| 90 | * during construction find the no-op tracer instead. |
| 91 | */ |
| 92 | export const makeTelemetryLive = ( |
| 93 | env: Record<string, string | undefined> = process.env, |
| 94 | ): Layer.Layer<never> => { |
| 95 | const target = resolveTarget(env); |
| 96 | if (!target) return Layer.empty; |
| 97 | |
| 98 | const resource = { serviceName: SERVICE_NAME, serviceVersion: SERVICE_VERSION }; |
| 99 | |
| 100 | const TracerLive = OtlpTracer.layer({ |
| 101 | url: target.tracesUrl, |
| 102 | resource, |
| 103 | headers: target.headers, |
| 104 | }); |
| 105 | |
| 106 | const logsUrl = target.logsUrl; |
| 107 | const LoggerLive = logsUrl |
| 108 | ? OtlpLogger.layer({ url: logsUrl, resource, headers: target.headers }) |
| 109 | : Layer.empty; |
| 110 | |
| 111 | console.info( |
| 112 | `[executor] exporting traces to ${target.tracesUrl}${logsUrl ? ` and logs to ${logsUrl}` : ""}`, |
| 113 | ); |
| 114 | |
| 115 | return Layer.merge(TracerLive, LoggerLive).pipe( |
| 116 | // The redacting serialization is the scrub for this exporter path: no |
| 117 | // cloud span processor runs here, so credential-bearing URL components |
| 118 | // (query values, userinfo, fragments) are stripped from the trace and log |
| 119 | // payloads at the serialization seam every exported span and log record |
| 120 | // passes through. Removal only — this path adds no stripped-keys |
| 121 | // diagnostic. |
| 122 | Layer.provide(UrlRedactingOtlpSerializationJson), |
| 123 | // The exporter gets a plain fetch client, deliberately not the guarded |
| 124 | // hosted client: the collector is an address the operator configured, so |
| 125 | // the SSRF guard's job (stopping agent-chosen URLs from reaching the |
| 126 | // private network) does not apply, and applying it would block the most |
| 127 | // common setup of all — a collector on localhost. |
| 128 | Layer.provide(FetchHttpClient.layer), |
| 129 | ); |
| 130 | }; |