effect 4.0.1 → 4.0.3

package/src/http/FindMyWay/internal/router.ts

@@ -338,13 +338,6 @@ class RouterImpl<A> implements Router.Router<A> {
         path = path.replace(FULL_PATH_REGEXP, "/")
       }
 
-      // This must be run before sanitizeUrl as the resulting function
-      // .sliceParameter must be constructed with same URL string used
-      // throughout the rest of this function.
-      if (this.options.ignoreDuplicateSlashes) {
-        path = removeDuplicateSlashes(path)
-      }
-
       let sanitizedUrl
       try {
         sanitizedUrl = safeDecodeURI(path)
@@ -355,6 +348,10 @@ class RouterImpl<A> implements Router.Router<A> {
         return undefined
       }
 
+      if (this.options.ignoreDuplicateSlashes) {
+        path = removeDuplicateSlashes(path)
+      }
+
       if (this.options.ignoreTrailingSlash) {
         path = trimLastSlash(path)
       }

package/src/http/Headers.ts

@@ -749,7 +749,9 @@ export const isRedactedName = (
  *
  * **Details**
  *
- * Defaults include `authorization`, `cookie`, `set-cookie`, and `x-api-key`.
+ * Defaults include `authorization`, `cookie`, `set-cookie`, `x-api-key` and
+ * `AWSAccessKeyId`, `Signature`, `sig` and `X-Goog-Signature`. Names match
+ * case-insensitively, and providing a new list replaces the defaults.
  *
  * @stability unstable
  * @category services
@@ -762,6 +764,10 @@ export const CurrentRedactedNames = Context.Reference<
     "authorization",
     "cookie",
     "set-cookie",
-    "x-api-key"
+    "x-api-key",
+    "AWSAccessKeyId",
+    "Signature",
+    "sig",
+    "X-Goog-Signature"
   ]
 })

package/src/http/HttpClient.ts

@@ -18,15 +18,18 @@ import { Clock } from "../Clock.ts"
 import * as Context from "../Context.ts"
 import * as Duration from "../Duration.ts"
 import * as Effect from "../Effect.ts"
+import * as Exit from "../Exit.ts"
 import * as Fiber from "../Fiber.ts"
 import { constant, constFalse, constTrue, dual, flow, identity } from "../Function.ts"
 import * as Inspectable from "../Inspectable.ts"
+import { getStackTraceLimit, setStackTraceLimit } from "../internal/stackTraceLimit.ts"
 import * as Layer from "../Layer.ts"
 import * as Option from "../Option.ts"
 import type * as RateLimiter from "../persistence/RateLimiter.ts"
 import { type Pipeable, pipeArguments } from "../Pipeable.ts"
 import * as Predicate from "../Predicate.ts"
 import * as Ref from "../Ref.ts"
+import * as References from "../References.ts"
 import * as Result from "../Result.ts"
 import * as Schedule from "../Schedule.ts"
 import type * as Scope from "../Scope.ts"
@@ -42,6 +45,7 @@ import * as HttpClientResponse from "./HttpClientResponse.ts"
 import * as HttpIncomingMessage from "./HttpIncomingMessage.ts"
 import * as HttpMethod from "./HttpMethod.ts"
 import * as TraceContext from "./HttpTraceContext.ts"
+import * as tracing from "./internal/tracing.ts"
 import * as Url from "./Url.ts"
 
 const TypeId = "~effect/http/HttpClient"
@@ -900,26 +904,10 @@ export const make = (
           { kind: "client" },
           (span) => {
             span.attribute("http.request.method", request.method)
-            span.attribute("server.address", url.origin)
-            if (url.port !== "") {
-              span.attribute("server.port", +url.port)
-            }
-            span.attribute("url.full", url.toString())
-            span.attribute("url.path", url.pathname)
-            span.attribute("url.scheme", url.protocol.slice(0, -1))
-            const query = url.search.slice(1)
-            if (query !== "") {
-              span.attribute("url.query", query)
-            }
             const redactedHeaderNames = fiber.getRef(Headers.CurrentRedactedNames)
+            tracing.addUrlAttributes(span, url)
             const headerFilter = fiber.getRef(TracerHeaderFilter)
-            for (const name in request.headers) {
-              if (!headerFilter(name, "request")) continue
-              span.attribute(
-                `http.request.header.${name}`,
-                Headers.isRedactedName(name, redactedHeaderNames) ? "<redacted>" : request.headers[name]
-              )
-            }
+            tracing.addHeaderAttributes(span, "request", request.headers, headerFilter, redactedHeaderNames)
             request = fiber.getRef(TracerPropagationEnabled)
               ? HttpClientRequest.setHeaders(request, TraceContext.toHeaders(span))
               : request
@@ -929,12 +917,12 @@ export const make = (
                 Effect.matchCauseEffect({
                   onSuccess: (response) => {
                     span.attribute("http.response.status_code", response.status)
-                    for (const name in response.headers) {
-                      if (!headerFilter(name, "response")) continue
-                      span.attribute(
-                        `http.response.header.${name}`,
-                        Headers.isRedactedName(name, redactedHeaderNames) ? "<redacted>" : response.headers[name]
-                      )
+                    tracing.addHeaderAttributes(span, "response", response.headers, headerFilter, redactedHeaderNames)
+                    // OpenTelemetry marks client spans as failed for 4xx and
+                    // 5xx responses, while the response itself still succeeds.
+                    if (response.status >= 400 && response.status < 600) {
+                      span.attribute("error.type", String(response.status))
+                      endSpanWithStatusError(fiber, span, request, response)
                     }
 
                     if (scopedController) return Effect.succeed(response)
@@ -954,6 +942,26 @@ export const make = (
         )
       })), Effect.succeed as HttpClient.Preprocess<never, never>)
 
+const endSpanWithStatusError = (
+  fiber: Fiber.Fiber<unknown, unknown>,
+  span: Tracer.Span,
+  request: HttpClientRequest.HttpClientRequest,
+  response: HttpClientResponse.HttpClientResponse
+): void => {
+  const stackTraceLimit = getStackTraceLimit()
+  setStackTraceLimit(0)
+  let exit: Exit.Exit<never, Error.HttpClientError>
+  try {
+    exit = Exit.fail(new Error.HttpClientError({ reason: new Error.StatusCodeError({ request, response }) }))
+  } finally {
+    setStackTraceLimit(stackTraceLimit)
+  }
+  span.end(
+    fiber.getRef(References.TracerTimingEnabled) ? fiber.getRef(Clock).currentTimeNanosUnsafe() : BigInt(0),
+    exit
+  )
+}
+
 /**
  * Appends a transformation of the request object before sending it.
  *
@@ -1458,6 +1466,8 @@ export declare namespace WithRateLimiter {
  * It can update limits by inspecting common rate limit response headers and
  * automatically retries HTTP `429` responses (or `HttpClientError` values
  * wrapping a `429` response) by forcing the retry back through the limiter.
+ * When a response reports the remaining budget, requests wait for the
+ * reported reset once that budget is exhausted.
  *
  * **Gotchas**
  *
@@ -1478,6 +1488,8 @@ export const withRateLimiter: {
    * It can update limits by inspecting common rate limit response headers and
    * automatically retries HTTP `429` responses (or `HttpClientError` values
    * wrapping a `429` response) by forcing the retry back through the limiter.
+   * When a response reports the remaining budget, requests wait for the
+   * reported reset once that budget is exhausted.
    *
    * **Gotchas**
    *
@@ -1500,6 +1512,8 @@ export const withRateLimiter: {
    * It can update limits by inspecting common rate limit response headers and
    * automatically retries HTTP `429` responses (or `HttpClientError` values
    * wrapping a `429` response) by forcing the retry back through the limiter.
+   * When a response reports the remaining budget, requests wait for the
+   * reported reset once that budget is exhausted.
    *
    * **Gotchas**
    *
@@ -1543,14 +1557,36 @@ export const withRateLimiter: {
     return initialState
   }
 
+  const budgets = new Map<string, RateLimitBudget>()
+  const getBudget = (key: string): RateLimitBudget => {
+    let budget = budgets.get(key)
+    if (budget === undefined) {
+      budget = { sent: 0, observed: 0, remaining: 0, resetAt: 0 }
+      budgets.set(key, budget)
+    }
+    return budget
+  }
+
   const onResponse = options.disableResponseInspection
     ? undefined
-    : (clock: Clock, key: string, headers: Headers.Headers, tokens: number) => {
+    : (clock: Clock, key: string, headers: Headers.Headers, tokens: number, sent: number) => {
       const current = getState(key)
       const next = parseRateLimiterState(current, clock, headers, tokens, headerNames)
       if (next.limit !== current.limit || !Duration.equals(next.window, current.window)) {
         states.set(key, next)
       }
+      const remaining = parseRateLimitRemaining(headers, headerNames)
+      const budget = getBudget(key)
+      // responses to earlier requests carry stale counts
+      if (remaining === undefined || sent <= budget.observed) {
+        return
+      }
+      const resetAfter = parseRateLimitWindow(clock, headers, headerNames)
+      budget.observed = sent
+      budget.remaining = remaining
+      if (resetAfter !== undefined) {
+        budget.resetAt = clock.currentTimeMillisUnsafe() + Duration.toMillis(resetAfter)
+      }
     }
 
   return transform(self, function loop(effect, request, retries = 0): Effect.Effect<
@@ -1562,6 +1598,15 @@ export const withRateLimiter: {
     const clock = fiber.getRef(Clock)
     const key = resolveKey(request)
     const tokens = Math.max(resolveTokens(request), 1)
+    const budget = getBudget(key)
+    const now = clock.currentTimeMillisUnsafe()
+    // requests admitted after the observed one are not reflected in its count
+    if (budget.resetAt > now && budget.remaining - (budget.sent - budget.observed) < tokens) {
+      return Effect.flatMap(Effect.sleep(budget.resetAt - now), () => loop(effect, request, retries))
+    }
+    // counted at admission, so requests already admitted are sent even if a
+    // later response exhausts the budget
+    const sent = budget.sent += tokens
     const current = getState(key)
     const canRetry = options.times === undefined || retries < options.times
     function retry(retryAfter: Duration.Duration | undefined) {
@@ -1573,7 +1618,7 @@ export const withRateLimiter: {
       response: HttpClientResponse.HttpClientResponse,
       adaptive: RateLimiter.AdaptiveConsumeResult | undefined
     ) => {
-      onResponse?.(clock, key, response.headers, tokens)
+      onResponse?.(clock, key, response.headers, tokens, sent)
       if (options.disableResponseInspection || response.status !== 429) {
         return Effect.succeed</**
          * Applies request rate limiting using the `RateLimiter` service.
@@ -1583,6 +1628,8 @@ export const withRateLimiter: {
          * It can update limits by inspecting common rate limit response headers and
          * automatically retries HTTP `429` responses (or `HttpClientError` values
          * wrapping a `429` response) by forcing the retry back through the limiter.
+         * When a response reports the remaining budget, requests wait for the
+         * reported reset once that budget is exhausted.
          *
          * **Gotchas**
          *
@@ -1606,6 +1653,8 @@ export const withRateLimiter: {
          * It can update limits by inspecting common rate limit response headers and
          * automatically retries HTTP `429` responses (or `HttpClientError` values
          * wrapping a `429` response) by forcing the retry back through the limiter.
+         * When a response reports the remaining budget, requests wait for the
+         * reported reset once that budget is exhausted.
          *
          * **Gotchas**
          *
@@ -1629,6 +1678,8 @@ export const withRateLimiter: {
          * It can update limits by inspecting common rate limit response headers and
          * automatically retries HTTP `429` responses (or `HttpClientError` values
          * wrapping a `429` response) by forcing the retry back through the limiter.
+         * When a response reports the remaining budget, requests wait for the
+         * reported reset once that budget is exhausted.
          *
          * **Gotchas**
          *
@@ -1748,6 +1799,17 @@ interface RateLimiterState {
   readonly initial: boolean
 }
 
+interface RateLimitBudget {
+  /** Total tokens admitted for the key. */
+  sent: number
+  /** The `sent` total of the request whose remaining count was last applied. */
+  observed: number
+  /** The remaining count reported in response to the `observed` request. */
+  remaining: number
+  /** When the server budget resets, in epoch milliseconds. */
+  resetAt: number
+}
+
 const parseRateLimiterState = (
   state: RateLimiterState,
   clock: Clock,
@@ -2153,6 +2215,11 @@ export const TracerDisabledWhen = Context.Reference<
 /**
  * Context reference for filtering request and response headers added to client spans.
  *
+ * **Details**
+ *
+ * Header capture is opt-in: the default filter records no headers. Captured
+ * headers listed in `Headers.CurrentRedactedNames` are recorded as `<redacted>`.
+ *
  * @stability unstable
  * @category services
  * @since 4.0.0
@@ -2160,7 +2227,7 @@ export const TracerDisabledWhen = Context.Reference<
 export const TracerHeaderFilter = Context.Reference<
   (headerName: string, phase: "request" | "response") => boolean
 >("effect/http/HttpClient/TracerHeaderFilter", {
-  defaultValue: () => constTrue
+  defaultValue: () => constFalse
 })
 
 /**
@@ -2177,6 +2244,10 @@ export const TracerPropagationEnabled = Context.Reference<boolean>("effect/http/
 /**
  * Context reference for generating the span name used for outgoing client request spans.
  *
+ * **Details**
+ *
+ * Defaults to the request method unchanged.
+ *
  * @stability unstable
  * @category services
  * @since 4.0.0
@@ -2184,7 +2255,7 @@ export const TracerPropagationEnabled = Context.Reference<boolean>("effect/http/
 export const SpanNameGenerator = Context.Reference<
   (request: HttpClientRequest.HttpClientRequest) => string
 >("effect/http/HttpClient/SpanNameGenerator", {
-  defaultValue: () => (request) => `http.client ${request.method}`
+  defaultValue: () => (request) => request.method
 })
 
 /**
@@ -2226,7 +2297,7 @@ const responseRegistry = (() => {
     }
   }
 
-  const timers = new Map<HttpClientResponse.HttpClientResponse, any>()
+  const timers = new WeakMap<HttpClientResponse.HttpClientResponse, any>()
   return {
     register(response: HttpClientResponse.HttpClientResponse, controller: AbortController) {
       timers.set(response, setTimeout(() => controller.abort(), 5000))

package/src/http/HttpClientResponse.ts

@@ -341,7 +341,9 @@ class WebHttpClientResponse extends Inspectable.Class implements HttpClientRespo
     if (this.cachedCookies) {
       return this.cachedCookies
     }
-    return this.cachedCookies = Cookies.fromSetCookie(this.source.headers.getSetCookie())
+    // React Native's Headers does not implement getSetCookie, and it never
+    // exposes Set-Cookie to JavaScript anyway.
+    return this.cachedCookies = Cookies.fromSetCookie(this.source.headers.getSetCookie?.() ?? [])
   }
 
   get remoteAddress(): Option.Option<string> {

package/src/http/HttpEffect.ts

@@ -33,6 +33,9 @@ import * as preResponseHandler from "./internal/preResponseHandler.ts"
 /**
  * Runs an HTTP server effect, sends the produced response with the supplied handler, and converts failures into HTTP responses.
  * On handler failure, the request scope closes with the original cause.
+ * If the send handler returns an `HttpServerResponse`, such as the `101`
+ * response of an upgraded request, middleware observes it in place of the
+ * handler's response.
  *
  * @stability unstable
  * @category combinators
@@ -81,11 +84,17 @@ export const toHandled = <E, R, EH, RH>(
     const handler = preResponseHandler.requestPreResponseHandlers.get(request.source)
     if (handler === undefined) {
       ;(request as any)[handledSymbol] = true
-      return Effect.mapEager(handleResponse(request, response), () => response)
+      return Effect.mapEager(
+        handleResponse(request, response),
+        (sent) => Response.isHttpServerResponse(sent) ? sent : response
+      )
     }
     return Effect.flatMapEager(handler(request, response), (sentResponse) => {
       ;(request as any)[handledSymbol] = true
-      return Effect.mapEager(handleResponse(request, sentResponse), () => response)
+      return Effect.mapEager(
+        handleResponse(request, sentResponse),
+        (sent) => Response.isHttpServerResponse(sent) ? sent : response
+      )
     })
   }
 

package/src/http/HttpMiddleware.ts

@@ -11,6 +11,7 @@
  * @stability unstable
  * @since 4.0.0
  */
+import * as Cause from "../Cause.ts"
 import { Clock } from "../Clock.ts"
 import * as Context from "../Context.ts"
 import * as Effect from "../Effect.ts"
@@ -18,6 +19,7 @@ import * as Exit from "../Exit.ts"
 import type * as Fiber from "../Fiber.ts"
 import { constant, constFalse } from "../Function.ts"
 import * as internalEffect from "../internal/effect.ts"
+import { getStackTraceLimit, setStackTraceLimit } from "../internal/stackTraceLimit.ts"
 import * as Layer from "../Layer.ts"
 import * as Option from "../Option.ts"
 import type { Predicate } from "../Predicate.ts"
@@ -26,7 +28,7 @@ import { nativeTracer, ParentSpan, Tracer } from "../Tracer.ts"
 import * as Headers from "./Headers.ts"
 import type { CompressionAlgorithm } from "./HttpPlatform.ts"
 import { HttpPlatform } from "./HttpPlatform.ts"
-import { causeResponseStripped, ClientAbort } from "./HttpServerError.ts"
+import { causeResponseStripped, ClientAbort, HttpServerError, ResponseError } from "./HttpServerError.ts"
 import { HttpServerRequest } from "./HttpServerRequest.ts"
 import * as Request from "./HttpServerRequest.ts"
 import * as Response from "./HttpServerResponse.ts"
@@ -35,6 +37,7 @@ import * as TraceContext from "./HttpTraceContext.ts"
 import * as compressionInternal from "./internal/compression.ts"
 import * as bodyInternal from "./internal/httpBody.ts"
 import { appendPreResponseHandlerUnsafe } from "./internal/preResponseHandler.ts"
+import * as tracing from "./internal/tracing.ts"
 
 /**
  * Middleware that transforms an HTTP server app effect into another HTTP server app effect.
@@ -130,15 +133,37 @@ export const layerTracerDisabledForUrls = (
 /**
  * Context reference for generating server span names from HTTP server requests.
  *
+ * **Details**
+ *
+ * Defaults to the request method unchanged.
+ *
  * @stability unstable
  * @category services
  * @since 4.0.0
  */
 export const SpanNameGenerator = Context.Reference<(request: HttpServerRequest) => string>(
   "@effect/platform/HttpMiddleware/SpanNameGenerator",
-  { defaultValue: () => (request) => `http.server ${request.method}` }
+  { defaultValue: () => (request) => request.method }
 )
 
+/**
+ * Context reference for filtering request and response headers added to server spans.
+ *
+ * **Details**
+ *
+ * Header capture is opt-in: the default filter records no headers. Captured
+ * headers listed in `Headers.CurrentRedactedNames` are recorded as `<redacted>`.
+ *
+ * @stability unstable
+ * @category services
+ * @since 4.0.0
+ */
+export const TracerHeaderFilter = Context.Reference<
+  (headerName: string, phase: "request" | "response") => boolean
+>("effect/http/HttpMiddleware/TracerHeaderFilter", {
+  defaultValue: () => constFalse
+})
+
 /**
  * Middleware that logs sent HTTP responses with request method, request URL, and response status annotations.
  *
@@ -195,6 +220,23 @@ export const isTracerDisabledUnsafe = (
   request: HttpServerRequest
 ): boolean => !fiber.cache.tracerEnabled || fiber.getRef(TracerDisabledWhen)(request)
 
+// OpenTelemetry requires failed server spans for 5xx responses.
+const responseSpanExit = (
+  request: HttpServerRequest,
+  response: HttpServerResponse
+): Exit.Exit<HttpServerResponse, HttpServerError> => {
+  if (!(response.status >= 500 && response.status < 600)) {
+    return Exit.succeed(response)
+  }
+  const stackTraceLimit = getStackTraceLimit()
+  setStackTraceLimit(0)
+  try {
+    return Exit.fail(new HttpServerError({ reason: new ResponseError({ request, response }) }))
+  } finally {
+    setStackTraceLimit(stackTraceLimit)
+  }
+}
+
 /**
  * Middleware that creates a server trace span for each request and records request and response HTTP attributes.
  *
@@ -221,71 +263,44 @@ export const tracer: <E, R>(
       fiber.setContext(prevServices)
       const endTime = fiber.getRef(Clock).currentTimeNanosUnsafe()
       if (Exit.isSuccess(exit) && (!span.sampled || fiber.getRef(Tracer) === nativeTracer)) {
-        span.end(endTime, exit)
+        span.end(endTime, responseSpanExit(request, exit.value))
         return undefined
       }
       const redactedHeaderNames = fiber.getRef(Headers.CurrentRedactedNames)
+      const headerFilter = fiber.getRef(TracerHeaderFilter)
       fiber.currentDispatcher.scheduleTask(() => {
         let response: HttpServerResponse
-        let spanExit = exit
+        let spanExit: Exit.Exit<HttpServerResponse, unknown>
         if (Exit.isFailure(exit)) {
           const [failureResponse, cause] = causeResponseStripped(exit.cause)
           response = failureResponse
-          spanExit = Option.isSome(cause) ? Exit.failCause(cause.value) : Exit.succeed(response)
+          // OpenTelemetry only treats 5xx responses as server span errors; interrupts still fail the span.
+          spanExit = Option.isSome(cause) && (response.status >= 500 || Cause.hasInterrupts(cause.value))
+            ? Exit.failCause(cause.value)
+            : responseSpanExit(request, response)
         } else {
           response = exit.value
+          spanExit = responseSpanExit(request, response)
         }
         if (span.sampled) {
           span.attribute("http.request.method", request.method)
-          if (request.url.startsWith("/")) {
-            const host = request.headers.host ?? "localhost"
-            const protocol = request.headers["x-forwarded-proto"] === "https" ? "https" : "http"
-            span.attribute("url.full", `${protocol}://${host}${request.url}`)
-            const queryIndex = request.url.indexOf("?")
-            if (queryIndex === -1) {
-              span.attribute("url.path", request.url)
-            } else {
-              span.attribute("url.path", request.url.slice(0, queryIndex))
-              if (queryIndex < request.url.length - 1) {
-                span.attribute("url.query", request.url.slice(queryIndex + 1))
-              }
-            }
-            span.attribute("url.scheme", protocol)
-          } else {
-            const url = Request.toURL(request)
-            if (Option.isSome(url)) {
-              if (url.value.username !== "" || url.value.password !== "") {
-                url.value.username = "REDACTED"
-                url.value.password = "REDACTED"
-              }
-              span.attribute("url.full", url.value.toString())
-              span.attribute("url.path", url.value.pathname)
-              const query = url.value.search.slice(1)
-              if (query !== "") {
-                span.attribute("url.query", query)
-              }
-              span.attribute("url.scheme", url.value.protocol.slice(0, -1))
+          const url = Request.toURL(request)
+          if (Option.isSome(url)) {
+            if (!request.url.startsWith("/") && (url.value.username !== "" || url.value.password !== "")) {
+              url.value.username = "REDACTED"
+              url.value.password = "REDACTED"
             }
+            tracing.addUrlAttributes(span, url.value)
           }
           if (request.headers["user-agent"] !== undefined) {
             span.attribute("user_agent.original", request.headers["user-agent"])
           }
-          for (const name in request.headers) {
-            span.attribute(
-              `http.request.header.${name}`,
-              Headers.isRedactedName(name, redactedHeaderNames) ? "<redacted>" : request.headers[name]
-            )
-          }
+          tracing.addHeaderAttributes(span, "request", request.headers, headerFilter, redactedHeaderNames)
           if (Option.isSome(request.remoteAddress)) {
             span.attribute("client.address", request.remoteAddress.value)
           }
           span.attribute("http.response.status_code", response.status)
-          for (const name in response.headers) {
-            span.attribute(
-              `http.response.header.${name}`,
-              Headers.isRedactedName(name, redactedHeaderNames) ? "<redacted>" : response.headers[name]
-            )
-          }
+          tracing.addHeaderAttributes(span, "response", response.headers, headerFilter, redactedHeaderNames)
         }
         span.end(endTime, spanExit)
       }, 0)

package/src/http/HttpServer.ts

@@ -51,7 +51,7 @@ export class HttpServer extends Context.Service<HttpServer, {
     ): Effect.Effect<
       void,
       never,
-      Exclude<R, HttpServerRequest> | Scope.Scope
+      Exclude<Effect.Services<App>, HttpServerRequest> | Scope.Scope
     >
   }
 

package/src/http/HttpTraceContext.ts

@@ -93,7 +93,7 @@ export const b3: FromHeaders = (headers) => {
     return Option.none()
   }
   const parts = headers["b3"].split("-")
-  if (parts.length < 2) {
+  if (parts.length < 2 || isB3Ids(parts[0], parts[1]) === false) {
     return Option.none()
   }
   return Option.some(Tracer.externalSpan({
@@ -116,7 +116,10 @@ export const b3: FromHeaders = (headers) => {
  * @since 4.0.0
  */
 export const xb3: FromHeaders = (headers) => {
-  if (!(headers["x-b3-traceid"]) || !(headers["x-b3-spanid"])) {
+  if (
+    !(headers["x-b3-traceid"]) || !(headers["x-b3-spanid"]) ||
+    isB3Ids(headers["x-b3-traceid"], headers["x-b3-spanid"]) === false
+  ) {
     return Option.none()
   }
   return Option.some(Tracer.externalSpan({
@@ -130,6 +133,9 @@ export const xb3: FromHeaders = (headers) => {
 const w3cTraceId = /^[0-9a-f]{32}$/i
 const w3cSpanId = /^[0-9a-f]{16}$/i
 
+const b3TraceId = /^(?:[0-9a-f]{16}|[0-9a-f]{32})$/i
+const isB3Ids = (traceId: string, spanId: string): boolean => b3TraceId.test(traceId) && w3cSpanId.test(spanId)
+
 /**
  * Decodes an external span safely from the W3C `traceparent` header.
  *

package/src/http/internal/tracing.ts

@@ -0,0 +1,52 @@
+import type * as Tracer from "../../Tracer.ts"
+import * as Headers from "../Headers.ts"
+
+const defaultPorts: Record<string, number> = {
+  "http:": 80,
+  "https:": 443,
+  "ws:": 80,
+  "wss:": 443
+}
+
+/**
+ * Records the `url.*` and `server.*` attributes for a request URL.
+ *
+ * @internal
+ */
+export const addUrlAttributes = (
+  span: Tracer.Span,
+  url: URL
+): void => {
+  const query = url.search.slice(1)
+  span.attribute("url.full", url.toString())
+  span.attribute("url.path", url.pathname)
+  if (query !== "") {
+    span.attribute("url.query", query)
+  }
+  span.attribute("url.scheme", url.protocol.slice(0, -1))
+  if (url.hostname !== "") {
+    // URL keeps IPv6 brackets in the hostname, but the semantic conventions do not.
+    span.attribute("server.address", url.hostname.startsWith("[") ? url.hostname.slice(1, -1) : url.hostname)
+    const port = url.port === "" ? defaultPorts[url.protocol] : Number(url.port)
+    if (port !== undefined) {
+      span.attribute("server.port", port)
+    }
+  }
+}
+
+/** @internal */
+export const addHeaderAttributes = (
+  span: Tracer.Span,
+  phase: "request" | "response",
+  headers: Headers.Headers,
+  filter: (headerName: string, phase: "request" | "response") => boolean,
+  redactedNames: ReadonlyArray<string | RegExp>
+): void => {
+  for (const name in headers) {
+    if (!filter(name, phase)) continue
+    span.attribute(
+      `http.${phase}.header.${name}`,
+      Headers.isRedactedName(name, redactedNames) ? "<redacted>" : headers[name]
+    )
+  }
+}

package/src/http-api/HttpApiBuilder.ts

@@ -746,7 +746,11 @@ function buildPayloadDecoders(
 ): Map<string, PayloadDecoder> {
   const result = new Map<string, PayloadDecoder>()
   payloadMap.forEach(({ encoding, schemas }, contentType) => {
-    const decode = Schema.decodeUnknownEffect(Schema.Union(schemas), options)
+    const schema = Schema.Union(schemas)
+    const decode = Schema.decodeUnknownEffect(
+      encoding._tag === "FormUrlEncoded" ? Schema.toCodecArrayFromSingle(schema) : schema,
+      options
+    )
     if (encoding._tag === "Multipart") {
       result.set(contentType, { _tag: "Multipart", mode: encoding.mode, limits: encoding.limits, decode })
     } else {