logger

type Logger struct {
	// contains filtered or unexported fields
}

type Options struct {
	// LogsDir is the directory for log files. Required for file logging.
	LogsDir string

	// Filename overrides the log file name within LogsDir.
	// Defaults to "clawker.log" when empty.
	Filename string

	// File rotation settings.
	MaxSizeMB  int  // default: 50
	MaxAgeDays int  // default: 7
	MaxBackups int  // default: 3
	Compress   bool // default: true

	// Otel configures the OTEL zerolog bridge. Nil disables OTEL export.
	Otel *OtelOptions

	// EchoStdout mirrors every record to os.Stdout in addition to the
	// file (and OTEL bridge if configured). Intended for containerized
	// daemons whose structured logs should also surface in
	// `docker logs <container>`; host-side CLI logging leaves this off.
	EchoStdout bool
}

type OtelOptions struct {
	Endpoint       string        // e.g. "localhost:4317"
	Insecure       bool          // default: true (local collector)
	Timeout        time.Duration // export timeout
	MaxQueueSize   int           // batch processor queue size
	ExportInterval time.Duration // batch export interval

	// ServiceName stamps `service.name` on the Resource attached to every
	// emitted log record. Required when the collector routes on this
	// attribute (routing/trusted, routing/untrusted in otel-config.yaml).
	// Empty leaves the SDK default ("unknown_service:<binary>") which is
	// dropped silently at the routing connector. Callers: "clawker-cli"
	// (host CLI), "clawker-cp" (control plane).
	ServiceName string

	// mTLS configuration. Two mutually-exclusive shapes:
	//
	//   - File-path triple (CACertFile + ClientCertFile + ClientKeyFile).
	//     The exporter reads PEM material from disk at New time. No
	//     in-tree consumer today — clawker-cp uses the TLSConfig path
	//     below, clawker-cli runs Insecure=true on the untrusted otlp
	//     receiver (CLI leaves chain to the CLI root, not the infra
	//     intermediate, so they cannot complete the otlp/infra
	//     handshake), and Envoy/CoreDNS read their bind-mounted PEM via
	//     their own native config (not this struct). Shape preserved
	//     for any future on-disk-cert consumer. If any one of the three
	//     is set, all three must be set.
	//
	//   - In-process tls.Config. The exporter is given a fully-formed
	//     *tls.Config (typically built by
	//     internal/controlplane/otelcerts.Service.LoadTLSConfig with a
	//     GetClientCertificate hook that re-mints on every handshake).
	//     Used by the clawker-cp daemon's own OTel exporter so the leaf
	//     never lands on disk and rotation matches the connection
	//     lifecycle.
	//
	// At most one shape may be set. Insecure is ignored when either is
	// populated.
	CACertFile     string
	ClientCertFile string
	ClientKeyFile  string

	// TLSConfig is the in-process counterpart to the file-path triple.
	// When non-nil, the exporter uses it directly and the file-path
	// fields are not consulted. Construction is the caller's
	// responsibility — see internal/controlplane/otelcerts for the
	// trusted-lane wiring used by clawker-cp.
	TLSConfig *tls.Config
}