@futurewindai/wotchi 0.1.0-beta.1 → 0.1.0-beta.2

package/README.md

@@ -1,26 +1,86 @@
 # Wotchi
 
-> Your production's night shift.
+> Bounded incident alerts for Node.js services.
 
-Wotchi is a lightweight incident assistant for Node.js applications. It is intended to help small teams turn repeated Express and NestJS application errors into a small number of useful console or Telegram alerts without operating a separate monitoring stack.
+> **Status:** Public beta (`0.1.0-beta.2`). Install with the `beta` tag; the API may evolve before the first stable release.
 
-> **Project status:** Private beta candidate (`0.1.0-beta.1`). Phases 1–8 are implemented and locally validated, including bounded incident processing, console and Telegram alerts, Express 4/5 middleware, NestJS 10/11 exception-filter integration, opt-in crash observation, security gates, performance budgets, packed-tarball examples, and Node.js 18–26 CI. The source repository is public; the npm package is not published yet.
+[![CI](https://github.com/FutureWindAI/Wotchi/actions/workflows/ci.yml/badge.svg?branch=main)](https://github.com/FutureWindAI/Wotchi/actions/workflows/ci.yml)
+[![CodeQL](https://github.com/FutureWindAI/Wotchi/actions/workflows/codeql.yml/badge.svg?branch=main)](https://github.com/FutureWindAI/Wotchi/actions/workflows/codeql.yml)
+[![npm](https://img.shields.io/npm/v/%40futurewindai%2Fwotchi?label=npm%20beta)](https://www.npmjs.com/package/@futurewindai/wotchi)
+[![License](https://img.shields.io/badge/license-Apache--2.0-blue.svg)](LICENSE)
+[![Node.js >=18.18](https://img.shields.io/badge/node-%3E%3D18.18.0-339933?logo=node.js&logoColor=white)](https://nodejs.org/en/about/previous-releases)
 
-The working package name is `@futurewindai/wotchi`. The founder accepted the documented Wotchi trademark risk for the beta release on 2026-08-08; this is not legal clearance. The package remains unpublished until the exact release snapshot and gates are verified.
+Wotchi captures application errors in-process, removes sensitive values, groups repeated failures, and delivers bounded console or Telegram alerts without changing framework response handling.
 
-## Planned v0.1 Scope
+## Quick start
 
-- one framework-independent TypeScript core;
-- focused integrations for Express 4/5 and NestJS 10/11;
-- manual exception and structured error-event capture;
-- sensitive-data redaction before storage, fingerprinting, logging, or transmission;
-- stable fingerprints and deterministic incident summaries;
-- bounded in-memory grouping, thresholds, cooldowns, and notification queueing;
-- console and Telegram notifiers;
-- CommonJS and ECMAScript module package exports;
-- measured latency, CPU, heap, queue, and package-size release gates.
+```bash
+npm install @futurewindai/wotchi@beta
+```
 
-The package exposes a root entry point plus focused `/express` and `/nest` entry points. Framework adapters are loaded only through their subpaths, and they observe errors while leaving response ownership with Express or NestJS.
+```ts
+import { consoleNotifier, createWotchi } from "@futurewindai/wotchi";
+
+const wotchi = createWotchi({
+  service: "orders-api",
+  environment: "development",
+  grouping: { alertThreshold: 1 },
+  notifiers: [consoleNotifier()],
+});
+
+wotchi.captureException(new Error("database query failed"));
+await wotchi.flush();
+```
+
+The example uses a threshold of one so the alert is visible immediately. The default policy groups three matching errors in one minute and suppresses duplicate alerts during the cooldown. Capture is synchronous; call `flush()` when the host needs to wait for notifier work.
+
+Example console output:
+
+```text
+Wotchi — Medium incident
+Service: orders-api
+Environment: development
+Summary: Observed 1 occurrences of Error: database query failed.
+Occurrences: 1
+First seen: 2026-08-08T12:00:00.000Z
+Last seen: 2026-08-08T12:00:00.000Z
+Suggested checks:
+- Check database availability, connection saturation, and recent schema changes.
+- Check the affected query and its dependency health before increasing capacity.
+```
+
+Timestamps and the fingerprint vary for each run. The alert is sanitized before it reaches a
+notifier.
+
+## What you get
+
+| Capability                                | Result                                                                             |
+| ----------------------------------------- | ---------------------------------------------------------------------------------- |
+| Bounded capture and queueing              | Repeated failures cannot create unbounded in-memory work.                          |
+| Redaction before processing               | Sensitive values are removed before grouping, logging, or transmission.            |
+| Grouping and cooldowns                    | Repeated failures produce a small number of useful alerts.                         |
+| Express 4/5 and NestJS 10/11 adapters     | Errors are observed while the framework keeps response ownership.                  |
+| ESM, CommonJS, and TypeScript types       | Use the package with common Node.js module setups.                                 |
+| Console and optional Telegram notifiers   | Start locally or self-host delivery without a Wotchi control plane.                |
+| Optional status observation and JSON logs | Observe direct `401`/`403`/`429`/`5xx` responses and emit collector-friendly JSON. |
+
+## How it works
+
+```mermaid
+flowchart LR
+  A[Application error] --> B[Normalize and redact]
+  B --> C[Stable fingerprint]
+  C --> D[Threshold and cooldown]
+  D --> E[Bounded queue]
+  E --> F[Console]
+  E --> G[Telegram]
+```
+
+The same bounded capture path can be called from HTTP handlers, background workers, and queue
+processors. Wotchi does not replace the host application's response, retry, or acknowledgement
+logic.
+
+## Framework integrations
 
 Express applications install the middleware after routes and before the existing final error handler:
 
@@ -47,7 +107,11 @@ import { registerWotchiNest } from "@futurewindai/wotchi/nest";
 registerWotchiNest(app, wotchi);
 ```
 
-Telegram is an optional self-hosted notifier. The application owner creates a bot with BotFather, starts or adds it to the destination chat, and keeps the credentials outside source control:
+The package supports Node.js `>=18.18.0`. Express and NestJS adapters are optional subpath integrations, so applications only load the framework adapter they use.
+
+## Telegram alerts
+
+Telegram is an optional self-hosted notifier. Create a bot with BotFather, start or add it to the destination chat, and keep both values outside source control:
 
 ```ts
 import { consoleNotifier, createWotchi, telegramNotifier } from "@futurewindai/wotchi";
@@ -65,9 +129,11 @@ const wotchi = createWotchi({
 });
 ```
 
-Wotchi does not ship a shared bot token. Telegram delivery is queued outside the request path, uses bounded HTTPS timeouts/retries, and sends only the sanitized incident alert.
+Wotchi does not ship a shared bot token. Delivery is queued outside the request path and sends only the sanitized incident alert. See [configuration](docs/CONFIGURATION.md) for notifier and security options.
+
+## Process monitoring
 
-Crash observation is also opt-in:
+Crash observation is opt-in:
 
 ```ts
 import { registerWotchiProcessMonitor } from "@futurewindai/wotchi";
@@ -76,53 +142,36 @@ const monitor = registerWotchiProcessMonitor(wotchi);
 // monitor.unregister() when the host intentionally stops observing crashes
 ```
 
-The implemented core can be exercised directly:
+## What it is not
 
-```ts
-import { consoleNotifier, createWotchi } from "@futurewindai/wotchi";
-
-const wotchi = createWotchi({
-  service: "orders-api",
-  environment: "production",
-  notifiers: [consoleNotifier()],
-});
-
-wotchi.captureException(new Error("database query failed"));
-await wotchi.flush();
-```
-
-The default policy emits after three matching errors in one minute and suppresses duplicate alerts during the cooldown. The capture path remains synchronous; `flush()` is only needed when the host explicitly wants to wait for notifier work.
-
-## Product Principles
-
-- **Host safety:** Wotchi must not break, suppress, or materially delay the application's normal error flow.
-- **Bounded overhead:** memory, payloads, groups, and queued notifications must all have explicit limits.
-- **Privacy first:** request bodies, response bodies, raw headers, and arbitrary environment variables are outside the first release.
-- **Deterministic first:** the MVP must work without an AI provider, database, hosted account, or collector.
-- **Honest compatibility:** the MVP targets Node.js 18.18 and later. Supported framework/module combinations are claimed only after packed-tarball CI verification. Maintained Node.js LTS versions are recommended for production.
+- A full observability, APM, or log-management platform.
+- A hosted dashboard, collector, or persistent incident database.
+- An AI-generated incident-summary service in this release.
+- A Slack, Discord, email, or generic webhook notifier in this release.
+- A Docker, Kubernetes, or Helm collector bundled into the npm SDK.
+- An automatic-remediation system.
 
-## Not Planned for v0.1
+## Documentation
 
-- a full observability, APM, or log-management platform;
-- a hosted dashboard, collector, or persistent incident history;
-- AI-generated summaries;
-- Slack, Discord, email, or generic webhook notifiers;
-- logger transports, Docker collectors, Kubernetes agents, or Helm charts in the npm SDK itself; a separate future collector/relay deployment may receive its own Docker and Helm milestone;
-- automatic remediation.
-
-A token-based hosted demo viewer is a separate possible future milestone, not part of the package MVP.
-
-## Project Documents
-
-- [Architecture and package boundaries](docs/ARCHITECTURE.md)
-- [Setup](docs/SETUP.md)
+- [Getting started](docs/GETTING_STARTED.md)
+- [Examples](docs/EXAMPLES.md)
+- [API reference](docs/API.md)
 - [Configuration](docs/CONFIGURATION.md)
-- [Testing and smoke validation](docs/TESTING.md)
-- [Security and privacy notes](docs/SECURITY.md)
-- [Development workflow](docs/DEVELOPMENT.md)
-- [Security policy](SECURITY.md)
-- [Contributing guide](CONTRIBUTING.md)
+- [Compatibility](docs/COMPATIBILITY.md)
+- [Performance](docs/PERFORMANCE.md)
+- [Architecture](docs/ARCHITECTURE.md)
+- [Roadmap](docs/ROADMAP.md)
+- [Troubleshooting](docs/TROUBLESHOOTING.md)
+- [FAQ](docs/FAQ.md)
+- [Security and privacy](docs/SECURITY.md)
+- [Threat model](docs/THREAT_MODEL.md)
+- [Contributing](CONTRIBUTING.md)
 - [Changelog](CHANGELOG.md)
+- [GitHub releases](https://github.com/FutureWindAI/Wotchi/releases)
 - [Apache License 2.0](LICENSE)
 
-Wotchi is an early open-source project from FutureWind AI. Contributions and product feedback should stay within the documented scope and avoid real secrets or customer error data.
+## Security
+
+Do not include real secrets or customer error data in issues, examples, or test fixtures. Report security vulnerabilities privately using [SECURITY.md](SECURITY.md).
+
+Wotchi is open source and maintained by FutureWind AI.

package/SECURITY.md

@@ -2,9 +2,9 @@
 
 ## Supported Versions
 
-Wotchi is currently pre-release. The package targets consumers running Node.js `>=18.18.0` and is built and tested across the maintained Node.js 18–26 matrix. Node.js versions below 18.18 are not supported.
+Wotchi targets applications running Node.js `>=18.18.0` and is built and tested across the Node.js 18–26 matrix. Node.js versions below 18.18 are not supported.
 
-The current pre-release package contains the framework-independent capture core, console and Telegram notifiers, Express 4/5 middleware, NestJS 10/11 exception-filter integration, and opt-in process monitoring. The package has not been published to npm. Supported runtime and framework combinations are documented only after the packed-tarball compatibility and release-security gates pass.
+The current package contains the framework-independent capture core, console and Telegram notifiers, Express 4/5 middleware, NestJS 10/11 exception-filter integration, and opt-in process monitoring. Supported runtime and framework combinations are documented after packed-tarball compatibility and release-security checks.
 
 ## Reporting a Vulnerability
 

package/dist/cjs/core/client.js

@@ -60,6 +60,15 @@ const safeMessage = (value, privacy) => {
     const normalized = (0, normalize_js_1.normalizeUnknown)(value, privacy);
     return typeof normalized === "string" ? normalized : "[unreadable value]";
 };
+const normalizeEventAlertThreshold = (value) => {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (!Number.isSafeInteger(value) || value <= 0 || value > 1_000_000) {
+        throw new TypeError("event.alertThreshold must be a positive integer no greater than 1000000");
+    }
+    return value;
+};
 function createWotchi(config) {
     const normalized = (0, config_js_1.validateConfig)(config);
     const now = Date.now;
@@ -76,7 +85,7 @@ function createWotchi(config) {
     });
     const privacy = normalized.privacy;
     let eventSequence = 0;
-    const captureSafeEvent = (error, metadata, context, request, eventKind = "error") => {
+    const captureSafeEvent = (error, metadata, context, request, eventKind = "error", alertThreshold = normalized.grouping.alertThreshold) => {
         const timestamp = now();
         const safeError = (0, redact_js_1.redactError)((0, normalize_js_1.normalizeError)(error, privacy), privacy);
         const requestContext = safeRequest(request, privacy);
@@ -97,7 +106,7 @@ function createWotchi(config) {
         const decision = (0, incident_policy_js_1.evaluateIncidentPolicy)({
             group,
             now: timestamp,
-            alertThreshold: normalized.grouping.alertThreshold,
+            alertThreshold,
             cooldownMs: normalized.grouping.cooldownMs,
             eventKind,
         });
@@ -131,7 +140,8 @@ function createWotchi(config) {
             if (typeof event.message !== "string") {
                 throw new TypeError("event.message must be a string");
             }
-            captureSafeEvent(event.error ?? safeMessage(event.message, privacy), event.metadata, event.context, event.request, event.kind ?? "error");
+            const alertThreshold = normalizeEventAlertThreshold(event.alertThreshold);
+            captureSafeEvent(event.error ?? safeMessage(event.message, privacy), event.metadata, event.context, event.request, event.kind ?? "error", alertThreshold ?? normalized.grouping.alertThreshold);
         }
         catch {
             diagnostics.captureFailures += 1;

package/dist/cjs/core/redact.js

@@ -51,11 +51,40 @@ const redactCardLikeValues = (value) => value.replace(/\b\d[\d -]{11,25}\d\b/g,
     const digits = candidate.replace(/[ -]/g, "");
     return digits.length >= 13 && digits.length <= 19 && luhnValid(digits) ? exports.REDACTED : candidate;
 });
+const CONNECTION_URL_PATTERN = /\b(?:postgres(?:ql)?|rediss?|mongodb(?:\+srv)?):\/\/[^\s"'<>]+/gi;
+const CONNECTION_QUERY_SECRET_PATTERN = /([?&](?:password|passwd|pass|secret|token|api[-_]?key|access[-_]?token|refresh[-_]?token|sslpassword)=)[^&#\s]*/gi;
+const URL_TRAILING_PUNCTUATION = /[),.;!?]+$/;
+const redactConnectionUrl = (candidate) => {
+    let core = candidate;
+    let suffix = "";
+    while (URL_TRAILING_PUNCTUATION.test(core)) {
+        suffix = `${core.slice(-1)}${suffix}`;
+        core = core.slice(0, -1);
+    }
+    const schemeEnd = core.indexOf("://");
+    if (schemeEnd < 0) {
+        return candidate;
+    }
+    const authorityStart = schemeEnd + 3;
+    const authorityOffset = core.slice(authorityStart).search(/[/?#]/);
+    const authorityEnd = authorityOffset < 0 ? core.length : authorityStart + authorityOffset;
+    const authority = core.slice(authorityStart, authorityEnd);
+    const atIndex = authority.lastIndexOf("@");
+    const redactedAuthority = atIndex < 0 ? authority : `${exports.REDACTED}@${authority.slice(atIndex + 1)}`;
+    const remainder = core
+        .slice(authorityEnd)
+        .replace(CONNECTION_QUERY_SECRET_PATTERN, `$1${exports.REDACTED}`);
+    return `${core.slice(0, authorityStart)}${redactedAuthority}${remainder}${suffix}`;
+};
+const redactConnectionUrls = (value) => value.replace(CONNECTION_URL_PATTERN, redactConnectionUrl);
 const redactString = (value, maxStringLength) => {
-    let result = value;
+    let result = redactConnectionUrls(value);
     result = result.replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?-----END [^-]*PRIVATE KEY-----/gi, exports.REDACTED);
     result = result.replace(/\bBearer\s+[A-Za-z0-9._~+/=-]+/gi, `Bearer ${exports.REDACTED}`);
-    result = result.replace(/\b(?:authorization|password|passwd|secret|token|api[-_]?key)\s*[:=]\s*[^\s,;]+/gi, (match) => `${match.slice(0, match.search(/[:=]/))}: ${exports.REDACTED}`);
+    result = result.replace(/\b(?:authorization|password|passwd|secret|token|api[-_]?key)\s*[:=]\s*[^\s,;]+/gi, (match) => {
+        const separatorIndex = match.search(/[:=]/);
+        return separatorIndex < 0 ? exports.REDACTED : `${match.slice(0, separatorIndex + 1)}${exports.REDACTED}`;
+    });
     result = result.replace(/\b[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, exports.REDACTED);
     result = result.replace(/\b(?:github_pat|ghp|xox[baprs]-|sk|pk|AKIA)[A-Za-z0-9_-]{8,}\b/gi, exports.REDACTED);
     result = redactCardLikeValues(result);

package/dist/cjs/integrations/express/error-handler.js

@@ -2,8 +2,10 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createExpressErrorHandler = createExpressErrorHandler;
 const request_context_js_1 = require("./request-context.js");
+const state_js_1 = require("./state.js");
 function createExpressErrorHandler(client, options) {
     return (error, request, response, next) => {
+        (0, state_js_1.markExpressErrorCaptured)(request);
         try {
             client.captureException(error, (0, request_context_js_1.getExpressRequestContext)(request, response, options));
         }

package/dist/cjs/integrations/express/index.js

@@ -1,12 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.telegramNotifier = exports.createWotchi = exports.consoleNotifier = void 0;
+exports.wotchiStatusObserver = exports.telegramNotifier = exports.createWotchi = exports.consoleNotifier = void 0;
 exports.wotchiErrorHandler = wotchiErrorHandler;
 const error_handler_js_1 = require("./error-handler.js");
 var index_js_1 = require("../../index.js");
 Object.defineProperty(exports, "consoleNotifier", { enumerable: true, get: function () { return index_js_1.consoleNotifier; } });
 Object.defineProperty(exports, "createWotchi", { enumerable: true, get: function () { return index_js_1.createWotchi; } });
 Object.defineProperty(exports, "telegramNotifier", { enumerable: true, get: function () { return index_js_1.telegramNotifier; } });
+var status_observer_js_1 = require("./status-observer.js");
+Object.defineProperty(exports, "wotchiStatusObserver", { enumerable: true, get: function () { return status_observer_js_1.wotchiStatusObserver; } });
 function wotchiErrorHandler(client, options) {
     return (0, error_handler_js_1.createExpressErrorHandler)(client, options);
 }

package/dist/cjs/integrations/express/state.js

@@ -0,0 +1,30 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.markExpressErrorCaptured = markExpressErrorCaptured;
+exports.wasExpressErrorCaptured = wasExpressErrorCaptured;
+const WOTCHI_ERROR_CAPTURED = Symbol("wotchi.errorCaptured");
+const asMarkedRequest = (request) => typeof request === "object" && request !== null ? request : undefined;
+function markExpressErrorCaptured(request) {
+    const markedRequest = asMarkedRequest(request);
+    if (markedRequest === undefined) {
+        return;
+    }
+    try {
+        markedRequest[WOTCHI_ERROR_CAPTURED] = true;
+    }
+    catch {
+        // A request object can be frozen by host middleware; the observer remains best-effort.
+    }
+}
+function wasExpressErrorCaptured(request) {
+    const markedRequest = asMarkedRequest(request);
+    if (markedRequest === undefined) {
+        return false;
+    }
+    try {
+        return markedRequest[WOTCHI_ERROR_CAPTURED] === true;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/cjs/integrations/express/status-observer.js

@@ -0,0 +1,80 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.wotchiStatusObserver = wotchiStatusObserver;
+const request_context_js_1 = require("./request-context.js");
+const state_js_1 = require("./state.js");
+const DEFAULT_STATUS_CODES = [401, 403, 429];
+const DEFAULT_STATUS_CLASSES = ["5xx"];
+const MAX_STATUS_CODES = 100;
+const normalizeStatuses = (values, defaults) => {
+    const selected = values ?? defaults;
+    if (selected.length > MAX_STATUS_CODES) {
+        throw new TypeError("statusCodes must contain at most 100 values");
+    }
+    for (const status of selected) {
+        if (!Number.isSafeInteger(status) || status < 100 || status > 599) {
+            throw new TypeError("statusCodes must contain HTTP status codes from 100 through 599");
+        }
+    }
+    return new Set(selected);
+};
+const normalizeStatusClasses = (values) => {
+    const selected = values ?? DEFAULT_STATUS_CLASSES;
+    for (const statusClass of selected) {
+        if (statusClass !== "4xx" && statusClass !== "5xx") {
+            throw new TypeError('statusClasses must contain only "4xx" or "5xx"');
+        }
+    }
+    return new Set(selected);
+};
+const normalizeAlertThreshold = (value) => {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (!Number.isSafeInteger(value) || value <= 0 || value > 1_000_000) {
+        throw new TypeError("alertThreshold must be a positive integer no greater than 1000000");
+    }
+    return value;
+};
+const normalizeOptions = (options) => {
+    const alertThreshold = normalizeAlertThreshold(options?.alertThreshold);
+    return {
+        ...(options?.requestIdProperty === undefined
+            ? {}
+            : { requestIdProperty: options.requestIdProperty }),
+        statusCodes: normalizeStatuses(options?.statusCodes, DEFAULT_STATUS_CODES),
+        statusClasses: normalizeStatusClasses(options?.statusClasses),
+        ignoreStatusCodes: normalizeStatuses(options?.ignoreStatusCodes, []),
+        ...(alertThreshold === undefined ? {} : { alertThreshold }),
+    };
+};
+const isObservedStatus = (statusCode, options) => !options.ignoreStatusCodes.has(statusCode) &&
+    (options.statusCodes.has(statusCode) ||
+        (statusCode >= 400 && statusCode < 500 && options.statusClasses.has("4xx")) ||
+        (statusCode >= 500 && statusCode < 600 && options.statusClasses.has("5xx")));
+function wotchiStatusObserver(client, options) {
+    const normalizedOptions = normalizeOptions(options);
+    return (request, response, next) => {
+        response.once("finish", () => {
+            const statusCode = response.statusCode;
+            if ((0, state_js_1.wasExpressErrorCaptured)(request) || !isObservedStatus(statusCode, normalizedOptions)) {
+                return;
+            }
+            try {
+                const requestContext = (0, request_context_js_1.getExpressRequestContext)(request, response, normalizedOptions);
+                client.captureEvent({
+                    level: "error",
+                    message: `HTTP ${statusCode} response`,
+                    ...(normalizedOptions.alertThreshold === undefined
+                        ? {}
+                        : { alertThreshold: normalizedOptions.alertThreshold }),
+                    ...(requestContext === undefined ? {} : { request: requestContext }),
+                });
+            }
+            catch {
+                // Status observation must never change the host response lifecycle.
+            }
+        });
+        next();
+    };
+}

package/dist/cjs/integrations/nest/index.js

@@ -1,9 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.registerWotchiNest = exports.telegramNotifier = exports.createWotchi = exports.consoleNotifier = void 0;
+exports.registerWotchiNestStatusObserver = exports.registerWotchiNest = exports.telegramNotifier = exports.createWotchi = exports.consoleNotifier = void 0;
 var index_js_1 = require("../../index.js");
 Object.defineProperty(exports, "consoleNotifier", { enumerable: true, get: function () { return index_js_1.consoleNotifier; } });
 Object.defineProperty(exports, "createWotchi", { enumerable: true, get: function () { return index_js_1.createWotchi; } });
 Object.defineProperty(exports, "telegramNotifier", { enumerable: true, get: function () { return index_js_1.telegramNotifier; } });
 var register_js_1 = require("./register.js");
 Object.defineProperty(exports, "registerWotchiNest", { enumerable: true, get: function () { return register_js_1.registerWotchiNest; } });
+Object.defineProperty(exports, "registerWotchiNestStatusObserver", { enumerable: true, get: function () { return register_js_1.registerWotchiNestStatusObserver; } });

package/dist/cjs/integrations/nest/register.js

@@ -1,8 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.registerWotchiNest = registerWotchiNest;
+exports.registerWotchiNestStatusObserver = registerWotchiNestStatusObserver;
 const core_1 = require("@nestjs/core");
 const exception_filter_js_1 = require("./exception-filter.js");
+const status_observer_js_1 = require("../express/status-observer.js");
 function registerWotchiNest(app, client, options) {
     const application = app;
     const directAdapter = application.getHttpAdapter?.();
@@ -11,3 +13,10 @@ function registerWotchiNest(app, client, options) {
         : directAdapter;
     application.useGlobalFilters(new exception_filter_js_1.WotchiNestExceptionFilter(client, httpAdapter, options));
 }
+function registerWotchiNestStatusObserver(app, client, options) {
+    const application = app;
+    if (typeof application.use !== "function") {
+        throw new TypeError("Nest application does not expose use(); an Express-based adapter is required");
+    }
+    application.use((0, status_observer_js_1.wotchiStatusObserver)(client, options));
+}

package/dist/cjs/notifiers/console.js

@@ -2,22 +2,42 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.formatConsoleAlert = formatConsoleAlert;
 exports.consoleNotifier = consoleNotifier;
+const redact_js_1 = require("../core/redact.js");
 const MAX_FIELD_LENGTH = 1_000;
 const MAX_ACTIONS = 5;
 const limit = (value, maxLength = MAX_FIELD_LENGTH) => value.slice(0, maxLength);
-function formatConsoleAlert(alert) {
-    const actions = alert.suggestedActions
+const safeText = (value, maxLength = MAX_FIELD_LENGTH) => {
+    const redacted = (0, redact_js_1.redactValue)(value, { maxStringLength: maxLength });
+    return typeof redacted === "string" ? limit(redacted, maxLength) : "[unreadable value]";
+};
+const boundedAlert = (alert) => ({
+    title: safeText(alert.title),
+    fingerprint: safeText(alert.fingerprint),
+    severity: alert.severity,
+    summary: safeText(alert.summary),
+    suggestedActions: alert.suggestedActions
         .slice(0, MAX_ACTIONS)
-        .map((action) => `- ${limit(action, 300)}`)
-        .join("\n");
+        .map((action) => safeText(action, 300)),
+    firstSeenAt: safeText(alert.firstSeenAt, 100),
+    lastSeenAt: safeText(alert.lastSeenAt, 100),
+    occurrences: Number.isSafeInteger(alert.occurrences) && alert.occurrences >= 0 ? alert.occurrences : 0,
+    service: safeText(alert.service, 300),
+    environment: safeText(alert.environment, 300),
+});
+function formatConsoleAlert(alert, format = "text") {
+    const bounded = boundedAlert(alert);
+    if (format === "json") {
+        return JSON.stringify(bounded);
+    }
+    const actions = bounded.suggestedActions.map((action) => `- ${action}`).join("\n");
     return [
-        limit(alert.title),
-        `Service: ${limit(alert.service, 300)}`,
-        `Environment: ${limit(alert.environment, 300)}`,
-        `Summary: ${limit(alert.summary)}`,
-        `Occurrences: ${alert.occurrences}`,
-        `First seen: ${limit(alert.firstSeenAt, 100)}`,
-        `Last seen: ${limit(alert.lastSeenAt, 100)}`,
+        bounded.title,
+        `Service: ${bounded.service}`,
+        `Environment: ${bounded.environment}`,
+        `Summary: ${bounded.summary}`,
+        `Occurrences: ${bounded.occurrences}`,
+        `First seen: ${bounded.firstSeenAt}`,
+        `Last seen: ${bounded.lastSeenAt}`,
         "Suggested checks:",
         actions,
     ].join("\n");
@@ -27,7 +47,7 @@ function consoleNotifier(options) {
     return {
         name: "console",
         async send(alert) {
-            write(formatConsoleAlert(alert));
+            write(formatConsoleAlert(alert, options?.format ?? "text"));
         },
     };
 }

package/dist/esm/core/client.js

@@ -57,6 +57,15 @@ const safeMessage = (value, privacy) => {
     const normalized = normalizeUnknown(value, privacy);
     return typeof normalized === "string" ? normalized : "[unreadable value]";
 };
+const normalizeEventAlertThreshold = (value) => {
+    if (value === undefined) {
+        return undefined;
+    }
+    if (!Number.isSafeInteger(value) || value <= 0 || value > 1_000_000) {
+        throw new TypeError("event.alertThreshold must be a positive integer no greater than 1000000");
+    }
+    return value;
+};
 export function createWotchi(config) {
     const normalized = validateConfig(config);
     const now = Date.now;
@@ -73,7 +82,7 @@ export function createWotchi(config) {
     });
     const privacy = normalized.privacy;
     let eventSequence = 0;
-    const captureSafeEvent = (error, metadata, context, request, eventKind = "error") => {
+    const captureSafeEvent = (error, metadata, context, request, eventKind = "error", alertThreshold = normalized.grouping.alertThreshold) => {
         const timestamp = now();
         const safeError = redactError(normalizeError(error, privacy), privacy);
         const requestContext = safeRequest(request, privacy);
@@ -94,7 +103,7 @@ export function createWotchi(config) {
         const decision = evaluateIncidentPolicy({
             group,
             now: timestamp,
-            alertThreshold: normalized.grouping.alertThreshold,
+            alertThreshold,
             cooldownMs: normalized.grouping.cooldownMs,
             eventKind,
         });
@@ -128,7 +137,8 @@ export function createWotchi(config) {
             if (typeof event.message !== "string") {
                 throw new TypeError("event.message must be a string");
             }
-            captureSafeEvent(event.error ?? safeMessage(event.message, privacy), event.metadata, event.context, event.request, event.kind ?? "error");
+            const alertThreshold = normalizeEventAlertThreshold(event.alertThreshold);
+            captureSafeEvent(event.error ?? safeMessage(event.message, privacy), event.metadata, event.context, event.request, event.kind ?? "error", alertThreshold ?? normalized.grouping.alertThreshold);
         }
         catch {
             diagnostics.captureFailures += 1;

package/dist/esm/core/redact.js

@@ -46,11 +46,40 @@ const redactCardLikeValues = (value) => value.replace(/\b\d[\d -]{11,25}\d\b/g,
     const digits = candidate.replace(/[ -]/g, "");
     return digits.length >= 13 && digits.length <= 19 && luhnValid(digits) ? REDACTED : candidate;
 });
+const CONNECTION_URL_PATTERN = /\b(?:postgres(?:ql)?|rediss?|mongodb(?:\+srv)?):\/\/[^\s"'<>]+/gi;
+const CONNECTION_QUERY_SECRET_PATTERN = /([?&](?:password|passwd|pass|secret|token|api[-_]?key|access[-_]?token|refresh[-_]?token|sslpassword)=)[^&#\s]*/gi;
+const URL_TRAILING_PUNCTUATION = /[),.;!?]+$/;
+const redactConnectionUrl = (candidate) => {
+    let core = candidate;
+    let suffix = "";
+    while (URL_TRAILING_PUNCTUATION.test(core)) {
+        suffix = `${core.slice(-1)}${suffix}`;
+        core = core.slice(0, -1);
+    }
+    const schemeEnd = core.indexOf("://");
+    if (schemeEnd < 0) {
+        return candidate;
+    }
+    const authorityStart = schemeEnd + 3;
+    const authorityOffset = core.slice(authorityStart).search(/[/?#]/);
+    const authorityEnd = authorityOffset < 0 ? core.length : authorityStart + authorityOffset;
+    const authority = core.slice(authorityStart, authorityEnd);
+    const atIndex = authority.lastIndexOf("@");
+    const redactedAuthority = atIndex < 0 ? authority : `${REDACTED}@${authority.slice(atIndex + 1)}`;
+    const remainder = core
+        .slice(authorityEnd)
+        .replace(CONNECTION_QUERY_SECRET_PATTERN, `$1${REDACTED}`);
+    return `${core.slice(0, authorityStart)}${redactedAuthority}${remainder}${suffix}`;
+};
+const redactConnectionUrls = (value) => value.replace(CONNECTION_URL_PATTERN, redactConnectionUrl);
 const redactString = (value, maxStringLength) => {
-    let result = value;
+    let result = redactConnectionUrls(value);
     result = result.replace(/-----BEGIN [^-]*PRIVATE KEY-----[\s\S]*?-----END [^-]*PRIVATE KEY-----/gi, REDACTED);
     result = result.replace(/\bBearer\s+[A-Za-z0-9._~+/=-]+/gi, `Bearer ${REDACTED}`);
-    result = result.replace(/\b(?:authorization|password|passwd|secret|token|api[-_]?key)\s*[:=]\s*[^\s,;]+/gi, (match) => `${match.slice(0, match.search(/[:=]/))}: ${REDACTED}`);
+    result = result.replace(/\b(?:authorization|password|passwd|secret|token|api[-_]?key)\s*[:=]\s*[^\s,;]+/gi, (match) => {
+        const separatorIndex = match.search(/[:=]/);
+        return separatorIndex < 0 ? REDACTED : `${match.slice(0, separatorIndex + 1)}${REDACTED}`;
+    });
     result = result.replace(/\b[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, REDACTED);
     result = result.replace(/\b(?:github_pat|ghp|xox[baprs]-|sk|pk|AKIA)[A-Za-z0-9_-]{8,}\b/gi, REDACTED);
     result = redactCardLikeValues(result);

package/dist/esm/integrations/express/error-handler.js

@@ -1,6 +1,8 @@
 import { getExpressRequestContext } from "./request-context.js";
+import { markExpressErrorCaptured } from "./state.js";
 export function createExpressErrorHandler(client, options) {
     return (error, request, response, next) => {
+        markExpressErrorCaptured(request);
         try {
             client.captureException(error, getExpressRequestContext(request, response, options));
         }