@reproapp/node-sdk 0.0.57 → 0.0.58

package/README.md

@@ -22,6 +22,14 @@ Requirements:
 
 ## Quickstart
 
+API and collector URLs are optional. Without overrides, the SDK uses
+`https://repro-api-d7288.ondigitalocean.app/api` and
+`https://log-collector-5rj86.ondigitalocean.app`.
+For local or custom deployments, set `apiBase` and `ingestBase`, or use
+`REPRO_API_BASE_URL`/`REPRO_API_BASE` and `REPRO_INGEST_BASE`.
+Policy fetching also uses `apiBase` unless `privacy.apiBase` or
+`REPRO_PRIVACY_API_BASE` overrides it. Existing environment overrides still apply.
+
 Call `initRepro` before importing your application modules. This lets the SDK
 install tracing hooks, auto-attach HTTP middleware to Express/Nest apps, register
 database/message/email integrations, and fetch the runtime privacy policy.
@@ -36,14 +44,12 @@ async function bootstrap() {
     appSecret: process.env.REPRO_APP_SECRET!,
     appName: process.env.REPRO_APP_NAME ?? "Acme Web",
     serviceName: process.env.REPRO_SERVICE_NAME ?? "api",
-    apiBase: process.env.REPRO_API_BASE,
     tracing: {
       disableFunctionTypes: ["constructor"],
       logFunctionCalls: false,
     },
     privacy: {
       environment: process.env.REPRO_PRIVACY_ENV ?? process.env.NODE_ENV ?? "dev",
-      apiBase: process.env.REPRO_PRIVACY_API_BASE ?? process.env.REPRO_API_BASE,
     },
   });
 
@@ -107,7 +113,7 @@ await initRepro({
   appName: "Acme Web",
   serviceName: "api",
   apiBase: process.env.REPRO_API_BASE,
-  ingestBase: process.env.REPRO_INGEST_BASE!,
+  ingestBase: process.env.REPRO_INGEST_BASE,
 });
 ```
 
@@ -242,7 +248,8 @@ Important options:
 - `serviceName`: Backend service label stored on request, trace, DB, queue, Redis,
   and email events. The SDK also registers this service with the application in
   the background so admins can see its environments and privacy policy status.
-- `apiBase`: Repro API base URL. Used by backend live sessions and privacy policy fetches.
+- `apiBase`: Optional Repro API base URL. Defaults to the hosted API and is used by backend live sessions and privacy policy fetches.
+- `ingestBase`: Optional collector base URL. Defaults to the hosted collector; `REPRO_INGEST_BASE` takes precedence when set.
 - `captureHeaders`: Enables header capture. Sensitive headers are masked unless
   explicitly unmasked.
 - `masking`: Local masking rules for request bodies, response bodies, and trace values.

package/dist/endpoints.d.ts

@@ -0,0 +1,2 @@
+export declare const DEFAULT_API_BASE = "https://repro-api-d7288.ondigitalocean.app/api";
+export declare const DEFAULT_INGEST_BASE = "https://log-collector-5rj86.ondigitalocean.app";

package/dist/endpoints.js

@@ -0,0 +1,5 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.DEFAULT_INGEST_BASE = exports.DEFAULT_API_BASE = void 0;
+exports.DEFAULT_API_BASE = 'https://repro-api-d7288.ondigitalocean.app/api';
+exports.DEFAULT_INGEST_BASE = 'https://log-collector-5rj86.ondigitalocean.app';

package/dist/index.d.ts

@@ -324,7 +324,7 @@ declare function chunkTraceEventsForTransport(events: TraceEventRecord[], reques
 export type ReproMiddlewareConfig = IngestClientConfig & {
     /** Propagated recording mode. A tagged staging request never inherits live limits. */
     captureMode?: 'live' | 'staging';
-    /** API base used for backend-owned live session documents. Defaults to REPRO_API_BASE_URL/REPRO_API_BASE/privacy.apiBase. */
+    /** API base for live sessions and privacy. Uses environment/privacy overrides, then the hosted Repro API. */
     apiBase?: string;
     /** Configure header capture/masking. Defaults to capturing with sensitive headers masked. */
     captureHeaders?: boolean | HeaderCaptureOptions;

package/dist/index.js

@@ -25,6 +25,7 @@ const crypto_1 = require("crypto");
 const module_1 = require("module");
 const path_1 = require("path");
 const url_1 = require("url");
+const endpoints_1 = require("./endpoints");
 const node_v8_1 = require("node:v8");
 const client_1 = require("./ingest/client");
 const privacy_1 = require("./privacy");
@@ -325,7 +326,6 @@ const KAFKA_HEADER_PARENT_SPAN_ID = 'x-repro-parent-span-id';
 const KAFKA_HEADER_REQUEST_ID = 'x-repro-request-rid';
 const KAFKA_HEADER_SESSION_ID = 'x-bug-session-id';
 const KAFKA_HEADER_ACTION_ID = 'x-bug-action-id';
-const DEFAULT_INGEST_BASE = 'http://localhost:8080';
 const DEFAULT_INGEST_PATH = '/v1/ingest/events';
 const DEFAULT_LIVE_SESSION_DURATION_MS = 3 * 60000;
 const DEFAULT_LIVE_SEGMENT_IDLE_MS = 15000;
@@ -1846,7 +1846,7 @@ function resolveLiveApiBase(cfg, liveMode) {
         env?.REPRO_API_BASE_URL ||
         env?.REPRO_API_BASE ||
         cfg.privacy?.apiBase ||
-        null;
+        endpoints_1.DEFAULT_API_BASE;
     if (typeof raw !== 'string' || !raw.trim())
         return null;
     return raw.trim().replace(/\/+$/, '');
@@ -2123,7 +2123,7 @@ async function resolveBackendLiveContext(cfg, req, requestStart) {
 }
 function resolveIngestUrl(cfg) {
     const envBase = typeof process !== 'undefined' ? process?.env?.REPRO_INGEST_BASE : undefined;
-    const ingestBase = String(envBase || cfg.ingestBase || DEFAULT_INGEST_BASE).replace(/\/+$/, '');
+    const ingestBase = String(envBase || cfg.ingestBase || endpoints_1.DEFAULT_INGEST_BASE).replace(/\/+$/, '');
     const ingestPath = cfg.ingestPath || DEFAULT_INGEST_PATH;
     const normalizedPath = ingestPath.startsWith('/') ? ingestPath : `/${ingestPath}`;
     return `${ingestBase}${normalizedPath}`;
@@ -3422,7 +3422,7 @@ async function ensureRuntimePrivacyPolicyLoaded(cfg) {
     if (state.nextRetryAt && Date.now() < state.nextRetryAt) {
         return state.policy;
     }
-    const apiBase = (0, privacy_1.resolvePrivacyApiBase)(privacy);
+    const apiBase = (0, privacy_1.resolvePrivacyApiBase)(privacy, cfg.apiBase);
     if (!apiBase || !cfg.appId || !cfg.appSecret) {
         reportRuntimePrivacyOutcome(cfg, state, `disabled:${!apiBase ? 'missing_config' : 'missing_credentials'}:${apiBase ?? 'no-api-base'}`, !apiBase
             ? 'runtime privacy is enabled but no privacy API base is configured'
@@ -3459,7 +3459,7 @@ async function initializeRuntimePrivacyPolicyAtStartup(cfg) {
     if (state.policy) {
         return;
     }
-    const apiBase = (0, privacy_1.resolvePrivacyApiBase)(privacy);
+    const apiBase = (0, privacy_1.resolvePrivacyApiBase)(privacy, cfg.apiBase);
     if (!apiBase) {
         return;
     }

package/dist/ingest/client.js

@@ -2,7 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.flushIngestQueue = exports.enqueueIngestEntries = exports.postIngestEntries = exports.kickIngestQueueDrain = exports.configureIngestQueueDrain = void 0;
 const mapper_1 = require("./mapper");
-const DEFAULT_INGEST_BASE = 'http://localhost:8080';
+const endpoints_1 = require("../endpoints");
 const DEFAULT_INGEST_PATH = '/v1/ingest/events';
 const DEFAULT_QUEUE_MAX_ITEMS = (() => {
     const env = Number(typeof process !== 'undefined' ? process?.env?.REPRO_INGEST_QUEUE_MAX_ITEMS : undefined);
@@ -145,7 +145,7 @@ const selectSendBatch = (queue) => {
 };
 const resolveIngestUrl = (config) => {
     const envBase = typeof process !== 'undefined' ? process?.env?.REPRO_INGEST_BASE : undefined;
-    const ingestBase = String(envBase || config.ingestBase || DEFAULT_INGEST_BASE).replace(/\/+$/, '');
+    const ingestBase = String(envBase || config.ingestBase || endpoints_1.DEFAULT_INGEST_BASE).replace(/\/+$/, '');
     const ingestPath = config.ingestPath || DEFAULT_INGEST_PATH;
     const normalizedPath = ingestPath.startsWith('/') ? ingestPath : `/${ingestPath}`;
     return `${ingestBase}${normalizedPath}`;

package/dist/ingest/types.d.ts

@@ -4,6 +4,7 @@ export interface IngestClientConfig {
     appSecret?: string;
     appName?: string;
     serviceName?: string;
+    /** Defaults to the hosted Repro collector; REPRO_INGEST_BASE overrides this value. */
     ingestBase?: string;
     ingestPath?: string;
     actorId?: string;

package/dist/privacy.d.ts

@@ -94,7 +94,7 @@ export type RuntimePrivacyFetchResult = {
     error: string;
 };
 export declare function normalizePrivacyEnvironment(input?: string | null): string;
-export declare function resolvePrivacyApiBase(cfg?: RuntimePrivacyConfig | null): string | null;
+export declare function resolvePrivacyApiBase(cfg?: RuntimePrivacyConfig | null, apiBase?: string): string | null;
 export declare function fetchApprovedRuntimePrivacyPolicy(params: {
     appId: string;
     appSecret?: string;

package/dist/privacy.js

@@ -8,6 +8,7 @@ exports.normalizeRuntimePrivacyPolicy = normalizeRuntimePrivacyPolicy;
 exports.applyRuntimePrivacyPolicy = applyRuntimePrivacyPolicy;
 exports.applyRuntimePrivacyPolicyAsync = applyRuntimePrivacyPolicyAsync;
 const crypto_1 = require("crypto");
+const endpoints_1 = require("./endpoints");
 const capture_work_budget_1 = require("./capture-work-budget");
 const privacy_fallback_1 = require("./privacy-fallback");
 const privacy_redaction_1 = require("./privacy-redaction");
@@ -84,11 +85,13 @@ function normalizePrivacyEnvironment(input) {
         return 'qa';
     return normalized || 'dev';
 }
-function resolvePrivacyApiBase(cfg) {
+function resolvePrivacyApiBase(cfg, apiBase) {
     const value = cfg?.apiBase ||
         process.env.REPRO_PRIVACY_API_BASE ||
+        apiBase ||
+        process.env.REPRO_API_BASE_URL ||
         process.env.REPRO_API_BASE ||
-        null;
+        endpoints_1.DEFAULT_API_BASE;
     if (!value || !String(value).trim()) {
         return null;
     }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@reproapp/node-sdk",
-  "version": "0.0.57",
+  "version": "0.0.58",
   "description": "Repro Nest SDK",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -9,6 +9,7 @@
     "node": ">=18"
   },
   "scripts": {
+    "test:endpoints": "npm run build && node test/hosted-endpoints.testcontainers.test.js",
     "test:throughput": "npm run build && node test/trace-worker-policy-reference.test.js && node test/privacy-policy-index.test.js && node test/trace-throughput.testcontainers.test.js",
     "test:latency": "npm run build && node test/privacy-fetch-timeout.test.js && node test/capture-latency.testcontainers.test.js",
     "test:live-capture": "npm run build && node test/twelve-element-capture.testcontainers.test.js && node test/live-capture-limits.test.js && node test/ingest-throttle-retention.test.js && node test/live-capture-limits.testcontainers.test.js",

package/src/endpoints.ts

@@ -0,0 +1,2 @@
+export const DEFAULT_API_BASE = 'https://repro-api-d7288.ondigitalocean.app/api';
+export const DEFAULT_INGEST_BASE = 'https://log-collector-5rj86.ondigitalocean.app';

package/src/index.ts

@@ -6,6 +6,7 @@ import { createHash, createHmac, randomUUID } from 'crypto';
 import { createRequire } from 'module';
 import { join } from 'path';
 import { pathToFileURL } from 'url';
+import { DEFAULT_API_BASE, DEFAULT_INGEST_BASE } from './endpoints';
 import { serialize as serializeSnapshot } from 'node:v8';
 import {
     configureIngestQueueDrain,
@@ -325,7 +326,6 @@ const KAFKA_HEADER_PARENT_SPAN_ID = 'x-repro-parent-span-id';
 const KAFKA_HEADER_REQUEST_ID = 'x-repro-request-rid';
 const KAFKA_HEADER_SESSION_ID = 'x-bug-session-id';
 const KAFKA_HEADER_ACTION_ID = 'x-bug-action-id';
-const DEFAULT_INGEST_BASE = 'http://localhost:8080';
 const DEFAULT_INGEST_PATH = '/v1/ingest/events';
 const DEFAULT_LIVE_SESSION_DURATION_MS = 3 * 60_000;
 const DEFAULT_LIVE_SEGMENT_IDLE_MS = 15_000;
@@ -2317,7 +2317,7 @@ function resolveLiveApiBase(cfg: ReproMiddlewareConfig, liveMode?: ReproLiveMode
         env?.REPRO_API_BASE_URL ||
         env?.REPRO_API_BASE ||
         (cfg.privacy as RuntimePrivacyConfig | undefined)?.apiBase ||
-        null;
+        DEFAULT_API_BASE;
     if (typeof raw !== 'string' || !raw.trim()) return null;
     return raw.trim().replace(/\/+$/, '');
 }
@@ -4192,7 +4192,7 @@ async function ensureRuntimePrivacyPolicyLoaded(cfg: ReproMiddlewareConfig): Pro
     if (state.nextRetryAt && Date.now() < state.nextRetryAt) {
         return state.policy;
     }
-    const apiBase = resolvePrivacyApiBase(privacy);
+    const apiBase = resolvePrivacyApiBase(privacy, cfg.apiBase);
     if (!apiBase || !cfg.appId || !cfg.appSecret) {
         reportRuntimePrivacyOutcome(
             cfg,
@@ -4241,7 +4241,7 @@ async function initializeRuntimePrivacyPolicyAtStartup(cfg: ReproMiddlewareConfi
         return;
     }
 
-    const apiBase = resolvePrivacyApiBase(privacy);
+    const apiBase = resolvePrivacyApiBase(privacy, cfg.apiBase);
     if (!apiBase) {
         return;
     }
@@ -5996,7 +5996,7 @@ async function maybeCaptureDbValueFromCandidatesAsync(
 export type ReproMiddlewareConfig = IngestClientConfig & {
     /** Propagated recording mode. A tagged staging request never inherits live limits. */
     captureMode?: 'live' | 'staging';
-    /** API base used for backend-owned live session documents. Defaults to REPRO_API_BASE_URL/REPRO_API_BASE/privacy.apiBase. */
+    /** API base for live sessions and privacy. Uses environment/privacy overrides, then the hosted Repro API. */
     apiBase?: string;
     /** Configure header capture/masking. Defaults to capturing with sensitive headers masked. */
     captureHeaders?: boolean | HeaderCaptureOptions;

package/src/ingest/client.ts

@@ -1,7 +1,7 @@
 import { mapLegacyEntriesToCanonicalEvents } from './mapper';
 import type { IngestClientConfig, LegacyEntry } from './types';
 
-const DEFAULT_INGEST_BASE = 'http://localhost:8080';
+import { DEFAULT_INGEST_BASE } from '../endpoints';
 const DEFAULT_INGEST_PATH = '/v1/ingest/events';
 const DEFAULT_QUEUE_MAX_ITEMS = (() => {
     const env = Number(typeof process !== 'undefined' ? (process as any)?.env?.REPRO_INGEST_QUEUE_MAX_ITEMS : undefined);

package/src/ingest/types.ts

@@ -4,6 +4,7 @@ export interface IngestClientConfig {
     appSecret?: string;
     appName?: string;
     serviceName?: string;
+    /** Defaults to the hosted Repro collector; REPRO_INGEST_BASE overrides this value. */
     ingestBase?: string;
     ingestPath?: string;
     actorId?: string;

package/src/privacy.ts

@@ -1,4 +1,5 @@
 import { createHash } from 'crypto';
+import { DEFAULT_API_BASE } from './endpoints';
 import { yieldCaptureWork } from './capture-work-budget';
 import { sanitizeUnknownBoundaryTextWithDetectors } from './privacy-fallback';
 import { redactEmailDeterministic, redactEmailsInText } from './privacy-redaction';
@@ -227,12 +228,14 @@ export function normalizePrivacyEnvironment(input?: string | null): string {
     return normalized || 'dev';
 }
 
-export function resolvePrivacyApiBase(cfg?: RuntimePrivacyConfig | null): string | null {
+export function resolvePrivacyApiBase(cfg?: RuntimePrivacyConfig | null, apiBase?: string): string | null {
     const value =
         cfg?.apiBase ||
         process.env.REPRO_PRIVACY_API_BASE ||
+        apiBase ||
+        process.env.REPRO_API_BASE_URL ||
         process.env.REPRO_API_BASE ||
-        null;
+        DEFAULT_API_BASE;
     if (!value || !String(value).trim()) {
         return null;
     }

package/test/hosted-endpoints.testcontainers.test.js

@@ -0,0 +1,99 @@
+const assert = require('node:assert/strict');
+const http = require('node:http');
+const { GenericContainer, Wait } = require('testcontainers');
+const { MongoClient } = require('mongodb');
+const { __reproTestHooks } = require('../dist');
+const { resolvePrivacyApiBase, fetchApprovedRuntimePrivacyPolicy } = require('../dist/privacy');
+const { enqueueIngestEntries, flushIngestQueue } = require('../dist/ingest/client');
+
+const API = 'https://repro-api-d7288.ondigitalocean.app/api';
+const COLLECTOR = 'https://log-collector-5rj86.ondigitalocean.app';
+const envKeys = ['REPRO_API_BASE_URL', 'REPRO_API_BASE', 'REPRO_PRIVACY_API_BASE', 'REPRO_INGEST_BASE'];
+const originalEnv = Object.fromEntries(envKeys.map(key => [key, process.env[key]]));
+const clearEnv = () => envKeys.forEach(key => delete process.env[key]);
+
+async function main() {
+  let container, mongo, server;
+  const originalFetch = global.fetch;
+  const requests = [];
+  const errors = [];
+  try {
+    clearEnv();
+    container = await new GenericContainer('mongo:7').withExposedPorts(27017)
+      .withWaitStrategy(Wait.forListeningPorts()).start();
+    mongo = await new MongoClient(`mongodb://${container.getHost()}:${container.getMappedPort(27017)}`).connect();
+    const events = mongo.db('endpoint_defaults').collection('events');
+    server = http.createServer(async (req, res) => {
+      try {
+        const chunks = [];
+        for await (const chunk of req) chunks.push(chunk);
+        const body = chunks.length ? JSON.parse(Buffer.concat(chunks)) : {};
+        const path = new URL(req.url, 'http://local').pathname;
+        let response;
+        if (path.endsWith('/sdk/privacy-policy')) {
+          response = { enabled: true, policy: { environment: 'dev', statements: [
+            { sid: 'protect-secret', when: { scope: 'FIELD', selector: 'field:secret' }, apply: { action: 'DROP' } },
+          ] } };
+        } else if (path.endsWith('/sdk/runtime-services')) {
+          response = { ok: true };
+        } else if (path.endsWith('/ingest/events')) {
+          assert.ok(body.events.length > 0);
+          await events.insertMany(body.events);
+          response = { accepted: body.events.length };
+        } else throw new Error(`Unexpected path: ${path}`);
+        res.writeHead(200, { 'content-type': 'application/json' });
+        res.end(JSON.stringify(response));
+      } catch (error) {
+        errors.push(error.message);
+        res.writeHead(500); res.end('{}');
+      }
+    });
+    await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
+    const local = `http://127.0.0.1:${server.address().port}`;
+    // Assert the actual destination selected by the SDK, but never contact production.
+    const allowedOrigins = new Set([new URL(API).origin, COLLECTOR, local, 'http://override.test', 'http://environment.test']);
+    global.fetch = (url, options) => {
+      const target = new URL(url);
+      assert.ok(allowedOrigins.has(target.origin), `Unexpected external request: ${target.origin}`);
+      requests.push({ url: target.href, options });
+      return originalFetch(`${local}${target.pathname}${target.search}`, options);
+    };
+
+    const cases = [
+      { name: 'omitted', config: {}, env: {}, api: API, privacy: API, collector: COLLECTOR },
+      { name: 'explicit-local', config: { apiBase: `${local}/api/`, ingestBase: `${local}/` }, env: {}, api: `${local}/api`, privacy: `${local}/api`, collector: local },
+      { name: 'environment', config: {}, env: { REPRO_API_BASE: 'http://environment.test/api/', REPRO_INGEST_BASE: 'http://environment.test/' }, api: 'http://environment.test/api', privacy: 'http://environment.test/api', collector: 'http://environment.test' },
+      { name: 'precedence', config: { apiBase: 'http://override.test/api/', ingestBase: 'http://override.test', privacy: { apiBase: 'http://override.test/privacy/' } }, env: { REPRO_API_BASE: 'http://environment.test/api', REPRO_INGEST_BASE: 'http://environment.test', REPRO_PRIVACY_API_BASE: 'http://environment.test/privacy' }, api: 'http://override.test/api', privacy: 'http://override.test/privacy', collector: 'http://environment.test' },
+      { name: 'api-url-env', config: {}, env: { REPRO_API_BASE_URL: `${local}/api`, REPRO_API_BASE: 'http://environment.test/api' }, api: `${local}/api`, privacy: `${local}/api`, collector: COLLECTOR },
+      { name: 'privacy-env', config: {}, env: { REPRO_PRIVACY_API_BASE: `${local}/privacy` }, api: API, privacy: `${local}/privacy`, collector: COLLECTOR },
+    ];
+    for (const entry of cases) {
+      clearEnv(); Object.assign(process.env, entry.env);
+      requests.length = 0;
+      const cfg = { tenantId: 'TENANT_test', appId: 'APP_test', appSecret: 'test-only', serviceName: entry.name, ...entry.config };
+      await __reproTestHooks.registerRuntimeServiceForTest(cfg);
+      assert.equal(requests[0].url, `${entry.api}/v1/sdk/runtime-services`);
+      assert.equal(requests[0].options.headers['X-App-Id'], 'APP_test');
+      const apiBase = resolvePrivacyApiBase(cfg.privacy, cfg.apiBase);
+      assert.equal(apiBase, entry.privacy);
+      const policy = await fetchApprovedRuntimePrivacyPolicy({ ...cfg, apiBase, environment: 'dev' });
+      assert.equal(policy.status, 'ok');
+      assert.equal(new URL(requests[1].url).pathname, new URL(`${entry.privacy}/v1/sdk/privacy-policy`).pathname);
+      const sid = `S_${entry.name}`;
+      enqueueIngestEntries(cfg, sid, [{ actionId: 'A_test', requestRid: 'R_test', db: [{ collection: 'orders', op: 'findOne', query: { order: entry.name } }], t: Date.now() }]);
+      await flushIngestQueue();
+      assert.equal(requests.at(-1).url, `${entry.collector}/v1/ingest/events`);
+      assert.equal(await events.countDocuments({ session_id: sid, event_type: 'db_change' }), 1);
+    }
+    assert.deepEqual(errors, []);
+    console.log('hosted endpoint defaults, local/env overrides, precedence, policy fetch and persisted ingestion passed (no production traffic)');
+  } finally {
+    global.fetch = originalFetch;
+    clearEnv();
+    for (const [key, value] of Object.entries(originalEnv)) if (value !== undefined) process.env[key] = value;
+    if (server) { server.closeAllConnections(); await new Promise(resolve => server.close(resolve)); }
+    await mongo?.close();
+    await container?.stop();
+  }
+}
+main().catch(error => { console.error(error); process.exitCode = 1; });