// Browser → Axiom OTLP ingress. The web client exports its spans to// same-origin /v1/traces (it can never hold AXIOM_TOKEN); this worker route// forwards the batch to Axiom with the server-held credentials. Locally and// in e2e the vite dev server proxies the same path to motel before the// worker ever sees it, so this route only serves deployed workers.//// Guards, not auth: the endpoint is write-only into a server-pinned dataset,// but it should not be an anonymous internet ingest — a session cookie must// at least be present, and bodies are capped. We deliberately do NOT verify// the session (that would put a WorkOS round-trip on every span batch).//// The batch is never forwarded opaquely. The page-side exporter scrubs its// own spans, but the page is not a trust boundary — anything with the cookie// can POST here — so the worker decodes the OTLP JSON payload, scrubs every// credential-bearing URL component server-side, and forwards the// re-serialized result. A batch that does not parse as JSON is refused: what// cannot be scrubbed is not forwarded. import { redactOtlpTraceExport } from "@executor-js/sdk"; const MAX_BODY_BYTES = 2_000_000; export const BROWSER_TRACES_PATH = "/v1/traces"; /** The batch re-serialized with every URL scrubbed, or `undefined` when it is *  not valid JSON (or too deep to scrub) and must be refused. */const scrubbedBatch = (body: string): string | undefined => {  // oxlint-disable-next-line executor/no-try-catch-or-throw -- boundary: JSON.parse throws on malformed input; the refusal path (400) is the handled outcome  try {    // oxlint-disable-next-line executor/no-json-parse -- boundary: the batch is deliberately unknown-shaped (the scrub walks arbitrary JSON); there is no schema to decode into    return JSON.stringify(redactOtlpTraceExport(JSON.parse(body)));  } catch {    return undefined;  }}; export const browserTracesResponse = (  request: Request,  env: Env,  fetchImpl: typeof fetch = fetch,): Promise<Response> | null => {  const url = new URL(request.url);  if (url.pathname !== BROWSER_TRACES_PATH) return null;  if (request.method !== "POST") {    return Promise.resolve(new Response(null, { status: 405 }));  }  // Tracing not configured on this deployment — accept and drop so the  // client exporter stays quiet (it would retry/log on errors).  if (!env.AXIOM_TOKEN) {    return Promise.resolve(new Response(null, { status: 204 }));  }  if (!(request.headers.get("cookie") ?? "").includes("wos-session=")) {    return Promise.resolve(new Response(null, { status: 401 }));  }  const contentLength = Number(request.headers.get("content-length") ?? 0);  if (contentLength > MAX_BODY_BYTES) {    return Promise.resolve(new Response(null, { status: 413 }));  }  return request.text().then(    (body) => {      // The content-length guard above trusts a header; re-check the bytes      // actually read.      if (body.length > MAX_BODY_BYTES) {        return new Response(null, { status: 413 });      }      const scrubbed = scrubbedBatch(body);      if (scrubbed === undefined) {        return new Response(null, { status: 400 });      }      return fetchImpl(env.AXIOM_TRACES_URL ?? "https://api.axiom.co/v1/traces", {        method: "POST",        headers: {          // Always JSON: the batch was decoded, scrubbed, and re-serialized.          "content-type": "application/json",          authorization: `Bearer ${env.AXIOM_TOKEN}`,          "x-axiom-dataset": env.AXIOM_DATASET ?? "executor-cloud",        },        body: scrubbed,      }).then(        // The exporter only needs success/failure; never reflect Axiom's        // response body (or its headers) back to an unauthenticated caller.        (upstream) => new Response(null, { status: upstream.ok ? 204 : 502 }),        () => new Response(null, { status: 502 }),      );    },    // An unreadable body cannot be scrubbed, so it is refused, not forwarded.    () => new Response(null, { status: 400 }),  );};