syntropylog 0.12.0 → 0.12.1

package/CHANGELOG.md

@@ -16,6 +16,12 @@ First release after 0.11.3. Includes all framework refinements validated end-to-
 - **Lint:** SerializationManager: replaced `(logEntry as any)` with `Record<string, unknown>`; removed unused destructuring variables in native serialize path (use copy + delete for metadata).
 - **Examples repo:** Full refresh: main set 01–17 only, updated README and test script, self-contained benchmark (17-benchmark), removed obsolete scripts and optional folders.
 
+## 0.12.1
+
+### Patch Changes
+
+- **Security / env:** The package no longer reads any environment variables (addresses tooling such as Socket.dev). Use config/options instead: `logger.disableNativeAddon: true` in `init()` to disable the native addon (replaces `SYNTROPYLOG_NATIVE_DISABLE=1`). For console transports, pass `disableColors: true` or derive from `NO_COLOR` in your app to disable ANSI colors. See SECURITY.md.
+
 ## 0.11.3
 
 ### Patch Changes

package/dist/index.cjs

@@ -863,6 +863,7 @@ const validateLoggerOptions = object({
     prettyPrint: optional(object({
         enabled: optional(isBoolean),
     })),
+    disableNativeAddon: optional(isBoolean),
 });
 const validateMasking = object({
     rules: optional(arrayOf(validateMaskingRule)),
@@ -1998,6 +1999,7 @@ class SerializationManager {
             enableMetrics: config.enableMetrics ?? true,
             sanitizeSensitiveData: config.sanitizeSensitiveData ?? true,
             nativeShallow: config.nativeShallow ?? false,
+            disableNativeAddon: config.disableNativeAddon ?? false,
             sanitizationContext: {
                 sensitiveFields: config.sanitizationContext?.sensitiveFields ||
                     getDefaultSensitiveFields(),
@@ -2042,7 +2044,7 @@ class SerializationManager {
         if (this.nativeChecked)
             return this.nativeAddon;
         this.nativeChecked = true;
-        if (process.env.SYNTROPYLOG_NATIVE_DISABLE === '1') {
+        if (this.config.disableNativeAddon) {
             this.nativeAddon = null;
             return null;
         }
@@ -2395,6 +2397,8 @@ class ConsoleTransport extends Transport {
  * @file src/logger/transports/optionalChalk.ts
  * @description Built-in chalk-like API using ANSI escape codes. No chalk dependency.
  * Used by ClassicConsoleTransport, PrettyConsoleTransport, CompactConsoleTransport, ColorfulConsoleTransport.
+ * Does not read process.env; pass disableColors from transport options (e.g. for NO_COLOR use
+ * disableColors: process.env.NO_COLOR != null && process.env.NO_COLOR !== '' && process.env.NO_COLOR !== '0').
  */
 const RESET = '\x1b[0m';
 function wrap(s, codes) {
@@ -2426,39 +2430,45 @@ function createChain(codes) {
     Object.defineProperty(fn, 'dim', { get: () => add(2), enumerable: true });
     return fn;
 }
-let cached = null;
+function createIdentityChalk() {
+    const identity = ((s) => s);
+    identity.white = identity;
+    identity.bold = identity;
+    identity.red = identity;
+    identity.bgRed = identity;
+    identity.yellow = identity;
+    identity.cyan = identity;
+    identity.green = identity;
+    identity.gray = identity;
+    identity.magenta = identity;
+    identity.blue = identity;
+    identity.bgWhite = identity;
+    identity.dim = identity;
+    return identity;
+}
+let cachedWithColors = null;
+let cachedNoColors = null;
 /**
  * Returns a chalk-like instance using built-in ANSI colors. No external chalk dependency.
- * Respects NO_COLOR and disables colors when stdout is not a TTY (e.g. pipes, CI).
+ * Does not read process.env. Pass disableColors from transport options; when true, output has no colors.
+ * When false, colors are used only if stdout is a TTY. To respect NO_COLOR, pass
+ * disableColors: process.env.NO_COLOR != null && process.env.NO_COLOR !== '' && process.env.NO_COLOR !== '0'.
  */
-function getOptionalChalk() {
-    if (cached !== null) {
-        return cached;
+function getOptionalChalk(disableColors) {
+    if (disableColors) {
+        if (cachedNoColors === null)
+            cachedNoColors = createIdentityChalk();
+        return cachedNoColors;
     }
-    const noColor = process.env.NO_COLOR !== undefined &&
-        process.env.NO_COLOR !== '' &&
-        process.env.NO_COLOR !== '0';
     const isTTY = typeof process.stdout?.isTTY === 'boolean' && process.stdout.isTTY;
-    if (noColor || !isTTY) {
-        const identity = ((s) => s);
-        identity.white = identity;
-        identity.bold = identity;
-        identity.red = identity;
-        identity.bgRed = identity;
-        identity.yellow = identity;
-        identity.cyan = identity;
-        identity.green = identity;
-        identity.gray = identity;
-        identity.magenta = identity;
-        identity.blue = identity;
-        identity.bgWhite = identity;
-        identity.dim = identity;
-        cached = identity;
-    }
-    else {
-        cached = createChain([]);
-    }
-    return cached;
+    if (!isTTY) {
+        if (cachedNoColors === null)
+            cachedNoColors = createIdentityChalk();
+        return cachedNoColors;
+    }
+    if (cachedWithColors === null)
+        cachedWithColors = createChain([]);
+    return cachedWithColors;
 }
 
 /**
@@ -2471,7 +2481,7 @@ function getOptionalChalk() {
 class BaseConsolePrettyTransport extends Transport {
     constructor(options) {
         super(options);
-        this.chalk = getOptionalChalk();
+        this.chalk = getOptionalChalk(options?.disableColors ?? false);
     }
     /**
      * The core log method. It handles common logic and delegates specific
@@ -3043,6 +3053,7 @@ class LoggerFactory {
         this.serializationManager = new SerializationManager({
             timeoutMs: config.logger?.serializerTimeoutMs,
             sanitizeSensitiveData: config.masking?.enableDefaultRules !== false,
+            disableNativeAddon: config.logger?.disableNativeAddon ?? false,
             onStepError: config.onStepError,
             onSerializationFallback: config.onSerializationFallback,
         });
@@ -3353,6 +3364,7 @@ class LifecycleManager extends events.EventEmitter {
             this.serializationManager = new SerializationManager({
                 timeoutMs: this.config.logger?.serializerTimeoutMs,
                 sanitizeSensitiveData: this.config.masking?.enableDefaultRules !== false,
+                disableNativeAddon: this.config.logger?.disableNativeAddon ?? false,
                 onStepError: this.config.onStepError,
                 onSerializationFallback: this.config.onSerializationFallback,
             });

package/dist/index.d.ts

@@ -556,6 +556,11 @@ interface TransportOptions {
      * An optional name for the transport, useful for debugging.
      */
     name?: string;
+    /**
+     * When true, disables ANSI colors in console output (e.g. for CI or NO_COLOR).
+     * For NO_COLOR use: disableColors: process.env.NO_COLOR != null && process.env.NO_COLOR !== '' && process.env.NO_COLOR !== '0'
+     */
+    disableColors?: boolean;
 }
 /**
  * @class Transport
@@ -619,6 +624,8 @@ interface LoggerOptions {
     prettyPrint?: {
         enabled?: boolean;
     };
+    /** When true, the native addon is not loaded (pure JS serialization). Use for debugging or when the addon is not built. */
+    disableNativeAddon?: boolean;
 }
 interface MaskingConfig {
     rules?: MaskingRule[];
@@ -715,6 +722,8 @@ interface SerializationManagerConfig {
     sanitizationContext?: SanitizationConfig;
     /** If true, Pino-style: only first level; nested objects are stringified in Node (one stringify per value). Faster for entries with complex objects; output will have nested values as JSON string. */
     nativeShallow?: boolean;
+    /** When true, the native addon is not loaded (pure JS path). Set via logger.disableNativeAddon in init(). */
+    disableNativeAddon?: boolean;
     /** Optional: called when a pipeline step fails (e.g. hygiene). For observability. */
     onStepError?: (step: string, error: unknown) => void;
     /** Optional: called when native addon fails and we fall back to JS pipeline. For observability. */
@@ -787,6 +796,8 @@ declare class ConsoleTransport extends Transport {
  * @file src/logger/transports/optionalChalk.ts
  * @description Built-in chalk-like API using ANSI escape codes. No chalk dependency.
  * Used by ClassicConsoleTransport, PrettyConsoleTransport, CompactConsoleTransport, ColorfulConsoleTransport.
+ * Does not read process.env; pass disableColors from transport options (e.g. for NO_COLOR use
+ * disableColors: process.env.NO_COLOR != null && process.env.NO_COLOR !== '' && process.env.NO_COLOR !== '0').
  */
 /** Chalk-like API: chainable style that returns wrapped string when called. */
 type ChalkLike = {
@@ -808,7 +819,7 @@ type ChalkLike = {
 /**
  * @file src/logger/transports/BaseConsolePrettyTransport.ts
  * @description An abstract base class for console transports that provide colored, human-readable output.
- * Colors use built-in ANSI (no chalk dependency). Disabled when NO_COLOR is set or stdout is not a TTY.
+ * Colors use built-in ANSI (no chalk dependency). Disabled when options.disableColors is true or stdout is not a TTY.
  */
 
 /**

package/dist/index.mjs

@@ -841,6 +841,7 @@ const validateLoggerOptions = object({
     prettyPrint: optional(object({
         enabled: optional(isBoolean),
     })),
+    disableNativeAddon: optional(isBoolean),
 });
 const validateMasking = object({
     rules: optional(arrayOf(validateMaskingRule)),
@@ -1976,6 +1977,7 @@ class SerializationManager {
             enableMetrics: config.enableMetrics ?? true,
             sanitizeSensitiveData: config.sanitizeSensitiveData ?? true,
             nativeShallow: config.nativeShallow ?? false,
+            disableNativeAddon: config.disableNativeAddon ?? false,
             sanitizationContext: {
                 sensitiveFields: config.sanitizationContext?.sensitiveFields ||
                     getDefaultSensitiveFields(),
@@ -2020,7 +2022,7 @@ class SerializationManager {
         if (this.nativeChecked)
             return this.nativeAddon;
         this.nativeChecked = true;
-        if (process.env.SYNTROPYLOG_NATIVE_DISABLE === '1') {
+        if (this.config.disableNativeAddon) {
             this.nativeAddon = null;
             return null;
         }
@@ -2373,6 +2375,8 @@ class ConsoleTransport extends Transport {
  * @file src/logger/transports/optionalChalk.ts
  * @description Built-in chalk-like API using ANSI escape codes. No chalk dependency.
  * Used by ClassicConsoleTransport, PrettyConsoleTransport, CompactConsoleTransport, ColorfulConsoleTransport.
+ * Does not read process.env; pass disableColors from transport options (e.g. for NO_COLOR use
+ * disableColors: process.env.NO_COLOR != null && process.env.NO_COLOR !== '' && process.env.NO_COLOR !== '0').
  */
 const RESET = '\x1b[0m';
 function wrap(s, codes) {
@@ -2404,39 +2408,45 @@ function createChain(codes) {
     Object.defineProperty(fn, 'dim', { get: () => add(2), enumerable: true });
     return fn;
 }
-let cached = null;
+function createIdentityChalk() {
+    const identity = ((s) => s);
+    identity.white = identity;
+    identity.bold = identity;
+    identity.red = identity;
+    identity.bgRed = identity;
+    identity.yellow = identity;
+    identity.cyan = identity;
+    identity.green = identity;
+    identity.gray = identity;
+    identity.magenta = identity;
+    identity.blue = identity;
+    identity.bgWhite = identity;
+    identity.dim = identity;
+    return identity;
+}
+let cachedWithColors = null;
+let cachedNoColors = null;
 /**
  * Returns a chalk-like instance using built-in ANSI colors. No external chalk dependency.
- * Respects NO_COLOR and disables colors when stdout is not a TTY (e.g. pipes, CI).
+ * Does not read process.env. Pass disableColors from transport options; when true, output has no colors.
+ * When false, colors are used only if stdout is a TTY. To respect NO_COLOR, pass
+ * disableColors: process.env.NO_COLOR != null && process.env.NO_COLOR !== '' && process.env.NO_COLOR !== '0'.
  */
-function getOptionalChalk() {
-    if (cached !== null) {
-        return cached;
+function getOptionalChalk(disableColors) {
+    if (disableColors) {
+        if (cachedNoColors === null)
+            cachedNoColors = createIdentityChalk();
+        return cachedNoColors;
     }
-    const noColor = process.env.NO_COLOR !== undefined &&
-        process.env.NO_COLOR !== '' &&
-        process.env.NO_COLOR !== '0';
     const isTTY = typeof process.stdout?.isTTY === 'boolean' && process.stdout.isTTY;
-    if (noColor || !isTTY) {
-        const identity = ((s) => s);
-        identity.white = identity;
-        identity.bold = identity;
-        identity.red = identity;
-        identity.bgRed = identity;
-        identity.yellow = identity;
-        identity.cyan = identity;
-        identity.green = identity;
-        identity.gray = identity;
-        identity.magenta = identity;
-        identity.blue = identity;
-        identity.bgWhite = identity;
-        identity.dim = identity;
-        cached = identity;
-    }
-    else {
-        cached = createChain([]);
-    }
-    return cached;
+    if (!isTTY) {
+        if (cachedNoColors === null)
+            cachedNoColors = createIdentityChalk();
+        return cachedNoColors;
+    }
+    if (cachedWithColors === null)
+        cachedWithColors = createChain([]);
+    return cachedWithColors;
 }
 
 /**
@@ -2449,7 +2459,7 @@ function getOptionalChalk() {
 class BaseConsolePrettyTransport extends Transport {
     constructor(options) {
         super(options);
-        this.chalk = getOptionalChalk();
+        this.chalk = getOptionalChalk(options?.disableColors ?? false);
     }
     /**
      * The core log method. It handles common logic and delegates specific
@@ -3021,6 +3031,7 @@ class LoggerFactory {
         this.serializationManager = new SerializationManager({
             timeoutMs: config.logger?.serializerTimeoutMs,
             sanitizeSensitiveData: config.masking?.enableDefaultRules !== false,
+            disableNativeAddon: config.logger?.disableNativeAddon ?? false,
             onStepError: config.onStepError,
             onSerializationFallback: config.onSerializationFallback,
         });
@@ -3331,6 +3342,7 @@ class LifecycleManager extends EventEmitter {
             this.serializationManager = new SerializationManager({
                 timeoutMs: this.config.logger?.serializerTimeoutMs,
                 sanitizeSensitiveData: this.config.masking?.enableDefaultRules !== false,
+                disableNativeAddon: this.config.logger?.disableNativeAddon ?? false,
                 onStepError: this.config.onStepError,
                 onSerializationFallback: this.config.onSerializationFallback,
             });

package/dist/testing/index.d.ts

@@ -351,6 +351,11 @@ interface TransportOptions {
      * An optional name for the transport, useful for debugging.
      */
     name?: string;
+    /**
+     * When true, disables ANSI colors in console output (e.g. for CI or NO_COLOR).
+     * For NO_COLOR use: disableColors: process.env.NO_COLOR != null && process.env.NO_COLOR !== '' && process.env.NO_COLOR !== '0'
+     */
+    disableColors?: boolean;
 }
 /**
  * @class Transport

package/dist/types/config.schema.d.ts

@@ -23,6 +23,8 @@ export interface LoggerOptions {
     prettyPrint?: {
         enabled?: boolean;
     };
+    /** When true, the native addon is not loaded (pure JS serialization). Use for debugging or when the addon is not built. */
+    disableNativeAddon?: boolean;
 }
 export interface MaskingConfig {
     rules?: MaskingRule[];

package/dist/types/logger/transports/BaseConsolePrettyTransport.d.ts

@@ -1,7 +1,7 @@
 /**
  * @file src/logger/transports/BaseConsolePrettyTransport.ts
  * @description An abstract base class for console transports that provide colored, human-readable output.
- * Colors use built-in ANSI (no chalk dependency). Disabled when NO_COLOR is set or stdout is not a TTY.
+ * Colors use built-in ANSI (no chalk dependency). Disabled when options.disableColors is true or stdout is not a TTY.
  */
 import { LogEntry } from '../../types';
 import { LogLevel } from '../levels';

package/dist/types/logger/transports/Transport.d.ts

@@ -30,6 +30,11 @@ export interface TransportOptions {
      * An optional name for the transport, useful for debugging.
      */
     name?: string;
+    /**
+     * When true, disables ANSI colors in console output (e.g. for CI or NO_COLOR).
+     * For NO_COLOR use: disableColors: process.env.NO_COLOR != null && process.env.NO_COLOR !== '' && process.env.NO_COLOR !== '0'
+     */
+    disableColors?: boolean;
 }
 /**
  * @class Transport

package/dist/types/logger/transports/optionalChalk.d.ts

@@ -2,6 +2,8 @@
  * @file src/logger/transports/optionalChalk.ts
  * @description Built-in chalk-like API using ANSI escape codes. No chalk dependency.
  * Used by ClassicConsoleTransport, PrettyConsoleTransport, CompactConsoleTransport, ColorfulConsoleTransport.
+ * Does not read process.env; pass disableColors from transport options (e.g. for NO_COLOR use
+ * disableColors: process.env.NO_COLOR != null && process.env.NO_COLOR !== '' && process.env.NO_COLOR !== '0').
  */
 /** Chalk-like API: chainable style that returns wrapped string when called. */
 export type ChalkLike = {
@@ -21,6 +23,8 @@ export type ChalkLike = {
 };
 /**
  * Returns a chalk-like instance using built-in ANSI colors. No external chalk dependency.
- * Respects NO_COLOR and disables colors when stdout is not a TTY (e.g. pipes, CI).
+ * Does not read process.env. Pass disableColors from transport options; when true, output has no colors.
+ * When false, colors are used only if stdout is a TTY. To respect NO_COLOR, pass
+ * disableColors: process.env.NO_COLOR != null && process.env.NO_COLOR !== '' && process.env.NO_COLOR !== '0'.
  */
-export declare function getOptionalChalk(): ChalkLike;
+export declare function getOptionalChalk(disableColors: boolean): ChalkLike;

package/dist/types/serialization/SerializationManager.d.ts

@@ -15,6 +15,8 @@ export interface SerializationManagerConfig {
     sanitizationContext?: SanitizationConfig;
     /** If true, Pino-style: only first level; nested objects are stringified in Node (one stringify per value). Faster for entries with complex objects; output will have nested values as JSON string. */
     nativeShallow?: boolean;
+    /** When true, the native addon is not loaded (pure JS path). Set via logger.disableNativeAddon in init(). */
+    disableNativeAddon?: boolean;
     /** Optional: called when a pipeline step fails (e.g. hygiene). For observability. */
     onStepError?: (step: string, error: unknown) => void;
     /** Optional: called when native addon fails and we fall back to JS pipeline. For observability. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "syntropylog",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "engines": {
     "node": ">=20.0.0"
   },