@lowdefy/server 6.0.0 → 6.1.0

package/lib/server/sentry/initSentry.test.mjs

@@ -0,0 +1,237 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import http from 'node:http';
+
+import { jest } from '@jest/globals';
+import * as RealSentry from '@sentry/node';
+
+const secret = 'planted/secret+value=1';
+
+const envelopes = [];
+function createStubTransport() {
+  return {
+    send: async (envelope) => {
+      envelopes.push(envelope);
+      return {};
+    },
+    flush: async () => true,
+  };
+}
+
+const httpIntegrations = [];
+
+// The real SDK with its network transport swapped for memory, so each test reads the exact
+// event Sentry would send, after the hooks initSentry installs.
+jest.unstable_mockModule('@sentry/node', () => ({
+  ...RealSentry,
+  init: (options) => RealSentry.init({ ...options, transport: createStubTransport }),
+  httpIntegration: (options) => {
+    const integration = RealSentry.httpIntegration(options);
+    httpIntegrations.push(integration);
+    return integration;
+  },
+}));
+jest.unstable_mockModule('../../build/logger.js', () => ({ default: { sentry: {} } }));
+
+process.env.SENTRY_DSN = 'https://public@o0.ingest.sentry.io/1';
+process.env.LOWDEFY_SECRET_API_KEY = secret;
+
+const { default: initSentryServer } = await import('./initSentry.js');
+
+const enabled = initSentryServer();
+const client = RealSentry.getClient();
+const options = client.getOptions();
+
+function sentEvents() {
+  return envelopes.flatMap(([, items]) =>
+    items.filter(([header]) => header.type === 'event').map(([, payload]) => payload)
+  );
+}
+
+beforeEach(() => {
+  envelopes.length = 0;
+});
+
+afterAll(async () => {
+  await RealSentry.close();
+});
+
+test('initSentry initializes Sentry when SENTRY_DSN is set', () => {
+  expect(enabled).toBe(true);
+  expect(client).toBeDefined();
+});
+
+test('initSentry installs exactly one Http integration, the one that attaches no request bodies', () => {
+  expect(httpIntegrations).toHaveLength(1);
+  const installedHttp = options.integrations.filter(({ name }) => name === 'Http');
+  expect(installedHttp).toHaveLength(1);
+  expect(installedHttp[0]).toBe(httpIntegrations[0]);
+  expect(client.getIntegrationByName('Http')).toBe(httpIntegrations[0]);
+});
+
+test('beforeSend replaces a planted secret in an exception value, a cause-chain exception value and extra', () => {
+  const event = {
+    event_id: 'a'.repeat(32),
+    level: 'error',
+    exception: {
+      values: [
+        {
+          type: 'AxiosError',
+          value: `connect failed for key ${secret}`,
+          mechanism: { type: 'chained', source: 'cause', exception_id: 1, parent_id: 0 },
+        },
+        {
+          type: 'RequestError',
+          value: `Request failed: ${encodeURIComponent(secret)}`,
+          stacktrace: { frames: [{ filename: 'app.js', function: 'handler', lineno: 12 }] },
+          mechanism: { type: 'generic', handled: true, exception_id: 0 },
+        },
+      ],
+    },
+    extra: {
+      configKey: 'key-1',
+      error: { name: 'RequestError', message: `failed with ${secret}`, received: [secret] },
+    },
+    tags: { requestId: 'req-1' },
+  };
+  const scrubbed = options.beforeSend(event, {});
+  expect(JSON.stringify(scrubbed)).not.toContain(secret);
+  expect(JSON.stringify(scrubbed)).not.toContain(encodeURIComponent(secret));
+  expect(scrubbed.exception.values[0].value).toEqual('connect failed for key [REDACTED]');
+  expect(scrubbed.exception.values[1].value).toEqual('Request failed: [REDACTED]');
+  expect(scrubbed.exception.values[1].stacktrace).toEqual(event.exception.values[1].stacktrace);
+  expect(scrubbed.extra).toEqual({
+    configKey: 'key-1',
+    error: { name: 'RequestError', message: 'failed with [REDACTED]', received: ['[REDACTED]'] },
+  });
+  expect(scrubbed.tags).toEqual({ requestId: 'req-1' });
+});
+
+test('beforeSend scrubs an exception captured through the SDK, cause chain included', async () => {
+  const cause = new Error(`upstream rejected ${secret}`);
+  RealSentry.captureException(new Error('Request failed.', { cause }), {
+    extra: { detail: `sent ${secret}` },
+  });
+  await RealSentry.flush();
+  const events = sentEvents();
+  expect(events).toHaveLength(1);
+  expect(JSON.stringify(events[0])).not.toContain(secret);
+  const values = events[0].exception.values.map(({ value }) => value);
+  expect(values).toEqual(['upstream rejected [REDACTED]', 'Request failed.']);
+  expect(events[0].extra.detail).toEqual('sent [REDACTED]');
+});
+
+test('beforeBreadcrumb replaces a planted secret in a breadcrumb URL', () => {
+  const breadcrumb = {
+    type: 'http',
+    category: 'http',
+    level: 'info',
+    data: {
+      url: `https://api.example.com/v1/items?api_key=${secret}`,
+      'http.method': 'GET',
+      status_code: 200,
+    },
+    timestamp: 1700000000,
+  };
+  expect(options.beforeBreadcrumb(breadcrumb)).toEqual({
+    ...breadcrumb,
+    data: {
+      url: 'https://api.example.com/v1/items?api_key=[REDACTED]',
+      'http.method': 'GET',
+      status_code: 200,
+    },
+  });
+});
+
+function createFetchSpan() {
+  return {
+    span_id: 'b'.repeat(16),
+    trace_id: 'c'.repeat(32),
+    parent_span_id: 'd'.repeat(16),
+    op: 'http.client',
+    description: `GET https://api.example.com/v1/items?api_key=${secret}`,
+    origin: 'auto.http.otel.node_fetch',
+    start_timestamp: 1700000000,
+    timestamp: 1700000001,
+    status: 'ok',
+    data: {
+      'sentry.op': 'http.client',
+      'http.method': 'GET',
+      url: `https://api.example.com/v1/items?api_key=${secret}`,
+      'http.url': `https://api.example.com/v1/items?api_key=${secret}`,
+      'http.query': `?api_key=${secret}`,
+      'http.response.status_code': 200,
+    },
+  };
+}
+
+test('beforeSendSpan replaces a planted secret in a fetch span http.url and http.query', () => {
+  const scrubbed = options.beforeSendSpan(createFetchSpan());
+  expect(JSON.stringify(scrubbed)).not.toContain(secret);
+  expect(scrubbed.data['http.url']).toEqual('https://api.example.com/v1/items?api_key=[REDACTED]');
+  expect(scrubbed.data['http.query']).toEqual('?api_key=[REDACTED]');
+  expect(scrubbed.data['http.response.status_code']).toEqual(200);
+});
+
+test('beforeSendTransaction replaces a planted secret in a fetch span http.url and http.query', () => {
+  const transaction = {
+    type: 'transaction',
+    transaction: 'POST /api/endpoints/fetch-items',
+    start_timestamp: 1700000000,
+    timestamp: 1700000002,
+    contexts: {
+      trace: { span_id: 'd'.repeat(16), trace_id: 'c'.repeat(32), op: 'http.server' },
+    },
+    spans: [createFetchSpan()],
+  };
+  const scrubbed = options.beforeSendTransaction(transaction, {});
+  expect(JSON.stringify(scrubbed)).not.toContain(secret);
+  expect(scrubbed.spans[0].data['http.url']).toEqual(
+    'https://api.example.com/v1/items?api_key=[REDACTED]'
+  );
+  expect(scrubbed.spans[0].data['http.query']).toEqual('?api_key=[REDACTED]');
+  expect(scrubbed.contexts).toEqual(transaction.contexts);
+});
+
+test('an error event captured during a request with a JSON body carries no request data', async () => {
+  const server = http.createServer((req, res) => {
+    const chunks = [];
+    req.on('data', (chunk) => chunks.push(chunk));
+    req.on('end', () => {
+      RealSentry.captureException(new Error('Endpoint failed.'));
+      res.end('{}');
+    });
+  });
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const { port } = server.address();
+  try {
+    const response = await fetch(`http://127.0.0.1:${port}/api/endpoints/sign-in`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ email: 'user@example.com', password: 'planted-user-password' }),
+    });
+    await response.text();
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+  }
+  await RealSentry.flush();
+  const events = sentEvents();
+  expect(events).toHaveLength(1);
+  expect(events[0].request.url).toMatch(/\/api\/endpoints\/sign-in$/);
+  expect(events[0].request.data).toBeUndefined();
+  expect(JSON.stringify(events[0])).not.toContain('planted-user-password');
+});

package/lib/server/sentry/scrubEvent.js

@@ -0,0 +1,29 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { mapPlainValues, type } from '@lowdefy/helpers';
+
+import scrubSecrets from '../scrubSecrets.js';
+
+// Class instances are left as they are: Sentry normalizes those before beforeSend
+// runs, so the event hook still reaches their strings. Breadcrumbs reach
+// beforeBreadcrumb un-normalized - a console breadcrumb holds the logged arguments
+// as they are - so the walk must be cycle-safe, which mapPlainValues is.
+function scrubEvent(value) {
+  return mapPlainValues(value, (item) => (type.isString(item) ? scrubSecrets(item) : item));
+}
+
+export default scrubEvent;

package/lib/server/sentry/scrubEvent.test.mjs

@@ -0,0 +1,88 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+const secret = 'planted/secret+value=1';
+const shortSecret = 'short77';
+
+process.env.LOWDEFY_SECRET_API_KEY = secret;
+process.env.LOWDEFY_SECRET_SHORT = shortSecret;
+
+const { default: scrubEvent } = await import('./scrubEvent.js');
+
+test('scrubEvent replaces a planted secret in strings at every depth of objects and arrays', () => {
+  expect(
+    scrubEvent({
+      message: `failed ${secret}`,
+      nested: { list: [`a ${secret}`, { deeper: [[secret]] }] },
+    })
+  ).toEqual({
+    message: 'failed [REDACTED]',
+    nested: { list: ['a [REDACTED]', { deeper: [['[REDACTED]']] }] },
+  });
+});
+
+test('scrubEvent leaves keys as they are, even a key holding a secret', () => {
+  expect(scrubEvent({ [secret]: 'value' })).toEqual({ [secret]: 'value' });
+});
+
+test('scrubEvent returns a copy and does not mutate the value it scrubs', () => {
+  const event = { extra: { detail: secret }, values: [secret] };
+  const scrubbed = scrubEvent(event);
+  expect(scrubbed).not.toBe(event);
+  expect(scrubbed.extra).not.toBe(event.extra);
+  expect(event).toEqual({ extra: { detail: secret }, values: [secret] });
+});
+
+test('scrubEvent returns numbers, booleans, null and undefined unchanged', () => {
+  expect(scrubEvent({ a: 1, b: true, c: null, d: undefined })).toEqual({
+    a: 1,
+    b: true,
+    c: null,
+    d: undefined,
+  });
+  expect(scrubEvent(null)).toBeNull();
+});
+
+test('scrubEvent scrubs a top-level string', () => {
+  expect(scrubEvent(`value ${secret}`)).toEqual('value [REDACTED]');
+});
+
+test('scrubEvent leaves a secret shorter than 8 characters alone', () => {
+  expect(scrubEvent({ detail: `value ${shortSecret}` })).toEqual({
+    detail: `value ${shortSecret}`,
+  });
+});
+
+test('scrubEvent returns class instances unchanged', () => {
+  class Client {
+    constructor() {
+      this.detail = secret;
+    }
+  }
+  const client = new Client();
+  const date = new Date(0);
+  const scrubbed = scrubEvent({ client, date });
+  expect(scrubbed.client).toBe(client);
+  expect(scrubbed.date).toBe(date);
+});
+
+test('scrubEvent copies a cycle as a cycle', () => {
+  const data = { message: secret };
+  data.self = data;
+  const scrubbed = scrubEvent({ data });
+  expect(scrubbed.data.message).toEqual('[REDACTED]');
+  expect(scrubbed.data.self).toBe(scrubbed.data);
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/server",
-  "version": "6.0.0",
+  "version": "6.1.0",
   "license": "Apache-2.0",
   "description": "",
   "homepage": "https://lowdefy.com",
@@ -40,40 +40,39 @@
   "dependencies": {
     "@ant-design/cssinjs": "2.1.2",
     "@ant-design/x": "2.7.0",
-    "@auth/core": "0.41.2",
+    "@auth/core": "0.41.3",
     "@hono/auth-js": "1.1.1",
     "@hono/mcp": "0.3.0",
-    "@hono/node-server": "2.0.4",
-    "@lowdefy/actions-core": "6.0.0",
-    "@lowdefy/api": "6.0.0",
-    "@lowdefy/block-utils": "6.0.0",
-    "@lowdefy/blocks-aggrid": "6.0.0",
-    "@lowdefy/blocks-antd": "6.0.0",
-    "@lowdefy/blocks-antd-x": "6.0.0",
-    "@lowdefy/blocks-basic": "6.0.0",
-    "@lowdefy/blocks-echarts": "6.0.0",
-    "@lowdefy/blocks-files": "6.0.0",
-    "@lowdefy/blocks-loaders": "6.0.0",
-    "@lowdefy/blocks-markdown": "6.0.0",
-    "@lowdefy/blocks-tiptap": "6.0.0",
-    "@lowdefy/client": "6.0.0",
-    "@lowdefy/errors": "6.0.0",
-    "@lowdefy/helpers": "6.0.0",
-    "@lowdefy/layout": "6.0.0",
-    "@lowdefy/logger": "6.0.0",
-    "@lowdefy/node-utils": "6.0.0",
-    "@lowdefy/operators-js": "6.0.0",
-    "@lowdefy/plugin-next-auth": "6.0.0",
-    "@lowdefy/websockets-core": "6.0.0",
+    "@hono/node-server": "2.0.10",
+    "@lowdefy/actions-core": "6.1.0",
+    "@lowdefy/api": "6.1.0",
+    "@lowdefy/block-utils": "6.1.0",
+    "@lowdefy/blocks-aggrid": "6.1.0",
+    "@lowdefy/blocks-antd": "6.1.0",
+    "@lowdefy/blocks-antd-x": "6.1.0",
+    "@lowdefy/blocks-basic": "6.1.0",
+    "@lowdefy/blocks-echarts": "6.1.0",
+    "@lowdefy/blocks-files": "6.1.0",
+    "@lowdefy/blocks-loaders": "6.1.0",
+    "@lowdefy/blocks-markdown": "6.1.0",
+    "@lowdefy/blocks-tiptap": "6.1.0",
+    "@lowdefy/client": "6.1.0",
+    "@lowdefy/errors": "6.1.0",
+    "@lowdefy/helpers": "6.1.0",
+    "@lowdefy/layout": "6.1.0",
+    "@lowdefy/logger": "6.1.0",
+    "@lowdefy/node-utils": "6.1.0",
+    "@lowdefy/operators-js": "6.1.0",
+    "@lowdefy/plugin-next-auth": "6.1.0",
+    "@lowdefy/websockets-core": "6.1.0",
     "@sentry/browser": "10.57.0",
-    "@sentry/nextjs": "8.53.0",
     "@sentry/node": "10.57.0",
     "@sentry/vite-plugin": "5.3.0",
     "@tailwindcss/postcss": "4.3.1",
     "@vitejs/plugin-react": "6.0.2",
     "antd": "6.3.1",
     "dayjs": "1.11.20",
-    "hono": "4.12.25",
+    "hono": "4.13.5",
     "pino": "10.3.1",
     "react": "18.2.0",
     "react-dom": "18.2.0",
@@ -81,14 +80,13 @@
     "tailwindcss": "4.3.1",
     "uuid": "14.0.0",
     "vite": "8.0.16",
-    "ws": "8.18.0"
+    "ws": "8.21.0"
   },
   "devDependencies": {
-    "@lowdefy/build": "6.0.0",
-    "@next/eslint-plugin-next": "16.1.6",
+    "@lowdefy/build": "6.1.0",
     "@tailwindcss/postcss": "4.3.1",
+    "jest": "28.1.3",
     "tailwindcss": "4.3.1",
-    "webpack": "5.94.0",
     "yaml": "2.9.0",
     "yargs": "18.0.0"
   },
@@ -103,6 +101,7 @@
     "build": "cp package.json package.original.json || copy package.json package.original.json",
     "build:client": "vite build",
     "build:lowdefy": "node lowdefy/build.mjs",
-    "start": "node src/index.js"
+    "start": "node src/index.js",
+    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js"
   }
 }

package/package.original.json

@@ -1,6 +1,6 @@
 {
   "name": "@lowdefy/server",
-  "version": "6.0.0",
+  "version": "6.1.0",
   "license": "Apache-2.0",
   "description": "",
   "homepage": "https://lowdefy.com",
@@ -42,45 +42,45 @@
     "build:client": "vite build",
     "build:lowdefy": "node lowdefy/build.mjs",
     "prepublishOnly": "pnpm build",
-    "start": "node src/index.js"
+    "start": "node src/index.js",
+    "test": "node --experimental-vm-modules node_modules/jest/bin/jest.js"
   },
   "dependencies": {
     "@ant-design/cssinjs": "2.1.2",
     "@ant-design/x": "2.7.0",
-    "@auth/core": "0.41.2",
+    "@auth/core": "0.41.3",
     "@hono/auth-js": "1.1.1",
     "@hono/mcp": "0.3.0",
-    "@hono/node-server": "2.0.4",
-    "@lowdefy/actions-core": "6.0.0",
-    "@lowdefy/api": "6.0.0",
-    "@lowdefy/block-utils": "6.0.0",
-    "@lowdefy/blocks-aggrid": "6.0.0",
-    "@lowdefy/blocks-antd": "6.0.0",
-    "@lowdefy/blocks-antd-x": "6.0.0",
-    "@lowdefy/blocks-basic": "6.0.0",
-    "@lowdefy/blocks-echarts": "6.0.0",
-    "@lowdefy/blocks-files": "6.0.0",
-    "@lowdefy/blocks-loaders": "6.0.0",
-    "@lowdefy/blocks-markdown": "6.0.0",
-    "@lowdefy/blocks-tiptap": "6.0.0",
-    "@lowdefy/client": "6.0.0",
-    "@lowdefy/errors": "6.0.0",
-    "@lowdefy/helpers": "6.0.0",
-    "@lowdefy/layout": "6.0.0",
-    "@lowdefy/logger": "6.0.0",
-    "@lowdefy/node-utils": "6.0.0",
-    "@lowdefy/operators-js": "6.0.0",
-    "@lowdefy/plugin-next-auth": "6.0.0",
-    "@lowdefy/websockets-core": "6.0.0",
+    "@hono/node-server": "2.0.10",
+    "@lowdefy/actions-core": "6.1.0",
+    "@lowdefy/api": "6.1.0",
+    "@lowdefy/block-utils": "6.1.0",
+    "@lowdefy/blocks-aggrid": "6.1.0",
+    "@lowdefy/blocks-antd": "6.1.0",
+    "@lowdefy/blocks-antd-x": "6.1.0",
+    "@lowdefy/blocks-basic": "6.1.0",
+    "@lowdefy/blocks-echarts": "6.1.0",
+    "@lowdefy/blocks-files": "6.1.0",
+    "@lowdefy/blocks-loaders": "6.1.0",
+    "@lowdefy/blocks-markdown": "6.1.0",
+    "@lowdefy/blocks-tiptap": "6.1.0",
+    "@lowdefy/client": "6.1.0",
+    "@lowdefy/errors": "6.1.0",
+    "@lowdefy/helpers": "6.1.0",
+    "@lowdefy/layout": "6.1.0",
+    "@lowdefy/logger": "6.1.0",
+    "@lowdefy/node-utils": "6.1.0",
+    "@lowdefy/operators-js": "6.1.0",
+    "@lowdefy/plugin-next-auth": "6.1.0",
+    "@lowdefy/websockets-core": "6.1.0",
     "@sentry/browser": "10.57.0",
-    "@sentry/nextjs": "8.53.0",
     "@sentry/node": "10.57.0",
     "@sentry/vite-plugin": "5.3.0",
     "@tailwindcss/postcss": "4.3.1",
     "@vitejs/plugin-react": "6.0.2",
     "antd": "6.3.1",
     "dayjs": "1.11.20",
-    "hono": "4.12.25",
+    "hono": "4.13.5",
     "pino": "10.3.1",
     "react": "18.2.0",
     "react-dom": "18.2.0",
@@ -88,14 +88,13 @@
     "tailwindcss": "4.3.1",
     "uuid": "14.0.0",
     "vite": "8.0.16",
-    "ws": "8.18.0"
+    "ws": "8.21.0"
   },
   "devDependencies": {
-    "@lowdefy/build": "6.0.0",
-    "@next/eslint-plugin-next": "16.1.6",
+    "@lowdefy/build": "6.1.0",
     "@tailwindcss/postcss": "4.3.1",
+    "jest": "28.1.3",
     "tailwindcss": "4.3.1",
-    "webpack": "5.94.0",
     "yaml": "2.9.0",
     "yargs": "18.0.0"
   },

package/src/index.js

@@ -18,6 +18,8 @@ import { serve } from '@hono/node-server';
 import * as Sentry from '@sentry/node';
 import { WebSocketServer } from 'ws';
 
+import checkEnvironmentGuards from '@lowdefy/node-utils/checkEnvironmentGuards.js';
+
 import initSentryServer from '../lib/server/sentry/initSentry.js';
 
 // Auth.js v5 reads AUTH_URL but not NEXTAUTH_URL — alias the v4 variable
@@ -32,6 +34,14 @@ const sentryEnabled = initSentryServer();
 const { default: createApp } = await import('./app.js');
 const { default: createLogger } = await import('../lib/server/log/createLogger.js');
 const { default: appMeta } = await import('../lib/build/appMeta.js');
+const { default: config } = await import('../lib/build/config.js');
+
+// The build checked the current environment's guards, but an image built once can be started with
+// different variables, so they are checked again before the server takes any traffic.
+checkEnvironmentGuards({
+  name: config.environment,
+  guards: config.environments?.[config.environment]?.guards,
+});
 
 const app = createApp();
 const logger = createLogger({ server: 'lowdefy' });

package/src/middleware/apiContext.js

@@ -32,6 +32,7 @@ import i18nConfig from '../../lib/build/i18n.js';
 import jsMap from '../../build/plugins/operators/serverJsMap.js';
 import logRequest from '../../lib/server/log/logRequest.js';
 import loggerConfig from '../../lib/build/logger.js';
+import scrubSecrets from '../../lib/server/scrubSecrets.js';
 import notifications, {
   interpolateProperties,
   renderEmail,
@@ -83,6 +84,7 @@ function apiContext() {
       interpolateProperties,
       jsMap,
       logger: createLogger({ rid }),
+      mode: 'prod',
       notifications,
       operators,
       renderEmail,
@@ -91,6 +93,7 @@ function apiContext() {
         method: c.req.method,
         hostname: c.req.header('host'),
       },
+      scrubSecrets,
       secrets,
       // On Vercel (fluid compute) the platform request context keeps the
       // invocation alive until waitUntil promises settle; on long-lived hosts