@lowdefy/server 6.0.0 → 6.1.0

package/client/Page.jsx

@@ -28,6 +28,9 @@ import blocks from '../build/plugins/blocks.js';
 import icons from '../build/plugins/icons.js';
 import operators from '../build/plugins/operators/client.js';
 import jsMap from '../build/plugins/operators/clientJsMap.js';
+import appMeta from '../build/appMeta.json';
+
+import shouldReloadForBuild from './shouldReloadForBuild.js';
 
 // Replaces lib/client/Page.js. The first page renders from the config
 // embedded in the HTML; SPA navigations fetch /api/page/* and swap pageConfig.
@@ -66,8 +69,18 @@ function Page({ auth, config, lowdefy }) {
           }
           return;
         }
-        const { pageConfig: nextPageConfig } = await res.json();
+        const { buildId, pageConfig: nextPageConfig } = await res.json();
         if (token !== latestNavRef.current) return;
+        if (
+          shouldReloadForBuild({ bundleBuildId: appMeta.buildId, serverBuildId: buildId, window })
+        ) {
+          // The app was redeployed after this bundle loaded, so the config may
+          // reference _js functions and plugins this bundle does not carry.
+          // The router has already pushed the target URL, so a reload lands
+          // on the requested page with the current bundle.
+          window.location.reload();
+          return;
+        }
         setPageConfig(nextPageConfig);
       } catch (error) {
         // Network failure on SPA navigation — fall back to a full page load.

package/client/clientBuildImports.test.mjs

@@ -0,0 +1,61 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+// Everything the client imports from build/ ships in the browser bundle. build/config.json is
+// server-only: it carries every deployment environment's settings (other environments' urls,
+// secret names, email filters). The client learns only the current environment's name and
+// switched-off features, through appMeta. This allowlist fails the build of any new client import
+// of a build artifact until it has been checked for what it exposes.
+const allowed = new Set([
+  'auth.json',
+  'appMeta.json',
+  'logger.json',
+  'i18n/antdLocales.js',
+  'i18n/antdXLocales.js',
+  'i18n/dayjsLocales.js',
+  'plugins/actions.js',
+  'plugins/blockMetas.json',
+  'plugins/blocks.js',
+  'plugins/icons.js',
+  'plugins/operators/client.js',
+  'plugins/operators/clientJsMap.js',
+]);
+
+const root = path.join(path.dirname(fileURLToPath(import.meta.url)), '..');
+
+function listSourceFiles(dir) {
+  return fs.readdirSync(dir, { withFileTypes: true }).flatMap((entry) => {
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) return listSourceFiles(full);
+    return /\.(js|jsx|mjs)$/.test(entry.name) && !entry.name.includes('.test.') ? [full] : [];
+  });
+}
+
+test('client code imports only client-safe build artifacts', () => {
+  const imported = ['client', 'lib/client'].flatMap((dir) =>
+    listSourceFiles(path.join(root, dir)).flatMap((file) =>
+      [...fs.readFileSync(file, 'utf8').matchAll(/from '[^']*\/build\/([^']+)'/g)].map(
+        (match) => ({ file: path.relative(root, file), artifact: match[1] })
+      )
+    )
+  );
+  expect(imported.length).toBeGreaterThan(0);
+  expect(imported.filter(({ artifact }) => !allowed.has(artifact))).toEqual([]);
+});

package/client/shouldReloadForBuild.js

@@ -0,0 +1,48 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { type } from '@lowdefy/helpers';
+
+// sessionStorage key holding the server build this tab last reloaded for.
+const RELOADED_FOR_BUILD_KEY = 'lowdefy.reloadedForBuild';
+
+// True when a page config fetched during SPA navigation came from a newer
+// deploy than the bundle this tab is running, so the tab must do a full load
+// to pick up the current bundle. Without this the new config can reference
+// _js functions the old bundle never shipped, and the page throws mid-event.
+//
+// A tab reloads at most once per server build: if the freshly loaded bundle
+// still disagrees with the server (a rolling deploy answering from mixed
+// versions, a proxy caching old HTML), reloading again would loop forever.
+// The old-config-on-old-bundle throw is the lesser failure in that case.
+function shouldReloadForBuild({ bundleBuildId, serverBuildId, window }) {
+  if (type.isNone(serverBuildId) || serverBuildId === bundleBuildId) {
+    return false;
+  }
+  try {
+    if (window.sessionStorage.getItem(RELOADED_FOR_BUILD_KEY) === serverBuildId) {
+      return false;
+    }
+    window.sessionStorage.setItem(RELOADED_FOR_BUILD_KEY, serverBuildId);
+  } catch (error) {
+    // Browsers with storage disabled throw on sessionStorage access. Without
+    // the once-per-build record the loop guard cannot work, so do not reload.
+    return false;
+  }
+  return true;
+}
+
+export default shouldReloadForBuild;

package/client/shouldReloadForBuild.test.mjs

@@ -0,0 +1,75 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import shouldReloadForBuild from './shouldReloadForBuild.js';
+
+function createWindow({ stored = {}, throws = false } = {}) {
+  return {
+    sessionStorage: {
+      getItem: (key) => {
+        if (throws) throw new Error('storage disabled');
+        return stored[key] ?? null;
+      },
+      setItem: (key, value) => {
+        if (throws) throw new Error('storage disabled');
+        stored[key] = value;
+      },
+    },
+  };
+}
+
+test('shouldReloadForBuild is false when the server build matches the bundle', () => {
+  const window = createWindow();
+  expect(shouldReloadForBuild({ bundleBuildId: 'build-1', serverBuildId: 'build-1', window })).toBe(
+    false
+  );
+});
+
+test('shouldReloadForBuild is false when the server sends no build id', () => {
+  const window = createWindow();
+  expect(shouldReloadForBuild({ bundleBuildId: 'build-1', serverBuildId: undefined, window })).toBe(
+    false
+  );
+  expect(shouldReloadForBuild({ bundleBuildId: 'build-1', serverBuildId: null, window })).toBe(
+    false
+  );
+});
+
+test('shouldReloadForBuild is true once per newer server build, then false', () => {
+  const stored = {};
+  const window = createWindow({ stored });
+  expect(shouldReloadForBuild({ bundleBuildId: 'build-1', serverBuildId: 'build-2', window })).toBe(
+    true
+  );
+  expect(stored['lowdefy.reloadedForBuild']).toEqual('build-2');
+  expect(shouldReloadForBuild({ bundleBuildId: 'build-1', serverBuildId: 'build-2', window })).toBe(
+    false
+  );
+});
+
+test('shouldReloadForBuild reloads again when the server moves to a third build', () => {
+  const window = createWindow({ stored: { 'lowdefy.reloadedForBuild': 'build-2' } });
+  expect(shouldReloadForBuild({ bundleBuildId: 'build-2', serverBuildId: 'build-3', window })).toBe(
+    true
+  );
+});
+
+test('shouldReloadForBuild is false when sessionStorage is unavailable', () => {
+  const window = createWindow({ throws: true });
+  expect(shouldReloadForBuild({ bundleBuildId: 'build-1', serverBuildId: 'build-2', window })).toBe(
+    false
+  );
+});

package/lib/client/auth/AuthConfigured.jsx

@@ -26,16 +26,15 @@ import {
   useSession,
 } from '@hono/auth-js/react';
 
-import { serializer } from '@lowdefy/helpers';
-
-import rawLowdefyConfig from '../../../build/config.json';
-
-const lowdefyConfig = serializer.deserialize(rawLowdefyConfig);
+// The app basePath, from Vite's BASE_URL (`${config.basePath}/`, set in
+// vite.config.js). build/config.json is server-only - it carries every
+// deployment environment's settings - so it is never imported into the client.
+const basePath = import.meta.env.BASE_URL.replace(/\/$/, '');
 
 // @hono/auth-js/react configures its fetch paths through a module-level
 // manager instead of SessionProvider props.
-if (lowdefyConfig.basePath) {
-  authConfigManager.setConfig({ basePath: `${lowdefyConfig.basePath}/api/auth` });
+if (basePath) {
+  authConfigManager.setConfig({ basePath: `${basePath}/api/auth` });
 }
 
 function Session({ children }) {

package/lib/server/auth/getAuthConfig.js

@@ -20,6 +20,7 @@ import { getSecretsFromEnv } from '@lowdefy/node-utils';
 import adapters from '../../../build/plugins/auth/adapters.js';
 import appMeta from '../../build/appMeta.js';
 import authJson from '../../build/auth.js';
+import config from '../../build/config.js';
 import callbacks from '../../../build/plugins/auth/callbacks.js';
 import events from '../../../build/plugins/auth/events.js';
 import providers from '../../../build/plugins/auth/providers.js';
@@ -28,6 +29,7 @@ function getAuthConfig({ logger }) {
   return getApiAuthConfig({
     appMeta,
     authJson,
+    config,
     logger,
     plugins: { adapters, callbacks, events, providers },
     secrets: getSecretsFromEnv(),

package/lib/server/log/createHandleError.js

@@ -27,6 +27,9 @@ import {
 } from '@lowdefy/errors';
 
 import captureSentryError from '../sentry/captureSentryError.js';
+import redactUrlQuery from './redactUrlQuery.js';
+import scrubSecrets from '../scrubSecrets.js';
+import serializeErrorForLog from './serializeErrorForLog.js';
 
 function getEventType(error) {
   if (error instanceof ServiceError) {
@@ -92,7 +95,7 @@ function createHandleError({ context }) {
         error.config = location.config;
       }
 
-      // Single structured log call — pino serializes error via extractErrorProps,
+      // Single structured log call — pino serializes the error via serializeErrorForLog,
       // message string gives human-readable display via CLI logger
       const errorName = error?.name || 'Error';
       context.logger.error(
@@ -125,7 +128,7 @@ function createHandleError({ context }) {
             'sec-ch-ua': headers['sec-ch-ua'],
             'user-agent': headers['user-agent'],
             host: headers.host,
-            referer: headers.referer,
+            referer: redactUrlQuery(headers.referer),
             // Non localhost headers
             'x-forwarded-for': headers['x-forwarded-for'],
             // Vercel headers
@@ -154,9 +157,11 @@ function createHandleError({ context }) {
         configLocation: location,
       });
     } catch (e) {
-      console.error(error);
+      // console.error writes to stderr past pino and its line scrub, and would print the raw
+      // error - an axios error's config.auth included - so it gets both layers by hand.
+      console.error(scrubSecrets(JSON.stringify(serializeErrorForLog(error))));
       console.error('An error occurred while logging the error.');
-      console.error(e);
+      console.error(scrubSecrets(JSON.stringify(serializeErrorForLog(e))));
     }
   };
 }

package/lib/server/log/createHandleError.test.mjs

@@ -0,0 +1,85 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { jest } from '@jest/globals';
+
+const secret = 'planted-handle-error-secret';
+
+process.env.LOWDEFY_SECRET_API_KEY = secret;
+
+const { default: createHandleError } = await import('./createHandleError.js');
+
+function createAxiosError() {
+  const error = new Error(`Request failed for key ${secret}`);
+  error.name = 'AxiosError';
+  error.code = 'ERR_BAD_REQUEST';
+  error.config = {
+    auth: { username: 'svc-user', password: 'planted-config-password' },
+    params: { api_key: 'planted-config-param' },
+    headers: { Authorization: 'Bearer planted-config-header' },
+  };
+  return error;
+}
+
+function testContext({ logger, headers } = {}) {
+  return {
+    headers,
+    logger: logger ?? { error: jest.fn() },
+    readConfigFile: jest.fn(async () => null),
+    req: { url: '/api/request/page/req', method: 'POST', hostname: 'app.example.com' },
+  };
+}
+
+beforeEach(() => {
+  console.error = jest.fn();
+});
+
+test('handleError logs the referer header with credential query parameters redacted', async () => {
+  const context = testContext({
+    headers: { referer: 'https://app.example.com/verify?token=planted-token&page=2' },
+  });
+  const handleError = createHandleError({ context });
+
+  await handleError(new Error('Failed.'));
+
+  const [fields] = context.logger.error.mock.calls[0];
+  expect(fields.headers.referer).toBe('https://app.example.com/verify?token=%5Bredacted%5D&page=2');
+});
+
+test('handleError fallback output carries no axios config auth and no planted secret when the log call throws', async () => {
+  const logError = new Error(`Log sink rejected ${secret}`);
+  const context = testContext({
+    logger: {
+      error: jest.fn(() => {
+        throw logError;
+      }),
+    },
+  });
+  const handleError = createHandleError({ context });
+
+  await handleError(createAxiosError());
+
+  expect(console.error).toHaveBeenCalledTimes(3);
+  const output = console.error.mock.calls.map(([line]) => line).join('\n');
+  expect(output).not.toContain('planted-config-password');
+  expect(output).not.toContain('planted-config-param');
+  expect(output).not.toContain('planted-config-header');
+  expect(output).not.toContain(secret);
+  const logged = JSON.parse(console.error.mock.calls[0][0]);
+  expect(logged.message).toBe('Request failed for key [REDACTED]');
+  expect(logged.code).toBe('ERR_BAD_REQUEST');
+  expect(JSON.parse(console.error.mock.calls[2][0]).message).toBe('Log sink rejected [REDACTED]');
+});

package/lib/server/log/createLogger.js

@@ -18,6 +18,8 @@ import { createNodeLogger } from '@lowdefy/logger/node';
 import { type } from '@lowdefy/helpers';
 
 import appMeta from '../../build/appMeta.js';
+import scrubSecrets from '../scrubSecrets.js';
+import serializeErrorForLog from './serializeErrorForLog.js';
 
 // Deploy identity on every log line — pid/hostname are stripped, so these
 // fields are what correlates a line to an app build across replicas.
@@ -31,11 +33,19 @@ if (!type.isNone(appMeta.version)) {
 if (!type.isNone(appMeta.gitSha)) {
   base.git_sha = appMeta.gitSha;
 }
+// The deployment environment (LOWDEFY_ENVIRONMENT), so one log drain can hold every environment.
+if (!type.isNone(appMeta.environment)) {
+  base.environment = appMeta.environment;
+}
 
 const logger = createNodeLogger({
   name: 'lowdefy_server',
   level: process.env.LOWDEFY_LOG_LEVEL ?? 'info',
   base,
+  serializers: { err: serializeErrorForLog },
+  // Scrubbing the finished line rather than the logged object covers every field of every
+  // call - debug payloads and request results as well as `err` - with no walker to miss one.
+  hooks: { streamWrite: scrubSecrets },
 });
 
 function createLogger(metadata = {}) {

package/lib/server/log/createLogger.test.mjs

@@ -0,0 +1,102 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { jest } from '@jest/globals';
+import { createNodeLogger } from '@lowdefy/logger/node';
+
+const secret = 'planted/secret+value=1';
+const shortSecret = 'short77';
+
+const lines = [];
+const destination = {
+  write(line) {
+    lines.push(line);
+  },
+};
+
+// The prod logger writes to stdout; route the real logger to memory so each test reads the
+// exact line pino would emit, after the streamWrite hook.
+jest.unstable_mockModule('@lowdefy/logger/node', () => ({
+  createNodeLogger: (options) => createNodeLogger({ ...options, destination }),
+}));
+jest.unstable_mockModule('../../build/appMeta.js', () => ({ default: {} }));
+
+process.env.LOWDEFY_SECRET_API_KEY = secret;
+process.env.LOWDEFY_SECRET_SHORT = shortSecret;
+process.env.LOWDEFY_LOG_LEVEL = 'debug';
+
+const { default: createLogger } = await import('./createLogger.js');
+
+function createAxiosError() {
+  const error = new Error('Request failed with status code 401');
+  error.name = 'AxiosError';
+  error.code = 'ERR_BAD_REQUEST';
+  error.config = {
+    auth: { username: 'svc-user', password: 'planted-config-password' },
+    params: { api_key: 'planted-config-param' },
+    headers: { Authorization: 'Bearer planted-config-header' },
+    baseURL: 'https://api.example.com',
+  };
+  error.response = { status: 401, data: { detail: 'planted-response-body' } };
+  return error;
+}
+
+beforeEach(() => {
+  lines.length = 0;
+});
+
+test('prod logger drops an axios error config auth, params and headers', () => {
+  createLogger().error({ err: createAxiosError() }, 'Request failed');
+  expect(lines).toHaveLength(1);
+  const line = lines[0];
+  expect(line).not.toContain('planted-config-password');
+  expect(line).not.toContain('planted-config-param');
+  expect(line).not.toContain('planted-config-header');
+  expect(line).not.toContain('planted-response-body');
+  const { err } = JSON.parse(line);
+  expect(err.config).toBeUndefined();
+  expect(err.code).toBe('ERR_BAD_REQUEST');
+  expect(err.statusCode).toBe(401);
+});
+
+test('prod logger redacts a planted secret in a message raw, URL-encoded and base64', () => {
+  const basic = Buffer.from(`svc-user:${secret}`).toString('base64');
+  const error = new Error(`raw ${secret} encoded ${encodeURIComponent(secret)} basic ${basic}`);
+  createLogger().error({ err: error }, error.message);
+  expect(lines).toHaveLength(1);
+  const line = lines[0];
+  expect(line).not.toContain(secret);
+  expect(line).not.toContain(encodeURIComponent(secret));
+  expect(line).not.toContain(Buffer.from(secret).toString('base64').slice(0, 20));
+  const { msg, err } = JSON.parse(line);
+  expect(msg).toMatch(/^raw \[REDACTED\] encoded \[REDACTED\] basic \S*\[REDACTED\]/);
+  expect(err.message).toBe(msg);
+});
+
+test('prod logger redacts a planted secret in a debug payload that is not an error', () => {
+  createLogger({ rid: 'req-1' }).debug({ response: { token: secret } }, 'Request result');
+  expect(lines).toHaveLength(1);
+  expect(lines[0]).not.toContain(secret);
+  expect(JSON.parse(lines[0]).response.token).toBe('[REDACTED]');
+});
+
+test('prod logger leaves a secret shorter than 8 characters alone', () => {
+  createLogger().info({ detail: shortSecret }, `value ${shortSecret}`);
+  expect(lines).toHaveLength(1);
+  const { msg, detail } = JSON.parse(lines[0]);
+  expect(msg).toBe(`value ${shortSecret}`);
+  expect(detail).toBe(shortSecret);
+});

package/lib/server/log/logRequest.js

@@ -14,7 +14,13 @@
   limitations under the License.
 */
 
+import redactUrlQuery from './redactUrlQuery.js';
+
 // Emits one access-log line per request, after the response is finalized.
+// `url` is the route path only (c.req.path). The referer keeps its query but
+// with credential parameters redacted, because the browser sends the page's
+// full URL there and that URL can carry a sign-in token or a signed OAuth
+// query (see redactUrlQuery).
 function logRequest({ context, status, durationMs }) {
   const { headers = {}, user = {} } = context;
   context.logger.info(
@@ -37,7 +43,7 @@ function logRequest({ context, status, durationMs }) {
         'sec-ch-ua': headers['sec-ch-ua'],
         'user-agent': headers['user-agent'],
         host: headers.host,
-        referer: headers.referer,
+        referer: redactUrlQuery(headers.referer),
         'x-forwarded-for': headers['x-forwarded-for'],
         // Vercel headers
         'x-vercel-id': headers['x-vercel-id'],

package/lib/server/log/maskCredentialKeys.js

@@ -0,0 +1,37 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { mapPlainValues } from '@lowdefy/helpers';
+
+// `received` is the one kept log field holding values fetched at runtime (a token
+// from an earlier step sent as a header), which the by-value secret scrub
+// cannot recognise, so credential-looking keys are masked by name instead.
+const credentialKeyParts = ['authorization', 'token', 'secret', 'password', 'apikey', 'cookie'];
+
+function isCredentialKey(key) {
+  const normalized = key.toLowerCase().replace(/[-_]/g, '');
+  return credentialKeyParts.some((part) => normalized.includes(part));
+}
+
+// Shared references and cycles are copied as such, so the serializer walk still
+// marks them '[Circular]'.
+function maskCredentialKeys(value) {
+  return mapPlainValues(value, (item, key) =>
+    key !== undefined && isCredentialKey(key) ? '[REDACTED]' : item
+  );
+}
+
+export default maskCredentialKeys;

package/lib/server/log/projectErrorForLog.js

@@ -0,0 +1,55 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { lowdefyErrorNames, readErrorCodes } from '@lowdefy/errors';
+
+import maskCredentialKeys from './maskCredentialKeys.js';
+
+// Kept only on nodes named as a Lowdefy error class: libraries reuse some of
+// these names for their own data - axios's `config` carries auth, params and
+// headers - so keying on the field alone would let a library's copy through.
+const lowdefyErrorFields = [
+  'configKey',
+  'source',
+  'config',
+  'handled',
+  'isLowdefyError',
+  'received',
+  'typeName',
+  'location',
+  'service',
+  'hint',
+  'methodName',
+  'metaData',
+  'blockId',
+  'pageId',
+  'isReject',
+];
+
+function projectErrorForLog(err) {
+  const { code, statusCode } = readErrorCodes(err);
+  const props = { name: err.name, message: err.message, stack: err.stack, code, statusCode };
+  if (lowdefyErrorNames.has(err.name)) {
+    lowdefyErrorFields.forEach((field) => {
+      props[field] = err[field];
+    });
+    props.received = maskCredentialKeys(err.received);
+  }
+  props.cause = err.cause;
+  return props;
+}
+
+export default projectErrorForLog;