@shivaedev/server 0.0.0-stage → 0.1.0

package/src/development.ts

@@ -0,0 +1,34 @@
+import process from "node:process";
+import { NodeRuntime, NodeServices } from "@effect/platform-node";
+import { Effect } from "effect";
+import { ChildProcess, ChildProcessSpawner } from "effect/process";
+
+export interface DevelopmentOptions {
+	readonly conditions?: readonly string[];
+	readonly server: string;
+	readonly worker: string;
+}
+
+export const development = Effect.fn("Platform.development")(function* ({ server, worker, conditions = [] }: DevelopmentOptions) {
+	const spawner = yield* ChildProcessSpawner.ChildProcessSpawner;
+	const options = { stderr: "inherit", stdout: "inherit" } as const;
+	const args = [...conditions.map((condition) => `--conditions=${condition}`), "--watch"];
+	return yield* Effect.raceAll([
+		spawner.exitCode(ChildProcess.make(process.execPath, [...args, server], options)),
+		spawner.exitCode(ChildProcess.make(process.execPath, [...args, worker], options)),
+		spawner.exitCode(ChildProcess.make("pnpm", ["exec", "vite"], options)),
+	]);
+});
+
+export function runDevelopment(options: DevelopmentOptions): void {
+	NodeRuntime.runMain(
+		development(options).pipe(
+			Effect.tap((code) =>
+				Effect.sync(() => {
+					process.exitCode = code;
+				}),
+			),
+			Effect.provide(NodeServices.layer),
+		),
+	);
+}

package/src/healthRoute.ts

@@ -0,0 +1,27 @@
+import { Effect, Fiber, Option } from "effect";
+import { HttpRouter, HttpServerResponse } from "effect/http";
+import { SqlClient } from "effect/sql";
+
+export const healthRoute = HttpRouter.use((router) =>
+	Effect.gen(function* () {
+		const database = yield* Effect.serviceOption(SqlClient.SqlClient);
+		const scope = yield* Effect.scope;
+		const probe = Effect.gen(function* () {
+			if (Option.isNone(database)) {
+				return 503;
+			}
+			const query = yield* database.value`select 1`.pipe(Effect.forkIn(scope));
+			return yield* Fiber.join(query).pipe(
+				Effect.timeout("2 seconds"),
+				// Driver cancellation may need network I/O; keep cleanup in the host scope without delaying the response.
+				Effect.ensuring(Fiber.interrupt(query).pipe(Effect.forkIn(scope), Effect.asVoid)),
+				Effect.match({ onFailure: () => 503, onSuccess: () => 200 }),
+			);
+		});
+		yield* router.add(
+			"GET",
+			"/health",
+			Effect.map(probe, (status) => HttpServerResponse.empty({ headers: { "cache-control": "no-store" }, status })),
+		);
+	}),
+);

package/src/hostChanges.ts

@@ -0,0 +1,34 @@
+import { Context, Effect, Layer, Option, Stream } from "effect";
+import type { Rpc, RpcGroup } from "effect/rpc";
+import type { QueryReference } from "@shivaedev/contract/serverMetadata.ts";
+import { resolveChanges } from "@shivaedev/identity/server/sessionKeys.ts";
+import type { AppChanges } from "./appHost.ts";
+
+export function hostChanges<R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>, changesService: typeof AppChanges) {
+	return Layer.effectContext(
+		Effect.gen(function* () {
+			const changes = yield* Effect.serviceOption(changesService);
+			const services = yield* Effect.context<never>();
+			const handlers = new Map<string, unknown>();
+			for (const rpc of group.requests.values()) {
+				if (!rpc._tag.endsWith(".$changes")) {
+					continue;
+				}
+				const provided = services.mapUnsafe.get(rpc.key);
+				if (Option.isNone(changes) && provided !== undefined) {
+					handlers.set(rpc.key, provided);
+					continue;
+				}
+				function handler({ queries }: { readonly queries: readonly QueryReference[] }) {
+					return Stream.unwrap(
+						Effect.map(resolveChanges(rpc, queries), ({ keys, context }) =>
+							Option.isSome(changes) ? changes.value.stream(keys, context) : Stream.never,
+						),
+					);
+				}
+				handlers.set(rpc.key, { context: services, handler, tag: rpc._tag });
+			}
+			return Context.makeUnsafe<Rpc.ToHandler<Extract<R, { readonly _tag: `${string}.$changes` }>>>(handlers);
+		}),
+	);
+}

package/src/hostOptions.ts

@@ -0,0 +1,30 @@
+import type { Duration, Layer } from "effect";
+import type { HttpRouter, HttpStaticServer } from "effect/http";
+import type { Rpc, RpcGroup } from "effect/rpc";
+import type { SessionPolicy, SessionShape } from "@shivaedev/identity/server/session.ts";
+import type { AppDatabaseOptions } from "./appHost.ts";
+
+export type HostOptions<TRpcs extends Rpc.Any, THandlers, THandlerError, THandlerRequirements, TServices, TServiceError, TServiceRequirements> = {
+	readonly assets?: string | Parameters<typeof HttpStaticServer.layer>[0];
+	readonly config?: AppDatabaseOptions["config"] & {
+		readonly port?: number;
+		readonly host?: string;
+		readonly trustedProxy?: string;
+		readonly maxBodySize?: number;
+		readonly sensitiveKeys?: readonly string[];
+		readonly disablePreemptiveShutdown?: boolean;
+		readonly gracefulShutdownTimeout?: Duration.Input;
+	};
+	readonly group: RpcGroup.RpcGroup<TRpcs>;
+	readonly handlers: Layer.Layer<THandlers, THandlerError, THandlerRequirements>;
+	readonly nativeOrigins?: readonly string[];
+	readonly routes?: Layer.Layer<never, never, HttpRouter.HttpRouter | HttpRouter.Request<"Error", unknown>>;
+	readonly rpcPath?: HttpRouter.PathInput;
+} & (
+	| { readonly services: Layer.Layer<TServices, TServiceError, TServiceRequirements> }
+	| ([TServices | TServiceError | TServiceRequirements] extends [never] ? { readonly services?: never } : never)
+);
+
+export type HostPolicy<TSession extends SessionShape> =
+	| { readonly policy?: undefined; readonly sessions: SessionPolicy<TSession> }
+	| { readonly policy: "loopback"; readonly sessions?: never };

package/src/hostTransport.ts

@@ -0,0 +1,26 @@
+import { Config, Effect, Option, Schema } from "effect";
+import { TrustedProxy } from "@shivaedev/identity/server/trustedProxy.ts";
+import { NativeOrigins } from "#nativeClientOrigins.ts";
+
+interface Options {
+	readonly config?: { readonly maxBodySize?: number; readonly trustedProxy?: string };
+	readonly nativeOrigins?: readonly string[];
+	readonly policy?: "loopback" | undefined;
+}
+export const hostTransport = Effect.fn("Platform.hostTransport")(function* (options: Options) {
+	const maxBodySize = options.config?.maxBodySize ?? (yield* Config.Int("MAX_BODY_SIZE").pipe(Config.withDefault(1024 * 1024)));
+	const bodySize = yield* Schema.decodeUnknownEffect(Schema.Int.check(Schema.isGreaterThanOrEqualTo(0)))(maxBodySize).pipe(
+		Effect.mapError((cause) => new Config.ConfigError(cause)),
+	);
+	const trustedProxy =
+		options.policy === "loopback"
+			? undefined
+			: (options.config?.trustedProxy ?? Option.getOrUndefined(yield* Config.String("TRUSTED_PROXY").pipe(Config.option)));
+	if (trustedProxy !== undefined) {
+		yield* Schema.decodeUnknownEffect(TrustedProxy)(trustedProxy).pipe(Effect.mapError((cause) => new Config.ConfigError(cause)));
+	}
+	const nativeOrigins = yield* Schema.decodeUnknownEffect(NativeOrigins)(options.nativeOrigins ?? []).pipe(
+		Effect.mapError((cause) => new Config.ConfigError(cause)),
+	);
+	return { bodySize, nativeOrigins, trustedProxy };
+});

package/src/nativeClientOrigins.ts

@@ -0,0 +1,44 @@
+import { Effect, Schema } from "effect";
+import { Headers, HttpMiddleware, HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
+import { localTransport } from "@shivaedev/identity/server/local.ts";
+
+export const NativeOrigins = Schema.Array(
+	Schema.String.check(
+		Schema.makeFilter((origin) => {
+			try {
+				const url = new URL(origin);
+				const authority = url.origin === "null" ? `${url.protocol}//${url.host}` : url.origin;
+				return url.host !== "" && !origin.includes("*") && authority === origin;
+			} catch {
+				return false;
+			}
+		}),
+	),
+);
+
+export function nativeClientOrigins(origins: readonly string[], trustedProxy: string | undefined, auth = false) {
+	const allowed = localTransport(trustedProxy, origins);
+	const cors = HttpMiddleware.cors({
+		allowedHeaders: ["Authorization", "Content-Type"],
+		allowedMethods: auth ? ["GET", "POST"] : ["POST"],
+		allowedOrigins: (origin) => origins.includes(origin),
+		credentials: false,
+		exposedHeaders: auth ? ["set-auth-token"] : [],
+	});
+	return HttpRouter.middleware((effect) =>
+		Effect.gen(function* () {
+			const request = yield* HttpServerRequest.HttpServerRequest;
+			if (auth && !request.url.split("?")[0]?.startsWith("/api/auth/")) {
+				return yield* effect;
+			}
+			if ((auth || request.method === "OPTIONS") && !allowed(request)) {
+				return HttpServerResponse.text("Local same-origin requests only", { status: 403 });
+			}
+			if (!origins.includes(request.headers.origin ?? "")) {
+				return yield* effect;
+			}
+			const native = request.modify({ headers: Headers.remove(request.headers, "cookie") });
+			return yield* cors(effect).pipe(Effect.provideService(HttpServerRequest.HttpServerRequest, native));
+		}),
+	).layer;
+}

package/src/node-http/subscriptionSignal.ts

@@ -0,0 +1,64 @@
+import type { IncomingMessage } from "node:http";
+export interface NodeSubscriptionSignalOptions {
+	readonly nodeRequest?: IncomingMessage | undefined;
+	readonly request?: Request | undefined;
+	readonly signals?: Iterable<AbortSignal | undefined>;
+}
+export interface NodeSubscriptionSignal {
+	readonly dispose: () => void;
+	readonly signal: AbortSignal;
+}
+function property(value: unknown, key: string): unknown {
+	return typeof value === "object" && value !== null ? Reflect.get(value, key) : undefined;
+}
+function isIncomingMessage(value: unknown): value is IncomingMessage {
+	return typeof property(value, "socket") === "object" && typeof property(value, "once") === "function";
+}
+function nodeRequestFrom(request: Request | undefined): IncomingMessage | undefined {
+	const req = property(property(property(request, "runtime"), "node"), "req");
+	return isIncomingMessage(req) ? req : undefined;
+}
+// Under Bun's node:http compatibility layer a Web request signal may miss an abandoned socket, so node close events cover long-lived responses.
+export function nodeSubscriptionSignal(options: NodeSubscriptionSignalOptions): NodeSubscriptionSignal {
+	const controller = new AbortController();
+	const signals: AbortSignal[] = [controller.signal];
+	if (options.request !== undefined) {
+		signals.push(options.request.signal);
+	}
+	for (const signal of options.signals ?? []) {
+		if (signal !== undefined) {
+			signals.push(signal);
+		}
+	}
+	const nodeRequest = options.nodeRequest ?? nodeRequestFrom(options.request);
+	if (nodeRequest === undefined) {
+		return { dispose: (): void => undefined, signal: AbortSignal.any(signals) };
+	}
+	const request = nodeRequest;
+	const socket = request.socket;
+	function onRequestClose() {
+		if (!request.complete) {
+			controller.abort();
+		}
+	}
+	function onSocketClose() {
+		return controller.abort();
+	}
+	nodeRequest.once("close", onRequestClose);
+	socket.once("close", onSocketClose);
+	if (nodeRequest.destroyed || socket.destroyed) {
+		controller.abort();
+	}
+	let disposed = false;
+	return {
+		dispose: () => {
+			if (disposed) {
+				return;
+			}
+			disposed = true;
+			nodeRequest.removeListener("close", onRequestClose);
+			socket.removeListener("close", onSocketClose);
+		},
+		signal: AbortSignal.any(signals),
+	};
+}

package/src/otlpHttpClient.ts

@@ -0,0 +1,54 @@
+import { Effect, Layer } from "effect";
+import { FetchHttpClient, HttpClient, HttpClientError, type HttpClientRequest } from "effect/http";
+import { RedactionPolicy } from "#RedactionPolicy.ts";
+import { redactOtlpText } from "#safeOtlpSerialization.ts";
+
+function timeoutError(request: HttpClientRequest.HttpClientRequest) {
+	return new HttpClientError.HttpClientError({
+		reason: new HttpClientError.TransportError({ description: "OTLP export request timed out", request }),
+	});
+}
+
+export function otlpHttpClient(timeout = 10_000) {
+	return Layer.effect(
+		HttpClient.HttpClient,
+		Effect.gen(function* () {
+			const client = yield* HttpClient.HttpClient;
+			const sensitive = yield* RedactionPolicy;
+			let warned = false;
+			function warnOnce(diagnostic: Effect.Effect<Record<string, unknown>>) {
+				return Effect.suspend(() => {
+					if (warned) {
+						return Effect.void;
+					}
+					warned = true;
+					return Effect.flatMap(diagnostic, (annotations) => Effect.logWarning("OTLP trace export failed").pipe(Effect.annotateLogs(annotations)));
+				});
+			}
+			return client.pipe(
+				HttpClient.tap((response) => response.arrayBuffer),
+				HttpClient.transform((requestEffect, request) =>
+					requestEffect.pipe(
+						Effect.timeoutOrElse({
+							duration: timeout,
+							orElse: () => Effect.fail(timeoutError(request)),
+						}),
+					),
+				),
+				HttpClient.tap((response) => {
+					if (response.status >= 200 && response.status < 300) {
+						warned = false;
+						return Effect.void;
+					}
+					return warnOnce(
+						response.text.pipe(
+							Effect.orElseSucceed(() => "Unable to read collector response"),
+							Effect.map((body) => ({ "otlp.response": redactOtlpText(body, "", sensitive), "otlp.status": response.status })),
+						),
+					);
+				}),
+				HttpClient.tapError((error) => warnOnce(Effect.succeed({ "otlp.failure": error.reason._tag }))),
+			);
+		}),
+	).pipe(Layer.provide(FetchHttpClient.layer));
+}

package/src/otlpTracing.ts

@@ -0,0 +1,61 @@
+import { Config, Effect, Layer, Schema } from "effect";
+import { OtlpSerialization, OtlpTracer } from "effect/observability";
+import { otlpHttpClient } from "#otlpHttpClient.ts";
+import { RedactionPolicy } from "#RedactionPolicy.ts";
+import { redactingTracer } from "#redactingTracer.ts";
+import { safeOtlpSerialization } from "#safeOtlpSerialization.ts";
+
+export const otlpTracing: Layer.Layer<never, Config.ConfigError> = Layer.unwrap(
+	Effect.gen(function* () {
+		const endpoint = yield* Config.URL("OTEL_EXPORTER_OTLP_TRACES_ENDPOINT").pipe(
+			Config.orElse(() =>
+				Config.URL("OTEL_EXPORTER_OTLP_ENDPOINT").pipe(
+					Config.map((url) => {
+						url.pathname = `${url.pathname.replace(/\/$/u, "")}/v1/traces`;
+						return url;
+					}),
+				),
+			),
+			Config.withDefault(undefined),
+		);
+		if (endpoint === undefined) {
+			return Layer.empty;
+		}
+		const configuredProtocol = yield* Config.String("OTEL_EXPORTER_OTLP_TRACES_PROTOCOL").pipe(
+			Config.orElse(() => Config.String("OTEL_EXPORTER_OTLP_PROTOCOL")),
+			Config.withDefault("http/protobuf"),
+		);
+		const protocol = yield* Schema.decodeUnknownEffect(Schema.Literals(["http/protobuf", "http/json"]), { reportInput: true })(
+			configuredProtocol,
+		).pipe(Effect.mapError((cause) => new Config.ConfigError(cause)));
+		const attributes: Record<string, string> = yield* Config.Record(
+			Schema.StringFromUriComponent,
+			Schema.StringFromUriComponent,
+			"OTEL_RESOURCE_ATTRIBUTES",
+		).pipe(Config.withDefault({}));
+		const serviceName = yield* Config.String("OTEL_SERVICE_NAME").pipe(Config.withDefault(attributes["service.name"] ?? "unknown_service"));
+		const serviceVersion = yield* Config.String("OTEL_SERVICE_VERSION").pipe(Config.withDefault(undefined));
+		const headers = yield* Config.Record(Schema.String, Schema.StringFromUriComponent, "OTEL_EXPORTER_OTLP_HEADERS").pipe(Config.withDefault({}));
+		const requestTimeout = yield* Config.Int("OTEL_EXPORTER_OTLP_TRACES_TIMEOUT").pipe(
+			Config.orElse(() => Config.Int("OTEL_EXPORTER_OTLP_TIMEOUT")),
+			Config.withDefault(10_000),
+		);
+		const exportInterval = yield* Config.Int("OTEL_BSP_SCHEDULE_DELAY").pipe(Config.withDefault(5000));
+		const maxBatchSize = yield* Config.Int("OTEL_BSP_MAX_EXPORT_BATCH_SIZE").pipe(Config.withDefault(1000));
+		const exportTimeout = yield* Config.Int("OTEL_BSP_EXPORT_TIMEOUT").pipe(Config.withDefault(3000));
+		const tracer = OtlpTracer.layer({
+			exportInterval,
+			headers,
+			maxBatchSize,
+			resource: { attributes, serviceName, serviceVersion },
+			shutdownTimeout: Math.min(exportTimeout, requestTimeout),
+			url: endpoint.toString(),
+		}).pipe(
+			Layer.provide(
+				safeOtlpSerialization.pipe(Layer.provide(protocol === "http/protobuf" ? OtlpSerialization.layerProtobuf : OtlpSerialization.layerJson)),
+			),
+			Layer.provide(otlpHttpClient(requestTimeout)),
+		);
+		return redactingTracer(yield* RedactionPolicy).pipe(Layer.provideMerge(tracer));
+	}),
+);

package/src/redactOtlpUrl.ts

@@ -0,0 +1,48 @@
+import { REDACTED } from "@shivaedev/errors/sensitive.ts";
+
+function query(value: string): string {
+	return value
+		.split("&")
+		.map((part) => (part === "" ? part : `${part.split("=", 1)[0]}=${REDACTED}`))
+		.join("&");
+}
+
+function url(value: string): string {
+	const fragment = value.indexOf("#");
+	const target = fragment === -1 ? value : value.slice(0, fragment);
+	const separator = target.indexOf("?");
+	return (
+		(separator === -1 ? target : `${target.slice(0, separator + 1)}${query(target.slice(separator + 1))}`).replaceAll(
+			/(?<authority>(?:\b[a-z][a-z0-9+.-]*:)?\/\/)[^/?#]*@/giu,
+			`$<authority>${REDACTED}@`,
+		) + (fragment === -1 ? "" : `#${REDACTED}`)
+	);
+}
+
+function structured(value: string): string | undefined {
+	try {
+		return JSON.stringify(JSON.parse(value, (key: string, item: unknown) => (typeof item === "string" ? redactOtlpUrl(item, key) : item)));
+	} catch {
+		return undefined;
+	}
+}
+
+export function redactOtlpUrl(value: string, key = ""): string {
+	if (/(?:^|[._-])(?:fragment|userinfo|username|password)$/iu.test(key)) {
+		return REDACTED;
+	}
+	if (/(?:^|[._-])query$/iu.test(key)) {
+		return url(`?${value}`).slice(1);
+	}
+	if (/(?:^|[._-])(?:url|uri|target)(?:$|[._-])/iu.test(key) || /(?:^|[._-])(?:referer|referrer|location|origin)$/iu.test(key)) {
+		return url(value);
+	}
+	if (/^\s*[[{]/u.test(value)) {
+		const redacted = structured(value);
+		if (redacted !== undefined) {
+			return redacted;
+		}
+	}
+	// Quotes and whitespace can belong to secret values, so free text has no safe closing delimiter.
+	return value.replaceAll(/(?:[a-z][a-z0-9+.-]*:\/\/|[/?#]).*/gisu, url);
+}

package/src/redactingDiagnostics.ts

@@ -0,0 +1,33 @@
+import { Context, Effect, ErrorReporter, Layer, Logger, References } from "effect";
+import { redact } from "@shivaedev/errors/redact.ts";
+import { redactDiagnosticCause, redactingErrorReporter } from "@shivaedev/errors/redactCause.ts";
+import type { SensitiveKey } from "@shivaedev/errors/sensitive.ts";
+
+export function redactRecord(values: Readonly<Record<string, unknown>>, sensitive: SensitiveKey): Record<string, unknown> {
+	return Object.fromEntries(Object.entries(values).map(([key, value]) => [key, sensitive(key) ? "<redacted>" : redact(value, sensitive)]));
+}
+export function redactingDiagnostics(sensitive: SensitiveKey) {
+	return Layer.effectContext(
+		Effect.gen(function* () {
+			const loggers = yield* Logger.CurrentLoggers;
+			const reporters = yield* ErrorReporter.CurrentErrorReporters;
+			const safeLoggers = new Set(
+				[...loggers].map((logger) =>
+					Logger.make((options) => {
+						const context = options.fiber.context;
+						const annotations = redactRecord(options.fiber.getRef(References.CurrentLogAnnotations), sensitive);
+						options.fiber.setContext(Context.add(context, References.CurrentLogAnnotations, annotations));
+						try {
+							return logger.log({ ...options, cause: redactDiagnosticCause(options.cause, sensitive), message: redact(options.message, sensitive) });
+						} finally {
+							options.fiber.setContext(context);
+						}
+					}),
+				),
+			);
+			return Context.make(Logger.CurrentLoggers, safeLoggers).pipe(
+				Context.add(ErrorReporter.CurrentErrorReporters, new Set([...reporters].map((reporter) => redactingErrorReporter(reporter, sensitive)))),
+			);
+		}),
+	);
+}

package/src/redactingRpcSerialization.ts

@@ -0,0 +1,85 @@
+import { Predicate } from "effect";
+import type { RpcSerialization } from "effect/rpc";
+import { redactWire } from "@shivaedev/errors/redact.ts";
+import { REDACTED, type SensitiveKey } from "@shivaedev/errors/sensitive.ts";
+
+function isRequestId(value: unknown): value is string | number {
+	return typeof value === "string" || typeof value === "number";
+}
+export function redactingRpcSerialization(
+	wire: RpcSerialization.RpcSerialization["Service"],
+	sensitive: SensitiveKey,
+	maskFailure: (tag: string | undefined, reason: "Fail" | "Die") => boolean = () => false,
+): typeof wire {
+	function reason(value: unknown, tag: string | undefined): unknown {
+		const redacted = redactWire(value, sensitive);
+		if (Predicate.isObjectOrArray(redacted)) {
+			if (Predicate.isTagged(value, "Fail") && maskFailure(tag, "Fail")) {
+				return { ...redacted, _tag: "Fail", error: REDACTED };
+			}
+			if (Predicate.isTagged(value, "Die") && maskFailure(tag, "Die")) {
+				return { ...redacted, _tag: "Die", defect: REDACTED };
+			}
+		}
+		if (
+			(Predicate.isTagged(value, "Fail") || Predicate.isTagged(value, "Die") || Predicate.isTagged(value, "Interrupt"))
+			&& Predicate.isObjectOrArray(redacted)
+		) {
+			return { ...redacted, _tag: value._tag };
+		}
+		return redacted;
+	}
+	function exit(value: unknown, tag: string | undefined): unknown {
+		if (Predicate.isTagged(value, "Failure") && Predicate.hasProperty(value, "cause")) {
+			const cause = Array.isArray(value.cause) ? value.cause.map((item) => reason(item, tag)) : redactWire(value.cause, sensitive);
+			return { ...value, cause };
+		}
+		return value;
+	}
+	return {
+		...wire,
+		makeUnsafe: () => {
+			const parser = wire.makeUnsafe();
+			const requests = new Map<string | number, string>();
+			function response(value: unknown): unknown {
+				if (Array.isArray(value)) {
+					return value.map(response);
+				}
+				if (Predicate.isTagged(value, "Defect") && Predicate.hasProperty(value, "defect")) {
+					return { ...value, defect: maskFailure(undefined, "Die") ? REDACTED : redactWire(value.defect, sensitive) };
+				}
+				if (
+					Predicate.isTagged(value, "Exit")
+					&& Predicate.hasProperty(value, "requestId")
+					&& isRequestId(value.requestId)
+					&& Predicate.hasProperty(value, "exit")
+				) {
+					const tag = requests.get(value.requestId);
+					requests.delete(value.requestId);
+					return { ...value, exit: exit(value.exit, tag) };
+				}
+				return value;
+			}
+			return {
+				...parser,
+				decode: (data) => {
+					const decoded = parser.decode(data);
+					for (const request of decoded) {
+						if (
+							Predicate.isTagged(request, "Request")
+							&& Predicate.hasProperty(request, "id")
+							&& isRequestId(request.id)
+							&& Predicate.hasProperty(request, "tag")
+							&& typeof request.tag === "string"
+							&& !requests.has(request.id)
+						) {
+							requests.set(request.id, request.tag);
+						}
+					}
+					return decoded;
+				},
+				encode: (value) => parser.encode(response(value)),
+			};
+		},
+	};
+}

package/src/redactingTracer.ts

@@ -0,0 +1,37 @@
+import { Effect, Exit, Layer, Tracer } from "effect";
+import { redact } from "@shivaedev/errors/redact.ts";
+import { redactDiagnosticCause } from "@shivaedev/errors/redactCause.ts";
+import { REDACTED, type SensitiveKey } from "@shivaedev/errors/sensitive.ts";
+import { redactRecord } from "#redactingDiagnostics.ts";
+
+function redactLinks(values: readonly Tracer.SpanLink[], sensitive: SensitiveKey) {
+	return values.map((link) => ({ ...link, attributes: redactRecord(link.attributes, sensitive) }));
+}
+function redactSpan(span: Tracer.Span, sensitive: SensitiveKey) {
+	const end = span.end.bind(span);
+	const attribute = span.attribute.bind(span);
+	const event = span.event.bind(span);
+	const addLinks = span.addLinks.bind(span);
+	return Object.assign(span, {
+		addLinks: (values: readonly Tracer.SpanLink[]) => addLinks(redactLinks(values, sensitive)),
+		attribute: (key: string, value: unknown) => attribute(key, sensitive(key) ? REDACTED : redact(value, sensitive)),
+		end: (time: bigint, exit: Exit.Exit<unknown, unknown>) => {
+			for (const [key, value] of span.attributes) {
+				attribute(key, sensitive(key) ? REDACTED : redact(value, sensitive));
+			}
+			end(time, Exit.isFailure(exit) ? Exit.failCause(redactDiagnosticCause(exit.cause, sensitive)) : exit);
+		},
+		event: (name: string, time: bigint, attributes?: Record<string, unknown>) => event(name, time, attributes && redactRecord(attributes, sensitive)),
+	});
+}
+export function redactingTracer(sensitive: SensitiveKey) {
+	return Layer.effect(
+		Tracer.Tracer,
+		Effect.map(Tracer.Tracer, (tracer) =>
+			Tracer.make({
+				...tracer,
+				span: (options) => redactSpan(tracer.span({ ...options, links: redactLinks(options.links, sensitive) }), sensitive),
+			}),
+		),
+	);
+}

package/src/rpc-server/publicConfigLayer.ts

@@ -0,0 +1,12 @@
+import { Config, type ConfigProvider, Effect } from "effect";
+import type { publicConfig } from "@shivaedev/contract/publicConfig.ts";
+
+export function publicConfigLayer<T, E>(declaration: ReturnType<typeof publicConfig<T, E>>, path?: string | ConfigProvider.Path) {
+	const application = declaration.application;
+	return application.toLayer(
+		Effect.gen(function* () {
+			const value = yield* Config.schema(declaration.declaration.queries[0].success, path);
+			return application.of({ "platform.publicConfig.get": () => Effect.succeed(value) });
+		}),
+	);
+}