import * as Atom from "effect/unstable/reactivity/Atom";import * as AtomHttpApi from "effect/unstable/reactivity/AtomHttpApi";import { FetchHttpClient, HttpClient, HttpClientRequest } from "effect/unstable/http";import * as HttpClientError from "effect/unstable/http/HttpClientError";import { OtlpSerialization, OtlpTracer } from "effect/unstable/observability";import { ExecutorApi } from "@executor-js/api/client";import * as Cause from "effect/Cause";import * as Effect from "effect/Effect";import * as Layer from "effect/Layer";import * as Option from "effect/Option";import * as Schema from "effect/Schema"; import { reportHandledFrontendError } from "./error-reporting";import { notifyLocalAuthRequired } from "./local-auth";import {  getExecutorServerAuthorizationHeader,  getExecutorTenantApiBaseUrl,} from "./server-connection"; const isApiClientInfrastructureCause = (cause: Cause.Cause<unknown>): boolean =>  Option.match(Cause.findErrorOption(cause), {    onNone: () => false,    onSome: (error) => Schema.isSchemaError(error) || HttpClientError.isHttpClientError(error),  }); export const reportApiClientInfrastructureCause = (cause: Cause.Cause<unknown>) =>  Effect.sync(() => {    if (!isApiClientInfrastructureCause(cause)) return;    reportHandledFrontendError(cause, {      surface: "api_client",      action: "decode_or_transport",    });  }); const isUnauthorizedCause = (cause: Cause.Cause<unknown>): boolean =>  Option.match(Cause.findErrorOption(cause), {    onNone: () => false,    onSome: (error) =>      HttpClientError.isHttpClientError(error) &&      "response" in error &&      (error as { readonly response?: { readonly status?: number } }).response?.status === 401,  }); const handleApiClientCause = (cause: Cause.Cause<unknown>) =>  Effect.suspend(() => {    // A 401 is an expected, handled state — show the local login gate (or, on a    // hosted surface, the session re-auth). It is NOT an infrastructure error,    // so don't surface it as frontend telemetry: that was noise, and via    // globalThis.reportError it also tripped vite's dev error overlay, covering    // the gate. Other causes (schema/transport) still report.    if (isUnauthorizedCause(cause)) {      notifyLocalAuthRequired();      return Effect.void;    }    return reportApiClientInfrastructureCause(cause);  }); // ---------------------------------------------------------------------------// Browser tracing — only when the build names an OTLP endpoint// (VITE_PUBLIC_OTLP_TRACES_URL; e2e points it at a local motel through a// dev proxy). With a Tracer in the runtime, Effect's HttpClient opens an// http.client span around every API request AND sends the W3C traceparent// header, so server spans join the browser's trace — one trace from the// click to the database. Without the env var this is exactly// FetchHttpClient.layer: no tracing code in the hot path.// --------------------------------------------------------------------------- // Plain member access — vite `define` rewrites the exact expression// `import.meta.env.VITE_PUBLIC_OTLP_TRACES_URL`; optional chaining would// dodge the replacement and always read undefined.const otlpTracesUrl = import.meta.env.VITE_PUBLIC_OTLP_TRACES_URL as string | undefined;// Per-SESSION sampling for production: a page either traces everything it// does or nothing (per-span sampling would shred the waterfalls). Unset = 1.const otlpSampleRatio = Number(  (import.meta.env.VITE_PUBLIC_OTLP_SAMPLE_RATIO as string | undefined) ?? "1",); // The tracer must reach the runtime context the atom effects EXECUTE in.// Merging it into the `httpClient` option doesn't: AtomHttpApi builds the// client with `Layer.provide(clientLayer, httpClient)`, which consumes the// tracer during construction without exposing it to the running fibers// (spans then come from the default native tracer — ids and traceparent,// no export). addGlobalLayer is provideMerge'd into every runtime built by// the default factory, which is exactly what AtomHttpApi services use.//// TracerDisabledWhen must be URL-scoped, NOT a blanket `() => true` on the// exporter's client: addGlobalLayer leaks provided references into the// shared runtime context, and a blanket predicate silently disables// tracing for EVERY HttpClient — no spans, no traceparent, no export, no// error. URL-scoped, the leak is the desired behavior: any client posting// to the OTLP endpoint (the exporter) goes untraced, everything else is// traced.// Browser-only (this module is also evaluated during SSR, where the worker// has its own tracer and a relative exporter URL would be meaningless).if (otlpTracesUrl && typeof document !== "undefined" && Math.random() < otlpSampleRatio) {  Atom.runtime.addGlobalLayer(    Layer.mergeAll(      OtlpTracer.layer({        // Relative paths (the prod shape: "/v1/traces" → the worker's        // forwarding route) resolve against the page's own origin.        url: new URL(otlpTracesUrl, window.location.origin).toString(),        resource: { serviceName: "executor-web" },        // Browser sessions are short; the 5s default loses the tail spans        // when the tab closes.        exportInterval: "1 second",      }).pipe(Layer.provide(OtlpSerialization.layerJson), Layer.provide(FetchHttpClient.layer)),      Layer.succeed(HttpClient.TracerDisabledWhen, (request) => request.url.includes("/v1/traces")),    ),  );} // ---------------------------------------------------------------------------// Core API client — tools + secrets// --------------------------------------------------------------------------- const ExecutorApiClient = AtomHttpApi.Service<"ExecutorApiClient">()("ExecutorApiClient", {  api: ExecutorApi,  httpClient: FetchHttpClient.layer,  transformClient: HttpClient.mapRequest((request) => {    let next = HttpClientRequest.prependUrl(request, getExecutorTenantApiBaseUrl());    const authorization = getExecutorServerAuthorizationHeader();    if (authorization) {      next = HttpClientRequest.setHeader(next, "authorization", authorization);    }    return next;  }),  transformResponse: (effect) => Effect.tapCause(effect, handleApiClientCause),}); export { ExecutorApiClient };