@apifuse/provider-sdk 2.2.0-beta.59 → 2.2.0-beta.61

package/dist/runtime/native-telemetry.js

@@ -0,0 +1,231 @@
+import { Buffer } from "node:buffer";
+import { closedEnum } from "./request-telemetry.js";
+const MAX_SAMPLES = 24;
+function integer(value) {
+    return Math.max(0, Math.floor(Number.isFinite(value) ? value : 0));
+}
+function saturatingAdd(a, b) {
+    if (!Number.isFinite(a) || !Number.isFinite(b))
+        return Number.MAX_SAFE_INTEGER;
+    return Math.min(Number.MAX_SAFE_INTEGER, integer(a) + integer(b));
+}
+function boundedText(value, redact) {
+    let result;
+    try {
+        result = redact ? redact(value) : value;
+        if (typeof result !== "string")
+            return "[REDACTION_FAILED]";
+    }
+    catch {
+        return "[REDACTION_FAILED]";
+    }
+    // Do not slice caller text: a substring may retain the entire vendor response.
+    const length = Math.min(result.length, 300);
+    const units = Buffer.alloc(length * 2);
+    for (let index = 0; index < length; index++)
+        units.writeUInt16LE(result.charCodeAt(index), index * 2);
+    return units.toString("utf16le");
+}
+function diagnostics(value, redact) {
+    const result = {};
+    for (const key of [
+        "host",
+        "serverName",
+        "protocol",
+        "sessionId",
+        "expiresAt",
+        "errorName",
+        "errorMessage",
+        "causeName",
+        "causeMessage",
+        "systemCode",
+    ]) {
+        if (value[key] !== undefined)
+            result[key] = boundedText(value[key], redact);
+    }
+    for (const key of ["port", "timeoutMs", "idleTimeoutMs", "status", "socksReplyCode"]) {
+        if (value[key] !== undefined)
+            result[key] = integer(value[key]);
+    }
+    if (value.sticky !== undefined)
+        result.sticky = value.sticky;
+    if (value.missingFields)
+        result.missingFields = value.missingFields
+            .slice(0, MAX_SAMPLES)
+            .map((field) => boundedText(field, redact));
+    return result;
+}
+function copyDiagnostics(value) {
+    return { ...value, ...(value.missingFields ? { missingFields: [...value.missingFields] } : {}) };
+}
+export class NativeTelemetryCollector {
+    key = "native";
+    #redact;
+    #recorded = false;
+    #attempts = 0;
+    #connectMs = 0;
+    #tunnelMs = 0;
+    #vendorSkips = 0;
+    #vendorSkipReasons = new Map();
+    #lifecycle = {
+        drain: 0,
+        drain_acknowledged: 0,
+        drain_error: 0,
+        drain_missing_handler: 0,
+        idle: 0,
+        expiry: 0,
+    };
+    #bytesIn = 0;
+    #bytesOut = 0;
+    #lastErrorCode;
+    #lastErrorDiagnostics;
+    #attemptSamples = [];
+    #attemptSamplesDropped = 0;
+    #vendorSkipSamples = [];
+    #vendorSkipSamplesDropped = 0;
+    constructor(options = {}) {
+        this.#redact = options.redact;
+    }
+    recordConnect(event) {
+        this.#recorded = true;
+        const ms = saturatingAdd(0, event.ms);
+        const tunnelMs = saturatingAdd(0, event.tunnelMs);
+        this.#attempts = saturatingAdd(this.#attempts, 1);
+        this.#connectMs = saturatingAdd(this.#connectMs, ms);
+        this.#tunnelMs = saturatingAdd(this.#tunnelMs, tunnelMs);
+        if (event.errorCode)
+            this.recordError({ errorCode: event.errorCode, diagnostics: event.diagnostics });
+        if (this.#attemptSamples.length < MAX_SAMPLES) {
+            this.#attemptSamples.push({
+                n: this.#attempts,
+                kind: event.kind,
+                outcome: event.outcome,
+                ms,
+                tunnelMs,
+                proxyUsed: event.proxyUsed,
+                ...(event.vendor ? { vendor: event.vendor } : {}),
+                ...(event.errorCode ? { errorCode: event.errorCode } : {}),
+                ...(event.diagnostics ? { diagnostics: diagnostics(event.diagnostics, this.#redact) } : {}),
+            });
+        }
+        else
+            this.#attemptSamplesDropped = saturatingAdd(this.#attemptSamplesDropped, 1);
+    }
+    recordVendorSkip(event) {
+        this.#recorded = true;
+        this.#vendorSkips = saturatingAdd(this.#vendorSkips, 1);
+        this.#vendorSkipReasons.set(event.reason, saturatingAdd(this.#vendorSkipReasons.get(event.reason) ?? 0, 1));
+        if (this.#vendorSkipSamples.length < MAX_SAMPLES) {
+            this.#vendorSkipSamples.push({
+                vendor: event.vendor,
+                reason: event.reason,
+                ...(event.diagnostics ? { diagnostics: diagnostics(event.diagnostics, this.#redact) } : {}),
+            });
+        }
+        else
+            this.#vendorSkipSamplesDropped = saturatingAdd(this.#vendorSkipSamplesDropped, 1);
+    }
+    recordLifecycle(event) {
+        this.#recorded = true;
+        this.#lifecycle[event.kind] = saturatingAdd(this.#lifecycle[event.kind], 1);
+        if (event.errorCode)
+            this.recordError({ errorCode: event.errorCode, diagnostics: event.diagnostics });
+    }
+    recordBytes(event) {
+        this.#recorded = true;
+        if (event.direction === "in")
+            this.#bytesIn = saturatingAdd(this.#bytesIn, event.bytes);
+        else
+            this.#bytesOut = saturatingAdd(this.#bytesOut, event.bytes);
+    }
+    recordError(event) {
+        this.#recorded = true;
+        this.#lastErrorCode = event.errorCode;
+        this.#lastErrorDiagnostics = event.diagnostics
+            ? diagnostics(event.diagnostics, this.#redact)
+            : undefined;
+    }
+    toLogPayload() {
+        if (!this.#recorded)
+            return undefined;
+        return {
+            attempts: this.#attempts,
+            connectMs: this.#connectMs,
+            tunnelMs: this.#tunnelMs,
+            vendorSkips: this.#vendorSkips,
+            vendorSkipReasons: [...this.#vendorSkipReasons].map(([reason, count]) => ({ reason, count })),
+            drain: this.#lifecycle.drain,
+            drainAcknowledged: this.#lifecycle.drain_acknowledged,
+            drainErrors: this.#lifecycle.drain_error,
+            drainMissingHandler: this.#lifecycle.drain_missing_handler,
+            idle: this.#lifecycle.idle,
+            expiry: this.#lifecycle.expiry,
+            bytesIn: this.#bytesIn,
+            bytesOut: this.#bytesOut,
+            ...(this.#lastErrorCode ? { lastErrorCode: this.#lastErrorCode } : {}),
+            ...(this.#lastErrorDiagnostics
+                ? { lastErrorDiagnostics: copyDiagnostics(this.#lastErrorDiagnostics) }
+                : {}),
+            ...(this.#attemptSamples.length
+                ? {
+                    attemptSamples: this.#attemptSamples.map((sample) => ({
+                        ...sample,
+                        ...(sample.diagnostics ? { diagnostics: copyDiagnostics(sample.diagnostics) } : {}),
+                    })),
+                }
+                : {}),
+            ...(this.#attemptSamplesDropped
+                ? { attemptSamplesDropped: this.#attemptSamplesDropped }
+                : {}),
+            ...(this.#vendorSkipSamples.length
+                ? {
+                    vendorSkipSamples: this.#vendorSkipSamples.map((sample) => ({
+                        ...sample,
+                        ...(sample.diagnostics ? { diagnostics: copyDiagnostics(sample.diagnostics) } : {}),
+                    })),
+                }
+                : {}),
+            ...(this.#vendorSkipSamplesDropped
+                ? { vendorSkipSamplesDropped: this.#vendorSkipSamplesDropped }
+                : {}),
+        };
+    }
+    toHeaderPayload(log) {
+        return {
+            attempts: log.attempts,
+            connectMs: log.connectMs,
+            tunnelMs: log.tunnelMs,
+            vendorSkips: log.vendorSkips,
+            vendorSkipReasons: log.vendorSkipReasons.map(({ reason, count }) => ({
+                reason: closedEnum(reason),
+                count,
+            })),
+            drain: log.drain,
+            drainAcknowledged: log.drainAcknowledged,
+            drainErrors: log.drainErrors,
+            drainMissingHandler: log.drainMissingHandler,
+            idle: log.idle,
+            expiry: log.expiry,
+            bytesIn: log.bytesIn,
+            bytesOut: log.bytesOut,
+            ...(log.lastErrorCode ? { lastErrorCode: closedEnum(log.lastErrorCode) } : {}),
+            ...(log.attemptSamples
+                ? {
+                    attemptSamples: log.attemptSamples.map((sample) => ({
+                        n: sample.n,
+                        kind: closedEnum(sample.kind),
+                        outcome: closedEnum(sample.outcome),
+                        ms: sample.ms,
+                        tunnelMs: sample.tunnelMs,
+                        proxyUsed: sample.proxyUsed,
+                        ...(sample.errorCode ? { errorCode: closedEnum(sample.errorCode) } : {}),
+                    })),
+                }
+                : {}),
+            ...(log.attemptSamplesDropped ? { attemptSamplesDropped: log.attemptSamplesDropped } : {}),
+            ...(log.vendorSkipSamplesDropped
+                ? { vendorSkipSamplesDropped: log.vendorSkipSamplesDropped }
+                : {}),
+        };
+    }
+}

package/dist/runtime/ocr.js

@@ -1,3 +1,4 @@
+import { readDiagnosticEnv } from "./diagnostic-env.js";
 import { ProviderError, TransportError } from "../errors.js";
 import { CLOUDFLARE_ACCOUNT_ID_ENV } from "./stt.js";
 import { createTimeoutController, isTimeoutLikeError } from "./timeout.js";
@@ -55,7 +56,7 @@ export function createUnsupportedOcrClient(reason) {
     });
 }
 function normalizedEnvValue(env, key) {
-    const value = env[key]?.trim();
+    const value = readDiagnosticEnv(key, env)?.trim();
     return value ? value : undefined;
 }
 export function createOcrClientFromEnv(config, env = process.env) {

package/dist/runtime/otlp.js

@@ -1,3 +1,4 @@
+import { readDiagnosticEnv } from "./diagnostic-env.js";
 import { AsyncResource } from "node:async_hooks";
 export const OTEL_EXPORTER_OTLP_TRACES_ENDPOINT = "OTEL_EXPORTER_OTLP_TRACES_ENDPOINT";
 export const OTEL_EXPORTER_OTLP_ENDPOINT = "OTEL_EXPORTER_OTLP_ENDPOINT";
@@ -118,12 +119,12 @@ export function resolveOTLPExportOptions(explicit, env = process.env) {
         { source: EXPLICIT_ENDPOINT_SOURCE, value: explicit.endpoint, appendPath: false },
         {
             source: OTEL_EXPORTER_OTLP_TRACES_ENDPOINT,
-            value: env[OTEL_EXPORTER_OTLP_TRACES_ENDPOINT],
+            value: readDiagnosticEnv(OTEL_EXPORTER_OTLP_TRACES_ENDPOINT, env),
             appendPath: false,
         },
         {
             source: OTEL_EXPORTER_OTLP_ENDPOINT,
-            value: env[OTEL_EXPORTER_OTLP_ENDPOINT],
+            value: readDiagnosticEnv(OTEL_EXPORTER_OTLP_ENDPOINT, env),
             appendPath: true,
         },
     ];
@@ -137,9 +138,9 @@ export function resolveOTLPExportOptions(explicit, env = process.env) {
         return { status: "invalid", source: candidate.source, reason: parsed.reason };
     }
     const endpoint = candidate.appendPath ? appendTracesPath(parsed.url) : candidate.value;
-    const tracesHeaders = presentValue(env[OTEL_EXPORTER_OTLP_TRACES_HEADERS]);
+    const tracesHeaders = presentValue(readDiagnosticEnv(OTEL_EXPORTER_OTLP_TRACES_HEADERS, env));
     const headersSource = tracesHeaders !== undefined ? OTEL_EXPORTER_OTLP_TRACES_HEADERS : OTEL_EXPORTER_OTLP_HEADERS;
-    const envHeaders = parseHeaderList(tracesHeaders ?? presentValue(env[OTEL_EXPORTER_OTLP_HEADERS]));
+    const envHeaders = parseHeaderList(tracesHeaders ?? presentValue(readDiagnosticEnv(OTEL_EXPORTER_OTLP_HEADERS, env)));
     if (!headersAreSendable(envHeaders)) {
         return { status: "invalid", source: headersSource, reason: INVALID_HEADERS };
     }

package/dist/runtime/proxy-nodemaven.js

@@ -1,3 +1,4 @@
+import { readDiagnosticEnv } from "./diagnostic-env.js";
 import { createHash, randomBytes } from "node:crypto";
 export const NODEMAVEN_USERNAME_ENV = "APIFUSE__PROXY__NODEMAVEN_USERNAME";
 export const NODEMAVEN_PASSWORD_ENV = "APIFUSE__PROXY__NODEMAVEN_PASSWORD";
@@ -25,10 +26,10 @@ export function hasNodemavenCredentials() {
     return Boolean(readNodemavenUsername() && readNodemavenPassword());
 }
 function readNodemavenUsername() {
-    return process.env[NODEMAVEN_USERNAME_ENV]?.trim() || undefined;
+    return readDiagnosticEnv(NODEMAVEN_USERNAME_ENV)?.trim() || undefined;
 }
 function readNodemavenPassword() {
-    return process.env[NODEMAVEN_PASSWORD_ENV]?.trim() || undefined;
+    return readDiagnosticEnv(NODEMAVEN_PASSWORD_ENV)?.trim() || undefined;
 }
 function resolveNodemavenFilter(value) {
     const raw = value?.trim().toLowerCase();

package/dist/runtime/request-options.d.ts

@@ -51,6 +51,13 @@ export declare function redactUrlQueryParams(url: string, sensitiveParamNames: r
  * separate, structurally redacted URL for diagnostics and observability.
  */
 export declare function serializeRequestUrl(url: string, params?: RequestParams, sensitiveParams?: Record<string, string>): SerializedRequestUrl;
+export declare function normalizePercentEscapes(value: string): string;
+export type SensitiveValueVariant = {
+    value: string;
+    requiresTokenBoundary: boolean;
+    caseInsensitive: boolean;
+};
+export declare function allSensitiveValueVariants(sensitiveValues: readonly string[]): SensitiveValueVariant[];
 /** Scrubs raw and URL-encoded secret values from diagnostic text. */
 export declare function redactSensitiveText(text: string, sensitiveValues: readonly string[], requestUrl?: string, redactedUrl?: string): string;
 /**

package/dist/runtime/request-options.js

@@ -108,13 +108,33 @@ export function serializeRequestUrl(url, params, sensitiveParams) {
         sensitiveValues: [...sensitiveValues],
     };
 }
-const MIN_UNSCOPED_SENSITIVE_VALUE_LENGTH = 4;
-function normalizePercentEscapes(value) {
+const MIN_UNSCOPED_SENSITIVE_VALUE_LENGTH = 8;
+export function normalizePercentEscapes(value) {
     return value.replace(/%[\da-f]{2}/gi, (percentEscape) => percentEscape.toUpperCase());
 }
 function sensitiveValueVariants(value) {
     if (!value || value === REDACTED_QUERY_VALUE)
         return [];
+    // Owner-visible policy: short credentials are literal, case-sensitive tokens only.
+    // Encoded short needles collide with benign cursors and ordinary diagnostic text.
+    if (value.length < 8)
+        return [value];
+    // These ASCII characters are identical under NFC, JSON, URI-component and
+    // form encoding. Avoid constructing those identical variants for common tokens.
+    if (/^[A-Za-z0-9._*-]+$/.test(value)) {
+        const base64 = Buffer.from(value, "utf8").toString("base64");
+        const base64Url = base64.replaceAll("+", "-").replaceAll("/", "_");
+        return [
+            ...new Set([
+                value,
+                base64,
+                base64.replace(/=+$/, ""),
+                base64Url,
+                base64Url.replace(/=+$/, ""),
+            ]),
+        ];
+    }
+    const normalized = value.normalize("NFC");
     const formEncoded = new URLSearchParams({ value }).toString().slice("value=".length);
     let componentEncoded;
     try {
@@ -125,12 +145,31 @@ function sensitiveValueVariants(value) {
         // still safe to scrub, and URLSearchParams supplies its well-formed form.
         componentEncoded = value;
     }
-    return [...new Set([value, componentEncoded, formEncoded].map(normalizePercentEscapes))];
-}
-function allSensitiveValueVariants(sensitiveValues) {
+    const base64 = Buffer.from(value, "utf8").toString("base64");
+    const base64Url = base64.replaceAll("+", "-").replaceAll("/", "_");
+    const jsonEscaped = JSON.stringify(value).slice(1, -1);
+    return [
+        ...new Set([
+            value,
+            normalized,
+            componentEncoded,
+            formEncoded,
+            jsonEscaped,
+            base64,
+            base64.replace(/=+$/, ""),
+            base64Url,
+            base64Url.replace(/=+$/, ""),
+        ].map(normalizePercentEscapes)),
+    ];
+}
+export function allSensitiveValueVariants(sensitiveValues) {
     const variants = new Map();
     for (const sensitiveValue of sensitiveValues) {
         const requiresTokenBoundary = sensitiveValue.length < MIN_UNSCOPED_SENSITIVE_VALUE_LENGTH;
+        // Long values are unlikely to be ordinary prose, so case folding is worth
+        // the extra over-redaction protection. Values of 4-7 characters remain
+        // case-sensitive because they commonly occur as words and identifiers.
+        const caseInsensitive = sensitiveValue.length >= 8;
         for (const value of sensitiveValueVariants(sensitiveValue)) {
             const existing = variants.get(value);
             variants.set(value, {
@@ -138,6 +177,7 @@ function allSensitiveValueVariants(sensitiveValues) {
                 requiresTokenBoundary: existing
                     ? existing.requiresTokenBoundary && requiresTokenBoundary
                     : requiresTokenBoundary,
+                caseInsensitive: existing ? existing.caseInsensitive || caseInsensitive : caseInsensitive,
             });
         }
     }
@@ -147,24 +187,24 @@ function isTokenCharacter(value) {
     return value !== undefined && /[\p{L}\p{N}]/u.test(value);
 }
 function replaceSensitiveVariant(text, variant) {
-    const pattern = variant.value.replace(/%([\da-f]{2})|[.*+?^${}()|[\]\\]/gi, (match, hex) => {
-        if (hex) {
-            return `%${[...String(hex)]
-                .map((character) => /[a-f]/i.test(character)
-                ? `[${character.toLowerCase()}${character.toUpperCase()}]`
-                : character)
-                .join("")}`;
-        }
-        return `\\${match}`;
-    });
-    return text.replace(new RegExp(pattern, "gu"), (match, offset, source) => {
-        const end = offset + match.length;
+    const normalized = normalizePercentEscapes(text);
+    const comparable = variant.caseInsensitive ? normalized.toLowerCase() : text;
+    const needle = variant.caseInsensitive ? variant.value.toLowerCase() : variant.value;
+    let cursor = 0;
+    let output = "";
+    for (let index = comparable.indexOf(needle); index !== -1; index = comparable.indexOf(needle, index + 1)) {
+        const end = index + needle.length;
         if (variant.requiresTokenBoundary &&
-            (isTokenCharacter(source[offset - 1]) || isTokenCharacter(source[end]))) {
-            return match;
-        }
-        return REDACTED_QUERY_VALUE;
-    });
+            (isTokenCharacter(comparable[index - 1]) || isTokenCharacter(comparable[end])))
+            continue;
+        // Unicode folding can change offsets; suppress the field instead of slicing a secret.
+        if (comparable.length !== text.length)
+            return REDACTED_QUERY_VALUE;
+        output += text.slice(cursor, index) + REDACTED_QUERY_VALUE;
+        cursor = end;
+        index = end - 1;
+    }
+    return cursor ? output + text.slice(cursor) : text;
 }
 /** Scrubs raw and URL-encoded secret values from diagnostic text. */
 export function redactSensitiveText(text, sensitiveValues, requestUrl, redactedUrl) {

package/dist/runtime/resolver-vendors/browser.js

@@ -111,7 +111,6 @@ async function runBoundedCleanup(cleanup, timeoutMs, challengeKind, operation, t
         onError(error) {
             return {
                 error_message: error instanceof Error ? error.message : String(error),
-                ...(error instanceof Error && error.stack ? { error_stack: error.stack } : {}),
             };
         },
     })

package/dist/runtime/resolver.js

@@ -1,3 +1,4 @@
+import { readDiagnosticEnv } from "./diagnostic-env.js";
 import { createHash } from "node:crypto";
 import { resolveProxyConfigAsync, } from "../config/loader.js";
 import { ProviderError } from "../errors.js";
@@ -130,11 +131,11 @@ const KNOWN_UNIMPLEMENTED_RESOLVER_VENDORS = new Set([
     "custom",
 ]);
 function normalizedEnvValue(env, key) {
-    const value = env[key]?.trim();
+    const value = readDiagnosticEnv(key, env)?.trim();
     return value ? value : undefined;
 }
 function readPositiveIntegerEnv(env, name) {
-    const raw = env[name]?.trim();
+    const raw = readDiagnosticEnv(name, env)?.trim();
     if (!raw)
         return undefined;
     if (!/^[1-9]\d*$/.test(raw)) {

package/dist/runtime/state.d.ts

@@ -15,6 +15,9 @@ export declare function createProviderRuntimeStateFromEnv(options?: {
     readonly providerId?: string;
     readonly allowMemoryFallback?: boolean;
 }): ProviderRuntimeState;
-export declare function createMemoryProviderRuntimeState(): ProviderRuntimeState;
+export declare function createMemoryProviderRuntimeState(options?: {
+    /** Clock for expiry and timestamps; defaults to `Date.now`. */
+    readonly now?: () => number;
+}): ProviderRuntimeState;
 export declare function createUnsupportedProviderRuntimeState(): ProviderRuntimeState;
 export {};

package/dist/runtime/state.js

@@ -60,9 +60,12 @@ if not indexed and redis.call("ZCARD", KEYS[2]) >= max_entries then
 end
 
 if current_decoded and type(current_decoded.createdAt) == "string" then
-	local next_decoded = cjson.decode(envelope)
-	next_decoded.createdAt = current_decoded.createdAt
-	envelope = cjson.encode(next_decoded)
+	-- Preserve the original createdAt by patching the encoded envelope in place.
+	-- The envelope puts its metadata before "value", so the first match is the
+	-- envelope's own key, never a provider value; re-encoding with cjson would
+	-- silently turn [] inside the value into {}.
+	local preserved = string.gsub(current_decoded.createdAt, "%%", "%%%%")
+	envelope = (string.gsub(envelope, '"createdAt":"[^"]*"', '"createdAt":"' .. preserved .. '"', 1))
 end
 redis.call("SET", KEYS[1], envelope, "PXAT", expires_at)
 redis.call("ZADD", KEYS[2], expires_at, KEYS[1])
@@ -197,7 +200,11 @@ function isStateTombstone(raw) {
 }
 function redisEnvelope(value, version, createdAt, expiresAt) {
     const updatedAt = new Date().toISOString();
-    return { value, version, expiresAt, createdAt, updatedAt };
+    // Metadata precedes `value` on purpose: the compare-and-set Lua script patches
+    // `createdAt` in the encoded string (first occurrence) instead of decoding and
+    // re-encoding with cjson, which would turn empty arrays inside `value` into
+    // objects. Keep the key order stable.
+    return { version, expiresAt, createdAt, updatedAt, value };
 }
 class RedisProviderStateNamespace {
     backend;
@@ -404,10 +411,12 @@ class UnsupportedProviderRuntimeState {
 }
 class MemoryProviderStateNamespace {
     options;
+    now;
     // biome-ignore lint/suspicious/noExplicitAny: in-memory state stores heterogeneous generic values by key.
     values = new Map();
-    constructor(options) {
+    constructor(options, now = Date.now) {
         this.options = options;
+        this.now = now;
     }
     enforceValueSize(value) {
         const bytes = Buffer.byteLength(JSON.stringify(value), "utf8");
@@ -426,7 +435,7 @@ class MemoryProviderStateNamespace {
             throw new UnsupportedProviderStateError(`Provider runtime state namespace quota exceeded (${this.options.maxEntries + 1} > ${this.options.maxEntries})`);
         }
     }
-    pruneExpired(nowMs = Date.now()) {
+    pruneExpired(nowMs = this.now()) {
         for (const [key, row] of this.values.entries()) {
             if (row.expiresAt && Date.parse(row.expiresAt) <= nowMs) {
                 this.values.delete(key);
@@ -445,9 +454,9 @@ class MemoryProviderStateNamespace {
     async set(key, value, options) {
         this.pruneExpired();
         this.enforceWritePolicy(key, value, options?.ttl);
-        const now = new Date().toISOString();
+        const now = new Date(this.now()).toISOString();
         const current = this.values.get(key);
-        const expiresAt = resolveMemoryStateExpiresAt(options?.ttl ?? this.options.defaultTtl);
+        const expiresAt = resolveMemoryStateExpiresAt(options?.ttl ?? this.options.defaultTtl, this.now());
         const row = {
             key,
             value,
@@ -469,12 +478,12 @@ class MemoryProviderStateNamespace {
             return { ok: false, current: current ?? null };
         }
         this.enforceWritePolicy(key, value, options?.ttl);
-        const now = new Date().toISOString();
+        const now = new Date(this.now()).toISOString();
         const stored = {
             key,
             value,
             version: expectedVersion + 1,
-            expiresAt: resolveMemoryStateExpiresAt(options?.ttl ?? this.options.defaultTtl),
+            expiresAt: resolveMemoryStateExpiresAt(options?.ttl ?? this.options.defaultTtl, this.now()),
             createdAt: current?.createdAt ?? now,
             updatedAt: now,
         };
@@ -491,7 +500,10 @@ class MemoryProviderStateNamespace {
 class MemoryProviderRuntimeState {
     backend;
     scopeDiscriminator;
-    constructor(backend = { namespaces: new Map() }, scopeDiscriminator = MISSING_CONNECTION_SCOPE_DISCRIMINATOR) {
+    constructor(backend = {
+        namespaces: new Map(),
+        now: Date.now,
+    }, scopeDiscriminator = MISSING_CONNECTION_SCOPE_DISCRIMINATOR) {
         this.backend = backend;
         this.scopeDiscriminator = scopeDiscriminator;
     }
@@ -504,15 +516,15 @@ class MemoryProviderRuntimeState {
         const existing = this.backend.namespaces.get(namespaceIdentity);
         if (existing)
             return existing;
-        const created = new MemoryProviderStateNamespace(options);
+        const created = new MemoryProviderStateNamespace(options, this.backend.now);
         this.backend.namespaces.set(namespaceIdentity, created);
         return created;
     }
 }
-function resolveMemoryStateExpiresAt(ttl) {
+function resolveMemoryStateExpiresAt(ttl, nowMs = Date.now()) {
     const match = /^(\d+)(ms|s|m|h|d)$/.exec(ttl ?? "1h");
     if (!match)
-        return new Date(Date.now() + 3_600_000).toISOString();
+        return new Date(nowMs + 3_600_000).toISOString();
     const amount = Number(match[1]);
     const unit = match[2];
     const multiplier = unit === "ms"
@@ -524,7 +536,7 @@ function resolveMemoryStateExpiresAt(ttl) {
                 : unit === "h"
                     ? 3_600_000
                     : 86_400_000;
-    return new Date(Date.now() + amount * multiplier).toISOString();
+    return new Date(nowMs + amount * multiplier).toISOString();
 }
 export function createRedisProviderRuntimeState(options) {
     return new RedisProviderRuntimeState(options);
@@ -542,8 +554,11 @@ export function createProviderRuntimeStateFromEnv(options = {}) {
     }
     return createUnsupportedProviderRuntimeState();
 }
-export function createMemoryProviderRuntimeState() {
-    return new MemoryProviderRuntimeState();
+export function createMemoryProviderRuntimeState(options) {
+    return new MemoryProviderRuntimeState({
+        namespaces: new Map(),
+        now: options?.now ?? Date.now,
+    });
 }
 export function createUnsupportedProviderRuntimeState() {
     return new UnsupportedProviderRuntimeState();

package/dist/runtime/stt.js

@@ -1,3 +1,4 @@
+import { readDiagnosticEnv } from "./diagnostic-env.js";
 import { ProviderError, TransportError, ValidationError } from "../errors.js";
 import { createTimeoutController, isTimeoutLikeError } from "./timeout.js";
 export const APIFUSE__STT__BACKEND_ENV = "APIFUSE__STT__BACKEND";
@@ -32,7 +33,7 @@ export function createUnsupportedSttClient(reason) {
     });
 }
 function normalizedEnvValue(env, key) {
-    const value = env[key]?.trim();
+    const value = readDiagnosticEnv(key, env)?.trim();
     return value ? value : undefined;
 }
 export function createSttClientFromEnv(config, env = process.env) {
@@ -53,7 +54,7 @@ export function createSttClientFromEnv(config, env = process.env) {
         });
     }
     const accountId = env.APIFUSE__CLOUDFLARE__ACCOUNT_ID?.trim();
-    const apiToken = env.APIFUSE__STT__CLOUDFLARE_API_TOKEN?.trim();
+    const apiToken = readDiagnosticEnv(APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV, env)?.trim();
     if (!accountId || !apiToken) {
         return createUnsupportedSttClient(`STT backend ${backend} requires ${CLOUDFLARE_ACCOUNT_ID_ENV} and ${APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV}`);
     }

package/dist/runtime/trace.d.ts

@@ -1,4 +1,5 @@
 import type { TraceContext as BaseTraceContext, TraceAttributeValue, TraceConfig, TraceSpan } from "../types.js";
+import { type DiagnosticRedactor } from "./diagnostic-redactor.js";
 import { type OTLPExportOptions } from "./otlp.js";
 export type SpanAttributeValue = TraceAttributeValue;
 export type Span = TraceSpan;
@@ -8,6 +9,8 @@ export interface TraceContext extends BaseTraceContext {
 export interface CreateTraceContextOptions {
     maxSpans?: number;
     onSpan?: (span: Span) => void;
+    /** Redacts diagnostic attribute values and errors before recording or calling onSpan. */
+    redact?: DiagnosticRedactor;
     exportOptions?: OTLPExportOptions;
     resourceAttributes?: Record<string, string>;
     /** W3C-compatible 32-character lowercase hexadecimal trace id used for export. */
@@ -34,5 +37,7 @@ export declare function updateTraceContextExportMetadata(trace: BaseTraceContext
 }): void;
 export declare function resolveTraceContextOptions(config?: TraceConfig): CreateTraceContextOptions;
 export declare function getTraceRecorder(trace: BaseTraceContext): TraceRecorder | null;
+/** Internal, read-only process counters; no reset can re-arm a warning. */
+export declare function getDroppedOTLPSpanCount(reason: string): number;
 export declare function createTraceContext(options?: CreateTraceContextOptions): TraceContext;
 export {};