@verevoir/review 0.3.0 → 0.3.2

package/node_modules/@anthropic-ai/sdk/src/lib/internal/toolsets/security-node.ts

@@ -0,0 +1,335 @@
+/**
+ * Upload-path allowlist and the Node file policy. Node-only: it resolves symlinks through the real
+ * filesystem.
+ *
+ * Kept apart from the runtime-agnostic modules so that the public `helpers/beta/toolsets` entry stays importable in
+ * browser and edge bundles: a static `fs`/`path` import at the top of a module reachable from it would pull the Node
+ * built-ins into every bundle. Reached through `helpers/beta/toolsets/node`. The built-ins come through
+ * `internal/node`, which browser builds stub, so importing this module there is harmless and using it throws.
+ */
+import { fs, path } from '../../../internal/node';
+
+import { ToolError } from '../../tools/ToolError';
+import { NO_UPLOAD_ROOTS, ToolsetConfigError, UploadRefusedError } from './errors';
+import type { BetaFilePolicy, BetaURLContext } from './hooks';
+
+const MAX_UPLOAD_PATH_LENGTH = 4096;
+// Two leading separators of either kind: Windows reads "/\\host" and "\\/?" as UNC and device paths too.
+const UNC_OR_DEVICE_PATH_RE = /^[\\/]{2}/;
+const DOS_DEVICE_NAME_RE =
+  /^(?:CON|PRN|AUX|NUL|CONIN\$|CONOUT\$|COM[0-9\u00b9\u00b2\u00b3]|LPT[0-9\u00b9\u00b2\u00b3])(?:[.:].*)?$/i;
+
+const MAX_REALPATH_PASSES = 8;
+
+/** The refusal for a path that is not, or cannot be shown to be, under a configured upload root. */
+class UploadOutsideRootsError extends UploadRefusedError {
+  constructor() {
+    super('file_upload path is outside the configured upload roots');
+  }
+}
+
+/**
+ * `realpath` that tolerates a not-yet-existing leaf: resolves the nearest existing ancestor and
+ * re-appends the rest.
+ *
+ * Only a component that does not exist may be re-appended. A bare `catch` would also swallow ELOOP and a
+ * dangling symlink, then return the lexical in-root path for an entry that actually points outside
+ * every root, so the containment check would pass and the driver would follow the link at open time.
+ */
+async function realpathLenient(candidate: string, depth = 0): Promise<string> {
+  // Made absolute but not normalised: a `..` that follows a symlinked component has to be resolved through
+  // the link, as the OS will at open time. Collapsing it against the lexical parent first (path.resolve)
+  // would judge `<dir>/link/../x` inside `<dir>` while it opens somewhere else. An upload or download path with a
+  // `..` component never reaches here, but configured directories may contain one.
+  let current = path.isAbsolute(candidate) ? candidate : process.cwd() + path.sep + candidate;
+  const remainder: string[] = [];
+
+  for (;;) {
+    try {
+      const resolved = path.join(await fs.promises.realpath(current), ...remainder);
+      // path.join collapsed any `..` left in the absent tail. A collapsed `..` can point back inside existing
+      // (possibly symlinked) directories, so resolve again until the answer stops changing.
+      if (remainder.includes('..') && depth < MAX_REALPATH_PASSES)
+        return await realpathLenient(resolved, depth + 1);
+      return resolved;
+    } catch (err) {
+      if (err instanceof ToolError) throw err;
+
+      // The entry exists (so this is a dangling symlink or a cycle, not a missing component):
+      // there is no safe lexical answer for it.
+      let exists = false;
+      try {
+        await fs.promises.lstat(current);
+        exists = true;
+      } catch {
+        /* really absent */
+      }
+      if (exists) throw new UploadOutsideRootsError();
+
+      if ((err as NodeJS.ErrnoException)?.code !== 'ENOENT') {
+        throw new UploadOutsideRootsError();
+      }
+
+      const parent = path.dirname(current);
+      if (parent === current) return path.join(current, ...remainder);
+      const base = path.basename(current);
+      if (base !== '' && base !== '.') remainder.unshift(base);
+      current = parent;
+    }
+  }
+}
+
+function comparable(p: string): string {
+  return process.platform === 'win32' ? p.toLowerCase() : p;
+}
+
+/** Whether `a` is `b` or a descendant of it by whole path components. Both are compared as given. */
+function sameOrUnder(a: string, b: string): boolean {
+  return a === b || a.startsWith(b.endsWith(path.sep) ? b : b + path.sep);
+}
+
+/**
+ * Whether `candidate` names a network location or a device rather than a file on Windows: a UNC or device path
+ * (two leading separators of either kind), or a path component whose stem (the text up to the first "." or
+ * ":", trailing spaces and dots dropped, as Win32 reads it) is a DOS device name. Resolving such a path on
+ * Windows connects to the named host or opens the device, so it is refused before anything touches the
+ * filesystem. On every other platform these are ordinary names (`aux/notes.txt`, `con.pdf`) and this is false.
+ * Like the rest of this module, the answer is for the host this process runs on.
+ */
+function namesNetworkOrDevice(candidate: string): boolean {
+  if (process.platform !== 'win32') return false;
+  return (
+    UNC_OR_DEVICE_PATH_RE.test(candidate) ||
+    candidate
+      .split(/[\\/:]/)
+      .some((part) => DOS_DEVICE_NAME_RE.test((part.split(/[.:]/, 1)[0] ?? '').replace(/[ .]+$/, '')))
+  );
+}
+
+/** Whether `candidate` resolves to `root` or a descendant of it. Both sides may be not-yet-existing. */
+export async function resolvesUnder(candidate: string, root: string): Promise<boolean> {
+  // realpathLenient refuses a path it cannot resolve (a dangling symlink or a cycle) by throwing the
+  // upload refusal. This is a predicate, and its callers are not the upload gate, so a path that will
+  // not resolve is not under the root, and neither is one that names a network location or a device.
+  if (namesNetworkOrDevice(candidate)) return false;
+  try {
+    return sameOrUnder(comparable(await realpathLenient(candidate)), comparable(await realpathLenient(root)));
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Default-deny upload allowlist: resolves to the real path when it is one of `roots` or below one by whole path
+ * components, with symlinks resolved on both sides, and rejects with `UploadRefusedError` otherwise. The refusal
+ * never lists the roots. Empty `roots` refuses everything. A root that does not exist on disk grants
+ * nothing. A `..` component (and, on Windows, a UNC path or a DOS device name) is refused outright, before the
+ * filesystem is touched. A dangling symlink or a symlink cycle under a root is refused rather than judged by its
+ * target. Upload the returned path, not the argument.
+ */
+export async function betaCheckUploadPath(candidate: string, roots: Iterable<string>): Promise<string> {
+  if (candidate === '' || candidate.includes('\0')) {
+    throw new UploadRefusedError('file_upload path is empty or contains a NUL byte');
+  }
+  if (candidate.length > MAX_UPLOAD_PATH_LENGTH) {
+    throw new UploadRefusedError('file_upload path is too long');
+  }
+
+  if (typeof roots === 'string') {
+    // `Iterable<string>` is satisfied by a bare string, whose iteration yields characters: the
+    // "/" element resolves to a parent of every absolute path and would approve everything.
+    throw new ToolsetConfigError('roots must be a list of paths, not a single path');
+  }
+
+  // An empty entry is not "the current directory is a root": `path.resolve('')` is the cwd, so a blank
+  // root (an empty env var split on ",") would open the whole working tree.
+  const rootList = [...roots].filter((r) => r.trim() !== '');
+  if (rootList.length === 0) throw new UploadRefusedError(NO_UPLOAD_ROOTS);
+
+  // Refused before anything touches the filesystem, on Windows only: there, resolving a UNC path makes the
+  // redirector connect to the named host with the user's credentials (a forced-auth leak) even
+  // though the path is then refused, and a DOS device name (CON, COM1, NUL.txt) fails the
+  // existence probe, is re-appended as a not-yet-existing tail under the root, and then opens the
+  // device rather than a file.
+  if (namesNetworkOrDevice(candidate)) {
+    throw new UploadOutsideRootsError();
+  }
+
+  // An upload path is model output (the deployer supplies the roots, the model the path), so a `..`
+  // component is never legitimate, and it is where a lexical `..` collapse can disagree with symlink
+  // resolution. Refuse it outright before resolving.
+  if (candidate.split(/[\\/]/).includes('..')) {
+    throw new UploadRefusedError("file_upload path must not contain a '..' component");
+  }
+
+  // Decided on the text first: a path that does not claim to be under an upload root is refused without
+  // touching the filesystem, so the model cannot make the SDK stat or resolve a path of its choosing (an existence
+  // probe, an automounted share). A path that does claim to be under a root is still resolved and compared below,
+  // so a symlink inside the root cannot lead out of it.
+  const claimed = await Promise.all(rootList.map((root) => lexicallyUnder(path.resolve(candidate), root)));
+  if (!claimed.includes(true)) {
+    throw new UploadOutsideRootsError();
+  }
+
+  const resolved = await realpathLenient(candidate);
+  if (namesNetworkOrDevice(resolved)) {
+    // On Windows, resolving a link to a share has already connected to its host with the user's credentials.
+    // Screening the resolved path refuses the upload, but it cannot undo that connection.
+    throw new UploadOutsideRootsError();
+  }
+
+  for (const root of rootList) {
+    let resolvedRoot: string;
+    try {
+      resolvedRoot = await fs.promises.realpath(path.resolve(root));
+    } catch {
+      continue;
+    }
+    if (sameOrUnder(comparable(resolved), comparable(resolvedRoot))) return resolved;
+  }
+
+  throw new UploadOutsideRootsError();
+}
+
+function conflicts(downloadDir: string, uploadRoots: readonly string[]): boolean {
+  // The download-then-upload loop: a page-triggered download written to an upload root is readable back through
+  // file_upload. Compared on the anchored paths as written: the constructor cannot wait for a promise, and following
+  // symlinks here would need a second, synchronous copy of the resolver. Letter case and the Unicode form of a name
+  // are ignored on every platform, since a macOS disk ignores both by default.
+  const nests = (a: string, b: string) => sameOrUnder(a, b) || sameOrUnder(b, a);
+  const literal = downloadDir.toLowerCase().normalize('NFC');
+  return uploadRoots.some((root) => nests(literal, root.toLowerCase().normalize('NFC')));
+}
+
+/**
+ * Refuses a configured directory that is, or sits under, a link that does not resolve (dangling, or in a cycle): the
+ * overlap check compares paths as written, so such a path would pass it now and be followed later. Walks up to the
+ * first part that `lstat` finds, then asks `existsSync`, which follows links. No resolver is needed. Only `ENOENT`
+ * means "does not exist, go up": any other `lstat` error (`EACCES`, `ENOTDIR`) refuses the path, since a part that
+ * cannot be inspected could be hiding a broken link.
+ */
+function assertResolves(dir: string, option: string): void {
+  const refused = () =>
+    new ToolsetConfigError(`${option} does not resolve on disk (a dangling symlink or a cycle)`);
+  let current = dir;
+  for (;;) {
+    try {
+      fs.lstatSync(current);
+      break;
+    } catch (err) {
+      if ((err as NodeJS.ErrnoException)?.code !== 'ENOENT') throw refused();
+      const parent = path.dirname(current);
+      if (parent === current) return;
+      current = parent;
+    }
+  }
+  if (!fs.existsSync(current)) throw refused();
+}
+
+export interface BetaNodeFilePolicyOptions {
+  /** `file_upload` may read paths under these directories. Empty (the default) refuses every path. */
+  uploadRoots?: readonly string[] | undefined;
+  /**
+   * Where the driver writes downloads. Exposed paths must resolve under it. Its overlap with the upload roots is
+   * compared on the paths as written, ignoring letter case, so a `downloadDir` that is, or sits under, a working
+   * symlink into an upload root is not caught, nor is an upload root that links into `downloadDir`. A link that
+   * does not resolve is refused.
+   */
+  downloadDir?: string | undefined;
+  /** Default false: download paths never reach the model. Has no effect without `downloadDir`. */
+  exposeDownloadPaths?: boolean | undefined;
+  /** Document ids (files staged with the Files API) `file_upload` may name. Empty (the default) refuses every id. */
+  uploadDocumentIds?: readonly string[] | undefined;
+}
+
+/**
+ * The file policy the SDK ships: `file_upload` may read paths under `uploadRoots` (symlinks resolved,
+ * whole components compared, a `..` component refused outright) and may name the document ids listed in
+ * `uploadDocumentIds` (none by default), and a `download_completed` path reaches the model only with
+ * `exposeDownloadPaths: true` and only when it lies inside `downloadDir`.
+ *
+ * Keep the roots to one dedicated directory holding only the task's files, and put `downloadDir`
+ * outside every upload root and outside anything another tool can reach. The driver decides where
+ * downloads are written, and this object only decides what the model may see.
+ */
+export class BetaNodeFilePolicy implements BetaFilePolicy {
+  readonly uploadRoots: readonly string[];
+  readonly downloadDir: string | undefined;
+  readonly exposeDownloadPaths: boolean;
+  readonly uploadDocumentIds: ReadonlySet<string>;
+
+  constructor(options: BetaNodeFilePolicyOptions = {}) {
+    const roots = options.uploadRoots ?? [];
+    if (roots.some((root) => root.trim() === '')) {
+      // Anchoring an empty entry would silently make it the working directory.
+      throw new ToolsetConfigError('uploadRoots entries must be non-empty strings');
+    }
+
+    if (options.downloadDir !== undefined && !options.downloadDir.trim()) {
+      throw new ToolsetConfigError('downloadDir must be a non-empty string');
+    }
+
+    // Anchored once, here: re-resolving a relative root against the working directory at check time
+    // would move the containment boundary.
+    this.uploadRoots = roots.map((root) => path.resolve(root));
+    this.downloadDir = options.downloadDir === undefined ? undefined : path.resolve(options.downloadDir);
+    this.exposeDownloadPaths = options.exposeDownloadPaths === true;
+
+    this.uploadDocumentIds = new Set(options.uploadDocumentIds ?? []);
+
+    // A configured directory that exists but will not resolve (a dangling link, a cycle) is refused now rather than
+    // granting nothing (a root) or skipping the overlap check (downloadDir) and following the link later.
+    for (const root of this.uploadRoots) assertResolves(root, 'an uploadRoots entry');
+    if (this.downloadDir !== undefined) assertResolves(this.downloadDir, 'downloadDir');
+    if (this.downloadDir !== undefined && conflicts(this.downloadDir, this.uploadRoots)) {
+      throw new ToolsetConfigError(
+        'downloadDir must be outside every upload root, otherwise a page-triggered download landing in an upload root can be read back through file_upload',
+      );
+    }
+  }
+
+  async resolveUploadPaths(_ctx: BetaURLContext, paths: string[]): Promise<string[]> {
+    const resolved: string[] = [];
+    for (const p of paths) resolved.push(await betaCheckUploadPath(p, this.uploadRoots));
+    return resolved;
+  }
+
+  resolveUploadDocuments(_ctx: BetaURLContext, documentIds: string[]): string[] {
+    for (const id of documentIds) {
+      // The refusal contains neither the id nor a count, so a steering page cannot learn which ids exist.
+      if (!this.uploadDocumentIds.has(id))
+        throw new UploadRefusedError('document not in the upload allowlist');
+    }
+    return [...documentIds];
+  }
+
+  async isPathVisible(candidate: string): Promise<boolean> {
+    if (!this.exposeDownloadPaths || this.downloadDir === undefined) return false;
+    // Decided on the text alone first: a path that does not claim to be under the download directory is never
+    // resolved, so a page cannot make the SDK stat a path of its choosing (an automounted share, an existence probe)
+    // by getting it into a download event or an error message.
+    if (candidate.split(/[\\/]/).includes('..')) return false;
+    if (!(await lexicallyUnder(candidate, this.downloadDir))) return false;
+    // Outside the quarantine directory through a symlink: the event still reaches the model, without the path.
+    return resolvesUnder(candidate, this.downloadDir);
+  }
+}
+
+/** Whether `candidate`, normalised as text, is `directory` (as written or as it resolves) or below it. */
+async function lexicallyUnder(candidate: string, directory: string): Promise<boolean> {
+  const text = comparable(path.normalize(candidate));
+  const bases = new Set([directory]);
+
+  try {
+    bases.add(await realpathLenient(directory));
+  } catch {
+    // compared as written only
+  }
+
+  for (const base of bases) {
+    const folded = comparable(path.normalize(base)).replace(/[\\/]+$/, '');
+    if (text === folded || text.startsWith(folded + path.sep)) return true;
+  }
+
+  return false;
+}

package/node_modules/@anthropic-ai/sdk/src/lib/internal/tracing/api-call.ts

@@ -0,0 +1,179 @@
+import type { Attributes, Span } from '@opentelemetry/api';
+import type { BaseAnthropic } from '../../../client';
+import { APIError } from '../../../core/error';
+import { Stream } from '../../../core/streaming';
+import { buildHeaders, type NullableHeaders } from '../../../internal/headers';
+import type { ApiCallResult, ApiCallSpan, ApiCallSpanSettings } from '../../../internal/tracing';
+import { loggerFor } from '../../../internal/utils/log';
+import type { BetaMessageTokensCount } from '../../../resources/beta/messages/messages';
+import type { BetaManagedAgentsSession } from '../../../resources/beta/sessions/sessions';
+import type { MessageTokensCount } from '../../../resources/messages/messages';
+import {
+  ATTR_ANTHROPIC_BETA,
+  ATTR_ANTHROPIC_MESSAGE_COUNT_TOKENS_INPUT_TOKENS,
+  ATTR_ANTHROPIC_REQUEST_SERVICE_TIER,
+  ATTR_ANTHROPIC_THINKING_BUDGET_TOKENS,
+  ATTR_ANTHROPIC_THINKING_TYPE,
+  ATTR_GEN_AI_AGENT_NAME,
+  ATTR_GEN_AI_OPERATION_NAME,
+  ATTR_GEN_AI_OUTPUT_TYPE,
+  ATTR_GEN_AI_REQUEST_MAX_TOKENS,
+  ATTR_GEN_AI_REQUEST_MODEL,
+  ATTR_GEN_AI_REQUEST_REASONING_LEVEL,
+  ATTR_GEN_AI_REQUEST_STREAM,
+  GEN_AI_OPERATION_NAME_VALUE_CHAT,
+  GEN_AI_OUTPUT_TYPE_VALUE_JSON,
+  RESPONSE_HEADER_ATTRIBUTES,
+} from './attributes';
+import { setMessageContentAttributes } from './content';
+import { setResponseAttributes } from './response';
+import type { AnyMessage, MessageCreateBody } from './types';
+
+/**
+ * Sets the IDs in the response headers of `result` on `span`, the call span of any API call.
+ * A failure to record, here and below, is logged and never fails the API call.
+ */
+export function setAnthropicSpanAttributes(client: BaseAnthropic, span: Span, result: ApiCallResult): void {
+  if (!span.isRecording()) {
+    return;
+  }
+  try {
+    const error = result.status === 'error' ? result.error : undefined;
+    const headers = result.response?.headers ?? (error instanceof APIError ? error.headers : undefined);
+    for (const [attribute, header] of RESPONSE_HEADER_ATTRIBUTES) {
+      const value = headers?.get(header);
+      if (value) {
+        span.setAttribute(attribute, value);
+      }
+    }
+  } catch (problem) {
+    loggerFor(client).debug('could not record the API call on its span', problem);
+  }
+}
+
+/**
+ * The attributes that a `messages.create` span starts with, from the request's `body` and
+ * `headers`. A sampler sees only the attributes that a span starts with.
+ */
+export function messagesCreateSpanSettings(
+  client: BaseAnthropic,
+  body: MessageCreateBody,
+  headers: NullableHeaders,
+): ApiCallSpanSettings {
+  const attributes: Attributes = {
+    [ATTR_GEN_AI_OPERATION_NAME]: GEN_AI_OPERATION_NAME_VALUE_CHAT,
+    [ATTR_GEN_AI_REQUEST_MODEL]: body.model,
+  };
+  try {
+    // The client sends its default headers with the method's, which replace those of the same name.
+    const betas = (buildHeaders([client._options.defaultHeaders, headers]).values.get('anthropic-beta') ?? '')
+      .split(',')
+      .map((beta) => beta.trim())
+      .filter(Boolean);
+    if (betas.length) {
+      attributes[ATTR_ANTHROPIC_BETA] = betas;
+    }
+    attributes[ATTR_GEN_AI_REQUEST_MAX_TOKENS] = body.max_tokens;
+    if (body.stream === true) {
+      attributes[ATTR_GEN_AI_REQUEST_STREAM] = true;
+    }
+    // The beta method has already moved a deprecated `output_format` here.
+    if (body.output_config?.format?.type === 'json_schema') {
+      attributes[ATTR_GEN_AI_OUTPUT_TYPE] = GEN_AI_OUTPUT_TYPE_VALUE_JSON;
+    }
+    const effort = body.output_config?.effort;
+    if (effort != null) {
+      attributes[ATTR_GEN_AI_REQUEST_REASONING_LEVEL] = effort;
+    }
+    if (body.service_tier != null) {
+      attributes[ATTR_ANTHROPIC_REQUEST_SERVICE_TIER] = body.service_tier;
+    }
+    const thinking = body.thinking;
+    if (thinking != null) {
+      attributes[ATTR_ANTHROPIC_THINKING_TYPE] = thinking.type;
+    }
+    if (thinking?.type === 'enabled') {
+      attributes[ATTR_ANTHROPIC_THINKING_BUDGET_TOKENS] = thinking.budget_tokens;
+    }
+  } catch (problem) {
+    loggerFor(client).debug('could not record the request on its span', problem);
+  }
+  return { route: '/v1/messages', attributes };
+}
+
+/**
+ * In content mode, sets the request's content on `call`. The span does not start with it, because
+ * the size limit counts it together with the response's content. Returns `call`.
+ */
+export function recordMessagesCreateRequest(
+  client: BaseAnthropic,
+  call: ApiCallSpan | undefined,
+  body: MessageCreateBody,
+): ApiCallSpan | undefined {
+  if (!call?.span.isRecording()) {
+    return call;
+  }
+  try {
+    const { contentMode, maxContentBytes } = client.openTelemetry.traces;
+    if (contentMode === 'content') {
+      setMessageContentAttributes(call, body, undefined, maxContentBytes);
+    }
+  } catch (problem) {
+    loggerFor(client).debug('could not record the request on its span', problem);
+  }
+  return call;
+}
+
+/**
+ * Sets the response attributes and, in content mode, the response's content on `call`. A streamed
+ * response is recorded as the application reads it (`endAnthropicApiCallSpanWhenStreamEnds`).
+ */
+export function recordMessagesCreateResponse(
+  client: BaseAnthropic,
+  call: ApiCallSpan | undefined,
+  body: MessageCreateBody,
+  data: AnyMessage | Stream<unknown>,
+): void {
+  if (!call?.span.isRecording() || data instanceof Stream) {
+    return;
+  }
+  const span = call.span;
+  try {
+    setResponseAttributes(span, data, data.usage, true);
+    const { contentMode, maxContentBytes } = client.openTelemetry.traces;
+    if (contentMode === 'content') {
+      setMessageContentAttributes(call, body, data.content, maxContentBytes);
+    }
+  } catch (problem) {
+    loggerFor(client).debug('could not record the response on its span', problem);
+  }
+}
+
+/** Sets the token count of a `messages.countTokens` response on `call`. */
+export function recordCountTokensResponse(
+  client: BaseAnthropic,
+  call: ApiCallSpan | undefined,
+  count: MessageTokensCount | BetaMessageTokensCount,
+): void {
+  try {
+    call?.span.setAttribute(ATTR_ANTHROPIC_MESSAGE_COUNT_TOKENS_INPUT_TOKENS, count.input_tokens);
+  } catch (problem) {
+    loggerFor(client).debug('could not record the response on its span', problem);
+  }
+}
+
+/** Sets the Agent's name and model on `call`, as the created `session` resolved them. */
+export function recordSessionsCreateResponse(
+  client: BaseAnthropic,
+  call: ApiCallSpan | undefined,
+  session: BetaManagedAgentsSession,
+): void {
+  try {
+    call?.span.setAttributes({
+      [ATTR_GEN_AI_AGENT_NAME]: session.agent.name,
+      [ATTR_GEN_AI_REQUEST_MODEL]: session.agent.model.id,
+    });
+  } catch (problem) {
+    loggerFor(client).debug('could not record the response on its span', problem);
+  }
+}

package/node_modules/@anthropic-ai/sdk/src/lib/internal/tracing/attributes.ts

@@ -0,0 +1,60 @@
+// Named as `@opentelemetry/semantic-conventions` names them, and copied: that package exports the
+// `gen_ai.*` names only from its unstable `incubating` entry point, which says to copy them.
+export const ATTR_GEN_AI_AGENT_NAME = 'gen_ai.agent.name';
+export { ATTR_GEN_AI_CONVERSATION_ID } from '../../../internal/tracing';
+export const ATTR_GEN_AI_INPUT_MESSAGES = 'gen_ai.input.messages';
+export const ATTR_GEN_AI_OPERATION_NAME = 'gen_ai.operation.name';
+export const ATTR_GEN_AI_OUTPUT_MESSAGES = 'gen_ai.output.messages';
+export const ATTR_GEN_AI_OUTPUT_TYPE = 'gen_ai.output.type';
+export { ATTR_GEN_AI_PROVIDER_NAME } from '../../../internal/tracing';
+export const ATTR_GEN_AI_REQUEST_MAX_TOKENS = 'gen_ai.request.max_tokens';
+export const ATTR_GEN_AI_REQUEST_MODEL = 'gen_ai.request.model';
+export const ATTR_GEN_AI_REQUEST_REASONING_LEVEL = 'gen_ai.request.reasoning.level';
+export const ATTR_GEN_AI_REQUEST_STOP_SEQUENCES = 'gen_ai.request.stop_sequences';
+export const ATTR_GEN_AI_REQUEST_STREAM = 'gen_ai.request.stream';
+export const ATTR_GEN_AI_RESPONSE_ID = 'gen_ai.response.id';
+export const ATTR_GEN_AI_RESPONSE_MODEL = 'gen_ai.response.model';
+export const ATTR_GEN_AI_RESPONSE_TIME_TO_FIRST_CHUNK = 'gen_ai.response.time_to_first_chunk';
+export const ATTR_GEN_AI_SYSTEM_INSTRUCTIONS = 'gen_ai.system_instructions';
+export const ATTR_GEN_AI_TOOL_CALL_ARGUMENTS = 'gen_ai.tool.call.arguments';
+export const ATTR_GEN_AI_TOOL_CALL_ID = 'gen_ai.tool.call.id';
+export const ATTR_GEN_AI_TOOL_DESCRIPTION = 'gen_ai.tool.description';
+export const ATTR_GEN_AI_TOOL_NAME = 'gen_ai.tool.name';
+export const ATTR_GEN_AI_TOOL_TYPE = 'gen_ai.tool.type';
+export const ATTR_GEN_AI_USAGE_CACHE_WRITE_INPUT_TOKENS = 'gen_ai.usage.cache_write.input_tokens';
+export const ATTR_GEN_AI_USAGE_CACHE_READ_INPUT_TOKENS = 'gen_ai.usage.cache_read.input_tokens';
+export const ATTR_GEN_AI_USAGE_INPUT_TOKENS = 'gen_ai.usage.input_tokens';
+export const ATTR_GEN_AI_USAGE_OUTPUT_TOKENS = 'gen_ai.usage.output_tokens';
+export const ATTR_GEN_AI_USAGE_REASONING_OUTPUT_TOKENS = 'gen_ai.usage.reasoning.output_tokens';
+export const GEN_AI_OPERATION_NAME_VALUE_CHAT = 'chat';
+export const GEN_AI_OPERATION_NAME_VALUE_EXECUTE_TOOL = 'execute_tool';
+export const GEN_AI_OPERATION_NAME_VALUE_INVOKE_AGENT = 'invoke_agent';
+export const GEN_AI_OUTPUT_TYPE_VALUE_JSON = 'json';
+export const GEN_AI_TOOL_TYPE_VALUE_FUNCTION = 'function';
+
+// This API's own attribute names, in the same style.
+export const ATTR_ANTHROPIC_REQUEST_ID = 'anthropic.request.id';
+export const ATTR_ANTHROPIC_ORGANIZATION_ID = 'anthropic.organization.id';
+export const ATTR_ANTHROPIC_WORKSPACE_ID = 'anthropic.workspace.id';
+export const ATTR_ANTHROPIC_BETA = 'anthropic.beta';
+export const ATTR_ANTHROPIC_CONTENT_TRUNCATED = 'anthropic.content.truncated';
+export const ATTR_ANTHROPIC_MESSAGE_STOP_REASON = 'anthropic.message.stop_reason';
+export const ATTR_ANTHROPIC_MESSAGE_COUNT_TOKENS_INPUT_TOKENS = 'anthropic.message.count_tokens.input_tokens';
+export const ATTR_ANTHROPIC_REQUEST_SERVICE_TIER = 'anthropic.request.service_tier';
+export const ATTR_ANTHROPIC_RESPONSE_SERVICE_TIER = 'anthropic.response.service_tier';
+export const ATTR_ANTHROPIC_THINKING_BUDGET_TOKENS = 'anthropic.thinking.budget_tokens';
+export const ATTR_ANTHROPIC_THINKING_TYPE = 'anthropic.thinking.type';
+export const ATTR_ANTHROPIC_TOOL_RESULT_CONTENT = 'anthropic.tool_result.content';
+export const ATTR_ANTHROPIC_TOOLSET_NAME = 'anthropic.toolset.name';
+export const ATTR_ANTHROPIC_USAGE_CACHE_CREATION_EPHEMERAL_1H_INPUT_TOKENS =
+  'anthropic.usage.cache_creation.ephemeral_1h_input_tokens';
+export const ATTR_ANTHROPIC_USAGE_CACHE_CREATION_EPHEMERAL_5M_INPUT_TOKENS =
+  'anthropic.usage.cache_creation.ephemeral_5m_input_tokens';
+export const ATTR_ANTHROPIC_USAGE_COMPACTION_INPUT_TOKENS = 'anthropic.usage.compaction.input_tokens';
+export const ATTR_ANTHROPIC_USAGE_COMPACTION_OUTPUT_TOKENS = 'anthropic.usage.compaction.output_tokens';
+
+export const RESPONSE_HEADER_ATTRIBUTES: ReadonlyArray<[attribute: string, header: string]> = [
+  [ATTR_ANTHROPIC_REQUEST_ID, 'request-id'],
+  [ATTR_ANTHROPIC_ORGANIZATION_ID, 'anthropic-organization-id'],
+  [ATTR_ANTHROPIC_WORKSPACE_ID, 'anthropic-workspace-id'],
+];