@apifuse/provider-sdk 2.2.0-beta.58 → 2.2.0-beta.60

package/src/runtime/stt.ts

@@ -1,3 +1,4 @@
+import { readDiagnosticEnv } from "./diagnostic-env.js";
 import { ProviderError, TransportError, ValidationError } from "../errors.js";
 import type {
 	Bcp47Locale,
@@ -69,7 +70,7 @@ export function createUnsupportedSttClient(reason?: string): SttContext {
 }
 
 function normalizedEnvValue(env: EnvLike, key: string): string | undefined {
-	const value = env[key]?.trim();
+	const value = readDiagnosticEnv(key, env)?.trim();
 	return value ? value : undefined;
 }
 
@@ -99,7 +100,7 @@ export function createSttClientFromEnv(
 	}
 
 	const accountId = env.APIFUSE__CLOUDFLARE__ACCOUNT_ID?.trim();
-	const apiToken = env.APIFUSE__STT__CLOUDFLARE_API_TOKEN?.trim();
+	const apiToken = readDiagnosticEnv(APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV, env)?.trim();
 	if (!accountId || !apiToken) {
 		return createUnsupportedSttClient(
 			`STT backend ${backend} requires ${CLOUDFLARE_ACCOUNT_ID_ENV} and ${APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV}`,

package/src/runtime/trace.ts

@@ -1,12 +1,25 @@
 import { AsyncLocalStorage } from "node:async_hooks";
-
+import { sanitizeSpanNameForOutput } from "../trace-sanitization.js";
 import type {
 	TraceContext as BaseTraceContext,
 	TraceAttributeValue,
 	TraceConfig,
 	TraceSpan,
 } from "../types.js";
+import {
+	type DiagnosticRedactor,
+	diagnosticStructuredRedactor,
+	redactDiagnosticAttributeKey,
+	copyDiagnosticAttributeTypes,
+	redactedKeyAllocator,
+	isRedactedKey,
+	redactCriticalDiagnosticText,
+	diagnosticAttributeRedactor,
+	REDACTION_FAILED,
+	redactDiagnosticText,
+} from "./diagnostic-redactor.js";
 import { exportSpansOTLP, type OTLPExportOptions } from "./otlp.js";
+import { REDACTED_QUERY_VALUE } from "./request-options.js";
 
 export type SpanAttributeValue = TraceAttributeValue;
 
@@ -19,6 +32,8 @@ export interface TraceContext extends BaseTraceContext {
 export interface CreateTraceContextOptions {
 	maxSpans?: number;
 	onSpan?: (span: Span) => void;
+	/** Redacts diagnostic attribute values and errors before recording or calling onSpan. */
+	redact?: DiagnosticRedactor;
 	exportOptions?: OTLPExportOptions;
 	resourceAttributes?: Record<string, string>;
 	/** W3C-compatible 32-character lowercase hexadecimal trace id used for export. */
@@ -42,7 +57,7 @@ type PendingSpan = {
 	startedAt: number;
 	parentId?: string;
 	sequence: number;
-	attributes: Record<string, SpanAttributeValue>;
+	attributes: Record<string, SpanAttributeValue | bigint>;
 };
 
 type CompletedSpanEntry = {
@@ -52,14 +67,22 @@ type CompletedSpanEntry = {
 	exported: boolean;
 };
 
+const TRACE_RESOURCE_ATTRIBUTE_SANITIZER = Symbol.for(
+	"@apifuse/provider-sdk/runtime/trace-resource-attribute-sanitizer",
+);
+
+type ResourceAttributesWithSanitizer = Record<string, string> & {
+	[TRACE_RESOURCE_ATTRIBUTE_SANITIZER]?: (
+		attributes: Record<string, string>,
+	) => Record<string, string>;
+};
+
 export interface TraceRecorder {
 	runSpan<T>(name: string, fn: () => Promise<T> | T, options?: SpanHookOptions<T>): Promise<T>;
 }
 
 export const TRACE_RECORDER = Symbol.for("@apifuse/provider-sdk/runtime/trace-recorder");
-const TRACE_EXPORT_METADATA = Symbol.for(
-	"@apifuse/provider-sdk/runtime/trace-export-metadata",
-);
+const TRACE_EXPORT_METADATA = Symbol.for("@apifuse/provider-sdk/runtime/trace-export-metadata");
 
 type TraceExportMetadata = {
 	update(input: { traceId?: string; resourceAttributes?: Record<string, string> }): void;
@@ -109,30 +132,104 @@ export function resolveTraceContextOptions(config?: TraceConfig): CreateTraceCon
 	};
 }
 
-function normalizeAttributeValue(value: unknown): SpanAttributeValue | undefined {
-	if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
-		return value;
+function normalizeAttributeValue(
+	value: unknown,
+	redact?: DiagnosticRedactor,
+	retainBigints = false,
+): SpanAttributeValue | bigint | undefined {
+	if (typeof value === "number" || typeof value === "boolean") {
+		// Typed columns are contracts: unlike string tokens, number/boolean/bigint
+		// values only consult the registry at >=8 characters in string form.
+		const text = String(value);
+		if (text.length < 8) return value;
+		const redacted = redactDiagnosticText(text, diagnosticStructuredRedactor(redact));
+		return redacted === text ? value : redacted;
+	}
+	if (typeof value === "bigint") {
+		// Bigints are not valid OTLP attribute primitives, so retain their prior
+		// string normalization while still checking their diagnostic form.
+		const text = String(value);
+		if (text.length < 8) return retainBigints ? value : text;
+		const redacted = redactDiagnosticText(text, diagnosticStructuredRedactor(redact));
+		return retainBigints && redacted === text ? value : redacted;
 	}
 
 	if (value === null || value === undefined) {
 		return undefined;
 	}
 
-	return String(value);
+	return redactDiagnosticText(String(value), redact);
 }
 
+function normalizeAttributes(
+	attributes: Record<string, unknown> | undefined,
+	redact: DiagnosticRedactor | undefined,
+	retainBigints: true,
+): Record<string, SpanAttributeValue | bigint>;
+function normalizeAttributes(
+	attributes?: Record<string, unknown>,
+	redact?: DiagnosticRedactor,
+): Record<string, SpanAttributeValue>;
 function normalizeAttributes(
 	attributes?: Record<string, unknown>,
-): Record<string, SpanAttributeValue> {
+	redact?: DiagnosticRedactor,
+	retainBigints = false,
+): Record<string, SpanAttributeValue | bigint> {
 	if (!attributes) {
 		return {};
 	}
 
+	const nextKey = redactedKeyAllocator(Object.keys(attributes));
 	const normalizedEntries = Object.entries(attributes)
-		.map(([key, value]) => [key, normalizeAttributeValue(value)] as const)
-		.filter((entry): entry is readonly [string, SpanAttributeValue] => entry[1] !== undefined);
+		.map(([key, value]) => {
+			const redactedKey = isRedactedKey(key) ? key : redactDiagnosticAttributeKey(key, redact);
+			const keyChanged = redactedKey !== key;
+			const normalizedKey = keyChanged ? nextKey() : key;
+			// Once a key changes, its original sensitivity classification is no
+			// longer available to later output sanitizers. Suppress the value here.
+			const normalizedValue = keyChanged
+				? redactedKey === REDACTION_FAILED
+					? REDACTION_FAILED
+					: REDACTED_QUERY_VALUE
+				: normalizeAttributeValue(value, diagnosticAttributeRedactor(key, redact), retainBigints);
+			return [normalizedKey, normalizedValue] as const;
+		})
+		.filter(
+			(entry): entry is readonly [string, SpanAttributeValue | bigint] => entry[1] !== undefined,
+		);
+
+	return copyDiagnosticAttributeTypes(attributes, Object.fromEntries(normalizedEntries));
+}
 
-	return Object.fromEntries(normalizedEntries);
+function prepareResourceAttributesForExport(
+	attributes: Record<string, string> | undefined,
+	redact?: DiagnosticRedactor,
+	sanitize?: (attributes: Record<string, string>) => Record<string, string>,
+): Record<string, string> | undefined {
+	if (!attributes) return undefined;
+	if (sanitize) {
+		const sanitized = sanitize({ ...attributes });
+		if (!sanitized || typeof sanitized !== "object") {
+			throw new Error("resource attribute sanitizer returned no attributes");
+		}
+		return sanitized;
+	}
+	const nextKey = redactedKeyAllocator(Object.keys(attributes));
+	return Object.fromEntries(
+		Object.entries(attributes).map(([key, value]) => {
+			const redactedKey = isRedactedKey(key) ? key : redactDiagnosticAttributeKey(key, redact);
+			const keyChanged = redactedKey !== key;
+			const sanitizedKey = keyChanged ? nextKey() : sanitizeSpanNameForOutput(key);
+			return [
+				sanitizedKey,
+				keyChanged
+					? redactedKey === REDACTION_FAILED
+						? REDACTION_FAILED
+						: REDACTED_QUERY_VALUE
+					: sanitizeSpanNameForOutput(value, diagnosticAttributeRedactor(key, redact)),
+			];
+		}),
+	);
 }
 
 function insertCompletedSpan(
@@ -158,7 +255,10 @@ function prepareSpanForExport(
 	span: Span,
 	sanitize: CreateTraceContextOptions["sanitizeSpanForExport"],
 ): Span {
-	const copy: Span = { ...span, attributes: { ...span.attributes } };
+	const copy: Span = {
+		...span,
+		attributes: copyDiagnosticAttributeTypes(span.attributes, { ...span.attributes }),
+	};
 	if (!sanitize) return copy;
 	const sanitized = sanitize(copy);
 	if (!sanitized || typeof sanitized !== "object") {
@@ -171,6 +271,25 @@ export function getTraceRecorder(trace: BaseTraceContext): TraceRecorder | null
 	return (trace as Partial<InternalTraceContext>)[TRACE_RECORDER] ?? null;
 }
 
+const droppedOTLPSpans = new Map<string, number>();
+
+/** Internal, read-only process counters; no reset can re-arm a warning. */
+export function getDroppedOTLPSpanCount(reason: string): number {
+	return droppedOTLPSpans.get(reason) ?? 0;
+}
+
+function warnDroppedOTLPSpans(reason: string, count: number): void {
+	const previous = getDroppedOTLPSpanCount(reason);
+	const total = previous + count;
+	droppedOTLPSpans.set(reason, total);
+	if (previous !== 0) return;
+	try {
+		console.warn(`[apifuse] OTLP export skipped; reason=${reason}; dropped_spans=${total}`);
+	} catch {
+		// Warning sinks are best-effort. The counter/latch survives a failed sink.
+	}
+}
+
 export function createTraceContext(options: CreateTraceContextOptions = {}): TraceContext {
 	if (options.traceId !== undefined) assertValidTraceId(options.traceId);
 	const maxSpans = options.maxSpans ?? 1000;
@@ -180,9 +299,14 @@ export function createTraceContext(options: CreateTraceContextOptions = {}): Tra
 	// Export configuration (which can carry collector credentials) stays in this closure;
 	// the context object handed to provider code never exposes it.
 	const exportOptions = options.exportOptions;
-	const exportResourceAttributes = options.resourceAttributes
-		? { ...options.resourceAttributes }
+	const resourceAttributeOptions = options.resourceAttributes as
+		| ResourceAttributesWithSanitizer
+		| undefined;
+	const exportResourceAttributes = resourceAttributeOptions
+		? { ...resourceAttributeOptions }
 		: undefined;
+	const exportResourceAttributeSanitizer =
+		resourceAttributeOptions?.[TRACE_RESOURCE_ATTRIBUTE_SANITIZER];
 	// One trace id per context so every export batch of this request shares it and
 	// two processes can never mint the same id.
 	let exportTraceId = options.traceId ?? crypto.randomUUID().replace(/-/g, "");
@@ -203,15 +327,30 @@ export function createTraceContext(options: CreateTraceContextOptions = {}): Tra
 			if (pending.length === 0) return;
 			// Sanitization runs off the request path; a faulty sanitizer drops the batch, never the request.
 			let spans: Span[];
+			let resourceAttributes: Record<string, string> | undefined;
 			try {
 				spans = pending.map((entry) =>
 					prepareSpanForExport(entry.span, options.sanitizeSpanForExport),
 				);
+				resourceAttributes = prepareResourceAttributesForExport(
+					exportResourceAttributes,
+					options.redact,
+					exportResourceAttributeSanitizer,
+				);
 			} catch {
-				console.warn("[apifuse] OTLP export skipped; span sanitization failed.");
+				try {
+					console.warn("[apifuse] OTLP export skipped; span sanitization failed.");
+				} catch {
+					// A broken diagnostic sink must not escape this detached callback.
+				}
+				return;
+			}
+			// A matching trace ID cannot be replaced with non-hex text on the wire. Emit less.
+			if (redactCriticalDiagnosticText(exportTraceId, options.redact) !== exportTraceId) {
+				warnDroppedOTLPSpans("unverifiable_trace_id", pending.length);
 				return;
 			}
-			void exportSpansOTLP(spans, exportOptions, exportResourceAttributes, exportTraceId);
+			void exportSpansOTLP(spans, exportOptions, resourceAttributes, exportTraceId);
 		});
 	};
 
@@ -219,11 +358,11 @@ export function createTraceContext(options: CreateTraceContextOptions = {}): Tra
 		async runSpan(name, fn, spanOptions = {}) {
 			const pendingSpan: PendingSpan = {
 				id: crypto.randomUUID(),
-				name,
+				name: redactCriticalDiagnosticText(name, options.redact),
 				startedAt: Date.now(),
 				parentId: activeSpanStorage.getStore()?.id,
 				sequence: sequence++,
-				attributes: normalizeAttributes(spanOptions.attributes),
+				attributes: normalizeAttributes(spanOptions.attributes, options.redact, true),
 			};
 
 			const finalize = (
@@ -235,7 +374,7 @@ export function createTraceContext(options: CreateTraceContextOptions = {}): Tra
 				const duration = endedAt - pendingSpan.startedAt;
 				const attributes = {
 					...pendingSpan.attributes,
-					...normalizeAttributes(extraAttributes),
+					...extraAttributes,
 				};
 
 				if (attributes.duration_ms === undefined) {
@@ -243,15 +382,18 @@ export function createTraceContext(options: CreateTraceContextOptions = {}): Tra
 				}
 
 				const span: Span = {
-					id: pendingSpan.id,
-					name: pendingSpan.name,
+					id: redactCriticalDiagnosticText(pendingSpan.id, options.redact),
+					// Recheck at recording: harvest and live env reads may follow span start.
+					name: redactCriticalDiagnosticText(pendingSpan.name, options.redact),
 					startedAt: pendingSpan.startedAt,
 					endedAt,
 					duration_ms: duration,
 					status,
-					attributes,
-					...(error ? { error } : {}),
-					...(pendingSpan.parentId ? { parentId: pendingSpan.parentId } : {}),
+					attributes: normalizeAttributes(attributes, options.redact),
+					...(error ? { error: redactDiagnosticText(error, options.redact) } : {}),
+					...(pendingSpan.parentId
+						? { parentId: redactCriticalDiagnosticText(pendingSpan.parentId, options.redact) }
+						: {}),
 				};
 
 				insertCompletedSpan(

package/src/schema.ts

@@ -83,6 +83,8 @@ export function safeParseSchemaSync(
 export const APIFUSE_SENSITIVE_META_KEY = "x-apifuse-sensitive";
 export const APIFUSE_SENSITIVE_KIND_META_KEY = "x-apifuse-sensitive-kind";
 export const APIFUSE_DESCRIPTION_KEY_META_KEY = "x-apifuse-description-key";
+export const APIFUSE_CONTENT_TRUST_META_KEY = "x-apifuse-content-trust";
+export const APIFUSE_CONTENT_PROVENANCE_META_KEY = "x-apifuse-content-provenance";
 export const APIFUSE_REDACTION_MARKER = "<redacted>";
 
 export type SensitivePathSegment = string | "*";
@@ -103,6 +105,8 @@ export type SensitiveFieldKind =
 export interface SensitiveFieldOptions {
 	/**
 	 * Mark this schema as sensitive. Defaults to true for the helper presets.
+	 * An explicit `false` emits `x-apifuse-sensitive: false` (reviewed public
+	 * data, never redacted) and drops any sensitivity kind.
 	 */
 	sensitive?: boolean;
 	/**
@@ -127,6 +131,21 @@ export function describeKey<TSchema extends ZodType>(
 	});
 }
 
+/**
+ * Mark an output field as externally authored text (listing bodies, reviews,
+ * posts) that the provider relays verbatim. Sets both content-trust JSON Schema
+ * meta keys on the field node so the platform can enforce the boundary when it
+ * assembles tool output; validation and the parsed value are unchanged.
+ */
+export function untrustedContent<TSchema extends ZodType>(schema: TSchema): TSchema {
+	const metadata = schema.meta() ?? {};
+	return schema.meta({
+		...metadata,
+		[APIFUSE_CONTENT_TRUST_META_KEY]: "untrusted",
+		[APIFUSE_CONTENT_PROVENANCE_META_KEY]: "external",
+	});
+}
+
 declare module "zod" {
 	interface ZodType {
 		describeKey(key: ProviderLocaleKey | string): this;
@@ -191,10 +210,27 @@ export function field<TSchema extends ZodType>(
 			? schema.describe(options.description)
 			: schema;
 	const metadata = described.meta() ?? {};
+	const isSensitive = options.sensitive ?? true;
+	// A public declaration only rewrites the meta of the node it receives;
+	// z.toJSONSchema folds that over the inner leaf, so `false` on a wrapper
+	// around a sensitive() leaf would publish `false` next to the leaf's kind
+	// while collectSensitivePaths() still redacts. Refuse the contradiction.
+	if (!isSensitive && wrapsSensitiveDeclaration(described)) {
+		throw new TypeError(
+			"publicField()/field({ sensitive: false }) wraps a sensitive() declaration; apply it to the leaf, before .optional(), .nullable(), .default(), .pipe(), z.lazy() or similar wrappers.",
+		);
+	}
+	// Zod merges meta with the parent chain, so an inherited kind can only be
+	// cleared by writing undefined over it (dropped from JSON Schema output).
+	const kind = isSensitive
+		? (options.kind ?? Reflect.get(metadata, APIFUSE_SENSITIVE_KIND_META_KEY))
+		: undefined;
 	return described.meta({
 		...metadata,
-		...((options.sensitive ?? true) ? { [APIFUSE_SENSITIVE_META_KEY]: true } : {}),
-		...(options.kind ? { [APIFUSE_SENSITIVE_KIND_META_KEY]: options.kind } : {}),
+		[APIFUSE_SENSITIVE_META_KEY]: isSensitive,
+		...(kind !== undefined || APIFUSE_SENSITIVE_KIND_META_KEY in metadata
+			? { [APIFUSE_SENSITIVE_KIND_META_KEY]: kind }
+			: {}),
 	});
 }
 
@@ -205,6 +241,18 @@ export function sensitive<TSchema extends ZodType>(
 	return field(schema, { sensitive: true, kind });
 }
 
+/**
+ * Declare a field as reviewed public data (business, facility, product, or
+ * place names and contacts) so a key-based privacy classifier hit counts as
+ * declared instead of undeclared. Emits `x-apifuse-sensitive: false` on the
+ * JSON Schema leaf; nothing is redacted. Use `sensitive()` for anything that
+ * identifies a person. Apply it to the leaf, before `.optional()` or
+ * `.nullable()`; wrapping a `sensitive()` declaration throws at definition time.
+ */
+export function publicField<TSchema extends ZodType>(schema: TSchema): TSchema {
+	return field(schema, { sensitive: false });
+}
+
 function sensitiveString(
 	kind: SensitiveFieldKind,
 	description: string,
@@ -365,6 +413,36 @@ function readZodMetadata(schema: unknown): object | undefined {
 	return metadata && typeof metadata === "object" ? metadata : undefined;
 }
 
+// Same-path wrappers (optional, nullable, default, catch, readonly, pipe,
+// lazy, ...) share the JSON Schema leaf with the schema they wrap.
+function wrapsSensitiveDeclaration(schema: unknown, seen = new Set<unknown>()): boolean {
+	const def = readZodDef(schema);
+	if (!def || seen.has(schema)) return false;
+	seen.add(schema);
+	return sameLeafChildren(def).some(
+		(child) => isSensitiveSchema(child) || wrapsSensitiveDeclaration(child, seen),
+	);
+}
+
+function sameLeafChildren(def: object): unknown[] {
+	switch (Reflect.get(def, "type")) {
+		case "pipe":
+			return [Reflect.get(def, "in"), Reflect.get(def, "out")];
+		case "lazy": {
+			// A forward-reference getter can throw before its target is
+			// initialised; treat that as no declaration rather than failing.
+			const getter = Reflect.get(def, "getter");
+			try {
+				return typeof getter === "function" ? [getter()] : [];
+			} catch {
+				return [];
+			}
+		}
+		default:
+			return [Reflect.get(def, "innerType")];
+	}
+}
+
 function readZodDef(schema: unknown): object | undefined {
 	if (!schema || typeof schema !== "object") return undefined;
 	const def = Reflect.get(schema, "def") ?? Reflect.get(schema, "_def");

package/src/server/index.ts

@@ -23,6 +23,27 @@ export {
 	type TelemetryKey,
 	type TenantNeutral,
 } from "../runtime/request-telemetry.js";
+export {
+	ResolverTelemetryCollector,
+	type ResolverAttemptSample,
+	type ResolverCacheReadTelemetryEvent,
+	type ResolverCacheWriteTelemetryEvent,
+	type ResolverFailoverTelemetryEvent,
+	type ResolverIdentityTelemetryEvent,
+	type ResolverOutcomeTelemetryEvent,
+	type ResolverTelemetryAttemptOutcome,
+	type ResolverTelemetryCacheStatus,
+	type ResolverTelemetryCacheWriteReason,
+	type ResolverTelemetryErrorClass,
+	type ResolverTelemetryHeaderPayload,
+	type ResolverTelemetryIdentitySource,
+	type ResolverTelemetryLogPayload,
+	type ResolverTelemetryOutcome,
+	type ResolverTelemetryPhase,
+	type ResolverTelemetrySink,
+	type ResolverVendorAttemptTelemetryEvent,
+} from "../runtime/resolver-telemetry.js";
+export type { ResolverVendorUnavailableReason } from "../runtime/resolver-vendors/types.js";
 export type { Span, TraceContext } from "../runtime/trace.js";
 export {
 	createServerApp,

package/src/server/self-test-redaction.ts

@@ -1,8 +1,8 @@
 import type { ProviderDefinition } from "../types.js";
 import {
-	PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_ENV,
-	PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_PREVIOUS_ENV,
-} from "./self-test-token.js";
+	collectDiagnosticSensitiveValues,
+	SELF_TEST_SENSITIVE_SOURCE_KINDS,
+} from "./sensitive-values.js";
 
 export const SELF_TEST_REDACTED_PLACEHOLDER = "[REDACTED]";
 
@@ -31,39 +31,12 @@ export function collectSelfTestSensitiveValues(
 		credentialInputs?: Readonly<Record<string, string>>;
 	} = {},
 ): string[] {
-	const env = options.env ?? process.env;
-	const envNames = new Set<string>([
-		PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_ENV,
-		PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_PREVIOUS_ENV,
-	]);
-	for (const secret of provider.secrets ?? []) {
-		envNames.add(secret.name);
-	}
-	const healthProbe = provider.healthProbe ?? provider.healthMonitor;
-	for (const name of healthProbe?.requiredSecrets ?? []) {
-		envNames.add(name);
-	}
-	for (const name of Object.values(healthProbe?.credentialInputs ?? {})) {
-		envNames.add(name);
-	}
-
-	const values = new Set<string>();
-	for (const name of envNames) {
-		const value = env[name];
-		if (typeof value === "string" && value.length >= MIN_SENSITIVE_VALUE_LENGTH) {
-			values.add(value);
-		}
-	}
-	for (const value of Object.values(options.credentialInputs ?? {})) {
-		if (value.length >= MIN_SENSITIVE_VALUE_LENGTH) {
-			values.add(value);
-		}
-	}
-	return [...values];
-}
-
-function escapeRegExp(value: string): string {
-	return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+	return collectDiagnosticSensitiveValues(provider, {
+		...options,
+		sourceKinds: SELF_TEST_SENSITIVE_SOURCE_KINDS,
+		minimumLength: MIN_SENSITIVE_VALUE_LENGTH,
+		includeResolvedEnvVariants: false,
+	});
 }
 
 /**
@@ -79,10 +52,7 @@ export function redactSelfTestText(
 	let redacted = text;
 	for (const value of sensitiveValues) {
 		if (value.length < MIN_SENSITIVE_VALUE_LENGTH) continue;
-		redacted = redacted.replace(
-			new RegExp(escapeRegExp(value), "g"),
-			SELF_TEST_REDACTED_PLACEHOLDER,
-		);
+		redacted = redacted.replaceAll(value, SELF_TEST_REDACTED_PLACEHOLDER);
 	}
 	for (const pattern of HEADER_SHAPED_SECRETS) {
 		redacted = redacted.replace(

package/src/server/self-test.ts

@@ -117,6 +117,8 @@ export type SelfTestAuthFlowInvoke = (args: {
 	externalRef?: string;
 	input?: Record<string, unknown>;
 	context?: Record<string, unknown>;
+	/** Opaque engine state from the previous turn (`engine` in the auth response), sent verbatim. */
+	engine?: { egressLease: string };
 	signal?: AbortSignal;
 }) => Promise<{
 	status: number;
@@ -343,6 +345,7 @@ export function createSelfTestAuthFlowInvoke(app: {
 		externalRef,
 		input,
 		context,
+		engine,
 		signal,
 	}) => {
 		const response = await app.request(`/auth/${route}`, {
@@ -351,10 +354,14 @@ export function createSelfTestAuthFlowInvoke(app: {
 			body: JSON.stringify({
 				requestId,
 				flowId,
+				// Engine ceremony leases are scoped to a tenant; the self-test has no
+				// customer tenant, so it presents a fixed one that never collides.
+				tenantId: "self-test",
 				...(connectionId ? { connectionId } : {}),
 				...(externalRef ? { externalRef } : {}),
 				...(input ? { input } : {}),
 				...(context ? { context } : {}),
+				...(engine ? { engine } : {}),
 			}),
 			...(signal ? { signal } : {}),
 		});
@@ -550,6 +557,7 @@ type ParsedAuthFlowTurn =
 			ok: true;
 			turn: { kind: string; data?: unknown; expectedInput?: unknown };
 			contextPatch?: Record<string, unknown>;
+			engine?: { egressLease: string };
 	  }
 	| { ok: false; code: string; message: string; httpStatus: number };
 
@@ -578,6 +586,7 @@ function parseAuthFlowResponse(result: { status: number; body: unknown }): Parse
 		};
 	}
 	const contextPatch = objectProperty(result.body, "contextPatch");
+	const egressLease = objectProperty(objectProperty(result.body, "engine"), "egressLease");
 	return {
 		ok: true,
 		turn: {
@@ -588,6 +597,7 @@ function parseAuthFlowResponse(result: { status: number; body: unknown }): Parse
 		...(contextPatch && typeof contextPatch === "object" && !Array.isArray(contextPatch)
 			? { contextPatch: contextPatch as Record<string, unknown> }
 			: {}),
+		...(typeof egressLease === "string" && egressLease ? { engine: { egressLease } } : {}),
 	};
 }
 
@@ -777,6 +787,9 @@ async function materializeFlowCredential(
 				...(options.externalRef ? { externalRef: options.externalRef } : {}),
 				input: submitInputs,
 				...(Object.keys(flowContext).length > 0 ? { context: flowContext } : {}),
+				// The ceremony egress lease is engine state, not flow context: carry it the
+				// way the gateway does so the continue turn stays on the start turn's egress.
+				...(started.engine ? { engine: started.engine } : {}),
 				...(options.signal ? { signal: options.signal } : {}),
 			}),
 		);