§9 trace all fetch + ENV service name + leveled logging (todo §9 follow-up); route every outbound fetch through the request logger, make the OTLP service name implementer-configurable, and add proper leveled logging throughout. An AsyncLocalStorage<Log> makes the per-request logger ambient (runWithLog/currentLog), so all outbound fetch traces with no signature churn: tracedFetch (a typeof fetch) routes through the active request log (client span + propagated W3C traceparent) for string/URL inputs, else plain fetch; server.ts wires it under the Ory timeout into every Kratos/Keto/Hydra + JWKS call (timeout still honoured — log.fetch spreads {...init,headers}). RequestContext gained ctx.log (request logger; additive/contract-stable, silent default) so a handler/plugin logs in-trace and ctx.log.fetch(url) traces upstream calls; the reference plugin's createUpstream defaults to tracedFetch and its handlers log via ctx.log; plugin-api.ts exports tracedFetch + the Log class. SERVICE_NAME (config + createLogger({serviceName})) brands the OTLP service.name. Leveled logging: who-did-what audit info lines on every admin write (user/group/role/client create·delete·assign — actor/target, no secrets), info on login (session mint) + logout, warn on missing-role 403 + CSRF rejections + Ory-unreachable, debug on a JWKS kid-miss reload. app.ts's handler body was extracted to handleRequest run inside runWithLog; end() now fires exactly once after BOTH the handler unwinds AND the response closes, so a client abort mid-handler can't end the log out from under a still-running ctx.log/tracedFetch (regression-tested) and the happy-path access line is never dropped. bootstrap.ts wraps main in runWithLog + traces the seed calls. Tests extended (logger: serviceName/runWithLog/currentLog/tracedFetch-continues-trace; config: SERVICE_NAME; context: ctx.log default+passthrough; app: ctx.log in-trace + ctx.log.fetch propagation + the abort race; plugin-api: tracedFetch+Log). Stability-reviewer: APPROVE, no Critical/High (fixed the abort-race end(); green nits addressed). docs/plugin-contract.md (ctx.log/ctx.log.fetch/tracedFetch) + README (config, Observability tracing/serviceName, plugin note, Layout) updated. typecheck + 333 units + the full scripts/ci.sh E2E gate green (326 → 333).

src/logger.test.ts

@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import { test } from "node:test";
-import { createLogger, requestLogger, SERVICE_NAME } from "./logger.ts";
+import { createLogger, currentLog, requestLogger, runWithLog, SERVICE_NAME, tracedFetch } from "./logger.ts";
 
 // A capture pair so a test reads exactly what hit stdout/stderr without touching the console.
 function capture() {
@@ -26,6 +26,11 @@ test("createLogger: tags service.name, routes by severity, gates on level, honou
   assert.equal(rec.n, 1); // metadata kept native in JSON
 });
 
+test("createLogger: service.name is overridable (implementer sets their own)", () => {
+  assert.equal(createLogger({}).context["service.name"], SERVICE_NAME); // default
+  assert.equal(createLogger({ serviceName: "acme-ops" }).context["service.name"], "acme-ops");
+});
+
 test("createLogger: level none silences every severity", () => {
   const c = capture();
   const log = createLogger({ level: "none", stderr: c.stderr, stdout: c.stdout });
@@ -92,3 +97,36 @@ test("requestLogger: a malformed traceparent is ignored, not thrown (starts a fr
   const tp = requestLogger(app, { requestId: "x", traceparent: "garbage" }).traceparent();
   assert.match(tp, /^00-[0-9a-f]{32}-[0-9a-f]{16}-[0-9a-f]{2}$/);
 });
+
+test("runWithLog/currentLog: the active request log is ambiently available within the scope", () => {
+  const app = createLogger({ stderr: () => {}, stdout: () => {} });
+  assert.equal(currentLog(), undefined); // none outside a request
+  const req = requestLogger(app, { requestId: "r1" });
+  const seen = runWithLog(req, () => currentLog());
+  assert.equal(seen, req);
+  assert.equal(currentLog(), undefined); // scope ended
+});
+
+test("tracedFetch: traces through the active request log (continuing its trace), plain otherwise", async () => {
+  const orig = globalThis.fetch;
+  const seen: { traceparent: string | undefined; url: string }[] = [];
+  globalThis.fetch = async (input, init) => {
+    seen.push({ traceparent: new Headers(init?.headers).get("traceparent") ?? undefined, url: String(input) });
+    return new Response("{}", { status: 200 });
+  };
+  try {
+    // Outside a request: no logger, so no traceparent is injected (plain fetch).
+    await tracedFetch("http://up.test/a");
+    assert.equal(seen.at(-1)!.traceparent, undefined);
+
+    // Inside runWithLog: the call is routed through req.fetch → a traceparent continuing req's trace.
+    const app = createLogger({ stderr: () => {}, stdout: () => {} });
+    const req = requestLogger(app, { requestId: "r2", traceparent: "00-0af7651916cd43dd8448eb211c80319c-b7ad6b7169203331-01" });
+    await runWithLog(req, () => tracedFetch("http://up.test/b"));
+    const tp = seen.at(-1)!.traceparent;
+    assert.ok(tp, "injects a traceparent inside a request");
+    assert.equal(tp!.split("-")[1], "0af7651916cd43dd8448eb211c80319c", "continues the request's trace");
+  } finally {
+    globalThis.fetch = orig;
+  }
+});