/**
 * Structured logger for LLMHosts frontend API routes.
 *
 * Uses Pino with PII redaction so emails, passwords, tokens, and other
 * sensitive values are never written to log output.  All log entries are
 * JSON-formatted for machine parsing by log aggregators (Loki/Promtail).
 *
 * Usage in API routes:
 *   import { logger } from "@/lib/logger";
 *   logger.info({ action: "register" }, "User registration attempt");
 *   logger.warn({ action: "login_failed", reason: "invalid_password" }, "Auth failed");
 *   logger.error({ err }, "Unexpected error in checkout flow");
 *
 * What NOT to do:
 *   logger.info(`Registered ${email}`);    // ← PII in message — use structured field
 *   logger.error("Error:", error.message); // ← unstructured — pass { err: error }
 */

import pino from "pino";

// Paths that Pino will replace with [REDACTED] in structured log fields.
// This is a safety net — do not rely on it: never put PII in log messages.
const REDACTED_PATHS = [
  "email",
  "password",
  "passwordHash",
  "token",
  "verificationToken",
  "resetToken",
  "name",
  "ip",
  "body.email",
  "body.password",
  "body.name",
  "body.token",
  "*.email",
  "*.password",
  "*.passwordHash",
  "*.token",
];

const isDev = process.env.NODE_ENV !== "production";

const logger = pino({
  name: "llmhosts-frontend",
  level: isDev ? "debug" : "info",
  redact: {
    paths: REDACTED_PATHS,
    censor: "[REDACTED]",
  },
  // Consistent timestamp format for log aggregators
  timestamp: pino.stdTimeFunctions.isoTime,
  // Include service context on every entry
  base: {
    service: "llmhosts-frontend",
    env: process.env.NODE_ENV ?? "unknown",
  },
  ...(isDev && {
    transport: {
      target: "pino-pretty",
      options: {
        colorize: true,
        translateTime: false, // already ISO
        ignore: "pid,hostname",
        singleLine: false,
      },
    },
  }),
});

export { logger };
export default logger;
