@reproapp/node-sdk 0.0.48 → 0.0.50

package/src/index.ts

@@ -2,7 +2,7 @@ import type { Request, Response, NextFunction } from 'express';
 import type { Schema, Model, Query } from 'mongoose';
 import * as mongoose from 'mongoose';
 import { AsyncLocalStorage } from 'async_hooks';
-import { createHmac, randomUUID } from 'crypto';
+import { createHash, createHmac, randomUUID } from 'crypto';
 import { createRequire } from 'module';
 import { join } from 'path';
 import { pathToFileURL } from 'url';
@@ -29,6 +29,7 @@ import {
     type RuntimePrivacyTraceContext,
 } from './privacy';
 import { projectSemanticInfrastructureValue } from './semantic-serialization';
+import { limitLiveCapture, limitLiveArguments, collectCaptureOmissions, type CaptureOmission } from './live-capture-limits';
 
 /**
  * ============================= IMPORTANT =============================
@@ -380,6 +381,8 @@ type PendingTraceEventRecord = TraceEventRecord & {
 };
 
 type TraceValueCaptureRef = {
+    complete?: boolean;
+    omissions?: CaptureOmission[];
     status:
         | 'stored'
         | 'truncated-for-storage'
@@ -419,6 +422,7 @@ type TraceValueBatchEntry = {
 };
 
 type TraceMaterializationConfig = {
+    captureMode?: 'live' | 'staging';
     tenantId: string;
     appId: string;
     appSecret?: string;
@@ -1213,6 +1217,7 @@ type NativeMongoSuppression = {
 };
 
 type RequestCaptureScopeState = {
+    liveCapture?: boolean;
     requestRid: string;
     transport: 'http' | 'kafka' | 'amqp' | 'background';
     backendRequestCount: number;
@@ -1228,6 +1233,7 @@ type RequestCaptureScopeState = {
     privacyPolicyFingerprint?: string;
     privacyStatementCount: number;
     emittedValueDefinitionIds: Set<string>;
+    traceObservationSnapshots: Map<string, any>;
 };
 
 function createRequestCaptureScope(
@@ -1245,6 +1251,7 @@ function createRequestCaptureScope(
     return {
         requestRid,
         transport,
+        liveCapture: cfg?.captureMode === 'live' || (!!cfg && cfg.captureMode !== 'staging' && !!normalizeLiveModeConfig(cfg)),
         // Every scope represents one captured transport request. This is an
         // observed expectation, not a count of successful enqueue operations.
         backendRequestCount: 1,
@@ -1256,6 +1263,7 @@ function createRequestCaptureScope(
         privacyPolicyFingerprint: privacy?.fingerprint,
         privacyStatementCount: privacy?.statements.length ?? 0,
         emittedValueDefinitionIds: new Set(),
+        traceObservationSnapshots: new Map(),
     };
 }
 
@@ -2597,6 +2605,7 @@ async function resolveBackendLiveContext(
         liveMode,
         '/v1/live-sessions/claim',
         {
+            liveCapture: liveMode.liveCapture,
             clientTime: requestStart,
             captureMode: 'backend-only',
             actorId,
@@ -2710,6 +2719,7 @@ function stripReproQueryFromUrl(rawUrl: string): string {
         parsed.searchParams.delete(REPRO_QUERY_SESSION_PARAM);
         parsed.searchParams.delete(REPRO_QUERY_ACTION_PARAM);
         parsed.searchParams.delete(REPRO_QUERY_START_PARAM);
+        parsed.searchParams.delete('__repro_mode');
         return `${parsed.pathname}${parsed.search}${parsed.hash}`;
     } catch {
         return rawUrl;
@@ -2723,6 +2733,7 @@ function stripReproQueryParams(req: Request): void {
             delete query[REPRO_QUERY_SESSION_PARAM];
             delete query[REPRO_QUERY_ACTION_PARAM];
             delete query[REPRO_QUERY_START_PARAM];
+            delete query.__repro_mode;
         }
     } catch {}
     try {
@@ -3403,6 +3414,112 @@ function hasMeaningfulRawTraceError(error: any): boolean {
     return error !== undefined && error !== null;
 }
 
+const TRACE_OBSERVATION_SNAPSHOT = Symbol('repro.traceObservationSnapshot');
+
+// Trace events can remain queued after user code mutates the observed objects.
+// Intern immutable semantic snapshots per request so temporal evidence stays
+// correct without retaining another full copy for repeated unchanged values.
+function internTraceObservationSnapshot(
+    snapshot: any,
+    captureScope?: RequestCaptureScopeState | null,
+): any {
+    if (!captureScope || snapshot === null || typeof snapshot !== 'object') {
+        return snapshot;
+    }
+
+    const serialized = stableSerializeTraceValue(snapshot);
+    if (serialized === null) return snapshot;
+
+    const digest = createHash('sha256')
+        .update('repro-trace-observation-v1\0')
+        .update(serialized)
+        .digest('hex');
+    const existing = captureScope.traceObservationSnapshots.get(digest);
+    if (existing !== undefined) return existing;
+
+    captureScope.traceObservationSnapshots.set(digest, snapshot);
+    return snapshot;
+}
+
+function snapshotTraceValueAtObservation(
+    value: any,
+    captureScope?: RequestCaptureScopeState | null,
+    valuePath = '$',
+    target = 'trace.value',
+): any {
+    try {
+        if (captureScope?.liveCapture) {
+            value = target === 'trace.args' && Array.isArray(value)
+                ? limitLiveArguments(value)
+                : limitLiveCapture(value, valuePath).value;
+        }
+        const snapshot = sanitizeTraceValue(
+            value,
+            0,
+            new WeakMap(),
+            { preserveLongStrings: true, disableTruncation: true },
+            valuePath,
+        );
+        return internTraceObservationSnapshot(snapshot, captureScope);
+    } catch {
+        recordRequestCaptureFailure(
+            captureScope,
+            'trace.snapshot',
+            target,
+            'snapshot_failed',
+        );
+        return makeOmittedValue('capture-snapshot-failed');
+    }
+}
+
+function snapshotTraceArgsAtObservation(
+    values: any,
+    captureScope?: RequestCaptureScopeState | null,
+): any[] {
+    const snapshot = snapshotTraceValueAtObservation(
+        normalizeRawTraceArgs(values),
+        captureScope,
+        '$',
+        'trace.args',
+    );
+    return Array.isArray(snapshot) ? snapshot : [snapshot];
+}
+
+function snapshotRawTraceEventAtObservation(
+    raw: any,
+    captureScope?: RequestCaptureScopeState | null,
+): any {
+    if (!raw || typeof raw !== 'object' || raw[TRACE_OBSERVATION_SNAPSHOT] === true) {
+        return raw;
+    }
+
+    const snapshot = { ...raw };
+    if (raw.args !== undefined) {
+        snapshot.args = snapshotTraceArgsAtObservation(raw.args, captureScope);
+    }
+    if (raw.returnValue !== undefined) {
+        snapshot.returnValue = snapshotTraceValueAtObservation(
+            raw.returnValue,
+            captureScope,
+            '$',
+            'trace.returnValue',
+        );
+    }
+    if (hasMeaningfulRawTraceError(raw.error)) {
+        snapshot.error = snapshotTraceValueAtObservation(
+            raw.error,
+            captureScope,
+            '$',
+            'trace.error',
+        );
+    }
+    Object.defineProperty(snapshot, TRACE_OBSERVATION_SNAPSHOT, {
+        value: true,
+        enumerable: false,
+    });
+    return snapshot;
+}
+
 function attachTraceValueEntry(
     event: TraceEventRecord | PendingTraceEventRecord,
     entry: TraceValueBatchEntry,
@@ -3611,6 +3728,7 @@ async function materializePendingTraceEventsAsync(
                 appSecret: params.cfg.appSecret,
                 appName: params.cfg.appName,
                 privacy: params.cfg.privacy,
+                captureMode: params.captureScope?.liveCapture ? 'live' : params.cfg.captureMode,
             },
             maskReq: params.maskReq,
             masking: params.masking,
@@ -4120,6 +4238,18 @@ async function initializeRuntimePrivacyPolicyAtStartup(cfg: ReproMiddlewareConfi
     );
 }
 
+function isLiveCapture(cfg: ReproMiddlewareConfig, scope?: RequestCaptureScopeState | null): boolean {
+    if (scope) return scope.liveCapture === true;
+    return cfg.captureMode === 'live' || (cfg.captureMode !== 'staging' && getCtx().captureScope?.liveCapture === true);
+}
+
+function constrainLiveCapture(value: any, cfg: ReproMiddlewareConfig, target: string, scope?: RequestCaptureScopeState | null): any {
+    if (!isLiveCapture(cfg, scope)) return value;
+    return target === 'trace.args' && Array.isArray(value)
+        ? limitLiveArguments(value)
+        : limitLiveCapture(value).value;
+}
+
 function applyPrivacyThenMask(
     target: RuntimePrivacySurface,
     value: any,
@@ -4130,6 +4260,7 @@ function applyPrivacyThenMask(
     privacy: NormalizedRuntimePrivacyPolicy | null,
     db?: RuntimePrivacyDbContext | null,
 ) {
+    value = constrainLiveCapture(value, cfg, target);
     if (shouldCapturePrivacyRaw(cfg)) {
         return value;
     }
@@ -4160,6 +4291,7 @@ async function applyPrivacyThenMaskAsync(
     privacy: NormalizedRuntimePrivacyPolicy | null,
     db?: RuntimePrivacyDbContext | null,
 ) {
+    value = constrainLiveCapture(value, cfg, target);
     if (shouldCapturePrivacyRaw(cfg)) {
         return value;
     }
@@ -4239,6 +4371,7 @@ function materializeInlinePrivacyValue(
     db?: RuntimePrivacyDbContext | null,
     captureScope?: RequestCaptureScopeState | null,
 ): InlinePrivacyMaterializationResult {
+    value = constrainLiveCapture(value, cfg, target, captureScope);
     if (value === undefined) {
         return { value };
     }
@@ -4278,6 +4411,7 @@ async function materializeInlinePrivacyValueAsync(
     db?: RuntimePrivacyDbContext | null,
     captureScope?: RequestCaptureScopeState | null,
 ): Promise<InlinePrivacyMaterializationResult> {
+    value = constrainLiveCapture(value, cfg, target, captureScope);
     if (value === undefined) {
         return { value };
     }
@@ -5446,6 +5580,9 @@ function createCapturedValueEntry(
 ): { captureRef: TraceValueCaptureRef; entry?: TraceValueBatchEntry } | undefined {
     if (!__FULL_VALUE_CAPTURE_ENABLED) return undefined;
 
+    const limitedRaw = constrainLiveCapture(params.rawValue, params.capture.runtimeConfig, params.target);
+    const omissions = isLiveCapture(params.capture.runtimeConfig) ? collectCaptureOmissions(limitedRaw) : [];
+
     const preferredLimits: FullValueCloneLimits = {
         maxDepth: TRACE_FULL_VALUE_MAX_DEPTH,
         maxKeys: TRACE_FULL_VALUE_MAX_KEYS,
@@ -5455,7 +5592,7 @@ function createCapturedValueEntry(
     const buildMaskedCandidate = (limits: FullValueCloneLimits) => {
         const projected = params.target === 'request.headers'
             ? sanitizeHeaders(params.rawValue, params.capture.captureHeaders)
-            : cloneFullValueCandidate(params.rawValue, params.capture, limits);
+            : cloneFullValueCandidate(limitedRaw, params.capture, limits);
         if (projected === undefined) return undefined;
         return applyPrivacyThenMask(
             params.target,
@@ -5476,7 +5613,7 @@ function createCapturedValueEntry(
     }
 
     const candidateSerialized = stableSerializeTraceValue(candidate);
-    if (!candidateSerialized || candidateSerialized === previewSerialized) {
+    if (!candidateSerialized || (candidateSerialized === previewSerialized && !omissions.length)) {
         return undefined;
     }
 
@@ -5502,6 +5639,7 @@ function createCapturedValueEntry(
             status: 'stored',
             valueId,
             projectedKind: entry.projectedKind,
+            ...(omissions.length ? { complete: false, omissions } : {}),
         },
         entry,
     };
@@ -5532,6 +5670,9 @@ async function createCapturedValueEntryAsync(
 ): Promise<{ captureRef: TraceValueCaptureRef; entry?: TraceValueBatchEntry } | undefined> {
     if (!__FULL_VALUE_CAPTURE_ENABLED) return undefined;
 
+    const limitedRaw = constrainLiveCapture(params.rawValue, params.capture.runtimeConfig, params.target);
+    const omissions = isLiveCapture(params.capture.runtimeConfig) ? collectCaptureOmissions(limitedRaw) : [];
+
     const preferredLimits: FullValueCloneLimits = {
         maxDepth: TRACE_FULL_VALUE_MAX_DEPTH,
         maxKeys: TRACE_FULL_VALUE_MAX_KEYS,
@@ -5541,7 +5682,7 @@ async function createCapturedValueEntryAsync(
     const buildMaskedCandidate = async (limits: FullValueCloneLimits) => {
         const projected = params.target === 'request.headers'
             ? sanitizeHeaders(params.rawValue, params.capture.captureHeaders)
-            : await cloneFullValueCandidateAsync(params.rawValue, params.capture, limits);
+            : await cloneFullValueCandidateAsync(limitedRaw, params.capture, limits);
         if (projected === undefined) return undefined;
         return applyPrivacyThenMaskAsync(
             params.target,
@@ -5562,7 +5703,7 @@ async function createCapturedValueEntryAsync(
     }
 
     const candidateSerialized = stableSerializeTraceValue(candidate);
-    if (!candidateSerialized || candidateSerialized === previewSerialized) {
+    if (!candidateSerialized || (candidateSerialized === previewSerialized && !omissions.length)) {
         return undefined;
     }
 
@@ -5588,6 +5729,7 @@ async function createCapturedValueEntryAsync(
             status: 'stored',
             valueId,
             projectedKind: entry.projectedKind,
+            ...(omissions.length ? { complete: false, omissions } : {}),
         },
         entry,
     };
@@ -5789,6 +5931,8 @@ async function maybeCaptureDbValueFromCandidatesAsync(
 // reproMiddleware — unchanged behavior + passive per-request trace
 // ===================================================================
 export type ReproMiddlewareConfig = IngestClientConfig & {
+    /** Propagated recording mode. A tagged staging request never inherits live limits. */
+    captureMode?: 'live' | 'staging';
     /** API base used for backend-owned live session documents. Defaults to REPRO_API_BASE_URL/REPRO_API_BASE/privacy.apiBase. */
     apiBase?: string;
     /** Configure header capture/masking. Defaults to capturing with sensitive headers masked. */
@@ -5820,6 +5964,11 @@ export type ReproLiveActorDecision = ReproLiveActorArgs & {
 };
 
 export type ReproLiveModeConfig = {
+    /** Stable chain sampling. Runtime updates apply to new chains; targets are evaluated on each claim. */
+    liveCapture?: {
+        sampleRate?: number;
+        targets?: { actorIds?: string[]; labels?: Record<string, string>; expiresAt: number }[];
+    };
     enabled?: boolean;
     backendOnly?: boolean;
     /**
@@ -6009,6 +6158,7 @@ export function reproMiddleware(cfg: ReproMiddlewareConfig) {
         const querySid = readRequestQueryParam(req, REPRO_QUERY_SESSION_PARAM);
         const queryAid = readRequestQueryParam(req, REPRO_QUERY_ACTION_PARAM);
         const queryTs = readRequestQueryNumber(req, REPRO_QUERY_START_PARAM);
+        const queryCaptureMode = readRequestQueryParam(req, '__repro_mode');
         if (querySid || queryAid || queryTs !== null) {
             stripReproQueryParams(req);
         }
@@ -6046,21 +6196,24 @@ export function reproMiddleware(cfg: ReproMiddlewareConfig) {
             res.on('close', endTrackedClientRequest);
             return next(); // only capture tagged requests
         }
-        const captureCfg: ReproMiddlewareConfig = backendLiveChild
-            ? {
+        let captureCfg: ReproMiddlewareConfig = cfg;
+        if (backendLiveChild) {
+            captureCfg = {
                 ...cfg,
                 actorId: backendLiveChild.actorId,
                 actorType: backendLiveChild.actorType,
                 actorLabels: backendLiveChild.actorLabels,
-            }
-            : taggedActorIdentity
-                ? {
-                    ...cfg,
-                    actorId: taggedActorIdentity.actorId,
-                    actorType: taggedActorIdentity.actorType,
-                    actorLabels: taggedActorIdentity.actorLabels,
-                }
-            : cfg;
+            };
+            shareRuntimePrivacyState(cfg, captureCfg);
+        } else if (taggedActorIdentity) {
+            captureCfg = {
+                ...cfg,
+                actorId: taggedActorIdentity.actorId,
+                actorType: taggedActorIdentity.actorType,
+                actorLabels: taggedActorIdentity.actorLabels,
+            };
+            shareRuntimePrivacyState(cfg, captureCfg);
+        }
         if (taggedActorIdentity) {
             post(captureCfg, sid, {
                 entries: [{
@@ -6075,6 +6228,11 @@ export function reproMiddleware(cfg: ReproMiddlewareConfig) {
                 }],
             }, { priority: 'high' });
         }
+        const captureMode = backendLiveContext || req.headers['x-repro-capture-mode'] === 'live' || queryCaptureMode === 'live'
+            ? 'live' : 'staging';
+        const modeConfig = { ...captureCfg, captureMode } as ReproMiddlewareConfig;
+        shareRuntimePrivacyState(captureCfg, modeConfig);
+        captureCfg = modeConfig;
         const resolvePrivacy = (): NormalizedRuntimePrivacyPolicy | null =>
             getRuntimePrivacyState(captureCfg).policy ?? null;
 
@@ -6588,17 +6746,27 @@ export function reproMiddleware(cfg: ReproMiddlewareConfig) {
                                 evt.__reproPending = {
                                     ...(ev.args !== undefined
                                         ? {
-                                            argsRaw: normalizeRawTraceArgs(ev.args),
+                                            argsRaw: snapshotTraceArgsAtObservation(ev.args, captureScope),
                                         }
                                         : {}),
                                     ...(ev.returnValue !== undefined
                                         ? {
-                                            returnValueRaw: ev.returnValue,
+                                            returnValueRaw: snapshotTraceValueAtObservation(
+                                                ev.returnValue,
+                                                captureScope,
+                                                '$',
+                                                'trace.returnValue',
+                                            ),
                                         }
                                         : {}),
                                     ...(hasErrorPayload
                                         ? {
-                                            errorRaw: ev.error,
+                                            errorRaw: snapshotTraceValueAtObservation(
+                                                ev.error,
+                                                captureScope,
+                                                '$',
+                                                'trace.error',
+                                            ),
                                         }
                                         : {}),
                                 };
@@ -7629,6 +7797,7 @@ function patchNodeFetchForPropagation() {
         if (runtime.aid && !hasHttpHeader(headers, KAFKA_HEADER_ACTION_ID)) {
             setHttpHeader(headers, KAFKA_HEADER_ACTION_ID, runtime.aid);
         }
+        if (runtime.sid) setHttpHeader(headers, 'x-repro-capture-mode', getCtx().captureScope?.liveCapture ? 'live' : 'staging');
         if (runtime.traceId && !hasHttpHeader(headers, KAFKA_HEADER_TRACE_ID)) {
             setHttpHeader(headers, KAFKA_HEADER_TRACE_ID, runtime.traceId);
         }
@@ -7683,6 +7852,7 @@ function patchNodeHttpModuleRequest(mod: any) {
             maybeSet(REQUEST_START_HEADER, String(alignedNow()));
             maybeSet(KAFKA_HEADER_SESSION_ID, runtime.sid);
             maybeSet(KAFKA_HEADER_ACTION_ID, runtime.aid);
+            if (runtime.sid) maybeSet('x-repro-capture-mode', getCtx().captureScope?.liveCapture ? 'live' : 'staging');
             maybeSet(KAFKA_HEADER_TRACE_ID, runtime.traceId);
             maybeSet(KAFKA_HEADER_PARENT_SPAN_ID, runtime.parentSpanId);
             maybeSet(KAFKA_HEADER_REQUEST_ID, runtime.requestRid);
@@ -7710,6 +7880,7 @@ type KafkaHeaderValue = string | Buffer | null | undefined;
 type KafkaHeaderMap = Record<string, KafkaHeaderValue>;
 type KafkaContextResolver = () => { sid?: string; aid?: string } | undefined;
 type KafkaPropagationContext = {
+    captureMode?: 'live' | 'staging';
     sid: string | null;
     aid: string | null;
     traceId: string | null;
@@ -7874,6 +8045,11 @@ async function materializeKafkaRequestBody(
     body: Record<string, any>,
     captureScope?: RequestCaptureScopeState | null,
 ): Promise<InlinePrivacyMaterializationResult> {
+    // Broker bodies have no separate full-value reference. Returning the trace
+    // inline preview here would permanently replace message arrays with 20 items.
+    if (shouldCapturePrivacyRaw(cfg)) {
+        return { value: constrainLiveCapture(sanitizeInlinePrivacyValue(body), cfg, 'request.body', captureScope) };
+    }
     return materializeInlinePrivacyValueAsync(
         'request.body',
         sanitizeInlinePrivacyValue(body),
@@ -7937,7 +8113,8 @@ function resolveKafkaContext(cfg: KafkaJsPatchConfig, headers: any): KafkaPropag
         null;
     const requestRid = readKafkaHeader(headers, KAFKA_HEADER_REQUEST_ID);
 
-    return { sid, aid, traceId, parentSpanId, requestRid };
+    return { sid, aid, traceId, parentSpanId, requestRid,
+        captureMode: readKafkaHeader(headers, 'x-repro-capture-mode') === 'live' || ctx.captureScope?.liveCapture ? 'live' : 'staging' };
 }
 
 function withOptionalTraceContext<T>(traceId: string | null, fn: () => Promise<T>): Promise<T> {
@@ -8094,6 +8271,8 @@ function recordKafkaTraceEvent(
 function buildPendingKafkaTraceEvent(raw: any): PendingTraceEventRecord | null {
     if (!raw || (raw.type !== 'enter' && raw.type !== 'exit')) return null;
 
+    raw = snapshotRawTraceEventAtObservation(raw, getCtx().captureScope);
+
     const sourceFileForLibrary =
         typeof raw.sourceFile === 'string' && raw.sourceFile
             ? String(raw.sourceFile)
@@ -8302,6 +8481,7 @@ function patchKafkaProducerInstance(producer: any, cfg: KafkaJsPatchConfig) {
                         [KAFKA_HEADER_REQUEST_ID]: publishRid,
                         [KAFKA_HEADER_SESSION_ID]: sid,
                         [KAFKA_HEADER_ACTION_ID]: aid,
+                        'x-repro-capture-mode': ctx.captureScope?.liveCapture ? 'live' : 'staging',
                     }),
                 };
             });
@@ -8434,6 +8614,7 @@ function patchKafkaProducerInstance(producer: any, cfg: KafkaJsPatchConfig) {
                                 [KAFKA_HEADER_REQUEST_ID]: publishRid,
                                 [KAFKA_HEADER_SESSION_ID]: sid,
                                 [KAFKA_HEADER_ACTION_ID]: aid,
+                                'x-repro-capture-mode': ctx.captureScope?.liveCapture ? 'live' : 'staging',
                             }),
                         };
                     }),
@@ -8550,6 +8731,7 @@ function wrapKafkaEachMessageHandler(eachMessage: any, cfg: KafkaJsPatchConfig,
         const consumeRid = nextRequestId(`${topic}-${message?.offset ?? alignedNow()}`);
         const traceId = consumeRid;
         const captureScope = createRequestCaptureScope(consumeRid, 'kafka', cfg);
+        captureScope.liveCapture = runtime.captureMode === 'live';
         emitRequestCaptureStart(cfg, sid, aid, captureScope);
         const rawTraceEvents: any[] = [];
         const maskReq: MaskRequestContext = {
@@ -8574,7 +8756,7 @@ function wrapKafkaEachMessageHandler(eachMessage: any, cfg: KafkaJsPatchConfig,
                 try {
                     unsubscribe = __TRACER__.tracer.on((event: any) => {
                         if (!event || event.traceId !== traceId) return;
-                        rawTraceEvents.push(event);
+                        rawTraceEvents.push(snapshotRawTraceEventAtObservation(event, captureScope));
                     });
                 } catch {}
             }
@@ -8660,6 +8842,7 @@ function wrapKafkaEachBatchHandler(eachBatch: any, cfg: KafkaJsPatchConfig, cons
         const consumeRid = nextRequestId(`${topic}-batch-${alignedNow()}`);
         const traceId = consumeRid;
         const captureScope = createRequestCaptureScope(consumeRid, 'kafka', cfg);
+        captureScope.liveCapture = runtime.captureMode === 'live';
         emitRequestCaptureStart(cfg, sid, aid, captureScope);
         const rawTraceEvents: any[] = [];
         const maskReq: MaskRequestContext = {
@@ -8684,7 +8867,7 @@ function wrapKafkaEachBatchHandler(eachBatch: any, cfg: KafkaJsPatchConfig, cons
                 try {
                     unsubscribe = __TRACER__.tracer.on((event: any) => {
                         if (!event || event.traceId !== traceId) return;
-                        rawTraceEvents.push(event);
+                        rawTraceEvents.push(snapshotRawTraceEventAtObservation(event, captureScope));
                     });
                 } catch {}
             }
@@ -8854,6 +9037,7 @@ export function patchKafkaJs(cfg: KafkaJsPatchConfig) {
 type AmqpHeaderMap = Record<string, any>;
 type AmqpContextResolver = () => { sid?: string; aid?: string } | undefined;
 type AmqpPropagationContext = {
+    captureMode?: 'live' | 'staging';
     sid: string | null;
     aid: string | null;
     traceId: string | null;
@@ -9122,7 +9306,8 @@ function resolveAmqpContext(cfg: AmqplibPatchConfig, headers: any): AmqpPropagat
         null;
     const requestRid = readAmqpHeader(headers, KAFKA_HEADER_REQUEST_ID);
 
-    return { sid, aid, traceId, parentSpanId, requestRid };
+    return { sid, aid, traceId, parentSpanId, requestRid,
+        captureMode: readAmqpHeader(headers, 'x-repro-capture-mode') === 'live' || ctx.captureScope?.liveCapture ? 'live' : 'staging' };
 }
 
 function withOptionalTraceContextSync<T>(traceId: string | null, fn: () => T): T {
@@ -9360,6 +9545,7 @@ function patchAmqplibPublishMethod(
             [KAFKA_HEADER_REQUEST_ID]: publishRid,
             [KAFKA_HEADER_SESSION_ID]: sid,
             [KAFKA_HEADER_ACTION_ID]: aid,
+            'x-repro-capture-mode': ctx.captureScope?.liveCapture ? 'live' : 'staging',
         };
         const shouldPropagate = hasAmqpPropagationValues(propagationValues);
         const callbackIndex = args.length > 0 && typeof args[args.length - 1] === 'function'
@@ -9468,6 +9654,7 @@ function wrapAmqplibConsumeHandler(onMessage: any, cfg: AmqplibPatchConfig, queu
         const consumeRid = nextRequestId(`${queueName}-${deliveryTag}`);
         const traceId = consumeRid;
         const captureScope = createRequestCaptureScope(consumeRid, 'amqp', cfg);
+        captureScope.liveCapture = runtime.captureMode === 'live';
         emitRequestCaptureStart(cfg, sid, aid, captureScope);
         const rawTraceEvents: any[] = [];
         const maskReq: MaskRequestContext = {
@@ -9492,7 +9679,7 @@ function wrapAmqplibConsumeHandler(onMessage: any, cfg: AmqplibPatchConfig, queu
             try {
                 unsubscribe = __TRACER__.tracer.on((event: any) => {
                     if (!event || event.traceId !== traceId) return;
-                    rawTraceEvents.push(event);
+                    rawTraceEvents.push(snapshotRawTraceEventAtObservation(event, captureScope));
                 });
             } catch {}
         };

package/src/ingest/client.ts

@@ -61,6 +61,8 @@ let backoffMs = 0;
 let criticalBackoffMs = 0;
 let shouldDeferDrain: (() => boolean) | null = null;
 let deferDrainMs = DEFAULT_DEFER_DRAIN_MS;
+const throttledUntil = new Map<string, number>();
+const throttleDelay = (config: IngestClientConfig) => Math.max(0, (throttledUntil.get(resolveIngestUrl(config)) ?? 0) - Date.now());
 
 export const configureIngestQueueDrain = (options: {
     shouldDefer?: (() => boolean) | null;
@@ -220,7 +222,9 @@ const sendIngestEntries = async (
     config: IngestClientConfig,
     sessionId: string,
     entries: LegacyEntry[],
-): Promise<boolean> => {
+): Promise<boolean | 'throttled' | 'denied'> => {
+    if (throttleDelay(config) > 0) return 'throttled';
+    throttledUntil.delete(resolveIngestUrl(config));
     if (!sessionId || !Array.isArray(entries) || entries.length === 0) {
         return true;
     }
@@ -255,6 +259,18 @@ const sendIngestEntries = async (
             body: JSON.stringify({ events }),
             ...(controller ? { signal: controller.signal } : {}),
         });
+        if (response.status === 429) {
+            const retryAfter = response.headers?.get?.('retry-after');
+            const seconds = retryAfter ? Number(retryAfter) : NaN;
+            const date = retryAfter ? Date.parse(retryAfter) : NaN;
+            const delay = Number.isFinite(seconds) ? seconds * 1000 : Number.isFinite(date) ? date - Date.now() : 1000;
+            throttledUntil.set(resolveIngestUrl(config), Date.now() + Math.max(1000, Math.min(86400_000, delay)));
+            return 'throttled';
+        }
+        if (response.status === 402 || response.status === 410) {
+            console.warn(`[repro] Upload refused for ${sessionId}: ${response.status === 402 ? 'capture quota exhausted' : 'capture deleted, expired or failed'}. This batch will not be retried.`);
+            return 'denied';
+        }
         return response.ok;
     } catch {
         // swallow in SDK
@@ -317,7 +333,11 @@ const drainCriticalIngestQueue = async (): Promise<void> => {
                 selected.batch.sessionId,
                 selected.batch.entries,
             );
-            if (ok) {
+            if (ok === 'throttled') {
+                scheduleCriticalDrain(throttleDelay(selected.batch.config));
+                return;
+            }
+            if (ok === true || ok === 'denied') {
                 criticalIngestQueue.splice(0, selected.queueItems);
                 criticalBackoffMs = 0;
                 continue;
@@ -362,7 +382,11 @@ const drainIngestQueue = async (): Promise<void> => {
             }
             const batch = selected.batch;
             const ok = await sendIngestEntries(batch.config, batch.sessionId, batch.entries);
-            if (ok) {
+            if (ok === 'throttled') {
+                scheduleDrain(throttleDelay(batch.config));
+                return;
+            }
+            if (ok === true || ok === 'denied') {
                 ingestQueue.splice(0, selected.queueItems);
                 backoffMs = 0;
                 continue;