@apifuse/provider-sdk 2.2.0-beta.59 → 2.2.0-beta.61

package/src/runtime/native-telemetry.ts

@@ -0,0 +1,366 @@
+import { Buffer } from "node:buffer";
+import type { ProviderProxyProvider } from "../types.js";
+import type { NativeNetworkErrorCode } from "./native-network-errors.js";
+import { closedEnum, type ClosedEnum, type TelemetryContributor } from "./request-telemetry.js";
+
+export type NativeTelemetryErrorCode =
+	| NativeNetworkErrorCode
+	| "PROXY_REQUIRED"
+	| "PROXY_ALLOCATION_FAILED"
+	| "other";
+export type NativeTelemetryKind = "tcp" | "tls";
+export type NativeTelemetryOutcome = "ok" | "error";
+export type NativeTelemetryVendorSkipReason =
+	| "credentials_absent"
+	| "protocol_unsupported"
+	| "allocation_failed"
+	| "credential_lookup_failed"
+	| "adapter_unavailable";
+export type NativeTelemetryLifecycleKind =
+	| "drain"
+	| "drain_acknowledged"
+	| "drain_error"
+	| "drain_missing_handler"
+	| "idle"
+	| "expiry";
+
+/** Operator-only text is redacted before it is detached and bounded to 300 code units. */
+export type NativeTelemetryDiagnostics = {
+	host?: string;
+	serverName?: string;
+	protocol?: string;
+	sessionId?: string;
+	expiresAt?: string;
+	errorName?: string;
+	errorMessage?: string;
+	causeName?: string;
+	causeMessage?: string;
+	systemCode?: string;
+	missingFields?: readonly string[];
+	port?: number;
+	timeoutMs?: number;
+	idleTimeoutMs?: number;
+	status?: number;
+	socksReplyCode?: number;
+	sticky?: boolean;
+};
+
+export type NativeConnectTelemetryEvent = {
+	kind: NativeTelemetryKind;
+	outcome: NativeTelemetryOutcome;
+	/** Entire establishment, including lease resolution, tunnel and TLS handshake. */
+	ms: number;
+	/** Tunnel establishment only; included in ms, never added to it. */
+	tunnelMs: number;
+	proxyUsed: boolean;
+	/** Selected vendor for this connection; operator log only. */
+	vendor?: ProviderProxyProvider;
+	errorCode?: NativeTelemetryErrorCode;
+	diagnostics?: NativeTelemetryDiagnostics;
+};
+export type NativeVendorSkipTelemetryEvent = {
+	vendor: ProviderProxyProvider;
+	reason: NativeTelemetryVendorSkipReason;
+	diagnostics?: NativeTelemetryDiagnostics;
+};
+export type NativeLifecycleTelemetryEvent = {
+	kind: NativeTelemetryLifecycleKind;
+	errorCode?: NativeTelemetryErrorCode;
+	diagnostics?: NativeTelemetryDiagnostics;
+};
+
+export interface NativeTelemetrySink {
+	recordConnect(event: NativeConnectTelemetryEvent): void;
+	recordVendorSkip(event: NativeVendorSkipTelemetryEvent): void;
+	recordLifecycle(event: NativeLifecycleTelemetryEvent): void;
+	/** Application bytes returned by read or accepted by a successful write. Excludes tunnel/TLS framing. */
+	recordBytes(event: { direction: "in" | "out"; bytes: number }): void;
+	recordError(event: {
+		errorCode: NativeTelemetryErrorCode;
+		diagnostics?: NativeTelemetryDiagnostics;
+	}): void;
+}
+
+export type NativeAttemptSample = NativeConnectTelemetryEvent & { n: number };
+export type NativeTelemetryLogPayload = {
+	attempts: number;
+	connectMs: number;
+	tunnelMs: number;
+	vendorSkips: number;
+	vendorSkipReasons: { reason: NativeTelemetryVendorSkipReason; count: number }[];
+	drain: number;
+	drainAcknowledged: number;
+	drainErrors: number;
+	drainMissingHandler: number;
+	idle: number;
+	expiry: number;
+	bytesIn: number;
+	bytesOut: number;
+	lastErrorCode?: NativeTelemetryErrorCode;
+	lastErrorDiagnostics?: NativeTelemetryDiagnostics;
+	attemptSamples?: NativeAttemptSample[];
+	attemptSamplesDropped?: number;
+	vendorSkipSamples?: NativeVendorSkipTelemetryEvent[];
+	vendorSkipSamplesDropped?: number;
+};
+
+export type NativeTelemetryHeaderPayload = {
+	attempts: number;
+	connectMs: number;
+	tunnelMs: number;
+	vendorSkips: number;
+	vendorSkipReasons: { reason: ClosedEnum<NativeTelemetryVendorSkipReason>; count: number }[];
+	drain: number;
+	drainAcknowledged: number;
+	drainErrors: number;
+	drainMissingHandler: number;
+	idle: number;
+	expiry: number;
+	bytesIn: number;
+	bytesOut: number;
+	lastErrorCode?: ClosedEnum<NativeTelemetryErrorCode>;
+	attemptSamples?: {
+		n: number;
+		kind: ClosedEnum<NativeTelemetryKind>;
+		outcome: ClosedEnum<NativeTelemetryOutcome>;
+		ms: number;
+		tunnelMs: number;
+		proxyUsed: boolean;
+		errorCode?: ClosedEnum<NativeTelemetryErrorCode>;
+	}[];
+	attemptSamplesDropped?: number;
+	vendorSkipSamplesDropped?: number;
+};
+
+const MAX_SAMPLES = 24;
+function integer(value: number): number {
+	return Math.max(0, Math.floor(Number.isFinite(value) ? value : 0));
+}
+function saturatingAdd(a: number, b: number): number {
+	if (!Number.isFinite(a) || !Number.isFinite(b)) return Number.MAX_SAFE_INTEGER;
+	return Math.min(Number.MAX_SAFE_INTEGER, integer(a) + integer(b));
+}
+function boundedText(value: string, redact?: (text: string) => string): string {
+	let result: string;
+	try {
+		result = redact ? redact(value) : value;
+		if (typeof result !== "string") return "[REDACTION_FAILED]";
+	} catch {
+		return "[REDACTION_FAILED]";
+	}
+	// Do not slice caller text: a substring may retain the entire vendor response.
+	const length = Math.min(result.length, 300);
+	const units = Buffer.alloc(length * 2);
+	for (let index = 0; index < length; index++)
+		units.writeUInt16LE(result.charCodeAt(index), index * 2);
+	return units.toString("utf16le");
+}
+function diagnostics(
+	value: NativeTelemetryDiagnostics,
+	redact?: (text: string) => string,
+): NativeTelemetryDiagnostics {
+	const result: NativeTelemetryDiagnostics = {};
+	for (const key of [
+		"host",
+		"serverName",
+		"protocol",
+		"sessionId",
+		"expiresAt",
+		"errorName",
+		"errorMessage",
+		"causeName",
+		"causeMessage",
+		"systemCode",
+	] as const) {
+		if (value[key] !== undefined) result[key] = boundedText(value[key], redact);
+	}
+	for (const key of ["port", "timeoutMs", "idleTimeoutMs", "status", "socksReplyCode"] as const) {
+		if (value[key] !== undefined) result[key] = integer(value[key]);
+	}
+	if (value.sticky !== undefined) result.sticky = value.sticky;
+	if (value.missingFields)
+		result.missingFields = value.missingFields
+			.slice(0, MAX_SAMPLES)
+			.map((field) => boundedText(field, redact));
+	return result;
+}
+function copyDiagnostics(value: NativeTelemetryDiagnostics): NativeTelemetryDiagnostics {
+	return { ...value, ...(value.missingFields ? { missingFields: [...value.missingFields] } : {}) };
+}
+
+export class NativeTelemetryCollector
+	implements
+		NativeTelemetrySink,
+		TelemetryContributor<NativeTelemetryLogPayload, NativeTelemetryHeaderPayload>
+{
+	readonly key = "native" as const;
+	readonly #redact: ((text: string) => string) | undefined;
+	#recorded = false;
+	#attempts = 0;
+	#connectMs = 0;
+	#tunnelMs = 0;
+	#vendorSkips = 0;
+	#vendorSkipReasons = new Map<NativeTelemetryVendorSkipReason, number>();
+	#lifecycle = {
+		drain: 0,
+		drain_acknowledged: 0,
+		drain_error: 0,
+		drain_missing_handler: 0,
+		idle: 0,
+		expiry: 0,
+	};
+	#bytesIn = 0;
+	#bytesOut = 0;
+	#lastErrorCode: NativeTelemetryErrorCode | undefined;
+	#lastErrorDiagnostics: NativeTelemetryDiagnostics | undefined;
+	#attemptSamples: NativeAttemptSample[] = [];
+	#attemptSamplesDropped = 0;
+	#vendorSkipSamples: NativeVendorSkipTelemetryEvent[] = [];
+	#vendorSkipSamplesDropped = 0;
+
+	constructor(options: { redact?: (text: string) => string } = {}) {
+		this.#redact = options.redact;
+	}
+
+	recordConnect(event: NativeConnectTelemetryEvent): void {
+		this.#recorded = true;
+		const ms = saturatingAdd(0, event.ms);
+		const tunnelMs = saturatingAdd(0, event.tunnelMs);
+		this.#attempts = saturatingAdd(this.#attempts, 1);
+		this.#connectMs = saturatingAdd(this.#connectMs, ms);
+		this.#tunnelMs = saturatingAdd(this.#tunnelMs, tunnelMs);
+		if (event.errorCode)
+			this.recordError({ errorCode: event.errorCode, diagnostics: event.diagnostics });
+		if (this.#attemptSamples.length < MAX_SAMPLES) {
+			this.#attemptSamples.push({
+				n: this.#attempts,
+				kind: event.kind,
+				outcome: event.outcome,
+				ms,
+				tunnelMs,
+				proxyUsed: event.proxyUsed,
+				...(event.vendor ? { vendor: event.vendor } : {}),
+				...(event.errorCode ? { errorCode: event.errorCode } : {}),
+				...(event.diagnostics ? { diagnostics: diagnostics(event.diagnostics, this.#redact) } : {}),
+			});
+		} else this.#attemptSamplesDropped = saturatingAdd(this.#attemptSamplesDropped, 1);
+	}
+	recordVendorSkip(event: NativeVendorSkipTelemetryEvent): void {
+		this.#recorded = true;
+		this.#vendorSkips = saturatingAdd(this.#vendorSkips, 1);
+		this.#vendorSkipReasons.set(
+			event.reason,
+			saturatingAdd(this.#vendorSkipReasons.get(event.reason) ?? 0, 1),
+		);
+		if (this.#vendorSkipSamples.length < MAX_SAMPLES) {
+			this.#vendorSkipSamples.push({
+				vendor: event.vendor,
+				reason: event.reason,
+				...(event.diagnostics ? { diagnostics: diagnostics(event.diagnostics, this.#redact) } : {}),
+			});
+		} else this.#vendorSkipSamplesDropped = saturatingAdd(this.#vendorSkipSamplesDropped, 1);
+	}
+	recordLifecycle(event: NativeLifecycleTelemetryEvent): void {
+		this.#recorded = true;
+		this.#lifecycle[event.kind] = saturatingAdd(this.#lifecycle[event.kind], 1);
+		if (event.errorCode)
+			this.recordError({ errorCode: event.errorCode, diagnostics: event.diagnostics });
+	}
+	recordBytes(event: { direction: "in" | "out"; bytes: number }): void {
+		this.#recorded = true;
+		if (event.direction === "in") this.#bytesIn = saturatingAdd(this.#bytesIn, event.bytes);
+		else this.#bytesOut = saturatingAdd(this.#bytesOut, event.bytes);
+	}
+	recordError(event: {
+		errorCode: NativeTelemetryErrorCode;
+		diagnostics?: NativeTelemetryDiagnostics;
+	}): void {
+		this.#recorded = true;
+		this.#lastErrorCode = event.errorCode;
+		this.#lastErrorDiagnostics = event.diagnostics
+			? diagnostics(event.diagnostics, this.#redact)
+			: undefined;
+	}
+	toLogPayload(): NativeTelemetryLogPayload | undefined {
+		if (!this.#recorded) return undefined;
+		return {
+			attempts: this.#attempts,
+			connectMs: this.#connectMs,
+			tunnelMs: this.#tunnelMs,
+			vendorSkips: this.#vendorSkips,
+			vendorSkipReasons: [...this.#vendorSkipReasons].map(([reason, count]) => ({ reason, count })),
+			drain: this.#lifecycle.drain,
+			drainAcknowledged: this.#lifecycle.drain_acknowledged,
+			drainErrors: this.#lifecycle.drain_error,
+			drainMissingHandler: this.#lifecycle.drain_missing_handler,
+			idle: this.#lifecycle.idle,
+			expiry: this.#lifecycle.expiry,
+			bytesIn: this.#bytesIn,
+			bytesOut: this.#bytesOut,
+			...(this.#lastErrorCode ? { lastErrorCode: this.#lastErrorCode } : {}),
+			...(this.#lastErrorDiagnostics
+				? { lastErrorDiagnostics: copyDiagnostics(this.#lastErrorDiagnostics) }
+				: {}),
+			...(this.#attemptSamples.length
+				? {
+						attemptSamples: this.#attemptSamples.map((sample) => ({
+							...sample,
+							...(sample.diagnostics ? { diagnostics: copyDiagnostics(sample.diagnostics) } : {}),
+						})),
+					}
+				: {}),
+			...(this.#attemptSamplesDropped
+				? { attemptSamplesDropped: this.#attemptSamplesDropped }
+				: {}),
+			...(this.#vendorSkipSamples.length
+				? {
+						vendorSkipSamples: this.#vendorSkipSamples.map((sample) => ({
+							...sample,
+							...(sample.diagnostics ? { diagnostics: copyDiagnostics(sample.diagnostics) } : {}),
+						})),
+					}
+				: {}),
+			...(this.#vendorSkipSamplesDropped
+				? { vendorSkipSamplesDropped: this.#vendorSkipSamplesDropped }
+				: {}),
+		};
+	}
+	toHeaderPayload(log: NativeTelemetryLogPayload): NativeTelemetryHeaderPayload {
+		return {
+			attempts: log.attempts,
+			connectMs: log.connectMs,
+			tunnelMs: log.tunnelMs,
+			vendorSkips: log.vendorSkips,
+			vendorSkipReasons: log.vendorSkipReasons.map(({ reason, count }) => ({
+				reason: closedEnum(reason),
+				count,
+			})),
+			drain: log.drain,
+			drainAcknowledged: log.drainAcknowledged,
+			drainErrors: log.drainErrors,
+			drainMissingHandler: log.drainMissingHandler,
+			idle: log.idle,
+			expiry: log.expiry,
+			bytesIn: log.bytesIn,
+			bytesOut: log.bytesOut,
+			...(log.lastErrorCode ? { lastErrorCode: closedEnum(log.lastErrorCode) } : {}),
+			...(log.attemptSamples
+				? {
+						attemptSamples: log.attemptSamples.map((sample) => ({
+							n: sample.n,
+							kind: closedEnum(sample.kind),
+							outcome: closedEnum(sample.outcome),
+							ms: sample.ms,
+							tunnelMs: sample.tunnelMs,
+							proxyUsed: sample.proxyUsed,
+							...(sample.errorCode ? { errorCode: closedEnum(sample.errorCode) } : {}),
+						})),
+					}
+				: {}),
+			...(log.attemptSamplesDropped ? { attemptSamplesDropped: log.attemptSamplesDropped } : {}),
+			...(log.vendorSkipSamplesDropped
+				? { vendorSkipSamplesDropped: log.vendorSkipSamplesDropped }
+				: {}),
+		};
+	}
+}

package/src/runtime/ocr.ts

@@ -1,3 +1,4 @@
+import { readDiagnosticEnv } from "./diagnostic-env.js";
 import { ProviderError, TransportError } from "../errors.js";
 import type {
 	OcrCaptchaCandidate,
@@ -96,7 +97,7 @@ export function createUnsupportedOcrClient(reason?: string): OcrContext {
 }
 
 function normalizedEnvValue(env: EnvLike, key: string): string | undefined {
-	const value = env[key]?.trim();
+	const value = readDiagnosticEnv(key, env)?.trim();
 	return value ? value : undefined;
 }
 

package/src/runtime/otlp.ts

@@ -1,3 +1,4 @@
+import { readDiagnosticEnv } from "./diagnostic-env.js";
 import { AsyncResource } from "node:async_hooks";
 
 import type { TraceSpan } from "../types.js";
@@ -153,12 +154,12 @@ export function resolveOTLPExportOptions(
 		{ source: EXPLICIT_ENDPOINT_SOURCE, value: explicit.endpoint, appendPath: false },
 		{
 			source: OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,
-			value: env[OTEL_EXPORTER_OTLP_TRACES_ENDPOINT],
+			value: readDiagnosticEnv(OTEL_EXPORTER_OTLP_TRACES_ENDPOINT, env),
 			appendPath: false,
 		},
 		{
 			source: OTEL_EXPORTER_OTLP_ENDPOINT,
-			value: env[OTEL_EXPORTER_OTLP_ENDPOINT],
+			value: readDiagnosticEnv(OTEL_EXPORTER_OTLP_ENDPOINT, env),
 			appendPath: true,
 		},
 	];
@@ -173,11 +174,11 @@ export function resolveOTLPExportOptions(
 	}
 	const endpoint = candidate.appendPath ? appendTracesPath(parsed.url) : candidate.value;
 
-	const tracesHeaders = presentValue(env[OTEL_EXPORTER_OTLP_TRACES_HEADERS]);
+	const tracesHeaders = presentValue(readDiagnosticEnv(OTEL_EXPORTER_OTLP_TRACES_HEADERS, env));
 	const headersSource =
 		tracesHeaders !== undefined ? OTEL_EXPORTER_OTLP_TRACES_HEADERS : OTEL_EXPORTER_OTLP_HEADERS;
 	const envHeaders = parseHeaderList(
-		tracesHeaders ?? presentValue(env[OTEL_EXPORTER_OTLP_HEADERS]),
+		tracesHeaders ?? presentValue(readDiagnosticEnv(OTEL_EXPORTER_OTLP_HEADERS, env)),
 	);
 	if (!headersAreSendable(envHeaders)) {
 		return { status: "invalid", source: headersSource, reason: INVALID_HEADERS };

package/src/runtime/proxy-nodemaven.ts

@@ -1,3 +1,4 @@
+import { readDiagnosticEnv } from "./diagnostic-env.js";
 import { createHash, randomBytes } from "node:crypto";
 
 import type { ProviderProxyPolicy } from "../types.js";
@@ -43,11 +44,11 @@ export function hasNodemavenCredentials(): boolean {
 }
 
 function readNodemavenUsername(): string | undefined {
-	return process.env[NODEMAVEN_USERNAME_ENV]?.trim() || undefined;
+	return readDiagnosticEnv(NODEMAVEN_USERNAME_ENV)?.trim() || undefined;
 }
 
 function readNodemavenPassword(): string | undefined {
-	return process.env[NODEMAVEN_PASSWORD_ENV]?.trim() || undefined;
+	return readDiagnosticEnv(NODEMAVEN_PASSWORD_ENV)?.trim() || undefined;
 }
 
 function resolveNodemavenFilter(value: string | undefined): string {

package/src/runtime/request-options.ts

@@ -1,3 +1,4 @@
+import { isProviderError } from "../errors.js";
 import type {
 	HttpClient,
 	RequestOptions,
@@ -5,7 +6,6 @@ import type {
 	RequestParams,
 	RequestParamValue,
 } from "../types.js";
-import { isProviderError } from "../errors.js";
 
 export const REDACTED_QUERY_VALUE = "[REDACTED]";
 
@@ -161,15 +161,34 @@ export function serializeRequestUrl(
 	};
 }
 
-const MIN_UNSCOPED_SENSITIVE_VALUE_LENGTH = 4;
+const MIN_UNSCOPED_SENSITIVE_VALUE_LENGTH = 8;
 
-function normalizePercentEscapes(value: string): string {
+export function normalizePercentEscapes(value: string): string {
 	return value.replace(/%[\da-f]{2}/gi, (percentEscape) => percentEscape.toUpperCase());
 }
 
 function sensitiveValueVariants(value: string): string[] {
 	if (!value || value === REDACTED_QUERY_VALUE) return [];
 
+	// Owner-visible policy: short credentials are literal, case-sensitive tokens only.
+	// Encoded short needles collide with benign cursors and ordinary diagnostic text.
+	if (value.length < 8) return [value];
+	// These ASCII characters are identical under NFC, JSON, URI-component and
+	// form encoding. Avoid constructing those identical variants for common tokens.
+	if (/^[A-Za-z0-9._*-]+$/.test(value)) {
+		const base64 = Buffer.from(value, "utf8").toString("base64");
+		const base64Url = base64.replaceAll("+", "-").replaceAll("/", "_");
+		return [
+			...new Set([
+				value,
+				base64,
+				base64.replace(/=+$/, ""),
+				base64Url,
+				base64Url.replace(/=+$/, ""),
+			]),
+		];
+	}
+	const normalized = value.normalize("NFC");
 	const formEncoded = new URLSearchParams({ value }).toString().slice("value=".length);
 	let componentEncoded: string;
 	try {
@@ -179,15 +198,42 @@ function sensitiveValueVariants(value: string): string[] {
 		// still safe to scrub, and URLSearchParams supplies its well-formed form.
 		componentEncoded = value;
 	}
-	return [...new Set([value, componentEncoded, formEncoded].map(normalizePercentEscapes))];
-}
-
-type SensitiveValueVariant = { value: string; requiresTokenBoundary: boolean };
+	const base64 = Buffer.from(value, "utf8").toString("base64");
+	const base64Url = base64.replaceAll("+", "-").replaceAll("/", "_");
+	const jsonEscaped = JSON.stringify(value).slice(1, -1);
+	return [
+		...new Set(
+			[
+				value,
+				normalized,
+				componentEncoded,
+				formEncoded,
+				jsonEscaped,
+				base64,
+				base64.replace(/=+$/, ""),
+				base64Url,
+				base64Url.replace(/=+$/, ""),
+			].map(normalizePercentEscapes),
+		),
+	];
+}
+
+export type SensitiveValueVariant = {
+	value: string;
+	requiresTokenBoundary: boolean;
+	caseInsensitive: boolean;
+};
 
-function allSensitiveValueVariants(sensitiveValues: readonly string[]): SensitiveValueVariant[] {
+export function allSensitiveValueVariants(
+	sensitiveValues: readonly string[],
+): SensitiveValueVariant[] {
 	const variants = new Map<string, SensitiveValueVariant>();
 	for (const sensitiveValue of sensitiveValues) {
 		const requiresTokenBoundary = sensitiveValue.length < MIN_UNSCOPED_SENSITIVE_VALUE_LENGTH;
+		// Long values are unlikely to be ordinary prose, so case folding is worth
+		// the extra over-redaction protection. Values of 4-7 characters remain
+		// case-sensitive because they commonly occur as words and identifiers.
+		const caseInsensitive = sensitiveValue.length >= 8;
 		for (const value of sensitiveValueVariants(sensitiveValue)) {
 			const existing = variants.get(value);
 			variants.set(value, {
@@ -195,6 +241,7 @@ function allSensitiveValueVariants(sensitiveValues: readonly string[]): Sensitiv
 				requiresTokenBoundary: existing
 					? existing.requiresTokenBoundary && requiresTokenBoundary
 					: requiresTokenBoundary,
+				caseInsensitive: existing ? existing.caseInsensitive || caseInsensitive : caseInsensitive,
 			});
 		}
 	}
@@ -209,28 +256,29 @@ function isTokenCharacter(value: string | undefined): boolean {
 }
 
 function replaceSensitiveVariant(text: string, variant: SensitiveValueVariant): string {
-	const pattern = variant.value.replace(/%([\da-f]{2})|[.*+?^${}()|[\]\\]/gi, (match, hex) => {
-		if (hex) {
-			return `%${[...String(hex)]
-				.map((character) =>
-					/[a-f]/i.test(character)
-						? `[${character.toLowerCase()}${character.toUpperCase()}]`
-						: character,
-				)
-				.join("")}`;
-		}
-		return `\\${match}`;
-	});
-	return text.replace(new RegExp(pattern, "gu"), (match, offset: number, source: string) => {
-		const end = offset + match.length;
+	const normalized = normalizePercentEscapes(text);
+	const comparable = variant.caseInsensitive ? normalized.toLowerCase() : text;
+	const needle = variant.caseInsensitive ? variant.value.toLowerCase() : variant.value;
+	let cursor = 0;
+	let output = "";
+	for (
+		let index = comparable.indexOf(needle);
+		index !== -1;
+		index = comparable.indexOf(needle, index + 1)
+	) {
+		const end = index + needle.length;
 		if (
 			variant.requiresTokenBoundary &&
-			(isTokenCharacter(source[offset - 1]) || isTokenCharacter(source[end]))
-		) {
-			return match;
-		}
-		return REDACTED_QUERY_VALUE;
-	});
+			(isTokenCharacter(comparable[index - 1]) || isTokenCharacter(comparable[end]))
+		)
+			continue;
+		// Unicode folding can change offsets; suppress the field instead of slicing a secret.
+		if (comparable.length !== text.length) return REDACTED_QUERY_VALUE;
+		output += text.slice(cursor, index) + REDACTED_QUERY_VALUE;
+		cursor = end;
+		index = end - 1;
+	}
+	return cursor ? output + text.slice(cursor) : text;
 }
 
 /** Scrubs raw and URL-encoded secret values from diagnostic text. */

package/src/runtime/resolver-vendors/browser.ts

@@ -173,7 +173,6 @@ async function runBoundedCleanup(
 			onError(error) {
 				return {
 					error_message: error instanceof Error ? error.message : String(error),
-					...(error instanceof Error && error.stack ? { error_stack: error.stack } : {}),
 				};
 			},
 		})

package/src/runtime/resolver.ts

@@ -1,3 +1,4 @@
+import { readDiagnosticEnv } from "./diagnostic-env.js";
 import { createHash } from "node:crypto";
 
 import {
@@ -309,12 +310,12 @@ type ResolverChainEntry = {
 };
 
 function normalizedEnvValue(env: EnvLike, key: string): string | undefined {
-	const value = env[key]?.trim();
+	const value = readDiagnosticEnv(key, env)?.trim();
 	return value ? value : undefined;
 }
 
 function readPositiveIntegerEnv(env: EnvLike, name: string): string | undefined {
-	const raw = env[name]?.trim();
+	const raw = readDiagnosticEnv(name, env)?.trim();
 	if (!raw) return undefined;
 	if (!/^[1-9]\d*$/.test(raw)) {
 		throw new Error(`${name} must be a positive integer`);