@sentry/core 10.53.1 → 10.54.0

package/build/esm/utils/tunnel.js.map

@@ -1 +1 @@
-{"version":3,"file":"tunnel.js","sources":["../../../src/utils/tunnel.ts"],"sourcesContent":["import { getEnvelopeEndpointWithUrlEncodedAuth } from '../api';\nimport { debug } from './debug-logger';\nimport { makeDsn } from './dsn';\nimport { parseEnvelope } from './envelope';\n\nexport interface HandleTunnelRequestOptions {\n  /** Incoming request containing the Sentry envelope as its body */\n  request: Request;\n  /** Pre-parsed array of allowed DSN strings */\n  allowedDsns: Array<string>;\n}\n\n/**\n * Core Sentry tunnel handler - framework agnostic.\n *\n * Validates the envelope DSN against allowed DSNs, then forwards the\n * envelope to the Sentry ingest endpoint.\n *\n * @returns A `Response` — either the upstream Sentry response on success, or an error response.\n */\nexport async function handleTunnelRequest(options: HandleTunnelRequestOptions): Promise<Response> {\n  const { request, allowedDsns } = options;\n\n  if (allowedDsns.length === 0) {\n    return new Response('Tunnel not configured', { status: 500 });\n  }\n\n  const body = new Uint8Array(await request.arrayBuffer());\n\n  let envelopeHeader;\n  try {\n    [envelopeHeader] = parseEnvelope(body);\n  } catch {\n    return new Response('Invalid envelope', { status: 400 });\n  }\n\n  if (!envelopeHeader) {\n    return new Response('Invalid envelope: missing header', { status: 400 });\n  }\n\n  const dsn = envelopeHeader.dsn;\n  if (!dsn) {\n    return new Response('Invalid envelope: missing DSN', { status: 400 });\n  }\n\n  // SECURITY: Validate that the envelope DSN matches one of the allowed DSNs\n  // This prevents SSRF attacks where attackers send crafted envelopes\n  // with malicious DSNs pointing to arbitrary hosts\n  const isAllowed = allowedDsns.some(allowed => allowed === dsn);\n\n  if (!isAllowed) {\n    debug.warn(`Sentry tunnel: rejected request with unauthorized DSN (${dsn})`);\n    return new Response('DSN not allowed', { status: 403 });\n  }\n\n  const dsnComponents = makeDsn(dsn);\n  if (!dsnComponents) {\n    debug.warn(`Could not extract DSN Components from: ${dsn}`);\n    return new Response('Invalid DSN', { status: 403 });\n  }\n\n  const sentryIngestUrl = getEnvelopeEndpointWithUrlEncodedAuth(dsnComponents);\n\n  try {\n    return await fetch(sentryIngestUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-sentry-envelope',\n      },\n      body,\n    });\n  } catch (error) {\n    debug.error('Sentry tunnel: failed to forward envelope', error);\n    return new Response('Failed to forward envelope to Sentry', { status: 500 });\n  }\n}\n"],"names":[],"mappings":";;;;;AAYA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,eAAe,mBAAmB,CAAC,OAAO,EAAiD;AAClG,EAAE,MAAM,EAAE,OAAO,EAAE,WAAA,EAAY,GAAI,OAAO;;AAE1C,EAAE,IAAI,WAAW,CAAC,MAAA,KAAW,CAAC,EAAE;AAChC,IAAI,OAAO,IAAI,QAAQ,CAAC,uBAAuB,EAAE,EAAE,MAAM,EAAE,GAAA,EAAK,CAAC;AACjE,EAAE;;AAEF,EAAE,MAAM,IAAA,GAAO,IAAI,UAAU,CAAC,MAAM,OAAO,CAAC,WAAW,EAAE,CAAC;;AAE1D,EAAE,IAAI,cAAc;AACpB,EAAE,IAAI;AACN,IAAI,CAAC,cAAc,CAAA,GAAI,aAAa,CAAC,IAAI,CAAC;AAC1C,EAAE,EAAE,MAAM;AACV,IAAI,OAAO,IAAI,QAAQ,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,GAAA,EAAK,CAAC;AAC5D,EAAE;;AAEF,EAAE,IAAI,CAAC,cAAc,EAAE;AACvB,IAAI,OAAO,IAAI,QAAQ,CAAC,kCAAkC,EAAE,EAAE,MAAM,EAAE,GAAA,EAAK,CAAC;AAC5E,EAAE;;AAEF,EAAE,MAAM,GAAA,GAAM,cAAc,CAAC,GAAG;AAChC,EAAE,IAAI,CAAC,GAAG,EAAE;AACZ,IAAI,OAAO,IAAI,QAAQ,CAAC,+BAA+B,EAAE,EAAE,MAAM,EAAE,GAAA,EAAK,CAAC;AACzE,EAAE;;AAEF;AACA;AACA;AACA,EAAE,MAAM,SAAA,GAAY,WAAW,CAAC,IAAI,CAAC,OAAA,IAAW,OAAA,KAAY,GAAG,CAAC;;AAEhE,EAAE,IAAI,CAAC,SAAS,EAAE;AAClB,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,uDAAuD,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;AAChF,IAAI,OAAO,IAAI,QAAQ,CAAC,iBAAiB,EAAE,EAAE,MAAM,EAAE,GAAA,EAAK,CAAC;AAC3D,EAAE;;AAEF,EAAE,MAAM,aAAA,GAAgB,OAAO,CAAC,GAAG,CAAC;AACpC,EAAE,IAAI,CAAC,aAAa,EAAE;AACtB,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAA,CAAA;AACA,IAAA,OAAA,IAAA,QAAA,CAAA,aAAA,EAAA,EAAA,MAAA,EAAA,GAAA,EAAA,CAAA;AACA,EAAA;;AAEA,EAAA,MAAA,eAAA,GAAA,qCAAA,CAAA,aAAA,CAAA;;AAEA,EAAA,IAAA;AACA,IAAA,OAAA,MAAA,KAAA,CAAA,eAAA,EAAA;AACA,MAAA,MAAA,EAAA,MAAA;AACA,MAAA,OAAA,EAAA;AACA,QAAA,cAAA,EAAA,+BAAA;AACA,OAAA;AACA,MAAA,IAAA;AACA,KAAA,CAAA;AACA,EAAA,CAAA,CAAA,OAAA,KAAA,EAAA;AACA,IAAA,KAAA,CAAA,KAAA,CAAA,2CAAA,EAAA,KAAA,CAAA;AACA,IAAA,OAAA,IAAA,QAAA,CAAA,sCAAA,EAAA,EAAA,MAAA,EAAA,GAAA,EAAA,CAAA;AACA,EAAA;AACA;;;;"}
+{"version":3,"file":"tunnel.js","sources":["../../../src/utils/tunnel.ts"],"sourcesContent":["import { getEnvelopeEndpointWithUrlEncodedAuth } from '../api';\nimport { debug } from './debug-logger';\nimport { makeDsn } from './dsn';\nimport { parseEnvelope } from './envelope';\n\nexport interface HandleTunnelRequestOptions {\n  /** Incoming request containing the Sentry envelope as its body */\n  request: Request;\n  /** Pre-parsed array of allowed DSN strings */\n  allowedDsns: Array<string>;\n}\n\n/**\n * Core Sentry tunnel handler - framework agnostic.\n *\n * Validates the envelope DSN against allowed DSNs, then forwards the\n * envelope to the Sentry ingest endpoint.\n *\n * @returns A `Response` — either the upstream Sentry response on success, or an error response.\n */\nexport async function handleTunnelRequest(options: HandleTunnelRequestOptions): Promise<Response> {\n  const { request, allowedDsns } = options;\n\n  if (allowedDsns.length === 0) {\n    return new Response('Tunnel not configured', { status: 500 });\n  }\n\n  const body = new Uint8Array(await request.arrayBuffer());\n\n  let envelopeHeader;\n  try {\n    [envelopeHeader] = parseEnvelope(body);\n  } catch {\n    return new Response('Invalid envelope', { status: 400 });\n  }\n\n  if (!envelopeHeader) {\n    return new Response('Invalid envelope: missing header', { status: 400 });\n  }\n\n  const dsn = envelopeHeader.dsn;\n  if (!dsn) {\n    return new Response('Invalid envelope: missing DSN', { status: 400 });\n  }\n\n  // SECURITY: Validate that the envelope DSN matches one of the allowed DSNs\n  // This prevents SSRF attacks where attackers send crafted envelopes\n  // with malicious DSNs pointing to arbitrary hosts\n  const isAllowed = allowedDsns.some(allowed => allowed === dsn);\n\n  if (!isAllowed) {\n    debug.warn(`Sentry tunnel: rejected request with unauthorized DSN (${dsn})`);\n    return new Response('DSN not allowed', { status: 403 });\n  }\n\n  const dsnComponents = makeDsn(dsn);\n  if (!dsnComponents) {\n    debug.warn(`Could not extract DSN Components from: ${dsn}`);\n    return new Response('Invalid DSN', { status: 403 });\n  }\n\n  const sentryIngestUrl = getEnvelopeEndpointWithUrlEncodedAuth(dsnComponents);\n\n  try {\n    return await fetch(sentryIngestUrl, {\n      method: 'POST',\n      headers: {\n        'Content-Type': 'application/x-sentry-envelope',\n      },\n      body,\n    });\n  } catch (error) {\n    debug.error('Sentry tunnel: failed to forward envelope', error);\n    return new Response('Failed to forward envelope to Sentry', { status: 500 });\n  }\n}\n"],"names":[],"mappings":";;;;;AAoBA,eAAsB,oBAAoB,OAAA,EAAwD;AAChG,EAAA,MAAM,EAAE,OAAA,EAAS,WAAA,EAAY,GAAI,OAAA;AAEjC,EAAA,IAAI,WAAA,CAAY,WAAW,CAAA,EAAG;AAC5B,IAAA,OAAO,IAAI,QAAA,CAAS,uBAAA,EAAyB,EAAE,MAAA,EAAQ,KAAK,CAAA;AAAA,EAC9D;AAEA,EAAA,MAAM,OAAO,IAAI,UAAA,CAAW,MAAM,OAAA,CAAQ,aAAa,CAAA;AAEvD,EAAA,IAAI,cAAA;AACJ,EAAA,IAAI;AACF,IAAA,CAAC,cAAc,CAAA,GAAI,aAAA,CAAc,IAAI,CAAA;AAAA,EACvC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAI,QAAA,CAAS,kBAAA,EAAoB,EAAE,MAAA,EAAQ,KAAK,CAAA;AAAA,EACzD;AAEA,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,OAAO,IAAI,QAAA,CAAS,kCAAA,EAAoC,EAAE,MAAA,EAAQ,KAAK,CAAA;AAAA,EACzE;AAEA,EAAA,MAAM,MAAM,cAAA,CAAe,GAAA;AAC3B,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,OAAO,IAAI,QAAA,CAAS,+BAAA,EAAiC,EAAE,MAAA,EAAQ,KAAK,CAAA;AAAA,EACtE;AAKA,EAAA,MAAM,SAAA,GAAY,WAAA,CAAY,IAAA,CAAK,CAAA,OAAA,KAAW,YAAY,GAAG,CAAA;AAE7D,EAAA,IAAI,CAAC,SAAA,EAAW;AACd,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,uDAAA,EAA0D,GAAG,CAAA,CAAA,CAAG,CAAA;AAC3E,IAAA,OAAO,IAAI,QAAA,CAAS,iBAAA,EAAmB,EAAE,MAAA,EAAQ,KAAK,CAAA;AAAA,EACxD;AAEA,EAAA,MAAM,aAAA,GAAgB,QAAQ,GAAG,CAAA;AACjC,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,KAAA,CAAM,IAAA,CAAK,CAAA,uCAAA,EAA0C,GAAG,CAAA,CAAE,CAAA;AAC1D,IAAA,OAAO,IAAI,QAAA,CAAS,aAAA,EAAe,EAAE,MAAA,EAAQ,KAAK,CAAA;AAAA,EACpD;AAEA,EAAA,MAAM,eAAA,GAAkB,sCAAsC,aAAa,CAAA;AAE3E,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,MAAM,eAAA,EAAiB;AAAA,MAClC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS;AAAA,QACP,cAAA,EAAgB;AAAA,OAClB;AAAA,MACA;AAAA,KACD,CAAA;AAAA,EACH,SAAS,KAAA,EAAO;AACd,IAAA,KAAA,CAAM,KAAA,CAAM,6CAA6C,KAAK,CAAA;AAC9D,IAAA,OAAO,IAAI,QAAA,CAAS,sCAAA,EAAwC,EAAE,MAAA,EAAQ,KAAK,CAAA;AAAA,EAC7E;AACF;;;;"}

package/build/esm/utils/url.js

@@ -1,267 +1,133 @@
 import { SEMANTIC_ATTRIBUTE_SENTRY_SOURCE, SEMANTIC_ATTRIBUTE_HTTP_REQUEST_METHOD, SEMANTIC_ATTRIBUTE_URL_FULL, SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN } from '../semanticAttributes.js';
 
-// Curious about `thismessage:/`? See: https://www.rfc-editor.org/rfc/rfc2557.html
-//  > When the methods above do not yield an absolute URI, a base URL
-//  > of "thismessage:/" MUST be employed. This base URL has been
-//  > defined for the sole purpose of resolving relative references
-//  > within a multipart/related structure when no other base URI is
-//  > specified.
-//
-// We need to provide a base URL to `parseStringToURLObject` because the fetch API gives us a
-// relative URL sometimes.
-//
-// This is the only case where we need to provide a base URL to `parseStringToURLObject`
-// because the relative URL is not valid on its own.
-const DEFAULT_BASE_URL = 'thismessage:/';
-
-/**
- * Checks if the URL object is relative
- *
- * @param url - The URL object to check
- * @returns True if the URL object is relative, false otherwise
- */
+const DEFAULT_BASE_URL = "thismessage:/";
 function isURLObjectRelative(url) {
-  return 'isRelative' in url;
+  return "isRelative" in url;
 }
-
-/**
- * Parses string to a URL object
- *
- * @param url - The URL to parse
- * @returns The parsed URL object or undefined if the URL is invalid
- */
 function parseStringToURLObject(url, urlBase) {
-  const isRelative = url.indexOf('://') <= 0 && url.indexOf('//') !== 0;
-  const base = urlBase ?? (isRelative ? DEFAULT_BASE_URL : undefined);
+  const isRelative = url.indexOf("://") <= 0 && url.indexOf("//") !== 0;
+  const base = urlBase ?? (isRelative ? DEFAULT_BASE_URL : void 0);
   try {
-    // Use `canParse` to short-circuit the URL constructor if it's not a valid URL
-    // This is faster than trying to construct the URL and catching the error
-    // Node 20+, Chrome 120+, Firefox 115+, Safari 17+
-    if ('canParse' in URL && !(URL ).canParse(url, base)) {
-      return undefined;
+    if ("canParse" in URL && !URL.canParse(url, base)) {
+      return void 0;
     }
-
     const fullUrlObject = new URL(url, base);
     if (isRelative) {
-      // Because we used a fake base URL, we need to return a relative URL object.
-      // We cannot return anything about the origin, host, etc. because it will refer to the fake base URL.
       return {
         isRelative,
         pathname: fullUrlObject.pathname,
         search: fullUrlObject.search,
-        hash: fullUrlObject.hash,
+        hash: fullUrlObject.hash
       };
     }
     return fullUrlObject;
   } catch {
-    // empty body
   }
-
-  return undefined;
+  return void 0;
 }
-
-/**
- * Takes a URL object and returns a sanitized string which is safe to use as span name
- * see: https://develop.sentry.dev/sdk/data-handling/#structuring-data
- */
 function getSanitizedUrlStringFromUrlObject(url) {
   if (isURLObjectRelative(url)) {
     return url.pathname;
   }
-
   const newUrl = new URL(url);
-  newUrl.search = '';
-  newUrl.hash = '';
-  if (['80', '443'].includes(newUrl.port)) {
-    newUrl.port = '';
+  newUrl.search = "";
+  newUrl.hash = "";
+  if (["80", "443"].includes(newUrl.port)) {
+    newUrl.port = "";
   }
   if (newUrl.password) {
-    newUrl.password = '%filtered%';
+    newUrl.password = "%filtered%";
   }
   if (newUrl.username) {
-    newUrl.username = '%filtered%';
+    newUrl.username = "%filtered%";
   }
-
   return newUrl.toString();
 }
-
-function getHttpSpanNameFromUrlObject(
-  urlObject,
-  kind,
-  request,
-  routeName,
-) {
-  const method = request?.method?.toUpperCase() ?? 'GET';
-  const route = routeName
-    ? routeName
-    : urlObject
-      ? kind === 'client'
-        ? getSanitizedUrlStringFromUrlObject(urlObject)
-        : urlObject.pathname
-      : '/';
-
+function getHttpSpanNameFromUrlObject(urlObject, kind, request, routeName) {
+  const method = request?.method?.toUpperCase() ?? "GET";
+  const route = routeName ? routeName : urlObject ? kind === "client" ? getSanitizedUrlStringFromUrlObject(urlObject) : urlObject.pathname : "/";
   return `${method} ${route}`;
 }
-
-/**
- * Takes a parsed URL object and returns a set of attributes for the span
- * that represents the HTTP request for that url. This is used for both server
- * and client http spans.
- *
- * Follows https://opentelemetry.io/docs/specs/semconv/http/.
- *
- * @param urlObject - see {@link parseStringToURLObject}
- * @param kind - The type of HTTP operation (server or client)
- * @param spanOrigin - The origin of the span
- * @param request - The request object, see {@link PartialRequest}
- * @param routeName - The name of the route, must be low cardinality
- * @returns The span name and attributes for the HTTP operation
- */
-function getHttpSpanDetailsFromUrlObject(
-  urlObject,
-  kind,
-  spanOrigin,
-  request,
-  routeName,
-) {
+function getHttpSpanDetailsFromUrlObject(urlObject, kind, spanOrigin, request, routeName) {
   const attributes = {
     [SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN]: spanOrigin,
-    [SEMANTIC_ATTRIBUTE_SENTRY_SOURCE]: 'url',
+    [SEMANTIC_ATTRIBUTE_SENTRY_SOURCE]: "url"
   };
-
   if (routeName) {
-    // This is based on https://opentelemetry.io/docs/specs/semconv/http/http-spans/#name
-    attributes[kind === 'server' ? 'http.route' : 'url.template'] = routeName;
-    attributes[SEMANTIC_ATTRIBUTE_SENTRY_SOURCE] = 'route';
+    attributes[kind === "server" ? "http.route" : "url.template"] = routeName;
+    attributes[SEMANTIC_ATTRIBUTE_SENTRY_SOURCE] = "route";
   }
-
   if (request?.method) {
     attributes[SEMANTIC_ATTRIBUTE_HTTP_REQUEST_METHOD] = request.method.toUpperCase();
   }
-
   if (urlObject) {
     if (urlObject.search) {
-      attributes['url.query'] = urlObject.search;
+      attributes["url.query"] = urlObject.search;
     }
     if (urlObject.hash) {
-      attributes['url.fragment'] = urlObject.hash;
+      attributes["url.fragment"] = urlObject.hash;
     }
     if (urlObject.pathname) {
-      attributes['url.path'] = urlObject.pathname;
-      if (urlObject.pathname === '/') {
-        attributes[SEMANTIC_ATTRIBUTE_SENTRY_SOURCE] = 'route';
+      attributes["url.path"] = urlObject.pathname;
+      if (urlObject.pathname === "/") {
+        attributes[SEMANTIC_ATTRIBUTE_SENTRY_SOURCE] = "route";
       }
     }
-
     if (!isURLObjectRelative(urlObject)) {
       attributes[SEMANTIC_ATTRIBUTE_URL_FULL] = urlObject.href;
       if (urlObject.port) {
-        attributes['url.port'] = urlObject.port;
+        attributes["url.port"] = urlObject.port;
       }
       if (urlObject.protocol) {
-        attributes['url.scheme'] = urlObject.protocol;
+        attributes["url.scheme"] = urlObject.protocol;
       }
       if (urlObject.hostname) {
-        attributes[kind === 'server' ? 'server.address' : 'url.domain'] = urlObject.hostname;
+        attributes[kind === "server" ? "server.address" : "url.domain"] = urlObject.hostname;
       }
     }
   }
-
   return [getHttpSpanNameFromUrlObject(urlObject, kind, request, routeName), attributes];
 }
-
-/**
- * Parses string form of URL into an object
- * // borrowed from https://tools.ietf.org/html/rfc3986#appendix-B
- * // intentionally using regex and not <a/> href parsing trick because React Native and other
- * // environments where DOM might not be available
- * @returns parsed URL object
- */
 function parseUrl(url) {
   if (!url) {
     return {};
   }
-
   const match = url.match(/^(([^:/?#]+):)?(\/\/([^/?#]*))?([^?#]*)(\?([^#]*))?(#(.*))?$/);
-
   if (!match) {
     return {};
   }
-
-  // coerce to undefined values to empty string so we don't get 'undefined'
-  const query = match[6] || '';
-  const fragment = match[8] || '';
+  const query = match[6] || "";
+  const fragment = match[8] || "";
   return {
     host: match[4],
     path: match[5],
     protocol: match[2],
     search: query,
     hash: fragment,
-    relative: match[5] + query + fragment, // everything minus origin
+    relative: match[5] + query + fragment
+    // everything minus origin
   };
 }
-
-/**
- * Strip the query string and fragment off of a given URL or path (if present)
- *
- * @param urlPath Full URL or path, including possible query string and/or fragment
- * @returns URL or path without query string or fragment
- */
 function stripUrlQueryAndFragment(urlPath) {
-  return (urlPath.split(/[?#]/, 1) )[0];
+  return urlPath.split(/[?#]/, 1)[0];
 }
-
-/**
- * Takes a URL object and returns a sanitized string which is safe to use as span name
- * see: https://develop.sentry.dev/sdk/data-handling/#structuring-data
- */
 function getSanitizedUrlString(url) {
   const { protocol, host, path } = url;
-
-  const filteredHost =
-    host
-      // Always filter out authority
-      ?.replace(/^.*@/, '[filtered]:[filtered]@')
-      // Don't show standard :80 (http) and :443 (https) ports to reduce the noise
-      // TODO: Use new URL global if it exists
-      .replace(/(:80)$/, '')
-      .replace(/(:443)$/, '') || '';
-
-  return `${protocol ? `${protocol}://` : ''}${filteredHost}${path}`;
+  const filteredHost = host?.replace(/^.*@/, "[filtered]:[filtered]@").replace(/(:80)$/, "").replace(/(:443)$/, "") || "";
+  return `${protocol ? `${protocol}://` : ""}${filteredHost}${path}`;
 }
-
-/**
- * Strips the content from a data URL, returning a placeholder with the MIME type.
- *
- * Data URLs can be very long (e.g. base64 encoded scripts for Web Workers),
- * with little valuable information, often leading to envelopes getting dropped due
- * to size limit violations. Therefore, we strip data URLs and replace them with a
- * placeholder.
- *
- * @param url - The URL to process
- * @param includeDataPrefix - If true, includes the first 10 characters of the data stream
- *                            for debugging (e.g., to identify magic bytes like WASM's AGFzbQ).
- *                            Defaults to true.
- * @returns For data URLs, returns a short format like `data:text/javascript;base64,SGVsbG8gV2... [truncated]`.
- *          For non-data URLs, returns the original URL unchanged.
- */
 function stripDataUrlContent(url, includeDataPrefix = true) {
-  if (url.startsWith('data:')) {
-    // Match the MIME type (everything after 'data:' until the first ';' or ',')
+  if (url.startsWith("data:")) {
     const match = url.match(/^data:([^;,]+)/);
-    const mimeType = match ? match[1] : 'text/plain';
-    const isBase64 = url.includes(';base64,');
-
-    // Find where the actual data starts (after the comma)
-    const dataStart = url.indexOf(',');
-    let dataPrefix = '';
+    const mimeType = match ? match[1] : "text/plain";
+    const isBase64 = url.includes(";base64,");
+    const dataStart = url.indexOf(",");
+    let dataPrefix = "";
     if (includeDataPrefix && dataStart !== -1) {
       const data = url.slice(dataStart + 1);
-      // Include first 10 chars of data to help identify content (e.g., magic bytes)
       dataPrefix = data.length > 10 ? `${data.slice(0, 10)}... [truncated]` : data;
     }
-
-    return `data:${mimeType}${isBase64 ? ',base64' : ''}${dataPrefix ? `,${dataPrefix}` : ''}`;
+    return `data:${mimeType}${isBase64 ? ",base64" : ""}${dataPrefix ? `,${dataPrefix}` : ""}`;
   }
   return url;
 }

package/build/esm/utils/url.js.map

@@ -1 +1 @@
-{"version":3,"file":"url.js","sources":["../../../src/utils/url.ts"],"sourcesContent":["import {\n  SEMANTIC_ATTRIBUTE_HTTP_REQUEST_METHOD,\n  SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,\n  SEMANTIC_ATTRIBUTE_SENTRY_SOURCE,\n  SEMANTIC_ATTRIBUTE_URL_FULL,\n} from '../semanticAttributes';\nimport type { SpanAttributes } from '../types-hoist/span';\n\ntype PartialURL = {\n  host?: string;\n  path?: string;\n  protocol?: string;\n  relative?: string;\n  search?: string;\n  hash?: string;\n};\n\ninterface URLwithCanParse extends URL {\n  canParse: (url: string, base?: string | URL | undefined) => boolean;\n}\n\n// A subset of the URL object that is valid for relative URLs\n// The URL object cannot handle relative URLs, so we need to handle them separately\ntype RelativeURL = {\n  isRelative: true;\n  pathname: URL['pathname'];\n  search: URL['search'];\n  hash: URL['hash'];\n};\n\ntype URLObject = RelativeURL | URL;\n\n// Curious about `thismessage:/`? See: https://www.rfc-editor.org/rfc/rfc2557.html\n//  > When the methods above do not yield an absolute URI, a base URL\n//  > of \"thismessage:/\" MUST be employed. This base URL has been\n//  > defined for the sole purpose of resolving relative references\n//  > within a multipart/related structure when no other base URI is\n//  > specified.\n//\n// We need to provide a base URL to `parseStringToURLObject` because the fetch API gives us a\n// relative URL sometimes.\n//\n// This is the only case where we need to provide a base URL to `parseStringToURLObject`\n// because the relative URL is not valid on its own.\nconst DEFAULT_BASE_URL = 'thismessage:/';\n\n/**\n * Checks if the URL object is relative\n *\n * @param url - The URL object to check\n * @returns True if the URL object is relative, false otherwise\n */\nexport function isURLObjectRelative(url: URLObject): url is RelativeURL {\n  return 'isRelative' in url;\n}\n\n/**\n * Parses string to a URL object\n *\n * @param url - The URL to parse\n * @returns The parsed URL object or undefined if the URL is invalid\n */\nexport function parseStringToURLObject(url: string, urlBase?: string | URL | undefined): URLObject | undefined {\n  const isRelative = url.indexOf('://') <= 0 && url.indexOf('//') !== 0;\n  const base = urlBase ?? (isRelative ? DEFAULT_BASE_URL : undefined);\n  try {\n    // Use `canParse` to short-circuit the URL constructor if it's not a valid URL\n    // This is faster than trying to construct the URL and catching the error\n    // Node 20+, Chrome 120+, Firefox 115+, Safari 17+\n    if ('canParse' in URL && !(URL as unknown as URLwithCanParse).canParse(url, base)) {\n      return undefined;\n    }\n\n    const fullUrlObject = new URL(url, base);\n    if (isRelative) {\n      // Because we used a fake base URL, we need to return a relative URL object.\n      // We cannot return anything about the origin, host, etc. because it will refer to the fake base URL.\n      return {\n        isRelative,\n        pathname: fullUrlObject.pathname,\n        search: fullUrlObject.search,\n        hash: fullUrlObject.hash,\n      };\n    }\n    return fullUrlObject;\n  } catch {\n    // empty body\n  }\n\n  return undefined;\n}\n\n/**\n * Takes a URL object and returns a sanitized string which is safe to use as span name\n * see: https://develop.sentry.dev/sdk/data-handling/#structuring-data\n */\nexport function getSanitizedUrlStringFromUrlObject(url: URLObject): string {\n  if (isURLObjectRelative(url)) {\n    return url.pathname;\n  }\n\n  const newUrl = new URL(url);\n  newUrl.search = '';\n  newUrl.hash = '';\n  if (['80', '443'].includes(newUrl.port)) {\n    newUrl.port = '';\n  }\n  if (newUrl.password) {\n    newUrl.password = '%filtered%';\n  }\n  if (newUrl.username) {\n    newUrl.username = '%filtered%';\n  }\n\n  return newUrl.toString();\n}\n\ntype PartialRequest = {\n  method?: string;\n};\n\nfunction getHttpSpanNameFromUrlObject(\n  urlObject: URLObject | undefined,\n  kind: 'server' | 'client',\n  request?: PartialRequest,\n  routeName?: string,\n): string {\n  const method = request?.method?.toUpperCase() ?? 'GET';\n  const route = routeName\n    ? routeName\n    : urlObject\n      ? kind === 'client'\n        ? getSanitizedUrlStringFromUrlObject(urlObject)\n        : urlObject.pathname\n      : '/';\n\n  return `${method} ${route}`;\n}\n\n/**\n * Takes a parsed URL object and returns a set of attributes for the span\n * that represents the HTTP request for that url. This is used for both server\n * and client http spans.\n *\n * Follows https://opentelemetry.io/docs/specs/semconv/http/.\n *\n * @param urlObject - see {@link parseStringToURLObject}\n * @param kind - The type of HTTP operation (server or client)\n * @param spanOrigin - The origin of the span\n * @param request - The request object, see {@link PartialRequest}\n * @param routeName - The name of the route, must be low cardinality\n * @returns The span name and attributes for the HTTP operation\n */\nexport function getHttpSpanDetailsFromUrlObject(\n  urlObject: URLObject | undefined,\n  kind: 'server' | 'client',\n  spanOrigin: string,\n  request?: PartialRequest,\n  routeName?: string,\n): [name: string, attributes: SpanAttributes] {\n  const attributes: SpanAttributes = {\n    [SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN]: spanOrigin,\n    [SEMANTIC_ATTRIBUTE_SENTRY_SOURCE]: 'url',\n  };\n\n  if (routeName) {\n    // This is based on https://opentelemetry.io/docs/specs/semconv/http/http-spans/#name\n    attributes[kind === 'server' ? 'http.route' : 'url.template'] = routeName;\n    attributes[SEMANTIC_ATTRIBUTE_SENTRY_SOURCE] = 'route';\n  }\n\n  if (request?.method) {\n    attributes[SEMANTIC_ATTRIBUTE_HTTP_REQUEST_METHOD] = request.method.toUpperCase();\n  }\n\n  if (urlObject) {\n    if (urlObject.search) {\n      attributes['url.query'] = urlObject.search;\n    }\n    if (urlObject.hash) {\n      attributes['url.fragment'] = urlObject.hash;\n    }\n    if (urlObject.pathname) {\n      attributes['url.path'] = urlObject.pathname;\n      if (urlObject.pathname === '/') {\n        attributes[SEMANTIC_ATTRIBUTE_SENTRY_SOURCE] = 'route';\n      }\n    }\n\n    if (!isURLObjectRelative(urlObject)) {\n      attributes[SEMANTIC_ATTRIBUTE_URL_FULL] = urlObject.href;\n      if (urlObject.port) {\n        attributes['url.port'] = urlObject.port;\n      }\n      if (urlObject.protocol) {\n        attributes['url.scheme'] = urlObject.protocol;\n      }\n      if (urlObject.hostname) {\n        attributes[kind === 'server' ? 'server.address' : 'url.domain'] = urlObject.hostname;\n      }\n    }\n  }\n\n  return [getHttpSpanNameFromUrlObject(urlObject, kind, request, routeName), attributes];\n}\n\n/**\n * Parses string form of URL into an object\n * // borrowed from https://tools.ietf.org/html/rfc3986#appendix-B\n * // intentionally using regex and not <a/> href parsing trick because React Native and other\n * // environments where DOM might not be available\n * @returns parsed URL object\n */\nexport function parseUrl(url: string): PartialURL {\n  if (!url) {\n    return {};\n  }\n\n  const match = url.match(/^(([^:/?#]+):)?(\\/\\/([^/?#]*))?([^?#]*)(\\?([^#]*))?(#(.*))?$/);\n\n  if (!match) {\n    return {};\n  }\n\n  // coerce to undefined values to empty string so we don't get 'undefined'\n  const query = match[6] || '';\n  const fragment = match[8] || '';\n  return {\n    host: match[4],\n    path: match[5],\n    protocol: match[2],\n    search: query,\n    hash: fragment,\n    relative: match[5] + query + fragment, // everything minus origin\n  };\n}\n\n/**\n * Strip the query string and fragment off of a given URL or path (if present)\n *\n * @param urlPath Full URL or path, including possible query string and/or fragment\n * @returns URL or path without query string or fragment\n */\nexport function stripUrlQueryAndFragment(urlPath: string): string {\n  return (urlPath.split(/[?#]/, 1) as [string, ...string[]])[0];\n}\n\n/**\n * Takes a URL object and returns a sanitized string which is safe to use as span name\n * see: https://develop.sentry.dev/sdk/data-handling/#structuring-data\n */\nexport function getSanitizedUrlString(url: PartialURL): string {\n  const { protocol, host, path } = url;\n\n  const filteredHost =\n    host\n      // Always filter out authority\n      ?.replace(/^.*@/, '[filtered]:[filtered]@')\n      // Don't show standard :80 (http) and :443 (https) ports to reduce the noise\n      // TODO: Use new URL global if it exists\n      .replace(/(:80)$/, '')\n      .replace(/(:443)$/, '') || '';\n\n  return `${protocol ? `${protocol}://` : ''}${filteredHost}${path}`;\n}\n\n/**\n * Strips the content from a data URL, returning a placeholder with the MIME type.\n *\n * Data URLs can be very long (e.g. base64 encoded scripts for Web Workers),\n * with little valuable information, often leading to envelopes getting dropped due\n * to size limit violations. Therefore, we strip data URLs and replace them with a\n * placeholder.\n *\n * @param url - The URL to process\n * @param includeDataPrefix - If true, includes the first 10 characters of the data stream\n *                            for debugging (e.g., to identify magic bytes like WASM's AGFzbQ).\n *                            Defaults to true.\n * @returns For data URLs, returns a short format like `data:text/javascript;base64,SGVsbG8gV2... [truncated]`.\n *          For non-data URLs, returns the original URL unchanged.\n */\nexport function stripDataUrlContent(url: string, includeDataPrefix: boolean = true): string {\n  if (url.startsWith('data:')) {\n    // Match the MIME type (everything after 'data:' until the first ';' or ',')\n    const match = url.match(/^data:([^;,]+)/);\n    const mimeType = match ? match[1] : 'text/plain';\n    const isBase64 = url.includes(';base64,');\n\n    // Find where the actual data starts (after the comma)\n    const dataStart = url.indexOf(',');\n    let dataPrefix = '';\n    if (includeDataPrefix && dataStart !== -1) {\n      const data = url.slice(dataStart + 1);\n      // Include first 10 chars of data to help identify content (e.g., magic bytes)\n      dataPrefix = data.length > 10 ? `${data.slice(0, 10)}... [truncated]` : data;\n    }\n\n    return `data:${mimeType}${isBase64 ? ',base64' : ''}${dataPrefix ? `,${dataPrefix}` : ''}`;\n  }\n  return url;\n}\n"],"names":[],"mappings":";;AAgCA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,MAAM,gBAAA,GAAmB,eAAe;;AAExC;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,mBAAmB,CAAC,GAAG,EAAiC;AACxE,EAAE,OAAO,YAAA,IAAgB,GAAG;AAC5B;;AAEA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,sBAAsB,CAAC,GAAG,EAAU,OAAO,EAAoD;AAC/G,EAAE,MAAM,UAAA,GAAa,GAAG,CAAC,OAAO,CAAC,KAAK,CAAA,IAAK,CAAA,IAAK,GAAG,CAAC,OAAO,CAAC,IAAI,CAAA,KAAM,CAAC;AACvE,EAAE,MAAM,IAAA,GAAO,OAAA,KAAY,UAAA,GAAa,gBAAA,GAAmB,SAAS,CAAC;AACrE,EAAE,IAAI;AACN;AACA;AACA;AACA,IAAI,IAAI,UAAA,IAAc,GAAA,IAAO,CAAC,CAAC,GAAA,GAAmC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE;AACvF,MAAM,OAAO,SAAS;AACtB,IAAI;;AAEJ,IAAI,MAAM,gBAAgB,IAAI,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC;AAC5C,IAAI,IAAI,UAAU,EAAE;AACpB;AACA;AACA,MAAM,OAAO;AACb,QAAQ,UAAU;AAClB,QAAQ,QAAQ,EAAE,aAAa,CAAC,QAAQ;AACxC,QAAQ,MAAM,EAAE,aAAa,CAAC,MAAM;AACpC,QAAQ,IAAI,EAAE,aAAa,CAAC,IAAI;AAChC,OAAO;AACP,IAAI;AACJ,IAAI,OAAO,aAAa;AACxB,EAAE,EAAE,MAAM;AACV;AACA,EAAE;;AAEF,EAAE,OAAO,SAAS;AAClB;;AAEA;AACA;AACA;AACA;AACO,SAAS,kCAAkC,CAAC,GAAG,EAAqB;AAC3E,EAAE,IAAI,mBAAmB,CAAC,GAAG,CAAC,EAAE;AAChC,IAAI,OAAO,GAAG,CAAC,QAAQ;AACvB,EAAE;;AAEF,EAAE,MAAM,MAAA,GAAS,IAAI,GAAG,CAAC,GAAG,CAAC;AAC7B,EAAE,MAAM,CAAC,MAAA,GAAS,EAAE;AACpB,EAAE,MAAM,CAAC,IAAA,GAAO,EAAE;AAClB,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;AAC3C,IAAI,MAAM,CAAC,IAAA,GAAO,EAAE;AACpB,EAAE;AACF,EAAE,IAAI,MAAM,CAAC,QAAQ,EAAE;AACvB,IAAI,MAAM,CAAC,QAAA,GAAW,YAAY;AAClC,EAAE;AACF,EAAE,IAAI,MAAM,CAAC,QAAQ,EAAE;AACvB,IAAI,MAAM,CAAC,QAAA,GAAW,YAAY;AAClC,EAAE;;AAEF,EAAE,OAAO,MAAM,CAAC,QAAQ,EAAE;AAC1B;;AAMA,SAAS,4BAA4B;AACrC,EAAE,SAAS;AACX,EAAE,IAAI;AACN,EAAE,OAAO;AACT,EAAE,SAAS;AACX,EAAU;AACV,EAAE,MAAM,MAAA,GAAS,OAAO,EAAE,MAAM,EAAE,WAAW,EAAC,IAAK,KAAK;AACxD,EAAE,MAAM,QAAQ;AAChB,MAAM;AACN,MAAM;AACN,QAAQ,SAAS;AACjB,UAAU,kCAAkC,CAAC,SAAS;AACtD,UAAU,SAAS,CAAC;AACpB,QAAQ,GAAG;;AAEX,EAAE,OAAO,CAAC,EAAA,MAAA,CAAA,CAAA,EAAA,KAAA,CAAA,CAAA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAA,+BAAA;AACA,EAAA,SAAA;AACA,EAAA,IAAA;AACA,EAAA,UAAA;AACA,EAAA,OAAA;AACA,EAAA,SAAA;AACA,EAAA;AACA,EAAA,MAAA,UAAA,GAAA;AACA,IAAA,CAAA,gCAAA,GAAA,UAAA;AACA,IAAA,CAAA,gCAAA,GAAA,KAAA;AACA,GAAA;;AAEA,EAAA,IAAA,SAAA,EAAA;AACA;AACA,IAAA,UAAA,CAAA,IAAA,KAAA,QAAA,GAAA,YAAA,GAAA,cAAA,CAAA,GAAA,SAAA;AACA,IAAA,UAAA,CAAA,gCAAA,CAAA,GAAA,OAAA;AACA,EAAA;;AAEA,EAAA,IAAA,OAAA,EAAA,MAAA,EAAA;AACA,IAAA,UAAA,CAAA,sCAAA,CAAA,GAAA,OAAA,CAAA,MAAA,CAAA,WAAA,EAAA;AACA,EAAA;;AAEA,EAAA,IAAA,SAAA,EAAA;AACA,IAAA,IAAA,SAAA,CAAA,MAAA,EAAA;AACA,MAAA,UAAA,CAAA,WAAA,CAAA,GAAA,SAAA,CAAA,MAAA;AACA,IAAA;AACA,IAAA,IAAA,SAAA,CAAA,IAAA,EAAA;AACA,MAAA,UAAA,CAAA,cAAA,CAAA,GAAA,SAAA,CAAA,IAAA;AACA,IAAA;AACA,IAAA,IAAA,SAAA,CAAA,QAAA,EAAA;AACA,MAAA,UAAA,CAAA,UAAA,CAAA,GAAA,SAAA,CAAA,QAAA;AACA,MAAA,IAAA,SAAA,CAAA,QAAA,KAAA,GAAA,EAAA;AACA,QAAA,UAAA,CAAA,gCAAA,CAAA,GAAA,OAAA;AACA,MAAA;AACA,IAAA;;AAEA,IAAA,IAAA,CAAA,mBAAA,CAAA,SAAA,CAAA,EAAA;AACA,MAAA,UAAA,CAAA,2BAAA,CAAA,GAAA,SAAA,CAAA,IAAA;AACA,MAAA,IAAA,SAAA,CAAA,IAAA,EAAA;AACA,QAAA,UAAA,CAAA,UAAA,CAAA,GAAA,SAAA,CAAA,IAAA;AACA,MAAA;AACA,MAAA,IAAA,SAAA,CAAA,QAAA,EAAA;AACA,QAAA,UAAA,CAAA,YAAA,CAAA,GAAA,SAAA,CAAA,QAAA;AACA,MAAA;AACA,MAAA,IAAA,SAAA,CAAA,QAAA,EAAA;AACA,QAAA,UAAA,CAAA,IAAA,KAAA,QAAA,GAAA,gBAAA,GAAA,YAAA,CAAA,GAAA,SAAA,CAAA,QAAA;AACA,MAAA;AACA,IAAA;AACA,EAAA;;AAEA,EAAA,OAAA,CAAA,4BAAA,CAAA,SAAA,EAAA,IAAA,EAAA,OAAA,EAAA,SAAA,CAAA,EAAA,UAAA,CAAA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAA,QAAA,CAAA,GAAA,EAAA;AACA,EAAA,IAAA,CAAA,GAAA,EAAA;AACA,IAAA,OAAA,EAAA;AACA,EAAA;;AAEA,EAAA,MAAA,KAAA,GAAA,GAAA,CAAA,KAAA,CAAA,8DAAA,CAAA;;AAEA,EAAA,IAAA,CAAA,KAAA,EAAA;AACA,IAAA,OAAA,EAAA;AACA,EAAA;;AAEA;AACA,EAAA,MAAA,KAAA,GAAA,KAAA,CAAA,CAAA,CAAA,IAAA,EAAA;AACA,EAAA,MAAA,QAAA,GAAA,KAAA,CAAA,CAAA,CAAA,IAAA,EAAA;AACA,EAAA,OAAA;AACA,IAAA,IAAA,EAAA,KAAA,CAAA,CAAA,CAAA;AACA,IAAA,IAAA,EAAA,KAAA,CAAA,CAAA,CAAA;AACA,IAAA,QAAA,EAAA,KAAA,CAAA,CAAA,CAAA;AACA,IAAA,MAAA,EAAA,KAAA;AACA,IAAA,IAAA,EAAA,QAAA;AACA,IAAA,QAAA,EAAA,KAAA,CAAA,CAAA,CAAA,GAAA,KAAA,GAAA,QAAA;AACA,GAAA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA,SAAA,wBAAA,CAAA,OAAA,EAAA;AACA,EAAA,OAAA,CAAA,OAAA,CAAA,KAAA,CAAA,MAAA,EAAA,CAAA,CAAA,GAAA,CAAA,CAAA;AACA;;AAEA;AACA;AACA;AACA;AACA,SAAA,qBAAA,CAAA,GAAA,EAAA;AACA,EAAA,MAAA,EAAA,QAAA,EAAA,IAAA,EAAA,IAAA,EAAA,GAAA,GAAA;;AAEA,EAAA,MAAA,YAAA;AACA,IAAA;AACA;AACA,QAAA,OAAA,CAAA,MAAA,EAAA,wBAAA;AACA;AACA;AACA,OAAA,OAAA,CAAA,QAAA,EAAA,EAAA;AACA,OAAA,OAAA,CAAA,SAAA,EAAA,EAAA,CAAA,IAAA,EAAA;;AAEA,EAAA,OAAA,CAAA,EAAA,QAAA,GAAA,CAAA,EAAA,QAAA,CAAA,GAAA,CAAA,GAAA,EAAA,CAAA,EAAA,YAAA,CAAA,EAAA,IAAA,CAAA,CAAA;AACA;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAA,mBAAA,CAAA,GAAA,EAAA,iBAAA,GAAA,IAAA,EAAA;AACA,EAAA,IAAA,GAAA,CAAA,UAAA,CAAA,OAAA,CAAA,EAAA;AACA;AACA,IAAA,MAAA,KAAA,GAAA,GAAA,CAAA,KAAA,CAAA,gBAAA,CAAA;AACA,IAAA,MAAA,QAAA,GAAA,KAAA,GAAA,KAAA,CAAA,CAAA,CAAA,GAAA,YAAA;AACA,IAAA,MAAA,QAAA,GAAA,GAAA,CAAA,QAAA,CAAA,UAAA,CAAA;;AAEA;AACA,IAAA,MAAA,SAAA,GAAA,GAAA,CAAA,OAAA,CAAA,GAAA,CAAA;AACA,IAAA,IAAA,UAAA,GAAA,EAAA;AACA,IAAA,IAAA,iBAAA,IAAA,SAAA,KAAA,EAAA,EAAA;AACA,MAAA,MAAA,IAAA,GAAA,GAAA,CAAA,KAAA,CAAA,SAAA,GAAA,CAAA,CAAA;AACA;AACA,MAAA,UAAA,GAAA,IAAA,CAAA,MAAA,GAAA,EAAA,GAAA,CAAA,EAAA,IAAA,CAAA,KAAA,CAAA,CAAA,EAAA,EAAA,CAAA,CAAA,eAAA,CAAA,GAAA,IAAA;AACA,IAAA;;AAEA,IAAA,OAAA,CAAA,KAAA,EAAA,QAAA,CAAA,EAAA,QAAA,GAAA,SAAA,GAAA,EAAA,CAAA,EAAA,UAAA,GAAA,CAAA,CAAA,EAAA,UAAA,CAAA,CAAA,GAAA,EAAA,CAAA,CAAA;AACA,EAAA;AACA,EAAA,OAAA,GAAA;AACA;;;;"}
+{"version":3,"file":"url.js","sources":["../../../src/utils/url.ts"],"sourcesContent":["import {\n  SEMANTIC_ATTRIBUTE_HTTP_REQUEST_METHOD,\n  SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,\n  SEMANTIC_ATTRIBUTE_SENTRY_SOURCE,\n  SEMANTIC_ATTRIBUTE_URL_FULL,\n} from '../semanticAttributes';\nimport type { SpanAttributes } from '../types/span';\n\ntype PartialURL = {\n  host?: string;\n  path?: string;\n  protocol?: string;\n  relative?: string;\n  search?: string;\n  hash?: string;\n};\n\ninterface URLwithCanParse extends URL {\n  canParse: (url: string, base?: string | URL | undefined) => boolean;\n}\n\n// A subset of the URL object that is valid for relative URLs\n// The URL object cannot handle relative URLs, so we need to handle them separately\ntype RelativeURL = {\n  isRelative: true;\n  pathname: URL['pathname'];\n  search: URL['search'];\n  hash: URL['hash'];\n};\n\ntype URLObject = RelativeURL | URL;\n\n// Curious about `thismessage:/`? See: https://www.rfc-editor.org/rfc/rfc2557.html\n//  > When the methods above do not yield an absolute URI, a base URL\n//  > of \"thismessage:/\" MUST be employed. This base URL has been\n//  > defined for the sole purpose of resolving relative references\n//  > within a multipart/related structure when no other base URI is\n//  > specified.\n//\n// We need to provide a base URL to `parseStringToURLObject` because the fetch API gives us a\n// relative URL sometimes.\n//\n// This is the only case where we need to provide a base URL to `parseStringToURLObject`\n// because the relative URL is not valid on its own.\nconst DEFAULT_BASE_URL = 'thismessage:/';\n\n/**\n * Checks if the URL object is relative\n *\n * @param url - The URL object to check\n * @returns True if the URL object is relative, false otherwise\n */\nexport function isURLObjectRelative(url: URLObject): url is RelativeURL {\n  return 'isRelative' in url;\n}\n\n/**\n * Parses string to a URL object\n *\n * @param url - The URL to parse\n * @returns The parsed URL object or undefined if the URL is invalid\n */\nexport function parseStringToURLObject(url: string, urlBase?: string | URL | undefined): URLObject | undefined {\n  const isRelative = url.indexOf('://') <= 0 && url.indexOf('//') !== 0;\n  const base = urlBase ?? (isRelative ? DEFAULT_BASE_URL : undefined);\n  try {\n    // Use `canParse` to short-circuit the URL constructor if it's not a valid URL\n    // This is faster than trying to construct the URL and catching the error\n    // Node 20+, Chrome 120+, Firefox 115+, Safari 17+\n    if ('canParse' in URL && !(URL as unknown as URLwithCanParse).canParse(url, base)) {\n      return undefined;\n    }\n\n    const fullUrlObject = new URL(url, base);\n    if (isRelative) {\n      // Because we used a fake base URL, we need to return a relative URL object.\n      // We cannot return anything about the origin, host, etc. because it will refer to the fake base URL.\n      return {\n        isRelative,\n        pathname: fullUrlObject.pathname,\n        search: fullUrlObject.search,\n        hash: fullUrlObject.hash,\n      };\n    }\n    return fullUrlObject;\n  } catch {\n    // empty body\n  }\n\n  return undefined;\n}\n\n/**\n * Takes a URL object and returns a sanitized string which is safe to use as span name\n * see: https://develop.sentry.dev/sdk/data-handling/#structuring-data\n */\nexport function getSanitizedUrlStringFromUrlObject(url: URLObject): string {\n  if (isURLObjectRelative(url)) {\n    return url.pathname;\n  }\n\n  const newUrl = new URL(url);\n  newUrl.search = '';\n  newUrl.hash = '';\n  if (['80', '443'].includes(newUrl.port)) {\n    newUrl.port = '';\n  }\n  if (newUrl.password) {\n    newUrl.password = '%filtered%';\n  }\n  if (newUrl.username) {\n    newUrl.username = '%filtered%';\n  }\n\n  return newUrl.toString();\n}\n\ntype PartialRequest = {\n  method?: string;\n};\n\nfunction getHttpSpanNameFromUrlObject(\n  urlObject: URLObject | undefined,\n  kind: 'server' | 'client',\n  request?: PartialRequest,\n  routeName?: string,\n): string {\n  const method = request?.method?.toUpperCase() ?? 'GET';\n  const route = routeName\n    ? routeName\n    : urlObject\n      ? kind === 'client'\n        ? getSanitizedUrlStringFromUrlObject(urlObject)\n        : urlObject.pathname\n      : '/';\n\n  return `${method} ${route}`;\n}\n\n/**\n * Takes a parsed URL object and returns a set of attributes for the span\n * that represents the HTTP request for that url. This is used for both server\n * and client http spans.\n *\n * Follows https://opentelemetry.io/docs/specs/semconv/http/.\n *\n * @param urlObject - see {@link parseStringToURLObject}\n * @param kind - The type of HTTP operation (server or client)\n * @param spanOrigin - The origin of the span\n * @param request - The request object, see {@link PartialRequest}\n * @param routeName - The name of the route, must be low cardinality\n * @returns The span name and attributes for the HTTP operation\n */\nexport function getHttpSpanDetailsFromUrlObject(\n  urlObject: URLObject | undefined,\n  kind: 'server' | 'client',\n  spanOrigin: string,\n  request?: PartialRequest,\n  routeName?: string,\n): [name: string, attributes: SpanAttributes] {\n  const attributes: SpanAttributes = {\n    [SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN]: spanOrigin,\n    [SEMANTIC_ATTRIBUTE_SENTRY_SOURCE]: 'url',\n  };\n\n  if (routeName) {\n    // This is based on https://opentelemetry.io/docs/specs/semconv/http/http-spans/#name\n    attributes[kind === 'server' ? 'http.route' : 'url.template'] = routeName;\n    attributes[SEMANTIC_ATTRIBUTE_SENTRY_SOURCE] = 'route';\n  }\n\n  if (request?.method) {\n    attributes[SEMANTIC_ATTRIBUTE_HTTP_REQUEST_METHOD] = request.method.toUpperCase();\n  }\n\n  if (urlObject) {\n    if (urlObject.search) {\n      attributes['url.query'] = urlObject.search;\n    }\n    if (urlObject.hash) {\n      attributes['url.fragment'] = urlObject.hash;\n    }\n    if (urlObject.pathname) {\n      attributes['url.path'] = urlObject.pathname;\n      if (urlObject.pathname === '/') {\n        attributes[SEMANTIC_ATTRIBUTE_SENTRY_SOURCE] = 'route';\n      }\n    }\n\n    if (!isURLObjectRelative(urlObject)) {\n      attributes[SEMANTIC_ATTRIBUTE_URL_FULL] = urlObject.href;\n      if (urlObject.port) {\n        attributes['url.port'] = urlObject.port;\n      }\n      if (urlObject.protocol) {\n        attributes['url.scheme'] = urlObject.protocol;\n      }\n      if (urlObject.hostname) {\n        attributes[kind === 'server' ? 'server.address' : 'url.domain'] = urlObject.hostname;\n      }\n    }\n  }\n\n  return [getHttpSpanNameFromUrlObject(urlObject, kind, request, routeName), attributes];\n}\n\n/**\n * Parses string form of URL into an object\n * // borrowed from https://tools.ietf.org/html/rfc3986#appendix-B\n * // intentionally using regex and not <a/> href parsing trick because React Native and other\n * // environments where DOM might not be available\n * @returns parsed URL object\n */\nexport function parseUrl(url: string): PartialURL {\n  if (!url) {\n    return {};\n  }\n\n  const match = url.match(/^(([^:/?#]+):)?(\\/\\/([^/?#]*))?([^?#]*)(\\?([^#]*))?(#(.*))?$/);\n\n  if (!match) {\n    return {};\n  }\n\n  // coerce to undefined values to empty string so we don't get 'undefined'\n  const query = match[6] || '';\n  const fragment = match[8] || '';\n  return {\n    host: match[4],\n    path: match[5],\n    protocol: match[2],\n    search: query,\n    hash: fragment,\n    relative: match[5] + query + fragment, // everything minus origin\n  };\n}\n\n/**\n * Strip the query string and fragment off of a given URL or path (if present)\n *\n * @param urlPath Full URL or path, including possible query string and/or fragment\n * @returns URL or path without query string or fragment\n */\nexport function stripUrlQueryAndFragment(urlPath: string): string {\n  return (urlPath.split(/[?#]/, 1) as [string, ...string[]])[0];\n}\n\n/**\n * Takes a URL object and returns a sanitized string which is safe to use as span name\n * see: https://develop.sentry.dev/sdk/data-handling/#structuring-data\n */\nexport function getSanitizedUrlString(url: PartialURL): string {\n  const { protocol, host, path } = url;\n\n  const filteredHost =\n    host\n      // Always filter out authority\n      ?.replace(/^.*@/, '[filtered]:[filtered]@')\n      // Don't show standard :80 (http) and :443 (https) ports to reduce the noise\n      // TODO: Use new URL global if it exists\n      .replace(/(:80)$/, '')\n      .replace(/(:443)$/, '') || '';\n\n  return `${protocol ? `${protocol}://` : ''}${filteredHost}${path}`;\n}\n\n/**\n * Strips the content from a data URL, returning a placeholder with the MIME type.\n *\n * Data URLs can be very long (e.g. base64 encoded scripts for Web Workers),\n * with little valuable information, often leading to envelopes getting dropped due\n * to size limit violations. Therefore, we strip data URLs and replace them with a\n * placeholder.\n *\n * @param url - The URL to process\n * @param includeDataPrefix - If true, includes the first 10 characters of the data stream\n *                            for debugging (e.g., to identify magic bytes like WASM's AGFzbQ).\n *                            Defaults to true.\n * @returns For data URLs, returns a short format like `data:text/javascript;base64,SGVsbG8gV2... [truncated]`.\n *          For non-data URLs, returns the original URL unchanged.\n */\nexport function stripDataUrlContent(url: string, includeDataPrefix: boolean = true): string {\n  if (url.startsWith('data:')) {\n    // Match the MIME type (everything after 'data:' until the first ';' or ',')\n    const match = url.match(/^data:([^;,]+)/);\n    const mimeType = match ? match[1] : 'text/plain';\n    const isBase64 = url.includes(';base64,');\n\n    // Find where the actual data starts (after the comma)\n    const dataStart = url.indexOf(',');\n    let dataPrefix = '';\n    if (includeDataPrefix && dataStart !== -1) {\n      const data = url.slice(dataStart + 1);\n      // Include first 10 chars of data to help identify content (e.g., magic bytes)\n      dataPrefix = data.length > 10 ? `${data.slice(0, 10)}... [truncated]` : data;\n    }\n\n    return `data:${mimeType}${isBase64 ? ',base64' : ''}${dataPrefix ? `,${dataPrefix}` : ''}`;\n  }\n  return url;\n}\n"],"names":[],"mappings":";;AA4CA,MAAM,gBAAA,GAAmB,eAAA;AAQlB,SAAS,oBAAoB,GAAA,EAAoC;AACtE,EAAA,OAAO,YAAA,IAAgB,GAAA;AACzB;AAQO,SAAS,sBAAA,CAAuB,KAAa,OAAA,EAA2D;AAC7G,EAAA,MAAM,UAAA,GAAa,IAAI,OAAA,CAAQ,KAAK,KAAK,CAAA,IAAK,GAAA,CAAI,OAAA,CAAQ,IAAI,CAAA,KAAM,CAAA;AACpE,EAAA,MAAM,IAAA,GAAO,OAAA,KAAY,UAAA,GAAa,gBAAA,GAAmB,MAAA,CAAA;AACzD,EAAA,IAAI;AAIF,IAAA,IAAI,cAAc,GAAA,IAAO,CAAE,IAAmC,QAAA,CAAS,GAAA,EAAK,IAAI,CAAA,EAAG;AACjF,MAAA,OAAO,KAAA,CAAA;AAAA,IACT;AAEA,IAAA,MAAM,aAAA,GAAgB,IAAI,GAAA,CAAI,GAAA,EAAK,IAAI,CAAA;AACvC,IAAA,IAAI,UAAA,EAAY;AAGd,MAAA,OAAO;AAAA,QACL,UAAA;AAAA,QACA,UAAU,aAAA,CAAc,QAAA;AAAA,QACxB,QAAQ,aAAA,CAAc,MAAA;AAAA,QACtB,MAAM,aAAA,CAAc;AAAA,OACtB;AAAA,IACF;AACA,IAAA,OAAO,aAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,OAAO,MAAA;AACT;AAMO,SAAS,mCAAmC,GAAA,EAAwB;AACzE,EAAA,IAAI,mBAAA,CAAoB,GAAG,CAAA,EAAG;AAC5B,IAAA,OAAO,GAAA,CAAI,QAAA;AAAA,EACb;AAEA,EAAA,MAAM,MAAA,GAAS,IAAI,GAAA,CAAI,GAAG,CAAA;AAC1B,EAAA,MAAA,CAAO,MAAA,GAAS,EAAA;AAChB,EAAA,MAAA,CAAO,IAAA,GAAO,EAAA;AACd,EAAA,IAAI,CAAC,IAAA,EAAM,KAAK,EAAE,QAAA,CAAS,MAAA,CAAO,IAAI,CAAA,EAAG;AACvC,IAAA,MAAA,CAAO,IAAA,GAAO,EAAA;AAAA,EAChB;AACA,EAAA,IAAI,OAAO,QAAA,EAAU;AACnB,IAAA,MAAA,CAAO,QAAA,GAAW,YAAA;AAAA,EACpB;AACA,EAAA,IAAI,OAAO,QAAA,EAAU;AACnB,IAAA,MAAA,CAAO,QAAA,GAAW,YAAA;AAAA,EACpB;AAEA,EAAA,OAAO,OAAO,QAAA,EAAS;AACzB;AAMA,SAAS,4BAAA,CACP,SAAA,EACA,IAAA,EACA,OAAA,EACA,SAAA,EACQ;AACR,EAAA,MAAM,MAAA,GAAS,OAAA,EAAS,MAAA,EAAQ,WAAA,EAAY,IAAK,KAAA;AACjD,EAAA,MAAM,KAAA,GAAQ,SAAA,GACV,SAAA,GACA,SAAA,GACE,IAAA,KAAS,WACP,kCAAA,CAAmC,SAAS,CAAA,GAC5C,SAAA,CAAU,QAAA,GACZ,GAAA;AAEN,EAAA,OAAO,CAAA,EAAG,MAAM,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA;AAC3B;AAgBO,SAAS,+BAAA,CACd,SAAA,EACA,IAAA,EACA,UAAA,EACA,SACA,SAAA,EAC4C;AAC5C,EAAA,MAAM,UAAA,GAA6B;AAAA,IACjC,CAAC,gCAAgC,GAAG,UAAA;AAAA,IACpC,CAAC,gCAAgC,GAAG;AAAA,GACtC;AAEA,EAAA,IAAI,SAAA,EAAW;AAEb,IAAA,UAAA,CAAW,IAAA,KAAS,QAAA,GAAW,YAAA,GAAe,cAAc,CAAA,GAAI,SAAA;AAChE,IAAA,UAAA,CAAW,gCAAgC,CAAA,GAAI,OAAA;AAAA,EACjD;AAEA,EAAA,IAAI,SAAS,MAAA,EAAQ;AACnB,IAAA,UAAA,CAAW,sCAAsC,CAAA,GAAI,OAAA,CAAQ,MAAA,CAAO,WAAA,EAAY;AAAA,EAClF;AAEA,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,IAAI,UAAU,MAAA,EAAQ;AACpB,MAAA,UAAA,CAAW,WAAW,IAAI,SAAA,CAAU,MAAA;AAAA,IACtC;AACA,IAAA,IAAI,UAAU,IAAA,EAAM;AAClB,MAAA,UAAA,CAAW,cAAc,IAAI,SAAA,CAAU,IAAA;AAAA,IACzC;AACA,IAAA,IAAI,UAAU,QAAA,EAAU;AACtB,MAAA,UAAA,CAAW,UAAU,IAAI,SAAA,CAAU,QAAA;AACnC,MAAA,IAAI,SAAA,CAAU,aAAa,GAAA,EAAK;AAC9B,QAAA,UAAA,CAAW,gCAAgC,CAAA,GAAI,OAAA;AAAA,MACjD;AAAA,IACF;AAEA,IAAA,IAAI,CAAC,mBAAA,CAAoB,SAAS,CAAA,EAAG;AACnC,MAAA,UAAA,CAAW,2BAA2B,IAAI,SAAA,CAAU,IAAA;AACpD,MAAA,IAAI,UAAU,IAAA,EAAM;AAClB,QAAA,UAAA,CAAW,UAAU,IAAI,SAAA,CAAU,IAAA;AAAA,MACrC;AACA,MAAA,IAAI,UAAU,QAAA,EAAU;AACtB,QAAA,UAAA,CAAW,YAAY,IAAI,SAAA,CAAU,QAAA;AAAA,MACvC;AACA,MAAA,IAAI,UAAU,QAAA,EAAU;AACtB,QAAA,UAAA,CAAW,IAAA,KAAS,QAAA,GAAW,gBAAA,GAAmB,YAAY,IAAI,SAAA,CAAU,QAAA;AAAA,MAC9E;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,CAAC,4BAAA,CAA6B,SAAA,EAAW,MAAM,OAAA,EAAS,SAAS,GAAG,UAAU,CAAA;AACvF;AASO,SAAS,SAAS,GAAA,EAAyB;AAChD,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,OAAO,EAAC;AAAA,EACV;AAEA,EAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,8DAA8D,CAAA;AAEtF,EAAA,IAAI,CAAC,KAAA,EAAO;AACV,IAAA,OAAO,EAAC;AAAA,EACV;AAGA,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA;AAC1B,EAAA,MAAM,QAAA,GAAW,KAAA,CAAM,CAAC,CAAA,IAAK,EAAA;AAC7B,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,MAAM,CAAC,CAAA;AAAA,IACb,IAAA,EAAM,MAAM,CAAC,CAAA;AAAA,IACb,QAAA,EAAU,MAAM,CAAC,CAAA;AAAA,IACjB,MAAA,EAAQ,KAAA;AAAA,IACR,IAAA,EAAM,QAAA;AAAA,IACN,QAAA,EAAU,KAAA,CAAM,CAAC,CAAA,GAAI,KAAA,GAAQ;AAAA;AAAA,GAC/B;AACF;AAQO,SAAS,yBAAyB,OAAA,EAAyB;AAChE,EAAA,OAAQ,OAAA,CAAQ,KAAA,CAAM,MAAA,EAAQ,CAAC,EAA4B,CAAC,CAAA;AAC9D;AAMO,SAAS,sBAAsB,GAAA,EAAyB;AAC7D,EAAA,MAAM,EAAE,QAAA,EAAU,IAAA,EAAM,IAAA,EAAK,GAAI,GAAA;AAEjC,EAAA,MAAM,YAAA,GACJ,IAAA,EAEI,OAAA,CAAQ,MAAA,EAAQ,wBAAwB,CAAA,CAGzC,OAAA,CAAQ,QAAA,EAAU,EAAE,CAAA,CACpB,OAAA,CAAQ,SAAA,EAAW,EAAE,CAAA,IAAK,EAAA;AAE/B,EAAA,OAAO,CAAA,EAAG,WAAW,CAAA,EAAG,QAAQ,QAAQ,EAAE,CAAA,EAAG,YAAY,CAAA,EAAG,IAAI,CAAA,CAAA;AAClE;AAiBO,SAAS,mBAAA,CAAoB,GAAA,EAAa,iBAAA,GAA6B,IAAA,EAAc;AAC1F,EAAA,IAAI,GAAA,CAAI,UAAA,CAAW,OAAO,CAAA,EAAG;AAE3B,IAAA,MAAM,KAAA,GAAQ,GAAA,CAAI,KAAA,CAAM,gBAAgB,CAAA;AACxC,IAAA,MAAM,QAAA,GAAW,KAAA,GAAQ,KAAA,CAAM,CAAC,CAAA,GAAI,YAAA;AACpC,IAAA,MAAM,QAAA,GAAW,GAAA,CAAI,QAAA,CAAS,UAAU,CAAA;AAGxC,IAAA,MAAM,SAAA,GAAY,GAAA,CAAI,OAAA,CAAQ,GAAG,CAAA;AACjC,IAAA,IAAI,UAAA,GAAa,EAAA;AACjB,IAAA,IAAI,iBAAA,IAAqB,cAAc,EAAA,EAAI;AACzC,MAAA,MAAM,IAAA,GAAO,GAAA,CAAI,KAAA,CAAM,SAAA,GAAY,CAAC,CAAA;AAEpC,MAAA,UAAA,GAAa,IAAA,CAAK,SAAS,EAAA,GAAK,CAAA,EAAG,KAAK,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,eAAA,CAAA,GAAoB,IAAA;AAAA,IAC1E;AAEA,IAAA,OAAO,CAAA,KAAA,EAAQ,QAAQ,CAAA,EAAG,QAAA,GAAW,SAAA,GAAY,EAAE,CAAA,EAAG,UAAA,GAAa,CAAA,CAAA,EAAI,UAAU,CAAA,CAAA,GAAK,EAAE,CAAA,CAAA;AAAA,EAC1F;AACA,EAAA,OAAO,GAAA;AACT;;;;"}

package/build/esm/utils/vercelWaitUntil.js

@@ -1,22 +1,14 @@
 import { GLOBAL_OBJ } from './worldwide.js';
 
-/**
- * Function that delays closing of a Vercel lambda until the provided promise is resolved.
- *
- * Vendored from https://www.npmjs.com/package/@vercel/functions
- */
 function vercelWaitUntil(task) {
-  // We only flush manually in Vercel Edge runtime
-  // In Node runtime, we use process.on('SIGTERM') instead
-  if (typeof EdgeRuntime !== 'string') {
+  if (typeof EdgeRuntime !== "string") {
     return;
   }
-  const vercelRequestContextGlobal =
+  const vercelRequestContextGlobal = (
     // @ts-expect-error This is not typed
-    GLOBAL_OBJ[Symbol.for('@vercel/request-context')];
-
+    GLOBAL_OBJ[/* @__PURE__ */ Symbol.for("@vercel/request-context")]
+  );
   const ctx = vercelRequestContextGlobal?.get?.();
-
   if (ctx?.waitUntil) {
     ctx.waitUntil(task);
   }

package/build/esm/utils/vercelWaitUntil.js.map

@@ -1 +1 @@
-{"version":3,"file":"vercelWaitUntil.js","sources":["../../../src/utils/vercelWaitUntil.ts"],"sourcesContent":["import { GLOBAL_OBJ } from './worldwide';\n\ndeclare const EdgeRuntime: string | undefined;\n\ninterface VercelRequestContextGlobal {\n  get?():\n    | {\n        waitUntil?: (task: Promise<unknown>) => void;\n      }\n    | undefined;\n}\n\n/**\n * Function that delays closing of a Vercel lambda until the provided promise is resolved.\n *\n * Vendored from https://www.npmjs.com/package/@vercel/functions\n */\nexport function vercelWaitUntil(task: Promise<unknown>): void {\n  // We only flush manually in Vercel Edge runtime\n  // In Node runtime, we use process.on('SIGTERM') instead\n  if (typeof EdgeRuntime !== 'string') {\n    return;\n  }\n  const vercelRequestContextGlobal: VercelRequestContextGlobal | undefined =\n    // @ts-expect-error This is not typed\n    GLOBAL_OBJ[Symbol.for('@vercel/request-context')];\n\n  const ctx = vercelRequestContextGlobal?.get?.();\n\n  if (ctx?.waitUntil) {\n    ctx.waitUntil(task);\n  }\n}\n"],"names":[],"mappings":";;AAYA;AACA;AACA;AACA;AACA;AACO,SAAS,eAAe,CAAC,IAAI,EAA0B;AAC9D;AACA;AACA,EAAE,IAAI,OAAO,WAAA,KAAgB,QAAQ,EAAE;AACvC,IAAI;AACJ,EAAE;AACF,EAAE,MAAM,0BAA0B;AAClC;AACA,IAAI,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;;AAErD,EAAE,MAAM,MAAM,0BAA0B,EAAE,GAAG,IAAI;;AAEjD,EAAE,IAAI,GAAG,EAAE,SAAS,EAAE;AACtB,IAAI,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC;AACvB,EAAE;AACF;;;;"}
+{"version":3,"file":"vercelWaitUntil.js","sources":["../../../src/utils/vercelWaitUntil.ts"],"sourcesContent":["import { GLOBAL_OBJ } from './worldwide';\n\ndeclare const EdgeRuntime: string | undefined;\n\ninterface VercelRequestContextGlobal {\n  get?():\n    | {\n        waitUntil?: (task: Promise<unknown>) => void;\n      }\n    | undefined;\n}\n\n/**\n * Function that delays closing of a Vercel lambda until the provided promise is resolved.\n *\n * Vendored from https://www.npmjs.com/package/@vercel/functions\n */\nexport function vercelWaitUntil(task: Promise<unknown>): void {\n  // We only flush manually in Vercel Edge runtime\n  // In Node runtime, we use process.on('SIGTERM') instead\n  if (typeof EdgeRuntime !== 'string') {\n    return;\n  }\n  const vercelRequestContextGlobal: VercelRequestContextGlobal | undefined =\n    // @ts-expect-error This is not typed\n    GLOBAL_OBJ[Symbol.for('@vercel/request-context')];\n\n  const ctx = vercelRequestContextGlobal?.get?.();\n\n  if (ctx?.waitUntil) {\n    ctx.waitUntil(task);\n  }\n}\n"],"names":[],"mappings":";;AAiBO,SAAS,gBAAgB,IAAA,EAA8B;AAG5D,EAAA,IAAI,OAAO,gBAAgB,QAAA,EAAU;AACnC,IAAA;AAAA,EACF;AACA,EAAA,MAAM,0BAAA;AAAA;AAAA,IAEJ,UAAA,iBAAW,MAAA,CAAO,GAAA,CAAI,yBAAyB,CAAC;AAAA,GAAA;AAElD,EAAA,MAAM,GAAA,GAAM,4BAA4B,GAAA,IAAM;AAE9C,EAAA,IAAI,KAAK,SAAA,EAAW;AAClB,IAAA,GAAA,CAAI,UAAU,IAAI,CAAA;AAAA,EACpB;AACF;;;;"}

package/build/esm/utils/version.js

@@ -1,6 +1,4 @@
-// This is a magic string replaced by rollup
-
-const SDK_VERSION = "10.53.1" ;
+const SDK_VERSION = "10.54.0" ;
 
 export { SDK_VERSION };
 //# sourceMappingURL=version.js.map

package/build/esm/utils/version.js.map

@@ -1 +1 @@
-{"version":3,"file":"version.js","sources":["../../../src/utils/version.ts"],"sourcesContent":["// This is a magic string replaced by rollup\ndeclare const __SENTRY_SDK_VERSION__: string;\n\nexport const SDK_VERSION = typeof __SENTRY_SDK_VERSION__ === 'string' ? __SENTRY_SDK_VERSION__ : '0.0.0-unknown.0';\n"],"names":[],"mappings":"AAAA;;AAGO,MAAM,WAAA,GAA2D,SAAA;;;;"}
+{"version":3,"file":"version.js","sources":["../../../src/utils/version.ts"],"sourcesContent":["// This is a magic string replaced by rollup\ndeclare const __SENTRY_SDK_VERSION__: string;\n\nexport const SDK_VERSION = typeof __SENTRY_SDK_VERSION__ === 'string' ? __SENTRY_SDK_VERSION__ : '0.0.0-unknown.0';\n"],"names":[],"mappings":"AAGO,MAAM,WAAA,GAA2D,SAAA;;;;"}

package/build/esm/utils/weakRef.js

@@ -1,58 +1,27 @@
 import { GLOBAL_OBJ } from './worldwide.js';
 
-/**
- * Interface representing a weak reference to an object.
- * This matches the standard WeakRef interface but is defined here
- * because WeakRef is not available in ES2020 type definitions.
- */
-
-/**
- * Creates a weak reference to an object if WeakRef is available,
- * otherwise returns the object directly.
- *
- * This is useful for breaking circular references while maintaining
- * compatibility with environments that don't support WeakRef (e.g., older browsers).
- *
- * @param value - The object to create a weak reference to
- * @returns A WeakRef wrapper if available, or the original object as fallback
- */
 function makeWeakRef(value) {
   try {
-    // @ts-expect-error - WeakRef may not be in the type definitions for older TS targets
     const WeakRefImpl = GLOBAL_OBJ.WeakRef;
-    if (typeof WeakRefImpl === 'function') {
+    if (typeof WeakRefImpl === "function") {
       return new WeakRefImpl(value);
     }
   } catch {
-    // WeakRef not available or construction failed
   }
   return value;
 }
-
-/**
- * Resolves a potentially weak reference, returning the underlying object
- * or undefined if the reference has been garbage collected.
- *
- * @param ref - A MaybeWeakRef or undefined
- * @returns The referenced object, or undefined if GC'd or ref was undefined
- */
 function derefWeakRef(ref) {
   if (!ref) {
-    return undefined;
+    return void 0;
   }
-
-  // Check if this is a WeakRef (has deref method)
-  if (typeof ref === 'object' && 'deref' in ref && typeof ref.deref === 'function') {
+  if (typeof ref === "object" && "deref" in ref && typeof ref.deref === "function") {
     try {
       return ref.deref();
     } catch {
-      // deref() failed - treat as GC'd
-      return undefined;
+      return void 0;
     }
   }
-
-  // Direct reference fallback
-  return ref ;
+  return ref;
 }
 
 export { derefWeakRef, makeWeakRef };

package/build/esm/utils/weakRef.js.map

@@ -1 +1 @@
-{"version":3,"file":"weakRef.js","sources":["../../../src/utils/weakRef.ts"],"sourcesContent":["import { GLOBAL_OBJ } from './worldwide';\n\n/**\n * Interface representing a weak reference to an object.\n * This matches the standard WeakRef interface but is defined here\n * because WeakRef is not available in ES2020 type definitions.\n */\ninterface WeakRefLike<T extends object> {\n  deref(): T | undefined;\n}\n\n/**\n * A wrapper type that represents either a WeakRef-like object or a direct reference.\n * Used for optional weak referencing in environments where WeakRef may not be available.\n */\nexport type MaybeWeakRef<T extends object> = WeakRefLike<T> | T;\n\n/**\n * Creates a weak reference to an object if WeakRef is available,\n * otherwise returns the object directly.\n *\n * This is useful for breaking circular references while maintaining\n * compatibility with environments that don't support WeakRef (e.g., older browsers).\n *\n * @param value - The object to create a weak reference to\n * @returns A WeakRef wrapper if available, or the original object as fallback\n */\nexport function makeWeakRef<T extends object>(value: T): MaybeWeakRef<T> {\n  try {\n    // @ts-expect-error - WeakRef may not be in the type definitions for older TS targets\n    const WeakRefImpl = GLOBAL_OBJ.WeakRef;\n    if (typeof WeakRefImpl === 'function') {\n      return new WeakRefImpl(value);\n    }\n  } catch {\n    // WeakRef not available or construction failed\n  }\n  return value;\n}\n\n/**\n * Resolves a potentially weak reference, returning the underlying object\n * or undefined if the reference has been garbage collected.\n *\n * @param ref - A MaybeWeakRef or undefined\n * @returns The referenced object, or undefined if GC'd or ref was undefined\n */\nexport function derefWeakRef<T extends object>(ref: MaybeWeakRef<T> | undefined): T | undefined {\n  if (!ref) {\n    return undefined;\n  }\n\n  // Check if this is a WeakRef (has deref method)\n  if (typeof ref === 'object' && 'deref' in ref && typeof ref.deref === 'function') {\n    try {\n      return ref.deref();\n    } catch {\n      // deref() failed - treat as GC'd\n      return undefined;\n    }\n  }\n\n  // Direct reference fallback\n  return ref as T;\n}\n"],"names":[],"mappings":";;AAEA;AACA;AACA;AACA;AACA;;AAWA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,WAAW,CAAmB,KAAK,EAAsB;AACzE,EAAE,IAAI;AACN;AACA,IAAI,MAAM,WAAA,GAAc,UAAU,CAAC,OAAO;AAC1C,IAAI,IAAI,OAAO,WAAA,KAAgB,UAAU,EAAE;AAC3C,MAAM,OAAO,IAAI,WAAW,CAAC,KAAK,CAAC;AACnC,IAAI;AACJ,EAAE,EAAE,MAAM;AACV;AACA,EAAE;AACF,EAAE,OAAO,KAAK;AACd;;AAEA;AACA;AACA;AACA;AACA;AACA;AACA;AACO,SAAS,YAAY,CAAmB,GAAG,EAA8C;AAChG,EAAE,IAAI,CAAC,GAAG,EAAE;AACZ,IAAI,OAAO,SAAS;AACpB,EAAE;;AAEF;AACA,EAAE,IAAI,OAAO,GAAA,KAAQ,YAAY,OAAA,IAAW,GAAA,IAAO,OAAO,GAAG,CAAC,KAAA,KAAU,UAAU,EAAE;AACpF,IAAI,IAAI;AACR,MAAM,OAAO,GAAG,CAAC,KAAK,EAAE;AACxB,IAAI,EAAE,MAAM;AACZ;AACA,MAAM,OAAO,SAAS;AACtB,IAAI;AACJ,EAAE;;AAEF;AACA,EAAE,OAAO,GAAA;AACT;;;;"}
+{"version":3,"file":"weakRef.js","sources":["../../../src/utils/weakRef.ts"],"sourcesContent":["import { GLOBAL_OBJ } from './worldwide';\n\n/**\n * Interface representing a weak reference to an object.\n * This matches the standard WeakRef interface but is defined here\n * because WeakRef is not available in ES2020 type definitions.\n */\ninterface WeakRefLike<T extends object> {\n  deref(): T | undefined;\n}\n\n/**\n * A wrapper type that represents either a WeakRef-like object or a direct reference.\n * Used for optional weak referencing in environments where WeakRef may not be available.\n */\nexport type MaybeWeakRef<T extends object> = WeakRefLike<T> | T;\n\n/**\n * Creates a weak reference to an object if WeakRef is available,\n * otherwise returns the object directly.\n *\n * This is useful for breaking circular references while maintaining\n * compatibility with environments that don't support WeakRef (e.g., older browsers).\n *\n * @param value - The object to create a weak reference to\n * @returns A WeakRef wrapper if available, or the original object as fallback\n */\nexport function makeWeakRef<T extends object>(value: T): MaybeWeakRef<T> {\n  try {\n    // @ts-expect-error - WeakRef may not be in the type definitions for older TS targets\n    const WeakRefImpl = GLOBAL_OBJ.WeakRef;\n    if (typeof WeakRefImpl === 'function') {\n      return new WeakRefImpl(value);\n    }\n  } catch {\n    // WeakRef not available or construction failed\n  }\n  return value;\n}\n\n/**\n * Resolves a potentially weak reference, returning the underlying object\n * or undefined if the reference has been garbage collected.\n *\n * @param ref - A MaybeWeakRef or undefined\n * @returns The referenced object, or undefined if GC'd or ref was undefined\n */\nexport function derefWeakRef<T extends object>(ref: MaybeWeakRef<T> | undefined): T | undefined {\n  if (!ref) {\n    return undefined;\n  }\n\n  // Check if this is a WeakRef (has deref method)\n  if (typeof ref === 'object' && 'deref' in ref && typeof ref.deref === 'function') {\n    try {\n      return ref.deref();\n    } catch {\n      // deref() failed - treat as GC'd\n      return undefined;\n    }\n  }\n\n  // Direct reference fallback\n  return ref as T;\n}\n"],"names":[],"mappings":";;AA2BO,SAAS,YAA8B,KAAA,EAA2B;AACvE,EAAA,IAAI;AAEF,IAAA,MAAM,cAAc,UAAA,CAAW,OAAA;AAC/B,IAAA,IAAI,OAAO,gBAAgB,UAAA,EAAY;AACrC,MAAA,OAAO,IAAI,YAAY,KAAK,CAAA;AAAA,IAC9B;AAAA,EACF,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,KAAA;AACT;AASO,SAAS,aAA+B,GAAA,EAAiD;AAC9F,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,OAAO,MAAA;AAAA,EACT;AAGA,EAAA,IAAI,OAAO,QAAQ,QAAA,IAAY,OAAA,IAAW,OAAO,OAAO,GAAA,CAAI,UAAU,UAAA,EAAY;AAChF,IAAA,IAAI;AACF,MAAA,OAAO,IAAI,KAAA,EAAM;AAAA,IACnB,CAAA,CAAA,MAAQ;AAEN,MAAA,OAAO,MAAA;AAAA,IACT;AAAA,EACF;AAGA,EAAA,OAAO,GAAA;AACT;;;;"}

package/build/esm/utils/worldwide.js

@@ -1,7 +1,4 @@
-/** Internal global with common properties and Sentry extensions  */
-
-/** Get's the global object for the current JavaScript runtime */
-const GLOBAL_OBJ = globalThis ;
+const GLOBAL_OBJ = globalThis;
 
 export { GLOBAL_OBJ };
 //# sourceMappingURL=worldwide.js.map

package/build/esm/utils/worldwide.js.map

@@ -1 +1 @@
-{"version":3,"file":"worldwide.js","sources":["../../../src/utils/worldwide.ts"],"sourcesContent":["/**\n * NOTE: In order to avoid circular dependencies, if you add a function to this module and it needs to print something,\n * you must either a) use `console.log` rather than the `debug` singleton, or b) put your function elsewhere.\n *\n * Note: This file was originally called `global.ts`, but was changed to unblock users which might be doing\n * string replaces with bundlers like Vite for `global` (would break imports that rely on importing from utils/src/global).\n *\n * Why worldwide?\n *\n * Why not?\n */\n\n/* eslint-disable @typescript-eslint/no-explicit-any */\n\nimport type { Carrier } from '../carrier';\nimport type { SdkSource } from './env';\n\n/** Internal global with common properties and Sentry extensions  */\nexport type InternalGlobal = {\n  navigator?: { userAgent?: string; maxTouchPoints?: number };\n  console: Console;\n  PerformanceObserver?: any;\n  Sentry?: any;\n  onerror?: {\n    (event: object | string, source?: string, lineno?: number, colno?: number, error?: Error): any;\n    __SENTRY_INSTRUMENTED__?: true;\n  };\n  onunhandledrejection?: {\n    (event: unknown): boolean;\n    __SENTRY_INSTRUMENTED__?: true;\n  };\n  SENTRY_ENVIRONMENT?: string;\n  SENTRY_DSN?: string;\n  SENTRY_RELEASE?: {\n    id?: string;\n  };\n  SENTRY_SDK_SOURCE?: SdkSource;\n  /**\n   * Debug IDs are indirectly injected by Sentry CLI or bundler plugins to directly reference a particular source map\n   * for resolving of a source file. The injected code will place an entry into the record for each loaded bundle/JS\n   * file.\n   */\n  _sentryDebugIds?: Record<string, string>;\n  /**\n   * Native debug IDs implementation (e.g., from Vercel).\n   * This uses the same format as _sentryDebugIds but with a different global name.\n   * Keys are `error.stack` strings, values are debug IDs.\n   */\n  _debugIds?: Record<string, string>;\n  /**\n   * Raw module metadata that is injected by bundler plugins.\n   *\n   * Keys are `error.stack` strings, values are the metadata.\n   */\n  _sentryModuleMetadata?: Record<string, any>;\n  _sentryEsmLoaderHookRegistered?: boolean;\n} & Carrier;\n\n/** Get's the global object for the current JavaScript runtime */\nexport const GLOBAL_OBJ = globalThis as unknown as InternalGlobal;\n"],"names":[],"mappings":"AAiBA;;AAyCA;AACO,MAAM,UAAA,GAAa,UAAA;;;;"}
+{"version":3,"file":"worldwide.js","sources":["../../../src/utils/worldwide.ts"],"sourcesContent":["/**\n * NOTE: In order to avoid circular dependencies, if you add a function to this module and it needs to print something,\n * you must either a) use `console.log` rather than the `debug` singleton, or b) put your function elsewhere.\n *\n * Note: This file was originally called `global.ts`, but was changed to unblock users which might be doing\n * string replaces with bundlers like Vite for `global` (would break imports that rely on importing from utils/src/global).\n *\n * Why worldwide?\n *\n * Why not?\n */\n\n/* eslint-disable @typescript-eslint/no-explicit-any */\n\nimport type { Carrier } from '../carrier';\nimport type { SdkSource } from './env';\n\n/** Internal global with common properties and Sentry extensions  */\nexport type InternalGlobal = {\n  navigator?: { userAgent?: string; maxTouchPoints?: number };\n  console: Console;\n  PerformanceObserver?: any;\n  Sentry?: any;\n  onerror?: {\n    (event: object | string, source?: string, lineno?: number, colno?: number, error?: Error): any;\n    __SENTRY_INSTRUMENTED__?: true;\n  };\n  onunhandledrejection?: {\n    (event: unknown): boolean;\n    __SENTRY_INSTRUMENTED__?: true;\n  };\n  SENTRY_ENVIRONMENT?: string;\n  SENTRY_DSN?: string;\n  SENTRY_RELEASE?: {\n    id?: string;\n  };\n  SENTRY_SDK_SOURCE?: SdkSource;\n  /**\n   * Debug IDs are indirectly injected by Sentry CLI or bundler plugins to directly reference a particular source map\n   * for resolving of a source file. The injected code will place an entry into the record for each loaded bundle/JS\n   * file.\n   */\n  _sentryDebugIds?: Record<string, string>;\n  /**\n   * Native debug IDs implementation (e.g., from Vercel).\n   * This uses the same format as _sentryDebugIds but with a different global name.\n   * Keys are `error.stack` strings, values are debug IDs.\n   */\n  _debugIds?: Record<string, string>;\n  /**\n   * Raw module metadata that is injected by bundler plugins.\n   *\n   * Keys are `error.stack` strings, values are the metadata.\n   */\n  _sentryModuleMetadata?: Record<string, any>;\n  _sentryEsmLoaderHookRegistered?: boolean;\n  _sentryWrappedDepth?: number;\n} & Carrier;\n\n/** Get's the global object for the current JavaScript runtime */\nexport const GLOBAL_OBJ = globalThis as unknown as InternalGlobal;\n"],"names":[],"mappings":"AA4DO,MAAM,UAAA,GAAa;;;;"}

package/build/esm/vendor/escapeStringForRegex.js

@@ -1,36 +1,5 @@
-// Based on https://github.com/sindresorhus/escape-string-regexp but with modifications to:
-//   a) reduce the size by skipping the runtime type - checking
-//   b) ensure it gets down - compiled for old versions of Node(the published package only supports Node 14+).
-//
-// MIT License
-//
-// Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (https://sindresorhus.com)
-//
-// Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated
-// documentation files(the "Software"), to deal in the Software without restriction, including without limitation
-// the rights to use, copy, modify, merge, publish, distribute, sublicense, and / or sell copies of the Software, and
-// to permit persons to whom the Software is furnished to do so, subject to the following conditions:
-//
-// The above copyright notice and this permission notice shall be included in all copies or substantial portions of
-// the Software.
-//
-// THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO
-// THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.IN NO EVENT SHALL THE
-// AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT,
-// TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS
-// IN THE SOFTWARE.
-
-/**
- * Given a string, escape characters which have meaning in the regex grammar, such that the result is safe to feed to
- * `new RegExp()`.
- *
- * @param regexString The string to escape
- * @returns An version of the string with all special regex characters escaped
- */
 function escapeStringForRegex(regexString) {
-  // escape the hyphen separately so we can also replace it with a unicode literal hyphen, to avoid the problems
-  // discussed in https://github.com/sindresorhus/escape-string-regexp/issues/20.
-  return regexString.replace(/[|\\{}()[\]^$+*?.]/g, '\\$&').replace(/-/g, '\\x2d');
+  return regexString.replace(/[|\\{}()[\]^$+*?.]/g, "\\$&").replace(/-/g, "\\x2d");
 }
 
 export { escapeStringForRegex };