@shivaedev/server 0.9.2 → 0.10.0

package/src/hostRpcRoutes.ts

@@ -5,7 +5,6 @@ import { type Rpc, type RpcGroup, RpcSerialization } from "effect/rpc";
 import type { Authenticated, MaybeAuthenticated, RequestTracing } from "@shivaedev/identity/middleware.ts";
 import { localRpcGuard } from "@shivaedev/identity/server/local.ts";
 import { authenticatedLayer, maybeAuthenticatedLayer, type SessionShape } from "@shivaedev/identity/server/session.ts";
-import { requestTracingLayer } from "@shivaedev/identity/server/tracing.ts";
 import type { AppChanges } from "#appHost.ts";
 import { boundedRpcRequest } from "#boundedRpcRequest.ts";
 import { hostChanges } from "#hostChanges.ts";
@@ -13,6 +12,7 @@ import type { HostPolicy } from "#hostOptions.ts";
 import { hostRpc, rpcCacheControl } from "#hostRpc.ts";
 import type { hostTransport } from "#hostTransport.ts";
 import { redactingRpcSerialization } from "#redactingRpcSerialization.ts";
+import { rpcRequestTracing } from "#rpcRequestTracing.ts";
 import type { schemaSensitiveKeys } from "#schemaSensitiveKeys.ts";
 import { socketRpc } from "#socketRpc.ts";
 
@@ -28,11 +28,11 @@ export function hostRpcRoutes<TRpcs extends Rpc.Any, THandlers, TError, TRequire
 ) {
 	const middleware: Layer.Layer<RequestTracing> | Layer.Layer<Authenticated | MaybeAuthenticated | RequestTracing> =
 		options.policy === "loopback"
-			? requestTracingLayer({ sensitive })
-			: Layer.mergeAll(authenticatedLayer(options.sessions), maybeAuthenticatedLayer(options.sessions), requestTracingLayer({ sensitive }));
+			? rpcRequestTracing(sensitive)
+			: Layer.mergeAll(authenticatedLayer(options.sessions), maybeAuthenticatedLayer(options.sessions), rpcRequestTracing(sensitive));
 	return HttpRouter.use((router) =>
 		Effect.gen(function* () {
-			const wire = redactingRpcSerialization(yield* RpcSerialization.RpcSerialization, sensitive, sensitive.maskFailure);
+			const wire = redactingRpcSerialization(yield* RpcSerialization.RpcSerialization, sensitive, sensitive.maskFailure, sensitive.forRpc);
 			const httpGroup = options.group.omit(...[...options.group.requests.keys()].filter((tag) => tag.endsWith(".$changes")));
 			const handler = yield* hostRpc(httpGroup).pipe(Effect.provideService(RpcSerialization.RpcSerialization, wire));
 			const guarded = localRpcGuard(handler, trustedProxy, nativeOrigins);

package/src/redactingDiagnostics.ts

@@ -2,11 +2,21 @@ import { Context, Effect, ErrorReporter, Layer, Logger, References } from "effec
 import { redact } from "@shivaedev/errors/redact.ts";
 import { redactDiagnosticCause, redactingErrorReporter } from "@shivaedev/errors/redactCause.ts";
 import type { SensitiveKey } from "@shivaedev/errors/sensitive.ts";
+import { type HostRedactionPolicy, redactionForRpc } from "#RedactionPolicy.ts";
 
 export function redactRecord(values: Readonly<Record<string, unknown>>, sensitive: SensitiveKey): Record<string, unknown> {
 	return Object.fromEntries(Object.entries(values).map(([key, value]) => [key, sensitive(key) ? "<redacted>" : redact(value, sensitive)]));
 }
-export function redactingDiagnostics(sensitive: SensitiveKey) {
+function requestErrorReporter(reporter: ErrorReporter.ErrorReporter, policy: HostRedactionPolicy): ErrorReporter.ErrorReporter {
+	return {
+		[ErrorReporter.TypeId]: ErrorReporter.TypeId,
+		report: (options) => {
+			const sensitive = redactionForRpc(policy, options.fiber.getRef(References.CurrentLogAnnotations)["rpc.method"]);
+			return redactingErrorReporter(reporter, sensitive).report(options);
+		},
+	};
+}
+export function redactingDiagnostics(policy: HostRedactionPolicy) {
 	return Layer.effectContext(
 		Effect.gen(function* () {
 			const loggers = yield* Logger.CurrentLoggers;
@@ -15,7 +25,9 @@ export function redactingDiagnostics(sensitive: SensitiveKey) {
 				[...loggers].map((logger) =>
 					Logger.make((options) => {
 						const context = options.fiber.context;
-						const annotations = redactRecord(options.fiber.getRef(References.CurrentLogAnnotations), sensitive);
+						const raw = options.fiber.getRef(References.CurrentLogAnnotations);
+						const sensitive = redactionForRpc(policy, raw["rpc.method"]);
+						const annotations = redactRecord(raw, sensitive);
 						options.fiber.setContext(Context.add(context, References.CurrentLogAnnotations, annotations));
 						try {
 							return logger.log({ ...options, cause: redactDiagnosticCause(options.cause, sensitive), message: redact(options.message, sensitive) });
@@ -26,7 +38,7 @@ export function redactingDiagnostics(sensitive: SensitiveKey) {
 				),
 			);
 			return Context.make(Logger.CurrentLoggers, safeLoggers).pipe(
-				Context.add(ErrorReporter.CurrentErrorReporters, new Set([...reporters].map((reporter) => redactingErrorReporter(reporter, sensitive)))),
+				Context.add(ErrorReporter.CurrentErrorReporters, new Set([...reporters].map((reporter) => requestErrorReporter(reporter, policy)))),
 			);
 		}),
 	);

package/src/redactingRpcSerialization.ts

@@ -10,9 +10,10 @@ export function redactingRpcSerialization(
 	wire: RpcSerialization.RpcSerialization["Service"],
 	sensitive: SensitiveKey,
 	maskFailure: (tag: string | undefined, reason: "Fail" | "Die") => boolean = () => false,
+	sensitiveForRpc: (tag: string | undefined) => SensitiveKey = () => sensitive,
 ): typeof wire {
 	function reason(value: unknown, tag: string | undefined): unknown {
-		const redacted = redactWire(value, sensitive);
+		const redacted = redactWire(value, sensitiveForRpc(tag));
 		if (Predicate.isObjectOrArray(redacted)) {
 			if (Predicate.isTagged(value, "Fail") && maskFailure(tag, "Fail")) {
 				return { ...redacted, _tag: "Fail", error: REDACTED };
@@ -31,7 +32,7 @@ export function redactingRpcSerialization(
 	}
 	function exit(value: unknown, tag: string | undefined): unknown {
 		if (Predicate.isTagged(value, "Failure") && Predicate.hasProperty(value, "cause")) {
-			const cause = Array.isArray(value.cause) ? value.cause.map((item) => reason(item, tag)) : redactWire(value.cause, sensitive);
+			const cause = Array.isArray(value.cause) ? value.cause.map((item) => reason(item, tag)) : redactWire(value.cause, sensitiveForRpc(tag));
 			return { ...value, cause };
 		}
 		return value;

package/src/redactingTracer.ts

@@ -1,17 +1,21 @@
-import { Effect, Exit, Layer, Tracer } from "effect";
+import { Effect, Exit, Layer, Option, Tracer } from "effect";
 import { redact } from "@shivaedev/errors/redact.ts";
 import { redactDiagnosticCause } from "@shivaedev/errors/redactCause.ts";
 import { REDACTED, type SensitiveKey } from "@shivaedev/errors/sensitive.ts";
+import { type HostRedactionPolicy, redactionForRpc } from "#RedactionPolicy.ts";
 import { redactRecord } from "#redactingDiagnostics.ts";
 
 function redactLinks(values: readonly Tracer.SpanLink[], sensitive: SensitiveKey) {
 	return values.map((link) => ({ ...link, attributes: redactRecord(link.attributes, sensitive) }));
 }
-function redactSpan(span: Tracer.Span, sensitive: SensitiveKey) {
+function redactSpan(span: Tracer.Span, policy: HostRedactionPolicy) {
 	const end = span.end.bind(span);
 	const attribute = span.attribute.bind(span);
 	const event = span.event.bind(span);
 	const addLinks = span.addLinks.bind(span);
+	function sensitive(key: string) {
+		return redactionForRpc(policy, span.attributes.get("rpc.method"))(key);
+	}
 	return Object.assign(span, {
 		addLinks: (values: readonly Tracer.SpanLink[]) => addLinks(redactLinks(values, sensitive)),
 		attribute: (key: string, value: unknown) => attribute(key, sensitive(key) ? REDACTED : redact(value, sensitive)),
@@ -24,13 +28,23 @@ function redactSpan(span: Tracer.Span, sensitive: SensitiveKey) {
 		event: (name: string, time: bigint, attributes?: Record<string, unknown>) => event(name, time, attributes && redactRecord(attributes, sensitive)),
 	});
 }
-export function redactingTracer(sensitive: SensitiveKey) {
+export function redactingTracer(sensitive: HostRedactionPolicy) {
 	return Layer.effect(
 		Tracer.Tracer,
 		Effect.map(Tracer.Tracer, (tracer) =>
 			Tracer.make({
 				...tracer,
-				span: (options) => redactSpan(tracer.span({ ...options, links: redactLinks(options.links, sensitive) }), sensitive),
+				span: (options) => {
+					const method = Option.match(options.parent, {
+						onNone: () => undefined,
+						onSome: (parent) => (parent._tag === "Span" ? parent.attributes.get("rpc.method") : undefined),
+					});
+					const span = tracer.span({ ...options, links: redactLinks(options.links, redactionForRpc(sensitive, method)) });
+					if (typeof method === "string") {
+						span.attribute("rpc.method", method);
+					}
+					return redactSpan(span, sensitive);
+				},
 			}),
 		),
 	);

package/src/rpcRequestTracing.ts

@@ -0,0 +1,12 @@
+import { Effect, Layer } from "effect";
+import { RequestTracing } from "@shivaedev/identity/middleware.ts";
+import { requestTracingLayer } from "@shivaedev/identity/server/tracing.ts";
+import { type HostRedactionPolicy, redactionForRpc } from "#RedactionPolicy.ts";
+
+export function rpcRequestTracing(sensitive: HostRedactionPolicy) {
+	return Layer.succeed(RequestTracing, (effect, request) =>
+		RequestTracing.use((tracing) => tracing(effect, request)).pipe(
+			Effect.provide(requestTracingLayer({ sensitive: redactionForRpc(sensitive, request.rpc._tag) })),
+		),
+	);
+}

package/src/safeOtlpSerialization.ts

@@ -2,7 +2,7 @@ import { Effect, Layer } from "effect";
 import type { OtlpResource, OtlpTracer } from "effect/observability";
 import { OtlpSerialization } from "effect/observability";
 import { isSensitiveKey, REDACTED, redactText, type SensitiveKey } from "@shivaedev/errors/sensitive.ts";
-import { RedactionPolicy } from "#RedactionPolicy.ts";
+import { type HostRedactionPolicy, RedactionPolicy, redactionForRpc } from "#RedactionPolicy.ts";
 import { redactOtlpUrl } from "#redactOtlpUrl.ts";
 
 function otlpSensitive(sensitive: SensitiveKey): SensitiveKey {
@@ -37,25 +37,30 @@ function spanName(span: { readonly name: string; readonly kind: number; readonly
 	return span.name;
 }
 
-function redactTraces(data: OtlpTracer.TraceData, sensitive: SensitiveKey): OtlpTracer.TraceData {
-	function text(value: string) {
-		return redactOtlpText(value, "", sensitive);
-	}
+function redactTraces(data: OtlpTracer.TraceData, policy: HostRedactionPolicy): OtlpTracer.TraceData {
+	const resourceSensitive = otlpSensitive(policy);
 	return {
 		...data,
 		resourceSpans: data.resourceSpans.map((resource) => ({
 			...resource,
-			resource: { ...resource.resource, attributes: attributes(resource.resource.attributes, sensitive) },
+			resource: { ...resource.resource, attributes: attributes(resource.resource.attributes, resourceSensitive) },
 			scopeSpans: resource.scopeSpans.map((scope) => ({
 				...scope,
-				spans: scope.spans.map((span) => ({
-					...span,
-					attributes: attributes(span.attributes, sensitive),
-					events: span.events.map((event) => ({ ...event, attributes: attributes(event.attributes, sensitive), name: text(event.name) })),
-					links: span.links.map((link) => ({ ...link, attributes: attributes(link.attributes, sensitive) })),
-					name: text(spanName(span)),
-					status: { ...span.status, ...(span.status.message === undefined ? {} : { message: text(span.status.message) }) },
-				})),
+				spans: scope.spans.map((span) => {
+					const method = span.attributes.find(({ key }) => key === "rpc.method")?.value.stringValue;
+					const sensitive = otlpSensitive(redactionForRpc(policy, method));
+					function text(value: string) {
+						return redactOtlpText(value, "", sensitive);
+					}
+					return {
+						...span,
+						attributes: attributes(span.attributes, sensitive),
+						events: span.events.map((event) => ({ ...event, attributes: attributes(event.attributes, sensitive), name: text(event.name) })),
+						links: span.links.map((link) => ({ ...link, attributes: attributes(link.attributes, sensitive) })),
+						name: text(spanName(span)),
+						status: { ...span.status, ...(span.status.message === undefined ? {} : { message: text(span.status.message) }) },
+					};
+				}),
 			})),
 		})),
 	};
@@ -64,7 +69,7 @@ export const safeOtlpSerialization = Layer.effect(
 	OtlpSerialization.OtlpSerialization,
 	Effect.gen(function* () {
 		const serialization = yield* OtlpSerialization.OtlpSerialization;
-		const sensitive = otlpSensitive(yield* RedactionPolicy);
+		const sensitive = yield* RedactionPolicy;
 		return OtlpSerialization.OtlpSerialization.of({
 			...serialization,
 			traces: (data) => serialization.traces(redactTraces(data, sensitive)),

package/src/schemaSensitiveAst.ts

@@ -0,0 +1,106 @@
+import { Predicate, type SchemaAST } from "effect";
+import { isSensitiveKey } from "@shivaedev/errors/sensitive.ts";
+
+function children(ast: SchemaAST.AST): readonly SchemaAST.AST[] {
+	switch (ast._tag) {
+		case "Objects":
+			return [...ast.propertySignatures.map((property) => property.type), ...ast.indexSignatures.flatMap((index) => [index.parameter, index.type])];
+		case "Arrays":
+			return [...ast.elements, ...ast.rest];
+		case "Union":
+			return ast.types;
+		case "Declaration":
+			return ast.typeParameters;
+		case "Suspend":
+			return [ast.thunk()];
+		default:
+			return [];
+	}
+}
+function sensitiveCheck(check: SchemaAST.Check<never>): boolean {
+	return check.annotations?.sensitive === true || (check._tag === "FilterGroup" && check.checks.some(sensitiveCheck));
+}
+export function marked(ast: SchemaAST.AST, seen = new Set<SchemaAST.AST>()): boolean {
+	if (seen.has(ast)) {
+		return false;
+	}
+	seen.add(ast);
+	if (
+		ast.annotations?.sensitive === true
+		|| ast.context?.annotations?.sensitive === true
+		|| ast.checks?.some(sensitiveCheck)
+		|| (Predicate.hasProperty(ast.annotations?.representation, "id") && ast.annotations.representation.id === "effect/schema/Redacted")
+	) {
+		return true;
+	}
+	const nested = ast._tag === "Objects" ? ast.indexSignatures.map((index) => index.type) : children(ast);
+	return (ast.encoding?.some((link) => marked(link.to, seen)) ?? false) || nested.some((type) => marked(type, seen));
+}
+function containsSensitive(ast: SchemaAST.AST, keys: ReadonlySet<string>): boolean {
+	return (
+		marked(ast)
+		|| propertiesOf(ast).some((property) => typeof property.name === "string" && (keys.has(property.name) || isSensitiveKey(property.name)))
+	);
+}
+export function collectEncodedKeys(ast: SchemaAST.AST, keys: Set<string>) {
+	let source = ast;
+	let sensitive = false;
+	for (const link of ast.encoding ?? []) {
+		sensitive ||= containsSensitive(source, keys);
+		if (sensitive) {
+			for (const property of propertiesOf(link.to)) {
+				if (typeof property.name === "string") {
+					keys.add(property.name);
+				}
+			}
+		}
+		source = link.to;
+	}
+}
+function fixedOutput(ast: SchemaAST.AST): boolean {
+	if (ast._tag === "Union") {
+		return ast.types.every(fixedOutput);
+	}
+	return ast._tag === "Objects" && ast.indexSignatures.length === 0;
+}
+export function maskedValue(ast: SchemaAST.AST, keys: ReadonlySet<string>, seen = new Set<SchemaAST.AST>()): boolean {
+	if (seen.has(ast)) {
+		return false;
+	}
+	seen.add(ast);
+	if (marked(ast)) {
+		return true;
+	}
+	let source = ast;
+	let sensitive = false;
+	for (const link of ast.encoding ?? []) {
+		sensitive ||= containsSensitive(source, keys);
+		if (sensitive && !fixedOutput(link.to)) {
+			return true;
+		}
+		source = link.to;
+	}
+	const nested = ast._tag === "Objects" ? ast.indexSignatures.map((index) => index.type) : children(ast);
+	return nested.some((type) => maskedValue(type, keys, seen));
+}
+export function collect(ast: SchemaAST.AST, nodes: Set<SchemaAST.AST>, encodings = true) {
+	if (nodes.has(ast)) {
+		return;
+	}
+	nodes.add(ast);
+	for (const child of [...children(ast), ...(encodings ? (ast.encoding?.map((link) => link.to) ?? []) : [])]) {
+		collect(child, nodes, encodings);
+	}
+}
+function propertiesOf(ast: SchemaAST.AST) {
+	const nodes = new Set<SchemaAST.AST>();
+	collect(ast, nodes, false);
+	return [...nodes].flatMap((node) => (node._tag === "Objects" ? node.propertySignatures : []));
+}
+export function collectFieldKeys(properties: SchemaAST.Objects["propertySignatures"], keys: Set<string>, sensitive: (ast: SchemaAST.AST) => boolean) {
+	for (const property of properties) {
+		if (typeof property.name === "string" && sensitive(property.type)) {
+			keys.add(property.name);
+		}
+	}
+}

package/src/schemaSensitiveKeys.ts

@@ -1,130 +1,20 @@
-import { Predicate, type Schema, type SchemaAST } from "effect";
+import type { Schema, SchemaAST } from "effect";
 import { Rpc, type RpcGroup } from "effect/rpc";
 import { isSensitiveKey } from "@shivaedev/errors/sensitive.ts";
+import { collect, collectEncodedKeys, collectFieldKeys, marked, maskedValue } from "#schemaSensitiveAst.ts";
 
-function children(ast: SchemaAST.AST): readonly SchemaAST.AST[] {
-	switch (ast._tag) {
-		case "Objects":
-			return [...ast.propertySignatures.map((property) => property.type), ...ast.indexSignatures.flatMap((index) => [index.parameter, index.type])];
-		case "Arrays":
-			return [...ast.elements, ...ast.rest];
-		case "Union":
-			return ast.types;
-		case "Declaration":
-			return ast.typeParameters;
-		case "Suspend":
-			return [ast.thunk()];
-		default:
-			return [];
-	}
-}
-function sensitiveCheck(check: SchemaAST.Check<never>): boolean {
-	return check.annotations?.sensitive === true || (check._tag === "FilterGroup" && check.checks.some(sensitiveCheck));
-}
-function marked(ast: SchemaAST.AST, seen = new Set<SchemaAST.AST>()): boolean {
-	if (seen.has(ast)) {
-		return false;
-	}
-	seen.add(ast);
-	if (
-		ast.annotations?.sensitive === true
-		|| ast.context?.annotations?.sensitive === true
-		|| ast.checks?.some(sensitiveCheck)
-		|| (Predicate.hasProperty(ast.annotations?.representation, "id") && ast.annotations.representation.id === "effect/schema/Redacted")
-	) {
-		return true;
-	}
-	const nested = ast._tag === "Objects" ? ast.indexSignatures.map((index) => index.type) : children(ast);
-	return (ast.encoding?.some((link) => marked(link.to, seen)) ?? false) || nested.some((type) => marked(type, seen));
-}
-function containsSensitive(ast: SchemaAST.AST, keys: ReadonlySet<string>): boolean {
-	return (
-		marked(ast)
-		|| propertiesOf(ast).some((property) => typeof property.name === "string" && (keys.has(property.name) || isSensitiveKey(property.name)))
-	);
-}
-function collectEncodedKeys(ast: SchemaAST.AST, keys: Set<string>) {
-	let source = ast;
-	let sensitive = false;
-	for (const link of ast.encoding ?? []) {
-		sensitive ||= containsSensitive(source, keys);
-		if (sensitive) {
-			for (const property of propertiesOf(link.to)) {
-				if (typeof property.name === "string") {
-					keys.add(property.name);
-				}
-			}
-		}
-		source = link.to;
-	}
-}
-function fixedOutput(ast: SchemaAST.AST): boolean {
-	if (ast._tag === "Union") {
-		return ast.types.every(fixedOutput);
-	}
-	return ast._tag === "Objects" && ast.indexSignatures.length === 0;
-}
-function maskedValue(ast: SchemaAST.AST, keys: ReadonlySet<string>, seen = new Set<SchemaAST.AST>()): boolean {
-	if (seen.has(ast)) {
-		return false;
-	}
-	seen.add(ast);
-	if (marked(ast)) {
-		return true;
-	}
-	let source = ast;
-	let sensitive = false;
-	for (const link of ast.encoding ?? []) {
-		sensitive ||= containsSensitive(source, keys);
-		if (sensitive && !fixedOutput(link.to)) {
-			return true;
-		}
-		source = link.to;
-	}
-	const nested = ast._tag === "Objects" ? ast.indexSignatures.map((index) => index.type) : children(ast);
-	return nested.some((type) => maskedValue(type, keys, seen));
-}
-function collect(ast: SchemaAST.AST, nodes: Set<SchemaAST.AST>, encodings = true) {
-	if (nodes.has(ast)) {
-		return;
-	}
-	nodes.add(ast);
-	for (const child of [...children(ast), ...(encodings ? (ast.encoding?.map((link) => link.to) ?? []) : [])]) {
-		collect(child, nodes, encodings);
-	}
-}
-function propertiesOf(ast: SchemaAST.AST) {
-	const nodes = new Set<SchemaAST.AST>();
-	collect(ast, nodes, false);
-	return [...nodes].flatMap((node) => (node._tag === "Objects" ? node.propertySignatures : []));
-}
-function collectFieldKeys(properties: SchemaAST.Objects["propertySignatures"], keys: Set<string>, sensitive: (ast: SchemaAST.AST) => boolean) {
-	for (const property of properties) {
-		if (typeof property.name === "string" && sensitive(property.type)) {
-			keys.add(property.name);
-		}
-	}
-}
-export function schemaSensitiveKeys<R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>, extra: readonly string[] = []) {
+function rpcSensitiveKeys(rpc: Rpc.AnyWithProps, extra: readonly string[]) {
 	const keys = new Set(extra);
 	const nodes = new Set<SchemaAST.AST>();
-	const requests: Rpc.AnyWithProps[] = [];
-	for (const rpc of group.requests.values()) {
-		if (Rpc.isRpc(rpc)) {
-			requests.push(rpc);
-		}
-	}
-	for (const rpc of requests) {
-		const schemas: Schema.Top[] = [
-			rpc.payloadSchema,
-			rpc.successSchema,
-			rpc.errorSchema,
-			rpc.defectSchema,
-			...[...rpc.middlewares].map((m) => m.error),
-		];
-		for (const schema of schemas) {
-			collect(schema.ast, nodes);
-		}
+	const schemas: Schema.Top[] = [
+		rpc.payloadSchema,
+		rpc.successSchema,
+		rpc.errorSchema,
+		rpc.defectSchema,
+		...[...rpc.middlewares].map((m) => m.error),
+	];
+	for (const schema of schemas) {
+		collect(schema.ast, nodes);
 	}
 	const properties = [...nodes].flatMap((ast) => (ast._tag === "Objects" ? ast.propertySignatures : []));
 	collectFieldKeys(properties, keys, marked);
@@ -136,13 +26,24 @@ export function schemaSensitiveKeys<R extends Rpc.Any>(group: RpcGroup.RpcGroup<
 			collectEncodedKeys(ast, keys);
 		}
 	} while (keys.size !== previousSize);
-	const roots = requests.map((rpc) => ({
+	return Object.assign((key: string) => keys.has(key) || isSensitiveKey(key), {
 		die: maskedValue(rpc.defectSchema.ast, keys),
 		fail: [rpc.errorSchema, ...[...rpc.middlewares].map((m) => m.error)].some((schema) => maskedValue(schema.ast, keys)),
-		tag: rpc._tag,
-	}));
-	return Object.assign((key: string) => keys.has(key) || isSensitiveKey(key), {
+	});
+}
+export function schemaSensitiveKeys<R extends Rpc.Any>(group: RpcGroup.RpcGroup<R>, extra: readonly string[] = []) {
+	const policies = new Map<string, ReturnType<typeof rpcSensitiveKeys>>();
+	for (const rpc of group.requests.values()) {
+		if (Rpc.isRpc(rpc)) {
+			policies.set(rpc._tag, rpcSensitiveKeys(rpc, extra));
+		}
+	}
+	function sensitive(key: string) {
+		return extra.includes(key) || isSensitiveKey(key) || [...policies.values()].some((policy) => policy(key));
+	}
+	return Object.assign(sensitive, {
+		forRpc: (tag: string | undefined) => (tag === undefined ? sensitive : (policies.get(tag) ?? sensitive)),
 		maskFailure: (tag: string | undefined, reason: "Fail" | "Die") =>
-			roots.some((root) => (tag === undefined || tag === root.tag) && (reason === "Fail" ? root.fail : root.die)),
+			[...policies].some(([method, policy]) => (tag === undefined || tag === method) && (reason === "Fail" ? policy.fail : policy.die)),
 	});
 }

package/src/setupDatabases.ts

@@ -8,5 +8,5 @@ export const setupDatabases = Effect.fn("Platform.setupDatabases")(function* ()
 		"DOCKER_HOST": Config.String("DOCKER_HOST").pipe(Config.withDefault("")),
 		"TEST_DATABASE_URL": Config.String("TEST_DATABASE_URL"),
 	});
-	yield* Effect.sync(() => localPostgres(config).prepareDatabases([config.DATABASE_URL, config.TEST_DATABASE_URL]));
+	yield* localPostgres(config).prepareDatabases([config.DATABASE_URL, config.TEST_DATABASE_URL]);
 });