@apifuse/provider-sdk 2.2.0-beta.59 → 2.2.0-beta.60

package/src/runtime/env.ts

@@ -1,3 +1,4 @@
+import { readDiagnosticEnv } from "./diagnostic-env.js";
 import { isEngineOwnedEnvName } from "../engine.js";
 import type { EnvContext } from "../types.js";
 
@@ -20,7 +21,7 @@ export function createEnvContext(allowedKeys?: string[]): EnvContext {
 				return undefined;
 			}
 
-			return process.env[key];
+			return readDiagnosticEnv(key);
 		},
 	};
 }

package/src/runtime/instrumentation.ts

@@ -1,3 +1,4 @@
+import { registerDiagnosticSensitiveValues } from "./diagnostic-redactor.js";
 import type {
 	HttpStreamResponse,
 	ProviderContext,
@@ -570,6 +571,7 @@ function wrapStealthRedirects(
 		run(...args: Parameters<StealthSession["redirects"]["run"]>) {
 			const diagnosticArgs = [args[0].url, args[0]];
 			const diagnostics = snapshotRequestDiagnostics("stealth", "fetch", diagnosticArgs);
+			registerDiagnosticSensitiveValues(trace, diagnostics.sensitiveValues);
 			let result: ReturnType<StealthSession["redirects"]["run"]>;
 			try {
 				result = redirects.run(...args);
@@ -750,6 +752,7 @@ function wrapNamespace<T extends object>(
 					return Reflect.apply(value, namespaceTarget, args);
 				}
 				const requestDiagnostics = snapshotRequestDiagnostics(namespace, methodName, args);
+				registerDiagnosticSensitiveValues(trace, requestDiagnostics.sensitiveValues);
 				// Invoke first and decide by the RETURN VALUE. `runSpan` always
 				// returns a Promise, so unconditionally span-wrapping every member
 				// silently rewrote synchronous contracts: `ctx.state.namespace()`

package/src/runtime/ocr.ts

@@ -1,3 +1,4 @@
+import { readDiagnosticEnv } from "./diagnostic-env.js";
 import { ProviderError, TransportError } from "../errors.js";
 import type {
 	OcrCaptchaCandidate,
@@ -96,7 +97,7 @@ export function createUnsupportedOcrClient(reason?: string): OcrContext {
 }
 
 function normalizedEnvValue(env: EnvLike, key: string): string | undefined {
-	const value = env[key]?.trim();
+	const value = readDiagnosticEnv(key, env)?.trim();
 	return value ? value : undefined;
 }
 

package/src/runtime/otlp.ts

@@ -1,3 +1,4 @@
+import { readDiagnosticEnv } from "./diagnostic-env.js";
 import { AsyncResource } from "node:async_hooks";
 
 import type { TraceSpan } from "../types.js";
@@ -153,12 +154,12 @@ export function resolveOTLPExportOptions(
 		{ source: EXPLICIT_ENDPOINT_SOURCE, value: explicit.endpoint, appendPath: false },
 		{
 			source: OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,
-			value: env[OTEL_EXPORTER_OTLP_TRACES_ENDPOINT],
+			value: readDiagnosticEnv(OTEL_EXPORTER_OTLP_TRACES_ENDPOINT, env),
 			appendPath: false,
 		},
 		{
 			source: OTEL_EXPORTER_OTLP_ENDPOINT,
-			value: env[OTEL_EXPORTER_OTLP_ENDPOINT],
+			value: readDiagnosticEnv(OTEL_EXPORTER_OTLP_ENDPOINT, env),
 			appendPath: true,
 		},
 	];
@@ -173,11 +174,11 @@ export function resolveOTLPExportOptions(
 	}
 	const endpoint = candidate.appendPath ? appendTracesPath(parsed.url) : candidate.value;
 
-	const tracesHeaders = presentValue(env[OTEL_EXPORTER_OTLP_TRACES_HEADERS]);
+	const tracesHeaders = presentValue(readDiagnosticEnv(OTEL_EXPORTER_OTLP_TRACES_HEADERS, env));
 	const headersSource =
 		tracesHeaders !== undefined ? OTEL_EXPORTER_OTLP_TRACES_HEADERS : OTEL_EXPORTER_OTLP_HEADERS;
 	const envHeaders = parseHeaderList(
-		tracesHeaders ?? presentValue(env[OTEL_EXPORTER_OTLP_HEADERS]),
+		tracesHeaders ?? presentValue(readDiagnosticEnv(OTEL_EXPORTER_OTLP_HEADERS, env)),
 	);
 	if (!headersAreSendable(envHeaders)) {
 		return { status: "invalid", source: headersSource, reason: INVALID_HEADERS };

package/src/runtime/proxy-nodemaven.ts

@@ -1,3 +1,4 @@
+import { readDiagnosticEnv } from "./diagnostic-env.js";
 import { createHash, randomBytes } from "node:crypto";
 
 import type { ProviderProxyPolicy } from "../types.js";
@@ -43,11 +44,11 @@ export function hasNodemavenCredentials(): boolean {
 }
 
 function readNodemavenUsername(): string | undefined {
-	return process.env[NODEMAVEN_USERNAME_ENV]?.trim() || undefined;
+	return readDiagnosticEnv(NODEMAVEN_USERNAME_ENV)?.trim() || undefined;
 }
 
 function readNodemavenPassword(): string | undefined {
-	return process.env[NODEMAVEN_PASSWORD_ENV]?.trim() || undefined;
+	return readDiagnosticEnv(NODEMAVEN_PASSWORD_ENV)?.trim() || undefined;
 }
 
 function resolveNodemavenFilter(value: string | undefined): string {

package/src/runtime/request-options.ts

@@ -1,3 +1,4 @@
+import { isProviderError } from "../errors.js";
 import type {
 	HttpClient,
 	RequestOptions,
@@ -5,7 +6,6 @@ import type {
 	RequestParams,
 	RequestParamValue,
 } from "../types.js";
-import { isProviderError } from "../errors.js";
 
 export const REDACTED_QUERY_VALUE = "[REDACTED]";
 
@@ -161,15 +161,34 @@ export function serializeRequestUrl(
 	};
 }
 
-const MIN_UNSCOPED_SENSITIVE_VALUE_LENGTH = 4;
+const MIN_UNSCOPED_SENSITIVE_VALUE_LENGTH = 8;
 
-function normalizePercentEscapes(value: string): string {
+export function normalizePercentEscapes(value: string): string {
 	return value.replace(/%[\da-f]{2}/gi, (percentEscape) => percentEscape.toUpperCase());
 }
 
 function sensitiveValueVariants(value: string): string[] {
 	if (!value || value === REDACTED_QUERY_VALUE) return [];
 
+	// Owner-visible policy: short credentials are literal, case-sensitive tokens only.
+	// Encoded short needles collide with benign cursors and ordinary diagnostic text.
+	if (value.length < 8) return [value];
+	// These ASCII characters are identical under NFC, JSON, URI-component and
+	// form encoding. Avoid constructing those identical variants for common tokens.
+	if (/^[A-Za-z0-9._*-]+$/.test(value)) {
+		const base64 = Buffer.from(value, "utf8").toString("base64");
+		const base64Url = base64.replaceAll("+", "-").replaceAll("/", "_");
+		return [
+			...new Set([
+				value,
+				base64,
+				base64.replace(/=+$/, ""),
+				base64Url,
+				base64Url.replace(/=+$/, ""),
+			]),
+		];
+	}
+	const normalized = value.normalize("NFC");
 	const formEncoded = new URLSearchParams({ value }).toString().slice("value=".length);
 	let componentEncoded: string;
 	try {
@@ -179,15 +198,42 @@ function sensitiveValueVariants(value: string): string[] {
 		// still safe to scrub, and URLSearchParams supplies its well-formed form.
 		componentEncoded = value;
 	}
-	return [...new Set([value, componentEncoded, formEncoded].map(normalizePercentEscapes))];
-}
-
-type SensitiveValueVariant = { value: string; requiresTokenBoundary: boolean };
+	const base64 = Buffer.from(value, "utf8").toString("base64");
+	const base64Url = base64.replaceAll("+", "-").replaceAll("/", "_");
+	const jsonEscaped = JSON.stringify(value).slice(1, -1);
+	return [
+		...new Set(
+			[
+				value,
+				normalized,
+				componentEncoded,
+				formEncoded,
+				jsonEscaped,
+				base64,
+				base64.replace(/=+$/, ""),
+				base64Url,
+				base64Url.replace(/=+$/, ""),
+			].map(normalizePercentEscapes),
+		),
+	];
+}
+
+export type SensitiveValueVariant = {
+	value: string;
+	requiresTokenBoundary: boolean;
+	caseInsensitive: boolean;
+};
 
-function allSensitiveValueVariants(sensitiveValues: readonly string[]): SensitiveValueVariant[] {
+export function allSensitiveValueVariants(
+	sensitiveValues: readonly string[],
+): SensitiveValueVariant[] {
 	const variants = new Map<string, SensitiveValueVariant>();
 	for (const sensitiveValue of sensitiveValues) {
 		const requiresTokenBoundary = sensitiveValue.length < MIN_UNSCOPED_SENSITIVE_VALUE_LENGTH;
+		// Long values are unlikely to be ordinary prose, so case folding is worth
+		// the extra over-redaction protection. Values of 4-7 characters remain
+		// case-sensitive because they commonly occur as words and identifiers.
+		const caseInsensitive = sensitiveValue.length >= 8;
 		for (const value of sensitiveValueVariants(sensitiveValue)) {
 			const existing = variants.get(value);
 			variants.set(value, {
@@ -195,6 +241,7 @@ function allSensitiveValueVariants(sensitiveValues: readonly string[]): Sensitiv
 				requiresTokenBoundary: existing
 					? existing.requiresTokenBoundary && requiresTokenBoundary
 					: requiresTokenBoundary,
+				caseInsensitive: existing ? existing.caseInsensitive || caseInsensitive : caseInsensitive,
 			});
 		}
 	}
@@ -209,28 +256,29 @@ function isTokenCharacter(value: string | undefined): boolean {
 }
 
 function replaceSensitiveVariant(text: string, variant: SensitiveValueVariant): string {
-	const pattern = variant.value.replace(/%([\da-f]{2})|[.*+?^${}()|[\]\\]/gi, (match, hex) => {
-		if (hex) {
-			return `%${[...String(hex)]
-				.map((character) =>
-					/[a-f]/i.test(character)
-						? `[${character.toLowerCase()}${character.toUpperCase()}]`
-						: character,
-				)
-				.join("")}`;
-		}
-		return `\\${match}`;
-	});
-	return text.replace(new RegExp(pattern, "gu"), (match, offset: number, source: string) => {
-		const end = offset + match.length;
+	const normalized = normalizePercentEscapes(text);
+	const comparable = variant.caseInsensitive ? normalized.toLowerCase() : text;
+	const needle = variant.caseInsensitive ? variant.value.toLowerCase() : variant.value;
+	let cursor = 0;
+	let output = "";
+	for (
+		let index = comparable.indexOf(needle);
+		index !== -1;
+		index = comparable.indexOf(needle, index + 1)
+	) {
+		const end = index + needle.length;
 		if (
 			variant.requiresTokenBoundary &&
-			(isTokenCharacter(source[offset - 1]) || isTokenCharacter(source[end]))
-		) {
-			return match;
-		}
-		return REDACTED_QUERY_VALUE;
-	});
+			(isTokenCharacter(comparable[index - 1]) || isTokenCharacter(comparable[end]))
+		)
+			continue;
+		// Unicode folding can change offsets; suppress the field instead of slicing a secret.
+		if (comparable.length !== text.length) return REDACTED_QUERY_VALUE;
+		output += text.slice(cursor, index) + REDACTED_QUERY_VALUE;
+		cursor = end;
+		index = end - 1;
+	}
+	return cursor ? output + text.slice(cursor) : text;
 }
 
 /** Scrubs raw and URL-encoded secret values from diagnostic text. */

package/src/runtime/resolver-vendors/browser.ts

@@ -173,7 +173,6 @@ async function runBoundedCleanup(
 			onError(error) {
 				return {
 					error_message: error instanceof Error ? error.message : String(error),
-					...(error instanceof Error && error.stack ? { error_stack: error.stack } : {}),
 				};
 			},
 		})

package/src/runtime/resolver.ts

@@ -1,3 +1,4 @@
+import { readDiagnosticEnv } from "./diagnostic-env.js";
 import { createHash } from "node:crypto";
 
 import {
@@ -309,12 +310,12 @@ type ResolverChainEntry = {
 };
 
 function normalizedEnvValue(env: EnvLike, key: string): string | undefined {
-	const value = env[key]?.trim();
+	const value = readDiagnosticEnv(key, env)?.trim();
 	return value ? value : undefined;
 }
 
 function readPositiveIntegerEnv(env: EnvLike, name: string): string | undefined {
-	const raw = env[name]?.trim();
+	const raw = readDiagnosticEnv(name, env)?.trim();
 	if (!raw) return undefined;
 	if (!/^[1-9]\d*$/.test(raw)) {
 		throw new Error(`${name} must be a positive integer`);

package/src/runtime/stt.ts

@@ -1,3 +1,4 @@
+import { readDiagnosticEnv } from "./diagnostic-env.js";
 import { ProviderError, TransportError, ValidationError } from "../errors.js";
 import type {
 	Bcp47Locale,
@@ -69,7 +70,7 @@ export function createUnsupportedSttClient(reason?: string): SttContext {
 }
 
 function normalizedEnvValue(env: EnvLike, key: string): string | undefined {
-	const value = env[key]?.trim();
+	const value = readDiagnosticEnv(key, env)?.trim();
 	return value ? value : undefined;
 }
 
@@ -99,7 +100,7 @@ export function createSttClientFromEnv(
 	}
 
 	const accountId = env.APIFUSE__CLOUDFLARE__ACCOUNT_ID?.trim();
-	const apiToken = env.APIFUSE__STT__CLOUDFLARE_API_TOKEN?.trim();
+	const apiToken = readDiagnosticEnv(APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV, env)?.trim();
 	if (!accountId || !apiToken) {
 		return createUnsupportedSttClient(
 			`STT backend ${backend} requires ${CLOUDFLARE_ACCOUNT_ID_ENV} and ${APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV}`,

package/src/runtime/trace.ts

@@ -1,12 +1,25 @@
 import { AsyncLocalStorage } from "node:async_hooks";
-
+import { sanitizeSpanNameForOutput } from "../trace-sanitization.js";
 import type {
 	TraceContext as BaseTraceContext,
 	TraceAttributeValue,
 	TraceConfig,
 	TraceSpan,
 } from "../types.js";
+import {
+	type DiagnosticRedactor,
+	diagnosticStructuredRedactor,
+	redactDiagnosticAttributeKey,
+	copyDiagnosticAttributeTypes,
+	redactedKeyAllocator,
+	isRedactedKey,
+	redactCriticalDiagnosticText,
+	diagnosticAttributeRedactor,
+	REDACTION_FAILED,
+	redactDiagnosticText,
+} from "./diagnostic-redactor.js";
 import { exportSpansOTLP, type OTLPExportOptions } from "./otlp.js";
+import { REDACTED_QUERY_VALUE } from "./request-options.js";
 
 export type SpanAttributeValue = TraceAttributeValue;
 
@@ -19,6 +32,8 @@ export interface TraceContext extends BaseTraceContext {
 export interface CreateTraceContextOptions {
 	maxSpans?: number;
 	onSpan?: (span: Span) => void;
+	/** Redacts diagnostic attribute values and errors before recording or calling onSpan. */
+	redact?: DiagnosticRedactor;
 	exportOptions?: OTLPExportOptions;
 	resourceAttributes?: Record<string, string>;
 	/** W3C-compatible 32-character lowercase hexadecimal trace id used for export. */
@@ -42,7 +57,7 @@ type PendingSpan = {
 	startedAt: number;
 	parentId?: string;
 	sequence: number;
-	attributes: Record<string, SpanAttributeValue>;
+	attributes: Record<string, SpanAttributeValue | bigint>;
 };
 
 type CompletedSpanEntry = {
@@ -52,14 +67,22 @@ type CompletedSpanEntry = {
 	exported: boolean;
 };
 
+const TRACE_RESOURCE_ATTRIBUTE_SANITIZER = Symbol.for(
+	"@apifuse/provider-sdk/runtime/trace-resource-attribute-sanitizer",
+);
+
+type ResourceAttributesWithSanitizer = Record<string, string> & {
+	[TRACE_RESOURCE_ATTRIBUTE_SANITIZER]?: (
+		attributes: Record<string, string>,
+	) => Record<string, string>;
+};
+
 export interface TraceRecorder {
 	runSpan<T>(name: string, fn: () => Promise<T> | T, options?: SpanHookOptions<T>): Promise<T>;
 }
 
 export const TRACE_RECORDER = Symbol.for("@apifuse/provider-sdk/runtime/trace-recorder");
-const TRACE_EXPORT_METADATA = Symbol.for(
-	"@apifuse/provider-sdk/runtime/trace-export-metadata",
-);
+const TRACE_EXPORT_METADATA = Symbol.for("@apifuse/provider-sdk/runtime/trace-export-metadata");
 
 type TraceExportMetadata = {
 	update(input: { traceId?: string; resourceAttributes?: Record<string, string> }): void;
@@ -109,30 +132,104 @@ export function resolveTraceContextOptions(config?: TraceConfig): CreateTraceCon
 	};
 }
 
-function normalizeAttributeValue(value: unknown): SpanAttributeValue | undefined {
-	if (typeof value === "string" || typeof value === "number" || typeof value === "boolean") {
-		return value;
+function normalizeAttributeValue(
+	value: unknown,
+	redact?: DiagnosticRedactor,
+	retainBigints = false,
+): SpanAttributeValue | bigint | undefined {
+	if (typeof value === "number" || typeof value === "boolean") {
+		// Typed columns are contracts: unlike string tokens, number/boolean/bigint
+		// values only consult the registry at >=8 characters in string form.
+		const text = String(value);
+		if (text.length < 8) return value;
+		const redacted = redactDiagnosticText(text, diagnosticStructuredRedactor(redact));
+		return redacted === text ? value : redacted;
+	}
+	if (typeof value === "bigint") {
+		// Bigints are not valid OTLP attribute primitives, so retain their prior
+		// string normalization while still checking their diagnostic form.
+		const text = String(value);
+		if (text.length < 8) return retainBigints ? value : text;
+		const redacted = redactDiagnosticText(text, diagnosticStructuredRedactor(redact));
+		return retainBigints && redacted === text ? value : redacted;
 	}
 
 	if (value === null || value === undefined) {
 		return undefined;
 	}
 
-	return String(value);
+	return redactDiagnosticText(String(value), redact);
 }
 
+function normalizeAttributes(
+	attributes: Record<string, unknown> | undefined,
+	redact: DiagnosticRedactor | undefined,
+	retainBigints: true,
+): Record<string, SpanAttributeValue | bigint>;
+function normalizeAttributes(
+	attributes?: Record<string, unknown>,
+	redact?: DiagnosticRedactor,
+): Record<string, SpanAttributeValue>;
 function normalizeAttributes(
 	attributes?: Record<string, unknown>,
-): Record<string, SpanAttributeValue> {
+	redact?: DiagnosticRedactor,
+	retainBigints = false,
+): Record<string, SpanAttributeValue | bigint> {
 	if (!attributes) {
 		return {};
 	}
 
+	const nextKey = redactedKeyAllocator(Object.keys(attributes));
 	const normalizedEntries = Object.entries(attributes)
-		.map(([key, value]) => [key, normalizeAttributeValue(value)] as const)
-		.filter((entry): entry is readonly [string, SpanAttributeValue] => entry[1] !== undefined);
+		.map(([key, value]) => {
+			const redactedKey = isRedactedKey(key) ? key : redactDiagnosticAttributeKey(key, redact);
+			const keyChanged = redactedKey !== key;
+			const normalizedKey = keyChanged ? nextKey() : key;
+			// Once a key changes, its original sensitivity classification is no
+			// longer available to later output sanitizers. Suppress the value here.
+			const normalizedValue = keyChanged
+				? redactedKey === REDACTION_FAILED
+					? REDACTION_FAILED
+					: REDACTED_QUERY_VALUE
+				: normalizeAttributeValue(value, diagnosticAttributeRedactor(key, redact), retainBigints);
+			return [normalizedKey, normalizedValue] as const;
+		})
+		.filter(
+			(entry): entry is readonly [string, SpanAttributeValue | bigint] => entry[1] !== undefined,
+		);
+
+	return copyDiagnosticAttributeTypes(attributes, Object.fromEntries(normalizedEntries));
+}
 
-	return Object.fromEntries(normalizedEntries);
+function prepareResourceAttributesForExport(
+	attributes: Record<string, string> | undefined,
+	redact?: DiagnosticRedactor,
+	sanitize?: (attributes: Record<string, string>) => Record<string, string>,
+): Record<string, string> | undefined {
+	if (!attributes) return undefined;
+	if (sanitize) {
+		const sanitized = sanitize({ ...attributes });
+		if (!sanitized || typeof sanitized !== "object") {
+			throw new Error("resource attribute sanitizer returned no attributes");
+		}
+		return sanitized;
+	}
+	const nextKey = redactedKeyAllocator(Object.keys(attributes));
+	return Object.fromEntries(
+		Object.entries(attributes).map(([key, value]) => {
+			const redactedKey = isRedactedKey(key) ? key : redactDiagnosticAttributeKey(key, redact);
+			const keyChanged = redactedKey !== key;
+			const sanitizedKey = keyChanged ? nextKey() : sanitizeSpanNameForOutput(key);
+			return [
+				sanitizedKey,
+				keyChanged
+					? redactedKey === REDACTION_FAILED
+						? REDACTION_FAILED
+						: REDACTED_QUERY_VALUE
+					: sanitizeSpanNameForOutput(value, diagnosticAttributeRedactor(key, redact)),
+			];
+		}),
+	);
 }
 
 function insertCompletedSpan(
@@ -158,7 +255,10 @@ function prepareSpanForExport(
 	span: Span,
 	sanitize: CreateTraceContextOptions["sanitizeSpanForExport"],
 ): Span {
-	const copy: Span = { ...span, attributes: { ...span.attributes } };
+	const copy: Span = {
+		...span,
+		attributes: copyDiagnosticAttributeTypes(span.attributes, { ...span.attributes }),
+	};
 	if (!sanitize) return copy;
 	const sanitized = sanitize(copy);
 	if (!sanitized || typeof sanitized !== "object") {
@@ -171,6 +271,25 @@ export function getTraceRecorder(trace: BaseTraceContext): TraceRecorder | null
 	return (trace as Partial<InternalTraceContext>)[TRACE_RECORDER] ?? null;
 }
 
+const droppedOTLPSpans = new Map<string, number>();
+
+/** Internal, read-only process counters; no reset can re-arm a warning. */
+export function getDroppedOTLPSpanCount(reason: string): number {
+	return droppedOTLPSpans.get(reason) ?? 0;
+}
+
+function warnDroppedOTLPSpans(reason: string, count: number): void {
+	const previous = getDroppedOTLPSpanCount(reason);
+	const total = previous + count;
+	droppedOTLPSpans.set(reason, total);
+	if (previous !== 0) return;
+	try {
+		console.warn(`[apifuse] OTLP export skipped; reason=${reason}; dropped_spans=${total}`);
+	} catch {
+		// Warning sinks are best-effort. The counter/latch survives a failed sink.
+	}
+}
+
 export function createTraceContext(options: CreateTraceContextOptions = {}): TraceContext {
 	if (options.traceId !== undefined) assertValidTraceId(options.traceId);
 	const maxSpans = options.maxSpans ?? 1000;
@@ -180,9 +299,14 @@ export function createTraceContext(options: CreateTraceContextOptions = {}): Tra
 	// Export configuration (which can carry collector credentials) stays in this closure;
 	// the context object handed to provider code never exposes it.
 	const exportOptions = options.exportOptions;
-	const exportResourceAttributes = options.resourceAttributes
-		? { ...options.resourceAttributes }
+	const resourceAttributeOptions = options.resourceAttributes as
+		| ResourceAttributesWithSanitizer
+		| undefined;
+	const exportResourceAttributes = resourceAttributeOptions
+		? { ...resourceAttributeOptions }
 		: undefined;
+	const exportResourceAttributeSanitizer =
+		resourceAttributeOptions?.[TRACE_RESOURCE_ATTRIBUTE_SANITIZER];
 	// One trace id per context so every export batch of this request shares it and
 	// two processes can never mint the same id.
 	let exportTraceId = options.traceId ?? crypto.randomUUID().replace(/-/g, "");
@@ -203,15 +327,30 @@ export function createTraceContext(options: CreateTraceContextOptions = {}): Tra
 			if (pending.length === 0) return;
 			// Sanitization runs off the request path; a faulty sanitizer drops the batch, never the request.
 			let spans: Span[];
+			let resourceAttributes: Record<string, string> | undefined;
 			try {
 				spans = pending.map((entry) =>
 					prepareSpanForExport(entry.span, options.sanitizeSpanForExport),
 				);
+				resourceAttributes = prepareResourceAttributesForExport(
+					exportResourceAttributes,
+					options.redact,
+					exportResourceAttributeSanitizer,
+				);
 			} catch {
-				console.warn("[apifuse] OTLP export skipped; span sanitization failed.");
+				try {
+					console.warn("[apifuse] OTLP export skipped; span sanitization failed.");
+				} catch {
+					// A broken diagnostic sink must not escape this detached callback.
+				}
+				return;
+			}
+			// A matching trace ID cannot be replaced with non-hex text on the wire. Emit less.
+			if (redactCriticalDiagnosticText(exportTraceId, options.redact) !== exportTraceId) {
+				warnDroppedOTLPSpans("unverifiable_trace_id", pending.length);
 				return;
 			}
-			void exportSpansOTLP(spans, exportOptions, exportResourceAttributes, exportTraceId);
+			void exportSpansOTLP(spans, exportOptions, resourceAttributes, exportTraceId);
 		});
 	};
 
@@ -219,11 +358,11 @@ export function createTraceContext(options: CreateTraceContextOptions = {}): Tra
 		async runSpan(name, fn, spanOptions = {}) {
 			const pendingSpan: PendingSpan = {
 				id: crypto.randomUUID(),
-				name,
+				name: redactCriticalDiagnosticText(name, options.redact),
 				startedAt: Date.now(),
 				parentId: activeSpanStorage.getStore()?.id,
 				sequence: sequence++,
-				attributes: normalizeAttributes(spanOptions.attributes),
+				attributes: normalizeAttributes(spanOptions.attributes, options.redact, true),
 			};
 
 			const finalize = (
@@ -235,7 +374,7 @@ export function createTraceContext(options: CreateTraceContextOptions = {}): Tra
 				const duration = endedAt - pendingSpan.startedAt;
 				const attributes = {
 					...pendingSpan.attributes,
-					...normalizeAttributes(extraAttributes),
+					...extraAttributes,
 				};
 
 				if (attributes.duration_ms === undefined) {
@@ -243,15 +382,18 @@ export function createTraceContext(options: CreateTraceContextOptions = {}): Tra
 				}
 
 				const span: Span = {
-					id: pendingSpan.id,
-					name: pendingSpan.name,
+					id: redactCriticalDiagnosticText(pendingSpan.id, options.redact),
+					// Recheck at recording: harvest and live env reads may follow span start.
+					name: redactCriticalDiagnosticText(pendingSpan.name, options.redact),
 					startedAt: pendingSpan.startedAt,
 					endedAt,
 					duration_ms: duration,
 					status,
-					attributes,
-					...(error ? { error } : {}),
-					...(pendingSpan.parentId ? { parentId: pendingSpan.parentId } : {}),
+					attributes: normalizeAttributes(attributes, options.redact),
+					...(error ? { error: redactDiagnosticText(error, options.redact) } : {}),
+					...(pendingSpan.parentId
+						? { parentId: redactCriticalDiagnosticText(pendingSpan.parentId, options.redact) }
+						: {}),
 				};
 
 				insertCompletedSpan(