@rootcat/node 0.0.0-stage → 0.2.0

package/dist/processor.d.ts

@@ -0,0 +1,197 @@
+import { type Attributes, type Context, type Span as ApiSpan, type SpanStatus } from '@opentelemetry/api';
+import type { Resource } from '@opentelemetry/resources';
+import type { ReadableSpan, Span, SpanProcessor } from '@opentelemetry/sdk-trace-base';
+import { type CallSiteLocation } from './callsite.js';
+import { type StatementMode } from './privacy.js';
+export { callSiteContextKey } from './keys.js';
+/**
+ * CallSiteSampling is the gate every capture goes through: the
+ * processor's own and the entry wrappers' (pg, pg pool, Drizzle,
+ * postgres.js), so a capture is never paid for a span that will not be
+ * exported or that the one-in-N setting skips.
+ */
+export declare class CallSiteSampling {
+    /** sample is the one-in-N setting; the benchmark changes it between blocks. */
+    sample: number;
+    /** ratio is the trace sampling share; the benchmark changes it between blocks. */
+    ratio: number;
+    private counter;
+    /** sample is ROOTCAT_CALLSITE_SAMPLE; ratio is ROOTCAT_SAMPLE. */
+    constructor(sample: number, ratio?: number);
+    /** take counts one occasion and reports whether it captures. */
+    take(): boolean;
+    /** on reports whether any capture happens at all. */
+    get on(): boolean;
+    /**
+     * carry is what an entry wrapper calls before the operation it wraps:
+     * it returns the context to run the operation in, or undefined to run
+     * it as it is. Under an unrecorded span nothing happens. Outside any
+     * span with a ratio below 1, the trace decision is made here (the
+     * sampler follows it), and an unsampled operation captures nothing. A
+     * site already carried by an outer layer of the same operation stands,
+     * unless override (a capture that costs nothing, such as postgres.js's
+     * own origin, and names the operation more exactly). Otherwise, one
+     * occasion in N, capture() runs and its site is carried.
+     */
+    carry(capture: () => CallSiteLocation | undefined, override?: boolean): Context | undefined;
+}
+/**
+ * recorded reports whether a span in this process is part of a recorded
+ * trace: it is recording (beside an errors-only Sentry the package
+ * records spans without the sampled flag, see RecordOnlySampler), or it
+ * carries the flag (a span context an application wrapped itself, to
+ * continue a trace from a queued job).
+ */
+export declare function recorded(span: ApiSpan): boolean;
+/**
+ * droppedMark is the trace-state key on the spans the package itself
+ * decided not to record beside Sentry (see RecordOnlySampler), so they
+ * can be told from another SDK's unrecorded spans.
+ */
+export declare const droppedMark = "rootcat";
+/**
+ * parentPolicy says how an unrecorded parent from another SDK counts.
+ * Beside an errors-only Sentry every span on Sentry's provider is
+ * unrecorded (Next.js starts its own through it), and the package's spans
+ * below one must not be lost: such a parent is passed through, as if the
+ * span had none, and the trace ratio decides on its trace id. Set once,
+ * when the package starts beside Sentry.
+ */
+export declare const parentPolicy: {
+    transparentForeign: boolean;
+};
+/**
+ * localParent is the span in ctx when it was started in this process
+ * (not a parent from an incoming header), and counts as one (see
+ * parentPolicy).
+ */
+export declare function localParent(ctx: Context): ApiSpan | undefined;
+/**
+ * unsampled reports whether a span started under ctx would not be
+ * recorded (an unrecorded parent, or a root an entry wrapper decided
+ * against): the drivers then run untouched, without even a
+ * non-recording span or a context of their own.
+ */
+export declare function unsampled(ctx: Context): boolean;
+/** runCarried runs fn under the context carry returned, if any. */
+export declare function runCarried<T>(ctx: Context | undefined, fn: () => T): T;
+/** CallSiteProcessorOptions configures the processor. */
+export interface CallSiteProcessorOptions {
+    /** sampling gates the captures; a number is the one-in-N setting. */
+    sampling: CallSiteSampling | number;
+    /** depth bounds the frames walked. */
+    depth: number;
+    /** statement is passed to the privacy rules. */
+    statement: StatementMode;
+    /** isApp decides which files are application code (tests override). */
+    isApp?: (file: string) => boolean;
+    /**
+     * above is the function a capture from the processor starts below (the
+     * SDK tracer's startSpan), so the walk skips the SDK's own frames.
+     */
+    above?: Function;
+    /**
+     * readOnly leaves the spans as they are: the processor sits in another
+     * SDK's provider, which sends those spans on. The call site and the
+     * privacy rules then apply only to the copy the package exports
+     * (exportView).
+     */
+    readOnly?: boolean;
+    /**
+     * keepHostKeys leaves another SDK's keys (sentry.*) on the live span
+     * at its end: beside Sentry, Sentry reads an ended span still active in
+     * a request's context (a call made after the response), and its source
+     * must stay what UrlSource pinned. The exported copy drops them (see
+     * FlaggedExport).
+     */
+    keepHostKeys?: boolean;
+}
+/** Attribute keys written. */
+export declare const codeFilepath = "code.filepath";
+export declare const codeLineno = "code.lineno";
+export declare const codeFunction = "code.function";
+/**
+ * eligible reports whether a span is a client operation worth a call
+ * site: client and producer spans, anything carrying db.system, and the
+ * operation spans of the ORMs that start their work in application code.
+ * A processor runs for recorded spans only, so every span here exports.
+ */
+export declare function eligible(span: ReadableSpan): boolean;
+/**
+ * clientOperationByOp reports whether a Sentry span is a client
+ * operation by its op, the one attribute Sentry sets when it starts a
+ * span (its postgres.js span gets db.system.name only after the start).
+ */
+export declare function clientOperationByOp(span: ReadableSpan): boolean;
+/** CallSiteProcessor implements SpanProcessor. */
+export declare class CallSiteProcessor implements SpanProcessor {
+    readonly sampling: CallSiteSampling;
+    private readonly depth;
+    private readonly statement;
+    private readonly isApp;
+    /** above is where a processor capture starts (the SDK tracer startSpan); set once the provider exists. */
+    above: Function | undefined;
+    readonly readOnly: boolean;
+    private readonly keepHostKeys;
+    private readonly sites;
+    /** captured counts spans given a call site (tests and the benchmark). */
+    captured: number;
+    constructor(options: CallSiteProcessorOptions);
+    /**
+     * assign gives a started span a call site found after its start (a
+     * driver's own origin, read once another SDK's span exists); it
+     * replaces any the processor found at the start.
+     */
+    assign(span: object, site: CallSiteLocation): void;
+    /** siteOf is the call site the processor holds for a span. */
+    siteOf(span: object): CallSiteLocation | undefined;
+    onStart(span: Span, parentContext: Context): void;
+    /**
+     * locate takes a site already carried in the context or by the parent
+     * span (an entry wrapper paid for it, under the same gate), else, one
+     * occasion in N, captures the synchronous stack.
+     */
+    private locate;
+    onEnd(span: ReadableSpan): void;
+    /**
+     * exportView is the span as the package exports it from a read-only
+     * processor: a copy of its attributes, events and status with the
+     * privacy rules and the call site applied, under the package's
+     * resource. The span itself is not touched.
+     */
+    exportView(span: ReadableSpan, resource?: Resource): ReadableSpan;
+    /** statementName is a statement-shaped span name under the statement rule. */
+    private statementName;
+    shutdown(): Promise<void>;
+    forceFlush(): Promise<void>;
+}
+/**
+ * routeFromHost drops the keys never exported and turns what a Sentry
+ * framework instrumentation wrote on the active span into the package's own
+ * vocabulary. @sentry/hono renames the server span to "GET /users/:id"
+ * once the route is known (sentry.source "route"): the template becomes
+ * http.route.
+ */
+export declare function routeFromHost(name: string, attributes: Record<string, unknown>): unknown;
+/**
+ * exportedName is the name a span is exported under. Another SDK's HTTP
+ * span is named by the method and the path or URL it served or called
+ * (Sentry's: "GET /reset/3f9c...", "GET https://api.example.com/u/42"):
+ * the target is masked as an attribute URL is, unless the name is a
+ * route template a framework set (sentry.source "route").
+ */
+export declare function exportedName(name: string, source: unknown): string;
+/** Overrides is what a view replaces; the rest reads through to the span. */
+interface Overrides {
+    name?: string;
+    attributes?: Attributes;
+    events?: ReadableSpan['events'];
+    status?: SpanStatus;
+    resource?: Resource;
+}
+/**
+ * view is a ReadableSpan with the span's fields except the given ones,
+ * and always flagged sampled: the package exports only spans it chose to
+ * record, whatever flag they carry inside the process.
+ */
+export declare function view(span: ReadableSpan, overrides?: Overrides): ReadableSpan;

package/dist/processor.js

@@ -0,0 +1,494 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CallSiteProcessor = exports.codeFunction = exports.codeLineno = exports.codeFilepath = exports.parentPolicy = exports.droppedMark = exports.CallSiteSampling = exports.callSiteContextKey = void 0;
+exports.recorded = recorded;
+exports.localParent = localParent;
+exports.unsampled = unsampled;
+exports.runCarried = runCarried;
+exports.eligible = eligible;
+exports.clientOperationByOp = clientOperationByOp;
+exports.routeFromHost = routeFromHost;
+exports.exportedName = exportedName;
+exports.view = view;
+// CallSiteProcessor: a span processor that, when a client span starts,
+// records the application frame that caused it as code.filepath,
+// code.lineno and code.function, and applies the privacy rules to the
+// span's attributes at start and at end.
+//
+// Where the frame comes from, in order: the synchronous stack at span
+// start (the usual case: the driver was called from application code);
+// else a call site an entry wrapper stored in the active context (a pg
+// pool hands queries to a client on nextTick, where the stack is the
+// pool's); else the parent span's call site (an ORM's operation span
+// started in application code, its driver span on a later tick).
+//
+// In another SDK's provider (Sentry's, with Sentry tracing on) the
+// processor is read-only: it finds the call site the same way but writes
+// nothing on the span, which that SDK sends on; the package exports a
+// copy with the site and the privacy rules applied (exportView).
+const api_1 = require("@opentelemetry/api");
+const callsite_js_1 = require("./callsite.js");
+const keys_js_1 = require("./keys.js");
+const privacy_js_1 = require("./privacy.js");
+var keys_js_2 = require("./keys.js");
+Object.defineProperty(exports, "callSiteContextKey", { enumerable: true, get: function () { return keys_js_2.callSiteContextKey; } });
+/**
+ * CallSiteSampling is the gate every capture goes through: the
+ * processor's own and the entry wrappers' (pg, pg pool, Drizzle,
+ * postgres.js), so a capture is never paid for a span that will not be
+ * exported or that the one-in-N setting skips.
+ */
+class CallSiteSampling {
+    /** sample is the one-in-N setting; the benchmark changes it between blocks. */
+    sample;
+    /** ratio is the trace sampling share; the benchmark changes it between blocks. */
+    ratio;
+    counter = 0;
+    /** sample is ROOTCAT_CALLSITE_SAMPLE; ratio is ROOTCAT_SAMPLE. */
+    constructor(sample, ratio = 1) {
+        this.sample = Math.max(0, Math.floor(sample));
+        this.ratio = Math.min(1, Math.max(0, ratio));
+    }
+    /** take counts one occasion and reports whether it captures. */
+    take() {
+        if (this.sample === 0) {
+            return false;
+        }
+        this.counter++;
+        return this.counter % this.sample === 0;
+    }
+    /** on reports whether any capture happens at all. */
+    get on() {
+        return this.sample > 0;
+    }
+    /**
+     * carry is what an entry wrapper calls before the operation it wraps:
+     * it returns the context to run the operation in, or undefined to run
+     * it as it is. Under an unrecorded span nothing happens. Outside any
+     * span with a ratio below 1, the trace decision is made here (the
+     * sampler follows it), and an unsampled operation captures nothing. A
+     * site already carried by an outer layer of the same operation stands,
+     * unless override (a capture that costs nothing, such as postgres.js's
+     * own origin, and names the operation more exactly). Otherwise, one
+     * occasion in N, capture() runs and its site is carried.
+     */
+    carry(capture, override = false) {
+        const active = api_1.context.active();
+        const local = localParent(active);
+        let ctx = active;
+        // A remote parent (an incoming traceparent) decides nothing: see the sampler.
+        if (local) {
+            if (!recorded(local)) {
+                return undefined;
+            }
+        }
+        else if (this.ratio < 1 && active.getValue(keys_js_1.rootDecisionKey) === undefined) {
+            const decided = Math.random() < this.ratio;
+            ctx = ctx.setValue(keys_js_1.rootDecisionKey, decided);
+            if (!decided) {
+                return ctx;
+            }
+        }
+        else if (active.getValue(keys_js_1.rootDecisionKey) === false) {
+            return undefined;
+        }
+        const existing = active.getValue(keys_js_1.callSiteContextKey) !== undefined;
+        if ((existing && !override) || (!existing && !this.take())) {
+            return ctx === active ? undefined : ctx;
+        }
+        const site = capture();
+        if (site) {
+            ctx = ctx.setValue(keys_js_1.callSiteContextKey, site);
+        }
+        return ctx === active ? undefined : ctx;
+    }
+}
+exports.CallSiteSampling = CallSiteSampling;
+/**
+ * recorded reports whether a span in this process is part of a recorded
+ * trace: it is recording (beside an errors-only Sentry the package
+ * records spans without the sampled flag, see RecordOnlySampler), or it
+ * carries the flag (a span context an application wrapped itself, to
+ * continue a trace from a queued job).
+ */
+function recorded(span) {
+    return span.isRecording() || (span.spanContext().traceFlags & api_1.TraceFlags.SAMPLED) !== 0;
+}
+/**
+ * droppedMark is the trace-state key on the spans the package itself
+ * decided not to record beside Sentry (see RecordOnlySampler), so they
+ * can be told from another SDK's unrecorded spans.
+ */
+exports.droppedMark = 'rootcat';
+/**
+ * parentPolicy says how an unrecorded parent from another SDK counts.
+ * Beside an errors-only Sentry every span on Sentry's provider is
+ * unrecorded (Next.js starts its own through it), and the package's spans
+ * below one must not be lost: such a parent is passed through, as if the
+ * span had none, and the trace ratio decides on its trace id. Set once,
+ * when the package starts beside Sentry.
+ */
+exports.parentPolicy = { transparentForeign: false };
+/**
+ * localParent is the span in ctx when it was started in this process
+ * (not a parent from an incoming header), and counts as one (see
+ * parentPolicy).
+ */
+function localParent(ctx) {
+    const span = api_1.trace.getSpan(ctx);
+    if (!span) {
+        return undefined;
+    }
+    const spanContext = span.spanContext();
+    if (!api_1.trace.isSpanContextValid(spanContext) || spanContext.isRemote) {
+        return undefined;
+    }
+    if (exports.parentPolicy.transparentForeign && !recorded(span) && spanContext.traceState?.get(exports.droppedMark) === undefined) {
+        return undefined;
+    }
+    return span;
+}
+/**
+ * unsampled reports whether a span started under ctx would not be
+ * recorded (an unrecorded parent, or a root an entry wrapper decided
+ * against): the drivers then run untouched, without even a
+ * non-recording span or a context of their own.
+ */
+function unsampled(ctx) {
+    const local = localParent(ctx);
+    if (local) {
+        return !recorded(local);
+    }
+    return ctx.getValue(keys_js_1.rootDecisionKey) === false;
+}
+/** runCarried runs fn under the context carry returned, if any. */
+function runCarried(ctx, fn) {
+    return ctx ? api_1.context.with(ctx, fn) : fn();
+}
+/** Attribute keys written. */
+exports.codeFilepath = 'code.filepath';
+exports.codeLineno = 'code.lineno';
+exports.codeFunction = 'code.function';
+/**
+ * eligible reports whether a span is a client operation worth a call
+ * site: client and producer spans, anything carrying db.system, and the
+ * operation spans of the ORMs that start their work in application code.
+ * A processor runs for recorded spans only, so every span here exports.
+ */
+function eligible(span) {
+    if (span.kind === api_1.SpanKind.CLIENT || span.kind === api_1.SpanKind.PRODUCER) {
+        return true;
+    }
+    if (isDatabase(span.attributes)) {
+        return true;
+    }
+    return span.name.startsWith('drizzle.') || span.name.startsWith('prisma:client:');
+}
+/**
+ * clientOperationByOp reports whether a Sentry span is a client
+ * operation by its op, the one attribute Sentry sets when it starts a
+ * span (its postgres.js span gets db.system.name only after the start).
+ */
+function clientOperationByOp(span) {
+    const op = span.attributes['sentry.op'];
+    return typeof op === 'string' && /^(db|cache|http\.client|queue\.publish)\b/.test(op);
+}
+/** CallSiteProcessor implements SpanProcessor. */
+class CallSiteProcessor {
+    sampling;
+    depth;
+    statement;
+    isApp;
+    /** above is where a processor capture starts (the SDK tracer startSpan); set once the provider exists. */
+    above;
+    readOnly;
+    keepHostKeys;
+    sites = new WeakMap();
+    /** captured counts spans given a call site (tests and the benchmark). */
+    captured = 0;
+    constructor(options) {
+        this.sampling = typeof options.sampling === 'number' ? new CallSiteSampling(options.sampling) : options.sampling;
+        this.depth = Math.max(1, Math.floor(options.depth));
+        this.statement = options.statement;
+        this.isApp = options.isApp ?? callsite_js_1.isAppFile;
+        this.above = options.above;
+        this.readOnly = options.readOnly === true;
+        this.keepHostKeys = options.keepHostKeys === true;
+    }
+    /**
+     * assign gives a started span a call site found after its start (a
+     * driver's own origin, read once another SDK's span exists); it
+     * replaces any the processor found at the start.
+     */
+    assign(span, site) {
+        if (!this.sites.has(span)) {
+            this.captured++;
+        }
+        this.sites.set(span, site);
+        if (!this.readOnly) {
+            stamp(span, site);
+        }
+    }
+    /** siteOf is the call site the processor holds for a span. */
+    siteOf(span) {
+        return this.sites.get(span);
+    }
+    onStart(span, parentContext) {
+        try {
+            if (!this.readOnly) {
+                const changes = (0, privacy_js_1.scrubbed)(span.attributes, this.statement);
+                if (changes) {
+                    span.setAttributes(changes);
+                }
+            }
+            if (!this.sampling.on || !(eligible(span) || (this.readOnly && clientOperationByOp(span)))) {
+                return;
+            }
+            const site = this.locate(parentContext);
+            if (!site) {
+                return;
+            }
+            this.sites.set(span, site);
+            this.captured++;
+            if (!this.readOnly) {
+                stamp(span, site);
+            }
+        }
+        catch {
+            // A call site is an extra; a failure to find one never reaches the app.
+        }
+    }
+    /**
+     * locate takes a site already carried in the context or by the parent
+     * span (an entry wrapper paid for it, under the same gate), else, one
+     * occasion in N, captures the synchronous stack.
+     */
+    locate(parentContext) {
+        const carried = parentContext.getValue(keys_js_1.callSiteContextKey);
+        if (isLocation(carried)) {
+            return carried;
+        }
+        const parent = api_1.trace.getSpan(parentContext);
+        const inherited = parent ? this.sites.get(parent) : undefined;
+        if (inherited) {
+            return inherited;
+        }
+        if (!this.sampling.take()) {
+            return undefined;
+        }
+        return (0, callsite_js_1.captureCallSite)(this.depth, this.isApp, this.above);
+    }
+    onEnd(span) {
+        if (this.readOnly) {
+            return; // exportView makes the copy the package sends
+        }
+        try {
+            // The span is ended; the exporter reads these same objects, so the
+            // rules hold for attributes and events set after the start as well.
+            const attributes = span.attributes;
+            const changes = (0, privacy_js_1.scrubbed)(span.attributes, this.statement);
+            if (changes) {
+                for (const [key, value] of Object.entries(changes)) {
+                    attributes[key] = value;
+                }
+            }
+            if (!this.keepHostKeys) {
+                routeFromHost(span.name, attributes);
+            }
+            const exceptionMessage = scrubEvents(span.events);
+            // A database span's status message is the server's text, which can
+            // quote the input that failed; the instrumentation's own exception
+            // message (the pg one says only the class and SQLSTATE) stands in.
+            if (span.status.code === api_1.SpanStatusCode.ERROR && isDatabase(span.attributes) && span.status.message) {
+                span.status.message = exceptionMessage ?? 'database error';
+            }
+        }
+        catch {
+            // never reaches the app
+        }
+    }
+    /**
+     * exportView is the span as the package exports it from a read-only
+     * processor: a copy of its attributes, events and status with the
+     * privacy rules and the call site applied, under the package's
+     * resource. The span itself is not touched.
+     */
+    exportView(span, resource) {
+        const attributes = { ...span.attributes };
+        const changes = (0, privacy_js_1.scrubbed)(attributes, this.statement);
+        if (changes) {
+            Object.assign(attributes, changes);
+        }
+        const source = routeFromHost(span.name, attributes);
+        const site = this.sites.get(span);
+        if (site) {
+            attributes[exports.codeFilepath] = (0, callsite_js_1.displayPath)(site.file);
+            attributes[exports.codeLineno] = site.line;
+            if (site.function !== '') {
+                attributes[exports.codeFunction] = site.function;
+            }
+        }
+        const events = span.events.map((event) => ({ ...event, attributes: event.attributes ? { ...event.attributes } : undefined }));
+        const exceptionMessage = scrubEvents(events);
+        let status = span.status;
+        if (status.code === api_1.SpanStatusCode.ERROR && isDatabase(attributes) && status.message) {
+            status = { code: status.code, message: exceptionMessage ?? 'database error' };
+        }
+        // A database span another SDK named after its statement (Sentry's
+        // postgres.js span, whose own sanitizer misses $$ and E'' literals)
+        // is named as the statement attribute is kept.
+        const name = isDatabase(attributes) ? this.statementName(span.name) : exportedName(span.name, source);
+        return view(span, { name, attributes: attributes, events, status, ...(resource ? { resource } : {}) });
+    }
+    /** statementName is a statement-shaped span name under the statement rule. */
+    statementName(name) {
+        const bounded = name.length > privacy_js_1.maxStatementLength ? name.slice(0, privacy_js_1.maxStatementLength) : name;
+        return this.statement === 'off' ? (0, privacy_js_1.statementKeyword)(bounded) : (0, privacy_js_1.maskLiterals)(bounded);
+    }
+    shutdown() {
+        return Promise.resolve();
+    }
+    forceFlush() {
+        return Promise.resolve();
+    }
+}
+exports.CallSiteProcessor = CallSiteProcessor;
+/** stamp writes a call site on a span. */
+function stamp(span, site) {
+    span.setAttribute(exports.codeFilepath, (0, callsite_js_1.displayPath)(site.file));
+    span.setAttribute(exports.codeLineno, site.line);
+    if (site.function !== '') {
+        span.setAttribute(exports.codeFunction, site.function);
+    }
+}
+/**
+ * scrubEvents applies the stack rule to recorded exceptions (in place)
+ * and returns the last exception message. A recorded exception's stack
+ * opens with its message line, which a database server may fill with the
+ * input that failed; the frames alone say where it happened.
+ */
+function scrubEvents(events) {
+    let exceptionMessage;
+    for (const event of events) {
+        const attributes = event.attributes;
+        const stack = attributes?.['exception.stacktrace'];
+        if (typeof stack === 'string') {
+            attributes['exception.stacktrace'] = (0, privacy_js_1.framesOnly)(stack);
+        }
+        if (event.name === 'exception' && typeof attributes?.['exception.message'] === 'string') {
+            exceptionMessage = attributes['exception.message'];
+        }
+    }
+    return exceptionMessage;
+}
+/**
+ * dropped reports the keys never exported: Sentry's bookkeeping
+ * (sentry.*), and request and response headers, which Sentry's http
+ * instrumentation records on its spans (cookies and authorization travel
+ * there) and the package's own never does.
+ */
+function dropped(key) {
+    const first = key.charCodeAt(0);
+    if (first === 115 /* s */) {
+        return key.startsWith('sentry.');
+    }
+    if (first === 99 /* c */) {
+        return key === 'cache.key'; // Sentry's cache spans: the keys
+    }
+    if (first === 114 /* r */) {
+        return key === 'rootcat.source'; // a source kept aside (see UrlSource)
+    }
+    return first === 104 /* h */ && (key.startsWith('http.request.header.') || key.startsWith('http.response.header.'));
+}
+/**
+ * routeFromHost drops the keys never exported and turns what a Sentry
+ * framework instrumentation wrote on the active span into the package's own
+ * vocabulary. @sentry/hono renames the server span to "GET /users/:id"
+ * once the route is known (sentry.source "route"): the template becomes
+ * http.route.
+ */
+function routeFromHost(name, attributes) {
+    let source;
+    let any = false;
+    for (const key in attributes) {
+        if (dropped(key)) {
+            any = true;
+            if (key === 'sentry.source' && source === undefined) {
+                source = attributes[key];
+            }
+            if (key === 'rootcat.source') {
+                source = attributes[key]; // what another SDK set, kept aside
+            }
+        }
+    }
+    if (!any) {
+        return undefined;
+    }
+    for (const key of Object.keys(attributes)) {
+        if (dropped(key)) {
+            delete attributes[key];
+        }
+    }
+    if (source === 'route' && attributes['http.route'] === undefined) {
+        const space = name.indexOf(' ');
+        if (space > 0 && name.charCodeAt(space + 1) === 47 /* / */) {
+            attributes['http.route'] = name.slice(space + 1, space + 1 + 256);
+        }
+    }
+    return source;
+}
+/** methodAndTarget matches a span name of an HTTP method and a path or URL. */
+const methodAndTarget = /^(GET|HEAD|POST|PUT|PATCH|DELETE|OPTIONS|CONNECT|TRACE) (\S+)$/;
+/**
+ * exportedName is the name a span is exported under. Another SDK's HTTP
+ * span is named by the method and the path or URL it served or called
+ * (Sentry's: "GET /reset/3f9c...", "GET https://api.example.com/u/42"):
+ * the target is masked as an attribute URL is, unless the name is a
+ * route template a framework set (sentry.source "route").
+ */
+function exportedName(name, source) {
+    if (source === 'route') {
+        return name;
+    }
+    const match = methodAndTarget.exec(name);
+    return match ? `${match[1]} ${(0, privacy_js_1.maskPath)(match[2])}` : name;
+}
+/**
+ * view is a ReadableSpan with the span's fields except the given ones,
+ * and always flagged sampled: the package exports only spans it chose to
+ * record, whatever flag they carry inside the process.
+ */
+function view(span, overrides = {}) {
+    const spanContext = span.spanContext();
+    const flagged = (spanContext.traceFlags & api_1.TraceFlags.SAMPLED) !== 0 ? spanContext : { ...spanContext, traceFlags: spanContext.traceFlags | api_1.TraceFlags.SAMPLED };
+    return {
+        name: overrides.name ?? span.name,
+        kind: span.kind,
+        spanContext: () => flagged,
+        parentSpanContext: span.parentSpanContext,
+        startTime: span.startTime,
+        endTime: span.endTime,
+        status: overrides.status ?? span.status,
+        attributes: overrides.attributes ?? span.attributes,
+        links: span.links,
+        events: overrides.events ?? span.events,
+        duration: span.duration,
+        ended: span.ended,
+        resource: overrides.resource ?? span.resource,
+        instrumentationScope: span.instrumentationScope,
+        droppedAttributesCount: span.droppedAttributesCount,
+        droppedEventsCount: span.droppedEventsCount,
+        droppedLinksCount: span.droppedLinksCount,
+    };
+}
+function isDatabase(attributes) {
+    return attributes['db.system'] !== undefined || attributes['db.system.name'] !== undefined;
+}
+function isLocation(value) {
+    if (!value || typeof value !== 'object') {
+        return false;
+    }
+    const record = value;
+    return typeof record.file === 'string' && typeof record.line === 'number';
+}
+//# sourceMappingURL=processor.js.map