@open-mercato/core 0.6.6-develop.6460.1.f94c74174c → 0.6.6-develop.6471.1.9ab5bdd79a

package/src/helpers/integration/auth.ts

@@ -1,4 +1,4 @@
-import { type Page } from '@playwright/test';
+import { type Page, type Response } from '@playwright/test';
 import { readFileSync } from 'fs';
 import { resolve } from 'path';
 
@@ -136,102 +136,194 @@ async function recoverGenericErrorPageIfPresent(page: Page): Promise<void> {
   await dismissGlobalNoticesIfPresent(page);
 }
 
-export async function login(page: Page, role: Role = 'admin'): Promise<void> {
-  const creds = DEFAULT_CREDENTIALS[role];
-  const loginReadySelector = 'form[data-auth-ready="1"]';
-  const hasBackendUrl = (): boolean => /\/backend(?:\/.*)?$/.test(page.url());
-  const waitForBackend = async (timeout: number): Promise<boolean> => {
-    try {
-      await page.waitForURL(/\/backend(?:\/.*)?$/, { timeout });
-      return true;
-    } catch {
-      return hasBackendUrl();
-    }
-  };
+type AuthNavigationTraceEntry = {
+  path: string;
+  status: number;
+  location: string | null;
+};
 
-  await acknowledgeGlobalNotices(page);
-  const apiLoginForm = new URLSearchParams();
-  apiLoginForm.set('email', creds.email);
-  apiLoginForm.set('password', creds.password);
-  // Retry-on-429 against the auth rate limit (5/60s per email). Capped
-  // exponential backoff: 1s, 2s, 4s — worst-case ~7s.
-  let apiLoginResponse: Awaited<ReturnType<typeof page.request.post>> | null = null;
-  for (let retry = 0; retry < 4; retry += 1) {
-    apiLoginResponse = await page.request.post('/api/auth/login', {
-      headers: {
-        'content-type': 'application/x-www-form-urlencoded',
-      },
-      data: apiLoginForm.toString(),
-    }).catch(() => null);
-    if (!apiLoginResponse || apiLoginResponse.status() !== 429) break;
-    await new Promise((resolve) => setTimeout(resolve, 1000 * 2 ** retry));
+function toPathOnly(rawUrl: string): string {
+  try {
+    const url = new URL(rawUrl);
+    return `${url.pathname}${url.search}`;
+  } catch {
+    return '[unparseable-url]';
+  }
+}
+
+function toRedactedLocation(rawLocation: string | undefined): string | null {
+  if (!rawLocation) return null;
+  try {
+    const url = new URL(rawLocation, 'http://integration.local');
+    return `${url.pathname}${url.search}`;
+  } catch {
+    return '[unparseable-location]';
   }
-  if (apiLoginResponse?.ok()) {
-    const apiLoginBody = (await apiLoginResponse.json().catch(() => null)) as { token?: string } | null;
-    const claims = typeof apiLoginBody?.token === 'string' ? decodeJwtClaims(apiLoginBody.token) : null;
-    const baseUrl = process.env.BASE_URL || 'http://localhost:3000';
-    const cookies = [];
-    if (claims?.tenantId) {
-      cookies.push({
-        name: 'om_selected_tenant',
-        value: claims.tenantId,
-        url: baseUrl,
-        sameSite: 'Lax' as const,
+}
+
+function createAuthNavigationTrace(page: Page): {
+  entries: AuthNavigationTraceEntry[];
+  stop: () => void;
+} {
+  const entries: AuthNavigationTraceEntry[] = [];
+  const onResponse = (response: Response) => {
+    const path = toPathOnly(response.url());
+    if (path === '/backend' || path.startsWith('/api/auth/session/refresh')) {
+      entries.push({
+        path,
+        status: response.status(),
+        location: toRedactedLocation(response.headers().location),
       });
     }
-    if (claims?.orgId) {
-      cookies.push({
-        name: 'om_selected_org',
-        value: claims.orgId,
-        url: baseUrl,
-        sameSite: 'Lax' as const,
-      });
+  };
+  page.on('response', onResponse);
+  return {
+    entries,
+    stop: () => page.off('response', onResponse),
+  };
+}
+
+async function formatLoginDiagnostics(
+  page: Page,
+  role: Role,
+  entries: AuthNavigationTraceEntry[],
+): Promise<string> {
+  const cookieNames = Array.from(
+    new Set((await page.context().cookies()).map((cookie) => cookie.name)),
+  ).sort((left, right) => left.localeCompare(right));
+  const traceLines = entries.length
+    ? entries.map((entry) => {
+      const location = entry.location ? ` -> ${entry.location}` : '';
+      return `${entry.status} ${entry.path}${location}`;
+    })
+    : ['none'];
+
+  return [
+    `Login diagnostics for role "${role}":`,
+    `current URL: ${toPathOnly(page.url())}`,
+    `browser cookie names: ${cookieNames.length ? cookieNames.join(', ') : 'none'}`,
+    'backend/refresh trace:',
+    ...traceLines,
+  ].join('\n');
+}
+
+async function throwLoginErrorWithDiagnostics(
+  page: Page,
+  role: Role,
+  entries: AuthNavigationTraceEntry[],
+  error: unknown,
+): Promise<never> {
+  const message = error instanceof Error ? error.message : String(error);
+  throw new Error([
+    `Login did not reach backend for role: ${role}.`,
+    await formatLoginDiagnostics(page, role, entries),
+    `Original error: ${message}`,
+  ].join('\n'));
+}
+
+export async function login(page: Page, role: Role = 'admin'): Promise<void> {
+  const authTrace = createAuthNavigationTrace(page);
+  try {
+    const creds = DEFAULT_CREDENTIALS[role];
+    const loginReadySelector = 'form[data-auth-ready="1"]';
+    const hasBackendUrl = (): boolean => /\/backend(?:\/.*)?$/.test(page.url());
+    const waitForBackend = async (timeout: number): Promise<boolean> => {
+      try {
+        await page.waitForURL(/\/backend(?:\/.*)?$/, { timeout });
+        return true;
+      } catch {
+        return hasBackendUrl();
+      }
+    };
+
+    await acknowledgeGlobalNotices(page);
+    const apiLoginForm = new URLSearchParams();
+    apiLoginForm.set('email', creds.email);
+    apiLoginForm.set('password', creds.password);
+    // Retry-on-429 against the auth rate limit (5/60s per email). Capped
+    // exponential backoff: 1s, 2s, 4s — worst-case ~7s.
+    let apiLoginResponse: Awaited<ReturnType<typeof page.request.post>> | null = null;
+    for (let retry = 0; retry < 4; retry += 1) {
+      apiLoginResponse = await page.request.post('/api/auth/login', {
+        headers: {
+          'content-type': 'application/x-www-form-urlencoded',
+        },
+        data: apiLoginForm.toString(),
+      }).catch(() => null);
+      if (!apiLoginResponse || apiLoginResponse.status() !== 429) break;
+      await new Promise((resolve) => setTimeout(resolve, 1000 * 2 ** retry));
     }
-    if (cookies.length > 0) {
-      await page.context().addCookies(cookies);
+    if (apiLoginResponse?.ok()) {
+      const apiLoginBody = (await apiLoginResponse.json().catch(() => null)) as { token?: string } | null;
+      const claims = typeof apiLoginBody?.token === 'string' ? decodeJwtClaims(apiLoginBody.token) : null;
+      const baseUrl = process.env.BASE_URL || 'http://localhost:3000';
+      const cookies = [];
+      if (claims?.tenantId) {
+        cookies.push({
+          name: 'om_selected_tenant',
+          value: claims.tenantId,
+          url: baseUrl,
+          sameSite: 'Lax' as const,
+        });
+      }
+      if (claims?.orgId) {
+        cookies.push({
+          name: 'om_selected_org',
+          value: claims.orgId,
+          url: baseUrl,
+          sameSite: 'Lax' as const,
+        });
+      }
+      if (cookies.length > 0) {
+        await page.context().addCookies(cookies);
+      }
+      await page.goto('/backend', { waitUntil: 'domcontentloaded' });
+      if (await waitForBackend(8_000)) return;
     }
-    await page.goto('/backend', { waitUntil: 'domcontentloaded' });
-    if (await waitForBackend(8_000)) return;
-  }
 
-  for (let attempt = 0; attempt < 4; attempt += 1) {
-    await page.goto('/login', { waitUntil: 'domcontentloaded' });
-    await dismissGlobalNoticesIfPresent(page);
-    await recoverClientSideErrorPageIfPresent(page);
-    await recoverGenericErrorPageIfPresent(page);
-    await page.waitForSelector(loginReadySelector, { state: 'visible', timeout: 3_000 }).catch(() => null);
-    if (await page.getByLabel('Email').isVisible().catch(() => false)) break;
-    if (attempt === 3) {
-      throw new Error(`Login form is unavailable for role: ${role}; current URL: ${page.url()}`);
+    for (let attempt = 0; attempt < 4; attempt += 1) {
+      await page.goto('/login', { waitUntil: 'domcontentloaded' });
+      await dismissGlobalNoticesIfPresent(page);
+      await recoverClientSideErrorPageIfPresent(page);
+      await recoverGenericErrorPageIfPresent(page);
+      await page.waitForSelector(loginReadySelector, { state: 'visible', timeout: 3_000 }).catch(() => null);
+      if (await page.getByLabel('Email').isVisible().catch(() => false)) break;
+      if (attempt === 3) {
+        throw new Error(`Login form is unavailable for role: ${role}; current URL: ${page.url()}`);
+      }
     }
-  }
-  await page.getByLabel('Email').fill(creds.email);
+    await page.getByLabel('Email').fill(creds.email);
 
-  const passwordInput = page.getByLabel('Password', { exact: true }).first();
-  if (await passwordInput.isVisible().catch(() => false)) {
-    await passwordInput.fill(creds.password);
-    await passwordInput.press('Enter');
-  } else {
-    const submitButton = page.getByRole('button', { name: /login|sign in|continue with sso/i }).first();
-    await submitButton.click();
-  }
+    const passwordInput = page.getByLabel('Password', { exact: true }).first();
+    if (await passwordInput.isVisible().catch(() => false)) {
+      await passwordInput.fill(creds.password);
+      await passwordInput.press('Enter');
+    } else {
+      const submitButton = page.getByRole('button', { name: /login|sign in|continue with sso/i }).first();
+      await submitButton.click();
+    }
 
-  if (await waitForBackend(7_000)) return;
+    if (await waitForBackend(7_000)) return;
 
-  const loginForm = page.locator('form').first();
-  if (await loginForm.isVisible().catch(() => false)) {
-    await loginForm.evaluate((element) => {
-      const form = element as HTMLFormElement
-      form.requestSubmit()
-    }).catch(() => {})
-  }
-  if (await waitForBackend(5_000)) return;
+    const loginForm = page.locator('form').first();
+    if (await loginForm.isVisible().catch(() => false)) {
+      await loginForm.evaluate((element) => {
+        const form = element as HTMLFormElement
+        form.requestSubmit()
+      }).catch(() => {})
+    }
+    if (await waitForBackend(5_000)) return;
 
-  const loginButton = page.getByRole('button', { name: /login|sign in|continue with sso/i }).first();
-  if (await loginButton.isVisible().catch(() => false)) {
-    await loginButton.click({ force: true });
-  }
-  if (await waitForBackend(8_000)) return;
+    const loginButton = page.getByRole('button', { name: /login|sign in|continue with sso/i }).first();
+    if (await loginButton.isVisible().catch(() => false)) {
+      await loginButton.click({ force: true });
+    }
+    if (await waitForBackend(8_000)) return;
 
-  throw new Error(`Login did not reach backend for role: ${role}; current URL: ${page.url()}`);
+    throw new Error(`Login did not reach backend for role: ${role}; current URL: ${page.url()}`);
+  } catch (error) {
+    await throwLoginErrorWithDiagnostics(page, role, authTrace.entries, error);
+  } finally {
+    authTrace.stop();
+  }
 }

package/src/helpers/integration/queue-runner.ts

@@ -73,7 +73,7 @@ export async function runQueueDrainFromEnv(): Promise<void> {
     jobLimit,
     queueBaseDir: process.env.QUEUE_BASE_DIR,
   })
-  console.log(JSON.stringify({ processed }))
+  process.stdout.write(`${JSON.stringify({ processed })}\n`)
 }
 
 const currentFile = fileURLToPath(import.meta.url)
@@ -85,7 +85,7 @@ if (invokedFile === currentFile) {
       process.exit(0)
     })
     .catch((error) => {
-      console.error(error)
+      process.stderr.write(`${error instanceof Error ? error.stack ?? error.message : String(error)}\n`)
       process.exit(1)
     })
 }

package/src/modules/api_keys/services/apiKeyService.ts

@@ -8,6 +8,9 @@ import { createKmsService } from '@open-mercato/shared/lib/encryption/kms'
 import { encryptWithAesGcm, decryptWithAesGcm } from '@open-mercato/shared/lib/encryption/aes'
 import { getSharedApiKeyAuthCache } from '@open-mercato/shared/lib/auth/apiKeyAuthCache'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('api_keys').child({ component: 'api-key-service' })
 
 const BCRYPT_COST = 10
 
@@ -308,14 +311,14 @@ export async function findSessionApiKeyWithSecret(
 
   // If no encrypted secret stored, cannot recover
   if (!record.sessionSecretEncrypted) {
-    console.warn('[ApiKeyService] Session key has no encrypted secret:', sessionToken.slice(0, 12))
+    logger.warn('Session key has no encrypted secret', { apiKeyId: record.id })
     return null
   }
 
   // Decrypt the secret
   const secret = await decryptSessionSecret(record.sessionSecretEncrypted, record.tenantId ?? null)
   if (!secret) {
-    console.warn('[ApiKeyService] Failed to decrypt session secret:', sessionToken.slice(0, 12))
+    logger.warn('Failed to decrypt session secret', { apiKeyId: record.id })
     return null
   }
 
@@ -377,7 +380,7 @@ export async function withOnetimeApiKey<T>(
       await em.persist(record).flush()
       getSharedApiKeyAuthCache().invalidateByKeyId(record.id)
     } catch (error) {
-      console.error('[withOnetimeApiKey] Failed to soft-delete one-time API key:', error)
+      logger.error('Failed to soft-delete one-time API key', { err: error })
     }
   }
 }

package/src/modules/attachments/api/image/[id]/[[...slug]]/route.ts

@@ -20,6 +20,9 @@ import {
   validateImageMagicBytes,
 } from '@open-mercato/core/modules/attachments/lib/imageSafety'
 import { StorageDriverFactory } from '../../../../lib/drivers'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('attachments').child({ component: 'image' })
 
 const querySchema = z.object({
   width: z.coerce.number().int().min(1).max(4000).optional(),
@@ -115,7 +118,7 @@ export async function GET(
       buffer = await transformer.toBuffer()
       if (cacheKey) {
         void writeThumbnailCache(attachment.partitionCode, attachment.id, cacheKey, buffer).catch((cacheError) => {
-          console.error('attachments.image.cache.write failed', cacheError)
+          logger.error('Thumbnail cache write failed', { err: cacheError })
         })
       }
     }
@@ -132,7 +135,7 @@ export async function GET(
       },
     })
   } catch (error) {
-    console.error('attachments.image.read failed', error)
+    logger.error('Image read failed', { err: error })
     return NextResponse.json({ error: 'Failed to render image' }, { status: 500 })
   }
 }

package/src/modules/attachments/api/library/[id]/route.ts

@@ -25,6 +25,9 @@ import {
   attachmentDetailResponseSchema,
   attachmentErrorSchema,
 } from '../../openapi'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('attachments').child({ component: 'library' })
 
 const updateSchema = z.object({
   tags: z.array(z.string()).optional(),
@@ -180,7 +183,7 @@ export async function PATCH(req: NextRequest, ctx: RouteContext) {
       }
     })
   } catch (error) {
-    console.error('[attachments] failed to persist custom attributes', error)
+    logger.error('Failed to persist custom attributes', { err: error })
     return NextResponse.json({ error: 'Failed to save attachment attributes.' }, { status: 500 })
   }
 

package/src/modules/attachments/api/route.ts

@@ -41,6 +41,9 @@ import {
   willExceedAttachmentTenantQuota,
 } from '../lib/upload-limits'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('attachments')
 
 export const metadata = {
   GET: { requireAuth: true, requireFeatures: ['attachments.view'] },
@@ -400,7 +403,7 @@ export async function POST(req: Request) {
     })
     storedPath = stored.storagePath
   } catch (error) {
-    console.error('[attachments] failed to persist file', error)
+    logger.error('Failed to persist file', { err: error })
     return NextResponse.json({ error: 'Failed to persist attachment.' }, { status: 500 })
   }
 
@@ -421,7 +424,7 @@ export async function POST(req: Request) {
         mimeType: fileMimeType,
       })
     } catch (error) {
-      console.error('[attachments] failed to extract attachment content', error)
+      logger.error('Failed to extract attachment content', { err: error })
     } finally {
       await cleanup().catch(() => {})
     }
@@ -467,16 +470,16 @@ export async function POST(req: Request) {
       }
     })
   } catch (error) {
-    console.error('[attachments] failed to persist attachment with custom attributes', error)
+    logger.error('Failed to persist attachment with custom attributes', { err: error })
     return NextResponse.json({ error: 'Failed to save attachment attributes.' }, { status: 500 })
   }
 
   if (useLlmOcr) {
     requestOcrProcessing(em, att, uploadDriver, storedPath).catch((error) => {
-      console.error('[attachments] failed to queue OCR processing', error)
+      logger.error('Failed to queue OCR processing', { err: error })
     })
   } else if (wantsLlmOcr) {
-    console.warn('[attachments] OCR requested but OPENAI_API_KEY not configured, falling back to text extraction when available')
+    logger.warn('OCR requested but OPENAI_API_KEY not configured, falling back to text extraction when available')
   }
 
   if (dataEngine) {
@@ -557,7 +560,7 @@ export async function DELETE(req: Request) {
   if (!record) return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })
   await em.remove(record).flush()
   await clearAttachmentThumbnailCache(record.partitionCode, record.id).catch((error) => {
-    console.error('[attachments] failed to cleanup cached thumbnails', error)
+    logger.error('Failed to cleanup cached thumbnails', { err: error })
   })
   if (record.storagePath) {
     const delDriver = await storageDriverFactory.resolveForPartition(record.partitionCode, {

package/src/modules/attachments/components/AttachmentPartitionSettings.tsx

@@ -30,6 +30,9 @@ import { raiseCrudError } from '@open-mercato/ui/backend/utils/serverErrors'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
 import { resolvePartitionEnvKey } from '@open-mercato/core/modules/attachments/lib/partitionEnv'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('attachments').child({ component: 'partitions' })
 
 type Partition = {
   id: string
@@ -119,7 +122,7 @@ export function AttachmentPartitionSettings({ s3Enabled }: AttachmentPartitionSe
       }))
       setItems(withDefaults)
     } catch (err) {
-      console.error('[attachments.partitions] list failed', err)
+      logger.error('Partition list failed', { err })
       flash(loadErrorMessage, 'error')
     } finally {
       setLoading(false)
@@ -257,7 +260,7 @@ export function AttachmentPartitionSettings({ s3Enabled }: AttachmentPartitionSe
       closeDialog()
       await loadItems()
     } catch (err) {
-      console.error('[attachments.partitions] save failed', err)
+      logger.error('Partition save failed', { err })
       if (surfaceRecordConflict(err, t)) return
       const message =
         err instanceof Error ? err.message : t('attachments.partitions.errors.save', 'Failed to save partition.')
@@ -295,7 +298,7 @@ export function AttachmentPartitionSettings({ s3Enabled }: AttachmentPartitionSe
         flash(t('attachments.partitions.messages.deleted', 'Partition removed.'), 'success')
         await loadItems()
       } catch (err) {
-        console.error('[attachments.partitions] delete failed', err)
+        logger.error('Partition delete failed', { err })
         if (surfaceRecordConflict(err, t)) return
         flash(t('attachments.partitions.errors.delete', 'Failed to delete partition.'), 'error')
       }

package/src/modules/attachments/lib/assignmentDetails.ts

@@ -3,6 +3,9 @@ import type { AttachmentAssignment } from './metadata'
 import type { CustomEntitySpec } from '@open-mercato/shared/modules/entities'
 import { getEntityIds } from '@open-mercato/shared/lib/encryption/entityIds'
 import { getModules } from '@open-mercato/shared/lib/i18n/server'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('attachments')
 
 type AssignmentLinkSpec = {
   labelFields?: string[]
@@ -271,7 +274,7 @@ export async function resolveAssignmentEnrichments(
         }
       }
     } catch (error) {
-      console.warn('[attachments] Failed to resolve assignment details for', entityId, error)
+      logger.warn('Failed to resolve assignment details', { entityId, err: error })
     }
   }
   return map

package/src/modules/attachments/lib/drivers/driverFactory.ts

@@ -3,6 +3,9 @@ import type { StorageDriver } from './types'
 import { LocalStorageDriver } from './localDriver'
 import { LegacyPublicStorageDriver } from './legacyPublicDriver'
 import { AttachmentPartition } from '../../data/entities'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('attachments').child({ component: 'storage-driver-factory' })
 
 type DriverScope = { tenantId: string; organizationId: string }
 type CredentialEnhancer = (config: Record<string, unknown>, scope: DriverScope) => Promise<Record<string, unknown>>
@@ -73,7 +76,7 @@ export class StorageDriverFactory {
     if (!partition) return this.localDriver
 
     const driverKey = partition.storageDriver ?? 'local'
-    console.log(`[storageDriverFactory] resolveForPartition: partition=${partitionCode} driverKey=${driverKey} moduleDrivers=${[...moduleDriverRegistry.keys()].join(',')} instanceDrivers=${[...this.externalDrivers.keys()].join(',')}`)
+    logger.debug('Resolving storage driver for partition', { partition: partitionCode, driverKey, moduleDrivers: [...moduleDriverRegistry.keys()], instanceDrivers: [...this.externalDrivers.keys()] })
     let config: Record<string, unknown> = partition.configJson ?? {}
 
     const activeEnhancer =

package/src/modules/attachments/lib/ocrQueue.ts

@@ -2,6 +2,9 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import { Attachment, AttachmentPartition } from '../data/entities'
 import { OcrService } from './ocrService'
 import type { StorageDriver } from './drivers/types'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('attachments').child({ component: 'ocr' })
 
 export type OcrRequestedEvent = {
   attachmentId: string
@@ -19,7 +22,7 @@ export async function processAttachmentOcr(
 ): Promise<void> {
   const { attachmentId, storagePath, mimeType, partitionCode } = payload
 
-  console.log(`[attachments.ocr] Processing started for attachment: ${attachmentId}`)
+  logger.info('Processing started', { attachmentId })
   const startTime = Date.now()
 
   const { filePath, cleanup } = await driver.toLocalPath(partitionCode, storagePath)
@@ -30,7 +33,7 @@ export async function processAttachmentOcr(
     const ocrService = new OcrService()
 
     if (!ocrService.available) {
-      console.warn(`[attachments.ocr] OPENAI_API_KEY not configured, skipping OCR for: ${attachmentId}`)
+      logger.warn('OPENAI_API_KEY not configured, skipping OCR', { attachmentId })
       return
     }
 
@@ -41,20 +44,20 @@ export async function processAttachmentOcr(
     })
 
     if (!result) {
-      console.log(`[attachments.ocr] No content extracted for attachment: ${attachmentId}`)
+      logger.info('No content extracted', { attachmentId })
       return
     }
 
     const attachment = await em.findOne(Attachment, { id: attachmentId })
     if (!attachment) {
-      console.error(`[attachments.ocr] Attachment not found: ${attachmentId}`)
+      logger.error('Attachment not found', { attachmentId })
       return
     }
 
     attachment.content = result.content
     await em.persist(attachment).flush()
 
-    console.log(`[attachments.ocr] Processing completed:`, {
+    logger.info('Processing completed', {
       attachmentId,
       pageCount: result.pageCount,
       contentLength: result.content.length,
@@ -62,13 +65,10 @@ export async function processAttachmentOcr(
       totalTimeMs: Date.now() - startTime,
     })
   } catch (error) {
-    console.error(`[attachments.ocr] Processing failed:`, {
-      attachmentId,
-      error: error instanceof Error ? error.message : String(error),
-    })
+    logger.error('Processing failed', { attachmentId, err: error })
   } finally {
     await cleanup().catch((cleanupError) => {
-      console.warn(`[attachments.ocr] Temp file cleanup failed:`, cleanupError)
+      logger.warn('Temp file cleanup failed', { err: cleanupError })
     })
   }
 }
@@ -99,7 +99,7 @@ export async function requestOcrProcessing(
 
   setImmediate(() => {
     processAttachmentOcr(workerEm, payload, driver).catch((error) => {
-      console.error(`[attachments.ocr] Background processing error:`, error)
+      logger.error('Background processing error', { err: error })
     })
   })
 }

package/src/modules/attachments/lib/ocrService.ts

@@ -2,6 +2,9 @@ import { generateText } from 'ai'
 import { createOpenAI } from '@ai-sdk/openai'
 import fs from 'fs/promises'
 import path from 'path'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('attachments').child({ component: 'ocr-service' })
 
 export type OcrServiceOptions = {
   apiKey?: string
@@ -221,7 +224,7 @@ export class OcrService {
           }
         }
       } catch (error) {
-        console.error(`[attachments.ocr] Failed to process PDF page ${page.pageNumber}`, error)
+        logger.error('Failed to process PDF page', { pageNumber: page.pageNumber, err: error })
       }
     }
 
@@ -236,16 +239,16 @@ export class OcrService {
     const { filePath, mimeType } = input
 
     if (isPdfMimeType(mimeType, filePath)) {
-      console.log('[attachments.ocr] Processing PDF attachment via pdfjs-dist')
+      logger.info('Processing PDF attachment via pdfjs-dist')
       return this.processPdf(input)
     }
 
     if (isImageMimeType(mimeType, filePath)) {
-      console.log('[attachments.ocr] Processing image attachment via LLM OCR')
+      logger.info('Processing image attachment via LLM OCR')
       return this.processImage(input)
     }
 
-    console.log(`[attachments.ocr] Unsupported file type for OCR: ${mimeType || 'unknown'}`)
+    logger.info('Unsupported file type for OCR', { mimeType: mimeType || 'unknown' })
     return null
   }
 }

package/src/modules/audit_logs/api/audit-logs/actions/redo/route.ts

@@ -11,6 +11,9 @@ import type { AwilixContainer } from 'awilix'
 import type { ActionLog } from '@open-mercato/core/modules/audit_logs/data/entities'
 import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('audit_logs').child({ component: 'redo' })
 
 export const metadata = {
   POST: { requireAuth: true, requireFeatures: ['audit_logs.redo_self'] },
@@ -157,7 +160,7 @@ export async function POST(req: Request) {
     }
     return response
   } catch (err) {
-    console.error('Redo failed', err)
+    logger.error('Redo failed', { err })
     return NextResponse.json({ error: 'Redo failed' }, { status: 400 })
   }
 }