@spotlightjs/spotlight 4.6.0 → 4.7.1

package/dist/server/routes/open.js.map

@@ -1 +1 @@
-{"version":3,"file":"open.js","sources":["../../../src/server/routes/open.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport { Hono } from \"hono\";\nimport launchEditor from \"launch-editor\";\nimport { logger } from \"../logger.ts\";\nimport type { HonoEnv } from \"../types/index.ts\";\n\nconst router = new Hono<HonoEnv>();\n\n// ASK: Will this still be used in a desktop app? And if so, do we still have a base path and cwd?\nrouter.post(\"/\", async ctx => {\n  const basePath = ctx.get(\"basePath\") ?? process.cwd();\n\n  const requestBody = await ctx.req.text();\n  const targetPath = resolve(basePath, requestBody);\n  logger.debug(`Launching editor for ${targetPath}`);\n  launchEditor(\n    // filename:line:column\n    // both line and column are optional\n    targetPath,\n    // callback if failed to launch (optional)\n    (fileName, errorMsg) => {\n      logger.error(`Failed to launch editor for ${fileName}: ${errorMsg}`);\n    },\n  );\n  return ctx.body(null, 204);\n});\n\nexport default router;\n"],"names":[],"mappings":";;;;AAMA,MAAM,SAAS,IAAI,KAAA;AAGnB,OAAO,KAAK,KAAK,OAAM,QAAO;AAC5B,QAAM,WAAW,IAAI,IAAI,UAAU,KAAK,QAAQ,IAAA;AAEhD,QAAM,cAAc,MAAM,IAAI,IAAI,KAAA;AAClC,QAAM,aAAa,QAAQ,UAAU,WAAW;AAChD,SAAO,MAAM,wBAAwB,UAAU,EAAE;AACjD;AAAA;AAAA;AAAA,IAGE;AAAA;AAAA,IAEA,CAAC,UAAU,aAAa;AACtB,aAAO,MAAM,+BAA+B,QAAQ,KAAK,QAAQ,EAAE;AAAA,IACrE;AAAA,EAAA;AAEF,SAAO,IAAI,KAAK,MAAM,GAAG;AAC3B,CAAC;"}
+{"version":3,"file":"open.js","sources":["../../../src/server/routes/open.ts"],"sourcesContent":["import { resolve } from \"node:path\";\nimport { Hono } from \"hono\";\nimport launchEditor from \"launch-editor\";\nimport { logger } from \"../logger.ts\";\nimport type { HonoEnv } from \"../types/index.ts\";\n\nconst router = new Hono<HonoEnv>();\n\n// ASK: Will this still be used in a desktop app? And if so, do we still have a base path and cwd?\nrouter.post(\"/\", async ctx => {\n  const basePath = ctx.get(\"basePath\") ?? process.cwd();\n\n  const requestBody = await ctx.req.text();\n  const targetPath = resolve(basePath, requestBody);\n  logger.debug(`Launching editor for ${targetPath}`);\n  launchEditor(\n    // filename:line:column\n    // both line and column are optional\n    targetPath,\n    // callback if failed to launch (optional)\n    (fileName, errorMsg) => {\n      logger.error(`Failed to launch editor for ${fileName}: ${errorMsg}`);\n    },\n  );\n  return ctx.body(null, 204);\n});\n\nexport default router;\n"],"names":[],"mappings":";;;;;;;;;;;;;AAMA,MAAM,SAAS,IAAI,KAAA;AAGnB,OAAO,KAAK,KAAK,OAAM,QAAO;AAC5B,QAAM,WAAW,IAAI,IAAI,UAAU,KAAK,QAAQ,IAAA;AAEhD,QAAM,cAAc,MAAM,IAAI,IAAI,KAAA;AAClC,QAAM,aAAa,QAAQ,UAAU,WAAW;AAChD,SAAO,MAAM,wBAAwB,UAAU,EAAE;AACjD;AAAA;AAAA;AAAA,IAGE;AAAA;AAAA,IAEA,CAAC,UAAU,aAAa;AACtB,aAAO,MAAM,+BAA+B,QAAQ,KAAK,QAAQ,EAAE;AAAA,IACrE;AAAA,EAAA;AAEF,SAAO,IAAI,KAAK,MAAM,GAAG;AAC3B,CAAC;"}

package/dist/server/routes/stream/debugLogging.js

@@ -1,6 +1,15 @@
+;
+!function() {
+  try {
+    var e = "undefined" != typeof window ? window : "undefined" != typeof global ? global : "undefined" != typeof globalThis ? globalThis : "undefined" != typeof self ? self : {}, n = new e.Error().stack;
+    n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "faef59ab-afce-40e0-b027-ea31b42dfa6e", e._sentryDebugIdIdentifier = "sentry-dbid-faef59ab-afce-40e0-b027-ea31b42dfa6e");
+  } catch (e2) {
+  }
+}();
 import { isDebugEnabled, logger } from "../../logger.js";
 import { isErrorEvent } from "../../parser/helpers.js";
 import "uuidv7";
+import "../../../_virtual/_sentry-release-injection-file.js";
 function logIncomingEvent(container) {
   if (!isDebugEnabled()) return;
   const contentType = container.getContentType();

package/dist/server/routes/stream/debugLogging.js.map

@@ -1 +1 @@
-{"version":3,"file":"debugLogging.js","sources":["../../../../src/server/routes/stream/debugLogging.ts"],"sourcesContent":["import { isDebugEnabled, logger } from \"../../logger.ts\";\nimport { type ParsedEnvelope, type SentryErrorEvent, type SentryEvent, isErrorEvent } from \"../../parser/index.ts\";\nimport type { EventContainer } from \"../../utils/index.ts\";\n\n/**\n * Logs incoming event details when debug mode is enabled\n * Uses the container's parsed data if available\n */\nexport function logIncomingEvent(container: EventContainer): void {\n  if (!isDebugEnabled()) return;\n\n  const contentType = container.getContentType();\n\n  if (contentType === \"application/x-sentry-envelope\") {\n    const parsedEnvelope = container.getParsedEnvelope();\n\n    if (!parsedEnvelope) {\n      // Still log something useful even if parsing failed\n      const data = container.getData();\n      const size = data.length;\n      // Only show first line of envelope header for safety (should be JSON metadata, not user data)\n      const firstNewline = data.indexOf(\"\\n\");\n      const headerPreview =\n        firstNewline > 0 && firstNewline < 200\n          ? data.toString(\"utf-8\", 0, firstNewline).replace(/\\n/g, \"\\\\n\")\n          : \"header not found\";\n      logger.debug(`→ envelope (parse error, ${size} bytes) | ${headerPreview}`);\n      return;\n    }\n\n    // Build complete log message with all details\n    let logMessage = `→ ${formatEnvelopeMetadata(parsedEnvelope.envelope)}`;\n\n    // Add error event details to the same log message\n    for (const item of parsedEnvelope.envelope[1]) {\n      if (isErrorEvent(item[1] as SentryEvent)) {\n        logMessage += `\\n  └ ${formatErrorDetails(item[1] as SentryErrorEvent)}`;\n      }\n    }\n\n    // Single atomic log statement\n    logger.debug(logMessage);\n  } else {\n    logger.debug(`→ ${contentType || \"unknown\"}`);\n  }\n}\n\n/**\n * Logs outgoing event to client when debug mode is enabled\n * Uses the container's already-parsed data if available\n */\nexport function logOutgoingEvent(container: EventContainer, clientId: string): void {\n  if (!isDebugEnabled()) return;\n\n  // Use the container's event type string (which uses cached parsed data)\n  const typeInfo = container.getEventTypesString();\n\n  // If it's an envelope that failed to parse, add size info\n  if (typeInfo === \"envelope\" && container.getContentType() === \"application/x-sentry-envelope\") {\n    const size = container.getData().length;\n    logger.debug(`← envelope (${size} bytes) to ${clientId}`);\n  } else {\n    logger.debug(`← ${typeInfo} to ${clientId}`);\n  }\n}\n\n/**\n * Formats envelope metadata for logging\n */\nfunction formatEnvelopeMetadata(envelope: ParsedEnvelope[\"envelope\"]): string {\n  const eventTypes = envelope[1].map(item => item[0].type).filter(Boolean);\n\n  const typePrefix = eventTypes.length > 0 ? eventTypes.join(\"+\") : \"envelope\";\n  const sdk = envelope[0].sdk?.name || \"unknown\";\n  const eventId = envelope[0].event_id;\n\n  return `${typePrefix} | sdk: ${sdk}${eventId ? ` | id: ${eventId}` : \"\"}`;\n}\n\n/**\n * Formats error event details for logging\n */\nfunction formatErrorDetails(payload: SentryErrorEvent): string {\n  const platform = payload.platform || \"unknown\";\n  const environment = payload.environment || \"unknown\";\n  const level = \"level\" in payload ? payload.level : \"error\";\n\n  const errorMsg = payload.exception?.values?.[0]?.value || String(payload.message) || \"No error message\";\n\n  const errorType = payload.exception?.values?.[0]?.type || \"Error\";\n\n  const truncatedMsg = errorMsg.substring(0, 80) + (errorMsg.length > 80 ? \"...\" : \"\");\n\n  return `${level} [${platform}/${environment}] ${errorType}: ${truncatedMsg}`;\n}\n"],"names":[],"mappings":";;;AAQO,SAAS,iBAAiB,WAAiC;AAChE,MAAI,CAAC,iBAAkB;AAEvB,QAAM,cAAc,UAAU,eAAA;AAE9B,MAAI,gBAAgB,iCAAiC;AACnD,UAAM,iBAAiB,UAAU,kBAAA;AAEjC,QAAI,CAAC,gBAAgB;AAEnB,YAAM,OAAO,UAAU,QAAA;AACvB,YAAM,OAAO,KAAK;AAElB,YAAM,eAAe,KAAK,QAAQ,IAAI;AACtC,YAAM,gBACJ,eAAe,KAAK,eAAe,MAC/B,KAAK,SAAS,SAAS,GAAG,YAAY,EAAE,QAAQ,OAAO,KAAK,IAC5D;AACN,aAAO,MAAM,4BAA4B,IAAI,aAAa,aAAa,EAAE;AACzE;AAAA,IACF;AAGA,QAAI,aAAa,KAAK,uBAAuB,eAAe,QAAQ,CAAC;AAGrE,eAAW,QAAQ,eAAe,SAAS,CAAC,GAAG;AAC7C,UAAI,aAAa,KAAK,CAAC,CAAgB,GAAG;AACxC,sBAAc;AAAA,MAAS,mBAAmB,KAAK,CAAC,CAAqB,CAAC;AAAA,MACxE;AAAA,IACF;AAGA,WAAO,MAAM,UAAU;AAAA,EACzB,OAAO;AACL,WAAO,MAAM,KAAK,eAAe,SAAS,EAAE;AAAA,EAC9C;AACF;AAMO,SAAS,iBAAiB,WAA2B,UAAwB;AAClF,MAAI,CAAC,iBAAkB;AAGvB,QAAM,WAAW,UAAU,oBAAA;AAG3B,MAAI,aAAa,cAAc,UAAU,eAAA,MAAqB,iCAAiC;AAC7F,UAAM,OAAO,UAAU,QAAA,EAAU;AACjC,WAAO,MAAM,eAAe,IAAI,cAAc,QAAQ,EAAE;AAAA,EAC1D,OAAO;AACL,WAAO,MAAM,KAAK,QAAQ,OAAO,QAAQ,EAAE;AAAA,EAC7C;AACF;AAKA,SAAS,uBAAuB,UAA8C;AAC5E,QAAM,aAAa,SAAS,CAAC,EAAE,IAAI,CAAA,SAAQ,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,OAAO;AAEvE,QAAM,aAAa,WAAW,SAAS,IAAI,WAAW,KAAK,GAAG,IAAI;AAClE,QAAM,MAAM,SAAS,CAAC,EAAE,KAAK,QAAQ;AACrC,QAAM,UAAU,SAAS,CAAC,EAAE;AAE5B,SAAO,GAAG,UAAU,WAAW,GAAG,GAAG,UAAU,UAAU,OAAO,KAAK,EAAE;AACzE;AAKA,SAAS,mBAAmB,SAAmC;AAC7D,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,cAAc,QAAQ,eAAe;AAC3C,QAAM,QAAQ,WAAW,UAAU,QAAQ,QAAQ;AAEnD,QAAM,WAAW,QAAQ,WAAW,SAAS,CAAC,GAAG,SAAS,OAAO,QAAQ,OAAO,KAAK;AAErF,QAAM,YAAY,QAAQ,WAAW,SAAS,CAAC,GAAG,QAAQ;AAE1D,QAAM,eAAe,SAAS,UAAU,GAAG,EAAE,KAAK,SAAS,SAAS,KAAK,QAAQ;AAEjF,SAAO,GAAG,KAAK,KAAK,QAAQ,IAAI,WAAW,KAAK,SAAS,KAAK,YAAY;AAC5E;"}
+{"version":3,"file":"debugLogging.js","sources":["../../../../src/server/routes/stream/debugLogging.ts"],"sourcesContent":["import { isDebugEnabled, logger } from \"../../logger.ts\";\nimport { type ParsedEnvelope, type SentryErrorEvent, type SentryEvent, isErrorEvent } from \"../../parser/index.ts\";\nimport type { EventContainer } from \"../../utils/index.ts\";\n\n/**\n * Logs incoming event details when debug mode is enabled\n * Uses the container's parsed data if available\n */\nexport function logIncomingEvent(container: EventContainer): void {\n  if (!isDebugEnabled()) return;\n\n  const contentType = container.getContentType();\n\n  if (contentType === \"application/x-sentry-envelope\") {\n    const parsedEnvelope = container.getParsedEnvelope();\n\n    if (!parsedEnvelope) {\n      // Still log something useful even if parsing failed\n      const data = container.getData();\n      const size = data.length;\n      // Only show first line of envelope header for safety (should be JSON metadata, not user data)\n      const firstNewline = data.indexOf(\"\\n\");\n      const headerPreview =\n        firstNewline > 0 && firstNewline < 200\n          ? data.toString(\"utf-8\", 0, firstNewline).replace(/\\n/g, \"\\\\n\")\n          : \"header not found\";\n      logger.debug(`→ envelope (parse error, ${size} bytes) | ${headerPreview}`);\n      return;\n    }\n\n    // Build complete log message with all details\n    let logMessage = `→ ${formatEnvelopeMetadata(parsedEnvelope.envelope)}`;\n\n    // Add error event details to the same log message\n    for (const item of parsedEnvelope.envelope[1]) {\n      if (isErrorEvent(item[1] as SentryEvent)) {\n        logMessage += `\\n  └ ${formatErrorDetails(item[1] as SentryErrorEvent)}`;\n      }\n    }\n\n    // Single atomic log statement\n    logger.debug(logMessage);\n  } else {\n    logger.debug(`→ ${contentType || \"unknown\"}`);\n  }\n}\n\n/**\n * Logs outgoing event to client when debug mode is enabled\n * Uses the container's already-parsed data if available\n */\nexport function logOutgoingEvent(container: EventContainer, clientId: string): void {\n  if (!isDebugEnabled()) return;\n\n  // Use the container's event type string (which uses cached parsed data)\n  const typeInfo = container.getEventTypesString();\n\n  // If it's an envelope that failed to parse, add size info\n  if (typeInfo === \"envelope\" && container.getContentType() === \"application/x-sentry-envelope\") {\n    const size = container.getData().length;\n    logger.debug(`← envelope (${size} bytes) to ${clientId}`);\n  } else {\n    logger.debug(`← ${typeInfo} to ${clientId}`);\n  }\n}\n\n/**\n * Formats envelope metadata for logging\n */\nfunction formatEnvelopeMetadata(envelope: ParsedEnvelope[\"envelope\"]): string {\n  const eventTypes = envelope[1].map(item => item[0].type).filter(Boolean);\n\n  const typePrefix = eventTypes.length > 0 ? eventTypes.join(\"+\") : \"envelope\";\n  const sdk = envelope[0].sdk?.name || \"unknown\";\n  const eventId = envelope[0].event_id;\n\n  return `${typePrefix} | sdk: ${sdk}${eventId ? ` | id: ${eventId}` : \"\"}`;\n}\n\n/**\n * Formats error event details for logging\n */\nfunction formatErrorDetails(payload: SentryErrorEvent): string {\n  const platform = payload.platform || \"unknown\";\n  const environment = payload.environment || \"unknown\";\n  const level = \"level\" in payload ? payload.level : \"error\";\n\n  const errorMsg = payload.exception?.values?.[0]?.value || String(payload.message) || \"No error message\";\n\n  const errorType = payload.exception?.values?.[0]?.type || \"Error\";\n\n  const truncatedMsg = errorMsg.substring(0, 80) + (errorMsg.length > 80 ? \"...\" : \"\");\n\n  return `${level} [${platform}/${environment}] ${errorType}: ${truncatedMsg}`;\n}\n"],"names":[],"mappings":";;;;;;;;;;;;AAQO,SAAS,iBAAiB,WAAiC;AAChE,MAAI,CAAC,iBAAkB;AAEvB,QAAM,cAAc,UAAU,eAAA;AAE9B,MAAI,gBAAgB,iCAAiC;AACnD,UAAM,iBAAiB,UAAU,kBAAA;AAEjC,QAAI,CAAC,gBAAgB;AAEnB,YAAM,OAAO,UAAU,QAAA;AACvB,YAAM,OAAO,KAAK;AAElB,YAAM,eAAe,KAAK,QAAQ,IAAI;AACtC,YAAM,gBACJ,eAAe,KAAK,eAAe,MAC/B,KAAK,SAAS,SAAS,GAAG,YAAY,EAAE,QAAQ,OAAO,KAAK,IAC5D;AACN,aAAO,MAAM,4BAA4B,IAAI,aAAa,aAAa,EAAE;AACzE;AAAA,IACF;AAGA,QAAI,aAAa,KAAK,uBAAuB,eAAe,QAAQ,CAAC;AAGrE,eAAW,QAAQ,eAAe,SAAS,CAAC,GAAG;AAC7C,UAAI,aAAa,KAAK,CAAC,CAAgB,GAAG;AACxC,sBAAc;AAAA,MAAS,mBAAmB,KAAK,CAAC,CAAqB,CAAC;AAAA,MACxE;AAAA,IACF;AAGA,WAAO,MAAM,UAAU;AAAA,EACzB,OAAO;AACL,WAAO,MAAM,KAAK,eAAe,SAAS,EAAE;AAAA,EAC9C;AACF;AAMO,SAAS,iBAAiB,WAA2B,UAAwB;AAClF,MAAI,CAAC,iBAAkB;AAGvB,QAAM,WAAW,UAAU,oBAAA;AAG3B,MAAI,aAAa,cAAc,UAAU,eAAA,MAAqB,iCAAiC;AAC7F,UAAM,OAAO,UAAU,QAAA,EAAU;AACjC,WAAO,MAAM,eAAe,IAAI,cAAc,QAAQ,EAAE;AAAA,EAC1D,OAAO;AACL,WAAO,MAAM,KAAK,QAAQ,OAAO,QAAQ,EAAE;AAAA,EAC7C;AACF;AAKA,SAAS,uBAAuB,UAA8C;AAC5E,QAAM,aAAa,SAAS,CAAC,EAAE,IAAI,CAAA,SAAQ,KAAK,CAAC,EAAE,IAAI,EAAE,OAAO,OAAO;AAEvE,QAAM,aAAa,WAAW,SAAS,IAAI,WAAW,KAAK,GAAG,IAAI;AAClE,QAAM,MAAM,SAAS,CAAC,EAAE,KAAK,QAAQ;AACrC,QAAM,UAAU,SAAS,CAAC,EAAE;AAE5B,SAAO,GAAG,UAAU,WAAW,GAAG,GAAG,UAAU,UAAU,OAAO,KAAK,EAAE;AACzE;AAKA,SAAS,mBAAmB,SAAmC;AAC7D,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,cAAc,QAAQ,eAAe;AAC3C,QAAM,QAAQ,WAAW,UAAU,QAAQ,QAAQ;AAEnD,QAAM,WAAW,QAAQ,WAAW,SAAS,CAAC,GAAG,SAAS,OAAO,QAAQ,OAAO,KAAK;AAErF,QAAM,YAAY,QAAQ,WAAW,SAAS,CAAC,GAAG,QAAQ;AAE1D,QAAM,eAAe,SAAS,UAAU,GAAG,EAAE,KAAK,SAAS,SAAS,KAAK,QAAQ;AAEjF,SAAO,GAAG,KAAK,KAAK,QAAQ,IAAI,WAAW,KAAK,SAAS,KAAK,YAAY;AAC5E;"}

package/dist/server/routes/stream/index.js

@@ -1,13 +1,25 @@
+;
+!function() {
+  try {
+    var e = "undefined" != typeof window ? window : "undefined" != typeof global ? global : "undefined" != typeof globalThis ? globalThis : "undefined" != typeof self ? self : {}, n = new e.Error().stack;
+    n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "c8123de6-5e77-41da-8100-10d99b558d5f", e._sentryDebugIdIdentifier = "sentry-dbid-c8123de6-5e77-41da-8100-10d99b558d5f");
+  } catch (e2) {
+  }
+}();
 import { createWriteStream } from "node:fs";
-import { decompressBody, pushToSpotlightBuffer } from "../../sdk.js";
-import { SENTRY_CONTENT_TYPE } from "../../../shared/constants.js";
 import { Hono } from "hono";
+import { SENTRY_CONTENT_TYPE } from "../../../shared/constants.js";
 import { logger } from "../../logger.js";
+import { decompressBody, pushToSpotlightBuffer } from "../../sdk.js";
 import { getBuffer } from "../../utils/getBuffer.js";
 import "../../parser/helpers.js";
 import "uuidv7";
+import "../../../_virtual/_sentry-release-injection-file.js";
 import "node:http";
 import "@sentry/node";
+import "node:dns/promises";
+import "node:net";
+import "node:os";
 import { logOutgoingEvent, logIncomingEvent } from "./debugLogging.js";
 import { streamSSE } from "./streaming.js";
 import { parseBrowserFromUserAgent } from "./userAgent.js";
@@ -57,7 +69,10 @@ const router = new Hono().get("/stream", (ctx) => {
   if (ctx.req.query("sentry_client")?.startsWith("sentry.javascript.browser") && ctx.req.header("Origin")) {
     contentType = SENTRY_CONTENT_TYPE;
   }
-  const body = decompressBody(Buffer.from(await ctx.req.arrayBuffer()), ctx.req.header("Content-Encoding"));
+  const body = decompressBody(
+    Buffer.from(await ctx.req.arrayBuffer()),
+    ctx.req.header("Content-Encoding")
+  );
   const container = pushToSpotlightBuffer({
     body,
     spotlightBuffer: getBuffer(),

package/dist/server/routes/stream/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../../../../src/server/routes/stream/index.ts"],"sourcesContent":["import { createWriteStream } from \"node:fs\";\nimport { decompressBody, pushToSpotlightBuffer } from \"@spotlight/server/sdk.ts\";\nimport { SENTRY_CONTENT_TYPE } from \"@spotlight/shared/constants.ts\";\nimport { Hono } from \"hono\";\nimport { logger } from \"../../logger.ts\";\nimport type { HonoEnv } from \"../../types/env.ts\";\nimport { getBuffer } from \"../../utils/index.ts\";\nimport { logIncomingEvent, logOutgoingEvent } from \"./debugLogging.ts\";\nimport { streamSSE } from \"./streaming.ts\";\nimport { parseBrowserFromUserAgent } from \"./userAgent.ts\";\n\nconst router = new Hono<HonoEnv>()\n  .get(\"/stream\", ctx => {\n    const buffer = getBuffer();\n\n    const useBase64 = ctx.req.query(\"base64\") != null;\n    const base64Indicator = useBase64 ? \";base64\" : \"\";\n\n    // Capture client information for debug logging\n    let clientId = ctx.req.query(\"client\");\n    if (!clientId) {\n      // Fallback to parsing User-Agent if no client param\n      const userAgent = ctx.req.header(\"User-Agent\") || \"unknown\";\n      clientId = parseBrowserFromUserAgent(userAgent);\n    }\n    // Sanitize to prevent log injection - keep only safe printable characters\n    // Allow alphanumeric, spaces, dots, dashes, underscores, slashes, parentheses\n    clientId = clientId.replace(/[^\\w\\s.\\-/()]/g, \"\");\n    // Ensure we always have a non-empty clientId\n    if (!clientId) clientId = \"unknown\";\n\n    return streamSSE(ctx, async stream => {\n      // Check for Last-Event-ID header to support reconnection\n      const lastEventId = ctx.req.header(\"Last-Event-ID\");\n\n      // Subscribe to events, optionally starting from after the lastEventId\n      const sub = buffer.subscribe(container => {\n        logOutgoingEvent(container, clientId);\n\n        const parsedEnvelope = container.getParsedEnvelope();\n        if (parsedEnvelope) {\n          stream.writeSSE({\n            id: parsedEnvelope.envelope[0].__spotlight_envelope_id.toString(),\n            event: `${container.getContentType()}${base64Indicator}`,\n            data: JSON.stringify(parsedEnvelope.envelope),\n          });\n        }\n      }, lastEventId);\n\n      stream.onAbort(() => {\n        buffer.unsubscribe(sub);\n      });\n    });\n  })\n  .get(\"/envelope/:id\", ctx => {\n    const buffer = getBuffer();\n\n    const envelopeId = ctx.req.param(\"id\");\n    const container = buffer.read({ envelopeId });\n\n    if (container.length === 0) {\n      return ctx.notFound();\n    }\n\n    return ctx.body(new Uint8Array(container[0].getData()), 200, {\n      \"Content-Type\": container[0].getContentType(),\n      \"Cache-Control\": \"no-cache\",\n      \"Content-Disposition\": `attachment; filename=\"${envelopeId}.bin\"`,\n      Connection: \"keep-alive\",\n    });\n  })\n  .on(\"POST\", [\"/stream\", \"/api/:id/envelope\"], async ctx => {\n    let contentType = ctx.req.header(\"content-type\")?.split(\";\")[0].toLocaleLowerCase();\n    if (ctx.req.query(\"sentry_client\")?.startsWith(\"sentry.javascript.browser\") && ctx.req.header(\"Origin\")) {\n      // This is a correction we make as Sentry Browser SDK may send messages with text/plain to avoid CORS issues\n      contentType = SENTRY_CONTENT_TYPE;\n    }\n\n    // manually decompress body to use it below without another decompression\n    const body = decompressBody(Buffer.from(await ctx.req.arrayBuffer()), ctx.req.header(\"Content-Encoding\"));\n\n    const container = pushToSpotlightBuffer({\n      body,\n      spotlightBuffer: getBuffer(),\n      contentType,\n      userAgent: ctx.req.header(\"User-Agent\"),\n    });\n\n    if (container) {\n      // Log incoming event details when debug is enabled\n      logIncomingEvent(container);\n    } else {\n      logger.warn(\"No content type, skipping payload...\");\n    }\n\n    const incomingPayload = ctx.get(\"incomingPayload\");\n\n    if (process.env.SPOTLIGHT_CAPTURE || incomingPayload) {\n      const contentType = container?.getContentType();\n      const timestamp = BigInt(Date.now()) * 1_000_000n + (process.hrtime.bigint() % 1_000_000n);\n      const filename = `${contentType?.replace(/[^a-z0-9]/gi, \"_\") || \"no_content_type\"}-${timestamp}.txt`;\n\n      if (incomingPayload) {\n        incomingPayload(body.toString(\"binary\"));\n      } else {\n        const stream = createWriteStream(filename);\n        stream.on(\"error\", err => {\n          logger.error(`Failed to save data to ${filename}: ${err}`);\n          stream.destroy();\n        });\n        stream.end(body, () => {\n          logger.info(`🗃️ Saved data to ${filename}`);\n        });\n      }\n    }\n\n    // 204 would be more appropriate but returning 200 to match what /envelope returns\n    return ctx.body(null, 200, {\n      \"Cache-Control\": \"no-cache\",\n      Connection: \"keep-alive\",\n    });\n  });\n\nexport default router;\n"],"names":["contentType"],"mappings":";;;;;;;;;;;;;AAWA,MAAM,SAAS,IAAI,KAAA,EAChB,IAAI,WAAW,CAAA,QAAO;AACrB,QAAM,SAAS,UAAA;AAEf,QAAM,YAAY,IAAI,IAAI,MAAM,QAAQ,KAAK;AAC7C,QAAM,kBAAkB,YAAY,YAAY;AAGhD,MAAI,WAAW,IAAI,IAAI,MAAM,QAAQ;AACrC,MAAI,CAAC,UAAU;AAEb,UAAM,YAAY,IAAI,IAAI,OAAO,YAAY,KAAK;AAClD,eAAW,0BAA0B,SAAS;AAAA,EAChD;AAGA,aAAW,SAAS,QAAQ,kBAAkB,EAAE;AAEhD,MAAI,CAAC,SAAU,YAAW;AAE1B,SAAO,UAAU,KAAK,OAAM,WAAU;AAEpC,UAAM,cAAc,IAAI,IAAI,OAAO,eAAe;AAGlD,UAAM,MAAM,OAAO,UAAU,CAAA,cAAa;AACxC,uBAAiB,WAAW,QAAQ;AAEpC,YAAM,iBAAiB,UAAU,kBAAA;AACjC,UAAI,gBAAgB;AAClB,eAAO,SAAS;AAAA,UACd,IAAI,eAAe,SAAS,CAAC,EAAE,wBAAwB,SAAA;AAAA,UACvD,OAAO,GAAG,UAAU,eAAA,CAAgB,GAAG,eAAe;AAAA,UACtD,MAAM,KAAK,UAAU,eAAe,QAAQ;AAAA,QAAA,CAC7C;AAAA,MACH;AAAA,IACF,GAAG,WAAW;AAEd,WAAO,QAAQ,MAAM;AACnB,aAAO,YAAY,GAAG;AAAA,IACxB,CAAC;AAAA,EACH,CAAC;AACH,CAAC,EACA,IAAI,iBAAiB,CAAA,QAAO;AAC3B,QAAM,SAAS,UAAA;AAEf,QAAM,aAAa,IAAI,IAAI,MAAM,IAAI;AACrC,QAAM,YAAY,OAAO,KAAK,EAAE,YAAY;AAE5C,MAAI,UAAU,WAAW,GAAG;AAC1B,WAAO,IAAI,SAAA;AAAA,EACb;AAEA,SAAO,IAAI,KAAK,IAAI,WAAW,UAAU,CAAC,EAAE,SAAS,GAAG,KAAK;AAAA,IAC3D,gBAAgB,UAAU,CAAC,EAAE,eAAA;AAAA,IAC7B,iBAAiB;AAAA,IACjB,uBAAuB,yBAAyB,UAAU;AAAA,IAC1D,YAAY;AAAA,EAAA,CACb;AACH,CAAC,EACA,GAAG,QAAQ,CAAC,WAAW,mBAAmB,GAAG,OAAM,QAAO;AACzD,MAAI,cAAc,IAAI,IAAI,OAAO,cAAc,GAAG,MAAM,GAAG,EAAE,CAAC,EAAE,kBAAA;AAChE,MAAI,IAAI,IAAI,MAAM,eAAe,GAAG,WAAW,2BAA2B,KAAK,IAAI,IAAI,OAAO,QAAQ,GAAG;AAEvG,kBAAc;AAAA,EAChB;AAGA,QAAM,OAAO,eAAe,OAAO,KAAK,MAAM,IAAI,IAAI,YAAA,CAAa,GAAG,IAAI,IAAI,OAAO,kBAAkB,CAAC;AAExG,QAAM,YAAY,sBAAsB;AAAA,IACtC;AAAA,IACA,iBAAiB,UAAA;AAAA,IACjB;AAAA,IACA,WAAW,IAAI,IAAI,OAAO,YAAY;AAAA,EAAA,CACvC;AAED,MAAI,WAAW;AAEb,qBAAiB,SAAS;AAAA,EAC5B,OAAO;AACL,WAAO,KAAK,sCAAsC;AAAA,EACpD;AAEA,QAAM,kBAAkB,IAAI,IAAI,iBAAiB;AAEjD,MAAI,QAAQ,IAAI,qBAAqB,iBAAiB;AACpD,UAAMA,eAAc,WAAW,eAAA;AAC/B,UAAM,YAAY,OAAO,KAAK,IAAA,CAAK,IAAI,WAAc,QAAQ,OAAO,OAAA,IAAW;AAC/E,UAAM,WAAW,GAAGA,cAAa,QAAQ,eAAe,GAAG,KAAK,iBAAiB,IAAI,SAAS;AAE9F,QAAI,iBAAiB;AACnB,sBAAgB,KAAK,SAAS,QAAQ,CAAC;AAAA,IACzC,OAAO;AACL,YAAM,SAAS,kBAAkB,QAAQ;AACzC,aAAO,GAAG,SAAS,CAAA,QAAO;AACxB,eAAO,MAAM,0BAA0B,QAAQ,KAAK,GAAG,EAAE;AACzD,eAAO,QAAA;AAAA,MACT,CAAC;AACD,aAAO,IAAI,MAAM,MAAM;AACrB,eAAO,KAAK,qBAAqB,QAAQ,EAAE;AAAA,MAC7C,CAAC;AAAA,IACH;AAAA,EACF;AAGA,SAAO,IAAI,KAAK,MAAM,KAAK;AAAA,IACzB,iBAAiB;AAAA,IACjB,YAAY;AAAA,EAAA,CACb;AACH,CAAC;"}
+{"version":3,"file":"index.js","sources":["../../../../src/server/routes/stream/index.ts"],"sourcesContent":["import { createWriteStream } from \"node:fs\";\nimport { Hono } from \"hono\";\nimport { SENTRY_CONTENT_TYPE } from \"../../../shared/constants.ts\";\nimport { logger } from \"../../logger.ts\";\nimport { decompressBody, pushToSpotlightBuffer } from \"../../sdk.ts\";\nimport type { ContentEncoding } from \"../../sdk.ts\";\nimport type { HonoEnv } from \"../../types/env.ts\";\nimport { getBuffer } from \"../../utils/index.ts\";\nimport { logIncomingEvent, logOutgoingEvent } from \"./debugLogging.ts\";\nimport { streamSSE } from \"./streaming.ts\";\nimport { parseBrowserFromUserAgent } from \"./userAgent.ts\";\n\nconst router = new Hono<HonoEnv>()\n  .get(\"/stream\", ctx => {\n    const buffer = getBuffer();\n\n    const useBase64 = ctx.req.query(\"base64\") != null;\n    const base64Indicator = useBase64 ? \";base64\" : \"\";\n\n    // Capture client information for debug logging\n    let clientId = ctx.req.query(\"client\");\n    if (!clientId) {\n      // Fallback to parsing User-Agent if no client param\n      const userAgent = ctx.req.header(\"User-Agent\") || \"unknown\";\n      clientId = parseBrowserFromUserAgent(userAgent);\n    }\n    // Sanitize to prevent log injection - keep only safe printable characters\n    // Allow alphanumeric, spaces, dots, dashes, underscores, slashes, parentheses\n    clientId = clientId.replace(/[^\\w\\s.\\-/()]/g, \"\");\n    // Ensure we always have a non-empty clientId\n    if (!clientId) clientId = \"unknown\";\n\n    return streamSSE(ctx, async stream => {\n      // Check for Last-Event-ID header to support reconnection\n      const lastEventId = ctx.req.header(\"Last-Event-ID\");\n\n      // Subscribe to events, optionally starting from after the lastEventId\n      const sub = buffer.subscribe(container => {\n        logOutgoingEvent(container, clientId);\n\n        const parsedEnvelope = container.getParsedEnvelope();\n        if (parsedEnvelope) {\n          stream.writeSSE({\n            id: parsedEnvelope.envelope[0].__spotlight_envelope_id.toString(),\n            event: `${container.getContentType()}${base64Indicator}`,\n            data: JSON.stringify(parsedEnvelope.envelope),\n          });\n        }\n      }, lastEventId);\n\n      stream.onAbort(() => {\n        buffer.unsubscribe(sub);\n      });\n    });\n  })\n  .get(\"/envelope/:id\", ctx => {\n    const buffer = getBuffer();\n\n    const envelopeId = ctx.req.param(\"id\");\n    const container = buffer.read({ envelopeId });\n\n    if (container.length === 0) {\n      return ctx.notFound();\n    }\n\n    return ctx.body(new Uint8Array(container[0].getData()), 200, {\n      \"Content-Type\": container[0].getContentType(),\n      \"Cache-Control\": \"no-cache\",\n      \"Content-Disposition\": `attachment; filename=\"${envelopeId}.bin\"`,\n      Connection: \"keep-alive\",\n    });\n  })\n  .on(\"POST\", [\"/stream\", \"/api/:id/envelope\"], async ctx => {\n    let contentType = ctx.req.header(\"content-type\")?.split(\";\")[0].toLocaleLowerCase();\n    if (ctx.req.query(\"sentry_client\")?.startsWith(\"sentry.javascript.browser\") && ctx.req.header(\"Origin\")) {\n      // This is a correction we make as Sentry Browser SDK may send messages with text/plain to avoid CORS issues\n      contentType = SENTRY_CONTENT_TYPE;\n    }\n\n    // manually decompress body to use it below without another decompression\n    const body = decompressBody(\n      Buffer.from(await ctx.req.arrayBuffer()),\n      ctx.req.header(\"Content-Encoding\") as ContentEncoding,\n    );\n\n    const container = pushToSpotlightBuffer({\n      body,\n      spotlightBuffer: getBuffer(),\n      contentType,\n      userAgent: ctx.req.header(\"User-Agent\"),\n    });\n\n    if (container) {\n      // Log incoming event details when debug is enabled\n      logIncomingEvent(container);\n    } else {\n      logger.warn(\"No content type, skipping payload...\");\n    }\n\n    const incomingPayload = ctx.get(\"incomingPayload\");\n\n    if (process.env.SPOTLIGHT_CAPTURE || incomingPayload) {\n      const contentType = container?.getContentType();\n      const timestamp = BigInt(Date.now()) * 1_000_000n + (process.hrtime.bigint() % 1_000_000n);\n      const filename = `${contentType?.replace(/[^a-z0-9]/gi, \"_\") || \"no_content_type\"}-${timestamp}.txt`;\n\n      if (incomingPayload) {\n        incomingPayload(body.toString(\"binary\"));\n      } else {\n        const stream = createWriteStream(filename);\n        stream.on(\"error\", err => {\n          logger.error(`Failed to save data to ${filename}: ${err}`);\n          stream.destroy();\n        });\n        stream.end(body, () => {\n          logger.info(`🗃️ Saved data to ${filename}`);\n        });\n      }\n    }\n\n    // 204 would be more appropriate but returning 200 to match what /envelope returns\n    return ctx.body(null, 200, {\n      \"Cache-Control\": \"no-cache\",\n      Connection: \"keep-alive\",\n    });\n  });\n\nexport default router;\n"],"names":["contentType"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;AAYA,MAAM,SAAS,IAAI,KAAA,EAChB,IAAI,WAAW,CAAA,QAAO;AACrB,QAAM,SAAS,UAAA;AAEf,QAAM,YAAY,IAAI,IAAI,MAAM,QAAQ,KAAK;AAC7C,QAAM,kBAAkB,YAAY,YAAY;AAGhD,MAAI,WAAW,IAAI,IAAI,MAAM,QAAQ;AACrC,MAAI,CAAC,UAAU;AAEb,UAAM,YAAY,IAAI,IAAI,OAAO,YAAY,KAAK;AAClD,eAAW,0BAA0B,SAAS;AAAA,EAChD;AAGA,aAAW,SAAS,QAAQ,kBAAkB,EAAE;AAEhD,MAAI,CAAC,SAAU,YAAW;AAE1B,SAAO,UAAU,KAAK,OAAM,WAAU;AAEpC,UAAM,cAAc,IAAI,IAAI,OAAO,eAAe;AAGlD,UAAM,MAAM,OAAO,UAAU,CAAA,cAAa;AACxC,uBAAiB,WAAW,QAAQ;AAEpC,YAAM,iBAAiB,UAAU,kBAAA;AACjC,UAAI,gBAAgB;AAClB,eAAO,SAAS;AAAA,UACd,IAAI,eAAe,SAAS,CAAC,EAAE,wBAAwB,SAAA;AAAA,UACvD,OAAO,GAAG,UAAU,eAAA,CAAgB,GAAG,eAAe;AAAA,UACtD,MAAM,KAAK,UAAU,eAAe,QAAQ;AAAA,QAAA,CAC7C;AAAA,MACH;AAAA,IACF,GAAG,WAAW;AAEd,WAAO,QAAQ,MAAM;AACnB,aAAO,YAAY,GAAG;AAAA,IACxB,CAAC;AAAA,EACH,CAAC;AACH,CAAC,EACA,IAAI,iBAAiB,CAAA,QAAO;AAC3B,QAAM,SAAS,UAAA;AAEf,QAAM,aAAa,IAAI,IAAI,MAAM,IAAI;AACrC,QAAM,YAAY,OAAO,KAAK,EAAE,YAAY;AAE5C,MAAI,UAAU,WAAW,GAAG;AAC1B,WAAO,IAAI,SAAA;AAAA,EACb;AAEA,SAAO,IAAI,KAAK,IAAI,WAAW,UAAU,CAAC,EAAE,SAAS,GAAG,KAAK;AAAA,IAC3D,gBAAgB,UAAU,CAAC,EAAE,eAAA;AAAA,IAC7B,iBAAiB;AAAA,IACjB,uBAAuB,yBAAyB,UAAU;AAAA,IAC1D,YAAY;AAAA,EAAA,CACb;AACH,CAAC,EACA,GAAG,QAAQ,CAAC,WAAW,mBAAmB,GAAG,OAAM,QAAO;AACzD,MAAI,cAAc,IAAI,IAAI,OAAO,cAAc,GAAG,MAAM,GAAG,EAAE,CAAC,EAAE,kBAAA;AAChE,MAAI,IAAI,IAAI,MAAM,eAAe,GAAG,WAAW,2BAA2B,KAAK,IAAI,IAAI,OAAO,QAAQ,GAAG;AAEvG,kBAAc;AAAA,EAChB;AAGA,QAAM,OAAO;AAAA,IACX,OAAO,KAAK,MAAM,IAAI,IAAI,aAAa;AAAA,IACvC,IAAI,IAAI,OAAO,kBAAkB;AAAA,EAAA;AAGnC,QAAM,YAAY,sBAAsB;AAAA,IACtC;AAAA,IACA,iBAAiB,UAAA;AAAA,IACjB;AAAA,IACA,WAAW,IAAI,IAAI,OAAO,YAAY;AAAA,EAAA,CACvC;AAED,MAAI,WAAW;AAEb,qBAAiB,SAAS;AAAA,EAC5B,OAAO;AACL,WAAO,KAAK,sCAAsC;AAAA,EACpD;AAEA,QAAM,kBAAkB,IAAI,IAAI,iBAAiB;AAEjD,MAAI,QAAQ,IAAI,qBAAqB,iBAAiB;AACpD,UAAMA,eAAc,WAAW,eAAA;AAC/B,UAAM,YAAY,OAAO,KAAK,IAAA,CAAK,IAAI,WAAc,QAAQ,OAAO,OAAA,IAAW;AAC/E,UAAM,WAAW,GAAGA,cAAa,QAAQ,eAAe,GAAG,KAAK,iBAAiB,IAAI,SAAS;AAE9F,QAAI,iBAAiB;AACnB,sBAAgB,KAAK,SAAS,QAAQ,CAAC;AAAA,IACzC,OAAO;AACL,YAAM,SAAS,kBAAkB,QAAQ;AACzC,aAAO,GAAG,SAAS,CAAA,QAAO;AACxB,eAAO,MAAM,0BAA0B,QAAQ,KAAK,GAAG,EAAE;AACzD,eAAO,QAAA;AAAA,MACT,CAAC;AACD,aAAO,IAAI,MAAM,MAAM;AACrB,eAAO,KAAK,qBAAqB,QAAQ,EAAE;AAAA,MAC7C,CAAC;AAAA,IACH;AAAA,EACF;AAGA,SAAO,IAAI,KAAK,MAAM,KAAK;AAAA,IACzB,iBAAiB;AAAA,IACjB,YAAY;AAAA,EAAA,CACb;AACH,CAAC;"}

package/dist/server/routes/stream/streaming.js

@@ -1,5 +1,14 @@
+;
+!function() {
+  try {
+    var e = "undefined" != typeof window ? window : "undefined" != typeof global ? global : "undefined" != typeof globalThis ? globalThis : "undefined" != typeof self ? self : {}, n = new e.Error().stack;
+    n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "fe8af0d5-27a9-4341-90d6-e57e107c3c7d", e._sentryDebugIdIdentifier = "sentry-dbid-fe8af0d5-27a9-4341-90d6-e57e107c3c7d");
+  } catch (e2) {
+  }
+}();
 import { captureException } from "@sentry/node";
 import { SSEStreamingApi } from "../../../node_modules/.pnpm/hono@4.10.3/node_modules/hono/dist/helper/streaming/sse.js";
+import "../../../_virtual/_sentry-release-injection-file.js";
 const run = async (stream, cb, onError) => {
   try {
     await cb(stream);

package/dist/server/routes/stream/streaming.js.map

@@ -1 +1 @@
-{"version":3,"file":"streaming.js","sources":["../../../../src/server/routes/stream/streaming.ts"],"sourcesContent":["import { captureException } from \"@sentry/node\";\nimport type { Context } from \"hono\";\nimport { SSEStreamingApi } from \"hono/streaming\";\n\nconst run = async (\n  stream: SSEStreamingApi,\n  cb: (stream: SSEStreamingApi) => Promise<void>,\n  onError?: (e: Error, stream: SSEStreamingApi) => Promise<void>,\n): Promise<void> => {\n  try {\n    await cb(stream);\n  } catch (e) {\n    if (e instanceof Error && onError) {\n      await onError(e, stream);\n\n      await stream.writeSSE({\n        event: \"error\",\n        data: e.message,\n      });\n    } else {\n      captureException(e, { extra: { context: \"Unhandled error in SSE stream\" } });\n    }\n  }\n};\n\nexport const streamSSE = (\n  c: Context,\n  cb: (stream: SSEStreamingApi) => Promise<void>,\n  onError?: (e: Error, stream: SSEStreamingApi) => Promise<void>,\n): Response => {\n  const { readable, writable } = new TransformStream();\n  const stream = new SSEStreamingApi(writable, readable);\n\n  c.header(\"Transfer-Encoding\", \"chunked\");\n  c.header(\"Content-Type\", \"text/event-stream\");\n  c.header(\"Cache-Control\", \"no-cache\");\n  c.header(\"Connection\", \"keep-alive\");\n\n  // Send something in the body to trigger the `open` event\n  // This is mostly for Firefox -- see #376\n  stream.writeln(\"\");\n\n  run(stream, cb, onError);\n\n  return c.newResponse(stream.responseReadable);\n};\n"],"names":[],"mappings":";;AAIA,MAAM,MAAM,OACV,QACA,IACA,YACkB;AAClB,MAAI;AACF,UAAM,GAAG,MAAM;AAAA,EACjB,SAAS,GAAG;AAQH;AACL,uBAAiB,GAAG,EAAE,OAAO,EAAE,SAAS,gCAAA,GAAmC;AAAA,IAC7E;AAAA,EACF;AACF;AAEO,MAAM,YAAY,CACvB,GACA,IACA,YACa;AACb,QAAM,EAAE,UAAU,SAAA,IAAa,IAAI,gBAAA;AACnC,QAAM,SAAS,IAAI,gBAAgB,UAAU,QAAQ;AAErD,IAAE,OAAO,qBAAqB,SAAS;AACvC,IAAE,OAAO,gBAAgB,mBAAmB;AAC5C,IAAE,OAAO,iBAAiB,UAAU;AACpC,IAAE,OAAO,cAAc,YAAY;AAInC,SAAO,QAAQ,EAAE;AAEjB,MAAI,QAAQ,EAAW;AAEvB,SAAO,EAAE,YAAY,OAAO,gBAAgB;AAC9C;"}
+{"version":3,"file":"streaming.js","sources":["../../../../src/server/routes/stream/streaming.ts"],"sourcesContent":["import { captureException } from \"@sentry/node\";\nimport type { Context } from \"hono\";\nimport { SSEStreamingApi } from \"hono/streaming\";\n\nconst run = async (\n  stream: SSEStreamingApi,\n  cb: (stream: SSEStreamingApi) => Promise<void>,\n  onError?: (e: Error, stream: SSEStreamingApi) => Promise<void>,\n): Promise<void> => {\n  try {\n    await cb(stream);\n  } catch (e) {\n    if (e instanceof Error && onError) {\n      await onError(e, stream);\n\n      await stream.writeSSE({\n        event: \"error\",\n        data: e.message,\n      });\n    } else {\n      captureException(e, { extra: { context: \"Unhandled error in SSE stream\" } });\n    }\n  }\n};\n\nexport const streamSSE = (\n  c: Context,\n  cb: (stream: SSEStreamingApi) => Promise<void>,\n  onError?: (e: Error, stream: SSEStreamingApi) => Promise<void>,\n): Response => {\n  const { readable, writable } = new TransformStream();\n  const stream = new SSEStreamingApi(writable, readable);\n\n  c.header(\"Transfer-Encoding\", \"chunked\");\n  c.header(\"Content-Type\", \"text/event-stream\");\n  c.header(\"Cache-Control\", \"no-cache\");\n  c.header(\"Connection\", \"keep-alive\");\n\n  // Send something in the body to trigger the `open` event\n  // This is mostly for Firefox -- see #376\n  stream.writeln(\"\");\n\n  run(stream, cb, onError);\n\n  return c.newResponse(stream.responseReadable);\n};\n"],"names":[],"mappings":";;;;;;;;;;;AAIA,MAAM,MAAM,OACV,QACA,IACA,YACkB;AAClB,MAAI;AACF,UAAM,GAAG,MAAM;AAAA,EACjB,SAAS,GAAG;AAQH;AACL,uBAAiB,GAAG,EAAE,OAAO,EAAE,SAAS,gCAAA,GAAmC;AAAA,IAC7E;AAAA,EACF;AACF;AAEO,MAAM,YAAY,CACvB,GACA,IACA,YACa;AACb,QAAM,EAAE,UAAU,SAAA,IAAa,IAAI,gBAAA;AACnC,QAAM,SAAS,IAAI,gBAAgB,UAAU,QAAQ;AAErD,IAAE,OAAO,qBAAqB,SAAS;AACvC,IAAE,OAAO,gBAAgB,mBAAmB;AAC5C,IAAE,OAAO,iBAAiB,UAAU;AACpC,IAAE,OAAO,cAAc,YAAY;AAInC,SAAO,QAAQ,EAAE;AAEjB,MAAI,QAAQ,EAAW;AAEvB,SAAO,EAAE,YAAY,OAAO,gBAAgB;AAC9C;"}

package/dist/server/routes/stream/userAgent.js

@@ -1,3 +1,12 @@
+;
+!function() {
+  try {
+    var e = "undefined" != typeof window ? window : "undefined" != typeof global ? global : "undefined" != typeof globalThis ? globalThis : "undefined" != typeof self ? self : {}, n = new e.Error().stack;
+    n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "973355d8-c9ea-4dc7-b5bb-32f849e751bc", e._sentryDebugIdIdentifier = "sentry-dbid-973355d8-c9ea-4dc7-b5bb-32f849e751bc");
+  } catch (e2) {
+  }
+}();
+import "../../../_virtual/_sentry-release-injection-file.js";
 function parseBrowserFromUserAgent(userAgent) {
   if (!userAgent) return "unknown";
   if (userAgent.includes("Chrome/") && !userAgent.includes("Edg/")) {

package/dist/server/routes/stream/userAgent.js.map

@@ -1 +1 @@
-{"version":3,"file":"userAgent.js","sources":["../../../../src/server/routes/stream/userAgent.ts"],"sourcesContent":["/**\n * Extracts browser name and major version from a User-Agent string\n * Returns format like \"Chrome/131\" or \"Firefox/122\"\n */\nexport function parseBrowserFromUserAgent(userAgent: string): string {\n  if (!userAgent) return \"unknown\";\n\n  // Check for Chrome (but not Edge which also contains Chrome)\n  if (userAgent.includes(\"Chrome/\") && !userAgent.includes(\"Edg/\")) {\n    const match = userAgent.match(/Chrome\\/([\\d]+)/);\n    return match ? `Chrome/${match[1]}` : \"Chrome\";\n  }\n\n  // Check for Firefox\n  if (userAgent.includes(\"Firefox/\")) {\n    const match = userAgent.match(/Firefox\\/([\\d]+)/);\n    return match ? `Firefox/${match[1]}` : \"Firefox\";\n  }\n\n  // Check for Safari (but not Chrome which also contains Safari)\n  if (userAgent.includes(\"Safari/\") && !userAgent.includes(\"Chrome\")) {\n    const match = userAgent.match(/Version\\/([\\d]+)/);\n    return match ? `Safari/${match[1]}` : \"Safari\";\n  }\n\n  // Check for Edge\n  if (userAgent.includes(\"Edg/\")) {\n    const match = userAgent.match(/Edg\\/([\\d]+)/);\n    return match ? `Edge/${match[1]}` : \"Edge\";\n  }\n\n  // Generic fallback - try to extract first meaningful part\n  const match = userAgent.match(/^([^\\/\\s\\(]+)/);\n  return match ? match[1] : \"unknown\";\n}\n\n/**\n * Builds a client identifier from browser info and optional hostname\n * Format: clientName/version (metadata)\n * Example: \"ui/Chrome/131 (example.com)\"\n */\nexport function buildClientIdentifier(clientName: string, userAgent?: string, hostname?: string): string {\n  let clientId = clientName;\n\n  if (userAgent) {\n    const browserInfo = parseBrowserFromUserAgent(userAgent);\n    if (browserInfo !== \"unknown\") {\n      clientId = `${clientName}/${browserInfo}`;\n    }\n  }\n\n  if (hostname && hostname !== \"localhost\") {\n    clientId += ` (${hostname})`;\n  }\n\n  return clientId;\n}\n"],"names":["match"],"mappings":"AAIO,SAAS,0BAA0B,WAA2B;AACnE,MAAI,CAAC,UAAW,QAAO;AAGvB,MAAI,UAAU,SAAS,SAAS,KAAK,CAAC,UAAU,SAAS,MAAM,GAAG;AAChE,UAAMA,SAAQ,UAAU,MAAM,iBAAiB;AAC/C,WAAOA,SAAQ,UAAUA,OAAM,CAAC,CAAC,KAAK;AAAA,EACxC;AAGA,MAAI,UAAU,SAAS,UAAU,GAAG;AAClC,UAAMA,SAAQ,UAAU,MAAM,kBAAkB;AAChD,WAAOA,SAAQ,WAAWA,OAAM,CAAC,CAAC,KAAK;AAAA,EACzC;AAGA,MAAI,UAAU,SAAS,SAAS,KAAK,CAAC,UAAU,SAAS,QAAQ,GAAG;AAClE,UAAMA,SAAQ,UAAU,MAAM,kBAAkB;AAChD,WAAOA,SAAQ,UAAUA,OAAM,CAAC,CAAC,KAAK;AAAA,EACxC;AAGA,MAAI,UAAU,SAAS,MAAM,GAAG;AAC9B,UAAMA,SAAQ,UAAU,MAAM,cAAc;AAC5C,WAAOA,SAAQ,QAAQA,OAAM,CAAC,CAAC,KAAK;AAAA,EACtC;AAGA,QAAM,QAAQ,UAAU,MAAM,eAAe;AAC7C,SAAO,QAAQ,MAAM,CAAC,IAAI;AAC5B;"}
+{"version":3,"file":"userAgent.js","sources":["../../../../src/server/routes/stream/userAgent.ts"],"sourcesContent":["/**\n * Extracts browser name and major version from a User-Agent string\n * Returns format like \"Chrome/131\" or \"Firefox/122\"\n */\nexport function parseBrowserFromUserAgent(userAgent: string): string {\n  if (!userAgent) return \"unknown\";\n\n  // Check for Chrome (but not Edge which also contains Chrome)\n  if (userAgent.includes(\"Chrome/\") && !userAgent.includes(\"Edg/\")) {\n    const match = userAgent.match(/Chrome\\/([\\d]+)/);\n    return match ? `Chrome/${match[1]}` : \"Chrome\";\n  }\n\n  // Check for Firefox\n  if (userAgent.includes(\"Firefox/\")) {\n    const match = userAgent.match(/Firefox\\/([\\d]+)/);\n    return match ? `Firefox/${match[1]}` : \"Firefox\";\n  }\n\n  // Check for Safari (but not Chrome which also contains Safari)\n  if (userAgent.includes(\"Safari/\") && !userAgent.includes(\"Chrome\")) {\n    const match = userAgent.match(/Version\\/([\\d]+)/);\n    return match ? `Safari/${match[1]}` : \"Safari\";\n  }\n\n  // Check for Edge\n  if (userAgent.includes(\"Edg/\")) {\n    const match = userAgent.match(/Edg\\/([\\d]+)/);\n    return match ? `Edge/${match[1]}` : \"Edge\";\n  }\n\n  // Generic fallback - try to extract first meaningful part\n  const match = userAgent.match(/^([^\\/\\s\\(]+)/);\n  return match ? match[1] : \"unknown\";\n}\n\n/**\n * Builds a client identifier from browser info and optional hostname\n * Format: clientName/version (metadata)\n * Example: \"ui/Chrome/131 (example.com)\"\n */\nexport function buildClientIdentifier(clientName: string, userAgent?: string, hostname?: string): string {\n  let clientId = clientName;\n\n  if (userAgent) {\n    const browserInfo = parseBrowserFromUserAgent(userAgent);\n    if (browserInfo !== \"unknown\") {\n      clientId = `${clientName}/${browserInfo}`;\n    }\n  }\n\n  if (hostname && hostname !== \"localhost\") {\n    clientId += ` (${hostname})`;\n  }\n\n  return clientId;\n}\n"],"names":["match"],"mappings":";;;;;;;;;AAIO,SAAS,0BAA0B,WAA2B;AACnE,MAAI,CAAC,UAAW,QAAO;AAGvB,MAAI,UAAU,SAAS,SAAS,KAAK,CAAC,UAAU,SAAS,MAAM,GAAG;AAChE,UAAMA,SAAQ,UAAU,MAAM,iBAAiB;AAC/C,WAAOA,SAAQ,UAAUA,OAAM,CAAC,CAAC,KAAK;AAAA,EACxC;AAGA,MAAI,UAAU,SAAS,UAAU,GAAG;AAClC,UAAMA,SAAQ,UAAU,MAAM,kBAAkB;AAChD,WAAOA,SAAQ,WAAWA,OAAM,CAAC,CAAC,KAAK;AAAA,EACzC;AAGA,MAAI,UAAU,SAAS,SAAS,KAAK,CAAC,UAAU,SAAS,QAAQ,GAAG;AAClE,UAAMA,SAAQ,UAAU,MAAM,kBAAkB;AAChD,WAAOA,SAAQ,UAAUA,OAAM,CAAC,CAAC,KAAK;AAAA,EACxC;AAGA,MAAI,UAAU,SAAS,MAAM,GAAG;AAC9B,UAAMA,SAAQ,UAAU,MAAM,cAAc;AAC5C,WAAOA,SAAQ,QAAQA,OAAM,CAAC,CAAC,KAAK;AAAA,EACtC;AAGA,QAAM,QAAQ,UAAU,MAAM,eAAe;AAC7C,SAAO,QAAQ,MAAM,CAAC,IAAI;AAC5B;"}

package/dist/server/sdk.d.ts

@@ -1,7 +1,7 @@
 import { MessageBuffer } from './messageBuffer.ts';
 import { EventContainer } from './utils/eventContainer.ts';
 declare const decompressors: Record<"gzip" | "deflate" | "br", (buf: Buffer) => Buffer>;
-type ContentEncoding = keyof typeof decompressors;
+export type ContentEncoding = keyof typeof decompressors;
 export declare function createSpotlightBuffer(): MessageBuffer<EventContainer>;
 type PushToSpotlightBufferOptions = {
     spotlightBuffer: MessageBuffer<EventContainer>;

package/dist/server/sdk.js

@@ -1,6 +1,15 @@
+;
+!function() {
+  try {
+    var e = "undefined" != typeof window ? window : "undefined" != typeof global ? global : "undefined" != typeof globalThis ? globalThis : "undefined" != typeof self ? self : {}, n = new e.Error().stack;
+    n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "75ed20dd-d677-4ccd-a15b-af93d9a30db1", e._sentryDebugIdIdentifier = "sentry-dbid-75ed20dd-d677-4ccd-a15b-af93d9a30db1");
+  } catch (e2) {
+  }
+}();
 import { brotliDecompressSync, inflateSync, gunzipSync } from "node:zlib";
 import { MessageBuffer } from "./messageBuffer.js";
 import { EventContainer } from "./utils/eventContainer.js";
+import "../_virtual/_sentry-release-injection-file.js";
 const decompressors = {
   gzip: gunzipSync,
   deflate: inflateSync,

package/dist/server/sdk.js.map

@@ -1 +1 @@
-{"version":3,"file":"sdk.js","sources":["../../src/server/sdk.ts"],"sourcesContent":["import { brotliDecompressSync, gunzipSync, inflateSync } from \"node:zlib\";\nimport { MessageBuffer } from \"./messageBuffer.ts\";\nimport { EventContainer } from \"./utils/eventContainer.ts\";\n\nconst decompressors: Record<\"gzip\" | \"deflate\" | \"br\", (buf: Buffer) => Buffer> = {\n  gzip: gunzipSync,\n  deflate: inflateSync,\n  br: brotliDecompressSync,\n};\ntype ContentEncoding = keyof typeof decompressors;\n\nexport function createSpotlightBuffer() {\n  return new MessageBuffer<EventContainer>();\n}\n\ntype PushToSpotlightBufferOptions = {\n  spotlightBuffer: MessageBuffer<EventContainer>;\n  body: Buffer;\n  encoding?: ContentEncoding;\n  contentType?: string;\n  userAgent?: string;\n};\n\nexport function pushToSpotlightBuffer(options: PushToSpotlightBufferOptions) {\n  const body = decompressBody(options.body, options.encoding);\n\n  const contentType = options.contentType?.split(\";\")[0].toLocaleLowerCase();\n\n  if (contentType) {\n    // Create event container and add to buffer\n    const container = new EventContainer(contentType, body, options.userAgent);\n\n    // Add to buffer - this will automatically trigger all subscribers\n    // including the onEnvelope callback if one is registered\n    options.spotlightBuffer.put(container);\n\n    return container;\n  }\n}\n\nexport function decompressBody(body: Buffer, contentEncoding?: ContentEncoding) {\n  if (!contentEncoding) {\n    return body;\n  }\n  return decompressors[contentEncoding](body);\n}\n"],"names":[],"mappings":";;;AAIA,MAAM,gBAA4E;AAAA,EAChF,MAAM;AAAA,EACN,SAAS;AAAA,EACT,IAAI;AACN;AAGO,SAAS,wBAAwB;AACtC,SAAO,IAAI,cAAA;AACb;AAUO,SAAS,sBAAsB,SAAuC;AAC3E,QAAM,OAAO,eAAe,QAAQ,MAAM,QAAQ,QAAQ;AAE1D,QAAM,cAAc,QAAQ,aAAa,MAAM,GAAG,EAAE,CAAC,EAAE,kBAAA;AAEvD,MAAI,aAAa;AAEf,UAAM,YAAY,IAAI,eAAe,aAAa,MAAM,QAAQ,SAAS;AAIzE,YAAQ,gBAAgB,IAAI,SAAS;AAErC,WAAO;AAAA,EACT;AACF;AAEO,SAAS,eAAe,MAAc,iBAAmC;AAC9E,MAAI,CAAC,iBAAiB;AACpB,WAAO;AAAA,EACT;AACA,SAAO,cAAc,eAAe,EAAE,IAAI;AAC5C;"}
+{"version":3,"file":"sdk.js","sources":["../../src/server/sdk.ts"],"sourcesContent":["import { brotliDecompressSync, gunzipSync, inflateSync } from \"node:zlib\";\nimport { MessageBuffer } from \"./messageBuffer.ts\";\nimport { EventContainer } from \"./utils/eventContainer.ts\";\n\nconst decompressors: Record<\"gzip\" | \"deflate\" | \"br\", (buf: Buffer) => Buffer> = {\n  gzip: gunzipSync,\n  deflate: inflateSync,\n  br: brotliDecompressSync,\n};\n\nexport type ContentEncoding = keyof typeof decompressors;\n\nexport function createSpotlightBuffer() {\n  return new MessageBuffer<EventContainer>();\n}\n\ntype PushToSpotlightBufferOptions = {\n  spotlightBuffer: MessageBuffer<EventContainer>;\n  body: Buffer;\n  encoding?: ContentEncoding;\n  contentType?: string;\n  userAgent?: string;\n};\n\nexport function pushToSpotlightBuffer(options: PushToSpotlightBufferOptions) {\n  const body = decompressBody(options.body, options.encoding);\n\n  const contentType = options.contentType?.split(\";\")[0].toLocaleLowerCase();\n\n  if (contentType) {\n    // Create event container and add to buffer\n    const container = new EventContainer(contentType, body, options.userAgent);\n\n    // Add to buffer - this will automatically trigger all subscribers\n    // including the onEnvelope callback if one is registered\n    options.spotlightBuffer.put(container);\n\n    return container;\n  }\n}\n\nexport function decompressBody(body: Buffer, contentEncoding?: ContentEncoding) {\n  if (!contentEncoding) {\n    return body;\n  }\n  return decompressors[contentEncoding](body);\n}\n"],"names":[],"mappings":";;;;;;;;;;;;AAIA,MAAM,gBAA4E;AAAA,EAChF,MAAM;AAAA,EACN,SAAS;AAAA,EACT,IAAI;AACN;AAIO,SAAS,wBAAwB;AACtC,SAAO,IAAI,cAAA;AACb;AAUO,SAAS,sBAAsB,SAAuC;AAC3E,QAAM,OAAO,eAAe,QAAQ,MAAM,QAAQ,QAAQ;AAE1D,QAAM,cAAc,QAAQ,aAAa,MAAM,GAAG,EAAE,CAAC,EAAE,kBAAA;AAEvD,MAAI,aAAa;AAEf,UAAM,YAAY,IAAI,eAAe,aAAa,MAAM,QAAQ,SAAS;AAIzE,YAAQ,gBAAgB,IAAI,SAAS;AAErC,WAAO;AAAA,EACT;AACF;AAEO,SAAS,eAAe,MAAc,iBAAmC;AAC9E,MAAI,CAAC,iBAAiB;AACpB,WAAO;AAAA,EACT;AACA,SAAO,cAAc,eAAe,EAAE,IAAI;AAC5C;"}

package/dist/server/types/cli.d.ts

@@ -9,6 +9,7 @@ export type CLIHandlerOptions = {
     format?: FormatterType;
     basePath?: SideCarOptions["basePath"];
     filesToServe?: SideCarOptions["filesToServe"];
+    allowedOrigins?: SideCarOptions["allowedOrigins"];
 };
 export type CLIHandlerReturnType = Promise<any> | any;
 export type CLIHandler = ((options: CLIHandlerOptions) => CLIHandlerReturnType) | (() => CLIHandlerReturnType);

package/dist/server/types/utils.d.ts

@@ -1,4 +1,5 @@
 import { ParsedEnvelope } from '../parser/processEnvelope.ts';
+import { NormalizedAllowedOrigins } from '../utils/cors.ts';
 export type IncomingPayloadCallback = (body: string) => void;
 export type OnEnvelopeCallback = (envelope: ParsedEnvelope["envelope"]) => void;
 export type SidecarLogger = {
@@ -38,7 +39,18 @@ export type SideCarOptions = {
     onEnvelope?: OnEnvelopeCallback;
     isStandalone?: boolean;
     stdioMCP?: boolean;
+    /**
+     * Additional origins to allow for CORS requests.
+     * Useful for custom local domains, tunnels, etc.
+     *
+     * Accepts two formats:
+     * - Full origins (e.g., "https://ngrok.io:443") for strict matching
+     * - Plain domains (e.g., "myapp.local") to allow any protocol/port
+     */
+    allowedOrigins?: string[];
 };
 export type StartServerOptions = Pick<SideCarOptions, "basePath" | "filesToServe" | "incomingPayload"> & {
     port: number;
+    /** Pre-normalized allowed origins for CORS (use normalizeAllowedOrigins() to create) */
+    normalizedAllowedOrigins?: NormalizedAllowedOrigins;
 };

package/dist/server/utils/cors.d.ts

@@ -1,12 +1,42 @@
+/**
+ * Pre-normalized allowed origins for efficient matching.
+ * Call normalizeAllowedOrigins() once at server startup to create this structure.
+ */
+export interface NormalizedAllowedOrigins {
+    /** Full origins (lowercased, trailing slash removed) for exact matching */
+    fullOrigins: Set<string>;
+    /** Plain domains (lowercased) for permissive matching */
+    domains: Set<string>;
+}
+/**
+ * Normalize and classify allowed origins for efficient matching.
+ * Call this once at server startup, then pass the result to isAllowedOrigin().
+ *
+ * @param allowedOrigins - Raw list of allowed origins/domains from config
+ * @returns Pre-normalized structure for O(1) lookups
+ */
+export declare function normalizeAllowedOrigins(allowedOrigins: string[]): NormalizedAllowedOrigins;
+/**
+ * Clear the DNS cache, pending resolutions, and machine IPs cache. Useful for testing.
+ */
+export declare function clearDnsCache(): void;
+/**
+ * Get the current DNS cache size. Useful for testing.
+ */
+export declare function getDnsCacheSize(): number;
 /**
  * Validates if an origin should be allowed to access the Sidecar.
  *
  * Allowed origins:
- * - localhost with any port or protocol (http/https)
- * - https://spotlightjs.com (HTTPS only, default port)
- * - https://*.spotlightjs.com (HTTPS only, default port)
+ * - localhost (RFC 6761 reserved name, always trusted)
+ * - Any origin whose hostname resolves to this machine's IPs (with TTL >= 1h)
+ * - https://spotlightjs.com and subdomains (HTTPS only, default port)
+ * - Custom origins/domains from the normalizedAllowedOrigins list
+ *
+ * For DNS rebinding protection details, see the TTL Constants section above.
  *
  * @param origin - The origin to validate
- * @returns true if the origin is allowed, false otherwise
+ * @param normalizedAllowedOrigins - Optional pre-normalized allowed origins (from normalizeAllowedOrigins())
+ * @returns Promise<boolean> - true if the origin is allowed, false otherwise
  */
-export declare function isAllowedOrigin(origin: string): boolean;
+export declare function isAllowedOrigin(origin: string, normalizedAllowedOrigins?: NormalizedAllowedOrigins): Promise<boolean>;

package/dist/server/utils/cors.js

@@ -1,22 +1,195 @@
-function isAllowedOrigin(origin) {
+;
+!function() {
+  try {
+    var e = "undefined" != typeof window ? window : "undefined" != typeof global ? global : "undefined" != typeof globalThis ? globalThis : "undefined" != typeof self ? self : {}, n = new e.Error().stack;
+    n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "4dd6e253-0d5e-4edb-bdeb-58750d0d4592", e._sentryDebugIdIdentifier = "sentry-dbid-4dd6e253-0d5e-4edb-bdeb-58750d0d4592");
+  } catch (e2) {
+  }
+}();
+import dns from "node:dns/promises";
+import net from "node:net";
+import os__default from "node:os";
+import "../../_virtual/_sentry-release-injection-file.js";
+const dnsCache = /* @__PURE__ */ new Map();
+const pendingResolutions = /* @__PURE__ */ new Map();
+const MIN_TTL_SECONDS = 60 * 60;
+const DEFAULT_TTL_MS = 60 * 60 * 1e3;
+const FAILURE_TTL_MS = 5 * 60 * 1e3;
+let machineIPsCache = null;
+let machineIPsCacheTime = 0;
+const MACHINE_IPS_CACHE_TTL_MS = 60 * 1e3;
+function getMachineIPs() {
+  const now = Date.now();
+  if (machineIPsCache && now - machineIPsCacheTime < MACHINE_IPS_CACHE_TTL_MS) {
+    return machineIPsCache;
+  }
+  const ips = /* @__PURE__ */ new Set();
+  const interfaces = os__default.networkInterfaces();
+  for (const name in interfaces) {
+    const addresses = interfaces[name];
+    if (addresses) {
+      for (const addr of addresses) {
+        ips.add(addr.address);
+      }
+    }
+  }
+  machineIPsCache = ips;
+  machineIPsCacheTime = now;
+  return ips;
+}
+function isIPAddress(hostname) {
+  const cleanHostname = hostname.startsWith("[") && hostname.endsWith("]") ? hostname.slice(1, -1) : hostname;
+  return net.isIP(cleanHostname) !== 0;
+}
+function isLocalMachineIP(ip) {
+  const cleanIP = ip.startsWith("[") && ip.endsWith("]") ? ip.slice(1, -1) : ip;
+  const machineIPs = getMachineIPs();
+  return machineIPs.has(cleanIP);
+}
+async function resolveHostname(hostname) {
+  const dnsAddresses = [];
+  const hostsFileAddresses = [];
+  let minTtl;
+  const [resolve4Result, resolve6Result, lookupResult] = await Promise.allSettled([
+    dns.resolve4(hostname, { ttl: true }),
+    dns.resolve6(hostname, { ttl: true }),
+    dns.lookup(hostname, { all: true })
+  ]);
+  const dnsSucceeded = resolve4Result.status === "fulfilled" || resolve6Result.status === "fulfilled";
+  if (resolve4Result.status === "fulfilled") {
+    for (const record of resolve4Result.value) {
+      dnsAddresses.push({ address: record.address, ttl: record.ttl });
+      if (record.ttl !== void 0) {
+        minTtl = minTtl === void 0 ? record.ttl : Math.min(minTtl, record.ttl);
+      }
+    }
+  }
+  if (resolve6Result.status === "fulfilled") {
+    for (const record of resolve6Result.value) {
+      dnsAddresses.push({ address: record.address, ttl: record.ttl });
+      if (record.ttl !== void 0) {
+        minTtl = minTtl === void 0 ? record.ttl : Math.min(minTtl, record.ttl);
+      }
+    }
+  }
+  if (!dnsSucceeded && lookupResult.status === "fulfilled") {
+    const lookupAddresses = Array.isArray(lookupResult.value) ? lookupResult.value : [lookupResult.value];
+    for (const record of lookupAddresses) {
+      hostsFileAddresses.push(record.address);
+    }
+  }
+  return { dnsAddresses, hostsFileAddresses, minTtl };
+}
+async function resolveAndCacheHostname(hostname) {
+  try {
+    const { dnsAddresses, hostsFileAddresses, minTtl } = await resolveHostname(hostname);
+    const hostsLocal = hostsFileAddresses.some((addr) => isLocalMachineIP(addr));
+    if (hostsLocal) {
+      dnsCache.set(hostname, {
+        isLocal: true,
+        expiresAt: Date.now() + DEFAULT_TTL_MS
+      });
+      return true;
+    }
+    const dnsLocal = dnsAddresses.some((result) => isLocalMachineIP(result.address));
+    if (dnsLocal) {
+      if (minTtl !== void 0 && minTtl < MIN_TTL_SECONDS) {
+        dnsCache.set(hostname, {
+          isLocal: false,
+          expiresAt: Date.now() + FAILURE_TTL_MS
+        });
+        return false;
+      }
+      const cacheTtl2 = minTtl !== void 0 ? minTtl * 1e3 : DEFAULT_TTL_MS;
+      dnsCache.set(hostname, {
+        isLocal: true,
+        expiresAt: Date.now() + cacheTtl2
+      });
+      return true;
+    }
+    const cacheTtl = minTtl !== void 0 ? minTtl * 1e3 : DEFAULT_TTL_MS;
+    dnsCache.set(hostname, {
+      isLocal: false,
+      expiresAt: Date.now() + cacheTtl
+    });
+    return false;
+  } catch {
+    dnsCache.set(hostname, {
+      isLocal: false,
+      expiresAt: Date.now() + FAILURE_TTL_MS
+    });
+    return false;
+  }
+}
+async function isHostnameLocal(hostname) {
+  const cached = dnsCache.get(hostname);
+  if (cached && cached.expiresAt > Date.now()) {
+    return cached.isLocal;
+  }
+  const pending = pendingResolutions.get(hostname);
+  if (pending) {
+    return pending;
+  }
+  const resolution = resolveAndCacheHostname(hostname);
+  pendingResolutions.set(hostname, resolution);
+  try {
+    return await resolution;
+  } finally {
+    pendingResolutions.delete(hostname);
+  }
+}
+function isSpotlightOrigin(url, hostname) {
+  if (hostname === "spotlightjs.com" || hostname.endsWith(".spotlightjs.com")) {
+    return url.protocol === "https:" && (url.port === "" || url.port === "443");
+  }
+  return false;
+}
+function normalizeAllowedOrigins(allowedOrigins) {
+  const fullOrigins = /* @__PURE__ */ new Set();
+  const domains = /* @__PURE__ */ new Set();
+  for (const entry of allowedOrigins) {
+    const normalized = entry.toLowerCase();
+    if (normalized.includes("://")) {
+      fullOrigins.add(normalized.replace(/\/$/, ""));
+    } else {
+      domains.add(normalized);
+    }
+  }
+  return { fullOrigins, domains };
+}
+function isCustomAllowedOrigin(origin, hostname, normalized) {
+  if (normalized.domains.has(hostname)) {
+    return true;
+  }
+  const normalizedOrigin = origin.toLowerCase().replace(/\/$/, "");
+  return normalized.fullOrigins.has(normalizedOrigin);
+}
+async function isAllowedOrigin(origin, normalizedAllowedOrigins) {
   if (!origin) {
     return false;
   }
   try {
     const url = new URL(origin);
     const hostname = url.hostname.toLowerCase();
-    if (hostname === "localhost" || hostname === "127.0.0.1" || hostname === "[::1]" || hostname === "::1") {
+    if (hostname === "localhost") {
+      return true;
+    }
+    if (isSpotlightOrigin(url, hostname)) {
+      return true;
+    }
+    if (normalizedAllowedOrigins && isCustomAllowedOrigin(origin, hostname, normalizedAllowedOrigins)) {
       return true;
     }
-    if (url.protocol !== "https:" || url.port !== "" && url.port !== "443") {
-      return false;
+    if (isIPAddress(hostname)) {
+      return isLocalMachineIP(hostname);
     }
-    return hostname === "spotlightjs.com" || hostname.endsWith(".spotlightjs.com");
+    return isHostnameLocal(hostname);
   } catch {
     return false;
   }
 }
 export {
-  isAllowedOrigin
+  isAllowedOrigin,
+  normalizeAllowedOrigins
 };
 //# sourceMappingURL=cors.js.map

package/dist/server/utils/cors.js.map

@@ -1 +1 @@
-{"version":3,"file":"cors.js","sources":["../../../src/server/utils/cors.ts"],"sourcesContent":["/**\n * Validates if an origin should be allowed to access the Sidecar.\n *\n * Allowed origins:\n * - localhost with any port or protocol (http/https)\n * - https://spotlightjs.com (HTTPS only, default port)\n * - https://*.spotlightjs.com (HTTPS only, default port)\n *\n * @param origin - The origin to validate\n * @returns true if the origin is allowed, false otherwise\n */\nexport function isAllowedOrigin(origin: string): boolean {\n  if (!origin) {\n    return false;\n  }\n\n  try {\n    const url = new URL(origin);\n    const hostname = url.hostname.toLowerCase();\n\n    // Allow localhost with any port and protocol (http or https)\n    // Check both [::1] and ::1 formats for IPv6 localhost compatibility\n    if (hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"[::1]\" || hostname === \"::1\") {\n      return true;\n    }\n\n    // Check for spotlightjs.com domains - must be HTTPS with default port\n    if (url.protocol !== \"https:\" || (url.port !== \"\" && url.port !== \"443\")) {\n      return false;\n    }\n\n    return hostname === \"spotlightjs.com\" || hostname.endsWith(\".spotlightjs.com\");\n  } catch {\n    // Invalid URL\n    return false;\n  }\n}\n"],"names":[],"mappings":"AAWO,SAAS,gBAAgB,QAAyB;AACvD,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,MAAM;AAC1B,UAAM,WAAW,IAAI,SAAS,YAAA;AAI9B,QAAI,aAAa,eAAe,aAAa,eAAe,aAAa,WAAW,aAAa,OAAO;AACtG,aAAO;AAAA,IACT;AAGA,QAAI,IAAI,aAAa,YAAa,IAAI,SAAS,MAAM,IAAI,SAAS,OAAQ;AACxE,aAAO;AAAA,IACT;AAEA,WAAO,aAAa,qBAAqB,SAAS,SAAS,kBAAkB;AAAA,EAC/E,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;"}
+{"version":3,"file":"cors.js","sources":["../../../src/server/utils/cors.ts"],"sourcesContent":["import dns from \"node:dns/promises\";\nimport net from \"node:net\";\nimport os from \"node:os\";\n\n/**\n * DNS Resolution Cache Entry\n */\ninterface CacheEntry {\n  isLocal: boolean;\n  expiresAt: number;\n}\n\n/**\n * DNS Resolution Result with optional TTL\n */\ninterface DnsResult {\n  address: string;\n  ttl?: number;\n}\n\n/**\n * Cache for DNS resolution results.\n * Key: lowercase hostname\n * Value: { isLocal, expiresAt }\n */\nconst dnsCache = new Map<string, CacheEntry>();\n\n/**\n * In-flight DNS resolutions for request coalescing.\n * Prevents duplicate DNS lookups when multiple requests come in\n * for the same hostname before the first one completes.\n */\nconst pendingResolutions = new Map<string, Promise<boolean>>();\n\n/**\n * TTL Constants (in milliseconds)\n *\n * DNS Rebinding Attack Protection:\n * ================================\n * A DNS rebinding attack works by:\n * 1. Attacker controls evil.com with a short TTL\n * 2. User visits evil.com, which initially resolves to attacker's server\n * 3. Attacker's page loads malicious JavaScript\n * 4. Attacker rebinds evil.com to 127.0.0.1\n * 5. JavaScript makes requests to evil.com (now 127.0.0.1), bypassing same-origin policy\n *\n * Our mitigation: Reject DNS records with TTL < 1 hour.\n * This means an attacker would need to set a TTL >= 1 hour, making their\n * site inaccessible for that duration after rebinding. This makes the attack\n * impractical for real-world exploitation.\n */\nconst MIN_TTL_SECONDS = 60 * 60; // 1 hour - reject DNS records with lower TTL\nconst DEFAULT_TTL_MS = 60 * 60 * 1000; // 1 hour - used when DNS doesn't provide TTL (e.g., /etc/hosts)\nconst FAILURE_TTL_MS = 5 * 60 * 1000; // 5 minutes - cache failed lookups to avoid hammering DNS\n\n/**\n * DNS resolution notes:\n * We use both resolve4/6 AND lookup because:\n * - dns.resolve4/6: Queries DNS servers directly, can return TTL\n * - dns.lookup: Uses OS resolver (getaddrinfo), checks /etc/hosts first, then DNS\n *\n * A hostname in /etc/hosts won't be found by resolve4/6, hence we need both.\n * We can only trust lookup results when DNS (resolve4/6) fails - that means\n * the result came from /etc/hosts rather than DNS.\n */\n\n/**\n * Cache for machine's own IP addresses.\n * Refreshed periodically as network interfaces can change.\n */\nlet machineIPsCache: Set<string> | null = null;\nlet machineIPsCacheTime = 0;\nconst MACHINE_IPS_CACHE_TTL_MS = 60 * 1000; // 1 minute - refresh periodically for network changes\n\n/**\n * Get all IP addresses assigned to this machine's network interfaces.\n * This includes:\n * - Loopback (127.0.0.1, ::1)\n * - Local/private IPs (192.168.x.x, 10.x.x.x, etc.)\n * - VPN IPs (e.g., Tailscale 100.x.x.x, Zerotier IPs)\n *\n * Results are cached for 1 minute to handle network changes while\n * avoiding repeated system calls.\n */\nfunction getMachineIPs(): Set<string> {\n  const now = Date.now();\n  if (machineIPsCache && now - machineIPsCacheTime < MACHINE_IPS_CACHE_TTL_MS) {\n    return machineIPsCache;\n  }\n\n  const ips = new Set<string>();\n  const interfaces = os.networkInterfaces();\n\n  for (const name in interfaces) {\n    const addresses = interfaces[name];\n    if (addresses) {\n      for (const addr of addresses) {\n        ips.add(addr.address);\n      }\n    }\n  }\n\n  machineIPsCache = ips;\n  machineIPsCacheTime = now;\n  return ips;\n}\n\n/**\n * Check if a string is an IP address (IPv4 or IPv6).\n */\nfunction isIPAddress(hostname: string): boolean {\n  // Handle bracketed IPv6 (e.g., [::1])\n  const cleanHostname = hostname.startsWith(\"[\") && hostname.endsWith(\"]\") ? hostname.slice(1, -1) : hostname;\n  return net.isIP(cleanHostname) !== 0;\n}\n\n/**\n * Check if an IP address belongs to this machine.\n * See getMachineIPs() for details on what IPs are considered local.\n */\nfunction isLocalMachineIP(ip: string): boolean {\n  // Handle bracketed IPv6\n  const cleanIP = ip.startsWith(\"[\") && ip.endsWith(\"]\") ? ip.slice(1, -1) : ip;\n  const machineIPs = getMachineIPs();\n  return machineIPs.has(cleanIP);\n}\n\n/**\n * Resolution result with source information for trust decisions.\n */\ninterface ResolutionResult {\n  /** Addresses from dns.resolve4/6() with TTL */\n  dnsAddresses: DnsResult[];\n  /** Addresses from dns.lookup() when DNS failed - these are from /etc/hosts */\n  hostsFileAddresses: string[];\n  /** Minimum TTL from DNS results (seconds) */\n  minTtl?: number;\n}\n\n/**\n * Resolve a hostname to IP addresses using both DNS and OS resolver.\n *\n * Why both dns.resolve() and dns.lookup()?\n * - dns.resolve4/6: Direct DNS query, returns TTL when available\n * - dns.lookup: Uses OS resolver (getaddrinfo), which reads /etc/hosts\n *\n * A hostname in /etc/hosts won't be found by resolve4/6, hence we need both.\n *\n * Trust model:\n * - If dns.resolve() succeeds → result is from DNS, needs TTL validation\n * - If dns.resolve() fails but dns.lookup() succeeds → result is from /etc/hosts, trusted\n *\n * We can only trust lookup results when DNS failed, because lookup also queries\n * DNS servers (via the OS resolver) if the hostname isn't in /etc/hosts.\n */\nasync function resolveHostname(hostname: string): Promise<ResolutionResult> {\n  const dnsAddresses: DnsResult[] = [];\n  const hostsFileAddresses: string[] = [];\n  let minTtl: number | undefined;\n\n  // Run all resolution methods in parallel for efficiency\n  const [resolve4Result, resolve6Result, lookupResult] = await Promise.allSettled([\n    dns.resolve4(hostname, { ttl: true }),\n    dns.resolve6(hostname, { ttl: true }),\n    dns.lookup(hostname, { all: true }),\n  ]);\n\n  const dnsSucceeded = resolve4Result.status === \"fulfilled\" || resolve6Result.status === \"fulfilled\";\n\n  // Process IPv4 DNS results (with TTL)\n  if (resolve4Result.status === \"fulfilled\") {\n    for (const record of resolve4Result.value) {\n      dnsAddresses.push({ address: record.address, ttl: record.ttl });\n      if (record.ttl !== undefined) {\n        minTtl = minTtl === undefined ? record.ttl : Math.min(minTtl, record.ttl);\n      }\n    }\n  }\n\n  // Process IPv6 DNS results (with TTL)\n  if (resolve6Result.status === \"fulfilled\") {\n    for (const record of resolve6Result.value) {\n      dnsAddresses.push({ address: record.address, ttl: record.ttl });\n      if (record.ttl !== undefined) {\n        minTtl = minTtl === undefined ? record.ttl : Math.min(minTtl, record.ttl);\n      }\n    }\n  }\n\n  // Process OS resolver results - ONLY trusted if DNS failed\n  // If DNS succeeded, lookup would return the same DNS result (not trusted separately)\n  // If DNS failed but lookup succeeded, it must be from /etc/hosts (trusted)\n  if (!dnsSucceeded && lookupResult.status === \"fulfilled\") {\n    const lookupAddresses = Array.isArray(lookupResult.value) ? lookupResult.value : [lookupResult.value];\n    for (const record of lookupAddresses) {\n      hostsFileAddresses.push(record.address);\n    }\n  }\n\n  return { dnsAddresses, hostsFileAddresses, minTtl };\n}\n\n/**\n * Perform the actual DNS resolution and cache the result.\n * This is separated from isHostnameLocal to enable request coalescing.\n */\nasync function resolveAndCacheHostname(hostname: string): Promise<boolean> {\n  try {\n    const { dnsAddresses, hostsFileAddresses, minTtl } = await resolveHostname(hostname);\n\n    // First check /etc/hosts addresses (trusted - DNS failed, so these must be from hosts file)\n    // These are under local control and don't need TTL validation\n    const hostsLocal = hostsFileAddresses.some(addr => isLocalMachineIP(addr));\n    if (hostsLocal) {\n      // /etc/hosts entry resolves to local - cache and allow\n      dnsCache.set(hostname, {\n        isLocal: true,\n        expiresAt: Date.now() + DEFAULT_TTL_MS,\n      });\n      return true;\n    }\n\n    // Check DNS addresses (need TTL validation for rebinding protection)\n    const dnsLocal = dnsAddresses.some(result => isLocalMachineIP(result.address));\n\n    if (dnsLocal) {\n      // DNS rebinding protection: reject records with TTL < 1 hour\n      if (minTtl !== undefined && minTtl < MIN_TTL_SECONDS) {\n        // Low TTL is suspicious - reject and cache as non-local\n        dnsCache.set(hostname, {\n          isLocal: false,\n          expiresAt: Date.now() + FAILURE_TTL_MS,\n        });\n        return false;\n      }\n\n      // DNS resolves to local with safe TTL\n      const cacheTtl = minTtl !== undefined ? minTtl * 1000 : DEFAULT_TTL_MS;\n      dnsCache.set(hostname, {\n        isLocal: true,\n        expiresAt: Date.now() + cacheTtl,\n      });\n      return true;\n    }\n\n    // Not a local address - cache the negative result\n    const cacheTtl = minTtl !== undefined ? minTtl * 1000 : DEFAULT_TTL_MS;\n    dnsCache.set(hostname, {\n      isLocal: false,\n      expiresAt: Date.now() + cacheTtl,\n    });\n    return false;\n  } catch {\n    // DNS resolution failed - cache the failure briefly\n    dnsCache.set(hostname, {\n      isLocal: false,\n      expiresAt: Date.now() + FAILURE_TTL_MS,\n    });\n    return false;\n  }\n}\n\n/**\n * Check if a hostname resolves to this machine, with DNS rebinding protection.\n *\n * Returns true if the hostname resolves to a local IP AND has a safe TTL.\n * DNS records with TTL < 1 hour are rejected to prevent rebinding attacks.\n * Results are cached to avoid repeated DNS lookups.\n *\n * Uses request coalescing: if multiple requests come in for the same hostname\n * before the first resolution completes, they all share the same promise.\n */\nasync function isHostnameLocal(hostname: string): Promise<boolean> {\n  // Check cache first\n  const cached = dnsCache.get(hostname);\n  if (cached && cached.expiresAt > Date.now()) {\n    return cached.isLocal;\n  }\n\n  // Check if there's already an in-flight resolution for this hostname\n  const pending = pendingResolutions.get(hostname);\n  if (pending) {\n    return pending;\n  }\n\n  // Start a new resolution and track it\n  const resolution = resolveAndCacheHostname(hostname);\n  pendingResolutions.set(hostname, resolution);\n\n  try {\n    return await resolution;\n  } finally {\n    pendingResolutions.delete(hostname);\n  }\n}\n\n/**\n * Check if an origin is from spotlightjs.com (HTTPS only, default port).\n */\nfunction isSpotlightOrigin(url: URL, hostname: string): boolean {\n  if (hostname === \"spotlightjs.com\" || hostname.endsWith(\".spotlightjs.com\")) {\n    return url.protocol === \"https:\" && (url.port === \"\" || url.port === \"443\");\n  }\n  return false;\n}\n\n/**\n * Pre-normalized allowed origins for efficient matching.\n * Call normalizeAllowedOrigins() once at server startup to create this structure.\n */\nexport interface NormalizedAllowedOrigins {\n  /** Full origins (lowercased, trailing slash removed) for exact matching */\n  fullOrigins: Set<string>;\n  /** Plain domains (lowercased) for permissive matching */\n  domains: Set<string>;\n}\n\n/**\n * Normalize and classify allowed origins for efficient matching.\n * Call this once at server startup, then pass the result to isAllowedOrigin().\n *\n * @param allowedOrigins - Raw list of allowed origins/domains from config\n * @returns Pre-normalized structure for O(1) lookups\n */\nexport function normalizeAllowedOrigins(allowedOrigins: string[]): NormalizedAllowedOrigins {\n  const fullOrigins = new Set<string>();\n  const domains = new Set<string>();\n\n  for (const entry of allowedOrigins) {\n    const normalized = entry.toLowerCase();\n    if (normalized.includes(\"://\")) {\n      // Full origin - normalize by removing trailing slash\n      fullOrigins.add(normalized.replace(/\\/$/, \"\"));\n    } else {\n      // Plain domain\n      domains.add(normalized);\n    }\n  }\n\n  return { fullOrigins, domains };\n}\n\n/**\n * Check if an origin matches an entry in the pre-normalized allowed origins.\n *\n * Supports two formats:\n * - Full origins (e.g., \"https://ngrok.io:443\") - exact match required\n * - Plain domains (e.g., \"myapp.local\") - matches any protocol/port\n *\n * @param origin - The origin to check (e.g., \"https://myapp.local:3000\")\n * @param hostname - The lowercase hostname from the origin URL\n * @param normalized - Pre-normalized allowed origins\n */\nfunction isCustomAllowedOrigin(origin: string, hostname: string, normalized: NormalizedAllowedOrigins): boolean {\n  // Check plain domain match first (more common case)\n  if (normalized.domains.has(hostname)) {\n    return true;\n  }\n\n  // Check full origin match\n  const normalizedOrigin = origin.toLowerCase().replace(/\\/$/, \"\");\n  return normalized.fullOrigins.has(normalizedOrigin);\n}\n\n/**\n * Clear the DNS cache, pending resolutions, and machine IPs cache. Useful for testing.\n */\nexport function clearDnsCache(): void {\n  dnsCache.clear();\n  pendingResolutions.clear();\n  machineIPsCache = null;\n  machineIPsCacheTime = 0;\n}\n\n/**\n * Get the current DNS cache size. Useful for testing.\n */\nexport function getDnsCacheSize(): number {\n  return dnsCache.size;\n}\n\n/**\n * Validates if an origin should be allowed to access the Sidecar.\n *\n * Allowed origins:\n * - localhost (RFC 6761 reserved name, always trusted)\n * - Any origin whose hostname resolves to this machine's IPs (with TTL >= 1h)\n * - https://spotlightjs.com and subdomains (HTTPS only, default port)\n * - Custom origins/domains from the normalizedAllowedOrigins list\n *\n * For DNS rebinding protection details, see the TTL Constants section above.\n *\n * @param origin - The origin to validate\n * @param normalizedAllowedOrigins - Optional pre-normalized allowed origins (from normalizeAllowedOrigins())\n * @returns Promise<boolean> - true if the origin is allowed, false otherwise\n */\nexport async function isAllowedOrigin(\n  origin: string,\n  normalizedAllowedOrigins?: NormalizedAllowedOrigins,\n): Promise<boolean> {\n  if (!origin) {\n    return false;\n  }\n\n  try {\n    const url = new URL(origin);\n    const hostname = url.hostname.toLowerCase();\n\n    // Fast path: localhost is always allowed (RFC 6761 reserved name)\n    // This is safe because \"localhost\" is guaranteed to resolve to loopback\n    // and cannot be registered as a public domain name.\n    if (hostname === \"localhost\") {\n      return true;\n    }\n\n    // Fast path: spotlightjs.com domains (no DNS lookup needed)\n    if (isSpotlightOrigin(url, hostname)) {\n      return true;\n    }\n\n    // Fast path: Check custom allowed origins (no DNS lookup needed)\n    if (normalizedAllowedOrigins && isCustomAllowedOrigin(origin, hostname, normalizedAllowedOrigins)) {\n      return true;\n    }\n\n    // Fast path: If hostname is already an IP address, check directly\n    if (isIPAddress(hostname)) {\n      return isLocalMachineIP(hostname);\n    }\n\n    // Resolve hostname and check if it's local (with caching and TTL validation)\n    return isHostnameLocal(hostname);\n  } catch {\n    // Invalid URL\n    return false;\n  }\n}\n"],"names":["os","cacheTtl"],"mappings":";;;;;;;;;;;;AAyBA,MAAM,+BAAe,IAAA;AAOrB,MAAM,yCAAyB,IAAA;AAmB/B,MAAM,kBAAkB,KAAK;AAC7B,MAAM,iBAAiB,KAAK,KAAK;AACjC,MAAM,iBAAiB,IAAI,KAAK;AAiBhC,IAAI,kBAAsC;AAC1C,IAAI,sBAAsB;AAC1B,MAAM,2BAA2B,KAAK;AAYtC,SAAS,gBAA6B;AACpC,QAAM,MAAM,KAAK,IAAA;AACjB,MAAI,mBAAmB,MAAM,sBAAsB,0BAA0B;AAC3E,WAAO;AAAA,EACT;AAEA,QAAM,0BAAU,IAAA;AAChB,QAAM,aAAaA,YAAG,kBAAA;AAEtB,aAAW,QAAQ,YAAY;AAC7B,UAAM,YAAY,WAAW,IAAI;AACjC,QAAI,WAAW;AACb,iBAAW,QAAQ,WAAW;AAC5B,YAAI,IAAI,KAAK,OAAO;AAAA,MACtB;AAAA,IACF;AAAA,EACF;AAEA,oBAAkB;AAClB,wBAAsB;AACtB,SAAO;AACT;AAKA,SAAS,YAAY,UAA2B;AAE9C,QAAM,gBAAgB,SAAS,WAAW,GAAG,KAAK,SAAS,SAAS,GAAG,IAAI,SAAS,MAAM,GAAG,EAAE,IAAI;AACnG,SAAO,IAAI,KAAK,aAAa,MAAM;AACrC;AAMA,SAAS,iBAAiB,IAAqB;AAE7C,QAAM,UAAU,GAAG,WAAW,GAAG,KAAK,GAAG,SAAS,GAAG,IAAI,GAAG,MAAM,GAAG,EAAE,IAAI;AAC3E,QAAM,aAAa,cAAA;AACnB,SAAO,WAAW,IAAI,OAAO;AAC/B;AA8BA,eAAe,gBAAgB,UAA6C;AAC1E,QAAM,eAA4B,CAAA;AAClC,QAAM,qBAA+B,CAAA;AACrC,MAAI;AAGJ,QAAM,CAAC,gBAAgB,gBAAgB,YAAY,IAAI,MAAM,QAAQ,WAAW;AAAA,IAC9E,IAAI,SAAS,UAAU,EAAE,KAAK,MAAM;AAAA,IACpC,IAAI,SAAS,UAAU,EAAE,KAAK,MAAM;AAAA,IACpC,IAAI,OAAO,UAAU,EAAE,KAAK,MAAM;AAAA,EAAA,CACnC;AAED,QAAM,eAAe,eAAe,WAAW,eAAe,eAAe,WAAW;AAGxF,MAAI,eAAe,WAAW,aAAa;AACzC,eAAW,UAAU,eAAe,OAAO;AACzC,mBAAa,KAAK,EAAE,SAAS,OAAO,SAAS,KAAK,OAAO,KAAK;AAC9D,UAAI,OAAO,QAAQ,QAAW;AAC5B,iBAAS,WAAW,SAAY,OAAO,MAAM,KAAK,IAAI,QAAQ,OAAO,GAAG;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AAGA,MAAI,eAAe,WAAW,aAAa;AACzC,eAAW,UAAU,eAAe,OAAO;AACzC,mBAAa,KAAK,EAAE,SAAS,OAAO,SAAS,KAAK,OAAO,KAAK;AAC9D,UAAI,OAAO,QAAQ,QAAW;AAC5B,iBAAS,WAAW,SAAY,OAAO,MAAM,KAAK,IAAI,QAAQ,OAAO,GAAG;AAAA,MAC1E;AAAA,IACF;AAAA,EACF;AAKA,MAAI,CAAC,gBAAgB,aAAa,WAAW,aAAa;AACxD,UAAM,kBAAkB,MAAM,QAAQ,aAAa,KAAK,IAAI,aAAa,QAAQ,CAAC,aAAa,KAAK;AACpG,eAAW,UAAU,iBAAiB;AACpC,yBAAmB,KAAK,OAAO,OAAO;AAAA,IACxC;AAAA,EACF;AAEA,SAAO,EAAE,cAAc,oBAAoB,OAAA;AAC7C;AAMA,eAAe,wBAAwB,UAAoC;AACzE,MAAI;AACF,UAAM,EAAE,cAAc,oBAAoB,WAAW,MAAM,gBAAgB,QAAQ;AAInF,UAAM,aAAa,mBAAmB,KAAK,CAAA,SAAQ,iBAAiB,IAAI,CAAC;AACzE,QAAI,YAAY;AAEd,eAAS,IAAI,UAAU;AAAA,QACrB,SAAS;AAAA,QACT,WAAW,KAAK,QAAQ;AAAA,MAAA,CACzB;AACD,aAAO;AAAA,IACT;AAGA,UAAM,WAAW,aAAa,KAAK,YAAU,iBAAiB,OAAO,OAAO,CAAC;AAE7E,QAAI,UAAU;AAEZ,UAAI,WAAW,UAAa,SAAS,iBAAiB;AAEpD,iBAAS,IAAI,UAAU;AAAA,UACrB,SAAS;AAAA,UACT,WAAW,KAAK,QAAQ;AAAA,QAAA,CACzB;AACD,eAAO;AAAA,MACT;AAGA,YAAMC,YAAW,WAAW,SAAY,SAAS,MAAO;AACxD,eAAS,IAAI,UAAU;AAAA,QACrB,SAAS;AAAA,QACT,WAAW,KAAK,QAAQA;AAAAA,MAAA,CACzB;AACD,aAAO;AAAA,IACT;AAGA,UAAM,WAAW,WAAW,SAAY,SAAS,MAAO;AACxD,aAAS,IAAI,UAAU;AAAA,MACrB,SAAS;AAAA,MACT,WAAW,KAAK,QAAQ;AAAA,IAAA,CACzB;AACD,WAAO;AAAA,EACT,QAAQ;AAEN,aAAS,IAAI,UAAU;AAAA,MACrB,SAAS;AAAA,MACT,WAAW,KAAK,QAAQ;AAAA,IAAA,CACzB;AACD,WAAO;AAAA,EACT;AACF;AAYA,eAAe,gBAAgB,UAAoC;AAEjE,QAAM,SAAS,SAAS,IAAI,QAAQ;AACpC,MAAI,UAAU,OAAO,YAAY,KAAK,OAAO;AAC3C,WAAO,OAAO;AAAA,EAChB;AAGA,QAAM,UAAU,mBAAmB,IAAI,QAAQ;AAC/C,MAAI,SAAS;AACX,WAAO;AAAA,EACT;AAGA,QAAM,aAAa,wBAAwB,QAAQ;AACnD,qBAAmB,IAAI,UAAU,UAAU;AAE3C,MAAI;AACF,WAAO,MAAM;AAAA,EACf,UAAA;AACE,uBAAmB,OAAO,QAAQ;AAAA,EACpC;AACF;AAKA,SAAS,kBAAkB,KAAU,UAA2B;AAC9D,MAAI,aAAa,qBAAqB,SAAS,SAAS,kBAAkB,GAAG;AAC3E,WAAO,IAAI,aAAa,aAAa,IAAI,SAAS,MAAM,IAAI,SAAS;AAAA,EACvE;AACA,SAAO;AACT;AAoBO,SAAS,wBAAwB,gBAAoD;AAC1F,QAAM,kCAAkB,IAAA;AACxB,QAAM,8BAAc,IAAA;AAEpB,aAAW,SAAS,gBAAgB;AAClC,UAAM,aAAa,MAAM,YAAA;AACzB,QAAI,WAAW,SAAS,KAAK,GAAG;AAE9B,kBAAY,IAAI,WAAW,QAAQ,OAAO,EAAE,CAAC;AAAA,IAC/C,OAAO;AAEL,cAAQ,IAAI,UAAU;AAAA,IACxB;AAAA,EACF;AAEA,SAAO,EAAE,aAAa,QAAA;AACxB;AAaA,SAAS,sBAAsB,QAAgB,UAAkB,YAA+C;AAE9G,MAAI,WAAW,QAAQ,IAAI,QAAQ,GAAG;AACpC,WAAO;AAAA,EACT;AAGA,QAAM,mBAAmB,OAAO,YAAA,EAAc,QAAQ,OAAO,EAAE;AAC/D,SAAO,WAAW,YAAY,IAAI,gBAAgB;AACpD;AAkCA,eAAsB,gBACpB,QACA,0BACkB;AAClB,MAAI,CAAC,QAAQ;AACX,WAAO;AAAA,EACT;AAEA,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,MAAM;AAC1B,UAAM,WAAW,IAAI,SAAS,YAAA;AAK9B,QAAI,aAAa,aAAa;AAC5B,aAAO;AAAA,IACT;AAGA,QAAI,kBAAkB,KAAK,QAAQ,GAAG;AACpC,aAAO;AAAA,IACT;AAGA,QAAI,4BAA4B,sBAAsB,QAAQ,UAAU,wBAAwB,GAAG;AACjG,aAAO;AAAA,IACT;AAGA,QAAI,YAAY,QAAQ,GAAG;AACzB,aAAO,iBAAiB,QAAQ;AAAA,IAClC;AAGA,WAAO,gBAAgB,QAAQ;AAAA,EACjC,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;"}

package/dist/server/utils/docker-compose-parser.js

@@ -1,7 +1,16 @@
+;
+!function() {
+  try {
+    var e = "undefined" != typeof window ? window : "undefined" != typeof global ? global : "undefined" != typeof globalThis ? globalThis : "undefined" != typeof self ? self : {}, n = new e.Error().stack;
+    n && (e._sentryDebugIds = e._sentryDebugIds || {}, e._sentryDebugIds[n] = "27b39d5b-e60f-435f-945d-efc94ca1a964", e._sentryDebugIdIdentifier = "sentry-dbid-27b39d5b-e60f-435f-945d-efc94ca1a964");
+  } catch (e2) {
+  }
+}();
 import { accessSync, constants, readFileSync } from "node:fs";
 import { delimiter } from "node:path";
 import { parse } from "yaml";
 import { logger } from "../logger.js";
+import "../../_virtual/_sentry-release-injection-file.js";
 const COMPOSE_FILE_BASE_NAMES = ["docker-compose", "compose"];
 const COMPOSE_FILE_EXTENSIONS = [".yml", ".yaml"];
 function getComposeFilesFromEnv() {

package/dist/server/utils/docker-compose-parser.js.map

@@ -1 +1 @@
-{"version":3,"file":"docker-compose-parser.js","sources":["../../../src/server/utils/docker-compose-parser.ts"],"sourcesContent":["import { constants, accessSync, readFileSync } from \"node:fs\";\nimport { delimiter } from \"node:path\";\nimport { parse as parseYaml } from \"yaml\";\nimport { logger } from \"../logger.ts\";\n\nconst COMPOSE_FILE_BASE_NAMES = [\"docker-compose\", \"compose\"] as const;\nconst COMPOSE_FILE_EXTENSIONS = [\".yml\", \".yaml\"] as const;\n\n/**\n * Get compose files from COMPOSE_FILE environment variable\n * Returns an array of file paths if the variable is set, null otherwise\n */\nexport function getComposeFilesFromEnv(): string[] | null {\n  const composeFileEnv = process.env.COMPOSE_FILE;\n  if (!composeFileEnv) {\n    return null;\n  }\n\n  // Split by platform-specific path delimiter (: on Unix, ; on Windows)\n  const files = composeFileEnv\n    .split(delimiter)\n    .map(f => f.trim())\n    .filter(Boolean);\n\n  return files.length > 0 ? files : null;\n}\n\n/**\n * Find the compose file in the current directory by trying all combinations\n * of base names and extensions.\n */\nexport function findComposeFile(): string | null {\n  for (const baseName of COMPOSE_FILE_BASE_NAMES) {\n    for (const ext of COMPOSE_FILE_EXTENSIONS) {\n      const fileName = `${baseName}${ext}`;\n      try {\n        accessSync(fileName, constants.R_OK);\n        return fileName;\n      } catch {\n        // File doesn't exist or isn't readable, continue searching\n      }\n    }\n  }\n  return null;\n}\n\n/**\n * Find the override file for a given compose file.\n * Docker Compose looks for an override file with the same base name and extension.\n * For example: docker-compose.yml -> docker-compose.override.yml\n */\nexport function findOverrideFile(composeFile: string): string | null {\n  // Extract extension from the original file to maintain consistency\n  const ext = composeFile.endsWith(\".yaml\") ? \".yaml\" : \".yml\";\n  const baseName = composeFile.replace(/\\.(yaml|yml)$/, \"\");\n  const overrideFile = `${baseName}.override${ext}`;\n\n  try {\n    accessSync(overrideFile, constants.R_OK);\n    return overrideFile;\n  } catch {\n    // File doesn't exist or isn't readable\n    return null;\n  }\n}\n\n/**\n * Parse compose file and extract service names\n */\nexport function getDockerComposeServices(filePath: string): string[] {\n  try {\n    const content = readFileSync(filePath, \"utf-8\");\n    const parsed = parseYaml(content);\n\n    if (!parsed || typeof parsed !== \"object\" || !(\"services\" in parsed)) {\n      logger.error(`Invalid compose file: ${filePath} - missing 'services' key`);\n      return [];\n    }\n\n    const services = parsed.services as Record<string, unknown>;\n    return Object.keys(services);\n  } catch (error) {\n    logger.error(`Failed to parse compose file: ${filePath}`);\n    logger.error(error);\n    return [];\n  }\n}\n"],"names":["parseYaml"],"mappings":";;;;AAKA,MAAM,0BAA0B,CAAC,kBAAkB,SAAS;AAC5D,MAAM,0BAA0B,CAAC,QAAQ,OAAO;AAMzC,SAAS,yBAA0C;AACxD,QAAM,iBAAiB,QAAQ,IAAI;AACnC,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,EACT;AAGA,QAAM,QAAQ,eACX,MAAM,SAAS,EACf,IAAI,CAAA,MAAK,EAAE,KAAA,CAAM,EACjB,OAAO,OAAO;AAEjB,SAAO,MAAM,SAAS,IAAI,QAAQ;AACpC;AAMO,SAAS,kBAAiC;AAC/C,aAAW,YAAY,yBAAyB;AAC9C,eAAW,OAAO,yBAAyB;AACzC,YAAM,WAAW,GAAG,QAAQ,GAAG,GAAG;AAClC,UAAI;AACF,mBAAW,UAAU,UAAU,IAAI;AACnC,eAAO;AAAA,MACT,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,iBAAiB,aAAoC;AAEnE,QAAM,MAAM,YAAY,SAAS,OAAO,IAAI,UAAU;AACtD,QAAM,WAAW,YAAY,QAAQ,iBAAiB,EAAE;AACxD,QAAM,eAAe,GAAG,QAAQ,YAAY,GAAG;AAE/C,MAAI;AACF,eAAW,cAAc,UAAU,IAAI;AACvC,WAAO;AAAA,EACT,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAKO,SAAS,yBAAyB,UAA4B;AACnE,MAAI;AACF,UAAM,UAAU,aAAa,UAAU,OAAO;AAC9C,UAAM,SAASA,MAAU,OAAO;AAEhC,QAAI,CAAC,UAAU,OAAO,WAAW,YAAY,EAAE,cAAc,SAAS;AACpE,aAAO,MAAM,yBAAyB,QAAQ,2BAA2B;AACzE,aAAO,CAAA;AAAA,IACT;AAEA,UAAM,WAAW,OAAO;AACxB,WAAO,OAAO,KAAK,QAAQ;AAAA,EAC7B,SAAS,OAAO;AACd,WAAO,MAAM,iCAAiC,QAAQ,EAAE;AACxD,WAAO,MAAM,KAAK;AAClB,WAAO,CAAA;AAAA,EACT;AACF;"}
+{"version":3,"file":"docker-compose-parser.js","sources":["../../../src/server/utils/docker-compose-parser.ts"],"sourcesContent":["import { constants, accessSync, readFileSync } from \"node:fs\";\nimport { delimiter } from \"node:path\";\nimport { parse as parseYaml } from \"yaml\";\nimport { logger } from \"../logger.ts\";\n\nconst COMPOSE_FILE_BASE_NAMES = [\"docker-compose\", \"compose\"] as const;\nconst COMPOSE_FILE_EXTENSIONS = [\".yml\", \".yaml\"] as const;\n\n/**\n * Get compose files from COMPOSE_FILE environment variable\n * Returns an array of file paths if the variable is set, null otherwise\n */\nexport function getComposeFilesFromEnv(): string[] | null {\n  const composeFileEnv = process.env.COMPOSE_FILE;\n  if (!composeFileEnv) {\n    return null;\n  }\n\n  // Split by platform-specific path delimiter (: on Unix, ; on Windows)\n  const files = composeFileEnv\n    .split(delimiter)\n    .map(f => f.trim())\n    .filter(Boolean);\n\n  return files.length > 0 ? files : null;\n}\n\n/**\n * Find the compose file in the current directory by trying all combinations\n * of base names and extensions.\n */\nexport function findComposeFile(): string | null {\n  for (const baseName of COMPOSE_FILE_BASE_NAMES) {\n    for (const ext of COMPOSE_FILE_EXTENSIONS) {\n      const fileName = `${baseName}${ext}`;\n      try {\n        accessSync(fileName, constants.R_OK);\n        return fileName;\n      } catch {\n        // File doesn't exist or isn't readable, continue searching\n      }\n    }\n  }\n  return null;\n}\n\n/**\n * Find the override file for a given compose file.\n * Docker Compose looks for an override file with the same base name and extension.\n * For example: docker-compose.yml -> docker-compose.override.yml\n */\nexport function findOverrideFile(composeFile: string): string | null {\n  // Extract extension from the original file to maintain consistency\n  const ext = composeFile.endsWith(\".yaml\") ? \".yaml\" : \".yml\";\n  const baseName = composeFile.replace(/\\.(yaml|yml)$/, \"\");\n  const overrideFile = `${baseName}.override${ext}`;\n\n  try {\n    accessSync(overrideFile, constants.R_OK);\n    return overrideFile;\n  } catch {\n    // File doesn't exist or isn't readable\n    return null;\n  }\n}\n\n/**\n * Parse compose file and extract service names\n */\nexport function getDockerComposeServices(filePath: string): string[] {\n  try {\n    const content = readFileSync(filePath, \"utf-8\");\n    const parsed = parseYaml(content);\n\n    if (!parsed || typeof parsed !== \"object\" || !(\"services\" in parsed)) {\n      logger.error(`Invalid compose file: ${filePath} - missing 'services' key`);\n      return [];\n    }\n\n    const services = parsed.services as Record<string, unknown>;\n    return Object.keys(services);\n  } catch (error) {\n    logger.error(`Failed to parse compose file: ${filePath}`);\n    logger.error(error);\n    return [];\n  }\n}\n"],"names":["parseYaml"],"mappings":";;;;;;;;;;;;;AAKA,MAAM,0BAA0B,CAAC,kBAAkB,SAAS;AAC5D,MAAM,0BAA0B,CAAC,QAAQ,OAAO;AAMzC,SAAS,yBAA0C;AACxD,QAAM,iBAAiB,QAAQ,IAAI;AACnC,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,EACT;AAGA,QAAM,QAAQ,eACX,MAAM,SAAS,EACf,IAAI,CAAA,MAAK,EAAE,KAAA,CAAM,EACjB,OAAO,OAAO;AAEjB,SAAO,MAAM,SAAS,IAAI,QAAQ;AACpC;AAMO,SAAS,kBAAiC;AAC/C,aAAW,YAAY,yBAAyB;AAC9C,eAAW,OAAO,yBAAyB;AACzC,YAAM,WAAW,GAAG,QAAQ,GAAG,GAAG;AAClC,UAAI;AACF,mBAAW,UAAU,UAAU,IAAI;AACnC,eAAO;AAAA,MACT,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAOO,SAAS,iBAAiB,aAAoC;AAEnE,QAAM,MAAM,YAAY,SAAS,OAAO,IAAI,UAAU;AACtD,QAAM,WAAW,YAAY,QAAQ,iBAAiB,EAAE;AACxD,QAAM,eAAe,GAAG,QAAQ,YAAY,GAAG;AAE/C,MAAI;AACF,eAAW,cAAc,UAAU,IAAI;AACvC,WAAO;AAAA,EACT,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAKO,SAAS,yBAAyB,UAA4B;AACnE,MAAI;AACF,UAAM,UAAU,aAAa,UAAU,OAAO;AAC9C,UAAM,SAASA,MAAU,OAAO;AAEhC,QAAI,CAAC,UAAU,OAAO,WAAW,YAAY,EAAE,cAAc,SAAS;AACpE,aAAO,MAAM,yBAAyB,QAAQ,2BAA2B;AACzE,aAAO,CAAA;AAAA,IACT;AAEA,UAAM,WAAW,OAAO;AACxB,WAAO,OAAO,KAAK,QAAQ;AAAA,EAC7B,SAAS,OAAO;AACd,WAAO,MAAM,iCAAiC,QAAQ,EAAE;AACxD,WAAO,MAAM,KAAK;AAClB,WAAO,CAAA;AAAA,EACT;AACF;"}