[DO NOT MERGE] feat(core): add opt-in assertion instrumentation - #6592

values !== undefined allows null through to flattenValues, where Object.keys(null) throws a TypeError and breaks the reporting path.

Only arguments[1] is captured, so variadic helpers like console.assert(condition, fmt, ...args) or invariant(condition, fmt, ...args) lose their substitution values in Sentry and produce un-interpolated %s messages. Any side effects in extra arguments are also removed from the AST.

The transform emits new Error() at the assertion call site without referencing the global constructor. A local let Error, parameter named Error, or module-scoped alias shadows the global and can cause a TypeError: Error is not a constructor crash when the assertion fires.

The includeNodeModules allowlist check does not normalize backslashes before matching fragments, so on Windows the plugin will not be pushed for allowlisted dependency paths. The plugin itself correctly normalizes via toPosixPath. Have you considered normalizing args.filename before the allowlist .includes() checks?

Accessing values[key] in the loop can trigger a throwing getter, breaking the reporting path's no-throw guarantee.

values !== undefined on line 201 allows null into flattenValues, where Object.keys(null) throws a TypeError and breaks the reporting path. The Babel transform emits only object literals, but manual calls that bypass the TypeScript contract can crash the safe reporter.

Also found at:

• packages/core/src/js/index.ts:119
• packages/core/src/js/assertion.ts:170-171

The Metro transformer wrapper (addSentryCaptureAssertionsPlugin) mirrors the plugin's isNodeModulesExcluded check but omits toPosixPath normalization, so allowlist fragments with forward slashes never match Windows backslash filenames and the plugin is never pushed for those dependencies.

Also found at:

• packages/core/src/js/tools/sentryAssertionBabelPlugin.ts:378
• packages/core/src/js/tools/sentryBabelTransformerUtils.ts:17
• packages/core/src/js/tools/sentryBabelTransformerUtils.ts:169-170
• packages/core/test/tools/sentryBabelTransformer.test.ts:246-250

The deduplication test assumes a fresh reportedSites Set, but assertion.ts keeps it at module level with no reset mechanism, so siteIds accumulate across tests and can cause order-dependent failures.