fixup! ref: Remove the option to enable them again

Author: JPeer264

.size-limit.js

@@ -480,7 +480,7 @@ module.exports = [
     ignore: [...builtinModules, ...nodePrefixedBuiltinModules],
     gzip: false,
     brotli: false,
-    limit: '445 KiB',
+    limit: '448 KiB',
     disablePlugins: ['@size-limit/webpack'],
     webpack: false,
     modifyEsbuildConfig: function (config) {

dev-packages/e2e-tests/test-applications/cloudflare-agent/tests/callable.test.ts

@@ -34,17 +34,20 @@ test('@callable() methods work correctly with Sentry instrumentDurableObjectWith
     },
     spans: expect.arrayContaining([
       expect.objectContaining({
-        op: 'db.query',
-        origin: 'auto.db.cloudflare.durable_object.sql',
-        description: expect.stringMatching(/^SELECT /),
-        data: expect.objectContaining({
-          'db.system.name': 'cloudflare-durable-object-sql',
-          'db.operation.name': 'exec',
-          'db.query.summary': expect.any(String),
-          'db.query.text': expect.any(String),
-          'sentry.op': 'db.query',
-          'sentry.origin': 'auto.db.cloudflare.durable_object.sql',
-        }),
+        data: {
+          'db.operation.name': 'get',
+          'db.system.name': 'cloudflare.durable_object.storage',
+          'sentry.op': 'db',
+          'sentry.origin': 'auto.db.cloudflare.durable_object',
+        },
+        description: 'durable_object_storage_get',
+        op: 'db',
+        origin: 'auto.db.cloudflare.durable_object',
+        parent_span_id: expect.stringMatching(/[a-f0-9]{16}/),
+        span_id: expect.stringMatching(/[a-f0-9]{16}/),
+        start_timestamp: expect.any(Number),
+        timestamp: expect.any(Number),
+        trace_id: expect.stringMatching(/[a-f0-9]{32}/),
       }),
     ]),
     start_timestamp: expect.any(Number),

packages/cloudflare/src/client.ts

@@ -216,6 +216,30 @@ interface BaseCloudflareOptions {
    */
   enableRpcTracePropagation?: boolean;
 
+  /**
+   * Table names that should stay instrumented even though they match the reserved `cf_` prefix used
+   * by Durable Object frameworks (`agents`, `partyserver`, ...) for their internal SQLite tables.
+   *
+   * By default, `exec` queries against `cf_`-prefixed tables are treated as framework noise and no
+   * `db.query` span is created for them. If one of your own tables happens to use this prefix, add it
+   * here to opt it back into instrumentation. Entries are matched against each table name in the
+   * query summary — strings must match exactly, while regular expressions give you prefix/pattern
+   * matching.
+   *
+   * @default []
+   * @example
+   * ```ts
+   * export default Sentry.withSentry(
+   *   (env) => ({
+   *     dsn: env.SENTRY_DSN,
+   *     durableObjectSqlSpanAllowlist: ['cf_my_table', /^cf_reports_/],
+   *   }),
+   *   handler,
+   * );
+   * ```
+   */
+  durableObjectSqlSpanAllowlist?: Array<string | RegExp>;
+
   /**
    * @deprecated Use `enableRpcTracePropagation` instead. This option will be removed in a future major version.
    *

packages/cloudflare/src/instrumentations/instrumentSqlStorage.ts

@@ -2,9 +2,11 @@ import type { SqlStorage } from '@cloudflare/workers-types';
 import {
   _INTERNAL_getSqlQuerySummary,
   _INTERNAL_sanitizeSqlQuery,
+  getClient,
   SEMANTIC_ATTRIBUTE_SENTRY_ORIGIN,
   startSpan,
 } from '@sentry/core';
+import type { CloudflareClientOptions } from '../client';
 import { targetsCloudflareInternalTable } from '../utils/internalSqlQuery';
 
 /**
@@ -28,7 +30,10 @@ export function instrumentSqlStorage(sql: SqlStorage): SqlStorage {
         const sanitizedQuery = _INTERNAL_sanitizeSqlQuery(query);
         const querySummary = _INTERNAL_getSqlQuerySummary(sanitizedQuery);
 
-        if (targetsCloudflareInternalTable(querySummary)) {
+        const allowlist = (getClient()?.getOptions() as CloudflareClientOptions | undefined)
+          ?.durableObjectSqlSpanAllowlist;
+
+        if (targetsCloudflareInternalTable(querySummary, allowlist)) {
           return (original as (...a: unknown[]) => ReturnType<SqlStorage['exec']>).apply(target, args);
         }
 

packages/cloudflare/src/utils/internalSqlQuery.ts

@@ -1,3 +1,5 @@
+import { stringMatchesSomePattern } from '@sentry/core';
+
 /**
  * Cloudflare frameworks that build on Durable Objects (`agents`, `partyserver`, ...) manage their
  * own internal SQLite tables, all namespaced with a `cf_` prefix — e.g. `cf_agents_schedules`,
@@ -6,18 +8,31 @@
  * with dozens of zero-signal `db.query` spans per request. The exact set of tables even varies
  * between framework versions, so we match the reserved prefix rather than an enumerated list.
  *
- * User tables never use this prefix, so skipping their spans is safe.
+ * The `cf_` prefix is a reserved convention for framework-managed tables, so user tables should not
+ * use it. In case a user table does collide with the prefix, the `durableObjectSqlSpanAllowlist`
+ * option lets them opt those tables back into instrumentation.
  *
  * The check operates on the query summary produced by `getSqlQuerySummary` (`{operation} {table} ...`,
  * the same value used as the span name), so table targets are already isolated from the rest of the
  * query.
  */
-export function targetsCloudflareInternalTable(querySummary: string | undefined): boolean {
+export function targetsCloudflareInternalTable(
+  querySummary: string | undefined,
+  allowlist?: Array<string | RegExp>,
+): boolean {
   if (!querySummary) {
     return false;
   }
 
   const [, ...tables] = querySummary.split(' ');
 
-  return tables.some(table => table.toLowerCase().startsWith('cf_'));
+  return tables.some(table => {
+    if (!table.toLowerCase().startsWith('cf_')) {
+      return false;
+    }
+
+    // A table on the allowlist is treated as a user table and stays instrumented, even though it
+    // matches the reserved prefix.
+    return !allowlist?.length || !stringMatchesSomePattern(table, allowlist, true);
+  });
 }

packages/cloudflare/test/instrumentSqlStorage.test.ts

@@ -168,6 +168,20 @@ describe('instrumentSqlStorage', () => {
 
       expect(startSpanSpy).toHaveBeenCalledTimes(1);
     });
+
+    it('creates a span for a cf_ table on the durableObjectSqlSpanAllowlist', () => {
+      const startSpanSpy = vi.spyOn(sentryCore, 'startSpan');
+      vi.spyOn(sentryCore, 'getClient').mockReturnValue({
+        getOptions: () => ({ durableObjectSqlSpanAllowlist: ['cf_my_table'] }),
+      } as unknown as ReturnType<typeof sentryCore.getClient>);
+
+      const mockSql = createMockSqlStorage();
+      const instrumented = instrumentSqlStorage(mockSql);
+
+      instrumented.exec('SELECT * FROM cf_my_table WHERE id = ?', 1);
+
+      expect(startSpanSpy).toHaveBeenCalledTimes(1);
+    });
   });
 });
 

packages/cloudflare/test/utils/internalSqlQuery.test.ts

@@ -60,6 +60,37 @@ describe('targetsCloudflareInternalTable', () => {
     });
   });
 
+  describe('allowlist (opt a cf_ table back into instrumentation)', () => {
+    it('returns false for an allowlisted table matched by exact string', () => {
+      expect(targetsCloudflareInternalTable(summarize('SELECT * FROM cf_my_table'), ['cf_my_table'])).toBe(false);
+    });
+
+    it('returns false for an allowlisted table matched by regex', () => {
+      expect(targetsCloudflareInternalTable(summarize('SELECT * FROM cf_reports_daily'), [/^cf_reports_/])).toBe(false);
+    });
+
+    it('requires an exact match for string entries', () => {
+      // Substring matches must not opt a table back in, otherwise `cf_` would allowlist everything.
+      expect(targetsCloudflareInternalTable(summarize('SELECT * FROM cf_agents_state'), ['cf_agents'])).toBe(true);
+    });
+
+    it('still skips genuine internal tables that are not allowlisted', () => {
+      expect(targetsCloudflareInternalTable(summarize('SELECT * FROM cf_agents_state'), ['cf_my_table'])).toBe(true);
+    });
+
+    it('still skips when an internal table is joined with an allowlisted table', () => {
+      expect(
+        targetsCloudflareInternalTable(summarize('SELECT * FROM cf_my_table t JOIN cf_agents_state s ON s.id = t.id'), [
+          'cf_my_table',
+        ]),
+      ).toBe(true);
+    });
+
+    it('ignores an empty allowlist', () => {
+      expect(targetsCloudflareInternalTable(summarize('SELECT * FROM cf_agents_state'), [])).toBe(true);
+    });
+  });
+
   describe('summaries without a resolvable table target (safe default: instrument)', () => {
     it.each([
       ['undefined', undefined],