@open-mercato/shared 0.6.6-develop.6460.1.f94c74174c → 0.6.6-develop.6471.1.9ab5bdd79a

package/src/lib/crud/factory.ts

@@ -71,11 +71,14 @@ import { mergeAdvancedFilters } from './advanced-filter-integration'
 import { parseExtensionHeaders } from '../umes/extension-headers'
 import { createGenericOptimisticLockReader } from './optimistic-lock'
 import { registerOptimisticLockReaderIfAbsent } from './optimistic-lock-store'
+import { createLogger } from '../logger'
 
 type RbacServiceLike = {
   getGrantedFeatures: (userId: string, opts: { tenantId: string | null; organizationId: string | null }) => Promise<string[]>
 }
 
+const logger = createLogger('shared').child({ component: 'crud' })
+
 function resolveSortParams(queryParams: Record<string, unknown>) {
   const rawSortField = queryParams.sortField ?? queryParams.sort ?? 'id'
   const rawSortDir = queryParams.sortDir ?? queryParams.order ?? 'asc'
@@ -544,8 +547,7 @@ function handleError(err: unknown): Response {
 
   const message = err instanceof Error ? err.message : undefined
   const stack = err instanceof Error ? err.stack : undefined
-  // eslint-disable-next-line no-console
-  console.error('[crud] unexpected error', { message, stack, err })
+  logger.error('Unexpected CRUD error', { message, stack, err })
   const body: Record<string, unknown> = {
     error: 'Internal server error',
     message: 'Something went wrong. Please try again later.',
@@ -615,7 +617,7 @@ async function runGuardAfterSuccessCallbacks(
     try {
       await guard.afterSuccess!({ ...base, metadata: guardMeta })
     } catch (error) {
-      console.error(`[mutation-guard] afterSuccess failed for guard ${guard.id}`, error)
+      logger.error('Mutation guard afterSuccess failed', { guardId: guard.id, err: error })
     }
   }
 }
@@ -705,8 +707,7 @@ export async function flushPendingCrudAccessLogs(): Promise<void> {
 
 function logForbidden(details: Record<string, unknown>) {
   try {
-    // eslint-disable-next-line no-console
-    console.warn('[crud] Forbidden request', details)
+    logger.warn('Forbidden request', details)
   } catch {}
 }
 
@@ -824,7 +825,7 @@ export async function logCrudAccess(options: LogCrudAccessOptions): Promise<LogC
           payloads.map((payload) =>
             Promise.resolve(service.log(payload)).catch((err) => {
               try {
-                console.error('[crud] failed to record access log', { err, payload })
+                logger.error('Failed to record access log', { err, payload })
               } catch {}
               return undefined
             }),
@@ -833,7 +834,7 @@ export async function logCrudAccess(options: LogCrudAccessOptions): Promise<LogC
       }
     } catch (err) {
       try {
-        console.error('[crud] failed to record access logs (batch)', { err, count: payloads.length })
+        logger.error('Failed to record access logs (batch)', { err, count: payloads.length })
       } catch {}
     }
   })()
@@ -1085,7 +1086,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
       })
       return decoratedItems
     } catch (err) {
-      console.warn('[crud] failed to decorate custom fields', err)
+      logger.warn('Failed to decorate custom fields', { err })
       endProfile({
         result: 'error',
         entityIds: entityIds.length,
@@ -1709,7 +1710,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
               }
             }
           } catch (err) {
-            console.warn('[CRUD] Translation overlay failed:', err)
+            logger.warn('Translation overlay failed', { err })
           }
           profiler.mark('translation_overlays_complete', { itemCount: transformedItems.length })
         }
@@ -1940,7 +1941,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
             }
           }
         } catch (err) {
-          console.warn('[CRUD] Translation overlay (fallback) failed:', err)
+          logger.warn('Translation overlay (fallback) failed', { err })
         }
         profiler.mark('fallback_translation_overlays_complete', { itemCount: Array.isArray(list) ? list.length : 0 })
       }

package/src/lib/crud/interceptor-registry.ts

@@ -1,5 +1,8 @@
 import type { ApiInterceptor, ApiInterceptorMethod, ApiInterceptorRegistryEntry } from './api-interceptor'
 import { applyApiInterceptorOverridesToEntries } from '../../modules/overrides'
+import { createLogger } from '../logger'
+
+const logger = createLogger('shared').child({ component: 'umes' })
 
 let _interceptorEntries: ApiInterceptorRegistryEntry[] | null = null
 const GLOBAL_INTERCEPTOR_KEY = '__openMercatoApiInterceptors__'
@@ -80,9 +83,7 @@ export function getApiInterceptorsForRoute(routePath: string, method: ApiInterce
       const warningKey = `${routePath}:${method}:${prev.interceptor.id}:${current.interceptor.id}:${currentPriority}`
       if (collisionWarnings.has(warningKey)) continue
       collisionWarnings.add(warningKey)
-      console.warn(
-        `[UMES] Interceptors "${prev.interceptor.id}" and "${current.interceptor.id}" have the same priority (${currentPriority}) for route "${routePath}". Execution order is based on module registration order.`
-      )
+      logger.warn('Interceptors share the same priority for route — execution order is based on module registration order', { firstInterceptorId: prev.interceptor.id, secondInterceptorId: current.interceptor.id, priority: currentPriority, routePath })
     }
   }
 

package/src/lib/crud/mutation-guard.ts

@@ -1,4 +1,7 @@
 import type { AwilixContainer } from 'awilix'
+import { createLogger } from '../logger'
+
+const logger = createLogger('shared').child({ component: 'crud' })
 
 export type CrudMutationGuardValidationSuccess = {
   ok: true
@@ -94,12 +97,12 @@ export async function runCrudMutationGuardAfterSuccess(
   try {
     await service.afterMutationSuccess(input)
   } catch (error) {
-    console.error('[crud-mutation-guard] after-success hook failed', {
+    logger.error('Mutation guard after-success hook failed', {
       resourceKind: input.resourceKind,
       resourceId: input.resourceId,
       operation: input.operation,
       requestMethod: input.requestMethod,
-      error: error instanceof Error ? error.message : String(error),
+      err: error,
     })
   }
 }

package/src/lib/crud/optimistic-lock.ts

@@ -44,6 +44,9 @@ import {
   type OptimisticLockConflictBody,
 } from './optimistic-lock-headers'
 import { getAllOptimisticLockReaders } from './optimistic-lock-store'
+import { createLogger } from '../logger'
+
+const logger = createLogger('shared').child({ component: 'optimistic-lock' })
 
 export type OptimisticLockConfig =
   | { mode: 'off' }
@@ -194,12 +197,7 @@ export function createGenericOptimisticLockReader(
       // misconfig filtering on a column the table lacks), which silently disables
       // locking for `resourceKind`. Log loudly so the misconfig is visible.
       // Control flow stays fail-open (return null) to honor the no-500 contract.
-      // eslint-disable-next-line no-console
-      console.error(
-        `[optimistic-lock] reader query failed for resourceKind="${resourceKind}" — optimistic locking is DISABLED for this entity until fixed. ` +
-          `Most likely a softDeleteField/tenantField/orgField filters on a column the table does not have.`,
-        err,
-      )
+      logger.error('Reader query failed — optimistic locking is DISABLED for this entity until fixed; most likely a softDeleteField/tenantField/orgField filters on a column the table does not have', { resourceKind, err })
       return null
     }
   }
@@ -350,8 +348,7 @@ export function createOptimisticLockGuardService(
 
     if (currentIso === expectedIso) {
       if (debugEnabled) {
-        // eslint-disable-next-line no-console
-        console.log('[optimistic-lock] match', {
+        logger.info('Optimistic lock match', {
           resourceKind: input.resourceKind,
           resourceId: input.resourceId,
           operation: input.operation,
@@ -363,8 +360,7 @@ export function createOptimisticLockGuardService(
     }
 
     if (debugEnabled) {
-      // eslint-disable-next-line no-console
-      console.log('[optimistic-lock] CONFLICT', {
+      logger.info('Optimistic lock conflict', {
         resourceKind: input.resourceKind,
         resourceId: input.resourceId,
         operation: input.operation,

package/src/lib/crud/route-mutation-guard.ts

@@ -5,6 +5,9 @@ import {
   type MutationGuard,
 } from './mutation-guard-registry'
 import { getAllMutationGuardInstances } from './mutation-guard-store'
+import { createLogger } from '../logger'
+
+const logger = createLogger('shared').child({ component: 'crud' })
 
 /**
  * Shared registry-based mutation-guard wrapper for custom write routes that do
@@ -173,7 +176,7 @@ export async function runRouteMutationGuards(params: {
             metadata,
           })
         } catch (error) {
-          console.error(`[mutation-guard] afterSuccess failed for guard ${guard.id}`, error)
+          logger.error('Mutation guard afterSuccess failed', { guardId: guard.id, err: error })
         }
       }
     },

package/src/lib/crud/sync-event-runner.ts

@@ -1,6 +1,9 @@
 import type { SyncCrudEventPayload } from './sync-event-types'
 import type { SyncSubscriberEntry } from './sync-subscriber-store'
 import { matchWildcardPattern } from '@open-mercato/shared/lib/patterns/wildcard'
+import { createLogger } from '../logger'
+
+const logger = createLogger('shared').child({ component: 'crud' })
 
 // ---------------------------------------------------------------------------
 // Event pattern matching
@@ -63,7 +66,7 @@ export async function runSyncAfterEvent(
     try {
       await subscriber.handler(payload, ctx)
     } catch (error) {
-      console.error(`[sync-event] after-subscriber failed: ${subscriber.metadata.id}`, error)
+      logger.error('Sync-event after-subscriber failed', { subscriberId: subscriber.metadata.id, err: error })
     }
   }
 }

package/src/lib/data/__tests__/engine.event-validation.test.ts

@@ -2,6 +2,21 @@ import type { AwilixContainer } from 'awilix'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { DefaultDataEngine, __resetUndeclaredEventWarningsForTests } from '../engine'
 import { createModuleEvents, registerEventModuleConfigs } from '../../../modules/events'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+jest.mock('@open-mercato/shared/lib/logger', () => {
+  const mocked = {
+    debug: jest.fn(),
+    info: jest.fn(),
+    warn: jest.fn(),
+    error: jest.fn(),
+    child: jest.fn(),
+  }
+  mocked.child.mockImplementation(() => mocked)
+  return { createLogger: jest.fn(() => mocked) }
+})
+const loggerWarn = createLogger('shared').warn as jest.Mock
+
 
 const testEvents = [
   { id: 'issue1421_test.widget.created', label: 'Widget Created', entity: 'widget', category: 'crud' as const },
@@ -41,7 +56,7 @@ describe('DataEngine event contract validation (issue #1421)', () => {
   })
 
   it('emits declared events without warning', async () => {
-    const warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {})
+    loggerWarn.mockClear()
     try {
       const { engine, emitted } = makeFixture()
 
@@ -55,9 +70,8 @@ describe('DataEngine event contract validation (issue #1421)', () => {
       expect(emitted).toEqual([
         expect.objectContaining({ name: 'issue1421_test.widget.created' }),
       ])
-      expect(warnSpy).not.toHaveBeenCalled()
+      expect(loggerWarn).not.toHaveBeenCalled()
     } finally {
-      warnSpy.mockRestore()
     }
   })
 
@@ -78,7 +92,7 @@ describe('DataEngine event contract validation (issue #1421)', () => {
       },
     ])
 
-    const warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {})
+    loggerWarn.mockClear()
     try {
       const { engine, emitted } = makeFixture()
 
@@ -92,14 +106,13 @@ describe('DataEngine event contract validation (issue #1421)', () => {
       expect(emitted).toEqual([
         expect.objectContaining({ name: 'issue1421_bootstrap.widget.deleted' }),
       ])
-      expect(warnSpy).not.toHaveBeenCalled()
+      expect(loggerWarn).not.toHaveBeenCalled()
     } finally {
-      warnSpy.mockRestore()
     }
   })
 
   it('warns when emitting an event that is not registered', async () => {
-    const warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {})
+    loggerWarn.mockClear()
     try {
       const { engine, emitted } = makeFixture()
 
@@ -110,22 +123,21 @@ describe('DataEngine event contract validation (issue #1421)', () => {
         events: { module: 'issue1421_unregistered', entity: 'ghost' },
       })
 
-      expect(warnSpy).toHaveBeenCalledTimes(1)
-      const warningMessage = warnSpy.mock.calls[0]?.[0] ?? ''
-      expect(warningMessage).toContain('issue1421_unregistered.ghost.created')
-      expect(warningMessage).toContain('events.ts')
+      expect(loggerWarn).toHaveBeenCalledTimes(1)
+      const [warningMessage, warningFields] = loggerWarn.mock.calls[0] ?? []
+      expect(String(warningMessage)).toContain('events.ts')
+      expect(warningFields).toEqual(expect.objectContaining({ eventName: 'issue1421_unregistered.ghost.created' }))
 
       // Emission is still attempted (non-strict), matching the factory's default behavior
       expect(emitted).toEqual([
         expect.objectContaining({ name: 'issue1421_unregistered.ghost.created' }),
       ])
     } finally {
-      warnSpy.mockRestore()
     }
   })
 
   it('deduplicates repeated warnings for the same undeclared event', async () => {
-    const warnSpy = jest.spyOn(console, 'warn').mockImplementation(() => {})
+    loggerWarn.mockClear()
     try {
       const { engine } = makeFixture()
 
@@ -138,9 +150,8 @@ describe('DataEngine event contract validation (issue #1421)', () => {
         })
       }
 
-      expect(warnSpy).toHaveBeenCalledTimes(1)
+      expect(loggerWarn).toHaveBeenCalledTimes(1)
     } finally {
-      warnSpy.mockRestore()
     }
   })
 })

package/src/lib/data/engine.ts

@@ -18,6 +18,9 @@ import { getEntityIds } from '../encryption/entityIds'
 import { normalizeCustomFieldValues } from '../custom-fields/normalize'
 import { parseBooleanToken } from '../boolean'
 import { isEventDeclared } from '../../modules/events'
+import { createLogger } from '../logger'
+
+const logger = createLogger('shared').child({ component: 'data-engine' })
 
 const undeclaredEventWarned = new Set<string>()
 
@@ -25,10 +28,7 @@ function warnIfUndeclaredEvent(eventName: string, context: string): void {
   if (isEventDeclared(eventName)) return
   if (undeclaredEventWarned.has(eventName)) return
   undeclaredEventWarned.add(eventName)
-  console.warn(
-    `[data-engine] ${context} is emitting undeclared event "${eventName}". ` +
-    `Declare it in the owning module's events.ts (createModuleEvents) so the event registry stays authoritative.`,
-  )
+  logger.warn('Emitting undeclared event — declare it in the owning module events.ts (createModuleEvents) so the event registry stays authoritative', { context, eventName })
 }
 
 /** Internal: clear the undeclared-event warning cache. Exposed for tests. */
@@ -618,7 +618,7 @@ export class DefaultDataEngine implements DataEngine {
         // defers the coverage recompute + fulltext delete, so this stays bounded.
         // Errors are logged, not thrown — index drift never fails the originating write.
         await bus.emitEvent('query_index.delete_one', enrichedPayload).catch((err: unknown) => {
-          console.error('[data-engine] query_index.delete_one emit failed', err)
+          logger.error('query_index.delete_one emit failed', { err })
         })
       } else {
         const payload = indexer.buildUpsertPayload
@@ -638,7 +638,7 @@ export class DefaultDataEngine implements DataEngine {
         // and defers the heavy token-reindex pipeline (build doc + encrypt + decrypt +
         // tokenize + DELETE + chunked INSERT) so write latency stays bounded.
         await bus.emitEvent('query_index.upsert_one', enrichedPayload).catch((err: unknown) => {
-          console.error('[data-engine] query_index.upsert_one emit failed', err)
+          logger.error('query_index.upsert_one emit failed', { err })
         })
       }
 

package/src/lib/db/mikro.ts

@@ -4,6 +4,9 @@ import { MikroORM } from '@mikro-orm/core'
 import { ReflectMetadataProvider } from '@mikro-orm/decorators/legacy'
 import { PostgreSqlDriver, type EntityManager as PostgreSqlEntityManager } from '@mikro-orm/postgresql'
 import { getSslConfig } from './ssl'
+import { createLogger } from '../logger'
+
+const logger = createLogger('shared').child({ component: 'orm' })
 
 export type AppMikroORM = MikroORM<PostgreSqlDriver, PostgreSqlEntityManager<PostgreSqlDriver>>
 
@@ -22,7 +25,7 @@ function setRegisteredEntities(entities: any[]): void {
 
 export function registerOrmEntities(entities: any[]) {
   if (getRegisteredEntities() !== null && process.env.NODE_ENV === 'development') {
-    console.debug('[Bootstrap] ORM entities re-registered (this may occur during HMR)')
+    logger.debug('ORM entities re-registered (this may occur during HMR)')
   }
   setRegisteredEntities(entities)
 }
@@ -106,7 +109,7 @@ export async function getOrm() {
   const sslConfig = getSslConfig()
 
   if (process.env.OM_DB_POOL_DEBUG === '1' || process.env.OM_INTEGRATION_TEST === 'true') {
-    console.log('[orm] pool config', {
+    logger.info('Pool config', {
       poolMin,
       poolMax,
       poolIdleTimeout,
@@ -150,7 +153,7 @@ export async function getOrm() {
       ssl: sslConfig,
       onPoolCreated: (pool: any) => {
         if (process.env.OM_DB_POOL_DEBUG === '1' || process.env.OM_INTEGRATION_TEST === 'true') {
-          console.log('[orm] pg pool created with options', {
+          logger.info('pg pool created with options', {
             max: pool.options?.max,
             min: pool.options?.min,
             idleTimeoutMillis: pool.options?.idleTimeoutMillis,

package/src/lib/di/container.ts

@@ -9,6 +9,9 @@ import { applyDiOverridesToContainer } from '@open-mercato/shared/modules/overri
 import { createOptimisticLockGuardService } from '@open-mercato/shared/lib/crud/optimistic-lock'
 import { getAllOptimisticLockReaders } from '@open-mercato/shared/lib/crud/optimistic-lock-store'
 import { createCommandOptimisticLockGuardService } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import { createLogger } from '../logger'
+
+const logger = createLogger('shared').child({ component: 'di' })
 
 type DynamicCradle = Record<string, any>
 
@@ -107,7 +110,7 @@ function setGlobalRegistrars(registrars: DiRegistrar[]): void {
 export function registerDiRegistrars(registrars: DiRegistrar[]) {
   const existing = getGlobalRegistrars()
   if (existing !== null && process.env.NODE_ENV === 'development') {
-    console.debug('[Bootstrap] DI registrars re-registered (this may occur during HMR)')
+    logger.debug('DI registrars re-registered (this may occur during HMR)')
   }
   setGlobalRegistrars(registrars)
   // Force re-bootstrap on HMR — module subscribers may have changed.

package/src/lib/encryption/aes.ts

@@ -1,5 +1,8 @@
 import crypto from 'node:crypto'
 import { isEncryptionDebugEnabled } from './toggles'
+import { createLogger } from '../logger'
+
+const logger = createLogger('shared').child({ component: 'encryption' })
 
 export type EncryptionPayload = {
   value: string | null
@@ -31,8 +34,7 @@ export function generateDek(): string {
 function logDebug(event: string, payload: Record<string, unknown>) {
   if (!isEncryptionDebugEnabled()) return
   try {
-    // eslint-disable-next-line no-console
-    console.debug('[encryption]', event, payload)
+    logger.debug(event, payload)
   } catch {
     // ignore
   }

package/src/lib/encryption/entityFields.ts

@@ -1,3 +1,7 @@
+import { createLogger } from '../logger'
+
+const logger = createLogger('shared').child({ component: 'encryption' })
+
 // Registration pattern for entity fields (for Turbopack compatibility)
 export type EntityFieldsRegistry = Record<string, Record<string, string>>
 
@@ -5,7 +9,7 @@ let _entityFieldsRegistry: EntityFieldsRegistry | null = null
 
 export function registerEntityFields(registry: EntityFieldsRegistry) {
   if (_entityFieldsRegistry !== null && process.env.NODE_ENV === 'development') {
-    console.debug('[Bootstrap] Entity fields re-registered (this may occur during HMR)')
+    logger.debug('Entity fields re-registered (this may occur during HMR)')
   }
   _entityFieldsRegistry = registry
 }

package/src/lib/encryption/entityIds.ts

@@ -1,4 +1,7 @@
 import type { EntityMetadata } from '@mikro-orm/core'
+import { createLogger } from '../logger'
+
+const logger = createLogger('shared').child({ component: 'encryption' })
 
 // Registration pattern for publishable packages
 export type EntityIds = Record<string, Record<string, string>>
@@ -8,7 +11,7 @@ let _entityIdLookup: Map<string, string> | null = null
 
 export function registerEntityIds(E: EntityIds) {
   if (_entityIds !== null && process.env.NODE_ENV === 'development') {
-    console.debug('[Bootstrap] Entity IDs re-registered (this may occur during HMR)')
+    logger.debug('Entity IDs re-registered (this may occur during HMR)')
   }
   _entityIds = E
   _entityIdLookup = null // Reset cache on re-registration

package/src/lib/encryption/kms.ts

@@ -2,8 +2,11 @@ import crypto from 'node:crypto'
 import { generateDek, hashForLookup } from './aes'
 import { isEncryptionDebugEnabled, isTenantDataEncryptionEnabled } from './toggles'
 import { parseBooleanToken } from '../boolean'
+import { createLogger } from '../logger'
 import { fetchWithTimeout, resolveTimeoutMs } from '../http/fetchWithTimeout'
 
+const logger = createLogger('shared').child({ component: 'kms' })
+
 const DEFAULT_VAULT_REQUEST_TIMEOUT_MS = 1_000
 const DEFAULT_VAULT_RECOVERY_COOLDOWN_MS = 30_000
 
@@ -54,9 +57,7 @@ class FallbackKmsService implements KmsService {
     try {
       return await op()
     } catch (err) {
-      console.warn('⚠️ [encryption][kms] Primary KMS failed, will try fallback', {
-        error: (err as Error)?.message || String(err),
-      })
+      logger.warn('Primary KMS failed, will try fallback', { err })
       return null
     }
   }
@@ -199,13 +200,13 @@ export class HashicorpVaultKmsService implements KmsService {
       this.healthy = false
       this.misconfigured = true
       if (this.debugEnabled) {
-        console.warn('⚠️ [encryption][kms] Vault misconfigured (missing VAULT_ADDR or VAULT_TOKEN)')
+        logger.warn('Vault misconfigured (missing VAULT_ADDR or VAULT_TOKEN)')
       }
     }
     if (this.healthy && !HashicorpVaultKmsService.loggedInit && this.debugEnabled) {
       HashicorpVaultKmsService.loggedInit = true
-      if(this.debugEnabled) {
-        console.info('🔐 [encryption][kms] Hashicorp Vault KMS enabled')
+      if (this.debugEnabled) {
+        logger.info('Hashicorp Vault KMS enabled')
       }
     }
   }
@@ -267,21 +268,17 @@ export class HashicorpVaultKmsService implements KmsService {
         // not-yet-created tenant DEK is the normal read-before-write path.
         if (res.status >= 500) this.markTransientFailure()
         else this.markHealthy()
-        console.warn('⚠️ [encryption][kms] Vault read failed', { path, status: res.status })
+        logger.warn('Vault read failed', { path, status: res.status })
         return null
       }
       this.markHealthy()
       if (this.debugEnabled) {
-        console.info('🔍 [encryption][kms] Vault read ok', { path })
+        logger.info('Vault read ok', { path })
       }
       return (await res.json()) as VaultReadResponse
     } catch (err) {
       this.markTransientFailure()
-      console.warn('⚠️ [encryption][kms] Vault read error', {
-        path,
-        error: (err as Error)?.message || String(err),
-        timeoutMs: this.requestTimeoutMs,
-      })
+      logger.warn('Vault read error', { path, err, timeoutMs: this.requestTimeoutMs })
       return null
     }
   }
@@ -313,19 +310,15 @@ export class HashicorpVaultKmsService implements KmsService {
       // not an unhealthy Vault — Vault is reachable, so close the breaker.
       if (typeof opts?.cas === 'number' && res.status === 400) {
         this.markHealthy()
-        console.warn('⚠️ [encryption][kms] Vault write CAS conflict (concurrent DEK create)', { path, status: res.status })
+        logger.warn('Vault write CAS conflict (concurrent DEK create)', { path, status: res.status })
         return 'conflict'
       }
       this.markTransientFailure()
-      console.warn('⚠️ [encryption][kms] Vault write failed', { path, status: res.status })
+      logger.warn('Vault write failed', { path, status: res.status })
       return 'error'
     } catch (err) {
       this.markTransientFailure()
-      console.warn('⚠️ [encryption][kms] Vault write error', {
-        path,
-        error: (err as Error)?.message || String(err),
-        timeoutMs: this.requestTimeoutMs,
-      })
+      logger.warn('Vault write error', { path, err, timeoutMs: this.requestTimeoutMs })
       return 'error'
     }
   }
@@ -348,7 +341,7 @@ export class HashicorpVaultKmsService implements KmsService {
     const res = await this.readVault(path)
     const key = res?.data?.data?.key
     if (!key) {
-      console.warn('⚠️ [encryption][kms] No tenant DEK found in Vault', { tenantId, path })
+      logger.warn('No tenant DEK found in Vault', { tenantId, path })
       return null
     }
     const dek: TenantDek = { tenantId, key, fetchedAt: this.now() }
@@ -371,7 +364,7 @@ export class HashicorpVaultKmsService implements KmsService {
     const key = generateDek()
     const outcome = await this.writeVault(path, key, { cas: 0 })
     if (outcome === 'ok') {
-      console.info('🔑 [encryption][kms] Stored tenant DEK in Vault', { tenantId, path })
+      logger.info('Stored tenant DEK in Vault', { tenantId, path })
       return this.remember({ tenantId, key, fetchedAt: this.now() })
     }
     if (outcome === 'conflict') {
@@ -380,11 +373,11 @@ export class HashicorpVaultKmsService implements KmsService {
       const winner = await this.readVault(path)
       const winnerKey = winner?.data?.data?.key
       if (winnerKey) {
-        console.info('🔑 [encryption][kms] Adopted concurrently-created tenant DEK', { tenantId, path })
+        logger.info('Adopted concurrently-created tenant DEK', { tenantId, path })
         return this.remember({ tenantId, key: winnerKey, fetchedAt: this.now() })
       }
     }
-    console.warn('⚠️ [encryption][kms] Failed to store tenant DEK in Vault', { tenantId, path })
+    logger.warn('Failed to store tenant DEK in Vault', { tenantId, path })
     return null
   }
 
@@ -419,12 +412,15 @@ function logDerivedKeyFallbackBanner(opts: DerivedSecret): void {
   const width = 110
   const border = `${redBg}${white}${'━'.repeat(width)}${reset}`
   const body = buildDerivedKeyFallbackBannerLines(opts)
-  console.warn(border)
-  for (const line of body) {
-    const padded = line.padEnd(width - 2, ' ')
-    console.warn(`${redBg}${white} ${padded} ${reset}`)
-  }
-  console.warn(border)
+  const bannerLines = [
+    border,
+    ...body.map((line) => `${redBg}${white} ${line.padEnd(width - 2, ' ')} ${reset}`),
+    border,
+  ]
+  process.stderr.write(bannerLines.join('\n') + '\n')
+  logger.warn('Using derived tenant encryption keys (Vault unavailable / no DEK)', {
+    secretFingerprint: fingerprintSecret(opts.secret),
+  })
 }
 
 export function createKmsService(): KmsService {
@@ -444,9 +440,7 @@ export function createKmsService(): KmsService {
       notifyFallback?.()
       return fallback
     }
-    console.warn(
-      '⚠️ [encryption][kms] Vault not healthy or misconfigured (missing VAULT_ADDR/VAULT_TOKEN) and no fallback secret provided; falling back to noop KMS',
-    )
+    logger.warn('Vault not healthy or misconfigured (missing VAULT_ADDR/VAULT_TOKEN) and no fallback secret provided; falling back to noop KMS')
     return new NoopKmsService()
   }
 

package/src/lib/encryption/subscriber.ts

@@ -5,6 +5,9 @@ import { TenantDataEncryptionService, parseDecryptedFieldValue } from './tenantD
 import { isTenantDataEncryptionEnabled } from './toggles'
 import { isEncryptionDebugEnabled } from './toggles'
 import { resolveTenantEncryptionService } from './customFieldValues'
+import { createLogger } from '../logger'
+
+const logger = createLogger('shared').child({ component: 'encryption' })
 
 type Scoped = {
   tenantId?: string | null
@@ -29,8 +32,7 @@ function resolveScope(entity: Scoped): Scope {
 function debug(event: string, payload: Record<string, unknown>) {
   if (!isEncryptionDebugEnabled()) return
   try {
-    // eslint-disable-next-line no-console
-    console.debug(event, payload)
+    logger.debug(event, payload)
   } catch {
     // ignore
   }