@apifuse/provider-sdk 2.2.0-beta.7 → 2.2.0-beta.70

package/dist/runtime/capability-response.js

@@ -0,0 +1,56 @@
+export const CAPABILITY_BODY_UNAVAILABLE = "<body unavailable>";
+/** Read optional diagnostic response text without letting a body stall the request failure. */
+export async function readCapabilityErrorBody(response, signal) {
+    if (signal.aborted)
+        return CAPABILITY_BODY_UNAVAILABLE;
+    let timer;
+    let onAbort;
+    let reader;
+    let unavailableWon = false;
+    const cancelBody = (reason) => {
+        const cancellation = reader ? reader.cancel(reason) : response.body?.cancel(reason);
+        if (cancellation)
+            void cancellation.catch(() => { });
+    };
+    const unavailable = new Promise((resolve) => {
+        onAbort = () => {
+            unavailableWon = true;
+            resolve(CAPABILITY_BODY_UNAVAILABLE);
+            cancelBody(signal.reason);
+        };
+        signal.addEventListener("abort", onAbort, { once: true });
+        timer = setTimeout(() => {
+            unavailableWon = true;
+            resolve(CAPABILITY_BODY_UNAVAILABLE);
+            cancelBody(new Error("capability error body read timeout"));
+        }, 250);
+    });
+    const body = Promise.resolve()
+        .then(async () => {
+        if (unavailableWon)
+            return CAPABILITY_BODY_UNAVAILABLE;
+        if (!response.body)
+            return response.text();
+        reader = response.body.getReader();
+        const decoder = new TextDecoder();
+        let text = "";
+        while (true) {
+            if (unavailableWon)
+                return CAPABILITY_BODY_UNAVAILABLE;
+            const chunk = await reader.read();
+            if (chunk.done)
+                return text + decoder.decode();
+            text += decoder.decode(chunk.value, { stream: true });
+        }
+    })
+        .catch(() => CAPABILITY_BODY_UNAVAILABLE);
+    try {
+        return await Promise.race([body, unavailable]);
+    }
+    finally {
+        if (timer !== undefined)
+            clearTimeout(timer);
+        if (onAbort)
+            signal.removeEventListener("abort", onAbort);
+    }
+}

package/dist/runtime/capability-telemetry.d.ts

@@ -0,0 +1,46 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+/** Internal capture facts, isolated across concurrent calls and never attached to caller results. */
+export type CapabilityFacts = {
+    status?: number;
+    finishReason?: string;
+    diagnostics?: string;
+};
+export declare const capabilityFacts: AsyncLocalStorage<CapabilityFacts>;
+export declare function tagCapability<T extends object>(context: T, facts: {
+    backend: string;
+    engine: string;
+    model?: string;
+}): T;
+export declare function capabilityMetadata(context: object): {
+    backend: string;
+    engine: string;
+    model?: string;
+} | undefined;
+export declare function captureCapability(facts: CapabilityFacts): void;
+export declare function registerCapabilityInput(input: {
+    kind: string;
+    data?: string;
+    url?: string;
+}): void;
+/**
+ * Formats capability diagnostics after credential redaction.
+ * When `stripPayload` is enabled, long base64-shaped runs are replaced as a
+ * defence in depth; this may replace an unregistered long identifier, while
+ * protecting against the more likely case of payload data in an upstream body.
+ */
+export declare function capabilityText(value: string, redact?: (text: string) => string, stripPayload?: boolean): string;
+export declare function capabilityErrorText(error: unknown): string;
+export declare const integer: (n: number | undefined) => number;
+export declare const add: (a: number, b: number) => number;
+export declare function inputBytes(input: {
+    kind: string;
+    data?: string;
+}): number | undefined;
+/** All capability hooks use the HTTP observer guard, including failure reporting. */
+export declare function observeCapability(sink: {
+    markTelemetryFailed?(): void;
+}, callback: () => unknown): void;
+type RootRunner = <T>(callback: () => Promise<T>) => Promise<T>;
+export declare function bindCapabilityRoot<T extends object>(context: T, run: RootRunner): T;
+export declare function runCapabilitySpan<T>(context: object, callback: () => Promise<T>): Promise<T>;
+export {};

package/dist/runtime/capability-telemetry.js

@@ -0,0 +1,68 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { Buffer } from "node:buffer";
+import { registerDiagnosticValue } from "./diagnostic-env.js";
+import { redactDiagnosticText } from "./diagnostic-redactor.js";
+import { observeTelemetry } from "./http-telemetry-guard.js";
+import { boundedText } from "./resolver-telemetry.js";
+export const capabilityFacts = new AsyncLocalStorage();
+const metadata = new WeakMap();
+export function tagCapability(context, facts) {
+    metadata.set(context, facts);
+    return context;
+}
+export function capabilityMetadata(context) {
+    return metadata.get(context);
+}
+export function captureCapability(facts) {
+    const current = capabilityFacts.getStore();
+    if (current)
+        Object.assign(current, facts);
+}
+export function registerCapabilityInput(input) {
+    // Payloads are measurements, never redaction needles. Only bounded URLs belong
+    // in the request inventory; structural stripping covers oversized URL echoes.
+    if (input.kind === "url" && input.url && Buffer.byteLength(input.url) <= 2048)
+        registerDiagnosticValue(input.url.trim());
+}
+/**
+ * Formats capability diagnostics after credential redaction.
+ * When `stripPayload` is enabled, long base64-shaped runs are replaced as a
+ * defence in depth; this may replace an unregistered long identifier, while
+ * protecting against the more likely case of payload data in an upstream body.
+ */
+export function capabilityText(value, redact, stripPayload = false) {
+    const stripped = value
+        .replace(/(?:authorization|proxy-authorization|cookie|set-cookie)\s*["']?\s*[:=]\s*[^\r\n]+/gi, "[REDACTED]")
+        .replace(/Bearer\s+[^\r\n]+/gi, "[REDACTED]")
+        .replace(/https?:\/\/[^\s"'<>]+/gi, "[REDACTED]")
+        .replace(/data:[^\s"']+/gi, "[BASE64_STRIPPED]");
+    return boundedText(stripPayload ? stripped.replace(/[A-Za-z0-9+/=]{64,}/g, "[BASE64_STRIPPED]") : stripped, (text) => redactDiagnosticText(text, redact));
+}
+export function capabilityErrorText(error) {
+    if (!(error instanceof Error))
+        return String(error);
+    const details = "details" in error ? error.details : undefined;
+    const body = details && typeof details === "object" && "body" in details ? details.body : undefined;
+    return `${error.message}${typeof body === "string" ? ` ${body}` : ""}`;
+}
+export const integer = (n) => Math.min(Number.MAX_SAFE_INTEGER, Math.max(0, Math.floor(Number.isFinite(n ?? 0) ? (n ?? 0) : 0)));
+export const add = (a, b) => Math.min(Number.MAX_SAFE_INTEGER, integer(a) + integer(b));
+export function inputBytes(input) {
+    if (input.kind !== "base64" || input.data === undefined)
+        return undefined;
+    return Buffer.byteLength(input.data.trim(), "base64");
+}
+/** All capability hooks use the HTTP observer guard, including failure reporting. */
+export function observeCapability(sink, callback) {
+    observeTelemetry(callback, () => {
+        observeTelemetry(() => sink.markTelemetryFailed?.(), () => { });
+    });
+}
+const roots = new WeakMap();
+export function bindCapabilityRoot(context, run) {
+    roots.set(context, run);
+    return context;
+}
+export function runCapabilitySpan(context, callback) {
+    return roots.get(context)?.(callback) ?? callback();
+}

package/dist/runtime/chrome149-header-order.d.ts

@@ -0,0 +1,58 @@
+/** @internal Chromium 149 DeprecatedCaseFoldingHash for an LChar string. */
+export declare function chrome149CaseFoldingHash(name: string): number;
+/** @internal Numeric rapidhash fixture from Chromium's string_hasher_test.cc. */
+export declare function chrome149RapidhashFixture(): {
+    full: bigint;
+    masked: number;
+};
+/**
+ * HTTPHeaderMap insertion sequence of the fixed headers in a real Chrome
+ * 149.0.7827.155 page fetch/XHR (insertion order, not bucket order). Caller
+ * headers precede all of these (core/fetch/fetch_manager.cc:1128-1130).
+ *
+ *   platform/loader/fetch/resource_request_utils.cc:146 UpgradeResourceRequestForLoader
+ *     :166 context.UpgradeResourceRequestForLoader
+ *          -> core/loader/frame_fetch_context.cc:1000 AddClientHintsIfNecessary
+ *             Set sec-ch-ua @737, sec-ch-ua-mobile @748, sec-ch-ua-platform @761
+ *          -> :1001 AddReducedAcceptLanguageIfNecessary is a no-op
+ *             (kReduceAcceptLanguage[HTTP] are FEATURE_DISABLED_BY_DEFAULT,
+ *             services/network/public/cpp/features.cc:204,214)
+ *     :214 context.PrepareRequest
+ *          -> core/loader/frame_fetch_context.cc:419 SetHTTPUserAgent
+ *          -> :455 probe::PrepareRequest, which only touches the map when a
+ *             DevTools session has set an Accept-Language override:
+ *             InspectorEmulationAgent::PrepareRequest (inspector_emulation_agent.cc
+ *             :626-636, Emulation.setUserAgentOverride acceptLanguage; skips a key
+ *             the page already set) or InspectorNetworkAgent::PrepareRequest
+ *             (inspector_network_agent.cc:1524-1547, Network.setExtraHTTPHeaders;
+ *             overwrites)
+ *
+ * Accept-Language is therefore NOT a map key in real Chrome. //net appends it
+ * in URLRequestHttpJob::AddExtraHeaders (net/url_request/url_request_http_job.cc
+ * :784-797) after Accept-Encoding, and only when the request does not already
+ * carry one (SetHeaderIfMissing), which is why a caller-supplied Accept-Language
+ * stays at its map bucket and is never emitted twice. al-placement-capture.json
+ * (B: no locale, C: --accept-lang=ja) confirms both the four-key map and the
+ * downstream slot.
+ *
+ * Every earlier corpus (placement-rule-sweep, expansion-sweep, holdout-capture,
+ * m1-capture) was captured through Playwright `newContext({ locale })`, which
+ * sets that override (Emulation.setUserAgentOverride acceptLanguage) and so
+ * inserts Accept-Language into the map as a fifth fixed key. Those fixtures still
+ * validate the hash and table mechanics;
+ * the tests interpret them through that harness insertion list. No production
+ * path uses it.
+ */
+export declare const CHROME149_FIXED_MAP_INSERTION: readonly ["sec-ch-ua", "sec-ch-ua-mobile", "sec-ch-ua-platform", "User-Agent"];
+/**
+ * @internal Header-name order model parameterised by the fixed map insertion
+ * sequence. Production always passes {@link CHROME149_FIXED_MAP_INSERTION};
+ * tests pass the DevTools-harness sequence to validate corpora captured through
+ * Playwright's `locale` option.
+ */
+export declare function chrome149HeaderOrderForMapInsertion(callerNames: Iterable<string>, fixedMapInsertion: readonly string[]): string[];
+/**
+ * @internal Predict real Chrome 149's non-pseudo HTTP/2 fetch/XHR header-name
+ * order for the given caller header names (no DevTools session attached).
+ */
+export declare function chrome149HeaderOrder(callerNames: Iterable<string>): string[];

package/dist/runtime/chrome149-header-order.js

@@ -0,0 +1,289 @@
+const U64_MASK = (1n << 64n) - 1n;
+const RAPID_SEED = 0xbdd89aa982704029n;
+const RAPID_SECRET = [0x2d358dccaa6c78a5n, 0x8bb84b93962eacc9n, 0x4b33a62ed433d4a3n];
+function latin1CaseFold(character) {
+    if (character >= 0x41 && character <= 0x5a)
+        return character + 0x20;
+    if (character === 0xb5)
+        return 0x03bc;
+    if ((character >= 0xc0 && character <= 0xd6) || (character >= 0xd8 && character <= 0xde))
+        return character + 0x20;
+    return character;
+}
+function multiply128(a, b) {
+    const product = (a & U64_MASK) * (b & U64_MASK);
+    return [product & U64_MASK, (product >> 64n) & U64_MASK];
+}
+function rapidMix(a, b) {
+    const [low, high] = multiply128(a, b);
+    return low ^ high;
+}
+class PlainByteHashReader {
+    bytes;
+    compressionFactor = 1;
+    expansionFactor = 1;
+    constructor(bytes) {
+        this.bytes = bytes;
+    }
+    read64(offset) {
+        let result = 0n;
+        for (let index = 0; index < 8; index += 1) {
+            result |= BigInt(this.bytes[offset + index] ?? 0) << BigInt(index * 8);
+        }
+        return result;
+    }
+    read32(offset) {
+        let result = 0n;
+        for (let index = 0; index < 4; index += 1) {
+            result |= BigInt(this.bytes[offset + index] ?? 0) << BigInt(index * 8);
+        }
+        return result;
+    }
+    readSmall(offset, length) {
+        return ((BigInt(this.bytes[offset] ?? 0) << 56n) |
+            (BigInt(this.bytes[offset + (length >> 1)] ?? 0) << 32n) |
+            BigInt(this.bytes[offset + length - 1] ?? 0));
+    }
+}
+class CaseFoldingLatin1HashReader {
+    input;
+    compressionFactor = 1;
+    expansionFactor = 2;
+    constructor(input) {
+        this.input = input;
+    }
+    fold(offset) {
+        return BigInt(latin1CaseFold(this.input.charCodeAt(offset)));
+    }
+    read64(offset) {
+        return (this.fold(offset) |
+            (this.fold(offset + 1) << 16n) |
+            (this.fold(offset + 2) << 32n) |
+            (this.fold(offset + 3) << 48n));
+    }
+    read32(offset) {
+        return this.fold(offset) | (this.fold(offset + 1) << 16n);
+    }
+    readSmall(offset, length) {
+        if (length !== 2) {
+            throw new Error(`CaseFoldingHashReader<LChar> received length ${length}; expected 2.`);
+        }
+        return this.fold(offset);
+    }
+}
+function rapidHash(reader, producedLength) {
+    const x = reader.compressionFactor;
+    const y = reader.expansionFactor;
+    if (producedLength % y !== 0)
+        throw new Error("Invalid rapidhash reader length.");
+    let seed = RAPID_SEED;
+    seed ^= rapidMix(seed ^ RAPID_SECRET[0], RAPID_SECRET[1]) ^ BigInt(producedLength);
+    seed &= U64_MASK;
+    let offset = 0;
+    let a;
+    let b;
+    if (producedLength <= 16) {
+        if (producedLength >= 4) {
+            const last = offset + Math.trunc(((producedLength - 4) * x) / y);
+            a = (reader.read32(offset) << 32n) | reader.read32(last);
+            const delta = Math.trunc((((producedLength & 24) >> (producedLength >> 3)) * x) / y);
+            b = (reader.read32(offset + delta) << 32n) | reader.read32(last - delta);
+        }
+        else if (producedLength > 0) {
+            a = reader.readSmall(offset, producedLength);
+            b = 0n;
+        }
+        else {
+            a = 0n;
+            b = 0n;
+        }
+    }
+    else {
+        let remaining = producedLength;
+        if (remaining > 48) {
+            let see1 = seed;
+            let see2 = seed;
+            do {
+                seed = rapidMix(reader.read64(offset) ^ RAPID_SECRET[0], reader.read64(offset + Math.trunc((8 * x) / y)) ^ seed);
+                see1 = rapidMix(reader.read64(offset + Math.trunc((16 * x) / y)) ^ RAPID_SECRET[1], reader.read64(offset + Math.trunc((24 * x) / y)) ^ see1);
+                see2 = rapidMix(reader.read64(offset + Math.trunc((32 * x) / y)) ^ RAPID_SECRET[2], reader.read64(offset + Math.trunc((40 * x) / y)) ^ see2);
+                offset += Math.trunc((48 * x) / y);
+                remaining -= 48;
+            } while (remaining >= 48);
+            seed ^= see1 ^ see2;
+        }
+        if (remaining > 16) {
+            seed = rapidMix(reader.read64(offset) ^ RAPID_SECRET[2], reader.read64(offset + Math.trunc((8 * x) / y)) ^ seed ^ RAPID_SECRET[1]);
+            if (remaining > 32) {
+                seed = rapidMix(reader.read64(offset + Math.trunc((16 * x) / y)) ^ RAPID_SECRET[2], reader.read64(offset + Math.trunc((24 * x) / y)) ^ seed);
+            }
+        }
+        a = reader.read64(offset + Math.trunc(((remaining - 16) * x) / y));
+        b = reader.read64(offset + Math.trunc(((remaining - 8) * x) / y));
+    }
+    a ^= RAPID_SECRET[1];
+    b ^= seed;
+    [a, b] = multiply128(a, b);
+    return rapidMix(a ^ RAPID_SECRET[0] ^ BigInt(producedLength), b ^ RAPID_SECRET[1]);
+}
+function maskTopEightBits(hash) {
+    const masked = Number(hash & 0xffffffn);
+    return masked === 0 ? 0x800000 : masked;
+}
+/** @internal Chromium 149 DeprecatedCaseFoldingHash for an LChar string. */
+export function chrome149CaseFoldingHash(name) {
+    const reader = new CaseFoldingLatin1HashReader(name);
+    return maskTopEightBits(rapidHash(reader, name.length * reader.expansionFactor));
+}
+/** @internal Numeric rapidhash fixture from Chromium's string_hasher_test.cc. */
+export function chrome149RapidhashFixture() {
+    const fixture = [0x41, 0x95, 0xff, 0x50, 0x01];
+    const full = rapidHash(new PlainByteHashReader(fixture), fixture.length);
+    return { full, masked: maskTopEightBits(full) };
+}
+function asciiCaseKey(name) {
+    let result = "";
+    for (let index = 0; index < name.length; index += 1) {
+        const character = name.charCodeAt(index);
+        result += String.fromCharCode(character >= 0x41 && character <= 0x5a ? character + 0x20 : character);
+    }
+    return result;
+}
+class WtfHeaderHashMap {
+    table = [];
+    keyCount = 0;
+    insertWithoutExpansion(key) {
+        const mask = this.table.length - 1;
+        let index = chrome149CaseFoldingHash(key) & mask;
+        let probeCount = 0;
+        const keyCaseFolded = asciiCaseKey(key);
+        for (;;) {
+            const stored = this.table[index];
+            if (stored === undefined) {
+                this.table[index] = key;
+                this.keyCount += 1;
+                return true;
+            }
+            if (asciiCaseKey(stored) === keyCaseFolded)
+                return false;
+            probeCount += 1;
+            index = (index + probeCount) & mask;
+        }
+    }
+    rehash(newSize) {
+        const oldTable = this.table;
+        this.table = Array(newSize);
+        this.keyCount = 0;
+        for (const key of oldTable) {
+            if (key !== undefined)
+                this.insertWithoutExpansion(key);
+        }
+    }
+    insert(key) {
+        if (this.table.length === 0)
+            this.table = Array(8);
+        if (!this.insertWithoutExpansion(key))
+            return;
+        if (this.keyCount * 2 >= this.table.length)
+            this.rehash(this.table.length * 2);
+    }
+    iterationOrder() {
+        return this.table.filter((key) => key !== undefined);
+    }
+}
+/**
+ * HTTPHeaderMap insertion sequence of the fixed headers in a real Chrome
+ * 149.0.7827.155 page fetch/XHR (insertion order, not bucket order). Caller
+ * headers precede all of these (core/fetch/fetch_manager.cc:1128-1130).
+ *
+ *   platform/loader/fetch/resource_request_utils.cc:146 UpgradeResourceRequestForLoader
+ *     :166 context.UpgradeResourceRequestForLoader
+ *          -> core/loader/frame_fetch_context.cc:1000 AddClientHintsIfNecessary
+ *             Set sec-ch-ua @737, sec-ch-ua-mobile @748, sec-ch-ua-platform @761
+ *          -> :1001 AddReducedAcceptLanguageIfNecessary is a no-op
+ *             (kReduceAcceptLanguage[HTTP] are FEATURE_DISABLED_BY_DEFAULT,
+ *             services/network/public/cpp/features.cc:204,214)
+ *     :214 context.PrepareRequest
+ *          -> core/loader/frame_fetch_context.cc:419 SetHTTPUserAgent
+ *          -> :455 probe::PrepareRequest, which only touches the map when a
+ *             DevTools session has set an Accept-Language override:
+ *             InspectorEmulationAgent::PrepareRequest (inspector_emulation_agent.cc
+ *             :626-636, Emulation.setUserAgentOverride acceptLanguage; skips a key
+ *             the page already set) or InspectorNetworkAgent::PrepareRequest
+ *             (inspector_network_agent.cc:1524-1547, Network.setExtraHTTPHeaders;
+ *             overwrites)
+ *
+ * Accept-Language is therefore NOT a map key in real Chrome. //net appends it
+ * in URLRequestHttpJob::AddExtraHeaders (net/url_request/url_request_http_job.cc
+ * :784-797) after Accept-Encoding, and only when the request does not already
+ * carry one (SetHeaderIfMissing), which is why a caller-supplied Accept-Language
+ * stays at its map bucket and is never emitted twice. al-placement-capture.json
+ * (B: no locale, C: --accept-lang=ja) confirms both the four-key map and the
+ * downstream slot.
+ *
+ * Every earlier corpus (placement-rule-sweep, expansion-sweep, holdout-capture,
+ * m1-capture) was captured through Playwright `newContext({ locale })`, which
+ * sets that override (Emulation.setUserAgentOverride acceptLanguage) and so
+ * inserts Accept-Language into the map as a fifth fixed key. Those fixtures still
+ * validate the hash and table mechanics;
+ * the tests interpret them through that harness insertion list. No production
+ * path uses it.
+ */
+export const CHROME149_FIXED_MAP_INSERTION = [
+    "sec-ch-ua",
+    "sec-ch-ua-mobile",
+    "sec-ch-ua-platform",
+    "User-Agent",
+];
+/**
+ * Appended after PopulateResourceRequest has iterated the map: Fetch Metadata
+ * and Referer by the network service, then //net's Accept-Encoding and
+ * Accept-Language, then the HTTP/2 Priority header (net/spdy/spdy_http_utils.cc).
+ */
+const DOWNSTREAM_SUFFIX = [
+    "sec-fetch-site",
+    "sec-fetch-mode",
+    "sec-fetch-dest",
+    "referer",
+];
+/**
+ * @internal Header-name order model parameterised by the fixed map insertion
+ * sequence. Production always passes {@link CHROME149_FIXED_MAP_INSERTION};
+ * tests pass the DevTools-harness sequence to validate corpora captured through
+ * Playwright's `locale` option.
+ */
+export function chrome149HeaderOrderForMapInsertion(callerNames, fixedMapInsertion) {
+    const unique = new Map();
+    for (const name of callerNames) {
+        const key = asciiCaseKey(name);
+        if (!unique.has(key))
+            unique.set(key, name);
+    }
+    const headerMap = new WtfHeaderHashMap();
+    for (const key of [...unique.keys()].sort())
+        headerMap.insert(unique.get(key));
+    for (const name of fixedMapInsertion)
+        headerMap.insert(name);
+    const order = headerMap.iterationOrder().map((name) => name.toLowerCase());
+    // SetAcceptHeader adds */* only when the caller Accept was absent.
+    if (!order.includes("accept"))
+        order.push("accept");
+    order.push(...DOWNSTREAM_SUFFIX);
+    // URLRequestHttpJob::AddExtraHeaders: Accept-Encoding, then Accept-Language,
+    // each only if the request does not already carry it.
+    if (!order.includes("accept-encoding"))
+        order.push("accept-encoding");
+    if (!order.includes("accept-language"))
+        order.push("accept-language");
+    // CreateSpdyHeadersFromHttpRequest appends the default Priority only if absent.
+    if (!order.includes("priority"))
+        order.push("priority");
+    return order;
+}
+/**
+ * @internal Predict real Chrome 149's non-pseudo HTTP/2 fetch/XHR header-name
+ * order for the given caller header names (no DevTools session attached).
+ */
+export function chrome149HeaderOrder(callerNames) {
+    return chrome149HeaderOrderForMapInsertion(callerNames, CHROME149_FIXED_MAP_INSERTION);
+}

package/dist/runtime/diagnostic-env-values.d.ts

@@ -0,0 +1,5 @@
+export declare function resolvedStringVariants(value: string | undefined): string[];
+export declare function urlCredentialComponents(value: string, options: {
+    includePathAndQuery: boolean;
+}): string[];
+export declare function otlpHeaderCredentialValues(value: string): string[];

package/dist/runtime/diagnostic-env-values.js

@@ -0,0 +1,57 @@
+export function resolvedStringVariants(value) {
+    if (value === undefined)
+        return [];
+    return [...new Set([value, value.trim()])].filter((candidate) => candidate.length > 0);
+}
+function decodedComponent(value) {
+    try {
+        return decodeURIComponent(value);
+    }
+    catch {
+        return value;
+    }
+}
+export function urlCredentialComponents(value, options) {
+    let url;
+    try {
+        url = new URL(value.trim());
+    }
+    catch {
+        return [];
+    }
+    const username = decodedComponent(url.username);
+    const password = decodedComponent(url.password);
+    const components = [username, password, username && password ? `${username}:${password}` : ""];
+    if (options.includePathAndQuery) {
+        for (const segment of url.pathname.split("/")) {
+            if (segment)
+                components.push(decodedComponent(segment));
+        }
+        for (const [key, entryValue] of url.searchParams) {
+            if (key)
+                components.push(key);
+            if (entryValue) {
+                components.push(entryValue, `${key}=${entryValue}`);
+            }
+        }
+    }
+    return [...new Set(components.flatMap((component) => resolvedStringVariants(component)))];
+}
+export function otlpHeaderCredentialValues(value) {
+    const variants = resolvedStringVariants(value);
+    for (const member of value.split(",")) {
+        const separator = member.indexOf("=");
+        if (separator <= 0)
+            continue;
+        const headerValue = decodedComponent(member.slice(separator + 1).trim());
+        variants.push(...resolvedStringVariants(headerValue));
+        const headerName = decodedComponent(member.slice(0, separator).trim()).toLowerCase();
+        if (headerName === "authorization" || headerName === "proxy-authorization") {
+            // A transport may echo just the credential without its HTTP auth scheme.
+            const credential = /^(?:Bearer|Basic)\s+(.+)$/i.exec(headerValue)?.[1];
+            if (credential)
+                variants.push(...resolvedStringVariants(credential));
+        }
+    }
+    return [...new Set(variants)];
+}

package/dist/runtime/diagnostic-env.d.ts

@@ -0,0 +1,14 @@
+import { type CompiledDiagnosticSensitiveValues } from "./diagnostic-redactor.js";
+type EnvObserver = (name: string, value: string) => void;
+export interface DiagnosticEnvScope {
+    observe: EnvObserver;
+    finished: boolean;
+    staticValues?: CompiledDiagnosticSensitiveValues;
+    register?: (values: readonly string[]) => void;
+}
+/** Resolve and register atomically, before any consumer can use a live env credential. */
+export declare function readDiagnosticEnv(name: string, env?: Readonly<Record<string, string | undefined>>): string | undefined;
+/** Register a runtime-discovered sensitive value in the active request inventory. */
+export declare function registerDiagnosticValue(value: string): void;
+export declare function withDiagnosticEnv<T>(observer: EnvObserver | DiagnosticEnvScope, fn: () => T): T;
+export {};

package/dist/runtime/diagnostic-env.js

@@ -0,0 +1,44 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+import { otlpHeaderCredentialValues, resolvedStringVariants, urlCredentialComponents, } from "./diagnostic-env-values.js";
+import { registerProcessDiagnosticValues, suppressProcessDiagnosticValues, withAppDiagnosticFallback, } from "./diagnostic-redactor.js";
+const observers = new AsyncLocalStorage();
+/** Resolve and register atomically, before any consumer can use a live env credential. */
+export function readDiagnosticEnv(name, env = process.env) {
+    const value = env[name];
+    if (value !== undefined) {
+        const scope = observers.getStore();
+        if (scope && !scope.finished)
+            scope.observe(name, value);
+        else {
+            // ALS survives the response. Finished requests register into the app's
+            // inherited fallback lifetime, never a dead request's private inventory.
+            if (Buffer.byteLength(value) > 64 * 1024)
+                suppressProcessDiagnosticValues();
+            else
+                registerProcessDiagnosticValues([
+                    ...resolvedStringVariants(value),
+                    ...urlCredentialComponents(value, {
+                        includePathAndQuery: name === "APIFUSE__CDP_POOL__URL",
+                    }),
+                    ...(name === "OTEL_EXPORTER_OTLP_HEADERS" || name === "OTEL_EXPORTER_OTLP_TRACES_HEADERS"
+                        ? otlpHeaderCredentialValues(value)
+                        : []),
+                ]);
+        }
+    }
+    return value;
+}
+/** Register a runtime-discovered sensitive value in the active request inventory. */
+export function registerDiagnosticValue(value) {
+    if (value.length < 4)
+        return;
+    const scope = observers.getStore();
+    if (scope && !scope.finished && scope.register) {
+        scope.register([value]);
+    }
+}
+export function withDiagnosticEnv(observer, fn) {
+    const scope = typeof observer === "function" ? { observe: observer, finished: false } : observer;
+    const run = () => observers.run(scope, fn);
+    return scope.staticValues ? withAppDiagnosticFallback(scope.staticValues, run) : run();
+}