@shivaedev/platform 0.14.1 → 0.14.3

package/CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 0.14.3 - 2026-10-18
+
+### Fixed
+
+- Bound OTLP HTTP export attempts to 10 seconds by default, honor standard general and traces-specific timeout variables, and read the batch interval, size and shutdown timeout through Effect Config.
+- Redact bare `sig` assignments, including short errors such as `error: sig=...`, and PEM private-key blocks from exported trace values in both JSON and protobuf.
+- SQL spans from `appDatabase` and `appHost` report the host and port from `DATABASE_URL`, including address query parameters, while keeping the connection URL redacted.
+
+## 0.14.2 - 2026-10-17
+
+### Fixed
+
+- Align published framework dependencies with the current releases.
+
 ## 0.14.1 - 2026-10-17
 
 ### Added

package/README.md

@@ -86,11 +86,11 @@ RPC uses the existing `localRpcGuard`: it requires a loopback peer and Host, sam
 
 For local tools, use `policy: "loopback"` with contracts that do not use session middleware to serve RPC without a session provider. The guard requires a loopback peer and Host, absent or same-origin Origin, and NDJSON content type. This policy does not use `TRUSTED_PROXY` or `config.trustedProxy`. Set `rpcPath` to choose another native RPC route; `/rpc` remains the default.
 
-Omit `migrations` to host an app without a database. This form creates no SQL pool and reads no `DATABASE_URL`; `AppHttpHostOptions` describes it. `AppHostOptions` retains its required migrations for existing typed callers. A service that needs SQL still requires a SQL Layer. Provide `appDatabase` to the application’s service Layer when it owns database composition, as Fleet's daemon does with its migration loader and namespace ledger. Real HTTP tests cover the custom route, session-free loopback guard and database-free startup; Fleet's PostgreSQL daemon tests cover the adopted composition.
+Omit `migrations` to host an app without a database. This form creates no SQL pool and reads no `DATABASE_URL`; `AppHttpHostOptions` describes it. `AppHostOptions` requires migrations for database-backed hosts. A service that needs SQL still requires a SQL Layer. Provide `appDatabase` to the application’s service Layer when it owns database composition, as Fleet's daemon does with its migration loader and namespace ledger. Real HTTP tests cover the custom route, session-free loopback guard and database-free startup; Fleet's PostgreSQL daemon tests cover the adopted composition.
 
 `appHost` serves unauthenticated `GET /health`. It queries its SQL client on each request and returns `200` only when the query succeeds within two seconds; a missing SQL client, query failure or timeout returns `503`. Both responses have an empty body and `Cache-Control: no-store`. This route also works when the SQL client comes from the application’s `services` Layer. Use it for database readiness checks.
 
-Set `migrations.mode: "check"` on `appDatabase` or a database-backed `appHost` when a separate pre-deploy command owns migrations. Startup reads the ledger and fails with native `MigrationError` (`kind: "BadState"`) if any required migration ID or name is missing; it does not run migrations or create a ledger. Later ledger entries are allowed for rolling deployments. With `mode` omitted or `"migrate"`, the existing migration behavior remains: startup applies pending migrations with a five-second lock timeout unless `migrations.lockTimeout` overrides it.
+Set `migrations.mode: "check"` on `appDatabase` or a database-backed `appHost` when a separate pre-deploy command owns migrations. Startup reads the ledger and fails with native `MigrationError` (`kind: "BadState"`) if any required migration ID or name is missing; it does not run migrations or create a ledger. Later ledger entries are allowed for rolling deployments. With `mode` omitted or `"migrate"`, startup applies pending migrations with a five-second lock timeout unless `migrations.lockTimeout` overrides it.
 
 When construction itself touches the schema, use `appHost({ migrations, config, application })`. `application` is a native Effect that returns the HTTP host options (`group`, handler and service Layers, session policy, and optional HTTP config). The host first builds `appDatabase`, then evaluates this Effect in the host scope with SQL, Reactivity and `AppChanges` available. A failed migration or schema-current check prevents construction. Initialization requirements and errors stay in the returned Layer's types, and acquired resources close with the host scope.
 
@@ -109,11 +109,31 @@ Construct Better Auth inside `application`, since its constructor starts schema
 
 Set `OTEL_EXPORTER_OTLP_ENDPOINT` (the collector base URL; `/v1/traces` is appended) or `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT` (the complete traces URL, which takes precedence) to export `appHost`'s Effect spans over OTLP/HTTP. `OTEL_EXPORTER_OTLP_PROTOCOL` selects `http/protobuf` or `http/json`; `OTEL_EXPORTER_OTLP_TRACES_PROTOCOL` takes precedence for traces. When neither protocol variable is set, the default is `http/protobuf`, following the [OpenTelemetry recommendation](https://opentelemetry.io/docs/specs/otel/protocol/exporter/#specify-protocol). Unsupported protocols, including `grpc`, fail startup with a `ConfigError` naming the value. `OTEL_EXPORTER_OTLP_HEADERS` supplies comma-separated `key=value` exporter headers with URL-encoded values. `OTEL_SERVICE_NAME` sets the service name and `OTEL_SERVICE_VERSION` sets `service.version`; `OTEL_RESOURCE_ATTRIBUTES` adds comma-separated, URL-encoded resource attributes and can supply `service.name` when no service name is set. The fallback name is `unknown_service`. Configuration is read through Effect Config. Without an endpoint, no exporter or export loop is built, even when service metadata is set.
 
-On Railway, enable the per-service tracing setting separately for the web service and worker, and leave both exporter endpoint variables unset in your app's configuration. Railway injects the `OTEL_*` variables, including `OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf`, only when the app sets no endpoint of its own. The framework exports through Effect's own `effect/observability` OTLP tracer; eBPF auto-instrumentation is outside this path. For a worker, provide `otlpTracing` from `@shivaedev/platform/otlpTracing.ts` to its application Layer. It batches ended Effect spans and flushes during scoped shutdown with a three-second bound. The first failed export logs a warning with the collector status and redacted response body, or the transport failure kind when no response arrives. Repeated failures stay quiet until a successful export. Collector connection failures and HTTP errors leave requests, jobs and shutdown successful. HTTP receiver tests cover the host and the starter's PostgreSQL word-count worker; they do not establish delivery in a deployed collector.
+The supported tracing variables and defaults are:
+
+| Variable | Default | Meaning |
+| --- | --- | --- |
+| `OTEL_EXPORTER_OTLP_ENDPOINT` | Unset | Collector base URL. |
+| `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT` | Base URL plus `/v1/traces` | Complete traces URL; takes precedence. |
+| `OTEL_EXPORTER_OTLP_PROTOCOL` | `http/protobuf` | `http/protobuf` or `http/json`. |
+| `OTEL_EXPORTER_OTLP_TRACES_PROTOCOL` | General protocol | Overrides the protocol for traces. |
+| `OTEL_EXPORTER_OTLP_HEADERS` | Empty | Comma-separated exporter headers. |
+| `OTEL_SERVICE_NAME` | Resource `service.name`, then `unknown_service` | Service name. |
+| `OTEL_SERVICE_VERSION` | Resource `service.version`, otherwise unset | Service version. |
+| `OTEL_RESOURCE_ATTRIBUTES` | Empty | Comma-separated resource attributes. |
+| `OTEL_EXPORTER_OTLP_TIMEOUT` | `10000` ms | Timeout for each HTTP export attempt, including its response body. |
+| `OTEL_EXPORTER_OTLP_TRACES_TIMEOUT` | General timeout | Overrides the request timeout for traces. |
+| `OTEL_BSP_SCHEDULE_DELAY` | `5000` ms | Effect tracer's batch export interval. |
+| `OTEL_BSP_MAX_EXPORT_BATCH_SIZE` | `1000` spans | Effect tracer's batch-size trigger. |
+| `OTEL_BSP_EXPORT_TIMEOUT` | `3000` ms | Effect tracer's shutdown flush bound, capped at the request timeout. |
+
+Timeouts fail through the HTTP client's typed transport-error channel and use the same warning path as other transport failures. Effect retains its native retry policy; the request timeout applies to each attempt. The batch defaults follow Effect's `OtlpTracer.layer`. Its options cannot express a separate batch-operation deadline or a queue capacity, so `OTEL_BSP_EXPORT_TIMEOUT` controls shutdown only and `OTEL_BSP_MAX_QUEUE_SIZE` is unsupported. Other `OTEL_BSP_*` variables are unsupported.
+
+On Railway, enable the per-service tracing setting separately for the web service and worker, and leave both exporter endpoint variables unset in your app's configuration. Railway injects the `OTEL_*` variables, including `OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf`, only when the app sets no endpoint of its own. The framework exports through Effect's own `effect/observability` OTLP tracer; eBPF auto-instrumentation is outside this path. For a worker, provide `otlpTracing` from `@shivaedev/platform/otlpTracing.ts` to its application Layer. It batches ended Effect spans and flushes during scoped shutdown with a three-second bound by default. The first failed export logs a warning with the collector status and redacted response body, or the transport failure kind when no response arrives. Repeated failures stay quiet until a successful export. Collector connection failures and HTTP errors leave requests, jobs and shutdown successful. HTTP receiver tests cover the host and the starter's PostgreSQL word-count worker; they do not establish delivery in a deployed collector.
 
 Exported HTTP server spans use `{method} {route}` with `http.route` for matched RPC and router paths, including parameter templates; unmatched requests use the method alone. The production host continues incoming W3C `traceparent` context, including one sent by an edge proxy.
 
-Both JSON and protobuf export serialization apply the existing sensitive-key and credential-text redaction to span attributes, events, links, error details and resource attributes. Exporter headers stay in the collector request, outside the spans. Applications must still avoid placing secrets in span names, free text or custom attributes; a comprehensive application redaction policy and request/action correlation remain open.
+Both JSON and protobuf export serialization apply sensitive-key and credential-text redaction to span attributes, events, links, error details and resource attributes. Credential text includes JWTs, Bearer/Basic credentials, sensitive assignments including bare `sig=...` anywhere in text (with or without `?`), and complete PEM private-key blocks through their matching END marker, including RSA, EC, OPENSSH and encrypted private keys. Matches become `<redacted>`. `sig` uses the shared sensitive-key policy for attributes and text. URL query values, fragments and user information are also redacted. Exporter headers stay in the collector request, outside the spans. Applications must still avoid placing secrets in span names, free text or custom attributes.
 
 Set `config.maxConnections` on `appDatabase` or a migrated `appHost` to bound the pool. A daemon with long-lived RPC streams can use `config.disablePreemptiveShutdown: true` to let scope closure interrupt those streams before closing the listener; omitting it keeps Node's native graceful-shutdown default. Fleet's daemon tests cover one bounded pool and scoped provider and listener cleanup, including follower reconnection after shutdown.
 
@@ -337,9 +357,7 @@ await runtime.dispose();
 
 `base` is `"application"` and `request` is `"request"`. The application's resource Layer is acquired once across calls. An explicit `developmentCacheKey` shares a runtime between calls with that key during development. Each key belongs to one application runtime definition.
 
-A nested `runWithServices` call replaces the outer invocation's overrides for
-its callback. Merge the contexts explicitly when the nested call must retain
-those overrides.
+A nested `runWithServices` call replaces the outer invocation's overrides for its callback. Merge the contexts explicitly when the nested call must retain those overrides.
 
 ### Node subscriptions: combine cancellation and clean up
 
@@ -442,6 +460,7 @@ Import the module that defines the name; there is no package-root entry. Paths b
 | Module | Names and purpose |
 | --- | --- |
 | `otlpTracing.ts` | `otlpTracing`: scoped, opt-in Effect OTLP trace export configured through standard exporter variables; provide it to worker Layers. |
+| `boundedBody.ts` | `readBoundedBody`, `RequestBodyTooLarge`: bounded body bytes and a typed HTTP 413 failure. |
 | `appHost.ts` | `appHost({ group, handlers, services, migrations?, sessions?, policy?, rpcPath?, assets?, routes?, config? })` or `appHost({ application, migrations, config? })`, `appDatabase({ migrations, config? })`, `AppChanges`, `AppHostOptions`, `AppHttpHostOptions`, `AppLocalHostOptions`, `AppDatabaseOptions`: scoped HTTP and PostgreSQL composition with loopback defaults and optional proxy trust. |
 | `errors/taxonomy.ts` | `NotFound`, `Unauthorized`, `Forbidden`, `BadRequest`, `Conflict`, `PreconditionFailed`, `TooManyRequests`, `AuthUnavailable`, `InternalServerError`, `ServiceUnavailable`: Schema tagged error classes with a `message`; `BadRequest` and `Conflict` also accept an optional `field`. |
 | `errors/rejected-field.ts` | `rejectedField(unknown): Option<RejectedField>`; `RejectedField` is `{ field: string, message: string }`. |
@@ -480,6 +499,7 @@ Install the optional peers for the selected integration:
 
 | Integration | Additional peers |
 | --- | --- |
+| `boundedBody.ts` | `@effect/platform-node` |
 | `appHost.ts` | `@effect/platform-node`, `@effect/sql-pg` |
 | `better-auth/adapter.ts` | `better-auth`, `@shivaedev/effect-prisma`, `@prisma-next/sql-orm-client` |
 | `testing/vitest.ts` | `@effect/vitest`, `@shivaedev/effect-prisma`, `@shivaedev/effect-trpc`, `@trpc/server` |

package/dist/server/databaseAddress.d.ts

@@ -0,0 +1,4 @@
+import type { PgPoolConfig } from "@effect/sql-pg/PgClient";
+import { Redacted } from "effect";
+export declare function databaseAddress(value: Redacted.Redacted<string>): Pick<PgPoolConfig, "host" | "port">;
+//# sourceMappingURL=databaseAddress.d.ts.map

package/dist/server/databaseAddress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"databaseAddress.d.ts","sourceRoot":"","sources":["../../src/server/databaseAddress.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAElC,wBAAgB,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,CAqBrG"}

package/dist/server/databaseAddress.js

@@ -0,0 +1,25 @@
+import { Redacted } from "effect";
+export function databaseAddress(value) {
+    try {
+        const url = new URL(Redacted.value(value));
+        if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") {
+            return {};
+        }
+        const hostname = url.hostname.startsWith("[") ? url.hostname.slice(1, -1) : decodeURIComponent(url.hostname);
+        // PgConnection applies query parameters in order, after the authority.
+        const host = url.searchParams.getAll("host").at(-1) ?? hostname;
+        const rawPort = url.searchParams.getAll("port").at(-1) ?? url.port;
+        const port = rawPort === "" ? undefined : Number(rawPort);
+        if (host.includes(",") || (port !== undefined && (!Number.isInteger(port) || port < 1 || port > 65_535))) {
+            return {};
+        }
+        return {
+            ...(host === "" && !url.searchParams.has("host") ? {} : { host }),
+            ...(port === undefined ? {} : { port }),
+        };
+    }
+    catch {
+        return {};
+    }
+}
+//# sourceMappingURL=databaseAddress.js.map

package/dist/server/databaseAddress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"databaseAddress.js","sourceRoot":"","sources":["../../src/server/databaseAddress.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAElC,MAAM,UAAU,eAAe,CAAC,KAAgC;IAC/D,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YACpE,OAAO,EAAE,CAAC;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7G,uEAAuE;QACvE,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;QAChE,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC;QACnE,MAAM,IAAI,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC;YAC1G,OAAO,EAAE,CAAC;QACX,CAAC;QACD,OAAO;YACN,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACjE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;SACvC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;AACF,CAAC"}

package/dist/server/databaseLayer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"databaseLayer.d.ts","sourceRoot":"","sources":["../../src/server/databaseLayer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAU,KAAK,EAAE,KAAK,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,KAAK,UAAU,MAAM,8BAA8B,CAAC;AAI3D,OAAO,EAAE,KAAK,sBAAsB,EAAmB,MAAM,0CAA0C,CAAC;AACxG,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,sBAAsB,EAAE,QAAQ,GAAG,QAAQ,CAAC,CAAC;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,UAAU,+UA6BjG"}
+{"version":3,"file":"databaseLayer.d.ts","sourceRoot":"","sources":["../../src/server/databaseLayer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAU,KAAK,EAAE,KAAK,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,KAAK,UAAU,MAAM,8BAA8B,CAAC;AAI3D,OAAO,EAAE,KAAK,sBAAsB,EAAmB,MAAM,0CAA0C,CAAC;AACxG,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGzE,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,sBAAsB,EAAE,QAAQ,GAAG,QAAQ,CAAC,CAAC;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,UAAU,+UA8BjG"}

package/dist/server/databaseLayer.js

@@ -5,11 +5,13 @@ import { makeLiveServer } from "@shivaedev/effect-contract/makeLiveServer.ts";
 import { assertPostgresMigrations } from "@shivaedev/effect-sql/assertPostgresMigrations.ts";
 import { migratePostgres } from "@shivaedev/effect-sql/migrations.ts";
 import { postgresChanges } from "@shivaedev/effect-sql/postgresChanges.ts";
+import { databaseAddress } from "./databaseAddress.js";
 export function databaseLayer(options, changesService) {
     const pool = Layer.unwrap(Effect.gen(function* () {
         const url = options.config?.databaseUrl ?? (yield* Config.Redacted("DATABASE_URL"));
         return PgClient.layer({
             url,
+            ...databaseAddress(url),
             ...(options.config?.maxConnections === undefined ? {} : { maxConnections: options.config.maxConnections }),
             ...(options.config?.applicationName === undefined ? {} : { applicationName: options.config.applicationName }),
         });

package/dist/server/databaseLayer.js.map

@@ -1 +1 @@
-{"version":3,"file":"databaseLayer.js","sourceRoot":"","sources":["../../src/server/databaseLayer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAiB,MAAM,QAAQ,CAAC;AAC9D,OAAO,KAAK,UAAU,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mDAAmD,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAA+B,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAUxG,MAAM,UAAU,aAAa,CAAI,OAA8B,EAAE,cAAiC;IACjG,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CACxB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QACpF,OAAO,QAAQ,CAAC,KAAK,CAAC;YACrB,GAAG;YACH,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1G,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;SAC7G,CAAC,CAAC;IACJ,CAAC,CAAC,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CACnC,OAAO,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO;QAClC,CAAC,CAAC,wBAAwB,CAAC,OAAO,CAAC,UAAU,CAAC;QAC9C,CAAC,CAAC,eAAe,CAAC,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,WAAW,IAAI,WAAW,EAAE,CAAC,CACzG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACrG,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;IACxC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAClB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;QACpC,OAAO,eAAe,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CACF,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"databaseLayer.js","sourceRoot":"","sources":["../../src/server/databaseLayer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAiB,MAAM,QAAQ,CAAC;AAC9D,OAAO,KAAK,UAAU,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mDAAmD,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAA+B,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAExG,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AASvD,MAAM,UAAU,aAAa,CAAI,OAA8B,EAAE,cAAiC;IACjG,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CACxB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QACpF,OAAO,QAAQ,CAAC,KAAK,CAAC;YACrB,GAAG;YACH,GAAG,eAAe,CAAC,GAAG,CAAC;YACvB,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1G,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;SAC7G,CAAC,CAAC;IACJ,CAAC,CAAC,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CACnC,OAAO,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO;QAClC,CAAC,CAAC,wBAAwB,CAAC,OAAO,CAAC,UAAU,CAAC;QAC9C,CAAC,CAAC,eAAe,CAAC,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,WAAW,IAAI,WAAW,EAAE,CAAC,CACzG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACrG,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;IACxC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAClB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;QACpC,OAAO,eAAe,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CACF,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC"}

package/dist/server/otlpHttpClient.d.ts

@@ -1,4 +1,4 @@
 import { Layer } from "effect";
 import { HttpClient } from "effect/http";
-export declare const otlpHttpClient: Layer.Layer<HttpClient.HttpClient, never, never>;
+export declare function otlpHttpClient(timeout?: number): Layer.Layer<HttpClient.HttpClient, never, never>;
 //# sourceMappingURL=otlpHttpClient.d.ts.map

package/dist/server/otlpHttpClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"otlpHttpClient.d.ts","sourceRoot":"","sources":["../../src/server/otlpHttpClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAmB,UAAU,EAAE,MAAM,aAAa,CAAC;AAG1D,eAAO,MAAM,cAAc,kDA8BiB,CAAC"}
+{"version":3,"file":"otlpHttpClient.d.ts","sourceRoot":"","sources":["../../src/server/otlpHttpClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAmB,UAAU,EAA2C,MAAM,aAAa,CAAC;AASnG,wBAAgB,cAAc,CAAC,OAAO,SAAS,oDAyC9C"}

package/dist/server/otlpHttpClient.js

@@ -1,24 +1,34 @@
 import { Effect, Layer } from "effect";
-import { FetchHttpClient, HttpClient } from "effect/http";
+import { FetchHttpClient, HttpClient, HttpClientError } from "effect/http";
 import { redactOtlpText } from "#safeOtlpSerialization.ts";
-export const otlpHttpClient = Layer.effect(HttpClient.HttpClient, Effect.gen(function* () {
-    const client = yield* HttpClient.HttpClient;
-    let warned = false;
-    function warnOnce(diagnostic) {
-        return Effect.suspend(() => {
-            if (warned) {
+function timeoutError(request) {
+    return new HttpClientError.HttpClientError({
+        reason: new HttpClientError.TransportError({ description: "OTLP export request timed out", request }),
+    });
+}
+export function otlpHttpClient(timeout = 10_000) {
+    return Layer.effect(HttpClient.HttpClient, Effect.gen(function* () {
+        const client = yield* HttpClient.HttpClient;
+        let warned = false;
+        function warnOnce(diagnostic) {
+            return Effect.suspend(() => {
+                if (warned) {
+                    return Effect.void;
+                }
+                warned = true;
+                return Effect.flatMap(diagnostic, (annotations) => Effect.logWarning("OTLP trace export failed").pipe(Effect.annotateLogs(annotations)));
+            });
+        }
+        return client.pipe(HttpClient.tap((response) => response.arrayBuffer), HttpClient.transform((requestEffect, request) => requestEffect.pipe(Effect.timeoutOrElse({
+            duration: timeout,
+            orElse: () => Effect.fail(timeoutError(request)),
+        }))), HttpClient.tap((response) => {
+            if (response.status >= 200 && response.status < 300) {
+                warned = false;
                 return Effect.void;
             }
-            warned = true;
-            return Effect.flatMap(diagnostic, (annotations) => Effect.logWarning("OTLP trace export failed").pipe(Effect.annotateLogs(annotations)));
-        });
-    }
-    return client.pipe(HttpClient.tap((response) => {
-        if (response.status >= 200 && response.status < 300) {
-            warned = false;
-            return Effect.void;
-        }
-        return warnOnce(response.text.pipe(Effect.orElseSucceed(() => "Unable to read collector response"), Effect.map((body) => ({ "otlp.response": redactOtlpText(body), "otlp.status": response.status }))));
-    }), HttpClient.tapError((error) => warnOnce(Effect.succeed({ "otlp.failure": error.reason._tag }))));
-})).pipe(Layer.provide(FetchHttpClient.layer));
+            return warnOnce(response.text.pipe(Effect.orElseSucceed(() => "Unable to read collector response"), Effect.map((body) => ({ "otlp.response": redactOtlpText(body), "otlp.status": response.status }))));
+        }), HttpClient.tapError((error) => warnOnce(Effect.succeed({ "otlp.failure": error.reason._tag }))));
+    })).pipe(Layer.provide(FetchHttpClient.layer));
+}
 //# sourceMappingURL=otlpHttpClient.js.map

package/dist/server/otlpHttpClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"otlpHttpClient.js","sourceRoot":"","sources":["../../src/server/otlpHttpClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CACzC,UAAU,CAAC,UAAU,EACrB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACnB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAC5C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,SAAS,QAAQ,CAAC,UAAkD;QACnE,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;YAC1B,IAAI,MAAM,EAAE,CAAC;gBACZ,OAAO,MAAM,CAAC,IAAI,CAAC;YACpB,CAAC;YACD,MAAM,GAAG,IAAI,CAAC;YACd,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC1I,CAAC,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CACjB,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC3B,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACrD,MAAM,GAAG,KAAK,CAAC;YACf,OAAO,MAAM,CAAC,IAAI,CAAC;QACpB,CAAC;QACD,OAAO,QAAQ,CACd,QAAQ,CAAC,IAAI,CAAC,IAAI,CACjB,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,mCAAmC,CAAC,EAC/D,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CACjG,CACD,CAAC;IACH,CAAC,CAAC,EACF,UAAU,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAC/F,CAAC;AACH,CAAC,CAAC,CACF,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC"}
+{"version":3,"file":"otlpHttpClient.js","sourceRoot":"","sources":["../../src/server/otlpHttpClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,eAAe,EAA0B,MAAM,aAAa,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,SAAS,YAAY,CAAC,OAA4C;IACjE,OAAO,IAAI,eAAe,CAAC,eAAe,CAAC;QAC1C,MAAM,EAAE,IAAI,eAAe,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,+BAA+B,EAAE,OAAO,EAAE,CAAC;KACrG,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAO,GAAG,MAAM;IAC9C,OAAO,KAAK,CAAC,MAAM,CAClB,UAAU,CAAC,UAAU,EACrB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;QAC5C,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,SAAS,QAAQ,CAAC,UAAkD;YACnE,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC1B,IAAI,MAAM,EAAE,CAAC;oBACZ,OAAO,MAAM,CAAC,IAAI,CAAC;gBACpB,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC;gBACd,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YAC1I,CAAC,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CACjB,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAClD,UAAU,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,EAAE,CAC/C,aAAa,CAAC,IAAI,CACjB,MAAM,CAAC,aAAa,CAAC;YACpB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;SAChD,CAAC,CACF,CACD,EACD,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC3B,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBACrD,MAAM,GAAG,KAAK,CAAC;gBACf,OAAO,MAAM,CAAC,IAAI,CAAC;YACpB,CAAC;YACD,OAAO,QAAQ,CACd,QAAQ,CAAC,IAAI,CAAC,IAAI,CACjB,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,mCAAmC,CAAC,EAC/D,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CACjG,CACD,CAAC;QACH,CAAC,CAAC,EACF,UAAU,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAC/F,CAAC;IACH,CAAC,CAAC,CACF,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9C,CAAC"}

package/dist/server/otlpTracing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"otlpTracing.d.ts","sourceRoot":"","sources":["../../src/server/otlpTracing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAU,KAAK,EAAU,MAAM,QAAQ,CAAC;AAKvD,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,CAsC9D,CAAC"}
+{"version":3,"file":"otlpTracing.d.ts","sourceRoot":"","sources":["../../src/server/otlpTracing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAU,KAAK,EAAU,MAAM,QAAQ,CAAC;AAKvD,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,CAoD9D,CAAC"}

package/dist/server/otlpTracing.js

@@ -16,6 +16,17 @@ export const otlpTracing = Layer.unwrap(Effect.gen(function* () {
     const serviceName = yield* Config.String("OTEL_SERVICE_NAME").pipe(Config.withDefault(attributes["service.name"] ?? "unknown_service"));
     const serviceVersion = yield* Config.String("OTEL_SERVICE_VERSION").pipe(Config.withDefault(undefined));
     const headers = yield* Config.Record(Schema.String, Schema.StringFromUriComponent, "OTEL_EXPORTER_OTLP_HEADERS").pipe(Config.withDefault({}));
-    return OtlpTracer.layer({ headers, resource: { attributes, serviceName, serviceVersion }, url: endpoint.toString() }).pipe(Layer.provide(safeOtlpSerialization.pipe(Layer.provide(protocol === "http/protobuf" ? OtlpSerialization.layerProtobuf : OtlpSerialization.layerJson))), Layer.provide(otlpHttpClient));
+    const requestTimeout = yield* Config.Int("OTEL_EXPORTER_OTLP_TRACES_TIMEOUT").pipe(Config.orElse(() => Config.Int("OTEL_EXPORTER_OTLP_TIMEOUT")), Config.withDefault(10_000));
+    const exportInterval = yield* Config.Int("OTEL_BSP_SCHEDULE_DELAY").pipe(Config.withDefault(5000));
+    const maxBatchSize = yield* Config.Int("OTEL_BSP_MAX_EXPORT_BATCH_SIZE").pipe(Config.withDefault(1000));
+    const exportTimeout = yield* Config.Int("OTEL_BSP_EXPORT_TIMEOUT").pipe(Config.withDefault(3000));
+    return OtlpTracer.layer({
+        exportInterval,
+        headers,
+        maxBatchSize,
+        resource: { attributes, serviceName, serviceVersion },
+        shutdownTimeout: Math.min(exportTimeout, requestTimeout),
+        url: endpoint.toString(),
+    }).pipe(Layer.provide(safeOtlpSerialization.pipe(Layer.provide(protocol === "http/protobuf" ? OtlpSerialization.layerProtobuf : OtlpSerialization.layerJson))), Layer.provide(otlpHttpClient(requestTimeout)));
 }));
 //# sourceMappingURL=otlpTracing.js.map

package/dist/server/otlpTracing.js.map

@@ -1 +1 @@
-{"version":3,"file":"otlpTracing.js","sourceRoot":"","sources":["../../src/server/otlpTracing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,MAAM,CAAC,MAAM,WAAW,GAA2C,KAAK,CAAC,MAAM,CAC9E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACnB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC,IAAI,CAC5E,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAClB,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,IAAI,CAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAClB,GAAG,CAAC,QAAQ,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC;QAC/D,OAAO,GAAG,CAAC;IACZ,CAAC,CAAC,CACF,CACD,EACD,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAC7B,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,KAAK,CAAC;IACpB,CAAC;IACD,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,oCAAoC,CAAC,CAAC,IAAI,CACzF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,EACjE,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,CACnC,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CACzH,kBAAkB,CAClB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,UAAU,GAA2B,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAC9D,MAAM,CAAC,sBAAsB,EAC7B,MAAM,CAAC,sBAAsB,EAC7B,0BAA0B,CAC1B,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC;IACxI,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;IACxG,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,sBAAsB,EAAE,4BAA4B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9I,OAAO,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,CACzH,KAAK,CAAC,OAAO,CACZ,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CACvI,EACD,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAC7B,CAAC;AACH,CAAC,CAAC,CACF,CAAC"}
+{"version":3,"file":"otlpTracing.js","sourceRoot":"","sources":["../../src/server/otlpTracing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,MAAM,CAAC,MAAM,WAAW,GAA2C,KAAK,CAAC,MAAM,CAC9E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACnB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC,IAAI,CAC5E,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAClB,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,IAAI,CAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAClB,GAAG,CAAC,QAAQ,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC;QAC/D,OAAO,GAAG,CAAC;IACZ,CAAC,CAAC,CACF,CACD,EACD,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAC7B,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,KAAK,CAAC;IACpB,CAAC;IACD,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,oCAAoC,CAAC,CAAC,IAAI,CACzF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,EACjE,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,CACnC,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CACzH,kBAAkB,CAClB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,UAAU,GAA2B,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAC9D,MAAM,CAAC,sBAAsB,EAC7B,MAAM,CAAC,sBAAsB,EAC7B,0BAA0B,CAC1B,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC;IACxI,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;IACxG,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,sBAAsB,EAAE,4BAA4B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9I,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC,IAAI,CACjF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,EAC7D,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAC1B,CAAC;IACF,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACnG,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACxG,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAClG,OAAO,UAAU,CAAC,KAAK,CAAC;QACvB,cAAc;QACd,OAAO;QACP,YAAY;QACZ,QAAQ,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE;QACrD,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC;QACxD,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE;KACxB,CAAC,CAAC,IAAI,CACN,KAAK,CAAC,OAAO,CACZ,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CACvI,EACD,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,CAC7C,CAAC;AACH,CAAC,CAAC,CACF,CAAC"}

package/dist/server/rpc-server/sensitive.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sensitive.d.ts","sourceRoot":"","sources":["../../../src/server/rpc-server/sensitive.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,QAAQ,eAAe,CAAC;AAwBrC,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;AAQpD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOnD;AAYD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,GAAG,MAAM,CAGxE"}
+{"version":3,"file":"sensitive.d.ts","sourceRoot":"","sources":["../../../src/server/rpc-server/sensitive.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,QAAQ,eAAe,CAAC;AAwBrC,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;AAQpD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOnD;AA8BD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,GAAG,MAAM,CAGxE"}

package/dist/server/rpc-server/sensitive.js

@@ -21,7 +21,7 @@ const SENSITIVE_PARTS = [
     "xsrf",
 ];
 const SENSITIVE_WORDS = ["otp", "pin", "cvv", "cvc", "ssn", "iban"];
-const SENSITIVE_NAMES = ["session", "pan"];
+const SENSITIVE_NAMES = ["session", "pan", "sig"];
 function wordsOf(key) {
     return key
         .replaceAll(/(?<lower>[a-z0-9])(?<upper>[A-Z])/gu, "$<lower> $<upper>")
@@ -37,14 +37,33 @@ export function isSensitiveKey(key) {
 }
 const AUTH_SCHEME = /\b(?<scheme>Bearer|Basic)\s+[A-Za-z0-9._~+/-]+=*/giu;
 const JWT = /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*/gu;
+const PRIVATE_KEY = /-----BEGIN (?<kind>(?:[A-Z0-9]+ )*PRIVATE KEY)-----[\s\S]*?-----END \k<kind>-----/gu;
 const URL_PASSWORD = /(?<authority>\/\/[^:/\s@]+:)[^@/\s]+@/gu;
-const ASSIGNMENT = /(?<key>[A-Za-z][\w.-]*)(?<separator>["']?\s*[=:]\s*["']?)(?<value>[^\s"'&,;]+)/gu;
+function redactAssignments(text, sensitive) {
+    const matcher = /(?<key>[A-Za-z][\w.-]*)(?<separator>["']?\s*[=:]\s*["']?)(?<value>[^\s"'&,;]+)/gu;
+    let result = "";
+    let cursor = 0;
+    for (let match = matcher.exec(text); match !== null; match = matcher.exec(text)) {
+        const key = match[1] ?? "";
+        const separator = match[2] ?? "";
+        if (sensitive(key)) {
+            result += `${text.slice(cursor, match.index)}${key}${separator}${REDACTED}`;
+            cursor = matcher.lastIndex;
+        }
+        else if (match[3]?.includes("=")) {
+            // Revisit embedded parameters without parsing URL and source-location colons as assignments.
+            matcher.lastIndex = match.index + key.length + separator.length;
+        }
+    }
+    return result + text.slice(cursor);
+}
 function scrub(text, sensitive) {
-    return text
+    const credentials = text
+        .replaceAll(PRIVATE_KEY, REDACTED)
         .replaceAll(AUTH_SCHEME, `$<scheme> ${REDACTED}`)
         .replaceAll(JWT, REDACTED)
-        .replaceAll(URL_PASSWORD, `$<authority>${REDACTED}@`)
-        .replaceAll(ASSIGNMENT, (match, key, separator) => (sensitive(key) ? `${key}${separator}${REDACTED}` : match));
+        .replaceAll(URL_PASSWORD, `$<authority>${REDACTED}@`);
+    return redactAssignments(credentials, sensitive);
 }
 export function redactText(text, sensitive) {
     const scrubbed = scrub(text, sensitive);

package/dist/server/rpc-server/sensitive.js.map

@@ -1 +1 @@
-{"version":3,"file":"sensitive.js","sourceRoot":"","sources":["../../../src/server/rpc-server/sensitive.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AACrC,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,MAAM,eAAe,GAAG;IACvB,UAAU;IACV,YAAY;IACZ,QAAQ;IACR,OAAO;IACP,eAAe;IACf,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,KAAK;IACL,QAAQ;IACR,WAAW;IACX,WAAW;IACX,YAAY;IACZ,eAAe;IACf,MAAM;IACN,MAAM;CACN,CAAC;AACF,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AACpE,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAE3C,SAAS,OAAO,CAAC,GAAW;IAC3B,OAAO,GAAG;SACR,UAAU,CAAC,qCAAqC,EAAE,mBAAmB,CAAC;SACtE,UAAU,CAAC,wCAAwC,EAAE,oBAAoB,CAAC;SAC1E,WAAW,EAAE;SACb,KAAK,CAAC,UAAU,CAAC,CAAC;AACrB,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,GAAW;IACzC,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC9D,OAAO,CACN,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC;WACjC,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;WACzD,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAC9D,CAAC;AACH,CAAC;AACD,MAAM,WAAW,GAAG,qDAAqD,CAAC;AAC1E,MAAM,GAAG,GAAG,uDAAuD,CAAC;AACpE,MAAM,YAAY,GAAG,yCAAyC,CAAC;AAC/D,MAAM,UAAU,GAAG,kFAAkF,CAAC;AACtG,SAAS,KAAK,CAAC,IAAY,EAAE,SAAuB;IACnD,OAAO,IAAI;SACT,UAAU,CAAC,WAAW,EAAE,aAAa,QAAQ,EAAE,CAAC;SAChD,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,YAAY,EAAE,eAAe,QAAQ,GAAG,CAAC;SACpD,UAAU,CAAC,UAAU,EAAE,CAAC,KAAa,EAAE,GAAW,EAAE,SAAiB,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,SAAS,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACzI,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAAuB;IAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACxC,OAAO,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,UAAU,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClI,CAAC"}
+{"version":3,"file":"sensitive.js","sourceRoot":"","sources":["../../../src/server/rpc-server/sensitive.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AACrC,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,MAAM,eAAe,GAAG;IACvB,UAAU;IACV,YAAY;IACZ,QAAQ;IACR,OAAO;IACP,eAAe;IACf,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,KAAK;IACL,QAAQ;IACR,WAAW;IACX,WAAW;IACX,YAAY;IACZ,eAAe;IACf,MAAM;IACN,MAAM;CACN,CAAC;AACF,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AACpE,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAElD,SAAS,OAAO,CAAC,GAAW;IAC3B,OAAO,GAAG;SACR,UAAU,CAAC,qCAAqC,EAAE,mBAAmB,CAAC;SACtE,UAAU,CAAC,wCAAwC,EAAE,oBAAoB,CAAC;SAC1E,WAAW,EAAE;SACb,KAAK,CAAC,UAAU,CAAC,CAAC;AACrB,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,GAAW;IACzC,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC9D,OAAO,CACN,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC;WACjC,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;WACzD,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAC9D,CAAC;AACH,CAAC;AACD,MAAM,WAAW,GAAG,qDAAqD,CAAC;AAC1E,MAAM,GAAG,GAAG,uDAAuD,CAAC;AACpE,MAAM,WAAW,GAAG,qFAAqF,CAAC;AAC1G,MAAM,YAAY,GAAG,yCAAyC,CAAC;AAC/D,SAAS,iBAAiB,CAAC,IAAY,EAAE,SAAuB;IAC/D,MAAM,OAAO,GAAG,kFAAkF,CAAC;IACnG,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjF,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,SAAS,GAAG,QAAQ,EAAE,CAAC;YAC5E,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;QAC5B,CAAC;aAAM,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,6FAA6F;YAC7F,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QACjE,CAAC;IACF,CAAC;IACD,OAAO,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AACD,SAAS,KAAK,CAAC,IAAY,EAAE,SAAuB;IACnD,MAAM,WAAW,GAAG,IAAI;SACtB,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC;SACjC,UAAU,CAAC,WAAW,EAAE,aAAa,QAAQ,EAAE,CAAC;SAChD,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,YAAY,EAAE,eAAe,QAAQ,GAAG,CAAC,CAAC;IACvD,OAAO,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AAClD,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAAuB;IAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACxC,OAAO,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,UAAU,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClI,CAAC"}

package/docs/roadmap.md

@@ -9,22 +9,23 @@ This file owns Platform's module implementation, package tests and scope questio
 - [x] Shared Schema tagged errors and field-rejection extraction, with native RPC JSON and tRPC rejection tests.
 - [x] Browser-safe native RPC middleware declarations and request-id, identity and optional-identity services, with compile-time checks on guarded handlers.
 - [x] Request-local session middleware, a Better Auth session-provider boundary and an explicit Origin policy. Tests cover concurrent identities, anonymous callers, provider failures and rejection before provider lookup.
-- [x] HTTP transport-header authentication and a WebSocket protocol fixture that uses upgrade-request headers instead of RPC message credentials.
-- [x] Request-id log/span annotations and redaction of failure payloads, defects, reported causes and credential-shaped strings, with bounded collection and string output.
-- [x] An application runtime that acquires its Layer once, shares an explicit development cache key and carries service overrides across Promise calls.
+- [x] HTTP transport-header authentication, direct tests of the RPC-header fallback and HTTP-header precedence, and a WebSocket protocol fixture that uses upgrade-request headers instead of RPC message credentials. [Header selection evidence](https://github.com/ShivaeDev/platform/blob/main/packages/platform/src/server/rpc-server/transportHeaders.test.ts).
+- [x] Request-id log/span annotations and redaction of failure payloads, defects, reported causes and credential-shaped strings, with bounded collection and string output. [Tracing tests](https://github.com/ShivaeDev/platform/blob/main/packages/platform/src/server/rpc-server/tracing.test.ts) cover successful requests and interruption without failure logs.
+- [x] An application runtime that acquires its Layer once, releases it exactly once, shares an explicit development cache key and recreates disposed cache entries, bypasses caching in production, and carries service overrides across Promise calls. [Runtime tests](https://github.com/ShivaeDev/platform/blob/main/packages/platform/src/server/runtime/makePlatform.test.ts) cover typed Layer build failures, Promise rejection, signal interruption with finalization, and nested override replacement and restoration.
 - [x] Node subscription cancellation from Web/procedure signals and simulated request/socket close events, with listener cleanup.
 - [x] A Better Auth Effect Prisma database adapter and Prisma/tRPC rollback harness. Real PostgreSQL tests cover shared transactions, failed transaction rollback, selected row operations and harness types; they require `PLATFORM_EFFECT_PRISMA_TEST_DATABASE_URL`.
+- [x] Better Auth adapter filters preserve PostgreSQL null, membership, comparison and literal-pattern semantics, including nonunique updates, OR-filter updates and deletes, and rejection of nonstring patterns. Configured model names map by default. Reads retain their filters through selection, ascending/descending ordering and limit/offset pagination; experimental native joins are rejected for both single and collection reads. [Adapter boundary tests](../src/server/better-auth/filterBoundaries.spec.ts) assert these paths against PostgreSQL.
 - [x] Packed-consumer checks for defining-module imports, types and core entries installed without optional peers.
 - [x] A local app host Layer and reusable database Layer, extracted from the PostgreSQL composition: migrations before services, guarded NDJSON RPC, session policy, static assets, scoped shutdown and commit-bound live delivery. The composed fixture covers two HTTP server processes and a worker. Fleet’s daemon adopts `appHost` and `appDatabase` with a custom RPC route, session-free loopback policy and its existing migration ledger. Platform’s real HTTP option tests cover hosting without a database, while Fleet’s PostgreSQL daemon tests cover pool limits, migration upgrades and existing clients.
 
 ## Next
 
-- [ ] Add focused runtime tests for production cache bypass, disposal and recreation, build failures, exit results and cancellation before documenting stronger lifecycle guarantees.
-- [ ] Extend adapter tests to the remaining public options and filter, selection, ordering and pagination paths. Add a regression test for the rejection of experimental native joins.
-- [ ] Exercise the no-HTTP-request `transportHeaders` fallback directly and the tracing boundary's successful and interrupted paths.
+- [ ] Add focused adapter tests for the remaining public options, `debugLogs` and `usePlural`.
 
 ## Open questions
 
+- What comprehensive application redaction policy should cover span names, free text and custom attributes, and how should request/action correlation work across boundaries?
+
 - Should the package keep the optional Better Auth storage adapter and Prisma/tRPC harness beside its native request-context modules, or should those compositions live with the integration packages? Both serve real boundary work, but they give this package a wider surface than its request-identity job alone.
 - If an application needs Better Auth storage on native Effect SQL, should Platform own that adapter or should the provider retain separate storage? The request middleware needs a session provider, not a particular database.
 - The exports make Better Auth translation helpers importable beside the adapter. Are these helpers intended as supported consumer APIs, or should a future public API change narrow the surface to the adapter?

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shivaedev/platform",
-  "version": "0.14.1",
+  "version": "0.14.3",
   "description": "Opinionated Effect application infrastructure for ShivaeDev services",
   "homepage": "https://github.com/ShivaeDev/platform/tree/main/packages/platform#readme",
   "bugs": {
@@ -386,12 +386,13 @@
     "@prisma-next/sql-contract": "0.16.0",
     "@prisma-next/sql-orm-client": "0.16.0",
     "@prisma-next/target-postgres": "0.16.0",
-    "@shivaedev/effect-prisma": "0.9.1",
+    "@shivaedev/effect-prisma": "0.9.2",
     "@shivaedev/effect-trpc": "0.7.1",
-    "@shivaedev/quality": "0.22.0",
+    "@shivaedev/quality": "0.23.0",
+    "@shivaedev/test-story": "0.6.0",
     "@trpc/client": "11.19.0",
     "@trpc/server": "11.19.0",
-    "@types/node": "24.19.1",
+    "@types/node": "24.19.2",
     "@typescript/native": "npm:typescript@7.0.2",
     "better-auth": "1.7.7",
     "effect": "4.0.4",
@@ -404,7 +405,7 @@
     "@effect/sql-pg": "4.0.4",
     "@effect/vitest": "4.0.4",
     "@prisma-next/sql-orm-client": "0.16.0",
-    "@shivaedev/effect-prisma": "0.9.1",
+    "@shivaedev/effect-prisma": "0.9.2",
     "@shivaedev/effect-trpc": "0.7.1",
     "@trpc/server": "11.19.0",
     "better-auth": "1.7.7",

package/src/server/databaseAddress.ts

@@ -0,0 +1,25 @@
+import type { PgPoolConfig } from "@effect/sql-pg/PgClient";
+import { Redacted } from "effect";
+
+export function databaseAddress(value: Redacted.Redacted<string>): Pick<PgPoolConfig, "host" | "port"> {
+	try {
+		const url = new URL(Redacted.value(value));
+		if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") {
+			return {};
+		}
+		const hostname = url.hostname.startsWith("[") ? url.hostname.slice(1, -1) : decodeURIComponent(url.hostname);
+		// PgConnection applies query parameters in order, after the authority.
+		const host = url.searchParams.getAll("host").at(-1) ?? hostname;
+		const rawPort = url.searchParams.getAll("port").at(-1) ?? url.port;
+		const port = rawPort === "" ? undefined : Number(rawPort);
+		if (host.includes(",") || (port !== undefined && (!Number.isInteger(port) || port < 1 || port > 65_535))) {
+			return {};
+		}
+		return {
+			...(host === "" && !url.searchParams.has("host") ? {} : { host }),
+			...(port === undefined ? {} : { port }),
+		};
+	} catch {
+		return {};
+	}
+}

package/src/server/databaseLayer.ts

@@ -6,6 +6,7 @@ import { assertPostgresMigrations } from "@shivaedev/effect-sql/assertPostgresMi
 import { migratePostgres } from "@shivaedev/effect-sql/migrations.ts";
 import { type PostgresChangesOptions, postgresChanges } from "@shivaedev/effect-sql/postgresChanges.ts";
 import type { AppChanges, AppDatabaseOptions } from "#server/appHost.ts";
+import { databaseAddress } from "./databaseAddress.ts";
 
 export interface DatabaseConfig {
 	readonly applicationName?: string;
@@ -20,6 +21,7 @@ export function databaseLayer<R>(options: AppDatabaseOptions<R>, changesService:
 			const url = options.config?.databaseUrl ?? (yield* Config.Redacted("DATABASE_URL"));
 			return PgClient.layer({
 				url,
+				...databaseAddress(url),
 				...(options.config?.maxConnections === undefined ? {} : { maxConnections: options.config.maxConnections }),
 				...(options.config?.applicationName === undefined ? {} : { applicationName: options.config.applicationName }),
 			});

package/src/server/otlpHttpClient.ts

@@ -1,35 +1,52 @@
 import { Effect, Layer } from "effect";
-import { FetchHttpClient, HttpClient } from "effect/http";
+import { FetchHttpClient, HttpClient, HttpClientError, type HttpClientRequest } from "effect/http";
 import { redactOtlpText } from "#safeOtlpSerialization.ts";
 
-export const otlpHttpClient = Layer.effect(
-	HttpClient.HttpClient,
-	Effect.gen(function* () {
-		const client = yield* HttpClient.HttpClient;
-		let warned = false;
-		function warnOnce(diagnostic: Effect.Effect<Record<string, unknown>>) {
-			return Effect.suspend(() => {
-				if (warned) {
-					return Effect.void;
-				}
-				warned = true;
-				return Effect.flatMap(diagnostic, (annotations) => Effect.logWarning("OTLP trace export failed").pipe(Effect.annotateLogs(annotations)));
-			});
-		}
-		return client.pipe(
-			HttpClient.tap((response) => {
-				if (response.status >= 200 && response.status < 300) {
-					warned = false;
-					return Effect.void;
-				}
-				return warnOnce(
-					response.text.pipe(
-						Effect.orElseSucceed(() => "Unable to read collector response"),
-						Effect.map((body) => ({ "otlp.response": redactOtlpText(body), "otlp.status": response.status })),
+function timeoutError(request: HttpClientRequest.HttpClientRequest) {
+	return new HttpClientError.HttpClientError({
+		reason: new HttpClientError.TransportError({ description: "OTLP export request timed out", request }),
+	});
+}
+
+export function otlpHttpClient(timeout = 10_000) {
+	return Layer.effect(
+		HttpClient.HttpClient,
+		Effect.gen(function* () {
+			const client = yield* HttpClient.HttpClient;
+			let warned = false;
+			function warnOnce(diagnostic: Effect.Effect<Record<string, unknown>>) {
+				return Effect.suspend(() => {
+					if (warned) {
+						return Effect.void;
+					}
+					warned = true;
+					return Effect.flatMap(diagnostic, (annotations) => Effect.logWarning("OTLP trace export failed").pipe(Effect.annotateLogs(annotations)));
+				});
+			}
+			return client.pipe(
+				HttpClient.tap((response) => response.arrayBuffer),
+				HttpClient.transform((requestEffect, request) =>
+					requestEffect.pipe(
+						Effect.timeoutOrElse({
+							duration: timeout,
+							orElse: () => Effect.fail(timeoutError(request)),
+						}),
 					),
-				);
-			}),
-			HttpClient.tapError((error) => warnOnce(Effect.succeed({ "otlp.failure": error.reason._tag }))),
-		);
-	}),
-).pipe(Layer.provide(FetchHttpClient.layer));
+				),
+				HttpClient.tap((response) => {
+					if (response.status >= 200 && response.status < 300) {
+						warned = false;
+						return Effect.void;
+					}
+					return warnOnce(
+						response.text.pipe(
+							Effect.orElseSucceed(() => "Unable to read collector response"),
+							Effect.map((body) => ({ "otlp.response": redactOtlpText(body), "otlp.status": response.status })),
+						),
+					);
+				}),
+				HttpClient.tapError((error) => warnOnce(Effect.succeed({ "otlp.failure": error.reason._tag }))),
+			);
+		}),
+	).pipe(Layer.provide(FetchHttpClient.layer));
+}

package/src/server/otlpTracing.ts

@@ -34,11 +34,25 @@ export const otlpTracing: Layer.Layer<never, Config.ConfigError> = Layer.unwrap(
 		const serviceName = yield* Config.String("OTEL_SERVICE_NAME").pipe(Config.withDefault(attributes["service.name"] ?? "unknown_service"));
 		const serviceVersion = yield* Config.String("OTEL_SERVICE_VERSION").pipe(Config.withDefault(undefined));
 		const headers = yield* Config.Record(Schema.String, Schema.StringFromUriComponent, "OTEL_EXPORTER_OTLP_HEADERS").pipe(Config.withDefault({}));
-		return OtlpTracer.layer({ headers, resource: { attributes, serviceName, serviceVersion }, url: endpoint.toString() }).pipe(
+		const requestTimeout = yield* Config.Int("OTEL_EXPORTER_OTLP_TRACES_TIMEOUT").pipe(
+			Config.orElse(() => Config.Int("OTEL_EXPORTER_OTLP_TIMEOUT")),
+			Config.withDefault(10_000),
+		);
+		const exportInterval = yield* Config.Int("OTEL_BSP_SCHEDULE_DELAY").pipe(Config.withDefault(5000));
+		const maxBatchSize = yield* Config.Int("OTEL_BSP_MAX_EXPORT_BATCH_SIZE").pipe(Config.withDefault(1000));
+		const exportTimeout = yield* Config.Int("OTEL_BSP_EXPORT_TIMEOUT").pipe(Config.withDefault(3000));
+		return OtlpTracer.layer({
+			exportInterval,
+			headers,
+			maxBatchSize,
+			resource: { attributes, serviceName, serviceVersion },
+			shutdownTimeout: Math.min(exportTimeout, requestTimeout),
+			url: endpoint.toString(),
+		}).pipe(
 			Layer.provide(
 				safeOtlpSerialization.pipe(Layer.provide(protocol === "http/protobuf" ? OtlpSerialization.layerProtobuf : OtlpSerialization.layerJson)),
 			),
-			Layer.provide(otlpHttpClient),
+			Layer.provide(otlpHttpClient(requestTimeout)),
 		);
 	}),
 );

package/src/server/rpc-server/sensitive.ts

@@ -21,7 +21,7 @@ const SENSITIVE_PARTS = [
 	"xsrf",
 ];
 const SENSITIVE_WORDS = ["otp", "pin", "cvv", "cvc", "ssn", "iban"];
-const SENSITIVE_NAMES = ["session", "pan"];
+const SENSITIVE_NAMES = ["session", "pan", "sig"];
 export type SensitiveKey = (key: string) => boolean;
 function wordsOf(key: string): string[] {
 	return key
@@ -40,14 +40,32 @@ export function isSensitiveKey(key: string): boolean {
 }
 const AUTH_SCHEME = /\b(?<scheme>Bearer|Basic)\s+[A-Za-z0-9._~+/-]+=*/giu;
 const JWT = /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*/gu;
+const PRIVATE_KEY = /-----BEGIN (?<kind>(?:[A-Z0-9]+ )*PRIVATE KEY)-----[\s\S]*?-----END \k<kind>-----/gu;
 const URL_PASSWORD = /(?<authority>\/\/[^:/\s@]+:)[^@/\s]+@/gu;
-const ASSIGNMENT = /(?<key>[A-Za-z][\w.-]*)(?<separator>["']?\s*[=:]\s*["']?)(?<value>[^\s"'&,;]+)/gu;
+function redactAssignments(text: string, sensitive: SensitiveKey): string {
+	const matcher = /(?<key>[A-Za-z][\w.-]*)(?<separator>["']?\s*[=:]\s*["']?)(?<value>[^\s"'&,;]+)/gu;
+	let result = "";
+	let cursor = 0;
+	for (let match = matcher.exec(text); match !== null; match = matcher.exec(text)) {
+		const key = match[1] ?? "";
+		const separator = match[2] ?? "";
+		if (sensitive(key)) {
+			result += `${text.slice(cursor, match.index)}${key}${separator}${REDACTED}`;
+			cursor = matcher.lastIndex;
+		} else if (match[3]?.includes("=")) {
+			// Revisit embedded parameters without parsing URL and source-location colons as assignments.
+			matcher.lastIndex = match.index + key.length + separator.length;
+		}
+	}
+	return result + text.slice(cursor);
+}
 function scrub(text: string, sensitive: SensitiveKey): string {
-	return text
+	const credentials = text
+		.replaceAll(PRIVATE_KEY, REDACTED)
 		.replaceAll(AUTH_SCHEME, `$<scheme> ${REDACTED}`)
 		.replaceAll(JWT, REDACTED)
-		.replaceAll(URL_PASSWORD, `$<authority>${REDACTED}@`)
-		.replaceAll(ASSIGNMENT, (match: string, key: string, separator: string) => (sensitive(key) ? `${key}${separator}${REDACTED}` : match));
+		.replaceAll(URL_PASSWORD, `$<authority>${REDACTED}@`);
+	return redactAssignments(credentials, sensitive);
 }
 export function redactText(text: string, sensitive: SensitiveKey): string {
 	const scrubbed = scrub(text, sensitive);