@smthrs/notifications 1.0.0-rc.4 → 1.0.0-rc.6

package/README.md

@@ -2,9 +2,9 @@
 
 Release candidate scope, host requirements and compatibility review are defined in the [library support policy](https://github.com/smithersai/smithers/blob/main/RELEASE_SUPPORT.md).
 
-This package declares `effect` as an exact
-`4.0.0-rc.115` peer dependency. Keep the application on that version so
-all Smithers packages share one Effect runtime.
+This package declares `effect` as a `^4.0.4` peer dependency. Install one
+`effect` release in that range so all Smithers packages share one Effect
+runtime.
 
 **Documentation:** https://notifications.smithers.sh
 

package/dist/cjs/layerWebhook.d.ts

@@ -35,6 +35,13 @@ export declare const defaultWebhookTimeout: Duration.Duration;
  * Each delivery has its own scope, which aborts the request and releases any
  * unread response body on completion, failure, timeout, or interruption.
  *
+ * The url is treated as a credential, because a webhook's secret usually is
+ * its path or query. The delivery's HTTP span is named for the method and
+ * records the scheme, host, port and answering status, never the path, the
+ * query or userinfo, and it fails with the same url-free reason the sink
+ * returns. A host that records HTTP headers on spans gets every name in
+ * `headers`, and a redirect's `location`, as `<redacted>`.
+ *
  * A non-2xx response is a failure, not a delivery, and an endpoint that never
  * answers is a failure after `timeout`. Paging is exactly the case where a
  * silently dropped request is worse than a retry, and a hung request is worse

package/dist/cjs/layerWebhook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"layerWebhook.d.ts","sourceRoot":"","sources":["../../src/layerWebhook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAU,KAAK,EAAU,MAAM,QAAQ,CAAA;AAKxD,OAAO,EAAc,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,QAA+B,CAAA;AAmD5E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,YAAY,GACvB,SAAS;IACP,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,QAAQ,GAAG,SAAS,CAAA;CACjD,KACA,KAAK,CAAC,KAAK,CAAC,IAAI,CAmD2B,CAAA"}
+{"version":3,"file":"layerWebhook.d.ts","sourceRoot":"","sources":["../../src/layerWebhook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAS,QAAQ,EAAgB,KAAK,EAAkB,MAAM,QAAQ,CAAA;AAM7E,OAAO,EAAc,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,QAA+B,CAAA;AAoH5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,YAAY,GACvB,SAAS;IACP,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,QAAQ,GAAG,SAAS,CAAA;CACjD,KACA,KAAK,CAAC,KAAK,CAAC,IAAI,CAwD2B,CAAA"}

package/dist/cjs/layerWebhook.js

@@ -33,9 +33,10 @@ __export(layerWebhook_exports, {
 });
 module.exports = __toCommonJS(layerWebhook_exports);
 var import_effect = require("effect");
-var FetchHttpClient = __toESM(require("effect/unstable/http/FetchHttpClient"), 1);
-var HttpClient = __toESM(require("effect/unstable/http/HttpClient"), 1);
-var HttpClientRequest = __toESM(require("effect/unstable/http/HttpClientRequest"), 1);
+var FetchHttpClient = __toESM(require("effect/http/FetchHttpClient"), 1);
+var Headers = __toESM(require("effect/http/Headers"), 1);
+var HttpClient = __toESM(require("effect/http/HttpClient"), 1);
+var HttpClientRequest = __toESM(require("effect/http/HttpClientRequest"), 1);
 var import_AlertPolicy = require("./AlertPolicy.js");
 var import_AlertSink = require("./AlertSink.js");
 const defaultWebhookTimeout = import_effect.Duration.seconds(10);
@@ -59,12 +60,50 @@ const followingNoRedirects = (effect) => import_effect.Effect.flatMap(
     redirect: "manual"
   })
 );
+const rejected = (status) => new import_AlertSink.AlertError({ code: "sink_rejected", status, message: `Alert webhook answered ${status}` });
+const originAttributes = /* @__PURE__ */ new Set([
+  "http.request.method",
+  "url.scheme",
+  "server.address",
+  "server.port",
+  "http.response.status_code",
+  "error.type"
+]);
+const isHeaderAttribute = (key) => key.startsWith("http.request.header.") || key.startsWith("http.response.header.");
+const redirectHeaderNames = ["location", "content-location"];
+const withoutRequest = (tracer) => import_effect.Tracer.make({
+  ...tracer,
+  span(options) {
+    const span = tracer.span(options);
+    const end = span.end.bind(span);
+    const attribute = span.attribute.bind(span);
+    span.attribute = (key, value) => {
+      if (originAttributes.has(key) || isHeaderAttribute(key)) attribute(key, value);
+    };
+    span.end = (endTime, exit) => {
+      if (exit._tag === "Success") return end(endTime, import_effect.Exit.void);
+      if (import_effect.Cause.hasInterruptsOnly(exit.cause)) return end(endTime, exit);
+      const status = span.attributes.get("http.response.status_code");
+      return end(
+        endTime,
+        import_effect.Exit.fail(
+          typeof status === "number" ? rejected(status) : new import_AlertSink.AlertError({ code: "sink_unreachable", message: "Alert webhook could not be reached" })
+        )
+      );
+    };
+    return span;
+  }
+});
 const layerWebhook = (options) => import_effect.Layer.effect(
   import_AlertSink.Sink,
   import_effect.Effect.gen(function* () {
     const url = yield* import_effect.Effect.orDie(webhookUrl(options.url));
     const client = HttpClient.withScope(yield* HttpClient.HttpClient);
     const timeout = options.timeout ?? defaultWebhookTimeout;
+    const redactedNames = [
+      ...Object.keys(options.headers ?? {}).map((name) => name.toLowerCase()),
+      ...redirectHeaderNames
+    ];
     return {
       deliver: (alert) => client.execute(
         HttpClientRequest.post(url).pipe(
@@ -74,14 +113,13 @@ const layerWebhook = (options) => import_effect.Layer.effect(
         )
       ).pipe(
         followingNoRedirects,
+        import_effect.Effect.updateService(Headers.CurrentRedactedNames, (names) => [...names, ...redactedNames]),
+        // A host may name HTTP spans for their url. This one is named for
+        // its method, as the client names it by default.
+        import_effect.Effect.provideService(HttpClient.SpanNameGenerator, (request) => request.method),
+        import_effect.Effect.updateService(import_effect.Tracer.Tracer, withoutRequest),
         import_effect.Effect.flatMap(
-          (response) => response.status >= 200 && response.status < 300 ? import_effect.Effect.void : import_effect.Effect.fail(
-            new import_AlertSink.AlertError({
-              code: "sink_rejected",
-              status: response.status,
-              message: `Alert webhook answered ${response.status}`
-            })
-          )
+          (response) => response.status >= 200 && response.status < 300 ? import_effect.Effect.void : import_effect.Effect.fail(rejected(response.status))
         ),
         import_effect.Effect.timeout(timeout),
         import_effect.Effect.scoped,

package/dist/cjs/layerWebhook.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/layerWebhook.ts"],
-  "sourcesContent": ["/**\n * The webhook alert sink: one POST per alert, keyed so the receiver can\n * dedupe on it.\n *\n * The transport rules live here rather than beside the policy, because which\n * endpoint is paged, over which scheme, carrying which credential is a\n * deployment's decision and the delays are not.\n *\n * @since 1.0.0\n */\n\nimport { Duration, Effect, Layer, Option } from \"effect\"\nimport * as FetchHttpClient from \"effect/unstable/http/FetchHttpClient\"\nimport * as HttpClient from \"effect/unstable/http/HttpClient\"\nimport * as HttpClientRequest from \"effect/unstable/http/HttpClientRequest\"\nimport { alertId } from \"./AlertPolicy.ts\"\nimport { AlertError, Sink } from \"./AlertSink.ts\"\n\n/**\n * How long the webhook sink waits for an answer before it calls the page\n * refused.\n *\n * @category constants\n * @since 1.0.0\n */\nexport const defaultWebhookTimeout: Duration.Duration = Duration.seconds(10)\n\n/**\n * The one check the webhook endpoint gets before an alert is ever built on\n * it.\n *\n * The url is operator config rather than runtime input, so there is no SSRF\n * vector to close here; the scheme bound is what keeps a credential the\n * deployment set in `headers` from being handed to a scheme that is not HTTP\n * at all. A `file:` or `javascript:` url is a config bug, and it fails the\n * composition the way an impossible policy rule does. The error names no\n * url: the value can carry basic-auth credentials, and an error is logged.\n */\nconst webhookUrl = (raw: string): Effect.Effect<string, AlertError> =>\n  Effect.suspend(() => {\n    const misconfigured = new AlertError({\n      code: \"sink_misconfigured\",\n      message: \"Alert webhook url must be an absolute http: or https: URL\"\n    })\n    let parsed: URL\n    try {\n      parsed = new URL(raw)\n    } catch {\n      return Effect.fail(misconfigured)\n    }\n    return parsed.protocol === \"http:\" || parsed.protocol === \"https:\"\n      ? Effect.succeed(raw)\n      : Effect.fail(misconfigured)\n  })\n\n/**\n * Runs a webhook request with redirect following switched off at the fetch\n * transport.\n *\n * The request carries whatever credential the deployment put in `headers`,\n * and a transport that follows a 3xx re-sends those headers to an origin the\n * deployment never named. Every other fetch default the composition set is\n * kept; only the redirect mode is forced. A 3xx therefore surfaces to the\n * status rule, which calls it `sink_rejected`: a redirecting pager endpoint\n * is a misconfiguration to fix, not an address to forward credentials to.\n */\nconst followingNoRedirects = <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, E, R> =>\n  Effect.flatMap(\n    Effect.serviceOption(FetchHttpClient.RequestInit),\n    (init) =>\n      Effect.provideService(effect, FetchHttpClient.RequestInit, {\n        ...(Option.isSome(init) ? init.value : {}),\n        redirect: \"manual\"\n      })\n  )\n\n/**\n * A sink that POSTs each alert to one webhook.\n *\n * The body is the alert plus its {@link alertId}, and the same id is sent as\n * an `Idempotency-Key` header, because the package requires the receiver to\n * dedupe on it and a body without it cannot. The header is set after the\n * caller's headers, so it is the one this sink sends.\n *\n * The endpoint must be an absolute `http:` or `https:` URL, checked when the\n * layer is built, and the request is made with redirect following disabled:\n * the caller's headers can carry a credential, and a followed redirect would\n * re-send them to an origin the deployment never named. A 3xx answer is a\n * refusal like any other non-2xx, not a forwarding instruction. The sink owns\n * its Fetch transport; an externally supplied `HttpClient` is not used.\n * Each delivery has its own scope, which aborts the request and releases any\n * unread response body on completion, failure, timeout, or interruption.\n *\n * A non-2xx response is a failure, not a delivery, and an endpoint that never\n * answers is a failure after `timeout`. Paging is exactly the case where a\n * silently dropped request is worse than a retry, and a hung request is worse\n * than either: it is indistinguishable from silence, so it must not be\n * possible to wait on one forever.\n *\n * @param options the endpoint, any headers it needs, and how long to wait\n * @category layers\n * @since 0.1.0\n */\nexport const layerWebhook = (\n  options: {\n    readonly url: string\n    readonly headers?: Readonly<Record<string, string>> | undefined\n    readonly timeout?: Duration.Duration | undefined\n  }\n): Layer.Layer<Sink> =>\n  Layer.effect(\n    Sink,\n    Effect.gen(function*() {\n      const url = yield* Effect.orDie(webhookUrl(options.url))\n      const client = HttpClient.withScope(yield* HttpClient.HttpClient)\n      const timeout = options.timeout ?? defaultWebhookTimeout\n      return {\n        deliver: (alert) =>\n          client.execute(\n            HttpClientRequest.post(url).pipe(\n              (request) =>\n                options.headers === undefined ? request : HttpClientRequest.setHeaders(request, options.headers),\n              HttpClientRequest.setHeader(\"Idempotency-Key\", alertId(alert)),\n              HttpClientRequest.bodyJsonUnsafe({ ...alert, alertId: alertId(alert) })\n            )\n          ).pipe(\n            followingNoRedirects,\n            Effect.flatMap((response) =>\n              response.status >= 200 && response.status < 300\n                ? Effect.void\n                : Effect.fail(\n                  new AlertError({\n                    code: \"sink_rejected\",\n                    status: response.status,\n                    message: `Alert webhook answered ${response.status}`\n                  })\n                )\n            ),\n            Effect.timeout(timeout),\n            Effect.scoped,\n            Effect.catchTag(\"TimeoutError\", () =>\n              Effect.fail(\n                new AlertError({\n                  code: \"sink_timeout\",\n                  message: `Alert webhook did not answer within ${Duration.toMillis(timeout)} ms`\n                })\n              )),\n            // The transport error holds the request, and the request holds the\n            // caller's headers. Only its reason tag crosses into the failure.\n            Effect.catchTag(\"HttpClientError\", (cause) =>\n              Effect.fail(\n                new AlertError({\n                  code: \"sink_unreachable\",\n                  reason: cause.reason._tag,\n                  message: \"Alert webhook could not be reached\"\n                })\n              ))\n          )\n      }\n    })\n  ).pipe(Layer.provide(FetchHttpClient.layer))\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWA,oBAAgD;AAChD,sBAAiC;AACjC,iBAA4B;AAC5B,wBAAmC;AACnC,yBAAwB;AACxB,uBAAiC;AAS1B,MAAM,wBAA2C,uBAAS,QAAQ,EAAE;AAa3E,MAAM,aAAa,CAAC,QAClB,qBAAO,QAAQ,MAAM;AACnB,QAAM,gBAAgB,IAAI,4BAAW;AAAA,IACnC,MAAM;AAAA,IACN,SAAS;AAAA,EACX,CAAC;AACD,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,GAAG;AAAA,EACtB,QAAQ;AACN,WAAO,qBAAO,KAAK,aAAa;AAAA,EAClC;AACA,SAAO,OAAO,aAAa,WAAW,OAAO,aAAa,WACtD,qBAAO,QAAQ,GAAG,IAClB,qBAAO,KAAK,aAAa;AAC/B,CAAC;AAaH,MAAM,uBAAuB,CAAU,WACrC,qBAAO;AAAA,EACL,qBAAO,cAAc,gBAAgB,WAAW;AAAA,EAChD,CAAC,SACC,qBAAO,eAAe,QAAQ,gBAAgB,aAAa;AAAA,IACzD,GAAI,qBAAO,OAAO,IAAI,IAAI,KAAK,QAAQ,CAAC;AAAA,IACxC,UAAU;AAAA,EACZ,CAAC;AACL;AA6BK,MAAM,eAAe,CAC1B,YAMA,oBAAM;AAAA,EACJ;AAAA,EACA,qBAAO,IAAI,aAAY;AACrB,UAAM,MAAM,OAAO,qBAAO,MAAM,WAAW,QAAQ,GAAG,CAAC;AACvD,UAAM,SAAS,WAAW,UAAU,OAAO,WAAW,UAAU;AAChE,UAAM,UAAU,QAAQ,WAAW;AACnC,WAAO;AAAA,MACL,SAAS,CAAC,UACR,OAAO;AAAA,QACL,kBAAkB,KAAK,GAAG,EAAE;AAAA,UAC1B,CAAC,YACC,QAAQ,YAAY,SAAY,UAAU,kBAAkB,WAAW,SAAS,QAAQ,OAAO;AAAA,UACjG,kBAAkB,UAAU,uBAAmB,4BAAQ,KAAK,CAAC;AAAA,UAC7D,kBAAkB,eAAe,EAAE,GAAG,OAAO,aAAS,4BAAQ,KAAK,EAAE,CAAC;AAAA,QACxE;AAAA,MACF,EAAE;AAAA,QACA;AAAA,QACA,qBAAO;AAAA,UAAQ,CAAC,aACd,SAAS,UAAU,OAAO,SAAS,SAAS,MACxC,qBAAO,OACP,qBAAO;AAAA,YACP,IAAI,4BAAW;AAAA,cACb,MAAM;AAAA,cACN,QAAQ,SAAS;AAAA,cACjB,SAAS,0BAA0B,SAAS,MAAM;AAAA,YACpD,CAAC;AAAA,UACH;AAAA,QACJ;AAAA,QACA,qBAAO,QAAQ,OAAO;AAAA,QACtB,qBAAO;AAAA,QACP,qBAAO,SAAS,gBAAgB,MAC9B,qBAAO;AAAA,UACL,IAAI,4BAAW;AAAA,YACb,MAAM;AAAA,YACN,SAAS,uCAAuC,uBAAS,SAAS,OAAO,CAAC;AAAA,UAC5E,CAAC;AAAA,QACH,CAAC;AAAA;AAAA;AAAA,QAGH,qBAAO,SAAS,mBAAmB,CAAC,UAClC,qBAAO;AAAA,UACL,IAAI,4BAAW;AAAA,YACb,MAAM;AAAA,YACN,QAAQ,MAAM,OAAO;AAAA,YACrB,SAAS;AAAA,UACX,CAAC;AAAA,QACH,CAAC;AAAA,MACL;AAAA,IACJ;AAAA,EACF,CAAC;AACH,EAAE,KAAK,oBAAM,QAAQ,gBAAgB,KAAK,CAAC;",
+  "sourcesContent": ["/**\n * The webhook alert sink: one POST per alert, keyed so the receiver can\n * dedupe on it.\n *\n * The transport rules live here rather than beside the policy, because which\n * endpoint is paged, over which scheme, carrying which credential is a\n * deployment's decision and the delays are not.\n *\n * @since 1.0.0\n */\n\nimport { Cause, Duration, Effect, Exit, Layer, Option, Tracer } from \"effect\"\nimport * as FetchHttpClient from \"effect/http/FetchHttpClient\"\nimport * as Headers from \"effect/http/Headers\"\nimport * as HttpClient from \"effect/http/HttpClient\"\nimport * as HttpClientRequest from \"effect/http/HttpClientRequest\"\nimport { alertId } from \"./AlertPolicy.ts\"\nimport { AlertError, Sink } from \"./AlertSink.ts\"\n\n/**\n * How long the webhook sink waits for an answer before it calls the page\n * refused.\n *\n * @category constants\n * @since 1.0.0\n */\nexport const defaultWebhookTimeout: Duration.Duration = Duration.seconds(10)\n\n/**\n * The one check the webhook endpoint gets before an alert is ever built on\n * it.\n *\n * The url is operator config rather than runtime input, so there is no SSRF\n * vector to close here; the scheme bound is what keeps a credential the\n * deployment set in `headers` from being handed to a scheme that is not HTTP\n * at all. A `file:` or `javascript:` url is a config bug, and it fails the\n * composition the way an impossible policy rule does. The error names no\n * url: the value can carry basic-auth credentials, and an error is logged.\n */\nconst webhookUrl = (raw: string): Effect.Effect<string, AlertError> =>\n  Effect.suspend(() => {\n    const misconfigured = new AlertError({\n      code: \"sink_misconfigured\",\n      message: \"Alert webhook url must be an absolute http: or https: URL\"\n    })\n    let parsed: URL\n    try {\n      parsed = new URL(raw)\n    } catch {\n      return Effect.fail(misconfigured)\n    }\n    return parsed.protocol === \"http:\" || parsed.protocol === \"https:\"\n      ? Effect.succeed(raw)\n      : Effect.fail(misconfigured)\n  })\n\n/**\n * Runs a webhook request with redirect following switched off at the fetch\n * transport.\n *\n * The request carries whatever credential the deployment put in `headers`,\n * and a transport that follows a 3xx re-sends those headers to an origin the\n * deployment never named. Every other fetch default the composition set is\n * kept; only the redirect mode is forced. A 3xx therefore surfaces to the\n * status rule, which calls it `sink_rejected`: a redirecting pager endpoint\n * is a misconfiguration to fix, not an address to forward credentials to.\n */\nconst followingNoRedirects = <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, E, R> =>\n  Effect.flatMap(\n    Effect.serviceOption(FetchHttpClient.RequestInit),\n    (init) =>\n      Effect.provideService(effect, FetchHttpClient.RequestInit, {\n        ...(Option.isSome(init) ? init.value : {}),\n        redirect: \"manual\"\n      })\n  )\n\nconst rejected = (status: number): AlertError =>\n  new AlertError({ code: \"sink_rejected\", status, message: `Alert webhook answered ${status}` })\n\n/**\n * The span attributes of a delivery that say nothing of the url's path, query\n * or userinfo: the method, the origin and the answer.\n */\nconst originAttributes: ReadonlySet<string> = new Set([\n  \"http.request.method\",\n  \"url.scheme\",\n  \"server.address\",\n  \"server.port\",\n  \"http.response.status_code\",\n  \"error.type\"\n])\n\nconst isHeaderAttribute = (key: string): boolean =>\n  key.startsWith(\"http.request.header.\") || key.startsWith(\"http.response.header.\")\n\n/**\n * The headers of a redirect that name where the endpoint moved, which is the\n * same secret under another address.\n */\nconst redirectHeaderNames: ReadonlyArray<string> = [\"location\", \"content-location\"]\n\n/**\n * The tracer a delivery opens its HTTP span on: the caller's own, with nothing\n * of the request left on the span.\n *\n * A webhook url is a credential. Slack, Discord and PagerDuty put the secret\n * in the path, others take it in the query, and a url may carry basic-auth\n * userinfo. The HTTP client writes the whole url on its span and again in the\n * failure it ends the span with, and the answer or the transport error it ends\n * with holds the request. So only the attributes that name the method, the\n * origin and the answer are kept, with the headers a host chose to record, and\n * the span ends with the outcome alone: nothing on success, the refusing\n * status, or that the endpoint could not be reached.\n */\nconst withoutRequest = (tracer: Tracer.Tracer): Tracer.Tracer =>\n  Tracer.make({\n    ...tracer,\n    span(options) {\n      const span = tracer.span(options)\n      const end = span.end.bind(span)\n      const attribute = span.attribute.bind(span)\n      span.attribute = (key, value) => {\n        if (originAttributes.has(key) || isHeaderAttribute(key)) attribute(key, value)\n      }\n      span.end = (endTime, exit) => {\n        if (exit._tag === \"Success\") return end(endTime, Exit.void)\n        if (Cause.hasInterruptsOnly(exit.cause)) return end(endTime, exit)\n        const status = span.attributes.get(\"http.response.status_code\")\n        return end(\n          endTime,\n          Exit.fail(\n            typeof status === \"number\"\n              ? rejected(status)\n              : new AlertError({ code: \"sink_unreachable\", message: \"Alert webhook could not be reached\" })\n          )\n        )\n      }\n      return span\n    }\n  })\n\n/**\n * A sink that POSTs each alert to one webhook.\n *\n * The body is the alert plus its {@link alertId}, and the same id is sent as\n * an `Idempotency-Key` header, because the package requires the receiver to\n * dedupe on it and a body without it cannot. The header is set after the\n * caller's headers, so it is the one this sink sends.\n *\n * The endpoint must be an absolute `http:` or `https:` URL, checked when the\n * layer is built, and the request is made with redirect following disabled:\n * the caller's headers can carry a credential, and a followed redirect would\n * re-send them to an origin the deployment never named. A 3xx answer is a\n * refusal like any other non-2xx, not a forwarding instruction. The sink owns\n * its Fetch transport; an externally supplied `HttpClient` is not used.\n * Each delivery has its own scope, which aborts the request and releases any\n * unread response body on completion, failure, timeout, or interruption.\n *\n * The url is treated as a credential, because a webhook's secret usually is\n * its path or query. The delivery's HTTP span is named for the method and\n * records the scheme, host, port and answering status, never the path, the\n * query or userinfo, and it fails with the same url-free reason the sink\n * returns. A host that records HTTP headers on spans gets every name in\n * `headers`, and a redirect's `location`, as `<redacted>`.\n *\n * A non-2xx response is a failure, not a delivery, and an endpoint that never\n * answers is a failure after `timeout`. Paging is exactly the case where a\n * silently dropped request is worse than a retry, and a hung request is worse\n * than either: it is indistinguishable from silence, so it must not be\n * possible to wait on one forever.\n *\n * @param options the endpoint, any headers it needs, and how long to wait\n * @category layers\n * @since 0.1.0\n */\nexport const layerWebhook = (\n  options: {\n    readonly url: string\n    readonly headers?: Readonly<Record<string, string>> | undefined\n    readonly timeout?: Duration.Duration | undefined\n  }\n): Layer.Layer<Sink> =>\n  Layer.effect(\n    Sink,\n    Effect.gen(function*() {\n      const url = yield* Effect.orDie(webhookUrl(options.url))\n      const client = HttpClient.withScope(yield* HttpClient.HttpClient)\n      const timeout = options.timeout ?? defaultWebhookTimeout\n      // `Headers.isRedactedName` compares a string matcher against an\n      // already-lowercased header name without lowercasing the matcher.\n      const redactedNames = [\n        ...Object.keys(options.headers ?? {}).map((name) => name.toLowerCase()),\n        ...redirectHeaderNames\n      ]\n      return {\n        deliver: (alert) =>\n          client.execute(\n            HttpClientRequest.post(url).pipe(\n              (request) =>\n                options.headers === undefined ? request : HttpClientRequest.setHeaders(request, options.headers),\n              HttpClientRequest.setHeader(\"Idempotency-Key\", alertId(alert)),\n              HttpClientRequest.bodyJsonUnsafe({ ...alert, alertId: alertId(alert) })\n            )\n          ).pipe(\n            followingNoRedirects,\n            Effect.updateService(Headers.CurrentRedactedNames, (names) => [...names, ...redactedNames]),\n            // A host may name HTTP spans for their url. This one is named for\n            // its method, as the client names it by default.\n            Effect.provideService(HttpClient.SpanNameGenerator, (request) => request.method),\n            Effect.updateService(Tracer.Tracer, withoutRequest),\n            Effect.flatMap((response) =>\n              response.status >= 200 && response.status < 300\n                ? Effect.void\n                : Effect.fail(rejected(response.status))\n            ),\n            Effect.timeout(timeout),\n            Effect.scoped,\n            Effect.catchTag(\"TimeoutError\", () =>\n              Effect.fail(\n                new AlertError({\n                  code: \"sink_timeout\",\n                  message: `Alert webhook did not answer within ${Duration.toMillis(timeout)} ms`\n                })\n              )),\n            // The transport error holds the request, and the request holds the\n            // caller's headers. Only its reason tag crosses into the failure.\n            Effect.catchTag(\"HttpClientError\", (cause) =>\n              Effect.fail(\n                new AlertError({\n                  code: \"sink_unreachable\",\n                  reason: cause.reason._tag,\n                  message: \"Alert webhook could not be reached\"\n                })\n              ))\n          )\n      }\n    })\n  ).pipe(Layer.provide(FetchHttpClient.layer))\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAWA,oBAAqE;AACrE,sBAAiC;AACjC,cAAyB;AACzB,iBAA4B;AAC5B,wBAAmC;AACnC,yBAAwB;AACxB,uBAAiC;AAS1B,MAAM,wBAA2C,uBAAS,QAAQ,EAAE;AAa3E,MAAM,aAAa,CAAC,QAClB,qBAAO,QAAQ,MAAM;AACnB,QAAM,gBAAgB,IAAI,4BAAW;AAAA,IACnC,MAAM;AAAA,IACN,SAAS;AAAA,EACX,CAAC;AACD,MAAI;AACJ,MAAI;AACF,aAAS,IAAI,IAAI,GAAG;AAAA,EACtB,QAAQ;AACN,WAAO,qBAAO,KAAK,aAAa;AAAA,EAClC;AACA,SAAO,OAAO,aAAa,WAAW,OAAO,aAAa,WACtD,qBAAO,QAAQ,GAAG,IAClB,qBAAO,KAAK,aAAa;AAC/B,CAAC;AAaH,MAAM,uBAAuB,CAAU,WACrC,qBAAO;AAAA,EACL,qBAAO,cAAc,gBAAgB,WAAW;AAAA,EAChD,CAAC,SACC,qBAAO,eAAe,QAAQ,gBAAgB,aAAa;AAAA,IACzD,GAAI,qBAAO,OAAO,IAAI,IAAI,KAAK,QAAQ,CAAC;AAAA,IACxC,UAAU;AAAA,EACZ,CAAC;AACL;AAEF,MAAM,WAAW,CAAC,WAChB,IAAI,4BAAW,EAAE,MAAM,iBAAiB,QAAQ,SAAS,0BAA0B,MAAM,GAAG,CAAC;AAM/F,MAAM,mBAAwC,oBAAI,IAAI;AAAA,EACpD;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,MAAM,oBAAoB,CAAC,QACzB,IAAI,WAAW,sBAAsB,KAAK,IAAI,WAAW,uBAAuB;AAMlF,MAAM,sBAA6C,CAAC,YAAY,kBAAkB;AAelF,MAAM,iBAAiB,CAAC,WACtB,qBAAO,KAAK;AAAA,EACV,GAAG;AAAA,EACH,KAAK,SAAS;AACZ,UAAM,OAAO,OAAO,KAAK,OAAO;AAChC,UAAM,MAAM,KAAK,IAAI,KAAK,IAAI;AAC9B,UAAM,YAAY,KAAK,UAAU,KAAK,IAAI;AAC1C,SAAK,YAAY,CAAC,KAAK,UAAU;AAC/B,UAAI,iBAAiB,IAAI,GAAG,KAAK,kBAAkB,GAAG,EAAG,WAAU,KAAK,KAAK;AAAA,IAC/E;AACA,SAAK,MAAM,CAAC,SAAS,SAAS;AAC5B,UAAI,KAAK,SAAS,UAAW,QAAO,IAAI,SAAS,mBAAK,IAAI;AAC1D,UAAI,oBAAM,kBAAkB,KAAK,KAAK,EAAG,QAAO,IAAI,SAAS,IAAI;AACjE,YAAM,SAAS,KAAK,WAAW,IAAI,2BAA2B;AAC9D,aAAO;AAAA,QACL;AAAA,QACA,mBAAK;AAAA,UACH,OAAO,WAAW,WACd,SAAS,MAAM,IACf,IAAI,4BAAW,EAAE,MAAM,oBAAoB,SAAS,qCAAqC,CAAC;AAAA,QAChG;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACF,CAAC;AAoCI,MAAM,eAAe,CAC1B,YAMA,oBAAM;AAAA,EACJ;AAAA,EACA,qBAAO,IAAI,aAAY;AACrB,UAAM,MAAM,OAAO,qBAAO,MAAM,WAAW,QAAQ,GAAG,CAAC;AACvD,UAAM,SAAS,WAAW,UAAU,OAAO,WAAW,UAAU;AAChE,UAAM,UAAU,QAAQ,WAAW;AAGnC,UAAM,gBAAgB;AAAA,MACpB,GAAG,OAAO,KAAK,QAAQ,WAAW,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,YAAY,CAAC;AAAA,MACtE,GAAG;AAAA,IACL;AACA,WAAO;AAAA,MACL,SAAS,CAAC,UACR,OAAO;AAAA,QACL,kBAAkB,KAAK,GAAG,EAAE;AAAA,UAC1B,CAAC,YACC,QAAQ,YAAY,SAAY,UAAU,kBAAkB,WAAW,SAAS,QAAQ,OAAO;AAAA,UACjG,kBAAkB,UAAU,uBAAmB,4BAAQ,KAAK,CAAC;AAAA,UAC7D,kBAAkB,eAAe,EAAE,GAAG,OAAO,aAAS,4BAAQ,KAAK,EAAE,CAAC;AAAA,QACxE;AAAA,MACF,EAAE;AAAA,QACA;AAAA,QACA,qBAAO,cAAc,QAAQ,sBAAsB,CAAC,UAAU,CAAC,GAAG,OAAO,GAAG,aAAa,CAAC;AAAA;AAAA;AAAA,QAG1F,qBAAO,eAAe,WAAW,mBAAmB,CAAC,YAAY,QAAQ,MAAM;AAAA,QAC/E,qBAAO,cAAc,qBAAO,QAAQ,cAAc;AAAA,QAClD,qBAAO;AAAA,UAAQ,CAAC,aACd,SAAS,UAAU,OAAO,SAAS,SAAS,MACxC,qBAAO,OACP,qBAAO,KAAK,SAAS,SAAS,MAAM,CAAC;AAAA,QAC3C;AAAA,QACA,qBAAO,QAAQ,OAAO;AAAA,QACtB,qBAAO;AAAA,QACP,qBAAO,SAAS,gBAAgB,MAC9B,qBAAO;AAAA,UACL,IAAI,4BAAW;AAAA,YACb,MAAM;AAAA,YACN,SAAS,uCAAuC,uBAAS,SAAS,OAAO,CAAC;AAAA,UAC5E,CAAC;AAAA,QACH,CAAC;AAAA;AAAA;AAAA,QAGH,qBAAO,SAAS,mBAAmB,CAAC,UAClC,qBAAO;AAAA,UACL,IAAI,4BAAW;AAAA,YACb,MAAM;AAAA,YACN,QAAQ,MAAM,OAAO;AAAA,YACrB,SAAS;AAAA,UACX,CAAC;AAAA,QACH,CAAC;AAAA,MACL;AAAA,IACJ;AAAA,EACF,CAAC;AACH,EAAE,KAAK,oBAAM,QAAQ,gBAAgB,KAAK,CAAC;",
   "names": []
 }

package/dist/esm/layerWebhook.d.ts

@@ -35,6 +35,13 @@ export declare const defaultWebhookTimeout: Duration.Duration;
  * Each delivery has its own scope, which aborts the request and releases any
  * unread response body on completion, failure, timeout, or interruption.
  *
+ * The url is treated as a credential, because a webhook's secret usually is
+ * its path or query. The delivery's HTTP span is named for the method and
+ * records the scheme, host, port and answering status, never the path, the
+ * query or userinfo, and it fails with the same url-free reason the sink
+ * returns. A host that records HTTP headers on spans gets every name in
+ * `headers`, and a redirect's `location`, as `<redacted>`.
+ *
  * A non-2xx response is a failure, not a delivery, and an endpoint that never
  * answers is a failure after `timeout`. Paging is exactly the case where a
  * silently dropped request is worse than a retry, and a hung request is worse

package/dist/esm/layerWebhook.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"layerWebhook.d.ts","sourceRoot":"","sources":["../../src/layerWebhook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAU,KAAK,EAAU,MAAM,QAAQ,CAAA;AAKxD,OAAO,EAAc,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,QAA+B,CAAA;AAmD5E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,YAAY,GACvB,SAAS;IACP,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,QAAQ,GAAG,SAAS,CAAA;CACjD,KACA,KAAK,CAAC,KAAK,CAAC,IAAI,CAmD2B,CAAA"}
+{"version":3,"file":"layerWebhook.d.ts","sourceRoot":"","sources":["../../src/layerWebhook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAS,QAAQ,EAAgB,KAAK,EAAkB,MAAM,QAAQ,CAAA;AAM7E,OAAO,EAAc,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAEjD;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAE,QAAQ,CAAC,QAA+B,CAAA;AAoH5E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,eAAO,MAAM,YAAY,GACvB,SAAS;IACP,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAA;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,QAAQ,GAAG,SAAS,CAAA;CACjD,KACA,KAAK,CAAC,KAAK,CAAC,IAAI,CAwD2B,CAAA"}

package/dist/esm/layerWebhook.js

@@ -8,10 +8,11 @@
  *
  * @since 1.0.0
  */
-import { Duration, Effect, Layer, Option } from "effect";
-import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient";
-import * as HttpClient from "effect/unstable/http/HttpClient";
-import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import { Cause, Duration, Effect, Exit, Layer, Option, Tracer } from "effect";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
+import * as Headers from "effect/http/Headers";
+import * as HttpClient from "effect/http/HttpClient";
+import * as HttpClientRequest from "effect/http/HttpClientRequest";
 import { alertId } from "./AlertPolicy.js";
 import { AlertError, Sink } from "./AlertSink.js";
 /**
@@ -64,6 +65,61 @@ const followingNoRedirects = (effect) => Effect.flatMap(Effect.serviceOption(Fet
     ...(Option.isSome(init) ? init.value : {}),
     redirect: "manual"
 }));
+const rejected = (status) => new AlertError({ code: "sink_rejected", status, message: `Alert webhook answered ${status}` });
+/**
+ * The span attributes of a delivery that say nothing of the url's path, query
+ * or userinfo: the method, the origin and the answer.
+ */
+const originAttributes = new Set([
+    "http.request.method",
+    "url.scheme",
+    "server.address",
+    "server.port",
+    "http.response.status_code",
+    "error.type"
+]);
+const isHeaderAttribute = (key) => key.startsWith("http.request.header.") || key.startsWith("http.response.header.");
+/**
+ * The headers of a redirect that name where the endpoint moved, which is the
+ * same secret under another address.
+ */
+const redirectHeaderNames = ["location", "content-location"];
+/**
+ * The tracer a delivery opens its HTTP span on: the caller's own, with nothing
+ * of the request left on the span.
+ *
+ * A webhook url is a credential. Slack, Discord and PagerDuty put the secret
+ * in the path, others take it in the query, and a url may carry basic-auth
+ * userinfo. The HTTP client writes the whole url on its span and again in the
+ * failure it ends the span with, and the answer or the transport error it ends
+ * with holds the request. So only the attributes that name the method, the
+ * origin and the answer are kept, with the headers a host chose to record, and
+ * the span ends with the outcome alone: nothing on success, the refusing
+ * status, or that the endpoint could not be reached.
+ */
+const withoutRequest = (tracer) => Tracer.make({
+    ...tracer,
+    span(options) {
+        const span = tracer.span(options);
+        const end = span.end.bind(span);
+        const attribute = span.attribute.bind(span);
+        span.attribute = (key, value) => {
+            if (originAttributes.has(key) || isHeaderAttribute(key))
+                attribute(key, value);
+        };
+        span.end = (endTime, exit) => {
+            if (exit._tag === "Success")
+                return end(endTime, Exit.void);
+            if (Cause.hasInterruptsOnly(exit.cause))
+                return end(endTime, exit);
+            const status = span.attributes.get("http.response.status_code");
+            return end(endTime, Exit.fail(typeof status === "number"
+                ? rejected(status)
+                : new AlertError({ code: "sink_unreachable", message: "Alert webhook could not be reached" })));
+        };
+        return span;
+    }
+});
 /**
  * A sink that POSTs each alert to one webhook.
  *
@@ -81,6 +137,13 @@ const followingNoRedirects = (effect) => Effect.flatMap(Effect.serviceOption(Fet
  * Each delivery has its own scope, which aborts the request and releases any
  * unread response body on completion, failure, timeout, or interruption.
  *
+ * The url is treated as a credential, because a webhook's secret usually is
+ * its path or query. The delivery's HTTP span is named for the method and
+ * records the scheme, host, port and answering status, never the path, the
+ * query or userinfo, and it fails with the same url-free reason the sink
+ * returns. A host that records HTTP headers on spans gets every name in
+ * `headers`, and a redirect's `location`, as `<redacted>`.
+ *
  * A non-2xx response is a failure, not a delivery, and an endpoint that never
  * answers is a failure after `timeout`. Paging is exactly the case where a
  * silently dropped request is worse than a retry, and a hung request is worse
@@ -95,14 +158,19 @@ export const layerWebhook = (options) => Layer.effect(Sink, Effect.gen(function*
     const url = yield* Effect.orDie(webhookUrl(options.url));
     const client = HttpClient.withScope(yield* HttpClient.HttpClient);
     const timeout = options.timeout ?? defaultWebhookTimeout;
+    // `Headers.isRedactedName` compares a string matcher against an
+    // already-lowercased header name without lowercasing the matcher.
+    const redactedNames = [
+        ...Object.keys(options.headers ?? {}).map((name) => name.toLowerCase()),
+        ...redirectHeaderNames
+    ];
     return {
-        deliver: (alert) => client.execute(HttpClientRequest.post(url).pipe((request) => options.headers === undefined ? request : HttpClientRequest.setHeaders(request, options.headers), HttpClientRequest.setHeader("Idempotency-Key", alertId(alert)), HttpClientRequest.bodyJsonUnsafe({ ...alert, alertId: alertId(alert) }))).pipe(followingNoRedirects, Effect.flatMap((response) => response.status >= 200 && response.status < 300
+        deliver: (alert) => client.execute(HttpClientRequest.post(url).pipe((request) => options.headers === undefined ? request : HttpClientRequest.setHeaders(request, options.headers), HttpClientRequest.setHeader("Idempotency-Key", alertId(alert)), HttpClientRequest.bodyJsonUnsafe({ ...alert, alertId: alertId(alert) }))).pipe(followingNoRedirects, Effect.updateService(Headers.CurrentRedactedNames, (names) => [...names, ...redactedNames]), 
+        // A host may name HTTP spans for their url. This one is named for
+        // its method, as the client names it by default.
+        Effect.provideService(HttpClient.SpanNameGenerator, (request) => request.method), Effect.updateService(Tracer.Tracer, withoutRequest), Effect.flatMap((response) => response.status >= 200 && response.status < 300
             ? Effect.void
-            : Effect.fail(new AlertError({
-                code: "sink_rejected",
-                status: response.status,
-                message: `Alert webhook answered ${response.status}`
-            }))), Effect.timeout(timeout), Effect.scoped, Effect.catchTag("TimeoutError", () => Effect.fail(new AlertError({
+            : Effect.fail(rejected(response.status))), Effect.timeout(timeout), Effect.scoped, Effect.catchTag("TimeoutError", () => Effect.fail(new AlertError({
             code: "sink_timeout",
             message: `Alert webhook did not answer within ${Duration.toMillis(timeout)} ms`
         }))), 

package/dist/esm/layerWebhook.js.map

@@ -1 +1 @@
-{"version":3,"file":"layerWebhook.js","sourceRoot":"","sources":["../../src/layerWebhook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AACxD,OAAO,KAAK,eAAe,MAAM,sCAAsC,CAAA;AACvE,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAA;AAC7D,OAAO,KAAK,iBAAiB,MAAM,wCAAwC,CAAA;AAC3E,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAEjD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AAE5E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,GAAG,CAAC,GAAW,EAAqC,EAAE,CACpE,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;IAClB,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC;QACnC,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,2DAA2D;KACrE,CAAC,CAAA;IACF,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAChE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QACrB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;AAChC,CAAC,CAAC,CAAA;AAEJ;;;;;;;;;;GAUG;AACH,MAAM,oBAAoB,GAAG,CAAU,MAA8B,EAA0B,EAAE,CAC/F,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,WAAW,CAAC,EACjD,CAAC,IAAI,EAAE,EAAE,CACP,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,eAAe,CAAC,WAAW,EAAE;IACzD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,QAAQ,EAAE,QAAQ;CACnB,CAAC,CACL,CAAA;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,OAIC,EACkB,EAAE,CACrB,KAAK,CAAC,MAAM,CACV,IAAI,EACJ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IACxD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,qBAAqB,CAAA;IACxD,OAAO;QACL,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,MAAM,CAAC,OAAO,CACZ,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAC9B,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAClG,iBAAiB,CAAC,SAAS,CAAC,iBAAiB,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAC9D,iBAAiB,CAAC,cAAc,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CACxE,CACF,CAAC,IAAI,CACJ,oBAAoB,EACpB,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;YAC7C,CAAC,CAAC,MAAM,CAAC,IAAI;YACb,CAAC,CAAC,MAAM,CAAC,IAAI,CACX,IAAI,UAAU,CAAC;gBACb,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,QAAQ,CAAC,MAAM;gBACvB,OAAO,EAAE,0BAA0B,QAAQ,CAAC,MAAM,EAAE;aACrD,CAAC,CACH,CACJ,EACD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EACvB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE,CACnC,MAAM,CAAC,IAAI,CACT,IAAI,UAAU,CAAC;YACb,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,uCAAuC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK;SAChF,CAAC,CACH,CAAC;QACJ,mEAAmE;QACnE,kEAAkE;QAClE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC3C,MAAM,CAAC,IAAI,CACT,IAAI,UAAU,CAAC;YACb,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;YACzB,OAAO,EAAE,oCAAoC;SAC9C,CAAC,CACH,CAAC,CACL;KACJ,CAAA;AACH,CAAC,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA","sourcesContent":["/**\n * The webhook alert sink: one POST per alert, keyed so the receiver can\n * dedupe on it.\n *\n * The transport rules live here rather than beside the policy, because which\n * endpoint is paged, over which scheme, carrying which credential is a\n * deployment's decision and the delays are not.\n *\n * @since 1.0.0\n */\n\nimport { Duration, Effect, Layer, Option } from \"effect\"\nimport * as FetchHttpClient from \"effect/unstable/http/FetchHttpClient\"\nimport * as HttpClient from \"effect/unstable/http/HttpClient\"\nimport * as HttpClientRequest from \"effect/unstable/http/HttpClientRequest\"\nimport { alertId } from \"./AlertPolicy.ts\"\nimport { AlertError, Sink } from \"./AlertSink.ts\"\n\n/**\n * How long the webhook sink waits for an answer before it calls the page\n * refused.\n *\n * @category constants\n * @since 1.0.0\n */\nexport const defaultWebhookTimeout: Duration.Duration = Duration.seconds(10)\n\n/**\n * The one check the webhook endpoint gets before an alert is ever built on\n * it.\n *\n * The url is operator config rather than runtime input, so there is no SSRF\n * vector to close here; the scheme bound is what keeps a credential the\n * deployment set in `headers` from being handed to a scheme that is not HTTP\n * at all. A `file:` or `javascript:` url is a config bug, and it fails the\n * composition the way an impossible policy rule does. The error names no\n * url: the value can carry basic-auth credentials, and an error is logged.\n */\nconst webhookUrl = (raw: string): Effect.Effect<string, AlertError> =>\n  Effect.suspend(() => {\n    const misconfigured = new AlertError({\n      code: \"sink_misconfigured\",\n      message: \"Alert webhook url must be an absolute http: or https: URL\"\n    })\n    let parsed: URL\n    try {\n      parsed = new URL(raw)\n    } catch {\n      return Effect.fail(misconfigured)\n    }\n    return parsed.protocol === \"http:\" || parsed.protocol === \"https:\"\n      ? Effect.succeed(raw)\n      : Effect.fail(misconfigured)\n  })\n\n/**\n * Runs a webhook request with redirect following switched off at the fetch\n * transport.\n *\n * The request carries whatever credential the deployment put in `headers`,\n * and a transport that follows a 3xx re-sends those headers to an origin the\n * deployment never named. Every other fetch default the composition set is\n * kept; only the redirect mode is forced. A 3xx therefore surfaces to the\n * status rule, which calls it `sink_rejected`: a redirecting pager endpoint\n * is a misconfiguration to fix, not an address to forward credentials to.\n */\nconst followingNoRedirects = <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, E, R> =>\n  Effect.flatMap(\n    Effect.serviceOption(FetchHttpClient.RequestInit),\n    (init) =>\n      Effect.provideService(effect, FetchHttpClient.RequestInit, {\n        ...(Option.isSome(init) ? init.value : {}),\n        redirect: \"manual\"\n      })\n  )\n\n/**\n * A sink that POSTs each alert to one webhook.\n *\n * The body is the alert plus its {@link alertId}, and the same id is sent as\n * an `Idempotency-Key` header, because the package requires the receiver to\n * dedupe on it and a body without it cannot. The header is set after the\n * caller's headers, so it is the one this sink sends.\n *\n * The endpoint must be an absolute `http:` or `https:` URL, checked when the\n * layer is built, and the request is made with redirect following disabled:\n * the caller's headers can carry a credential, and a followed redirect would\n * re-send them to an origin the deployment never named. A 3xx answer is a\n * refusal like any other non-2xx, not a forwarding instruction. The sink owns\n * its Fetch transport; an externally supplied `HttpClient` is not used.\n * Each delivery has its own scope, which aborts the request and releases any\n * unread response body on completion, failure, timeout, or interruption.\n *\n * A non-2xx response is a failure, not a delivery, and an endpoint that never\n * answers is a failure after `timeout`. Paging is exactly the case where a\n * silently dropped request is worse than a retry, and a hung request is worse\n * than either: it is indistinguishable from silence, so it must not be\n * possible to wait on one forever.\n *\n * @param options the endpoint, any headers it needs, and how long to wait\n * @category layers\n * @since 0.1.0\n */\nexport const layerWebhook = (\n  options: {\n    readonly url: string\n    readonly headers?: Readonly<Record<string, string>> | undefined\n    readonly timeout?: Duration.Duration | undefined\n  }\n): Layer.Layer<Sink> =>\n  Layer.effect(\n    Sink,\n    Effect.gen(function*() {\n      const url = yield* Effect.orDie(webhookUrl(options.url))\n      const client = HttpClient.withScope(yield* HttpClient.HttpClient)\n      const timeout = options.timeout ?? defaultWebhookTimeout\n      return {\n        deliver: (alert) =>\n          client.execute(\n            HttpClientRequest.post(url).pipe(\n              (request) =>\n                options.headers === undefined ? request : HttpClientRequest.setHeaders(request, options.headers),\n              HttpClientRequest.setHeader(\"Idempotency-Key\", alertId(alert)),\n              HttpClientRequest.bodyJsonUnsafe({ ...alert, alertId: alertId(alert) })\n            )\n          ).pipe(\n            followingNoRedirects,\n            Effect.flatMap((response) =>\n              response.status >= 200 && response.status < 300\n                ? Effect.void\n                : Effect.fail(\n                  new AlertError({\n                    code: \"sink_rejected\",\n                    status: response.status,\n                    message: `Alert webhook answered ${response.status}`\n                  })\n                )\n            ),\n            Effect.timeout(timeout),\n            Effect.scoped,\n            Effect.catchTag(\"TimeoutError\", () =>\n              Effect.fail(\n                new AlertError({\n                  code: \"sink_timeout\",\n                  message: `Alert webhook did not answer within ${Duration.toMillis(timeout)} ms`\n                })\n              )),\n            // The transport error holds the request, and the request holds the\n            // caller's headers. Only its reason tag crosses into the failure.\n            Effect.catchTag(\"HttpClientError\", (cause) =>\n              Effect.fail(\n                new AlertError({\n                  code: \"sink_unreachable\",\n                  reason: cause.reason._tag,\n                  message: \"Alert webhook could not be reached\"\n                })\n              ))\n          )\n      }\n    })\n  ).pipe(Layer.provide(FetchHttpClient.layer))\n"]}
+{"version":3,"file":"layerWebhook.js","sourceRoot":"","sources":["../../src/layerWebhook.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAC7E,OAAO,KAAK,eAAe,MAAM,6BAA6B,CAAA;AAC9D,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAA;AAC9C,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAA;AACpD,OAAO,KAAK,iBAAiB,MAAM,+BAA+B,CAAA;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,gBAAgB,CAAA;AAEjD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;AAE5E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,GAAG,CAAC,GAAW,EAAqC,EAAE,CACpE,MAAM,CAAC,OAAO,CAAC,GAAG,EAAE;IAClB,MAAM,aAAa,GAAG,IAAI,UAAU,CAAC;QACnC,IAAI,EAAE,oBAAoB;QAC1B,OAAO,EAAE,2DAA2D;KACrE,CAAC,CAAA;IACF,IAAI,MAAW,CAAA;IACf,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACvB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;IACnC,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;QAChE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;QACrB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;AAChC,CAAC,CAAC,CAAA;AAEJ;;;;;;;;;;GAUG;AACH,MAAM,oBAAoB,GAAG,CAAU,MAA8B,EAA0B,EAAE,CAC/F,MAAM,CAAC,OAAO,CACZ,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC,WAAW,CAAC,EACjD,CAAC,IAAI,EAAE,EAAE,CACP,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,eAAe,CAAC,WAAW,EAAE;IACzD,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC1C,QAAQ,EAAE,QAAQ;CACnB,CAAC,CACL,CAAA;AAEH,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAc,EAAE,CAC9C,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,MAAM,EAAE,OAAO,EAAE,0BAA0B,MAAM,EAAE,EAAE,CAAC,CAAA;AAEhG;;;GAGG;AACH,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IACpD,qBAAqB;IACrB,YAAY;IACZ,gBAAgB;IAChB,aAAa;IACb,2BAA2B;IAC3B,YAAY;CACb,CAAC,CAAA;AAEF,MAAM,iBAAiB,GAAG,CAAC,GAAW,EAAW,EAAE,CACjD,GAAG,CAAC,UAAU,CAAC,sBAAsB,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,uBAAuB,CAAC,CAAA;AAEnF;;;GAGG;AACH,MAAM,mBAAmB,GAA0B,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAA;AAEnF;;;;;;;;;;;;GAYG;AACH,MAAM,cAAc,GAAG,CAAC,MAAqB,EAAiB,EAAE,CAC9D,MAAM,CAAC,IAAI,CAAC;IACV,GAAG,MAAM;IACT,IAAI,CAAC,OAAO;QACV,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACjC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QAC3C,IAAI,CAAC,SAAS,GAAG,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YAC9B,IAAI,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,GAAG,CAAC;gBAAE,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;QAChF,CAAC,CAAA;QACD,IAAI,CAAC,GAAG,GAAG,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE;YAC3B,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS;gBAAE,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;YAC3D,IAAI,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC;gBAAE,OAAO,GAAG,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAClE,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAA;YAC/D,OAAO,GAAG,CACR,OAAO,EACP,IAAI,CAAC,IAAI,CACP,OAAO,MAAM,KAAK,QAAQ;gBACxB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAClB,CAAC,CAAC,IAAI,UAAU,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,oCAAoC,EAAE,CAAC,CAChG,CACF,CAAA;QACH,CAAC,CAAA;QACD,OAAO,IAAI,CAAA;IACb,CAAC;CACF,CAAC,CAAA;AAEJ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,CAC1B,OAIC,EACkB,EAAE,CACrB,KAAK,CAAC,MAAM,CACV,IAAI,EACJ,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAA;IACxD,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,CAAA;IACjE,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,qBAAqB,CAAA;IACxD,gEAAgE;IAChE,kEAAkE;IAClE,MAAM,aAAa,GAAG;QACpB,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;QACvE,GAAG,mBAAmB;KACvB,CAAA;IACD,OAAO;QACL,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CACjB,MAAM,CAAC,OAAO,CACZ,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAC9B,CAAC,OAAO,EAAE,EAAE,CACV,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,iBAAiB,CAAC,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,CAAC,EAClG,iBAAiB,CAAC,SAAS,CAAC,iBAAiB,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAC9D,iBAAiB,CAAC,cAAc,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CACxE,CACF,CAAC,IAAI,CACJ,oBAAoB,EACpB,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,oBAAoB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,aAAa,CAAC,CAAC;QAC3F,kEAAkE;QAClE,iDAAiD;QACjD,MAAM,CAAC,cAAc,CAAC,UAAU,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,EAChF,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,EACnD,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC1B,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;YAC7C,CAAC,CAAC,MAAM,CAAC,IAAI;YACb,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC3C,EACD,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EACvB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,GAAG,EAAE,CACnC,MAAM,CAAC,IAAI,CACT,IAAI,UAAU,CAAC;YACb,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,uCAAuC,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK;SAChF,CAAC,CACH,CAAC;QACJ,mEAAmE;QACnE,kEAAkE;QAClE,MAAM,CAAC,QAAQ,CAAC,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAC3C,MAAM,CAAC,IAAI,CACT,IAAI,UAAU,CAAC;YACb,IAAI,EAAE,kBAAkB;YACxB,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,IAAI;YACzB,OAAO,EAAE,oCAAoC;SAC9C,CAAC,CACH,CAAC,CACL;KACJ,CAAA;AACH,CAAC,CAAC,CACH,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAA","sourcesContent":["/**\n * The webhook alert sink: one POST per alert, keyed so the receiver can\n * dedupe on it.\n *\n * The transport rules live here rather than beside the policy, because which\n * endpoint is paged, over which scheme, carrying which credential is a\n * deployment's decision and the delays are not.\n *\n * @since 1.0.0\n */\n\nimport { Cause, Duration, Effect, Exit, Layer, Option, Tracer } from \"effect\"\nimport * as FetchHttpClient from \"effect/http/FetchHttpClient\"\nimport * as Headers from \"effect/http/Headers\"\nimport * as HttpClient from \"effect/http/HttpClient\"\nimport * as HttpClientRequest from \"effect/http/HttpClientRequest\"\nimport { alertId } from \"./AlertPolicy.ts\"\nimport { AlertError, Sink } from \"./AlertSink.ts\"\n\n/**\n * How long the webhook sink waits for an answer before it calls the page\n * refused.\n *\n * @category constants\n * @since 1.0.0\n */\nexport const defaultWebhookTimeout: Duration.Duration = Duration.seconds(10)\n\n/**\n * The one check the webhook endpoint gets before an alert is ever built on\n * it.\n *\n * The url is operator config rather than runtime input, so there is no SSRF\n * vector to close here; the scheme bound is what keeps a credential the\n * deployment set in `headers` from being handed to a scheme that is not HTTP\n * at all. A `file:` or `javascript:` url is a config bug, and it fails the\n * composition the way an impossible policy rule does. The error names no\n * url: the value can carry basic-auth credentials, and an error is logged.\n */\nconst webhookUrl = (raw: string): Effect.Effect<string, AlertError> =>\n  Effect.suspend(() => {\n    const misconfigured = new AlertError({\n      code: \"sink_misconfigured\",\n      message: \"Alert webhook url must be an absolute http: or https: URL\"\n    })\n    let parsed: URL\n    try {\n      parsed = new URL(raw)\n    } catch {\n      return Effect.fail(misconfigured)\n    }\n    return parsed.protocol === \"http:\" || parsed.protocol === \"https:\"\n      ? Effect.succeed(raw)\n      : Effect.fail(misconfigured)\n  })\n\n/**\n * Runs a webhook request with redirect following switched off at the fetch\n * transport.\n *\n * The request carries whatever credential the deployment put in `headers`,\n * and a transport that follows a 3xx re-sends those headers to an origin the\n * deployment never named. Every other fetch default the composition set is\n * kept; only the redirect mode is forced. A 3xx therefore surfaces to the\n * status rule, which calls it `sink_rejected`: a redirecting pager endpoint\n * is a misconfiguration to fix, not an address to forward credentials to.\n */\nconst followingNoRedirects = <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.Effect<A, E, R> =>\n  Effect.flatMap(\n    Effect.serviceOption(FetchHttpClient.RequestInit),\n    (init) =>\n      Effect.provideService(effect, FetchHttpClient.RequestInit, {\n        ...(Option.isSome(init) ? init.value : {}),\n        redirect: \"manual\"\n      })\n  )\n\nconst rejected = (status: number): AlertError =>\n  new AlertError({ code: \"sink_rejected\", status, message: `Alert webhook answered ${status}` })\n\n/**\n * The span attributes of a delivery that say nothing of the url's path, query\n * or userinfo: the method, the origin and the answer.\n */\nconst originAttributes: ReadonlySet<string> = new Set([\n  \"http.request.method\",\n  \"url.scheme\",\n  \"server.address\",\n  \"server.port\",\n  \"http.response.status_code\",\n  \"error.type\"\n])\n\nconst isHeaderAttribute = (key: string): boolean =>\n  key.startsWith(\"http.request.header.\") || key.startsWith(\"http.response.header.\")\n\n/**\n * The headers of a redirect that name where the endpoint moved, which is the\n * same secret under another address.\n */\nconst redirectHeaderNames: ReadonlyArray<string> = [\"location\", \"content-location\"]\n\n/**\n * The tracer a delivery opens its HTTP span on: the caller's own, with nothing\n * of the request left on the span.\n *\n * A webhook url is a credential. Slack, Discord and PagerDuty put the secret\n * in the path, others take it in the query, and a url may carry basic-auth\n * userinfo. The HTTP client writes the whole url on its span and again in the\n * failure it ends the span with, and the answer or the transport error it ends\n * with holds the request. So only the attributes that name the method, the\n * origin and the answer are kept, with the headers a host chose to record, and\n * the span ends with the outcome alone: nothing on success, the refusing\n * status, or that the endpoint could not be reached.\n */\nconst withoutRequest = (tracer: Tracer.Tracer): Tracer.Tracer =>\n  Tracer.make({\n    ...tracer,\n    span(options) {\n      const span = tracer.span(options)\n      const end = span.end.bind(span)\n      const attribute = span.attribute.bind(span)\n      span.attribute = (key, value) => {\n        if (originAttributes.has(key) || isHeaderAttribute(key)) attribute(key, value)\n      }\n      span.end = (endTime, exit) => {\n        if (exit._tag === \"Success\") return end(endTime, Exit.void)\n        if (Cause.hasInterruptsOnly(exit.cause)) return end(endTime, exit)\n        const status = span.attributes.get(\"http.response.status_code\")\n        return end(\n          endTime,\n          Exit.fail(\n            typeof status === \"number\"\n              ? rejected(status)\n              : new AlertError({ code: \"sink_unreachable\", message: \"Alert webhook could not be reached\" })\n          )\n        )\n      }\n      return span\n    }\n  })\n\n/**\n * A sink that POSTs each alert to one webhook.\n *\n * The body is the alert plus its {@link alertId}, and the same id is sent as\n * an `Idempotency-Key` header, because the package requires the receiver to\n * dedupe on it and a body without it cannot. The header is set after the\n * caller's headers, so it is the one this sink sends.\n *\n * The endpoint must be an absolute `http:` or `https:` URL, checked when the\n * layer is built, and the request is made with redirect following disabled:\n * the caller's headers can carry a credential, and a followed redirect would\n * re-send them to an origin the deployment never named. A 3xx answer is a\n * refusal like any other non-2xx, not a forwarding instruction. The sink owns\n * its Fetch transport; an externally supplied `HttpClient` is not used.\n * Each delivery has its own scope, which aborts the request and releases any\n * unread response body on completion, failure, timeout, or interruption.\n *\n * The url is treated as a credential, because a webhook's secret usually is\n * its path or query. The delivery's HTTP span is named for the method and\n * records the scheme, host, port and answering status, never the path, the\n * query or userinfo, and it fails with the same url-free reason the sink\n * returns. A host that records HTTP headers on spans gets every name in\n * `headers`, and a redirect's `location`, as `<redacted>`.\n *\n * A non-2xx response is a failure, not a delivery, and an endpoint that never\n * answers is a failure after `timeout`. Paging is exactly the case where a\n * silently dropped request is worse than a retry, and a hung request is worse\n * than either: it is indistinguishable from silence, so it must not be\n * possible to wait on one forever.\n *\n * @param options the endpoint, any headers it needs, and how long to wait\n * @category layers\n * @since 0.1.0\n */\nexport const layerWebhook = (\n  options: {\n    readonly url: string\n    readonly headers?: Readonly<Record<string, string>> | undefined\n    readonly timeout?: Duration.Duration | undefined\n  }\n): Layer.Layer<Sink> =>\n  Layer.effect(\n    Sink,\n    Effect.gen(function*() {\n      const url = yield* Effect.orDie(webhookUrl(options.url))\n      const client = HttpClient.withScope(yield* HttpClient.HttpClient)\n      const timeout = options.timeout ?? defaultWebhookTimeout\n      // `Headers.isRedactedName` compares a string matcher against an\n      // already-lowercased header name without lowercasing the matcher.\n      const redactedNames = [\n        ...Object.keys(options.headers ?? {}).map((name) => name.toLowerCase()),\n        ...redirectHeaderNames\n      ]\n      return {\n        deliver: (alert) =>\n          client.execute(\n            HttpClientRequest.post(url).pipe(\n              (request) =>\n                options.headers === undefined ? request : HttpClientRequest.setHeaders(request, options.headers),\n              HttpClientRequest.setHeader(\"Idempotency-Key\", alertId(alert)),\n              HttpClientRequest.bodyJsonUnsafe({ ...alert, alertId: alertId(alert) })\n            )\n          ).pipe(\n            followingNoRedirects,\n            Effect.updateService(Headers.CurrentRedactedNames, (names) => [...names, ...redactedNames]),\n            // A host may name HTTP spans for their url. This one is named for\n            // its method, as the client names it by default.\n            Effect.provideService(HttpClient.SpanNameGenerator, (request) => request.method),\n            Effect.updateService(Tracer.Tracer, withoutRequest),\n            Effect.flatMap((response) =>\n              response.status >= 200 && response.status < 300\n                ? Effect.void\n                : Effect.fail(rejected(response.status))\n            ),\n            Effect.timeout(timeout),\n            Effect.scoped,\n            Effect.catchTag(\"TimeoutError\", () =>\n              Effect.fail(\n                new AlertError({\n                  code: \"sink_timeout\",\n                  message: `Alert webhook did not answer within ${Duration.toMillis(timeout)} ms`\n                })\n              )),\n            // The transport error holds the request, and the request holds the\n            // caller's headers. Only its reason tag crosses into the failure.\n            Effect.catchTag(\"HttpClientError\", (cause) =>\n              Effect.fail(\n                new AlertError({\n                  code: \"sink_unreachable\",\n                  reason: cause.reason._tag,\n                  message: \"Alert webhook could not be reached\"\n                })\n              ))\n          )\n      }\n    })\n  ).pipe(Layer.provide(FetchHttpClient.layer))\n"]}

package/docs/api.md

@@ -366,13 +366,13 @@ own `detectors` are merged over `defaultDetectors`.
 
 ### Sinks
 
-| Export                  | Signature                                                                                                  | What it is                                                                                                                                                                                                                                                                                                                                                                      |
-| ----------------------- | ---------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `SinkService`           | `{ deliver: (alert: Alert) => Effect.Effect<void, AlertError> }`                                           | Where a raised alert is sent. `deliver` MUST be idempotent on `alertId(alert)`, and MUST fail when the page did not go out.                                                                                                                                                                                                                                                     |
-| `Sink`                  | `Context.Service` under `/notifications/AlertSink`                                                         | The service tag.                                                                                                                                                                                                                                                                                                                                                                |
-| `layerNoop`             | `Layer<Sink>`                                                                                              | Accepts every alert and sends it nowhere. The admission and the delivery record still happen.                                                                                                                                                                                                                                                                                   |
-| `defaultWebhookTimeout` | `Duration.Duration`                                                                                        | Ten seconds.                                                                                                                                                                                                                                                                                                                                                                    |
-| `layerWebhook`          | `(options: { url: string; headers?: Record<string, string>; timeout?: Duration.Duration }) => Layer<Sink>` | POSTs each alert to one webhook using an owned Fetch client with redirects disabled and a scope per delivery. Injected `HttpClient` layers are not used. The body is the alert plus its `alertId`, and the same id is sent as an `Idempotency-Key` header, set after the caller's headers. A non-2xx answer is a failure; an endpoint that never answers fails after `timeout`. |
+| Export                  | Signature                                                                                                  | What it is                                                                                                                                                                                                                                                                                                                                                                                                                                                                                           |
+| ----------------------- | ---------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `SinkService`           | `{ deliver: (alert: Alert) => Effect.Effect<void, AlertError> }`                                           | Where a raised alert is sent. `deliver` MUST be idempotent on `alertId(alert)`, and MUST fail when the page did not go out.                                                                                                                                                                                                                                                                                                                                                                          |
+| `Sink`                  | `Context.Service` under `/notifications/AlertSink`                                                         | The service tag.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
+| `layerNoop`             | `Layer<Sink>`                                                                                              | Accepts every alert and sends it nowhere. The admission and the delivery record still happen.                                                                                                                                                                                                                                                                                                                                                                                                        |
+| `defaultWebhookTimeout` | `Duration.Duration`                                                                                        | Ten seconds.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
+| `layerWebhook`          | `(options: { url: string; headers?: Record<string, string>; timeout?: Duration.Duration }) => Layer<Sink>` | POSTs each alert to one webhook using an owned Fetch client with redirects disabled and a scope per delivery. Injected `HttpClient` layers are not used. The body is the alert plus its `alertId`, and the same id is sent as an `Idempotency-Key` header, set after the caller's headers. A non-2xx answer is a failure; an endpoint that never answers fails after `timeout`. The delivery's HTTP span records the method, scheme, host, port and status, never the url's path, query or userinfo. |
 
 | Export        | Shape                                                                                                           |
 | ------------- | --------------------------------------------------------------------------------------------------------------- |

package/docs/guides/send-alerts-to-a-webhook.md

@@ -49,6 +49,31 @@ Each delivery has its own scope. Completion, refusal, timeout, and interruption
 abort the request and release any unread response body. Delivery depends on the
 response status, so a body that never ends does not delay completion.
 
+## What a trace shows
+
+A webhook url is a credential: Slack, Discord and PagerDuty put the secret in
+the path, and other receivers take it in the query. The sink keeps it out of
+telemetry. Each delivery opens one HTTP span named `POST` that records:
+
+| Attribute                   | Value                                          |
+| --------------------------- | ---------------------------------------------- |
+| `http.request.method`       | `POST`                                         |
+| `url.scheme`                | `https` or `http`                              |
+| `server.address`            | The endpoint's host name                       |
+| `server.port`               | The endpoint's port                            |
+| `http.response.status_code` | The answering status, when there was an answer |
+| `error.type`                | The status again, for a `4xx` or `5xx` answer  |
+
+The span never records the url's path, query or userinfo. It fails with the
+reason the sink returns: `Alert webhook answered 503`, or
+`Alert webhook could not be reached` when no answer came. A delivery that hit
+`timeout` ends its span as interrupted.
+
+The span records no header. A host that sets `HttpClient.TracerHeaderFilter` to
+record headers gets every name in `headers` as `<redacted>`, and the `location`
+and `content-location` of a redirect too, because they name where the endpoint
+moved.
+
 ## What the request looks like
 
 The body is the alert plus its `alertId`, and the same id is sent as an

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@smthrs/notifications",
   "type": "module",
-  "version": "1.0.0-rc.4",
+  "version": "1.0.0-rc.6",
   "license": "MIT",
   "smthrs": {
     "group": "agent"
@@ -145,19 +145,19 @@
     "tag": "next"
   },
   "dependencies": {
-    "@smthrs/canonical": "1.0.0-rc.4",
-    "@smthrs/crypto": "1.0.0-rc.4",
-    "@smthrs/journal": "1.0.0-rc.4"
+    "@smthrs/canonical": "1.0.0-rc.6",
+    "@smthrs/crypto": "1.0.0-rc.6",
+    "@smthrs/journal": "1.0.0-rc.6"
   },
   "devDependencies": {
     "@effect/language-service": "0.87.2",
-    "@effect/vitest": "4.0.0-rc.115",
+    "@effect/vitest": "4.0.4",
     "@eslint/js": "9.39.5",
-    "@smthrs/database": "1.0.0-rc.4",
+    "@smthrs/database": "1.0.0-rc.6",
     "@types/node": "26.4.1",
     "@vitest/coverage-v8": "5.0.0",
     "dprint": "0.57.1",
-    "effect": "4.0.0-rc.115",
+    "effect": "4.0.4",
     "esbuild": "0.28.2",
     "eslint": "9.39.5",
     "eslint-import-resolver-typescript": "4.4.5",
@@ -171,7 +171,7 @@
     "fast-check": "4.9.0"
   },
   "peerDependencies": {
-    "effect": "4.0.0-rc.115"
+    "effect": "^4.0.4"
   },
   "scripts": {
     "lint": "eslint src --max-warnings=0 && dprint check",

package/src/layerWebhook.ts

@@ -9,10 +9,11 @@
  * @since 1.0.0
  */
 
-import { Duration, Effect, Layer, Option } from "effect"
-import * as FetchHttpClient from "effect/unstable/http/FetchHttpClient"
-import * as HttpClient from "effect/unstable/http/HttpClient"
-import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest"
+import { Cause, Duration, Effect, Exit, Layer, Option, Tracer } from "effect"
+import * as FetchHttpClient from "effect/http/FetchHttpClient"
+import * as Headers from "effect/http/Headers"
+import * as HttpClient from "effect/http/HttpClient"
+import * as HttpClientRequest from "effect/http/HttpClientRequest"
 import { alertId } from "./AlertPolicy.ts"
 import { AlertError, Sink } from "./AlertSink.ts"
 
@@ -74,6 +75,71 @@ const followingNoRedirects = <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.E
       })
   )
 
+const rejected = (status: number): AlertError =>
+  new AlertError({ code: "sink_rejected", status, message: `Alert webhook answered ${status}` })
+
+/**
+ * The span attributes of a delivery that say nothing of the url's path, query
+ * or userinfo: the method, the origin and the answer.
+ */
+const originAttributes: ReadonlySet<string> = new Set([
+  "http.request.method",
+  "url.scheme",
+  "server.address",
+  "server.port",
+  "http.response.status_code",
+  "error.type"
+])
+
+const isHeaderAttribute = (key: string): boolean =>
+  key.startsWith("http.request.header.") || key.startsWith("http.response.header.")
+
+/**
+ * The headers of a redirect that name where the endpoint moved, which is the
+ * same secret under another address.
+ */
+const redirectHeaderNames: ReadonlyArray<string> = ["location", "content-location"]
+
+/**
+ * The tracer a delivery opens its HTTP span on: the caller's own, with nothing
+ * of the request left on the span.
+ *
+ * A webhook url is a credential. Slack, Discord and PagerDuty put the secret
+ * in the path, others take it in the query, and a url may carry basic-auth
+ * userinfo. The HTTP client writes the whole url on its span and again in the
+ * failure it ends the span with, and the answer or the transport error it ends
+ * with holds the request. So only the attributes that name the method, the
+ * origin and the answer are kept, with the headers a host chose to record, and
+ * the span ends with the outcome alone: nothing on success, the refusing
+ * status, or that the endpoint could not be reached.
+ */
+const withoutRequest = (tracer: Tracer.Tracer): Tracer.Tracer =>
+  Tracer.make({
+    ...tracer,
+    span(options) {
+      const span = tracer.span(options)
+      const end = span.end.bind(span)
+      const attribute = span.attribute.bind(span)
+      span.attribute = (key, value) => {
+        if (originAttributes.has(key) || isHeaderAttribute(key)) attribute(key, value)
+      }
+      span.end = (endTime, exit) => {
+        if (exit._tag === "Success") return end(endTime, Exit.void)
+        if (Cause.hasInterruptsOnly(exit.cause)) return end(endTime, exit)
+        const status = span.attributes.get("http.response.status_code")
+        return end(
+          endTime,
+          Exit.fail(
+            typeof status === "number"
+              ? rejected(status)
+              : new AlertError({ code: "sink_unreachable", message: "Alert webhook could not be reached" })
+          )
+        )
+      }
+      return span
+    }
+  })
+
 /**
  * A sink that POSTs each alert to one webhook.
  *
@@ -91,6 +157,13 @@ const followingNoRedirects = <A, E, R>(effect: Effect.Effect<A, E, R>): Effect.E
  * Each delivery has its own scope, which aborts the request and releases any
  * unread response body on completion, failure, timeout, or interruption.
  *
+ * The url is treated as a credential, because a webhook's secret usually is
+ * its path or query. The delivery's HTTP span is named for the method and
+ * records the scheme, host, port and answering status, never the path, the
+ * query or userinfo, and it fails with the same url-free reason the sink
+ * returns. A host that records HTTP headers on spans gets every name in
+ * `headers`, and a redirect's `location`, as `<redacted>`.
+ *
  * A non-2xx response is a failure, not a delivery, and an endpoint that never
  * answers is a failure after `timeout`. Paging is exactly the case where a
  * silently dropped request is worse than a retry, and a hung request is worse
@@ -114,6 +187,12 @@ export const layerWebhook = (
       const url = yield* Effect.orDie(webhookUrl(options.url))
       const client = HttpClient.withScope(yield* HttpClient.HttpClient)
       const timeout = options.timeout ?? defaultWebhookTimeout
+      // `Headers.isRedactedName` compares a string matcher against an
+      // already-lowercased header name without lowercasing the matcher.
+      const redactedNames = [
+        ...Object.keys(options.headers ?? {}).map((name) => name.toLowerCase()),
+        ...redirectHeaderNames
+      ]
       return {
         deliver: (alert) =>
           client.execute(
@@ -125,16 +204,15 @@ export const layerWebhook = (
             )
           ).pipe(
             followingNoRedirects,
+            Effect.updateService(Headers.CurrentRedactedNames, (names) => [...names, ...redactedNames]),
+            // A host may name HTTP spans for their url. This one is named for
+            // its method, as the client names it by default.
+            Effect.provideService(HttpClient.SpanNameGenerator, (request) => request.method),
+            Effect.updateService(Tracer.Tracer, withoutRequest),
             Effect.flatMap((response) =>
               response.status >= 200 && response.status < 300
                 ? Effect.void
-                : Effect.fail(
-                  new AlertError({
-                    code: "sink_rejected",
-                    status: response.status,
-                    message: `Alert webhook answered ${response.status}`
-                  })
-                )
+                : Effect.fail(rejected(response.status))
             ),
             Effect.timeout(timeout),
             Effect.scoped,