@hyperbridge/simplex 0.17.1 → 0.18.0

package/dist/error-reporting.cjs

@@ -0,0 +1,123 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/config/error-reporting.ts
+var error_reporting_exports = {};
+__export(error_reporting_exports, {
+  ERROR_REPORTING_ENV: () => ERROR_REPORTING_ENV,
+  errorReportingDisabled: () => errorReportingDisabled,
+  scrubBreadcrumb: () => scrubBreadcrumb,
+  scrubEvent: () => scrubEvent,
+  scrubText: () => scrubText,
+  sentryIngestOrigin: () => sentryIngestOrigin
+});
+module.exports = __toCommonJS(error_reporting_exports);
+var import_english = require("@scure/bip39/wordlists/english");
+var ERROR_REPORTING_ENV = "SIMPLEX_ERROR_REPORTING";
+function errorReportingDisabled(value) {
+  return ["off", "0", "false", "no"].includes((value ?? "").trim().toLowerCase());
+}
+function sentryIngestOrigin(dsn) {
+  try {
+    const url = new URL(dsn);
+    return url.protocol === "https:" ? url.origin : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var MNEMONIC_WORDS = new Set(import_english.wordlist);
+var MNEMONIC_MIN_WORDS = 12;
+var REDACTED = "[redacted]";
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "local"]);
+var URL_PATTERN = /\b(?:https?|wss?|simplex|file):\/\/[^\s"'<>`]+/i;
+var FILE_PATH_PATTERN = /(?<=["'])(?:[a-z]:[\\/]|\\\\|\/)[^"'<>`\r\n]+|(?:[a-z]:[\\/]|\\\\|(?<![\w/])\/)[^\s"'<>`]+/;
+var LOCATION_PATTERN = new RegExp(`${URL_PATTERN.source}|${FILE_PATH_PATTERN.source}`, "gi");
+var WORD_RUN_PATTERN = /\b[a-z]+(?:[\s"',\[\]]+[a-z]+){11,}\b/gi;
+var LONG_TOKEN_PATTERN = /[A-Za-z0-9+/_=-]{32,}/g;
+var ADDRESS_PATTERN = /^0x[0-9a-fA-F]{40}$/;
+function scrubUrl(raw) {
+  try {
+    const url = new URL(raw);
+    if (url.protocol === "file:") return REDACTED;
+    const path = LOOPBACK_HOSTS.has(url.hostname) ? url.pathname : url.pathname === "/" ? "" : `/${REDACTED}`;
+    return `${url.protocol}//${url.host}${path}${url.search || url.hash ? `?${REDACTED}` : ""}`;
+  } catch {
+    return REDACTED;
+  }
+}
+function containsMnemonic(run) {
+  let consecutive = 0;
+  for (const word of run.toLowerCase().split(/[\s"',\[\]]+/)) {
+    consecutive = MNEMONIC_WORDS.has(word) ? consecutive + 1 : 0;
+    if (consecutive >= MNEMONIC_MIN_WORDS) return true;
+  }
+  return false;
+}
+function scrubText(text) {
+  const withoutUrls = text.replace(
+    LOCATION_PATTERN,
+    (location) => URL_PATTERN.test(location) ? scrubUrl(location) : REDACTED
+  );
+  const withoutMnemonics = withoutUrls.replace(WORD_RUN_PATTERN, (run) => containsMnemonic(run) ? REDACTED : run);
+  return withoutMnemonics.replace(LONG_TOKEN_PATTERN, (token) => ADDRESS_PATTERN.test(token) ? token : REDACTED);
+}
+function scrubBreadcrumb(breadcrumb) {
+  if (breadcrumb.message) breadcrumb.message = scrubText(breadcrumb.message);
+  if (breadcrumb.data) breadcrumb.data = scrubDeep(breadcrumb.data);
+  return breadcrumb;
+}
+function scrubEvent(event) {
+  if (event.message) event.message = scrubText(event.message);
+  if (event.logentry) event.logentry = scrubDeep(event.logentry);
+  for (const exception of event.exception?.values ?? []) {
+    if (exception.value) exception.value = scrubText(exception.value);
+  }
+  for (const breadcrumb of event.breadcrumbs ?? []) scrubBreadcrumb(breadcrumb);
+  if (event.extra) event.extra = scrubDeep(event.extra);
+  if (event.request) {
+    if (event.request.url) event.request.url = scrubText(event.request.url);
+    delete event.request.query_string;
+    delete event.request.data;
+    delete event.request.cookies;
+    const userAgent = event.request.headers?.["User-Agent"];
+    event.request.headers = userAgent ? { "User-Agent": userAgent } : void 0;
+  }
+  return event;
+}
+function scrubDeep(value, seen = /* @__PURE__ */ new WeakSet()) {
+  if (typeof value === "string") return scrubText(value);
+  if (!value || typeof value !== "object") return value;
+  if (seen.has(value)) return REDACTED;
+  seen.add(value);
+  if (Array.isArray(value)) {
+    if (containsMnemonic(value.map((item) => typeof item === "string" ? item : "").join(" "))) return REDACTED;
+    return value.map((item) => scrubDeep(item, seen));
+  }
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, scrubDeep(item, seen)]));
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ERROR_REPORTING_ENV,
+  errorReportingDisabled,
+  scrubBreadcrumb,
+  scrubEvent,
+  scrubText,
+  sentryIngestOrigin
+});
+//# sourceMappingURL=error-reporting.cjs.map

package/dist/error-reporting.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config/error-reporting.ts"],"sourcesContent":["import { wordlist } from \"@scure/bip39/wordlists/english\"\n\n/**\n * Error reporting shared by the web UI and the desktop shell. Builds only report\n * when CI baked a Sentry DSN into them; operators opt out with\n * `SIMPLEX_ERROR_REPORTING=off`. Everything here is browser-safe.\n */\nexport const ERROR_REPORTING_ENV = \"SIMPLEX_ERROR_REPORTING\"\n\nexport function errorReportingDisabled(value: string | undefined): boolean {\n\treturn [\"off\", \"0\", \"false\", \"no\"].includes((value ?? \"\").trim().toLowerCase())\n}\n\n/** The ingest origin a renderer CSP must allow for this DSN, or undefined for a malformed one. */\nexport function sentryIngestOrigin(dsn: string): string | undefined {\n\ttry {\n\t\tconst url = new URL(dsn)\n\t\treturn url.protocol === \"https:\" ? url.origin : undefined\n\t} catch {\n\t\treturn undefined\n\t}\n}\n\nconst MNEMONIC_WORDS = new Set(wordlist)\nconst MNEMONIC_MIN_WORDS = 12\nconst REDACTED = \"[redacted]\"\nconst LOOPBACK_HOSTS = new Set([\"localhost\", \"127.0.0.1\", \"[::1]\", \"local\"])\nconst URL_PATTERN = /\\b(?:https?|wss?|simplex|file):\\/\\/[^\\s\"'<>`]+/i\n// Quoted paths may contain spaces. Match URLs first so local API routes remain readable.\nconst FILE_PATH_PATTERN = /(?<=[\"'])(?:[a-z]:[\\\\/]|\\\\\\\\|\\/)[^\"'<>`\\r\\n]+|(?:[a-z]:[\\\\/]|\\\\\\\\|(?<![\\w/])\\/)[^\\s\"'<>`]+/\nconst LOCATION_PATTERN = new RegExp(`${URL_PATTERN.source}|${FILE_PATH_PATTERN.source}`, \"gi\")\n// Also catches phrases rendered as JSON word arrays or comma-separated words.\nconst WORD_RUN_PATTERN = /\\b[a-z]+(?:[\\s\"',\\[\\]]+[a-z]+){11,}\\b/gi\n// Private keys, signatures, API tokens, base58/base64 secrets and long file paths\n// (which name the operator's home directory). A 0x address stays readable.\nconst LONG_TOKEN_PATTERN = /[A-Za-z0-9+/_=-]{32,}/g\nconst ADDRESS_PATTERN = /^0x[0-9a-fA-F]{40}$/\n\nfunction scrubUrl(raw: string): string {\n\ttry {\n\t\tconst url = new URL(raw)\n\t\tif (url.protocol === \"file:\") return REDACTED\n\t\t// RPC providers carry API keys in the path or query; local solver routes do not.\n\t\tconst path = LOOPBACK_HOSTS.has(url.hostname) ? url.pathname : url.pathname === \"/\" ? \"\" : `/${REDACTED}`\n\t\treturn `${url.protocol}//${url.host}${path}${url.search || url.hash ? `?${REDACTED}` : \"\"}`\n\t} catch {\n\t\treturn REDACTED\n\t}\n}\n\nfunction containsMnemonic(run: string): boolean {\n\tlet consecutive = 0\n\tfor (const word of run.toLowerCase().split(/[\\s\"',\\[\\]]+/)) {\n\t\tconsecutive = MNEMONIC_WORDS.has(word) ? consecutive + 1 : 0\n\t\tif (consecutive >= MNEMONIC_MIN_WORDS) return true\n\t}\n\treturn false\n}\n\n/** Removes recovery phrases, key material and provider URLs from one string. */\nexport function scrubText(text: string): string {\n\tconst withoutUrls = text.replace(LOCATION_PATTERN, (location) =>\n\t\tURL_PATTERN.test(location) ? scrubUrl(location) : REDACTED,\n\t)\n\tconst withoutMnemonics = withoutUrls.replace(WORD_RUN_PATTERN, (run) => (containsMnemonic(run) ? REDACTED : run))\n\treturn withoutMnemonics.replace(LONG_TOKEN_PATTERN, (token) => (ADDRESS_PATTERN.test(token) ? token : REDACTED))\n}\n\ninterface ScrubbableBreadcrumb {\n\tmessage?: string\n\tdata?: Record<string, unknown>\n}\n\ninterface ScrubbableEvent {\n\tmessage?: string\n\tlogentry?: { message?: string; params?: unknown[] }\n\texception?: { values?: Array<{ value?: string }> }\n\tbreadcrumbs?: ScrubbableBreadcrumb[]\n\textra?: Record<string, unknown>\n\trequest?: {\n\t\turl?: string\n\t\tquery_string?: unknown\n\t\tdata?: unknown\n\t\tcookies?: unknown\n\t\theaders?: Record<string, string>\n\t}\n}\n\n/** Scrubs a breadcrumb's message and data in place. */\nexport function scrubBreadcrumb<T extends ScrubbableBreadcrumb>(breadcrumb: T): T {\n\tif (breadcrumb.message) breadcrumb.message = scrubText(breadcrumb.message)\n\tif (breadcrumb.data) breadcrumb.data = scrubDeep(breadcrumb.data) as Record<string, unknown>\n\treturn breadcrumb\n}\n\n/**\n * Scrubs the free-text parts of an event in place. Identifiers (event and\n * trace ids), release names and stack frames stay intact so Sentry can group\n * the event and resolve uploaded source maps.\n */\nexport function scrubEvent<T extends ScrubbableEvent>(event: T): T {\n\tif (event.message) event.message = scrubText(event.message)\n\tif (event.logentry) event.logentry = scrubDeep(event.logentry) as ScrubbableEvent[\"logentry\"]\n\tfor (const exception of event.exception?.values ?? []) {\n\t\tif (exception.value) exception.value = scrubText(exception.value)\n\t}\n\tfor (const breadcrumb of event.breadcrumbs ?? []) scrubBreadcrumb(breadcrumb)\n\tif (event.extra) event.extra = scrubDeep(event.extra) as Record<string, unknown>\n\tif (event.request) {\n\t\tif (event.request.url) event.request.url = scrubText(event.request.url)\n\t\tdelete event.request.query_string\n\t\tdelete event.request.data\n\t\tdelete event.request.cookies\n\t\t// Sentry derives the browser and OS from the user agent; no other header is needed.\n\t\tconst userAgent = event.request.headers?.[\"User-Agent\"]\n\t\tevent.request.headers = userAgent ? { \"User-Agent\": userAgent } : undefined\n\t}\n\treturn event\n}\n\nfunction scrubDeep(value: unknown, seen = new WeakSet<object>()): unknown {\n\tif (typeof value === \"string\") return scrubText(value)\n\tif (!value || typeof value !== \"object\") return value\n\tif (seen.has(value)) return REDACTED\n\tseen.add(value)\n\tif (Array.isArray(value)) {\n\t\tif (containsMnemonic(value.map((item) => (typeof item === \"string\" ? item : \"\")).join(\" \"))) return REDACTED\n\t\treturn value.map((item) => scrubDeep(item, seen))\n\t}\n\treturn Object.fromEntries(Object.entries(value).map(([key, item]) => [key, scrubDeep(item, seen)]))\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,qBAAyB;AAOlB,IAAM,sBAAsB;AAE5B,SAAS,uBAAuB,OAAoC;AAC1E,SAAO,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,UAAU,SAAS,IAAI,KAAK,EAAE,YAAY,CAAC;AAC/E;AAGO,SAAS,mBAAmB,KAAiC;AACnE,MAAI;AACH,UAAM,MAAM,IAAI,IAAI,GAAG;AACvB,WAAO,IAAI,aAAa,WAAW,IAAI,SAAS;AAAA,EACjD,QAAQ;AACP,WAAO;AAAA,EACR;AACD;AAEA,IAAM,iBAAiB,IAAI,IAAI,uBAAQ;AACvC,IAAM,qBAAqB;AAC3B,IAAM,WAAW;AACjB,IAAM,iBAAiB,oBAAI,IAAI,CAAC,aAAa,aAAa,SAAS,OAAO,CAAC;AAC3E,IAAM,cAAc;AAEpB,IAAM,oBAAoB;AAC1B,IAAM,mBAAmB,IAAI,OAAO,GAAG,YAAY,MAAM,IAAI,kBAAkB,MAAM,IAAI,IAAI;AAE7F,IAAM,mBAAmB;AAGzB,IAAM,qBAAqB;AAC3B,IAAM,kBAAkB;AAExB,SAAS,SAAS,KAAqB;AACtC,MAAI;AACH,UAAM,MAAM,IAAI,IAAI,GAAG;AACvB,QAAI,IAAI,aAAa,QAAS,QAAO;AAErC,UAAM,OAAO,eAAe,IAAI,IAAI,QAAQ,IAAI,IAAI,WAAW,IAAI,aAAa,MAAM,KAAK,IAAI,QAAQ;AACvG,WAAO,GAAG,IAAI,QAAQ,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,IAAI,UAAU,IAAI,OAAO,IAAI,QAAQ,KAAK,EAAE;AAAA,EAC1F,QAAQ;AACP,WAAO;AAAA,EACR;AACD;AAEA,SAAS,iBAAiB,KAAsB;AAC/C,MAAI,cAAc;AAClB,aAAW,QAAQ,IAAI,YAAY,EAAE,MAAM,cAAc,GAAG;AAC3D,kBAAc,eAAe,IAAI,IAAI,IAAI,cAAc,IAAI;AAC3D,QAAI,eAAe,mBAAoB,QAAO;AAAA,EAC/C;AACA,SAAO;AACR;AAGO,SAAS,UAAU,MAAsB;AAC/C,QAAM,cAAc,KAAK;AAAA,IAAQ;AAAA,IAAkB,CAAC,aACnD,YAAY,KAAK,QAAQ,IAAI,SAAS,QAAQ,IAAI;AAAA,EACnD;AACA,QAAM,mBAAmB,YAAY,QAAQ,kBAAkB,CAAC,QAAS,iBAAiB,GAAG,IAAI,WAAW,GAAI;AAChH,SAAO,iBAAiB,QAAQ,oBAAoB,CAAC,UAAW,gBAAgB,KAAK,KAAK,IAAI,QAAQ,QAAS;AAChH;AAuBO,SAAS,gBAAgD,YAAkB;AACjF,MAAI,WAAW,QAAS,YAAW,UAAU,UAAU,WAAW,OAAO;AACzE,MAAI,WAAW,KAAM,YAAW,OAAO,UAAU,WAAW,IAAI;AAChE,SAAO;AACR;AAOO,SAAS,WAAsC,OAAa;AAClE,MAAI,MAAM,QAAS,OAAM,UAAU,UAAU,MAAM,OAAO;AAC1D,MAAI,MAAM,SAAU,OAAM,WAAW,UAAU,MAAM,QAAQ;AAC7D,aAAW,aAAa,MAAM,WAAW,UAAU,CAAC,GAAG;AACtD,QAAI,UAAU,MAAO,WAAU,QAAQ,UAAU,UAAU,KAAK;AAAA,EACjE;AACA,aAAW,cAAc,MAAM,eAAe,CAAC,EAAG,iBAAgB,UAAU;AAC5E,MAAI,MAAM,MAAO,OAAM,QAAQ,UAAU,MAAM,KAAK;AACpD,MAAI,MAAM,SAAS;AAClB,QAAI,MAAM,QAAQ,IAAK,OAAM,QAAQ,MAAM,UAAU,MAAM,QAAQ,GAAG;AACtE,WAAO,MAAM,QAAQ;AACrB,WAAO,MAAM,QAAQ;AACrB,WAAO,MAAM,QAAQ;AAErB,UAAM,YAAY,MAAM,QAAQ,UAAU,YAAY;AACtD,UAAM,QAAQ,UAAU,YAAY,EAAE,cAAc,UAAU,IAAI;AAAA,EACnE;AACA,SAAO;AACR;AAEA,SAAS,UAAU,OAAgB,OAAO,oBAAI,QAAgB,GAAY;AACzE,MAAI,OAAO,UAAU,SAAU,QAAO,UAAU,KAAK;AACrD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,MAAI,KAAK,IAAI,KAAK,EAAG,QAAO;AAC5B,OAAK,IAAI,KAAK;AACd,MAAI,MAAM,QAAQ,KAAK,GAAG;AACzB,QAAI,iBAAiB,MAAM,IAAI,CAAC,SAAU,OAAO,SAAS,WAAW,OAAO,EAAG,EAAE,KAAK,GAAG,CAAC,EAAG,QAAO;AACpG,WAAO,MAAM,IAAI,CAAC,SAAS,UAAU,MAAM,IAAI,CAAC;AAAA,EACjD;AACA,SAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,UAAU,MAAM,IAAI,CAAC,CAAC,CAAC;AACnG;","names":[]}

package/dist/error-reporting.d.cts

@@ -0,0 +1,46 @@
+/**
+ * Error reporting shared by the web UI and the desktop shell. Builds only report
+ * when CI baked a Sentry DSN into them; operators opt out with
+ * `SIMPLEX_ERROR_REPORTING=off`. Everything here is browser-safe.
+ */
+declare const ERROR_REPORTING_ENV = "SIMPLEX_ERROR_REPORTING";
+declare function errorReportingDisabled(value: string | undefined): boolean;
+/** The ingest origin a renderer CSP must allow for this DSN, or undefined for a malformed one. */
+declare function sentryIngestOrigin(dsn: string): string | undefined;
+/** Removes recovery phrases, key material and provider URLs from one string. */
+declare function scrubText(text: string): string;
+interface ScrubbableBreadcrumb {
+    message?: string;
+    data?: Record<string, unknown>;
+}
+interface ScrubbableEvent {
+    message?: string;
+    logentry?: {
+        message?: string;
+        params?: unknown[];
+    };
+    exception?: {
+        values?: Array<{
+            value?: string;
+        }>;
+    };
+    breadcrumbs?: ScrubbableBreadcrumb[];
+    extra?: Record<string, unknown>;
+    request?: {
+        url?: string;
+        query_string?: unknown;
+        data?: unknown;
+        cookies?: unknown;
+        headers?: Record<string, string>;
+    };
+}
+/** Scrubs a breadcrumb's message and data in place. */
+declare function scrubBreadcrumb<T extends ScrubbableBreadcrumb>(breadcrumb: T): T;
+/**
+ * Scrubs the free-text parts of an event in place. Identifiers (event and
+ * trace ids), release names and stack frames stay intact so Sentry can group
+ * the event and resolve uploaded source maps.
+ */
+declare function scrubEvent<T extends ScrubbableEvent>(event: T): T;
+
+export { ERROR_REPORTING_ENV, errorReportingDisabled, scrubBreadcrumb, scrubEvent, scrubText, sentryIngestOrigin };

package/dist/error-reporting.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Error reporting shared by the web UI and the desktop shell. Builds only report
+ * when CI baked a Sentry DSN into them; operators opt out with
+ * `SIMPLEX_ERROR_REPORTING=off`. Everything here is browser-safe.
+ */
+declare const ERROR_REPORTING_ENV = "SIMPLEX_ERROR_REPORTING";
+declare function errorReportingDisabled(value: string | undefined): boolean;
+/** The ingest origin a renderer CSP must allow for this DSN, or undefined for a malformed one. */
+declare function sentryIngestOrigin(dsn: string): string | undefined;
+/** Removes recovery phrases, key material and provider URLs from one string. */
+declare function scrubText(text: string): string;
+interface ScrubbableBreadcrumb {
+    message?: string;
+    data?: Record<string, unknown>;
+}
+interface ScrubbableEvent {
+    message?: string;
+    logentry?: {
+        message?: string;
+        params?: unknown[];
+    };
+    exception?: {
+        values?: Array<{
+            value?: string;
+        }>;
+    };
+    breadcrumbs?: ScrubbableBreadcrumb[];
+    extra?: Record<string, unknown>;
+    request?: {
+        url?: string;
+        query_string?: unknown;
+        data?: unknown;
+        cookies?: unknown;
+        headers?: Record<string, string>;
+    };
+}
+/** Scrubs a breadcrumb's message and data in place. */
+declare function scrubBreadcrumb<T extends ScrubbableBreadcrumb>(breadcrumb: T): T;
+/**
+ * Scrubs the free-text parts of an event in place. Identifiers (event and
+ * trace ids), release names and stack frames stay intact so Sentry can group
+ * the event and resolve uploaded source maps.
+ */
+declare function scrubEvent<T extends ScrubbableEvent>(event: T): T;
+
+export { ERROR_REPORTING_ENV, errorReportingDisabled, scrubBreadcrumb, scrubEvent, scrubText, sentryIngestOrigin };

package/dist/error-reporting.js

@@ -0,0 +1,95 @@
+import { createRequire } from 'module'; const require = createRequire(import.meta.url);
+
+// src/config/error-reporting.ts
+import { wordlist } from "@scure/bip39/wordlists/english";
+var ERROR_REPORTING_ENV = "SIMPLEX_ERROR_REPORTING";
+function errorReportingDisabled(value) {
+  return ["off", "0", "false", "no"].includes((value ?? "").trim().toLowerCase());
+}
+function sentryIngestOrigin(dsn) {
+  try {
+    const url = new URL(dsn);
+    return url.protocol === "https:" ? url.origin : void 0;
+  } catch {
+    return void 0;
+  }
+}
+var MNEMONIC_WORDS = new Set(wordlist);
+var MNEMONIC_MIN_WORDS = 12;
+var REDACTED = "[redacted]";
+var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "local"]);
+var URL_PATTERN = /\b(?:https?|wss?|simplex|file):\/\/[^\s"'<>`]+/i;
+var FILE_PATH_PATTERN = /(?<=["'])(?:[a-z]:[\\/]|\\\\|\/)[^"'<>`\r\n]+|(?:[a-z]:[\\/]|\\\\|(?<![\w/])\/)[^\s"'<>`]+/;
+var LOCATION_PATTERN = new RegExp(`${URL_PATTERN.source}|${FILE_PATH_PATTERN.source}`, "gi");
+var WORD_RUN_PATTERN = /\b[a-z]+(?:[\s"',\[\]]+[a-z]+){11,}\b/gi;
+var LONG_TOKEN_PATTERN = /[A-Za-z0-9+/_=-]{32,}/g;
+var ADDRESS_PATTERN = /^0x[0-9a-fA-F]{40}$/;
+function scrubUrl(raw) {
+  try {
+    const url = new URL(raw);
+    if (url.protocol === "file:") return REDACTED;
+    const path = LOOPBACK_HOSTS.has(url.hostname) ? url.pathname : url.pathname === "/" ? "" : `/${REDACTED}`;
+    return `${url.protocol}//${url.host}${path}${url.search || url.hash ? `?${REDACTED}` : ""}`;
+  } catch {
+    return REDACTED;
+  }
+}
+function containsMnemonic(run) {
+  let consecutive = 0;
+  for (const word of run.toLowerCase().split(/[\s"',\[\]]+/)) {
+    consecutive = MNEMONIC_WORDS.has(word) ? consecutive + 1 : 0;
+    if (consecutive >= MNEMONIC_MIN_WORDS) return true;
+  }
+  return false;
+}
+function scrubText(text) {
+  const withoutUrls = text.replace(
+    LOCATION_PATTERN,
+    (location) => URL_PATTERN.test(location) ? scrubUrl(location) : REDACTED
+  );
+  const withoutMnemonics = withoutUrls.replace(WORD_RUN_PATTERN, (run) => containsMnemonic(run) ? REDACTED : run);
+  return withoutMnemonics.replace(LONG_TOKEN_PATTERN, (token) => ADDRESS_PATTERN.test(token) ? token : REDACTED);
+}
+function scrubBreadcrumb(breadcrumb) {
+  if (breadcrumb.message) breadcrumb.message = scrubText(breadcrumb.message);
+  if (breadcrumb.data) breadcrumb.data = scrubDeep(breadcrumb.data);
+  return breadcrumb;
+}
+function scrubEvent(event) {
+  if (event.message) event.message = scrubText(event.message);
+  if (event.logentry) event.logentry = scrubDeep(event.logentry);
+  for (const exception of event.exception?.values ?? []) {
+    if (exception.value) exception.value = scrubText(exception.value);
+  }
+  for (const breadcrumb of event.breadcrumbs ?? []) scrubBreadcrumb(breadcrumb);
+  if (event.extra) event.extra = scrubDeep(event.extra);
+  if (event.request) {
+    if (event.request.url) event.request.url = scrubText(event.request.url);
+    delete event.request.query_string;
+    delete event.request.data;
+    delete event.request.cookies;
+    const userAgent = event.request.headers?.["User-Agent"];
+    event.request.headers = userAgent ? { "User-Agent": userAgent } : void 0;
+  }
+  return event;
+}
+function scrubDeep(value, seen = /* @__PURE__ */ new WeakSet()) {
+  if (typeof value === "string") return scrubText(value);
+  if (!value || typeof value !== "object") return value;
+  if (seen.has(value)) return REDACTED;
+  seen.add(value);
+  if (Array.isArray(value)) {
+    if (containsMnemonic(value.map((item) => typeof item === "string" ? item : "").join(" "))) return REDACTED;
+    return value.map((item) => scrubDeep(item, seen));
+  }
+  return Object.fromEntries(Object.entries(value).map(([key, item]) => [key, scrubDeep(item, seen)]));
+}
+export {
+  ERROR_REPORTING_ENV,
+  errorReportingDisabled,
+  scrubBreadcrumb,
+  scrubEvent,
+  scrubText,
+  sentryIngestOrigin
+};
+//# sourceMappingURL=error-reporting.js.map

package/dist/error-reporting.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config/error-reporting.ts"],"sourcesContent":["import { wordlist } from \"@scure/bip39/wordlists/english\"\n\n/**\n * Error reporting shared by the web UI and the desktop shell. Builds only report\n * when CI baked a Sentry DSN into them; operators opt out with\n * `SIMPLEX_ERROR_REPORTING=off`. Everything here is browser-safe.\n */\nexport const ERROR_REPORTING_ENV = \"SIMPLEX_ERROR_REPORTING\"\n\nexport function errorReportingDisabled(value: string | undefined): boolean {\n\treturn [\"off\", \"0\", \"false\", \"no\"].includes((value ?? \"\").trim().toLowerCase())\n}\n\n/** The ingest origin a renderer CSP must allow for this DSN, or undefined for a malformed one. */\nexport function sentryIngestOrigin(dsn: string): string | undefined {\n\ttry {\n\t\tconst url = new URL(dsn)\n\t\treturn url.protocol === \"https:\" ? url.origin : undefined\n\t} catch {\n\t\treturn undefined\n\t}\n}\n\nconst MNEMONIC_WORDS = new Set(wordlist)\nconst MNEMONIC_MIN_WORDS = 12\nconst REDACTED = \"[redacted]\"\nconst LOOPBACK_HOSTS = new Set([\"localhost\", \"127.0.0.1\", \"[::1]\", \"local\"])\nconst URL_PATTERN = /\\b(?:https?|wss?|simplex|file):\\/\\/[^\\s\"'<>`]+/i\n// Quoted paths may contain spaces. Match URLs first so local API routes remain readable.\nconst FILE_PATH_PATTERN = /(?<=[\"'])(?:[a-z]:[\\\\/]|\\\\\\\\|\\/)[^\"'<>`\\r\\n]+|(?:[a-z]:[\\\\/]|\\\\\\\\|(?<![\\w/])\\/)[^\\s\"'<>`]+/\nconst LOCATION_PATTERN = new RegExp(`${URL_PATTERN.source}|${FILE_PATH_PATTERN.source}`, \"gi\")\n// Also catches phrases rendered as JSON word arrays or comma-separated words.\nconst WORD_RUN_PATTERN = /\\b[a-z]+(?:[\\s\"',\\[\\]]+[a-z]+){11,}\\b/gi\n// Private keys, signatures, API tokens, base58/base64 secrets and long file paths\n// (which name the operator's home directory). A 0x address stays readable.\nconst LONG_TOKEN_PATTERN = /[A-Za-z0-9+/_=-]{32,}/g\nconst ADDRESS_PATTERN = /^0x[0-9a-fA-F]{40}$/\n\nfunction scrubUrl(raw: string): string {\n\ttry {\n\t\tconst url = new URL(raw)\n\t\tif (url.protocol === \"file:\") return REDACTED\n\t\t// RPC providers carry API keys in the path or query; local solver routes do not.\n\t\tconst path = LOOPBACK_HOSTS.has(url.hostname) ? url.pathname : url.pathname === \"/\" ? \"\" : `/${REDACTED}`\n\t\treturn `${url.protocol}//${url.host}${path}${url.search || url.hash ? `?${REDACTED}` : \"\"}`\n\t} catch {\n\t\treturn REDACTED\n\t}\n}\n\nfunction containsMnemonic(run: string): boolean {\n\tlet consecutive = 0\n\tfor (const word of run.toLowerCase().split(/[\\s\"',\\[\\]]+/)) {\n\t\tconsecutive = MNEMONIC_WORDS.has(word) ? consecutive + 1 : 0\n\t\tif (consecutive >= MNEMONIC_MIN_WORDS) return true\n\t}\n\treturn false\n}\n\n/** Removes recovery phrases, key material and provider URLs from one string. */\nexport function scrubText(text: string): string {\n\tconst withoutUrls = text.replace(LOCATION_PATTERN, (location) =>\n\t\tURL_PATTERN.test(location) ? scrubUrl(location) : REDACTED,\n\t)\n\tconst withoutMnemonics = withoutUrls.replace(WORD_RUN_PATTERN, (run) => (containsMnemonic(run) ? REDACTED : run))\n\treturn withoutMnemonics.replace(LONG_TOKEN_PATTERN, (token) => (ADDRESS_PATTERN.test(token) ? token : REDACTED))\n}\n\ninterface ScrubbableBreadcrumb {\n\tmessage?: string\n\tdata?: Record<string, unknown>\n}\n\ninterface ScrubbableEvent {\n\tmessage?: string\n\tlogentry?: { message?: string; params?: unknown[] }\n\texception?: { values?: Array<{ value?: string }> }\n\tbreadcrumbs?: ScrubbableBreadcrumb[]\n\textra?: Record<string, unknown>\n\trequest?: {\n\t\turl?: string\n\t\tquery_string?: unknown\n\t\tdata?: unknown\n\t\tcookies?: unknown\n\t\theaders?: Record<string, string>\n\t}\n}\n\n/** Scrubs a breadcrumb's message and data in place. */\nexport function scrubBreadcrumb<T extends ScrubbableBreadcrumb>(breadcrumb: T): T {\n\tif (breadcrumb.message) breadcrumb.message = scrubText(breadcrumb.message)\n\tif (breadcrumb.data) breadcrumb.data = scrubDeep(breadcrumb.data) as Record<string, unknown>\n\treturn breadcrumb\n}\n\n/**\n * Scrubs the free-text parts of an event in place. Identifiers (event and\n * trace ids), release names and stack frames stay intact so Sentry can group\n * the event and resolve uploaded source maps.\n */\nexport function scrubEvent<T extends ScrubbableEvent>(event: T): T {\n\tif (event.message) event.message = scrubText(event.message)\n\tif (event.logentry) event.logentry = scrubDeep(event.logentry) as ScrubbableEvent[\"logentry\"]\n\tfor (const exception of event.exception?.values ?? []) {\n\t\tif (exception.value) exception.value = scrubText(exception.value)\n\t}\n\tfor (const breadcrumb of event.breadcrumbs ?? []) scrubBreadcrumb(breadcrumb)\n\tif (event.extra) event.extra = scrubDeep(event.extra) as Record<string, unknown>\n\tif (event.request) {\n\t\tif (event.request.url) event.request.url = scrubText(event.request.url)\n\t\tdelete event.request.query_string\n\t\tdelete event.request.data\n\t\tdelete event.request.cookies\n\t\t// Sentry derives the browser and OS from the user agent; no other header is needed.\n\t\tconst userAgent = event.request.headers?.[\"User-Agent\"]\n\t\tevent.request.headers = userAgent ? { \"User-Agent\": userAgent } : undefined\n\t}\n\treturn event\n}\n\nfunction scrubDeep(value: unknown, seen = new WeakSet<object>()): unknown {\n\tif (typeof value === \"string\") return scrubText(value)\n\tif (!value || typeof value !== \"object\") return value\n\tif (seen.has(value)) return REDACTED\n\tseen.add(value)\n\tif (Array.isArray(value)) {\n\t\tif (containsMnemonic(value.map((item) => (typeof item === \"string\" ? item : \"\")).join(\" \"))) return REDACTED\n\t\treturn value.map((item) => scrubDeep(item, seen))\n\t}\n\treturn Object.fromEntries(Object.entries(value).map(([key, item]) => [key, scrubDeep(item, seen)]))\n}\n"],"mappings":";;;AAAA,SAAS,gBAAgB;AAOlB,IAAM,sBAAsB;AAE5B,SAAS,uBAAuB,OAAoC;AAC1E,SAAO,CAAC,OAAO,KAAK,SAAS,IAAI,EAAE,UAAU,SAAS,IAAI,KAAK,EAAE,YAAY,CAAC;AAC/E;AAGO,SAAS,mBAAmB,KAAiC;AACnE,MAAI;AACH,UAAM,MAAM,IAAI,IAAI,GAAG;AACvB,WAAO,IAAI,aAAa,WAAW,IAAI,SAAS;AAAA,EACjD,QAAQ;AACP,WAAO;AAAA,EACR;AACD;AAEA,IAAM,iBAAiB,IAAI,IAAI,QAAQ;AACvC,IAAM,qBAAqB;AAC3B,IAAM,WAAW;AACjB,IAAM,iBAAiB,oBAAI,IAAI,CAAC,aAAa,aAAa,SAAS,OAAO,CAAC;AAC3E,IAAM,cAAc;AAEpB,IAAM,oBAAoB;AAC1B,IAAM,mBAAmB,IAAI,OAAO,GAAG,YAAY,MAAM,IAAI,kBAAkB,MAAM,IAAI,IAAI;AAE7F,IAAM,mBAAmB;AAGzB,IAAM,qBAAqB;AAC3B,IAAM,kBAAkB;AAExB,SAAS,SAAS,KAAqB;AACtC,MAAI;AACH,UAAM,MAAM,IAAI,IAAI,GAAG;AACvB,QAAI,IAAI,aAAa,QAAS,QAAO;AAErC,UAAM,OAAO,eAAe,IAAI,IAAI,QAAQ,IAAI,IAAI,WAAW,IAAI,aAAa,MAAM,KAAK,IAAI,QAAQ;AACvG,WAAO,GAAG,IAAI,QAAQ,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,IAAI,UAAU,IAAI,OAAO,IAAI,QAAQ,KAAK,EAAE;AAAA,EAC1F,QAAQ;AACP,WAAO;AAAA,EACR;AACD;AAEA,SAAS,iBAAiB,KAAsB;AAC/C,MAAI,cAAc;AAClB,aAAW,QAAQ,IAAI,YAAY,EAAE,MAAM,cAAc,GAAG;AAC3D,kBAAc,eAAe,IAAI,IAAI,IAAI,cAAc,IAAI;AAC3D,QAAI,eAAe,mBAAoB,QAAO;AAAA,EAC/C;AACA,SAAO;AACR;AAGO,SAAS,UAAU,MAAsB;AAC/C,QAAM,cAAc,KAAK;AAAA,IAAQ;AAAA,IAAkB,CAAC,aACnD,YAAY,KAAK,QAAQ,IAAI,SAAS,QAAQ,IAAI;AAAA,EACnD;AACA,QAAM,mBAAmB,YAAY,QAAQ,kBAAkB,CAAC,QAAS,iBAAiB,GAAG,IAAI,WAAW,GAAI;AAChH,SAAO,iBAAiB,QAAQ,oBAAoB,CAAC,UAAW,gBAAgB,KAAK,KAAK,IAAI,QAAQ,QAAS;AAChH;AAuBO,SAAS,gBAAgD,YAAkB;AACjF,MAAI,WAAW,QAAS,YAAW,UAAU,UAAU,WAAW,OAAO;AACzE,MAAI,WAAW,KAAM,YAAW,OAAO,UAAU,WAAW,IAAI;AAChE,SAAO;AACR;AAOO,SAAS,WAAsC,OAAa;AAClE,MAAI,MAAM,QAAS,OAAM,UAAU,UAAU,MAAM,OAAO;AAC1D,MAAI,MAAM,SAAU,OAAM,WAAW,UAAU,MAAM,QAAQ;AAC7D,aAAW,aAAa,MAAM,WAAW,UAAU,CAAC,GAAG;AACtD,QAAI,UAAU,MAAO,WAAU,QAAQ,UAAU,UAAU,KAAK;AAAA,EACjE;AACA,aAAW,cAAc,MAAM,eAAe,CAAC,EAAG,iBAAgB,UAAU;AAC5E,MAAI,MAAM,MAAO,OAAM,QAAQ,UAAU,MAAM,KAAK;AACpD,MAAI,MAAM,SAAS;AAClB,QAAI,MAAM,QAAQ,IAAK,OAAM,QAAQ,MAAM,UAAU,MAAM,QAAQ,GAAG;AACtE,WAAO,MAAM,QAAQ;AACrB,WAAO,MAAM,QAAQ;AACrB,WAAO,MAAM,QAAQ;AAErB,UAAM,YAAY,MAAM,QAAQ,UAAU,YAAY;AACtD,UAAM,QAAQ,UAAU,YAAY,EAAE,cAAc,UAAU,IAAI;AAAA,EACnE;AACA,SAAO;AACR;AAEA,SAAS,UAAU,OAAgB,OAAO,oBAAI,QAAgB,GAAY;AACzE,MAAI,OAAO,UAAU,SAAU,QAAO,UAAU,KAAK;AACrD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,MAAI,KAAK,IAAI,KAAK,EAAG,QAAO;AAC5B,OAAK,IAAI,KAAK;AACd,MAAI,MAAM,QAAQ,KAAK,GAAG;AACzB,QAAI,iBAAiB,MAAM,IAAI,CAAC,SAAU,OAAO,SAAS,WAAW,OAAO,EAAG,EAAE,KAAK,GAAG,CAAC,EAAG,QAAO;AACpG,WAAO,MAAM,IAAI,CAAC,SAAS,UAAU,MAAM,IAAI,CAAC;AAAA,EACjD;AACA,SAAO,OAAO,YAAY,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,UAAU,MAAM,IAAI,CAAC,CAAC,CAAC;AACnG;","names":[]}