// ---------------------------------------------------------------------------// Export-seam redaction for the BROWSER isolate's OTLP pipeline.//// The web client's `OtlpTracer` stamps the same credential-bearing values the// worker's tracer does — `HttpClient` writes `url.full` and `url.query` on// every `http.client` span, and a failed span carries the interpolated log// message, `effect.cause`, and `exception.*` as event text — and ships them to// `/v1/traces`, which the worker forwards to Axiom. The policy is shared with// the Workers isolates (`@executor-js/sdk/shared`); only the seam differs.//// `OtlpTracer` has no processor hook: it builds the OTLP payload itself and// hands it to `OtlpSerialization`. That handoff is the one chokepoint every// exported span crosses, so the redaction wraps the serializer rather than the// tracer — a tracer wrapper would have to re-implement `Tracer.Span`, and a// per-request `HttpClient` transform would only cover the clients someone// remembered to wire it into.// --------------------------------------------------------------------------- import * as Effect from "effect/Effect";import * as Layer from "effect/Layer";import { OtlpSerialization } from "effect/unstable/observability/OtlpSerialization";import type { TraceData } from "effect/unstable/observability/OtlpTracer"; import {  STRIPPED_QUERY_ATTRIBUTE,  redactSpanUrlAttribute,  scrubSpanText,} from "@executor-js/sdk/shared"; /** The OTLP span, taken off `TraceData` rather than redeclared — the payload *  shape is the contract this wrapper sits on. */type OtlpSpan = TraceData["resourceSpans"][number]["scopeSpans"][number]["spans"][number]; /** Rewrite one span's payload in place. The `TraceData` handed to the *  serializer is freshly built per export batch and is not shared with the *  tracer's own span objects, so mutating it affects only what is serialized. * *  An OTLP attribute value is a tagged union (`stringValue`, `intValue`, …); *  only the string arm can carry a URL or free text. */const scrubSpan = (span: OtlpSpan): void => {  const stripped = new Set<string>();  for (const attribute of span.attributes) {    const value = attribute.value.stringValue;    if (typeof value !== "string") continue;    const result = redactSpanUrlAttribute(attribute.key, value);    if (result === null) continue;    attribute.value.stringValue = result.value;    for (const key of result.stripped) stripped.add(key);  }  if (stripped.size > 0) {    span.attributes.push({      key: STRIPPED_QUERY_ATTRIBUTE,      value: { stringValue: Array.from(stripped).sort().join(",") },    });  }  span.events.forEach((event, index) => {    for (const attribute of event.attributes) {      const value = attribute.value.stringValue;      if (typeof value !== "string") continue;      attribute.value.stringValue = scrubSpanText(value);    }    // `name` is readonly on the event, so the entry is replaced rather than    // assigned through — the attribute bags above are shared with the copy.    span.events[index] = { ...event, name: scrubSpanText(event.name) };  });  if (typeof span.status.message === "string") {    span.status.message = scrubSpanText(span.status.message);  }}; /** Wrap an `OtlpSerialization` layer so every span it serializes is scrubbed *  first. Metrics and logs pass through untouched — neither carries a span's *  URL attributes, and the log exporter is not installed on this surface. */export const layerRedacted = (  inner: Layer.Layer<OtlpSerialization>,): Layer.Layer<OtlpSerialization> =>  Layer.effect(    OtlpSerialization,    Effect.map(OtlpSerialization.asEffect(), (serialization) => ({      ...serialization,      traces: (data) => {        for (const resourceSpan of data.resourceSpans) {          for (const scopeSpan of resourceSpan.scopeSpans) {            for (const span of scopeSpan.spans) scrubSpan(span);          }        }        return serialization.traces(data);      },    })),  ).pipe(Layer.provide(inner));