logixia 2.3.0 → 2.3.1

package/dist/{cloudwatch.transport-DO9e__Z-.js.map → cloudwatch.transport-DCTWV9p6.js.map}

@@ -1 +1 @@
-{"version":3,"file":"cloudwatch.transport-DO9e__Z-.js","names":["path","os","fs","httpRequest","crypto","HttpError","BatchBuffer","urlSecrets","isPermanentHttpError","stringifyForLog","mergeCoreFields","httpRequest"],"sources":["../src/transports/aws-credentials.ts","../src/transports/aws-sigv4.ts","../src/transports/cloudwatch.transport.ts"],"sourcesContent":["/**\n * AWS credential resolution without the SDK.\n *\n * Order: explicit config, environment variables, shared credentials file,\n * ECS/container credentials, EC2 instance metadata (IMDSv2).\n * Not supported: SSO, assume-role profiles, credential_process, web identity.\n */\n\nimport * as fs from 'node:fs';\nimport * as os from 'node:os';\nimport * as path from 'node:path';\n\nimport { internalWarn } from '../utils/internal-log';\nimport { type AwsCredentials } from './aws-sigv4';\nimport { httpRequest } from './batch-buffer';\nimport { protectSecrets } from './secret-config';\n\nconst REFRESH_MARGIN_MS = 5 * 60 * 1000;\nconst FAILURE_BACKOFF_MS = 30 * 1000;\nconst METADATA_TIMEOUT_MS = 2000;\n\nexport interface AwsCredentialConfig {\n  accessKeyId?: string | undefined;\n  secretAccessKey?: string | undefined;\n  sessionToken?: string | undefined;\n}\n\n/** Parse the sections of an AWS ini file into `{ section: { key: value } }`. */\nexport function parseIni(text: string): Record<string, Record<string, string>> {\n  const out: Record<string, Record<string, string>> = {};\n  let section: Record<string, string> | undefined;\n  for (const raw of text.split(/\\r?\\n/)) {\n    const line = raw.trim();\n    if (!line || line.startsWith('#') || line.startsWith(';')) continue;\n    const header = /^\\[(.+)\\]$/.exec(line);\n    if (header) {\n      section = out[header[1]!.trim()] = out[header[1]!.trim()] ?? {};\n      continue;\n    }\n    const eq = line.indexOf('=');\n    if (eq > 0 && section) section[line.slice(0, eq).trim()] = line.slice(eq + 1).trim();\n  }\n  return out;\n}\n\nfunction fromEnv(): AwsCredentials | undefined {\n  const accessKeyId = process.env['AWS_ACCESS_KEY_ID'];\n  const secretAccessKey = process.env['AWS_SECRET_ACCESS_KEY'];\n  if (!accessKeyId || !secretAccessKey) return undefined;\n  return { accessKeyId, secretAccessKey, sessionToken: process.env['AWS_SESSION_TOKEN'] };\n}\n\nfunction fromSharedFile(): AwsCredentials | undefined {\n  const file =\n    process.env['AWS_SHARED_CREDENTIALS_FILE'] ?? path.join(os.homedir(), '.aws', 'credentials');\n  const profile = process.env['AWS_PROFILE'] ?? 'default';\n  let text: string;\n  try {\n    text = fs.readFileSync(file, 'utf8');\n  } catch {\n    return undefined;\n  }\n  const section = parseIni(text)[profile];\n  const accessKeyId = section?.['aws_access_key_id'];\n  const secretAccessKey = section?.['aws_secret_access_key'];\n  if (!accessKeyId || !secretAccessKey) return undefined;\n  return { accessKeyId, secretAccessKey, sessionToken: section?.['aws_session_token'] };\n}\n\ninterface CredentialDocument {\n  AccessKeyId?: string;\n  SecretAccessKey?: string;\n  Token?: string;\n  Expiration?: string;\n}\n\nfunction fromDocument(raw: string): AwsCredentials | undefined {\n  const doc = JSON.parse(raw) as CredentialDocument;\n  if (!doc.AccessKeyId || !doc.SecretAccessKey) return undefined;\n  const expiresAt = doc.Expiration ? Date.parse(doc.Expiration) : Number.NaN;\n  return {\n    accessKeyId: doc.AccessKeyId,\n    secretAccessKey: doc.SecretAccessKey,\n    sessionToken: doc.Token,\n    expiresAt: Number.isNaN(expiresAt) ? undefined : expiresAt,\n  };\n}\n\nconst CONTAINER_HOSTS = new Set([\n  // eslint-disable-next-line sonarjs/no-hardcoded-ip -- fixed ECS credentials endpoint\n  '169.254.170.2',\n  // eslint-disable-next-line sonarjs/no-hardcoded-ip -- fixed EKS pod identity endpoint\n  '169.254.170.23',\n  '[fd00:ec2::23]',\n  'localhost',\n  '[::1]',\n]);\n\n/** Same rule as the AWS SDKs: never send the container token to an arbitrary http host. */\nfunction isAllowedContainerHost(url: URL): boolean {\n  if (url.protocol === 'https:') return true;\n  if (url.protocol !== 'http:') return false;\n  return CONTAINER_HOSTS.has(url.hostname) || /^127(?:\\.\\d{1,3}){3}$/.test(url.hostname);\n}\n\nasync function fromContainer(): Promise<AwsCredentials | undefined> {\n  const relative = process.env['AWS_CONTAINER_CREDENTIALS_RELATIVE_URI'];\n  const full = process.env['AWS_CONTAINER_CREDENTIALS_FULL_URI'];\n  if (!relative && !full) return undefined;\n  const url = new URL(relative ? `http://169.254.170.2${relative}` : (full as string));\n  if (!relative && !isAllowedContainerHost(url)) {\n    internalWarn(\n      `ignoring AWS_CONTAINER_CREDENTIALS_FULL_URI: ${url.host} is not https or a loopback / ECS / EKS address`\n    );\n    return undefined;\n  }\n  const headers: Record<string, string> = {};\n  const tokenFile = process.env['AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE'];\n  const token = tokenFile\n    ? fs.readFileSync(tokenFile, 'utf8').trim()\n    : process.env['AWS_CONTAINER_AUTHORIZATION_TOKEN'];\n  if (token) headers['Authorization'] = token;\n  const res = await httpRequest({\n    url,\n    method: 'GET',\n    headers,\n    timeoutMs: METADATA_TIMEOUT_MS,\n    label: 'AWS container credentials',\n  });\n  return fromDocument(res.body);\n}\n\nasync function fromInstanceMetadata(): Promise<AwsCredentials | undefined> {\n  if (process.env['AWS_EC2_METADATA_DISABLED'] === 'true') return undefined;\n  const base = process.env['AWS_EC2_METADATA_SERVICE_ENDPOINT'] ?? 'http://169.254.169.254';\n  const get = (p: string, method: string, headers: Record<string, string>) =>\n    httpRequest({\n      url: new URL(p, base),\n      method,\n      headers,\n      timeoutMs: METADATA_TIMEOUT_MS,\n      label: 'EC2 instance metadata',\n    });\n  const session = await get('/latest/api/token', 'PUT', {\n    'X-aws-ec2-metadata-token-ttl-seconds': '21600',\n  });\n  const auth = { 'X-aws-ec2-metadata-token': session.body.trim() };\n  const roles = await get('/latest/meta-data/iam/security-credentials/', 'GET', auth);\n  const role = roles.body.split('\\n')[0]?.trim();\n  if (!role) return undefined;\n  const creds = await get(\n    `/latest/meta-data/iam/security-credentials/${encodeURIComponent(role)}`,\n    'GET',\n    auth\n  );\n  return fromDocument(creds.body);\n}\n\nexport class AwsCredentialProvider {\n  private cached: AwsCredentials | undefined;\n  private failedAt = 0;\n  private readonly explicit: AwsCredentials | undefined;\n\n  constructor(config: AwsCredentialConfig) {\n    protectSecrets(this, ['cached', 'explicit']);\n    if (config.accessKeyId && config.secretAccessKey) {\n      this.explicit = {\n        accessKeyId: config.accessKeyId,\n        secretAccessKey: config.secretAccessKey,\n        sessionToken: config.sessionToken,\n      };\n    }\n  }\n\n  /** Throws when no source yields credentials, so the caller keeps its buffer. */\n  async get(): Promise<AwsCredentials> {\n    if (this.explicit) return this.explicit;\n    const env = fromEnv();\n    if (env) return env;\n    if (this.cached && !this.isExpiring(this.cached)) return this.cached;\n    if (Date.now() - this.failedAt < FAILURE_BACKOFF_MS) {\n      throw new Error('no AWS credentials found (retrying shortly)');\n    }\n\n    let found = fromSharedFile();\n    for (const source of [fromContainer, fromInstanceMetadata]) {\n      if (found) break;\n      try {\n        found = await source();\n      } catch {\n        /* source not available here; try the next */\n      }\n    }\n    if (!found) {\n      this.failedAt = Date.now();\n      throw new Error(\n        'no AWS credentials found: set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, a shared credentials file, container credentials, or run on EC2 with an instance role'\n      );\n    }\n    this.cached = found;\n    return found;\n  }\n\n  /** Secret values this provider may hold, for scrubbing error text. */\n  secretValues(): (string | undefined)[] {\n    const env = process.env;\n    return [\n      this.explicit?.secretAccessKey,\n      this.explicit?.sessionToken,\n      this.cached?.secretAccessKey,\n      this.cached?.sessionToken,\n      env['AWS_SECRET_ACCESS_KEY'],\n      env['AWS_SESSION_TOKEN'],\n    ];\n  }\n\n  invalidate(): void {\n    this.cached = undefined;\n    this.failedAt = 0;\n  }\n\n  private isExpiring(c: AwsCredentials): boolean {\n    return c.expiresAt !== undefined && c.expiresAt - Date.now() < REFRESH_MARGIN_MS;\n  }\n}\n","/**\n * AWS Signature Version 4 request signing, dependency-free.\n */\n\nimport * as crypto from 'node:crypto';\n\nexport interface AwsCredentials {\n  accessKeyId: string;\n  secretAccessKey: string;\n  sessionToken?: string | undefined;\n  /** Epoch ms after which the credentials are no longer valid. */\n  expiresAt?: number | undefined;\n}\n\nexport interface SignV4Options {\n  method: string;\n  path: string;\n  query?: string;\n  /** Must include `host`. Names are lowercased before signing. */\n  headers: Record<string, string>;\n  body: string;\n  region: string;\n  service: string;\n  credentials: AwsCredentials;\n  date?: Date;\n}\n\nconst sha256Hex = (data: string): string => crypto.createHash('sha256').update(data).digest('hex');\n\nconst hmac = (key: Buffer | string, msg: string): Buffer =>\n  crypto.createHmac('sha256', key).update(msg).digest();\n\n/** Returns the request headers (lowercase names) with `x-amz-date` and `authorization` added. */\nexport function signV4(opts: SignV4Options): Record<string, string> {\n  const {\n    method,\n    path,\n    query = '',\n    body,\n    region,\n    service,\n    credentials,\n    headers: input,\n    date,\n  } = opts;\n  const amzDate = (date ?? new Date()).toISOString().replace(/[:-]|\\.\\d{3}/g, '');\n  const dateStamp = amzDate.slice(0, 8);\n\n  const headers: Record<string, string> = {};\n  for (const [k, v] of Object.entries(input)) headers[k.toLowerCase()] = v;\n  headers['x-amz-date'] = amzDate;\n  if (credentials.sessionToken) headers['x-amz-security-token'] = credentials.sessionToken;\n\n  const names = Object.keys(headers).sort();\n  const canonicalHeaders = names\n    .map((n) => `${n}:${headers[n]!.trim().replace(/\\s+/g, ' ')}\\n`)\n    .join('');\n  const signedHeaders = names.join(';');\n\n  const canonicalRequest = [\n    method,\n    path,\n    query,\n    canonicalHeaders,\n    signedHeaders,\n    sha256Hex(body),\n  ].join('\\n');\n  const scope = `${dateStamp}/${region}/${service}/aws4_request`;\n  const stringToSign = ['AWS4-HMAC-SHA256', amzDate, scope, sha256Hex(canonicalRequest)].join('\\n');\n\n  const signingKey = hmac(\n    hmac(hmac(hmac(`AWS4${credentials.secretAccessKey}`, dateStamp), region), service),\n    'aws4_request'\n  );\n  const signature = crypto.createHmac('sha256', signingKey).update(stringToSign).digest('hex');\n\n  headers['authorization'] =\n    `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, ` +\n    `SignedHeaders=${signedHeaders}, Signature=${signature}`;\n  return headers;\n}\n","/**\n * logixia — AWS CloudWatch Logs transport\n *\n * Sends log entries to AWS CloudWatch Logs via the PutLogEvents API.\n * Supports EMF (Embedded Metric Format) for automatic metric extraction.\n *\n * Auth, in order: explicit config, environment variables, the shared\n * credentials file (AWS_PROFILE, AWS_SHARED_CREDENTIALS_FILE), ECS container\n * credentials, then EC2 instance metadata (IMDSv2). SSO, assume-role profiles\n * and credential_process are not supported. No SDK dependency — raw HTTPS with\n * AWS Signature Version 4.\n *\n * The log group and stream are created on first use if they do not exist.\n *\n * @example\n * ```ts\n * import { createLogger } from 'logixia';\n * import { CloudWatchTransport } from 'logixia/cloudwatch';\n *\n * const logger = createLogger({\n *   transports: {\n *     custom: [\n *       new CloudWatchTransport({\n *         region: 'us-east-1',\n *         logGroupName: '/myapp/production',\n *         logStreamName: `api-${process.env.HOSTNAME}`,\n *         batchSize: 100,\n *         flushIntervalMs: 5000,\n *       }),\n *     ],\n *   },\n * });\n * ```\n */\n\nimport type { IAsyncTransport, TransportLogEntry } from '../types/transport.types';\nimport { internalWarn } from '../utils/internal-log';\nimport { stringifyForLog } from '../utils/safe-stringify';\nimport { AwsCredentialProvider } from './aws-credentials';\nimport { signV4 } from './aws-sigv4';\nimport {\n  BatchBuffer,\n  DEFAULT_MAX_BUFFER_SIZE,\n  DEFAULT_REQUEST_TIMEOUT_MS,\n  HttpError,\n  httpRequest,\n  isPermanentHttpError,\n} from './batch-buffer';\nimport { mergeCoreFields } from './entry-fields';\nimport { protectSecrets, urlSecrets } from './secret-config';\n\nexport interface CloudWatchTransportConfig {\n  /** AWS region, e.g. `'us-east-1'`. Falls back to `AWS_REGION` env var. */\n  region?: string;\n  /** CloudWatch Logs group name. Created automatically if it does not exist. */\n  logGroupName: string;\n  /** CloudWatch Logs stream name. Defaults to hostname + process PID. */\n  logStreamName?: string;\n  /** Override the Logs endpoint, e.g. for LocalStack. Default: `https://logs.<region>.amazonaws.com`. */\n  endpoint?: string;\n  /** AWS access key ID. Falls back to the credential chain described above. */\n  accessKeyId?: string;\n  /** AWS secret access key. Used together with `accessKeyId`. */\n  secretAccessKey?: string;\n  /** AWS session token for temporary credentials. Used together with `accessKeyId`. */\n  sessionToken?: string;\n  /**\n   * Number of log events to batch before flushing.\n   * CloudWatch allows max 10,000 events per PutLogEvents call; larger values are capped.\n   * @default 100\n   */\n  batchSize?: number;\n  /**\n   * Max ms between flushes even if batchSize is not reached.\n   * @default 5000\n   */\n  flushIntervalMs?: number;\n  /**\n   * Enable EMF (Embedded Metric Format) — wraps log entries as CloudWatch\n   * metric namespaces so numeric fields become CloudWatch Metrics automatically.\n   * @default false\n   */\n  emf?: boolean;\n  /** CloudWatch Metrics namespace used by EMF. @default 'Logixia' */\n  emfNamespace?: string;\n  /**\n   * Payload fields published as EMF metrics. When set, only these numeric\n   * fields become metrics; when unset every numeric payload field does (up to\n   * the EMF limit of 100 per entry).\n   */\n  emfMetrics?: string[];\n  /** Abort a request that has not finished after this many ms. @default 10000 */\n  requestTimeoutMs?: number;\n  /** Max buffered events; the oldest are dropped past this. @default 10000 */\n  maxBufferSize?: number;\n  /** Minimum log level to forward. */\n  level?: string;\n}\n\nconst MAX_EVENTS_PER_PUT = 10_000;\nconst EMF_MAX_METRICS = 100;\n\n/** Error types worth retrying even though CloudWatch reports them as HTTP 400. */\nconst RETRYABLE_TYPES = new Set([\n  'ThrottlingException',\n  'ThrottledException',\n  'LimitExceededException',\n  'ServiceUnavailableException',\n  'ExpiredTokenException',\n  'ResourceNotFoundException',\n]);\n\nfunction awsErrorType(err: unknown): string | undefined {\n  if (!(err instanceof HttpError)) return undefined;\n  try {\n    const type = (JSON.parse(err.body) as { __type?: string }).__type;\n    return type?.split('#').pop();\n  } catch {\n    return undefined;\n  }\n}\n\ninterface CwLogEvent {\n  timestamp: number;\n  message: string;\n}\n\n/**\n * AWS CloudWatch Logs transport with EMF support and batched PutLogEvents calls.\n */\nexport class CloudWatchTransport implements IAsyncTransport {\n  public readonly name = 'cloudwatch';\n  public readonly batchSize: number;\n  public readonly flushInterval: number;\n  public readonly level: string | undefined;\n\n  private readonly buffer: BatchBuffer<CwLogEvent>;\n  private readonly requestTimeoutMs: number;\n  private flushTimer: NodeJS.Timeout | null = null;\n  private readonly credentials: AwsCredentialProvider;\n  private readonly endpoint: URL;\n  private streamReady = false;\n\n  private readonly region: string;\n  private readonly logGroupName: string;\n  private readonly logStreamName: string;\n  private readonly emf: boolean;\n  private readonly emfNamespace: string;\n  private readonly emfMetrics: ReadonlySet<string> | undefined;\n\n  constructor(config: CloudWatchTransportConfig) {\n    this.region =\n      config.region ??\n      process.env['AWS_REGION'] ??\n      process.env['AWS_DEFAULT_REGION'] ??\n      'us-east-1';\n    this.logGroupName = config.logGroupName;\n    this.logStreamName =\n      config.logStreamName ?? `${process.env['HOSTNAME'] ?? 'node'}-${process.pid}`;\n    this.credentials = new AwsCredentialProvider(config);\n    this.endpoint = new URL(config.endpoint ?? `https://logs.${this.region}.amazonaws.com`);\n    this.batchSize = Math.min(config.batchSize ?? 100, MAX_EVENTS_PER_PUT);\n    this.emfNamespace = config.emfNamespace ?? 'Logixia';\n    this.flushInterval = config.flushIntervalMs ?? 5000;\n    this.emf = config.emf ?? false;\n    this.emfMetrics = config.emfMetrics ? new Set(config.emfMetrics) : undefined;\n    this.level = config.level;\n    this.requestTimeoutMs = config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;\n    this.buffer = new BatchBuffer<CwLogEvent>({\n      name: 'CloudWatchTransport',\n      batchSize: this.batchSize,\n      maxBufferSize: config.maxBufferSize ?? DEFAULT_MAX_BUFFER_SIZE,\n      send: (events) => this.putLogEvents(events),\n      secrets: () => [...this.credentials.secretValues(), ...urlSecrets(this.endpoint)],\n      shouldRetry: (err) =>\n        !isPermanentHttpError(err) || RETRYABLE_TYPES.has(awsErrorType(err) ?? ''),\n    });\n\n    this.flushTimer = setInterval(() => {\n      this.flush().catch(() => {});\n    }, this.flushInterval);\n    if (this.flushTimer.unref) this.flushTimer.unref();\n    protectSecrets(this, ['credentials', 'endpoint']);\n  }\n\n  write(entry: TransportLogEntry): void {\n    const timestamp = entry.timestamp ? new Date(entry.timestamp).getTime() : Date.now();\n    const message = this.emf ? this.toEmf(entry) : stringifyForLog(entry);\n    this.buffer.push({ timestamp, message });\n    this.buffer.flushIfFull();\n  }\n\n  flush(): Promise<void> {\n    return this.buffer.flush();\n  }\n\n  /**\n   * Flush remaining events and stop the interval timer on shutdown. Without this\n   * the manager's close() skips the transport (close was undefined) and any\n   * buffered events were lost on deploy. Waits for any in-flight send first.\n   */\n  async close(): Promise<void> {\n    if (this.flushTimer) {\n      clearInterval(this.flushTimer);\n      this.flushTimer = null;\n    }\n    await this.buffer.close();\n  }\n\n  private toEmf(entry: TransportLogEntry): string {\n    const { level, message, data: payload, timestamp } = entry;\n    const fields = mergeCoreFields({ _aws: undefined, level, message }, payload);\n    const metricNames: string[] = [];\n    for (const [k, v] of Object.entries(fields)) {\n      if (k === '_aws' || k === 'level' || k === 'message' || typeof v !== 'number') continue;\n      if (this.emfMetrics && !this.emfMetrics.has(k)) continue;\n      if (metricNames.length < EMF_MAX_METRICS) metricNames.push(k);\n    }\n    fields['_aws'] = {\n      Timestamp: timestamp ? new Date(timestamp).getTime() : Date.now(),\n      CloudWatchMetrics:\n        metricNames.length > 0\n          ? [\n              {\n                Namespace: this.emfNamespace,\n                Dimensions: [['level']],\n                Metrics: metricNames.map((n) => ({ Name: n, Unit: 'None' })),\n              },\n            ]\n          : [],\n    };\n    return stringifyForLog(fields);\n  }\n\n  private async putLogEvents(events: CwLogEvent[]): Promise<void> {\n    await this.ensureStream();\n    const logEvents = [...events].sort((a, b) => a.timestamp - b.timestamp);\n    try {\n      await this.call('PutLogEvents', {\n        logGroupName: this.logGroupName,\n        logStreamName: this.logStreamName,\n        logEvents,\n      });\n    } catch (err) {\n      const type = awsErrorType(err);\n      if (type === 'DataAlreadyAcceptedException') return;\n      if (type === 'ResourceNotFoundException') this.streamReady = false;\n      if (type === 'ExpiredTokenException') this.credentials.invalidate();\n      throw err;\n    }\n  }\n\n  private async ensureStream(): Promise<void> {\n    if (this.streamReady) return;\n    try {\n      await this.call('CreateLogGroup', { logGroupName: this.logGroupName });\n    } catch (err) {\n      if (awsErrorType(err) === 'ExpiredTokenException') this.credentials.invalidate();\n      if (!(err instanceof HttpError)) throw err;\n      if (awsErrorType(err) !== 'ResourceAlreadyExistsException') {\n        internalWarn(`CloudWatchTransport: CreateLogGroup failed, continuing (${err.message})`);\n      }\n    }\n    try {\n      await this.call('CreateLogStream', {\n        logGroupName: this.logGroupName,\n        logStreamName: this.logStreamName,\n      });\n    } catch (err) {\n      if (awsErrorType(err) !== 'ResourceAlreadyExistsException') throw err;\n    }\n    this.streamReady = true;\n  }\n\n  private async call(action: string, payload: Record<string, unknown>): Promise<void> {\n    const credentials = await this.credentials.get();\n    const body = stringifyForLog(payload);\n    const { host } = this.endpoint;\n    const headers = signV4({\n      method: 'POST',\n      path: '/',\n      headers: {\n        host,\n        'content-type': 'application/x-amz-json-1.1',\n        'x-amz-target': `Logs_20140328.${action}`,\n      },\n      body,\n      region: this.region,\n      service: 'logs',\n      credentials,\n    });\n    await httpRequest({\n      url: this.endpoint,\n      headers,\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: `CloudWatch ${action}`,\n      secrets: () => [\n        ...this.credentials.secretValues(),\n        headers['authorization'],\n        headers['x-amz-security-token'],\n        ...urlSecrets(this.endpoint),\n      ],\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAiBA,MAAM,oBAAoB;AAC1B,MAAM,qBAAqB;AAC3B,MAAM,sBAAsB;;AAS5B,SAAgB,SAAS,MAAsD;CAC7E,MAAM,MAA8C,CAAC;CACrD,IAAI;CACJ,KAAK,MAAM,OAAO,KAAK,MAAM,OAAO,GAAG;EACrC,MAAM,OAAO,IAAI,KAAK;EACtB,IAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,GAAG,GAAG;EAC3D,MAAM,SAAS,aAAa,KAAK,IAAI;EACrC,IAAI,QAAQ;GACV,UAAU,IAAI,OAAO,EAAE,CAAE,KAAK,KAAK,IAAI,OAAO,EAAE,CAAE,KAAK,MAAM,CAAC;GAC9D;EACF;EACA,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,IAAI,KAAK,KAAK,SAAS,QAAQ,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK;CACrF;CACA,OAAO;AACT;AAEA,SAAS,UAAsC;CAC7C,MAAM,cAAc,QAAQ,IAAI;CAChC,MAAM,kBAAkB,QAAQ,IAAI;CACpC,IAAI,CAAC,eAAe,CAAC,iBAAiB,OAAO,KAAA;CAC7C,OAAO;EAAE;EAAa;EAAiB,cAAc,QAAQ,IAAI;CAAqB;AACxF;AAEA,SAAS,iBAA6C;CACpD,MAAM,OACJ,QAAQ,IAAI,kCAAkCA,UAAK,KAAKC,QAAG,QAAQ,GAAG,QAAQ,aAAa;CAC7F,MAAM,UAAU,QAAQ,IAAI,kBAAkB;CAC9C,IAAI;CACJ,IAAI;EACF,OAAOC,QAAG,aAAa,MAAM,MAAM;CACrC,QAAQ;EACN;CACF;CACA,MAAM,UAAU,SAAS,IAAI,CAAC,CAAC;CAC/B,MAAM,cAAA,YAAA,QAAA,YAAA,KAAA,IAAA,KAAA,IAAc,QAAU;CAC9B,MAAM,kBAAA,YAAA,QAAA,YAAA,KAAA,IAAA,KAAA,IAAkB,QAAU;CAClC,IAAI,CAAC,eAAe,CAAC,iBAAiB,OAAO,KAAA;CAC7C,OAAO;EAAE;EAAa;EAAiB,cAAA,YAAA,QAAA,YAAA,KAAA,IAAA,KAAA,IAAc,QAAU;CAAqB;AACtF;AASA,SAAS,aAAa,KAAyC;CAC7D,MAAM,MAAM,KAAK,MAAM,GAAG;CAC1B,IAAI,CAAC,IAAI,eAAe,CAAC,IAAI,iBAAiB,OAAO,KAAA;CACrD,MAAM,YAAY,IAAI,aAAa,KAAK,MAAM,IAAI,UAAU,IAAI;CAChE,OAAO;EACL,aAAa,IAAI;EACjB,iBAAiB,IAAI;EACrB,cAAc,IAAI;EAClB,WAAW,OAAO,MAAM,SAAS,IAAI,KAAA,IAAY;CACnD;AACF;AAEA,MAAM,kCAAkB,IAAI,IAAI;CAE9B;CAEA;CACA;CACA;CACA;AACF,CAAC;;AAGD,SAAS,uBAAuB,KAAmB;CACjD,IAAI,IAAI,aAAa,UAAU,OAAO;CACtC,IAAI,IAAI,aAAa,SAAS,OAAO;CACrC,OAAO,gBAAgB,IAAI,IAAI,QAAQ,KAAK,wBAAwB,KAAK,IAAI,QAAQ;AACvF;AAEA,eAAe,gBAAqD;CAClE,MAAM,WAAW,QAAQ,IAAI;CAC7B,MAAM,OAAO,QAAQ,IAAI;CACzB,IAAI,CAAC,YAAY,CAAC,MAAM,OAAO,KAAA;CAC/B,MAAM,MAAM,IAAI,IAAI,WAAW,uBAAuB,aAAc,IAAe;CACnF,IAAI,CAAC,YAAY,CAAC,uBAAuB,GAAG,GAAG;EAC7C,qBAAA,aACE,gDAAgD,IAAI,KAAK,gDAC3D;EACA;CACF;CACA,MAAM,UAAkC,CAAC;CACzC,MAAM,YAAY,QAAQ,IAAI;CAC9B,MAAM,QAAQ,YACVA,QAAG,aAAa,WAAW,MAAM,CAAC,CAAC,KAAK,IACxC,QAAQ,IAAI;CAChB,IAAI,OAAO,QAAQ,mBAAmB;CAQtC,OAAO,cAAa,MAPFC,qBAAAA,YAAY;EAC5B;EACA,QAAQ;EACR;EACA,WAAW;EACX,OAAO;CACT,CAAC,EAAA,CACuB,IAAI;AAC9B;AAEA,eAAe,uBAA4D;;CACzE,IAAI,QAAQ,IAAI,iCAAiC,QAAQ,OAAO,KAAA;CAChE,MAAM,OAAO,QAAQ,IAAI,wCAAwC;CACjE,MAAM,OAAO,GAAW,QAAgB,YACtCA,qBAAAA,YAAY;EACV,KAAK,IAAI,IAAI,GAAG,IAAI;EACpB;EACA;EACA,WAAW;EACX,OAAO;CACT,CAAC;CAIH,MAAM,OAAO,EAAE,6BAA4B,MAHrB,IAAI,qBAAqB,OAAO,EACpD,wCAAwC,QAC1C,CAAC,EAAA,CACkD,KAAK,KAAK,EAAE;CAE/D,MAAM,QAAA,sBAAO,MADO,IAAI,+CAA+C,OAAO,IAAI,EAAA,CAC/D,KAAK,MAAM,IAAI,CAAC,CAAC,QAAA,QAAA,uBAAA,KAAA,IAAA,KAAA,IAAA,mBAAI,KAAK;CAC7C,IAAI,CAAC,MAAM,OAAO,KAAA;CAMlB,OAAO,cAAa,MALA,IAClB,8CAA8C,mBAAmB,IAAI,KACrE,OACA,IACF,EAAA,CAC0B,IAAI;AAChC;AAEA,IAAa,wBAAb,MAAmC;CACjC;CACA,WAAmB;CACnB;CAEA,YAAY,QAA6B;EACvC,sBAAA,eAAe,MAAM,CAAC,UAAU,UAAU,CAAC;EAC3C,IAAI,OAAO,eAAe,OAAO,iBAC/B,KAAK,WAAW;GACd,aAAa,OAAO;GACpB,iBAAiB,OAAO;GACxB,cAAc,OAAO;EACvB;CAEJ;;CAGA,MAAM,MAA+B;EACnC,IAAI,KAAK,UAAU,OAAO,KAAK;EAC/B,MAAM,MAAM,QAAQ;EACpB,IAAI,KAAK,OAAO;EAChB,IAAI,KAAK,UAAU,CAAC,KAAK,WAAW,KAAK,MAAM,GAAG,OAAO,KAAK;EAC9D,IAAI,KAAK,IAAI,IAAI,KAAK,WAAW,oBAC/B,MAAM,IAAI,MAAM,6CAA6C;EAG/D,IAAI,QAAQ,eAAe;EAC3B,KAAK,MAAM,UAAU,CAAC,eAAe,oBAAoB,GAAG;GAC1D,IAAI,OAAO;GACX,IAAI;IACF,QAAQ,MAAM,OAAO;GACvB,QAAQ,CAER;EACF;EACA,IAAI,CAAC,OAAO;GACV,KAAK,WAAW,KAAK,IAAI;GACzB,MAAM,IAAI,MACR,8JACF;EACF;EACA,KAAK,SAAS;EACd,OAAO;CACT;;CAGA,eAAuC;;EACrC,MAAM,MAAM,QAAQ;EACpB,OAAO;IACL,iBAAA,KAAK,cAAA,QAAA,mBAAA,KAAA,IAAA,KAAA,IAAA,eAAU;IACf,kBAAA,KAAK,cAAA,QAAA,oBAAA,KAAA,IAAA,KAAA,IAAA,gBAAU;IACf,eAAA,KAAK,YAAA,QAAA,iBAAA,KAAA,IAAA,KAAA,IAAA,aAAQ;IACb,gBAAA,KAAK,YAAA,QAAA,kBAAA,KAAA,IAAA,KAAA,IAAA,cAAQ;GACb,IAAI;GACJ,IAAI;EACN;CACF;CAEA,aAAmB;EACjB,KAAK,SAAS,KAAA;EACd,KAAK,WAAW;CAClB;CAEA,WAAmB,GAA4B;EAC7C,OAAO,EAAE,cAAc,KAAA,KAAa,EAAE,YAAY,KAAK,IAAI,IAAI;CACjE;AACF;;;;;ACrMA,MAAM,aAAa,SAAyBC,YAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK;AAEjG,MAAM,QAAQ,KAAsB,QAClCA,YAAO,WAAW,UAAU,GAAG,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO;;AAGtD,SAAgB,OAAO,MAA6C;CAClE,MAAM,EACJ,QACA,MACA,QAAQ,IACR,MACA,QACA,SACA,aACA,SAAS,OACT,SACE;CACJ,MAAM,WAAW,wBAAQ,IAAI,KAAK,EAAA,CAAG,YAAY,CAAC,CAAC,QAAQ,iBAAiB,EAAE;CAC9E,MAAM,YAAY,QAAQ,MAAM,GAAG,CAAC;CAEpC,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,KAAK,GAAG,QAAQ,EAAE,YAAY,KAAK;CACvE,QAAQ,gBAAgB;CACxB,IAAI,YAAY,cAAc,QAAQ,0BAA0B,YAAY;CAE5E,MAAM,QAAQ,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK;CACxC,MAAM,mBAAmB,MACtB,KAAK,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAE,KAAK,CAAC,CAAC,QAAQ,QAAQ,GAAG,EAAE,GAAG,CAAC,CAC/D,KAAK,EAAE;CACV,MAAM,gBAAgB,MAAM,KAAK,GAAG;CAEpC,MAAM,mBAAmB;EACvB;EACA;EACA;EACA;EACA;EACA,UAAU,IAAI;CAChB,CAAC,CAAC,KAAK,IAAI;CACX,MAAM,QAAQ,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ;CAChD,MAAM,eAAe;EAAC;EAAoB;EAAS;EAAO,UAAU,gBAAgB;CAAC,CAAC,CAAC,KAAK,IAAI;CAEhG,MAAM,aAAa,KACjB,KAAK,KAAK,KAAK,OAAO,YAAY,mBAAmB,SAAS,GAAG,MAAM,GAAG,OAAO,GACjF,cACF;CACA,MAAM,YAAYA,YAAO,WAAW,UAAU,UAAU,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC,OAAO,KAAK;CAE3F,QAAQ,mBACN,+BAA+B,YAAY,YAAY,GAAG,MAAM,kBAC/C,cAAc,cAAc;CAC/C,OAAO;AACT;;ACmBA,MAAM,qBAAqB;AAC3B,MAAM,kBAAkB;;AAGxB,MAAM,kCAAkB,IAAI,IAAI;CAC9B;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,aAAa,KAAkC;CACtD,IAAI,EAAE,eAAeC,qBAAAA,YAAY,OAAO,KAAA;CACxC,IAAI;EACF,MAAM,OAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,CAAyB;EAC3D,OAAA,SAAA,QAAA,SAAA,KAAA,IAAA,KAAA,IAAO,KAAM,MAAM,GAAG,CAAC,CAAC,IAAI;CAC9B,QAAQ;EACN;CACF;AACF;;;;AAUA,IAAa,sBAAb,MAA4D;CAC1D,OAAuB;CACvB;CACA;CACA;CAEA;CACA;CACA,aAA4C;CAC5C;CACA;CACA,cAAsB;CAEtB;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,QAAmC;EAC7C,KAAK,SACH,OAAO,UACP,QAAQ,IAAI,iBACZ,QAAQ,IAAI,yBACZ;EACF,KAAK,eAAe,OAAO;EAC3B,KAAK,gBACH,OAAO,iBAAiB,GAAG,QAAQ,IAAI,eAAe,OAAO,GAAG,QAAQ;EAC1E,KAAK,cAAc,IAAI,sBAAsB,MAAM;EACnD,KAAK,WAAW,IAAI,IAAI,OAAO,YAAY,gBAAgB,KAAK,OAAO,eAAe;EACtF,KAAK,YAAY,KAAK,IAAI,OAAO,aAAa,KAAK,kBAAkB;EACrE,KAAK,eAAe,OAAO,gBAAgB;EAC3C,KAAK,gBAAgB,OAAO,mBAAmB;EAC/C,KAAK,MAAM,OAAO,OAAO;EACzB,KAAK,aAAa,OAAO,aAAa,IAAI,IAAI,OAAO,UAAU,IAAI,KAAA;EACnE,KAAK,QAAQ,OAAO;EACpB,KAAK,mBAAmB,OAAO,oBAAA;EAC/B,KAAK,SAAS,IAAIC,qBAAAA,YAAwB;GACxC,MAAM;GACN,WAAW,KAAK;GAChB,eAAe,OAAO,iBAAA;GACtB,OAAO,WAAW,KAAK,aAAa,MAAM;GAC1C,eAAe,CAAC,GAAG,KAAK,YAAY,aAAa,GAAG,GAAGC,sBAAAA,WAAW,KAAK,QAAQ,CAAC;GAChF,cAAc,QACZ,CAACC,qBAAAA,qBAAqB,GAAG,KAAK,gBAAgB,IAAI,aAAa,GAAG,KAAK,EAAE;EAC7E,CAAC;EAED,KAAK,aAAa,kBAAkB;GAClC,KAAK,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;EAC7B,GAAG,KAAK,aAAa;EACrB,IAAI,KAAK,WAAW,OAAO,KAAK,WAAW,MAAM;EACjD,sBAAA,eAAe,MAAM,CAAC,eAAe,UAAU,CAAC;CAClD;CAEA,MAAM,OAAgC;EACpC,MAAM,YAAY,MAAM,YAAY,IAAI,KAAK,MAAM,SAAS,CAAC,CAAC,QAAQ,IAAI,KAAK,IAAI;EACnF,MAAM,UAAU,KAAK,MAAM,KAAK,MAAM,KAAK,IAAIC,uBAAAA,gBAAgB,KAAK;EACpE,KAAK,OAAO,KAAK;GAAE;GAAW;EAAQ,CAAC;EACvC,KAAK,OAAO,YAAY;CAC1B;CAEA,QAAuB;EACrB,OAAO,KAAK,OAAO,MAAM;CAC3B;;;;;;CAOA,MAAM,QAAuB;EAC3B,IAAI,KAAK,YAAY;GACnB,cAAc,KAAK,UAAU;GAC7B,KAAK,aAAa;EACpB;EACA,MAAM,KAAK,OAAO,MAAM;CAC1B;CAEA,MAAc,OAAkC;EAC9C,MAAM,EAAE,OAAO,SAAS,MAAM,SAAS,cAAc;EACrD,MAAM,SAASC,qBAAAA,gBAAgB;GAAE,MAAM,KAAA;GAAW;GAAO;EAAQ,GAAG,OAAO;EAC3E,MAAM,cAAwB,CAAC;EAC/B,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,MAAM,GAAG;GAC3C,IAAI,MAAM,UAAU,MAAM,WAAW,MAAM,aAAa,OAAO,MAAM,UAAU;GAC/E,IAAI,KAAK,cAAc,CAAC,KAAK,WAAW,IAAI,CAAC,GAAG;GAChD,IAAI,YAAY,SAAS,iBAAiB,YAAY,KAAK,CAAC;EAC9D;EACA,OAAO,UAAU;GACf,WAAW,YAAY,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,IAAI,KAAK,IAAI;GAChE,mBACE,YAAY,SAAS,IACjB,CACE;IACE,WAAW,KAAK;IAChB,YAAY,CAAC,CAAC,OAAO,CAAC;IACtB,SAAS,YAAY,KAAK,OAAO;KAAE,MAAM;KAAG,MAAM;IAAO,EAAE;GAC7D,CACF,IACA,CAAC;EACT;EACA,OAAOD,uBAAAA,gBAAgB,MAAM;CAC/B;CAEA,MAAc,aAAa,QAAqC;EAC9D,MAAM,KAAK,aAAa;EACxB,MAAM,YAAY,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,YAAY,EAAE,SAAS;EACtE,IAAI;GACF,MAAM,KAAK,KAAK,gBAAgB;IAC9B,cAAc,KAAK;IACnB,eAAe,KAAK;IACpB;GACF,CAAC;EACH,SAAS,KAAK;GACZ,MAAM,OAAO,aAAa,GAAG;GAC7B,IAAI,SAAS,gCAAgC;GAC7C,IAAI,SAAS,6BAA6B,KAAK,cAAc;GAC7D,IAAI,SAAS,yBAAyB,KAAK,YAAY,WAAW;GAClE,MAAM;EACR;CACF;CAEA,MAAc,eAA8B;EAC1C,IAAI,KAAK,aAAa;EACtB,IAAI;GACF,MAAM,KAAK,KAAK,kBAAkB,EAAE,cAAc,KAAK,aAAa,CAAC;EACvE,SAAS,KAAK;GACZ,IAAI,aAAa,GAAG,MAAM,yBAAyB,KAAK,YAAY,WAAW;GAC/E,IAAI,EAAE,eAAeJ,qBAAAA,YAAY,MAAM;GACvC,IAAI,aAAa,GAAG,MAAM,kCACxB,qBAAA,aAAa,2DAA2D,IAAI,QAAQ,EAAE;EAE1F;EACA,IAAI;GACF,MAAM,KAAK,KAAK,mBAAmB;IACjC,cAAc,KAAK;IACnB,eAAe,KAAK;GACtB,CAAC;EACH,SAAS,KAAK;GACZ,IAAI,aAAa,GAAG,MAAM,kCAAkC,MAAM;EACpE;EACA,KAAK,cAAc;CACrB;CAEA,MAAc,KAAK,QAAgB,SAAiD;EAClF,MAAM,cAAc,MAAM,KAAK,YAAY,IAAI;EAC/C,MAAM,OAAOI,uBAAAA,gBAAgB,OAAO;EACpC,MAAM,EAAE,SAAS,KAAK;EACtB,MAAM,UAAU,OAAO;GACrB,QAAQ;GACR,MAAM;GACN,SAAS;IACP;IACA,gBAAgB;IAChB,gBAAgB,iBAAiB;GACnC;GACA;GACA,QAAQ,KAAK;GACb,SAAS;GACT;EACF,CAAC;EACD,MAAME,qBAAAA,YAAY;GAChB,KAAK,KAAK;GACV;GACA;GACA,WAAW,KAAK;GAChB,OAAO,cAAc;GACrB,eAAe;IACb,GAAG,KAAK,YAAY,aAAa;IACjC,QAAQ;IACR,QAAQ;IACR,GAAGJ,sBAAAA,WAAW,KAAK,QAAQ;GAC7B;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"cloudwatch.transport-DCTWV9p6.js","names":["path","os","fs","httpRequest","crypto","HttpError","BatchBuffer","urlSecrets","isPermanentHttpError","stringifyForLog","mergeCoreFields","httpRequest"],"sources":["../src/transports/aws-credentials.ts","../src/transports/aws-sigv4.ts","../src/transports/cloudwatch.transport.ts"],"sourcesContent":["/**\n * AWS credential resolution without the SDK.\n *\n * Order: explicit config, environment variables, shared credentials file,\n * ECS/container credentials, EC2 instance metadata (IMDSv2).\n * Not supported: SSO, assume-role profiles, credential_process, web identity.\n */\n\nimport * as fs from 'node:fs';\nimport * as os from 'node:os';\nimport * as path from 'node:path';\n\nimport { internalWarn } from '../utils/internal-log';\nimport { type AwsCredentials } from './aws-sigv4';\nimport { httpRequest } from './batch-buffer';\nimport { protectSecrets } from './secret-config';\n\nconst REFRESH_MARGIN_MS = 5 * 60 * 1000;\nconst FAILURE_BACKOFF_MS = 30 * 1000;\nconst METADATA_TIMEOUT_MS = 2000;\n\nexport interface AwsCredentialConfig {\n  accessKeyId?: string | undefined;\n  secretAccessKey?: string | undefined;\n  sessionToken?: string | undefined;\n}\n\n/** Parse the sections of an AWS ini file into `{ section: { key: value } }`. */\nexport function parseIni(text: string): Record<string, Record<string, string>> {\n  const out: Record<string, Record<string, string>> = {};\n  let section: Record<string, string> | undefined;\n  for (const raw of text.split(/\\r?\\n/)) {\n    const line = raw.trim();\n    if (!line || line.startsWith('#') || line.startsWith(';')) continue;\n    const header = /^\\[(.+)\\]$/.exec(line);\n    if (header) {\n      section = out[header[1]!.trim()] = out[header[1]!.trim()] ?? {};\n      continue;\n    }\n    const eq = line.indexOf('=');\n    if (eq > 0 && section) section[line.slice(0, eq).trim()] = line.slice(eq + 1).trim();\n  }\n  return out;\n}\n\nfunction fromEnv(): AwsCredentials | undefined {\n  const accessKeyId = process.env['AWS_ACCESS_KEY_ID'];\n  const secretAccessKey = process.env['AWS_SECRET_ACCESS_KEY'];\n  if (!accessKeyId || !secretAccessKey) return undefined;\n  return { accessKeyId, secretAccessKey, sessionToken: process.env['AWS_SESSION_TOKEN'] };\n}\n\nfunction fromSharedFile(): AwsCredentials | undefined {\n  const file =\n    process.env['AWS_SHARED_CREDENTIALS_FILE'] ?? path.join(os.homedir(), '.aws', 'credentials');\n  const profile = process.env['AWS_PROFILE'] ?? 'default';\n  let text: string;\n  try {\n    text = fs.readFileSync(file, 'utf8');\n  } catch {\n    return undefined;\n  }\n  const section = parseIni(text)[profile];\n  const accessKeyId = section?.['aws_access_key_id'];\n  const secretAccessKey = section?.['aws_secret_access_key'];\n  if (!accessKeyId || !secretAccessKey) return undefined;\n  return { accessKeyId, secretAccessKey, sessionToken: section?.['aws_session_token'] };\n}\n\ninterface CredentialDocument {\n  AccessKeyId?: string;\n  SecretAccessKey?: string;\n  Token?: string;\n  Expiration?: string;\n}\n\nfunction fromDocument(raw: string): AwsCredentials | undefined {\n  const doc = JSON.parse(raw) as CredentialDocument;\n  if (!doc.AccessKeyId || !doc.SecretAccessKey) return undefined;\n  const expiresAt = doc.Expiration ? Date.parse(doc.Expiration) : Number.NaN;\n  return {\n    accessKeyId: doc.AccessKeyId,\n    secretAccessKey: doc.SecretAccessKey,\n    sessionToken: doc.Token,\n    expiresAt: Number.isNaN(expiresAt) ? undefined : expiresAt,\n  };\n}\n\nconst CONTAINER_HOSTS = new Set([\n  // eslint-disable-next-line sonarjs/no-hardcoded-ip -- fixed ECS credentials endpoint\n  '169.254.170.2',\n  // eslint-disable-next-line sonarjs/no-hardcoded-ip -- fixed EKS pod identity endpoint\n  '169.254.170.23',\n  '[fd00:ec2::23]',\n  'localhost',\n  '[::1]',\n]);\n\n/** Same rule as the AWS SDKs: never send the container token to an arbitrary http host. */\nfunction isAllowedContainerHost(url: URL): boolean {\n  if (url.protocol === 'https:') return true;\n  if (url.protocol !== 'http:') return false;\n  return CONTAINER_HOSTS.has(url.hostname) || /^127(?:\\.\\d{1,3}){3}$/.test(url.hostname);\n}\n\nasync function fromContainer(): Promise<AwsCredentials | undefined> {\n  const relative = process.env['AWS_CONTAINER_CREDENTIALS_RELATIVE_URI'];\n  const full = process.env['AWS_CONTAINER_CREDENTIALS_FULL_URI'];\n  if (!relative && !full) return undefined;\n  const url = new URL(relative ? `http://169.254.170.2${relative}` : (full as string));\n  if (!relative && !isAllowedContainerHost(url)) {\n    internalWarn(\n      `ignoring AWS_CONTAINER_CREDENTIALS_FULL_URI: ${url.host} is not https or a loopback / ECS / EKS address`\n    );\n    return undefined;\n  }\n  const headers: Record<string, string> = {};\n  const tokenFile = process.env['AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE'];\n  const token = tokenFile\n    ? fs.readFileSync(tokenFile, 'utf8').trim()\n    : process.env['AWS_CONTAINER_AUTHORIZATION_TOKEN'];\n  if (token) headers['Authorization'] = token;\n  const res = await httpRequest({\n    url,\n    method: 'GET',\n    headers,\n    timeoutMs: METADATA_TIMEOUT_MS,\n    label: 'AWS container credentials',\n  });\n  return fromDocument(res.body);\n}\n\nasync function fromInstanceMetadata(): Promise<AwsCredentials | undefined> {\n  if (process.env['AWS_EC2_METADATA_DISABLED'] === 'true') return undefined;\n  const base = process.env['AWS_EC2_METADATA_SERVICE_ENDPOINT'] ?? 'http://169.254.169.254';\n  const get = (p: string, method: string, headers: Record<string, string>) =>\n    httpRequest({\n      url: new URL(p, base),\n      method,\n      headers,\n      timeoutMs: METADATA_TIMEOUT_MS,\n      label: 'EC2 instance metadata',\n    });\n  const session = await get('/latest/api/token', 'PUT', {\n    'X-aws-ec2-metadata-token-ttl-seconds': '21600',\n  });\n  const auth = { 'X-aws-ec2-metadata-token': session.body.trim() };\n  const roles = await get('/latest/meta-data/iam/security-credentials/', 'GET', auth);\n  const role = roles.body.split('\\n')[0]?.trim();\n  if (!role) return undefined;\n  const creds = await get(\n    `/latest/meta-data/iam/security-credentials/${encodeURIComponent(role)}`,\n    'GET',\n    auth\n  );\n  return fromDocument(creds.body);\n}\n\nexport class AwsCredentialProvider {\n  private cached: AwsCredentials | undefined;\n  private failedAt = 0;\n  private readonly explicit: AwsCredentials | undefined;\n\n  constructor(config: AwsCredentialConfig) {\n    protectSecrets(this, ['cached', 'explicit']);\n    if (config.accessKeyId && config.secretAccessKey) {\n      this.explicit = {\n        accessKeyId: config.accessKeyId,\n        secretAccessKey: config.secretAccessKey,\n        sessionToken: config.sessionToken,\n      };\n    }\n  }\n\n  /** Throws when no source yields credentials, so the caller keeps its buffer. */\n  async get(): Promise<AwsCredentials> {\n    if (this.explicit) return this.explicit;\n    const env = fromEnv();\n    if (env) return env;\n    if (this.cached && !this.isExpiring(this.cached)) return this.cached;\n    if (Date.now() - this.failedAt < FAILURE_BACKOFF_MS) {\n      throw new Error('no AWS credentials found (retrying shortly)');\n    }\n\n    let found = fromSharedFile();\n    for (const source of [fromContainer, fromInstanceMetadata]) {\n      if (found) break;\n      try {\n        found = await source();\n      } catch {\n        /* source not available here; try the next */\n      }\n    }\n    if (!found) {\n      this.failedAt = Date.now();\n      throw new Error(\n        'no AWS credentials found: set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, a shared credentials file, container credentials, or run on EC2 with an instance role'\n      );\n    }\n    this.cached = found;\n    return found;\n  }\n\n  /** Secret values this provider may hold, for scrubbing error text. */\n  secretValues(): (string | undefined)[] {\n    const env = process.env;\n    return [\n      this.explicit?.secretAccessKey,\n      this.explicit?.sessionToken,\n      this.cached?.secretAccessKey,\n      this.cached?.sessionToken,\n      env['AWS_SECRET_ACCESS_KEY'],\n      env['AWS_SESSION_TOKEN'],\n    ];\n  }\n\n  invalidate(): void {\n    this.cached = undefined;\n    this.failedAt = 0;\n  }\n\n  private isExpiring(c: AwsCredentials): boolean {\n    return c.expiresAt !== undefined && c.expiresAt - Date.now() < REFRESH_MARGIN_MS;\n  }\n}\n","/**\n * AWS Signature Version 4 request signing, dependency-free.\n */\n\nimport * as crypto from 'node:crypto';\n\nexport interface AwsCredentials {\n  accessKeyId: string;\n  secretAccessKey: string;\n  sessionToken?: string | undefined;\n  /** Epoch ms after which the credentials are no longer valid. */\n  expiresAt?: number | undefined;\n}\n\nexport interface SignV4Options {\n  method: string;\n  path: string;\n  query?: string;\n  /** Must include `host`. Names are lowercased before signing. */\n  headers: Record<string, string>;\n  body: string;\n  region: string;\n  service: string;\n  credentials: AwsCredentials;\n  date?: Date;\n}\n\nconst sha256Hex = (data: string): string => crypto.createHash('sha256').update(data).digest('hex');\n\nconst hmac = (key: Buffer | string, msg: string): Buffer =>\n  crypto.createHmac('sha256', key).update(msg).digest();\n\n/** Returns the request headers (lowercase names) with `x-amz-date` and `authorization` added. */\nexport function signV4(opts: SignV4Options): Record<string, string> {\n  const {\n    method,\n    path,\n    query = '',\n    body,\n    region,\n    service,\n    credentials,\n    headers: input,\n    date,\n  } = opts;\n  const amzDate = (date ?? new Date()).toISOString().replace(/[:-]|\\.\\d{3}/g, '');\n  const dateStamp = amzDate.slice(0, 8);\n\n  const headers: Record<string, string> = {};\n  for (const [k, v] of Object.entries(input)) headers[k.toLowerCase()] = v;\n  headers['x-amz-date'] = amzDate;\n  if (credentials.sessionToken) headers['x-amz-security-token'] = credentials.sessionToken;\n\n  const names = Object.keys(headers).sort();\n  const canonicalHeaders = names\n    .map((n) => `${n}:${headers[n]!.trim().replace(/\\s+/g, ' ')}\\n`)\n    .join('');\n  const signedHeaders = names.join(';');\n\n  const canonicalRequest = [\n    method,\n    path,\n    query,\n    canonicalHeaders,\n    signedHeaders,\n    sha256Hex(body),\n  ].join('\\n');\n  const scope = `${dateStamp}/${region}/${service}/aws4_request`;\n  const stringToSign = ['AWS4-HMAC-SHA256', amzDate, scope, sha256Hex(canonicalRequest)].join('\\n');\n\n  const signingKey = hmac(\n    hmac(hmac(hmac(`AWS4${credentials.secretAccessKey}`, dateStamp), region), service),\n    'aws4_request'\n  );\n  const signature = crypto.createHmac('sha256', signingKey).update(stringToSign).digest('hex');\n\n  headers['authorization'] =\n    `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, ` +\n    `SignedHeaders=${signedHeaders}, Signature=${signature}`;\n  return headers;\n}\n","/**\n * logixia — AWS CloudWatch Logs transport\n *\n * Sends log entries to AWS CloudWatch Logs via the PutLogEvents API.\n * Supports EMF (Embedded Metric Format) for automatic metric extraction.\n *\n * Auth, in order: explicit config, environment variables, the shared\n * credentials file (AWS_PROFILE, AWS_SHARED_CREDENTIALS_FILE), ECS container\n * credentials, then EC2 instance metadata (IMDSv2). SSO, assume-role profiles\n * and credential_process are not supported. No SDK dependency — raw HTTPS with\n * AWS Signature Version 4.\n *\n * The log group and stream are created on first use if they do not exist.\n *\n * @example\n * ```ts\n * import { createLogger } from 'logixia';\n * import { CloudWatchTransport } from 'logixia/cloudwatch';\n *\n * const logger = createLogger({\n *   transports: {\n *     custom: [\n *       new CloudWatchTransport({\n *         region: 'us-east-1',\n *         logGroupName: '/myapp/production',\n *         logStreamName: `api-${process.env.HOSTNAME}`,\n *         batchSize: 100,\n *         flushIntervalMs: 5000,\n *       }),\n *     ],\n *   },\n * });\n * ```\n */\n\nimport type { IAsyncTransport, TransportLogEntry } from '../types/transport.types';\nimport { internalWarn } from '../utils/internal-log';\nimport { stringifyForLog } from '../utils/safe-stringify';\nimport { AwsCredentialProvider } from './aws-credentials';\nimport { signV4 } from './aws-sigv4';\nimport {\n  BatchBuffer,\n  DEFAULT_MAX_BUFFER_SIZE,\n  DEFAULT_REQUEST_TIMEOUT_MS,\n  HttpError,\n  httpRequest,\n  isPermanentHttpError,\n} from './batch-buffer';\nimport { mergeCoreFields } from './entry-fields';\nimport { protectSecrets, urlSecrets } from './secret-config';\n\nexport interface CloudWatchTransportConfig {\n  /** AWS region, e.g. `'us-east-1'`. Falls back to `AWS_REGION` env var. */\n  region?: string;\n  /** CloudWatch Logs group name. Created automatically if it does not exist. */\n  logGroupName: string;\n  /** CloudWatch Logs stream name. Defaults to hostname + process PID. */\n  logStreamName?: string;\n  /** Override the Logs endpoint, e.g. for LocalStack. Default: `https://logs.<region>.amazonaws.com`. */\n  endpoint?: string;\n  /** AWS access key ID. Falls back to the credential chain described above. */\n  accessKeyId?: string;\n  /** AWS secret access key. Used together with `accessKeyId`. */\n  secretAccessKey?: string;\n  /** AWS session token for temporary credentials. Used together with `accessKeyId`. */\n  sessionToken?: string;\n  /**\n   * Number of log events to batch before flushing.\n   * CloudWatch allows max 10,000 events per PutLogEvents call; larger values are capped.\n   * @default 100\n   */\n  batchSize?: number;\n  /**\n   * Max ms between flushes even if batchSize is not reached.\n   * @default 5000\n   */\n  flushIntervalMs?: number;\n  /**\n   * Enable EMF (Embedded Metric Format) — wraps log entries as CloudWatch\n   * metric namespaces so numeric fields become CloudWatch Metrics automatically.\n   * @default false\n   */\n  emf?: boolean;\n  /** CloudWatch Metrics namespace used by EMF. @default 'Logixia' */\n  emfNamespace?: string;\n  /**\n   * Payload fields published as EMF metrics. When set, only these numeric\n   * fields become metrics; when unset every numeric payload field does (up to\n   * the EMF limit of 100 per entry).\n   */\n  emfMetrics?: string[];\n  /** Abort a request that has not finished after this many ms. @default 10000 */\n  requestTimeoutMs?: number;\n  /** Max buffered events; the oldest are dropped past this. @default 10000 */\n  maxBufferSize?: number;\n  /** Minimum log level to forward. */\n  level?: string;\n}\n\nconst MAX_EVENTS_PER_PUT = 10_000;\nconst EMF_MAX_METRICS = 100;\n\n/** Error types worth retrying even though CloudWatch reports them as HTTP 400. */\nconst RETRYABLE_TYPES = new Set([\n  'ThrottlingException',\n  'ThrottledException',\n  'LimitExceededException',\n  'ServiceUnavailableException',\n  'ExpiredTokenException',\n  'ResourceNotFoundException',\n]);\n\nfunction awsErrorType(err: unknown): string | undefined {\n  if (!(err instanceof HttpError)) return undefined;\n  try {\n    const type = (JSON.parse(err.body) as { __type?: string }).__type;\n    return type?.split('#').pop();\n  } catch {\n    return undefined;\n  }\n}\n\ninterface CwLogEvent {\n  timestamp: number;\n  message: string;\n}\n\n/**\n * AWS CloudWatch Logs transport with EMF support and batched PutLogEvents calls.\n */\nexport class CloudWatchTransport implements IAsyncTransport {\n  public readonly name = 'cloudwatch';\n  public readonly batchSize: number;\n  public readonly flushInterval: number;\n  public readonly level: string | undefined;\n\n  private readonly buffer: BatchBuffer<CwLogEvent>;\n  private readonly requestTimeoutMs: number;\n  private flushTimer: NodeJS.Timeout | null = null;\n  private readonly credentials: AwsCredentialProvider;\n  private readonly endpoint: URL;\n  private streamReady = false;\n\n  private readonly region: string;\n  private readonly logGroupName: string;\n  private readonly logStreamName: string;\n  private readonly emf: boolean;\n  private readonly emfNamespace: string;\n  private readonly emfMetrics: ReadonlySet<string> | undefined;\n\n  constructor(config: CloudWatchTransportConfig) {\n    this.region =\n      config.region ??\n      process.env['AWS_REGION'] ??\n      process.env['AWS_DEFAULT_REGION'] ??\n      'us-east-1';\n    this.logGroupName = config.logGroupName;\n    this.logStreamName =\n      config.logStreamName ?? `${process.env['HOSTNAME'] ?? 'node'}-${process.pid}`;\n    this.credentials = new AwsCredentialProvider(config);\n    this.endpoint = new URL(config.endpoint ?? `https://logs.${this.region}.amazonaws.com`);\n    this.batchSize = Math.min(config.batchSize ?? 100, MAX_EVENTS_PER_PUT);\n    this.emfNamespace = config.emfNamespace ?? 'Logixia';\n    this.flushInterval = config.flushIntervalMs ?? 5000;\n    this.emf = config.emf ?? false;\n    this.emfMetrics = config.emfMetrics ? new Set(config.emfMetrics) : undefined;\n    this.level = config.level;\n    this.requestTimeoutMs = config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;\n    this.buffer = new BatchBuffer<CwLogEvent>({\n      name: 'CloudWatchTransport',\n      batchSize: this.batchSize,\n      maxBufferSize: config.maxBufferSize ?? DEFAULT_MAX_BUFFER_SIZE,\n      send: (events) => this.putLogEvents(events),\n      secrets: () => [...this.credentials.secretValues(), ...urlSecrets(this.endpoint)],\n      shouldRetry: (err) =>\n        !isPermanentHttpError(err) || RETRYABLE_TYPES.has(awsErrorType(err) ?? ''),\n    });\n\n    this.flushTimer = setInterval(() => {\n      this.flush().catch(() => {});\n    }, this.flushInterval);\n    if (this.flushTimer.unref) this.flushTimer.unref();\n    protectSecrets(this, ['credentials', 'endpoint']);\n  }\n\n  write(entry: TransportLogEntry): void {\n    const timestamp = entry.timestamp ? new Date(entry.timestamp).getTime() : Date.now();\n    const message = this.emf ? this.toEmf(entry) : stringifyForLog(entry);\n    this.buffer.push({ timestamp, message });\n    this.buffer.flushIfFull();\n  }\n\n  flush(): Promise<void> {\n    return this.buffer.flush();\n  }\n\n  /**\n   * Flush remaining events and stop the interval timer on shutdown. Without this\n   * the manager's close() skips the transport (close was undefined) and any\n   * buffered events were lost on deploy. Waits for any in-flight send first.\n   */\n  async close(): Promise<void> {\n    if (this.flushTimer) {\n      clearInterval(this.flushTimer);\n      this.flushTimer = null;\n    }\n    await this.buffer.close();\n  }\n\n  private toEmf(entry: TransportLogEntry): string {\n    const { level, message, data: payload, timestamp } = entry;\n    const fields = mergeCoreFields({ _aws: undefined, level, message }, payload);\n    const metricNames: string[] = [];\n    for (const [k, v] of Object.entries(fields)) {\n      if (k === '_aws' || k === 'level' || k === 'message' || typeof v !== 'number') continue;\n      if (this.emfMetrics && !this.emfMetrics.has(k)) continue;\n      if (metricNames.length < EMF_MAX_METRICS) metricNames.push(k);\n    }\n    fields['_aws'] = {\n      Timestamp: timestamp ? new Date(timestamp).getTime() : Date.now(),\n      CloudWatchMetrics:\n        metricNames.length > 0\n          ? [\n              {\n                Namespace: this.emfNamespace,\n                Dimensions: [['level']],\n                Metrics: metricNames.map((n) => ({ Name: n, Unit: 'None' })),\n              },\n            ]\n          : [],\n    };\n    return stringifyForLog(fields);\n  }\n\n  private async putLogEvents(events: CwLogEvent[]): Promise<void> {\n    await this.ensureStream();\n    const logEvents = [...events].sort((a, b) => a.timestamp - b.timestamp);\n    try {\n      await this.call('PutLogEvents', {\n        logGroupName: this.logGroupName,\n        logStreamName: this.logStreamName,\n        logEvents,\n      });\n    } catch (err) {\n      const type = awsErrorType(err);\n      if (type === 'DataAlreadyAcceptedException') return;\n      if (type === 'ResourceNotFoundException') this.streamReady = false;\n      if (type === 'ExpiredTokenException') this.credentials.invalidate();\n      throw err;\n    }\n  }\n\n  private async ensureStream(): Promise<void> {\n    if (this.streamReady) return;\n    try {\n      await this.call('CreateLogGroup', { logGroupName: this.logGroupName });\n    } catch (err) {\n      if (awsErrorType(err) === 'ExpiredTokenException') this.credentials.invalidate();\n      if (!(err instanceof HttpError)) throw err;\n      if (awsErrorType(err) !== 'ResourceAlreadyExistsException') {\n        internalWarn(`CloudWatchTransport: CreateLogGroup failed, continuing (${err.message})`);\n      }\n    }\n    try {\n      await this.call('CreateLogStream', {\n        logGroupName: this.logGroupName,\n        logStreamName: this.logStreamName,\n      });\n    } catch (err) {\n      if (awsErrorType(err) !== 'ResourceAlreadyExistsException') throw err;\n    }\n    this.streamReady = true;\n  }\n\n  private async call(action: string, payload: Record<string, unknown>): Promise<void> {\n    const credentials = await this.credentials.get();\n    const body = stringifyForLog(payload);\n    const { host } = this.endpoint;\n    const headers = signV4({\n      method: 'POST',\n      path: '/',\n      headers: {\n        host,\n        'content-type': 'application/x-amz-json-1.1',\n        'x-amz-target': `Logs_20140328.${action}`,\n      },\n      body,\n      region: this.region,\n      service: 'logs',\n      credentials,\n    });\n    await httpRequest({\n      url: this.endpoint,\n      headers,\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: `CloudWatch ${action}`,\n      secrets: () => [\n        ...this.credentials.secretValues(),\n        headers['authorization'],\n        headers['x-amz-security-token'],\n        ...urlSecrets(this.endpoint),\n      ],\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAiBA,MAAM,oBAAoB;AAC1B,MAAM,qBAAqB;AAC3B,MAAM,sBAAsB;;AAS5B,SAAgB,SAAS,MAAsD;CAC7E,MAAM,MAA8C,CAAC;CACrD,IAAI;CACJ,KAAK,MAAM,OAAO,KAAK,MAAM,OAAO,GAAG;EACrC,MAAM,OAAO,IAAI,KAAK;EACtB,IAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,GAAG,GAAG;EAC3D,MAAM,SAAS,aAAa,KAAK,IAAI;EACrC,IAAI,QAAQ;GACV,UAAU,IAAI,OAAO,EAAE,CAAE,KAAK,KAAK,IAAI,OAAO,EAAE,CAAE,KAAK,MAAM,CAAC;GAC9D;EACF;EACA,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,IAAI,KAAK,KAAK,SAAS,QAAQ,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK;CACrF;CACA,OAAO;AACT;AAEA,SAAS,UAAsC;CAC7C,MAAM,cAAc,QAAQ,IAAI;CAChC,MAAM,kBAAkB,QAAQ,IAAI;CACpC,IAAI,CAAC,eAAe,CAAC,iBAAiB,OAAO,KAAA;CAC7C,OAAO;EAAE;EAAa;EAAiB,cAAc,QAAQ,IAAI;CAAqB;AACxF;AAEA,SAAS,iBAA6C;CACpD,MAAM,OACJ,QAAQ,IAAI,kCAAkCA,UAAK,KAAKC,QAAG,QAAQ,GAAG,QAAQ,aAAa;CAC7F,MAAM,UAAU,QAAQ,IAAI,kBAAkB;CAC9C,IAAI;CACJ,IAAI;EACF,OAAOC,QAAG,aAAa,MAAM,MAAM;CACrC,QAAQ;EACN;CACF;CACA,MAAM,UAAU,SAAS,IAAI,CAAC,CAAC;CAC/B,MAAM,cAAA,YAAA,QAAA,YAAA,KAAA,IAAA,KAAA,IAAc,QAAU;CAC9B,MAAM,kBAAA,YAAA,QAAA,YAAA,KAAA,IAAA,KAAA,IAAkB,QAAU;CAClC,IAAI,CAAC,eAAe,CAAC,iBAAiB,OAAO,KAAA;CAC7C,OAAO;EAAE;EAAa;EAAiB,cAAA,YAAA,QAAA,YAAA,KAAA,IAAA,KAAA,IAAc,QAAU;CAAqB;AACtF;AASA,SAAS,aAAa,KAAyC;CAC7D,MAAM,MAAM,KAAK,MAAM,GAAG;CAC1B,IAAI,CAAC,IAAI,eAAe,CAAC,IAAI,iBAAiB,OAAO,KAAA;CACrD,MAAM,YAAY,IAAI,aAAa,KAAK,MAAM,IAAI,UAAU,IAAI;CAChE,OAAO;EACL,aAAa,IAAI;EACjB,iBAAiB,IAAI;EACrB,cAAc,IAAI;EAClB,WAAW,OAAO,MAAM,SAAS,IAAI,KAAA,IAAY;CACnD;AACF;AAEA,MAAM,kCAAkB,IAAI,IAAI;CAE9B;CAEA;CACA;CACA;CACA;AACF,CAAC;;AAGD,SAAS,uBAAuB,KAAmB;CACjD,IAAI,IAAI,aAAa,UAAU,OAAO;CACtC,IAAI,IAAI,aAAa,SAAS,OAAO;CACrC,OAAO,gBAAgB,IAAI,IAAI,QAAQ,KAAK,wBAAwB,KAAK,IAAI,QAAQ;AACvF;AAEA,eAAe,gBAAqD;CAClE,MAAM,WAAW,QAAQ,IAAI;CAC7B,MAAM,OAAO,QAAQ,IAAI;CACzB,IAAI,CAAC,YAAY,CAAC,MAAM,OAAO,KAAA;CAC/B,MAAM,MAAM,IAAI,IAAI,WAAW,uBAAuB,aAAc,IAAe;CACnF,IAAI,CAAC,YAAY,CAAC,uBAAuB,GAAG,GAAG;EAC7C,qBAAA,aACE,gDAAgD,IAAI,KAAK,gDAC3D;EACA;CACF;CACA,MAAM,UAAkC,CAAC;CACzC,MAAM,YAAY,QAAQ,IAAI;CAC9B,MAAM,QAAQ,YACVA,QAAG,aAAa,WAAW,MAAM,CAAC,CAAC,KAAK,IACxC,QAAQ,IAAI;CAChB,IAAI,OAAO,QAAQ,mBAAmB;CAQtC,OAAO,cAAa,MAPFC,qBAAAA,YAAY;EAC5B;EACA,QAAQ;EACR;EACA,WAAW;EACX,OAAO;CACT,CAAC,EAAA,CACuB,IAAI;AAC9B;AAEA,eAAe,uBAA4D;;CACzE,IAAI,QAAQ,IAAI,iCAAiC,QAAQ,OAAO,KAAA;CAChE,MAAM,OAAO,QAAQ,IAAI,wCAAwC;CACjE,MAAM,OAAO,GAAW,QAAgB,YACtCA,qBAAAA,YAAY;EACV,KAAK,IAAI,IAAI,GAAG,IAAI;EACpB;EACA;EACA,WAAW;EACX,OAAO;CACT,CAAC;CAIH,MAAM,OAAO,EAAE,6BAA4B,MAHrB,IAAI,qBAAqB,OAAO,EACpD,wCAAwC,QAC1C,CAAC,EAAA,CACkD,KAAK,KAAK,EAAE;CAE/D,MAAM,QAAA,sBAAO,MADO,IAAI,+CAA+C,OAAO,IAAI,EAAA,CAC/D,KAAK,MAAM,IAAI,CAAC,CAAC,QAAA,QAAA,uBAAA,KAAA,IAAA,KAAA,IAAA,mBAAI,KAAK;CAC7C,IAAI,CAAC,MAAM,OAAO,KAAA;CAMlB,OAAO,cAAa,MALA,IAClB,8CAA8C,mBAAmB,IAAI,KACrE,OACA,IACF,EAAA,CAC0B,IAAI;AAChC;AAEA,IAAa,wBAAb,MAAmC;CACjC;CACA,WAAmB;CACnB;CAEA,YAAY,QAA6B;EACvC,sBAAA,eAAe,MAAM,CAAC,UAAU,UAAU,CAAC;EAC3C,IAAI,OAAO,eAAe,OAAO,iBAC/B,KAAK,WAAW;GACd,aAAa,OAAO;GACpB,iBAAiB,OAAO;GACxB,cAAc,OAAO;EACvB;CAEJ;;CAGA,MAAM,MAA+B;EACnC,IAAI,KAAK,UAAU,OAAO,KAAK;EAC/B,MAAM,MAAM,QAAQ;EACpB,IAAI,KAAK,OAAO;EAChB,IAAI,KAAK,UAAU,CAAC,KAAK,WAAW,KAAK,MAAM,GAAG,OAAO,KAAK;EAC9D,IAAI,KAAK,IAAI,IAAI,KAAK,WAAW,oBAC/B,MAAM,IAAI,MAAM,6CAA6C;EAG/D,IAAI,QAAQ,eAAe;EAC3B,KAAK,MAAM,UAAU,CAAC,eAAe,oBAAoB,GAAG;GAC1D,IAAI,OAAO;GACX,IAAI;IACF,QAAQ,MAAM,OAAO;GACvB,QAAQ,CAER;EACF;EACA,IAAI,CAAC,OAAO;GACV,KAAK,WAAW,KAAK,IAAI;GACzB,MAAM,IAAI,MACR,8JACF;EACF;EACA,KAAK,SAAS;EACd,OAAO;CACT;;CAGA,eAAuC;;EACrC,MAAM,MAAM,QAAQ;EACpB,OAAO;IACL,iBAAA,KAAK,cAAA,QAAA,mBAAA,KAAA,IAAA,KAAA,IAAA,eAAU;IACf,kBAAA,KAAK,cAAA,QAAA,oBAAA,KAAA,IAAA,KAAA,IAAA,gBAAU;IACf,eAAA,KAAK,YAAA,QAAA,iBAAA,KAAA,IAAA,KAAA,IAAA,aAAQ;IACb,gBAAA,KAAK,YAAA,QAAA,kBAAA,KAAA,IAAA,KAAA,IAAA,cAAQ;GACb,IAAI;GACJ,IAAI;EACN;CACF;CAEA,aAAmB;EACjB,KAAK,SAAS,KAAA;EACd,KAAK,WAAW;CAClB;CAEA,WAAmB,GAA4B;EAC7C,OAAO,EAAE,cAAc,KAAA,KAAa,EAAE,YAAY,KAAK,IAAI,IAAI;CACjE;AACF;;;;;ACrMA,MAAM,aAAa,SAAyBC,YAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK;AAEjG,MAAM,QAAQ,KAAsB,QAClCA,YAAO,WAAW,UAAU,GAAG,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO;;AAGtD,SAAgB,OAAO,MAA6C;CAClE,MAAM,EACJ,QACA,MACA,QAAQ,IACR,MACA,QACA,SACA,aACA,SAAS,OACT,SACE;CACJ,MAAM,WAAW,wBAAQ,IAAI,KAAK,EAAA,CAAG,YAAY,CAAC,CAAC,QAAQ,iBAAiB,EAAE;CAC9E,MAAM,YAAY,QAAQ,MAAM,GAAG,CAAC;CAEpC,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,KAAK,GAAG,QAAQ,EAAE,YAAY,KAAK;CACvE,QAAQ,gBAAgB;CACxB,IAAI,YAAY,cAAc,QAAQ,0BAA0B,YAAY;CAE5E,MAAM,QAAQ,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK;CACxC,MAAM,mBAAmB,MACtB,KAAK,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAE,KAAK,CAAC,CAAC,QAAQ,QAAQ,GAAG,EAAE,GAAG,CAAC,CAC/D,KAAK,EAAE;CACV,MAAM,gBAAgB,MAAM,KAAK,GAAG;CAEpC,MAAM,mBAAmB;EACvB;EACA;EACA;EACA;EACA;EACA,UAAU,IAAI;CAChB,CAAC,CAAC,KAAK,IAAI;CACX,MAAM,QAAQ,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ;CAChD,MAAM,eAAe;EAAC;EAAoB;EAAS;EAAO,UAAU,gBAAgB;CAAC,CAAC,CAAC,KAAK,IAAI;CAEhG,MAAM,aAAa,KACjB,KAAK,KAAK,KAAK,OAAO,YAAY,mBAAmB,SAAS,GAAG,MAAM,GAAG,OAAO,GACjF,cACF;CACA,MAAM,YAAYA,YAAO,WAAW,UAAU,UAAU,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC,OAAO,KAAK;CAE3F,QAAQ,mBACN,+BAA+B,YAAY,YAAY,GAAG,MAAM,kBAC/C,cAAc,cAAc;CAC/C,OAAO;AACT;;ACmBA,MAAM,qBAAqB;AAC3B,MAAM,kBAAkB;;AAGxB,MAAM,kCAAkB,IAAI,IAAI;CAC9B;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,aAAa,KAAkC;CACtD,IAAI,EAAE,eAAeC,qBAAAA,YAAY,OAAO,KAAA;CACxC,IAAI;EACF,MAAM,OAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,CAAyB;EAC3D,OAAA,SAAA,QAAA,SAAA,KAAA,IAAA,KAAA,IAAO,KAAM,MAAM,GAAG,CAAC,CAAC,IAAI;CAC9B,QAAQ;EACN;CACF;AACF;;;;AAUA,IAAa,sBAAb,MAA4D;CAC1D,OAAuB;CACvB;CACA;CACA;CAEA;CACA;CACA,aAA4C;CAC5C;CACA;CACA,cAAsB;CAEtB;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,QAAmC;EAC7C,KAAK,SACH,OAAO,UACP,QAAQ,IAAI,iBACZ,QAAQ,IAAI,yBACZ;EACF,KAAK,eAAe,OAAO;EAC3B,KAAK,gBACH,OAAO,iBAAiB,GAAG,QAAQ,IAAI,eAAe,OAAO,GAAG,QAAQ;EAC1E,KAAK,cAAc,IAAI,sBAAsB,MAAM;EACnD,KAAK,WAAW,IAAI,IAAI,OAAO,YAAY,gBAAgB,KAAK,OAAO,eAAe;EACtF,KAAK,YAAY,KAAK,IAAI,OAAO,aAAa,KAAK,kBAAkB;EACrE,KAAK,eAAe,OAAO,gBAAgB;EAC3C,KAAK,gBAAgB,OAAO,mBAAmB;EAC/C,KAAK,MAAM,OAAO,OAAO;EACzB,KAAK,aAAa,OAAO,aAAa,IAAI,IAAI,OAAO,UAAU,IAAI,KAAA;EACnE,KAAK,QAAQ,OAAO;EACpB,KAAK,mBAAmB,OAAO,oBAAA;EAC/B,KAAK,SAAS,IAAIC,qBAAAA,YAAwB;GACxC,MAAM;GACN,WAAW,KAAK;GAChB,eAAe,OAAO,iBAAA;GACtB,OAAO,WAAW,KAAK,aAAa,MAAM;GAC1C,eAAe,CAAC,GAAG,KAAK,YAAY,aAAa,GAAG,GAAGC,sBAAAA,WAAW,KAAK,QAAQ,CAAC;GAChF,cAAc,QACZ,CAACC,qBAAAA,qBAAqB,GAAG,KAAK,gBAAgB,IAAI,aAAa,GAAG,KAAK,EAAE;EAC7E,CAAC;EAED,KAAK,aAAa,kBAAkB;GAClC,KAAK,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;EAC7B,GAAG,KAAK,aAAa;EACrB,IAAI,KAAK,WAAW,OAAO,KAAK,WAAW,MAAM;EACjD,sBAAA,eAAe,MAAM,CAAC,eAAe,UAAU,CAAC;CAClD;CAEA,MAAM,OAAgC;EACpC,MAAM,YAAY,MAAM,YAAY,IAAI,KAAK,MAAM,SAAS,CAAC,CAAC,QAAQ,IAAI,KAAK,IAAI;EACnF,MAAM,UAAU,KAAK,MAAM,KAAK,MAAM,KAAK,IAAIC,uBAAAA,gBAAgB,KAAK;EACpE,KAAK,OAAO,KAAK;GAAE;GAAW;EAAQ,CAAC;EACvC,KAAK,OAAO,YAAY;CAC1B;CAEA,QAAuB;EACrB,OAAO,KAAK,OAAO,MAAM;CAC3B;;;;;;CAOA,MAAM,QAAuB;EAC3B,IAAI,KAAK,YAAY;GACnB,cAAc,KAAK,UAAU;GAC7B,KAAK,aAAa;EACpB;EACA,MAAM,KAAK,OAAO,MAAM;CAC1B;CAEA,MAAc,OAAkC;EAC9C,MAAM,EAAE,OAAO,SAAS,MAAM,SAAS,cAAc;EACrD,MAAM,SAASC,qBAAAA,gBAAgB;GAAE,MAAM,KAAA;GAAW;GAAO;EAAQ,GAAG,OAAO;EAC3E,MAAM,cAAwB,CAAC;EAC/B,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,MAAM,GAAG;GAC3C,IAAI,MAAM,UAAU,MAAM,WAAW,MAAM,aAAa,OAAO,MAAM,UAAU;GAC/E,IAAI,KAAK,cAAc,CAAC,KAAK,WAAW,IAAI,CAAC,GAAG;GAChD,IAAI,YAAY,SAAS,iBAAiB,YAAY,KAAK,CAAC;EAC9D;EACA,OAAO,UAAU;GACf,WAAW,YAAY,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,IAAI,KAAK,IAAI;GAChE,mBACE,YAAY,SAAS,IACjB,CACE;IACE,WAAW,KAAK;IAChB,YAAY,CAAC,CAAC,OAAO,CAAC;IACtB,SAAS,YAAY,KAAK,OAAO;KAAE,MAAM;KAAG,MAAM;IAAO,EAAE;GAC7D,CACF,IACA,CAAC;EACT;EACA,OAAOD,uBAAAA,gBAAgB,MAAM;CAC/B;CAEA,MAAc,aAAa,QAAqC;EAC9D,MAAM,KAAK,aAAa;EACxB,MAAM,YAAY,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,YAAY,EAAE,SAAS;EACtE,IAAI;GACF,MAAM,KAAK,KAAK,gBAAgB;IAC9B,cAAc,KAAK;IACnB,eAAe,KAAK;IACpB;GACF,CAAC;EACH,SAAS,KAAK;GACZ,MAAM,OAAO,aAAa,GAAG;GAC7B,IAAI,SAAS,gCAAgC;GAC7C,IAAI,SAAS,6BAA6B,KAAK,cAAc;GAC7D,IAAI,SAAS,yBAAyB,KAAK,YAAY,WAAW;GAClE,MAAM;EACR;CACF;CAEA,MAAc,eAA8B;EAC1C,IAAI,KAAK,aAAa;EACtB,IAAI;GACF,MAAM,KAAK,KAAK,kBAAkB,EAAE,cAAc,KAAK,aAAa,CAAC;EACvE,SAAS,KAAK;GACZ,IAAI,aAAa,GAAG,MAAM,yBAAyB,KAAK,YAAY,WAAW;GAC/E,IAAI,EAAE,eAAeJ,qBAAAA,YAAY,MAAM;GACvC,IAAI,aAAa,GAAG,MAAM,kCACxB,qBAAA,aAAa,2DAA2D,IAAI,QAAQ,EAAE;EAE1F;EACA,IAAI;GACF,MAAM,KAAK,KAAK,mBAAmB;IACjC,cAAc,KAAK;IACnB,eAAe,KAAK;GACtB,CAAC;EACH,SAAS,KAAK;GACZ,IAAI,aAAa,GAAG,MAAM,kCAAkC,MAAM;EACpE;EACA,KAAK,cAAc;CACrB;CAEA,MAAc,KAAK,QAAgB,SAAiD;EAClF,MAAM,cAAc,MAAM,KAAK,YAAY,IAAI;EAC/C,MAAM,OAAOI,uBAAAA,gBAAgB,OAAO;EACpC,MAAM,EAAE,SAAS,KAAK;EACtB,MAAM,UAAU,OAAO;GACrB,QAAQ;GACR,MAAM;GACN,SAAS;IACP;IACA,gBAAgB;IAChB,gBAAgB,iBAAiB;GACnC;GACA;GACA,QAAQ,KAAK;GACb,SAAS;GACT;EACF,CAAC;EACD,MAAME,qBAAAA,YAAY;GAChB,KAAK,KAAK;GACV;GACA;GACA,WAAW,KAAK;GAChB,OAAO,cAAc;GACrB,eAAe;IACb,GAAG,KAAK,YAAY,aAAa;IACjC,QAAQ;IACR,QAAQ;IACR,GAAGJ,sBAAAA,WAAW,KAAK,QAAQ;GAC7B;EACF,CAAC;CACH;AACF"}

package/dist/{cloudwatch.transport-Brh5fmRN.mjs → cloudwatch.transport-wWrht2Gv.mjs}

@@ -1,8 +1,8 @@
-import { n as protectSecrets, o as urlSecrets } from "./secret-config-Cng7XPLx.mjs";
+import { n as protectSecrets, s as urlSecrets } from "./secret-config-BFKJrSYF.mjs";
 import { r as internalWarn } from "./internal-log-Cy5nF1ZL.mjs";
 import { i as stringifyForLog } from "./safe-stringify-B5p5ktFe.mjs";
 import { t as mergeCoreFields } from "./entry-fields-J1OBi24o.mjs";
-import { a as httpRequest, i as HttpError, o as isPermanentHttpError, t as BatchBuffer } from "./batch-buffer-BnmVCCwI.mjs";
+import { a as httpRequest, i as HttpError, o as isPermanentHttpError, t as BatchBuffer } from "./batch-buffer-CcubZ2cW.mjs";
 import * as crypto from "node:crypto";
 import * as os from "node:os";
 import * as fs from "node:fs";
@@ -405,4 +405,4 @@ var CloudWatchTransport = class {
 };
 export { CloudWatchTransport as t };
 
-//# sourceMappingURL=cloudwatch.transport-Brh5fmRN.mjs.map
+//# sourceMappingURL=cloudwatch.transport-wWrht2Gv.mjs.map

package/dist/{cloudwatch.transport-Brh5fmRN.mjs.map → cloudwatch.transport-wWrht2Gv.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"cloudwatch.transport-Brh5fmRN.mjs","names":["path"],"sources":["../src/transports/aws-credentials.ts","../src/transports/aws-sigv4.ts","../src/transports/cloudwatch.transport.ts"],"sourcesContent":["/**\n * AWS credential resolution without the SDK.\n *\n * Order: explicit config, environment variables, shared credentials file,\n * ECS/container credentials, EC2 instance metadata (IMDSv2).\n * Not supported: SSO, assume-role profiles, credential_process, web identity.\n */\n\nimport * as fs from 'node:fs';\nimport * as os from 'node:os';\nimport * as path from 'node:path';\n\nimport { internalWarn } from '../utils/internal-log';\nimport { type AwsCredentials } from './aws-sigv4';\nimport { httpRequest } from './batch-buffer';\nimport { protectSecrets } from './secret-config';\n\nconst REFRESH_MARGIN_MS = 5 * 60 * 1000;\nconst FAILURE_BACKOFF_MS = 30 * 1000;\nconst METADATA_TIMEOUT_MS = 2000;\n\nexport interface AwsCredentialConfig {\n  accessKeyId?: string | undefined;\n  secretAccessKey?: string | undefined;\n  sessionToken?: string | undefined;\n}\n\n/** Parse the sections of an AWS ini file into `{ section: { key: value } }`. */\nexport function parseIni(text: string): Record<string, Record<string, string>> {\n  const out: Record<string, Record<string, string>> = {};\n  let section: Record<string, string> | undefined;\n  for (const raw of text.split(/\\r?\\n/)) {\n    const line = raw.trim();\n    if (!line || line.startsWith('#') || line.startsWith(';')) continue;\n    const header = /^\\[(.+)\\]$/.exec(line);\n    if (header) {\n      section = out[header[1]!.trim()] = out[header[1]!.trim()] ?? {};\n      continue;\n    }\n    const eq = line.indexOf('=');\n    if (eq > 0 && section) section[line.slice(0, eq).trim()] = line.slice(eq + 1).trim();\n  }\n  return out;\n}\n\nfunction fromEnv(): AwsCredentials | undefined {\n  const accessKeyId = process.env['AWS_ACCESS_KEY_ID'];\n  const secretAccessKey = process.env['AWS_SECRET_ACCESS_KEY'];\n  if (!accessKeyId || !secretAccessKey) return undefined;\n  return { accessKeyId, secretAccessKey, sessionToken: process.env['AWS_SESSION_TOKEN'] };\n}\n\nfunction fromSharedFile(): AwsCredentials | undefined {\n  const file =\n    process.env['AWS_SHARED_CREDENTIALS_FILE'] ?? path.join(os.homedir(), '.aws', 'credentials');\n  const profile = process.env['AWS_PROFILE'] ?? 'default';\n  let text: string;\n  try {\n    text = fs.readFileSync(file, 'utf8');\n  } catch {\n    return undefined;\n  }\n  const section = parseIni(text)[profile];\n  const accessKeyId = section?.['aws_access_key_id'];\n  const secretAccessKey = section?.['aws_secret_access_key'];\n  if (!accessKeyId || !secretAccessKey) return undefined;\n  return { accessKeyId, secretAccessKey, sessionToken: section?.['aws_session_token'] };\n}\n\ninterface CredentialDocument {\n  AccessKeyId?: string;\n  SecretAccessKey?: string;\n  Token?: string;\n  Expiration?: string;\n}\n\nfunction fromDocument(raw: string): AwsCredentials | undefined {\n  const doc = JSON.parse(raw) as CredentialDocument;\n  if (!doc.AccessKeyId || !doc.SecretAccessKey) return undefined;\n  const expiresAt = doc.Expiration ? Date.parse(doc.Expiration) : Number.NaN;\n  return {\n    accessKeyId: doc.AccessKeyId,\n    secretAccessKey: doc.SecretAccessKey,\n    sessionToken: doc.Token,\n    expiresAt: Number.isNaN(expiresAt) ? undefined : expiresAt,\n  };\n}\n\nconst CONTAINER_HOSTS = new Set([\n  // eslint-disable-next-line sonarjs/no-hardcoded-ip -- fixed ECS credentials endpoint\n  '169.254.170.2',\n  // eslint-disable-next-line sonarjs/no-hardcoded-ip -- fixed EKS pod identity endpoint\n  '169.254.170.23',\n  '[fd00:ec2::23]',\n  'localhost',\n  '[::1]',\n]);\n\n/** Same rule as the AWS SDKs: never send the container token to an arbitrary http host. */\nfunction isAllowedContainerHost(url: URL): boolean {\n  if (url.protocol === 'https:') return true;\n  if (url.protocol !== 'http:') return false;\n  return CONTAINER_HOSTS.has(url.hostname) || /^127(?:\\.\\d{1,3}){3}$/.test(url.hostname);\n}\n\nasync function fromContainer(): Promise<AwsCredentials | undefined> {\n  const relative = process.env['AWS_CONTAINER_CREDENTIALS_RELATIVE_URI'];\n  const full = process.env['AWS_CONTAINER_CREDENTIALS_FULL_URI'];\n  if (!relative && !full) return undefined;\n  const url = new URL(relative ? `http://169.254.170.2${relative}` : (full as string));\n  if (!relative && !isAllowedContainerHost(url)) {\n    internalWarn(\n      `ignoring AWS_CONTAINER_CREDENTIALS_FULL_URI: ${url.host} is not https or a loopback / ECS / EKS address`\n    );\n    return undefined;\n  }\n  const headers: Record<string, string> = {};\n  const tokenFile = process.env['AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE'];\n  const token = tokenFile\n    ? fs.readFileSync(tokenFile, 'utf8').trim()\n    : process.env['AWS_CONTAINER_AUTHORIZATION_TOKEN'];\n  if (token) headers['Authorization'] = token;\n  const res = await httpRequest({\n    url,\n    method: 'GET',\n    headers,\n    timeoutMs: METADATA_TIMEOUT_MS,\n    label: 'AWS container credentials',\n  });\n  return fromDocument(res.body);\n}\n\nasync function fromInstanceMetadata(): Promise<AwsCredentials | undefined> {\n  if (process.env['AWS_EC2_METADATA_DISABLED'] === 'true') return undefined;\n  const base = process.env['AWS_EC2_METADATA_SERVICE_ENDPOINT'] ?? 'http://169.254.169.254';\n  const get = (p: string, method: string, headers: Record<string, string>) =>\n    httpRequest({\n      url: new URL(p, base),\n      method,\n      headers,\n      timeoutMs: METADATA_TIMEOUT_MS,\n      label: 'EC2 instance metadata',\n    });\n  const session = await get('/latest/api/token', 'PUT', {\n    'X-aws-ec2-metadata-token-ttl-seconds': '21600',\n  });\n  const auth = { 'X-aws-ec2-metadata-token': session.body.trim() };\n  const roles = await get('/latest/meta-data/iam/security-credentials/', 'GET', auth);\n  const role = roles.body.split('\\n')[0]?.trim();\n  if (!role) return undefined;\n  const creds = await get(\n    `/latest/meta-data/iam/security-credentials/${encodeURIComponent(role)}`,\n    'GET',\n    auth\n  );\n  return fromDocument(creds.body);\n}\n\nexport class AwsCredentialProvider {\n  private cached: AwsCredentials | undefined;\n  private failedAt = 0;\n  private readonly explicit: AwsCredentials | undefined;\n\n  constructor(config: AwsCredentialConfig) {\n    protectSecrets(this, ['cached', 'explicit']);\n    if (config.accessKeyId && config.secretAccessKey) {\n      this.explicit = {\n        accessKeyId: config.accessKeyId,\n        secretAccessKey: config.secretAccessKey,\n        sessionToken: config.sessionToken,\n      };\n    }\n  }\n\n  /** Throws when no source yields credentials, so the caller keeps its buffer. */\n  async get(): Promise<AwsCredentials> {\n    if (this.explicit) return this.explicit;\n    const env = fromEnv();\n    if (env) return env;\n    if (this.cached && !this.isExpiring(this.cached)) return this.cached;\n    if (Date.now() - this.failedAt < FAILURE_BACKOFF_MS) {\n      throw new Error('no AWS credentials found (retrying shortly)');\n    }\n\n    let found = fromSharedFile();\n    for (const source of [fromContainer, fromInstanceMetadata]) {\n      if (found) break;\n      try {\n        found = await source();\n      } catch {\n        /* source not available here; try the next */\n      }\n    }\n    if (!found) {\n      this.failedAt = Date.now();\n      throw new Error(\n        'no AWS credentials found: set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, a shared credentials file, container credentials, or run on EC2 with an instance role'\n      );\n    }\n    this.cached = found;\n    return found;\n  }\n\n  /** Secret values this provider may hold, for scrubbing error text. */\n  secretValues(): (string | undefined)[] {\n    const env = process.env;\n    return [\n      this.explicit?.secretAccessKey,\n      this.explicit?.sessionToken,\n      this.cached?.secretAccessKey,\n      this.cached?.sessionToken,\n      env['AWS_SECRET_ACCESS_KEY'],\n      env['AWS_SESSION_TOKEN'],\n    ];\n  }\n\n  invalidate(): void {\n    this.cached = undefined;\n    this.failedAt = 0;\n  }\n\n  private isExpiring(c: AwsCredentials): boolean {\n    return c.expiresAt !== undefined && c.expiresAt - Date.now() < REFRESH_MARGIN_MS;\n  }\n}\n","/**\n * AWS Signature Version 4 request signing, dependency-free.\n */\n\nimport * as crypto from 'node:crypto';\n\nexport interface AwsCredentials {\n  accessKeyId: string;\n  secretAccessKey: string;\n  sessionToken?: string | undefined;\n  /** Epoch ms after which the credentials are no longer valid. */\n  expiresAt?: number | undefined;\n}\n\nexport interface SignV4Options {\n  method: string;\n  path: string;\n  query?: string;\n  /** Must include `host`. Names are lowercased before signing. */\n  headers: Record<string, string>;\n  body: string;\n  region: string;\n  service: string;\n  credentials: AwsCredentials;\n  date?: Date;\n}\n\nconst sha256Hex = (data: string): string => crypto.createHash('sha256').update(data).digest('hex');\n\nconst hmac = (key: Buffer | string, msg: string): Buffer =>\n  crypto.createHmac('sha256', key).update(msg).digest();\n\n/** Returns the request headers (lowercase names) with `x-amz-date` and `authorization` added. */\nexport function signV4(opts: SignV4Options): Record<string, string> {\n  const {\n    method,\n    path,\n    query = '',\n    body,\n    region,\n    service,\n    credentials,\n    headers: input,\n    date,\n  } = opts;\n  const amzDate = (date ?? new Date()).toISOString().replace(/[:-]|\\.\\d{3}/g, '');\n  const dateStamp = amzDate.slice(0, 8);\n\n  const headers: Record<string, string> = {};\n  for (const [k, v] of Object.entries(input)) headers[k.toLowerCase()] = v;\n  headers['x-amz-date'] = amzDate;\n  if (credentials.sessionToken) headers['x-amz-security-token'] = credentials.sessionToken;\n\n  const names = Object.keys(headers).sort();\n  const canonicalHeaders = names\n    .map((n) => `${n}:${headers[n]!.trim().replace(/\\s+/g, ' ')}\\n`)\n    .join('');\n  const signedHeaders = names.join(';');\n\n  const canonicalRequest = [\n    method,\n    path,\n    query,\n    canonicalHeaders,\n    signedHeaders,\n    sha256Hex(body),\n  ].join('\\n');\n  const scope = `${dateStamp}/${region}/${service}/aws4_request`;\n  const stringToSign = ['AWS4-HMAC-SHA256', amzDate, scope, sha256Hex(canonicalRequest)].join('\\n');\n\n  const signingKey = hmac(\n    hmac(hmac(hmac(`AWS4${credentials.secretAccessKey}`, dateStamp), region), service),\n    'aws4_request'\n  );\n  const signature = crypto.createHmac('sha256', signingKey).update(stringToSign).digest('hex');\n\n  headers['authorization'] =\n    `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, ` +\n    `SignedHeaders=${signedHeaders}, Signature=${signature}`;\n  return headers;\n}\n","/**\n * logixia — AWS CloudWatch Logs transport\n *\n * Sends log entries to AWS CloudWatch Logs via the PutLogEvents API.\n * Supports EMF (Embedded Metric Format) for automatic metric extraction.\n *\n * Auth, in order: explicit config, environment variables, the shared\n * credentials file (AWS_PROFILE, AWS_SHARED_CREDENTIALS_FILE), ECS container\n * credentials, then EC2 instance metadata (IMDSv2). SSO, assume-role profiles\n * and credential_process are not supported. No SDK dependency — raw HTTPS with\n * AWS Signature Version 4.\n *\n * The log group and stream are created on first use if they do not exist.\n *\n * @example\n * ```ts\n * import { createLogger } from 'logixia';\n * import { CloudWatchTransport } from 'logixia/cloudwatch';\n *\n * const logger = createLogger({\n *   transports: {\n *     custom: [\n *       new CloudWatchTransport({\n *         region: 'us-east-1',\n *         logGroupName: '/myapp/production',\n *         logStreamName: `api-${process.env.HOSTNAME}`,\n *         batchSize: 100,\n *         flushIntervalMs: 5000,\n *       }),\n *     ],\n *   },\n * });\n * ```\n */\n\nimport type { IAsyncTransport, TransportLogEntry } from '../types/transport.types';\nimport { internalWarn } from '../utils/internal-log';\nimport { stringifyForLog } from '../utils/safe-stringify';\nimport { AwsCredentialProvider } from './aws-credentials';\nimport { signV4 } from './aws-sigv4';\nimport {\n  BatchBuffer,\n  DEFAULT_MAX_BUFFER_SIZE,\n  DEFAULT_REQUEST_TIMEOUT_MS,\n  HttpError,\n  httpRequest,\n  isPermanentHttpError,\n} from './batch-buffer';\nimport { mergeCoreFields } from './entry-fields';\nimport { protectSecrets, urlSecrets } from './secret-config';\n\nexport interface CloudWatchTransportConfig {\n  /** AWS region, e.g. `'us-east-1'`. Falls back to `AWS_REGION` env var. */\n  region?: string;\n  /** CloudWatch Logs group name. Created automatically if it does not exist. */\n  logGroupName: string;\n  /** CloudWatch Logs stream name. Defaults to hostname + process PID. */\n  logStreamName?: string;\n  /** Override the Logs endpoint, e.g. for LocalStack. Default: `https://logs.<region>.amazonaws.com`. */\n  endpoint?: string;\n  /** AWS access key ID. Falls back to the credential chain described above. */\n  accessKeyId?: string;\n  /** AWS secret access key. Used together with `accessKeyId`. */\n  secretAccessKey?: string;\n  /** AWS session token for temporary credentials. Used together with `accessKeyId`. */\n  sessionToken?: string;\n  /**\n   * Number of log events to batch before flushing.\n   * CloudWatch allows max 10,000 events per PutLogEvents call; larger values are capped.\n   * @default 100\n   */\n  batchSize?: number;\n  /**\n   * Max ms between flushes even if batchSize is not reached.\n   * @default 5000\n   */\n  flushIntervalMs?: number;\n  /**\n   * Enable EMF (Embedded Metric Format) — wraps log entries as CloudWatch\n   * metric namespaces so numeric fields become CloudWatch Metrics automatically.\n   * @default false\n   */\n  emf?: boolean;\n  /** CloudWatch Metrics namespace used by EMF. @default 'Logixia' */\n  emfNamespace?: string;\n  /**\n   * Payload fields published as EMF metrics. When set, only these numeric\n   * fields become metrics; when unset every numeric payload field does (up to\n   * the EMF limit of 100 per entry).\n   */\n  emfMetrics?: string[];\n  /** Abort a request that has not finished after this many ms. @default 10000 */\n  requestTimeoutMs?: number;\n  /** Max buffered events; the oldest are dropped past this. @default 10000 */\n  maxBufferSize?: number;\n  /** Minimum log level to forward. */\n  level?: string;\n}\n\nconst MAX_EVENTS_PER_PUT = 10_000;\nconst EMF_MAX_METRICS = 100;\n\n/** Error types worth retrying even though CloudWatch reports them as HTTP 400. */\nconst RETRYABLE_TYPES = new Set([\n  'ThrottlingException',\n  'ThrottledException',\n  'LimitExceededException',\n  'ServiceUnavailableException',\n  'ExpiredTokenException',\n  'ResourceNotFoundException',\n]);\n\nfunction awsErrorType(err: unknown): string | undefined {\n  if (!(err instanceof HttpError)) return undefined;\n  try {\n    const type = (JSON.parse(err.body) as { __type?: string }).__type;\n    return type?.split('#').pop();\n  } catch {\n    return undefined;\n  }\n}\n\ninterface CwLogEvent {\n  timestamp: number;\n  message: string;\n}\n\n/**\n * AWS CloudWatch Logs transport with EMF support and batched PutLogEvents calls.\n */\nexport class CloudWatchTransport implements IAsyncTransport {\n  public readonly name = 'cloudwatch';\n  public readonly batchSize: number;\n  public readonly flushInterval: number;\n  public readonly level: string | undefined;\n\n  private readonly buffer: BatchBuffer<CwLogEvent>;\n  private readonly requestTimeoutMs: number;\n  private flushTimer: NodeJS.Timeout | null = null;\n  private readonly credentials: AwsCredentialProvider;\n  private readonly endpoint: URL;\n  private streamReady = false;\n\n  private readonly region: string;\n  private readonly logGroupName: string;\n  private readonly logStreamName: string;\n  private readonly emf: boolean;\n  private readonly emfNamespace: string;\n  private readonly emfMetrics: ReadonlySet<string> | undefined;\n\n  constructor(config: CloudWatchTransportConfig) {\n    this.region =\n      config.region ??\n      process.env['AWS_REGION'] ??\n      process.env['AWS_DEFAULT_REGION'] ??\n      'us-east-1';\n    this.logGroupName = config.logGroupName;\n    this.logStreamName =\n      config.logStreamName ?? `${process.env['HOSTNAME'] ?? 'node'}-${process.pid}`;\n    this.credentials = new AwsCredentialProvider(config);\n    this.endpoint = new URL(config.endpoint ?? `https://logs.${this.region}.amazonaws.com`);\n    this.batchSize = Math.min(config.batchSize ?? 100, MAX_EVENTS_PER_PUT);\n    this.emfNamespace = config.emfNamespace ?? 'Logixia';\n    this.flushInterval = config.flushIntervalMs ?? 5000;\n    this.emf = config.emf ?? false;\n    this.emfMetrics = config.emfMetrics ? new Set(config.emfMetrics) : undefined;\n    this.level = config.level;\n    this.requestTimeoutMs = config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;\n    this.buffer = new BatchBuffer<CwLogEvent>({\n      name: 'CloudWatchTransport',\n      batchSize: this.batchSize,\n      maxBufferSize: config.maxBufferSize ?? DEFAULT_MAX_BUFFER_SIZE,\n      send: (events) => this.putLogEvents(events),\n      secrets: () => [...this.credentials.secretValues(), ...urlSecrets(this.endpoint)],\n      shouldRetry: (err) =>\n        !isPermanentHttpError(err) || RETRYABLE_TYPES.has(awsErrorType(err) ?? ''),\n    });\n\n    this.flushTimer = setInterval(() => {\n      this.flush().catch(() => {});\n    }, this.flushInterval);\n    if (this.flushTimer.unref) this.flushTimer.unref();\n    protectSecrets(this, ['credentials', 'endpoint']);\n  }\n\n  write(entry: TransportLogEntry): void {\n    const timestamp = entry.timestamp ? new Date(entry.timestamp).getTime() : Date.now();\n    const message = this.emf ? this.toEmf(entry) : stringifyForLog(entry);\n    this.buffer.push({ timestamp, message });\n    this.buffer.flushIfFull();\n  }\n\n  flush(): Promise<void> {\n    return this.buffer.flush();\n  }\n\n  /**\n   * Flush remaining events and stop the interval timer on shutdown. Without this\n   * the manager's close() skips the transport (close was undefined) and any\n   * buffered events were lost on deploy. Waits for any in-flight send first.\n   */\n  async close(): Promise<void> {\n    if (this.flushTimer) {\n      clearInterval(this.flushTimer);\n      this.flushTimer = null;\n    }\n    await this.buffer.close();\n  }\n\n  private toEmf(entry: TransportLogEntry): string {\n    const { level, message, data: payload, timestamp } = entry;\n    const fields = mergeCoreFields({ _aws: undefined, level, message }, payload);\n    const metricNames: string[] = [];\n    for (const [k, v] of Object.entries(fields)) {\n      if (k === '_aws' || k === 'level' || k === 'message' || typeof v !== 'number') continue;\n      if (this.emfMetrics && !this.emfMetrics.has(k)) continue;\n      if (metricNames.length < EMF_MAX_METRICS) metricNames.push(k);\n    }\n    fields['_aws'] = {\n      Timestamp: timestamp ? new Date(timestamp).getTime() : Date.now(),\n      CloudWatchMetrics:\n        metricNames.length > 0\n          ? [\n              {\n                Namespace: this.emfNamespace,\n                Dimensions: [['level']],\n                Metrics: metricNames.map((n) => ({ Name: n, Unit: 'None' })),\n              },\n            ]\n          : [],\n    };\n    return stringifyForLog(fields);\n  }\n\n  private async putLogEvents(events: CwLogEvent[]): Promise<void> {\n    await this.ensureStream();\n    const logEvents = [...events].sort((a, b) => a.timestamp - b.timestamp);\n    try {\n      await this.call('PutLogEvents', {\n        logGroupName: this.logGroupName,\n        logStreamName: this.logStreamName,\n        logEvents,\n      });\n    } catch (err) {\n      const type = awsErrorType(err);\n      if (type === 'DataAlreadyAcceptedException') return;\n      if (type === 'ResourceNotFoundException') this.streamReady = false;\n      if (type === 'ExpiredTokenException') this.credentials.invalidate();\n      throw err;\n    }\n  }\n\n  private async ensureStream(): Promise<void> {\n    if (this.streamReady) return;\n    try {\n      await this.call('CreateLogGroup', { logGroupName: this.logGroupName });\n    } catch (err) {\n      if (awsErrorType(err) === 'ExpiredTokenException') this.credentials.invalidate();\n      if (!(err instanceof HttpError)) throw err;\n      if (awsErrorType(err) !== 'ResourceAlreadyExistsException') {\n        internalWarn(`CloudWatchTransport: CreateLogGroup failed, continuing (${err.message})`);\n      }\n    }\n    try {\n      await this.call('CreateLogStream', {\n        logGroupName: this.logGroupName,\n        logStreamName: this.logStreamName,\n      });\n    } catch (err) {\n      if (awsErrorType(err) !== 'ResourceAlreadyExistsException') throw err;\n    }\n    this.streamReady = true;\n  }\n\n  private async call(action: string, payload: Record<string, unknown>): Promise<void> {\n    const credentials = await this.credentials.get();\n    const body = stringifyForLog(payload);\n    const { host } = this.endpoint;\n    const headers = signV4({\n      method: 'POST',\n      path: '/',\n      headers: {\n        host,\n        'content-type': 'application/x-amz-json-1.1',\n        'x-amz-target': `Logs_20140328.${action}`,\n      },\n      body,\n      region: this.region,\n      service: 'logs',\n      credentials,\n    });\n    await httpRequest({\n      url: this.endpoint,\n      headers,\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: `CloudWatch ${action}`,\n      secrets: () => [\n        ...this.credentials.secretValues(),\n        headers['authorization'],\n        headers['x-amz-security-token'],\n        ...urlSecrets(this.endpoint),\n      ],\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAiBA,MAAM,oBAAoB;AAC1B,MAAM,qBAAqB;AAC3B,MAAM,sBAAsB;;AAS5B,SAAgB,SAAS,MAAsD;CAC7E,MAAM,MAA8C,CAAC;CACrD,IAAI;CACJ,KAAK,MAAM,OAAO,KAAK,MAAM,OAAO,GAAG;EACrC,MAAM,OAAO,IAAI,KAAK;EACtB,IAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,GAAG,GAAG;EAC3D,MAAM,SAAS,aAAa,KAAK,IAAI;EACrC,IAAI,QAAQ;GACV,UAAU,IAAI,OAAO,EAAE,CAAE,KAAK,KAAK,IAAI,OAAO,EAAE,CAAE,KAAK,MAAM,CAAC;GAC9D;EACF;EACA,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,IAAI,KAAK,KAAK,SAAS,QAAQ,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK;CACrF;CACA,OAAO;AACT;AAEA,SAAS,UAAsC;CAC7C,MAAM,cAAc,QAAQ,IAAI;CAChC,MAAM,kBAAkB,QAAQ,IAAI;CACpC,IAAI,CAAC,eAAe,CAAC,iBAAiB,OAAO,KAAA;CAC7C,OAAO;EAAE;EAAa;EAAiB,cAAc,QAAQ,IAAI;CAAqB;AACxF;AAEA,SAAS,iBAA6C;CACpD,MAAM,OACJ,QAAQ,IAAI,kCAAkCA,OAAK,KAAK,GAAG,QAAQ,GAAG,QAAQ,aAAa;CAC7F,MAAM,UAAU,QAAQ,IAAI,kBAAkB;CAC9C,IAAI;CACJ,IAAI;EACF,OAAO,GAAG,aAAa,MAAM,MAAM;CACrC,QAAQ;EACN;CACF;CACA,MAAM,UAAU,SAAS,IAAI,CAAC,CAAC;CAC/B,MAAM,cAAA,YAAA,QAAA,YAAA,KAAA,IAAA,KAAA,IAAc,QAAU;CAC9B,MAAM,kBAAA,YAAA,QAAA,YAAA,KAAA,IAAA,KAAA,IAAkB,QAAU;CAClC,IAAI,CAAC,eAAe,CAAC,iBAAiB,OAAO,KAAA;CAC7C,OAAO;EAAE;EAAa;EAAiB,cAAA,YAAA,QAAA,YAAA,KAAA,IAAA,KAAA,IAAc,QAAU;CAAqB;AACtF;AASA,SAAS,aAAa,KAAyC;CAC7D,MAAM,MAAM,KAAK,MAAM,GAAG;CAC1B,IAAI,CAAC,IAAI,eAAe,CAAC,IAAI,iBAAiB,OAAO,KAAA;CACrD,MAAM,YAAY,IAAI,aAAa,KAAK,MAAM,IAAI,UAAU,IAAI;CAChE,OAAO;EACL,aAAa,IAAI;EACjB,iBAAiB,IAAI;EACrB,cAAc,IAAI;EAClB,WAAW,OAAO,MAAM,SAAS,IAAI,KAAA,IAAY;CACnD;AACF;AAEA,MAAM,kCAAkB,IAAI,IAAI;CAE9B;CAEA;CACA;CACA;CACA;AACF,CAAC;;AAGD,SAAS,uBAAuB,KAAmB;CACjD,IAAI,IAAI,aAAa,UAAU,OAAO;CACtC,IAAI,IAAI,aAAa,SAAS,OAAO;CACrC,OAAO,gBAAgB,IAAI,IAAI,QAAQ,KAAK,wBAAwB,KAAK,IAAI,QAAQ;AACvF;AAEA,eAAe,gBAAqD;CAClE,MAAM,WAAW,QAAQ,IAAI;CAC7B,MAAM,OAAO,QAAQ,IAAI;CACzB,IAAI,CAAC,YAAY,CAAC,MAAM,OAAO,KAAA;CAC/B,MAAM,MAAM,IAAI,IAAI,WAAW,uBAAuB,aAAc,IAAe;CACnF,IAAI,CAAC,YAAY,CAAC,uBAAuB,GAAG,GAAG;EAC7C,aACE,gDAAgD,IAAI,KAAK,gDAC3D;EACA;CACF;CACA,MAAM,UAAkC,CAAC;CACzC,MAAM,YAAY,QAAQ,IAAI;CAC9B,MAAM,QAAQ,YACV,GAAG,aAAa,WAAW,MAAM,CAAC,CAAC,KAAK,IACxC,QAAQ,IAAI;CAChB,IAAI,OAAO,QAAQ,mBAAmB;CAQtC,OAAO,cAAa,MAPF,YAAY;EAC5B;EACA,QAAQ;EACR;EACA,WAAW;EACX,OAAO;CACT,CAAC,EAAA,CACuB,IAAI;AAC9B;AAEA,eAAe,uBAA4D;;CACzE,IAAI,QAAQ,IAAI,iCAAiC,QAAQ,OAAO,KAAA;CAChE,MAAM,OAAO,QAAQ,IAAI,wCAAwC;CACjE,MAAM,OAAO,GAAW,QAAgB,YACtC,YAAY;EACV,KAAK,IAAI,IAAI,GAAG,IAAI;EACpB;EACA;EACA,WAAW;EACX,OAAO;CACT,CAAC;CAIH,MAAM,OAAO,EAAE,6BAA4B,MAHrB,IAAI,qBAAqB,OAAO,EACpD,wCAAwC,QAC1C,CAAC,EAAA,CACkD,KAAK,KAAK,EAAE;CAE/D,MAAM,QAAA,sBAAO,MADO,IAAI,+CAA+C,OAAO,IAAI,EAAA,CAC/D,KAAK,MAAM,IAAI,CAAC,CAAC,QAAA,QAAA,uBAAA,KAAA,IAAA,KAAA,IAAA,mBAAI,KAAK;CAC7C,IAAI,CAAC,MAAM,OAAO,KAAA;CAMlB,OAAO,cAAa,MALA,IAClB,8CAA8C,mBAAmB,IAAI,KACrE,OACA,IACF,EAAA,CAC0B,IAAI;AAChC;AAEA,IAAa,wBAAb,MAAmC;CACjC;CACA,WAAmB;CACnB;CAEA,YAAY,QAA6B;EACvC,eAAe,MAAM,CAAC,UAAU,UAAU,CAAC;EAC3C,IAAI,OAAO,eAAe,OAAO,iBAC/B,KAAK,WAAW;GACd,aAAa,OAAO;GACpB,iBAAiB,OAAO;GACxB,cAAc,OAAO;EACvB;CAEJ;;CAGA,MAAM,MAA+B;EACnC,IAAI,KAAK,UAAU,OAAO,KAAK;EAC/B,MAAM,MAAM,QAAQ;EACpB,IAAI,KAAK,OAAO;EAChB,IAAI,KAAK,UAAU,CAAC,KAAK,WAAW,KAAK,MAAM,GAAG,OAAO,KAAK;EAC9D,IAAI,KAAK,IAAI,IAAI,KAAK,WAAW,oBAC/B,MAAM,IAAI,MAAM,6CAA6C;EAG/D,IAAI,QAAQ,eAAe;EAC3B,KAAK,MAAM,UAAU,CAAC,eAAe,oBAAoB,GAAG;GAC1D,IAAI,OAAO;GACX,IAAI;IACF,QAAQ,MAAM,OAAO;GACvB,QAAQ,CAER;EACF;EACA,IAAI,CAAC,OAAO;GACV,KAAK,WAAW,KAAK,IAAI;GACzB,MAAM,IAAI,MACR,8JACF;EACF;EACA,KAAK,SAAS;EACd,OAAO;CACT;;CAGA,eAAuC;;EACrC,MAAM,MAAM,QAAQ;EACpB,OAAO;IACL,iBAAA,KAAK,cAAA,QAAA,mBAAA,KAAA,IAAA,KAAA,IAAA,eAAU;IACf,kBAAA,KAAK,cAAA,QAAA,oBAAA,KAAA,IAAA,KAAA,IAAA,gBAAU;IACf,eAAA,KAAK,YAAA,QAAA,iBAAA,KAAA,IAAA,KAAA,IAAA,aAAQ;IACb,gBAAA,KAAK,YAAA,QAAA,kBAAA,KAAA,IAAA,KAAA,IAAA,cAAQ;GACb,IAAI;GACJ,IAAI;EACN;CACF;CAEA,aAAmB;EACjB,KAAK,SAAS,KAAA;EACd,KAAK,WAAW;CAClB;CAEA,WAAmB,GAA4B;EAC7C,OAAO,EAAE,cAAc,KAAA,KAAa,EAAE,YAAY,KAAK,IAAI,IAAI;CACjE;AACF;;;;;ACrMA,MAAM,aAAa,SAAyB,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK;AAEjG,MAAM,QAAQ,KAAsB,QAClC,OAAO,WAAW,UAAU,GAAG,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO;;AAGtD,SAAgB,OAAO,MAA6C;CAClE,MAAM,EACJ,QACA,MACA,QAAQ,IACR,MACA,QACA,SACA,aACA,SAAS,OACT,SACE;CACJ,MAAM,WAAW,wBAAQ,IAAI,KAAK,EAAA,CAAG,YAAY,CAAC,CAAC,QAAQ,iBAAiB,EAAE;CAC9E,MAAM,YAAY,QAAQ,MAAM,GAAG,CAAC;CAEpC,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,KAAK,GAAG,QAAQ,EAAE,YAAY,KAAK;CACvE,QAAQ,gBAAgB;CACxB,IAAI,YAAY,cAAc,QAAQ,0BAA0B,YAAY;CAE5E,MAAM,QAAQ,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK;CACxC,MAAM,mBAAmB,MACtB,KAAK,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAE,KAAK,CAAC,CAAC,QAAQ,QAAQ,GAAG,EAAE,GAAG,CAAC,CAC/D,KAAK,EAAE;CACV,MAAM,gBAAgB,MAAM,KAAK,GAAG;CAEpC,MAAM,mBAAmB;EACvB;EACA;EACA;EACA;EACA;EACA,UAAU,IAAI;CAChB,CAAC,CAAC,KAAK,IAAI;CACX,MAAM,QAAQ,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ;CAChD,MAAM,eAAe;EAAC;EAAoB;EAAS;EAAO,UAAU,gBAAgB;CAAC,CAAC,CAAC,KAAK,IAAI;CAEhG,MAAM,aAAa,KACjB,KAAK,KAAK,KAAK,OAAO,YAAY,mBAAmB,SAAS,GAAG,MAAM,GAAG,OAAO,GACjF,cACF;CACA,MAAM,YAAY,OAAO,WAAW,UAAU,UAAU,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC,OAAO,KAAK;CAE3F,QAAQ,mBACN,+BAA+B,YAAY,YAAY,GAAG,MAAM,kBAC/C,cAAc,cAAc;CAC/C,OAAO;AACT;;ACmBA,MAAM,qBAAqB;AAC3B,MAAM,kBAAkB;;AAGxB,MAAM,kCAAkB,IAAI,IAAI;CAC9B;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,aAAa,KAAkC;CACtD,IAAI,EAAE,eAAe,YAAY,OAAO,KAAA;CACxC,IAAI;EACF,MAAM,OAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,CAAyB;EAC3D,OAAA,SAAA,QAAA,SAAA,KAAA,IAAA,KAAA,IAAO,KAAM,MAAM,GAAG,CAAC,CAAC,IAAI;CAC9B,QAAQ;EACN;CACF;AACF;;;;AAUA,IAAa,sBAAb,MAA4D;CAC1D,OAAuB;CACvB;CACA;CACA;CAEA;CACA;CACA,aAA4C;CAC5C;CACA;CACA,cAAsB;CAEtB;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,QAAmC;EAC7C,KAAK,SACH,OAAO,UACP,QAAQ,IAAI,iBACZ,QAAQ,IAAI,yBACZ;EACF,KAAK,eAAe,OAAO;EAC3B,KAAK,gBACH,OAAO,iBAAiB,GAAG,QAAQ,IAAI,eAAe,OAAO,GAAG,QAAQ;EAC1E,KAAK,cAAc,IAAI,sBAAsB,MAAM;EACnD,KAAK,WAAW,IAAI,IAAI,OAAO,YAAY,gBAAgB,KAAK,OAAO,eAAe;EACtF,KAAK,YAAY,KAAK,IAAI,OAAO,aAAa,KAAK,kBAAkB;EACrE,KAAK,eAAe,OAAO,gBAAgB;EAC3C,KAAK,gBAAgB,OAAO,mBAAmB;EAC/C,KAAK,MAAM,OAAO,OAAO;EACzB,KAAK,aAAa,OAAO,aAAa,IAAI,IAAI,OAAO,UAAU,IAAI,KAAA;EACnE,KAAK,QAAQ,OAAO;EACpB,KAAK,mBAAmB,OAAO,oBAAA;EAC/B,KAAK,SAAS,IAAI,YAAwB;GACxC,MAAM;GACN,WAAW,KAAK;GAChB,eAAe,OAAO,iBAAA;GACtB,OAAO,WAAW,KAAK,aAAa,MAAM;GAC1C,eAAe,CAAC,GAAG,KAAK,YAAY,aAAa,GAAG,GAAG,WAAW,KAAK,QAAQ,CAAC;GAChF,cAAc,QACZ,CAAC,qBAAqB,GAAG,KAAK,gBAAgB,IAAI,aAAa,GAAG,KAAK,EAAE;EAC7E,CAAC;EAED,KAAK,aAAa,kBAAkB;GAClC,KAAK,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;EAC7B,GAAG,KAAK,aAAa;EACrB,IAAI,KAAK,WAAW,OAAO,KAAK,WAAW,MAAM;EACjD,eAAe,MAAM,CAAC,eAAe,UAAU,CAAC;CAClD;CAEA,MAAM,OAAgC;EACpC,MAAM,YAAY,MAAM,YAAY,IAAI,KAAK,MAAM,SAAS,CAAC,CAAC,QAAQ,IAAI,KAAK,IAAI;EACnF,MAAM,UAAU,KAAK,MAAM,KAAK,MAAM,KAAK,IAAI,gBAAgB,KAAK;EACpE,KAAK,OAAO,KAAK;GAAE;GAAW;EAAQ,CAAC;EACvC,KAAK,OAAO,YAAY;CAC1B;CAEA,QAAuB;EACrB,OAAO,KAAK,OAAO,MAAM;CAC3B;;;;;;CAOA,MAAM,QAAuB;EAC3B,IAAI,KAAK,YAAY;GACnB,cAAc,KAAK,UAAU;GAC7B,KAAK,aAAa;EACpB;EACA,MAAM,KAAK,OAAO,MAAM;CAC1B;CAEA,MAAc,OAAkC;EAC9C,MAAM,EAAE,OAAO,SAAS,MAAM,SAAS,cAAc;EACrD,MAAM,SAAS,gBAAgB;GAAE,MAAM,KAAA;GAAW;GAAO;EAAQ,GAAG,OAAO;EAC3E,MAAM,cAAwB,CAAC;EAC/B,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,MAAM,GAAG;GAC3C,IAAI,MAAM,UAAU,MAAM,WAAW,MAAM,aAAa,OAAO,MAAM,UAAU;GAC/E,IAAI,KAAK,cAAc,CAAC,KAAK,WAAW,IAAI,CAAC,GAAG;GAChD,IAAI,YAAY,SAAS,iBAAiB,YAAY,KAAK,CAAC;EAC9D;EACA,OAAO,UAAU;GACf,WAAW,YAAY,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,IAAI,KAAK,IAAI;GAChE,mBACE,YAAY,SAAS,IACjB,CACE;IACE,WAAW,KAAK;IAChB,YAAY,CAAC,CAAC,OAAO,CAAC;IACtB,SAAS,YAAY,KAAK,OAAO;KAAE,MAAM;KAAG,MAAM;IAAO,EAAE;GAC7D,CACF,IACA,CAAC;EACT;EACA,OAAO,gBAAgB,MAAM;CAC/B;CAEA,MAAc,aAAa,QAAqC;EAC9D,MAAM,KAAK,aAAa;EACxB,MAAM,YAAY,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,YAAY,EAAE,SAAS;EACtE,IAAI;GACF,MAAM,KAAK,KAAK,gBAAgB;IAC9B,cAAc,KAAK;IACnB,eAAe,KAAK;IACpB;GACF,CAAC;EACH,SAAS,KAAK;GACZ,MAAM,OAAO,aAAa,GAAG;GAC7B,IAAI,SAAS,gCAAgC;GAC7C,IAAI,SAAS,6BAA6B,KAAK,cAAc;GAC7D,IAAI,SAAS,yBAAyB,KAAK,YAAY,WAAW;GAClE,MAAM;EACR;CACF;CAEA,MAAc,eAA8B;EAC1C,IAAI,KAAK,aAAa;EACtB,IAAI;GACF,MAAM,KAAK,KAAK,kBAAkB,EAAE,cAAc,KAAK,aAAa,CAAC;EACvE,SAAS,KAAK;GACZ,IAAI,aAAa,GAAG,MAAM,yBAAyB,KAAK,YAAY,WAAW;GAC/E,IAAI,EAAE,eAAe,YAAY,MAAM;GACvC,IAAI,aAAa,GAAG,MAAM,kCACxB,aAAa,2DAA2D,IAAI,QAAQ,EAAE;EAE1F;EACA,IAAI;GACF,MAAM,KAAK,KAAK,mBAAmB;IACjC,cAAc,KAAK;IACnB,eAAe,KAAK;GACtB,CAAC;EACH,SAAS,KAAK;GACZ,IAAI,aAAa,GAAG,MAAM,kCAAkC,MAAM;EACpE;EACA,KAAK,cAAc;CACrB;CAEA,MAAc,KAAK,QAAgB,SAAiD;EAClF,MAAM,cAAc,MAAM,KAAK,YAAY,IAAI;EAC/C,MAAM,OAAO,gBAAgB,OAAO;EACpC,MAAM,EAAE,SAAS,KAAK;EACtB,MAAM,UAAU,OAAO;GACrB,QAAQ;GACR,MAAM;GACN,SAAS;IACP;IACA,gBAAgB;IAChB,gBAAgB,iBAAiB;GACnC;GACA;GACA,QAAQ,KAAK;GACb,SAAS;GACT;EACF,CAAC;EACD,MAAM,YAAY;GAChB,KAAK,KAAK;GACV;GACA;GACA,WAAW,KAAK;GAChB,OAAO,cAAc;GACrB,eAAe;IACb,GAAG,KAAK,YAAY,aAAa;IACjC,QAAQ;IACR,QAAQ;IACR,GAAG,WAAW,KAAK,QAAQ;GAC7B;EACF,CAAC;CACH;AACF"}
+{"version":3,"file":"cloudwatch.transport-wWrht2Gv.mjs","names":["path"],"sources":["../src/transports/aws-credentials.ts","../src/transports/aws-sigv4.ts","../src/transports/cloudwatch.transport.ts"],"sourcesContent":["/**\n * AWS credential resolution without the SDK.\n *\n * Order: explicit config, environment variables, shared credentials file,\n * ECS/container credentials, EC2 instance metadata (IMDSv2).\n * Not supported: SSO, assume-role profiles, credential_process, web identity.\n */\n\nimport * as fs from 'node:fs';\nimport * as os from 'node:os';\nimport * as path from 'node:path';\n\nimport { internalWarn } from '../utils/internal-log';\nimport { type AwsCredentials } from './aws-sigv4';\nimport { httpRequest } from './batch-buffer';\nimport { protectSecrets } from './secret-config';\n\nconst REFRESH_MARGIN_MS = 5 * 60 * 1000;\nconst FAILURE_BACKOFF_MS = 30 * 1000;\nconst METADATA_TIMEOUT_MS = 2000;\n\nexport interface AwsCredentialConfig {\n  accessKeyId?: string | undefined;\n  secretAccessKey?: string | undefined;\n  sessionToken?: string | undefined;\n}\n\n/** Parse the sections of an AWS ini file into `{ section: { key: value } }`. */\nexport function parseIni(text: string): Record<string, Record<string, string>> {\n  const out: Record<string, Record<string, string>> = {};\n  let section: Record<string, string> | undefined;\n  for (const raw of text.split(/\\r?\\n/)) {\n    const line = raw.trim();\n    if (!line || line.startsWith('#') || line.startsWith(';')) continue;\n    const header = /^\\[(.+)\\]$/.exec(line);\n    if (header) {\n      section = out[header[1]!.trim()] = out[header[1]!.trim()] ?? {};\n      continue;\n    }\n    const eq = line.indexOf('=');\n    if (eq > 0 && section) section[line.slice(0, eq).trim()] = line.slice(eq + 1).trim();\n  }\n  return out;\n}\n\nfunction fromEnv(): AwsCredentials | undefined {\n  const accessKeyId = process.env['AWS_ACCESS_KEY_ID'];\n  const secretAccessKey = process.env['AWS_SECRET_ACCESS_KEY'];\n  if (!accessKeyId || !secretAccessKey) return undefined;\n  return { accessKeyId, secretAccessKey, sessionToken: process.env['AWS_SESSION_TOKEN'] };\n}\n\nfunction fromSharedFile(): AwsCredentials | undefined {\n  const file =\n    process.env['AWS_SHARED_CREDENTIALS_FILE'] ?? path.join(os.homedir(), '.aws', 'credentials');\n  const profile = process.env['AWS_PROFILE'] ?? 'default';\n  let text: string;\n  try {\n    text = fs.readFileSync(file, 'utf8');\n  } catch {\n    return undefined;\n  }\n  const section = parseIni(text)[profile];\n  const accessKeyId = section?.['aws_access_key_id'];\n  const secretAccessKey = section?.['aws_secret_access_key'];\n  if (!accessKeyId || !secretAccessKey) return undefined;\n  return { accessKeyId, secretAccessKey, sessionToken: section?.['aws_session_token'] };\n}\n\ninterface CredentialDocument {\n  AccessKeyId?: string;\n  SecretAccessKey?: string;\n  Token?: string;\n  Expiration?: string;\n}\n\nfunction fromDocument(raw: string): AwsCredentials | undefined {\n  const doc = JSON.parse(raw) as CredentialDocument;\n  if (!doc.AccessKeyId || !doc.SecretAccessKey) return undefined;\n  const expiresAt = doc.Expiration ? Date.parse(doc.Expiration) : Number.NaN;\n  return {\n    accessKeyId: doc.AccessKeyId,\n    secretAccessKey: doc.SecretAccessKey,\n    sessionToken: doc.Token,\n    expiresAt: Number.isNaN(expiresAt) ? undefined : expiresAt,\n  };\n}\n\nconst CONTAINER_HOSTS = new Set([\n  // eslint-disable-next-line sonarjs/no-hardcoded-ip -- fixed ECS credentials endpoint\n  '169.254.170.2',\n  // eslint-disable-next-line sonarjs/no-hardcoded-ip -- fixed EKS pod identity endpoint\n  '169.254.170.23',\n  '[fd00:ec2::23]',\n  'localhost',\n  '[::1]',\n]);\n\n/** Same rule as the AWS SDKs: never send the container token to an arbitrary http host. */\nfunction isAllowedContainerHost(url: URL): boolean {\n  if (url.protocol === 'https:') return true;\n  if (url.protocol !== 'http:') return false;\n  return CONTAINER_HOSTS.has(url.hostname) || /^127(?:\\.\\d{1,3}){3}$/.test(url.hostname);\n}\n\nasync function fromContainer(): Promise<AwsCredentials | undefined> {\n  const relative = process.env['AWS_CONTAINER_CREDENTIALS_RELATIVE_URI'];\n  const full = process.env['AWS_CONTAINER_CREDENTIALS_FULL_URI'];\n  if (!relative && !full) return undefined;\n  const url = new URL(relative ? `http://169.254.170.2${relative}` : (full as string));\n  if (!relative && !isAllowedContainerHost(url)) {\n    internalWarn(\n      `ignoring AWS_CONTAINER_CREDENTIALS_FULL_URI: ${url.host} is not https or a loopback / ECS / EKS address`\n    );\n    return undefined;\n  }\n  const headers: Record<string, string> = {};\n  const tokenFile = process.env['AWS_CONTAINER_AUTHORIZATION_TOKEN_FILE'];\n  const token = tokenFile\n    ? fs.readFileSync(tokenFile, 'utf8').trim()\n    : process.env['AWS_CONTAINER_AUTHORIZATION_TOKEN'];\n  if (token) headers['Authorization'] = token;\n  const res = await httpRequest({\n    url,\n    method: 'GET',\n    headers,\n    timeoutMs: METADATA_TIMEOUT_MS,\n    label: 'AWS container credentials',\n  });\n  return fromDocument(res.body);\n}\n\nasync function fromInstanceMetadata(): Promise<AwsCredentials | undefined> {\n  if (process.env['AWS_EC2_METADATA_DISABLED'] === 'true') return undefined;\n  const base = process.env['AWS_EC2_METADATA_SERVICE_ENDPOINT'] ?? 'http://169.254.169.254';\n  const get = (p: string, method: string, headers: Record<string, string>) =>\n    httpRequest({\n      url: new URL(p, base),\n      method,\n      headers,\n      timeoutMs: METADATA_TIMEOUT_MS,\n      label: 'EC2 instance metadata',\n    });\n  const session = await get('/latest/api/token', 'PUT', {\n    'X-aws-ec2-metadata-token-ttl-seconds': '21600',\n  });\n  const auth = { 'X-aws-ec2-metadata-token': session.body.trim() };\n  const roles = await get('/latest/meta-data/iam/security-credentials/', 'GET', auth);\n  const role = roles.body.split('\\n')[0]?.trim();\n  if (!role) return undefined;\n  const creds = await get(\n    `/latest/meta-data/iam/security-credentials/${encodeURIComponent(role)}`,\n    'GET',\n    auth\n  );\n  return fromDocument(creds.body);\n}\n\nexport class AwsCredentialProvider {\n  private cached: AwsCredentials | undefined;\n  private failedAt = 0;\n  private readonly explicit: AwsCredentials | undefined;\n\n  constructor(config: AwsCredentialConfig) {\n    protectSecrets(this, ['cached', 'explicit']);\n    if (config.accessKeyId && config.secretAccessKey) {\n      this.explicit = {\n        accessKeyId: config.accessKeyId,\n        secretAccessKey: config.secretAccessKey,\n        sessionToken: config.sessionToken,\n      };\n    }\n  }\n\n  /** Throws when no source yields credentials, so the caller keeps its buffer. */\n  async get(): Promise<AwsCredentials> {\n    if (this.explicit) return this.explicit;\n    const env = fromEnv();\n    if (env) return env;\n    if (this.cached && !this.isExpiring(this.cached)) return this.cached;\n    if (Date.now() - this.failedAt < FAILURE_BACKOFF_MS) {\n      throw new Error('no AWS credentials found (retrying shortly)');\n    }\n\n    let found = fromSharedFile();\n    for (const source of [fromContainer, fromInstanceMetadata]) {\n      if (found) break;\n      try {\n        found = await source();\n      } catch {\n        /* source not available here; try the next */\n      }\n    }\n    if (!found) {\n      this.failedAt = Date.now();\n      throw new Error(\n        'no AWS credentials found: set AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY, a shared credentials file, container credentials, or run on EC2 with an instance role'\n      );\n    }\n    this.cached = found;\n    return found;\n  }\n\n  /** Secret values this provider may hold, for scrubbing error text. */\n  secretValues(): (string | undefined)[] {\n    const env = process.env;\n    return [\n      this.explicit?.secretAccessKey,\n      this.explicit?.sessionToken,\n      this.cached?.secretAccessKey,\n      this.cached?.sessionToken,\n      env['AWS_SECRET_ACCESS_KEY'],\n      env['AWS_SESSION_TOKEN'],\n    ];\n  }\n\n  invalidate(): void {\n    this.cached = undefined;\n    this.failedAt = 0;\n  }\n\n  private isExpiring(c: AwsCredentials): boolean {\n    return c.expiresAt !== undefined && c.expiresAt - Date.now() < REFRESH_MARGIN_MS;\n  }\n}\n","/**\n * AWS Signature Version 4 request signing, dependency-free.\n */\n\nimport * as crypto from 'node:crypto';\n\nexport interface AwsCredentials {\n  accessKeyId: string;\n  secretAccessKey: string;\n  sessionToken?: string | undefined;\n  /** Epoch ms after which the credentials are no longer valid. */\n  expiresAt?: number | undefined;\n}\n\nexport interface SignV4Options {\n  method: string;\n  path: string;\n  query?: string;\n  /** Must include `host`. Names are lowercased before signing. */\n  headers: Record<string, string>;\n  body: string;\n  region: string;\n  service: string;\n  credentials: AwsCredentials;\n  date?: Date;\n}\n\nconst sha256Hex = (data: string): string => crypto.createHash('sha256').update(data).digest('hex');\n\nconst hmac = (key: Buffer | string, msg: string): Buffer =>\n  crypto.createHmac('sha256', key).update(msg).digest();\n\n/** Returns the request headers (lowercase names) with `x-amz-date` and `authorization` added. */\nexport function signV4(opts: SignV4Options): Record<string, string> {\n  const {\n    method,\n    path,\n    query = '',\n    body,\n    region,\n    service,\n    credentials,\n    headers: input,\n    date,\n  } = opts;\n  const amzDate = (date ?? new Date()).toISOString().replace(/[:-]|\\.\\d{3}/g, '');\n  const dateStamp = amzDate.slice(0, 8);\n\n  const headers: Record<string, string> = {};\n  for (const [k, v] of Object.entries(input)) headers[k.toLowerCase()] = v;\n  headers['x-amz-date'] = amzDate;\n  if (credentials.sessionToken) headers['x-amz-security-token'] = credentials.sessionToken;\n\n  const names = Object.keys(headers).sort();\n  const canonicalHeaders = names\n    .map((n) => `${n}:${headers[n]!.trim().replace(/\\s+/g, ' ')}\\n`)\n    .join('');\n  const signedHeaders = names.join(';');\n\n  const canonicalRequest = [\n    method,\n    path,\n    query,\n    canonicalHeaders,\n    signedHeaders,\n    sha256Hex(body),\n  ].join('\\n');\n  const scope = `${dateStamp}/${region}/${service}/aws4_request`;\n  const stringToSign = ['AWS4-HMAC-SHA256', amzDate, scope, sha256Hex(canonicalRequest)].join('\\n');\n\n  const signingKey = hmac(\n    hmac(hmac(hmac(`AWS4${credentials.secretAccessKey}`, dateStamp), region), service),\n    'aws4_request'\n  );\n  const signature = crypto.createHmac('sha256', signingKey).update(stringToSign).digest('hex');\n\n  headers['authorization'] =\n    `AWS4-HMAC-SHA256 Credential=${credentials.accessKeyId}/${scope}, ` +\n    `SignedHeaders=${signedHeaders}, Signature=${signature}`;\n  return headers;\n}\n","/**\n * logixia — AWS CloudWatch Logs transport\n *\n * Sends log entries to AWS CloudWatch Logs via the PutLogEvents API.\n * Supports EMF (Embedded Metric Format) for automatic metric extraction.\n *\n * Auth, in order: explicit config, environment variables, the shared\n * credentials file (AWS_PROFILE, AWS_SHARED_CREDENTIALS_FILE), ECS container\n * credentials, then EC2 instance metadata (IMDSv2). SSO, assume-role profiles\n * and credential_process are not supported. No SDK dependency — raw HTTPS with\n * AWS Signature Version 4.\n *\n * The log group and stream are created on first use if they do not exist.\n *\n * @example\n * ```ts\n * import { createLogger } from 'logixia';\n * import { CloudWatchTransport } from 'logixia/cloudwatch';\n *\n * const logger = createLogger({\n *   transports: {\n *     custom: [\n *       new CloudWatchTransport({\n *         region: 'us-east-1',\n *         logGroupName: '/myapp/production',\n *         logStreamName: `api-${process.env.HOSTNAME}`,\n *         batchSize: 100,\n *         flushIntervalMs: 5000,\n *       }),\n *     ],\n *   },\n * });\n * ```\n */\n\nimport type { IAsyncTransport, TransportLogEntry } from '../types/transport.types';\nimport { internalWarn } from '../utils/internal-log';\nimport { stringifyForLog } from '../utils/safe-stringify';\nimport { AwsCredentialProvider } from './aws-credentials';\nimport { signV4 } from './aws-sigv4';\nimport {\n  BatchBuffer,\n  DEFAULT_MAX_BUFFER_SIZE,\n  DEFAULT_REQUEST_TIMEOUT_MS,\n  HttpError,\n  httpRequest,\n  isPermanentHttpError,\n} from './batch-buffer';\nimport { mergeCoreFields } from './entry-fields';\nimport { protectSecrets, urlSecrets } from './secret-config';\n\nexport interface CloudWatchTransportConfig {\n  /** AWS region, e.g. `'us-east-1'`. Falls back to `AWS_REGION` env var. */\n  region?: string;\n  /** CloudWatch Logs group name. Created automatically if it does not exist. */\n  logGroupName: string;\n  /** CloudWatch Logs stream name. Defaults to hostname + process PID. */\n  logStreamName?: string;\n  /** Override the Logs endpoint, e.g. for LocalStack. Default: `https://logs.<region>.amazonaws.com`. */\n  endpoint?: string;\n  /** AWS access key ID. Falls back to the credential chain described above. */\n  accessKeyId?: string;\n  /** AWS secret access key. Used together with `accessKeyId`. */\n  secretAccessKey?: string;\n  /** AWS session token for temporary credentials. Used together with `accessKeyId`. */\n  sessionToken?: string;\n  /**\n   * Number of log events to batch before flushing.\n   * CloudWatch allows max 10,000 events per PutLogEvents call; larger values are capped.\n   * @default 100\n   */\n  batchSize?: number;\n  /**\n   * Max ms between flushes even if batchSize is not reached.\n   * @default 5000\n   */\n  flushIntervalMs?: number;\n  /**\n   * Enable EMF (Embedded Metric Format) — wraps log entries as CloudWatch\n   * metric namespaces so numeric fields become CloudWatch Metrics automatically.\n   * @default false\n   */\n  emf?: boolean;\n  /** CloudWatch Metrics namespace used by EMF. @default 'Logixia' */\n  emfNamespace?: string;\n  /**\n   * Payload fields published as EMF metrics. When set, only these numeric\n   * fields become metrics; when unset every numeric payload field does (up to\n   * the EMF limit of 100 per entry).\n   */\n  emfMetrics?: string[];\n  /** Abort a request that has not finished after this many ms. @default 10000 */\n  requestTimeoutMs?: number;\n  /** Max buffered events; the oldest are dropped past this. @default 10000 */\n  maxBufferSize?: number;\n  /** Minimum log level to forward. */\n  level?: string;\n}\n\nconst MAX_EVENTS_PER_PUT = 10_000;\nconst EMF_MAX_METRICS = 100;\n\n/** Error types worth retrying even though CloudWatch reports them as HTTP 400. */\nconst RETRYABLE_TYPES = new Set([\n  'ThrottlingException',\n  'ThrottledException',\n  'LimitExceededException',\n  'ServiceUnavailableException',\n  'ExpiredTokenException',\n  'ResourceNotFoundException',\n]);\n\nfunction awsErrorType(err: unknown): string | undefined {\n  if (!(err instanceof HttpError)) return undefined;\n  try {\n    const type = (JSON.parse(err.body) as { __type?: string }).__type;\n    return type?.split('#').pop();\n  } catch {\n    return undefined;\n  }\n}\n\ninterface CwLogEvent {\n  timestamp: number;\n  message: string;\n}\n\n/**\n * AWS CloudWatch Logs transport with EMF support and batched PutLogEvents calls.\n */\nexport class CloudWatchTransport implements IAsyncTransport {\n  public readonly name = 'cloudwatch';\n  public readonly batchSize: number;\n  public readonly flushInterval: number;\n  public readonly level: string | undefined;\n\n  private readonly buffer: BatchBuffer<CwLogEvent>;\n  private readonly requestTimeoutMs: number;\n  private flushTimer: NodeJS.Timeout | null = null;\n  private readonly credentials: AwsCredentialProvider;\n  private readonly endpoint: URL;\n  private streamReady = false;\n\n  private readonly region: string;\n  private readonly logGroupName: string;\n  private readonly logStreamName: string;\n  private readonly emf: boolean;\n  private readonly emfNamespace: string;\n  private readonly emfMetrics: ReadonlySet<string> | undefined;\n\n  constructor(config: CloudWatchTransportConfig) {\n    this.region =\n      config.region ??\n      process.env['AWS_REGION'] ??\n      process.env['AWS_DEFAULT_REGION'] ??\n      'us-east-1';\n    this.logGroupName = config.logGroupName;\n    this.logStreamName =\n      config.logStreamName ?? `${process.env['HOSTNAME'] ?? 'node'}-${process.pid}`;\n    this.credentials = new AwsCredentialProvider(config);\n    this.endpoint = new URL(config.endpoint ?? `https://logs.${this.region}.amazonaws.com`);\n    this.batchSize = Math.min(config.batchSize ?? 100, MAX_EVENTS_PER_PUT);\n    this.emfNamespace = config.emfNamespace ?? 'Logixia';\n    this.flushInterval = config.flushIntervalMs ?? 5000;\n    this.emf = config.emf ?? false;\n    this.emfMetrics = config.emfMetrics ? new Set(config.emfMetrics) : undefined;\n    this.level = config.level;\n    this.requestTimeoutMs = config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;\n    this.buffer = new BatchBuffer<CwLogEvent>({\n      name: 'CloudWatchTransport',\n      batchSize: this.batchSize,\n      maxBufferSize: config.maxBufferSize ?? DEFAULT_MAX_BUFFER_SIZE,\n      send: (events) => this.putLogEvents(events),\n      secrets: () => [...this.credentials.secretValues(), ...urlSecrets(this.endpoint)],\n      shouldRetry: (err) =>\n        !isPermanentHttpError(err) || RETRYABLE_TYPES.has(awsErrorType(err) ?? ''),\n    });\n\n    this.flushTimer = setInterval(() => {\n      this.flush().catch(() => {});\n    }, this.flushInterval);\n    if (this.flushTimer.unref) this.flushTimer.unref();\n    protectSecrets(this, ['credentials', 'endpoint']);\n  }\n\n  write(entry: TransportLogEntry): void {\n    const timestamp = entry.timestamp ? new Date(entry.timestamp).getTime() : Date.now();\n    const message = this.emf ? this.toEmf(entry) : stringifyForLog(entry);\n    this.buffer.push({ timestamp, message });\n    this.buffer.flushIfFull();\n  }\n\n  flush(): Promise<void> {\n    return this.buffer.flush();\n  }\n\n  /**\n   * Flush remaining events and stop the interval timer on shutdown. Without this\n   * the manager's close() skips the transport (close was undefined) and any\n   * buffered events were lost on deploy. Waits for any in-flight send first.\n   */\n  async close(): Promise<void> {\n    if (this.flushTimer) {\n      clearInterval(this.flushTimer);\n      this.flushTimer = null;\n    }\n    await this.buffer.close();\n  }\n\n  private toEmf(entry: TransportLogEntry): string {\n    const { level, message, data: payload, timestamp } = entry;\n    const fields = mergeCoreFields({ _aws: undefined, level, message }, payload);\n    const metricNames: string[] = [];\n    for (const [k, v] of Object.entries(fields)) {\n      if (k === '_aws' || k === 'level' || k === 'message' || typeof v !== 'number') continue;\n      if (this.emfMetrics && !this.emfMetrics.has(k)) continue;\n      if (metricNames.length < EMF_MAX_METRICS) metricNames.push(k);\n    }\n    fields['_aws'] = {\n      Timestamp: timestamp ? new Date(timestamp).getTime() : Date.now(),\n      CloudWatchMetrics:\n        metricNames.length > 0\n          ? [\n              {\n                Namespace: this.emfNamespace,\n                Dimensions: [['level']],\n                Metrics: metricNames.map((n) => ({ Name: n, Unit: 'None' })),\n              },\n            ]\n          : [],\n    };\n    return stringifyForLog(fields);\n  }\n\n  private async putLogEvents(events: CwLogEvent[]): Promise<void> {\n    await this.ensureStream();\n    const logEvents = [...events].sort((a, b) => a.timestamp - b.timestamp);\n    try {\n      await this.call('PutLogEvents', {\n        logGroupName: this.logGroupName,\n        logStreamName: this.logStreamName,\n        logEvents,\n      });\n    } catch (err) {\n      const type = awsErrorType(err);\n      if (type === 'DataAlreadyAcceptedException') return;\n      if (type === 'ResourceNotFoundException') this.streamReady = false;\n      if (type === 'ExpiredTokenException') this.credentials.invalidate();\n      throw err;\n    }\n  }\n\n  private async ensureStream(): Promise<void> {\n    if (this.streamReady) return;\n    try {\n      await this.call('CreateLogGroup', { logGroupName: this.logGroupName });\n    } catch (err) {\n      if (awsErrorType(err) === 'ExpiredTokenException') this.credentials.invalidate();\n      if (!(err instanceof HttpError)) throw err;\n      if (awsErrorType(err) !== 'ResourceAlreadyExistsException') {\n        internalWarn(`CloudWatchTransport: CreateLogGroup failed, continuing (${err.message})`);\n      }\n    }\n    try {\n      await this.call('CreateLogStream', {\n        logGroupName: this.logGroupName,\n        logStreamName: this.logStreamName,\n      });\n    } catch (err) {\n      if (awsErrorType(err) !== 'ResourceAlreadyExistsException') throw err;\n    }\n    this.streamReady = true;\n  }\n\n  private async call(action: string, payload: Record<string, unknown>): Promise<void> {\n    const credentials = await this.credentials.get();\n    const body = stringifyForLog(payload);\n    const { host } = this.endpoint;\n    const headers = signV4({\n      method: 'POST',\n      path: '/',\n      headers: {\n        host,\n        'content-type': 'application/x-amz-json-1.1',\n        'x-amz-target': `Logs_20140328.${action}`,\n      },\n      body,\n      region: this.region,\n      service: 'logs',\n      credentials,\n    });\n    await httpRequest({\n      url: this.endpoint,\n      headers,\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: `CloudWatch ${action}`,\n      secrets: () => [\n        ...this.credentials.secretValues(),\n        headers['authorization'],\n        headers['x-amz-security-token'],\n        ...urlSecrets(this.endpoint),\n      ],\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAiBA,MAAM,oBAAoB;AAC1B,MAAM,qBAAqB;AAC3B,MAAM,sBAAsB;;AAS5B,SAAgB,SAAS,MAAsD;CAC7E,MAAM,MAA8C,CAAC;CACrD,IAAI;CACJ,KAAK,MAAM,OAAO,KAAK,MAAM,OAAO,GAAG;EACrC,MAAM,OAAO,IAAI,KAAK;EACtB,IAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,KAAK,KAAK,WAAW,GAAG,GAAG;EAC3D,MAAM,SAAS,aAAa,KAAK,IAAI;EACrC,IAAI,QAAQ;GACV,UAAU,IAAI,OAAO,EAAE,CAAE,KAAK,KAAK,IAAI,OAAO,EAAE,CAAE,KAAK,MAAM,CAAC;GAC9D;EACF;EACA,MAAM,KAAK,KAAK,QAAQ,GAAG;EAC3B,IAAI,KAAK,KAAK,SAAS,QAAQ,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,KAAK,KAAK,MAAM,KAAK,CAAC,CAAC,CAAC,KAAK;CACrF;CACA,OAAO;AACT;AAEA,SAAS,UAAsC;CAC7C,MAAM,cAAc,QAAQ,IAAI;CAChC,MAAM,kBAAkB,QAAQ,IAAI;CACpC,IAAI,CAAC,eAAe,CAAC,iBAAiB,OAAO,KAAA;CAC7C,OAAO;EAAE;EAAa;EAAiB,cAAc,QAAQ,IAAI;CAAqB;AACxF;AAEA,SAAS,iBAA6C;CACpD,MAAM,OACJ,QAAQ,IAAI,kCAAkCA,OAAK,KAAK,GAAG,QAAQ,GAAG,QAAQ,aAAa;CAC7F,MAAM,UAAU,QAAQ,IAAI,kBAAkB;CAC9C,IAAI;CACJ,IAAI;EACF,OAAO,GAAG,aAAa,MAAM,MAAM;CACrC,QAAQ;EACN;CACF;CACA,MAAM,UAAU,SAAS,IAAI,CAAC,CAAC;CAC/B,MAAM,cAAA,YAAA,QAAA,YAAA,KAAA,IAAA,KAAA,IAAc,QAAU;CAC9B,MAAM,kBAAA,YAAA,QAAA,YAAA,KAAA,IAAA,KAAA,IAAkB,QAAU;CAClC,IAAI,CAAC,eAAe,CAAC,iBAAiB,OAAO,KAAA;CAC7C,OAAO;EAAE;EAAa;EAAiB,cAAA,YAAA,QAAA,YAAA,KAAA,IAAA,KAAA,IAAc,QAAU;CAAqB;AACtF;AASA,SAAS,aAAa,KAAyC;CAC7D,MAAM,MAAM,KAAK,MAAM,GAAG;CAC1B,IAAI,CAAC,IAAI,eAAe,CAAC,IAAI,iBAAiB,OAAO,KAAA;CACrD,MAAM,YAAY,IAAI,aAAa,KAAK,MAAM,IAAI,UAAU,IAAI;CAChE,OAAO;EACL,aAAa,IAAI;EACjB,iBAAiB,IAAI;EACrB,cAAc,IAAI;EAClB,WAAW,OAAO,MAAM,SAAS,IAAI,KAAA,IAAY;CACnD;AACF;AAEA,MAAM,kCAAkB,IAAI,IAAI;CAE9B;CAEA;CACA;CACA;CACA;AACF,CAAC;;AAGD,SAAS,uBAAuB,KAAmB;CACjD,IAAI,IAAI,aAAa,UAAU,OAAO;CACtC,IAAI,IAAI,aAAa,SAAS,OAAO;CACrC,OAAO,gBAAgB,IAAI,IAAI,QAAQ,KAAK,wBAAwB,KAAK,IAAI,QAAQ;AACvF;AAEA,eAAe,gBAAqD;CAClE,MAAM,WAAW,QAAQ,IAAI;CAC7B,MAAM,OAAO,QAAQ,IAAI;CACzB,IAAI,CAAC,YAAY,CAAC,MAAM,OAAO,KAAA;CAC/B,MAAM,MAAM,IAAI,IAAI,WAAW,uBAAuB,aAAc,IAAe;CACnF,IAAI,CAAC,YAAY,CAAC,uBAAuB,GAAG,GAAG;EAC7C,aACE,gDAAgD,IAAI,KAAK,gDAC3D;EACA;CACF;CACA,MAAM,UAAkC,CAAC;CACzC,MAAM,YAAY,QAAQ,IAAI;CAC9B,MAAM,QAAQ,YACV,GAAG,aAAa,WAAW,MAAM,CAAC,CAAC,KAAK,IACxC,QAAQ,IAAI;CAChB,IAAI,OAAO,QAAQ,mBAAmB;CAQtC,OAAO,cAAa,MAPF,YAAY;EAC5B;EACA,QAAQ;EACR;EACA,WAAW;EACX,OAAO;CACT,CAAC,EAAA,CACuB,IAAI;AAC9B;AAEA,eAAe,uBAA4D;;CACzE,IAAI,QAAQ,IAAI,iCAAiC,QAAQ,OAAO,KAAA;CAChE,MAAM,OAAO,QAAQ,IAAI,wCAAwC;CACjE,MAAM,OAAO,GAAW,QAAgB,YACtC,YAAY;EACV,KAAK,IAAI,IAAI,GAAG,IAAI;EACpB;EACA;EACA,WAAW;EACX,OAAO;CACT,CAAC;CAIH,MAAM,OAAO,EAAE,6BAA4B,MAHrB,IAAI,qBAAqB,OAAO,EACpD,wCAAwC,QAC1C,CAAC,EAAA,CACkD,KAAK,KAAK,EAAE;CAE/D,MAAM,QAAA,sBAAO,MADO,IAAI,+CAA+C,OAAO,IAAI,EAAA,CAC/D,KAAK,MAAM,IAAI,CAAC,CAAC,QAAA,QAAA,uBAAA,KAAA,IAAA,KAAA,IAAA,mBAAI,KAAK;CAC7C,IAAI,CAAC,MAAM,OAAO,KAAA;CAMlB,OAAO,cAAa,MALA,IAClB,8CAA8C,mBAAmB,IAAI,KACrE,OACA,IACF,EAAA,CAC0B,IAAI;AAChC;AAEA,IAAa,wBAAb,MAAmC;CACjC;CACA,WAAmB;CACnB;CAEA,YAAY,QAA6B;EACvC,eAAe,MAAM,CAAC,UAAU,UAAU,CAAC;EAC3C,IAAI,OAAO,eAAe,OAAO,iBAC/B,KAAK,WAAW;GACd,aAAa,OAAO;GACpB,iBAAiB,OAAO;GACxB,cAAc,OAAO;EACvB;CAEJ;;CAGA,MAAM,MAA+B;EACnC,IAAI,KAAK,UAAU,OAAO,KAAK;EAC/B,MAAM,MAAM,QAAQ;EACpB,IAAI,KAAK,OAAO;EAChB,IAAI,KAAK,UAAU,CAAC,KAAK,WAAW,KAAK,MAAM,GAAG,OAAO,KAAK;EAC9D,IAAI,KAAK,IAAI,IAAI,KAAK,WAAW,oBAC/B,MAAM,IAAI,MAAM,6CAA6C;EAG/D,IAAI,QAAQ,eAAe;EAC3B,KAAK,MAAM,UAAU,CAAC,eAAe,oBAAoB,GAAG;GAC1D,IAAI,OAAO;GACX,IAAI;IACF,QAAQ,MAAM,OAAO;GACvB,QAAQ,CAER;EACF;EACA,IAAI,CAAC,OAAO;GACV,KAAK,WAAW,KAAK,IAAI;GACzB,MAAM,IAAI,MACR,8JACF;EACF;EACA,KAAK,SAAS;EACd,OAAO;CACT;;CAGA,eAAuC;;EACrC,MAAM,MAAM,QAAQ;EACpB,OAAO;IACL,iBAAA,KAAK,cAAA,QAAA,mBAAA,KAAA,IAAA,KAAA,IAAA,eAAU;IACf,kBAAA,KAAK,cAAA,QAAA,oBAAA,KAAA,IAAA,KAAA,IAAA,gBAAU;IACf,eAAA,KAAK,YAAA,QAAA,iBAAA,KAAA,IAAA,KAAA,IAAA,aAAQ;IACb,gBAAA,KAAK,YAAA,QAAA,kBAAA,KAAA,IAAA,KAAA,IAAA,cAAQ;GACb,IAAI;GACJ,IAAI;EACN;CACF;CAEA,aAAmB;EACjB,KAAK,SAAS,KAAA;EACd,KAAK,WAAW;CAClB;CAEA,WAAmB,GAA4B;EAC7C,OAAO,EAAE,cAAc,KAAA,KAAa,EAAE,YAAY,KAAK,IAAI,IAAI;CACjE;AACF;;;;;ACrMA,MAAM,aAAa,SAAyB,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK;AAEjG,MAAM,QAAQ,KAAsB,QAClC,OAAO,WAAW,UAAU,GAAG,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO;;AAGtD,SAAgB,OAAO,MAA6C;CAClE,MAAM,EACJ,QACA,MACA,QAAQ,IACR,MACA,QACA,SACA,aACA,SAAS,OACT,SACE;CACJ,MAAM,WAAW,wBAAQ,IAAI,KAAK,EAAA,CAAG,YAAY,CAAC,CAAC,QAAQ,iBAAiB,EAAE;CAC9E,MAAM,YAAY,QAAQ,MAAM,GAAG,CAAC;CAEpC,MAAM,UAAkC,CAAC;CACzC,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,KAAK,GAAG,QAAQ,EAAE,YAAY,KAAK;CACvE,QAAQ,gBAAgB;CACxB,IAAI,YAAY,cAAc,QAAQ,0BAA0B,YAAY;CAE5E,MAAM,QAAQ,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK;CACxC,MAAM,mBAAmB,MACtB,KAAK,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAE,KAAK,CAAC,CAAC,QAAQ,QAAQ,GAAG,EAAE,GAAG,CAAC,CAC/D,KAAK,EAAE;CACV,MAAM,gBAAgB,MAAM,KAAK,GAAG;CAEpC,MAAM,mBAAmB;EACvB;EACA;EACA;EACA;EACA;EACA,UAAU,IAAI;CAChB,CAAC,CAAC,KAAK,IAAI;CACX,MAAM,QAAQ,GAAG,UAAU,GAAG,OAAO,GAAG,QAAQ;CAChD,MAAM,eAAe;EAAC;EAAoB;EAAS;EAAO,UAAU,gBAAgB;CAAC,CAAC,CAAC,KAAK,IAAI;CAEhG,MAAM,aAAa,KACjB,KAAK,KAAK,KAAK,OAAO,YAAY,mBAAmB,SAAS,GAAG,MAAM,GAAG,OAAO,GACjF,cACF;CACA,MAAM,YAAY,OAAO,WAAW,UAAU,UAAU,CAAC,CAAC,OAAO,YAAY,CAAC,CAAC,OAAO,KAAK;CAE3F,QAAQ,mBACN,+BAA+B,YAAY,YAAY,GAAG,MAAM,kBAC/C,cAAc,cAAc;CAC/C,OAAO;AACT;;ACmBA,MAAM,qBAAqB;AAC3B,MAAM,kBAAkB;;AAGxB,MAAM,kCAAkB,IAAI,IAAI;CAC9B;CACA;CACA;CACA;CACA;CACA;AACF,CAAC;AAED,SAAS,aAAa,KAAkC;CACtD,IAAI,EAAE,eAAe,YAAY,OAAO,KAAA;CACxC,IAAI;EACF,MAAM,OAAQ,KAAK,MAAM,IAAI,IAAI,CAAC,CAAyB;EAC3D,OAAA,SAAA,QAAA,SAAA,KAAA,IAAA,KAAA,IAAO,KAAM,MAAM,GAAG,CAAC,CAAC,IAAI;CAC9B,QAAQ;EACN;CACF;AACF;;;;AAUA,IAAa,sBAAb,MAA4D;CAC1D,OAAuB;CACvB;CACA;CACA;CAEA;CACA;CACA,aAA4C;CAC5C;CACA;CACA,cAAsB;CAEtB;CACA;CACA;CACA;CACA;CACA;CAEA,YAAY,QAAmC;EAC7C,KAAK,SACH,OAAO,UACP,QAAQ,IAAI,iBACZ,QAAQ,IAAI,yBACZ;EACF,KAAK,eAAe,OAAO;EAC3B,KAAK,gBACH,OAAO,iBAAiB,GAAG,QAAQ,IAAI,eAAe,OAAO,GAAG,QAAQ;EAC1E,KAAK,cAAc,IAAI,sBAAsB,MAAM;EACnD,KAAK,WAAW,IAAI,IAAI,OAAO,YAAY,gBAAgB,KAAK,OAAO,eAAe;EACtF,KAAK,YAAY,KAAK,IAAI,OAAO,aAAa,KAAK,kBAAkB;EACrE,KAAK,eAAe,OAAO,gBAAgB;EAC3C,KAAK,gBAAgB,OAAO,mBAAmB;EAC/C,KAAK,MAAM,OAAO,OAAO;EACzB,KAAK,aAAa,OAAO,aAAa,IAAI,IAAI,OAAO,UAAU,IAAI,KAAA;EACnE,KAAK,QAAQ,OAAO;EACpB,KAAK,mBAAmB,OAAO,oBAAA;EAC/B,KAAK,SAAS,IAAI,YAAwB;GACxC,MAAM;GACN,WAAW,KAAK;GAChB,eAAe,OAAO,iBAAA;GACtB,OAAO,WAAW,KAAK,aAAa,MAAM;GAC1C,eAAe,CAAC,GAAG,KAAK,YAAY,aAAa,GAAG,GAAG,WAAW,KAAK,QAAQ,CAAC;GAChF,cAAc,QACZ,CAAC,qBAAqB,GAAG,KAAK,gBAAgB,IAAI,aAAa,GAAG,KAAK,EAAE;EAC7E,CAAC;EAED,KAAK,aAAa,kBAAkB;GAClC,KAAK,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;EAC7B,GAAG,KAAK,aAAa;EACrB,IAAI,KAAK,WAAW,OAAO,KAAK,WAAW,MAAM;EACjD,eAAe,MAAM,CAAC,eAAe,UAAU,CAAC;CAClD;CAEA,MAAM,OAAgC;EACpC,MAAM,YAAY,MAAM,YAAY,IAAI,KAAK,MAAM,SAAS,CAAC,CAAC,QAAQ,IAAI,KAAK,IAAI;EACnF,MAAM,UAAU,KAAK,MAAM,KAAK,MAAM,KAAK,IAAI,gBAAgB,KAAK;EACpE,KAAK,OAAO,KAAK;GAAE;GAAW;EAAQ,CAAC;EACvC,KAAK,OAAO,YAAY;CAC1B;CAEA,QAAuB;EACrB,OAAO,KAAK,OAAO,MAAM;CAC3B;;;;;;CAOA,MAAM,QAAuB;EAC3B,IAAI,KAAK,YAAY;GACnB,cAAc,KAAK,UAAU;GAC7B,KAAK,aAAa;EACpB;EACA,MAAM,KAAK,OAAO,MAAM;CAC1B;CAEA,MAAc,OAAkC;EAC9C,MAAM,EAAE,OAAO,SAAS,MAAM,SAAS,cAAc;EACrD,MAAM,SAAS,gBAAgB;GAAE,MAAM,KAAA;GAAW;GAAO;EAAQ,GAAG,OAAO;EAC3E,MAAM,cAAwB,CAAC;EAC/B,KAAK,MAAM,CAAC,GAAG,MAAM,OAAO,QAAQ,MAAM,GAAG;GAC3C,IAAI,MAAM,UAAU,MAAM,WAAW,MAAM,aAAa,OAAO,MAAM,UAAU;GAC/E,IAAI,KAAK,cAAc,CAAC,KAAK,WAAW,IAAI,CAAC,GAAG;GAChD,IAAI,YAAY,SAAS,iBAAiB,YAAY,KAAK,CAAC;EAC9D;EACA,OAAO,UAAU;GACf,WAAW,YAAY,IAAI,KAAK,SAAS,CAAC,CAAC,QAAQ,IAAI,KAAK,IAAI;GAChE,mBACE,YAAY,SAAS,IACjB,CACE;IACE,WAAW,KAAK;IAChB,YAAY,CAAC,CAAC,OAAO,CAAC;IACtB,SAAS,YAAY,KAAK,OAAO;KAAE,MAAM;KAAG,MAAM;IAAO,EAAE;GAC7D,CACF,IACA,CAAC;EACT;EACA,OAAO,gBAAgB,MAAM;CAC/B;CAEA,MAAc,aAAa,QAAqC;EAC9D,MAAM,KAAK,aAAa;EACxB,MAAM,YAAY,CAAC,GAAG,MAAM,CAAC,CAAC,MAAM,GAAG,MAAM,EAAE,YAAY,EAAE,SAAS;EACtE,IAAI;GACF,MAAM,KAAK,KAAK,gBAAgB;IAC9B,cAAc,KAAK;IACnB,eAAe,KAAK;IACpB;GACF,CAAC;EACH,SAAS,KAAK;GACZ,MAAM,OAAO,aAAa,GAAG;GAC7B,IAAI,SAAS,gCAAgC;GAC7C,IAAI,SAAS,6BAA6B,KAAK,cAAc;GAC7D,IAAI,SAAS,yBAAyB,KAAK,YAAY,WAAW;GAClE,MAAM;EACR;CACF;CAEA,MAAc,eAA8B;EAC1C,IAAI,KAAK,aAAa;EACtB,IAAI;GACF,MAAM,KAAK,KAAK,kBAAkB,EAAE,cAAc,KAAK,aAAa,CAAC;EACvE,SAAS,KAAK;GACZ,IAAI,aAAa,GAAG,MAAM,yBAAyB,KAAK,YAAY,WAAW;GAC/E,IAAI,EAAE,eAAe,YAAY,MAAM;GACvC,IAAI,aAAa,GAAG,MAAM,kCACxB,aAAa,2DAA2D,IAAI,QAAQ,EAAE;EAE1F;EACA,IAAI;GACF,MAAM,KAAK,KAAK,mBAAmB;IACjC,cAAc,KAAK;IACnB,eAAe,KAAK;GACtB,CAAC;EACH,SAAS,KAAK;GACZ,IAAI,aAAa,GAAG,MAAM,kCAAkC,MAAM;EACpE;EACA,KAAK,cAAc;CACrB;CAEA,MAAc,KAAK,QAAgB,SAAiD;EAClF,MAAM,cAAc,MAAM,KAAK,YAAY,IAAI;EAC/C,MAAM,OAAO,gBAAgB,OAAO;EACpC,MAAM,EAAE,SAAS,KAAK;EACtB,MAAM,UAAU,OAAO;GACrB,QAAQ;GACR,MAAM;GACN,SAAS;IACP;IACA,gBAAgB;IAChB,gBAAgB,iBAAiB;GACnC;GACA;GACA,QAAQ,KAAK;GACb,SAAS;GACT;EACF,CAAC;EACD,MAAM,YAAY;GAChB,KAAK,KAAK;GACV;GACA;GACA,WAAW,KAAK;GAChB,OAAO,cAAc;GACrB,eAAe;IACb,GAAG,KAAK,YAAY,aAAa;IACjC,QAAQ;IACR,QAAQ;IACR,GAAG,WAAW,KAAK,QAAQ;GAC7B;EACF,CAAC;CACH;AACF"}

package/dist/gcp.js

@@ -1,3 +1,3 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_gcp_transport = require("./gcp.transport-V9R4dwdT.js");
+const require_gcp_transport = require("./gcp.transport-BvKR7MIz.js");
 exports.GCPTransport = require_gcp_transport.GCPTransport;

package/dist/gcp.mjs

@@ -1 +1 @@
-export { t as GCPTransport } from "./gcp.transport-BY1Z3cS0.mjs";
+export { t as GCPTransport } from "./gcp.transport-BqzWORwO.mjs";

package/dist/{gcp.transport-BY1Z3cS0.mjs → gcp.transport-BqzWORwO.mjs}

@@ -1,9 +1,9 @@
 import { t as __require } from "./rolldown-runtime-D3PmRqjj.mjs";
-import { n as protectSecrets } from "./secret-config-Cng7XPLx.mjs";
+import { n as protectSecrets } from "./secret-config-BFKJrSYF.mjs";
 import { t as internalError } from "./internal-log-Cy5nF1ZL.mjs";
 import { i as stringifyForLog } from "./safe-stringify-B5p5ktFe.mjs";
 import { t as mergeCoreFields } from "./entry-fields-J1OBi24o.mjs";
-import { a as httpRequest, t as BatchBuffer } from "./batch-buffer-BnmVCCwI.mjs";
+import { a as httpRequest, t as BatchBuffer } from "./batch-buffer-CcubZ2cW.mjs";
 import * as https from "node:https";
 // src/transports/gcp.transport.ts
 /**
@@ -241,4 +241,4 @@ var GCPTransport = class {
 };
 export { GCPTransport as t };
 
-//# sourceMappingURL=gcp.transport-BY1Z3cS0.mjs.map
+//# sourceMappingURL=gcp.transport-BqzWORwO.mjs.map

package/dist/{gcp.transport-BY1Z3cS0.mjs.map → gcp.transport-BqzWORwO.mjs.map}

@@ -1 +1 @@
-{"version":3,"file":"gcp.transport-BY1Z3cS0.mjs","names":[],"sources":["../src/transports/gcp.transport.ts"],"sourcesContent":["/**\n * logixia — Google Cloud Logging (Stackdriver) transport\n *\n * Maps logixia log entries to the GCP Logging REST API format:\n *   - Maps `level` → `severity` (INFO, WARNING, ERROR, CRITICAL…)\n *   - Injects `logging.googleapis.com/trace` for Cloud Trace correlation\n *   - Sets `traceSampled: true` whenever a trace id is present\n *     (`logging.googleapis.com/spanId` and `sourceLocation` are not populated)\n *   - Supports structured `jsonPayload` and plain `textPayload`\n *\n * Auth: the metadata server on GCE/GKE/Cloud Run, or a service-account key passed\n * as `credentials`. The `GOOGLE_APPLICATION_CREDENTIALS` key-file variable is not\n * read; full ADC is not supported.\n *\n * @example\n * ```ts\n * import { createLogger } from 'logixia';\n * import { GCPTransport } from 'logixia/gcp';\n *\n * const logger = createLogger({\n *   transports: {\n *     custom: [\n *       new GCPTransport({\n *         projectId: process.env.GOOGLE_CLOUD_PROJECT,\n *         logName: 'projects/my-project/logs/api',\n *         resource: { type: 'gce_instance', labels: { instance_id: '123' } },\n *       }),\n *     ],\n *   },\n * });\n * ```\n */\n\nimport * as https from 'node:https';\n\nimport type { IAsyncTransport, TransportLogEntry } from '../types/transport.types';\nimport { internalError } from '../utils/internal-log';\nimport { stringifyForLog } from '../utils/safe-stringify';\nimport {\n  BatchBuffer,\n  DEFAULT_MAX_BUFFER_SIZE,\n  DEFAULT_REQUEST_TIMEOUT_MS,\n  httpRequest,\n} from './batch-buffer';\nimport { mergeCoreFields } from './entry-fields';\nimport { protectSecrets } from './secret-config';\n\nexport interface GCPMonitoredResource {\n  type: string;\n  labels?: Record<string, string>;\n}\n\nexport interface GCPTransportConfig {\n  /** GCP project ID. Falls back to `GOOGLE_CLOUD_PROJECT` or `GCLOUD_PROJECT` env vars. */\n  projectId?: string;\n  /**\n   * Full log name, e.g. `'projects/my-project/logs/api'`.\n   * If omitted, defaults to `projects/{projectId}/logs/logixia`.\n   */\n  logName?: string;\n  /** Monitored resource descriptor. Defaults to `global`. */\n  resource?: GCPMonitoredResource;\n  /**\n   * Service account key JSON (parsed). If omitted, only the metadata server\n   * (GCE/GKE/Cloud Run) is tried; the key-file env var is not read.\n   */\n  credentials?: {\n    client_email: string;\n    private_key: string;\n  };\n  /** Number of entries to batch. @default 200 */\n  batchSize?: number;\n  /** Flush interval in ms. @default 5000 */\n  flushIntervalMs?: number;\n  /** Abort a request that has not finished after this many ms. @default 10000 */\n  requestTimeoutMs?: number;\n  /** Max buffered entries; the oldest are dropped past this. @default 10000 */\n  maxBufferSize?: number;\n  level?: string;\n}\n\ntype GcpSeverity =\n  | 'DEFAULT'\n  | 'DEBUG'\n  | 'INFO'\n  | 'NOTICE'\n  | 'WARNING'\n  | 'ERROR'\n  | 'CRITICAL'\n  | 'ALERT'\n  | 'EMERGENCY';\n\nfunction toGcpSeverity(level: string): GcpSeverity {\n  switch (level.toLowerCase()) {\n    case 'trace':\n    case 'verbose':\n    case 'debug':\n      return 'DEBUG';\n    case 'info':\n    case 'log':\n      return 'INFO';\n    case 'warn':\n    case 'warning':\n      return 'WARNING';\n    case 'error':\n      return 'ERROR';\n    case 'critical':\n    case 'fatal':\n      return 'CRITICAL';\n    default:\n      return 'DEFAULT';\n  }\n}\n\n/**\n * Google Cloud Logging transport with trace correlation and GCP severity mapping.\n */\nexport class GCPTransport implements IAsyncTransport {\n  public readonly name = 'gcp';\n  public readonly batchSize: number;\n  public readonly flushInterval: number;\n  public readonly level: string | undefined;\n\n  private readonly buffer: BatchBuffer<TransportLogEntry>;\n  private readonly requestTimeoutMs: number;\n  private flushTimer: NodeJS.Timeout | null = null;\n  private accessToken: string | null = null;\n  private tokenExpiry = 0;\n\n  private readonly projectId: string;\n  private readonly logName: string;\n  private readonly resource: GCPMonitoredResource;\n  private readonly credentials: { client_email: string; private_key: string } | undefined;\n\n  constructor(config: GCPTransportConfig) {\n    protectSecrets(this, ['credentials', 'accessToken']);\n    this.projectId =\n      config.projectId ??\n      process.env['GOOGLE_CLOUD_PROJECT'] ??\n      process.env['GCLOUD_PROJECT'] ??\n      'unknown-project';\n    this.logName = config.logName ?? `projects/${this.projectId}/logs/logixia`;\n    this.resource = config.resource ?? { type: 'global' };\n    this.credentials = config.credentials;\n    this.batchSize = config.batchSize ?? 200;\n    this.flushInterval = config.flushIntervalMs ?? 5000;\n    this.level = config.level;\n    this.requestTimeoutMs = config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;\n    this.buffer = new BatchBuffer<TransportLogEntry>({\n      name: 'GCPTransport',\n      batchSize: this.batchSize,\n      maxBufferSize: config.maxBufferSize ?? DEFAULT_MAX_BUFFER_SIZE,\n      send: (entries) => this.writeEntries(entries),\n      secrets: () => this.secretValues(),\n    });\n\n    this.flushTimer = setInterval(() => {\n      this.flush().catch(() => {});\n    }, this.flushInterval);\n    if (this.flushTimer.unref) this.flushTimer.unref();\n  }\n\n  write(entry: TransportLogEntry): void {\n    this.buffer.push(entry);\n    this.buffer.flushIfFull();\n  }\n\n  flush(): Promise<void> {\n    return this.buffer.flush();\n  }\n\n  /**\n   * Flush remaining entries and stop the interval timer on shutdown. Without\n   * this the manager's close() skipped the transport (close was undefined) and\n   * buffered entries were lost on deploy. Waits for any in-flight send first.\n   */\n  async close(): Promise<void> {\n    if (this.flushTimer) {\n      clearInterval(this.flushTimer);\n      this.flushTimer = null;\n    }\n    await this.buffer.close();\n  }\n\n  private buildLogEntry(entry: TransportLogEntry): Record<string, unknown> {\n    const gcpEntry: Record<string, unknown> = {\n      logName: this.logName,\n      resource: this.resource,\n      severity: toGcpSeverity(entry.level),\n      timestamp: entry.timestamp ?? new Date().toISOString(),\n      jsonPayload: mergeCoreFields(\n        { message: entry.message, appName: entry.appName, context: entry.context },\n        entry.data\n      ),\n    };\n\n    // GCP Cloud Trace correlation\n    if (entry.traceId) {\n      gcpEntry['trace'] = `projects/${this.projectId}/traces/${entry.traceId}`;\n      gcpEntry['traceSampled'] = true;\n    }\n\n    return gcpEntry;\n  }\n\n  private async getAccessToken(): Promise<string | null> {\n    if (this.accessToken && Date.now() < this.tokenExpiry) return this.accessToken;\n\n    // Try ADC metadata server (GCE/GKE/Cloud Run)\n    try {\n      const token = await this.fetchFromMetadataServer();\n      if (token) {\n        this.accessToken = token;\n        this.tokenExpiry = Date.now() + 55 * 60 * 1000; // 55 minutes\n        return this.accessToken;\n      }\n    } catch {\n      /* fall through to service account */\n    }\n\n    // Try service account key\n    if (this.credentials) {\n      try {\n        const token = await this.fetchServiceAccountToken();\n        if (token) {\n          this.accessToken = token;\n          this.tokenExpiry = Date.now() + 55 * 60 * 1000;\n          return this.accessToken;\n        }\n      } catch (err) {\n        internalError('GCPTransport service account token error', err);\n      }\n    }\n\n    return null;\n  }\n\n  private fetchFromMetadataServer(): Promise<string | null> {\n    return new Promise((resolve, reject) => {\n      const req = https.request(\n        {\n          hostname: 'metadata.google.internal',\n          path: '/computeMetadata/v1/instance/service-accounts/default/token',\n          headers: { 'Metadata-Flavor': 'Google' },\n          timeout: 3000,\n        },\n        (res) => {\n          let raw = '';\n          res.on('data', (c: Buffer) => (raw += c.toString()));\n          res.on('end', () => {\n            if (res.statusCode === 200) {\n              try {\n                const parsed = JSON.parse(raw) as { access_token?: string };\n                resolve(parsed.access_token ?? null);\n              } catch {\n                resolve(null);\n              }\n            } else {\n              resolve(null);\n            }\n          });\n        }\n      );\n      req.on('error', reject);\n      req.on('timeout', () => {\n        req.destroy();\n        reject(new Error('metadata timeout'));\n      });\n      req.end();\n    });\n  }\n\n  private fetchServiceAccountToken(): Promise<string | null> {\n    // Minimal JWT creation for service account — only for environments without\n    // the full Google Auth Library. For production workloads, prefer ADC.\n    if (!this.credentials) return Promise.resolve(null);\n\n    const iat = Math.floor(Date.now() / 1000);\n    const exp = iat + 3600;\n    const scope = 'https://www.googleapis.com/auth/logging.write';\n\n    const header = Buffer.from(JSON.stringify({ alg: 'RS256', typ: 'JWT' })).toString('base64url');\n    const payload = Buffer.from(\n      JSON.stringify({\n        iss: this.credentials.client_email,\n        scope,\n        aud: 'https://oauth2.googleapis.com/token',\n        exp,\n        iat,\n      })\n    ).toString('base64url');\n\n    const signingInput = `${header}.${payload}`;\n\n    let signature: string;\n    try {\n      // eslint-disable-next-line @typescript-eslint/no-require-imports\n      const sign = require('node:crypto').createSign('RSA-SHA256');\n      sign.update(signingInput);\n      signature = sign.sign(this.credentials.private_key, 'base64url') as string;\n    } catch {\n      return Promise.resolve(null);\n    }\n\n    const jwt = `${signingInput}.${signature}`;\n    const body = `grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=${jwt}`;\n\n    return httpRequest({\n      url: new URL('https://oauth2.googleapis.com/token'),\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: 'GCP token request',\n    }).then(\n      (res) => (JSON.parse(res.body) as { access_token?: string }).access_token ?? null,\n      () => null\n    );\n  }\n\n  private secretValues(token?: string): (string | undefined)[] {\n    return [\n      ...(this.credentials?.private_key.split('\\n') ?? []),\n      this.credentials?.private_key,\n      this.accessToken ?? undefined,\n      token,\n    ];\n  }\n\n  private async writeEntries(entries: TransportLogEntry[]): Promise<void> {\n    const token = await this.getAccessToken();\n    if (!token) {\n      throw new Error('GCPTransport: no access token available');\n    }\n\n    const body = stringifyForLog({\n      logName: this.logName,\n      resource: this.resource,\n      entries: entries.map((e) => this.buildLogEntry(e)),\n    });\n\n    await httpRequest({\n      url: new URL('https://logging.googleapis.com/v2/entries:write'),\n      headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: 'GCP Logging API',\n      secrets: () => this.secretValues(token),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4FA,SAAS,cAAc,OAA4B;CACjD,QAAQ,MAAM,YAAY,GAA1B;EACE,KAAK;EACL,KAAK;EACL,KAAK,SACH,OAAO;EACT,KAAK;EACL,KAAK,OACH,OAAO;EACT,KAAK;EACL,KAAK,WACH,OAAO;EACT,KAAK,SACH,OAAO;EACT,KAAK;EACL,KAAK,SACH,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;AAKA,IAAa,eAAb,MAAqD;CACnD,OAAuB;CACvB;CACA;CACA;CAEA;CACA;CACA,aAA4C;CAC5C,cAAqC;CACrC,cAAsB;CAEtB;CACA;CACA;CACA;CAEA,YAAY,QAA4B;EACtC,eAAe,MAAM,CAAC,eAAe,aAAa,CAAC;EACnD,KAAK,YACH,OAAO,aACP,QAAQ,IAAI,2BACZ,QAAQ,IAAI,qBACZ;EACF,KAAK,UAAU,OAAO,WAAW,YAAY,KAAK,UAAU;EAC5D,KAAK,WAAW,OAAO,YAAY,EAAE,MAAM,SAAS;EACpD,KAAK,cAAc,OAAO;EAC1B,KAAK,YAAY,OAAO,aAAa;EACrC,KAAK,gBAAgB,OAAO,mBAAmB;EAC/C,KAAK,QAAQ,OAAO;EACpB,KAAK,mBAAmB,OAAO,oBAAA;EAC/B,KAAK,SAAS,IAAI,YAA+B;GAC/C,MAAM;GACN,WAAW,KAAK;GAChB,eAAe,OAAO,iBAAA;GACtB,OAAO,YAAY,KAAK,aAAa,OAAO;GAC5C,eAAe,KAAK,aAAa;EACnC,CAAC;EAED,KAAK,aAAa,kBAAkB;GAClC,KAAK,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;EAC7B,GAAG,KAAK,aAAa;EACrB,IAAI,KAAK,WAAW,OAAO,KAAK,WAAW,MAAM;CACnD;CAEA,MAAM,OAAgC;EACpC,KAAK,OAAO,KAAK,KAAK;EACtB,KAAK,OAAO,YAAY;CAC1B;CAEA,QAAuB;EACrB,OAAO,KAAK,OAAO,MAAM;CAC3B;;;;;;CAOA,MAAM,QAAuB;EAC3B,IAAI,KAAK,YAAY;GACnB,cAAc,KAAK,UAAU;GAC7B,KAAK,aAAa;EACpB;EACA,MAAM,KAAK,OAAO,MAAM;CAC1B;CAEA,cAAsB,OAAmD;EACvE,MAAM,WAAoC;GACxC,SAAS,KAAK;GACd,UAAU,KAAK;GACf,UAAU,cAAc,MAAM,KAAK;GACnC,WAAW,MAAM,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;GACrD,aAAa,gBACX;IAAE,SAAS,MAAM;IAAS,SAAS,MAAM;IAAS,SAAS,MAAM;GAAQ,GACzE,MAAM,IACR;EACF;EAGA,IAAI,MAAM,SAAS;GACjB,SAAS,WAAW,YAAY,KAAK,UAAU,UAAU,MAAM;GAC/D,SAAS,kBAAkB;EAC7B;EAEA,OAAO;CACT;CAEA,MAAc,iBAAyC;EACrD,IAAI,KAAK,eAAe,KAAK,IAAI,IAAI,KAAK,aAAa,OAAO,KAAK;EAGnE,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,wBAAwB;GACjD,IAAI,OAAO;IACT,KAAK,cAAc;IACnB,KAAK,cAAc,KAAK,IAAI,IAAI;IAChC,OAAO,KAAK;GACd;EACF,QAAQ,CAER;EAGA,IAAI,KAAK,aACP,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,yBAAyB;GAClD,IAAI,OAAO;IACT,KAAK,cAAc;IACnB,KAAK,cAAc,KAAK,IAAI,IAAI;IAChC,OAAO,KAAK;GACd;EACF,SAAS,KAAK;GACZ,cAAc,4CAA4C,GAAG;EAC/D;EAGF,OAAO;CACT;CAEA,0BAA0D;EACxD,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,MAAM,MAAM,MAAM,QAChB;IACE,UAAU;IACV,MAAM;IACN,SAAS,EAAE,mBAAmB,SAAS;IACvC,SAAS;GACX,IACC,QAAQ;IACP,IAAI,MAAM;IACV,IAAI,GAAG,SAAS,MAAe,OAAO,EAAE,SAAS,CAAE;IACnD,IAAI,GAAG,aAAa;KAClB,IAAI,IAAI,eAAe,KACrB,IAAI;MAEF,QADe,KAAK,MAAM,GACb,CAAC,CAAC,gBAAgB,IAAI;KACrC,QAAQ;MACN,QAAQ,IAAI;KACd;UAEA,QAAQ,IAAI;IAEhB,CAAC;GACH,CACF;GACA,IAAI,GAAG,SAAS,MAAM;GACtB,IAAI,GAAG,iBAAiB;IACtB,IAAI,QAAQ;IACZ,uBAAO,IAAI,MAAM,kBAAkB,CAAC;GACtC,CAAC;GACD,IAAI,IAAI;EACV,CAAC;CACH;CAEA,2BAA2D;EAGzD,IAAI,CAAC,KAAK,aAAa,OAAO,QAAQ,QAAQ,IAAI;EAElD,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC,MAAM,MAAM,MAAM;EAclB,MAAM,eAAe,GAXN,OAAO,KAAK,KAAK,UAAU;GAAE,KAAK;GAAS,KAAK;EAAM,CAAC,CAAC,CAAC,CAAC,SAAS,WAWrD,EAAE,GAVf,OAAO,KACrB,KAAK,UAAU;GACb,KAAK,KAAK,YAAY;GACtB,OAAA;GACA,KAAK;GACL;GACA;EACF,CAAC,CACH,CAAC,CAAC,SAAS,WAE6B;EAExC,IAAI;EACJ,IAAI;GAEF,MAAM,OAAA,UAAe,aAAa,CAAC,CAAC,WAAW,YAAY;GAC3D,KAAK,OAAO,YAAY;GACxB,YAAY,KAAK,KAAK,KAAK,YAAY,aAAa,WAAW;EACjE,QAAQ;GACN,OAAO,QAAQ,QAAQ,IAAI;EAC7B;EAGA,MAAM,OAAO,8EAA8E,GAD5E,aAAa,GAAG;EAG/B,OAAO,YAAY;GACjB,KAAK,IAAI,IAAI,qCAAqC;GAClD,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D;GACA,WAAW,KAAK;GAChB,OAAO;EACT,CAAC,CAAC,CAAC,MACA,QAAS,KAAK,MAAM,IAAI,IAAI,CAAC,CAA+B,gBAAgB,YACvE,IACR;CACF;CAEA,aAAqB,OAAwC;;EAC3D,OAAO;GACL,KAAA,oBAAI,KAAK,iBAAA,QAAA,sBAAA,KAAA,IAAA,KAAA,IAAA,kBAAa,YAAY,MAAM,IAAI,MAAK,CAAC;IAClD,qBAAA,KAAK,iBAAA,QAAA,uBAAA,KAAA,IAAA,KAAA,IAAA,mBAAa;GAClB,KAAK,eAAe,KAAA;GACpB;EACF;CACF;CAEA,MAAc,aAAa,SAA6C;EACtE,MAAM,QAAQ,MAAM,KAAK,eAAe;EACxC,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,yCAAyC;EAG3D,MAAM,OAAO,gBAAgB;GAC3B,SAAS,KAAK;GACd,UAAU,KAAK;GACf,SAAS,QAAQ,KAAK,MAAM,KAAK,cAAc,CAAC,CAAC;EACnD,CAAC;EAED,MAAM,YAAY;GAChB,KAAK,IAAI,IAAI,iDAAiD;GAC9D,SAAS;IAAE,eAAe,UAAU;IAAS,gBAAgB;GAAmB;GAChF;GACA,WAAW,KAAK;GAChB,OAAO;GACP,eAAe,KAAK,aAAa,KAAK;EACxC,CAAC;CACH;AACF"}
+{"version":3,"file":"gcp.transport-BqzWORwO.mjs","names":[],"sources":["../src/transports/gcp.transport.ts"],"sourcesContent":["/**\n * logixia — Google Cloud Logging (Stackdriver) transport\n *\n * Maps logixia log entries to the GCP Logging REST API format:\n *   - Maps `level` → `severity` (INFO, WARNING, ERROR, CRITICAL…)\n *   - Injects `logging.googleapis.com/trace` for Cloud Trace correlation\n *   - Sets `traceSampled: true` whenever a trace id is present\n *     (`logging.googleapis.com/spanId` and `sourceLocation` are not populated)\n *   - Supports structured `jsonPayload` and plain `textPayload`\n *\n * Auth: the metadata server on GCE/GKE/Cloud Run, or a service-account key passed\n * as `credentials`. The `GOOGLE_APPLICATION_CREDENTIALS` key-file variable is not\n * read; full ADC is not supported.\n *\n * @example\n * ```ts\n * import { createLogger } from 'logixia';\n * import { GCPTransport } from 'logixia/gcp';\n *\n * const logger = createLogger({\n *   transports: {\n *     custom: [\n *       new GCPTransport({\n *         projectId: process.env.GOOGLE_CLOUD_PROJECT,\n *         logName: 'projects/my-project/logs/api',\n *         resource: { type: 'gce_instance', labels: { instance_id: '123' } },\n *       }),\n *     ],\n *   },\n * });\n * ```\n */\n\nimport * as https from 'node:https';\n\nimport type { IAsyncTransport, TransportLogEntry } from '../types/transport.types';\nimport { internalError } from '../utils/internal-log';\nimport { stringifyForLog } from '../utils/safe-stringify';\nimport {\n  BatchBuffer,\n  DEFAULT_MAX_BUFFER_SIZE,\n  DEFAULT_REQUEST_TIMEOUT_MS,\n  httpRequest,\n} from './batch-buffer';\nimport { mergeCoreFields } from './entry-fields';\nimport { protectSecrets } from './secret-config';\n\nexport interface GCPMonitoredResource {\n  type: string;\n  labels?: Record<string, string>;\n}\n\nexport interface GCPTransportConfig {\n  /** GCP project ID. Falls back to `GOOGLE_CLOUD_PROJECT` or `GCLOUD_PROJECT` env vars. */\n  projectId?: string;\n  /**\n   * Full log name, e.g. `'projects/my-project/logs/api'`.\n   * If omitted, defaults to `projects/{projectId}/logs/logixia`.\n   */\n  logName?: string;\n  /** Monitored resource descriptor. Defaults to `global`. */\n  resource?: GCPMonitoredResource;\n  /**\n   * Service account key JSON (parsed). If omitted, only the metadata server\n   * (GCE/GKE/Cloud Run) is tried; the key-file env var is not read.\n   */\n  credentials?: {\n    client_email: string;\n    private_key: string;\n  };\n  /** Number of entries to batch. @default 200 */\n  batchSize?: number;\n  /** Flush interval in ms. @default 5000 */\n  flushIntervalMs?: number;\n  /** Abort a request that has not finished after this many ms. @default 10000 */\n  requestTimeoutMs?: number;\n  /** Max buffered entries; the oldest are dropped past this. @default 10000 */\n  maxBufferSize?: number;\n  level?: string;\n}\n\ntype GcpSeverity =\n  | 'DEFAULT'\n  | 'DEBUG'\n  | 'INFO'\n  | 'NOTICE'\n  | 'WARNING'\n  | 'ERROR'\n  | 'CRITICAL'\n  | 'ALERT'\n  | 'EMERGENCY';\n\nfunction toGcpSeverity(level: string): GcpSeverity {\n  switch (level.toLowerCase()) {\n    case 'trace':\n    case 'verbose':\n    case 'debug':\n      return 'DEBUG';\n    case 'info':\n    case 'log':\n      return 'INFO';\n    case 'warn':\n    case 'warning':\n      return 'WARNING';\n    case 'error':\n      return 'ERROR';\n    case 'critical':\n    case 'fatal':\n      return 'CRITICAL';\n    default:\n      return 'DEFAULT';\n  }\n}\n\n/**\n * Google Cloud Logging transport with trace correlation and GCP severity mapping.\n */\nexport class GCPTransport implements IAsyncTransport {\n  public readonly name = 'gcp';\n  public readonly batchSize: number;\n  public readonly flushInterval: number;\n  public readonly level: string | undefined;\n\n  private readonly buffer: BatchBuffer<TransportLogEntry>;\n  private readonly requestTimeoutMs: number;\n  private flushTimer: NodeJS.Timeout | null = null;\n  private accessToken: string | null = null;\n  private tokenExpiry = 0;\n\n  private readonly projectId: string;\n  private readonly logName: string;\n  private readonly resource: GCPMonitoredResource;\n  private readonly credentials: { client_email: string; private_key: string } | undefined;\n\n  constructor(config: GCPTransportConfig) {\n    protectSecrets(this, ['credentials', 'accessToken']);\n    this.projectId =\n      config.projectId ??\n      process.env['GOOGLE_CLOUD_PROJECT'] ??\n      process.env['GCLOUD_PROJECT'] ??\n      'unknown-project';\n    this.logName = config.logName ?? `projects/${this.projectId}/logs/logixia`;\n    this.resource = config.resource ?? { type: 'global' };\n    this.credentials = config.credentials;\n    this.batchSize = config.batchSize ?? 200;\n    this.flushInterval = config.flushIntervalMs ?? 5000;\n    this.level = config.level;\n    this.requestTimeoutMs = config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;\n    this.buffer = new BatchBuffer<TransportLogEntry>({\n      name: 'GCPTransport',\n      batchSize: this.batchSize,\n      maxBufferSize: config.maxBufferSize ?? DEFAULT_MAX_BUFFER_SIZE,\n      send: (entries) => this.writeEntries(entries),\n      secrets: () => this.secretValues(),\n    });\n\n    this.flushTimer = setInterval(() => {\n      this.flush().catch(() => {});\n    }, this.flushInterval);\n    if (this.flushTimer.unref) this.flushTimer.unref();\n  }\n\n  write(entry: TransportLogEntry): void {\n    this.buffer.push(entry);\n    this.buffer.flushIfFull();\n  }\n\n  flush(): Promise<void> {\n    return this.buffer.flush();\n  }\n\n  /**\n   * Flush remaining entries and stop the interval timer on shutdown. Without\n   * this the manager's close() skipped the transport (close was undefined) and\n   * buffered entries were lost on deploy. Waits for any in-flight send first.\n   */\n  async close(): Promise<void> {\n    if (this.flushTimer) {\n      clearInterval(this.flushTimer);\n      this.flushTimer = null;\n    }\n    await this.buffer.close();\n  }\n\n  private buildLogEntry(entry: TransportLogEntry): Record<string, unknown> {\n    const gcpEntry: Record<string, unknown> = {\n      logName: this.logName,\n      resource: this.resource,\n      severity: toGcpSeverity(entry.level),\n      timestamp: entry.timestamp ?? new Date().toISOString(),\n      jsonPayload: mergeCoreFields(\n        { message: entry.message, appName: entry.appName, context: entry.context },\n        entry.data\n      ),\n    };\n\n    // GCP Cloud Trace correlation\n    if (entry.traceId) {\n      gcpEntry['trace'] = `projects/${this.projectId}/traces/${entry.traceId}`;\n      gcpEntry['traceSampled'] = true;\n    }\n\n    return gcpEntry;\n  }\n\n  private async getAccessToken(): Promise<string | null> {\n    if (this.accessToken && Date.now() < this.tokenExpiry) return this.accessToken;\n\n    // Try ADC metadata server (GCE/GKE/Cloud Run)\n    try {\n      const token = await this.fetchFromMetadataServer();\n      if (token) {\n        this.accessToken = token;\n        this.tokenExpiry = Date.now() + 55 * 60 * 1000; // 55 minutes\n        return this.accessToken;\n      }\n    } catch {\n      /* fall through to service account */\n    }\n\n    // Try service account key\n    if (this.credentials) {\n      try {\n        const token = await this.fetchServiceAccountToken();\n        if (token) {\n          this.accessToken = token;\n          this.tokenExpiry = Date.now() + 55 * 60 * 1000;\n          return this.accessToken;\n        }\n      } catch (err) {\n        internalError('GCPTransport service account token error', err);\n      }\n    }\n\n    return null;\n  }\n\n  private fetchFromMetadataServer(): Promise<string | null> {\n    return new Promise((resolve, reject) => {\n      const req = https.request(\n        {\n          hostname: 'metadata.google.internal',\n          path: '/computeMetadata/v1/instance/service-accounts/default/token',\n          headers: { 'Metadata-Flavor': 'Google' },\n          timeout: 3000,\n        },\n        (res) => {\n          let raw = '';\n          res.on('data', (c: Buffer) => (raw += c.toString()));\n          res.on('end', () => {\n            if (res.statusCode === 200) {\n              try {\n                const parsed = JSON.parse(raw) as { access_token?: string };\n                resolve(parsed.access_token ?? null);\n              } catch {\n                resolve(null);\n              }\n            } else {\n              resolve(null);\n            }\n          });\n        }\n      );\n      req.on('error', reject);\n      req.on('timeout', () => {\n        req.destroy();\n        reject(new Error('metadata timeout'));\n      });\n      req.end();\n    });\n  }\n\n  private fetchServiceAccountToken(): Promise<string | null> {\n    // Minimal JWT creation for service account — only for environments without\n    // the full Google Auth Library. For production workloads, prefer ADC.\n    if (!this.credentials) return Promise.resolve(null);\n\n    const iat = Math.floor(Date.now() / 1000);\n    const exp = iat + 3600;\n    const scope = 'https://www.googleapis.com/auth/logging.write';\n\n    const header = Buffer.from(JSON.stringify({ alg: 'RS256', typ: 'JWT' })).toString('base64url');\n    const payload = Buffer.from(\n      JSON.stringify({\n        iss: this.credentials.client_email,\n        scope,\n        aud: 'https://oauth2.googleapis.com/token',\n        exp,\n        iat,\n      })\n    ).toString('base64url');\n\n    const signingInput = `${header}.${payload}`;\n\n    let signature: string;\n    try {\n      // eslint-disable-next-line @typescript-eslint/no-require-imports\n      const sign = require('node:crypto').createSign('RSA-SHA256');\n      sign.update(signingInput);\n      signature = sign.sign(this.credentials.private_key, 'base64url') as string;\n    } catch {\n      return Promise.resolve(null);\n    }\n\n    const jwt = `${signingInput}.${signature}`;\n    const body = `grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=${jwt}`;\n\n    return httpRequest({\n      url: new URL('https://oauth2.googleapis.com/token'),\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: 'GCP token request',\n    }).then(\n      (res) => (JSON.parse(res.body) as { access_token?: string }).access_token ?? null,\n      () => null\n    );\n  }\n\n  private secretValues(token?: string): (string | undefined)[] {\n    return [\n      ...(this.credentials?.private_key.split('\\n') ?? []),\n      this.credentials?.private_key,\n      this.accessToken ?? undefined,\n      token,\n    ];\n  }\n\n  private async writeEntries(entries: TransportLogEntry[]): Promise<void> {\n    const token = await this.getAccessToken();\n    if (!token) {\n      throw new Error('GCPTransport: no access token available');\n    }\n\n    const body = stringifyForLog({\n      logName: this.logName,\n      resource: this.resource,\n      entries: entries.map((e) => this.buildLogEntry(e)),\n    });\n\n    await httpRequest({\n      url: new URL('https://logging.googleapis.com/v2/entries:write'),\n      headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: 'GCP Logging API',\n      secrets: () => this.secretValues(token),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4FA,SAAS,cAAc,OAA4B;CACjD,QAAQ,MAAM,YAAY,GAA1B;EACE,KAAK;EACL,KAAK;EACL,KAAK,SACH,OAAO;EACT,KAAK;EACL,KAAK,OACH,OAAO;EACT,KAAK;EACL,KAAK,WACH,OAAO;EACT,KAAK,SACH,OAAO;EACT,KAAK;EACL,KAAK,SACH,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;AAKA,IAAa,eAAb,MAAqD;CACnD,OAAuB;CACvB;CACA;CACA;CAEA;CACA;CACA,aAA4C;CAC5C,cAAqC;CACrC,cAAsB;CAEtB;CACA;CACA;CACA;CAEA,YAAY,QAA4B;EACtC,eAAe,MAAM,CAAC,eAAe,aAAa,CAAC;EACnD,KAAK,YACH,OAAO,aACP,QAAQ,IAAI,2BACZ,QAAQ,IAAI,qBACZ;EACF,KAAK,UAAU,OAAO,WAAW,YAAY,KAAK,UAAU;EAC5D,KAAK,WAAW,OAAO,YAAY,EAAE,MAAM,SAAS;EACpD,KAAK,cAAc,OAAO;EAC1B,KAAK,YAAY,OAAO,aAAa;EACrC,KAAK,gBAAgB,OAAO,mBAAmB;EAC/C,KAAK,QAAQ,OAAO;EACpB,KAAK,mBAAmB,OAAO,oBAAA;EAC/B,KAAK,SAAS,IAAI,YAA+B;GAC/C,MAAM;GACN,WAAW,KAAK;GAChB,eAAe,OAAO,iBAAA;GACtB,OAAO,YAAY,KAAK,aAAa,OAAO;GAC5C,eAAe,KAAK,aAAa;EACnC,CAAC;EAED,KAAK,aAAa,kBAAkB;GAClC,KAAK,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;EAC7B,GAAG,KAAK,aAAa;EACrB,IAAI,KAAK,WAAW,OAAO,KAAK,WAAW,MAAM;CACnD;CAEA,MAAM,OAAgC;EACpC,KAAK,OAAO,KAAK,KAAK;EACtB,KAAK,OAAO,YAAY;CAC1B;CAEA,QAAuB;EACrB,OAAO,KAAK,OAAO,MAAM;CAC3B;;;;;;CAOA,MAAM,QAAuB;EAC3B,IAAI,KAAK,YAAY;GACnB,cAAc,KAAK,UAAU;GAC7B,KAAK,aAAa;EACpB;EACA,MAAM,KAAK,OAAO,MAAM;CAC1B;CAEA,cAAsB,OAAmD;EACvE,MAAM,WAAoC;GACxC,SAAS,KAAK;GACd,UAAU,KAAK;GACf,UAAU,cAAc,MAAM,KAAK;GACnC,WAAW,MAAM,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;GACrD,aAAa,gBACX;IAAE,SAAS,MAAM;IAAS,SAAS,MAAM;IAAS,SAAS,MAAM;GAAQ,GACzE,MAAM,IACR;EACF;EAGA,IAAI,MAAM,SAAS;GACjB,SAAS,WAAW,YAAY,KAAK,UAAU,UAAU,MAAM;GAC/D,SAAS,kBAAkB;EAC7B;EAEA,OAAO;CACT;CAEA,MAAc,iBAAyC;EACrD,IAAI,KAAK,eAAe,KAAK,IAAI,IAAI,KAAK,aAAa,OAAO,KAAK;EAGnE,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,wBAAwB;GACjD,IAAI,OAAO;IACT,KAAK,cAAc;IACnB,KAAK,cAAc,KAAK,IAAI,IAAI;IAChC,OAAO,KAAK;GACd;EACF,QAAQ,CAER;EAGA,IAAI,KAAK,aACP,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,yBAAyB;GAClD,IAAI,OAAO;IACT,KAAK,cAAc;IACnB,KAAK,cAAc,KAAK,IAAI,IAAI;IAChC,OAAO,KAAK;GACd;EACF,SAAS,KAAK;GACZ,cAAc,4CAA4C,GAAG;EAC/D;EAGF,OAAO;CACT;CAEA,0BAA0D;EACxD,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,MAAM,MAAM,MAAM,QAChB;IACE,UAAU;IACV,MAAM;IACN,SAAS,EAAE,mBAAmB,SAAS;IACvC,SAAS;GACX,IACC,QAAQ;IACP,IAAI,MAAM;IACV,IAAI,GAAG,SAAS,MAAe,OAAO,EAAE,SAAS,CAAE;IACnD,IAAI,GAAG,aAAa;KAClB,IAAI,IAAI,eAAe,KACrB,IAAI;MAEF,QADe,KAAK,MAAM,GACb,CAAC,CAAC,gBAAgB,IAAI;KACrC,QAAQ;MACN,QAAQ,IAAI;KACd;UAEA,QAAQ,IAAI;IAEhB,CAAC;GACH,CACF;GACA,IAAI,GAAG,SAAS,MAAM;GACtB,IAAI,GAAG,iBAAiB;IACtB,IAAI,QAAQ;IACZ,uBAAO,IAAI,MAAM,kBAAkB,CAAC;GACtC,CAAC;GACD,IAAI,IAAI;EACV,CAAC;CACH;CAEA,2BAA2D;EAGzD,IAAI,CAAC,KAAK,aAAa,OAAO,QAAQ,QAAQ,IAAI;EAElD,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC,MAAM,MAAM,MAAM;EAclB,MAAM,eAAe,GAXN,OAAO,KAAK,KAAK,UAAU;GAAE,KAAK;GAAS,KAAK;EAAM,CAAC,CAAC,CAAC,CAAC,SAAS,WAWrD,EAAE,GAVf,OAAO,KACrB,KAAK,UAAU;GACb,KAAK,KAAK,YAAY;GACtB,OAAA;GACA,KAAK;GACL;GACA;EACF,CAAC,CACH,CAAC,CAAC,SAAS,WAE6B;EAExC,IAAI;EACJ,IAAI;GAEF,MAAM,OAAA,UAAe,aAAa,CAAC,CAAC,WAAW,YAAY;GAC3D,KAAK,OAAO,YAAY;GACxB,YAAY,KAAK,KAAK,KAAK,YAAY,aAAa,WAAW;EACjE,QAAQ;GACN,OAAO,QAAQ,QAAQ,IAAI;EAC7B;EAGA,MAAM,OAAO,8EAA8E,GAD5E,aAAa,GAAG;EAG/B,OAAO,YAAY;GACjB,KAAK,IAAI,IAAI,qCAAqC;GAClD,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D;GACA,WAAW,KAAK;GAChB,OAAO;EACT,CAAC,CAAC,CAAC,MACA,QAAS,KAAK,MAAM,IAAI,IAAI,CAAC,CAA+B,gBAAgB,YACvE,IACR;CACF;CAEA,aAAqB,OAAwC;;EAC3D,OAAO;GACL,KAAA,oBAAI,KAAK,iBAAA,QAAA,sBAAA,KAAA,IAAA,KAAA,IAAA,kBAAa,YAAY,MAAM,IAAI,MAAK,CAAC;IAClD,qBAAA,KAAK,iBAAA,QAAA,uBAAA,KAAA,IAAA,KAAA,IAAA,mBAAa;GAClB,KAAK,eAAe,KAAA;GACpB;EACF;CACF;CAEA,MAAc,aAAa,SAA6C;EACtE,MAAM,QAAQ,MAAM,KAAK,eAAe;EACxC,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,yCAAyC;EAG3D,MAAM,OAAO,gBAAgB;GAC3B,SAAS,KAAK;GACd,UAAU,KAAK;GACf,SAAS,QAAQ,KAAK,MAAM,KAAK,cAAc,CAAC,CAAC;EACnD,CAAC;EAED,MAAM,YAAY;GAChB,KAAK,IAAI,IAAI,iDAAiD;GAC9D,SAAS;IAAE,eAAe,UAAU;IAAS,gBAAgB;GAAmB;GAChF;GACA,WAAW,KAAK;GAChB,OAAO;GACP,eAAe,KAAK,aAAa,KAAK;EACxC,CAAC;CACH;AACF"}

package/dist/{gcp.transport-V9R4dwdT.js → gcp.transport-BvKR7MIz.js}

@@ -1,8 +1,8 @@
-const require_secret_config = require("./secret-config-OqmIPmpV.js");
+const require_secret_config = require("./secret-config-DB84lWy4.js");
 const require_internal_log = require("./internal-log-DwqTjhpb.js");
 const require_safe_stringify = require("./safe-stringify-J3sh-7YM.js");
 const require_entry_fields = require("./entry-fields-BSLkzw18.js");
-const require_batch_buffer = require("./batch-buffer-C-ETEX3Y.js");
+const require_batch_buffer = require("./batch-buffer-C6EmQcD5.js");
 let node_https = require("node:https");
 node_https = require_secret_config.__toESM(node_https);
 // src/transports/gcp.transport.ts
@@ -246,4 +246,4 @@ Object.defineProperty(exports, "GCPTransport", {
 	}
 });
 
-//# sourceMappingURL=gcp.transport-V9R4dwdT.js.map
+//# sourceMappingURL=gcp.transport-BvKR7MIz.js.map

package/dist/{gcp.transport-V9R4dwdT.js.map → gcp.transport-BvKR7MIz.js.map}

@@ -1 +1 @@
-{"version":3,"file":"gcp.transport-V9R4dwdT.js","names":["BatchBuffer","mergeCoreFields","https","httpRequest","stringifyForLog"],"sources":["../src/transports/gcp.transport.ts"],"sourcesContent":["/**\n * logixia — Google Cloud Logging (Stackdriver) transport\n *\n * Maps logixia log entries to the GCP Logging REST API format:\n *   - Maps `level` → `severity` (INFO, WARNING, ERROR, CRITICAL…)\n *   - Injects `logging.googleapis.com/trace` for Cloud Trace correlation\n *   - Sets `traceSampled: true` whenever a trace id is present\n *     (`logging.googleapis.com/spanId` and `sourceLocation` are not populated)\n *   - Supports structured `jsonPayload` and plain `textPayload`\n *\n * Auth: the metadata server on GCE/GKE/Cloud Run, or a service-account key passed\n * as `credentials`. The `GOOGLE_APPLICATION_CREDENTIALS` key-file variable is not\n * read; full ADC is not supported.\n *\n * @example\n * ```ts\n * import { createLogger } from 'logixia';\n * import { GCPTransport } from 'logixia/gcp';\n *\n * const logger = createLogger({\n *   transports: {\n *     custom: [\n *       new GCPTransport({\n *         projectId: process.env.GOOGLE_CLOUD_PROJECT,\n *         logName: 'projects/my-project/logs/api',\n *         resource: { type: 'gce_instance', labels: { instance_id: '123' } },\n *       }),\n *     ],\n *   },\n * });\n * ```\n */\n\nimport * as https from 'node:https';\n\nimport type { IAsyncTransport, TransportLogEntry } from '../types/transport.types';\nimport { internalError } from '../utils/internal-log';\nimport { stringifyForLog } from '../utils/safe-stringify';\nimport {\n  BatchBuffer,\n  DEFAULT_MAX_BUFFER_SIZE,\n  DEFAULT_REQUEST_TIMEOUT_MS,\n  httpRequest,\n} from './batch-buffer';\nimport { mergeCoreFields } from './entry-fields';\nimport { protectSecrets } from './secret-config';\n\nexport interface GCPMonitoredResource {\n  type: string;\n  labels?: Record<string, string>;\n}\n\nexport interface GCPTransportConfig {\n  /** GCP project ID. Falls back to `GOOGLE_CLOUD_PROJECT` or `GCLOUD_PROJECT` env vars. */\n  projectId?: string;\n  /**\n   * Full log name, e.g. `'projects/my-project/logs/api'`.\n   * If omitted, defaults to `projects/{projectId}/logs/logixia`.\n   */\n  logName?: string;\n  /** Monitored resource descriptor. Defaults to `global`. */\n  resource?: GCPMonitoredResource;\n  /**\n   * Service account key JSON (parsed). If omitted, only the metadata server\n   * (GCE/GKE/Cloud Run) is tried; the key-file env var is not read.\n   */\n  credentials?: {\n    client_email: string;\n    private_key: string;\n  };\n  /** Number of entries to batch. @default 200 */\n  batchSize?: number;\n  /** Flush interval in ms. @default 5000 */\n  flushIntervalMs?: number;\n  /** Abort a request that has not finished after this many ms. @default 10000 */\n  requestTimeoutMs?: number;\n  /** Max buffered entries; the oldest are dropped past this. @default 10000 */\n  maxBufferSize?: number;\n  level?: string;\n}\n\ntype GcpSeverity =\n  | 'DEFAULT'\n  | 'DEBUG'\n  | 'INFO'\n  | 'NOTICE'\n  | 'WARNING'\n  | 'ERROR'\n  | 'CRITICAL'\n  | 'ALERT'\n  | 'EMERGENCY';\n\nfunction toGcpSeverity(level: string): GcpSeverity {\n  switch (level.toLowerCase()) {\n    case 'trace':\n    case 'verbose':\n    case 'debug':\n      return 'DEBUG';\n    case 'info':\n    case 'log':\n      return 'INFO';\n    case 'warn':\n    case 'warning':\n      return 'WARNING';\n    case 'error':\n      return 'ERROR';\n    case 'critical':\n    case 'fatal':\n      return 'CRITICAL';\n    default:\n      return 'DEFAULT';\n  }\n}\n\n/**\n * Google Cloud Logging transport with trace correlation and GCP severity mapping.\n */\nexport class GCPTransport implements IAsyncTransport {\n  public readonly name = 'gcp';\n  public readonly batchSize: number;\n  public readonly flushInterval: number;\n  public readonly level: string | undefined;\n\n  private readonly buffer: BatchBuffer<TransportLogEntry>;\n  private readonly requestTimeoutMs: number;\n  private flushTimer: NodeJS.Timeout | null = null;\n  private accessToken: string | null = null;\n  private tokenExpiry = 0;\n\n  private readonly projectId: string;\n  private readonly logName: string;\n  private readonly resource: GCPMonitoredResource;\n  private readonly credentials: { client_email: string; private_key: string } | undefined;\n\n  constructor(config: GCPTransportConfig) {\n    protectSecrets(this, ['credentials', 'accessToken']);\n    this.projectId =\n      config.projectId ??\n      process.env['GOOGLE_CLOUD_PROJECT'] ??\n      process.env['GCLOUD_PROJECT'] ??\n      'unknown-project';\n    this.logName = config.logName ?? `projects/${this.projectId}/logs/logixia`;\n    this.resource = config.resource ?? { type: 'global' };\n    this.credentials = config.credentials;\n    this.batchSize = config.batchSize ?? 200;\n    this.flushInterval = config.flushIntervalMs ?? 5000;\n    this.level = config.level;\n    this.requestTimeoutMs = config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;\n    this.buffer = new BatchBuffer<TransportLogEntry>({\n      name: 'GCPTransport',\n      batchSize: this.batchSize,\n      maxBufferSize: config.maxBufferSize ?? DEFAULT_MAX_BUFFER_SIZE,\n      send: (entries) => this.writeEntries(entries),\n      secrets: () => this.secretValues(),\n    });\n\n    this.flushTimer = setInterval(() => {\n      this.flush().catch(() => {});\n    }, this.flushInterval);\n    if (this.flushTimer.unref) this.flushTimer.unref();\n  }\n\n  write(entry: TransportLogEntry): void {\n    this.buffer.push(entry);\n    this.buffer.flushIfFull();\n  }\n\n  flush(): Promise<void> {\n    return this.buffer.flush();\n  }\n\n  /**\n   * Flush remaining entries and stop the interval timer on shutdown. Without\n   * this the manager's close() skipped the transport (close was undefined) and\n   * buffered entries were lost on deploy. Waits for any in-flight send first.\n   */\n  async close(): Promise<void> {\n    if (this.flushTimer) {\n      clearInterval(this.flushTimer);\n      this.flushTimer = null;\n    }\n    await this.buffer.close();\n  }\n\n  private buildLogEntry(entry: TransportLogEntry): Record<string, unknown> {\n    const gcpEntry: Record<string, unknown> = {\n      logName: this.logName,\n      resource: this.resource,\n      severity: toGcpSeverity(entry.level),\n      timestamp: entry.timestamp ?? new Date().toISOString(),\n      jsonPayload: mergeCoreFields(\n        { message: entry.message, appName: entry.appName, context: entry.context },\n        entry.data\n      ),\n    };\n\n    // GCP Cloud Trace correlation\n    if (entry.traceId) {\n      gcpEntry['trace'] = `projects/${this.projectId}/traces/${entry.traceId}`;\n      gcpEntry['traceSampled'] = true;\n    }\n\n    return gcpEntry;\n  }\n\n  private async getAccessToken(): Promise<string | null> {\n    if (this.accessToken && Date.now() < this.tokenExpiry) return this.accessToken;\n\n    // Try ADC metadata server (GCE/GKE/Cloud Run)\n    try {\n      const token = await this.fetchFromMetadataServer();\n      if (token) {\n        this.accessToken = token;\n        this.tokenExpiry = Date.now() + 55 * 60 * 1000; // 55 minutes\n        return this.accessToken;\n      }\n    } catch {\n      /* fall through to service account */\n    }\n\n    // Try service account key\n    if (this.credentials) {\n      try {\n        const token = await this.fetchServiceAccountToken();\n        if (token) {\n          this.accessToken = token;\n          this.tokenExpiry = Date.now() + 55 * 60 * 1000;\n          return this.accessToken;\n        }\n      } catch (err) {\n        internalError('GCPTransport service account token error', err);\n      }\n    }\n\n    return null;\n  }\n\n  private fetchFromMetadataServer(): Promise<string | null> {\n    return new Promise((resolve, reject) => {\n      const req = https.request(\n        {\n          hostname: 'metadata.google.internal',\n          path: '/computeMetadata/v1/instance/service-accounts/default/token',\n          headers: { 'Metadata-Flavor': 'Google' },\n          timeout: 3000,\n        },\n        (res) => {\n          let raw = '';\n          res.on('data', (c: Buffer) => (raw += c.toString()));\n          res.on('end', () => {\n            if (res.statusCode === 200) {\n              try {\n                const parsed = JSON.parse(raw) as { access_token?: string };\n                resolve(parsed.access_token ?? null);\n              } catch {\n                resolve(null);\n              }\n            } else {\n              resolve(null);\n            }\n          });\n        }\n      );\n      req.on('error', reject);\n      req.on('timeout', () => {\n        req.destroy();\n        reject(new Error('metadata timeout'));\n      });\n      req.end();\n    });\n  }\n\n  private fetchServiceAccountToken(): Promise<string | null> {\n    // Minimal JWT creation for service account — only for environments without\n    // the full Google Auth Library. For production workloads, prefer ADC.\n    if (!this.credentials) return Promise.resolve(null);\n\n    const iat = Math.floor(Date.now() / 1000);\n    const exp = iat + 3600;\n    const scope = 'https://www.googleapis.com/auth/logging.write';\n\n    const header = Buffer.from(JSON.stringify({ alg: 'RS256', typ: 'JWT' })).toString('base64url');\n    const payload = Buffer.from(\n      JSON.stringify({\n        iss: this.credentials.client_email,\n        scope,\n        aud: 'https://oauth2.googleapis.com/token',\n        exp,\n        iat,\n      })\n    ).toString('base64url');\n\n    const signingInput = `${header}.${payload}`;\n\n    let signature: string;\n    try {\n      // eslint-disable-next-line @typescript-eslint/no-require-imports\n      const sign = require('node:crypto').createSign('RSA-SHA256');\n      sign.update(signingInput);\n      signature = sign.sign(this.credentials.private_key, 'base64url') as string;\n    } catch {\n      return Promise.resolve(null);\n    }\n\n    const jwt = `${signingInput}.${signature}`;\n    const body = `grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=${jwt}`;\n\n    return httpRequest({\n      url: new URL('https://oauth2.googleapis.com/token'),\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: 'GCP token request',\n    }).then(\n      (res) => (JSON.parse(res.body) as { access_token?: string }).access_token ?? null,\n      () => null\n    );\n  }\n\n  private secretValues(token?: string): (string | undefined)[] {\n    return [\n      ...(this.credentials?.private_key.split('\\n') ?? []),\n      this.credentials?.private_key,\n      this.accessToken ?? undefined,\n      token,\n    ];\n  }\n\n  private async writeEntries(entries: TransportLogEntry[]): Promise<void> {\n    const token = await this.getAccessToken();\n    if (!token) {\n      throw new Error('GCPTransport: no access token available');\n    }\n\n    const body = stringifyForLog({\n      logName: this.logName,\n      resource: this.resource,\n      entries: entries.map((e) => this.buildLogEntry(e)),\n    });\n\n    await httpRequest({\n      url: new URL('https://logging.googleapis.com/v2/entries:write'),\n      headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: 'GCP Logging API',\n      secrets: () => this.secretValues(token),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4FA,SAAS,cAAc,OAA4B;CACjD,QAAQ,MAAM,YAAY,GAA1B;EACE,KAAK;EACL,KAAK;EACL,KAAK,SACH,OAAO;EACT,KAAK;EACL,KAAK,OACH,OAAO;EACT,KAAK;EACL,KAAK,WACH,OAAO;EACT,KAAK,SACH,OAAO;EACT,KAAK;EACL,KAAK,SACH,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;AAKA,IAAa,eAAb,MAAqD;CACnD,OAAuB;CACvB;CACA;CACA;CAEA;CACA;CACA,aAA4C;CAC5C,cAAqC;CACrC,cAAsB;CAEtB;CACA;CACA;CACA;CAEA,YAAY,QAA4B;EACtC,sBAAA,eAAe,MAAM,CAAC,eAAe,aAAa,CAAC;EACnD,KAAK,YACH,OAAO,aACP,QAAQ,IAAI,2BACZ,QAAQ,IAAI,qBACZ;EACF,KAAK,UAAU,OAAO,WAAW,YAAY,KAAK,UAAU;EAC5D,KAAK,WAAW,OAAO,YAAY,EAAE,MAAM,SAAS;EACpD,KAAK,cAAc,OAAO;EAC1B,KAAK,YAAY,OAAO,aAAa;EACrC,KAAK,gBAAgB,OAAO,mBAAmB;EAC/C,KAAK,QAAQ,OAAO;EACpB,KAAK,mBAAmB,OAAO,oBAAA;EAC/B,KAAK,SAAS,IAAIA,qBAAAA,YAA+B;GAC/C,MAAM;GACN,WAAW,KAAK;GAChB,eAAe,OAAO,iBAAA;GACtB,OAAO,YAAY,KAAK,aAAa,OAAO;GAC5C,eAAe,KAAK,aAAa;EACnC,CAAC;EAED,KAAK,aAAa,kBAAkB;GAClC,KAAK,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;EAC7B,GAAG,KAAK,aAAa;EACrB,IAAI,KAAK,WAAW,OAAO,KAAK,WAAW,MAAM;CACnD;CAEA,MAAM,OAAgC;EACpC,KAAK,OAAO,KAAK,KAAK;EACtB,KAAK,OAAO,YAAY;CAC1B;CAEA,QAAuB;EACrB,OAAO,KAAK,OAAO,MAAM;CAC3B;;;;;;CAOA,MAAM,QAAuB;EAC3B,IAAI,KAAK,YAAY;GACnB,cAAc,KAAK,UAAU;GAC7B,KAAK,aAAa;EACpB;EACA,MAAM,KAAK,OAAO,MAAM;CAC1B;CAEA,cAAsB,OAAmD;EACvE,MAAM,WAAoC;GACxC,SAAS,KAAK;GACd,UAAU,KAAK;GACf,UAAU,cAAc,MAAM,KAAK;GACnC,WAAW,MAAM,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;GACrD,aAAaC,qBAAAA,gBACX;IAAE,SAAS,MAAM;IAAS,SAAS,MAAM;IAAS,SAAS,MAAM;GAAQ,GACzE,MAAM,IACR;EACF;EAGA,IAAI,MAAM,SAAS;GACjB,SAAS,WAAW,YAAY,KAAK,UAAU,UAAU,MAAM;GAC/D,SAAS,kBAAkB;EAC7B;EAEA,OAAO;CACT;CAEA,MAAc,iBAAyC;EACrD,IAAI,KAAK,eAAe,KAAK,IAAI,IAAI,KAAK,aAAa,OAAO,KAAK;EAGnE,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,wBAAwB;GACjD,IAAI,OAAO;IACT,KAAK,cAAc;IACnB,KAAK,cAAc,KAAK,IAAI,IAAI;IAChC,OAAO,KAAK;GACd;EACF,QAAQ,CAER;EAGA,IAAI,KAAK,aACP,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,yBAAyB;GAClD,IAAI,OAAO;IACT,KAAK,cAAc;IACnB,KAAK,cAAc,KAAK,IAAI,IAAI;IAChC,OAAO,KAAK;GACd;EACF,SAAS,KAAK;GACZ,qBAAA,cAAc,4CAA4C,GAAG;EAC/D;EAGF,OAAO;CACT;CAEA,0BAA0D;EACxD,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,MAAM,MAAMC,WAAM,QAChB;IACE,UAAU;IACV,MAAM;IACN,SAAS,EAAE,mBAAmB,SAAS;IACvC,SAAS;GACX,IACC,QAAQ;IACP,IAAI,MAAM;IACV,IAAI,GAAG,SAAS,MAAe,OAAO,EAAE,SAAS,CAAE;IACnD,IAAI,GAAG,aAAa;KAClB,IAAI,IAAI,eAAe,KACrB,IAAI;MAEF,QADe,KAAK,MAAM,GACb,CAAC,CAAC,gBAAgB,IAAI;KACrC,QAAQ;MACN,QAAQ,IAAI;KACd;UAEA,QAAQ,IAAI;IAEhB,CAAC;GACH,CACF;GACA,IAAI,GAAG,SAAS,MAAM;GACtB,IAAI,GAAG,iBAAiB;IACtB,IAAI,QAAQ;IACZ,uBAAO,IAAI,MAAM,kBAAkB,CAAC;GACtC,CAAC;GACD,IAAI,IAAI;EACV,CAAC;CACH;CAEA,2BAA2D;EAGzD,IAAI,CAAC,KAAK,aAAa,OAAO,QAAQ,QAAQ,IAAI;EAElD,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC,MAAM,MAAM,MAAM;EAclB,MAAM,eAAe,GAXN,OAAO,KAAK,KAAK,UAAU;GAAE,KAAK;GAAS,KAAK;EAAM,CAAC,CAAC,CAAC,CAAC,SAAS,WAWrD,EAAE,GAVf,OAAO,KACrB,KAAK,UAAU;GACb,KAAK,KAAK,YAAY;GACtB,OAAA;GACA,KAAK;GACL;GACA;EACF,CAAC,CACH,CAAC,CAAC,SAAS,WAE6B;EAExC,IAAI;EACJ,IAAI;GAEF,MAAM,OAAO,QAAQ,aAAa,CAAC,CAAC,WAAW,YAAY;GAC3D,KAAK,OAAO,YAAY;GACxB,YAAY,KAAK,KAAK,KAAK,YAAY,aAAa,WAAW;EACjE,QAAQ;GACN,OAAO,QAAQ,QAAQ,IAAI;EAC7B;EAGA,MAAM,OAAO,8EAA8E,GAD5E,aAAa,GAAG;EAG/B,OAAOC,qBAAAA,YAAY;GACjB,KAAK,IAAI,IAAI,qCAAqC;GAClD,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D;GACA,WAAW,KAAK;GAChB,OAAO;EACT,CAAC,CAAC,CAAC,MACA,QAAS,KAAK,MAAM,IAAI,IAAI,CAAC,CAA+B,gBAAgB,YACvE,IACR;CACF;CAEA,aAAqB,OAAwC;;EAC3D,OAAO;GACL,KAAA,oBAAI,KAAK,iBAAA,QAAA,sBAAA,KAAA,IAAA,KAAA,IAAA,kBAAa,YAAY,MAAM,IAAI,MAAK,CAAC;IAClD,qBAAA,KAAK,iBAAA,QAAA,uBAAA,KAAA,IAAA,KAAA,IAAA,mBAAa;GAClB,KAAK,eAAe,KAAA;GACpB;EACF;CACF;CAEA,MAAc,aAAa,SAA6C;EACtE,MAAM,QAAQ,MAAM,KAAK,eAAe;EACxC,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,yCAAyC;EAG3D,MAAM,OAAOC,uBAAAA,gBAAgB;GAC3B,SAAS,KAAK;GACd,UAAU,KAAK;GACf,SAAS,QAAQ,KAAK,MAAM,KAAK,cAAc,CAAC,CAAC;EACnD,CAAC;EAED,MAAMD,qBAAAA,YAAY;GAChB,KAAK,IAAI,IAAI,iDAAiD;GAC9D,SAAS;IAAE,eAAe,UAAU;IAAS,gBAAgB;GAAmB;GAChF;GACA,WAAW,KAAK;GAChB,OAAO;GACP,eAAe,KAAK,aAAa,KAAK;EACxC,CAAC;CACH;AACF"}
+{"version":3,"file":"gcp.transport-BvKR7MIz.js","names":["BatchBuffer","mergeCoreFields","https","httpRequest","stringifyForLog"],"sources":["../src/transports/gcp.transport.ts"],"sourcesContent":["/**\n * logixia — Google Cloud Logging (Stackdriver) transport\n *\n * Maps logixia log entries to the GCP Logging REST API format:\n *   - Maps `level` → `severity` (INFO, WARNING, ERROR, CRITICAL…)\n *   - Injects `logging.googleapis.com/trace` for Cloud Trace correlation\n *   - Sets `traceSampled: true` whenever a trace id is present\n *     (`logging.googleapis.com/spanId` and `sourceLocation` are not populated)\n *   - Supports structured `jsonPayload` and plain `textPayload`\n *\n * Auth: the metadata server on GCE/GKE/Cloud Run, or a service-account key passed\n * as `credentials`. The `GOOGLE_APPLICATION_CREDENTIALS` key-file variable is not\n * read; full ADC is not supported.\n *\n * @example\n * ```ts\n * import { createLogger } from 'logixia';\n * import { GCPTransport } from 'logixia/gcp';\n *\n * const logger = createLogger({\n *   transports: {\n *     custom: [\n *       new GCPTransport({\n *         projectId: process.env.GOOGLE_CLOUD_PROJECT,\n *         logName: 'projects/my-project/logs/api',\n *         resource: { type: 'gce_instance', labels: { instance_id: '123' } },\n *       }),\n *     ],\n *   },\n * });\n * ```\n */\n\nimport * as https from 'node:https';\n\nimport type { IAsyncTransport, TransportLogEntry } from '../types/transport.types';\nimport { internalError } from '../utils/internal-log';\nimport { stringifyForLog } from '../utils/safe-stringify';\nimport {\n  BatchBuffer,\n  DEFAULT_MAX_BUFFER_SIZE,\n  DEFAULT_REQUEST_TIMEOUT_MS,\n  httpRequest,\n} from './batch-buffer';\nimport { mergeCoreFields } from './entry-fields';\nimport { protectSecrets } from './secret-config';\n\nexport interface GCPMonitoredResource {\n  type: string;\n  labels?: Record<string, string>;\n}\n\nexport interface GCPTransportConfig {\n  /** GCP project ID. Falls back to `GOOGLE_CLOUD_PROJECT` or `GCLOUD_PROJECT` env vars. */\n  projectId?: string;\n  /**\n   * Full log name, e.g. `'projects/my-project/logs/api'`.\n   * If omitted, defaults to `projects/{projectId}/logs/logixia`.\n   */\n  logName?: string;\n  /** Monitored resource descriptor. Defaults to `global`. */\n  resource?: GCPMonitoredResource;\n  /**\n   * Service account key JSON (parsed). If omitted, only the metadata server\n   * (GCE/GKE/Cloud Run) is tried; the key-file env var is not read.\n   */\n  credentials?: {\n    client_email: string;\n    private_key: string;\n  };\n  /** Number of entries to batch. @default 200 */\n  batchSize?: number;\n  /** Flush interval in ms. @default 5000 */\n  flushIntervalMs?: number;\n  /** Abort a request that has not finished after this many ms. @default 10000 */\n  requestTimeoutMs?: number;\n  /** Max buffered entries; the oldest are dropped past this. @default 10000 */\n  maxBufferSize?: number;\n  level?: string;\n}\n\ntype GcpSeverity =\n  | 'DEFAULT'\n  | 'DEBUG'\n  | 'INFO'\n  | 'NOTICE'\n  | 'WARNING'\n  | 'ERROR'\n  | 'CRITICAL'\n  | 'ALERT'\n  | 'EMERGENCY';\n\nfunction toGcpSeverity(level: string): GcpSeverity {\n  switch (level.toLowerCase()) {\n    case 'trace':\n    case 'verbose':\n    case 'debug':\n      return 'DEBUG';\n    case 'info':\n    case 'log':\n      return 'INFO';\n    case 'warn':\n    case 'warning':\n      return 'WARNING';\n    case 'error':\n      return 'ERROR';\n    case 'critical':\n    case 'fatal':\n      return 'CRITICAL';\n    default:\n      return 'DEFAULT';\n  }\n}\n\n/**\n * Google Cloud Logging transport with trace correlation and GCP severity mapping.\n */\nexport class GCPTransport implements IAsyncTransport {\n  public readonly name = 'gcp';\n  public readonly batchSize: number;\n  public readonly flushInterval: number;\n  public readonly level: string | undefined;\n\n  private readonly buffer: BatchBuffer<TransportLogEntry>;\n  private readonly requestTimeoutMs: number;\n  private flushTimer: NodeJS.Timeout | null = null;\n  private accessToken: string | null = null;\n  private tokenExpiry = 0;\n\n  private readonly projectId: string;\n  private readonly logName: string;\n  private readonly resource: GCPMonitoredResource;\n  private readonly credentials: { client_email: string; private_key: string } | undefined;\n\n  constructor(config: GCPTransportConfig) {\n    protectSecrets(this, ['credentials', 'accessToken']);\n    this.projectId =\n      config.projectId ??\n      process.env['GOOGLE_CLOUD_PROJECT'] ??\n      process.env['GCLOUD_PROJECT'] ??\n      'unknown-project';\n    this.logName = config.logName ?? `projects/${this.projectId}/logs/logixia`;\n    this.resource = config.resource ?? { type: 'global' };\n    this.credentials = config.credentials;\n    this.batchSize = config.batchSize ?? 200;\n    this.flushInterval = config.flushIntervalMs ?? 5000;\n    this.level = config.level;\n    this.requestTimeoutMs = config.requestTimeoutMs ?? DEFAULT_REQUEST_TIMEOUT_MS;\n    this.buffer = new BatchBuffer<TransportLogEntry>({\n      name: 'GCPTransport',\n      batchSize: this.batchSize,\n      maxBufferSize: config.maxBufferSize ?? DEFAULT_MAX_BUFFER_SIZE,\n      send: (entries) => this.writeEntries(entries),\n      secrets: () => this.secretValues(),\n    });\n\n    this.flushTimer = setInterval(() => {\n      this.flush().catch(() => {});\n    }, this.flushInterval);\n    if (this.flushTimer.unref) this.flushTimer.unref();\n  }\n\n  write(entry: TransportLogEntry): void {\n    this.buffer.push(entry);\n    this.buffer.flushIfFull();\n  }\n\n  flush(): Promise<void> {\n    return this.buffer.flush();\n  }\n\n  /**\n   * Flush remaining entries and stop the interval timer on shutdown. Without\n   * this the manager's close() skipped the transport (close was undefined) and\n   * buffered entries were lost on deploy. Waits for any in-flight send first.\n   */\n  async close(): Promise<void> {\n    if (this.flushTimer) {\n      clearInterval(this.flushTimer);\n      this.flushTimer = null;\n    }\n    await this.buffer.close();\n  }\n\n  private buildLogEntry(entry: TransportLogEntry): Record<string, unknown> {\n    const gcpEntry: Record<string, unknown> = {\n      logName: this.logName,\n      resource: this.resource,\n      severity: toGcpSeverity(entry.level),\n      timestamp: entry.timestamp ?? new Date().toISOString(),\n      jsonPayload: mergeCoreFields(\n        { message: entry.message, appName: entry.appName, context: entry.context },\n        entry.data\n      ),\n    };\n\n    // GCP Cloud Trace correlation\n    if (entry.traceId) {\n      gcpEntry['trace'] = `projects/${this.projectId}/traces/${entry.traceId}`;\n      gcpEntry['traceSampled'] = true;\n    }\n\n    return gcpEntry;\n  }\n\n  private async getAccessToken(): Promise<string | null> {\n    if (this.accessToken && Date.now() < this.tokenExpiry) return this.accessToken;\n\n    // Try ADC metadata server (GCE/GKE/Cloud Run)\n    try {\n      const token = await this.fetchFromMetadataServer();\n      if (token) {\n        this.accessToken = token;\n        this.tokenExpiry = Date.now() + 55 * 60 * 1000; // 55 minutes\n        return this.accessToken;\n      }\n    } catch {\n      /* fall through to service account */\n    }\n\n    // Try service account key\n    if (this.credentials) {\n      try {\n        const token = await this.fetchServiceAccountToken();\n        if (token) {\n          this.accessToken = token;\n          this.tokenExpiry = Date.now() + 55 * 60 * 1000;\n          return this.accessToken;\n        }\n      } catch (err) {\n        internalError('GCPTransport service account token error', err);\n      }\n    }\n\n    return null;\n  }\n\n  private fetchFromMetadataServer(): Promise<string | null> {\n    return new Promise((resolve, reject) => {\n      const req = https.request(\n        {\n          hostname: 'metadata.google.internal',\n          path: '/computeMetadata/v1/instance/service-accounts/default/token',\n          headers: { 'Metadata-Flavor': 'Google' },\n          timeout: 3000,\n        },\n        (res) => {\n          let raw = '';\n          res.on('data', (c: Buffer) => (raw += c.toString()));\n          res.on('end', () => {\n            if (res.statusCode === 200) {\n              try {\n                const parsed = JSON.parse(raw) as { access_token?: string };\n                resolve(parsed.access_token ?? null);\n              } catch {\n                resolve(null);\n              }\n            } else {\n              resolve(null);\n            }\n          });\n        }\n      );\n      req.on('error', reject);\n      req.on('timeout', () => {\n        req.destroy();\n        reject(new Error('metadata timeout'));\n      });\n      req.end();\n    });\n  }\n\n  private fetchServiceAccountToken(): Promise<string | null> {\n    // Minimal JWT creation for service account — only for environments without\n    // the full Google Auth Library. For production workloads, prefer ADC.\n    if (!this.credentials) return Promise.resolve(null);\n\n    const iat = Math.floor(Date.now() / 1000);\n    const exp = iat + 3600;\n    const scope = 'https://www.googleapis.com/auth/logging.write';\n\n    const header = Buffer.from(JSON.stringify({ alg: 'RS256', typ: 'JWT' })).toString('base64url');\n    const payload = Buffer.from(\n      JSON.stringify({\n        iss: this.credentials.client_email,\n        scope,\n        aud: 'https://oauth2.googleapis.com/token',\n        exp,\n        iat,\n      })\n    ).toString('base64url');\n\n    const signingInput = `${header}.${payload}`;\n\n    let signature: string;\n    try {\n      // eslint-disable-next-line @typescript-eslint/no-require-imports\n      const sign = require('node:crypto').createSign('RSA-SHA256');\n      sign.update(signingInput);\n      signature = sign.sign(this.credentials.private_key, 'base64url') as string;\n    } catch {\n      return Promise.resolve(null);\n    }\n\n    const jwt = `${signingInput}.${signature}`;\n    const body = `grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Ajwt-bearer&assertion=${jwt}`;\n\n    return httpRequest({\n      url: new URL('https://oauth2.googleapis.com/token'),\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: 'GCP token request',\n    }).then(\n      (res) => (JSON.parse(res.body) as { access_token?: string }).access_token ?? null,\n      () => null\n    );\n  }\n\n  private secretValues(token?: string): (string | undefined)[] {\n    return [\n      ...(this.credentials?.private_key.split('\\n') ?? []),\n      this.credentials?.private_key,\n      this.accessToken ?? undefined,\n      token,\n    ];\n  }\n\n  private async writeEntries(entries: TransportLogEntry[]): Promise<void> {\n    const token = await this.getAccessToken();\n    if (!token) {\n      throw new Error('GCPTransport: no access token available');\n    }\n\n    const body = stringifyForLog({\n      logName: this.logName,\n      resource: this.resource,\n      entries: entries.map((e) => this.buildLogEntry(e)),\n    });\n\n    await httpRequest({\n      url: new URL('https://logging.googleapis.com/v2/entries:write'),\n      headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json' },\n      body,\n      timeoutMs: this.requestTimeoutMs,\n      label: 'GCP Logging API',\n      secrets: () => this.secretValues(token),\n    });\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4FA,SAAS,cAAc,OAA4B;CACjD,QAAQ,MAAM,YAAY,GAA1B;EACE,KAAK;EACL,KAAK;EACL,KAAK,SACH,OAAO;EACT,KAAK;EACL,KAAK,OACH,OAAO;EACT,KAAK;EACL,KAAK,WACH,OAAO;EACT,KAAK,SACH,OAAO;EACT,KAAK;EACL,KAAK,SACH,OAAO;EACT,SACE,OAAO;CACX;AACF;;;;AAKA,IAAa,eAAb,MAAqD;CACnD,OAAuB;CACvB;CACA;CACA;CAEA;CACA;CACA,aAA4C;CAC5C,cAAqC;CACrC,cAAsB;CAEtB;CACA;CACA;CACA;CAEA,YAAY,QAA4B;EACtC,sBAAA,eAAe,MAAM,CAAC,eAAe,aAAa,CAAC;EACnD,KAAK,YACH,OAAO,aACP,QAAQ,IAAI,2BACZ,QAAQ,IAAI,qBACZ;EACF,KAAK,UAAU,OAAO,WAAW,YAAY,KAAK,UAAU;EAC5D,KAAK,WAAW,OAAO,YAAY,EAAE,MAAM,SAAS;EACpD,KAAK,cAAc,OAAO;EAC1B,KAAK,YAAY,OAAO,aAAa;EACrC,KAAK,gBAAgB,OAAO,mBAAmB;EAC/C,KAAK,QAAQ,OAAO;EACpB,KAAK,mBAAmB,OAAO,oBAAA;EAC/B,KAAK,SAAS,IAAIA,qBAAAA,YAA+B;GAC/C,MAAM;GACN,WAAW,KAAK;GAChB,eAAe,OAAO,iBAAA;GACtB,OAAO,YAAY,KAAK,aAAa,OAAO;GAC5C,eAAe,KAAK,aAAa;EACnC,CAAC;EAED,KAAK,aAAa,kBAAkB;GAClC,KAAK,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC;EAC7B,GAAG,KAAK,aAAa;EACrB,IAAI,KAAK,WAAW,OAAO,KAAK,WAAW,MAAM;CACnD;CAEA,MAAM,OAAgC;EACpC,KAAK,OAAO,KAAK,KAAK;EACtB,KAAK,OAAO,YAAY;CAC1B;CAEA,QAAuB;EACrB,OAAO,KAAK,OAAO,MAAM;CAC3B;;;;;;CAOA,MAAM,QAAuB;EAC3B,IAAI,KAAK,YAAY;GACnB,cAAc,KAAK,UAAU;GAC7B,KAAK,aAAa;EACpB;EACA,MAAM,KAAK,OAAO,MAAM;CAC1B;CAEA,cAAsB,OAAmD;EACvE,MAAM,WAAoC;GACxC,SAAS,KAAK;GACd,UAAU,KAAK;GACf,UAAU,cAAc,MAAM,KAAK;GACnC,WAAW,MAAM,8BAAa,IAAI,KAAK,EAAA,CAAE,YAAY;GACrD,aAAaC,qBAAAA,gBACX;IAAE,SAAS,MAAM;IAAS,SAAS,MAAM;IAAS,SAAS,MAAM;GAAQ,GACzE,MAAM,IACR;EACF;EAGA,IAAI,MAAM,SAAS;GACjB,SAAS,WAAW,YAAY,KAAK,UAAU,UAAU,MAAM;GAC/D,SAAS,kBAAkB;EAC7B;EAEA,OAAO;CACT;CAEA,MAAc,iBAAyC;EACrD,IAAI,KAAK,eAAe,KAAK,IAAI,IAAI,KAAK,aAAa,OAAO,KAAK;EAGnE,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,wBAAwB;GACjD,IAAI,OAAO;IACT,KAAK,cAAc;IACnB,KAAK,cAAc,KAAK,IAAI,IAAI;IAChC,OAAO,KAAK;GACd;EACF,QAAQ,CAER;EAGA,IAAI,KAAK,aACP,IAAI;GACF,MAAM,QAAQ,MAAM,KAAK,yBAAyB;GAClD,IAAI,OAAO;IACT,KAAK,cAAc;IACnB,KAAK,cAAc,KAAK,IAAI,IAAI;IAChC,OAAO,KAAK;GACd;EACF,SAAS,KAAK;GACZ,qBAAA,cAAc,4CAA4C,GAAG;EAC/D;EAGF,OAAO;CACT;CAEA,0BAA0D;EACxD,OAAO,IAAI,SAAS,SAAS,WAAW;GACtC,MAAM,MAAMC,WAAM,QAChB;IACE,UAAU;IACV,MAAM;IACN,SAAS,EAAE,mBAAmB,SAAS;IACvC,SAAS;GACX,IACC,QAAQ;IACP,IAAI,MAAM;IACV,IAAI,GAAG,SAAS,MAAe,OAAO,EAAE,SAAS,CAAE;IACnD,IAAI,GAAG,aAAa;KAClB,IAAI,IAAI,eAAe,KACrB,IAAI;MAEF,QADe,KAAK,MAAM,GACb,CAAC,CAAC,gBAAgB,IAAI;KACrC,QAAQ;MACN,QAAQ,IAAI;KACd;UAEA,QAAQ,IAAI;IAEhB,CAAC;GACH,CACF;GACA,IAAI,GAAG,SAAS,MAAM;GACtB,IAAI,GAAG,iBAAiB;IACtB,IAAI,QAAQ;IACZ,uBAAO,IAAI,MAAM,kBAAkB,CAAC;GACtC,CAAC;GACD,IAAI,IAAI;EACV,CAAC;CACH;CAEA,2BAA2D;EAGzD,IAAI,CAAC,KAAK,aAAa,OAAO,QAAQ,QAAQ,IAAI;EAElD,MAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;EACxC,MAAM,MAAM,MAAM;EAclB,MAAM,eAAe,GAXN,OAAO,KAAK,KAAK,UAAU;GAAE,KAAK;GAAS,KAAK;EAAM,CAAC,CAAC,CAAC,CAAC,SAAS,WAWrD,EAAE,GAVf,OAAO,KACrB,KAAK,UAAU;GACb,KAAK,KAAK,YAAY;GACtB,OAAA;GACA,KAAK;GACL;GACA;EACF,CAAC,CACH,CAAC,CAAC,SAAS,WAE6B;EAExC,IAAI;EACJ,IAAI;GAEF,MAAM,OAAO,QAAQ,aAAa,CAAC,CAAC,WAAW,YAAY;GAC3D,KAAK,OAAO,YAAY;GACxB,YAAY,KAAK,KAAK,KAAK,YAAY,aAAa,WAAW;EACjE,QAAQ;GACN,OAAO,QAAQ,QAAQ,IAAI;EAC7B;EAGA,MAAM,OAAO,8EAA8E,GAD5E,aAAa,GAAG;EAG/B,OAAOC,qBAAAA,YAAY;GACjB,KAAK,IAAI,IAAI,qCAAqC;GAClD,SAAS,EAAE,gBAAgB,oCAAoC;GAC/D;GACA,WAAW,KAAK;GAChB,OAAO;EACT,CAAC,CAAC,CAAC,MACA,QAAS,KAAK,MAAM,IAAI,IAAI,CAAC,CAA+B,gBAAgB,YACvE,IACR;CACF;CAEA,aAAqB,OAAwC;;EAC3D,OAAO;GACL,KAAA,oBAAI,KAAK,iBAAA,QAAA,sBAAA,KAAA,IAAA,KAAA,IAAA,kBAAa,YAAY,MAAM,IAAI,MAAK,CAAC;IAClD,qBAAA,KAAK,iBAAA,QAAA,uBAAA,KAAA,IAAA,KAAA,IAAA,mBAAa;GAClB,KAAK,eAAe,KAAA;GACpB;EACF;CACF;CAEA,MAAc,aAAa,SAA6C;EACtE,MAAM,QAAQ,MAAM,KAAK,eAAe;EACxC,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,yCAAyC;EAG3D,MAAM,OAAOC,uBAAAA,gBAAgB;GAC3B,SAAS,KAAK;GACd,UAAU,KAAK;GACf,SAAS,QAAQ,KAAK,MAAM,KAAK,cAAc,CAAC,CAAC;EACnD,CAAC;EAED,MAAMD,qBAAAA,YAAY;GAChB,KAAK,IAAI,IAAI,iDAAiD;GAC9D,SAAS;IAAE,eAAe,UAAU;IAAS,gBAAgB;GAAmB;GAChF;GACA,WAAW,KAAK;GAChB,OAAO;GACP,eAAe,KAAK,aAAa,KAAK;EACxC,CAAC;CACH;AACF"}

package/dist/index.d.mts

@@ -1,7 +1,7 @@
 import { _ as TransportLogEntry, d as ITransport, h as TransportConfig } from "./transport.types-MjMDjOQ7.mjs";
 import { n as HttpResponseShape, t as HttpRequestShape } from "./http-shapes-BnBkJcid.mjs";
 import { A as TraceIdConfig, B as usePlugin, C as LogixiaLoggerInstance, D as ReservedLevelName, E as RequestContext, F as RequestMetrics, I as RequestTiming, L as LogixiaPlugin, M as HttpError, N as HttpRequest, O as SamplingConfig, P as HttpResponse, R as PluginRegistry, S as LogixiaLoggerDefault, T as RedactConfig, _ as LogFieldKey, a as DEFAULT_LOG_LEVELS, b as LoggerConfig, c as ExtractLevels, d as ILogFormatter, f as ILogger, g as LogEntry, h as LogColor, i as DEFAULT_LOG_COLORS, j as TraceIdExtractorConfig, k as TimingEntry, l as GracefulShutdownConfig, m as ILoggerRuntimeControls, n as ContextData, o as Environment, p as ILoggerDefault, r as CustomLevelMethods, s as ErrorSerializationOptions, t as AdaptiveSamplingConfig, u as IBaseLogger, v as LogLevel, w as NamespaceLevels, x as LoggerWithLevels, y as LogLevelString, z as globalPluginRegistry } from "./index-0X_XpQ_f.mjs";
-import { n as createLogger$1, t as LogixiaLogger } from "./logixia-logger-DcvASx5B.mjs";
+import { n as createLogger$1, t as LogixiaLogger } from "./logixia-logger-DK6oHsmN.mjs";
 import { a as SentryLoggerLike, c as SentryTransport, d as DiscordTransport, f as DiscordTransportConfig, h as toOtelSeverity, i as SentryLike, l as SentryTransportConfig, m as OtlpLogTransportConfig, n as SlackTransport, o as SentryScopeLike, p as OtlpLogTransport, r as SlackTransportConfig, s as SentrySeverity, t as SlackMessage, u as DiscordEmbed } from "./slack.transport-DAGuMvm7.mjs";
 import { A as SearchStats, C as SearchFilters, D as SearchPreset, E as SearchOptions, F as SuggestionType, I as TimeRange, L as TimelineEvent, M as SemanticIndex, N as SimilarLog, O as SearchQuery, P as SortField, S as RelativeTime, T as SearchMatch, _ as ParsedNLQuery, a as ILogSearchEngine, b as RelatedLog, c as SearchManager, d as CorrelatedLogs, f as EntityType, g as LogPattern, h as LogCorrelationSummary, i as BasicSearchEngine, j as SearchSuggestion, k as SearchResult, l as SearchManagerConfig, m as LogCluster, n as NLPSearchEngine, o as BasicLogIndexer, p as ExportOptions, r as CorrelationEngine, s as ILogIndexer, t as PatternRecognitionEngine, u as AnomalyDetection, v as QueryEntity, w as SearchHighlight, x as RelationshipType, y as QueryIntent } from "./search-CdTwNSQm.mjs";
 import { AsyncLocalStorage } from "node:async_hooks";

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import { _ as TransportLogEntry, d as ITransport, h as TransportConfig } from "./transport.types-MjMDjOQ7.js";
 import { n as HttpResponseShape, t as HttpRequestShape } from "./http-shapes-BnBkJcid.js";
 import { A as TraceIdConfig, B as usePlugin, C as LogixiaLoggerInstance, D as ReservedLevelName, E as RequestContext, F as RequestMetrics, I as RequestTiming, L as LogixiaPlugin, M as HttpError, N as HttpRequest, O as SamplingConfig, P as HttpResponse, R as PluginRegistry, S as LogixiaLoggerDefault, T as RedactConfig, _ as LogFieldKey, a as DEFAULT_LOG_LEVELS, b as LoggerConfig, c as ExtractLevels, d as ILogFormatter, f as ILogger, g as LogEntry, h as LogColor, i as DEFAULT_LOG_COLORS, j as TraceIdExtractorConfig, k as TimingEntry, l as GracefulShutdownConfig, m as ILoggerRuntimeControls, n as ContextData, o as Environment, p as ILoggerDefault, r as CustomLevelMethods, s as ErrorSerializationOptions, t as AdaptiveSamplingConfig, u as IBaseLogger, v as LogLevel, w as NamespaceLevels, x as LoggerWithLevels, y as LogLevelString, z as globalPluginRegistry } from "./index-BnbqeNl6.js";
-import { n as createLogger$1, t as LogixiaLogger } from "./logixia-logger-cLi5x5I2.js";
+import { n as createLogger$1, t as LogixiaLogger } from "./logixia-logger-DSh5ZUEz.js";
 import { a as SentryLoggerLike, c as SentryTransport, d as DiscordTransport, f as DiscordTransportConfig, h as toOtelSeverity, i as SentryLike, l as SentryTransportConfig, m as OtlpLogTransportConfig, n as SlackTransport, o as SentryScopeLike, p as OtlpLogTransport, r as SlackTransportConfig, s as SentrySeverity, t as SlackMessage, u as DiscordEmbed } from "./slack.transport-LvYsOoFZ.js";
 import { A as SearchStats, C as SearchFilters, D as SearchPreset, E as SearchOptions, F as SuggestionType, I as TimeRange, L as TimelineEvent, M as SemanticIndex, N as SimilarLog, O as SearchQuery, P as SortField, S as RelativeTime, T as SearchMatch, _ as ParsedNLQuery, a as ILogSearchEngine, b as RelatedLog, c as SearchManager, d as CorrelatedLogs, f as EntityType, g as LogPattern, h as LogCorrelationSummary, i as BasicSearchEngine, j as SearchSuggestion, k as SearchResult, l as SearchManagerConfig, m as LogCluster, n as NLPSearchEngine, o as BasicLogIndexer, p as ExportOptions, r as CorrelationEngine, s as ILogIndexer, t as PatternRecognitionEngine, u as AnomalyDetection, v as QueryEntity, w as SearchHighlight, x as RelationshipType, y as QueryIntent } from "./search-B9fKizkh.js";
 import { AsyncLocalStorage } from "node:async_hooks";

package/dist/index.js

@@ -1,5 +1,5 @@
 Object.defineProperty(exports, Symbol.toStringTag, { value: "Module" });
-const require_builder = require("./builder-CC48eDJ3.js");
+const require_builder = require("./builder-Dm8M1WXD.js");
 const require_own_property = require("./own-property-BWkibepN.js");
 const require_request_trace = require("./request-trace-BqU7ARjg.js");
 const require_async_context = require("./async-context-BqjwNzgS.js");
@@ -7,9 +7,9 @@ const require_sensitive_names = require("./sensitive-names-NiKIRhp5.js");
 const require_internal_log = require("./internal-log-DwqTjhpb.js");
 const require_safe_stringify = require("./safe-stringify-J3sh-7YM.js");
 const require_csv_utils = require("./csv.utils-CbVHY1pd.js");
-const require_otel = require("./otel-D4SdNYhR.js");
+const require_otel = require("./otel-BAzbTiJw.js");
 const require_error_utils = require("./error.utils-fZkRExam.js");
-const require_slack_transport = require("./slack.transport-B-IsNaB8.js");
+const require_slack_transport = require("./slack.transport-BA97gQ8V.js");
 const require_search = require("./search-_qx4YzRP.js");
 let node_async_hooks = require("node:async_hooks");
 // src/formatters/json.formatter.ts