@reproapp/node-sdk 0.0.49 → 0.0.50

package/src/ingest/client.ts

@@ -61,6 +61,8 @@ let backoffMs = 0;
 let criticalBackoffMs = 0;
 let shouldDeferDrain: (() => boolean) | null = null;
 let deferDrainMs = DEFAULT_DEFER_DRAIN_MS;
+const throttledUntil = new Map<string, number>();
+const throttleDelay = (config: IngestClientConfig) => Math.max(0, (throttledUntil.get(resolveIngestUrl(config)) ?? 0) - Date.now());
 
 export const configureIngestQueueDrain = (options: {
     shouldDefer?: (() => boolean) | null;
@@ -220,7 +222,9 @@ const sendIngestEntries = async (
     config: IngestClientConfig,
     sessionId: string,
     entries: LegacyEntry[],
-): Promise<boolean> => {
+): Promise<boolean | 'throttled' | 'denied'> => {
+    if (throttleDelay(config) > 0) return 'throttled';
+    throttledUntil.delete(resolveIngestUrl(config));
     if (!sessionId || !Array.isArray(entries) || entries.length === 0) {
         return true;
     }
@@ -255,6 +259,18 @@ const sendIngestEntries = async (
             body: JSON.stringify({ events }),
             ...(controller ? { signal: controller.signal } : {}),
         });
+        if (response.status === 429) {
+            const retryAfter = response.headers?.get?.('retry-after');
+            const seconds = retryAfter ? Number(retryAfter) : NaN;
+            const date = retryAfter ? Date.parse(retryAfter) : NaN;
+            const delay = Number.isFinite(seconds) ? seconds * 1000 : Number.isFinite(date) ? date - Date.now() : 1000;
+            throttledUntil.set(resolveIngestUrl(config), Date.now() + Math.max(1000, Math.min(86400_000, delay)));
+            return 'throttled';
+        }
+        if (response.status === 402 || response.status === 410) {
+            console.warn(`[repro] Upload refused for ${sessionId}: ${response.status === 402 ? 'capture quota exhausted' : 'capture deleted, expired or failed'}. This batch will not be retried.`);
+            return 'denied';
+        }
         return response.ok;
     } catch {
         // swallow in SDK
@@ -317,7 +333,11 @@ const drainCriticalIngestQueue = async (): Promise<void> => {
                 selected.batch.sessionId,
                 selected.batch.entries,
             );
-            if (ok) {
+            if (ok === 'throttled') {
+                scheduleCriticalDrain(throttleDelay(selected.batch.config));
+                return;
+            }
+            if (ok === true || ok === 'denied') {
                 criticalIngestQueue.splice(0, selected.queueItems);
                 criticalBackoffMs = 0;
                 continue;
@@ -362,7 +382,11 @@ const drainIngestQueue = async (): Promise<void> => {
             }
             const batch = selected.batch;
             const ok = await sendIngestEntries(batch.config, batch.sessionId, batch.entries);
-            if (ok) {
+            if (ok === 'throttled') {
+                scheduleDrain(throttleDelay(batch.config));
+                return;
+            }
+            if (ok === true || ok === 'denied') {
                 ingestQueue.splice(0, selected.queueItems);
                 backoffMs = 0;
                 continue;

package/src/live-capture-limits.ts

@@ -0,0 +1,177 @@
+import { IncomingMessage, ServerResponse } from 'http';
+import { mongooseDocumentData, projectSemanticInfrastructureValue } from './semantic-serialization';
+
+export type CaptureOmission = {
+    reason: 'max-depth' | 'max-keys' | 'max-entries' | 'accessor' | 'uninspectable';
+    path: string;
+    limit?: number;
+    originalCount?: number;
+    capturedCount: number;
+};
+export const LIVE_CAPTURE_LIMITS = Object.freeze({ maxDepth: 10, maxKeys: 100, maxEntries: 100 });
+const marker = (omission: CaptureOmission) => ({ __kind: 'repro-omitted', complete: false, ...omission });
+const childPath = (path: string, key: string | number) => `${path}[${JSON.stringify(key)}]`;
+function parseStructuredString(value: unknown): any {
+    if (typeof value !== 'string' || !/^[\s]*[\[{]/.test(value)) return undefined;
+    try { const parsed = JSON.parse(value); return parsed && typeof parsed === 'object' ? parsed : undefined; }
+    catch { return undefined; }
+}
+
+/** Snapshot only data descriptors: capture must never execute application getters. */
+export function limitLiveCapture(value: unknown, rootPath = '$'): { value: any; omissions: CaptureOmission[] } {
+    const omissions: CaptureOmission[] = [];
+    const seen = new WeakMap<object, { path: string; depth: number }>();
+    const omit = (detail: CaptureOmission) => { omissions.push(detail); return marker(detail); };
+    const walk = (input: any, depth: number, path: string): any => {
+        if (input === null || input === undefined) return input;
+        if (typeof input === 'string') {
+            const parsed = parseStructuredString(input);
+            if (parsed === undefined) return input;
+            const before = omissions.length;
+            const bounded = walk(parsed, depth, path);
+            // Preserve the original string exactly unless its structured data exceeded a limit.
+            return omissions.length === before ? input : JSON.stringify(bounded);
+        }
+        if (typeof input === 'bigint' || typeof input === 'symbol') return String(input);
+        if (typeof input === 'function') return '[Function]';
+        if (typeof input !== 'object') return input;
+        const previous = seen.get(input);
+        if (previous && previous.depth <= depth) return { __reproCircularRef: previous.path };
+        seen.set(input, { path, depth });
+        const descriptor = (key: string) => Object.getOwnPropertyDescriptor(input, key);
+        const data = (key: string) => descriptor(key)?.value;
+        if (data('__kind') === 'repro-omitted') {
+            const detail = { reason: data('reason'), path: data('path'), limit: data('limit'), originalCount: data('originalCount'), capturedCount: data('capturedCount') };
+            omissions.push(detail);
+            return marker(detail);
+        }
+        if (input instanceof Date) return Number.isNaN(Date.prototype.getTime.call(input)) ? 'Invalid Date' : Date.prototype.toISOString.call(input);
+        if (input instanceof RegExp) return RegExp.prototype.toString.call(input);
+        if (input instanceof IncomingMessage) {
+            // The business body is its own root, not depth one in a socket graph.
+            return { __kind: 'http-request', method: data('method'), url: data('originalUrl') ?? data('url'),
+                headers: walk(data('headers') ?? Object.getOwnPropertyDescriptor(IncomingMessage.prototype, 'headers')?.get?.call(input), 0, childPath(path, 'headers')),
+                query: walk(data('query'), 0, childPath(path, 'query')),
+                body: walk(data('body'), 0, childPath(path, 'body')),
+                params: walk(data('params'), 0, childPath(path, 'params')) };
+        }
+        if (input instanceof ServerResponse) return { __kind: 'http-response', statusCode: data('statusCode') };
+        const projected = projectSemanticInfrastructureValue(input);
+        if (projected) return projected.value;
+        // Mongoose stores business fields in _doc; never recurse through $__ state.
+        const documentData = mongooseDocumentData(input);
+        if (documentData) return walk(documentData, depth, path);
+        if (depth > LIVE_CAPTURE_LIMITS.maxDepth) return omit({ reason: 'max-depth', path, limit: LIVE_CAPTURE_LIMITS.maxDepth, capturedCount: 0 });
+        if (input instanceof Error) {
+            const details: Record<string, any> = Object.create(null);
+            for (const key of ['message', 'stack', 'cause', 'errors', ...Object.keys(input)]) {
+                const item = descriptor(key);
+                if (item) Object.defineProperty(details, key, { ...item, enumerable: true, configurable: true });
+            }
+            return walk(details, depth, path);
+        }
+        if (input instanceof ArrayBuffer || (typeof SharedArrayBuffer !== 'undefined' && input instanceof SharedArrayBuffer) || input instanceof DataView) {
+            let bytes: Uint8Array;
+            if (input instanceof DataView) {
+                const read = (key: string) => Object.getOwnPropertyDescriptor(DataView.prototype, key)!.get!.call(input);
+                bytes = new Uint8Array(read('buffer'), read('byteOffset'), read('byteLength'));
+            } else bytes = new Uint8Array(input);
+            return { __type: input instanceof DataView ? 'DataView' : 'ArrayBuffer', values: walk(bytes, depth, path).values };
+        }
+        if (input instanceof Map) {
+            const entries: any[] = [];
+            const size = Object.getOwnPropertyDescriptor(Map.prototype, 'size')!.get!.call(input);
+            for (const [key, item] of Map.prototype.entries.call(input)) {
+                if (entries.length >= LIVE_CAPTURE_LIMITS.maxEntries) break;
+                const index = entries.length;
+                entries.push([walk(key, depth + 1, childPath(path, `key:${index}`)), walk(item, depth + 1, childPath(path, index))]);
+            }
+            if (size > entries.length) entries.push(omit({ reason: 'max-entries', path, limit: 100, originalCount: size, capturedCount: entries.length }));
+            return { __type: 'Map', entries };
+        }
+        if (input instanceof Set) {
+            const values: any[] = [];
+            const size = Object.getOwnPropertyDescriptor(Set.prototype, 'size')!.get!.call(input);
+            for (const item of Set.prototype.values.call(input)) {
+                if (values.length >= 100) break;
+                values.push(walk(item, depth + 1, childPath(path, values.length)));
+            }
+            if (size > values.length) values.push(omit({ reason: 'max-entries', path, limit: 100, originalCount: size, capturedCount: values.length }));
+            return { __type: 'Set', values };
+        }
+        if (Array.isArray(input) || (ArrayBuffer.isView(input) && !(input instanceof DataView))) {
+            const length = (input as any).length;
+            const previousMarker = Array.isArray(input) && length === 101 ? descriptor('100')?.value : null;
+            const prior = previousMarker && Object.getOwnPropertyDescriptors(previousMarker);
+            const hasPriorLimit = prior?.__kind?.value === 'repro-omitted' && prior?.reason?.value === 'max-entries';
+            const values: any[] = [];
+            for (let i = 0; i < Math.min(length, 100); i++) {
+                const itemDescriptor = descriptor(String(i));
+                values.push(itemDescriptor && !('value' in itemDescriptor)
+                    ? omit({ reason: 'accessor', path: childPath(path, i), capturedCount: 0 })
+                    : walk(itemDescriptor?.value, depth + 1, childPath(path, i)));
+            }
+            if (length > 100) values.push(hasPriorLimit
+                ? walk(previousMarker, depth + 1, path)
+                : omit({ reason: 'max-entries', path, limit: 100, originalCount: length, capturedCount: 100 }));
+            return Array.isArray(input) ? values : { __type: 'TypedArray', values };
+        }
+        const keys = Object.keys(input);
+        const previousMetadataKey = keys.find(key => {
+            if (!/^__reproCapture\$*$/.test(key)) return false;
+            const candidate = descriptor(key)?.value;
+            return candidate && Object.getOwnPropertyDescriptor(candidate, '__kind')?.value === 'repro-omitted'
+                && Object.getOwnPropertyDescriptor(candidate, 'reason')?.value === 'max-keys';
+        });
+        const businessKeys = keys.filter(key => key !== previousMetadataKey);
+        const out: Record<string, any> = Object.create(null);
+        for (const key of businessKeys.slice(0, 100)) {
+            const itemDescriptor = descriptor(key)!;
+            out[key] = 'value' in itemDescriptor
+                ? walk(itemDescriptor.value, depth + 1, childPath(path, key))
+                : omit({ reason: 'accessor', path: childPath(path, key), capturedCount: 0 });
+        }
+        if (businessKeys.length > 100 || previousMetadataKey) {
+            const detail = previousMetadataKey
+                ? walk(descriptor(previousMetadataKey)?.value, depth + 1, path)
+                : omit({ reason: 'max-keys', path, limit: 100, originalCount: businessKeys.length, capturedCount: 100 });
+            let metadataKey = '__reproCapture';
+            while (Object.prototype.hasOwnProperty.call(out, metadataKey)) metadataKey += '$';
+            out[metadataKey] = detail;
+        }
+        return out;
+    };
+    try { return { value: walk(value, 0, rootPath), omissions }; }
+    catch { return { value: omit({ reason: 'uninspectable', path: rootPath, capturedCount: 0 }), omissions }; }
+}
+
+export function collectCaptureOmissions(value: any): CaptureOmission[] {
+    const result: CaptureOmission[] = [];
+    const seen = new WeakSet();
+    const pending = [value];
+    while (pending.length) {
+        const item = pending.pop();
+        const node = typeof item === 'string' ? parseStructuredString(item) : item;
+        if (!node || typeof node !== 'object' || seen.has(node)) continue;
+        seen.add(node);
+        const descriptors = Object.getOwnPropertyDescriptors(node);
+        if (descriptors.__kind?.value === 'repro-omitted') {
+            result.push({ reason: descriptors.reason?.value, path: descriptors.path?.value, limit: descriptors.limit?.value,
+                originalCount: descriptors.originalCount?.value, capturedCount: descriptors.capturedCount?.value });
+            continue;
+        }
+        for (const item of Object.values(descriptors)) if ('value' in item) pending.push(item.value);
+    }
+    return result;
+}
+
+export function limitLiveArguments(args: any[]): any[] {
+    const values = args.slice(0, 100).map((arg, index) => limitLiveCapture(arg, `$[${index}]`).value);
+    if (args.length > 100) {
+        const prior = Object.getOwnPropertyDescriptor(args, '100')?.value;
+        values.push(args.length === 101 && prior && Object.getOwnPropertyDescriptor(prior, '__kind')?.value === 'repro-omitted'
+            ? limitLiveCapture(prior).value
+            : marker({ reason: 'max-entries', path: '$', limit: 100, originalCount: args.length, capturedCount: 100 }));
+    }
+    return values;
+}

package/src/semantic-serialization.ts

@@ -52,6 +52,12 @@ function method(value: unknown, key: string): boolean {
     }
 }
 
+export function mongooseDocumentData(value: object): object | null {
+    const doc = Object.getOwnPropertyDescriptor(value, '_doc')?.value;
+    if (!doc || typeof doc !== 'object' || !Object.getOwnPropertyDescriptor(value, '$__')?.value) return null;
+    return method(value, '$__init') && method(value, '$toObject') ? doc : null;
+}
+
 function primitiveStateValue(value: unknown): string | number | boolean | null | undefined {
     if (value === null) return null;
     if (typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean') {
@@ -86,6 +92,7 @@ function projectConfigurationService(value: object, className: string): Semantic
 
 function projectLogger(value: object, className: string): SemanticProjection | null {
     if (!/(Logger|LoggerService)$/i.test(className)) return null;
+    if (!method(value, 'log') && !method(value, 'info')) return null;
     const descriptors = ownDataDescriptors(value);
     const context = primitiveStateValue(descriptors.context?.value);
     return semanticValue('logger', className, context !== undefined ? { context } : {});
@@ -95,6 +102,14 @@ function projectNestInfrastructure(value: object, className: string): SemanticPr
     if (!/(ModuleRef|ModulesContainer|InstanceWrapper|NestContainer|Injector|DiscoveryService|ExecutionContextHost|ArgumentsHost|HttpAdapterHost)$/i.test(className)) {
         return null;
     }
+    const signatures: Record<string, string[]> = {
+        ModuleRef: ['get', 'resolve'], ModulesContainer: ['get', 'set'],
+        InstanceWrapper: ['getInstanceByContextId'], NestContainer: ['getModules'],
+        Injector: ['loadInstance'], DiscoveryService: ['getProviders'],
+        ExecutionContextHost: ['switchToHttp', 'getArgs'], ArgumentsHost: ['switchToHttp', 'getArgs'],
+        HttpAdapterHost: ['listen$'],
+    };
+    if (!(signatures[className] ?? []).some(key => method(value, key))) return null;
     return semanticValue('nestjs-infrastructure', className);
 }
 
@@ -159,6 +174,20 @@ function projectTypeOrm(value: object, className: string): SemanticProjection |
     return null;
 }
 
+function projectMongoInfrastructure(value: object, className: string): SemanticProjection | null {
+    const signatures: Record<string, string[]> = {
+        MongoClient: ['connect', 'db', 'close'],
+        ClientSession: ['startTransaction', 'endSession'],
+        ConnectionPool: ['checkOut', 'checkIn'],
+        NativeConnection: ['openUri', 'model', 'close'],
+        Schema: ['add', 'path', 'plugin'],
+    };
+    const required = signatures[className];
+    return required?.every(key => method(value, key))
+        ? semanticValue('mongodb-infrastructure', className)
+        : null;
+}
+
 /**
  * Projects known runtime machinery into stable, non-recursive descriptions.
  * Unknown application values deliberately return null and remain fully captured.
@@ -176,6 +205,7 @@ export function projectSemanticInfrastructureValue(value: unknown): SemanticProj
         projectRedis(value, className) ||
         projectKafka(value, className) ||
         projectAmqp(value, className) ||
+        projectMongoInfrastructure(value, className) ||
         projectPostgres(value, className) ||
         projectTypeOrm(value, className)
     );

package/test/fixtures/live-capture-limits-server.js

@@ -0,0 +1,21 @@
+const express = require('express');
+const mongoose = require('mongoose');
+const { reproMiddleware, reproMongoosePlugin } = require('../../dist');
+
+function inspectShipment(shipment) { return shipment; }
+async function start(config, uri) {
+  const connection = await mongoose.createConnection(uri).asPromise();
+  const schema = new mongoose.Schema({ reference: String, rows: [Object] });
+  schema.plugin(reproMongoosePlugin, config);
+  const Shipment = connection.model('LiveCaptureShipment', schema);
+  await Shipment.create({ reference: 'SHIP-LIMIT', rows: Array.from({ length: 157 }, (_, id) => ({ id, status: 'available' })) });
+  const app = express();
+  app.use(reproMiddleware(config));
+  app.get('/shipment', async (_req, res) => {
+    const shipment = await Shipment.findOne({ reference: 'SHIP-LIMIT' }).lean().exec();
+    res.json(inspectShipment(shipment));
+  });
+  const server = await new Promise(resolve => { const server = app.listen(0, '127.0.0.1', () => resolve(server)); });
+  return { server, close: async () => { await new Promise(resolve => server.close(resolve)); await connection.close(); } };
+}
+module.exports = { start };

package/test/ingest-throttle-retention.test.js

@@ -0,0 +1,41 @@
+const assert = require('node:assert/strict');
+const http = require('node:http');
+const { once } = require('node:events');
+const { enqueueIngestEntries, flushIngestQueue } = require('../dist/ingest/client');
+
+async function main() {
+  let attempts = 0;
+  const accepted = [];
+  const terminalAttempts = new Map();
+  const app = http.createServer(async (req, res) => {
+    const chunks = []; for await (const chunk of req) chunks.push(chunk);
+    const body = JSON.parse(Buffer.concat(chunks));
+    const sid = body.events[0]?.session_id;
+    if (sid === 'S_quota_denied' || sid === 'S_deleted') {
+      terminalAttempts.set(sid, (terminalAttempts.get(sid) ?? 0) + 1);
+      res.writeHead(sid === 'S_deleted' ? 410 : 402); res.end('{}'); return;
+    }
+    attempts++;
+    if (attempts === 1) { res.writeHead(429, { 'Retry-After': '1' }); res.end('{}'); }
+    else { accepted.push(body); res.writeHead(202); res.end('{}'); }
+  });
+  app.listen(0, '127.0.0.1'); await once(app, 'listening');
+  try {
+    const cfg = { tenantId: 'T', appId: 'A', ingestBase: `http://127.0.0.1:${app.address().port}` };
+    enqueueIngestEntries(cfg, 'S_throttle', [{ request: { rid: 'R1', method: 'POST', url: '/shipment', status: 200 }, t: Date.now() }]);
+    await flushIngestQueue();
+    for (let i = 0; i < 8; i++) await flushIngestQueue();
+    assert.equal(attempts, 1, 'forced flushes must not hammer the collector or use up retries during cooldown');
+    await new Promise(resolve => setTimeout(resolve, 1100));
+    await flushIngestQueue();
+    assert.equal(attempts, 2);
+    assert.equal(accepted.flatMap(batch => batch.events).filter(event => event.event_type === 'backend_request').length, 1);
+    for (const sid of ['S_quota_denied', 'S_deleted']) {
+      enqueueIngestEntries(cfg, sid, [{ requestCaptureManifest: { requestRid: sid, closedAt: Date.now() }, t: Date.now() }]);
+      for (let attempt = 0; attempt < 4; attempt++) await flushIngestQueue();
+      assert.equal(terminalAttempts.get(sid), 1, 'terminal refusal must not retry critical manifests indefinitely');
+    }
+    console.log('HTTP 429 respects Retry-After and retains the exact pending request');
+  } finally { app.closeAllConnections(); await new Promise(resolve => app.close(resolve)); }
+}
+main().catch(error => { console.error(error); process.exitCode = 1; });

package/test/live-broker-limits.testcontainers.test.js

@@ -0,0 +1,86 @@
+process.env.REPRO_SDK_BACKGROUND_MAX_DEFER_MS = '20';
+process.env.REPRO_SDK_BACKGROUND_IDLE_DELAY_MS = '0';
+process.env.REPRO_SDK_BACKGROUND_BUSY_IDLE_DELAY_MS = '0';
+const assert = require('node:assert/strict');
+const http = require('node:http');
+const { once } = require('node:events');
+const { GenericContainer, Wait } = require('testcontainers');
+const { KafkaContainer } = require('@testcontainers/kafka');
+const { Kafka, logLevel } = require('kafkajs');
+const amqp = require('amqplib');
+const { __reproTestHooks } = require('../dist');
+const { flushIngestQueue } = require('../dist/ingest/client');
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+
+async function main() {
+  const posts = [];
+  const sink = http.createServer(async (req, res) => {
+    const buffers = [];
+    for await (const chunk of req) buffers.push(chunk);
+    posts.push(JSON.parse(Buffer.concat(buffers)));
+    res.writeHead(202); res.end('{}');
+  });
+  sink.listen(0, '127.0.0.1'); await once(sink, 'listening');
+  let kafkaContainer, rabbitContainer, consumer, producer, connection, channel;
+  let consumed = 0;
+  const rows = Array.from({ length: 157 }, (_, id) => ({ id, state: 'available' }));
+  const payload = Buffer.from(JSON.stringify({ rows }));
+  const cfg = { tenantId: 'TENANT_broker_limits', appId: 'APP_limits', appSecret: 'test',
+    privacy: { captureRaw: true, environment: 'dev' }, ingestBase: `http://127.0.0.1:${sink.address().port}` };
+  const headers = mode => ({ 'x-bug-session-id': `S_broker_${mode}`, 'x-bug-action-id': `A_${mode}`, 'x-repro-capture-mode': mode });
+  async function businessWork(buffer) {
+    await sleep(15);
+    const value = JSON.parse(buffer.toString());
+    assert.equal(value.rows.length, 157, 'instrumentation must not modify the delivered message');
+    assert.equal(value.rows[156].id, 156);
+    consumed++;
+  }
+  try {
+    kafkaContainer = await new KafkaContainer('confluentinc/cp-kafka:7.6.1').withKraft().start();
+    const kafka = new Kafka({ brokers: [`${kafkaContainer.getHost()}:${kafkaContainer.getMappedPort(9093)}`], logLevel: logLevel.NOTHING });
+    producer = kafka.producer(); consumer = kafka.consumer({ groupId: 'repro-live-limit-test' });
+    await producer.connect(); await consumer.connect();
+    const admin = kafka.admin(); await admin.connect();
+    try { await admin.createTopics({ topics: [{ topic: 'capture-limits', numPartitions: 1, replicationFactor: 1 }] }); }
+    finally { await admin.disconnect(); }
+    await consumer.subscribe({ topic: 'capture-limits', fromBeginning: true });
+    await consumer.run({ eachMessage: __reproTestHooks.wrapKafkaEachMessageHandlerForTest(
+      async ({ message }) => businessWork(message.value), cfg, { __repro_group_id: 'repro-live-limit-test' },
+    ) });
+    for (const mode of ['live', 'staging']) await producer.send({ topic: 'capture-limits', messages: [{ key: mode, value: payload, headers: headers(mode) }] });
+
+    rabbitContainer = await new GenericContainer('rabbitmq:3.13-alpine')
+      .withEnvironment({ RABBITMQ_DEFAULT_USER: 'repro', RABBITMQ_DEFAULT_PASS: 'test' })
+      .withExposedPorts(5672).withWaitStrategy(Wait.forLogMessage('Server startup complete')).start();
+    connection = await amqp.connect(`amqp://repro:test@${rabbitContainer.getHost()}:${rabbitContainer.getMappedPort(5672)}`);
+    channel = await connection.createChannel(); await channel.assertQueue('capture-limits', { durable: false });
+    await channel.consume('capture-limits', __reproTestHooks.wrapAmqplibConsumeHandlerForTest(async message => {
+      await businessWork(message.content); channel.ack(message);
+    }, cfg, 'capture-limits'));
+    for (const mode of ['live', 'staging']) channel.sendToQueue('capture-limits', payload, { headers: headers(mode) });
+    const deadline = Date.now() + 30_000;
+    let requests;
+    do {
+      await __reproTestHooks.drainSdkBackgroundQueueForTest(); await flushIngestQueue();
+      requests = posts.flatMap(post => post.events || []).filter(event => event.event_type === 'backend_request');
+      if (requests.length >= 4 && consumed === 4) break;
+      await sleep(50);
+    } while (Date.now() < deadline);
+    assert.equal(consumed, 4); assert.equal(requests.length, 4);
+    for (const method of ['KAFKA_CONSUME', 'AMQP_CONSUME']) for (const mode of ['live', 'staging']) {
+      const request = requests.find(event => event.session_id === `S_broker_${mode}` && event.payload.request.method === method)?.payload.request;
+      assert(request, `${method} ${mode} missing`);
+      assert.equal(request.body.value.rows.length, mode === 'live' ? 101 : 157, `${method} ${mode}`);
+      assert.equal(JSON.parse(request.body.rawValue).rows.length, mode === 'live' ? 101 : 157, 'raw JSON copy must not bypass live limits');
+      if (mode === 'live') assert.equal(request.body.value.rows[100].originalCount, 157);
+    }
+    console.log('real Kafka and RabbitMQ: live bounds after asynchronous consumers; staging and broker values unchanged');
+  } finally {
+    if (consumer) await consumer.disconnect(); if (producer) await producer.disconnect();
+    if (channel) await channel.close(); if (connection) await connection.close();
+    await __reproTestHooks.drainSdkBackgroundQueueForTest(); await flushIngestQueue();
+    sink.closeAllConnections(); await new Promise(resolve => sink.close(resolve));
+    if (rabbitContainer) await rabbitContainer.stop(); if (kafkaContainer) await kafkaContainer.stop();
+  }
+}
+main().catch(error => { console.error(error); process.exitCode = 1; });

package/test/live-capture-limits.test.js

@@ -0,0 +1,99 @@
+const assert = require('node:assert/strict');
+const { limitLiveCapture, limitLiveArguments, collectCaptureOmissions } = require('../dist/live-capture-limits');
+const { projectSemanticInfrastructureValue } = require('../dist/semantic-serialization');
+const { IncomingMessage } = require('node:http');
+const { Socket } = require('node:net');
+const mongoose = require('mongoose');
+
+let getterCalls = 0;
+const payload = { nested: { rows: Array.from({ length: 157 }, (_, id) => ({ id, secret: `value-${id}` })) } };
+Object.defineProperty(payload, 'danger', { enumerable: true, get() { getterCalls++; throw new Error('not safe'); } });
+payload.self = payload;
+payload.alias = payload.nested;
+const limited = limitLiveCapture(payload);
+assert.equal(getterCalls, 0);
+assert.equal(payload.nested.rows.length, 157);
+assert.equal(limited.value.nested.rows.length, 101);
+assert.equal(limited.value.nested.rows[99].id, 99);
+assert.equal(limited.value.nested.rows[100].__kind, 'repro-omitted');
+assert.equal(limited.value.nested.rows[100].originalCount, 157);
+assert.equal(limited.value.alias.__reproCircularRef, '$["nested"]');
+assert.equal(limited.value.self.__reproCircularRef, '$');
+assert.equal(limited.omissions.length, 2);
+assert.equal(limitLiveCapture(limited.value).value.nested.rows[100].originalCount, 157);
+assert.equal(collectCaptureOmissions(limited.value).length, 2);
+
+const native = limitLiveCapture({
+  map: new Map(Array.from({ length: 150 }, (_, i) => [{ id: i }, { value: i }])),
+  set: new Set(Array.from({ length: 101 }, (_, i) => i)),
+  bytes: new Uint8Array(130).fill(7),
+}).value;
+assert.deepEqual(native.map.entries[99], [{ id: 99 }, { value: 99 }].map(x => Object.assign(Object.create(null), x)));
+assert.equal(native.map.entries[100].originalCount, 150);
+assert.equal(native.set.values[100].originalCount, 101);
+assert.equal(native.bytes.values[100].originalCount, 130);
+const dataBuffer = new Uint8Array(200).fill(8).buffer;
+const dataView = limitLiveCapture(new DataView(dataBuffer, 10, 140)).value;
+assert.equal(dataView.values[99], 8);
+assert.equal(dataView.values[100].originalCount, 140);
+assert.equal(limitLiveCapture(dataBuffer).value.values[100].originalCount, 200);
+const error = new Error('observed failure', { cause: { rows: payload.nested.rows } });
+const capturedError = limitLiveCapture(error).value;
+assert.equal(capturedError.message, 'observed failure');
+assert.equal(capturedError.cause.rows[100].originalCount, 157);
+const deep = {};
+let node = deep;
+for (let i = 0; i < 12; i++) node = node.next = { level: i + 1 };
+const depth = limitLiveCapture(deep);
+assert.equal(depth.omissions[0].reason, 'max-depth');
+assert.equal(depth.omissions[0].limit, 10);
+assert.equal(depth.omissions[0].path.split('["next"]').length - 1, 11);
+const aliasTarget = { important: 'must remain visible through the shallower alias' };
+node.next = aliasTarget;
+deep.shallowAlias = aliasTarget;
+assert.equal(limitLiveCapture(deep).value.shallowAlias.important, aliasTarget.important);
+const wide = Object.fromEntries(Array.from({ length: 150 }, (_, i) => [`key${i}`, i]));
+wide.__reproCapture = 'business field';
+const width = limitLiveCapture(wide);
+assert.equal(width.value.key99, 99);
+assert.equal(width.value.key100, undefined);
+assert.equal(width.omissions[0].originalCount, 151);
+assert.equal(limitLiveCapture(width.value).omissions[0].originalCount, 151);
+const tooManyArgs = Array.from({ length: 157 }, (_, i) => i);
+assert.equal(limitLiveArguments(tooManyArgs)[100].originalCount, 157);
+assert.equal(limitLiveArguments(limitLiveArguments(tooManyArgs))[100].originalCount, 157);
+const rawJson = JSON.stringify({ rows: payload.nested.rows });
+const boundedJson = limitLiveCapture(rawJson).value;
+assert.equal(typeof boundedJson, 'string');
+assert.equal(JSON.parse(boundedJson).rows[100].originalCount, 157);
+assert.equal(collectCaptureOmissions(boundedJson)[0].originalCount, 157);
+const smallJson = '{ "business": [1, 2, 3] }';
+assert.equal(limitLiveCapture(smallJson).value, smallJson, 'unlimited strings retain exact formatting');
+const MongoClient = class MongoClient { connect() {} db() {} close() {} };
+const actualInfrastructure = new MongoClient();
+actualInfrastructure.password = 'never-serialize-runtime-config';
+assert.equal(limitLiveCapture(actualInfrastructure).value.category, 'mongodb-infrastructure');
+assert.equal(limitLiveCapture(actualInfrastructure).value.password, undefined);
+const unknownMongoClass = class MongoClient { constructor() { this.orderId = 'business'; } };
+assert.equal(limitLiveCapture(new unknownMongoClass()).value.orderId, 'business');
+const Logger = class Logger { constructor() { this.importantBusinessField = true; } };
+const ModuleRef = class ModuleRef { constructor() { this.invoice = 'INV-1'; } };
+assert.equal(projectSemanticInfrastructureValue(new Logger()), null);
+assert.equal(projectSemanticInfrastructureValue(new ModuleRef()), null);
+const collision = { $__: { business: true }, _doc: { id: 'BUSINESS_DOC' }, invoice: 'INV-2' };
+assert.equal(limitLiveCapture(collision).value.invoice, 'INV-2', 'business property names must not trigger infrastructure removal');
+const Shipment = mongoose.model('LiveLimitShipment', new mongoose.Schema({ status: String, rows: [Number] }));
+const shipment = new Shipment({ status: 'received', rows: Array.from({ length: 157 }, (_, i) => i) });
+assert.equal(limitLiveCapture(shipment).value.status, 'received');
+assert.equal(limitLiveCapture(shipment).value.rows[100].originalCount, 157);
+assert.equal(limitLiveCapture(shipment).value.$__, undefined);
+const req = new IncomingMessage(new Socket());
+req.headers = { 'x-shipment': 'SHIP_1' }; req.body = { rows: [1, 2, 3] };
+Object.defineProperty(req, 'dangerous', { get() { throw new Error('must not execute'); } });
+assert.equal(limitLiveCapture(req).value.headers['x-shipment'], 'SHIP_1');
+assert.deepEqual(limitLiveCapture(req).value.body.rows, [1, 2, 3]);
+req.socket.destroy();
+const withPrototypeKey = JSON.parse('{"__proto__":{"polluted":true},"valid":1}');
+assert.equal(limitLiveCapture(withPrototypeKey).value.__proto__.polluted, true);
+assert.equal({}.polluted, undefined);
+console.log('live capture limits: native collections, depth, keys, getters, references and metadata passed');

package/test/live-capture-limits.testcontainers.test.js

@@ -0,0 +1,78 @@
+process.env.REPRO_SDK_BACKGROUND_IDLE_DELAY_MS = '0';
+process.env.REPRO_SDK_BACKGROUND_BUSY_IDLE_DELAY_MS = '0';
+process.env.REPRO_SDK_BACKGROUND_MAX_DEFER_MS = '30';
+process.env.TRACE_IDLE_FLUSH_MS = '10';
+process.env.TRACE_LINGER_AFTER_FINISH_MS = '0';
+const assert = require('node:assert/strict');
+const http = require('node:http');
+const { GenericContainer, Wait } = require('testcontainers');
+const { initRepro } = require('../dist');
+const { flushIngestQueue } = require('../dist/ingest/client');
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+
+async function main() {
+  const posts = [];
+  const sink = http.createServer((req, res) => {
+    const chunks = [];
+    req.on('data', chunk => chunks.push(chunk));
+    req.on('end', () => { posts.push(JSON.parse(Buffer.concat(chunks))); res.writeHead(202); res.end('{}'); });
+  });
+  await new Promise(resolve => sink.listen(0, '127.0.0.1', resolve));
+  let mongo, app;
+  try {
+    mongo = await new GenericContainer('mongo:7').withExposedPorts(27017).withWaitStrategy(Wait.forListeningPorts()).start();
+    const config = { tenantId: 'TENANT_limits', appId: 'APP_limits', appSecret: 'test',
+      privacy: { environment: 'dev', captureRaw: true }, ingestBase: `http://127.0.0.1:${sink.address().port}`,
+      tracing: { fullValueCapture: true, disableFunctionTypes: ['constructor'], logFunctionCalls: false } };
+    await initRepro(config);
+    app = await require('./fixtures/live-capture-limits-server').start(config, `mongodb://${mongo.getHost()}:${mongo.getMappedPort(27017)}/limits`);
+    for (const mode of ['live', 'staging']) {
+      const response = await fetch(`http://127.0.0.1:${app.server.address().port}/shipment?__repro_sid=S_${mode}&__repro_aid=A_${mode}&__repro_mode=${mode}`);
+      assert.equal(response.status, 200);
+      const actual = await response.json();
+      assert.equal(actual.rows.length, 157, 'recording must not alter the application response');
+      assert.equal(actual.rows[156].id, 156);
+    }
+    const deadline = Date.now() + 30_000;
+    let events = [];
+    do {
+      await flushIngestQueue();
+      events = posts.flatMap(post => post.events || []);
+      if (events.filter(event => event.event_type === 'request_capture_manifest').length >= 2) break;
+      await sleep(100);
+    } while (Date.now() < deadline);
+    for (const mode of ['live', 'staging']) {
+      const scoped = events.filter(event => event.session_id === `S_${mode}`);
+      const request = scoped.find(event => event.event_type === 'backend_request')?.payload?.request;
+      assert(request, `missing ${mode} request`);
+      const values = scoped.flatMap(event => [...(event.payload?.traceValues || []), ...(event.payload?.requestValues || []), ...(event.payload?.dbValues || [])]);
+      if (request.respBodyValueCapture?.valueId) assert(values.some(value => value.id === request.respBodyValueCapture.valueId), 'response reference must resolve');
+      const body = values.find(value => value.id === request.respBodyValueCapture?.valueId)?.value || request.respBody;
+      assert(body?.rows, `missing ${mode} response body`);
+      assert.equal(body.rows.length, mode === 'live' ? 101 : 157, JSON.stringify({ mode, capture: request.respBodyValueCapture, valueTargets: values.map(value => value.target) }));
+      if (mode === 'live') {
+        assert.equal(body.rows[100].originalCount, 157);
+        assert.equal(request.respBodyValueCapture.complete, false);
+      }
+      const changes = scoped.filter(event => event.event_type === 'db_change').flatMap(event => event.payload?.db || []);
+      const read = changes.find(change => change.op === 'findOne');
+      assert(read, `missing ${mode} database query`);
+      const result = values.find(value => value.id === read.resultMetaValueCapture?.valueId)?.value || read.resultMeta;
+      const resultText = JSON.stringify(result);
+      assert(resultText?.includes('SHIP-LIMIT'), `missing ${mode} database result ${JSON.stringify(read)}`);
+      assert.equal(resultText.includes('"id":156'), mode === 'staging', 'query results must follow the same mode as responses');
+      if (mode === 'live') assert.equal(read.resultMetaValueCapture.complete, false);
+      const trace = scoped.flatMap(event => event.payload?.trace || []).find(event => event.fn === 'inspectShipment' && event.type === 'enter');
+      assert(trace, `missing ${mode} function arguments`);
+      const args = values.find(value => value.id === trace.argsValueCapture?.valueId)?.value || trace.args;
+      assert.equal(args[0].rows.length, mode === 'live' ? 101 : 157);
+    }
+    console.log('real Mongo + Express + instrumented traces: live bounds and exact staging evidence passed');
+  } finally {
+    if (app) await app.close();
+    await flushIngestQueue();
+    await new Promise(resolve => sink.close(resolve));
+    if (mongo) await mongo.stop();
+  }
+}
+main().catch(error => { console.error(error); process.exitCode = 1; });