serverless-ircd 0.1.0 → 0.3.0

package/tools/ci-hardening/tests/__stryker_bad__.json

@@ -0,0 +1,4 @@
+{
+  "_comment": "Fixture: Stryker config without a mutate[] array. Used by the validator test to confirm readStrykerConfig throws loud.",
+  "testRunner": "vitest"
+}

package/tools/ci-hardening/tests/validate.test.ts

@@ -0,0 +1,177 @@
+import { readFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { describe, expect, it } from 'vitest';
+import {
+  MUTATION_SCORE_THRESHOLD,
+  readCoverageThresholds,
+  readStrykerConfig,
+  readWorkflowJob,
+} from '../src/validate.js';
+
+const REPO_ROOT = resolve(import.meta.dirname, '..', '..', '..');
+
+function repoPath(rel: string): string {
+  return resolve(REPO_ROOT, rel);
+}
+
+function readText(rel: string): string {
+  return readFileSync(repoPath(rel), 'utf8');
+}
+
+describe('coverage gate', () => {
+  it('enforces 100% line/function/branch/statement coverage on irc-core', () => {
+    const thresholds = readCoverageThresholds(repoPath('packages/irc-core/vitest.config.ts'));
+    expect(thresholds).toEqual({
+      lines: 100,
+      functions: 100,
+      branches: 100,
+      statements: 100,
+    });
+  });
+
+  it('enforces ≥90% coverage on cf-adapter', () => {
+    const thresholds = readCoverageThresholds(repoPath('packages/cf-adapter/vitest.config.ts'));
+    expect(thresholds.lines).toBeGreaterThanOrEqual(90);
+    expect(thresholds.functions).toBeGreaterThanOrEqual(90);
+    expect(thresholds.branches).toBeGreaterThanOrEqual(90);
+    expect(thresholds.statements).toBeGreaterThanOrEqual(90);
+  });
+
+  it('enforces ≥90% coverage on irc-server', () => {
+    const thresholds = readCoverageThresholds(repoPath('packages/irc-server/vitest.config.ts'));
+    expect(thresholds.lines).toBeGreaterThanOrEqual(90);
+    expect(thresholds.functions).toBeGreaterThanOrEqual(90);
+    expect(thresholds.branches).toBeGreaterThanOrEqual(90);
+    expect(thresholds.statements).toBeGreaterThanOrEqual(90);
+  });
+
+  it('enforces ≥90% coverage on in-memory-runtime', () => {
+    const thresholds = readCoverageThresholds(
+      repoPath('packages/in-memory-runtime/vitest.config.ts'),
+    );
+    expect(thresholds.lines).toBeGreaterThanOrEqual(90);
+    expect(thresholds.functions).toBeGreaterThanOrEqual(90);
+    expect(thresholds.branches).toBeGreaterThanOrEqual(90);
+    expect(thresholds.statements).toBeGreaterThanOrEqual(90);
+  });
+});
+
+describe('contract tests on every PR', () => {
+  it('runs the integration contract suite on PRs via ci.yml', () => {
+    const ci = readText('.github/workflows/ci.yml');
+    // Pull request trigger must be present so contract suite runs on PRs.
+    expect(ci).toMatch(/pull_request:/);
+    // The integration contract suite must be invoked. It ships as
+    // packages/cf-adapter/tests/integration (the parametrized harness
+    // that runs against every runtime) and is exercised by the
+    // workspace-wide coverage task. The gate step must explicitly
+    // reference the integration suite so it cannot be silently dropped.
+    expect(ci).toMatch(/integration/);
+    // Coverage must run on PRs (not only on main pushes).
+    const job = readWorkflowJob(ci, 'verify');
+    const runSteps = job.steps
+      .filter((s: { run?: unknown }) => typeof s.run === 'string')
+      .map((s: { run?: string }) => s.run ?? '');
+    const runsCoverage = runSteps.some((r) => r.includes('pnpm coverage'));
+    expect(runsCoverage).toBe(true);
+  });
+
+  it('has an explicit coverage-gate step that fails the build on regressions', () => {
+    const ci = readText('.github/workflows/ci.yml');
+    // The gate step name must make the failure mode obvious in the
+    // GitHub Actions UI.
+    expect(ci).toMatch(/coverage gate/i);
+    // The gate step must surface an explicit failure marker rather than
+    // relying on vitest's implicit threshold exit code alone.
+    expect(ci).toMatch(/coverage-thresholds/);
+  });
+});
+
+describe('mutation testing spot-check', () => {
+  it('exports a documented mutation-score threshold of ≥80%', () => {
+    expect(MUTATION_SCORE_THRESHOLD).toBeGreaterThanOrEqual(80);
+  });
+
+  it('ships a Stryker config that targets irc-core/protocol', () => {
+    const config = readStrykerConfig(repoPath('packages/irc-core/stryker.protocol.conf.json'));
+    expect(config.mutate).toEqual(
+      expect.arrayContaining([expect.stringMatching(/protocol\/[^/]+\.ts$/)]),
+    );
+    expect(config.thresholds?.high).toBeGreaterThanOrEqual(MUTATION_SCORE_THRESHOLD);
+    expect(config.thresholds?.break).toBe(MUTATION_SCORE_THRESHOLD);
+    // The config must disable Stryker's own coverage runner and reuse
+    // vitest's so the per-package coverage gate stays the source of
+    // truth for line/function coverage.
+    expect(config.coverageAnalysis).toBe('off');
+    expect(config.testRunner).toBe('vitest');
+    // Under pnpm's symlinked node_modules the Stryker child process
+    // cannot auto-discover the vitest plugin, so it must be listed
+    // explicitly.
+    expect(config.plugins).toEqual(['@stryker-mutator/vitest-runner']);
+  });
+
+  it('ships a Stryker config that targets irc-core/commands', () => {
+    const config = readStrykerConfig(repoPath('packages/irc-core/stryker.commands.conf.json'));
+    expect(config.mutate).toEqual(
+      expect.arrayContaining([expect.stringMatching(/commands\/[^/]+\.ts$/)]),
+    );
+    expect(config.thresholds?.high).toBeGreaterThanOrEqual(MUTATION_SCORE_THRESHOLD);
+    expect(config.thresholds?.break).toBe(MUTATION_SCORE_THRESHOLD);
+    expect(config.coverageAnalysis).toBe('off');
+    expect(config.testRunner).toBe('vitest');
+    expect(config.plugins).toEqual(['@stryker-mutator/vitest-runner']);
+  });
+
+  it('exposes a workspace-level mutation script that runs both spot-checks', () => {
+    const root = JSON.parse(readText('package.json')) as { scripts: Record<string, string> };
+    // Root scripts delegate to the irc-core package's stryker scripts.
+    expect(root.scripts['mutation:protocol']).toMatch(
+      /--filter @serverless-ircd\/irc-core mutation:protocol/,
+    );
+    expect(root.scripts['mutation:commands']).toMatch(
+      /--filter @serverless-ircd\/irc-core mutation:commands/,
+    );
+    expect(root.scripts.mutation).toMatch(/mutation:protocol/);
+    expect(root.scripts.mutation).toMatch(/mutation:commands/);
+
+    // The irc-core package must actually invoke stryker.
+    const ircCore = JSON.parse(readText('packages/irc-core/package.json')) as {
+      scripts: Record<string, string>;
+    };
+    expect(ircCore.scripts['mutation:protocol']).toMatch(
+      /stryker run stryker\.protocol\.conf\.json/,
+    );
+    expect(ircCore.scripts['mutation:commands']).toMatch(
+      /stryker run stryker\.commands\.conf\.json/,
+    );
+  });
+
+  it('runs mutation spot-checks in CI on every PR', () => {
+    const ci = readText('.github/workflows/ci.yml');
+    expect(ci).toMatch(/mutation/i);
+    expect(ci).toMatch(/stryker/);
+  });
+});
+
+describe('validate.ts error paths', () => {
+  it('readCoverageThresholds throws when no thresholds block exists', () => {
+    const tmpPath = repoPath('tools/ci-hardening/tests/__no_thresholds__.txt');
+    expect(() => readCoverageThresholds(tmpPath)).toThrow(/no thresholds block|No coverage/i);
+  });
+
+  it('readCoverageThresholds throws when a threshold key is missing', () => {
+    const tmpPath = repoPath('tools/ci-hardening/tests/__partial_thresholds__.txt');
+    expect(() => readCoverageThresholds(tmpPath)).toThrow(/No lines threshold/i);
+  });
+
+  it('readStrykerConfig throws when mutate is missing', () => {
+    const tmpPath = repoPath('tools/ci-hardening/tests/__stryker_bad__.json');
+    expect(() => readStrykerConfig(tmpPath)).toThrow(/missing mutate/);
+  });
+
+  it('readWorkflowJob throws when the job does not exist', () => {
+    expect(() => readWorkflowJob('jobs:\n  other: {}\n', 'verify')).toThrow(
+      /no job named "verify"/,
+    );
+  });
+});

package/tools/ci-hardening/tsconfig.build.json

@@ -0,0 +1,12 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "composite": true,
+    "rootDir": "./src",
+    "outDir": "./dist",
+    "tsBuildInfoFile": "./.tsbuildinfo",
+    "types": ["node"]
+  },
+  "include": ["src/**/*.ts"],
+  "exclude": ["dist", "tests", "**/*.test.ts"]
+}

package/tools/ci-hardening/tsconfig.test.json

@@ -0,0 +1,10 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "noEmit": true,
+    "types": ["node"],
+    "composite": false
+  },
+  "include": ["src/**/*.ts", "tests/**/*.ts"],
+  "exclude": ["dist"]
+}

package/tools/ci-hardening/vitest.config.ts

@@ -0,0 +1,21 @@
+import { defineConfig } from 'vitest/config';
+
+export default defineConfig({
+  test: {
+    environment: 'node',
+    include: ['tests/**/*.test.ts'],
+    coverage: {
+      provider: 'v8',
+      all: false,
+      include: ['src/**/*.ts'],
+      exclude: ['src/index.ts'],
+      reporter: ['text', 'html', 'json-summary'],
+      thresholds: {
+        lines: 100,
+        functions: 100,
+        branches: 100,
+        statements: 100,
+      },
+    },
+  },
+});

package/tools/seed-aws-accounts.ts

@@ -0,0 +1,80 @@
+#!/usr/bin/env node
+/**
+ * Seed SASL PLAIN accounts into the DynamoDB `Accounts` table.
+ *
+ * Usage:
+ *   node --import tsx tools/seed-aws-accounts.ts \
+ *     --table StagingAccounts \
+ *     --endpoint http://localhost:8000 \
+ *     --accounts alice:s3cret bob:password2
+ *
+ * Or read from a file (newline-delimited `username:password`):
+ *   node --import tsx tools/seed-aws-accounts.ts \
+ *     --table StagingAccounts \
+ *     --file accounts.txt
+ *
+ * The script hashes each password with scrypt (never writes plaintext).
+ * Re-running with the same username overwrites the prior row.
+ */
+
+import { parseArgs } from 'node:util';
+import { readFileSync } from 'node:fs';
+import {
+  createDynamoDocumentClient,
+  putAccountCredential,
+} from '@serverless-ircd/aws-adapter';
+
+const { values } = parseArgs({
+  options: {
+    table: { type: 'string' },
+    endpoint: { type: 'string', default: undefined },
+    region: { type: 'string', default: undefined },
+    accounts: { type: 'string', multiple: true, default: [] },
+    file: { type: 'string', default: undefined },
+  },
+});
+
+if (values.table === undefined) {
+  console.error('Usage: seed-aws-accounts --table <TableName> [--endpoint <url>] [--accounts user:pass ...] [--file <path>]');
+  process.exit(1);
+}
+
+const clientOptions: Record<string, string> = {};
+if (values.endpoint !== undefined) clientOptions.endpoint = values.endpoint;
+if (values.region !== undefined) clientOptions.region = values.region;
+
+const docClient = createDynamoDocumentClient(clientOptions);
+
+const pairs: Array<{ username: string; password: string }> = [];
+
+for (const pair of values.accounts) {
+  const sep = pair.indexOf(':');
+  if (sep <= 0) {
+    console.error(`Skipping malformed entry (no colon): ${pair}`);
+    continue;
+  }
+  pairs.push({ username: pair.slice(0, sep), password: pair.slice(sep + 1) });
+}
+
+if (values.file !== undefined) {
+  const content = readFileSync(values.file, 'utf-8');
+  for (const line of content.split('\n')) {
+    const trimmed = line.trim();
+    if (trimmed.length === 0) continue;
+    const sep = trimmed.indexOf(':');
+    if (sep <= 0) continue;
+    pairs.push({ username: trimmed.slice(0, sep), password: trimmed.slice(sep + 1) });
+  }
+}
+
+if (pairs.length === 0) {
+  console.error('No accounts to seed. Use --accounts or --file.');
+  process.exit(1);
+}
+
+for (const { username, password } of pairs) {
+  const entry = await putAccountCredential(docClient, values.table, username, password);
+  console.log(`Seeded ${username} (algorithm=${entry.algorithm})`);
+}
+
+console.log(`Done: ${pairs.length} account(s) written to ${values.table}.`);

package/tools/tcp-ws-forwarder/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@serverless-ircd/tcp-ws-forwarder",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "private": true,
   "description": "Local TCP to ws/wss forwarder so standard IRC clients can reach the WebSocket-only ServerlessIRCd transport",
   "license": "BSD-3-Clause",

package/tools/tcp-ws-forwarder/src/forwarder.ts

@@ -29,6 +29,7 @@
 import { type Socket, createServer } from 'node:net';
 import { type RawData, WebSocket } from 'ws';
 import { LineScanner } from './line-scanner.js';
+import { ConsoleLogger, LogLevel, type Logger } from './logger.js';
 
 /** Options accepted by {@link startForwarder}. */
 export interface StartForwarderOptions {
@@ -41,6 +42,12 @@ export interface StartForwarderOptions {
    * `ws:` or `wss:` scheme; otherwise `startForwarder` throws synchronously.
    */
   targetUrl: string;
+  /**
+   * Minimum log severity to emit. `debug` traces every relayed line/frame;
+   * `info` (default) logs connection lifecycle; `warn`/`error` quiet the
+   * bridge to faults only. Mirrors the irc-core `LogLevel` ordering.
+   */
+  logLevel?: LogLevel;
 }
 
 /** A running forwarder. Call {@link Forwarder.close} to shut it down. */
@@ -87,6 +94,8 @@ export function startForwarder(opts: StartForwarderOptions): Promise<Forwarder>
   const target = parseTargetUrl(opts.targetUrl);
   const listenHost = opts.listenHost ?? '127.0.0.1';
   const targetHref = target.href;
+  const logger: Logger = new ConsoleLogger(undefined, opts.logLevel ?? LogLevel.Info);
+  let nextConnId = 1;
 
   const bridges = new Map<Socket, () => void>();
   const sockets = new Set<Socket>();
@@ -94,7 +103,7 @@ export function startForwarder(opts: StartForwarderOptions): Promise<Forwarder>
 
   const server = createServer((tcp) => {
     sockets.add(tcp);
-    bridges.set(tcp, bridgeConnection(tcp, targetHref, bridges, sockets));
+    bridges.set(tcp, bridgeConnection(tcp, targetHref, bridges, sockets, logger, nextConnId++));
   });
 
   const close = (): Promise<void> => {
@@ -132,6 +141,9 @@ export function startForwarder(opts: StartForwarderOptions): Promise<Forwarder>
   });
 }
 
+/** Why a bridge tore down. Surfaces in the `bridge.closed` log record. */
+type CloseReason = 'shutdown' | 'tcp-close' | 'tcp-error' | 'ws-close' | 'ws-error';
+
 /**
  * Wires one TCP socket to one fresh WebSocket. Returns a teardown closure
  * that closes both ends idempotently; the caller registers it in `bridges`
@@ -142,12 +154,17 @@ function bridgeConnection(
   targetHref: string,
   bridges: Map<Socket, () => void>,
   sockets: Set<Socket>,
+  logger: Logger,
+  connId: number,
 ): () => void {
   const ws = new WebSocket(targetHref);
   const outgoing = new LineScanner();
   const pending: string[] = [];
   let wsReady = false;
   let bridgeClosed = false;
+  const remote = `${tcp.remoteAddress ?? '?'}:${tcp.remotePort ?? '?'}`;
+
+  logger.info('bridge.accepted', { conn: connId, remote });
 
   const sendLine = (line: string): void => {
     if (wsReady) ws.send(line);
@@ -156,28 +173,35 @@ function bridgeConnection(
 
   tcp.on('data', (chunk: Buffer) => {
     for (const line of outgoing.push(chunk)) {
-      if (line.length > 0) sendLine(line);
+      if (line.length > 0) {
+        logger.debug('tcp.line', { conn: connId, line });
+        sendLine(line);
+      }
     }
   });
 
   ws.on('open', () => {
     wsReady = true;
+    const flushed = pending.length;
     for (const line of pending) ws.send(line);
     pending.length = 0;
+    logger.debug('ws.open', { conn: connId, flushed });
   });
 
   ws.on('message', (data: RawData) => {
     const text = toBuffer(data).toString('utf8');
+    logger.debug('ws.frame', { conn: connId, frame: text });
     for (const line of splitFrameLines(text)) {
       if (line.length > 0) tcp.write(`${line}\r\n`);
     }
   });
 
-  const teardown = (): void => {
+  const teardown = (reason: CloseReason): void => {
     if (bridgeClosed) return;
     bridgeClosed = true;
     bridges.delete(tcp);
     sockets.delete(tcp);
+    logger.info('bridge.closed', { conn: connId, reason });
     // ws.close() does not throw: on a CONNECTING socket it aborts the
     // handshake and emits an 'error' event, which our handler suppresses
     // via the `bridgeClosed` guard set above.
@@ -185,25 +209,25 @@ function bridgeConnection(
     tcp.destroy();
   };
 
-  tcp.on('close', teardown);
+  tcp.on('close', () => teardown('tcp-close'));
   tcp.on('error', (err) => {
     // Errors that arrive after we already tore this bridge down (e.g. an
     // RST echoing our own `destroy()`) are expected — don't log them.
     if (bridgeClosed) return;
-    logError('forwarder tcp socket error', err);
-    teardown();
+    logger.error('forwarder tcp socket error', { conn: connId, err });
+    teardown('tcp-error');
   });
-  ws.on('close', teardown);
+  ws.on('close', () => teardown('ws-close'));
   ws.on('error', (err) => {
     // Same suppression as above; also covers the benign "closed before the
     // connection was established" event ws emits when we close() a socket
     // that was still CONNECTING at shutdown time.
     if (bridgeClosed) return;
-    logError('forwarder upstream ws error', err);
-    teardown();
+    logger.error('forwarder upstream ws error', { conn: connId, err });
+    teardown('ws-error');
   });
 
-  return teardown;
+  return () => teardown('shutdown');
 }
 
 /**
@@ -229,16 +253,3 @@ export function toBuffer(data: RawData): Buffer {
   if (data instanceof ArrayBuffer) return Buffer.from(data);
   return Buffer.from(data as Uint8Array);
 }
-
-function logError(msg: string, err: unknown): void {
-  const payload = {
-    ts: new Date().toISOString(),
-    level: 'error',
-    msg,
-    err:
-      err instanceof Error
-        ? { name: err.name, message: err.message, stack: err.stack }
-        : String(err),
-  };
-  console.error(JSON.stringify(payload));
-}

package/tools/tcp-ws-forwarder/src/logger.ts

@@ -0,0 +1,155 @@
+/**
+ * Self-contained structured logger for the TCP↔WS forwarder.
+ *
+ * The forwarder is deliberately dependency-free (no `@serverless-ircd/*`
+ * import) so it can ship as a standalone tool, but it mirrors the irc-core
+ * logging conventions so output is consistent across the monorepo:
+ *
+ *   - numeric {@link LogLevel} enum with `debug < info < warn < error`;
+ *   - one JSON line per record (`{ ts, level, msg, ...fields }`);
+ *   - `minLevel` filtering;
+ *   - injectable sinks (so tests never touch the real `console`); and
+ *   - automatic `Error` serialization — any field value that is an `Error`
+ *     becomes `{ name, message, stack }`, matching the legacy `logError`
+ *     output the existing tests assert on.
+ */
+
+/** Severity. Ordering matters: a logger set to `Info` suppresses `Debug`. */
+export enum LogLevel {
+  Debug = 10,
+  Info = 20,
+  Warn = 30,
+  Error = 40,
+}
+
+/** String label written as the `level` field of each record. */
+export function logLevelLabel(level: LogLevel): LogLevelLabel {
+  switch (level) {
+    case LogLevel.Debug:
+      return 'debug';
+    case LogLevel.Info:
+      return 'info';
+    case LogLevel.Warn:
+      return 'warn';
+    case LogLevel.Error:
+      return 'error';
+  }
+}
+
+/** A parsed, case-insensitive log-level label. */
+export type LogLevelLabel = 'debug' | 'info' | 'warn' | 'error';
+
+const LABEL_TO_LEVEL: Record<LogLevelLabel, LogLevel> = {
+  debug: LogLevel.Debug,
+  info: LogLevel.Info,
+  warn: LogLevel.Warn,
+  error: LogLevel.Error,
+};
+
+/**
+ * Parses a log-level label (case-insensitive, whitespace-trimmed) into a
+ * {@link LogLevel}. Throws on anything that is not one of the four canonical
+ * labels so a typo at startup fails loudly instead of silently degrading to a
+ * default.
+ */
+export function parseLogLevel(raw: string): LogLevel {
+  const key = raw.trim().toLowerCase();
+  if (key in LABEL_TO_LEVEL) {
+    return LABEL_TO_LEVEL[key as LogLevelLabel];
+  }
+  throw new Error(`unknown log level "${raw}" (expected one of: debug, info, warn, error)`);
+}
+
+/** Per-level output sinks. Defaults to the global `console`. */
+export interface LoggerSinks {
+  debug(line: string): void;
+  info(line: string): void;
+  warn(line: string): void;
+  error(line: string): void;
+}
+
+/** Minimal structured logger port the forwarder speaks. */
+export interface Logger {
+  debug(msg: string, fields?: Record<string, unknown>): void;
+  info(msg: string, fields?: Record<string, unknown>): void;
+  warn(msg: string, fields?: Record<string, unknown>): void;
+  error(msg: string, fields?: Record<string, unknown>): void;
+}
+
+/**
+ * Structured logger that writes one JSON line per record.
+ *
+ * Output shape: `{ ts, level, msg, ...fields }`. Any field value that is an
+ * `Error` is serialized to `{ name, message, stack }`; all other values pass
+ * through unchanged (so non-Error errors surface as their string form).
+ */
+export class ConsoleLogger implements Logger {
+  private readonly minLevel: LogLevel;
+  private readonly sinks: LoggerSinks;
+
+  constructor(sinks?: LoggerSinks, minLevel: LogLevel = LogLevel.Debug) {
+    this.sinks = sinks ?? globalConsoleSinks();
+    this.minLevel = minLevel;
+  }
+
+  debug(msg: string, fields?: Record<string, unknown>): void {
+    this.write(LogLevel.Debug, msg, fields);
+  }
+  info(msg: string, fields?: Record<string, unknown>): void {
+    this.write(LogLevel.Info, msg, fields);
+  }
+  warn(msg: string, fields?: Record<string, unknown>): void {
+    this.write(LogLevel.Warn, msg, fields);
+  }
+  error(msg: string, fields?: Record<string, unknown>): void {
+    this.write(LogLevel.Error, msg, fields);
+  }
+
+  private write(level: LogLevel, msg: string, fields?: Record<string, unknown>): void {
+    if (level < this.minLevel) return;
+    const payload: Record<string, unknown> = {
+      ts: new Date().toISOString(),
+      level: logLevelLabel(level),
+      msg,
+    };
+    if (fields !== undefined) {
+      for (const [key, value] of Object.entries(fields)) {
+        payload[key] = value instanceof Error ? serializeError(value) : value;
+      }
+    }
+    const line = JSON.stringify(payload);
+    switch (level) {
+      case LogLevel.Debug:
+        this.sinks.debug(line);
+        return;
+      case LogLevel.Info:
+        this.sinks.info(line);
+        return;
+      case LogLevel.Warn:
+        this.sinks.warn(line);
+        return;
+      case LogLevel.Error:
+        this.sinks.error(line);
+        return;
+    }
+  }
+}
+
+/** Returns the global `console` mapped onto {@link LoggerSinks}. */
+function globalConsoleSinks(): LoggerSinks {
+  const c = (globalThis as { console?: Partial<Console> }).console;
+  if (c === undefined) {
+    const drop = (): void => {};
+    return { debug: drop, info: drop, warn: drop, error: drop };
+  }
+  return {
+    debug: (l) => c.debug?.(l),
+    info: (l) => c.info?.(l),
+    warn: (l) => c.warn?.(l),
+    error: (l) => c.error?.(l),
+  };
+}
+
+function serializeError(err: Error): { name: string; message: string; stack: string | undefined } {
+  return { name: err.name, message: err.message, stack: err.stack };
+}