@adobe-commerce/aio-toolkit 1.2.6 → 1.2.7

package/dist/index.d.mts

@@ -450,6 +450,16 @@ declare class JsonMessageProcessor implements LogRecordProcessor {
     shutdown(): Promise<void>;
 }
 
+declare class LogSanitizer {
+    private readonly additionalSensitiveKeys;
+    private readonly maxDepth;
+    constructor(additionalSensitiveKeys?: ReadonlySet<string>, maxDepth?: number);
+    static parseSensitiveKeys(raw: unknown): ReadonlySet<string>;
+    execute(data: unknown): unknown;
+    private isSensitiveKey;
+    private sanitize;
+}
+
 interface BearerTokenInfo {
     token: string | null;
     tokenLength: number;
@@ -1182,4 +1192,4 @@ declare class AdminUiSdk {
     getRegistration(): AdminUiSdkRegistration;
 }
 
-export { AbdbCollection, type AbdbCollectionCallback, AbdbColumn, type AbdbColumnJson, type AbdbColumnOptions, AbdbColumnType, type AbdbFindOptions, type AbdbFindSort, type AbdbFindSortDirection, type AbdbRecord, AbdbRepository, type AbdbRepositoryFilter, type AbdbRunCallback, type AddColumnOptions, AdminUiSdk, type AdminUiSdkRegistration, AdobeAuth, AdobeCommerceClient, type AdobeIMSConfig, AmazonSQSClient, type AmazonSQSConfig, type ConsumeStats as AmazonSQSConsumeStats, type MessageHandler as AmazonSQSMessageHandler, type PublishStats as AmazonSQSPublishStats, type BaseTelemetry, type BaseTelemetryValidator, BasicAuthConnection, BearerToken, type BearerTokenInfo, type CommerceEvent, type CommerceEventConfig, type CommerceEventField, type Connection, type ConsumeStats$1 as ConsumeStats, type CreateEventResult, CreateEvents, type CreateProviderParams, type CreateProviderResult, type CreateRegistrationResult, CreateRegistrations, type ErrorResponse, EventConsumerAction, type EventData, type EventMetadata, type EventMetadataInputModel, type EventMetadataListResponse, EventMetadataManager, type ExtendedRequestError, type FileMetadata, type FileRecord, FileRepository, GenerateBasicAuthToken, type GetProviderQueryParams, type GetRegistrationQueryParams, GraphQlAction, type HALLink, type Headers, HttpMethod, HttpStatus, IOEventsApiError, type IOEventsError, ImsConnection, ImsToken, type ImsTokenResult, InfiniteLoopBreaker, type InfiniteLoopData, IoEventsGlobals, JsonMessageProcessor, type ListProvidersQueryParams, type ListRegistrationQueryParams, type MenuItem, type MessageHandler$1 as MessageHandler, Oauth1aConnection, OnboardCommerce, type OnboardCommerceConfig, type OnboardCommerceResult, OnboardEvents, type OnboardEventsInput, type OnboardEventsResponse, OnboardEvents as OnboardIOEvents, Openwhisk, OpenwhiskAction, type OpenwhiskConfig, type Page, Parameters, type Provider, type ProviderInputModel, ProviderManager, PublishEvent, type PublishEventResult, type PublishStats$1 as PublishStats, RabbitMQClient, type RabbitMQConsumeOptions, type RabbitMQCredentials, type Registration, type RegistrationCreateModel, type RegistrationListResponse, RegistrationManager, RestClient, RuntimeAction, RuntimeActionResponse, type RuntimeActionResponseType, RuntimeApiGatewayService, ShippingCarrier, type ShippingCarrierData, ShippingCarrierMethod, type ShippingCarrierMethodAdditionalData, type ShippingCarrierMethodData, ShippingCarrierResponse, SignatureVerification, SuccessChecker, type SuccessResponse, Telemetry, TelemetryInputError, type TokenResult, Validator, WebhookAction, type WebhookActionAddResponse, type WebhookActionExceptionResponse, WebhookActionOperation, type WebhookActionRemoveResponse, type WebhookActionReplaceResponse, WebhookActionResponse, type WebhookActionResponseType, type WebhookActionSuccessResponse, type WorkspaceConfig };
+export { AbdbCollection, type AbdbCollectionCallback, AbdbColumn, type AbdbColumnJson, type AbdbColumnOptions, AbdbColumnType, type AbdbFindOptions, type AbdbFindSort, type AbdbFindSortDirection, type AbdbRecord, AbdbRepository, type AbdbRepositoryFilter, type AbdbRunCallback, type AddColumnOptions, AdminUiSdk, type AdminUiSdkRegistration, AdobeAuth, AdobeCommerceClient, type AdobeIMSConfig, AmazonSQSClient, type AmazonSQSConfig, type ConsumeStats as AmazonSQSConsumeStats, type MessageHandler as AmazonSQSMessageHandler, type PublishStats as AmazonSQSPublishStats, type BaseTelemetry, type BaseTelemetryValidator, BasicAuthConnection, BearerToken, type BearerTokenInfo, type CommerceEvent, type CommerceEventConfig, type CommerceEventField, type Connection, type ConsumeStats$1 as ConsumeStats, type CreateEventResult, CreateEvents, type CreateProviderParams, type CreateProviderResult, type CreateRegistrationResult, CreateRegistrations, type ErrorResponse, EventConsumerAction, type EventData, type EventMetadata, type EventMetadataInputModel, type EventMetadataListResponse, EventMetadataManager, type ExtendedRequestError, type FileMetadata, type FileRecord, FileRepository, GenerateBasicAuthToken, type GetProviderQueryParams, type GetRegistrationQueryParams, GraphQlAction, type HALLink, type Headers, HttpMethod, HttpStatus, IOEventsApiError, type IOEventsError, ImsConnection, ImsToken, type ImsTokenResult, InfiniteLoopBreaker, type InfiniteLoopData, IoEventsGlobals, JsonMessageProcessor, type ListProvidersQueryParams, type ListRegistrationQueryParams, LogSanitizer, type MenuItem, type MessageHandler$1 as MessageHandler, Oauth1aConnection, OnboardCommerce, type OnboardCommerceConfig, type OnboardCommerceResult, OnboardEvents, type OnboardEventsInput, type OnboardEventsResponse, OnboardEvents as OnboardIOEvents, Openwhisk, OpenwhiskAction, type OpenwhiskConfig, type Page, Parameters, type Provider, type ProviderInputModel, ProviderManager, PublishEvent, type PublishEventResult, type PublishStats$1 as PublishStats, RabbitMQClient, type RabbitMQConsumeOptions, type RabbitMQCredentials, type Registration, type RegistrationCreateModel, type RegistrationListResponse, RegistrationManager, RestClient, RuntimeAction, RuntimeActionResponse, type RuntimeActionResponseType, RuntimeApiGatewayService, ShippingCarrier, type ShippingCarrierData, ShippingCarrierMethod, type ShippingCarrierMethodAdditionalData, type ShippingCarrierMethodData, ShippingCarrierResponse, SignatureVerification, SuccessChecker, type SuccessResponse, Telemetry, TelemetryInputError, type TokenResult, Validator, WebhookAction, type WebhookActionAddResponse, type WebhookActionExceptionResponse, WebhookActionOperation, type WebhookActionRemoveResponse, type WebhookActionReplaceResponse, WebhookActionResponse, type WebhookActionResponseType, type WebhookActionSuccessResponse, type WorkspaceConfig };

package/dist/index.d.ts

@@ -450,6 +450,16 @@ declare class JsonMessageProcessor implements LogRecordProcessor {
     shutdown(): Promise<void>;
 }
 
+declare class LogSanitizer {
+    private readonly additionalSensitiveKeys;
+    private readonly maxDepth;
+    constructor(additionalSensitiveKeys?: ReadonlySet<string>, maxDepth?: number);
+    static parseSensitiveKeys(raw: unknown): ReadonlySet<string>;
+    execute(data: unknown): unknown;
+    private isSensitiveKey;
+    private sanitize;
+}
+
 interface BearerTokenInfo {
     token: string | null;
     tokenLength: number;
@@ -1182,4 +1192,4 @@ declare class AdminUiSdk {
     getRegistration(): AdminUiSdkRegistration;
 }
 
-export { AbdbCollection, type AbdbCollectionCallback, AbdbColumn, type AbdbColumnJson, type AbdbColumnOptions, AbdbColumnType, type AbdbFindOptions, type AbdbFindSort, type AbdbFindSortDirection, type AbdbRecord, AbdbRepository, type AbdbRepositoryFilter, type AbdbRunCallback, type AddColumnOptions, AdminUiSdk, type AdminUiSdkRegistration, AdobeAuth, AdobeCommerceClient, type AdobeIMSConfig, AmazonSQSClient, type AmazonSQSConfig, type ConsumeStats as AmazonSQSConsumeStats, type MessageHandler as AmazonSQSMessageHandler, type PublishStats as AmazonSQSPublishStats, type BaseTelemetry, type BaseTelemetryValidator, BasicAuthConnection, BearerToken, type BearerTokenInfo, type CommerceEvent, type CommerceEventConfig, type CommerceEventField, type Connection, type ConsumeStats$1 as ConsumeStats, type CreateEventResult, CreateEvents, type CreateProviderParams, type CreateProviderResult, type CreateRegistrationResult, CreateRegistrations, type ErrorResponse, EventConsumerAction, type EventData, type EventMetadata, type EventMetadataInputModel, type EventMetadataListResponse, EventMetadataManager, type ExtendedRequestError, type FileMetadata, type FileRecord, FileRepository, GenerateBasicAuthToken, type GetProviderQueryParams, type GetRegistrationQueryParams, GraphQlAction, type HALLink, type Headers, HttpMethod, HttpStatus, IOEventsApiError, type IOEventsError, ImsConnection, ImsToken, type ImsTokenResult, InfiniteLoopBreaker, type InfiniteLoopData, IoEventsGlobals, JsonMessageProcessor, type ListProvidersQueryParams, type ListRegistrationQueryParams, type MenuItem, type MessageHandler$1 as MessageHandler, Oauth1aConnection, OnboardCommerce, type OnboardCommerceConfig, type OnboardCommerceResult, OnboardEvents, type OnboardEventsInput, type OnboardEventsResponse, OnboardEvents as OnboardIOEvents, Openwhisk, OpenwhiskAction, type OpenwhiskConfig, type Page, Parameters, type Provider, type ProviderInputModel, ProviderManager, PublishEvent, type PublishEventResult, type PublishStats$1 as PublishStats, RabbitMQClient, type RabbitMQConsumeOptions, type RabbitMQCredentials, type Registration, type RegistrationCreateModel, type RegistrationListResponse, RegistrationManager, RestClient, RuntimeAction, RuntimeActionResponse, type RuntimeActionResponseType, RuntimeApiGatewayService, ShippingCarrier, type ShippingCarrierData, ShippingCarrierMethod, type ShippingCarrierMethodAdditionalData, type ShippingCarrierMethodData, ShippingCarrierResponse, SignatureVerification, SuccessChecker, type SuccessResponse, Telemetry, TelemetryInputError, type TokenResult, Validator, WebhookAction, type WebhookActionAddResponse, type WebhookActionExceptionResponse, WebhookActionOperation, type WebhookActionRemoveResponse, type WebhookActionReplaceResponse, WebhookActionResponse, type WebhookActionResponseType, type WebhookActionSuccessResponse, type WorkspaceConfig };
+export { AbdbCollection, type AbdbCollectionCallback, AbdbColumn, type AbdbColumnJson, type AbdbColumnOptions, AbdbColumnType, type AbdbFindOptions, type AbdbFindSort, type AbdbFindSortDirection, type AbdbRecord, AbdbRepository, type AbdbRepositoryFilter, type AbdbRunCallback, type AddColumnOptions, AdminUiSdk, type AdminUiSdkRegistration, AdobeAuth, AdobeCommerceClient, type AdobeIMSConfig, AmazonSQSClient, type AmazonSQSConfig, type ConsumeStats as AmazonSQSConsumeStats, type MessageHandler as AmazonSQSMessageHandler, type PublishStats as AmazonSQSPublishStats, type BaseTelemetry, type BaseTelemetryValidator, BasicAuthConnection, BearerToken, type BearerTokenInfo, type CommerceEvent, type CommerceEventConfig, type CommerceEventField, type Connection, type ConsumeStats$1 as ConsumeStats, type CreateEventResult, CreateEvents, type CreateProviderParams, type CreateProviderResult, type CreateRegistrationResult, CreateRegistrations, type ErrorResponse, EventConsumerAction, type EventData, type EventMetadata, type EventMetadataInputModel, type EventMetadataListResponse, EventMetadataManager, type ExtendedRequestError, type FileMetadata, type FileRecord, FileRepository, GenerateBasicAuthToken, type GetProviderQueryParams, type GetRegistrationQueryParams, GraphQlAction, type HALLink, type Headers, HttpMethod, HttpStatus, IOEventsApiError, type IOEventsError, ImsConnection, ImsToken, type ImsTokenResult, InfiniteLoopBreaker, type InfiniteLoopData, IoEventsGlobals, JsonMessageProcessor, type ListProvidersQueryParams, type ListRegistrationQueryParams, LogSanitizer, type MenuItem, type MessageHandler$1 as MessageHandler, Oauth1aConnection, OnboardCommerce, type OnboardCommerceConfig, type OnboardCommerceResult, OnboardEvents, type OnboardEventsInput, type OnboardEventsResponse, OnboardEvents as OnboardIOEvents, Openwhisk, OpenwhiskAction, type OpenwhiskConfig, type Page, Parameters, type Provider, type ProviderInputModel, ProviderManager, PublishEvent, type PublishEventResult, type PublishStats$1 as PublishStats, RabbitMQClient, type RabbitMQConsumeOptions, type RabbitMQCredentials, type Registration, type RegistrationCreateModel, type RegistrationListResponse, RegistrationManager, RestClient, RuntimeAction, RuntimeActionResponse, type RuntimeActionResponseType, RuntimeApiGatewayService, ShippingCarrier, type ShippingCarrierData, ShippingCarrierMethod, type ShippingCarrierMethodAdditionalData, type ShippingCarrierMethodData, ShippingCarrierResponse, SignatureVerification, SuccessChecker, type SuccessResponse, Telemetry, TelemetryInputError, type TokenResult, Validator, WebhookAction, type WebhookActionAddResponse, type WebhookActionExceptionResponse, WebhookActionOperation, type WebhookActionRemoveResponse, type WebhookActionReplaceResponse, WebhookActionResponse, type WebhookActionResponseType, type WebhookActionSuccessResponse, type WorkspaceConfig };

package/dist/index.js

@@ -56,6 +56,7 @@ __export(index_exports, {
   InfiniteLoopBreaker: () => infinite_loop_breaker_default,
   IoEventsGlobals: () => IoEventsGlobals,
   JsonMessageProcessor: () => JsonMessageProcessor,
+  LogSanitizer: () => LogSanitizer,
   Oauth1aConnection: () => oauth1a_connection_default,
   OnboardCommerce: () => onboard_commerce_default,
   OnboardEvents: () => onboard_events_default,
@@ -214,7 +215,7 @@ var validator_default = Validator;
 
 // src/framework/telemetry/index.ts
 var import_aio_sdk = require("@adobe/aio-sdk");
-var import_aio_lib_telemetry3 = require("@adobe/aio-lib-telemetry");
+var import_aio_lib_telemetry4 = require("@adobe/aio-lib-telemetry");
 
 // src/framework/telemetry/new-relic/index.ts
 var import_aio_lib_telemetry2 = require("@adobe/aio-lib-telemetry");
@@ -768,6 +769,334 @@ __name(_NewRelicTelemetry, "NewRelicTelemetry");
 var NewRelicTelemetry = _NewRelicTelemetry;
 var new_relic_default = NewRelicTelemetry;
 
+// src/framework/telemetry/grafana/index.ts
+var import_aio_lib_telemetry3 = require("@adobe/aio-lib-telemetry");
+
+// src/framework/telemetry/grafana/validator/index.ts
+var _GrafanaTelemetryValidator = class _GrafanaTelemetryValidator {
+  /**
+   * Checks if Grafana telemetry is configured
+   *
+   * Returns true when:
+   * - ENABLE_TELEMETRY is explicitly set to true
+   * - GRAFANA_TELEMETRY is explicitly set to true
+   *
+   * This method does NOT validate configuration completeness —
+   * it only checks whether the provider should be active.
+   *
+   * @param params - Runtime parameters to check
+   * @returns true if Grafana telemetry is enabled, false otherwise
+   *
+   * @example
+   * ```typescript
+   * const validator = new GrafanaTelemetryValidator();
+   * const params = { ENABLE_TELEMETRY: true, GRAFANA_TELEMETRY: true };
+   * if (validator.isConfigured(params)) {
+   *   // Grafana telemetry is enabled, proceed with initialization
+   * }
+   * ```
+   */
+  isConfigured(params) {
+    return params.ENABLE_TELEMETRY === true && params.GRAFANA_TELEMETRY === true;
+  }
+  /**
+   * Validates Grafana-specific parameters
+   *
+   * IMPORTANT: Only call this method after isConfigured() returns true.
+   *
+   * Validation rules by mode:
+   * - GRAFANA_DEV=true   → all parameters optional; localhost defaults are used
+   * - GRAFANA_CLOUD=true → GRAFANA_ENDPOINT, GRAFANA_SERVICE_NAME, GRAFANA_INSTANCE_ID,
+   *                        and GRAFANA_API_KEY are all required
+   * - Default (tunnel)   → GRAFANA_ENDPOINT and GRAFANA_SERVICE_NAME are required;
+   *                        no credentials needed
+   *
+   * @param params - Runtime parameters to validate
+   * @throws {TelemetryInputError} If required parameters are missing for the selected mode
+   *
+   * @example Dev mode — all optional
+   * ```typescript
+   * validator.validateConfiguration({ GRAFANA_DEV: true }); // passes
+   * ```
+   *
+   * @example Grafana Cloud — credentials required
+   * ```typescript
+   * validator.validateConfiguration({
+   *   GRAFANA_CLOUD: true,
+   *   GRAFANA_ENDPOINT: 'https://otlp-gateway-prod-us-east-0.grafana.net/otlp',
+   *   GRAFANA_SERVICE_NAME: 'my-app',
+   *   GRAFANA_INSTANCE_ID: '123456',
+   *   GRAFANA_API_KEY: 'glc_xxx',
+   * }); // passes
+   * ```
+   *
+   * @example Tunnel (deployed) mode — endpoint + service name required
+   * ```typescript
+   * validator.validateConfiguration({
+   *   GRAFANA_ENDPOINT: 'https://abc123.trycloudflare.com',
+   *   GRAFANA_SERVICE_NAME: 'my-app',
+   * }); // passes
+   * ```
+   */
+  validateConfiguration(params) {
+    if (params.GRAFANA_DEV === true) {
+      return;
+    }
+    if (!params.GRAFANA_ENDPOINT) {
+      throw new TelemetryInputError(
+        "GRAFANA_ENDPOINT is required when GRAFANA_DEV is not true. Provide a reachable OTLP/HTTP collector URL."
+      );
+    }
+    if (!params.GRAFANA_SERVICE_NAME) {
+      throw new TelemetryInputError(
+        "GRAFANA_SERVICE_NAME is required when GRAFANA_DEV is not true."
+      );
+    }
+    if (params.GRAFANA_CLOUD === true) {
+      if (!params.GRAFANA_INSTANCE_ID) {
+        throw new TelemetryInputError(
+          "GRAFANA_INSTANCE_ID is required when GRAFANA_CLOUD is true."
+        );
+      }
+      if (!params.GRAFANA_API_KEY) {
+        throw new TelemetryInputError("GRAFANA_API_KEY is required when GRAFANA_CLOUD is true.");
+      }
+    }
+  }
+};
+__name(_GrafanaTelemetryValidator, "GrafanaTelemetryValidator");
+var GrafanaTelemetryValidator = _GrafanaTelemetryValidator;
+
+// src/framework/telemetry/grafana/index.ts
+var import_otel2 = require("@adobe/aio-lib-telemetry/otel");
+var DEFAULT_DEV_URL = "http://localhost:4318";
+var DEFAULT_SERVICE_NAME = "app-builder-app";
+var _GrafanaTelemetry = class _GrafanaTelemetry {
+  constructor() {
+    this.validator = new GrafanaTelemetryValidator();
+    this.successChecker = new SuccessChecker();
+  }
+  /**
+   * Checks if Grafana telemetry can be initialized
+   *
+   * Returns true when ENABLE_TELEMETRY=true and GRAFANA_TELEMETRY=true.
+   *
+   * @param params - Runtime parameters to check
+   * @returns true if Grafana telemetry is enabled and can be initialized
+   *
+   * @example
+   * ```typescript
+   * const telemetry = new GrafanaTelemetry();
+   * if (telemetry.canInitialize(params)) {
+   *   // Grafana is configured, use it
+   * } else {
+   *   // Skip to next provider
+   * }
+   * ```
+   */
+  canInitialize(params) {
+    return this.validator.isConfigured(params);
+  }
+  /**
+   * Get the OpenTelemetry instrumentation configuration for Grafana
+   *
+   * Builds and returns the complete instrumentation configuration:
+   * - Service name (from GRAFANA_SERVICE_NAME or default)
+   * - Preset simple instrumentations
+   * - Adobe I/O Runtime resource attributes
+   * - OTLP/HTTP exporters (localhost in dev, GRAFANA_ENDPOINT in deployed)
+   * - Success/failure detection for actions
+   *
+   * @returns Complete entrypoint instrumentation configuration
+   * @throws {TelemetryInputError} If GRAFANA_ENDPOINT or GRAFANA_SERVICE_NAME is missing in non-dev mode
+   */
+  getConfig() {
+    return {
+      ...(0, import_aio_lib_telemetry3.defineTelemetryConfig)((params) => {
+        this.validator.validateConfiguration(params);
+        const serviceName = params.GRAFANA_DEV === true ? params.GRAFANA_SERVICE_NAME || DEFAULT_SERVICE_NAME : params.GRAFANA_SERVICE_NAME;
+        return {
+          sdkConfig: {
+            serviceName,
+            instrumentations: (0, import_aio_lib_telemetry3.getPresetInstrumentations)("simple"),
+            resource: (0, import_aio_lib_telemetry3.getAioRuntimeResource)(),
+            ...this.buildExportersConfig(params)
+          }
+        };
+      }),
+      isSuccessful: this.successChecker.execute.bind(this.successChecker)
+    };
+  }
+  /**
+   * Build OTLP/HTTP exporters for traces, metrics, and logs
+   *
+   * Selects the collector base URL and optional auth header based on mode:
+   * - GRAFANA_DEV=true   → http://localhost:4318, no auth
+   * - GRAFANA_CLOUD=true → GRAFANA_ENDPOINT with Basic auth (instance ID + API key)
+   * - Default (tunnel)   → GRAFANA_ENDPOINT, no auth
+   *
+   * All three signal types share the same factory that appends the signal-specific
+   * path (/v1/traces, /v1/metrics, /v1/logs) to the base URL.
+   *
+   * @param params - Runtime parameters
+   * @returns Configuration object with traceExporter, metricReaders, logRecordProcessors
+   * @private
+   */
+  buildExportersConfig(params) {
+    const exportUrl = (params.GRAFANA_DEV === true ? DEFAULT_DEV_URL : params.GRAFANA_ENDPOINT).replace(/\/$/, "");
+    const authHeader = params.GRAFANA_CLOUD === true ? {
+      Authorization: `Basic ${Buffer.from(
+        `${params.GRAFANA_INSTANCE_ID}:${params.GRAFANA_API_KEY}`
+      ).toString("base64")}`
+    } : void 0;
+    const makeExporterConfig = /* @__PURE__ */ __name((path) => authHeader ? { url: `${exportUrl}/${path}`, headers: authHeader } : { url: `${exportUrl}/${path}` }, "makeExporterConfig");
+    return {
+      traceExporter: new import_otel2.OTLPTraceExporterProto(makeExporterConfig("v1/traces")),
+      metricReaders: [
+        new import_otel2.PeriodicExportingMetricReader({
+          exporter: new import_otel2.OTLPMetricExporterProto(makeExporterConfig("v1/metrics"))
+        })
+      ],
+      logRecordProcessors: [
+        new import_otel2.SimpleLogRecordProcessor(new import_otel2.OTLPLogExporterProto(makeExporterConfig("v1/logs")))
+      ]
+    };
+  }
+  /**
+   * Initialize telemetry instrumentation for a runtime action
+   *
+   * Wraps the provided action with OpenTelemetry instrumentation using
+   * the Grafana LGTM stack as the backend.
+   *
+   * @param action - The runtime action function to instrument
+   * @returns The instrumented action function with Grafana telemetry enabled
+   * @throws {TelemetryInputError} If required configuration is missing
+   *
+   * @example
+   * ```typescript
+   * async function myAction(params: Record<string, unknown>) {
+   *   return { statusCode: 200, body: { success: true } };
+   * }
+   *
+   * const telemetry = new GrafanaTelemetry();
+   * export const main = telemetry.initialize(myAction);
+   * ```
+   */
+  initialize(action) {
+    return (0, import_aio_lib_telemetry3.instrumentEntrypoint)(action, this.getConfig());
+  }
+};
+__name(_GrafanaTelemetry, "GrafanaTelemetry");
+var GrafanaTelemetry = _GrafanaTelemetry;
+var grafana_default = GrafanaTelemetry;
+
+// src/framework/telemetry/helpers/log-sanitizer/types.ts
+var EXACT_SENSITIVE_KEYS = /* @__PURE__ */ new Set([
+  "authorization",
+  "x-api-key",
+  "cookie",
+  "set-cookie"
+]);
+var SENSITIVE_KEY_SUFFIXES = [
+  "_api_key",
+  "_secret",
+  "_token",
+  "_password",
+  "_key",
+  "-token",
+  "-secret",
+  "-key"
+];
+
+// src/framework/telemetry/helpers/log-sanitizer/index.ts
+var _LogSanitizer = class _LogSanitizer {
+  constructor(additionalSensitiveKeys = /* @__PURE__ */ new Set(), maxDepth = 10) {
+    this.additionalSensitiveKeys = additionalSensitiveKeys;
+    this.maxDepth = maxDepth;
+  }
+  /**
+   * Parses the `SENSITIVE_KEYS` runtime param into a `ReadonlySet<string>`.
+   *
+   * Accepts three forms:
+   * - **Array** — each string element becomes a key (`["my_key", "x-secret"]`)
+   * - **Comma-separated string** — split on `,`, each trimmed segment becomes a key (`"my_key, x-secret"`)
+   * - **Single string** — treated as one key (`"my_key"`)
+   *
+   * Non-string array elements and non-string / non-array values are silently ignored.
+   * All keys are lowercased for case-insensitive matching.
+   *
+   * @param raw - The raw `params.SENSITIVE_KEYS` value
+   * @returns A set of lowercased key strings safe to pass to the constructor
+   */
+  static parseSensitiveKeys(raw) {
+    if (Array.isArray(raw)) {
+      return new Set(
+        raw.filter((v) => typeof v === "string").map((v) => v.trim().toLowerCase()).filter(Boolean)
+      );
+    }
+    if (typeof raw === "string") {
+      return new Set(
+        raw.split(",").map((s) => s.trim().toLowerCase()).filter(Boolean)
+      );
+    }
+    return /* @__PURE__ */ new Set();
+  }
+  /**
+   * Sanitizes `data` and returns a deep copy with sensitive values replaced.
+   *
+   * @param data - The value to sanitize
+   * @returns A sanitized deep copy of `data`
+   */
+  execute(data) {
+    return this.sanitize(data, this.maxDepth);
+  }
+  /**
+   * Returns `true` when `key` should have its value replaced with `"[REDACTED]"`.
+   *
+   * Matches exact keys from {@link EXACT_SENSITIVE_KEYS} and the caller's
+   * `additionalSensitiveKeys`, then falls back to suffix matching via
+   * {@link SENSITIVE_KEY_SUFFIXES}. All comparisons are case-insensitive.
+   *
+   * @param key - Object property name to evaluate
+   */
+  isSensitiveKey(key) {
+    const lower = key.toLowerCase();
+    if (EXACT_SENSITIVE_KEYS.has(lower) || this.additionalSensitiveKeys.has(lower)) {
+      return true;
+    }
+    return SENSITIVE_KEY_SUFFIXES.some((suffix) => lower.endsWith(suffix));
+  }
+  /**
+   * Recursively sanitizes `data` up to `depth` levels deep.
+   *
+   * Arrays are mapped element-by-element; plain objects have each value checked
+   * with {@link isSensitiveKey} and replaced or recursed accordingly. All other
+   * value types (primitives, `null`, `undefined`) are returned unchanged.
+   * When `depth` reaches zero the node is returned as-is to cap recursion.
+   *
+   * @param data  - Value to sanitize
+   * @param depth - Remaining recursion budget
+   */
+  sanitize(data, depth) {
+    if (depth === 0 || data === null || data === void 0) {
+      return data;
+    }
+    if (Array.isArray(data)) {
+      return data.map((item) => this.sanitize(item, depth - 1));
+    }
+    if (typeof data === "object") {
+      const sanitized = {};
+      for (const [key, value] of Object.entries(data)) {
+        sanitized[key] = this.isSensitiveKey(key) ? "[REDACTED]" : this.sanitize(value, depth - 1);
+      }
+      return sanitized;
+    }
+    return data;
+  }
+};
+__name(_LogSanitizer, "LogSanitizer");
+var LogSanitizer = _LogSanitizer;
+
 // src/framework/telemetry/index.ts
 var _Telemetry = class _Telemetry {
   /**
@@ -886,7 +1215,7 @@ var _Telemetry = class _Telemetry {
       level: this.params?.LOG_LEVEL || "info"
     });
     if (this.params?.ENABLE_TELEMETRY === true) {
-      const helpers = (0, import_aio_lib_telemetry3.getInstrumentationHelpers)();
+      const helpers = (0, import_aio_lib_telemetry4.getInstrumentationHelpers)();
       baseLogger = helpers.logger;
     }
     const metadata = {};
@@ -899,38 +1228,24 @@ var _Telemetry = class _Telemetry {
     if (actionType && actionType !== "") {
       metadata["action.type"] = actionType;
     }
+    const logSanitizer = new LogSanitizer(
+      LogSanitizer.parseSensitiveKeys(this.params?.SENSITIVE_KEYS)
+    );
     if (Object.keys(metadata).length === 0) {
+      this.logger = baseLogger;
       return baseLogger;
     }
+    const sanitizeAndMerge = /* @__PURE__ */ __name((message) => {
+      if (typeof message === "object" && message !== null) {
+        return logSanitizer.execute({ ...metadata, ...message });
+      }
+      return message;
+    }, "sanitizeAndMerge");
     const wrapper = {
-      debug: /* @__PURE__ */ __name((message) => {
-        if (typeof message === "object" && message !== null) {
-          baseLogger.debug({ ...metadata, ...message });
-        } else {
-          baseLogger.debug(message);
-        }
-      }, "debug"),
-      info: /* @__PURE__ */ __name((message) => {
-        if (typeof message === "object" && message !== null) {
-          baseLogger.info({ ...metadata, ...message });
-        } else {
-          baseLogger.info(message);
-        }
-      }, "info"),
-      warn: /* @__PURE__ */ __name((message) => {
-        if (typeof message === "object" && message !== null) {
-          baseLogger.warn({ ...metadata, ...message });
-        } else {
-          baseLogger.warn(message);
-        }
-      }, "warn"),
-      error: /* @__PURE__ */ __name((message) => {
-        if (typeof message === "object" && message !== null) {
-          baseLogger.error({ ...metadata, ...message });
-        } else {
-          baseLogger.error(message);
-        }
-      }, "error")
+      debug: /* @__PURE__ */ __name((message) => baseLogger.debug(sanitizeAndMerge(message)), "debug"),
+      info: /* @__PURE__ */ __name((message) => baseLogger.info(sanitizeAndMerge(message)), "info"),
+      warn: /* @__PURE__ */ __name((message) => baseLogger.warn(sanitizeAndMerge(message)), "warn"),
+      error: /* @__PURE__ */ __name((message) => baseLogger.error(sanitizeAndMerge(message)), "error")
     };
     this.logger = {
       ...baseLogger,
@@ -993,7 +1308,7 @@ var _Telemetry = class _Telemetry {
    */
   getCurrentSpan() {
     if (this.params?.ENABLE_TELEMETRY === true) {
-      const helpers = (0, import_aio_lib_telemetry3.getInstrumentationHelpers)();
+      const helpers = (0, import_aio_lib_telemetry4.getInstrumentationHelpers)();
       return helpers?.currentSpan || null;
     }
     return null;
@@ -1031,7 +1346,7 @@ var _Telemetry = class _Telemetry {
    * ```
    */
   instrument(spanName, fn) {
-    return (0, import_aio_lib_telemetry3.instrument)(fn, {
+    return (0, import_aio_lib_telemetry4.instrument)(fn, {
       spanConfig: {
         spanName
       }
@@ -1042,7 +1357,7 @@ var _Telemetry = class _Telemetry {
    *
    * Attempts to initialize telemetry providers in the following order:
    * 1. New Relic (if NEW_RELIC_TELEMETRY=true)
-   * 2. Grafana (if GRAFANA_TELEMETRY=true) - Future support
+   * 2. Grafana LGTM (if GRAFANA_TELEMETRY=true)
    * 3. Original action (no telemetry)
    *
    * Telemetry initialization is deferred to runtime when params are available.
@@ -1057,13 +1372,30 @@ var _Telemetry = class _Telemetry {
    * @param action - The runtime action function to instrument
    * @returns The instrumented action ready for export
    *
-   * @example
+   * @example New Relic provider
    * ```typescript
    * const telemetry = new Telemetry();
    * export const main = telemetry.initialize(myAction);
    * // Environment: ENABLE_TELEMETRY=true, NEW_RELIC_TELEMETRY=true
    * // Result: Uses New Relic telemetry with full distributed tracing
    * ```
+   *
+   * @example Grafana LGTM provider (dev mode)
+   * ```typescript
+   * const telemetry = new Telemetry();
+   * export const main = telemetry.initialize(myAction);
+   * // Environment: ENABLE_TELEMETRY=true, GRAFANA_TELEMETRY=true, GRAFANA_DEV=true
+   * // Result: Sends all signals to http://localhost:4318 (Grafana LGTM Docker stack)
+   * ```
+   *
+   * @example Grafana LGTM provider (deployed mode)
+   * ```typescript
+   * const telemetry = new Telemetry();
+   * export const main = telemetry.initialize(myAction);
+   * // Environment: ENABLE_TELEMETRY=true, GRAFANA_TELEMETRY=true,
+   * //              GRAFANA_ENDPOINT=https://abc123.trycloudflare.com
+   * // Result: Sends all signals to the Cloudflare tunnel URL
+   * ```
    */
   initialize(action) {
     return async (params) => {
@@ -1081,6 +1413,19 @@ var _Telemetry = class _Telemetry {
           );
         }
       }
+      const grafanaTelemetry = new grafana_default();
+      if (grafanaTelemetry.canInitialize(params)) {
+        try {
+          const instrumentedAction = grafanaTelemetry.initialize(action);
+          return await instrumentedAction(params);
+        } catch (error) {
+          const errorMessage = error instanceof Error ? error.message : "Telemetry initialization failed";
+          return response_default.error(
+            500 /* INTERNAL_ERROR */,
+            `Telemetry configuration error: ${errorMessage}`
+          );
+        }
+      }
       return action(params);
     };
   }
@@ -1191,6 +1536,7 @@ var _RuntimeAction = class _RuntimeAction {
       }
       telemetry.setParams(params);
       const logger = telemetry.createLogger(name);
+      const logSanitizer = new LogSanitizer(LogSanitizer.parseSensitiveKeys(params.SENSITIVE_KEYS));
       try {
         logger.debug({
           message: `${_RuntimeAction.getActionTypeName()} execution started`
@@ -1198,13 +1544,13 @@ var _RuntimeAction = class _RuntimeAction {
         logger.debug(
           JSON.stringify({
             message: `${_RuntimeAction.getActionTypeName()} headers received`,
-            headers: params.__ow_headers || {}
+            headers: logSanitizer.execute(params.__ow_headers || {})
           })
         );
         logger.debug(
           JSON.stringify({
             message: `${_RuntimeAction.getActionTypeName()} body received`,
-            body: params.__ow_body || {}
+            body: logSanitizer.execute(params.__ow_body || {})
           })
         );
         const validationError = _RuntimeAction.validateRequestWithInstrumentation(
@@ -1230,7 +1576,7 @@ var _RuntimeAction = class _RuntimeAction {
         logger.debug(
           JSON.stringify({
             message: `${_RuntimeAction.getActionTypeName()} execution completed`,
-            result
+            result: logSanitizer.execute(result)
           })
         );
         return result;
@@ -1488,17 +1834,18 @@ var _EventConsumerAction = class _EventConsumerAction {
     const eventConsumerAction = /* @__PURE__ */ __name(async (params) => {
       params.action_type = "event-consumer-action";
       const logger = telemetry.createLogger(name);
+      const logSanitizer = new LogSanitizer(LogSanitizer.parseSensitiveKeys(params.SENSITIVE_KEYS));
       try {
         logger.debug({
           message: "Event consumer action execution started"
         });
         logger.debug({
           message: "Event consumer action headers received",
-          headers: params.__ow_headers || {}
+          headers: logSanitizer.execute(params.__ow_headers || {})
         });
         logger.debug({
           message: "Event consumer action parameters received",
-          parameters: params
+          parameters: logSanitizer.execute(params)
         });
         const errorMessage = _EventConsumerAction.validateWithInstrumentation(
           name,
@@ -1524,7 +1871,7 @@ var _EventConsumerAction = class _EventConsumerAction {
         );
         logger.debug({
           message: "Event consumer action execution completed",
-          result
+          result: logSanitizer.execute(result)
         });
         return result;
       } catch (error) {
@@ -2152,13 +2499,14 @@ var _OpenwhiskAction = class _OpenwhiskAction {
     const openwhiskAction = /* @__PURE__ */ __name(async (params) => {
       params.action_type = "openwhisk-action";
       const logger = telemetry.createLogger(name);
+      const logSanitizer = new LogSanitizer(LogSanitizer.parseSensitiveKeys(params.SENSITIVE_KEYS));
       try {
         logger.debug({
           message: "OpenWhisk action execution started"
         });
         logger.debug({
           message: "OpenWhisk action parameters received",
-          params
+          params: logSanitizer.execute(params)
         });
         const result = await _OpenwhiskAction.executeActionWithInstrumentation(
           name,
@@ -2170,7 +2518,7 @@ var _OpenwhiskAction = class _OpenwhiskAction {
         );
         logger.debug({
           message: "OpenWhisk action execution completed",
-          result
+          result: logSanitizer.execute(result)
         });
         return result;
       } catch (error) {
@@ -13160,6 +13508,7 @@ var AdminUiSdk = _AdminUiSdk;
   InfiniteLoopBreaker,
   IoEventsGlobals,
   JsonMessageProcessor,
+  LogSanitizer,
   Oauth1aConnection,
   OnboardCommerce,
   OnboardEvents,