feat(observability): client-side redaction of PII/secrets in telemetry spans

[simonvdk-mistral]

What

Adds client-side redaction of OpenTelemetry spans emitted by the SDK, so PII and secrets are stripped before spans leave the process.

New public API (@mistralai/mistralai/extra/observability)

• RedactingSpanExporter — wraps any OTEL SpanExporter and redacts span attributes, events, links, and resource attributes before delegating export. Reusable by any OpenTelemetry application, independent of the Mistral client.
• Redaction policies, each exported with its defaults as constants so they can be extended rather than replaced:
  • RegexRedactionPolicy (default) — content-oriented: keeps keys/structure, redacts matched substrings (secret tokens plus PII: emails, card-like sequences, IPv4).
  • AttributeRedactionPolicy — key-oriented: redacts whole values for sensitive keys, then scans kept values for secret tokens.
  • CallbackRedactionPolicy — a (key, value) => value | undefined masker for full control (can drop attributes entirely).
• configureTelemetry(client, provider?, options?) gains a redaction option:
  • Dedicated mode (SDK owns the exporter): redaction is on by default; pass false, a policy instance, or a callback to customize.
  • Global / custom-provider modes: the application owns the export pipeline, so the option is ignored and a warning is logged. Wrap your own exporter with RedactingSpanExporter to redact there.
• shutdownTelemetry(client) — flushes and shuts down the SDK-owned provider so short-lived programs export buffered spans before exiting.

Other changes

• OpenTelemetry SDK / exporter / resources declared as optional peer dependencies.
• Lazy OTel import marked bundler-ignore (webpack / Turbopack / Vite) so the SDK works when bundled as first-party source.
• README "Telemetry & Observability" section (provider modes, redaction policies, env vars) + TOC entry.
• Runnable examples under examples/src/observability/ (dedicated mode, global provider with redaction, custom/extended policies).

Usage

import { Mistral } from "@mistralai/mistralai";
import { configureTelemetry, shutdownTelemetry } from "@mistralai/mistralai/extra/observability";

const client = new Mistral({ apiKey: process.env["MISTRAL_API_KEY"] });

// Dedicated mode is the default; redaction is on by default.
await configureTelemetry(client);

// ... make requests ...

await shutdownTelemetry(client);

Testing

• npm run build — clean
• npm run lint — 0 warnings / 0 errors
• tests/ — 174/174 pass (new: 18 redaction, 47 policy, +11 telemetry)