@lowdefy/server 6.0.0 → 7.0.0

package/lib/server/sentry/initSentry.serverless.test.mjs

@@ -0,0 +1,165 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import http from 'node:http';
+
+import { jest } from '@jest/globals';
+import * as RealLight from '@sentry/node-core/light';
+
+const envelopes = [];
+function createStubTransport() {
+  return {
+    send: async (envelope) => {
+      envelopes.push(envelope);
+      return {};
+    },
+    flush: async () => true,
+  };
+}
+
+const imported = { node: false, light: false };
+const nodeInit = jest.fn();
+const nodeHttpIntegration = jest.fn(() => ({ name: 'Http' }));
+
+// @sentry/node is a stub that records its import, so a test can tell which SDK started. The light
+// SDK is real, with its network transport swapped for memory.
+jest.unstable_mockModule('@sentry/node', () => {
+  imported.node = true;
+  return { init: nodeInit, httpIntegration: nodeHttpIntegration };
+});
+jest.unstable_mockModule('@sentry/node-core/light', () => {
+  imported.light = true;
+  return {
+    ...RealLight,
+    init: (options) => RealLight.init({ ...options, transport: createStubTransport }),
+  };
+});
+const loggerConfig = { sentry: {} };
+jest.unstable_mockModule('../../build/logger.js', () => ({ default: loggerConfig }));
+
+const { default: initSentryServer } = await import('./initSentry.js');
+const { default: sentrySdk } = await import('./sentrySdk.js');
+const { default: captureSentryError } = await import('./captureSentryError.js');
+const { default: setSentryUser } = await import('./setSentryUser.js');
+
+function sentEvents() {
+  return envelopes.flatMap(([, items]) =>
+    items.filter(([header]) => header.type === 'event').map(([, payload]) => payload)
+  );
+}
+
+beforeEach(() => {
+  envelopes.length = 0;
+});
+
+afterAll(async () => {
+  await RealLight.close();
+});
+
+test('initSentry imports no Sentry SDK and returns null when SENTRY_DSN is not set', async () => {
+  delete process.env.SENTRY_DSN;
+  expect(await initSentryServer({ serverless: true })).toBe(null);
+  expect(imported).toEqual({ node: false, light: false });
+  expect(sentrySdk.current).toBe(null);
+});
+
+test('initSentry on a serverless function reports errors with the light SDK, without tracing or client reports', async () => {
+  process.env.SENTRY_DSN = 'https://public@o0.ingest.sentry.io/1';
+  const sentry = await initSentryServer({ serverless: true });
+  expect(imported).toEqual({ node: false, light: true });
+  expect(sentrySdk.current).toBe(sentry);
+  const client = RealLight.getClient();
+  expect(client).toBeInstanceOf(RealLight.LightNodeClient);
+  const options = client.getOptions();
+  expect(options.tracesSampleRate).toBeUndefined();
+  expect(options.sendClientReports).toBe(false);
+  expect(options.integrations.filter(({ name }) => name === 'Http')).toHaveLength(1);
+});
+
+// A request handler that, like the Vercel function entry, reads the body with for await, sets the
+// caller from a header and, when asked, waits and then captures an error, so a second request
+// sets its own user while the first is still running.
+async function handleRequest(req, res) {
+  const chunks = [];
+  for await (const chunk of req) chunks.push(chunk);
+  setSentryUser({ user: { id: req.headers['x-user'] } });
+  if (req.headers['x-fail'] === 'true') {
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    captureSentryError({ error: new Error('Endpoint failed.'), context: { rid: 'req-1' } });
+  }
+  res.end('{}');
+}
+
+async function startServer() {
+  const server = http.createServer((req, res) => {
+    handleRequest(req, res);
+  });
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  return server;
+}
+
+function post({ port, user, fail }) {
+  return fetch(`http://127.0.0.1:${port}/api/endpoints/sign-in`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', 'x-user': user, 'x-fail': String(fail) },
+    body: JSON.stringify({ email: 'user@example.com', password: 'planted-user-password' }),
+  }).then((response) => response.text());
+}
+
+test('a serverless request that captures nothing leaves nothing for the flush to send', async () => {
+  const server = await startServer();
+  try {
+    await post({ port: server.address().port, user: 'user-a', fail: false });
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+  }
+  expect(await sentrySdk.current.flush(2000)).toBe(true);
+  expect(envelopes).toEqual([]);
+});
+
+test('a serverless request that captures an error sends it on flush, with its own user and no request body', async () => {
+  const server = await startServer();
+  const { port } = server.address();
+  try {
+    const failing = post({ port, user: 'user-a', fail: true });
+    await new Promise((resolve) => setTimeout(resolve, 10));
+    await post({ port, user: 'user-b', fail: false });
+    await failing;
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+  }
+  await sentrySdk.current.flush(2000);
+  const events = sentEvents();
+  expect(events).toHaveLength(1);
+  expect(events[0].exception.values[0].value).toEqual('Endpoint failed.');
+  expect(events[0].user).toEqual({ id: 'user-a' });
+  expect(events[0].request.url).toMatch(/\/api\/endpoints\/sign-in$/);
+  expect(events[0].request.data).toBeUndefined();
+  expect(JSON.stringify(events[0])).not.toContain('planted-user-password');
+});
+
+test('initSentry on a serverless function with serverTracing runs @sentry/node with tracing and no client reports', async () => {
+  loggerConfig.sentry = { serverTracing: true, tracesSampleRate: 0.2 };
+  const sentry = await initSentryServer({ serverless: true });
+  expect(imported.node).toBe(true);
+  expect(sentrySdk.current).toBe(sentry);
+  expect(nodeHttpIntegration.mock.calls).toEqual([[{ maxIncomingRequestBodySize: 'none' }]]);
+  expect(nodeInit).toHaveBeenCalledTimes(1);
+  const [options] = nodeInit.mock.calls[0];
+  expect(options.tracesSampleRate).toBe(0.2);
+  expect(options.sendClientReports).toBe(false);
+  expect(options.integrations).toEqual([{ name: 'Http' }]);
+});

package/lib/server/sentry/initSentry.test.mjs

@@ -0,0 +1,365 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import http from 'node:http';
+
+import { jest } from '@jest/globals';
+import { Hono } from 'hono';
+import { serve } from '@hono/node-server';
+import * as RealSentry from '@sentry/node';
+import { markCredential, runInCredentialScope } from '@lowdefy/node-utils';
+
+const secret = 'planted/secret+value=1';
+
+const envelopes = [];
+function createStubTransport() {
+  return {
+    send: async (envelope) => {
+      envelopes.push(envelope);
+      return {};
+    },
+    flush: async () => true,
+  };
+}
+
+const httpIntegrations = [];
+
+// The real SDK with its network transport swapped for memory, so each test reads the exact
+// event Sentry would send, after the hooks initSentry installs.
+jest.unstable_mockModule('@sentry/node', () => ({
+  ...RealSentry,
+  init: (options) => RealSentry.init({ ...options, transport: createStubTransport }),
+  httpIntegration: (options) => {
+    const integration = RealSentry.httpIntegration(options);
+    httpIntegrations.push(integration);
+    return integration;
+  },
+}));
+jest.unstable_mockModule('../../build/logger.js', () => ({
+  default: { sentry: { tracesSampleRate: 1 } },
+}));
+
+process.env.SENTRY_DSN = 'https://public@o0.ingest.sentry.io/1';
+process.env.LOWDEFY_SECRET_API_KEY = secret;
+
+const { default: initSentryServer } = await import('./initSentry.js');
+const { default: sentrySdk } = await import('./sentrySdk.js');
+const { default: sentryMiddleware } = await import('../../../src/middleware/sentry.js');
+
+const sentry = await initSentryServer();
+const client = RealSentry.getClient();
+const options = client.getOptions();
+
+function sentEvents() {
+  return envelopes.flatMap(([, items]) =>
+    items.filter(([header]) => header.type === 'event').map(([, payload]) => payload)
+  );
+}
+
+function sentTransactions() {
+  return envelopes.flatMap(([, items]) =>
+    items.filter(([header]) => header.type === 'transaction').map(([, payload]) => payload)
+  );
+}
+
+function listen(server) {
+  return new Promise((resolve) => {
+    if (server.listening) {
+      resolve(server.address().port);
+      return;
+    }
+    server.once('listening', () => resolve(server.address().port));
+  });
+}
+
+beforeEach(() => {
+  envelopes.length = 0;
+});
+
+afterAll(async () => {
+  await RealSentry.close();
+});
+
+test('initSentry initializes Sentry when SENTRY_DSN is set and makes its SDK the server one', () => {
+  expect(client).toBeDefined();
+  expect(sentry.captureException).toBe(RealSentry.captureException);
+  expect(sentrySdk.current).toBe(sentry);
+});
+
+test('initSentry traces requests and keeps client reports on a long-running server', () => {
+  expect(options.tracesSampleRate).toBe(1);
+  expect(options.sendClientReports).toBe(true);
+});
+
+test('initSentry installs exactly one Http integration, the one that attaches no request bodies', () => {
+  expect(httpIntegrations).toHaveLength(1);
+  const installedHttp = options.integrations.filter(({ name }) => name === 'Http');
+  expect(installedHttp).toHaveLength(1);
+  expect(installedHttp[0]).toBe(httpIntegrations[0]);
+  expect(client.getIntegrationByName('Http')).toBe(httpIntegrations[0]);
+});
+
+test('beforeSend replaces a planted secret in an exception value, a cause-chain exception value and extra', () => {
+  const event = {
+    event_id: 'a'.repeat(32),
+    level: 'error',
+    exception: {
+      values: [
+        {
+          type: 'AxiosError',
+          value: `connect failed for key ${secret}`,
+          mechanism: { type: 'chained', source: 'cause', exception_id: 1, parent_id: 0 },
+        },
+        {
+          type: 'RequestError',
+          value: `Request failed: ${encodeURIComponent(secret)}`,
+          stacktrace: { frames: [{ filename: 'app.js', function: 'handler', lineno: 12 }] },
+          mechanism: { type: 'generic', handled: true, exception_id: 0 },
+        },
+      ],
+    },
+    extra: {
+      configKey: 'key-1',
+      error: { name: 'RequestError', message: `failed with ${secret}`, received: [secret] },
+    },
+    tags: { requestId: 'req-1' },
+  };
+  const scrubbed = options.beforeSend(event, {});
+  expect(JSON.stringify(scrubbed)).not.toContain(secret);
+  expect(JSON.stringify(scrubbed)).not.toContain(encodeURIComponent(secret));
+  expect(scrubbed.exception.values[0].value).toEqual('connect failed for key [REDACTED]');
+  expect(scrubbed.exception.values[1].value).toEqual('Request failed: [REDACTED]');
+  expect(scrubbed.exception.values[1].stacktrace).toEqual(event.exception.values[1].stacktrace);
+  expect(scrubbed.extra).toEqual({
+    configKey: 'key-1',
+    error: { name: 'RequestError', message: 'failed with [REDACTED]', received: ['[REDACTED]'] },
+  });
+  expect(scrubbed.tags).toEqual({ requestId: 'req-1' });
+});
+
+test('beforeSend scrubs an exception captured through the SDK, cause chain included', async () => {
+  const cause = new Error(`upstream rejected ${secret}`);
+  RealSentry.captureException(new Error('Request failed.', { cause }), {
+    extra: { detail: `sent ${secret}` },
+  });
+  await RealSentry.flush();
+  const events = sentEvents();
+  expect(events).toHaveLength(1);
+  expect(JSON.stringify(events[0])).not.toContain(secret);
+  const values = events[0].exception.values.map(({ value }) => value);
+  expect(values).toEqual(['upstream rejected [REDACTED]', 'Request failed.']);
+  expect(events[0].extra.detail).toEqual('sent [REDACTED]');
+});
+
+test('beforeBreadcrumb replaces a planted secret in a breadcrumb URL', () => {
+  const breadcrumb = {
+    type: 'http',
+    category: 'http',
+    level: 'info',
+    data: {
+      url: `https://api.example.com/v1/items?api_key=${secret}`,
+      'http.method': 'GET',
+      status_code: 200,
+    },
+    timestamp: 1700000000,
+  };
+  expect(options.beforeBreadcrumb(breadcrumb)).toEqual({
+    ...breadcrumb,
+    data: {
+      url: 'https://api.example.com/v1/items?api_key=[REDACTED]',
+      'http.method': 'GET',
+      status_code: 200,
+    },
+  });
+});
+
+function createFetchSpan() {
+  return {
+    span_id: 'b'.repeat(16),
+    trace_id: 'c'.repeat(32),
+    parent_span_id: 'd'.repeat(16),
+    op: 'http.client',
+    description: `GET https://api.example.com/v1/items?api_key=${secret}`,
+    origin: 'auto.http.otel.node_fetch',
+    start_timestamp: 1700000000,
+    timestamp: 1700000001,
+    status: 'ok',
+    data: {
+      'sentry.op': 'http.client',
+      'http.method': 'GET',
+      url: `https://api.example.com/v1/items?api_key=${secret}`,
+      'http.url': `https://api.example.com/v1/items?api_key=${secret}`,
+      'http.query': `?api_key=${secret}`,
+      'http.response.status_code': 200,
+    },
+  };
+}
+
+test('beforeSendSpan replaces a planted secret in a fetch span http.url and http.query', () => {
+  const scrubbed = options.beforeSendSpan(createFetchSpan());
+  expect(JSON.stringify(scrubbed)).not.toContain(secret);
+  expect(scrubbed.data['http.url']).toEqual('https://api.example.com/v1/items?api_key=[REDACTED]');
+  expect(scrubbed.data['http.query']).toEqual('?api_key=[REDACTED]');
+  expect(scrubbed.data['http.response.status_code']).toEqual(200);
+});
+
+test('beforeSendTransaction replaces a planted secret in a fetch span http.url and http.query', () => {
+  const transaction = {
+    type: 'transaction',
+    transaction: 'POST /api/endpoints/fetch-items',
+    start_timestamp: 1700000000,
+    timestamp: 1700000002,
+    contexts: {
+      trace: { span_id: 'd'.repeat(16), trace_id: 'c'.repeat(32), op: 'http.server' },
+    },
+    spans: [createFetchSpan()],
+  };
+  const scrubbed = options.beforeSendTransaction(transaction, {});
+  expect(JSON.stringify(scrubbed)).not.toContain(secret);
+  expect(scrubbed.spans[0].data['http.url']).toEqual(
+    'https://api.example.com/v1/items?api_key=[REDACTED]'
+  );
+  expect(scrubbed.spans[0].data['http.query']).toEqual('?api_key=[REDACTED]');
+  expect(scrubbed.contexts).toEqual(transaction.contexts);
+});
+
+test('an error event captured during a request with a JSON body carries no request data', async () => {
+  const server = http.createServer((req, res) => {
+    const chunks = [];
+    req.on('data', (chunk) => chunks.push(chunk));
+    req.on('end', () => {
+      RealSentry.captureException(new Error('Endpoint failed.'));
+      res.end('{}');
+    });
+  });
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  const { port } = server.address();
+  try {
+    const response = await fetch(`http://127.0.0.1:${port}/api/endpoints/sign-in`, {
+      method: 'POST',
+      headers: { 'content-type': 'application/json' },
+      body: JSON.stringify({ email: 'user@example.com', password: 'planted-user-password' }),
+    });
+    await response.text();
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+  }
+  await RealSentry.flush();
+  const events = sentEvents();
+  expect(events).toHaveLength(1);
+  expect(events[0].request.url).toMatch(/\/api\/endpoints\/sign-in$/);
+  expect(events[0].request.data).toBeUndefined();
+  expect(JSON.stringify(events[0])).not.toContain('planted-user-password');
+});
+
+test('a transaction sent after the response is scrubbed of the credentials its request marked', async () => {
+  const markedKey = 'runtime-made-app-key-0001';
+  const upstream = http.createServer((req, res) => res.end('{}'));
+  upstream.listen(0, '127.0.0.1');
+  const upstreamPort = await listen(upstream);
+
+  // The two middlewares the production app runs first, in its order.
+  const app = new Hono();
+  app.use('*', (c, next) => runInCredentialScope(next));
+  app.use('*', sentryMiddleware());
+  app.post('/api/endpoints/create-app', async (c) => {
+    markCredential(markedKey);
+    const upstreamResponse = await fetch(
+      `http://127.0.0.1:${upstreamPort}/v1/apps?key=${markedKey}`
+    );
+    await upstreamResponse.text();
+    return c.json({ ok: true });
+  });
+  // @hono/node-server writes the response after the middleware chain has returned, so the
+  // request's root span ends, and its transaction is sent, outside the credential scope.
+  const server = serve({ fetch: app.fetch, port: 0, hostname: '127.0.0.1' });
+  const port = await listen(server);
+  try {
+    const response = await fetch(`http://127.0.0.1:${port}/api/endpoints/create-app`, {
+      method: 'POST',
+    });
+    await response.text();
+    await new Promise((resolve) => setTimeout(resolve, 50));
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+    await new Promise((resolve) => upstream.close(resolve));
+  }
+  await RealSentry.flush();
+  const transaction = sentTransactions().find(
+    ({ transaction: name }) => name === 'POST /api/endpoints/create-app'
+  );
+  expect(transaction).toBeDefined();
+  const clientSpan = transaction.spans.find(({ op }) => op === 'http.client');
+  expect(clientSpan.data['url.full']).toEqual(
+    `http://127.0.0.1:${upstreamPort}/v1/apps?key=[REDACTED]`
+  );
+  expect(clientSpan.data['http.query']).toEqual('key=[REDACTED]');
+  expect(JSON.stringify(transaction)).not.toContain(markedKey);
+});
+
+test('concurrent requests each scrub their transaction with their own marked credentials', async () => {
+  const keyA = 'runtime-made-app-key-aaaa';
+  const keyB = 'runtime-made-app-key-bbbb';
+  const upstream = http.createServer((req, res) => res.end('{}'));
+  upstream.listen(0, '127.0.0.1');
+  const upstreamPort = await listen(upstream);
+
+  let markedB;
+  const bMarked = new Promise((resolve) => {
+    markedB = resolve;
+  });
+  const app = new Hono();
+  app.use('*', (c, next) => runInCredentialScope(next));
+  app.use('*', sentryMiddleware());
+  // The first request's middleware runs before the second's, and its fetch after the second
+  // has marked its own key, so a scrub shared between them would miss the first key.
+  app.post('/api/endpoints/first', async (c) => {
+    markCredential(keyA);
+    await bMarked;
+    await (await fetch(`http://127.0.0.1:${upstreamPort}/v1/first?key=${keyA}`)).text();
+    return c.json({ ok: true });
+  });
+  app.post('/api/endpoints/second', async (c) => {
+    markCredential(keyB);
+    markedB();
+    await (await fetch(`http://127.0.0.1:${upstreamPort}/v1/second?key=${keyB}`)).text();
+    return c.json({ ok: true });
+  });
+  const server = serve({ fetch: app.fetch, port: 0, hostname: '127.0.0.1' });
+  const port = await listen(server);
+  try {
+    const first = fetch(`http://127.0.0.1:${port}/api/endpoints/first`, { method: 'POST' });
+    await new Promise((resolve) => setTimeout(resolve, 20));
+    const second = fetch(`http://127.0.0.1:${port}/api/endpoints/second`, { method: 'POST' });
+    await Promise.all([(await first).text(), (await second).text()]);
+    await new Promise((resolve) => setTimeout(resolve, 50));
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+    await new Promise((resolve) => upstream.close(resolve));
+  }
+  await RealSentry.flush();
+  const transactions = sentTransactions();
+  const firstTransaction = transactions.find(
+    ({ transaction: name }) => name === 'POST /api/endpoints/first'
+  );
+  const secondTransaction = transactions.find(
+    ({ transaction: name }) => name === 'POST /api/endpoints/second'
+  );
+  expect(JSON.stringify(firstTransaction)).toContain('/v1/first?key=[REDACTED]');
+  expect(JSON.stringify(secondTransaction)).toContain('/v1/second?key=[REDACTED]');
+  expect(JSON.stringify([firstTransaction, secondTransaction])).not.toContain(keyA);
+  expect(JSON.stringify([firstTransaction, secondTransaction])).not.toContain(keyB);
+});

package/lib/server/sentry/scrubEvent.js

@@ -0,0 +1,40 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import { mapPlainValues, type } from '@lowdefy/helpers';
+
+import scrubSecrets from '../scrubSecrets.js';
+
+function returnUnchanged(value) {
+  return value;
+}
+
+// Class instances are left as they are: Sentry normalizes those before beforeSend
+// runs, so the event hook still reaches their strings. Breadcrumbs reach
+// beforeBreadcrumb un-normalized - a console breadcrumb holds the logged arguments
+// as they are - so the walk must be cycle-safe, which mapPlainValues is.
+// An event also carries its request's credential scrub (the Sentry middleware puts it on the
+// request's isolation scope), which reaches the credentials that request marked when the event
+// is sent after the request's scope has ended, as a transaction is.
+function scrubEvent(value) {
+  const scrubRequestCredentials =
+    value?.sdkProcessingMetadata?.scrubRequestCredentials ?? returnUnchanged;
+  return mapPlainValues(value, (item) =>
+    type.isString(item) ? scrubRequestCredentials(scrubSecrets(item)) : item
+  );
+}
+
+export default scrubEvent;

package/lib/server/sentry/scrubEvent.test.mjs

@@ -0,0 +1,88 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+const secret = 'planted/secret+value=1';
+const shortSecret = 'short77';
+
+process.env.LOWDEFY_SECRET_API_KEY = secret;
+process.env.LOWDEFY_SECRET_SHORT = shortSecret;
+
+const { default: scrubEvent } = await import('./scrubEvent.js');
+
+test('scrubEvent replaces a planted secret in strings at every depth of objects and arrays', () => {
+  expect(
+    scrubEvent({
+      message: `failed ${secret}`,
+      nested: { list: [`a ${secret}`, { deeper: [[secret]] }] },
+    })
+  ).toEqual({
+    message: 'failed [REDACTED]',
+    nested: { list: ['a [REDACTED]', { deeper: [['[REDACTED]']] }] },
+  });
+});
+
+test('scrubEvent leaves keys as they are, even a key holding a secret', () => {
+  expect(scrubEvent({ [secret]: 'value' })).toEqual({ [secret]: 'value' });
+});
+
+test('scrubEvent returns a copy and does not mutate the value it scrubs', () => {
+  const event = { extra: { detail: secret }, values: [secret] };
+  const scrubbed = scrubEvent(event);
+  expect(scrubbed).not.toBe(event);
+  expect(scrubbed.extra).not.toBe(event.extra);
+  expect(event).toEqual({ extra: { detail: secret }, values: [secret] });
+});
+
+test('scrubEvent returns numbers, booleans, null and undefined unchanged', () => {
+  expect(scrubEvent({ a: 1, b: true, c: null, d: undefined })).toEqual({
+    a: 1,
+    b: true,
+    c: null,
+    d: undefined,
+  });
+  expect(scrubEvent(null)).toBeNull();
+});
+
+test('scrubEvent scrubs a top-level string', () => {
+  expect(scrubEvent(`value ${secret}`)).toEqual('value [REDACTED]');
+});
+
+test('scrubEvent leaves a secret shorter than 8 characters alone', () => {
+  expect(scrubEvent({ detail: `value ${shortSecret}` })).toEqual({
+    detail: `value ${shortSecret}`,
+  });
+});
+
+test('scrubEvent returns class instances unchanged', () => {
+  class Client {
+    constructor() {
+      this.detail = secret;
+    }
+  }
+  const client = new Client();
+  const date = new Date(0);
+  const scrubbed = scrubEvent({ client, date });
+  expect(scrubbed.client).toBe(client);
+  expect(scrubbed.date).toBe(date);
+});
+
+test('scrubEvent copies a cycle as a cycle', () => {
+  const data = { message: secret };
+  data.self = data;
+  const scrubbed = scrubEvent({ data });
+  expect(scrubbed.data.message).toEqual('[REDACTED]');
+  expect(scrubbed.data.self).toBe(scrubbed.data);
+});

package/lib/server/sentry/sentrySdk.js

@@ -0,0 +1,23 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// The Sentry SDK the server started, or null while Sentry is off. initSentryServer sets it once,
+// before the app loads. The SDK is imported only when Sentry is on, and which SDK depends on
+// whether the server traces requests, so nothing else imports a Sentry package: every server
+// module that reports to Sentry reads it from here.
+const sentrySdk = { current: null };
+
+export default sentrySdk;