feat(diagnostics): correlate staff operations errors and audit records

src/lib/logger.ts

@@ -1,6 +1,7 @@
 import pino from "pino";
 import { env } from "@/env";
 import { captureCmsError } from "./error-monitor";
+import { getOperationContext } from "./foundation/request-context";
 
 type LogLevel = "debug" | "info" | "warn" | "error";
 
@@ -31,16 +32,16 @@ export function generateRequestId(): string {
 	return `${Date.now().toString(36)}-${requestIdCounter.toString(36)}`;
 }
 
-/** Compatibility wrapper — existing call sites use (message, meta). */
+/** Compatibility wrapper — existing call sites use (message, meta). */
 export const logger = {
 	debug(message: string, meta: Record<string, unknown> = {}): void {
-		pinoLogger.debug(meta, message);
+		pinoLogger.debug({ ...meta, ...getOperationContext() }, message);
 	},
 	info(message: string, meta: Record<string, unknown> = {}): void {
-		pinoLogger.info(meta, message);
+		pinoLogger.info({ ...meta, ...getOperationContext() }, message);
 	},
 	warn(message: string, meta: Record<string, unknown> = {}): void {
-		pinoLogger.warn(meta, message);
+		pinoLogger.warn({ ...meta, ...getOperationContext() }, message);
 	},
 	error(message: string, meta: Record<string, unknown> = {}): string {
 		const error =
@@ -55,8 +56,11 @@ export const logger = {
 									? meta.error
 									: message,
 						);
-		const errorId = captureCmsError("server", message, error, meta);
-		pinoLogger.error({ ...meta, errorId }, message);
+		const operation = getOperationContext();
+		// Keep trusted correlation first so bounded error context retains it.
+		const context = { ...operation, ...meta, ...operation };
+		const errorId = captureCmsError("server", message, error, context);
+		pinoLogger.error({ ...context, errorId }, message);
 		return errorId;
 	},
 };