@reproapp/node-sdk 0.0.48 → 0.0.49

package/dist/index.d.ts

@@ -299,6 +299,7 @@ type RequestCaptureScopeState = {
     privacyPolicyFingerprint?: string;
     privacyStatementCount: number;
     emittedValueDefinitionIds: Set<string>;
+    traceObservationSnapshots: Map<string, any>;
 };
 type BackendLiveTimingConfig = {
     sessionMaxDurationMs: number;

package/dist/index.js

@@ -839,6 +839,7 @@ function createRequestCaptureScope(requestRid, transport, cfg) {
         privacyPolicyFingerprint: privacy?.fingerprint,
         privacyStatementCount: privacy?.statements.length ?? 0,
         emittedValueDefinitionIds: new Set(),
+        traceObservationSnapshots: new Map(),
     };
 }
 function recordRequestCaptureFailure(scope, stage, target, reason) {
@@ -2810,6 +2811,61 @@ function normalizeRawTraceArgs(values) {
 function hasMeaningfulRawTraceError(error) {
     return error !== undefined && error !== null;
 }
+const TRACE_OBSERVATION_SNAPSHOT = Symbol('repro.traceObservationSnapshot');
+// Trace events can remain queued after user code mutates the observed objects.
+// Intern immutable semantic snapshots per request so temporal evidence stays
+// correct without retaining another full copy for repeated unchanged values.
+function internTraceObservationSnapshot(snapshot, captureScope) {
+    if (!captureScope || snapshot === null || typeof snapshot !== 'object') {
+        return snapshot;
+    }
+    const serialized = stableSerializeTraceValue(snapshot);
+    if (serialized === null)
+        return snapshot;
+    const digest = (0, crypto_1.createHash)('sha256')
+        .update('repro-trace-observation-v1\0')
+        .update(serialized)
+        .digest('hex');
+    const existing = captureScope.traceObservationSnapshots.get(digest);
+    if (existing !== undefined)
+        return existing;
+    captureScope.traceObservationSnapshots.set(digest, snapshot);
+    return snapshot;
+}
+function snapshotTraceValueAtObservation(value, captureScope, valuePath = '$', target = 'trace.value') {
+    try {
+        const snapshot = sanitizeTraceValue(value, 0, new WeakMap(), { preserveLongStrings: true, disableTruncation: true }, valuePath);
+        return internTraceObservationSnapshot(snapshot, captureScope);
+    }
+    catch {
+        recordRequestCaptureFailure(captureScope, 'trace.snapshot', target, 'snapshot_failed');
+        return makeOmittedValue('capture-snapshot-failed');
+    }
+}
+function snapshotTraceArgsAtObservation(values, captureScope) {
+    const snapshot = snapshotTraceValueAtObservation(normalizeRawTraceArgs(values), captureScope, '$', 'trace.args');
+    return Array.isArray(snapshot) ? snapshot : [snapshot];
+}
+function snapshotRawTraceEventAtObservation(raw, captureScope) {
+    if (!raw || typeof raw !== 'object' || raw[TRACE_OBSERVATION_SNAPSHOT] === true) {
+        return raw;
+    }
+    const snapshot = { ...raw };
+    if (raw.args !== undefined) {
+        snapshot.args = snapshotTraceArgsAtObservation(raw.args, captureScope);
+    }
+    if (raw.returnValue !== undefined) {
+        snapshot.returnValue = snapshotTraceValueAtObservation(raw.returnValue, captureScope, '$', 'trace.returnValue');
+    }
+    if (hasMeaningfulRawTraceError(raw.error)) {
+        snapshot.error = snapshotTraceValueAtObservation(raw.error, captureScope, '$', 'trace.error');
+    }
+    Object.defineProperty(snapshot, TRACE_OBSERVATION_SNAPSHOT, {
+        value: true,
+        enumerable: false,
+    });
+    return snapshot;
+}
 function attachTraceValueEntry(event, entry) {
     const current = event[TRACE_FULL_VALUE_ENTRY_SYMBOL];
     if (Array.isArray(current)) {
@@ -4774,21 +4830,25 @@ function reproMiddleware(cfg) {
             res.on('close', endTrackedClientRequest);
             return next(); // only capture tagged requests
         }
-        const captureCfg = backendLiveChild
-            ? {
+        let captureCfg = cfg;
+        if (backendLiveChild) {
+            captureCfg = {
                 ...cfg,
                 actorId: backendLiveChild.actorId,
                 actorType: backendLiveChild.actorType,
                 actorLabels: backendLiveChild.actorLabels,
-            }
-            : taggedActorIdentity
-                ? {
-                    ...cfg,
-                    actorId: taggedActorIdentity.actorId,
-                    actorType: taggedActorIdentity.actorType,
-                    actorLabels: taggedActorIdentity.actorLabels,
-                }
-                : cfg;
+            };
+            shareRuntimePrivacyState(cfg, captureCfg);
+        }
+        else if (taggedActorIdentity) {
+            captureCfg = {
+                ...cfg,
+                actorId: taggedActorIdentity.actorId,
+                actorType: taggedActorIdentity.actorType,
+                actorLabels: taggedActorIdentity.actorLabels,
+            };
+            shareRuntimePrivacyState(cfg, captureCfg);
+        }
         if (taggedActorIdentity) {
             post(captureCfg, sid, {
                 entries: [{
@@ -5262,17 +5322,17 @@ function reproMiddleware(cfg) {
                                 evt.__reproPending = {
                                     ...(ev.args !== undefined
                                         ? {
-                                            argsRaw: normalizeRawTraceArgs(ev.args),
+                                            argsRaw: snapshotTraceArgsAtObservation(ev.args, captureScope),
                                         }
                                         : {}),
                                     ...(ev.returnValue !== undefined
                                         ? {
-                                            returnValueRaw: ev.returnValue,
+                                            returnValueRaw: snapshotTraceValueAtObservation(ev.returnValue, captureScope, '$', 'trace.returnValue'),
                                         }
                                         : {}),
                                     ...(hasErrorPayload
                                         ? {
-                                            errorRaw: ev.error,
+                                            errorRaw: snapshotTraceValueAtObservation(ev.error, captureScope, '$', 'trace.error'),
                                         }
                                         : {}),
                                 };
@@ -6621,6 +6681,7 @@ function recordKafkaTraceEvent(raw, sink, cfg, maskReq) {
 function buildPendingKafkaTraceEvent(raw) {
     if (!raw || (raw.type !== 'enter' && raw.type !== 'exit'))
         return null;
+    raw = snapshotRawTraceEventAtObservation(raw, getCtx().captureScope);
     const sourceFileForLibrary = typeof raw.sourceFile === 'string' && raw.sourceFile
         ? String(raw.sourceFile)
         : null;
@@ -7054,7 +7115,7 @@ function wrapKafkaEachMessageHandler(eachMessage, cfg, consumer) {
                     unsubscribe = __TRACER__.tracer.on((event) => {
                         if (!event || event.traceId !== traceId)
                             return;
-                        rawTraceEvents.push(event);
+                        rawTraceEvents.push(snapshotRawTraceEventAtObservation(event, captureScope));
                     });
                 }
                 catch { }
@@ -7168,7 +7229,7 @@ function wrapKafkaEachBatchHandler(eachBatch, cfg, consumer) {
                     unsubscribe = __TRACER__.tracer.on((event) => {
                         if (!event || event.traceId !== traceId)
                             return;
-                        rawTraceEvents.push(event);
+                        rawTraceEvents.push(snapshotRawTraceEventAtObservation(event, captureScope));
                     });
                 }
                 catch { }
@@ -7886,7 +7947,7 @@ function wrapAmqplibConsumeHandler(onMessage, cfg, queue) {
                 unsubscribe = __TRACER__.tracer.on((event) => {
                     if (!event || event.traceId !== traceId)
                         return;
-                    rawTraceEvents.push(event);
+                    rawTraceEvents.push(snapshotRawTraceEventAtObservation(event, captureScope));
                 });
             }
             catch { }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reproapp/node-sdk",
-  "version": "0.0.48",
+  "version": "0.0.49",
   "description": "Repro Nest SDK",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -12,7 +12,7 @@
     "build": "tsc -p tsconfig.json",
     "dev": "tsc -p tsconfig.json --watch --preserveWatchOutput",
     "prepublishOnly": "npm run build",
-    "test": "npm run build && node test/semantic-serialization.test.js && node test/semantic-serialization-trace.test.js && node test/content-addressed-trace-values.test.js && node test/session-storage-budget.test.js && node test/trace-source-exclude.test.js && node test/unawaited.test.js && node test/integration-unawaited.js && node test/request-flush-timing.test.js && node test/request-capture-background.test.js && node test/init-auto-http-server.test.js && node test/backend-live-mode.test.js && node test/client-performance-regression.test.js && node test/request-manifest-priority.test.js && node test/runtime-no-double-invoke.test.js && node test/express-trace-http-args.test.js && node test/trace-batch-size.test.js && node test/sdk-background-priority.test.js && node test/sdk-background-timeout-isolation.test.js && node test/runtime-service-registration.test.js && node test/ingest-queue-retention.test.js && node test/ingest-high-priority-retention.test.js && node test/ingest-high-priority-fairness.test.js && node test/ingest-critical-retention.test.js && node test/ingest-critical-retry-retention.test.js && node test/ingest-batching.test.js && node test/ingest-timeout.test.js && node -r ./tracer/register test/promise-map.test.js && node test/disable-subtree.test.js && node test/circular-capture.test.js && node test/wrap-plugin-arrow-args.test.js && node test/wrap-plugin-super-call.test.js && node test/function-arg-identity.test.js && node test/privacy-service-scope.test.js && node test/privacy-policy-index.test.js && node test/policy-capture-attestation.test.js && node test/privacy-runtime-policy.test.js && node test/runtime-privacy-materialization.test.js && node test/kafka-runtime-privacy-policy.test.js && node test/amqplib-integration.test.js && node test/mongodb-integration.test.js && node test/mongodb-esm-import-hook.test.js && node test/mongodb-suppression-cleanup.test.js && node test/postgresql-integration.test.js",
+    "test": "npm run build && node test/semantic-serialization.test.js && node test/semantic-serialization-trace.test.js && node test/content-addressed-trace-values.test.js && node test/trace-observation-snapshots.test.js && node test/session-storage-budget.test.js && node test/trace-source-exclude.test.js && node test/unawaited.test.js && node test/integration-unawaited.js && node test/request-flush-timing.test.js && node test/request-capture-background.test.js && node test/init-auto-http-server.test.js && node test/backend-live-mode.test.js && node test/client-performance-regression.test.js && node test/request-manifest-priority.test.js && node test/runtime-no-double-invoke.test.js && node test/express-trace-http-args.test.js && node test/trace-batch-size.test.js && node test/sdk-background-priority.test.js && node test/sdk-background-timeout-isolation.test.js && node test/runtime-service-registration.test.js && node test/ingest-queue-retention.test.js && node test/ingest-high-priority-retention.test.js && node test/ingest-high-priority-fairness.test.js && node test/ingest-critical-retention.test.js && node test/ingest-critical-retry-retention.test.js && node test/ingest-batching.test.js && node test/ingest-timeout.test.js && node -r ./tracer/register test/promise-map.test.js && node test/disable-subtree.test.js && node test/circular-capture.test.js && node test/wrap-plugin-arrow-args.test.js && node test/wrap-plugin-super-call.test.js && node test/function-arg-identity.test.js && node test/privacy-service-scope.test.js && node test/privacy-policy-index.test.js && node test/policy-capture-attestation.test.js && node test/privacy-runtime-policy.test.js && node test/runtime-privacy-materialization.test.js && node test/kafka-runtime-privacy-policy.test.js && node test/amqplib-integration.test.js && node test/mongodb-integration.test.js && node test/mongodb-esm-import-hook.test.js && node test/mongodb-suppression-cleanup.test.js && node test/postgresql-integration.test.js",
     "test:containers": "npm run build && node test/runtime-no-double-invoke.testcontainers.test.js && node test/wrap-plugin-super-call.testcontainers.test.js && node test/function-arg-identity.testcontainers.test.js && node test/mongodb-mongoose-native-suppression.testcontainers.test.js && node test/content-addressed-mongodb.testcontainers.test.js && node test/policy-session-completion.testcontainers.test.js && node test/postgresql-integrations.testcontainers.test.js"
   },
   "peerDependencies": {

package/src/index.ts

@@ -2,7 +2,7 @@ import type { Request, Response, NextFunction } from 'express';
 import type { Schema, Model, Query } from 'mongoose';
 import * as mongoose from 'mongoose';
 import { AsyncLocalStorage } from 'async_hooks';
-import { createHmac, randomUUID } from 'crypto';
+import { createHash, createHmac, randomUUID } from 'crypto';
 import { createRequire } from 'module';
 import { join } from 'path';
 import { pathToFileURL } from 'url';
@@ -1228,6 +1228,7 @@ type RequestCaptureScopeState = {
     privacyPolicyFingerprint?: string;
     privacyStatementCount: number;
     emittedValueDefinitionIds: Set<string>;
+    traceObservationSnapshots: Map<string, any>;
 };
 
 function createRequestCaptureScope(
@@ -1256,6 +1257,7 @@ function createRequestCaptureScope(
         privacyPolicyFingerprint: privacy?.fingerprint,
         privacyStatementCount: privacy?.statements.length ?? 0,
         emittedValueDefinitionIds: new Set(),
+        traceObservationSnapshots: new Map(),
     };
 }
 
@@ -3403,6 +3405,107 @@ function hasMeaningfulRawTraceError(error: any): boolean {
     return error !== undefined && error !== null;
 }
 
+const TRACE_OBSERVATION_SNAPSHOT = Symbol('repro.traceObservationSnapshot');
+
+// Trace events can remain queued after user code mutates the observed objects.
+// Intern immutable semantic snapshots per request so temporal evidence stays
+// correct without retaining another full copy for repeated unchanged values.
+function internTraceObservationSnapshot(
+    snapshot: any,
+    captureScope?: RequestCaptureScopeState | null,
+): any {
+    if (!captureScope || snapshot === null || typeof snapshot !== 'object') {
+        return snapshot;
+    }
+
+    const serialized = stableSerializeTraceValue(snapshot);
+    if (serialized === null) return snapshot;
+
+    const digest = createHash('sha256')
+        .update('repro-trace-observation-v1\0')
+        .update(serialized)
+        .digest('hex');
+    const existing = captureScope.traceObservationSnapshots.get(digest);
+    if (existing !== undefined) return existing;
+
+    captureScope.traceObservationSnapshots.set(digest, snapshot);
+    return snapshot;
+}
+
+function snapshotTraceValueAtObservation(
+    value: any,
+    captureScope?: RequestCaptureScopeState | null,
+    valuePath = '$',
+    target = 'trace.value',
+): any {
+    try {
+        const snapshot = sanitizeTraceValue(
+            value,
+            0,
+            new WeakMap(),
+            { preserveLongStrings: true, disableTruncation: true },
+            valuePath,
+        );
+        return internTraceObservationSnapshot(snapshot, captureScope);
+    } catch {
+        recordRequestCaptureFailure(
+            captureScope,
+            'trace.snapshot',
+            target,
+            'snapshot_failed',
+        );
+        return makeOmittedValue('capture-snapshot-failed');
+    }
+}
+
+function snapshotTraceArgsAtObservation(
+    values: any,
+    captureScope?: RequestCaptureScopeState | null,
+): any[] {
+    const snapshot = snapshotTraceValueAtObservation(
+        normalizeRawTraceArgs(values),
+        captureScope,
+        '$',
+        'trace.args',
+    );
+    return Array.isArray(snapshot) ? snapshot : [snapshot];
+}
+
+function snapshotRawTraceEventAtObservation(
+    raw: any,
+    captureScope?: RequestCaptureScopeState | null,
+): any {
+    if (!raw || typeof raw !== 'object' || raw[TRACE_OBSERVATION_SNAPSHOT] === true) {
+        return raw;
+    }
+
+    const snapshot = { ...raw };
+    if (raw.args !== undefined) {
+        snapshot.args = snapshotTraceArgsAtObservation(raw.args, captureScope);
+    }
+    if (raw.returnValue !== undefined) {
+        snapshot.returnValue = snapshotTraceValueAtObservation(
+            raw.returnValue,
+            captureScope,
+            '$',
+            'trace.returnValue',
+        );
+    }
+    if (hasMeaningfulRawTraceError(raw.error)) {
+        snapshot.error = snapshotTraceValueAtObservation(
+            raw.error,
+            captureScope,
+            '$',
+            'trace.error',
+        );
+    }
+    Object.defineProperty(snapshot, TRACE_OBSERVATION_SNAPSHOT, {
+        value: true,
+        enumerable: false,
+    });
+    return snapshot;
+}
+
 function attachTraceValueEntry(
     event: TraceEventRecord | PendingTraceEventRecord,
     entry: TraceValueBatchEntry,
@@ -6046,21 +6149,24 @@ export function reproMiddleware(cfg: ReproMiddlewareConfig) {
             res.on('close', endTrackedClientRequest);
             return next(); // only capture tagged requests
         }
-        const captureCfg: ReproMiddlewareConfig = backendLiveChild
-            ? {
+        let captureCfg: ReproMiddlewareConfig = cfg;
+        if (backendLiveChild) {
+            captureCfg = {
                 ...cfg,
                 actorId: backendLiveChild.actorId,
                 actorType: backendLiveChild.actorType,
                 actorLabels: backendLiveChild.actorLabels,
-            }
-            : taggedActorIdentity
-                ? {
-                    ...cfg,
-                    actorId: taggedActorIdentity.actorId,
-                    actorType: taggedActorIdentity.actorType,
-                    actorLabels: taggedActorIdentity.actorLabels,
-                }
-            : cfg;
+            };
+            shareRuntimePrivacyState(cfg, captureCfg);
+        } else if (taggedActorIdentity) {
+            captureCfg = {
+                ...cfg,
+                actorId: taggedActorIdentity.actorId,
+                actorType: taggedActorIdentity.actorType,
+                actorLabels: taggedActorIdentity.actorLabels,
+            };
+            shareRuntimePrivacyState(cfg, captureCfg);
+        }
         if (taggedActorIdentity) {
             post(captureCfg, sid, {
                 entries: [{
@@ -6588,17 +6694,27 @@ export function reproMiddleware(cfg: ReproMiddlewareConfig) {
                                 evt.__reproPending = {
                                     ...(ev.args !== undefined
                                         ? {
-                                            argsRaw: normalizeRawTraceArgs(ev.args),
+                                            argsRaw: snapshotTraceArgsAtObservation(ev.args, captureScope),
                                         }
                                         : {}),
                                     ...(ev.returnValue !== undefined
                                         ? {
-                                            returnValueRaw: ev.returnValue,
+                                            returnValueRaw: snapshotTraceValueAtObservation(
+                                                ev.returnValue,
+                                                captureScope,
+                                                '$',
+                                                'trace.returnValue',
+                                            ),
                                         }
                                         : {}),
                                     ...(hasErrorPayload
                                         ? {
-                                            errorRaw: ev.error,
+                                            errorRaw: snapshotTraceValueAtObservation(
+                                                ev.error,
+                                                captureScope,
+                                                '$',
+                                                'trace.error',
+                                            ),
                                         }
                                         : {}),
                                 };
@@ -8094,6 +8210,8 @@ function recordKafkaTraceEvent(
 function buildPendingKafkaTraceEvent(raw: any): PendingTraceEventRecord | null {
     if (!raw || (raw.type !== 'enter' && raw.type !== 'exit')) return null;
 
+    raw = snapshotRawTraceEventAtObservation(raw, getCtx().captureScope);
+
     const sourceFileForLibrary =
         typeof raw.sourceFile === 'string' && raw.sourceFile
             ? String(raw.sourceFile)
@@ -8574,7 +8692,7 @@ function wrapKafkaEachMessageHandler(eachMessage: any, cfg: KafkaJsPatchConfig,
                 try {
                     unsubscribe = __TRACER__.tracer.on((event: any) => {
                         if (!event || event.traceId !== traceId) return;
-                        rawTraceEvents.push(event);
+                        rawTraceEvents.push(snapshotRawTraceEventAtObservation(event, captureScope));
                     });
                 } catch {}
             }
@@ -8684,7 +8802,7 @@ function wrapKafkaEachBatchHandler(eachBatch: any, cfg: KafkaJsPatchConfig, cons
                 try {
                     unsubscribe = __TRACER__.tracer.on((event: any) => {
                         if (!event || event.traceId !== traceId) return;
-                        rawTraceEvents.push(event);
+                        rawTraceEvents.push(snapshotRawTraceEventAtObservation(event, captureScope));
                     });
                 } catch {}
             }
@@ -9492,7 +9610,7 @@ function wrapAmqplibConsumeHandler(onMessage: any, cfg: AmqplibPatchConfig, queu
             try {
                 unsubscribe = __TRACER__.tracer.on((event: any) => {
                     if (!event || event.traceId !== traceId) return;
-                    rawTraceEvents.push(event);
+                    rawTraceEvents.push(snapshotRawTraceEventAtObservation(event, captureScope));
                 });
             } catch {}
         };

package/test/content-addressed-mongodb.testcontainers.test.js

@@ -215,6 +215,7 @@ async function main() {
         const middleware = reproMiddleware(config);
         const { req, res } = makeReqRes('S_content_addressed_mongo', 'A_content_addressed_mongo');
         const repository = new SubjectRepository(Subject, new ConfigService());
+        const queryInput = { subjectNumber: 'SUBJECT-CONTENT-1001' };
         let operationResult;
 
         await new Promise((resolve, reject) => {
@@ -227,12 +228,14 @@ async function main() {
                     operationResult = await global.__repro_call(
                         loadSubjectRepeatedly,
                         null,
-                        [repository, { subjectNumber: 'SUBJECT-CONTENT-1001' }],
+                        [repository, queryInput],
                         '/app/src/subjects.repository.ts',
                         120,
                         'loadSubjectRepeatedly',
                         false,
                     );
+                    queryInput.subjectNumber = 'MUTATED-AFTER-TRACE-EXIT';
+                    operationResult.docs[0].status = 'mutated-after-trace-exit';
                     res.end();
                     resolve();
                 } catch (operationError) {
@@ -313,15 +316,31 @@ async function main() {
         const argsDefinition = traceDefinitions.find((entry) =>
             entry.id === enter.argsValueCapture?.valueId
         );
-        assert(argsDefinition, JSON.stringify(traceDefinitions));
-        assert.deepEqual(argsDefinition.value[0].configService, {
+        const capturedArgs = argsDefinition?.value ?? enter.args;
+        assert(Array.isArray(capturedArgs), JSON.stringify(enter));
+        assert.deepEqual(capturedArgs[0].configService, {
             __kind: 'repro-semantic',
             category: 'configuration-service',
             className: 'ConfigService',
         });
-        assert.equal(argsDefinition.value[1].subjectNumber, 'SUBJECT-CONTENT-1001');
+        assert.equal(capturedArgs[1].subjectNumber, 'SUBJECT-CONTENT-1001');
+
+        const exit = traceEvents.find((event) =>
+            event.fn === 'loadSubjectRepeatedly' && event.type === 'exit'
+        );
+        assert(exit, JSON.stringify(traceEvents));
+        const returnDefinition = traceDefinitions.find((entry) =>
+            entry.id === exit.returnValueCapture?.valueId
+        );
+        assert(returnDefinition, JSON.stringify({
+            exit,
+            definitions: traceDefinitions.map((entry) => ({ id: entry.id, target: entry.target })),
+        }));
+        assert.equal(returnDefinition.value.docs[0].status, 'screened');
 
         const capturedJson = JSON.stringify(posts);
+        assert(!capturedJson.includes('MUTATED-AFTER-TRACE-EXIT'));
+        assert(!capturedJson.includes('mutated-after-trace-exit'));
         assert(!capturedJson.includes('captured-config-secret'));
         assert(!capturedJson.includes('mongo-config-credential-999'));
         assert(!capturedJson.includes('mongo-test-logger-buffer'));

package/test/kafka-runtime-privacy-policy.test.js

@@ -145,10 +145,19 @@ async function testKafkaConsumerTraceUsesConsumeTraceId() {
             privacy: { environment: 'dev' },
             ingestBase: 'http://127.0.0.1:65535',
         };
+        const consumerPayload = {
+            marker: 'before-consumer-work',
+            repeated: 'consumer-trace-value'.repeat(1024),
+        };
         const wrapped = __reproTestHooks.wrapKafkaEachMessageHandlerForTest(
             async () => {
-                tracer.tracer.enter('consumerWork', { file: '/app/consumer.ts', line: 10 }, { args: ['ok'] });
-                tracer.tracer.exit({ fn: 'consumerWork', file: '/app/consumer.ts', line: 10 }, { returnValue: 'done' });
+                tracer.tracer.enter('consumerWork', { file: '/app/consumer.ts', line: 10 }, { args: [consumerPayload] });
+                consumerPayload.marker = 'at-consumer-exit';
+                tracer.tracer.exit(
+                    { fn: 'consumerWork', file: '/app/consumer.ts', line: 10 },
+                    { args: [consumerPayload], returnValue: consumerPayload },
+                );
+                consumerPayload.marker = 'after-consumer-exit';
 
                 tracer.withTrace('parent-http-trace', () => {
                     tracer.tracer.enter('parentWork', { file: '/app/controller.ts', line: 20 }, { args: ['wrong'] });
@@ -207,6 +216,21 @@ async function testKafkaConsumerTraceUsesConsumeTraceId() {
             .map((traceEvent) => traceEvent.fn);
         assert(traceFns.includes('consumerWork'), traceFns.join(','));
         assert(!traceFns.includes('parentWork'), traceFns.join(','));
+
+        const traceBatches = events.filter((event) => event.event_type === 'trace_batch');
+        const traceEvents = traceBatches.flatMap((event) => event.payload?.trace || []);
+        const definitions = traceBatches.flatMap((event) => event.payload?.traceValues || []);
+        const definitionsById = new Map(definitions.map((definition) => [definition.id, definition]));
+        const consumerEnter = traceEvents.find((event) => event.fn === 'consumerWork' && event.type === 'enter');
+        const consumerExit = traceEvents.find((event) => event.fn === 'consumerWork' && event.type === 'exit');
+        assert(consumerEnter && consumerExit, JSON.stringify(traceEvents));
+        const enterValue = definitionsById.get(consumerEnter.argsValueCapture?.valueId)?.value;
+        const exitArgsValue = definitionsById.get(consumerExit.argsValueCapture?.valueId)?.value;
+        const returnValue = definitionsById.get(consumerExit.returnValueCapture?.valueId)?.value;
+        assert.equal(enterValue?.[0]?.marker, 'before-consumer-work');
+        assert.equal(exitArgsValue?.[0]?.marker, 'at-consumer-exit');
+        assert.equal(returnValue?.marker, 'at-consumer-exit');
+        assert(!JSON.stringify(definitions).includes('after-consumer-exit'));
     } finally {
         global.fetch = originalFetch;
     }

package/test/policy-session-completion.testcontainers.test.js

@@ -79,6 +79,7 @@ function requestNames(port, index) {
                 'x-bug-session-id': 'S_policy_completion',
                 'x-bug-action-id': `A_policy_completion_${index}`,
                 'x-bug-request-start': String(Date.now()),
+                'x-demo-actor-id': 'policy-completion-actor',
             },
         }, (response) => {
             const chunks = [];
@@ -152,10 +153,26 @@ async function main() {
             captureHeaders: false,
             privacy: {
                 environment: 'dev',
-                policy: largePolicy(),
+            },
+            liveMode: {
+                enabled: true,
+                backendOnly: true,
+                defineActorId: ({ req }) => req.headers['x-demo-actor-id'],
+                shouldCapture: () => true,
+                actorType: 'policy-test-user',
             },
             ingestBase: 'http://127.0.0.1:65535',
         };
+        __reproTestHooks.shareRuntimePrivacyStateForTest(
+            {
+                ...cfg,
+                privacy: {
+                    environment: 'dev',
+                    policy: largePolicy(),
+                },
+            },
+            cfg,
+        );
 
         const depotSchema = new mongoose.Schema({
             location: String,

package/test/trace-observation-snapshots.test.js

@@ -0,0 +1,403 @@
+process.env.REPRO_SDK_BACKGROUND_MAX_DEFER_MS = '50';
+process.env.REPRO_SDK_BACKGROUND_IDLE_DELAY_MS = '0';
+process.env.REPRO_SDK_BACKGROUND_BUSY_IDLE_DELAY_MS = '0';
+process.env.REPRO_SDK_TRACE_INLINE_VALUE_MAX_SERIALIZED_CHARS = '256';
+process.env.REPRO_TRACE_BATCH_MAX_SERIALIZED_BYTES = '65536';
+process.env.TRACE_IDLE_FLUSH_MS = '10';
+process.env.TRACE_LINGER_AFTER_FINISH_MS = '0';
+
+const assert = require('node:assert/strict');
+const { EventEmitter } = require('node:events');
+const { initReproTracing, reproMiddleware, __reproTestHooks } = require('../dist');
+const { flushIngestQueue } = require('../dist/ingest/client');
+
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+
+function deferred() {
+    let resolve;
+    let reject;
+    const promise = new Promise((resolvePromise, rejectPromise) => {
+        resolve = resolvePromise;
+        reject = rejectPromise;
+    });
+    return { promise, resolve, reject };
+}
+
+function makeReqRes(sessionId) {
+    const req = new EventEmitter();
+    req.method = 'POST';
+    req.url = '/trace-observation-snapshots';
+    req.originalUrl = req.url;
+    req.headers = {
+        'x-bug-session-id': sessionId,
+        'x-bug-action-id': `A_${sessionId}`,
+        'x-bug-request-start': String(Date.now()),
+    };
+    req.body = {};
+    req.params = {};
+    req.query = {};
+
+    const res = new EventEmitter();
+    res.statusCode = 204;
+    res.getHeader = () => undefined;
+    res.getHeaders = () => ({});
+    res.setHeader = () => {};
+    res.write = () => true;
+    res.end = function end() {
+        this.emit('finish');
+        return this;
+    };
+    return { req, res };
+}
+
+function makePayload(id, phase = 'before') {
+    return {
+        id,
+        phase,
+        nested: { count: 0 },
+        rows: Array.from({ length: 20 }, (_, index) => ({
+            index,
+            location: `${id}-LOCATION-${String(index).padStart(3, '0')}`,
+            state: 'initial',
+        })),
+    };
+}
+
+function mutateSyncPayload(payload) {
+    payload.phase = 'inside-sync';
+    payload.nested.count = 1;
+    payload.rows[0].state = 'inside-sync';
+    return payload;
+}
+
+function observeVersion(payload) {
+    return payload.phase;
+}
+
+function observeAliasedPayload(payload) {
+    return payload;
+}
+
+async function mutateAsyncPayload(payload, gate) {
+    payload.phase = 'started';
+    await gate;
+    payload.phase = 'settled';
+    payload.nested.count += 1;
+    payload.rows[0].state = 'settled';
+    return payload;
+}
+
+function mutateAndThrow(payload) {
+    payload.phase = 'before-throw';
+    payload.nested.count = 7;
+    throw new Error('expected trace snapshot failure path');
+}
+
+function observeHostilePayload(payload) {
+    return payload;
+}
+
+async function waitForCapture(posts) {
+    const deadline = Date.now() + 5000;
+    while (Date.now() < deadline) {
+        const events = posts.flatMap((post) => post.events || []);
+        if (events.some((event) => event.event_type === 'backend_request') &&
+            events.some((event) => event.event_type === 'trace_batch')) {
+            break;
+        }
+        await sleep(20);
+    }
+    await __reproTestHooks.drainSdkBackgroundQueueForTest();
+    await flushIngestQueue();
+}
+
+function inspectCapture(posts) {
+    const ingestEvents = posts.flatMap((post) => post.events || []);
+    const traceBatches = ingestEvents.filter((event) => event.event_type === 'trace_batch');
+    const events = traceBatches.flatMap((event) => event.payload?.trace || []);
+    const definitions = traceBatches.flatMap((event) => event.payload?.traceValues || []);
+    const definitionsById = new Map(definitions.map((definition) => [definition.id, definition]));
+
+    const resolveCaptured = (event, field) => {
+        const capture = event[field];
+        assert.equal(capture?.status, 'stored', `${event.fn} ${event.type} lacks ${field}`);
+        const definition = definitionsById.get(capture.valueId);
+        assert(definition, `missing definition ${capture.valueId}`);
+        return definition.value;
+    };
+
+    return { ingestEvents, traceBatches, events, definitions, definitionsById, resolveCaptured };
+}
+
+function eventsFor(capture, fn) {
+    return capture.events.filter((event) => event.fn === fn);
+}
+
+async function main() {
+    const config = {
+        tenantId: 'TENANT_trace_observation_snapshot',
+        appId: 'APP_trace_observation_snapshot',
+        appSecret: 'trace-observation-snapshot-secret',
+        captureHeaders: false,
+        privacy: { environment: 'dev', captureRaw: true },
+        ingestBase: 'http://127.0.0.1:65535',
+    };
+
+    initReproTracing({ instrument: false, fullValueCapture: true, logFunctionCalls: false });
+    __reproTestHooks.resetSdkBackgroundQueuesForTest();
+
+    const posts = [];
+    const previousFetch = global.fetch;
+    global.fetch = async (_url, init = {}) => {
+        posts.push(JSON.parse(String(init.body || '{}')));
+        return {
+            ok: true,
+            status: 202,
+            json: async () => ({ ok: true }),
+            text: async () => '{"ok":true}',
+        };
+    };
+
+    const sessionId = 'S_trace_observation_snapshot';
+    const middleware = reproMiddleware(config);
+    const { req, res } = makeReqRes(sessionId);
+
+    try {
+        await new Promise((resolve, reject) => {
+            middleware(req, res, async (middlewareError) => {
+                if (middlewareError) {
+                    reject(middlewareError);
+                    return;
+                }
+
+                try {
+                    const syncPayload = makePayload('sync');
+                    const syncResult = global.__repro_call(
+                        mutateSyncPayload,
+                        null,
+                        [syncPayload],
+                        '/app/trace-observation.service.ts',
+                        20,
+                        'mutateSyncPayload',
+                        false,
+                    );
+                    assert.strictEqual(syncResult, syncPayload, 'tracing changed sync return identity');
+                    syncPayload.phase = 'after-sync-caller';
+                    syncPayload.nested.count = 99;
+                    syncPayload.rows[0].state = 'after-sync-caller';
+
+                    const versionedPayload = makePayload('versioned', 'v1');
+                    for (const phase of ['v1', 'v2', 'v1']) {
+                        versionedPayload.phase = phase;
+                        const observed = global.__repro_call(
+                            observeVersion,
+                            null,
+                            [versionedPayload],
+                            '/app/trace-observation.service.ts',
+                            40,
+                            'observeVersion',
+                            false,
+                        );
+                        assert.equal(observed, phase);
+                    }
+                    versionedPayload.phase = 'after-version-caller';
+
+                    const shared = {
+                        value: 'alias-before',
+                        rows: makePayload('alias-rows').rows,
+                    };
+                    const aliasedPayload = { id: 'alias', left: shared, right: shared };
+                    aliasedPayload.self = aliasedPayload;
+                    const aliasResult = global.__repro_call(
+                        observeAliasedPayload,
+                        null,
+                        [aliasedPayload],
+                        '/app/trace-observation.service.ts',
+                        60,
+                        'observeAliasedPayload',
+                        false,
+                    );
+                    assert.strictEqual(aliasResult, aliasedPayload, 'tracing changed aliased return identity');
+                    shared.value = 'alias-after-caller';
+
+                    const gateA = deferred();
+                    const gateB = deferred();
+                    const asyncPayloadA = makePayload('async-a');
+                    const asyncPayloadB = makePayload('async-b');
+                    const pendingA = global.__repro_call(
+                        mutateAsyncPayload,
+                        null,
+                        [asyncPayloadA, gateA.promise],
+                        '/app/trace-observation.service.ts',
+                        80,
+                        'mutateAsyncPayloadA',
+                        false,
+                    );
+                    const pendingB = global.__repro_call(
+                        mutateAsyncPayload,
+                        null,
+                        [asyncPayloadB, gateB.promise],
+                        '/app/trace-observation.service.ts',
+                        90,
+                        'mutateAsyncPayloadB',
+                        false,
+                    );
+                    gateB.resolve();
+                    assert.strictEqual(await pendingB, asyncPayloadB);
+                    asyncPayloadB.phase = 'after-async-b-caller';
+                    asyncPayloadB.nested.count = 99;
+                    gateA.resolve();
+                    assert.strictEqual(await pendingA, asyncPayloadA);
+                    asyncPayloadA.phase = 'after-async-a-caller';
+                    asyncPayloadA.nested.count = 99;
+
+                    const throwingPayload = makePayload('throwing');
+                    assert.throws(() => global.__repro_call(
+                        mutateAndThrow,
+                        null,
+                        [throwingPayload],
+                        '/app/trace-observation.service.ts',
+                        110,
+                        'mutateAndThrow',
+                        false,
+                    ), /expected trace snapshot failure path/);
+                    throwingPayload.phase = 'after-throw-caller';
+                    throwingPayload.nested.count = 99;
+
+                    const hostilePayload = new Proxy(
+                        { id: 'hostile-payload' },
+                        {
+                            ownKeys() {
+                                throw new Error('hostile ownKeys trap');
+                            },
+                        },
+                    );
+                    const hostileResult = global.__repro_call(
+                        observeHostilePayload,
+                        null,
+                        [hostilePayload],
+                        '/app/trace-observation.service.ts',
+                        130,
+                        'observeHostilePayload',
+                        false,
+                    );
+                    assert.strictEqual(hostileResult, hostilePayload, 'snapshot failure changed application identity');
+
+                    res.end();
+                    resolve();
+                } catch (error) {
+                    reject(error);
+                }
+            });
+        });
+
+        await waitForCapture(posts);
+        const capture = inspectCapture(posts);
+
+        const syncEvents = eventsFor(capture, 'mutateSyncPayload');
+        assert.equal(syncEvents.length, 2);
+        const syncEnterArgs = capture.resolveCaptured(syncEvents.find((event) => event.type === 'enter'), 'argsValueCapture');
+        const syncExit = syncEvents.find((event) => event.type === 'exit');
+        const syncExitArgs = capture.resolveCaptured(syncExit, 'argsValueCapture');
+        const syncReturn = capture.resolveCaptured(syncExit, 'returnValueCapture');
+        assert.deepEqual(
+            [syncEnterArgs[0].phase, syncEnterArgs[0].nested.count, syncEnterArgs[0].rows[0].state],
+            ['before', 0, 'initial'],
+        );
+        assert.deepEqual(
+            [syncExitArgs[0].phase, syncExitArgs[0].nested.count, syncExitArgs[0].rows[0].state],
+            ['inside-sync', 1, 'inside-sync'],
+        );
+        assert.deepEqual(
+            [syncReturn.phase, syncReturn.nested.count, syncReturn.rows[0].state],
+            ['inside-sync', 1, 'inside-sync'],
+        );
+
+        const versionEvents = eventsFor(capture, 'observeVersion');
+        assert.equal(versionEvents.length, 6);
+        const versionRefs = versionEvents.map((event) => event.argsValueCapture?.valueId);
+        assert(versionRefs.every((valueId) => typeof valueId === 'string'));
+        assert.equal(versionRefs[0], versionRefs[1], 'unchanged enter/exit observations must deduplicate');
+        assert.equal(versionRefs[2], versionRefs[3], 'second unchanged enter/exit observations must deduplicate');
+        assert.equal(versionRefs[4], versionRefs[5], 'restored enter/exit observations must deduplicate');
+        assert.equal(versionRefs[0], versionRefs[4], 'restoring prior content must restore its content ID');
+        assert.notEqual(versionRefs[0], versionRefs[2], 'same object with changed content needs a new content ID');
+        assert.deepEqual(
+            [0, 2, 4].map((index) => capture.resolveCaptured(versionEvents[index], 'argsValueCapture')[0].phase),
+            ['v1', 'v2', 'v1'],
+        );
+
+        const aliasEvents = eventsFor(capture, 'observeAliasedPayload');
+        assert.equal(aliasEvents.length, 2);
+        const aliasArgs = capture.resolveCaptured(aliasEvents[0], 'argsValueCapture');
+        assert.equal(aliasArgs[0].left.value, 'alias-before');
+        assert.deepEqual(aliasArgs[0].right, { __reproCircularRef: '$[0].left' });
+        assert.deepEqual(aliasArgs[0].self, { __reproCircularRef: '$[0]' });
+
+        for (const fn of ['mutateAsyncPayloadA', 'mutateAsyncPayloadB']) {
+            const asyncEvents = eventsFor(capture, fn);
+            assert.equal(asyncEvents.length, 2, `${fn} event count`);
+            const enterArgs = capture.resolveCaptured(asyncEvents.find((event) => event.type === 'enter'), 'argsValueCapture');
+            const exit = asyncEvents.find((event) => event.type === 'exit');
+            const exitArgs = capture.resolveCaptured(exit, 'argsValueCapture');
+            const returnValue = capture.resolveCaptured(exit, 'returnValueCapture');
+            assert.equal(enterArgs[0].phase, 'before', `${fn} enter was rewritten`);
+            assert.equal(enterArgs[0].nested.count, 0);
+            assert.equal(exitArgs[0].phase, 'settled', `${fn} exit was rewritten by caller mutation`);
+            assert.equal(exitArgs[0].nested.count, 1);
+            assert.equal(returnValue.phase, 'settled', `${fn} return was rewritten by caller mutation`);
+            assert.equal(returnValue.nested.count, 1);
+        }
+
+        const throwEvents = eventsFor(capture, 'mutateAndThrow');
+        assert.equal(throwEvents.length, 2);
+        const throwExit = throwEvents.find((event) => event.type === 'exit');
+        const throwArgs = capture.resolveCaptured(throwExit, 'argsValueCapture');
+        const throwError = capture.resolveCaptured(throwExit, 'errorValueCapture');
+        assert.equal(throwArgs[0].phase, 'before-throw');
+        assert.equal(throwArgs[0].nested.count, 7);
+        assert.equal(throwExit.threw, true);
+        assert.equal(throwError.message, 'expected trace snapshot failure path');
+
+        const hostileEvents = eventsFor(capture, 'observeHostilePayload');
+        assert.equal(hostileEvents.length, 2);
+        for (const hostileEvent of hostileEvents) {
+            assert.deepEqual(hostileEvent.args, [{
+                __kind: 'omitted',
+                reason: 'capture-snapshot-failed',
+            }]);
+        }
+        const manifests = capture.ingestEvents
+            .filter((event) => event.event_type === 'request_capture_manifest')
+            .map((event) => event.payload?.requestCaptureManifest ?? event.payload)
+            .filter(Boolean);
+        assert.equal(manifests.length, 1);
+        assert.equal(manifests[0].privacy?.status, 'failed');
+        assert(manifests[0].captureFailures?.some((failure) =>
+            failure.stage === 'trace.snapshot' &&
+            failure.target === 'trace.args' &&
+            failure.reason === 'snapshot_failed'
+        ), JSON.stringify(manifests[0]));
+
+        const serializedDefinitions = JSON.stringify(capture.definitions);
+        for (const forbidden of [
+            'after-sync-caller',
+            'after-version-caller',
+            'alias-after-caller',
+            'after-async-a-caller',
+            'after-async-b-caller',
+            'after-throw-caller',
+        ]) {
+            assert(!serializedDefinitions.includes(forbidden), `late mutation leaked into capture: ${forbidden}`);
+        }
+
+        console.log('trace observation snapshots preserve temporal values and application identity OK');
+    } finally {
+        global.fetch = previousFetch;
+    }
+}
+
+main().catch((error) => {
+    console.error(error);
+    process.exit(1);
+});