@stigmer/server 3.14.0-dev.20260910084630

package/src/boot/inprocess.ts

@@ -0,0 +1,415 @@
+/**
+ * In-process ConnectRPC clients — the TS twin of Go's pkg/downstream/*
+ * packages (agent, agentinstance), which serve cross-domain calls through
+ * the same *grpc.Server over an in-memory bufconn so EVERY interceptor
+ * executes: an internal call is validated, logged, and kind-tagged exactly
+ * like an external one. Here the bufconn equivalent is ConnectRPC's
+ * `createRouterTransport` built from the SAME routes registration function
+ * the unified-port server uses, with the SAME interceptor chain EXCEPT the
+ * position-1 identity source (O2, ruling Q4): this chain stamps the
+ * `internal` caller class only it can mint, where the serving chain runs
+ * the verifier chassis over the wire's credentials. Chain traversal proven
+ * by spike SP-B (src/pipeline/__tests__/router-transport.test.ts): every
+ * interceptor runs, in registration order, and a chain rejection
+ * short-circuits with a ConnectError the in-process caller sees (DD-002).
+ *
+ * The agent↔agentinstance true cycle is broken at the CONSUMERS with lazy
+ * providers (`() => client`) resolved at call time; this module only
+ * supplies the client objects those providers close over.
+ */
+import { createClient, createRouterTransport } from "@connectrpc/connect";
+import type { ConnectRouter, Transport } from "@connectrpc/connect";
+import { create } from "@bufbuild/protobuf";
+
+import { AgentCommandController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/command_pb";
+import { AgentQueryController } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/query_pb";
+import { AgentIdSchema } from "@stigmer/protos/ai/stigmer/agentic/agent/v1/io_pb";
+import { McpServerCommandController } from "@stigmer/protos/ai/stigmer/agentic/mcpserver/v1/command_pb";
+import { ApiResourceDeleteInputSchema } from "@stigmer/protos/ai/stigmer/commons/apiresource/io_pb";
+import { SkillCommandController } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/command_pb";
+import { SkillIdSchema } from "@stigmer/protos/ai/stigmer/agentic/skill/v1/io_pb";
+import { WorkflowCommandController } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/command_pb";
+import { AgentInstanceCommandController } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/command_pb";
+import { AgentInstanceQueryController } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/query_pb";
+import { AgentInstanceIdSchema } from "@stigmer/protos/ai/stigmer/agentic/agentinstance/v1/io_pb";
+import { EnvironmentCommandController } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/command_pb";
+import { EnvironmentQueryController } from "@stigmer/protos/ai/stigmer/agentic/environment/v1/query_pb";
+import { ExecutionContextCommandController } from "@stigmer/protos/ai/stigmer/agentic/executioncontext/v1/command_pb";
+import { SessionCommandController } from "@stigmer/protos/ai/stigmer/agentic/session/v1/command_pb";
+import { SessionQueryController } from "@stigmer/protos/ai/stigmer/agentic/session/v1/query_pb";
+import { SessionIdSchema } from "@stigmer/protos/ai/stigmer/agentic/session/v1/io_pb";
+import { WorkflowQueryController } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/query_pb";
+import { WorkflowIdSchema } from "@stigmer/protos/ai/stigmer/agentic/workflow/v1/io_pb";
+import { WorkflowInstanceCommandController } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/command_pb";
+import { WorkflowInstanceQueryController } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/query_pb";
+import { WorkflowInstanceIdSchema } from "@stigmer/protos/ai/stigmer/agentic/workflowinstance/v1/io_pb";
+import { AgentExecutionCommandController } from "@stigmer/protos/ai/stigmer/agentic/agentexecution/v1/command_pb";
+
+import type { AgentInstanceApplier } from "../domain/agent/steps.js";
+import type { ParentAgentLoader } from "../domain/agentinstance/steps.js";
+import type {
+  AgentLoader,
+  ExecutionAgentInstanceCreator,
+  SessionCreator,
+} from "../domain/agentexecution/create-steps.js";
+import type {
+  AgentInstanceLoader,
+  EnvironmentReader,
+  ExecutionContextCreator,
+  SessionLoader,
+} from "../domain/agentexecution/create-execution-context-step.js";
+import type { ConnectExecutionContextClient } from "../domain/mcpserver/connect.js";
+import type { ManagedEnvironmentClient } from "../domain/mcpserver/oauth/managed-env.js";
+import type { AgentInstanceCreator } from "../domain/session/steps.js";
+import type { WorkflowInstanceCreator } from "../domain/workflow/steps.js";
+import type { ExecutionWorkflowInstanceCreator } from "../domain/workflowexecution/create-steps.js";
+import type {
+  ExecutionWorkflowInstanceLoader,
+  WorkflowExecutionContextCreator,
+} from "../domain/workflowexecution/create-execution-context-step.js";
+import type { AgentExecutionApprovalForwarder } from "../domain/workflowexecution/submit-approval.js";
+import type { AgentExecutionFileDecisionForwarder } from "../domain/workflowexecution/submit-file-decision.js";
+import type { ParentWorkflowLoader } from "../domain/workflowinstance/steps.js";
+import { ApiResourceKind } from "@stigmer/protos/ai/stigmer/commons/apiresource/apiresourcekind/api_resource_kind_pb";
+import type { OrphanDeleter } from "../domain/project/reconcile.js";
+import type { ExecutionStatusWriter } from "../temporal/agentexecution/activities.js";
+import type { ScheduleExecutionCreator } from "../temporal/schedule/run-starter.js";
+import { buildInterceptorChain } from "../pipeline/chain.js";
+import {
+  createInProcessCallerInterceptor,
+  encodeInProcessCaller,
+  IN_PROCESS_CALLER_HEADER,
+} from "../pipeline/interceptors/auth.js";
+import type { CallerIdentity } from "../extensions/identity.js";
+import type { Logger } from "./logger.js";
+import type { CallOptions } from "@connectrpc/connect";
+
+/** The narrow in-process surfaces the domains consume (DD-002). */
+export interface InProcessClients {
+  readonly agentInstanceApplier: AgentInstanceApplier;
+  readonly agentInstanceCreator: AgentInstanceCreator;
+  readonly parentAgentLoader: ParentAgentLoader;
+  readonly workflowInstanceCreator: WorkflowInstanceCreator;
+  readonly parentWorkflowLoader: ParentWorkflowLoader;
+  // The agentexecution create/EC-builder edges (server.go 565–566: the
+  // controller's agent/agentinstance/session/environment/executioncontext
+  // in-process clients).
+  readonly executionAgentLoader: AgentLoader;
+  readonly executionAgentInstanceLoader: AgentInstanceLoader;
+  readonly executionAgentInstanceCreator: ExecutionAgentInstanceCreator;
+  readonly executionSessionLoader: SessionLoader;
+  readonly executionSessionCreator: SessionCreator;
+  /**
+   * Reads for the EC builder plus the full managed-environment lifecycle
+   * (ManagedEnvironmentClient): the secret rewrite the OAuth pre-flight
+   * refresh needs (#17) and the create/delete edges the connect/OAuth
+   * slice mints and tears managed environments with (#19) — one surface,
+   * every call through the full chain.
+   */
+  readonly executionEnvironmentReader: EnvironmentReader &
+    ManagedEnvironmentClient;
+  readonly executionContextCreator: ExecutionContextCreator;
+  /**
+   * The connect lanes' ephemeral-EC lifecycle (server.go 693–705: the
+   * mcpserver controller's executioncontext client) — create before the
+   * discovery workflow starts, delete when the operation settles.
+   */
+  readonly connectExecutionContextClient: ConnectExecutionContextClient;
+  // The workflowexecution edges (server.go 636–642: the controller's
+  // workflowinstance/executioncontext clients and the two HITL forwarding
+  // interfaces satisfied by the agentexecution controller).
+  readonly workflowExecutionInstanceCreator: ExecutionWorkflowInstanceCreator;
+  readonly workflowExecutionInstanceLoader: ExecutionWorkflowInstanceLoader;
+  readonly workflowExecutionContextCreator: WorkflowExecutionContextCreator;
+  readonly workflowExecutionApprovalForwarder: AgentExecutionApprovalForwarder;
+  readonly workflowExecutionFileDecisionForwarder: AgentExecutionFileDecisionForwarder;
+  /**
+   * The project reconciler's orphan-delete edge (server.go 635-648: Go's
+   * DownstreamClients + ResourceDeleterAdapter). Go retains the four full
+   * CRUD client interfaces; the reconciler uses ONLY Delete, so this
+   * surface exposes only the delete routing — every orphan delete runs the
+   * owning domain's FULL pipeline (referential blocks included) through
+   * the same interceptor chain as an external delete.
+   */
+  readonly projectOrphanDeleter: OrphanDeleter;
+  /**
+   * The schedule clock's fire edge (server.go 581: the RunStarter's
+   * in-process agentexecution client): every fire — cron tick or manual
+   * trigger — enters the FULL execution create pipeline, so session
+   * auto-create, execution context, launch gates, and workflow start all
+   * run exactly as for an external create.
+   */
+  readonly scheduleExecutionCreator: ScheduleExecutionCreator;
+  /**
+   * The agent-execution worker's own-behalf status edge (stigmer#979): the
+   * invoke workflow's fallback writes — FAILED when a runner fails without
+   * persisting, the IN_PROGRESS re-assertions on recovery and resume, the
+   * CANCELLED fallback, the PAUSED / WAITING_FOR_APPROVAL defense-in-depth
+   * persists — enter the SAME updateStatus chain the runner's gRPC path
+   * runs (Authorize, the merge chokepoint, the status hooks, the
+   * broadcast) and carry the internal caller class this transport's
+   * position 1 stamps. The worker builds no identity of its own: server
+   * code acting on its own behalf rides this lane, where the class is
+   * minted — exactly like the schedule clock and the reconciler above.
+   */
+  readonly executionStatusWriter: ExecutionStatusWriter;
+}
+
+/**
+ * The in-process wiring: the narrow typed clients above PLUS the transport
+ * they ride. The transport is exposed because it is the one lane that can
+ * reach EVERY service the routes closure registers — extension services
+ * included (blueprint 20260826.02/03 §8) — which the fixed client set
+ * above cannot know about; it doubles as the extension test suite's
+ * both-router visibility proof (O1) and stays behavior-identical to the
+ * clients' own calls (same routes, same interceptor chain).
+ */
+export interface InProcessWiring {
+  readonly clients: InProcessClients;
+  readonly transport: Transport;
+}
+
+/**
+ * Builds the in-process clients over a router transport that registers the
+ * SAME routes and runs the SAME interceptor chain as the serving router —
+ * validation parity is the point, exactly Go's bufconn shape.
+ */
+export function createInProcessClients(
+  routes: (router: ConnectRouter) => void,
+  logger: Logger,
+): InProcessWiring {
+  // Position 1 of this chain is the in-process identity stamper, NOT the
+  // serving chassis (O2, ruling Q4): every call through this transport
+  // carries the internal caller class, which only this chain can mint —
+  // the TS rendering of the Java in-process authorization skip. Positions
+  // 2–4 stay identical to the serving chain (validation parity, DD-002).
+  const transport = createRouterTransport(routes, {
+    router: {
+      interceptors: buildInterceptorChain(
+        logger,
+        createInProcessCallerInterceptor(),
+      ),
+    },
+  });
+
+  const agentInstanceCommand = createClient(
+    AgentInstanceCommandController,
+    transport,
+  );
+  const agentInstanceQuery = createClient(
+    AgentInstanceQueryController,
+    transport,
+  );
+  const agentQuery = createClient(AgentQueryController, transport);
+  const sessionCommand = createClient(SessionCommandController, transport);
+  const sessionQuery = createClient(SessionQueryController, transport);
+  const environmentCommand = createClient(
+    EnvironmentCommandController,
+    transport,
+  );
+  const environmentQuery = createClient(EnvironmentQueryController, transport);
+  const executionContextCommand = createClient(
+    ExecutionContextCommandController,
+    transport,
+  );
+  const workflowInstanceCommand = createClient(
+    WorkflowInstanceCommandController,
+    transport,
+  );
+  const workflowInstanceQuery = createClient(
+    WorkflowInstanceQueryController,
+    transport,
+  );
+  const workflowQuery = createClient(WorkflowQueryController, transport);
+  const agentExecutionCommand = createClient(
+    AgentExecutionCommandController,
+    transport,
+  );
+  const agentCommand = createClient(AgentCommandController, transport);
+  const workflowCommand = createClient(WorkflowCommandController, transport);
+  const mcpServerCommand = createClient(McpServerCommandController, transport);
+  const skillCommand = createClient(SkillCommandController, transport);
+
+  // The caller-propagation call options (C2 Stage 3, ruling R5 — the
+  // Java posture restored): the ORIGINAL caller's identity rides the
+  // propagation header (the one client→router channel; contextValues are
+  // server-side); the in-process position-1 interceptor decodes it and
+  // stamps `origin: "in-process"` instead of minting internal. Explicit
+  // per call, never ambient (DD-007's threading doctrine); the serving
+  // chassis strips the header, so the wire cannot forge it.
+  const asCaller = (caller: CallerIdentity): CallOptions => ({
+    headers: { [IN_PROCESS_CALLER_HEADER]: encodeInProcessCaller(caller) },
+  });
+
+  const clients: InProcessClients = {
+    // The Apply RPC AS THE ORIGINAL CALLER (ruling R5; Java
+    // applyAsCaller): the default instance's owner attribution lands on
+    // the requesting user, so it stays manageable under an enforcing
+    // Authorizer. Pre-R5 this lane minted the internal class (Go's
+    // ApplyAsSystem shape) — the recorded attribution gap.
+    agentInstanceApplier: {
+      applyAsCaller: (instance, caller) =>
+        agentInstanceCommand.apply(instance, asCaller(caller)),
+    },
+    // CREATE (not apply) so a duplicate default-instance slug surfaces
+    // as AlreadyExists instead of silently updating — as the original
+    // caller (ruling R5).
+    agentInstanceCreator: {
+      createAsCaller: (instance, caller) =>
+        agentInstanceCommand.create(instance, asCaller(caller)),
+    },
+    parentAgentLoader: {
+      get: (agentId) =>
+        agentQuery.get(create(AgentIdSchema, { value: agentId })),
+    },
+    // CREATE (not apply) for the same AlreadyExists posture — as the
+    // original caller (ruling R5), matching the agent edge above.
+    workflowInstanceCreator: {
+      createAsCaller: (instance, caller) =>
+        workflowInstanceCommand.create(instance, asCaller(caller)),
+    },
+    // Go's workflow.Client.Get for workflowinstance create's parent load
+    // (server.go 657: the other direction of the mutual edge).
+    parentWorkflowLoader: {
+      get: (workflowId) =>
+        workflowQuery.get(create(WorkflowIdSchema, { value: workflowId })),
+    },
+    // The agentexecution edges: reads stay under the internal class (the
+    // daemon-safe default); the CREATES propagate the original caller
+    // (ruling R5) so instances and sessions born during execution create
+    // carry their real owner.
+    executionAgentLoader: {
+      get: (agentId) =>
+        agentQuery.get(create(AgentIdSchema, { value: agentId })),
+    },
+    executionAgentInstanceLoader: {
+      get: (instanceId) =>
+        agentInstanceQuery.get(
+          create(AgentInstanceIdSchema, { value: instanceId }),
+        ),
+    },
+    executionAgentInstanceCreator: {
+      createAsCaller: (instance, caller) =>
+        agentInstanceCommand.create(instance, asCaller(caller)),
+    },
+    executionSessionLoader: {
+      get: (sessionId) =>
+        sessionQuery.get(create(SessionIdSchema, { value: sessionId })),
+    },
+    executionSessionCreator: {
+      createAsCaller: (session, caller) =>
+        sessionCommand.create(session, asCaller(caller)),
+    },
+    executionEnvironmentReader: {
+      list: (request) => environmentQuery.list(request),
+      getSecretValue: (input) => environmentQuery.getSecretValue(input),
+      updateVariables: (request) => environmentCommand.updateVariables(request),
+      // The managed-env create propagates the connecting user when the
+      // lane has one (ruling R5 — the Java createAsCaller posture; parity
+      // entry 20260830.05): ownership tuples land on the user, not the
+      // unattributable internal class.
+      create: (environment, caller) =>
+        environmentCommand.create(
+          environment,
+          caller === undefined ? undefined : asCaller(caller),
+        ),
+      delete: (input) => environmentCommand.delete(input),
+    },
+    executionContextCreator: {
+      create: (ec) => executionContextCommand.create(ec),
+    },
+    connectExecutionContextClient: {
+      create: (ec) => executionContextCommand.create(ec),
+      delete: (input) => executionContextCommand.delete(input),
+    },
+    // The workflowexecution edges: the default-instance self-heal creates
+    // as the original caller (ruling R5), surfacing duplicate slugs as
+    // AlreadyExists exactly as before.
+    workflowExecutionInstanceCreator: {
+      createAsCaller: (instance, caller) =>
+        workflowInstanceCommand.create(instance, asCaller(caller)),
+    },
+    workflowExecutionInstanceLoader: {
+      get: (instanceId) =>
+        workflowInstanceQuery.get(
+          create(WorkflowInstanceIdSchema, { value: instanceId }),
+        ),
+    },
+    workflowExecutionContextCreator: {
+      create: (ec) => executionContextCommand.create(ec),
+    },
+    // The two HITL forwarding edges — Go's method-segregated
+    // AgentExecutionApprovalClient / AgentExecutionFileDecisionClient,
+    // both satisfied by the in-process agentexecution controller.
+    workflowExecutionApprovalForwarder: {
+      submitApproval: (input) => agentExecutionCommand.submitApproval(input),
+    },
+    workflowExecutionFileDecisionForwarder: {
+      submitFileDecision: (input) =>
+        agentExecutionCommand.submitFileDecision(input),
+    },
+    // The schedule clock's fire edge — the plain Create RPC (Go's
+    // ExecutionCreator). Since O2 every call through this transport
+    // carries the internal caller class stamped at position 1; its audit
+    // derivation equals the old process-global operator identity. A
+    // composed fire caller (the scheduleFireCaller driver point,
+    // stigmer-cloud#572) propagates instead — the RunStarter mints it per
+    // fire, so the created execution and its auto-created session carry
+    // the edition's schedule identity (ruling R5's asCaller lane).
+    scheduleExecutionCreator: {
+      create: (execution, fireCaller) =>
+        agentExecutionCommand.create(
+          execution,
+          fireCaller === undefined ? undefined : asCaller(fireCaller),
+        ),
+    },
+    // The worker's own-behalf status writes — the plain UpdateStatus RPC
+    // under the internal class (never asCaller: the fallback is the
+    // server's own reconciliation of a runner outcome, a daemon-origin
+    // write with no original caller to propagate, exactly the schedule
+    // clock's posture when no fire caller is composed).
+    executionStatusWriter: {
+      updateStatus: (input) => agentExecutionCommand.updateStatus(input),
+    },
+    // The project reconciler's delete routing — Go's
+    // ResourceDeleterAdapter.Delete switch (execution_engine.go:75-92).
+    // The unsupported-kind default is defense-in-depth kept for Go parity:
+    // the reconciler's slug resolver rejects unsupported kinds before any
+    // delete is attempted, in both editions. Log-only surface: reconcile
+    // failures never reach the wire.
+    projectOrphanDeleter: {
+      async delete(kind, resourceId) {
+        switch (kind) {
+          case ApiResourceKind.agent:
+            await agentCommand.delete(
+              create(AgentIdSchema, { value: resourceId }),
+            );
+            return;
+          case ApiResourceKind.workflow:
+            await workflowCommand.delete(
+              create(WorkflowIdSchema, { value: resourceId }),
+            );
+            return;
+          case ApiResourceKind.mcp_server:
+            // McpServer's delete input is the commons ApiResourceDeleteInput
+            // (not an id wrapper) — Go's client builds the same message.
+            await mcpServerCommand.delete(
+              create(ApiResourceDeleteInputSchema, { resourceId }),
+            );
+            return;
+          case ApiResourceKind.skill:
+            await skillCommand.delete(
+              create(SkillIdSchema, { value: resourceId }),
+            );
+            return;
+          default:
+            throw new Error(
+              `unsupported resource kind for delete: ${ApiResourceKind[kind] ?? String(kind)}`,
+            );
+        }
+      },
+    },
+  };
+
+  return { clients, transport };
+}

package/src/boot/logger.ts

@@ -0,0 +1,111 @@
+/**
+ * Leveled structured logger for the server process.
+ *
+ * Hand-rolled rather than a dependency: the repo's TS services have no
+ * logging library precedent (the runner logs through raw console and
+ * Temporal's runtime), and the server's needs are exactly four levels, a
+ * threshold, structured fields, and two output shapes. Go's zerolog
+ * behavior is the reference: NDJSON to stderr in deployed environments,
+ * human-readable console output when ENV=local (server.go:939), stdout
+ * untouched.
+ *
+ * The sink is the one seam for a structured export. A deployable that
+ * ships records to a collector (the cloud composition's OTLP log export,
+ * convergence entry 20260909.05; a self-hosting team's own exporter next)
+ * needs the entry — level, instant, message, fields — not the formatted
+ * line, and it needs it exactly for the lines the threshold let through,
+ * so LOG_LEVEL governs every output from one place. The written line stays
+ * the operator's `kubectl logs` view, unchanged whether a sink is present
+ * or not; the sink is called after the write, so a stderr fault skips the
+ * export of that line rather than the reverse. This module stays free of
+ * runtime dependencies on purpose: the SDK that turns an entry into a
+ * record belongs to the deployable that chose a collector.
+ *
+ * The level tiering CONTRACT lives in the logging interceptor
+ * (pipeline/interceptors/logging.ts) — this module only provides the
+ * mechanism.
+ */
+
+export type LogLevel = "debug" | "info" | "warn" | "error";
+
+export type LogFields = Record<string, unknown>;
+
+export interface Logger {
+  debug(message: string, fields?: LogFields): void;
+  info(message: string, fields?: LogFields): void;
+  warn(message: string, fields?: LogFields): void;
+  error(message: string, fields?: LogFields): void;
+}
+
+/**
+ * One log line, structured, as a sink receives it: computed once per
+ * emission, so the written line and the exported record carry the same
+ * instant and the same fields.
+ */
+export interface LogEntry {
+  readonly level: LogLevel;
+  readonly time: Date;
+  readonly message: string;
+  readonly fields: LogFields | undefined;
+}
+
+/**
+ * Receives every entry that passed the threshold, after the line is
+ * written. A sink owns its own failure handling — the logger is called
+ * from every hot path in the process and never wraps the sink in a
+ * try/catch it would then have to log through itself.
+ */
+export type LogSink = (entry: LogEntry) => void;
+
+const LEVEL_RANK: Record<LogLevel, number> = {
+  debug: 10,
+  info: 20,
+  warn: 30,
+  error: 40,
+};
+
+export interface LoggerOptions {
+  /** Threshold; entries below it are dropped. Unknown values mean "info". */
+  level: string;
+  /** Human-readable output (ENV=local) instead of NDJSON. */
+  pretty: boolean;
+  /** Test seam; defaults to stderr so stdout stays clean for tooling. */
+  write?: (line: string) => void;
+  /** Structured export seam; absent means the written line is the only output. */
+  sink?: LogSink;
+}
+
+export function createLogger(options: LoggerOptions): Logger {
+  const threshold = LEVEL_RANK[options.level as LogLevel] ?? LEVEL_RANK.info;
+  const write =
+    options.write ?? ((line: string) => process.stderr.write(line + "\n"));
+  const sink = options.sink;
+
+  const emit = (level: LogLevel, message: string, fields?: LogFields): void => {
+    if (LEVEL_RANK[level] < threshold) {
+      return;
+    }
+    const time = new Date();
+    if (options.pretty) {
+      const suffix =
+        fields === undefined || Object.keys(fields).length === 0
+          ? ""
+          : " " + JSON.stringify(fields);
+      write(
+        `${time.toISOString()} ${level.toUpperCase().padEnd(5)} ${message}${suffix}`,
+      );
+    } else {
+      write(
+        JSON.stringify({ level, time: time.toISOString(), message, ...fields }),
+      );
+    }
+    sink?.({ level, time, message, fields });
+  };
+
+  return {
+    debug: (message, fields) => emit("debug", message, fields),
+    info: (message, fields) => emit("info", message, fields),
+    warn: (message, fields) => emit("warn", message, fields),
+    error: (message, fields) => emit("error", message, fields),
+  };
+}