npm - @introspection-sdk/introspection-proxy - Versions diffs - 0.7.2 → 0.8.1 - Mend

@introspection-sdk/introspection-proxy 0.7.2 → 0.8.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (17) hide show

package/.turbo/turbo-build.log CHANGED Viewed

@@ -1,4 +1,4 @@
-> @introspection-sdk/introspection-proxy@0.7.2 build /home/runner/work/introspection-js-sdk/introspection-js-sdk/packages/introspection-proxy
+> @introspection-sdk/introspection-proxy@0.8.1 build /home/runner/work/introspection-js-sdk/introspection-js-sdk/packages/introspection-proxy
 > tsc

package/dist/index.d.ts CHANGED Viewed

@@ -1,13 +1,17 @@
 /**
  * `@introspection-sdk/introspection-proxy`
  *
- * Lightweight, dependency-minimal (undici only) helpers for routing
- * `fetch`-based clients through the Introspection egress credential-injection
- * proxy or a standard forward proxy. Has no OpenTelemetry or provider-SDK
- * dependencies, so it can be used standalone (e.g. alongside the
- * `introspection-pi` instrumentation wrapper) without pulling in the full
- * `introspection-node` surface.
+ * Lightweight, dependency-minimal helpers for routing `fetch`-based clients
+ * through the Introspection egress credential-injection proxy or a standard
+ * forward proxy. Depends only on undici and the zero-dependency
+ * `@opentelemetry/api` (proxied requests emit `introspection-proxy-call`
+ * spans that no-op unless the host process registers a tracer provider — no
+ * OTel SDK or provider-SDK dependencies), so it can be used standalone (e.g.
+ * alongside the `introspection-pi` instrumentation wrapper) without pulling
+ * in the full `introspection-node` surface.
  */
 export { getProxyDispatcher, createProxyFetch, installProxyFetch, resolveForwardProxyUrl, } from "./proxy.js";
 export type { ProxyFetchOptions } from "./proxy.js";
+export { PROXY_CALL_SPAN_NAME, PROXY_TRACER_NAME } from "./tracing.js";
+export type { ProxyMode } from "./tracing.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA~~;;;;;;;;;GASG~~;AACH,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC"}
1	+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AACvE,YAAY,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.js CHANGED Viewed

@@ -1,12 +1,15 @@
 /**
  * `@introspection-sdk/introspection-proxy`
  *
- * Lightweight, dependency-minimal (undici only) helpers for routing
- * `fetch`-based clients through the Introspection egress credential-injection
- * proxy or a standard forward proxy. Has no OpenTelemetry or provider-SDK
- * dependencies, so it can be used standalone (e.g. alongside the
- * `introspection-pi` instrumentation wrapper) without pulling in the full
- * `introspection-node` surface.
+ * Lightweight, dependency-minimal helpers for routing `fetch`-based clients
+ * through the Introspection egress credential-injection proxy or a standard
+ * forward proxy. Depends only on undici and the zero-dependency
+ * `@opentelemetry/api` (proxied requests emit `introspection-proxy-call`
+ * spans that no-op unless the host process registers a tracer provider — no
+ * OTel SDK or provider-SDK dependencies), so it can be used standalone (e.g.
+ * alongside the `introspection-pi` instrumentation wrapper) without pulling
+ * in the full `introspection-node` surface.
  */
 export { getProxyDispatcher, createProxyFetch, installProxyFetch, resolveForwardProxyUrl, } from "./proxy.js";
+export { PROXY_CALL_SPAN_NAME, PROXY_TRACER_NAME } from "./tracing.js";
 //# sourceMappingURL=index.js.map

package/dist/index.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA~~;;;;;;;;;GASG~~;AACH,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,YAAY,CAAC"}
1	+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EACL,kBAAkB,EAClB,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,GACvB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC"}

package/dist/proxy.d.ts CHANGED Viewed

@@ -3,6 +3,13 @@ export interface ProxyFetchOptions {
     egressProxyUrl?: string;
     egressProxyHosts?: string;
     forwardProxyUrl?: string;
+    /**
+     * Emit an `introspection-proxy-call` OTel span per proxied request
+     * (default true). Spans no-op unless the host process registered a tracer
+     * provider. Direct requests (no proxy, or `NO_PROXY` hosts) never get a
+     * span regardless of this flag.
+     */
+    tracing?: boolean;
 }
 export declare function resolveForwardProxyUrl(): string | undefined;
 /**

package/dist/proxy.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAiBA,OAAO,EAKL,KAAK,UAAU,EAChB,MAAM,QAAQ,CAAC;~~AAEhB~~,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;~~CAC1B~~;AAiBD,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,SAAS,CAQ3D;AA0BD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,GAAE,iBAAsB,GAC9B,UAAU,GAAG,SAAS,CAUxB;AAaD,wBAAgB,gBAAgB,CAC9B,OAAO,GAAE,iBAAsB,GAC9B,OAAO,KAAK,~~CAwDd~~;AAED,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,iBAAsB,GAAG,MAAM,IAAI,CAU7E"}
1	+ {"version":3,"file":"proxy.d.ts","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAiBA,OAAO,EAKL,KAAK,UAAU,EAChB,MAAM,QAAQ,CAAC;AAOhB,MAAM,WAAW,iBAAiB;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;OAKG;IACH,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAiBD,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,SAAS,CAQ3D;AA0BD;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,GAAE,iBAAsB,GAC9B,UAAU,GAAG,SAAS,CAUxB;AAaD,wBAAgB,gBAAgB,CAC9B,OAAO,GAAE,iBAAsB,GAC9B,OAAO,KAAK,CAmFd;AAED,wBAAgB,iBAAiB,CAAC,OAAO,GAAE,iBAAsB,GAAG,MAAM,IAAI,CAU7E"}

package/dist/proxy.js CHANGED Viewed

@@ -16,6 +16,7 @@
 import { Socket } from "node:net";
 import { connect as tlsConnect } from "node:tls";
 import { Agent, EnvHttpProxyAgent, fetch as undiciFetch, } from "undici";
+import { matchesNoProxy, parseNoProxyEntries, tracedProxyCall, } from "./tracing.js";
 function resolveEgressUrl(options) {
     return options.egressProxyUrl ?? process.env.INTROSPECTION_EGRESS_URL;
 }
@@ -94,8 +95,13 @@ export function createProxyFetch(options = {}) {
         : undefined;
     if (!egress && !forward)
         return base;
+    const tracing = options.tracing ?? true;
+    // Snapshot NO_PROXY once, like EnvHttpProxyAgent does at construction. Used
+    // only to decide span emission — undici owns the actual routing.
+    const noProxyEntries = parseNoProxyEntries(process.env);
     return (input, init) => {
-        const hostname = new URL(toUrlString(input)).hostname.toLowerCase();
+        const url = new URL(toUrlString(input));
+        const hostname = url.hostname.toLowerCase();
         const useEgress = !!egress && egressHosts.size > 0 && egressHosts.has(hostname);
         const dispatcher = useEgress ? egress : forward;
         if (!dispatcher)
@@ -124,7 +130,18 @@ export function createProxyFetch(options = {}) {
         if (useEgress && egressIsPlainHttp) {
             target = downgradeToHttp(target);
         }
-        return undiciFetch(target, opts);
+        const execute = () => undiciFetch(target, opts);
+        // A forward-dispatched request to a NO_PROXY host goes direct inside
+        // EnvHttpProxyAgent — no proxy hop, so no proxy span (in-cluster clients
+        // trace those calls themselves as `introspection-api-call`).
+        const viaProxy = useEgress || !matchesNoProxy(hostname, url.port, noProxyEntries);
+        if (!tracing || !viaProxy)
+            return execute();
+        const method = (init?.method ??
+            (typeof Request !== "undefined" && input instanceof Request
+                ? input.method
+                : "GET")).toUpperCase();
+        return tracedProxyCall(useEgress ? "egress" : "forward", method, url, execute);
     };
 }
 export function installProxyFetch(options = {}) {

package/dist/proxy.js.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EACL,KAAK,EACL,iBAAiB,EAEjB,KAAK,IAAI,WAAW,GAErB,MAAM,QAAQ,CAAC;~~AAQhB~~,SAAS,gBAAgB,CAAC,OAA0B;IAClD,OAAO,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;AACxE,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA0B;IACpD,MAAM,GAAG,GACP,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC;IAC7E,OAAO,IAAI,GAAG,CACZ,GAAG;SACA,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,OAAO,CAAC,CACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,WAAW;QACvB,OAAO,CAAC,GAAG,CAAC,WAAW;QACvB,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,SAAS,CACV,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAE1B,OAAO,IAAI,KAAK,CAAC;QACf,OAAO,CACL,QAAgC,EAChC,QAAiC;YAEjC,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC5D,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;gBAC3D,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YACrD,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;gBAC5B,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;gBACzD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAA6B,EAAE;IAE/B,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,SAAS,IAAI,aAAa,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,sBAAsB,EAAE,EAAE,CAAC;QAC7B,OAAO,IAAI,iBAAiB,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,KAAwB;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,YAAY,GAAG;QAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;IAClD,OAAQ,KAAiB,CAAC,GAAG,CAAC;AAChC,CAAC;AAED,SAAS,eAAe,CAAC,GAAiB;IACxC,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IACzD,OAAO,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,UAA6B,EAAE;IAE/B,6DAA6D;IAC7D,4EAA4E;IAC5E,oEAAoE;IACpE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC;IAC9B,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,iBAAiB,GACrB,CAAC,CAAC,SAAS,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;IAEzD,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,MAAM,OAAO,GAAG,sBAAsB,EAAE;QACtC,CAAC,CAAC,IAAI,iBAAiB,EAAE;QACzB,CAAC,CAAC,SAAS,CAAC;IAEd,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAErC,OAAO,CAAC,KAAwB,EAAE,IAAkB,EAAqB,EAAE;QACzE,MAAM,~~QAAQ~~,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;~~QAEpE~~,MAAM,SAAS,GACb,CAAC,CAAC,MAAM,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAEhD,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAE1C,IAAI,MAAoB,CAAC;QACzB,IAAI,IAA6B,CAAC;QAElC,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,KAAK,YAAY,OAAO,EAAE,CAAC;YAC/D,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC;YACnB,IAAI,GAAG;gBACL,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,GAAG,IAAI;gBACP,UAAU;aACX,CAAC;YACF,IAAI,KAAK,CAAC,IAAI,IAAI,IAAI;gBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,KAAqB,CAAC;YAC/B,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,CAAC;QACjC,CAAC;QAED,IAAI,SAAS,IAAI,iBAAiB,EAAE,CAAC;YACnC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QAED,OAAO,WAAW,~~CAChB~~,MAAsD,EACtD,IAAoD,CACrB,CAAC;~~IACpC~~,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,UAA6B,EAAE;IAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC;IAClC,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAC1C,UAAU,CAAC,KAAK,GAAG,OAAO,CAAC;IAC3B,OAAO,GAAG,EAAE;QACV,IAAI,UAAU,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YACjC,UAAU,CAAC,KAAK,GAAG,QAAQ,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}
1	+ {"version":3,"file":"proxy.js","sourceRoot":"","sources":["../src/proxy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,MAAM,EAAE,MAAM,UAAU,CAAC;AAClC,OAAO,EAAE,OAAO,IAAI,UAAU,EAAE,MAAM,UAAU,CAAC;AACjD,OAAO,EACL,KAAK,EACL,iBAAiB,EAEjB,KAAK,IAAI,WAAW,GAErB,MAAM,QAAQ,CAAC;AAChB,OAAO,EACL,cAAc,EACd,mBAAmB,EACnB,eAAe,GAChB,MAAM,cAAc,CAAC;AAetB,SAAS,gBAAgB,CAAC,OAA0B;IAClD,OAAO,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC;AACxE,CAAC;AAED,SAAS,kBAAkB,CAAC,OAA0B;IACpD,MAAM,GAAG,GACP,OAAO,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,4BAA4B,IAAI,EAAE,CAAC;IAC7E,OAAO,IAAI,GAAG,CACZ,GAAG;SACA,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAClC,MAAM,CAAC,OAAO,CAAC,CACnB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,CACL,OAAO,CAAC,GAAG,CAAC,WAAW;QACvB,OAAO,CAAC,GAAG,CAAC,WAAW;QACvB,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,OAAO,CAAC,GAAG,CAAC,UAAU;QACtB,SAAS,CACV,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC7C,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC9B,MAAM,MAAM,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC;IAE1B,OAAO,IAAI,KAAK,CAAC;QACf,OAAO,CACL,QAAgC,EAChC,QAAiC;YAEjC,IAAI,MAAM,EAAE,CAAC;gBACX,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC5D,MAAM,CAAC,IAAI,CAAC,eAAe,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;gBAC3D,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YACrD,CAAC;iBAAM,CAAC;gBACN,MAAM,MAAM,GAAG,IAAI,MAAM,EAAE,CAAC;gBAC5B,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;gBACzD,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,UAA6B,EAAE;IAE/B,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,aAAa,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAClD,IAAI,SAAS,IAAI,aAAa,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;QACxC,OAAO,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,sBAAsB,EAAE,EAAE,CAAC;QAC7B,OAAO,IAAI,iBAAiB,EAAE,CAAC;IACjC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,WAAW,CAAC,KAAwB;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,KAAK,YAAY,GAAG;QAAE,OAAO,KAAK,CAAC,QAAQ,EAAE,CAAC;IAClD,OAAQ,KAAiB,CAAC,GAAG,CAAC;AAChC,CAAC;AAED,SAAS,eAAe,CAAC,GAAiB;IACxC,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC;IACzD,OAAO,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,MAAM,UAAU,gBAAgB,CAC9B,UAA6B,EAAE;IAE/B,6DAA6D;IAC7D,4EAA4E;IAC5E,oEAAoE;IACpE,MAAM,IAAI,GAAG,UAAU,CAAC,KAAK,CAAC;IAC9B,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,iBAAiB,GACrB,CAAC,CAAC,SAAS,IAAI,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC;IAEzD,MAAM,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxE,MAAM,OAAO,GAAG,sBAAsB,EAAE;QACtC,CAAC,CAAC,IAAI,iBAAiB,EAAE;QACzB,CAAC,CAAC,SAAS,CAAC;IAEd,IAAI,CAAC,MAAM,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAErC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,IAAI,CAAC;IACxC,4EAA4E;IAC5E,iEAAiE;IACjE,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAExD,OAAO,CAAC,KAAwB,EAAE,IAAkB,EAAqB,EAAE;QACzE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QAE5C,MAAM,SAAS,GACb,CAAC,CAAC,MAAM,IAAI,WAAW,CAAC,IAAI,GAAG,CAAC,IAAI,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC;QAEhD,IAAI,CAAC,UAAU;YAAE,OAAO,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAE1C,IAAI,MAAoB,CAAC;QACzB,IAAI,IAA6B,CAAC;QAElC,IAAI,OAAO,OAAO,KAAK,WAAW,IAAI,KAAK,YAAY,OAAO,EAAE,CAAC;YAC/D,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC;YACnB,IAAI,GAAG;gBACL,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,IAAI,EAAE,KAAK,CAAC,IAAI;gBAChB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,WAAW,EAAE,KAAK,CAAC,WAAW;gBAC9B,GAAG,IAAI;gBACP,UAAU;aACX,CAAC;YACF,IAAI,KAAK,CAAC,IAAI,IAAI,IAAI;gBAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QAC/C,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,KAAqB,CAAC;YAC/B,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,CAAC;QACjC,CAAC;QAED,IAAI,SAAS,IAAI,iBAAiB,EAAE,CAAC;YACnC,MAAM,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;QACnC,CAAC;QAED,MAAM,OAAO,GAAG,GAAG,EAAE,CACnB,WAAW,CACT,MAAsD,EACtD,IAAoD,CACrB,CAAC;QAEpC,qEAAqE;QACrE,yEAAyE;QACzE,6DAA6D;QAC7D,MAAM,QAAQ,GACZ,SAAS,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO,IAAI,CAAC,QAAQ;YAAE,OAAO,OAAO,EAAE,CAAC;QAE5C,MAAM,MAAM,GAAG,CACb,IAAI,EAAE,MAAM;YACZ,CAAC,OAAO,OAAO,KAAK,WAAW,IAAI,KAAK,YAAY,OAAO;gBACzD,CAAC,CAAC,KAAK,CAAC,MAAM;gBACd,CAAC,CAAC,KAAK,CAAC,CACX,CAAC,WAAW,EAAE,CAAC;QAChB,OAAO,eAAe,CACpB,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,EAChC,MAAM,EACN,GAAG,EACH,OAAO,CACR,CAAC;IACJ,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,UAA6B,EAAE;IAC/D,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC;IAClC,MAAM,OAAO,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAC1C,UAAU,CAAC,KAAK,GAAG,OAAO,CAAC;IAC3B,OAAO,GAAG,EAAE;QACV,IAAI,UAAU,CAAC,KAAK,KAAK,OAAO,EAAE,CAAC;YACjC,UAAU,CAAC,KAAK,GAAG,QAAQ,CAAC;QAC9B,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/tracing.d.ts ADDED Viewed

@@ -0,0 +1,14 @@
+export declare const PROXY_CALL_SPAN_NAME = "introspection-proxy-call";
+export declare const PROXY_TRACER_NAME = "@introspection-sdk/introspection-proxy";
+export type ProxyMode = "egress" | "forward";
+/**
+ * Parse `NO_PROXY`/`no_proxy` into normalized entries. Mirrors undici's
+ * `EnvHttpProxyAgent` semantics closely enough to decide span emission —
+ * undici still owns the actual routing decision.
+ */
+export declare function parseNoProxyEntries(env: NodeJS.ProcessEnv): string[];
+/** Whether `hostname[:port]` matches a `NO_PROXY` entry (i.e. goes direct). */
+export declare function matchesNoProxy(hostname: string, port: string, entries: string[]): boolean;
+/** Run `execute` inside an `introspection-proxy-call` CLIENT span. */
+export declare function tracedProxyCall(mode: ProxyMode, method: string, url: URL, execute: () => Promise<Response>): Promise<Response>;
+//# sourceMappingURL=tracing.d.ts.map

package/dist/tracing.d.ts.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"tracing.d.ts","sourceRoot":"","sources":["../src/tracing.ts"],"names":[],"mappings":"AAuBA,eAAO,MAAM,oBAAoB,6BAA6B,CAAC;AAC/D,eAAO,MAAM,iBAAiB,2CAA2C,CAAC;AAE1E,MAAM,MAAM,SAAS,GAAG,QAAQ,GAAG,SAAS,CAAC;AAE7C;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,EAAE,CAMpE;AAED,+EAA+E;AAC/E,wBAAgB,cAAc,CAC5B,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,OAAO,EAAE,MAAM,EAAE,GAChB,OAAO,CAeT;AAED,sEAAsE;AACtE,wBAAgB,eAAe,CAC7B,IAAI,EAAE,SAAS,EACf,MAAM,EAAE,MAAM,EACd,GAAG,EAAE,GAAG,EACR,OAAO,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,GAC/B,OAAO,CAAC,QAAQ,CAAC,CAoCnB"}

package/dist/tracing.js ADDED Viewed

@@ -0,0 +1,94 @@
+/**
+ * OpenTelemetry span instrumentation for proxied requests.
+ *
+ * Emits one `introspection-proxy-call` CLIENT span per request that is
+ * actually routed through a proxy (egress credential-injection or forward
+ * CONNECT). Requests that go direct — no proxy configured, or the host is
+ * excluded via `NO_PROXY` — deliberately get no span: in-cluster callers
+ * (`NO_PROXY` covers the DP API) already trace those calls at the client
+ * layer, so proxy spans and client-layer spans stay mutually exclusive.
+ *
+ * Depends only on `@opentelemetry/api`: without a registered tracer provider
+ * every span here is a no-op, so the package stays safe to load in bare Node
+ * processes (e.g. the sandbox `NODE_OPTIONS` preload).
+ *
+ * Attributes are intentionally lean — transport shape only (method, host,
+ * port, query-stripped URL, proxy mode, status). Tenant/task identity is
+ * inferred server-side from the request's JWT, or stamped globally by the
+ * host process's span processors, never duplicated here. Query strings are
+ * stripped because they can carry capability tokens (presigned URLs,
+ * share ids).
+ */
+import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
+export const PROXY_CALL_SPAN_NAME = "introspection-proxy-call";
+export const PROXY_TRACER_NAME = "@introspection-sdk/introspection-proxy";
+/**
+ * Parse `NO_PROXY`/`no_proxy` into normalized entries. Mirrors undici's
+ * `EnvHttpProxyAgent` semantics closely enough to decide span emission —
+ * undici still owns the actual routing decision.
+ */
+export function parseNoProxyEntries(env) {
+    const raw = env.NO_PROXY ?? env.no_proxy ?? "";
+    return raw
+        .split(",")
+        .map((entry) => entry.trim().toLowerCase())
+        .filter(Boolean);
+}
+/** Whether `hostname[:port]` matches a `NO_PROXY` entry (i.e. goes direct). */
+export function matchesNoProxy(hostname, port, entries) {
+    for (const raw of entries) {
+        if (raw === "*")
+            return true;
+        let entry = raw;
+        let entryPort = "";
+        const colon = entry.lastIndexOf(":");
+        if (colon !== -1 && !entry.slice(colon).includes("]")) {
+            entryPort = entry.slice(colon + 1);
+            entry = entry.slice(0, colon);
+        }
+        if (entryPort && entryPort !== port)
+            continue;
+        if (entry.startsWith("."))
+            entry = entry.slice(1);
+        if (hostname === entry || hostname.endsWith(`.${entry}`))
+            return true;
+    }
+    return false;
+}
+/** Run `execute` inside an `introspection-proxy-call` CLIENT span. */
+export function tracedProxyCall(mode, method, url, execute) {
+    const tracer = trace.getTracer(PROXY_TRACER_NAME);
+    const port = Number(url.port) || (url.protocol === "https:" ? 443 : 80);
+    return tracer.startActiveSpan(PROXY_CALL_SPAN_NAME, {
+        kind: SpanKind.CLIENT,
+        attributes: {
+            "http.request.method": method,
+            "server.address": url.hostname,
+            "server.port": port,
+            "url.full": url.origin + url.pathname,
+            "url.path": url.pathname,
+            "introspection.proxy.mode": mode,
+        },
+    }, async (span) => {
+        try {
+            const response = await execute();
+            span.setAttribute("http.response.status_code", response.status);
+            if (response.status >= 400) {
+                span.setStatus({ code: SpanStatusCode.ERROR });
+            }
+            return response;
+        }
+        catch (err) {
+            span.recordException(err instanceof Error ? err : String(err));
+            span.setStatus({
+                code: SpanStatusCode.ERROR,
+                message: err instanceof Error ? err.message : String(err),
+            });
+            throw err;
+        }
+        finally {
+            span.end();
+        }
+    });
+}
+//# sourceMappingURL=tracing.js.map

package/dist/tracing.js.map ADDED Viewed

@@ -0,0 +1 @@

+ {"version":3,"file":"tracing.js","sourceRoot":"","sources":["../src/tracing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,QAAQ,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAErE,MAAM,CAAC,MAAM,oBAAoB,GAAG,0BAA0B,CAAC;AAC/D,MAAM,CAAC,MAAM,iBAAiB,GAAG,wCAAwC,CAAC;AAI1E;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAsB;IACxD,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC/C,OAAO,GAAG;SACP,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAC1C,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAC5B,QAAgB,EAChB,IAAY,EACZ,OAAiB;IAEjB,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;QAC1B,IAAI,GAAG,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QAC7B,IAAI,KAAK,GAAG,GAAG,CAAC;QAChB,IAAI,SAAS,GAAG,EAAE,CAAC;QACnB,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACtD,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YACnC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAChC,CAAC;QACD,IAAI,SAAS,IAAI,SAAS,KAAK,IAAI;YAAE,SAAS;QAC9C,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAClD,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,EAAE,CAAC;YAAE,OAAO,IAAI,CAAC;IACxE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,eAAe,CAC7B,IAAe,EACf,MAAc,EACd,GAAQ,EACR,OAAgC;IAEhC,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,iBAAiB,CAAC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC,eAAe,CAC3B,oBAAoB,EACpB;QACE,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,UAAU,EAAE;YACV,qBAAqB,EAAE,MAAM;YAC7B,gBAAgB,EAAE,GAAG,CAAC,QAAQ;YAC9B,aAAa,EAAE,IAAI;YACnB,UAAU,EAAE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ;YACrC,UAAU,EAAE,GAAG,CAAC,QAAQ;YACxB,0BAA0B,EAAE,IAAI;SACjC;KACF,EACD,KAAK,EAAE,IAAI,EAAE,EAAE;QACb,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC,YAAY,CAAC,2BAA2B,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAChE,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC3B,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC;YACjD,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,eAAe,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC/D,IAAI,CAAC,SAAS,CAAC;gBACb,IAAI,EAAE,cAAc,CAAC,KAAK;gBAC1B,OAAO,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;aAC1D,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,CAAC;IACH,CAAC,CACF,CAAC;AACJ,CAAC"}

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@introspection-sdk/introspection-proxy",
-  "version": "0.7.2",
+  "version": "0.8.1",
   "license": "Apache-2.0",
   "description": "Outbound HTTP proxy helpers for routing fetch-based clients through the Introspection egress proxy or a standard forward proxy",
   "engines": {
@@ -16,6 +16,7 @@
     }
   },
   "dependencies": {
+    "@opentelemetry/api": "^1.9.0",
     "undici": "^8.7.0"
   },
   "devDependencies": {

package/src/index.ts CHANGED Viewed

@@ -1,12 +1,14 @@
 /**
  * `@introspection-sdk/introspection-proxy`
  *
- * Lightweight, dependency-minimal (undici only) helpers for routing
- * `fetch`-based clients through the Introspection egress credential-injection
- * proxy or a standard forward proxy. Has no OpenTelemetry or provider-SDK
- * dependencies, so it can be used standalone (e.g. alongside the
- * `introspection-pi` instrumentation wrapper) without pulling in the full
- * `introspection-node` surface.
+ * Lightweight, dependency-minimal helpers for routing `fetch`-based clients
+ * through the Introspection egress credential-injection proxy or a standard
+ * forward proxy. Depends only on undici and the zero-dependency
+ * `@opentelemetry/api` (proxied requests emit `introspection-proxy-call`
+ * spans that no-op unless the host process registers a tracer provider — no
+ * OTel SDK or provider-SDK dependencies), so it can be used standalone (e.g.
+ * alongside the `introspection-pi` instrumentation wrapper) without pulling
+ * in the full `introspection-node` surface.
  */
 export {
   getProxyDispatcher,
@@ -15,3 +17,5 @@ export {
   resolveForwardProxyUrl,
 } from "./proxy.js";
 export type { ProxyFetchOptions } from "./proxy.js";
+export { PROXY_CALL_SPAN_NAME, PROXY_TRACER_NAME } from "./tracing.js";
+export type { ProxyMode } from "./tracing.js";

package/src/proxy.ts CHANGED Viewed

@@ -22,11 +22,23 @@ import {
   fetch as undiciFetch,
   type Dispatcher,
 } from "undici";
+import {
+  matchesNoProxy,
+  parseNoProxyEntries,
+  tracedProxyCall,
+} from "./tracing.js";
 export interface ProxyFetchOptions {
   egressProxyUrl?: string;
   egressProxyHosts?: string;
   forwardProxyUrl?: string;
+  /**
+   * Emit an `introspection-proxy-call` OTel span per proxied request
+   * (default true). Spans no-op unless the host process registered a tracer
+   * provider. Direct requests (no proxy, or `NO_PROXY` hosts) never get a
+   * span regardless of this flag.
+   */
+  tracing?: boolean;
 }
 function resolveEgressUrl(options: ProxyFetchOptions): string | undefined {
@@ -127,8 +139,14 @@ export function createProxyFetch(
   if (!egress && !forward) return base;
+  const tracing = options.tracing ?? true;
+  // Snapshot NO_PROXY once, like EnvHttpProxyAgent does at construction. Used
+  // only to decide span emission — undici owns the actual routing.
+  const noProxyEntries = parseNoProxyEntries(process.env);
   return (input: RequestInfo | URL, init?: RequestInit): Promise<Response> => {
-    const hostname = new URL(toUrlString(input)).hostname.toLowerCase();
+    const url = new URL(toUrlString(input));
+    const hostname = url.hostname.toLowerCase();
     const useEgress =
       !!egress && egressHosts.size > 0 && egressHosts.has(hostname);
@@ -161,10 +179,31 @@ export function createProxyFetch(
       target = downgradeToHttp(target);
     }
-    return undiciFetch(
-      target as unknown as Parameters<typeof undiciFetch>[0],
-      opts as unknown as Parameters<typeof undiciFetch>[1],
-    ) as unknown as Promise<Response>;
+    const execute = () =>
+      undiciFetch(
+        target as unknown as Parameters<typeof undiciFetch>[0],
+        opts as unknown as Parameters<typeof undiciFetch>[1],
+      ) as unknown as Promise<Response>;
+    // A forward-dispatched request to a NO_PROXY host goes direct inside
+    // EnvHttpProxyAgent — no proxy hop, so no proxy span (in-cluster clients
+    // trace those calls themselves as `introspection-api-call`).
+    const viaProxy =
+      useEgress || !matchesNoProxy(hostname, url.port, noProxyEntries);
+    if (!tracing || !viaProxy) return execute();
+    const method = (
+      init?.method ??
+      (typeof Request !== "undefined" && input instanceof Request
+        ? input.method
+        : "GET")
+    ).toUpperCase();
+    return tracedProxyCall(
+      useEgress ? "egress" : "forward",
+      method,
+      url,
+      execute,
+    );
   };
 }

package/src/tracing.ts ADDED Viewed

@@ -0,0 +1,106 @@
+/**
+ * OpenTelemetry span instrumentation for proxied requests.
+ *
+ * Emits one `introspection-proxy-call` CLIENT span per request that is
+ * actually routed through a proxy (egress credential-injection or forward
+ * CONNECT). Requests that go direct — no proxy configured, or the host is
+ * excluded via `NO_PROXY` — deliberately get no span: in-cluster callers
+ * (`NO_PROXY` covers the DP API) already trace those calls at the client
+ * layer, so proxy spans and client-layer spans stay mutually exclusive.
+ *
+ * Depends only on `@opentelemetry/api`: without a registered tracer provider
+ * every span here is a no-op, so the package stays safe to load in bare Node
+ * processes (e.g. the sandbox `NODE_OPTIONS` preload).
+ *
+ * Attributes are intentionally lean — transport shape only (method, host,
+ * port, query-stripped URL, proxy mode, status). Tenant/task identity is
+ * inferred server-side from the request's JWT, or stamped globally by the
+ * host process's span processors, never duplicated here. Query strings are
+ * stripped because they can carry capability tokens (presigned URLs,
+ * share ids).
+ */
+import { SpanKind, SpanStatusCode, trace } from "@opentelemetry/api";
+export const PROXY_CALL_SPAN_NAME = "introspection-proxy-call";
+export const PROXY_TRACER_NAME = "@introspection-sdk/introspection-proxy";
+export type ProxyMode = "egress" | "forward";
+/**
+ * Parse `NO_PROXY`/`no_proxy` into normalized entries. Mirrors undici's
+ * `EnvHttpProxyAgent` semantics closely enough to decide span emission —
+ * undici still owns the actual routing decision.
+ */
+export function parseNoProxyEntries(env: NodeJS.ProcessEnv): string[] {
+  const raw = env.NO_PROXY ?? env.no_proxy ?? "";
+  return raw
+    .split(",")
+    .map((entry) => entry.trim().toLowerCase())
+    .filter(Boolean);
+}
+/** Whether `hostname[:port]` matches a `NO_PROXY` entry (i.e. goes direct). */
+export function matchesNoProxy(
+  hostname: string,
+  port: string,
+  entries: string[],
+): boolean {
+  for (const raw of entries) {
+    if (raw === "*") return true;
+    let entry = raw;
+    let entryPort = "";
+    const colon = entry.lastIndexOf(":");
+    if (colon !== -1 && !entry.slice(colon).includes("]")) {
+      entryPort = entry.slice(colon + 1);
+      entry = entry.slice(0, colon);
+    }
+    if (entryPort && entryPort !== port) continue;
+    if (entry.startsWith(".")) entry = entry.slice(1);
+    if (hostname === entry || hostname.endsWith(`.${entry}`)) return true;
+  }
+  return false;
+}
+/** Run `execute` inside an `introspection-proxy-call` CLIENT span. */
+export function tracedProxyCall(
+  mode: ProxyMode,
+  method: string,
+  url: URL,
+  execute: () => Promise<Response>,
+): Promise<Response> {
+  const tracer = trace.getTracer(PROXY_TRACER_NAME);
+  const port = Number(url.port) || (url.protocol === "https:" ? 443 : 80);
+  return tracer.startActiveSpan(
+    PROXY_CALL_SPAN_NAME,
+    {
+      kind: SpanKind.CLIENT,
+      attributes: {
+        "http.request.method": method,
+        "server.address": url.hostname,
+        "server.port": port,
+        "url.full": url.origin + url.pathname,
+        "url.path": url.pathname,
+        "introspection.proxy.mode": mode,
+      },
+    },
+    async (span) => {
+      try {
+        const response = await execute();
+        span.setAttribute("http.response.status_code", response.status);
+        if (response.status >= 400) {
+          span.setStatus({ code: SpanStatusCode.ERROR });
+        }
+        return response;
+      } catch (err) {
+        span.recordException(err instanceof Error ? err : String(err));
+        span.setStatus({
+          code: SpanStatusCode.ERROR,
+          message: err instanceof Error ? err.message : String(err),
+        });
+        throw err;
+      } finally {
+        span.end();
+      }
+    },
+  );
+}