@shivaedev/platform 0.13.0 → 0.14.1

package/dist/server/redactOtlpUrl.js

@@ -0,0 +1,41 @@
+import { REDACTED } from "#rpc-server/sensitive.ts";
+function query(value) {
+    return value
+        .split("&")
+        .map((part) => (part === "" ? part : `${part.split("=", 1)[0]}=${REDACTED}`))
+        .join("&");
+}
+function url(value) {
+    const fragment = value.indexOf("#");
+    const target = fragment === -1 ? value : value.slice(0, fragment);
+    const separator = target.indexOf("?");
+    return ((separator === -1 ? target : `${target.slice(0, separator + 1)}${query(target.slice(separator + 1))}`).replaceAll(/(?<authority>(?:\b[a-z][a-z0-9+.-]*:)?\/\/)[^/?#]*@/giu, `$<authority>${REDACTED}@`) + (fragment === -1 ? "" : `#${REDACTED}`));
+}
+function structured(value) {
+    try {
+        return JSON.stringify(JSON.parse(value, (key, item) => (typeof item === "string" ? redactOtlpUrl(item, key) : item)));
+    }
+    catch {
+        return undefined;
+    }
+}
+export function redactOtlpUrl(value, key = "") {
+    if (/(?:^|[._-])(?:fragment|userinfo|username|password)$/iu.test(key)) {
+        return REDACTED;
+    }
+    if (/(?:^|[._-])query$/iu.test(key)) {
+        return url(`?${value}`).slice(1);
+    }
+    if (/(?:^|[._-])(?:url|uri|target)(?:$|[._-])/iu.test(key) || /(?:^|[._-])(?:referer|referrer|location|origin)$/iu.test(key)) {
+        return url(value);
+    }
+    if (/^\s*[[{]/u.test(value)) {
+        const redacted = structured(value);
+        if (redacted !== undefined) {
+            return redacted;
+        }
+    }
+    // Quotes and whitespace can belong to secret values, so free text has no safe closing delimiter.
+    return value.replaceAll(/(?:[a-z][a-z0-9+.-]*:\/\/|[/?#]).*/gisu, url);
+}
+//# sourceMappingURL=redactOtlpUrl.js.map

package/dist/server/redactOtlpUrl.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redactOtlpUrl.js","sourceRoot":"","sources":["../../src/server/redactOtlpUrl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEpD,SAAS,KAAK,CAAC,KAAa;IAC3B,OAAO,KAAK;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;SAC5E,IAAI,CAAC,GAAG,CAAC,CAAC;AACb,CAAC;AAED,SAAS,GAAG,CAAC,KAAa;IACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,CACN,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAChH,wDAAwD,EACxD,eAAe,QAAQ,GAAG,CAC1B,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC,CAC3C,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAChC,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAW,EAAE,IAAa,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxI,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,GAAG,GAAG,EAAE;IACpD,IAAI,uDAAuD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvE,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,4CAA4C,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,oDAAoD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9H,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC;QACjB,CAAC;IACF,CAAC;IACD,iGAAiG;IACjG,OAAO,KAAK,CAAC,UAAU,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;AACxE,CAAC"}

package/dist/server/safeOtlpSerialization.d.ts

@@ -1,4 +1,5 @@
 import { Layer } from "effect";
 import { OtlpSerialization } from "effect/observability";
-export declare const safeOtlpSerialization: Layer.Layer<OtlpSerialization.OtlpSerialization, never, never>;
+export declare function redactOtlpText(value: string, key?: string): string;
+export declare const safeOtlpSerialization: Layer.Layer<OtlpSerialization.OtlpSerialization, never, OtlpSerialization.OtlpSerialization>;
 //# sourceMappingURL=safeOtlpSerialization.d.ts.map

package/dist/server/safeOtlpSerialization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"safeOtlpSerialization.d.ts","sourceRoot":"","sources":["../../src/server/safeOtlpSerialization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAG/B,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAwBzD,eAAO,MAAM,qBAAqB,gEAsBhC,CAAC"}
+{"version":3,"file":"safeOtlpSerialization.d.ts","sourceRoot":"","sources":["../../src/server/safeOtlpSerialization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAOzD,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAK,UAErD;AA2BD,eAAO,MAAM,qBAAqB,8FAwBjC,CAAC"}

package/dist/server/safeOtlpSerialization.js

@@ -1,31 +1,40 @@
-import { Layer } from "effect";
-import { HttpBody } from "effect/http";
+import { Effect, Layer } from "effect";
 import { OtlpSerialization } from "effect/observability";
+import { redactOtlpUrl } from "#redactOtlpUrl.ts";
 import { isSensitiveKey, REDACTED, redactText } from "#rpc-server/sensitive.ts";
 function sensitive(key) {
     return isSensitiveKey(key) || ["db.user", "db.user.name", "db.connection_string"].includes(key.toLowerCase());
 }
-function text(value) {
-    return redactText(value, sensitive).replaceAll(/(?<scheme>\b[a-z][a-z0-9+.-]*:\/\/)[^/@\s]+@/giu, `$<scheme>${REDACTED}@`);
+export function redactOtlpText(value, key = "") {
+    return redactText(redactOtlpUrl(value, key), sensitive);
 }
-function attributeValue(value) {
+function attributeValue(value, key) {
     return {
         ...value,
-        ...(typeof value.stringValue === "string" ? { stringValue: text(value.stringValue) } : {}),
-        ...(value.arrayValue ? { arrayValue: { values: value.arrayValue.values.map(attributeValue) } } : {}),
+        ...(typeof value.stringValue === "string" ? { stringValue: redactOtlpText(value.stringValue, key) } : {}),
+        ...(value.arrayValue ? { arrayValue: { values: value.arrayValue.values.map((item) => attributeValue(item, key)) } } : {}),
         ...(value.kvlistValue ? { kvlistValue: { values: attributes(value.kvlistValue.values) } } : {}),
     };
 }
 function attributes(values) {
     return values.map(({ key, value }) => ({
         key,
-        value: sensitive(key) ? { stringValue: REDACTED } : attributeValue(value),
+        value: sensitive(key) ? { stringValue: REDACTED } : attributeValue(value, key),
     }));
 }
-export const safeOtlpSerialization = Layer.succeed(OtlpSerialization.OtlpSerialization, {
-    logs: HttpBody.jsonUnsafe,
-    metrics: HttpBody.jsonUnsafe,
-    traces: (data) => HttpBody.jsonUnsafe({
+function spanName(span) {
+    if (span.kind === 2) {
+        const method = span.attributes.find(({ key }) => key === "http.request.method")?.value.stringValue;
+        const route = span.attributes.find(({ key }) => key === "http.route")?.value.stringValue;
+        if (typeof method === "string") {
+            return typeof route === "string" ? `${method} ${route}` : method;
+        }
+    }
+    return span.name;
+}
+export const safeOtlpSerialization = Layer.effect(OtlpSerialization.OtlpSerialization, Effect.map(OtlpSerialization.OtlpSerialization, (serialization) => ({
+    ...serialization,
+    traces: (data) => serialization.traces({
         ...data,
         resourceSpans: data.resourceSpans.map((resource) => ({
             ...resource,
@@ -35,13 +44,13 @@ export const safeOtlpSerialization = Layer.succeed(OtlpSerialization.OtlpSeriali
                 spans: scope.spans.map((span) => ({
                     ...span,
                     attributes: attributes(span.attributes),
-                    events: span.events.map((event) => ({ ...event, attributes: attributes(event.attributes), name: text(event.name) })),
+                    events: span.events.map((event) => ({ ...event, attributes: attributes(event.attributes), name: redactOtlpText(event.name) })),
                     links: span.links.map((link) => ({ ...link, attributes: attributes(link.attributes) })),
-                    name: text(span.name),
-                    status: { ...span.status, ...(span.status.message === undefined ? {} : { message: text(span.status.message) }) },
+                    name: redactOtlpText(spanName(span)),
+                    status: { ...span.status, ...(span.status.message === undefined ? {} : { message: redactOtlpText(span.status.message) }) },
                 })),
             })),
         })),
     }),
-});
+})));
 //# sourceMappingURL=safeOtlpSerialization.js.map

package/dist/server/safeOtlpSerialization.js.map

@@ -1 +1 @@
-{"version":3,"file":"safeOtlpSerialization.js","sourceRoot":"","sources":["../../src/server/safeOtlpSerialization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAC/B,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAEvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEhF,SAAS,SAAS,CAAC,GAAW;IAC7B,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,sBAAsB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AAC/G,CAAC;AACD,SAAS,IAAI,CAAC,KAAa;IAC1B,OAAO,UAAU,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,UAAU,CAAC,iDAAiD,EAAE,YAAY,QAAQ,GAAG,CAAC,CAAC;AAC5H,CAAC;AACD,SAAS,cAAc,CAAC,KAA4B;IACnD,OAAO;QACN,GAAG,KAAK;QACR,GAAG,CAAC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1F,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC;AACH,CAAC;AACD,SAAS,UAAU,CAAC,MAA+B;IAClD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QACtC,GAAG;QACH,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,CAAC;KACzE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,iBAAiB,EAAE;IACvF,IAAI,EAAE,QAAQ,CAAC,UAAU;IACzB,OAAO,EAAE,QAAQ,CAAC,UAAU;IAC5B,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAChB,QAAQ,CAAC,UAAU,CAAC;QACnB,GAAG,IAAI;QACP,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACpD,GAAG,QAAQ;YACX,QAAQ,EAAE,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE;YACxF,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC/C,GAAG,KAAK;gBACR,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACjC,GAAG,IAAI;oBACP,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;oBACvC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBACpH,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;oBACvF,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC;oBACrB,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE;iBAChH,CAAC,CAAC;aACH,CAAC,CAAC;SACH,CAAC,CAAC;KACH,CAAC;CACH,CAAC,CAAC"}
+{"version":3,"file":"safeOtlpSerialization.js","sourceRoot":"","sources":["../../src/server/safeOtlpSerialization.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AAEhF,SAAS,SAAS,CAAC,GAAW;IAC7B,OAAO,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,EAAE,sBAAsB,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC;AAC/G,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,KAAa,EAAE,GAAG,GAAG,EAAE;IACrD,OAAO,UAAU,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,SAAS,CAAC,CAAC;AACzD,CAAC;AACD,SAAS,cAAc,CAAC,KAA4B,EAAE,GAAW;IAChE,OAAO;QACN,GAAG,KAAK;QACR,GAAG,CAAC,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,cAAc,CAAC,KAAK,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzG,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzH,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC/F,CAAC;AACH,CAAC;AACD,SAAS,UAAU,CAAC,MAA+B;IAClD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;QACtC,GAAG;QACH,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,GAAG,CAAC;KAC9E,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,IAAoG;IACrH,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,qBAAqB,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC;QACnG,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE,CAAC,GAAG,KAAK,YAAY,CAAC,EAAE,KAAK,CAAC,WAAW,CAAC;QACzF,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC;QAClE,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC;AAClB,CAAC;AAED,MAAM,CAAC,MAAM,qBAAqB,GAAG,KAAK,CAAC,MAAM,CAChD,iBAAiB,CAAC,iBAAiB,EACnC,MAAM,CAAC,GAAG,CAAC,iBAAiB,CAAC,iBAAiB,EAAE,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;IACnE,GAAG,aAAa;IAChB,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAChB,aAAa,CAAC,MAAM,CAAC;QACpB,GAAG,IAAI;QACP,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;YACpD,GAAG,QAAQ;YACX,QAAQ,EAAE,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE;YACxF,UAAU,EAAE,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC/C,GAAG,KAAK;gBACR,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;oBACjC,GAAG,IAAI;oBACP,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC;oBACvC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,UAAU,EAAE,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;oBAC9H,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;oBACvF,IAAI,EAAE,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBACpC,MAAM,EAAE,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE;iBAC1H,CAAC,CAAC;aACH,CAAC,CAAC;SACH,CAAC,CAAC;KACH,CAAC;CACH,CAAC,CAAC,CACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shivaedev/platform",
-  "version": "0.13.0",
+  "version": "0.14.1",
   "description": "Opinionated Effect application infrastructure for ShivaeDev services",
   "homepage": "https://github.com/ShivaeDev/platform/tree/main/packages/platform#readme",
   "bugs": {
@@ -186,10 +186,20 @@
       "types": "./dist/server/hostOptions.d.ts",
       "default": "./dist/server/hostOptions.js"
     },
+    "#otlpHttpClient.ts": {
+      "source": "./src/server/otlpHttpClient.ts",
+      "types": "./dist/server/otlpHttpClient.d.ts",
+      "default": "./dist/server/otlpHttpClient.js"
+    },
     "#safeOtlpSerialization.ts": {
       "source": "./src/server/safeOtlpSerialization.ts",
       "types": "./dist/server/safeOtlpSerialization.d.ts",
       "default": "./dist/server/safeOtlpSerialization.js"
+    },
+    "#redactOtlpUrl.ts": {
+      "source": "./src/server/redactOtlpUrl.ts",
+      "types": "./dist/server/redactOtlpUrl.d.ts",
+      "default": "./dist/server/redactOtlpUrl.js"
     }
   },
   "exports": {
@@ -362,8 +372,8 @@
     "README.md"
   ],
   "dependencies": {
-    "@shivaedev/effect-contract": "0.5.0",
-    "@shivaedev/effect-sql": "0.4.0",
+    "@shivaedev/effect-contract": "0.5.1",
+    "@shivaedev/effect-sql": "0.5.0",
     "@shivaedev/types": "0.2.1"
   },
   "devDependencies": {
@@ -376,8 +386,8 @@
     "@prisma-next/sql-contract": "0.16.0",
     "@prisma-next/sql-orm-client": "0.16.0",
     "@prisma-next/target-postgres": "0.16.0",
-    "@shivaedev/effect-prisma": "0.9.0",
-    "@shivaedev/effect-trpc": "0.7.0",
+    "@shivaedev/effect-prisma": "0.9.1",
+    "@shivaedev/effect-trpc": "0.7.1",
     "@shivaedev/quality": "0.22.0",
     "@trpc/client": "11.19.0",
     "@trpc/server": "11.19.0",
@@ -394,8 +404,8 @@
     "@effect/sql-pg": "4.0.4",
     "@effect/vitest": "4.0.4",
     "@prisma-next/sql-orm-client": "0.16.0",
-    "@shivaedev/effect-prisma": "0.9.0",
-    "@shivaedev/effect-trpc": "0.7.0",
+    "@shivaedev/effect-prisma": "0.9.1",
+    "@shivaedev/effect-trpc": "0.7.1",
     "@trpc/server": "11.19.0",
     "better-auth": "1.7.7",
     "effect": "4.0.4"

package/src/server/appHost.ts

@@ -1,23 +1,18 @@
-import { Context, type Duration, type Effect, type Redacted } from "effect";
+import { Context, type Duration, type Effect } from "effect";
 import type { Rpc } from "effect/rpc";
 import type { Migrator } from "effect/sql";
 import type { makeLiveServer } from "@shivaedev/effect-contract/makeLiveServer.ts";
-import type { PostgresChangesOptions } from "@shivaedev/effect-sql/postgresChanges.ts";
 import type { SessionPolicy, SessionShape } from "#rpc-server/session.ts";
-import { appHostHttp, migratedHost } from "./appHostHttp.ts";
-import { databaseLayer } from "./databaseLayer.ts";
-import type { HostOptions, HostPolicy } from "./hostOptions.ts";
+import { appHostHttp, deferredHost, migratedHost } from "#server/appHostHttp.ts";
+import { type DatabaseConfig, databaseLayer } from "#server/databaseLayer.ts";
+import type { HostOptions, HostPolicy } from "#server/hostOptions.ts";
 
 export class AppChanges extends Context.Service<AppChanges, Effect.Success<typeof makeLiveServer>>()("@shivaedev/platform/AppChanges") {}
 export interface AppDatabaseOptions<R = never> {
-	readonly config?: {
-		readonly databaseUrl?: Redacted.Redacted<string>;
-		readonly applicationName?: string;
-		readonly maxConnections?: number;
-		readonly changes?: Omit<PostgresChangesOptions, "client" | "resync">;
-	};
+	readonly config?: DatabaseConfig;
 	readonly migrations: {
 		readonly loader: Migrator.Loader<R>;
+		readonly mode?: "migrate" | "check";
 		readonly table?: string;
 		readonly lockTimeout?: Duration.Input;
 	};
@@ -80,30 +75,35 @@ export function appHost<
 	TServiceRequirements = never,
 	TMigrations = never,
 	TSession extends SessionShape = SessionShape,
+	TApplicationError = never,
+	TApplicationRequirements = never,
 >(
 	options:
+		| (AppDatabaseOptions<TMigrations> & {
+				readonly application: Effect.Effect<
+					AppHttpHostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TSession>,
+					TApplicationError,
+					TApplicationRequirements
+				>;
+		  })
 		| AppHostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TMigrations, TSession>
 		| AppLocalHostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TMigrations>,
 ): ReturnType<
-	typeof migratedHost<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TMigrations, TSession>
->;
-export function appHost<
-	TRpcs extends Rpc.Any,
-	THandlers,
-	THandlerError,
-	THandlerRequirements,
-	TServices = never,
-	TServiceError = never,
-	TServiceRequirements = never,
->(
-	options: HostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements> & {
-		readonly policy: "loopback";
-		readonly sessions?: never;
-		readonly migrations?: undefined;
-	},
-): ReturnType<
-	typeof appHostHttp<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, SessionShape>
+	typeof deferredHost<
+		TRpcs,
+		THandlers,
+		THandlerError,
+		THandlerRequirements,
+		TServices,
+		TServiceError,
+		TServiceRequirements,
+		TMigrations,
+		TSession,
+		TApplicationError,
+		TApplicationRequirements
+	>
 >;
+
 export function appHost<
 	TRpcs extends Rpc.Any,
 	THandlers,
@@ -126,12 +126,24 @@ export function appHost<
 	TServiceRequirements = never,
 	TMigrations = never,
 	TSession extends SessionShape = SessionShape,
+	TApplicationError = never,
+	TApplicationRequirements = never,
 >(
 	options:
+		| (AppDatabaseOptions<TMigrations> & {
+				readonly application: Effect.Effect<
+					AppHttpHostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TSession>,
+					TApplicationError,
+					TApplicationRequirements
+				>;
+		  })
 		| AppHostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TMigrations, TSession>
 		| AppLocalHostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TMigrations>
 		| AppHttpHostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TSession>,
 ) {
+	if ("application" in options) {
+		return deferredHost(options.application, appDatabase(options));
+	}
 	return options.migrations === undefined
 		? appHostHttp(options)
 		: migratedHost({ ...options, migrations: options.migrations }, appDatabase({ ...options, migrations: options.migrations }));

package/src/server/appHostHttp.ts

@@ -3,7 +3,7 @@ import { NodeHttpServer, NodeServices } from "@effect/platform-node";
 import { ByteSize, Config, Effect, Layer, Option, Schema } from "effect";
 import { HttpIncomingMessage, HttpRouter, HttpServerRequest, HttpStaticServer } from "effect/http";
 import { type Rpc, RpcSerialization, RpcServer } from "effect/rpc";
-import type { AppHostOptions, AppLocalHostOptions } from "#appHost.ts";
+import type { AppHostOptions, AppHttpHostOptions, AppLocalHostOptions } from "#appHost.ts";
 import { boundedRpcRequest } from "#boundedRpcRequest.ts";
 import type { databaseLayer } from "#databaseLayer.ts";
 import type { HostOptions, HostPolicy } from "#hostOptions.ts";
@@ -13,6 +13,7 @@ import { localRpcGuard } from "#rpc-server/local.ts";
 import { authenticatedLayer, maybeAuthenticatedLayer, type SessionShape } from "#rpc-server/session.ts";
 import { requestTracingLayer } from "#rpc-server/tracing.ts";
 import { TrustedProxy } from "#rpc-server/trustedProxy.ts";
+import { healthRoute } from "#server/healthRoute.ts";
 export function appHostHttp<
 	TRpcs extends Rpc.Any,
 	THandlers,
@@ -74,7 +75,7 @@ export function appHostHttp<
 					});
 				}),
 			);
-			return HttpRouter.serve(Layer.mergeAll(routes, assets, options.routes ?? Layer.empty), { disableLogger: true }).pipe(
+			return HttpRouter.serve(Layer.mergeAll(routes, healthRoute, assets, options.routes ?? Layer.empty), { disableLogger: true }).pipe(
 				Layer.provideMerge(application),
 				Layer.provideMerge(server),
 				Layer.provide(NodeServices.layer),
@@ -102,3 +103,26 @@ export function migratedHost<
 	const services = Layer.mergeAll(options.services ?? Layer.empty);
 	return appHostHttp({ ...options, services: services.pipe(Layer.provideMerge(database)) });
 }
+
+export function deferredHost<
+	TRpcs extends Rpc.Any,
+	THandlers,
+	THandlerError,
+	THandlerRequirements,
+	TServices,
+	TServiceError,
+	TServiceRequirements,
+	TMigrations,
+	TSession extends SessionShape,
+	TApplicationError,
+	TApplicationRequirements,
+>(
+	application: Effect.Effect<
+		AppHttpHostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements, TSession>,
+		TApplicationError,
+		TApplicationRequirements
+	>,
+	database: ReturnType<typeof databaseLayer<TMigrations>>,
+) {
+	return Layer.unwrap(Effect.map(application, (options) => appHostHttp(options))).pipe(Layer.provideMerge(database));
+}

package/src/server/databaseLayer.ts

@@ -1,10 +1,18 @@
 import * as PgClient from "@effect/sql-pg/PgClient";
-import { Config, Effect, Layer } from "effect";
+import { Config, Effect, Layer, type Redacted } from "effect";
 import * as Reactivity from "effect/reactivity/Reactivity";
 import { makeLiveServer } from "@shivaedev/effect-contract/makeLiveServer.ts";
+import { assertPostgresMigrations } from "@shivaedev/effect-sql/assertPostgresMigrations.ts";
 import { migratePostgres } from "@shivaedev/effect-sql/migrations.ts";
-import { postgresChanges } from "@shivaedev/effect-sql/postgresChanges.ts";
-import type { AppChanges, AppDatabaseOptions } from "./appHost.ts";
+import { type PostgresChangesOptions, postgresChanges } from "@shivaedev/effect-sql/postgresChanges.ts";
+import type { AppChanges, AppDatabaseOptions } from "#server/appHost.ts";
+
+export interface DatabaseConfig {
+	readonly applicationName?: string;
+	readonly changes?: Omit<PostgresChangesOptions, "client" | "resync">;
+	readonly databaseUrl?: Redacted.Redacted<string>;
+	readonly maxConnections?: number;
+}
 
 export function databaseLayer<R>(options: AppDatabaseOptions<R>, changesService: typeof AppChanges) {
 	const pool = Layer.unwrap(
@@ -17,11 +25,13 @@ export function databaseLayer<R>(options: AppDatabaseOptions<R>, changesService:
 			});
 		}),
 	);
-	const migrated = Layer.effectDiscard(migratePostgres({ ...options.migrations, lockTimeout: options.migrations.lockTimeout ?? "5 seconds" })).pipe(
-		Layer.provideMerge(pool),
-	);
+	const prepared = Layer.effectDiscard(
+		options.migrations.mode === "check"
+			? assertPostgresMigrations(options.migrations)
+			: migratePostgres({ ...options.migrations, lockTimeout: options.migrations.lockTimeout ?? "5 seconds" }),
+	).pipe(Layer.provideMerge(pool));
 	const live = Layer.effect(changesService, makeLiveServer).pipe(Layer.provideMerge(Reactivity.layer));
-	const base = Layer.merge(migrated, live);
+	const base = Layer.merge(prepared, live);
 	const changes = options.config?.changes;
 	if (changes === undefined) {
 		return base;

package/src/server/healthRoute.ts

@@ -0,0 +1,27 @@
+import { Effect, Fiber, Option } from "effect";
+import { HttpRouter, HttpServerResponse } from "effect/http";
+import { SqlClient } from "effect/sql";
+
+export const healthRoute = HttpRouter.use((router) =>
+	Effect.gen(function* () {
+		const database = yield* Effect.serviceOption(SqlClient.SqlClient);
+		const scope = yield* Effect.scope;
+		const probe = Effect.gen(function* () {
+			if (Option.isNone(database)) {
+				return 503;
+			}
+			const query = yield* database.value`select 1`.pipe(Effect.forkIn(scope));
+			return yield* Fiber.join(query).pipe(
+				Effect.timeout("2 seconds"),
+				// Driver cancellation may need network I/O; keep cleanup in the host scope without delaying the response.
+				Effect.ensuring(Fiber.interrupt(query).pipe(Effect.forkIn(scope), Effect.asVoid)),
+				Effect.match({ onFailure: () => 503, onSuccess: () => 200 }),
+			);
+		});
+		yield* router.add(
+			"GET",
+			"/health",
+			Effect.map(probe, (status) => HttpServerResponse.empty({ headers: { "cache-control": "no-store" }, status })),
+		);
+	}),
+);

package/src/server/otlpHttpClient.ts

@@ -0,0 +1,35 @@
+import { Effect, Layer } from "effect";
+import { FetchHttpClient, HttpClient } from "effect/http";
+import { redactOtlpText } from "#safeOtlpSerialization.ts";
+
+export const otlpHttpClient = Layer.effect(
+	HttpClient.HttpClient,
+	Effect.gen(function* () {
+		const client = yield* HttpClient.HttpClient;
+		let warned = false;
+		function warnOnce(diagnostic: Effect.Effect<Record<string, unknown>>) {
+			return Effect.suspend(() => {
+				if (warned) {
+					return Effect.void;
+				}
+				warned = true;
+				return Effect.flatMap(diagnostic, (annotations) => Effect.logWarning("OTLP trace export failed").pipe(Effect.annotateLogs(annotations)));
+			});
+		}
+		return client.pipe(
+			HttpClient.tap((response) => {
+				if (response.status >= 200 && response.status < 300) {
+					warned = false;
+					return Effect.void;
+				}
+				return warnOnce(
+					response.text.pipe(
+						Effect.orElseSucceed(() => "Unable to read collector response"),
+						Effect.map((body) => ({ "otlp.response": redactOtlpText(body), "otlp.status": response.status })),
+					),
+				);
+			}),
+			HttpClient.tapError((error) => warnOnce(Effect.succeed({ "otlp.failure": error.reason._tag }))),
+		);
+	}),
+).pipe(Layer.provide(FetchHttpClient.layer));

package/src/server/otlpTracing.ts

@@ -1,6 +1,6 @@
 import { Config, Effect, Layer, Schema } from "effect";
-import { FetchHttpClient } from "effect/http";
-import { OtlpTracer } from "effect/observability";
+import { OtlpSerialization, OtlpTracer } from "effect/observability";
+import { otlpHttpClient } from "#otlpHttpClient.ts";
 import { safeOtlpSerialization } from "#safeOtlpSerialization.ts";
 
 export const otlpTracing: Layer.Layer<never, Config.ConfigError> = Layer.unwrap(
@@ -19,16 +19,26 @@ export const otlpTracing: Layer.Layer<never, Config.ConfigError> = Layer.unwrap(
 		if (endpoint === undefined) {
 			return Layer.empty;
 		}
+		const configuredProtocol = yield* Config.String("OTEL_EXPORTER_OTLP_TRACES_PROTOCOL").pipe(
+			Config.orElse(() => Config.String("OTEL_EXPORTER_OTLP_PROTOCOL")),
+			Config.withDefault("http/protobuf"),
+		);
+		const protocol = yield* Schema.decodeUnknownEffect(Schema.Literals(["http/protobuf", "http/json"]), { reportInput: true })(
+			configuredProtocol,
+		).pipe(Effect.mapError((cause) => new Config.ConfigError(cause)));
 		const attributes: Record<string, string> = yield* Config.Record(
 			Schema.StringFromUriComponent,
 			Schema.StringFromUriComponent,
 			"OTEL_RESOURCE_ATTRIBUTES",
 		).pipe(Config.withDefault({}));
 		const serviceName = yield* Config.String("OTEL_SERVICE_NAME").pipe(Config.withDefault(attributes["service.name"] ?? "unknown_service"));
+		const serviceVersion = yield* Config.String("OTEL_SERVICE_VERSION").pipe(Config.withDefault(undefined));
 		const headers = yield* Config.Record(Schema.String, Schema.StringFromUriComponent, "OTEL_EXPORTER_OTLP_HEADERS").pipe(Config.withDefault({}));
-		return OtlpTracer.layer({ headers, resource: { attributes, serviceName }, url: endpoint.toString() }).pipe(
-			Layer.provide(safeOtlpSerialization),
-			Layer.provide(FetchHttpClient.layer),
+		return OtlpTracer.layer({ headers, resource: { attributes, serviceName, serviceVersion }, url: endpoint.toString() }).pipe(
+			Layer.provide(
+				safeOtlpSerialization.pipe(Layer.provide(protocol === "http/protobuf" ? OtlpSerialization.layerProtobuf : OtlpSerialization.layerJson)),
+			),
+			Layer.provide(otlpHttpClient),
 		);
 	}),
 );

package/src/server/redactOtlpUrl.ts

@@ -0,0 +1,48 @@
+import { REDACTED } from "#rpc-server/sensitive.ts";
+
+function query(value: string): string {
+	return value
+		.split("&")
+		.map((part) => (part === "" ? part : `${part.split("=", 1)[0]}=${REDACTED}`))
+		.join("&");
+}
+
+function url(value: string): string {
+	const fragment = value.indexOf("#");
+	const target = fragment === -1 ? value : value.slice(0, fragment);
+	const separator = target.indexOf("?");
+	return (
+		(separator === -1 ? target : `${target.slice(0, separator + 1)}${query(target.slice(separator + 1))}`).replaceAll(
+			/(?<authority>(?:\b[a-z][a-z0-9+.-]*:)?\/\/)[^/?#]*@/giu,
+			`$<authority>${REDACTED}@`,
+		) + (fragment === -1 ? "" : `#${REDACTED}`)
+	);
+}
+
+function structured(value: string): string | undefined {
+	try {
+		return JSON.stringify(JSON.parse(value, (key: string, item: unknown) => (typeof item === "string" ? redactOtlpUrl(item, key) : item)));
+	} catch {
+		return undefined;
+	}
+}
+
+export function redactOtlpUrl(value: string, key = ""): string {
+	if (/(?:^|[._-])(?:fragment|userinfo|username|password)$/iu.test(key)) {
+		return REDACTED;
+	}
+	if (/(?:^|[._-])query$/iu.test(key)) {
+		return url(`?${value}`).slice(1);
+	}
+	if (/(?:^|[._-])(?:url|uri|target)(?:$|[._-])/iu.test(key) || /(?:^|[._-])(?:referer|referrer|location|origin)$/iu.test(key)) {
+		return url(value);
+	}
+	if (/^\s*[[{]/u.test(value)) {
+		const redacted = structured(value);
+		if (redacted !== undefined) {
+			return redacted;
+		}
+	}
+	// Quotes and whitespace can belong to secret values, so free text has no safe closing delimiter.
+	return value.replaceAll(/(?:[a-z][a-z0-9+.-]*:\/\/|[/?#]).*/gisu, url);
+}