Interface Logger

Structured logging. log is synchronous and called on hot paths, so it must not throw and should hand off rather than block. Call sites put policy facts and identifiers in fields, never secrets (credentials live in Ports.secrets, which is never logged).

interface Logger {
    log(
        level: "debug" | "info" | "warn" | "error",
        event: string,
        fields: Record<string, unknown>,
    ): void;
}