@homeflare/alchemy 0.38.0 → 0.40.0

package/dist/telemetry/fake-collector.d.ts

@@ -0,0 +1,36 @@
+/**
+ * A fake OTLP/HTTP collector for the tests beside it — `Bun.serve` on an ephemeral 127.0.0.1 port,
+ * answering every POST with 200 and recording each request's path, headers and raw body bytes.
+ *
+ * ⛔ TEST-ONLY, and no live call ever leaves this process: nothing here reaches a real Victoria
+ *   endpoint, satisfying the workflow's "no live calls to Victoria from tests" rule. A consumer's
+ *   own integration test points `telemetryLayer` at ITS running Victoria; this file exists so this
+ *   package's tests never need one.
+ * ★ 200 UNCONDITIONALLY. `OtlpExporter.make` treats any non-2xx as a transient failure and retries
+ *   three times with backoff (OtlpExporter.ts `policy`/`retryTransient`) — a fake that ever answered
+ *   with an error would make a test wait through that retry schedule for no reason.
+ * ⛔ RAW BYTES, NOT PARSED JSON (redteam PR 302 CRITICAL item 1, 2026-09-26): `telemetryLayer` now
+ *   sends `OtlpSerialization.layerProtobuf`, not JSON, so there is no body to `JSON.parse`. `sawText`
+ *   below is what every test needing to inspect content uses instead — it works unchanged for either
+ *   encoding, since protobuf's string fields are raw UTF-8 with no escaping: a leaked literal (a
+ *   secret, a span name, `<redacted>`) always appears as a contiguous byte run in the raw body,
+ *   exactly like it would in JSON, with no OTLP protobuf decoder needed to find it.
+ */
+export interface CollectedRequest {
+    readonly path: string;
+    readonly headers: Headers;
+    readonly raw: Uint8Array;
+}
+export interface FakeCollector {
+    readonly url: string;
+    readonly requests: CollectedRequest[];
+    /** `requests` filtered to POSTs at exactly this path (e.g. `/v1/traces`). */
+    at(path: string): CollectedRequest[];
+    /** True when `text`'s bytes appear anywhere in ANY collected request's raw body. ASCII text (a
+     * secret, a hostname, `<redacted>`) decodes to itself regardless of what surrounds it in an
+     * otherwise-binary protobuf buffer — see this file's own header for why that's sound. */
+    sawText(text: string): boolean;
+    stop(): void;
+}
+export declare const fakeCollector: () => FakeCollector;
+//# sourceMappingURL=fake-collector.d.ts.map

package/dist/telemetry/fake-collector.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-collector.d.ts","sourceRoot":"","sources":["../../src/telemetry/fake-collector.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,EAAE,CAAC;IACtC,6EAA6E;IAC7E,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAAC;IACrC;;6FAEyF;IACzF,OAAO,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,IAAI,IAAI,IAAI,CAAC;CACd;AAID,eAAO,MAAM,aAAa,QAAO,aAoBhC,CAAC"}

package/dist/telemetry/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `@homeflare/alchemy/telemetry` — an OTLP tracing/logging/metrics Layer for a stack's own
+ * `providers`, off unless a consumer gives it real endpoints. See docs/telemetry.md for how a site
+ * file wires it up and docs/telemetry-spike.md for what a stack's `providers` Layer can and cannot
+ * capture (measured against alchemy 2.0.0-beta.79's own engine).
+ */
+export { telemetryLayer } from './layer.ts';
+export type { TelemetryEndpoints, TelemetryOptions } from './layer.ts';
+export { DROP, REDACTED, redactAttribute, wrapTracer } from './redact.ts';
+export type { RedactionPolicy } from './redact.ts';
+//# sourceMappingURL=index.d.ts.map

package/dist/telemetry/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/telemetry/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,YAAY,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC1E,YAAY,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC"}

package/dist/telemetry/index.js

@@ -0,0 +1,223 @@
+// src/telemetry/layer.ts
+import * as Effect2 from "effect/Effect";
+import * as Layer2 from "effect/Layer";
+import * as Logger from "effect/Logger";
+import * as LogLevel from "effect/LogLevel";
+import * as Tracer from "effect/Tracer";
+import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
+import { OtlpExporter, OtlpLogger, OtlpMetrics, OtlpTracer } from "effect/unstable/observability";
+
+// src/telemetry/redact-serialization.ts
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { OtlpSerialization } from "effect/unstable/observability";
+
+// src/telemetry/redact.ts
+var REDACTED = "<redacted>";
+var DROP = Symbol.for("homeflare/alchemy/telemetry/drop-attribute");
+var HEADER_ATTRIBUTE = /^http\.(?:request|response)\.header\./;
+var redactSegments = (value, denylist) => value.split("/").map((segment) => denylist.has(segment) ? REDACTED : segment).join("/");
+var redactAttribute = (key, value, policy) => {
+  if (HEADER_ATTRIBUTE.test(key))
+    return DROP;
+  if (key === "url.query")
+    return DROP;
+  if (typeof value !== "string")
+    return value;
+  const denylist = new Set(policy.denylist ?? []);
+  if (denylist.size === 0 && key !== "url.full" && key !== "server.address")
+    return value;
+  if (key === "server.address") {
+    try {
+      const url = new URL(value);
+      return denylist.has(url.hostname) ? REDACTED : value;
+    } catch {
+      return denylist.has(value) ? REDACTED : value;
+    }
+  }
+  if (key === "url.path")
+    return redactSegments(value, denylist);
+  if (key === "url.full") {
+    try {
+      const url = new URL(value);
+      const host = denylist.has(url.hostname) ? REDACTED : url.host;
+      return `${url.protocol}//${host}${redactSegments(url.pathname, denylist)}`;
+    } catch {
+      return value;
+    }
+  }
+  return value;
+};
+var redactAttributes = (attributes, policy) => {
+  const out = {};
+  for (const [key, value] of Object.entries(attributes)) {
+    const redacted = redactAttribute(key, value, policy);
+    if (redacted !== DROP)
+      out[key] = redacted;
+  }
+  return out;
+};
+var wrapTracer = (inner, policy) => ({
+  context: inner.context,
+  span(options) {
+    const real = inner.span(options);
+    return {
+      _tag: "Span",
+      spanId: real.spanId,
+      traceId: real.traceId,
+      parent: real.parent,
+      annotations: real.annotations,
+      get name() {
+        return real.name;
+      },
+      get status() {
+        return real.status;
+      },
+      get attributes() {
+        return real.attributes;
+      },
+      get links() {
+        return real.links;
+      },
+      sampled: real.sampled,
+      kind: real.kind,
+      end: (endTime, exit) => {
+        real.end(endTime, exit);
+      },
+      attribute: (key, value) => {
+        const redacted = redactAttribute(key, value, policy);
+        if (redacted !== DROP)
+          real.attribute(key, redacted);
+      },
+      event: (name, startTime, attributes) => {
+        real.event(name, startTime, attributes ? redactAttributes(attributes, policy) : attributes);
+      },
+      addLinks: (links) => {
+        real.addLinks(links);
+      }
+    };
+  }
+});
+
+// src/telemetry/redact-serialization.ts
+var URL_PATTERN = /https?:\/\/[^\s"'<>)]+/g;
+var scrubUrl = (raw, denylist) => {
+  try {
+    const url = new URL(raw);
+    const host = denylist.has(url.hostname) ? REDACTED : url.host;
+    const path = url.pathname.split("/").map((segment) => denylist.has(segment) ? REDACTED : segment).join("/");
+    return `${url.protocol}//${host}${path}`;
+  } catch {
+    return raw;
+  }
+};
+var scrubText = (text, policy) => {
+  const denylist = policy.denylist ?? [];
+  const denylistSet = new Set(denylist);
+  let out = text.replace(URL_PATTERN, (match) => scrubUrl(match, denylistSet));
+  for (const token of denylist) {
+    if (token.length === 0)
+      continue;
+    out = out.split(token).join(REDACTED);
+  }
+  return out;
+};
+var scrubValue = (value, policy) => {
+  if (typeof value.stringValue === "string")
+    return { ...value, stringValue: scrubText(value.stringValue, policy) };
+  if (value.arrayValue !== undefined) {
+    return {
+      ...value,
+      arrayValue: { values: value.arrayValue.values.map((v) => scrubValue(v, policy)) }
+    };
+  }
+  if (value.kvlistValue !== undefined) {
+    return {
+      ...value,
+      kvlistValue: {
+        values: value.kvlistValue.values.map((kv) => ({
+          key: kv.key,
+          value: scrubValue(kv.value, policy)
+        }))
+      }
+    };
+  }
+  return value;
+};
+var scrubKeyValues = (attributes, policy) => attributes.map((kv) => ({ key: kv.key, value: scrubValue(kv.value, policy) }));
+var redactTraceData = (data, policy) => ({
+  resourceSpans: data.resourceSpans.map((resourceSpan) => ({
+    ...resourceSpan,
+    scopeSpans: resourceSpan.scopeSpans.map((scopeSpan) => ({
+      ...scopeSpan,
+      spans: scopeSpan.spans.map((span) => ({
+        ...span,
+        attributes: scrubKeyValues(span.attributes, policy),
+        events: span.events.map((event) => ({
+          ...event,
+          attributes: scrubKeyValues(event.attributes, policy),
+          name: scrubText(event.name, policy)
+        })),
+        links: span.links.map((link) => ({
+          ...link,
+          attributes: scrubKeyValues(link.attributes, policy)
+        })),
+        name: scrubText(span.name, policy),
+        status: span.status.message === undefined ? span.status : { ...span.status, message: scrubText(span.status.message, policy) }
+      }))
+    }))
+  }))
+});
+var scrubLogRecord = (record, policy) => ({
+  ...record,
+  attributes: scrubKeyValues(record.attributes, policy),
+  ...record.body !== undefined ? { body: scrubValue(record.body, policy) } : {}
+});
+var redactLogsData = (data, policy) => ({
+  resourceLogs: data.resourceLogs.map((resourceLog) => ({
+    ...resourceLog,
+    scopeLogs: resourceLog.scopeLogs.map((scopeLog) => ({
+      ...scopeLog,
+      ...scopeLog.logRecords !== undefined ? { logRecords: scopeLog.logRecords.map((record) => scrubLogRecord(record, policy)) } : {}
+    }))
+  }))
+});
+var redactedSerialization = (policy) => Layer.effect(OtlpSerialization.OtlpSerialization, Effect.map(OtlpSerialization.OtlpSerialization, (inner) => ({
+  logs: (data) => inner.logs(redactLogsData(data, policy)),
+  metrics: inner.metrics,
+  traces: (data) => inner.traces(redactTraceData(data, policy))
+}))).pipe(Layer.provide(OtlpSerialization.layerProtobuf));
+
+// src/telemetry/layer.ts
+var resourceOf = (options) => ({
+  serviceName: options.serviceName,
+  ...options.serviceVersion !== undefined ? { serviceVersion: options.serviceVersion } : {},
+  ...options.resourceAttributes !== undefined ? { attributes: options.resourceAttributes } : {}
+});
+var tracerLayer = (url, options, exportInterval) => Layer2.effect(Tracer.Tracer, Effect2.map(OtlpTracer.make({ exportInterval, resource: resourceOf(options), url }), (inner) => wrapTracer(inner, options.redaction ?? {}))).pipe(Layer2.provideMerge(OtlpExporter.layerFlusher));
+var loggerLayer = (url, options, exportInterval) => {
+  const floor = options.logsMinimumLevel ?? "Info";
+  return Logger.layer([
+    Effect2.map(OtlpLogger.make({ exportInterval, resource: resourceOf(options), url }), (inner) => Logger.make((record) => LogLevel.isGreaterThanOrEqualTo(record.logLevel, floor) ? inner.log(record) : undefined))
+  ], { mergeWithExisting: true }).pipe(Layer2.provideMerge(OtlpExporter.layerFlusher));
+};
+var telemetryLayer = (options) => {
+  const { traces, logs, metrics } = options.endpoints;
+  if (traces === undefined && logs === undefined && metrics === undefined)
+    return Layer2.empty;
+  const exportInterval = options.exportInterval ?? "1 second";
+  const tracer = traces === undefined ? Layer2.empty : tracerLayer(traces, options, exportInterval);
+  const logger = logs === undefined ? Layer2.empty : loggerLayer(logs, options, exportInterval);
+  const meter = metrics === undefined ? Layer2.empty : OtlpMetrics.layer({ exportInterval, resource: resourceOf(options), url: metrics });
+  return Layer2.mergeAll(tracer, logger, meter).pipe(Layer2.provide(redactedSerialization(options.redaction ?? {})), Layer2.provide(FetchHttpClient.layer));
+};
+export {
+  DROP,
+  REDACTED,
+  redactAttribute,
+  telemetryLayer,
+  wrapTracer
+};
+
+//# debugId=D5C073A7ECCA33DE64756E2164756E21
+//# sourceMappingURL=index.js.map

package/dist/telemetry/index.js.map

@@ -0,0 +1,12 @@
+{
+  "version": 3,
+  "sources": ["../src/telemetry/layer.ts", "../src/telemetry/redact-serialization.ts", "../src/telemetry/redact.ts"],
+  "sourcesContent": [
+    "/**\n * A Layer factory for OTLP tracing/logging/metrics, built for a stack's own `providers` Layer\n * rather than the CLI-wide install alchemy's own `Telemetry/Layer.ts` does (`src/Telemetry/\n * Layer.ts:13-15`, hard-coded to `otel.alchemy.run` with no override). Nothing here calls that\n * endpoint or knows it exists.\n *\n * ⛔ NO DEFAULTS THAT POINT ANYWHERE. `endpoints` is `{}` by default and `telemetryLayer` resolves\n *   to `Layer.empty` when every entry is `undefined` — see layer.test.ts's own \"nothing sent\n *   when unconfigured\". A consumer wires actual hosts from ITS OWN site config; see docs/telemetry.md.\n * ★ SEALED TRANSPORT — the caddy lesson (kit PR 293, admin.ts's own ⛔): merging a layer that still\n *   requires `HttpClient.HttpClient` into a stack's `providers` would let this module's own\n *   `FetchHttpClient` shadow a sibling fetch-based provider's client once both are merged into the\n *   same `Layer.mergeAll`. `Layer.provide` (not `Layer.provideMerge`) twice below feeds\n *   `FetchHttpClient`/`OtlpSerialization` to the OTLP layers and returns ONLY their own output —\n *   `HttpClient.HttpClient` never appears in what `telemetryLayer` hands back. See\n *   http-client-sealing.test.ts.\n * ★ PER-SIGNAL URLS, NOT ONE BASE URL. effect's own `Otlp.layer`/`layerJson` take a single\n *   `baseUrl` and post to `<baseUrl>/v1/{traces,metrics,logs}` — fine when one collector serves all\n *   three, wrong for Victoria's split binaries (VictoriaTraces/Logs/Metrics on three different\n *   ports/paths — docs/telemetry.md has the exact paths). `OtlpTracer`/`OtlpLogger`/`OtlpMetrics`\n *   each take their own `url` and post to it verbatim (OtlpExporter.ts `make`: `HttpClientRequest.\n *   post(options.url, …)`, no suffix appended) — exactly the shape three independent endpoints need.\n * ⛔ PROTOBUF, NOT JSON (redteam PR 302 CRITICAL item 1, 2026-09-26, measured against the pinned\n *   binaries in homeflare-mini's `src/obs`): VictoriaLogs 1.52.0 and VictoriaMetrics 1.151.0 both\n *   answer OTLP/HTTP JSON with `400 \"json encoding isn't supported for opentelemetry format\"` —\n *   effect's exporter treats a 400 as non-transient, drops the batch silently and disables itself for\n *   60s at debug-only log level, so a JSON-encoded consumer sees traces (VictoriaTraces alone\n *   tolerates JSON) but never logs or metrics, with no visible error. `redactedSerialization` below\n *   provides `OtlpSerialization.layerProtobuf`, which all three ingested in the same measurement.\n */\nimport type * as Duration from 'effect/Duration';\nimport * as Effect from 'effect/Effect';\nimport * as Layer from 'effect/Layer';\nimport * as Logger from 'effect/Logger';\nimport * as LogLevel from 'effect/LogLevel';\nimport * as Tracer from 'effect/Tracer';\nimport * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';\nimport { OtlpExporter, OtlpLogger, OtlpMetrics, OtlpTracer } from 'effect/unstable/observability';\nimport { redactedSerialization } from './redact-serialization.ts';\nimport { type RedactionPolicy, wrapTracer } from './redact.ts';\n\n/** Full OTLP/HTTP endpoint per signal — e.g. `http://victoria.example.test:10428/insert/opentelemetry/v1/traces`. Any entry left `undefined` sends nothing for that signal. */\nexport interface TelemetryEndpoints {\n  readonly traces?: string;\n  readonly logs?: string;\n  readonly metrics?: string;\n}\n\nexport interface TelemetryOptions {\n  readonly endpoints: TelemetryEndpoints;\n  /** OTLP `service.name` — required, since an unnamed service in a shared Victoria instance is unusable. */\n  readonly serviceName: string;\n  readonly serviceVersion?: string;\n  /** Extra OTLP resource attributes (e.g. `{ \"deployment.environment\": \"prod\" }`). */\n  readonly resourceAttributes?: Record<string, unknown>;\n  readonly redaction?: RedactionPolicy;\n  /**\n   * How often a signal flushes its buffer.\n   * @default '1 second' — short on purpose: alchemy invocations are CLI runs, often shorter than a\n   * typical OTLP batch interval, so the export must fire well before the process could exit. The\n   * scope's own shutdown flush (`Exporter.layerFlusher`) is the backstop for whatever this interval\n   * misses; docs/telemetry-spike.md measured both paths.\n   */\n  readonly exportInterval?: Duration.Input;\n  /**\n   * Floor below which a log record never reaches the OTLP logger.\n   * @default 'Info' — redteam PR 302 IMPORTANT item 4: the `alchemy` CLI sets the GLOBAL minimum\n   * log level to Debug (`GlobalLog.ts`), and `OtlpLogger` has no floor of its own, so without one\n   * every Debug-level record (a provider's own connection-string/config dump, annotation noise)\n   * would ship — once `redactedSerialization` fixed item 1's silent-JSON-failure, they would\n   * actually start arriving. This floor applies ONLY to what THIS layer exports; a consumer's\n   * console/file loggers keep whatever level the CLI's own global setting gives them, since\n   * `logsMinimumLevel` filters after `Logger.layer`'s `mergeWithExisting: true` has already added\n   * this logger alongside them, not by lowering that global setting.\n   */\n  readonly logsMinimumLevel?: LogLevel.LogLevel;\n}\n\n// ⚠️ `exactOptionalPropertyTypes` — omit a key entirely rather than set it `undefined`, or the\n//   OTLP layers' own `{ readonly attributes?: X }` (no `| undefined` in their own signatures)\n//   rejects the object.\nconst resourceOf = (options: TelemetryOptions) => ({\n  serviceName: options.serviceName,\n  ...(options.serviceVersion !== undefined ? { serviceVersion: options.serviceVersion } : {}),\n  ...(options.resourceAttributes !== undefined ? { attributes: options.resourceAttributes } : {}),\n});\n\n/**\n * `OtlpTracer.layer`'s own composition (OtlpTracer.ts: `flow(make, Layer.effect(Tracer.Tracer),\n * Layer.provideMerge(Exporter.layerFlusher))`), with `wrapTracer` inserted between `make` and\n * `Layer.effect` so every span this tracer creates is redacted before anything else can see it.\n */\nconst tracerLayer = (url: string, options: TelemetryOptions, exportInterval: Duration.Input) =>\n  Layer.effect(\n    Tracer.Tracer,\n    Effect.map(OtlpTracer.make({ exportInterval, resource: resourceOf(options), url }), (inner) =>\n      wrapTracer(inner, options.redaction ?? {}),\n    ),\n  ).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));\n\n/**\n * `OtlpLogger.layer`'s own composition (`Logger.layer([make(options)], { mergeWithExisting: true })\n * .pipe(Layer.provideMerge(Exporter.layerFlusher))`), with a level floor inserted between `make` and\n * `Logger.layer` — see `TelemetryOptions.logsMinimumLevel`'s own doc for why.\n */\nconst loggerLayer = (url: string, options: TelemetryOptions, exportInterval: Duration.Input) => {\n  const floor = options.logsMinimumLevel ?? 'Info';\n  return Logger.layer(\n    [\n      Effect.map(OtlpLogger.make({ exportInterval, resource: resourceOf(options), url }), (inner) =>\n        Logger.make((record) =>\n          LogLevel.isGreaterThanOrEqualTo(record.logLevel, floor) ? inner.log(record) : undefined,\n        ),\n      ),\n    ],\n    { mergeWithExisting: true },\n  ).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));\n};\n\n/**\n * The Layer a consumer stack merges into its own `providers` — see docs/telemetry.md for how a\n * site file wires real hosts in, and docs/telemetry-spike.md for what a stack's `providers` Layer does and does\n * not carry a span for.\n *\n * ⚠️ FIXED THREE-ARG `Layer.mergeAll`, NOT AN ARRAY `.reduce`. Every signal slot is filled — with\n *   the real per-signal layer when its endpoint is set, `Layer.empty` when it is not — instead of\n *   building a variable-length array and folding it with `Layer.merge`. `Layer<in ROut, …>`\n *   declares its success channel CONTRAVARIANT, and once a fold's accumulator needs an explicit\n *   annotation to type-check under this repo's `exactOptionalPropertyTypes`, TS's overload\n *   resolution for `Layer.provide`/`Layer.merge` starts inferring `unknown` for that channel and\n *   then fails `unknown` against `never` (measured 2026-09-26, TS2769). `Layer.mergeAll`'s own\n *   fixed-arity overload — the exact shape alchemy's own `Telemetry/Layer.ts` uses for its three\n *   signals — infers cleanly with no annotation at all.\n */\nexport const telemetryLayer = (options: TelemetryOptions): Layer.Layer<never> => {\n  const { traces, logs, metrics } = options.endpoints;\n  if (traces === undefined && logs === undefined && metrics === undefined) return Layer.empty;\n  // Default declared here, not in the options' type, so every call site above stays a concrete\n  // `Duration.Input` — `exactOptionalPropertyTypes` rejects passing `undefined` through to the\n  // OTLP layers' own `exportInterval?: Duration.Input` (no `| undefined` in their signatures).\n  const exportInterval: Duration.Input = options.exportInterval ?? '1 second';\n  const tracer = traces === undefined ? Layer.empty : tracerLayer(traces, options, exportInterval);\n  const logger = logs === undefined ? Layer.empty : loggerLayer(logs, options, exportInterval);\n  const meter =\n    metrics === undefined\n      ? Layer.empty\n      : OtlpMetrics.layer({ exportInterval, resource: resourceOf(options), url: metrics });\n  return Layer.mergeAll(tracer, logger, meter).pipe(\n    Layer.provide(redactedSerialization(options.redaction ?? {})),\n    Layer.provide(FetchHttpClient.layer),\n  );\n};\n",
+    "/**\n * Free-text OTLP redaction applied at `OtlpSerialization` — the ONE place every span/log field\n * reaches the wire, right before HTTP body encoding. `redact.ts`'s `wrapTracer` only sees what a\n * caller passes to `Span.attribute()`/`Span.event()`; two real fields never go through either hook:\n *\n * - `status.message` and the `exception.*` event attributes `OtlpTracer`'s own `makeOtlpSpan` builds\n *   from `Cause.prettyErrors(exit.cause)` — computed at export time, inside effect's tracer, AFTER\n *   `wrapTracer.end()` has already handed the exit straight to `real.end()`.\n * - a log line inside a span, turned into a span event by effect's default `tracerLogger` — the log\n *   message becomes the event NAME (not an attribute `wrapTracer.event()` redacts), and its\n *   `effect.cause` attribute is free text `redactAttribute`'s key-based rules never recognize.\n *\n * Redteam finding (PR 302, 2026-09-26): a provider GET that 404'd exported `exception.message =\n * \"... 404 GET http://host/secret-site-abc123/probe?token=SECRET123\"` unredacted — the query, the\n * denylisted path segment and the denylisted host all went out. A `logWarning` inside a span leaked\n * the same way through the event name.\n *\n * ⚠️ SUBSTRING MATCH, NOT SEGMENT MATCH. `redactAttribute` compares a denylist entry against a whole\n *   `/`-bounded URL segment on purpose (`redact.ts`'s own ⚠️: `\"db\"` must not blank `\"db1.example.\n *   test\"`). Free text has no segment boundaries — a log message or a formatted `Cause` embeds a\n *   token in prose — so `scrubText` matches a denylist entry as a literal substring ANYWHERE in the\n *   string. This is strictly broader than the structured rules, so it also closes the `server.\n *   address` bare-hostname and legacy `http.url` gaps (redteam MINOR item 5) as a side effect: a\n *   denylisted hostname is a substring match wherever it appears, URL-shaped or not. The tradeoff a\n *   caller accepts by naming a short, common word in `denylist` is over-redaction, never a leak.\n */\nimport * as Effect from 'effect/Effect';\nimport * as Layer from 'effect/Layer';\nimport { OtlpSerialization } from 'effect/unstable/observability';\nimport type { OtlpLogger, OtlpResource, OtlpTracer } from 'effect/unstable/observability';\nimport { REDACTED, type RedactionPolicy } from './redact.ts';\n\nconst URL_PATTERN = /https?:\\/\\/[^\\s\"'<>)]+/g;\n\n/** Strips an embedded URL's query/hash and blanks its denylisted host/path segments — `redact.ts`'s\n * `url.full` case, reused here because a URL can appear inside prose, not just as its own attribute. */\nconst scrubUrl = (raw: string, denylist: ReadonlySet<string>): string => {\n  try {\n    const url = new URL(raw);\n    const host = denylist.has(url.hostname) ? REDACTED : url.host;\n    const path = url.pathname\n      .split('/')\n      .map((segment) => (denylist.has(segment) ? REDACTED : segment))\n      .join('/');\n    return `${url.protocol}//${host}${path}`;\n  } catch {\n    return raw; // Matched the URL_PATTERN regex but `URL` still rejects it — leave verbatim.\n  }\n};\n\n/** Redacts one piece of free text: every embedded URL loses its query string and denylisted\n * segments, then every denylist entry is blanked as a substring anywhere else in the text. */\nexport const scrubText = (text: string, policy: RedactionPolicy): string => {\n  const denylist = policy.denylist ?? [];\n  const denylistSet = new Set(denylist);\n  let out = text.replace(URL_PATTERN, (match) => scrubUrl(match, denylistSet));\n  for (const token of denylist) {\n    if (token.length === 0) continue; // an empty entry would blank every character boundary\n    out = out.split(token).join(REDACTED);\n  }\n  return out;\n};\n\n/** Walks one OTLP `AnyValue`'s string leaves (`stringValue`, and recursively through `arrayValue`/\n * `kvlistValue`) — the union effect's OTLP encoders use for every attribute and log body value. */\nconst scrubValue = (\n  value: OtlpResource.AnyValue,\n  policy: RedactionPolicy,\n): OtlpResource.AnyValue => {\n  if (typeof value.stringValue === 'string')\n    return { ...value, stringValue: scrubText(value.stringValue, policy) };\n  if (value.arrayValue !== undefined) {\n    return {\n      ...value,\n      arrayValue: { values: value.arrayValue.values.map((v) => scrubValue(v, policy)) },\n    };\n  }\n  if (value.kvlistValue !== undefined) {\n    return {\n      ...value,\n      kvlistValue: {\n        values: value.kvlistValue.values.map((kv) => ({\n          key: kv.key,\n          value: scrubValue(kv.value, policy),\n        })),\n      },\n    };\n  }\n  return value; // boolValue / intValue / doubleValue / bytesValue — never free text.\n};\n\nconst scrubKeyValues = (\n  attributes: ReadonlyArray<OtlpResource.KeyValue>,\n  policy: RedactionPolicy,\n): Array<OtlpResource.KeyValue> =>\n  attributes.map((kv) => ({ key: kv.key, value: scrubValue(kv.value, policy) }));\n\n/** `TraceData` after every span's name, attributes, events (including the `exception.*` ones\n * `makeOtlpSpan` builds from the exit), status message and link attributes have been scrubbed. */\nexport const redactTraceData = (\n  data: OtlpTracer.TraceData,\n  policy: RedactionPolicy,\n): OtlpTracer.TraceData => ({\n  resourceSpans: data.resourceSpans.map((resourceSpan) => ({\n    ...resourceSpan,\n    scopeSpans: resourceSpan.scopeSpans.map((scopeSpan) => ({\n      ...scopeSpan,\n      spans: scopeSpan.spans.map((span) => ({\n        ...span,\n        attributes: scrubKeyValues(span.attributes, policy),\n        events: span.events.map((event) => ({\n          ...event,\n          attributes: scrubKeyValues(event.attributes, policy),\n          name: scrubText(event.name, policy),\n        })),\n        links: span.links.map((link) => ({\n          ...link,\n          attributes: scrubKeyValues(link.attributes, policy),\n        })),\n        name: scrubText(span.name, policy),\n        status:\n          span.status.message === undefined\n            ? span.status\n            : { ...span.status, message: scrubText(span.status.message, policy) },\n      })),\n    })),\n  })),\n});\n\ntype LogRecord = NonNullable<\n  OtlpLogger.LogsData['resourceLogs'][number]['scopeLogs'][number]['logRecords']\n>[number];\n\n// ⚠️ `exactOptionalPropertyTypes` — `body` is `AnyValue?` with no `| undefined` in its own\n//   signature (matches `layer.ts`'s own `resourceOf` note), so an absent one is OMITTED, not set to\n//   `undefined`, or this object-literal return fails to type-check against `ILogRecord`.\nconst scrubLogRecord = (record: LogRecord, policy: RedactionPolicy): LogRecord => ({\n  ...record,\n  attributes: scrubKeyValues(record.attributes, policy),\n  ...(record.body !== undefined ? { body: scrubValue(record.body, policy) } : {}),\n});\n\n/** `LogsData` after every log record's attributes and body have been scrubbed — the fix for redteam\n * item 4's \"logs ship unredacted\": `log.error` (`Cause.pretty`) and the message body are free text. */\nexport const redactLogsData = (\n  data: OtlpLogger.LogsData,\n  policy: RedactionPolicy,\n): OtlpLogger.LogsData => ({\n  resourceLogs: data.resourceLogs.map((resourceLog) => ({\n    ...resourceLog,\n    scopeLogs: resourceLog.scopeLogs.map((scopeLog) => ({\n      ...scopeLog,\n      // Same `exactOptionalPropertyTypes` reasoning as `scrubLogRecord` — omit `logRecords`\n      // entirely rather than assign it `undefined` when the source had none.\n      ...(scopeLog.logRecords !== undefined\n        ? { logRecords: scopeLog.logRecords.map((record) => scrubLogRecord(record, policy)) }\n        : {}),\n    })),\n  })),\n});\n\n/**\n * Wraps the real `OtlpSerialization` so `telemetryLayer` gets this free-text pass on every signal\n * with no separate wiring at each call site — `layer.ts` provides this in place of a bare\n * `OtlpSerialization.layerProtobuf`. Metrics pass through untouched: they carry numeric data points\n * keyed by `Metric.Metric.AttributeSet`, not provider-supplied free text.\n */\nexport const redactedSerialization = (\n  policy: RedactionPolicy,\n): Layer.Layer<OtlpSerialization.OtlpSerialization> =>\n  Layer.effect(\n    OtlpSerialization.OtlpSerialization,\n    Effect.map(OtlpSerialization.OtlpSerialization, (inner) => ({\n      logs: (data: OtlpLogger.LogsData) => inner.logs(redactLogsData(data, policy)),\n      metrics: inner.metrics,\n      traces: (data: OtlpTracer.TraceData) => inner.traces(redactTraceData(data, policy)),\n    })),\n  ).pipe(Layer.provide(OtlpSerialization.layerProtobuf));\n",
+    "/**\n * URL/header redaction for outgoing spans — applied at the `Tracer.Tracer` boundary so it holds for\n * EVERY span source (a provider's own `Effect.withSpan`, effect's `HttpClient` client spans, and\n * alchemy's own plan/apply/resource spans), not just the ones a caller remembers to annotate.\n *\n * ★ WHY THE TRACER, NOT AN HTTPCLIENT MIDDLEWARE. effect's `HttpClient.make` (src/unstable/http/\n *   HttpClient.ts) hard-codes `span.attribute(\"url.full\", …)`, `\"url.query\"` and\n *   `http.request.header.<name>` on the span it creates — there is no hook to stop it recording\n *   them. The one seam every span (HttpClient's included) passes through is `Tracer.span()`\n *   returning a `Tracer.Span`, so `wrapTracer` intercepts `Span.attribute()` there instead.\n * ⛔ NEVER RECORD HEADERS. A header NAME can itself be sensitive (`x-api-key`, a session cookie\n *   name), so every `http.{request,response}.header.*` key is DROPPED, not value-redacted.\n * ⚠️ QUERY STRINGS ARE STRIPPED WHOLE, not redacted per-parameter: an allowlist of \"safe\" params\n *   would silently leak the next secret param a provider adds. `url.query` is dropped outright and\n *   `url.full`/`url.path` never carry a `?…` past this point.\n */\nimport type * as Tracer from 'effect/Tracer';\n\n/** Host or path segments to blank wherever they appear in a URL attribute — exact-segment match. */\nexport interface RedactionPolicy {\n  /**\n   * e.g. a UniFi console id embedded in a path (`/proxy/network/api/site/<id>/...`) or a private\n   * hostname a consumer never wants leaving its own process. Compared against the full hostname and\n   * against each `/`-separated path segment — never a substring match, so `\"db\"` cannot accidentally\n   * blank `\"db1.example.test\"`.\n   */\n  readonly denylist?: ReadonlyArray<string>;\n}\n\nexport const REDACTED = '<redacted>';\n\n/** Returned by `redactAttribute` to mean \"drop this attribute entirely — do not forward it\". */\nexport const DROP: unique symbol = Symbol.for('homeflare/alchemy/telemetry/drop-attribute');\n\nconst HEADER_ATTRIBUTE = /^http\\.(?:request|response)\\.header\\./;\n\nconst redactSegments = (value: string, denylist: ReadonlySet<string>): string =>\n  value\n    .split('/')\n    .map((segment) => (denylist.has(segment) ? REDACTED : segment))\n    .join('/');\n\n/**\n * Applies `policy` to one span attribute. Returns `DROP` when the key must never be recorded at\n * all (every header); otherwise returns the value to record, with URLs stripped of their query\n * string and hash and their denylisted host/path segments blanked. A value this function does not\n * recognize (not a URL-shaped key, or not a string) passes through unchanged — alchemy's own\n * engine attributes (`resource.fqn`, `plan.action`, …) are never URLs and are never touched.\n */\nexport const redactAttribute = (key: string, value: unknown, policy: RedactionPolicy): unknown => {\n  if (HEADER_ATTRIBUTE.test(key)) return DROP;\n  if (key === 'url.query') return DROP;\n  if (typeof value !== 'string') return value;\n  const denylist = new Set(policy.denylist ?? []);\n  if (denylist.size === 0 && key !== 'url.full' && key !== 'server.address') return value;\n  // ⚠️ MEASURED 2026-09-26 (docs/telemetry-spike.md): effect's own `HttpClient.make` sets\n  //   `server.address` to `url.origin` (`http://host:port`), NOT a bare hostname — a denylist entry\n  //   naming just a hostname would never match the raw value, so this parses it out the same way\n  //   `url.full` does.\n  // ⛔ FIX (redteam PR 302 MINOR item 5, 2026-09-26): the OTel semantic convention's own default for\n  //   `server.address` IS a bare hostname with no scheme (`new URL(value)` throws on that), and other\n  //   instrumentation could emit exactly that even though effect's `HttpClient` doesn't today —\n  //   `redactAttribute('server.address', 'db1.example.test', { denylist: ['db1.example.test'] })`\n  //   returned the value verbatim before this fallback. Compare the raw string directly when it\n  //   isn't a parseable URL, instead of giving up.\n  if (key === 'server.address') {\n    try {\n      const url = new URL(value);\n      return denylist.has(url.hostname) ? REDACTED : value;\n    } catch {\n      return denylist.has(value) ? REDACTED : value;\n    }\n  }\n  if (key === 'url.path') return redactSegments(value, denylist);\n  if (key === 'url.full') {\n    try {\n      const url = new URL(value);\n      const host = denylist.has(url.hostname) ? REDACTED : url.host;\n      return `${url.protocol}//${host}${redactSegments(url.pathname, denylist)}`;\n    } catch {\n      // Not a URL we can parse (a relative path effect couldn't resolve) — leave it verbatim\n      // rather than guess; `url.full` is the one HttpClient always sets from a resolved `URL`, so\n      // this branch is a defensive fallback, not the expected path.\n      return value;\n    }\n  }\n  return value;\n};\n\nconst redactAttributes = (\n  attributes: Record<string, unknown>,\n  policy: RedactionPolicy,\n): Record<string, unknown> => {\n  const out: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(attributes)) {\n    const redacted = redactAttribute(key, value, policy);\n    if (redacted !== DROP) out[key] = redacted;\n  }\n  return out;\n};\n\n/**\n * Wraps a `Tracer.Tracer` so every span it creates redacts its attributes and event attributes\n * through `redactAttribute`/`redactAttributes` before they reach the real span (and therefore\n * before OTLP serialization ever sees them). Everything else — timing, status, links, the span's\n * own identity — passes straight through to `inner`.\n */\nexport const wrapTracer = (inner: Tracer.Tracer, policy: RedactionPolicy): Tracer.Tracer => ({\n  context: inner.context,\n  span(options): Tracer.Span {\n    const real = inner.span(options);\n    return {\n      _tag: 'Span',\n      spanId: real.spanId,\n      traceId: real.traceId,\n      parent: real.parent,\n      annotations: real.annotations,\n      get name() {\n        return real.name;\n      },\n      get status() {\n        return real.status;\n      },\n      get attributes() {\n        return real.attributes;\n      },\n      get links() {\n        return real.links;\n      },\n      sampled: real.sampled,\n      kind: real.kind,\n      end: (endTime, exit) => {\n        real.end(endTime, exit);\n      },\n      attribute: (key, value) => {\n        const redacted = redactAttribute(key, value, policy);\n        if (redacted !== DROP) real.attribute(key, redacted);\n      },\n      event: (name, startTime, attributes) => {\n        real.event(name, startTime, attributes ? redactAttributes(attributes, policy) : attributes);\n      },\n      addLinks: (links) => {\n        real.addLinks(links);\n      },\n    };\n  },\n});\n"
+  ],
+  "mappings": ";AA+BA;AACA;AACA;AACA;AACA;AACA;AACA;;;ACXA;AACA;AACA;;;ACCO,IAAM,WAAW;AAGjB,IAAM,OAAsB,OAAO,IAAI,4CAA4C;AAE1F,IAAM,mBAAmB;AAEzB,IAAM,iBAAiB,CAAC,OAAe,aACrC,MACG,MAAM,GAAG,EACT,IAAI,CAAC,YAAa,SAAS,IAAI,OAAO,IAAI,WAAW,OAAQ,EAC7D,KAAK,GAAG;AASN,IAAM,kBAAkB,CAAC,KAAa,OAAgB,WAAqC;AAAA,EAChG,IAAI,iBAAiB,KAAK,GAAG;AAAA,IAAG,OAAO;AAAA,EACvC,IAAI,QAAQ;AAAA,IAAa,OAAO;AAAA,EAChC,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,WAAW,IAAI,IAAI,OAAO,YAAY,CAAC,CAAC;AAAA,EAC9C,IAAI,SAAS,SAAS,KAAK,QAAQ,cAAc,QAAQ;AAAA,IAAkB,OAAO;AAAA,EAWlF,IAAI,QAAQ,kBAAkB;AAAA,IAC5B,IAAI;AAAA,MACF,MAAM,MAAM,IAAI,IAAI,KAAK;AAAA,MACzB,OAAO,SAAS,IAAI,IAAI,QAAQ,IAAI,WAAW;AAAA,MAC/C,MAAM;AAAA,MACN,OAAO,SAAS,IAAI,KAAK,IAAI,WAAW;AAAA;AAAA,EAE5C;AAAA,EACA,IAAI,QAAQ;AAAA,IAAY,OAAO,eAAe,OAAO,QAAQ;AAAA,EAC7D,IAAI,QAAQ,YAAY;AAAA,IACtB,IAAI;AAAA,MACF,MAAM,MAAM,IAAI,IAAI,KAAK;AAAA,MACzB,MAAM,OAAO,SAAS,IAAI,IAAI,QAAQ,IAAI,WAAW,IAAI;AAAA,MACzD,OAAO,GAAG,IAAI,aAAa,OAAO,eAAe,IAAI,UAAU,QAAQ;AAAA,MACvE,MAAM;AAAA,MAIN,OAAO;AAAA;AAAA,EAEX;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,mBAAmB,CACvB,YACA,WAC4B;AAAA,EAC5B,MAAM,MAA+B,CAAC;AAAA,EACtC,YAAY,KAAK,UAAU,OAAO,QAAQ,UAAU,GAAG;AAAA,IACrD,MAAM,WAAW,gBAAgB,KAAK,OAAO,MAAM;AAAA,IACnD,IAAI,aAAa;AAAA,MAAM,IAAI,OAAO;AAAA,EACpC;AAAA,EACA,OAAO;AAAA;AASF,IAAM,aAAa,CAAC,OAAsB,YAA4C;AAAA,EAC3F,SAAS,MAAM;AAAA,EACf,IAAI,CAAC,SAAsB;AAAA,IACzB,MAAM,OAAO,MAAM,KAAK,OAAO;AAAA,IAC/B,OAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,MACd,QAAQ,KAAK;AAAA,MACb,aAAa,KAAK;AAAA,UACd,IAAI,GAAG;AAAA,QACT,OAAO,KAAK;AAAA;AAAA,UAEV,MAAM,GAAG;AAAA,QACX,OAAO,KAAK;AAAA;AAAA,UAEV,UAAU,GAAG;AAAA,QACf,OAAO,KAAK;AAAA;AAAA,UAEV,KAAK,GAAG;AAAA,QACV,OAAO,KAAK;AAAA;AAAA,MAEd,SAAS,KAAK;AAAA,MACd,MAAM,KAAK;AAAA,MACX,KAAK,CAAC,SAAS,SAAS;AAAA,QACtB,KAAK,IAAI,SAAS,IAAI;AAAA;AAAA,MAExB,WAAW,CAAC,KAAK,UAAU;AAAA,QACzB,MAAM,WAAW,gBAAgB,KAAK,OAAO,MAAM;AAAA,QACnD,IAAI,aAAa;AAAA,UAAM,KAAK,UAAU,KAAK,QAAQ;AAAA;AAAA,MAErD,OAAO,CAAC,MAAM,WAAW,eAAe;AAAA,QACtC,KAAK,MAAM,MAAM,WAAW,aAAa,iBAAiB,YAAY,MAAM,IAAI,UAAU;AAAA;AAAA,MAE5F,UAAU,CAAC,UAAU;AAAA,QACnB,KAAK,SAAS,KAAK;AAAA;AAAA,IAEvB;AAAA;AAEJ;;;ADlHA,IAAM,cAAc;AAIpB,IAAM,WAAW,CAAC,KAAa,aAA0C;AAAA,EACvE,IAAI;AAAA,IACF,MAAM,MAAM,IAAI,IAAI,GAAG;AAAA,IACvB,MAAM,OAAO,SAAS,IAAI,IAAI,QAAQ,IAAI,WAAW,IAAI;AAAA,IACzD,MAAM,OAAO,IAAI,SACd,MAAM,GAAG,EACT,IAAI,CAAC,YAAa,SAAS,IAAI,OAAO,IAAI,WAAW,OAAQ,EAC7D,KAAK,GAAG;AAAA,IACX,OAAO,GAAG,IAAI,aAAa,OAAO;AAAA,IAClC,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAMJ,IAAM,YAAY,CAAC,MAAc,WAAoC;AAAA,EAC1E,MAAM,WAAW,OAAO,YAAY,CAAC;AAAA,EACrC,MAAM,cAAc,IAAI,IAAI,QAAQ;AAAA,EACpC,IAAI,MAAM,KAAK,QAAQ,aAAa,CAAC,UAAU,SAAS,OAAO,WAAW,CAAC;AAAA,EAC3E,WAAW,SAAS,UAAU;AAAA,IAC5B,IAAI,MAAM,WAAW;AAAA,MAAG;AAAA,IACxB,MAAM,IAAI,MAAM,KAAK,EAAE,KAAK,QAAQ;AAAA,EACtC;AAAA,EACA,OAAO;AAAA;AAKT,IAAM,aAAa,CACjB,OACA,WAC0B;AAAA,EAC1B,IAAI,OAAO,MAAM,gBAAgB;AAAA,IAC/B,OAAO,KAAK,OAAO,aAAa,UAAU,MAAM,aAAa,MAAM,EAAE;AAAA,EACvE,IAAI,MAAM,eAAe,WAAW;AAAA,IAClC,OAAO;AAAA,SACF;AAAA,MACH,YAAY,EAAE,QAAQ,MAAM,WAAW,OAAO,IAAI,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE;AAAA,IAClF;AAAA,EACF;AAAA,EACA,IAAI,MAAM,gBAAgB,WAAW;AAAA,IACnC,OAAO;AAAA,SACF;AAAA,MACH,aAAa;AAAA,QACX,QAAQ,MAAM,YAAY,OAAO,IAAI,CAAC,QAAQ;AAAA,UAC5C,KAAK,GAAG;AAAA,UACR,OAAO,WAAW,GAAG,OAAO,MAAM;AAAA,QACpC,EAAE;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,iBAAiB,CACrB,YACA,WAEA,WAAW,IAAI,CAAC,QAAQ,EAAE,KAAK,GAAG,KAAK,OAAO,WAAW,GAAG,OAAO,MAAM,EAAE,EAAE;AAIxE,IAAM,kBAAkB,CAC7B,MACA,YAC0B;AAAA,EAC1B,eAAe,KAAK,cAAc,IAAI,CAAC,kBAAkB;AAAA,OACpD;AAAA,IACH,YAAY,aAAa,WAAW,IAAI,CAAC,eAAe;AAAA,SACnD;AAAA,MACH,OAAO,UAAU,MAAM,IAAI,CAAC,UAAU;AAAA,WACjC;AAAA,QACH,YAAY,eAAe,KAAK,YAAY,MAAM;AAAA,QAClD,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW;AAAA,aAC/B;AAAA,UACH,YAAY,eAAe,MAAM,YAAY,MAAM;AAAA,UACnD,MAAM,UAAU,MAAM,MAAM,MAAM;AAAA,QACpC,EAAE;AAAA,QACF,OAAO,KAAK,MAAM,IAAI,CAAC,UAAU;AAAA,aAC5B;AAAA,UACH,YAAY,eAAe,KAAK,YAAY,MAAM;AAAA,QACpD,EAAE;AAAA,QACF,MAAM,UAAU,KAAK,MAAM,MAAM;AAAA,QACjC,QACE,KAAK,OAAO,YAAY,YACpB,KAAK,SACL,KAAK,KAAK,QAAQ,SAAS,UAAU,KAAK,OAAO,SAAS,MAAM,EAAE;AAAA,MAC1E,EAAE;AAAA,IACJ,EAAE;AAAA,EACJ,EAAE;AACJ;AASA,IAAM,iBAAiB,CAAC,QAAmB,YAAwC;AAAA,KAC9E;AAAA,EACH,YAAY,eAAe,OAAO,YAAY,MAAM;AAAA,KAChD,OAAO,SAAS,YAAY,EAAE,MAAM,WAAW,OAAO,MAAM,MAAM,EAAE,IAAI,CAAC;AAC/E;AAIO,IAAM,iBAAiB,CAC5B,MACA,YACyB;AAAA,EACzB,cAAc,KAAK,aAAa,IAAI,CAAC,iBAAiB;AAAA,OACjD;AAAA,IACH,WAAW,YAAY,UAAU,IAAI,CAAC,cAAc;AAAA,SAC/C;AAAA,SAGC,SAAS,eAAe,YACxB,EAAE,YAAY,SAAS,WAAW,IAAI,CAAC,WAAW,eAAe,QAAQ,MAAM,CAAC,EAAE,IAClF,CAAC;AAAA,IACP,EAAE;AAAA,EACJ,EAAE;AACJ;AAQO,IAAM,wBAAwB,CACnC,WAEM,aACJ,kBAAkB,mBACX,WAAI,kBAAkB,mBAAmB,CAAC,WAAW;AAAA,EAC1D,MAAM,CAAC,SAA8B,MAAM,KAAK,eAAe,MAAM,MAAM,CAAC;AAAA,EAC5E,SAAS,MAAM;AAAA,EACf,QAAQ,CAAC,SAA+B,MAAM,OAAO,gBAAgB,MAAM,MAAM,CAAC;AACpF,EAAE,CACJ,EAAE,KAAW,cAAQ,kBAAkB,aAAa,CAAC;;;ADhGvD,IAAM,aAAa,CAAC,aAA+B;AAAA,EACjD,aAAa,QAAQ;AAAA,KACjB,QAAQ,mBAAmB,YAAY,EAAE,gBAAgB,QAAQ,eAAe,IAAI,CAAC;AAAA,KACrF,QAAQ,uBAAuB,YAAY,EAAE,YAAY,QAAQ,mBAAmB,IAAI,CAAC;AAC/F;AAOA,IAAM,cAAc,CAAC,KAAa,SAA2B,mBACrD,cACG,eACA,YAAI,WAAW,KAAK,EAAE,gBAAgB,UAAU,WAAW,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,UACnF,WAAW,OAAO,QAAQ,aAAa,CAAC,CAAC,CAC3C,CACF,EAAE,KAAW,oBAAa,aAAa,YAAY,CAAC;AAOtD,IAAM,cAAc,CAAC,KAAa,SAA2B,mBAAmC;AAAA,EAC9F,MAAM,QAAQ,QAAQ,oBAAoB;AAAA,EAC1C,OAAc,aACZ;AAAA,IACS,YAAI,WAAW,KAAK,EAAE,gBAAgB,UAAU,WAAW,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,UAC5E,YAAK,CAAC,WACF,gCAAuB,OAAO,UAAU,KAAK,IAAI,MAAM,IAAI,MAAM,IAAI,SAChF,CACF;AAAA,EACF,GACA,EAAE,mBAAmB,KAAK,CAC5B,EAAE,KAAW,oBAAa,aAAa,YAAY,CAAC;AAAA;AAkB/C,IAAM,iBAAiB,CAAC,YAAkD;AAAA,EAC/E,QAAQ,QAAQ,MAAM,YAAY,QAAQ;AAAA,EAC1C,IAAI,WAAW,aAAa,SAAS,aAAa,YAAY;AAAA,IAAW,OAAa;AAAA,EAItF,MAAM,iBAAiC,QAAQ,kBAAkB;AAAA,EACjE,MAAM,SAAS,WAAW,YAAkB,eAAQ,YAAY,QAAQ,SAAS,cAAc;AAAA,EAC/F,MAAM,SAAS,SAAS,YAAkB,eAAQ,YAAY,MAAM,SAAS,cAAc;AAAA,EAC3F,MAAM,QACJ,YAAY,YACF,eACN,YAAY,MAAM,EAAE,gBAAgB,UAAU,WAAW,OAAO,GAAG,KAAK,QAAQ,CAAC;AAAA,EACvF,OAAa,gBAAS,QAAQ,QAAQ,KAAK,EAAE,KACrC,eAAQ,sBAAsB,QAAQ,aAAa,CAAC,CAAC,CAAC,GACtD,eAAwB,qBAAK,CACrC;AAAA;",
+  "debugId": "D5C073A7ECCA33DE64756E2164756E21",
+  "names": []
+}

package/dist/telemetry/layer.d.ts

@@ -0,0 +1,86 @@
+/**
+ * A Layer factory for OTLP tracing/logging/metrics, built for a stack's own `providers` Layer
+ * rather than the CLI-wide install alchemy's own `Telemetry/Layer.ts` does (`src/Telemetry/
+ * Layer.ts:13-15`, hard-coded to `otel.alchemy.run` with no override). Nothing here calls that
+ * endpoint or knows it exists.
+ *
+ * ⛔ NO DEFAULTS THAT POINT ANYWHERE. `endpoints` is `{}` by default and `telemetryLayer` resolves
+ *   to `Layer.empty` when every entry is `undefined` — see layer.test.ts's own "nothing sent
+ *   when unconfigured". A consumer wires actual hosts from ITS OWN site config; see docs/telemetry.md.
+ * ★ SEALED TRANSPORT — the caddy lesson (kit PR 293, admin.ts's own ⛔): merging a layer that still
+ *   requires `HttpClient.HttpClient` into a stack's `providers` would let this module's own
+ *   `FetchHttpClient` shadow a sibling fetch-based provider's client once both are merged into the
+ *   same `Layer.mergeAll`. `Layer.provide` (not `Layer.provideMerge`) twice below feeds
+ *   `FetchHttpClient`/`OtlpSerialization` to the OTLP layers and returns ONLY their own output —
+ *   `HttpClient.HttpClient` never appears in what `telemetryLayer` hands back. See
+ *   http-client-sealing.test.ts.
+ * ★ PER-SIGNAL URLS, NOT ONE BASE URL. effect's own `Otlp.layer`/`layerJson` take a single
+ *   `baseUrl` and post to `<baseUrl>/v1/{traces,metrics,logs}` — fine when one collector serves all
+ *   three, wrong for Victoria's split binaries (VictoriaTraces/Logs/Metrics on three different
+ *   ports/paths — docs/telemetry.md has the exact paths). `OtlpTracer`/`OtlpLogger`/`OtlpMetrics`
+ *   each take their own `url` and post to it verbatim (OtlpExporter.ts `make`: `HttpClientRequest.
+ *   post(options.url, …)`, no suffix appended) — exactly the shape three independent endpoints need.
+ * ⛔ PROTOBUF, NOT JSON (redteam PR 302 CRITICAL item 1, 2026-09-26, measured against the pinned
+ *   binaries in homeflare-mini's `src/obs`): VictoriaLogs 1.52.0 and VictoriaMetrics 1.151.0 both
+ *   answer OTLP/HTTP JSON with `400 "json encoding isn't supported for opentelemetry format"` —
+ *   effect's exporter treats a 400 as non-transient, drops the batch silently and disables itself for
+ *   60s at debug-only log level, so a JSON-encoded consumer sees traces (VictoriaTraces alone
+ *   tolerates JSON) but never logs or metrics, with no visible error. `redactedSerialization` below
+ *   provides `OtlpSerialization.layerProtobuf`, which all three ingested in the same measurement.
+ */
+import type * as Duration from 'effect/Duration';
+import * as Layer from 'effect/Layer';
+import * as LogLevel from 'effect/LogLevel';
+import { type RedactionPolicy } from './redact.ts';
+/** Full OTLP/HTTP endpoint per signal — e.g. `http://victoria.example.test:10428/insert/opentelemetry/v1/traces`. Any entry left `undefined` sends nothing for that signal. */
+export interface TelemetryEndpoints {
+    readonly traces?: string;
+    readonly logs?: string;
+    readonly metrics?: string;
+}
+export interface TelemetryOptions {
+    readonly endpoints: TelemetryEndpoints;
+    /** OTLP `service.name` — required, since an unnamed service in a shared Victoria instance is unusable. */
+    readonly serviceName: string;
+    readonly serviceVersion?: string;
+    /** Extra OTLP resource attributes (e.g. `{ "deployment.environment": "prod" }`). */
+    readonly resourceAttributes?: Record<string, unknown>;
+    readonly redaction?: RedactionPolicy;
+    /**
+     * How often a signal flushes its buffer.
+     * @default '1 second' — short on purpose: alchemy invocations are CLI runs, often shorter than a
+     * typical OTLP batch interval, so the export must fire well before the process could exit. The
+     * scope's own shutdown flush (`Exporter.layerFlusher`) is the backstop for whatever this interval
+     * misses; docs/telemetry-spike.md measured both paths.
+     */
+    readonly exportInterval?: Duration.Input;
+    /**
+     * Floor below which a log record never reaches the OTLP logger.
+     * @default 'Info' — redteam PR 302 IMPORTANT item 4: the `alchemy` CLI sets the GLOBAL minimum
+     * log level to Debug (`GlobalLog.ts`), and `OtlpLogger` has no floor of its own, so without one
+     * every Debug-level record (a provider's own connection-string/config dump, annotation noise)
+     * would ship — once `redactedSerialization` fixed item 1's silent-JSON-failure, they would
+     * actually start arriving. This floor applies ONLY to what THIS layer exports; a consumer's
+     * console/file loggers keep whatever level the CLI's own global setting gives them, since
+     * `logsMinimumLevel` filters after `Logger.layer`'s `mergeWithExisting: true` has already added
+     * this logger alongside them, not by lowering that global setting.
+     */
+    readonly logsMinimumLevel?: LogLevel.LogLevel;
+}
+/**
+ * The Layer a consumer stack merges into its own `providers` — see docs/telemetry.md for how a
+ * site file wires real hosts in, and docs/telemetry-spike.md for what a stack's `providers` Layer does and does
+ * not carry a span for.
+ *
+ * ⚠️ FIXED THREE-ARG `Layer.mergeAll`, NOT AN ARRAY `.reduce`. Every signal slot is filled — with
+ *   the real per-signal layer when its endpoint is set, `Layer.empty` when it is not — instead of
+ *   building a variable-length array and folding it with `Layer.merge`. `Layer<in ROut, …>`
+ *   declares its success channel CONTRAVARIANT, and once a fold's accumulator needs an explicit
+ *   annotation to type-check under this repo's `exactOptionalPropertyTypes`, TS's overload
+ *   resolution for `Layer.provide`/`Layer.merge` starts inferring `unknown` for that channel and
+ *   then fails `unknown` against `never` (measured 2026-09-26, TS2769). `Layer.mergeAll`'s own
+ *   fixed-arity overload — the exact shape alchemy's own `Telemetry/Layer.ts` uses for its three
+ *   signals — infers cleanly with no annotation at all.
+ */
+export declare const telemetryLayer: (options: TelemetryOptions) => Layer.Layer<never>;
+//# sourceMappingURL=layer.d.ts.map

package/dist/telemetry/layer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"layer.d.ts","sourceRoot":"","sources":["../../src/telemetry/layer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAEjD,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAEtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAK5C,OAAO,EAAE,KAAK,eAAe,EAAc,MAAM,aAAa,CAAC;AAE/D,+KAA+K;AAC/K,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,SAAS,EAAE,kBAAkB,CAAC;IACvC,0GAA0G;IAC1G,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;IACjC,oFAAoF;IACpF,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACtD,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,cAAc,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC;IACzC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,gBAAgB,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC;CAC/C;AA2CD;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,cAAc,YAAa,gBAAgB,KAAG,KAAK,CAAC,KAAK,CAAC,KAAK,CAiB3E,CAAC"}

package/dist/telemetry/redact-serialization.d.ts

@@ -0,0 +1,21 @@
+import * as Layer from 'effect/Layer';
+import { OtlpSerialization } from 'effect/unstable/observability';
+import type { OtlpLogger, OtlpTracer } from 'effect/unstable/observability';
+import { type RedactionPolicy } from './redact.ts';
+/** Redacts one piece of free text: every embedded URL loses its query string and denylisted
+ * segments, then every denylist entry is blanked as a substring anywhere else in the text. */
+export declare const scrubText: (text: string, policy: RedactionPolicy) => string;
+/** `TraceData` after every span's name, attributes, events (including the `exception.*` ones
+ * `makeOtlpSpan` builds from the exit), status message and link attributes have been scrubbed. */
+export declare const redactTraceData: (data: OtlpTracer.TraceData, policy: RedactionPolicy) => OtlpTracer.TraceData;
+/** `LogsData` after every log record's attributes and body have been scrubbed — the fix for redteam
+ * item 4's "logs ship unredacted": `log.error` (`Cause.pretty`) and the message body are free text. */
+export declare const redactLogsData: (data: OtlpLogger.LogsData, policy: RedactionPolicy) => OtlpLogger.LogsData;
+/**
+ * Wraps the real `OtlpSerialization` so `telemetryLayer` gets this free-text pass on every signal
+ * with no separate wiring at each call site — `layer.ts` provides this in place of a bare
+ * `OtlpSerialization.layerProtobuf`. Metrics pass through untouched: they carry numeric data points
+ * keyed by `Metric.Metric.AttributeSet`, not provider-supplied free text.
+ */
+export declare const redactedSerialization: (policy: RedactionPolicy) => Layer.Layer<OtlpSerialization.OtlpSerialization>;
+//# sourceMappingURL=redact-serialization.d.ts.map

package/dist/telemetry/redact-serialization.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-serialization.d.ts","sourceRoot":"","sources":["../../src/telemetry/redact-serialization.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAgB,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EAAY,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAoB7D;8FAC8F;AAC9F,eAAO,MAAM,SAAS,SAAU,MAAM,UAAU,eAAe,KAAG,MASjE,CAAC;AAoCF;kGACkG;AAClG,eAAO,MAAM,eAAe,SACpB,UAAU,CAAC,SAAS,UAClB,eAAe,KACtB,UAAU,CAAC,SAyBZ,CAAC;AAeH;uGACuG;AACvG,eAAO,MAAM,cAAc,SACnB,UAAU,CAAC,QAAQ,UACjB,eAAe,KACtB,UAAU,CAAC,QAYZ,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,WACxB,eAAe,KACtB,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,iBAAiB,CAQM,CAAC"}

package/dist/telemetry/redact.d.ts

@@ -0,0 +1,46 @@
+/**
+ * URL/header redaction for outgoing spans — applied at the `Tracer.Tracer` boundary so it holds for
+ * EVERY span source (a provider's own `Effect.withSpan`, effect's `HttpClient` client spans, and
+ * alchemy's own plan/apply/resource spans), not just the ones a caller remembers to annotate.
+ *
+ * ★ WHY THE TRACER, NOT AN HTTPCLIENT MIDDLEWARE. effect's `HttpClient.make` (src/unstable/http/
+ *   HttpClient.ts) hard-codes `span.attribute("url.full", …)`, `"url.query"` and
+ *   `http.request.header.<name>` on the span it creates — there is no hook to stop it recording
+ *   them. The one seam every span (HttpClient's included) passes through is `Tracer.span()`
+ *   returning a `Tracer.Span`, so `wrapTracer` intercepts `Span.attribute()` there instead.
+ * ⛔ NEVER RECORD HEADERS. A header NAME can itself be sensitive (`x-api-key`, a session cookie
+ *   name), so every `http.{request,response}.header.*` key is DROPPED, not value-redacted.
+ * ⚠️ QUERY STRINGS ARE STRIPPED WHOLE, not redacted per-parameter: an allowlist of "safe" params
+ *   would silently leak the next secret param a provider adds. `url.query` is dropped outright and
+ *   `url.full`/`url.path` never carry a `?…` past this point.
+ */
+import type * as Tracer from 'effect/Tracer';
+/** Host or path segments to blank wherever they appear in a URL attribute — exact-segment match. */
+export interface RedactionPolicy {
+    /**
+     * e.g. a UniFi console id embedded in a path (`/proxy/network/api/site/<id>/...`) or a private
+     * hostname a consumer never wants leaving its own process. Compared against the full hostname and
+     * against each `/`-separated path segment — never a substring match, so `"db"` cannot accidentally
+     * blank `"db1.example.test"`.
+     */
+    readonly denylist?: ReadonlyArray<string>;
+}
+export declare const REDACTED = "<redacted>";
+/** Returned by `redactAttribute` to mean "drop this attribute entirely — do not forward it". */
+export declare const DROP: unique symbol;
+/**
+ * Applies `policy` to one span attribute. Returns `DROP` when the key must never be recorded at
+ * all (every header); otherwise returns the value to record, with URLs stripped of their query
+ * string and hash and their denylisted host/path segments blanked. A value this function does not
+ * recognize (not a URL-shaped key, or not a string) passes through unchanged — alchemy's own
+ * engine attributes (`resource.fqn`, `plan.action`, …) are never URLs and are never touched.
+ */
+export declare const redactAttribute: (key: string, value: unknown, policy: RedactionPolicy) => unknown;
+/**
+ * Wraps a `Tracer.Tracer` so every span it creates redacts its attributes and event attributes
+ * through `redactAttribute`/`redactAttributes` before they reach the real span (and therefore
+ * before OTLP serialization ever sees them). Everything else — timing, status, links, the span's
+ * own identity — passes straight through to `inner`.
+ */
+export declare const wrapTracer: (inner: Tracer.Tracer, policy: RedactionPolicy) => Tracer.Tracer;
+//# sourceMappingURL=redact.d.ts.map

package/dist/telemetry/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/telemetry/redact.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,KAAK,MAAM,MAAM,eAAe,CAAC;AAE7C,oGAAoG;AACpG,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC3C;AAED,eAAO,MAAM,QAAQ,eAAe,CAAC;AAErC,gGAAgG;AAChG,eAAO,MAAM,IAAI,EAAE,OAAO,MAAiE,CAAC;AAU5F;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,QAAS,MAAM,SAAS,OAAO,UAAU,eAAe,KAAG,OAsCtF,CAAC;AAcF;;;;;GAKG;AACH,eAAO,MAAM,UAAU,UAAW,MAAM,CAAC,MAAM,UAAU,eAAe,KAAG,MAAM,CAAC,MAuChF,CAAC"}

package/dist/unifi/acl-rule-drift.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `Unifi.AclRule`'s `matches` AND `driftOf` (B6) — both built on the ONE field list below, the
+ * same `fieldDrift`-is-the-only-comparison shape `network-drift.ts`'s header explains (MEDIUM-4,
+ * red team, 2026-09-26): `matches(attrs, props) === (driftOf(live, props).length === 0)` is true
+ * BY CONSTRUCTION.
+ *
+ * ⚠️ `stripNullish: true` ON EVERY FIELD BY DEFAULT (`drift.ts`'s `defaultEqual`) — same "UniFi's
+ *   JSON answers `null`, a declaration omits" tolerance `network-drift.ts` documents.
+ * ⛔ `enforcingDeviceFilter`/`protocolFilter` RUN THROUGH `acl-rule-form.ts`'s normalizers on BOTH
+ *   sides before comparing — never applied to only `live` or only `declared` (that specific gap is
+ *   what MEDIUM-4's own mutant found in `network-drift.ts`; see its header).
+ */
+import type * as aclRules from '@distilled.cloud/unifi-network/access_control_acl_rules';
+import { type AclRuleAttributes, type AclRuleProps } from './acl-rule-form.ts';
+export declare const matches: (attributes: AclRuleAttributes, props: AclRuleProps) => boolean;
+/**
+ * Per-field live-vs-declared drift straight from one live read — the task's own API
+ * (`driftOf(live, props)`), so `homeflare-network`'s pre-import drift check never has to derive
+ * `attributesOf` itself just to call this.
+ */
+export declare const driftOf: (live: aclRules.ACLRule, props: AclRuleProps) => import("./drift.ts").FieldDrift[];
+//# sourceMappingURL=acl-rule-drift.d.ts.map

package/dist/unifi/acl-rule-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-rule-drift.d.ts","sourceRoot":"","sources":["../../src/unifi/acl-rule-drift.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yDAAyD,CAAC;AAEzF,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAIlB,MAAM,oBAAoB,CAAC;AA2B5B,eAAO,MAAM,OAAO,eAAgB,iBAAiB,SAAS,YAAY,KAAG,OACjC,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,OAAO,SAAU,QAAQ,CAAC,OAAO,SAAS,YAAY,sCACrB,CAAC"}