@shivaedev/platform 0.18.2 → 0.20.0

package/src/server/appHostHttp.ts

@@ -4,17 +4,22 @@ import { ByteSize, Config, Effect, Layer, Option, Schema } from "effect";
 import { HttpIncomingMessage, HttpRouter, HttpServerRequest, HttpStaticServer } from "effect/http";
 import { type Rpc, RpcSerialization, RpcServer } from "effect/rpc";
 import type { Authenticated, MaybeAuthenticated, RequestTracing } from "#rpc/middleware.ts";
-import type { AppHttpHostOptions } from "#server/appHost.ts";
+import type { AppChanges, AppHttpHostOptions } from "#server/appHost.ts";
 import { boundedRpcRequest } from "#server/boundedRpcRequest.ts";
 import type { databaseLayer } from "#server/databaseLayer.ts";
 import { healthRoute } from "#server/healthRoute.ts";
+import { hostChanges } from "#server/hostChanges.ts";
 import type { HostOptions, HostPolicy } from "#server/hostOptions.ts";
 import type { MigrationOptions } from "#server/MigrationOptions.ts";
 import { otlpTracing } from "#server/otlpTracing.ts";
+import { RedactionPolicy } from "#server/RedactionPolicy.ts";
+import { redactingDiagnostics } from "#server/redactingDiagnostics.ts";
+import { redactingRpcSerialization } from "#server/redactingRpcSerialization.ts";
 import { localRpcGuard } from "#server/rpc-server/local.ts";
 import { authenticatedLayer, maybeAuthenticatedLayer, type SessionShape } from "#server/rpc-server/session.ts";
 import { requestTracingLayer } from "#server/rpc-server/tracing.ts";
 import { TrustedProxy } from "#server/rpc-server/trustedProxy.ts";
+import { schemaSensitiveKeys } from "#server/schemaSensitiveKeys.ts";
 import { tracedGroup } from "#server/tracedGroup.ts";
 export function appHostHttp<
 	TRpcs extends Rpc.Any,
@@ -27,7 +32,9 @@ export function appHostHttp<
 	TSession extends SessionShape,
 >(
 	options: HostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements> & HostPolicy<TSession>,
+	changesService: typeof AppChanges,
 ) {
+	const sensitive = schemaSensitiveKeys(options.group, options.config?.sensitiveKeys);
 	return Layer.unwrap(
 		Effect.gen(function* () {
 			const maxBodySize = options.config?.maxBodySize ?? (yield* Config.Int("MAX_BODY_SIZE").pipe(Config.withDefault(1024 * 1024)));
@@ -43,12 +50,14 @@ export function appHostHttp<
 			}
 			const middleware: Layer.Layer<RequestTracing> | Layer.Layer<Authenticated | MaybeAuthenticated | RequestTracing> =
 				options.policy === "loopback"
-					? requestTracingLayer()
-					: Layer.mergeAll(authenticatedLayer(options.sessions), maybeAuthenticatedLayer(options.sessions), requestTracingLayer());
+					? requestTracingLayer({ sensitive })
+					: Layer.mergeAll(authenticatedLayer(options.sessions), maybeAuthenticatedLayer(options.sessions), requestTracingLayer({ sensitive }));
 			const routes = HttpRouter.use((router) =>
 				Effect.gen(function* () {
-					const wire = yield* RpcSerialization.RpcSerialization;
-					const handler = yield* RpcServer.toHttpEffect(tracedGroup(options.group));
+					const wire = redactingRpcSerialization(yield* RpcSerialization.RpcSerialization, sensitive, sensitive.maskFailure);
+					const handler = yield* RpcServer.toHttpEffect(tracedGroup(options.group)).pipe(
+						Effect.provideService(RpcSerialization.RpcSerialization, wire),
+					);
 					const guarded = localRpcGuard(handler, trustedProxy);
 					yield* router.add("POST", options.rpcPath ?? "/rpc", (request) =>
 						guarded.pipe(
@@ -58,7 +67,10 @@ export function appHostHttp<
 						),
 					);
 				}),
-			).pipe(Layer.provide(Layer.merge(options.handlers, middleware)), Layer.provide(RpcSerialization.layerNdjson));
+			).pipe(
+				Layer.provide(Layer.mergeAll(options.handlers, middleware, hostChanges(options.group, changesService))),
+				Layer.provide(RpcSerialization.layerNdjson),
+			);
 			const assets =
 				options.assets === undefined
 					? Layer.empty
@@ -83,7 +95,7 @@ export function appHostHttp<
 				Layer.provide(NodeServices.layer),
 			);
 		}),
-	).pipe(Layer.provide(otlpTracing));
+	).pipe(Layer.provide(redactingDiagnostics(sensitive)), Layer.provide(otlpTracing), Layer.provide(Layer.succeed(RedactionPolicy, sensitive)));
 }
 
 export function migratedHost<
@@ -100,9 +112,10 @@ export function migratedHost<
 	options: HostOptions<TRpcs, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements> &
 		HostPolicy<TSession> & { readonly migrations: MigrationOptions<TMigrations> },
 	database: ReturnType<typeof databaseLayer<TMigrations>>,
+	changesService: typeof AppChanges,
 ) {
 	const services = Layer.mergeAll(options.services ?? Layer.empty);
-	return appHostHttp({ ...options, services: services.pipe(Layer.provideMerge(database)) });
+	return appHostHttp({ ...options, services: services.pipe(Layer.provideMerge(database)) }, changesService);
 }
 
 export function deferredHost<
@@ -124,6 +137,7 @@ export function deferredHost<
 		TApplicationRequirements
 	>,
 	database: ReturnType<typeof databaseLayer<TMigrations>>,
+	changesService: typeof AppChanges,
 ) {
-	return Layer.unwrap(Effect.map(application, (options) => appHostHttp(options))).pipe(Layer.provideMerge(database));
+	return Layer.unwrap(Effect.map(application, (options) => appHostHttp(options, changesService))).pipe(Layer.provideMerge(database));
 }

package/src/server/commandChanges.ts

@@ -0,0 +1,46 @@
+import { Context, Effect, Option } from "effect";
+import * as Reactivity from "effect/reactivity/Reactivity";
+import type { Rpc } from "effect/rpc";
+import { SqlClient } from "effect/sql";
+import { invalidationKeys } from "@shivaedev/effect-contract/keys.ts";
+import { CommandInvalidation } from "@shivaedev/effect-contract/serverMetadata.ts";
+import { ChangeObserver, invalidateOnCommit, transact } from "@shivaedev/effect-sql/transact.ts";
+
+export function commandChanges<A, E, R>(effect: Effect.Effect<A, E, R>, rpc: Rpc.AnyWithProps, payload: unknown) {
+	const invalidates = Context.getOption(rpc.annotations, CommandInvalidation);
+	if (Option.isNone(invalidates)) {
+		return effect;
+	}
+	const declared = invalidates.value;
+	return Effect.gen(function* () {
+		const sql = yield* Effect.serviceOption(SqlClient.SqlClient);
+		const reactivity = yield* Effect.serviceOption(Reactivity.Reactivity);
+		if (Option.isNone(reactivity)) {
+			return yield* effect;
+		}
+		const published = new Set<unknown>();
+		const observer = yield* ChangeObserver;
+		const result = yield* effect.pipe(
+			Effect.provideService(ChangeObserver, (event) => {
+				if (event._tag === "Published") {
+					for (const key of event.changes) {
+						published.add(key);
+					}
+				}
+				return observer(event);
+			}),
+		);
+		const keys = invalidationKeys(declared(payload, result)).filter((key) => !published.has(key));
+		if (keys.length > 0) {
+			const announce = Option.isNone(sql)
+				? reactivity.value.invalidate(keys)
+				: invalidateOnCommit(keys).pipe(
+						transact({ onSqlError: (error) => error }),
+						Effect.provideService(SqlClient.SqlClient, sql.value),
+						Effect.provideService(Reactivity.Reactivity, reactivity.value),
+					);
+			yield* announce.pipe(Effect.catchCause((cause) => Effect.logError("Committed command invalidation failed", cause)));
+		}
+		return result;
+	});
+}

package/src/server/databaseLayer.ts

@@ -1,5 +1,6 @@
+import { createHash } from "node:crypto";
 import * as PgClient from "@effect/sql-pg/PgClient";
-import { Config, Effect, Layer, type Redacted, Schedule } from "effect";
+import { Config, Effect, Layer, Redacted, Schedule } from "effect";
 import * as Reactivity from "effect/reactivity/Reactivity";
 import { makeLiveServer } from "@shivaedev/effect-contract/makeLiveServer.ts";
 import { assertPostgresMigrations } from "@shivaedev/effect-sql/assertPostgresMigrations.ts";
@@ -11,7 +12,7 @@ import { databaseAddress } from "./databaseAddress.ts";
 
 export interface DatabaseConfig extends SqlNameTransforms {
 	readonly applicationName?: string;
-	readonly changes?: Omit<PostgresChangesOptions, "client" | "resync">;
+	readonly changes?: Partial<Omit<PostgresChangesOptions, "client" | "resync">>;
 	readonly databaseUrl?: Redacted.Redacted<string>;
 	readonly maxConnections?: number;
 }
@@ -34,14 +35,14 @@ export function databaseLayer<R>(options: AppDatabaseOptions<R>, changesService:
 	const live = Layer.effect(changesService, makeLiveServer).pipe(Layer.provideMerge(Reactivity.layer));
 	const base = Layer.merge(prepared, live);
 	const changes = options.config?.changes;
-	if (changes === undefined) {
-		return base;
-	}
 	return Layer.unwrap(
 		Effect.gen(function* () {
 			const client = yield* PgClient.PgClient;
 			const hints = yield* changesService;
-			return postgresChanges({ ...changes, client, resync: hints.resync });
+			const url = options.config?.databaseUrl ?? (yield* Config.Redacted("DATABASE_URL"));
+			const name = yield* Config.String("APP_NAME").pipe(Config.withDefault(new URL(Redacted.value(url)).pathname));
+			const channel = changes?.channel ?? `changes_${createHash("sha256").update(name).digest("hex").slice(0, 32)}`;
+			return postgresChanges({ ...changes, channel, client, resync: hints.resync });
 		}),
 	).pipe(Layer.provideMerge(base));
 }

package/src/server/hostChanges.ts

@@ -0,0 +1,27 @@
+import { Context, Effect, Layer, Option } from "effect";
+import type { Rpc, RpcGroup } from "effect/rpc";
+import type { AppChanges } from "./appHost.ts";
+
+export function hostChanges<R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>, changesService: typeof AppChanges) {
+	return Layer.effectContext(
+		Effect.gen(function* () {
+			const changes = yield* Effect.serviceOption(changesService);
+			if (Option.isNone(changes)) {
+				return Context.empty();
+			}
+			const live = changes.value;
+			const services = yield* Effect.context<never>();
+			const handlers = new Map<string, unknown>();
+			for (const rpc of group.requests.values()) {
+				if (!rpc._tag.endsWith(".$changes")) {
+					continue;
+				}
+				function handler({ keys }: { readonly keys: Parameters<typeof live.stream>[0] }) {
+					return live.stream(keys);
+				}
+				handlers.set(rpc.key, { context: services, handler, tag: rpc._tag });
+			}
+			return Context.makeUnsafe(handlers);
+		}),
+	);
+}

package/src/server/hostOptions.ts

@@ -11,6 +11,7 @@ export type HostOptions<TRpcs extends Rpc.Any, THandlers, THandlerError, THandle
 		readonly host?: string;
 		readonly trustedProxy?: string;
 		readonly maxBodySize?: number;
+		readonly sensitiveKeys?: readonly string[];
 		readonly disablePreemptiveShutdown?: boolean;
 	};
 	readonly group: RpcGroup.RpcGroup<TRpcs>;

package/src/server/otlpHttpClient.ts

@@ -1,5 +1,6 @@
 import { Effect, Layer } from "effect";
 import { FetchHttpClient, HttpClient, HttpClientError, type HttpClientRequest } from "effect/http";
+import { RedactionPolicy } from "#server/RedactionPolicy.ts";
 import { redactOtlpText } from "#server/safeOtlpSerialization.ts";
 
 function timeoutError(request: HttpClientRequest.HttpClientRequest) {
@@ -13,6 +14,7 @@ export function otlpHttpClient(timeout = 10_000) {
 		HttpClient.HttpClient,
 		Effect.gen(function* () {
 			const client = yield* HttpClient.HttpClient;
+			const sensitive = yield* RedactionPolicy;
 			let warned = false;
 			function warnOnce(diagnostic: Effect.Effect<Record<string, unknown>>) {
 				return Effect.suspend(() => {
@@ -41,7 +43,7 @@ export function otlpHttpClient(timeout = 10_000) {
 					return warnOnce(
 						response.text.pipe(
 							Effect.orElseSucceed(() => "Unable to read collector response"),
-							Effect.map((body) => ({ "otlp.response": redactOtlpText(body), "otlp.status": response.status })),
+							Effect.map((body) => ({ "otlp.response": redactOtlpText(body, "", sensitive), "otlp.status": response.status })),
 						),
 					);
 				}),

package/src/server/otlpTracing.ts

@@ -1,6 +1,8 @@
 import { Config, Effect, Layer, Schema } from "effect";
 import { OtlpSerialization, OtlpTracer } from "effect/observability";
 import { otlpHttpClient } from "#server/otlpHttpClient.ts";
+import { RedactionPolicy } from "#server/RedactionPolicy.ts";
+import { redactingTracer } from "#server/redactingTracer.ts";
 import { safeOtlpSerialization } from "#server/safeOtlpSerialization.ts";
 
 export const otlpTracing: Layer.Layer<never, Config.ConfigError> = Layer.unwrap(
@@ -41,7 +43,7 @@ export const otlpTracing: Layer.Layer<never, Config.ConfigError> = Layer.unwrap(
 		const exportInterval = yield* Config.Int("OTEL_BSP_SCHEDULE_DELAY").pipe(Config.withDefault(5000));
 		const maxBatchSize = yield* Config.Int("OTEL_BSP_MAX_EXPORT_BATCH_SIZE").pipe(Config.withDefault(1000));
 		const exportTimeout = yield* Config.Int("OTEL_BSP_EXPORT_TIMEOUT").pipe(Config.withDefault(3000));
-		return OtlpTracer.layer({
+		const tracer = OtlpTracer.layer({
 			exportInterval,
 			headers,
 			maxBatchSize,
@@ -54,5 +56,6 @@ export const otlpTracing: Layer.Layer<never, Config.ConfigError> = Layer.unwrap(
 			),
 			Layer.provide(otlpHttpClient(requestTimeout)),
 		);
+		return redactingTracer(yield* RedactionPolicy).pipe(Layer.provideMerge(tracer));
 	}),
 );

package/src/server/redactingDiagnostics.ts

@@ -0,0 +1,33 @@
+import { Context, Effect, ErrorReporter, Layer, Logger, References } from "effect";
+import { redact } from "#server/rpc-server/redact.ts";
+import { redactDiagnosticCause, redactingErrorReporter } from "#server/rpc-server/redactCause.ts";
+import type { SensitiveKey } from "#server/rpc-server/sensitive.ts";
+
+export function redactRecord(values: Readonly<Record<string, unknown>>, sensitive: SensitiveKey): Record<string, unknown> {
+	return Object.fromEntries(Object.entries(values).map(([key, value]) => [key, sensitive(key) ? "<redacted>" : redact(value, sensitive)]));
+}
+export function redactingDiagnostics(sensitive: SensitiveKey) {
+	return Layer.effectContext(
+		Effect.gen(function* () {
+			const loggers = yield* Logger.CurrentLoggers;
+			const reporters = yield* ErrorReporter.CurrentErrorReporters;
+			const safeLoggers = new Set(
+				[...loggers].map((logger) =>
+					Logger.make((options) => {
+						const context = options.fiber.context;
+						const annotations = redactRecord(options.fiber.getRef(References.CurrentLogAnnotations), sensitive);
+						options.fiber.setContext(Context.add(context, References.CurrentLogAnnotations, annotations));
+						try {
+							return logger.log({ ...options, cause: redactDiagnosticCause(options.cause, sensitive), message: redact(options.message, sensitive) });
+						} finally {
+							options.fiber.setContext(context);
+						}
+					}),
+				),
+			);
+			return Context.make(Logger.CurrentLoggers, safeLoggers).pipe(
+				Context.add(ErrorReporter.CurrentErrorReporters, new Set([...reporters].map((reporter) => redactingErrorReporter(reporter, sensitive)))),
+			);
+		}),
+	);
+}

package/src/server/redactingRpcSerialization.ts

@@ -0,0 +1,85 @@
+import { Predicate } from "effect";
+import type { RpcSerialization } from "effect/rpc";
+import { redactWire } from "#server/rpc-server/redact.ts";
+import { REDACTED, type SensitiveKey } from "#server/rpc-server/sensitive.ts";
+
+function isRequestId(value: unknown): value is string | number {
+	return typeof value === "string" || typeof value === "number";
+}
+export function redactingRpcSerialization(
+	wire: RpcSerialization.RpcSerialization["Service"],
+	sensitive: SensitiveKey,
+	maskFailure: (tag: string | undefined, reason: "Fail" | "Die") => boolean = () => false,
+): typeof wire {
+	function reason(value: unknown, tag: string | undefined): unknown {
+		const redacted = redactWire(value, sensitive);
+		if (Predicate.isObjectOrArray(redacted)) {
+			if (Predicate.isTagged(value, "Fail") && maskFailure(tag, "Fail")) {
+				return { ...redacted, _tag: "Fail", error: REDACTED };
+			}
+			if (Predicate.isTagged(value, "Die") && maskFailure(tag, "Die")) {
+				return { ...redacted, _tag: "Die", defect: REDACTED };
+			}
+		}
+		if (
+			(Predicate.isTagged(value, "Fail") || Predicate.isTagged(value, "Die") || Predicate.isTagged(value, "Interrupt"))
+			&& Predicate.isObjectOrArray(redacted)
+		) {
+			return { ...redacted, _tag: value._tag };
+		}
+		return redacted;
+	}
+	function exit(value: unknown, tag: string | undefined): unknown {
+		if (Predicate.isTagged(value, "Failure") && Predicate.hasProperty(value, "cause")) {
+			const cause = Array.isArray(value.cause) ? value.cause.map((item) => reason(item, tag)) : redactWire(value.cause, sensitive);
+			return { ...value, cause };
+		}
+		return value;
+	}
+	return {
+		...wire,
+		makeUnsafe: () => {
+			const parser = wire.makeUnsafe();
+			const requests = new Map<string | number, string>();
+			function response(value: unknown): unknown {
+				if (Array.isArray(value)) {
+					return value.map(response);
+				}
+				if (Predicate.isTagged(value, "Defect") && Predicate.hasProperty(value, "defect")) {
+					return { ...value, defect: maskFailure(undefined, "Die") ? REDACTED : redactWire(value.defect, sensitive) };
+				}
+				if (
+					Predicate.isTagged(value, "Exit")
+					&& Predicate.hasProperty(value, "requestId")
+					&& isRequestId(value.requestId)
+					&& Predicate.hasProperty(value, "exit")
+				) {
+					const tag = requests.get(value.requestId);
+					requests.delete(value.requestId);
+					return { ...value, exit: exit(value.exit, tag) };
+				}
+				return value;
+			}
+			return {
+				...parser,
+				decode: (data) => {
+					const decoded = parser.decode(data);
+					for (const request of decoded) {
+						if (
+							Predicate.isTagged(request, "Request")
+							&& Predicate.hasProperty(request, "id")
+							&& isRequestId(request.id)
+							&& Predicate.hasProperty(request, "tag")
+							&& typeof request.tag === "string"
+							&& !requests.has(request.id)
+						) {
+							requests.set(request.id, request.tag);
+						}
+					}
+					return decoded;
+				},
+				encode: (value) => parser.encode(response(value)),
+			};
+		},
+	};
+}

package/src/server/redactingTracer.ts

@@ -0,0 +1,37 @@
+import { Effect, Exit, Layer, Tracer } from "effect";
+import { redactRecord } from "#server/redactingDiagnostics.ts";
+import { redact } from "#server/rpc-server/redact.ts";
+import { redactDiagnosticCause } from "#server/rpc-server/redactCause.ts";
+import { REDACTED, type SensitiveKey } from "#server/rpc-server/sensitive.ts";
+
+function redactLinks(values: readonly Tracer.SpanLink[], sensitive: SensitiveKey) {
+	return values.map((link) => ({ ...link, attributes: redactRecord(link.attributes, sensitive) }));
+}
+function redactSpan(span: Tracer.Span, sensitive: SensitiveKey) {
+	const end = span.end.bind(span);
+	const attribute = span.attribute.bind(span);
+	const event = span.event.bind(span);
+	const addLinks = span.addLinks.bind(span);
+	return Object.assign(span, {
+		addLinks: (values: readonly Tracer.SpanLink[]) => addLinks(redactLinks(values, sensitive)),
+		attribute: (key: string, value: unknown) => attribute(key, sensitive(key) ? REDACTED : redact(value, sensitive)),
+		end: (time: bigint, exit: Exit.Exit<unknown, unknown>) => {
+			for (const [key, value] of span.attributes) {
+				attribute(key, sensitive(key) ? REDACTED : redact(value, sensitive));
+			}
+			end(time, Exit.isFailure(exit) ? Exit.failCause(redactDiagnosticCause(exit.cause, sensitive)) : exit);
+		},
+		event: (name: string, time: bigint, attributes?: Record<string, unknown>) => event(name, time, attributes && redactRecord(attributes, sensitive)),
+	});
+}
+export function redactingTracer(sensitive: SensitiveKey) {
+	return Layer.effect(
+		Tracer.Tracer,
+		Effect.map(Tracer.Tracer, (tracer) =>
+			Tracer.make({
+				...tracer,
+				span: (options) => redactSpan(tracer.span({ ...options, links: redactLinks(options.links, sensitive) }), sensitive),
+			}),
+		),
+	);
+}

package/src/server/rpc-server/redact.ts

@@ -1,5 +1,5 @@
 import { Predicate, Redacted } from "effect";
-import { isSensitiveKey, REDACTED, redactText, type SensitiveKey } from "./sensitive.ts";
+import { isSensitiveKey, REDACTED, redactErrorStack, redactText, type SensitiveKey } from "#server/rpc-server/sensitive.ts";
 
 const MAX_DEPTH = 8;
 const MAX_ENTRIES = 50;
@@ -12,7 +12,7 @@ function binary(value: object): string | undefined {
 	}
 	return undefined;
 }
-function entriesOf(value: object): [string, unknown][] {
+function entriesOf(value: object, sensitive: SensitiveKey, bounded: boolean): [string, unknown][] {
 	const entries = Object.entries(value);
 	if (!Predicate.isError(value)) {
 		return entries;
@@ -20,37 +20,45 @@ function entriesOf(value: object): [string, unknown][] {
 	const shape: [string, unknown][] = [
 		["name", value.name],
 		["message", value.message],
-		["stack", value.stack],
+		["stack", bounded ? redactErrorStack(value, sensitive) : value.stack],
 	];
-	return value.cause === undefined ? [...shape, ...entries] : [...shape, ...entries, ["cause", value.cause]];
+	const extra = entries.filter(([key]) => !["name", "message", "stack", "cause"].includes(key));
+	return value.cause === undefined ? [...shape, ...extra] : [...shape, ...extra, ["cause", value.cause]];
 }
-function walk(value: unknown, sensitive: SensitiveKey, depth: number): unknown {
+function collection(value: object, sensitive: SensitiveKey, depth: number, bounded: boolean): unknown {
+	if (Array.isArray(value)) {
+		const items = value.slice(0, bounded ? MAX_ENTRIES : value.length).map((item) => walk(item, sensitive, depth + 1, bounded));
+		return bounded && value.length > MAX_ENTRIES ? [...items, `<${value.length - MAX_ENTRIES} more items>`] : items;
+	}
+	const entries = entriesOf(value, sensitive, bounded);
+	const kept = entries.slice(0, bounded ? MAX_ENTRIES : entries.length).map(([key, nested]): [string, unknown] => {
+		const stackHeader = key === "stack" && typeof nested === "string" && (sensitive("name") || sensitive("message"));
+		return [key, sensitive(key) || stackHeader ? REDACTED : walk(nested, sensitive, depth + 1, bounded)];
+	});
+	return Object.fromEntries(bounded && entries.length > MAX_ENTRIES ? [...kept, ["<truncated>", `${entries.length - MAX_ENTRIES} more keys`]] : kept);
+}
+function walk(value: unknown, sensitive: SensitiveKey, depth: number, bounded: boolean): unknown {
 	if (Redacted.isRedacted(value)) {
 		return REDACTED;
 	}
 	if (Predicate.isString(value)) {
-		return redactText(value, sensitive);
+		return bounded ? redactText(value, sensitive) : redactText(value, sensitive, Number.POSITIVE_INFINITY);
 	}
 	if (!Predicate.isObjectOrArray(value)) {
 		return value;
 	}
 	const summary = binary(value);
 	if (summary !== undefined) {
-		return summary;
+		return bounded ? summary : value;
 	}
-	if (depth >= MAX_DEPTH) {
+	if (bounded && depth >= MAX_DEPTH) {
 		return "<truncated>";
 	}
-	if (Array.isArray(value)) {
-		const items = value.slice(0, MAX_ENTRIES).map((item) => walk(item, sensitive, depth + 1));
-		return value.length > MAX_ENTRIES ? [...items, `<${value.length - MAX_ENTRIES} more items>`] : items;
-	}
-	const entries = entriesOf(value);
-	const kept = entries
-		.slice(0, MAX_ENTRIES)
-		.map(([key, nested]): [string, unknown] => [key, sensitive(key) ? REDACTED : walk(nested, sensitive, depth + 1)]);
-	return Object.fromEntries(entries.length > MAX_ENTRIES ? [...kept, ["<truncated>", `${entries.length - MAX_ENTRIES} more keys`]] : kept);
+	return collection(value, sensitive, depth, bounded);
 }
 export function redact(value: unknown, sensitive: SensitiveKey = isSensitiveKey): unknown {
-	return walk(value, sensitive, 0);
+	return walk(value, sensitive, 0, true);
+}
+export function redactWire(value: unknown, sensitive: SensitiveKey = isSensitiveKey): unknown {
+	return walk(value, sensitive, 0, false);
 }

package/src/server/rpc-server/redactCause.ts

@@ -1,6 +1,6 @@
-import { Cause, Context, ErrorReporter, Predicate } from "effect";
-import { redact } from "./redact.ts";
-import { isSensitiveKey, redactText, type SensitiveKey } from "./sensitive.ts";
+import { Cause, Context, ErrorReporter, Predicate, type References } from "effect";
+import { redact } from "#server/rpc-server/redact.ts";
+import { isSensitiveKey, REDACTED, redactErrorStack, redactText, type SensitiveKey } from "#server/rpc-server/sensitive.ts";
 
 function reporterHints(error: Error, sensitive: SensitiveKey) {
 	return {
@@ -9,16 +9,24 @@ function reporterHints(error: Error, sensitive: SensitiveKey) {
 		...(ErrorReporter.attributes in error ? { [ErrorReporter.attributes]: redact(ErrorReporter.getAttributes(error), sensitive) } : {}),
 	};
 }
+function errorText(key: string, value: string, sensitive: SensitiveKey): string {
+	return sensitive(key) ? REDACTED : redactText(value, sensitive);
+}
 function redactError(error: Error, sensitive: SensitiveKey): Error {
-	const options = error.cause === undefined ? undefined : { cause: redact(error.cause, sensitive) };
-	const copy = new Error(redactText(error.message, sensitive), options);
-	Object.defineProperty(copy, "name", { configurable: true, value: error.name, writable: true });
+	const cause = sensitive("cause") ? REDACTED : redact(error.cause, sensitive);
+	const options = error.cause === undefined ? undefined : { cause };
+	const copy = Object.assign(
+		new Error(errorText("message", error.message, sensitive), options),
+		redact(Object.fromEntries(Object.entries(error)), sensitive),
+		reporterHints(error, sensitive),
+	);
+	Object.defineProperty(copy, "name", { configurable: true, value: errorText("name", error.name, sensitive), writable: true });
 	Object.defineProperty(copy, "stack", {
 		configurable: true,
-		value: error.stack === undefined ? undefined : redactText(error.stack, sensitive),
+		value: redactErrorStack(error, sensitive),
 		writable: true,
 	});
-	return Object.assign(copy, redact(Object.fromEntries(Object.entries(error)), sensitive), reporterHints(error, sensitive));
+	return copy;
 }
 export function redactDefect(defect: unknown, sensitive: SensitiveKey = isSensitiveKey): unknown {
 	return Predicate.isError(defect) ? redactError(defect, sensitive) : redact(defect, sensitive);
@@ -32,9 +40,65 @@ export function redactCause<E>(cause: Cause.Cause<E>, sensitive: SensitiveKey =
 		),
 	);
 }
+function diagnosticReason(reason: Cause.Reason<unknown>, sensitive: SensitiveKey): Cause.Cause<unknown> {
+	switch (reason._tag) {
+		case "Fail":
+			return Cause.fail(redactDefect(reason.error, sensitive));
+		case "Die":
+			return Cause.die(redactDefect(reason.defect, sensitive));
+		case "Interrupt":
+			return Cause.interrupt(reason.fiberId);
+	}
+}
+function stackFrame(frame: References.StackFrame | undefined, sensitive: SensitiveKey, remaining = 8): References.StackFrame | undefined {
+	if (frame === undefined || remaining === 0) {
+		return undefined;
+	}
+	return {
+		name: sensitive("name") ? REDACTED : redactText(frame.name, sensitive),
+		parent: stackFrame(frame.parent, sensitive, remaining - 1),
+		stack: () => {
+			const value = frame.stack();
+			if (value === undefined) {
+				return undefined;
+			}
+			return sensitive("name") || sensitive("message") ? REDACTED : redactText(value, sensitive);
+		},
+	};
+}
+function diagnosticAnnotations(reason: Cause.Reason<unknown>, sensitive: SensitiveKey) {
+	const nativeStacks: Context.Key<Cause.StackTrace | Cause.InterruptorStackTrace, References.StackFrame>[] = [
+		Cause.StackTrace,
+		Cause.InterruptorStackTrace,
+	];
+	const annotations = new Map(
+		[...reason.annotations]
+			.filter(([key]) => !nativeStacks.some((service) => service.key === key))
+			.map(([key, value]) => [key, sensitive(key) ? REDACTED : redact(value, sensitive)]),
+	);
+	if (!sensitive("stack")) {
+		const context = Cause.reasonAnnotations(reason);
+		for (const service of nativeStacks) {
+			const frame = Context.getOrUndefined(context, service);
+			if (frame !== undefined && !sensitive(service.key)) {
+				annotations.set(service.key, stackFrame(frame, sensitive));
+			}
+		}
+	}
+	return annotations;
+}
+export function redactDiagnosticCause(cause: Cause.Cause<unknown>, sensitive: SensitiveKey = isSensitiveKey): Cause.Cause<unknown> {
+	return Cause.fromReasons(
+		cause.reasons.flatMap((reason) => {
+			const redacted = diagnosticReason(reason, sensitive);
+			const annotations = diagnosticAnnotations(reason, sensitive);
+			return Cause.annotate(redacted, Context.makeUnsafe(annotations), { overwrite: true }).reasons;
+		}),
+	);
+}
 export function redactingErrorReporter(reporter: ErrorReporter.ErrorReporter, sensitive: SensitiveKey = isSensitiveKey): ErrorReporter.ErrorReporter {
 	return {
 		[ErrorReporter.TypeId]: ErrorReporter.TypeId,
-		report: (options) => reporter.report({ ...options, cause: redactCause(options.cause, sensitive) }),
+		report: (options) => reporter.report({ ...options, cause: redactDiagnosticCause(options.cause, sensitive) }),
 	};
 }

package/src/server/rpc-server/sensitive.ts

@@ -67,7 +67,13 @@ function scrub(text: string, sensitive: SensitiveKey): string {
 		.replaceAll(URL_PASSWORD, `$<authority>${REDACTED}@`);
 	return redactAssignments(credentials, sensitive);
 }
-export function redactText(text: string, sensitive: SensitiveKey): string {
+export function redactText(text: string, sensitive: SensitiveKey, maxLength = MAX_STRING): string {
 	const scrubbed = scrub(text, sensitive);
-	return scrubbed.length > MAX_STRING ? `${scrubbed.slice(0, MAX_STRING)}…<${scrubbed.length - MAX_STRING} more chars>` : scrubbed;
+	return scrubbed.length > maxLength ? `${scrubbed.slice(0, maxLength)}…<${scrubbed.length - maxLength} more chars>` : scrubbed;
+}
+export function redactErrorStack(error: Error, sensitive: SensitiveKey): string | undefined {
+	if (error.stack === undefined) {
+		return undefined;
+	}
+	return ["message", "name", "stack"].some((key) => sensitive(key)) ? REDACTED : redactText(error.stack, sensitive);
 }