@debugbundle/sdk-react-native 1.3.0 → 3.0.0

package/dist/privacy-keys.js

@@ -0,0 +1,35 @@
+export const DEFAULT_SENSITIVE_KEYS = [
+    "password", "secret", "token", "api_key", "apikey", "access_token", "refresh_token",
+    "private_key", "authorization", "bearer", "cookie", "session_id", "passwd", "ssn",
+    "credit_card", "card_number", "cvv", "cvc", "pin", "expiry", "phone", "otp",
+    "verification_code"
+];
+function canonicalizeSensitiveKey(value) {
+    return value.toLowerCase().replace(/[^a-z0-9]+/g, "");
+}
+function splitKeyIntoSegments(key) {
+    return key
+        .trim()
+        .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
+        .toLowerCase()
+        .split(/[^a-z0-9]+/)
+        .filter((segment) => segment.length > 0);
+}
+export function isSensitiveKey(key, sensitiveKeys) {
+    const normalized = key.trim().toLowerCase();
+    if (sensitiveKeys.includes(normalized)) {
+        return true;
+    }
+    const canonicalSensitiveKeys = new Set(sensitiveKeys.map(canonicalizeSensitiveKey));
+    const segments = splitKeyIntoSegments(key);
+    for (let start = 0; start < segments.length; start += 1) {
+        let combined = "";
+        for (let end = start; end < segments.length; end += 1) {
+            combined += segments[end];
+            if (canonicalSensitiveKeys.has(combined)) {
+                return true;
+            }
+        }
+    }
+    return false;
+}

package/dist/privacy-telemetry.d.ts

@@ -0,0 +1,19 @@
+type JsonValue = string | number | boolean | null | JsonValue[] | {
+    [key: string]: JsonValue;
+};
+export interface TelemetrySanitizationOptions {
+    additionalKeys?: readonly string[];
+    maxTotalBytes?: number;
+}
+export type TelemetrySanitizationResult = {
+    ok: true;
+    value: JsonValue;
+    redactionCount: number;
+} | {
+    ok: false;
+    reason: "unsafe_input" | "budget_exceeded";
+};
+/** Mandatory telemetry policy; unlike the legacy `redact` helper, custom keys are additive. */
+export declare function sanitizeTelemetry(value: unknown, options?: TelemetrySanitizationOptions): TelemetrySanitizationResult;
+export {};
+//# sourceMappingURL=privacy-telemetry.d.ts.map

package/dist/privacy-telemetry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy-telemetry.d.ts","sourceRoot":"","sources":["../src/privacy-telemetry.ts"],"names":[],"mappings":"AAAA,KAAK,SAAS,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,GAAG,IAAI,GAAG,SAAS,EAAE,GAAG;IAAE,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,CAAA;CAAE,CAAC;AAW/F,MAAM,WAAW,4BAA4B;IAC3C,cAAc,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,MAAM,2BAA2B,GACnC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,SAAS,CAAC;IAAC,cAAc,EAAE,MAAM,CAAA;CAAE,GACtD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,cAAc,GAAG,iBAAiB,CAAA;CAAE,CAAC;AAyH9D,+FAA+F;AAC/F,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,4BAAiC,GAAG,2BAA2B,CA2BzH"}

package/dist/privacy-telemetry.js

@@ -0,0 +1,164 @@
+import { DEFAULT_SENSITIVE_KEYS, isSensitiveKey } from "./privacy-keys.js";
+import { scrubCredentialText } from "./privacy-text.js";
+const REDACTED = "[REDACTED]";
+const MAX_DEPTH = 16;
+const MAX_NODES = 4096;
+const MAX_ENTRIES = 256;
+const MAX_STRING_BYTES = 16 * 1024;
+const MAX_TOTAL_BYTES = 256 * 1024;
+class BudgetExceeded extends Error {
+}
+function byteLength(value) {
+    let bytes = 0;
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code < 0x80)
+            bytes += 1;
+        else if (code < 0x800)
+            bytes += 2;
+        else if (code >= 0xd800 && code <= 0xdbff && index + 1 < value.length &&
+            value.charCodeAt(index + 1) >= 0xdc00 && value.charCodeAt(index + 1) <= 0xdfff) {
+            bytes += 4;
+            index += 1;
+        }
+        else
+            bytes += 3;
+    }
+    return bytes;
+}
+function mask(state) {
+    state.redactionCount += 1;
+    return REDACTED;
+}
+function sanitizeString(value, state, allowStructured) {
+    if (value.length > MAX_STRING_BYTES)
+        return mask(state);
+    const length = byteLength(value);
+    if (length > MAX_STRING_BYTES)
+        return mask(state);
+    state.textBytes += length;
+    if (state.textBytes > state.maxTotalBytes)
+        throw new BudgetExceeded();
+    if (allowStructured && (value.startsWith("{") || value.startsWith("["))) {
+        try {
+            const parsed = JSON.parse(value);
+            if (typeof parsed === "object" && parsed !== null) {
+                const nested = sanitizeValue(parsed, state, 0, false);
+                const encoded = JSON.stringify(nested);
+                if (encoded !== value)
+                    state.redactionCount += 1;
+                return encoded;
+            }
+        }
+        catch (error) {
+            if (error instanceof BudgetExceeded)
+                throw error;
+            // Malformed structured content with a recognizable sensitive label is withheld below.
+        }
+    }
+    const result = scrubCredentialText(value, state.extra);
+    if (result !== value)
+        state.redactionCount += 1;
+    if ((value.startsWith("{") || value.startsWith("[")) && result === value &&
+        /(?:password|token|secret|authorization|cookie)["']?\s*[:=]/i.test(value)) {
+        return mask(state);
+    }
+    return result;
+}
+function sanitizeValue(value, state, depth, allowStructured) {
+    state.nodes += 1;
+    if (state.nodes > MAX_NODES)
+        throw new BudgetExceeded();
+    if (depth > MAX_DEPTH)
+        return mask(state);
+    if (typeof value === "string")
+        return sanitizeString(value, state, allowStructured);
+    if (value === null || typeof value === "boolean")
+        return value;
+    if (typeof value === "number" && Number.isFinite(value))
+        return value;
+    if (typeof value !== "object")
+        throw new TypeError("unsafe_input");
+    if (state.seen.has(value))
+        return "[Circular]";
+    state.seen.add(value);
+    try {
+        if (Array.isArray(value)) {
+            if (value.length > MAX_ENTRIES)
+                return mask(state);
+            return Array.from({ length: value.length }, (_, index) => {
+                const descriptor = Object.getOwnPropertyDescriptor(value, String(index));
+                if (descriptor === undefined || !("value" in descriptor))
+                    throw new TypeError("unsafe_input");
+                return sanitizeValue(descriptor.value, state, depth + 1, allowStructured);
+            });
+        }
+        if (Object.getPrototypeOf(value) !== Object.prototype && Object.getPrototypeOf(value) !== null) {
+            throw new TypeError("unsafe_input");
+        }
+        const keys = Object.keys(value);
+        if (keys.length > MAX_ENTRIES)
+            return mask(state);
+        const result = {};
+        for (const key of keys) {
+            if (key.length > 128) {
+                state.redactionCount += 1;
+                continue;
+            }
+            state.textBytes += byteLength(key);
+            if (state.textBytes > state.maxTotalBytes)
+                throw new BudgetExceeded();
+            const safeKey = scrubCredentialText(key, state.extra);
+            if (safeKey !== key) {
+                state.redactionCount += 1;
+                continue;
+            }
+            const descriptor = Object.getOwnPropertyDescriptor(value, key);
+            if (descriptor === undefined || !("value" in descriptor))
+                throw new TypeError("unsafe_input");
+            const safeValue = isSensitiveKey(key, state.keys)
+                ? mask(state)
+                : sanitizeValue(descriptor.value, state, depth + 1, allowStructured);
+            Object.defineProperty(result, key, {
+                value: safeValue,
+                enumerable: true,
+                configurable: true,
+                writable: true
+            });
+        }
+        return result;
+    }
+    finally {
+        state.seen.delete(value);
+    }
+}
+/** Mandatory telemetry policy; unlike the legacy `redact` helper, custom keys are additive. */
+export function sanitizeTelemetry(value, options = {}) {
+    try {
+        const extra = options.additionalKeys ?? [];
+        if (extra.length > 128 || extra.some((key) => typeof key !== "string" || key.length > 64 || !key.trim())) {
+            return { ok: false, reason: "unsafe_input" };
+        }
+        const maxTotalBytes = options.maxTotalBytes ?? MAX_TOTAL_BYTES;
+        if (!Number.isInteger(maxTotalBytes) || maxTotalBytes < 1 || maxTotalBytes > 512 * 1024) {
+            return { ok: false, reason: "unsafe_input" };
+        }
+        const state = {
+            nodes: 0,
+            textBytes: 0,
+            redactionCount: 0,
+            seen: new WeakSet(),
+            keys: [...DEFAULT_SENSITIVE_KEYS, ...extra],
+            extra,
+            maxTotalBytes
+        };
+        const sanitized = sanitizeValue(value, state, 0, true);
+        if (byteLength(JSON.stringify(sanitized)) > maxTotalBytes) {
+            return { ok: false, reason: "budget_exceeded" };
+        }
+        return { ok: true, value: sanitized, redactionCount: state.redactionCount };
+    }
+    catch (error) {
+        return { ok: false, reason: error instanceof BudgetExceeded ? "budget_exceeded" : "unsafe_input" };
+    }
+}

package/dist/privacy-text.d.ts

@@ -0,0 +1,3 @@
+/** Bounded caller input only. Returns stable replacement text, never the matching secret. */
+export declare function scrubCredentialText(input: string, additionalKeys: readonly string[], scanUrls?: boolean): string;
+//# sourceMappingURL=privacy-text.d.ts.map

package/dist/privacy-text.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy-text.d.ts","sourceRoot":"","sources":["../src/privacy-text.ts"],"names":[],"mappings":"AAyDA,6FAA6F;AAC7F,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,SAAS,MAAM,EAAE,EAAE,QAAQ,UAAO,GAAG,MAAM,CA2B7G"}

package/dist/privacy-text.js

@@ -0,0 +1,85 @@
+import { DEFAULT_SENSITIVE_KEYS, isSensitiveKey } from "./privacy-keys.js";
+const REDACTED = "[REDACTED]";
+const BUILTIN_LABELS = [...DEFAULT_SENSITIVE_KEYS, "client_secret", "x_api_key",
+    "accessToken", "refreshToken", "privateKey", "clientSecret"];
+const ASSIGNMENT = new RegExp(`\\b(${BUILTIN_LABELS.join("|")})\\b(["']?\\s*[:=]\\s*)(?:"[^"]*"|'[^']*'|[^\\s&,;]+)`, "gi");
+const HEADER = /\b(Authorization|Proxy-Authorization|Cookie|Set-Cookie)\s*:\s*[^\r\n]*/gi;
+const PEM = /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/gi;
+const PEM_COMPLETE = new RegExp(PEM.source, "i");
+const PEM_START = /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/i;
+const DEBUGBUNDLE_TOKEN = /\bdbundle_(?:proj|mem|probe|agent)_[A-Za-z0-9_-]+\b/g;
+const BEARER = /\b(Bearer|Basic)\s+[A-Za-z0-9._~+\/-]{6,}/gi;
+const URL_TEXT = /\bhttps?:\/\/[^\s<>"']+/gi;
+// Do not treat numeric substrings inside UUIDs, hashes, or identifier slugs as cards.
+const CARD = /(?<![A-Za-z0-9_-])(?:\d[ -]?){12,18}\d(?![A-Za-z0-9_-])/g;
+function isValidCard(value) {
+    const digits = value.replace(/[^0-9]/g, "");
+    if (digits.length < 13 || digits.length > 19 || /^(\d)\1+$/.test(digits)) {
+        return false;
+    }
+    let sum = 0;
+    for (let index = digits.length - 1; index >= 0; index -= 1) {
+        let digit = Number(digits[index]);
+        if ((digits.length - index) % 2 === 0) {
+            digit *= 2;
+            if (digit > 9)
+                digit -= 9;
+        }
+        sum += digit;
+    }
+    return sum % 10 === 0;
+}
+function scrubUrl(raw, keys) {
+    try {
+        const url = new URL(raw);
+        if (url.username || url.password) {
+            url.username = "REDACTED";
+            url.password = "";
+        }
+        const nextQuery = new URLSearchParams();
+        for (const [key, value] of url.searchParams) {
+            if (key.length > 128 || scrubCredentialText(key, keys, false) !== key)
+                continue;
+            nextQuery.append(key, isSensitiveKey(key, keys) || scrubCredentialText(value, keys, false) !== value ? REDACTED : value);
+        }
+        url.search = nextQuery.toString();
+        url.hash = "";
+        return url.toString();
+    }
+    catch {
+        // A malformed URL with a recognizable credential must not be emitted verbatim.
+        return REDACTED;
+    }
+}
+/** Bounded caller input only. Returns stable replacement text, never the matching secret. */
+export function scrubCredentialText(input, additionalKeys, scanUrls = true) {
+    const keys = [...DEFAULT_SENSITIVE_KEYS, ...additionalKeys];
+    if (PEM_START.test(input) && !PEM_COMPLETE.test(input))
+        return REDACTED;
+    let output = input;
+    if (/(?:password|token|secret|authorization|cookie)%3[ad]/i.test(output)) {
+        try {
+            output = decodeURIComponent(output);
+        }
+        catch {
+            return REDACTED;
+        }
+    }
+    output = output.replace(PEM, REDACTED).replace(HEADER, "$1: [REDACTED]");
+    output = output.replace(BEARER, "$1 [REDACTED]").replace(DEBUGBUNDLE_TOKEN, REDACTED);
+    output = output.replace(ASSIGNMENT, "$1$2[REDACTED]");
+    if (additionalKeys.length > 0) {
+        for (const key of additionalKeys) {
+            const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+            const named = new RegExp(`\\b(${escaped})\\b(["']?\\s*[:=]\\s*)(?:"[^"]*"|'[^']*'|[^\\s&,;]+)`, "gi");
+            output = output.replace(named, "$1$2[REDACTED]");
+        }
+    }
+    output = output.replace(CARD, (candidate) => isValidCard(candidate) ? REDACTED : candidate);
+    if (!scanUrls)
+        return output;
+    return output.replace(URL_TEXT, (matched) => {
+        const trailing = matched.match(/[).,;]+$/)?.[0] ?? "";
+        return scrubUrl(matched.slice(0, matched.length - trailing.length), keys) + trailing;
+    });
+}

package/dist/redaction.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAyBA,eAAO,MAAM,wBAAwB,UAQpC,CAAC;AAEF,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAE9C;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAGpF;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EAC3C,SAAS,GAAE,MAAM,EAA6B,EAC9C,OAAO,GAAE,eAAoB,GAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAaxB"}
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAOA,eAAO,MAAM,wBAAwB,UAQpC,CAAC;AAEF,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,mBAAmB,IAAI,MAAM,EAAE,CAE9C;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,GAAE,eAAoB,GAAG,OAAO,CAUpF;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,EAC3C,SAAS,GAAE,MAAM,EAA6B,EAC9C,OAAO,GAAE,eAAoB,GAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAaxB"}

package/dist/redaction.js

@@ -1,26 +1,7 @@
+import { DEFAULT_SENSITIVE_KEYS, isSensitiveKey as privacySensitiveKey } from "./privacy-keys.js";
+import { sanitizeTelemetry } from "./privacy-telemetry.js";
 const DEFAULT_REDACT_FIELDS = [
-    "password",
-    "secret",
-    "token",
-    "api_key",
-    "apikey",
-    "access_token",
-    "refresh_token",
-    "private_key",
-    "passwd",
-    "card_number",
-    "cvv",
-    "cvc",
-    "pin",
-    "expiry",
-    "phone",
-    "bearer",
-    "session_id",
-    "otp",
-    "verification_code",
-    "authorization",
-    "cookie",
-    "ssn"
+    ...DEFAULT_SENSITIVE_KEYS
 ];
 export const DEFAULT_HEADER_ALLOWLIST = [
     "user-agent",
@@ -35,8 +16,16 @@ export function defaultRedactFields() {
     return [...DEFAULT_REDACT_FIELDS];
 }
 export function sanitizeValue(value, options = {}) {
-    const visited = new WeakSet();
-    return sanitize(value, normalizeOptions(options), 0, visited, undefined);
+    try {
+        const normalized = normalizeOptions(options);
+        const visited = new WeakSet();
+        const prepared = sanitize(value, normalized, 0, visited, undefined);
+        const protectedValue = sanitizeTelemetry(prepared, { additionalKeys: options.redactFields ?? [] });
+        return protectedValue.ok ? protectedValue.value : "[REDACTED]";
+    }
+    catch {
+        return "[REDACTED]";
+    }
 }
 export function sanitizeHeaders(headers, allowlist = DEFAULT_HEADER_ALLOWLIST, options = {}) {
     if (!headers) {
@@ -54,7 +43,7 @@ export function sanitizeHeaders(headers, allowlist = DEFAULT_HEADER_ALLOWLIST, o
 }
 function normalizeOptions(options) {
     return {
-        redactFields: options.redactFields ?? DEFAULT_REDACT_FIELDS,
+        redactFields: [...DEFAULT_REDACT_FIELDS, ...(options.redactFields ?? [])],
         maxDepth: options.maxDepth ?? 8,
         maxStringLength: options.maxStringLength ?? 2048,
         maxArrayLength: options.maxArrayLength ?? 50,
@@ -63,13 +52,13 @@ function normalizeOptions(options) {
 }
 function sanitize(value, options, depth, visited, key) {
     if (key && isSensitiveKey(key, options.redactFields)) {
-        return "[Redacted]";
+        return "[REDACTED]";
     }
     if (value === null || value === undefined) {
         return value ?? null;
     }
     if (typeof value === "string") {
-        return truncate(value, options.maxStringLength);
+        return truncate(value, options.maxStringLength, options.redactFields);
     }
     if (typeof value === "number" || typeof value === "boolean") {
         return value;
@@ -106,27 +95,22 @@ function sanitize(value, options, depth, visited, key) {
 }
 function sanitizeError(error, options, depth, visited) {
     return {
-        name: truncate(error.name || "Error", options.maxStringLength),
-        message: truncate(error.message || "", options.maxStringLength),
-        stack: typeof error.stack === "string" ? truncate(error.stack, options.maxStringLength * 4) : null,
+        name: truncate(error.name || "Error", options.maxStringLength, options.redactFields),
+        message: truncate(error.message || "", options.maxStringLength, options.redactFields),
+        stack: typeof error.stack === "string" ? truncate(error.stack, options.maxStringLength * 4, options.redactFields) : null,
         cause: "cause" in error ? sanitize(error.cause, options, depth + 1, visited, "cause") : null
     };
 }
-function truncate(value, maxLength) {
-    if (value.length <= maxLength) {
-        return value;
-    }
-    return `${value.slice(0, maxLength)}...[Truncated]`;
+function truncate(value, maxLength, fields) {
+    if (value.length > 16 * 1024)
+        return "[REDACTED]";
+    const safe = sanitizeTelemetry(value, { additionalKeys: fields });
+    if (!safe.ok || typeof safe.value !== "string")
+        return "[REDACTED]";
+    if (safe.value.length <= maxLength)
+        return safe.value;
+    return `${safe.value.slice(0, maxLength)}...[Truncated]`;
 }
 function isSensitiveKey(key, sensitiveFields) {
-    const segments = splitKey(key);
-    const sensitive = new Set(sensitiveFields.flatMap(splitKey));
-    return segments.some((segment) => sensitive.has(segment));
-}
-function splitKey(key) {
-    return key
-        .replace(/([a-z0-9])([A-Z])/g, "$1_$2")
-        .split(/[^a-zA-Z0-9]+/)
-        .map((segment) => segment.toLowerCase())
-        .filter(Boolean);
+    return privacySensitiveKey(key, [...DEFAULT_SENSITIVE_KEYS, ...sensitiveFields]);
 }

package/ios/DebugBundleReactNative.swift

@@ -4,7 +4,7 @@ import DebugBundle
 
 @objc(DebugBundleReactNative)
 final class DebugBundleReactNative: NSObject {
-	private var currentSDKVersion = "1.3.0"
+	private var currentSDKVersion = "3.0.0"
 	private var currentService = "react-native-app"
 	private var currentEnvironment = "production"
 
@@ -14,7 +14,7 @@ final class DebugBundleReactNative: NSObject {
 		resolver resolve: @escaping RCTPromiseResolveBlock,
 		rejecter reject: @escaping RCTPromiseRejectBlock
 	) {
-		currentSDKVersion = config["sdkVersion"] as? String ?? "1.3.0"
+		currentSDKVersion = config["sdkVersion"] as? String ?? "3.0.0"
 		currentService = config["service"] as? String ?? "react-native-app"
 		currentEnvironment = config["environment"] as? String ?? "production"
 		let sdkConfig = DebugBundleConfig(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@debugbundle/sdk-react-native",
-  "version": "1.3.0",
+  "version": "3.0.0",
   "description": "React Native SDK for DebugBundle mobile event capture.",
   "license": "Apache-2.0",
   "type": "module",
@@ -41,14 +41,15 @@
   },
   "files": [
     "android/build.gradle",
-    "android/src",
+    "android/src/main",
     "ios",
     "src",
     "dist",
     "app.plugin.js",
     "DebugBundleReactNative.podspec",
     "CHANGELOG.md",
-    "README.md"
+    "README.md",
+    "MIGRATION-3.0.md"
   ],
   "exports": {
     "./package.json": "./package.json",
@@ -104,9 +105,9 @@
   },
   "devDependencies": {
     "@types/react": "^19.1.2",
-    "@vitest/coverage-v8": "^4.1.2",
+    "@vitest/coverage-v8": "^4.1.11",
     "react": "^19.2.4",
     "typescript": "^6.0.2",
-    "vitest": "^4.1.2"
+    "vitest": "^4.1.11"
   }
 }

package/src/before-send.ts

@@ -50,6 +50,12 @@ export function applyBeforeSend(
   }
   try {
     const result = hook(cloneEvent(event));
+    // Hooks have synchronous return contracts. Contain mistaken async failures
+    // before treating their Promise as invalid and keeping the protected original.
+    if (result instanceof Promise) {
+      void result.catch(() => undefined);
+      return event;
+    }
     if (result === null) {
       return null;
     }