/** Log server-owned routing metadata, never credentials carried by URLs or headers. */
export function safeRequestRoute(request: unknown): string {
  if (!request || typeof request !== 'object') return '[unmatched route]';
  const req = request as { route?: { path?: unknown }; raw?: { route?: { path?: unknown } } };
  const path = req.route?.path ?? req.raw?.route?.path;
  return typeof path === 'string' ? path : '[unmatched route]';
}

export const safeHttpSerializers = {
  req(request: {
    method?: string;
    route?: { path?: unknown };
    raw?: { route?: { path?: unknown } };
  }) {
    return { method: request.method, route: safeRequestRoute(request) };
  },
  res(response: { statusCode?: number }) {
    return { statusCode: response.statusCode };
  },
  err(_error: unknown) {
    // Driver/SMTP errors can contain SQL parameters, tokens, headers or message bodies.
    return { type: 'Error', message: 'Request failed; sensitive error details omitted' };
  },
};