@forwardimpact/libtelemetry - npm Package Compare versions

Comparing version 0.1.38 to 0.1.39

package.json

 {
   "name": "@forwardimpact/libtelemetry",
-  "version": "0.1.38",
+  "version": "0.1.39",
   "description": "Structured RFC 5424 logging and trace spans for observable agent operations.",
@@ -12,2 +12,10 @@ "keywords": [
   ],
+  "homepage": "https://www.forwardimpact.team",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/forwardimpact/monorepo.git",
+    "directory": "libraries/libtelemetry"
+  },
+  "license": "Apache-2.0",
+  "author": "D. Olsson <[e-mail]>",
   "forwardimpact": {
@@ -20,4 +28,2 @@ "capability": "agent-infrastructure",
   },
-  "license": "Apache-2.0",
-  "author": "D. Olsson <[e-mail]>",
   "type": "module",
@@ -39,6 +45,2 @@ "main": "./src/index.js",
   ],
-  "engines": {
-    "bun": ">=1.2.0",
-    "node": ">=18.0.0"
-  },
   "scripts": {
@@ -55,2 +57,6 @@ "test": "bun test test/*.test.js"
   },
+  "engines": {
+    "bun": ">=1.2.0",
+    "node": ">=18.0.0"
+  },
   "publishConfig": {
@@ -57,0 +63,0 @@ "access": "public"

src/logger.js

 /**
+ * Numeric severity per syslog ordering. `info` is the default when LOG_LEVEL
+ * is unset, preserving the historical behavior where info() and error() both
+ * print and debug() is gated by the DEBUG env var. `trace` is accepted as an
+ * alias for `debug` so consumers used to other ecosystems don't trip.
+ */
+const LEVELS = { error: 0, warn: 1, info: 2, debug: 3, trace: 3 };
+const DEFAULT_LEVEL = "info";
+
+/**
  * Logger class for RFC 5424 compliant logging
@@ -7,2 +16,3 @@ */
   #enabled;
+  #level;
   #process;
@@ -22,2 +32,3 @@ #msgId = 0;
     this.#process = process;
+    this.#level = this.#resolveLevel();
     this.#enabled = this.#isEnabled();
@@ -68,3 +79,4 @@ }
   /**
-   * Logs a debug message if logging is enabled for this domain
+   * Logs a debug message when LOG_LEVEL is debug/trace, or when this logger's
+   * domain matches DEBUG.
    * @param {string} [appId] - Application identifier or method name
@@ -75,3 +87,3 @@ * @param {string} [message] - The log message
   debug(appId, message, attributes = {}) {
-    if (!this.#enabled) {
+    if (this.#level < LEVELS.debug && !this.#enabled) {
       return;
@@ -84,3 +96,3 @@ }
   /**
-   * Logs an info message (always outputs regardless of DEBUG setting)
+   * Logs an info message unless LOG_LEVEL is set below info (warn or error).
    * @param {string} [appId] - Application identifier or method name
@@ -91,2 +103,6 @@ * @param {string} [message] - The log message
   info(appId, message, attributes = {}) {
+    if (this.#level < LEVELS.info) {
+      return;
+    }
+
     console.error(this.#formatLine("INFO", appId, message, attributes));
@@ -96,3 +112,3 @@ }
   /**
-   * Logs an error message (always outputs regardless of DEBUG setting)
+   * Logs an error message (always outputs regardless of LOG_LEVEL).
    * @param {string} [appId] - Application identifier or method name
@@ -129,4 +145,5 @@ * @param {string|Error} [message] - Error message or Error object
 
-    // Append stack trace if available and logging is enabled
-    if (this.#enabled && error?.stack) {
+    // Append stack trace if available and debug output is on (either DEBUG
+    // domain match or LOG_LEVEL=debug/trace).
+    if ((this.#enabled || this.#level >= LEVELS.debug) && error?.stack) {
       message += "\n" + error.stack;
@@ -185,2 +202,13 @@ }
   /**
+   * Resolves the numeric LOG_LEVEL threshold from the environment, falling
+   * back to the default when unset or unrecognized.
+   * @returns {number} Numeric level
+   * @private
+   */
+  #resolveLevel() {
+    const raw = (this.#process.env.LOG_LEVEL || "").toLowerCase().trim();
+    return LEVELS[raw] ?? LEVELS[DEFAULT_LEVEL];
+  }
+
+  /**
    * Checks if logging is enabled for this domain based on DEBUG environment variable
@@ -187,0 +215,0 @@ * @returns {boolean} Whether logging is enabled

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Fixed alerts

No repository

Supply chain risk

Package does not have a linked source code repository. Without this field, a package will have no reference to the location of the source code use to generate the package.

Found 1 instance in 1 package

No website

Quality

Package does not have a website.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

67158

1.86%

Lines of code

1528

1.66%

Number of low quality alerts

1

-50%

No dependency changes