@oneuptime/common 12.0.32 → 12.0.34

package/Server/Utils/EmailRollup/EmailRollupWriter.ts

@@ -0,0 +1,368 @@
+import MailService from "../../Services/MailService";
+import UserNotificationEmailRollupItemService from "../../Services/UserNotificationEmailRollupItemService";
+import UserNotificationEmailRollupSettingService from "../../Services/UserNotificationEmailRollupSettingService";
+import QueryHelper from "../../Types/Database/QueryHelper";
+import logger from "../Logger";
+import CaptureSpan from "../Telemetry/CaptureSpan";
+import {
+  BURST_THRESHOLD,
+  BURST_WINDOW_MINUTES,
+  ROLLUP_SUBJECT_MAX_LENGTH,
+} from "./EmailRollupConstants";
+import UserNotificationEmailRollupItem from "../../../Models/DatabaseModels/UserNotificationEmailRollupItem";
+import OneUptimeDate from "../../../Types/Date";
+import Dictionary from "../../../Types/Dictionary";
+import Email from "../../../Types/Email";
+import { EmailEnvelope } from "../../../Types/Email/EmailMessage";
+import { JSONObject } from "../../../Types/JSON";
+import RollupCategory, {
+  getRollupCategory,
+} from "../../../Types/NotificationSetting/NotificationEmailRollupCategory";
+import { isRollupEligible } from "../../../Types/NotificationSetting/NotificationEmailRollupPolicy";
+import NotificationSettingEventType from "../../../Types/NotificationSetting/NotificationSettingEventType";
+import ObjectID from "../../../Types/ObjectID";
+import PositiveNumber from "../../../Types/PositiveNumber";
+import Text from "../../../Types/Text";
+
+/*
+ * Why this file exists: it is the ONE place an owner notification email can be
+ * held back, and it sits between UserNotificationSettingService and
+ * MailService rather than inside either of them.
+ *
+ * It is a Util and not a method on UserNotificationSettingService because it
+ * orchestrates two other services (the rollup item ledger and MailService) and
+ * has its own failure policy. That is the same reason OnCallShiftReminderRunner
+ * lives under Utils rather than on UserOnCallShiftReminderService, and keeping
+ * the shape consistent means a reader who has seen one recognises the other.
+ *
+ * THE SINGLE MOST IMPORTANT PROPERTY OF THIS FILE: it can only ever fail INTO
+ * today's behaviour. Every line that touches the database is inside one
+ * try/catch whose catch sets `deferred = false`, so a missing table, a
+ * statement timeout, a degraded Postgres, a category the code has never heard
+ * of, or a bug introduced here next year all end at the same place - the
+ * MailService.sendMail call that shipped before this feature existed. There is
+ * no failure mode in which a notification is silently dropped, and that is the
+ * entire reason this is safe to default ON for every existing project with no
+ * migration and no preference.
+ *
+ * The second property worth stating up front: below the burst threshold this
+ * is a no-op on the observable behaviour. The same envelope and the same
+ * correlation-id options reach MailService.sendMail, fire-and-forget, exactly
+ * as before. A project that produces three owner emails a day never notices
+ * the feature exists. Only an address that is already being flooded sees a
+ * change, and even then nothing is suppressed - the 5th through Nth
+ * notifications arrive together in one rollup email a few minutes later.
+ */
+
+/*
+ * The correlation-id bag that UserNotificationSettingService already builds
+ * for MailService. Derived from sendMail's own signature rather than
+ * re-declared, because the whole point is that it is passed through VERBATIM:
+ * if somebody adds a new id to sendMail's options, this type follows and the
+ * seam keeps compiling instead of quietly dropping the new field.
+ */
+export type RollupMailOptions = Parameters<typeof MailService.sendMail>[1];
+
+export interface SendOrRollupData {
+  projectId: ObjectID;
+  userId: ObjectID;
+  toEmail: Email;
+  eventType: NotificationSettingEventType;
+  emailEnvelope: EmailEnvelope;
+  mailOptions: RollupMailOptions;
+  /*
+   * Set by a producer that reuses another family's event type for something
+   * urgent, so the event type alone cannot express the urgency. The SLA-breach
+   * job is the case that exists today: it sends under
+   * EmailTemplateType.IncidentOwnerResourceCreated and reuses
+   * SEND_INCIDENT_CREATED_OWNER_NOTIFICATION, so nothing about its event type
+   * distinguishes "your SLA just breached" from an ordinary incident-created
+   * notice.
+   */
+  forceImmediate?: boolean | undefined;
+}
+
+/*
+ * The deep-link variable names every owner-notification producer in the repo
+ * actually uses, harvested by grep over App/FeatureSet/Workers/Jobs and
+ * Common/Server/Services. Order is preference order: when an envelope carries
+ * more than one, the first entry here wins, so the resource the notification is
+ * ABOUT beats whatever context happens to ride along with it.
+ *
+ * Both the singular and the plural forms of the probe and AI-agent links are
+ * listed on purpose. viewProbesLink (plural) is the variable used by the
+ * default-seeded, cooldown-free probe connection-flip notification, which is
+ * the single event most likely to dominate a real rollup - getting that one
+ * name wrong would leave the most common rollup line un-clickable.
+ */
+const KNOWN_LINK_VARS: ReadonlyArray<string> = [
+  "incidentViewLink",
+  "alertViewLink",
+  "episodeViewLink",
+  "incidentEpisodeViewLink",
+  "alertEpisodeViewLink",
+  "monitorViewLink",
+  "scheduledMaintenanceViewLink",
+  "statusPageViewLink",
+  "sloViewLink",
+  "viewProbesLink",
+  "viewProbeLink",
+  "viewAIAgentsLink",
+  "viewAIAgentLink",
+  "deviceViewLink",
+  "onCallPolicyViewLink",
+];
+
+type IsAbsoluteLinkFunction = (
+  value: string | JSONObject | undefined,
+) => value is string;
+
+/*
+ * A link is usable in an email only if it is an absolute http(s) URL. Envelope
+ * vars are typed `string | JSONObject`, and in practice also carry numbers and
+ * relative paths cast in from producers, so this is a value check and not just
+ * a type check.
+ */
+const isAbsoluteLink: IsAbsoluteLinkFunction = (
+  value: string | JSONObject | undefined,
+): value is string => {
+  return typeof value === "string" && value.startsWith("http");
+};
+
+type StripHandlebarsBracesFunction = (value: string) => string;
+
+/*
+ * The stored subject is replayed into the rollup email, and MailService
+ * Handlebars-compiles subject lines. An incident whose title contains `{{`
+ * would therefore be interpreted as a template expression at render time -
+ * best case it renders empty, worst case it reaches for a variable that is not
+ * there and throws inside the mailer. Strip the braces at the boundary, once,
+ * rather than trusting every future renderer to escape them.
+ */
+const stripHandlebarsBraces: StripHandlebarsBracesFunction = (
+  value: string,
+): string => {
+  return value.split("{{").join("").split("}}").join("");
+};
+
+export default class EmailRollupWriter {
+  /*
+   * Pure and exported so it can be tested with no mocks at all. Returns the
+   * first known link var whose value is an absolute URL; failing that, the
+   * first key ending in "Link" whose value is an absolute URL.
+   *
+   * The generic fallback is the point of the design: a producer that adds a
+   * new `somethingViewLink` var next year gets a clickable rollup line with no
+   * code change here and no list to keep in sync. KNOWN_LINK_VARS exists only
+   * to make the CHOICE deterministic when an envelope carries several links -
+   * Object.keys order is insertion order, which is a producer's business, not
+   * a contract this file should depend on.
+   */
+  public static extractViewLink(
+    vars: Dictionary<string | JSONObject> | undefined,
+  ): string | undefined {
+    if (!vars) {
+      return undefined;
+    }
+
+    for (const name of KNOWN_LINK_VARS) {
+      const value: string | JSONObject | undefined = vars[name];
+
+      if (isAbsoluteLink(value)) {
+        return value;
+      }
+    }
+
+    for (const key of Object.keys(vars)) {
+      if (!key.endsWith("Link")) {
+        continue;
+      }
+
+      const value: string | JSONObject | undefined = vars[key];
+
+      if (isAbsoluteLink(value)) {
+        return value;
+      }
+    }
+
+    return undefined;
+  }
+
+  /*
+   * The seam. Either sends the email exactly as the product always has, or
+   * records it as pending for the flush sweep to collapse into one rollup.
+   *
+   * Awaited by the caller, unlike the fire-and-forget send it replaces, because
+   * the enqueue has to have happened before sendUserNotification returns -
+   * otherwise a caller that shuts the process down after its last notification
+   * would lose the row, and the burst counter would under-count under load.
+   * The SEND itself is still fire-and-forget inside sendNow, so the awaited
+   * part is only the two indexed queries.
+   */
+  @CaptureSpan()
+  public static async sendOrRollup(data: SendOrRollupData): Promise<void> {
+    const sendNow: () => void = (): void => {
+      MailService.sendMail(
+        {
+          ...data.emailEnvelope,
+          toEmail: data.toEmail,
+        },
+        data.mailOptions,
+      ).catch((err: Error) => {
+        logger.error(err);
+      });
+    };
+
+    /*
+     * STRUCTURAL BYPASSES, BEFORE ANY DATABASE WORK. Both of these must stay
+     * above the try block: paging-adjacent mail has to cost zero extra queries
+     * on the hot path, and "the rollup code cannot reach it" has to be
+     * provable by reading six lines rather than by auditing the fail-open
+     * catch below.
+     */
+    if (data.forceImmediate === true) {
+      sendNow();
+      return;
+    }
+
+    /*
+     * isRollupEligible is the whole on-call guard. It is a positive allow-list,
+     * and NEVER_ROLLED_UP_EVENT_TYPES is its complement by construction, so
+     * testing the never-list here as well would add a second place for the
+     * policy to drift with no extra safety.
+     */
+    if (!isRollupEligible(data.eventType)) {
+      sendNow();
+      return;
+    }
+
+    let deferred: boolean = false;
+
+    try {
+      const category: RollupCategory = getRollupCategory(data.eventType);
+
+      const windowStart: Date = OneUptimeDate.addRemoveMinutes(
+        OneUptimeDate.getCurrentDate(),
+        BURST_WINDOW_MINUTES * -1,
+      );
+
+      /*
+       * SCOPED PER CATEGORY, and that scoping is the feature's main regression
+       * guard. A monitor that flaps every thirty seconds must not be able to
+       * consume the free immediate sends that the first "production is down"
+       * incident email needs. The query's columns are the leading four of the
+       * item table's composite index plus createdAt, so this is one index
+       * range scan on a path that already awaits a dozen other queries.
+       */
+      const recentCount: PositiveNumber =
+        await UserNotificationEmailRollupItemService.countBy({
+          query: {
+            projectId: data.projectId,
+            userId: data.userId,
+            toEmail: data.toEmail,
+            rollupCategory: category,
+            createdAt: QueryHelper.greaterThan(windowStart),
+          },
+          props: {
+            isRoot: true,
+          },
+        });
+
+      deferred = recentCount.toNumber() >= BURST_THRESHOLD;
+
+      /*
+       * THE PERSONAL ESCAPE HATCH, READ ONLY WHEN IT COULD CHANGE THE ANSWER.
+       *
+       * A user can turn burst rollup off for themselves in one project, and
+       * then every owner notification is emailed individually and immediately,
+       * exactly as the product behaved before rollup existed.
+       *
+       * The read is deliberately inside this `if`. Below the threshold the
+       * outcome is an immediate send whatever the preference says, so asking
+       * would be a query per notification per address that could never change
+       * anything - the feature's no-op-below-the-threshold property has to
+       * stay a no-op in queries too, not just in emails. Above it, one indexed
+       * single-row read per deferred email is the honest cost of letting
+       * somebody opt out, and it is not cached, because a person who has just
+       * asked for immediate email should not keep receiving batches for the
+       * length of a TTL.
+       *
+       * A throw here lands in the fail-open catch below, which sends
+       * immediately - the same direction opting out means, so the failure mode
+       * of the escape hatch is the escape hatch.
+       */
+      if (deferred) {
+        const mayRollUp: boolean =
+          await UserNotificationEmailRollupSettingService.isRollupEnabledForUser(
+            {
+              userId: data.userId,
+              projectId: data.projectId,
+            },
+          );
+
+        deferred = mayRollUp;
+      }
+
+      /*
+       * A ROW IS WRITTEN FOR EVERY ROLLUP-ELIGIBLE EMAIL, sent or deferred.
+       * That is what makes the counter above countable at all, and it is also
+       * what makes this table the first per-event-type, per-recipient email
+       * volume record the product has ever had.
+       */
+      const item: UserNotificationEmailRollupItem =
+        new UserNotificationEmailRollupItem();
+      item.projectId = data.projectId;
+      item.userId = data.userId;
+      item.toEmail = data.toEmail;
+      item.eventType = data.eventType;
+      item.rollupCategory = category;
+      item.subject =
+        Text.truncate(
+          stripHandlebarsBraces(data.emailEnvelope.subject ?? ""),
+          ROLLUP_SUBJECT_MAX_LENGTH,
+        ) ?? "";
+
+      const link: string | undefined = EmailRollupWriter.extractViewLink(
+        data.emailEnvelope.vars,
+      );
+
+      /*
+       * Guarded rather than `item.viewLink = link ?? undefined`, because
+       * exactOptionalPropertyTypes is on and an optional property will not
+       * accept an explicit undefined.
+       */
+      if (link !== undefined) {
+        item.viewLink = link;
+      }
+
+      /*
+       * sentAt at insert time for an immediate send; left NULL for a deferred
+       * one, which is precisely what "pending" means to the flush sweep.
+       */
+      if (!deferred) {
+        item.sentAt = OneUptimeDate.getCurrentDate();
+      }
+
+      await UserNotificationEmailRollupItemService.create({
+        data: item,
+        props: {
+          isRoot: true,
+        },
+      });
+    } catch (err) {
+      /*
+       * FAIL OPEN. Read the file header before changing anything here: the
+       * only correct answer to "the rollup bookkeeping did not work" is to
+       * behave exactly as the product did before the feature existed. Resetting
+       * deferred is not defensive tidying - it is the line that guarantees a
+       * broken rollup can never turn into a missed notification.
+       */
+      logger.error(err);
+      deferred = false;
+    }
+
+    if (!deferred) {
+      sendNow();
+    }
+  }
+}

package/Server/Utils/FrontendEnvironment.ts

@@ -0,0 +1,40 @@
+import { getFrontendEnvVars } from "../EnvironmentConfig";
+import { ExpressRequest, ExpressResponse } from "./Express";
+import Response from "./Response";
+
+export const FRONTEND_ENVIRONMENT_CACHE_CONTROL: string =
+  "private, no-store, no-cache, must-revalidate";
+
+/*
+ * The combined App server and the five standalone frontend servers must emit
+ * exactly the same environment payload. Keeping the serializer here prevents
+ * either route family from growing a second, less restrictive copy.
+ */
+export const getFrontendEnvironmentScript: () => string = (): string => {
+  return `
+if(!window.process){
+  window.process = {}
+}
+
+if(!window.process.env){
+  window.process.env = {}
+}
+window.process.env = ${JSON.stringify(getFrontendEnvVars())};
+`;
+};
+
+/*
+ * Keep the cache policy beside the one serializer used by every frontend. A
+ * pre-remediation env.js may contain a backend exporter credential, so merely
+ * fixing the next response is insufficient if a browser or intermediary is
+ * allowed to retain the old bytes. `private` is defence in depth for shared
+ * caches; `no-store` is the controlling requirement.
+ */
+export const sendFrontendEnvironmentResponse: (
+  req: ExpressRequest,
+  res: ExpressResponse,
+) => void = (req: ExpressRequest, res: ExpressResponse): void => {
+  Response.setNoCacheHeaders(res);
+  res.setHeader("Cache-Control", FRONTEND_ENVIRONMENT_CACHE_CONTROL);
+  Response.sendJavaScriptResponse(req, res, getFrontendEnvironmentScript());
+};

package/Server/Utils/LLM/LLMService.ts

@@ -126,6 +126,20 @@ interface OpenAIRequestAdaptation {
   unsupportedParams: Set<string>;
 }
 
+/*
+ * Structural fields of an Ollama /api/chat request. additionalParams is
+ * operator-supplied tuning, so it must never be able to replace the
+ * conversation, silence the tool belt, or flip the request to streaming —
+ * the same fail-closed posture PROTECTED_ADDITIONAL_PARAMETER_ALLOWLIST
+ * applies on the OpenAI wire.
+ */
+const OLLAMA_RESERVED_REQUEST_KEYS: Set<string> = new Set([
+  "model",
+  "messages",
+  "tools",
+  "stream",
+]);
+
 export default class LLMService {
   /*
    * How many times a provider call is attempted before it is reported as a
@@ -1545,6 +1559,70 @@ export default class LLMService {
       requestData["tools"] = this.toOpenAITools(request.tools);
     }
 
+    /*
+     * Provider-configured tuning. The model column and the settings UI both
+     * promise additionalParams is sent to the provider, but only the
+     * OpenAI-wire branch honoured it — so on Ollama the operator had no lever
+     * at all, and in particular no way to raise `num_ctx`. That matters here
+     * more than on any hosted provider: Ollama silently truncates anything
+     * past the server's default context (2048/4096 on common builds), and the
+     * chat agent's tool belt alone is several thousand tokens. A truncated
+     * request loses the tool definitions with no error, and the model then
+     * answers that it has no tool for the question.
+     *
+     * Ollama nests generation settings under `options`, so an `options`
+     * object in additionalParams is merged INTO the defaults above rather
+     * than replacing them; every other key is applied at the top level.
+     */
+    if (request.additionalParams) {
+      const additionalOptions: JSONObject | undefined = request
+        .additionalParams["options"] as JSONObject | undefined;
+
+      for (const key of Object.keys(request.additionalParams)) {
+        if (key === "options" || OLLAMA_RESERVED_REQUEST_KEYS.has(key)) {
+          continue;
+        }
+
+        if (
+          request.protectRequestParameters &&
+          !this.PROTECTED_ADDITIONAL_PARAMETER_ALLOWLIST.has(key)
+        ) {
+          continue;
+        }
+
+        requestData[key] = request.additionalParams[key];
+      }
+
+      if (
+        additionalOptions &&
+        typeof additionalOptions === "object" &&
+        !Array.isArray(additionalOptions)
+      ) {
+        Object.assign(requestData["options"] as JSONObject, additionalOptions);
+
+        /*
+         * Ollama's generation knobs live inside `options`, so merging it is
+         * how an operator raises num_ctx — but it is also how they would
+         * overwrite the caller's own temperature and output cap. A protected
+         * caller owns those two, exactly as it does on the OpenAI wire (where
+         * the protected branch re-asserts temperature and max_tokens after
+         * the merge), so re-assert them here rather than filtering the merge
+         * and losing the tuning the operator legitimately configured.
+         */
+        if (request.protectRequestParameters) {
+          const protectedOptions: JSONObject = requestData[
+            "options"
+          ] as JSONObject;
+
+          protectedOptions["temperature"] = request.temperature ?? 0.7;
+
+          if (request.maxTokens) {
+            protectedOptions["num_predict"] = request.maxTokens;
+          }
+        }
+      }
+    }
+
     const ollamaRequestUrl: string = `${config.baseUrl}/api/chat`;
 
     const response: HTTPErrorResponse | HTTPResponse<JSONObject> =

package/Server/Utils/LogRedaction.ts

@@ -75,6 +75,14 @@ const SENSITIVE_KEY_FRAGMENTS: Array<string> = [
   "onetimecode",
   "logincode",
   "resetcode",
+  /*
+   * A DSN carries the password inline, so the key name is the only signal
+   * we get before the value is already in the log line.
+   */
+  "connectionstring",
+  "connectionuri",
+  "dsn",
+  "sslkey",
 ];
 
 /*
@@ -131,6 +139,15 @@ const SENSITIVE_EXACT_KEYS: Set<string> = new Set<string>([
   "userhandle",
   "challenge",
   "twofactorsecret",
+  /*
+   * Database drivers attach bind values to QueryFailedError as enumerable
+   * arrays. The values have no reliable self-identifying shape, so the whole
+   * field must be treated as secret rather than logged positionally.
+   */
+  "parameters",
+  "parametervalues",
+  "bindparameters",
+  "bindvalues",
 ]);
 
 export type NormalizeLogKeyFunction = (key: string) => string;
@@ -329,6 +346,16 @@ const STRING_REDACTION_RULES: Array<StringRedactionRule> = [
     regex: /\bAIza[0-9A-Za-z_-]{35}\b/g,
     replacement: REDACTED,
   },
+  {
+    /*
+     * Telegram puts the bot credential in the request path rather than a
+     * header. Network clients commonly copy that URL into exception messages,
+     * so structural key redaction cannot see it.
+     */
+    name: "telegram-bot-token-path",
+    regex: /(\/bot)[0-9]{5,}:[A-Za-z0-9_-]{20,}/g,
+    replacement: `$1${REDACTED}`,
+  },
   {
     name: "private-key-block",
     regex:
@@ -369,6 +396,7 @@ const SENSITIVE_TEXT_HINT_REGEX: RegExp = new RegExp(
     "github_pat_",
     "AKIA|ASIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASCA",
     "AIza",
+    "/bot[0-9]{5,}:",
     "-----BEGIN",
     "://",
   ].join("|"),

package/Server/Utils/Logger.ts

@@ -1,6 +1,11 @@
 import { LogLevel } from "../EnvironmentConfig";
 import OneUptimeTelemetry, { TelemetryLogger } from "./Telemetry";
 import TelemetryContext from "./Telemetry/TelemetryContext";
+import ErrorClassResolver from "./Telemetry/ErrorClassResolver";
+import ErrorClass, {
+  isNonActionableErrorClass,
+} from "../../Types/Telemetry/ErrorClass";
+import { ERROR_CLASS_ATTRIBUTE_KEY } from "../../Types/Telemetry/UnitOfWork";
 import { SeverityNumber } from "@opentelemetry/api-logs";
 import Exception from "../../Types/Exception/Exception";
 import { JSONObject } from "../../Types/JSON";
@@ -27,6 +32,24 @@ export interface LogAttributes {
   [key: string]: string | number | boolean | undefined;
 }
 
+/**
+ * Attach to a `logger.error` call whose condition was caused OUTSIDE this
+ * codebase: a tenant's endpoint being down, their credentials being wrong,
+ * their webhook returning 500, their script throwing, their quota being
+ * exhausted. Detecting those is the product working correctly, so they are
+ * logged at WARN severity and never become an Issue.
+ *
+ *   logger.error(`Monitor ping failed: ${err}`, EXTERNAL_FAULT);
+ *
+ * Use it only where the condition is unambiguously external. A genuine
+ * OneUptime defect that happens to surface through a stamped site would be
+ * demoted with it — so keep the stamp tight around the single external call,
+ * never around a whole function body.
+ */
+export const EXTERNAL_FAULT: LogAttributes = {
+  [ERROR_CLASS_ATTRIBUTE_KEY]: ErrorClass.UserError,
+};
+
 export interface RequestLike {
   requestId?: string;
   tenantId?: { toString(): string };
@@ -141,6 +164,17 @@ export default class logger {
       }
 
       if (body instanceof Exception || body instanceof Error) {
+        /*
+         * Driver and HTTP errors often carry security-sensitive enumerable
+         * fields (`parameters`, request config, headers) even when their
+         * message and stack are harmless. Preserve the native Error fast path
+         * only for errors with no extra fields; structured errors must pass
+         * through the recursive key-aware redactor before any sink sees them.
+         */
+        if (Object.keys(body).length > 0) {
+          return redactLogValue(body) as LogBody;
+        }
+
         const originalStack: string = body.stack || "";
         const message: string = redactLogString(body.message);
         const stack: string = redactLogString(originalStack);
@@ -246,13 +280,68 @@ export default class logger {
       logLevel === ConfigLogLevel.ERROR
     ) {
       const body: LogBody = this.redactBody(message);
+      /*
+       * An explicit `error.class` attribute is a site-level declaration and is
+       * authoritative — it is how the probe, notification and worker call
+       * sites that log a plain STRING (no Error object to carry a tag) declare
+       * that a condition is the tenant's, not ours. See EXTERNAL_FAULT.
+       */
+      const errorClass: ErrorClass = ErrorClassResolver.resolve(
+        message,
+        attributes?.[ERROR_CLASS_ATTRIBUTE_KEY],
+      );
+
+      if (isNonActionableErrorClass(errorClass)) {
+        /*
+         * The platform correctly REFUSING a request is not an ERROR. This one
+         * guard reaches every logger.error call site in the product,
+         * including the three unconditional choke points — Response
+         * sendErrorResponse (which is the DOMINANT path: ~720 call sites
+         * answer 4xx directly and never throw, so this log line is the
+         * error's only report), the Express error handler, and the
+         * @CaptureSpan recorder.
+         *
+         * Deliberately NOT this.warn(): Logger.warn is gated on
+         * DEBUG/INFO/WARN and config.example.env ships LOG_LEVEL=ERROR, so
+         * routing through warn() would delete the line from stdout AND from
+         * the support-bundle ring buffer on every Docker Compose install —
+         * and those lines are how an operator discovers a tenant
+         * misconfiguration. Keep the ERROR-level gate; export at WARN
+         * severity.
+         *
+         * Kept inside error() rather than added as a new Logger method
+         * because a number of test suites mock the logger with `error` and no
+         * `warn` sibling; a new method name would be undefined there.
+         *
+         * Free side effect worth knowing about: WARN (severityNumber 13) is
+         * below LogExceptionExtractor's MIN_ERROR_SEVERITY_NUMBER (17), so
+         * demoting also shuts off the log-derived exception path for these
+         * records. That matters more than it looks — redactBody returns the
+         * FULL STACK STRING whenever redaction fired, and that stack
+         * otherwise parses straight into an Issue.
+         */
+        // eslint-disable-next-line no-console
+        console.warn(body);
+
+        this.record("WARN", body);
+
+        this.emitRedacted(body, SeverityNumber.WARN, {
+          ...(attributes || {}),
+          [ERROR_CLASS_ATTRIBUTE_KEY]: errorClass,
+        });
+
+        return;
+      }
 
       // eslint-disable-next-line no-console
       console.error(body);
 
       this.record("ERROR", body);
 
-      this.emitRedacted(body, SeverityNumber.ERROR, attributes);
+      this.emitRedacted(body, SeverityNumber.ERROR, {
+        ...(attributes || {}),
+        [ERROR_CLASS_ATTRIBUTE_KEY]: errorClass,
+      });
     }
   }