@juspay/neurolink 12.12.9 → 12.12.11

package/dist/proxy/bodyCaptureProcessing.js

@@ -0,0 +1,219 @@
+import { join } from "node:path";
+import { mkdir, chmod, writeFile } from "node:fs/promises";
+import { createHash, randomUUID } from "node:crypto";
+import { promisify } from "node:util";
+import { gzip as gzipCallback } from "node:zlib";
+const REQUEST_LOG_IO_TIMEOUT_MS = 5_000;
+/** Maximum redacted body bytes persisted per capture entry. */
+const MAX_CAPTURED_BODY_BYTES = 1024 * 1024;
+const BODY_TRUNCATION_MARKER = "\n...[TRUNCATED]";
+const gzip = promisify(gzipCallback);
+/** Headers whose values must always be redacted. */
+const SENSITIVE_HEADER_NAMES = new Set([
+    "authorization",
+    "proxy-authorization",
+    "x-api-key",
+    "cookie",
+    "set-cookie",
+]);
+/** Pattern that matches header names likely to contain secrets. */
+const SENSITIVE_HEADER_PATTERN = /token|secret|key|password|credential/i;
+/** JSON keys whose values should be redacted in request/response bodies. */
+const SENSITIVE_BODY_KEYS = /("(?:password|access_token|refresh_token|api_key|apiKey|secret|authorization|token|credential|x-api-key)"\s*:\s*)"(?:[^"\\]|\\.)*"/gi;
+/**
+ * Copy headers while removing credential values, including custom
+ * secret-bearing header names.
+ */
+function redactHeaders(headers) {
+    if (!headers) {
+        return headers;
+    }
+    const redacted = {};
+    for (const [key, value] of Object.entries(headers)) {
+        const lower = key.toLowerCase();
+        if (SENSITIVE_HEADER_NAMES.has(lower) ||
+            SENSITIVE_HEADER_PATTERN.test(lower)) {
+            redacted[key] = "[REDACTED]";
+        }
+        else {
+            redacted[key] = value;
+        }
+    }
+    return redacted;
+}
+const SENSITIVE_BODY_KEY = /^(?:password|access_token|refresh_token|api_key|apiKey|secret|authorization|token|credential|x-api-key)$/i;
+/** Redact every value under a sensitive key, including objects and arrays. */
+function redactBody(body) {
+    if (body === undefined || body === null) {
+        return undefined;
+    }
+    let value = body;
+    if (typeof body === "string") {
+        try {
+            value = JSON.parse(body);
+        }
+        catch {
+            // Non-JSON bodies (including SSE transcripts) keep the legacy fallback.
+            return body.replace(SENSITIVE_BODY_KEYS, '$1"[REDACTED]"');
+        }
+    }
+    return JSON.stringify(value, (key, nested) => SENSITIVE_BODY_KEY.test(key) ? "[REDACTED]" : nested);
+}
+/**
+ * Restrict request and phase identifiers to characters safe for artifact
+ * path components.
+ */
+function sanitizePhase(phase) {
+    return phase.replace(/[^a-zA-Z0-9._-]+/g, "_");
+}
+/**
+ * Hash the redacted artifact body so offline reconstruction can verify its
+ * contents.
+ */
+function sha256(value) {
+    return createHash("sha256").update(value).digest("hex");
+}
+/**
+ * Measure persisted UTF-8 bytes rather than JavaScript UTF-16 character
+ * counts.
+ */
+function utf8ByteLength(value) {
+    return Buffer.byteLength(value, "utf8");
+}
+/**
+ * Reserve space for the truncation marker and cut only at a UTF-8 code
+ * point boundary.
+ */
+function truncateUtf8String(input, maxBytes, marker = BODY_TRUNCATION_MARKER) {
+    const inputBytes = utf8ByteLength(input);
+    if (inputBytes <= maxBytes) {
+        return { value: input, bytes: inputBytes, truncated: false };
+    }
+    const markerBytes = utf8ByteLength(marker);
+    if (maxBytes <= markerBytes) {
+        return { value: marker, bytes: markerBytes, truncated: true };
+    }
+    const buffer = Buffer.from(input, "utf8");
+    let end = maxBytes - markerBytes;
+    while (end > 0 && (buffer[end] & 0xc0) === 0x80) {
+        end -= 1;
+    }
+    const value = buffer.subarray(0, end).toString("utf8");
+    const truncatedValue = `${value}${marker}`;
+    return {
+        value: truncatedValue,
+        bytes: utf8ByteLength(truncatedValue),
+        truncated: true,
+    };
+}
+/**
+ * Split redacted text into byte-bounded OTLP chunks without splitting
+ * encoded characters.
+ */
+export function splitUtf8StringByBytes(input, maxBytes) {
+    if (!input) {
+        return [""];
+    }
+    const chunks = [];
+    const buffer = Buffer.from(input, "utf8");
+    for (let start = 0; start < buffer.length;) {
+        let end = Math.min(start + Math.max(4, maxBytes), buffer.length);
+        while (end < buffer.length && (buffer[end] & 0xc0) === 0x80) {
+            end -= 1;
+        }
+        chunks.push(buffer.subarray(start, end).toString("utf8"));
+        start = end;
+    }
+    return chunks;
+}
+/**
+ * Apply structural redaction before enforcing the per-artifact byte
+ * ceiling.
+ */
+function prepareRedactedBody(body) {
+    const redacted = redactBody(body);
+    if (redacted === undefined) {
+        return { truncated: false };
+    }
+    return truncateUtf8String(redacted, MAX_CAPTURED_BODY_BYTES);
+}
+/**
+ * Write a private gzip artifact with a unique name and return its
+ * redacted-body digest.
+ */
+async function writeBodyArtifact(logDir, entry, redactedHeaders, redactedBody, bodyTruncated) {
+    if (redactedBody === undefined) {
+        return {};
+    }
+    const dateStr = new Date(entry.timestamp).toISOString().split("T")[0];
+    const bodyDir = join(logDir, "bodies", dateStr, sanitizePhase(entry.requestId));
+    await mkdir(bodyDir, { recursive: true, mode: 0o700 });
+    await chmod(bodyDir, 0o700);
+    const fileName = `${randomUUID()}-${sanitizePhase(entry.phase)}` +
+        (entry.attempt !== undefined ? `-attempt-${entry.attempt}` : "") +
+        `.json.gz`;
+    const bodyPath = join(bodyDir, fileName);
+    const payload = JSON.stringify({
+        timestamp: entry.timestamp,
+        requestId: entry.requestId,
+        phase: entry.phase,
+        model: entry.model,
+        stream: entry.stream,
+        account: entry.account,
+        accountType: entry.accountType,
+        attempt: entry.attempt,
+        responseStatus: entry.responseStatus,
+        durationMs: entry.durationMs,
+        contentType: entry.contentType,
+        headers: redactedHeaders,
+        body: redactedBody,
+        traceId: entry.traceId,
+        spanId: entry.spanId,
+        metadata: entry.metadata,
+    });
+    const compressed = await gzip(payload);
+    await writeFile(bodyPath, compressed, {
+        mode: 0o600,
+        signal: AbortSignal.timeout(REQUEST_LOG_IO_TIMEOUT_MS),
+    });
+    return {
+        bodyPath,
+        bodySha256: sha256(redactedBody),
+        redactedBodyBytes: utf8ByteLength(redactedBody),
+        storedFileBytes: compressed.byteLength,
+        redactedBody,
+        bodyTruncated,
+    };
+}
+/** Shared pure redaction for replay; serving paths invoke it in the worker. */
+export function prepareProxyBodyForLogging(body) {
+    return prepareRedactedBody(body);
+}
+/**
+ * Expose the same header-redaction policy to replay and metadata
+ * consumers.
+ */
+export function redactProxyHeadersForLogging(headers) {
+    return redactHeaders(headers);
+}
+/**
+ * Process a capture in the worker and retain redacted output when artifact
+ * persistence fails.
+ */
+export async function processProxyBodyCapture(entry, logDir) {
+    const headers = redactHeaders(entry.headers);
+    const prepared = prepareRedactedBody(entry.body);
+    let stored;
+    try {
+        stored = await writeBodyArtifact(logDir, entry, headers, prepared.value, prepared.truncated);
+    }
+    catch {
+        stored = {
+            redactedBody: prepared.value,
+            redactedBodyBytes: prepared.bytes,
+            bodyTruncated: prepared.truncated,
+            bodyWriteFailed: true,
+        };
+    }
+    return { headers, stored };
+}

package/dist/proxy/bodyCaptureWorker.d.ts

@@ -0,0 +1,16 @@
+import type { ProcessedProxyBodyCapture, ProxyBodyCaptureEntry, ProxyBodyCaptureWorkerSnapshot } from "../types/index.js";
+export declare const PROXY_BODY_CAPTURE_DEADLINE_MS = 20000;
+/** Bounded bulk capture. Failures are indexed; never fall back to blocking work. */
+export declare function captureProxyBody(entry: ProxyBodyCaptureEntry, logDir: string, consume: (result: ProcessedProxyBodyCapture) => Promise<void>): Promise<void>;
+/**
+ * Return independent counters for processing, rejection, failure, and
+ * retained publication work.
+ */
+export declare function getBodyCaptureWorkerSnapshot(): ProxyBodyCaptureWorkerSnapshot;
+/** Isolated tests point at a separately executed built worker. */
+export declare const __bodyCaptureWorkerTestHooks: {
+    /**
+     * Reset an isolated worker after capture publications drain, optionally selecting a fixture entry.
+     */
+    reset(url?: URL): Promise<void>;
+};

package/dist/proxy/bodyCaptureWorker.js

@@ -0,0 +1,232 @@
+import { Worker } from "node:worker_threads";
+const MAX_PENDING = 16;
+const MAX_PENDING_BYTES = 32 * 1024 * 1024;
+const MAX_ENTRY_BYTES = 8 * 1024 * 1024;
+export const PROXY_BODY_CAPTURE_DEADLINE_MS = 20_000;
+let worker;
+let workerUrl;
+let retryAfter = 0;
+let nextId = 0;
+const snapshot = {
+    attempted: 0,
+    completed: 0,
+    rejected: 0,
+    failed: 0,
+    pending: 0,
+    pendingBytes: 0,
+    maxPending: MAX_PENDING,
+    maxPendingBytes: MAX_PENDING_BYTES,
+};
+const pending = new Map();
+// Bound traversal as well as the structured clone sent to the worker. Never
+// invoke getters/toJSON or stringify a large body on the serving event loop.
+/**
+ * Conservatively bound clone size and traversal work without invoking
+ * getters or serializers.
+ */
+function estimateCloneBytes(value) {
+    const stack = [value];
+    const seen = new Set();
+    let bytes = 0, nodes = 0;
+    while (stack.length) {
+        if (++nodes > 100_000 || bytes > MAX_ENTRY_BYTES) {
+            return Infinity;
+        }
+        const item = stack.pop();
+        if (typeof item === "string") {
+            bytes += item.length * 3;
+            continue;
+        }
+        bytes += 16;
+        if (!item || typeof item !== "object") {
+            continue;
+        }
+        if (seen.has(item)) {
+            return Infinity;
+        }
+        seen.add(item);
+        if (!Array.isArray(item) &&
+            Object.getPrototypeOf(item) !== Object.prototype &&
+            Object.getPrototypeOf(item) !== null) {
+            return Infinity;
+        }
+        for (const key of Object.keys(item)) {
+            bytes += key.length * 3;
+            const descriptor = Object.getOwnPropertyDescriptor(item, key);
+            if (!descriptor || descriptor.get || descriptor.set) {
+                return Infinity;
+            }
+            stack.push(descriptor.value);
+            if (stack.length > 100_000 || bytes > MAX_ENTRY_BYTES) {
+                return Infinity;
+            }
+        }
+    }
+    return bytes;
+}
+/**
+ * Settle IPC ownership once while publication retains the capture memory
+ * lease.
+ */
+function settle(id, result) {
+    const task = pending.get(id);
+    if (!task) {
+        return;
+    }
+    pending.delete(id);
+    clearTimeout(task.timer);
+    task.resolve(result);
+    if (!pending.size) {
+        worker?.unref();
+    }
+}
+/**
+ * Fail every pending capture explicitly and back off without moving bulk
+ * work to the caller.
+ */
+function failWorker(current, reason) {
+    if (worker !== current) {
+        return;
+    }
+    worker = undefined;
+    retryAfter = Date.now() + 5_000;
+    for (const id of pending.keys()) {
+        settle(id, {
+            error: reason,
+            stored: { bodyWriteFailed: true },
+        });
+    }
+    void current.terminate().catch(() => undefined);
+}
+/**
+ * Lazily create the bounded worker; only admitted processing keeps it
+ * referenced.
+ */
+function getWorker() {
+    if (worker) {
+        return worker;
+    }
+    const current = new Worker(workerUrl ?? new URL("./bodyCaptureWorkerEntry.js", import.meta.url), {
+        execArgv: process.execArgv.filter((arg) => !arg.startsWith("--input-type")),
+        resourceLimits: { maxOldGenerationSizeMb: 128 },
+    });
+    worker = current;
+    current.on("message", (message) => {
+        if (worker === current) {
+            settle(message.id, message.result);
+        }
+    });
+    current.on("error", () => failWorker(current, "body_worker_error"));
+    current.on("exit", () => failWorker(current, "body_worker_exit"));
+    current.unref();
+    return current;
+}
+/** Bounded bulk capture. Failures are indexed; never fall back to blocking work. */
+export async function captureProxyBody(entry, logDir, consume) {
+    snapshot.attempted += 1;
+    let bytes;
+    try {
+        bytes = estimateCloneBytes(entry);
+    }
+    catch {
+        bytes = Infinity;
+    }
+    if (bytes > MAX_ENTRY_BYTES ||
+        snapshot.pending >= MAX_PENDING ||
+        snapshot.pendingBytes + bytes > MAX_PENDING_BYTES ||
+        Date.now() < retryAfter) {
+        snapshot.rejected += 1;
+        const error = bytes > MAX_ENTRY_BYTES
+            ? "body_capture_too_large_or_non_json"
+            : Date.now() < retryAfter
+                ? "body_worker_backoff"
+                : "body_capture_queue_full";
+        snapshot.lastError = error;
+        return consume({ error, stored: { bodyWriteFailed: true } });
+    }
+    let current;
+    try {
+        current = getWorker();
+    }
+    catch {
+        snapshot.failed += 1;
+        retryAfter = Date.now() + 5_000;
+        return consume({
+            error: "body_worker_start_failed",
+            stored: { bodyWriteFailed: true },
+        });
+    }
+    const id = ++nextId;
+    return new Promise((resolve) => {
+        const timer = setTimeout(() => failWorker(current, "body_worker_timeout"), PROXY_BODY_CAPTURE_DEADLINE_MS);
+        timer.unref();
+        pending.set(id, {
+            timer,
+            resolve: (result) => {
+                // Keep the byte/count lease through index writes and OTLP publication,
+                // so completed worker results cannot form an unbounded parent backlog.
+                void consume(result)
+                    .catch(() => {
+                    result.error ??= "body_capture_publication_failed";
+                })
+                    .finally(() => {
+                    snapshot.pending -= 1;
+                    snapshot.pendingBytes -= bytes;
+                    if (result.error || result.stored.bodyWriteFailed) {
+                        snapshot.failed += 1;
+                    }
+                    else {
+                        snapshot.completed += 1;
+                    }
+                    if (result.error) {
+                        snapshot.lastError = result.error;
+                    }
+                    resolve();
+                });
+            },
+        });
+        snapshot.pending += 1;
+        snapshot.pendingBytes += bytes;
+        current.ref();
+        try {
+            current.postMessage({ id, entry, logDir, queuedAt: Date.now() });
+        }
+        catch {
+            settle(id, {
+                error: "body_capture_clone_failed",
+                stored: { bodyWriteFailed: true },
+            });
+        }
+    });
+}
+/**
+ * Return independent counters for processing, rejection, failure, and
+ * retained publication work.
+ */
+export function getBodyCaptureWorkerSnapshot() {
+    return { ...snapshot };
+}
+/** Isolated tests point at a separately executed built worker. */
+export const __bodyCaptureWorkerTestHooks = {
+    /**
+     * Reset an isolated worker after capture publications drain, optionally selecting a fixture entry.
+     */
+    async reset(url) {
+        if (worker) {
+            const current = worker;
+            failWorker(current, "body_worker_test_reset");
+            await current.terminate();
+        }
+        workerUrl = url;
+        retryAfter = 0;
+        Object.assign(snapshot, {
+            attempted: 0,
+            completed: 0,
+            rejected: 0,
+            failed: 0,
+            pending: 0,
+            pendingBytes: 0,
+            lastError: undefined,
+        });
+    },
+};

package/dist/proxy/bodyCaptureWorkerEntry.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/proxy/bodyCaptureWorkerEntry.js

@@ -0,0 +1,34 @@
+import { parentPort } from "node:worker_threads";
+import { performance } from "node:perf_hooks";
+import { processProxyBodyCapture } from "./bodyCaptureProcessing.js";
+// Sequential processing bounds serialization/compression memory. The parent
+// bounds both the queued record count and clone bytes, including in-flight work.
+let tail = Promise.resolve();
+parentPort?.on("message", (message) => {
+    tail = tail.then(async () => {
+        const started = performance.now();
+        const queueWaitMs = Math.max(0, Date.now() - message.queuedAt);
+        try {
+            const result = await processProxyBodyCapture(message.entry, message.logDir);
+            parentPort?.postMessage({
+                id: message.id,
+                result: {
+                    ...result,
+                    queueWaitMs,
+                    processingMs: performance.now() - started,
+                },
+            });
+        }
+        catch {
+            parentPort?.postMessage({
+                id: message.id,
+                result: {
+                    error: "body_capture_processing_failed",
+                    stored: { bodyWriteFailed: true },
+                    queueWaitMs,
+                    processingMs: performance.now() - started,
+                },
+            });
+        }
+    });
+});