@shivaedev/server 0.9.3 → 0.11.0

package/src/appHost.ts

@@ -1,25 +1,19 @@
 import * as NodeCrypto from "@effect/platform-node/NodeCrypto";
-import { Context, type Effect, Layer } from "effect";
+import { Layer } from "effect";
 import type { Rpc } from "effect/rpc";
-import type { makeLiveServer } from "@shivaedev/contract/makeLiveServer.ts";
 import type { SessionPolicy, SessionShape } from "@shivaedev/identity/server/session.ts";
 import type { AppHostFactory } from "#AppHostFactory.ts";
 import type { AppHostInput, HostPreflight } from "#AppHostInput.ts";
+import { appDatabase, type DatabaseConfig } from "#appDatabase.ts";
 import { appHostHttp, deferredHost, migratedHost } from "#appHostHttp.ts";
-import { type DatabaseConfig, databaseLayer } from "#databaseLayer.ts";
 import type { HostCoreOptions, HostPolicy, HostRouteRequirements, HostRoutes } from "#hostOptions.ts";
 import type { MigrationOptions } from "#MigrationOptions.ts";
 
-export class AppChanges extends Context.Service<AppChanges, Effect.Success<typeof makeLiveServer>>()("@shivaedev/server/AppChanges") {}
 export interface AppDatabaseOptions<R = never, E = never> {
 	readonly config?: DatabaseConfig;
 	readonly migrations: MigrationOptions<R, E>;
 }
 
-export function appDatabase<R, E = never>(options: AppDatabaseOptions<R, E>) {
-	return databaseLayer(options, AppChanges);
-}
-
 export type AppHostOptions<
 	TRpcs extends Rpc.Any,
 	THandlers,
@@ -125,14 +119,14 @@ export const appHost: AppHostFactory = <
 	>,
 ) => {
 	if ("application" in options) {
-		return deferredHost(options.application, appDatabase(options), AppChanges).pipe(
+		return deferredHost(options.application, appDatabase(options)).pipe(
 			Layer.provideMerge(options.preflight ?? Layer.empty),
 			Layer.provide(NodeCrypto.layer),
 		);
 	}
 	return options.migrations === undefined
-		? appHostHttp(options, AppChanges).pipe(Layer.provideMerge(options.preflight ?? Layer.empty), Layer.provide(NodeCrypto.layer))
-		: migratedHost({ ...options, migrations: options.migrations }, appDatabase({ ...options, migrations: options.migrations }), AppChanges).pipe(
+		? appHostHttp(options).pipe(Layer.provideMerge(options.preflight ?? Layer.empty), Layer.provide(NodeCrypto.layer))
+		: migratedHost({ ...options, migrations: options.migrations }, appDatabase({ ...options, migrations: options.migrations })).pipe(
 				Layer.provideMerge(options.preflight ?? Layer.empty),
 				Layer.provide(NodeCrypto.layer),
 			);

package/src/appHostHttp.ts

@@ -2,9 +2,10 @@ import * as NodeHttpServer from "@effect/platform-node/NodeHttpServer";
 import { Effect, Layer } from "effect";
 import { HttpRouter, HttpServer, HttpStaticServer } from "effect/http";
 import type { Rpc } from "effect/rpc";
+import { schemaSensitiveKeys } from "@shivaedev/errors/schemaSensitiveKeys.ts";
 import type { SessionShape } from "@shivaedev/identity/server/session.ts";
-import type { AppChanges, AppHttpHostOptions } from "#appHost.ts";
-import type { databaseLayer } from "#databaseLayer.ts";
+import type { appDatabase } from "#appDatabase.ts";
+import type { AppHttpHostOptions } from "#appHost.ts";
 import { healthRoute } from "#healthRoute.ts";
 import { hostApplicationRoutes } from "#hostApplicationRoutes.ts";
 import type { HostOptions, HostPolicy, HostRouteRequirements } from "#hostOptions.ts";
@@ -16,7 +17,6 @@ import { nodeHttpServer } from "#nodeHttpServer.ts";
 import { otlpTracing } from "#otlpTracing.ts";
 import { RedactionPolicy } from "#RedactionPolicy.ts";
 import { redactingDiagnostics } from "#redactingDiagnostics.ts";
-import { schemaSensitiveKeys } from "#schemaSensitiveKeys.ts";
 
 export function appHostHttp<
 	TRpcs extends Rpc.Any,
@@ -42,14 +42,13 @@ export function appHostHttp<
 		TRouteRequirements
 	> &
 		HostPolicy<TSession>,
-	changesService: typeof AppChanges,
 ) {
 	const sensitive = schemaSensitiveKeys(options.group, options.config?.sensitiveKeys);
 	return Layer.unwrap(
 		Effect.gen(function* () {
 			const transport = yield* hostTransport(options);
 			const { bodySize, host, trustedProxy, nativeOrigins } = transport;
-			const routes = hostRpcRoutes(options, changesService, transport, sensitive);
+			const routes = hostRpcRoutes(options, transport, sensitive);
 			const assets =
 				options.assets === undefined
 					? Layer.empty
@@ -98,11 +97,10 @@ export function migratedHost<
 		HostPolicy<TSession> & {
 			readonly migrations: MigrationOptions<TMigrations, TMigrationError>;
 		},
-	database: ReturnType<typeof databaseLayer<TMigrations, TMigrationError>>,
-	changesService: typeof AppChanges,
+	database: ReturnType<typeof appDatabase<TMigrations, TMigrationError>>,
 ) {
 	const services = Layer.mergeAll(options.services ?? Layer.empty);
-	return appHostHttp({ ...options, services: services.pipe(Layer.provideMerge(database)) }, changesService);
+	return appHostHttp({ ...options, services: services.pipe(Layer.provideMerge(database)) });
 }
 
 export function deferredHost<
@@ -140,8 +138,7 @@ export function deferredHost<
 		TApplicationError,
 		TApplicationRequirements
 	>,
-	database: ReturnType<typeof databaseLayer<TMigrations, TMigrationError>>,
-	changesService: typeof AppChanges,
+	database: ReturnType<typeof appDatabase<TMigrations, TMigrationError>>,
 ) {
-	return Layer.unwrap(Effect.map(application, (options) => appHostHttp(options, changesService))).pipe(Layer.provideMerge(database));
+	return Layer.unwrap(Effect.map(application, (options) => appHostHttp(options))).pipe(Layer.provideMerge(database));
 }

package/src/bearerSocketRpc.ts

@@ -0,0 +1,80 @@
+import { Effect, Option, Schema, type Scope } from "effect";
+import { Headers, HttpServerRequest, HttpServerResponse } from "effect/http";
+import * as Socket from "effect/socket/Socket";
+import { SocketAuthentication } from "@shivaedev/contract/socketAuthentication.ts";
+import { Unauthorized } from "@shivaedev/errors/taxonomy.ts";
+import { recheckSession } from "@shivaedev/identity/server/recheckSession.ts";
+import { resolveSession, type SessionPolicy, type SessionShape } from "@shivaedev/identity/server/session.ts";
+import { makeSocketSession, SocketSession } from "@shivaedev/identity/server/socketSession.ts";
+
+export const bearerSocketRpc = Effect.fnUntraced(function* <TSession extends SessionShape>(
+	handler: Effect.Effect<HttpServerResponse.HttpServerResponse, never, HttpServerRequest.HttpServerRequest | Scope.Scope>,
+	policy: SessionPolicy<TSession>,
+) {
+	const request = yield* HttpServerRequest.HttpServerRequest;
+	const socket = yield* Effect.orDie(request.upgrade);
+	const reader = yield* Effect.orDie(socket.reader);
+	const writer = yield* socket.writer;
+	function close(code: number, reason: string) {
+		return writer.write(new Socket.CloseEvent(code, reason)).pipe(Effect.as(HttpServerResponse.empty()));
+	}
+	function unauthorized() {
+		return close(1008, "Authentication required");
+	}
+	function unavailable() {
+		return close(1011, "Authentication unavailable");
+	}
+	return yield* Effect.gen(function* () {
+		const frames = yield* reader.pull.pipe(Effect.timeout("5 seconds"));
+		const frame = frames[0];
+		const auth =
+			typeof frame === "string" && frame.length <= 8192
+				? Schema.decodeUnknownOption(Schema.fromJsonString(SocketAuthentication))(frame)
+				: Option.none();
+		if (Option.isNone(auth)) {
+			return yield* new Unauthorized({ message: "Authentication required" });
+		}
+		const authenticated = request.modify({ headers: Headers.set(request.headers, "authorization", `Bearer ${auth.value.token}`) });
+		let buffered = frames.slice(1);
+		const authenticatedSocket: Socket.Socket = {
+			...socket,
+			reader: Effect.succeed({
+				...reader,
+				pull: Effect.suspend(() => {
+					if (buffered.length === 0) {
+						return reader.pull;
+					}
+					const [first, ...rest] = buffered;
+					buffered = [];
+					return first === undefined ? reader.pull : Effect.succeed([first, ...rest] as const);
+				}),
+			}),
+		};
+		const transport = new Proxy(authenticated, {
+			get: (target, key, receiver) => (key === "upgrade" ? Effect.succeed(authenticatedSocket) : Reflect.get(target, key, receiver)),
+		});
+		return yield* Effect.gen(function* () {
+			const initial = yield* resolveSession(policy, Headers.empty, "$connect");
+			if (Option.isNone(initial)) {
+				return yield* new Unauthorized({ message: "Authentication required" });
+			}
+			const session = yield* makeSocketSession(policy.streamRevalidationInterval ?? "30 seconds");
+			const check = recheckSession(policy, Headers.empty, "$connect").pipe(
+				Effect.flatMap((current) =>
+					Option.isSome(current) && current.value.user.id === initial.value.user.id
+						? Effect.void
+						: Effect.fail(new Unauthorized({ message: "Authentication required" })),
+				),
+			);
+			return yield* Effect.raceFirst(handler, session.monitor(check)).pipe(Effect.provideService(SocketSession, session));
+		}).pipe(Effect.provideService(HttpServerRequest.HttpServerRequest, transport));
+	}).pipe(
+		Effect.catchTags({
+			AuthUnavailable: unavailable,
+			Forbidden: unauthorized,
+			TimeoutError: unauthorized,
+			Unauthorized: unauthorized,
+		}),
+		Effect.catchTag("SocketError", () => Effect.succeed(HttpServerResponse.empty())),
+	);
+});

package/src/hostChanges.ts

@@ -1,44 +1,43 @@
 import { Context, Effect, Layer, Option, Stream } from "effect";
 import { Headers } from "effect/http";
-import type { Rpc, RpcGroup } from "effect/rpc";
+import { Rpc, type RpcGroup } from "effect/rpc";
+import { LiveServer } from "@shivaedev/contract/LiveServer.ts";
 import { CurrentViewer, type Viewer } from "@shivaedev/contract/readPolicy.ts";
 import type { QueryReference } from "@shivaedev/contract/serverMetadata.ts";
 import { Unauthorized } from "@shivaedev/errors/taxonomy.ts";
 import { recheckSession } from "@shivaedev/identity/server/recheckSession.ts";
+import { revalidateStream } from "@shivaedev/identity/server/revalidateStream.ts";
 import type { SessionPolicy, SessionShape } from "@shivaedev/identity/server/session.ts";
 import { resolveChanges } from "@shivaedev/identity/server/sessionKeys.ts";
-import { revalidateSession } from "@shivaedev/identity/server/socketSession.ts";
-import type { AppChanges } from "#appHost.ts";
 import { rerunQuery } from "#rerunQuery.ts";
 
-export function hostChanges<R extends Rpc.Any, TSession extends SessionShape>(
-	group: RpcGroup.RpcGroup<R>,
-	changesService: typeof AppChanges,
-	sessions?: SessionPolicy<TSession>,
-) {
+export function hostChanges<R extends Rpc.Any, TSession extends SessionShape>(group: RpcGroup.RpcGroup<R>, sessions?: SessionPolicy<TSession>) {
 	return Layer.effectContext(
 		Effect.gen(function* () {
-			const changes = yield* Effect.serviceOption(changesService);
+			const changes = yield* Effect.serviceOption(LiveServer);
 			const services = yield* Effect.context<never>();
 			const handlers = new Map<string, unknown>();
-			function subscribe(rpc: Rpc.Any, queries: readonly QueryReference[], options: Parameters<Rpc.Handler<string>["handler"]>[1]) {
+			function subscribe(rpc: Rpc.AnyWithProps, queries: readonly QueryReference[], options: Parameters<Rpc.Handler<string>["handler"]>[1]) {
 				return Stream.unwrap(
 					Effect.gen(function* () {
 						const { subscription, context } = yield* resolveChanges(rpc, queries);
 						const viewer = yield* CurrentViewer;
 						const authorized = authorizeSession(sessions, rpc._tag, viewer, subscription.authorized);
 						const stream = Option.isSome(changes)
-							? changes.value.subscribe({ ...subscription, authorized }, context, rerunQuery(group, options))
+							? Stream.unwrap(changes.value.subscribe({ ...subscription, authorized }, context, rerunQuery(group, options)))
 							: Stream.concat(Stream.succeed({ _tag: "Resync" } as const), Stream.never);
 						if (sessions === undefined || Option.isNone(viewer)) {
 							return stream;
 						}
-						return Stream.interruptWhen(stream, sessionRevoked(sessions, rpc._tag, viewer.value.id));
+						const revalidation = Effect.never.pipe(
+							revalidateStream(sessions, rpc, viewer.value.id, recheckSession(sessions, Headers.empty, rpc._tag)),
+						);
+						return Stream.interruptWhen(stream, revalidation);
 					}),
 				);
 			}
 			for (const rpc of group.requests.values()) {
-				if (!rpc._tag.endsWith(".$changes")) {
+				if (!(Rpc.isRpc(rpc) && rpc._tag.endsWith(".$changes"))) {
 					continue;
 				}
 				const provided = services.mapUnsafe.get(rpc.key);
@@ -75,12 +74,3 @@ function authorizeSession<TSession extends SessionShape, E, R>(
 		),
 	);
 }
-
-function sessionRevoked<TSession extends SessionShape>(sessions: SessionPolicy<TSession>, tag: string, id: string) {
-	return Effect.gen(function* () {
-		const current = yield* recheckSession(sessions, Headers.empty, tag).pipe(Effect.catchTag("AuthUnavailable", () => Effect.succeed(undefined)));
-		if (current !== undefined && (Option.isNone(current) || current.value.user.id !== id)) {
-			return yield* new Unauthorized({ message: "Authentication required" });
-		}
-	}).pipe((check) => revalidateSession(check, sessions.streamRevalidationInterval ?? "30 seconds"));
-}

package/src/hostRpcRoutes.ts

@@ -2,10 +2,11 @@ import { ByteSize, Effect, Layer } from "effect";
 import { HttpEffect, HttpIncomingMessage, HttpRouter, HttpServerRequest, HttpServerResponse } from "effect/http";
 import * as HttpStatus from "effect/http/HttpStatus";
 import { type Rpc, type RpcGroup, RpcSerialization } from "effect/rpc";
+import { validateReadPolicies } from "@shivaedev/contract/validateReadPolicies.ts";
+import type { schemaSensitiveKeys } from "@shivaedev/errors/schemaSensitiveKeys.ts";
 import type { Authenticated, MaybeAuthenticated, RequestTracing } from "@shivaedev/identity/middleware.ts";
 import { localRpcGuard } from "@shivaedev/identity/server/local.ts";
 import { authenticatedLayer, maybeAuthenticatedLayer, type SessionShape } from "@shivaedev/identity/server/session.ts";
-import type { AppChanges } from "#appHost.ts";
 import { boundedRpcRequest } from "#boundedRpcRequest.ts";
 import { hostChanges } from "#hostChanges.ts";
 import type { HostPolicy } from "#hostOptions.ts";
@@ -13,7 +14,6 @@ import { hostRpc, rpcCacheControl } from "#hostRpc.ts";
 import type { hostTransport } from "#hostTransport.ts";
 import { redactingRpcSerialization } from "#redactingRpcSerialization.ts";
 import { rpcRequestTracing } from "#rpcRequestTracing.ts";
-import type { schemaSensitiveKeys } from "#schemaSensitiveKeys.ts";
 import { socketRpc } from "#socketRpc.ts";
 
 export function hostRpcRoutes<TRpcs extends Rpc.Any, THandlers, TError, TRequirements, TSession extends SessionShape>(
@@ -22,7 +22,6 @@ export function hostRpcRoutes<TRpcs extends Rpc.Any, THandlers, TError, TRequire
 		readonly handlers: Layer.Layer<THandlers, TError, TRequirements>;
 		readonly rpcPath?: HttpRouter.PathInput;
 	} & HostPolicy<TSession>,
-	changesService: typeof AppChanges,
 	{ bodySize, trustedProxy, nativeOrigins }: Effect.Success<ReturnType<typeof hostTransport>>,
 	sensitive: ReturnType<typeof schemaSensitiveKeys>,
 ) {
@@ -32,6 +31,7 @@ export function hostRpcRoutes<TRpcs extends Rpc.Any, THandlers, TError, TRequire
 			: Layer.mergeAll(authenticatedLayer(options.sessions), maybeAuthenticatedLayer(options.sessions), rpcRequestTracing(sensitive));
 	return HttpRouter.use((router) =>
 		Effect.gen(function* () {
+			yield* validateReadPolicies(options.group);
 			const wire = redactingRpcSerialization(yield* RpcSerialization.RpcSerialization, sensitive, sensitive.maskFailure, sensitive.forRpc);
 			const httpGroup = options.group.omit(...[...options.group.requests.keys()].filter((tag) => tag.endsWith(".$changes")));
 			const handler = yield* hostRpc(httpGroup).pipe(Effect.provideService(RpcSerialization.RpcSerialization, wire));
@@ -62,9 +62,7 @@ export function hostRpcRoutes<TRpcs extends Rpc.Any, THandlers, TError, TRequire
 		Layer.provide(
 			Layer.merge(
 				middleware,
-				hostChanges(options.group, changesService, options.policy === "loopback" ? undefined : options.sessions).pipe(
-					Layer.provideMerge(options.handlers),
-				),
+				hostChanges(options.group, options.policy === "loopback" ? undefined : options.sessions).pipe(Layer.provideMerge(options.handlers)),
 			),
 		),
 		Layer.provide(RpcSerialization.layerNdjson),

package/src/otlpHttpClient.ts

@@ -1,8 +1,8 @@
 import { Effect, Layer } from "effect";
 import { FetchHttpClient, HttpClient, HttpClientError, type HttpClientRequest } from "effect/http";
 import * as HttpStatus from "effect/http/HttpStatus";
+import { redactText } from "@shivaedev/errors/sensitive.ts";
 import { RedactionPolicy } from "#RedactionPolicy.ts";
-import { redactOtlpText } from "#safeOtlpSerialization.ts";
 
 function timeoutError(request: HttpClientRequest.HttpClientRequest) {
 	return new HttpClientError.HttpClientError({
@@ -44,7 +44,7 @@ export function otlpHttpClient(timeout = 10_000) {
 					return warnOnce(
 						response.text.pipe(
 							Effect.orElseSucceed(() => "Unable to read collector response"),
-							Effect.map((body) => ({ "otlp.response": redactOtlpText(body, "", sensitive), "otlp.status": response.status })),
+							Effect.map((body) => ({ "otlp.response": redactText(body, sensitive), "otlp.status": response.status })),
 						),
 					);
 				}),

package/src/redactingDiagnostics.ts

@@ -1,12 +1,8 @@
 import { Context, Effect, ErrorReporter, Layer, Logger, References } from "effect";
-import { redact } from "@shivaedev/errors/redact.ts";
+import { redact, redactRecord } from "@shivaedev/errors/redact.ts";
 import { redactDiagnosticCause, redactingErrorReporter } from "@shivaedev/errors/redactCause.ts";
-import type { SensitiveKey } from "@shivaedev/errors/sensitive.ts";
 import { type HostRedactionPolicy, redactionForRpc } from "#RedactionPolicy.ts";
 
-export function redactRecord(values: Readonly<Record<string, unknown>>, sensitive: SensitiveKey): Record<string, unknown> {
-	return Object.fromEntries(Object.entries(values).map(([key, value]) => [key, sensitive(key) ? "<redacted>" : redact(value, sensitive)]));
-}
 function requestErrorReporter(reporter: ErrorReporter.ErrorReporter, policy: HostRedactionPolicy): ErrorReporter.ErrorReporter {
 	return {
 		[ErrorReporter.TypeId]: ErrorReporter.TypeId,

package/src/redactingTracer.ts

@@ -1,9 +1,8 @@
 import { Effect, Exit, Layer, Option, Tracer } from "effect";
-import { redact } from "@shivaedev/errors/redact.ts";
+import { redactRecord } from "@shivaedev/errors/redact.ts";
 import { redactDiagnosticCause } from "@shivaedev/errors/redactCause.ts";
-import { REDACTED, type SensitiveKey } from "@shivaedev/errors/sensitive.ts";
+import type { SensitiveKey } from "@shivaedev/errors/sensitive.ts";
 import { type HostRedactionPolicy, redactionForRpc } from "#RedactionPolicy.ts";
-import { redactRecord } from "#redactingDiagnostics.ts";
 
 function redactLinks(values: readonly Tracer.SpanLink[], sensitive: SensitiveKey) {
 	return values.map((link) => ({ ...link, attributes: redactRecord(link.attributes, sensitive) }));
@@ -11,6 +10,9 @@ function redactLinks(values: readonly Tracer.SpanLink[], sensitive: SensitiveKey
 function redactSpan(span: Tracer.Span, policy: HostRedactionPolicy) {
 	const end = span.end.bind(span);
 	const attribute = span.attribute.bind(span);
+	function safeAttribute(key: string, value: unknown) {
+		return attribute(key, redactRecord({ [key]: value }, sensitive)[key]);
+	}
 	const event = span.event.bind(span);
 	const addLinks = span.addLinks.bind(span);
 	function sensitive(key: string) {
@@ -18,10 +20,10 @@ function redactSpan(span: Tracer.Span, policy: HostRedactionPolicy) {
 	}
 	return Object.assign(span, {
 		addLinks: (values: readonly Tracer.SpanLink[]) => addLinks(redactLinks(values, sensitive)),
-		attribute: (key: string, value: unknown) => attribute(key, sensitive(key) ? REDACTED : redact(value, sensitive)),
+		attribute: safeAttribute,
 		end: (time: bigint, exit: Exit.Exit<unknown, unknown>) => {
 			for (const [key, value] of span.attributes) {
-				attribute(key, sensitive(key) ? REDACTED : redact(value, sensitive));
+				safeAttribute(key, value);
 			}
 			end(time, Exit.isFailure(exit) ? Exit.failCause(redactDiagnosticCause(exit.cause, sensitive)) : exit);
 		},

package/src/safeOtlpSerialization.ts

@@ -1,20 +1,13 @@
 import { Effect, Layer } from "effect";
 import type { OtlpResource, OtlpTracer } from "effect/observability";
 import { OtlpSerialization } from "effect/observability";
-import { isSensitiveKey, REDACTED, redactText, type SensitiveKey } from "@shivaedev/errors/sensitive.ts";
+import { REDACTED, redactText, type SensitiveKey } from "@shivaedev/errors/sensitive.ts";
 import { type HostRedactionPolicy, RedactionPolicy, redactionForRpc } from "#RedactionPolicy.ts";
-import { redactOtlpUrl } from "#redactOtlpUrl.ts";
 
-function otlpSensitive(sensitive: SensitiveKey): SensitiveKey {
-	return (key) => sensitive(key) || ["db.user", "db.user.name", "db.connection_string"].includes(key.toLowerCase());
-}
-export function redactOtlpText(value: string, key = "", sensitive: SensitiveKey = isSensitiveKey) {
-	return redactText(redactOtlpUrl(value, key), otlpSensitive(sensitive));
-}
 function attributeValue(value: OtlpResource.AnyValue, key: string, sensitive: SensitiveKey): OtlpResource.AnyValue {
 	return {
 		...value,
-		...(typeof value.stringValue === "string" ? { stringValue: redactOtlpText(value.stringValue, key, sensitive) } : {}),
+		...(typeof value.stringValue === "string" ? { stringValue: redactText(value.stringValue, sensitive, undefined, key) } : {}),
 		...(value.arrayValue ? { arrayValue: { values: value.arrayValue.values.map((item) => attributeValue(item, key, sensitive)) } } : {}),
 		...(value.kvlistValue ? { kvlistValue: { values: attributes(value.kvlistValue.values, sensitive) } } : {}),
 	};
@@ -38,7 +31,7 @@ function spanName(span: { readonly name: string; readonly kind: number; readonly
 }
 
 function redactTraces(data: OtlpTracer.TraceData, policy: HostRedactionPolicy): OtlpTracer.TraceData {
-	const resourceSensitive = otlpSensitive(policy);
+	const resourceSensitive = policy;
 	return {
 		...data,
 		resourceSpans: data.resourceSpans.map((resource) => ({
@@ -48,9 +41,9 @@ function redactTraces(data: OtlpTracer.TraceData, policy: HostRedactionPolicy):
 				...scope,
 				spans: scope.spans.map((span) => {
 					const method = span.attributes.find(({ key }) => key === "rpc.method")?.value.stringValue;
-					const sensitive = otlpSensitive(redactionForRpc(policy, method));
+					const sensitive = redactionForRpc(policy, method);
 					function text(value: string) {
-						return redactOtlpText(value, "", sensitive);
+						return redactText(value, sensitive);
 					}
 					return {
 						...span,

package/src/setupDatabases.ts

@@ -8,5 +8,5 @@ export const setupDatabases = Effect.fn("Platform.setupDatabases")(function* ()
 		"DOCKER_HOST": Config.String("DOCKER_HOST").pipe(Config.withDefault("")),
 		"TEST_DATABASE_URL": Config.String("TEST_DATABASE_URL"),
 	});
-	yield* Effect.sync(() => localPostgres(config).prepareDatabases([config.DATABASE_URL, config.TEST_DATABASE_URL]));
+	yield* localPostgres(config).prepareDatabases([config.DATABASE_URL, config.TEST_DATABASE_URL]);
 });

package/src/socketRpc.ts

@@ -1,9 +1,11 @@
 import { Effect, type Scope } from "effect";
 import { Headers, HttpServerRequest, HttpServerResponse } from "effect/http";
 import * as HttpStatus from "effect/http/HttpStatus";
+import { isAuthUnavailable, isForbidden } from "@shivaedev/errors/taxonomy.ts";
 import { localTransport } from "@shivaedev/identity/server/local.ts";
 import { resolveSession, type SessionShape } from "@shivaedev/identity/server/session.ts";
 import { makeSocketSession, SocketSession } from "@shivaedev/identity/server/socketSession.ts";
+import { bearerSocketRpc } from "#bearerSocketRpc.ts";
 import type { HostPolicy } from "#hostOptions.ts";
 
 export function socketRpc<TSession extends SessionShape>(
@@ -18,17 +20,15 @@ export function socketRpc<TSession extends SessionShape>(
 			return HttpServerResponse.text("Local same-origin requests only", { status: HttpStatus.fromLiteral("Forbidden") });
 		}
 		if (policy.policy !== "loopback") {
+			if (new URL(request.url, "http://localhost").searchParams.get("auth") === "frame") {
+				return yield* bearerSocketRpc(handler, policy.sessions);
+			}
 			yield* resolveSession(policy.sessions, Headers.empty, "$connect");
 			const session = yield* makeSocketSession(policy.sessions.streamRevalidationInterval ?? "30 seconds");
 			return yield* Effect.provideService(handler, SocketSession, session);
 		}
 		return yield* handler;
-	}).pipe(
-		Effect.catchTags({
-			AuthUnavailable: authUnavailable,
-			Forbidden: forbidden,
-		}),
-	);
+	}).pipe(Effect.catchIf(isAuthUnavailable, authUnavailable), Effect.catchIf(isForbidden, forbidden));
 }
 
 function authUnavailable() {

package/dist/databaseLayer.d.ts

@@ -1,14 +0,0 @@
-import * as PgClient from "@effect/sql-pg/PgClient";
-import { Config, Layer, Redacted } from "effect";
-import * as Reactivity from "effect/reactivity/Reactivity";
-import { Migrator } from "effect/sql";
-import { type PostgresChangesOptions } from "@shivaedev/sql/postgresChanges.ts";
-import { type PostgresOptions } from "@shivaedev/sql/postgresLayer.ts";
-import type { AppChanges, AppDatabaseOptions } from "#appHost.ts";
-export interface DatabaseConfig extends PostgresOptions {
-    readonly changes?: Partial<Omit<PostgresChangesOptions, "client" | "listenerClient" | "connectionSetting" | "resync">>;
-    readonly databaseUrl?: Redacted.Redacted<string>;
-    readonly listenDatabaseUrl?: Redacted.Redacted<string>;
-}
-export declare function databaseLayer<R, E>(options: AppDatabaseOptions<R, E>, changesService: typeof AppChanges): Layer.Layer<AppChanges | PgClient.PgClient | import("@effect/sql-pg/PgPool").PgPool | Reactivity.Reactivity | import("effect/sql/SqlClient").SqlClient, E | Config.ConfigError | Migrator.MigrationError | import("@shivaedev/sql/PostgresListenerError.ts").PostgresListenerError | import("effect/Schema").SchemaError | import("effect/sql/SqlError").SqlError, Exclude<Exclude<R, import("effect/Scope").Scope>, PgClient.PgClient | import("@effect/sql-pg/PgPool").PgPool | import("effect/sql/SqlClient").SqlClient>>;
-//# sourceMappingURL=databaseLayer.d.ts.map

package/dist/databaseLayer.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"databaseLayer.d.ts","sourceRoot":"","sources":["../src/databaseLayer.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,QAAQ,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAoC,KAAK,EAAU,QAAQ,EAAY,MAAM,QAAQ,CAAC;AACrG,OAAO,KAAK,UAAU,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AAMtC,OAAO,EAAE,KAAK,sBAAsB,EAAmB,MAAM,mCAAmC,CAAC;AACjG,OAAO,EAAE,KAAK,eAAe,EAAiB,MAAM,iCAAiC,CAAC;AAEtF,OAAO,KAAK,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAElE,MAAM,WAAW,cAAe,SAAQ,eAAe;IACtD,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE,QAAQ,GAAG,gBAAgB,GAAG,mBAAmB,GAAG,QAAQ,CAAC,CAAC,CAAC;IACvH,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACjD,QAAQ,CAAC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;CACvD;AAED,wBAAgB,aAAa,CAAC,CAAC,EAAE,CAAC,EAAE,OAAO,EAAE,kBAAkB,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,cAAc,EAAE,OAAO,UAAU,ggBAqCvG"}

package/dist/databaseLayer.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"databaseLayer.js","sourceRoot":"","sources":["../src/databaseLayer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,KAAK,QAAQ,MAAM,yBAAyB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,QAAQ,CAAC;AACrG,OAAO,KAAK,UAAU,MAAM,8BAA8B,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,YAAY,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,uCAAuC,CAAC;AACvE,OAAO,EAAE,wBAAwB,EAAE,sBAAsB,EAAE,MAAM,4CAA4C,CAAC;AAC9G,OAAO,EAAE,uBAAuB,EAAE,MAAM,2CAA2C,CAAC;AACpF,OAAO,EAAE,eAAe,EAAE,MAAM,8BAA8B,CAAC;AAC/D,OAAO,EAAkC,yBAAyB,EAAE,MAAM,6CAA6C,CAAC;AACxH,OAAO,EAA+B,eAAe,EAAE,MAAM,mCAAmC,CAAC;AACjG,OAAO,EAAwB,aAAa,EAAE,MAAM,iCAAiC,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,iCAAiC,CAAC;AAShE,MAAM,UAAU,aAAa,CAAO,OAAiC,EAAE,cAAiC;IACvG,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CACxB,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAC5I,aAAa,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,CAClC,CACD,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,aAAa,CAAC,iBAAiB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;IAC3G,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC;IACrG,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;IACtC,MAAM,MAAM,GACX,UAAU,CAAC,IAAI,KAAK,MAAM,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS;QAC7D,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,EAAE,uBAAuB,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,YAAY,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;QACrH,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC;IAChB,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;IAC1E,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC;IACxC,OAAO,KAAK,CAAC,MAAM,CAClB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QACnB,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;QACxC,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,cAAc,CAAC;QACpC,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC;QACpF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC9G,MAAM,OAAO,GAAG,OAAO,EAAE,OAAO,IAAI,WAAW,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QAC9G,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,EAAE,iBAAiB,IAAI,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;QAChJ,MAAM,cAAc,GACnB,SAAS,KAAK,SAAS;YACtB,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CACjB,KAAK,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,EAAE,EAAE,eAAe,EAAE,OAAO,CAAC,MAAM,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,EAAE,CAAC,CAAC,EAC9G,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,QAAQ,CAAC,CACpD,CAAC;QACL,IAAI,iBAAiB,GAAG,OAAO,CAAC,MAAM,EAAE,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAC1G,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC7B,iBAAiB,GAAG,OAAO,CAAC,MAAM,EAAE,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,0BAA0B,CAAC;QAC1H,CAAC;QACD,OAAO,eAAe,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAClH,CAAC,CAAC,CACF,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,iBAAiB,CAAO,UAAkD;IAClF,QAAQ,UAAU,CAAC,IAAI,EAAE,CAAC;QACzB,KAAK,OAAO,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,EAAE,GAAG,UAAU,EAAE,CAAC;YACjC,OAAO,MAAM,CAAC,OAAO,CAAC;YACtB,OAAO,wBAAwB,CAAC,MAAM,CAAC,CAAC;QACzC,CAAC;QACD,KAAK,MAAM;YACV,OAAO,iBAAiB,CAAC,UAAU,CAAC,CAAC;QACtC;YACC,OAAO,eAAe,CAAC,EAAE,GAAG,UAAU,EAAE,WAAW,EAAE,UAAU,CAAC,WAAW,IAAI,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpH,CAAC;AACF,CAAC;AAED,SAAS,iBAAiB,CAAO,UAAkD;IAClF,OAAO,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC1B,MAAM,gBAAgB,GAAG,QAAQ,CAAC,eAAe,CAAC,UAAU,CAAC,gBAAgB,IAAI,YAAY,CAAC,CAAC;QAC/F,IAAI,OAAO,GAA8B,EAAE,UAAU,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;QAC5E,IAAI,QAAwC,CAAC;QAC7C,SAAS,GAAG,CAAC,OAAe;YAC3B,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE,CAC1B,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,iBAAiB,EAAE,OAAO,CAAC,UAAU,EAAE,iBAAiB,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CACnI,CAAC;QACH,CAAC;QACD,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC1B,OAAO,GAAG,KAAK,CAAC,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC;YACvD,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACxE,OAAO;YACR,CAAC;YACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAC5B,KAAK,CAAC,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;gBAC9C,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CACvI,MAAM,CAAC,UAAU,CACjB,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC,IAAI,CACN,MAAM,CAAC,KAAK,CAAC;YACZ,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,YAAY,IAAI,UAAU,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,CAAC,WAAW,IAAI,WAAW,CAAC,CAAC,CAAC;YACxI,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,YAAY,QAAQ,CAAC,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU;SACvF,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACzB,KAAK,YAAY,QAAQ,CAAC,cAAc,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CACtI,CACD,CAAC;QACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,KAAK,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;YACjC,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,6BAA6B,CAAC,CAAC;QACtD,CAAC;IACF,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AACxB,CAAC"}

package/dist/redactOtlpUrl.d.ts

@@ -1,2 +0,0 @@
-export declare function redactOtlpUrl(value: string, key?: string): string;
-//# sourceMappingURL=redactOtlpUrl.d.ts.map

package/dist/redactOtlpUrl.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"redactOtlpUrl.d.ts","sourceRoot":"","sources":["../src/redactOtlpUrl.ts"],"names":[],"mappings":"AA6BA,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,SAAK,GAAG,MAAM,CAkB7D"}

package/dist/redactOtlpUrl.js

@@ -1,41 +0,0 @@
-import { REDACTED } from "@shivaedev/errors/sensitive.ts";
-function query(value) {
-    return value
-        .split("&")
-        .map((part) => (part === "" ? part : `${part.split("=", 1)[0]}=${REDACTED}`))
-        .join("&");
-}
-function url(value) {
-    const fragment = value.indexOf("#");
-    const target = fragment === -1 ? value : value.slice(0, fragment);
-    const separator = target.indexOf("?");
-    return ((separator === -1 ? target : `${target.slice(0, separator + 1)}${query(target.slice(separator + 1))}`).replaceAll(/(?<authority>(?:\b[a-z][a-z0-9+.-]*:)?\/\/)[^/?#]*@/giu, `$<authority>${REDACTED}@`) + (fragment === -1 ? "" : `#${REDACTED}`));
-}
-function structured(value) {
-    try {
-        return JSON.stringify(JSON.parse(value, (key, item) => (typeof item === "string" ? redactOtlpUrl(item, key) : item)));
-    }
-    catch {
-        return undefined;
-    }
-}
-export function redactOtlpUrl(value, key = "") {
-    if (/(?:^|[._-])(?:fragment|userinfo|username|password)$/iu.test(key)) {
-        return REDACTED;
-    }
-    if (/(?:^|[._-])query$/iu.test(key)) {
-        return url(`?${value}`).slice(1);
-    }
-    if (/(?:^|[._-])(?:url|uri|target)(?:$|[._-])/iu.test(key) || /(?:^|[._-])(?:referer|referrer|location|origin)$/iu.test(key)) {
-        return url(value);
-    }
-    if (/^\s*[[{]/u.test(value)) {
-        const redacted = structured(value);
-        if (redacted !== undefined) {
-            return redacted;
-        }
-    }
-    // Quotes and whitespace can belong to secret values, so free text has no safe closing delimiter.
-    return value.replaceAll(/(?:[a-z][a-z0-9+.-]*:\/\/|[/?#]).*/gisu, url);
-}
-//# sourceMappingURL=redactOtlpUrl.js.map

package/dist/redactOtlpUrl.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"redactOtlpUrl.js","sourceRoot":"","sources":["../src/redactOtlpUrl.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,gCAAgC,CAAC;AAE1D,SAAS,KAAK,CAAC,KAAa;IAC3B,OAAO,KAAK;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC,CAAC;SAC5E,IAAI,CAAC,GAAG,CAAC,CAAC;AACb,CAAC;AAED,SAAS,GAAG,CAAC,KAAa;IACzB,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,CACN,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,UAAU,CAChH,wDAAwD,EACxD,eAAe,QAAQ,GAAG,CAC1B,GAAG,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,QAAQ,EAAE,CAAC,CAC3C,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAChC,IAAI,CAAC;QACJ,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAW,EAAE,IAAa,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACxI,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,GAAG,GAAG,EAAE;IACpD,IAAI,uDAAuD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvE,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACrC,OAAO,GAAG,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;IACD,IAAI,4CAA4C,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,oDAAoD,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9H,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC;IACnB,CAAC;IACD,IAAI,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;QACnC,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO,QAAQ,CAAC;QACjB,CAAC;IACF,CAAC;IACD,iGAAiG;IACjG,OAAO,KAAK,CAAC,UAAU,CAAC,wCAAwC,EAAE,GAAG,CAAC,CAAC;AACxE,CAAC"}

package/dist/schemaSensitiveAst.d.ts

@@ -1,7 +0,0 @@
-import { type SchemaAST } from "effect";
-export declare function marked(ast: SchemaAST.AST, seen?: Set<SchemaAST.AST>): boolean;
-export declare function collectEncodedKeys(ast: SchemaAST.AST, keys: Set<string>): void;
-export declare function maskedValue(ast: SchemaAST.AST, keys: ReadonlySet<string>, seen?: Set<SchemaAST.AST>): boolean;
-export declare function collect(ast: SchemaAST.AST, nodes: Set<SchemaAST.AST>, encodings?: boolean): void;
-export declare function collectFieldKeys(properties: SchemaAST.Objects["propertySignatures"], keys: Set<string>, sensitive: (ast: SchemaAST.AST) => boolean): void;
-//# sourceMappingURL=schemaSensitiveAst.d.ts.map

package/dist/schemaSensitiveAst.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"schemaSensitiveAst.d.ts","sourceRoot":"","sources":["../src/schemaSensitiveAst.ts"],"names":[],"mappings":"AAAA,OAAO,EAAa,KAAK,SAAS,EAAE,MAAM,QAAQ,CAAC;AAsBnD,wBAAgB,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,IAAI,qBAA2B,GAAG,OAAO,CAenF;AAOD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,QAcvE;AAOD,wBAAgB,WAAW,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,qBAA2B,GAAG,OAAO,CAmBnH;AACD,wBAAgB,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,SAAS,UAAO,QAQtF;AAMD,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,SAAS,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,SAAS,EAAE,CAAC,GAAG,EAAE,SAAS,CAAC,GAAG,KAAK,OAAO,QAMlJ"}