@lavarage/telemetry 1.2.0 → 1.2.2

package/dist/index.js

@@ -43,6 +43,19 @@ class LavarageTelemetry {
         }
         try {
             const win = window;
+            // Check for Solana wallets FIRST (since they're more specific and users might have both)
+            if (win.solana) {
+                // Phantom
+                if (win.solana.isPhantom) {
+                    return 'Phantom';
+                }
+                // Solflare
+                if (win.solana.isSolflare) {
+                    return 'Solflare';
+                }
+                // Generic Solana
+                return 'Solana';
+            }
             // Check for Ethereum wallets
             if (win.ethereum) {
                 // MetaMask
@@ -80,19 +93,6 @@ class LavarageTelemetry {
                 // Default to generic Ethereum
                 return 'Ethereum';
             }
-            // Check for Solana wallets
-            if (win.solana) {
-                // Phantom
-                if (win.solana.isPhantom) {
-                    return 'Phantom';
-                }
-                // Solflare
-                if (win.solana.isSolflare) {
-                    return 'Solflare';
-                }
-                // Generic Solana
-                return 'Solana';
-            }
             // Check for other wallet providers
             if (win.web3) {
                 return 'Web3';
@@ -124,16 +124,57 @@ class LavarageTelemetry {
     }
     shouldCaptureHost(url) {
         try {
-            const urlObj = new URL(url);
-            const hostname = urlObj.hostname;
+            // Skip empty or invalid URLs
+            if (!url || url.trim() === '') {
+                return false;
+            }
+            // Resolve relative URLs to absolute URLs
+            let absoluteUrl;
+            try {
+                // Try to parse as absolute URL first
+                new URL(url);
+                absoluteUrl = url;
+            }
+            catch {
+                // If it fails, it's likely a relative URL - resolve it using current origin
+                if (typeof window !== 'undefined' && window.location) {
+                    try {
+                        absoluteUrl = new URL(url, window.location.origin).href;
+                    }
+                    catch {
+                        // Still can't resolve, don't capture
+                        return false;
+                    }
+                }
+                else {
+                    // Not in browser environment, can't resolve relative URLs
+                    return false;
+                }
+            }
+            const urlObj = new URL(absoluteUrl);
+            let hostname = urlObj.hostname;
+            // Handle special URL types that don't have a hostname (data:, blob:, etc.)
+            if (!hostname || hostname === '') {
+                // For include mode, don't capture URLs without hostnames
+                // For exclude mode, these would be captured (but they're unlikely to be in exclude list)
+                return false;
+            }
+            // Remove port number if present (hostname property should already exclude it, but be defensive)
+            // Also normalize: lowercase and trim
+            hostname = hostname.split(':')[0].toLowerCase().trim();
             const { mode, hosts = [], patterns = [] } = this.hostFilter;
             if (mode === 'all')
                 return true;
             if (mode === 'none')
                 return false;
-            // Check host patterns
+            // In include mode, if no hosts or patterns are specified, don't capture anything
+            if (mode === 'include' && hosts.length === 0 && patterns.length === 0) {
+                return false;
+            }
+            // Check host patterns (normalize them too)
             for (const host of hosts) {
-                if (this.matchesHost(hostname, host)) {
+                const normalizedHost = host.toLowerCase().trim();
+                if (this.matchesHost(hostname, normalizedHost)) {
                     return mode === 'include';
                 }
             }
@@ -159,16 +200,26 @@ class LavarageTelemetry {
         }
     }
     matchesHost(hostname, pattern) {
+        // Normalize inputs (should already be normalized, but be defensive)
+        hostname = hostname.toLowerCase().trim();
+        pattern = pattern.toLowerCase().trim();
         // Exact match
         if (hostname === pattern)
             return true;
         // Wildcard subdomain: *.example.com
         if (pattern.startsWith('*.')) {
-            const domain = pattern.substring(2);
+            const domain = pattern.substring(2).toLowerCase().trim();
+            // Match exact domain or any subdomain
             return hostname === domain || hostname.endsWith('.' + domain);
         }
         // Domain match (matches domain and all subdomains)
-        if (hostname === pattern || hostname.endsWith('.' + pattern)) {
+        // e.g., 'lavarave.wtf' matches 'lavarave.wtf' and 'api.lavarave.wtf'
+        if (hostname === pattern) {
+            return true;
+        }
+        // Check if hostname is a subdomain of pattern
+        // e.g., 'api.lavarave.wtf' ends with '.lavarave.wtf'
+        if (hostname.endsWith('.' + pattern)) {
             return true;
         }
         return false;
@@ -220,10 +271,27 @@ class LavarageTelemetry {
         }
         if (typeof data === 'object') {
             const sanitized = {};
-            const sensitiveKeys = ['privateKey', 'mnemonic', 'password', 'secret', 'token', 'apiKey', 'authorization'];
+            // Exact matches for sensitive keys
+            const exactSensitiveKeys = ['privateKey', 'mnemonic', 'password', 'secret', 'apiKey', 'authorization'];
+            // Patterns that indicate sensitive tokens (but not identifiers like baseToken, quoteToken)
+            const sensitiveTokenPatterns = [
+                /^access[_-]?token$/i,
+                /^auth[_-]?token$/i,
+                /^api[_-]?token$/i,
+                /^bearer[_-]?token$/i,
+                /^refresh[_-]?token$/i,
+                /^session[_-]?token$/i,
+                /^token$/i, // Only exact match for "token"
+            ];
             for (const [key, value] of Object.entries(data)) {
                 const lowerKey = key.toLowerCase();
-                const isSensitive = sensitiveKeys.some(sk => lowerKey.includes(sk.toLowerCase()));
+                // Check for exact matches first
+                const isExactMatch = exactSensitiveKeys.some(sk => lowerKey === sk.toLowerCase());
+                // Check for sensitive token patterns (but exclude common non-sensitive patterns)
+                const isSensitiveToken = sensitiveTokenPatterns.some(pattern => pattern.test(key));
+                // Exclude common non-sensitive patterns that contain "token"
+                const isNonSensitiveToken = /^(base|quote|tokenId|tokenAddress|tokenSymbol|tokenName|tokenUri|tokenType|tokenContract|tokenDecimals)/i.test(key);
+                const isSensitive = isExactMatch || (isSensitiveToken && !isNonSensitiveToken);
                 if (isSensitive) {
                     sanitized[key] = '[REDACTED]';
                 }
@@ -502,16 +570,53 @@ class LavarageTelemetry {
         }
         // Request interceptor
         axiosInstance.interceptors.request.use((config) => {
-            const url = config.url || (config.baseURL ? `${config.baseURL}${config.url || ''}` : '');
+            // Construct full URL from axios config
+            let url;
+            try {
+                if (config.url) {
+                    // If url is absolute (starts with http:// or https://), use it directly
+                    if (config.url.startsWith('http://') || config.url.startsWith('https://')) {
+                        url = config.url;
+                    }
+                    else if (config.baseURL) {
+                        // Relative URL with baseURL - use URL constructor to properly combine them
+                        try {
+                            url = new URL(config.url, config.baseURL).href;
+                        }
+                        catch {
+                            // Fallback to manual concatenation if URL constructor fails
+                            const base = config.baseURL.endsWith('/') ? config.baseURL.slice(0, -1) : config.baseURL;
+                            const path = config.url.startsWith('/') ? config.url : '/' + config.url;
+                            url = base + path;
+                        }
+                    }
+                    else {
+                        // Relative URL without baseURL - will be resolved in shouldCaptureHost
+                        url = config.url;
+                    }
+                }
+                else if (config.baseURL) {
+                    url = config.baseURL;
+                }
+                else {
+                    // No URL and no baseURL - skip capture
+                    return config;
+                }
+            }
+            catch {
+                // If URL construction fails, skip capture
+                return config;
+            }
             const method = config.method?.toUpperCase() || 'GET';
             if (!this.shouldCaptureHost(url)) {
                 return config;
             }
             const requestId = this.generateRequestId();
             const startTime = Date.now();
-            // Store request metadata
+            // Store request metadata (including full URL for response interceptor)
             config._telemetryRequestId = requestId;
             config._telemetryStartTime = startTime;
+            config._telemetryUrl = url; // Store full URL for response interceptor
             // Track request start
             this.enqueue({
                 type: 'request',
@@ -535,7 +640,8 @@ class LavarageTelemetry {
             const startTime = config._telemetryStartTime;
             if (requestId && startTime) {
                 const duration = Date.now() - startTime;
-                const url = response.config?.url || response.request?.responseURL || '';
+                // Use stored URL from request interceptor, fallback to response URL
+                const url = config._telemetryUrl || response.config?.url || response.request?.responseURL || '';
                 this.enqueue({
                     type: 'request',
                     wallet: this.wallet,
@@ -557,7 +663,8 @@ class LavarageTelemetry {
             const startTime = config._telemetryStartTime;
             if (requestId && startTime) {
                 const duration = Date.now() - startTime;
-                const url = config.url || error.request?.responseURL || '';
+                // Use stored URL from request interceptor, fallback to error config URL
+                const url = config._telemetryUrl || config.url || error.request?.responseURL || '';
                 const errorMessage = error.message || 'Request failed';
                 this.enqueue({
                     type: 'request',

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lavarage/telemetry",
-  "version": "1.2.0",
+  "version": "1.2.2",
   "description": "Production telemetry SDK for Lavarage and partner applications",
   "main": "dist/index.js",
   "module": "dist/index.js",