Replace Winston with in-house logger implementation

[Jayden Chan (jayden-chan)]

Replaces Winston with a much more lightweight in-house logger implementation.

Rationale:

• Improve performance by removing unnecessary features and formatting machinery
• Reduce long term maintenance burden by removing Winston dependency
• Reduce attack surface by removing Winston dependency
• Add dedicated log collection mechanism which fixes a bug with the old Winston-based logger

[Copilot]

🟡 Changes recommended

Shared-stream backpressure, stale logger configuration, and release compatibility remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Review details

Files not reviewed (1)

• packages/logger/package-lock.json: Generated file

Suppressed comments (2)

packages/logger/README.md:49

• The public Sink API has no type discriminator or separate console variant; every sink is configured with a Node.js Writable stream. This sentence advertises sink types that do not exist. Describe stdout and stderr as writable-stream examples instead.

The supported sink types are `console` and `stream`.

packages/logger/CHANGELOG.md:19

• This release note still says callers can configure a console sink, but the replacement API exposes only writable-stream sinks. Update the migration guidance so it matches the new Sink type.

- Removed `SSQT_LOG_TRANSPORTS`; configure `console` or writable `stream` sink through `initializeLogger`.

• Files reviewed: 32/34 changed files
• Comments generated: 4
• Review effort level: Balanced

[Copilot]

Copilot review overview

🔵 Needs a closer look

An Express test helper still uses the removed logLevel option, causing compilation failure or incorrect logger behavior.

Review effort: Balanced
Findings: 1

Open (1)

• The updated logger API removes LoggerConfig.logLevel, but `packages/express-boilerplate/src/tests/…

Resolved since last review (3)

• Honor writable stream backpressure for sink output
• Migrate Express test helper from logLevel to level
• Preserve out-of-range BigInt values during serialization

Files not reviewed (1)

• packages/logger/package-lock.json: Generated file

Previously missed (3)

In code that hasn't changed since last review

Update test logger configuration and sinks

packages/​logger/​src/​logger.ts:57

LoggerConfig no longer accepts logLevel, but packages/express-boilerplate/src/tests/util.ts:12-14 still initializes the test logger with { logLevel: "crit" }. That excess property fails TypeScript compilation now that Express resolves this API; if type checking is bypassed, it is silently ignored and the logger uses the default info level and stdout sink. Update the helper to use level: "crit" and explicitly set sinks if tests should remain quiet.

Correct migration note for writable-stream sink configuration

packages/​logger/​CHANGELOG.md:19

The replacement API has no console or stream sink discriminator; each sink is { stream: Writable }. Update this migration note so it describes the actual initializeLogger configuration.

Document sinks as writable streams only

packages/​logger/​README.md:49

The public Sink API only accepts { stream: Writable }; it has no console or stream type discriminator. This sentence advertises configuration variants that consumers cannot use. Describe writable-stream sinks instead.

[Copilot]

Copilot review overview

🟢 Approval recommended

Remaining feedback is limited to minor documentation consistency issues.

Review effort: Balanced
Findings: 1

Open (1)

• The updated logger API removes LoggerConfig.logLevel, but `packages/express-boilerplate/src/tests/…

Files not reviewed (1)

• packages/logger/package-lock.json: Generated file

Previously missed (3)

In code that hasn't changed since last review

Add missing 4.0.0 changelog link reference

packages/​logger/​CHANGELOG.md:10

This reference-style [4.0.0] heading has no matching link definition at the bottom of the changelog, unlike the existing release headings, so it renders as plain bracketed text. Add the 4.0.0 release reference when the release URL is finalized.

Document supported writable-stream Sink configuration

packages/​logger/​CHANGELOG.md:19

The new Sink API accepts only { stream: Writable }; there is no console sink kind. This migration note should describe the supported writable-stream configuration rather than direct users to a removed transport type.

Correct Sink documentation to describe writable streams

packages/​logger/​README.md:49

The exported Sink type is { stream: Writable }; it has no console or stream discriminator. This sentence could lead users to try the removed transport-style configuration, so describe stdout and stderr as writable streams instead.