Observability, Telemetry, and Rate Limits

Typed telemetry

The optional analytics module exposes a versioned event envelope through src/services/telemetry. The built-in adapters are noop, logger, posthog, ga4, and umami. Events are sent only after analytics consent on the client; server-side business events use the same contract and degrade to logs or no-op when a provider is unavailable.

The default context contains a bounded anonymous ID, optional authenticated user ID, session and request IDs, locale, first/latest source, and UTM fields. It does not include passwords, cookies, authorization headers, email addresses, prompts, model output, or upload contents. Use Operations for the event dictionary and metric formulas.

Logging

Server, Docker, and Vercel use structured logging from src/lib/logger. Configure AXIOM_TOKEN and AXIOM_DATASET to ship logs to Axiom; local output remains available without them.

Cloudflare generation substitutes a Worker-safe console logger and removes Pino and file-writing dependencies. Payment, webhook, and job logs should carry a request or external event ID while excluding keys, cookies, authorization headers, and complete user content.

Sentry

When Sentry is selected, use:

NEXT_PUBLIC_SENTRY_DSN="https://..."
SENTRY_AUTH_TOKEN="sntrys_..."

The DSN is used at runtime. Keep the auth token in the build or release system for source-map upload. The Cloudflare Free combination uses a console monitoring replacement for bundle size and runtime compatibility. Sentry is error monitoring; it is separate from the product-event adapters above.

Rate-limit adapters

Selection	Configuration	Use case
noop	None	Local or trusted environments; no abuse protection
upstash	REST URL and REST token	Server, Docker, Vercel
cloudflare-rate-limit	Seven Rate Limiting bindings	Cloudflare Workers

Cloudflare separates global, auth, ai, payment, upload, strict, and telemetry bindings. Generated thresholds are a starting point; tune them for real traffic and endpoint cost.

Health check

/api/health checks configuration and database reachability. It returns safe status data without exposing variable values.

pnpm deploy:check -- https://your-domain.example/api/health

HTTP 200 with status: healthy confirms the base runtime. Payment, mail, storage, AI, and jobs still need separate real smoke tests.

Privacy and failure behavior

The first-party anonymous ID is stored for at most one year in a cookie or local storage and can be cleared by the user. Analytics consent can be withdrawn from the cookie settings UI. Provider errors are logged after redaction and never reject registration, payment, credit, or core product requests.

Production checks

• Apply a suitable rate limit to every public mutation route.
• Redact logs and error events.
• Configure sampling, retention, and alerts in Sentry and Axiom.
• Monitor /api/health without exposing internal connection details.
• Confirm Worker logs contain no node:fs, SonicBoom, or Pino initialization errors.