Function withTokenRequestSpan

packages/core/sdk/src/oauth-helpers.ts:809–835

(input: {
    readonly grantType:
      | "authorization_code"
      | "client_credentials"
      | "refresh_token"
      | typeof TOKEN_EXCHANGE_GRANT_TYPE
      | typeof JWT_BEARER_GRANT_TYPE;
    readonly tokenUrl: string;
    readonly clientAuth: ClientAuthMethod | undefined;
    readonly hasResource: boolean;
  })

 *  response URL and a body preview), never token or code material. */
const withTokenRequestSpan =
  (input: {
    readonly grantType:
      | "authorization_code"
      | "client_credentials"
      | "refresh_token"
      | typeof TOKEN_EXCHANGE_GRANT_TYPE
      | typeof JWT_BEARER_GRANT_TYPE;
    readonly tokenUrl: string;
    readonly clientAuth: ClientAuthMethod | undefined;
    readonly hasResource: boolean;
  }) =>
  <A>(effect: Effect.Effect<A, OAuth2Error>): Effect.Effect<A, OAuth2Error> =>
    effect.pipe(
      Effect.tapError((error) =>
        Effect.annotateCurrentSpan({
          ...(error.error !== undefined ? { "executor.oauth.error_code": error.error } : {}),
        }),
      ),
      Effect.withSpan("executor.oauth.token_request", {
        attributes: {
          "executor.oauth.grant_type": input.grantType,
          "executor.oauth.token_host": hostnameForTelemetry(input.tokenUrl),
          "executor.oauth.client_auth": input.clientAuth ?? DEFAULT_CLIENT_AUTH_METHOD,
          "executor.oauth.has_resource": input.hasResource,
        },
      }),
    );

/** The hostname alone — a malformed URL yields "invalid" rather than leaking
 *  whatever string failed to parse. */