Structured Logger With Redaction

Specify a structured logger that is safe to ship. JSON in production, pretty in dev, secrets never in the line. STACK [PINO | WINSTON | CONSOLE — pick if I do not] Runtime: [NODE] What we log on each request: [METHOD, PATH, STATUS, DURATION, REQUEST ID, USER ID] What we must redact: [AUTHORIZATION, COOKIE, PASSWORD, TOKEN, EMAIL IF I SAY SO] DELIVER 1) The logger setup: level from env, redact paths, and the base fields (service, env). 2) Request middleware that assigns a request id, accepts an incoming id if it matches a safe pattern, and returns it on the response header. 3) The child logger pattern so a handler does not re-bind the same fields. 4) An error log that includes the stack in server logs and a generic message to the client. 5) A unit test that a password field becomes "[Redacted]" and that we did not log the header by accident. 6) What not to log at info: full bodies, SQL text with literals, payment payloads. Do not use a log line as a metric. Mention the one metric this request should emit instead.