app_factory_logging

Releases

1. ▸▾0.2.08 Sept 2026

   Fixed default credential and Authorization/Cookie header redaction for quoted JSON-style keys (including whitespace, case variants, and escaped quoted

   • Fixed default credential and Authorization/Cookie header redaction for quoted JSON-style keys (including whitespace, case variants, and escaped quoted values) before all outputs.
   • Added the app.runtime-log.v1 structured event contract, stable eventName, one-line JSON framing, optional stage/action/status/duration, correlation IDs, error codes, bounded JSON-safe attributes, and a published JSON Schema.
   • Added centralized fail-closed sanitization for messages, errors, stack traces, attributes, console output, FakeAppLogger, and sinks. The default redactor covers common credentials, Authorization/Cookie values, URL query and fragment data, emails, and phone numbers.
   • Added AppLogEventSink and appLogEventSinkProvider for sanitized event capture without adding a remote logging implementation.
   • Added SanitizingAppLogger for bounded brownfield adaptation of existing custom logging backends.
   • Changed AppLoggerProviderObserver.include to filter every callback and stopped serializing provider values.
   • Changed debugChunked to sanitize the complete input before splitting and cap the number of chunks. Complete response or user payload logging is no longer a supported use case.
   • Kept legacy AppLogger call sites and AppLogSink.write source-compatible. Built-in fakes and sinks now receive sanitized error/stack text, so callers must not rely on original object identity. ConsoleAppLogger.maxMessageLength is now restricted to the Schema range of 0–4096 characters.
   • Enforced configured field and whole-event bounds after truncation, rejected processor settings outside the published Schema contract, and added runtime JSON Schema contract tests for normal, fallback, invalid, deep, and oversized events.

   Open source →