@nowo-tech/beacon-express 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 nowo-tech
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,3 +1,34 @@
-# Temporary Holding Version
+# @nowo-tech/beacon-express
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Beacon middleware for Express 4.18+ and 5. `express` is a required peer dependency.
+
+```sh
+pnpm add @nowo-tech/beacon-node @nowo-tech/beacon-express
+```
+
+```ts
+import express from 'express';
+import * as Beacon from '@nowo-tech/beacon-node';
+import { beaconErrorHandler, beaconRequestHandler } from '@nowo-tech/beacon-express';
+
+Beacon.init({ dsn: process.env.BEACON_DSN!, release: 'api@1.4.2' });
+
+const app = express();
+app.use(beaconRequestHandler()); // first: one isolated scope per request
+// … routes …
+app.use(beaconErrorHandler()); // after the routes: captures, then calls next(err)
+```
+
+- `beaconRequestHandler({ includeBody?, allowHeaders? })`: forks the scope for the request (breadcrumbs, user and
+  tags never leak between requests) and records the method, the scrubbed URL and an **allow-list** of headers:
+  `accept`, `accept-encoding`, `accept-language`, `content-length`, `content-type`, `referer` (without its query)
+  and `user-agent`, plus the names in `allowHeaders`. Client-address headers (`*forwarded*`, `*client-ip*`,
+  `*real-ip*`, `cf-*`, `fastly-*`, `x-vercel-*`, `true-client-ip`, …), cookies, `Authorization` and other credential
+  headers are never recorded, even when listed or with `sendDefaultPii`.
+- The body is recorded only with `includeBody: true`. JSON and form bodies are parsed, their keys scrubbed and their
+  values credential-masked **before** any size check; a body over 10 kB becomes `"[truncated]"`, and one that
+  cannot be parsed becomes `"[unparsed]"`. Raw text is never sent.
+- Both handlers swallow their own failures: the app's request and error always go on unchanged.
+- `beaconErrorHandler({ shouldHandleError? })`: captures errors without a status or with a status of 500 or more
+  (mechanism `express`, `handled: false`), adds the route (`request.route`, tag `route`), stores the event id in
+  `res.locals.beaconEventId`, and calls `next(err)`. Async handler rejections reach it natively in Express 5.

package/dist/.build-stamp

@@ -0,0 +1 @@
+@nowo-tech/beacon-express@0.1.0

package/dist/index.cjs

@@ -0,0 +1,172 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  BODY_TRUNCATED: () => BODY_TRUNCATED,
+  BODY_UNPARSED: () => BODY_UNPARSED,
+  DEFAULT_ALLOWED_HEADERS: () => DEFAULT_ALLOWED_HEADERS,
+  beaconErrorHandler: () => beaconErrorHandler,
+  beaconRequestHandler: () => beaconRequestHandler,
+  bodyOf: () => bodyOf,
+  defaultShouldHandleError: () => defaultShouldHandleError,
+  requestDataOf: () => requestDataOf
+});
+module.exports = __toCommonJS(index_exports);
+var import_beacon_node = require("@nowo-tech/beacon-node");
+var MAX_BODY_BYTES = 10 * 1024;
+var DEFAULT_ALLOWED_HEADERS = [
+  "accept",
+  "accept-encoding",
+  "accept-language",
+  "content-length",
+  "content-type",
+  "referer",
+  "user-agent"
+];
+var NEVER_HEADERS = /cookie|authorization|^x-beacon-auth$|api-?key|token|secret|session|csrf|xsrf|password|credential/i;
+function isNeverRecorded(name) {
+  return (0, import_beacon_node.isClientAddressHeader)(name) || NEVER_HEADERS.test(name);
+}
+var BODY_TRUNCATED = "[truncated]";
+var BODY_UNPARSED = "[unparsed]";
+function headersOf(req, allowHeaders) {
+  const allowed = /* @__PURE__ */ new Set([
+    ...DEFAULT_ALLOWED_HEADERS,
+    ...allowHeaders.map((name) => name.toLowerCase())
+  ]);
+  const out = {};
+  for (const [name, value] of Object.entries(req.headers)) {
+    const lower = name.toLowerCase();
+    if (value === void 0 || !allowed.has(lower) || isNeverRecorded(name)) continue;
+    const text = Array.isArray(value) ? value.join(", ") : value;
+    out[name] = lower === "referer" ? (0, import_beacon_node.scrubUrl)(text).replace(/\?.*$/, "") : text;
+  }
+  return out;
+}
+function parsedBody(body, contentType) {
+  if (typeof body !== "string" && !(body instanceof Uint8Array)) return body;
+  const text = typeof body === "string" ? body : new TextDecoder().decode(body);
+  if (/json/i.test(contentType)) return JSON.parse(text);
+  if (/x-www-form-urlencoded/i.test(contentType))
+    return Object.fromEntries(new URLSearchParams(text));
+  throw new Error("unsupported body");
+}
+function bodyOf(body, contentType = "") {
+  if (body === void 0) return void 0;
+  let value;
+  try {
+    value = parsedBody(body, contentType);
+  } catch {
+    return BODY_UNPARSED;
+  }
+  const scrubbed = maskValues((0, import_beacon_node.scrubObject)(value, MASK_DEPTH));
+  const normalized = (0, import_beacon_node.normalize)(scrubbed, {
+    depth: 5,
+    maxKeys: 100,
+    maxArray: 100,
+    maxString: MAX_BODY_BYTES
+  });
+  return JSON.stringify(normalized).length > MAX_BODY_BYTES ? BODY_TRUNCATED : normalized;
+}
+var MASK_DEPTH = 20;
+function maskValues(value, depth = MASK_DEPTH) {
+  if (typeof value === "string") return (0, import_beacon_node.maskCredentials)(value);
+  if (!value || typeof value !== "object") return value;
+  if (depth <= 0) return "[Filtered]";
+  if (Array.isArray(value)) return value.map((item) => maskValues(item, depth - 1));
+  return Object.fromEntries(
+    Object.entries(value).map(([key, item]) => [key, maskValues(item, depth - 1)])
+  );
+}
+function requestDataOf(req, options = {}) {
+  const data = {
+    method: req.method,
+    url: (0, import_beacon_node.scrubUrl)(`${req.protocol}://${req.get("host") ?? "localhost"}${req.originalUrl}`),
+    headers: headersOf(req, options.allowHeaders ?? [])
+  };
+  if (options.includeBody) {
+    const body = bodyOf(req.body, String(req.get("content-type") ?? ""));
+    if (body !== void 0) data.data = body;
+  }
+  return data;
+}
+function beaconRequestHandler(options = {}) {
+  return function beaconRequestHandler2(req, _res, next) {
+    let request;
+    try {
+      request = requestDataOf(req, options);
+    } catch {
+      request = void 0;
+    }
+    (0, import_beacon_node.withScope)((scope) => {
+      if (request) scope.request = request;
+      next();
+    });
+  };
+}
+function statusOf(error) {
+  if (typeof error !== "object" || error === null) return void 0;
+  const candidate = error;
+  const status = candidate.status ?? candidate.statusCode ?? candidate.output?.statusCode;
+  const number = Number(status);
+  return status === void 0 || !Number.isFinite(number) ? void 0 : number;
+}
+function defaultShouldHandleError(error) {
+  const status = statusOf(error);
+  return status === void 0 || status >= 500;
+}
+function beaconErrorHandler(options = {}) {
+  const shouldHandle = options.shouldHandleError ?? defaultShouldHandleError;
+  return function beaconErrorHandler2(error, req, res, next) {
+    try {
+      const client = (0, import_beacon_node.getClient)();
+      if (client && shouldHandle(error)) {
+        const scope = (0, import_beacon_node.getCurrentScope)().clone();
+        const request = { ...scope.request ?? requestDataOf(req) };
+        const route = req.route?.path;
+        if (typeof route === "string") {
+          request["route"] = route;
+          scope.setTag("route", `${req.method} ${route}`);
+        }
+        scope.request = request;
+        const eventId = client.captureException(error, scope, void 0, {
+          mechanism: { type: "express", handled: false },
+          logger: "express"
+        });
+        res.locals["beaconEventId"] = eventId;
+      }
+    } catch {
+    }
+    next(error);
+  };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  BODY_TRUNCATED,
+  BODY_UNPARSED,
+  DEFAULT_ALLOWED_HEADERS,
+  beaconErrorHandler,
+  beaconRequestHandler,
+  bodyOf,
+  defaultShouldHandleError,
+  requestDataOf
+});
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/index.ts"],
+  "sourcesContent": ["import {\n  getClient,\n  getCurrentScope,\n  isClientAddressHeader,\n  maskCredentials,\n  normalize,\n  scrubObject,\n  scrubUrl,\n  withScope,\n  type RequestData,\n} from '@nowo-tech/beacon-node';\nimport type { ErrorRequestHandler, Request, RequestHandler } from 'express';\n\nexport interface RequestHandlerOptions {\n  /** Attach `req.body` (keys scrubbed; dropped when unparsable or over 10 kB). Default false. */\n  includeBody?: boolean;\n  /**\n   * Extra request headers to record, on top of the default allow-list. Client-address, cookie and authorization\n   * headers are never recorded, even when listed here.\n   */\n  allowHeaders?: string[];\n}\n\nexport interface ErrorHandlerOptions {\n  /** Default: errors without a status, and statuses of 500 or more. */\n  shouldHandleError?: (error: unknown) => boolean;\n}\n\nconst MAX_BODY_BYTES = 10 * 1024;\n\n/** The request headers recorded by default (contract \u00A75, allow-list). */\nexport const DEFAULT_ALLOWED_HEADERS: readonly string[] = [\n  'accept',\n  'accept-encoding',\n  'accept-language',\n  'content-length',\n  'content-type',\n  'referer',\n  'user-agent',\n];\n\n/** Never recorded, whatever the allow-list says: client addresses, cookies and credentials. */\nconst NEVER_HEADERS =\n  /cookie|authorization|^x-beacon-auth$|api-?key|token|secret|session|csrf|xsrf|password|credential/i;\n\n/** Client-address headers (FVD-L1) and credential headers are never recorded, even when opted in. */\nfunction isNeverRecorded(name: string): boolean {\n  return isClientAddressHeader(name) || NEVER_HEADERS.test(name);\n}\n\nexport const BODY_TRUNCATED = '[truncated]';\nexport const BODY_UNPARSED = '[unparsed]';\n\nfunction headersOf(req: Request, allowHeaders: readonly string[]): Record<string, string> {\n  const allowed = new Set([\n    ...DEFAULT_ALLOWED_HEADERS,\n    ...allowHeaders.map((name) => name.toLowerCase()),\n  ]);\n  const out: Record<string, string> = {};\n  for (const [name, value] of Object.entries(req.headers)) {\n    const lower = name.toLowerCase();\n    if (value === undefined || !allowed.has(lower) || isNeverRecorded(name)) continue;\n    const text = Array.isArray(value) ? value.join(', ') : value;\n    // The referer is another page's URL: its query string and fragment are never kept.\n    out[name] = lower === 'referer' ? scrubUrl(text).replace(/\\?.*$/, '') : text;\n  }\n  return out;\n}\n\n/** Parses JSON and form bodies that arrive as text, so that their keys can be scrubbed. */\nfunction parsedBody(body: unknown, contentType: string): unknown {\n  if (typeof body !== 'string' && !(body instanceof Uint8Array)) return body;\n  const text = typeof body === 'string' ? body : new TextDecoder().decode(body);\n  if (/json/i.test(contentType)) return JSON.parse(text) as unknown;\n  if (/x-www-form-urlencoded/i.test(contentType))\n    return Object.fromEntries(new URLSearchParams(text));\n  throw new Error('unsupported body');\n}\n\n/**\n * The request body for the event (FV-M1): parsed, keys scrubbed **before** anything is cut, string values\n * credential-masked, and then either kept whole (\u2264 10 kB) or replaced by `[truncated]`. Raw text is never sent:\n * a body that cannot be parsed becomes `[unparsed]`.\n */\nexport function bodyOf(body: unknown, contentType = ''): unknown {\n  if (body === undefined) return undefined;\n  let value: unknown;\n  try {\n    value = parsedBody(body, contentType);\n  } catch {\n    return BODY_UNPARSED;\n  }\n  const scrubbed = maskValues(scrubObject(value, MASK_DEPTH));\n  const normalized = normalize(scrubbed, {\n    depth: 5,\n    maxKeys: 100,\n    maxArray: 100,\n    maxString: MAX_BODY_BYTES,\n  });\n  return JSON.stringify(normalized).length > MAX_BODY_BYTES ? BODY_TRUNCATED : normalized;\n}\n\nconst MASK_DEPTH = 20;\n\n/**\n * Masks credential-looking strings, at most {@link MASK_DEPTH} levels deep (FVD-I2). Card numbers sent as numbers\n * are already masked by `scrubObject`.\n */\nfunction maskValues(value: unknown, depth = MASK_DEPTH): unknown {\n  if (typeof value === 'string') return maskCredentials(value);\n  if (!value || typeof value !== 'object') return value;\n  // Deeper (or cyclic) structures are not walked: they are cut here instead of throwing.\n  if (depth <= 0) return '[Filtered]';\n  if (Array.isArray(value)) return value.map((item) => maskValues(item, depth - 1));\n  return Object.fromEntries(\n    Object.entries(value).map(([key, item]) => [key, maskValues(item, depth - 1)]),\n  );\n}\n\n/** Request data for the event (contract \u00A78.2): method, scrubbed URL, allow-listed headers, never cookies. */\nexport function requestDataOf(req: Request, options: RequestHandlerOptions = {}): RequestData {\n  const data: RequestData = {\n    method: req.method,\n    url: scrubUrl(`${req.protocol}://${req.get('host') ?? 'localhost'}${req.originalUrl}`),\n    headers: headersOf(req, options.allowHeaders ?? []),\n  };\n  if (options.includeBody) {\n    const body = bodyOf(req.body as unknown, String(req.get('content-type') ?? ''));\n    if (body !== undefined) data.data = body;\n  }\n  return data;\n}\n\n/** Install first: an isolated scope per request, with the request context. */\nexport function beaconRequestHandler(options: RequestHandlerOptions = {}): RequestHandler {\n  return function beaconRequestHandler(req, _res, next) {\n    let request: RequestData | undefined;\n    try {\n      request = requestDataOf(req, options);\n    } catch {\n      // The SDK never changes the app's behaviour: without request data, the request still goes on.\n      request = undefined;\n    }\n    withScope((scope) => {\n      if (request) scope.request = request;\n      next();\n    });\n  };\n}\n\nfunction statusOf(error: unknown): number | undefined {\n  if (typeof error !== 'object' || error === null) return undefined;\n  const candidate = error as {\n    status?: unknown;\n    statusCode?: unknown;\n    output?: { statusCode?: unknown };\n  };\n  const status = candidate.status ?? candidate.statusCode ?? candidate.output?.statusCode;\n  const number = Number(status);\n  return status === undefined || !Number.isFinite(number) ? undefined : number;\n}\n\n/** The default filter: errors without a status, and statuses of 500 or more. */\nexport function defaultShouldHandleError(error: unknown): boolean {\n  const status = statusOf(error);\n  return status === undefined || status >= 500;\n}\n\n/**\n * Install after the routes: captures the error (mechanism `express`, unhandled) with the route, then calls\n * `next(err)` so that Express (or the app's own error handler) still answers. Works with Express 4 and 5.\n */\nexport function beaconErrorHandler(options: ErrorHandlerOptions = {}): ErrorRequestHandler {\n  const shouldHandle = options.shouldHandleError ?? defaultShouldHandleError;\n  return function beaconErrorHandler(error, req, res, next) {\n    try {\n      const client = getClient();\n      if (client && shouldHandle(error)) {\n        const scope = getCurrentScope().clone();\n        const request = { ...(scope.request ?? requestDataOf(req)) };\n        const route = (req.route as { path?: unknown } | undefined)?.path;\n        if (typeof route === 'string') {\n          request['route'] = route;\n          scope.setTag('route', `${req.method} ${route}`);\n        }\n        scope.request = request;\n        const eventId = client.captureException(error, scope, undefined, {\n          mechanism: { type: 'express', handled: false },\n          logger: 'express',\n        });\n        (res.locals as Record<string, unknown>)['beaconEventId'] = eventId;\n      }\n    } catch {\n      // Whatever happens in the SDK, the app's own error goes on unchanged.\n    }\n    next(error);\n  };\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,yBAUO;AAkBP,IAAM,iBAAiB,KAAK;AAGrB,IAAM,0BAA6C;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGA,IAAM,gBACJ;AAGF,SAAS,gBAAgB,MAAuB;AAC9C,aAAO,0CAAsB,IAAI,KAAK,cAAc,KAAK,IAAI;AAC/D;AAEO,IAAM,iBAAiB;AACvB,IAAM,gBAAgB;AAE7B,SAAS,UAAU,KAAc,cAAyD;AACxF,QAAM,UAAU,oBAAI,IAAI;AAAA,IACtB,GAAG;AAAA,IACH,GAAG,aAAa,IAAI,CAAC,SAAS,KAAK,YAAY,CAAC;AAAA,EAClD,CAAC;AACD,QAAM,MAA8B,CAAC;AACrC,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AACvD,UAAM,QAAQ,KAAK,YAAY;AAC/B,QAAI,UAAU,UAAa,CAAC,QAAQ,IAAI,KAAK,KAAK,gBAAgB,IAAI,EAAG;AACzE,UAAM,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI;AAEvD,QAAI,IAAI,IAAI,UAAU,gBAAY,6BAAS,IAAI,EAAE,QAAQ,SAAS,EAAE,IAAI;AAAA,EAC1E;AACA,SAAO;AACT;AAGA,SAAS,WAAW,MAAe,aAA8B;AAC/D,MAAI,OAAO,SAAS,YAAY,EAAE,gBAAgB,YAAa,QAAO;AACtE,QAAM,OAAO,OAAO,SAAS,WAAW,OAAO,IAAI,YAAY,EAAE,OAAO,IAAI;AAC5E,MAAI,QAAQ,KAAK,WAAW,EAAG,QAAO,KAAK,MAAM,IAAI;AACrD,MAAI,yBAAyB,KAAK,WAAW;AAC3C,WAAO,OAAO,YAAY,IAAI,gBAAgB,IAAI,CAAC;AACrD,QAAM,IAAI,MAAM,kBAAkB;AACpC;AAOO,SAAS,OAAO,MAAe,cAAc,IAAa;AAC/D,MAAI,SAAS,OAAW,QAAO;AAC/B,MAAI;AACJ,MAAI;AACF,YAAQ,WAAW,MAAM,WAAW;AAAA,EACtC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,WAAW,eAAW,gCAAY,OAAO,UAAU,CAAC;AAC1D,QAAM,iBAAa,8BAAU,UAAU;AAAA,IACrC,OAAO;AAAA,IACP,SAAS;AAAA,IACT,UAAU;AAAA,IACV,WAAW;AAAA,EACb,CAAC;AACD,SAAO,KAAK,UAAU,UAAU,EAAE,SAAS,iBAAiB,iBAAiB;AAC/E;AAEA,IAAM,aAAa;AAMnB,SAAS,WAAW,OAAgB,QAAQ,YAAqB;AAC/D,MAAI,OAAO,UAAU,SAAU,YAAO,oCAAgB,KAAK;AAC3D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAEhD,MAAI,SAAS,EAAG,QAAO;AACvB,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,WAAW,MAAM,QAAQ,CAAC,CAAC;AAChF,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,WAAW,MAAM,QAAQ,CAAC,CAAC,CAAC;AAAA,EAC/E;AACF;AAGO,SAAS,cAAc,KAAc,UAAiC,CAAC,GAAgB;AAC5F,QAAM,OAAoB;AAAA,IACxB,QAAQ,IAAI;AAAA,IACZ,SAAK,6BAAS,GAAG,IAAI,QAAQ,MAAM,IAAI,IAAI,MAAM,KAAK,WAAW,GAAG,IAAI,WAAW,EAAE;AAAA,IACrF,SAAS,UAAU,KAAK,QAAQ,gBAAgB,CAAC,CAAC;AAAA,EACpD;AACA,MAAI,QAAQ,aAAa;AACvB,UAAM,OAAO,OAAO,IAAI,MAAiB,OAAO,IAAI,IAAI,cAAc,KAAK,EAAE,CAAC;AAC9E,QAAI,SAAS,OAAW,MAAK,OAAO;AAAA,EACtC;AACA,SAAO;AACT;AAGO,SAAS,qBAAqB,UAAiC,CAAC,GAAmB;AACxF,SAAO,SAASA,sBAAqB,KAAK,MAAM,MAAM;AACpD,QAAI;AACJ,QAAI;AACF,gBAAU,cAAc,KAAK,OAAO;AAAA,IACtC,QAAQ;AAEN,gBAAU;AAAA,IACZ;AACA,sCAAU,CAAC,UAAU;AACnB,UAAI,QAAS,OAAM,UAAU;AAC7B,WAAK;AAAA,IACP,CAAC;AAAA,EACH;AACF;AAEA,SAAS,SAAS,OAAoC;AACpD,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,YAAY;AAKlB,QAAM,SAAS,UAAU,UAAU,UAAU,cAAc,UAAU,QAAQ;AAC7E,QAAM,SAAS,OAAO,MAAM;AAC5B,SAAO,WAAW,UAAa,CAAC,OAAO,SAAS,MAAM,IAAI,SAAY;AACxE;AAGO,SAAS,yBAAyB,OAAyB;AAChE,QAAM,SAAS,SAAS,KAAK;AAC7B,SAAO,WAAW,UAAa,UAAU;AAC3C;AAMO,SAAS,mBAAmB,UAA+B,CAAC,GAAwB;AACzF,QAAM,eAAe,QAAQ,qBAAqB;AAClD,SAAO,SAASC,oBAAmB,OAAO,KAAK,KAAK,MAAM;AACxD,QAAI;AACF,YAAM,aAAS,8BAAU;AACzB,UAAI,UAAU,aAAa,KAAK,GAAG;AACjC,cAAM,YAAQ,oCAAgB,EAAE,MAAM;AACtC,cAAM,UAAU,EAAE,GAAI,MAAM,WAAW,cAAc,GAAG,EAAG;AAC3D,cAAM,QAAS,IAAI,OAA0C;AAC7D,YAAI,OAAO,UAAU,UAAU;AAC7B,kBAAQ,OAAO,IAAI;AACnB,gBAAM,OAAO,SAAS,GAAG,IAAI,MAAM,IAAI,KAAK,EAAE;AAAA,QAChD;AACA,cAAM,UAAU;AAChB,cAAM,UAAU,OAAO,iBAAiB,OAAO,OAAO,QAAW;AAAA,UAC/D,WAAW,EAAE,MAAM,WAAW,SAAS,MAAM;AAAA,UAC7C,QAAQ;AAAA,QACV,CAAC;AACD,QAAC,IAAI,OAAmC,eAAe,IAAI;AAAA,MAC7D;AAAA,IACF,QAAQ;AAAA,IAER;AACA,SAAK,KAAK;AAAA,EACZ;AACF;",
+  "names": ["beaconRequestHandler", "beaconErrorHandler"]
+}

package/dist/index.d.cts

@@ -0,0 +1,50 @@
+import type { ErrorRequestHandler } from 'express';
+import type { Request as Request_2 } from 'express';
+import { RequestData } from '@nowo-tech/beacon-node';
+import type { RequestHandler } from 'express';
+
+/**
+ * Install after the routes: captures the error (mechanism `express`, unhandled) with the route, then calls
+ * `next(err)` so that Express (or the app's own error handler) still answers. Works with Express 4 and 5.
+ */
+export declare function beaconErrorHandler(options?: ErrorHandlerOptions): ErrorRequestHandler;
+
+/** Install first: an isolated scope per request, with the request context. */
+export declare function beaconRequestHandler(options?: RequestHandlerOptions): RequestHandler;
+
+export declare const BODY_TRUNCATED = "[truncated]";
+
+export declare const BODY_UNPARSED = "[unparsed]";
+
+/**
+ * The request body for the event (FV-M1): parsed, keys scrubbed **before** anything is cut, string values
+ * credential-masked, and then either kept whole (≤ 10 kB) or replaced by `[truncated]`. Raw text is never sent:
+ * a body that cannot be parsed becomes `[unparsed]`.
+ */
+export declare function bodyOf(body: unknown, contentType?: string): unknown;
+
+/** The request headers recorded by default (contract §5, allow-list). */
+export declare const DEFAULT_ALLOWED_HEADERS: readonly string[];
+
+/** The default filter: errors without a status, and statuses of 500 or more. */
+export declare function defaultShouldHandleError(error: unknown): boolean;
+
+export declare interface ErrorHandlerOptions {
+    /** Default: errors without a status, and statuses of 500 or more. */
+    shouldHandleError?: (error: unknown) => boolean;
+}
+
+/** Request data for the event (contract §8.2): method, scrubbed URL, allow-listed headers, never cookies. */
+export declare function requestDataOf(req: Request_2, options?: RequestHandlerOptions): RequestData;
+
+export declare interface RequestHandlerOptions {
+    /** Attach `req.body` (keys scrubbed; dropped when unparsable or over 10 kB). Default false. */
+    includeBody?: boolean;
+    /**
+     * Extra request headers to record, on top of the default allow-list. Client-address, cookie and authorization
+     * headers are never recorded, even when listed here.
+     */
+    allowHeaders?: string[];
+}
+
+export { }

package/dist/index.d.ts

@@ -0,0 +1,50 @@
+import type { ErrorRequestHandler } from 'express';
+import type { Request as Request_2 } from 'express';
+import { RequestData } from '@nowo-tech/beacon-node';
+import type { RequestHandler } from 'express';
+
+/**
+ * Install after the routes: captures the error (mechanism `express`, unhandled) with the route, then calls
+ * `next(err)` so that Express (or the app's own error handler) still answers. Works with Express 4 and 5.
+ */
+export declare function beaconErrorHandler(options?: ErrorHandlerOptions): ErrorRequestHandler;
+
+/** Install first: an isolated scope per request, with the request context. */
+export declare function beaconRequestHandler(options?: RequestHandlerOptions): RequestHandler;
+
+export declare const BODY_TRUNCATED = "[truncated]";
+
+export declare const BODY_UNPARSED = "[unparsed]";
+
+/**
+ * The request body for the event (FV-M1): parsed, keys scrubbed **before** anything is cut, string values
+ * credential-masked, and then either kept whole (≤ 10 kB) or replaced by `[truncated]`. Raw text is never sent:
+ * a body that cannot be parsed becomes `[unparsed]`.
+ */
+export declare function bodyOf(body: unknown, contentType?: string): unknown;
+
+/** The request headers recorded by default (contract §5, allow-list). */
+export declare const DEFAULT_ALLOWED_HEADERS: readonly string[];
+
+/** The default filter: errors without a status, and statuses of 500 or more. */
+export declare function defaultShouldHandleError(error: unknown): boolean;
+
+export declare interface ErrorHandlerOptions {
+    /** Default: errors without a status, and statuses of 500 or more. */
+    shouldHandleError?: (error: unknown) => boolean;
+}
+
+/** Request data for the event (contract §8.2): method, scrubbed URL, allow-listed headers, never cookies. */
+export declare function requestDataOf(req: Request_2, options?: RequestHandlerOptions): RequestData;
+
+export declare interface RequestHandlerOptions {
+    /** Attach `req.body` (keys scrubbed; dropped when unparsable or over 10 kB). Default false. */
+    includeBody?: boolean;
+    /**
+     * Extra request headers to record, on top of the default allow-list. Client-address, cookie and authorization
+     * headers are never recorded, even when listed here.
+     */
+    allowHeaders?: string[];
+}
+
+export { }

package/dist/index.mjs

@@ -0,0 +1,149 @@
+// src/index.ts
+import {
+  getClient,
+  getCurrentScope,
+  isClientAddressHeader,
+  maskCredentials,
+  normalize,
+  scrubObject,
+  scrubUrl,
+  withScope
+} from "@nowo-tech/beacon-node";
+var MAX_BODY_BYTES = 10 * 1024;
+var DEFAULT_ALLOWED_HEADERS = [
+  "accept",
+  "accept-encoding",
+  "accept-language",
+  "content-length",
+  "content-type",
+  "referer",
+  "user-agent"
+];
+var NEVER_HEADERS = /cookie|authorization|^x-beacon-auth$|api-?key|token|secret|session|csrf|xsrf|password|credential/i;
+function isNeverRecorded(name) {
+  return isClientAddressHeader(name) || NEVER_HEADERS.test(name);
+}
+var BODY_TRUNCATED = "[truncated]";
+var BODY_UNPARSED = "[unparsed]";
+function headersOf(req, allowHeaders) {
+  const allowed = /* @__PURE__ */ new Set([
+    ...DEFAULT_ALLOWED_HEADERS,
+    ...allowHeaders.map((name) => name.toLowerCase())
+  ]);
+  const out = {};
+  for (const [name, value] of Object.entries(req.headers)) {
+    const lower = name.toLowerCase();
+    if (value === void 0 || !allowed.has(lower) || isNeverRecorded(name)) continue;
+    const text = Array.isArray(value) ? value.join(", ") : value;
+    out[name] = lower === "referer" ? scrubUrl(text).replace(/\?.*$/, "") : text;
+  }
+  return out;
+}
+function parsedBody(body, contentType) {
+  if (typeof body !== "string" && !(body instanceof Uint8Array)) return body;
+  const text = typeof body === "string" ? body : new TextDecoder().decode(body);
+  if (/json/i.test(contentType)) return JSON.parse(text);
+  if (/x-www-form-urlencoded/i.test(contentType))
+    return Object.fromEntries(new URLSearchParams(text));
+  throw new Error("unsupported body");
+}
+function bodyOf(body, contentType = "") {
+  if (body === void 0) return void 0;
+  let value;
+  try {
+    value = parsedBody(body, contentType);
+  } catch {
+    return BODY_UNPARSED;
+  }
+  const scrubbed = maskValues(scrubObject(value, MASK_DEPTH));
+  const normalized = normalize(scrubbed, {
+    depth: 5,
+    maxKeys: 100,
+    maxArray: 100,
+    maxString: MAX_BODY_BYTES
+  });
+  return JSON.stringify(normalized).length > MAX_BODY_BYTES ? BODY_TRUNCATED : normalized;
+}
+var MASK_DEPTH = 20;
+function maskValues(value, depth = MASK_DEPTH) {
+  if (typeof value === "string") return maskCredentials(value);
+  if (!value || typeof value !== "object") return value;
+  if (depth <= 0) return "[Filtered]";
+  if (Array.isArray(value)) return value.map((item) => maskValues(item, depth - 1));
+  return Object.fromEntries(
+    Object.entries(value).map(([key, item]) => [key, maskValues(item, depth - 1)])
+  );
+}
+function requestDataOf(req, options = {}) {
+  const data = {
+    method: req.method,
+    url: scrubUrl(`${req.protocol}://${req.get("host") ?? "localhost"}${req.originalUrl}`),
+    headers: headersOf(req, options.allowHeaders ?? [])
+  };
+  if (options.includeBody) {
+    const body = bodyOf(req.body, String(req.get("content-type") ?? ""));
+    if (body !== void 0) data.data = body;
+  }
+  return data;
+}
+function beaconRequestHandler(options = {}) {
+  return function beaconRequestHandler2(req, _res, next) {
+    let request;
+    try {
+      request = requestDataOf(req, options);
+    } catch {
+      request = void 0;
+    }
+    withScope((scope) => {
+      if (request) scope.request = request;
+      next();
+    });
+  };
+}
+function statusOf(error) {
+  if (typeof error !== "object" || error === null) return void 0;
+  const candidate = error;
+  const status = candidate.status ?? candidate.statusCode ?? candidate.output?.statusCode;
+  const number = Number(status);
+  return status === void 0 || !Number.isFinite(number) ? void 0 : number;
+}
+function defaultShouldHandleError(error) {
+  const status = statusOf(error);
+  return status === void 0 || status >= 500;
+}
+function beaconErrorHandler(options = {}) {
+  const shouldHandle = options.shouldHandleError ?? defaultShouldHandleError;
+  return function beaconErrorHandler2(error, req, res, next) {
+    try {
+      const client = getClient();
+      if (client && shouldHandle(error)) {
+        const scope = getCurrentScope().clone();
+        const request = { ...scope.request ?? requestDataOf(req) };
+        const route = req.route?.path;
+        if (typeof route === "string") {
+          request["route"] = route;
+          scope.setTag("route", `${req.method} ${route}`);
+        }
+        scope.request = request;
+        const eventId = client.captureException(error, scope, void 0, {
+          mechanism: { type: "express", handled: false },
+          logger: "express"
+        });
+        res.locals["beaconEventId"] = eventId;
+      }
+    } catch {
+    }
+    next(error);
+  };
+}
+export {
+  BODY_TRUNCATED,
+  BODY_UNPARSED,
+  DEFAULT_ALLOWED_HEADERS,
+  beaconErrorHandler,
+  beaconRequestHandler,
+  bodyOf,
+  defaultShouldHandleError,
+  requestDataOf
+};
+//# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/index.ts"],
+  "sourcesContent": ["import {\n  getClient,\n  getCurrentScope,\n  isClientAddressHeader,\n  maskCredentials,\n  normalize,\n  scrubObject,\n  scrubUrl,\n  withScope,\n  type RequestData,\n} from '@nowo-tech/beacon-node';\nimport type { ErrorRequestHandler, Request, RequestHandler } from 'express';\n\nexport interface RequestHandlerOptions {\n  /** Attach `req.body` (keys scrubbed; dropped when unparsable or over 10 kB). Default false. */\n  includeBody?: boolean;\n  /**\n   * Extra request headers to record, on top of the default allow-list. Client-address, cookie and authorization\n   * headers are never recorded, even when listed here.\n   */\n  allowHeaders?: string[];\n}\n\nexport interface ErrorHandlerOptions {\n  /** Default: errors without a status, and statuses of 500 or more. */\n  shouldHandleError?: (error: unknown) => boolean;\n}\n\nconst MAX_BODY_BYTES = 10 * 1024;\n\n/** The request headers recorded by default (contract \u00A75, allow-list). */\nexport const DEFAULT_ALLOWED_HEADERS: readonly string[] = [\n  'accept',\n  'accept-encoding',\n  'accept-language',\n  'content-length',\n  'content-type',\n  'referer',\n  'user-agent',\n];\n\n/** Never recorded, whatever the allow-list says: client addresses, cookies and credentials. */\nconst NEVER_HEADERS =\n  /cookie|authorization|^x-beacon-auth$|api-?key|token|secret|session|csrf|xsrf|password|credential/i;\n\n/** Client-address headers (FVD-L1) and credential headers are never recorded, even when opted in. */\nfunction isNeverRecorded(name: string): boolean {\n  return isClientAddressHeader(name) || NEVER_HEADERS.test(name);\n}\n\nexport const BODY_TRUNCATED = '[truncated]';\nexport const BODY_UNPARSED = '[unparsed]';\n\nfunction headersOf(req: Request, allowHeaders: readonly string[]): Record<string, string> {\n  const allowed = new Set([\n    ...DEFAULT_ALLOWED_HEADERS,\n    ...allowHeaders.map((name) => name.toLowerCase()),\n  ]);\n  const out: Record<string, string> = {};\n  for (const [name, value] of Object.entries(req.headers)) {\n    const lower = name.toLowerCase();\n    if (value === undefined || !allowed.has(lower) || isNeverRecorded(name)) continue;\n    const text = Array.isArray(value) ? value.join(', ') : value;\n    // The referer is another page's URL: its query string and fragment are never kept.\n    out[name] = lower === 'referer' ? scrubUrl(text).replace(/\\?.*$/, '') : text;\n  }\n  return out;\n}\n\n/** Parses JSON and form bodies that arrive as text, so that their keys can be scrubbed. */\nfunction parsedBody(body: unknown, contentType: string): unknown {\n  if (typeof body !== 'string' && !(body instanceof Uint8Array)) return body;\n  const text = typeof body === 'string' ? body : new TextDecoder().decode(body);\n  if (/json/i.test(contentType)) return JSON.parse(text) as unknown;\n  if (/x-www-form-urlencoded/i.test(contentType))\n    return Object.fromEntries(new URLSearchParams(text));\n  throw new Error('unsupported body');\n}\n\n/**\n * The request body for the event (FV-M1): parsed, keys scrubbed **before** anything is cut, string values\n * credential-masked, and then either kept whole (\u2264 10 kB) or replaced by `[truncated]`. Raw text is never sent:\n * a body that cannot be parsed becomes `[unparsed]`.\n */\nexport function bodyOf(body: unknown, contentType = ''): unknown {\n  if (body === undefined) return undefined;\n  let value: unknown;\n  try {\n    value = parsedBody(body, contentType);\n  } catch {\n    return BODY_UNPARSED;\n  }\n  const scrubbed = maskValues(scrubObject(value, MASK_DEPTH));\n  const normalized = normalize(scrubbed, {\n    depth: 5,\n    maxKeys: 100,\n    maxArray: 100,\n    maxString: MAX_BODY_BYTES,\n  });\n  return JSON.stringify(normalized).length > MAX_BODY_BYTES ? BODY_TRUNCATED : normalized;\n}\n\nconst MASK_DEPTH = 20;\n\n/**\n * Masks credential-looking strings, at most {@link MASK_DEPTH} levels deep (FVD-I2). Card numbers sent as numbers\n * are already masked by `scrubObject`.\n */\nfunction maskValues(value: unknown, depth = MASK_DEPTH): unknown {\n  if (typeof value === 'string') return maskCredentials(value);\n  if (!value || typeof value !== 'object') return value;\n  // Deeper (or cyclic) structures are not walked: they are cut here instead of throwing.\n  if (depth <= 0) return '[Filtered]';\n  if (Array.isArray(value)) return value.map((item) => maskValues(item, depth - 1));\n  return Object.fromEntries(\n    Object.entries(value).map(([key, item]) => [key, maskValues(item, depth - 1)]),\n  );\n}\n\n/** Request data for the event (contract \u00A78.2): method, scrubbed URL, allow-listed headers, never cookies. */\nexport function requestDataOf(req: Request, options: RequestHandlerOptions = {}): RequestData {\n  const data: RequestData = {\n    method: req.method,\n    url: scrubUrl(`${req.protocol}://${req.get('host') ?? 'localhost'}${req.originalUrl}`),\n    headers: headersOf(req, options.allowHeaders ?? []),\n  };\n  if (options.includeBody) {\n    const body = bodyOf(req.body as unknown, String(req.get('content-type') ?? ''));\n    if (body !== undefined) data.data = body;\n  }\n  return data;\n}\n\n/** Install first: an isolated scope per request, with the request context. */\nexport function beaconRequestHandler(options: RequestHandlerOptions = {}): RequestHandler {\n  return function beaconRequestHandler(req, _res, next) {\n    let request: RequestData | undefined;\n    try {\n      request = requestDataOf(req, options);\n    } catch {\n      // The SDK never changes the app's behaviour: without request data, the request still goes on.\n      request = undefined;\n    }\n    withScope((scope) => {\n      if (request) scope.request = request;\n      next();\n    });\n  };\n}\n\nfunction statusOf(error: unknown): number | undefined {\n  if (typeof error !== 'object' || error === null) return undefined;\n  const candidate = error as {\n    status?: unknown;\n    statusCode?: unknown;\n    output?: { statusCode?: unknown };\n  };\n  const status = candidate.status ?? candidate.statusCode ?? candidate.output?.statusCode;\n  const number = Number(status);\n  return status === undefined || !Number.isFinite(number) ? undefined : number;\n}\n\n/** The default filter: errors without a status, and statuses of 500 or more. */\nexport function defaultShouldHandleError(error: unknown): boolean {\n  const status = statusOf(error);\n  return status === undefined || status >= 500;\n}\n\n/**\n * Install after the routes: captures the error (mechanism `express`, unhandled) with the route, then calls\n * `next(err)` so that Express (or the app's own error handler) still answers. Works with Express 4 and 5.\n */\nexport function beaconErrorHandler(options: ErrorHandlerOptions = {}): ErrorRequestHandler {\n  const shouldHandle = options.shouldHandleError ?? defaultShouldHandleError;\n  return function beaconErrorHandler(error, req, res, next) {\n    try {\n      const client = getClient();\n      if (client && shouldHandle(error)) {\n        const scope = getCurrentScope().clone();\n        const request = { ...(scope.request ?? requestDataOf(req)) };\n        const route = (req.route as { path?: unknown } | undefined)?.path;\n        if (typeof route === 'string') {\n          request['route'] = route;\n          scope.setTag('route', `${req.method} ${route}`);\n        }\n        scope.request = request;\n        const eventId = client.captureException(error, scope, undefined, {\n          mechanism: { type: 'express', handled: false },\n          logger: 'express',\n        });\n        (res.locals as Record<string, unknown>)['beaconEventId'] = eventId;\n      }\n    } catch {\n      // Whatever happens in the SDK, the app's own error goes on unchanged.\n    }\n    next(error);\n  };\n}\n"],
+  "mappings": ";AAAA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AAkBP,IAAM,iBAAiB,KAAK;AAGrB,IAAM,0BAA6C;AAAA,EACxD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAGA,IAAM,gBACJ;AAGF,SAAS,gBAAgB,MAAuB;AAC9C,SAAO,sBAAsB,IAAI,KAAK,cAAc,KAAK,IAAI;AAC/D;AAEO,IAAM,iBAAiB;AACvB,IAAM,gBAAgB;AAE7B,SAAS,UAAU,KAAc,cAAyD;AACxF,QAAM,UAAU,oBAAI,IAAI;AAAA,IACtB,GAAG;AAAA,IACH,GAAG,aAAa,IAAI,CAAC,SAAS,KAAK,YAAY,CAAC;AAAA,EAClD,CAAC;AACD,QAAM,MAA8B,CAAC;AACrC,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,IAAI,OAAO,GAAG;AACvD,UAAM,QAAQ,KAAK,YAAY;AAC/B,QAAI,UAAU,UAAa,CAAC,QAAQ,IAAI,KAAK,KAAK,gBAAgB,IAAI,EAAG;AACzE,UAAM,OAAO,MAAM,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,IAAI;AAEvD,QAAI,IAAI,IAAI,UAAU,YAAY,SAAS,IAAI,EAAE,QAAQ,SAAS,EAAE,IAAI;AAAA,EAC1E;AACA,SAAO;AACT;AAGA,SAAS,WAAW,MAAe,aAA8B;AAC/D,MAAI,OAAO,SAAS,YAAY,EAAE,gBAAgB,YAAa,QAAO;AACtE,QAAM,OAAO,OAAO,SAAS,WAAW,OAAO,IAAI,YAAY,EAAE,OAAO,IAAI;AAC5E,MAAI,QAAQ,KAAK,WAAW,EAAG,QAAO,KAAK,MAAM,IAAI;AACrD,MAAI,yBAAyB,KAAK,WAAW;AAC3C,WAAO,OAAO,YAAY,IAAI,gBAAgB,IAAI,CAAC;AACrD,QAAM,IAAI,MAAM,kBAAkB;AACpC;AAOO,SAAS,OAAO,MAAe,cAAc,IAAa;AAC/D,MAAI,SAAS,OAAW,QAAO;AAC/B,MAAI;AACJ,MAAI;AACF,YAAQ,WAAW,MAAM,WAAW;AAAA,EACtC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,QAAM,WAAW,WAAW,YAAY,OAAO,UAAU,CAAC;AAC1D,QAAM,aAAa,UAAU,UAAU;AAAA,IACrC,OAAO;AAAA,IACP,SAAS;AAAA,IACT,UAAU;AAAA,IACV,WAAW;AAAA,EACb,CAAC;AACD,SAAO,KAAK,UAAU,UAAU,EAAE,SAAS,iBAAiB,iBAAiB;AAC/E;AAEA,IAAM,aAAa;AAMnB,SAAS,WAAW,OAAgB,QAAQ,YAAqB;AAC/D,MAAI,OAAO,UAAU,SAAU,QAAO,gBAAgB,KAAK;AAC3D,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAEhD,MAAI,SAAS,EAAG,QAAO;AACvB,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,SAAS,WAAW,MAAM,QAAQ,CAAC,CAAC;AAChF,SAAO,OAAO;AAAA,IACZ,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,WAAW,MAAM,QAAQ,CAAC,CAAC,CAAC;AAAA,EAC/E;AACF;AAGO,SAAS,cAAc,KAAc,UAAiC,CAAC,GAAgB;AAC5F,QAAM,OAAoB;AAAA,IACxB,QAAQ,IAAI;AAAA,IACZ,KAAK,SAAS,GAAG,IAAI,QAAQ,MAAM,IAAI,IAAI,MAAM,KAAK,WAAW,GAAG,IAAI,WAAW,EAAE;AAAA,IACrF,SAAS,UAAU,KAAK,QAAQ,gBAAgB,CAAC,CAAC;AAAA,EACpD;AACA,MAAI,QAAQ,aAAa;AACvB,UAAM,OAAO,OAAO,IAAI,MAAiB,OAAO,IAAI,IAAI,cAAc,KAAK,EAAE,CAAC;AAC9E,QAAI,SAAS,OAAW,MAAK,OAAO;AAAA,EACtC;AACA,SAAO;AACT;AAGO,SAAS,qBAAqB,UAAiC,CAAC,GAAmB;AACxF,SAAO,SAASA,sBAAqB,KAAK,MAAM,MAAM;AACpD,QAAI;AACJ,QAAI;AACF,gBAAU,cAAc,KAAK,OAAO;AAAA,IACtC,QAAQ;AAEN,gBAAU;AAAA,IACZ;AACA,cAAU,CAAC,UAAU;AACnB,UAAI,QAAS,OAAM,UAAU;AAC7B,WAAK;AAAA,IACP,CAAC;AAAA,EACH;AACF;AAEA,SAAS,SAAS,OAAoC;AACpD,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,YAAY;AAKlB,QAAM,SAAS,UAAU,UAAU,UAAU,cAAc,UAAU,QAAQ;AAC7E,QAAM,SAAS,OAAO,MAAM;AAC5B,SAAO,WAAW,UAAa,CAAC,OAAO,SAAS,MAAM,IAAI,SAAY;AACxE;AAGO,SAAS,yBAAyB,OAAyB;AAChE,QAAM,SAAS,SAAS,KAAK;AAC7B,SAAO,WAAW,UAAa,UAAU;AAC3C;AAMO,SAAS,mBAAmB,UAA+B,CAAC,GAAwB;AACzF,QAAM,eAAe,QAAQ,qBAAqB;AAClD,SAAO,SAASC,oBAAmB,OAAO,KAAK,KAAK,MAAM;AACxD,QAAI;AACF,YAAM,SAAS,UAAU;AACzB,UAAI,UAAU,aAAa,KAAK,GAAG;AACjC,cAAM,QAAQ,gBAAgB,EAAE,MAAM;AACtC,cAAM,UAAU,EAAE,GAAI,MAAM,WAAW,cAAc,GAAG,EAAG;AAC3D,cAAM,QAAS,IAAI,OAA0C;AAC7D,YAAI,OAAO,UAAU,UAAU;AAC7B,kBAAQ,OAAO,IAAI;AACnB,gBAAM,OAAO,SAAS,GAAG,IAAI,MAAM,IAAI,KAAK,EAAE;AAAA,QAChD;AACA,cAAM,UAAU;AAChB,cAAM,UAAU,OAAO,iBAAiB,OAAO,OAAO,QAAW;AAAA,UAC/D,WAAW,EAAE,MAAM,WAAW,SAAS,MAAM;AAAA,UAC7C,QAAQ;AAAA,QACV,CAAC;AACD,QAAC,IAAI,OAAmC,eAAe,IAAI;AAAA,MAC7D;AAAA,IACF,QAAQ;AAAA,IAER;AACA,SAAK,KAAK;AAAA,EACZ;AACF;",
+  "names": ["beaconRequestHandler", "beaconErrorHandler"]
+}

package/package.json

@@ -1,6 +1,79 @@
 {
   "name": "@nowo-tech/beacon-express",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "Beacon middleware for Express 4 and 5: request isolation, scrubbed request context and error capture.",
+  "keywords": [
+    "beacon",
+    "error-tracking",
+    "express",
+    "middleware"
+  ],
+  "license": "MIT",
+  "author": "nowo-tech",
+  "homepage": "https://github.com/nowo-tech/beacon-js/tree/main/packages/express#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/nowo-tech/beacon-js.git",
+    "directory": "packages/express"
+  },
+  "bugs": "https://github.com/nowo-tech/beacon-js/issues",
+  "type": "module",
+  "sideEffects": false,
+  "main": "./dist/index.cjs",
+  "module": "./dist/index.mjs",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": {
+        "types": "./dist/index.d.ts",
+        "default": "./dist/index.mjs"
+      },
+      "require": {
+        "types": "./dist/index.d.cts",
+        "default": "./dist/index.cjs"
+      }
+    },
+    "./package.json": "./package.json"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "CHANGELOG.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "dependencies": {
+    "@nowo-tech/beacon-node": "0.1.0"
+  },
+  "peerDependencies": {
+    "express": ">=4.18"
+  },
+  "devDependencies": {
+    "@types/express": "5.0.6",
+    "express": "5.3.0"
+  },
+  "beaconBuild": {
+    "platform": "node",
+    "target": "node20",
+    "entries": [
+      {
+        "in": "src/index.ts",
+        "out": "index",
+        "formats": [
+          "esm",
+          "cjs"
+        ]
+      }
+    ]
+  },
+  "scripts": {
+    "build": "node ../../tooling/build.mjs",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run --coverage"
+  }
 }