@reproapp/node-sdk 0.0.49 → 0.0.51

package/src/live-capture-limits.ts

@@ -0,0 +1,177 @@
+import { IncomingMessage, ServerResponse } from 'http';
+import { mongooseDocumentData, projectSemanticInfrastructureValue } from './semantic-serialization';
+
+export type CaptureOmission = {
+    reason: 'max-depth' | 'max-keys' | 'max-entries' | 'accessor' | 'uninspectable';
+    path: string;
+    limit?: number;
+    originalCount?: number;
+    capturedCount: number;
+};
+export const LIVE_CAPTURE_LIMITS = Object.freeze({ maxDepth: 10, maxKeys: 100, maxEntries: 100 });
+const marker = (omission: CaptureOmission) => ({ __kind: 'repro-omitted', complete: false, ...omission });
+const childPath = (path: string, key: string | number) => `${path}[${JSON.stringify(key)}]`;
+function parseStructuredString(value: unknown): any {
+    if (typeof value !== 'string' || !/^[\s]*[\[{]/.test(value)) return undefined;
+    try { const parsed = JSON.parse(value); return parsed && typeof parsed === 'object' ? parsed : undefined; }
+    catch { return undefined; }
+}
+
+/** Snapshot only data descriptors: capture must never execute application getters. */
+export function limitLiveCapture(value: unknown, rootPath = '$'): { value: any; omissions: CaptureOmission[] } {
+    const omissions: CaptureOmission[] = [];
+    const seen = new WeakMap<object, { path: string; depth: number }>();
+    const omit = (detail: CaptureOmission) => { omissions.push(detail); return marker(detail); };
+    const walk = (input: any, depth: number, path: string): any => {
+        if (input === null || input === undefined) return input;
+        if (typeof input === 'string') {
+            const parsed = parseStructuredString(input);
+            if (parsed === undefined) return input;
+            const before = omissions.length;
+            const bounded = walk(parsed, depth, path);
+            // Preserve the original string exactly unless its structured data exceeded a limit.
+            return omissions.length === before ? input : JSON.stringify(bounded);
+        }
+        if (typeof input === 'bigint' || typeof input === 'symbol') return String(input);
+        if (typeof input === 'function') return '[Function]';
+        if (typeof input !== 'object') return input;
+        const previous = seen.get(input);
+        if (previous && previous.depth <= depth) return { __reproCircularRef: previous.path };
+        seen.set(input, { path, depth });
+        const descriptor = (key: string) => Object.getOwnPropertyDescriptor(input, key);
+        const data = (key: string) => descriptor(key)?.value;
+        if (data('__kind') === 'repro-omitted') {
+            const detail = { reason: data('reason'), path: data('path'), limit: data('limit'), originalCount: data('originalCount'), capturedCount: data('capturedCount') };
+            omissions.push(detail);
+            return marker(detail);
+        }
+        if (input instanceof Date) return Number.isNaN(Date.prototype.getTime.call(input)) ? 'Invalid Date' : Date.prototype.toISOString.call(input);
+        if (input instanceof RegExp) return RegExp.prototype.toString.call(input);
+        if (input instanceof IncomingMessage) {
+            // The business body is its own root, not depth one in a socket graph.
+            return { __kind: 'http-request', method: data('method'), url: data('originalUrl') ?? data('url'),
+                headers: walk(data('headers') ?? Object.getOwnPropertyDescriptor(IncomingMessage.prototype, 'headers')?.get?.call(input), 0, childPath(path, 'headers')),
+                query: walk(data('query'), 0, childPath(path, 'query')),
+                body: walk(data('body'), 0, childPath(path, 'body')),
+                params: walk(data('params'), 0, childPath(path, 'params')) };
+        }
+        if (input instanceof ServerResponse) return { __kind: 'http-response', statusCode: data('statusCode') };
+        const projected = projectSemanticInfrastructureValue(input);
+        if (projected) return projected.value;
+        // Mongoose stores business fields in _doc; never recurse through $__ state.
+        const documentData = mongooseDocumentData(input);
+        if (documentData) return walk(documentData, depth, path);
+        if (depth > LIVE_CAPTURE_LIMITS.maxDepth) return omit({ reason: 'max-depth', path, limit: LIVE_CAPTURE_LIMITS.maxDepth, capturedCount: 0 });
+        if (input instanceof Error) {
+            const details: Record<string, any> = Object.create(null);
+            for (const key of ['message', 'stack', 'cause', 'errors', ...Object.keys(input)]) {
+                const item = descriptor(key);
+                if (item) Object.defineProperty(details, key, { ...item, enumerable: true, configurable: true });
+            }
+            return walk(details, depth, path);
+        }
+        if (input instanceof ArrayBuffer || (typeof SharedArrayBuffer !== 'undefined' && input instanceof SharedArrayBuffer) || input instanceof DataView) {
+            let bytes: Uint8Array;
+            if (input instanceof DataView) {
+                const read = (key: string) => Object.getOwnPropertyDescriptor(DataView.prototype, key)!.get!.call(input);
+                bytes = new Uint8Array(read('buffer'), read('byteOffset'), read('byteLength'));
+            } else bytes = new Uint8Array(input);
+            return { __type: input instanceof DataView ? 'DataView' : 'ArrayBuffer', values: walk(bytes, depth, path).values };
+        }
+        if (input instanceof Map) {
+            const entries: any[] = [];
+            const size = Object.getOwnPropertyDescriptor(Map.prototype, 'size')!.get!.call(input);
+            for (const [key, item] of Map.prototype.entries.call(input)) {
+                if (entries.length >= LIVE_CAPTURE_LIMITS.maxEntries) break;
+                const index = entries.length;
+                entries.push([walk(key, depth + 1, childPath(path, `key:${index}`)), walk(item, depth + 1, childPath(path, index))]);
+            }
+            if (size > entries.length) entries.push(omit({ reason: 'max-entries', path, limit: 100, originalCount: size, capturedCount: entries.length }));
+            return { __type: 'Map', entries };
+        }
+        if (input instanceof Set) {
+            const values: any[] = [];
+            const size = Object.getOwnPropertyDescriptor(Set.prototype, 'size')!.get!.call(input);
+            for (const item of Set.prototype.values.call(input)) {
+                if (values.length >= 100) break;
+                values.push(walk(item, depth + 1, childPath(path, values.length)));
+            }
+            if (size > values.length) values.push(omit({ reason: 'max-entries', path, limit: 100, originalCount: size, capturedCount: values.length }));
+            return { __type: 'Set', values };
+        }
+        if (Array.isArray(input) || (ArrayBuffer.isView(input) && !(input instanceof DataView))) {
+            const length = (input as any).length;
+            const previousMarker = Array.isArray(input) && length === 101 ? descriptor('100')?.value : null;
+            const prior = previousMarker && Object.getOwnPropertyDescriptors(previousMarker);
+            const hasPriorLimit = prior?.__kind?.value === 'repro-omitted' && prior?.reason?.value === 'max-entries';
+            const values: any[] = [];
+            for (let i = 0; i < Math.min(length, 100); i++) {
+                const itemDescriptor = descriptor(String(i));
+                values.push(itemDescriptor && !('value' in itemDescriptor)
+                    ? omit({ reason: 'accessor', path: childPath(path, i), capturedCount: 0 })
+                    : walk(itemDescriptor?.value, depth + 1, childPath(path, i)));
+            }
+            if (length > 100) values.push(hasPriorLimit
+                ? walk(previousMarker, depth + 1, path)
+                : omit({ reason: 'max-entries', path, limit: 100, originalCount: length, capturedCount: 100 }));
+            return Array.isArray(input) ? values : { __type: 'TypedArray', values };
+        }
+        const keys = Object.keys(input);
+        const previousMetadataKey = keys.find(key => {
+            if (!/^__reproCapture\$*$/.test(key)) return false;
+            const candidate = descriptor(key)?.value;
+            return candidate && Object.getOwnPropertyDescriptor(candidate, '__kind')?.value === 'repro-omitted'
+                && Object.getOwnPropertyDescriptor(candidate, 'reason')?.value === 'max-keys';
+        });
+        const businessKeys = keys.filter(key => key !== previousMetadataKey);
+        const out: Record<string, any> = Object.create(null);
+        for (const key of businessKeys.slice(0, 100)) {
+            const itemDescriptor = descriptor(key)!;
+            out[key] = 'value' in itemDescriptor
+                ? walk(itemDescriptor.value, depth + 1, childPath(path, key))
+                : omit({ reason: 'accessor', path: childPath(path, key), capturedCount: 0 });
+        }
+        if (businessKeys.length > 100 || previousMetadataKey) {
+            const detail = previousMetadataKey
+                ? walk(descriptor(previousMetadataKey)?.value, depth + 1, path)
+                : omit({ reason: 'max-keys', path, limit: 100, originalCount: businessKeys.length, capturedCount: 100 });
+            let metadataKey = '__reproCapture';
+            while (Object.prototype.hasOwnProperty.call(out, metadataKey)) metadataKey += '$';
+            out[metadataKey] = detail;
+        }
+        return out;
+    };
+    try { return { value: walk(value, 0, rootPath), omissions }; }
+    catch { return { value: omit({ reason: 'uninspectable', path: rootPath, capturedCount: 0 }), omissions }; }
+}
+
+export function collectCaptureOmissions(value: any): CaptureOmission[] {
+    const result: CaptureOmission[] = [];
+    const seen = new WeakSet();
+    const pending = [value];
+    while (pending.length) {
+        const item = pending.pop();
+        const node = typeof item === 'string' ? parseStructuredString(item) : item;
+        if (!node || typeof node !== 'object' || seen.has(node)) continue;
+        seen.add(node);
+        const descriptors = Object.getOwnPropertyDescriptors(node);
+        if (descriptors.__kind?.value === 'repro-omitted') {
+            result.push({ reason: descriptors.reason?.value, path: descriptors.path?.value, limit: descriptors.limit?.value,
+                originalCount: descriptors.originalCount?.value, capturedCount: descriptors.capturedCount?.value });
+            continue;
+        }
+        for (const item of Object.values(descriptors)) if ('value' in item) pending.push(item.value);
+    }
+    return result;
+}
+
+export function limitLiveArguments(args: any[]): any[] {
+    const values = args.slice(0, 100).map((arg, index) => limitLiveCapture(arg, `$[${index}]`).value);
+    if (args.length > 100) {
+        const prior = Object.getOwnPropertyDescriptor(args, '100')?.value;
+        values.push(args.length === 101 && prior && Object.getOwnPropertyDescriptor(prior, '__kind')?.value === 'repro-omitted'
+            ? limitLiveCapture(prior).value
+            : marker({ reason: 'max-entries', path: '$', limit: 100, originalCount: args.length, capturedCount: 100 }));
+    }
+    return values;
+}

package/src/semantic-serialization.ts

@@ -52,6 +52,12 @@ function method(value: unknown, key: string): boolean {
     }
 }
 
+export function mongooseDocumentData(value: object): object | null {
+    const doc = Object.getOwnPropertyDescriptor(value, '_doc')?.value;
+    if (!doc || typeof doc !== 'object' || !Object.getOwnPropertyDescriptor(value, '$__')?.value) return null;
+    return method(value, '$__init') && method(value, '$toObject') ? doc : null;
+}
+
 function primitiveStateValue(value: unknown): string | number | boolean | null | undefined {
     if (value === null) return null;
     if (typeof value === 'string' || typeof value === 'number' || typeof value === 'boolean') {
@@ -86,6 +92,7 @@ function projectConfigurationService(value: object, className: string): Semantic
 
 function projectLogger(value: object, className: string): SemanticProjection | null {
     if (!/(Logger|LoggerService)$/i.test(className)) return null;
+    if (!method(value, 'log') && !method(value, 'info')) return null;
     const descriptors = ownDataDescriptors(value);
     const context = primitiveStateValue(descriptors.context?.value);
     return semanticValue('logger', className, context !== undefined ? { context } : {});
@@ -95,6 +102,14 @@ function projectNestInfrastructure(value: object, className: string): SemanticPr
     if (!/(ModuleRef|ModulesContainer|InstanceWrapper|NestContainer|Injector|DiscoveryService|ExecutionContextHost|ArgumentsHost|HttpAdapterHost)$/i.test(className)) {
         return null;
     }
+    const signatures: Record<string, string[]> = {
+        ModuleRef: ['get', 'resolve'], ModulesContainer: ['get', 'set'],
+        InstanceWrapper: ['getInstanceByContextId'], NestContainer: ['getModules'],
+        Injector: ['loadInstance'], DiscoveryService: ['getProviders'],
+        ExecutionContextHost: ['switchToHttp', 'getArgs'], ArgumentsHost: ['switchToHttp', 'getArgs'],
+        HttpAdapterHost: ['listen$'],
+    };
+    if (!(signatures[className] ?? []).some(key => method(value, key))) return null;
     return semanticValue('nestjs-infrastructure', className);
 }
 
@@ -159,6 +174,20 @@ function projectTypeOrm(value: object, className: string): SemanticProjection |
     return null;
 }
 
+function projectMongoInfrastructure(value: object, className: string): SemanticProjection | null {
+    const signatures: Record<string, string[]> = {
+        MongoClient: ['connect', 'db', 'close'],
+        ClientSession: ['startTransaction', 'endSession'],
+        ConnectionPool: ['checkOut', 'checkIn'],
+        NativeConnection: ['openUri', 'model', 'close'],
+        Schema: ['add', 'path', 'plugin'],
+    };
+    const required = signatures[className];
+    return required?.every(key => method(value, key))
+        ? semanticValue('mongodb-infrastructure', className)
+        : null;
+}
+
 /**
  * Projects known runtime machinery into stable, non-recursive descriptions.
  * Unknown application values deliberately return null and remain fully captured.
@@ -176,6 +205,7 @@ export function projectSemanticInfrastructureValue(value: unknown): SemanticProj
         projectRedis(value, className) ||
         projectKafka(value, className) ||
         projectAmqp(value, className) ||
+        projectMongoInfrastructure(value, className) ||
         projectPostgres(value, className) ||
         projectTypeOrm(value, className)
     );

package/test/background-continuous-traffic.testcontainers.test.js

@@ -0,0 +1,100 @@
+process.env.REPRO_SDK_BACKGROUND_IDLE_DELAY_MS = '2000';
+process.env.REPRO_SDK_BACKGROUND_BUSY_IDLE_DELAY_MS = '0';
+process.env.REPRO_SDK_BACKGROUND_MAX_DEFER_MS = '200';
+process.env.TRACE_IDLE_FLUSH_MS = '10';
+process.env.TRACE_LINGER_AFTER_FINISH_MS = '0';
+
+const assert = require('node:assert/strict');
+const http = require('node:http');
+const { GenericContainer, Wait } = require('testcontainers');
+const { initRepro } = require('../dist');
+const { flushIngestQueue } = require('../dist/ingest/client');
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+
+async function main() {
+  const events = [];
+  let rejectedOnce = false;
+  const sink = http.createServer((req, res) => {
+    const chunks = [];
+    req.on('data', chunk => chunks.push(chunk));
+    req.on('end', () => {
+      const batch = JSON.parse(Buffer.concat(chunks)).events;
+      if (!rejectedOnce && batch.some(event => event.event_type === 'backend_request')) {
+        rejectedOnce = true;
+        res.writeHead(503); res.end('{}'); return;
+      }
+      events.push(...batch);
+      res.writeHead(202); res.end('{}');
+    });
+  });
+  await new Promise(resolve => sink.listen(0, '127.0.0.1', resolve));
+  let mongo, app, polling;
+  let stopped = false, polls = 0, maxPollGap = 0;
+  try {
+    mongo = await new GenericContainer('mongo:7').withExposedPorts(27017)
+      .withWaitStrategy(Wait.forListeningPorts()).start();
+    const config = { tenantId: 'TENANT_busy', appId: 'APP_busy', appSecret: 'test',
+      privacy: { environment: 'dev', captureRaw: true },
+      ingestBase: `http://127.0.0.1:${sink.address().port}`,
+      tracing: { fullValueCapture: true, disableFunctionTypes: ['constructor'], logFunctionCalls: false } };
+    await initRepro(config);
+    app = await require('./fixtures/live-capture-limits-server').start(config,
+      `mongodb://${mongo.getHost()}:${mongo.getMappedPort(27017)}/busy`);
+    const base = `http://127.0.0.1:${app.server.address().port}`;
+    polling = (async () => {
+      let previous = Date.now();
+      while (!stopped) {
+        // Untagged, short requests also participate in the SDK's activity tracking.
+        const response = await fetch(`${base}/uncorrelated`);
+        await response.text();
+        maxPollGap = Math.max(maxPollGap, Date.now() - previous);
+        previous = Date.now();
+        polls++;
+        await sleep(20);
+      }
+    })();
+    for (const mode of ['live', 'staging']) {
+      const response = await fetch(`${base}/shipment?__repro_sid=S_busy_${mode}&__repro_aid=A_${mode}&__repro_mode=${mode}`);
+      assert.equal(response.status, 200);
+      const body = await response.json();
+      assert.equal(body.rows.length, 157, 'capture must not change business responses');
+      assert.equal(body.rows[156].id, 156);
+    }
+    const complete = () => ['live', 'staging'].every(mode => {
+      const scoped = events.filter(event => event.session_id === `S_busy_${mode}`);
+      return ['request_capture_start', 'backend_request', 'request_capture_manifest', 'trace_batch', 'db_change']
+        .every(type => scoped.some(event => event.event_type === type));
+    });
+    // Do not call flushIngestQueue: automatic delivery must work while traffic continues.
+    const deadline = Date.now() + 6000;
+    while (!complete() && Date.now() < deadline) await sleep(25);
+    assert(polls > 5, 'continuous traffic must overlap capture finalization');
+    assert(maxPollGap < 2000, `traffic must not accidentally create an idle window: ${maxPollGap}ms`);
+    assert(complete(), `uploads starved during short requests: ${JSON.stringify(events.map(e => [e.session_id, e.event_type]))}`);
+    assert(rejectedOnce, 'the test must exercise a real collector retry');
+    for (const mode of ['live', 'staging']) {
+      const scoped = events.filter(event => event.session_id === `S_busy_${mode}`);
+      const requests = scoped.filter(event => event.event_type === 'backend_request');
+      assert.equal(requests.length, 1, 'finish and close must not duplicate requests');
+      const request = requests[0].payload.request;
+      const values = scoped.flatMap(e => [...(e.payload.requestValues || []), ...(e.payload.traceValues || []), ...(e.payload.dbValues || [])]);
+      const body = values.find(v => v.id === request.respBodyValueCapture?.valueId)?.value || request.respBody;
+      assert.equal(body.rows.length, mode === 'live' ? 101 : 157);
+      const trace = scoped.flatMap(e => e.payload.trace || []).find(e => e.fn === 'inspectShipment' && e.type === 'enter');
+      assert(trace, 'instrumented function arguments must survive background delivery');
+      const args = values.find(v => v.id === trace.argsValueCapture?.valueId)?.value || trace.args;
+      assert.equal(args[0].rows.length, mode === 'live' ? 101 : 157);
+      assert(scoped.flatMap(e => e.payload.db || []).some(change => change.op === 'findOne'));
+    }
+    console.log(`continuous short HTTP traffic: complete live/staging captures delivered during ${polls} requests`);
+  } finally {
+    stopped = true;
+    if (polling) await polling;
+    if (app) await app.close();
+    await sleep(2100);
+    await flushIngestQueue();
+    await new Promise(resolve => sink.close(resolve));
+    if (mongo) await mongo.stop();
+  }
+}
+main().catch(error => { console.error(error); process.exitCode = 1; });

package/test/fixtures/live-capture-limits-server.js

@@ -0,0 +1,21 @@
+const express = require('express');
+const mongoose = require('mongoose');
+const { reproMiddleware, reproMongoosePlugin } = require('../../dist');
+
+function inspectShipment(shipment) { return shipment; }
+async function start(config, uri) {
+  const connection = await mongoose.createConnection(uri).asPromise();
+  const schema = new mongoose.Schema({ reference: String, rows: [Object] });
+  schema.plugin(reproMongoosePlugin, config);
+  const Shipment = connection.model('LiveCaptureShipment', schema);
+  await Shipment.create({ reference: 'SHIP-LIMIT', rows: Array.from({ length: 157 }, (_, id) => ({ id, status: 'available' })) });
+  const app = express();
+  app.use(reproMiddleware(config));
+  app.get('/shipment', async (_req, res) => {
+    const shipment = await Shipment.findOne({ reference: 'SHIP-LIMIT' }).lean().exec();
+    res.json(inspectShipment(shipment));
+  });
+  const server = await new Promise(resolve => { const server = app.listen(0, '127.0.0.1', () => resolve(server)); });
+  return { server, close: async () => { await new Promise(resolve => server.close(resolve)); await connection.close(); } };
+}
+module.exports = { start };

package/test/ingest-throttle-retention.test.js

@@ -0,0 +1,41 @@
+const assert = require('node:assert/strict');
+const http = require('node:http');
+const { once } = require('node:events');
+const { enqueueIngestEntries, flushIngestQueue } = require('../dist/ingest/client');
+
+async function main() {
+  let attempts = 0;
+  const accepted = [];
+  const terminalAttempts = new Map();
+  const app = http.createServer(async (req, res) => {
+    const chunks = []; for await (const chunk of req) chunks.push(chunk);
+    const body = JSON.parse(Buffer.concat(chunks));
+    const sid = body.events[0]?.session_id;
+    if (sid === 'S_quota_denied' || sid === 'S_deleted') {
+      terminalAttempts.set(sid, (terminalAttempts.get(sid) ?? 0) + 1);
+      res.writeHead(sid === 'S_deleted' ? 410 : 402); res.end('{}'); return;
+    }
+    attempts++;
+    if (attempts === 1) { res.writeHead(429, { 'Retry-After': '1' }); res.end('{}'); }
+    else { accepted.push(body); res.writeHead(202); res.end('{}'); }
+  });
+  app.listen(0, '127.0.0.1'); await once(app, 'listening');
+  try {
+    const cfg = { tenantId: 'T', appId: 'A', ingestBase: `http://127.0.0.1:${app.address().port}` };
+    enqueueIngestEntries(cfg, 'S_throttle', [{ request: { rid: 'R1', method: 'POST', url: '/shipment', status: 200 }, t: Date.now() }]);
+    await flushIngestQueue();
+    for (let i = 0; i < 8; i++) await flushIngestQueue();
+    assert.equal(attempts, 1, 'forced flushes must not hammer the collector or use up retries during cooldown');
+    await new Promise(resolve => setTimeout(resolve, 1100));
+    await flushIngestQueue();
+    assert.equal(attempts, 2);
+    assert.equal(accepted.flatMap(batch => batch.events).filter(event => event.event_type === 'backend_request').length, 1);
+    for (const sid of ['S_quota_denied', 'S_deleted']) {
+      enqueueIngestEntries(cfg, sid, [{ requestCaptureManifest: { requestRid: sid, closedAt: Date.now() }, t: Date.now() }]);
+      for (let attempt = 0; attempt < 4; attempt++) await flushIngestQueue();
+      assert.equal(terminalAttempts.get(sid), 1, 'terminal refusal must not retry critical manifests indefinitely');
+    }
+    console.log('HTTP 429 respects Retry-After and retains the exact pending request');
+  } finally { app.closeAllConnections(); await new Promise(resolve => app.close(resolve)); }
+}
+main().catch(error => { console.error(error); process.exitCode = 1; });

package/test/live-broker-limits.testcontainers.test.js

@@ -0,0 +1,86 @@
+process.env.REPRO_SDK_BACKGROUND_MAX_DEFER_MS = '20';
+process.env.REPRO_SDK_BACKGROUND_IDLE_DELAY_MS = '0';
+process.env.REPRO_SDK_BACKGROUND_BUSY_IDLE_DELAY_MS = '0';
+const assert = require('node:assert/strict');
+const http = require('node:http');
+const { once } = require('node:events');
+const { GenericContainer, Wait } = require('testcontainers');
+const { KafkaContainer } = require('@testcontainers/kafka');
+const { Kafka, logLevel } = require('kafkajs');
+const amqp = require('amqplib');
+const { __reproTestHooks } = require('../dist');
+const { flushIngestQueue } = require('../dist/ingest/client');
+const sleep = ms => new Promise(resolve => setTimeout(resolve, ms));
+
+async function main() {
+  const posts = [];
+  const sink = http.createServer(async (req, res) => {
+    const buffers = [];
+    for await (const chunk of req) buffers.push(chunk);
+    posts.push(JSON.parse(Buffer.concat(buffers)));
+    res.writeHead(202); res.end('{}');
+  });
+  sink.listen(0, '127.0.0.1'); await once(sink, 'listening');
+  let kafkaContainer, rabbitContainer, consumer, producer, connection, channel;
+  let consumed = 0;
+  const rows = Array.from({ length: 157 }, (_, id) => ({ id, state: 'available' }));
+  const payload = Buffer.from(JSON.stringify({ rows }));
+  const cfg = { tenantId: 'TENANT_broker_limits', appId: 'APP_limits', appSecret: 'test',
+    privacy: { captureRaw: true, environment: 'dev' }, ingestBase: `http://127.0.0.1:${sink.address().port}` };
+  const headers = mode => ({ 'x-bug-session-id': `S_broker_${mode}`, 'x-bug-action-id': `A_${mode}`, 'x-repro-capture-mode': mode });
+  async function businessWork(buffer) {
+    await sleep(15);
+    const value = JSON.parse(buffer.toString());
+    assert.equal(value.rows.length, 157, 'instrumentation must not modify the delivered message');
+    assert.equal(value.rows[156].id, 156);
+    consumed++;
+  }
+  try {
+    kafkaContainer = await new KafkaContainer('confluentinc/cp-kafka:7.6.1').withKraft().start();
+    const kafka = new Kafka({ brokers: [`${kafkaContainer.getHost()}:${kafkaContainer.getMappedPort(9093)}`], logLevel: logLevel.NOTHING });
+    producer = kafka.producer(); consumer = kafka.consumer({ groupId: 'repro-live-limit-test' });
+    await producer.connect(); await consumer.connect();
+    const admin = kafka.admin(); await admin.connect();
+    try { await admin.createTopics({ topics: [{ topic: 'capture-limits', numPartitions: 1, replicationFactor: 1 }] }); }
+    finally { await admin.disconnect(); }
+    await consumer.subscribe({ topic: 'capture-limits', fromBeginning: true });
+    await consumer.run({ eachMessage: __reproTestHooks.wrapKafkaEachMessageHandlerForTest(
+      async ({ message }) => businessWork(message.value), cfg, { __repro_group_id: 'repro-live-limit-test' },
+    ) });
+    for (const mode of ['live', 'staging']) await producer.send({ topic: 'capture-limits', messages: [{ key: mode, value: payload, headers: headers(mode) }] });
+
+    rabbitContainer = await new GenericContainer('rabbitmq:3.13-alpine')
+      .withEnvironment({ RABBITMQ_DEFAULT_USER: 'repro', RABBITMQ_DEFAULT_PASS: 'test' })
+      .withExposedPorts(5672).withWaitStrategy(Wait.forLogMessage('Server startup complete')).start();
+    connection = await amqp.connect(`amqp://repro:test@${rabbitContainer.getHost()}:${rabbitContainer.getMappedPort(5672)}`);
+    channel = await connection.createChannel(); await channel.assertQueue('capture-limits', { durable: false });
+    await channel.consume('capture-limits', __reproTestHooks.wrapAmqplibConsumeHandlerForTest(async message => {
+      await businessWork(message.content); channel.ack(message);
+    }, cfg, 'capture-limits'));
+    for (const mode of ['live', 'staging']) channel.sendToQueue('capture-limits', payload, { headers: headers(mode) });
+    const deadline = Date.now() + 30_000;
+    let requests;
+    do {
+      await __reproTestHooks.drainSdkBackgroundQueueForTest(); await flushIngestQueue();
+      requests = posts.flatMap(post => post.events || []).filter(event => event.event_type === 'backend_request');
+      if (requests.length >= 4 && consumed === 4) break;
+      await sleep(50);
+    } while (Date.now() < deadline);
+    assert.equal(consumed, 4); assert.equal(requests.length, 4);
+    for (const method of ['KAFKA_CONSUME', 'AMQP_CONSUME']) for (const mode of ['live', 'staging']) {
+      const request = requests.find(event => event.session_id === `S_broker_${mode}` && event.payload.request.method === method)?.payload.request;
+      assert(request, `${method} ${mode} missing`);
+      assert.equal(request.body.value.rows.length, mode === 'live' ? 101 : 157, `${method} ${mode}`);
+      assert.equal(JSON.parse(request.body.rawValue).rows.length, mode === 'live' ? 101 : 157, 'raw JSON copy must not bypass live limits');
+      if (mode === 'live') assert.equal(request.body.value.rows[100].originalCount, 157);
+    }
+    console.log('real Kafka and RabbitMQ: live bounds after asynchronous consumers; staging and broker values unchanged');
+  } finally {
+    if (consumer) await consumer.disconnect(); if (producer) await producer.disconnect();
+    if (channel) await channel.close(); if (connection) await connection.close();
+    await __reproTestHooks.drainSdkBackgroundQueueForTest(); await flushIngestQueue();
+    sink.closeAllConnections(); await new Promise(resolve => sink.close(resolve));
+    if (rabbitContainer) await rabbitContainer.stop(); if (kafkaContainer) await kafkaContainer.stop();
+  }
+}
+main().catch(error => { console.error(error); process.exitCode = 1; });

package/test/live-capture-limits.test.js

@@ -0,0 +1,99 @@
+const assert = require('node:assert/strict');
+const { limitLiveCapture, limitLiveArguments, collectCaptureOmissions } = require('../dist/live-capture-limits');
+const { projectSemanticInfrastructureValue } = require('../dist/semantic-serialization');
+const { IncomingMessage } = require('node:http');
+const { Socket } = require('node:net');
+const mongoose = require('mongoose');
+
+let getterCalls = 0;
+const payload = { nested: { rows: Array.from({ length: 157 }, (_, id) => ({ id, secret: `value-${id}` })) } };
+Object.defineProperty(payload, 'danger', { enumerable: true, get() { getterCalls++; throw new Error('not safe'); } });
+payload.self = payload;
+payload.alias = payload.nested;
+const limited = limitLiveCapture(payload);
+assert.equal(getterCalls, 0);
+assert.equal(payload.nested.rows.length, 157);
+assert.equal(limited.value.nested.rows.length, 101);
+assert.equal(limited.value.nested.rows[99].id, 99);
+assert.equal(limited.value.nested.rows[100].__kind, 'repro-omitted');
+assert.equal(limited.value.nested.rows[100].originalCount, 157);
+assert.equal(limited.value.alias.__reproCircularRef, '$["nested"]');
+assert.equal(limited.value.self.__reproCircularRef, '$');
+assert.equal(limited.omissions.length, 2);
+assert.equal(limitLiveCapture(limited.value).value.nested.rows[100].originalCount, 157);
+assert.equal(collectCaptureOmissions(limited.value).length, 2);
+
+const native = limitLiveCapture({
+  map: new Map(Array.from({ length: 150 }, (_, i) => [{ id: i }, { value: i }])),
+  set: new Set(Array.from({ length: 101 }, (_, i) => i)),
+  bytes: new Uint8Array(130).fill(7),
+}).value;
+assert.deepEqual(native.map.entries[99], [{ id: 99 }, { value: 99 }].map(x => Object.assign(Object.create(null), x)));
+assert.equal(native.map.entries[100].originalCount, 150);
+assert.equal(native.set.values[100].originalCount, 101);
+assert.equal(native.bytes.values[100].originalCount, 130);
+const dataBuffer = new Uint8Array(200).fill(8).buffer;
+const dataView = limitLiveCapture(new DataView(dataBuffer, 10, 140)).value;
+assert.equal(dataView.values[99], 8);
+assert.equal(dataView.values[100].originalCount, 140);
+assert.equal(limitLiveCapture(dataBuffer).value.values[100].originalCount, 200);
+const error = new Error('observed failure', { cause: { rows: payload.nested.rows } });
+const capturedError = limitLiveCapture(error).value;
+assert.equal(capturedError.message, 'observed failure');
+assert.equal(capturedError.cause.rows[100].originalCount, 157);
+const deep = {};
+let node = deep;
+for (let i = 0; i < 12; i++) node = node.next = { level: i + 1 };
+const depth = limitLiveCapture(deep);
+assert.equal(depth.omissions[0].reason, 'max-depth');
+assert.equal(depth.omissions[0].limit, 10);
+assert.equal(depth.omissions[0].path.split('["next"]').length - 1, 11);
+const aliasTarget = { important: 'must remain visible through the shallower alias' };
+node.next = aliasTarget;
+deep.shallowAlias = aliasTarget;
+assert.equal(limitLiveCapture(deep).value.shallowAlias.important, aliasTarget.important);
+const wide = Object.fromEntries(Array.from({ length: 150 }, (_, i) => [`key${i}`, i]));
+wide.__reproCapture = 'business field';
+const width = limitLiveCapture(wide);
+assert.equal(width.value.key99, 99);
+assert.equal(width.value.key100, undefined);
+assert.equal(width.omissions[0].originalCount, 151);
+assert.equal(limitLiveCapture(width.value).omissions[0].originalCount, 151);
+const tooManyArgs = Array.from({ length: 157 }, (_, i) => i);
+assert.equal(limitLiveArguments(tooManyArgs)[100].originalCount, 157);
+assert.equal(limitLiveArguments(limitLiveArguments(tooManyArgs))[100].originalCount, 157);
+const rawJson = JSON.stringify({ rows: payload.nested.rows });
+const boundedJson = limitLiveCapture(rawJson).value;
+assert.equal(typeof boundedJson, 'string');
+assert.equal(JSON.parse(boundedJson).rows[100].originalCount, 157);
+assert.equal(collectCaptureOmissions(boundedJson)[0].originalCount, 157);
+const smallJson = '{ "business": [1, 2, 3] }';
+assert.equal(limitLiveCapture(smallJson).value, smallJson, 'unlimited strings retain exact formatting');
+const MongoClient = class MongoClient { connect() {} db() {} close() {} };
+const actualInfrastructure = new MongoClient();
+actualInfrastructure.password = 'never-serialize-runtime-config';
+assert.equal(limitLiveCapture(actualInfrastructure).value.category, 'mongodb-infrastructure');
+assert.equal(limitLiveCapture(actualInfrastructure).value.password, undefined);
+const unknownMongoClass = class MongoClient { constructor() { this.orderId = 'business'; } };
+assert.equal(limitLiveCapture(new unknownMongoClass()).value.orderId, 'business');
+const Logger = class Logger { constructor() { this.importantBusinessField = true; } };
+const ModuleRef = class ModuleRef { constructor() { this.invoice = 'INV-1'; } };
+assert.equal(projectSemanticInfrastructureValue(new Logger()), null);
+assert.equal(projectSemanticInfrastructureValue(new ModuleRef()), null);
+const collision = { $__: { business: true }, _doc: { id: 'BUSINESS_DOC' }, invoice: 'INV-2' };
+assert.equal(limitLiveCapture(collision).value.invoice, 'INV-2', 'business property names must not trigger infrastructure removal');
+const Shipment = mongoose.model('LiveLimitShipment', new mongoose.Schema({ status: String, rows: [Number] }));
+const shipment = new Shipment({ status: 'received', rows: Array.from({ length: 157 }, (_, i) => i) });
+assert.equal(limitLiveCapture(shipment).value.status, 'received');
+assert.equal(limitLiveCapture(shipment).value.rows[100].originalCount, 157);
+assert.equal(limitLiveCapture(shipment).value.$__, undefined);
+const req = new IncomingMessage(new Socket());
+req.headers = { 'x-shipment': 'SHIP_1' }; req.body = { rows: [1, 2, 3] };
+Object.defineProperty(req, 'dangerous', { get() { throw new Error('must not execute'); } });
+assert.equal(limitLiveCapture(req).value.headers['x-shipment'], 'SHIP_1');
+assert.deepEqual(limitLiveCapture(req).value.body.rows, [1, 2, 3]);
+req.socket.destroy();
+const withPrototypeKey = JSON.parse('{"__proto__":{"polluted":true},"valid":1}');
+assert.equal(limitLiveCapture(withPrototypeKey).value.__proto__.polluted, true);
+assert.equal({}.polluted, undefined);
+console.log('live capture limits: native collections, depth, keys, getters, references and metadata passed');