@vreko/cli 3.0.1

package/dist/chunk-YPTTIXKC.js

@@ -0,0 +1,199 @@
+#!/usr/bin/env node
+import { __name } from './chunk-EWOJGXRX.js';
+import * as node from '@sentry/node';
+export { node as Sentry };
+
+process.env.VREKO_CLI='true';process.env.NODE_NO_WARNINGS='1';
+var __defProp = Object.defineProperty;
+var __name2 = /* @__PURE__ */ __name((target, value) => __defProp(target, "name", {
+  value,
+  configurable: true
+}), "__name");
+var EXTRA_ALLOWLIST = /* @__PURE__ */ new Set([
+  "requestId",
+  "workspaceHash",
+  "sessionId",
+  "tier",
+  "cliVersion",
+  "daemonVersion",
+  "extensionVersion",
+  "platform",
+  "nodeVersion"
+]);
+var BLOCKED_BREADCRUMB_CATEGORIES = /* @__PURE__ */ new Set([
+  "fetch",
+  "xhr",
+  "console"
+]);
+var HOME_PATH_RE = /\/(Users|home)\/[^/]+\//g;
+var GH_TOKEN_RE = /(ghp|gho|ghu|ghs)_[A-Za-z0-9]{36}/g;
+var API_KEY_RE = /sk-[A-Za-z0-9]{32,}/g;
+var MAX_STRING_LEN = 2048;
+function scrubString(value) {
+  if (value.length > MAX_STRING_LEN) {
+    return `[TRUNCATED:${value.length}]`;
+  }
+  return value.replace(HOME_PATH_RE, "/~/").replace(GH_TOKEN_RE, "[REDACTED_GH_TOKEN]").replace(API_KEY_RE, "[REDACTED_API_KEY]");
+}
+__name(scrubString, "scrubString");
+__name2(scrubString, "scrubString");
+function createNextjsSentryConfig(options) {
+  const { dsn, release, environment, tracesSampleRate, ignoreErrors } = options;
+  const resolvedEnv = resolveDeploymentEnv(environment);
+  return {
+    dsn,
+    environment: resolvedEnv,
+    release: release ?? process.env.VERCEL_GIT_COMMIT_SHA ?? process.env.NEXT_PUBLIC_VERCEL_GIT_COMMIT_SHA ?? process.env.npm_package_version,
+    sendDefaultPii: false,
+    tracesSampleRate: tracesSampleRate ?? (resolvedEnv === "development" ? 1 : 0.1),
+    ignoreErrors: ignoreErrors ?? [
+      "NetworkError",
+      "Failed to fetch",
+      "Load failed",
+      "AbortError"
+    ],
+    beforeSend(event) {
+      const req = event.request;
+      if (req?.headers) {
+        const headers = req.headers;
+        delete headers.authorization;
+        delete headers.cookie;
+        delete headers["x-api-key"];
+      }
+      const user = event.user;
+      if (user?.email) {
+        user.email = "[REDACTED]";
+      }
+      const exception = event.exception;
+      if (exception?.values) {
+        for (const exc of exception.values) {
+          if (exc.value && typeof exc.value === "string") {
+            exc.value = scrubString(exc.value);
+          }
+          const st = exc.stacktrace;
+          if (st?.frames) {
+            for (const frame of st.frames) {
+              if (typeof frame.filename === "string") {
+                frame.filename = scrubString(frame.filename);
+              }
+              if (typeof frame.abs_path === "string") {
+                frame.abs_path = scrubString(frame.abs_path);
+              }
+            }
+          }
+        }
+      }
+      return event;
+    }
+  };
+}
+__name(createNextjsSentryConfig, "createNextjsSentryConfig");
+__name2(createNextjsSentryConfig, "createNextjsSentryConfig");
+function resolveDeploymentEnv(override) {
+  if (override) return override;
+  const explicit = process.env.DEPLOYMENT_ENV;
+  if (explicit === "development" || explicit === "staging" || explicit === "production") {
+    return explicit;
+  }
+  if (process.env.VERCEL_ENV === "preview") return "staging";
+  return process.env.NODE_ENV ?? "production";
+}
+__name(resolveDeploymentEnv, "resolveDeploymentEnv");
+__name2(resolveDeploymentEnv, "resolveDeploymentEnv");
+function createSentryConfig(options) {
+  const { dsn, surface, workspaceHash, tier, release, environment } = options;
+  const resolvedEnv = resolveDeploymentEnv(environment);
+  return {
+    dsn,
+    environment: resolvedEnv,
+    release: release ?? process.env.GIT_SHA ?? process.env.npm_package_version,
+    sendDefaultPii: false,
+    attachStacktrace: true,
+    // Full sampling in development; reduced in staging/production to limit overhead.
+    tracesSampleRate: resolvedEnv === "development" ? 1 : 0.1,
+    initialScope: {
+      tags: {
+        surface,
+        ...tier ? {
+          tier
+        } : {}
+      },
+      ...workspaceHash ? {
+        user: {
+          id: workspaceHash
+        }
+      } : {}
+    },
+    // Drop auto-capture integrations that can produce breadcrumbs with sensitive data
+    integrations(defaultIntegrations) {
+      return defaultIntegrations.filter((i) => ![
+        "Breadcrumbs",
+        "Console",
+        "Http"
+      ].includes(i.name));
+    },
+    beforeSend(event) {
+      if (event.extra) {
+        const filtered = {};
+        for (const key of EXTRA_ALLOWLIST) {
+          if (key in event.extra) {
+            filtered[key] = event.extra[key];
+          }
+        }
+        event.extra = filtered;
+      }
+      if (event.contexts?.runtime) {
+        event.contexts.runtime.args = void 0;
+      }
+      if (event.request) {
+        event.request.data = void 0;
+      }
+      if (event.breadcrumbs?.values) {
+        const breadcrumbs = event.breadcrumbs.values();
+        for (const crumb of breadcrumbs) {
+          crumb.data = void 0;
+        }
+      }
+      if (event.exception?.values) {
+        for (const exc of event.exception.values) {
+          if (exc.value) {
+            exc.value = scrubString(exc.value);
+          }
+          if (exc.stacktrace?.frames) {
+            for (const frame of exc.stacktrace.frames) {
+              if (frame.filename) {
+                frame.filename = scrubString(frame.filename);
+              }
+              if (frame.abs_path) {
+                frame.abs_path = scrubString(frame.abs_path);
+              }
+            }
+          }
+        }
+      }
+      if (event.message) {
+        event.message = scrubString(event.message);
+      }
+      return event;
+    },
+    beforeBreadcrumb(breadcrumb) {
+      const cat = breadcrumb.category ?? "";
+      if (BLOCKED_BREADCRUMB_CATEGORIES.has(cat)) {
+        const data = breadcrumb.data;
+        if (data?._allow === true) {
+          const { _allow: _, ...rest } = data;
+          breadcrumb.data = rest;
+          return breadcrumb;
+        }
+        return null;
+      }
+      return breadcrumb;
+    }
+  };
+}
+__name(createSentryConfig, "createSentryConfig");
+__name2(createSentryConfig, "createSentryConfig");
+
+export { createSentryConfig };
+//# sourceMappingURL=chunk-YPTTIXKC.js.map
+//# sourceMappingURL=chunk-YPTTIXKC.js.map

package/dist/chunk-YPTTIXKC.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../packages/sentry-privacy/src/index.ts"],"names":["EXTRA_ALLOWLIST","Set","BLOCKED_BREADCRUMB_CATEGORIES","HOME_PATH_RE","GH_TOKEN_RE","API_KEY_RE","MAX_STRING_LEN","scrubString","value","length","replace","createNextjsSentryConfig","options","dsn","release","environment","tracesSampleRate","ignoreErrors","resolvedEnv","resolveDeploymentEnv","process","env","VERCEL_GIT_COMMIT_SHA","NEXT_PUBLIC_VERCEL_GIT_COMMIT_SHA","npm_package_version","sendDefaultPii","beforeSend","event","req","request","headers","authorization","cookie","user","email","exception","values","exc","st","stacktrace","frames","frame","filename","abs_path","override","explicit","DEPLOYMENT_ENV","VERCEL_ENV","NODE_ENV","createSentryConfig","surface","workspaceHash","tier","GIT_SHA","attachStacktrace","initialScope","tags","id","integrations","defaultIntegrations","filter","i","includes","name","extra","filtered","key","contexts","runtime","args","undefined","data","breadcrumbs","crumb","message","beforeBreadcrumb","breadcrumb","cat","category","has","_allow","_","rest"],"mappings":";;;;;;;;;;;AAmBA,IAAMA,eAAAA,uBAAsBC,GAAAA,CAAI;AAC/B,EAAA,WAAA;AACA,EAAA,eAAA;AACA,EAAA,WAAA;AACA,EAAA,MAAA;AACA,EAAA,YAAA;AACA,EAAA,eAAA;AACA,EAAA,kBAAA;AACA,EAAA,UAAA;AACA,EAAA;AACA,CAAA,CAAA;AAED,IAAMC,6BAAAA,uBAAoCD,GAAAA,CAAI;AAAC,EAAA,OAAA;AAAS,EAAA,KAAA;AAAO,EAAA;AAAU,CAAA,CAAA;AAGzE,IAAME,YAAAA,GAAe,0BAAA;AAErB,IAAMC,WAAAA,GAAc,oCAAA;AAEpB,IAAMC,UAAAA,GAAa,sBAAA;AAEnB,IAAMC,cAAAA,GAAiB,IAAA;AAEvB,SAASC,YAAYC,KAAAA,EAAa;AACjC,EAAA,IAAIA,KAAAA,CAAMC,SAASH,cAAAA,EAAgB;AAClC,IAAA,OAAO,CAAA,WAAA,EAAcE,MAAMC,MAAM,CAAA,CAAA,CAAA;AAClC,EAAA;AACA,EAAA,OAAOD,KAAAA,CACLE,OAAAA,CAAQP,YAAAA,EAAc,KAAA,CAAA,CACtBO,OAAAA,CAAQN,WAAAA,EAAa,qBAAA,CAAA,CACrBM,OAAAA,CAAQL,UAAAA,EAAY,oBAAA,CAAA;AACvB;AARSE,MAAAA,CAAAA,WAAAA,EAAAA,aAAAA,CAAAA;AAAAA,OAAAA,CAAAA,aAAAA,aAAAA,CAAAA;AAuCF,SAASI,yBAAyBC,OAAAA,EAA4B;AACpE,EAAA,MAAM,EAAEC,GAAAA,EAAKC,OAAAA,EAASC,WAAAA,EAAaC,gBAAAA,EAAkBC,cAAY,GAAKL,OAAAA;AACtE,EAAA,MAAMM,WAAAA,GAAcC,qBAAqBJ,WAAAA,CAAAA;AACzC,EAAA,OAAO;AACNF,IAAAA,GAAAA;IACAE,WAAAA,EAAaG,WAAAA;IACbJ,OAAAA,EACCA,OAAAA,IACAM,QAAQC,GAAAA,CAAIC,qBAAAA,IACZF,QAAQC,GAAAA,CAAIE,iCAAAA,IACZH,QAAQC,GAAAA,CAAIG,mBAAAA;IACbC,cAAAA,EAAgB,KAAA;IAChBT,gBAAAA,EAAkBA,gBAAAA,KAAqBE,WAAAA,KAAgB,aAAA,GAAgB,CAAA,GAAM,GAAA,CAAA;AAC7ED,IAAAA,YAAAA,EAAcA,YAAAA,IAAgB;AAAC,MAAA,cAAA;AAAgB,MAAA,iBAAA;AAAmB,MAAA,aAAA;AAAe,MAAA;;AACjFS,IAAAA,UAAAA,CAAWC,KAAAA,EAA8B;AACxC,MAAA,MAAMC,MAAMD,KAAAA,CAAME,OAAAA;AAClB,MAAA,IAAID,KAAKE,OAAAA,EAAS;AACjB,QAAA,MAAMA,UAAUF,GAAAA,CAAIE,OAAAA;AACpB,QAAA,OAAOA,OAAAA,CAAQC,aAAAA;AACf,QAAA,OAAOD,OAAAA,CAAQE,MAAAA;AACf,QAAA,OAAOF,QAAQ,WAAA,CAAA;AAChB,MAAA;AACA,MAAA,MAAMG,OAAON,KAAAA,CAAMM,IAAAA;AACnB,MAAA,IAAIA,MAAMC,KAAAA,EAAO;AAChBD,QAAAA,IAAAA,CAAKC,KAAAA,GAAQ,YAAA;AACd,MAAA;AACA,MAAA,MAAMC,YAAYR,KAAAA,CAAMQ,SAAAA;AACxB,MAAA,IAAIA,WAAWC,MAAAA,EAAQ;AACtB,QAAA,KAAA,MAAWC,GAAAA,IAAOF,UAAUC,MAAAA,EAA0C;AACrE,UAAA,IAAIC,GAAAA,CAAI7B,KAAAA,IAAS,OAAO6B,GAAAA,CAAI7B,UAAU,QAAA,EAAU;AAC/C6B,YAAAA,GAAAA,CAAI7B,KAAAA,GAAQD,WAAAA,CAAY8B,GAAAA,CAAI7B,KAAK,CAAA;AAClC,UAAA;AACA,UAAA,MAAM8B,KAAKD,GAAAA,CAAIE,UAAAA;AACf,UAAA,IAAID,IAAIE,MAAAA,EAAQ;AACf,YAAA,KAAA,MAAWC,KAAAA,IAASH,GAAGE,MAAAA,EAA0C;AAChE,cAAA,IAAI,OAAOC,KAAAA,CAAMC,QAAAA,KAAa,QAAA,EAAU;AACvCD,gBAAAA,KAAAA,CAAMC,QAAAA,GAAWnC,WAAAA,CAAYkC,KAAAA,CAAMC,QAAQ,CAAA;AAC5C,cAAA;AACA,cAAA,IAAI,OAAOD,KAAAA,CAAME,QAAAA,KAAa,QAAA,EAAU;AACvCF,gBAAAA,KAAAA,CAAME,QAAAA,GAAWpC,WAAAA,CAAYkC,KAAAA,CAAME,QAAQ,CAAA;AAC5C,cAAA;AACD,YAAA;AACD,UAAA;AACD,QAAA;AACD,MAAA;AACA,MAAA,OAAOhB,KAAAA;AACR,IAAA;AACD,GAAA;AACD;AAhDgBhB,MAAAA,CAAAA,wBAAAA,EAAAA,0BAAAA,CAAAA;AAAAA,OAAAA,CAAAA,0BAAAA,0BAAAA,CAAAA;AA2DhB,SAASQ,qBAAqByB,QAAAA,EAAiB;AAC9C,EAAA,IAAIA,UAAU,OAAOA,QAAAA;AACrB,EAAA,MAAMC,QAAAA,GAAWzB,QAAQC,GAAAA,CAAIyB,cAAAA;AAC7B,EAAA,IAAID,QAAAA,KAAa,aAAA,IAAiBA,QAAAA,KAAa,SAAA,IAAaA,aAAa,YAAA,EAAc;AACtF,IAAA,OAAOA,QAAAA;AACR,EAAA;AAIA,EAAA,IAAIzB,OAAAA,CAAQC,GAAAA,CAAI0B,UAAAA,KAAe,SAAA,EAAW,OAAO,SAAA;AAGjD,EAAA,OAAO3B,OAAAA,CAAQC,IAAI2B,QAAAA,IAAY,YAAA;AAChC;AAbS7B,MAAAA,CAAAA,oBAAAA,EAAAA,sBAAAA,CAAAA;AAAAA,OAAAA,CAAAA,sBAAAA,sBAAAA,CAAAA;AAeF,SAAS8B,mBAAmBrC,OAAAA,EAA6B;AAC/D,EAAA,MAAM,EAAEC,GAAAA,EAAKqC,OAAAA,EAASC,eAAeC,IAAAA,EAAMtC,OAAAA,EAASC,aAAW,GAAKH,OAAAA;AAEpE,EAAA,MAAMM,WAAAA,GAAcC,qBAAqBJ,WAAAA,CAAAA;AAEzC,EAAA,OAAO;AACNF,IAAAA,GAAAA;IACAE,WAAAA,EAAaG,WAAAA;AACbJ,IAAAA,OAAAA,EAASA,OAAAA,IAAWM,OAAAA,CAAQC,GAAAA,CAAIgC,OAAAA,IAAWjC,QAAQC,GAAAA,CAAIG,mBAAAA;IACvDC,cAAAA,EAAgB,KAAA;IAChB6B,gBAAAA,EAAkB,IAAA;;IAElBtC,gBAAAA,EAAkBE,WAAAA,KAAgB,gBAAgB,CAAA,GAAM,GAAA;IAExDqC,YAAAA,EAAc;MACbC,IAAAA,EAAM;AACLN,QAAAA,OAAAA;AACA,QAAA,GAAIE,IAAAA,GAAO;AAAEA,UAAAA;AAAK,SAAA,GAAI;AACvB,OAAA;AACA,MAAA,GAAID,aAAAA,GAAgB;QAAElB,IAAAA,EAAM;UAAEwB,EAAAA,EAAIN;AAAc;AAAE,OAAA,GAAI;AACvD,KAAA;;AAGAO,IAAAA,YAAAA,CAAaC,mBAAAA,EAAqC;AACjD,MAAA,OAAOA,mBAAAA,CAAoBC,MAAAA,CAAO,CAACC,CAAAA,KAAM,CAAC;AAAC,QAAA,aAAA;AAAe,QAAA,SAAA;AAAW,QAAA;QAAQC,QAAAA,CAASD,CAAAA,CAAEE,IAAI,CAAA,CAAA;AAC7F,IAAA,CAAA;AAEArC,IAAAA,UAAAA,CAAWC,KAAAA,EAAK;AAEf,MAAA,IAAIA,MAAMqC,KAAAA,EAAO;AAChB,QAAA,MAAMC,WAAoC,EAAC;AAC3C,QAAA,KAAA,MAAWC,OAAOlE,eAAAA,EAAiB;AAClC,UAAA,IAAIkE,GAAAA,IAAOvC,MAAMqC,KAAAA,EAAO;AACvBC,YAAAA,QAAAA,CAASC,GAAAA,CAAAA,GAAOvC,KAAAA,CAAMqC,KAAAA,CAAME,GAAAA,CAAAA;AAC7B,UAAA;AACD,QAAA;AACAvC,QAAAA,KAAAA,CAAMqC,KAAAA,GAAQC,QAAAA;AACf,MAAA;AAGA,MAAA,IAAItC,KAAAA,CAAMwC,UAAUC,OAAAA,EAAS;AAC3BzC,QAAAA,KAAAA,CAAMwC,QAAAA,CAASC,QAAoCC,IAAAA,GAAOC,MAAAA;AAC5D,MAAA;AAGA,MAAA,IAAI3C,MAAME,OAAAA,EAAS;AAClBF,QAAAA,KAAAA,CAAME,QAAQ0C,IAAAA,GAAOD,MAAAA;AACtB,MAAA;AAGA,MAAA,IAAI3C,KAAAA,CAAM6C,aAAapC,MAAAA,EAAQ;AAC9B,QAAA,MAAMoC,WAAAA,GAAc7C,KAAAA,CAAM6C,WAAAA,CAAYpC,MAAAA,EAAM;AAC5C,QAAA,KAAA,MAAWqC,SAASD,WAAAA,EAAa;AAChCC,UAAAA,KAAAA,CAAMF,IAAAA,GAAOD,MAAAA;AACd,QAAA;AACD,MAAA;AAGA,MAAA,IAAI3C,KAAAA,CAAMQ,WAAWC,MAAAA,EAAQ;AAC5B,QAAA,KAAA,MAAWC,GAAAA,IAAOV,KAAAA,CAAMQ,SAAAA,CAAUC,MAAAA,EAAQ;AACzC,UAAA,IAAIC,IAAI7B,KAAAA,EAAO;AACd6B,YAAAA,GAAAA,CAAI7B,KAAAA,GAAQD,WAAAA,CAAY8B,GAAAA,CAAI7B,KAAK,CAAA;AAClC,UAAA;AACA,UAAA,IAAI6B,GAAAA,CAAIE,YAAYC,MAAAA,EAAQ;AAC3B,YAAA,KAAA,MAAWC,KAAAA,IAASJ,GAAAA,CAAIE,UAAAA,CAAWC,MAAAA,EAAQ;AAC1C,cAAA,IAAIC,MAAMC,QAAAA,EAAU;AACnBD,gBAAAA,KAAAA,CAAMC,QAAAA,GAAWnC,WAAAA,CAAYkC,KAAAA,CAAMC,QAAQ,CAAA;AAC5C,cAAA;AACA,cAAA,IAAID,MAAME,QAAAA,EAAU;AACnBF,gBAAAA,KAAAA,CAAME,QAAAA,GAAWpC,WAAAA,CAAYkC,KAAAA,CAAME,QAAQ,CAAA;AAC5C,cAAA;AACD,YAAA;AACD,UAAA;AACD,QAAA;AACD,MAAA;AAGA,MAAA,IAAIhB,MAAM+C,OAAAA,EAAS;AAClB/C,QAAAA,KAAAA,CAAM+C,OAAAA,GAAUnE,WAAAA,CAAYoB,KAAAA,CAAM+C,OAAO,CAAA;AAC1C,MAAA;AAEA,MAAA,OAAO/C,KAAAA;AACR,IAAA,CAAA;AAEAgD,IAAAA,gBAAAA,CAAiBC,UAAAA,EAAU;AAC1B,MAAA,MAAMC,GAAAA,GAAMD,WAAWE,QAAAA,IAAY,EAAA;AACnC,MAAA,IAAI5E,6BAAAA,CAA8B6E,GAAAA,CAAIF,GAAAA,CAAAA,EAAM;AAE3C,QAAA,MAAMN,OAAOK,UAAAA,CAAWL,IAAAA;AACxB,QAAA,IAAIA,IAAAA,EAAMS,WAAW,IAAA,EAAM;AAC1B,UAAA,MAAM,EAAEA,MAAAA,EAAQC,CAAAA,EAAG,GAAGC,MAAAA,GAASX,IAAAA;AAC/BK,UAAAA,UAAAA,CAAWL,IAAAA,GAAOW,IAAAA;AAClB,UAAA,OAAON,UAAAA;AACR,QAAA;AACA,QAAA,OAAO,IAAA;AACR,MAAA;AACA,MAAA,OAAOA,UAAAA;AACR,IAAA;AACD,GAAA;AACD;AAnGgB3B,MAAAA,CAAAA,kBAAAA,EAAAA,oBAAAA,CAAAA;AAAAA,OAAAA,CAAAA,oBAAAA,oBAAAA,CAAAA","file":"chunk-YPTTIXKC.js","sourcesContent":["import type { NodeOptions } from \"@sentry/node\";\nimport * as Sentry from \"@sentry/node\";\n\ntype AnyIntegration = { name: string };\n\nexport { Sentry };\n\nexport type Surface = \"daemon\" | \"extension\" | \"cli\" | \"api\" | \"mcp-proxy\";\nexport type Tier = \"free\" | \"pro\" | \"team\" | \"pioneer\";\n\nexport interface SentryPrivacyOptions {\n\tdsn: string;\n\tsurface: Surface;\n\tworkspaceHash?: string;\n\ttier?: Tier;\n\trelease?: string;\n\tenvironment?: string;\n}\n\nconst EXTRA_ALLOWLIST = new Set([\n\t\"requestId\",\n\t\"workspaceHash\",\n\t\"sessionId\",\n\t\"tier\",\n\t\"cliVersion\",\n\t\"daemonVersion\",\n\t\"extensionVersion\",\n\t\"platform\",\n\t\"nodeVersion\",\n]);\n\nconst BLOCKED_BREADCRUMB_CATEGORIES = new Set([\"fetch\", \"xhr\", \"console\"]);\n\n// Matches /Users/<name>/ and /home/<name>/\nconst HOME_PATH_RE = /\\/(Users|home)\\/[^/]+\\//g;\n// GitHub personal/oauth/user/server tokens\nconst GH_TOKEN_RE = /(ghp|gho|ghu|ghs)_[A-Za-z0-9]{36}/g;\n// OpenAI-style secret keys\nconst API_KEY_RE = /sk-[A-Za-z0-9]{32,}/g;\n\nconst MAX_STRING_LEN = 2048;\n\nfunction scrubString(value: string): string {\n\tif (value.length > MAX_STRING_LEN) {\n\t\treturn `[TRUNCATED:${value.length}]`;\n\t}\n\treturn value\n\t\t.replace(HOME_PATH_RE, \"/~/\")\n\t\t.replace(GH_TOKEN_RE, \"[REDACTED_GH_TOKEN]\")\n\t\t.replace(API_KEY_RE, \"[REDACTED_API_KEY]\");\n}\n\nfunction scrubValue(value: unknown): unknown {\n\tif (typeof value === \"string\") {\n\t\treturn scrubString(value);\n\t}\n\tif (Array.isArray(value)) {\n\t\treturn value.map(scrubValue);\n\t}\n\tif (value !== null && typeof value === \"object\") {\n\t\treturn scrubRecord(value as Record<string, unknown>);\n\t}\n\treturn value;\n}\n\nfunction scrubRecord(obj: Record<string, unknown>): Record<string, unknown> {\n\tconst result: Record<string, unknown> = {};\n\tfor (const [k, v] of Object.entries(obj)) {\n\t\tresult[k] = scrubValue(v);\n\t}\n\treturn result;\n}\n\nexport interface NextjsSentryOptions {\n\tdsn: string;\n\trelease?: string;\n\tenvironment?: string;\n\ttracesSampleRate?: number;\n\tignoreErrors?: (string | RegExp)[];\n}\n\nexport function createNextjsSentryConfig(options: NextjsSentryOptions): Record<string, unknown> {\n\tconst { dsn, release, environment, tracesSampleRate, ignoreErrors } = options;\n\tconst resolvedEnv = resolveDeploymentEnv(environment);\n\treturn {\n\t\tdsn,\n\t\tenvironment: resolvedEnv,\n\t\trelease:\n\t\t\trelease ??\n\t\t\tprocess.env.VERCEL_GIT_COMMIT_SHA ??\n\t\t\tprocess.env.NEXT_PUBLIC_VERCEL_GIT_COMMIT_SHA ??\n\t\t\tprocess.env.npm_package_version,\n\t\tsendDefaultPii: false,\n\t\ttracesSampleRate: tracesSampleRate ?? (resolvedEnv === \"development\" ? 1.0 : 0.1),\n\t\tignoreErrors: ignoreErrors ?? [\"NetworkError\", \"Failed to fetch\", \"Load failed\", \"AbortError\"],\n\t\tbeforeSend(event: Record<string, unknown>) {\n\t\t\tconst req = event.request as Record<string, unknown> | undefined;\n\t\t\tif (req?.headers) {\n\t\t\t\tconst headers = req.headers as Record<string, unknown>;\n\t\t\t\tdelete headers.authorization;\n\t\t\t\tdelete headers.cookie;\n\t\t\t\tdelete headers[\"x-api-key\"];\n\t\t\t}\n\t\t\tconst user = event.user as Record<string, unknown> | undefined;\n\t\t\tif (user?.email) {\n\t\t\t\tuser.email = \"[REDACTED]\";\n\t\t\t}\n\t\t\tconst exception = event.exception as Record<string, unknown> | undefined;\n\t\t\tif (exception?.values) {\n\t\t\t\tfor (const exc of exception.values as Array<Record<string, unknown>>) {\n\t\t\t\t\tif (exc.value && typeof exc.value === \"string\") {\n\t\t\t\t\t\texc.value = scrubString(exc.value);\n\t\t\t\t\t}\n\t\t\t\t\tconst st = exc.stacktrace as Record<string, unknown> | undefined;\n\t\t\t\t\tif (st?.frames) {\n\t\t\t\t\t\tfor (const frame of st.frames as Array<Record<string, unknown>>) {\n\t\t\t\t\t\t\tif (typeof frame.filename === \"string\") {\n\t\t\t\t\t\t\t\tframe.filename = scrubString(frame.filename);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tif (typeof frame.abs_path === \"string\") {\n\t\t\t\t\t\t\t\tframe.abs_path = scrubString(frame.abs_path);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn event;\n\t\t},\n\t};\n}\n\n/**\n * Resolve the deployment environment from explicit override, Doppler-aware\n * detection, or platform signals.\n *\n * NODE_ENV is unreliable: Doppler sets it to \"production\" even for local dev\n * configs. DEPLOYMENT_ENV is the authoritative discriminator  -  it is set\n * explicitly per Doppler config (dev → \"development\", stg → \"staging\",\n * prd → \"production\"). Falls back to platform signals and then NODE_ENV.\n */\nfunction resolveDeploymentEnv(override?: string): string {\n\tif (override) return override;\n\tconst explicit = process.env.DEPLOYMENT_ENV;\n\tif (explicit === \"development\" || explicit === \"staging\" || explicit === \"production\") {\n\t\treturn explicit;\n\t}\n\t// Staging Fly.io deploy: FLY_ALLOC_ID is set but DEPLOYMENT_ENV=staging\n\t// must be present in doppler stg config to reach this branch correctly.\n\t// Vercel preview deployments are staging, not production.\n\tif (process.env.VERCEL_ENV === \"preview\") return \"staging\";\n\t// NODE_ENV fallback  -  only reliable when Doppler is not in the picture\n\t// (e.g. unit tests, or non-Doppler local dev with a hand-crafted .env).\n\treturn process.env.NODE_ENV ?? \"production\";\n}\n\nexport function createSentryConfig(options: SentryPrivacyOptions): NodeOptions {\n\tconst { dsn, surface, workspaceHash, tier, release, environment } = options;\n\n\tconst resolvedEnv = resolveDeploymentEnv(environment);\n\n\treturn {\n\t\tdsn,\n\t\tenvironment: resolvedEnv,\n\t\trelease: release ?? process.env.GIT_SHA ?? process.env.npm_package_version,\n\t\tsendDefaultPii: false,\n\t\tattachStacktrace: true,\n\t\t// Full sampling in development; reduced in staging/production to limit overhead.\n\t\ttracesSampleRate: resolvedEnv === \"development\" ? 1.0 : 0.1,\n\n\t\tinitialScope: {\n\t\t\ttags: {\n\t\t\t\tsurface,\n\t\t\t\t...(tier ? { tier } : {}),\n\t\t\t},\n\t\t\t...(workspaceHash ? { user: { id: workspaceHash } } : {}),\n\t\t},\n\n\t\t// Drop auto-capture integrations that can produce breadcrumbs with sensitive data\n\t\tintegrations(defaultIntegrations: AnyIntegration[]) {\n\t\t\treturn defaultIntegrations.filter((i) => ![\"Breadcrumbs\", \"Console\", \"Http\"].includes(i.name));\n\t\t},\n\n\t\tbeforeSend(event) {\n\t\t\t// Strip extra keys outside allowlist\n\t\t\tif (event.extra) {\n\t\t\t\tconst filtered: Record<string, unknown> = {};\n\t\t\t\tfor (const key of EXTRA_ALLOWLIST) {\n\t\t\t\t\tif (key in event.extra) {\n\t\t\t\t\t\tfiltered[key] = event.extra[key];\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tevent.extra = filtered;\n\t\t\t}\n\n\t\t\t// Clear runtime args (may contain file paths)\n\t\t\tif (event.contexts?.runtime) {\n\t\t\t\t(event.contexts.runtime as Record<string, unknown>).args = undefined;\n\t\t\t}\n\n\t\t\t// Clear request body (may contain RPC payloads)\n\t\t\tif (event.request) {\n\t\t\t\tevent.request.data = undefined;\n\t\t\t}\n\n\t\t\t// Clear all breadcrumb data payloads\n\t\t\tif (event.breadcrumbs?.values) {\n\t\t\t\tconst breadcrumbs = event.breadcrumbs.values();\n\t\t\t\tfor (const crumb of breadcrumbs) {\n\t\t\t\t\tcrumb.data = undefined;\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Scrub strings in exception messages and stack frame filenames\n\t\t\tif (event.exception?.values) {\n\t\t\t\tfor (const exc of event.exception.values) {\n\t\t\t\t\tif (exc.value) {\n\t\t\t\t\t\texc.value = scrubString(exc.value);\n\t\t\t\t\t}\n\t\t\t\t\tif (exc.stacktrace?.frames) {\n\t\t\t\t\t\tfor (const frame of exc.stacktrace.frames) {\n\t\t\t\t\t\t\tif (frame.filename) {\n\t\t\t\t\t\t\t\tframe.filename = scrubString(frame.filename);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tif (frame.abs_path) {\n\t\t\t\t\t\t\t\tframe.abs_path = scrubString(frame.abs_path);\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t}\n\n\t\t\t// Scrub event message\n\t\t\tif (event.message) {\n\t\t\t\tevent.message = scrubString(event.message);\n\t\t\t}\n\n\t\t\treturn event;\n\t\t},\n\n\t\tbeforeBreadcrumb(breadcrumb) {\n\t\t\tconst cat = breadcrumb.category ?? \"\";\n\t\t\tif (BLOCKED_BREADCRUMB_CATEGORIES.has(cat)) {\n\t\t\t\t// Explicit opt-in via _allow sentinel bypasses the filter\n\t\t\t\tconst data = breadcrumb.data as Record<string, unknown> | undefined;\n\t\t\t\tif (data?._allow === true) {\n\t\t\t\t\tconst { _allow: _, ...rest } = data;\n\t\t\t\t\tbreadcrumb.data = rest as Record<string, unknown>;\n\t\t\t\t\treturn breadcrumb;\n\t\t\t\t}\n\t\t\t\treturn null;\n\t\t\t}\n\t\t\treturn breadcrumb;\n\t\t},\n\t};\n}\n"]}