fix(client): keep HMR alive when Trusted Types blocks the logging runtime

Under a require-trusted-types-for 'script' CSP, tapable — bundled
through webpack's logging runtime — cannot compile its hooks: the first
log call throws an EvalError from new Function, killing whatever
listener happened to log (and with it the update flow). The logger
methods are now guarded, so webpack's logging runtime stays the engine
and enforcement just turns logging off.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: bjohansebas

client-src/utils/log.js

@@ -1,84 +1,46 @@
-/* eslint-disable no-console -- this module is the console logger */
-// A self-contained level-gated console logger. webpack's logging runtime is
-// deliberately not used: it pulls tapable into the bundle, whose hook
-// compiler calls `new Function` — which throws under a
-// `require-trusted-types-for 'script'` Content Security Policy.
-
-const LOG_PREFIX = "[webpack-dev-middleware]";
-
-/** @typedef {false | true | "none" | "error" | "warn" | "info" | "log" | "verbose"} LogLevel */
-
-const LEVELS = ["none", "error", "warn", "info", "log", "verbose"];
+// @ts-expect-error -- no published types for this entry point
+import logger from "webpack/lib/logging/runtime.js";
 
+const LOGGER_NAME = "webpack-dev-middleware";
 const DEFAULT_LEVEL = "info";
 
-let currentLevel = DEFAULT_LEVEL;
+/** @typedef {false | true | "none" | "error" | "warn" | "info" | "log" | "verbose"} LogLevel */
 
 /**
- * @param {LogLevel} level log level (or `false` for off, `true` for "log")
+ * @param {LogLevel} level log level (or `false` for off, `true` for default)
  */
 export function setLogLevel(level) {
-  if (level === false) {
-    currentLevel = "none";
-  } else if (level === true) {
-    currentLevel = "log";
-  } else if (LEVELS.includes(level)) {
-    currentLevel = level;
-  }
+  logger.configureDefaultLogger({ level });
 }
 
-/**
- * @param {string} level level of the message
- * @returns {boolean} true when the current level shows the message
- */
-function enabled(level) {
-  return LEVELS.indexOf(currentLevel) >= LEVELS.indexOf(level);
-}
+setLogLevel(DEFAULT_LEVEL);
+
+const rawLog = logger.getLogger(LOGGER_NAME);
 
 /**
- * Prefix like webpack's logger: merged into the first argument when it is a
- * string, passed separately otherwise (e.g. Error objects).
- * @param {unknown[]} args arguments
- * @returns {unknown[]} prefixed arguments
+ * Guard a logger method: under a `require-trusted-types-for 'script'`
+ * Content Security Policy, tapable (bundled through webpack's logging
+ * runtime) cannot compile its hooks — `new Function` throws an EvalError on
+ * the first log call. Swallowing it keeps HMR fully functional with logging
+ * off instead of breaking whatever listener happened to log.
+ * @param {string} method logger method name
+ * @returns {(...args: unknown[]) => void} guarded method
  */
-function prefixed(args) {
-  return typeof args[0] === "string"
-    ? [`${LOG_PREFIX} ${args[0]}`, ...args.slice(1)]
-    : [LOG_PREFIX, ...args];
+function guarded(method) {
+  return (...args) => {
+    try {
+      rawLog[method](...args);
+    } catch {
+      // Logging is unavailable (e.g. Trusted Types enforcement).
+    }
+  };
 }
 
 export const log = {
-  /**
-   * @param {...unknown} args arguments
-   */
-  error(...args) {
-    if (enabled("error")) console.error(...prefixed(args));
-  },
-  /**
-   * @param {...unknown} args arguments
-   */
-  warn(...args) {
-    if (enabled("warn")) console.warn(...prefixed(args));
-  },
-  /**
-   * @param {...unknown} args arguments
-   */
-  info(...args) {
-    if (enabled("info")) console.info(...prefixed(args));
-  },
-  /**
-   * @param {...unknown} args arguments
-   */
-  log(...args) {
-    if (enabled("log")) console.log(...prefixed(args));
-  },
-  /**
-   * @param {...unknown} args arguments
-   */
-  groupCollapsed(...args) {
-    if (enabled("log")) console.groupCollapsed(...prefixed(args));
-  },
-  groupEnd() {
-    if (enabled("log")) console.groupEnd();
-  },
+  error: guarded("error"),
+  warn: guarded("warn"),
+  info: guarded("info"),
+  log: guarded("log"),
+  groupCollapsed: guarded("groupCollapsed"),
+  groupEnd: guarded("groupEnd"),
 };