@lowdefy/server 6.1.0 → 7.1.0

package/lib/server/log/projectErrorForLog.js

@@ -32,11 +32,17 @@ const lowdefyErrorFields = [
   'location',
   'service',
   'hint',
+  'retryAfter',
   'methodName',
   'metaData',
   'blockId',
   'pageId',
   'isReject',
+  'collection',
+  'connectionId',
+  'organizationId',
+  'field',
+  'endpointId',
 ];
 
 function projectErrorForLog(err) {

package/lib/server/log/serializeErrorForLog.test.mjs

@@ -14,7 +14,7 @@
   limitations under the License.
 */
 
-import { OperatorError, RequestError, UserError } from '@lowdefy/errors';
+import { OperatorError, RequestError, ServiceError, UserError } from '@lowdefy/errors';
 
 import maskCredentialKeys from './maskCredentialKeys.js';
 import projectErrorForLog from './projectErrorForLog.js';
@@ -37,6 +37,7 @@ const allowedErrorKeys = new Set([
   'location',
   'service',
   'hint',
+  'retryAfter',
   'methodName',
   'metaData',
   'blockId',
@@ -210,6 +211,17 @@ test('serializeErrorForLog keeps UserError metaData, blockId, pageId and isRejec
   });
 });
 
+test('serializeErrorForLog keeps the Retry-After of a rate-limited ServiceError', () => {
+  const cause = new Error('Too Many Requests');
+  cause.statusCode = 429;
+  cause.responseHeaders = { 'retry-after': '30' };
+  const serialized = serializeErrorForLog(
+    new ServiceError(undefined, { cause, service: 'claude' })
+  );
+  expect(serialized.statusCode).toBe(429);
+  expect(serialized.retryAfter).toBe('30');
+});
+
 test('serializeErrorForLog keeps Lowdefy fields on an error that has a Lowdefy class name but not the class', () => {
   const error = new Error('Not allowed.');
   error.name = 'AuthorizationError';

package/lib/server/sentry/captureSentryError.js

@@ -14,14 +14,14 @@
   limitations under the License.
 */
 
-import * as Sentry from '@sentry/node';
 import { type } from '@lowdefy/helpers';
 
 import serializeErrorForLog from '../log/serializeErrorForLog.js';
+import sentrySdk from './sentrySdk.js';
 
 function captureSentryError({ error, context, configLocation }) {
-  // No-op if Sentry not initialized (DSN not set)
-  if (!process.env.SENTRY_DSN) {
+  const Sentry = sentrySdk.current;
+  if (!Sentry) {
     return;
   }
 
@@ -45,6 +45,19 @@ function captureSentryError({ error, context, configLocation }) {
     tags.isServiceError = error.isServiceError;
   }
 
+  // Fields a data-integrity fault carries, so it can be filtered and grouped
+  // in Sentry by where it happened.
+  ['collection', 'connectionId', 'organizationId', 'endpointId'].forEach((field) => {
+    if (!type.isNone(error?.[field])) {
+      tags[field] = error[field];
+    }
+  });
+  if (tags.collection || tags.connectionId || tags.organizationId || tags.endpointId) {
+    tags.errorName = error.name;
+  }
+  const fingerprint =
+    error?.name === 'TenantIntegrityError' ? [error.name, error.collection ?? ''] : undefined;
+
   // Add config location context
   if (configLocation) {
     extra.configLocation = configLocation;
@@ -63,6 +76,7 @@ function captureSentryError({ error, context, configLocation }) {
   Sentry.captureException(error, {
     tags,
     extra,
+    ...(fingerprint ? { fingerprint } : {}),
   });
 }
 

package/lib/server/sentry/captureSentryError.test.mjs

@@ -15,16 +15,17 @@
 */
 
 import { jest } from '@jest/globals';
-import { RequestError } from '@lowdefy/errors';
+import { RequestError, TenantIntegrityError } from '@lowdefy/errors';
 
 const captureException = jest.fn();
 
-jest.unstable_mockModule('@sentry/node', () => ({ captureException }));
-
-process.env.SENTRY_DSN = 'https://public@o0.ingest.sentry.io/1';
-
+const { default: sentrySdk } = await import('./sentrySdk.js');
 const { default: captureSentryError } = await import('./captureSentryError.js');
 
+beforeEach(() => {
+  sentrySdk.current = { captureException };
+});
+
 function createAxiosError() {
   const error = new Error('Request failed with status code 401');
   error.name = 'AxiosError';
@@ -92,13 +93,36 @@ test('captureSentryError leaves out the requestId tag when the context has no re
   expect(Object.keys(tags)).not.toContain('requestId');
 });
 
-test('captureSentryError does nothing when SENTRY_DSN is not set', () => {
-  const dsn = process.env.SENTRY_DSN;
-  delete process.env.SENTRY_DSN;
-  try {
-    captureSentryError({ error: new Error('Failed.'), context: { rid: 'req-1' } });
-  } finally {
-    process.env.SENTRY_DSN = dsn;
-  }
+test('captureSentryError does nothing when Sentry was not started', () => {
+  sentrySdk.current = null;
+  captureSentryError({ error: new Error('Failed.'), context: { rid: 'req-1' } });
   expect(captureException).not.toHaveBeenCalled();
 });
+
+test('captureSentryError tags integrity fields and fingerprints a TenantIntegrityError by collection', () => {
+  captureException.mockClear();
+  const error = new TenantIntegrityError('bad row', {
+    collection: 'contacts',
+    connectionId: 'contacts_conn',
+    organizationId: 'org_a',
+    endpointId: 'save',
+  });
+  captureSentryError({ error, context: { rid: 'req-2' } });
+  const [, options] = captureException.mock.calls[0];
+  expect(options.tags).toMatchObject({
+    collection: 'contacts',
+    connectionId: 'contacts_conn',
+    organizationId: 'org_a',
+    endpointId: 'save',
+    errorName: 'TenantIntegrityError',
+  });
+  expect(options.fingerprint).toEqual(['TenantIntegrityError', 'contacts']);
+});
+
+test('captureSentryError sets no fingerprint or integrity tags on an ordinary error', () => {
+  captureException.mockClear();
+  captureSentryError({ error: new Error('x'), context: { rid: 'req-3' } });
+  const [, options] = captureException.mock.calls[0];
+  expect(options.fingerprint).toBeUndefined();
+  expect(options.tags.errorName).toBeUndefined();
+});

package/lib/server/sentry/initSentry.js

@@ -14,43 +14,64 @@
   limitations under the License.
 */
 
-import * as Sentry from '@sentry/node';
-
 import loggerConfig from '../../build/logger.js';
 import scrubEvent from './scrubEvent.js';
+import sentrySdk from './sentrySdk.js';
 
-// Returns true when Sentry was initialized, so the caller can log it through
-// the structured logger — this module runs before the logger exists.
-function initSentryServer() {
-  // No-op if SENTRY_DSN not set
+// Starts Sentry and returns its SDK, or null when Sentry is off. Nothing Sentry is imported when
+// it is off. A server that traces requests runs @sentry/node, which sets up OpenTelemetry and
+// hooks every module the app imports after it. A server that only reports errors runs the SDK's
+// light mode, which has neither: on a serverless function that start-up cost lands on every cold
+// start, so serverless functions report errors only unless logger.sentry.serverTracing is true.
+// This module runs before the logger exists, so the caller logs that Sentry is on.
+async function initSentryServer({ serverless = false } = {}) {
   if (!process.env.SENTRY_DSN) {
-    return false;
+    return null;
   }
 
-  const sentryConfig = loggerConfig.sentry || {};
+  const sentryConfig = loggerConfig.sentry ?? {};
 
-  // No-op if server logging is explicitly disabled
   if (sentryConfig.server === false) {
-    return false;
+    return null;
   }
 
-  Sentry.init({
+  const tracing = sentryConfig.serverTracing ?? !serverless;
+  const options = {
     dsn: process.env.SENTRY_DSN,
     environment: sentryConfig.environment || process.env.NODE_ENV || 'production',
-    tracesSampleRate: sentryConfig.tracesSampleRate ?? 0.1,
+    // A serverless function stays busy until the flush after each request ends, and the SDK
+    // sends a client report (a count of dropped and unsampled events) with every flush that has
+    // one, so each request would wait on an upload. A long-running server sends them on a timer.
+    sendClientReports: !serverless,
     // Every path out to Sentry gets the log's secret scrub: error events with their cause
     // chain, and the spans and breadcrumbs that carry outgoing URLs with their query strings.
     beforeSend: (event) => scrubEvent(event),
     beforeSendTransaction: (event) => scrubEvent(event),
     beforeSendSpan: (span) => scrubEvent(span),
     beforeBreadcrumb: (breadcrumb) => scrubEvent(breadcrumb),
-    // Incoming request bodies are attached to error events by default - an endpoint payload,
-    // a sign-in password - and no value scrub can recognise them. This replaces the default
-    // Http integration by name rather than adding a second one.
-    integrations: [Sentry.httpIntegration({ maxIncomingRequestBodySize: 'none' })],
-  });
+  };
+
+  // Incoming request bodies are attached to error events by default - an endpoint payload,
+  // a sign-in password - and no value scrub can recognise them. Each SDK's Http integration is
+  // passed by name, replacing its default one rather than adding a second.
+  let Sentry;
+  if (tracing) {
+    Sentry = await import('@sentry/node');
+    Sentry.init({
+      ...options,
+      tracesSampleRate: sentryConfig.tracesSampleRate ?? 0.1,
+      integrations: [Sentry.httpIntegration({ maxIncomingRequestBodySize: 'none' })],
+    });
+  } else {
+    Sentry = await import('@sentry/node-core/light');
+    Sentry.init({
+      ...options,
+      integrations: [Sentry.httpIntegration({ maxRequestBodySize: 'none' })],
+    });
+  }
 
-  return true;
+  sentrySdk.current = Sentry;
+  return Sentry;
 }
 
 export default initSentryServer;

package/lib/server/sentry/initSentry.serverless.test.mjs

@@ -0,0 +1,165 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+import http from 'node:http';
+
+import { jest } from '@jest/globals';
+import * as RealLight from '@sentry/node-core/light';
+
+const envelopes = [];
+function createStubTransport() {
+  return {
+    send: async (envelope) => {
+      envelopes.push(envelope);
+      return {};
+    },
+    flush: async () => true,
+  };
+}
+
+const imported = { node: false, light: false };
+const nodeInit = jest.fn();
+const nodeHttpIntegration = jest.fn(() => ({ name: 'Http' }));
+
+// @sentry/node is a stub that records its import, so a test can tell which SDK started. The light
+// SDK is real, with its network transport swapped for memory.
+jest.unstable_mockModule('@sentry/node', () => {
+  imported.node = true;
+  return { init: nodeInit, httpIntegration: nodeHttpIntegration };
+});
+jest.unstable_mockModule('@sentry/node-core/light', () => {
+  imported.light = true;
+  return {
+    ...RealLight,
+    init: (options) => RealLight.init({ ...options, transport: createStubTransport }),
+  };
+});
+const loggerConfig = { sentry: {} };
+jest.unstable_mockModule('../../build/logger.js', () => ({ default: loggerConfig }));
+
+const { default: initSentryServer } = await import('./initSentry.js');
+const { default: sentrySdk } = await import('./sentrySdk.js');
+const { default: captureSentryError } = await import('./captureSentryError.js');
+const { default: setSentryUser } = await import('./setSentryUser.js');
+
+function sentEvents() {
+  return envelopes.flatMap(([, items]) =>
+    items.filter(([header]) => header.type === 'event').map(([, payload]) => payload)
+  );
+}
+
+beforeEach(() => {
+  envelopes.length = 0;
+});
+
+afterAll(async () => {
+  await RealLight.close();
+});
+
+test('initSentry imports no Sentry SDK and returns null when SENTRY_DSN is not set', async () => {
+  delete process.env.SENTRY_DSN;
+  expect(await initSentryServer({ serverless: true })).toBe(null);
+  expect(imported).toEqual({ node: false, light: false });
+  expect(sentrySdk.current).toBe(null);
+});
+
+test('initSentry on a serverless function reports errors with the light SDK, without tracing or client reports', async () => {
+  process.env.SENTRY_DSN = 'https://public@o0.ingest.sentry.io/1';
+  const sentry = await initSentryServer({ serverless: true });
+  expect(imported).toEqual({ node: false, light: true });
+  expect(sentrySdk.current).toBe(sentry);
+  const client = RealLight.getClient();
+  expect(client).toBeInstanceOf(RealLight.LightNodeClient);
+  const options = client.getOptions();
+  expect(options.tracesSampleRate).toBeUndefined();
+  expect(options.sendClientReports).toBe(false);
+  expect(options.integrations.filter(({ name }) => name === 'Http')).toHaveLength(1);
+});
+
+// A request handler that, like the Vercel function entry, reads the body with for await, sets the
+// caller from a header and, when asked, waits and then captures an error, so a second request
+// sets its own user while the first is still running.
+async function handleRequest(req, res) {
+  const chunks = [];
+  for await (const chunk of req) chunks.push(chunk);
+  setSentryUser({ user: { id: req.headers['x-user'] } });
+  if (req.headers['x-fail'] === 'true') {
+    await new Promise((resolve) => setTimeout(resolve, 50));
+    captureSentryError({ error: new Error('Endpoint failed.'), context: { rid: 'req-1' } });
+  }
+  res.end('{}');
+}
+
+async function startServer() {
+  const server = http.createServer((req, res) => {
+    handleRequest(req, res);
+  });
+  await new Promise((resolve) => server.listen(0, '127.0.0.1', resolve));
+  return server;
+}
+
+function post({ port, user, fail }) {
+  return fetch(`http://127.0.0.1:${port}/api/endpoints/sign-in`, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json', 'x-user': user, 'x-fail': String(fail) },
+    body: JSON.stringify({ email: 'user@example.com', password: 'planted-user-password' }),
+  }).then((response) => response.text());
+}
+
+test('a serverless request that captures nothing leaves nothing for the flush to send', async () => {
+  const server = await startServer();
+  try {
+    await post({ port: server.address().port, user: 'user-a', fail: false });
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+  }
+  expect(await sentrySdk.current.flush(2000)).toBe(true);
+  expect(envelopes).toEqual([]);
+});
+
+test('a serverless request that captures an error sends it on flush, with its own user and no request body', async () => {
+  const server = await startServer();
+  const { port } = server.address();
+  try {
+    const failing = post({ port, user: 'user-a', fail: true });
+    await new Promise((resolve) => setTimeout(resolve, 10));
+    await post({ port, user: 'user-b', fail: false });
+    await failing;
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+  }
+  await sentrySdk.current.flush(2000);
+  const events = sentEvents();
+  expect(events).toHaveLength(1);
+  expect(events[0].exception.values[0].value).toEqual('Endpoint failed.');
+  expect(events[0].user).toEqual({ id: 'user-a' });
+  expect(events[0].request.url).toMatch(/\/api\/endpoints\/sign-in$/);
+  expect(events[0].request.data).toBeUndefined();
+  expect(JSON.stringify(events[0])).not.toContain('planted-user-password');
+});
+
+test('initSentry on a serverless function with serverTracing runs @sentry/node with tracing and no client reports', async () => {
+  loggerConfig.sentry = { serverTracing: true, tracesSampleRate: 0.2 };
+  const sentry = await initSentryServer({ serverless: true });
+  expect(imported.node).toBe(true);
+  expect(sentrySdk.current).toBe(sentry);
+  expect(nodeHttpIntegration.mock.calls).toEqual([[{ maxIncomingRequestBodySize: 'none' }]]);
+  expect(nodeInit).toHaveBeenCalledTimes(1);
+  const [options] = nodeInit.mock.calls[0];
+  expect(options.tracesSampleRate).toBe(0.2);
+  expect(options.sendClientReports).toBe(false);
+  expect(options.integrations).toEqual([{ name: 'Http' }]);
+});

package/lib/server/sentry/initSentry.test.mjs

@@ -17,7 +17,10 @@
 import http from 'node:http';
 
 import { jest } from '@jest/globals';
+import { Hono } from 'hono';
+import { serve } from '@hono/node-server';
 import * as RealSentry from '@sentry/node';
+import { markCredential, runInCredentialScope } from '@lowdefy/node-utils';
 
 const secret = 'planted/secret+value=1';
 
@@ -45,14 +48,18 @@ jest.unstable_mockModule('@sentry/node', () => ({
     return integration;
   },
 }));
-jest.unstable_mockModule('../../build/logger.js', () => ({ default: { sentry: {} } }));
+jest.unstable_mockModule('../../build/logger.js', () => ({
+  default: { sentry: { tracesSampleRate: 1 } },
+}));
 
 process.env.SENTRY_DSN = 'https://public@o0.ingest.sentry.io/1';
 process.env.LOWDEFY_SECRET_API_KEY = secret;
 
 const { default: initSentryServer } = await import('./initSentry.js');
+const { default: sentrySdk } = await import('./sentrySdk.js');
+const { default: sentryMiddleware } = await import('../../../src/middleware/sentry.js');
 
-const enabled = initSentryServer();
+const sentry = await initSentryServer();
 const client = RealSentry.getClient();
 const options = client.getOptions();
 
@@ -62,6 +69,22 @@ function sentEvents() {
   );
 }
 
+function sentTransactions() {
+  return envelopes.flatMap(([, items]) =>
+    items.filter(([header]) => header.type === 'transaction').map(([, payload]) => payload)
+  );
+}
+
+function listen(server) {
+  return new Promise((resolve) => {
+    if (server.listening) {
+      resolve(server.address().port);
+      return;
+    }
+    server.once('listening', () => resolve(server.address().port));
+  });
+}
+
 beforeEach(() => {
   envelopes.length = 0;
 });
@@ -70,9 +93,15 @@ afterAll(async () => {
   await RealSentry.close();
 });
 
-test('initSentry initializes Sentry when SENTRY_DSN is set', () => {
-  expect(enabled).toBe(true);
+test('initSentry initializes Sentry when SENTRY_DSN is set and makes its SDK the server one', () => {
   expect(client).toBeDefined();
+  expect(sentry.captureException).toBe(RealSentry.captureException);
+  expect(sentrySdk.current).toBe(sentry);
+});
+
+test('initSentry traces requests and keeps client reports on a long-running server', () => {
+  expect(options.tracesSampleRate).toBe(1);
+  expect(options.sendClientReports).toBe(true);
 });
 
 test('initSentry installs exactly one Http integration, the one that attaches no request bodies', () => {
@@ -235,3 +264,102 @@ test('an error event captured during a request with a JSON body carries no reque
   expect(events[0].request.data).toBeUndefined();
   expect(JSON.stringify(events[0])).not.toContain('planted-user-password');
 });
+
+test('a transaction sent after the response is scrubbed of the credentials its request marked', async () => {
+  const markedKey = 'runtime-made-app-key-0001';
+  const upstream = http.createServer((req, res) => res.end('{}'));
+  upstream.listen(0, '127.0.0.1');
+  const upstreamPort = await listen(upstream);
+
+  // The two middlewares the production app runs first, in its order.
+  const app = new Hono();
+  app.use('*', (c, next) => runInCredentialScope(next));
+  app.use('*', sentryMiddleware());
+  app.post('/api/endpoints/create-app', async (c) => {
+    markCredential(markedKey);
+    const upstreamResponse = await fetch(
+      `http://127.0.0.1:${upstreamPort}/v1/apps?key=${markedKey}`
+    );
+    await upstreamResponse.text();
+    return c.json({ ok: true });
+  });
+  // @hono/node-server writes the response after the middleware chain has returned, so the
+  // request's root span ends, and its transaction is sent, outside the credential scope.
+  const server = serve({ fetch: app.fetch, port: 0, hostname: '127.0.0.1' });
+  const port = await listen(server);
+  try {
+    const response = await fetch(`http://127.0.0.1:${port}/api/endpoints/create-app`, {
+      method: 'POST',
+    });
+    await response.text();
+    await new Promise((resolve) => setTimeout(resolve, 50));
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+    await new Promise((resolve) => upstream.close(resolve));
+  }
+  await RealSentry.flush();
+  const transaction = sentTransactions().find(
+    ({ transaction: name }) => name === 'POST /api/endpoints/create-app'
+  );
+  expect(transaction).toBeDefined();
+  const clientSpan = transaction.spans.find(({ op }) => op === 'http.client');
+  expect(clientSpan.data['url.full']).toEqual(
+    `http://127.0.0.1:${upstreamPort}/v1/apps?key=[REDACTED]`
+  );
+  expect(clientSpan.data['http.query']).toEqual('key=[REDACTED]');
+  expect(JSON.stringify(transaction)).not.toContain(markedKey);
+});
+
+test('concurrent requests each scrub their transaction with their own marked credentials', async () => {
+  const keyA = 'runtime-made-app-key-aaaa';
+  const keyB = 'runtime-made-app-key-bbbb';
+  const upstream = http.createServer((req, res) => res.end('{}'));
+  upstream.listen(0, '127.0.0.1');
+  const upstreamPort = await listen(upstream);
+
+  let markedB;
+  const bMarked = new Promise((resolve) => {
+    markedB = resolve;
+  });
+  const app = new Hono();
+  app.use('*', (c, next) => runInCredentialScope(next));
+  app.use('*', sentryMiddleware());
+  // The first request's middleware runs before the second's, and its fetch after the second
+  // has marked its own key, so a scrub shared between them would miss the first key.
+  app.post('/api/endpoints/first', async (c) => {
+    markCredential(keyA);
+    await bMarked;
+    await (await fetch(`http://127.0.0.1:${upstreamPort}/v1/first?key=${keyA}`)).text();
+    return c.json({ ok: true });
+  });
+  app.post('/api/endpoints/second', async (c) => {
+    markCredential(keyB);
+    markedB();
+    await (await fetch(`http://127.0.0.1:${upstreamPort}/v1/second?key=${keyB}`)).text();
+    return c.json({ ok: true });
+  });
+  const server = serve({ fetch: app.fetch, port: 0, hostname: '127.0.0.1' });
+  const port = await listen(server);
+  try {
+    const first = fetch(`http://127.0.0.1:${port}/api/endpoints/first`, { method: 'POST' });
+    await new Promise((resolve) => setTimeout(resolve, 20));
+    const second = fetch(`http://127.0.0.1:${port}/api/endpoints/second`, { method: 'POST' });
+    await Promise.all([(await first).text(), (await second).text()]);
+    await new Promise((resolve) => setTimeout(resolve, 50));
+  } finally {
+    await new Promise((resolve) => server.close(resolve));
+    await new Promise((resolve) => upstream.close(resolve));
+  }
+  await RealSentry.flush();
+  const transactions = sentTransactions();
+  const firstTransaction = transactions.find(
+    ({ transaction: name }) => name === 'POST /api/endpoints/first'
+  );
+  const secondTransaction = transactions.find(
+    ({ transaction: name }) => name === 'POST /api/endpoints/second'
+  );
+  expect(JSON.stringify(firstTransaction)).toContain('/v1/first?key=[REDACTED]');
+  expect(JSON.stringify(secondTransaction)).toContain('/v1/second?key=[REDACTED]');
+  expect(JSON.stringify([firstTransaction, secondTransaction])).not.toContain(keyA);
+  expect(JSON.stringify([firstTransaction, secondTransaction])).not.toContain(keyB);
+});

package/lib/server/sentry/scrubEvent.js

@@ -18,12 +18,23 @@ import { mapPlainValues, type } from '@lowdefy/helpers';
 
 import scrubSecrets from '../scrubSecrets.js';
 
+function returnUnchanged(value) {
+  return value;
+}
+
 // Class instances are left as they are: Sentry normalizes those before beforeSend
 // runs, so the event hook still reaches their strings. Breadcrumbs reach
 // beforeBreadcrumb un-normalized - a console breadcrumb holds the logged arguments
 // as they are - so the walk must be cycle-safe, which mapPlainValues is.
+// An event also carries its request's credential scrub (the Sentry middleware puts it on the
+// request's isolation scope), which reaches the credentials that request marked when the event
+// is sent after the request's scope has ended, as a transaction is.
 function scrubEvent(value) {
-  return mapPlainValues(value, (item) => (type.isString(item) ? scrubSecrets(item) : item));
+  const scrubRequestCredentials =
+    value?.sdkProcessingMetadata?.scrubRequestCredentials ?? returnUnchanged;
+  return mapPlainValues(value, (item) =>
+    type.isString(item) ? scrubRequestCredentials(scrubSecrets(item)) : item
+  );
 }
 
 export default scrubEvent;

package/lib/server/sentry/sentrySdk.js

@@ -0,0 +1,23 @@
+/*
+  Copyright 2020-2026 Lowdefy, Inc
+
+  Licensed under the Apache License, Version 2.0 (the "License");
+  you may not use this file except in compliance with the License.
+  You may obtain a copy of the License at
+
+      http://www.apache.org/licenses/LICENSE-2.0
+
+  Unless required by applicable law or agreed to in writing, software
+  distributed under the License is distributed on an "AS IS" BASIS,
+  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+  See the License for the specific language governing permissions and
+  limitations under the License.
+*/
+
+// The Sentry SDK the server started, or null while Sentry is off. initSentryServer sets it once,
+// before the app loads. The SDK is imported only when Sentry is on, and which SDK depends on
+// whether the server traces requests, so nothing else imports a Sentry package: every server
+// module that reports to Sentry reads it from here.
+const sentrySdk = { current: null };
+
+export default sentrySdk;

package/lib/server/sentry/setSentryUser.js

@@ -14,11 +14,11 @@
   limitations under the License.
 */
 
-import * as Sentry from '@sentry/node';
+import sentrySdk from './sentrySdk.js';
 
 function setSentryUser({ user, sentryConfig }) {
-  // No-op if Sentry not initialized (DSN not set)
-  if (!process.env.SENTRY_DSN) {
+  const Sentry = sentrySdk.current;
+  if (!Sentry) {
     return;
   }
 

package/lowdefy/build.mjs

@@ -54,7 +54,9 @@ async function run() {
     customTypesMap,
     directories,
     logger,
+    pluginInstallFollows: process.env.LOWDEFY_BUILD_PLUGIN_INSTALL_FOLLOWS === 'true',
     refResolver: argv.refResolver || process.env.LOWDEFY_BUILD_REF_RESOLVER,
+    skipPluginChecks: process.env.LOWDEFY_BUILD_SKIP_PLUGIN_CHECKS === 'true',
   });
 }