@apifuse/provider-sdk 2.2.0-beta.27 → 2.2.0-beta.29

package/dist/runtime/stealth.js

@@ -1,13 +1,13 @@
 import { createHash } from "node:crypto";
-import { Cookie, CookieJar as ToughCookieJar } from "tough-cookie";
 import { DEFAULT_SMARTPROXY_POOL_SIZE, invalidateProxyResolutionCacheAsync, ProxyResolutionError, policyResolvesRegistryVendorChain, resolvePolicyProxyPoolSpan, resolvePolicyTransportAttemptCap, resolveProxyConfigAsync, vendorFromResolvedSource, } from "../config/loader.js";
-import { SDKError, StealthCookieStoreVersionError, TransportError } from "../errors.js";
+import { SDKError, TransportError } from "../errors.js";
 import { getStealthProfile } from "../stealth/profiles.js";
+import { StealthCookieJar } from "./stealth-cookies.js";
 import { createProxyAuthIpDeniedError, createProxyEdgeAuthRejectedError, createProxyEdgeTlsRejectedError, createProxyPoolExhaustedError, createProxyPoolStaleError, isProxyAuthIpDeniedMessage, isProxyEdgeAuthRejectedMessage, isProxyEdgeTlsRejectedResponse, isProxyPoolRefreshableError, isProxyPoolStaleMessage, isProxyPoolStaleStatus, PROXY_EDGE_AUTH_REJECTED_CODE, PROXY_POOL_STALE_CODE, } from "./proxy-errors.js";
 import { computeProxyAttemptIndex, computeProxyTransportRetryDelayMs, createDefaultProxyTransportRetryOptions, normalizeProxyTransportRetryOptions, shouldRetryProxyTransportAttempt, validateUnsafeProxyTransportRetryMethods, } from "./proxy-retry-policy.js";
 import { evaluateRedirectHop, isRedirectStatus, nextRedirectMethod, resolveRedirectUrl, } from "./redirects.js";
 import { isSensitiveKey, normalizeSensitiveParams, redactSensitiveError, redactSensitiveRequestError, redactSensitiveText, redactUrlQueryParams, serializeRequestUrl, } from "./request-options.js";
-const DEFAULT_PROFILE = "chrome-146";
+export const DEFAULT_PROFILE = "chrome-146";
 const MISSING_PROXY_WARNING = "[provider-sdk] Provider requested proxy routing, but no proxy URL was configured. Continuing without proxy.";
 const MAX_POLICY_PROXY_POOL_REFRESHES = 1;
 const PROXY_CONNECT_FAILURE_CODE = "proxy_connect_failed";
@@ -22,6 +22,9 @@ const REDIRECT_BODY_HEADERS = new Set([
     "content-location",
     "content-type",
 ]);
+function isRecord(value) {
+    return typeof value === "object" && value !== null;
+}
 function sensitiveQueryParamNames(url) {
     const queryStart = url.indexOf("?");
     if (queryStart === -1)
@@ -43,132 +46,6 @@ const REMOVED_CHROME_PROFILE_NAMES = new Set([
     "chrome-130-psk",
     "edge-131",
 ]);
-function isRecord(value) {
-    return typeof value === "object" && value !== null;
-}
-const LEGACY_COOKIE_ORIGIN = "https://legacy-cookie.invalid/";
-class CookieJarImpl {
-    cookies;
-    defaultUrl;
-    constructor(cookieStrings, defaultUrl = LEGACY_COOKIE_ORIGIN) {
-        this.cookies = new ToughCookieJar(undefined, {
-            allowSecureOnLocal: false,
-            rejectPublicSuffixes: true,
-        });
-        this.defaultUrl = this.normalizeUrl(defaultUrl) ?? LEGACY_COOKIE_ORIGIN;
-        this.setFromCookieStrings(cookieStrings);
-    }
-    /**
-     * URL-less legacy operations are scoped to this jar's default URL. Session
-     * jars use the client's base URL and response jars use the response URL. A
-     * flat restore has no attributes to recover, so it creates host-only Path=/
-     * cookies for that default URL instead of making them visible to every host.
-     */
-    setFromCookieStrings(cookieStrings, url = this.defaultUrl) {
-        const cookieUrl = this.normalizeUrl(url);
-        if (!cookieUrl)
-            return;
-        for (const cookieString of cookieStrings) {
-            this.cookies.setCookieSync(cookieString, cookieUrl, { ignoreError: true });
-        }
-    }
-    get(name, url) {
-        return this.getAll(url)[name];
-    }
-    getAll(url) {
-        return Object.fromEntries(this.getUniqueCookies(url ?? this.defaultUrl).map((cookie) => [cookie.key, cookie.value]));
-    }
-    has(name, url) {
-        return Object.hasOwn(this.getAll(url), name);
-    }
-    toString(url) {
-        return this.getUniqueCookies(url ?? this.defaultUrl)
-            .map((cookie) => cookie.cookieString())
-            .join("; ");
-    }
-    toHeader(url) {
-        return this.toString(url);
-    }
-    snapshot() {
-        // This compatibility view deliberately enumerates the serialized store,
-        // not getAll(defaultUrl): persistence must include sibling hosts and paths.
-        // Duplicate names still collapse because a flat map cannot represent them.
-        const entries = [];
-        for (const cookie of this.serialize().jar.cookies) {
-            if (typeof cookie.key === "string" && typeof cookie.value === "string" && cookie.key) {
-                entries.push([cookie.key, cookie.value]);
-            }
-        }
-        return Object.fromEntries(entries);
-    }
-    restore(cookies) {
-        this.clear();
-        for (const [name, value] of Object.entries(cookies)) {
-            if (!name)
-                continue;
-            this.cookies.setCookieSync(new Cookie({ key: name, path: "/", value }), this.defaultUrl, {
-                ignoreError: true,
-            });
-        }
-    }
-    serialize() {
-        const jar = this.cookies.serializeSync();
-        if (!jar) {
-            throw new SDKError("Stealth cookie store could not be serialized", {
-                code: "stealth_cookie_store_serialize_failed",
-            });
-        }
-        return { version: 1, jar };
-    }
-    deserialize(state) {
-        const version = isRecord(state) ? state.version : undefined;
-        if (version !== 1) {
-            throw new StealthCookieStoreVersionError(version);
-        }
-        // Deserialize into a new jar first so invalid state cannot partially clear
-        // or replace a live session. tough-cookie restores the cookie attributes and
-        // matching semantics represented in its own serialized format.
-        const restored = ToughCookieJar.deserializeSync(state.jar);
-        // tough-cookie 6 does not include this option in serializeSync(). Preserve
-        // the SDK's stricter setting across restoration.
-        Reflect.set(restored, "allowSecureOnLocal", false);
-        this.cookies = restored;
-    }
-    clear() {
-        this.cookies.removeAllCookiesSync();
-    }
-    find(predicate, url) {
-        for (const cookie of this.getUniqueCookies(url ?? this.defaultUrl)) {
-            const cookieString = cookie.cookieString();
-            if (predicate(cookieString)) {
-                return cookieString;
-            }
-        }
-        return undefined;
-    }
-    normalizeUrl(url) {
-        try {
-            return new URL(url).toString();
-        }
-        catch {
-            return undefined;
-        }
-    }
-    getUniqueCookies(url) {
-        const cookieUrl = this.normalizeUrl(url);
-        if (!cookieUrl)
-            return [];
-        // tough-cookie returns longer (more-specific) paths first. Keeping the
-        // first cookie for each name prevents ambiguous duplicate-name headers.
-        const names = new Set();
-        return this.cookies.getCookiesSync(cookieUrl).filter((cookie) => {
-            if (names.has(cookie.key))
-                return false;
-            names.add(cookie.key);
-            return true;
-        });
-    }
-}
 let wreqModulePromise;
 function getWreqModule() {
     if (!wreqModulePromise) {
@@ -325,7 +202,7 @@ function splitCombinedSetCookieHeader(headerValue) {
 }
 export async function normalizeResponse(response, requestUrl, maxBodyBytes) {
     const headers = Object.fromEntries(response.headers.entries());
-    const cookies = new CookieJarImpl(setCookieHeadersFromResponse(response.headers), response.url ?? requestUrl);
+    const cookies = new StealthCookieJar(setCookieHeadersFromResponse(response.headers), response.url ?? requestUrl);
     const bodyBytes = maxBodyBytes === undefined
         ? await response.arrayBuffer()
         : await readResponseBodyWithLimit(response, maxBodyBytes);
@@ -669,7 +546,7 @@ function createSessionFetcher(baseUrl, defaultProfile, clientOptions) {
     let closed = false;
     let hasWarnedMissingProxy = false;
     const warn = clientOptions.warn ?? console.warn;
-    const cookieJar = new CookieJarImpl([], baseUrl);
+    const cookieJar = new StealthCookieJar([], baseUrl);
     async function getClientEntry(profileName, proxyUrl, ignoreTlsErrors) {
         if (closed) {
             throw new TransportError("Stealth session is closed", { status: 0 });

package/dist/serve.d.ts

@@ -1 +1 @@
-export { createServerApp, type ServeOptions, serve } from "./server/serve.js";
+export { createServerApp, createServerAppAsync, type ServeOptions, serve, } from "./server/serve.js";

package/dist/serve.js

@@ -1 +1 @@
-export { createServerApp, serve } from "./server/serve.js";
+export { createServerApp, createServerAppAsync, serve, } from "./server/serve.js";

package/dist/server/index.d.ts

@@ -1,4 +1,4 @@
-export { createServerApp, ERROR_OBSERVABILITY_HEADER, type ErrorObservabilityDetails, type ProviderServerCloseOptions, type ProviderServerHandle, type ProviderServerLogEvent, type ProviderServerLogger, type ProviderServerOperationExecutor, type ProviderServerOperationExecutorInput, type ProviderServerOptions, type ProviderServerStatefulForwardEnvelope, type ServeOptions, serve, } from "./serve.js";
+export { createServerApp, createServerAppAsync, ERROR_OBSERVABILITY_HEADER, type ErrorObservabilityDetails, type ProviderServerCloseOptions, type ProviderServerHandle, type ProviderServerLogEvent, type ProviderServerLogger, type ProviderServerOperationExecutor, type ProviderServerOperationExecutorInput, type ProviderServerOptions, type ProviderServerStatefulForwardEnvelope, type ServeOptions, serve, } from "./serve.js";
 export { computeSelfTestPlanDigest, createSelfTestApp, createSelfTestAuthFlowInvoke, createSelfTestInvoke, DEFAULT_SELF_TEST_REQUEST_BUDGET_MS, isSelfTestReadOnlyOperation, PROVIDER_RUNTIME_SELF_TEST_REQUEST_BUDGET_MS_ENV, resolveSelfTestPort, SELF_TEST_AUTH_FLOW_MULTI_TURN_SKIP_REASON, SELF_TEST_AUTH_FLOW_REJECTED_SKIP_REASON, SELF_TEST_HEALTHZ_PATH, SELF_TEST_PATH, SELF_TEST_SCHEMA_VERSION, type SelfTestAppOptions, type SelfTestAuthFlowInvoke, type SelfTestAuthFlowRoute, type SelfTestCaseResult, type SelfTestCaseStatus, type SelfTestOperationInvoke, type SelfTestRequest, SelfTestRequestSchema, type SelfTestResponse, } from "./self-test.js";
 export { type InputDateTokenCalendar, resolveHealthCheckInputDateTokens, } from "./self-test-input-tokens.js";
 export { collectSelfTestSensitiveValues, redactSelfTestText, SELF_TEST_MAX_TEXT_LENGTH, SELF_TEST_REDACTED_PLACEHOLDER, } from "./self-test-redaction.js";

package/dist/server/index.js

@@ -1,4 +1,4 @@
-export { createServerApp, ERROR_OBSERVABILITY_HEADER, serve, } from "./serve.js";
+export { createServerApp, createServerAppAsync, ERROR_OBSERVABILITY_HEADER, serve, } from "./serve.js";
 export { computeSelfTestPlanDigest, createSelfTestApp, createSelfTestAuthFlowInvoke, createSelfTestInvoke, DEFAULT_SELF_TEST_REQUEST_BUDGET_MS, isSelfTestReadOnlyOperation, PROVIDER_RUNTIME_SELF_TEST_REQUEST_BUDGET_MS_ENV, resolveSelfTestPort, SELF_TEST_AUTH_FLOW_MULTI_TURN_SKIP_REASON, SELF_TEST_AUTH_FLOW_REJECTED_SKIP_REASON, SELF_TEST_HEALTHZ_PATH, SELF_TEST_PATH, SELF_TEST_SCHEMA_VERSION, SelfTestRequestSchema, } from "./self-test.js";
 export { resolveHealthCheckInputDateTokens, } from "./self-test-input-tokens.js";
 export { collectSelfTestSensitiveValues, redactSelfTestText, SELF_TEST_MAX_TEXT_LENGTH, SELF_TEST_REDACTED_PLACEHOLDER, } from "./self-test-redaction.js";

package/dist/server/self-test.d.ts

@@ -51,11 +51,21 @@ export interface SelfTestResponse {
     result?: SelfTestCaseResult;
     results: SelfTestCaseResult[];
 }
+export interface SelfTestCancellationLogEvent {
+    level: "info";
+    event: "self_test_run_cancelled";
+    providerId: string;
+    requestId: string;
+    operationId: string;
+    caseName: string;
+    reason: string;
+}
 export type SelfTestOperationInvoke = (args: {
     operationId: string;
     input: unknown;
     connection?: OperationConnection;
     requestId: string;
+    signal?: AbortSignal;
 }) => Promise<{
     status: number;
     data: unknown;
@@ -78,6 +88,7 @@ export type SelfTestAuthFlowInvoke = (args: {
     externalRef?: string;
     input?: Record<string, unknown>;
     context?: Record<string, unknown>;
+    signal?: AbortSignal;
 }) => Promise<{
     status: number;
     body: unknown;
@@ -112,6 +123,8 @@ export interface SelfTestAppOptions {
     requestBudgetMs?: number;
     /** Env override for secret collection + budget resolution (tests). */
     env?: Readonly<Record<string, string | undefined>>;
+    /** Structured server logger; defaults to the same JSON console shape as the provider server. */
+    logger?: (event: SelfTestCancellationLogEvent) => void;
 }
 /**
  * Stable sha256 over the provider's declared health plan (operations, case

package/dist/server/self-test.js

@@ -132,8 +132,8 @@ export function isSelfTestReadOnlyOperation(operation) {
 }
 /** Binds the self-test executor to a tenant app's /v1 pipeline in-process. */
 export function createSelfTestInvoke(app) {
-    return async ({ operationId, input, connection, requestId }) => {
-        const response = await app.request(`/v1/${encodeURIComponent(operationId)}`, {
+    return async ({ operationId, input, connection, requestId, signal }) => {
+        const responsePromise = Promise.resolve(app.request(`/v1/${encodeURIComponent(operationId)}`, {
             method: "POST",
             headers: { "content-type": "application/json" },
             body: JSON.stringify({
@@ -141,7 +141,14 @@ export function createSelfTestInvoke(app) {
                 input: input ?? {},
                 ...(connection ? { connection } : {}),
             }),
-        });
+            ...(signal ? { signal } : {}),
+        }));
+        const response = await responsePromise;
+        if (signal?.aborted) {
+            await cancelSelfTestResponse(response);
+            signal.throwIfAborted();
+        }
+        // An abort after body consumption starts may let response.text() finish.
         const text = await response.text();
         let body = text;
         try {
@@ -161,9 +168,36 @@ export function createSelfTestInvoke(app) {
         return { status: response.status, data: body };
     };
 }
+async function cancelSelfTestResponse(response) {
+    await response.body?.cancel().catch(() => undefined);
+}
+function selfTestAbortReason(reason, sensitiveValues) {
+    const text = reason instanceof Error
+        ? reason.message || reason.name
+        : reason === undefined
+            ? "aborted"
+            : String(reason);
+    return redactSelfTestText(text, sensitiveValues);
+}
+function logSelfTestCancellation(provider, options, requestId, selected, signal, sensitiveValues) {
+    const event = {
+        level: "info",
+        event: "self_test_run_cancelled",
+        providerId: provider.id,
+        requestId,
+        operationId: selected.operationId,
+        caseName: selected.healthCase.name,
+        reason: selfTestAbortReason(signal.reason, sensitiveValues),
+    };
+    if (options.logger) {
+        options.logger(event);
+        return;
+    }
+    console.log(JSON.stringify(event));
+}
 /** Binds the self-test auth-flow driver to a tenant app's /auth pipeline in-process. */
 export function createSelfTestAuthFlowInvoke(app) {
-    return async ({ route, requestId, flowId, connectionId, externalRef, input, context }) => {
+    return async ({ route, requestId, flowId, connectionId, externalRef, input, context, signal, }) => {
         const response = await app.request(`/auth/${route}`, {
             method: "POST",
             headers: { "content-type": "application/json" },
@@ -175,6 +209,7 @@ export function createSelfTestAuthFlowInvoke(app) {
                 ...(input ? { input } : {}),
                 ...(context ? { context } : {}),
             }),
+            ...(signal ? { signal } : {}),
         });
         const text = await response.text();
         let body = text;
@@ -193,19 +228,32 @@ class SelfTestCaseTimeoutError extends Error {
         this.name = "SelfTestCaseTimeoutError";
     }
 }
-async function withCaseTimeout(run, timeoutMs) {
+async function withCaseTimeout(run, timeoutMs, controller) {
     let timer;
+    let onAbort;
     try {
         return await Promise.race([
             run(),
             new Promise((_, reject) => {
-                timer = setTimeout(() => reject(new SelfTestCaseTimeoutError(timeoutMs)), timeoutMs);
+                timer = setTimeout(() => {
+                    const error = new SelfTestCaseTimeoutError(timeoutMs);
+                    controller.abort(error);
+                    reject(error);
+                }, timeoutMs);
+            }),
+            new Promise((_, reject) => {
+                onAbort = () => reject(controller.signal.reason);
+                controller.signal.addEventListener("abort", onAbort, { once: true });
+                if (controller.signal.aborted)
+                    onAbort();
             }),
         ]);
     }
     finally {
         if (timer !== undefined)
             clearTimeout(timer);
+        if (onAbort)
+            controller.signal.removeEventListener("abort", onAbort);
     }
 }
 function objectProperty(value, key) {
@@ -389,6 +437,7 @@ async function materializeFlowCredential(execution, inputs, options = {}) {
         flowId,
         ...(options.connectionId ? { connectionId: options.connectionId } : {}),
         ...(options.externalRef ? { externalRef: options.externalRef } : {}),
+        ...(options.signal ? { signal: options.signal } : {}),
     }));
     if (!started.ok) {
         return { kind: "flow_error", code: started.code, message: started.message };
@@ -460,6 +509,7 @@ async function materializeFlowCredential(execution, inputs, options = {}) {
             ...(options.externalRef ? { externalRef: options.externalRef } : {}),
             input: submitInputs,
             ...(Object.keys(flowContext).length > 0 ? { context: flowContext } : {}),
+            ...(options.signal ? { signal: options.signal } : {}),
         }));
         if (!continued.ok) {
             // Providers built with defineCredentialsAuth cannot return a retry
@@ -613,6 +663,7 @@ async function resolveSelfTestConnection(execution, operationId, suite, options
         ...(options.isAbandoned !== undefined ? { isAbandoned: options.isAbandoned } : {}),
         connectionId,
         externalRef: `${execution.provider.id}-${operationId}-self-test`,
+        ...(options.signal ? { signal: options.signal } : {}),
     });
     if (!("credential" in materialized)) {
         // Only the multi-turn SKIP is negative-cached. Flow ERRORS
@@ -632,10 +683,9 @@ async function resolveSelfTestConnection(execution, operationId, suite, options
         }
         return materialized;
     }
-    // A flow that outlived the case deadline still completes here (the timeout
-    // only races the promise, it cannot cancel it). The case already reported
-    // self_test_timeout — caching this credential would let the next probe
-    // reuse a login whose latency just failed the case, hiding the failure.
+    // Abort is cooperative: a flow may still complete after the case deadline
+    // if provider code ignores the signal. Never cache that late credential or
+    // let the next probe hide the timed-out login.
     if (options.isAbandoned?.() === true) {
         return {
             kind: "flow_error",
@@ -659,7 +709,7 @@ async function resolveSelfTestConnection(execution, operationId, suite, options
 function isAuthFailureCaseResult(result) {
     return result.status === "failed" && (result.httpStatus === 401 || result.httpStatus === 403);
 }
-async function executeSelfTestCase(execution, operationId, suite, healthCase) {
+async function executeSelfTestCase(execution, operationId, suite, healthCase, caseController) {
     const { provider, invoke } = execution;
     // execution.sensitiveValues may grow while the case runs (flow-issued
     // secrets); redact always reads the live array.
@@ -671,6 +721,7 @@ async function executeSelfTestCase(execution, operationId, suite, healthCase) {
     // a 30s case must never take ~4×30s across its stages.
     const caseDeadlineAtMs = performance.now() + timeoutMs;
     const remainingCaseTimeoutMs = () => Math.max(1, Math.ceil(caseDeadlineAtMs - performance.now()));
+    const runWithCaseTimeout = (run, remainingMs) => withCaseTimeout(run, remainingMs, caseController);
     const beginCase = () => {
         const startedAt = new Date().toISOString();
         const startedAtMs = performance.now();
@@ -695,14 +746,15 @@ async function executeSelfTestCase(execution, operationId, suite, healthCase) {
         });
     }
     const resolveConnection = async (forceLogin) => {
-        // The timeout only races the flow promise — it cannot cancel it. Once
-        // the deadline fires, the still-running resolution is marked abandoned
-        // so its late completion cannot write the session cache.
+        // The deadline aborts the in-process flow request. Keep the abandonment
+        // guard as a backstop for provider code that ignores cancellation so a
+        // late completion still cannot write the session cache.
         let abandoned = false;
         try {
-            return await withCaseTimeout(() => resolveSelfTestConnection(execution, operationId, suite, {
+            return await runWithCaseTimeout(() => resolveSelfTestConnection(execution, operationId, suite, {
                 forceLogin,
                 isAbandoned: () => abandoned,
+                signal: caseController.signal,
             }), remainingCaseTimeoutMs());
         }
         catch (error) {
@@ -739,7 +791,7 @@ async function executeSelfTestCase(execution, operationId, suite, healthCase) {
         // operation attempt, or a slow login reads as a fast healthy case.
         const { startedAtMs, finish } = caseScope;
         try {
-            return await withCaseTimeout(async () => {
+            return await runWithCaseTimeout(async () => {
                 const resolvedInput = resolveHealthCheckInputDateTokens(healthCase.input);
                 const preparedInput = healthCase.prepareInput
                     ? await healthCase.prepareInput({
@@ -758,6 +810,7 @@ async function executeSelfTestCase(execution, operationId, suite, healthCase) {
                                     input: gatewayInput,
                                     connection,
                                     requestId: `${execution.requestId}-prepare-${randomUUID()}`,
+                                    signal: caseController.signal,
                                 });
                                 if (executed.status === 401 || executed.status === 403) {
                                     prepareAuthStatus = executed.status;
@@ -777,6 +830,7 @@ async function executeSelfTestCase(execution, operationId, suite, healthCase) {
                     input: preparedInput,
                     connection,
                     requestId: `${execution.requestId}-${randomUUID()}`,
+                    signal: caseController.signal,
                 });
                 const durationMs = performance.now() - startedAtMs;
                 if (executed.status < 200 || executed.status >= 300) {
@@ -1054,41 +1108,65 @@ export function createSelfTestApp(provider, options) {
             };
             const deadline = performance.now() + requestBudgetMs;
             const results = [];
+            const runSignal = c.req.raw.signal;
+            let interruptedCase;
             // Sequential execution (parallelism 1): self-tests run on serving pods
             // and must never compete with themselves for upstream quota.
             for (const selected of selection.cases) {
-                if (performance.now() >= deadline) {
-                    const now = new Date().toISOString();
-                    results.push({
-                        operationId: selected.operationId,
-                        caseName: selected.healthCase.name,
-                        status: "skipped",
-                        label: selected.healthCase.name,
-                        responseTimeMs: 0,
-                        skipReason: "budget_exhausted",
-                        startedAt: now,
-                        finishedAt: now,
-                    });
-                    continue;
+                const caseController = new AbortController();
+                const abortFromRun = () => caseController.abort(runSignal.reason);
+                runSignal.addEventListener("abort", abortFromRun, { once: true });
+                if (runSignal.aborted)
+                    abortFromRun();
+                try {
+                    if (runSignal.aborted) {
+                        interruptedCase = selected;
+                        break;
+                    }
+                    if (performance.now() >= deadline) {
+                        const now = new Date().toISOString();
+                        results.push({
+                            operationId: selected.operationId,
+                            caseName: selected.healthCase.name,
+                            status: "skipped",
+                            label: selected.healthCase.name,
+                            responseTimeMs: 0,
+                            skipReason: "budget_exhausted",
+                            startedAt: now,
+                            finishedAt: now,
+                        });
+                        continue;
+                    }
+                    if (!isSelfTestReadOnlyOperation(selected.operation)) {
+                        const now = new Date().toISOString();
+                        results.push({
+                            operationId: selected.operationId,
+                            caseName: selected.healthCase.name,
+                            status: "error",
+                            label: selected.healthCase.name,
+                            responseTimeMs: 0,
+                            error: {
+                                code: "operation_not_read_only",
+                                message: `Operation "${selected.operationId}" is not classified read-only; self-test refuses to execute it.`,
+                            },
+                            startedAt: now,
+                            finishedAt: now,
+                        });
+                        continue;
+                    }
+                    results.push(await executeSelfTestCase(execution, selected.operationId, selected.suite, selected.healthCase, caseController));
+                    if (runSignal.aborted) {
+                        interruptedCase = selected;
+                        break;
+                    }
                 }
-                if (!isSelfTestReadOnlyOperation(selected.operation)) {
-                    const now = new Date().toISOString();
-                    results.push({
-                        operationId: selected.operationId,
-                        caseName: selected.healthCase.name,
-                        status: "error",
-                        label: selected.healthCase.name,
-                        responseTimeMs: 0,
-                        error: {
-                            code: "operation_not_read_only",
-                            message: `Operation "${selected.operationId}" is not classified read-only; self-test refuses to execute it.`,
-                        },
-                        startedAt: now,
-                        finishedAt: now,
-                    });
-                    continue;
+                finally {
+                    runSignal.removeEventListener("abort", abortFromRun);
+                    caseController.abort();
                 }
-                results.push(await executeSelfTestCase(execution, selected.operationId, selected.suite, selected.healthCase));
+            }
+            if (interruptedCase) {
+                logSelfTestCancellation(provider, options, request.requestId, interruptedCase, runSignal, execution.sensitiveValues);
             }
             const singleCase = request.operationId !== undefined && request.caseName !== undefined;
             const response = {