Structured logging in JSON format is implemented

Unstructured console.log output is unsearchable, unqueryable, and useless when diagnosing production incidents. Without consistent fields — level, timestamp, traceId, userId — correlating a user-reported failure to a server-side log line can take hours. NIST SP 800-53 AU-3 mandates that audit records contain sufficient information to establish what events occurred and who was responsible. ISO 25010 reliability.fault-tolerance requires detectable failure conditions; logs that can't be filtered by severity or correlated by trace ID fail that standard.

Replace console.log calls with a structured logging library. Pino is the lowest-overhead choice for Node.js; winston is more configurable for multi-transport needs.

// lib/logger.ts
import pino from 'pino'

export const logger = pino({
  level: process.env.LOG_LEVEL ?? 'info',
  base: { service: 'api' },
})

// Usage:
logger.info(
  { userId: session.userId, traceId: req.headers['x-trace-id'] },
  'Payment initiated'
)

Every log call must include at minimum level, timestamp (automatic with pino), and one correlation ID (traceId or requestId). Configure LOG_LEVEL=warn in production to suppress debug noise.