@replayio-app-building/netlify-recorder 0.17.0 → 0.18.0

package/README.md

@@ -1,6 +1,6 @@
 # @replayio-app-building/netlify-recorder
 
-Capture and replay Netlify function executions as [Replay](https://replay.io) recordings. This package intercepts outbound network calls and environment variable reads during handler execution, stores the captured data via the Netlify Recorder service, and can later reproduce the exact execution as a Replay recording for debugging and analysis.
+Capture and replay Netlify function executions as [Replay](https://replay.io) recordings. This package intercepts outbound network calls and environment variable reads during handler execution, stores the captured data in your app's own database, and can later reproduce the exact execution as a Replay recording for debugging and analysis.
 
 ## Installation
 
@@ -10,7 +10,19 @@ npm install @replayio-app-building/netlify-recorder
 
 ## Setup
 
-### 1. Set required environment variables
+### 1. Create the backend_requests table
+
+The package stores captured request data directly in your app's database. Call `backendRequestsEnsureTable` once during schema initialization to create the `backend_requests` table:
+
+```typescript
+import { backendRequestsEnsureTable } from "@replayio-app-building/netlify-recorder";
+
+await backendRequestsEnsureTable(sql);
+```
+
+This creates a table with columns for the serialized blob data, git metadata (commit SHA, branch, repository URL), handler path, recording status, and timestamps.
+
+### 2. Set required environment variables
 
 `finishRequest` needs to know which repository, branch, and commit your deployed code belongs to. Set these environment variables on your Netlify site:
 
@@ -19,9 +31,8 @@ npm install @replayio-app-building/netlify-recorder
 | `REPLAY_REPOSITORY_URL` | Your app's git repository URL (e.g. `https://github.com/org/repo.git`) | Set in your deploy script or Netlify site settings |
 | `COMMIT_SHA` | The git commit hash of the deployed code | Set in your deploy script via `git rev-parse HEAD` |
 | `BRANCH_NAME` | The git branch of the deployed code | Set in your deploy script via `git rev-parse --abbrev-ref HEAD` |
-| `NETLIFY_RECORDER_SECRET` | Secret string for access control — restricts who can view and act on your captured requests | Set in Netlify site environment variables or via `set-branch-secret` |
 
-The first three are **required** — `finishRequest` will throw an error if any are missing. `NETLIFY_RECORDER_SECRET` is strongly recommended to prevent other apps from accessing your captured request data. Your deploy script should resolve the git values and set them on the Netlify site before deploying. Example:
+All three are **required** — `finishRequest` will throw an error if any are missing. Your deploy script should resolve the git values and set them on the Netlify site before deploying. Example:
 
 ```typescript
 // In your deploy script:
@@ -33,19 +44,20 @@ const repositoryUrl = execSync("git remote get-url origin", { encoding: "utf-8"
 // Set these on your Netlify site via the Netlify API or CLI
 ```
 
-### 2. Wrap your Netlify function
+### 3. Wrap your Netlify function
 
-Use `createRecordingRequestHandler` with `remoteCallbacks()` to wrap your handler with automatic request capture. Set `secret` to restrict access to captured requests — only API calls providing the same secret can view or act on them.
+Use `createRecordingRequestHandler` with `databaseCallbacks(sql)` to wrap your handler with automatic request capture. The captured data is stored directly in the `backend_requests` table in your database.
 
 **v1 handler** (Netlify Functions v1 — `event` with `httpMethod`, `path`, etc.):
 
 ```typescript
 import {
   createRecordingRequestHandler,
-  remoteCallbacks,
+  databaseCallbacks,
 } from "@replayio-app-building/netlify-recorder";
+import { neon } from "@neondatabase/serverless";
 
-const RECORDER_URL = "https://netlify-recorder-bm4wmw.netlify.app";
+const sql = neon(process.env.DATABASE_URL!);
 
 const handler = createRecordingRequestHandler(
   async (event) => {
@@ -58,9 +70,8 @@ const handler = createRecordingRequestHandler(
     };
   },
   {
-    callbacks: remoteCallbacks(RECORDER_URL),
+    callbacks: databaseCallbacks(sql),
     handlerPath: "netlify/functions/my-handler",
-    secret: process.env.NETLIFY_RECORDER_SECRET,
   }
 );
 
@@ -72,10 +83,11 @@ export { handler };
 ```typescript
 import {
   createRecordingRequestHandler,
-  remoteCallbacks,
+  databaseCallbacks,
 } from "@replayio-app-building/netlify-recorder";
+import { neon } from "@neondatabase/serverless";
 
-const RECORDER_URL = "https://netlify-recorder-bm4wmw.netlify.app";
+const sql = neon(process.env.DATABASE_URL!);
 
 // The wrapper reads the body from a clone — you can still read req.json() etc.
 export default createRecordingRequestHandler(
@@ -90,37 +102,57 @@ export default createRecordingRequestHandler(
     };
   },
   {
-    callbacks: remoteCallbacks(RECORDER_URL),
+    callbacks: databaseCallbacks(sql),
     handlerPath: "netlify/functions/my-handler",
-    secret: process.env.NETLIFY_RECORDER_SECRET,
   }
 );
 ```
 
-`createRecordingRequestHandler` automatically captures all outbound network calls and environment variable reads during your handler's execution, then sends the captured data to the Netlify Recorder service. The response includes an `X-Replay-Request-Id` header with the request ID managed by the service.
+`createRecordingRequestHandler` automatically captures all outbound network calls and environment variable reads during your handler's execution, then stores the captured data in the `backend_requests` table. The response includes an `X-Replay-Request-Id` header with the ID of the stored request.
 
 > **Note:** Always use the response returned by the wrapper (or `finishRequest`), not your original response object. The wrapper adds the `X-Replay-Request-Id` header to the response it returns.
 
-### 3. Create recordings
+### 4. Create recordings via the Netlify Recorder service
 
-When you want to turn a captured request into a Replay recording, POST to the Netlify Recorder service's `create-recording` endpoint with the request ID. If the request was created with a secret, you must include it:
+When you want to turn a captured request into a Replay recording, POST to the Netlify Recorder service's `create-recording` endpoint. You need to provide a `blobDataUrl` — a publicly accessible URL where the recording container can fetch the captured blob data.
+
+If your app exposes the blob data via an endpoint (e.g. using `backendRequestsGetBlobData`), construct the URL and pass it:
 
 ```typescript
+const RECORDER_URL = "https://netlify-recorder-bm4wmw.netlify.app";
+const blobDataUrl = `https://your-app.netlify.app/api/get-backend-request-blob?requestId=${requestId}`;
+
 const response = await fetch(
   `${RECORDER_URL}/api/create-recording`,
   {
     method: "POST",
     headers: { "Content-Type": "application/json" },
     body: JSON.stringify({
-      requestId,
-      secret,
+      blobDataUrl,
+      handlerPath: "netlify/functions/my-handler",
+      commitSha: "abc123",
+      branchName: "main",
+      repositoryUrl: "https://github.com/org/repo.git", // optional
       webhookUrl: "https://your-app.netlify.app/api/on-recording-complete", // optional
     }),
   }
 );
+
+const { requestId: serviceRequestId } = await response.json();
 ```
 
-The service looks up the stored blob data, dispatches the work to a recording container, and creates the recording.
+The `create-recording` endpoint accepts:
+
+| Parameter | Required | Description |
+|---|---|---|
+| `blobDataUrl` | Yes | URL where the recording container can fetch the captured blob JSON |
+| `handlerPath` | Yes | Path to the handler file (e.g. `netlify/functions/my-handler`) |
+| `commitSha` | Yes | Git commit SHA of the deployed code |
+| `branchName` | Yes | Git branch of the deployed code |
+| `repositoryUrl` | No | Git repository URL for the container to clone |
+| `webhookUrl` | No | URL to POST the result to when the recording completes or fails |
+
+The service dispatches the work to a recording container, which fetches the blob data from `blobDataUrl`, replays the handler execution under `replay-node`, and produces a Replay recording.
 
 If `webhookUrl` is provided, the service will POST the result to that URL when the recording completes (or fails):
 
@@ -134,97 +166,32 @@ On failure:
 { "status": "failed", "error": "Error message" }
 ```
 
-### 4. Check recording status
+### 5. Manage stored requests
 
-You can poll the recording status at any time. If the request was created with a secret, you must include it:
+Use the `backendRequests*` helpers to query and manage captured requests in your database:
 
 ```typescript
-const res = await fetch(
-  `${RECORDER_URL}/api/get-request?requestId=${requestId}&secret=${secret}`
-);
-const { status, recordingId } = await res.json();
-// status: "captured" | "processing" | "recorded" | "failed"
-// recordingId: string | null
-```
-
-Requests created with a secret return 403 if the secret is missing or incorrect.
-
-### 5. Access control with secrets
-
-You can restrict access to captured requests by setting a `secret` string. When a secret is set, the request is only accessible via API calls that provide the same secret value. This lets each app isolate its requests from other apps sharing the same Netlify Recorder service.
-
-#### Setting a secret
-
-Pass `secret` in the options when wrapping your handler:
-
-```typescript
-export default createRecordingRequestHandler(
-  async (req) => {
-    const result = await myBusinessLogic();
-    return { statusCode: 200, body: JSON.stringify(result) };
-  },
-  {
-    callbacks: remoteCallbacks(RECORDER_URL),
-    handlerPath: "netlify/functions/my-handler",
-    secret: process.env.NETLIFY_RECORDER_SECRET,
-  }
-);
-```
-
-#### Listing requests by secret
-
-Use the `requests` endpoint with a `secret` parameter to retrieve all requests associated with your secret, with optional filtering by status, handler path, and time range:
-
-```typescript
-const res = await fetch(
-  `${RECORDER_URL}/api/requests?secret=${secret}&status=recorded&handlerPath=netlify/functions/my-handler&after=2025-01-01T00:00:00Z&before=2025-12-31T23:59:59Z`
-);
-const { rows, total, page, limit } = await res.json();
-```
-
-Query parameters:
-
-| Parameter | Description |
-|---|---|
-| `secret` | **(required)** The secret string used when creating the requests |
-| `id` | Search by request ID prefix |
-| `status` | Filter by status: `captured`, `queued`, `processing`, `recorded`, `failed`, `all` |
-| `handlerPath` | Filter by handler path (exact match) |
-| `after` | Only include requests created at or after this ISO timestamp |
-| `before` | Only include requests created at or before this ISO timestamp |
-| `page` | Page number (default 1) |
-| `limit` | Page size (default 20, max 100) |
+import {
+  backendRequestsGet,
+  backendRequestsList,
+  backendRequestsUpdateStatus,
+} from "@replayio-app-building/netlify-recorder";
 
-Without a `secret` parameter, only requests created without a secret are returned.
+// Get a single request by ID
+const request = await backendRequestsGet(sql, requestId);
+// request.status: "captured" | "queued" | "processing" | "recorded" | "failed"
+// request.recording_id: string | null
 
-#### Checking request status with a secret
+// List requests with optional filters
+const requests = await backendRequestsList(sql, { status: "captured", limit: 20 });
 
-When a request was created with a secret, you must include the secret when polling its status:
+// Update status after recording completes
+await backendRequestsUpdateStatus(sql, requestId, "recorded", recordingId);
 
-```typescript
-const res = await fetch(
-  `${RECORDER_URL}/api/get-request?requestId=${requestId}&secret=${secret}`
-);
+// Update status on failure
+await backendRequestsUpdateStatus(sql, requestId, "failed", undefined, "Error message");
 ```
 
-Requests created without a secret remain accessible without one (backward compatible).
-
-#### Managing your secret
-
-Store your secret as a `NETLIFY_RECORDER_SECRET` environment variable. To keep it secure:
-
-1. **Netlify site environment:** Add `NETLIFY_RECORDER_SECRET` in your Netlify site's environment variables (Site settings > Environment variables). This makes it available to all deployed functions.
-
-2. **Branch-level secret** (for CI/development): If you're using the Netlify Recorder agent infrastructure, store the secret as a branch secret so deploy scripts and background agents can access it:
-
-   ```bash
-   set-branch-secret NETLIFY_RECORDER_SECRET "your-secret-value"
-   ```
-
-3. **Local development:** Add `NETLIFY_RECORDER_SECRET` to your `.env` file (make sure `.env` is in `.gitignore`).
-
-Use a strong random string (e.g. `openssl rand -base64 32`) and rotate it if compromised. All requests created under the old secret remain accessible only with the old secret value — there is no migration mechanism, so plan rotations during low-traffic windows.
-
 ---
 
 ## Audit Log Support
@@ -261,7 +228,7 @@ No special SQL wrapper is needed. Any Neon SQL query inside a handler wrapped wi
 ```typescript
 import {
   createRecordingRequestHandler,
-  remoteCallbacks,
+  databaseCallbacks,
 } from "@replayio-app-building/netlify-recorder";
 
 export default createRecordingRequestHandler(
@@ -271,9 +238,8 @@ export default createRecordingRequestHandler(
     return { statusCode: 200, body: "OK" };
   },
   {
-    callbacks: remoteCallbacks(RECORDER_URL),
+    callbacks: databaseCallbacks(sql),
     handlerPath: "netlify/functions/create-order",
-    secret: process.env.NETLIFY_RECORDER_SECRET,
   }
 );
 ```
@@ -314,22 +280,21 @@ The network interceptor detects Neon SQL HTTP requests (which use `fetch` intern
 
 Wraps a Netlify handler function with automatic request recording. This is the recommended way to integrate — it handles `startRequest`/`finishRequest` and error cleanup internally.
 
-**Response timing:** When the Netlify Functions v2 `context` object is available (with `waitUntil`), the response is returned to the client **immediately** with a pre-generated `X-Replay-Request-Id` header. The blob upload and metadata storage continue in the background via `context.waitUntil()`, adding zero latency to the client response.
+**Response timing:** When the Netlify Functions v2 `context` object is available (with `waitUntil`), the response is returned to the client **immediately** with a pre-generated `X-Replay-Request-Id` header. The data storage continues in the background via `context.waitUntil()`, adding zero latency to the client response.
 
 When `context.waitUntil` is not available (v1 handlers or missing context), the wrapper falls back to awaiting `finishRequest` before returning.
 
 **Parameters:**
 - `handler` — Your async handler function `(event, context?) => Promise<{ statusCode, headers?, body? }>`
-- `options.callbacks` — `remoteCallbacks(serviceUrl)` for sending captured data to the Netlify Recorder service
+- `options.callbacks` — `databaseCallbacks(sql)` to store captured data in the `backend_requests` table
 - `options.handlerPath` — Path to the handler file (used for recording metadata)
 - `options.commitSha` — Override `COMMIT_SHA` env var
 - `options.branchName` — Override `BRANCH_NAME` env var
 - `options.repositoryUrl` — Override `REPLAY_REPOSITORY_URL` env var
-- `options.secret` — Optional secret string. When set, the stored request is only accessible via API calls that provide the same secret value.
 
 **Returns:** A wrapped handler function with the same signature.
 
-**Callbacks note:** When using the `waitUntil` flow, `storeRequestData` receives a `requestId` field in its data parameter. Callbacks should use this as the row ID so the stored record matches the ID already sent to the client.
+**Callbacks note:** When using the `waitUntil` flow, `storeRequest` receives a `requestId` field in its data parameter. Callbacks should use this as the row ID so the stored record matches the ID already sent to the client.
 
 ### `startRequest(event): RequestContext`
 
@@ -346,31 +311,143 @@ For v2 Request inputs, the body is read from a **clone** — the original reques
 
 ### `finishRequest(requestContext, callbacks, response, options?): Promise<HandlerResponse>`
 
-Lower-level API. Finalizes the request capture. Restores original `fetch` and `process.env`, serializes the captured data, uploads it via the callbacks, and returns the response with `X-Replay-Request-Id` header set.
+Lower-level API. Finalizes the request capture. Restores original `fetch` and `process.env`, serializes the captured data, stores it via the callback, and returns the response with `X-Replay-Request-Id` header set.
 
 **Important:** You must send the returned response to the client — it contains the `X-Replay-Request-Id` header.
 
-Logs a `console.warn` when the total duration exceeds 2 seconds or when individual callback steps (upload, store) exceed 1 second, to help diagnose slow operations.
+Logs a `console.warn` when the total duration exceeds 2 seconds to help diagnose slow operations.
 
 **Requires** the following environment variables (or equivalent options overrides): `COMMIT_SHA`, `BRANCH_NAME`, `REPLAY_REPOSITORY_URL`. Throws if any are missing.
 
 **Parameters:**
 - `requestContext` — The context returned by `startRequest`
-- `callbacks` — `remoteCallbacks(serviceUrl)` for sending captured data to the Netlify Recorder service
+- `callbacks` — `databaseCallbacks(sql)` or a custom `{ storeRequest }` callback
 - `response` — The handler's response object (`{ statusCode, headers?, body? }`)
 - `options.handlerPath` — Path to the handler file (used for recording metadata)
 - `options.commitSha` — Override `COMMIT_SHA` env var
 - `options.branchName` — Override `BRANCH_NAME` env var
 - `options.repositoryUrl` — Override `REPLAY_REPOSITORY_URL` env var
 - `options.requestId` — Pre-generated request ID (used by `createRecordingRequestHandler` in the `waitUntil` flow)
-- `options.secret` — Optional secret string. When set, the stored request is only accessible via API calls that provide the same secret value.
 
-### `remoteCallbacks(serviceUrl): FinishRequestCallbacks`
+### `databaseCallbacks(sql): FinishRequestCallbacks`
+
+Creates a `FinishRequestCallbacks` object that stores captured request data directly in the `backend_requests` table. This is the standard way to provide callbacks to `createRecordingRequestHandler` or `finishRequest`.
+
+**Parameters:**
+- `sql` — A Neon SQL tagged-template function
+
+**Returns:** An object with a `storeRequest` method that inserts rows into `backend_requests`.
+
+### `backendRequestsEnsureTable(sql): Promise<void>`
+
+Creates the `backend_requests` table and its indexes. Call once during schema initialization.
+
+The table schema:
+
+| Column | Type | Description |
+|---|---|---|
+| `id` | UUID (PK) | Auto-generated request ID |
+| `blob_data` | TEXT | Serialized JSON of captured request data |
+| `handler_path` | TEXT | Path to the handler file |
+| `commit_sha` | TEXT | Git commit SHA |
+| `branch_name` | TEXT | Git branch name (default: `'main'`) |
+| `repository_url` | TEXT | Git repository URL (nullable) |
+| `status` | TEXT | `'captured'`, `'queued'`, `'processing'`, `'recorded'`, or `'failed'` |
+| `recording_id` | TEXT | Replay recording ID (set when status is `'recorded'`) |
+| `error_message` | TEXT | Error details (set when status is `'failed'`) |
+| `created_at` | TIMESTAMPTZ | Row creation time |
+| `updated_at` | TIMESTAMPTZ | Last update time |
+
+**Parameters:**
+- `sql` — A Neon SQL tagged-template function
+
+### `backendRequestsInsert(sql, data): Promise<string>`
+
+Inserts a new row into `backend_requests` and returns the generated (or provided) ID.
+
+**Parameters:**
+- `sql` — A Neon SQL tagged-template function
+- `data.blobData` — Serialized blob JSON string
+- `data.handlerPath` — Handler file path
+- `data.commitSha` — Git commit SHA
+- `data.branchName` — Git branch name
+- `data.repositoryUrl` — Git repository URL (optional)
+- `data.id` — Pre-generated UUID (optional; auto-generated if omitted)
+
+### `backendRequestsGet(sql, id): Promise<BackendRequest | null>`
+
+Retrieves a single request by ID, or `null` if not found.
+
+**Parameters:**
+- `sql` — A Neon SQL tagged-template function
+- `id` — The request UUID
+
+### `backendRequestsGetBlobData(sql, id): Promise<string | null>`
 
-Creates callbacks for `finishRequest` that send captured data to the Netlify Recorder service. The service handles blob storage and request tracking.
+Retrieves only the `blob_data` column for a request, or `null` if not found. Use this to serve blob data to the recording container without fetching the full row.
 
 **Parameters:**
-- `serviceUrl` — Base URL of the Netlify Recorder service (e.g. `"https://netlify-recorder-bm4wmw.netlify.app"`)
+- `sql` — A Neon SQL tagged-template function
+- `id` — The request UUID
+
+### `backendRequestsList(sql, filters?): Promise<BackendRequest[]>`
+
+Lists requests ordered by `created_at` DESC, with optional filters.
+
+**Parameters:**
+- `sql` — A Neon SQL tagged-template function
+- `filters.status` — Filter by status (e.g. `"captured"`, `"recorded"`)
+- `filters.limit` — Maximum rows to return (default: 50)
+
+### `backendRequestsUpdateStatus(sql, id, status, recordingId?, errorMessage?): Promise<void>`
+
+Updates the status of a request. Optionally sets `recording_id` (on success) or `error_message` (on failure).
+
+**Parameters:**
+- `sql` — A Neon SQL tagged-template function
+- `id` — The request UUID
+- `status` — New status string
+- `recordingId` — Replay recording ID (optional, for `"recorded"` status)
+- `errorMessage` — Error details (optional, for `"failed"` status)
+
+### `createRequestRecording(blobUrlOrData, handlerPath, requestInfo): Promise<RecordingResult>`
+
+Called inside a recording container running under `replay-node`. Downloads the captured data blob (or accepts pre-parsed `BlobData`), installs replay-mode interceptors that return pre-recorded responses instead of making real calls, and executes the original handler so `replay-node` can record the execution.
+
+Returns a `RecordingResult` with mismatch detection:
+
+| Field | Type | Description |
+|---|---|---|
+| `responseMismatch` | boolean | Whether the replay response differs from the captured response |
+| `mismatchDetails` | string? | Description of the mismatch |
+| `replayResponse` | HandlerResponse? | The response produced during replay |
+| `capturedResponse` | HandlerResponse? | The original captured response |
+| `unconsumedNetworkCalls` | boolean | Whether some recorded network calls were not replayed |
+| `unconsumedNetworkDetails` | string? | Details about unconsumed calls |
+
+**Parameters:**
+- `blobUrlOrData` — URL to the captured data blob, or pre-parsed `BlobData` object
+- `handlerPath` — Path to the handler module to execute
+- `requestInfo` — The original request info to replay
+
+### `getCurrentRequestId(): string | null`
+
+Returns the request ID for the currently executing handler, or `null` if no handler is active. Useful for correlating logs or database operations with the current request.
+
+### `redactBlobData(data): BlobData`
+
+Redacts sensitive environment variable values from captured blob data before storage. Applied automatically by `finishRequest` — you only need to call this directly if using the lower-level APIs.
+
+Redaction rules:
+- Allow-listed keys (standard system/runtime variables like `NODE_ENV`, `PATH`, `COMMIT_SHA`) are never redacted
+- Values that are `undefined` or 8 characters or shorter are kept as-is
+- All other values are replaced with `*` repeated to the same length
+- Redacted values are also scrubbed from all other string fields in the blob (request headers, network call bodies, etc.) to prevent leakage through embedded values
+
+**Parameters:**
+- `data` — A `BlobData` object
+
+**Returns:** A new `BlobData` object with sensitive values masked.
 
 ### `databaseAuditEnsureLogTable(sql): Promise<void>`
 
@@ -403,10 +480,9 @@ These must be set on your Netlify site. Your deploy script should resolve them f
 | `COMMIT_SHA` | Git commit hash of the deployed code | `git rev-parse HEAD` |
 | `BRANCH_NAME` | Git branch of the deployed code | `git rev-parse --abbrev-ref HEAD` |
 | `REPLAY_REPOSITORY_URL` | Git repository URL (no embedded credentials) | `git remote get-url origin` (strip tokens) |
-| `NETLIFY_RECORDER_SECRET` | Secret for access control (strongly recommended) | `openssl rand -base64 32` — store in Netlify site env vars |
 
 ## How It Works
 
-1. **Capture phase** (`createRecordingRequestHandler` or `startRequest` / `finishRequest`): When a Netlify function handles a request, the recording layer patches `globalThis.fetch` and `process.env` with Proxies that record every outbound network call and environment variable read. When the handler completes, the originals are restored, the captured data is serialized to JSON, and sent to the Netlify Recorder service via `remoteCallbacks`.
+1. **Capture phase** (`createRecordingRequestHandler` or `startRequest` / `finishRequest`): When a Netlify function handles a request, the recording layer patches `globalThis.fetch` and `process.env` with Proxies that record every outbound network call and environment variable read. Sensitive environment variable values are automatically redacted. When the handler completes, the originals are restored, the captured data is serialized to JSON, and stored in the `backend_requests` table in your database via `databaseCallbacks`.
 
-2. **Recording phase**: The Netlify Recorder service dispatches the captured data to a recording container. Inside the container, the captured blob is downloaded, replay-mode interceptors return the pre-recorded responses instead of making real calls, and the original handler is re-executed under `replay-node`. Since replay-node records all execution, this produces a Replay recording of the exact same handler execution.
+2. **Recording phase**: To create a Replay recording, POST to the Netlify Recorder service's `create-recording` endpoint with a `blobDataUrl` pointing to the captured data. The service dispatches the work to a recording container, which fetches the blob data from the URL, installs replay-mode interceptors that return pre-recorded responses instead of making real calls, and re-executes the handler under `replay-node`. Since `replay-node` records all execution, this produces a Replay recording of the exact same handler execution. The recording result includes mismatch detection — the service compares the replay response against the originally captured response to flag any divergence.

package/dist/index.d.ts

@@ -93,66 +93,24 @@ interface BlobData {
     handlerResponse?: HandlerResponse$1;
 }
 interface FinishRequestCallbacks {
-    /** Uploads serialized captured data and returns the blob URL. */
-    uploadBlob: (data: string) => Promise<string>;
     /**
-     * Stores request metadata in the database and returns the request ID.
+     * Stores the captured request data and returns the request ID.
      *
      * When `requestId` is provided (from `createRecordingRequestHandler`'s
      * `waitUntil` flow), the callback should use it as the row ID so the
-     * client-facing header and the stored record match.  When omitted, the
-     * callback generates its own ID (backward-compatible).
+     * client-facing header and the stored record match. When omitted, the
+     * callback generates its own ID.
      */
-    storeRequestData: (data: {
-        blobUrl: string;
+    storeRequest: (data: {
+        blobData: string;
         commitSha: string;
         branchName: string;
         repositoryUrl: string;
         handlerPath: string;
         /** Pre-generated request ID. Use as the row ID when provided. */
         requestId?: string;
-        /** Optional secret that restricts access to this request. */
-        secret?: string;
     }) => Promise<string>;
 }
-/**
- * Infrastructure credentials required to start a recording container.
- *
- * The container is started on Fly.io via the `@replayio/app-building` package.
- * It requires Infisical credentials (for secrets management inside the
- * container) and a Fly.io token + app name.
- *
- * These must be set as environment variables on the Netlify site:
- *   INFISICAL_CLIENT_ID, INFISICAL_CLIENT_SECRET,
- *   INFISICAL_PROJECT_ID, INFISICAL_ENVIRONMENT,
- *   FLY_API_TOKEN, FLY_APP_NAME
- */
-interface ContainerInfraConfig {
-    infisicalClientId: string;
-    infisicalClientSecret: string;
-    infisicalProjectId: string;
-    infisicalEnvironment: string;
-    flyToken: string;
-    flyApp: string;
-}
-interface EnsureRecordingOptions {
-    repositoryUrl: string;
-    /** Infrastructure credentials for starting the recording container. */
-    infraConfig?: ContainerInfraConfig;
-    /** Webhook URL the container can POST log entries to (optional). */
-    webhookUrl?: string;
-    /** Looks up request metadata by ID. */
-    lookupRequest: (requestId: string) => Promise<{
-        blobUrl: string;
-        commitSha: string;
-        branchName: string;
-        handlerPath: string;
-    }>;
-    /** Updates the request status (and optionally recording ID) in the database. */
-    updateStatus: (requestId: string, status: string, recordingId?: string) => Promise<void>;
-    /** Optional callback for the caller to emit structured log entries. */
-    onLog?: (level: "info" | "warn" | "error", message: string) => Promise<void>;
-}
 
 /**
  * Called at the beginning of a Netlify handler execution.
@@ -212,32 +170,16 @@ interface FinishRequestOptions {
     repositoryUrl?: string;
     /**
      * Pre-generated request ID. When provided, this ID is passed to the
-     * `storeRequestData` callback so the stored row matches the ID already
+     * `storeRequest` callback so the stored row matches the ID already
      * sent to the client in the `X-Replay-Request-Id` header.
-     *
-     * Used by `createRecordingRequestHandler` in the `waitUntil` flow where
-     * the response is returned before `finishRequest` runs.
      */
     requestId?: string;
-    /**
-     * Optional secret string. When set, the stored request is only
-     * accessible via API calls that provide the same secret value.
-     */
-    secret?: string;
 }
 /**
  * Called at the end of the handler execution.
  * Restores original globals, serializes all captured data,
- * uploads it as a JSON blob via the provided callback,
- * stores the request metadata, and sets the X-Replay-Request-Id header.
- *
- * **Important:** The returned response includes the `X-Replay-Request-Id`
- * header. You must send the returned response to the client — not the
- * original response object you passed in.
- *
- * Logs a warning to `console.warn` when the total finishRequest time or
- * individual callback steps exceed their thresholds, to help diagnose
- * slow blob uploads or database writes.
+ * stores the request via the provided callback, and sets the
+ * X-Replay-Request-Id header.
  */
 declare function finishRequest(requestContext: RequestContext, callbacks: FinishRequestCallbacks, response: FullHandlerResponse, options?: FinishRequestOptions): Promise<FullHandlerResponse>;
 
@@ -254,80 +196,15 @@ interface CreateRecordingRequestHandlerOptions extends FinishRequestOptions {
  *
  * Automatically calls `startRequest` before the handler and `finishRequest`
  * after, capturing all outbound network calls and environment variable reads.
- * On error, interceptors are cleaned up and the error is re-thrown.
+ * The captured data is stored via the provided callbacks.
  *
  * **Response timing:** When the Netlify Functions v2 `context` object is
  * available (with `waitUntil`), the response is returned to the client
  * **immediately** with a pre-generated `X-Replay-Request-Id` header. The
- * blob upload and metadata storage continue in the background via
- * `context.waitUntil()`. This avoids adding latency to the client response.
- *
- * When `context.waitUntil` is not available (v1 handlers or missing context),
- * the wrapper falls back to awaiting `finishRequest` before returning.
- *
- * For v2 handlers the request body is read from a clone internally — your
- * handler still receives the original request with an unconsumed body.
- *
- * @example v1 handler (NetlifyEvent)
- * ```typescript
- * import { createRecordingRequestHandler, remoteCallbacks } from "@replayio-app-building/netlify-recorder";
- *
- * const handler = createRecordingRequestHandler(
- *   async (event) => {
- *     const result = await myBusinessLogic(event.body);
- *     return {
- *       statusCode: 200,
- *       headers: { "Content-Type": "application/json" },
- *       body: JSON.stringify(result),
- *     };
- *   },
- *   {
- *     callbacks: remoteCallbacks("https://netlify-recorder-bm4wmw.netlify.app"),
- *     handlerPath: "netlify/functions/my-handler",
- *   }
- * );
- *
- * export { handler };
- * ```
- *
- * @example v2 handler (Web API Request)
- * ```typescript
- * import { createRecordingRequestHandler, remoteCallbacks } from "@replayio-app-building/netlify-recorder";
- *
- * export default createRecordingRequestHandler(
- *   async (req) => {
- *     // Body is still available — startRequest reads from a clone
- *     const body = await (req as Request).json();
- *     const result = await myBusinessLogic(body);
- *     return {
- *       statusCode: 200,
- *       headers: { "Content-Type": "application/json" },
- *       body: JSON.stringify(result),
- *     };
- *   },
- *   {
- *     callbacks: remoteCallbacks("https://netlify-recorder-bm4wmw.netlify.app"),
- *     handlerPath: "netlify/functions/my-handler",
- *   }
- * );
- * ```
+ * data storage continues in the background via `context.waitUntil()`.
  */
 declare function createRecordingRequestHandler(handler: (event: NetlifyEvent | NetlifyV2Request, context?: unknown) => Promise<HandlerResponse>, options: CreateRecordingRequestHandlerOptions): (event: NetlifyEvent | NetlifyV2Request, context?: unknown) => Promise<HandlerResponse>;
 
-/**
- * Creates `FinishRequestCallbacks` that send captured data to a remote
- * Netlify Recorder service. This removes the need for the consuming app
- * to set up its own blob storage or database tables.
- *
- * The callbacks upload blob data and store request metadata via the
- * service's `/api/store-request` endpoint, which handles UploadThing
- * storage and database insertion.
- *
- * @param serviceUrl - Base URL of the Netlify Recorder service
- *   (e.g. "https://netlify-recorder-bm4wmw.netlify.app")
- */
-declare function remoteCallbacks(serviceUrl: string): FinishRequestCallbacks;
-
 /**
  * Redacts sensitive environment variable values from blob data.
  *
@@ -348,28 +225,6 @@ declare function remoteCallbacks(serviceUrl: string): FinishRequestCallbacks;
  */
 declare function redactBlobData(blobData: BlobData): BlobData;
 
-/**
- * Called by a background function to convert a request ID into a Replay recording ID.
- *
- * The function:
- *  1. Looks up request metadata (blob URL, commit, handler path).
- *  2. Delegates to `spawnRecordingContainer` which starts a detached Fly.io
- *     container, runs the recording script under replay-node, and uploads
- *     the resulting recording.
- *  3. Updates the request status with the recording ID.
- *
- * **Required infrastructure:** Infisical credentials and a Fly.io token/app.
- * See `ContainerInfraConfig` in types.ts for details. When these are not
- * configured the function fails with an actionable error message listing
- * the missing environment variables.
- */
-declare function ensureRequestRecording(requestId: string, options: EnsureRecordingOptions): Promise<string>;
-/**
- * Reads infrastructure config from environment variables.
- * Returns undefined if any required variable is missing.
- */
-declare function readInfraConfigFromEnv(): ContainerInfraConfig | undefined;
-
 interface RecordingResult {
     /** Whether a response mismatch was detected between capture and replay. */
     responseMismatch: boolean;
@@ -394,39 +249,49 @@ interface RecordingResult {
  */
 declare function createRequestRecording(blobUrlOrData: string | BlobData, handlerPath: string, requestInfo: RequestInfo): Promise<RecordingResult>;
 
+type SqlFunction$1 = (...args: any[]) => Promise<any[]>;
+interface BackendRequest {
+    id: string;
+    blob_data: string;
+    handler_path: string;
+    commit_sha: string;
+    branch_name: string;
+    repository_url: string | null;
+    status: string;
+    recording_id: string | null;
+    error_message: string | null;
+    created_at: string;
+    updated_at: string;
+}
 /**
- * Options for spawning a recording container from a blob URL.
- * This is the core building block — it knows nothing about request IDs or databases.
+ * Creates the `backend_requests` table. Call during schema initialization.
+ *
+ * Each package client stores captured request data in its own database
+ * using this table. The blob data (captured network calls, env reads, etc.)
+ * is stored directly in the `blob_data` column rather than in external
+ * blob storage.
  */
-interface SpawnRecordingContainerOptions {
-    /** URL (or data: URI) of the captured request blob JSON. */
-    blobUrl: string;
-    /** Handler file path relative to the app root (e.g. "netlify/functions/generate-haiku"). */
+declare function backendRequestsEnsureTable(sql: SqlFunction$1): Promise<void>;
+declare function backendRequestsInsert(sql: SqlFunction$1, data: {
+    id?: string;
+    blobData: string;
     handlerPath: string;
-    /** Git commit SHA to check out inside the container. */
     commitSha: string;
-    /** Git branch to clone. */
     branchName: string;
-    /** Git repository URL for the app. */
-    repositoryUrl: string;
-    /** Infrastructure credentials for Fly.io + Infisical. */
-    infraConfig: ContainerInfraConfig;
-    /** Optional webhook URL the container can POST log events to. */
-    logWebhookUrl?: string;
-    /** Optional callback for structured log entries. */
-    onLog?: (level: "info" | "warn" | "error", message: string) => Promise<void>;
-}
+    repositoryUrl?: string | null;
+}): Promise<string>;
+declare function backendRequestsGet(sql: SqlFunction$1, id: string): Promise<BackendRequest | null>;
+declare function backendRequestsGetBlobData(sql: SqlFunction$1, id: string): Promise<string | null>;
+declare function backendRequestsList(sql: SqlFunction$1, filters?: {
+    status?: string;
+    limit?: number;
+}): Promise<BackendRequest[]>;
+declare function backendRequestsUpdateStatus(sql: SqlFunction$1, id: string, status: string, recordingId?: string, errorMessage?: string): Promise<void>;
 /**
- * Spawns a detached Fly.io container that:
- *  1. Clones the app repo at the correct branch
- *  2. Checks out the exact commit
- *  3. Runs `scripts/create-request-recording.ts` under replay-node
- *  4. Uploads the resulting recording
- *  5. Outputs the recording ID
- *
- * Returns the recording ID on success, or throws on failure.
+ * Convenience helper: creates `FinishRequestCallbacks` that store
+ * captured request data directly in the `backend_requests` table.
  */
-declare function spawnRecordingContainer(options: SpawnRecordingContainerOptions): Promise<string>;
+declare function databaseCallbacks(sql: SqlFunction$1): FinishRequestCallbacks;
 
 type SqlFunction = (...args: any[]) => Promise<any[]>;
 /**
@@ -451,4 +316,4 @@ declare function databaseAuditDumpLogTable(sql: SqlFunction): Promise<Record<str
 
 declare function getCurrentRequestId(): string | null;
 
-export { type BlobData, type CapturedData, type ContainerInfraConfig, type CreateRecordingRequestHandlerOptions, type EnsureRecordingOptions, type EnvRead, type FinishRequestCallbacks, type FinishRequestOptions, type HandlerResponse$1 as HandlerResponse, type NetlifyEvent, type NetlifyV2Request, type NetworkCall, type RecordingResult, type RequestContext, type RequestInfo, type SpawnRecordingContainerOptions, createRecordingRequestHandler, createRequestRecording, databaseAuditDumpLogTable, databaseAuditEnsureLogTable, databaseAuditMonitorTable, ensureRequestRecording, finishRequest, getCurrentRequestId, readInfraConfigFromEnv, redactBlobData, remoteCallbacks, spawnRecordingContainer, startRequest };
+export { type BackendRequest, type BlobData, type CapturedData, type CreateRecordingRequestHandlerOptions, type EnvRead, type FinishRequestCallbacks, type FinishRequestOptions, type HandlerResponse$1 as HandlerResponse, type NetlifyEvent, type NetlifyV2Request, type NetworkCall, type RecordingResult, type RequestContext, type RequestInfo, backendRequestsEnsureTable, backendRequestsGet, backendRequestsGetBlobData, backendRequestsInsert, backendRequestsList, backendRequestsUpdateStatus, createRecordingRequestHandler, createRequestRecording, databaseAuditDumpLogTable, databaseAuditEnsureLogTable, databaseAuditMonitorTable, databaseCallbacks, finishRequest, getCurrentRequestId, redactBlobData, startRequest };

package/dist/index.js

@@ -490,7 +490,6 @@ function redactBlobData(blobData) {
 
 // src/finishRequest.ts
 var SLOW_THRESHOLD_MS = 2e3;
-var SLOW_STEP_THRESHOLD_MS = 1e3;
 async function finishRequest(requestContext, callbacks, response, options) {
   const finishStart = Date.now();
   requestContext.cleanup();
@@ -535,34 +534,20 @@ async function finishRequest(requestContext, callbacks, response, options) {
   };
   const blobData = redactBlobData(rawBlobData);
   const blobContent = JSON.stringify(blobData);
-  const uploadStart = Date.now();
-  const blobUrl = await callbacks.uploadBlob(blobContent);
-  const uploadDuration = Date.now() - uploadStart;
-  if (uploadDuration > SLOW_STEP_THRESHOLD_MS) {
-    console.warn(
-      `netlify-recorder: uploadBlob took ${uploadDuration}ms (handler: ${handlerPath})`
-    );
-  }
   const storeStart = Date.now();
-  const storedRequestId = await callbacks.storeRequestData({
-    blobUrl,
+  const storedRequestId = await callbacks.storeRequest({
+    blobData: blobContent,
     commitSha,
     branchName,
     repositoryUrl,
     handlerPath,
-    requestId: options?.requestId,
-    secret: options?.secret
+    requestId: options?.requestId
   });
   const storeDuration = Date.now() - storeStart;
-  if (storeDuration > SLOW_STEP_THRESHOLD_MS) {
-    console.warn(
-      `netlify-recorder: storeRequestData took ${storeDuration}ms (handler: ${handlerPath})`
-    );
-  }
   const totalDuration = Date.now() - finishStart;
   if (totalDuration > SLOW_THRESHOLD_MS) {
     console.warn(
-      `netlify-recorder: finishRequest took ${totalDuration}ms total (upload: ${uploadDuration}ms, store: ${storeDuration}ms, handler: ${handlerPath})`
+      `netlify-recorder: finishRequest took ${totalDuration}ms total (store: ${storeDuration}ms, handler: ${handlerPath})`
     );
   }
   return {
@@ -618,284 +603,6 @@ function createRecordingRequestHandler(handler, options) {
   };
 }
 
-// src/remoteCallbacks.ts
-function remoteCallbacks(serviceUrl) {
-  const base = serviceUrl.replace(/\/+$/, "");
-  let pendingBlobData;
-  return {
-    uploadBlob: async (data) => {
-      pendingBlobData = data;
-      return "__pending__";
-    },
-    storeRequestData: async (metadata) => {
-      const blobData = pendingBlobData;
-      pendingBlobData = void 0;
-      if (!blobData) {
-        throw new Error(
-          "remoteCallbacks: uploadBlob must be called before storeRequestData"
-        );
-      }
-      const res = await fetch(
-        `${base}/api/store-request`,
-        {
-          method: "POST",
-          headers: { "Content-Type": "application/json" },
-          body: JSON.stringify({
-            blobData,
-            handlerPath: metadata.handlerPath,
-            commitSha: metadata.commitSha,
-            branchName: metadata.branchName,
-            repositoryUrl: metadata.repositoryUrl,
-            requestId: metadata.requestId,
-            secret: metadata.secret
-          })
-        }
-      );
-      if (!res.ok) {
-        const errBody = await res.text().catch(() => "(unreadable)");
-        throw new Error(
-          `Netlify Recorder store-request failed: ${res.status} ${errBody}`
-        );
-      }
-      const result = await res.json();
-      return result.requestId;
-    }
-  };
-}
-
-// src/spawnRecordingContainer.ts
-async function spawnRecordingContainer(options) {
-  const {
-    blobUrl,
-    handlerPath,
-    commitSha,
-    branchName,
-    repositoryUrl,
-    infraConfig,
-    logWebhookUrl,
-    onLog
-  } = options;
-  const emit = async (level, message) => {
-    if (onLog) {
-      try {
-        await onLog(level, message);
-      } catch {
-      }
-    }
-  };
-  await emit("info", "Logging in to Infisical");
-  const {
-    infisicalLogin,
-    startContainer,
-    FileContainerRegistry,
-    httpGet,
-    httpOptsFor
-  } = await import("@replayio/app-building");
-  const infisicalToken = await infisicalLogin(
-    infraConfig.infisicalClientId,
-    infraConfig.infisicalClientSecret
-  );
-  const infisicalConfig = {
-    token: infisicalToken,
-    projectId: infraConfig.infisicalProjectId,
-    environment: infraConfig.infisicalEnvironment
-  };
-  const registry = new FileContainerRegistry("/tmp/netlify-recorder-containers.json");
-  const initialPrompt = [
-    `IMPORTANT: Follow these steps EXACTLY. Run each command as shown. Print ALL output.`,
-    `Do NOT explore the codebase, read AGENTS.md, or deviate from these steps.`,
-    `Do NOT attempt to debug, fix, shim, or work around ANY errors. If a command fails,`,
-    `print the full error output and move on to the next step. Errors during handler replay`,
-    `(like "No more recorded network calls" or DB errors) are EXPECTED and harmless.`,
-    ``,
-    `=== Step 1: Install dependencies ===`,
-    `cd /repo/apps/netlify-recorder && npm install 2>&1`,
-    ``,
-    `=== Step 2: Checkout the exact commit ===`,
-    `git fetch origin ${commitSha} 2>&1 || git fetch --all 2>&1`,
-    `git checkout ${commitSha} 2>&1`,
-    ``,
-    `=== Step 3: Verify recording script exists ===`,
-    `ls -la /repo/apps/netlify-recorder/scripts/create-request-recording.ts`,
-    `If the file does NOT exist, print "ERROR: create-request-recording.ts not found" and STOP.`,
-    ``,
-    `=== Step 4: Pre-compile for replay-node (Node v16) ===`,
-    `replay-node is Node v16 \u2014 it cannot run TypeScript or use modern APIs directly.`,
-    `You MUST compile everything with esbuild first. Run these commands exactly:`,
-    ``,
-    `# Install undici for web API polyfills (fetch, Headers, Response):`,
-    `cd /repo/apps/netlify-recorder && npm install undici@5 2>&1`,
-    ``,
-    `# Create the polyfill loader:`,
-    `cat > /tmp/web-polyfill.cjs << 'POLYFILL'`,
-    `try {`,
-    `  var u = require("undici");`,
-    `  if (!globalThis.fetch) globalThis.fetch = u.fetch;`,
-    `  if (!globalThis.Headers) globalThis.Headers = u.Headers;`,
-    `  if (!globalThis.Response) globalThis.Response = u.Response;`,
-    `  if (!globalThis.Request) globalThis.Request = u.Request;`,
-    `} catch(e) { console.error("polyfill warning:", e.message); }`,
-    `POLYFILL`,
-    ``,
-    `# Compile the recording script (bundles all local TS dependencies):`,
-    `npx esbuild scripts/create-request-recording.ts \\`,
-    `  --bundle --platform=node --target=node16 --format=cjs \\`,
-    `  --outfile=/tmp/create-recording.cjs 2>&1`,
-    ``,
-    `# Compile the handler (bundles everything including node_modules):`,
-    `npx esbuild ${handlerPath}.ts \\`,
-    `  --bundle --platform=node --target=node16 --format=cjs \\`,
-    `  --outfile=/tmp/handler.cjs 2>&1`,
-    ``,
-    `=== Step 5: Run under replay-node ===`,
-    `This MUST use replay-node so the execution is recorded. Run exactly:`,
-    ``,
-    `cd /repo/apps/netlify-recorder && npx @replayio/node \\`,
-    `  -r /tmp/web-polyfill.cjs /tmp/create-recording.cjs \\`,
-    `  --blob-url '${blobUrl}' \\`,
-    `  --handler-path '/tmp/handler.cjs' 2>&1`,
-    ``,
-    `The output will show captured data being replayed. Errors like "No more recorded`,
-    `network calls" or "DATABASE_URL" errors are EXPECTED \u2014 they come from post-handler`,
-    `DB operations that were not in the original blob. Do NOT try to fix these.`,
-    ``,
-    `=== Step 6: Upload the recording ===`,
-    `exec-secrets RECORD_REPLAY_API_KEY -- npx replayio upload --all 2>&1`,
-    ``,
-    `Find the recording ID (UUID) in the upload output and print:`,
-    `  recording: <recording-id>`,
-    ``,
-    `Then output <DONE>.`
-  ].join("\n");
-  await emit("info", "Starting detached container on Fly.io");
-  const state = await startContainer(
-    {
-      infisical: infisicalConfig,
-      registry,
-      flyToken: infraConfig.flyToken,
-      flyApp: infraConfig.flyApp,
-      detached: true,
-      initialPrompt,
-      webhookUrl: logWebhookUrl
-    },
-    {
-      repoUrl: repositoryUrl,
-      cloneBranch: branchName
-    }
-  );
-  await emit("info", `Container started: ${state.containerName} at ${state.baseUrl}`);
-  const maxWaitMs = 10 * 60 * 1e3;
-  const pollIntervalMs = 1e4;
-  const deadline = Date.now() + maxWaitMs;
-  let containerDone = false;
-  while (Date.now() < deadline) {
-    try {
-      const status = await httpGet(`${state.baseUrl}/status`, httpOptsFor(state));
-      if (status?.state === "stopped" || status?.state === "stopping") {
-        containerDone = true;
-        break;
-      }
-    } catch {
-      containerDone = true;
-      break;
-    }
-    await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
-  }
-  if (!containerDone) {
-    await emit("warn", "Container did not finish within 10 minutes");
-  }
-  let recordingId = null;
-  try {
-    const logs = await httpGet(`${state.baseUrl}/logs?offset=0`, httpOptsFor(state));
-    if (typeof logs === "string") {
-      const match = logs.match(/recording[:\s]+([a-f0-9-]{36})/i);
-      if (match?.[1]) {
-        recordingId = match[1];
-      }
-    }
-  } catch {
-    await emit("warn", "Could not read container logs after exit");
-  }
-  if (!recordingId) {
-    await emit("error", "Container completed but no recording ID was found in output");
-    throw new Error("Recording creation failed: no recording ID returned from container");
-  }
-  await emit("info", `Container completed \u2014 recording ID: ${recordingId}`);
-  return recordingId;
-}
-
-// src/ensureRequestRecording.ts
-async function ensureRequestRecording(requestId, options) {
-  const { repositoryUrl, infraConfig, webhookUrl, lookupRequest, updateStatus, onLog } = options;
-  const emit = async (level, message) => {
-    if (onLog) {
-      try {
-        await onLog(level, message);
-      } catch {
-      }
-    }
-  };
-  await updateStatus(requestId, "processing");
-  try {
-    if (!infraConfig) {
-      const missing = getMissingInfraVars();
-      throw new Error(
-        `Container infrastructure not configured. Missing environment variables: ${missing.join(", ")}. These must be set on the Netlify site for recording creation to work.`
-      );
-    }
-    const requestData = await lookupRequest(requestId);
-    await emit("info", `Request data retrieved \u2014 handler: ${requestData.handlerPath}, branch: ${requestData.branchName}, commit: ${requestData.commitSha}`);
-    const recordingId = await spawnRecordingContainer({
-      blobUrl: requestData.blobUrl,
-      handlerPath: requestData.handlerPath,
-      commitSha: requestData.commitSha,
-      branchName: requestData.branchName,
-      repositoryUrl,
-      infraConfig,
-      logWebhookUrl: webhookUrl,
-      onLog
-    });
-    await emit("info", `Recording created successfully: ${recordingId}`);
-    await updateStatus(requestId, "recorded", recordingId);
-    return recordingId;
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    await emit("error", `Recording creation failed: ${message}`);
-    await updateStatus(requestId, "failed");
-    throw err;
-  }
-}
-function getMissingInfraVars() {
-  const required = [
-    "INFISICAL_CLIENT_ID",
-    "INFISICAL_CLIENT_SECRET",
-    "INFISICAL_PROJECT_ID",
-    "INFISICAL_ENVIRONMENT",
-    "FLY_API_TOKEN",
-    "FLY_APP_NAME"
-  ];
-  return required.filter((name) => !process.env[name]);
-}
-function readInfraConfigFromEnv() {
-  const clientId = process.env.INFISICAL_CLIENT_ID;
-  const clientSecret = process.env.INFISICAL_CLIENT_SECRET;
-  const projectId = process.env.INFISICAL_PROJECT_ID;
-  const environment = process.env.INFISICAL_ENVIRONMENT;
-  const flyToken = process.env.FLY_API_TOKEN;
-  const flyApp = process.env.FLY_APP_NAME;
-  if (!clientId || !clientSecret || !projectId || !environment || !flyToken || !flyApp) {
-    return void 0;
-  }
-  return {
-    infisicalClientId: clientId,
-    infisicalClientSecret: clientSecret,
-    infisicalProjectId: projectId,
-    infisicalEnvironment: environment,
-    flyToken,
-    flyApp
-  };
-}
-
 // src/createRequestRecording.ts
 async function createRequestRecording(blobUrlOrData, handlerPath, requestInfo) {
   let blobData;
@@ -1203,6 +910,131 @@ async function createRequestRecording(blobUrlOrData, handlerPath, requestInfo) {
   return result;
 }
 
+// src/backendRequests.ts
+async function backendRequestsEnsureTable(sql) {
+  await sql`
+    CREATE TABLE IF NOT EXISTS backend_requests (
+      id UUID PRIMARY KEY DEFAULT gen_random_uuid(),
+      blob_data TEXT NOT NULL,
+      handler_path TEXT NOT NULL,
+      commit_sha TEXT NOT NULL,
+      branch_name TEXT NOT NULL DEFAULT 'main',
+      repository_url TEXT,
+      status TEXT NOT NULL DEFAULT 'captured'
+        CHECK (status IN ('captured', 'queued', 'processing', 'recorded', 'failed')),
+      recording_id TEXT,
+      error_message TEXT,
+      created_at TIMESTAMPTZ NOT NULL DEFAULT NOW(),
+      updated_at TIMESTAMPTZ NOT NULL DEFAULT NOW()
+    )
+  `;
+  await sql`
+    CREATE INDEX IF NOT EXISTS idx_backend_requests_status ON backend_requests (status)
+  `;
+  await sql`
+    CREATE INDEX IF NOT EXISTS idx_backend_requests_created_at ON backend_requests (created_at DESC)
+  `;
+}
+async function backendRequestsInsert(sql, data) {
+  if (data.id) {
+    await sql`
+      INSERT INTO backend_requests (id, blob_data, handler_path, commit_sha, branch_name, repository_url)
+      VALUES (
+        ${data.id}::uuid,
+        ${data.blobData},
+        ${data.handlerPath},
+        ${data.commitSha},
+        ${data.branchName},
+        ${data.repositoryUrl ?? null}
+      )
+    `;
+    return data.id;
+  }
+  const rows = await sql`
+    INSERT INTO backend_requests (blob_data, handler_path, commit_sha, branch_name, repository_url)
+    VALUES (
+      ${data.blobData},
+      ${data.handlerPath},
+      ${data.commitSha},
+      ${data.branchName},
+      ${data.repositoryUrl ?? null}
+    )
+    RETURNING id
+  `;
+  return rows[0]?.id ?? "";
+}
+async function backendRequestsGet(sql, id) {
+  const rows = await sql`
+    SELECT id, blob_data, handler_path, commit_sha, branch_name, repository_url,
+           status, recording_id, error_message, created_at, updated_at
+    FROM backend_requests WHERE id = ${id}
+  `;
+  return rows[0] ?? null;
+}
+async function backendRequestsGetBlobData(sql, id) {
+  const rows = await sql`
+    SELECT blob_data FROM backend_requests WHERE id = ${id}
+  `;
+  return rows[0]?.blob_data ?? null;
+}
+async function backendRequestsList(sql, filters) {
+  const limit = filters?.limit ?? 50;
+  if (filters?.status) {
+    const rows2 = await sql`
+      SELECT id, blob_data, handler_path, commit_sha, branch_name, repository_url,
+             status, recording_id, error_message, created_at, updated_at
+      FROM backend_requests
+      WHERE status = ${filters.status}
+      ORDER BY created_at DESC
+      LIMIT ${limit}
+    `;
+    return rows2;
+  }
+  const rows = await sql`
+    SELECT id, blob_data, handler_path, commit_sha, branch_name, repository_url,
+           status, recording_id, error_message, created_at, updated_at
+    FROM backend_requests
+    ORDER BY created_at DESC
+    LIMIT ${limit}
+  `;
+  return rows;
+}
+async function backendRequestsUpdateStatus(sql, id, status, recordingId, errorMessage) {
+  if (recordingId) {
+    await sql`
+      UPDATE backend_requests
+      SET status = ${status}, recording_id = ${recordingId}, updated_at = NOW()
+      WHERE id = ${id}
+    `;
+  } else if (errorMessage) {
+    await sql`
+      UPDATE backend_requests
+      SET status = ${status}, error_message = ${errorMessage}, updated_at = NOW()
+      WHERE id = ${id}
+    `;
+  } else {
+    await sql`
+      UPDATE backend_requests
+      SET status = ${status}, updated_at = NOW()
+      WHERE id = ${id}
+    `;
+  }
+}
+function databaseCallbacks(sql) {
+  return {
+    storeRequest: async (data) => {
+      return backendRequestsInsert(sql, {
+        id: data.requestId,
+        blobData: data.blobData,
+        handlerPath: data.handlerPath,
+        commitSha: data.commitSha,
+        branchName: data.branchName,
+        repositoryUrl: data.repositoryUrl
+      });
+    }
+  };
+}
+
 // src/databaseAudit.ts
 async function databaseAuditEnsureLogTable(sql) {
   await sql`
@@ -1283,17 +1115,20 @@ async function databaseAuditDumpLogTable(sql) {
   return rows;
 }
 export {
+  backendRequestsEnsureTable,
+  backendRequestsGet,
+  backendRequestsGetBlobData,
+  backendRequestsInsert,
+  backendRequestsList,
+  backendRequestsUpdateStatus,
   createRecordingRequestHandler,
   createRequestRecording,
   databaseAuditDumpLogTable,
   databaseAuditEnsureLogTable,
   databaseAuditMonitorTable,
-  ensureRequestRecording,
+  databaseCallbacks,
   finishRequest,
   getCurrentRequestId,
-  readInfraConfigFromEnv,
   redactBlobData,
-  remoteCallbacks,
-  spawnRecordingContainer,
   startRequest
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@replayio-app-building/netlify-recorder",
-  "version": "0.17.0",
+  "version": "0.18.0",
   "description": "Capture and replay Netlify function executions as Replay recordings",
   "type": "module",
   "exports": {