@apifuse/provider-sdk 2.2.0-beta.53 → 2.2.0-beta.55

package/dist/server/serve-implementation.js

@@ -1,4 +1,5 @@
 import { createHash } from "node:crypto";
+import { AsyncLocalStorage } from "node:async_hooks";
 import { existsSync } from "node:fs";
 import { createRequire } from "node:module";
 import { join } from "node:path";
@@ -30,12 +31,13 @@ import { assertRequiredSecretsPresent, listMissingRequiredSecrets, MISSING_SECRE
 import { createProviderRuntimeStateFromEnv, createUnsupportedProviderRuntimeState, } from "../runtime/state.js";
 import { StealthCookieJar } from "../runtime/stealth-cookies.js";
 import { createSttClientFromEnv } from "../runtime/stt.js";
-import { createTraceContext } from "../runtime/trace.js";
+import { createTraceContext, updateTraceContextExportMetadata, } from "../runtime/trace.js";
 import { resolveTraceConfigFromEnv } from "../runtime/trace-config.js";
 import { parseSchema } from "../schema.js";
 import { STATEFUL_NONCE_HEADER as STATEFUL_FORWARDING_NONCE_HEADER, STATEFUL_SIGNATURE_HEADER as STATEFUL_FORWARDING_SIGNATURE_HEADER, STATEFUL_TIMESTAMP_HEADER as STATEFUL_FORWARDING_TIMESTAMP_HEADER, verifyStatefulRequestSignature, } from "../stateful-signing.js";
 import { StatefulRoutingDeadlineError } from "../stateful/errors.js";
 import { getStealthProfile } from "../stealth/profiles.js";
+import { sanitizeTraceAttributes } from "../trace-sanitization.js";
 import { APIFUSE_STREAM_DONE_EVENT, APIFUSE_STREAM_ERROR_EVENT, encodeSseEvent, error as streamError, } from "../stream.js";
 import { VALID_OPERATION_ERROR_STATUSES } from "../types.js";
 import { resolveSelfTestMasterSecrets } from "./self-test-token.js";
@@ -398,8 +400,7 @@ function resolveNativeProxyPolicy(provider) {
 function providerSecretNames(provider) {
     return (provider.secrets?.map((secret) => secret.name) ?? []).filter((name) => !isEngineOwnedEnvName(name));
 }
-function createProviderContext(provider, request, operationId, options, state = createUnsupportedProviderRuntimeState(), proxyTelemetry, signal) {
-    const traceConfig = resolveTraceConfigFromEnv();
+function createProviderContext(provider, request, operationId, options, state = createUnsupportedProviderRuntimeState(), scope, signal) {
     const baseUrl = getProviderBaseUrl(provider);
     const stealthBaseUrl = getProviderStealthBaseUrl(provider);
     const stealthProfile = getProviderStealthProfile(provider);
@@ -408,7 +409,7 @@ function createProviderContext(provider, request, operationId, options, state =
     const proxyClientOptions = {
         upstream: { proxy: provider.proxy },
         affinityKey: resolveProviderProxyAffinityKey(provider, request, operationId),
-        telemetry: proxyTelemetry,
+        telemetry: scope.proxyTelemetry,
         engineCredentials: engineProxyCredentials,
     };
     const resolverIdentityScope = resolveProviderResolverIdentityScope(provider, proxyClientOptions.affinityKey, request.requestId);
@@ -416,7 +417,7 @@ function createProviderContext(provider, request, operationId, options, state =
     const stealthClientOptions = {
         upstream: proxyClientOptions.upstream,
         affinityKey: proxyClientOptions.affinityKey,
-        telemetry: proxyTelemetry,
+        telemetry: scope.proxyTelemetry,
         engineCredentials: engineProxyCredentials,
         ...(signal ? { signal } : {}),
         ...(provider.stealth ? { stealth: provider.stealth } : {}),
@@ -482,13 +483,7 @@ function createProviderContext(provider, request, operationId, options, state =
                 },
             }
             : {}),
-        trace: traceConfig
-            ? createTraceContext(resolveServerTraceContextOptions(traceConfig, {
-                request_id: request.requestId,
-                provider_id: provider.id,
-                operation_id: operationId,
-            }))
-            : createTraceContext(),
+        trace: scope.trace,
         auth: createAuthStub(),
         ocr: options.ocr ?? createOcrClientFromEnv(provider.ocr),
         stt: options.stt ?? createSttClientFromEnv(provider.stt),
@@ -558,7 +553,7 @@ export function resolveAuthFlowProxyAffinityKey(provider, request) {
         request.providerId ??
         provider.id);
 }
-function createAuthFlowContext(provider, request, options, state, proxyTelemetry, signal) {
+function createAuthFlowContext(provider, request, options, state, scope, signal) {
     const baseUrl = getProviderBaseUrl(provider);
     const stealthBaseUrl = getProviderStealthBaseUrl(provider);
     const stealthProfile = getProviderStealthProfile(provider);
@@ -569,14 +564,14 @@ function createAuthFlowContext(provider, request, options, state, proxyTelemetry
     const proxyClientOptions = {
         upstream: { proxy: provider.proxy },
         affinityKey: resolveAuthFlowProxyAffinityKey(provider, request),
-        telemetry: proxyTelemetry,
+        telemetry: scope.proxyTelemetry,
         engineCredentials: engineProxyCredentials,
     };
     const resolverIdentityScope = resolveProviderResolverIdentityScope(provider, proxyClientOptions.affinityKey, request.requestId);
     const stealthClientOptions = {
         upstream: proxyClientOptions.upstream,
         affinityKey: proxyClientOptions.affinityKey,
-        telemetry: proxyTelemetry,
+        telemetry: scope.proxyTelemetry,
         engineCredentials: engineProxyCredentials,
         ...(signal ? { signal } : {}),
         ...(provider.stealth ? { stealth: provider.stealth } : {}),
@@ -592,63 +587,65 @@ function createAuthFlowContext(provider, request, options, state, proxyTelemetry
         })
         : undefined;
     const cache = createProviderCache({ providerId: provider.id });
+    const context = wrapWithInstrumentation({
+        flowId: request.flowId,
+        connectionId: resolveOperationConnectionId(request),
+        externalRef: request.externalRef,
+        tenantId: request.tenantId ?? "",
+        providerId: request.providerId ?? provider.id,
+        trace: scope.trace,
+        http: createHttpClient(baseUrl, {
+            ...proxyClientOptions,
+            ...(signal ? { signal } : {}),
+        }),
+        state: state.forConnection(resolveOperationConnectionId(request)),
+        stealth: stealthBaseUrl
+            ? capabilityModules.stealth
+                ? capabilityModules.stealth.createStealthClient(stealthBaseUrl, stealthClientOptions)
+                : createLazyStealthClient(logStealthCleanupError, stealthBaseUrl, stealthClientOptions)
+            : createStealthStub(),
+        ...(provider.native
+            ? {
+                native: {
+                    network: capabilityModules.nativeNetwork.createNativeNetworkClient({
+                        egress: provider.native.network,
+                        proxyPolicy: resolveNativeProxyPolicy(provider),
+                        affinityKey: proxyClientOptions.affinityKey,
+                        credentials: capabilityModules.nativeNetwork.createEnvVendorCredentialResolver(createEnvContext([...ENGINE_OWNED_PROXY_CREDENTIAL_ENV_NAMES])),
+                    }),
+                },
+            }
+            : {}),
+        env: createEnvContext([
+            ...providerSecretNames(provider),
+            ...(provider.auth?.mode === "oauth2_proxied" ? ["APIFUSE__AUTH_PROXY__URL"] : []),
+        ]),
+        credential,
+        context: flowContextStore.context,
+        ocr: options.ocr ?? createOcrClientFromEnv(provider.ocr),
+        stt: options.stt ?? createSttClientFromEnv(provider.stt),
+        resolver: capabilityModules.resolver
+            ? capabilityModules.resolver.bindResolverSignal(options.resolver ??
+                capabilityModules.resolver.createResolverClientFromEnv(provider.resolver, undefined, {
+                    allowedHosts: provider.allowedHosts,
+                    cache,
+                    identityScope: resolverIdentityScope,
+                    ...(proxyPolicy
+                        ? {
+                            proxyIntent: {
+                                mode: proxyPolicy.mode,
+                                ...proxyClientOptions,
+                                ...(stealthProfile ? { userAgent: stealthProfile.userAgent } : {}),
+                            },
+                        }
+                        : {}),
+                }), signal)
+            : bindResolverSignalWithoutRuntime(options.resolver ??
+                createUnsupportedResolverClient("Provider does not declare resolver capability"), signal),
+        auth: createAuthFlowHelpers({ signal }),
+    });
     return {
-        context: {
-            flowId: request.flowId,
-            connectionId: resolveOperationConnectionId(request),
-            externalRef: request.externalRef,
-            tenantId: request.tenantId ?? "",
-            providerId: request.providerId ?? provider.id,
-            http: createHttpClient(baseUrl, {
-                ...proxyClientOptions,
-                ...(signal ? { signal } : {}),
-            }),
-            state: state.forConnection(resolveOperationConnectionId(request)),
-            stealth: stealthBaseUrl
-                ? capabilityModules.stealth
-                    ? capabilityModules.stealth.createStealthClient(stealthBaseUrl, stealthClientOptions)
-                    : createLazyStealthClient(logStealthCleanupError, stealthBaseUrl, stealthClientOptions)
-                : createStealthStub(),
-            ...(provider.native
-                ? {
-                    native: {
-                        network: capabilityModules.nativeNetwork.createNativeNetworkClient({
-                            egress: provider.native.network,
-                            proxyPolicy: resolveNativeProxyPolicy(provider),
-                            affinityKey: proxyClientOptions.affinityKey,
-                            credentials: capabilityModules.nativeNetwork.createEnvVendorCredentialResolver(createEnvContext([...ENGINE_OWNED_PROXY_CREDENTIAL_ENV_NAMES])),
-                        }),
-                    },
-                }
-                : {}),
-            env: createEnvContext([
-                ...providerSecretNames(provider),
-                ...(provider.auth?.mode === "oauth2_proxied" ? ["APIFUSE__AUTH_PROXY__URL"] : []),
-            ]),
-            credential,
-            context: flowContextStore.context,
-            ocr: options.ocr ?? createOcrClientFromEnv(provider.ocr),
-            stt: options.stt ?? createSttClientFromEnv(provider.stt),
-            resolver: capabilityModules.resolver
-                ? capabilityModules.resolver.bindResolverSignal(options.resolver ??
-                    capabilityModules.resolver.createResolverClientFromEnv(provider.resolver, undefined, {
-                        allowedHosts: provider.allowedHosts,
-                        cache,
-                        identityScope: resolverIdentityScope,
-                        ...(proxyPolicy
-                            ? {
-                                proxyIntent: {
-                                    mode: proxyPolicy.mode,
-                                    ...proxyClientOptions,
-                                    ...(stealthProfile ? { userAgent: stealthProfile.userAgent } : {}),
-                                },
-                            }
-                            : {}),
-                    }), signal)
-                : bindResolverSignalWithoutRuntime(options.resolver ??
-                    createUnsupportedResolverClient("Provider does not declare resolver capability"), signal),
-            auth: createAuthFlowHelpers({ signal }),
-        },
+        context,
         getPatch: flowContextStore.getPatch,
     };
 }
@@ -1017,7 +1014,7 @@ function providerErrorCauseChain(error) {
     }
     return frames.length > 0 ? frames : undefined;
 }
-function logProviderError(logger, provider, kind, route, requestId, error, status, cost, declaredErrorCode, proxyTelemetry, observabilityDetails) {
+function logProviderError(logger, provider, kind, route, requestId, error, status, cost, declaredErrorCode, proxyTelemetry, observabilityDetails, correlation = {}) {
     const providerCode = isProviderError(error) ? providerErrorCode(error) : undefined;
     const code = isProviderError(error)
         ? (providerCode ?? "provider_error")
@@ -1051,6 +1048,14 @@ function logProviderError(logger, provider, kind, route, requestId, error, statu
         kind,
         route,
         ...(requestId ? { requestId } : {}),
+        ...(correlation.connectionId !== undefined
+            ? { connectionId: correlation.connectionId }
+            : {}),
+        ...(correlation.flowId !== undefined ? { flowId: correlation.flowId } : {}),
+        ...(correlation.tenantId !== undefined ? { tenantId: correlation.tenantId } : {}),
+        ...(correlation.requestedProviderId !== undefined
+            ? { requestedProviderId: correlation.requestedProviderId }
+            : {}),
         status,
         ...cost,
         ...(proxy ? { proxy } : {}),
@@ -1088,7 +1093,7 @@ function logProviderCleanupError(logger, provider, kind, operationId, requestId,
         message,
     });
 }
-function logProviderSuccess(logger, provider, kind, route, requestId, status, cost, proxyTelemetry) {
+function logProviderSuccess(logger, provider, kind, route, requestId, status, cost, proxyTelemetry, correlation = {}) {
     const proxy = proxyTelemetry?.toLogPayload();
     const emit = typeof logger === "function" ? logger : defaultProviderServerLogger;
     emit({
@@ -1098,11 +1103,301 @@ function logProviderSuccess(logger, provider, kind, route, requestId, status, co
         kind,
         route,
         ...(requestId ? { requestId } : {}),
+        ...(correlation.connectionId !== undefined
+            ? { connectionId: correlation.connectionId }
+            : {}),
+        ...(correlation.flowId !== undefined ? { flowId: correlation.flowId } : {}),
+        ...(correlation.tenantId !== undefined ? { tenantId: correlation.tenantId } : {}),
+        ...(correlation.requestedProviderId !== undefined
+            ? { requestedProviderId: correlation.requestedProviderId }
+            : {}),
         status,
         ...cost,
         ...(proxy ? { proxy } : {}),
     });
 }
+const STREAM_CLEANUP_TIMEOUT_MS = 100;
+const CLIENT_CANCELLED_STATUS = 400;
+function clientCancelledError() {
+    return new ProviderError("Request stream was cancelled by the client.", {
+        code: "client_cancelled",
+        category: "client_cancelled",
+        retryable: false,
+    });
+}
+async function runBestEffortWithTimeout(cleanup) {
+    let timeout;
+    const work = Promise.resolve()
+        .then(cleanup)
+        .catch(() => undefined);
+    try {
+        await Promise.race([
+            work,
+            new Promise((resolve) => {
+                timeout = setTimeout(resolve, STREAM_CLEANUP_TIMEOUT_MS);
+            }),
+        ]);
+    }
+    finally {
+        if (timeout !== undefined)
+            clearTimeout(timeout);
+    }
+}
+function traceIdFromTraceparent(headers) {
+    const traceparent = Object.entries(headers).find(([name]) => name.toLowerCase() === "traceparent")?.[1];
+    if (!traceparent)
+        return undefined;
+    const match = /^(00)-([0-9a-f]{32})-([0-9a-f]{16})-([0-9a-f]{2})$/.exec(traceparent);
+    if (!match)
+        return undefined;
+    const traceId = match[2];
+    const parentId = match[3];
+    if (!traceId || !parentId || /^0+$/.test(traceId) || /^0+$/.test(parentId))
+        return undefined;
+    return traceId;
+}
+function requestTraceId(headers, requestId) {
+    return (traceIdFromTraceparent(headers) ??
+        (requestId
+            ? createHash("sha256").update(requestId, "utf8").digest("hex").slice(0, 32)
+            : undefined));
+}
+function createRequestScope(input) {
+    const requestCost = startRequestCost();
+    const traceConfig = resolveTraceConfigFromEnv();
+    const proxyTelemetry = new ProxyTelemetryCollector();
+    const details = {
+        route: input.route,
+        requestId: input.requestId,
+        operationId: input.operationId,
+        flowId: input.flowId,
+        headers: input.headers,
+        correlation: { ...(input.correlation ?? {}) },
+    };
+    const traceAttributes = {
+        provider_id: input.provider.id,
+        ...(input.operationId ? { operation_id: input.operationId } : {}),
+        ...(input.flowId ? { flow_id: input.flowId } : {}),
+        ...(input.requestId ? { request_id: input.requestId } : {}),
+        route: input.route,
+    };
+    const initialTraceId = requestTraceId(input.headers, input.requestId);
+    const trace = traceConfig
+        ? createTraceContext({
+            ...resolveServerTraceContextOptions(traceConfig, traceAttributes),
+            ...(initialTraceId ? { traceId: initialTraceId } : {}),
+        })
+        : createTraceContext();
+    let rootRunner = (fn) => fn();
+    let resolveRoot;
+    const rootTerminal = new Promise((resolve) => {
+        resolveRoot = resolve;
+    });
+    let streamingSetupPending = false;
+    let rootSettled = false;
+    let headersSnapshotted = false;
+    let terminalOutcome;
+    let finishedResult;
+    let abortSignal;
+    let abortListener;
+    const streamCleanups = [];
+    const terminalError = (outcome) => {
+        if (outcome.kind === "failed")
+            return outcome.error;
+        if (outcome.kind === "cancelled")
+            return clientCancelledError();
+        return undefined;
+    };
+    const root = trace.span(`request:${input.kind}:${input.route}`, async () => {
+        rootRunner = AsyncLocalStorage.snapshot();
+        const outcome = await rootTerminal;
+        const error = terminalError(outcome);
+        if (error !== undefined)
+            throw error;
+    });
+    void root.catch(() => undefined);
+    const settleRoot = () => {
+        if (!terminalOutcome || streamingSetupPending || rootSettled)
+            return;
+        rootSettled = true;
+        if (abortSignal && abortListener) {
+            abortSignal.removeEventListener("abort", abortListener);
+        }
+        resolveRoot(terminalOutcome);
+    };
+    const runCleanupEntry = (entry) => {
+        entry.promise ??= runBestEffortWithTimeout(entry.cleanup);
+        return entry.promise;
+    };
+    const cleanupStream = async () => {
+        await Promise.all(streamCleanups.map(runCleanupEntry));
+    };
+    const headerSnapshot = (error) => {
+        const providerTelemetryHeader = proxyTelemetry.toHeaderValue();
+        const declaredErrorCode = error === undefined ? undefined : input.declaredErrorCode?.(error);
+        const errorObservability = error === undefined ? undefined : errorObservabilityDetails(error, declaredErrorCode);
+        return {
+            ...(providerTelemetryHeader ? { providerTelemetryHeader } : {}),
+            ...(errorObservability ? { errorObservability } : {}),
+        };
+    };
+    const updateTraceMetadata = () => {
+        if (details.requestId)
+            traceAttributes.request_id = details.requestId;
+        if (details.operationId)
+            traceAttributes.operation_id = details.operationId;
+        if (details.flowId)
+            traceAttributes.flow_id = details.flowId;
+        traceAttributes.route = details.route;
+        const traceId = requestTraceId(details.headers, details.requestId);
+        const sanitizedAttributes = Object.fromEntries(Object.entries(sanitizeTraceAttributes(traceAttributes)).map(([key, value]) => [
+            key,
+            String(value),
+        ]));
+        updateTraceContextExportMetadata(trace, {
+            ...(traceId ? { traceId } : {}),
+            resourceAttributes: sanitizedAttributes,
+        });
+    };
+    const scope = {
+        trace,
+        proxyTelemetry,
+        enrich(enrichment) {
+            if (terminalOutcome)
+                return;
+            if (enrichment.route !== undefined)
+                details.route = enrichment.route;
+            if (enrichment.requestId !== undefined)
+                details.requestId = enrichment.requestId;
+            if (enrichment.operationId !== undefined)
+                details.operationId = enrichment.operationId;
+            if (enrichment.flowId !== undefined)
+                details.flowId = enrichment.flowId;
+            if (enrichment.headers !== undefined)
+                details.headers = enrichment.headers;
+            if (enrichment.correlation !== undefined) {
+                Object.assign(details.correlation, enrichment.correlation);
+            }
+            updateTraceMetadata();
+        },
+        run(fn) {
+            return rootRunner(fn);
+        },
+        async runStreaming(fn) {
+            streamingSetupPending = true;
+            try {
+                return await rootRunner(fn);
+            }
+            finally {
+                streamingSetupPending = false;
+                settleRoot();
+            }
+        },
+        runStreamStep(fn) {
+            return rootRunner(fn);
+        },
+        watchAbort(signal) {
+            if (terminalOutcome)
+                return;
+            abortSignal = signal;
+            abortListener = () => {
+                scope.terminalize({ kind: "cancelled", status: CLIENT_CANCELLED_STATUS });
+                void cleanupStream();
+            };
+            if (signal.aborted)
+                abortListener();
+            else
+                signal.addEventListener("abort", abortListener, { once: true });
+        },
+        registerStreamCleanup(cleanup) {
+            const entry = { cleanup };
+            streamCleanups.push(entry);
+            if (terminalOutcome)
+                void runCleanupEntry(entry);
+        },
+        cleanupStream,
+        snapshotHeaders(error) {
+            headersSnapshotted = true;
+            return headerSnapshot(error);
+        },
+        terminalize(outcome) {
+            if (finishedResult)
+                return finishedResult;
+            terminalOutcome = outcome;
+            const error = terminalError(outcome);
+            finishedResult = {};
+            try {
+                const declaredErrorCode = error === undefined ? undefined : input.declaredErrorCode?.(error);
+                const status = outcome.status ??
+                    (error === undefined ? 200 : toStatusCode(error, declaredErrorCode));
+                finishedResult = headerSnapshot(error);
+                const cost = finishRequestCost(requestCost);
+                try {
+                    if (error === undefined) {
+                        logProviderSuccess(input.logger, input.provider, input.kind, details.route, details.requestId, status, cost, proxyTelemetry, details.correlation);
+                    }
+                    else {
+                        logProviderError(input.logger, input.provider, input.kind, details.route, details.requestId, error, status, cost, declaredErrorCode, proxyTelemetry, finishedResult.errorObservability, details.correlation);
+                    }
+                }
+                catch {
+                    // Observer callbacks cannot hold the request root open or change the response.
+                }
+                if (!headersSnapshotted) {
+                    if (finishedResult.providerTelemetryHeader) {
+                        try {
+                            input.setHeader?.(PROVIDER_TELEMETRY_HEADER, finishedResult.providerTelemetryHeader);
+                        }
+                        catch {
+                            // Header observers are isolated independently from request settlement.
+                        }
+                    }
+                    if (finishedResult.errorObservability) {
+                        try {
+                            input.setHeader?.(ERROR_OBSERVABILITY_HEADER, JSON.stringify(finishedResult.errorObservability));
+                        }
+                        catch {
+                            // Header observers are isolated independently from request settlement.
+                        }
+                    }
+                }
+            }
+            finally {
+                settleRoot();
+                void cleanupStream();
+            }
+            return finishedResult;
+        },
+    };
+    return scope;
+}
+function responseWithRequestScopeHeaders(response, finished) {
+    const headers = new Headers(response.headers);
+    headers.delete(PROVIDER_TELEMETRY_HEADER);
+    if (finished.providerTelemetryHeader) {
+        headers.set(PROVIDER_TELEMETRY_HEADER, finished.providerTelemetryHeader);
+    }
+    if (finished.errorObservability) {
+        headers.set(ERROR_OBSERVABILITY_HEADER, JSON.stringify(finished.errorObservability));
+    }
+    return new Response(response.body, {
+        headers,
+        status: response.status,
+        statusText: response.statusText,
+    });
+}
+function finalizeRequestResponse(scope, response, outcome) {
+    try {
+        const error = outcome.kind === "failed" ? outcome.error : undefined;
+        const finalResponse = responseWithRequestScopeHeaders(response, scope.snapshotHeaders(error));
+        scope.terminalize(outcome);
+        return finalResponse;
+    }
+    catch (error) {
+        scope.terminalize({ kind: "failed", status: 500, error });
+        throw error;
+    }
+}
 function toJsonSuccessResponse(result, ctx) {
     if (result instanceof Response) {
         return result;
@@ -1135,45 +1430,40 @@ function isAsyncIterable(value) {
     const iterator = Reflect.get(value, Symbol.asyncIterator);
     return typeof iterator === "function";
 }
-function responseWithCleanup(response, cleanup) {
+function responseWithCleanup(response, lifecycle) {
     if (!response.body) {
-        void cleanup();
+        lifecycle.terminalize({ kind: "completed", status: response.status });
+        void lifecycle.cleanup();
         return response;
     }
     const reader = response.body.getReader();
-    let cleaned = false;
-    const runCleanup = async () => {
-        if (cleaned)
-            return;
-        cleaned = true;
-        await cleanup();
-    };
+    let cleanupReason = "request terminalized";
+    lifecycle.registerCleanup(() => lifecycle.runStep(() => reader.cancel(cleanupReason)));
     const body = new ReadableStream({
         async pull(controller) {
             try {
-                const { done, value } = await reader.read();
+                const { done, value } = await lifecycle.runStep(() => reader.read());
                 if (done) {
                     controller.close();
-                    await runCleanup();
+                    lifecycle.terminalize({ kind: "completed", status: response.status });
+                    await lifecycle.cleanup();
                     return;
                 }
                 if (value)
                     controller.enqueue(value);
             }
             catch (error) {
-                await runCleanup();
+                lifecycle.terminalize({ kind: "failed", error });
+                await lifecycle.cleanup();
                 controller.error(error);
             }
         },
         async cancel(reason) {
-            try {
-                await reader.cancel(reason);
-            }
-            finally {
-                await runCleanup();
-            }
+            cleanupReason = reason;
+            lifecycle.terminalize({ kind: "cancelled", status: CLIENT_CANCELLED_STATUS });
+            await lifecycle.cleanup();
         },
-    });
+    }, { highWaterMark: 0 });
     return new Response(body, {
         headers: response.headers,
         status: response.status,
@@ -1215,37 +1505,39 @@ function assertStreamPayloadWithinLimit(actualBytes, maxBytes, kind) {
             : "Emit smaller stream chunks or increase transport.maxChunkBytes.",
     });
 }
-function toSseResponse(operation, result, cleanup, requestId) {
+function toSseResponse(operation, result, lifecycle, requestId) {
     const encoder = new TextEncoder();
     const iterator = result[Symbol.asyncIterator]();
+    let cleanupReason;
+    lifecycle.registerCleanup(() => lifecycle.runStep(async () => {
+        await iterator.return?.(cleanupReason);
+    }));
     const transport = getSseTransport(operation);
     let done = false;
-    let cleaned = false;
-    const runCleanup = async () => {
-        if (cleaned)
-            return;
-        cleaned = true;
-        await cleanup();
-    };
     const body = new ReadableStream({
         async pull(controller) {
             try {
                 if (done) {
                     controller.close();
-                    await runCleanup();
+                    lifecycle.terminalize({ kind: "completed", status: 200 });
+                    await lifecycle.cleanup();
                     return;
                 }
-                const next = await iterator.next();
+                const next = await lifecycle.runStep(() => iterator.next());
                 if (next.done) {
                     done = true;
                     controller.close();
-                    await runCleanup();
+                    lifecycle.terminalize({ kind: "completed", status: 200 });
+                    await lifecycle.cleanup();
                     return;
                 }
-                const validated = await validateSseEvent(operation, next.value);
-                const encodedEvent = encodeSseEvent(validated);
-                const encodedBytes = encoder.encode(encodedEvent);
-                assertStreamPayloadWithinLimit(encodedBytes.byteLength, transport?.maxEventBytes, "event");
+                const encodedBytes = await lifecycle.runStep(async () => {
+                    const validated = await validateSseEvent(operation, next.value);
+                    const encodedEvent = encodeSseEvent(validated);
+                    const bytes = encoder.encode(encodedEvent);
+                    assertStreamPayloadWithinLimit(bytes.byteLength, transport?.maxEventBytes, "event");
+                    return bytes;
+                });
                 controller.enqueue(encodedBytes);
             }
             catch (error) {
@@ -1255,18 +1547,16 @@ function toSseResponse(operation, result, cleanup, requestId) {
                 }))));
                 controller.close();
                 done = true;
-                await runCleanup();
+                lifecycle.terminalize({ kind: "failed", error });
+                await lifecycle.cleanup();
             }
         },
         async cancel(reason) {
-            try {
-                await iterator.return?.(reason);
-            }
-            finally {
-                await runCleanup();
-            }
+            cleanupReason = reason;
+            lifecycle.terminalize({ kind: "cancelled", status: CLIENT_CANCELLED_STATUS });
+            await lifecycle.cleanup();
         },
-    });
+    }, { highWaterMark: 0 });
     return new Response(body, {
         headers: {
             "Cache-Control": "no-cache, no-transform",
@@ -1301,10 +1591,9 @@ function enforceStreamChunkLimit(body, maxChunkBytes) {
         },
     });
 }
-function toStreamingResponse(operation, result, cleanup, requestId) {
+function toStreamingResponse(operation, result, lifecycle, requestId) {
     const transport = operation.transport?.kind ?? "json";
     if (transport === "sse" && (result instanceof Response || result instanceof ReadableStream)) {
-        void cleanup();
         throw new ProviderError("SSE operations must return an AsyncIterable of typed stream.event(...) values.", {
             code: "SSE_RESULT_UNSUPPORTED",
             category: "output_validation",
@@ -1319,9 +1608,9 @@ function toStreamingResponse(operation, result, cleanup, requestId) {
                 headers: result.headers,
                 status: result.status,
                 statusText: result.statusText,
-            }), cleanup);
+            }), lifecycle);
         }
-        return responseWithCleanup(result, cleanup);
+        return responseWithCleanup(result, lifecycle);
     }
     if (result instanceof ReadableStream) {
         const httpTransport = getHttpStreamTransport(operation);
@@ -1336,12 +1625,11 @@ function toStreamingResponse(operation, result, cleanup, requestId) {
                         ? (operation.transport.contentType ?? "application/octet-stream")
                         : "application/octet-stream",
                 },
-        }), cleanup);
+        }), lifecycle);
     }
     if (transport === "sse" && isAsyncIterable(result)) {
-        return toSseResponse(operation, result, cleanup, requestId);
+        return toSseResponse(operation, result, lifecycle, requestId);
     }
-    void cleanup();
     throw new ProviderError(`Streaming operation returned unsupported result for transport "${transport}"`, {
         code: "STREAM_RESULT_UNSUPPORTED",
         fix: "Return an AsyncIterable of stream.event(...) values, a ReadableStream, or a Response from streaming operations.",
@@ -1419,8 +1707,8 @@ function withAuthRequestHeaders(request, headers) {
         },
     };
 }
-async function handleOperation(provider, request, operationId, options, state = createUnsupportedProviderRuntimeState(), proxyTelemetry, signal) {
-    const ctx = createProviderContext(provider, request, operationId, options, state, proxyTelemetry, signal);
+async function handleOperation(provider, request, operationId, options, state = createUnsupportedProviderRuntimeState(), scope, signal) {
+    const ctx = createProviderContext(provider, request, operationId, options, state, scope, signal);
     const operation = provider.operations[operationId];
     const streaming = operation?.transport?.kind && operation.transport.kind !== "json";
     let cleanupCalled = false;
@@ -1445,6 +1733,21 @@ async function handleOperation(provider, request, operationId, options, state =
             }
         }
     };
+    const streamLifecycle = {
+        runStep(fn) {
+            return scope.runStreamStep(fn);
+        },
+        registerCleanup(streamCleanup) {
+            scope.registerStreamCleanup(streamCleanup);
+        },
+        terminalize(outcome) {
+            scope.terminalize(outcome);
+        },
+        cleanup() {
+            return scope.cleanupStream();
+        },
+    };
+    scope.registerStreamCleanup(() => scope.runStreamStep(cleanup));
     try {
         const result = options.operationExecutor
             ? await options.operationExecutor({
@@ -1458,7 +1761,7 @@ async function handleOperation(provider, request, operationId, options, state =
                 env: createEnvContext(providerSecretNames(provider)),
             });
         if (streaming && operation) {
-            return toStreamingResponse(operation, result, cleanup, request.requestId);
+            return toStreamingResponse(operation, result, streamLifecycle, request.requestId);
         }
         return toJsonSuccessResponse(result, ctx);
     }
@@ -1471,19 +1774,7 @@ async function handleOperation(provider, request, operationId, options, state =
             await cleanup();
     }
 }
-function responseWithProviderTelemetry(response, proxyTelemetry) {
-    const headerValue = proxyTelemetry?.toHeaderValue();
-    const headers = new Headers(response.headers);
-    headers.delete(PROVIDER_TELEMETRY_HEADER);
-    if (headerValue)
-        headers.set(PROVIDER_TELEMETRY_HEADER, headerValue);
-    return new Response(response.body, {
-        headers,
-        status: response.status,
-        statusText: response.statusText,
-    });
-}
-async function handleAuthFlow(provider, request, route, options, state, proxyTelemetry, signal) {
+async function handleAuthFlow(provider, request, route, options, state, scope, signal) {
     const flow = provider.auth?.flow;
     if (!flow) {
         throw new ProviderError("Auth flow is not configured", {
@@ -1495,7 +1786,7 @@ async function handleAuthFlow(provider, request, route, options, state, proxyTel
     // any flow code runs instead of at whatever point the ceremony first reads
     // the env. `abort` stays exempt: a user must always be able to cancel a
     // stranded flow even when provisioning is broken.
-    const { context, getPatch } = createAuthFlowContext(provider, request, options, state, proxyTelemetry, signal);
+    const { context, getPatch } = createAuthFlowContext(provider, request, options, state, scope, signal);
     try {
         if (route !== "abort") {
             assertRequiredSecretsPresent(provider, context.env);
@@ -1723,7 +2014,15 @@ function createServerAppWithCapabilityModules(provider, serverOptions, capabilit
         let rawBody;
         let operationId;
         const operation = "stateful-internal";
-        const requestCost = startRequestCost();
+        const requestScope = createRequestScope({
+            provider,
+            kind: "operation",
+            route: operation,
+            headers: Object.fromEntries(c.req.raw.headers.entries()),
+            logger,
+            setHeader: (name, value) => c.header(name, value),
+            declaredErrorCode: (error) => declaredErrorCodeFor(error, operationId, operationErrorCodes),
+        });
         try {
             if (!options.internalOperationExecutor) {
                 throw new ProviderError("Stateful internal operation executor is not configured.", {
@@ -1808,20 +2107,32 @@ function createServerAppWithCapabilityModules(provider, serverOptions, capabilit
             }
             const request = operationRequestFromForwardingEnvelope(envelope);
             operationId = envelope.operationId;
-            const ctx = createProviderContext(provider, request, operationId, options, state, undefined, signal);
-            if (deadlineAtMs !== undefined && deadlineAtMs <= Date.now()) {
-                throw new StatefulRoutingDeadlineError(envelope.requestId, envelope.deadlineAt);
-            }
-            const output = await options.internalOperationExecutor({
-                provider,
+            requestScope.enrich({
+                route: operationId,
+                requestId: request.requestId,
                 operationId,
-                ctx,
-                request,
-                internalStatefulForward: envelope,
-                signal,
+                headers: request.headers ?? {},
+                correlation: { connectionId: envelope.connectionId },
+            });
+            const response = await requestScope.run(async () => {
+                const ctx = createProviderContext(provider, request, operationId, options, state, requestScope, signal);
+                if (deadlineAtMs !== undefined && deadlineAtMs <= Date.now()) {
+                    throw new StatefulRoutingDeadlineError(envelope.requestId, envelope.deadlineAt);
+                }
+                const output = await options.internalOperationExecutor({
+                    provider,
+                    operationId: operationId,
+                    ctx,
+                    request,
+                    internalStatefulForward: envelope,
+                    signal,
+                });
+                return c.json({ data: output });
+            });
+            return finalizeRequestResponse(requestScope, response, {
+                kind: "completed",
+                status: 200,
             });
-            logProviderSuccess(logger, provider, "operation", operationId || operation, request.requestId, 200, finishRequestCost(requestCost));
-            return c.json({ data: output });
         }
         catch (error) {
             const declaredErrorCode = declaredErrorCodeFor(error, operationId, operationErrorCodes);
@@ -1831,16 +2142,32 @@ function createServerAppWithCapabilityModules(provider, serverOptions, capabilit
                 c.header("Retry-After", String(STATEFUL_FORWARDING_REPLAY_RETRY_AFTER_SECONDS));
             }
             const requestId = extractRequestId(rawBody);
+            requestScope.enrich({
+                ...(operationId ? { route: operationId, operationId } : {}),
+                ...(requestId ? { requestId } : {}),
+            });
             const observabilityDetails = errorObservabilityDetails(error, declaredErrorCode);
-            logProviderError(logger, provider, "operation", operationId || operation, requestId, error, status, finishRequestCost(requestCost), declaredErrorCode, undefined, observabilityDetails);
-            return responseWithErrorObservability(c.json(toErrorResponse(error, requestId, observabilityDetails), status), observabilityDetails);
+            const response = c.json(toErrorResponse(error, requestId, observabilityDetails), status);
+            return finalizeRequestResponse(requestScope, response, {
+                kind: "failed",
+                status,
+                error,
+            });
         }
     });
     app.post("/v1/:operation", async (c) => {
         let rawBody;
         const operation = c.req.param("operation");
-        const proxyTelemetry = new ProxyTelemetryCollector();
-        const requestCost = startRequestCost();
+        const requestScope = createRequestScope({
+            provider,
+            kind: "operation",
+            route: operation,
+            operationId: operation,
+            headers: Object.fromEntries(c.req.raw.headers.entries()),
+            logger,
+            setHeader: (name, value) => c.header(name, value),
+            declaredErrorCode: (error) => declaredErrorCodeFor(error, operation, operationErrorCodes),
+        });
         try {
             rawBody = await c.req.raw
                 .clone()
@@ -1849,179 +2176,107 @@ function createServerAppWithCapabilityModules(provider, serverOptions, capabilit
             const body = OperationRequestSchema.parse(rawBody);
             const requestHeaders = Object.fromEntries(c.req.raw.headers.entries());
             body.headers = { ...requestHeaders, ...body.headers };
-            const response = await handleOperation(provider, body, operation, options, state, proxyTelemetry, c.req.raw.signal);
-            if (response instanceof Response) {
-                logProviderSuccess(logger, provider, "operation", operation, body.requestId, response.status, finishRequestCost(requestCost), proxyTelemetry);
-                return responseWithProviderTelemetry(response, proxyTelemetry);
-            }
-            const telemetryHeader = proxyTelemetry.toHeaderValue();
-            if (telemetryHeader)
-                c.header(PROVIDER_TELEMETRY_HEADER, telemetryHeader);
-            logProviderSuccess(logger, provider, "operation", operation, body.requestId, 200, finishRequestCost(requestCost), proxyTelemetry);
-            return c.json(response);
+            requestScope.enrich({
+                requestId: body.requestId,
+                headers: body.headers,
+                correlation: { connectionId: resolveOperationConnectionId(body) },
+            });
+            const streaming = provider.operations[operation]?.transport?.kind
+                ? provider.operations[operation]?.transport?.kind !== "json"
+                : false;
+            if (streaming)
+                requestScope.watchAbort(c.req.raw.signal);
+            const execute = async () => {
+                const handled = await handleOperation(provider, body, operation, options, state, requestScope, c.req.raw.signal);
+                const response = handled instanceof Response ? handled : c.json(handled);
+                return streaming
+                    ? responseWithRequestScopeHeaders(response, requestScope.snapshotHeaders())
+                    : response;
+            };
+            const response = streaming
+                ? await requestScope.runStreaming(execute)
+                : await requestScope.run(execute);
+            if (streaming)
+                return response;
+            return finalizeRequestResponse(requestScope, response, {
+                kind: "completed",
+                status: response.status,
+            });
         }
         catch (error) {
             const declaredErrorCode = declaredErrorCodeFor(error, operation, operationErrorCodes);
             const status = toStatusCode(error, declaredErrorCode);
             const requestId = extractRequestId(rawBody);
+            requestScope.enrich({ ...(requestId ? { requestId } : {}) });
             const observabilityDetails = errorObservabilityDetails(error, declaredErrorCode);
-            logProviderError(logger, provider, "operation", operation, requestId, error, status, finishRequestCost(requestCost), declaredErrorCode, proxyTelemetry, observabilityDetails);
-            const telemetryHeader = proxyTelemetry.toHeaderValue();
-            if (telemetryHeader)
-                c.header(PROVIDER_TELEMETRY_HEADER, telemetryHeader);
-            return responseWithErrorObservability(c.json(toErrorResponse(error, requestId, observabilityDetails), status), observabilityDetails);
-        }
-    });
-    app.post("/auth/start", async (c) => {
-        let rawBody;
-        const proxyTelemetry = new ProxyTelemetryCollector();
-        const requestCost = startRequestCost();
-        try {
-            rawBody = await c.req.raw
-                .clone()
-                .json()
-                .catch(() => undefined);
-            const body = withAuthRequestHeaders(AuthFlowRequestSchema.parse(rawBody), c.req.raw.headers);
-            const response = await handleAuthFlow(provider, body, "start", options, state, proxyTelemetry, c.req.raw.signal);
-            logProviderSuccess(logger, provider, "auth", "start", body.requestId, response instanceof Response ? response.status : 200, finishRequestCost(requestCost), proxyTelemetry);
-            if (response instanceof Response)
-                return responseWithProviderTelemetry(response, proxyTelemetry);
-            const telemetryHeader = proxyTelemetry.toHeaderValue();
-            if (telemetryHeader)
-                c.header(PROVIDER_TELEMETRY_HEADER, telemetryHeader);
-            return c.json(response);
-        }
-        catch (error) {
-            const status = toStatusCode(error);
-            const requestId = extractRequestId(rawBody);
-            const observabilityDetails = errorObservabilityDetails(error);
-            logProviderError(logger, provider, "auth", "start", requestId, error, status, finishRequestCost(requestCost), undefined, proxyTelemetry, observabilityDetails);
-            const telemetryHeader = proxyTelemetry.toHeaderValue();
-            if (telemetryHeader)
-                c.header(PROVIDER_TELEMETRY_HEADER, telemetryHeader);
-            return responseWithErrorObservability(c.json(toErrorResponse(error, requestId, observabilityDetails), status), observabilityDetails);
-        }
-    });
-    app.post("/auth/continue", async (c) => {
-        let rawBody;
-        const proxyTelemetry = new ProxyTelemetryCollector();
-        const requestCost = startRequestCost();
-        try {
-            rawBody = await c.req.raw
-                .clone()
-                .json()
-                .catch(() => undefined);
-            const body = withAuthRequestHeaders(AuthFlowRequestSchema.parse(rawBody), c.req.raw.headers);
-            const response = await handleAuthFlow(provider, body, "continue", options, state, proxyTelemetry, c.req.raw.signal);
-            logProviderSuccess(logger, provider, "auth", "continue", body.requestId, response instanceof Response ? response.status : 200, finishRequestCost(requestCost), proxyTelemetry);
-            if (response instanceof Response)
-                return responseWithProviderTelemetry(response, proxyTelemetry);
-            const telemetryHeader = proxyTelemetry.toHeaderValue();
-            if (telemetryHeader)
-                c.header(PROVIDER_TELEMETRY_HEADER, telemetryHeader);
-            return c.json(response);
-        }
-        catch (error) {
-            const status = toStatusCode(error);
-            const requestId = extractRequestId(rawBody);
-            const observabilityDetails = errorObservabilityDetails(error);
-            logProviderError(logger, provider, "auth", "continue", requestId, error, status, finishRequestCost(requestCost), undefined, proxyTelemetry, observabilityDetails);
-            const telemetryHeader = proxyTelemetry.toHeaderValue();
-            if (telemetryHeader)
-                c.header(PROVIDER_TELEMETRY_HEADER, telemetryHeader);
-            return responseWithErrorObservability(c.json(toErrorResponse(error, requestId, observabilityDetails), status), observabilityDetails);
-        }
-    });
-    app.post("/auth/poll", async (c) => {
-        let rawBody;
-        const proxyTelemetry = new ProxyTelemetryCollector();
-        const requestCost = startRequestCost();
-        try {
-            rawBody = await c.req.raw
-                .clone()
-                .json()
-                .catch(() => undefined);
-            const body = withAuthRequestHeaders(AuthFlowRequestSchema.parse(rawBody), c.req.raw.headers);
-            const response = await handleAuthFlow(provider, body, "poll", options, state, proxyTelemetry, c.req.raw.signal);
-            logProviderSuccess(logger, provider, "auth", "poll", body.requestId, response instanceof Response ? response.status : 200, finishRequestCost(requestCost), proxyTelemetry);
-            if (response instanceof Response)
-                return responseWithProviderTelemetry(response, proxyTelemetry);
-            const telemetryHeader = proxyTelemetry.toHeaderValue();
-            if (telemetryHeader)
-                c.header(PROVIDER_TELEMETRY_HEADER, telemetryHeader);
-            return c.json(response);
-        }
-        catch (error) {
-            const status = toStatusCode(error);
-            const requestId = extractRequestId(rawBody);
-            const observabilityDetails = errorObservabilityDetails(error);
-            logProviderError(logger, provider, "auth", "poll", requestId, error, status, finishRequestCost(requestCost), undefined, proxyTelemetry, observabilityDetails);
-            const telemetryHeader = proxyTelemetry.toHeaderValue();
-            if (telemetryHeader)
-                c.header(PROVIDER_TELEMETRY_HEADER, telemetryHeader);
-            return responseWithErrorObservability(c.json(toErrorResponse(error, requestId, observabilityDetails), status), observabilityDetails);
-        }
-    });
-    app.post("/auth/refresh", async (c) => {
-        let rawBody;
-        const proxyTelemetry = new ProxyTelemetryCollector();
-        const requestCost = startRequestCost();
-        try {
-            rawBody = await c.req.raw
-                .clone()
-                .json()
-                .catch(() => undefined);
-            const body = withAuthRequestHeaders(AuthFlowRequestSchema.parse(rawBody), c.req.raw.headers);
-            const response = await handleAuthFlow(provider, body, "refresh", options, state, proxyTelemetry, c.req.raw.signal);
-            logProviderSuccess(logger, provider, "auth", "refresh", body.requestId, response instanceof Response ? response.status : 200, finishRequestCost(requestCost), proxyTelemetry);
-            if (response instanceof Response)
-                return responseWithProviderTelemetry(response, proxyTelemetry);
-            const telemetryHeader = proxyTelemetry.toHeaderValue();
-            if (telemetryHeader)
-                c.header(PROVIDER_TELEMETRY_HEADER, telemetryHeader);
-            return c.json(response);
-        }
-        catch (error) {
-            const status = toStatusCode(error);
-            const requestId = extractRequestId(rawBody);
-            const observabilityDetails = errorObservabilityDetails(error);
-            logProviderError(logger, provider, "auth", "refresh", requestId, error, status, finishRequestCost(requestCost), undefined, proxyTelemetry, observabilityDetails);
-            const telemetryHeader = proxyTelemetry.toHeaderValue();
-            if (telemetryHeader)
-                c.header(PROVIDER_TELEMETRY_HEADER, telemetryHeader);
-            return responseWithErrorObservability(c.json(toErrorResponse(error, requestId, observabilityDetails), status), observabilityDetails);
-        }
-    });
-    app.post("/auth/disconnect", async (c) => {
-        let rawBody;
-        const proxyTelemetry = new ProxyTelemetryCollector();
-        const requestCost = startRequestCost();
-        try {
-            rawBody = await c.req.raw
-                .clone()
-                .json()
-                .catch(() => undefined);
-            const body = withAuthRequestHeaders(AuthFlowRequestSchema.parse(rawBody), c.req.raw.headers);
-            const response = await handleAuthFlow(provider, body, "abort", options, state, proxyTelemetry, c.req.raw.signal);
-            logProviderSuccess(logger, provider, "auth", "disconnect", body.requestId, response instanceof Response ? response.status : 200, finishRequestCost(requestCost), proxyTelemetry);
-            if (response instanceof Response)
-                return responseWithProviderTelemetry(response, proxyTelemetry);
-            const telemetryHeader = proxyTelemetry.toHeaderValue();
-            if (telemetryHeader)
-                c.header(PROVIDER_TELEMETRY_HEADER, telemetryHeader);
-            return c.json(response);
-        }
-        catch (error) {
-            const status = toStatusCode(error);
-            const requestId = extractRequestId(rawBody);
-            const observabilityDetails = errorObservabilityDetails(error);
-            logProviderError(logger, provider, "auth", "disconnect", requestId, error, status, finishRequestCost(requestCost), undefined, proxyTelemetry, observabilityDetails);
-            const telemetryHeader = proxyTelemetry.toHeaderValue();
-            if (telemetryHeader)
-                c.header(PROVIDER_TELEMETRY_HEADER, telemetryHeader);
-            return responseWithErrorObservability(c.json(toErrorResponse(error, requestId, observabilityDetails), status), observabilityDetails);
+            const response = c.json(toErrorResponse(error, requestId, observabilityDetails), status);
+            return finalizeRequestResponse(requestScope, response, {
+                kind: "failed",
+                status,
+                error,
+            });
         }
     });
+    const authRoutes = [
+        { path: "/auth/start", flowRoute: "start", logRoute: "start" },
+        { path: "/auth/continue", flowRoute: "continue", logRoute: "continue" },
+        { path: "/auth/poll", flowRoute: "poll", logRoute: "poll" },
+        { path: "/auth/refresh", flowRoute: "refresh", logRoute: "refresh" },
+        { path: "/auth/disconnect", flowRoute: "abort", logRoute: "disconnect" },
+    ];
+    for (const { path, flowRoute, logRoute } of authRoutes) {
+        app.post(path, async (c) => {
+            let rawBody;
+            const requestScope = createRequestScope({
+                provider,
+                kind: "auth",
+                route: logRoute,
+                headers: Object.fromEntries(c.req.raw.headers.entries()),
+                logger,
+                setHeader: (name, value) => c.header(name, value),
+            });
+            try {
+                rawBody = await c.req.raw
+                    .clone()
+                    .json()
+                    .catch(() => undefined);
+                const body = withAuthRequestHeaders(AuthFlowRequestSchema.parse(rawBody), c.req.raw.headers);
+                requestScope.enrich({
+                    requestId: body.requestId,
+                    flowId: body.flowId,
+                    headers: body.headers ?? {},
+                    correlation: {
+                        connectionId: resolveOperationConnectionId(body),
+                        flowId: body.flowId,
+                        tenantId: body.tenantId,
+                        requestedProviderId: body.providerId !== undefined && body.providerId !== provider.id
+                            ? body.providerId
+                            : undefined,
+                    },
+                });
+                const response = await requestScope.run(async () => {
+                    const handled = await handleAuthFlow(provider, body, flowRoute, options, state, requestScope, c.req.raw.signal);
+                    return handled instanceof Response ? handled : c.json(handled);
+                });
+                return finalizeRequestResponse(requestScope, response, {
+                    kind: "completed",
+                    status: response.status,
+                });
+            }
+            catch (error) {
+                const status = toStatusCode(error);
+                const requestId = extractRequestId(rawBody);
+                requestScope.enrich({ ...(requestId ? { requestId } : {}) });
+                const observabilityDetails = errorObservabilityDetails(error);
+                const response = c.json(toErrorResponse(error, requestId, observabilityDetails), status);
+                return finalizeRequestResponse(requestScope, response, {
+                    kind: "failed",
+                    status,
+                    error,
+                });
+            }
+        });
+    }
     return app;
 }
 function validateStatefulServerConfig(options) {