@reproapp/node-sdk 0.0.47 → 0.0.48

package/test/semantic-serialization.test.js

@@ -0,0 +1,229 @@
+const assert = require('node:assert/strict');
+const { __reproTestHooks } = require('../dist');
+
+const {
+    projectSemanticInfrastructureValueForTest: project,
+    sanitizeTraceValueForPrivacyForTest: sanitize,
+} = __reproTestHooks;
+
+class Logger {
+    constructor(context) {
+        this.context = context;
+        this.internalBuffer = Array.from({ length: 100 }, () => 'log-internal-state');
+    }
+
+    log() {}
+}
+
+class ConfigService {
+    constructor() {
+        this.cache = {
+            SENDGRID_API_KEY: 'secret-sendgrid-value-that-must-not-be-captured',
+            DATABASE_URL: 'mongodb://user:password@database/repro',
+        };
+        this.internalConfig = {
+            infrastructure: Array.from({ length: 500 }, (_, index) => ({
+                index,
+                secret: `internal-secret-${index}`,
+                nested: { socket: { host: 'database.internal', port: 27017 } },
+            })),
+        };
+    }
+
+    get(key) {
+        return this.cache[key];
+    }
+}
+
+class ApiConfigService {
+    constructor(configService) {
+        this.configService = configService;
+    }
+
+    getDatabaseConfig() {
+        return this.configService.get('DATABASE_URL');
+    }
+}
+
+class GlobalUserRepository {
+    constructor(apiConfigService) {
+        this.apiConfigService = apiConfigService;
+    }
+}
+
+class UserService {
+    constructor(globalUserRepository) {
+        this.globalUserRepository = globalUserRepository;
+        this.logger = new Logger('UserService');
+    }
+}
+
+class StudyConfigService {
+    constructor(userService) {
+        this.userService = userService;
+    }
+}
+
+class BlindingMailerService {
+    constructor() {
+        this.logger = new Logger('BlindingMailerService');
+        this.fromEmail = 'automated@example.test';
+    }
+}
+
+class SiteStatusChangedGenerator {
+    constructor(configService) {
+        this.blindingMailerService = new BlindingMailerService();
+        this.logger = new Logger('SiteStatusChangedGenerator');
+        this.studyConfigService = new StudyConfigService(
+            new UserService(new GlobalUserRepository(new ApiConfigService(configService))),
+        );
+        this.triggerAction = 'SiteStatusChanged';
+    }
+}
+
+class ClinicalShipmentDto {
+    constructor() {
+        this.shipmentNumber = 'SHIP-10023';
+        this.site = {
+            number: 'SITE-0042',
+            address: {
+                country: {
+                    code: 'US',
+                    regulatory: { region: 'FDA', enabled: true },
+                },
+            },
+        };
+        this.kits = Array.from({ length: 40 }, (_, index) => ({
+            kitNumber: `KIT-${String(index).padStart(4, '0')}`,
+            status: index % 2 ? 'released' : 'available',
+            temperature: { minC: 2, maxC: 8 },
+        }));
+    }
+}
+
+class PricingService {
+    constructor() {
+        this.price = 125;
+        this.currency = 'USD';
+        this.breakdown = { base: 100, tax: 25 };
+    }
+}
+
+class DeliveryClient {
+    send() {}
+    connect() {}
+    disconnect() {}
+}
+
+class RuntimeConfigService {
+    constructor() {
+        Object.defineProperty(this, 'dangerousGetter', {
+            enumerable: true,
+            get() {
+                throw new Error('semantic projection invoked an application getter');
+            },
+        });
+    }
+
+    get() {
+        return 'value';
+    }
+}
+
+class RedisClient {
+    get() {}
+    set() {}
+    pipeline() {}
+}
+
+class KafkaProducer {
+    connect() {}
+    disconnect() {}
+    send() {}
+}
+
+class ChannelModel {
+    publish() {}
+    sendToQueue() {}
+    ack() {}
+}
+
+class Pool {
+    query() {}
+    connect() {}
+    end() {}
+}
+
+class DataSource {
+    createQueryRunner() {}
+}
+
+function main() {
+    const configService = new ConfigService();
+    const generator = new SiteStatusChangedGenerator(configService);
+    const businessDto = new ClinicalShipmentDto();
+
+    const rawJson = JSON.stringify([generator, businessDto]);
+    const captured = sanitize([generator, businessDto]);
+    const capturedJson = JSON.stringify(captured);
+
+    assert.equal(captured[0].__class, 'SiteStatusChangedGenerator');
+    assert.equal(captured[0].triggerAction, 'SiteStatusChanged');
+    assert.equal(captured[0].blindingMailerService.fromEmail, 'automated@example.test');
+    assert.deepEqual(captured[0].logger, {
+        __kind: 'repro-semantic',
+        category: 'logger',
+        className: 'Logger',
+        context: 'SiteStatusChangedGenerator',
+    });
+    assert.deepEqual(
+        captured[0]
+            .studyConfigService
+            .userService
+            .globalUserRepository
+            .apiConfigService
+            .configService,
+        {
+            __kind: 'repro-semantic',
+            category: 'configuration-service',
+            className: 'ConfigService',
+        },
+    );
+    assert(!capturedJson.includes('secret-sendgrid-value-that-must-not-be-captured'));
+    assert(!capturedJson.includes('internal-secret-499'));
+
+    assert.deepEqual(
+        { ...captured[1], __class: undefined },
+        { ...JSON.parse(JSON.stringify(businessDto)), __class: undefined },
+        'business DTOs must remain byte-for-byte equivalent after JSON serialization',
+    );
+
+    assert(
+        Buffer.byteLength(capturedJson) < Buffer.byteLength(rawJson) * 0.15,
+        `semantic capture did not reduce infrastructure graph enough: raw=${Buffer.byteLength(rawJson)} captured=${Buffer.byteLength(capturedJson)}`,
+    );
+
+    assert.equal(project(configService).value.category, 'configuration-service');
+    assert.equal(project(new Logger('test')).value.category, 'logger');
+    assert.equal(project(new RedisClient()).value.category, 'redis-client');
+    assert.equal(project(new KafkaProducer()).value.category, 'kafka-producer');
+    assert.equal(project(new ChannelModel()).value.category, 'amqp-channel');
+    assert.equal(project(new Pool()).value.category, 'postgres-pool');
+    assert.equal(project(new DataSource()).value.category, 'typeorm-infrastructure');
+    assert.equal(project(new DeliveryClient()), null, 'generic clients must not be mistaken for Kafka');
+
+    assert.equal(project(new PricingService()), null, 'data-only application classes must remain complete');
+    assert.deepEqual(
+        sanitize(new PricingService()),
+        { ...JSON.parse(JSON.stringify(new PricingService())), __class: 'PricingService' },
+        'data-only application classes must not be semantically projected',
+    );
+
+    assert.doesNotThrow(() => project(new RuntimeConfigService()));
+    assert.equal(project(new RuntimeConfigService()).value.category, 'configuration-service');
+
+    console.log('semantic serialization adversarial coverage OK');
+}
+
+main();

package/test/session-storage-budget.test.js

@@ -0,0 +1,298 @@
+process.env.REPRO_SDK_BACKGROUND_MAX_DEFER_MS = '50';
+process.env.REPRO_SDK_BACKGROUND_IDLE_DELAY_MS = '0';
+process.env.REPRO_SDK_BACKGROUND_BUSY_IDLE_DELAY_MS = '0';
+process.env.REPRO_SDK_TRACE_INLINE_VALUE_MAX_SERIALIZED_CHARS = '2048';
+process.env.REPRO_TRACE_BATCH_MAX_SERIALIZED_BYTES = '65536';
+process.env.TRACE_IDLE_FLUSH_MS = '10';
+process.env.TRACE_LINGER_AFTER_FINISH_MS = '0';
+
+const assert = require('node:assert/strict');
+const { EventEmitter } = require('node:events');
+const { initReproTracing, reproMiddleware, __reproTestHooks } = require('../dist');
+const { flushIngestQueue } = require('../dist/ingest/client');
+
+const CALL_COUNT = 120;
+const UNIQUE_PAYLOAD_COUNT = 12;
+
+const byteLength = (value) => Buffer.byteLength(JSON.stringify(value), 'utf8');
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+class ConfigService {
+    constructor() {
+        this.cache = {
+            DATABASE_URL: 'mongodb://runtime-user:runtime-password@database/repro',
+            SENDGRID_API_KEY: 'SG.runtime-secret',
+        };
+        this.internalConfig = Array.from({ length: 1500 }, (_, index) => ({
+            index,
+            tenant: `TENANT-${index}`,
+            connection: {
+                host: `mongo-${index % 3}.internal`,
+                password: `runtime-password-${index}`,
+            },
+        }));
+    }
+
+    get(key) {
+        return this.cache[key];
+    }
+}
+
+class Logger {
+    constructor(context) {
+        this.context = context;
+        this.buffers = Array.from({ length: 500 }, (_, index) => ({
+            index,
+            line: `runtime-log-buffer-${index}`,
+        }));
+    }
+
+    log() {}
+}
+
+class ShipmentWorkflowService {
+    constructor() {
+        this.configService = new ConfigService();
+        this.logger = new Logger('ShipmentWorkflowService');
+        this.workflow = 'clinical-supply-release';
+    }
+}
+
+function makeBusinessPayload(variant) {
+    return {
+        shipmentNumber: `SHIP-STORAGE-${String(variant).padStart(4, '0')}`,
+        protocol: {
+            id: 'PROTOCOL-1001',
+            version: 7,
+            countries: ['US', 'CA', 'DE', 'FR'],
+        },
+        kits: Array.from({ length: 180 }, (_, index) => ({
+            kitNumber: `KIT-${variant}-${String(index).padStart(5, '0')}`,
+            depot: `DEPOT-${index % 8}`,
+            site: {
+                number: `SITE-${index % 35}`,
+                country: { code: index % 2 ? 'US' : 'CA', region: 'GxP' },
+            },
+            status: index % 3 === 0 ? 'released' : 'available',
+            temperature: { minimumC: 2, maximumC: 8 },
+        })),
+        audit: {
+            actor: `USER-${variant}`,
+            correlationId: `CORRELATION-${variant}`,
+            reason: 'release-after-quality-review',
+        },
+    };
+}
+
+function inspectShipment(_service, payload) {
+    return payload;
+}
+
+function makeReqRes() {
+    const req = new EventEmitter();
+    req.method = 'POST';
+    req.url = '/storage-budget';
+    req.originalUrl = req.url;
+    req.headers = {
+        'x-bug-session-id': 'S_storage_budget',
+        'x-bug-action-id': 'A_storage_budget',
+        'x-bug-request-start': String(Date.now()),
+    };
+    req.body = {};
+    req.params = {};
+    req.query = {};
+
+    const res = new EventEmitter();
+    res.statusCode = 204;
+    res.getHeader = () => undefined;
+    res.getHeaders = () => ({});
+    res.setHeader = () => {};
+    res.write = () => true;
+    res.end = function end() {
+        this.emit('finish');
+        return this;
+    };
+    return { req, res };
+}
+
+function captureRef(event) {
+    if (event.type === 'enter') return event.argsValueCapture;
+    if (event.type === 'exit') return event.returnValueCapture;
+    return null;
+}
+
+async function main() {
+    const posts = [];
+    const originalFetch = global.fetch;
+    global.fetch = async (_url, init = {}) => {
+        posts.push(JSON.parse(String(init.body || '{}')));
+        return {
+            ok: true,
+            status: 202,
+            json: async () => ({ ok: true }),
+            text: async () => '{"ok":true}',
+        };
+    };
+
+    const config = {
+        tenantId: 'TENANT_storage_budget',
+        appId: 'APP_storage_budget',
+        appSecret: 'storage-budget-secret',
+        captureHeaders: false,
+        privacy: { environment: 'dev', captureRaw: true },
+        ingestBase: 'http://127.0.0.1:65535',
+    };
+    const service = new ShipmentWorkflowService();
+    const payloads = Array.from(
+        { length: UNIQUE_PAYLOAD_COUNT },
+        (_, index) => makeBusinessPayload(index),
+    );
+
+    try {
+        initReproTracing({ instrument: false, fullValueCapture: true, logFunctionCalls: false });
+        __reproTestHooks.resetSdkBackgroundQueuesForTest();
+        const middleware = reproMiddleware(config);
+        const { req, res } = makeReqRes();
+
+        await new Promise((resolve, reject) => {
+            middleware(req, res, (error) => {
+                if (error) {
+                    reject(error);
+                    return;
+                }
+                try {
+                    for (let index = 0; index < CALL_COUNT; index += 1) {
+                        const payload = payloads[index % payloads.length];
+                        const result = global.__repro_call(
+                            inspectShipment,
+                            null,
+                            [service, payload],
+                            '/app/src/shipment-workflow.service.ts',
+                            145,
+                            'inspectShipment',
+                            false,
+                        );
+                        assert.strictEqual(result, payload, 'tracing changed return-value identity');
+                    }
+                    res.end();
+                    resolve();
+                } catch (traceError) {
+                    reject(traceError);
+                }
+            });
+        });
+
+        const deadline = Date.now() + 8000;
+        while (Date.now() < deadline) {
+            const events = posts.flatMap((post) => post.events || []);
+            const trace = events
+                .filter((event) => event.event_type === 'trace_batch')
+                .flatMap((event) => event.payload?.trace || []);
+            if (trace.filter((event) => event.fn === 'inspectShipment').length === CALL_COUNT * 2) {
+                break;
+            }
+            await sleep(20);
+        }
+        await __reproTestHooks.drainSdkBackgroundQueueForTest();
+        await flushIngestQueue();
+
+        const ingestEvents = posts.flatMap((post) => post.events || []);
+        const traceBatches = ingestEvents.filter((event) => event.event_type === 'trace_batch');
+        const traceEvents = traceBatches
+            .flatMap((event) => event.payload?.trace || [])
+            .filter((event) => event.fn === 'inspectShipment');
+        const definitions = traceBatches.flatMap((event) => event.payload?.traceValues || []);
+        const definitionsById = new Map(definitions.map((definition) => [definition.id, definition]));
+
+        assert.equal(traceEvents.length, CALL_COUNT * 2, 'trace occurrence evidence was dropped');
+        assert.equal(
+            definitionsById.size,
+            UNIQUE_PAYLOAD_COUNT * 2,
+            'expected one args and one return definition per unique business payload',
+        );
+
+        const resolvedOccurrences = [];
+        for (const event of traceEvents) {
+            const ref = captureRef(event);
+            assert.equal(ref?.status, 'stored', `missing value ref for ${event.type}`);
+            const definition = definitionsById.get(ref.valueId);
+            assert(definition, `unresolved captured value ${ref.valueId}`);
+            resolvedOccurrences.push(definition.value);
+
+            const expectedVariant = Math.floor(resolvedOccurrences.length > 0
+                ? (resolvedOccurrences.length - 1) / 2
+                : 0) % UNIQUE_PAYLOAD_COUNT;
+            if (event.type === 'enter') {
+                assert.deepEqual(definition.value[1], payloads[expectedVariant]);
+                assert.deepEqual(definition.value[0].configService, {
+                    __kind: 'repro-semantic',
+                    category: 'configuration-service',
+                    className: 'ConfigService',
+                });
+                assert.deepEqual(definition.value[0].logger, {
+                    __kind: 'repro-semantic',
+                    category: 'logger',
+                    className: 'Logger',
+                    context: 'ShipmentWorkflowService',
+                });
+            } else {
+                assert.deepEqual(definition.value, payloads[expectedVariant]);
+            }
+        }
+
+        const rawRuntimeBytes = byteLength(service);
+        const projectedRuntime = definitions.find((definition) => definition.target === 'trace.args')
+            ?.value?.[0];
+        assert(projectedRuntime, 'missing projected service argument');
+        const projectedRuntimeBytes = byteLength(projectedRuntime);
+        assert(
+            projectedRuntimeBytes < rawRuntimeBytes * 0.02,
+            `runtime projection budget exceeded: ${projectedRuntimeBytes}/${rawRuntimeBytes}`,
+        );
+
+        const legacyOccurrenceValueBytes = traceEvents.reduce((total, event) => {
+            const definition = definitionsById.get(captureRef(event).valueId);
+            return total + byteLength(definition.value);
+        }, 0);
+        const optimizedDefinitionBytes = Array.from(definitionsById.values())
+            .reduce((total, definition) => total + byteLength(definition.value), 0);
+        const optimizedRefBytes = traceEvents.reduce(
+            (total, event) => total + byteLength(captureRef(event)),
+            0,
+        );
+        const optimizedValueBytes = optimizedDefinitionBytes + optimizedRefBytes;
+        const reduction = 1 - optimizedValueBytes / legacyOccurrenceValueBytes;
+
+        assert(
+            reduction > 0.85,
+            `content-addressed value storage reduced only ${(reduction * 100).toFixed(1)}%`,
+        );
+        const serializedCapture = JSON.stringify(posts);
+        assert(!serializedCapture.includes('runtime-password-1499'));
+        assert(!serializedCapture.includes('SG.runtime-secret'));
+        assert(serializedCapture.includes('KIT-11-00179'));
+
+        console.log('session storage budget OK', JSON.stringify({
+            calls: CALL_COUNT,
+            valueOccurrences: traceEvents.length,
+            uniqueDefinitions: definitionsById.size,
+            legacyOccurrenceValueBytes,
+            optimizedValueBytes,
+            contentAddressedReductionPercent: Number((reduction * 100).toFixed(2)),
+            rawRuntimeBytes,
+            projectedRuntimeBytes,
+            runtimeProjectionReductionPercent: Number(
+                ((1 - projectedRuntimeBytes / rawRuntimeBytes) * 100).toFixed(2),
+            ),
+        }));
+    } finally {
+        await __reproTestHooks.drainSdkBackgroundQueueForTest().catch(() => {});
+        await flushIngestQueue().catch(() => {});
+        global.fetch = originalFetch;
+    }
+}
+
+main().catch((error) => {
+    console.error(error);
+    process.exit(1);
+});

package/test/trace-batch-size.test.js

@@ -76,6 +76,39 @@ function main() {
     assert.strictEqual(cappedEvents[500].fn, 'fn1000');
     assert.strictEqual(cappedEvents[cappedEvents.length - 1].fn, 'fn1499');
 
+    const distinctLargeValueEvents = Array.from({ length: 24 }, (_, index) => ({
+        ...makeEvent(index, { __kind: 'omitted', reason: 'inline-size-limit' }),
+        argsValueCapture: {
+            status: 'stored',
+            valueId: `rv1_${String(index).padStart(40, '0')}`,
+        },
+        __reproTraceValueEntries: [
+            {
+                id: `rv1_${String(index).padStart(40, '0')}`,
+                target: 'trace.args',
+                value: [{ index, exact: `VALUE-${index}`, body: 'z'.repeat(300 * 1024) }],
+                truncatedForStorage: false,
+            },
+        ],
+    }));
+    const distinctLargeValueBatches = __reproTestHooks.chunkTraceEventsForTransportForTest(
+        distinctLargeValueEvents,
+        'RID_distinct_large_values',
+        'A_distinct_large_values',
+    );
+    assert.equal(
+        distinctLargeValueBatches.flat().length,
+        distinctLargeValueEvents.length,
+        'byte-based splitting must not apply the old ten-batch evidence cap',
+    );
+    assert(
+        distinctLargeValueBatches.length > 10,
+        `fixture did not exercise more than ten batches: ${distinctLargeValueBatches.length}`,
+    );
+    for (const [index, event] of distinctLargeValueBatches.flat().entries()) {
+        assert.equal(event.__reproTraceValueEntries[0].value[0].exact, `VALUE-${index}`);
+    }
+
     // eslint-disable-next-line no-console
     console.log('trace batch size chunking OK');
 }