@shivaedev/platform 0.14.2 → 0.14.3

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # Changelog
 
+## 0.14.3 - 2026-10-18
+
+### Fixed
+
+- Bound OTLP HTTP export attempts to 10 seconds by default, honor standard general and traces-specific timeout variables, and read the batch interval, size and shutdown timeout through Effect Config.
+- Redact bare `sig` assignments, including short errors such as `error: sig=...`, and PEM private-key blocks from exported trace values in both JSON and protobuf.
+- SQL spans from `appDatabase` and `appHost` report the host and port from `DATABASE_URL`, including address query parameters, while keeping the connection URL redacted.
+
 ## 0.14.2 - 2026-10-17
 
 ### Fixed

package/README.md

@@ -109,11 +109,31 @@ Construct Better Auth inside `application`, since its constructor starts schema
 
 Set `OTEL_EXPORTER_OTLP_ENDPOINT` (the collector base URL; `/v1/traces` is appended) or `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT` (the complete traces URL, which takes precedence) to export `appHost`'s Effect spans over OTLP/HTTP. `OTEL_EXPORTER_OTLP_PROTOCOL` selects `http/protobuf` or `http/json`; `OTEL_EXPORTER_OTLP_TRACES_PROTOCOL` takes precedence for traces. When neither protocol variable is set, the default is `http/protobuf`, following the [OpenTelemetry recommendation](https://opentelemetry.io/docs/specs/otel/protocol/exporter/#specify-protocol). Unsupported protocols, including `grpc`, fail startup with a `ConfigError` naming the value. `OTEL_EXPORTER_OTLP_HEADERS` supplies comma-separated `key=value` exporter headers with URL-encoded values. `OTEL_SERVICE_NAME` sets the service name and `OTEL_SERVICE_VERSION` sets `service.version`; `OTEL_RESOURCE_ATTRIBUTES` adds comma-separated, URL-encoded resource attributes and can supply `service.name` when no service name is set. The fallback name is `unknown_service`. Configuration is read through Effect Config. Without an endpoint, no exporter or export loop is built, even when service metadata is set.
 
-On Railway, enable the per-service tracing setting separately for the web service and worker, and leave both exporter endpoint variables unset in your app's configuration. Railway injects the `OTEL_*` variables, including `OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf`, only when the app sets no endpoint of its own. The framework exports through Effect's own `effect/observability` OTLP tracer; eBPF auto-instrumentation is outside this path. For a worker, provide `otlpTracing` from `@shivaedev/platform/otlpTracing.ts` to its application Layer. It batches ended Effect spans and flushes during scoped shutdown with a three-second bound. The first failed export logs a warning with the collector status and redacted response body, or the transport failure kind when no response arrives. Repeated failures stay quiet until a successful export. Collector connection failures and HTTP errors leave requests, jobs and shutdown successful. HTTP receiver tests cover the host and the starter's PostgreSQL word-count worker; they do not establish delivery in a deployed collector.
+The supported tracing variables and defaults are:
+
+| Variable | Default | Meaning |
+| --- | --- | --- |
+| `OTEL_EXPORTER_OTLP_ENDPOINT` | Unset | Collector base URL. |
+| `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT` | Base URL plus `/v1/traces` | Complete traces URL; takes precedence. |
+| `OTEL_EXPORTER_OTLP_PROTOCOL` | `http/protobuf` | `http/protobuf` or `http/json`. |
+| `OTEL_EXPORTER_OTLP_TRACES_PROTOCOL` | General protocol | Overrides the protocol for traces. |
+| `OTEL_EXPORTER_OTLP_HEADERS` | Empty | Comma-separated exporter headers. |
+| `OTEL_SERVICE_NAME` | Resource `service.name`, then `unknown_service` | Service name. |
+| `OTEL_SERVICE_VERSION` | Resource `service.version`, otherwise unset | Service version. |
+| `OTEL_RESOURCE_ATTRIBUTES` | Empty | Comma-separated resource attributes. |
+| `OTEL_EXPORTER_OTLP_TIMEOUT` | `10000` ms | Timeout for each HTTP export attempt, including its response body. |
+| `OTEL_EXPORTER_OTLP_TRACES_TIMEOUT` | General timeout | Overrides the request timeout for traces. |
+| `OTEL_BSP_SCHEDULE_DELAY` | `5000` ms | Effect tracer's batch export interval. |
+| `OTEL_BSP_MAX_EXPORT_BATCH_SIZE` | `1000` spans | Effect tracer's batch-size trigger. |
+| `OTEL_BSP_EXPORT_TIMEOUT` | `3000` ms | Effect tracer's shutdown flush bound, capped at the request timeout. |
+
+Timeouts fail through the HTTP client's typed transport-error channel and use the same warning path as other transport failures. Effect retains its native retry policy; the request timeout applies to each attempt. The batch defaults follow Effect's `OtlpTracer.layer`. Its options cannot express a separate batch-operation deadline or a queue capacity, so `OTEL_BSP_EXPORT_TIMEOUT` controls shutdown only and `OTEL_BSP_MAX_QUEUE_SIZE` is unsupported. Other `OTEL_BSP_*` variables are unsupported.
+
+On Railway, enable the per-service tracing setting separately for the web service and worker, and leave both exporter endpoint variables unset in your app's configuration. Railway injects the `OTEL_*` variables, including `OTEL_EXPORTER_OTLP_PROTOCOL=http/protobuf`, only when the app sets no endpoint of its own. The framework exports through Effect's own `effect/observability` OTLP tracer; eBPF auto-instrumentation is outside this path. For a worker, provide `otlpTracing` from `@shivaedev/platform/otlpTracing.ts` to its application Layer. It batches ended Effect spans and flushes during scoped shutdown with a three-second bound by default. The first failed export logs a warning with the collector status and redacted response body, or the transport failure kind when no response arrives. Repeated failures stay quiet until a successful export. Collector connection failures and HTTP errors leave requests, jobs and shutdown successful. HTTP receiver tests cover the host and the starter's PostgreSQL word-count worker; they do not establish delivery in a deployed collector.
 
 Exported HTTP server spans use `{method} {route}` with `http.route` for matched RPC and router paths, including parameter templates; unmatched requests use the method alone. The production host continues incoming W3C `traceparent` context, including one sent by an edge proxy.
 
-Both JSON and protobuf export serialization apply sensitive-key and credential-text redaction to span attributes, events, links, error details and resource attributes. Exporter headers stay in the collector request, outside the spans. Applications must still avoid placing secrets in span names, free text or custom attributes.
+Both JSON and protobuf export serialization apply sensitive-key and credential-text redaction to span attributes, events, links, error details and resource attributes. Credential text includes JWTs, Bearer/Basic credentials, sensitive assignments including bare `sig=...` anywhere in text (with or without `?`), and complete PEM private-key blocks through their matching END marker, including RSA, EC, OPENSSH and encrypted private keys. Matches become `<redacted>`. `sig` uses the shared sensitive-key policy for attributes and text. URL query values, fragments and user information are also redacted. Exporter headers stay in the collector request, outside the spans. Applications must still avoid placing secrets in span names, free text or custom attributes.
 
 Set `config.maxConnections` on `appDatabase` or a migrated `appHost` to bound the pool. A daemon with long-lived RPC streams can use `config.disablePreemptiveShutdown: true` to let scope closure interrupt those streams before closing the listener; omitting it keeps Node's native graceful-shutdown default. Fleet's daemon tests cover one bounded pool and scoped provider and listener cleanup, including follower reconnection after shutdown.
 

package/dist/server/databaseAddress.d.ts

@@ -0,0 +1,4 @@
+import type { PgPoolConfig } from "@effect/sql-pg/PgClient";
+import { Redacted } from "effect";
+export declare function databaseAddress(value: Redacted.Redacted<string>): Pick<PgPoolConfig, "host" | "port">;
+//# sourceMappingURL=databaseAddress.d.ts.map

package/dist/server/databaseAddress.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"databaseAddress.d.ts","sourceRoot":"","sources":["../../src/server/databaseAddress.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAElC,wBAAgB,eAAe,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAAC,CAqBrG"}

package/dist/server/databaseAddress.js

@@ -0,0 +1,25 @@
+import { Redacted } from "effect";
+export function databaseAddress(value) {
+    try {
+        const url = new URL(Redacted.value(value));
+        if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") {
+            return {};
+        }
+        const hostname = url.hostname.startsWith("[") ? url.hostname.slice(1, -1) : decodeURIComponent(url.hostname);
+        // PgConnection applies query parameters in order, after the authority.
+        const host = url.searchParams.getAll("host").at(-1) ?? hostname;
+        const rawPort = url.searchParams.getAll("port").at(-1) ?? url.port;
+        const port = rawPort === "" ? undefined : Number(rawPort);
+        if (host.includes(",") || (port !== undefined && (!Number.isInteger(port) || port < 1 || port > 65_535))) {
+            return {};
+        }
+        return {
+            ...(host === "" && !url.searchParams.has("host") ? {} : { host }),
+            ...(port === undefined ? {} : { port }),
+        };
+    }
+    catch {
+        return {};
+    }
+}
+//# sourceMappingURL=databaseAddress.js.map

package/dist/server/databaseAddress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"databaseAddress.js","sourceRoot":"","sources":["../../src/server/databaseAddress.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAElC,MAAM,UAAU,eAAe,CAAC,KAAgC;IAC/D,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAC3C,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,IAAI,GAAG,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;YACpE,OAAO,EAAE,CAAC;QACX,CAAC;QACD,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC7G,uEAAuE;QACvE,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC;QAChE,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC;QACnE,MAAM,IAAI,GAAG,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC;YAC1G,OAAO,EAAE,CAAC;QACX,CAAC;QACD,OAAO;YACN,GAAG,CAAC,IAAI,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;YACjE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;SACvC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,EAAE,CAAC;IACX,CAAC;AACF,CAAC"}

package/dist/server/databaseLayer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"databaseLayer.d.ts","sourceRoot":"","sources":["../../src/server/databaseLayer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAU,KAAK,EAAE,KAAK,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,KAAK,UAAU,MAAM,8BAA8B,CAAC;AAI3D,OAAO,EAAE,KAAK,sBAAsB,EAAmB,MAAM,0CAA0C,CAAC;AACxG,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAEzE,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,sBAAsB,EAAE,QAAQ,GAAG,QAAQ,CAAC,CAAC;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,UAAU,+UA6BjG"}
+{"version":3,"file":"databaseLayer.d.ts","sourceRoot":"","sources":["../../src/server/databaseLayer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAU,KAAK,EAAE,KAAK,QAAQ,EAAE,MAAM,QAAQ,CAAC;AAC9D,OAAO,KAAK,UAAU,MAAM,8BAA8B,CAAC;AAI3D,OAAO,EAAE,KAAK,sBAAsB,EAAmB,MAAM,0CAA0C,CAAC;AACxG,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAGzE,MAAM,WAAW,cAAc;IAC9B,QAAQ,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,sBAAsB,EAAE,QAAQ,GAAG,QAAQ,CAAC,CAAC;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjD,QAAQ,CAAC,cAAc,CAAC,EAAE,MAAM,CAAC;CACjC;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,UAAU,+UA8BjG"}

package/dist/server/databaseLayer.js

@@ -5,11 +5,13 @@ import { makeLiveServer } from "@shivaedev/effect-contract/makeLiveServer.ts";
 import { assertPostgresMigrations } from "@shivaedev/effect-sql/assertPostgresMigrations.ts";
 import { migratePostgres } from "@shivaedev/effect-sql/migrations.ts";
 import { postgresChanges } from "@shivaedev/effect-sql/postgresChanges.ts";
+import { databaseAddress } from "./databaseAddress.js";
 export function databaseLayer(options, changesService) {
     const pool = Layer.unwrap(Effect.gen(function* () {
         const url = options.config?.databaseUrl ?? (yield* Config.Redacted("DATABASE_URL"));
         return PgClient.layer({
             url,
+            ...databaseAddress(url),
             ...(options.config?.maxConnections === undefined ? {} : { maxConnections: options.config.maxConnections }),
             ...(options.config?.applicationName === undefined ? {} : { applicationName: options.config.applicationName }),
         });

package/dist/server/databaseLayer.js.map

@@ -1 +1 @@
-{"version":3,"file":"databaseLayer.js","sourceRoot":"","sources":["../../src/server/databaseLayer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAiB,MAAM,QAAQ,CAAC;AAC9D,OAAO,KAAK,UAAU,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mDAAmD,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAA+B,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAUxG,MAAM,UAAU,aAAa,CAAI,OAA8B,EAAE,cAAiC;IACjG,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CACxB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QACpF,OAAO,QAAQ,CAAC,KAAK,CAAC;YACrB,GAAG;YACH,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1G,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;SAC7G,CAAC,CAAC;IACJ,CAAC,CAAC,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CACnC,OAAO,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO;QAClC,CAAC,CAAC,wBAAwB,CAAC,OAAO,CAAC,UAAU,CAAC;QAC9C,CAAC,CAAC,eAAe,CAAC,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,WAAW,IAAI,WAAW,EAAE,CAAC,CACzG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACrG,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;IACxC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAClB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;QACpC,OAAO,eAAe,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CACF,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC"}
+{"version":3,"file":"databaseLayer.js","sourceRoot":"","sources":["../../src/server/databaseLayer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAiB,MAAM,QAAQ,CAAC;AAC9D,OAAO,KAAK,UAAU,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,8CAA8C,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,MAAM,mDAAmD,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,MAAM,qCAAqC,CAAC;AACtE,OAAO,EAA+B,eAAe,EAAE,MAAM,0CAA0C,CAAC;AAExG,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AASvD,MAAM,UAAU,aAAa,CAAI,OAA8B,EAAE,cAAiC;IACjG,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CACxB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QACpF,OAAO,QAAQ,CAAC,KAAK,CAAC;YACrB,GAAG;YACH,GAAG,eAAe,CAAC,GAAG,CAAC;YACvB,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YAC1G,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;SAC7G,CAAC,CAAC;IACJ,CAAC,CAAC,CACF,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CACnC,OAAO,CAAC,UAAU,CAAC,IAAI,KAAK,OAAO;QAClC,CAAC,CAAC,wBAAwB,CAAC,OAAO,CAAC,UAAU,CAAC;QAC9C,CAAC,CAAC,eAAe,CAAC,EAAE,GAAG,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,CAAC,WAAW,IAAI,WAAW,EAAE,CAAC,CACzG,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACrG,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;IACxC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,CAClB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;QACpC,OAAO,eAAe,CAAC,EAAE,GAAG,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC,CACF,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC"}

package/dist/server/otlpHttpClient.d.ts

@@ -1,4 +1,4 @@
 import { Layer } from "effect";
 import { HttpClient } from "effect/http";
-export declare const otlpHttpClient: Layer.Layer<HttpClient.HttpClient, never, never>;
+export declare function otlpHttpClient(timeout?: number): Layer.Layer<HttpClient.HttpClient, never, never>;
 //# sourceMappingURL=otlpHttpClient.d.ts.map

package/dist/server/otlpHttpClient.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"otlpHttpClient.d.ts","sourceRoot":"","sources":["../../src/server/otlpHttpClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAmB,UAAU,EAAE,MAAM,aAAa,CAAC;AAG1D,eAAO,MAAM,cAAc,kDA8BiB,CAAC"}
+{"version":3,"file":"otlpHttpClient.d.ts","sourceRoot":"","sources":["../../src/server/otlpHttpClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAU,KAAK,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAmB,UAAU,EAA2C,MAAM,aAAa,CAAC;AASnG,wBAAgB,cAAc,CAAC,OAAO,SAAS,oDAyC9C"}

package/dist/server/otlpHttpClient.js

@@ -1,24 +1,34 @@
 import { Effect, Layer } from "effect";
-import { FetchHttpClient, HttpClient } from "effect/http";
+import { FetchHttpClient, HttpClient, HttpClientError } from "effect/http";
 import { redactOtlpText } from "#safeOtlpSerialization.ts";
-export const otlpHttpClient = Layer.effect(HttpClient.HttpClient, Effect.gen(function* () {
-    const client = yield* HttpClient.HttpClient;
-    let warned = false;
-    function warnOnce(diagnostic) {
-        return Effect.suspend(() => {
-            if (warned) {
+function timeoutError(request) {
+    return new HttpClientError.HttpClientError({
+        reason: new HttpClientError.TransportError({ description: "OTLP export request timed out", request }),
+    });
+}
+export function otlpHttpClient(timeout = 10_000) {
+    return Layer.effect(HttpClient.HttpClient, Effect.gen(function* () {
+        const client = yield* HttpClient.HttpClient;
+        let warned = false;
+        function warnOnce(diagnostic) {
+            return Effect.suspend(() => {
+                if (warned) {
+                    return Effect.void;
+                }
+                warned = true;
+                return Effect.flatMap(diagnostic, (annotations) => Effect.logWarning("OTLP trace export failed").pipe(Effect.annotateLogs(annotations)));
+            });
+        }
+        return client.pipe(HttpClient.tap((response) => response.arrayBuffer), HttpClient.transform((requestEffect, request) => requestEffect.pipe(Effect.timeoutOrElse({
+            duration: timeout,
+            orElse: () => Effect.fail(timeoutError(request)),
+        }))), HttpClient.tap((response) => {
+            if (response.status >= 200 && response.status < 300) {
+                warned = false;
                 return Effect.void;
             }
-            warned = true;
-            return Effect.flatMap(diagnostic, (annotations) => Effect.logWarning("OTLP trace export failed").pipe(Effect.annotateLogs(annotations)));
-        });
-    }
-    return client.pipe(HttpClient.tap((response) => {
-        if (response.status >= 200 && response.status < 300) {
-            warned = false;
-            return Effect.void;
-        }
-        return warnOnce(response.text.pipe(Effect.orElseSucceed(() => "Unable to read collector response"), Effect.map((body) => ({ "otlp.response": redactOtlpText(body), "otlp.status": response.status }))));
-    }), HttpClient.tapError((error) => warnOnce(Effect.succeed({ "otlp.failure": error.reason._tag }))));
-})).pipe(Layer.provide(FetchHttpClient.layer));
+            return warnOnce(response.text.pipe(Effect.orElseSucceed(() => "Unable to read collector response"), Effect.map((body) => ({ "otlp.response": redactOtlpText(body), "otlp.status": response.status }))));
+        }), HttpClient.tapError((error) => warnOnce(Effect.succeed({ "otlp.failure": error.reason._tag }))));
+    })).pipe(Layer.provide(FetchHttpClient.layer));
+}
 //# sourceMappingURL=otlpHttpClient.js.map

package/dist/server/otlpHttpClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"otlpHttpClient.js","sourceRoot":"","sources":["../../src/server/otlpHttpClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CACzC,UAAU,CAAC,UAAU,EACrB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACnB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAC5C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,SAAS,QAAQ,CAAC,UAAkD;QACnE,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;YAC1B,IAAI,MAAM,EAAE,CAAC;gBACZ,OAAO,MAAM,CAAC,IAAI,CAAC;YACpB,CAAC;YACD,MAAM,GAAG,IAAI,CAAC;YACd,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAC1I,CAAC,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CACjB,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;QAC3B,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACrD,MAAM,GAAG,KAAK,CAAC;YACf,OAAO,MAAM,CAAC,IAAI,CAAC;QACpB,CAAC;QACD,OAAO,QAAQ,CACd,QAAQ,CAAC,IAAI,CAAC,IAAI,CACjB,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,mCAAmC,CAAC,EAC/D,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CACjG,CACD,CAAC;IACH,CAAC,CAAC,EACF,UAAU,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAC/F,CAAC;AACH,CAAC,CAAC,CACF,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC"}
+{"version":3,"file":"otlpHttpClient.js","sourceRoot":"","sources":["../../src/server/otlpHttpClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,eAAe,EAA0B,MAAM,aAAa,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,SAAS,YAAY,CAAC,OAA4C;IACjE,OAAO,IAAI,eAAe,CAAC,eAAe,CAAC;QAC1C,MAAM,EAAE,IAAI,eAAe,CAAC,cAAc,CAAC,EAAE,WAAW,EAAE,+BAA+B,EAAE,OAAO,EAAE,CAAC;KACrG,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,OAAO,GAAG,MAAM;IAC9C,OAAO,KAAK,CAAC,MAAM,CAClB,UAAU,CAAC,UAAU,EACrB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;QAC5C,IAAI,MAAM,GAAG,KAAK,CAAC;QACnB,SAAS,QAAQ,CAAC,UAAkD;YACnE,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;gBAC1B,IAAI,MAAM,EAAE,CAAC;oBACZ,OAAO,MAAM,CAAC,IAAI,CAAC;gBACpB,CAAC;gBACD,MAAM,GAAG,IAAI,CAAC;gBACd,OAAO,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,0BAA0B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;YAC1I,CAAC,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CACjB,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAClD,UAAU,CAAC,SAAS,CAAC,CAAC,aAAa,EAAE,OAAO,EAAE,EAAE,CAC/C,aAAa,CAAC,IAAI,CACjB,MAAM,CAAC,aAAa,CAAC;YACpB,QAAQ,EAAE,OAAO;YACjB,MAAM,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;SAChD,CAAC,CACF,CACD,EACD,UAAU,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE;YAC3B,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBACrD,MAAM,GAAG,KAAK,CAAC;gBACf,OAAO,MAAM,CAAC,IAAI,CAAC;YACpB,CAAC;YACD,OAAO,QAAQ,CACd,QAAQ,CAAC,IAAI,CAAC,IAAI,CACjB,MAAM,CAAC,aAAa,CAAC,GAAG,EAAE,CAAC,mCAAmC,CAAC,EAC/D,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CACjG,CACD,CAAC;QACH,CAAC,CAAC,EACF,UAAU,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,cAAc,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAC/F,CAAC;IACH,CAAC,CAAC,CACF,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;AAC9C,CAAC"}

package/dist/server/otlpTracing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"otlpTracing.d.ts","sourceRoot":"","sources":["../../src/server/otlpTracing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAU,KAAK,EAAU,MAAM,QAAQ,CAAC;AAKvD,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,CAsC9D,CAAC"}
+{"version":3,"file":"otlpTracing.d.ts","sourceRoot":"","sources":["../../src/server/otlpTracing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAU,KAAK,EAAU,MAAM,QAAQ,CAAC;AAKvD,eAAO,MAAM,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,CAoD9D,CAAC"}

package/dist/server/otlpTracing.js

@@ -16,6 +16,17 @@ export const otlpTracing = Layer.unwrap(Effect.gen(function* () {
     const serviceName = yield* Config.String("OTEL_SERVICE_NAME").pipe(Config.withDefault(attributes["service.name"] ?? "unknown_service"));
     const serviceVersion = yield* Config.String("OTEL_SERVICE_VERSION").pipe(Config.withDefault(undefined));
     const headers = yield* Config.Record(Schema.String, Schema.StringFromUriComponent, "OTEL_EXPORTER_OTLP_HEADERS").pipe(Config.withDefault({}));
-    return OtlpTracer.layer({ headers, resource: { attributes, serviceName, serviceVersion }, url: endpoint.toString() }).pipe(Layer.provide(safeOtlpSerialization.pipe(Layer.provide(protocol === "http/protobuf" ? OtlpSerialization.layerProtobuf : OtlpSerialization.layerJson))), Layer.provide(otlpHttpClient));
+    const requestTimeout = yield* Config.Int("OTEL_EXPORTER_OTLP_TRACES_TIMEOUT").pipe(Config.orElse(() => Config.Int("OTEL_EXPORTER_OTLP_TIMEOUT")), Config.withDefault(10_000));
+    const exportInterval = yield* Config.Int("OTEL_BSP_SCHEDULE_DELAY").pipe(Config.withDefault(5000));
+    const maxBatchSize = yield* Config.Int("OTEL_BSP_MAX_EXPORT_BATCH_SIZE").pipe(Config.withDefault(1000));
+    const exportTimeout = yield* Config.Int("OTEL_BSP_EXPORT_TIMEOUT").pipe(Config.withDefault(3000));
+    return OtlpTracer.layer({
+        exportInterval,
+        headers,
+        maxBatchSize,
+        resource: { attributes, serviceName, serviceVersion },
+        shutdownTimeout: Math.min(exportTimeout, requestTimeout),
+        url: endpoint.toString(),
+    }).pipe(Layer.provide(safeOtlpSerialization.pipe(Layer.provide(protocol === "http/protobuf" ? OtlpSerialization.layerProtobuf : OtlpSerialization.layerJson))), Layer.provide(otlpHttpClient(requestTimeout)));
 }));
 //# sourceMappingURL=otlpTracing.js.map

package/dist/server/otlpTracing.js.map

@@ -1 +1 @@
-{"version":3,"file":"otlpTracing.js","sourceRoot":"","sources":["../../src/server/otlpTracing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,MAAM,CAAC,MAAM,WAAW,GAA2C,KAAK,CAAC,MAAM,CAC9E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACnB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC,IAAI,CAC5E,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAClB,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,IAAI,CAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAClB,GAAG,CAAC,QAAQ,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC;QAC/D,OAAO,GAAG,CAAC;IACZ,CAAC,CAAC,CACF,CACD,EACD,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAC7B,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,KAAK,CAAC;IACpB,CAAC;IACD,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,oCAAoC,CAAC,CAAC,IAAI,CACzF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,EACjE,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,CACnC,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CACzH,kBAAkB,CAClB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,UAAU,GAA2B,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAC9D,MAAM,CAAC,sBAAsB,EAC7B,MAAM,CAAC,sBAAsB,EAC7B,0BAA0B,CAC1B,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC;IACxI,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;IACxG,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,sBAAsB,EAAE,4BAA4B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9I,OAAO,UAAU,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,CACzH,KAAK,CAAC,OAAO,CACZ,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CACvI,EACD,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,CAC7B,CAAC;AACH,CAAC,CAAC,CACF,CAAC"}
+{"version":3,"file":"otlpTracing.js","sourceRoot":"","sources":["../../src/server/otlpTracing.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACvD,OAAO,EAAE,iBAAiB,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAElE,MAAM,CAAC,MAAM,WAAW,GAA2C,KAAK,CAAC,MAAM,CAC9E,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IACnB,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,oCAAoC,CAAC,CAAC,IAAI,CAC5E,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAClB,MAAM,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,IAAI,CAC7C,MAAM,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAClB,GAAG,CAAC,QAAQ,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,YAAY,CAAC;QAC/D,OAAO,GAAG,CAAC;IACZ,CAAC,CAAC,CACF,CACD,EACD,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAC7B,CAAC;IACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC5B,OAAO,KAAK,CAAC,KAAK,CAAC;IACpB,CAAC;IACD,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,oCAAoC,CAAC,CAAC,IAAI,CACzF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,EACjE,MAAM,CAAC,WAAW,CAAC,eAAe,CAAC,CACnC,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CACzH,kBAAkB,CAClB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,UAAU,GAA2B,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAC9D,MAAM,CAAC,sBAAsB,EAC7B,MAAM,CAAC,sBAAsB,EAC7B,0BAA0B,CAC1B,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,iBAAiB,CAAC,CAAC,CAAC;IACxI,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,sBAAsB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;IACxG,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,sBAAsB,EAAE,4BAA4B,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9I,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,mCAAmC,CAAC,CAAC,IAAI,CACjF,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC,EAC7D,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAC1B,CAAC;IACF,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACnG,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,gCAAgC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IACxG,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;IAClG,OAAO,UAAU,CAAC,KAAK,CAAC;QACvB,cAAc;QACd,OAAO;QACP,YAAY;QACZ,QAAQ,EAAE,EAAE,UAAU,EAAE,WAAW,EAAE,cAAc,EAAE;QACrD,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,aAAa,EAAE,cAAc,CAAC;QACxD,GAAG,EAAE,QAAQ,CAAC,QAAQ,EAAE;KACxB,CAAC,CAAC,IAAI,CACN,KAAK,CAAC,OAAO,CACZ,qBAAqB,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,iBAAiB,CAAC,aAAa,CAAC,CAAC,CAAC,iBAAiB,CAAC,SAAS,CAAC,CAAC,CACvI,EACD,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,cAAc,CAAC,CAAC,CAC7C,CAAC;AACH,CAAC,CAAC,CACF,CAAC"}

package/dist/server/rpc-server/sensitive.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sensitive.d.ts","sourceRoot":"","sources":["../../../src/server/rpc-server/sensitive.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,QAAQ,eAAe,CAAC;AAwBrC,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;AAQpD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOnD;AAYD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,GAAG,MAAM,CAGxE"}
+{"version":3,"file":"sensitive.d.ts","sourceRoot":"","sources":["../../../src/server/rpc-server/sensitive.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,QAAQ,eAAe,CAAC;AAwBrC,MAAM,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC;AAQpD,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAOnD;AA8BD,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,YAAY,GAAG,MAAM,CAGxE"}

package/dist/server/rpc-server/sensitive.js

@@ -21,7 +21,7 @@ const SENSITIVE_PARTS = [
     "xsrf",
 ];
 const SENSITIVE_WORDS = ["otp", "pin", "cvv", "cvc", "ssn", "iban"];
-const SENSITIVE_NAMES = ["session", "pan"];
+const SENSITIVE_NAMES = ["session", "pan", "sig"];
 function wordsOf(key) {
     return key
         .replaceAll(/(?<lower>[a-z0-9])(?<upper>[A-Z])/gu, "$<lower> $<upper>")
@@ -37,14 +37,33 @@ export function isSensitiveKey(key) {
 }
 const AUTH_SCHEME = /\b(?<scheme>Bearer|Basic)\s+[A-Za-z0-9._~+/-]+=*/giu;
 const JWT = /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*/gu;
+const PRIVATE_KEY = /-----BEGIN (?<kind>(?:[A-Z0-9]+ )*PRIVATE KEY)-----[\s\S]*?-----END \k<kind>-----/gu;
 const URL_PASSWORD = /(?<authority>\/\/[^:/\s@]+:)[^@/\s]+@/gu;
-const ASSIGNMENT = /(?<key>[A-Za-z][\w.-]*)(?<separator>["']?\s*[=:]\s*["']?)(?<value>[^\s"'&,;]+)/gu;
+function redactAssignments(text, sensitive) {
+    const matcher = /(?<key>[A-Za-z][\w.-]*)(?<separator>["']?\s*[=:]\s*["']?)(?<value>[^\s"'&,;]+)/gu;
+    let result = "";
+    let cursor = 0;
+    for (let match = matcher.exec(text); match !== null; match = matcher.exec(text)) {
+        const key = match[1] ?? "";
+        const separator = match[2] ?? "";
+        if (sensitive(key)) {
+            result += `${text.slice(cursor, match.index)}${key}${separator}${REDACTED}`;
+            cursor = matcher.lastIndex;
+        }
+        else if (match[3]?.includes("=")) {
+            // Revisit embedded parameters without parsing URL and source-location colons as assignments.
+            matcher.lastIndex = match.index + key.length + separator.length;
+        }
+    }
+    return result + text.slice(cursor);
+}
 function scrub(text, sensitive) {
-    return text
+    const credentials = text
+        .replaceAll(PRIVATE_KEY, REDACTED)
         .replaceAll(AUTH_SCHEME, `$<scheme> ${REDACTED}`)
         .replaceAll(JWT, REDACTED)
-        .replaceAll(URL_PASSWORD, `$<authority>${REDACTED}@`)
-        .replaceAll(ASSIGNMENT, (match, key, separator) => (sensitive(key) ? `${key}${separator}${REDACTED}` : match));
+        .replaceAll(URL_PASSWORD, `$<authority>${REDACTED}@`);
+    return redactAssignments(credentials, sensitive);
 }
 export function redactText(text, sensitive) {
     const scrubbed = scrub(text, sensitive);

package/dist/server/rpc-server/sensitive.js.map

@@ -1 +1 @@
-{"version":3,"file":"sensitive.js","sourceRoot":"","sources":["../../../src/server/rpc-server/sensitive.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AACrC,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,MAAM,eAAe,GAAG;IACvB,UAAU;IACV,YAAY;IACZ,QAAQ;IACR,OAAO;IACP,eAAe;IACf,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,KAAK;IACL,QAAQ;IACR,WAAW;IACX,WAAW;IACX,YAAY;IACZ,eAAe;IACf,MAAM;IACN,MAAM;CACN,CAAC;AACF,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AACpE,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;AAE3C,SAAS,OAAO,CAAC,GAAW;IAC3B,OAAO,GAAG;SACR,UAAU,CAAC,qCAAqC,EAAE,mBAAmB,CAAC;SACtE,UAAU,CAAC,wCAAwC,EAAE,oBAAoB,CAAC;SAC1E,WAAW,EAAE;SACb,KAAK,CAAC,UAAU,CAAC,CAAC;AACrB,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,GAAW;IACzC,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC9D,OAAO,CACN,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC;WACjC,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;WACzD,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAC9D,CAAC;AACH,CAAC;AACD,MAAM,WAAW,GAAG,qDAAqD,CAAC;AAC1E,MAAM,GAAG,GAAG,uDAAuD,CAAC;AACpE,MAAM,YAAY,GAAG,yCAAyC,CAAC;AAC/D,MAAM,UAAU,GAAG,kFAAkF,CAAC;AACtG,SAAS,KAAK,CAAC,IAAY,EAAE,SAAuB;IACnD,OAAO,IAAI;SACT,UAAU,CAAC,WAAW,EAAE,aAAa,QAAQ,EAAE,CAAC;SAChD,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,YAAY,EAAE,eAAe,QAAQ,GAAG,CAAC;SACpD,UAAU,CAAC,UAAU,EAAE,CAAC,KAAa,EAAE,GAAW,EAAE,SAAiB,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,SAAS,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;AACzI,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAAuB;IAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACxC,OAAO,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,UAAU,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClI,CAAC"}
+{"version":3,"file":"sensitive.js","sourceRoot":"","sources":["../../../src/server/rpc-server/sensitive.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AACrC,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,MAAM,eAAe,GAAG;IACvB,UAAU;IACV,YAAY;IACZ,QAAQ;IACR,OAAO;IACP,eAAe;IACf,QAAQ;IACR,QAAQ;IACR,WAAW;IACX,YAAY;IACZ,YAAY;IACZ,KAAK;IACL,QAAQ;IACR,WAAW;IACX,WAAW;IACX,YAAY;IACZ,eAAe;IACf,MAAM;IACN,MAAM;CACN,CAAC;AACF,MAAM,eAAe,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;AACpE,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;AAElD,SAAS,OAAO,CAAC,GAAW;IAC3B,OAAO,GAAG;SACR,UAAU,CAAC,qCAAqC,EAAE,mBAAmB,CAAC;SACtE,UAAU,CAAC,wCAAwC,EAAE,oBAAoB,CAAC;SAC1E,WAAW,EAAE;SACb,KAAK,CAAC,UAAU,CAAC,CAAC;AACrB,CAAC;AACD,MAAM,UAAU,cAAc,CAAC,GAAW;IACzC,MAAM,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC9D,OAAO,CACN,eAAe,CAAC,QAAQ,CAAC,UAAU,CAAC;WACjC,eAAe,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;WACzD,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAC9D,CAAC;AACH,CAAC;AACD,MAAM,WAAW,GAAG,qDAAqD,CAAC;AAC1E,MAAM,GAAG,GAAG,uDAAuD,CAAC;AACpE,MAAM,WAAW,GAAG,qFAAqF,CAAC;AAC1G,MAAM,YAAY,GAAG,yCAAyC,CAAC;AAC/D,SAAS,iBAAiB,CAAC,IAAY,EAAE,SAAuB;IAC/D,MAAM,OAAO,GAAG,kFAAkF,CAAC;IACnG,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,IAAI,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACjF,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3B,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACjC,IAAI,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;YACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,GAAG,SAAS,GAAG,QAAQ,EAAE,CAAC;YAC5E,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC;QAC5B,CAAC;aAAM,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YACpC,6FAA6F;YAC7F,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC;QACjE,CAAC;IACF,CAAC;IACD,OAAO,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;AACpC,CAAC;AACD,SAAS,KAAK,CAAC,IAAY,EAAE,SAAuB;IACnD,MAAM,WAAW,GAAG,IAAI;SACtB,UAAU,CAAC,WAAW,EAAE,QAAQ,CAAC;SACjC,UAAU,CAAC,WAAW,EAAE,aAAa,QAAQ,EAAE,CAAC;SAChD,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC;SACzB,UAAU,CAAC,YAAY,EAAE,eAAe,QAAQ,GAAG,CAAC,CAAC;IACvD,OAAO,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;AAClD,CAAC;AACD,MAAM,UAAU,UAAU,CAAC,IAAY,EAAE,SAAuB;IAC/D,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACxC,OAAO,QAAQ,CAAC,MAAM,GAAG,UAAU,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,UAAU,cAAc,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClI,CAAC"}

package/docs/roadmap.md

@@ -14,13 +14,13 @@ This file owns Platform's module implementation, package tests and scope questio
 - [x] An application runtime that acquires its Layer once, releases it exactly once, shares an explicit development cache key and recreates disposed cache entries, bypasses caching in production, and carries service overrides across Promise calls. [Runtime tests](https://github.com/ShivaeDev/platform/blob/main/packages/platform/src/server/runtime/makePlatform.test.ts) cover typed Layer build failures, Promise rejection, signal interruption with finalization, and nested override replacement and restoration.
 - [x] Node subscription cancellation from Web/procedure signals and simulated request/socket close events, with listener cleanup.
 - [x] A Better Auth Effect Prisma database adapter and Prisma/tRPC rollback harness. Real PostgreSQL tests cover shared transactions, failed transaction rollback, selected row operations and harness types; they require `PLATFORM_EFFECT_PRISMA_TEST_DATABASE_URL`.
-- [x] Better Auth adapter filters, ordering, pagination, projection, native-join rejection and configured model mapping have [PostgreSQL regression tests](https://github.com/ShivaeDev/platform/blob/main/packages/platform/src/server/better-auth/filterBoundaries.spec.ts).
+- [x] Better Auth adapter filters preserve PostgreSQL null, membership, comparison and literal-pattern semantics, including nonunique updates, OR-filter updates and deletes, and rejection of nonstring patterns. Configured model names map by default. Reads retain their filters through selection, ascending/descending ordering and limit/offset pagination; experimental native joins are rejected for both single and collection reads. [Adapter boundary tests](../src/server/better-auth/filterBoundaries.spec.ts) assert these paths against PostgreSQL.
 - [x] Packed-consumer checks for defining-module imports, types and core entries installed without optional peers.
 - [x] A local app host Layer and reusable database Layer, extracted from the PostgreSQL composition: migrations before services, guarded NDJSON RPC, session policy, static assets, scoped shutdown and commit-bound live delivery. The composed fixture covers two HTTP server processes and a worker. Fleet’s daemon adopts `appHost` and `appDatabase` with a custom RPC route, session-free loopback policy and its existing migration ledger. Platform’s real HTTP option tests cover hosting without a database, while Fleet’s PostgreSQL daemon tests cover pool limits, migration upgrades and existing clients.
 
 ## Next
 
-- [ ] Add adapter coverage for the `usePlural` option.
+- [ ] Add focused adapter tests for the remaining public options, `debugLogs` and `usePlural`.
 
 ## Open questions
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shivaedev/platform",
-  "version": "0.14.2",
+  "version": "0.14.3",
   "description": "Opinionated Effect application infrastructure for ShivaeDev services",
   "homepage": "https://github.com/ShivaeDev/platform/tree/main/packages/platform#readme",
   "bugs": {
@@ -389,7 +389,7 @@
     "@shivaedev/effect-prisma": "0.9.2",
     "@shivaedev/effect-trpc": "0.7.1",
     "@shivaedev/quality": "0.23.0",
-    "@shivaedev/test-story": "0.5.0",
+    "@shivaedev/test-story": "0.6.0",
     "@trpc/client": "11.19.0",
     "@trpc/server": "11.19.0",
     "@types/node": "24.19.2",

package/src/server/databaseAddress.ts

@@ -0,0 +1,25 @@
+import type { PgPoolConfig } from "@effect/sql-pg/PgClient";
+import { Redacted } from "effect";
+
+export function databaseAddress(value: Redacted.Redacted<string>): Pick<PgPoolConfig, "host" | "port"> {
+	try {
+		const url = new URL(Redacted.value(value));
+		if (url.protocol !== "postgres:" && url.protocol !== "postgresql:") {
+			return {};
+		}
+		const hostname = url.hostname.startsWith("[") ? url.hostname.slice(1, -1) : decodeURIComponent(url.hostname);
+		// PgConnection applies query parameters in order, after the authority.
+		const host = url.searchParams.getAll("host").at(-1) ?? hostname;
+		const rawPort = url.searchParams.getAll("port").at(-1) ?? url.port;
+		const port = rawPort === "" ? undefined : Number(rawPort);
+		if (host.includes(",") || (port !== undefined && (!Number.isInteger(port) || port < 1 || port > 65_535))) {
+			return {};
+		}
+		return {
+			...(host === "" && !url.searchParams.has("host") ? {} : { host }),
+			...(port === undefined ? {} : { port }),
+		};
+	} catch {
+		return {};
+	}
+}

package/src/server/databaseLayer.ts

@@ -6,6 +6,7 @@ import { assertPostgresMigrations } from "@shivaedev/effect-sql/assertPostgresMi
 import { migratePostgres } from "@shivaedev/effect-sql/migrations.ts";
 import { type PostgresChangesOptions, postgresChanges } from "@shivaedev/effect-sql/postgresChanges.ts";
 import type { AppChanges, AppDatabaseOptions } from "#server/appHost.ts";
+import { databaseAddress } from "./databaseAddress.ts";
 
 export interface DatabaseConfig {
 	readonly applicationName?: string;
@@ -20,6 +21,7 @@ export function databaseLayer<R>(options: AppDatabaseOptions<R>, changesService:
 			const url = options.config?.databaseUrl ?? (yield* Config.Redacted("DATABASE_URL"));
 			return PgClient.layer({
 				url,
+				...databaseAddress(url),
 				...(options.config?.maxConnections === undefined ? {} : { maxConnections: options.config.maxConnections }),
 				...(options.config?.applicationName === undefined ? {} : { applicationName: options.config.applicationName }),
 			});

package/src/server/otlpHttpClient.ts

@@ -1,35 +1,52 @@
 import { Effect, Layer } from "effect";
-import { FetchHttpClient, HttpClient } from "effect/http";
+import { FetchHttpClient, HttpClient, HttpClientError, type HttpClientRequest } from "effect/http";
 import { redactOtlpText } from "#safeOtlpSerialization.ts";
 
-export const otlpHttpClient = Layer.effect(
-	HttpClient.HttpClient,
-	Effect.gen(function* () {
-		const client = yield* HttpClient.HttpClient;
-		let warned = false;
-		function warnOnce(diagnostic: Effect.Effect<Record<string, unknown>>) {
-			return Effect.suspend(() => {
-				if (warned) {
-					return Effect.void;
-				}
-				warned = true;
-				return Effect.flatMap(diagnostic, (annotations) => Effect.logWarning("OTLP trace export failed").pipe(Effect.annotateLogs(annotations)));
-			});
-		}
-		return client.pipe(
-			HttpClient.tap((response) => {
-				if (response.status >= 200 && response.status < 300) {
-					warned = false;
-					return Effect.void;
-				}
-				return warnOnce(
-					response.text.pipe(
-						Effect.orElseSucceed(() => "Unable to read collector response"),
-						Effect.map((body) => ({ "otlp.response": redactOtlpText(body), "otlp.status": response.status })),
+function timeoutError(request: HttpClientRequest.HttpClientRequest) {
+	return new HttpClientError.HttpClientError({
+		reason: new HttpClientError.TransportError({ description: "OTLP export request timed out", request }),
+	});
+}
+
+export function otlpHttpClient(timeout = 10_000) {
+	return Layer.effect(
+		HttpClient.HttpClient,
+		Effect.gen(function* () {
+			const client = yield* HttpClient.HttpClient;
+			let warned = false;
+			function warnOnce(diagnostic: Effect.Effect<Record<string, unknown>>) {
+				return Effect.suspend(() => {
+					if (warned) {
+						return Effect.void;
+					}
+					warned = true;
+					return Effect.flatMap(diagnostic, (annotations) => Effect.logWarning("OTLP trace export failed").pipe(Effect.annotateLogs(annotations)));
+				});
+			}
+			return client.pipe(
+				HttpClient.tap((response) => response.arrayBuffer),
+				HttpClient.transform((requestEffect, request) =>
+					requestEffect.pipe(
+						Effect.timeoutOrElse({
+							duration: timeout,
+							orElse: () => Effect.fail(timeoutError(request)),
+						}),
 					),
-				);
-			}),
-			HttpClient.tapError((error) => warnOnce(Effect.succeed({ "otlp.failure": error.reason._tag }))),
-		);
-	}),
-).pipe(Layer.provide(FetchHttpClient.layer));
+				),
+				HttpClient.tap((response) => {
+					if (response.status >= 200 && response.status < 300) {
+						warned = false;
+						return Effect.void;
+					}
+					return warnOnce(
+						response.text.pipe(
+							Effect.orElseSucceed(() => "Unable to read collector response"),
+							Effect.map((body) => ({ "otlp.response": redactOtlpText(body), "otlp.status": response.status })),
+						),
+					);
+				}),
+				HttpClient.tapError((error) => warnOnce(Effect.succeed({ "otlp.failure": error.reason._tag }))),
+			);
+		}),
+	).pipe(Layer.provide(FetchHttpClient.layer));
+}

package/src/server/otlpTracing.ts

@@ -34,11 +34,25 @@ export const otlpTracing: Layer.Layer<never, Config.ConfigError> = Layer.unwrap(
 		const serviceName = yield* Config.String("OTEL_SERVICE_NAME").pipe(Config.withDefault(attributes["service.name"] ?? "unknown_service"));
 		const serviceVersion = yield* Config.String("OTEL_SERVICE_VERSION").pipe(Config.withDefault(undefined));
 		const headers = yield* Config.Record(Schema.String, Schema.StringFromUriComponent, "OTEL_EXPORTER_OTLP_HEADERS").pipe(Config.withDefault({}));
-		return OtlpTracer.layer({ headers, resource: { attributes, serviceName, serviceVersion }, url: endpoint.toString() }).pipe(
+		const requestTimeout = yield* Config.Int("OTEL_EXPORTER_OTLP_TRACES_TIMEOUT").pipe(
+			Config.orElse(() => Config.Int("OTEL_EXPORTER_OTLP_TIMEOUT")),
+			Config.withDefault(10_000),
+		);
+		const exportInterval = yield* Config.Int("OTEL_BSP_SCHEDULE_DELAY").pipe(Config.withDefault(5000));
+		const maxBatchSize = yield* Config.Int("OTEL_BSP_MAX_EXPORT_BATCH_SIZE").pipe(Config.withDefault(1000));
+		const exportTimeout = yield* Config.Int("OTEL_BSP_EXPORT_TIMEOUT").pipe(Config.withDefault(3000));
+		return OtlpTracer.layer({
+			exportInterval,
+			headers,
+			maxBatchSize,
+			resource: { attributes, serviceName, serviceVersion },
+			shutdownTimeout: Math.min(exportTimeout, requestTimeout),
+			url: endpoint.toString(),
+		}).pipe(
 			Layer.provide(
 				safeOtlpSerialization.pipe(Layer.provide(protocol === "http/protobuf" ? OtlpSerialization.layerProtobuf : OtlpSerialization.layerJson)),
 			),
-			Layer.provide(otlpHttpClient),
+			Layer.provide(otlpHttpClient(requestTimeout)),
 		);
 	}),
 );

package/src/server/rpc-server/sensitive.ts

@@ -21,7 +21,7 @@ const SENSITIVE_PARTS = [
 	"xsrf",
 ];
 const SENSITIVE_WORDS = ["otp", "pin", "cvv", "cvc", "ssn", "iban"];
-const SENSITIVE_NAMES = ["session", "pan"];
+const SENSITIVE_NAMES = ["session", "pan", "sig"];
 export type SensitiveKey = (key: string) => boolean;
 function wordsOf(key: string): string[] {
 	return key
@@ -40,14 +40,32 @@ export function isSensitiveKey(key: string): boolean {
 }
 const AUTH_SCHEME = /\b(?<scheme>Bearer|Basic)\s+[A-Za-z0-9._~+/-]+=*/giu;
 const JWT = /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]*/gu;
+const PRIVATE_KEY = /-----BEGIN (?<kind>(?:[A-Z0-9]+ )*PRIVATE KEY)-----[\s\S]*?-----END \k<kind>-----/gu;
 const URL_PASSWORD = /(?<authority>\/\/[^:/\s@]+:)[^@/\s]+@/gu;
-const ASSIGNMENT = /(?<key>[A-Za-z][\w.-]*)(?<separator>["']?\s*[=:]\s*["']?)(?<value>[^\s"'&,;]+)/gu;
+function redactAssignments(text: string, sensitive: SensitiveKey): string {
+	const matcher = /(?<key>[A-Za-z][\w.-]*)(?<separator>["']?\s*[=:]\s*["']?)(?<value>[^\s"'&,;]+)/gu;
+	let result = "";
+	let cursor = 0;
+	for (let match = matcher.exec(text); match !== null; match = matcher.exec(text)) {
+		const key = match[1] ?? "";
+		const separator = match[2] ?? "";
+		if (sensitive(key)) {
+			result += `${text.slice(cursor, match.index)}${key}${separator}${REDACTED}`;
+			cursor = matcher.lastIndex;
+		} else if (match[3]?.includes("=")) {
+			// Revisit embedded parameters without parsing URL and source-location colons as assignments.
+			matcher.lastIndex = match.index + key.length + separator.length;
+		}
+	}
+	return result + text.slice(cursor);
+}
 function scrub(text: string, sensitive: SensitiveKey): string {
-	return text
+	const credentials = text
+		.replaceAll(PRIVATE_KEY, REDACTED)
 		.replaceAll(AUTH_SCHEME, `$<scheme> ${REDACTED}`)
 		.replaceAll(JWT, REDACTED)
-		.replaceAll(URL_PASSWORD, `$<authority>${REDACTED}@`)
-		.replaceAll(ASSIGNMENT, (match: string, key: string, separator: string) => (sensitive(key) ? `${key}${separator}${REDACTED}` : match));
+		.replaceAll(URL_PASSWORD, `$<authority>${REDACTED}@`);
+	return redactAssignments(credentials, sensitive);
 }
 export function redactText(text: string, sensitive: SensitiveKey): string {
 	const scrubbed = scrub(text, sensitive);