[codex] Extract infrastructure, telemetry, and test tooling (#2994)

Co-authored-by: codex <codex@users.noreply.github.com>

Author: juliusmarminge

.env.example

@@ -10,3 +10,8 @@
 
 # Get this from your relay deployment. `infra/relay` deploys update it automatically.
 # T3CODE_RELAY_URL=https://relay.example.com
+
+# Public, ingest-only mobile OpenTelemetry configuration.
+# T3CODE_MOBILE_OTLP_TRACES_URL=https://api.axiom.co/v1/traces
+# T3CODE_MOBILE_OTLP_TRACES_DATASET=t3-code-mobile-traces-dev
+# T3CODE_MOBILE_OTLP_TRACES_TOKEN=xaat-...

apps/mobile/app.config.ts

@@ -161,6 +161,11 @@ const config: ExpoConfig = {
       publishableKey: repoEnv.EXPO_PUBLIC_CLERK_PUBLISHABLE_KEY ?? null,
       jwtTemplate: repoEnv.EXPO_PUBLIC_CLERK_JWT_TEMPLATE ?? null,
     },
+    observability: {
+      tracesUrl: repoEnv.EXPO_PUBLIC_OTLP_TRACES_URL ?? "https://api.axiom.co/v1/traces",
+      tracesDataset: repoEnv.EXPO_PUBLIC_OTLP_TRACES_DATASET ?? null,
+      tracesToken: repoEnv.EXPO_PUBLIC_OTLP_TRACES_TOKEN ?? null,
+    },
     eas: {
       projectId: "d763fcb8-d37c-41ea-a773-b54a0ab4a454",
     },

apps/mobile/src/features/agent-awareness/remoteRegistration.ts

@@ -41,7 +41,7 @@ export function normalizeAgentAwarenessRelayBaseUrl(
 }
 
 function readRelayConfig(): { readonly url: string } | null {
-  const relayUrl = resolveCloudPublicConfig().relayUrl;
+  const relayUrl = resolveCloudPublicConfig().relay.url;
   if (!relayUrl) {
     logRegistrationDebug("relay registration skipped; relay config missing");
     return null;

apps/mobile/src/features/cloud/CloudAuthProvider.tsx

@@ -66,7 +66,9 @@ function CloudAuthBridge(props: { readonly children: ReactNode }) {
 }
 
 export function CloudAuthProvider(props: { readonly children: ReactNode }) {
-  const { clerkPublishableKey: publishableKey, relayUrl } = resolveCloudPublicConfig();
+  const config = resolveCloudPublicConfig();
+  const publishableKey = config.clerk.publishableKey;
+  const relayUrl = config.relay.url;
 
   useEffect(() => {
     if (!publishableKey || !relayUrl) {

apps/mobile/src/features/cloud/linkEnvironment.ts

@@ -50,7 +50,7 @@ export function normalizeRelayBaseUrl(value: string | null | undefined): string
 }
 
 function readRelayUrl(): string | null {
-  return resolveCloudPublicConfig().relayUrl;
+  return resolveCloudPublicConfig().relay.url;
 }
 
 export class CloudEnvironmentLinkError extends Data.TaggedError("CloudEnvironmentLinkError")<{

apps/mobile/src/features/cloud/managedRelayState.ts

@@ -1,31 +1,20 @@
 import { useAtomValue } from "@effect/atom-react";
 import {
   createManagedRelayQueryManager,
-  ManagedRelayClient,
   managedRelaySessionAtom,
   readManagedRelaySnapshotState,
 } from "@t3tools/client-runtime";
 import type {
   RelayClientEnvironmentRecord,
   RelayEnvironmentStatusResponse,
 } from "@t3tools/contracts/relay";
-import * as Context from "effect/Context";
-import * as Effect from "effect/Effect";
-import * as Layer from "effect/Layer";
 import { AsyncResult, Atom } from "effect/unstable/reactivity";
 import { useCallback } from "react";
 
-import { mobileRuntime } from "../../lib/runtime";
+import { mobileRuntimeContextLayer } from "../../lib/runtime";
 import { appAtomRegistry } from "../../state/atom-registry";
 
-const managedRelayAtomRuntime = Atom.runtime(
-  Layer.effect(
-    ManagedRelayClient,
-    mobileRuntime.contextEffect.pipe(
-      Effect.map((context) => Context.get(context, ManagedRelayClient)),
-    ),
-  ),
-);
+const managedRelayAtomRuntime = Atom.runtime(mobileRuntimeContextLayer);
 
 export const managedRelayQueryManager = createManagedRelayQueryManager(managedRelayAtomRuntime);
 

apps/mobile/src/features/cloud/publicConfig.test.ts

@@ -1,6 +1,6 @@
 import { describe, expect, it, vi } from "vite-plus/test";
 
-import { resolveCloudPublicConfig } from "./publicConfig";
+import { hasMobileTracingPublicConfig, resolveCloudPublicConfig } from "./publicConfig";
 
 vi.mock("expo-constants", () => ({
   default: {
@@ -13,9 +13,18 @@ vi.mock("expo-constants", () => ({
 describe("resolveCloudPublicConfig", () => {
   it("returns no cloud configuration for an unconfigured build", () => {
     expect(resolveCloudPublicConfig({})).toEqual({
-      clerkPublishableKey: null,
-      clerkJwtTemplate: null,
-      relayUrl: null,
+      clerk: {
+        publishableKey: null,
+        jwtTemplate: null,
+      },
+      relay: {
+        url: null,
+      },
+      observability: {
+        tracesUrl: null,
+        tracesDataset: null,
+        tracesToken: null,
+      },
     });
   });
 
@@ -24,11 +33,25 @@ describe("resolveCloudPublicConfig", () => {
       resolveCloudPublicConfig({
         clerk: { publishableKey: "  pk_test_example  ", jwtTemplate: "  t3-relay  " },
         relay: { url: " https://relay.example.test/// " },
+        observability: {
+          tracesUrl: " https://api.axiom.co/v1/traces ",
+          tracesDataset: " mobile-traces ",
+          tracesToken: " public-ingest-token ",
+        },
       }),
     ).toEqual({
-      clerkPublishableKey: "pk_test_example",
-      clerkJwtTemplate: "t3-relay",
-      relayUrl: "https://relay.example.test",
+      clerk: {
+        publishableKey: "pk_test_example",
+        jwtTemplate: "t3-relay",
+      },
+      relay: {
+        url: "https://relay.example.test",
+      },
+      observability: {
+        tracesUrl: "https://api.axiom.co/v1/traces",
+        tracesDataset: "mobile-traces",
+        tracesToken: "public-ingest-token",
+      },
     });
   });
 
@@ -39,9 +62,59 @@ describe("resolveCloudPublicConfig", () => {
         relay: { url: "http://relay.example.test" },
       }),
     ).toEqual({
-      clerkPublishableKey: "pk_test_example",
-      clerkJwtTemplate: "t3-relay",
-      relayUrl: null,
+      clerk: {
+        publishableKey: "pk_test_example",
+        jwtTemplate: "t3-relay",
+      },
+      relay: {
+        url: null,
+      },
+      observability: {
+        tracesUrl: null,
+        tracesDataset: null,
+        tracesToken: null,
+      },
     });
   });
+
+  it("rejects an insecure traces URL", () => {
+    expect(
+      resolveCloudPublicConfig({
+        observability: {
+          tracesUrl: "http://api.axiom.co/v1/traces",
+          tracesDataset: "mobile-traces",
+          tracesToken: "public-ingest-token",
+        },
+      }).observability,
+    ).toEqual({
+      tracesUrl: null,
+      tracesDataset: "mobile-traces",
+      tracesToken: "public-ingest-token",
+    });
+  });
+
+  it("keeps tracing disabled unless every public tracing value is configured", () => {
+    expect(hasMobileTracingPublicConfig(resolveCloudPublicConfig({}))).toBe(false);
+    expect(
+      hasMobileTracingPublicConfig(
+        resolveCloudPublicConfig({
+          observability: {
+            tracesUrl: "https://api.axiom.co/v1/traces",
+            tracesDataset: "mobile-traces",
+          },
+        }),
+      ),
+    ).toBe(false);
+    expect(
+      hasMobileTracingPublicConfig(
+        resolveCloudPublicConfig({
+          observability: {
+            tracesUrl: "https://api.axiom.co/v1/traces",
+            tracesDataset: "mobile-traces",
+            tracesToken: "public-ingest-token",
+          },
+        }),
+      ),
+    ).toBe(true);
+  });
 });

apps/mobile/src/features/cloud/publicConfig.ts

@@ -2,40 +2,92 @@ import Constants from "expo-constants";
 import { relayClerkTokenOptions } from "@t3tools/shared/relayAuth";
 import { normalizeSecureRelayUrl } from "@t3tools/shared/relayUrl";
 
-type ExpoExtra = Readonly<Record<string, unknown>> | undefined;
-
 export interface CloudPublicConfig {
-  readonly clerkPublishableKey: string | null;
-  readonly clerkJwtTemplate: string | null;
-  readonly relayUrl: string | null;
+  readonly clerk: {
+    readonly publishableKey: string | null;
+    readonly jwtTemplate: string | null;
+  };
+  readonly relay: {
+    readonly url: string | null;
+  };
+  readonly observability: {
+    readonly tracesUrl: string | null;
+    readonly tracesDataset: string | null;
+    readonly tracesToken: string | null;
+  };
 }
 
+type UntrustedSection<T> = {
+  readonly [Key in keyof T]?: unknown;
+};
+
+type ExpoExtra =
+  | {
+      readonly [Section in keyof CloudPublicConfig]?: UntrustedSection<CloudPublicConfig[Section]>;
+    }
+  | undefined;
+
 function trimNonEmpty(value: unknown): string | null {
   return typeof value === "string" && value.trim() ? value.trim() : null;
 }
 
-export function resolveCloudPublicConfig(extra: ExpoExtra = Constants.expoConfig?.extra) {
-  const clerk = extra?.clerk as
-    | { readonly publishableKey?: unknown; readonly jwtTemplate?: unknown }
-    | undefined;
-  const relay = extra?.relay as { readonly url?: unknown } | undefined;
+function normalizeSecureUrl(value: unknown): string | null {
+  const raw = trimNonEmpty(value);
+  if (raw === null) {
+    return null;
+  }
+  try {
+    const url = new URL(raw);
+    return url.protocol === "https:" ? url.toString() : null;
+  } catch {
+    return null;
+  }
+}
 
+export function resolveCloudPublicConfig(extra: ExpoExtra = Constants.expoConfig?.extra) {
   return {
-    clerkPublishableKey: trimNonEmpty(clerk?.publishableKey),
-    clerkJwtTemplate: trimNonEmpty(clerk?.jwtTemplate),
-    relayUrl: normalizeSecureRelayUrl(trimNonEmpty(relay?.url) ?? ""),
+    clerk: {
+      publishableKey: trimNonEmpty(extra?.clerk?.publishableKey),
+      jwtTemplate: trimNonEmpty(extra?.clerk?.jwtTemplate),
+    },
+    relay: {
+      url: normalizeSecureRelayUrl(trimNonEmpty(extra?.relay?.url) ?? ""),
+    },
+    observability: {
+      tracesUrl: normalizeSecureUrl(extra?.observability?.tracesUrl),
+      tracesDataset: trimNonEmpty(extra?.observability?.tracesDataset),
+      tracesToken: trimNonEmpty(extra?.observability?.tracesToken),
+    },
   } satisfies CloudPublicConfig;
 }
 
 export function hasCloudPublicConfig(): boolean {
   const config = resolveCloudPublicConfig();
-  return Boolean(config.clerkPublishableKey && config.clerkJwtTemplate && config.relayUrl);
+  return Boolean(config.clerk.publishableKey && config.clerk.jwtTemplate && config.relay.url);
+}
+
+type Configured<T> = {
+  readonly [Key in keyof T]: NonNullable<T[Key]>;
+};
+
+type MobileTracingPublicConfig = Omit<CloudPublicConfig, "observability"> & {
+  readonly observability: Configured<CloudPublicConfig["observability"]>;
+};
+
+export function hasMobileTracingPublicConfig(
+  config: CloudPublicConfig = resolveCloudPublicConfig(),
+): config is MobileTracingPublicConfig {
+  return Boolean(
+    config.observability.tracesUrl &&
+    config.observability.tracesDataset &&
+    config.observability.tracesToken,
+  );
 }
 
 export function resolveRelayClerkTokenOptions() {
-  const { clerkJwtTemplate } = resolveCloudPublicConfig();
-  if (!clerkJwtTemplate) {
+  const { jwtTemplate } = resolveCloudPublicConfig().clerk;
+  if (!jwtTemplate) {
     throw new Error("T3CODE_CLERK_JWT_TEMPLATE is not configured.");
   }
-  return relayClerkTokenOptions(clerkJwtTemplate);
+  return relayClerkTokenOptions(jwtTemplate);
 }

apps/mobile/src/features/observability/mobileTracing.test.ts

@@ -0,0 +1,52 @@
+import { expect, it } from "@effect/vitest";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import { vi } from "vite-plus/test";
+
+import { remoteHttpClientLayer } from "@t3tools/client-runtime";
+
+import { makeMobileTracingLayer } from "./mobileTracing";
+
+vi.mock("expo-constants", () => ({
+  default: {
+    expoConfig: {
+      extra: {},
+    },
+  },
+}));
+
+it.effect("exports spans through the scoped mobile OTLP layer", () => {
+  const fetchFn = vi.fn<typeof fetch>(async () => new Response(null, { status: 202 }));
+  const tracingLayer = makeMobileTracingLayer(
+    {
+      tracesUrl: "https://api.axiom.test/v1/traces",
+      tracesDataset: "mobile-traces",
+      tracesToken: "public-ingest-token",
+    },
+    {
+      appVariant: "test",
+      serviceVersion: "1.2.3",
+    },
+  ).pipe(Layer.provide(remoteHttpClientLayer(fetchFn)));
+  const tracedApplication = Layer.effectDiscard(
+    Effect.void.pipe(Effect.withSpan("mobile.test.span")),
+  ).pipe(Layer.provide(tracingLayer));
+
+  return Effect.gen(function* () {
+    yield* Layer.build(tracedApplication);
+
+    expect(fetchFn).not.toHaveBeenCalled();
+  }).pipe(
+    Effect.scoped,
+    Effect.andThen(
+      Effect.sync(() => {
+        expect(fetchFn).toHaveBeenCalledOnce();
+        const [url, init] = fetchFn.mock.calls[0]!;
+        expect(String(url)).toBe("https://api.axiom.test/v1/traces");
+        expect(new Headers(init?.headers).get("authorization")).toBe("Bearer public-ingest-token");
+        expect(new Headers(init?.headers).get("x-axiom-dataset")).toBe("mobile-traces");
+        expect(new TextDecoder().decode(init?.body as Uint8Array)).toContain("mobile.test.span");
+      }),
+    ),
+  );
+});