@reproapp/node-sdk 0.0.45 → 0.0.47

package/dist/ingest/client.js

@@ -107,6 +107,9 @@ const selectSendBatch = (queue) => {
     if (first.priority === 'normal') {
         return { batch: first, queueItems: 1 };
     }
+    if (first.attempts > 0) {
+        return { batch: first, queueItems: 1 };
+    }
     const entries = first.entries.slice();
     let bytes = serializedBytes(entries);
     let queueItems = 1;
@@ -309,6 +312,14 @@ const drainIngestQueue = async () => {
                 backoffMs = 0;
                 continue;
             }
+            if (batch.priority === 'high' &&
+                selected.queueItems === 1 &&
+                ingestQueue.length > 1) {
+                const [failedItem] = ingestQueue.splice(0, 1);
+                if (failedItem) {
+                    ingestQueue.push(failedItem);
+                }
+            }
             backoffMs = Math.min(DEFAULT_QUEUE_BACKOFF_MAX_MS, backoffMs ? backoffMs * 2 : 250);
             scheduleDrain(backoffMs);
             return;

package/dist/privacy.d.ts

@@ -77,6 +77,7 @@ export type NormalizedRuntimePrivacyPolicy = {
     strength?: 'weak' | 'medium' | 'strict';
     statements: NormalizedStatement[];
     rawTextHints: NormalizedRawTextHint[];
+    fingerprint: string;
 };
 export declare function clearRuntimePrivacyProvenance(): void;
 export type RuntimePrivacyFetchResult = {

package/dist/privacy.js

@@ -7,7 +7,10 @@ const privacy_redaction_1 = require("./privacy-redaction");
 const EMPTY_RUNTIME_PRIVACY_POLICY = {
     statements: [],
     rawTextHints: [],
+    fingerprint: 'empty',
 };
+const runtimePrivacyStatementIndexes = new WeakMap();
+const RUNTIME_PRIVACY_CANDIDATE_CACHE_MAX_ENTRIES = 2048;
 const RUNTIME_PRIVACY_PROVENANCE_MAX_ENTRIES = 1000;
 const RUNTIME_PRIVACY_PROVENANCE_MAX_SERIALIZED_LENGTH = 200000;
 let objectRuntimePrivacyProvenance = new WeakMap();
@@ -165,21 +168,24 @@ function normalizeRuntimePrivacyPolicy(raw) {
     const policy = raw;
     const flattened = flattenStatements(policy);
     const rawTextHints = normalizeRawTextHints(policy.rawTextHints);
-    const statements = flattened
+    const statements = deduplicateNormalizedStatements(flattened
         .map((entry, index) => normalizeStatement(entry, index))
         .filter((entry) => entry !== null)
-        .sort((left, right) => left.priority - right.priority);
+        .sort((left, right) => left.priority - right.priority));
     if (!statements.length) {
         return null;
     }
-    return {
+    const normalizedPolicy = {
         environment: typeof policy.environment === 'string' ? policy.environment : undefined,
         strength: policy.strength === 'weak' || policy.strength === 'medium' || policy.strength === 'strict'
             ? policy.strength
             : undefined,
         statements,
         rawTextHints,
+        fingerprint: runtimePrivacyPolicyFingerprint(typeof policy.environment === 'string' ? policy.environment : undefined, typeof policy.strength === 'string' ? policy.strength : undefined, statements, rawTextHints),
     };
+    runtimePrivacyStatementIndexes.set(normalizedPolicy, buildRuntimePrivacyStatementIndex(statements));
+    return normalizedPolicy;
 }
 exports.normalizeRuntimePrivacyPolicy = normalizeRuntimePrivacyPolicy;
 function applyRuntimePrivacyPolicy(policy, surface, value, context) {
@@ -267,6 +273,287 @@ function normalizeStatement(input, index) {
         descendantRawTextMode: normalizeRawTextMode(input?.apply?.descendantRawTextMode ?? input?.descendantRawTextMode),
     };
 }
+function deduplicateNormalizedStatements(statements) {
+    const seen = new Set();
+    const deduplicated = [];
+    for (const statement of statements) {
+        const key = normalizedStatementSemanticKey(statement);
+        if (seen.has(key)) {
+            continue;
+        }
+        seen.add(key);
+        deduplicated.push(statement);
+    }
+    return deduplicated;
+}
+function normalizedStatementSemanticKey(statement) {
+    return JSON.stringify({
+        scope: statement.scope,
+        selectorTokens: statement.selectorTokens,
+        selectorLeaves: statement.selectorLeaves,
+        action: statement.action,
+        pattern: statement.pattern
+            ? {
+                source: statement.pattern.source,
+                flags: statement.pattern.flags,
+            }
+            : null,
+        targetMatchers: statement.targetMatchers.map((matcher) => ({
+            surfaces: matcher.surfaces,
+            path: matcher.path,
+        })),
+        textPolicy: statement.textPolicy ?? null,
+        rawTextMode: statement.rawTextMode ?? null,
+        rawTextHintNames: statement.rawTextHintNames ?? null,
+        descendantRawTextMode: statement.descendantRawTextMode ?? null,
+    });
+}
+function runtimePrivacyPolicyFingerprint(environment, strength, statements, rawTextHints) {
+    const serialized = JSON.stringify({
+        environment: environment ?? null,
+        strength: strength ?? null,
+        statements: statements.map(normalizedStatementSemanticKey),
+        rawTextHints: rawTextHints.map((hint) => ({
+            name: hint.name,
+            action: hint.action,
+            pattern: hint.pattern.source,
+            flags: hint.pattern.flags,
+            tokenLabel: hint.tokenLabel,
+        })),
+    });
+    return (0, crypto_1.createHash)('sha256').update(serialized).digest('hex');
+}
+function createFunctionStatementTrieNode() {
+    return {
+        children: new Map(),
+        terminal: [],
+        subtree: [],
+    };
+}
+function appendUniqueStatement(target, statement) {
+    if (!target.includes(statement)) {
+        target.push(statement);
+    }
+}
+function functionSelectorSegments(value) {
+    return normalizeFunctionSelector(value)
+        .split('.')
+        .map((segment) => segment.trim())
+        .filter(Boolean)
+        .reverse();
+}
+function addFunctionStatementToTrie(root, selector, statement) {
+    const segments = functionSelectorSegments(selector);
+    if (!segments.length) {
+        return;
+    }
+    let node = root;
+    for (const segment of segments) {
+        let child = node.children.get(segment);
+        if (!child) {
+            child = createFunctionStatementTrieNode();
+            node.children.set(segment, child);
+        }
+        node = child;
+        appendUniqueStatement(node.subtree, statement);
+    }
+    appendUniqueStatement(node.terminal, statement);
+}
+function createRuntimePrivacySurfaceIndex() {
+    return {
+        contextualStatements: [],
+        fieldStatementsBySuffix: new Map(),
+        fieldWildcardTargetStatements: [],
+    };
+}
+function appendStatementToMap(target, key, statement) {
+    if (!key) {
+        return;
+    }
+    const current = target.get(key);
+    if (current) {
+        appendUniqueStatement(current, statement);
+        return;
+    }
+    target.set(key, [statement]);
+}
+function explicitTargetSurfaces(statement) {
+    if (!statement.targetMatchers.length) {
+        return null;
+    }
+    return new Set(statement.targetMatchers.flatMap((matcher) => matcher.surfaces));
+}
+function scopeCanMatchSurface(statement, surface) {
+    if (statement.scope === 'FUNCTION') {
+        return surface.startsWith('trace.');
+    }
+    if (statement.scope === 'ROUTE') {
+        return surface.startsWith('request.') || surface === 'response.body';
+    }
+    if (statement.scope === 'SCHEMA' || statement.scope === 'QUERY') {
+        return surface.startsWith('db.');
+    }
+    return true;
+}
+function addFieldStatementToSurfaceIndex(index, statement) {
+    for (const selector of statement.selectorLeaves) {
+        appendStatementToMap(index.fieldStatementsBySuffix, normalizeComparableToken(selector), statement);
+    }
+    for (const matcher of statement.targetMatchers) {
+        const terminal = matcher.path?.[matcher.path.length - 1];
+        if (!terminal) {
+            continue;
+        }
+        if (terminal === '*') {
+            appendUniqueStatement(index.fieldWildcardTargetStatements, statement);
+            continue;
+        }
+        appendStatementToMap(index.fieldStatementsBySuffix, normalizeComparableToken(terminal), statement);
+    }
+}
+function buildRuntimePrivacyStatementIndex(statements) {
+    const bySurface = new Map(ALL_SURFACES.map((surface) => [surface, createRuntimePrivacySurfaceIndex()]));
+    const functionStatements = createFunctionStatementTrieNode();
+    let hasNumericTargetSegments = false;
+    for (const statement of statements) {
+        for (const matcher of statement.targetMatchers) {
+            if (matcher.path?.some((segment) => /^\d+$/.test(segment))) {
+                hasNumericTargetSegments = true;
+            }
+        }
+        if (statement.scope === 'FUNCTION') {
+            for (const selector of statement.selectorTokens) {
+                addFunctionStatementToTrie(functionStatements, selector, statement);
+            }
+            continue;
+        }
+        const targetSurfaces = explicitTargetSurfaces(statement);
+        for (const surface of ALL_SURFACES) {
+            if (!scopeCanMatchSurface(statement, surface)) {
+                continue;
+            }
+            // FIELD protections deliberately have cross-surface fallback semantics.
+            if (statement.scope !== 'FIELD' &&
+                targetSurfaces &&
+                !targetSurfaces.has(surface)) {
+                continue;
+            }
+            const surfaceIndex = bySurface.get(surface);
+            if (statement.scope === 'FIELD') {
+                addFieldStatementToSurfaceIndex(surfaceIndex, statement);
+            }
+            else {
+                appendUniqueStatement(surfaceIndex.contextualStatements, statement);
+            }
+        }
+    }
+    return {
+        bySurface,
+        functionStatements,
+        candidateCache: new Map(),
+        hasNumericTargetSegments,
+    };
+}
+function getRuntimePrivacyStatementIndex(policy) {
+    const existing = runtimePrivacyStatementIndexes.get(policy);
+    if (existing) {
+        return existing;
+    }
+    const created = buildRuntimePrivacyStatementIndex(policy.statements);
+    runtimePrivacyStatementIndexes.set(policy, created);
+    return created;
+}
+function matchingFunctionStatements(root, functionName) {
+    const segments = functionSelectorSegments(functionName);
+    if (!segments.length) {
+        return [];
+    }
+    const matches = new Set();
+    let node = root;
+    for (let index = 0; index < segments.length; index += 1) {
+        node = node.children.get(segments[index]);
+        if (!node) {
+            break;
+        }
+        for (const statement of node.terminal) {
+            matches.add(statement);
+        }
+        if (index === segments.length - 1) {
+            for (const statement of node.subtree) {
+                matches.add(statement);
+            }
+        }
+    }
+    return Array.from(matches);
+}
+function normalizedPathSuffixes(path, preserveNumericSegments) {
+    const joined = path
+        .filter((segment) => segment !== '*' &&
+        (preserveNumericSegments || !/^\d+$/.test(segment)))
+        .map(normalizeComparableToken)
+        .filter(Boolean)
+        .join('.');
+    if (!joined) {
+        return [];
+    }
+    const segments = joined.split('.').filter(Boolean);
+    const suffixes = [];
+    for (let index = 0; index < segments.length; index += 1) {
+        suffixes.push(segments.slice(index).join('.'));
+    }
+    return suffixes;
+}
+function runtimePrivacyCandidateCacheKey(index, surface, context, path) {
+    const pathKey = path
+        .map((segment) => !index.hasNumericTargetSegments && /^\d+$/.test(segment)
+        ? '*'
+        : segment)
+        .join('.');
+    return [
+        surface,
+        normalizeFunctionSelector(context.trace?.fn?.trim() ?? ''),
+        context.routeKey?.trim() ?? '',
+        String(context.db?.type ?? ''),
+        String(context.db?.collection ?? ''),
+        String(context.db?.op ?? ''),
+        pathKey,
+    ].join('\u0000');
+}
+function candidateStatementsForMatch(policy, surface, context, path) {
+    const index = getRuntimePrivacyStatementIndex(policy);
+    const cacheKey = runtimePrivacyCandidateCacheKey(index, surface, context, path);
+    const cached = index.candidateCache.get(cacheKey);
+    if (cached) {
+        return cached;
+    }
+    const surfaceIndex = index.bySurface.get(surface);
+    const candidateSet = new Set(surfaceIndex?.contextualStatements ?? []);
+    if (surfaceIndex && path.length) {
+        for (const suffix of normalizedPathSuffixes(path, index.hasNumericTargetSegments)) {
+            for (const statement of surfaceIndex.fieldStatementsBySuffix.get(suffix) ?? []) {
+                candidateSet.add(statement);
+            }
+        }
+        for (const statement of surfaceIndex.fieldWildcardTargetStatements) {
+            candidateSet.add(statement);
+        }
+    }
+    if (surface.startsWith('trace.')) {
+        const functionName = context.trace?.fn?.trim() ?? '';
+        if (functionName) {
+            for (const statement of matchingFunctionStatements(index.functionStatements, functionName)) {
+                candidateSet.add(statement);
+            }
+        }
+    }
+    const candidates = Array.from(candidateSet)
+        .sort((left, right) => left.priority - right.priority);
+    if (index.candidateCache.size >= RUNTIME_PRIVACY_CANDIDATE_CACHE_MAX_ENTRIES) {
+        index.candidateCache.clear();
+    }
+    index.candidateCache.set(cacheKey, candidates);
+    return candidates;
+}
 function resolveEffectiveAction(baseAction, value, path) {
     const safetyFloor = deriveSensitiveLeafFloorAction(value, path);
     if (!safetyFloor) {
@@ -938,7 +1225,7 @@ async function transformSerializedStructuredStringAsChildrenAsync(policy, surfac
 }
 function matchStatement(policy, surface, value, context, path) {
     let candidates = [];
-    for (const statement of policy.statements) {
+    for (const statement of candidateStatementsForMatch(policy, surface, context, path)) {
         if (shouldIgnoreBroadContainerRuleOnDescendant(statement, surface, path)) {
             continue;
         }
@@ -1247,14 +1534,26 @@ function querySelectorMatches(selectors, surface, context) {
 function patternMatches(pattern, leaf, joinedPath, value) {
     if (!pattern)
         return false;
-    if (leaf && pattern.test(leaf))
+    if (leaf && testRuntimePrivacyPattern(pattern, leaf))
         return true;
-    if (joinedPath && pattern.test(joinedPath))
+    if (joinedPath && testRuntimePrivacyPattern(pattern, joinedPath))
         return true;
-    if (typeof value === 'string' && pattern.test(value))
+    if (typeof value === 'string' && testRuntimePrivacyPattern(pattern, value))
         return true;
     return false;
 }
+function testRuntimePrivacyPattern(pattern, value) {
+    // Generated policies may contain global/sticky expressions. RegExp.test mutates
+    // lastIndex for those flags, which otherwise makes identical captures alternate
+    // between matched and unmatched.
+    pattern.lastIndex = 0;
+    try {
+        return pattern.test(value);
+    }
+    finally {
+        pattern.lastIndex = 0;
+    }
+}
 function functionSelectorMatches(selector, fn) {
     const normalizedSelector = normalizeFunctionSelector(selector);
     const normalizedFn = normalizeFunctionSelector(fn);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reproapp/node-sdk",
-  "version": "0.0.45",
+  "version": "0.0.47",
   "description": "Repro Nest SDK",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -12,8 +12,8 @@
     "build": "tsc -p tsconfig.json",
     "dev": "tsc -p tsconfig.json --watch --preserveWatchOutput",
     "prepublishOnly": "npm run build",
-    "test": "npm run build && node test/unawaited.test.js && node test/integration-unawaited.js && node test/request-flush-timing.test.js && node test/request-capture-background.test.js && node test/init-auto-http-server.test.js && node test/backend-live-mode.test.js && node test/client-performance-regression.test.js && node test/request-manifest-priority.test.js && node test/runtime-no-double-invoke.test.js && node test/express-trace-http-args.test.js && node test/trace-batch-size.test.js && node test/sdk-background-priority.test.js && node test/runtime-service-registration.test.js && node test/ingest-queue-retention.test.js && node test/ingest-high-priority-retention.test.js && node test/ingest-critical-retention.test.js && node test/ingest-critical-retry-retention.test.js && node test/ingest-batching.test.js && node test/ingest-timeout.test.js && node -r ./tracer/register test/promise-map.test.js && node test/disable-subtree.test.js && node test/circular-capture.test.js && node test/wrap-plugin-arrow-args.test.js && node test/wrap-plugin-super-call.test.js && node test/function-arg-identity.test.js && node test/privacy-service-scope.test.js && node test/privacy-runtime-policy.test.js && node test/runtime-privacy-materialization.test.js && node test/kafka-runtime-privacy-policy.test.js && node test/amqplib-integration.test.js && node test/mongodb-integration.test.js && node test/mongodb-esm-import-hook.test.js && node test/mongodb-suppression-cleanup.test.js && node test/postgresql-integration.test.js",
-    "test:containers": "npm run build && node test/runtime-no-double-invoke.testcontainers.test.js && node test/wrap-plugin-super-call.testcontainers.test.js && node test/function-arg-identity.testcontainers.test.js && node test/mongodb-mongoose-native-suppression.testcontainers.test.js && node test/postgresql-integrations.testcontainers.test.js"
+    "test": "npm run build && node test/trace-source-exclude.test.js && node test/unawaited.test.js && node test/integration-unawaited.js && node test/request-flush-timing.test.js && node test/request-capture-background.test.js && node test/init-auto-http-server.test.js && node test/backend-live-mode.test.js && node test/client-performance-regression.test.js && node test/request-manifest-priority.test.js && node test/runtime-no-double-invoke.test.js && node test/express-trace-http-args.test.js && node test/trace-batch-size.test.js && node test/sdk-background-priority.test.js && node test/sdk-background-timeout-isolation.test.js && node test/runtime-service-registration.test.js && node test/ingest-queue-retention.test.js && node test/ingest-high-priority-retention.test.js && node test/ingest-high-priority-fairness.test.js && node test/ingest-critical-retention.test.js && node test/ingest-critical-retry-retention.test.js && node test/ingest-batching.test.js && node test/ingest-timeout.test.js && node -r ./tracer/register test/promise-map.test.js && node test/disable-subtree.test.js && node test/circular-capture.test.js && node test/wrap-plugin-arrow-args.test.js && node test/wrap-plugin-super-call.test.js && node test/function-arg-identity.test.js && node test/privacy-service-scope.test.js && node test/privacy-policy-index.test.js && node test/policy-capture-attestation.test.js && node test/privacy-runtime-policy.test.js && node test/runtime-privacy-materialization.test.js && node test/kafka-runtime-privacy-policy.test.js && node test/amqplib-integration.test.js && node test/mongodb-integration.test.js && node test/mongodb-esm-import-hook.test.js && node test/mongodb-suppression-cleanup.test.js && node test/postgresql-integration.test.js",
+    "test:containers": "npm run build && node test/runtime-no-double-invoke.testcontainers.test.js && node test/wrap-plugin-super-call.testcontainers.test.js && node test/function-arg-identity.testcontainers.test.js && node test/mongodb-mongoose-native-suppression.testcontainers.test.js && node test/policy-session-completion.testcontainers.test.js && node test/postgresql-integrations.testcontainers.test.js"
   },
   "peerDependencies": {
     "express": "^5.1.0",