KAAK,cAAc;IACnB,KAAK,cAAc,KAAK,IAAI,IAAI;IAChC,OAAO,KAAK;GACd;EACF,SAAS,KAAK;GACZ,qBAAA,cAAc,4CAA4C,GAAG;EAC/D;EAGF,OAAO;CACT;CAEA,0BAA0D;EACxD,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,MAAM,MAAMC,WAAM,QAChB;IACE,UAAU;IACV,MAAM;IACN,SAAS,EAAE,mBAAmB,SAAS;IACvC,SAAS;GACX,IACC,QAAQ;IACP,IAAI,MAAM;IACV,IAAI,GAAG,SAAS,MAAe,OAAO,EAAE,SAAS,CAAE;IACnD,IAAI,GAAG,aAAa;KAClB,IAAI,IAAI,eAAe,KACrB,IAAI;MAEF,QADe,KAAK,MAAM,GACb,CAAC,CAAC,gBAAgB,IAAI;KACrC,QAAQ;MACN,QAAQ,IAAI;KACd;UAEA,QAAQ,IAAI;IAEhB,CAAC;GACH,CACF;GACA,IAAI,GAAG,SAAS,MAAM;GACtB,IAAI,GAAG,iBAAiB;IACtB,IAAI,QAAQ;IACZ,uBAAO,IAAI,MAAM,kBAAkB,CAAC;GACtC,CAAC;GACD,IAAI,IAAI;EACV,CAAC;CACH;CAEA,2BAA2D;EAGzD,IAAI,CAAC,KAAK,aAAa,OAAO,QAAQ,QAAQ,IAAI;EAElD,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC,MAAM,MAAM,MAAM;EAclB,MAAM,eAAe,GAXN,OAAO,KAAK,KAAK,UAAU;GAAE,KAAK;GAAS,KAAK;EAAM,CAAC,CAAC,CAAC,CAAC,SAAS,WAWrD,EAAE,GAVf,OAAO,KACrB,KAAK,UAAU;GACb,KAAK,KAAK,YAAY;GACtB,OAAA;GACA,KAAK;GACL;GACA;EACF,CAAC,CACH,CAAC,CAAC,SAAS,WAE6B;EAExC,IAAI;EACJ,IAAI;GAEF,MAAM,OAAO,QAAQ,aAAa,CAAC,CAAC,WAAW,YAAY;GAC3D,KAAK,OAAO,YAAY;GACxB,YAAY,KAAK,KAAK,KAAK,YAAY,aAAa,WAAW;EACjE,QAAQ;GACN,OAAO,QAAQ,QAAQ,IAAI;EAC7B;EAGA,MAAM,OAAO,8EAA8E,GAD5E,aAAa,GAAG;EAG/B,OAAOC,qBAAAA,YAAY;GACjB,KAAK,IAAI,IAAI,qCAAqC;GAClD,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D;GACA,WAAW,KAAK;GAChB,OAAO;EACT,CAAC,CAAC,CAAC,MACA,QAAS,KAAK,MAAM,IAAI,IAAI,CAAC,CAA+B,gBAAgB,YACvE,IACR;CACF;CAEA,aAAqB,OAAwC;;EAC3D,OAAO;GACL,KAAA,oBAAI,KAAK,iBAAA,QAAA,sBAAA,KAAA,IAAA,KAAA,IAAA,kBAAa,YAAY,MAAM,IAAI,MAAK,CAAC;IAClD,qBAAA,KAAK,iBAAA,QAAA,uBAAA,KAAA,IAAA,KAAA,IAAA,mBAAa;GAClB,KAAK,eAAe,KAAA;GACpB;EACF;CACF;CAEA,MAAc,aAAa,SAA6C;EACtE,MAAM,QAAQ,MAAM,KAAK,eAAe;EACxC,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,yCAAyC;EAG3D,MAAM,OAAOC,uBAAAA,gBAAgB;GAC3B,SAAS,KAAK;GACd,UAAU,KAAK;GACf,SAAS,QAAQ,KAAK,MAAM,KAAK,cAAc,CAAC,CAAC;EACnD,CAAC;EAED,MAAMD,qBAAAA,YAAY;GAChB,KAAK,IAAI,IAAI,iDAAiD;GAC9D,SAAS;IAAE,eAAe,UAAU;IAAS,gBAAgB;GAAmB;GAChF;GACA,WAAW,KAAK;GAChB,OAAO;GACP,eAAe,KAAK,aAAa,KAAK;EACxC,CAAC;CACH;AACF"}
+{"version":3,"file":"gcp.transport-V9R4dwdT.js","names":["BatchBuffer","mergeCoreFields","https","httpRequest","stringifyForLog"],"sources":["../src/transports/gcp.transport.ts"],"sourcesContent":["/**\n * logixia — Google Cloud Logging (Stackdriver) transport\n *\n * Maps logixia log entries to the GCP Logging REST API format:\n *   - Maps `level` → `severity` (INFO, WARNING, ERROR, CRITICAL…)\n *   - Injects `logging.googleapis.com/trace` for Cloud Trace correlation\n *   - Sets `traceSampled: true` whenever a trace id is present\n *     (`logging.googleapis.com/spanId` and `sourceLocation` are not populated)\n *   - Supports structured `jsonPayload` and plain `textPayload`\n *\n * Auth: the metadata server on GCE/GKE/Cloud Run, or a service-account key passed\n * as `credentials`. The `GOOGLE_APPLICATION_CREDENTIALS` key-file variable is not\n * read; full ADC is not supported.\n *\n * @example\n * ```ts\n * import { createLogger } from 'logixia';\n * import { GCPTransport } from 'logixia/gcp';\n *\n * const logger = createLogger({\n *   transports: {\n *     custom: [\n *       new GCPTransport({\n *         projectId: process.env.GOOGLE_CLOUD_PROJECT,\n *         logName: 'projects/my-project/logs/api',\n *         resource: { type: 'gce_instance', labels: { instance_id: '123' } },\n *       }),\n *     ],\n *   },\n * });\n * ```\n */\n\nimport * as https from 'node:https';\n\nimport type { IAsyncTransport, TransportLogEntry } from '../types/transport.types';\nimport { internalError } from '../utils/internal-log';\nimport { stringifyForLog } from '../utils/safe-stringify';\nimport {\n  BatchBuffer,\n  DEFAULT_MAX_BUFFER_SIZE,\n  DEFAULT_REQUEST_TIMEOUT_MS,\n  httpRequest,\n} from './batch-buffer';\nimport { mergeCoreFields } from './entry-fields';\nimport { protectSecrets } from './secret-config';\n\nexport interface GCPMonitoredResource {\n  type: string;\n  labels?: Record<string, string>;\n}\n\nexport interface GCPTransportConfig {\n  /** GCP project ID. Falls back to `GOOGLE_CLOUD_PROJECT` or `GCLOUD_PROJECT` env vars. */\n  projectId?: string;\n  /**\n   * Full log name, e.g. `'projects/my-project/logs/api'`.\n   * If omitted, defaults to `projects/{projectId}/logs/logixia`.\n   */\n  logName?: string;\n  /** Monitored resource descriptor. Defaults to `global`. */\n  resource?: GCPMonitoredResource;\n  /**\n   * Service account key JSON (parsed). If omitted, only the metadata server\n   * (GCE/GKE/Cloud Run) is tried; the key-file env var is not read.\n   */\n  credentials?: {\n    client_email: string;\n    private_key: string;\n  };\n  /** Number of entries to batch. @default 200 */\n  batchSize?: number;\n  /** Flush interval in ms. @default 5000 */\n  flushIntervalMs?: number;\n  /** Abort a request that has not finished after this many ms. @default 10000 */\n  requestTimeoutMs?: number;\n  /** Max buffered entries; the oldest are dropped past this. @default 10000 */\n  maxBufferSize?: number;\n  level?: string;\n}\n\ntype GcpSeverity =\n  | 'DEFAULT'\n  | 'DEBUG'\n  | 'INFO'\n  | 'NOTICE'\n  | 'WARNING'\n  | 'ERROR'\n  | 'CRITICAL'\n  | 'ALERT'\n  | 'EMERGENCY';\n\nfunction toGcpSeverity(level: string): GcpSeverity {\n  switch (level.toLowerCase()) {\n    case 'trace':\n    case 'verbose':\n    case 'debug':\n      return 'DEBUG';\n    case 'info':\n    case 'log':\n      return 'INFO';\n    case 'warn':\n    case 'warning':\n      return 'WARNING';\n    case 'error':\n      return 'ERROR';\n    case 'critical':\n    case 'fatal':\n      return 'CRITICAL';\n    default:\n      return 'DEFAULT';\n  }\n}\n\n/**\n * Google Cloud Logging transport with trace correlation and GCP severity mapping.\n */\nexport class GCPTransport implements IAsyncTransport {\n  public readonly name = 'gcp';\n  public readonly batchSize: number;\n  public readonly flushInterval: number;\n  public readonly level: string | undefined;\n\n  private readonly buffer: BatchBuffer<TransportLogEntry>;\n  private readonly requestTimeoutMs: number;\n  private flushTimer: NodeJS.Timeout | null = null;\n  private accessToken: string | null = null;\n  private tokenExpiry = 0;\n\n  private readonly projectId: string;\n  private readonly logName: string;\n  private readonly resource: GCPMonitoredResource;\n  private readonly credentials: { client_email: string; private_key: string } | undefined;\n\n  constructor(config: GCPTransportConfig) {\n    protectSecrets(this, ['credentials', 'accessToken']);\n    this.projectId =\n      config.projectId ??\n      process.env['GOOGLE_CLOUD_PROJECT'] ??\n      process.env['GCLOUD_PROJECT'] ??\n      'unknown-project';\n    this.logName = config.logName ?? `projects/${this.projectId}/logs/logixia`;\n    this.resource = config.resource ?? { type: 'global' };\n    this.credentials = config.credentials;\n    this.batchSize = config.batchSize ?? 200;\n    this.flushInterval = config.flushIntervalMs ?? 5000;\n    this.level = config.level;\n    this.requestTimeoutMs = config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;\n    this.buffer = new BatchBuffer<TransportLogEntry>({\n      name: 'GCPTransport',\n      batchSize: this.batchSize,\n      maxBufferSize: config.maxBufferSize ?? DEFAULT_MAX_BUFFER_SIZE,\n      send: (entries) => this.writeEntries(entries),\n      secrets: () => this.secretValues(),\n    });\n\n    this.flushTimer = setInterval(() => {\n      this.flush().catch(() => {});\n    }, this.flushInterval);\n    if (this.flushTimer.unref) this.flushTimer.unref();\n  }\n\n  write(entry: TransportLogEntry): void {\n    this.buffer.push(entry);\n    this.buffer.flushIfFull();\n  }\n\n  flush(): Promise<void> {\n    return this.buffer.flush();\n  }\n\n  /**\n   * Flush remaining entries and stop the interval timer on shutdown. Without\n   * this the manager's close() skipped the transport (close was undefined) and\n   * buffered entries were lost on deploy. Waits for any in-flight send first.\n   */\n  async close(): Promise<void> {\n    if (this.flushTimer) {\n      clearInterval(this.flushTimer);\n      this.flushTimer = null;\n    }\n    await this.buffer.close();\n  }\n\n  private buildLogEntry(entry: TransportLogEntry): Record<string, unknown> {\n    const gcpEntry: Record<string, unknown> = {\n      logName: this.logName,\n      resource: this.resource,\n      severity: toGcpSeverity(entry.level),\n      timestamp: entry.timestamp ?? new Date().toISOString(),\n      jsonPayload: mergeCoreFields(\n        { message: entry.message, appName: entry.appName, context: entry.context },\n        entry.data\n      ),\n    };\n\n    // GCP Cloud Trace correlation\n    if (entry.traceId) {\n      gcpEntry['trace'] = `projects/${this.projectId}/traces/${entry.traceId}`;\n      gcpEntry['traceSampled'] = true;\n    }\n\n    return gcpEntry;\n  }\n\n  private async getAccessToken(): Promise<string | null> {\n    if (this.accessToken && Date.now() < this.tokenExpiry) return this.accessToken;\n\n    // Try ADC metadata server (GCE/GKE/Cloud Run)\n    try {\n      const token = await this.fetchFromMetadataServer();\n      if (token) {\n        this.accessToken = token;\n        this.tokenExpiry = Date.now() + 55 * 60 * 1000; // 55 minutes\n        return this.accessToken;\n      }\n    } catch {\n      /* fall through to service account */\n    }\n\n    // Try service account key\n    if (this.credentials) {\n      try {\n        const token = await this.fetchServiceAccountToken();\n        if (token) {\n          this.accessToken = token;\n          this.tokenExpiry = Date.now() + 55 * 60 * 1000;\n          return this.accessToken;\n        }\n      } catch (err) {\n        internalError('GCPTransport service account token error', err);\n      }\n    }\n\n    return null;\n  }\n\n  private fetchFromMetadataServer(): Promise<string | null> {\n    return new Promise((resolve, reject) => {\n      const req = https.request(\n        {\n          hostname: 'metadata.google.internal',\n          path: '/computeMetadata/v1/instance/service-accounts/default/token',\n          headers: { 'Metadata-Flavor': 'Google' },\n          timeout: 3000,\n        },\n        (res) => {\n          let raw = '';\n          res.on('data', (c: Buffer) => (raw += c.toString()));\n          res.on('end', () => {\n            if (res.statusCode === 200) {\n              try {\n                const parsed = JSON.parse(raw) as { access_token?: string };\n                resolve(parsed.access_token ?? null);\n              } catch {\n                resolve(null);\n              }\n            } else {\n              resolve(null);\n            }\n          });\n        }\n      );\n      req.on('error', reject);\n      req.on('timeout', () => {\n        req.destroy();\n        reject(new Error('metadata timeout'));\n      });\n      req.end();\n    });\n  }\n\n  private fetchServiceAccountToken(): Promise<string | null> {\n    // Minimal JWT creation for service account — only for environments without\n    // the full Google Auth Library. For production workloads, prefer ADC.\n    if (!this.credentials) return Promise.resolve(null);\n\n    const iat = Math.floor(Date.now() / 1000);\n    const exp = iat + 3600;\n    const scope = 'https://www.googleapis.com/auth/logging.write';\n\n    const header = Buffer.from(JSON.stringify({ alg: 'RS256', typ: 'JWT' })).toString('base64url');\n    const payload = Buffer.from(\n      JSON.stringify({\n        iss: this.credentials.client_email,\n        scope,\n        aud: 'https://oauth2.googleapis.com/token',\n        exp,\n        iat,\n      })\n    ).toString('base64url');\n\n    const signingInput = `${header}.${payload}`;\n\n    let signature: string;\n    try {\n      // eslint-disable-next-line @typescript-eslint/no-require-imports\n      const sign = require('node:crypto').createSign('RSA-SHA256');\n      sign.update(signingInput);\n      signature = sign.sign(this.credentials.private_key, 'base64url') as string;\n    } catch {\n      return Promise.resolve(null);\n    }\n\n    const jwt = `${signingInput}.${signature}`;\n    const body = `grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=${jwt}`;\n\n    return httpRequest({\n      url: new URL('https://oauth2.googleapis.com/token'),\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: 'GCP token request',\n    }).then(\n      (res) => (JSON.parse(res.body) as { access_token?: string }).access_token ?? null,\n      () => null\n    );\n  }\n\n  private secretValues(token?: string): (string | undefined)[] {\n    return [\n      ...(this.credentials?.private_key.split('\\n') ?? []),\n      this.credentials?.private_key,\n      this.accessToken ?? undefined,\n      token,\n    ];\n  }\n\n  private async writeEntries(entries: TransportLogEntry[]): Promise<void> {\n    const token = await this.getAccessToken();\n    if (!token) {\n      throw new Error('GCPTransport: no access token available');\n    }\n\n    const body = stringifyForLog({\n      logName: this.logName,\n      resource: this.resource,\n      entries: entries.map((e) => this.buildLogEntry(e)),\n    });\n\n    await httpRequest({\n      url: new URL('https://logging.googleapis.com/v2/entries:write'),\n      headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: 'GCP Logging API',\n      secrets: () => this.secretValues(token),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4FA,SAAS,cAAc,OAA4B;CACjD,QAAQ,MAAM,YAAY,GAA1B;EACE,KAAK;EACL,KAAK;EACL,KAAK,SACH,OAAO;EACT,KAAK;EACL,KAAK,OACH,OAAO;EACT,KAAK;EACL,KAAK,WACH,OAAO;EACT,KAAK,SACH,OAAO;EACT,KAAK;EACL,KAAK,SACH,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;AAKA,IAAa,eAAb,MAAqD;CACnD,OAAuB;CACvB;CACA;CACA;CAEA;CACA;CACA,aAA4C;CAC5C,cAAqC;CACrC,cAAsB;CAEtB;CACA;CACA;CACA;CAEA,YAAY,QAA4B;EACtC,sBAAA,eAAe,MAAM,CAAC,eAAe,aAAa,CAAC;EACnD,KAAK,YACH,OAAO,aACP,QAAQ,IAAI,2BACZ,QAAQ,IAAI,qBACZ;EACF,KAAK,UAAU,OAAO,WAAW,YAAY,KAAK,UAAU;EAC5D,KAAK,WAAW,OAAO,YAAY,EAAE,MAAM,SAAS;EACpD,KAAK,cAAc,OAAO;EAC1B,KAAK,YAAY,OAAO,aAAa;EACrC,KAAK,gBAAgB,OAAO,mBAAmB;EAC/C,KAAK,QAAQ,OAAO;EACpB,KAAK,mBAAmB,OAAO,oBAAA;EAC/B,KAAK,SAAS,IAAIA,qBAAAA,YAA+B;GAC/C,MAAM;GACN,WAAW,KAAK;GAChB,eAAe,OAAO,iBAAA;GACtB,OAAO,YAAY,KAAK,aAAa,OAAO;GAC5C,eAAe,KAAK,aAAa;EACnC,CAAC;EAED,KAAK,aAAa,kBAAkB;GAClC,KAAK,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;EAC7B,GAAG,KAAK,aAAa;EACrB,IAAI,KAAK,WAAW,OAAO,KAAK,WAAW,MAAM;CACnD;CAEA,MAAM,OAAgC;EACpC,KAAK,OAAO,KAAK,KAAK;EACtB,KAAK,OAAO,YAAY;CAC1B;CAEA,QAAuB;EACrB,OAAO,KAAK,OAAO,MAAM;CAC3B;;;;;;CAOA,MAAM,QAAuB;EAC3B,IAAI,KAAK,YAAY;GACnB,cAAc,KAAK,UAAU;GAC7B,KAAK,aAAa;EACpB;EACA,MAAM,KAAK,OAAO,MAAM;CAC1B;CAEA,cAAsB,OAAmD;EACvE,MAAM,WAAoC;GACxC,SAAS,KAAK;GACd,UAAU,KAAK;GACf,UAAU,cAAc,MAAM,KAAK;GACnC,WAAW,MAAM,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;GACrD,aAAaC,qBAAAA,gBACX;IAAE,SAAS,MAAM;IAAS,SAAS,MAAM;IAAS,SAAS,MAAM;GAAQ,GACzE,MAAM,IACR;EACF;EAGA,IAAI,MAAM,SAAS;GACjB,SAAS,WAAW,YAAY,KAAK,UAAU,UAAU,MAAM;GAC/D,SAAS,kBAAkB;EAC7B;EAEA,OAAO;CACT;CAEA,MAAc,iBAAyC;EACrD,IAAI,KAAK,eAAe,KAAK,IAAI,IAAI,KAAK,aAAa,OAAO,KAAK;EAGnE,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,wBAAwB;GACjD,IAAI,OAAO;IACT,KAAK,cAAc;IACnB,KAAK,cAAc,KAAK,IAAI,IAAI;IAChC,OAAO,KAAK;GACd;EACF,QAAQ,CAER;EAGA,IAAI,KAAK,aACP,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,yBAAyB;GAClD,IAAI,OAAO;IACT,KAAK,cAAc;IACnB,KAAK,cAAc,KAAK,IAAI,IAAI;IAChC,OAAO,KAAK;GACd;EACF,SAAS,KAAK;GACZ,qBAAA,cAAc,4CAA4C,GAAG;EAC/D;EAGF,OAAO;CACT;CAEA,0BAA0D;EACxD,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,MAAM,MAAMC,WAAM,QAChB;IACE,UAAU;IACV,MAAM;IACN,SAAS,EAAE,mBAAmB,SAAS;IACvC,SAAS;GACX,IACC,QAAQ;IACP,IAAI,MAAM;IACV,IAAI,GAAG,SAAS,MAAe,OAAO,EAAE,SAAS,CAAE;IACnD,IAAI,GAAG,aAAa;KAClB,IAAI,IAAI,eAAe,KACrB,IAAI;MAEF,QADe,KAAK,MAAM,GACb,CAAC,CAAC,gBAAgB,IAAI;KACrC,QAAQ;MACN,QAAQ,IAAI;KACd;UAEA,QAAQ,IAAI;IAEhB,CAAC;GACH,CACF;GACA,IAAI,GAAG,SAAS,MAAM;GACtB,IAAI,GAAG,iBAAiB;IACtB,IAAI,QAAQ;IACZ,uBAAO,IAAI,MAAM,kBAAkB,CAAC;GACtC,CAAC;GACD,IAAI,IAAI;EACV,CAAC;CACH;CAEA,2BAA2D;EAGzD,IAAI,CAAC,KAAK,aAAa,OAAO,QAAQ,QAAQ,IAAI;EAElD,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC,MAAM,MAAM,MAAM;EAclB,MAAM,eAAe,GAXN,OAAO,KAAK,KAAK,UAAU;GAAE,KAAK;GAAS,KAAK;EAAM,CAAC,CAAC,CAAC,CAAC,SAAS,WAWrD,EAAE,GAVf,OAAO,KACrB,KAAK,UAAU;GACb,KAAK,KAAK,YAAY;GACtB,OAAA;GACA,KAAK;GACL;GACA;EACF,CAAC,CACH,CAAC,CAAC,SAAS,WAE6B;EAExC,IAAI;EACJ,IAAI;GAEF,MAAM,OAAO,QAAQ,aAAa,CAAC,CAAC,WAAW,YAAY;GAC3D,KAAK,OAAO,YAAY;GACxB,YAAY,KAAK,KAAK,KAAK,YAAY,aAAa,WAAW;EACjE,QAAQ;GACN,OAAO,QAAQ,QAAQ,IAAI;EAC7B;EAGA,MAAM,OAAO,8EAA8E,GAD5E,aAAa,GAAG;EAG/B,OAAOC,qBAAAA,YAAY;GACjB,KAAK,IAAI,IAAI,qCAAqC;GAClD,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D;GACA,WAAW,KAAK;GAChB,OAAO;EACT,CAAC,CAAC,CAAC,MACA,QAAS,KAAK,MAAM,IAAI,IAAI,CAAC,CAA+B,gBAAgB,YACvE,IACR;CACF;CAEA,aAAqB,OAAwC;;EAC3D,OAAO;GACL,KAAA,oBAAI,KAAK,iBAAA,QAAA,sBAAA,KAAA,IAAA,KAAA,IAAA,kBAAa,YAAY,MAAM,IAAI,MAAK,CAAC;IAClD,qBAAA,KAAK,iBAAA,QAAA,uBAAA,KAAA,IAAA,KAAA,IAAA,mBAAa;GAClB,KAAK,eAAe,KAAA;GACpB;EACF;CACF;CAEA,MAAc,aAAa,SAA6C;EACtE,MAAM,QAAQ,MAAM,KAAK,eAAe;EACxC,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,yCAAyC;EAG3D,MAAM,OAAOC,uBAAAA,gBAAgB;GAC3B,SAAS,KAAK;GACd,UAAU,KAAK;GACf,SAAS,QAAQ,KAAK,MAAM,KAAK,cAAc,CAAC,CAAC;EACnD,CAAC;EAED,MAAMD,qBAAAA,YAAY;GAChB,KAAK,IAAI,IAAI,iDAAiD;GAC9D,SAAS;IAAE,eAAe,UAAU;IAAS,gBAAgB;GAAmB;GAChF;GACA,WAAW,KAAK;GAChB,OAAO;GACP,eAAe,KAAK,aAAa,KAAK;EACxC,CAAC;CACH;AACF"}

package/dist/hono.d.mts

@@ -0,0 +1,66 @@
+/**
+ * Hono request logging middleware: trace ID, response header and a completion entry.
+ *
+ * Only structural types are used, so it works with any Hono version and runs on Node,
+ * Bun and Cloudflare Workers (`nodejs_compat`, for `AsyncLocalStorage`).
+ *
+ * @example
+ * ```ts
+ * import { Hono } from 'hono';
+ * import { createHonoMiddleware } from 'logixia/hono';
+ *
+ * const app = new Hono();
+ * app.use(createHonoMiddleware(logger));
+ * ```
+ */
+type LogFn = (message: string, data?: Record<string, unknown>) => unknown;
+/** The logger methods used: logixia's `Logger` and `createBrowserLogger()` both fit. */
+interface HonoLoggerLike {
+  info: LogFn;
+  warn: LogFn;
+  error: LogFn;
+}
+/** The slice of Hono's `Context` the middleware reads and writes. */
+interface HonoContextLike {
+  req: {
+    method: string;
+    url: string;
+    header(name: string): string | undefined;
+  };
+  res: Response;
+  error?: Error | undefined;
+  header(name: string, value: string): unknown;
+  set(key: 'traceId', value: string): void;
+}
+type HonoNext = () => Promise<void>;
+interface HonoMiddlewareOptions {
+  /** Skip logging and tracing for a request, for example health checks. */
+  skip?: (c: HonoContextLike) => boolean;
+  /**
+   * Header name, or list of names tried in order, to read the trace ID from.
+   * Default: `DEFAULT_TRACE_HEADERS` (traceparent, x-trace-id, x-request-id,
+   * x-correlation-id, trace-id). A generated UUID is used when none is present.
+   */
+  traceIdHeader?: string | readonly string[];
+  /** Response header that carries the trace ID. Default: `'x-trace-id'`. `false` sets none. */
+  responseHeader?: string | false;
+  /**
+   * Extra query-string parameter names redacted from the logged path, merged with the
+   * defaults (token, access_token, refresh_token, code, password, secret, api_key, ...).
+   */
+  redactQueryParams?: string[];
+  /** Fields added to every entry. */
+  extraFields?: (c: HonoContextLike) => Record<string, unknown>;
+}
+/**
+ * Create a Hono middleware (`app.use(...)`).
+ *
+ * Per request it resolves the trace ID from headers, sets it on the response and on
+ * `c.var.traceId`, runs the rest of the request inside {@link runWithTraceId} and logs
+ * one entry when the request completes: `method`, `path` (query secrets redacted),
+ * `status`, `duration` in ms and `traceId`. Responses with status 500 and above, and
+ * errors thrown by handlers, are logged at `error`; other thrown errors at `warn`.
+ */
+export declare function createHonoMiddleware(logger: HonoLoggerLike, options?: HonoMiddlewareOptions): (c: HonoContextLike, next: HonoNext) => Promise<void>;
+export type { HonoContextLike, HonoLoggerLike, HonoMiddlewareOptions, HonoNext };
+//# sourceMappingURL=hono.d.mts.map

package/dist/hono.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono.d.mts","names":[],"sources":["../src/hono/middleware.ts"],"mappings":";;;;;;;;;;;;;;;KA4BK,SAAS,iBAAiB,OAAO;;UAGrB;EACf,MAAM;EACN,MAAM;EACN,OAAO;;;UAIQ;EACf;IAAO;IAAgB;IAAa,OAAO;;EAC3C,KAAK;EACL,QAAQ;EACR,OAAO,cAAc;EACrB,IAAI,gBAAgB;;KAGV,iBAAiB;UAEZ;;EAEf,QAAQ,GAAG;;;;;;EAMX;;EAEA;;;;;EAKA;;EAEA,eAAe,GAAG,oBAAoB;;;;;;;;;;;wBA+CxB,qBACd,QAAQ,gBACR,UAAS,yBACP,GAAG,iBAAiB,MAAM,aAAa"}

package/dist/hono.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Hono request logging middleware: trace ID, response header and a completion entry.
+ *
+ * Only structural types are used, so it works with any Hono version and runs on Node,
+ * Bun and Cloudflare Workers (`nodejs_compat`, for `AsyncLocalStorage`).
+ *
+ * @example
+ * ```ts
+ * import { Hono } from 'hono';
+ * import { createHonoMiddleware } from 'logixia/hono';
+ *
+ * const app = new Hono();
+ * app.use(createHonoMiddleware(logger));
+ * ```
+ */
+type LogFn = (message: string, data?: Record<string, unknown>) => unknown;
+/** The logger methods used: logixia's `Logger` and `createBrowserLogger()` both fit. */
+interface HonoLoggerLike {
+  info: LogFn;
+  warn: LogFn;
+  error: LogFn;
+}
+/** The slice of Hono's `Context` the middleware reads and writes. */
+interface HonoContextLike {
+  req: {
+    method: string;
+    url: string;
+    header(name: string): string | undefined;
+  };
+  res: Response;
+  error?: Error | undefined;
+  header(name: string, value: string): unknown;
+  set(key: 'traceId', value: string): void;
+}
+type HonoNext = () => Promise<void>;
+interface HonoMiddlewareOptions {
+  /** Skip logging and tracing for a request, for example health checks. */
+  skip?: (c: HonoContextLike) => boolean;
+  /**
+   * Header name, or list of names tried in order, to read the trace ID from.
+   * Default: `DEFAULT_TRACE_HEADERS` (traceparent, x-trace-id, x-request-id,
+   * x-correlation-id, trace-id). A generated UUID is used when none is present.
+   */
+  traceIdHeader?: string | readonly string[];
+  /** Response header that carries the trace ID. Default: `'x-trace-id'`. `false` sets none. */
+  responseHeader?: string | false;
+  /**
+   * Extra query-string parameter names redacted from the logged path, merged with the
+   * defaults (token, access_token, refresh_token, code, password, secret, api_key, ...).
+   */
+  redactQueryParams?: string[];
+  /** Fields added to every entry. */
+  extraFields?: (c: HonoContextLike) => Record<string, unknown>;
+}
+/**
+ * Create a Hono middleware (`app.use(...)`).
+ *
+ * Per request it resolves the trace ID from headers, sets it on the response and on
+ * `c.var.traceId`, runs the rest of the request inside {@link runWithTraceId} and logs
+ * one entry when the request completes: `method`, `path` (query secrets redacted),
+ * `status`, `duration` in ms and `traceId`. Responses with status 500 and above, and
+ * errors thrown by handlers, are logged at `error`; other thrown errors at `warn`.
+ */
+export declare function createHonoMiddleware(logger: HonoLoggerLike, options?: HonoMiddlewareOptions): (c: HonoContextLike, next: HonoNext) => Promise<void>;
+export type { HonoContextLike, HonoLoggerLike, HonoMiddlewareOptions, HonoNext };
+//# sourceMappingURL=hono.d.ts.map

package/dist/hono.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hono.d.ts","names":[],"sources":["../src/hono/middleware.ts"],"mappings":";;;;;;;;;;;;;;;KA4BK,SAAS,iBAAiB,OAAO;;UAGrB;EACf,MAAM;EACN,MAAM;EACN,OAAO;;;UAIQ;EACf;IAAO;IAAgB;IAAa,OAAO;;EAC3C,KAAK;EACL,QAAQ;EACR,OAAO,cAAc;EACrB,IAAI,gBAAgB;;KAGV,iBAAiB;UAEZ;;EAEf,QAAQ,GAAG;;;;;;EAMX;;EAEA;;;;;EAKA;;EAEA,eAAe,GAAG,oBAAoB;;;;;;;;;;;wBA+CxB,qBACd,QAAQ,gBACR,UAAS,yBACP,GAAG,iBAAiB,MAAM,aAAa"}