effect-cf 0.28.0 → 0.28.1

package/CHANGELOG.md

@@ -1,5 +1,13 @@
 # effect-cf
 
+## 0.28.1
+
+### Patch Changes
+
+- [#105](https://github.com/danieljvdm/effect-cf/pull/105) [`f5dfd5e`](https://github.com/danieljvdm/effect-cf/commit/f5dfd5e2c79b257cc760dc0b2cdf5a2901b0b295) Thanks [@danieljvdm](https://github.com/danieljvdm)! - Bound internally scheduled telemetry flushes so exporter retries cannot extend Worker or Durable Object event lifetimes indefinitely.
+
+- [#106](https://github.com/danieljvdm/effect-cf/pull/106) [`c0fbb85`](https://github.com/danieljvdm/effect-cf/commit/c0fbb8535479262741e6844935e9ff9d508f6b56) Thanks [@danieljvdm](https://github.com/danieljvdm)! - Silently absorb failures raised while scheduling automatic OTLP telemetry flushes so platform boundary defects cannot feed back into the configured exporter. Document the two-second best-effort boundary and keep explicit queue flush policy application-owned.
+
 ## 0.28.0
 
 ### Minor Changes

package/README.md

@@ -357,6 +357,12 @@ Producers should usually use `const queue = yield* AvatarQueue` and then call `q
 
 Queue handlers run inline failures through Cloudflare's normal retry path. If background work scheduled with `WorkerContext.waitUntil(...)` should also make the batch retry, use `WorkerContext.waitUntilPropagating(...)` or `waitUntil(..., { mode: "propagate" })`; the default `waitUntil` mode observes and logs failures without rejecting the native `waitUntil` promise.
 
+effect-cf automatically schedules best-effort OTLP flushes only for Worker
+fetch/RPC and Durable Object alarm/RPC handlers. Those internal flushes are
+capped at two seconds. Queue handlers do not flush telemetry automatically;
+applications that explicitly flush in a queue handler own that flush's timeout
+and failure policy.
+
 ## Cache Example
 
 `Cache.layer` exposes Cloudflare's global Cache API as an Effect service. Cache misses are represented by `Option.none()`, and named caches are available through `open(...)`.

package/dist/ComputerWorkspace.d.mts

@@ -1,5 +1,5 @@
 import { ComputerArtifactsClient } from "./ComputerArtifacts.mjs";
-import { t as DurableObjectState } from "./DurableObjectState-B3uFY1eM.mjs";
+import { t as DurableObjectState } from "./DurableObjectState-OupNMMUl.mjs";
 import { Context, Effect, Layer, Schema, Scope, Stream } from "effect";
 import { CommitView, GitClient, GitCloneOptions, GitCommitOptions, GitDiffOptions, GitFetchOptions, GitLogOptions, GitUpdateRefOptions } from "@cloudflare/computer/git";
 import { ExecSyncResult, RuntimeExecOptions, RuntimeGetOptions, RuntimeKillOptions, ShellValue, SkippedEntry, ThinkWorkspaceCompatibility, WorkspaceClient, WorkspaceRuntimeResult, WorkspaceRuntimeValue as WorkspaceRuntimeValue$1 } from "@cloudflare/computer";

package/dist/{DurableObjectState-B3uFY1eM.d.mts → DurableObjectState-OupNMMUl.d.mts}

@@ -888,7 +888,8 @@ interface WorkerOptions<RRuntime, REvent = never, EventLayerError = never, Rpc e
    *
    * The layer is built inside the event's Effect scope and finalized when the
    * event effect completes. Use this for event-scoped resources such as OTLP
-   * trace/log exporters that should flush at event completion.
+   * trace/log exporters. Worker fetch and RPC handlers schedule a best-effort
+   * flush capped at two seconds; queue handlers do not flush automatically.
    */
   readonly eventLayer?: Layer.Layer<REvent, EventLayerError, WorkerBaseContext<RRuntime>>;
   /** Main request handler. */
@@ -899,7 +900,8 @@ interface WorkerOptions<RRuntime, REvent = never, EventLayerError = never, Rpc e
    * Optional RPC methods exposed as class instance methods.
    *
    * After every invocation, the configured OTLP flusher is scheduled through
-   * `WorkerContext.waitUntil`, including when the handler fails.
+   * `WorkerContext.waitUntil`, including when the handler fails. The scheduled
+   * flush silently settles within two seconds even if the exporter does not.
    */
   readonly rpc?: Rpc;
 }

package/dist/Vitest.d.mts

@@ -1,6 +1,6 @@
 import { c as WorkerEnvironment, s as WorkerEnv } from "./Binding-xJJJPmiD.mjs";
-import { n as DurableObjectStateService, t as DurableObjectState } from "./DurableObjectState-B3uFY1eM.mjs";
-import { o as WorkflowInstanceStatusName } from "./WorkflowBinding-wZ-yGHow.mjs";
+import { n as DurableObjectStateService, t as DurableObjectState } from "./DurableObjectState-OupNMMUl.mjs";
+import { o as WorkflowInstanceStatusName } from "./WorkflowBinding-DUZtKCVM.mjs";
 import { Effect, Layer, Schema } from "effect";
 import { DurableObject } from "cloudflare:workers";
 import { adminSecretsStore as adminSecretsStore$1, getQueueResult, introspectWorkflow as introspectWorkflow$1, introspectWorkflowInstance as introspectWorkflowInstance$1 } from "cloudflare:test";

package/dist/{WorkflowBinding-wZ-yGHow.d.mts → WorkflowBinding-DUZtKCVM.d.mts}

@@ -1,5 +1,5 @@
 import { c as WorkerEnvironment, r as BindingValidationError, t as BindingNotFoundError } from "./Binding-xJJJPmiD.mjs";
-import { x as ServiceFreeSchema } from "./DurableObjectState-B3uFY1eM.mjs";
+import { x as ServiceFreeSchema } from "./DurableObjectState-OupNMMUl.mjs";
 import { Context, Effect, Option, Schema } from "effect";
 declare namespace WorkflowBinding_d_exports {
   export { WorkflowBindingClient, WorkflowBindingDefinition, WorkflowInstance, WorkflowInstanceCreateBatchOptions, WorkflowInstanceCreateOptions, WorkflowInstanceEvent, WorkflowInstanceRestartOptions, WorkflowInstanceStatus, WorkflowInstanceStatusName, WorkflowOperationError, WorkflowResultDecodeError, isWorkflow, layer, makeClient };

package/dist/index.d.mts

@@ -1,8 +1,8 @@
 import { a as Environment_d_exports, c as WorkerEnvironment, i as Binding_d_exports, n as BindingService, o as WorkerConfig, r as BindingValidationError, s as WorkerEnv, t as BindingNotFoundError } from "./Binding-xJJJPmiD.mjs";
 import { l as Artifacts_d_exports } from "./Artifacts-DnHQA-Ax.mjs";
-import { C as Rpc_d_exports, D as StorageOperationError, E as DurableObjectStorage_d_exports, S as Provider, T as DurableWebSocket, _ as Definition$4, a as NativeRequest, b as RpcDefinition_d_exports, c as WorkerDefinition_d_exports, d as AsyncMethodCloudflareReturn, f as AsyncMethodKey, g as QueueBinding_d_exports, h as QueueDefinition_d_exports, i as ExecutionContext, l as ServiceBinding_d_exports, m as Queue_d_exports, o as WorkerContext, p as AsyncMethodSuccess, r as DurableObjectState_d_exports, s as Worker_d_exports, t as DurableObjectState, u as AsyncMethodArgs, v as Method$2, w as DurableObjectWebSocket_d_exports, x as ServiceFreeSchema$1, y as ReservedMethodName$2 } from "./DurableObjectState-B3uFY1eM.mjs";
+import { C as Rpc_d_exports, D as StorageOperationError, E as DurableObjectStorage_d_exports, S as Provider, T as DurableWebSocket, _ as Definition$4, a as NativeRequest, b as RpcDefinition_d_exports, c as WorkerDefinition_d_exports, d as AsyncMethodCloudflareReturn, f as AsyncMethodKey, g as QueueBinding_d_exports, h as QueueDefinition_d_exports, i as ExecutionContext, l as ServiceBinding_d_exports, m as Queue_d_exports, o as WorkerContext, p as AsyncMethodSuccess, r as DurableObjectState_d_exports, s as Worker_d_exports, t as DurableObjectState, u as AsyncMethodArgs, v as Method$2, w as DurableObjectWebSocket_d_exports, x as ServiceFreeSchema$1, y as ReservedMethodName$2 } from "./DurableObjectState-OupNMMUl.mjs";
 import { t as Hyperdrive_d_exports } from "./Hyperdrive-z-9fFz15.mjs";
-import { a as WorkflowInstanceCreateOptions, i as WorkflowInstanceCreateBatchOptions, n as WorkflowBinding_d_exports, r as WorkflowInstance, s as WorkflowOperationError, t as WorkflowBindingClient } from "./WorkflowBinding-wZ-yGHow.mjs";
+import { a as WorkflowInstanceCreateOptions, i as WorkflowInstanceCreateBatchOptions, n as WorkflowBinding_d_exports, r as WorkflowInstance, s as WorkflowOperationError, t as WorkflowBindingClient } from "./WorkflowBinding-DUZtKCVM.mjs";
 import { Cause, Config, Context, Data, DateTime, Duration, Effect, Layer, Option, Predicate, Redacted, Schema, Scope } from "effect";
 import { Headers as Headers$1, HttpClient, HttpClientResponse } from "effect/unstable/http";
 import { OtlpExporter, OtlpResource } from "effect/unstable/observability";
@@ -1111,7 +1111,9 @@ interface DurableObjectOptions<RRuntime, REvent = never, EventLayerError = never
    * Optional RPC methods exposed as Durable Object instance methods.
    *
    * After every invocation, the configured OTLP flusher is scheduled through
-   * `DurableObjectState.waitUntil`, including when the handler fails.
+   * `DurableObjectState.waitUntil`, including when the handler fails. The
+   * scheduled flush silently settles within two seconds even if the exporter
+   * does not.
    */
   readonly rpc?: Rpc;
   /** Optional fetch handler for HTTP/WebSocket requests. */
@@ -1128,7 +1130,9 @@ interface DurableObjectOptions<RRuntime, REvent = never, EventLayerError = never
    * Optional raw alarm handler.
    *
    * After every invocation, the configured OTLP flusher is scheduled through
-   * `DurableObjectState.waitUntil`, including when the handler fails.
+   * `DurableObjectState.waitUntil`, including when the handler fails. The
+   * scheduled flush silently settles within two seconds even if the exporter
+   * does not.
    */
   readonly alarm?: (alarmInfo?: globalThis.AlarmInvocationInfo) => Effect.Effect<void, unknown, HandlerContext<RRuntime | REvent>>;
   readonly webSocketMessage?: (socket: DurableWebSocket, message: string | ArrayBuffer) => Effect.Effect<void, unknown, HandlerContext<RRuntime | REvent>>;

package/dist/index.mjs

@@ -643,16 +643,23 @@ const layer$14 = Layer.sync(CacheStorage, () => makeClient$11(caches));
 * telemetry on demand. Cloudflare isolates can freeze before the periodic
 * export interval fires. Effect-backed Worker fetch handlers, Worker or
 * Durable Object native RPC handlers, and Durable Object alarm handlers
-* schedule this flusher automatically.
-* Flush or scheduling failures do not replace the handler outcome and emit
-* only bounded framework diagnostics without attaching the foreign cause.
-* Other entrypoint lifecycles can flush explicitly or hand the flush to their
-* `waitUntil` mechanism:
+* schedule this flusher automatically. These automatic flushes are capped at
+* two seconds and silently discard timeouts and failures so telemetry cannot
+* extend or fail the user event, or recursively log through an unhealthy
+* exporter.
+*
+* Other entrypoint lifecycles, including queue handlers, do not flush
+* automatically. Applications can flush explicitly or hand the flush to their
+* `waitUntil` mechanism, and own the timeout and failure policy at that call
+* site:
 *
 * ```ts
 * const flusher = yield* OtlpExporter.Flusher;
 *
-* yield* flusher.flush;
+* yield* flusher.flush.pipe(
+*   Effect.timeoutOption("2 seconds"),
+*   Effect.ignoreCause,
+* );
 * ```
 */
 var CloudflareOtlp_exports = /* @__PURE__ */ __exportAll({
@@ -1342,16 +1349,20 @@ function runEventPromise(...args) {
 }
 //#endregion
 //#region src/internal/Telemetry.ts
-const logFlushFailure = Effect.logError("Telemetry flush failed").pipe(Effect.ignoreCause);
-const logFlushSchedulingFailure = Effect.logError("Telemetry flush scheduling failed").pipe(Effect.ignoreCause);
+/** Maximum event lifetime spent on an internally scheduled telemetry flush. */
+const scheduledFlushTimeout = "2 seconds";
 /**
 * Schedules a configured OTLP flusher through the current Cloudflare event.
+*
+* The handed-off effect is best-effort: it settles within two seconds and
+* silently absorbs every failure cause so telemetry cannot extend or fail the
+* user event, or recursively log through an unhealthy exporter.
 */
 const scheduleTelemetryFlush$2 = (waitUntil) => Effect.gen(function* () {
 	const flusher = yield* Effect.serviceOption(OtlpExporter.Flusher);
 	if (Option.isNone(flusher)) return;
-	yield* waitUntil(flusher.value.flush.pipe(Effect.catchCause(() => logFlushFailure)));
-}).pipe(Effect.catchCause(() => logFlushSchedulingFailure));
+	yield* waitUntil(flusher.value.flush.pipe(Effect.timeoutOption(scheduledFlushTimeout), Effect.ignoreCause, Effect.asVoid));
+}).pipe(Effect.ignoreCause);
 //#endregion
 //#region src/Rpc.ts
 var Rpc_exports = /* @__PURE__ */ __exportAll({
@@ -1737,7 +1748,8 @@ const isWorkerOptions = (options) => !Effect.isEffect(options);
 *
 * The flush is handed to `ctx.waitUntil` so it never delays the response
 * (including streaming bodies still being consumed). It is a no-op when the
-* context does not contain an `OtlpExporter.Flusher`.
+* context does not contain an `OtlpExporter.Flusher`. The handed-off effect is
+* best-effort and silently settles within two seconds.
 */
 const scheduleTelemetryFlush$1 = scheduleTelemetryFlush$2((flush) => Effect.flatMap(WorkerContext, (workerContext) => workerContext.waitUntil(flush)));
 function make$9(layer, optionsOrFetch) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "effect-cf",
-  "version": "0.28.0",
+  "version": "0.28.1",
   "description": "Effect-native primitives for Cloudflare Workers and bindings.",
   "license": "MIT",
   "repository": {

package/src/CloudflareOtlp.ts

@@ -5,16 +5,23 @@
  * telemetry on demand. Cloudflare isolates can freeze before the periodic
  * export interval fires. Effect-backed Worker fetch handlers, Worker or
  * Durable Object native RPC handlers, and Durable Object alarm handlers
- * schedule this flusher automatically.
- * Flush or scheduling failures do not replace the handler outcome and emit
- * only bounded framework diagnostics without attaching the foreign cause.
- * Other entrypoint lifecycles can flush explicitly or hand the flush to their
- * `waitUntil` mechanism:
+ * schedule this flusher automatically. These automatic flushes are capped at
+ * two seconds and silently discard timeouts and failures so telemetry cannot
+ * extend or fail the user event, or recursively log through an unhealthy
+ * exporter.
+ *
+ * Other entrypoint lifecycles, including queue handlers, do not flush
+ * automatically. Applications can flush explicitly or hand the flush to their
+ * `waitUntil` mechanism, and own the timeout and failure policy at that call
+ * site:
  *
  * ```ts
  * const flusher = yield* OtlpExporter.Flusher;
  *
- * yield* flusher.flush;
+ * yield* flusher.flush.pipe(
+ *   Effect.timeoutOption("2 seconds"),
+ *   Effect.ignoreCause,
+ * );
  * ```
  */
 import { ConfigProvider, Effect, Layer, Option } from "effect";

package/src/DurableObject.ts

@@ -108,7 +108,9 @@ export interface DurableObjectOptions<
    * Optional RPC methods exposed as Durable Object instance methods.
    *
    * After every invocation, the configured OTLP flusher is scheduled through
-   * `DurableObjectState.waitUntil`, including when the handler fails.
+   * `DurableObjectState.waitUntil`, including when the handler fails. The
+   * scheduled flush silently settles within two seconds even if the exporter
+   * does not.
    */
   readonly rpc?: Rpc;
   /** Optional fetch handler for HTTP/WebSocket requests. */
@@ -125,7 +127,9 @@ export interface DurableObjectOptions<
    * Optional raw alarm handler.
    *
    * After every invocation, the configured OTLP flusher is scheduled through
-   * `DurableObjectState.waitUntil`, including when the handler fails.
+   * `DurableObjectState.waitUntil`, including when the handler fails. The
+   * scheduled flush silently settles within two seconds even if the exporter
+   * does not.
    */
   readonly alarm?: (
     alarmInfo?: globalThis.AlarmInvocationInfo,

package/src/Worker.ts

@@ -185,7 +185,8 @@ export interface WorkerOptions<
    *
    * The layer is built inside the event's Effect scope and finalized when the
    * event effect completes. Use this for event-scoped resources such as OTLP
-   * trace/log exporters that should flush at event completion.
+   * trace/log exporters. Worker fetch and RPC handlers schedule a best-effort
+   * flush capped at two seconds; queue handlers do not flush automatically.
    */
   readonly eventLayer?: Layer.Layer<REvent, EventLayerError, WorkerBaseContext<RRuntime>>;
   /** Main request handler. */
@@ -200,7 +201,8 @@ export interface WorkerOptions<
    * Optional RPC methods exposed as class instance methods.
    *
    * After every invocation, the configured OTLP flusher is scheduled through
-   * `WorkerContext.waitUntil`, including when the handler fails.
+   * `WorkerContext.waitUntil`, including when the handler fails. The scheduled
+   * flush silently settles within two seconds even if the exporter does not.
    */
   readonly rpc?: Rpc;
 }
@@ -300,7 +302,8 @@ const isWorkerOptions = <ROut, REvent, EventLayerError, Rpc extends WorkerRpc<RO
  *
  * The flush is handed to `ctx.waitUntil` so it never delays the response
  * (including streaming bodies still being consumed). It is a no-op when the
- * context does not contain an `OtlpExporter.Flusher`.
+ * context does not contain an `OtlpExporter.Flusher`. The handed-off effect is
+ * best-effort and silently settles within two seconds.
  */
 const scheduleTelemetryFlush: Effect.Effect<void, never, WorkerContext> =
   Telemetry.scheduleTelemetryFlush((flush) =>

package/src/internal/Telemetry.ts

@@ -1,14 +1,15 @@
 import { Effect, Option } from "effect";
 import { OtlpExporter } from "effect/unstable/observability";
 
-const logFlushFailure = Effect.logError("Telemetry flush failed").pipe(Effect.ignoreCause);
-
-const logFlushSchedulingFailure = Effect.logError("Telemetry flush scheduling failed").pipe(
-  Effect.ignoreCause,
-);
+/** Maximum event lifetime spent on an internally scheduled telemetry flush. */
+const scheduledFlushTimeout = "2 seconds";
 
 /**
  * Schedules a configured OTLP flusher through the current Cloudflare event.
+ *
+ * The handed-off effect is best-effort: it settles within two seconds and
+ * silently absorbs every failure cause so telemetry cannot extend or fail the
+ * user event, or recursively log through an unhealthy exporter.
  */
 export const scheduleTelemetryFlush = <R>(
   waitUntil: (flush: Effect.Effect<void>) => Effect.Effect<void, never, R>,
@@ -20,8 +21,14 @@ export const scheduleTelemetryFlush = <R>(
       return;
     }
 
-    // Exporters and platform schedulers are foreign boundaries. Preserve a
-    // useful diagnostic without retaining their arbitrary failure causes in
-    // logs, where payloads, headers, or credentials could otherwise escape.
-    yield* waitUntil(flusher.value.flush.pipe(Effect.catchCause(() => logFlushFailure)));
-  }).pipe(Effect.catchCause(() => logFlushSchedulingFailure));
+    // Exporters and platform schedulers are foreign boundaries. Do not log
+    // their arbitrary failure causes: the configured logger may be the same
+    // unhealthy OTLP exporter and recursively increase its backlog.
+    yield* waitUntil(
+      flusher.value.flush.pipe(
+        Effect.timeoutOption(scheduledFlushTimeout),
+        Effect.ignoreCause,
+        Effect.asVoid,
+      ),
+    );
+  }).pipe(Effect.ignoreCause);