@apifuse/provider-sdk 2.2.0-beta.58 → 2.2.0-beta.60

package/src/server/serve-implementation.ts

@@ -1,5 +1,7 @@
-import { createHash } from "node:crypto";
+import { STATUS_CODES } from "node:http";
+import { readDiagnosticEnv, withDiagnosticEnv } from "../runtime/diagnostic-env.js";
 import { AsyncLocalStorage } from "node:async_hooks";
+import { createHash } from "node:crypto";
 import { existsSync } from "node:fs";
 import { createRequire } from "node:module";
 import { join } from "node:path";
@@ -8,15 +10,15 @@ import { Hono } from "hono";
 import { z } from "zod";
 import { AuthAbortError, createAuthFlowHelpers } from "../auth.js";
 import { validateFailClosedDeclaration } from "../declaration-validation.js";
-import { safeProviderErrorObservability } from "../error-observability.js";
 import {
 	createInProcessProviderEngine,
 	ENGINE_OWNED_PROXY_CREDENTIAL_ENV_NAMES,
 	isEngineOwnedEnvName,
-	readEngineProxyCredentials,
 	type ProviderEngine,
 	type ProviderEngineBindingCandidates,
+	readEngineProxyCredentials,
 } from "../engine.js";
+import { safeProviderErrorObservability } from "../error-observability.js";
 import {
 	SDK_OWNED_PROVIDER_ERROR_CODES,
 	SDK_RUNTIME_OWNED_ERROR_CODES,
@@ -29,6 +31,7 @@ import {
 	isTransportError,
 	isValidationError,
 	ProviderError,
+	SDKError,
 	type ProviderErrorObservability,
 	type ProviderErrorOptions,
 } from "../errors.js";
@@ -41,11 +44,11 @@ import {
 import type { ProviderLocale } from "../i18n/keys.js";
 import {
 	categoryForStatus,
-	type ProviderErrorSource,
-	sourceForCategory,
 	isRetryableCategory,
 	PROVIDER_OBSERVABILITY_TAXONOMY_VERSION,
 	type ProviderErrorCategory,
+	type ProviderErrorSource,
+	sourceForCategory,
 } from "../observability.js";
 import { createScratchpad } from "../runtime/auth-flow.js";
 import type * as BrowserRuntimeModule from "../runtime/browser.js";
@@ -55,13 +58,30 @@ import {
 	PROVIDER_RUNTIME_CHOICE_TOKEN_MASTER_SECRET_ENV,
 } from "../runtime/choice.js";
 import { createCredentialContext } from "../runtime/credential.js";
+import {
+	bindDiagnosticSensitiveRegistry,
+	type CompiledDiagnosticSensitiveValues,
+	compileProcessDiagnosticSensitiveValues,
+	createDiagnosticRedactor,
+	type DiagnosticRedactor,
+	REDACTION_FAILED,
+	isDiagnosticRedactionSuppressed,
+	bindCriticalDiagnosticRedactor,
+	redactCriticalDiagnosticText,
+	redactDiagnosticText,
+	registerDiagnosticSensitiveValues,
+} from "../runtime/diagnostic-redactor.js";
+import {
+	createCeremonyEgressLeaseRuntime,
+	ENGINE_CEREMONY_EGRESS_LEASE,
+} from "../runtime/egress-lease.js";
 import { createEnvContext } from "../runtime/env.js";
 import { executeOperation } from "../runtime/executor.js";
 import { createHttpClient } from "../runtime/http.js";
 import { wrapWithInstrumentation } from "../runtime/instrumentation.js";
 import type * as NativeNetworkRuntimeModule from "../runtime/native-network.js";
-import { getProviderBaseUrl } from "../runtime/provider.js";
 import { createOcrClientFromEnv } from "../runtime/ocr.js";
+import { getProviderBaseUrl } from "../runtime/provider.js";
 import {
 	PROXY_AUTH_IP_DENIED_CODE,
 	PROXY_EDGE_AUTH_REJECTED_CODE,
@@ -73,18 +93,24 @@ import {
 	type ProxyTelemetryLogPayload,
 } from "../runtime/proxy-telemetry.js";
 import {
+	type ClosedEnum,
 	closedEnum,
 	RequestTelemetry,
-	tenantOpaqueKeys,
-	type ClosedEnum,
 	type TenantNeutral,
 	type TenantOpaqueKeys,
+	tenantOpaqueKeys,
 } from "../runtime/request-telemetry.js";
 import type * as ResolverRuntimeModule from "../runtime/resolver.js";
 import {
+	bindResolverTelemetry,
 	createUnsupportedResolverClient,
+	inheritResolverTelemetryBinding,
 	type ResolverSolveWithRecorder,
 } from "../runtime/resolver-shared.js";
+import {
+	ResolverTelemetryCollector,
+	type ResolverTelemetryLogPayload,
+} from "../runtime/resolver-telemetry.js";
 import {
 	assertRequiredSecretsPresent,
 	listMissingRequiredSecrets,
@@ -94,32 +120,34 @@ import {
 	createProviderRuntimeStateFromEnv,
 	createUnsupportedProviderRuntimeState,
 } from "../runtime/state.js";
-import { StealthCookieJar } from "../runtime/stealth-cookies.js";
 import type * as StealthRuntimeModule from "../runtime/stealth.js";
+import type { StealthChallengeRuntime } from "../runtime/stealth-akamai-sbsd.js";
+import { StealthCookieJar } from "../runtime/stealth-cookies.js";
 import { createSttClientFromEnv } from "../runtime/stt.js";
 import {
 	createTraceContext,
+	getTraceRecorder,
 	type TraceContext as RuntimeTraceContext,
 	type TraceRecorder,
 	updateTraceContextExportMetadata,
 } from "../runtime/trace.js";
 import { resolveTraceConfigFromEnv } from "../runtime/trace-config.js";
 import { parseSchema } from "../schema.js";
+import { StatefulRoutingDeadlineError } from "../stateful/errors.js";
 import {
 	STATEFUL_NONCE_HEADER as STATEFUL_FORWARDING_NONCE_HEADER,
 	STATEFUL_SIGNATURE_HEADER as STATEFUL_FORWARDING_SIGNATURE_HEADER,
 	STATEFUL_TIMESTAMP_HEADER as STATEFUL_FORWARDING_TIMESTAMP_HEADER,
 	verifyStatefulRequestSignature,
 } from "../stateful-signing.js";
-import { StatefulRoutingDeadlineError } from "../stateful/errors.js";
 import { getStealthProfile } from "../stealth/profiles.js";
-import { sanitizeTraceAttributes } from "../trace-sanitization.js";
 import {
 	APIFUSE_STREAM_DONE_EVENT,
 	APIFUSE_STREAM_ERROR_EVENT,
 	encodeSseEvent,
 	error as streamError,
 } from "../stream.js";
+import { sanitizeSpanNameForOutput, sanitizeTraceAttributes } from "../trace-sanitization.js";
 import type {
 	AuthContext,
 	AuthTurn,
@@ -127,15 +155,15 @@ import type {
 	FlowContext,
 	FlowContextStore,
 	HttpRetrySummary,
+	OcrContext,
 	OperationDefinition,
 	OperationErrorCode,
 	OperationHttpStreamTransport,
 	OperationSseTransport,
-	OcrContext,
-	ProviderErrorStatus,
-	ProviderContext,
 	ProviderCacheResponseMeta,
+	ProviderContext,
 	ProviderDefinition,
+	ProviderErrorStatus,
 	ProviderFilesContext,
 	ProviderProxyPolicy,
 	ProviderRuntimeState,
@@ -149,6 +177,10 @@ import type {
 import { VALID_OPERATION_ERROR_STATUSES } from "../types.js";
 import type { SelfTestCancellationLogEvent } from "./self-test.js";
 import { resolveSelfTestMasterSecrets } from "./self-test-token.js";
+import {
+	collectStaticDiagnosticSensitiveValues,
+	createDiagnosticEnvObserver,
+} from "./sensitive-values.js";
 import { resolveServerTraceContextOptions } from "./trace-output.js";
 import {
 	type AuthFlowRequest,
@@ -294,9 +326,7 @@ export type ProviderServerOperationExecutorInput<
 
 export type ProviderServerOperationExecutor<
 	TContext extends Partial<ProviderContext> = ProviderContext,
-> = (
-	input: ProviderServerOperationExecutorInput<TContext>,
-) => Promise<unknown>;
+> = (input: ProviderServerOperationExecutorInput<TContext>) => Promise<unknown>;
 
 type RequestTerminalOutcome =
 	| { kind: "completed"; status: number }
@@ -304,6 +334,7 @@ type RequestTerminalOutcome =
 	| { kind: "cancelled"; status?: number };
 
 type RequestStreamLifecycle = {
+	redact: DiagnosticRedactor;
 	runStep<T>(fn: () => Promise<T>): Promise<T>;
 	registerCleanup(cleanup: () => void | Promise<void>): void;
 	terminalize(outcome: RequestTerminalOutcome): void;
@@ -513,6 +544,9 @@ function createLazyStealthClient(
 				async fetch(...args) {
 					return (await getSession()).fetch(...args);
 				},
+				async replayChallenged(...args) {
+					return (await getSession()).replayChallenged(...args);
+				},
 				redirects: {
 					async run(...args) {
 						return (await getSession()).redirects.run(...args);
@@ -553,7 +587,7 @@ function bindResolverSignalWithoutRuntime(
 	defaultSignal: AbortSignal | undefined,
 ): ResolverContext {
 	if (!defaultSignal) return resolver;
-	return {
+	const boundResolver: ResolverContext = {
 		solve(challenge, signal = defaultSignal, traceRecorder?: TraceRecorder) {
 			// Forward the instrumentation trace recorder so resolver.vendor.* spans
 			// survive this wrapper. See ResolverSolveWithRecorder in resolver-shared.ts.
@@ -564,6 +598,8 @@ function bindResolverSignalWithoutRuntime(
 			);
 		},
 	};
+	inheritResolverTelemetryBinding(resolver, boundResolver);
+	return boundResolver;
 }
 
 function getProviderStealthBaseUrl(provider: ProviderDefinition): string | undefined {
@@ -579,6 +615,99 @@ function getProviderStealthProfile(provider: ProviderDefinition) {
 	return provider.stealth ? getStealthProfile(provider.stealth) : undefined;
 }
 
+type ResolverRuntimeOptions = ResolverRuntimeModule.ResolverRuntimeOptions;
+
+/** One option set for ctx.resolver and the automatic SBSD solve, so both share identity scope, cache, proxy intent, and telemetry. */
+function createResolverRuntimeOptions(
+	provider: ProviderDefinition,
+	cache: ReturnType<typeof createProviderCache>,
+	identityScope: string,
+	proxyPolicy: ProviderProxyPolicy | undefined,
+	proxyClientOptions: Omit<
+		NonNullable<ResolverRuntimeOptions["proxyIntent"]>,
+		"mode" | "userAgent"
+	>,
+	stealthProfile: { readonly userAgent: string } | undefined,
+	telemetry: ResolverTelemetryCollector,
+): ResolverRuntimeOptions {
+	return {
+		allowedHosts: provider.allowedHosts,
+		cache,
+		telemetry,
+		identityScope,
+		...(proxyPolicy
+			? {
+					proxyIntent: {
+						mode: proxyPolicy.mode,
+						...proxyClientOptions,
+						...(stealthProfile ? { userAgent: stealthProfile.userAgent } : {}),
+					},
+				}
+			: {}),
+	};
+}
+
+/** Shared predicate for the SBSD challenge runtime and the ceremony egress lease. */
+function declaresAkamaiSbsdResolver(provider: ProviderDefinition): boolean {
+	return provider.resolver?.kinds.some((kind) => kind === "akamai_sbsd") === true;
+}
+
+function createStealthChallengeDetection(
+	provider: ProviderDefinition,
+	resolverRuntime: typeof ResolverRuntimeModule | undefined,
+	resolverOverride: ResolverContext | undefined,
+	resolverOptions: ResolverRuntimeOptions,
+	trace: RuntimeTraceContext,
+	signal: AbortSignal | undefined,
+): StealthChallengeRuntime | undefined {
+	const resolverDeclared = declaresAkamaiSbsdResolver(provider);
+	const detectOnly = provider.stealth?.challengeDetection?.akamaiSbsd === true;
+	if (!resolverDeclared && !detectOnly) {
+		return undefined;
+	}
+	return {
+		akamaiSbsd: {
+			allowedHosts: provider.allowedHosts ?? [],
+			// The profile belongs to the SBSD resolver; a resolver declared for other kinds
+			// may name a different browser without affecting detect-only classification.
+			...(resolverDeclared && provider.resolver?.clientProfile
+				? { clientProfile: provider.resolver.clientProfile }
+				: {}),
+			...(resolverDeclared && resolverRuntime
+				? {
+						async solve(challenge, transport, solveSignal) {
+							const resolver = resolverRuntime.bindResolverSignal(
+								(resolverOverride
+									? bindResolverTelemetry(resolverOverride, resolverOptions.telemetry)
+									: undefined) ??
+									resolverRuntime.createResolverClientFromEnv(provider.resolver, undefined, {
+										allowedHosts: resolverOptions.allowedHosts,
+										cache: resolverOptions.cache,
+										telemetry: resolverOptions.telemetry,
+										identityScope: resolverOptions.identityScope,
+										// No proxyIntent: the transport is already bound to the initiating
+										// request's lease, and a second identity resolution would allocate
+										// again (and fail closed without allocator credentials) for nothing
+										// the SBSD adapters consume.
+										createTransport: () => transport,
+									}),
+								signal,
+							) as ResolverContext & Partial<ResolverSolveWithRecorder>;
+							// Same span and recorder threading as the instrumented ctx.resolver.solve.
+							const recorder = getTraceRecorder(trace);
+							const solve = () => resolver.solve(challenge, solveSignal, recorder ?? undefined);
+							return recorder
+								? recorder.runSpan("resolver.solve", solve, {
+										attributes: { challenge_kind: challenge.kind },
+									})
+								: solve();
+						},
+					}
+				: {}),
+		},
+	};
+}
+
 function isProductionProviderBrowserMode(provider: ProviderDefinition, env = process.env): boolean {
 	if (provider.runtime !== "browser") {
 		return false;
@@ -712,8 +841,10 @@ function providerSecretNames(provider: ProviderDefinition): string[] {
 }
 
 type RequestScopeContext = {
+	redact: DiagnosticRedactor;
 	trace: RuntimeTraceContext;
 	telemetry: RequestTelemetry;
+	resolverTelemetry: ResolverTelemetryCollector;
 };
 
 function createProviderContext(
@@ -741,16 +872,43 @@ function createProviderContext(
 		proxyClientOptions.affinityKey,
 		request.requestId,
 	);
+	const cache = createProviderCache({ providerId: provider.id });
 	let wrappedContext: ProviderContext | undefined;
+	const { capabilityModules } = options;
+	const resolverOptions = createResolverRuntimeOptions(
+		provider,
+		cache,
+		resolverIdentityScope,
+		proxyPolicy,
+		proxyClientOptions,
+		stealthProfile,
+		scope.resolverTelemetry,
+	);
+	const challengeRuntime = createStealthChallengeDetection(
+		provider,
+		capabilityModules.resolver,
+		options.resolver,
+		resolverOptions,
+		scope.trace,
+		signal,
+	);
 	const stealthClientOptions = {
 		upstream: proxyClientOptions.upstream,
 		affinityKey: proxyClientOptions.affinityKey,
 		telemetry: scope.telemetry.proxy,
 		engineCredentials: engineProxyCredentials,
 		...(signal ? { signal } : {}),
-		...(provider.stealth ? { stealth: provider.stealth } : {}),
+		// A declared resolver without a `stealth` block still gets the default Chrome client
+		// (auth FlowContext is not capability-gated), so the runtime must ride along.
+		...(provider.stealth || challengeRuntime
+			? {
+					stealth: {
+						...(provider.stealth ?? {}),
+						...(challengeRuntime ? { challengeRuntime } : {}),
+					},
+				}
+			: {}),
 	};
-	const { capabilityModules } = options;
 	const logStealthCleanupError = (error: unknown) =>
 		logProviderCleanupError(
 			options.logger,
@@ -760,6 +918,7 @@ function createProviderContext(
 			request.requestId,
 			"stealth",
 			error,
+			scope.redact,
 		);
 
 	const env = createEnvContext([
@@ -777,7 +936,6 @@ function createProviderContext(
 		headers: request.headers ?? {},
 	};
 	const requestState = state.forConnection(requestContext.connectionId);
-	const cache = createProviderCache({ providerId: provider.id });
 	const bindings: ProviderEngineBindingCandidates = {
 		env,
 		credential,
@@ -802,7 +960,7 @@ function createProviderContext(
 			provider.runtime === "browser"
 				? capabilityModules.browser!.createBrowserClient({
 						allowedHosts: provider.allowedHosts,
-						cdpUrl: process.env.APIFUSE__CDP_POOL__URL,
+						cdpUrl: readDiagnosticEnv("APIFUSE__CDP_POOL__URL"),
 						headless: true,
 						requireCdpPool: isProductionProviderBrowserMode(provider),
 						stealth: true,
@@ -829,25 +987,20 @@ function createProviderContext(
 		stt: options.stt ?? createSttClientFromEnv(provider.stt),
 		resolver: capabilityModules.resolver
 			? capabilityModules.resolver.bindResolverSignal(
-					options.resolver ??
-						capabilityModules.resolver.createResolverClientFromEnv(provider.resolver, undefined, {
-							allowedHosts: provider.allowedHosts,
-							cache,
-							identityScope: resolverIdentityScope,
-							...(proxyPolicy
-								? {
-										proxyIntent: {
-											mode: proxyPolicy.mode,
-											...proxyClientOptions,
-											...(stealthProfile ? { userAgent: stealthProfile.userAgent } : {}),
-										},
-									}
-								: {}),
-						}),
+					(options.resolver
+						? bindResolverTelemetry(options.resolver, resolverOptions.telemetry)
+						: undefined) ??
+						capabilityModules.resolver.createResolverClientFromEnv(
+							provider.resolver,
+							undefined,
+							resolverOptions,
+						),
 					signal,
 				)
 			: bindResolverSignalWithoutRuntime(
-					options.resolver ??
+					(options.resolver
+						? bindResolverTelemetry(options.resolver, resolverOptions.telemetry)
+						: undefined) ??
 						createUnsupportedResolverClient("Provider does not declare resolver capability"),
 					signal,
 				),
@@ -927,6 +1080,7 @@ export function resolveAuthFlowProxyAffinityKey(
 function createAuthFlowContext(
 	provider: ProviderDefinition,
 	request: AuthFlowRequest,
+	route: AuthRoute,
 	options: ProviderServerRuntimeOptions,
 	state: ProviderRuntimeState,
 	scope: RequestScopeContext,
@@ -934,6 +1088,7 @@ function createAuthFlowContext(
 ): {
 	context: FlowContext;
 	getPatch: () => Record<string, unknown | null> | undefined;
+	getEngineState: () => AuthFlowSuccessResponse["engine"];
 } {
 	const baseUrl = getProviderBaseUrl(provider);
 	const stealthBaseUrl = getProviderStealthBaseUrl(provider);
@@ -951,20 +1106,73 @@ function createAuthFlowContext(
 		telemetry: scope.telemetry.proxy,
 		engineCredentials: engineProxyCredentials,
 	};
+	// The lease pins the proxy egress a challenged ceremony solved on, so only providers
+	// that declare the akamai_sbsd resolver kind carry one (same predicate as the challenge
+	// runtime). `abort` never evaluates the key or tenant: a user must be able to cancel a
+	// stranded flow even when engine provisioning is broken, and an abort is not a
+	// continuation of the ceremony the lease pins.
+	const ceremonyEgressLease =
+		route !== "abort" &&
+		declaresAkamaiSbsdResolver(provider) &&
+		proxyPolicy &&
+		proxyPolicy.mode !== "disabled"
+			? createCeremonyEgressLeaseRuntime({
+					tenantId: request.tenantId,
+					providerId: provider.id,
+					flowId: request.flowId,
+					affinityKey: proxyClientOptions.affinityKey,
+					onHandle: (handle) => registerDiagnosticSensitiveValues(scope.trace, [handle]),
+					...(request.engine?.egressLease ? { handle: request.engine.egressLease } : {}),
+				})
+			: undefined;
+	if (route !== "abort" && request.engine?.egressLease && !ceremonyEgressLease) {
+		throw new SDKError(
+			"An egress lease was supplied for an auth flow that does not use a ceremony lease",
+			{ code: "EGRESS_LEASE_INVALID" },
+		);
+	}
 	const resolverIdentityScope = resolveProviderResolverIdentityScope(
 		provider,
 		proxyClientOptions.affinityKey,
 		request.requestId,
 	);
+	const cache = createProviderCache({ providerId: provider.id });
+	const { capabilityModules } = options;
+	const resolverOptions = createResolverRuntimeOptions(
+		provider,
+		cache,
+		resolverIdentityScope,
+		proxyPolicy,
+		proxyClientOptions,
+		stealthProfile,
+		scope.resolverTelemetry,
+	);
+	const challengeRuntime = createStealthChallengeDetection(
+		provider,
+		capabilityModules.resolver,
+		options.resolver,
+		resolverOptions,
+		scope.trace,
+		signal,
+	);
 	const stealthClientOptions = {
 		upstream: proxyClientOptions.upstream,
 		affinityKey: proxyClientOptions.affinityKey,
 		telemetry: scope.telemetry.proxy,
 		engineCredentials: engineProxyCredentials,
+		...(ceremonyEgressLease ? { [ENGINE_CEREMONY_EGRESS_LEASE]: ceremonyEgressLease } : {}),
 		...(signal ? { signal } : {}),
-		...(provider.stealth ? { stealth: provider.stealth } : {}),
+		// A declared resolver without a `stealth` block still gets the default Chrome client
+		// (auth FlowContext is not capability-gated), so the runtime must ride along.
+		...(provider.stealth || challengeRuntime
+			? {
+					stealth: {
+						...(provider.stealth ?? {}),
+						...(challengeRuntime ? { challengeRuntime } : {}),
+					},
+				}
+			: {}),
 	};
-	const { capabilityModules } = options;
 	const logStealthCleanupError = (error: unknown) =>
 		logProviderCleanupError(
 			options.logger,
@@ -974,6 +1182,7 @@ function createAuthFlowContext(
 			request.requestId,
 			"stealth",
 			error,
+			scope.redact,
 		);
 	const credential = request.connection
 		? createCredentialContext({
@@ -983,8 +1192,6 @@ function createAuthFlowContext(
 				values: request.connection.secrets,
 			})
 		: undefined;
-	const cache = createProviderCache({ providerId: provider.id });
-
 	const context: FlowContext = wrapWithInstrumentation({
 		flowId: request.flowId,
 		connectionId: resolveOperationConnectionId(request),
@@ -1026,25 +1233,20 @@ function createAuthFlowContext(
 		stt: options.stt ?? createSttClientFromEnv(provider.stt),
 		resolver: capabilityModules.resolver
 			? capabilityModules.resolver.bindResolverSignal(
-					options.resolver ??
-						capabilityModules.resolver.createResolverClientFromEnv(provider.resolver, undefined, {
-							allowedHosts: provider.allowedHosts,
-							cache,
-							identityScope: resolverIdentityScope,
-							...(proxyPolicy
-								? {
-										proxyIntent: {
-											mode: proxyPolicy.mode,
-											...proxyClientOptions,
-											...(stealthProfile ? { userAgent: stealthProfile.userAgent } : {}),
-										},
-									}
-								: {}),
-						}),
+					(options.resolver
+						? bindResolverTelemetry(options.resolver, resolverOptions.telemetry)
+						: undefined) ??
+						capabilityModules.resolver.createResolverClientFromEnv(
+							provider.resolver,
+							undefined,
+							resolverOptions,
+						),
 					signal,
 				)
 			: bindResolverSignalWithoutRuntime(
-					options.resolver ??
+					(options.resolver
+						? bindResolverTelemetry(options.resolver, resolverOptions.telemetry)
+						: undefined) ??
 						createUnsupportedResolverClient("Provider does not declare resolver capability"),
 					signal,
 				),
@@ -1054,6 +1256,10 @@ function createAuthFlowContext(
 	return {
 		context,
 		getPatch: flowContextStore.getPatch,
+		getEngineState() {
+			const egressLease = ceremonyEgressLease?.handle();
+			return egressLease ? { egressLease } : undefined;
+		},
 	};
 }
 
@@ -1082,6 +1288,7 @@ type ProviderServerLogEventBase = ProviderRequestCost & {
 	requestedProviderId?: string;
 	status: number;
 	proxy?: ProxyTelemetryLogPayload;
+	resolver?: ResolverTelemetryLogPayload;
 };
 
 export type ProviderServerLogEvent =
@@ -1167,7 +1374,11 @@ export type ProviderServerOptions<TContext extends Partial<ProviderContext> = Pr
 	stt?: SttContext;
 	/** Optional OCR override for tests or custom hosts; local/prod normally resolves from env. */
 	ocr?: OcrContext;
-	/** Optional resolver override for tests or custom hosts; local/prod normally resolves from env. */
+	/**
+	 * Optional resolver override for tests or custom hosts; local/prod normally resolves from env.
+	 * SDK chains are reconstructed with each request's telemetry sink. An opaque host
+	 * resolver is reported as one custom invocation; its internal vendor work is not exposed.
+	 */
 	resolver?: ResolverContext;
 	/** Optional runtime state override for tests or custom hosts. Production resolves Redis from env and fails closed when unavailable. */
 	state?: ProviderRuntimeState;
@@ -1229,15 +1440,18 @@ function finishRequestCost(input: {
 	};
 }
 
-function zodDetails(error: z.ZodError): Array<{
+function zodDetails(
+	error: z.ZodError,
+	redact?: DiagnosticRedactor,
+): Array<{
 	path: string;
 	code: string;
 	message: string;
 }> {
 	return error.issues.map((issue) => ({
-		path: issue.path.join("."),
-		code: issue.code,
-		message: issue.message,
+		path: sanitizeSpanNameForOutput(issue.path.join("."), redact),
+		code: sanitizeSpanNameForOutput(issue.code, redact),
+		message: sanitizeSpanNameForOutput(issue.message, redact),
 	}));
 }
 
@@ -1264,6 +1478,7 @@ function toErrorResponse(
 	error: unknown,
 	requestId: string | undefined,
 	observabilityDetails: ErrorObservabilityDetails,
+	redact?: DiagnosticRedactor,
 ): OperationErrorResponse {
 	const observability = observabilityDetails;
 	const source = publicErrorSource(error, observability.category);
@@ -1302,7 +1517,7 @@ function toErrorResponse(
 				...(requestId ? { requestId } : {}),
 				retryable: observability.retryable,
 				source,
-				details: zodDetails(error),
+				details: zodDetails(error, redact),
 			},
 		};
 	}
@@ -1598,14 +1813,17 @@ export type ProviderErrorCauseFrame = {
 const MAX_PROVIDER_ERROR_CAUSE_FRAMES = 5;
 const MAX_PROVIDER_ERROR_CAUSE_MESSAGE_LENGTH = 300;
 
-function providerErrorCauseMessage(message: string): string {
-	const sanitized = sanitizeDiagnosticText(message);
+function providerErrorCauseMessage(message: string, redact?: DiagnosticRedactor): string {
+	const sanitized = sanitizeDiagnosticText(redactDiagnosticText(message, redact));
 	return sanitized.length > MAX_PROVIDER_ERROR_CAUSE_MESSAGE_LENGTH
 		? `${sanitized.slice(0, MAX_PROVIDER_ERROR_CAUSE_MESSAGE_LENGTH)}… [truncated]`
 		: sanitized;
 }
 
-function providerErrorCauseChain(error: unknown): ProviderErrorCauseFrame[] | undefined {
+function providerErrorCauseChain(
+	error: unknown,
+	redact?: DiagnosticRedactor,
+): ProviderErrorCauseFrame[] | undefined {
 	if (!(error instanceof Error) && !isProviderError(error)) return undefined;
 
 	const seen = new Set<object>([error]);
@@ -1622,9 +1840,9 @@ function providerErrorCauseChain(error: unknown): ProviderErrorCauseFrame[] | un
 		const providerObservability = safeProviderErrorObservability(cause);
 		const causeCode = providerErrorCode(cause);
 		frames.push({
-			errorClass: cause.name,
-			...(causeCode !== undefined ? { code: causeCode } : {}),
-			message: providerErrorCauseMessage(message),
+			errorClass: redactDiagnosticText(cause.name, redact),
+			...(causeCode !== undefined ? { code: redactDiagnosticText(causeCode, redact) } : {}),
+			message: providerErrorCauseMessage(message, redact),
 			messageLength: message.length,
 			messageFingerprint: createHash("sha256").update(message).digest("hex").slice(0, 12),
 			...(providerObservability ? { providerObservability } : {}),
@@ -1648,6 +1866,7 @@ function logProviderError(
 	telemetry: RequestTelemetry | undefined,
 	observabilityDetails: ErrorObservabilityDetails,
 	correlation: RequestCorrelationIds = {},
+	redact?: DiagnosticRedactor,
 ): void {
 	const providerCode = isProviderError(error) ? providerErrorCode(error) : undefined;
 	const code = isProviderError(error)
@@ -1659,7 +1878,7 @@ function logProviderError(
 				: "internal_error";
 	const errorClass = error instanceof Error ? error.name : typeof error;
 	const message = error instanceof Error ? error.message : String(error);
-	const causeChain = providerErrorCauseChain(error);
+	const causeChain = providerErrorCauseChain(error, redact);
 	const details = observabilityDetails;
 	const isUnregisteredProviderErrorCode =
 		status === 500 &&
@@ -1679,24 +1898,28 @@ function logProviderError(
 	emit({
 		level: status >= 500 ? "error" : "warn",
 		event: "provider_request_failed",
-		providerId: provider.id,
+		providerId: redactDiagnosticText(provider.id, redact),
 		kind,
-		route,
-		...(requestId ? { requestId } : {}),
+		route: redactCriticalDiagnosticText(route, redact),
+		...(requestId ? { requestId: redactCriticalDiagnosticText(requestId, redact) } : {}),
 		...(correlation.connectionId !== undefined
-			? { connectionId: correlation.connectionId }
+			? { connectionId: redactDiagnosticText(correlation.connectionId, redact) }
+			: {}),
+		...(correlation.flowId !== undefined
+			? { flowId: redactDiagnosticText(correlation.flowId, redact) }
+			: {}),
+		...(correlation.tenantId !== undefined
+			? { tenantId: redactDiagnosticText(correlation.tenantId, redact) }
 			: {}),
-		...(correlation.flowId !== undefined ? { flowId: correlation.flowId } : {}),
-		...(correlation.tenantId !== undefined ? { tenantId: correlation.tenantId } : {}),
 		...(correlation.requestedProviderId !== undefined
-			? { requestedProviderId: correlation.requestedProviderId }
+			? { requestedProviderId: redactDiagnosticText(correlation.requestedProviderId, redact) }
 			: {}),
 		status,
 		...cost,
 		...(telemetryPayload ?? {}),
-		code,
-		errorClass,
-		message,
+		code: sanitizeSpanNameForOutput(redactCriticalDiagnosticText(code, redact)),
+		errorClass: redactDiagnosticText(errorClass, redact),
+		message: sanitizeDiagnosticText(redactDiagnosticText(message, redact)),
 		...(causeChain ? { causeChain } : {}),
 		...(providerObservability ? { providerObservability } : {}),
 		...(details.upstreamStatus ? { upstreamStatus: details.upstreamStatus } : {}),
@@ -1710,7 +1933,7 @@ function logProviderError(
 						"Declare this code (with status and retryable) in the operation's errorCodes so it serves its intended status instead of 500.",
 				}
 			: {}),
-		...(error instanceof z.ZodError ? { issues: zodDetails(error) } : {}),
+		...(error instanceof z.ZodError ? { issues: zodDetails(error, redact) } : {}),
 	});
 }
 
@@ -1722,6 +1945,7 @@ function logProviderCleanupError(
 	requestId: string | undefined,
 	resource: "browser" | "stealth",
 	error: unknown,
+	redact?: DiagnosticRedactor,
 ): void {
 	const emit = typeof logger === "function" ? logger : defaultProviderServerLogger;
 	const errorClass = error instanceof Error ? error.name : typeof error;
@@ -1729,13 +1953,13 @@ function logProviderCleanupError(
 	emit({
 		level: "warn",
 		event: "provider_cleanup_failed",
-		providerId: provider.id,
+		providerId: redactDiagnosticText(provider.id, redact),
 		kind,
-		route: operationId,
-		...(requestId ? { requestId } : {}),
+		route: redactCriticalDiagnosticText(operationId, redact),
+		...(requestId ? { requestId: redactCriticalDiagnosticText(requestId, redact) } : {}),
 		resource,
-		errorClass,
-		message,
+		errorClass: redactDiagnosticText(errorClass, redact),
+		message: sanitizeDiagnosticText(redactDiagnosticText(message, redact)),
 	});
 }
 
@@ -1749,23 +1973,28 @@ function logProviderSuccess(
 	cost: ProviderRequestCost,
 	telemetry?: RequestTelemetry,
 	correlation: RequestCorrelationIds = {},
+	redact?: DiagnosticRedactor,
 ): void {
 	const telemetryPayload = telemetry?.toLogPayload();
 	const emit = typeof logger === "function" ? logger : defaultProviderServerLogger;
 	emit({
 		level: "info",
 		event: "provider_request_completed",
-		providerId: provider.id,
+		providerId: redactDiagnosticText(provider.id, redact),
 		kind,
-		route,
-		...(requestId ? { requestId } : {}),
+		route: redactCriticalDiagnosticText(route, redact),
+		...(requestId ? { requestId: redactCriticalDiagnosticText(requestId, redact) } : {}),
 		...(correlation.connectionId !== undefined
-			? { connectionId: correlation.connectionId }
+			? { connectionId: redactDiagnosticText(correlation.connectionId, redact) }
+			: {}),
+		...(correlation.flowId !== undefined
+			? { flowId: redactDiagnosticText(correlation.flowId, redact) }
+			: {}),
+		...(correlation.tenantId !== undefined
+			? { tenantId: redactDiagnosticText(correlation.tenantId, redact) }
 			: {}),
-		...(correlation.flowId !== undefined ? { flowId: correlation.flowId } : {}),
-		...(correlation.tenantId !== undefined ? { tenantId: correlation.tenantId } : {}),
 		...(correlation.requestedProviderId !== undefined
-			? { requestedProviderId: correlation.requestedProviderId }
+			? { requestedProviderId: redactDiagnosticText(correlation.requestedProviderId, redact) }
 			: {}),
 		status,
 		...cost,
@@ -1779,6 +2008,7 @@ type RequestScopeFinishResult = {
 };
 
 type RequestScope = RequestScopeContext & {
+	seedCredentials(rawBody: unknown, kind: "operation" | "auth" | "stateful"): void;
 	enrich(input: {
 		route?: string;
 		requestId?: string;
@@ -1850,8 +2080,91 @@ function requestTraceId(
 	);
 }
 
+/** Harvest only credential subtrees, iteratively and before schema diagnostics. */
+function rawRequestCredentials(
+	rawBody: unknown,
+	kind: "operation" | "auth" | "stateful",
+): { values: string[]; exhausted: boolean } {
+	const record = (value: unknown): Record<string, unknown> | undefined =>
+		value !== null && typeof value === "object" ? (value as Record<string, unknown>) : undefined;
+	const own = (value: unknown, key: string): unknown => {
+		const object = record(value);
+		return object && Object.hasOwn(object, key) ? object[key] : undefined;
+	};
+	const body = kind === "stateful" ? own(rawBody, "operationRequest") : rawBody;
+	const values: string[] = [];
+	let remainingBytes = 64 * 1024;
+	let exhausted = false;
+	const add = (value: unknown): void => {
+		if (typeof value !== "string") return;
+		const bytes = Buffer.byteLength(value, "utf8");
+		if (bytes > remainingBytes) {
+			exhausted = true;
+			return;
+		}
+		remainingBytes -= bytes;
+		if (value) values.push(value);
+		const trimmed = value.trim();
+		if (trimmed && trimmed !== value) values.push(trimmed);
+	};
+	function* entries(object: Record<string, unknown>) {
+		for (const key in object) {
+			if (Object.hasOwn(object, key)) yield [key, object[key]] as const;
+		}
+	}
+	const visit = (root: unknown): void => {
+		const object = record(root);
+		if (!object) {
+			add(root);
+			return;
+		}
+		// Connection inventories are usually flat. Walk the root directly and only
+		// allocate iterator frames when a nested credential container is encountered.
+		for (const key in object) {
+			if (!Object.hasOwn(object, key)) continue;
+			const value = object[key];
+			add(key);
+			if (exhausted) break;
+			const child = record(value);
+			if (!child) {
+				add(value);
+				if (exhausted) break;
+				continue;
+			}
+			const stack = [{ iterator: entries(child), depth: 1 }];
+			while (stack.length && !exhausted) {
+				const frame = stack[stack.length - 1];
+				const entry = frame.iterator.next();
+				if (entry.done) {
+					stack.pop();
+					continue;
+				}
+				const [key, value] = entry.value;
+				add(key);
+				if (exhausted) break;
+				const child = record(value);
+				if (child) {
+					if (frame.depth >= 8) {
+						exhausted = true;
+						break;
+					}
+					stack.push({ iterator: entries(child), depth: frame.depth + 1 });
+				} else add(value);
+			}
+			if (exhausted) break;
+		}
+	};
+	visit(own(own(body, "connection"), "secrets"));
+	if (kind === "auth" && !exhausted) {
+		add(own(own(body, "engine"), "egressLease"));
+		if (!exhausted) visit(own(body, "input"));
+	}
+	return { values, exhausted };
+}
+
 function createRequestScope(input: {
 	provider: ProviderDefinition;
+	staticSensitiveValues: CompiledDiagnosticSensitiveValues;
 	kind: "operation" | "auth";
 	route: string;
 	requestId?: string;
@@ -1863,8 +2176,25 @@ function createRequestScope(input: {
 	setHeader?: (name: string, value: string) => void;
 	declaredErrorCode?: (error: unknown) => OperationErrorCode | undefined;
 }): RequestScope {
+	const sensitiveRegistry = createDiagnosticRedactor([], input.staticSensitiveValues);
+	const redact = (text: string) => redactDiagnosticText(text, sensitiveRegistry.redact);
+	bindCriticalDiagnosticRedactor(
+		redact,
+		sensitiveRegistry.redactCritical,
+		sensitiveRegistry.redactStructured,
+		() => sensitiveRegistry.suppressed,
+	);
 	const requestCost = startRequestCost();
-	const traceConfig = resolveTraceConfigFromEnv();
+	const observeEnv = {
+		observe: createDiagnosticEnvObserver(
+			input.provider,
+			sensitiveRegistry.add,
+			sensitiveRegistry.has,
+		),
+		finished: false,
+		staticValues: input.staticSensitiveValues,
+	};
+	const traceConfig = withDiagnosticEnv(observeEnv, () => resolveTraceConfigFromEnv());
 	const details = {
 		route: input.route,
 		requestId: input.requestId,
@@ -1883,13 +2213,19 @@ function createRequestScope(input: {
 	const initialTraceId = requestTraceId(input.headers, input.requestId);
 	const trace: RuntimeTraceContext = traceConfig
 		? createTraceContext({
-				...resolveServerTraceContextOptions(traceConfig, traceAttributes),
+				...withDiagnosticEnv(observeEnv, () =>
+					resolveServerTraceContextOptions(traceConfig, traceAttributes, undefined, redact),
+				),
+				redact,
 				...(initialTraceId ? { traceId: initialTraceId } : {}),
 			})
-		: createTraceContext();
+		: createTraceContext({ redact });
+	bindDiagnosticSensitiveRegistry(trace, sensitiveRegistry);
 	const proxyCollector = new ProxyTelemetryCollector();
+	const resolverCollector = new ResolverTelemetryCollector({ redact });
 	const telemetry = new RequestTelemetry(trace);
 	telemetry.register(proxyCollector);
+	telemetry.register(resolverCollector);
 	let rootRunner: <T>(fn: () => Promise<T>) => Promise<T> = (fn) => fn();
 	let resolveRoot!: (outcome: RequestTerminalOutcome) => void;
 	const rootTerminal = new Promise<RequestTerminalOutcome>((resolve) => {
@@ -1913,12 +2249,14 @@ function createRequestScope(input: {
 		if (outcome.kind === "cancelled") return clientCancelledError();
 		return undefined;
 	};
-	const root = trace.span(`request:${input.kind}:${input.route}`, async () => {
-		rootRunner = AsyncLocalStorage.snapshot();
-		const outcome = await rootTerminal;
-		const error = terminalError(outcome);
-		if (error !== undefined) throw error;
-	});
+	const root = withDiagnosticEnv(observeEnv, () =>
+		trace.span(`request:${input.kind}:${input.route}`, async () => {
+			rootRunner = AsyncLocalStorage.snapshot();
+			const outcome = await rootTerminal;
+			const error = terminalError(outcome);
+			if (error !== undefined) throw error;
+		}),
+	);
 	void root.catch(() => undefined);
 
 	const settleRoot = (): void => {
@@ -1953,7 +2291,7 @@ function createRequestScope(input: {
 		traceAttributes.route = details.route;
 		const traceId = requestTraceId(details.headers, details.requestId);
 		const sanitizedAttributes = Object.fromEntries(
-			Object.entries(sanitizeTraceAttributes(traceAttributes)).map(([key, value]) => [
+			Object.entries(sanitizeTraceAttributes(traceAttributes, redact)).map(([key, value]) => [
 				key,
 				String(value),
 			]),
@@ -1965,8 +2303,16 @@ function createRequestScope(input: {
 	};
 
 	const scope: RequestScope = {
+		redact,
 		trace,
 		telemetry,
+		resolverTelemetry: resolverCollector,
+		seedCredentials(rawBody, kind): void {
+			const harvested = rawRequestCredentials(rawBody, kind);
+			sensitiveRegistry.add(harvested.values);
+			// An incomplete inventory cannot certify free text: emit less.
+			if (harvested.exhausted) sensitiveRegistry.suppress();
+		},
 		enrich(enrichment): void {
 			if (terminalOutcome) return;
 			if (enrichment.route !== undefined) details.route = enrichment.route;
@@ -2016,6 +2362,7 @@ function createRequestScope(input: {
 		},
 		terminalize(outcome): RequestScopeFinishResult {
 			if (finishedResult) return finishedResult;
+			observeEnv.finished = true;
 			terminalOutcome = outcome;
 			const error = terminalError(outcome);
 			finishedResult = {};
@@ -2023,8 +2370,7 @@ function createRequestScope(input: {
 				const declaredErrorCode =
 					error === undefined ? undefined : input.declaredErrorCode?.(error);
 				const status =
-					outcome.status ??
-					(error === undefined ? 200 : toStatusCode(error, declaredErrorCode));
+					outcome.status ?? (error === undefined ? 200 : toStatusCode(error, declaredErrorCode));
 				finishedResult = headerSnapshot(error);
 				const cost = finishRequestCost(requestCost);
 				try {
@@ -2039,6 +2385,7 @@ function createRequestScope(input: {
 							cost,
 							telemetry,
 							details.correlation,
+							redact,
 						);
 					} else {
 						logProviderError(
@@ -2054,6 +2401,7 @@ function createRequestScope(input: {
 							telemetry,
 							finishedResult.errorObservability as ErrorObservabilityDetails,
 							details.correlation,
+							redact,
 						);
 					}
 				} catch {
@@ -2089,35 +2437,73 @@ function createRequestScope(input: {
 	return scope;
 }
 
-function responseWithRequestScopeHeaders(
+// A raw `Response` result skips `toErrorResponse`. Its payload shape stays
+// provider-owned; known credentials in error payloads still need redaction.
+// The observability header is SDK-owned: derive it
+// from the status. Only timeouts, rate limits, and 5xx are retryable;
+// `isRetryableCategory` would otherwise mark every other 4xx (`upstream_http`)
+// as retryable.
+function rawResponseErrorObservability(status: number): ErrorObservabilityDetails {
+	return {
+		category: categoryForStatus(status),
+		taxonomyVersion: PROVIDER_OBSERVABILITY_TAXONOMY_VERSION,
+		retryable: status === 408 || status === 429 || status >= 500,
+	};
+}
+
+// `rawStatusFallback` is decided by the caller from the outcome, not from a
+// missing snapshot: a failed outcome whose thrown value is `undefined` also has
+// no `errorObservability`, and its 500 carries the SDK envelope, not a raw body.
+async function responseWithRequestScopeHeaders(
 	response: Response,
 	finished: RequestScopeFinishResult,
-): Response {
+	rawStatusFallback: boolean,
+	redact: DiagnosticRedactor,
+): Promise<Response> {
 	const headers = new Headers(response.headers);
 	headers.delete(PROVIDER_TELEMETRY_HEADER);
 	if (finished.providerTelemetryHeader) {
 		headers.set(PROVIDER_TELEMETRY_HEADER, finished.providerTelemetryHeader);
 	}
-	if (finished.errorObservability) {
-		headers.set(ERROR_OBSERVABILITY_HEADER, JSON.stringify(finished.errorObservability));
-	}
-	return new Response(response.body, {
+	headers.delete(ERROR_OBSERVABILITY_HEADER);
+	const errorObservability =
+		finished.errorObservability ??
+		(rawStatusFallback && response.status >= 400
+			? rawResponseErrorObservability(response.status)
+			: undefined);
+	if (errorObservability) {
+		headers.set(ERROR_OBSERVABILITY_HEADER, JSON.stringify(errorObservability));
+	}
+	// Raw Response bodies are provider-owned. Preserve their stream and representation.
+	const body = response.body;
+	const statusText =
+		rawStatusFallback && response.status >= 400
+			? redactDiagnosticText(response.statusText, redact)
+			: response.statusText;
+	return new Response(body, {
 		headers,
 		status: response.status,
-		statusText: response.statusText,
+		// When free text cannot be certified, use the SDK's standard HTTP reason
+		// phrase. It preserves the status contract without trusting provider text.
+		statusText:
+			statusText === REDACTION_FAILED && isDiagnosticRedactionSuppressed(redact)
+				? (STATUS_CODES[response.status] ?? "")
+				: statusText,
 	});
 }
 
-function finalizeRequestResponse(
+async function finalizeRequestResponse(
 	scope: RequestScope,
 	response: Response,
 	outcome: RequestTerminalOutcome,
-): Response {
+): Promise<Response> {
 	try {
 		const error = outcome.kind === "failed" ? outcome.error : undefined;
-		const finalResponse = responseWithRequestScopeHeaders(
+		const finalResponse = await responseWithRequestScopeHeaders(
 			response,
 			scope.snapshotHeaders(error),
+			outcome.kind === "completed",
+			scope.redact,
 		);
 		scope.terminalize(outcome);
 		return finalResponse;
@@ -2336,11 +2722,7 @@ function toSseResponse(
 						const validated = await validateSseEvent(operation, next.value);
 						const encodedEvent = encodeSseEvent(validated);
 						const bytes = encoder.encode(encodedEvent);
-						assertStreamPayloadWithinLimit(
-							bytes.byteLength,
-							transport?.maxEventBytes,
-							"event",
-						);
+						assertStreamPayloadWithinLimit(bytes.byteLength, transport?.maxEventBytes, "event");
 						return bytes;
 					});
 					controller.enqueue(encodedBytes);
@@ -2349,9 +2731,13 @@ function toSseResponse(
 					controller.enqueue(
 						encoder.encode(
 							encodeSseEvent(
-								streamError("stream_error", message, {
-									...(requestId ? { requestId } : {}),
-								}),
+								streamError(
+									"stream_error",
+									sanitizeDiagnosticText(redactDiagnosticText(message, lifecycle.redact)),
+									{
+										...(requestId ? { requestId } : {}),
+									},
+								),
 							),
 						),
 					);
@@ -2484,6 +2870,7 @@ function getHttpStreamTransport(
 function toAuthFlowResponse(
 	result: unknown,
 	contextPatch: Record<string, unknown | null> | undefined,
+	engine: AuthFlowSuccessResponse["engine"],
 ): Response | AuthFlowSuccessResponse {
 	if (result instanceof Response) {
 		return result;
@@ -2496,6 +2883,7 @@ function toAuthFlowResponse(
 	return {
 		data: result,
 		...(contextPatch ? { contextPatch } : {}),
+		...(engine ? { engine } : {}),
 	};
 }
 
@@ -2592,6 +2980,7 @@ async function handleOperation(
 					request.requestId,
 					"stealth",
 					error,
+					scope.redact,
 				);
 			}
 		}
@@ -2607,11 +2996,13 @@ async function handleOperation(
 					request.requestId,
 					"browser",
 					error,
+					scope.redact,
 				);
 			}
 		}
 	};
 	const streamLifecycle: RequestStreamLifecycle = {
+		redact: scope.redact,
 		runStep<T>(fn: () => Promise<T>): Promise<T> {
 			return scope.runStreamStep(fn);
 		},
@@ -2672,10 +3063,12 @@ async function handleAuthFlow(
 	// depend on declared secrets (client ids/secrets), so fail structured before
 	// any flow code runs instead of at whatever point the ceremony first reads
 	// the env. `abort` stays exempt: a user must always be able to cancel a
-	// stranded flow even when provisioning is broken.
-	const { context, getPatch } = createAuthFlowContext(
+	// stranded flow even when provisioning is broken (createAuthFlowContext
+	// applies the same exemption to the engine ceremony lease).
+	const { context, getPatch, getEngineState } = createAuthFlowContext(
 		provider,
 		request,
+		route,
 		options,
 		state,
 		scope,
@@ -2715,10 +3108,10 @@ async function handleAuthFlow(
 			isAuthTurn(result)
 				? materializeAuthFlowTurn(provider, request, result)
 				: result;
-		return toAuthFlowResponse(materializedResult, getPatch());
+		return toAuthFlowResponse(materializedResult, getPatch(), getEngineState());
 	} catch (error) {
 		if (error instanceof AuthAbortError) {
-			return toAuthFlowResponse(error.turn, getPatch());
+			return toAuthFlowResponse(error.turn, getPatch(), getEngineState());
 		}
 		throw error;
 	} finally {
@@ -2733,6 +3126,7 @@ async function handleAuthFlow(
 				request.requestId,
 				"stealth",
 				error,
+				scope.redact,
 			);
 		}
 	}
@@ -2854,12 +3248,15 @@ function operationRequestFromForwardingEnvelope(
 	};
 }
 
-function parseStatefulForwardingEnvelope(rawBody: unknown): ProviderServerStatefulForwardEnvelope {
+function parseStatefulForwardingEnvelope(
+	rawBody: unknown,
+	redact: DiagnosticRedactor,
+): ProviderServerStatefulForwardEnvelope {
 	const parsed = ProviderServerStatefulForwardEnvelopeSchema.safeParse(rawBody);
 	if (parsed.success) return parsed.data;
 	throw new ProviderError("Stateful forwarding envelope is invalid.", {
 		code: "STATEFUL_FORWARDING_ENVELOPE_INVALID",
-		details: zodDetails(parsed.error),
+		details: zodDetails(parsed.error, redact),
 	});
 }
 
@@ -2867,7 +3264,9 @@ function parseStatefulForwardingEnvelope(rawBody: unknown): ProviderServerStatef
  * Primary, cross-runtime app factory. Declared capability ESM is preloaded
  * asynchronously, so this path works on Bun and every supported Node release.
  */
-export async function createServerAppAsync<TContext extends Partial<ProviderContext> = ProviderContext>(
+export async function createServerAppAsync<
+	TContext extends Partial<ProviderContext> = ProviderContext,
+>(
 	provider: ProviderDefinition<TContext>,
 	options: ProviderServerOptions<TContext> = {},
 ): Promise<Hono> {
@@ -2914,6 +3313,12 @@ function createServerAppWithCapabilityModules(
 		engine: serverOptions.engine ?? createInProcessProviderEngine(),
 	};
 	const app = new Hono();
+	// Compile the startup inventory once, composed with the shared outside-context fallback.
+	const staticSensitiveValues = compileProcessDiagnosticSensitiveValues(
+		collectStaticDiagnosticSensitiveValues(provider, {
+			statefulForwardingSecret: options.statefulForwarding?.secret,
+		}),
+	);
 	const logger = options.logger ?? defaultProviderServerLogger;
 	const operationErrorCodes = buildOperationErrorCodeLookup(provider);
 	const statefulForwardingReplayCache = new StatefulForwardingReplayCache(
@@ -2969,6 +3374,7 @@ function createServerAppWithCapabilityModules(
 		const operation = "stateful-internal";
 		const requestScope = createRequestScope({
 			provider,
+			staticSensitiveValues,
 			kind: "operation",
 			route: operation,
 			headers: Object.fromEntries(c.req.raw.headers.entries()),
@@ -2998,7 +3404,8 @@ function createServerAppWithCapabilityModules(
 					code: "STATEFUL_FORWARDING_ENVELOPE_INVALID",
 				});
 			}
-			const envelope = parseStatefulForwardingEnvelope(rawBody);
+			requestScope.seedCredentials(rawBody, "stateful");
+			const envelope = parseStatefulForwardingEnvelope(rawBody, requestScope.redact);
 			if (envelope.providerId !== provider.id) {
 				throw new ProviderError(
 					"Stateful forwarding envelope providerId does not match the served provider.",
@@ -3134,7 +3541,10 @@ function createServerAppWithCapabilityModules(
 				...(requestId ? { requestId } : {}),
 			});
 			const observabilityDetails = errorObservabilityDetails(error, declaredErrorCode);
-			const response = c.json(toErrorResponse(error, requestId, observabilityDetails), status);
+			const response = c.json(
+				toErrorResponse(error, requestId, observabilityDetails, requestScope.redact),
+				status,
+			);
 			return finalizeRequestResponse(requestScope, response, {
 				kind: "failed",
 				status,
@@ -3148,6 +3558,7 @@ function createServerAppWithCapabilityModules(
 		const operation = c.req.param("operation");
 		const requestScope = createRequestScope({
 			provider,
+			staticSensitiveValues,
 			kind: "operation",
 			route: operation,
 			operationId: operation,
@@ -3161,6 +3572,7 @@ function createServerAppWithCapabilityModules(
 				.clone()
 				.json()
 				.catch(() => undefined);
+			requestScope.seedCredentials(rawBody, "operation");
 			const body = OperationRequestSchema.parse(rawBody);
 			const requestHeaders = Object.fromEntries(c.req.raw.headers.entries());
 			body.headers = { ...requestHeaders, ...body.headers };
@@ -3185,7 +3597,12 @@ function createServerAppWithCapabilityModules(
 				);
 				const response = handled instanceof Response ? handled : c.json(handled);
 				return streaming
-					? responseWithRequestScopeHeaders(response, requestScope.snapshotHeaders())
+					? responseWithRequestScopeHeaders(
+							response,
+							requestScope.snapshotHeaders(),
+							true,
+							requestScope.redact,
+						)
 					: response;
 			};
 			const response = streaming
@@ -3202,7 +3619,10 @@ function createServerAppWithCapabilityModules(
 			const requestId = extractRequestId(rawBody);
 			requestScope.enrich({ ...(requestId ? { requestId } : {}) });
 			const observabilityDetails = errorObservabilityDetails(error, declaredErrorCode);
-			const response = c.json(toErrorResponse(error, requestId, observabilityDetails), status);
+			const response = c.json(
+				toErrorResponse(error, requestId, observabilityDetails, requestScope.redact),
+				status,
+			);
 			return finalizeRequestResponse(requestScope, response, {
 				kind: "failed",
 				status,
@@ -3228,6 +3648,7 @@ function createServerAppWithCapabilityModules(
 			let rawBody: unknown;
 			const requestScope = createRequestScope({
 				provider,
+				staticSensitiveValues,
 				kind: "auth",
 				route: logRoute,
 				headers: Object.fromEntries(c.req.raw.headers.entries()),
@@ -3239,6 +3660,7 @@ function createServerAppWithCapabilityModules(
 					.clone()
 					.json()
 					.catch(() => undefined);
+				requestScope.seedCredentials(rawBody, "auth");
 				const body = withAuthRequestHeaders(
 					AuthFlowRequestSchema.parse(rawBody),
 					c.req.raw.headers,
@@ -3278,7 +3700,10 @@ function createServerAppWithCapabilityModules(
 				const requestId = extractRequestId(rawBody);
 				requestScope.enrich({ ...(requestId ? { requestId } : {}) });
 				const observabilityDetails = errorObservabilityDetails(error);
-				const response = c.json(toErrorResponse(error, requestId, observabilityDetails), status);
+				const response = c.json(
+					toErrorResponse(error, requestId, observabilityDetails, requestScope.redact),
+					status,
+				);
 				return finalizeRequestResponse(requestScope, response, {
 					kind: "failed",
 					status,