@apifuse/provider-sdk 2.2.0-beta.7 → 2.2.0-beta.70

package/dist/server/self-test.js

@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from "node:crypto";
-import { readFileSync } from "node:fs";
 import { TURN_KINDS } from "../auth-turn/index.js";
+import { SDK_VERSION } from "./sdk-version.js";
 import { Hono } from "hono";
 import { z } from "zod";
 import { resolveHealthCheckInputDateTokens } from "./self-test-input-tokens.js";
@@ -58,23 +58,6 @@ export const SELF_TEST_AUTH_FLOW_REJECTED_SKIP_REASON = "auth_flow_rejected";
  */
 const AUTH_REJECTION_HTTP_STATUSES = new Set([401, 403]);
 const INTERACTIVE_TURN_KIND_SET = new Set(TURN_KINDS.filter((descriptor) => descriptor.rendering !== "terminal" && descriptor.kind !== "retry").map((descriptor) => descriptor.kind));
-function resolveSdkVersion() {
-    try {
-        const packageJsonUrl = new URL("../../package.json", import.meta.url);
-        const parsed = JSON.parse(readFileSync(packageJsonUrl, "utf8"));
-        if (parsed &&
-            typeof parsed === "object" &&
-            "version" in parsed &&
-            typeof parsed.version === "string") {
-            return parsed.version;
-        }
-    }
-    catch {
-        // fall through to unknown
-    }
-    return "unknown";
-}
-const SDK_VERSION = resolveSdkVersion();
 function healthCheckSuite(operation) {
     return operation.healthCheck;
 }
@@ -115,25 +98,15 @@ export function computeSelfTestPlanDigest(provider) {
 }
 /**
  * Fail-closed read-only classification: an operation may self-test only when
- * its own metadata marks it read-only (annotations.readOnly or
- * toolRouter.riskClass "read") and nothing marks it side-effecting. Unclassified
- * operations are refused so the endpoint cannot become a mutation oracle.
+ * its authored safety source of truth classifies it as read-only.
  */
 export function isSelfTestReadOnlyOperation(operation) {
-    const annotations = operation.annotations;
-    if (annotations?.readOnly === false)
-        return false;
-    if (annotations?.destructive === true)
-        return false;
-    const riskClass = operation.toolRouter?.riskClass;
-    if (riskClass !== undefined && riskClass !== "read")
-        return false;
-    return annotations?.readOnly === true || riskClass === "read";
+    return operation.riskClass === "read";
 }
 /** Binds the self-test executor to a tenant app's /v1 pipeline in-process. */
 export function createSelfTestInvoke(app) {
-    return async ({ operationId, input, connection, requestId }) => {
-        const response = await app.request(`/v1/${encodeURIComponent(operationId)}`, {
+    return async ({ operationId, input, connection, requestId, signal }) => {
+        const responsePromise = Promise.resolve(app.request(`/v1/${encodeURIComponent(operationId)}`, {
             method: "POST",
             headers: { "content-type": "application/json" },
             body: JSON.stringify({
@@ -141,7 +114,14 @@ export function createSelfTestInvoke(app) {
                 input: input ?? {},
                 ...(connection ? { connection } : {}),
             }),
-        });
+            ...(signal ? { signal } : {}),
+        }));
+        const response = await responsePromise;
+        if (signal?.aborted) {
+            await cancelSelfTestResponse(response);
+            signal.throwIfAborted();
+        }
+        // An abort after body consumption starts may let response.text() finish.
         const text = await response.text();
         let body = text;
         try {
@@ -161,20 +141,52 @@ export function createSelfTestInvoke(app) {
         return { status: response.status, data: body };
     };
 }
+async function cancelSelfTestResponse(response) {
+    await response.body?.cancel().catch(() => undefined);
+}
+function selfTestAbortReason(reason, sensitiveValues) {
+    const text = reason instanceof Error
+        ? reason.message || reason.name
+        : reason === undefined
+            ? "aborted"
+            : String(reason);
+    return redactSelfTestText(text, sensitiveValues);
+}
+function logSelfTestCancellation(provider, options, requestId, selected, signal, sensitiveValues) {
+    const event = {
+        level: "info",
+        event: "self_test_run_cancelled",
+        providerId: provider.id,
+        requestId,
+        operationId: selected.operationId,
+        caseName: selected.healthCase.name,
+        reason: selfTestAbortReason(signal.reason, sensitiveValues),
+    };
+    if (options.logger) {
+        options.logger(event);
+        return;
+    }
+    console.log(JSON.stringify(event));
+}
 /** Binds the self-test auth-flow driver to a tenant app's /auth pipeline in-process. */
 export function createSelfTestAuthFlowInvoke(app) {
-    return async ({ route, requestId, flowId, connectionId, externalRef, input, context }) => {
+    return async ({ route, requestId, flowId, connectionId, externalRef, input, context, engine, signal, }) => {
         const response = await app.request(`/auth/${route}`, {
             method: "POST",
             headers: { "content-type": "application/json" },
             body: JSON.stringify({
                 requestId,
                 flowId,
+                // Engine ceremony leases are scoped to a tenant; the self-test has no
+                // customer tenant, so it presents a fixed one that never collides.
+                tenantId: "self-test",
                 ...(connectionId ? { connectionId } : {}),
                 ...(externalRef ? { externalRef } : {}),
                 ...(input ? { input } : {}),
                 ...(context ? { context } : {}),
+                ...(engine ? { engine } : {}),
             }),
+            ...(signal ? { signal } : {}),
         });
         const text = await response.text();
         let body = text;
@@ -193,19 +205,32 @@ class SelfTestCaseTimeoutError extends Error {
         this.name = "SelfTestCaseTimeoutError";
     }
 }
-async function withCaseTimeout(run, timeoutMs) {
+async function withCaseTimeout(run, timeoutMs, controller) {
     let timer;
+    let onAbort;
     try {
         return await Promise.race([
             run(),
             new Promise((_, reject) => {
-                timer = setTimeout(() => reject(new SelfTestCaseTimeoutError(timeoutMs)), timeoutMs);
+                timer = setTimeout(() => {
+                    const error = new SelfTestCaseTimeoutError(timeoutMs);
+                    controller.abort(error);
+                    reject(error);
+                }, timeoutMs);
+            }),
+            new Promise((_, reject) => {
+                onAbort = () => reject(controller.signal.reason);
+                controller.signal.addEventListener("abort", onAbort, { once: true });
+                if (controller.signal.aborted)
+                    onAbort();
             }),
         ]);
     }
     finally {
         if (timer !== undefined)
             clearTimeout(timer);
+        if (onAbort)
+            controller.signal.removeEventListener("abort", onAbort);
     }
 }
 function objectProperty(value, key) {
@@ -291,6 +316,7 @@ function parseAuthFlowResponse(result) {
         };
     }
     const contextPatch = objectProperty(result.body, "contextPatch");
+    const egressLease = objectProperty(objectProperty(result.body, "engine"), "egressLease");
     return {
         ok: true,
         turn: {
@@ -301,6 +327,7 @@ function parseAuthFlowResponse(result) {
         ...(contextPatch && typeof contextPatch === "object" && !Array.isArray(contextPatch)
             ? { contextPatch: contextPatch }
             : {}),
+        ...(typeof egressLease === "string" && egressLease ? { engine: { egressLease } } : {}),
     };
 }
 function applyAuthFlowContextPatch(base, patch) {
@@ -389,6 +416,7 @@ async function materializeFlowCredential(execution, inputs, options = {}) {
         flowId,
         ...(options.connectionId ? { connectionId: options.connectionId } : {}),
         ...(options.externalRef ? { externalRef: options.externalRef } : {}),
+        ...(options.signal ? { signal: options.signal } : {}),
     }));
     if (!started.ok) {
         return { kind: "flow_error", code: started.code, message: started.message };
@@ -460,6 +488,10 @@ async function materializeFlowCredential(execution, inputs, options = {}) {
             ...(options.externalRef ? { externalRef: options.externalRef } : {}),
             input: submitInputs,
             ...(Object.keys(flowContext).length > 0 ? { context: flowContext } : {}),
+            // The ceremony egress lease is engine state, not flow context: carry it the
+            // way the gateway does so the continue turn stays on the start turn's egress.
+            ...(started.engine ? { engine: started.engine } : {}),
+            ...(options.signal ? { signal: options.signal } : {}),
         }));
         if (!continued.ok) {
             // Providers built with defineCredentialsAuth cannot return a retry
@@ -613,6 +645,7 @@ async function resolveSelfTestConnection(execution, operationId, suite, options
         ...(options.isAbandoned !== undefined ? { isAbandoned: options.isAbandoned } : {}),
         connectionId,
         externalRef: `${execution.provider.id}-${operationId}-self-test`,
+        ...(options.signal ? { signal: options.signal } : {}),
     });
     if (!("credential" in materialized)) {
         // Only the multi-turn SKIP is negative-cached. Flow ERRORS
@@ -632,10 +665,9 @@ async function resolveSelfTestConnection(execution, operationId, suite, options
         }
         return materialized;
     }
-    // A flow that outlived the case deadline still completes here (the timeout
-    // only races the promise, it cannot cancel it). The case already reported
-    // self_test_timeout — caching this credential would let the next probe
-    // reuse a login whose latency just failed the case, hiding the failure.
+    // Abort is cooperative: a flow may still complete after the case deadline
+    // if provider code ignores the signal. Never cache that late credential or
+    // let the next probe hide the timed-out login.
     if (options.isAbandoned?.() === true) {
         return {
             kind: "flow_error",
@@ -659,7 +691,7 @@ async function resolveSelfTestConnection(execution, operationId, suite, options
 function isAuthFailureCaseResult(result) {
     return result.status === "failed" && (result.httpStatus === 401 || result.httpStatus === 403);
 }
-async function executeSelfTestCase(execution, operationId, suite, healthCase) {
+async function executeSelfTestCase(execution, operationId, suite, healthCase, caseController) {
     const { provider, invoke } = execution;
     // execution.sensitiveValues may grow while the case runs (flow-issued
     // secrets); redact always reads the live array.
@@ -671,6 +703,7 @@ async function executeSelfTestCase(execution, operationId, suite, healthCase) {
     // a 30s case must never take ~4×30s across its stages.
     const caseDeadlineAtMs = performance.now() + timeoutMs;
     const remainingCaseTimeoutMs = () => Math.max(1, Math.ceil(caseDeadlineAtMs - performance.now()));
+    const runWithCaseTimeout = (run, remainingMs) => withCaseTimeout(run, remainingMs, caseController);
     const beginCase = () => {
         const startedAt = new Date().toISOString();
         const startedAtMs = performance.now();
@@ -695,14 +728,15 @@ async function executeSelfTestCase(execution, operationId, suite, healthCase) {
         });
     }
     const resolveConnection = async (forceLogin) => {
-        // The timeout only races the flow promise — it cannot cancel it. Once
-        // the deadline fires, the still-running resolution is marked abandoned
-        // so its late completion cannot write the session cache.
+        // The deadline aborts the in-process flow request. Keep the abandonment
+        // guard as a backstop for provider code that ignores cancellation so a
+        // late completion still cannot write the session cache.
         let abandoned = false;
         try {
-            return await withCaseTimeout(() => resolveSelfTestConnection(execution, operationId, suite, {
+            return await runWithCaseTimeout(() => resolveSelfTestConnection(execution, operationId, suite, {
                 forceLogin,
                 isAbandoned: () => abandoned,
+                signal: caseController.signal,
             }), remainingCaseTimeoutMs());
         }
         catch (error) {
@@ -739,7 +773,10 @@ async function executeSelfTestCase(execution, operationId, suite, healthCase) {
         // operation attempt, or a slow login reads as a fast healthy case.
         const { startedAtMs, finish } = caseScope;
         try {
-            return await withCaseTimeout(async () => {
+            return await runWithCaseTimeout(async () => {
+                if (healthCase.assertions === undefined) {
+                    throw new Error(`Self-test cannot execute declarative health-check case "${healthCase.name}"; run its scenario through the health monitor.`);
+                }
                 const resolvedInput = resolveHealthCheckInputDateTokens(healthCase.input);
                 const preparedInput = healthCase.prepareInput
                     ? await healthCase.prepareInput({
@@ -758,6 +795,7 @@ async function executeSelfTestCase(execution, operationId, suite, healthCase) {
                                     input: gatewayInput,
                                     connection,
                                     requestId: `${execution.requestId}-prepare-${randomUUID()}`,
+                                    signal: caseController.signal,
                                 });
                                 if (executed.status === 401 || executed.status === 403) {
                                     prepareAuthStatus = executed.status;
@@ -777,6 +815,7 @@ async function executeSelfTestCase(execution, operationId, suite, healthCase) {
                     input: preparedInput,
                     connection,
                     requestId: `${execution.requestId}-${randomUUID()}`,
+                    signal: caseController.signal,
                 });
                 const durationMs = performance.now() - startedAtMs;
                 if (executed.status < 200 || executed.status >= 300) {
@@ -1054,41 +1093,65 @@ export function createSelfTestApp(provider, options) {
             };
             const deadline = performance.now() + requestBudgetMs;
             const results = [];
+            const runSignal = c.req.raw.signal;
+            let interruptedCase;
             // Sequential execution (parallelism 1): self-tests run on serving pods
             // and must never compete with themselves for upstream quota.
             for (const selected of selection.cases) {
-                if (performance.now() >= deadline) {
-                    const now = new Date().toISOString();
-                    results.push({
-                        operationId: selected.operationId,
-                        caseName: selected.healthCase.name,
-                        status: "skipped",
-                        label: selected.healthCase.name,
-                        responseTimeMs: 0,
-                        skipReason: "budget_exhausted",
-                        startedAt: now,
-                        finishedAt: now,
-                    });
-                    continue;
+                const caseController = new AbortController();
+                const abortFromRun = () => caseController.abort(runSignal.reason);
+                runSignal.addEventListener("abort", abortFromRun, { once: true });
+                if (runSignal.aborted)
+                    abortFromRun();
+                try {
+                    if (runSignal.aborted) {
+                        interruptedCase = selected;
+                        break;
+                    }
+                    if (performance.now() >= deadline) {
+                        const now = new Date().toISOString();
+                        results.push({
+                            operationId: selected.operationId,
+                            caseName: selected.healthCase.name,
+                            status: "skipped",
+                            label: selected.healthCase.name,
+                            responseTimeMs: 0,
+                            skipReason: "budget_exhausted",
+                            startedAt: now,
+                            finishedAt: now,
+                        });
+                        continue;
+                    }
+                    if (!isSelfTestReadOnlyOperation(selected.operation)) {
+                        const now = new Date().toISOString();
+                        results.push({
+                            operationId: selected.operationId,
+                            caseName: selected.healthCase.name,
+                            status: "error",
+                            label: selected.healthCase.name,
+                            responseTimeMs: 0,
+                            error: {
+                                code: "operation_not_read_only",
+                                message: `Operation "${selected.operationId}" is not classified read-only; self-test refuses to execute it.`,
+                            },
+                            startedAt: now,
+                            finishedAt: now,
+                        });
+                        continue;
+                    }
+                    results.push(await executeSelfTestCase(execution, selected.operationId, selected.suite, selected.healthCase, caseController));
+                    if (runSignal.aborted) {
+                        interruptedCase = selected;
+                        break;
+                    }
                 }
-                if (!isSelfTestReadOnlyOperation(selected.operation)) {
-                    const now = new Date().toISOString();
-                    results.push({
-                        operationId: selected.operationId,
-                        caseName: selected.healthCase.name,
-                        status: "error",
-                        label: selected.healthCase.name,
-                        responseTimeMs: 0,
-                        error: {
-                            code: "operation_not_read_only",
-                            message: `Operation "${selected.operationId}" is not classified read-only; self-test refuses to execute it.`,
-                        },
-                        startedAt: now,
-                        finishedAt: now,
-                    });
-                    continue;
+                finally {
+                    runSignal.removeEventListener("abort", abortFromRun);
+                    caseController.abort();
                 }
-                results.push(await executeSelfTestCase(execution, selected.operationId, selected.suite, selected.healthCase));
+            }
+            if (interruptedCase) {
+                logSelfTestCancellation(provider, options, request.requestId, interruptedCase, runSignal, execution.sensitiveValues);
             }
             const singleCase = request.operationId !== undefined && request.caseName !== undefined;
             const response = {

package/dist/server/sensitive-values.d.ts

@@ -0,0 +1,26 @@
+import type { ProviderDefinition } from "../types.js";
+export declare const SELF_TEST_SENSITIVE_SOURCE_KINDS: readonly ["selfTestMasterSecrets", "providerSecrets", "healthProbeSecrets", "requestCredentials"];
+/** Explicit source allowlist: no environment-name or payload-shape secret sweep. */
+export declare const DIAGNOSTIC_SENSITIVE_SOURCE_KINDS: readonly ["selfTestMasterSecrets", "providerSecrets", "healthProbeSecrets", "requestCredentials", "engineProxyCredentials", "engineSolverKeys", "engineCeremonyLeaseCredentials", "engineClientCredentials", "ocrCredentials", "sttCredentials", "cdpCredentials", "statefulForwardingSecret", "redisCredentials", "otlpHeaders", "cacheKeyPepper", "sensitiveParams"];
+export type DiagnosticSensitiveSourceKind = (typeof DIAGNOSTIC_SENSITIVE_SOURCE_KINDS)[number];
+/**
+ * Startup inventory; request-scoped readers additionally register live values on access.
+ */
+export declare function collectStaticDiagnosticSensitiveValues(provider: ProviderDefinition, options?: {
+    env?: Readonly<Record<string, string | undefined>>;
+    statefulForwardingSecret?: string;
+}): string[];
+/** Generalised self-test collector, also used to seed and enrich ordinary request scopes. */
+export declare function collectDiagnosticSensitiveValues(provider: ProviderDefinition, options?: {
+    env?: Readonly<Record<string, string | undefined>>;
+    credentialInputs?: Readonly<Record<string, unknown>>;
+    connectionSecrets?: Readonly<Record<string, string | undefined>>;
+    sensitiveParams?: readonly string[];
+    statefulForwardingSecret?: string;
+    sourceKinds?: readonly DiagnosticSensitiveSourceKind[];
+    minimumLength?: number;
+    /** Preserve the legacy self-test response collector when false. */
+    includeResolvedEnvVariants?: boolean;
+}): string[];
+/** Derive the live-read allowlist from the same collector as the startup inventory. */
+export declare function createDiagnosticEnvObserver(provider: ProviderDefinition, register: (values: readonly string[]) => void, has?: (value: string) => boolean): (name: string, value: string) => void;

package/dist/server/sensitive-values.js

@@ -0,0 +1,137 @@
+import { resolvedStringVariants, urlCredentialComponents, otlpHeaderCredentialValues, } from "../runtime/diagnostic-env-values.js";
+import { PROVIDER_CACHE_REDIS_URL_ENV, PROVIDER_STATE_REDIS_URL_ENV, REDIS_URL_ENV, } from "../config/loader.js";
+import { ENGINE_OWNED_PROXY_CREDENTIAL_ENV_NAMES, ENGINE_OWNED_RESOLVER_CREDENTIAL_ENV_NAMES, } from "../engine.js";
+import { REMOTE_ENGINE_CLIENT_API_KEY_ENV, REMOTE_ENGINE_CLIENT_URL_ENV, } from "../runtime/engine-mode.js";
+import { APIFUSE__CACHE__KEY_PEPPER_ENV } from "../runtime/cache.js";
+import { APIFUSE__ENGINE__CEREMONY_LEASE_KEY } from "../runtime/egress-lease.js";
+import { APIFUSE__OCR__API_KEY_ENV, APIFUSE__OCR__CLOUDFLARE_API_TOKEN_ENV, } from "../runtime/ocr.js";
+import { OTEL_EXPORTER_OTLP_HEADERS, OTEL_EXPORTER_OTLP_TRACES_HEADERS, OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_TRACES_ENDPOINT, } from "../runtime/otlp.js";
+import { APIFUSE__CDP_POOL__URL } from "../runtime/resolver-config.js";
+import { APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV } from "../runtime/stt.js";
+import { PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_ENV, PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_PREVIOUS_ENV, } from "./self-test-token.js";
+export const SELF_TEST_SENSITIVE_SOURCE_KINDS = [
+    "selfTestMasterSecrets",
+    "providerSecrets",
+    "healthProbeSecrets",
+    "requestCredentials",
+];
+/** Explicit source allowlist: no environment-name or payload-shape secret sweep. */
+export const DIAGNOSTIC_SENSITIVE_SOURCE_KINDS = [
+    ...SELF_TEST_SENSITIVE_SOURCE_KINDS,
+    "engineProxyCredentials",
+    "engineSolverKeys",
+    "engineCeremonyLeaseCredentials",
+    "engineClientCredentials",
+    "ocrCredentials",
+    "sttCredentials",
+    "cdpCredentials",
+    "statefulForwardingSecret",
+    "redisCredentials",
+    "otlpHeaders",
+    "cacheKeyPepper",
+    "sensitiveParams",
+];
+/**
+ * Startup inventory; request-scoped readers additionally register live values on access.
+ */
+export function collectStaticDiagnosticSensitiveValues(provider, options = {}) {
+    return collectDiagnosticSensitiveValues(provider, {
+        ...options,
+        sourceKinds: DIAGNOSTIC_SENSITIVE_SOURCE_KINDS.filter((kind) => kind !== "requestCredentials" && kind !== "sensitiveParams"),
+    });
+}
+/** Generalised self-test collector, also used to seed and enrich ordinary request scopes. */
+export function collectDiagnosticSensitiveValues(provider, options = {}) {
+    const env = options.env ?? process.env;
+    const envValues = (names) => names.map((name) => env[name]);
+    const resolvedEnvValues = (names) => envValues(names).flatMap((value) => value === undefined
+        ? []
+        : options.includeResolvedEnvVariants === false
+            ? [value]
+            : [value, value.trim()]);
+    const healthProbe = provider.healthProbe ?? provider.healthMonitor;
+    const sources = {
+        selfTestMasterSecrets: () => resolvedEnvValues([
+            PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_ENV,
+            PROVIDER_RUNTIME_SELF_TEST_MASTER_SECRET_PREVIOUS_ENV,
+        ]),
+        providerSecrets: () => resolvedEnvValues((provider.secrets ?? []).map((secret) => secret.name)),
+        healthProbeSecrets: () => resolvedEnvValues([
+            ...(healthProbe?.requiredSecrets ?? []),
+            ...Object.values(healthProbe?.credentialInputs ?? {}),
+        ]),
+        requestCredentials: () => [
+            ...Object.values(options.credentialInputs ?? {}),
+            ...Object.values(options.connectionSecrets ?? {}),
+        ],
+        engineProxyCredentials: () => resolvedEnvValues(ENGINE_OWNED_PROXY_CREDENTIAL_ENV_NAMES),
+        // These are the resolver-config API keys after #251's engine credential projection.
+        engineSolverKeys: () => resolvedEnvValues(ENGINE_OWNED_RESOLVER_CREDENTIAL_ENV_NAMES),
+        engineCeremonyLeaseCredentials: () => resolvedEnvValues([APIFUSE__ENGINE__CEREMONY_LEASE_KEY]),
+        // Remote engine client credential (projected before the ADR-0011 flip). The
+        // endpoint itself is an internal service URL, so only credentials embedded
+        // in it are inventoried, not the whole URL.
+        engineClientCredentials: () => [
+            ...resolvedEnvValues([REMOTE_ENGINE_CLIENT_API_KEY_ENV]),
+            ...resolvedStringVariants(env[REMOTE_ENGINE_CLIENT_URL_ENV]).flatMap((url) => urlCredentialComponents(url, { includePathAndQuery: false })),
+        ],
+        ocrCredentials: () => resolvedEnvValues([APIFUSE__OCR__CLOUDFLARE_API_TOKEN_ENV, APIFUSE__OCR__API_KEY_ENV]),
+        sttCredentials: () => resolvedEnvValues([APIFUSE__STT__CLOUDFLARE_API_TOKEN_ENV]),
+        cdpCredentials: () => resolvedStringVariants(env[APIFUSE__CDP_POOL__URL]).flatMap((url) => [
+            url,
+            ...urlCredentialComponents(url, { includePathAndQuery: true }),
+        ]),
+        statefulForwardingSecret: () => resolvedStringVariants(options.statefulForwardingSecret),
+        redisCredentials: () => [PROVIDER_CACHE_REDIS_URL_ENV, PROVIDER_STATE_REDIS_URL_ENV, REDIS_URL_ENV]
+            .flatMap((name) => resolvedStringVariants(env[name]))
+            .flatMap((url) => urlCredentialComponents(url, { includePathAndQuery: false })),
+        otlpHeaders: () => [
+            ...[OTEL_EXPORTER_OTLP_TRACES_HEADERS, OTEL_EXPORTER_OTLP_HEADERS].flatMap((name) => env[name] === undefined ? [] : otlpHeaderCredentialValues(env[name])),
+            ...[OTEL_EXPORTER_OTLP_ENDPOINT, OTEL_EXPORTER_OTLP_TRACES_ENDPOINT].flatMap((name) => resolvedStringVariants(env[name]).flatMap((url) => urlCredentialComponents(url, { includePathAndQuery: false }))),
+        ],
+        cacheKeyPepper: () => resolvedEnvValues([APIFUSE__CACHE__KEY_PEPPER_ENV]),
+        sensitiveParams: () => options.sensitiveParams ?? [],
+    };
+    const values = new Set();
+    for (const kind of options.sourceKinds ?? DIAGNOSTIC_SENSITIVE_SOURCE_KINDS) {
+        for (const value of sources[kind]()) {
+            if (typeof value === "string" && value.length >= (options.minimumLength ?? 1))
+                values.add(value);
+        }
+    }
+    return [...values];
+}
+const diagnosticEnvNames = new WeakMap();
+/** Derive the live-read allowlist from the same collector as the startup inventory. */
+export function createDiagnosticEnvObserver(provider, register, has) {
+    let names = diagnosticEnvNames.get(provider);
+    if (!names) {
+        names = new Set();
+        const captured = names;
+        collectStaticDiagnosticSensitiveValues(provider, {
+            env: new Proxy({}, {
+                get: (_target, key) => {
+                    if (typeof key === "string")
+                        captured.add(key);
+                    return undefined;
+                },
+            }),
+        });
+        diagnosticEnvNames.set(provider, names);
+    }
+    const seen = new Map();
+    return (name, value) => {
+        if (!names.has(name) || seen.get(name) === value)
+            return;
+        if (has?.(value) && has(value.trim()))
+            return;
+        // Includes URL userinfo/CDP components and OTLP auth values, using the same rules.
+        register([
+            ...resolvedStringVariants(value),
+            ...collectStaticDiagnosticSensitiveValues(provider, {
+                env: { [name]: value },
+            }),
+        ]);
+        seen.set(name, value);
+    };
+}