@reprova/sdk 0.4.0 → 0.6.0

package/dist/cjs/sequelize.js

@@ -0,0 +1,108 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installSequelizeHooks = installSequelizeHooks;
+const context_js_1 = require("./context.js");
+function readAttr(instance, attr) {
+    if (instance && typeof instance.get === 'function') {
+        try {
+            const v = instance.get(attr);
+            if (v !== undefined)
+                return v;
+        }
+        catch {
+            // fall through to direct property access
+        }
+    }
+    return instance?.[attr];
+}
+function extractPks(instances, pkAttrs) {
+    if (pkAttrs.length === 0)
+        return [];
+    const seen = new Set();
+    const pks = [];
+    for (const inst of instances) {
+        const vals = pkAttrs.map((a) => readAttr(inst, a));
+        if (vals.some((v) => v === undefined || v === null))
+            continue;
+        const pk = vals.map((v) => String(v)).join(':');
+        if (!seen.has(pk)) {
+            seen.add(pk);
+            pks.push(pk);
+        }
+    }
+    return pks;
+}
+function whereShape(options, capture) {
+    if (!capture || !options?.where)
+        return undefined;
+    const cols = Object.keys(options.where).sort(); // symbol Op keys are skipped
+    return cols.length ? cols.join(',') : undefined;
+}
+function push(entry) {
+    const ctx = context_js_1.contextStorage.getStore();
+    if (ctx)
+        ctx.footprint.push(entry);
+}
+function installOnModel(model, capture) {
+    const pkAttrs = () => model.primaryKeyAttributes ?? ['id'];
+    model.addHook('afterFind', (result, options) => {
+        try {
+            const items = (Array.isArray(result) ? result : result ? [result] : []);
+            const pks = extractPks(items, pkAttrs());
+            push({
+                model: model.tableName,
+                op: 'select',
+                pks,
+                where_shape: whereShape(options, capture),
+                count: items.length,
+                note: items.length === 0 ? 'returned 0 rows' : undefined,
+                resolved: true,
+            });
+        }
+        catch { /* never break a query */ }
+    });
+    const recordWrite = (op) => (instance) => {
+        try {
+            const pks = extractPks([instance], pkAttrs());
+            push({ model: model.tableName, op, pks, count: 1, resolved: true });
+        }
+        catch { /* ignore */ }
+    };
+    model.addHook('afterCreate', recordWrite('insert'));
+    model.addHook('afterUpdate', recordWrite('update'));
+    model.addHook('afterDestroy', recordWrite('delete'));
+    model.addHook('afterBulkCreate', (instances) => {
+        try {
+            const items = (Array.isArray(instances) ? instances : []);
+            push({ model: model.tableName, op: 'insert', pks: extractPks(items, pkAttrs()), count: items.length, resolved: true });
+        }
+        catch { /* ignore */ }
+    });
+    // Bulk update/destroy operate by WHERE without materializing instances, so
+    // we record the touch + where_shape but no PKs.
+    const recordBulk = (op) => (options) => {
+        try {
+            push({ model: model.tableName, op, pks: [], where_shape: whereShape(options, capture), count: 0, note: `bulk ${op}`, resolved: true });
+        }
+        catch { /* ignore */ }
+    };
+    model.addHook('afterBulkUpdate', recordBulk('update'));
+    model.addHook('afterBulkDestroy', recordBulk('delete'));
+}
+// Installs footprint hooks on every model of a Sequelize instance (and any
+// defined later). Call once after your models are defined.
+function installSequelizeHooks(sequelize, opts = {}) {
+    const capture = opts.captureWhereShape !== false;
+    const sq = sequelize;
+    try {
+        for (const model of Object.values(sq.models ?? {}))
+            installOnModel(model, capture);
+        sq.addHook('afterDefine', (model) => {
+            try {
+                installOnModel(model, capture);
+            }
+            catch { /* ignore */ }
+        });
+    }
+    catch { /* ignore — never throw from install */ }
+}

package/dist/cjs/shape.js

@@ -0,0 +1,45 @@
+"use strict";
+// Shapes a value by replacing every scalar leaf with "[type:length]".
+// This prevents PII from leaking into where_shape / args_shape fields.
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.shapeValue = shapeValue;
+exports.shapeArgs = shapeArgs;
+function shapeValue(val, depth = 0) {
+    if (val === null || val === undefined)
+        return 'null';
+    if (depth > 3)
+        return '[...]';
+    const t = typeof val;
+    if (t === 'string')
+        return `[string:${val.length}]`;
+    if (t === 'number')
+        return `[number:${String(val).length}]`;
+    if (t === 'boolean')
+        return `[boolean:1]`;
+    if (t === 'bigint')
+        return `[bigint:${String(val).length}]`;
+    if (Array.isArray(val)) {
+        if (val.length === 0)
+            return '[]';
+        return `[array:${val.length}]`;
+    }
+    if (t === 'object') {
+        const shaped = {};
+        for (const [k, v] of Object.entries(val)) {
+            shaped[k] = shapeValue(v, depth + 1);
+        }
+        return JSON.stringify(shaped);
+    }
+    return `[${t}]`;
+}
+function shapeArgs(args) {
+    if (args === null || args === undefined)
+        return 'null';
+    if (typeof args !== 'object')
+        return shapeValue(args);
+    const shaped = {};
+    for (const [k, v] of Object.entries(args)) {
+        shaped[k] = shapeValue(v);
+    }
+    return JSON.stringify(shaped);
+}

package/dist/cjs/stack.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseStack = parseStack;
+exports.generateTraceId = generateTraceId;
+exports.stripHeaders = stripHeaders;
+exports.captureHeaders = captureHeaders;
+const node_crypto_1 = require("node:crypto");
+// Converts an Error stack trace into an array of frame strings.
+function parseStack(err) {
+    if (!err.stack)
+        return [];
+    const lines = err.stack.split('\n');
+    // Skip first line (error message), return the rest trimmed.
+    return lines
+        .slice(1)
+        .map(l => l.trim())
+        .filter(l => l.startsWith('at '));
+}
+// Generates a W3C traceparent header value.
+function generateTraceId() {
+    const traceId = randomHex(32);
+    const spanId = randomHex(16);
+    return `00-${traceId}-${spanId}-01`;
+}
+// Node's own crypto module (not the WebCrypto `crypto` global, which only
+// became a stable global in Node 19+) — randomBytes has existed since
+// Node's earliest crypto module, so this works on any Node version this SDK
+// targets, not just modern ones.
+function randomHex(chars) {
+    const bytes = Math.ceil(chars / 2);
+    return (0, node_crypto_1.randomBytes)(bytes).toString('hex').slice(0, chars);
+}
+// Strips sensitive HTTP headers, replacing values with '[stripped]'.
+const SENSITIVE = /^(authorization|cookie|token|secret)/i;
+function stripHeaders(headers) {
+    const out = {};
+    for (const [k, v] of Object.entries(headers)) {
+        out[k] = SENSITIVE.test(k) ? '[stripped]' : v;
+    }
+    return out;
+}
+// Captures HTTP headers from Express-style IncomingMessage header object.
+function captureHeaders(raw) {
+    const out = {};
+    for (const [k, v] of Object.entries(raw)) {
+        if (v === undefined)
+            continue;
+        out[k] = Array.isArray(v) ? v.join(', ') : v;
+    }
+    return out;
+}

package/dist/cjs/transport.js

@@ -0,0 +1,71 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BatchTransport = void 0;
+const httpFetch_js_1 = require("./httpFetch.js");
+const WARN_INTERVAL_MS = 60_000;
+class BatchTransport {
+    queue = [];
+    timer = null;
+    lastWarnAt = 0;
+    endpoint;
+    apiKey;
+    maxBatch;
+    flushIntervalMs;
+    constructor(opts) {
+        this.endpoint = opts.endpoint;
+        this.apiKey = opts.apiKey;
+        this.maxBatch = opts.maxBatch ?? 10;
+        this.flushIntervalMs = opts.flushIntervalMs ?? 2_000;
+    }
+    start() {
+        this.timer = setInterval(() => void this.flush(), this.flushIntervalMs);
+        if (this.timer.unref)
+            this.timer.unref(); // don't block process exit
+    }
+    stop() {
+        if (this.timer) {
+            clearInterval(this.timer);
+            this.timer = null;
+        }
+    }
+    enqueue(payload) {
+        this.queue.push(payload);
+        if (this.queue.length >= this.maxBatch) {
+            void this.flush();
+        }
+    }
+    async flush() {
+        if (this.queue.length === 0)
+            return;
+        const batch = this.queue.splice(0, this.maxBatch);
+        for (const payload of batch) {
+            await this.sendOne(payload);
+        }
+    }
+    async sendOne(payload) {
+        try {
+            const res = await (0, httpFetch_js_1.httpFetch)(this.endpoint, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'X-Reprova-Key': this.apiKey,
+                },
+                body: JSON.stringify(payload),
+            });
+            if (!res.ok) {
+                this.warnOnce(`reprova: ingest returned ${res.status}`);
+            }
+        }
+        catch (err) {
+            this.warnOnce(`reprova: transport error: ${err.message}`);
+        }
+    }
+    warnOnce(msg) {
+        const now = Date.now();
+        if (now - this.lastWarnAt > WARN_INTERVAL_MS) {
+            this.lastWarnAt = now;
+            console.warn(msg);
+        }
+    }
+}
+exports.BatchTransport = BatchTransport;

package/dist/cjs/typeorm.js

@@ -0,0 +1,200 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.installTypeOrmSubscriber = installTypeOrmSubscriber;
+exports.installTypeOrmQueryLogger = installTypeOrmQueryLogger;
+const context_js_1 = require("./context.js");
+function pkOf(entity, metadata) {
+    const cols = metadata?.primaryColumns ?? [];
+    if (!entity || cols.length === 0)
+        return null;
+    const vals = cols.map((c) => entity[c.propertyName]);
+    if (vals.some((v) => v === undefined || v === null))
+        return null;
+    return vals.map((v) => String(v)).join(':');
+}
+// Find-or-create the (table, op) entry for this request and fold in the PK.
+function recordPk(table, op, pk) {
+    const ctx = context_js_1.contextStorage.getStore();
+    if (!ctx || !table)
+        return;
+    let entry = ctx.footprint.find((f) => f.model === table && f.op === op);
+    if (!entry) {
+        entry = { model: table, op, pks: [], count: 0, resolved: true };
+        ctx.footprint.push(entry);
+    }
+    if (pk !== null && !entry.pks.includes(pk))
+        entry.pks.push(pk);
+    entry.count = entry.pks.length;
+}
+// Installs a footprint subscriber on an initialized TypeORM DataSource. Call
+// AFTER dataSource.initialize() — the subscribers array exists once the source
+// is initialized. Attaches an instance directly, so the host needs no
+// @EventSubscriber()-decorated class.
+function installTypeOrmSubscriber(dataSource) {
+    const subscriber = {
+        afterLoad(entity, event) {
+            try {
+                recordPk(event?.metadata?.tableName, 'select', pkOf(entity, event?.metadata));
+            }
+            catch { /* never break */ }
+        },
+        afterInsert(event) {
+            try {
+                recordPk(event?.metadata?.tableName, 'insert', pkOf(event?.entity, event?.metadata));
+            }
+            catch { /* ignore */ }
+        },
+        afterUpdate(event) {
+            try {
+                recordPk(event?.metadata?.tableName, 'update', pkOf(event?.entity, event?.metadata));
+            }
+            catch { /* ignore */ }
+        },
+        afterRemove(event) {
+            try {
+                recordPk(event?.metadata?.tableName, 'delete', pkOf(event?.databaseEntity ?? event?.entity, event?.metadata));
+            }
+            catch { /* ignore */ }
+        },
+    };
+    try {
+        const ds = dataSource;
+        if (Array.isArray(ds.subscribers))
+            ds.subscribers.push(subscriber);
+        else
+            ds.subscribers = [subscriber];
+    }
+    catch { /* never throw from install */ }
+    installTypeOrmQueryLogger(dataSource);
+}
+// Entity subscribers only fire on SUCCESS (afterInsert/afterUpdate/etc. never
+// broadcast for a query the database rejected), so a failed write — a
+// constraint violation, a too-long value, a deadlock — leaves no trace in the
+// footprint at all: the request just carries the thrown error with nothing
+// showing what was attempted. This records what the write attempt LOOKED
+// LIKE — table, operation, and the column *names* involved — never the bound
+// parameter values, which are row data (the too-long username, the duplicate
+// email) and must never enter a footprint per the metadata-only rule. Only
+// parses SQL for INSERT/UPDATE/DELETE; a SELECT that fails (e.g. a raw query
+// builder error) has no row-level meaning to capture and is left alone.
+const WRITE_VERBS = new Set(['insert', 'update', 'delete']);
+function parseFailedWrite(sql) {
+    const trimmed = sql.trim();
+    const verb = trimmed.match(/^(insert|update|delete)\b/i)?.[1]?.toLowerCase();
+    if (!verb || !WRITE_VERBS.has(verb))
+        return null;
+    const stripIdent = (s) => s.trim().replace(/^[`"[]|[`"\]]$/g, '');
+    if (verb === 'insert') {
+        // INSERT INTO `table` (`a`, `b`) VALUES (?, ?)  /  INSERT INTO "table" ("a","b") VALUES ($1,$2)
+        const m = trimmed.match(/^insert\s+into\s+([`"[\]\w.]+)\s*\(([^)]*)\)/i);
+        if (!m)
+            return null;
+        return {
+            op: 'insert',
+            table: stripIdent(m[1].split('.').pop() ?? m[1]),
+            columns: m[2].split(',').map(stripIdent).filter(Boolean),
+        };
+    }
+    if (verb === 'update') {
+        // UPDATE `table` SET `a` = ?, `b` = ? [WHERE ...]
+        const m = trimmed.match(/^update\s+([`"[\]\w.]+)\s+set\s+([\s\S]*?)(?:\s+where\s[\s\S]*)?$/i);
+        if (!m)
+            return null;
+        return {
+            op: 'update',
+            table: stripIdent(m[1].split('.').pop() ?? m[1]),
+            columns: m[2].split(',').map((assign) => stripIdent(assign.split('=')[0] ?? '')).filter(Boolean),
+        };
+    }
+    // DELETE FROM `table` [WHERE ...] — no column shape, just the table.
+    const m = trimmed.match(/^delete\s+from\s+([`"[\]\w.]+)/i);
+    if (!m)
+        return null;
+    return { op: 'delete', table: stripIdent(m[1].split('.').pop() ?? m[1]), columns: [] };
+}
+function recordFailedWrite(ctx, sql) {
+    const parsed = parseFailedWrite(sql);
+    if (!parsed || !parsed.table)
+        return;
+    ctx.footprint.push({
+        model: parsed.table,
+        op: `${parsed.op}_failed`,
+        pks: [],
+        count: 0,
+        where_shape: parsed.columns.length ? parsed.columns.join(',') : undefined,
+        note: 'rejected by database — see error for reason',
+        resolved: true,
+    });
+}
+// Prototypes already patched, keyed by the prototype object itself (TypeORM
+// shares one QueryRunner class per driver/dialect, not per DataSource
+// instance, so this correctly dedupes even if install is called more than
+// once, or against more than one DataSource using the same driver).
+const patchedQueryRunnerProtos = new WeakSet();
+// TypeORM's own driver (at least the "mysql" — not mysql2 — npm package's,
+// which pre-dates async_hooks-aware pooling) acquires its actual DB
+// connection from a pool INSIDE QueryRunner.query()'s own promise executor,
+// and older callback-based drivers like this one are exactly the class of
+// library that has historically NOT reliably propagated Node's
+// AsyncLocalStorage context across that kind of internal async boundary —
+// the same class of bug already fixed for Mongoose's pooled connections in
+// mongoose.ts (context frozen to whatever was ambient when a pooled
+// connection was first used, not when a later query is issued). This patch
+// defends against that regardless of the exact internal cause, by
+// re-asserting the CALLER's context explicitly around every query rather
+// than trusting the driver's own continuation to carry it.
+//
+// One important limitation found while validating this against a real
+// NestJS + TypeORM + MySQL app: if context is ALREADY gone by the time
+// repository.save()/find() is even called — observed happening upstream of
+// this file entirely, in Nest's own ValidationPipe/@Body() parameter
+// resolution for that app's TypeORM/Nest version combination — this patch
+// (and installTypeOrmSubscriber) has nothing left to capture. That is a
+// separate, framework-level gap this file cannot fix from here.
+//
+// The fix: monkey-patch QueryRunner.prototype.query (once per driver, since
+// TypeORM shares that class across DataSources of the same dialect) to
+// capture the CALLER's context synchronously — before any of the driver's
+// own internal pool/socket work runs — then re-run the original call inside
+// contextStorage.run() with that captured value. Per Node's own
+// AsyncLocalStorage contract, any async operation "created within" a run()
+// callback inherits its store; since query()'s returned Promise (and
+// whatever pool acquisition happens inside it) is created there, this
+// restores continuity for both this file's own failed-write capture AND the
+// pre-existing entity-subscriber path, which shares the same underlying
+// QueryRunner.query() call.
+function installTypeOrmQueryLogger(dataSource) {
+    try {
+        const ds = dataSource;
+        if (typeof ds.createQueryRunner !== 'function')
+            return;
+        const sample = ds.createQueryRunner();
+        const proto = Object.getPrototypeOf(sample);
+        if (typeof proto.query !== 'function' || patchedQueryRunnerProtos.has(proto)) {
+            void sample.release?.().catch(() => { });
+            return;
+        }
+        patchedQueryRunnerProtos.add(proto);
+        const originalQuery = proto.query;
+        proto.query = function (...args) {
+            const capturedCtx = context_js_1.contextStorage.getStore();
+            if (!capturedCtx)
+                return originalQuery.apply(this, args);
+            const sql = typeof args[0] === 'string' ? args[0] : '';
+            const result = context_js_1.contextStorage.run(capturedCtx, () => originalQuery.apply(this, args));
+            result.catch(() => {
+                try {
+                    recordFailedWrite(capturedCtx, sql);
+                }
+                catch {
+                    /* never break the app's own query */
+                }
+            });
+            return result;
+        };
+        void sample.release?.().catch(() => { });
+    }
+    catch {
+        /* never throw from install */
+    }
+}

package/dist/context.d.ts

@@ -13,6 +13,7 @@ export interface FootprintQuery {
     where_shape?: string;
     count: number;
     note?: string;
+    resolved?: boolean;
 }
 export interface OutboundCall {
     host: string;
@@ -24,15 +25,46 @@ export interface OutboundCall {
     duration_ms?: number;
     outcome?: 'success' | 'timeout' | 'network_error';
 }
+export interface BusinessInvariantHit {
+    ruleId: string;
+    message: string;
+    pks: string[];
+}
+export interface WriteCountDriftHit {
+    route: string;
+    model: string;
+    operation: string;
+}
 export interface ReprovaContext {
     traceId: string;
     capturedAt: Date;
     request: RequestSnapshot;
     footprint: FootprintQuery[];
     outboundCalls: OutboundCall[];
+    businessInvariantHits: BusinessInvariantHit[];
+    writeCountDriftHits: WriteCountDriftHit[];
     captured?: boolean;
     rawRequest?: unknown;
+    replayDetection?: {
+        trigger: string;
+        type: string;
+        message: string;
+    };
 }
 export declare const contextStorage: AsyncLocalStorage<ReprovaContext>;
 export declare function currentContext(): ReprovaContext | undefined;
+/**
+ * Explicitly records the authenticated identity for the in-flight request.
+ * Auto-detection already covers `req.auth` (express-oauth2-jwt-bearer/Auth0)
+ * and `req.user` (Passport and most hand-rolled Express JWT middleware) —
+ * see detectAuthClaims in sdk.ts — so most apps need zero code changes. This
+ * is the escape hatch for anything else: a custom property, a non-Express
+ * framework. Call it from inside your own auth middleware once the token is
+ * verified, e.g. `setAuthClaims(decoded)` right after `jwt.verify`. Without
+ * captured claims one way or the other, replay has nothing to re-sign into a
+ * token and the app bounces the replayed request as unauthenticated before
+ * it ever reaches the captured bug. No-ops outside a Reprova request
+ * context.
+ */
+export declare function setAuthClaims(claims: Record<string, unknown>): void;
 //# sourceMappingURL=context.d.ts.map

package/dist/context.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,OAAO,CAAC;IAG7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,eAAe,CAAC;CACnD;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,IAAI,CAAC;IACjB,OAAO,EAAE,eAAe,CAAC;IACzB,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,QAAQ,CAAC,EAAE,OAAO,CAAC;IAKnB,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,eAAO,MAAM,cAAc,mCAA0C,CAAC;AAEtE,wBAAgB,cAAc,IAAI,cAAc,GAAG,SAAS,CAE3D"}
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEhD,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC;IAQd,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,mBAAmB,EAAE,OAAO,CAAC;IAG7B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,SAAS,GAAG,SAAS,GAAG,eAAe,CAAC;CACnD;AAED,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,EAAE,MAAM,EAAE,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,IAAI,CAAC;IACjB,OAAO,EAAE,eAAe,CAAC;IACzB,SAAS,EAAE,cAAc,EAAE,CAAC;IAC5B,aAAa,EAAE,YAAY,EAAE,CAAC;IAC9B,qBAAqB,EAAE,oBAAoB,EAAE,CAAC;IAC9C,mBAAmB,EAAE,kBAAkB,EAAE,CAAC;IAC1C,QAAQ,CAAC,EAAE,OAAO,CAAC;IAKnB,UAAU,CAAC,EAAE,OAAO,CAAC;IAOrB,eAAe,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACtE;AAED,eAAO,MAAM,cAAc,mCAA0C,CAAC;AAEtE,wBAAgB,cAAc,IAAI,cAAc,GAAG,SAAS,CAE3D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAGnE"}

package/dist/context.js

@@ -3,4 +3,22 @@ export const contextStorage = new AsyncLocalStorage();
 export function currentContext() {
     return contextStorage.getStore();
 }
+/**
+ * Explicitly records the authenticated identity for the in-flight request.
+ * Auto-detection already covers `req.auth` (express-oauth2-jwt-bearer/Auth0)
+ * and `req.user` (Passport and most hand-rolled Express JWT middleware) —
+ * see detectAuthClaims in sdk.ts — so most apps need zero code changes. This
+ * is the escape hatch for anything else: a custom property, a non-Express
+ * framework. Call it from inside your own auth middleware once the token is
+ * verified, e.g. `setAuthClaims(decoded)` right after `jwt.verify`. Without
+ * captured claims one way or the other, replay has nothing to re-sign into a
+ * token and the app bounces the replayed request as unauthenticated before
+ * it ever reaches the captured bug. No-ops outside a Reprova request
+ * context.
+ */
+export function setAuthClaims(claims) {
+    const ctx = currentContext();
+    if (ctx)
+        ctx.request.authClaims = claims;
+}
 //# sourceMappingURL=context.js.map

package/dist/context.js.map

@@ -1 +1 @@
-{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AA8ChD,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,iBAAiB,EAAkB,CAAC;AAEtE,MAAM,UAAU,cAAc;IAC5B,OAAO,cAAc,CAAC,QAAQ,EAAE,CAAC;AACnC,CAAC"}
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AA2EhD,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,iBAAiB,EAAkB,CAAC;AAEtE,MAAM,UAAU,cAAc;IAC5B,OAAO,cAAc,CAAC,QAAQ,EAAE,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,aAAa,CAAC,MAA+B;IAC3D,MAAM,GAAG,GAAG,cAAc,EAAE,CAAC;IAC7B,IAAI,GAAG;QAAE,GAAG,CAAC,OAAO,CAAC,UAAU,GAAG,MAAM,CAAC;AAC3C,CAAC"}

package/dist/distributionBaselinePoller.d.ts

@@ -0,0 +1,36 @@
+import type { DistributionBaseline } from './distributionDrift.js';
+interface DistributionBaselinePollerOptions {
+    endpoint: string;
+    apiKey: string;
+    intervalMs?: number;
+}
+export interface DistributionBaselinesResponse {
+    enabled?: boolean;
+    baselines?: Array<{
+        route: string;
+        field: string;
+        sample_count: number;
+        mean: number;
+        stddev: number;
+    }>;
+}
+export declare class DistributionBaselinePoller {
+    private enabled;
+    private baselines;
+    private timer;
+    private lastWarnAt;
+    private readonly endpoint;
+    private readonly apiKey;
+    private readonly intervalMs;
+    constructor(opts: DistributionBaselinePollerOptions);
+    start(): void;
+    stop(): void;
+    isEnabled(): boolean;
+    getBaseline(route: string, field: string): DistributionBaseline | undefined;
+    refresh(): Promise<void>;
+    seed(body: DistributionBaselinesResponse): void;
+    private applyResponse;
+    private warnOnce;
+}
+export {};
+//# sourceMappingURL=distributionBaselinePoller.d.ts.map

package/dist/distributionBaselinePoller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"distributionBaselinePoller.d.ts","sourceRoot":"","sources":["../src/distributionBaselinePoller.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,wBAAwB,CAAC;AAGnE,UAAU,iCAAiC;IACzC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,6BAA6B;IAC5C,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzG;AAaD,qBAAa,0BAA0B;IACrC,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAA2C;IAC5D,OAAO,CAAC,KAAK,CAA+C;IAC5D,OAAO,CAAC,UAAU,CAAK;IACvB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;gBAExB,IAAI,EAAE,iCAAiC;IAMnD,KAAK,IAAI,IAAI;IAMb,IAAI,IAAI,IAAI;IAOZ,SAAS,IAAI,OAAO;IAIpB,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,oBAAoB,GAAG,SAAS;IAIrE,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC;IAsB9B,IAAI,CAAC,IAAI,EAAE,6BAA6B,GAAG,IAAI;IAI/C,OAAO,CAAC,aAAa;IASrB,OAAO,CAAC,QAAQ;CAOjB"}