syntropylog 0.9.11 → 0.9.13

package/CHANGELOG.md

@@ -1,5 +1,41 @@
 # Changelog
 
+## 0.9.13
+
+### Patch Changes
+
+- a1498cb: - **MaskingEngine**: On masking failure (timeout/error), return a safe fallback payload with `_maskingFailed` and allowed keys only (`level`, `timestamp`, `message`, `service`) instead of raw metadata to avoid leaking sensitive data.
+  - **RedisConnectionManager**: Call `removeAllListeners()` when client was never open in `disconnect()` to avoid listener leaks.
+  - **RedisManager**: Clear `instances` and `defaultInstance` in `shutdown()` after closing connections.
+- eca5f56: **Fix: ~3–6s delay per log call (logger.info/warn/error)**
+  - **Cause**: `MaskingEngine` used the `regex-test` package for every key×rule check. That package runs each test in a child-process worker with a single queue, so many sequential IPC round-trips added up to several seconds per log.
+  - **Change**: Built-in default rules (password, email, token, credit_card, SSN, phone) now use synchronous `RegExp.test()` in-process; they use safe, known patterns with no ReDoS risk. Custom rules added via `masking.rules` still use `regex-test` with timeout for safety.
+  - **Result**: Log calls complete in milliseconds again. README documents the behavior under "Data Masking → Performance".
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+_Nothing at the moment._
+
+## [0.9.12] - 2026-03-07
+
+### Security
+
+- **loadLoggerConfig**: Use js-yaml's `JSON_SCHEMA` when parsing YAML files to avoid prototype pollution and dangerous types. Use only with configuration files under deployment team control.
+
+### Fixed
+
+- **LifecycleManager**: `MaskingEngine.shutdown()` is now invoked during framework shutdown so the regex-test worker is cleaned up and process leaks are avoided. Defensive optional chaining used when the manager is not in READY state.
+- **RedisConnectionManager**: Call `removeAllListeners()` on the Redis client before `quit()` in `disconnect()` for clean teardown and to avoid retaining listener references.
+
+### Documentation
+
+- **Audit reports**: Added `INFORME_TECH_LEAD_AUDITORIA_LIBRERIA.md` with full audit for enterprise adoption (security, memory, performance, dependencies). Complements existing `INFORME_AUDITORIA_SEGURIDAD_RENDIMIENTO.md`.
+
 ## 0.9.11
 
 ### Patch Changes
@@ -42,11 +78,6 @@
 - Security: Removed example IPs and URLs (e.g. 192.168.1.1, example.com) from source code, tests, and documentation to resolve Socket.dev supply chain security warnings.
   Docs: Updated test coverage badge to 92.48%.
 
-All notable changes to this project will be documented in this file.
-
-The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
-and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
-
 ## [0.9.5] - 2026-03-07
 
 ### 🔧 Maintenance

package/CONTRIBUTING.md

@@ -86,6 +86,16 @@ We welcome code contributions! To contribute code, please follow these steps:
 - Keep API documentation current
 - Include usage examples
 
+## Release process (maintainers)
+
+Releases use [Changesets](https://github.com/changesets/changesets) and GitHub Actions:
+
+1. **Add a changeset** when changing the library: `pnpm changeset` (choose version type and describe the change).
+2. **Push to `main`** (or merge a PR that includes the changeset). The Release workflow runs and:
+   - Creates a **"Version Packages"** PR with the version bump (e.g. 0.9.12 → 0.9.13) and CHANGELOG updates.
+   - **Publishes to npm** from that same run (so npm may already have the new version).
+3. **Merge the "Version Packages" PR** into `main`. This step is required so that `main` has the same `package.json` version and CHANGELOG as what was published to npm. If you skip it, `main` will stay on the old version while npm has the new one.
+
 ## Getting Help
 
 If you need help with your contribution, please:

package/README.md

@@ -17,7 +17,7 @@
   <a href="https://github.com/Syntropysoft/SyntropyLog/blob/main/LICENSE"><img src="https://img.shields.io/npm/l/syntropylog.svg" alt="License"></a>
   <a href="https://github.com/Syntropysoft/SyntropyLog/actions/workflows/ci.yaml"><img src="https://github.com/Syntropysoft/SyntropyLog/actions/workflows/ci.yaml/badge.svg" alt="CI Status"></a>
   <a href="#"><img src="https://img.shields.io/badge/coverage-92.47%25-brightgreen" alt="Test Coverage"></a>
-  <a href="#"><img src="https://img.shields.io/badge/status-v0.9.10-brightgreen.svg" alt="Version 0.9.10"></a>
+  <a href="#"><img src="https://img.shields.io/badge/status-v0.9.12-brightgreen.svg" alt="Version 0.9.12"></a>
   <a href="https://socket.dev/npm/package/syntropylog"><img src="https://socket.dev/api/badge/npm/package/syntropylog" alt="Socket Badge"></a>
 </p>
 
@@ -446,6 +446,8 @@ await syntropyLog.init({
 
 > **Silent Observer guarantee**: if the masking engine fails for any reason, it returns the original object and the application keeps running — it never throws.
 
+**Performance**: Built-in rules use synchronous regex matching (safe, known patterns). Custom rules you add still use the timeout-protected `regex-test` worker to guard against ReDoS. This avoids the ~3–6s delay per log that occurred when every key was tested via the worker queue.
+
 ---
 
 ## 💾 Universal Persistence — Log to Any Database

package/dist/config/loadLoggerConfig.js

@@ -10,6 +10,11 @@ import path from 'path';
  *
  * It does NOT read environment variables directly; all state must be passed via `opts`.
  * If no file is found, it returns an empty object, making the config file optional.
+ *
+ * **Security:** A restricted schema (JSON_SCHEMA) is used to avoid prototype pollution
+ * and dangerous types. Only use with configuration files under deployment team
+ * control (controlled paths and permissions).
+ *
  * @param opts - Options to customize the loading behavior.
  * @returns A partial `LoggerOptions` object, or an empty object if no file is found.
  * @throws An error if a config file is found but fails to be read or parsed.
@@ -40,9 +45,11 @@ export function loadLoggerConfig(opts) {
         return {};
     }
     try {
-        // Load and parse the YAML file.
+        // Load and parse the YAML file with restricted schema (avoids prototype pollution / unsafe types).
         const fileContents = fs.readFileSync(configPath, 'utf8');
-        const yamlConfig = yaml.load(fileContents);
+        const yamlConfig = yaml.load(fileContents, {
+            schema: yaml.JSON_SCHEMA,
+        });
         // If the YAML has the config under a 'logger' key, extract it.
         // Otherwise, assume the root object is the configuration.
         return yamlConfig?.logger || yamlConfig || {};

package/dist/config/loadLoggerConfig.js.map

@@ -1 +1 @@
-{"version":3,"file":"loadLoggerConfig.js","sourceRoot":"","sources":["../../src/config/loadLoggerConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,SAAS,CAAC;AAC3B,OAAO,IAAI,MAAM,MAAM,CAAC;AA8BxB;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAgC;IAEhC,MAAM,EACJ,UAAU,EAAE,kBAAkB,EAC9B,WAAW,EACX,SAAS,GAAG,UAAU,EACtB,WAAW,GAAG,QAAQ,GACvB,GAAG,IAAI,IAAI,EAAE,CAAC;IAEf,yCAAyC;IACzC,IAAI,UAA8B,CAAC;IACnC,IAAI,kBAAkB,IAAI,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC5D,UAAU,GAAG,kBAAkB,CAAC;IAClC,CAAC;IAED,oEAAoE;IACpE,IAAI,CAAC,UAAU,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAC/B,SAAS,EACT,GAAG,WAAW,IAAI,WAAW,OAAO,CACrC,CAAC;QACF,IAAI,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YACnC,UAAU,GAAG,eAAe,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,WAAW,OAAO,CAAC,CAAC;QAChE,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,UAAU,GAAG,WAAW,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,gCAAgC;QAChC,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,CAGjC,CAAC;QAET,+DAA+D;QAC/D,0DAA0D;QAC1D,OAAO,UAAU,EAAE,MAAM,IAAI,UAAU,IAAI,EAAE,CAAC;IAChD,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,sDAAsD,UAAU,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9H,CAAC;IACJ,CAAC;AACH,CAAC"}
+{"version":3,"file":"loadLoggerConfig.js","sourceRoot":"","sources":["../../src/config/loadLoggerConfig.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,SAAS,CAAC;AAC3B,OAAO,IAAI,MAAM,MAAM,CAAC;AA8BxB;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,gBAAgB,CAC9B,IAAgC;IAEhC,MAAM,EACJ,UAAU,EAAE,kBAAkB,EAC9B,WAAW,EACX,SAAS,GAAG,UAAU,EACtB,WAAW,GAAG,QAAQ,GACvB,GAAG,IAAI,IAAI,EAAE,CAAC;IAEf,yCAAyC;IACzC,IAAI,UAA8B,CAAC;IACnC,IAAI,kBAAkB,IAAI,EAAE,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;QAC5D,UAAU,GAAG,kBAAkB,CAAC;IAClC,CAAC;IAED,oEAAoE;IACpE,IAAI,CAAC,UAAU,IAAI,WAAW,EAAE,CAAC;QAC/B,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAC/B,SAAS,EACT,GAAG,WAAW,IAAI,WAAW,OAAO,CACrC,CAAC;QACF,IAAI,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;YACnC,UAAU,GAAG,eAAe,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,0DAA0D;IAC1D,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,WAAW,OAAO,CAAC,CAAC;QAChE,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,UAAU,GAAG,WAAW,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,+EAA+E;IAC/E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,mGAAmG;QACnG,MAAM,YAAY,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE;YACzC,MAAM,EAAE,IAAI,CAAC,WAAW;SACzB,CAAmC,CAAC;QAErC,+DAA+D;QAC/D,0DAA0D;QAC1D,OAAO,UAAU,EAAE,MAAM,IAAI,UAAU,IAAI,EAAE,CAAC;IAChD,CAAC;IAAC,OAAO,KAAc,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,sDAAsD,UAAU,KAAK,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAC9H,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/core/LifecycleManager.js

@@ -119,6 +119,8 @@ export class LifecycleManager extends EventEmitter {
         this.logger?.info('🔄 State changed to SHUTTING_DOWN');
         try {
             this.logger?.info('Shutting down SyntropyLog framework...');
+            // Shutdown MaskingEngine first so regex-test worker is cleaned (avoids process leak)
+            this.maskingEngine?.shutdown?.();
             const shutdownPromises = [
                 this.redisManager?.shutdown(),
                 this.loggerFactory?.shutdown?.(),

package/dist/core/LifecycleManager.js.map

@@ -1 +1 @@
-{"version":3,"file":"LifecycleManager.js","sourceRoot":"","sources":["../../src/core/LifecycleManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEtC,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAE/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAmB,MAAM,YAAY,CAAC;AAE7D,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAU5C,+CAA+C;AAC/C,MAAM,gBAAgB,GAAG,KAAK,EAC5B,YAA0B,EAC1B,MAAsB,EACP,EAAE;IACjB,IAAI,CAAC,YAAY,CAAC,SAAS,IAAI,YAAY,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC9D,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC;IAC7B,MAAM,EAAE,KAAK,CAAC,8BAA8B,GAAG,KAAK,CAAC,CAAC;IAEtD,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAE7B,yCAAyC;IACzC,MAAM,YAAY,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,OAAO,EAAE,CAAC;YACV,YAAY,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC,CAAC;QACF,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAE1E,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IAE5C,IAAI,YAAY,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,EAAE,IAAI,CACV,WAAW,GAAG,iDAAiD,CAChE,CAAC;QACF,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,KAAK,CAAC,WAAW,GAAG,oBAAoB,CAAC,CAAC;IACpD,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,OAAO,gBAAiB,SAAQ,YAAY;IACxC,KAAK,GAAqB,iBAAiB,CAAC;IAC7C,MAAM,CAAgC;IACtC,cAAc,CAA8B;IAC5C,aAAa,CAA4B;IACzC,YAAY,CAA2B;IACvC,oBAAoB,CAAuB;IAC3C,aAAa,CAAgB;IAC5B,MAAM,GAAmB,IAAI,CAAC;IAC9B,cAAc,CAAc;IAC5B,gBAAgB,GAAG,IAAI,GAAG,EAAgB,CAAC;IAEnD,YAAY,cAA2B;QACrC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,mEAAmE;QACnE,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC,oBAAoB,GAAG,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,aAAa,GAAG,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;IAEM,QAAQ;QACb,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,MAAyB;QACzC,IAAI,IAAI,CAAC,KAAK,KAAK,iBAAiB,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,EAAE,IAAI,CACf,kDAAkD,IAAI,CAAC,KAAK,8BAA8B,CAC3F,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,cAAc,CAAC;QAE5B,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC3D,MAAM,eAAe,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC;YAE9B,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACpE,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACrD,CAAC;YAED,IAAI,CAAC,oBAAoB,GAAG,IAAI,oBAAoB,CAAC;gBACnD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB;gBAClD,qBAAqB,EACnB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,kBAAkB,KAAK,KAAK;aACpD,CAAC,CAAC;YAEH,IAAI,CAAC,aAAa,GAAG,IAAI,aAAa,CAAC;gBACrC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK;gBACjC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ;gBACvC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc;gBACnD,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,kBAAkB,KAAK,KAAK;aACtE,CAAC,CAAC;YAEH,IAAI,CAAC,aAAa,GAAG,IAAI,aAAa,CACpC,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,cAAc,CACpB,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YAErB,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACtB,IAAI,CAAC;oBACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;oBAC/D,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAClC,IAAI,CAAC,MAAM,CAAC,KAAK,EACjB,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,EAClC,IAAI,CAAC,cAAc,CACpB,CAAC;oBACF,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;gBAC3B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CACV,2EAA2E,EAC3E,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CACnC,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;YAC/D,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAE1B,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;gBAC9B,OAAO,CAAC,KAAK,CACX,gDAAgD,EAChD,KAAK,CAAC,MAAM,CACb,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,KAAK,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,QAAQ;QACnB,IAAI,CAAC,MAAM,EAAE,IAAI,CACf,yDAAyD,IAAI,CAAC,KAAK,EAAE,CACtE,CAAC;QAEF,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,EAAE,IAAI,CACf,6CAA6C,IAAI,CAAC,KAAK,EAAE,CAC1D,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,eAAe,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,mCAAmC,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,wCAAwC,CAAC,CAAC;YAE5D,MAAM,gBAAgB,GAAG;gBACvB,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE;gBAC7B,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,EAAE;aACjC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAElB,IAAI,CAAC,MAAM,EAAE,IAAI,CACf,gBAAgB,gBAAgB,CAAC,MAAM,uBAAuB,CAC/D,CAAC;YACF,MAAM,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAEnD,kEAAkE;YAClE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,6CAA6C,CAAC,CAAC;YACjE,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC;YAExC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,mCAAmC,CAAC,CAAC;YACvD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtB,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,6BAA6B,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,0BAA0B,EAAE;gBAC7C,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,oBAAoB,CAAC,YAA0B;QACpD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAExC,qCAAqC;QACrC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YAC3B,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,0BAA0B;QACtC,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,4CAA4C,CAAC,CAAC;gBAChE,OAAO;YACT,CAAC;YAED,IAAI,CAAC,MAAM,EAAE,IAAI,CACf,eAAe,IAAI,CAAC,gBAAgB,CAAC,IAAI,wBAAwB,CAClE,CAAC;YAEF,MAAM,mBAAmB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC/D,CAAC,YAAY,EAAE,EAAE,CAAC,gBAAgB,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,CAC9D,CAAC;YAEF,MAAM,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;YAC9C,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,uCAAuC,EAAE;gBACzD,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,WAAW;QAMhB,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,6CAA6C,IAAI,CAAC,KAAK,iFAAiF,CACzI,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"LifecycleManager.js","sourceRoot":"","sources":["../../src/core/LifecycleManager.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAEtC,OAAO,EAAE,QAAQ,EAAE,MAAM,KAAK,CAAC;AAE/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAmB,MAAM,YAAY,CAAC;AAE7D,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AAExD,OAAO,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,uCAAuC,CAAC;AAC7E,OAAO,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAEzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,UAAU,CAAC;AAU5C,+CAA+C;AAC/C,MAAM,gBAAgB,GAAG,KAAK,EAC5B,YAA0B,EAC1B,MAAsB,EACP,EAAE;IACjB,IAAI,CAAC,YAAY,CAAC,SAAS,IAAI,YAAY,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QAC9D,OAAO;IACT,CAAC;IAED,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC;IAC7B,MAAM,EAAE,KAAK,CAAC,8BAA8B,GAAG,KAAK,CAAC,CAAC;IAEtD,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAE7B,yCAAyC;IACzC,MAAM,YAAY,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE;QACjD,MAAM,MAAM,GAAG,GAAG,EAAE;YAClB,OAAO,EAAE,CAAC;YACV,YAAY,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC9C,CAAC,CAAC;QACF,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;IAE1E,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC,CAAC;IAE5C,IAAI,YAAY,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACnC,MAAM,EAAE,IAAI,CACV,WAAW,GAAG,iDAAiD,CAChE,CAAC;QACF,YAAY,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,KAAK,CAAC,WAAW,GAAG,oBAAoB,CAAC,CAAC;IACpD,CAAC;AACH,CAAC,CAAC;AAEF,MAAM,OAAO,gBAAiB,SAAQ,YAAY;IACxC,KAAK,GAAqB,iBAAiB,CAAC;IAC7C,MAAM,CAAgC;IACtC,cAAc,CAA8B;IAC5C,aAAa,CAA4B;IACzC,YAAY,CAA2B;IACvC,oBAAoB,CAAuB;IAC3C,aAAa,CAAgB;IAC5B,MAAM,GAAmB,IAAI,CAAC;IAC9B,cAAc,CAAc;IAC5B,gBAAgB,GAAG,IAAI,GAAG,EAAgB,CAAC;IAEnD,YAAY,cAA2B;QACrC,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,cAAc,GAAG,cAAc,CAAC;QACrC,mEAAmE;QACnE,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QACjB,IAAI,CAAC,oBAAoB,GAAG,IAAI,oBAAoB,CAAC,EAAE,CAAC,CAAC;QACzD,IAAI,CAAC,aAAa,GAAG,IAAI,aAAa,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC;IAEM,QAAQ;QACb,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAEM,KAAK,CAAC,IAAI,CAAC,MAAyB;QACzC,IAAI,IAAI,CAAC,KAAK,KAAK,iBAAiB,EAAE,CAAC;YACrC,IAAI,CAAC,MAAM,EAAE,IAAI,CACf,kDAAkD,IAAI,CAAC,KAAK,8BAA8B,CAC3F,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,cAAc,CAAC;QAE5B,IAAI,CAAC;YACH,MAAM,YAAY,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;YAC3D,MAAM,eAAe,GAAG,cAAc,CAAC,YAAY,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC;YAE9B,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;YACpE,IAAI,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,cAAc,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YACrD,CAAC;YAED,IAAI,CAAC,oBAAoB,GAAG,IAAI,oBAAoB,CAAC;gBACnD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB;gBAClD,qBAAqB,EACnB,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,kBAAkB,KAAK,KAAK;aACpD,CAAC,CAAC;YAEH,IAAI,CAAC,aAAa,GAAG,IAAI,aAAa,CAAC;gBACrC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK;gBACjC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ;gBACvC,cAAc,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,cAAc;gBACnD,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,kBAAkB,KAAK,KAAK;aACtE,CAAC,CAAC;YAEH,IAAI,CAAC,aAAa,GAAG,IAAI,aAAa,CACpC,IAAI,CAAC,MAAM,EACX,IAAI,CAAC,cAAc,EACnB,IAAI,CAAC,cAAc,CACpB,CAAC;YACF,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;YAChE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;YAErB,IAAI,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACtB,IAAI,CAAC;oBACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;oBAC/D,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAClC,IAAI,CAAC,MAAM,CAAC,KAAK,EACjB,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC,EAClC,IAAI,CAAC,cAAc,CACpB,CAAC;oBACF,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;gBAC3B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,KAAK,CACV,2EAA2E,EAC3E,EAAE,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CACnC,CAAC;gBACJ,CAAC;YACH,CAAC;YAED,MAAM,CAAC,IAAI,CAAC,iDAAiD,CAAC,CAAC;YAC/D,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAE1B,IAAI,KAAK,YAAY,QAAQ,EAAE,CAAC;gBAC9B,OAAO,CAAC,KAAK,CACX,gDAAgD,EAChD,KAAK,CAAC,MAAM,CACb,CAAC;YACJ,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,KAAK,CAAC,+CAA+C,EAAE,KAAK,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,KAAK,CAAC;QACd,CAAC;IACH,CAAC;IAEM,KAAK,CAAC,QAAQ;QACnB,IAAI,CAAC,MAAM,EAAE,IAAI,CACf,yDAAyD,IAAI,CAAC,KAAK,EAAE,CACtE,CAAC;QAEF,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YAC3B,IAAI,CAAC,MAAM,EAAE,IAAI,CACf,6CAA6C,IAAI,CAAC,KAAK,EAAE,CAC1D,CAAC;YACF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,eAAe,CAAC;QAC7B,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,mCAAmC,CAAC,CAAC;QAEvD,IAAI,CAAC;YACH,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,wCAAwC,CAAC,CAAC;YAE5D,qFAAqF;YACrF,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,EAAE,CAAC;YAEjC,MAAM,gBAAgB,GAAG;gBACvB,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE;gBAC7B,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,EAAE;aACjC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAElB,IAAI,CAAC,MAAM,EAAE,IAAI,CACf,gBAAgB,gBAAgB,CAAC,MAAM,uBAAuB,CAC/D,CAAC;YACF,MAAM,OAAO,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;YAC3C,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,+BAA+B,CAAC,CAAC;YAEnD,kEAAkE;YAClE,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,6CAA6C,CAAC,CAAC;YACjE,MAAM,IAAI,CAAC,0BAA0B,EAAE,CAAC;YAExC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,mCAAmC,CAAC,CAAC;YACvD,IAAI,CAAC,KAAK,GAAG,UAAU,CAAC;YACxB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACtB,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,6BAA6B,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,KAAK,GAAG,OAAO,CAAC;YACrB,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,0BAA0B,EAAE;gBAC7C,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED;;;;OAIG;IACI,oBAAoB,CAAC,YAA0B;QACpD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QAExC,qCAAqC;QACrC,YAAY,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YAC3B,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,0BAA0B;QACtC,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,4CAA4C,CAAC,CAAC;gBAChE,OAAO;YACT,CAAC;YAED,IAAI,CAAC,MAAM,EAAE,IAAI,CACf,eAAe,IAAI,CAAC,gBAAgB,CAAC,IAAI,wBAAwB,CAClE,CAAC;YAEF,MAAM,mBAAmB,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,CAC/D,CAAC,YAAY,EAAE,EAAE,CAAC,gBAAgB,CAAC,YAAY,EAAE,IAAI,CAAC,MAAM,CAAC,CAC9D,CAAC;YAEF,MAAM,OAAO,CAAC,UAAU,CAAC,mBAAmB,CAAC,CAAC;YAC9C,IAAI,CAAC,gBAAgB,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAC3D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,uCAAuC,EAAE;gBACzD,KAAK,EAAE,gBAAgB,CAAC,KAAK,CAAC;aAC/B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAEM,WAAW;QAMhB,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YAC3B,MAAM,IAAI,KAAK,CACb,6CAA6C,IAAI,CAAC,KAAK,iFAAiF,CACzI,CAAC;QACJ,CAAC;IACH,CAAC;CACF"}

package/dist/index.cjs

@@ -150,36 +150,42 @@ class MaskingEngine {
                 strategy: MaskingStrategy.CREDIT_CARD,
                 preserveLength: true,
                 maskChar: this.maskChar,
+                _isDefaultRule: true,
             },
             {
                 pattern: /ssn|social_security|security_number/i,
                 strategy: MaskingStrategy.SSN,
                 preserveLength: true,
                 maskChar: this.maskChar,
+                _isDefaultRule: true,
             },
             {
                 pattern: /email/i,
                 strategy: MaskingStrategy.EMAIL,
                 preserveLength: true,
                 maskChar: this.maskChar,
+                _isDefaultRule: true,
             },
             {
                 pattern: /phone|phone_number|mobile_number/i,
                 strategy: MaskingStrategy.PHONE,
                 preserveLength: true,
                 maskChar: this.maskChar,
+                _isDefaultRule: true,
             },
             {
                 pattern: /password|pass|pwd|secret/i,
                 strategy: MaskingStrategy.PASSWORD,
                 preserveLength: true,
                 maskChar: this.maskChar,
+                _isDefaultRule: true,
             },
             {
                 pattern: /token|api_key|auth_token|jwt|bearer/i,
                 strategy: MaskingStrategy.TOKEN,
                 preserveLength: true,
                 maskChar: this.maskChar,
+                _isDefaultRule: true,
             },
         ];
         for (const rule of defaultRules) {
@@ -206,8 +212,10 @@ class MaskingEngine {
     /**
      * Processes a metadata object and applies the configured masking rules.
      * Uses JSON flattening strategy for extreme performance.
+     * On failure (timeout, rule error, etc.) returns a safe redacted object with an explicit message
+     * instead of the original data, to avoid leaking sensitive content.
      * @param meta - The metadata object to process
-     * @returns A new object with the masked data
+     * @returns A new object with the masked data, or a safe fallback object if masking fails
      */
     async process(meta) {
         // Set initialized flag on first use
@@ -222,10 +230,28 @@ class MaskingEngine {
             return masked;
         }
         catch {
-            // Silent observer - return original data if masking fails
-            return meta;
+            // Do not return original data: emit a safe placeholder so sensitive payload is never logged
+            return {
+                ...MaskingEngine.buildSafeFallbackFromMeta(meta),
+                _maskingFailed: true,
+                _maskingFailedMessage: MaskingEngine.MASKING_FAILED_MESSAGE,
+            };
         }
     }
+    /**
+     * Builds a minimal safe object from meta (level, timestamp, message, service) for fallback.
+     * Avoids leaking any arbitrary keys/values when masking fails.
+     */
+    static buildSafeFallbackFromMeta(meta) {
+        const safe = {};
+        const allowedKeys = ['level', 'timestamp', 'message', 'service'];
+        for (const key of allowedKeys) {
+            if (key in meta && meta[key] !== undefined) {
+                safe[key] = meta[key];
+            }
+        }
+        return safe;
+    }
     /**
      * Applies masking rules to data recursively.
      * @param data - Data to mask
@@ -254,13 +280,20 @@ class MaskingEngine {
                     for (const rule of this.rules) {
                         let isMatch = false;
                         if (rule._compiledPattern) {
-                            try {
-                                // Use regex-test for safe execution with timeout
-                                isMatch = await this.regexTest.test(rule._compiledPattern, key);
+                            if (rule._isDefaultRule) {
+                                // Default rules use safe, known patterns (no ReDoS); sync test avoids
+                                // regex-test worker IPC queue which caused ~3–6s delay per log.
+                                isMatch = rule._compiledPattern.test(key);
                             }
-                            catch {
-                                // Silent failure on timeout/error - treat as no match
-                                isMatch = false;
+                            else {
+                                try {
+                                    // Custom rules: use regex-test for safe execution with timeout
+                                    isMatch = await this.regexTest.test(rule._compiledPattern, key);
+                                }
+                                catch {
+                                    // Silent failure on timeout/error - treat as no match
+                                    isMatch = false;
+                                }
                             }
                         }
                         if (isMatch) {
@@ -477,6 +510,8 @@ class MaskingEngine {
         }
     }
 }
+/** Message used when masking fails (e.g. timeout) so we never emit raw payload. */
+MaskingEngine.MASKING_FAILED_MESSAGE = '[SyntropyLog] Masking could not be applied (e.g. timeout or error); payload redacted for safety.';
 
 /**
  * FILE: src/config.schema.ts
@@ -2347,6 +2382,8 @@ class LifecycleManager extends events.EventEmitter {
         this.logger?.info('🔄 State changed to SHUTTING_DOWN');
         try {
             this.logger?.info('Shutting down SyntropyLog framework...');
+            // Shutdown MaskingEngine first so regex-test worker is cleaned (avoids process leak)
+            this.maskingEngine?.shutdown?.();
             const shutdownPromises = [
                 this.redisManager?.shutdown(),
                 this.loggerFactory?.shutdown?.(),
@@ -3283,6 +3320,9 @@ class RedisConnectionManager {
         if (this.client.isOpen) {
             this.logger.info('Attempting to quit client.');
             try {
+                if (typeof this.client.removeAllListeners === 'function') {
+                    this.client.removeAllListeners();
+                }
                 await this.client.quit();
             }
             catch (error) {
@@ -3291,6 +3331,10 @@ class RedisConnectionManager {
             }
         }
         else {
+            // Client never connected or already closed: remove listeners to avoid leak
+            if (typeof this.client.removeAllListeners === 'function') {
+                this.client.removeAllListeners();
+            }
             this.logger.info('Client was not open. Quit operation effectively complete.');
         }
     }
@@ -4532,6 +4576,8 @@ class RedisManager {
         this.logger.info('Closing all Redis connections...');
         const shutdownPromises = Array.from(this.instances.values()).map((instance) => instance.quit());
         await Promise.allSettled(shutdownPromises);
+        this.instances.clear();
+        this.defaultInstance = undefined;
         this.logger.info('All Redis connections have been closed.');
     }
 }